diff --git a/.gitignore b/.gitignore
index 41804b5ea8..25f59eee75 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,7 @@ examples/react-native/shopping-list/ios/
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
 tsconfig.vitest-temp.json
+
+# The part-reach oracle lints scratch programs inside the repository; an
+# interrupted run can leave them behind.
+/part-reach-scratch-*/
diff --git a/AGENTS.md b/AGENTS.md
index 3225c4f830..e9dabc568d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -138,9 +138,10 @@ the harness's own edit tools make. After an edit through a shell command, or
 in a harness without these hooks, run `pnpm lint:changed` before you finish.
 
 The end-of-turn hook and `pnpm lint:changed` also report every oracle run
-budget that the branch lowered, and CI prints it as a warning. A lowered
-budget can be deliberate. Restore it, or explain the reason in the pull
-request.
+budget that the branch lowered or removed, and CI prints it as a warning. A
+budget is removed when its key is in no oracle file, or in a module that an
+oracle file imports, any more. A lowered or removed budget can be deliberate.
+Restore it, or explain the reason in the pull request.
 
 Fix a report. Do not turn the rule off. The hooks, `pnpm lint:changed`, the
 pre-commit hook, and CI ignore `eslint-disable` comments for these rules. A
@@ -729,6 +730,15 @@ Modules that define the model, checker, or its history grammar also qualify.
 Identify the actual mechanism before renaming a file. A coverage-map entry,
 contract comment, or collection of fixed assertions is not sufficient evidence.
 
+An oracle file holds only oracle tests. It declares its check, model, and history
+grammar with `declareOracle` from `packages/db/tests/oracle-declaration.ts`. A
+type-level oracle names its model types in `typeModel`. Each
+part is optional. Every test in the file must use a declared part, directly
+or through a driver, or run a generated property that states its law inline.
+A test that compares production with a hand-written value is a unit test:
+put it in an ordinary test file. The `oracle/no-unit-test` lint rule reports
+a test that does neither.
+
 Ordinary example tests, type assertions, fixtures, registration wrappers, and
 runner utilities keep their ordinary names. A module that only drives production
 or records observations is not an oracle definition. Report oracle owners and
diff --git a/docs/contributing/oracle-coverage.md b/docs/contributing/oracle-coverage.md
index 9944a382f2..b6d649ada2 100644
--- a/docs/contributing/oracle-coverage.md
+++ b/docs/contributing/oracle-coverage.md
@@ -78,7 +78,10 @@ The Convex package has these independent judgments:
   the new revision appears. Pending ranges retain the prior complete snapshot.
   Split cursors stay inside their returned page ranges. The accepted-row bound
   rejects over-cap results without partial publication; the omitted-option
-  default accepts exactly 10,000 rows and rejects 10,001.
+  default accepts exactly 10,000 rows and rejects 10,001. The default-cap
+  boundary, invalid `maxRows` rejection, and cleanup-failure fidelity are fixed
+  tests in `packages/convex-db-collection/tests/pagination.test.ts` (fixed tests;
+  no oracle owner (tracked in #2264)).
   Its initial-materialization work law also varies 3-40 pages and 1-8 rows per
   page. The original implementation copied incomplete prefixes and failed at
   seed 20261022/path 0:0:0:0. The repaired fixed/random campaigns copy each
@@ -112,6 +115,9 @@ CONVEX_VALUES_ORACLE; ownership uses CONVEX_OWNERSHIP_ORACLE.
 
 `packages/convex-db-collection/e2e/backend-oracle.test.ts` receives these contracts
 at an actual isolated local Convex backend using both Convex 1.47.0 SDK clients.
+Its row-bound rejection is a fixed test in
+`packages/convex-db-collection/e2e/backend.test.ts` (fixed tests; no oracle owner
+(tracked in #2264)).
 It compares pagination with a separately evaluated unpaginated server query,
 including real server-generated split responses. Its durable driver runs fixed
 and random insert/update/delete histories through SIGKILL after disk admission and, optionally,
@@ -162,8 +168,9 @@ Both public-app fixtures deploy with this package's installed Convex 1.47 SDK.
 The pagination app's upstream package declares 1.48, its business functions are
 unchanged here but its original dependency installation is not being tested.
 
-`packages/convex-db-collection/e2e/backend-startup-oracle.test.ts` owns the
-receiving fixture's occupied-port startup judgment. It holds the former fixed
+`packages/convex-db-collection/e2e/backend-startup.test.ts` (fixed tests; no
+oracle owner (tracked in #2264)) covers the receiving fixture's occupied-port
+startup judgment. It holds the former fixed
 pagination port, invokes the actual pinned public-app setup, and requires a
 different loopback URL serving a fresh empty query. Expected availability comes
 from an independently held listener, not a copy of CLI selection logic. An
@@ -219,6 +226,9 @@ rejected acquisition/unload, held initial/moved/repaired windows, cache-before-
 callback refetch, abort before/after acceptance, held cleanup/restart, and two
 real applied receipts across publication reentry. Duplicate pending request
 objects retain both waiters. An invalid lazy startup never publishes readiness.
+Malformed order declarations are fixed tests in
+`packages/convex-db-collection/tests/lazy-paging.test.ts` (fixed tests; no oracle
+owner (tracked in #2264)).
 
 The [October 27 strengthening record](oracle-reviews/2026-10-27-convex-lazy-paging.md)
 supersedes those historical source bindings for the current files. The native
@@ -506,10 +516,10 @@ that test identifiers must copy production's private data structures.
 | Surface                                  | Status                                                         | Completed or next owner                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | ---------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Ordered relations and BTree              | Complete                                                       | The signed top-K relation, BTree/Map refinement model, and DBSP incrementalization laws are literate.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| D2 operator work                         | `packages/db-ivm/tests/d2-work-oracle.test.ts`                 | A finalized 65-branch graph receives one direct input at the first, middle, or last branch, then a second input on a different branch. The oracle compares exact forwarded messages and operator invocations after each `run()`: branches without queued input perform no operator work. A connected reversed-registration pair must drain in the same run, and an empty unfinalized graph rejects. The old unconditional loop fails with 64 idle calls per turn. This bounded work check does not establish elapsed latency, fused operators, arbitrary graph topologies, or provider-level live-query work.                                      |
+| D2 operator work                         | `packages/db-ivm/tests/d2-work.test.ts` (fixed tests; no oracle owner (tracked in #2264))                 | A finalized 65-branch graph receives one direct input at the first, middle, or last branch, then a second input on a different branch. The test compares exact forwarded messages and operator invocations after each `run()`: branches without queued input perform no operator work. A connected reversed-registration pair must drain in the same run, and an empty unfinalized graph rejects. The old unconditional loop fails with 64 idle calls per turn. This bounded work check does not establish elapsed latency, fused operators, arbitrary graph topologies, or provider-level live-query work.                                      |
 | Includes and publication                 | Complete, [facade rollback](https://github.com/TanStack/db/blob/main/packages/db/tests/query/bucket-facade-rollback-oracle.property.test.ts) ([review](oracle-reviews/perf-lazy-bucket-rollback-copy.md)) | The central recomputation model plus cross-formulation, temporal demand, layered publication, Collection facade lifecycle and space bounds, route-context transport, functional projection, query-shape, optimistic, and source-work owners are literate. They keep the architecture document as their contract source. A failed facade flush restores every facade it wrote, disposes the facades it created, publishes no event or layout revision, and reads the stored rows of no other facade; nested facades across two edges have a pinned witness. The grammar adds optimistic facade inserts and optimistic deletes of shown graph rows; a retired facade must show exactly its visible optimistic rows, and every history ends by settling them and comparing all rows again. A facade commit that throws before committing is generated, and the restore must commit the open sync transaction. Every change pending at a failed root commit, child rows included, stays pending, and the next flush publishes it once. Open: the flush's edge and bucket map copy is unmeasured bookkeeping; disposal between a flush and its rollback has pinned witnesses only; held facade commits are generated one hold at a time for up to three flushes, and a release that covered earlier flushes checks rows only; the grammar also cleans up a shown facade from outside, lets optimistic rows share graph ids and later rolls them back, after which those keys are compared by value; a holder's cleanup of a shown facade rejects (code 241) and the facade keeps receiving the graph's writes; retiring a shown bucket without the graph's retractions is generated (`contradict`) and throws code 240; optimistic deletes and updates of shown graph rows are generated, and an update's copy keeps the row's key; a facade that `resolve()` created before activation can stay ready and empty after a failed flush (recorded limit). |
 | Collection lifecycle                     | Complete                                                       | The shared logical-owner/acquisition-attempt/sync-run grammar plus mutation admission, lifecycle trace, publication, replay, disposal, and transaction-refinement boundaries are literate. The lifecycle history driver checks law 13 at every command: an attempt that settled without an abort keeps no core abort listener on its signal (RED on d0cde4778 in 36 histories; a mutant that keeps the replay participant's listener fails 33). `parkedReloadDemandCases` drives a demand parked behind a failed first load through a reload whose new run marks ready, commits a snapshot inside `sync()` before or after `markReady()`, or commits it after the first load settled: one `loadSubset` per replay attempt that starts work and one `unloadSubset` per replaced acquisition (RED on d0cde4778 for `ready-then-snapshot`: two loads and one unload, because the restart joined the attempt before the attempt's own setup ran; a mutant without the per-attempt check fails it). Limits: these are four fixed histories, not generated; a second reload and asynchronous failures are outside them.                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| Collection status and health tree | `packages/db/tests/source-health-oracle.test.ts` (`source-health.history`) | An independent per-Collection model of the first-load gate, `failureReason` and stopped `error` slots with serials and each slot's frame of failures (maintainer decision: a problem shows its newest failure and lists its frame in `errors`; a failure reason's frame is its sync run's reports until `reportHealthy()`, once per error value, less each failure `reportHealthy(error)` removed, and a reload's new run that reports starts a new one), crashes, and reloads derives each live query's status and expected health tree for direct, join, self-join, nested, include, and pooled-nested shapes. Generated histories cross `ready`, `fail`, `report`, `healthy`, `crash`, `reload`, `reload-cleanup-fails` (a retired cleanup that rejects crashes the Collection), `reload-cleanup-held` and `retired-cleanup-rejects` (a retired run's cleanup that rejects later still crashes the Collection, also after a cleanup and a fresh start: the adapter broke its contract for that Collection, by maintainer decision), `cancel` (a commit with an aborted signal changes nothing), `reload-query` (a query's `reload()` reaches every Collection below it that shows an `error`, through nested queries; a crashed query rejects without touching its sources), `cleanup-reload` (cleanup, a fresh start, and a reload in one tick: the cleaned-up run's reload decides nothing for the new one), `snapshot` (`begin({ snapshot: true })` replaces every row at its commit, at any time, also when the reload fails or the Collection crashes before that commit; maintainer decision: only a snapshot or the adapter's `truncate()` replaces rows, and every other write of a reload's new run applies on the kept rows), `mark-ready` (a reload without a snapshot completes at the new run's `markReady()` and keeps the rows; a run's `markReady()` after it is ready or after its `fail()` does nothing, by maintainer decision), `reload-ready-throws` (a first-ready callback that throws while a reload's new run marks ready inside `sync()`, also when the reload starts a cleaned-up Collection through its preload, is reported uncaught and the Collection stays ready, by maintainer decision), and restart. A second `fail()` in a sync run does nothing. A `problem values` lane checks that `fail()`, `reportError()`, and a crash behave the same for any value, also one that cannot describe itself. The Effect lane checks that a problem a source already shows when the Effect's gate opens reaches `onHealthChange` once, that a healthy gate announces nothing, and that each later change is one call. The `effect healthy gate` lane crosses where the gate opens: at the Effect's start, inside an eager source's, a nested query's, or a join's second source's `status:change`, or when an on-demand load settles. A healthy gate that announced its own tree for the status change that opened it failed the three `status:change` openers; an Effect that skips its first healthy change fails the on-demand opener. The lazy grammar's `reload-in-load` checks that a reload from inside the adapter's `loadSubset` rejects and leaves the query running. A query-db receiving witness checks that a direct insert, update, or delete during a reload applies on the kept rows, because it is not a snapshot, and ends with the same rows as during a refetch in flight. A second query-db receiving witness, `housekeeping during a reload` (`query-db.reload-housekeeping`), checks that Query Collection's retention housekeeping keeps the rows during a reload of an eager persisted Collection: an expired persisted retention entry is removed by its expiry timer or by the new run's startup maintenance while the new run's Query fetch is held, and the rows stay, the reload stays in flight, and it ends with the same rows as a refetch. A fourth kind, `expiry-timer-lagging-clock`, makes the expiry timer fire before `Date.now()` reaches `expiresAt`; the entry must still expire in that run, and a callback that drops the early timer fails every time (this was a CI flake and a production bug). The reach counts only begins of the run after the retired one, and the window is observed by polling until the entry is gone. A housekeeping `begin()` marked `snapshot: true` fails it: it replaces the kept rows with none. A third kind, `release-at-startup`, reaches the retention entry that a subset release writes: during a reload of an on-demand persisted Collection, the driver requests and releases a fresh subset through a change subscription in every microtask turn until the new run's `markReady()`, and in the turns after its startup retention maintenance settles each release writes its entry while the reload is in flight; the rows stay and the reload stays in flight in every turn, and it ends with the same rows as a refetch. A retention write marked `snapshot: true` fails it. Release of a Query's rows also begins a housekeeping transaction, but no legal history begins it in the new run while the reload is in flight: core runs the run's cleanup only after retiring its callbacks, and a release takes that path only without a persistence capability, where Query Collection writes no retention entry, so the new on-demand run calls `markReady()` inside `sync()`; a snapshot there is an equivalent mutant for the lane. The lazy grammar's `deferredStart` dimension starts the child the way a persisted Collection does, after the query asked for data, so every lazy history can begin with a first load that enters the adapter from the deferred start; with `reload-in-first-load` that load calls `reload()`, which must reject (a deferred call that skips the guard fails the generated property, shrunk to the empty history). The lazy join grammar checks which request error the query's node shows after every step: every failure has its own message, and the model shows the newest open failure by the order failures became request errors (maintainer decision). It also compares the node's `errors` with the model's frame after every step: every open request failure once, oldest first, each the very value the adapter failed with; a shared error keeps the place of its first failure, and a failed replay lists its failures in failure order, with the newest on top (maintainer decision; the subscription's own replay error stays its earliest held failure). The window grammar makes the same comparison. A replay's verdict decides every request error of the demand it replayed (maintainer decision: coarse verdict): loads that settle while it is judged decide none themselves, its success clears them all, and its failure replaces them with its failures, every failed load of its current attempt that the query still holds for a key that no later held load loaded. Closed from 30-times runs, each now a named history: a query's reload passes through a nested query that a cascade ended, which is a Collection below it that shows A's error, so that inner query's own reload reloads A and starts it, also when another source's reload rejects and the outer query does not start (`a query reload starts an ended nested query even when another source rejects`; the model had reloaded A past the ended inner query). A synchronous throw from `loadSubset` is a rejection (maintainer decision): the lazy driver's `throw-next` failure holds its demand, so the next demand change or replay requests its key again, and the churn replacement twins (`a churn replacement that throws|rejects leaves its key to the older load after the next demand change`) must agree; the driver sees the abort that releases a thrown load's demand. A replay load the query released does not count for the replay's verdict, even when it loaded its keys before the release (law 9: the replay succeeds only as a replacement for the demand that remains; `a released replay load's success does not count for the replay's verdict`; model). A failed replay request that the query released holds nothing, so a parked demand change that asks for its key again parks it (law 9; `a parked growth asks again for a key whose released replay request failed`; model). The main grammar projects every problem's `errors` (messages, order, and which report each cause is) and rejects a problem whose `message`, `cause`, or `at` is not its newest failure's; it checks that a legal `report` or `healthy` announces one `health:change` (a self-join announced two, one per alias, before the relay was registered once per Collection). The demand model treats a replay's failed request of a parked acquisition, which never loaded, as that demand's own failed first load: it covers nothing, and the next demand change parks a retry that holds the failed replay open (law 10; a 30-times counterexample on b521d29d9 of the model, which let the request cover the key, pinned as `a demand change retries a parked key whose replay request failed`; a production mutant that retires the failed segment without a retry fails it and 12 other lazy histories). The `request error bookkeeping` property checks the shared tracker's listed causes and its change result, including a request with several failures. Its `fail-again` step fails an issuer again with every cause it still lists and one new cause, as a replay's later verdict does: a cause still open keeps the place of its first failure (law 17; RED on d0cde4778, which released the issuer's causes before it counted the new list). The lazy and window grammars make `Date.now()` strictly increasing and check every request error's `at` after each step: a failure the model did not show anew keeps the `at` the node showed for it (RED on d0cde4778 in the named history `a failed replay's error stays when parked demand retires after the child restarts` and in the generated lazy property; reach `replay verdict lists an open failure again`, entered by a prefix in which a parked demand joins a failed replay; a mutant that clears the verdict's request errors before it reports its failures fails the named history). Both grammars also check that no `health:change` of a ready query repeats the tree before it. Open (R18, maintainer decision pending on code weight): a replay's verdict, and a lazy load or demand change that decides several keys, announce once per request error they change, so a listener sees intermediate trees (a verdict that replaces key errors with its failures first shows them cleared); a check that every announcement shows a request error frame the model held fails on d0cde4778 (for example `a failed replay's verdict replaces an earlier open failure`, step 5) and passes with a lifecycle `changeRequestErrors(change)` batch that costs about +57 B gzip, so it is not committed. Limits: these announcement checks skip trees whose query is not ready, because a source crash makes the query announce the same crashed tree twice in one step (seen on d0cde4778 at the lazy grammar's `crash` step); the main grammar owns crash announcements and does not count them. Not fixed (R3, R5): during a reload, before it completes, the new run's `reportHealthy()` clears the retired run's failure reason, and a query's own reload drops the retired run's request errors at the new run's first request error; the main and window models encode that behavior, which is in tension with law 16 ("a reload keeps the node's problems until it completes"), and needs a maintainer decision. Not reached (R8): a retired run's committed but unapplied truncate, from a listener that reenters during `commitPendingTransactions`, can complete the new run's reload. A deterministic work witness (`request-errors-work.test.ts`) bounds one failed 2,000-key segment's report-and-settle work at 20·K visits; the original scan-and-sort tracker used 14,007,001. A lazy named history pins that a demand change which retires a fragmented-churn replacement and another segment, while the replaced segment's replay load has failed, fails the replay for the still-held key (laws 9 and 16); the subscription lifecycle owner's demand-change grammar generates the class. A failed replay does not list the failure of a load the query released before the verdict (law 16; glossary request error: it clears when its demand retires); the named history `a failed replay does not list a load the query released before its verdict` fails on the model that listed it and on a production mutant that keeps a released demand's failure. A cleanup during a reload (ARCHITECTURE law 14; maintainer decision that a reload ends with its run) is a generated step in two grammars. The main grammar's `cleanup-during-reload` runs `cleanup({ dependents: true })` from the Collection's or the dependent query's `health:change` while `reload()` announces `reloading: true`. The lazy grammar's `ending` runs `cleanup()` or `cleanup({ dependents: true })` from those, from the Collection's `loadingSubset:change`, or from a change subscription's `status:change` while the reload retires its demand. In both, the model is an ordinary cleanup: no sync run stays live at the adapter, a reload in flight rejects, the Collection ends `cleaned-up`, and a later fresh start's commit is its diff baseline. Setting the epoch after the reload's announcement, or the truncate after the run's retirement, fails 12 histories; restoring the old flag order, or dropping the epoch return, fails the subscription-status ending. Cleanup from the retired run's adapter cleanup function or from the new run's `sync()` is outside this lane. A cleanup of a Collection that a cleanup during a reload left `cleaned-up` has no run to wait for and settles at once; the driver holds an adapter cleanup only while a run is live (a 30-times counterexample of the driver). Focused witnesses check that a reload from inside a `loadSubset` call the deferred start runs rejects, that a cleanup run from a subscription's status listener while a reload retires the run ends that reload with its run (no sync run starts and no replacement stays armed), and that a lazy join load that fails after readiness, under an ordered window that filters on it, publishes the output it held. The main grammar also compares the query's row count at the `status:change` that makes it ready with the count the step leaves (law 9): A's truncate commit that marks A ready while the nested shape's outer query waits for its inner query reaches it, in the first load and in a reload of a failed first load; a completion check that ignores the graph's pending work fails it. Limits: row count only, not identity. After every step the check compares status, rows, the projected tree, node identity, `status:change`/`health:change` order, and `findProblems()`. Named histories pin a reload's new-run `failureReason` surviving its completion. Focused lanes cover request errors, overlapping root loads (a request error clears only when a load started after the failure succeeds; 8 histories plus a later clearing load), a query's own failed first load not restarting when an unrelated source becomes ready, reload invariant witnesses (the retired run's open sync transaction is dropped; a canceled reload commit changes nothing and the reload keeps the rows; a diffing adapter sees an empty baseline inside a reload's snapshot), and Effect disposal on a failed first load or crash. The shared framework conformance scenarios `sync-errors-after-readiness` and `crashed-status` judge the hooks; `sync-errors-after-readiness` reads a two-failure `failureReason.errors` and a one-failure `error.errors` through every framework driver. Adapter receivers for reload after a failed first load (the new run's own readiness decides it, not Collection status): query-db, RxDB, and PowerSync focused tests, Electric's integration test, and TrailBase's lifecycle lane. Adapter receivers for reload of a ready Collection (maintainer decision F19: the reload keeps the rows until it completes; only a `begin({ snapshot: true })` transaction or the new run's own `truncate()` replaces them; every other write applies on them): Electric's integration tests `reload of a ready Collection` (a resumed stream with no changes, or with an update, a delete, and an insert, applies them on the kept rows and completes at up-to-date; a stream that cannot resume replaces the rows with its fresh snapshot; a must-refetch keeps the rows through its reset-marker commit and replaces them at its snapshot) and `an on-demand reload keeps its rows and ends with the source's rows` (resumed or not: the replayed subset's rows apply on the kept rows, and the adapter writes an update for a kept key, since core no longer rewrites a kept-key insert and sweeps nothing; the adapter owns removing rows deleted while no stream listened, [#2269](https://github.com/TanStack/db/issues/2269)), and `a progressive reload that cannot resume keeps its rows through a subset load` (no kept row vanishes before the atomic swap, the kept key takes the source's value, the live query has no error; it failed on the parent core with DuplicateKeySyncError); query-db `a reload of a ready eager|on-demand Collection keeps its rows and ends as a refetch does`; PowerSync `eager mode: a reload of a ready Collection keeps its rows and ends with the table` (three batches in one snapshot transaction); RxDB `a reload of a ready Collection keeps its rows and ends with the documents` (a first run that missed changes; two fetch batches); and TrailBase's lifecycle lane `a reload of a ready eager Collection` (10 histories; see its ORACLE.md). On the parent core, Electric's resumed and must-refetch cases, query-db on-demand, PowerSync, and TrailBase's two-page cases fail; RxDB's passes and guards the port. Each of these mutants fails them: a resumed Electric run whose first commit replaces rows; a fresh Electric, PowerSync, or RxDB load without a snapshot; and a query-db housekeeping or direct write marked `snapshot: true`. A reload keeps every row its new run does not rewrite, and core deletes no kept row on its own (maintainer decision; removing a row the backend deleted is the adapter's job, [#2269](https://github.com/TanStack/db/issues/2269)); the adapters' own on-demand reload receivers belong to their packages. Adapter receivers for an on-demand reload (maintainer decision: no core sweep; a held key is written as `update`; issue #2269): Electric `an on-demand reload keeps its rows and ends with the source's rows` (resumed: deleted rows go through the log; cannot resume: a row deleted while no stream listened stays), query-db `a reload of a ready on-demand Collection keeps its rows and ends as a refetch does` (row ownership removes the deleted row), PowerSync `an unchanged row survives an on-demand reload` (the adapter's own tracking removes the deleted row), and the TrailBase lane `an unchanged row survives an on-demand reload` (a row deleted with no event stays). Without Electric's `syncedKeys` seed and its update-for-held-key write, its non-resumed and progressive witnesses fail. Subset snapshot rows go through the same `syncedKeys` check as stream rows. PowerSync `eager mode: a reload whose later batch fails keeps the rows and the next reload ends with the table` checks core state: no open transaction remains and the accepted rows equal the kept rows; a snapshot begun before the batches fails it. Abort receivers (an abort ends the load): Electric, PowerSync, TrailBase, and query-db `an aborted load writes no rows and its late result changes nothing`; each fails under a mutant that ignores the signal at that adapter's stop point. Limits: an Electric abort while a request is in flight still lets the SDK publish its rows; query-db applies a late result after an abort without `unloadSubset` (a replay replacing the load within a run), whose data is current, so it costs a write, not correctness; RxDB has no on-demand path. Electric's `a ready after the stream gave up changes nothing` witnesses that `markReady()` after the run's `fail()` is a no-op (F6): the SDK gives up while a ready run's up-to-date commit waits for a wrapping sync's acceptance, and the acceptance arrives afterwards; there is no unhandled rejection and no status or health change. It fails on the parent core with an unhandled `CollectionStateError`. Limits: the progressive and on-demand Electric witnesses are fixed examples, not generated histories. A joined-filter lane checks that a failed join load lets an ordered window move again. An Effect has no request errors: a failed load after its gate still ends it, and the Effect load-failure lane checks that. An on-demand reload lane crosses the new run's first commit (an empty `markReady()` or a row commit inside `sync()`, or `markReady()` after it returns) with an unfiltered and a filtered query. While the new run's loads are in flight, it checks that the query keeps the old run's rows and that a direct read shows the kept rows with the new run's own commit on top (no snapshot came). After the loads settle, it checks the new run's rows. A late-first-load lane enumerates an on-demand Collection that fails its first load, stops after readiness, or crashes after a direct or joined query is ready, then calls the query's `reload()`. A query that follows its source into `error` after showing data fails it, and so does a query reload that skips a source still in its first load. A focused RxDB test checks that a change-stream error calls `fail()` before and after readiness. The generated grammar also keeps each Collection's rows and the sync run's open transaction: `write` and `commit` steps span other steps, the driver writes like a diffing adapter, a `write` can omit the `tag` field (an update merges into the row, an insert replaces it, also when a failed reload's open transaction applies on the kept rows), and after every step the check compares rows, the adapter's baseline, the query's rows, a direct subscriber with the initial state on each source when the history includes one (its rows equal the Collection's within one Collection lifetime, also while a reload is in flight or after it fails; a source that starts again after cleanup gets a fresh one), and an Effect over A (ended, source errors, listeners left). `cleanup-hold` and `cleanup-settle` steps run every other step while adapter cleanup is pending, including a crash, a new Effect, and the query's reload, which restarts a query a cascade ended. A second generated property, `source-health.on-demand`, drives a root window over an on-demand Collection: window moves, settle-all outcomes, source reloads, and the source's own calls, with requested loads reported from the adapter boundary; it checks the query's status, its request error, the source's node, and the window's rows. A third, `source-health.lazy-demand`, drives an eager parent Collection left-joined to an on-demand child Collection: parents come and go, loads settle ok or failed, the child source reloads, and the source makes its own calls; the driver reports each load's requested keys from the adapter boundary. It checks the query's status, its request error (which clears when a later load of the failed key succeeds or when the query no longer needs that key), and each parent's child. The lazy and window drivers can add a direct subscriber with the initial state on the on-demand source (its rows equal the Collection's at every step; the driver answers its own requests at once), and the lazy driver can add an Effect over the same join (at quiet checkpoints it has the query's rows; a delete that a later insert undoes between checkpoints is not observed). The lazy driver also crosses a child that holds `markReady()` until a `child-ready` step, so the child can be `loading` or fail its first load when it reloads, a reload stays in flight past its new run's first commit, and a second `reload()` returns the first one's promise; and the child adapter's own `truncate()` (a must-refetch in the same sync run, also while a reload is in flight: its replay requests every needed key, also one whose load threw, and a demand change's replacement that applies releases the coverage it replaces), loads that throw, and source reloads during the first load: the first load waits for the whole replay, and a replay fails only for a key the query still needs when it is judged. The child adapter honours aborts; an adapter that ignores them is outside the contract (maintainer decision: an abort ends the load). In the on-demand lane, a window move after a failed replay waits for the next successful replay, and a later reload aborts it. A reload starts its replay when it retires the sync run, so a load the reload aborted is over and its consumers wait for the replay, as after a truncate; a named history checks that the retired run's load decides nothing when its abort rejects it. A named history pins that a truncate after a reload's failed replay replays the demand again. The on-demand window grammar adds `settle-aborted-fail` and `settle-aborted-ok`, which settle only the loads the query aborted, with declared reach for an aborted load that settles beside a pending load after a request error. A source reload that aborts the app's retry after a request error leaves that error to the replay's verdict: the retry's late rejection or success decides nothing, and a failed replay's verdict replaces the retry's failure. On 2bc79fc7c the coarse verdict's window histories fail, and a mutant whose replay failure reports no error fails 37 tests. Window moves never abort a root load outside a replay, so a root load's late success after an abort outside a replay is unreached (a mutant that lets it clear the root error survives); page-distinct root failures are not modelled: the grammar keeps one logical window demand, as law 16's "later load of that Collection" wording allows. The lazy grammar's `remote-delete` step deletes a child at the provider with no stream event; a child Collection rows check after every step pins that a reload keeps that row (maintainer decision: no reload sweep; RED on 2bc79fc7c, which swept it). The main grammar's blind `insert` write pins that an insert of a key the baseline holds throws, during a reload as at any time (maintainer decision; RED on 2bc79fc7c, which turned a reload's insert of a row the retired run left into an update; a mutant that lets a reload's insert of a held key apply fails 12 named histories); the lazy grammar's diffing adapter writes an `update` for a kept child. Limits: the window grammar has no provider deletion. Every truncate replays the demand again, also one the reload's new run sends while the reload's own replay is open or after it settled (F8: a latch that skipped the reload's own truncate let a replacement delete replayed rows with nothing re-requesting them); a reload with no held acquisition keeps the rows and replays nothing. The window grammar's `reload-query` reaches the query's own reload while its node shows a request error: the query keeps its rows, its node's error, and `reloading` until its new run's window load settles, keeps the window it showed (a window move waiting for a replay ends with the retired run), and then shows only the new run's failure, if any (F4). During the query's own reload the window grammar also issues window moves and `restart`. A move of the new run whose load fails keeps the reload, its rows, `reloading`, and its promise until a later move's load succeeds, and a failure the new run reports shows on the node at once (maintainer decision). `restart` (cleanup and preload of the query) discards the window and any own reload in flight, so the new lifetime loads the initial window. Its limits: no source reload, report, or aborted settle during the own reload; the reload starts only when the source shows no problem; and a restart ends the request-error announcement watch for the rest of the history. Named histories also pin that a later load of a failed key clears its request error while an unrelated load is still pending, that a load failing during a replay is decided by the replay's verdict, that a reload during the first load fails it only for a demand still held when the replay is judged, and that a reload keeps a window move that joined the replay while it aborts a later move that waited. Mutants that restore last round's reload, cleanup, Effect, and replay bugs, and a request error that outlives the failed key's demand, each fail named histories. Witnesses pin that cleanup start announces the problems it drops, that a reload rejects during pending adapter cleanup, that a ready callback that throws still settles a reload, that a failed reload keeps its rows as a diffing adapter's baseline, that a query's own reload settles with its new run (a load that fails again, or a graph that throws), that a source's or the query's reload clears a request error, that an Effect over a source already in `error` or `crashed` ends, and that a pooled view keeps node identity when its source alias is `root`. Later witnesses pin that a reload's open transaction applies on the kept rows after the new run fails, that an Effect over a stopped source leaves no load, subscription, or listener on it, that cleanup start keeps an `error` status's cause, that a source reload's replay keeps a request error that failed after it started, and (query-db) that a late recovery counts when another Query fails meanwhile. The query-db lane `failureReason follows the still-failing Queries` (`query-db.failing-queries`) enumerates every history of four fetches over two subsets' Queries, directly and behind the persisted wrapper (a receiving witness: the wrapper must relay `reportHealthy(error)`'s value). Its model keeps each failing Query's latest error value and the listed values, one per value, oldest first (review: one entry per failing Query, and a value stays listed while any failing Query holds it); fetches succeed, fail with a fresh error, or fail with one shared value; after every fetch it compares the listed causes by identity and order, the shown `message` and `cause`, each kept failure's `at`, and health tree identity (ARCHITECTURE law 17): a fetch that leaves the frame as it was keeps the node and its `failureReason` object and announces no `health:change`. Declared reach includes a Query that fails again while listed and one that recovers with two failures listed while another fails. RED on the parent: a recovered Query's failures stayed listed. The main grammar's `report` and `healthy` steps can name a listed failure's error value or an unlisted value with the same message; a report of a listed value and a healthy call for an unlisted one leave the frame as it was and must announce nothing (maintainer decision), and a healthy call for a listed value removes only that failure. Limits: replacing a Query's failure announces two health:change events (add, then remove). The [snapshot oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts)'s health lane (`live-query-observer.snapshot-health`) generates `report`, `healthy`, `write`, `subscribe`, `unsubscribe`, and `read` over one ready source and checks that every `getSnapshot()` shows the current `failureReason`, `hasErrors`, and `isSyncError`, on detached reads, attached reads, and across the attach cut, and that the tree keeps its identity while unchanged; after a round trip between reads that ends on the previous read's content, either identity is legal (glossary, health tree). Each read also compares the `failureReason`'s `errors` (messages in order, each cause by identity) with the model's frame, and a declared reach state reads a frame of several failures. Limits: one source, `failureReason` only, no hydration seed, no framework. The shared conformance cells `crashed-status` and `crashed-status-during-first-load-{collection,query}` read each driver's status flags without reading `data`, and require Solid's resource path to show `crashed`, not `error`, when preload rejects for a crashed Collection. By maintainer decision, an error boundary receives an Error for a failed first load or a crash: the cause itself when it is an Error, otherwise an Error with the problem's message whose `cause` is the reported value; React's `useLiveSuspenseQuery` and Solid's resource witnesses cover a failed first load and a crash, each with an Error and a non-Error cause: a failure inside sync and after mount, a sync function that throws, and a later crash (after readiness for React, during the first load for Solid). A crash path that throws the raw cause fails the non-Error crash cells in both. The replay refinement oracle's `settle` command can keep holding loads that start during the step, so a held retry keeps a failed join load's request error visible. A crash-recovery witness checks that nothing recovers a crash in place and that a cascade cleanup gives a fresh start with only the new run's rows; a `reload()` that recovers a crash, a cleanup that keeps the crashed run's rows, and a crash that survives cleanup each fail it. The three generated properties share one model: the main grammar's source model drives the on-demand Collection of the window and lazy grammars too (a load that succeeds is one sync transaction, so a reload's first load replaces every row), and one demand model, from ARCHITECTURE laws 9, 10, and 16, judges the window grammar's single window demand and the lazy grammar's per-parent keys. The lazy grammar checks the request error after every step, also while a replay is open or after one failed, and both grammars check a coverage law: once the query is ready, every held key has a load the adapter still serves, its rows, a replay failure awaiting judgment, or a shown request error (an aborted load without a replacement fails it). Named histories pin the cases that closing the earlier open item found: a demand parked behind a child whose first load failed joins the open replay, also an in-flight one when the child restarts (the CI counterexample seed -838690579: production replaced the in-flight replay and lost its own failed load; `a reload after the source stopped replays its demand and fails with every load`); a failed replay stays open while the query holds demand, and its error clears when its failed demand retires after the rest loaded (law 9); a load the truncate aborted does not clear a request error; a held replacement that loaded decides the demands it replaces; and a cascade cancels a query's pending reload. Law-silent, recorded with the maintainer: a truncate's `markReady` option does nothing on a ready Collection, also after `fail()`; a cleanup after a crash that followed cleanup settles at once; a truncate after `fail()` is outside the grammars; a window move with no request is served from loaded rows. A child whose first load failed parks new demand without a request; by maintainer decision the lazy model predicts the parked acquisition from law 10 (growth or churn), and a declared reach state and prefix enter that region. Named histories pin that a replay re-requests parked demand and then publishes, that a released parked demand parks again, that a replay's failed request keeps its acquisition's coverage, and that a later change drops a parked replacement that no longer matches. ARCHITECTURE law 16 states the rule. A query that crashes while it starts, because a Collection it reads is still cleaning up, reads nothing: it announces nothing more and no cascade ends it (maintainer decision). A pooled view that is unsubscribed, outlives its source's `cleanup({ dependents: true })` and restart, and then subscribes again stays `cleaned-up`, while a live-query Collection restarts; the pooled cleanup-admission lane crosses observed and unobserved views but never restarts their source; a follower tab does not see a provider failure on the leader outside a pending request. |
+| Collection status and health tree | `packages/db/tests/source-health-oracle.test.ts` (`source-health.history`); the `problem values`, reload invariant, request error, crash recovery, failed join load, root request, Effect, pooled view, and include node lanes are in `packages/db/tests/source-health.test.ts` (fixed tests; no oracle owner (tracked in #2264)) | An independent per-Collection model of the first-load gate, `failureReason` and stopped `error` slots with serials and each slot's frame of failures (maintainer decision: a problem shows its newest failure and lists its frame in `errors`; a failure reason's frame is its sync run's reports until `reportHealthy()`, once per error value, less each failure `reportHealthy(error)` removed, and a reload's new run that reports starts a new one), crashes, and reloads derives each live query's status and expected health tree for direct, join, self-join, nested, include, and pooled-nested shapes. Generated histories cross `ready`, `fail`, `report`, `healthy`, `crash`, `reload`, `reload-cleanup-fails` (a retired cleanup that rejects crashes the Collection), `reload-cleanup-held` and `retired-cleanup-rejects` (a retired run's cleanup that rejects later still crashes the Collection, also after a cleanup and a fresh start: the adapter broke its contract for that Collection, by maintainer decision), `cancel` (a commit with an aborted signal changes nothing), `reload-query` (a query's `reload()` reaches every Collection below it that shows an `error`, through nested queries; a crashed query rejects without touching its sources), `cleanup-reload` (cleanup, a fresh start, and a reload in one tick: the cleaned-up run's reload decides nothing for the new one), `snapshot` (`begin({ snapshot: true })` replaces every row at its commit, at any time, also when the reload fails or the Collection crashes before that commit; maintainer decision: only a snapshot or the adapter's `truncate()` replaces rows, and every other write of a reload's new run applies on the kept rows), `mark-ready` (a reload without a snapshot completes at the new run's `markReady()` and keeps the rows; a run's `markReady()` after it is ready or after its `fail()` does nothing, by maintainer decision), `reload-ready-throws` (a first-ready callback that throws while a reload's new run marks ready inside `sync()`, also when the reload starts a cleaned-up Collection through its preload, is reported uncaught and the Collection stays ready, by maintainer decision), and restart. A second `fail()` in a sync run does nothing. A `problem values` lane checks that `fail()`, `reportError()`, and a crash behave the same for any value, also one that cannot describe itself. The Effect lane checks that a problem a source already shows when the Effect's gate opens reaches `onHealthChange` once, that a healthy gate announces nothing, and that each later change is one call. The `effect healthy gate` lane crosses where the gate opens: at the Effect's start, inside an eager source's, a nested query's, or a join's second source's `status:change`, or when an on-demand load settles. A healthy gate that announced its own tree for the status change that opened it failed the three `status:change` openers; an Effect that skips its first healthy change fails the on-demand opener. The lazy grammar's `reload-in-load` checks that a reload from inside the adapter's `loadSubset` rejects and leaves the query running. A query-db receiving witness checks that a direct insert, update, or delete during a reload applies on the kept rows, because it is not a snapshot, and ends with the same rows as during a refetch in flight. A second query-db receiving witness, `housekeeping during a reload` (`query-db.reload-housekeeping`), checks that Query Collection's retention housekeeping keeps the rows during a reload of an eager persisted Collection: an expired persisted retention entry is removed by its expiry timer or by the new run's startup maintenance while the new run's Query fetch is held, and the rows stay, the reload stays in flight, and it ends with the same rows as a refetch. A fourth kind, `expiry-timer-lagging-clock`, makes the expiry timer fire before `Date.now()` reaches `expiresAt`; the entry must still expire in that run, and a callback that drops the early timer fails every time (this was a CI flake and a production bug). The reach counts only begins of the run after the retired one, and the window is observed by polling until the entry is gone. A housekeeping `begin()` marked `snapshot: true` fails it: it replaces the kept rows with none. A third kind, `release-at-startup`, reaches the retention entry that a subset release writes: during a reload of an on-demand persisted Collection, the driver requests and releases a fresh subset through a change subscription in every microtask turn until the new run's `markReady()`, and in the turns after its startup retention maintenance settles each release writes its entry while the reload is in flight; the rows stay and the reload stays in flight in every turn, and it ends with the same rows as a refetch. A retention write marked `snapshot: true` fails it. Release of a Query's rows also begins a housekeeping transaction, but no legal history begins it in the new run while the reload is in flight: core runs the run's cleanup only after retiring its callbacks, and a release takes that path only without a persistence capability, where Query Collection writes no retention entry, so the new on-demand run calls `markReady()` inside `sync()`; a snapshot there is an equivalent mutant for the lane. The lazy grammar's `deferredStart` dimension starts the child the way a persisted Collection does, after the query asked for data, so every lazy history can begin with a first load that enters the adapter from the deferred start; with `reload-in-first-load` that load calls `reload()`, which must reject (a deferred call that skips the guard fails the generated property, shrunk to the empty history). The lazy join grammar checks which request error the query's node shows after every step: every failure has its own message, and the model shows the newest open failure by the order failures became request errors (maintainer decision). It also compares the node's `errors` with the model's frame after every step: every open request failure once, oldest first, each the very value the adapter failed with; a shared error keeps the place of its first failure, and a failed replay lists its failures in failure order, with the newest on top (maintainer decision; the subscription's own replay error stays its earliest held failure). The window grammar makes the same comparison. A replay's verdict decides every request error of the demand it replayed (maintainer decision: coarse verdict): loads that settle while it is judged decide none themselves, its success clears them all, and its failure replaces them with its failures, every failed load of its current attempt that the query still holds for a key that no later held load loaded. Closed from 30-times runs, each now a named history: a query's reload passes through a nested query that a cascade ended, which is a Collection below it that shows A's error, so that inner query's own reload reloads A and starts it, also when another source's reload rejects and the outer query does not start (`a query reload starts an ended nested query even when another source rejects`; the model had reloaded A past the ended inner query). A synchronous throw from `loadSubset` is a rejection (maintainer decision): the lazy driver's `throw-next` failure holds its demand, so the next demand change or replay requests its key again, and the churn replacement twins (`a churn replacement that throws|rejects leaves its key to the older load after the next demand change`) must agree; the driver sees the abort that releases a thrown load's demand. A replay load the query released does not count for the replay's verdict, even when it loaded its keys before the release (law 9: the replay succeeds only as a replacement for the demand that remains; `a released replay load's success does not count for the replay's verdict`; model). A failed replay request that the query released holds nothing, so a parked demand change that asks for its key again parks it (law 9; `a parked growth asks again for a key whose released replay request failed`; model). The main grammar projects every problem's `errors` (messages, order, and which report each cause is) and rejects a problem whose `message`, `cause`, or `at` is not its newest failure's; it checks that a legal `report` or `healthy` announces one `health:change` (a self-join announced two, one per alias, before the relay was registered once per Collection). The demand model treats a replay's failed request of a parked acquisition, which never loaded, as that demand's own failed first load: it covers nothing, and the next demand change parks a retry that holds the failed replay open (law 10; a 30-times counterexample on b521d29d9 of the model, which let the request cover the key, pinned as `a demand change retries a parked key whose replay request failed`; a production mutant that retires the failed segment without a retry fails it and 12 other lazy histories). The `request error bookkeeping` property checks the shared tracker's listed causes and its change result, including a request with several failures. Its `fail-again` step fails an issuer again with every cause it still lists and one new cause, as a replay's later verdict does: a cause still open keeps the place of its first failure (law 17; RED on d0cde4778, which released the issuer's causes before it counted the new list). The lazy and window grammars make `Date.now()` strictly increasing and check every request error's `at` after each step: a failure the model did not show anew keeps the `at` the node showed for it (RED on d0cde4778 in the named history `a failed replay's error stays when parked demand retires after the child restarts` and in the generated lazy property; reach `replay verdict lists an open failure again`, entered by a prefix in which a parked demand joins a failed replay; a mutant that clears the verdict's request errors before it reports its failures fails the named history). Both grammars also check that no `health:change` of a ready query repeats the tree before it. Open (R18, maintainer decision pending on code weight): a replay's verdict, and a lazy load or demand change that decides several keys, announce once per request error they change, so a listener sees intermediate trees (a verdict that replaces key errors with its failures first shows them cleared); a check that every announcement shows a request error frame the model held fails on d0cde4778 (for example `a failed replay's verdict replaces an earlier open failure`, step 5) and passes with a lifecycle `changeRequestErrors(change)` batch that costs about +57 B gzip, so it is not committed. Limits: these announcement checks skip trees whose query is not ready, because a source crash makes the query announce the same crashed tree twice in one step (seen on d0cde4778 at the lazy grammar's `crash` step); the main grammar owns crash announcements and does not count them. Not fixed (R3, R5): during a reload, before it completes, the new run's `reportHealthy()` clears the retired run's failure reason, and a query's own reload drops the retired run's request errors at the new run's first request error; the main and window models encode that behavior, which is in tension with law 16 ("a reload keeps the node's problems until it completes"), and needs a maintainer decision. Not reached (R8): a retired run's committed but unapplied truncate, from a listener that reenters during `commitPendingTransactions`, can complete the new run's reload. A deterministic work witness (`request-errors-work.test.ts`) bounds one failed 2,000-key segment's report-and-settle work at 20·K visits; the original scan-and-sort tracker used 14,007,001. A lazy named history pins that a demand change which retires a fragmented-churn replacement and another segment, while the replaced segment's replay load has failed, fails the replay for the still-held key (laws 9 and 16); the subscription lifecycle owner's demand-change grammar generates the class. A failed replay does not list the failure of a load the query released before the verdict (law 16; glossary request error: it clears when its demand retires); the named history `a failed replay does not list a load the query released before its verdict` fails on the model that listed it and on a production mutant that keeps a released demand's failure. A cleanup during a reload (ARCHITECTURE law 14; maintainer decision that a reload ends with its run) is a generated step in two grammars. The main grammar's `cleanup-during-reload` runs `cleanup({ dependents: true })` from the Collection's or the dependent query's `health:change` while `reload()` announces `reloading: true`. The lazy grammar's `ending` runs `cleanup()` or `cleanup({ dependents: true })` from those, from the Collection's `loadingSubset:change`, or from a change subscription's `status:change` while the reload retires its demand. In both, the model is an ordinary cleanup: no sync run stays live at the adapter, a reload in flight rejects, the Collection ends `cleaned-up`, and a later fresh start's commit is its diff baseline. Setting the epoch after the reload's announcement, or the truncate after the run's retirement, fails 12 histories; restoring the old flag order, or dropping the epoch return, fails the subscription-status ending. Cleanup from the retired run's adapter cleanup function or from the new run's `sync()` is outside this lane. A cleanup of a Collection that a cleanup during a reload left `cleaned-up` has no run to wait for and settles at once; the driver holds an adapter cleanup only while a run is live (a 30-times counterexample of the driver). Focused witnesses check that a reload from inside a `loadSubset` call the deferred start runs rejects, that a cleanup run from a subscription's status listener while a reload retires the run ends that reload with its run (no sync run starts and no replacement stays armed), and that a lazy join load that fails after readiness, under an ordered window that filters on it, publishes the output it held. The main grammar also compares the query's row count at the `status:change` that makes it ready with the count the step leaves (law 9): A's truncate commit that marks A ready while the nested shape's outer query waits for its inner query reaches it, in the first load and in a reload of a failed first load; a completion check that ignores the graph's pending work fails it. Limits: row count only, not identity. After every step the check compares status, rows, the projected tree, node identity, `status:change`/`health:change` order, and `findProblems()`. Named histories pin a reload's new-run `failureReason` surviving its completion. Focused lanes cover request errors, overlapping root loads (a request error clears only when a load started after the failure succeeds; 8 histories plus a later clearing load), a query's own failed first load not restarting when an unrelated source becomes ready, reload invariant witnesses (the retired run's open sync transaction is dropped; a canceled reload commit changes nothing and the reload keeps the rows; a diffing adapter sees an empty baseline inside a reload's snapshot), and Effect disposal on a failed first load or crash. The shared framework conformance scenarios `sync-errors-after-readiness` and `crashed-status` judge the hooks; `sync-errors-after-readiness` reads a two-failure `failureReason.errors` and a one-failure `error.errors` through every framework driver. Adapter receivers for reload after a failed first load (the new run's own readiness decides it, not Collection status): query-db, RxDB, and PowerSync focused tests, Electric's integration test, and TrailBase's lifecycle lane. Adapter receivers for reload of a ready Collection (maintainer decision F19: the reload keeps the rows until it completes; only a `begin({ snapshot: true })` transaction or the new run's own `truncate()` replaces them; every other write applies on them): Electric's integration tests `reload of a ready Collection` (a resumed stream with no changes, or with an update, a delete, and an insert, applies them on the kept rows and completes at up-to-date; a stream that cannot resume replaces the rows with its fresh snapshot; a must-refetch keeps the rows through its reset-marker commit and replaces them at its snapshot) and `an on-demand reload keeps its rows and ends with the source's rows` (resumed or not: the replayed subset's rows apply on the kept rows, and the adapter writes an update for a kept key, since core no longer rewrites a kept-key insert and sweeps nothing; the adapter owns removing rows deleted while no stream listened, [#2269](https://github.com/TanStack/db/issues/2269)), and `a progressive reload that cannot resume keeps its rows through a subset load` (no kept row vanishes before the atomic swap, the kept key takes the source's value, the live query has no error; it failed on the parent core with DuplicateKeySyncError); query-db `a reload of a ready eager|on-demand Collection keeps its rows and ends as a refetch does`; PowerSync `eager mode: a reload of a ready Collection keeps its rows and ends with the table` (three batches in one snapshot transaction); RxDB `a reload of a ready Collection keeps its rows and ends with the documents` (a first run that missed changes; two fetch batches); and TrailBase's lifecycle lane `a reload of a ready eager Collection` (10 histories; see its ORACLE.md). On the parent core, Electric's resumed and must-refetch cases, query-db on-demand, PowerSync, and TrailBase's two-page cases fail; RxDB's passes and guards the port. Each of these mutants fails them: a resumed Electric run whose first commit replaces rows; a fresh Electric, PowerSync, or RxDB load without a snapshot; and a query-db housekeeping or direct write marked `snapshot: true`. A reload keeps every row its new run does not rewrite, and core deletes no kept row on its own (maintainer decision; removing a row the backend deleted is the adapter's job, [#2269](https://github.com/TanStack/db/issues/2269)); the adapters' own on-demand reload receivers belong to their packages. Adapter receivers for an on-demand reload (maintainer decision: no core sweep; a held key is written as `update`; issue #2269): Electric `an on-demand reload keeps its rows and ends with the source's rows` (resumed: deleted rows go through the log; cannot resume: a row deleted while no stream listened stays), query-db `a reload of a ready on-demand Collection keeps its rows and ends as a refetch does` (row ownership removes the deleted row), PowerSync `an unchanged row survives an on-demand reload` (the adapter's own tracking removes the deleted row), and the TrailBase lane `an unchanged row survives an on-demand reload` (a row deleted with no event stays). Without Electric's `syncedKeys` seed and its update-for-held-key write, its non-resumed and progressive witnesses fail. Subset snapshot rows go through the same `syncedKeys` check as stream rows. PowerSync `eager mode: a reload whose later batch fails keeps the rows and the next reload ends with the table` checks core state: no open transaction remains and the accepted rows equal the kept rows; a snapshot begun before the batches fails it. Abort receivers (an abort ends the load): Electric, PowerSync, TrailBase, and query-db `an aborted load writes no rows and its late result changes nothing`; each fails under a mutant that ignores the signal at that adapter's stop point. Limits: an Electric abort while a request is in flight still lets the SDK publish its rows; query-db applies a late result after an abort without `unloadSubset` (a replay replacing the load within a run), whose data is current, so it costs a write, not correctness; RxDB has no on-demand path. Electric's `a ready after the stream gave up changes nothing` witnesses that `markReady()` after the run's `fail()` is a no-op (F6): the SDK gives up while a ready run's up-to-date commit waits for a wrapping sync's acceptance, and the acceptance arrives afterwards; there is no unhandled rejection and no status or health change. It fails on the parent core with an unhandled `CollectionStateError`. Limits: the progressive and on-demand Electric witnesses are fixed examples, not generated histories. A joined-filter lane checks that a failed join load lets an ordered window move again. An Effect has no request errors: a failed load after its gate still ends it, and the Effect load-failure lane checks that. An on-demand reload lane crosses the new run's first commit (an empty `markReady()` or a row commit inside `sync()`, or `markReady()` after it returns) with an unfiltered and a filtered query. While the new run's loads are in flight, it checks that the query keeps the old run's rows and that a direct read shows the kept rows with the new run's own commit on top (no snapshot came). After the loads settle, it checks the new run's rows. A late-first-load lane enumerates an on-demand Collection that fails its first load, stops after readiness, or crashes after a direct or joined query is ready, then calls the query's `reload()`. A query that follows its source into `error` after showing data fails it, and so does a query reload that skips a source still in its first load. A focused RxDB test checks that a change-stream error calls `fail()` before and after readiness. The generated grammar also keeps each Collection's rows and the sync run's open transaction: `write` and `commit` steps span other steps, the driver writes like a diffing adapter, a `write` can omit the `tag` field (an update merges into the row, an insert replaces it, also when a failed reload's open transaction applies on the kept rows), and after every step the check compares rows, the adapter's baseline, the query's rows, a direct subscriber with the initial state on each source when the history includes one (its rows equal the Collection's within one Collection lifetime, also while a reload is in flight or after it fails; a source that starts again after cleanup gets a fresh one), and an Effect over A (ended, source errors, listeners left). `cleanup-hold` and `cleanup-settle` steps run every other step while adapter cleanup is pending, including a crash, a new Effect, and the query's reload, which restarts a query a cascade ended. A second generated property, `source-health.on-demand`, drives a root window over an on-demand Collection: window moves, settle-all outcomes, source reloads, and the source's own calls, with requested loads reported from the adapter boundary; it checks the query's status, its request error, the source's node, and the window's rows. A third, `source-health.lazy-demand`, drives an eager parent Collection left-joined to an on-demand child Collection: parents come and go, loads settle ok or failed, the child source reloads, and the source makes its own calls; the driver reports each load's requested keys from the adapter boundary. It checks the query's status, its request error (which clears when a later load of the failed key succeeds or when the query no longer needs that key), and each parent's child. The lazy and window drivers can add a direct subscriber with the initial state on the on-demand source (its rows equal the Collection's at every step; the driver answers its own requests at once), and the lazy driver can add an Effect over the same join (at quiet checkpoints it has the query's rows; a delete that a later insert undoes between checkpoints is not observed). The lazy driver also crosses a child that holds `markReady()` until a `child-ready` step, so the child can be `loading` or fail its first load when it reloads, a reload stays in flight past its new run's first commit, and a second `reload()` returns the first one's promise; and the child adapter's own `truncate()` (a must-refetch in the same sync run, also while a reload is in flight: its replay requests every needed key, also one whose load threw, and a demand change's replacement that applies releases the coverage it replaces), loads that throw, and source reloads during the first load: the first load waits for the whole replay, and a replay fails only for a key the query still needs when it is judged. The child adapter honours aborts; an adapter that ignores them is outside the contract (maintainer decision: an abort ends the load). In the on-demand lane, a window move after a failed replay waits for the next successful replay, and a later reload aborts it. A reload starts its replay when it retires the sync run, so a load the reload aborted is over and its consumers wait for the replay, as after a truncate; a named history checks that the retired run's load decides nothing when its abort rejects it. A named history pins that a truncate after a reload's failed replay replays the demand again. The on-demand window grammar adds `settle-aborted-fail` and `settle-aborted-ok`, which settle only the loads the query aborted, with declared reach for an aborted load that settles beside a pending load after a request error. A source reload that aborts the app's retry after a request error leaves that error to the replay's verdict: the retry's late rejection or success decides nothing, and a failed replay's verdict replaces the retry's failure. On 2bc79fc7c the coarse verdict's window histories fail, and a mutant whose replay failure reports no error fails 37 tests. Window moves never abort a root load outside a replay, so a root load's late success after an abort outside a replay is unreached (a mutant that lets it clear the root error survives); page-distinct root failures are not modelled: the grammar keeps one logical window demand, as law 16's "later load of that Collection" wording allows. The lazy grammar's `remote-delete` step deletes a child at the provider with no stream event; a child Collection rows check after every step pins that a reload keeps that row (maintainer decision: no reload sweep; RED on 2bc79fc7c, which swept it). The main grammar's blind `insert` write pins that an insert of a key the baseline holds throws, during a reload as at any time (maintainer decision; RED on 2bc79fc7c, which turned a reload's insert of a row the retired run left into an update; a mutant that lets a reload's insert of a held key apply fails 12 named histories); the lazy grammar's diffing adapter writes an `update` for a kept child. Limits: the window grammar has no provider deletion. Every truncate replays the demand again, also one the reload's new run sends while the reload's own replay is open or after it settled (F8: a latch that skipped the reload's own truncate let a replacement delete replayed rows with nothing re-requesting them); a reload with no held acquisition keeps the rows and replays nothing. The window grammar's `reload-query` reaches the query's own reload while its node shows a request error: the query keeps its rows, its node's error, and `reloading` until its new run's window load settles, keeps the window it showed (a window move waiting for a replay ends with the retired run), and then shows only the new run's failure, if any (F4). During the query's own reload the window grammar also issues window moves and `restart`. A move of the new run whose load fails keeps the reload, its rows, `reloading`, and its promise until a later move's load succeeds, and a failure the new run reports shows on the node at once (maintainer decision). `restart` (cleanup and preload of the query) discards the window and any own reload in flight, so the new lifetime loads the initial window. Its limits: no source reload, report, or aborted settle during the own reload; the reload starts only when the source shows no problem; and a restart ends the request-error announcement watch for the rest of the history. Named histories also pin that a later load of a failed key clears its request error while an unrelated load is still pending, that a load failing during a replay is decided by the replay's verdict, that a reload during the first load fails it only for a demand still held when the replay is judged, and that a reload keeps a window move that joined the replay while it aborts a later move that waited. Mutants that restore last round's reload, cleanup, Effect, and replay bugs, and a request error that outlives the failed key's demand, each fail named histories. Witnesses pin that cleanup start announces the problems it drops, that a reload rejects during pending adapter cleanup, that a ready callback that throws still settles a reload, that a failed reload keeps its rows as a diffing adapter's baseline, that a query's own reload settles with its new run (a load that fails again, or a graph that throws), that a source's or the query's reload clears a request error, that an Effect over a source already in `error` or `crashed` ends, and that a pooled view keeps node identity when its source alias is `root`. Later witnesses pin that a reload's open transaction applies on the kept rows after the new run fails, that an Effect over a stopped source leaves no load, subscription, or listener on it, that cleanup start keeps an `error` status's cause, that a source reload's replay keeps a request error that failed after it started, and (query-db) that a late recovery counts when another Query fails meanwhile. The query-db lane `failureReason follows the still-failing Queries` (`query-db.failing-queries`) enumerates every history of four fetches over two subsets' Queries, directly and behind the persisted wrapper (a receiving witness: the wrapper must relay `reportHealthy(error)`'s value). Its model keeps each failing Query's latest error value and the listed values, one per value, oldest first (review: one entry per failing Query, and a value stays listed while any failing Query holds it); fetches succeed, fail with a fresh error, or fail with one shared value; after every fetch it compares the listed causes by identity and order, the shown `message` and `cause`, each kept failure's `at`, and health tree identity (ARCHITECTURE law 17): a fetch that leaves the frame as it was keeps the node and its `failureReason` object and announces no `health:change`. Declared reach includes a Query that fails again while listed and one that recovers with two failures listed while another fails. RED on the parent: a recovered Query's failures stayed listed. The main grammar's `report` and `healthy` steps can name a listed failure's error value or an unlisted value with the same message; a report of a listed value and a healthy call for an unlisted one leave the frame as it was and must announce nothing (maintainer decision), and a healthy call for a listed value removes only that failure. Limits: replacing a Query's failure announces two health:change events (add, then remove). The [snapshot oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts)'s health lane (`live-query-observer.snapshot-health`) generates `report`, `healthy`, `write`, `subscribe`, `unsubscribe`, and `read` over one ready source and checks that every `getSnapshot()` shows the current `failureReason`, `hasErrors`, and `isSyncError`, on detached reads, attached reads, and across the attach cut, and that the tree keeps its identity while unchanged; after a round trip between reads that ends on the previous read's content, either identity is legal (glossary, health tree). Each read also compares the `failureReason`'s `errors` (messages in order, each cause by identity) with the model's frame, and a declared reach state reads a frame of several failures. Limits: one source, `failureReason` only, no hydration seed, no framework. The shared conformance cells `crashed-status` and `crashed-status-during-first-load-{collection,query}` read each driver's status flags without reading `data`, and require Solid's resource path to show `crashed`, not `error`, when preload rejects for a crashed Collection. By maintainer decision, an error boundary receives an Error for a failed first load or a crash: the cause itself when it is an Error, otherwise an Error with the problem's message whose `cause` is the reported value; React's `useLiveSuspenseQuery` and Solid's resource witnesses cover a failed first load and a crash, each with an Error and a non-Error cause: a failure inside sync and after mount, a sync function that throws, and a later crash (after readiness for React, during the first load for Solid). A crash path that throws the raw cause fails the non-Error crash cells in both. The replay refinement oracle's `settle` command can keep holding loads that start during the step, so a held retry keeps a failed join load's request error visible. A crash-recovery witness checks that nothing recovers a crash in place and that a cascade cleanup gives a fresh start with only the new run's rows; a `reload()` that recovers a crash, a cleanup that keeps the crashed run's rows, and a crash that survives cleanup each fail it. The three generated properties share one model: the main grammar's source model drives the on-demand Collection of the window and lazy grammars too (a load that succeeds is one sync transaction, so a reload's first load replaces every row), and one demand model, from ARCHITECTURE laws 9, 10, and 16, judges the window grammar's single window demand and the lazy grammar's per-parent keys. The lazy grammar checks the request error after every step, also while a replay is open or after one failed, and both grammars check a coverage law: once the query is ready, every held key has a load the adapter still serves, its rows, a replay failure awaiting judgment, or a shown request error (an aborted load without a replacement fails it). Named histories pin the cases that closing the earlier open item found: a demand parked behind a child whose first load failed joins the open replay, also an in-flight one when the child restarts (the CI counterexample seed -838690579: production replaced the in-flight replay and lost its own failed load; `a reload after the source stopped replays its demand and fails with every load`); a failed replay stays open while the query holds demand, and its error clears when its failed demand retires after the rest loaded (law 9); a load the truncate aborted does not clear a request error; a held replacement that loaded decides the demands it replaces; and a cascade cancels a query's pending reload. Law-silent, recorded with the maintainer: a truncate's `markReady` option does nothing on a ready Collection, also after `fail()`; a cleanup after a crash that followed cleanup settles at once; a truncate after `fail()` is outside the grammars; a window move with no request is served from loaded rows. A child whose first load failed parks new demand without a request; by maintainer decision the lazy model predicts the parked acquisition from law 10 (growth or churn), and a declared reach state and prefix enter that region. Named histories pin that a replay re-requests parked demand and then publishes, that a released parked demand parks again, that a replay's failed request keeps its acquisition's coverage, and that a later change drops a parked replacement that no longer matches. ARCHITECTURE law 16 states the rule. A query that crashes while it starts, because a Collection it reads is still cleaning up, reads nothing: it announces nothing more and no cascade ends it (maintainer decision). A pooled view that is unsubscribed, outlives its source's `cleanup({ dependents: true })` and restart, and then subscribes again stays `cleaned-up`, while a live-query Collection restarts; the pooled cleanup-admission lane crosses observed and unobserved views but never restarts their source; a follower tab does not see a provider failure on the leader outside a pending request. |
 | Paced mutations                          | Partial                                                        | The core virtual-clock owner checks strategy timing, admission, cleanup, and settlement. The React render-cut owner checks committed callback ownership across suspended and committed transitions, descendant layout effects, and StrictMode while preserving mutate identity. Callback affinity to transaction admission, other frameworks, new debounce/throttle admission after cleanup, failed persistence, and broader generated schedules remain open. |
 | Optimistic state                         | Complete                                                       | The independent base/intent/source-queue graph plus outcome, transaction-payload, and publication drivers are literate.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | Drafts and native values                 | Complete                                                       | Native differential behavior, draft change tracking, detachment and its class-instance exception, hostile keys, aliases, cycles, and Map/Set live iteration are literate.                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
@@ -532,7 +542,7 @@ that test identifiers must copy production's private data structures.
 | Join equality and cold acquisition | Complete | Independent cold relational recomputation, acquisition evidence, established equality domains, replacements, and scan/index routes are literate. |
 | Opaque backend pagination | Complete | The full-relation value model plus opaque token, cache generation, publication, browser acquisition, and live-window integration owners are literate. |
 | Electric and TrailBase | Complete | Electric replica and recovery models, installed-SDK HTTP delivery, PostgreSQL serialization, and TrailBase's controlled RecordApi/native-stream lifecycle are literate with their real-provider limits intact. |
-| PowerSync | Complete | Patch conservation, effective-update receipts, metadata and falsey changes, declared-view keys, transformed schema output, logging, cleanup, and native SQLite reach are literate. |
+| PowerSync | Fixed tests only | Patch conservation, effective-update receipts, metadata and falsey changes, declared-view keys, transformed schema output, logging, cleanup, and native SQLite reach are covered by fixed tests in `correctness.test.ts`; no oracle owns them (tracked in #2264). |
 | SQLite persistence and native hosts | Complete | Persisted hydration/replay and ownership, shared-handle driver transaction laws, OPFS page and diagnostic state machines, and the 113-law native conformance manifest are literate. Native execution remains distinct from registration and shim evidence. |
 | Offline execution | Complete | FIFO retry, scheduler eligibility, leadership replay, transaction settlement, and typed wire serialization are literate. The [interruption settlement oracle](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/interruption-settlement-oracle.property.test.ts) moves one leadership loss, offline change, or disposal across individual microtask turns after one to three commits on disjoint keys, then recovers by regaining leadership, going online, or restarting over the same storage. It requires that no provider call or new outbox admission starts while fenced, that each admitted ID reaches the provider once and in commit order, that a fulfilled commit's row is already gone from storage, that commits settle with their provider outcome after a regain or reconnect, and that the outbox ends empty. A reach check requires interruptions before admission, between admission and the provider call, and after it, for each interruption. Mutants that drop the execution loop's fence, resolve before deletion, drop the admission check, or check admission before awaiting initialization fail it. Open there: shared keys, providers that answer later, and overlapping old and new executors. The settlement oracle's generated FIFO histories draw each transaction as one record (outcome; manual commit, auto-commit with the option set or omitted, or an `OfflineAction`; receipt read or not), use `isPersisted` as an auto-commit's receipt, and require that no failure escapes as an unhandled rejection, also when nobody reads the receipt, and that settlement logs no failure again and writes no debug output. An empty transaction on any commit path may precede each one; its receipt and completion waiter must fulfil without reaching the provider or the outbox. A manual transaction that writes a row and rolls back before it commits may also precede each one; its waiter must reject with an Error that names the rollback. A focused witness rolls a transaction back while it persists, for both provider outcomes: its waiter must wait for the executor and report the executor's outcome. After every transaction settles, a new waiter for each one must reject within a turn rather than hang. An unread receipt still settles with its own outcome when read afterwards, and a caller may register its completion waiter before admission on every path but `OfflineAction`. A focused witness fails the admission outbox write on every commit path and requires the receipt to reject with the storage error, without an unhandled rejection or a repeated log; a failed outbox write stops the executor, so generated histories do not continue past one. Open: the generated failure source is the mutation function only; manual commits always follow their own `mutate()` at once, so a pending manual transaction behind a failing shared-key sibling is not generated; a throwing `mutate()` callback is not generated, because core keeps its transaction pending; a rolled-back-before-commit transaction is generated only on the manual path, with its own key and its waiter registered after `mutate()`, so a secondary rollback of a pending transaction by a failing sibling, whose waiter gets the generic rollback Error, is not generated. |
 | Frameworks | Complete | Shared live-query and infinite-query models are literate. Each framework keeps its own realm, ownership, and scheduling driver. |
@@ -752,7 +762,7 @@ The versioned audit records the user decision, original overwrite RED, GREEN,
 and guards that check only own/truthy properties or omit a reserved name.
 
 Other existing fixed type checks cover adjacent compile-time boundaries:
-`packages/db/tests/mutation-handler-type-oracle.test-d.ts` checks sibling
+`packages/db/tests/mutation-handler-type.test-d.ts` (fixed tests; no oracle owner (tracked in #2264)) checks sibling
 Collection/key/utilities in mutation handlers; and
 `packages/db/tests/query/virtual-row-fields-oracle.test-d.ts` checks all four
 published virtual fields against an independently written public shape. Their
@@ -1068,7 +1078,7 @@ does not award oracle credit for a filename alone.
 
 | PR                                                | Classification                   | Permanent authority and campaign                                                                                                                                                                                                                                                                                                                                                                 |
 | ------------------------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [#1831](https://github.com/TanStack/db/pull/1831) | Explicit oracle                  | PowerSync's `packages/powersync-db-collection/tests/correctness-oracle.test.ts` crosses real PowerSync receipts and native SQLite behavior. It runs in the package test campaign and the focused `test:oracles` campaign; portable declarations retain compiler authority.                                                                                                                       |
+| [#1831](https://github.com/TanStack/db/pull/1831) | Fixed tests; no oracle owner (tracked in #2264) | PowerSync's `packages/powersync-db-collection/tests/correctness.test.ts` (fixed tests; no oracle owner (tracked in #2264)) crosses real PowerSync receipts and native SQLite behavior. It runs in the package test campaign; portable declarations retain compiler authority.                                                                                                                                                               |
 | [#1832](https://github.com/TanStack/db/pull/1832) | Equivalent specialized authority | `packages/electric-db-collection/e2e/sql-predicate-semantics-oracle.e2e.test.ts` and `packages/electric-db-collection/e2e/subset-sql-acceptance.e2e.test.ts` run through the package's real-provider `test:e2e` campaign. Compiler unit tests are collateral, not substitutes for either service boundary.                                                                                       |
 | [#1833](https://github.com/TanStack/db/pull/1833) | Explicit oracle                  | `packages/db/tests/query/pagination-oracle.property.test.ts` owns inherited collection collation, actual `item2`/`item10` order, exact request options, hostile lexical/numeric controls, and both scan and auto-index paths. It runs in `@tanstack/db`'s `test:oracles` campaign.                                                                                                               |
 | [#1834](https://github.com/TanStack/db/pull/1834) | Explicit oracle                  | `packages/db/tests/query/cold-join-reconciliation-oracle.test.ts` owns join/predicate equality equivalence across the established value domains, binary/string and nullish controls, replacement histories, raw lazy demand, and scan/auto-index paths. It runs in `@tanstack/db`'s `test:oracles` campaign.                                                                                     |
@@ -1364,7 +1374,7 @@ after a reactive query replacement.
 `packages/db/tests/db-client.test.ts` supplies a
 focused nested-query preload witness across two clients, including equal query
 hashes and distinct dehydrated rows.
-`packages/db/tests/db-client-preload-identity-oracle.test.ts` owns the bounded
+`packages/db/tests/db-client-preload-identity.test.ts` (fixed tests; no oracle owner (tracked in #2264)) covers the bounded
 same-hash preload law within one DbClient: the second local preload reuses a
 result only when its source Collection objects are the same at each query
 position. Concrete then
@@ -1433,7 +1443,7 @@ starts an idle eager source once, does not restart a running source, and reaches
 a ready public snapshot in both cases, with or without an SSR cleanup client.
 This bounded witness does not claim the same path for on-demand or asynchronous
 sources.
-`packages/svelte-db/tests/descriptor-query-release-oracle.svelte.test.ts`
+`packages/svelte-db/tests/descriptor-query-release.svelte.test.ts` (fixed tests; no oracle owner (tracked in #2264))
 checks Svelte's two-source release after a first startup error and a direct
 reader after a second descriptor factory fails. It observes source start counts,
 ready status, and failed-hook subscription release. A fresh effect root after
@@ -1473,12 +1483,12 @@ generic visitor behavior outside the named collectors.
 | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Ordered relations and BTree                  | [top-K relation oracle](https://github.com/TanStack/db/blob/main/packages/db-ivm/tests/operators/topk-relation-oracle.test.ts), [fractional-index window moves](https://github.com/TanStack/db/blob/main/packages/db-ivm/tests/operators/topKWithFractionalIndex-oracle.test.ts), [BTree/Map](https://github.com/TanStack/db/blob/main/packages/db/tests/btree-map-oracle.test.ts), [incrementalization laws](https://github.com/TanStack/db/blob/main/packages/db-ivm/tests/incrementalization-law-oracle.property.test.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Independent ordered relations and cumulative signed output. Each generated incrementalization campaign sums the checker's delivery counts and requires one atomic delivery per checkpoint and more split deliveries than an unsplit run makes; a checker that stops splitting fails all six campaigns. Most ordered steps edit the previous world by one removal or insertion, and a reconstruction check counts promotions of retained rows over the executed fixed campaign (25 global and 21 per parity at 100 runs; independent worlds gave 2 and 2). A type test pins `join(other, type)`'s nullable pair sides for every join type. Top-K consolidation compares same-key values without hashing, including cyclic replacements and fresh transient cancellation. The fractional-index test checks an empty output message for a window move after all rows retract; it does not prove downstream lazy acquisition. Other hash-based operators retain hashing's declared domain. Algebra does not specify client readiness. The BTree/Map oracle checks point operations, neighbor pairs, and full, partial, boundary, exclusive-high, and empty range scans for integer keys and node sizes 4–8. It does not check balance or space, and it assumes consistent comparators ([code-weight BTree review](oracle-reviews/code-weight-btree-trim.md)). The generated groupBy law compares JSON values; a pinned contract test in `packages/db-ivm/tests/operators/groupBy.test.ts` records that after a delete, `min` and `max` return a value hash-equal to a remaining member, not necessarily the remaining instance (`-0` for `0`, an equal Date), which is why the query compiler keeps its own exact-value keys. It checks both insertion orders, reads the group's row by integrating output multiplicities, deletes the minimum and the maximum, and shows that an aggregate input that tells the rows apart returns the remaining instance, for -0/0 in both directions and for both `min` and `max`. The contract holds while every member has positive multiplicity. It pins the current behavior separately: the delete's retraction is the last record a shared hash entry gets, so the deleted instance comes back in either insertion order, for -0/0 in either direction and for an equal Date. For -0/0 and equal Dates the contract assertions only show hash equality, which is all the contract promises. Open: the incrementalization law's value policy compares JSON and clones by `structuredClone`, so no generated history sees -0 or Date identity; a value-identity policy with -0/0 and equal-time Dates would generalize this pinned contract. |
 | Includes and publication                     | [cross-formulation](https://github.com/TanStack/db/blob/main/packages/db/tests/query/includes-cross-formulation-oracle.property.test.ts), [temporal](https://github.com/TanStack/db/blob/main/packages/db/tests/query/includes-temporal-oracle.test.ts), [Collection includes](https://github.com/TanStack/db/blob/main/packages/db/tests/query/includes-collection-oracle.property.test.ts), [architecture and complete suite map](https://github.com/TanStack/db/blob/main/packages/db/src/query/live/ARCHITECTURE.md#executable-contracts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Per-parent/flat-join/partition relations, callback-time rows, nested values, and route histories. Fragmented lazy-demand consolidation covers delta growth and successful, rejected/retried, and obsolete replacements at the Collection request boundary; it observes exact key unions and abort checkpoints. A compiled-includes fixture makes adapter unload evict owned child rows and proves a rejected union cannot remove established public child rows. Retry after that terminal live-query failure remains covered at the acquisition boundary; no automatic in-place recovery is claimed. Observe raw promised order; fresh queries do not establish continuous publication safety. The temporal owner's source-readiness lane enumerates every legal order of delivery, settlement, source readiness, and one later change for a source whose Collection readiness lags its settled subsets. It checks live-query readiness, preload settlement, and visible rows for direct, single-result, ordered-window, include-child, lazy-join, and eager-root sources; `queryOnce` results for the direct and eager-root shapes; `toArrayWhenReady()` and `stateWhenReady()` results for a read started after rows are visible but before readiness, over the direct, single-result, and eager-root shapes (and the lazy join for `toArrayWhenReady()`); and Effect `skipInitial` deltas for the direct, lazy-join, and eager-root shapes, and every on-demand cell of every consumer is crossed with a truncate or (join and include) a parent rekey before settlement. Each on-demand cell also compares its consumer with a metamorphic twin over a source that is ready from its start, which does not rely on the model's eager/on-demand rule. A live-query observer test checks that a hydration seed hands off at subset settlement, and an Electric test pins that a ready progressive query's rows update only at the full sync's swap. Effects over an ordered window or an include have no lane. It rejects both a design that waits for every source's Collection readiness and one that ignores source readiness. Electric live-query tests are the receiving witnesses for a real progressive source and an on-demand source that is ready before its subset loads; a React Suspense test checks that Suspense and `isReady` release together. Other framework adapters have no Suspense witness.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| Collection lifecycle                         | [mutation startup](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-mutation-startup-oracle.test.ts), [change-event history](https://github.com/TanStack/db/blob/main/packages/db/tests/change-event-history-oracle.test.ts), [sync publication reentrancy](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-sync-reentrancy-oracle.test.ts), [history](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-lifecycle-history-oracle.property.test.ts), [publication](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-lifecycle-publication-oracle.property.test.ts), [replay](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-replay-oracle.property.test.ts), [effect disposal](https://github.com/TanStack/db/blob/main/packages/db/tests/effect-disposal-oracle.test.ts), [GC and persisting transactions](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-transaction-oracle.property.test.ts), [GC retention boundaries](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-retention-oracle.property.test.ts), [shared GC model](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-retention-oracle.ts), [GC mutation projection](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-mutation-oracle.property.test.ts), [native idle receiver](https://github.com/TanStack/db/tree/main/packages/db/e2e/collection-gc), [initial GC review evidence](oracle-reviews/pr-2258-gc-retention.md), [second GC review and decisions](oracle-reviews/pr-2258-gc-retention-round2.md), [interaction and mutation receiving evidence](oracle-reviews/pr-2258-gc-retention-round3.md), [GC checker calibration](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-retention-oracle.test.ts), [Electric confirmation receiver](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/e2e/collection-gc.e2e.test.ts), [PR #1902 review](oracle-reviews/pr-1902-change-event-history.md), [batch-order decision review](oracle-reviews/change-event-batch-order.md), [absent-key insert review](oracle-reviews/2026-10-02-insert-for-absent-key.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Core Collection `insert`/`update`/`delete` admission while `startSync:false` is idle; complete public-row/change-message agreement across bounded one- and two-key histories plus replayable four-key campaigns, where every message must be valid for a strict consumer (insert only for an absent key, update or delete only for a present one; [absent-key insert review](oracle-reviews/2026-10-02-insert-for-absent-key.md)); a two-key deferred sync history checks each key's causal insert/update/delete trace while allowing any cross-key interleaving. Reversing all deferred messages fails that check; reversing each sync transaction's distinct-key messages passes. Queued duplicate admission and cancellation, ownership and phase histories, exact caller/error/publication evidence, and late completion and restart have separate witnesses. Generated deferred histories with cancellation or reentrant callbacks need a witness in the change-event history owner before claiming general batch-shape coverage. Every bounded change-event history, and about half of each generated campaign, runs again on a local-only Collection that ends with `reload()`: it must resolve with the Collection `ready`, the change-message mirror of valid messages must equal the public rows, the public rows must equal the history's kept rows (maintainer decision: a local-only reload keeps the user's writes, and `initialData` loads only into a Collection that starts empty), and a later write must reach both. The adapter that re-inserted `initialData` in each run failed 210 histories (a crash when a kept row changed, or a mix of kept rows and `initialData`); a reset to `initialData` fails 344, and loading `initialData` whenever the Collection is empty fails 45 (a history that deleted every row). Query write utilities and effect self-dependent disposal remain separate contracts. During a truncate, a ready callback can write to any key after a prior optimistic request. Each subscriber, with or without initial state or a filter, must receive valid messages after the Collection is ready and end at the Collection's rows. A ready callback that throws while entering sync surfaces when the sync function returns, whether it calls markReady or commits a truncate ([round 3 follow-ups](oracle-reviews/2026-10-05-round-3-followups.md)). Callback rollbacks, non-optimistic callback writes, and several writing callbacks remain open ([ready-callback truncate review](oracle-reviews/2026-10-05-truncate-ready-callback-delete.md)). The GC property (`collection-lifecycle.gc-persisting-transaction`) checks on a fake clock that automatic garbage collection retires a Collection only after `gcTime` with no subscriber and no persisting transaction, that the delay restarts when the last transaction completes or fails, and that explicit `cleanup()` still retires it while a transaction persists. Histories run over two Collections, with inserts through one Collection's `onInsert` or through a manually committed transaction that touches both. After each subscribe, unsubscribe, insert, settlement, and clock step it compares each Collection's `cleaned-up` status and each persisting row's visibility with an independent deadline model. `main` before the fix, a hold that never restarts the delay, a restart only on completion, and a restart only for the first Collection a transaction touched each fail it. The companion `collection-lifecycle.gc-retention-boundaries` property separates elapsed eligibility from host idle delivery. Its shared reference model checks the absolute 50ms startup/preload handoff, real last unsubscribe, pending versus persisting transactions, delayed commit, success/failure/rollback, surviving siblings, disabled GC, and old idle work after renewal. Generated configured delays are 1, 10, 49, 50, 51, and 100ms; observations include immediately before and at the independent deadline. Eager sync and write-started sync both run. A Chromium receiving driver uses the same model/checker with native idle delivery and cancellation and controlled elapsed timers. It records the actual budget core reads and checks public status at core delivery and a usable native observation opportunity. Exact wall-clock cleanup latency is not promised. Paced mutations, offline transaction restoration, live-query Collections, and actual Electric `awaitTxId` plus provider delivery are not generated by these GC owners. The boundary grammar now generates repeated warm preloads over queued idle and persisting holds, successful and failed cold preloads as first or last releases, both sibling settlement orders, and pending drafts held by subscriptions. Held adapter cleanup crosses settlement with surviving pending or persisting siblings, both before and after cleanup settlement. Exact key comparisons reject leftover settled rows and cleanup resurrection; tracked transaction identities still match unsettled transactions. The 250-history fixed and random campaigns require all 33 declared states. Alongside the 15 focused lanes, constructive interaction histories combine up to seven transactions and three subscribers, delayed commit, three persisting siblings, non-FIFO settlement and preload between releases. Automatic GC also starts held or rejecting adapter cleanup, checks synchronous row discard before adapter settlement, and rejects pending-sibling resurrection. The shared model additionally receives direct updates/deletes, shared update/delete and cancelled insert/delete ownership with a surviving peer update through `collection-lifecycle.gc-mutation-shapes`. Its independent source/intent projection checks exact keys and values across completion/failure/rollback, both Collection orientations and subscriber states; each 150-history campaign requires all 11 declared states. The maintainer chose first-usable-idle retirement as a fixture scheduling assumption, not a public liveness guarantee. The maintainer also chose caller-owned pending draft visibility: keep a subscription; restart after GC does not promise draft restoration. The boundary grammar therefore does not establish post-GC draft restoration, paced/offline restoration, or arbitrary cleanup/source-recovery histories. A real Electric/Postgres receiving driver now crosses gcTime 10/100ms with absent/last-unsubscribed owners, holds an assigned uncommitted txid across the unheld deadline, and observes pending caller, persisting phase, optimistic row, genuine confirmation, successful settlement, synced row, renewed GC and idle delivery. Its 12 paths retain four one-write cases and add eight two-write cases with separate real SQL transactions and both local settlement orders. A genuine acknowledgement releases only one hold; the other SQL transaction remains open beyond the first-release deadline. It shares the model/checker and rejects no-hold and first-release runtime mutants. Native host and real provider are witnessed separately; their combined browser/provider schedule, three-or-more provider writers, provider failure/recovery and persistence wrappers remain outside these bounded receiving histories. The Collection lifecycle GC owners still use fresh disjoint optimistic keys. Before claiming the combined same-key rollback-cascade or confirming-sync-queue law with GC, this owner needs a generated receiving history that crosses those semantic owners at retention and cleanup checkpoints. The history owner's demand-change grammar (`demandChangeLifecycleHistoryArbitrary`, a fixed seed and the random campaign `subscription-lifecycle.demand-change`) adds a third demand, a `replace` command (`replaceSnapshots`: a held replacement whose own load did not fail covers the owners it replaces, law 10), and a `change` command that retires several owners through one `releaseSnapshot(...wheres)` call; the model judges an open replay once after the whole change (law 9). Declared reach: a change during a replay, a replacement covering a failed owner, and a change whose verdict between releases would differ. Per-release judging, first-release-alone, and batching only two-owner changes each fail it. A covered owner's failed replay load reports `loadSubset:error` whatever its settlement order (the model's existing reporting rule; suppressing the last settler fails it), and a prompt cancellation of a covered owner settles the replay as any settlement does. An aborted held replacement covers nothing: the abort ended its load before it applied (maintainer decision: an abort ends the load; law 10), so its replaced owner's failure keeps the replay failed (two 30-times counterexamples, now `keeps a replay failed when a replacement aborted after its replaced owner failed` and its peer-loaded twin; RED on the first simplification, which counted the aborted replacement as covering; a mutant that drops the check fails both). The controller always aborts and releases a segment together, so it never makes that case. An abort ends the load (maintainer decision): the history model's `abort`, and a truncate that replaces an attempt, stop that attempt's gating at once in both `manual` and `reject` cancellation; an owner whose attempt the abort ended before it settled owes the replay nothing, and a rejection after the abort decides nothing (a failure settled before the abort stays). The publication model finishes a replacement at an abort, and the replay oracle's newer attempt drops the older attempts' pending loads. A synchronous throw from `loadSubset` is a rejection (maintainer decision): an acquisition that core releases, also in the acquisition-cell and replay witnesses. RED on 2bc79fc7c: 18 lifecycle tests, 1 refinement test. Mutants that fail: a replay that waits for an aborted load (14), an aborted rejection reported as `loadSubset:error` (19), an aborted load that still holds readiness (17).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Collection lifecycle                         | [mutation startup](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-mutation-startup.test.ts) (fixed tests; no oracle owner (tracked in #2264)), [change-event history](https://github.com/TanStack/db/blob/main/packages/db/tests/change-event-history-oracle.test.ts), [sync publication reentrancy](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-sync-reentrancy-oracle.test.ts), [history](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-lifecycle-history-oracle.property.test.ts), [publication](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-lifecycle-publication-oracle.property.test.ts), [replay](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-replay-oracle.property.test.ts), [effect disposal](https://github.com/TanStack/db/blob/main/packages/db/tests/effect-disposal-oracle.test.ts), [GC and persisting transactions](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-transaction-oracle.property.test.ts), [GC retention boundaries](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-retention-oracle.property.test.ts), [shared GC model](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-retention-oracle.ts), [GC mutation projection](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-mutation-oracle.property.test.ts), [native idle receiver](https://github.com/TanStack/db/tree/main/packages/db/e2e/collection-gc), [initial GC review evidence](oracle-reviews/pr-2258-gc-retention.md), [second GC review and decisions](oracle-reviews/pr-2258-gc-retention-round2.md), [interaction and mutation receiving evidence](oracle-reviews/pr-2258-gc-retention-round3.md), [GC checker calibration](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-retention-oracle.test.ts), [Electric confirmation receiver](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/e2e/collection-gc.e2e.test.ts), [PR #1902 review](oracle-reviews/pr-1902-change-event-history.md), [batch-order decision review](oracle-reviews/change-event-batch-order.md), [absent-key insert review](oracle-reviews/2026-10-02-insert-for-absent-key.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Core Collection `insert`/`update`/`delete` admission while `startSync:false` is idle; complete public-row/change-message agreement across bounded one- and two-key histories plus replayable four-key campaigns, where every message must be valid for a strict consumer (insert only for an absent key, update or delete only for a present one; [absent-key insert review](oracle-reviews/2026-10-02-insert-for-absent-key.md)); a two-key deferred sync history checks each key's causal insert/update/delete trace while allowing any cross-key interleaving. Reversing all deferred messages fails that check; reversing each sync transaction's distinct-key messages passes. Queued duplicate admission and cancellation, ownership and phase histories, exact caller/error/publication evidence, and late completion and restart have separate witnesses. Generated deferred histories with cancellation or reentrant callbacks need a witness in the change-event history owner before claiming general batch-shape coverage. Every bounded change-event history, and about half of each generated campaign, runs again on a local-only Collection that ends with `reload()`: it must resolve with the Collection `ready`, the change-message mirror of valid messages must equal the public rows, the public rows must equal the history's kept rows (maintainer decision: a local-only reload keeps the user's writes, and `initialData` loads only into a Collection that starts empty), and a later write must reach both. The adapter that re-inserted `initialData` in each run failed 210 histories (a crash when a kept row changed, or a mix of kept rows and `initialData`); a reset to `initialData` fails 344, and loading `initialData` whenever the Collection is empty fails 45 (a history that deleted every row). Query write utilities and effect self-dependent disposal remain separate contracts. During a truncate, a ready callback can write to any key after a prior optimistic request. Each subscriber, with or without initial state or a filter, must receive valid messages after the Collection is ready and end at the Collection's rows. A ready callback that throws while entering sync surfaces when the sync function returns, whether it calls markReady or commits a truncate ([round 3 follow-ups](oracle-reviews/2026-10-05-round-3-followups.md)). Callback rollbacks, non-optimistic callback writes, and several writing callbacks remain open ([ready-callback truncate review](oracle-reviews/2026-10-05-truncate-ready-callback-delete.md)). The GC property (`collection-lifecycle.gc-persisting-transaction`) checks on a fake clock that automatic garbage collection retires a Collection only after `gcTime` with no subscriber and no persisting transaction, that the delay restarts when the last transaction completes or fails, and that explicit `cleanup()` still retires it while a transaction persists. Histories run over two Collections, with inserts through one Collection's `onInsert` or through a manually committed transaction that touches both. After each subscribe, unsubscribe, insert, settlement, and clock step it compares each Collection's `cleaned-up` status and each persisting row's visibility with an independent deadline model. `main` before the fix, a hold that never restarts the delay, a restart only on completion, and a restart only for the first Collection a transaction touched each fail it. The companion `collection-lifecycle.gc-retention-boundaries` property separates elapsed eligibility from host idle delivery. Its shared reference model checks the absolute 50ms startup/preload handoff, real last unsubscribe, pending versus persisting transactions, delayed commit, success/failure/rollback, surviving siblings, disabled GC, and old idle work after renewal. Generated configured delays are 1, 10, 49, 50, 51, and 100ms; observations include immediately before and at the independent deadline. Eager sync and write-started sync both run. A Chromium receiving driver uses the same model/checker with native idle delivery and cancellation and controlled elapsed timers. It records the actual budget core reads and checks public status at core delivery and a usable native observation opportunity. Exact wall-clock cleanup latency is not promised. Paced mutations, offline transaction restoration, live-query Collections, and actual Electric `awaitTxId` plus provider delivery are not generated by these GC owners. The boundary grammar now generates repeated warm preloads over queued idle and persisting holds, successful and failed cold preloads as first or last releases, both sibling settlement orders, and pending drafts held by subscriptions. Held adapter cleanup crosses settlement with surviving pending or persisting siblings, both before and after cleanup settlement. Exact key comparisons reject leftover settled rows and cleanup resurrection; tracked transaction identities still match unsettled transactions. The 250-history fixed and random campaigns require all 33 declared states. Alongside the 15 focused lanes, constructive interaction histories combine up to seven transactions and three subscribers, delayed commit, three persisting siblings, non-FIFO settlement and preload between releases. Automatic GC also starts held or rejecting adapter cleanup, checks synchronous row discard before adapter settlement, and rejects pending-sibling resurrection. The shared model additionally receives direct updates/deletes, shared update/delete and cancelled insert/delete ownership with a surviving peer update through `collection-lifecycle.gc-mutation-shapes`. Its independent source/intent projection checks exact keys and values across completion/failure/rollback, both Collection orientations and subscriber states; each 150-history campaign requires all 11 declared states. The maintainer chose first-usable-idle retirement as a fixture scheduling assumption, not a public liveness guarantee. The maintainer also chose caller-owned pending draft visibility: keep a subscription; restart after GC does not promise draft restoration. The boundary grammar therefore does not establish post-GC draft restoration, paced/offline restoration, or arbitrary cleanup/source-recovery histories. A real Electric/Postgres receiving driver now crosses gcTime 10/100ms with absent/last-unsubscribed owners, holds an assigned uncommitted txid across the unheld deadline, and observes pending caller, persisting phase, optimistic row, genuine confirmation, successful settlement, synced row, renewed GC and idle delivery. Its 12 paths retain four one-write cases and add eight two-write cases with separate real SQL transactions and both local settlement orders. A genuine acknowledgement releases only one hold; the other SQL transaction remains open beyond the first-release deadline. It shares the model/checker and rejects no-hold and first-release runtime mutants. Native host and real provider are witnessed separately; their combined browser/provider schedule, three-or-more provider writers, provider failure/recovery and persistence wrappers remain outside these bounded receiving histories. The Collection lifecycle GC owners still use fresh disjoint optimistic keys. Before claiming the combined same-key rollback-cascade or confirming-sync-queue law with GC, this owner needs a generated receiving history that crosses those semantic owners at retention and cleanup checkpoints. The history owner's demand-change grammar (`demandChangeLifecycleHistoryArbitrary`, a fixed seed and the random campaign `subscription-lifecycle.demand-change`) adds a third demand, a `replace` command (`replaceSnapshots`: a held replacement whose own load did not fail covers the owners it replaces, law 10), and a `change` command that retires several owners through one `releaseSnapshot(...wheres)` call; the model judges an open replay once after the whole change (law 9). Declared reach: a change during a replay, a replacement covering a failed owner, and a change whose verdict between releases would differ. Per-release judging, first-release-alone, and batching only two-owner changes each fail it. A covered owner's failed replay load reports `loadSubset:error` whatever its settlement order (the model's existing reporting rule; suppressing the last settler fails it), and a prompt cancellation of a covered owner settles the replay as any settlement does. An aborted held replacement covers nothing: the abort ended its load before it applied (maintainer decision: an abort ends the load; law 10), so its replaced owner's failure keeps the replay failed (two 30-times counterexamples, now `keeps a replay failed when a replacement aborted after its replaced owner failed` and its peer-loaded twin; RED on the first simplification, which counted the aborted replacement as covering; a mutant that drops the check fails both). The controller always aborts and releases a segment together, so it never makes that case. An abort ends the load (maintainer decision): the history model's `abort`, and a truncate that replaces an attempt, stop that attempt's gating at once in both `manual` and `reject` cancellation; an owner whose attempt the abort ended before it settled owes the replay nothing, and a rejection after the abort decides nothing (a failure settled before the abort stays). The publication model finishes a replacement at an abort, and the replay oracle's newer attempt drops the older attempts' pending loads. A synchronous throw from `loadSubset` is a rejection (maintainer decision): an acquisition that core releases, also in the acquisition-cell and replay witnesses. RED on 2bc79fc7c: 18 lifecycle tests, 1 refinement test. Mutants that fail: a replay that waits for an aborted load (14), an aborted rejection reported as `loadSubset:error` (19), an aborted load that still holds readiness (17).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | Paced mutations                              | [virtual-clock oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/paced-mutations-oracle.test.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `createPacedMutations` with queue front/back options, bounded waiting capacity at zero and one, cleanup draining in FIFO/LIFO order after a held write, cleanup timing at the configured wait for immediate writes, admitted writes after separate Collection cleanup, debounce and throttle schedules with explicit and omitted options, and first-leading throttle execution at epoch zero. Finite histories compare optimistic rows, returned transaction identity and receipt outcome, execution order and virtual-clock time. Held writes verify queue serialization. Leading-only throttle and debounce witnesses reject skipped calls immediately with their named dropped-call errors, including omitted edges, both edges disabled, and same-row rollback while a prior write is held. Capacity witnesses cover overflow rejection, distinct-key optimistic rollback, same-key admitted-write survival, and in-flight versus waiting admission. Cleanup witnesses check repeated queue cleanup, eventual admitted receipt settlement, direct queue strategy rejection of new callbacks, public post-cleanup rollback with `QueueDisposedError`, pending debounce transactions that wait until the last call's quiet edge after separate Collection cleanup, and a trailing throttle timer that runs at its regular edge after separate Collection cleanup. Deferred custom queue and batch callbacks check compatibility with `void` and `false` execute results, respectively. Frozen options verify factory non-mutation; a mutable option witness checks that debounce uses its construction-time trailing setting. Throwing `onMutate` histories check leading-edge reuse before any row change, failed-row restoration when a pending transaction already has admitted work, eligible leading writes behind a held handler, and throttle pending merges at the throw, start, receipt, and later-timer cuts. New debounce/throttle admission after cleanup, manual commit of a strategy-owned transaction, longer throwing/reentrant bursts, failed persistence, broader capacities and schedules remain outside this owner.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | React paced-mutation render cuts             | [render-cut oracle](https://github.com/TanStack/db/blob/main/packages/react-db/tests/usePacedMutations-render-cuts-oracle.test.tsx), [PR #2170 review](oracle-reviews/pr-2170-react-paced-render-cuts.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `usePacedMutations` publishes callbacks only from committed renders and does so before descendant layout effects, while callback-only commits preserve mutate identity. An independent committed-document model crosses ordinary and StrictMode schedules with mutation before or after a suspended candidate, mutation after the candidate commits, and delayed or immediate mutation from a descendant layout effect. It compares ordered callback traces and public rows at the mutation cut, the trace after persistence, and mutate identity at the commit cut. Render-time publication, layout-effect-only publication, and split insertion/layout publication mutants fail at the intended comparisons. A commit between transaction admission and persistence, arbitrary React schedules, server delivery, and other frameworks remain outside this receiving owner. |
 | Optimistic state                             | [same-key composition](https://github.com/TanStack/db/blob/main/packages/db/tests/optimistic-composition-oracle.test.ts), [history model](https://github.com/TanStack/db/blob/main/packages/db/tests/optimistic-history-oracle.ts), [generated histories](https://github.com/TanStack/db/blob/main/packages/db/tests/optimistic-transaction-oracle.property.test.ts), [outcomes](https://github.com/TanStack/db/blob/main/packages/db/tests/optimistic-history-outcomes-oracle.test.ts), [publication](https://github.com/TanStack/db/blob/main/packages/db/tests/optimistic-history-publication-oracle.test.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Optimistic state drops at settlement and held sync transactions publish with it ([settlement-drop review](oracle-reviews/2026-10-03-settlement-drop.md)); whole-row active overlays, metadata and prior-value events. A raw subscriber without initial state checks that each truncate batch inserts a key once ([2026-10-02 review](oracle-reviews/2026-10-02-truncate-raw-subscriber.md)). Never rebase a pending snapshot merely to simplify the model. Generated histories also write source batches inside mutation handlers, before they return; the Collection must own the request by then ([handler source batch review](oracle-reviews/2026-10-01-handler-source-batch.md)). The same-key transaction lane also authors a delete followed by a reinsert, which must be visible optimistically and net to the truth-table request ([state mutation round 2](oracle-reviews/2026-10-02-state-mutation-round-2.md)). Source rows are written as `insert` for a key the source lacks, and batches may delete keys the source holds ([state-stack mutation gaps](oracle-reviews/2026-10-02-state-stack-mutant-gaps.md)). Batches may also delete a key the source never held. That delete leaves an active request in place ([absent-key source delete review](oracle-reviews/2026-10-02-absent-key-source-delete.md)). A separate partial campaign keeps the default partial row update mode, where source updates may omit a field and merge into the source row, not into an optimistic row ([round 3 review](oracle-reviews/2026-10-05-state-mutation-round-3.md)). An aborted open batch restores the driver's own source rows as well as its keys, so a later partial update still omits the field ([aborted-batch review](oracle-reviews/2026-10-08-partial-update-aborted-batch.md)). A failed synchronous manual `mutate` callback is now checked after same-key update, distinct insert, and same-key delete, with and without earlier intent, plus two two-Collection cases, one with a restoration listener failure. The throw cut compares public rows and pending payload; the later commit checks only surviving intent. A restoration listener error retains the callback error as the aggregate cause and does not stop other Collection restoration. These witnesses allow transient notifications during the callback and do not cover nested throwing callbacks or async work after the synchronous scope. After every step the driver also checks, by transaction identity, that the Collection tracks exactly its unsettled transactions, so a failed or rolled-back transaction leaves the map ([failed transaction retention review](oracle-reviews/failed-transaction-retention.md)). The [transaction ownership oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/transaction-ownership-oracle.property.test.ts) owns release across two Collections: merged-away pairs, conflicting rollbacks with a throwing subscriber, asynchronous success and failure settlements with a throwing subscriber, rollbacks from a `truncate` listener during a sync commit, a reused transaction id, and a `mutate()` callback that throws, checked in the same call stack and after promises flush. It also checks the settlement error shape and that a settled transaction's set of tracking Collections is empty; its mutations still name their Collection, so neither owner claims the Collection is collectable. Focused [restoration ownership](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/restoration-ownership.test.ts) witnesses check that repeated offline `mutate()` calls add to one transaction, that a completed restoration settles `isPersisted`, and that a restoration one Collection cannot track leaves no Collection tracking it. Its grammar also has direct writes (`insert`, `update` and `delete` outside a transaction), optionally with a throwing subscriber that may have been sent the rows first; it captures each direct write's own transaction and requires it to fail when the admission throws and to complete otherwise, counts handler calls (none for a rejected write), and keeps a mirror subscriber on each Collection that must match the rows after every step. A write whose admission throws rolls back only its own transaction and rethrows. The [change-event history oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/change-event-history-oracle.test.ts) generates local-only direct writes that meet a throwing subscriber, registered after the mirror, and requires the call to rethrow with its transaction completed and the rows following the model. Focused witnesses cover a local-only subscriber that writes the key it was told about, and a subscriber that throws a value that is not an Error; whether a throwing subscriber may stop a later subscriber is not decided. Open (approved limits): a direct write made inside another write's change subscriber reports its subscriber failure to the outer write; on a local-only Collection a direct write whose subscriber throws completes on the fast path but rolls back on the transaction path, and the change-event oracle generates only the fast path; a direct write admitted from inside a sync-commit listener, where the rollback's recompute is deferred, is not generated; the generated ownership histories read every receipt themselves, so only a focused witness (rolling back an empty manual transaction) checks that an unread receipt reaches no `unhandledrejection`; two Collection instances with one id, a Collection cleaned up before its transaction settles, and offline restoration have focused witnesses only; no generated history combines a held completed row with a second Collection. |
 | Drafts and native values | [proxy](https://github.com/TanStack/db/blob/main/packages/db/tests/proxy-oracle.test.ts), [detachment](https://github.com/TanStack/db/blob/main/packages/db/tests/proxy-detachment-contract-oracle.test.ts), [iteration](https://github.com/TanStack/db/blob/main/packages/db/tests/proxy-iteration-contract-oracle.test.ts), [revert](https://github.com/TanStack/db/blob/main/packages/db/tests/proxy-revert-oracle.property.test.ts), [native methods](https://github.com/TanStack/db/blob/main/packages/db/tests/proxy-native-methods-oracle.property.test.ts) | Native-operation controls, exact patches and actual stored rows; alias/cycle/adversarial-key histories. Set and Map reorder histories check draft patches and stored iteration order after replacement and clear-and-readd; RegExp replacement/reversion histories check `lastIndex`. General native-mutator and symbol-write support is not established by a plain-object oracle. The revert owner generates assignment, revert, delete, nested, symbol-key, and `for...of` histories and checks `getChanges()` and the draft against an independent draft-equality model: ordered Map and Set contents (including Sets inside Map values), RegExp `lastIndex`, array holes, and symbol keys inside nested values. Map and Set mutators and top-level symbol writes are outside its grammar; array mutators appear only in the mixed block below. Its round-trip grammar also replaces a field with a new object and restores the original value through a nested write. The law requires every changed key, and permits a written key whose final value equals its original to be reported with that value: a false positive repeats the stored value, and a false negative loses a write ([review](oracle-reviews/proxy-revert-replaced-object.md)). A further revert block mixes array `push`, `pop`, and `reverse` with assignments, a nested object replacement, and a retained handle, and checks that a mutator through a replaced handle changes nothing; pinned witnesses require a native write through a Map or Set value, a typed-array view, or a frozen draft to be reported, and a nested revert inside a Map or Set to keep the container's other write; Map and Set mutators are not mixed with assignments, and an equal-valued assignment keeps a retained handle attached (declared). The proxy owner's stored-function law checks, against a native row, that a function stored as data reads back as stored by every read path and that a stored method sees the draft as `this`, so its writes are tracked. The detachment owner pins which key classes a draft copies: enumerable string keys and every symbol key. The revert owner also generates typed arrays (including a subclass that does not forward its constructor argument), URLs, and a class with only private state as written values, with a property that writes two of them over one field. The native-methods owner generates rows (holes, `undefined`, duplicates, nested arrays, empty rows, typed `-0` and `NaN`) and calls every method of `Array.prototype` and `TypedArray.prototype`, in fixed and random campaigns with replay; it compares the result, whether the method returned the array itself, the identity of each original object, and the published row with native values, and a new built-in method fails until it has arguments. The proxy owner's `defineProperty`, stored-function, and frozen-draft laws are bounded tables against native rows. Its `defineProperty` law compares result, value, descriptor, and changes, for values and accessors. The iteration owner checks that array iterators see a push, removal, index write, or length cut made while they are open. Open: a draft reads a class instance of the original row as a plain object, so private-field getters read `undefined`, and a built-in method called through `this` on a nested Map or Set draft rejects the Proxy receiver; a mutator that changes nothing publishes an equal value; writing back a keyless class instance of the original row is a change, and `DataView` setters are untracked ([draft proxy review](oracle-reviews/code-weight-draft-proxy.md)). |
-| Query DB and observer                        | [ownership](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts), [persisted direct-write window](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts) ([review](oracle-reviews/issue-2029-direct-write-lock-window.md)), [load lifecycle](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/load-subset-lifecycle-oracle.test.ts), [observer histories](https://github.com/TanStack/db/blob/main/packages/db/tests/live-query-observer-history-oracle.property.test.ts), [retained snapshots](https://github.com/TanStack/db/blob/main/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts) ([review](oracle-reviews/pr-2043-retained-observer-snapshots.md))                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Real QueryClient boundary, applied-settlement barriers for existing and cached demand, mutation-handler Collection identity, terminal fetch-record lifecycle, and a per-listener eligibility ledger, not a duplicate dispatch queue. The bounded handler grammar crosses insert, update, delete, parameter and mutation-alias access, refetch, and clearError. A held clearError retry retains the prior public error through initial, background, and Collection application failures; success clears it, failure advances the count, including a repeated error at clock time zero. An intermediate Query retry attempt does not recount the previous background error; a held final attempt can succeed or fail. A held application after successful Query fetch keeps the error visible until the applied result. A mocked persisted-baseline scan holds an older success while a newer terminal Query failure arrives; the newer public error and count survive application, including when the Error object and clock tick repeat. Native SQLite persistence, concurrent retries across multiple tracked Queries, mutation-handler fetch-boundary settlement, and deferred result application remain outside this witness. The mutation overlap grammar crosses both start orders. Check reentry, peer survival, FIFO and disposal independently of final rows. A retained observer snapshot shows its capture-time rows on a later first read of `data` or `state`. Direct-write witnesses now distinguish an idle pending eager cache seed (success with no new freshness timestamp) from an in-flight pending request, and require update, delete, and upsert to reach both eager Collections through their shared physical Query, in both acquisition orders. They check both public Collections and the Query cache immediately after each write. A held older shared fetch also crosses B's release and reacquisition, then compares both public rows at refetch and load settlement; mixed select wrappers and three or more co-owners remain outside this witness. The load-lifecycle owner also restores an intermediate checkpoint that keeps an explicit subset refetch pending until a post-write request applies, and rejects a no-cancel mutant at the replacement-request assertion. |
+| Query DB and observer                        | [ownership](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts), [persisted direct-write window](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts) ([review](oracle-reviews/issue-2029-direct-write-lock-window.md)), [load lifecycle](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/load-subset-lifecycle.test.ts) (fixed tests; no oracle owner (tracked in #2264)), [observer histories](https://github.com/TanStack/db/blob/main/packages/db/tests/live-query-observer-history-oracle.property.test.ts), [retained snapshots](https://github.com/TanStack/db/blob/main/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts) ([review](oracle-reviews/pr-2043-retained-observer-snapshots.md))                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Real QueryClient boundary, applied-settlement barriers for existing and cached demand, mutation-handler Collection identity, terminal fetch-record lifecycle, and a per-listener eligibility ledger, not a duplicate dispatch queue. The bounded handler grammar crosses insert, update, delete, parameter and mutation-alias access, refetch, and clearError. A held clearError retry retains the prior public error through initial, background, and Collection application failures; success clears it, failure advances the count, including a repeated error at clock time zero. An intermediate Query retry attempt does not recount the previous background error; a held final attempt can succeed or fail. A held application after successful Query fetch keeps the error visible until the applied result. A mocked persisted-baseline scan holds an older success while a newer terminal Query failure arrives; the newer public error and count survive application, including when the Error object and clock tick repeat. Native SQLite persistence, concurrent retries across multiple tracked Queries, mutation-handler fetch-boundary settlement, and deferred result application remain outside this witness. The mutation overlap grammar crosses both start orders. Check reentry, peer survival, FIFO and disposal independently of final rows. A retained observer snapshot shows its capture-time rows on a later first read of `data` or `state`. Direct-write witnesses now distinguish an idle pending eager cache seed (success with no new freshness timestamp) from an in-flight pending request, and require update, delete, and upsert to reach both eager Collections through their shared physical Query, in both acquisition orders. They check both public Collections and the Query cache immediately after each write. A held older shared fetch also crosses B's release and reacquisition, then compares both public rows at refetch and load settlement; mixed select wrappers and three or more co-owners remain outside this witness. The load-lifecycle tests also restore an intermediate checkpoint that keeps an explicit subset refetch pending until a post-write request applies, and rejects a no-cancel mutant at the replacement-request assertion. |
 | Observer hydration under terminal statuses | `packages/db/tests/live-query-observer-hydration-oracle.property.test.ts` | ARCHITECTURE.md law 16 and the glossary "crash": while a hydration seed is active, a Collection `error` or `crashed` shows in the snapshot, attached or detached, and is announced; an attached observer that sees the failure ends the seed, so cleanup then shows `cleaned-up` and live rows, not the stale failure or the seed. Decision (not a law-16 claim): `cleaned-up` and restart under an active seed keep the seed as `ready`, because cleanup is not a failure and the next sync run's readiness hands off. Generated histories cross both modes, attach order, live writes, `markReady()`, `fail()`, `crash()`, cleanup, and restart, with declared reach; replays pin the crash, fail-then-cleanup, and crash-before-attach traces. Limits: rows under a failure status are not claimed; the source is a plain controlled Collection, not a live-query graph or an on-demand subset; streamed client errors, handoff timing, and framework adapters stay with the focused observer and adapter tests; the property is not in the `oracle-config.ts` path-replay registry. |
 | Query DB SSR dehydration                     | `packages/query-db-collection/tests/ssr-dehydration-oracle.test.ts`, [review record](oracle-reviews/issue-1950-ssr-dehydration.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | A plain Query cache control, a live on-demand compound predicate, a signal-only request, and an ordered cursor with a custom comparator all retain their row through QueryClient dehydration, reconstruction of Seroval's emitted stream payload, and Query Core hydration from that payload. The on-demand query functions still receive the original IR, comparator, and signal; serialized metadata retains enumerable user metadata but excludes request options. The original implementation fails the compound and signal cases at the stream checkpoint. A serializable stream-only request-options leak passes the former chunk-count check but fails the current payload assertion. This owner covers successful Query cache entries at the installed Query Core 5.90.20 and Seroval 1.5.0 versions. A TanStack Start integration owner still needs the reporter's Router 1.171.33 and Seroval 1.6.8 path, browser Collection resume/refetch, and request cancellation across SSR. Query subset and pagination oracles remain owners of predicate/order/cursor meaning and supported value types. The issue's `shouldDehydrateQuery` workaround replaces Query Core's success-only default and admits pending/error queries; any documented workaround must preserve that default filter.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | Query DB ordered refetch | `packages/query-db-collection/tests/refetch-ordered-prefix-oracle.test.ts` | Issue #2136: after preload, and after `utils.refetch()` or a Query invalidation settles, an on-demand Query Collection behind a LEFT-joined, ordered, limited live query must show the window over the current backend rows. The design under test: query-db reports `invalidateLoadedSubsets()` when an ordered page changes keys and either has a later page or ends earlier in the order than before, and each ordered loader runs its bounded prefix repair. Its model is a pure top-k of marked backend rows. A fixed and a random campaign generate rounds of marker flips (which serve continuation pages), backend changes while the provider lags, a second live query (`observe`) whose own demand can load a page's new row first, optional Query invalidation with further changes, and a refetch, across one or two order terms, a numeric or locale-collated string order, limits 1–3, offsets 0–1, and a static or function Query key. With an unchanged backend, a repeated refetch must serve no more rows, start at most one first-page request, and report nothing. A refetch or invalidation must never start a new full-source request. A coverage law runs at the same checkpoints: every backend row from the start of the order through the window's last row (every row, when the window is short) must be in the source Collection with its current values, so a latent gap fails before a marker exposes it; a named replay of the issue trace with the moved row unmarked passes the window law and fails only the coverage law when Query DB never reports. The grammar can hold an optimistic update across a refetch, with the checkpoint moved to its release, and a premise-directed campaign under a hold (other rows observed, a row moved ahead of the page's end, a new row further ahead, a write to the last-sorting observed row) requires a report during a hold in every case and fails a skip that reads rows held back behind the transaction; the general campaigns did not. The general grammar holds optimistic deletes as well as updates. A named replay of a refetch during a held delete left the window short after release, also with this PR's report and overlap changes reverted, until the fix that resumes a continuation after a synchronous answer; no window is checked during a hold, where #2148 and #2169 remain open. Reports (`loadedSubsets:invalidated`) are bounded: a step reports at most once, and only when some ordered request was answered again with different rows; named replays require no report when a one-page window, or a window's last page, only loses a row, and a sync-boundary replay requires a report when a page ending on a row without an order value has its end move earlier (on the earlier gate, which read that page as empty, it reported nothing), and another requires a report when the provider returns a one-page window's rows in reverse order (the earlier gate took the last array row as the page's end). When a page's end moves earlier, Query DB reports, and a loader whose window lies inside its own first page must skip the repair: a named replay of an insert into a top-N list bounds the refetch's requests by its Queries, and a filtered one-page window whose page end moves past an unseen row must still repair (found by the random campaign; a loader that always skips fails it, the f9 tie replay, and the ordered-work oracle's signalling replays). The skip also refuses while the source holds accepted sync rows back: a replay refetches while an optimistic update persists, so the report arrives before the refetched rows are visible, and a skip that reads those older rows fails it. The ordered loader state oracle checks that a prefix read issued before an ordering invalidation, which settles after the bounded repair, does not retire the repair's prefix; the repair-first order failed before that fix. A `loadSubset` call that acquires a released, invalidated page can report, because Query then refetches that page on its own. A failed repair shows only the last window or the right one. Named replays cover the issue trace after a refetch and after an invalidation, with a page-capping provider, with another live query loading the page's new row first, with an empty later page, with a page whose end moves earlier while a tie request holds its old last row, a second refetch after an invalidation, a repair failure, and a provider that honors neither cursor nor offset. Never signalling, the old overlap-to-full-source rule, ignoring empty later pages, reporting on any page change, removing the repair loop guard, and reporting once per page each fail it by assertion. A replay makes a page's application fail and checks the window shows its last result or the right one, then the next refetch restores it; recording a page before its rows are accepted cannot be distinguished, because the failed attempt reports on its own. Open: the report laws bound reports but do not require each one; a page whose end moves earlier reports even with unique order values, where no row can be missing; it does not check whether a repair waits for in-flight work; the generated campaigns use an uncapped cursor provider only (an offset-only provider and a page-capping provider each hit a loader defect that reproduces on main: #2182, #2183); the generated campaigns do not check the window after a marker flip (a named replay checks the trace where the loader stopped refilling after a joined-side removal, which the repair-retirement fix below closed); a failed repair still recovers through the loader's full-source retry; interval, focus, and reconnect refetches share the invalidation path but are not driven; NaN order values have no executable witness; overlapping `refetch: true` acquisitions on one Query hash are counted, so the first to finish does not clear the loop guard for the other, but no witness separates that from a plain set; a Query refetch that joins a running `refetch: true` acquisition on the same hash does not report, and no witness reaches it (#2185); follower tabs of a multi-tab persisted collection never receive the report (#2174). The offset-only and page-capping loader defects have `it.fails` witnesses in the oracle. A finished bounded repair used to discard its boundary when its retirement made Query DB remove a row the loader had sent; the loader then restarted paging with a smaller first page that could not retire the repair's prefix, so every later refetch read both. A named replay found by the random campaign (at four times the run count) and an ordered loader state witness fail on that, and the fix also closed the joined-side refill defect. At four times the run count, the random campaign found a short window that stopped paging before the last row of the order: a report's repair released continuation Queries, and Query DB answered their reacquisition synchronously from its cache, so the graph turn inside each request asked for more while the loader was still requesting and nothing resumed the staged continuation. Only the coverage law failed. A named replay and an ordered loader state witness (a synchronous answer whose writes the graph already processed must continue the chain) fail on that, and pass with the fix. The loader side of the report also has a second owner: the ordered-work oracle's `refetch-signal` provider re-runs each served request alone and reports when any answer changed, across that oracle's generated plans, and a signalling refetch must start no full-source request unless a bounded page in that step ended on a null or NaN rank, which takes the documented full-source fallback (a random seed found that case). Never signalling and the old overlap-to-full-source rule each fail it. It excludes a peer live query, which can keep a short window after a refetch (#2155). The persisted-collection oracle checks that a source's report reaches the Collection through the managed cache-generation wrapper and that a retired source session's report is dropped. Remaining work for this class is tracked in #2186. |
@@ -1486,20 +1496,20 @@ generic visitor behavior outside the named collectors.
 
 | Indexed predicate filtering | `packages/db/tests/query/index-path-collision-oracle.test.ts` | A bounded cross product of numeric values checks exact public keys before and after adding a nested-field BTree index. Direct predicates vary argument order, bound inclusivity, reversed operands, and bound field. Public Collection subscription and live-query callbacks run with and without the index. Selected-field ordering compares a direct JavaScript sort with a public `$selected` callback; restoring the dotted-key proxy cache made that comparison fail. The original compound grouping failed four indexed cases while scan controls passed. The original callback proxy caches also failed both unindexed public routes. A hostile cleanup control preserves the primary mismatch and secondary release error. Arbitrary path segments, nullish values, custom collation, and incremental publication need separate witnesses if claimed. |
 | Lazy target path identity | `packages/db/tests/query/compiler/lazy-targets.test.ts` | A focused same-source `UnionFrom`/`coalesce` witness requires both [`a.b`] and [`a`, `b`] demand targets. Restoring dotted-string deduplication drops the second target at the compiler boundary. A public on-demand adapter and row-publication history still need a separate witness. |
-| Correlated include path identity | `packages/db/tests/query/includes-context-transport-oracle.test.ts` | A flat parent field and nested parent field reach one-level and nested `toArray` results independently; dotted ancestor aliases remain distinct through a grandchild route. Initial results and parent updates have exact public-value checks. A conditional projection gives [`a.b`] and [`a`, `b`] different include results and checks parent-key changes plus later child inserts. Removing the compiler's unique route-key allocator loses a public child result; restoring dotted-string deduplication at either builder site loses a distinct parent value. These fixed witnesses do not establish arbitrary path segments, every recursive source form, or every materialization form. |
+| Correlated include path identity | `packages/db/tests/query/includes-context-transport-oracle.test.ts` | The fixed path witnesses live in `packages/db/tests/query/includes-context-transport.test.ts`. A flat parent field and nested parent field reach one-level and nested `toArray` results independently; dotted ancestor aliases remain distinct through a grandchild route. Initial results and parent updates have exact public-value checks. A conditional projection gives [`a.b`] and [`a`, `b`] different include results and checks parent-key changes plus later child inserts. Removing the compiler's unique route-key allocator loses a public child result; restoring dotted-string deduplication at either builder site loses a distinct parent value. These fixed witnesses do not establish arbitrary path segments, every recursive source form, or every materialization form. |
 | Alias scope identity | `packages/db/tests/query/includes-oracle.property.test.ts` (`includes alpha-renaming across lexical scopes`), `packages/db/tests/query/includes-scope-identity-oracle.ts`, `packages/db/tests/query/includes-alias-shadowing-oracle.test.ts`, `packages/db/tests/query/includes-outer-join-route-work-oracle.test.ts`, `packages/db/tests/query/validate-aliases.test.ts`, [issue #1975 review](oracle-reviews/issue-1975-scope-identity.md) | Four topologies place a source beside a same-named source: a `from()` subquery with an include, a joined `unionAll()` branch with an include, a collapsed top-level pure wrapper with a join subquery, and an include directly on a joined `unionAll()`, which may reuse a branch alias. The grammar crosses zero to two joins, LEFT or INNER, zero to two predicates, plain, ordered-and-limited, or DISTINCT bodies, include forms, and eager or on-demand finite providers, after preload and after source writes. Includes read their source directly, through a join, through a `unionAll()` with an anchor join, or through a `from()` subquery that reads the parent row. One in four scenarios draws any naming; same-scope and union-branch repeats are rejected while ancestor shadowing is admitted. Each checkpoint compares the canonical naming with plain recomputation, the generated naming with the canonical naming, and per-Collection `loadSubset` WHERE clauses. The exact-output companion independently recomputes parent-child rows for direct, QueryRef, union, and implicit-join forms across two equality operand orders, shadowed and renamed aliases, eager and on-demand children, initial publication and parent/child writes. The recursive forms keep a required outer lockId correlation and an independent captured lockName predicate; the union has a nonempty right branch and a later two-branch overlap. It checks enumerable user and virtual key names, user values, multiplicity, sibling helper reuse, a fresh parent/inner QueryRef declaration across a source update, direct, child union-branch, parent union-branch, parent QueryRef, and nested-include rejection of ancestor/descendant builder reuse, one nested grandparent capture, functional callback child input, grouping, captured whole-row and nested-path spreads across shadowed and renamed aliases, eager and on-demand children, and parent/child writes, and query identity. Focused follow-up cells check same-path group keys under shadowing and renaming through parent and child writes, alpha-renamed pure wrappers at public-row and optimized-identity cuts, and indexed lazy demand for direct or wrapped nested includes through anchor and user writes. Wrong-query controls that drop either inner predicate or substitute a parent-shaped callback value fail at the initial public-row comparison. A finite follow-up crosses direct includes and joined QueryRefs with shadowed or renamed aliases, eager or on-demand sources, and child IDs equal to or distinct from an outer filter literal; it checks public rows and on-demand child admission after preload. Another follow-up projects a captured parent rank through a child QueryRef and checks public rows after preload, a child-rank change, and a parent-rank change. The original compiler misrouted the outer filter in four cases, and the original optimizer lost the captured binding in two cases at their first public-row comparison. Every pinned witness and both campaigns fail on `18abceee4`; each of the four optimizer re-mint sites fails a witness when reverted. Arbitrary nested includes, include-inside-subquery forms beyond the checked LEFT joined QueryRef, other join-subquery topologies, `having`, outer joins beyond the bounded RIGHT/FULL matrix, publication events, unload, ordered windows, other lazy join targets, and temporal demand remain outside these owners; they need witnesses before an alias-scope closure claim covers them. Ancestor/descendant builder reuse is rejected before correlation extraction; one helper builder remains legal across a parent QueryRef, union branch, or joined QueryRef and a sibling include child. Six placement/source-mode cells check construction, exact rows after preload, and a source update; the joined placement includes an unmatched manager that would expose a missing helper join. The original source-tree guard rejects all six. A discarded enumeration of a captured proxy cannot change the selected query identity or rows before or after a child update; the retained-marker implementation fails that identity check. The [PR #2079 follow-up](oracle-reviews/issue-2072-alias-shadowing-followup.md) records its RED trace, the repaired spread and nested-QueryRef cells, and the remaining compiler and optimizer evidence gaps. The [ad5e0108 review](oracle-reviews/issue-2072-alias-shadowing-ad5e0108.md) adds a self-join with an inner alias matching the outer joined source, a joined child whose local source competes with inherited parent context in matched and unmatched LEFT joins, captured/local spreads, grandparent whole-row capture, and direct captured-alias selection. These finite cells compare public rows after preload and selected writes; an alias-only lazy-target mutant fails the eager self-join comparison. The reported on-demand failure did not reproduce with the controlled source. A further finite matrix crosses nested FROM or JOIN placement, field or whole-row capture of a shadowed outer joined alias, shadowed or renamed spelling, and eager or on-demand acquisition. It compares source-role rows after preload, child deletion and movement, joined-row update and movement, and parent update; on-demand cases compare nonempty request sets. Disabling projected binding lookup fails all eight cells at the initial public-row assertion; an alias-only lazy-target mutant survives this matrix, so it adds no broader lazy-target claim. A bounded outer-join extension crosses RIGHT and FULL joins, main- or joined-side correlation, direct and QueryRef joined sources, shadowed and renamed aliases, eager and on-demand sources, two parent routes, and seven initial or post-write cuts. Its independent source-role model checks exact public rows, including both absent sides; on-demand cells also require source acquisition. A join-operand extension crosses an ancestor term combined with a local main or joined term, or serving as the whole main key, with equality reversal, alias renaming, source mode, and five public-row cuts. The [outer-join follow-up](oracle-reviews/issue-2072-alias-shadowing-outer-joins.md) records RED and GREEN evidence. A foreign captured join operand must reject: a finite provenance matrix checks root and include placements, matching or different alias spelling, and eager or on-demand sources at construction or preload settlement; valid local and captured-ancestor operands remain controls. A two-LEFT-join history now checks that a later routed QueryRef or captured operand cannot restore an absent shadowed local source, across alias renaming, eager/on-demand mode, two parents, and local and second-joined arrival/removal. It also selects and updates a parent label while joins are matched, checking that the main route retains that ancestor value. A nested joined QueryRef control projects its join key from an inner tag source while the post alias shadows or renames an outer user alias; an independent plain-row model and installed on-demand post/tag rows are compared at preload, a user-key move, and a tag update. A wrong Collection/SourceId pair loads an irrelevant post at preload and fails the installed-row check. Other nested source shapes and real-provider request schedules remain outside this control. The route-work owner compares public rows and assembled parent-route work as irrelevant joined rows grow for direct main-correlated RIGHT/FULL joins in both source modes; an unconditional-route mutant grows from two to six pairs at preload. RIGHT joins correlated on main now join the outer-join row matrix, beside joined-side correlation and FULL controls. An include child rejects a bound join operand declared inside its parent QueryRef or union branch, across matching/renamed aliases and eager/on-demand sources; the original source-tree collector resolves preload instead of rejecting. A joined QueryRef rejects a captured source declared beside it in the enclosing query: the matrix crosses root/include placement, matching/renamed inner alias, and eager/on-demand sources; four true-ancestor controls assert rows, and the permissive sibling-scope mutant fails all eight invalid cells while those controls pass. The primary oracle now extends the hidden-source rejection through two QueryRef or union levels, with matching/renamed aliases and both source modes; a source-tree-binding mutant fails all eight added cells at the rejection cut. An unrelated bound reference is rejected in WHERE, GROUP BY, HAVING, ORDER BY, direct SELECT, and conditional SELECT across matching/renamed aliases; legal local controls and a grouped include with captured ancestor predicates, HAVING, ordering, shadowing, and parent/child writes prevent a blanket rejection. It also rejects foreign references moved into extracted include parent filters or into the removed correlation equality, each across alias spelling and source mode with valid parent controls. Disabling expression validation fails twelve non-join cells; omitting parent-filter or extracted-correlation validation fails four cells each. A separate plain relational model checks RIGHT-to-LEFT, RIGHT-to-RIGHT, FULL-to-FULL, and FULL-to-LEFT two-join chains under shadowing/renaming, both source modes, main/joined/tag correlation, and six source or ancestor writes; a later-FULL-as-LEFT mutant fails two initial public-row comparisons. The route-work owner now compares public rows and parent-route assembly counts at preload and four main-source writes while irrelevant joined rows grow. Other expression forms, arbitrary join-subquery and lazy-target shapes, deeper captures, other chained outer joins, real-provider schedules, and broader source-work bounds remain open under this owner. The alias-scope owner also checks outer grouping through a nested QueryRef and joined source with shadowed or renamed inner alias, eager or on-demand acquisition, and four source/tag writes at five public-row cuts. The tag insertion duplicates one joined source and the plain model counts both copies. A controlled rewrite probe reached an unbound pushed WHERE inside the QueryRef while the bound GROUP BY remained outside; an inner GROUP BY blocked that pushdown. A matcher mutant that ignored binding IDs failed two same-path group cells at the first public-row cut; a dropped-pushed-predicate mutant failed all four new cells by publishing an extra group. This refutes the reported WHERE-rewrite-to-GROUP-BY-matcher route in those shapes; another lost-provenance route needs a concrete fixture. Base/head work probes confirmed an extra pure-wrapper stage after #2079, but the same full-source outer-WHERE request and keyed lazy-join request on both revisions. No wrapper-stage work budget or safe binding remap is established. Bound root refs caused two route-metadata symbol checks per evaluation on the current head versus zero on base, while captured-ancestor rows remain protected by the primary oracle; a compile-time fast path needs a justified work budget and a preservation witness. The same function-form subquery placed twice compiled two results and invoked its callback four times for two source rows on both revisions. Cache comparison read more query properties on the current head, and a stateful callback produced placement-specific values. A callback identity or purity rule and work budget are needed before cache-equivalence changes. |
 | Join equality and cold acquisition | `packages/db/tests/query/cold-join-reconciliation-oracle.test.ts` | Independent recomputation for cold acquisition plus direct join/predicate equivalence across established equality domains. Binary/string and nullish classes, replacement histories, raw on-demand values, and both scan/auto-index paths are explicit; the compound lane also covers tuple equality, term order, all four join types, controlled cold sources, and keyed histories. Positive acquisition witnesses require a satisfiable tuple. |
-| Aggregate selects | [aggregate select oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/query/aggregate-select-oracle.property.test.ts) | Generated select shapes of aggregate queries with and without `groupBy` by `c.k`, the pair `c.k`, `gt(c.v, 1)`, the triple that adds `gt(c.v, 2)`, `upper(c.k)`, `inArray(c.k, ['a', 'b'])`, a Date-valued `coalesce` or a `NaN`-valued `add`, rebuilt per use (literals, parent fields, the group key, the raw field `c.k`, source fields, `count`/`sum`/`max`, `add`, `caseWhen` with expression or object branches, nested objects, spreads, a nested include) and a HAVING condition that may compare an aggregate, selected as a field or not, at the top level, directly or through a `unionAll`, and in an include whose source may shadow the parent alias, through parent updates and source inserts, updates (including key changes that move a row to another group and route) and deletes. A shape throws `NonAggregateExpressionNotInGroupByError` exactly when a non-key source field appears outside an aggregate in its select or HAVING, or the shape spreads a row or holds a nested include; otherwise every published group equals the model and keeps the select's field order. The same grammar checks the opt-in operator laws: a grouped query whose select and HAVING hold no aggregate throws `GroupingOperatorRequiredError` when its keys are passed bare, and works through `groupKeys()`; a bare query builder throws `IncludeOperatorRequiredError` as a field, inside a nested object, or in a conditional branch; a wrapped include inside a nested object throws (a conditional branch may be an include; the includes-collection oracle publishes one, and a compiler that rejects one fails both that oracle and this one). When several errors apply, any one of them passes. Includes are wrapped in `toArray()`, `include()`, or `materialize()`. In three generated histories of six, the driver strips one kind of operator code, the grouping compiler, the include runtime, or the grouping compiler of the `orderBy` aggregate only, from the IR it built. One history in three is a forced history that strips the grouping compiler everywhere or from `orderBy` only, with no, one, or two group keys in turn, so every campaign reaches each path and compiles it through `new BaseQueryBuilder(ir)`; IR without its operator code must throw the coded error for the missing operator. A runtime-stripped history gives its include a child query that is valid on its own, so other errors cannot hide the missing runtime. Half the grouping-stripped histories give the top-level query a select of `count()` alone, with an aggregate HAVING when the generated shape has one, so a model error set of exactly `groupingRequired` witnesses the grouped, one-group, and HAVING paths. The top-level and include queries may order their groups with one or two `orderBy` calls, each on an aggregate or on a number or string select field through `$selected`, strings with the documented `en-US` collation: published rows and each parent's `kids` fall into blocks of equal values in that order. An `orderBy` aggregate that no top-level field selects throws `AggregateFunctionNotInSelectError` (now stated in the guide's "Ordering by SELECT Fields"), and a stripped `orderBy` aggregate compiles with the compiler that `groupKeys()` or a select or HAVING aggregate brings. One history in four takes ordered shapes from a grammar whose shapes compile, because generated ordered shapes compile in about one case in forty; the source starts with a key `A`, where locale and code-unit order differ. The property declares twenty-one states with `createOracleReach`, and each campaign of 160 histories reaches each of them; without the forced select, the one-group and HAVING states were never reached, and a mutant that throws the wrong error class only on the implicit path passed three campaigns. Pinned witnesses in `hand-built-ir-operators.test.ts` cover the old `IncludesSubquery` argument order, an aggregate only in `orderBy` without a select aggregate, and the mixed `orderBy` replay. The compiler before the order step took the query's grouping compiler fails the generated `orderBy` dimension (`top compiles`); an order step that ignores direction, keeps only the first `orderBy` call, or sorts strings by code unit, an include query that ignores direction, a group step that keeps only the first one or two keys, and a check that throws the wrong error class only beside HAVING each fail it (the last passed two of three campaigns before the alone states). A mutant without the include-runtime check, which publishes `kids: null`, and one without the grouping guard, which throws a `TypeError`, both fail it. A mutant that skips the grouping-operator check fails it with a `TypeError`, and one that treats a bare builder as an include fails it with the wrong error class. Open: an `orderBy` term on a raw expression other than an aggregate, and on boolean, Date, `NaN`, or object fields, whose order the docs do not state. The operator laws are generated only for aggregate and grouped selects; for plain selects, `includes.test.ts` pins a bare builder as a field, nested, and in a conditional, because this model publishes one row per group and needs a separate row-per-source model for them. |
+| Aggregate selects | [aggregate select oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/query/aggregate-select-oracle.property.test.ts) | Generated select shapes of aggregate queries with and without `groupBy` by `c.k`, the pair `c.k`, `gt(c.v, 1)`, the triple that adds `gt(c.v, 2)`, `upper(c.k)`, `inArray(c.k, ['a', 'b'])`, a Date-valued `coalesce` or a `NaN`-valued `add`, rebuilt per use (literals, parent fields, the group key, the raw field `c.k`, source fields, `count`/`sum`/`max`, `add`, `caseWhen` with expression or object branches, nested objects, spreads, a nested include) and a HAVING condition that may compare an aggregate, selected as a field or not, at the top level, directly or through a `unionAll`, and in an include whose source may shadow the parent alias, through parent updates and source inserts, updates (including key changes that move a row to another group and route) and deletes. A shape throws `NonAggregateExpressionNotInGroupByError` exactly when a non-key source field appears outside an aggregate in its select or HAVING, or the shape spreads a row or holds a nested include; otherwise every published group equals the model and keeps the select's field order. The same grammar checks the opt-in operator laws: a grouped query whose select and HAVING hold no aggregate throws `GroupingOperatorRequiredError` when its keys are passed bare, and works through `groupKeys()`; a bare query builder throws `IncludeOperatorRequiredError` as a field, inside a nested object, or in a conditional branch; a wrapped include inside a nested object throws (a conditional branch may be an include; the includes-collection oracle publishes one, and a compiler that rejects one fails both that oracle and this one). When several errors apply, any one of them passes. Includes are wrapped in `toArray()`, `include()`, or `materialize()`. In three generated histories of six, the driver strips one kind of operator code, the grouping compiler, the include runtime, or the grouping compiler of the `orderBy` aggregate only, from the IR it built. One history in three is a forced history that strips the grouping compiler everywhere or from `orderBy` only, with no, one, or two group keys in turn, so every campaign reaches each path and compiles it through `new BaseQueryBuilder(ir)`; IR without its operator code must throw the coded error for the missing operator. A runtime-stripped history gives its include a child query that is valid on its own, so other errors cannot hide the missing runtime. Half the grouping-stripped histories give the top-level query a select of `count()` alone, with an aggregate HAVING when the generated shape has one, so a model error set of exactly `groupingRequired` witnesses the grouped, one-group, and HAVING paths. The top-level and include queries may order their groups with one or two `orderBy` calls, each on an aggregate or on a number or string select field through `$selected`, strings with the documented `en-US` collation: published rows and each parent's `kids` fall into blocks of equal values in that order. An `orderBy` aggregate that no top-level field selects throws `AggregateFunctionNotInSelectError` (now stated in the guide's "Ordering by SELECT Fields"), and a stripped `orderBy` aggregate compiles with the compiler that `groupKeys()` or a select or HAVING aggregate brings. One history in four takes ordered shapes from a grammar whose shapes compile, because generated ordered shapes compile in about one case in forty; the source starts with a key `A`, where locale and code-unit order differ. The property declares twenty-one states with `createOracleReach`, and each campaign of 160 histories reaches each of them; without the forced select, the one-group and HAVING states were never reached, and a mutant that throws the wrong error class only on the implicit path passed three campaigns. Pinned witnesses in `hand-built-ir-operators.test.ts` cover the old `IncludesSubquery` argument order, an aggregate only in `orderBy` without a select aggregate, and the mixed `orderBy` replay. The compiler before the order step took the query's grouping compiler fails the generated `orderBy` dimension (`top compiles`); an order step that ignores direction, keeps only the first `orderBy` call, or sorts strings by code unit, an include query that ignores direction, a group step that keeps only the first one or two keys, and a check that throws the wrong error class only beside HAVING each fail it (the last passed two of three campaigns before the alone states). A mutant without the include-runtime check, which publishes `kids: null`, and one without the grouping guard, which throws a `TypeError`, both fail it. A mutant that skips the grouping-operator check fails it with a `TypeError`, and one that treats a bare builder as an include fails it with the wrong error class. Open: an `orderBy` term on a raw expression other than an aggregate, and on boolean, Date, `NaN`, or object fields, whose order the docs do not state. The operator laws are generated only for aggregate and grouped selects; for plain selects, `includes.test.ts` pins a bare builder as a field, nested, and in a conditional, because this model publishes one row per group and needs a separate row-per-source model for them. Open: the random campaign's declared reach of "a string field orders A against a lowercase key" can miss on an unlucky seed. One full run on 2026-10-28 missed it (0 histories at 160 runs); 15 reruns reached it. The reach check runs after the campaign, so the miss records no replayable seed. Needed: a grammar weight that makes the case common, or a reported seed for a missed reach. |
 | Query optimizer semantics | `packages/db/tests/query/optimizer-semantics-oracle.test.ts`, [aggregate review](oracle-reviews/2026-09-28-optimizer-aggregate-pushdown.md), [QueryRef repair](oracle-reviews/2026-09-30-queryref-publication-repair.md), [residual review](oracle-reviews/2026-10-01-pr-1977-residual-convergence.md) | Independent sum recomputation and a materialized-Collection formulation check the first public snapshot of a nested aggregate under a left join. Direct, arithmetic-wrapped, and conditional aggregates distinguish safe from unsafe pushdown; a grouped-key control covers the grouped boundary. Matching and nonmatching global aggregates also cross a nested QueryRef inner join with absent, accepting, and rejecting outer predicates. The matching initial cases fail on the pre-repair revision and pass after the computed-projection lookup repair. A separate fixed residual-convergence grammar checks exact predicate and outer WHERE clause counts at `optimizeQuery` return and after re-optimization: LEFT, RIGHT, INNER, and FULL joins; equality, greater-than, nullable-field `isUndefined`, same-source OR, cross-source equality, clause order, separate/AND form, two active predicates, two residual sources, and an existing residual marker. Plain-array LEFT/RIGHT and three-source join models check first public rows, including unmatched rows. Arbitrary expressions, more complex join chains, and incremental optimizer/publication histories remain outside this owner. |
 | QueryRef operators and user-value boundaries | `packages/db/tests/query/subquery-user-value-oracle.test.ts`, `packages/db/tests/transactions.test.ts`, [repair record](oracle-reviews/2026-09-30-queryref-publication-repair.md) | A finite array/Set model checks the compiled output bag for a joined DISTINCT subquery with an outer WHERE. Live-query drivers check selected containers, no-select, functional, and predicate-literal user objects with IR-like fields, top-level and aggregate-subquery proxy-shaped fields, arrays of selected references, outer virtual-field filters on joined DISTINCT and nested aggregate QueryRefs, and a renamed no-select source. The transaction suite documents the existing development-browser duplicate-load guard. The bounded cases run in `test:oracles` or the full DB suite. Joined DISTINCT, nested and flat aggregate source-update histories pass. Ordered joined `findOne()` checks initial, singleton, empty, restored, and changed-join-key cuts; an unordered `findOne()` QueryRef on either side of a join checks default-key candidate deletion and reinsertion. A materialized joined `findOne()` supplies a separate receiving formulation. Other `singleResult` forms, join forms, schedules, and cross-copy value handling outside the duplicate-load guard remain unproved. |
 | Opaque backend pagination | [window oracle](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination.oracle.test.ts), [cache histories](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination.cache-oracle.test.ts), [cache publication](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination.publication-oracle.test.ts), [browser acquisition boundaries](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination.boundary-oracle.test.ts), [QueryCollection integration](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination-oracle.integration.test.ts) | Full filter/sort/slice reference, opaque token transport, actual Query cache expiry/invalidation/GC, forced refresh during growth, protocol failure publication/recovery, bounded slice work, nested cancellation/replacement, reader abort, browser retry defaults, manual-write cache isolation, and production window publications. Stable backend sequences; not snapshot guarantees for changing endpoints. Peek-ahead remains enabled. |
 | Experimental no-peek continuation | [test-only live-window probe](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination-oracle.no-peek.integration.test.ts) | The candidate uses an authoritative fact only for the same complete output prefix and otherwise requests the extra row. It remains test-only; the shipped opaque-pagination owner keeps peek-ahead. See [experiment limits](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/cursor-pagination/NO-PEEK-RESULTS.md). |
 | Electric and TrailBase                       | [Electric histories](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/tests/electric-oracle.property.test.ts), [recovery histories](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/tests/electric-recovery-oracle.test.ts), [held resume snapshots](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/tests/electric-resume-snapshot-races.test.ts), [PostgreSQL semantics](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/e2e/sql-predicate-semantics-oracle.e2e.test.ts), [TrailBase contract](https://github.com/TanStack/db/blob/main/packages/trailbase-db-collection/tests/ORACLE.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Installed SDK delivery/framing, independent predicates, exact subscription arguments, restart/reset lineage, held certification and durability races, source-order publication before durability, and late errors. The queued-presence property runs identical fixed/random generators plus isolated seed-and-path replay across insert, update, delete, and truncate callbacks. The recovery fixtures use a mocked ShapeStream; they do not establish live Electric-service framing or native persistence-host behavior. The TrailBase lifecycle oracle's early-demand lane checks that an on-demand load issued before the change listener runs does not fetch until the listener runs or cannot start, through a real live query and the subset boundary: 16 histories cross listen, subscribe rejection, reader failure, abort, and cleanup with a service change before the subscription; the adapter from before the wait fails all 16. Its page-event lane checks that a page read before a concurrent change event neither reverts nor resurrects that row, and its stream-end lane pins that the adapter does not resubscribe: 17 histories, 6 of which fail on the adapter before the page fence. A generated page lane (`trailbase.page-event`) crosses two-page loads, cursor and offset paging, overlapping on-demand loads, and up to four changes among page releases. A held-commit lane checks that a page never fails a load for an older event that core holds while a user mutation persists; deciding insert or update from visible rows fails it. After a generated history drains, the Collection holds exactly the rows a page returned or an event touched. Both page lanes deliver events for changes made before the list call at once, during the page, or after it applies, and check that the listener survives a late insert for a row a page already holds. The retry-decision property (`electric.retry-decision`) generates histories over full-log and progressive waits, with and without `onError`, crossing synchronous and asynchronous retries and give-ups, a throwing `onError`, a later error after a retry, an Electric client give-up, an external abort before or during a decision, new demands, the first up-to-date, a persisting optimistic transaction that holds the retried snapshot and later settles, and cleanup. The retry-decision grammar also crosses eager and changes-only sources, an external signal already aborted at sync start, and a status listener that cleans up inside the failure; it checks that a readiness wait rejects with the same cause as every waiting demand, and that such a cleanup leaves a rejected demand rejected. It also holds the acceptance of the first up-to-date commit across later errors, retries, give-ups, and aborts, and checks that the Collection becomes ready with the snapshot's rows when the commit is accepted, and fails with the acceptance's cause when it is not. The descriptor-isolation oracle holds that acceptance across a managed-cache rotation and checks that the retired session's acceptance settles nothing, whether it resolves or rejects, and that the replacement session's snapshot decides readiness. A progressive snapshot's truncate applies at once; a demand whose snapshot arrived before an external abort settles when its rows apply, and cleanup after the abort rejects it. An independent model checks the status, every demand's settlement and cause, and row visibility after each step: a source that still tries stays `loading`, and only a give-up fails its waits. `main` before #2127 and mutants that fail before the decision, skip the failure on a throw or give-up, or skip `markError` on a client give-up or an external abort each fail it at an assertion. An installed-client lane in the SDK delivery oracle drives the same model (`electric-retry-decision-model.ts`) through the real Electric client and HTTP: a retried 503, a response without Electric headers, and an exhausted 50-retry budget, in eager, full-log, and progressive modes, with a synchronous or asynchronous retry (18 cells). Skipping `markError` on the client's give-up fails the 12 give-up cells; failing before the decision, or `main` before #2127, fails 15; the 3 survivors give up in the same continuation that decides, so an early failure is not observable there. A mutant that settles a held demand on acceptance instead of visibility fails the held replays. Excluded: stream steps while `onError` decides or after a final failure, which the client cannot produce. The source-release property (`electric.sdk-source-release`) checks that cleanup removes every `visibilitychange` listener that the installed client registered for a sync run's streams: one to three runs in eager, on-demand, and progressive modes, each answering up to three requests with row-only delivery, an up-to-date, an HTTP 409 reset, or a retried 503, then staying open, giving up, aborting the external signal, or holding an asynchronous retry/give-up decision through cleanup and later runs, with restarts through `preload()`. It declares separate cleanup reach for partial delivery, reset before a later up-to-date, and a pending error decision. The minimal partial/reset histories cross all five endings in every sync mode through the same driver. It compares the live listener count with the number of active runs after each step. The recorder tracks ordered callback/capture identities with duplicate-add semantics; all 8,421 add/remove histories of length zero to three over two callbacks and five capture spellings compare its count with native EventTarget dispatch before teardown. Recorder teardown independently removes retained registrations after the comparison; bounded callback-subset enumeration checks actual EventTarget dispatch and preservation of a primary failure. `main` before the fix, and mutants that release only while the stream is unaborted or only without a final initial failure, fail it at cleanup; the generated managed-rotation property (`electric.sdk-rotation-release`) checks the approved Electric deadline before replacement `ShapeStream` construction. It rotates one to three times in one on-demand sync run, so a replacement session is itself retired. Each old HTTP snapshot arrives during held rotation, before replacement snapshots, or after their settlement. It declares reach for all three delivery cuts, initial/replacement session retirement, and demands awaiting replacement source responses. A transparent constructor observer records zero retired listeners immediately before the real SDK constructor; both retained demands stay pending while rotation is held and before any replacement response, then fulfill after their source snapshots apply. Fresh public/current-generation durable rows, late old-response rejection, and final cleanup comparisons remain. Each round also remembers its retired storage target and checks that the late response's absent key reaches neither that target after delivery nor after replacement settlement. The seventh declared state requires this retired-target observation. This constrains the expired session's row; unrelated retained rows remain allowed, and a separate run with a valid claim can still use a retired generation. Assertion inputs copy mutable observations so cleanup cannot change their failure payload. The browser listener is observed in jsdom; React Native's AppState adapter and overlapping rotations are outside this generated lane. |
-| PowerSync                                    | [tests](https://github.com/TanStack/db/tree/main/packages/powersync-db-collection/tests), `tests/correctness-oracle.test.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Applied receipt positions crossed with held peers, native SQLite/SDK and cleanup evidence. A metadata-bearing `Collection.update` passes through an observed SDK watcher callback to the public and SQLite rows and an exact queued CRUD patch. Held callback ordering and synthetic zero-field cases remain controlled-only, and remote upload has no receiving fixture here. Run the focused owner with the package's `test:oracles` command. A timeout mutant proves a progress failure, not every value assertion.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| SQLite persistence and native hosts          | [persisted histories](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts), [reset/resume histories](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-oracle.test.ts), [setup reopen](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/collection-setup-reopen-oracle.test.ts), [reload class](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/reload-class-oracle.ts), [dual-adapter resume snapshots](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-oracle.test.ts), [Browser composed-owner histories](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-oracle.test.ts), [Browser coordinator RPC](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts), [shared-driver fairness](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.test.ts), [driver contracts](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/contracts/sqlite-driver-contract.ts), [Node shared-handle scheduling](https://github.com/TanStack/db/blob/main/packages/node-db-sqlite-persistence/tests/node-driver.test.ts), [OP-SQLite shared-handle scheduling](https://github.com/TanStack/db/blob/main/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts), [browser OPFS lifecycle](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts), [worker diagnostics](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/opfs-worker-diagnostics-oracle.test.ts), [request order](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/opfs-request-order-oracle.ts), [Electron IPC and composed owner](https://github.com/TanStack/db/blob/main/packages/electron-db-sqlite-persistence/tests/electron-ipc.test.ts), [113-law manifest](https://github.com/TanStack/db/blob/main/packages/db-collection-e2e/src/fixtures/persisted-conformance-manifest.ts), [persisted sync problems](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts), [persisted reload replacement](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts) | Core cache/remote rejection/peer/reopen histories, atomic reset/resume lineage, key-set evidence, dual-adapter races, queued coordinator reload/gap notifications during startup, unscheduled startup/reset overlap, and exact driver results. The persisted sync-problem oracle (`packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts`) owns how the wrapper reports failures of its own remote work and to which sync run: a later successful remote request ends the wrapper's remote failures (maintainer decision: a coarse clear, by any remote request that succeeds, the same one repeated or another; 8 histories failed before it, and a wrapper without the clear fails 7); 35 histories over eight sites (coordinator release, the adapter's own `unloadSubset` throw or reject, scoped refresh ensure and release, rotated reacquisition through a routed or single-process coordinator, and a reload's cleanup release), each crossed with ready or loading and with the current run or a run that `reload()` retired before or after the new run's `markReady()`. A remote failure is a ready Collection's failure reason and never a crash; before the first ready it is only logged; an `unloadSubset` breach surfaces uncaught; a retired run's failures change nothing in the new run and never reject its cleanup. HEAD failed 29 histories; mutants that crash, remove the generation fence, or let a cleanup release reject each fail. Limits: controlled adapter and coordinator doubles; no Browser or Electron follower routing; no coordinator retry queue. The persisted reload-replacement oracle (`packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts`) checks over 40 histories that the wrapper forwards `begin({ snapshot })` and `truncate({ markReady })`, that its restore and metadata commits replace nothing and do not complete a reload, and that durable rows equal visible rows after a replacement. HEAD's wrapper failed 15; a dropped snapshot, a non-durable snapshot, dropped truncate options, and a restore marked as a snapshot each fail. Limits: eager Collection only, in-memory adapter. The setup-reopen owner checks that a fresh adapter's first read repairs an interrupted setup, every subset of missing indexes, triggers, and bookkeeping rows, and a schema change to the fresh-install schema with rows kept or reset; complete setup costs at most one driver call over a cached read. It excludes cache-generation claims and concurrent adapters; the held-registration resume cases cover a collected generation at the setup DDL and at the registry read. The reload class owner keeps the reload law, model, histories, driver loop, and comparison in one module, with four production drivers: the Node Browser driver (real Browser persistence and coordinator, one connection per tab), the Node Electron driver (real renderers and main handler with an in-process `ipcMain` double), the real Chromium OPFS page, and a real Electron app (renderer over real IPC to a main process running the Node persistence over `node:sqlite`). Histories cover 1 to 4 eager or managed Collections with any subset of missing derived setup facts, a schema change, a database missing a migrated column or index, lock grants 1 to 5 tasks after the request, statement latency where the host controls it, a local write during another startup read (issued before or after its grant), a write held in flight at another Collection's grant, a follower write, a write from a third tab, takeover (also while a follower read is held after an earlier follower or third-tab write, and while a follower that knows the departed leader's route has a source commit queued behind a held subset read, which it flushes after the grant or which the departed leader received and never answered), restart, and a tab closed while its terms wait. It checks skipped and repaired Collection and database setup, that no term runs ahead of work queued on its tab at its grant unless a leader need is live in that election (a need that an earlier election served exempts none), that needs elect and settle, that a takeover's queued source commit settles within one RPC timeout (one timeout and a retry when the departed leader received it), and an exact per-reload budget: one registry read per adapter, one row scan per tab, two startup snapshots per eager Collection (metadata before the source starts, rows at the baseline hydrate, both required by the Electric resume laws), no rescan after a commit the tab already knows, and no database setup statement when it is complete. The implementation on origin/main fails every fixed history: the original 24 on all four drivers, and the 5 that cover per-election needs on the Node Browser driver. Production on this branch passes all 29 on all four drivers. The Node drivers reject 14 production mutants by assertion, including a lasting need latch, an earlier served need from this tab or another, a need still waiting at the grant that is ignored, and a grant that keeps the departed leader's route. The Browser coordinator RPC owner's per-election cells also reject those latches and a delayed heartbeat from the departed leader that restores its route during an election. Real Chromium rejects the never-waiting barrier across its histories; the real Electron app rejects it in 10 of the 29 fixed histories; in the others, real IPC finishes the startup reads before any grant. Hold seams patch the adapter in the process that runs it. Not owned here: a barrier that skips queued but not yet running regular work, which driver transaction order and the writer lock hide in reload histories; the shared logical scheduling oracle owns it. The real Electron app uses `node:sqlite` because Electron's ABI cannot load better-sqlite3; a native better-sqlite3 build for Electron is not run. The shared core-adapter contract checks custom local comparator dispatch for ascending, descending, and comparator-equal public-key ordering at `loadSubset` completion. Host packages register this contract, but the local sqlite3 CLI run does not prove native host execution. Browser composes public source commits with per-collection elected-owner routing and covers the complete committed-transaction wire partition through deterministic Node transport seams. Remote-subset histories distinguish logical demand, physical acquisitions, exact acquisition leases, and released replay tombstones. Electron composes source commits with a per-collection renderer owner, IPC adapter, real SQLite, and reopen checks. The shared-driver fairness owner checks K=1 complete-logical-hydrate scheduling with identical fixed, random, and seed-plus-path campaigns. It records public rows, raw dequeue reach, and a persist-first FIFO hostile control. Its Chromium OPFS fixture refines the provider boundary but does not establish a browser matrix, elapsed-time latency, unbounded eventuality, or multi-process coordination. Same-handle Node and OP-SQLite tests cover transaction admission. Controlled OPFS page/worker histories cover ownership and diagnostic-cause retention. The reset/resume owners use sqlite3 CLI and in-memory node:sqlite seams; they do not prove multi-process WAL, mobile/Tauri, or other native-device execution. Distinct database handles rely on SQLite lock admission rather than one in-process queue. React Native hosts without async-context propagation must use the transaction driver supplied to the callback for nested work. Fake workers and synthetic page events do not prove native handle release or real bfcache admission. The Browser composed seams are not real multi-context/OPFS-worker execution; the Electron harness is not an actual Electron process unless its explicit runtime-bridge mode runs. An ownerless elected node suppresses core routing, while a follower may route demand to the elected owner. The follower generation-notice and rotated-reacquisition lanes state the rotation law: a rotated follower holds the new generation's commit notices until the owner has reacquired every active demand, then ends scoped recovery and applies them. Production does not yet end that recovery, so their cells that require it are pinned as failing under the known gap [#2139](https://github.com/TanStack/db/issues/2139); the random generation-notice campaign is omitted until the fix, because some of its histories pass today. Cells that still pass cover failed reacquisitions (scoped recovery stays and the failure is reported), a superseding rotation as leader, and a scoped recovery without rotation, with or without an active demand (untrusted durable rows stay hidden). Other cells cover a follower whose claim expires while its ensure is in flight and an owner reset (the follower requests its demand again). The follower remote-demand lane checks that a follower's load, and a live query over its demand, settle only after the owner's broadcast applies here, for a broadcast that applies at once, one queued behind another subset's hydration, and one while the cache claim is expired; the claim-rotation placement is pinned under #2139. A failed apply rejects the load, errors the query, and fails the source. A renewal that fails transiently at the reply rejects the load but keeps and retries the demand, without releasing the owner's acquisition; a rotation during the reply wait is tracked under #2139. The flush-side expiry check and arrival-order queueing have no killing witness yet. Removing the follower's wait on either ensure path, its terminal check, or the queued flush's terminal marking each fails it. The Electron IPC readiness oracle checks a fresh or reopened renderer, a successful or failed IPC hydration, and an upstream load that succeeds, fails, or is released during hydration, against a model of the three readiness checkpoints; a renderer that replies before the main-process read or treats an IPC failure as empty fails it. The owner is a controlled coordinator double, not two real coordinators; host coordinators retry only classified transport or admission failures while demand remains retained. The manifest excludes progressive and move suites; registration and shim runs are not device execution. The per-collection coordinator oracle's real-tab lane runs a follower and an owner tab with real Browser coordinators over Node's BroadcastChannel and Web Locks and one real SQLite file: 16 histories over the owner's source (custom or Query Collection), the broadcast's placement, the follower's apply outcome, and the consumer, plus a rotation cell. Main fails all 16 histories; an owner tab for a rotated follower generation is not reachable there. The Electron IPC readiness oracle adds a follower and an owner renderer with Electron coordinators: 4 histories over the apply outcome and the consumer, in process and through a real Electron main process; main fails all 4. |
+| PowerSync                                    | [tests](https://github.com/TanStack/db/tree/main/packages/powersync-db-collection/tests), `tests/correctness.test.ts` (fixed tests; no oracle owner (tracked in #2264))                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Applied receipt positions crossed with held peers, native SQLite/SDK and cleanup evidence. A metadata-bearing `Collection.update` passes through an observed SDK watcher callback to the public and SQLite rows and an exact queued CRUD patch. Held callback ordering and synthetic zero-field cases remain controlled-only, and remote upload has no receiving fixture here. Run the focused owner with the package's `test:oracles` command. A timeout mutant proves a progress failure, not every value assertion.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| SQLite persistence and native hosts          | [persisted histories](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts), [reset/resume histories](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-oracle.test.ts), [setup reopen](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/collection-setup-reopen-oracle.test.ts), [reload class](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/reload-class-oracle.ts), [dual-adapter resume snapshots](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-oracle.test.ts), [Browser composed-owner histories](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-oracle.test.ts), [Browser coordinator RPC](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts) (fixed histories and the source-commit scheduler-order test live in `packages/browser-db-sqlite-persistence/tests/browser-coordinator.test.ts`), [shared-driver fairness](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.test.ts), [driver contracts](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/contracts/sqlite-driver-contract.ts), [Node shared-handle scheduling](https://github.com/TanStack/db/blob/main/packages/node-db-sqlite-persistence/tests/node-driver.test.ts), [OP-SQLite shared-handle scheduling](https://github.com/TanStack/db/blob/main/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts), [browser OPFS lifecycle](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts), [worker diagnostics](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/opfs-worker-diagnostics-oracle.test.ts), [request order](https://github.com/TanStack/db/blob/main/packages/browser-db-sqlite-persistence/tests/opfs-request-order-oracle.ts), [Electron IPC and composed owner](https://github.com/TanStack/db/blob/main/packages/electron-db-sqlite-persistence/tests/electron-ipc.test.ts), [113-law manifest](https://github.com/TanStack/db/blob/main/packages/db-collection-e2e/src/fixtures/persisted-conformance-manifest.ts), [persisted sync problems](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts), [persisted reload replacement](https://github.com/TanStack/db/blob/main/packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts) | Core cache/remote rejection/peer/reopen histories, atomic reset/resume lineage, key-set evidence, dual-adapter races, queued coordinator reload/gap notifications during startup, unscheduled startup/reset overlap, and exact driver results. The persisted sync-problem oracle (`packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts`) owns how the wrapper reports failures of its own remote work and to which sync run: a later successful remote request ends the wrapper's remote failures (maintainer decision: a coarse clear, by any remote request that succeeds, the same one repeated or another; 8 histories failed before it, and a wrapper without the clear fails 7); 35 histories over eight sites (coordinator release, the adapter's own `unloadSubset` throw or reject, scoped refresh ensure and release, rotated reacquisition through a routed or single-process coordinator, and a reload's cleanup release), each crossed with ready or loading and with the current run or a run that `reload()` retired before or after the new run's `markReady()`. A remote failure is a ready Collection's failure reason and never a crash; before the first ready it is only logged; an `unloadSubset` breach surfaces uncaught; a retired run's failures change nothing in the new run and never reject its cleanup. HEAD failed 29 histories; mutants that crash, remove the generation fence, or let a cleanup release reject each fail. Limits: controlled adapter and coordinator doubles; no Browser or Electron follower routing; no coordinator retry queue. The persisted reload-replacement oracle (`packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts`) checks over 40 histories that the wrapper forwards `begin({ snapshot })` and `truncate({ markReady })`, that its restore and metadata commits replace nothing and do not complete a reload, and that durable rows equal visible rows after a replacement. HEAD's wrapper failed 15; a dropped snapshot, a non-durable snapshot, dropped truncate options, and a restore marked as a snapshot each fail. Limits: eager Collection only, in-memory adapter. The setup-reopen owner checks that a fresh adapter's first read repairs an interrupted setup, every subset of missing indexes, triggers, and bookkeeping rows, and a schema change to the fresh-install schema with rows kept or reset; complete setup costs at most one driver call over a cached read. It excludes cache-generation claims and concurrent adapters; the held-registration resume cases cover a collected generation at the setup DDL and at the registry read. The reload class owner keeps the reload law, model, histories, driver loop, and comparison in one module, with four production drivers: the Node Browser driver (real Browser persistence and coordinator, one connection per tab), the Node Electron driver (real renderers and main handler with an in-process `ipcMain` double), the real Chromium OPFS page, and a real Electron app (renderer over real IPC to a main process running the Node persistence over `node:sqlite`). Histories cover 1 to 4 eager or managed Collections with any subset of missing derived setup facts, a schema change, a database missing a migrated column or index, lock grants 1 to 5 tasks after the request, statement latency where the host controls it, a local write during another startup read (issued before or after its grant), a write held in flight at another Collection's grant, a follower write, a write from a third tab, takeover (also while a follower read is held after an earlier follower or third-tab write, and while a follower that knows the departed leader's route has a source commit queued behind a held subset read, which it flushes after the grant or which the departed leader received and never answered), restart, and a tab closed while its terms wait. It checks skipped and repaired Collection and database setup, that no term runs ahead of work queued on its tab at its grant unless a leader need is live in that election (a need that an earlier election served exempts none), that needs elect and settle, that a takeover's queued source commit settles within one RPC timeout (one timeout and a retry when the departed leader received it), and an exact per-reload budget: one registry read per adapter, one row scan per tab, two startup snapshots per eager Collection (metadata before the source starts, rows at the baseline hydrate, both required by the Electric resume laws), no rescan after a commit the tab already knows, and no database setup statement when it is complete. The implementation on origin/main fails every fixed history: the original 24 on all four drivers, and the 5 that cover per-election needs on the Node Browser driver. Production on this branch passes all 29 on all four drivers. The Node drivers reject 14 production mutants by assertion, including a lasting need latch, an earlier served need from this tab or another, a need still waiting at the grant that is ignored, and a grant that keeps the departed leader's route. The per-election cells in `browser-coordinator.test.ts` (fixed tests; no oracle owner (tracked in #2264)) also reject those latches and a delayed heartbeat from the departed leader that restores its route during an election. Real Chromium rejects the never-waiting barrier across its histories; the real Electron app rejects it in 10 of the 29 fixed histories; in the others, real IPC finishes the startup reads before any grant. Hold seams patch the adapter in the process that runs it. Not owned here: a barrier that skips queued but not yet running regular work, which driver transaction order and the writer lock hide in reload histories; the shared logical scheduling oracle owns it. The real Electron app uses `node:sqlite` because Electron's ABI cannot load better-sqlite3; a native better-sqlite3 build for Electron is not run. The shared core-adapter contract checks custom local comparator dispatch for ascending, descending, and comparator-equal public-key ordering at `loadSubset` completion. Host packages register this contract, but the local sqlite3 CLI run does not prove native host execution. Browser composes public source commits with per-collection elected-owner routing and covers the complete committed-transaction wire partition through deterministic Node transport seams. Remote-subset histories distinguish logical demand, physical acquisitions, exact acquisition leases, and released replay tombstones. Electron composes source commits with a per-collection renderer owner, IPC adapter, real SQLite, and reopen checks. The shared-driver fairness owner checks K=1 complete-logical-hydrate scheduling with identical fixed, random, and seed-plus-path campaigns. It records public rows, raw dequeue reach, and a persist-first FIFO hostile control. Its Chromium OPFS fixture refines the provider boundary but does not establish a browser matrix, elapsed-time latency, unbounded eventuality, or multi-process coordination. Same-handle Node and OP-SQLite tests cover transaction admission. Controlled OPFS page/worker histories cover ownership and diagnostic-cause retention. The reset/resume owners use sqlite3 CLI and in-memory node:sqlite seams; they do not prove multi-process WAL, mobile/Tauri, or other native-device execution. Distinct database handles rely on SQLite lock admission rather than one in-process queue. React Native hosts without async-context propagation must use the transaction driver supplied to the callback for nested work. Fake workers and synthetic page events do not prove native handle release or real bfcache admission. The Browser composed seams are not real multi-context/OPFS-worker execution; the Electron harness is not an actual Electron process unless its explicit runtime-bridge mode runs. An ownerless elected node suppresses core routing, while a follower may route demand to the elected owner. The follower generation-notice and rotated-reacquisition lanes state the rotation law: a rotated follower holds the new generation's commit notices until the owner has reacquired every active demand, then ends scoped recovery and applies them. Production does not yet end that recovery, so their cells that require it are pinned as failing under the known gap [#2139](https://github.com/TanStack/db/issues/2139); the random generation-notice campaign is omitted until the fix, because some of its histories pass today. Cells that still pass cover failed reacquisitions (scoped recovery stays and the failure is reported), a superseding rotation as leader, and a scoped recovery without rotation, with or without an active demand (untrusted durable rows stay hidden). Other cells cover a follower whose claim expires while its ensure is in flight and an owner reset (the follower requests its demand again). The follower remote-demand lane checks that a follower's load, and a live query over its demand, settle only after the owner's broadcast applies here, for a broadcast that applies at once, one queued behind another subset's hydration, and one while the cache claim is expired; the claim-rotation placement is pinned under #2139. A failed apply rejects the load, errors the query, and fails the source. A renewal that fails transiently at the reply rejects the load but keeps and retries the demand, without releasing the owner's acquisition; a rotation during the reply wait is tracked under #2139. The flush-side expiry check and arrival-order queueing have no killing witness yet. Removing the follower's wait on either ensure path, its terminal check, or the queued flush's terminal marking each fails it. The Electron IPC readiness oracle checks a fresh or reopened renderer, a successful or failed IPC hydration, and an upstream load that succeeds, fails, or is released during hydration, against a model of the three readiness checkpoints; a renderer that replies before the main-process read or treats an IPC failure as empty fails it. The owner is a controlled coordinator double, not two real coordinators; host coordinators retry only classified transport or admission failures while demand remains retained. The manifest excludes progressive and move suites; registration and shim runs are not device execution. The per-collection coordinator oracle's real-tab lane runs a follower and an owner tab with real Browser coordinators over Node's BroadcastChannel and Web Locks and one real SQLite file: 16 histories over the owner's source (custom or Query Collection), the broadcast's placement, the follower's apply outcome, and the consumer, plus a rotation cell. Main fails all 16 histories; an owner tab for a rotated follower generation is not reachable there. The Electron IPC readiness oracle adds a follower and an owner renderer with Electron coordinators: 4 histories over the apply outcome and the consumer, in process and through a real Electron main process; main fails all 4. |
 | SQLite expression-index planning             | [Node expression-index oracle](https://github.com/TanStack/db/blob/main/packages/node-db-sqlite-persistence/tests/expression-index-oracle.test.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | RFC #1659 invariant 8 owns identical persisted-index and runtime-expression shapes. Independent expected keys are checked against direct captured SQL, adapter results, and named-index plans. Generated BigInts use SQLite's signed range; one fixed case checks legacy oversized-value reads. Other limits: bounded unqualified JSON paths/scalars, Node BetterSQLite, and no null, arbitrary raw SQL, or native-host planning. Run the package's `test:oracles` campaign.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | Offline execution                            | [scheduler](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/KeyScheduler-oracle.property.test.ts), [leadership](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/leadership-replay-oracle.property.test.ts), [settlement](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts), [serialization](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/transaction-serializer-oracle.property.test.ts), [web connectivity replay](https://github.com/TanStack/db/blob/main/packages/offline-transactions/tests/connectivity-replay-oracle.test.ts), [review record](oracle-reviews/pr-1879-visible-replay.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Declarative FIFO eligibility, per-transaction outcomes, durable state and typed wire trees. The web connectivity owner checks a persisted write under a false browser online hint, then visible replay by event or explicit retry, at provider-call, outbox, and caller-settlement cuts. It uses controlled browser globals and fake storage; it does not prove actual browser network detection, genuine offline retry timing, multi-tab leadership transfer, or React Native behavior. Issued work may finish after ownership loss, but new work must not start. Exactly-once network execution is not promised.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| Frameworks                                   | [React conformance](https://github.com/TanStack/db/blob/main/packages/react-db/tests/conformance.test.tsx), [React pagination](https://github.com/TanStack/db/blob/main/packages/react-db/tests/infinite-query-conformance.test.tsx), [shared framework contracts](https://github.com/TanStack/db/tree/main/packages/db/tests/conformance), [Vue synchronous publication](https://github.com/TanStack/db/blob/main/packages/vue-db/tests/useLiveQuery-publication-oracle.test.ts), [Preact conformance](https://github.com/TanStack/db/blob/main/packages/preact-db/tests/conformance.test.ts), [Preact binding witnesses](https://github.com/TanStack/db/blob/main/packages/preact-db/tests/useLiveQuery.test.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Exact exposed rows/pages and each framework's own lifecycle cuts. Vue's synchronous watcher checks insert, update, and nonterminal delete through supplied Collection and identity query inputs; it does not cover an empty final result, multiple changes in one transaction, or query recompilation. A React witness does not prove Preact/Vue/Solid/Angular/Svelte scheduling. Preserve their receiving registrations. The Preact driver observes each result at commit through a layout-effect probe under an error boundary, because Preact runs passive effects after paint and `act` drains only those it scheduled; it has no Suspense, server-snapshot, or DbClient witness. Its binding witnesses check that a write between render and subscription publishes and that an equal `queryKey` or structurally equal query keeps its live-query Collection. Subscribing in a passive effect instead of a layout effect survives both, as allowed scheduling freedom. The query-identity laws (1.0, maintainer decisions 2026-10-22 and 2026-10-23) run through every live-query driver and the React, Preact, Vue, and Svelte infinite drivers, branching on each driver's public `comparesQueryIdentity` policy. In a binding that compares identity (React and Preact), a query without a nonempty `queryKey` whose IR has no stable hash throws `UnhashableQueryIRError` at mount and at recompilation, with any dependency list; an empty key counts as none, and a nonempty key runs the query. Such a binding claims each source Collection ID it compiled, so A(x) -> C(y) -> A(x) is legal while a later B(x) throws `SourceCollectionIdReuseError`. A pairwise model judges 32 enumerated histories over A(x), B(x), C(y), and a disabled step, with declared reach for a swap after an intervening query, a swap after a disabled step, and a revisit after an intervening query. Reach labels name the steps between the claim and its test, so a direct swap does not count; removing the C(y) step fails reach. Claims that keep only the latest query, or reset at a disabled step, fail it. React runs every shared history twice, with derived identity and with a dependency list (mount, config mount, and recompile); skipping the dependency-list check at the first compile fails five scenarios. A nonempty `queryKey` skips the claim: React and Preact witnesses swap a same-ID source under a changed key, and a key reader that ignores keys fails both. One query over two same-ID objects uses overlapping but different rows; an engine mutant that resolves each source through the Collection-ID map, so the last object serves both join sides, fails the live and infinite scenarios. A Svelte hydration witness checks that a `DbClient`-backed query with a dependency list hydrates `queryKey: []` exactly as it hydrates an omitted key. The infinite suite runs the same pairwise grammar over A(x), B(x), and C(y), 18 histories with declared reach for a swap and a revisit after an intervening query; it has no disabled or page-shape step, because one infinite handle changes either its query or its page shape. A new binding starts unclaimed. A React witness checks that a dependency-list query with a `DbClient` rejects an unhashable query when it compiles, at mount or after a dependency change, but not on a render whose dependencies did not change. After a rejection, two reads must each throw or hold no rows. No current driver can fail that check, and reactive drivers do not reject. React unmounts a tree whose render throws. Preact keeps such a component mounted, so its driver mounts the hook under an error boundary, which unmounts it; a Preact component with no boundary keeps its last committed rows and is not witnessed here. It guards a future driver whose binding stays mounted; the `DbClient`-backed Svelte binding, which stays mounted, is checked field by field in its release oracle. A reactive binding (Vue, Solid, Angular, Svelte without a `DbClient`) runs the same histories and must publish the current input's rows: the unhashable query runs and recompiles when a captured value changes, and B(x) shows B's rows, never A's. One query over two same-ID objects is likewise rejected by a comparing binding and read through an inner join by a reactive one. The same mount-and-recompile split is not yet generated for `DbClient`-backed Svelte or React hooks beyond the receiving witnesses below. The [React source ID reuse oracle](https://github.com/TanStack/db/blob/main/packages/react-db/tests/source-id-reuse-oracle.test.tsx) and the [Svelte descriptor release oracle](https://github.com/TanStack/db/blob/main/packages/svelte-db/tests/descriptor-query-release-oracle.svelte.test.ts) own the release law for `DbClient` descriptors: a rejected query releases every sync start it deferred. React crosses six causes (source-ID collision, unhashable IR, a descriptor factory that throws, a query the live query rejects when it compiles, a single-result query in an infinite hook, and a Suspense query that cannot stream during SSR) with six hook paths (live, infinite, and Suspense, each derived or with a dependency list) and two direct readers; Svelte crosses the collision, unhashable, factory, and compile causes with eager and lazy sources and three readers, and its collision history reads every public result field separately after the rejection; dropping the guard from one getter, such as `isLoadingError`, fails all six collision cells. The React oracle also checks that a dependency-list Suspense hook claims its source when it takes a cached Suspense collection, on a retry after suspending and on a sibling mount; with a hashable dependency, the cache path skipped the claim before the fix. These are two fixed histories, not a dimension of the claim grammar: that grammar's disabled step has no Suspense form, because `useLiveSuspenseQuery` rejects a disabled query. Each hook releases at one render boundary (React `useLiveQuery`, `useLiveSuspenseQuery`, and `useLiveInfiniteQuery`, and Svelte's compiled query); removing any one boundary fails exactly that hook's cells, and routing Svelte's getters around the compiled query fails its collision cells; `preload()` overrides a deferral, so those cells pass without the release by design. Declared reach: each enumerated release history asserts that the rejected query ran the shared descriptor's factory once before the reader, and a history that binds the failing descriptor first fails that check. A render that never commits (React: a sibling throws after the hook returns, or the render suspends; Svelte: setup throws after the hook returns) releases its deferral when garbage collection reclaims the live query it built (maintainer decision 2026-10-23), or after the unsubscribed GC floor when the hook's config disables that reclaim (`gcTime` 0 or `Infinity`, or `startSync: false`); both release grammars add these causes, React adds the three config paths and Svelte a `gcTime: 0` setup, and waiting only for the reclaim fails those cells; removing the reclaim release fails exactly them, and releasing at the end of render instead fails the descriptor binding owner's no-work-before-commit law. Known limit, owner the maintainer: the reclaim follows the 50 ms unsubscribed GC floor, so a render whose commit React holds past that floor releases its deferral, and its source may start, before it commits; that render then subscribes to a cleaned-up live query, which restarts. No history holds a commit past the floor, which needs a controlled React scheduler or fake timers; this joins the existing held-commit open cell in the infinite-query publication row. A keyed step records no claim and checks none (maintainer decision 2026-10-23): for a comparing binding the claim grammar adds keyed steps AK and BK over the same-ID objects, 108 histories with declared reach for a claim that crosses a keyed step and a keyed step after a claim; a keyed step that claims, or that resets earlier claims, fails it for React on both paths and for Preact. Each controllable driver records a publication log (`publication-log.ts`) at the end of each synchronous turn, plus the value on screen at the first paint after each `setParam`, once the framework has flushed and before any later task (maintainer decision 2026-10-23). After a same-ID swap, a reactive binding's every logged value holds only the new source's rows or none: a binding that keeps the old rows published until a later task fails it in Vue and Svelte. A value replaced within one synchronous turn is not logged, because the browser never paints it; Solid and Svelte publish the previous query's rows once inside the swap's own turn, for any input change, and pass. Accepted design (maintainer decision 2026-10-23): React claims source IDs during render, so a concurrent render that is abandoned before commit keeps its claim, as the React oracle states for a render that suspends, because that render's live query may still own the source until cleanup. Same-ID source objects stay legal; the claim, not `createCollection`, rejects a swap. Trace: committed C(y); a transition render reads B(x) and is interrupted; an urgent render reads A(x) and throws `SourceCollectionIdReuseError`. The abandoned-transition history has no witness. Adapter-specific `queryKey` change semantics stay with each adapter's own tests; React's infinite hook also has a focused witness that a `queryKey` array changed in place recompiles, because only React hands the caller's array to the shared window binding. The shared lifecycle histories distinguish adapter-created projections from caller-owned retention: omitted and explicitly `undefined` `gcTime` use the 1 ms adapter policy; `gcTime: 0`, a positive 100 ms retention, and supplied Collections keep caller authority. They observe retirement after unmount, replacement, disabling, and positive expiry, plus survival before that expiry. The shared suite also checks initial-query readiness over a lagging on-demand source, for a list and a `findOne` query and for the infinite query (React, Preact, Vue, and Svelte): not ready before the subset settles, ready at settlement while the source is still `loading`, and still ready after the source becomes ready. Solid's Suspense over that source has its own witness. A Solid Suspense witness also checks that a source's `reportError()` and `fail()` after readiness keep the boundary's rows shown and the query `ready`; a hook whose status follows the health tree fails it. A resource that suspends again on a tree change is not observable at that cut, because its refetch over a ready query settles before a fallback renders. A separate Solid two-resource Suspense witness holds one ready projection past the 50 ms unsubscribed floor while its sibling remains pending, then checks both commit and boundary abandonment release the temporary preload owner and preserve ordinary 1 ms teardown. |
+| Frameworks                                   | [React conformance](https://github.com/TanStack/db/blob/main/packages/react-db/tests/conformance.test.tsx), [React pagination](https://github.com/TanStack/db/blob/main/packages/react-db/tests/infinite-query-conformance.test.tsx), [shared framework contracts](https://github.com/TanStack/db/tree/main/packages/db/tests/conformance), [Vue synchronous publication](https://github.com/TanStack/db/blob/main/packages/vue-db/tests/useLiveQuery-publication-oracle.test.ts), [Preact conformance](https://github.com/TanStack/db/blob/main/packages/preact-db/tests/conformance.test.ts), [Preact binding witnesses](https://github.com/TanStack/db/blob/main/packages/preact-db/tests/useLiveQuery.test.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Exact exposed rows/pages and each framework's own lifecycle cuts. Vue's synchronous watcher checks insert, update, and nonterminal delete through supplied Collection and identity query inputs; it does not cover an empty final result, multiple changes in one transaction, or query recompilation. A React witness does not prove Preact/Vue/Solid/Angular/Svelte scheduling. Preserve their receiving registrations. The Preact driver observes each result at commit through a layout-effect probe under an error boundary, because Preact runs passive effects after paint and `act` drains only those it scheduled; it has no Suspense, server-snapshot, or DbClient witness. Its binding witnesses check that a write between render and subscription publishes and that an equal `queryKey` or structurally equal query keeps its live-query Collection. Subscribing in a passive effect instead of a layout effect survives both, as allowed scheduling freedom. The query-identity laws (1.0, maintainer decisions 2026-10-22 and 2026-10-23) run through every live-query driver and the React, Preact, Vue, and Svelte infinite drivers, branching on each driver's public `comparesQueryIdentity` policy. In a binding that compares identity (React and Preact), a query without a nonempty `queryKey` whose IR has no stable hash throws `UnhashableQueryIRError` at mount and at recompilation, with any dependency list; an empty key counts as none, and a nonempty key runs the query. Such a binding claims each source Collection ID it compiled, so A(x) -> C(y) -> A(x) is legal while a later B(x) throws `SourceCollectionIdReuseError`. A pairwise model judges 32 enumerated histories over A(x), B(x), C(y), and a disabled step, with declared reach for a swap after an intervening query, a swap after a disabled step, and a revisit after an intervening query. Reach labels name the steps between the claim and its test, so a direct swap does not count; removing the C(y) step fails reach. Claims that keep only the latest query, or reset at a disabled step, fail it. React runs every shared history twice, with derived identity and with a dependency list (mount, config mount, and recompile); skipping the dependency-list check at the first compile fails five scenarios. A nonempty `queryKey` skips the claim: React and Preact witnesses swap a same-ID source under a changed key, and a key reader that ignores keys fails both. One query over two same-ID objects uses overlapping but different rows; an engine mutant that resolves each source through the Collection-ID map, so the last object serves both join sides, fails the live and infinite scenarios. A Svelte hydration witness checks that a `DbClient`-backed query with a dependency list hydrates `queryKey: []` exactly as it hydrates an omitted key. The infinite suite runs the same pairwise grammar over A(x), B(x), and C(y), 18 histories with declared reach for a swap and a revisit after an intervening query; it has no disabled or page-shape step, because one infinite handle changes either its query or its page shape. A new binding starts unclaimed. A React witness checks that a dependency-list query with a `DbClient` rejects an unhashable query when it compiles, at mount or after a dependency change, but not on a render whose dependencies did not change. After a rejection, two reads must each throw or hold no rows. No current driver can fail that check, and reactive drivers do not reject. React unmounts a tree whose render throws. Preact keeps such a component mounted, so its driver mounts the hook under an error boundary, which unmounts it; a Preact component with no boundary keeps its last committed rows and is not witnessed here. It guards a future driver whose binding stays mounted; the `DbClient`-backed Svelte binding, which stays mounted, is checked field by field in fixed [descriptor release tests](https://github.com/TanStack/db/blob/main/packages/svelte-db/tests/descriptor-query-release.svelte.test.ts) (no oracle owner; tracked in #2264). A reactive binding (Vue, Solid, Angular, Svelte without a `DbClient`) runs the same histories and must publish the current input's rows: the unhashable query runs and recompiles when a captured value changes, and B(x) shows B's rows, never A's. One query over two same-ID objects is likewise rejected by a comparing binding and read through an inner join by a reactive one. The same mount-and-recompile split is not yet generated for `DbClient`-backed Svelte or React hooks beyond the receiving witnesses below. The [React source ID reuse oracle](https://github.com/TanStack/db/blob/main/packages/react-db/tests/source-id-reuse-oracle.test.tsx) owns the release law for `DbClient` descriptors: a rejected query releases every sync start it deferred. React crosses six causes (source-ID collision, unhashable IR, a descriptor factory that throws, a query the live query rejects when it compiles, a single-result query in an infinite hook, and a Suspense query that cannot stream during SSR) with six hook paths (live, infinite, and Suspense, each derived or with a dependency list) and two direct readers; Svelte crosses the collision, unhashable, factory, and compile causes with eager and lazy sources and three readers, and its collision history reads every public result field separately after the rejection; dropping the guard from one getter, such as `isLoadingError`, fails all six collision cells. The React oracle also checks that a dependency-list Suspense hook claims its source when it takes a cached Suspense collection, on a retry after suspending and on a sibling mount; with a hashable dependency, the cache path skipped the claim before the fix. These are two fixed histories, not a dimension of the claim grammar: that grammar's disabled step has no Suspense form, because `useLiveSuspenseQuery` rejects a disabled query. Each hook releases at one render boundary (React `useLiveQuery`, `useLiveSuspenseQuery`, and `useLiveInfiniteQuery`, and Svelte's compiled query); removing any one boundary fails exactly that hook's cells, and routing Svelte's getters around the compiled query fails its collision cells; `preload()` overrides a deferral, so those cells pass without the release by design. Declared reach: each enumerated release history asserts that the rejected query ran the shared descriptor's factory once before the reader, and a history that binds the failing descriptor first fails that check. A render that never commits (React: a sibling throws after the hook returns, or the render suspends; Svelte: setup throws after the hook returns) releases its deferral when garbage collection reclaims the live query it built (maintainer decision 2026-10-23), or after the unsubscribed GC floor when the hook's config disables that reclaim (`gcTime` 0 or `Infinity`, or `startSync: false`); both release grammars add these causes, React adds the three config paths and Svelte a `gcTime: 0` setup, and waiting only for the reclaim fails those cells; removing the reclaim release fails exactly them, and releasing at the end of render instead fails the descriptor binding owner's no-work-before-commit law. Known limit, owner the maintainer: the reclaim follows the 50 ms unsubscribed GC floor, so a render whose commit React holds past that floor releases its deferral, and its source may start, before it commits; that render then subscribes to a cleaned-up live query, which restarts. No history holds a commit past the floor, which needs a controlled React scheduler or fake timers; this joins the existing held-commit open cell in the infinite-query publication row. A keyed step records no claim and checks none (maintainer decision 2026-10-23): for a comparing binding the claim grammar adds keyed steps AK and BK over the same-ID objects, 108 histories with declared reach for a claim that crosses a keyed step and a keyed step after a claim; a keyed step that claims, or that resets earlier claims, fails it for React on both paths and for Preact. Each controllable driver records a publication log (`publication-log.ts`) at the end of each synchronous turn, plus the value on screen at the first paint after each `setParam`, once the framework has flushed and before any later task (maintainer decision 2026-10-23). After a same-ID swap, a reactive binding's every logged value holds only the new source's rows or none: a binding that keeps the old rows published until a later task fails it in Vue and Svelte. A value replaced within one synchronous turn is not logged, because the browser never paints it; Solid and Svelte publish the previous query's rows once inside the swap's own turn, for any input change, and pass. Accepted design (maintainer decision 2026-10-23): React claims source IDs during render, so a concurrent render that is abandoned before commit keeps its claim, as the React oracle states for a render that suspends, because that render's live query may still own the source until cleanup. Same-ID source objects stay legal; the claim, not `createCollection`, rejects a swap. Trace: committed C(y); a transition render reads B(x) and is interrupted; an urgent render reads A(x) and throws `SourceCollectionIdReuseError`. The abandoned-transition history has no witness. Adapter-specific `queryKey` change semantics stay with each adapter's own tests; React's infinite hook also has a focused witness that a `queryKey` array changed in place recompiles, because only React hands the caller's array to the shared window binding. The shared lifecycle histories distinguish adapter-created projections from caller-owned retention: omitted and explicitly `undefined` `gcTime` use the 1 ms adapter policy; `gcTime: 0`, a positive 100 ms retention, and supplied Collections keep caller authority. They observe retirement after unmount, replacement, disabling, and positive expiry, plus survival before that expiry. The shared suite also checks initial-query readiness over a lagging on-demand source, for a list and a `findOne` query and for the infinite query (React, Preact, Vue, and Svelte): not ready before the subset settles, ready at settlement while the source is still `loading`, and still ready after the source becomes ready. Solid's Suspense over that source has its own witness. A Solid Suspense witness also checks that a source's `reportError()` and `fail()` after readiness keep the boundary's rows shown and the query `ready`; a hook whose status follows the health tree fails it. A resource that suspends again on a tree change is not observable at that cut, because its refetch over a ready query settles before a fallback renders. A separate Solid two-resource Suspense witness holds one ready projection past the 50 ms unsubscribed floor while its sibling remains pending, then checks both commit and boundary abandonment release the temporary preload owner and preserve ordinary 1 ms teardown. |
 | Backend Collection E2E | [shared provider suites](https://github.com/TanStack/db/tree/main/packages/db-collection-e2e/src/suites); [Electric registration](https://github.com/TanStack/db/blob/main/packages/electric-db-collection/e2e/electric.e2e.test.ts); [Query registration](https://github.com/TanStack/db/blob/main/packages/query-db-collection/e2e/query.e2e.test.ts); [TrailBase registration](https://github.com/TanStack/db/blob/main/packages/trailbase-db-collection/e2e/trailbase.e2e.test.ts) | Electric, Query, and TrailBase register reusable predicate, pagination, join, and live-update checks at their provider boundaries; Electric also registers the move suite. These are receiving paths for core query and Collection laws, not framework render cuts. |
 | Window-controller overlap | [shared infinite-query conformance](https://github.com/TanStack/db/blob/main/packages/db/tests/conformance/infinite-suite-oracle.ts), [React driver](https://github.com/TanStack/db/blob/main/packages/react-db/tests/infinite-query-conformance.test.tsx), [Vue driver](https://github.com/TanStack/db/blob/main/packages/vue-db/tests/infinite-query-conformance.test.ts), [Svelte driver](https://github.com/TanStack/db/blob/main/packages/svelte-db/tests/infinite-query-conformance.svelte.test.ts), [Preact driver](https://github.com/TanStack/db/blob/main/packages/preact-db/tests/infinite-query-conformance.test.ts), [review record](oracle-reviews/dec-03-window-overlap.md) | Four or five ordered source rows, two window-settlement orders, and public snapshots after each settlement, a subscribed observer update, a detached controller read, and explicit recovery. Insertion and removal of the fifth row distinguish both continuation directions while an earlier error remains visible. The detached read follows a source change with no controller subscriber; its preloaded Collection retains the five-row window. The exact overlap uses the exported DB controller in each package realm. Framework hooks expose no controller preload, so this cell does not establish a hook scheduling path; direct hook paging remains in the adjacent shared scenarios. An unsubscribed controller has no notification claim. |
 | Infinite-query publication | [shared publication laws](https://github.com/TanStack/db/blob/main/packages/db/tests/conformance/infinite-suite-oracle.ts), [React render cuts](https://github.com/TanStack/db/blob/main/packages/react-db/tests/infinite-query-render-cuts-oracle.test.tsx), [Svelte hook tests](https://github.com/TanStack/db/blob/main/packages/svelte-db/tests/useLiveInfiniteQuery.svelte.test.ts), [review record](oracle-reviews/2026-10-05-infinite-first-paint.md) | Each driver records every value its framework published: React layout commits, Vue pre-flushes, and the Svelte construction value plus pre-effect runs. The shared suite checks that a synchronous source shows its ready first page on the first value, for a query callback and for a supplied collection that has not started, that every ready value in a fixed-source, fixed-query scenario equals the source prefix for its own page count, including an equal dependency replacement that keeps page depth, and that a mount requests an on-demand first window once, for a query callback and for a supplied collection whose finite window is wider than or equal to the one the hook needs, judged by the rows the on-demand source holds after mount. Under deferred acquisition, an on-demand first value is either the ready first page or a value with no rows, by framework: React and Svelte publish before the hook subscribes, Vue after. `preloaded-collection-first-paint` checks the documented route-loader pattern: a limited live query preloaded before mount shows its ready first page on the first value in every framework and asks the source for nothing more; a preload that does not count as demand never settles there. Pre-commit work has no shared form, because Vue setup is its commit. The React driver owns renders that never commit, StrictMode double renders (one first-window request on React 19), retries after GC, a mounted replacement whose startup error must reach the error boundary, and a collection kept from an abandoned render that enters terminal error before its query is selected again, each as under `useLiveQuery`. The React source ID reuse oracle drives the infinite hook too. Svelte owns construction and superseded recomputes before the subscribing effect. In both, the hook acquires an on-demand source as often as `useLiveQuery` does under the same history, for either input form, direct or behind a live-query Collection. On-demand requests from renders that never commit are now owned by the live-query deferred acquisition oracle; the React render-cut oracle checks that an abandoned render makes no acquisition. Open cells, owned here: React 18 StrictMode, where neither hook keeps refs across the double render; a React commit held after the 50 ms unsubscribed GC floor, where a controlled-premise controller witness shows no non-ready value but no React scheduling witness exists; ready values in scenarios that write the source or replace the query, which need a per-step source model; a join of eager and on-demand sources, which needs a zero-acquisition check before commit; a supplied collection with no `.limit`, which sends one unbounded request on `main` too, because the controller cannot narrow it before the source request; and Svelte `state_unsafe_mutation` when a start inside `$derived.by` synchronously writes rows a peer is waiting for, shared with Svelte's `useLiveQuery`, which a two-component probe reproduces and the deferred-acquisition follow-up removes. |
@@ -1513,13 +1523,13 @@ generic visitor behavior outside the named collectors.
 | Live-query notification algebra | [real-query and checker calibration](https://github.com/TanStack/db/blob/main/packages/db/tests/notification-laws-oracle.test.ts), [independent Map checker](https://github.com/TanStack/db/blob/main/packages/db-collection-e2e/src/utils/notification-laws-oracle.ts) | One-key synchronous source histories check exact live-query callback reconstruction and unsubscribe silence. Synthetic multi-key histories calibrate the checker; direct source Collection events remain with the change-event history owner. |
 | Flat-row change tracking | [flat change tracking oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/flat-change-tracking-oracle.property.test.ts) | Generated callbacks over flat rows, frozen or not and with or without a non-enumerable field (assignments of `0`, `-0`, `NaN`, `undefined`, functions, and fresh objects; reverts; deletions; added fields; data and accessor `defineProperty`; stored drafts; throws), run through the flat tracker, the draft proxy, and an independent model, which must report the same change sets with `0` and `-0` equal, or throw the same error and leave the rows unchanged. Defining a field acts as assigning it, and a non-enumerable field is row data only once written; the proxy broke three of those laws on `main` and the flat tracker one. Diffs using `!==`, `Object.is` alone, or no deletions fail it. It found that the proxy dropped a field added as `undefined` when another field reverted; the pinned history and both campaigns fail without that fix. Non-flat rows must fall back. The [2026-10-01 review](oracle-reviews/2026-10-01-pooled-live-queries.md) records each ORC outcome. |
 | Virtual props cache | [cache laws](https://github.com/TanStack/db/blob/main/packages/db/tests/virtual-props-cache.test.ts) | Focused laws for the per-key cache of rows read with virtual props: a change's published value is the row later `get` and `toArray` reads return, for every subscriber, after sync and local writes, and a key that is deleted or rolled back leaves the cache. Enriching the value before the previous value fails the first two; skipping the drop on delete events fails the third. Rows read with virtual props through other paths, such as joins, are outside these laws. |
-| LocalStorage Collection | [mutation order](../../packages/db/tests/local-storage-order-oracle.test.ts), [peer snapshots and ownership](../../packages/db/tests/local-storage-peer-oracle.test.ts) | Finite two-write histories compare authored same/disjoint-key updates, both handler completion orders, and all four application-decision pairs against public rows, durable rows, caller settlement, and fresh restore. A nested fire-and-forget admission checks that the outer write reaches storage first; awaiting the nested receipt inside its earlier handler is an excluded dependency cycle. Handler-free direct insert, update, and delete are checked at the method-return boundary for synchronous Storage effects. A later handler failure is checked while its earlier handler remains held: its receipt rejects and its optimistic row rolls back promptly, while the durable predecessor remains pending. An automatic insert followed by manual acceptance crosses same-key update versus disjoint insert and both earlier-handler decisions; manual settlement waits behind that handler, and public, durable, and fresh-restore rows match the authored fold. Un-awaited manual acceptance crosses direct and held-predecessor paths with success or Storage failure: both commit and persistence receipts wait for every registered write, report the exact fault on failure, and agree with durable and public rows at settlement. A two-Collection witness checks that one manual receipt waits for both un-awaited acceptances. Peer witnesses check serialized disjoint typed-key writes before delayed event delivery, equal-ID manual Collection ownership, construction-time rejection of direct or shallow-copy reuse before or after first preload with the first Collection still writable, a peer insert during pending local insert, listener release across cleanup/restart, malformed startup snapshots, transient startup read failures and restart, the null-versus-empty storage sentinel, local and peer clear publication with subsequent public/durable agreement and a pending optimistic mutation across clear, and storage/parser read failures during writes and event delivery. Reload witnesses let another tab (a second Storage object over the same bytes) update or delete a kept row and insert a row, or clear storage, while no event reaches the first tab, with and without a prior local edit of the kept row: `reload()` must resolve with the Collection `ready` and its public rows equal to the durable rows and a fresh restore, and the reloaded run must confirm a later write. The adapter that re-inserted stored rows in each run crashed on the update histories and kept the deleted row; a snapshot only for non-empty storage fails the clear histories. The [same-tab audit](oracle-reviews/2026-10-08-localstorage-same-tab.md) records witnesses that withhold events through each persistence receipt: disjoint typed keys, a manually accepted same-key update followed by automatic update and delete, clear, a rejected Storage write, a pending same-key optimistic insert, cleanup/restart, and a write started by a ready-status listener compare public snapshots with the authored durable fold. A default jsdom Storage witness receives a same-tab write. The old event-only adapter fails seven no-event checkpoints. The original adapter also fails the second-handler-first, delayed-peer, equal-ID, listener-release, read-failure, synchronous direct-write, prompt-failure, mixed manual/automatic order, un-awaited manual receipt, reused-options admission, malformed-startup, and clear-publication witnesses. A failed write read rejects without replacing durable rows; a failed event read retains the public snapshot until a later valid event. These checks do not establish simultaneous cross-tab read-modify-write atomicity, atomic acceptance across distinct storage keys, manual acceptance without a mutation Collection owner, arbitrary long histories, native browser scheduling, or synchronization across distinct custom Storage wrapper objects. Existing LocalStorage failure and CRUD tests remain supporting examples. |
+| LocalStorage Collection | [mutation order](../../packages/db/tests/local-storage-order-oracle.test.ts), [peer snapshots and ownership](../../packages/db/tests/local-storage-peer-history.test.ts) (fixed tests; no oracle owner (tracked in #2264)) | Finite two-write histories compare authored same/disjoint-key updates, both handler completion orders, and all four application-decision pairs against public rows, durable rows, caller settlement, and fresh restore. A nested fire-and-forget admission checks that the outer write reaches storage first; awaiting the nested receipt inside its earlier handler is an excluded dependency cycle. Handler-free direct insert, update, and delete are checked at the method-return boundary for synchronous Storage effects. A later handler failure is checked while its earlier handler remains held: its receipt rejects and its optimistic row rolls back promptly, while the durable predecessor remains pending. Fixed tests in `packages/db/tests/local-storage-order.test.ts` (no oracle owner (tracked in #2264)) cover the next two histories. An automatic insert followed by manual acceptance crosses same-key update versus disjoint insert and both earlier-handler decisions; manual settlement waits behind that handler, and public, durable, and fresh-restore rows match the authored fold. Un-awaited manual acceptance crosses direct and held-predecessor paths with success or Storage failure: both commit and persistence receipts wait for every registered write, report the exact fault on failure, and agree with durable and public rows at settlement. A two-Collection witness checks that one manual receipt waits for both un-awaited acceptances. Peer witnesses check serialized disjoint typed-key writes before delayed event delivery, equal-ID manual Collection ownership, construction-time rejection of direct or shallow-copy reuse before or after first preload with the first Collection still writable, a peer insert during pending local insert, listener release across cleanup/restart, malformed startup snapshots, transient startup read failures and restart, the null-versus-empty storage sentinel, local and peer clear publication with subsequent public/durable agreement and a pending optimistic mutation across clear, and storage/parser read failures during writes and event delivery. Reload witnesses let another tab (a second Storage object over the same bytes) update or delete a kept row and insert a row, or clear storage, while no event reaches the first tab, with and without a prior local edit of the kept row: `reload()` must resolve with the Collection `ready` and its public rows equal to the durable rows and a fresh restore, and the reloaded run must confirm a later write. The adapter that re-inserted stored rows in each run crashed on the update histories and kept the deleted row; a snapshot only for non-empty storage fails the clear histories. The [same-tab audit](oracle-reviews/2026-10-08-localstorage-same-tab.md) records witnesses that withhold events through each persistence receipt: disjoint typed keys, a manually accepted same-key update followed by automatic update and delete, clear, a rejected Storage write, a pending same-key optimistic insert, cleanup/restart, and a write started by a ready-status listener compare public snapshots with the authored durable fold. A default jsdom Storage witness receives a same-tab write. The old event-only adapter fails seven no-event checkpoints. The original adapter also fails the second-handler-first, delayed-peer, equal-ID, listener-release, read-failure, synchronous direct-write, prompt-failure, mixed manual/automatic order, un-awaited manual receipt, reused-options admission, malformed-startup, and clear-publication witnesses. A failed write read rejects without replacing durable rows; a failed event read retains the public snapshot until a later valid event. These checks do not establish simultaneous cross-tab read-modify-write atomicity, atomic acceptance across distinct storage keys, manual acceptance without a mutation Collection owner, arbitrary long histories, native browser scheduling, or synchronization across distinct custom Storage wrapper objects. Existing LocalStorage failure and CRUD tests remain supporting examples. |
 | LocalStorage value fidelity | [JSON value model](../../packages/db/tests/local-storage-value-fidelity-oracle.property.test.ts) | With the default JSON parser, an insert, update, manual insert, or manual update is accepted only if a fresh restore can return the row. A recursive value grammar labels each generated value, while it is built, with its expected JSON form or as lost. Lost: functions, symbols, enumerable symbol keys, `NaN` and infinities (also boxed), `undefined` and missing array entries, arrays with extra or symbol properties, a `toJSON` that returns `undefined` in an array, and Map, Set, WeakMap, Promise, RegExp, Uint8Array, and SharedArrayBuffer values. Normalized: `toJSON` values (Date, a plain object, and a function with its own `toJSON`), `undefined` properties and `toJSON` results, `-0`, boxed finite numbers, and non-enumerable symbol keys. Histories cross the four entry paths with and without an automatic handler. At `isPersisted` settlement, an accepted row must keep the authored writer value, store the model's form durably, and restore it in a fresh Collection; a lost row must reject with `SerializationError`, leave the writer's predecessor and storage bytes unchanged, and never call the handler. Pinned witnesses cover every lost kind and normalization on each path, with and without a handler; a fixed-seed and a random campaign of 300 histories run under `local-storage.value-fidelity`. A pinned witness per entry path uses a `toJSON` that changes after its first call: storage must hold the JSON the check accepted, and serializing the row again during the key check or the snapshot write each fails it. The stringify-only check on `main` fails 162 of 230 cells. The first walker in this PR failed 66 cells of the expanded grammar. Mutants that reject `undefined` properties, accept `undefined` array entries, skip boxed-number unwrapping, treat non-enumerable symbol keys as lost, skip the array-property check, or shrink the opaque-type list each fail at least six cells. Open: custom parsers, including a wrapper around `JSON` (accepted by design, documented); class instances (accepted by design; the guide states they restore as plain objects); cross-realm natives; getters; non-enumerable string data; update payloads whose shape the draft copy changes (array extra properties and symbol keys are dropped, and a hidden symbol key becomes enumerable, so an update of an object with a hidden symbol key rejects although its insert succeeds), which the proxy detachment owner must decide; peer or event delivery of a rejected write, which never reaches storage; and peer delivery of normalized values: the peer owner checks only `Date` at that boundary, so a peer receiving witness for the generated value grammar remains with the peer owner. IndexedDB clone rejection is owned by the IndexedDB settlement and values oracles, which require `SerializationError`; local-only rows keep values by reference, pinned in `local-only.test.ts`. |
 | Local-only direct writes | [direct write witnesses](https://github.com/TanStack/db/blob/main/packages/db/tests/local-only-direct-write-oracle.test.ts) | Focused witnesses pin when a local-only direct write skips the optimistic stage: a completed transaction and one publication per write, and the fallbacks for a pending, persisting, or ambient transaction and a user handler, for insert, update, and delete. Each history also runs on a local-only Collection whose handlers resolve, which must match its rows, change batches, errors, and transaction states, across mixed multi-key batches, a batch that fails midway, schema rejection, and handler rollback. Mutants that drop each guard, write only the first mutation, or never complete the transaction fail them. The change-event history oracle drives the direct path through generated histories (about two thousand writes per run); removing the guard, or guarding only persisting transactions, fails these witnesses. |
 | Reused sync row objects | [reused row witness](https://github.com/TanStack/db/blob/main/packages/db/tests/sync-reused-row.test.ts) | Focused witnesses for a sync source that changes a stored row object in place: in development, writing it again as an update without `previousValue` throws, while the same write with `previousValue`, or with a new object, moves the row out of an `eq` live query. Production skips the check. The check compares a shallow snapshot taken when the object was written, so it misses changes to nested fields; a write that names `previousValue` and a row whose fields throw on read are not checked. |
 | Index suggestions | [index suggestion oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/index-suggestion-oracle.test.ts) | A public filtered live-query Collection checks manual/default, eager, threshold, matching-index, and unrelated-index cases against the documented collection-size suggestion policy. A bounded ordered-query decision table separately classifies no field index, a null-placement mismatch, matching but order-ineligible indexes, and usable candidates in either registration order. It compares the development warning after preload; the matching-index selection owner below checks the chosen reader and ordered request. Two cyclic locale-options cells require the diagnostic to preserve valid query construction with or without a field index, and a custom-collation cell requires remediation to preserve comparator reference identity. The original manual-silence/eager-noise implementation failed two expected observations. The issue #2190 baseline failed four diagnostic cells, including a first-unusable/second-usable candidate order; the first formatter draft failed all three non-JSON-safe remediation cells. The owner does not judge repeated-query warning volume, slow-query timing, production-build suppression, every comparison-option mismatch, or every query shape. It runs in `@tanstack/db`'s `test:oracles` campaign. |
 | Minified DB public API | [consumer bundle check](https://github.com/TanStack/db/blob/main/scripts/test-minified-db.mjs) | CI builds `@tanstack/db`, then bundles its built `dist` entry with db-ivm inlined through esbuild `minify: true`. The build renames TypeScript-private members from `packages/db/mangle-cache.json`, so this lane runs against the renamed output that consumers install. It rejects a `dist` that is older than `src`, the cache, or the package's build configuration. `pnpm --filter @tanstack/db test:dist` also runs five db test files against the built `dist`, chosen for coverage of the modules with the most renamed members. `pnpm check:mangle` fails when a cached name is used other than as a private member in db src, is read by another package, appears as a string, or has a short name that collides with a source identifier ([private-member mangling review](oracle-reviews/code-weight-private-member-mangling.md)). It checks every exported error class's current public `name`, the built-in `BasicIndex` resolver name in index metadata and its event, complete query rows (after removing the four documented virtual fields) against an independent array filter/sort/projection, and one live update. The `new.target.name`, public-member mangle, and extra-output-field calibration modes fail at the intended observations. This fixed slice does not replace the unminified generated oracles, exercise framework adapters, or establish stable names for custom index resolvers. |
-| Boundary refinements | [cleanup/restart](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-cleanup-restart-oracle.test.ts), [idle cleanup](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-idle-cleanup.test.ts), [issue #1891 async-cleanup review](oracle-reviews/issue-1891-async-cleanup.md), [issue #1891 cleanup-start follow-up](oracle-reviews/issue-1891-cleanup-start-followup.md), [metadata publication](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-metadata-publication-oracle.property.test.ts), [row metadata composition](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-row-metadata-composition-oracle.test.ts), [nested-begin metadata rebuild review](oracle-reviews/2026-10-06-nested-begin-metadata-rebuild.md), [state mutation round 4](oracle-reviews/2026-10-06-state-mutation-round-4.md), [state retention](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-state-retention-oracle.property.test.ts), [acquisition cells](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-lifecycle-oracle.test.ts), [D2 source reconciliation](https://github.com/TanStack/db/blob/main/packages/db/tests/d2-source-reconciliation-oracle.property.test.ts), [top-K support windows](https://github.com/TanStack/db/blob/main/packages/db-ivm/tests/operators/topk-support-window-oracle.test.ts), [nested Query work](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/includes-work-counter-oracle.test.ts) | Explicit lifecycle products, independent source maps and weighted relations, exact publication cuts, support/multiplicity, and value-plus-work observations. These refine the larger subsystem models; they do not replace them. The cleanup/restart owner's failing-dependents product crosses every ordered pair of resolving, throwing, rejecting, held, and pooled-throwing dependent ends with synchronous, held, and rejecting adapter cleanup and both release orders, with declared reach; it rejects a cleanup that stops at a throwing dependent, settles with `Promise.all`, or waits only for its dependents. Effects and nested live-query chains with failing ends are not generated. |
+| Boundary refinements | [cleanup/restart](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-cleanup-restart-oracle.test.ts), [idle cleanup](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-idle-cleanup.test.ts), [issue #1891 async-cleanup review](oracle-reviews/issue-1891-async-cleanup.md), [issue #1891 cleanup-start follow-up](oracle-reviews/issue-1891-cleanup-start-followup.md), [metadata publication](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-metadata-publication-oracle.property.test.ts), [row metadata composition](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-row-metadata-composition-oracle.test.ts), [nested-begin metadata rebuild review](oracle-reviews/2026-10-06-nested-begin-metadata-rebuild.md), [state mutation round 4](oracle-reviews/2026-10-06-state-mutation-round-4.md), [state retention](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-state-retention-oracle.property.test.ts), [acquisition cells](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-subscription-lifecycle-cells.test.ts) (fixed tests; no oracle owner (tracked in #2264)), [D2 source reconciliation](https://github.com/TanStack/db/blob/main/packages/db/tests/d2-source-reconciliation-oracle.property.test.ts), [top-K support windows](https://github.com/TanStack/db/blob/main/packages/db-ivm/tests/operators/topk-support-window-oracle.test.ts), [nested Query work](https://github.com/TanStack/db/blob/main/packages/query-db-collection/tests/includes-work-counter-oracle.test.ts) | Explicit lifecycle products, independent source maps and weighted relations, exact publication cuts, support/multiplicity, and value-plus-work observations. These refine the larger subsystem models; they do not replace them. The cleanup/restart owner's failing-dependents product crosses every ordered pair of resolving, throwing, rejecting, held, and pooled-throwing dependent ends with synchronous, held, and rejecting adapter cleanup and both release orders, with declared reach; it rejects a cleanup that stops at a throwing dependent, settles with `Promise.all`, or waits only for its dependents. Effects and nested live-query chains with failing ends are not generated. |
 | Small structures and test mechanics | [SortedMap](https://github.com/TanStack/db/blob/main/packages/db/tests/SortedMap-oracle.test.ts), [cleanup queue](https://github.com/TanStack/db/blob/main/packages/db/tests/cleanup-queue-oracle.property.test.ts), [live-query GC clock](https://github.com/TanStack/db/blob/main/packages/db/tests/collection-gc-clock.test.ts), [guarded replay](https://github.com/TanStack/db/blob/main/packages/db/tests/oracle-replay.test.ts) | Map/full-sort and elapsed appointment-list models with executed target/seed/path checks. SortedMap promises what Collection state uses, not full Map parity (maintainer decision). Keys are strings or numbers: `sync.write` and mutations throw `InvalidKeyError` or `UndefinedKeyError` for any other key, and grouped live queries key nullish, boolean, and bigint group values with strings (maintainer decision, 2026-10-27). The model is a Map of numbers plus a full sort; production stores row objects so the driver can change one in place. Keys include `NaN`, which a grouped live query uses for a `NaN` group; it is one key that key order places after every other number. Generated histories mix deferred and immediate sets and deletes, clear, deferred bursts of 17 to 41 keys, prunes that delete entries with deferOrder while iterating, and in-place changes of a deferred or a placed row. A prune must yield the order it began with. A row changed before restore sorts by its current value; once a placed row changes in place, comparator order downgrades to membership (each key once, current value) for the rest of the history, and a later write or delete affects only its own key. At each ordered read with a comparator, restoring k deferred keys among n others makes at most k * (ceil(log2 k) + ceil(log2 (n + 1)) + 2) comparator calls, and none with nothing deferred. Declared reach (minimum 5, per campaign of 100): burst restorations, an entry yielded after a prune deleted one, a placed `NaN` key written without deferral (7 to 16), a restore whose bound is below n (19 to 30), a changed placed row later written (11 to 20), and a deferred row changed before restore (11 to 19). Mutants that re-sort every key (108 calls against a bound of 7), re-sort the kept keys with the dirty keys appended (34 against 7), re-sort clean scans, drop the scan fallback for a changed row, match slots by `===` (a placed `NaN` key then removes the last key), keep dirty slots, apply deferred deletes immediately, or place a deferred row by its value at the write each fail. Supplemental examples in `SortedMap.test.ts` pin splice movement at scale, a key iterator opened before a deferred restore, scan reuse, and public single-transaction and queued-transaction Collection sync paths. Not promised: other mutation during iteration (immediate writes, clear), the order of rows once a placed row changed in place, keys outside the key type, `-0` keys, a comparator that throws, and the work of key order without a comparator, which the public API cannot observe. `forEach` was removed; SortedMap is not exported. Wall-clock steps do not move due times, and a focused public witness checks source subscription release. Callback-reentrant scheduling, OS suspend/resume, environments without `performance.now()`, and fake/real Performance clock replacement while GC is pending remain outside this coverage. Tests must drain or reset pending GC before switching timer providers. |
 
 The index-suggestion oracle's PR #2196 extension checks a matching local
@@ -1599,8 +1609,8 @@ The deep-equality and Collection change-event history owners check a Duration
 field replacement and its subscriber mirror. These fixed histories do not
 establish arbitrary multirow Duration updates or live-query publication.
 
-The [Temporal index order oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/temporal-index-order-oracle.test.ts)
-owns ZonedDateTime instant ordering and time-only Duration ordering for direct
+The [Temporal index order tests](https://github.com/TanStack/db/blob/main/packages/db/tests/temporal-index-order.test.ts)
+(fixed tests; no oracle owner (tracked in #2264)) covers ZonedDateTime instant ordering and time-only Duration ordering for direct
 BasicIndex/BTreeIndex reads and bounded public first-row reads. It separates
 exact Duration fields from order ties, including exclusive cursor behavior.
 An extended-year PlainDate lane checks calendar order under lexical string
@@ -2073,7 +2083,7 @@ The following related oracles own distinct production paths or observation cuts:
   These finite matrices do not establish arbitrary overlapping optimistic
   histories, ties, or provider-specific cursor behavior.
 - The [IR identity oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/query/ir-stable-identity-oracle.test.ts)
-  owns demand-key encoding. The
+  owns demand-key encoding in only two generated tests. The fixed demand-key cases live in [ir-stable-identity.test.ts](https://github.com/TanStack/db/blob/main/packages/db/tests/query/ir-stable-identity.test.ts), not in this owner. The
   [load-subset oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/query/load-subset-oracle.property.test.ts)
   owns runtime sharing and retry. The
   [transaction refinement oracle](https://github.com/TanStack/db/blob/main/packages/db/tests/query/load-subset-transaction-refinement-oracle.test.ts)
@@ -2141,8 +2151,8 @@ failed-construction host has one extra read on `8b3debb3a`, exposing an
 abandoned same-tab callback. These checks cannot prove that a failed Collection
 is no longer retained by a private adapter closure or an inert callback in
 the same-tab registry; those resource-retention claims need a receiving
-lifecycle/GC witness owned by
-`packages/db/tests/local-storage-peer-oracle.test.ts`.
+lifecycle/GC witness in
+`packages/db/tests/local-storage-peer-history.test.ts` (fixed tests; no oracle owner (tracked in #2264)).
 Native browser listener failure and host scheduling remain outside the
 controlled history.
 
@@ -2618,7 +2628,7 @@ installed Electric SDK. It checks distinct per-Collection schema versions,
 unchanged public and durable rows when a follower opens, leadership transfer
 with later source rows, and recovery of partial-row loss or a fully empty
 pre-key-ledger baseline with a stale resume marker. A wrapped source-commit
-test in `packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts`
+test in `packages/browser-db-sqlite-persistence/tests/browser-coordinator.test.ts`
 checks scheduler entry before the writer-lock request; the old bypass fails at
 that order assertion. The live recovery histories also guard the resulting
 progress. These bounded histories do not prove Firefox/Zen,
@@ -2953,9 +2963,12 @@ Three callback-lifetime calibrations distinguish nested scopes and both overlap
 exit orders. Forwarding-wrapper and explicit-adapter controls cover coordinator
 composition and the ordinary registered fallback.
 
-The receiving
-`packages/browser-db-sqlite-persistence/e2e/hydration-commit-oracle.opfs.spec.ts`
-runs 24 real Chromium OPFS histories plus one cleanup-failure calibration.
+The receiving fixed tests in
+`packages/browser-db-sqlite-persistence/e2e/hydration-commit.opfs.spec.ts`
+run 24 real Chromium OPFS histories plus one cleanup-failure calibration.
+They have no oracle owner: their expected rows come from a written table keyed
+by baseline and source history, not from a model. An oracle owner is tracked in
+#2264.
 It crosses the original phases/coordinators/baselines with single-insert and
 rich source histories, and checks three distinct Collection schemas, a cold
 peer, metadata, durable rows, and reopen. Sixteen startup/subscription histories
@@ -3199,7 +3212,6 @@ when they replace that path.
 pnpm --filter @tanstack/db-ivm build
 pnpm --filter @tanstack/db build
 pnpm --filter @tanstack/db test:oracles
-pnpm --filter @tanstack/powersync-db-collection test:oracles
 pnpm --filter @tanstack/db-sqlite-persistence-core build
 pnpm --filter @tanstack/node-db-sqlite-persistence test:oracles
 # Service-dependent: requires Electric and PostgreSQL to be running.
@@ -3246,12 +3258,15 @@ does not let the worker process its progress messages.
 
 ## Action enforcement example
 
-`examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations-oracle.test.js`
-owns the example's file-local lint boundary. Its finite grammar covers 12 binding
+`examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations.test.js`
+(fixed tests; no oracle owner (tracked in #2264)) covers the example's
+file-local lint boundary. Its finite crossing covers 12 binding
 forms, six methods, six call forms, and two callback definition orders, plus
 lexical shadowing, sibling scopes, configurable imports/methods, and alias cycles.
-The independent model labels the constructed receiver as a Collection and
-predicts one diagnostic for writes and none for reads. The checkpoint is the
+Each expected count is written: a table gives one diagnostic for each write
+method and none for each read, so the crossing is fixed tests, not a model
+(maintainer decision 2026-10-27: a table of written expected values selected by
+a test's parameters is not a model). The checkpoint is the
 complete diagnostic list from the real ESLint `Linter.verify` call. A receiving
 check runs the actual ESLint configuration on feature writes, feature reads,
 and action writes. The import-source dimension checks eight alias/relative/barrel
@@ -3325,6 +3340,51 @@ remount behavior during pending writes, or browser-native Enter dispatch.
 This component suite owns the first two extensions; a browser form witness
 is needed for native keyboard dispatch.
 
+## Oracle tooling
+
+`scripts/run-budget-oracle.property.test.js` owns run-budget tracking
+(`scripts.run-budget`): every lowered budget, and every budget whose key is in
+no tracked oracle file at head, is reported. A budget belongs to the oracle
+file that uses it, including campaigns and constants in the test modules that
+it imports. The removal rule is the maintainer's decision of 2026-10-27; a move
+into an imported support module is not a removal. Its grammar varies where the
+count, key, and campaign are written at base and head, a base oracle file above
+1 MiB, `.ts` and `.js` files, an untracked second oracle file, and a fixed seed
+shared with an unrelated campaign. Its driver fails on a crashed script. It
+does not establish that a lowered budget moved between two oracle files is
+compared when its fixed seed was already in the destination at base: a fixed
+seed is not unique, so the script cannot attribute it, and neither removal nor
+lowering is reported there. A budget moved into an ordinary test file whose
+seed another oracle file shares is therefore not reported.
+
+A budget that a helper computes at run time is not tracked either: the script
+reads the counts and keys written at a campaign's call, or in constants that the
+oracle file declares or imports. The op-sqlite alias campaigns in
+`packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts`
+(`op-sqlite.write-marker-aliases` and `op-sqlite.columnar-sql-aliases`, 50 runs
+each) register through `registerAliasOracle`, which builds its parameters from
+`readAliasOracleRuns()` and `TANSTACK_DB_OP_SQLITE_ORACLE_RUNS`, so lowering
+them is not reported. On main the script instead counted the literal
+`oracleRandomParameters(50, …)` calls in a unit test of those parameters. That
+unit test now lives in `op-sqlite-driver.test.ts`, so the script reports both
+keys and the fixed seed 271828 as removed, although both campaigns still run in
+the oracle file. Owner: `scripts.run-budget`. Needed witness: a campaign whose
+budget a helper computes and passes in as parameters.
+
+`scripts/lint-scope-oracle.property.test.js` owns lint selection after an
+edit (`scripts.lint-scope`): the changed scope, the named (pre-commit) scope,
+and the Claude edit hook. Its model is a fixed-point closure over the drawn
+import graph, independent of the script's forward search. It covers
+oracle-to-oracle imports, untracked oracle files, and `.js` oracle files. It
+does not draw `.js` support modules or drivers, although the rule now resolves
+a `.js` test module when no TypeScript source exists for it (the part-reach
+oracle owns that resolution). It passes file names in their real-path spelling:
+a name given through a symlinked path is not covered.
+
+`packages/db/tests/oracle-replay.test.ts` checks every replay manifest owner:
+from its cwd, the command's files exist, its target is the owner, and a Vitest
+config applies.
+
 ## Reusable-law backlog
 
 RFC #1659 reviews found several green oracles whose stated laws remained valid
@@ -3512,7 +3572,10 @@ the Collection. The multi-call histories check that the wrapper delivers the
 adapter's calls to core in the order it made them; a throwing `onFirstReady` callback or `status:ready` listener surfaces as uncaught and the Collection stays `ready`. The laws: restored rows open the Collection once the
 deadline passes or the remote fails; an empty restore stays `loading`; a remote
 answer before the restore completes waits for it; a failed restore crashes.
-Separate cases check that a Collection without `initialRender` waits for the
+Fixed tests in
+`packages/db-sqlite-persistence-core/tests/persisted-readiness.test.ts`
+(fixed tests; no oracle owner (tracked in #2264)) check that a Collection
+without `initialRender` waits for the
 network, the three-second default deadline, configuration rejection, and that
 `reportError()` before ready still crashes; `markReady()` after a ready
 Collection's `fail()` is a no-op. Mutants that let an empty restore open,
@@ -3794,7 +3857,7 @@ must match authored durable operation order after controlled delivery. A raw
 unseen row makes excluded-notification handling observable. These cases repair
 specific convergence laws; they do not establish arbitrary concurrent receivers.
 
-The [compatibility owner](https://github.com/TanStack/db/blob/main/packages/db/tests/indexed-db/compatibility-oracle.test.ts)
+The [compatibility tests](https://github.com/TanStack/db/blob/main/packages/db/tests/indexed-db/compatibility.test.ts) (fixed tests; no oracle owner (tracked in #2264))
 checks full versus getRandomValues-only crypto through write/broadcast, one
 reusable descriptor across independent DbClients and cleanup, and injected
 factories without ambient IndexedDB globals across typed-key multi-store
@@ -4052,7 +4115,7 @@ records the subsequent calibration and closes the stored-field/type cleanup.
 
 `packages/db/tests/indexed-db/retirement-oracle.test.ts` owns the finish
 policy's row, caller, admission, read-authority, accepted-work and error-status
-laws. `deletion-queue-oracle.test.ts` owns administrative receipt authority across
+laws. `deletion-queue.test.ts` (fixed tests; no oracle owner (tracked in #2264)) holds administrative receipt authority across
 delete/recreate/delete. `packages/db/tests/truncate-readiness-oracle.test.ts`
 owns replacement publication with explicit readiness preservation. Their models
 remain structurally independent of production connection listeners and caches.
@@ -4090,7 +4153,7 @@ The [sighted donor survey](oracle-reviews/2026-10-06-indexeddb-donor-survey.md)
 now has these receiving owners. The [port audit](oracle-reviews/2026-10-06-indexeddb-donor-port.md)
 records calibration, validation and the remaining limits.
 
-- DP08: `compatibility-oracle.test.ts` starts two/three native opens against
+- DP08: `compatibility.test.ts` (fixed tests; no oracle owner (tracked in #2264)) starts two/three native opens against
   absent same/independent names, with identical complete declarations. It checks
   schema, held restore/readiness, disjoint writes, convergence, restore and a later
   upgrade with no orphan blocker.
@@ -4107,7 +4170,7 @@ records calibration, validation and the remaining limits.
 - DP10: the compatibility owner substitutes six legal database/store names into
   the same authored multi-store history. Prefix neighbors, typed keys in separate
   transactions, version values, peers and restore distinguish routing mistakes.
-  `packages/db/e2e/indexed-db/host-oracle.spec.ts` receives all six names
+  `packages/db/e2e/indexed-db/host.spec.ts` (fixed tests; no oracle owner (tracked in #2264)) receives all six names
   through single-transaction typed-key insertion, peer update, import, clear, export and fresh restore.
   Prefix-neighbor and anchor snapshots must remain unchanged.
 - DP17: `packed-consumer.test.ts` supplements declaration tests with installed
diff --git a/docs/contributing/oracle-rubric.md b/docs/contributing/oracle-rubric.md
index b5b012f3ec..df249ca78d 100644
--- a/docs/contributing/oracle-rubric.md
+++ b/docs/contributing/oracle-rubric.md
@@ -390,6 +390,45 @@ Use `oracle` in filenames that own an independent expected-result computation,
 state model, differential or metamorphic comparison, or reusable law checker.
 A separate module that defines that model, checker, or its history grammar also
 qualifies. Identify the mechanism in the code before applying the name.
+
+An oracle file holds only oracle tests. It names its parts with
+`declareOracle({ check: [...], model: [...], grammar: [...] })` from
+[`oracle-declaration.ts`](../../packages/db/tests/oracle-declaration.ts), which
+imports nothing so that browser and native-app modules can use it: the check
+compares production observations with the model or with a second
+formulation, and the grammar is the generators that produce legal histories.
+Each part is optional. Every test in the file uses a declared part, directly
+or through a driver:
+
+- A generated property or a fixed history runs through the check.
+- A model pin steps the model and checks one rule against its authority.
+- A calibration shows that the check rejects a wrong answer (ORC-006).
+- A grammar calibration shows that the generators reach the states that the
+  laws need (ORC-004, ORC-015).
+- A generated property can state its law inline: its predicate relates
+  production to inputs that nobody wrote down. A property whose arbitraries
+  are all constants, or whose predicate ignores its input, checks written
+  values instead.
+- A type-level test compares an inferred type with a type model. A type has no
+  value to pass, so the file names its model types in
+  `declareOracle({ typeModel: [...] })`. Each name is a type alias or
+  interface in the same file, and a type built from one counts as using it.
+
+A test that uses none of them compares production with a hand-written value. It
+is a unit test, even when it asserts a contract, and it belongs in an
+ordinary test file beside the oracle. A finite table of hand-written expected
+values selected by a test's parameters is not a model. The `oracle/no-unit-test` lint rule
+reports such a test. Files named `oracle-*`, such as `oracle-config.ts`, are
+the shared oracle machinery and declare no parts.
+
+An oracle file also registers no test through a helper from an ordinary module.
+The rule reports a call to such a helper, because the helper's tests then appear
+under the oracle file. The ordinary runner registers those tests, and passes the
+shared suite a registrar when the suite needs one. A helper from an oracle-named
+module is linted on its own, so the rule does not report a call to it. An
+`oracle-` machinery module, such as `oracle-config.ts`, is not linted, so the
+rule judges a call to its helpers as it judges an ordinary module's.
+
 ORC-016 keeps ordinary unit tests and concrete type assertions out of oracle
 files. Fixed regressions replay the shared law; supplemental examples live in
 ordinary test files.
diff --git a/examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations-oracle.test.js b/examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations.test.js
similarity index 97%
rename from examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations-oracle.test.js
rename to examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations.test.js
index 6b2bc0eb6a..b517f4bc01 100644
--- a/examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations-oracle.test.js
+++ b/examples/react/action-enforcement/eslint-rules/no-direct-collection-mutations.test.js
@@ -15,7 +15,9 @@ import config from '../eslint.config.mjs'
  * Moving a callback definition before an alias cannot change that alias's value
  * when the callback runs after initialization.
  *
- * This finite syntax oracle covers the bindings, call forms, and scopes below.
+ * These are fixed tests, not an oracle: each expected diagnostic count is a
+ * written value, chosen by the method under test (the operations table). They
+ * cover the bindings, call forms, and scopes below.
  * It does not model execution paths, inter-module re-exports, function arguments,
  * factory returns, dynamic method names, or aliases stored in new containers.
  * Mutable aliases conservatively retain their Collection classification.
diff --git a/lint-staged.config.js b/lint-staged.config.js
index 7741941e3a..0509ea0fa1 100644
--- a/lint-staged.config.js
+++ b/lint-staged.config.js
@@ -5,9 +5,19 @@
 const chunkSize = 40
 
 export default {
-  // The oracle rules, without inline directives. lint-staged appends the
-  // staged oracle files as arguments.
-  '*oracle*.{ts,tsx}': `node scripts/agent-lint-feedback.mjs`,
+  // The oracle rules, without inline directives. The script lints the oracle
+  // files that each staged test or support module affects, so every module
+  // that an oracle can import is passed. It selects the oracle files itself.
+  '*.{ts,tsx,js,mjs}': (files) => {
+    const commands = []
+    for (let start = 0; start < files.length; start += chunkSize) {
+      const chunk = files.slice(start, start + chunkSize)
+      commands.push(
+        `node scripts/agent-lint-feedback.mjs ${chunk.map((file) => `"${file}"`).join(` `)}`,
+      )
+    }
+    return commands
+  },
   '*.{ts,tsx}': (files) => {
     const commands = []
     for (let start = 0; start < files.length; start += chunkSize) {
diff --git a/package.json b/package.json
index 2b71e901c8..a33b1c08bc 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     "lint:changed": "node scripts/agent-lint-feedback.mjs",
     "lint:oracles": "node scripts/agent-lint-feedback.mjs --all",
     "lint:run-budgets": "node scripts/check-oracle-run-counts.mjs",
-    "test:lint-rules": "node --test \"scripts/eslint-plugin-oracle/*.test.js\"",
+    "test:lint-rules": "vitest run --config scripts/eslint-plugin-oracle/vitest.config.mjs && vitest run --config scripts/oracle-scripts.vitest.config.mjs",
     "lint-all": "eslint . --fix",
     "prepare": "husky",
     "test": "pnpm --filter \"./packages/**\" test && pnpm --filter @tanstack/db test:indexed-db:package",
diff --git a/packages/browser-db-sqlite-persistence/e2e/hydration-commit-oracle.opfs.spec.ts b/packages/browser-db-sqlite-persistence/e2e/hydration-commit.opfs.spec.ts
similarity index 88%
rename from packages/browser-db-sqlite-persistence/e2e/hydration-commit-oracle.opfs.spec.ts
rename to packages/browser-db-sqlite-persistence/e2e/hydration-commit.opfs.spec.ts
index 65b080ae3f..4452675e0d 100644
--- a/packages/browser-db-sqlite-persistence/e2e/hydration-commit-oracle.opfs.spec.ts
+++ b/packages/browser-db-sqlite-persistence/e2e/hydration-commit.opfs.spec.ts
@@ -1,3 +1,38 @@
+/**
+ * Harness self-test for the hydration-commit checkpoint: the fixture's cleanup
+ * failures must not replace the primary observation. The real-provider matrix below
+ * is in this file too.
+ */
+import { expect, test } from '@playwright/test'
+import type { HydrationCommitObservation } from './hydration-commit.opfs'
+
+// ORC-010 calibration: two teardown failures cannot erase the independently
+// captured observation, mutate its receipt errors, or hide one another.
+test(`preserves the primary observation through multiple cleanup failures`, async ({
+  page,
+}) => {
+  await page.goto(
+    `/e2e/hydration-commit.opfs.html?phase=after-ready&baseline=false&coordinator=browser&rich=false&cleanupFault=true`,
+  )
+  await page.waitForFunction(() => window.__hydrationCommitDone === true)
+  const result = await page.evaluate(() => ({
+    observation: window.__hydrationCommitResult,
+    error: window.__hydrationCommitError,
+    cleanup: window.__hydrationCommitCleanupErrors,
+  }))
+  expect(result.error).toBeUndefined()
+  expect(result.observation?.cycleCalls).toBe(0)
+  expect(result.observation?.errors).toEqual([])
+  expect(result.observation?.reopenedRows).toEqual([
+    { id: `r1`, value: 1 },
+    { id: `tail`, value: 9 },
+  ])
+  expect(result.cleanup).toEqual([
+    `Error: injected first cleanup failure`,
+    `Error: injected last cleanup failure`,
+  ])
+})
+
 /**
  * Real-provider refinement of the law/driver in hydration-commit.opfs.ts.
  * The insert history retains baseline+r1. The rich history replaces all rows,
@@ -10,8 +45,23 @@
  * post-cleanup fresh claim checks durable rows, not offline Collection restore;
  * a partial on-demand cache has no authority to restore public rows alone.
  */
-import { expect, test } from '@playwright/test'
-import type { HydrationCommitObservation } from './hydration-commit.opfs'
+// The edit-log model's rows after the receipt cut and the ordinary tail: the rich
+// history replaces all rows with r2; the insert history keeps r1 and an optional baseline.
+function expectedHydrationCommitRows(
+  baseline: boolean,
+  rich: boolean,
+): Array<{ id: string; value: number }> {
+  return rich
+    ? [
+        { id: `r2`, value: 3 },
+        { id: `tail`, value: 9 },
+      ]
+    : [
+        ...(baseline ? [{ id: `baseline`, value: 0 }] : []),
+        { id: `r1`, value: 1 },
+        { id: `tail`, value: 9 },
+      ]
+}
 
 for (const phase of [`startup`, `subscription`, `after-ready`] as const) {
   for (const baseline of [false, true]) {
@@ -82,16 +132,7 @@ for (const phase of [`startup`, `subscription`, `after-ready`] as const) {
             ordinary: `fulfilled`,
             exited: phase === `after-ready` ? null : true,
           })
-          const expected = rich
-            ? [
-                { id: `r2`, value: 3 },
-                { id: `tail`, value: 9 },
-              ]
-            : [
-                ...(baseline ? [{ id: `baseline`, value: 0 }] : []),
-                { id: `r1`, value: 1 },
-                { id: `tail`, value: 9 },
-              ]
+          const expected = expectedHydrationCommitRows(baseline, rich)
           expect(observed.rows).toEqual(expected)
           expect(observed.durableRows).toEqual(expected)
           expect(observed.reopenedRows).toEqual(expected)
@@ -122,30 +163,3 @@ for (const phase of [`startup`, `subscription`, `after-ready`] as const) {
     }
   }
 }
-
-// ORC-010 calibration: two teardown failures cannot erase the independently
-// captured observation, mutate its receipt errors, or hide one another.
-test(`preserves the primary observation through multiple cleanup failures`, async ({
-  page,
-}) => {
-  await page.goto(
-    `/e2e/hydration-commit.opfs.html?phase=after-ready&baseline=false&coordinator=browser&rich=false&cleanupFault=true`,
-  )
-  await page.waitForFunction(() => window.__hydrationCommitDone === true)
-  const result = await page.evaluate(() => ({
-    observation: window.__hydrationCommitResult,
-    error: window.__hydrationCommitError,
-    cleanup: window.__hydrationCommitCleanupErrors,
-  }))
-  expect(result.error).toBeUndefined()
-  expect(result.observation?.cycleCalls).toBe(0)
-  expect(result.observation?.errors).toEqual([])
-  expect(result.observation?.reopenedRows).toEqual([
-    { id: `r1`, value: 1 },
-    { id: `tail`, value: 9 },
-  ])
-  expect(result.cleanup).toEqual([
-    `Error: injected first cleanup failure`,
-    `Error: injected last cleanup failure`,
-  ])
-})
diff --git a/packages/browser-db-sqlite-persistence/e2e/install-layout-oracle.e2e.test.ts b/packages/browser-db-sqlite-persistence/e2e/install-layout-oracle.e2e.test.ts
index 979705db7b..c9767f2e95 100644
--- a/packages/browser-db-sqlite-persistence/e2e/install-layout-oracle.e2e.test.ts
+++ b/packages/browser-db-sqlite-persistence/e2e/install-layout-oracle.e2e.test.ts
@@ -48,6 +48,7 @@ import { fileURLToPath } from 'node:url'
 import { chromium } from '@playwright/test'
 import { afterAll, beforeAll, expect, it } from 'vitest'
 import { createServer, preview } from 'vite'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { buildForProduction } from './packaged-consumer'
 import type { Browser } from '@playwright/test'
 import type { BrowserWASQLiteDatabase } from '../src'
@@ -169,6 +170,23 @@ const layoutCases: Array<LayoutCase> = [
   })),
 ]
 
+declareOracle({
+  check: [expectLayoutOutcome],
+  model: [expectedOutcome],
+  grammar: [layoutCases],
+})
+
+// The check: the installed copy's observed outcome equals the layout model's
+// prediction for the same case and install facts.
+async function expectLayoutOutcome(
+  layoutCase: LayoutCase,
+  install: InstallFacts,
+): Promise<void> {
+  expect(await openInLayout(install, layoutCase)).toEqual(
+    expectedOutcome(layoutCase, install),
+  )
+}
+
 let browser: Browser
 const coveredOutcomes = new Set<string>()
 beforeAll(async () => {
@@ -188,7 +206,7 @@ it.each(layoutCases)(
       const install = installLayout(temporaryDirectory, layoutCase.layout)
       const expected = expectedOutcome(layoutCase, install)
       coveredOutcomes.add(JSON.stringify(expected))
-      expect(await openInLayout(install, layoutCase)).toEqual(expected)
+      await expectLayoutOutcome(layoutCase, install)
     } finally {
       rmSync(temporaryDirectory, { recursive: true, force: true })
     }
diff --git a/packages/browser-db-sqlite-persistence/e2e/leader-close-oracle.opfs.spec.ts b/packages/browser-db-sqlite-persistence/e2e/leader-close-oracle.opfs.spec.ts
index 4fe8b9dff2..88db214727 100644
--- a/packages/browser-db-sqlite-persistence/e2e/leader-close-oracle.opfs.spec.ts
+++ b/packages/browser-db-sqlite-persistence/e2e/leader-close-oracle.opfs.spec.ts
@@ -20,44 +20,10 @@
  * detector for this no-pruning fixture, not a permanent storage contract.
  */
 import { expect, test } from '@playwright/test'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import { observe, openProbe } from './leader-close-probe'
 import type { BrowserContext, Page } from '@playwright/test'
 
-type ProbeObservation = {
-  phase: `starting` | `ready` | `failed`
-  failure?: string
-  isLeader: boolean
-  collectionStatus: string
-  publicIds: Array<string>
-  liveIds: Array<string>
-  liveStatus: string
-  publicEventKeys: Array<string>
-  liveEventKeys: Array<string>
-  authoredTxIds: Record<string, string>
-  syncRuns: number
-  heldAtCommitBoundary: boolean
-  reconciliationRequested: boolean
-  firstOutcome?: {
-    status: `fulfilled` | `rejected`
-    errorName?: string
-    message?: string
-  }
-}
-
-async function observe(page: Page): Promise<ProbeObservation> {
-  return page.evaluate(() => window.__leaderCloseProbe!.observe())
-}
-
-async function openProbe(page: Page, url: string): Promise<void> {
-  await page.goto(url)
-  await page.waitForFunction(
-    () =>
-      window.__leaderCloseProbe !== undefined &&
-      window.__leaderCloseProbe.observe().phase !== `starting`,
-  )
-  const state = await observe(page)
-  if (state.phase === `failed`) throw new Error(state.failure)
-}
-
 type Schedule = `none` | `before` | `after` | `after-peer` | `after-notify`
 
 // The authored order is crossing→later. Each fulfilled source receipt has one
@@ -377,74 +343,7 @@ async function runHistory(
   expect(cleanupFailures).toEqual([])
 }
 
-// The cold successor is opened only after the idle owner closes. It cannot
-// have learned that owner's term from a heartbeat. Real OPFS SQLite must
-// retain the no-write election reservation across page lifetimes, and the
-// new owner must use the next term for its first public source receipt.
-test(`cold OPFS successor reserves a new term after a no-write leader closes`, async ({
-  context,
-}) => {
-  const databaseId = `leader-close-${crypto.randomUUID()}`
-  const pageUrl = (role: `leader` | `follower`) =>
-    `/e2e/leader-close.opfs.html?databaseId=${databaseId}&role=${role}&hold=none`
-  const pages: Array<Page> = []
-  const cleanupFailures: Array<string> = []
-  let primaryFailure: unknown
-  try {
-    const former = await context.newPage()
-    pages.push(former)
-    await openProbe(former, pageUrl(`leader`))
-    await expect.poll(async () => (await observe(former)).isLeader).toBe(true)
-    expect(
-      await former.evaluate(() => window.__leaderCloseProbe!.durableState()),
-    ).toMatchObject({ term: 1, rowVersion: 0, ids: [] })
-    await former.close()
-
-    const successor = await context.newPage()
-    pages.push(successor)
-    await openProbe(successor, pageUrl(`follower`))
-    await expect
-      .poll(async () => (await observe(successor)).isLeader)
-      .toBe(true)
-    expect(
-      await successor.evaluate(() => window.__leaderCloseProbe!.durableState()),
-    ).toMatchObject({ term: 2, rowVersion: 0, ids: [] })
-    expect(
-      await successor.evaluate(() =>
-        window.__leaderCloseProbe!.commitNext(`later`),
-      ),
-    ).toEqual({ status: `fulfilled` })
-    expect(
-      await successor.evaluate(() => window.__leaderCloseProbe!.durableState()),
-    ).toMatchObject({ term: 2, rowVersion: 1, ids: [`later`] })
-    expect((await observe(successor)).publicIds).toEqual([`later`])
-  } catch (error) {
-    primaryFailure = error
-  }
-  for (const page of pages.reverse()) {
-    try {
-      if (page.isClosed()) continue
-      cleanupFailures.push(
-        ...(await page.evaluate(
-          () => window.__leaderCloseProbe?.cleanup() ?? [],
-        )),
-      )
-      await page.close()
-    } catch (error) {
-      cleanupFailures.push(`page cleanup: ${String(error)}`)
-      await page.close().catch(() => undefined)
-    }
-  }
-  if (primaryFailure && cleanupFailures.length > 0) {
-    throw new AggregateError(
-      cleanupFailures.map((message) => new Error(message)),
-      `Cold leader-close oracle and cleanup both failed`,
-      { cause: primaryFailure },
-    )
-  }
-  if (primaryFailure) throw primaryFailure
-  expect(cleanupFailures).toEqual([])
-})
+declareOracle({ check: [runHistory], model: [expectedHistory] })
 
 test(`surviving OPFS source Collection accepts work after an idle leader tab closes`, async ({
   context,
diff --git a/packages/browser-db-sqlite-persistence/e2e/leader-close-probe.ts b/packages/browser-db-sqlite-persistence/e2e/leader-close-probe.ts
new file mode 100644
index 0000000000..117e31b6cb
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/e2e/leader-close-probe.ts
@@ -0,0 +1,39 @@
+import type { Page } from '@playwright/test'
+
+// The browser probe that the leader-close checkpoints and their scenario tests share.
+// It stages tabs, reads each tab's observation, and reports when a tab is ready.
+export type ProbeObservation = {
+  phase: `starting` | `ready` | `failed`
+  failure?: string
+  isLeader: boolean
+  collectionStatus: string
+  publicIds: Array<string>
+  liveIds: Array<string>
+  liveStatus: string
+  publicEventKeys: Array<string>
+  liveEventKeys: Array<string>
+  authoredTxIds: Record<string, string>
+  syncRuns: number
+  heldAtCommitBoundary: boolean
+  reconciliationRequested: boolean
+  firstOutcome?: {
+    status: `fulfilled` | `rejected`
+    errorName?: string
+    message?: string
+  }
+}
+
+export async function observe(page: Page): Promise<ProbeObservation> {
+  return page.evaluate(() => window.__leaderCloseProbe!.observe())
+}
+
+export async function openProbe(page: Page, url: string): Promise<void> {
+  await page.goto(url)
+  await page.waitForFunction(
+    () =>
+      window.__leaderCloseProbe !== undefined &&
+      window.__leaderCloseProbe.observe().phase !== `starting`,
+  )
+  const state = await observe(page)
+  if (state.phase === `failed`) throw new Error(state.failure)
+}
diff --git a/packages/browser-db-sqlite-persistence/e2e/leader-close.opfs.spec.ts b/packages/browser-db-sqlite-persistence/e2e/leader-close.opfs.spec.ts
new file mode 100644
index 0000000000..cf8404d80b
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/e2e/leader-close.opfs.spec.ts
@@ -0,0 +1,77 @@
+/**
+ * Cold-successor checkpoint for the leader-close law in
+ * `leader-close-oracle.opfs.spec.ts`, which owns the law and its histories.
+ * This scenario states its own hand-written term and row expectations.
+ */
+import { expect, test } from '@playwright/test'
+import { observe, openProbe } from './leader-close-probe'
+import type { Page } from '@playwright/test'
+
+// The cold successor is opened only after the idle owner closes. It cannot
+// have learned that owner's term from a heartbeat. Real OPFS SQLite must
+// retain the no-write election reservation across page lifetimes, and the
+// new owner must use the next term for its first public source receipt.
+test(`cold OPFS successor reserves a new term after a no-write leader closes`, async ({
+  context,
+}) => {
+  const databaseId = `leader-close-${crypto.randomUUID()}`
+  const pageUrl = (role: `leader` | `follower`) =>
+    `/e2e/leader-close.opfs.html?databaseId=${databaseId}&role=${role}&hold=none`
+  const pages: Array<Page> = []
+  const cleanupFailures: Array<string> = []
+  let primaryFailure: unknown
+  try {
+    const former = await context.newPage()
+    pages.push(former)
+    await openProbe(former, pageUrl(`leader`))
+    await expect.poll(async () => (await observe(former)).isLeader).toBe(true)
+    expect(
+      await former.evaluate(() => window.__leaderCloseProbe!.durableState()),
+    ).toMatchObject({ term: 1, rowVersion: 0, ids: [] })
+    await former.close()
+
+    const successor = await context.newPage()
+    pages.push(successor)
+    await openProbe(successor, pageUrl(`follower`))
+    await expect
+      .poll(async () => (await observe(successor)).isLeader)
+      .toBe(true)
+    expect(
+      await successor.evaluate(() => window.__leaderCloseProbe!.durableState()),
+    ).toMatchObject({ term: 2, rowVersion: 0, ids: [] })
+    expect(
+      await successor.evaluate(() =>
+        window.__leaderCloseProbe!.commitNext(`later`),
+      ),
+    ).toEqual({ status: `fulfilled` })
+    expect(
+      await successor.evaluate(() => window.__leaderCloseProbe!.durableState()),
+    ).toMatchObject({ term: 2, rowVersion: 1, ids: [`later`] })
+    expect((await observe(successor)).publicIds).toEqual([`later`])
+  } catch (error) {
+    primaryFailure = error
+  }
+  for (const page of pages.reverse()) {
+    try {
+      if (page.isClosed()) continue
+      cleanupFailures.push(
+        ...(await page.evaluate(
+          () => window.__leaderCloseProbe?.cleanup() ?? [],
+        )),
+      )
+      await page.close()
+    } catch (error) {
+      cleanupFailures.push(`page cleanup: ${String(error)}`)
+      await page.close().catch(() => undefined)
+    }
+  }
+  if (primaryFailure && cleanupFailures.length > 0) {
+    throw new AggregateError(
+      cleanupFailures.map((message) => new Error(message)),
+      `Cold leader-close oracle and cleanup both failed`,
+      { cause: primaryFailure },
+    )
+  }
+  if (primaryFailure) throw primaryFailure
+  expect(cleanupFailures).toEqual([])
+})
diff --git a/packages/browser-db-sqlite-persistence/e2e/opfs-request-order-oracle.opfs.spec.ts b/packages/browser-db-sqlite-persistence/e2e/opfs-request-order-oracle.opfs.spec.ts
index 0bfbbdce59..cee4029f25 100644
--- a/packages/browser-db-sqlite-persistence/e2e/opfs-request-order-oracle.opfs.spec.ts
+++ b/packages/browser-db-sqlite-persistence/e2e/opfs-request-order-oracle.opfs.spec.ts
@@ -6,8 +6,23 @@
  */
 import { expect, test } from '@playwright/test'
 import { requestOrderExamples } from '../tests/opfs-request-order-oracle'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import type { OPFSRequestOrderResult } from './opfs-request-order.opfs'
 
+// The page's comparison of each fixed history's settlements with the model: no history may report a violation.
+function expectRequestOrderLawsHold(result: {
+  results: ReadonlyArray<{ history: unknown; violation?: unknown }>
+}): void {
+  expect(result.results).toHaveLength(requestOrderExamples.length)
+  expect(
+    result.results
+      .filter(({ violation }) => violation !== undefined)
+      .map(({ history, violation }) => ({ history, violation })),
+  ).toEqual([])
+}
+
+declareOracle({ check: [expectRequestOrderLawsHold] })
+
 test(`real Chromium OPFS connection answers requests in order and closes after them`, async ({
   page,
 }) => {
@@ -26,10 +41,5 @@ test(`real Chromium OPFS connection answers requests in order and closes after t
   expect(pageErrors).toEqual([])
   expect(result.status).toBe(`complete`)
   if (result.status !== `complete`) return
-  expect(result.results).toHaveLength(requestOrderExamples.length)
-  expect(
-    result.results
-      .filter(({ violation }) => violation !== undefined)
-      .map(({ history, violation }) => ({ history, violation })),
-  ).toEqual([])
+  expectRequestOrderLawsHold(result)
 })
diff --git a/packages/browser-db-sqlite-persistence/e2e/reload-class-oracle.opfs.spec.ts b/packages/browser-db-sqlite-persistence/e2e/reload-class-oracle.opfs.spec.ts
index 7bb1fd850e..3a624d004b 100644
--- a/packages/browser-db-sqlite-persistence/e2e/reload-class-oracle.opfs.spec.ts
+++ b/packages/browser-db-sqlite-persistence/e2e/reload-class-oracle.opfs.spec.ts
@@ -6,8 +6,25 @@
  * stays distinct from a law violation.
  */
 import { expect, test } from '@playwright/test'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import type { ReloadClassResult } from './reload-class.opfs'
 
+// The page's comparison of each fixed reload history with the oracle: every
+// expected history reports, and none reports a violation.
+function expectReloadClassLawsHold(
+  result: Extract<ReloadClassResult, { status: `complete` }>,
+): void {
+  expect(result.expected.length).toBeGreaterThan(0)
+  expect(result.results.map(({ name }) => name)).toEqual(result.expected)
+  expect(
+    result.results
+      .filter(({ violations }) => violations.length > 0)
+      .map(({ name, violations }) => ({ name, violations })),
+  ).toEqual([])
+}
+
+declareOracle({ check: [expectReloadClassLawsHold] })
+
 test(`real Chromium OPFS reload is free of avoidable work ahead of its reads`, async ({
   page,
 }) => {
@@ -26,11 +43,5 @@ test(`real Chromium OPFS reload is free of avoidable work ahead of its reads`, a
   expect(pageErrors).toEqual([])
   expect(result).toMatchObject({ status: `complete` })
   if (result.status !== `complete`) return
-  expect(result.expected.length).toBeGreaterThan(0)
-  expect(result.results.map(({ name }) => name)).toEqual(result.expected)
-  expect(
-    result.results
-      .filter(({ violations }) => violations.length > 0)
-      .map(({ name, violations }) => ({ name, violations })),
-  ).toEqual([])
+  expectReloadClassLawsHold(result)
 })
diff --git a/packages/browser-db-sqlite-persistence/e2e/shared-driver-fairness-oracle.opfs.spec.ts b/packages/browser-db-sqlite-persistence/e2e/shared-driver-fairness-oracle.opfs.spec.ts
index 5bc2dd1c63..76feef0151 100644
--- a/packages/browser-db-sqlite-persistence/e2e/shared-driver-fairness-oracle.opfs.spec.ts
+++ b/packages/browser-db-sqlite-persistence/e2e/shared-driver-fairness-oracle.opfs.spec.ts
@@ -11,6 +11,7 @@
  * the scheduling laws.
  */
 import { expect, test } from '@playwright/test'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import type { Page } from '@playwright/test'
 import type { OPFSOracleResult } from './shared-driver-fairness.opfs'
 
@@ -65,6 +66,8 @@ function expectLawsHold(result: OPFSOracleResult): void {
   expect(result.opfsCleanupFailures).toEqual([])
 }
 
+declareOracle({ check: [expectLawsHold] })
+
 test(`real Chromium OPFS fixture reaches and cleans up cold hydration`, async ({
   page,
 }) => {
diff --git a/packages/browser-db-sqlite-persistence/playwright.opfs.config.ts b/packages/browser-db-sqlite-persistence/playwright.opfs.config.ts
index 628d268853..f7f7eacc71 100644
--- a/packages/browser-db-sqlite-persistence/playwright.opfs.config.ts
+++ b/packages/browser-db-sqlite-persistence/playwright.opfs.config.ts
@@ -11,8 +11,9 @@ export default defineConfig({
     `remote-subset-two-tab.opfs.spec.ts`,
     `cache-claim-notice.opfs.spec.ts`,
     `open-timeout.opfs.spec.ts`,
-    `hydration-commit-oracle.opfs.spec.ts`,
+    `hydration-commit.opfs.spec.ts`,
     `leader-close-oracle.opfs.spec.ts`,
+    `leader-close.opfs.spec.ts`,
     `opfs-request-order-oracle.opfs.spec.ts`,
     `reload-class-oracle.opfs.spec.ts`,
   ],
diff --git a/packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts b/packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts
index 59283b39af..70dffd204d 100644
--- a/packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts
+++ b/packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts
@@ -1,33 +1,3 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import fc from 'fast-check'
-import { BasicIndex, IR, createCollection } from '@tanstack/db'
-import {
-  RetryableRemoteSubsetAcquisitionError,
-  validateRemoteSubsetOptions,
-} from '@tanstack/db-sqlite-persistence-core'
-import { BrowserCollectionCoordinator } from '../src/browser-coordinator'
-import {
-  createBrowserWASQLitePersistence,
-  persistedCollectionOptions,
-} from '../src'
-import { createWASQLiteTestDatabase } from './helpers/wa-sqlite-test-db'
-import type { LoadSubsetOptions, Subscription, SyncConfig } from '@tanstack/db'
-import type {
-  ApplyCommittedTxRequest,
-  ApplyCommittedTxResponse,
-  ApplyLocalMutationsRequest,
-  ApplyLocalMutationsResponse,
-  HydrationPersistenceAdapter,
-  IndeterminateCommitError,
-  PersistedCollectionDurabilityError,
-  PersistedStorageTarget,
-  PersistedTx,
-  PersistenceAdapter,
-  RemoteSubsetOwner,
-  TransportedLoadSubsetOptions,
-} from '@tanstack/db-sqlite-persistence-core'
-import type { BrowserCollectionCoordinatorOptions } from '../src/browser-coordinator'
-
 /**
  * # Which Browser coordinator outcomes are safe to acknowledge?
  *
@@ -75,7949 +45,178 @@ import type { BrowserCollectionCoordinatorOptions } from '../src/browser-coordin
  * real browser scheduling, Web Locks, BroadcastChannel, OPFS ownership, or
  * worker behavior. Bounded replay retry is covered for retryable transport and
  * admission failures, including cancellation on release and disposal.
- */
-
-// ---------------------------------------------------------------------------
-// BroadcastChannel mock
-// ---------------------------------------------------------------------------
-
-type MessageHandler = (event: { data: unknown }) => void
-const channels: Map<
-  string,
-  Set<{ onmessage: MessageHandler | null }>
-> = new Map()
-const durableTerms = new Map<string, number>()
-let dropNextMessageWhen: ((data: unknown) => boolean) | undefined
-let observePostedMessage: ((data: unknown) => void) | undefined
-let dropNextBroadcastMessage: ((data: unknown) => boolean) | undefined
-let duplicateNextBroadcastMessage:
-  ((data: unknown) => unknown | undefined) | undefined
-let observeBroadcastMessage: ((data: unknown) => void) | undefined
-
-class MockBroadcastChannel {
-  readonly name: string
-  onmessage: MessageHandler | null = null
-
-  constructor(name: string) {
-    this.name = name
-    if (!channels.has(name)) {
-      channels.set(name, new Set())
-    }
-    channels.get(name)!.add(this)
-  }
-
-  postMessage(data: unknown): void {
-    observePostedMessage?.(data)
-    if (dropNextMessageWhen?.(data)) {
-      dropNextMessageWhen = undefined
-      return
-    }
-    observeBroadcastMessage?.(data)
-    if (dropNextBroadcastMessage?.(data)) {
-      dropNextBroadcastMessage = undefined
-      return
-    }
-
-    const duplicate = duplicateNextBroadcastMessage?.(data)
-    if (duplicate !== undefined) {
-      duplicateNextBroadcastMessage = undefined
-    }
-    // BroadcastChannel performs serialization during postMessage, so clone
-    // failures are synchronous rather than deferred to delivery.
-    const deliveries = (
-      duplicate === undefined ? [data] : [data, duplicate]
-    ).map((delivery) => structuredClone(delivery))
-    const peers = channels.get(this.name)
-    if (!peers) return
-    // Deliver to all other instances on same channel (simulating cross-tab)
-    for (const peer of peers) {
-      if (peer !== this && peer.onmessage) {
-        // Use microtask to simulate async delivery
-        const handler = peer.onmessage
-        for (const delivery of deliveries) {
-          queueMicrotask(() => handler({ data: structuredClone(delivery) }))
-        }
-      }
-    }
-  }
-
-  close(): void {
-    channels.get(this.name)?.delete(this)
-  }
-}
-
-function injectBroadcastMessage(channelName: string, data: unknown): void {
-  for (const endpoint of channels.get(channelName) ?? []) {
-    const handler = endpoint.onmessage
-    if (handler) {
-      queueMicrotask(() => handler({ data: structuredClone(data) }))
-    }
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Web Locks mock
-// ---------------------------------------------------------------------------
-
-type LockGrantedCallback = (lock: { name: string }) => Promise<unknown>
-
-const heldLocks = new Map<string, { release: () => void }>()
-const lockQueues = new Map<
-  string,
-  Array<{
-    callback: LockGrantedCallback
-    signal?: AbortSignal
-    resolve: (v: unknown) => void
-    reject: (e: Error) => void
-  }>
->()
-
-function tryGrantNextLock(name: string): void {
-  if (heldLocks.has(name)) return
-  const queue = lockQueues.get(name)
-  if (!queue || queue.length === 0) return
-
-  const next = queue.shift()!
-  if (next.signal?.aborted) {
-    // Skip aborted entries and try next
-    tryGrantNextLock(name)
-    return
-  }
-
-  let releaseCallback!: () => void
-  void new Promise<void>((resolve) => {
-    releaseCallback = resolve
-  })
-
-  heldLocks.set(name, { release: releaseCallback })
-
-  const result = next.callback({ name })
-  // When the callback resolves/rejects, release the lock
-  Promise.resolve(result).then(
-    (value) => {
-      heldLocks.delete(name)
-      releaseCallback()
-      next.resolve(value)
-      tryGrantNextLock(name)
-    },
-    (error) => {
-      heldLocks.delete(name)
-      releaseCallback()
-      next.reject(error)
-      tryGrantNextLock(name)
-    },
-  )
-}
-
-const mockNavigatorLocks = {
-  request: (
-    name: string,
-    optionsOrCallback: { signal?: AbortSignal } | LockGrantedCallback,
-    maybeCallback?: LockGrantedCallback,
-  ): Promise<unknown> => {
-    const callback =
-      typeof optionsOrCallback === `function`
-        ? optionsOrCallback
-        : maybeCallback!
-    const signal =
-      typeof optionsOrCallback === `object`
-        ? optionsOrCallback.signal
-        : undefined
-
-    return new Promise((resolve, reject) => {
-      if (signal?.aborted) {
-        reject(new DOMException(`Lock request aborted`, `AbortError`))
-        return
-      }
-
-      const entry = { callback, signal, resolve, reject }
-      if (!lockQueues.has(name)) {
-        lockQueues.set(name, [])
-      }
-      lockQueues.get(name)!.push(entry)
-
-      if (signal) {
-        signal.addEventListener(`abort`, () => {
-          const queue = lockQueues.get(name)
-          if (queue) {
-            const idx = queue.indexOf(entry)
-            if (idx >= 0) {
-              queue.splice(idx, 1)
-              reject(new DOMException(`Lock request aborted`, `AbortError`))
-            }
-          }
-        })
-      }
-
-      tryGrantNextLock(name)
-    })
-  },
-}
-
-// ---------------------------------------------------------------------------
-// Setup / teardown
-// ---------------------------------------------------------------------------
-
-function installGlobals(): void {
-  ;(globalThis as Record<string, unknown>).BroadcastChannel =
-    MockBroadcastChannel as unknown
-  Object.defineProperty(globalThis, `navigator`, {
-    value: {
-      ...(((globalThis as Record<string, unknown>).navigator as
-        object | undefined) ?? {}),
-      locks: mockNavigatorLocks,
-    },
-    writable: true,
-    configurable: true,
-  })
-}
-
-function cleanupGlobals(): void {
-  dropNextMessageWhen = undefined
-  observePostedMessage = undefined
-  dropNextBroadcastMessage = undefined
-  duplicateNextBroadcastMessage = undefined
-  observeBroadcastMessage = undefined
-  channels.clear()
-  heldLocks.clear()
-  lockQueues.clear()
-  durableTerms.clear()
-}
-
-// ---------------------------------------------------------------------------
-// Adapter stub
-// ---------------------------------------------------------------------------
-
-function storageId(target: PersistedStorageTarget): string {
-  return target.kind === `managed`
-    ? target.storageCollectionId
-    : target.collectionId
-}
-
-function createStubAdapter(): PersistenceAdapter & {
-  pullSince: (
-    target: PersistedStorageTarget,
-    fromRowVersion: number,
-  ) => Promise<{
-    latestRowVersion: number
-    requiresFullReload: false
-    changedKeys: Array<string | number>
-    deletedKeys: Array<string | number>
-  }>
-  getStreamPosition: (target: PersistedStorageTarget) => Promise<{
-    latestTerm: number
-    latestSeq: number
-    latestRowVersion: number
-  }>
-  appliedTxs: Array<{ collectionId: string; tx: PersistedTx }>
-} {
-  const appliedTxs: Array<{ collectionId: string; tx: PersistedTx }> = []
-
-  return {
-    appliedTxs,
-    loadSubset: () => Promise.resolve([]),
-    loadResumeSnapshot: () =>
-      Promise.resolve({
-        rows: [],
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }),
-    applyCommittedTx: (target, tx) => {
-      appliedTxs.push({ collectionId: storageId(target), tx })
-      return Promise.resolve()
-    },
-    ensureIndex: () => Promise.resolve(),
-    pullSince: (_collectionId, _fromRowVersion) =>
-      Promise.resolve({
-        latestRowVersion: 0,
-        requiresFullReload: false as const,
-        changedKeys: [],
-        deletedKeys: [],
-      }),
-    getStreamPosition: () =>
-      Promise.resolve({
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-      }),
-    async reserveLeadershipTerm(target, observedTerm) {
-      const collectionId = storageId(target)
-      const position = await this.getStreamPosition(target)
-      const latestTerm =
-        Math.max(
-          position.latestTerm,
-          durableTerms.get(collectionId) ?? 0,
-          observedTerm,
-        ) + 1
-      durableTerms.set(collectionId, latestTerm)
-      return { ...position, latestTerm }
-    },
-  }
-}
-
-function createCoordinator(
-  adapter?: ReturnType<typeof createStubAdapter>,
-): BrowserCollectionCoordinator {
-  const opts: BrowserCollectionCoordinatorOptions = {
-    dbName: `test-db`,
-    adapter: adapter ?? createStubAdapter(),
-  }
-  const coordinator = new BrowserCollectionCoordinator(opts)
-  liveCoordinators.add(coordinator)
-  return coordinator
-}
-
-const liveCoordinators = new Set<BrowserCollectionCoordinator>()
-
-function subsetWithNestedValue(value: unknown): LoadSubsetOptions {
-  return {
-    where: new IR.Func(`in`, [
-      new IR.PropRef([`todos`, `status`]),
-      new IR.Value([`kept`, value]),
-    ]),
-  }
-}
-
-function withUnusedUnloadSubset<
-  T extends (options: TransportedLoadSubsetOptions) => Promise<void> | void,
->(owner: T): T & RemoteSubsetOwner {
-  // These fixtures exercise admission and delivery only. The required no-op
-  // release hook keeps that unrelated scope explicit without weakening the
-  // production coordinator contract.
-  return Object.assign(owner, {
-    unloadSubset: vi.fn(),
-    onError: vi.fn(),
-  })
-}
-
-class UnsupportedSubsetValue {
-  constructor(readonly label: string) {}
-}
-
-function withEnumerableExpando<T extends object>(value: T): T {
-  Object.defineProperty(value, `extra`, {
-    value: `would be lost`,
-    enumerable: true,
-  })
-  return value
-}
-
-function detachBufferWithView(
-  kind: `buffer` | `data-view` | `typed-array`,
-): ArrayBuffer | DataView | Uint8Array {
-  const buffer = new ArrayBuffer(4)
-  const value =
-    kind === `buffer`
-      ? buffer
-      : kind === `data-view`
-        ? new DataView(buffer)
-        : new Uint8Array(buffer)
-  structuredClone(buffer, { transfer: [buffer] })
-  return value
-}
-
-type ResizableArrayBufferConstructor = {
-  new (byteLength: number, options: { maxByteLength: number }): ArrayBuffer
-}
-
-type Float16ArrayConstructor = {
-  new (values: ArrayLike<number>): ArrayBufferView
-}
-
-function createResizableArrayBuffer(): ArrayBuffer | undefined {
-  try {
-    const buffer = new (ArrayBuffer as ResizableArrayBufferConstructor)(4, {
-      maxByteLength: 8,
-    })
-    return (buffer as ArrayBuffer & { readonly resizable?: boolean }).resizable
-      ? buffer
-      : undefined
-  } catch {
-    return undefined
-  }
-}
-
-const unsupportedValuePath = `options.where.args[1].value[1]`
-const resizableArrayBufferValueCases = createResizableArrayBuffer()
-  ? ([
-      [
-        `resizable ArrayBuffer`,
-        () => createResizableArrayBuffer()!,
-        unsupportedValuePath,
-      ],
-      [
-        `length-tracking DataView`,
-        () => new DataView(createResizableArrayBuffer()!),
-        unsupportedValuePath,
-      ],
-      [
-        `length-tracking typed array`,
-        () => new Uint8Array(createResizableArrayBuffer()!),
-        unsupportedValuePath,
-      ],
-    ] as const)
-  : ([] as const)
-const Float16ArrayValue = Reflect.get(globalThis, `Float16Array`) as
-  Float16ArrayConstructor | undefined
-const float16ArrayValueCases = Float16ArrayValue
-  ? ([
-      [
-        `Float16Array outside the exported typed-array union`,
-        () => new Float16ArrayValue([1, 2]),
-        unsupportedValuePath,
-      ],
-    ] as const)
-  : ([] as const)
-
-const unsupportedSubsetValueCases = [
-  [`function`, () => () => {}, unsupportedValuePath],
-  [`symbol`, () => Symbol(`unsupported`), unsupportedValuePath],
-  [`WeakMap`, () => new WeakMap(), unsupportedValuePath],
-  [`WeakSet`, () => new WeakSet(), unsupportedValuePath],
-  [`Promise`, () => Promise.resolve(`unsupported`), unsupportedValuePath],
-  [
-    `custom prototype`,
-    () => new UnsupportedSubsetValue(`unsupported`),
-    unsupportedValuePath,
-  ],
-  [
-    `custom prototype with a throwing constructor getter`,
-    () => {
-      const prototype = Object.create(null) as object
-      Object.defineProperty(prototype, `constructor`, {
-        get: () => {
-          throw new Error(`constructor getter must not be invoked`)
-        },
-      })
-      return Object.create(prototype) as object
-    },
-    unsupportedValuePath,
-  ],
-  [
-    `nonzero RegExp lastIndex`,
-    () => {
-      const regexp = /wire/g
-      regexp.lastIndex = 2
-      return regexp
-    },
-    `${unsupportedValuePath}.lastIndex`,
-  ],
-  [`SharedArrayBuffer`, () => new SharedArrayBuffer(4), unsupportedValuePath],
-  [
-    `function-valued Map key`,
-    () => new Map([[() => {}, `value`]]),
-    `${unsupportedValuePath}.entries[0].key`,
-  ],
-  [
-    `symbol-valued Map value`,
-    () => new Map([[`key`, Symbol(`unsupported`)]]),
-    `${unsupportedValuePath}.entries[0].value`,
-  ],
-  [
-    `function-valued Set entry`,
-    () => new Set([() => {}]),
-    `${unsupportedValuePath}.values[0]`,
-  ],
-  [
-    `detached view nested in a Map`,
-    () => new Map([[`key`, detachBufferWithView(`typed-array`)]]),
-    `${unsupportedValuePath}.entries[0].value`,
-  ],
-  [
-    `detached ArrayBuffer`,
-    () => detachBufferWithView(`buffer`),
-    unsupportedValuePath,
-  ],
-  [
-    `detached DataView`,
-    () => detachBufferWithView(`data-view`),
-    unsupportedValuePath,
-  ],
-  [
-    `detached typed array`,
-    () => detachBufferWithView(`typed-array`),
-    unsupportedValuePath,
-  ],
-  [
-    `symbol-keyed record`,
-    () => ({ [Symbol(`unsupported`)]: true }),
-    `${unsupportedValuePath}[Symbol(unsupported)]`,
-  ],
-  [
-    `accessor property`,
-    () =>
-      Object.defineProperty({}, `computed`, {
-        enumerable: true,
-        get: () => {
-          throw new Error(`accessor must not be invoked`)
-        },
-      }),
-    `${unsupportedValuePath}.computed`,
-  ],
-  [
-    `non-enumerable property`,
-    () => Object.defineProperty({}, `hidden`, { value: true }),
-    `${unsupportedValuePath}.hidden`,
-  ],
-  [
-    `Date expando`,
-    () => withEnumerableExpando(new Date(0)),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `RegExp expando`,
-    () => withEnumerableExpando(/wire/),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `Map expando`,
-    () => withEnumerableExpando(new Map()),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `Set expando`,
-    () => withEnumerableExpando(new Set()),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `ArrayBuffer expando`,
-    () => withEnumerableExpando(new ArrayBuffer(4)),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `DataView expando`,
-    () => withEnumerableExpando(new DataView(new ArrayBuffer(4))),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `typed array expando`,
-    () => withEnumerableExpando(new Uint8Array(4)),
-    `${unsupportedValuePath}.extra`,
-  ],
-  [
-    `array expando`,
-    () => withEnumerableExpando([]),
-    `${unsupportedValuePath}.extra`,
-  ],
-  ...resizableArrayBufferValueCases,
-  ...float16ArrayValueCases,
-] as const
-
-async function flush(ms: number = 10): Promise<void> {
-  await new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-type Deferred = {
-  promise: Promise<void>
-  resolve: () => void
-}
-
-function createDeferred(): Deferred {
-  let resolve!: () => void
-  const promise = new Promise<void>((settle) => {
-    resolve = settle
-  })
-  return { promise, resolve }
-}
-
-type CoordinatorInspection = {
-  collectionAdapters: Map<string, unknown>
-  collections: Map<string, unknown>
-  appliedEnvelopes: Map<string, unknown>
-}
-
-function inspectCoordinator(
-  coordinator: BrowserCollectionCoordinator,
-): CoordinatorInspection {
-  return coordinator as unknown as CoordinatorInspection
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe(`BrowserCollectionCoordinator`, () => {
-  beforeEach(() => {
-    installGlobals()
-  })
-
-  afterEach(async () => {
-    for (const coordinator of liveCoordinators) coordinator.dispose()
-    liveCoordinators.clear()
-    await flush(0)
-    cleanupGlobals()
-  })
-
-  describe(`leadership`, () => {
-    /** Without a durable term reservation, a cold successor can reuse its predecessor's term. */
-    it(`rejects an adapter that cannot reserve a durable election term`, () => {
-      const adapter = createStubAdapter()
-      adapter.reserveLeadershipTerm = undefined
-      expect(() => createCoordinator(adapter)).toThrow(/reserveLeadershipTerm/)
-    })
-
-    /**
-     * An election waits for queued work through the scheduler barrier. A
-     * regular scope without it is an adapter written for an older contract;
-     * failing at construction keeps the election from retrying forever.
-     */
-    it(`rejects an adapter whose regular scope has no queued-work barrier`, () => {
-      const adapter = createStubAdapter()
-      adapter.runInRegularScope = ((task) =>
-        task(adapter)) as PersistenceAdapter[`runInRegularScope`]
-      expect(() => createCoordinator(adapter)).toThrow(
-        /runInRegularScope\.afterQueuedWork/,
-      )
-    })
-
-    /**
-     * A physical cache generation and its claim are one election authority.
-     * The reference records the claim registered for each physical ID before
-     * election; a term reservation must receive that same pair. A reservation
-     * without the claim could advance a retired generation after expiry.
-     */
-    it(`reserves a physical cache term under its registered claim`, async () => {
-      const adapter = createStubAdapter()
-      const calls: Array<{
-        target: PersistedStorageTarget
-        claimId?: string
-      }> = []
-      const reserve = adapter.reserveLeadershipTerm!.bind(adapter)
-      adapter.reserveLeadershipTerm = (target, observedTerm, ctx) => {
-        calls.push({
-          target,
-          claimId: ctx?.cacheGenerationClaimId,
-        })
-        return reserve(target, observedTerm, ctx)
-      }
-      const coordinator = createCoordinator(adapter)
-      coordinator.setAdapterForCollection(
-        `physical-cache`,
-        adapter,
-        `claim-for-physical-cache`,
-      )
-      coordinator.subscribe(`physical-cache`, () => {})
-      await vi.waitFor(() =>
-        expect(coordinator.isLeader(`physical-cache`)).toBe(true),
-      )
-      expect(calls).toEqual([
-        {
-          target: {
-            kind: `managed`,
-            storageCollectionId: `physical-cache`,
-            claimId: `claim-for-physical-cache`,
-          },
-          claimId: `claim-for-physical-cache`,
-        },
-      ])
-    })
-
-    // A local mutation originates without a persisted tx. Its coordinator
-    // request must carry the Collection's claim across leader and follower
-    // routing before the coordinator creates that tx. Otherwise the adapter sees an eager
-    // write to a physical cache ID and can resurrect it after collection.
-    it(`keeps a managed claim on coordinator local mutations`, async () => {
-      const adapter = createStubAdapter()
-      const targets: Array<PersistedStorageTarget> = []
-      const apply = adapter.applyCommittedTx.bind(adapter)
-      adapter.applyCommittedTx = (target, tx) => {
-        targets.push(target)
-        return apply(target, tx)
-      }
-      const coordinator = createCoordinator(adapter)
-      const storageCollectionId = `local-mutation-cache`
-      const claimId = `claim-for-local-mutation-cache`
-      coordinator.setAdapterForCollection(storageCollectionId, adapter, claimId)
-      coordinator.subscribe(storageCollectionId, () => {})
-      await vi.waitFor(() =>
-        expect(coordinator.isLeader(storageCollectionId)).toBe(true),
-      )
-
-      const mutations = [
-        {
-          mutationId: `local-managed-write`,
-          type: `insert` as const,
-          key: `row`,
-          value: { id: `row` },
-        },
-      ]
-      const response = await coordinator.requestApplyLocalMutations(
-        storageCollectionId,
-        mutations,
-        claimId,
-      )
-      expect(response.ok).toBe(true)
-      expect(targets).toEqual([
-        { kind: `managed`, storageCollectionId, claimId },
-      ])
-      expect(adapter.appliedTxs[0]?.tx.cacheGenerationClaimId).toBe(claimId)
-
-      const follower = createCoordinator(adapter)
-      follower.setAdapterForCollection(storageCollectionId, adapter, claimId)
-      follower.subscribe(storageCollectionId, () => {})
-      await vi.waitFor(() =>
-        expect(follower.isLeader(storageCollectionId)).toBe(false),
-      )
-      const followerResponse = await follower.requestApplyLocalMutations(
-        storageCollectionId,
-        [{ ...mutations[0]!, mutationId: `follower-managed-write` }],
-        claimId,
-      )
-      expect(followerResponse.ok).toBe(true)
-      expect(targets).toEqual([
-        { kind: `managed`, storageCollectionId, claimId },
-        { kind: `managed`, storageCollectionId, claimId },
-      ])
-      expect(adapter.appliedTxs[1]?.tx.cacheGenerationClaimId).toBe(claimId)
-
-      await expect(
-        coordinator.requestApplyLocalMutations(storageCollectionId, mutations),
-      ).rejects.toThrow(`requires a persisted cache claim`)
-      expect(targets).toHaveLength(2)
-    })
-
-    it(`first coordinator becomes leader for a collection`, async () => {
-      const coord = createCoordinator()
-      coord.subscribe(`todos`, () => {})
-      await flush(50)
-
-      expect(coord.isLeader(`todos`)).toBe(true)
-      coord.dispose()
-    })
-
-    it.each([{ kind: `source commit` }, { kind: `local mutation` }] as const)(
-      `does not persist a queued $kind after leadership transfers`,
-      async ({ kind }) => {
-        const queued = createDeferred()
-        const releaseQueued = createDeferred()
-        const formerAdapter = createStubAdapter()
-        // Hold only the write queued after election. The election's empty
-        // read-queue barrier also enters the regular scope.
-        let holdRegularWork = false
-        formerAdapter.runInRegularScope = Object.assign(
-          async <T>(
-            task: (adapter: HydrationPersistenceAdapter) => Promise<T>,
-          ) => {
-            if (holdRegularWork) {
-              queued.resolve()
-              await releaseQueued.promise
-            }
-            return task(formerAdapter)
-          },
-          { afterQueuedWork: () => Promise.resolve() },
-        )
-        const newAdapter = createStubAdapter()
-        const formerLeader = createCoordinator(formerAdapter)
-        const newLeader = createCoordinator(newAdapter)
-        const unsubscribeFormer = formerLeader.subscribe(`todos`, () => {})
-        const unsubscribeNew = newLeader.subscribe(`todos`, () => {})
-        let write:
-          | Promise<ApplyCommittedTxResponse | ApplyLocalMutationsResponse>
-          | undefined
-        let committedMessagePosts = 0
-
-        try {
-          await vi.waitFor(() =>
-            expect(formerLeader.isLeader(`todos`)).toBe(true),
-          )
-          holdRegularWork = true
-          observeBroadcastMessage = (data) => {
-            if (
-              (data as { payload?: { type?: string } }).payload?.type ===
-              `tx:committed`
-            ) {
-              committedMessagePosts++
-            }
-          }
-          write =
-            kind === `source commit`
-              ? formerLeader.requestApplyCommittedTx(`todos`, {
-                  txId: `queued-source-commit`,
-                  term: 0,
-                  seq: 0,
-                  rowVersion: 0,
-                  mutations: [
-                    { type: `insert`, key: `queued`, value: { id: `queued` } },
-                  ],
-                })
-              : formerLeader.requestApplyLocalMutations(`todos`, [
-                  {
-                    mutationId: `queued-local-mutation`,
-                    type: `insert`,
-                    key: `queued`,
-                    value: { id: `queued` },
-                  },
-                ])
-          void write.catch(() => undefined)
-          await queued.promise
-          expect(formerAdapter.appliedTxs).toEqual([])
-
-          unsubscribeFormer()
-          await vi.waitFor(() => expect(newLeader.isLeader(`todos`)).toBe(true))
-          releaseQueued.resolve()
-
-          await expect(write).resolves.toMatchObject({
-            ok: false,
-            code: `NOT_LEADER`,
-          })
-          expect(formerAdapter.appliedTxs).toEqual([])
-          expect(newAdapter.appliedTxs).toEqual([])
-          expect(committedMessagePosts).toBe(0)
-        } finally {
-          releaseQueued.resolve()
-          await write?.catch(() => undefined)
-          observeBroadcastMessage = undefined
-          unsubscribeFormer()
-          unsubscribeNew()
-          formerLeader.dispose()
-          newLeader.dispose()
-        }
-      },
-    )
-
-    it(`paces leadership retry after stream-position failure`, async () => {
-      vi.useFakeTimers()
-      const streamError = new Error(`stream position unavailable`)
-      const adapter = createStubAdapter()
-      const getStreamPosition = vi
-        .fn()
-        .mockRejectedValueOnce(streamError)
-        .mockResolvedValue({
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-        })
-      adapter.getStreamPosition = getStreamPosition
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const coordinator = createCoordinator(adapter)
-
-      try {
-        coordinator.subscribe(`todos`, () => {})
-        await vi.advanceTimersByTimeAsync(0)
-
-        expect({
-          streamPositionReads: getStreamPosition.mock.calls.length,
-          isLeader: coordinator.isLeader(`todos`),
-          warnings: warning.mock.calls.length,
-        }).toEqual({
-          streamPositionReads: 1,
-          isLeader: false,
-          warnings: 1,
-        })
-
-        await vi.advanceTimersByTimeAsync(1_000)
-
-        expect({
-          streamPositionReads: getStreamPosition.mock.calls.length,
-          isLeader: coordinator.isLeader(`todos`),
-          warnings: warning.mock.calls.length,
-        }).toEqual({
-          streamPositionReads: 2,
-          isLeader: true,
-          warnings: 1,
-        })
-      } finally {
-        coordinator.dispose()
-        warning.mockRestore()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`cancels a delayed leadership retry on disposal`, async () => {
-      vi.useFakeTimers()
-      const adapter = createStubAdapter()
-      const getStreamPosition = vi
-        .fn()
-        .mockRejectedValueOnce(new Error(`stream position unavailable`))
-        .mockResolvedValue({
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-        })
-      adapter.getStreamPosition = getStreamPosition
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const coordinator = createCoordinator(adapter)
-
-      try {
-        coordinator.subscribe(`todos`, () => {})
-        await vi.advanceTimersByTimeAsync(0)
-        coordinator.dispose()
-        await vi.advanceTimersByTimeAsync(1_000)
-
-        expect({
-          streamPositionReads: getStreamPosition.mock.calls.length,
-          isLeader: coordinator.isLeader(`todos`),
-          warnings: warning.mock.calls.length,
-        }).toEqual({
-          streamPositionReads: 1,
-          isLeader: false,
-          warnings: 1,
-        })
-      } finally {
-        coordinator.dispose()
-        warning.mockRestore()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`second coordinator waits for leadership`, async () => {
-      const coord1 = createCoordinator()
-      coord1.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coord1.isLeader(`todos`)).toBe(true)
-
-      const coord2 = createCoordinator()
-      coord2.subscribe(`todos`, () => {})
-      await flush(50)
-      // coord2 should be follower while coord1 holds the lock
-      expect(coord2.isLeader(`todos`)).toBe(false)
-
-      coord1.dispose()
-      coord2.dispose()
-    })
-
-    it(`second coordinator takes over after first disposes`, async () => {
-      const coord1 = createCoordinator()
-      coord1.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coord1.isLeader(`todos`)).toBe(true)
-
-      const coord2 = createCoordinator()
-      coord2.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coord2.isLeader(`todos`)).toBe(false)
-
-      coord1.dispose()
-      await flush(50)
-
-      expect(coord2.isLeader(`todos`)).toBe(true)
-      coord2.dispose()
-    })
-
-    // The wrapper may issue best-effort release for a refresh that retired
-    // before acquisition. Without an acquisition ID, the coordinator must not
-    // send a release RPC to any leader.
-    it(`sends no release RPC for an unacquired subset`, async () => {
-      const follower = createCoordinator()
-      const internals = follower as unknown as {
-        sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
-      }
-      const sendRPC = vi.fn(() => Promise.reject(new Error(`unexpected RPC`)))
-      internals.sendRPC = sendRPC
-      try {
-        await follower.requestReleaseRemoteSubset(`todos`, { limit: 1 })
-        expect(sendRPC).not.toHaveBeenCalled()
-      } finally {
-        follower.dispose()
-      }
-    })
-
-    // A release can fail while the original acquisition is still in flight.
-    // Its later success must not cancel the retained release retry debt.
-    // The settled-acquisition neighbor checks that ordinary release retry
-    // remains possible without an overlapping acquisition.
-    it.each([false, true])(
-      `retains a release retry when acquisition overlaps release=%s`,
-      async (overlap) => {
-        const leader = createCoordinator()
-        const follower = createCoordinator()
-        const unsubscribeLeader = leader.subscribe(`todos`, () => {})
-        follower.subscribe(`todos`, () => {})
-        await flush(50)
-        const heldOwner = createDeferred()
-        const owner = Object.assign(
-          vi.fn(() => heldOwner.promise),
-          {
-            unloadSubset: vi.fn(),
-            onError: vi.fn(),
-          },
-        )
-        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-        const options: LoadSubsetOptions = { limit: 1 }
-        const internals = follower as unknown as {
-          sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
-          outboundRemoteSubsetAcquisitions: Map<
-            string,
-            { retryTimer: ReturnType<typeof setTimeout> | null }
-          >
-        }
-        const sendRPC = internals.sendRPC.bind(follower)
-        let releaseAttempts = 0
-        internals.sendRPC = (collectionId, request) => {
-          if (
-            (request as { type?: string }).type ===
-            `rpc:releaseRemoteSubset:req`
-          ) {
-            releaseAttempts++
-            if (releaseAttempts === 1) {
-              return Promise.reject(
-                new Error(`review release transport failure`),
-              )
-            }
-          }
-          return sendRPC(collectionId, request)
-        }
-        const ensure = follower.requestEnsureRemoteSubset(`todos`, options)
-        try {
-          await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
-          if (!overlap) {
-            heldOwner.resolve()
-            await ensure
-          }
-          await expect(
-            follower.requestReleaseRemoteSubset(`todos`, options),
-          ).rejects.toThrow(`review release transport failure`)
-          const acquisition = [
-            ...internals.outboundRemoteSubsetAcquisitions.values(),
-          ][0]!
-          expect(acquisition.retryTimer).not.toBeNull()
-          if (overlap) heldOwner.resolve()
-          await ensure
-          expect(acquisition.retryTimer).not.toBeNull()
-          await vi.waitFor(() => expect(releaseAttempts).toBe(2))
-        } finally {
-          heldOwner.resolve()
-          await Promise.allSettled([ensure])
-          unregisterOwner()
-          unsubscribeLeader()
-          leader.dispose()
-          follower.dispose()
-        }
-      },
-    )
-
-    it.each([
-      { schemaV1: 1, schemaV2: 2 },
-      { schemaV1: 2, schemaV2: 4 },
-    ])(
-      `routes each collection through its schema-version adapter: $schemaV1/$schemaV2`,
-      async ({ schemaV1, schemaV2 }) => {
-        const database = createWASQLiteTestDatabase({ filename: `:memory:` })
-        const coordinator = new BrowserCollectionCoordinator({
-          dbName: `schema-routed-db`,
-        })
-        const persistence = createBrowserWASQLitePersistence({
-          database,
-          coordinator,
-        })
-        const collectionV1 = `schema-routed-v1`
-        const collectionV2 = `schema-routed-v2`
-
-        try {
-          const optionsV1 = persistedCollectionOptions<
-            { id: string; title: string },
-            string
-          >({
-            id: collectionV1,
-            schemaVersion: schemaV1,
-            getKey: (row) => row.id,
-            persistence,
-          })
-          await optionsV1.persistence.adapter.loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionV1,
-          })
-
-          const optionsV2 = persistedCollectionOptions<
-            { id: string; title: string },
-            string
-          >({
-            id: collectionV2,
-            schemaVersion: schemaV2,
-            getKey: (row) => row.id,
-            persistence,
-          })
-          await optionsV2.persistence.adapter.loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionV2,
-          })
-
-          coordinator.subscribe(collectionV1, () => {})
-          coordinator.subscribe(collectionV2, () => {})
-          await vi.waitFor(() => {
-            expect(coordinator.isLeader(collectionV1)).toBe(true)
-            expect(coordinator.isLeader(collectionV2)).toBe(true)
-          })
-
-          const [resultV1, resultV2] = await Promise.all([
-            coordinator.requestApplyLocalMutations(collectionV1, [
-              {
-                mutationId: `mutation-v1`,
-                type: `insert`,
-                key: `v1`,
-                value: { id: `v1`, title: `schema one` },
-              },
-            ]),
-            coordinator.requestApplyLocalMutations(collectionV2, [
-              {
-                mutationId: `mutation-v2`,
-                type: `insert`,
-                key: `v2`,
-                value: { id: `v2`, title: `schema two` },
-              },
-            ]),
-          ])
-
-          expect(resultV1.ok).toBe(true)
-          expect(resultV2.ok).toBe(true)
-          expect(
-            await optionsV1.persistence.adapter.loadSubset(
-              { kind: `eager`, collectionId: collectionV1 },
-              {},
-            ),
-          ).toMatchObject([
-            { key: `v1`, value: { id: `v1`, title: `schema one` } },
-          ])
-          expect(
-            await optionsV2.persistence.adapter.loadSubset(
-              { kind: `eager`, collectionId: collectionV2 },
-              {},
-            ),
-          ).toMatchObject([
-            { key: `v2`, value: { id: `v2`, title: `schema two` } },
-          ])
-        } finally {
-          coordinator.dispose()
-          await Promise.resolve(database.close?.())
-        }
-      },
-    )
-
-    it(`different collections have independent leaders`, async () => {
-      const coord1 = createCoordinator()
-      const coord2 = createCoordinator()
-
-      coord1.subscribe(`todos`, () => {})
-      coord2.subscribe(`notes`, () => {})
-      await flush(50)
-
-      expect(coord1.isLeader(`todos`)).toBe(true)
-      expect(coord2.isLeader(`notes`)).toBe(true)
-
-      coord1.dispose()
-      coord2.dispose()
-    })
-
-    it(`records an unrelated heartbeat without joining that collection's leadership`, async () => {
-      const adapter = createStubAdapter()
-      const getStreamPosition = vi.spyOn(adapter, `getStreamPosition`)
-      const coordinator = createCoordinator(adapter)
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-
-      injectBroadcastMessage(`tsdb:coord:test-db`, {
-        v: 1,
-        dbName: `test-db`,
-        collectionId: `notes`,
-        senderId: `notes-owner`,
-        ts: Date.now(),
-        payload: {
-          type: `leader:heartbeat`,
-          term: 4,
-          leaderId: `notes-owner`,
-          latestSeq: 3,
-          latestRowVersion: 8,
-        },
-      })
-      await flush(0)
-
-      const state = (
-        coordinator as unknown as {
-          collections: Map<
-            string,
-            { leaderId: string | null; latestTerm: number }
-          >
-        }
-      ).collections.get(`notes`)
-      expect({
-        leaderId: state?.leaderId,
-        latestTerm: state?.latestTerm,
-        joinedLeadership: coordinator.isLeader(`notes`),
-        streamPositionCollections: getStreamPosition.mock.calls.map(
-          ([target]) => storageId(target),
-        ),
-      }).toEqual({
-        leaderId: `notes-owner`,
-        latestTerm: 4,
-        joinedLeadership: false,
-        streamPositionCollections: [`todos`],
-      })
-    })
-
-    it(`returns unique node ids`, () => {
-      const coord1 = createCoordinator()
-      const coord2 = createCoordinator()
-
-      expect(coord1.getNodeId()).not.toBe(coord2.getNodeId())
-
-      coord1.dispose()
-      coord2.dispose()
-    })
-  })
-
-  /**
-   * # When may an election wait behind queued reads?
-   *
-   * Law: a Web Lock holder reserves its durable election term only after the
-   * reads already queued on its shared scheduler, unless some caller needs a
-   * leader first. A leadership need ends that wait at once: a local route
-   * wait, an outbound RPC, `ensureLeadership`, or an inbound route request or
-   * RPC from another tab. Without that rule, a hydrate that waits for its
-   * first writer route would wait for an election that waits for the hydrate.
-   * A need belongs to one election: it is still waiting at the grant, or it
-   * arrives before the term. A need that an earlier leader served, for this
-   * tab or another, does not exempt a later election. The lock is exclusive,
-   * so its holder has no route to another leader: a delayed heartbeat from
-   * the departed leader does not restore one, and a request made during the
-   * election is a need.
-   *
-   * Model: the reference is the need table below. Every listed request is a
-   * leadership need, so the term must exist while the queued read is still
-   * held. The read is a deferred hydrate: the scheduler barrier
-   * (`runInRegularScope.afterQueuedWork`) and all regular work wait for it,
-   * so it also holds the leader-side write for mutating requests. After
-   * the read is released, each request settles well before the RPC timeout.
-   * A remote request posts one RPC of its kind. Remote subset demand may also
-   * replay once when its first leader becomes known; every post carries the
-   * same acquisition ID, and the lease oracle owns exact lease accounting.
-   *
-   * Grammar: each request kind × a local requester (the lock holder itself)
-   * or a remote requester (a later tab whose lock request is queued). Remote
-   * `ensureLeadership` is excluded: the holder keeps the lock, so the remote
-   * caller has no route to its own leadership. Release of an unacquired
-   * subset sends no RPC and is not a leadership need.
-   *
-   * Checkpoints: before the request (premise: no term while the read is
-   * held), after bounded turns with the read still held (term and route), and
-   * after release (settlement and RPC count). Hostile mutants that skip any
-   * need mark fail the held-read checkpoint or the settlement deadline.
-   *
-   * Per-election cells: a follower takes over from a leader that served an
-   * earlier need, from another tab or from the follower itself, while the
-   * follower's queued read is held. The model has no term until the read is
-   * released. A third cell delivers the departed leader's heartbeat during
-   * the follower's election and then makes a request; the model has the
-   * follower's term while the read is still held.
-   */
-  describe(`leadership need under a queued read`, () => {
-    const collectionId = `needed`
-    const transaction = (txId: string): PersistedTx => ({
-      txId,
-      term: 0,
-      seq: 0,
-      rowVersion: 0,
-      mutations: [{ type: `insert`, key: txId, value: { id: txId } }],
-    })
-    const leadershipNeeds = {
-      'local mutation': {
-        request: `rpc:applyLocalMutations:req`,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.requestApplyLocalMutations(collectionId, [
-            {
-              mutationId: `needed-mutation`,
-              type: `insert`,
-              key: `needed-mutation`,
-              value: { id: `needed-mutation` },
-            },
-          ]),
-      },
-      'source commit': {
-        request: `rpc:applyCommittedTx:req`,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.requestApplyCommittedTx(
-            collectionId,
-            transaction(`needed-commit`),
-          ),
-      },
-      reconciliation: {
-        request: `rpc:reconcileCommittedTx:req`,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.reconcileCommittedTx(
-            collectionId,
-            transaction(`needed-reconcile`),
-            { latestRowVersion: 0, resetEpoch: 0 },
-          ),
-      },
-      'remote subset': {
-        request: `rpc:ensureRemoteSubset:req`,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.requestEnsureRemoteSubset(collectionId, { limit: 1 }),
-      },
-      pullSince: {
-        request: `rpc:pullSince:req`,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.pullSince(collectionId, 0),
-      },
-      'persisted index': {
-        request: `rpc:ensurePersistedIndex:req`,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.requestEnsurePersistedIndex(collectionId, `needed-idx`, {
-            expressionSql: [`id`],
-          }),
-      },
-      ensureLeadership: {
-        request: undefined,
-        run: (coordinator: BrowserCollectionCoordinator) =>
-          coordinator.ensureLeadership(collectionId),
-      },
-    } as const
-    const cells = Object.keys(leadershipNeeds).flatMap((kind) =>
-      (kind === `ensureLeadership`
-        ? ([`local`] as const)
-        : ([`local`, `remote`] as const)
-      ).map((requester) => ({
-        kind: kind as keyof typeof leadershipNeeds,
-        requester,
-      })),
-    )
-
-    function createQueuedReadAdapter() {
-      const adapter = createStubAdapter()
-      const queuedRead = createDeferred()
-      // The queued read holds regular work and every barrier behind it.
-      adapter.runInRegularScope = Object.assign(
-        async <T>(
-          task: (adapter: HydrationPersistenceAdapter) => Promise<T>,
-        ) => {
-          await queuedRead.promise
-          return task(adapter)
-        },
-        { afterQueuedWork: () => queuedRead.promise },
-      )
-      adapter.reconcileCommittedTx = (target, tx) => {
-        adapter.appliedTxs.push({ collectionId: storageId(target), tx })
-        return Promise.resolve({
-          kind: `applied-now` as const,
-          committed: { term: tx.term, seq: tx.seq, rowVersion: tx.rowVersion },
-          latestRowVersion: tx.rowVersion,
-        })
-      }
-      return { adapter, queuedRead }
-    }
-
-    it.each(cells)(
-      `elects for a $requester $kind while a queued read holds the scheduler`,
-      async ({ kind, requester }) => {
-        const need = leadershipNeeds[kind]
-        const { adapter, queuedRead } = createQueuedReadAdapter()
-        const holder = createCoordinator(adapter)
-        holder.registerRemoteSubsetOwner(
-          collectionId,
-          withUnusedUnloadSubset(async () => {}),
-        )
-        holder.subscribe(collectionId, () => {})
-        await flush(20)
-        const caller =
-          requester === `local` ? holder : createCoordinator(adapter)
-        if (caller !== holder) caller.subscribe(collectionId, () => {})
-        await flush(20)
-        // Premise: the holder has the Web Lock, but its term waits behind
-        // the queued read because no caller has needed a leader yet.
-        expect(durableTerms.get(collectionId)).toBeUndefined()
-        expect(holder.isLeader(collectionId)).toBe(false)
-
-        const posts: Array<{ acquisitionId?: string }> = []
-        observePostedMessage = (data) => {
-          const payload = (
-            data as { payload?: { type?: string; acquisitionId?: string } }
-          ).payload
-          if (need.request !== undefined && payload?.type === need.request) {
-            posts.push({ acquisitionId: payload.acquisitionId })
-          }
-        }
-        let settled = false
-        const pending = Promise.resolve(need.run(caller)).finally(() => {
-          settled = true
-        })
-        void pending.catch(() => undefined)
-        try {
-          await flush(50)
-          // The need ended the wait before the read finished.
-          expect(durableTerms.get(collectionId)).toBe(1)
-          expect(holder.isLeader(collectionId)).toBe(true)
-          expect(caller.isLeader(collectionId)).toBe(caller === holder)
-
-          queuedRead.resolve()
-          await Promise.race([pending, flush(1_000)])
-          expect(settled).toBe(true)
-          await pending
-          if (need.request === undefined || caller === holder) {
-            expect(posts).toEqual([])
-          } else if (kind === `remote subset`) {
-            expect(posts.length).toBeGreaterThan(0)
-            expect(new Set(posts.map((post) => post.acquisitionId)).size).toBe(
-              1,
-            )
-          } else {
-            expect(posts).toHaveLength(1)
-          }
-        } finally {
-          queuedRead.resolve()
-          observePostedMessage = undefined
-          // A request stuck on an RPC timeout must not hide the assertion;
-          // disposal in afterEach rejects it.
-          await Promise.race([pending.catch(() => undefined), flush(0)])
-        }
-      },
-    )
-
-    it(`reserves the term after the queued read when no caller needs a leader`, async () => {
-      const { adapter, queuedRead } = createQueuedReadAdapter()
-      const holder = createCoordinator(adapter)
-      holder.subscribe(collectionId, () => {})
-      await flush(50)
-      expect(durableTerms.get(collectionId)).toBeUndefined()
-      expect(holder.isLeader(collectionId)).toBe(false)
-
-      queuedRead.resolve()
-      await flush(20)
-      expect(durableTerms.get(collectionId)).toBe(1)
-      expect(holder.isLeader(collectionId)).toBe(true)
-    })
-
-    /**
-     * Starts a leader, then a follower whose queued read is held, and lets
-     * `serve` make requests that the leader answers.
-     */
-    async function followerOfServedLeader(
-      serve: (follower: BrowserCollectionCoordinator) => Promise<unknown>,
-    ) {
-      const leader = createCoordinator()
-      leader.subscribe(collectionId, () => {})
-      await flush(20)
-      const { adapter, queuedRead } = createQueuedReadAdapter()
-      const follower = createCoordinator(adapter)
-      follower.subscribe(collectionId, () => {})
-      await flush(20)
-      await serve(follower)
-      expect(durableTerms.get(collectionId)).toBe(1)
-      return { leader, follower, queuedRead }
-    }
-
-    it.each([
-      {
-        served: `another tab's request`,
-        serve: async () => {
-          const other = createCoordinator()
-          other.subscribe(collectionId, () => {})
-          await other.pullSince(collectionId, 0)
-          other.dispose()
-        },
-      },
-      {
-        served: `the follower's own request`,
-        serve: (follower: BrowserCollectionCoordinator) =>
-          follower.pullSince(collectionId, 0),
-      },
-    ])(
-      `keeps a takeover term behind its queued read after $served was served`,
-      async ({ serve }) => {
-        const { leader, follower, queuedRead } =
-          await followerOfServedLeader(serve)
-        leader.dispose()
-        await flush(50)
-        expect(durableTerms.get(collectionId)).toBe(1)
-        expect(follower.isLeader(collectionId)).toBe(false)
-
-        queuedRead.resolve()
-        await flush(20)
-        expect(durableTerms.get(collectionId)).toBe(2)
-        expect(follower.isLeader(collectionId)).toBe(true)
-      },
-    )
-
-    it(`treats a request during a takeover as a need despite a delayed former heartbeat`, async () => {
-      const { leader, follower, queuedRead } = await followerOfServedLeader(
-        (follower) => follower.pullSince(collectionId, 0),
-      )
-      const formerId = leader.getNodeId()
-      leader.dispose()
-      await flush(50)
-      // The departed leader's last heartbeat arrives during the election.
-      injectBroadcastMessage(`tsdb:coord:test-db`, {
-        v: 1,
-        dbName: `test-db`,
-        collectionId,
-        senderId: formerId,
-        ts: Date.now(),
-        payload: {
-          type: `leader:heartbeat`,
-          term: 1,
-          leaderId: formerId,
-          latestSeq: 0,
-          latestRowVersion: 0,
-        },
-      })
-      await flush(0)
-      expect(durableTerms.get(collectionId)).toBe(1)
-
-      let settled = false
-      const pulled = follower.pullSince(collectionId, 0).finally(() => {
-        settled = true
-      })
-      void pulled.catch(() => undefined)
-      try {
-        await flush(50)
-        expect(durableTerms.get(collectionId)).toBe(2)
-        expect(follower.isLeader(collectionId)).toBe(true)
-        queuedRead.resolve()
-        await Promise.race([pulled, flush(1_000)])
-        expect(settled).toBe(true)
-        await expect(pulled).resolves.toMatchObject({ ok: true })
-      } finally {
-        queuedRead.resolve()
-        await Promise.race([pulled.catch(() => undefined), flush(0)])
-      }
-    })
-  })
-
-  /**
-   * # What does `ensureLeadership` promise?
-   *
-   * Law: `PersistedCollectionCoordinator.ensureLeadership` resolves when this
-   * node becomes the collection's leader, whether it already leads or its
-   * queued Web Lock is granted later. Joining keeps an existing lock request
-   * and its queue position. Disposal rejects the wait, as it rejects other
-   * route waits and pending RPCs. The model is the FIFO Web Lock queue: tabs
-   * that subscribed earlier are granted earlier. Checkpoints are the call's
-   * settlement and each tab's `isLeader` after the current leader disposes.
-   */
-  describe(`ensureLeadership`, () => {
-    it(`resolves at once for the current leader`, async () => {
-      const leader = createCoordinator()
-      leader.subscribe(`todos`, () => {})
-      await flush(20)
-      expect(leader.isLeader(`todos`)).toBe(true)
-      await expect(leader.ensureLeadership(`todos`)).resolves.toBeUndefined()
-    })
-
-    it(`resolves when a queued lock is granted later, keeping its queue position`, async () => {
-      const first = createCoordinator()
-      const second = createCoordinator()
-      const third = createCoordinator()
-      first.subscribe(`todos`, () => {})
-      await flush(20)
-      second.subscribe(`todos`, () => {})
-      third.subscribe(`todos`, () => {})
-      await flush(20)
-      expect(first.isLeader(`todos`)).toBe(true)
-
-      let settled = false
-      const ensured = second.ensureLeadership(`todos`).finally(() => {
-        settled = true
-      })
-      void ensured.catch(() => undefined)
-      await flush(20)
-      expect(settled).toBe(false)
-
-      first.dispose()
-      await flush(50)
-      expect(second.isLeader(`todos`)).toBe(true)
-      expect(third.isLeader(`todos`)).toBe(false)
-      expect(settled).toBe(true)
-      await expect(ensured).resolves.toBeUndefined()
-    })
-
-    // A request that first waits for a route keeps the retry budget it had
-    // without that wait. A lock holder that never announces a route stands in
-    // for a slow election: once it lets go, this tab leads and the request is
-    // still within its retries.
-    it(`keeps an RPC's retry budget when the first route wait times out`, async () => {
-      const lockName = `tsdb:leader:test-db:todos`
-      let releaseHolder!: () => void
-      const holding = new Promise<void>((acquired) => {
-        void navigator.locks.request(lockName, () => {
-          acquired()
-          return new Promise<void>((resolve) => {
-            releaseHolder = resolve
-          })
-        })
-      })
-      await holding
-      const follower = createCoordinator()
-      follower.subscribe(`todos`, () => {})
-      await flush(20)
-      expect(follower.isLeader(`todos`)).toBe(false)
-
-      const pulled = follower.pullSince(`todos`, 0)
-      void pulled.catch(() => undefined)
-      // Past the route wait's 10 s bound, then the holder lets go.
-      await new Promise((resolve) => setTimeout(resolve, 10_500))
-      releaseHolder()
-      await expect(pulled).resolves.toMatchObject({ ok: true })
-      expect(follower.isLeader(`todos`)).toBe(true)
-    }, 40_000)
-
-    it(`rejects a pending wait when its coordinator is disposed`, async () => {
-      const leader = createCoordinator()
-      const waiting = createCoordinator()
-      leader.subscribe(`todos`, () => {})
-      await flush(20)
-      waiting.subscribe(`todos`, () => {})
-      await flush(20)
-
-      const ensured = waiting.ensureLeadership(`todos`)
-      void ensured.catch(() => undefined)
-      waiting.dispose()
-      await expect(ensured).rejects.toThrow(/leadership route closed/)
-      expect(leader.isLeader(`todos`)).toBe(true)
-    })
-  })
-
-  describe(`message transport`, () => {
-    it(`delivers published messages to remote subscribers`, async () => {
-      const coord1 = createCoordinator()
-      const coord2 = createCoordinator()
-
-      const received: Array<unknown> = []
-      coord2.subscribe(`todos`, (msg) => {
-        received.push(msg.payload)
-      })
-
-      coord1.subscribe(`todos`, () => {})
-      await flush(50)
-
-      coord1.publish(`todos`, {
-        v: 1,
-        dbName: `test-db`,
-        collectionId: `todos`,
-        senderId: coord1.getNodeId(),
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `tx-1`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        },
-      })
-
-      await flush()
-
-      expect(received.length).toBe(1)
-      expect((received[0] as Record<string, unknown>).type).toBe(`tx:committed`)
-
-      coord1.dispose()
-      coord2.dispose()
-    })
-
-    it(`does not deliver own messages to self via subscriber`, async () => {
-      const coord = createCoordinator()
-      const received: Array<unknown> = []
-      coord.subscribe(`todos`, (msg) => {
-        received.push(msg)
-      })
-      await flush(50)
-
-      coord.publish(`todos`, {
-        v: 1,
-        dbName: `test-db`,
-        collectionId: `todos`,
-        senderId: coord.getNodeId(),
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `tx-1`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        },
-      })
-
-      await flush()
-
-      expect(received.length).toBe(0)
-      coord.dispose()
-    })
-
-    it(`ignores unsupported Browser RPC request types without answering`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.isLeader = () => true
-      const postMessage = vi.fn()
-      const internals = coordinator as unknown as {
-        onChannelMessage: (message: unknown) => void
-        channel: { postMessage: (message: unknown) => void }
-      }
-      internals.channel.postMessage = postMessage
-
-      internals.onChannelMessage({
-        v: 1,
-        dbName: `test-db`,
-        collectionId: `todos`,
-        senderId: `future-browser-peer`,
-        ts: Date.now(),
-        payload: {
-          type: `rpc:futureProtocol:req`,
-          rpcId: `future-browser-rpc`,
-        },
-      })
-      await flush(0)
-
-      expect(postMessage).not.toHaveBeenCalled()
-      coordinator.dispose()
-    })
-  })
-
-  describe(`RPC - applyLocalMutations`, () => {
-    it.each([{ kind: `source commit` }, { kind: `local mutation` }] as const)(
-      `waits for initial leadership before routing a $kind`,
-      async ({ kind }) => {
-        const adapter = createStubAdapter()
-        const readStarted = createDeferred()
-        const releaseRead = createDeferred()
-        adapter.getStreamPosition = async () => {
-          readStarted.resolve()
-          await releaseRead.promise
-          return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-        }
-        const coordinator = createCoordinator(adapter)
-        const mutationPosts: Array<string> = []
-        observePostedMessage = (data) => {
-          const type = (data as { payload?: { type?: string } }).payload?.type
-          if (
-            type === `rpc:applyCommittedTx:req` ||
-            type === `rpc:applyLocalMutations:req`
-          ) {
-            mutationPosts.push(type)
-          }
-        }
-
-        coordinator.subscribe(`todos`, () => {})
-        await readStarted.promise
-        const request =
-          kind === `source commit`
-            ? coordinator.requestApplyCommittedTx(`todos`, {
-                txId: `first-source-commit`,
-                term: 0,
-                seq: 0,
-                rowVersion: 0,
-                mutations: [
-                  {
-                    type: `insert`,
-                    key: `first`,
-                    value: { id: `first` },
-                  },
-                ],
-              })
-            : coordinator.requestApplyLocalMutations(`todos`, [
-                {
-                  mutationId: `first-local-mutation`,
-                  type: `insert`,
-                  key: `first`,
-                  value: { id: `first` },
-                },
-              ])
-        void request.catch(() => undefined)
-
-        try {
-          // The single participating tab has not yet read its durable stream
-          // position. No owner is known, so no mutation may enter transport.
-          expect(coordinator.isLeader(`todos`)).toBe(false)
-          expect(mutationPosts).toEqual([])
-
-          releaseRead.resolve()
-          await expect(request).resolves.toMatchObject({ ok: true })
-          expect(mutationPosts).toEqual([])
-          expect(adapter.appliedTxs).toHaveLength(1)
-          expect(adapter.appliedTxs[0]?.collectionId).toBe(`todos`)
-        } finally {
-          releaseRead.resolve()
-          coordinator.dispose()
-          await request.catch(() => undefined)
-          observePostedMessage = undefined
-        }
-      },
-    )
-
-    it.each([{ kind: `source commit` }, { kind: `local mutation` }] as const)(
-      `discovers a late follower route before the next heartbeat for a $kind`,
-      async ({ kind }) => {
-        vi.useFakeTimers()
-        const leaderAdapter = createStubAdapter()
-        const leader = createCoordinator(leaderAdapter)
-        let follower: BrowserCollectionCoordinator | undefined
-        let observed: Promise<void> | undefined
-        let settled = false
-        let response:
-          ApplyCommittedTxResponse | ApplyLocalMutationsResponse | undefined
-        let failure: unknown
-        const posted: Array<string> = []
-
-        try {
-          leader.subscribe(`todos`, () => {})
-          await vi.advanceTimersByTimeAsync(0)
-          expect(leader.isLeader(`todos`)).toBe(true)
-
-          // The follower joins after the initial heartbeat. Stop periodic
-          // heartbeats so only an explicit route reply can settle its write.
-          const leaderState = inspectCoordinator(leader).collections.get(
-            `todos`,
-          ) as { heartbeatTimer: ReturnType<typeof setInterval> | null }
-          if (leaderState.heartbeatTimer !== null) {
-            clearInterval(leaderState.heartbeatTimer)
-            leaderState.heartbeatTimer = null
-          }
-          observePostedMessage = (data) => {
-            const envelope = data as {
-              collectionId?: string
-              payload?: { type?: string }
-            }
-            const type = envelope.payload?.type
-            if (
-              envelope.collectionId === `todos` &&
-              (type === `leader:routeRequest` ||
-                type === `leader:heartbeat` ||
-                type === `rpc:applyCommittedTx:req` ||
-                type === `rpc:applyLocalMutations:req`)
-            ) {
-              posted.push(type)
-            }
-          }
-
-          follower = createCoordinator()
-          follower.subscribe(`todos`, () => {})
-          expect(follower.isLeader(`todos`)).toBe(false)
-
-          const write =
-            kind === `source commit`
-              ? follower.requestApplyCommittedTx(`todos`, {
-                  txId: `late-follower-source`,
-                  term: 0,
-                  seq: 0,
-                  rowVersion: 0,
-                  mutations: [
-                    { type: `insert`, key: `first`, value: { id: `first` } },
-                  ],
-                })
-              : follower.requestApplyLocalMutations(`todos`, [
-                  {
-                    mutationId: `late-follower-local`,
-                    type: `insert`,
-                    key: `first`,
-                    value: { id: `first` },
-                  },
-                ])
-          observed = write.then(
-            (result) => {
-              settled = true
-              response = result
-            },
-            (error: unknown) => {
-              settled = true
-              failure = error
-            },
-          )
-          await vi.advanceTimersByTimeAsync(0)
-
-          expect({
-            settled,
-            failure,
-            responseOk: response?.ok,
-            posted,
-          }).toEqual({
-            settled: true,
-            failure: undefined,
-            responseOk: true,
-            posted: [
-              `leader:routeRequest`,
-              `leader:heartbeat`,
-              kind === `source commit`
-                ? `rpc:applyCommittedTx:req`
-                : `rpc:applyLocalMutations:req`,
-            ],
-          })
-          expect(leaderAdapter.appliedTxs).toHaveLength(1)
-        } finally {
-          observePostedMessage = undefined
-          follower?.dispose()
-          leader.dispose()
-          await vi.advanceTimersByTimeAsync(0)
-          await observed
-          vi.useRealTimers()
-        }
-      },
-    )
-
-    it(`rejects a first source commit when election cannot establish a route`, async () => {
-      vi.useFakeTimers()
-      const adapter = createStubAdapter()
-      const readPosition = vi
-        .fn()
-        .mockRejectedValue(new Error(`stream position unavailable`))
-      adapter.getStreamPosition = readPosition
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const coordinator = createCoordinator(adapter)
-      coordinator.subscribe(`todos`, () => {})
-      const request = coordinator.requestApplyCommittedTx(`todos`, {
-        txId: `first-source-commit`,
-        term: 0,
-        seq: 0,
-        rowVersion: 0,
-        mutations: [],
-      })
-      let settled = false
-      const outcome = request.then(
-        () => {
-          settled = true
-          return undefined
-        },
-        (error: unknown) => {
-          settled = true
-          return error
-        },
-      )
-
-      try {
-        await vi.advanceTimersByTimeAsync(10_001)
-        expect(readPosition.mock.calls.length).toBeGreaterThan(1)
-        expect(settled).toBe(true)
-        expect(await outcome).toMatchObject({
-          message: expect.stringContaining(`leadership route`),
-        })
-        expect(adapter.appliedTxs).toEqual([])
-      } finally {
-        coordinator.dispose()
-        await outcome
-        warning.mockRestore()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`leader applies mutations and returns accepted ids`, async () => {
-      const adapter = createStubAdapter()
-      const coord = createCoordinator(adapter)
-
-      coord.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coord.isLeader(`todos`)).toBe(true)
-
-      const response = await coord.requestApplyLocalMutations(`todos`, [
-        {
-          mutationId: `mut-1`,
-          type: `insert`,
-          key: `1`,
-          value: { id: `1`, title: `Test` },
-        },
-      ])
-
-      expect(response.ok).toBe(true)
-      if (response.ok) {
-        expect(response.acceptedMutationIds).toEqual([`mut-1`])
-        expect(response.term).toBeGreaterThan(0)
-        expect(response.seq).toBeGreaterThan(0)
-      }
-      expect(adapter.appliedTxs.length).toBe(1)
-
-      coord.dispose()
-    })
-
-    it(`follower routes mutations to leader via RPC`, async () => {
-      const adapter = createStubAdapter()
-      const leader = createCoordinator(adapter)
-      const follower = createCoordinator(adapter)
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      expect(leader.isLeader(`todos`)).toBe(true)
-      expect(follower.isLeader(`todos`)).toBe(false)
-
-      const response = await follower.requestApplyLocalMutations(`todos`, [
-        {
-          mutationId: `mut-2`,
-          type: `insert`,
-          key: `2`,
-          value: { id: `2`, title: `Follower mutation` },
-        },
-      ])
-
-      expect(response.ok).toBe(true)
-      if (response.ok) {
-        expect(response.acceptedMutationIds).toEqual([`mut-2`])
-      }
-      expect(adapter.appliedTxs.length).toBe(1)
-
-      leader.dispose()
-      follower.dispose()
-    })
-
-    it(`deduplicates envelope ids`, async () => {
-      const adapter = createStubAdapter()
-      const coord = createCoordinator(adapter)
-      coord.subscribe(`todos`, () => {})
-      await flush(50)
-
-      // First call
-      const res1 = await coord.requestApplyLocalMutations(`todos`, [
-        {
-          mutationId: `mut-1`,
-          type: `insert`,
-          key: `1`,
-          value: { id: `1`, title: `Test` },
-        },
-      ])
-      expect(res1.ok).toBe(true)
-      expect(adapter.appliedTxs.length).toBe(1)
-
-      coord.dispose()
-    })
-
-    it(`coalesces a local-mutation envelope while application is in flight`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const originalApply = leaderAdapter.applyCommittedTx
-      let releaseApplication = (): void => {}
-      const applicationGate = new Promise<void>((resolve) => {
-        releaseApplication = resolve
-      })
-      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
-        await applicationGate
-        return originalApply(collectionId, tx)
-      })
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator()
-      const observedResponses: Array<{
-        rpcId: string
-        term: number
-        seq: number
-        latestRowVersion: number
-        acceptedMutationIds: Array<string>
-      }> = []
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        duplicateNextBroadcastMessage = (data) => {
-          const envelope = data as { payload?: { type?: string } }
-          if (envelope.payload?.type !== `rpc:applyLocalMutations:req`) {
-            return undefined
-          }
-          const duplicate = structuredClone(data) as {
-            payload: { rpcId: string }
-          }
-          duplicate.payload.rpcId = `coalesced-local-rpc`
-          return duplicate
-        }
-        observeBroadcastMessage = (data) => {
-          const payload = (
-            data as {
-              payload?: {
-                type?: string
-                rpcId?: string
-                ok?: boolean
-                term?: number
-                seq?: number
-                latestRowVersion?: number
-                acceptedMutationIds?: Array<string>
-              }
-            }
-          ).payload
-          if (
-            payload?.type === `rpc:applyLocalMutations:res` &&
-            payload.ok === true
-          ) {
-            observedResponses.push({
-              rpcId: payload.rpcId!,
-              term: payload.term!,
-              seq: payload.seq!,
-              latestRowVersion: payload.latestRowVersion!,
-              acceptedMutationIds: payload.acceptedMutationIds!,
-            })
-          }
-        }
-
-        const responsePromise = follower.requestApplyLocalMutations(`todos`, [
-          {
-            mutationId: `mut-in-flight`,
-            type: `insert`,
-            key: `todo-in-flight-local`,
-            value: { id: `todo-in-flight-local` },
-          },
-        ])
-        await flush()
-        releaseApplication()
-        const response = await responsePromise
-        await flush()
-
-        const responsesByRpcId = Object.fromEntries(
-          observedResponses.map(({ rpcId, ...result }) => [rpcId, result]),
-        )
-        const expectedResult = {
-          term: 1,
-          seq: 1,
-          latestRowVersion: 1,
-          acceptedMutationIds: [`mut-in-flight`],
-        }
-        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-        expect(responsesByRpcId).toEqual({
-          [response.rpcId]: expectedResult,
-          'coalesced-local-rpc': expectedResult,
-        })
-      } finally {
-        releaseApplication()
-        observeBroadcastMessage = undefined
-        duplicateNextBroadcastMessage = undefined
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`replays the exact local-mutation success after same-leader response loss`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const followerAdapter = createStubAdapter()
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(followerAdapter)
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      vi.useFakeTimers()
-      try {
-        let droppedResponse: unknown
-        dropNextBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type !== `rpc:applyLocalMutations:res`) return false
-          droppedResponse = structuredClone(payload)
-          return true
-        }
-
-        const responsePromise = follower.requestApplyLocalMutations(`todos`, [
-          {
-            mutationId: `local-response-loss`,
-            type: `insert`,
-            key: `todo-local-response-loss`,
-            value: { id: `todo-local-response-loss` },
-          },
-        ])
-
-        await vi.advanceTimersByTimeAsync(0)
-        expect(droppedResponse).toMatchObject({
-          type: `rpc:applyLocalMutations:res`,
-          ok: true,
-        })
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-
-        await vi.advanceTimersByTimeAsync(10_200)
-        const response = await responsePromise
-
-        expect(response).toEqual(droppedResponse)
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-        expect(followerAdapter.appliedTxs).toEqual([])
-      } finally {
-        leader.dispose()
-        follower.dispose()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`accepts a delivered mutation success after the observed route changes`, async () => {
-      const coordinator = createCoordinator()
-      const internals = coordinator as unknown as {
-        collections: Map<
-          string,
-          { isLeader: boolean; leaderId: string | null; latestTerm: number }
-        >
-      }
-      internals.collections.set(`todos`, {
-        isLeader: false,
-        leaderId: `leader-before`,
-        latestTerm: 1,
-      })
-      const deliveredSuccess = vi.fn(
-        (_collectionId: string, request: ApplyLocalMutationsRequest) => {
-          const state = internals.collections.get(`todos`)!
-          state.leaderId = `leader-after`
-          state.latestTerm = 2
-          return Promise.resolve({
-            type: `rpc:applyLocalMutations:res` as const,
-            rpcId: request.rpcId,
-            ok: true as const,
-            term: 1,
-            seq: 7,
-            latestRowVersion: 7,
-            acceptedMutationIds: request.mutations.map(
-              (mutation) => mutation.mutationId,
-            ),
-          })
-        },
-      )
-      Object.defineProperty(coordinator, `sendRPCOnce`, {
-        value: deliveredSuccess,
-        configurable: true,
-      })
-
-      try {
-        await expect(
-          coordinator.requestApplyLocalMutations(`todos`, [
-            {
-              mutationId: `delivered-before-route-change`,
-              type: `insert`,
-              key: `delivered-before-route-change`,
-              value: { id: `delivered-before-route-change` },
-            },
-          ]),
-        ).resolves.toMatchObject({
-          ok: true,
-          acceptedMutationIds: [`delivered-before-route-change`],
-        })
-        expect(deliveredSuccess).toHaveBeenCalledOnce()
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    it(`fails indeterminate when a local-mutation success is lost across leader change`, async () => {
-      const retiredLeaderAdapter = createStubAdapter()
-      const requesterAdapter = createStubAdapter()
-      const retiredLeader = createCoordinator(retiredLeaderAdapter)
-      const requester = createCoordinator(requesterAdapter)
-
-      retiredLeader.subscribe(`todos`, () => {})
-      requester.subscribe(`todos`, () => {})
-      await flush(50)
-
-      vi.useFakeTimers()
-      try {
-        let committedMessagePosts = 0
-        observeBroadcastMessage = (data) => {
-          if (
-            (data as { payload?: { type?: string } }).payload?.type ===
-            `tx:committed`
-          ) {
-            committedMessagePosts++
-          }
-        }
-        dropNextBroadcastMessage = (data) =>
-          (data as { payload?: { type?: string } }).payload?.type ===
-          `rpc:applyLocalMutations:res`
-        const outcomePromise = requester
-          .requestApplyLocalMutations(`todos`, [
-            {
-              mutationId: `local-requester-takeover`,
-              type: `insert`,
-              key: `local-requester-takeover`,
-              value: { id: `local-requester-takeover` },
-            },
-          ])
-          .then(
-            (response) => ({ response }),
-            (error: unknown) => ({ error }),
-          )
-
-        await vi.advanceTimersByTimeAsync(0)
-        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
-        retiredLeader.dispose()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(requester.isLeader(`todos`)).toBe(true)
-
-        await vi.advanceTimersByTimeAsync(31_000)
-        const outcome = await outcomePromise
-
-        expect(outcome).toEqual({
-          error: expect.objectContaining({
-            name: `IndeterminateCommitError`,
-            code: `INDETERMINATE_COMMIT`,
-            collectionId: `todos`,
-            requestType: `rpc:applyLocalMutations:req`,
-            previousLeaderId: (retiredLeader as unknown as { nodeId: string })
-              .nodeId,
-            previousTerm: 1,
-            currentLeaderId: (requester as unknown as { nodeId: string })
-              .nodeId,
-            currentTerm: 2,
-            cause: expect.objectContaining({
-              message: expect.stringContaining(`timed out`),
-            }),
-          } satisfies Partial<IndeterminateCommitError>),
-        })
-        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
-        expect(requesterAdapter.appliedTxs).toEqual([])
-        expect(committedMessagePosts).toBe(1)
-      } finally {
-        observeBroadcastMessage = undefined
-        retiredLeader.dispose()
-        requester.dispose()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`fails indeterminate instead of retrying local mutations without an initial leader route`, async () => {
-      const coordinator = createCoordinator()
-      const transportError = new Error(`unknown leader response was lost`)
-      const attemptedMutations: Array<ApplyLocalMutationsRequest[`mutations`]> =
-        []
-      const failedTransport = vi.fn(
-        (_collectionId: string, request: ApplyLocalMutationsRequest) => {
-          attemptedMutations.push(structuredClone(request.mutations))
-          if (attemptedMutations.length === 1) {
-            return Promise.reject(transportError)
-          }
-          return Promise.resolve({
-            type: `rpc:applyLocalMutations:res` as const,
-            rpcId: request.rpcId,
-            ok: true as const,
-            term: 1,
-            seq: 1,
-            latestRowVersion: 1,
-            acceptedMutationIds: request.mutations.map(
-              (mutation) => mutation.mutationId,
-            ),
-          })
-        },
-      )
-      Object.defineProperty(coordinator, `sendRPCOnce`, {
-        value: failedTransport,
-        configurable: true,
-      })
-
-      try {
-        const outcome = await coordinator
-          .requestApplyLocalMutations(`todos`, [
-            {
-              mutationId: `browser-unknown-leader-local`,
-              type: `insert`,
-              key: `browser-unknown-leader-local`,
-              value: { id: `browser-unknown-leader-local` },
-            },
-          ])
-          .then(
-            (response) => ({ response }),
-            (error: unknown) => ({ error }),
-          )
-
-        expect(outcome).toEqual({
-          error: expect.objectContaining({
-            name: `IndeterminateCommitError`,
-            code: `INDETERMINATE_COMMIT`,
-            collectionId: `todos`,
-            requestType: `rpc:applyLocalMutations:req`,
-            previousLeaderId: null,
-            previousTerm: null,
-            currentLeaderId: null,
-            currentTerm: null,
-            cause: transportError,
-          } satisfies Partial<IndeterminateCommitError>),
-        })
-        expect(failedTransport).toHaveBeenCalledTimes(1)
-        expect(attemptedMutations).toEqual([
-          [
-            {
-              mutationId: `browser-unknown-leader-local`,
-              type: `insert`,
-              key: `browser-unknown-leader-local`,
-              value: { id: `browser-unknown-leader-local` },
-            },
-          ],
-        ])
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    it(`classifies local-mutation durability failures on local and follower routes`, async () => {
-      const failure = Object.assign(
-        new Error(`local mutation persistence failed`),
-        {
-          code: `SQLITE_IOERR`,
-          path: [`todos`, `rows`],
-        },
-      )
-      const adapter = createStubAdapter()
-      adapter.applyCommittedTx = vi.fn().mockRejectedValue(failure)
-      const leader = createCoordinator(adapter)
-      const follower = createCoordinator(createStubAdapter())
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        const followerResponse = await follower.requestApplyLocalMutations(
-          `todos`,
-          [
-            {
-              mutationId: `remote-durability-failure`,
-              type: `insert`,
-              key: `remote-durability-failure`,
-              value: { id: `remote-durability-failure` },
-            },
-          ],
-        )
-
-        expect(followerResponse).toEqual({
-          type: `rpc:applyLocalMutations:res`,
-          rpcId: expect.any(String),
-          ok: false,
-          code: `PERSISTENCE_ERROR`,
-          error: expect.stringContaining(failure.message),
-          sourceCode: `SQLITE_IOERR`,
-          path: [`todos`, `rows`],
-        })
-        expect(adapter.applyCommittedTx).toHaveBeenCalledTimes(1)
-
-        await expect(
-          leader.requestApplyLocalMutations(`todos`, [
-            {
-              mutationId: `local-durability-failure`,
-              type: `insert`,
-              key: `local-durability-failure`,
-              value: { id: `local-durability-failure` },
-            },
-          ]),
-        ).rejects.toMatchObject({
-          name: `PersistedCollectionDurabilityError`,
-          code: `SQLITE_IOERR`,
-          path: [`todos`, `rows`],
-          cause: failure,
-        } satisfies Partial<PersistedCollectionDurabilityError>)
-        expect(adapter.applyCommittedTx).toHaveBeenCalledTimes(2)
-      } finally {
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it.each([
-      { requestType: `committed transaction` as const },
-      { requestType: `local mutations` as const },
-    ])(
-      `keeps pre-adapter failures outside the durability boundary for $requestType`,
-      async ({ requestType }) => {
-        type LeaderState = {
-          participatesInLeadership: boolean
-          isLeader: boolean
-          leaderId: string
-          lockAbortController: null
-          heartbeatTimer: null
-          latestTerm: number
-          latestSeq: number
-          latestRowVersion: number
-          subscribers: Set<(message: unknown) => void>
-        }
-        type CoordinatorInternals = {
-          collections: Map<string, LeaderState>
-          withWriterLock: <T>(task: () => Promise<T>) => Promise<T>
-        }
-        const leaderState = (): LeaderState => ({
-          participatesInLeadership: true,
-          isLeader: true,
-          leaderId: `forced-local-leader`,
-          lockAbortController: null,
-          heartbeatTimer: null,
-          latestTerm: 1,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          subscribers: new Set(),
-        })
-        const invoke = (
-          coordinator: BrowserCollectionCoordinator,
-          suffix: string,
-        ) =>
-          requestType === `committed transaction`
-            ? coordinator.requestApplyCommittedTx(`todos`, {
-                txId: `classification-boundary-${suffix}`,
-                term: 0,
-                seq: 0,
-                rowVersion: 0,
-                mutations: [],
-              })
-            : coordinator.requestApplyLocalMutations(`todos`, [
-                {
-                  mutationId: `classification-boundary-${suffix}`,
-                  type: `insert`,
-                  key: `classification-boundary-${suffix}`,
-                  value: { id: `classification-boundary-${suffix}` },
-                },
-              ])
-        const missingAdapter = new BrowserCollectionCoordinator({
-          dbName: `missing-adapter`,
-        })
-        const missingInternals =
-          missingAdapter as unknown as CoordinatorInternals
-        missingInternals.collections.set(`todos`, leaderState())
-        const lockFailure = new Error(`writer lock unavailable`)
-        const lockCoordinator = createCoordinator()
-        const lockInternals = lockCoordinator as unknown as CoordinatorInternals
-        lockInternals.collections.set(`todos`, leaderState())
-        lockInternals.withWriterLock = () => Promise.reject(lockFailure)
-
-        try {
-          const missingError = await invoke(missingAdapter, `missing`).then(
-            () => undefined,
-            (error: unknown) => error,
-          )
-          const lockError = await invoke(lockCoordinator, `writer-lock`).then(
-            () => undefined,
-            (error: unknown) => error,
-          )
-
-          expect(missingError).toMatchObject({
-            name: `Error`,
-            message: expect.stringContaining(`adapter not set`),
-          })
-          expect(lockError).toBe(lockFailure)
-        } finally {
-          missingAdapter.dispose()
-          lockCoordinator.dispose()
-        }
-      },
-    )
-
-    it(`reuses the durable stream position after local mutation persistence fails`, async () => {
-      const adapter = createStubAdapter()
-      const persistenceError = new Error(`local disk full`)
-      const attemptedPositions: Array<{ seq: number; rowVersion: number }> = []
-      adapter.applyCommittedTx = vi.fn((_collectionId, tx) => {
-        attemptedPositions.push({ seq: tx.seq, rowVersion: tx.rowVersion })
-        return attemptedPositions.length === 1
-          ? Promise.reject(persistenceError)
-          : Promise.resolve()
-      })
-      const coordinator = createCoordinator(adapter)
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        await expect(
-          coordinator.requestApplyLocalMutations(`todos`, [
-            {
-              mutationId: `failed-local-mutation`,
-              type: `insert`,
-              key: `failed-local-mutation`,
-              value: { id: `failed-local-mutation` },
-            },
-          ]),
-        ).rejects.toMatchObject({ cause: persistenceError })
-
-        const response = await coordinator.requestApplyLocalMutations(`todos`, [
-          {
-            mutationId: `successful-local-mutation`,
-            type: `insert`,
-            key: `successful-local-mutation`,
-            value: { id: `successful-local-mutation` },
-          },
-        ])
-
-        expect({ attemptedPositions, response }).toEqual({
-          attemptedPositions: [
-            { seq: 1, rowVersion: 1 },
-            { seq: 1, rowVersion: 1 },
-          ],
-          response: {
-            type: `rpc:applyLocalMutations:res`,
-            rpcId: expect.any(String),
-            ok: true,
-            term: 1,
-            seq: 1,
-            latestRowVersion: 1,
-            acceptedMutationIds: [`successful-local-mutation`],
-          },
-        })
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    it(`scopes envelope deduplication by collection`, async () => {
-      const alphaAdapter = createStubAdapter()
-      const betaAdapter = createStubAdapter()
-      const coordinator = createCoordinator(alphaAdapter)
-      coordinator.setAdapterForCollection(`alpha`, alphaAdapter)
-      coordinator.setAdapterForCollection(`beta`, betaAdapter)
-      coordinator.subscribe(`alpha`, () => {})
-      coordinator.subscribe(`beta`, () => {})
-      await flush(50)
-
-      const internals = coordinator as unknown as {
-        handleApplyLocalMutations: (
-          collectionId: string,
-          request: {
-            type: `rpc:applyLocalMutations:req`
-            rpcId: string
-            envelopeId: string
-            mutations: Array<{
-              mutationId: string
-              type: `insert`
-              key: string
-              value: { id: string }
-            }>
-          },
-        ) => Promise<{ ok: boolean; rpcId: string }>
-      }
-
-      try {
-        const alpha = await internals.handleApplyLocalMutations(`alpha`, {
-          type: `rpc:applyLocalMutations:req`,
-          rpcId: `alpha-rpc`,
-          envelopeId: `shared-envelope`,
-          mutations: [
-            {
-              mutationId: `alpha-mutation`,
-              type: `insert`,
-              key: `alpha`,
-              value: { id: `alpha` },
-            },
-          ],
-        })
-        const beta = await internals.handleApplyLocalMutations(`beta`, {
-          type: `rpc:applyLocalMutations:req`,
-          rpcId: `beta-rpc`,
-          envelopeId: `shared-envelope`,
-          mutations: [
-            {
-              mutationId: `beta-mutation`,
-              type: `insert`,
-              key: `beta`,
-              value: { id: `beta` },
-            },
-          ],
-        })
-
-        expect({
-          alpha,
-          alphaApplies: alphaAdapter.appliedTxs,
-          beta,
-          betaApplies: betaAdapter.appliedTxs,
-        }).toMatchObject({
-          alpha: { ok: true, rpcId: `alpha-rpc` },
-          alphaApplies: [{ collectionId: `alpha` }],
-          beta: { ok: true, rpcId: `beta-rpc` },
-          betaApplies: [{ collectionId: `beta` }],
-        })
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    it(`coalesces an envelope retry while its first write is in flight`, async () => {
-      const adapter = createStubAdapter()
-      const firstApplyEntered = createDeferred()
-      const releaseFirstApply = createDeferred()
-      let applyCalls = 0
-      adapter.applyCommittedTx = async (collectionId, tx) => {
-        applyCalls++
-        if (applyCalls === 1) {
-          firstApplyEntered.resolve()
-          await releaseFirstApply.promise
-        }
-        adapter.appliedTxs.push({ collectionId: storageId(collectionId), tx })
-      }
-      const coordinator = createCoordinator(adapter)
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-
-      const internals = coordinator as unknown as {
-        handleApplyLocalMutations: (
-          collectionId: string,
-          request: {
-            type: `rpc:applyLocalMutations:req`
-            rpcId: string
-            envelopeId: string
-            mutations: Array<{
-              mutationId: string
-              type: `insert`
-              key: string
-              value: { id: string }
-            }>
-          },
-        ) => Promise<{
-          ok: boolean
-          rpcId: string
-          term?: number
-          seq?: number
-          latestRowVersion?: number
-        }>
-      }
-      const request = {
-        type: `rpc:applyLocalMutations:req` as const,
-        envelopeId: `in-flight-envelope`,
-        mutations: [
-          {
-            mutationId: `mutation`,
-            type: `insert` as const,
-            key: `row`,
-            value: { id: `row` },
-          },
-        ],
-      }
-
-      try {
-        const first = internals.handleApplyLocalMutations(`todos`, {
-          ...request,
-          rpcId: `first-rpc`,
-        })
-        await firstApplyEntered.promise
-        const retry = internals.handleApplyLocalMutations(`todos`, {
-          ...request,
-          rpcId: `retry-rpc`,
-        })
-        await Promise.resolve()
-        releaseFirstApply.resolve()
-
-        const [firstResponse, retryResponse] = await Promise.all([first, retry])
-        expect({
-          applyCalls,
-          first: { ...firstResponse, rpcId: undefined },
-          retry: { ...retryResponse, rpcId: undefined },
-        }).toEqual({
-          applyCalls: 1,
-          first: { ...retryResponse, rpcId: undefined },
-          retry: { ...firstResponse, rpcId: undefined },
-        })
-      } finally {
-        releaseFirstApply.resolve()
-        coordinator.dispose()
-      }
-    })
-
-    it(`replays the successful mutation result when its first response is lost`, async () => {
-      vi.useFakeTimers()
-      const adapter = createStubAdapter()
-      let leadershipRead!: () => void
-      const leadershipReadPromise = new Promise<void>((resolve) => {
-        leadershipRead = resolve
-      })
-      let firstSuccessDropped!: () => void
-      const firstSuccessDroppedPromise = new Promise<void>((resolve) => {
-        firstSuccessDropped = resolve
-      })
-      adapter.getStreamPosition = async () => {
-        leadershipRead()
-        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-      }
-
-      const leader = createCoordinator(adapter)
-      const follower = createCoordinator(adapter)
-
-      try {
-        leader.subscribe(`todos`, () => {})
-        await leadershipReadPromise
-        await Promise.resolve()
-        follower.subscribe(`todos`, () => {})
-
-        dropNextMessageWhen = (data) => {
-          const payload = (
-            data as { payload?: { type?: string; ok?: boolean } }
-          ).payload
-          if (
-            payload?.type === `rpc:applyLocalMutations:res` &&
-            payload.ok === true
-          ) {
-            firstSuccessDropped()
-            return true
-          }
-          return false
-        }
-
-        const responsePromise = follower.requestApplyLocalMutations(`todos`, [
-          {
-            mutationId: `mut-lost-response`,
-            type: `insert`,
-            key: `lost-response`,
-            value: { id: `lost-response`, title: `Persisted once` },
-          },
-        ])
-
-        await firstSuccessDroppedPromise
-        expect(adapter.appliedTxs).toHaveLength(1)
-
-        await vi.advanceTimersByTimeAsync(10_200)
-        const response = await responsePromise
-        expect(response).toMatchObject({
-          ok: true,
-          acceptedMutationIds: [`mut-lost-response`],
-        })
-        expect(adapter.appliedTxs).toHaveLength(1)
-      } finally {
-        follower.dispose()
-        leader.dispose()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`preserves one durable mutation result across generated response-delivery histories`, async () => {
-      vi.useFakeTimers()
-      let run = 0
-      try {
-        await fc.assert(
-          fc.asyncProperty(
-            fc.record({
-              mutationCount: fc.integer({ min: 1, max: 4 }),
-              dropFirstSuccess: fc.boolean(),
-            }),
-            async ({ mutationCount, dropFirstSuccess }) => {
-              run++
-              const collectionId = `delivery-history-${run}`
-              const adapter = createStubAdapter()
-              let leadershipRead!: () => void
-              const leadershipReadPromise = new Promise<void>((resolve) => {
-                leadershipRead = resolve
-              })
-              let firstSuccessDropped!: () => void
-              const firstSuccessDroppedPromise = new Promise<void>(
-                (resolve) => {
-                  firstSuccessDropped = resolve
-                },
-              )
-              adapter.getStreamPosition = async () => {
-                leadershipRead()
-                return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-              }
-
-              const leader = createCoordinator(adapter)
-              const follower = createCoordinator(adapter)
-              try {
-                leader.subscribe(collectionId, () => {})
-                await leadershipReadPromise
-                await Promise.resolve()
-                follower.subscribe(collectionId, () => {})
-
-                if (dropFirstSuccess) {
-                  dropNextMessageWhen = (data) => {
-                    const payload = (
-                      data as { payload?: { type?: string; ok?: boolean } }
-                    ).payload
-                    if (
-                      payload?.type === `rpc:applyLocalMutations:res` &&
-                      payload.ok === true
-                    ) {
-                      firstSuccessDropped()
-                      return true
-                    }
-                    return false
-                  }
-                }
-
-                const mutations = Array.from(
-                  { length: mutationCount },
-                  (_, index) => ({
-                    mutationId: `mut-${run}-${index}`,
-                    type: `insert` as const,
-                    key: `${index}`,
-                    value: { id: `${index}`, title: `row ${index}` },
-                  }),
-                )
-                const responsePromise = follower.requestApplyLocalMutations(
-                  collectionId,
-                  mutations,
-                )
-                if (dropFirstSuccess) {
-                  await firstSuccessDroppedPromise
-                  await vi.advanceTimersByTimeAsync(10_200)
-                }
-
-                const response = await responsePromise
-                expect(response).toMatchObject({
-                  ok: true,
-                  acceptedMutationIds: mutations.map(
-                    (mutation) => mutation.mutationId,
-                  ),
-                })
-                expect(adapter.appliedTxs).toHaveLength(1)
-              } finally {
-                dropNextMessageWhen = undefined
-                follower.dispose()
-                leader.dispose()
-                for (let microtask = 0; microtask < 4; microtask++) {
-                  await Promise.resolve()
-                }
-              }
-            },
-          ),
-          { seed: 1868, numRuns: 12, endOnFailure: true },
-        )
-      } finally {
-        vi.useRealTimers()
-      }
-    })
-  })
-
-  describe(`RPC - applyCommittedTx`, () => {
-    it(`schedules an ordinary source commit before requesting the writer lock`, async () => {
-      const adapter = createStubAdapter()
-      const coordinator = createCoordinator(adapter)
-      const collectionId = `ordinary-source-commit`
-      const unsubscribe = coordinator.subscribe(collectionId, () => {})
-      let applySource!: () => Promise<void>
-      const collection = createCollection(
-        persistedCollectionOptions<{ id: string }, string>({
-          id: collectionId,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ begin, write, commit, markReady }) => {
-              applySource = async () => {
-                begin()
-                write({ type: `insert`, value: { id: `source-row` } })
-                await commit()
-              }
-              markReady()
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-
-      try {
-        await collection.stateWhenReady()
-        await vi.waitFor(() =>
-          expect(coordinator.isLeader(collectionId)).toBe(true),
-        )
-
-        const events: Array<string> = []
-        adapter.runInRegularScope = Object.assign(
-          async <T>(
-            task: (adapter: HydrationPersistenceAdapter) => Promise<T>,
-          ) => {
-            events.push(`scheduler-enter`)
-            try {
-              return await task(adapter)
-            } finally {
-              events.push(`scheduler-exit`)
-            }
-          },
-          { afterQueuedWork: () => Promise.resolve() },
-        )
-        const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-        adapter.applyCommittedTx = async (...args) => {
-          events.push(`apply`)
-          await applyCommittedTx(...args)
-        }
-        const requestLock = mockNavigatorLocks.request.bind(mockNavigatorLocks)
-        const lockSpy = vi
-          .spyOn(mockNavigatorLocks, `request`)
-          .mockImplementation((name, optionsOrCallback, maybeCallback) => {
-            if (name === `tsdb:writer:test-db`) {
-              events.push(`writer-lock-request`)
-            }
-            return requestLock(name, optionsOrCallback, maybeCallback)
-          })
-
-        try {
-          await applySource()
-          expect(events).toEqual([
-            `scheduler-enter`,
-            `writer-lock-request`,
-            `apply`,
-            `scheduler-exit`,
-          ])
-          expect(adapter.appliedTxs).toHaveLength(1)
-          expect(adapter.appliedTxs[0]).toMatchObject({
-            collectionId,
-            tx: {
-              mutations: [{ key: `source-row`, value: { id: `source-row` } }],
-            },
-          })
-          expect(collection.get(`source-row`)).toMatchObject({
-            id: `source-row`,
-          })
-        } finally {
-          lockSpy.mockRestore()
-        }
-      } finally {
-        await collection.cleanup()
-        unsubscribe()
-        coordinator.dispose()
-      }
-    })
-
-    it(`completes the first source commit when leader election overlaps scheduled hydration`, async () => {
-      const database = createWASQLiteTestDatabase({ filename: `:memory:` })
-      const coordinator = createCoordinator()
-      const persistence = createBrowserWASQLitePersistence({
-        database,
-        coordinator,
-      }).resolvePersistenceForCollection?.({
-        collectionId: `first-commit`,
-        mode: `sync-present`,
-      })
-      if (!persistence?.adapter.runInHydrationScope) {
-        coordinator.dispose()
-        await database.close?.()
-        throw new Error(`scheduled hydration adapter not available`)
-      }
-
-      let unsubscribe: (() => void) | undefined
-      const hydration = persistence.adapter.runInHydrationScope(
-        async (adapter) => {
-          unsubscribe = coordinator.subscribe(`first-commit`, () => {})
-          return coordinator.requestApplyCommittedTx(
-            `first-commit`,
-            {
-              txId: `first-source-commit`,
-              term: 0,
-              seq: 0,
-              rowVersion: 0,
-              mutations: [
-                { type: `insert`, key: `first`, value: { id: `first` } },
-              ],
-            },
-            adapter,
-          )
-        },
-      )
-      void hydration.catch(() => undefined)
-      let timeout: ReturnType<typeof setTimeout> | undefined
-
-      try {
-        const response = await Promise.race([
-          hydration,
-          new Promise<never>((_resolve, reject) => {
-            timeout = setTimeout(
-              () => reject(new Error(`first commit stalled during election`)),
-              2_000,
-            )
-          }),
-        ])
-        expect(response.ok).toBe(true)
-        expect(
-          (
-            await persistence.adapter.loadResumeSnapshot({
-              kind: `eager`,
-              collectionId: `first-commit`,
-            })
-          ).rows,
-        ).toEqual([{ key: `first`, value: { id: `first` } }])
-        expect(
-          await database.execute<{ count: number }>(
-            `SELECT COUNT(*) AS count FROM applied_tx`,
-          ),
-        ).toEqual([{ count: 1 }])
-      } finally {
-        if (timeout) clearTimeout(timeout)
-        coordinator.dispose()
-        await Promise.race([hydration.catch(() => undefined), flush(0)])
-        unsubscribe?.()
-        await flush(0)
-        await database.close?.()
-      }
-    })
-
-    it(`settles a cold source commit and another collection's write without a writer-lock cycle`, async () => {
-      const database = createWASQLiteTestDatabase({ filename: `:memory:` })
-      const coordinator = createCoordinator()
-      const persistence = createBrowserWASQLitePersistence({
-        database,
-        coordinator,
-      })
-      const active = persistence.resolvePersistenceForCollection?.({
-        collectionId: `active`,
-        mode: `sync-present`,
-      })
-      const cold = persistence.resolvePersistenceForCollection?.({
-        collectionId: `cold`,
-        mode: `sync-present`,
-      })
-      const adapter = cold?.adapter
-      if (
-        !active ||
-        !adapter?.runInHydrationScope ||
-        !adapter.reserveLeadershipTerm
-      ) {
-        coordinator.dispose()
-        await database.close?.()
-        throw new Error(`shared scheduled adapter not available`)
-      }
-
-      const releaseElectionRead = createDeferred()
-      const electionReadStarted = createDeferred()
-      const releaseHydration = createDeferred()
-      const sourceCommitStarted = createDeferred()
-      const reserveLeadershipTerm = adapter.reserveLeadershipTerm.bind(adapter)
-      adapter.reserveLeadershipTerm = async (collectionId, observedTerm) => {
-        if (storageId(collectionId) === `cold`) {
-          electionReadStarted.resolve()
-          await releaseElectionRead.promise
-        }
-        return reserveLeadershipTerm(collectionId, observedTerm)
-      }
-
-      const unsubscribeActive = coordinator.subscribe(`active`, () => {})
-      let unsubscribeCold: (() => void) | undefined
-      let sourceCommit: Promise<ApplyCommittedTxResponse> | undefined
-      let otherWrite: Promise<ApplyLocalMutationsResponse> | undefined
-      let hydration: Promise<void> | undefined
-      let timeout: ReturnType<typeof setTimeout> | undefined
-
-      try {
-        await vi.waitFor(() =>
-          expect(coordinator.isLeader(`active`)).toBe(true),
-        )
-
-        hydration = adapter.runInHydrationScope(async (scopedAdapter) => {
-          unsubscribeCold = coordinator.subscribe(`cold`, () => {})
-          sourceCommit = coordinator.requestApplyCommittedTx(
-            `cold`,
-            {
-              txId: `first-cold-commit`,
-              term: 0,
-              seq: 0,
-              rowVersion: 0,
-              mutations: [
-                { type: `insert`, key: `cold`, value: { id: `cold` } },
-              ],
-            },
-            scopedAdapter,
-          )
-          void sourceCommit.catch(() => undefined)
-          sourceCommitStarted.resolve()
-          await Promise.race([sourceCommit, releaseHydration.promise])
-        })
-        void hydration.catch(() => undefined)
-        await Promise.all([
-          electionReadStarted.promise,
-          sourceCommitStarted.promise,
-        ])
-        expect(coordinator.isLeader(`cold`)).toBe(false)
-
-        otherWrite = coordinator.requestApplyLocalMutations(`active`, [
-          {
-            mutationId: `active-write`,
-            type: `insert`,
-            key: `active`,
-            value: { id: `active` },
-          },
-        ])
-        void otherWrite.catch(() => undefined)
-        // Let the other collection reach its writer-lock/scheduler boundary
-        // before the held election read establishes the cold route.
-        await flush(0)
-        releaseElectionRead.resolve()
-
-        const [sourceResponse, otherResponse] = await Promise.race([
-          Promise.all([sourceCommit!, otherWrite, hydration]).then(
-            ([source, other]) => [source, other] as const,
-          ),
-          new Promise<never>((_resolve, reject) => {
-            timeout = setTimeout(
-              () =>
-                reject(
-                  new Error(
-                    `cross-collection writer-lock cycle; writer held=${heldLocks.has(`tsdb:writer:test-db`)}`,
-                  ),
-                ),
-              2_000,
-            )
-          }),
-        ])
-        expect(sourceResponse.ok).toBe(true)
-        expect(otherResponse.ok).toBe(true)
-        expect(
-          (
-            await adapter.loadResumeSnapshot({
-              kind: `eager`,
-              collectionId: `cold`,
-            })
-          ).rows,
-        ).toEqual([{ key: `cold`, value: { id: `cold` } }])
-        expect(
-          (
-            await active.adapter.loadResumeSnapshot({
-              kind: `eager`,
-              collectionId: `active`,
-            })
-          ).rows,
-        ).toEqual([{ key: `active`, value: { id: `active` } }])
-      } finally {
-        if (timeout) clearTimeout(timeout)
-        releaseElectionRead.resolve()
-        releaseHydration.resolve()
-        await Promise.race([
-          Promise.allSettled([
-            hydration ?? Promise.resolve(),
-            sourceCommit ?? Promise.resolve(),
-            otherWrite ?? Promise.resolve(),
-          ]),
-          flush(500),
-        ])
-        unsubscribeCold?.()
-        unsubscribeActive()
-        coordinator.dispose()
-        await database.close?.()
-      }
-    })
-
-    it(`routes a complete source transaction to the leader-owned adapter`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const followerAdapter = createStubAdapter()
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(followerAdapter)
-      const followerMessages: Array<unknown> = []
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, (message) => {
-        if ((message.payload as { type?: string }).type === `tx:committed`) {
-          followerMessages.push(message.payload)
-        }
-      })
-      await flush(50)
-
-      const response = await follower.requestApplyCommittedTx(`todos`, {
-        txId: `source-tx`,
-        term: 91,
-        seq: 92,
-        rowVersion: 93,
-        truncate: true,
-        mutations: [
-          {
-            type: `insert`,
-            key: `todo-1`,
-            value: { id: `todo-1`, title: `Owned source row` },
-          },
-        ],
-        rowMetadataMutations: [
-          { type: `set`, key: `todo-1`, value: { source: `remote` } },
-        ],
-        collectionMetadataMutations: [
-          { type: `set`, key: `resume`, value: { offset: `next` } },
-        ],
-      })
-
-      expect(response.ok).toBe(true)
-      expect(followerAdapter.appliedTxs).toEqual([])
-      expect(leaderAdapter.appliedTxs).toHaveLength(1)
-      expect(leaderAdapter.appliedTxs[0]).toMatchObject({
-        collectionId: `todos`,
-        tx: {
-          txId: `source-tx`,
-          truncate: true,
-          mutations: [
-            {
-              type: `insert`,
-              key: `todo-1`,
-              value: { id: `todo-1`, title: `Owned source row` },
-            },
-          ],
-          rowMetadataMutations: [
-            { type: `set`, key: `todo-1`, value: { source: `remote` } },
-          ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `resume`, value: { offset: `next` } },
-          ],
-        },
-      })
-      expect(leaderAdapter.appliedTxs[0]!.tx.term).not.toBe(91)
-      expect(leaderAdapter.appliedTxs[0]!.tx.seq).not.toBe(92)
-      expect(leaderAdapter.appliedTxs[0]!.tx.rowVersion).not.toBe(93)
-
-      await flush()
-      expect(followerMessages).toHaveLength(1)
-      expect(followerMessages[0]).toEqual({
-        type: `tx:committed`,
-        term: expect.any(Number),
-        seq: expect.any(Number),
-        txId: `source-tx`,
-        latestRowVersion: expect.any(Number),
-        requiresFullReload: true,
-      })
-
-      leader.dispose()
-      follower.dispose()
-    })
-
-    it(`classifies committed durability failures on local and follower routes`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const failure = Object.assign(new Error(`persistence failed`), {
-        code: `SQLITE_FULL`,
-        path: `/tmp/browser.sqlite`,
-      })
-      leaderAdapter.applyCommittedTx = vi.fn().mockRejectedValue(failure)
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(createStubAdapter())
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      const response = await follower.requestApplyCommittedTx(`todos`, {
-        txId: `source-tx-failure`,
-        term: 0,
-        seq: 0,
-        rowVersion: 0,
-        mutations: [],
-      })
-
-      expect(response).toEqual({
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: expect.any(String),
-        ok: false,
-        code: `PERSISTENCE_ERROR`,
-        error: expect.stringContaining(`persistence failed`),
-        sourceCode: `SQLITE_FULL`,
-        path: `/tmp/browser.sqlite`,
-      })
-      expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
-
-      await expect(
-        leader.requestApplyCommittedTx(`todos`, {
-          txId: `source-tx-local-failure`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [],
-        }),
-      ).rejects.toMatchObject({
-        name: `PersistedCollectionDurabilityError`,
-        code: `SQLITE_FULL`,
-        path: `/tmp/browser.sqlite`,
-        cause: failure,
-      } satisfies Partial<PersistedCollectionDurabilityError>)
-      expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(2)
-
-      leader.dispose()
-      follower.dispose()
-    })
-
-    it(`does not retry application failures after entering the writer lock`, async () => {
-      const applicationError = new Error(`persistence failed once`)
-      const adapter = createStubAdapter()
-      adapter.applyCommittedTx = vi.fn().mockRejectedValue(applicationError)
-      const coordinator = createCoordinator(adapter)
-
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-
-      vi.useFakeTimers()
-      try {
-        let settled = false
-        const outcomePromise = coordinator
-          .requestApplyCommittedTx(`todos`, {
-            txId: `source-tx-application-failure`,
-            term: 0,
-            seq: 0,
-            rowVersion: 0,
-            mutations: [],
-          })
-          .then(
-            (response) => {
-              settled = true
-              return { response }
-            },
-            (error: unknown) => {
-              settled = true
-              return { error }
-            },
-          )
-
-        await vi.advanceTimersByTimeAsync(0)
-        const firstTurn = {
-          applicationCalls: vi.mocked(adapter.applyCommittedTx).mock.calls
-            .length,
-          settled,
-        }
-
-        coordinator.dispose()
-        await vi.advanceTimersByTimeAsync(5_000)
-        const outcome = await outcomePromise
-
-        expect(firstTurn).toEqual({ applicationCalls: 1, settled: true })
-        expect(adapter.applyCommittedTx).toHaveBeenCalledTimes(1)
-        expect(outcome).toEqual({
-          error: expect.objectContaining({
-            name: `PersistedCollectionDurabilityError`,
-            cause: applicationError,
-          }),
-        })
-      } finally {
-        coordinator.dispose()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`reuses the durable stream position after a committed transaction fails`, async () => {
-      const adapter = createStubAdapter()
-      const persistenceError = new Error(`disk full`)
-      const attemptedPositions: Array<{
-        term: number
-        seq: number
-        rowVersion: number
-      }> = []
-      adapter.applyCommittedTx = vi.fn((_collectionId, tx) => {
-        attemptedPositions.push({
-          term: tx.term,
-          seq: tx.seq,
-          rowVersion: tx.rowVersion,
-        })
-        return attemptedPositions.length === 1
-          ? Promise.reject(persistenceError)
-          : Promise.resolve()
-      })
-      const coordinator = createCoordinator(adapter)
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        await expect(
-          coordinator.requestApplyCommittedTx(`todos`, {
-            txId: `failed-source-tx`,
-            term: 0,
-            seq: 0,
-            rowVersion: 0,
-            mutations: [],
-          }),
-        ).rejects.toMatchObject({ cause: persistenceError })
-
-        const response = await coordinator.requestApplyCommittedTx(`todos`, {
-          txId: `successful-source-tx`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [],
-        })
-
-        expect({ attemptedPositions, response }).toEqual({
-          attemptedPositions: [
-            { term: 1, seq: 1, rowVersion: 1 },
-            { term: 1, seq: 1, rowVersion: 1 },
-          ],
-          response: {
-            type: `rpc:applyCommittedTx:res`,
-            rpcId: expect.any(String),
-            ok: true,
-            term: 1,
-            seq: 1,
-            latestRowVersion: 1,
-          },
-        })
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    it(`replays the successful response when only that response is lost`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const followerAdapter = createStubAdapter()
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(followerAdapter)
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      vi.useFakeTimers()
-      try {
-        let droppedResponse: unknown
-        dropNextBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type !== `rpc:applyCommittedTx:res`) return false
-          droppedResponse = structuredClone(payload)
-          return true
-        }
-
-        const responsePromise = follower.requestApplyCommittedTx(`todos`, {
-          txId: `source-tx-response-loss`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [
-            {
-              type: `insert`,
-              key: `todo-response-loss`,
-              value: { id: `todo-response-loss` },
-            },
-          ],
-        })
-
-        await vi.advanceTimersByTimeAsync(0)
-        expect(droppedResponse).toMatchObject({
-          type: `rpc:applyCommittedTx:res`,
-          ok: true,
-        })
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-
-        await vi.advanceTimersByTimeAsync(10_200)
-        const response = await responsePromise
-
-        expect(response).toEqual(droppedResponse)
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-        expect(followerAdapter.appliedTxs).toEqual([])
-      } finally {
-        leader.dispose()
-        follower.dispose()
-        vi.useRealTimers()
-      }
-    })
-
-    it(`coalesces the same envelope while its first application is in flight`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const followerAdapter = createStubAdapter()
-      const originalApply = leaderAdapter.applyCommittedTx
-      let releaseApplication = (): void => {}
-      const applicationGate = new Promise<void>((resolve) => {
-        releaseApplication = resolve
-      })
-      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
-        await applicationGate
-        return originalApply(collectionId, tx)
-      })
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(followerAdapter)
-      const observedResponses: Array<{
-        rpcId: string
-        term: number
-        seq: number
-        latestRowVersion: number
-      }> = []
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        duplicateNextBroadcastMessage = (data) => {
-          const envelope = data as {
-            payload?: { type?: string; rpcId?: string }
-          }
-          if (envelope.payload?.type !== `rpc:applyCommittedTx:req`) {
-            return undefined
-          }
-          const duplicate = structuredClone(data) as {
-            payload: { rpcId: string }
-          }
-          duplicate.payload.rpcId = `coalesced-rpc`
-          return duplicate
-        }
-        observeBroadcastMessage = (data) => {
-          const payload = (
-            data as {
-              payload?: {
-                type?: string
-                rpcId?: string
-                ok?: boolean
-                term?: number
-                seq?: number
-                latestRowVersion?: number
-              }
-            }
-          ).payload
-          if (
-            payload?.type === `rpc:applyCommittedTx:res` &&
-            payload.ok === true
-          ) {
-            observedResponses.push({
-              rpcId: payload.rpcId!,
-              term: payload.term!,
-              seq: payload.seq!,
-              latestRowVersion: payload.latestRowVersion!,
-            })
-          }
-        }
-
-        const responsePromise = follower.requestApplyCommittedTx(`todos`, {
-          txId: `source-tx-in-flight-envelope`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [
-            {
-              type: `insert`,
-              key: `todo-in-flight-envelope`,
-              value: { id: `todo-in-flight-envelope` },
-            },
-          ],
-        })
-        await flush()
-        const callsBeforeRelease = vi.mocked(leaderAdapter.applyCommittedTx)
-          .mock.calls.length
-
-        releaseApplication()
-        const response = await responsePromise
-        await flush()
-
-        const responsesByRpcId = Object.fromEntries(
-          observedResponses.map(({ rpcId, ...position }) => [rpcId, position]),
-        )
-        const expectedPosition = {
-          term: 1,
-          seq: 1,
-          latestRowVersion: 1,
-        }
-        expect({
-          callsBeforeRelease,
-          appliedTxs: leaderAdapter.appliedTxs.length,
-          responsesByRpcId,
-        }).toEqual({
-          callsBeforeRelease: 1,
-          appliedTxs: 1,
-          responsesByRpcId: {
-            [response.rpcId]: expectedPosition,
-            'coalesced-rpc': expectedPosition,
-          },
-        })
-        expect(followerAdapter.appliedTxs).toEqual([])
-      } finally {
-        releaseApplication()
-        observeBroadcastMessage = undefined
-        duplicateNextBroadcastMessage = undefined
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`allows the same envelope to retry after its application fails`, async () => {
-      const applicationError = new Error(`first application failed`)
-      const leaderAdapter = createStubAdapter()
-      const originalApply = leaderAdapter.applyCommittedTx
-      leaderAdapter.applyCommittedTx = vi
-        .fn()
-        .mockRejectedValueOnce(applicationError)
-        .mockImplementation((collectionId, tx) =>
-          originalApply(collectionId, tx),
-        )
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator()
-      let requestEnvelope: unknown
-      const observedResponses: Array<{ ok?: boolean; error?: string }> = []
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        observeBroadcastMessage = (data) => {
-          const payload = (
-            data as {
-              payload?: { type?: string; ok?: boolean; error?: string }
-            }
-          ).payload
-          if (
-            payload?.type === `rpc:applyCommittedTx:req` &&
-            requestEnvelope === undefined
-          ) {
-            requestEnvelope = structuredClone(data)
-          }
-          if (payload?.type === `rpc:applyCommittedTx:res`) {
-            observedResponses.push({
-              ok: payload.ok,
-              ...(payload.error === undefined ? {} : { error: payload.error }),
-            })
-          }
-        }
-
-        const firstResponse = await follower.requestApplyCommittedTx(`todos`, {
-          txId: `source-tx-retry-after-failure`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [],
-        })
-        expect(firstResponse).toMatchObject({
-          ok: false,
-          code: `PERSISTENCE_ERROR`,
-          error: expect.stringContaining(applicationError.message),
-        })
-        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
-        expect(requestEnvelope).toBeDefined()
-
-        injectBroadcastMessage(`tsdb:coord:test-db`, requestEnvelope)
-        await flush()
-
-        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(2)
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-        expect(observedResponses).toEqual([
-          {
-            ok: false,
-            error: expect.stringContaining(applicationError.message),
-          },
-          { ok: true },
-        ])
-      } finally {
-        observeBroadcastMessage = undefined
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`rejects a different mutation operation that reuses an in-flight envelope`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const originalApply = leaderAdapter.applyCommittedTx
-      let releaseApplication = (): void => {}
-      const applicationGate = new Promise<void>((resolve) => {
-        releaseApplication = resolve
-      })
-      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
-        await applicationGate
-        return originalApply(collectionId, tx)
-      })
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator()
-      let crossOperationResponse: unknown
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        duplicateNextBroadcastMessage = (data) => {
-          const envelope = data as {
-            payload?: { type?: string; envelopeId?: string }
-          }
-          if (envelope.payload?.type !== `rpc:applyCommittedTx:req`) {
-            return undefined
-          }
-          const duplicate = structuredClone(data) as {
-            payload: Record<string, unknown>
-          }
-          duplicate.payload = {
-            type: `rpc:applyLocalMutations:req`,
-            rpcId: `cross-operation-rpc`,
-            envelopeId: envelope.payload.envelopeId,
-            mutations: [],
-          }
-          return duplicate
-        }
-        observeBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { rpcId?: string } }).payload
-          if (payload?.rpcId === `cross-operation-rpc`) {
-            crossOperationResponse = structuredClone(payload)
-          }
-        }
-
-        const responsePromise = follower.requestApplyCommittedTx(`todos`, {
-          txId: `source-tx-cross-operation-envelope`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [],
-        })
-        await flush()
-
-        expect(crossOperationResponse).toMatchObject({
-          type: `rpc:applyLocalMutations:res`,
-          rpcId: `cross-operation-rpc`,
-          ok: false,
-          code: `CONFLICT`,
-          error: expect.stringContaining(`is already in flight`),
-        })
-        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
-
-        releaseApplication()
-        const response = await responsePromise
-        expect(response).toMatchObject({ ok: true, seq: 1 })
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-      } finally {
-        releaseApplication()
-        observeBroadcastMessage = undefined
-        duplicateNextBroadcastMessage = undefined
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`fails indeterminate when a committed success is lost across leader change`, async () => {
-      const retiredLeaderAdapter = createStubAdapter()
-      const requesterAdapter = createStubAdapter()
-      const retiredLeader = createCoordinator(retiredLeaderAdapter)
-      const requester = createCoordinator(requesterAdapter)
-
-      retiredLeader.subscribe(`todos`, () => {})
-      requester.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(retiredLeader.isLeader(`todos`)).toBe(true)
-      expect(requester.isLeader(`todos`)).toBe(false)
-
-      vi.useFakeTimers()
-      try {
-        let committedMessagePosts = 0
-        observeBroadcastMessage = (data) => {
-          if (
-            (data as { payload?: { type?: string } }).payload?.type ===
-            `tx:committed`
-          ) {
-            committedMessagePosts++
-          }
-        }
-        let droppedResponse: unknown
-        dropNextBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type !== `rpc:applyCommittedTx:res`) return false
-          droppedResponse = structuredClone(payload)
-          return true
-        }
-
-        const outcomePromise = requester
-          .requestApplyCommittedTx(`todos`, {
-            txId: `source-tx-requester-takeover`,
-            term: 0,
-            seq: 0,
-            rowVersion: 0,
-            mutations: [
-              {
-                type: `insert`,
-                key: `todo-requester-takeover`,
-                value: { id: `todo-requester-takeover` },
-              },
-            ],
-          })
-          .then(
-            (response) => ({ response }),
-            (error: unknown) => ({ error }),
-          )
-
-        await vi.advanceTimersByTimeAsync(0)
-        expect(droppedResponse).toMatchObject({ ok: true })
-        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
-
-        retiredLeader.dispose()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(requester.isLeader(`todos`)).toBe(true)
-
-        await vi.advanceTimersByTimeAsync(31_000)
-        const outcome = await outcomePromise
-
-        expect(outcome).toEqual({
-          error: expect.objectContaining({
-            name: `IndeterminateCommitError`,
-            code: `INDETERMINATE_COMMIT`,
-            collectionId: `todos`,
-            requestType: `rpc:applyCommittedTx:req`,
-            previousLeaderId: (retiredLeader as unknown as { nodeId: string })
-              .nodeId,
-            previousTerm: 1,
-            currentLeaderId: (requester as unknown as { nodeId: string })
-              .nodeId,
-            currentTerm: 2,
-            cause: expect.objectContaining({
-              message: expect.stringContaining(`timed out`),
-            }),
-          } satisfies Partial<IndeterminateCommitError>),
-        })
-        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
-        expect(requesterAdapter.appliedTxs).toEqual([])
-        expect(committedMessagePosts).toBe(1)
-      } finally {
-        observeBroadcastMessage = undefined
-        retiredLeader.dispose()
-        requester.dispose()
-        vi.useRealTimers()
-      }
-    })
-
-    /**
-     * A source commit whose response is lost across leadership retains its
-     * applied receipt while the replacement leader certifies the exact txId.
-     * The receipt fulfills in the same Collection sync run, which admits a
-     * later source commit. A direct coordinator RPC remains indeterminate.
-     *
-     * Mock transport and Web Locks order durable leader application, response
-     * loss, disposal, election, and the next source commit. The independent
-     * check compares the receipt, sync-run count, public status, and next
-     * receipt after the RPC deadline. The shared applied-tx ledger here only
-     * certifies an exact ID; SQLite and OPFS own durable rows and cursor.
-     */
-    it(`keeps a surviving source Collection usable after a leader closes during a committed RPC`, async () => {
-      type Row = { id: string; title: string }
-      type SourceParams = Parameters<SyncConfig<Row, string>['sync']>[0]
-      const leaderAdapter = createStubAdapter()
-      const followerAdapter = createStubAdapter()
-      followerAdapter.reconcileCommittedTx = async (
-        _collectionId,
-        tx,
-        anchor,
-      ) => {
-        expect(anchor).toEqual({ latestRowVersion: 0, resetEpoch: 0 })
-        const applied = leaderAdapter.appliedTxs.find(
-          ({ tx: durable }) => durable.txId === tx.txId,
-        )?.tx
-        if (!applied) return { kind: `unknown` }
-        return {
-          kind: `already-applied`,
-          committed: {
-            term: applied.term,
-            seq: applied.seq,
-            rowVersion: applied.rowVersion,
-          },
-          latestRowVersion: applied.rowVersion,
-        }
-      }
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(followerAdapter)
-      const releaseLeader = leader.subscribe(`source-close`, () => {})
-      let source!: SourceParams
-      let syncRuns = 0
-      const collection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: `source-close`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              syncRuns++
-              source = params
-              params.markReady()
-            },
-          },
-          persistence: { adapter: followerAdapter, coordinator: follower },
-        }),
-      )
-      let firstReceipt: Promise<unknown> | undefined
-      let primaryFailure: unknown
-      let hasPrimaryFailure = false
-
-      try {
-        await collection.preload()
-        await flush(50)
-        expect(leader.isLeader(`source-close`)).toBe(true)
-        expect(follower.isLeader(`source-close`)).toBe(false)
-
-        vi.useFakeTimers()
-        let droppedSuccess = false
-        dropNextBroadcastMessage = (data) => {
-          const payload = (
-            data as { payload?: { type?: string; ok?: boolean } }
-          ).payload
-          if (payload?.type !== `rpc:applyCommittedTx:res`) return false
-          droppedSuccess = payload.ok === true
-          return true
-        }
-
-        source.begin()
-        source.write({
-          type: `insert`,
-          value: { id: `first`, title: `before close` },
-        })
-        firstReceipt = Promise.resolve(source.commit()).then(
-          () => ({ status: `fulfilled` as const }),
-          (error: unknown) => ({
-            status: `rejected` as const,
-            errorName: error instanceof Error ? error.name : String(error),
-          }),
-        )
-        await vi.advanceTimersByTimeAsync(0)
-        expect(droppedSuccess).toBe(true)
-        expect(leaderAdapter.appliedTxs).toHaveLength(1)
-
-        leader.dispose()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(follower.isLeader(`source-close`)).toBe(true)
-        await vi.advanceTimersByTimeAsync(10_200)
-        const firstOutcome = await firstReceipt
-
-        let secondOutcome: {
-          status: `fulfilled` | `rejected`
-          errorName?: string
-        }
-        try {
-          source.begin()
-          source.write({
-            type: `insert`,
-            value: { id: `second`, title: `after close` },
-          })
-          await source.commit()
-          secondOutcome = { status: `fulfilled` }
-        } catch (error) {
-          secondOutcome = {
-            status: `rejected`,
-            errorName: error instanceof Error ? error.name : String(error),
-          }
-        }
-
-        // Reach witnesses above distinguish an RPC crossover from ordinary
-        // leadership transfer. The exact-ID answer must settle the wrapper's
-        // first receipt without cleanup or a second sync run.
-        const actual = {
-          firstOutcome,
-          collectionStatus: collection.status,
-          syncRuns,
-          secondOutcome,
-        }
-        expect(
-          actual,
-          `Source-close observation: ${JSON.stringify(actual)}`,
-        ).toMatchObject({
-          firstOutcome: { status: `fulfilled` },
-          collectionStatus: `ready`,
-          syncRuns: 1,
-          secondOutcome: { status: `fulfilled` },
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        primaryFailure = error
-      }
-
-      dropNextBroadcastMessage = undefined
-      const cleanupFailures: Array<Error> = []
-      for (const cleanup of [
-        () => leader.dispose(),
-        () => releaseLeader(),
-        () => collection.cleanup(),
-        () => follower.dispose(),
-        () => firstReceipt?.catch(() => undefined),
-      ]) {
-        try {
-          await cleanup()
-        } catch (error) {
-          cleanupFailures.push(
-            error instanceof Error ? error : new Error(String(error)),
-          )
-        }
-      }
-      vi.useRealTimers()
-      if (hasPrimaryFailure && cleanupFailures.length > 0) {
-        throw new AggregateError(
-          cleanupFailures,
-          `Source-close oracle and cleanup both failed`,
-          { cause: primaryFailure },
-        )
-      }
-      if (hasPrimaryFailure) throw primaryFailure
-      expect(cleanupFailures).toEqual([])
-    })
-
-    /**
-     * Reconciliation and a later source commit share the writer lock. The
-     * replacement must advance its stream position before releasing that lock;
-     * otherwise the next commit can reuse the reconciled (term, seq) and be
-     * falsely acknowledged. The adapter log is the independent sequence
-     * reference, and both RPC receipts are checked after the queued write.
-     */
-    it(`reserves the reconciled stream position before a queued source write`, async () => {
-      const adapter = createStubAdapter()
-      const entered = createDeferred()
-      const release = createDeferred()
-      adapter.reconcileCommittedTx = async (collectionId, tx) => {
-        entered.resolve()
-        await release.promise
-        adapter.appliedTxs.push({ collectionId: storageId(collectionId), tx })
-        return {
-          kind: `applied-now`,
-          committed: {
-            term: tx.term,
-            seq: tx.seq,
-            rowVersion: tx.rowVersion,
-          },
-          latestRowVersion: tx.rowVersion,
-        }
-      }
-      const coordinator = createCoordinator(adapter)
-      const unsubscribe = coordinator.subscribe(`source-sequence`, () => {})
-      const transaction = (txId: string): PersistedTx => ({
-        txId,
-        term: 0,
-        seq: 0,
-        rowVersion: 0,
-        mutations: [],
-      })
-      try {
-        await flush(50)
-        expect(coordinator.isLeader(`source-sequence`)).toBe(true)
-        const first = coordinator.reconcileCommittedTx(
-          `source-sequence`,
-          transaction(`crossing`),
-          { latestRowVersion: 0, resetEpoch: 0 },
-        )
-        await entered.promise
-        const second = coordinator.requestApplyCommittedTx(
-          `source-sequence`,
-          transaction(`later`),
-        )
-        release.resolve()
-        expect(await first).toMatchObject({ ok: true, alreadyApplied: false })
-        expect(await second).toMatchObject({
-          ok: true,
-          seq: 2,
-          latestRowVersion: 2,
-        })
-        expect(
-          adapter.appliedTxs.map(({ tx }) => ({
-            id: tx.txId,
-            term: tx.term,
-            seq: tx.seq,
-            rowVersion: tx.rowVersion,
-          })),
-        ).toEqual([
-          { id: `crossing`, term: 1, seq: 1, rowVersion: 1 },
-          { id: `later`, term: 1, seq: 2, rowVersion: 2 },
-        ])
-      } finally {
-        release.resolve()
-        unsubscribe()
-        coordinator.dispose()
-      }
-    })
-
-    /**
-     * Each Web Lock election reserves a distinct durable term before its first
-     * heartbeat, including when the successor never heard the former owner.
-     * The independent ledger increments once per election. A passive follower
-     * may observe a successor and then a delayed former heartbeat; at that
-     * second delivery checkpoint its route must still name the successor.
-     * The controlled channel supplies delivery order, while the real
-     * coordinator supplies elections and route changes. This does not prove
-     * OPFS process scheduling or a real SQLite term reservation.
-     */
-    it.each([`known successor`, `cold successor`])(
-      `keeps a passive follower on the newer elected route after %s`,
-      async (successorHistory) => {
-        let durableTerm = 0
-        const reserveLeadershipTerm = async (
-          _collectionId: string,
-          observedTerm: number,
-        ) => ({
-          latestTerm: (durableTerm = Math.max(durableTerm, observedTerm) + 1),
-          latestSeq: 0,
-          latestRowVersion: 0,
-        })
-        const formerAdapter = Object.assign(createStubAdapter(), {
-          reserveLeadershipTerm,
-        })
-        const successorAdapter = Object.assign(createStubAdapter(), {
-          reserveLeadershipTerm,
-        })
-        const former = createCoordinator(formerAdapter)
-        const follower = createCoordinator()
-        const collectionId = `passive-delayed-heartbeat-${successorHistory}`
-        let successor: BrowserCollectionCoordinator | undefined
-        let unsubscribeSuccessor: (() => void) | undefined
-        const unsubscribeFormer = former.subscribe(collectionId, () => {})
-        let delayedHeartbeat: unknown
-        const followerState = () =>
-          (
-            follower as unknown as {
-              collections: Map<
-                string,
-                { leaderId: string | null; latestTerm: number }
-              >
-            }
-          ).collections.get(collectionId)
-        try {
-          await vi.waitFor(() =>
-            expect(former.isLeader(collectionId)).toBe(true),
-          )
-          await vi.waitFor(() =>
-            expect(followerState()?.leaderId).toBe(former.getNodeId()),
-          )
-          if (successorHistory === `known successor`) {
-            successor = createCoordinator(successorAdapter)
-            unsubscribeSuccessor = successor.subscribe(collectionId, () => {})
-            expect(successor.isLeader(collectionId)).toBe(false)
-          }
-          dropNextBroadcastMessage = (message) => {
-            const envelope = message as {
-              senderId?: string
-              payload?: { type?: string }
-            }
-            if (
-              envelope.senderId !== former.getNodeId() ||
-              envelope.payload?.type !== `leader:heartbeat`
-            ) {
-              return false
-            }
-            delayedHeartbeat = structuredClone(message)
-            return true
-          }
-          injectBroadcastMessage(`tsdb:coord:test-db`, {
-            v: 1,
-            dbName: `test-db`,
-            collectionId,
-            senderId: `route-probe`,
-            ts: Date.now(),
-            payload: { type: `leader:routeRequest` },
-          })
-          await vi.waitFor(() => expect(delayedHeartbeat).toBeDefined())
-          dropNextBroadcastMessage = undefined
-          former.dispose()
-          if (!successor) {
-            successor = createCoordinator(successorAdapter)
-            unsubscribeSuccessor = successor.subscribe(collectionId, () => {})
-          }
-          await vi.waitFor(() =>
-            expect(successor?.isLeader(collectionId)).toBe(true),
-          )
-          await vi.waitFor(() =>
-            expect(followerState()?.leaderId).toBe(successor?.getNodeId()),
-          )
-          injectBroadcastMessage(`tsdb:coord:test-db`, delayedHeartbeat)
-          await flush(0)
-          expect(followerState()).toMatchObject({
-            leaderId: successor.getNodeId(),
-            latestTerm: 2,
-          })
-          expect(
-            await follower.requestApplyCommittedTx(collectionId, {
-              txId: `after-delayed-heartbeat`,
-              term: 0,
-              seq: 0,
-              rowVersion: 0,
-              mutations: [],
-            }),
-          ).toMatchObject({ ok: true, term: 2, seq: 1 })
-          expect(successorAdapter.appliedTxs.map(({ tx }) => tx.txId)).toEqual([
-            `after-delayed-heartbeat`,
-          ])
-          expect(formerAdapter.appliedTxs).toEqual([])
-          expect(durableTerm).toBe(2)
-        } finally {
-          dropNextBroadcastMessage = undefined
-          unsubscribeFormer()
-          unsubscribeSuccessor?.()
-          former.dispose()
-          follower.dispose()
-          successor?.dispose()
-        }
-      },
-    )
-
-    /**
-     * A delayed former-owner heartbeat cannot reclaim the replacement Web
-     * Lock holder's route while exact-ID checking waits behind another writer.
-     * The receipt and later source write must use the replacement term.
-     */
-    it(`keeps the Web Lock owner's route after a delayed old-term heartbeat`, async () => {
-      const formerAdapter = createStubAdapter()
-      const successorAdapter = createStubAdapter()
-      successorAdapter.reconcileCommittedTx = vi.fn((collectionId, tx) => {
-        successorAdapter.appliedTxs.push({ collectionId, tx })
-        return Promise.resolve({
-          kind: `applied-now` as const,
-          committed: {
-            term: tx.term,
-            seq: tx.seq,
-            rowVersion: tx.rowVersion,
-          },
-          latestRowVersion: tx.rowVersion,
-        })
-      })
-      const former = createCoordinator(formerAdapter)
-      const successor = createCoordinator(successorAdapter)
-      const collectionId = `source-stale-heartbeat`
-      const unsubscribeFormer = former.subscribe(collectionId, () => {})
-      const unsubscribeSuccessor = successor.subscribe(collectionId, () => {})
-      const writerEntered = createDeferred()
-      const releaseWriter = createDeferred()
-      let blockingWriter: Promise<unknown> | undefined
-      let reconciliation: Promise<unknown> | undefined
-      let delayedHeartbeat: unknown
-      try {
-        await vi.waitFor(() => expect(former.isLeader(collectionId)).toBe(true))
-        expect(successor.isLeader(collectionId)).toBe(false)
-        dropNextBroadcastMessage = (message) => {
-          const envelope = message as {
-            senderId?: string
-            payload?: { type?: string }
-          }
-          if (
-            envelope.senderId !== former.getNodeId() ||
-            envelope.payload?.type !== `leader:heartbeat`
-          ) {
-            return false
-          }
-          delayedHeartbeat = structuredClone(message)
-          return true
-        }
-        injectBroadcastMessage(`tsdb:coord:test-db`, {
-          v: 1,
-          dbName: `test-db`,
-          collectionId,
-          senderId: `route-probe`,
-          ts: Date.now(),
-          payload: { type: `leader:routeRequest` },
-        })
-        await vi.waitFor(() =>
-          expect(delayedHeartbeat).toMatchObject({
-            senderId: former.getNodeId(),
-            payload: { type: `leader:heartbeat`, term: 1 },
-          }),
-        )
-        dropNextBroadcastMessage = undefined
-        former.dispose()
-        await vi.waitFor(() =>
-          expect(successor.isLeader(collectionId)).toBe(true),
-        )
-        const successorInternals = successor as unknown as {
-          collections: Map<
-            string,
-            { isLeader: boolean; leaderId: string | null; latestTerm: number }
-          >
-        }
-        expect(successorInternals.collections.get(collectionId)).toMatchObject({
-          isLeader: true,
-          leaderId: successor.getNodeId(),
-          latestTerm: 2,
-        })
-
-        blockingWriter = mockNavigatorLocks.request(
-          `tsdb:writer:test-db`,
-          async () => {
-            writerEntered.resolve()
-            await releaseWriter.promise
-          },
-        )
-        await writerEntered.promise
-        reconciliation = successor.reconcileCommittedTx(
-          collectionId,
-          { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
-          { latestRowVersion: 0, resetEpoch: 0 },
-        )
-        await vi.waitFor(() =>
-          expect(lockQueues.get(`tsdb:writer:test-db`)).toHaveLength(1),
-        )
-        injectBroadcastMessage(`tsdb:coord:test-db`, delayedHeartbeat)
-        await flush(0)
-        releaseWriter.resolve()
-        await blockingWriter
-
-        expect(await reconciliation).toMatchObject({
-          ok: true,
-          alreadyApplied: false,
-          committed: { term: 2, seq: 1, rowVersion: 1 },
-        })
-        expect(successorAdapter.reconcileCommittedTx).toHaveBeenCalledTimes(1)
-        expect(
-          await successor.requestApplyCommittedTx(collectionId, {
-            txId: `later`,
-            term: 0,
-            seq: 0,
-            rowVersion: 0,
-            mutations: [],
-          }),
-        ).toMatchObject({ ok: true, term: 2, seq: 2, latestRowVersion: 2 })
-        expect(successorInternals.collections.get(collectionId)).toMatchObject({
-          isLeader: true,
-          leaderId: successor.getNodeId(),
-        })
-        expect(formerAdapter.appliedTxs).toEqual([])
-        expect(
-          successorAdapter.appliedTxs.map(({ tx }) => ({
-            id: tx.txId,
-            term: tx.term,
-            seq: tx.seq,
-            rowVersion: tx.rowVersion,
-          })),
-        ).toEqual([
-          { id: `crossing`, term: 2, seq: 1, rowVersion: 1 },
-          { id: `later`, term: 2, seq: 2, rowVersion: 2 },
-        ])
-      } finally {
-        dropNextBroadcastMessage = undefined
-        releaseWriter.resolve()
-        await blockingWriter
-        unsubscribeFormer()
-        unsubscribeSuccessor()
-        former.dispose()
-        successor.dispose()
-        await reconciliation?.catch(() => undefined)
-      }
-    })
-
-    /**
-     * The writer-lock callback must recheck the full owner identity before
-     * entering the adapter. This deliberately contradictory local state is an
-     * invariant witness, not a legal Browser route: a Web Lock holder normally
-     * names itself. It protects the same fail-closed boundary as ordinary
-     * apply when a future change accidentally corrupts leaderId.
-     */
-    it(`rejects reconciliation before adapter entry when owner identity conflicts`, async () => {
-      const adapter = createStubAdapter()
-      adapter.reconcileCommittedTx = vi.fn(async (_collectionId, tx) => ({
-        kind: `applied-now` as const,
-        committed: {
-          term: tx.term,
-          seq: tx.seq,
-          rowVersion: tx.rowVersion,
-        },
-        latestRowVersion: tx.rowVersion,
-      }))
-      const coordinator = createCoordinator(adapter)
-      const collectionId = `source-reconcile-owner-invariant`
-      const unsubscribe = coordinator.subscribe(collectionId, () => {})
-      const writerEntered = createDeferred()
-      const releaseWriter = createDeferred()
-      let blockingWriter: Promise<unknown> | undefined
-      let reconciliation: Promise<unknown> | undefined
-      try {
-        await vi.waitFor(() =>
-          expect(coordinator.isLeader(collectionId)).toBe(true),
-        )
-        blockingWriter = mockNavigatorLocks.request(
-          `tsdb:writer:test-db`,
-          async () => {
-            writerEntered.resolve()
-            await releaseWriter.promise
-          },
-        )
-        await writerEntered.promise
-        reconciliation = coordinator.reconcileCommittedTx(
-          collectionId,
-          { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
-          { latestRowVersion: 0, resetEpoch: 0 },
-        )
-        await vi.waitFor(() =>
-          expect(lockQueues.get(`tsdb:writer:test-db`)).toHaveLength(1),
-        )
-        const state = (
-          coordinator as unknown as {
-            collections: Map<string, { leaderId: string | null }>
-          }
-        ).collections.get(collectionId)
-        if (!state) throw new Error(`missing coordinator state`)
-        state.leaderId = `contradictory-owner`
-        releaseWriter.resolve()
-        await blockingWriter
-        expect(await reconciliation).toMatchObject({
-          ok: false,
-          code: `NOT_LEADER`,
-        })
-        expect(adapter.reconcileCommittedTx).not.toHaveBeenCalled()
-      } finally {
-        releaseWriter.resolve()
-        await blockingWriter
-        await reconciliation?.catch(() => undefined)
-        unsubscribe()
-        coordinator.dispose()
-      }
-    })
-
-    /** A malformed wire request cannot turn missing proof into an ordinary write. */
-    it(`rejects a reconciliation RPC without its durable anchor`, async () => {
-      const adapter = createStubAdapter()
-      adapter.reconcileCommittedTx = vi.fn(async () => ({
-        kind: `unknown` as const,
-      }))
-      const coordinator = createCoordinator(adapter)
-      const unsubscribe = coordinator.subscribe(`source-anchor`, () => {})
-      let response: unknown
-      try {
-        await flush(50)
-        expect(coordinator.isLeader(`source-anchor`)).toBe(true)
-        observeBroadcastMessage = (message) => {
-          const payload = (message as { payload?: { type?: string } }).payload
-          if (payload?.type === `rpc:reconcileCommittedTx:res`) {
-            response = payload
-          }
-        }
-        injectBroadcastMessage(`tsdb:coord:test-db`, {
-          v: 1,
-          dbName: `test-db`,
-          collectionId: `source-anchor`,
-          senderId: `malformed-peer`,
-          ts: Date.now(),
-          payload: {
-            type: `rpc:reconcileCommittedTx:req`,
-            rpcId: `missing-anchor`,
-            tx: { txId: `unsafe`, mutations: [] },
-          },
-        })
-        await flush(50)
-        expect(response).toMatchObject({
-          rpcId: `missing-anchor`,
-          ok: false,
-          code: `UNDETERMINED`,
-        })
-        expect(adapter.reconcileCommittedTx).not.toHaveBeenCalled()
-        expect(adapter.appliedTxs).toEqual([])
-      } finally {
-        observeBroadcastMessage = undefined
-        unsubscribe()
-        coordinator.dispose()
-      }
-    })
-
-    /**
-     * Exact-ID reconciliation may follow lost transport answers and then a
-     * stale NOT_LEADER response. The same pending source receipt must survive
-     * both kinds of failure and reach the replacement route. This seam counts
-     * sends; it makes no wall-clock or real-network latency claim.
-     */
-    it(`reconciles after two lost answers and a stale owner rejection`, async () => {
-      const coordinator = createCoordinator()
-      const collectionId = `source-reconcile-work-bound`
-      const transportFailure = new Error(`lost reconciliation answer`)
-      const internals = coordinator as unknown as {
-        sendRPCOnce: (
-          collectionId: string,
-          request: { rpcId: string },
-        ) => Promise<unknown>
-      }
-      let sends = 0
-      internals.sendRPCOnce = vi.fn(async (_collectionId, request) => {
-        sends++
-        if (sends <= 2) throw transportFailure
-        return sends === 3
-          ? {
-              type: `rpc:reconcileCommittedTx:res`,
-              rpcId: request.rpcId,
-              ok: false,
-              code: `NOT_LEADER`,
-              error: `stale route`,
-            }
-          : {
-              type: `rpc:reconcileCommittedTx:res`,
-              rpcId: request.rpcId,
-              ok: true,
-              committed: { term: 2, seq: 1, rowVersion: 1 },
-            }
-      })
-      try {
-        injectBroadcastMessage(`tsdb:coord:test-db`, {
-          v: 1,
-          dbName: `test-db`,
-          collectionId,
-          senderId: `remote-owner`,
-          ts: Date.now(),
-          payload: {
-            type: `leader:heartbeat`,
-            leaderId: `remote-owner`,
-            term: 1,
-            latestSeq: 0,
-            latestRowVersion: 0,
-          },
-        })
-        await flush(0)
-        expect(
-          await coordinator.reconcileCommittedTx(
-            collectionId,
-            { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
-            { latestRowVersion: 0, resetEpoch: 0 },
-          ),
-        ).toMatchObject({ ok: true, committed: { term: 2 } })
-        expect(sends).toBe(4)
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    /** A NOT_LEADER response can race election before the durable check starts. */
-    it(`retries an unanswered source proof after a stale owner rejects its route`, async () => {
-      const oldOwner = createCoordinator(createStubAdapter())
-      const replacementAdapter = createStubAdapter()
-      replacementAdapter.reconcileCommittedTx = vi.fn(
-        async (collectionId, tx) => {
-          replacementAdapter.appliedTxs.push({ collectionId, tx })
-          return {
-            kind: `applied-now` as const,
-            committed: {
-              term: tx.term,
-              seq: tx.seq,
-              rowVersion: tx.rowVersion,
-            },
-            latestRowVersion: tx.rowVersion,
-          }
-        },
-      )
-      const requester = createCoordinator(replacementAdapter)
-      const releaseOld = oldOwner.subscribe(`source-route`, () => {})
-      const releaseRequester = requester.subscribe(`source-route`, () => {})
-      let rejectedRoute = false
-      try {
-        await flush(50)
-        expect(oldOwner.isLeader(`source-route`)).toBe(true)
-        dropNextBroadcastMessage = (message) => {
-          const payload = (
-            message as {
-              payload?: { type?: string; rpcId?: string }
-            }
-          ).payload
-          if (payload?.type !== `rpc:reconcileCommittedTx:req`) return false
-          rejectedRoute = true
-          queueMicrotask(() => {
-            injectBroadcastMessage(`tsdb:coord:test-db`, {
-              v: 1,
-              dbName: `test-db`,
-              collectionId: `source-route`,
-              senderId: oldOwner.getNodeId(),
-              ts: Date.now(),
-              payload: {
-                type: `rpc:reconcileCommittedTx:res`,
-                rpcId: payload.rpcId,
-                ok: false,
-                code: `NOT_LEADER`,
-                error: `the old owner released its route`,
-              },
-            })
-            oldOwner.dispose()
-          })
-          return true
-        }
-        const response = await requester.reconcileCommittedTx(
-          `source-route`,
-          { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
-          { latestRowVersion: 0, resetEpoch: 0 },
-        )
-        expect(rejectedRoute).toBe(true)
-        expect(requester.isLeader(`source-route`)).toBe(true)
-        expect(response).toMatchObject({ ok: true, alreadyApplied: false })
-        expect(
-          replacementAdapter.appliedTxs.map(({ tx }) => ({
-            txId: tx.txId,
-            term: tx.term,
-            seq: tx.seq,
-            rowVersion: tx.rowVersion,
-          })),
-        ).toEqual([{ txId: `crossing`, term: 2, seq: 1, rowVersion: 1 }])
-      } finally {
-        dropNextBroadcastMessage = undefined
-        releaseOld()
-        releaseRequester()
-        oldOwner.dispose()
-        requester.dispose()
-      }
-    })
-
-    it(`fails indeterminate instead of retrying a committed transaction without an initial leader route`, async () => {
-      const coordinator = createCoordinator()
-      const transportError = new Error(`unknown leader response was lost`)
-      const attemptedTransactions: Array<PersistedTx> = []
-      const failedTransport = vi.fn(
-        (_collectionId: string, request: ApplyCommittedTxRequest) => {
-          attemptedTransactions.push(structuredClone(request.tx))
-          if (attemptedTransactions.length === 1) {
-            return Promise.reject(transportError)
-          }
-          return Promise.resolve({
-            type: `rpc:applyCommittedTx:res` as const,
-            rpcId: request.rpcId,
-            ok: true as const,
-            term: 1,
-            seq: 1,
-            latestRowVersion: 1,
-          })
-        },
-      )
-      Object.defineProperty(coordinator, `sendRPCOnce`, {
-        value: failedTransport,
-        configurable: true,
-      })
-
-      try {
-        const outcome = await coordinator
-          .requestApplyCommittedTx(`todos`, {
-            txId: `browser-unknown-leader-committed`,
-            term: 0,
-            seq: 0,
-            rowVersion: 0,
-            mutations: [
-              {
-                type: `insert`,
-                key: `browser-unknown-leader-committed`,
-                value: { id: `browser-unknown-leader-committed` },
-              },
-            ],
-          })
-          .then(
-            (response) => ({ response }),
-            (error: unknown) => ({ error }),
-          )
-
-        expect(outcome).toEqual({
-          error: expect.objectContaining({
-            name: `IndeterminateCommitError`,
-            code: `INDETERMINATE_COMMIT`,
-            collectionId: `todos`,
-            requestType: `rpc:applyCommittedTx:req`,
-            previousLeaderId: null,
-            previousTerm: null,
-            currentLeaderId: null,
-            currentTerm: null,
-            cause: transportError,
-          } satisfies Partial<IndeterminateCommitError>),
-        })
-        expect(failedTransport).toHaveBeenCalledTimes(1)
-        expect(attemptedTransactions).toEqual([
-          {
-            txId: `browser-unknown-leader-committed`,
-            term: 0,
-            seq: 0,
-            rowVersion: 0,
-            mutations: [
-              {
-                type: `insert`,
-                key: `browser-unknown-leader-committed`,
-                value: { id: `browser-unknown-leader-committed` },
-              },
-            ],
-          },
-        ])
-      } finally {
-        coordinator.dispose()
-      }
-    })
-
-    it(`does not retain completed or in-flight committed transactions after disposal`, async () => {
-      const adapter = createStubAdapter()
-      const originalApply = adapter.applyCommittedTx
-      let heldApplyEntered = false
-      let releaseHeldApply = (): void => {}
-      const heldApplyGate = new Promise<void>((resolve) => {
-        releaseHeldApply = resolve
-      })
-      adapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
-        if (tx.txId === `held-during-disposal`) {
-          heldApplyEntered = true
-          await heldApplyGate
-        }
-        await originalApply(collectionId, tx)
-      })
-      const coordinator = createCoordinator(adapter)
-      const internals = coordinator as unknown as {
-        handleApplyCommittedTx: (
-          collectionId: string,
-          request: ApplyCommittedTxRequest,
-        ) => Promise<{
-          ok: boolean
-          code?: string
-        }>
-        appliedEnvelopes: Map<string, unknown>
-        inFlightEnvelopes: Map<string, unknown>
-      }
-      const completedRequest: ApplyCommittedTxRequest = {
-        type: `rpc:applyCommittedTx:req`,
-        rpcId: `completed-rpc`,
-        envelopeId: `completed-envelope`,
-        tx: {
-          txId: `completed-before-disposal`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [],
-        },
-      }
-      const heldRequest: ApplyCommittedTxRequest = {
-        type: `rpc:applyCommittedTx:req`,
-        rpcId: `held-rpc`,
-        envelopeId: `held-envelope`,
-        tx: {
-          txId: `held-during-disposal`,
-          term: 0,
-          seq: 0,
-          rowVersion: 0,
-          mutations: [],
-        },
-      }
-
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        expect(
-          await internals.handleApplyCommittedTx(`todos`, completedRequest),
-        ).toMatchObject({ ok: true })
-        const heldResponse = internals.handleApplyCommittedTx(
-          `todos`,
-          heldRequest,
-        )
-        await vi.waitFor(() => expect(heldApplyEntered).toBe(true))
-        expect({
-          completed: internals.appliedEnvelopes.size,
-          inFlight: internals.inFlightEnvelopes.size,
-        }).toEqual({ completed: 1, inFlight: 1 })
-
-        coordinator.dispose()
-        expect({
-          completed: internals.appliedEnvelopes.size,
-          inFlight: internals.inFlightEnvelopes.size,
-        }).toEqual({ completed: 0, inFlight: 0 })
-
-        releaseHeldApply()
-        await expect(heldResponse).resolves.toMatchObject({ ok: true })
-        expect({
-          completed: internals.appliedEnvelopes.size,
-          inFlight: internals.inFlightEnvelopes.size,
-        }).toEqual({ completed: 0, inFlight: 0 })
-        await expect(
-          internals.handleApplyCommittedTx(`todos`, completedRequest),
-        ).resolves.toMatchObject({ ok: false, code: `NOT_LEADER` })
-      } finally {
-        releaseHeldApply()
-        coordinator.dispose()
-      }
-    })
-
-    it(`does not answer a held follower request after its leader is disposed`, async () => {
-      const leaderAdapter = createStubAdapter()
-      const originalApply = leaderAdapter.applyCommittedTx
-      let applyEntered = false
-      let releaseApply = (): void => {}
-      const applyGate = new Promise<void>((resolve) => {
-        releaseApply = resolve
-      })
-      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
-        applyEntered = true
-        await applyGate
-        await originalApply(collectionId, tx)
-      })
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator(createStubAdapter())
-      const leaderInternals = leader as unknown as {
-        appliedEnvelopes: Map<string, unknown>
-        inFlightEnvelopes: Map<string, unknown>
-      }
-      const followerInternals = follower as unknown as {
-        sendRPCOnce: (
-          collectionId: string,
-          request: ApplyCommittedTxRequest,
-        ) => Promise<unknown>
-      }
-      let responsePosts = 0
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        observeBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type === `rpc:applyCommittedTx:res`) {
-            responsePosts++
-          }
-        }
-        const outcomePromise = followerInternals
-          .sendRPCOnce(`todos`, {
-            type: `rpc:applyCommittedTx:req`,
-            rpcId: `held-follower-rpc`,
-            envelopeId: `held-follower-envelope`,
-            tx: {
-              txId: `held-follower-tx`,
-              term: 0,
-              seq: 0,
-              rowVersion: 0,
-              mutations: [],
-            },
-          })
-          .then(
-            (response) => ({ response }),
-            (error: unknown) => ({ error }),
-          )
-
-        await vi.waitFor(() => expect(applyEntered).toBe(true))
-        leader.dispose()
-        releaseApply()
-        await vi.waitFor(() => expect(leaderAdapter.appliedTxs).toHaveLength(1))
-        await flush()
-
-        expect({
-          responsePosts,
-          completed: leaderInternals.appliedEnvelopes.size,
-          inFlight: leaderInternals.inFlightEnvelopes.size,
-        }).toEqual({ responsePosts: 0, completed: 0, inFlight: 0 })
-
-        follower.dispose()
-        const outcome = await outcomePromise
-        expect(outcome).toEqual({ error: new Error(`coordinator disposed`) })
-      } finally {
-        observeBroadcastMessage = undefined
-        releaseApply()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-  })
-
-  describe(`RPC - ensureRemoteSubset`, () => {
-    /**
-     * Route-pending was absent from the earlier acquisition grammar: every
-     * generated request began after a leader was known. This law varies the
-     * terminal action while the same first acquisition is waiting for its
-     * route, and checks both transport exclusion and live local-only identity.
-     */
-    it.each([
-      { terminalAction: `complete` as const },
-      { terminalAction: `abort` as const },
-    ])(
-      `settles a route-pending first subset request after $terminalAction without premature transport or replay`,
-      async ({ terminalAction }) => {
-        const lockName = `tsdb:leader:test-db:todos`
-        let releaseInitialLock = (): void => {}
-        heldLocks.set(lockName, {
-          release: () => {
-            heldLocks.delete(lockName)
-            tryGrantNextLock(lockName)
-          },
-        })
-        releaseInitialLock = heldLocks.get(lockName)!.release
-        const coordinator = createCoordinator()
-        const owner = withUnusedUnloadSubset(vi.fn())
-        const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-          `todos`,
-          owner,
-        )
-        coordinator.subscribe(`todos`, () => {})
-        const internals = coordinator as unknown as {
-          sendRPCOnce: (
-            collectionId: string,
-            request: unknown,
-          ) => Promise<unknown>
-        }
-        const originalSendRPCOnce = internals.sendRPCOnce.bind(coordinator)
-        const prematureTransport = vi.fn(() =>
-          Promise.reject(new Error(`no leader route yet`)),
-        )
-        internals.sendRPCOnce = prematureTransport
-        const abortController = new AbortController()
-        const signal = abortController.signal
-        const subscription = { on: () => () => {} } as unknown as Subscription
-        const options: LoadSubsetOptions = { limit: 1, signal, subscription }
-        const acquisitionInternals = coordinator as unknown as {
-          outboundRemoteSubsetAcquisitions: Map<string, unknown>
-        }
-
-        try {
-          const request = coordinator.requestEnsureRemoteSubset(
-            `todos`,
-            options,
-          )
-          await flush(0)
-          const transportCallsBeforeLeadership =
-            prematureTransport.mock.calls.length
-
-          if (terminalAction === `abort`) {
-            abortController.abort()
-            await expect(request).rejects.toMatchObject({ name: `AbortError` })
-          }
-          releaseInitialLock()
-          await vi.waitFor(() =>
-            expect(coordinator.isLeader(`todos`)).toBe(true),
-          )
-          if (terminalAction === `complete`) await request
-          await flush(0)
-
-          expect(transportCallsBeforeLeadership).toBe(0)
-          if (terminalAction === `complete`) {
-            expect(owner).toHaveBeenCalledTimes(1)
-            expect(owner.mock.calls[0]?.[0]).toMatchObject({ limit: 1 })
-            expect(owner.mock.calls[0]?.[0].signal).toBe(signal)
-            expect(owner.mock.calls[0]?.[0].subscription).toBe(subscription)
-          } else {
-            expect(owner).not.toHaveBeenCalled()
-            expect(
-              acquisitionInternals.outboundRemoteSubsetAcquisitions.size,
-            ).toBe(0)
-          }
-          await coordinator.requestReleaseRemoteSubset(`todos`, options)
-        } finally {
-          internals.sendRPCOnce = originalSendRPCOnce
-          releaseInitialLock()
-          unregisterOwner()
-          coordinator.dispose()
-        }
-      },
-    )
-
-    it.each([
-      { cleanupOrder: `owner then subscriptions` as const, subscriberCount: 1 },
-      { cleanupOrder: `owner then subscriptions` as const, subscriberCount: 2 },
-      { cleanupOrder: `subscriptions then owner` as const, subscriberCount: 1 },
-      { cleanupOrder: `subscriptions then owner` as const, subscriberCount: 2 },
-    ])(
-      `relinquishes leadership after $subscriberCount runtime subscriber(s) clean up in $cleanupOrder order`,
-      async ({ cleanupOrder, subscriberCount }) => {
-        const first = createCoordinator()
-        const second = createCoordinator()
-        const unsubscribeFirst = Array.from({ length: subscriberCount }, () =>
-          first.subscribe(`todos`, () => {}),
-        )
-        second.subscribe(`todos`, () => {})
-        const firstOwner = withUnusedUnloadSubset(vi.fn())
-        const secondOwner = withUnusedUnloadSubset(vi.fn())
-        const unregisterFirst = first.registerRemoteSubsetOwner(
-          `todos`,
-          firstOwner,
-        )
-        const unregisterSecond = second.registerRemoteSubsetOwner(
-          `todos`,
-          secondOwner,
-        )
-
-        try {
-          await vi.waitFor(() => {
-            expect({
-              first: first.isLeader(`todos`),
-              second: second.isLeader(`todos`),
-            }).toEqual({ first: true, second: false })
-          })
-
-          if (cleanupOrder === `owner then subscriptions`) unregisterFirst()
-          for (const [index, unsubscribe] of unsubscribeFirst.entries()) {
-            unsubscribe()
-            if (index < unsubscribeFirst.length - 1) {
-              expect(first.isLeader(`todos`)).toBe(true)
-            }
-          }
-          if (cleanupOrder === `subscriptions then owner`) unregisterFirst()
-
-          await vi.waitFor(() => {
-            expect({
-              first: first.isLeader(`todos`),
-              second: second.isLeader(`todos`),
-            }).toEqual({ first: false, second: true })
-          })
-
-          const options: LoadSubsetOptions = { limit: 1 }
-          await second.requestEnsureRemoteSubset(`todos`, options)
-          expect(secondOwner).toHaveBeenCalledTimes(1)
-          await second.requestReleaseRemoteSubset(`todos`, options)
-        } finally {
-          for (const unsubscribe of unsubscribeFirst) unsubscribe()
-          unregisterFirst()
-          unregisterSecond()
-          first.dispose()
-          second.dispose()
-        }
-      },
-    )
-
-    it(`does not orphan an overlapping leadership attempt across rapid unsubscribe and resubscribe`, async () => {
-      // The earlier generated histories changed leaders only after a settled
-      // acquisition. This hostile history leaves getStreamPosition in flight
-      // while participation toggles twice, which can overlap lock loops.
-      const NativeAbortController = globalThis.AbortController
-      const leadershipControllers: Array<AbortController> = []
-      class TrackingAbortController extends NativeAbortController {
-        constructor() {
-          super()
-          leadershipControllers.push(this)
-        }
-      }
-      Object.defineProperty(globalThis, `AbortController`, {
-        value: TrackingAbortController,
-        writable: true,
-        configurable: true,
-      })
-      const adapter = createStubAdapter()
-      const positionResolvers: Array<() => void> = []
-      adapter.getStreamPosition = vi.fn(
-        () =>
-          new Promise<{
-            latestTerm: number
-            latestSeq: number
-            latestRowVersion: number
-          }>((resolve) => {
-            positionResolvers.push(() =>
-              resolve({
-                latestTerm: 0,
-                latestSeq: 0,
-                latestRowVersion: 0,
-              }),
-            )
-          }),
-      )
-      const participant = createCoordinator(adapter)
-      let unsubscribe = participant.subscribe(`todos`, () => {})
-      let contender: BrowserCollectionCoordinator | undefined
-
-      try {
-        await vi.waitFor(() => expect(positionResolvers).toHaveLength(1))
-
-        unsubscribe()
-        unsubscribe = participant.subscribe(`todos`, () => {})
-        positionResolvers[0]!()
-        await vi.waitFor(() => expect(positionResolvers).toHaveLength(2))
-        await flush(0)
-
-        contender = createCoordinator()
-        contender.subscribe(`todos`, () => {})
-        unsubscribe()
-        positionResolvers[1]!()
-
-        await vi.waitFor(() => {
-          expect({
-            participant: participant.isLeader(`todos`),
-            contender: contender!.isLeader(`todos`),
-          }).toEqual({ participant: false, contender: true })
-        })
-      } finally {
-        unsubscribe()
-        for (const controller of leadershipControllers) controller.abort()
-        participant.dispose()
-        contender?.dispose()
-        Object.defineProperty(globalThis, `AbortController`, {
-          value: NativeAbortController,
-          writable: true,
-          configurable: true,
-        })
-      }
-    })
-
-    it(`rejects a second live remote subset owner instead of replacing the first`, () => {
-      const coordinator = createCoordinator()
-      const first = Object.assign(
-        vi.fn((_options: TransportedLoadSubsetOptions) => Promise.resolve()),
-        {
-          loadSubset: vi.fn((_options: TransportedLoadSubsetOptions) =>
-            Promise.resolve(),
-          ),
-          unloadSubset: vi.fn((_options: TransportedLoadSubsetOptions) => {}),
-          onError: vi.fn(),
-        },
-      )
-      const second = Object.assign(
-        vi.fn((_options: TransportedLoadSubsetOptions) => Promise.resolve()),
-        {
-          loadSubset: vi.fn((_options: TransportedLoadSubsetOptions) =>
-            Promise.resolve(),
-          ),
-          unloadSubset: vi.fn((_options: TransportedLoadSubsetOptions) => {}),
-          onError: vi.fn(),
-        },
-      )
-      const unregisterFirst = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        first,
-      )
-
-      try {
-        expect(() =>
-          coordinator.registerRemoteSubsetOwner(`todos`, second),
-        ).toThrowError(
-          expect.objectContaining({
-            name: `DuplicateRemoteSubsetOwnerError`,
-            collectionId: `todos`,
-          }),
-        )
-      } finally {
-        unregisterFirst()
-        coordinator.dispose()
-      }
-    })
-
-    it(`rejects an unsupported nested membership value before local owner work`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-
-      const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-
-      try {
-        await expect(
-          coordinator.requestEnsureRemoteSubset(
-            `todos`,
-            subsetWithNestedValue(() => {}),
-          ),
-        ).rejects.toMatchObject({
-          name: `RemoteSubsetWireValueError`,
-          path: `options.where.args[1].value[1]`,
-          message: `Unsupported remote subset wire value at options.where.args[1].value[1]: function`,
-        })
-        expect(owner).not.toHaveBeenCalled()
-      } finally {
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`rejects a sparse function argument at its exact Browser wire path`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      const owner = withUnusedUnloadSubset(vi.fn())
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      const args = [new IR.PropRef([`todos`, `status`])]
-      args.length = 2
-
-      try {
-        await expect(
-          coordinator.requestEnsureRemoteSubset(`todos`, {
-            where: new IR.Func(`eq`, args),
-          }),
-        ).rejects.toMatchObject({
-          name: `RemoteSubsetWireValueError`,
-          path: `options.where.args[1]`,
-        })
-        expect(owner).not.toHaveBeenCalled()
-      } finally {
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`holds same-stack Browser subset reentry behind the original owner load`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      const options: LoadSubsetOptions = { limit: 1 }
-      let releaseLoad = (): void => {}
-      const loadGate = new Promise<void>((resolve) => {
-        releaseLoad = resolve
-      })
-      let duplicate: Promise<void> | undefined
-      let didReenter = false
-      const owner = Object.assign(
-        vi.fn(() => {
-          if (!didReenter) {
-            didReenter = true
-            duplicate = coordinator.requestEnsureRemoteSubset(`todos`, options)
-          }
-          return loadGate
-        }),
-        { unloadSubset: vi.fn(), onError: vi.fn() },
-      )
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-
-      try {
-        let firstSettled = false
-        let duplicateSettled = false
-        const first = coordinator
-          .requestEnsureRemoteSubset(`todos`, options)
-          .then(() => {
-            firstSettled = true
-          })
-        await vi.waitFor(() => expect(duplicate).toBeDefined())
-        const duplicateResult = duplicate!.then(() => {
-          duplicateSettled = true
-        })
-        await flush(0)
-
-        expect({
-          ownerCalls: owner.mock.calls.length,
-          firstSettled,
-          duplicateSettled,
-        }).toEqual({
-          ownerCalls: 1,
-          firstSettled: false,
-          duplicateSettled: false,
-        })
-
-        releaseLoad()
-        await Promise.all([first, duplicateResult])
-      } finally {
-        releaseLoad()
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    // The owner can hold a load until unload cancels it. A terminal release
-    // must therefore reach unload before source settlement, even when release
-    // reenters from the owner's load callback on the same stack.
-    it(`compacts a terminal same-stack Browser release before the owner load finishes`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      const options: LoadSubsetOptions = { limit: 1 }
-      let releaseLoad = (): void => {}
-      const loadGate = new Promise<void>((resolve) => {
-        releaseLoad = resolve
-      })
-      let release: Promise<void> | undefined
-      const events: Array<string> = []
-      const owner = Object.assign(
-        vi.fn(() => {
-          events.push(`load`)
-          release = coordinator.requestReleaseRemoteSubset(`todos`, options)
-          return loadGate
-        }),
-        {
-          unloadSubset: vi.fn(() => {
-            events.push(`unload`)
-          }),
-          onError: vi.fn(),
-        },
-      )
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      const internals = coordinator as unknown as {
-        outboundRemoteSubsetAcquisitions: Map<string, unknown>
-        inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
-      }
-
-      try {
-        let releaseSettled = false
-        const load = coordinator.requestEnsureRemoteSubset(`todos`, options)
-        await vi.waitFor(() => expect(release).toBeDefined())
-        const terminalRelease = release!.then(() => {
-          releaseSettled = true
-        })
-        await vi.waitFor(() => expect(releaseSettled).toBe(true))
-        expect({ events: [...events], releaseSettled }).toEqual({
-          events: [`load`, `unload`],
-          releaseSettled: true,
-        })
-
-        releaseLoad()
-        await Promise.all([load, terminalRelease])
-        const [terminal] = internals.inboundRemoteSubsetAcquisitions.values()
-        expect({
-          events,
-          outbound: internals.outboundRemoteSubsetAcquisitions.size,
-          inbound: internals.inboundRemoteSubsetAcquisitions.size,
-          terminalKeys: Object.keys(terminal ?? {}).sort(),
-        }).toEqual({
-          events: [`load`, `unload`],
-          outbound: 0,
-          inbound: 1,
-          terminalKeys: [
-            `acquisitionId`,
-            `collectionId`,
-            `released`,
-            `requesterId`,
-          ],
-        })
-      } finally {
-        releaseLoad()
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it.each([
-      { failureMode: `before lease transfer` as const, expectedUnloads: 1 },
-      { failureMode: `after lease transfer` as const, expectedUnloads: 2 },
-    ])(
-      `retires a rejected owner load $failureMode and permits a fresh retry`,
-      async ({ failureMode, expectedUnloads }) => {
-        // The previous grammar generated only fulfilled owner loads. Both sides
-        // of the promise-return lease-transfer boundary must permit a fresh
-        // attempt without caching the rejected acquisition.
-        const coordinator = createCoordinator()
-        coordinator.subscribe(`todos`, () => {})
-        await flush(50)
-        expect(coordinator.isLeader(`todos`)).toBe(true)
-        const loadError = new Error(`browser transferred load failed`)
-        const ownerErrors: Array<unknown> = []
-        let loadCalls = 0
-        const owner = Object.assign(
-          vi.fn((_options: TransportedLoadSubsetOptions) => {
-            loadCalls++
-            if (loadCalls !== 1) return Promise.resolve()
-            if (failureMode === `before lease transfer`) throw loadError
-            return Promise.reject(loadError)
-          }),
-          {
-            unloadSubset: vi.fn(
-              (_options: TransportedLoadSubsetOptions) => undefined,
-            ),
-            onError: (error: unknown) => ownerErrors.push(error),
-          },
-        )
-        const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-          `todos`,
-          owner,
-        )
-        const options: LoadSubsetOptions = { offset: 20 }
-        const unhandled: Array<unknown> = []
-        const onUnhandled = (error: unknown) => unhandled.push(error)
-        process.on(`unhandledRejection`, onUnhandled)
-        const internals = coordinator as unknown as {
-          inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
-        }
-
-        try {
-          const ensureError = await coordinator
-            .requestEnsureRemoteSubset(`todos`, options)
-            .then(
-              () => undefined,
-              (error: unknown) => error,
-            )
-          await coordinator.requestEnsureRemoteSubset(`todos`, options)
-          await coordinator.requestReleaseRemoteSubset(`todos`, options)
-          await flush(0)
-          const [terminal] = internals.inboundRemoteSubsetAcquisitions.values()
-
-          expect(ensureError).toBe(loadError)
-          expect(owner).toHaveBeenCalledTimes(2)
-          expect(owner.unloadSubset).toHaveBeenCalledTimes(expectedUnloads)
-          if (failureMode === `after lease transfer`) {
-            expect(owner.unloadSubset.mock.calls[0]?.[0]).toBe(
-              owner.mock.calls[0]?.[0],
-            )
-          }
-          expect(owner.unloadSubset.mock.calls.at(-1)?.[0]).toBe(
-            owner.mock.calls[1]?.[0],
-          )
-          expect(ownerErrors).toEqual([])
-          expect(unhandled).toEqual([])
-          expect({
-            inbound: internals.inboundRemoteSubsetAcquisitions.size,
-            terminalKeys: Object.keys(terminal ?? {}).sort(),
-          }).toEqual({
-            inbound: 1,
-            terminalKeys: [
-              `acquisitionId`,
-              `collectionId`,
-              `released`,
-              `requesterId`,
-            ],
-          })
-        } finally {
-          process.off(`unhandledRejection`, onUnhandled)
-          unregisterOwner()
-          coordinator.dispose()
-        }
-      },
-    )
-
-    it.each([
-      {
-        transportFailure: `delivered negative response` as const,
-        retainedAfterFailure: 0,
-      },
-      {
-        transportFailure: `undelivered rejection` as const,
-        retainedAfterFailure: 1,
-      },
-    ])(
-      `resolves a $transportFailure by delivery boundary without takeover replay`,
-      async ({ transportFailure, retainedAfterFailure }) => {
-        // Earlier takeover histories replayed only live demand; release failure
-        // was tested without a real leader change. No-response transport keeps
-        // retry debt; a leader response proves delivery and retires it. Both
-        // terminal paths must suppress takeover replay.
-        const leader = createCoordinator()
-        const follower = createCoordinator()
-        const unsubscribeLeader = leader.subscribe(`todos`, () => {})
-        follower.subscribe(`todos`, () => {})
-        await flush(50)
-        const firstOwner = Object.assign(
-          vi.fn(() => Promise.resolve()),
-          {
-            unloadSubset: vi.fn(() => Promise.resolve()),
-            onError: vi.fn(),
-          },
-        )
-        const secondOwner = Object.assign(
-          vi.fn(() => Promise.resolve()),
-          {
-            unloadSubset: vi.fn(() => Promise.resolve()),
-            onError: vi.fn(),
-          },
-        )
-        const unregisterFirst = leader.registerRemoteSubsetOwner(
-          `todos`,
-          firstOwner,
-        )
-        const unregisterSecond = follower.registerRemoteSubsetOwner(
-          `todos`,
-          secondOwner,
-        )
-        const options: LoadSubsetOptions = { limit: 1 }
-        const followerInternals = follower as unknown as {
-          sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
-          outboundRemoteSubsetAcquisitions: Map<string, unknown>
-        }
-
-        try {
-          await follower.requestEnsureRemoteSubset(`todos`, options)
-          const sendRPC = followerInternals.sendRPC.bind(follower)
-          let releaseAttempts = 0
-          followerInternals.sendRPC = async (collectionId, request) => {
-            if (
-              (request as { type?: string }).type ===
-              `rpc:releaseRemoteSubset:req`
-            ) {
-              releaseAttempts++
-              if (releaseAttempts === 1) {
-                if (transportFailure === `undelivered rejection`) {
-                  throw new Error(`transient release transport rejection`)
-                }
-                return {
-                  type: `rpc:releaseRemoteSubset:res`,
-                  rpcId: (request as { rpcId: string }).rpcId,
-                  ok: false,
-                  error: `transient release transport failure`,
-                }
-              }
-            }
-            return sendRPC(collectionId, request)
-          }
-
-          await expect(
-            follower.requestReleaseRemoteSubset(`todos`, options),
-          ).rejects.toThrow(/transient release transport/)
-          expect({
-            releaseAttempts,
-            retained: followerInternals.outboundRemoteSubsetAcquisitions.size,
-            unloads: firstOwner.unloadSubset.mock.calls.length,
-          }).toEqual({
-            releaseAttempts: 1,
-            retained: retainedAfterFailure,
-            unloads: 0,
-          })
-
-          unsubscribeLeader()
-          await vi.waitFor(() => expect(follower.isLeader(`todos`)).toBe(true))
-          await vi.waitFor(() =>
-            expect(firstOwner.unloadSubset).toHaveBeenCalledTimes(1),
-          )
-          expect(secondOwner).not.toHaveBeenCalled()
-
-          await follower.requestReleaseRemoteSubset(`todos`, options)
-          expect({
-            releaseAttempts,
-            retained: followerInternals.outboundRemoteSubsetAcquisitions.size,
-            firstUnloads: firstOwner.unloadSubset.mock.calls.length,
-            takeoverLoads: secondOwner.mock.calls.length,
-          }).toEqual({
-            releaseAttempts: 1,
-            retained: 0,
-            firstUnloads: 1,
-            takeoverLoads: 0,
-          })
-        } finally {
-          unsubscribeLeader()
-          unregisterFirst()
-          unregisterSecond()
-          leader.dispose()
-          follower.dispose()
-        }
-      },
-    )
-
-    // A release may reach the old leader and unload its exact acquisition,
-    // while the reply is lost. The real RPC timer then expires after takeover;
-    // its retry must retire the outbound debt without replaying demand or
-    // unloading the old acquisition twice. The independent expectation is one
-    // old-owner unload, zero replacement-owner loads, and no outbound lease at
-    // the release settlement checkpoint.
-    it(`retries a timed-out old-leader release after takeover without replaying demand`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      const unsubscribeLeader = leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-      const oldOwner = Object.assign(
-        vi.fn(() => Promise.resolve()),
-        {
-          unloadSubset: vi.fn(() => Promise.resolve()),
-          onError: vi.fn(),
-        },
-      )
-      const newOwner = Object.assign(
-        vi.fn(() => Promise.resolve()),
-        {
-          unloadSubset: vi.fn(() => Promise.resolve()),
-          onError: vi.fn(),
-        },
-      )
-      const unregisterOld = leader.registerRemoteSubsetOwner(`todos`, oldOwner)
-      const unregisterNew = follower.registerRemoteSubsetOwner(
-        `todos`,
-        newOwner,
-      )
-      const options: LoadSubsetOptions = { limit: 1 }
-      const internals = follower as unknown as {
-        outboundRemoteSubsetAcquisitions: Map<string, unknown>
-      }
-      let droppedResponses = 0
-
-      try {
-        await follower.requestEnsureRemoteSubset(`todos`, options)
-        dropNextBroadcastMessage = (data) => {
-          const type = (data as { payload?: { type?: string } }).payload?.type
-          if (type !== `rpc:releaseRemoteSubset:res`) return false
-          droppedResponses++
-          return true
-        }
-        const release = follower.requestReleaseRemoteSubset(`todos`, options)
-        void release.catch(() => undefined)
-        await vi.waitFor(() => expect(droppedResponses).toBe(1))
-        expect(oldOwner.unloadSubset).toHaveBeenCalledTimes(1)
-        expect(internals.outboundRemoteSubsetAcquisitions.size).toBe(1)
-
-        unsubscribeLeader()
-        await vi.waitFor(() => expect(follower.isLeader(`todos`)).toBe(true))
-        await release
-        expect(internals.outboundRemoteSubsetAcquisitions.size).toBe(0)
-        expect(oldOwner.unloadSubset).toHaveBeenCalledTimes(1)
-        expect(newOwner).not.toHaveBeenCalled()
-        expect(newOwner.unloadSubset).not.toHaveBeenCalled()
-      } finally {
-        dropNextBroadcastMessage = undefined
-        unsubscribeLeader()
-        unregisterOld()
-        unregisterNew()
-        leader.dispose()
-        follower.dispose()
-      }
-    }, 20_000)
-
-    it(`keeps a Browser release tombstone when a transferred load rejects concurrently`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-      const loadError = new Error(`browser concurrent transferred load failed`)
-      let rejectLoad = (_error: unknown): void => {}
-      const loadGate = new Promise<void>((_resolve, reject) => {
-        rejectLoad = reject
-      })
-      const ownerErrors: Array<unknown> = []
-      const owner = Object.assign(
-        vi.fn((_options: TransportedLoadSubsetOptions) => loadGate),
-        {
-          unloadSubset: vi.fn(
-            (_options: TransportedLoadSubsetOptions) => undefined,
-          ),
-          onError: (error: unknown) => ownerErrors.push(error),
-        },
-      )
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      const options: LoadSubsetOptions = { offset: 21 }
-      const unhandled: Array<unknown> = []
-      const onUnhandled = (error: unknown) => unhandled.push(error)
-      process.on(`unhandledRejection`, onUnhandled)
-      const internals = coordinator as unknown as {
-        nodeId: string
-        outboundRemoteSubsetAcquisitions: Map<string, { acquisitionId: string }>
-        inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
-        handleEnsureRemoteSubset: (
-          collectionId: string,
-          request: {
-            type: `rpc:ensureRemoteSubset:req`
-            rpcId: string
-            acquisitionId: string
-            options: TransportedLoadSubsetOptions
-          },
-          requesterId: string,
-        ) => Promise<{ ok: boolean }>
-      }
-
-      try {
-        const ensure = coordinator
-          .requestEnsureRemoteSubset(`todos`, options)
-          .then(
-            () => ({ status: `fulfilled` as const }),
-            (error: unknown) => ({ status: `rejected` as const, error }),
-          )
-        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
-        const [outbound] = internals.outboundRemoteSubsetAcquisitions.values()
-        const release = coordinator
-          .requestReleaseRemoteSubset(`todos`, options)
-          .then(
-            () => ({ status: `fulfilled` as const }),
-            (error: unknown) => ({ status: `rejected` as const, error }),
-          )
-        rejectLoad(loadError)
-        const outcomes = await Promise.all([ensure, release])
-        const duplicate = await internals
-          .handleEnsureRemoteSubset(
-            `todos`,
-            {
-              type: `rpc:ensureRemoteSubset:req`,
-              rpcId: `delayed-browser-duplicate`,
-              acquisitionId: outbound!.acquisitionId,
-              options: owner.mock.calls[0]![0],
-            },
-            internals.nodeId,
-          )
-          .then(
-            (response) => ({ status: `fulfilled` as const, response }),
-            (error: unknown) => ({ status: `rejected` as const, error }),
-          )
-        await flush(0)
-        const [terminal] = internals.inboundRemoteSubsetAcquisitions.values()
-
-        expect(outcomes).toEqual([
-          { status: `rejected`, error: loadError },
-          { status: `fulfilled` },
-        ])
-        expect(duplicate).toEqual({
-          status: `fulfilled`,
-          response: expect.objectContaining({ ok: true }),
-        })
-        expect(owner).toHaveBeenCalledTimes(1)
-        expect(owner.unloadSubset).toHaveBeenCalledTimes(1)
-        expect(ownerErrors).toEqual([])
-        expect(unhandled).toEqual([])
-        expect({
-          inbound: internals.inboundRemoteSubsetAcquisitions.size,
-          terminalKeys: Object.keys(terminal ?? {}).sort(),
-        }).toEqual({
-          inbound: 1,
-          terminalKeys: [
-            `acquisitionId`,
-            `collectionId`,
-            `released`,
-            `requesterId`,
-          ],
-        })
-      } finally {
-        rejectLoad(loadError)
-        process.off(`unhandledRejection`, onUnhandled)
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`rejects unsupported nested values before follower transport or owner work`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
-      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-      let subsetPosts = 0
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(leader.isLeader(`todos`)).toBe(true)
-      expect(follower.isLeader(`todos`)).toBe(false)
-      observeBroadcastMessage = (data) => {
-        const payload = (data as { payload?: { type?: string } }).payload
-        if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
-      }
-
-      try {
-        await expect(
-          follower.requestEnsureRemoteSubset(
-            `todos`,
-            subsetWithNestedValue(() => {}),
-          ),
-        ).rejects.toMatchObject({
-          name: `RemoteSubsetWireValueError`,
-          path: `options.where.args[1].value[1]`,
-          message: `Unsupported remote subset wire value at options.where.args[1].value[1]: function`,
-        })
-        expect({ subsetPosts, ownerCalls: owner.mock.calls.length }).toEqual({
-          subsetPosts: 0,
-          ownerCalls: 0,
-        })
-      } finally {
-        observeBroadcastMessage = undefined
-        unregisterOwner()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it.each(unsupportedSubsetValueCases)(
-      `rejects a nested %s through both local and follower admission`,
-      async (_label, createUnsupported, path) => {
-        const leader = createCoordinator()
-        const follower = createCoordinator()
-        const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
-        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-        let subsetPosts = 0
-
-        leader.subscribe(`todos`, () => {})
-        follower.subscribe(`todos`, () => {})
-        await flush(50)
-        observeBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
-        }
-
-        try {
-          // Admission-only traversal must retain the same independently named
-          // rejection boundary as the local and transported coordinator routes.
-          expect(() =>
-            validateRemoteSubsetOptions(
-              subsetWithNestedValue(createUnsupported()),
-            ),
-          ).toThrowError(
-            expect.objectContaining({
-              name: `RemoteSubsetWireValueError`,
-              path,
-            }),
-          )
-          const outcomes = await Promise.all(
-            [leader, follower].map((coordinator) =>
-              coordinator
-                .requestEnsureRemoteSubset(
-                  `todos`,
-                  subsetWithNestedValue(createUnsupported()),
-                )
-                .then(
-                  () => ({ ok: true as const }),
-                  (error: unknown) => ({ ok: false as const, error }),
-                ),
-            ),
-          )
-          for (const outcome of outcomes) {
-            expect(outcome).toMatchObject({
-              ok: false,
-              error: { name: `RemoteSubsetWireValueError`, path },
-            })
-          }
-          expect({
-            subsetPosts,
-            ownerCalls: owner.mock.calls.length,
-          }).toEqual({ subsetPosts: 0, ownerCalls: 0 })
-        } finally {
-          observeBroadcastMessage = undefined
-          unregisterOwner()
-          leader.dispose()
-          follower.dispose()
-        }
-      },
-    )
-
-    it.each([
-      [
-        `where expression`,
-        {
-          where: new IR.Value({ nested: () => {} }),
-        },
-        `options.where.value.nested`,
-      ],
-      [
-        `non-identifier object key`,
-        {
-          where: new IR.Value({ [`dotted.key`]: () => {} }),
-        },
-        `options.where.value["dotted.key"]`,
-      ],
-      [
-        `property-reference path`,
-        {
-          where: new IR.PropRef([`todos`, (() => {}) as unknown as string]),
-        },
-        `options.where.path[1]`,
-      ],
-      [
-        `order expression`,
-        {
-          orderBy: [
-            {
-              expression: new IR.Value({ nested: () => {} }),
-              compareOptions: { direction: `asc`, nulls: `last` },
-            },
-          ],
-        },
-        `options.orderBy[0].expression.value.nested`,
-      ],
-      [
-        `comparison options`,
-        {
-          orderBy: [
-            {
-              expression: new IR.PropRef([`todos`, `title`]),
-              compareOptions: {
-                direction: `asc`,
-                nulls: `last`,
-                stringSort: `locale`,
-                localeOptions: { matcher: () => {} },
-              },
-            },
-          ],
-        },
-        `options.orderBy[0].compareOptions.localeOptions.matcher`,
-      ],
-      [
-        `cursor from expression`,
-        {
-          cursor: {
-            whereFrom: new IR.Value({ nested: () => {} }),
-            whereCurrent: new IR.Value(`current`),
-          },
-        },
-        `options.cursor.whereFrom.value.nested`,
-      ],
-      [
-        `cursor current expression`,
-        {
-          cursor: {
-            whereFrom: new IR.Value(`from`),
-            whereCurrent: new IR.Value({ nested: () => {} }),
-          },
-        },
-        `options.cursor.whereCurrent.value.nested`,
-      ],
-      [
-        `cursor key`,
-        {
-          cursor: {
-            whereFrom: new IR.Value(`from`),
-            whereCurrent: new IR.Value(`current`),
-            lastKey: () => {},
-          },
-        },
-        `options.cursor.lastKey`,
-      ],
-      [`limit`, { limit: () => {} }, `options.limit`],
-      [`offset`, { offset: () => {} }, `options.offset`],
-    ] as const)(
-      `reports the exact path for an unsupported %s value`,
-      async (_label, options, path) => {
-        const leader = createCoordinator()
-        const follower = createCoordinator()
-        leader.subscribe(`todos`, () => {})
-        follower.subscribe(`todos`, () => {})
-        await flush(50)
-        const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
-        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-        let subsetPosts = 0
-        observeBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
-        }
-
-        try {
-          // Admission-only traversal must retain the same independently named
-          // rejection boundary as the local and transported coordinator routes.
-          expect(() =>
-            validateRemoteSubsetOptions(
-              options as unknown as LoadSubsetOptions,
-            ),
-          ).toThrowError(
-            expect.objectContaining({
-              name: `RemoteSubsetWireValueError`,
-              path,
-            }),
-          )
-          const outcomes = await Promise.all(
-            [leader, follower].map((coordinator) =>
-              coordinator
-                .requestEnsureRemoteSubset(
-                  `todos`,
-                  options as unknown as LoadSubsetOptions,
-                )
-                .then(
-                  () => ({ ok: true as const }),
-                  (error: unknown) => ({ ok: false as const, error }),
-                ),
-            ),
-          )
-          for (const outcome of outcomes) {
-            expect(outcome).toMatchObject({
-              ok: false,
-              error: { name: `RemoteSubsetWireValueError`, path },
-            })
-          }
-          expect({
-            subsetPosts,
-            ownerCalls: owner.mock.calls.length,
-          }).toEqual({ subsetPosts: 0, ownerCalls: 0 })
-        } finally {
-          observeBroadcastMessage = undefined
-          unregisterOwner()
-          leader.dispose()
-          follower.dispose()
-        }
-      },
-    )
-
-    it.each([
-      [
-        `wire record reused as an expression`,
-        () => {
-          const shared = { bad: 1 }
-          return {
-            where: new IR.Func(`and`, [
-              new IR.Value(shared),
-              shared as unknown as IR.BasicExpression,
-            ]),
-          }
-        },
-        `options.where.args[1].type`,
-      ],
-      [
-        `wire array reused as a property-reference path`,
-        () => {
-          const shared = [`todos`, 1]
-          return {
-            where: new IR.Func(`and`, [
-              new IR.Value(shared),
-              new IR.PropRef(shared as unknown as Array<string>),
-            ]),
-          }
-        },
-        `options.where.args[1].path[1]`,
-      ],
-      [
-        `wire array reused as an expression array`,
-        () => {
-          const shared = [1]
-          return {
-            where: new IR.Func(`and`, [
-              new IR.Value(shared),
-              new IR.Func(
-                `nested`,
-                shared as unknown as Array<IR.BasicExpression>,
-              ),
-            ]),
-          }
-        },
-        `options.where.args[1].args[0]`,
-      ],
-      [
-        `wire record reused as comparison options`,
-        () => {
-          const shared = { bad: 1 }
-          return {
-            where: new IR.Value(shared),
-            orderBy: [
-              {
-                expression: new IR.PropRef([`todos`, `title`]),
-                compareOptions: shared,
-              },
-            ],
-          }
-        },
-        `options.orderBy[0].compareOptions.bad`,
-      ],
-    ] as const)(
-      `does not reuse a projected %s across incompatible schema roles`,
-      async (_label, createOptions, path) => {
-        const leader = createCoordinator()
-        const follower = createCoordinator()
-        const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
-        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-        let subsetPosts = 0
-
-        leader.subscribe(`todos`, () => {})
-        follower.subscribe(`todos`, () => {})
-        await flush(50)
-        observeBroadcastMessage = (data) => {
-          const payload = (data as { payload?: { type?: string } }).payload
-          if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
-        }
-
-        try {
-          // Admission-only traversal must retain the same independently named
-          // rejection boundary as the local and transported coordinator routes.
-          expect(() =>
-            validateRemoteSubsetOptions(
-              createOptions() as unknown as LoadSubsetOptions,
-            ),
-          ).toThrowError(
-            expect.objectContaining({
-              name: `RemoteSubsetWireValueError`,
-              path,
-            }),
-          )
-          const outcomes = await Promise.all(
-            [leader, follower].map((coordinator) =>
-              coordinator
-                .requestEnsureRemoteSubset(
-                  `todos`,
-                  createOptions() as unknown as LoadSubsetOptions,
-                )
-                .then(
-                  () => ({ ok: true as const }),
-                  (error: unknown) => ({ ok: false as const, error }),
-                ),
-            ),
-          )
-          for (const outcome of outcomes) {
-            expect(outcome).toMatchObject({
-              ok: false,
-              error: { name: `RemoteSubsetWireValueError`, path },
-            })
-          }
-          expect({
-            subsetPosts,
-            ownerCalls: owner.mock.calls.length,
-          }).toEqual({ subsetPosts: 0, ownerCalls: 0 })
-        } finally {
-          observeBroadcastMessage = undefined
-          unregisterOwner()
-          leader.dispose()
-          follower.dispose()
-        }
-      },
-    )
-
-    it(`preserves local lifecycle fields while transporting only wire values`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      const received: Array<TransportedLoadSubsetOptions> = []
-      const unloadSubset = vi.fn((_options: TransportedLoadSubsetOptions) => {})
-      const owner = Object.assign(
-        vi.fn((options: TransportedLoadSubsetOptions) => {
-          received.push(options)
-          return Promise.resolve()
-        }),
-        { unloadSubset, onError: vi.fn() },
-      ) satisfies RemoteSubsetOwner
-      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      const shared = { label: `shared` }
-      const cycle: Record<string, unknown> = { label: `cycle` }
-      cycle.self = cycle
-      const buffer = new ArrayBuffer(8)
-      const view = new DataView(buffer, 2, 4)
-      const typed = new Uint16Array(buffer, 0, 2)
-      typed.set([17, 42])
-      const typedArrays = [
-        new Int8Array([-1, 2]),
-        new Uint8Array([0, 255]),
-        new Uint8ClampedArray([0, 255]),
-        new Int16Array([-2, 3]),
-        new Uint16Array([2, 65_535]),
-        new Int32Array([-3, 4]),
-        new Uint32Array([3, 4_000_000_000]),
-        new Float32Array([-0, Number.NaN, Number.POSITIVE_INFINITY]),
-        new Float64Array([Number.NEGATIVE_INFINITY, Math.PI]),
-        new BigInt64Array([-4n, 5n]),
-        new BigUint64Array([4n, 5n]),
-      ]
-      const sparse = new Array<unknown>(3)
-      sparse[1] = undefined
-      const reservedKeys = { constructor: `own constructor value` }
-      Object.defineProperty(reservedKeys, `__proto__`, {
-        value: { label: `own __proto__ value` },
-        enumerable: true,
-        writable: true,
-        configurable: true,
-      })
-      const richValue = {
-        undefinedValue: undefined,
-        nullValue: null,
-        booleanValue: true,
-        stringValue: `wire`,
-        bigintValue: 9_007_199_254_740_993n,
-        nanValue: Number.NaN,
-        positiveInfinity: Number.POSITIVE_INFINITY,
-        negativeInfinity: Number.NEGATIVE_INFINITY,
-        negativeZero: -0,
-        date: new Date(`2026-09-16T12:34:56.000Z`),
-        invalidDate: new Date(Number.NaN),
-        regexp: /wire/giu,
-        buffer,
-        view,
-        typed,
-        typedArrays,
-        map: new Map<unknown, unknown>([[shared, cycle]]),
-        set: new Set<unknown>([shared, cycle]),
-        sparse,
-        reservedKeys,
-        first: shared,
-        second: shared,
-        cycle,
-      }
-      const options = {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`todos`, `payload`]),
-          new IR.Value(richValue),
-        ]),
-        signal: new AbortController().signal,
-        subscription: {
-          on: () => () => {},
-        } as unknown as Subscription,
-      }
-
-      try {
-        // Validation cannot rewrite a request or erase the aliases/cycle that
-        // this receiving witness observes. Frozen records expose accidental writes.
-        for (const value of [
-          options,
-          options.where,
-          options.where.args,
-          richValue,
-          shared,
-          cycle,
-          sparse,
-          reservedKeys,
-          typedArrays,
-        ])
-          Object.freeze(value)
-        const beforeValidation = structuredClone(richValue)
-        expect(validateRemoteSubsetOptions(options)).toBeUndefined()
-        expect(richValue).toEqual(beforeValidation)
-        await leader.requestEnsureRemoteSubset(`todos`, options)
-        await follower.requestEnsureRemoteSubset(`todos`, options)
-        expect(received).toHaveLength(2)
-
-        for (const [routeIndex, decoded] of received.entries()) {
-          const value = (
-            decoded.where as unknown as {
-              args: Array<{ value?: typeof richValue }>
-            }
-          ).args[1]!.value!
-          expect(value).toEqual(beforeValidation)
-          for (const key of Object.keys(richValue) as Array<
-            keyof typeof richValue
-          >) {
-            if (typeof richValue[key] === `object` && richValue[key] !== null)
-              expect(value[key]).not.toBe(richValue[key])
-          }
-          expect(value.undefinedValue).toBeUndefined()
-          expect(value.nullValue).toBeNull()
-          expect(value.booleanValue).toBe(true)
-          expect(value.stringValue).toBe(`wire`)
-          expect(value.bigintValue).toBe(9_007_199_254_740_993n)
-          expect(Object.is(value.nanValue, Number.NaN)).toBe(true)
-          expect(
-            Object.is(value.positiveInfinity, Number.POSITIVE_INFINITY),
-          ).toBe(true)
-          expect(
-            Object.is(value.negativeInfinity, Number.NEGATIVE_INFINITY),
-          ).toBe(true)
-          expect(Object.is(value.negativeZero, -0)).toBe(true)
-          expect(value.date.getTime()).toBe(richValue.date.getTime())
-          expect(Number.isNaN(value.invalidDate.getTime())).toBe(true)
-          expect({
-            source: value.regexp.source,
-            flags: value.regexp.flags,
-            lastIndex: value.regexp.lastIndex,
-          }).toEqual({ source: `wire`, flags: `giu`, lastIndex: 0 })
-          expect(value.buffer).toBeInstanceOf(ArrayBuffer)
-          expect(value.view).toBeInstanceOf(DataView)
-          expect(value.typed).toBeInstanceOf(Uint16Array)
-          expect(Array.from(new Uint8Array(value.buffer))).toEqual(
-            Array.from(new Uint8Array(richValue.buffer)),
-          )
-          expect({
-            byteOffset: value.view.byteOffset,
-            byteLength: value.view.byteLength,
-          }).toEqual({ byteOffset: 2, byteLength: 4 })
-          expect(Array.from(value.typed)).toEqual([17, 42])
-          expect(value.view.buffer).toBe(value.buffer)
-          expect(value.typed.buffer).toBe(value.buffer)
-          expect(value.typedArrays).toHaveLength(typedArrays.length)
-          for (let index = 0; index < typedArrays.length; index++) {
-            const actual = value.typedArrays[index]!
-            const expected = typedArrays[index]!
-            expect(actual.constructor).toBe(expected.constructor)
-            expect(actual.byteOffset).toBe(expected.byteOffset)
-            expect(actual.byteLength).toBe(expected.byteLength)
-            expect(
-              Array.from(
-                new Uint8Array(
-                  actual.buffer,
-                  actual.byteOffset,
-                  actual.byteLength,
-                ),
-              ),
-            ).toEqual(
-              Array.from(
-                new Uint8Array(
-                  expected.buffer,
-                  expected.byteOffset,
-                  expected.byteLength,
-                ),
-              ),
-            )
-          }
-          expect(value.map).toBeInstanceOf(Map)
-          expect(value.set).toBeInstanceOf(Set)
-          expect(value.first).toBe(value.second)
-          expect([...value.map.keys()]).toEqual([value.first])
-          expect(value.map.get(value.first)).toBe(value.cycle)
-          expect(value.set.has(value.first)).toBe(true)
-          expect(value.set.has(value.cycle)).toBe(true)
-          expect(value.cycle.self).toBe(value.cycle)
-          expect(0 in value.sparse).toBe(false)
-          expect(1 in value.sparse).toBe(true)
-          expect(2 in value.sparse).toBe(false)
-          expect(Object.getPrototypeOf(value.reservedKeys)).toBe(
-            Object.prototype,
-          )
-          expect(
-            Object.getOwnPropertyDescriptor(value.reservedKeys, `__proto__`),
-          ).toMatchObject({
-            value: { label: `own __proto__ value` },
-            enumerable: true,
-            writable: true,
-            configurable: true,
-          })
-          expect(value.reservedKeys.constructor).toBe(`own constructor value`)
-          if (routeIndex === 0) {
-            const local = decoded as TransportedLoadSubsetOptions &
-              Pick<LoadSubsetOptions, `signal` | `subscription`>
-            expect(local.signal).toBe(options.signal)
-            expect(local.subscription).toBe(options.subscription)
-          } else {
-            expect(decoded).not.toHaveProperty(`signal`)
-            expect(decoded).not.toHaveProperty(`subscription`)
-          }
-        }
-        // Both routes validate immutable request data. Only process-local
-        // delivery retains live lifecycle references.
-        expect(received[1]).not.toBe(options)
-
-        await leader.requestReleaseRemoteSubset(`todos`, options)
-        await follower.requestReleaseRemoteSubset(`todos`, options)
-        expect(unloadSubset.mock.calls).toHaveLength(received.length)
-        for (const [index, [value]] of unloadSubset.mock.calls.entries())
-          expect(value).toBe(received[index])
-      } finally {
-        unregisterOwner()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`direct leader requests await the registered collection owner`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-
-      let releaseOwner = (): void => {}
-      const owner = withUnusedUnloadSubset(
-        vi.fn(
-          () =>
-            new Promise<void>((resolve) => {
-              releaseOwner = resolve
-            }),
-        ),
-      )
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-
-      try {
-        let settled = false
-        const request = coordinator
-          .requestEnsureRemoteSubset(`todos`, { limit: 2, offset: 1 })
-          .then(() => {
-            settled = true
-          })
-        await Promise.resolve()
-        const beforeRelease = { ownerCalls: owner.mock.calls.length, settled }
-
-        releaseOwner()
-        await request
-
-        expect(beforeRelease).toEqual({ ownerCalls: 1, settled: false })
-        expect(owner).toHaveBeenCalledWith({ limit: 2, offset: 1 })
-      } finally {
-        releaseOwner()
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`preserves the receiver of an explicitly registered adapter owner`, async () => {
-      const receivers: Array<unknown> = []
-      const leaderAdapter = createStubAdapter() as ReturnType<
-        typeof createStubAdapter
-      > & {
-        ensureRemoteSubset: (
-          collectionId: string,
-          options: { limit?: number },
-        ) => Promise<void>
-      }
-      leaderAdapter.ensureRemoteSubset = function (
-        this: typeof leaderAdapter,
-        _collectionId,
-        _options,
-      ) {
-        receivers.push(this)
-        return Promise.resolve()
-      }
-      const leader = createCoordinator(leaderAdapter)
-      const follower = createCoordinator()
-      const owner = withUnusedUnloadSubset(
-        vi.fn((options: TransportedLoadSubsetOptions) =>
-          leaderAdapter.ensureRemoteSubset(`todos`, options),
-        ),
-      )
-      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      try {
-        await follower.requestEnsureRemoteSubset(`todos`, { limit: 1 })
-        expect(receivers).toEqual([leaderAdapter])
-      } finally {
-        unregisterOwner()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`scopes a reused subset options object to each Browser collection`, async () => {
-      const coordinator = createCoordinator()
-      const alpha = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const beta = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const unregisterAlpha = coordinator.registerRemoteSubsetOwner(
-        `alpha`,
-        alpha,
-      )
-      const unregisterBeta = coordinator.registerRemoteSubsetOwner(`beta`, beta)
-      coordinator.subscribe(`alpha`, () => {})
-      coordinator.subscribe(`beta`, () => {})
-      await flush(50)
-      expect({
-        alpha: coordinator.isLeader(`alpha`),
-        beta: coordinator.isLeader(`beta`),
-      }).toEqual({ alpha: true, beta: true })
-
-      const shared: LoadSubsetOptions = { limit: 2, offset: 1 }
-      try {
-        await coordinator.requestEnsureRemoteSubset(`alpha`, shared)
-        await coordinator.requestEnsureRemoteSubset(`beta`, shared)
-        await coordinator.requestEnsureRemoteSubset(`alpha`, shared)
-
-        const afterAcquire = {
-          alphaLoads: alpha.mock.calls.length,
-          betaLoads: beta.mock.calls.length,
-        }
-        await coordinator.requestReleaseRemoteSubset(`alpha`, shared)
-        await coordinator.requestReleaseRemoteSubset(`beta`, shared)
-
-        expect({
-          afterAcquire,
-          alphaUnloads: alpha.unloadSubset.mock.calls.length,
-          betaUnloads: beta.unloadSubset.mock.calls.length,
-        }).toEqual({
-          afterAcquire: { alphaLoads: 1, betaLoads: 1 },
-          alphaUnloads: 1,
-          betaUnloads: 1,
-        })
-      } finally {
-        unregisterAlpha()
-        unregisterBeta()
-        coordinator.dispose()
-      }
-    })
-
-    it(`replays after an earlier Browser leader responds behind a new heartbeat`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      let releaseOwner = (): void => {}
-      const owner = withUnusedUnloadSubset(
-        vi.fn(
-          () =>
-            new Promise<void>((resolve) => {
-              releaseOwner = resolve
-            }),
-        ),
-      )
-      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-      expect({
-        leader: leader.isLeader(`todos`),
-        follower: follower.isLeader(`todos`),
-      }).toEqual({ leader: true, follower: false })
-
-      const leaderInternals = leader as unknown as {
-        nodeId: string
-        channel: { postMessage: (message: unknown) => void }
-      }
-      const followerInternals = follower as unknown as {
-        onChannelMessage: (message: unknown) => void
-        outboundRemoteSubsetAcquisitions: Map<
-          string,
-          { acquiredLeaderId: string | null }
-        >
-      }
-      const originalLeaderPost = leaderInternals.channel.postMessage.bind(
-        leaderInternals.channel,
-      )
-      let heldResponse: unknown
-      leaderInternals.channel.postMessage = (message) => {
-        const type = (message as { payload?: { type?: string } }).payload?.type
-        if (type === `rpc:ensureRemoteSubset:res`) {
-          heldResponse = structuredClone(message)
-          return
-        }
-        originalLeaderPost(message)
-      }
-      let requestPosts = 0
-      observeBroadcastMessage = (message) => {
-        if (
-          (message as { payload?: { type?: string } }).payload?.type ===
-          `rpc:ensureRemoteSubset:req`
-        ) {
-          requestPosts++
-        }
-      }
-
-      try {
-        const request = follower.requestEnsureRemoteSubset(`todos`, {
-          limit: 1,
-        })
-        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
-
-        followerInternals.onChannelMessage({
-          v: 1,
-          dbName: `test-db`,
-          collectionId: `todos`,
-          senderId: `replacement-browser-leader`,
-          ts: Date.now(),
-          payload: {
-            type: `leader:heartbeat`,
-            term: 2,
-            leaderId: `replacement-browser-leader`,
-            latestSeq: 0,
-            latestRowVersion: 0,
-          },
-        })
-        releaseOwner()
-        await vi.waitFor(() => expect(heldResponse).toBeDefined())
-        leader.isLeader = () => false
-        followerInternals.onChannelMessage(heldResponse)
-        await request
-        await flush()
-
-        const [acquisition] =
-          followerInternals.outboundRemoteSubsetAcquisitions.values()
-        expect({
-          requestPosts,
-          acquiredLeaderId: acquisition?.acquiredLeaderId,
-        }).toEqual({
-          requestPosts: 2,
-          acquiredLeaderId: leaderInternals.nodeId,
-        })
-      } finally {
-        observeBroadcastMessage = undefined
-        releaseOwner()
-        unregisterOwner()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`establishes replacement Browser acquisitions for retained demand after an A to B to A leader cycle`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      let releaseFirstLoad = (): void => {}
-      const firstLoadGate = new Promise<void>((resolve) => {
-        releaseFirstLoad = resolve
-      })
-      const owner = Object.assign(
-        vi.fn().mockImplementationOnce(() => firstLoadGate),
-        { unloadSubset: vi.fn(), onError: vi.fn() },
-      )
-      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-      const leaderInternals = leader as unknown as {
-        nodeId: string
-        channel: { postMessage: (message: unknown) => void }
-        inboundRemoteSubsetAcquisitions: Map<string, unknown>
-        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
-      }
-      const followerInternals = follower as unknown as {
-        onChannelMessage: (message: unknown) => void
-        outboundRemoteSubsetAcquisitions: Map<
-          string,
-          { acquiredLeaderId: string | null }
-        >
-      }
-      const originalLeaderPost = leaderInternals.channel.postMessage.bind(
-        leaderInternals.channel,
-      )
-      let heldResponse: unknown
-      leaderInternals.channel.postMessage = (message) => {
-        const type = (message as { payload?: { type?: string } }).payload?.type
-        if (
-          type === `rpc:ensureRemoteSubset:res` &&
-          heldResponse === undefined
-        ) {
-          heldResponse = structuredClone(message)
-          return
-        }
-        originalLeaderPost(message)
-      }
-      let requestPosts = 0
-      const wireRequests: Array<{
-        acquisitionId: string
-        rpcId: string
-      }> = []
-      observeBroadcastMessage = (message) => {
-        const payload = (
-          message as {
-            payload?: {
-              type?: string
-              acquisitionId?: string
-              rpcId?: string
-            }
-          }
-        ).payload
-        if (payload?.type === `rpc:ensureRemoteSubset:req`) {
-          requestPosts++
-          wireRequests.push({
-            acquisitionId: payload.acquisitionId!,
-            rpcId: payload.rpcId!,
-          })
-        }
-      }
-      const heartbeat = (leaderId: string, term: number) => ({
-        v: 1,
-        dbName: `test-db`,
-        collectionId: `todos`,
-        senderId: leaderId,
-        ts: Date.now(),
-        payload: {
-          type: `leader:heartbeat`,
-          term,
-          leaderId,
-          latestSeq: 0,
-          latestRowVersion: 0,
-        },
-      })
-      const options: LoadSubsetOptions = { limit: 1 }
-
-      try {
-        const request = follower.requestEnsureRemoteSubset(`todos`, options)
-        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
-        followerInternals.onChannelMessage(
-          heartbeat(`replacement-browser-leader`, 2),
-        )
-        leaderInternals.releaseInboundRemoteSubsetAcquisitions(`todos`)
-        followerInternals.onChannelMessage(heartbeat(leaderInternals.nodeId, 3))
-        releaseFirstLoad()
-        await vi.waitFor(() => expect(heldResponse).toBeDefined())
-        followerInternals.onChannelMessage(heldResponse)
-        await request
-        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(2))
-
-        const [acquisition] =
-          followerInternals.outboundRemoteSubsetAcquisitions.values()
-        expect({
-          requestPosts,
-          loads: owner.mock.calls.length,
-          unloads: owner.unloadSubset.mock.calls.length,
-          inbound: leaderInternals.inboundRemoteSubsetAcquisitions.size,
-          acquiredLeaderId: acquisition?.acquiredLeaderId,
-        }).toEqual({
-          requestPosts: 2,
-          loads: 2,
-          unloads: 1,
-          inbound: 1,
-          acquiredLeaderId: leaderInternals.nodeId,
-        })
-        expect(wireRequests).toHaveLength(2)
-        expect(wireRequests[0]!.acquisitionId).not.toBe(``)
-        expect(wireRequests[1]!.acquisitionId).toBe(
-          wireRequests[0]!.acquisitionId,
-        )
-        expect(wireRequests[1]!.rpcId).not.toBe(wireRequests[0]!.rpcId)
-
-        await follower.requestReleaseRemoteSubset(`todos`, options)
-        expect(owner.unloadSubset).toHaveBeenCalledTimes(2)
-      } finally {
-        observeBroadcastMessage = undefined
-        releaseFirstLoad()
-        unregisterOwner()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`contains a failed Browser replay without fail-stopping the owner`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      const replayError = new Error(`replacement owner is not ready`)
-      const ownerErrors: Array<unknown> = []
-      const owner = Object.assign(
-        vi
-          .fn()
-          .mockResolvedValueOnce(undefined)
-          .mockRejectedValueOnce(replayError),
-        {
-          unloadSubset: vi.fn(),
-          onError: (error: unknown) => ownerErrors.push(error),
-        },
-      )
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      const options: LoadSubsetOptions = { limit: 1 }
-      await coordinator.requestEnsureRemoteSubset(`todos`, options)
-      type Acquisition = {
-        acquiredLeaderId: string | null
-        inFlight: Promise<void> | null
-      }
-      const internals = coordinator as unknown as {
-        outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
-        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
-        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
-      }
-      const [acquisition] = internals.outboundRemoteSubsetAcquisitions.values()
-      internals.releaseInboundRemoteSubsetAcquisitions(`todos`)
-      await vi.waitFor(() =>
-        expect(owner.unloadSubset).toHaveBeenCalledTimes(1),
-      )
-      acquisition!.acquiredLeaderId = `retired-browser-leader`
-      const unhandled: Array<unknown> = []
-      const onUnhandled = (error: unknown) => unhandled.push(error)
-      process.on(`unhandledRejection`, onUnhandled)
-
-      try {
-        await internals.replayRemoteSubsetAcquisitions(`todos`)
-        await flush()
-        expect({
-          attempts: owner.mock.calls.length - 1,
-          ownerErrors,
-          acquiredLeaderId: acquisition!.acquiredLeaderId,
-          inFlight: acquisition!.inFlight,
-          unhandled,
-        }).toEqual({
-          attempts: 1,
-          ownerErrors: [],
-          acquiredLeaderId: `retired-browser-leader`,
-          inFlight: null,
-          unhandled: [],
-        })
-      } finally {
-        process.off(`unhandledRejection`, onUnhandled)
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`keeps a failed remote Browser follower replay out of its local owner lifecycle`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      const internals = coordinator as unknown as {
-        onChannelMessage: (message: unknown) => void
-        sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
-        outboundRemoteSubsetAcquisitions: Map<
-          string,
-          { acquiredLeaderId: string | null; inFlight: Promise<void> | null }
-        >
-      }
-      coordinator.isLeader = () => false
-      const heartbeat = (leaderId: string, term: number) =>
-        internals.onChannelMessage({
-          v: 1,
-          dbName: `test-db`,
-          collectionId: `todos`,
-          senderId: leaderId,
-          ts: Date.now(),
-          payload: {
-            type: `leader:heartbeat`,
-            term,
-            leaderId,
-            latestSeq: 0,
-            latestRowVersion: 0,
-          },
-        })
-      heartbeat(`remote-browser-a`, 1)
-      const ownerErrors: Array<unknown> = []
-      const owner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: (error: unknown) => ownerErrors.push(error),
-      })
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      internals.sendRPC = vi.fn().mockResolvedValue({
-        type: `rpc:ensureRemoteSubset:res`,
-        rpcId: `initial-browser`,
-        ok: true,
-        leaderId: `remote-browser-a`,
-      })
-      const options: LoadSubsetOptions = { limit: 1 }
-
-      try {
-        await coordinator.requestEnsureRemoteSubset(`todos`, options)
-        const replayError = new Error(`remote Browser replay transport failed`)
-        const replayRPC = vi.fn().mockRejectedValue(replayError)
-        internals.sendRPC = replayRPC
-        heartbeat(`remote-browser-b`, 2)
-        await vi.waitFor(() => expect(replayRPC).toHaveBeenCalledTimes(1))
-        await vi.waitFor(() => {
-          const [acquisition] =
-            internals.outboundRemoteSubsetAcquisitions.values()
-          expect(acquisition?.inFlight).toBeNull()
-        })
-
-        const [acquisition] =
-          internals.outboundRemoteSubsetAcquisitions.values()
-        expect({
-          ownerErrors,
-          attempts: replayRPC.mock.calls.length,
-          acquiredLeaderId: acquisition?.acquiredLeaderId,
-          retained: internals.outboundRemoteSubsetAcquisitions.size,
-        }).toEqual({
-          ownerErrors: [],
-          attempts: 1,
-          acquiredLeaderId: `remote-browser-a`,
-          retained: 1,
-        })
-      } finally {
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`expires Browser release tombstones after the existing RPC dedupe horizon`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-      const owner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      const now = vi.spyOn(Date, `now`)
-      const internals = coordinator as unknown as {
-        inboundRemoteSubsetAcquisitions: Map<string, unknown>
-      }
-
-      try {
-        for (let index = 0; index < 8; index++) {
-          now.mockReturnValue(index * 60_001)
-          const options = { offset: index }
-          await coordinator.requestEnsureRemoteSubset(`todos`, options)
-          await coordinator.requestReleaseRemoteSubset(`todos`, options)
-        }
-
-        expect({
-          loads: owner.mock.calls.length,
-          unloads: owner.unloadSubset.mock.calls.length,
-          retained: internals.inboundRemoteSubsetAcquisitions.size,
-        }).toEqual({ loads: 8, unloads: 8, retained: 1 })
-      } finally {
-        now.mockRestore()
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`ignores a lower-term Browser heartbeat without replaying to its stale leader`, async () => {
-      // Another holder keeps the leader lock, so this coordinator follows.
-      let releaseHolder!: () => void
-      await new Promise<void>((acquired) => {
-        void navigator.locks.request(`tsdb:leader:test-db:todos`, () => {
-          acquired()
-          return new Promise<void>((resolve) => {
-            releaseHolder = resolve
-          })
-        })
-      })
-      const coordinator = createCoordinator()
-      let forwardedHeartbeats = 0
-      coordinator.subscribe(`todos`, (message) => {
-        if (
-          (message.payload as { type?: unknown }).type === `leader:heartbeat`
-        ) {
-          forwardedHeartbeats++
-        }
-      })
-      const internals = coordinator as unknown as {
-        onChannelMessage: (message: unknown) => void
-        collections: Map<
-          string,
-          { leaderId: string | null; latestTerm: number }
-        >
-        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
-      }
-      const replay = vi.fn(() => Promise.resolve())
-      internals.replayRemoteSubsetAcquisitions = replay
-      const heartbeat = (leaderId: string, term: number) =>
-        internals.onChannelMessage({
-          v: 1,
-          dbName: `test-db`,
-          collectionId: `todos`,
-          senderId: leaderId,
-          ts: Date.now(),
-          payload: {
-            type: `leader:heartbeat`,
-            term,
-            leaderId,
-            latestSeq: 0,
-            latestRowVersion: 0,
-          },
-        })
-
-      try {
-        heartbeat(`remote-browser-b`, 2)
-        replay.mockClear()
-        heartbeat(`retired-browser-a`, 1)
-        const state = internals.collections.get(`todos`)
-
-        expect({
-          leaderId: state?.leaderId,
-          latestTerm: state?.latestTerm,
-          replayCalls: replay.mock.calls.length,
-          forwardedHeartbeats,
-        }).toEqual({
-          leaderId: `remote-browser-b`,
-          latestTerm: 2,
-          replayCalls: 0,
-          forwardedHeartbeats: 1,
-        })
-      } finally {
-        coordinator.dispose()
-        releaseHolder()
-      }
-    })
-
-    it(`establishes a replacement Browser acquisition for retained demand when its owner changes`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-      let releaseFirstLoad = (): void => {}
-      const firstLoadGate = new Promise<void>((resolve) => {
-        releaseFirstLoad = resolve
-      })
-      const firstOwner = Object.assign(
-        vi.fn(() => firstLoadGate),
-        {
-          unloadSubset: vi.fn(),
-          onError: vi.fn(),
-        },
-      )
-      const secondOwner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(
-          (_options: TransportedLoadSubsetOptions) => undefined,
-        ),
-        onError: vi.fn(),
-      })
-      const unregisterFirst = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        firstOwner,
-      )
-      let unregisterSecond: (() => void) | undefined
-      const options: LoadSubsetOptions = { limit: 1 }
-
-      try {
-        const initialAcquire = coordinator.requestEnsureRemoteSubset(
-          `todos`,
-          options,
-        )
-        await vi.waitFor(() => expect(firstOwner).toHaveBeenCalledTimes(1))
-        unregisterFirst()
-        unregisterSecond = coordinator.registerRemoteSubsetOwner(
-          `todos`,
-          secondOwner,
-        )
-        releaseFirstLoad()
-        await initialAcquire
-        await vi.waitFor(() => expect(secondOwner).toHaveBeenCalledTimes(1))
-
-        expect(firstOwner.unloadSubset).toHaveBeenCalledTimes(1)
-        await coordinator.requestReleaseRemoteSubset(`todos`, options)
-        expect(secondOwner.unloadSubset).toHaveBeenCalledTimes(1)
-      } finally {
-        releaseFirstLoad()
-        unregisterFirst()
-        unregisterSecond?.()
-        coordinator.dispose()
-      }
-    })
-
-    it(`establishes a replacement remote Browser acquisition for retained follower demand when the same leader changes owners`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-      expect({
-        leader: leader.isLeader(`todos`),
-        follower: follower.isLeader(`todos`),
-      }).toEqual({ leader: true, follower: false })
-      let releaseFirstLoad = (): void => {}
-      const firstLoadGate = new Promise<void>((resolve) => {
-        releaseFirstLoad = resolve
-      })
-      const firstOwner = Object.assign(
-        vi.fn(() => firstLoadGate),
-        {
-          unloadSubset: vi.fn(),
-          onError: vi.fn(),
-        },
-      )
-      const secondOwner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const unregisterFirst = leader.registerRemoteSubsetOwner(
-        `todos`,
-        firstOwner,
-      )
-      let unregisterSecond: (() => void) | undefined
-      const options: LoadSubsetOptions = { limit: 1 }
-      let requestPosts = 0
-      observeBroadcastMessage = (message) => {
-        if (
-          (message as { payload?: { type?: string } }).payload?.type ===
-          `rpc:ensureRemoteSubset:req`
-        ) {
-          requestPosts++
-        }
-      }
-
-      try {
-        const initialAcquire = follower.requestEnsureRemoteSubset(
-          `todos`,
-          options,
-        )
-        await vi.waitFor(() => expect(firstOwner).toHaveBeenCalledTimes(1))
-        unregisterFirst()
-        unregisterSecond = leader.registerRemoteSubsetOwner(
-          `todos`,
-          secondOwner,
-        )
-        releaseFirstLoad()
-        await initialAcquire
-        await vi.waitFor(() => expect(secondOwner).toHaveBeenCalledTimes(1))
-
-        expect({
-          requestPosts,
-          firstUnloads: firstOwner.unloadSubset.mock.calls.length,
-        }).toEqual({ requestPosts: 1, firstUnloads: 1 })
-        await follower.requestReleaseRemoteSubset(`todos`, options)
-        expect(secondOwner.unloadSubset).toHaveBeenCalledTimes(1)
-      } finally {
-        observeBroadcastMessage = undefined
-        releaseFirstLoad()
-        unregisterFirst()
-        unregisterSecond?.()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`rebinds remote Browser demand when its replacement owner registers after release settlement`, async () => {
-      const leader = createCoordinator()
-      const follower = createCoordinator()
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-      expect({
-        leader: leader.isLeader(`todos`),
-        follower: follower.isLeader(`todos`),
-      }).toEqual({ leader: true, follower: false })
-      const firstOwner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const secondOwner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const unregisterFirst = leader.registerRemoteSubsetOwner(
-        `todos`,
-        firstOwner,
-      )
-      let unregisterSecond: (() => void) | undefined
-      const options: LoadSubsetOptions = { offset: 22 }
-      const leaderInternals = leader as unknown as {
-        inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
-      }
-
-      try {
-        await follower.requestEnsureRemoteSubset(`todos`, options)
-        unregisterFirst()
-        await vi.waitFor(() =>
-          expect(firstOwner.unloadSubset).toHaveBeenCalledTimes(1),
-        )
-        await flush(0)
-
-        unregisterSecond = leader.registerRemoteSubsetOwner(
-          `todos`,
-          secondOwner,
-        )
-        await flush(0)
-
-        expect({
-          firstLoads: firstOwner.mock.calls.length,
-          firstUnloads: firstOwner.unloadSubset.mock.calls.length,
-          secondLoads: secondOwner.mock.calls.length,
-          inbound: leaderInternals.inboundRemoteSubsetAcquisitions.size,
-        }).toEqual({
-          firstLoads: 1,
-          firstUnloads: 1,
-          secondLoads: 1,
-          inbound: 1,
-        })
-
-        await follower.requestReleaseRemoteSubset(`todos`, options)
-        const [terminal] =
-          leaderInternals.inboundRemoteSubsetAcquisitions.values()
-        expect(secondOwner.unloadSubset).toHaveBeenCalledTimes(1)
-        expect(secondOwner.unloadSubset.mock.calls[0]?.[0]).toBe(
-          secondOwner.mock.calls[0]?.[0],
-        )
-        expect({
-          inbound: leaderInternals.inboundRemoteSubsetAcquisitions.size,
-          terminalKeys: Object.keys(terminal ?? {}).sort(),
-        }).toEqual({
-          inbound: 1,
-          terminalKeys: [
-            `acquisitionId`,
-            `collectionId`,
-            `released`,
-            `requesterId`,
-          ],
-        })
-      } finally {
-        unregisterFirst()
-        unregisterSecond?.()
-        leader.dispose()
-        follower.dispose()
-      }
-    })
-
-    it(`establishes a replacement Browser acquisition for retained demand after leadership retirement`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-      const owner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      const internals = coordinator as unknown as {
-        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
-      }
-      const options: LoadSubsetOptions = { limit: 1 }
-
-      try {
-        await coordinator.requestEnsureRemoteSubset(`todos`, options)
-        internals.releaseInboundRemoteSubsetAcquisitions(`todos`)
-        await vi.waitFor(() =>
-          expect(owner.unloadSubset).toHaveBeenCalledTimes(1),
-        )
-
-        await coordinator.requestEnsureRemoteSubset(`todos`, options)
-        expect(owner).toHaveBeenCalledTimes(2)
-        await coordinator.requestReleaseRemoteSubset(`todos`, options)
-        expect(owner.unloadSubset).toHaveBeenCalledTimes(2)
-      } finally {
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`retries retained Browser demand after a retryable replay failure`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-
-      type Acquisition = {
-        collectionId: string
-        acquisitionId: string
-        options: TransportedLoadSubsetOptions
-        acquiredLeaderId: string | null
-        inFlight: Promise<void> | null
-        forceReplay: boolean
-        retryTimer: ReturnType<typeof setTimeout> | null
-        retryAttempts: number
-      }
-      const acquisition: Acquisition = {
-        collectionId: `todos`,
-        acquisitionId: `retryable-browser-replay`,
-        options: { limit: 1 },
-        acquiredLeaderId: `retired-browser-leader`,
-        inFlight: null,
-        forceReplay: false,
-        retryTimer: null,
-        retryAttempts: 0,
-      }
-      const internals = coordinator as unknown as {
-        nodeId: string
-        outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
-        acquireRemoteSubset: (acquisition: Acquisition) => Promise<void>
-        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
-      }
-      internals.outboundRemoteSubsetAcquisitions.set(
-        JSON.stringify([acquisition.collectionId, acquisition.acquisitionId]),
-        acquisition,
-      )
-      let attempts = 0
-      internals.acquireRemoteSubset = vi.fn((current) => {
-        attempts++
-        if (attempts === 1) {
-          return Promise.reject(
-            new RetryableRemoteSubsetAcquisitionError(`offline`),
-          )
-        }
-        current.acquiredLeaderId = internals.nodeId
-        return Promise.resolve()
-      })
-
-      await internals.replayRemoteSubsetAcquisitions(`todos`)
-      expect(attempts).toBe(1)
-      await vi.waitFor(() => expect(attempts).toBe(2))
-    })
-
-    it.each([`release`, `dispose`] as const)(
-      `cancels a scheduled Browser replay retry on %s`,
-      async (stop) => {
-        const coordinator = createCoordinator()
-        coordinator.subscribe(`todos`, () => {})
-        await flush(50)
-
-        type Acquisition = {
-          collectionId: string
-          acquisitionId: string
-          options: TransportedLoadSubsetOptions
-          acquiredLeaderId: string | null
-          inFlight: Promise<void> | null
-          forceReplay: boolean
-          retryTimer: ReturnType<typeof setTimeout> | null
-          retryAttempts: number
-        }
-        const requestedOptions: LoadSubsetOptions = { limit: 1 }
-        const acquisition: Acquisition = {
-          collectionId: `todos`,
-          acquisitionId: `cancelled-browser-replay`,
-          options: { limit: 1 },
-          acquiredLeaderId: `retired-browser-leader`,
-          inFlight: null,
-          forceReplay: false,
-          retryTimer: null,
-          retryAttempts: 0,
-        }
-        const internals = coordinator as unknown as {
-          remoteSubsetIds: Map<string, WeakMap<LoadSubsetOptions, string>>
-          outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
-          acquireRemoteSubset: (acquisition: Acquisition) => Promise<void>
-          replayRemoteSubsetAcquisitions: (
-            collectionId: string,
-          ) => Promise<void>
-        }
-        internals.remoteSubsetIds.set(
-          `todos`,
-          new WeakMap([[requestedOptions, acquisition.acquisitionId]]),
-        )
-        internals.outboundRemoteSubsetAcquisitions.set(
-          JSON.stringify([acquisition.collectionId, acquisition.acquisitionId]),
-          acquisition,
-        )
-        let attempts = 0
-        internals.acquireRemoteSubset = vi.fn(() => {
-          attempts++
-          return Promise.reject(
-            new RetryableRemoteSubsetAcquisitionError(`offline`),
-          )
-        })
-
-        await internals.replayRemoteSubsetAcquisitions(`todos`)
-        expect(acquisition.retryTimer).not.toBeNull()
-        if (stop === `release`) {
-          await coordinator.requestReleaseRemoteSubset(
-            `todos`,
-            requestedOptions,
-          )
-        } else {
-          coordinator.dispose()
-        }
-        expect(acquisition.retryTimer).toBeNull()
-        await new Promise<void>((resolve) => setTimeout(resolve, 250))
-        expect(attempts).toBe(1)
-      },
-    )
-
-    it(`starts replacement Browser acquisitions without sibling head-of-line blocking`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      const owner = Object.assign(vi.fn(), {
-        unloadSubset: vi.fn(),
-        onError: vi.fn(),
-      })
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 1 })
-      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 2 })
-
-      type Acquisition = {
-        collectionId: string
-        options: TransportedLoadSubsetOptions
-        acquiredLeaderId: string | null
-      }
-      const internals = coordinator as unknown as {
-        outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
-        acquireRemoteSubset: (acquisition: Acquisition) => Promise<void>
-        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
-      }
-      const acquisitions = [
-        ...internals.outboundRemoteSubsetAcquisitions.values(),
-      ]
-      for (const acquisition of acquisitions) {
-        acquisition.acquiredLeaderId = `retired-browser-leader`
-      }
-      let releaseFirstReplay = (): void => {}
-      const firstReplayGate = new Promise<void>((resolve) => {
-        releaseFirstReplay = resolve
-      })
-      const starts: Array<number | undefined> = []
-      internals.acquireRemoteSubset = async (acquisition) => {
-        starts.push(acquisition.options.offset)
-        if (acquisition.options.offset === 1) await firstReplayGate
-      }
-
-      try {
-        const replay = internals.replayRemoteSubsetAcquisitions(`todos`)
-        await Promise.resolve()
-        const startsBeforeFirstFinished = [...starts]
-        expect(startsBeforeFirstFinished).toEqual([1, 2])
-        releaseFirstReplay()
-        await replay
-      } finally {
-        releaseFirstReplay()
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it(`reports owner unload rejection while completing sibling Browser cleanup`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      const unloadError = new Error(`browser owner unload failed`)
-      const ownerErrors: Array<unknown> = []
-      const unloadSubset = vi.fn((options: TransportedLoadSubsetOptions) =>
-        options.offset === 1 ? Promise.reject(unloadError) : undefined,
-      )
-      const owner = Object.assign(vi.fn(), {
-        unloadSubset,
-        onError: (error: unknown) => ownerErrors.push(error),
-      })
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 1 })
-      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 2 })
-      const unhandled: Array<unknown> = []
-      const onUnhandled = (error: unknown) => unhandled.push(error)
-      process.on(`unhandledRejection`, onUnhandled)
-      const internals = coordinator as unknown as {
-        inboundRemoteSubsetAcquisitions: Map<
-          string,
-          { release: Promise<void> | null }
-        >
-        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
-      }
-
-      try {
-        internals.releaseInboundRemoteSubsetAcquisitions(`todos`)
-        const releases = [
-          ...internals.inboundRemoteSubsetAcquisitions.values(),
-        ].map((acquisition) => acquisition.release!)
-        const outcomes = await Promise.allSettled(releases)
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-
-        expect({
-          outcomes: outcomes.map((outcome) =>
-            outcome.status === `rejected` ? outcome.reason : outcome.status,
-          ),
-          unloadOffsets: unloadSubset.mock.calls.map(
-            ([options]) => options.offset,
-          ),
-          ownerErrors,
-          unhandled,
-        }).toEqual({
-          outcomes: [unloadError, `fulfilled`],
-          unloadOffsets: [1, 2],
-          ownerErrors: [unloadError],
-          unhandled: [],
-        })
-      } finally {
-        process.off(`unhandledRejection`, onUnhandled)
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
-
-    it.each([
-      { failureMode: `synchronous throw` as const },
-      { failureMode: `asynchronous rejection` as const },
-    ])(
-      `retires a terminal owner release after reporting one $failureMode`,
-      async ({ failureMode }) => {
-        // Previous cleanup laws observed and reported unload rejection, but
-        // never repeated the same terminal caller release. The owner receives
-        // one release attempt; after it reports failure the logical demand is
-        // terminal and must not replay or accrue retry debt here.
-        const coordinator = createCoordinator()
-        coordinator.subscribe(`todos`, () => {})
-        await flush(50)
-        const unloadError = new Error(`transient Browser owner unload failure`)
-        const ownerErrors: Array<unknown> = []
-        let unloadAttempts = 0
-        const owner = Object.assign(vi.fn(), {
-          unloadSubset: vi.fn(() => {
-            unloadAttempts++
-            if (unloadAttempts !== 1) return undefined
-            if (failureMode === `synchronous throw`) throw unloadError
-            return Promise.reject(unloadError)
-          }),
-          onError: (error: unknown) => ownerErrors.push(error),
-        })
-        const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-          `todos`,
-          owner,
-        )
-        const options: LoadSubsetOptions = { offset: 41 }
-        const internals = coordinator as unknown as {
-          outboundRemoteSubsetAcquisitions: Map<string, unknown>
-          replayRemoteSubsetAcquisitions: (
-            collectionId: string,
-          ) => Promise<void>
-        }
-
-        try {
-          await coordinator.requestEnsureRemoteSubset(`todos`, options)
-          await expect(
-            coordinator.requestReleaseRemoteSubset(`todos`, options),
-          ).rejects.toBe(unloadError)
-
-          await expect(
-            coordinator.requestReleaseRemoteSubset(`todos`, options),
-          ).resolves.toBeUndefined()
-          await internals.replayRemoteSubsetAcquisitions(`todos`)
-          expect({ unloadAttempts, ownerErrors }).toEqual({
-            unloadAttempts: 1,
-            ownerErrors: [unloadError],
-          })
-          expect(internals.outboundRemoteSubsetAcquisitions.size).toBe(0)
-          expect(owner).toHaveBeenCalledTimes(1)
-        } finally {
-          unregisterOwner()
-          coordinator.dispose()
-        }
-      },
-    )
+ *
+ * Fixed scenarios with literal expectations live in
+ * `browser-coordinator.test.ts`. That includes the per-election need cells,
+ * whose expected posts come from a written need table; an oracle owner for
+ * them is tracked in TanStack/db#2264. This file keeps the generated histories.
+ */
 
-    it(`reports local Browser disposal unload rejection once and completes cleanup`, async () => {
-      const coordinator = createCoordinator()
-      coordinator.subscribe(`todos`, () => {})
-      await flush(50)
-      expect(coordinator.isLeader(`todos`)).toBe(true)
-      const unloadError = new Error(`browser disposal unload failed`)
-      const ownerErrors: Array<unknown> = []
-      const unloadSubset = vi.fn((options: TransportedLoadSubsetOptions) =>
-        options.offset === 23 ? Promise.reject(unloadError) : undefined,
-      )
-      const owner = Object.assign(vi.fn(), {
-        unloadSubset,
-        onError: (error: unknown) => ownerErrors.push(error),
-      })
-      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-        `todos`,
-        owner,
-      )
-      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 23 })
-      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 24 })
-      const unhandled: Array<unknown> = []
-      const onUnhandled = (error: unknown) => unhandled.push(error)
-      process.on(`unhandledRejection`, onUnhandled)
-      const internals = coordinator as unknown as {
-        collections: Map<string, unknown>
-        pendingRPCs: Map<string, unknown>
-        remoteSubsetOwners: Map<string, unknown>
-        outboundRemoteSubsetAcquisitions: Map<string, unknown>
-        inboundRemoteSubsetAcquisitions: Map<string, unknown>
-      }
+import fc from 'fast-check'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  bindTransportControls,
+  cleanupGlobals,
+  createCoordinator,
+  createDeferred,
+  createStubAdapter,
+  flush,
+  inspectCoordinator,
+  installGlobals,
+  liveCoordinators,
+} from './browser-coordinator-support'
 
-      try {
-        coordinator.dispose()
-        await flush(0)
+let dropNextMessageWhen: ((data: unknown) => boolean) | undefined
+let observePostedMessage: ((data: unknown) => void) | undefined
+let dropNextBroadcastMessage: ((data: unknown) => boolean) | undefined
+let duplicateNextBroadcastMessage:
+  ((data: unknown) => unknown | undefined) | undefined
+let observeBroadcastMessage: ((data: unknown) => void) | undefined
+// The mock in browser-coordinator-support.ts reads and clears these transport
+// controls. The binding lets this file's tests assign them directly.
+bindTransportControls({
+  get dropNextMessageWhen() {
+    return dropNextMessageWhen
+  },
+  set dropNextMessageWhen(value) {
+    dropNextMessageWhen = value
+  },
+  get observePostedMessage() {
+    return observePostedMessage
+  },
+  set observePostedMessage(value) {
+    observePostedMessage = value
+  },
+  get dropNextBroadcastMessage() {
+    return dropNextBroadcastMessage
+  },
+  set dropNextBroadcastMessage(value) {
+    dropNextBroadcastMessage = value
+  },
+  get duplicateNextBroadcastMessage() {
+    return duplicateNextBroadcastMessage
+  },
+  set duplicateNextBroadcastMessage(value) {
+    duplicateNextBroadcastMessage = value
+  },
+  get observeBroadcastMessage() {
+    return observeBroadcastMessage
+  },
+  set observeBroadcastMessage(value) {
+    observeBroadcastMessage = value
+  },
+})
 
-        expect({
-          unloadOffsets: unloadSubset.mock.calls.map(
-            ([options]) => options.offset,
-          ),
-          ownerErrors,
-          unhandled,
-          collections: internals.collections.size,
-          pendingRPCs: internals.pendingRPCs.size,
-          owners: internals.remoteSubsetOwners.size,
-          outbound: internals.outboundRemoteSubsetAcquisitions.size,
-          inbound: internals.inboundRemoteSubsetAcquisitions.size,
-          channelEndpoints: channels.get(`tsdb:coord:test-db`)?.size ?? 0,
-        }).toEqual({
-          unloadOffsets: [23, 24],
-          ownerErrors: [unloadError],
-          unhandled: [],
-          collections: 0,
-          pendingRPCs: 0,
-          owners: 0,
-          outbound: 0,
-          inbound: 0,
-          channelEndpoints: 0,
-        })
-      } finally {
-        process.off(`unhandledRejection`, onUnhandled)
-        unregisterOwner()
-        coordinator.dispose()
-      }
-    })
+describe(`BrowserCollectionCoordinator`, () => {
+  beforeEach(() => {
+    installGlobals()
   })
 
-  describe(`RPC - pullSince`, () => {
-    it(`leader handles pullSince directly`, async () => {
-      const adapter = createStubAdapter()
-      const coord = createCoordinator(adapter)
-      coord.subscribe(`todos`, () => {})
-      await flush(50)
-
-      const response = await coord.pullSince(`todos`, 0)
-
-      expect(response.ok).toBe(true)
-      if (response.ok) {
-        expect(response.requiresFullReload).toBe(false)
-      }
-
-      coord.dispose()
-    })
-
-    it(`follower routes pullSince to leader`, async () => {
-      const adapter = createStubAdapter()
-      adapter.pullSince = vi.fn().mockResolvedValue({
-        latestRowVersion: 5,
-        requiresFullReload: false,
-        changedKeys: [`key-1`],
-        deletedKeys: [],
-      })
-
-      const leader = createCoordinator(adapter)
-      const follower = createCoordinator(adapter)
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      const response = await follower.pullSince(`todos`, 0)
-
-      expect(response.ok).toBe(true)
-      if (response.ok && !response.requiresFullReload) {
-        expect(response.changedKeys).toEqual([`key-1`])
-        expect(response.latestRowVersion).toBe(5)
-      }
-
-      leader.dispose()
-      follower.dispose()
-    })
+  afterEach(async () => {
+    for (const coordinator of liveCoordinators) coordinator.dispose()
+    liveCoordinators.clear()
+    await flush(0)
+    cleanupGlobals()
   })
-
-  describe(`RPC - ensurePersistedIndex`, () => {
-    it(`leader ensures index locally`, async () => {
-      const adapter = createStubAdapter()
-      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-
-      const coord = createCoordinator(adapter)
-      coord.subscribe(`todos`, () => {})
-      await flush(50)
-
-      await coord.requestEnsurePersistedIndex(`todos`, `idx-1`, {
-        expressionSql: [`title`],
-      })
-
-      expect(adapter.ensureIndex).toHaveBeenCalledWith(
-        { kind: `eager`, collectionId: `todos` },
-        `idx-1`,
-        {
-          expressionSql: [`title`],
-        },
-      )
-
-      coord.dispose()
-    })
-
-    it(`follower routes ensurePersistedIndex to leader`, async () => {
-      const adapter = createStubAdapter()
-      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-
-      const leader = createCoordinator(adapter)
-      const follower = createCoordinator(adapter)
-
-      leader.subscribe(`todos`, () => {})
-      follower.subscribe(`todos`, () => {})
-      await flush(50)
-
-      await follower.requestEnsurePersistedIndex(`todos`, `idx-2`, {
-        expressionSql: [`id`],
-      })
-
-      expect(adapter.ensureIndex).toHaveBeenCalled()
-
-      leader.dispose()
-      follower.dispose()
-    })
-
-    it(`does not repeat successful leader-local index creation`, async () => {
-      const adapter = createStubAdapter()
-      let leadershipRead!: () => void
-      const leadershipReadPromise = new Promise<void>((resolve) => {
-        leadershipRead = resolve
-      })
-      adapter.getStreamPosition = async () => {
-        leadershipRead()
-        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-      }
-      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-
-      const coord = createCoordinator(adapter)
-      try {
-        coord.subscribe(`todos`, () => {})
-        await leadershipReadPromise
-        await vi.waitFor(() => expect(coord.isLeader(`todos`)).toBe(true))
-
-        const spec = { expressionSql: [`title`] }
-        await adapter.ensureIndex(
-          { kind: `eager`, collectionId: `todos` },
-          `idx-once`,
-          spec,
-        )
-        await coord.requestEnsurePersistedIndex(
-          `todos`,
-          `idx-once`,
-          spec,
-          adapter,
-          true,
-        )
-
-        expect(adapter.ensureIndex).toHaveBeenCalledOnce()
-      } finally {
-        coord.dispose()
-      }
-    })
-
-    it(`keeps production collection bootstrap index work exact-once on the leader`, async () => {
-      const adapter = createStubAdapter()
-      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-      const coordinator = createCoordinator(adapter)
-      const leaderReady = createDeferred()
-      observePostedMessage = (data) => {
-        const envelope = data as {
-          collectionId?: string
-          payload?: { type?: string }
-        }
-        if (
-          envelope.collectionId === `leader-bootstrap-index` &&
-          envelope.payload?.type === `leader:heartbeat`
-        ) {
-          leaderReady.resolve()
-        }
-      }
-      const releaseLeader = coordinator.subscribe(
-        `leader-bootstrap-index`,
-        () => {},
-      )
-      await leaderReady.promise
-      observePostedMessage = undefined
-
-      const collection = createCollection(
-        persistedCollectionOptions<{ id: string; title: string }, string>({
-          id: `leader-bootstrap-index`,
-          getKey: (row) => row.id,
-          defaultIndexType: BasicIndex,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      collection.createIndex((row) => row.title, { name: `title` })
-
+  describe(`RPC - applyLocalMutations`, () => {
+    it(`preserves one durable mutation result across generated response-delivery histories`, async () => {
+      vi.useFakeTimers()
+      let run = 0
       try {
-        await collection.preload()
-        expect(adapter.ensureIndex).toHaveBeenCalledOnce()
-      } finally {
-        await collection.cleanup()
-        releaseLeader()
-        coordinator.dispose()
-      }
-    })
+        await fc.assert(
+          fc.asyncProperty(
+            fc.record({
+              mutationCount: fc.integer({ min: 1, max: 4 }),
+              dropFirstSuccess: fc.boolean(),
+            }),
+            async ({ mutationCount, dropFirstSuccess }) => {
+              run++
+              const collectionId = `delivery-history-${run}`
+              const adapter = createStubAdapter()
+              let leadershipRead!: () => void
+              const leadershipReadPromise = new Promise<void>((resolve) => {
+                leadershipRead = resolve
+              })
+              let firstSuccessDropped!: () => void
+              const firstSuccessDroppedPromise = new Promise<void>(
+                (resolve) => {
+                  firstSuccessDropped = resolve
+                },
+              )
+              adapter.getStreamPosition = async () => {
+                leadershipRead()
+                return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+              }
 
-    it(`reaches crossed production RPC leadership only after both hydration scopes exit`, async () => {
-      const bothLocalIndexesEntered = createDeferred()
-      const bothLeaderRPCsEntered = createDeferred()
-      const releaseSchedulerCycle = createDeferred()
-      let localIndexEntries = 0
-      let leaderRPCEntries = 0
+              const leader = createCoordinator(adapter)
+              const follower = createCoordinator(adapter)
+              try {
+                leader.subscribe(collectionId, () => {})
+                await leadershipReadPromise
+                await Promise.resolve()
+                follower.subscribe(collectionId, () => {})
 
-      const createTab = () => {
-        const adapter = createStubAdapter()
-        const baseEnsureIndex = adapter.ensureIndex.bind(adapter)
-        let hydrationScopeActive = false
-        const leaderRPCScopeObservations: Array<boolean> = []
-        const scopedAdapter: PersistenceAdapter = {
-          ...adapter,
-          ensureIndex: async (...args) => {
-            localIndexEntries++
-            if (localIndexEntries === 2) bothLocalIndexesEntered.resolve()
-            await bothLocalIndexesEntered.promise
-            await baseEnsureIndex(...args)
-          },
-        }
-        adapter.runInHydrationScope = async (task) => {
-          hydrationScopeActive = true
-          try {
-            return await task(scopedAdapter)
-          } finally {
-            hydrationScopeActive = false
-          }
-        }
-        adapter.ensureIndex = async (...args) => {
-          leaderRPCScopeObservations.push(hydrationScopeActive)
-          leaderRPCEntries++
-          if (leaderRPCEntries === 2) bothLeaderRPCsEntered.resolve()
-          if (hydrationScopeActive) await releaseSchedulerCycle.promise
-          await baseEnsureIndex(...args)
-        }
-        return { adapter, leaderRPCScopeObservations }
-      }
+                if (dropFirstSuccess) {
+                  dropNextMessageWhen = (data) => {
+                    const payload = (
+                      data as { payload?: { type?: string; ok?: boolean } }
+                    ).payload
+                    if (
+                      payload?.type === `rpc:applyLocalMutations:res` &&
+                      payload.ok === true
+                    ) {
+                      firstSuccessDropped()
+                      return true
+                    }
+                    return false
+                  }
+                }
 
-      const tab1 = createTab()
-      const tab2 = createTab()
-      const coordinator1 = createCoordinator(tab1.adapter)
-      const coordinator2 = createCoordinator(tab2.adapter)
-      const leaderCollections = new Set<string>()
-      const bothLeadersReady = createDeferred()
-      observePostedMessage = (data) => {
-        const envelope = data as {
-          collectionId?: string
-          payload?: { type?: string }
-        }
-        if (
-          envelope.payload?.type === `leader:heartbeat` &&
-          (envelope.collectionId === `crossed-a` ||
-            envelope.collectionId === `crossed-b`)
-        ) {
-          leaderCollections.add(envelope.collectionId)
-          if (leaderCollections.size === 2) bothLeadersReady.resolve()
-        }
-      }
-      coordinator1.setAdapterForCollection(`crossed-b`, tab1.adapter)
-      coordinator2.setAdapterForCollection(`crossed-a`, tab2.adapter)
-      const releaseLeaderB = coordinator1.subscribe(`crossed-b`, () => {})
-      const releaseLeaderA = coordinator2.subscribe(`crossed-a`, () => {})
-      await bothLeadersReady.promise
-      observePostedMessage = undefined
+                const mutations = Array.from(
+                  { length: mutationCount },
+                  (_, index) => ({
+                    mutationId: `mut-${run}-${index}`,
+                    type: `insert` as const,
+                    key: `${index}`,
+                    value: { id: `${index}`, title: `row ${index}` },
+                  }),
+                )
+                const responsePromise = follower.requestApplyLocalMutations(
+                  collectionId,
+                  mutations,
+                )
+                if (dropFirstSuccess) {
+                  await firstSuccessDroppedPromise
+                  await vi.advanceTimersByTimeAsync(10_200)
+                }
 
-      const createFollowerCollection = (
-        id: string,
-        adapter: PersistenceAdapter,
-        coordinator: BrowserCollectionCoordinator,
-      ) => {
-        const collection = createCollection(
-          persistedCollectionOptions<{ id: string; title: string }, string>({
-            id,
-            getKey: (row) => row.id,
-            defaultIndexType: BasicIndex,
-            sync: {
-              sync: ({ markReady }) => {
-                markReady()
-              },
+                const response = await responsePromise
+                expect(response).toMatchObject({
+                  ok: true,
+                  acceptedMutationIds: mutations.map(
+                    (mutation) => mutation.mutationId,
+                  ),
+                })
+                expect(adapter.appliedTxs).toHaveLength(1)
+              } finally {
+                dropNextMessageWhen = undefined
+                follower.dispose()
+                leader.dispose()
+                for (let microtask = 0; microtask < 4; microtask++) {
+                  await Promise.resolve()
+                }
+              }
             },
-            persistence: { adapter, coordinator },
-          }),
-        )
-        collection.createIndex((row) => row.title, { name: `${id}-title` })
-        return collection
-      }
-      const followerA = createFollowerCollection(
-        `crossed-a`,
-        tab1.adapter,
-        coordinator1,
-      )
-      const followerB = createFollowerCollection(
-        `crossed-b`,
-        tab2.adapter,
-        coordinator2,
-      )
-      const preloadA = Promise.resolve(followerA.preload())
-      const preloadB = Promise.resolve(followerB.preload())
-      void preloadA.catch(() => undefined)
-      void preloadB.catch(() => undefined)
-
-      try {
-        await bothLeaderRPCsEntered.promise
-        expect({
-          tab1: tab1.leaderRPCScopeObservations,
-          tab2: tab2.leaderRPCScopeObservations,
-        }).toEqual({ tab1: [false], tab2: [false] })
-        await Promise.all([preloadA, preloadB])
-      } finally {
-        releaseSchedulerCycle.resolve()
-        await Promise.all([preloadA, preloadB]).catch(() => undefined)
-        await Promise.all([followerA.cleanup(), followerB.cleanup()])
-        releaseLeaderA()
-        releaseLeaderB()
-        coordinator2.dispose()
-        coordinator1.dispose()
-      }
-    })
-
-    it(`uses a supplied leader-local adapter when local work is not complete`, async () => {
-      const registeredAdapter = createStubAdapter()
-      const scopedAdapter = createStubAdapter()
-      let leadershipRead!: () => void
-      const leadershipReadPromise = new Promise<void>((resolve) => {
-        leadershipRead = resolve
-      })
-      registeredAdapter.getStreamPosition = async () => {
-        leadershipRead()
-        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-      }
-      registeredAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-      scopedAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-
-      const coord = createCoordinator(registeredAdapter)
-      try {
-        coord.subscribe(`todos`, () => {})
-        await leadershipReadPromise
-        await vi.waitFor(() => expect(coord.isLeader(`todos`)).toBe(true))
-
-        await coord.requestEnsurePersistedIndex(
-          `todos`,
-          `idx-scoped`,
-          { expressionSql: [`title`] },
-          scopedAdapter,
-        )
-
-        expect(scopedAdapter.ensureIndex).toHaveBeenCalledOnce()
-        expect(registeredAdapter.ensureIndex).not.toHaveBeenCalled()
-      } finally {
-        coord.dispose()
-      }
-    })
-
-    it(`keeps leader RPC work on the adapter registered for its collection`, async () => {
-      const todosAdapter = createStubAdapter()
-      const notesAdapter = createStubAdapter()
-      let leadershipRead!: () => void
-      const leadershipReadPromise = new Promise<void>((resolve) => {
-        leadershipRead = resolve
-      })
-      todosAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-      notesAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-      todosAdapter.getStreamPosition = async () => {
-        leadershipRead()
-        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-      }
-
-      const leader = createCoordinator(todosAdapter)
-      const follower = createCoordinator(notesAdapter)
-
-      try {
-        leader.setAdapterForCollection(`todos`, todosAdapter)
-        leader.subscribe(`todos`, () => {})
-        await leadershipReadPromise
-        await vi.waitFor(() => expect(leader.isLeader(`todos`)).toBe(true))
-        follower.subscribe(`todos`, () => {})
-
-        // Resolving a later collection variant must not replace the adapter
-        // already owning leader-side work for `todos`.
-        leader.setAdapter(notesAdapter)
-        await follower.requestEnsurePersistedIndex(`todos`, `idx-todos`, {
-          expressionSql: [`title`],
-        })
-
-        expect(todosAdapter.ensureIndex).toHaveBeenCalledOnce()
-        expect(notesAdapter.ensureIndex).not.toHaveBeenCalled()
-      } finally {
-        follower.dispose()
-        leader.dispose()
-      }
-    })
-
-    it(`re-registers the collection adapter after cleanup and restart`, async () => {
-      const defaultAdapter = createStubAdapter()
-      const collectionAdapter = createStubAdapter()
-      const defaultEnsure = vi.fn().mockResolvedValue(undefined)
-      const collectionEnsure = vi.fn().mockResolvedValue(undefined)
-      defaultAdapter.ensureIndex = defaultEnsure
-      collectionAdapter.ensureIndex = collectionEnsure
-      const coordinator = createCoordinator(defaultAdapter)
-      const collection = createCollection(
-        persistedCollectionOptions<{ id: string; title: string }, string>({
-          id: `todos`,
-          getKey: (row) => row.id,
-          sync: { sync: ({ markReady }) => markReady() },
-          persistence: { adapter: collectionAdapter, coordinator },
-        }),
-      )
-
-      try {
-        await collection.stateWhenReady()
-        await vi.waitFor(() => expect(coordinator.isLeader(`todos`)).toBe(true))
-        await coordinator.requestEnsurePersistedIndex(`todos`, `before`, {
-          expressionSql: [`title`],
-        })
-
-        await collection.cleanup()
-        expect(
-          inspectCoordinator(coordinator).collectionAdapters.has(`todos`),
-        ).toBe(false)
-        await collection.stateWhenReady()
-        await vi.waitFor(() => expect(coordinator.isLeader(`todos`)).toBe(true))
-        await coordinator.requestEnsurePersistedIndex(`todos`, `after`, {
-          expressionSql: [`title`],
-        })
-
-        expect(collectionEnsure.mock.calls.map((call) => call[1])).toEqual([
-          `before`,
-          `after`,
-        ])
-        expect(defaultEnsure).not.toHaveBeenCalled()
-      } finally {
-        await collection.cleanup()
-        coordinator.dispose()
-      }
-    })
-
-    it(`replaces a cached default adapter with its collection registration`, async () => {
-      const defaultAdapter = createStubAdapter()
-      const replacementAdapter = createStubAdapter()
-      let leadershipRead!: () => void
-      const leadershipReadPromise = new Promise<void>((resolve) => {
-        leadershipRead = resolve
-      })
-      defaultAdapter.getStreamPosition = async () => {
-        leadershipRead()
-        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-      }
-      defaultAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-      replacementAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
-
-      const coordinator = createCoordinator(defaultAdapter)
-      try {
-        coordinator.subscribe(`todos`, () => {})
-        await leadershipReadPromise
-        await vi.waitFor(() => expect(coordinator.isLeader(`todos`)).toBe(true))
-
-        await coordinator.requestEnsurePersistedIndex(`todos`, `idx-default`, {
-          expressionSql: [`title`],
-        })
-        coordinator.setAdapterForCollection(`todos`, replacementAdapter)
-        await coordinator.requestEnsurePersistedIndex(
-          `todos`,
-          `idx-replacement`,
-          { expressionSql: [`title`] },
-        )
-
-        expect(defaultAdapter.ensureIndex).toHaveBeenCalledOnce()
-        expect(replacementAdapter.ensureIndex).toHaveBeenCalledOnce()
-        expect(replacementAdapter.ensureIndex).toHaveBeenCalledWith(
-          { kind: `eager`, collectionId: `todos` },
-          `idx-replacement`,
-          { expressionSql: [`title`] },
+          ),
+          { seed: 1868, numRuns: 12, endOnFailure: true },
         )
       } finally {
-        coordinator.dispose()
+        vi.useRealTimers()
       }
     })
+  })
 
+  describe(`RPC - ensurePersistedIndex`, () => {
     it(`routes generated collection and RPC histories through their owning adapter`, async () => {
       let run = 0
       await fc.assert(
@@ -8131,147 +330,6 @@ describe(`BrowserCollectionCoordinator`, () => {
   })
 
   describe(`dispose`, () => {
-    it(`stops Browser RPC retry after disposal and preserves the first failure`, async () => {
-      vi.useFakeTimers()
-      const coordinator = createCoordinator()
-      const firstError = new Error(`browser transport failed during disposal`)
-      let firstAttempt = true
-      const internals = coordinator as unknown as {
-        sendRPC: (
-          collectionId: string,
-          request: {
-            type: `rpc:pullSince:req`
-            rpcId: string
-            fromRowVersion: number
-          },
-        ) => Promise<unknown>
-        sendRPCOnce: () => Promise<unknown>
-      }
-      internals.sendRPCOnce = vi.fn(() => {
-        if (firstAttempt) {
-          firstAttempt = false
-          coordinator.dispose()
-        }
-        return Promise.reject(firstError)
-      })
-      let outcome: { error: unknown } | undefined
-
-      try {
-        const pending = internals
-          .sendRPC(`todos`, {
-            type: `rpc:pullSince:req`,
-            rpcId: `browser-disposal-rpc`,
-            fromRowVersion: 0,
-          })
-          .then(
-            () => ({ error: undefined }),
-            (error: unknown) => ({ error }),
-          )
-          .then((result) => {
-            outcome = result
-            return result
-          })
-        await vi.advanceTimersByTimeAsync(0)
-        const immediate = {
-          calls: vi.mocked(internals.sendRPCOnce).mock.calls.length,
-          settled: outcome !== undefined,
-        }
-        await vi.runAllTimersAsync()
-        const finalOutcome = await pending
-
-        expect(immediate).toEqual({ calls: 1, settled: true })
-        expect(finalOutcome).toEqual({ error: firstError })
-        expect(internals.sendRPCOnce).toHaveBeenCalledTimes(1)
-      } finally {
-        await vi.runAllTimersAsync()
-        vi.useRealTimers()
-        coordinator.dispose()
-      }
-    })
-
-    it(`cleans up on dispose`, async () => {
-      const coord = createCoordinator()
-      coord.subscribe(`todos`, () => {})
-      await flush(50)
-
-      coord.dispose()
-
-      // Should not throw after disposal
-      expect(coord.isLeader(`todos`)).toBe(false)
-    })
-
-    it(`settles an in-flight RPC at dispose without posting retries`, async () => {
-      vi.useFakeTimers()
-      const adapter = createStubAdapter()
-      let leadershipRead!: () => void
-      const leadershipReadPromise = new Promise<void>((resolve) => {
-        leadershipRead = resolve
-      })
-      let firstRequestPosted!: () => void
-      const firstRequestPostedPromise = new Promise<void>((resolve) => {
-        firstRequestPosted = resolve
-      })
-      adapter.getStreamPosition = async () => {
-        leadershipRead()
-        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
-      }
-
-      const leader = createCoordinator(adapter)
-      const follower = createCoordinator(adapter)
-      let requestPosts = 0
-      let settled = false
-
-      try {
-        leader.subscribe(`todos`, () => {})
-        await leadershipReadPromise
-        await Promise.resolve()
-        follower.subscribe(`todos`, () => {})
-
-        observePostedMessage = (data) => {
-          const type = (data as { payload?: { type?: string } }).payload?.type
-          if (type === `rpc:ensurePersistedIndex:req`) {
-            requestPosts++
-            if (requestPosts === 1) firstRequestPosted()
-          }
-        }
-        dropNextMessageWhen = (data) =>
-          (data as { payload?: { type?: string } }).payload?.type ===
-          `rpc:ensurePersistedIndex:req`
-
-        const request = follower
-          .requestEnsurePersistedIndex(`todos`, `idx-dispose`, {
-            expressionSql: [`title`],
-          })
-          .then(
-            () => {
-              settled = true
-            },
-            () => {
-              settled = true
-            },
-          )
-
-        await firstRequestPostedPromise
-        follower.dispose()
-        for (let microtask = 0; microtask < 8; microtask++) {
-          await Promise.resolve()
-        }
-        const settledAtDispose = settled
-
-        await vi.advanceTimersByTimeAsync(21_000)
-        await request
-
-        expect({ settledAtDispose, requestPosts }).toEqual({
-          settledAtDispose: true,
-          requestPosts: 1,
-        })
-      } finally {
-        follower.dispose()
-        leader.dispose()
-        vi.useRealTimers()
-      }
-    })
-
     it(`makes disposal terminal across generated RPC kinds and lifecycle phases`, async () => {
       vi.useFakeTimers()
       let run = 0
diff --git a/packages/browser-db-sqlite-persistence/tests/browser-coordinator-support.ts b/packages/browser-db-sqlite-persistence/tests/browser-coordinator-support.ts
new file mode 100644
index 0000000000..4bb00540db
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/browser-coordinator-support.ts
@@ -0,0 +1,624 @@
+// Shared harness for the Browser coordinator tests. The ordinary tests and the
+// oracle tests in browser-coordinator-oracle.test.ts run this mock in their own
+// module instances, so each test file binds its transport controls.
+
+import { vi } from 'vitest'
+import { IR } from '@tanstack/db'
+import { BrowserCollectionCoordinator } from '../src/browser-coordinator'
+import type { LoadSubsetOptions } from '@tanstack/db'
+import type { BrowserCollectionCoordinatorOptions } from '../src/browser-coordinator'
+import type {
+  HydrationPersistenceAdapter,
+  PersistedStorageTarget,
+  PersistedTx,
+  PersistenceAdapter,
+  RemoteSubsetOwner,
+  TransportedLoadSubsetOptions,
+} from '@tanstack/db-sqlite-persistence-core'
+
+// ---------------------------------------------------------------------------
+// BroadcastChannel mock
+// ---------------------------------------------------------------------------
+
+export type MessageHandler = (event: { data: unknown }) => void
+export const channels: Map<
+  string,
+  Set<{ onmessage: MessageHandler | null }>
+> = new Map()
+export const durableTerms = new Map<string, number>()
+
+/**
+ * The transport controls are variables in the test file that drives the mock,
+ * so its assignments (`dropNextMessageWhen = ...`) reach the mock. The file
+ * binds accessors for them once, and the mock reads and clears them through
+ * the binding.
+ */
+export type TransportControls = {
+  dropNextMessageWhen: ((data: unknown) => boolean) | undefined
+  observePostedMessage: ((data: unknown) => void) | undefined
+  dropNextBroadcastMessage: ((data: unknown) => boolean) | undefined
+  duplicateNextBroadcastMessage:
+    ((data: unknown) => unknown | undefined) | undefined
+  observeBroadcastMessage: ((data: unknown) => void) | undefined
+}
+let transportControls: TransportControls | undefined
+
+export function bindTransportControls(controls: TransportControls): void {
+  transportControls = controls
+}
+
+function boundTransportControls(): TransportControls {
+  if (!transportControls) {
+    throw new Error(`transport controls are not bound`)
+  }
+  return transportControls
+}
+
+export class MockBroadcastChannel {
+  readonly name: string
+  onmessage: MessageHandler | null = null
+
+  constructor(name: string) {
+    this.name = name
+    if (!channels.has(name)) {
+      channels.set(name, new Set())
+    }
+    channels.get(name)!.add(this)
+  }
+
+  postMessage(data: unknown): void {
+    const controls = boundTransportControls()
+    controls.observePostedMessage?.(data)
+    if (controls.dropNextMessageWhen?.(data)) {
+      controls.dropNextMessageWhen = undefined
+      return
+    }
+    controls.observeBroadcastMessage?.(data)
+    if (controls.dropNextBroadcastMessage?.(data)) {
+      controls.dropNextBroadcastMessage = undefined
+      return
+    }
+
+    const duplicate = controls.duplicateNextBroadcastMessage?.(data)
+    if (duplicate !== undefined) {
+      controls.duplicateNextBroadcastMessage = undefined
+    }
+    // BroadcastChannel performs serialization during postMessage, so clone
+    // failures are synchronous rather than deferred to delivery.
+    const deliveries = (
+      duplicate === undefined ? [data] : [data, duplicate]
+    ).map((delivery) => structuredClone(delivery))
+    const peers = channels.get(this.name)
+    if (!peers) return
+    // Deliver to all other instances on same channel (simulating cross-tab)
+    for (const peer of peers) {
+      if (peer !== this && peer.onmessage) {
+        // Use microtask to simulate async delivery
+        const handler = peer.onmessage
+        for (const delivery of deliveries) {
+          queueMicrotask(() => handler({ data: structuredClone(delivery) }))
+        }
+      }
+    }
+  }
+
+  close(): void {
+    channels.get(this.name)?.delete(this)
+  }
+}
+
+export function injectBroadcastMessage(
+  channelName: string,
+  data: unknown,
+): void {
+  for (const endpoint of channels.get(channelName) ?? []) {
+    const handler = endpoint.onmessage
+    if (handler) {
+      queueMicrotask(() => handler({ data: structuredClone(data) }))
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Web Locks mock
+// ---------------------------------------------------------------------------
+
+export type LockGrantedCallback = (lock: { name: string }) => Promise<unknown>
+
+export const heldLocks = new Map<string, { release: () => void }>()
+export const lockQueues = new Map<
+  string,
+  Array<{
+    callback: LockGrantedCallback
+    signal?: AbortSignal
+    resolve: (v: unknown) => void
+    reject: (e: Error) => void
+  }>
+>()
+
+export function tryGrantNextLock(name: string): void {
+  if (heldLocks.has(name)) return
+  const queue = lockQueues.get(name)
+  if (!queue || queue.length === 0) return
+
+  const next = queue.shift()!
+  if (next.signal?.aborted) {
+    // Skip aborted entries and try next
+    tryGrantNextLock(name)
+    return
+  }
+
+  let releaseCallback!: () => void
+  void new Promise<void>((resolve) => {
+    releaseCallback = resolve
+  })
+
+  heldLocks.set(name, { release: releaseCallback })
+
+  const result = next.callback({ name })
+  // When the callback resolves/rejects, release the lock
+  Promise.resolve(result).then(
+    (value) => {
+      heldLocks.delete(name)
+      releaseCallback()
+      next.resolve(value)
+      tryGrantNextLock(name)
+    },
+    (error) => {
+      heldLocks.delete(name)
+      releaseCallback()
+      next.reject(error)
+      tryGrantNextLock(name)
+    },
+  )
+}
+
+export const mockNavigatorLocks = {
+  request: (
+    name: string,
+    optionsOrCallback: { signal?: AbortSignal } | LockGrantedCallback,
+    maybeCallback?: LockGrantedCallback,
+  ): Promise<unknown> => {
+    const callback =
+      typeof optionsOrCallback === `function`
+        ? optionsOrCallback
+        : maybeCallback!
+    const signal =
+      typeof optionsOrCallback === `object`
+        ? optionsOrCallback.signal
+        : undefined
+
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(new DOMException(`Lock request aborted`, `AbortError`))
+        return
+      }
+
+      const entry = { callback, signal, resolve, reject }
+      if (!lockQueues.has(name)) {
+        lockQueues.set(name, [])
+      }
+      lockQueues.get(name)!.push(entry)
+
+      if (signal) {
+        signal.addEventListener(`abort`, () => {
+          const queue = lockQueues.get(name)
+          if (queue) {
+            const idx = queue.indexOf(entry)
+            if (idx >= 0) {
+              queue.splice(idx, 1)
+              reject(new DOMException(`Lock request aborted`, `AbortError`))
+            }
+          }
+        })
+      }
+
+      tryGrantNextLock(name)
+    })
+  },
+}
+
+// ---------------------------------------------------------------------------
+// Setup / teardown
+// ---------------------------------------------------------------------------
+
+export function installGlobals(): void {
+  ;(globalThis as Record<string, unknown>).BroadcastChannel =
+    MockBroadcastChannel as unknown
+  Object.defineProperty(globalThis, `navigator`, {
+    value: {
+      ...(((globalThis as Record<string, unknown>).navigator as
+        object | undefined) ?? {}),
+      locks: mockNavigatorLocks,
+    },
+    writable: true,
+    configurable: true,
+  })
+}
+
+export function cleanupGlobals(): void {
+  const controls = boundTransportControls()
+  controls.dropNextMessageWhen = undefined
+  controls.observePostedMessage = undefined
+  controls.dropNextBroadcastMessage = undefined
+  controls.duplicateNextBroadcastMessage = undefined
+  controls.observeBroadcastMessage = undefined
+  channels.clear()
+  heldLocks.clear()
+  lockQueues.clear()
+  durableTerms.clear()
+}
+
+// ---------------------------------------------------------------------------
+// Adapter stub
+// ---------------------------------------------------------------------------
+
+export function storageId(target: PersistedStorageTarget): string {
+  return target.kind === `managed`
+    ? target.storageCollectionId
+    : target.collectionId
+}
+
+export function createStubAdapter(): PersistenceAdapter & {
+  pullSince: (
+    target: PersistedStorageTarget,
+    fromRowVersion: number,
+  ) => Promise<{
+    latestRowVersion: number
+    requiresFullReload: false
+    changedKeys: Array<string | number>
+    deletedKeys: Array<string | number>
+  }>
+  getStreamPosition: (target: PersistedStorageTarget) => Promise<{
+    latestTerm: number
+    latestSeq: number
+    latestRowVersion: number
+  }>
+  appliedTxs: Array<{ collectionId: string; tx: PersistedTx }>
+} {
+  const appliedTxs: Array<{ collectionId: string; tx: PersistedTx }> = []
+
+  return {
+    appliedTxs,
+    loadSubset: () => Promise.resolve([]),
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: (target, tx) => {
+      appliedTxs.push({ collectionId: storageId(target), tx })
+      return Promise.resolve()
+    },
+    ensureIndex: () => Promise.resolve(),
+    pullSince: (_collectionId, _fromRowVersion) =>
+      Promise.resolve({
+        latestRowVersion: 0,
+        requiresFullReload: false as const,
+        changedKeys: [],
+        deletedKeys: [],
+      }),
+    getStreamPosition: () =>
+      Promise.resolve({
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+      }),
+    async reserveLeadershipTerm(target, observedTerm) {
+      const collectionId = storageId(target)
+      const position = await this.getStreamPosition(target)
+      const latestTerm =
+        Math.max(
+          position.latestTerm,
+          durableTerms.get(collectionId) ?? 0,
+          observedTerm,
+        ) + 1
+      durableTerms.set(collectionId, latestTerm)
+      return { ...position, latestTerm }
+    },
+  }
+}
+
+export function createCoordinator(
+  adapter?: ReturnType<typeof createStubAdapter>,
+): BrowserCollectionCoordinator {
+  const opts: BrowserCollectionCoordinatorOptions = {
+    dbName: `test-db`,
+    adapter: adapter ?? createStubAdapter(),
+  }
+  const coordinator = new BrowserCollectionCoordinator(opts)
+  liveCoordinators.add(coordinator)
+  return coordinator
+}
+
+export const liveCoordinators = new Set<BrowserCollectionCoordinator>()
+
+export function subsetWithNestedValue(value: unknown): LoadSubsetOptions {
+  return {
+    where: new IR.Func(`in`, [
+      new IR.PropRef([`todos`, `status`]),
+      new IR.Value([`kept`, value]),
+    ]),
+  }
+}
+
+export function withUnusedUnloadSubset<
+  T extends (options: TransportedLoadSubsetOptions) => Promise<void> | void,
+>(owner: T): T & RemoteSubsetOwner {
+  // These fixtures exercise admission and delivery only. The required no-op
+  // release hook keeps that unrelated scope explicit without weakening the
+  // production coordinator contract.
+  return Object.assign(owner, {
+    unloadSubset: vi.fn(),
+    onError: vi.fn(),
+  })
+}
+
+export class UnsupportedSubsetValue {
+  constructor(readonly label: string) {}
+}
+
+export function withEnumerableExpando<T extends object>(value: T): T {
+  Object.defineProperty(value, `extra`, {
+    value: `would be lost`,
+    enumerable: true,
+  })
+  return value
+}
+
+export function detachBufferWithView(
+  kind: `buffer` | `data-view` | `typed-array`,
+): ArrayBuffer | DataView | Uint8Array {
+  const buffer = new ArrayBuffer(4)
+  const value =
+    kind === `buffer`
+      ? buffer
+      : kind === `data-view`
+        ? new DataView(buffer)
+        : new Uint8Array(buffer)
+  structuredClone(buffer, { transfer: [buffer] })
+  return value
+}
+
+export type ResizableArrayBufferConstructor = {
+  new (byteLength: number, options: { maxByteLength: number }): ArrayBuffer
+}
+
+export type Float16ArrayConstructor = {
+  new (values: ArrayLike<number>): ArrayBufferView
+}
+
+export function createResizableArrayBuffer(): ArrayBuffer | undefined {
+  try {
+    const buffer = new (ArrayBuffer as ResizableArrayBufferConstructor)(4, {
+      maxByteLength: 8,
+    })
+    return (buffer as ArrayBuffer & { readonly resizable?: boolean }).resizable
+      ? buffer
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+export const unsupportedValuePath = `options.where.args[1].value[1]`
+export const resizableArrayBufferValueCases = createResizableArrayBuffer()
+  ? ([
+      [
+        `resizable ArrayBuffer`,
+        () => createResizableArrayBuffer()!,
+        unsupportedValuePath,
+      ],
+      [
+        `length-tracking DataView`,
+        () => new DataView(createResizableArrayBuffer()!),
+        unsupportedValuePath,
+      ],
+      [
+        `length-tracking typed array`,
+        () => new Uint8Array(createResizableArrayBuffer()!),
+        unsupportedValuePath,
+      ],
+    ] as const)
+  : ([] as const)
+export const Float16ArrayValue = Reflect.get(globalThis, `Float16Array`) as
+  Float16ArrayConstructor | undefined
+export const float16ArrayValueCases = Float16ArrayValue
+  ? ([
+      [
+        `Float16Array outside the exported typed-array union`,
+        () => new Float16ArrayValue([1, 2]),
+        unsupportedValuePath,
+      ],
+    ] as const)
+  : ([] as const)
+
+export const unsupportedSubsetValueCases = [
+  [`function`, () => () => {}, unsupportedValuePath],
+  [`symbol`, () => Symbol(`unsupported`), unsupportedValuePath],
+  [`WeakMap`, () => new WeakMap(), unsupportedValuePath],
+  [`WeakSet`, () => new WeakSet(), unsupportedValuePath],
+  [`Promise`, () => Promise.resolve(`unsupported`), unsupportedValuePath],
+  [
+    `custom prototype`,
+    () => new UnsupportedSubsetValue(`unsupported`),
+    unsupportedValuePath,
+  ],
+  [
+    `custom prototype with a throwing constructor getter`,
+    () => {
+      const prototype = Object.create(null) as object
+      Object.defineProperty(prototype, `constructor`, {
+        get: () => {
+          throw new Error(`constructor getter must not be invoked`)
+        },
+      })
+      return Object.create(prototype) as object
+    },
+    unsupportedValuePath,
+  ],
+  [
+    `nonzero RegExp lastIndex`,
+    () => {
+      const regexp = /wire/g
+      regexp.lastIndex = 2
+      return regexp
+    },
+    `${unsupportedValuePath}.lastIndex`,
+  ],
+  [`SharedArrayBuffer`, () => new SharedArrayBuffer(4), unsupportedValuePath],
+  [
+    `function-valued Map key`,
+    () => new Map([[() => {}, `value`]]),
+    `${unsupportedValuePath}.entries[0].key`,
+  ],
+  [
+    `symbol-valued Map value`,
+    () => new Map([[`key`, Symbol(`unsupported`)]]),
+    `${unsupportedValuePath}.entries[0].value`,
+  ],
+  [
+    `function-valued Set entry`,
+    () => new Set([() => {}]),
+    `${unsupportedValuePath}.values[0]`,
+  ],
+  [
+    `detached view nested in a Map`,
+    () => new Map([[`key`, detachBufferWithView(`typed-array`)]]),
+    `${unsupportedValuePath}.entries[0].value`,
+  ],
+  [
+    `detached ArrayBuffer`,
+    () => detachBufferWithView(`buffer`),
+    unsupportedValuePath,
+  ],
+  [
+    `detached DataView`,
+    () => detachBufferWithView(`data-view`),
+    unsupportedValuePath,
+  ],
+  [
+    `detached typed array`,
+    () => detachBufferWithView(`typed-array`),
+    unsupportedValuePath,
+  ],
+  [
+    `symbol-keyed record`,
+    () => ({ [Symbol(`unsupported`)]: true }),
+    `${unsupportedValuePath}[Symbol(unsupported)]`,
+  ],
+  [
+    `accessor property`,
+    () =>
+      Object.defineProperty({}, `computed`, {
+        enumerable: true,
+        get: () => {
+          throw new Error(`accessor must not be invoked`)
+        },
+      }),
+    `${unsupportedValuePath}.computed`,
+  ],
+  [
+    `non-enumerable property`,
+    () => Object.defineProperty({}, `hidden`, { value: true }),
+    `${unsupportedValuePath}.hidden`,
+  ],
+  [
+    `Date expando`,
+    () => withEnumerableExpando(new Date(0)),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `RegExp expando`,
+    () => withEnumerableExpando(/wire/),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `Map expando`,
+    () => withEnumerableExpando(new Map()),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `Set expando`,
+    () => withEnumerableExpando(new Set()),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `ArrayBuffer expando`,
+    () => withEnumerableExpando(new ArrayBuffer(4)),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `DataView expando`,
+    () => withEnumerableExpando(new DataView(new ArrayBuffer(4))),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `typed array expando`,
+    () => withEnumerableExpando(new Uint8Array(4)),
+    `${unsupportedValuePath}.extra`,
+  ],
+  [
+    `array expando`,
+    () => withEnumerableExpando([]),
+    `${unsupportedValuePath}.extra`,
+  ],
+  ...resizableArrayBufferValueCases,
+  ...float16ArrayValueCases,
+] as const
+
+export async function flush(ms: number = 10): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+export type Deferred = {
+  promise: Promise<void>
+  resolve: () => void
+}
+
+export function createDeferred(): Deferred {
+  let resolve!: () => void
+  const promise = new Promise<void>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+export type CoordinatorInspection = {
+  collectionAdapters: Map<string, unknown>
+  collections: Map<string, unknown>
+  appliedEnvelopes: Map<string, unknown>
+}
+
+export function inspectCoordinator(
+  coordinator: BrowserCollectionCoordinator,
+): CoordinatorInspection {
+  return coordinator as unknown as CoordinatorInspection
+}
+
+export function createQueuedReadAdapter() {
+  const adapter = createStubAdapter()
+  const queuedRead = createDeferred()
+  // The queued read holds regular work and every barrier behind it.
+  adapter.runInRegularScope = Object.assign(
+    async <T>(task: (adapter: HydrationPersistenceAdapter) => Promise<T>) => {
+      await queuedRead.promise
+      return task(adapter)
+    },
+    { afterQueuedWork: () => queuedRead.promise },
+  )
+  adapter.reconcileCommittedTx = (target, tx) => {
+    adapter.appliedTxs.push({ collectionId: storageId(target), tx })
+    return Promise.resolve({
+      kind: `applied-now` as const,
+      committed: { term: tx.term, seq: tx.seq, rowVersion: tx.rowVersion },
+      latestRowVersion: tx.rowVersion,
+    })
+  }
+  return { adapter, queuedRead }
+}
diff --git a/packages/browser-db-sqlite-persistence/tests/browser-coordinator.test.ts b/packages/browser-db-sqlite-persistence/tests/browser-coordinator.test.ts
new file mode 100644
index 0000000000..8990effe0a
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/browser-coordinator.test.ts
@@ -0,0 +1,7518 @@
+/**
+ * Ordinary Browser coordinator tests: leadership, message transport, RPC
+ * routing and durability outcomes, subset ownership, replay, and disposal in
+ * fixed scenarios with literal expectations. The laws that these scenarios
+ * share, and the generated histories that check them, are owned by
+ * `browser-coordinator-oracle.test.ts`.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { BasicIndex, IR, createCollection } from '@tanstack/db'
+import {
+  RetryableRemoteSubsetAcquisitionError,
+  validateRemoteSubsetOptions,
+} from '@tanstack/db-sqlite-persistence-core'
+import { BrowserCollectionCoordinator } from '../src/browser-coordinator'
+import {
+  createBrowserWASQLitePersistence,
+  persistedCollectionOptions,
+} from '../src'
+import { createWASQLiteTestDatabase } from './helpers/wa-sqlite-test-db'
+import {
+  bindTransportControls,
+  channels,
+  cleanupGlobals,
+  createCoordinator,
+  createDeferred,
+  createQueuedReadAdapter,
+  createStubAdapter,
+  durableTerms,
+  flush,
+  heldLocks,
+  injectBroadcastMessage,
+  inspectCoordinator,
+  installGlobals,
+  liveCoordinators,
+  lockQueues,
+  mockNavigatorLocks,
+  storageId,
+  subsetWithNestedValue,
+  tryGrantNextLock,
+  unsupportedSubsetValueCases,
+  withUnusedUnloadSubset,
+} from './browser-coordinator-support'
+import type {
+  ApplyCommittedTxRequest,
+  ApplyCommittedTxResponse,
+  ApplyLocalMutationsRequest,
+  ApplyLocalMutationsResponse,
+  HydrationPersistenceAdapter,
+  IndeterminateCommitError,
+  PersistedCollectionDurabilityError,
+  PersistedStorageTarget,
+  PersistedTx,
+  PersistenceAdapter,
+  RemoteSubsetOwner,
+  TransportedLoadSubsetOptions,
+} from '@tanstack/db-sqlite-persistence-core'
+import type { LoadSubsetOptions, Subscription, SyncConfig } from '@tanstack/db'
+
+let dropNextMessageWhen: ((data: unknown) => boolean) | undefined
+let observePostedMessage: ((data: unknown) => void) | undefined
+let dropNextBroadcastMessage: ((data: unknown) => boolean) | undefined
+let duplicateNextBroadcastMessage:
+  ((data: unknown) => unknown | undefined) | undefined
+let observeBroadcastMessage: ((data: unknown) => void) | undefined
+// The mock in browser-coordinator-support.ts reads and clears these transport
+// controls. The binding lets this file's tests assign them directly.
+bindTransportControls({
+  get dropNextMessageWhen() {
+    return dropNextMessageWhen
+  },
+  set dropNextMessageWhen(value) {
+    dropNextMessageWhen = value
+  },
+  get observePostedMessage() {
+    return observePostedMessage
+  },
+  set observePostedMessage(value) {
+    observePostedMessage = value
+  },
+  get dropNextBroadcastMessage() {
+    return dropNextBroadcastMessage
+  },
+  set dropNextBroadcastMessage(value) {
+    dropNextBroadcastMessage = value
+  },
+  get duplicateNextBroadcastMessage() {
+    return duplicateNextBroadcastMessage
+  },
+  set duplicateNextBroadcastMessage(value) {
+    duplicateNextBroadcastMessage = value
+  },
+  get observeBroadcastMessage() {
+    return observeBroadcastMessage
+  },
+  set observeBroadcastMessage(value) {
+    observeBroadcastMessage = value
+  },
+})
+
+/**
+ * Law: a leadership need posts one RPC of its request kind. A remote
+ * `ensureRemoteSubset` need may post several, all under one acquisition ID.
+ * A holder's own need, and `ensureLeadership`, post nothing. The expected
+ * posts come from the need table, not from production.
+ */
+function compareNeedPosts(
+  kind: string,
+  need: { readonly request: string | undefined },
+  callerIsHolder: boolean,
+  posts: ReadonlyArray<{ acquisitionId?: string }>,
+): void {
+  if (need.request === undefined || callerIsHolder) {
+    expect(posts).toEqual([])
+  } else if (kind === `remote subset`) {
+    expect(posts.length).toBeGreaterThan(0)
+    expect(new Set(posts.map((post) => post.acquisitionId)).size).toBe(1)
+  } else {
+    expect(posts).toHaveLength(1)
+  }
+}
+
+describe(`BrowserCollectionCoordinator`, () => {
+  beforeEach(() => {
+    installGlobals()
+  })
+
+  afterEach(async () => {
+    for (const coordinator of liveCoordinators) coordinator.dispose()
+    liveCoordinators.clear()
+    await flush(0)
+    cleanupGlobals()
+  })
+
+  describe(`leadership`, () => {
+    /** Without a durable term reservation, a cold successor can reuse its predecessor's term. */
+    it(`rejects an adapter that cannot reserve a durable election term`, () => {
+      const adapter = createStubAdapter()
+      adapter.reserveLeadershipTerm = undefined
+      expect(() => createCoordinator(adapter)).toThrow(/reserveLeadershipTerm/)
+    })
+
+    /**
+     * An election waits for queued work through the scheduler barrier. A
+     * regular scope without it is an adapter written for an older contract;
+     * failing at construction keeps the election from retrying forever.
+     */
+    it(`rejects an adapter whose regular scope has no queued-work barrier`, () => {
+      const adapter = createStubAdapter()
+      adapter.runInRegularScope = ((task) =>
+        task(adapter)) as PersistenceAdapter[`runInRegularScope`]
+      expect(() => createCoordinator(adapter)).toThrow(
+        /runInRegularScope\.afterQueuedWork/,
+      )
+    })
+
+    /**
+     * A physical cache generation and its claim are one election authority.
+     * The reference records the claim registered for each physical ID before
+     * election; a term reservation must receive that same pair. A reservation
+     * without the claim could advance a retired generation after expiry.
+     */
+    it(`reserves a physical cache term under its registered claim`, async () => {
+      const adapter = createStubAdapter()
+      const calls: Array<{
+        target: PersistedStorageTarget
+        claimId?: string
+      }> = []
+      const reserve = adapter.reserveLeadershipTerm!.bind(adapter)
+      adapter.reserveLeadershipTerm = (target, observedTerm, ctx) => {
+        calls.push({
+          target,
+          claimId: ctx?.cacheGenerationClaimId,
+        })
+        return reserve(target, observedTerm, ctx)
+      }
+      const coordinator = createCoordinator(adapter)
+      coordinator.setAdapterForCollection(
+        `physical-cache`,
+        adapter,
+        `claim-for-physical-cache`,
+      )
+      coordinator.subscribe(`physical-cache`, () => {})
+      await vi.waitFor(() =>
+        expect(coordinator.isLeader(`physical-cache`)).toBe(true),
+      )
+      expect(calls).toEqual([
+        {
+          target: {
+            kind: `managed`,
+            storageCollectionId: `physical-cache`,
+            claimId: `claim-for-physical-cache`,
+          },
+          claimId: `claim-for-physical-cache`,
+        },
+      ])
+    })
+
+    // A local mutation originates without a persisted tx. Its coordinator
+    // request must carry the Collection's claim across leader and follower
+    // routing before the coordinator creates that tx. Otherwise the adapter sees an eager
+    // write to a physical cache ID and can resurrect it after collection.
+    it(`keeps a managed claim on coordinator local mutations`, async () => {
+      const adapter = createStubAdapter()
+      const targets: Array<PersistedStorageTarget> = []
+      const apply = adapter.applyCommittedTx.bind(adapter)
+      adapter.applyCommittedTx = (target, tx) => {
+        targets.push(target)
+        return apply(target, tx)
+      }
+      const coordinator = createCoordinator(adapter)
+      const storageCollectionId = `local-mutation-cache`
+      const claimId = `claim-for-local-mutation-cache`
+      coordinator.setAdapterForCollection(storageCollectionId, adapter, claimId)
+      coordinator.subscribe(storageCollectionId, () => {})
+      await vi.waitFor(() =>
+        expect(coordinator.isLeader(storageCollectionId)).toBe(true),
+      )
+
+      const mutations = [
+        {
+          mutationId: `local-managed-write`,
+          type: `insert` as const,
+          key: `row`,
+          value: { id: `row` },
+        },
+      ]
+      const response = await coordinator.requestApplyLocalMutations(
+        storageCollectionId,
+        mutations,
+        claimId,
+      )
+      expect(response.ok).toBe(true)
+      expect(targets).toEqual([
+        { kind: `managed`, storageCollectionId, claimId },
+      ])
+      expect(adapter.appliedTxs[0]?.tx.cacheGenerationClaimId).toBe(claimId)
+
+      const follower = createCoordinator(adapter)
+      follower.setAdapterForCollection(storageCollectionId, adapter, claimId)
+      follower.subscribe(storageCollectionId, () => {})
+      await vi.waitFor(() =>
+        expect(follower.isLeader(storageCollectionId)).toBe(false),
+      )
+      const followerResponse = await follower.requestApplyLocalMutations(
+        storageCollectionId,
+        [{ ...mutations[0]!, mutationId: `follower-managed-write` }],
+        claimId,
+      )
+      expect(followerResponse.ok).toBe(true)
+      expect(targets).toEqual([
+        { kind: `managed`, storageCollectionId, claimId },
+        { kind: `managed`, storageCollectionId, claimId },
+      ])
+      expect(adapter.appliedTxs[1]?.tx.cacheGenerationClaimId).toBe(claimId)
+
+      await expect(
+        coordinator.requestApplyLocalMutations(storageCollectionId, mutations),
+      ).rejects.toThrow(`requires a persisted cache claim`)
+      expect(targets).toHaveLength(2)
+    })
+
+    it(`first coordinator becomes leader for a collection`, async () => {
+      const coord = createCoordinator()
+      coord.subscribe(`todos`, () => {})
+      await flush(50)
+
+      expect(coord.isLeader(`todos`)).toBe(true)
+      coord.dispose()
+    })
+
+    it.each([{ kind: `source commit` }, { kind: `local mutation` }] as const)(
+      `does not persist a queued $kind after leadership transfers`,
+      async ({ kind }) => {
+        const queued = createDeferred()
+        const releaseQueued = createDeferred()
+        const formerAdapter = createStubAdapter()
+        // Hold only the write queued after election. The election's empty
+        // read-queue barrier also enters the regular scope.
+        let holdRegularWork = false
+        formerAdapter.runInRegularScope = Object.assign(
+          async <T>(
+            task: (adapter: HydrationPersistenceAdapter) => Promise<T>,
+          ) => {
+            if (holdRegularWork) {
+              queued.resolve()
+              await releaseQueued.promise
+            }
+            return task(formerAdapter)
+          },
+          { afterQueuedWork: () => Promise.resolve() },
+        )
+        const newAdapter = createStubAdapter()
+        const formerLeader = createCoordinator(formerAdapter)
+        const newLeader = createCoordinator(newAdapter)
+        const unsubscribeFormer = formerLeader.subscribe(`todos`, () => {})
+        const unsubscribeNew = newLeader.subscribe(`todos`, () => {})
+        let write:
+          | Promise<ApplyCommittedTxResponse | ApplyLocalMutationsResponse>
+          | undefined
+        let committedMessagePosts = 0
+
+        try {
+          await vi.waitFor(() =>
+            expect(formerLeader.isLeader(`todos`)).toBe(true),
+          )
+          holdRegularWork = true
+          observeBroadcastMessage = (data) => {
+            if (
+              (data as { payload?: { type?: string } }).payload?.type ===
+              `tx:committed`
+            ) {
+              committedMessagePosts++
+            }
+          }
+          write =
+            kind === `source commit`
+              ? formerLeader.requestApplyCommittedTx(`todos`, {
+                  txId: `queued-source-commit`,
+                  term: 0,
+                  seq: 0,
+                  rowVersion: 0,
+                  mutations: [
+                    { type: `insert`, key: `queued`, value: { id: `queued` } },
+                  ],
+                })
+              : formerLeader.requestApplyLocalMutations(`todos`, [
+                  {
+                    mutationId: `queued-local-mutation`,
+                    type: `insert`,
+                    key: `queued`,
+                    value: { id: `queued` },
+                  },
+                ])
+          void write.catch(() => undefined)
+          await queued.promise
+          expect(formerAdapter.appliedTxs).toEqual([])
+
+          unsubscribeFormer()
+          await vi.waitFor(() => expect(newLeader.isLeader(`todos`)).toBe(true))
+          releaseQueued.resolve()
+
+          await expect(write).resolves.toMatchObject({
+            ok: false,
+            code: `NOT_LEADER`,
+          })
+          expect(formerAdapter.appliedTxs).toEqual([])
+          expect(newAdapter.appliedTxs).toEqual([])
+          expect(committedMessagePosts).toBe(0)
+        } finally {
+          releaseQueued.resolve()
+          await write?.catch(() => undefined)
+          observeBroadcastMessage = undefined
+          unsubscribeFormer()
+          unsubscribeNew()
+          formerLeader.dispose()
+          newLeader.dispose()
+        }
+      },
+    )
+
+    it(`paces leadership retry after stream-position failure`, async () => {
+      vi.useFakeTimers()
+      const streamError = new Error(`stream position unavailable`)
+      const adapter = createStubAdapter()
+      const getStreamPosition = vi
+        .fn()
+        .mockRejectedValueOnce(streamError)
+        .mockResolvedValue({
+          latestTerm: 0,
+          latestSeq: 0,
+          latestRowVersion: 0,
+        })
+      adapter.getStreamPosition = getStreamPosition
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const coordinator = createCoordinator(adapter)
+
+      try {
+        coordinator.subscribe(`todos`, () => {})
+        await vi.advanceTimersByTimeAsync(0)
+
+        expect({
+          streamPositionReads: getStreamPosition.mock.calls.length,
+          isLeader: coordinator.isLeader(`todos`),
+          warnings: warning.mock.calls.length,
+        }).toEqual({
+          streamPositionReads: 1,
+          isLeader: false,
+          warnings: 1,
+        })
+
+        await vi.advanceTimersByTimeAsync(1_000)
+
+        expect({
+          streamPositionReads: getStreamPosition.mock.calls.length,
+          isLeader: coordinator.isLeader(`todos`),
+          warnings: warning.mock.calls.length,
+        }).toEqual({
+          streamPositionReads: 2,
+          isLeader: true,
+          warnings: 1,
+        })
+      } finally {
+        coordinator.dispose()
+        warning.mockRestore()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`cancels a delayed leadership retry on disposal`, async () => {
+      vi.useFakeTimers()
+      const adapter = createStubAdapter()
+      const getStreamPosition = vi
+        .fn()
+        .mockRejectedValueOnce(new Error(`stream position unavailable`))
+        .mockResolvedValue({
+          latestTerm: 0,
+          latestSeq: 0,
+          latestRowVersion: 0,
+        })
+      adapter.getStreamPosition = getStreamPosition
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const coordinator = createCoordinator(adapter)
+
+      try {
+        coordinator.subscribe(`todos`, () => {})
+        await vi.advanceTimersByTimeAsync(0)
+        coordinator.dispose()
+        await vi.advanceTimersByTimeAsync(1_000)
+
+        expect({
+          streamPositionReads: getStreamPosition.mock.calls.length,
+          isLeader: coordinator.isLeader(`todos`),
+          warnings: warning.mock.calls.length,
+        }).toEqual({
+          streamPositionReads: 1,
+          isLeader: false,
+          warnings: 1,
+        })
+      } finally {
+        coordinator.dispose()
+        warning.mockRestore()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`second coordinator waits for leadership`, async () => {
+      const coord1 = createCoordinator()
+      coord1.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coord1.isLeader(`todos`)).toBe(true)
+
+      const coord2 = createCoordinator()
+      coord2.subscribe(`todos`, () => {})
+      await flush(50)
+      // coord2 should be follower while coord1 holds the lock
+      expect(coord2.isLeader(`todos`)).toBe(false)
+
+      coord1.dispose()
+      coord2.dispose()
+    })
+
+    it(`second coordinator takes over after first disposes`, async () => {
+      const coord1 = createCoordinator()
+      coord1.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coord1.isLeader(`todos`)).toBe(true)
+
+      const coord2 = createCoordinator()
+      coord2.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coord2.isLeader(`todos`)).toBe(false)
+
+      coord1.dispose()
+      await flush(50)
+
+      expect(coord2.isLeader(`todos`)).toBe(true)
+      coord2.dispose()
+    })
+
+    // The wrapper may issue best-effort release for a refresh that retired
+    // before acquisition. Without an acquisition ID, the coordinator must not
+    // send a release RPC to any leader.
+    it(`sends no release RPC for an unacquired subset`, async () => {
+      const follower = createCoordinator()
+      const internals = follower as unknown as {
+        sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
+      }
+      const sendRPC = vi.fn(() => Promise.reject(new Error(`unexpected RPC`)))
+      internals.sendRPC = sendRPC
+      try {
+        await follower.requestReleaseRemoteSubset(`todos`, { limit: 1 })
+        expect(sendRPC).not.toHaveBeenCalled()
+      } finally {
+        follower.dispose()
+      }
+    })
+
+    // A release can fail while the original acquisition is still in flight.
+    // Its later success must not cancel the retained release retry debt.
+    // The settled-acquisition neighbor checks that ordinary release retry
+    // remains possible without an overlapping acquisition.
+    it.each([false, true])(
+      `retains a release retry when acquisition overlaps release=%s`,
+      async (overlap) => {
+        const leader = createCoordinator()
+        const follower = createCoordinator()
+        const unsubscribeLeader = leader.subscribe(`todos`, () => {})
+        follower.subscribe(`todos`, () => {})
+        await flush(50)
+        const heldOwner = createDeferred()
+        const owner = Object.assign(
+          vi.fn(() => heldOwner.promise),
+          {
+            unloadSubset: vi.fn(),
+            onError: vi.fn(),
+          },
+        )
+        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+        const options: LoadSubsetOptions = { limit: 1 }
+        const internals = follower as unknown as {
+          sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
+          outboundRemoteSubsetAcquisitions: Map<
+            string,
+            { retryTimer: ReturnType<typeof setTimeout> | null }
+          >
+        }
+        const sendRPC = internals.sendRPC.bind(follower)
+        let releaseAttempts = 0
+        internals.sendRPC = (collectionId, request) => {
+          if (
+            (request as { type?: string }).type ===
+            `rpc:releaseRemoteSubset:req`
+          ) {
+            releaseAttempts++
+            if (releaseAttempts === 1) {
+              return Promise.reject(
+                new Error(`review release transport failure`),
+              )
+            }
+          }
+          return sendRPC(collectionId, request)
+        }
+        const ensure = follower.requestEnsureRemoteSubset(`todos`, options)
+        try {
+          await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
+          if (!overlap) {
+            heldOwner.resolve()
+            await ensure
+          }
+          await expect(
+            follower.requestReleaseRemoteSubset(`todos`, options),
+          ).rejects.toThrow(`review release transport failure`)
+          const acquisition = [
+            ...internals.outboundRemoteSubsetAcquisitions.values(),
+          ][0]!
+          expect(acquisition.retryTimer).not.toBeNull()
+          if (overlap) heldOwner.resolve()
+          await ensure
+          expect(acquisition.retryTimer).not.toBeNull()
+          await vi.waitFor(() => expect(releaseAttempts).toBe(2))
+        } finally {
+          heldOwner.resolve()
+          await Promise.allSettled([ensure])
+          unregisterOwner()
+          unsubscribeLeader()
+          leader.dispose()
+          follower.dispose()
+        }
+      },
+    )
+
+    it.each([
+      { schemaV1: 1, schemaV2: 2 },
+      { schemaV1: 2, schemaV2: 4 },
+    ])(
+      `routes each collection through its schema-version adapter: $schemaV1/$schemaV2`,
+      async ({ schemaV1, schemaV2 }) => {
+        const database = createWASQLiteTestDatabase({ filename: `:memory:` })
+        const coordinator = new BrowserCollectionCoordinator({
+          dbName: `schema-routed-db`,
+        })
+        const persistence = createBrowserWASQLitePersistence({
+          database,
+          coordinator,
+        })
+        const collectionV1 = `schema-routed-v1`
+        const collectionV2 = `schema-routed-v2`
+
+        try {
+          const optionsV1 = persistedCollectionOptions<
+            { id: string; title: string },
+            string
+          >({
+            id: collectionV1,
+            schemaVersion: schemaV1,
+            getKey: (row) => row.id,
+            persistence,
+          })
+          await optionsV1.persistence.adapter.loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionV1,
+          })
+
+          const optionsV2 = persistedCollectionOptions<
+            { id: string; title: string },
+            string
+          >({
+            id: collectionV2,
+            schemaVersion: schemaV2,
+            getKey: (row) => row.id,
+            persistence,
+          })
+          await optionsV2.persistence.adapter.loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionV2,
+          })
+
+          coordinator.subscribe(collectionV1, () => {})
+          coordinator.subscribe(collectionV2, () => {})
+          await vi.waitFor(() => {
+            expect(coordinator.isLeader(collectionV1)).toBe(true)
+            expect(coordinator.isLeader(collectionV2)).toBe(true)
+          })
+
+          const [resultV1, resultV2] = await Promise.all([
+            coordinator.requestApplyLocalMutations(collectionV1, [
+              {
+                mutationId: `mutation-v1`,
+                type: `insert`,
+                key: `v1`,
+                value: { id: `v1`, title: `schema one` },
+              },
+            ]),
+            coordinator.requestApplyLocalMutations(collectionV2, [
+              {
+                mutationId: `mutation-v2`,
+                type: `insert`,
+                key: `v2`,
+                value: { id: `v2`, title: `schema two` },
+              },
+            ]),
+          ])
+
+          expect(resultV1.ok).toBe(true)
+          expect(resultV2.ok).toBe(true)
+          expect(
+            await optionsV1.persistence.adapter.loadSubset(
+              { kind: `eager`, collectionId: collectionV1 },
+              {},
+            ),
+          ).toMatchObject([
+            { key: `v1`, value: { id: `v1`, title: `schema one` } },
+          ])
+          expect(
+            await optionsV2.persistence.adapter.loadSubset(
+              { kind: `eager`, collectionId: collectionV2 },
+              {},
+            ),
+          ).toMatchObject([
+            { key: `v2`, value: { id: `v2`, title: `schema two` } },
+          ])
+        } finally {
+          coordinator.dispose()
+          await Promise.resolve(database.close?.())
+        }
+      },
+    )
+
+    it(`different collections have independent leaders`, async () => {
+      const coord1 = createCoordinator()
+      const coord2 = createCoordinator()
+
+      coord1.subscribe(`todos`, () => {})
+      coord2.subscribe(`notes`, () => {})
+      await flush(50)
+
+      expect(coord1.isLeader(`todos`)).toBe(true)
+      expect(coord2.isLeader(`notes`)).toBe(true)
+
+      coord1.dispose()
+      coord2.dispose()
+    })
+
+    it(`records an unrelated heartbeat without joining that collection's leadership`, async () => {
+      const adapter = createStubAdapter()
+      const getStreamPosition = vi.spyOn(adapter, `getStreamPosition`)
+      const coordinator = createCoordinator(adapter)
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+
+      injectBroadcastMessage(`tsdb:coord:test-db`, {
+        v: 1,
+        dbName: `test-db`,
+        collectionId: `notes`,
+        senderId: `notes-owner`,
+        ts: Date.now(),
+        payload: {
+          type: `leader:heartbeat`,
+          term: 4,
+          leaderId: `notes-owner`,
+          latestSeq: 3,
+          latestRowVersion: 8,
+        },
+      })
+      await flush(0)
+
+      const state = (
+        coordinator as unknown as {
+          collections: Map<
+            string,
+            { leaderId: string | null; latestTerm: number }
+          >
+        }
+      ).collections.get(`notes`)
+      expect({
+        leaderId: state?.leaderId,
+        latestTerm: state?.latestTerm,
+        joinedLeadership: coordinator.isLeader(`notes`),
+        streamPositionCollections: getStreamPosition.mock.calls.map(
+          ([target]) => storageId(target),
+        ),
+      }).toEqual({
+        leaderId: `notes-owner`,
+        latestTerm: 4,
+        joinedLeadership: false,
+        streamPositionCollections: [`todos`],
+      })
+    })
+
+    it(`returns unique node ids`, () => {
+      const coord1 = createCoordinator()
+      const coord2 = createCoordinator()
+
+      expect(coord1.getNodeId()).not.toBe(coord2.getNodeId())
+
+      coord1.dispose()
+      coord2.dispose()
+    })
+  })
+
+  describe(`leadership need under a queued read`, () => {
+    const collectionId = `needed`
+
+    it(`reserves the term after the queued read when no caller needs a leader`, async () => {
+      const { adapter, queuedRead } = createQueuedReadAdapter()
+      const holder = createCoordinator(adapter)
+      holder.subscribe(collectionId, () => {})
+      await flush(50)
+      expect(durableTerms.get(collectionId)).toBeUndefined()
+      expect(holder.isLeader(collectionId)).toBe(false)
+
+      queuedRead.resolve()
+      await flush(20)
+      expect(durableTerms.get(collectionId)).toBe(1)
+      expect(holder.isLeader(collectionId)).toBe(true)
+    })
+
+    /**
+     * Starts a leader, then a follower whose queued read is held, and lets
+     * `serve` make requests that the leader answers.
+     */
+    async function followerOfServedLeader(
+      serve: (follower: BrowserCollectionCoordinator) => Promise<unknown>,
+    ) {
+      const leader = createCoordinator()
+      leader.subscribe(collectionId, () => {})
+      await flush(20)
+      const { adapter, queuedRead } = createQueuedReadAdapter()
+      const follower = createCoordinator(adapter)
+      follower.subscribe(collectionId, () => {})
+      await flush(20)
+      await serve(follower)
+      expect(durableTerms.get(collectionId)).toBe(1)
+      return { leader, follower, queuedRead }
+    }
+
+    it.each([
+      {
+        served: `another tab's request`,
+        serve: async () => {
+          const other = createCoordinator()
+          other.subscribe(collectionId, () => {})
+          await other.pullSince(collectionId, 0)
+          other.dispose()
+        },
+      },
+      {
+        served: `the follower's own request`,
+        serve: (follower: BrowserCollectionCoordinator) =>
+          follower.pullSince(collectionId, 0),
+      },
+    ])(
+      `keeps a takeover term behind its queued read after $served was served`,
+      async ({ serve }) => {
+        const { leader, follower, queuedRead } =
+          await followerOfServedLeader(serve)
+        leader.dispose()
+        await flush(50)
+        expect(durableTerms.get(collectionId)).toBe(1)
+        expect(follower.isLeader(collectionId)).toBe(false)
+
+        queuedRead.resolve()
+        await flush(20)
+        expect(durableTerms.get(collectionId)).toBe(2)
+        expect(follower.isLeader(collectionId)).toBe(true)
+      },
+    )
+
+    it(`treats a request during a takeover as a need despite a delayed former heartbeat`, async () => {
+      const { leader, follower, queuedRead } = await followerOfServedLeader(
+        (follower) => follower.pullSince(collectionId, 0),
+      )
+      const formerId = leader.getNodeId()
+      leader.dispose()
+      await flush(50)
+      // The departed leader's last heartbeat arrives during the election.
+      injectBroadcastMessage(`tsdb:coord:test-db`, {
+        v: 1,
+        dbName: `test-db`,
+        collectionId,
+        senderId: formerId,
+        ts: Date.now(),
+        payload: {
+          type: `leader:heartbeat`,
+          term: 1,
+          leaderId: formerId,
+          latestSeq: 0,
+          latestRowVersion: 0,
+        },
+      })
+      await flush(0)
+      expect(durableTerms.get(collectionId)).toBe(1)
+
+      let settled = false
+      const pulled = follower.pullSince(collectionId, 0).finally(() => {
+        settled = true
+      })
+      void pulled.catch(() => undefined)
+      try {
+        await flush(50)
+        expect(durableTerms.get(collectionId)).toBe(2)
+        expect(follower.isLeader(collectionId)).toBe(true)
+        queuedRead.resolve()
+        await Promise.race([pulled, flush(1_000)])
+        expect(settled).toBe(true)
+        await expect(pulled).resolves.toMatchObject({ ok: true })
+      } finally {
+        queuedRead.resolve()
+        await Promise.race([pulled.catch(() => undefined), flush(0)])
+      }
+    })
+
+    /**
+     * # When may an election wait behind queued reads?
+     *
+     * Law: a Web Lock holder reserves its durable election term only after the
+     * reads already queued on its shared scheduler, unless some caller needs a
+     * leader first. A leadership need ends that wait at once: a local route
+     * wait, an outbound RPC, `ensureLeadership`, or an inbound route request or
+     * RPC from another tab. Without that rule, a hydrate that waits for its
+     * first writer route would wait for an election that waits for the hydrate.
+     * A need belongs to one election: it is still waiting at the grant, or it
+     * arrives before the term. A need that an earlier leader served, for this
+     * tab or another, does not exempt a later election. The lock is exclusive,
+     * so its holder has no route to another leader: a delayed heartbeat from
+     * the departed leader does not restore one, and a request made during the
+     * election is a need.
+     *
+     * Model: the reference is the need table below. Every listed request is a
+     * leadership need, so the term must exist while the queued read is still
+     * held. The read is a deferred hydrate: the scheduler barrier
+     * (`runInRegularScope.afterQueuedWork`) and all regular work wait for it,
+     * so it also holds the leader-side write for mutating requests. After
+     * the read is released, each request settles well before the RPC timeout.
+     * A remote request posts one RPC of its kind. Remote subset demand may also
+     * replay once when its first leader becomes known; every post carries the
+     * same acquisition ID, and the lease oracle owns exact lease accounting.
+     *
+     * Grammar: each request kind × a local requester (the lock holder itself)
+     * or a remote requester (a later tab whose lock request is queued). Remote
+     * `ensureLeadership` is excluded: the holder keeps the lock, so the remote
+     * caller has no route to its own leadership. Release of an unacquired
+     * subset sends no RPC and is not a leadership need.
+     *
+     * Checkpoints: before the request (premise: no term while the read is
+     * held), after bounded turns with the read still held (term and route), and
+     * after release (settlement and RPC count). Hostile mutants that skip any
+     * need mark fail the held-read checkpoint or the settlement deadline.
+     *
+     * Per-election cells: a follower takes over from a leader that served an
+     * earlier need, from another tab or from the follower itself, while the
+     * follower's queued read is held. The model has no term until the read is
+     * released. A third cell delivers the departed leader's heartbeat during
+     * the follower's election and then makes a request; the model has the
+     * follower's term while the read is still held.
+     */
+    const transaction = (txId: string): PersistedTx => ({
+      txId,
+      term: 0,
+      seq: 0,
+      rowVersion: 0,
+      mutations: [{ type: `insert`, key: txId, value: { id: txId } }],
+    })
+
+    const leadershipNeeds = {
+      'local mutation': {
+        request: `rpc:applyLocalMutations:req`,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.requestApplyLocalMutations(collectionId, [
+            {
+              mutationId: `needed-mutation`,
+              type: `insert`,
+              key: `needed-mutation`,
+              value: { id: `needed-mutation` },
+            },
+          ]),
+      },
+      'source commit': {
+        request: `rpc:applyCommittedTx:req`,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.requestApplyCommittedTx(
+            collectionId,
+            transaction(`needed-commit`),
+          ),
+      },
+      reconciliation: {
+        request: `rpc:reconcileCommittedTx:req`,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.reconcileCommittedTx(
+            collectionId,
+            transaction(`needed-reconcile`),
+            { latestRowVersion: 0, resetEpoch: 0 },
+          ),
+      },
+      'remote subset': {
+        request: `rpc:ensureRemoteSubset:req`,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.requestEnsureRemoteSubset(collectionId, { limit: 1 }),
+      },
+      pullSince: {
+        request: `rpc:pullSince:req`,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.pullSince(collectionId, 0),
+      },
+      'persisted index': {
+        request: `rpc:ensurePersistedIndex:req`,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.requestEnsurePersistedIndex(collectionId, `needed-idx`, {
+            expressionSql: [`id`],
+          }),
+      },
+      ensureLeadership: {
+        request: undefined,
+        run: (coordinator: BrowserCollectionCoordinator) =>
+          coordinator.ensureLeadership(collectionId),
+      },
+    } as const
+
+    const cells = Object.keys(leadershipNeeds).flatMap((kind) =>
+      (kind === `ensureLeadership`
+        ? ([`local`] as const)
+        : ([`local`, `remote`] as const)
+      ).map((requester) => ({
+        kind: kind as keyof typeof leadershipNeeds,
+        requester,
+      })),
+    )
+
+    it.each(cells)(
+      `elects for a $requester $kind while a queued read holds the scheduler`,
+      async ({ kind, requester }) => {
+        const need = leadershipNeeds[kind]
+        const { adapter, queuedRead } = createQueuedReadAdapter()
+        const holder = createCoordinator(adapter)
+        holder.registerRemoteSubsetOwner(
+          collectionId,
+          withUnusedUnloadSubset(async () => {}),
+        )
+        holder.subscribe(collectionId, () => {})
+        await flush(20)
+        const caller =
+          requester === `local` ? holder : createCoordinator(adapter)
+        if (caller !== holder) caller.subscribe(collectionId, () => {})
+        await flush(20)
+        // Premise: the holder has the Web Lock, but its term waits behind
+        // the queued read because no caller has needed a leader yet.
+        expect(durableTerms.get(collectionId)).toBeUndefined()
+        expect(holder.isLeader(collectionId)).toBe(false)
+
+        const posts: Array<{ acquisitionId?: string }> = []
+        observePostedMessage = (data) => {
+          const payload = (
+            data as { payload?: { type?: string; acquisitionId?: string } }
+          ).payload
+          if (need.request !== undefined && payload?.type === need.request) {
+            posts.push({ acquisitionId: payload.acquisitionId })
+          }
+        }
+        let settled = false
+        const pending = Promise.resolve(need.run(caller)).finally(() => {
+          settled = true
+        })
+        void pending.catch(() => undefined)
+        try {
+          await flush(50)
+          // The need ended the wait before the read finished.
+          expect(durableTerms.get(collectionId)).toBe(1)
+          expect(holder.isLeader(collectionId)).toBe(true)
+          expect(caller.isLeader(collectionId)).toBe(caller === holder)
+
+          queuedRead.resolve()
+          await Promise.race([pending, flush(1_000)])
+          expect(settled).toBe(true)
+          await pending
+          compareNeedPosts(kind, need, caller === holder, posts)
+        } finally {
+          queuedRead.resolve()
+          observePostedMessage = undefined
+          // A request stuck on an RPC timeout must not hide the assertion;
+          // disposal in afterEach rejects it.
+          await Promise.race([pending.catch(() => undefined), flush(0)])
+        }
+      },
+    )
+  })
+
+  /**
+   * # What does `ensureLeadership` promise?
+   *
+   * Law: `PersistedCollectionCoordinator.ensureLeadership` resolves when this
+   * node becomes the collection's leader, whether it already leads or its
+   * queued Web Lock is granted later. Joining keeps an existing lock request
+   * and its queue position. Disposal rejects the wait, as it rejects other
+   * route waits and pending RPCs. The model is the FIFO Web Lock queue: tabs
+   * that subscribed earlier are granted earlier. Checkpoints are the call's
+   * settlement and each tab's `isLeader` after the current leader disposes.
+   */
+  describe(`ensureLeadership`, () => {
+    it(`resolves at once for the current leader`, async () => {
+      const leader = createCoordinator()
+      leader.subscribe(`todos`, () => {})
+      await flush(20)
+      expect(leader.isLeader(`todos`)).toBe(true)
+      await expect(leader.ensureLeadership(`todos`)).resolves.toBeUndefined()
+    })
+
+    it(`resolves when a queued lock is granted later, keeping its queue position`, async () => {
+      const first = createCoordinator()
+      const second = createCoordinator()
+      const third = createCoordinator()
+      first.subscribe(`todos`, () => {})
+      await flush(20)
+      second.subscribe(`todos`, () => {})
+      third.subscribe(`todos`, () => {})
+      await flush(20)
+      expect(first.isLeader(`todos`)).toBe(true)
+
+      let settled = false
+      const ensured = second.ensureLeadership(`todos`).finally(() => {
+        settled = true
+      })
+      void ensured.catch(() => undefined)
+      await flush(20)
+      expect(settled).toBe(false)
+
+      first.dispose()
+      await flush(50)
+      expect(second.isLeader(`todos`)).toBe(true)
+      expect(third.isLeader(`todos`)).toBe(false)
+      expect(settled).toBe(true)
+      await expect(ensured).resolves.toBeUndefined()
+    })
+
+    // A request that first waits for a route keeps the retry budget it had
+    // without that wait. A lock holder that never announces a route stands in
+    // for a slow election: once it lets go, this tab leads and the request is
+    // still within its retries.
+    it(`keeps an RPC's retry budget when the first route wait times out`, async () => {
+      const lockName = `tsdb:leader:test-db:todos`
+      let releaseHolder!: () => void
+      const holding = new Promise<void>((acquired) => {
+        void navigator.locks.request(lockName, () => {
+          acquired()
+          return new Promise<void>((resolve) => {
+            releaseHolder = resolve
+          })
+        })
+      })
+      await holding
+      const follower = createCoordinator()
+      follower.subscribe(`todos`, () => {})
+      await flush(20)
+      expect(follower.isLeader(`todos`)).toBe(false)
+
+      const pulled = follower.pullSince(`todos`, 0)
+      void pulled.catch(() => undefined)
+      // Past the route wait's 10 s bound, then the holder lets go.
+      await new Promise((resolve) => setTimeout(resolve, 10_500))
+      releaseHolder()
+      await expect(pulled).resolves.toMatchObject({ ok: true })
+      expect(follower.isLeader(`todos`)).toBe(true)
+    }, 40_000)
+
+    it(`rejects a pending wait when its coordinator is disposed`, async () => {
+      const leader = createCoordinator()
+      const waiting = createCoordinator()
+      leader.subscribe(`todos`, () => {})
+      await flush(20)
+      waiting.subscribe(`todos`, () => {})
+      await flush(20)
+
+      const ensured = waiting.ensureLeadership(`todos`)
+      void ensured.catch(() => undefined)
+      waiting.dispose()
+      await expect(ensured).rejects.toThrow(/leadership route closed/)
+      expect(leader.isLeader(`todos`)).toBe(true)
+    })
+  })
+
+  describe(`message transport`, () => {
+    it(`delivers published messages to remote subscribers`, async () => {
+      const coord1 = createCoordinator()
+      const coord2 = createCoordinator()
+
+      const received: Array<unknown> = []
+      coord2.subscribe(`todos`, (msg) => {
+        received.push(msg.payload)
+      })
+
+      coord1.subscribe(`todos`, () => {})
+      await flush(50)
+
+      coord1.publish(`todos`, {
+        v: 1,
+        dbName: `test-db`,
+        collectionId: `todos`,
+        senderId: coord1.getNodeId(),
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `tx-1`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        },
+      })
+
+      await flush()
+
+      expect(received.length).toBe(1)
+      expect((received[0] as Record<string, unknown>).type).toBe(`tx:committed`)
+
+      coord1.dispose()
+      coord2.dispose()
+    })
+
+    it(`does not deliver own messages to self via subscriber`, async () => {
+      const coord = createCoordinator()
+      const received: Array<unknown> = []
+      coord.subscribe(`todos`, (msg) => {
+        received.push(msg)
+      })
+      await flush(50)
+
+      coord.publish(`todos`, {
+        v: 1,
+        dbName: `test-db`,
+        collectionId: `todos`,
+        senderId: coord.getNodeId(),
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `tx-1`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        },
+      })
+
+      await flush()
+
+      expect(received.length).toBe(0)
+      coord.dispose()
+    })
+
+    it(`ignores unsupported Browser RPC request types without answering`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.isLeader = () => true
+      const postMessage = vi.fn()
+      const internals = coordinator as unknown as {
+        onChannelMessage: (message: unknown) => void
+        channel: { postMessage: (message: unknown) => void }
+      }
+      internals.channel.postMessage = postMessage
+
+      internals.onChannelMessage({
+        v: 1,
+        dbName: `test-db`,
+        collectionId: `todos`,
+        senderId: `future-browser-peer`,
+        ts: Date.now(),
+        payload: {
+          type: `rpc:futureProtocol:req`,
+          rpcId: `future-browser-rpc`,
+        },
+      })
+      await flush(0)
+
+      expect(postMessage).not.toHaveBeenCalled()
+      coordinator.dispose()
+    })
+  })
+
+  describe(`RPC - applyLocalMutations`, () => {
+    it.each([{ kind: `source commit` }, { kind: `local mutation` }] as const)(
+      `waits for initial leadership before routing a $kind`,
+      async ({ kind }) => {
+        const adapter = createStubAdapter()
+        const readStarted = createDeferred()
+        const releaseRead = createDeferred()
+        adapter.getStreamPosition = async () => {
+          readStarted.resolve()
+          await releaseRead.promise
+          return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+        }
+        const coordinator = createCoordinator(adapter)
+        const mutationPosts: Array<string> = []
+        observePostedMessage = (data) => {
+          const type = (data as { payload?: { type?: string } }).payload?.type
+          if (
+            type === `rpc:applyCommittedTx:req` ||
+            type === `rpc:applyLocalMutations:req`
+          ) {
+            mutationPosts.push(type)
+          }
+        }
+
+        coordinator.subscribe(`todos`, () => {})
+        await readStarted.promise
+        const request =
+          kind === `source commit`
+            ? coordinator.requestApplyCommittedTx(`todos`, {
+                txId: `first-source-commit`,
+                term: 0,
+                seq: 0,
+                rowVersion: 0,
+                mutations: [
+                  {
+                    type: `insert`,
+                    key: `first`,
+                    value: { id: `first` },
+                  },
+                ],
+              })
+            : coordinator.requestApplyLocalMutations(`todos`, [
+                {
+                  mutationId: `first-local-mutation`,
+                  type: `insert`,
+                  key: `first`,
+                  value: { id: `first` },
+                },
+              ])
+        void request.catch(() => undefined)
+
+        try {
+          // The single participating tab has not yet read its durable stream
+          // position. No owner is known, so no mutation may enter transport.
+          expect(coordinator.isLeader(`todos`)).toBe(false)
+          expect(mutationPosts).toEqual([])
+
+          releaseRead.resolve()
+          await expect(request).resolves.toMatchObject({ ok: true })
+          expect(mutationPosts).toEqual([])
+          expect(adapter.appliedTxs).toHaveLength(1)
+          expect(adapter.appliedTxs[0]?.collectionId).toBe(`todos`)
+        } finally {
+          releaseRead.resolve()
+          coordinator.dispose()
+          await request.catch(() => undefined)
+          observePostedMessage = undefined
+        }
+      },
+    )
+
+    it.each([{ kind: `source commit` }, { kind: `local mutation` }] as const)(
+      `discovers a late follower route before the next heartbeat for a $kind`,
+      async ({ kind }) => {
+        vi.useFakeTimers()
+        const leaderAdapter = createStubAdapter()
+        const leader = createCoordinator(leaderAdapter)
+        let follower: BrowserCollectionCoordinator | undefined
+        let observed: Promise<void> | undefined
+        let settled = false
+        let response:
+          ApplyCommittedTxResponse | ApplyLocalMutationsResponse | undefined
+        let failure: unknown
+        const posted: Array<string> = []
+
+        try {
+          leader.subscribe(`todos`, () => {})
+          await vi.advanceTimersByTimeAsync(0)
+          expect(leader.isLeader(`todos`)).toBe(true)
+
+          // The follower joins after the initial heartbeat. Stop periodic
+          // heartbeats so only an explicit route reply can settle its write.
+          const leaderState = inspectCoordinator(leader).collections.get(
+            `todos`,
+          ) as { heartbeatTimer: ReturnType<typeof setInterval> | null }
+          if (leaderState.heartbeatTimer !== null) {
+            clearInterval(leaderState.heartbeatTimer)
+            leaderState.heartbeatTimer = null
+          }
+          observePostedMessage = (data) => {
+            const envelope = data as {
+              collectionId?: string
+              payload?: { type?: string }
+            }
+            const type = envelope.payload?.type
+            if (
+              envelope.collectionId === `todos` &&
+              (type === `leader:routeRequest` ||
+                type === `leader:heartbeat` ||
+                type === `rpc:applyCommittedTx:req` ||
+                type === `rpc:applyLocalMutations:req`)
+            ) {
+              posted.push(type)
+            }
+          }
+
+          follower = createCoordinator()
+          follower.subscribe(`todos`, () => {})
+          expect(follower.isLeader(`todos`)).toBe(false)
+
+          const write =
+            kind === `source commit`
+              ? follower.requestApplyCommittedTx(`todos`, {
+                  txId: `late-follower-source`,
+                  term: 0,
+                  seq: 0,
+                  rowVersion: 0,
+                  mutations: [
+                    { type: `insert`, key: `first`, value: { id: `first` } },
+                  ],
+                })
+              : follower.requestApplyLocalMutations(`todos`, [
+                  {
+                    mutationId: `late-follower-local`,
+                    type: `insert`,
+                    key: `first`,
+                    value: { id: `first` },
+                  },
+                ])
+          observed = write.then(
+            (result) => {
+              settled = true
+              response = result
+            },
+            (error: unknown) => {
+              settled = true
+              failure = error
+            },
+          )
+          await vi.advanceTimersByTimeAsync(0)
+
+          expect({
+            settled,
+            failure,
+            responseOk: response?.ok,
+            posted,
+          }).toEqual({
+            settled: true,
+            failure: undefined,
+            responseOk: true,
+            posted: [
+              `leader:routeRequest`,
+              `leader:heartbeat`,
+              kind === `source commit`
+                ? `rpc:applyCommittedTx:req`
+                : `rpc:applyLocalMutations:req`,
+            ],
+          })
+          expect(leaderAdapter.appliedTxs).toHaveLength(1)
+        } finally {
+          observePostedMessage = undefined
+          follower?.dispose()
+          leader.dispose()
+          await vi.advanceTimersByTimeAsync(0)
+          await observed
+          vi.useRealTimers()
+        }
+      },
+    )
+
+    it(`rejects a first source commit when election cannot establish a route`, async () => {
+      vi.useFakeTimers()
+      const adapter = createStubAdapter()
+      const readPosition = vi
+        .fn()
+        .mockRejectedValue(new Error(`stream position unavailable`))
+      adapter.getStreamPosition = readPosition
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const coordinator = createCoordinator(adapter)
+      coordinator.subscribe(`todos`, () => {})
+      const request = coordinator.requestApplyCommittedTx(`todos`, {
+        txId: `first-source-commit`,
+        term: 0,
+        seq: 0,
+        rowVersion: 0,
+        mutations: [],
+      })
+      let settled = false
+      const outcome = request.then(
+        () => {
+          settled = true
+          return undefined
+        },
+        (error: unknown) => {
+          settled = true
+          return error
+        },
+      )
+
+      try {
+        await vi.advanceTimersByTimeAsync(10_001)
+        expect(readPosition.mock.calls.length).toBeGreaterThan(1)
+        expect(settled).toBe(true)
+        expect(await outcome).toMatchObject({
+          message: expect.stringContaining(`leadership route`),
+        })
+        expect(adapter.appliedTxs).toEqual([])
+      } finally {
+        coordinator.dispose()
+        await outcome
+        warning.mockRestore()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`leader applies mutations and returns accepted ids`, async () => {
+      const adapter = createStubAdapter()
+      const coord = createCoordinator(adapter)
+
+      coord.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coord.isLeader(`todos`)).toBe(true)
+
+      const response = await coord.requestApplyLocalMutations(`todos`, [
+        {
+          mutationId: `mut-1`,
+          type: `insert`,
+          key: `1`,
+          value: { id: `1`, title: `Test` },
+        },
+      ])
+
+      expect(response.ok).toBe(true)
+      if (response.ok) {
+        expect(response.acceptedMutationIds).toEqual([`mut-1`])
+        expect(response.term).toBeGreaterThan(0)
+        expect(response.seq).toBeGreaterThan(0)
+      }
+      expect(adapter.appliedTxs.length).toBe(1)
+
+      coord.dispose()
+    })
+
+    it(`follower routes mutations to leader via RPC`, async () => {
+      const adapter = createStubAdapter()
+      const leader = createCoordinator(adapter)
+      const follower = createCoordinator(adapter)
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      expect(leader.isLeader(`todos`)).toBe(true)
+      expect(follower.isLeader(`todos`)).toBe(false)
+
+      const response = await follower.requestApplyLocalMutations(`todos`, [
+        {
+          mutationId: `mut-2`,
+          type: `insert`,
+          key: `2`,
+          value: { id: `2`, title: `Follower mutation` },
+        },
+      ])
+
+      expect(response.ok).toBe(true)
+      if (response.ok) {
+        expect(response.acceptedMutationIds).toEqual([`mut-2`])
+      }
+      expect(adapter.appliedTxs.length).toBe(1)
+
+      leader.dispose()
+      follower.dispose()
+    })
+
+    it(`deduplicates envelope ids`, async () => {
+      const adapter = createStubAdapter()
+      const coord = createCoordinator(adapter)
+      coord.subscribe(`todos`, () => {})
+      await flush(50)
+
+      // First call
+      const res1 = await coord.requestApplyLocalMutations(`todos`, [
+        {
+          mutationId: `mut-1`,
+          type: `insert`,
+          key: `1`,
+          value: { id: `1`, title: `Test` },
+        },
+      ])
+      expect(res1.ok).toBe(true)
+      expect(adapter.appliedTxs.length).toBe(1)
+
+      coord.dispose()
+    })
+
+    it(`coalesces a local-mutation envelope while application is in flight`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const originalApply = leaderAdapter.applyCommittedTx
+      let releaseApplication = (): void => {}
+      const applicationGate = new Promise<void>((resolve) => {
+        releaseApplication = resolve
+      })
+      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
+        await applicationGate
+        return originalApply(collectionId, tx)
+      })
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator()
+      const observedResponses: Array<{
+        rpcId: string
+        term: number
+        seq: number
+        latestRowVersion: number
+        acceptedMutationIds: Array<string>
+      }> = []
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        duplicateNextBroadcastMessage = (data) => {
+          const envelope = data as { payload?: { type?: string } }
+          if (envelope.payload?.type !== `rpc:applyLocalMutations:req`) {
+            return undefined
+          }
+          const duplicate = structuredClone(data) as {
+            payload: { rpcId: string }
+          }
+          duplicate.payload.rpcId = `coalesced-local-rpc`
+          return duplicate
+        }
+        observeBroadcastMessage = (data) => {
+          const payload = (
+            data as {
+              payload?: {
+                type?: string
+                rpcId?: string
+                ok?: boolean
+                term?: number
+                seq?: number
+                latestRowVersion?: number
+                acceptedMutationIds?: Array<string>
+              }
+            }
+          ).payload
+          if (
+            payload?.type === `rpc:applyLocalMutations:res` &&
+            payload.ok === true
+          ) {
+            observedResponses.push({
+              rpcId: payload.rpcId!,
+              term: payload.term!,
+              seq: payload.seq!,
+              latestRowVersion: payload.latestRowVersion!,
+              acceptedMutationIds: payload.acceptedMutationIds!,
+            })
+          }
+        }
+
+        const responsePromise = follower.requestApplyLocalMutations(`todos`, [
+          {
+            mutationId: `mut-in-flight`,
+            type: `insert`,
+            key: `todo-in-flight-local`,
+            value: { id: `todo-in-flight-local` },
+          },
+        ])
+        await flush()
+        releaseApplication()
+        const response = await responsePromise
+        await flush()
+
+        const responsesByRpcId = Object.fromEntries(
+          observedResponses.map(({ rpcId, ...result }) => [rpcId, result]),
+        )
+        const expectedResult = {
+          term: 1,
+          seq: 1,
+          latestRowVersion: 1,
+          acceptedMutationIds: [`mut-in-flight`],
+        }
+        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+        expect(responsesByRpcId).toEqual({
+          [response.rpcId]: expectedResult,
+          'coalesced-local-rpc': expectedResult,
+        })
+      } finally {
+        releaseApplication()
+        observeBroadcastMessage = undefined
+        duplicateNextBroadcastMessage = undefined
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`replays the exact local-mutation success after same-leader response loss`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const followerAdapter = createStubAdapter()
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(followerAdapter)
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      vi.useFakeTimers()
+      try {
+        let droppedResponse: unknown
+        dropNextBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type !== `rpc:applyLocalMutations:res`) return false
+          droppedResponse = structuredClone(payload)
+          return true
+        }
+
+        const responsePromise = follower.requestApplyLocalMutations(`todos`, [
+          {
+            mutationId: `local-response-loss`,
+            type: `insert`,
+            key: `todo-local-response-loss`,
+            value: { id: `todo-local-response-loss` },
+          },
+        ])
+
+        await vi.advanceTimersByTimeAsync(0)
+        expect(droppedResponse).toMatchObject({
+          type: `rpc:applyLocalMutations:res`,
+          ok: true,
+        })
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+
+        await vi.advanceTimersByTimeAsync(10_200)
+        const response = await responsePromise
+
+        expect(response).toEqual(droppedResponse)
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+        expect(followerAdapter.appliedTxs).toEqual([])
+      } finally {
+        leader.dispose()
+        follower.dispose()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`accepts a delivered mutation success after the observed route changes`, async () => {
+      const coordinator = createCoordinator()
+      const internals = coordinator as unknown as {
+        collections: Map<
+          string,
+          { isLeader: boolean; leaderId: string | null; latestTerm: number }
+        >
+      }
+      internals.collections.set(`todos`, {
+        isLeader: false,
+        leaderId: `leader-before`,
+        latestTerm: 1,
+      })
+      const deliveredSuccess = vi.fn(
+        (_collectionId: string, request: ApplyLocalMutationsRequest) => {
+          const state = internals.collections.get(`todos`)!
+          state.leaderId = `leader-after`
+          state.latestTerm = 2
+          return Promise.resolve({
+            type: `rpc:applyLocalMutations:res` as const,
+            rpcId: request.rpcId,
+            ok: true as const,
+            term: 1,
+            seq: 7,
+            latestRowVersion: 7,
+            acceptedMutationIds: request.mutations.map(
+              (mutation) => mutation.mutationId,
+            ),
+          })
+        },
+      )
+      Object.defineProperty(coordinator, `sendRPCOnce`, {
+        value: deliveredSuccess,
+        configurable: true,
+      })
+
+      try {
+        await expect(
+          coordinator.requestApplyLocalMutations(`todos`, [
+            {
+              mutationId: `delivered-before-route-change`,
+              type: `insert`,
+              key: `delivered-before-route-change`,
+              value: { id: `delivered-before-route-change` },
+            },
+          ]),
+        ).resolves.toMatchObject({
+          ok: true,
+          acceptedMutationIds: [`delivered-before-route-change`],
+        })
+        expect(deliveredSuccess).toHaveBeenCalledOnce()
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    it(`fails indeterminate when a local-mutation success is lost across leader change`, async () => {
+      const retiredLeaderAdapter = createStubAdapter()
+      const requesterAdapter = createStubAdapter()
+      const retiredLeader = createCoordinator(retiredLeaderAdapter)
+      const requester = createCoordinator(requesterAdapter)
+
+      retiredLeader.subscribe(`todos`, () => {})
+      requester.subscribe(`todos`, () => {})
+      await flush(50)
+
+      vi.useFakeTimers()
+      try {
+        let committedMessagePosts = 0
+        observeBroadcastMessage = (data) => {
+          if (
+            (data as { payload?: { type?: string } }).payload?.type ===
+            `tx:committed`
+          ) {
+            committedMessagePosts++
+          }
+        }
+        dropNextBroadcastMessage = (data) =>
+          (data as { payload?: { type?: string } }).payload?.type ===
+          `rpc:applyLocalMutations:res`
+        const outcomePromise = requester
+          .requestApplyLocalMutations(`todos`, [
+            {
+              mutationId: `local-requester-takeover`,
+              type: `insert`,
+              key: `local-requester-takeover`,
+              value: { id: `local-requester-takeover` },
+            },
+          ])
+          .then(
+            (response) => ({ response }),
+            (error: unknown) => ({ error }),
+          )
+
+        await vi.advanceTimersByTimeAsync(0)
+        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
+        retiredLeader.dispose()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(requester.isLeader(`todos`)).toBe(true)
+
+        await vi.advanceTimersByTimeAsync(31_000)
+        const outcome = await outcomePromise
+
+        expect(outcome).toEqual({
+          error: expect.objectContaining({
+            name: `IndeterminateCommitError`,
+            code: `INDETERMINATE_COMMIT`,
+            collectionId: `todos`,
+            requestType: `rpc:applyLocalMutations:req`,
+            previousLeaderId: (retiredLeader as unknown as { nodeId: string })
+              .nodeId,
+            previousTerm: 1,
+            currentLeaderId: (requester as unknown as { nodeId: string })
+              .nodeId,
+            currentTerm: 2,
+            cause: expect.objectContaining({
+              message: expect.stringContaining(`timed out`),
+            }),
+          } satisfies Partial<IndeterminateCommitError>),
+        })
+        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
+        expect(requesterAdapter.appliedTxs).toEqual([])
+        expect(committedMessagePosts).toBe(1)
+      } finally {
+        observeBroadcastMessage = undefined
+        retiredLeader.dispose()
+        requester.dispose()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`fails indeterminate instead of retrying local mutations without an initial leader route`, async () => {
+      const coordinator = createCoordinator()
+      const transportError = new Error(`unknown leader response was lost`)
+      const attemptedMutations: Array<ApplyLocalMutationsRequest[`mutations`]> =
+        []
+      const failedTransport = vi.fn(
+        (_collectionId: string, request: ApplyLocalMutationsRequest) => {
+          attemptedMutations.push(structuredClone(request.mutations))
+          if (attemptedMutations.length === 1) {
+            return Promise.reject(transportError)
+          }
+          return Promise.resolve({
+            type: `rpc:applyLocalMutations:res` as const,
+            rpcId: request.rpcId,
+            ok: true as const,
+            term: 1,
+            seq: 1,
+            latestRowVersion: 1,
+            acceptedMutationIds: request.mutations.map(
+              (mutation) => mutation.mutationId,
+            ),
+          })
+        },
+      )
+      Object.defineProperty(coordinator, `sendRPCOnce`, {
+        value: failedTransport,
+        configurable: true,
+      })
+
+      try {
+        const outcome = await coordinator
+          .requestApplyLocalMutations(`todos`, [
+            {
+              mutationId: `browser-unknown-leader-local`,
+              type: `insert`,
+              key: `browser-unknown-leader-local`,
+              value: { id: `browser-unknown-leader-local` },
+            },
+          ])
+          .then(
+            (response) => ({ response }),
+            (error: unknown) => ({ error }),
+          )
+
+        expect(outcome).toEqual({
+          error: expect.objectContaining({
+            name: `IndeterminateCommitError`,
+            code: `INDETERMINATE_COMMIT`,
+            collectionId: `todos`,
+            requestType: `rpc:applyLocalMutations:req`,
+            previousLeaderId: null,
+            previousTerm: null,
+            currentLeaderId: null,
+            currentTerm: null,
+            cause: transportError,
+          } satisfies Partial<IndeterminateCommitError>),
+        })
+        expect(failedTransport).toHaveBeenCalledTimes(1)
+        expect(attemptedMutations).toEqual([
+          [
+            {
+              mutationId: `browser-unknown-leader-local`,
+              type: `insert`,
+              key: `browser-unknown-leader-local`,
+              value: { id: `browser-unknown-leader-local` },
+            },
+          ],
+        ])
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    it(`classifies local-mutation durability failures on local and follower routes`, async () => {
+      const failure = Object.assign(
+        new Error(`local mutation persistence failed`),
+        {
+          code: `SQLITE_IOERR`,
+          path: [`todos`, `rows`],
+        },
+      )
+      const adapter = createStubAdapter()
+      adapter.applyCommittedTx = vi.fn().mockRejectedValue(failure)
+      const leader = createCoordinator(adapter)
+      const follower = createCoordinator(createStubAdapter())
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        const followerResponse = await follower.requestApplyLocalMutations(
+          `todos`,
+          [
+            {
+              mutationId: `remote-durability-failure`,
+              type: `insert`,
+              key: `remote-durability-failure`,
+              value: { id: `remote-durability-failure` },
+            },
+          ],
+        )
+
+        expect(followerResponse).toEqual({
+          type: `rpc:applyLocalMutations:res`,
+          rpcId: expect.any(String),
+          ok: false,
+          code: `PERSISTENCE_ERROR`,
+          error: expect.stringContaining(failure.message),
+          sourceCode: `SQLITE_IOERR`,
+          path: [`todos`, `rows`],
+        })
+        expect(adapter.applyCommittedTx).toHaveBeenCalledTimes(1)
+
+        await expect(
+          leader.requestApplyLocalMutations(`todos`, [
+            {
+              mutationId: `local-durability-failure`,
+              type: `insert`,
+              key: `local-durability-failure`,
+              value: { id: `local-durability-failure` },
+            },
+          ]),
+        ).rejects.toMatchObject({
+          name: `PersistedCollectionDurabilityError`,
+          code: `SQLITE_IOERR`,
+          path: [`todos`, `rows`],
+          cause: failure,
+        } satisfies Partial<PersistedCollectionDurabilityError>)
+        expect(adapter.applyCommittedTx).toHaveBeenCalledTimes(2)
+      } finally {
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it.each([
+      { requestType: `committed transaction` as const },
+      { requestType: `local mutations` as const },
+    ])(
+      `keeps pre-adapter failures outside the durability boundary for $requestType`,
+      async ({ requestType }) => {
+        type LeaderState = {
+          participatesInLeadership: boolean
+          isLeader: boolean
+          leaderId: string
+          lockAbortController: null
+          heartbeatTimer: null
+          latestTerm: number
+          latestSeq: number
+          latestRowVersion: number
+          subscribers: Set<(message: unknown) => void>
+        }
+        type CoordinatorInternals = {
+          collections: Map<string, LeaderState>
+          withWriterLock: <T>(task: () => Promise<T>) => Promise<T>
+        }
+        const leaderState = (): LeaderState => ({
+          participatesInLeadership: true,
+          isLeader: true,
+          leaderId: `forced-local-leader`,
+          lockAbortController: null,
+          heartbeatTimer: null,
+          latestTerm: 1,
+          latestSeq: 0,
+          latestRowVersion: 0,
+          subscribers: new Set(),
+        })
+        const invoke = (
+          coordinator: BrowserCollectionCoordinator,
+          suffix: string,
+        ) =>
+          requestType === `committed transaction`
+            ? coordinator.requestApplyCommittedTx(`todos`, {
+                txId: `classification-boundary-${suffix}`,
+                term: 0,
+                seq: 0,
+                rowVersion: 0,
+                mutations: [],
+              })
+            : coordinator.requestApplyLocalMutations(`todos`, [
+                {
+                  mutationId: `classification-boundary-${suffix}`,
+                  type: `insert`,
+                  key: `classification-boundary-${suffix}`,
+                  value: { id: `classification-boundary-${suffix}` },
+                },
+              ])
+        const missingAdapter = new BrowserCollectionCoordinator({
+          dbName: `missing-adapter`,
+        })
+        const missingInternals =
+          missingAdapter as unknown as CoordinatorInternals
+        missingInternals.collections.set(`todos`, leaderState())
+        const lockFailure = new Error(`writer lock unavailable`)
+        const lockCoordinator = createCoordinator()
+        const lockInternals = lockCoordinator as unknown as CoordinatorInternals
+        lockInternals.collections.set(`todos`, leaderState())
+        lockInternals.withWriterLock = () => Promise.reject(lockFailure)
+
+        try {
+          const missingError = await invoke(missingAdapter, `missing`).then(
+            () => undefined,
+            (error: unknown) => error,
+          )
+          const lockError = await invoke(lockCoordinator, `writer-lock`).then(
+            () => undefined,
+            (error: unknown) => error,
+          )
+
+          expect(missingError).toMatchObject({
+            name: `Error`,
+            message: expect.stringContaining(`adapter not set`),
+          })
+          expect(lockError).toBe(lockFailure)
+        } finally {
+          missingAdapter.dispose()
+          lockCoordinator.dispose()
+        }
+      },
+    )
+
+    it(`reuses the durable stream position after local mutation persistence fails`, async () => {
+      const adapter = createStubAdapter()
+      const persistenceError = new Error(`local disk full`)
+      const attemptedPositions: Array<{ seq: number; rowVersion: number }> = []
+      adapter.applyCommittedTx = vi.fn((_collectionId, tx) => {
+        attemptedPositions.push({ seq: tx.seq, rowVersion: tx.rowVersion })
+        return attemptedPositions.length === 1
+          ? Promise.reject(persistenceError)
+          : Promise.resolve()
+      })
+      const coordinator = createCoordinator(adapter)
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        await expect(
+          coordinator.requestApplyLocalMutations(`todos`, [
+            {
+              mutationId: `failed-local-mutation`,
+              type: `insert`,
+              key: `failed-local-mutation`,
+              value: { id: `failed-local-mutation` },
+            },
+          ]),
+        ).rejects.toMatchObject({ cause: persistenceError })
+
+        const response = await coordinator.requestApplyLocalMutations(`todos`, [
+          {
+            mutationId: `successful-local-mutation`,
+            type: `insert`,
+            key: `successful-local-mutation`,
+            value: { id: `successful-local-mutation` },
+          },
+        ])
+
+        expect({ attemptedPositions, response }).toEqual({
+          attemptedPositions: [
+            { seq: 1, rowVersion: 1 },
+            { seq: 1, rowVersion: 1 },
+          ],
+          response: {
+            type: `rpc:applyLocalMutations:res`,
+            rpcId: expect.any(String),
+            ok: true,
+            term: 1,
+            seq: 1,
+            latestRowVersion: 1,
+            acceptedMutationIds: [`successful-local-mutation`],
+          },
+        })
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    it(`scopes envelope deduplication by collection`, async () => {
+      const alphaAdapter = createStubAdapter()
+      const betaAdapter = createStubAdapter()
+      const coordinator = createCoordinator(alphaAdapter)
+      coordinator.setAdapterForCollection(`alpha`, alphaAdapter)
+      coordinator.setAdapterForCollection(`beta`, betaAdapter)
+      coordinator.subscribe(`alpha`, () => {})
+      coordinator.subscribe(`beta`, () => {})
+      await flush(50)
+
+      const internals = coordinator as unknown as {
+        handleApplyLocalMutations: (
+          collectionId: string,
+          request: {
+            type: `rpc:applyLocalMutations:req`
+            rpcId: string
+            envelopeId: string
+            mutations: Array<{
+              mutationId: string
+              type: `insert`
+              key: string
+              value: { id: string }
+            }>
+          },
+        ) => Promise<{ ok: boolean; rpcId: string }>
+      }
+
+      try {
+        const alpha = await internals.handleApplyLocalMutations(`alpha`, {
+          type: `rpc:applyLocalMutations:req`,
+          rpcId: `alpha-rpc`,
+          envelopeId: `shared-envelope`,
+          mutations: [
+            {
+              mutationId: `alpha-mutation`,
+              type: `insert`,
+              key: `alpha`,
+              value: { id: `alpha` },
+            },
+          ],
+        })
+        const beta = await internals.handleApplyLocalMutations(`beta`, {
+          type: `rpc:applyLocalMutations:req`,
+          rpcId: `beta-rpc`,
+          envelopeId: `shared-envelope`,
+          mutations: [
+            {
+              mutationId: `beta-mutation`,
+              type: `insert`,
+              key: `beta`,
+              value: { id: `beta` },
+            },
+          ],
+        })
+
+        expect({
+          alpha,
+          alphaApplies: alphaAdapter.appliedTxs,
+          beta,
+          betaApplies: betaAdapter.appliedTxs,
+        }).toMatchObject({
+          alpha: { ok: true, rpcId: `alpha-rpc` },
+          alphaApplies: [{ collectionId: `alpha` }],
+          beta: { ok: true, rpcId: `beta-rpc` },
+          betaApplies: [{ collectionId: `beta` }],
+        })
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    it(`coalesces an envelope retry while its first write is in flight`, async () => {
+      const adapter = createStubAdapter()
+      const firstApplyEntered = createDeferred()
+      const releaseFirstApply = createDeferred()
+      let applyCalls = 0
+      adapter.applyCommittedTx = async (collectionId, tx) => {
+        applyCalls++
+        if (applyCalls === 1) {
+          firstApplyEntered.resolve()
+          await releaseFirstApply.promise
+        }
+        adapter.appliedTxs.push({ collectionId: storageId(collectionId), tx })
+      }
+      const coordinator = createCoordinator(adapter)
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+
+      const internals = coordinator as unknown as {
+        handleApplyLocalMutations: (
+          collectionId: string,
+          request: {
+            type: `rpc:applyLocalMutations:req`
+            rpcId: string
+            envelopeId: string
+            mutations: Array<{
+              mutationId: string
+              type: `insert`
+              key: string
+              value: { id: string }
+            }>
+          },
+        ) => Promise<{
+          ok: boolean
+          rpcId: string
+          term?: number
+          seq?: number
+          latestRowVersion?: number
+        }>
+      }
+      const request = {
+        type: `rpc:applyLocalMutations:req` as const,
+        envelopeId: `in-flight-envelope`,
+        mutations: [
+          {
+            mutationId: `mutation`,
+            type: `insert` as const,
+            key: `row`,
+            value: { id: `row` },
+          },
+        ],
+      }
+
+      try {
+        const first = internals.handleApplyLocalMutations(`todos`, {
+          ...request,
+          rpcId: `first-rpc`,
+        })
+        await firstApplyEntered.promise
+        const retry = internals.handleApplyLocalMutations(`todos`, {
+          ...request,
+          rpcId: `retry-rpc`,
+        })
+        await Promise.resolve()
+        releaseFirstApply.resolve()
+
+        const [firstResponse, retryResponse] = await Promise.all([first, retry])
+        expect({
+          applyCalls,
+          first: { ...firstResponse, rpcId: undefined },
+          retry: { ...retryResponse, rpcId: undefined },
+        }).toEqual({
+          applyCalls: 1,
+          first: { ...retryResponse, rpcId: undefined },
+          retry: { ...firstResponse, rpcId: undefined },
+        })
+      } finally {
+        releaseFirstApply.resolve()
+        coordinator.dispose()
+      }
+    })
+
+    it(`replays the successful mutation result when its first response is lost`, async () => {
+      vi.useFakeTimers()
+      const adapter = createStubAdapter()
+      let leadershipRead!: () => void
+      const leadershipReadPromise = new Promise<void>((resolve) => {
+        leadershipRead = resolve
+      })
+      let firstSuccessDropped!: () => void
+      const firstSuccessDroppedPromise = new Promise<void>((resolve) => {
+        firstSuccessDropped = resolve
+      })
+      adapter.getStreamPosition = async () => {
+        leadershipRead()
+        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+      }
+
+      const leader = createCoordinator(adapter)
+      const follower = createCoordinator(adapter)
+
+      try {
+        leader.subscribe(`todos`, () => {})
+        await leadershipReadPromise
+        await Promise.resolve()
+        follower.subscribe(`todos`, () => {})
+
+        dropNextMessageWhen = (data) => {
+          const payload = (
+            data as { payload?: { type?: string; ok?: boolean } }
+          ).payload
+          if (
+            payload?.type === `rpc:applyLocalMutations:res` &&
+            payload.ok === true
+          ) {
+            firstSuccessDropped()
+            return true
+          }
+          return false
+        }
+
+        const responsePromise = follower.requestApplyLocalMutations(`todos`, [
+          {
+            mutationId: `mut-lost-response`,
+            type: `insert`,
+            key: `lost-response`,
+            value: { id: `lost-response`, title: `Persisted once` },
+          },
+        ])
+
+        await firstSuccessDroppedPromise
+        expect(adapter.appliedTxs).toHaveLength(1)
+
+        await vi.advanceTimersByTimeAsync(10_200)
+        const response = await responsePromise
+        expect(response).toMatchObject({
+          ok: true,
+          acceptedMutationIds: [`mut-lost-response`],
+        })
+        expect(adapter.appliedTxs).toHaveLength(1)
+      } finally {
+        follower.dispose()
+        leader.dispose()
+        vi.useRealTimers()
+      }
+    })
+  })
+
+  describe(`RPC - applyCommittedTx`, () => {
+    it(`schedules an ordinary source commit before requesting the writer lock`, async () => {
+      const adapter = createStubAdapter()
+      const coordinator = createCoordinator(adapter)
+      const collectionId = `ordinary-source-commit`
+      const unsubscribe = coordinator.subscribe(collectionId, () => {})
+      let applySource!: () => Promise<void>
+      const collection = createCollection(
+        persistedCollectionOptions<{ id: string }, string>({
+          id: collectionId,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ begin, write, commit, markReady }) => {
+              applySource = async () => {
+                begin()
+                write({ type: `insert`, value: { id: `source-row` } })
+                await commit()
+              }
+              markReady()
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+
+      try {
+        await collection.stateWhenReady()
+        await vi.waitFor(() =>
+          expect(coordinator.isLeader(collectionId)).toBe(true),
+        )
+
+        const events: Array<string> = []
+        adapter.runInRegularScope = Object.assign(
+          async <T>(
+            task: (adapter: HydrationPersistenceAdapter) => Promise<T>,
+          ) => {
+            events.push(`scheduler-enter`)
+            try {
+              return await task(adapter)
+            } finally {
+              events.push(`scheduler-exit`)
+            }
+          },
+          { afterQueuedWork: () => Promise.resolve() },
+        )
+        const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+        adapter.applyCommittedTx = async (...args) => {
+          events.push(`apply`)
+          await applyCommittedTx(...args)
+        }
+        const requestLock = mockNavigatorLocks.request.bind(mockNavigatorLocks)
+        const lockSpy = vi
+          .spyOn(mockNavigatorLocks, `request`)
+          .mockImplementation((name, optionsOrCallback, maybeCallback) => {
+            if (name === `tsdb:writer:test-db`) {
+              events.push(`writer-lock-request`)
+            }
+            return requestLock(name, optionsOrCallback, maybeCallback)
+          })
+
+        try {
+          await applySource()
+          expect(events).toEqual([
+            `scheduler-enter`,
+            `writer-lock-request`,
+            `apply`,
+            `scheduler-exit`,
+          ])
+          expect(adapter.appliedTxs).toHaveLength(1)
+          expect(adapter.appliedTxs[0]).toMatchObject({
+            collectionId,
+            tx: {
+              mutations: [{ key: `source-row`, value: { id: `source-row` } }],
+            },
+          })
+          expect(collection.get(`source-row`)).toMatchObject({
+            id: `source-row`,
+          })
+        } finally {
+          lockSpy.mockRestore()
+        }
+      } finally {
+        await collection.cleanup()
+        unsubscribe()
+        coordinator.dispose()
+      }
+    })
+
+    it(`completes the first source commit when leader election overlaps scheduled hydration`, async () => {
+      const database = createWASQLiteTestDatabase({ filename: `:memory:` })
+      const coordinator = createCoordinator()
+      const persistence = createBrowserWASQLitePersistence({
+        database,
+        coordinator,
+      }).resolvePersistenceForCollection?.({
+        collectionId: `first-commit`,
+        mode: `sync-present`,
+      })
+      if (!persistence?.adapter.runInHydrationScope) {
+        coordinator.dispose()
+        await database.close?.()
+        throw new Error(`scheduled hydration adapter not available`)
+      }
+
+      let unsubscribe: (() => void) | undefined
+      const hydration = persistence.adapter.runInHydrationScope(
+        async (adapter) => {
+          unsubscribe = coordinator.subscribe(`first-commit`, () => {})
+          return coordinator.requestApplyCommittedTx(
+            `first-commit`,
+            {
+              txId: `first-source-commit`,
+              term: 0,
+              seq: 0,
+              rowVersion: 0,
+              mutations: [
+                { type: `insert`, key: `first`, value: { id: `first` } },
+              ],
+            },
+            adapter,
+          )
+        },
+      )
+      void hydration.catch(() => undefined)
+      let timeout: ReturnType<typeof setTimeout> | undefined
+
+      try {
+        const response = await Promise.race([
+          hydration,
+          new Promise<never>((_resolve, reject) => {
+            timeout = setTimeout(
+              () => reject(new Error(`first commit stalled during election`)),
+              2_000,
+            )
+          }),
+        ])
+        expect(response.ok).toBe(true)
+        expect(
+          (
+            await persistence.adapter.loadResumeSnapshot({
+              kind: `eager`,
+              collectionId: `first-commit`,
+            })
+          ).rows,
+        ).toEqual([{ key: `first`, value: { id: `first` } }])
+        expect(
+          await database.execute<{ count: number }>(
+            `SELECT COUNT(*) AS count FROM applied_tx`,
+          ),
+        ).toEqual([{ count: 1 }])
+      } finally {
+        if (timeout) clearTimeout(timeout)
+        coordinator.dispose()
+        await Promise.race([hydration.catch(() => undefined), flush(0)])
+        unsubscribe?.()
+        await flush(0)
+        await database.close?.()
+      }
+    })
+
+    it(`settles a cold source commit and another collection's write without a writer-lock cycle`, async () => {
+      const database = createWASQLiteTestDatabase({ filename: `:memory:` })
+      const coordinator = createCoordinator()
+      const persistence = createBrowserWASQLitePersistence({
+        database,
+        coordinator,
+      })
+      const active = persistence.resolvePersistenceForCollection?.({
+        collectionId: `active`,
+        mode: `sync-present`,
+      })
+      const cold = persistence.resolvePersistenceForCollection?.({
+        collectionId: `cold`,
+        mode: `sync-present`,
+      })
+      const adapter = cold?.adapter
+      if (
+        !active ||
+        !adapter?.runInHydrationScope ||
+        !adapter.reserveLeadershipTerm
+      ) {
+        coordinator.dispose()
+        await database.close?.()
+        throw new Error(`shared scheduled adapter not available`)
+      }
+
+      const releaseElectionRead = createDeferred()
+      const electionReadStarted = createDeferred()
+      const releaseHydration = createDeferred()
+      const sourceCommitStarted = createDeferred()
+      const reserveLeadershipTerm = adapter.reserveLeadershipTerm.bind(adapter)
+      adapter.reserveLeadershipTerm = async (collectionId, observedTerm) => {
+        if (storageId(collectionId) === `cold`) {
+          electionReadStarted.resolve()
+          await releaseElectionRead.promise
+        }
+        return reserveLeadershipTerm(collectionId, observedTerm)
+      }
+
+      const unsubscribeActive = coordinator.subscribe(`active`, () => {})
+      let unsubscribeCold: (() => void) | undefined
+      let sourceCommit: Promise<ApplyCommittedTxResponse> | undefined
+      let otherWrite: Promise<ApplyLocalMutationsResponse> | undefined
+      let hydration: Promise<void> | undefined
+      let timeout: ReturnType<typeof setTimeout> | undefined
+
+      try {
+        await vi.waitFor(() =>
+          expect(coordinator.isLeader(`active`)).toBe(true),
+        )
+
+        hydration = adapter.runInHydrationScope(async (scopedAdapter) => {
+          unsubscribeCold = coordinator.subscribe(`cold`, () => {})
+          sourceCommit = coordinator.requestApplyCommittedTx(
+            `cold`,
+            {
+              txId: `first-cold-commit`,
+              term: 0,
+              seq: 0,
+              rowVersion: 0,
+              mutations: [
+                { type: `insert`, key: `cold`, value: { id: `cold` } },
+              ],
+            },
+            scopedAdapter,
+          )
+          void sourceCommit.catch(() => undefined)
+          sourceCommitStarted.resolve()
+          await Promise.race([sourceCommit, releaseHydration.promise])
+        })
+        void hydration.catch(() => undefined)
+        await Promise.all([
+          electionReadStarted.promise,
+          sourceCommitStarted.promise,
+        ])
+        expect(coordinator.isLeader(`cold`)).toBe(false)
+
+        otherWrite = coordinator.requestApplyLocalMutations(`active`, [
+          {
+            mutationId: `active-write`,
+            type: `insert`,
+            key: `active`,
+            value: { id: `active` },
+          },
+        ])
+        void otherWrite.catch(() => undefined)
+        // Let the other collection reach its writer-lock/scheduler boundary
+        // before the held election read establishes the cold route.
+        await flush(0)
+        releaseElectionRead.resolve()
+
+        const [sourceResponse, otherResponse] = await Promise.race([
+          Promise.all([sourceCommit!, otherWrite, hydration]).then(
+            ([source, other]) => [source, other] as const,
+          ),
+          new Promise<never>((_resolve, reject) => {
+            timeout = setTimeout(
+              () =>
+                reject(
+                  new Error(
+                    `cross-collection writer-lock cycle; writer held=${heldLocks.has(`tsdb:writer:test-db`)}`,
+                  ),
+                ),
+              2_000,
+            )
+          }),
+        ])
+        expect(sourceResponse.ok).toBe(true)
+        expect(otherResponse.ok).toBe(true)
+        expect(
+          (
+            await adapter.loadResumeSnapshot({
+              kind: `eager`,
+              collectionId: `cold`,
+            })
+          ).rows,
+        ).toEqual([{ key: `cold`, value: { id: `cold` } }])
+        expect(
+          (
+            await active.adapter.loadResumeSnapshot({
+              kind: `eager`,
+              collectionId: `active`,
+            })
+          ).rows,
+        ).toEqual([{ key: `active`, value: { id: `active` } }])
+      } finally {
+        if (timeout) clearTimeout(timeout)
+        releaseElectionRead.resolve()
+        releaseHydration.resolve()
+        await Promise.race([
+          Promise.allSettled([
+            hydration ?? Promise.resolve(),
+            sourceCommit ?? Promise.resolve(),
+            otherWrite ?? Promise.resolve(),
+          ]),
+          flush(500),
+        ])
+        unsubscribeCold?.()
+        unsubscribeActive()
+        coordinator.dispose()
+        await database.close?.()
+      }
+    })
+
+    it(`routes a complete source transaction to the leader-owned adapter`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const followerAdapter = createStubAdapter()
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(followerAdapter)
+      const followerMessages: Array<unknown> = []
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, (message) => {
+        if ((message.payload as { type?: string }).type === `tx:committed`) {
+          followerMessages.push(message.payload)
+        }
+      })
+      await flush(50)
+
+      const response = await follower.requestApplyCommittedTx(`todos`, {
+        txId: `source-tx`,
+        term: 91,
+        seq: 92,
+        rowVersion: 93,
+        truncate: true,
+        mutations: [
+          {
+            type: `insert`,
+            key: `todo-1`,
+            value: { id: `todo-1`, title: `Owned source row` },
+          },
+        ],
+        rowMetadataMutations: [
+          { type: `set`, key: `todo-1`, value: { source: `remote` } },
+        ],
+        collectionMetadataMutations: [
+          { type: `set`, key: `resume`, value: { offset: `next` } },
+        ],
+      })
+
+      expect(response.ok).toBe(true)
+      expect(followerAdapter.appliedTxs).toEqual([])
+      expect(leaderAdapter.appliedTxs).toHaveLength(1)
+      expect(leaderAdapter.appliedTxs[0]).toMatchObject({
+        collectionId: `todos`,
+        tx: {
+          txId: `source-tx`,
+          truncate: true,
+          mutations: [
+            {
+              type: `insert`,
+              key: `todo-1`,
+              value: { id: `todo-1`, title: `Owned source row` },
+            },
+          ],
+          rowMetadataMutations: [
+            { type: `set`, key: `todo-1`, value: { source: `remote` } },
+          ],
+          collectionMetadataMutations: [
+            { type: `set`, key: `resume`, value: { offset: `next` } },
+          ],
+        },
+      })
+      expect(leaderAdapter.appliedTxs[0]!.tx.term).not.toBe(91)
+      expect(leaderAdapter.appliedTxs[0]!.tx.seq).not.toBe(92)
+      expect(leaderAdapter.appliedTxs[0]!.tx.rowVersion).not.toBe(93)
+
+      await flush()
+      expect(followerMessages).toHaveLength(1)
+      expect(followerMessages[0]).toEqual({
+        type: `tx:committed`,
+        term: expect.any(Number),
+        seq: expect.any(Number),
+        txId: `source-tx`,
+        latestRowVersion: expect.any(Number),
+        requiresFullReload: true,
+      })
+
+      leader.dispose()
+      follower.dispose()
+    })
+
+    it(`classifies committed durability failures on local and follower routes`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const failure = Object.assign(new Error(`persistence failed`), {
+        code: `SQLITE_FULL`,
+        path: `/tmp/browser.sqlite`,
+      })
+      leaderAdapter.applyCommittedTx = vi.fn().mockRejectedValue(failure)
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(createStubAdapter())
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      const response = await follower.requestApplyCommittedTx(`todos`, {
+        txId: `source-tx-failure`,
+        term: 0,
+        seq: 0,
+        rowVersion: 0,
+        mutations: [],
+      })
+
+      expect(response).toEqual({
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: expect.any(String),
+        ok: false,
+        code: `PERSISTENCE_ERROR`,
+        error: expect.stringContaining(`persistence failed`),
+        sourceCode: `SQLITE_FULL`,
+        path: `/tmp/browser.sqlite`,
+      })
+      expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
+
+      await expect(
+        leader.requestApplyCommittedTx(`todos`, {
+          txId: `source-tx-local-failure`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [],
+        }),
+      ).rejects.toMatchObject({
+        name: `PersistedCollectionDurabilityError`,
+        code: `SQLITE_FULL`,
+        path: `/tmp/browser.sqlite`,
+        cause: failure,
+      } satisfies Partial<PersistedCollectionDurabilityError>)
+      expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(2)
+
+      leader.dispose()
+      follower.dispose()
+    })
+
+    it(`does not retry application failures after entering the writer lock`, async () => {
+      const applicationError = new Error(`persistence failed once`)
+      const adapter = createStubAdapter()
+      adapter.applyCommittedTx = vi.fn().mockRejectedValue(applicationError)
+      const coordinator = createCoordinator(adapter)
+
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+
+      vi.useFakeTimers()
+      try {
+        let settled = false
+        const outcomePromise = coordinator
+          .requestApplyCommittedTx(`todos`, {
+            txId: `source-tx-application-failure`,
+            term: 0,
+            seq: 0,
+            rowVersion: 0,
+            mutations: [],
+          })
+          .then(
+            (response) => {
+              settled = true
+              return { response }
+            },
+            (error: unknown) => {
+              settled = true
+              return { error }
+            },
+          )
+
+        await vi.advanceTimersByTimeAsync(0)
+        const firstTurn = {
+          applicationCalls: vi.mocked(adapter.applyCommittedTx).mock.calls
+            .length,
+          settled,
+        }
+
+        coordinator.dispose()
+        await vi.advanceTimersByTimeAsync(5_000)
+        const outcome = await outcomePromise
+
+        expect(firstTurn).toEqual({ applicationCalls: 1, settled: true })
+        expect(adapter.applyCommittedTx).toHaveBeenCalledTimes(1)
+        expect(outcome).toEqual({
+          error: expect.objectContaining({
+            name: `PersistedCollectionDurabilityError`,
+            cause: applicationError,
+          }),
+        })
+      } finally {
+        coordinator.dispose()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`reuses the durable stream position after a committed transaction fails`, async () => {
+      const adapter = createStubAdapter()
+      const persistenceError = new Error(`disk full`)
+      const attemptedPositions: Array<{
+        term: number
+        seq: number
+        rowVersion: number
+      }> = []
+      adapter.applyCommittedTx = vi.fn((_collectionId, tx) => {
+        attemptedPositions.push({
+          term: tx.term,
+          seq: tx.seq,
+          rowVersion: tx.rowVersion,
+        })
+        return attemptedPositions.length === 1
+          ? Promise.reject(persistenceError)
+          : Promise.resolve()
+      })
+      const coordinator = createCoordinator(adapter)
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        await expect(
+          coordinator.requestApplyCommittedTx(`todos`, {
+            txId: `failed-source-tx`,
+            term: 0,
+            seq: 0,
+            rowVersion: 0,
+            mutations: [],
+          }),
+        ).rejects.toMatchObject({ cause: persistenceError })
+
+        const response = await coordinator.requestApplyCommittedTx(`todos`, {
+          txId: `successful-source-tx`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [],
+        })
+
+        expect({ attemptedPositions, response }).toEqual({
+          attemptedPositions: [
+            { term: 1, seq: 1, rowVersion: 1 },
+            { term: 1, seq: 1, rowVersion: 1 },
+          ],
+          response: {
+            type: `rpc:applyCommittedTx:res`,
+            rpcId: expect.any(String),
+            ok: true,
+            term: 1,
+            seq: 1,
+            latestRowVersion: 1,
+          },
+        })
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    it(`replays the successful response when only that response is lost`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const followerAdapter = createStubAdapter()
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(followerAdapter)
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      vi.useFakeTimers()
+      try {
+        let droppedResponse: unknown
+        dropNextBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type !== `rpc:applyCommittedTx:res`) return false
+          droppedResponse = structuredClone(payload)
+          return true
+        }
+
+        const responsePromise = follower.requestApplyCommittedTx(`todos`, {
+          txId: `source-tx-response-loss`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [
+            {
+              type: `insert`,
+              key: `todo-response-loss`,
+              value: { id: `todo-response-loss` },
+            },
+          ],
+        })
+
+        await vi.advanceTimersByTimeAsync(0)
+        expect(droppedResponse).toMatchObject({
+          type: `rpc:applyCommittedTx:res`,
+          ok: true,
+        })
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+
+        await vi.advanceTimersByTimeAsync(10_200)
+        const response = await responsePromise
+
+        expect(response).toEqual(droppedResponse)
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+        expect(followerAdapter.appliedTxs).toEqual([])
+      } finally {
+        leader.dispose()
+        follower.dispose()
+        vi.useRealTimers()
+      }
+    })
+
+    it(`coalesces the same envelope while its first application is in flight`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const followerAdapter = createStubAdapter()
+      const originalApply = leaderAdapter.applyCommittedTx
+      let releaseApplication = (): void => {}
+      const applicationGate = new Promise<void>((resolve) => {
+        releaseApplication = resolve
+      })
+      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
+        await applicationGate
+        return originalApply(collectionId, tx)
+      })
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(followerAdapter)
+      const observedResponses: Array<{
+        rpcId: string
+        term: number
+        seq: number
+        latestRowVersion: number
+      }> = []
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        duplicateNextBroadcastMessage = (data) => {
+          const envelope = data as {
+            payload?: { type?: string; rpcId?: string }
+          }
+          if (envelope.payload?.type !== `rpc:applyCommittedTx:req`) {
+            return undefined
+          }
+          const duplicate = structuredClone(data) as {
+            payload: { rpcId: string }
+          }
+          duplicate.payload.rpcId = `coalesced-rpc`
+          return duplicate
+        }
+        observeBroadcastMessage = (data) => {
+          const payload = (
+            data as {
+              payload?: {
+                type?: string
+                rpcId?: string
+                ok?: boolean
+                term?: number
+                seq?: number
+                latestRowVersion?: number
+              }
+            }
+          ).payload
+          if (
+            payload?.type === `rpc:applyCommittedTx:res` &&
+            payload.ok === true
+          ) {
+            observedResponses.push({
+              rpcId: payload.rpcId!,
+              term: payload.term!,
+              seq: payload.seq!,
+              latestRowVersion: payload.latestRowVersion!,
+            })
+          }
+        }
+
+        const responsePromise = follower.requestApplyCommittedTx(`todos`, {
+          txId: `source-tx-in-flight-envelope`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [
+            {
+              type: `insert`,
+              key: `todo-in-flight-envelope`,
+              value: { id: `todo-in-flight-envelope` },
+            },
+          ],
+        })
+        await flush()
+        const callsBeforeRelease = vi.mocked(leaderAdapter.applyCommittedTx)
+          .mock.calls.length
+
+        releaseApplication()
+        const response = await responsePromise
+        await flush()
+
+        const responsesByRpcId = Object.fromEntries(
+          observedResponses.map(({ rpcId, ...position }) => [rpcId, position]),
+        )
+        const expectedPosition = {
+          term: 1,
+          seq: 1,
+          latestRowVersion: 1,
+        }
+        expect({
+          callsBeforeRelease,
+          appliedTxs: leaderAdapter.appliedTxs.length,
+          responsesByRpcId,
+        }).toEqual({
+          callsBeforeRelease: 1,
+          appliedTxs: 1,
+          responsesByRpcId: {
+            [response.rpcId]: expectedPosition,
+            'coalesced-rpc': expectedPosition,
+          },
+        })
+        expect(followerAdapter.appliedTxs).toEqual([])
+      } finally {
+        releaseApplication()
+        observeBroadcastMessage = undefined
+        duplicateNextBroadcastMessage = undefined
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`allows the same envelope to retry after its application fails`, async () => {
+      const applicationError = new Error(`first application failed`)
+      const leaderAdapter = createStubAdapter()
+      const originalApply = leaderAdapter.applyCommittedTx
+      leaderAdapter.applyCommittedTx = vi
+        .fn()
+        .mockRejectedValueOnce(applicationError)
+        .mockImplementation((collectionId, tx) =>
+          originalApply(collectionId, tx),
+        )
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator()
+      let requestEnvelope: unknown
+      const observedResponses: Array<{ ok?: boolean; error?: string }> = []
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        observeBroadcastMessage = (data) => {
+          const payload = (
+            data as {
+              payload?: { type?: string; ok?: boolean; error?: string }
+            }
+          ).payload
+          if (
+            payload?.type === `rpc:applyCommittedTx:req` &&
+            requestEnvelope === undefined
+          ) {
+            requestEnvelope = structuredClone(data)
+          }
+          if (payload?.type === `rpc:applyCommittedTx:res`) {
+            observedResponses.push({
+              ok: payload.ok,
+              ...(payload.error === undefined ? {} : { error: payload.error }),
+            })
+          }
+        }
+
+        const firstResponse = await follower.requestApplyCommittedTx(`todos`, {
+          txId: `source-tx-retry-after-failure`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [],
+        })
+        expect(firstResponse).toMatchObject({
+          ok: false,
+          code: `PERSISTENCE_ERROR`,
+          error: expect.stringContaining(applicationError.message),
+        })
+        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
+        expect(requestEnvelope).toBeDefined()
+
+        injectBroadcastMessage(`tsdb:coord:test-db`, requestEnvelope)
+        await flush()
+
+        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(2)
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+        expect(observedResponses).toEqual([
+          {
+            ok: false,
+            error: expect.stringContaining(applicationError.message),
+          },
+          { ok: true },
+        ])
+      } finally {
+        observeBroadcastMessage = undefined
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`rejects a different mutation operation that reuses an in-flight envelope`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const originalApply = leaderAdapter.applyCommittedTx
+      let releaseApplication = (): void => {}
+      const applicationGate = new Promise<void>((resolve) => {
+        releaseApplication = resolve
+      })
+      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
+        await applicationGate
+        return originalApply(collectionId, tx)
+      })
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator()
+      let crossOperationResponse: unknown
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        duplicateNextBroadcastMessage = (data) => {
+          const envelope = data as {
+            payload?: { type?: string; envelopeId?: string }
+          }
+          if (envelope.payload?.type !== `rpc:applyCommittedTx:req`) {
+            return undefined
+          }
+          const duplicate = structuredClone(data) as {
+            payload: Record<string, unknown>
+          }
+          duplicate.payload = {
+            type: `rpc:applyLocalMutations:req`,
+            rpcId: `cross-operation-rpc`,
+            envelopeId: envelope.payload.envelopeId,
+            mutations: [],
+          }
+          return duplicate
+        }
+        observeBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { rpcId?: string } }).payload
+          if (payload?.rpcId === `cross-operation-rpc`) {
+            crossOperationResponse = structuredClone(payload)
+          }
+        }
+
+        const responsePromise = follower.requestApplyCommittedTx(`todos`, {
+          txId: `source-tx-cross-operation-envelope`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [],
+        })
+        await flush()
+
+        expect(crossOperationResponse).toMatchObject({
+          type: `rpc:applyLocalMutations:res`,
+          rpcId: `cross-operation-rpc`,
+          ok: false,
+          code: `CONFLICT`,
+          error: expect.stringContaining(`is already in flight`),
+        })
+        expect(leaderAdapter.applyCommittedTx).toHaveBeenCalledTimes(1)
+
+        releaseApplication()
+        const response = await responsePromise
+        expect(response).toMatchObject({ ok: true, seq: 1 })
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+      } finally {
+        releaseApplication()
+        observeBroadcastMessage = undefined
+        duplicateNextBroadcastMessage = undefined
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`fails indeterminate when a committed success is lost across leader change`, async () => {
+      const retiredLeaderAdapter = createStubAdapter()
+      const requesterAdapter = createStubAdapter()
+      const retiredLeader = createCoordinator(retiredLeaderAdapter)
+      const requester = createCoordinator(requesterAdapter)
+
+      retiredLeader.subscribe(`todos`, () => {})
+      requester.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(retiredLeader.isLeader(`todos`)).toBe(true)
+      expect(requester.isLeader(`todos`)).toBe(false)
+
+      vi.useFakeTimers()
+      try {
+        let committedMessagePosts = 0
+        observeBroadcastMessage = (data) => {
+          if (
+            (data as { payload?: { type?: string } }).payload?.type ===
+            `tx:committed`
+          ) {
+            committedMessagePosts++
+          }
+        }
+        let droppedResponse: unknown
+        dropNextBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type !== `rpc:applyCommittedTx:res`) return false
+          droppedResponse = structuredClone(payload)
+          return true
+        }
+
+        const outcomePromise = requester
+          .requestApplyCommittedTx(`todos`, {
+            txId: `source-tx-requester-takeover`,
+            term: 0,
+            seq: 0,
+            rowVersion: 0,
+            mutations: [
+              {
+                type: `insert`,
+                key: `todo-requester-takeover`,
+                value: { id: `todo-requester-takeover` },
+              },
+            ],
+          })
+          .then(
+            (response) => ({ response }),
+            (error: unknown) => ({ error }),
+          )
+
+        await vi.advanceTimersByTimeAsync(0)
+        expect(droppedResponse).toMatchObject({ ok: true })
+        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
+
+        retiredLeader.dispose()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(requester.isLeader(`todos`)).toBe(true)
+
+        await vi.advanceTimersByTimeAsync(31_000)
+        const outcome = await outcomePromise
+
+        expect(outcome).toEqual({
+          error: expect.objectContaining({
+            name: `IndeterminateCommitError`,
+            code: `INDETERMINATE_COMMIT`,
+            collectionId: `todos`,
+            requestType: `rpc:applyCommittedTx:req`,
+            previousLeaderId: (retiredLeader as unknown as { nodeId: string })
+              .nodeId,
+            previousTerm: 1,
+            currentLeaderId: (requester as unknown as { nodeId: string })
+              .nodeId,
+            currentTerm: 2,
+            cause: expect.objectContaining({
+              message: expect.stringContaining(`timed out`),
+            }),
+          } satisfies Partial<IndeterminateCommitError>),
+        })
+        expect(retiredLeaderAdapter.appliedTxs).toHaveLength(1)
+        expect(requesterAdapter.appliedTxs).toEqual([])
+        expect(committedMessagePosts).toBe(1)
+      } finally {
+        observeBroadcastMessage = undefined
+        retiredLeader.dispose()
+        requester.dispose()
+        vi.useRealTimers()
+      }
+    })
+
+    /**
+     * A source commit whose response is lost across leadership retains its
+     * applied receipt while the replacement leader certifies the exact txId.
+     * The receipt fulfills in the same Collection sync run, which admits a
+     * later source commit. A direct coordinator RPC remains indeterminate.
+     *
+     * Mock transport and Web Locks order durable leader application, response
+     * loss, disposal, election, and the next source commit. The independent
+     * check compares the receipt, sync-run count, public status, and next
+     * receipt after the RPC deadline. The shared applied-tx ledger here only
+     * certifies an exact ID; SQLite and OPFS own durable rows and cursor.
+     */
+    it(`keeps a surviving source Collection usable after a leader closes during a committed RPC`, async () => {
+      type Row = { id: string; title: string }
+      type SourceParams = Parameters<SyncConfig<Row, string>['sync']>[0]
+      const leaderAdapter = createStubAdapter()
+      const followerAdapter = createStubAdapter()
+      followerAdapter.reconcileCommittedTx = async (
+        _collectionId,
+        tx,
+        anchor,
+      ) => {
+        expect(anchor).toEqual({ latestRowVersion: 0, resetEpoch: 0 })
+        const applied = leaderAdapter.appliedTxs.find(
+          ({ tx: durable }) => durable.txId === tx.txId,
+        )?.tx
+        if (!applied) return { kind: `unknown` }
+        return {
+          kind: `already-applied`,
+          committed: {
+            term: applied.term,
+            seq: applied.seq,
+            rowVersion: applied.rowVersion,
+          },
+          latestRowVersion: applied.rowVersion,
+        }
+      }
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(followerAdapter)
+      const releaseLeader = leader.subscribe(`source-close`, () => {})
+      let source!: SourceParams
+      let syncRuns = 0
+      const collection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: `source-close`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              syncRuns++
+              source = params
+              params.markReady()
+            },
+          },
+          persistence: { adapter: followerAdapter, coordinator: follower },
+        }),
+      )
+      let firstReceipt: Promise<unknown> | undefined
+      let primaryFailure: unknown
+      let hasPrimaryFailure = false
+
+      try {
+        await collection.preload()
+        await flush(50)
+        expect(leader.isLeader(`source-close`)).toBe(true)
+        expect(follower.isLeader(`source-close`)).toBe(false)
+
+        vi.useFakeTimers()
+        let droppedSuccess = false
+        dropNextBroadcastMessage = (data) => {
+          const payload = (
+            data as { payload?: { type?: string; ok?: boolean } }
+          ).payload
+          if (payload?.type !== `rpc:applyCommittedTx:res`) return false
+          droppedSuccess = payload.ok === true
+          return true
+        }
+
+        source.begin()
+        source.write({
+          type: `insert`,
+          value: { id: `first`, title: `before close` },
+        })
+        firstReceipt = Promise.resolve(source.commit()).then(
+          () => ({ status: `fulfilled` as const }),
+          (error: unknown) => ({
+            status: `rejected` as const,
+            errorName: error instanceof Error ? error.name : String(error),
+          }),
+        )
+        await vi.advanceTimersByTimeAsync(0)
+        expect(droppedSuccess).toBe(true)
+        expect(leaderAdapter.appliedTxs).toHaveLength(1)
+
+        leader.dispose()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(follower.isLeader(`source-close`)).toBe(true)
+        await vi.advanceTimersByTimeAsync(10_200)
+        const firstOutcome = await firstReceipt
+
+        let secondOutcome: {
+          status: `fulfilled` | `rejected`
+          errorName?: string
+        }
+        try {
+          source.begin()
+          source.write({
+            type: `insert`,
+            value: { id: `second`, title: `after close` },
+          })
+          await source.commit()
+          secondOutcome = { status: `fulfilled` }
+        } catch (error) {
+          secondOutcome = {
+            status: `rejected`,
+            errorName: error instanceof Error ? error.name : String(error),
+          }
+        }
+
+        // Reach witnesses above distinguish an RPC crossover from ordinary
+        // leadership transfer. The exact-ID answer must settle the wrapper's
+        // first receipt without cleanup or a second sync run.
+        const actual = {
+          firstOutcome,
+          collectionStatus: collection.status,
+          syncRuns,
+          secondOutcome,
+        }
+        expect(
+          actual,
+          `Source-close observation: ${JSON.stringify(actual)}`,
+        ).toMatchObject({
+          firstOutcome: { status: `fulfilled` },
+          collectionStatus: `ready`,
+          syncRuns: 1,
+          secondOutcome: { status: `fulfilled` },
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        primaryFailure = error
+      }
+
+      dropNextBroadcastMessage = undefined
+      const cleanupFailures: Array<Error> = []
+      for (const cleanup of [
+        () => leader.dispose(),
+        () => releaseLeader(),
+        () => collection.cleanup(),
+        () => follower.dispose(),
+        () => firstReceipt?.catch(() => undefined),
+      ]) {
+        try {
+          await cleanup()
+        } catch (error) {
+          cleanupFailures.push(
+            error instanceof Error ? error : new Error(String(error)),
+          )
+        }
+      }
+      vi.useRealTimers()
+      if (hasPrimaryFailure && cleanupFailures.length > 0) {
+        throw new AggregateError(
+          cleanupFailures,
+          `Source-close oracle and cleanup both failed`,
+          { cause: primaryFailure },
+        )
+      }
+      if (hasPrimaryFailure) throw primaryFailure
+      expect(cleanupFailures).toEqual([])
+    })
+
+    /**
+     * Reconciliation and a later source commit share the writer lock. The
+     * replacement must advance its stream position before releasing that lock;
+     * otherwise the next commit can reuse the reconciled (term, seq) and be
+     * falsely acknowledged. The adapter log is the independent sequence
+     * reference, and both RPC receipts are checked after the queued write.
+     */
+    it(`reserves the reconciled stream position before a queued source write`, async () => {
+      const adapter = createStubAdapter()
+      const entered = createDeferred()
+      const release = createDeferred()
+      adapter.reconcileCommittedTx = async (collectionId, tx) => {
+        entered.resolve()
+        await release.promise
+        adapter.appliedTxs.push({ collectionId: storageId(collectionId), tx })
+        return {
+          kind: `applied-now`,
+          committed: {
+            term: tx.term,
+            seq: tx.seq,
+            rowVersion: tx.rowVersion,
+          },
+          latestRowVersion: tx.rowVersion,
+        }
+      }
+      const coordinator = createCoordinator(adapter)
+      const unsubscribe = coordinator.subscribe(`source-sequence`, () => {})
+      const transaction = (txId: string): PersistedTx => ({
+        txId,
+        term: 0,
+        seq: 0,
+        rowVersion: 0,
+        mutations: [],
+      })
+      try {
+        await flush(50)
+        expect(coordinator.isLeader(`source-sequence`)).toBe(true)
+        const first = coordinator.reconcileCommittedTx(
+          `source-sequence`,
+          transaction(`crossing`),
+          { latestRowVersion: 0, resetEpoch: 0 },
+        )
+        await entered.promise
+        const second = coordinator.requestApplyCommittedTx(
+          `source-sequence`,
+          transaction(`later`),
+        )
+        release.resolve()
+        expect(await first).toMatchObject({ ok: true, alreadyApplied: false })
+        expect(await second).toMatchObject({
+          ok: true,
+          seq: 2,
+          latestRowVersion: 2,
+        })
+        expect(
+          adapter.appliedTxs.map(({ tx }) => ({
+            id: tx.txId,
+            term: tx.term,
+            seq: tx.seq,
+            rowVersion: tx.rowVersion,
+          })),
+        ).toEqual([
+          { id: `crossing`, term: 1, seq: 1, rowVersion: 1 },
+          { id: `later`, term: 1, seq: 2, rowVersion: 2 },
+        ])
+      } finally {
+        release.resolve()
+        unsubscribe()
+        coordinator.dispose()
+      }
+    })
+
+    /**
+     * Each Web Lock election reserves a distinct durable term before its first
+     * heartbeat, including when the successor never heard the former owner.
+     * The independent ledger increments once per election. A passive follower
+     * may observe a successor and then a delayed former heartbeat; at that
+     * second delivery checkpoint its route must still name the successor.
+     * The controlled channel supplies delivery order, while the real
+     * coordinator supplies elections and route changes. This does not prove
+     * OPFS process scheduling or a real SQLite term reservation.
+     */
+    it.each([`known successor`, `cold successor`])(
+      `keeps a passive follower on the newer elected route after %s`,
+      async (successorHistory) => {
+        let durableTerm = 0
+        const reserveLeadershipTerm = async (
+          _collectionId: string,
+          observedTerm: number,
+        ) => ({
+          latestTerm: (durableTerm = Math.max(durableTerm, observedTerm) + 1),
+          latestSeq: 0,
+          latestRowVersion: 0,
+        })
+        const formerAdapter = Object.assign(createStubAdapter(), {
+          reserveLeadershipTerm,
+        })
+        const successorAdapter = Object.assign(createStubAdapter(), {
+          reserveLeadershipTerm,
+        })
+        const former = createCoordinator(formerAdapter)
+        const follower = createCoordinator()
+        const collectionId = `passive-delayed-heartbeat-${successorHistory}`
+        let successor: BrowserCollectionCoordinator | undefined
+        let unsubscribeSuccessor: (() => void) | undefined
+        const unsubscribeFormer = former.subscribe(collectionId, () => {})
+        let delayedHeartbeat: unknown
+        const followerState = () =>
+          (
+            follower as unknown as {
+              collections: Map<
+                string,
+                { leaderId: string | null; latestTerm: number }
+              >
+            }
+          ).collections.get(collectionId)
+        try {
+          await vi.waitFor(() =>
+            expect(former.isLeader(collectionId)).toBe(true),
+          )
+          await vi.waitFor(() =>
+            expect(followerState()?.leaderId).toBe(former.getNodeId()),
+          )
+          if (successorHistory === `known successor`) {
+            successor = createCoordinator(successorAdapter)
+            unsubscribeSuccessor = successor.subscribe(collectionId, () => {})
+            expect(successor.isLeader(collectionId)).toBe(false)
+          }
+          dropNextBroadcastMessage = (message) => {
+            const envelope = message as {
+              senderId?: string
+              payload?: { type?: string }
+            }
+            if (
+              envelope.senderId !== former.getNodeId() ||
+              envelope.payload?.type !== `leader:heartbeat`
+            ) {
+              return false
+            }
+            delayedHeartbeat = structuredClone(message)
+            return true
+          }
+          injectBroadcastMessage(`tsdb:coord:test-db`, {
+            v: 1,
+            dbName: `test-db`,
+            collectionId,
+            senderId: `route-probe`,
+            ts: Date.now(),
+            payload: { type: `leader:routeRequest` },
+          })
+          await vi.waitFor(() => expect(delayedHeartbeat).toBeDefined())
+          dropNextBroadcastMessage = undefined
+          former.dispose()
+          if (!successor) {
+            successor = createCoordinator(successorAdapter)
+            unsubscribeSuccessor = successor.subscribe(collectionId, () => {})
+          }
+          await vi.waitFor(() =>
+            expect(successor?.isLeader(collectionId)).toBe(true),
+          )
+          await vi.waitFor(() =>
+            expect(followerState()?.leaderId).toBe(successor?.getNodeId()),
+          )
+          injectBroadcastMessage(`tsdb:coord:test-db`, delayedHeartbeat)
+          await flush(0)
+          expect(followerState()).toMatchObject({
+            leaderId: successor.getNodeId(),
+            latestTerm: 2,
+          })
+          expect(
+            await follower.requestApplyCommittedTx(collectionId, {
+              txId: `after-delayed-heartbeat`,
+              term: 0,
+              seq: 0,
+              rowVersion: 0,
+              mutations: [],
+            }),
+          ).toMatchObject({ ok: true, term: 2, seq: 1 })
+          expect(successorAdapter.appliedTxs.map(({ tx }) => tx.txId)).toEqual([
+            `after-delayed-heartbeat`,
+          ])
+          expect(formerAdapter.appliedTxs).toEqual([])
+          expect(durableTerm).toBe(2)
+        } finally {
+          dropNextBroadcastMessage = undefined
+          unsubscribeFormer()
+          unsubscribeSuccessor?.()
+          former.dispose()
+          follower.dispose()
+          successor?.dispose()
+        }
+      },
+    )
+
+    /**
+     * A delayed former-owner heartbeat cannot reclaim the replacement Web
+     * Lock holder's route while exact-ID checking waits behind another writer.
+     * The receipt and later source write must use the replacement term.
+     */
+    it(`keeps the Web Lock owner's route after a delayed old-term heartbeat`, async () => {
+      const formerAdapter = createStubAdapter()
+      const successorAdapter = createStubAdapter()
+      successorAdapter.reconcileCommittedTx = vi.fn((collectionId, tx) => {
+        successorAdapter.appliedTxs.push({ collectionId, tx })
+        return Promise.resolve({
+          kind: `applied-now` as const,
+          committed: {
+            term: tx.term,
+            seq: tx.seq,
+            rowVersion: tx.rowVersion,
+          },
+          latestRowVersion: tx.rowVersion,
+        })
+      })
+      const former = createCoordinator(formerAdapter)
+      const successor = createCoordinator(successorAdapter)
+      const collectionId = `source-stale-heartbeat`
+      const unsubscribeFormer = former.subscribe(collectionId, () => {})
+      const unsubscribeSuccessor = successor.subscribe(collectionId, () => {})
+      const writerEntered = createDeferred()
+      const releaseWriter = createDeferred()
+      let blockingWriter: Promise<unknown> | undefined
+      let reconciliation: Promise<unknown> | undefined
+      let delayedHeartbeat: unknown
+      try {
+        await vi.waitFor(() => expect(former.isLeader(collectionId)).toBe(true))
+        expect(successor.isLeader(collectionId)).toBe(false)
+        dropNextBroadcastMessage = (message) => {
+          const envelope = message as {
+            senderId?: string
+            payload?: { type?: string }
+          }
+          if (
+            envelope.senderId !== former.getNodeId() ||
+            envelope.payload?.type !== `leader:heartbeat`
+          ) {
+            return false
+          }
+          delayedHeartbeat = structuredClone(message)
+          return true
+        }
+        injectBroadcastMessage(`tsdb:coord:test-db`, {
+          v: 1,
+          dbName: `test-db`,
+          collectionId,
+          senderId: `route-probe`,
+          ts: Date.now(),
+          payload: { type: `leader:routeRequest` },
+        })
+        await vi.waitFor(() =>
+          expect(delayedHeartbeat).toMatchObject({
+            senderId: former.getNodeId(),
+            payload: { type: `leader:heartbeat`, term: 1 },
+          }),
+        )
+        dropNextBroadcastMessage = undefined
+        former.dispose()
+        await vi.waitFor(() =>
+          expect(successor.isLeader(collectionId)).toBe(true),
+        )
+        const successorInternals = successor as unknown as {
+          collections: Map<
+            string,
+            { isLeader: boolean; leaderId: string | null; latestTerm: number }
+          >
+        }
+        expect(successorInternals.collections.get(collectionId)).toMatchObject({
+          isLeader: true,
+          leaderId: successor.getNodeId(),
+          latestTerm: 2,
+        })
+
+        blockingWriter = mockNavigatorLocks.request(
+          `tsdb:writer:test-db`,
+          async () => {
+            writerEntered.resolve()
+            await releaseWriter.promise
+          },
+        )
+        await writerEntered.promise
+        reconciliation = successor.reconcileCommittedTx(
+          collectionId,
+          { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
+          { latestRowVersion: 0, resetEpoch: 0 },
+        )
+        await vi.waitFor(() =>
+          expect(lockQueues.get(`tsdb:writer:test-db`)).toHaveLength(1),
+        )
+        injectBroadcastMessage(`tsdb:coord:test-db`, delayedHeartbeat)
+        await flush(0)
+        releaseWriter.resolve()
+        await blockingWriter
+
+        expect(await reconciliation).toMatchObject({
+          ok: true,
+          alreadyApplied: false,
+          committed: { term: 2, seq: 1, rowVersion: 1 },
+        })
+        expect(successorAdapter.reconcileCommittedTx).toHaveBeenCalledTimes(1)
+        expect(
+          await successor.requestApplyCommittedTx(collectionId, {
+            txId: `later`,
+            term: 0,
+            seq: 0,
+            rowVersion: 0,
+            mutations: [],
+          }),
+        ).toMatchObject({ ok: true, term: 2, seq: 2, latestRowVersion: 2 })
+        expect(successorInternals.collections.get(collectionId)).toMatchObject({
+          isLeader: true,
+          leaderId: successor.getNodeId(),
+        })
+        expect(formerAdapter.appliedTxs).toEqual([])
+        expect(
+          successorAdapter.appliedTxs.map(({ tx }) => ({
+            id: tx.txId,
+            term: tx.term,
+            seq: tx.seq,
+            rowVersion: tx.rowVersion,
+          })),
+        ).toEqual([
+          { id: `crossing`, term: 2, seq: 1, rowVersion: 1 },
+          { id: `later`, term: 2, seq: 2, rowVersion: 2 },
+        ])
+      } finally {
+        dropNextBroadcastMessage = undefined
+        releaseWriter.resolve()
+        await blockingWriter
+        unsubscribeFormer()
+        unsubscribeSuccessor()
+        former.dispose()
+        successor.dispose()
+        await reconciliation?.catch(() => undefined)
+      }
+    })
+
+    /**
+     * The writer-lock callback must recheck the full owner identity before
+     * entering the adapter. This deliberately contradictory local state is an
+     * invariant witness, not a legal Browser route: a Web Lock holder normally
+     * names itself. It protects the same fail-closed boundary as ordinary
+     * apply when a future change accidentally corrupts leaderId.
+     */
+    it(`rejects reconciliation before adapter entry when owner identity conflicts`, async () => {
+      const adapter = createStubAdapter()
+      adapter.reconcileCommittedTx = vi.fn(async (_collectionId, tx) => ({
+        kind: `applied-now` as const,
+        committed: {
+          term: tx.term,
+          seq: tx.seq,
+          rowVersion: tx.rowVersion,
+        },
+        latestRowVersion: tx.rowVersion,
+      }))
+      const coordinator = createCoordinator(adapter)
+      const collectionId = `source-reconcile-owner-invariant`
+      const unsubscribe = coordinator.subscribe(collectionId, () => {})
+      const writerEntered = createDeferred()
+      const releaseWriter = createDeferred()
+      let blockingWriter: Promise<unknown> | undefined
+      let reconciliation: Promise<unknown> | undefined
+      try {
+        await vi.waitFor(() =>
+          expect(coordinator.isLeader(collectionId)).toBe(true),
+        )
+        blockingWriter = mockNavigatorLocks.request(
+          `tsdb:writer:test-db`,
+          async () => {
+            writerEntered.resolve()
+            await releaseWriter.promise
+          },
+        )
+        await writerEntered.promise
+        reconciliation = coordinator.reconcileCommittedTx(
+          collectionId,
+          { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
+          { latestRowVersion: 0, resetEpoch: 0 },
+        )
+        await vi.waitFor(() =>
+          expect(lockQueues.get(`tsdb:writer:test-db`)).toHaveLength(1),
+        )
+        const state = (
+          coordinator as unknown as {
+            collections: Map<string, { leaderId: string | null }>
+          }
+        ).collections.get(collectionId)
+        if (!state) throw new Error(`missing coordinator state`)
+        state.leaderId = `contradictory-owner`
+        releaseWriter.resolve()
+        await blockingWriter
+        expect(await reconciliation).toMatchObject({
+          ok: false,
+          code: `NOT_LEADER`,
+        })
+        expect(adapter.reconcileCommittedTx).not.toHaveBeenCalled()
+      } finally {
+        releaseWriter.resolve()
+        await blockingWriter
+        await reconciliation?.catch(() => undefined)
+        unsubscribe()
+        coordinator.dispose()
+      }
+    })
+
+    /** A malformed wire request cannot turn missing proof into an ordinary write. */
+    it(`rejects a reconciliation RPC without its durable anchor`, async () => {
+      const adapter = createStubAdapter()
+      adapter.reconcileCommittedTx = vi.fn(async () => ({
+        kind: `unknown` as const,
+      }))
+      const coordinator = createCoordinator(adapter)
+      const unsubscribe = coordinator.subscribe(`source-anchor`, () => {})
+      let response: unknown
+      try {
+        await flush(50)
+        expect(coordinator.isLeader(`source-anchor`)).toBe(true)
+        observeBroadcastMessage = (message) => {
+          const payload = (message as { payload?: { type?: string } }).payload
+          if (payload?.type === `rpc:reconcileCommittedTx:res`) {
+            response = payload
+          }
+        }
+        injectBroadcastMessage(`tsdb:coord:test-db`, {
+          v: 1,
+          dbName: `test-db`,
+          collectionId: `source-anchor`,
+          senderId: `malformed-peer`,
+          ts: Date.now(),
+          payload: {
+            type: `rpc:reconcileCommittedTx:req`,
+            rpcId: `missing-anchor`,
+            tx: { txId: `unsafe`, mutations: [] },
+          },
+        })
+        await flush(50)
+        expect(response).toMatchObject({
+          rpcId: `missing-anchor`,
+          ok: false,
+          code: `UNDETERMINED`,
+        })
+        expect(adapter.reconcileCommittedTx).not.toHaveBeenCalled()
+        expect(adapter.appliedTxs).toEqual([])
+      } finally {
+        observeBroadcastMessage = undefined
+        unsubscribe()
+        coordinator.dispose()
+      }
+    })
+
+    /**
+     * Exact-ID reconciliation may follow lost transport answers and then a
+     * stale NOT_LEADER response. The same pending source receipt must survive
+     * both kinds of failure and reach the replacement route. This seam counts
+     * sends; it makes no wall-clock or real-network latency claim.
+     */
+    it(`reconciles after two lost answers and a stale owner rejection`, async () => {
+      const coordinator = createCoordinator()
+      const collectionId = `source-reconcile-work-bound`
+      const transportFailure = new Error(`lost reconciliation answer`)
+      const internals = coordinator as unknown as {
+        sendRPCOnce: (
+          collectionId: string,
+          request: { rpcId: string },
+        ) => Promise<unknown>
+      }
+      let sends = 0
+      internals.sendRPCOnce = vi.fn(async (_collectionId, request) => {
+        sends++
+        if (sends <= 2) throw transportFailure
+        return sends === 3
+          ? {
+              type: `rpc:reconcileCommittedTx:res`,
+              rpcId: request.rpcId,
+              ok: false,
+              code: `NOT_LEADER`,
+              error: `stale route`,
+            }
+          : {
+              type: `rpc:reconcileCommittedTx:res`,
+              rpcId: request.rpcId,
+              ok: true,
+              committed: { term: 2, seq: 1, rowVersion: 1 },
+            }
+      })
+      try {
+        injectBroadcastMessage(`tsdb:coord:test-db`, {
+          v: 1,
+          dbName: `test-db`,
+          collectionId,
+          senderId: `remote-owner`,
+          ts: Date.now(),
+          payload: {
+            type: `leader:heartbeat`,
+            leaderId: `remote-owner`,
+            term: 1,
+            latestSeq: 0,
+            latestRowVersion: 0,
+          },
+        })
+        await flush(0)
+        expect(
+          await coordinator.reconcileCommittedTx(
+            collectionId,
+            { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
+            { latestRowVersion: 0, resetEpoch: 0 },
+          ),
+        ).toMatchObject({ ok: true, committed: { term: 2 } })
+        expect(sends).toBe(4)
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    /** A NOT_LEADER response can race election before the durable check starts. */
+    it(`retries an unanswered source proof after a stale owner rejects its route`, async () => {
+      const oldOwner = createCoordinator(createStubAdapter())
+      const replacementAdapter = createStubAdapter()
+      replacementAdapter.reconcileCommittedTx = vi.fn(
+        async (collectionId, tx) => {
+          replacementAdapter.appliedTxs.push({ collectionId, tx })
+          return {
+            kind: `applied-now` as const,
+            committed: {
+              term: tx.term,
+              seq: tx.seq,
+              rowVersion: tx.rowVersion,
+            },
+            latestRowVersion: tx.rowVersion,
+          }
+        },
+      )
+      const requester = createCoordinator(replacementAdapter)
+      const releaseOld = oldOwner.subscribe(`source-route`, () => {})
+      const releaseRequester = requester.subscribe(`source-route`, () => {})
+      let rejectedRoute = false
+      try {
+        await flush(50)
+        expect(oldOwner.isLeader(`source-route`)).toBe(true)
+        dropNextBroadcastMessage = (message) => {
+          const payload = (
+            message as {
+              payload?: { type?: string; rpcId?: string }
+            }
+          ).payload
+          if (payload?.type !== `rpc:reconcileCommittedTx:req`) return false
+          rejectedRoute = true
+          queueMicrotask(() => {
+            injectBroadcastMessage(`tsdb:coord:test-db`, {
+              v: 1,
+              dbName: `test-db`,
+              collectionId: `source-route`,
+              senderId: oldOwner.getNodeId(),
+              ts: Date.now(),
+              payload: {
+                type: `rpc:reconcileCommittedTx:res`,
+                rpcId: payload.rpcId,
+                ok: false,
+                code: `NOT_LEADER`,
+                error: `the old owner released its route`,
+              },
+            })
+            oldOwner.dispose()
+          })
+          return true
+        }
+        const response = await requester.reconcileCommittedTx(
+          `source-route`,
+          { txId: `crossing`, term: 0, seq: 0, rowVersion: 0, mutations: [] },
+          { latestRowVersion: 0, resetEpoch: 0 },
+        )
+        expect(rejectedRoute).toBe(true)
+        expect(requester.isLeader(`source-route`)).toBe(true)
+        expect(response).toMatchObject({ ok: true, alreadyApplied: false })
+        expect(
+          replacementAdapter.appliedTxs.map(({ tx }) => ({
+            txId: tx.txId,
+            term: tx.term,
+            seq: tx.seq,
+            rowVersion: tx.rowVersion,
+          })),
+        ).toEqual([{ txId: `crossing`, term: 2, seq: 1, rowVersion: 1 }])
+      } finally {
+        dropNextBroadcastMessage = undefined
+        releaseOld()
+        releaseRequester()
+        oldOwner.dispose()
+        requester.dispose()
+      }
+    })
+
+    it(`fails indeterminate instead of retrying a committed transaction without an initial leader route`, async () => {
+      const coordinator = createCoordinator()
+      const transportError = new Error(`unknown leader response was lost`)
+      const attemptedTransactions: Array<PersistedTx> = []
+      const failedTransport = vi.fn(
+        (_collectionId: string, request: ApplyCommittedTxRequest) => {
+          attemptedTransactions.push(structuredClone(request.tx))
+          if (attemptedTransactions.length === 1) {
+            return Promise.reject(transportError)
+          }
+          return Promise.resolve({
+            type: `rpc:applyCommittedTx:res` as const,
+            rpcId: request.rpcId,
+            ok: true as const,
+            term: 1,
+            seq: 1,
+            latestRowVersion: 1,
+          })
+        },
+      )
+      Object.defineProperty(coordinator, `sendRPCOnce`, {
+        value: failedTransport,
+        configurable: true,
+      })
+
+      try {
+        const outcome = await coordinator
+          .requestApplyCommittedTx(`todos`, {
+            txId: `browser-unknown-leader-committed`,
+            term: 0,
+            seq: 0,
+            rowVersion: 0,
+            mutations: [
+              {
+                type: `insert`,
+                key: `browser-unknown-leader-committed`,
+                value: { id: `browser-unknown-leader-committed` },
+              },
+            ],
+          })
+          .then(
+            (response) => ({ response }),
+            (error: unknown) => ({ error }),
+          )
+
+        expect(outcome).toEqual({
+          error: expect.objectContaining({
+            name: `IndeterminateCommitError`,
+            code: `INDETERMINATE_COMMIT`,
+            collectionId: `todos`,
+            requestType: `rpc:applyCommittedTx:req`,
+            previousLeaderId: null,
+            previousTerm: null,
+            currentLeaderId: null,
+            currentTerm: null,
+            cause: transportError,
+          } satisfies Partial<IndeterminateCommitError>),
+        })
+        expect(failedTransport).toHaveBeenCalledTimes(1)
+        expect(attemptedTransactions).toEqual([
+          {
+            txId: `browser-unknown-leader-committed`,
+            term: 0,
+            seq: 0,
+            rowVersion: 0,
+            mutations: [
+              {
+                type: `insert`,
+                key: `browser-unknown-leader-committed`,
+                value: { id: `browser-unknown-leader-committed` },
+              },
+            ],
+          },
+        ])
+      } finally {
+        coordinator.dispose()
+      }
+    })
+
+    it(`does not retain completed or in-flight committed transactions after disposal`, async () => {
+      const adapter = createStubAdapter()
+      const originalApply = adapter.applyCommittedTx
+      let heldApplyEntered = false
+      let releaseHeldApply = (): void => {}
+      const heldApplyGate = new Promise<void>((resolve) => {
+        releaseHeldApply = resolve
+      })
+      adapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
+        if (tx.txId === `held-during-disposal`) {
+          heldApplyEntered = true
+          await heldApplyGate
+        }
+        await originalApply(collectionId, tx)
+      })
+      const coordinator = createCoordinator(adapter)
+      const internals = coordinator as unknown as {
+        handleApplyCommittedTx: (
+          collectionId: string,
+          request: ApplyCommittedTxRequest,
+        ) => Promise<{
+          ok: boolean
+          code?: string
+        }>
+        appliedEnvelopes: Map<string, unknown>
+        inFlightEnvelopes: Map<string, unknown>
+      }
+      const completedRequest: ApplyCommittedTxRequest = {
+        type: `rpc:applyCommittedTx:req`,
+        rpcId: `completed-rpc`,
+        envelopeId: `completed-envelope`,
+        tx: {
+          txId: `completed-before-disposal`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [],
+        },
+      }
+      const heldRequest: ApplyCommittedTxRequest = {
+        type: `rpc:applyCommittedTx:req`,
+        rpcId: `held-rpc`,
+        envelopeId: `held-envelope`,
+        tx: {
+          txId: `held-during-disposal`,
+          term: 0,
+          seq: 0,
+          rowVersion: 0,
+          mutations: [],
+        },
+      }
+
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        expect(
+          await internals.handleApplyCommittedTx(`todos`, completedRequest),
+        ).toMatchObject({ ok: true })
+        const heldResponse = internals.handleApplyCommittedTx(
+          `todos`,
+          heldRequest,
+        )
+        await vi.waitFor(() => expect(heldApplyEntered).toBe(true))
+        expect({
+          completed: internals.appliedEnvelopes.size,
+          inFlight: internals.inFlightEnvelopes.size,
+        }).toEqual({ completed: 1, inFlight: 1 })
+
+        coordinator.dispose()
+        expect({
+          completed: internals.appliedEnvelopes.size,
+          inFlight: internals.inFlightEnvelopes.size,
+        }).toEqual({ completed: 0, inFlight: 0 })
+
+        releaseHeldApply()
+        await expect(heldResponse).resolves.toMatchObject({ ok: true })
+        expect({
+          completed: internals.appliedEnvelopes.size,
+          inFlight: internals.inFlightEnvelopes.size,
+        }).toEqual({ completed: 0, inFlight: 0 })
+        await expect(
+          internals.handleApplyCommittedTx(`todos`, completedRequest),
+        ).resolves.toMatchObject({ ok: false, code: `NOT_LEADER` })
+      } finally {
+        releaseHeldApply()
+        coordinator.dispose()
+      }
+    })
+
+    it(`does not answer a held follower request after its leader is disposed`, async () => {
+      const leaderAdapter = createStubAdapter()
+      const originalApply = leaderAdapter.applyCommittedTx
+      let applyEntered = false
+      let releaseApply = (): void => {}
+      const applyGate = new Promise<void>((resolve) => {
+        releaseApply = resolve
+      })
+      leaderAdapter.applyCommittedTx = vi.fn(async (collectionId, tx) => {
+        applyEntered = true
+        await applyGate
+        await originalApply(collectionId, tx)
+      })
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator(createStubAdapter())
+      const leaderInternals = leader as unknown as {
+        appliedEnvelopes: Map<string, unknown>
+        inFlightEnvelopes: Map<string, unknown>
+      }
+      const followerInternals = follower as unknown as {
+        sendRPCOnce: (
+          collectionId: string,
+          request: ApplyCommittedTxRequest,
+        ) => Promise<unknown>
+      }
+      let responsePosts = 0
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        observeBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type === `rpc:applyCommittedTx:res`) {
+            responsePosts++
+          }
+        }
+        const outcomePromise = followerInternals
+          .sendRPCOnce(`todos`, {
+            type: `rpc:applyCommittedTx:req`,
+            rpcId: `held-follower-rpc`,
+            envelopeId: `held-follower-envelope`,
+            tx: {
+              txId: `held-follower-tx`,
+              term: 0,
+              seq: 0,
+              rowVersion: 0,
+              mutations: [],
+            },
+          })
+          .then(
+            (response) => ({ response }),
+            (error: unknown) => ({ error }),
+          )
+
+        await vi.waitFor(() => expect(applyEntered).toBe(true))
+        leader.dispose()
+        releaseApply()
+        await vi.waitFor(() => expect(leaderAdapter.appliedTxs).toHaveLength(1))
+        await flush()
+
+        expect({
+          responsePosts,
+          completed: leaderInternals.appliedEnvelopes.size,
+          inFlight: leaderInternals.inFlightEnvelopes.size,
+        }).toEqual({ responsePosts: 0, completed: 0, inFlight: 0 })
+
+        follower.dispose()
+        const outcome = await outcomePromise
+        expect(outcome).toEqual({ error: new Error(`coordinator disposed`) })
+      } finally {
+        observeBroadcastMessage = undefined
+        releaseApply()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+  })
+
+  describe(`RPC - ensureRemoteSubset`, () => {
+    /**
+     * Route-pending was absent from the earlier acquisition grammar: every
+     * generated request began after a leader was known. This law varies the
+     * terminal action while the same first acquisition is waiting for its
+     * route, and checks both transport exclusion and live local-only identity.
+     */
+    it.each([
+      { terminalAction: `complete` as const },
+      { terminalAction: `abort` as const },
+    ])(
+      `settles a route-pending first subset request after $terminalAction without premature transport or replay`,
+      async ({ terminalAction }) => {
+        const lockName = `tsdb:leader:test-db:todos`
+        let releaseInitialLock = (): void => {}
+        heldLocks.set(lockName, {
+          release: () => {
+            heldLocks.delete(lockName)
+            tryGrantNextLock(lockName)
+          },
+        })
+        releaseInitialLock = heldLocks.get(lockName)!.release
+        const coordinator = createCoordinator()
+        const owner = withUnusedUnloadSubset(vi.fn())
+        const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+          `todos`,
+          owner,
+        )
+        coordinator.subscribe(`todos`, () => {})
+        const internals = coordinator as unknown as {
+          sendRPCOnce: (
+            collectionId: string,
+            request: unknown,
+          ) => Promise<unknown>
+        }
+        const originalSendRPCOnce = internals.sendRPCOnce.bind(coordinator)
+        const prematureTransport = vi.fn(() =>
+          Promise.reject(new Error(`no leader route yet`)),
+        )
+        internals.sendRPCOnce = prematureTransport
+        const abortController = new AbortController()
+        const signal = abortController.signal
+        const subscription = { on: () => () => {} } as unknown as Subscription
+        const options: LoadSubsetOptions = { limit: 1, signal, subscription }
+        const acquisitionInternals = coordinator as unknown as {
+          outboundRemoteSubsetAcquisitions: Map<string, unknown>
+        }
+
+        try {
+          const request = coordinator.requestEnsureRemoteSubset(
+            `todos`,
+            options,
+          )
+          await flush(0)
+          const transportCallsBeforeLeadership =
+            prematureTransport.mock.calls.length
+
+          if (terminalAction === `abort`) {
+            abortController.abort()
+            await expect(request).rejects.toMatchObject({ name: `AbortError` })
+          }
+          releaseInitialLock()
+          await vi.waitFor(() =>
+            expect(coordinator.isLeader(`todos`)).toBe(true),
+          )
+          if (terminalAction === `complete`) await request
+          await flush(0)
+
+          expect(transportCallsBeforeLeadership).toBe(0)
+          if (terminalAction === `complete`) {
+            expect(owner).toHaveBeenCalledTimes(1)
+            expect(owner.mock.calls[0]?.[0]).toMatchObject({ limit: 1 })
+            expect(owner.mock.calls[0]?.[0].signal).toBe(signal)
+            expect(owner.mock.calls[0]?.[0].subscription).toBe(subscription)
+          } else {
+            expect(owner).not.toHaveBeenCalled()
+            expect(
+              acquisitionInternals.outboundRemoteSubsetAcquisitions.size,
+            ).toBe(0)
+          }
+          await coordinator.requestReleaseRemoteSubset(`todos`, options)
+        } finally {
+          internals.sendRPCOnce = originalSendRPCOnce
+          releaseInitialLock()
+          unregisterOwner()
+          coordinator.dispose()
+        }
+      },
+    )
+
+    it.each([
+      { cleanupOrder: `owner then subscriptions` as const, subscriberCount: 1 },
+      { cleanupOrder: `owner then subscriptions` as const, subscriberCount: 2 },
+      { cleanupOrder: `subscriptions then owner` as const, subscriberCount: 1 },
+      { cleanupOrder: `subscriptions then owner` as const, subscriberCount: 2 },
+    ])(
+      `relinquishes leadership after $subscriberCount runtime subscriber(s) clean up in $cleanupOrder order`,
+      async ({ cleanupOrder, subscriberCount }) => {
+        const first = createCoordinator()
+        const second = createCoordinator()
+        const unsubscribeFirst = Array.from({ length: subscriberCount }, () =>
+          first.subscribe(`todos`, () => {}),
+        )
+        second.subscribe(`todos`, () => {})
+        const firstOwner = withUnusedUnloadSubset(vi.fn())
+        const secondOwner = withUnusedUnloadSubset(vi.fn())
+        const unregisterFirst = first.registerRemoteSubsetOwner(
+          `todos`,
+          firstOwner,
+        )
+        const unregisterSecond = second.registerRemoteSubsetOwner(
+          `todos`,
+          secondOwner,
+        )
+
+        try {
+          await vi.waitFor(() => {
+            expect({
+              first: first.isLeader(`todos`),
+              second: second.isLeader(`todos`),
+            }).toEqual({ first: true, second: false })
+          })
+
+          if (cleanupOrder === `owner then subscriptions`) unregisterFirst()
+          for (const [index, unsubscribe] of unsubscribeFirst.entries()) {
+            unsubscribe()
+            if (index < unsubscribeFirst.length - 1) {
+              expect(first.isLeader(`todos`)).toBe(true)
+            }
+          }
+          if (cleanupOrder === `subscriptions then owner`) unregisterFirst()
+
+          await vi.waitFor(() => {
+            expect({
+              first: first.isLeader(`todos`),
+              second: second.isLeader(`todos`),
+            }).toEqual({ first: false, second: true })
+          })
+
+          const options: LoadSubsetOptions = { limit: 1 }
+          await second.requestEnsureRemoteSubset(`todos`, options)
+          expect(secondOwner).toHaveBeenCalledTimes(1)
+          await second.requestReleaseRemoteSubset(`todos`, options)
+        } finally {
+          for (const unsubscribe of unsubscribeFirst) unsubscribe()
+          unregisterFirst()
+          unregisterSecond()
+          first.dispose()
+          second.dispose()
+        }
+      },
+    )
+
+    it(`does not orphan an overlapping leadership attempt across rapid unsubscribe and resubscribe`, async () => {
+      // The earlier generated histories changed leaders only after a settled
+      // acquisition. This hostile history leaves getStreamPosition in flight
+      // while participation toggles twice, which can overlap lock loops.
+      const NativeAbortController = globalThis.AbortController
+      const leadershipControllers: Array<AbortController> = []
+      class TrackingAbortController extends NativeAbortController {
+        constructor() {
+          super()
+          leadershipControllers.push(this)
+        }
+      }
+      Object.defineProperty(globalThis, `AbortController`, {
+        value: TrackingAbortController,
+        writable: true,
+        configurable: true,
+      })
+      const adapter = createStubAdapter()
+      const positionResolvers: Array<() => void> = []
+      adapter.getStreamPosition = vi.fn(
+        () =>
+          new Promise<{
+            latestTerm: number
+            latestSeq: number
+            latestRowVersion: number
+          }>((resolve) => {
+            positionResolvers.push(() =>
+              resolve({
+                latestTerm: 0,
+                latestSeq: 0,
+                latestRowVersion: 0,
+              }),
+            )
+          }),
+      )
+      const participant = createCoordinator(adapter)
+      let unsubscribe = participant.subscribe(`todos`, () => {})
+      let contender: BrowserCollectionCoordinator | undefined
+
+      try {
+        await vi.waitFor(() => expect(positionResolvers).toHaveLength(1))
+
+        unsubscribe()
+        unsubscribe = participant.subscribe(`todos`, () => {})
+        positionResolvers[0]!()
+        await vi.waitFor(() => expect(positionResolvers).toHaveLength(2))
+        await flush(0)
+
+        contender = createCoordinator()
+        contender.subscribe(`todos`, () => {})
+        unsubscribe()
+        positionResolvers[1]!()
+
+        await vi.waitFor(() => {
+          expect({
+            participant: participant.isLeader(`todos`),
+            contender: contender!.isLeader(`todos`),
+          }).toEqual({ participant: false, contender: true })
+        })
+      } finally {
+        unsubscribe()
+        for (const controller of leadershipControllers) controller.abort()
+        participant.dispose()
+        contender?.dispose()
+        Object.defineProperty(globalThis, `AbortController`, {
+          value: NativeAbortController,
+          writable: true,
+          configurable: true,
+        })
+      }
+    })
+
+    it(`rejects a second live remote subset owner instead of replacing the first`, () => {
+      const coordinator = createCoordinator()
+      const first = Object.assign(
+        vi.fn((_options: TransportedLoadSubsetOptions) => Promise.resolve()),
+        {
+          loadSubset: vi.fn((_options: TransportedLoadSubsetOptions) =>
+            Promise.resolve(),
+          ),
+          unloadSubset: vi.fn((_options: TransportedLoadSubsetOptions) => {}),
+          onError: vi.fn(),
+        },
+      )
+      const second = Object.assign(
+        vi.fn((_options: TransportedLoadSubsetOptions) => Promise.resolve()),
+        {
+          loadSubset: vi.fn((_options: TransportedLoadSubsetOptions) =>
+            Promise.resolve(),
+          ),
+          unloadSubset: vi.fn((_options: TransportedLoadSubsetOptions) => {}),
+          onError: vi.fn(),
+        },
+      )
+      const unregisterFirst = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        first,
+      )
+
+      try {
+        expect(() =>
+          coordinator.registerRemoteSubsetOwner(`todos`, second),
+        ).toThrowError(
+          expect.objectContaining({
+            name: `DuplicateRemoteSubsetOwnerError`,
+            collectionId: `todos`,
+          }),
+        )
+      } finally {
+        unregisterFirst()
+        coordinator.dispose()
+      }
+    })
+
+    it(`rejects an unsupported nested membership value before local owner work`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+
+      const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+
+      try {
+        await expect(
+          coordinator.requestEnsureRemoteSubset(
+            `todos`,
+            subsetWithNestedValue(() => {}),
+          ),
+        ).rejects.toMatchObject({
+          name: `RemoteSubsetWireValueError`,
+          path: `options.where.args[1].value[1]`,
+          message: `Unsupported remote subset wire value at options.where.args[1].value[1]: function`,
+        })
+        expect(owner).not.toHaveBeenCalled()
+      } finally {
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`rejects a sparse function argument at its exact Browser wire path`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      const owner = withUnusedUnloadSubset(vi.fn())
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      const args = [new IR.PropRef([`todos`, `status`])]
+      args.length = 2
+
+      try {
+        await expect(
+          coordinator.requestEnsureRemoteSubset(`todos`, {
+            where: new IR.Func(`eq`, args),
+          }),
+        ).rejects.toMatchObject({
+          name: `RemoteSubsetWireValueError`,
+          path: `options.where.args[1]`,
+        })
+        expect(owner).not.toHaveBeenCalled()
+      } finally {
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`holds same-stack Browser subset reentry behind the original owner load`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      const options: LoadSubsetOptions = { limit: 1 }
+      let releaseLoad = (): void => {}
+      const loadGate = new Promise<void>((resolve) => {
+        releaseLoad = resolve
+      })
+      let duplicate: Promise<void> | undefined
+      let didReenter = false
+      const owner = Object.assign(
+        vi.fn(() => {
+          if (!didReenter) {
+            didReenter = true
+            duplicate = coordinator.requestEnsureRemoteSubset(`todos`, options)
+          }
+          return loadGate
+        }),
+        { unloadSubset: vi.fn(), onError: vi.fn() },
+      )
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+
+      try {
+        let firstSettled = false
+        let duplicateSettled = false
+        const first = coordinator
+          .requestEnsureRemoteSubset(`todos`, options)
+          .then(() => {
+            firstSettled = true
+          })
+        await vi.waitFor(() => expect(duplicate).toBeDefined())
+        const duplicateResult = duplicate!.then(() => {
+          duplicateSettled = true
+        })
+        await flush(0)
+
+        expect({
+          ownerCalls: owner.mock.calls.length,
+          firstSettled,
+          duplicateSettled,
+        }).toEqual({
+          ownerCalls: 1,
+          firstSettled: false,
+          duplicateSettled: false,
+        })
+
+        releaseLoad()
+        await Promise.all([first, duplicateResult])
+      } finally {
+        releaseLoad()
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    // The owner can hold a load until unload cancels it. A terminal release
+    // must therefore reach unload before source settlement, even when release
+    // reenters from the owner's load callback on the same stack.
+    it(`compacts a terminal same-stack Browser release before the owner load finishes`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      const options: LoadSubsetOptions = { limit: 1 }
+      let releaseLoad = (): void => {}
+      const loadGate = new Promise<void>((resolve) => {
+        releaseLoad = resolve
+      })
+      let release: Promise<void> | undefined
+      const events: Array<string> = []
+      const owner = Object.assign(
+        vi.fn(() => {
+          events.push(`load`)
+          release = coordinator.requestReleaseRemoteSubset(`todos`, options)
+          return loadGate
+        }),
+        {
+          unloadSubset: vi.fn(() => {
+            events.push(`unload`)
+          }),
+          onError: vi.fn(),
+        },
+      )
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      const internals = coordinator as unknown as {
+        outboundRemoteSubsetAcquisitions: Map<string, unknown>
+        inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
+      }
+
+      try {
+        let releaseSettled = false
+        const load = coordinator.requestEnsureRemoteSubset(`todos`, options)
+        await vi.waitFor(() => expect(release).toBeDefined())
+        const terminalRelease = release!.then(() => {
+          releaseSettled = true
+        })
+        await vi.waitFor(() => expect(releaseSettled).toBe(true))
+        expect({ events: [...events], releaseSettled }).toEqual({
+          events: [`load`, `unload`],
+          releaseSettled: true,
+        })
+
+        releaseLoad()
+        await Promise.all([load, terminalRelease])
+        const [terminal] = internals.inboundRemoteSubsetAcquisitions.values()
+        expect({
+          events,
+          outbound: internals.outboundRemoteSubsetAcquisitions.size,
+          inbound: internals.inboundRemoteSubsetAcquisitions.size,
+          terminalKeys: Object.keys(terminal ?? {}).sort(),
+        }).toEqual({
+          events: [`load`, `unload`],
+          outbound: 0,
+          inbound: 1,
+          terminalKeys: [
+            `acquisitionId`,
+            `collectionId`,
+            `released`,
+            `requesterId`,
+          ],
+        })
+      } finally {
+        releaseLoad()
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it.each([
+      { failureMode: `before lease transfer` as const, expectedUnloads: 1 },
+      { failureMode: `after lease transfer` as const, expectedUnloads: 2 },
+    ])(
+      `retires a rejected owner load $failureMode and permits a fresh retry`,
+      async ({ failureMode, expectedUnloads }) => {
+        // The previous grammar generated only fulfilled owner loads. Both sides
+        // of the promise-return lease-transfer boundary must permit a fresh
+        // attempt without caching the rejected acquisition.
+        const coordinator = createCoordinator()
+        coordinator.subscribe(`todos`, () => {})
+        await flush(50)
+        expect(coordinator.isLeader(`todos`)).toBe(true)
+        const loadError = new Error(`browser transferred load failed`)
+        const ownerErrors: Array<unknown> = []
+        let loadCalls = 0
+        const owner = Object.assign(
+          vi.fn((_options: TransportedLoadSubsetOptions) => {
+            loadCalls++
+            if (loadCalls !== 1) return Promise.resolve()
+            if (failureMode === `before lease transfer`) throw loadError
+            return Promise.reject(loadError)
+          }),
+          {
+            unloadSubset: vi.fn(
+              (_options: TransportedLoadSubsetOptions) => undefined,
+            ),
+            onError: (error: unknown) => ownerErrors.push(error),
+          },
+        )
+        const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+          `todos`,
+          owner,
+        )
+        const options: LoadSubsetOptions = { offset: 20 }
+        const unhandled: Array<unknown> = []
+        const onUnhandled = (error: unknown) => unhandled.push(error)
+        process.on(`unhandledRejection`, onUnhandled)
+        const internals = coordinator as unknown as {
+          inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
+        }
+
+        try {
+          const ensureError = await coordinator
+            .requestEnsureRemoteSubset(`todos`, options)
+            .then(
+              () => undefined,
+              (error: unknown) => error,
+            )
+          await coordinator.requestEnsureRemoteSubset(`todos`, options)
+          await coordinator.requestReleaseRemoteSubset(`todos`, options)
+          await flush(0)
+          const [terminal] = internals.inboundRemoteSubsetAcquisitions.values()
+
+          expect(ensureError).toBe(loadError)
+          expect(owner).toHaveBeenCalledTimes(2)
+          expect(owner.unloadSubset).toHaveBeenCalledTimes(expectedUnloads)
+          if (failureMode === `after lease transfer`) {
+            expect(owner.unloadSubset.mock.calls[0]?.[0]).toBe(
+              owner.mock.calls[0]?.[0],
+            )
+          }
+          expect(owner.unloadSubset.mock.calls.at(-1)?.[0]).toBe(
+            owner.mock.calls[1]?.[0],
+          )
+          expect(ownerErrors).toEqual([])
+          expect(unhandled).toEqual([])
+          expect({
+            inbound: internals.inboundRemoteSubsetAcquisitions.size,
+            terminalKeys: Object.keys(terminal ?? {}).sort(),
+          }).toEqual({
+            inbound: 1,
+            terminalKeys: [
+              `acquisitionId`,
+              `collectionId`,
+              `released`,
+              `requesterId`,
+            ],
+          })
+        } finally {
+          process.off(`unhandledRejection`, onUnhandled)
+          unregisterOwner()
+          coordinator.dispose()
+        }
+      },
+    )
+
+    it.each([
+      {
+        transportFailure: `delivered negative response` as const,
+        retainedAfterFailure: 0,
+      },
+      {
+        transportFailure: `undelivered rejection` as const,
+        retainedAfterFailure: 1,
+      },
+    ])(
+      `resolves a $transportFailure by delivery boundary without takeover replay`,
+      async ({ transportFailure, retainedAfterFailure }) => {
+        // Earlier takeover histories replayed only live demand; release failure
+        // was tested without a real leader change. No-response transport keeps
+        // retry debt; a leader response proves delivery and retires it. Both
+        // terminal paths must suppress takeover replay.
+        const leader = createCoordinator()
+        const follower = createCoordinator()
+        const unsubscribeLeader = leader.subscribe(`todos`, () => {})
+        follower.subscribe(`todos`, () => {})
+        await flush(50)
+        const firstOwner = Object.assign(
+          vi.fn(() => Promise.resolve()),
+          {
+            unloadSubset: vi.fn(() => Promise.resolve()),
+            onError: vi.fn(),
+          },
+        )
+        const secondOwner = Object.assign(
+          vi.fn(() => Promise.resolve()),
+          {
+            unloadSubset: vi.fn(() => Promise.resolve()),
+            onError: vi.fn(),
+          },
+        )
+        const unregisterFirst = leader.registerRemoteSubsetOwner(
+          `todos`,
+          firstOwner,
+        )
+        const unregisterSecond = follower.registerRemoteSubsetOwner(
+          `todos`,
+          secondOwner,
+        )
+        const options: LoadSubsetOptions = { limit: 1 }
+        const followerInternals = follower as unknown as {
+          sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
+          outboundRemoteSubsetAcquisitions: Map<string, unknown>
+        }
+
+        try {
+          await follower.requestEnsureRemoteSubset(`todos`, options)
+          const sendRPC = followerInternals.sendRPC.bind(follower)
+          let releaseAttempts = 0
+          followerInternals.sendRPC = async (collectionId, request) => {
+            if (
+              (request as { type?: string }).type ===
+              `rpc:releaseRemoteSubset:req`
+            ) {
+              releaseAttempts++
+              if (releaseAttempts === 1) {
+                if (transportFailure === `undelivered rejection`) {
+                  throw new Error(`transient release transport rejection`)
+                }
+                return {
+                  type: `rpc:releaseRemoteSubset:res`,
+                  rpcId: (request as { rpcId: string }).rpcId,
+                  ok: false,
+                  error: `transient release transport failure`,
+                }
+              }
+            }
+            return sendRPC(collectionId, request)
+          }
+
+          await expect(
+            follower.requestReleaseRemoteSubset(`todos`, options),
+          ).rejects.toThrow(/transient release transport/)
+          expect({
+            releaseAttempts,
+            retained: followerInternals.outboundRemoteSubsetAcquisitions.size,
+            unloads: firstOwner.unloadSubset.mock.calls.length,
+          }).toEqual({
+            releaseAttempts: 1,
+            retained: retainedAfterFailure,
+            unloads: 0,
+          })
+
+          unsubscribeLeader()
+          await vi.waitFor(() => expect(follower.isLeader(`todos`)).toBe(true))
+          await vi.waitFor(() =>
+            expect(firstOwner.unloadSubset).toHaveBeenCalledTimes(1),
+          )
+          expect(secondOwner).not.toHaveBeenCalled()
+
+          await follower.requestReleaseRemoteSubset(`todos`, options)
+          expect({
+            releaseAttempts,
+            retained: followerInternals.outboundRemoteSubsetAcquisitions.size,
+            firstUnloads: firstOwner.unloadSubset.mock.calls.length,
+            takeoverLoads: secondOwner.mock.calls.length,
+          }).toEqual({
+            releaseAttempts: 1,
+            retained: 0,
+            firstUnloads: 1,
+            takeoverLoads: 0,
+          })
+        } finally {
+          unsubscribeLeader()
+          unregisterFirst()
+          unregisterSecond()
+          leader.dispose()
+          follower.dispose()
+        }
+      },
+    )
+
+    // A release may reach the old leader and unload its exact acquisition,
+    // while the reply is lost. The real RPC timer then expires after takeover;
+    // its retry must retire the outbound debt without replaying demand or
+    // unloading the old acquisition twice. The independent expectation is one
+    // old-owner unload, zero replacement-owner loads, and no outbound lease at
+    // the release settlement checkpoint.
+    it(`retries a timed-out old-leader release after takeover without replaying demand`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      const unsubscribeLeader = leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+      const oldOwner = Object.assign(
+        vi.fn(() => Promise.resolve()),
+        {
+          unloadSubset: vi.fn(() => Promise.resolve()),
+          onError: vi.fn(),
+        },
+      )
+      const newOwner = Object.assign(
+        vi.fn(() => Promise.resolve()),
+        {
+          unloadSubset: vi.fn(() => Promise.resolve()),
+          onError: vi.fn(),
+        },
+      )
+      const unregisterOld = leader.registerRemoteSubsetOwner(`todos`, oldOwner)
+      const unregisterNew = follower.registerRemoteSubsetOwner(
+        `todos`,
+        newOwner,
+      )
+      const options: LoadSubsetOptions = { limit: 1 }
+      const internals = follower as unknown as {
+        outboundRemoteSubsetAcquisitions: Map<string, unknown>
+      }
+      let droppedResponses = 0
+
+      try {
+        await follower.requestEnsureRemoteSubset(`todos`, options)
+        dropNextBroadcastMessage = (data) => {
+          const type = (data as { payload?: { type?: string } }).payload?.type
+          if (type !== `rpc:releaseRemoteSubset:res`) return false
+          droppedResponses++
+          return true
+        }
+        const release = follower.requestReleaseRemoteSubset(`todos`, options)
+        void release.catch(() => undefined)
+        await vi.waitFor(() => expect(droppedResponses).toBe(1))
+        expect(oldOwner.unloadSubset).toHaveBeenCalledTimes(1)
+        expect(internals.outboundRemoteSubsetAcquisitions.size).toBe(1)
+
+        unsubscribeLeader()
+        await vi.waitFor(() => expect(follower.isLeader(`todos`)).toBe(true))
+        await release
+        expect(internals.outboundRemoteSubsetAcquisitions.size).toBe(0)
+        expect(oldOwner.unloadSubset).toHaveBeenCalledTimes(1)
+        expect(newOwner).not.toHaveBeenCalled()
+        expect(newOwner.unloadSubset).not.toHaveBeenCalled()
+      } finally {
+        dropNextBroadcastMessage = undefined
+        unsubscribeLeader()
+        unregisterOld()
+        unregisterNew()
+        leader.dispose()
+        follower.dispose()
+      }
+    }, 20_000)
+
+    it(`keeps a Browser release tombstone when a transferred load rejects concurrently`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+      const loadError = new Error(`browser concurrent transferred load failed`)
+      let rejectLoad = (_error: unknown): void => {}
+      const loadGate = new Promise<void>((_resolve, reject) => {
+        rejectLoad = reject
+      })
+      const ownerErrors: Array<unknown> = []
+      const owner = Object.assign(
+        vi.fn((_options: TransportedLoadSubsetOptions) => loadGate),
+        {
+          unloadSubset: vi.fn(
+            (_options: TransportedLoadSubsetOptions) => undefined,
+          ),
+          onError: (error: unknown) => ownerErrors.push(error),
+        },
+      )
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      const options: LoadSubsetOptions = { offset: 21 }
+      const unhandled: Array<unknown> = []
+      const onUnhandled = (error: unknown) => unhandled.push(error)
+      process.on(`unhandledRejection`, onUnhandled)
+      const internals = coordinator as unknown as {
+        nodeId: string
+        outboundRemoteSubsetAcquisitions: Map<string, { acquisitionId: string }>
+        inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
+        handleEnsureRemoteSubset: (
+          collectionId: string,
+          request: {
+            type: `rpc:ensureRemoteSubset:req`
+            rpcId: string
+            acquisitionId: string
+            options: TransportedLoadSubsetOptions
+          },
+          requesterId: string,
+        ) => Promise<{ ok: boolean }>
+      }
+
+      try {
+        const ensure = coordinator
+          .requestEnsureRemoteSubset(`todos`, options)
+          .then(
+            () => ({ status: `fulfilled` as const }),
+            (error: unknown) => ({ status: `rejected` as const, error }),
+          )
+        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
+        const [outbound] = internals.outboundRemoteSubsetAcquisitions.values()
+        const release = coordinator
+          .requestReleaseRemoteSubset(`todos`, options)
+          .then(
+            () => ({ status: `fulfilled` as const }),
+            (error: unknown) => ({ status: `rejected` as const, error }),
+          )
+        rejectLoad(loadError)
+        const outcomes = await Promise.all([ensure, release])
+        const duplicate = await internals
+          .handleEnsureRemoteSubset(
+            `todos`,
+            {
+              type: `rpc:ensureRemoteSubset:req`,
+              rpcId: `delayed-browser-duplicate`,
+              acquisitionId: outbound!.acquisitionId,
+              options: owner.mock.calls[0]![0],
+            },
+            internals.nodeId,
+          )
+          .then(
+            (response) => ({ status: `fulfilled` as const, response }),
+            (error: unknown) => ({ status: `rejected` as const, error }),
+          )
+        await flush(0)
+        const [terminal] = internals.inboundRemoteSubsetAcquisitions.values()
+
+        expect(outcomes).toEqual([
+          { status: `rejected`, error: loadError },
+          { status: `fulfilled` },
+        ])
+        expect(duplicate).toEqual({
+          status: `fulfilled`,
+          response: expect.objectContaining({ ok: true }),
+        })
+        expect(owner).toHaveBeenCalledTimes(1)
+        expect(owner.unloadSubset).toHaveBeenCalledTimes(1)
+        expect(ownerErrors).toEqual([])
+        expect(unhandled).toEqual([])
+        expect({
+          inbound: internals.inboundRemoteSubsetAcquisitions.size,
+          terminalKeys: Object.keys(terminal ?? {}).sort(),
+        }).toEqual({
+          inbound: 1,
+          terminalKeys: [
+            `acquisitionId`,
+            `collectionId`,
+            `released`,
+            `requesterId`,
+          ],
+        })
+      } finally {
+        rejectLoad(loadError)
+        process.off(`unhandledRejection`, onUnhandled)
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`rejects unsupported nested values before follower transport or owner work`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
+      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+      let subsetPosts = 0
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(leader.isLeader(`todos`)).toBe(true)
+      expect(follower.isLeader(`todos`)).toBe(false)
+      observeBroadcastMessage = (data) => {
+        const payload = (data as { payload?: { type?: string } }).payload
+        if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
+      }
+
+      try {
+        await expect(
+          follower.requestEnsureRemoteSubset(
+            `todos`,
+            subsetWithNestedValue(() => {}),
+          ),
+        ).rejects.toMatchObject({
+          name: `RemoteSubsetWireValueError`,
+          path: `options.where.args[1].value[1]`,
+          message: `Unsupported remote subset wire value at options.where.args[1].value[1]: function`,
+        })
+        expect({ subsetPosts, ownerCalls: owner.mock.calls.length }).toEqual({
+          subsetPosts: 0,
+          ownerCalls: 0,
+        })
+      } finally {
+        observeBroadcastMessage = undefined
+        unregisterOwner()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it.each(unsupportedSubsetValueCases)(
+      `rejects a nested %s through both local and follower admission`,
+      async (_label, createUnsupported, path) => {
+        const leader = createCoordinator()
+        const follower = createCoordinator()
+        const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
+        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+        let subsetPosts = 0
+
+        leader.subscribe(`todos`, () => {})
+        follower.subscribe(`todos`, () => {})
+        await flush(50)
+        observeBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
+        }
+
+        try {
+          // Admission-only traversal must retain the same independently named
+          // rejection boundary as the local and transported coordinator routes.
+          expect(() =>
+            validateRemoteSubsetOptions(
+              subsetWithNestedValue(createUnsupported()),
+            ),
+          ).toThrowError(
+            expect.objectContaining({
+              name: `RemoteSubsetWireValueError`,
+              path,
+            }),
+          )
+          const outcomes = await Promise.all(
+            [leader, follower].map((coordinator) =>
+              coordinator
+                .requestEnsureRemoteSubset(
+                  `todos`,
+                  subsetWithNestedValue(createUnsupported()),
+                )
+                .then(
+                  () => ({ ok: true as const }),
+                  (error: unknown) => ({ ok: false as const, error }),
+                ),
+            ),
+          )
+          for (const outcome of outcomes) {
+            expect(outcome).toMatchObject({
+              ok: false,
+              error: { name: `RemoteSubsetWireValueError`, path },
+            })
+          }
+          expect({
+            subsetPosts,
+            ownerCalls: owner.mock.calls.length,
+          }).toEqual({ subsetPosts: 0, ownerCalls: 0 })
+        } finally {
+          observeBroadcastMessage = undefined
+          unregisterOwner()
+          leader.dispose()
+          follower.dispose()
+        }
+      },
+    )
+
+    it.each([
+      [
+        `where expression`,
+        {
+          where: new IR.Value({ nested: () => {} }),
+        },
+        `options.where.value.nested`,
+      ],
+      [
+        `non-identifier object key`,
+        {
+          where: new IR.Value({ [`dotted.key`]: () => {} }),
+        },
+        `options.where.value["dotted.key"]`,
+      ],
+      [
+        `property-reference path`,
+        {
+          where: new IR.PropRef([`todos`, (() => {}) as unknown as string]),
+        },
+        `options.where.path[1]`,
+      ],
+      [
+        `order expression`,
+        {
+          orderBy: [
+            {
+              expression: new IR.Value({ nested: () => {} }),
+              compareOptions: { direction: `asc`, nulls: `last` },
+            },
+          ],
+        },
+        `options.orderBy[0].expression.value.nested`,
+      ],
+      [
+        `comparison options`,
+        {
+          orderBy: [
+            {
+              expression: new IR.PropRef([`todos`, `title`]),
+              compareOptions: {
+                direction: `asc`,
+                nulls: `last`,
+                stringSort: `locale`,
+                localeOptions: { matcher: () => {} },
+              },
+            },
+          ],
+        },
+        `options.orderBy[0].compareOptions.localeOptions.matcher`,
+      ],
+      [
+        `cursor from expression`,
+        {
+          cursor: {
+            whereFrom: new IR.Value({ nested: () => {} }),
+            whereCurrent: new IR.Value(`current`),
+          },
+        },
+        `options.cursor.whereFrom.value.nested`,
+      ],
+      [
+        `cursor current expression`,
+        {
+          cursor: {
+            whereFrom: new IR.Value(`from`),
+            whereCurrent: new IR.Value({ nested: () => {} }),
+          },
+        },
+        `options.cursor.whereCurrent.value.nested`,
+      ],
+      [
+        `cursor key`,
+        {
+          cursor: {
+            whereFrom: new IR.Value(`from`),
+            whereCurrent: new IR.Value(`current`),
+            lastKey: () => {},
+          },
+        },
+        `options.cursor.lastKey`,
+      ],
+      [`limit`, { limit: () => {} }, `options.limit`],
+      [`offset`, { offset: () => {} }, `options.offset`],
+    ] as const)(
+      `reports the exact path for an unsupported %s value`,
+      async (_label, options, path) => {
+        const leader = createCoordinator()
+        const follower = createCoordinator()
+        leader.subscribe(`todos`, () => {})
+        follower.subscribe(`todos`, () => {})
+        await flush(50)
+        const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
+        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+        let subsetPosts = 0
+        observeBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
+        }
+
+        try {
+          // Admission-only traversal must retain the same independently named
+          // rejection boundary as the local and transported coordinator routes.
+          expect(() =>
+            validateRemoteSubsetOptions(
+              options as unknown as LoadSubsetOptions,
+            ),
+          ).toThrowError(
+            expect.objectContaining({
+              name: `RemoteSubsetWireValueError`,
+              path,
+            }),
+          )
+          const outcomes = await Promise.all(
+            [leader, follower].map((coordinator) =>
+              coordinator
+                .requestEnsureRemoteSubset(
+                  `todos`,
+                  options as unknown as LoadSubsetOptions,
+                )
+                .then(
+                  () => ({ ok: true as const }),
+                  (error: unknown) => ({ ok: false as const, error }),
+                ),
+            ),
+          )
+          for (const outcome of outcomes) {
+            expect(outcome).toMatchObject({
+              ok: false,
+              error: { name: `RemoteSubsetWireValueError`, path },
+            })
+          }
+          expect({
+            subsetPosts,
+            ownerCalls: owner.mock.calls.length,
+          }).toEqual({ subsetPosts: 0, ownerCalls: 0 })
+        } finally {
+          observeBroadcastMessage = undefined
+          unregisterOwner()
+          leader.dispose()
+          follower.dispose()
+        }
+      },
+    )
+
+    it.each([
+      [
+        `wire record reused as an expression`,
+        () => {
+          const shared = { bad: 1 }
+          return {
+            where: new IR.Func(`and`, [
+              new IR.Value(shared),
+              shared as unknown as IR.BasicExpression,
+            ]),
+          }
+        },
+        `options.where.args[1].type`,
+      ],
+      [
+        `wire array reused as a property-reference path`,
+        () => {
+          const shared = [`todos`, 1]
+          return {
+            where: new IR.Func(`and`, [
+              new IR.Value(shared),
+              new IR.PropRef(shared as unknown as Array<string>),
+            ]),
+          }
+        },
+        `options.where.args[1].path[1]`,
+      ],
+      [
+        `wire array reused as an expression array`,
+        () => {
+          const shared = [1]
+          return {
+            where: new IR.Func(`and`, [
+              new IR.Value(shared),
+              new IR.Func(
+                `nested`,
+                shared as unknown as Array<IR.BasicExpression>,
+              ),
+            ]),
+          }
+        },
+        `options.where.args[1].args[0]`,
+      ],
+      [
+        `wire record reused as comparison options`,
+        () => {
+          const shared = { bad: 1 }
+          return {
+            where: new IR.Value(shared),
+            orderBy: [
+              {
+                expression: new IR.PropRef([`todos`, `title`]),
+                compareOptions: shared,
+              },
+            ],
+          }
+        },
+        `options.orderBy[0].compareOptions.bad`,
+      ],
+    ] as const)(
+      `does not reuse a projected %s across incompatible schema roles`,
+      async (_label, createOptions, path) => {
+        const leader = createCoordinator()
+        const follower = createCoordinator()
+        const owner = withUnusedUnloadSubset(vi.fn(() => Promise.resolve()))
+        const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+        let subsetPosts = 0
+
+        leader.subscribe(`todos`, () => {})
+        follower.subscribe(`todos`, () => {})
+        await flush(50)
+        observeBroadcastMessage = (data) => {
+          const payload = (data as { payload?: { type?: string } }).payload
+          if (payload?.type === `rpc:ensureRemoteSubset:req`) subsetPosts++
+        }
+
+        try {
+          // Admission-only traversal must retain the same independently named
+          // rejection boundary as the local and transported coordinator routes.
+          expect(() =>
+            validateRemoteSubsetOptions(
+              createOptions() as unknown as LoadSubsetOptions,
+            ),
+          ).toThrowError(
+            expect.objectContaining({
+              name: `RemoteSubsetWireValueError`,
+              path,
+            }),
+          )
+          const outcomes = await Promise.all(
+            [leader, follower].map((coordinator) =>
+              coordinator
+                .requestEnsureRemoteSubset(
+                  `todos`,
+                  createOptions() as unknown as LoadSubsetOptions,
+                )
+                .then(
+                  () => ({ ok: true as const }),
+                  (error: unknown) => ({ ok: false as const, error }),
+                ),
+            ),
+          )
+          for (const outcome of outcomes) {
+            expect(outcome).toMatchObject({
+              ok: false,
+              error: { name: `RemoteSubsetWireValueError`, path },
+            })
+          }
+          expect({
+            subsetPosts,
+            ownerCalls: owner.mock.calls.length,
+          }).toEqual({ subsetPosts: 0, ownerCalls: 0 })
+        } finally {
+          observeBroadcastMessage = undefined
+          unregisterOwner()
+          leader.dispose()
+          follower.dispose()
+        }
+      },
+    )
+
+    it(`preserves local lifecycle fields while transporting only wire values`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      const received: Array<TransportedLoadSubsetOptions> = []
+      const unloadSubset = vi.fn((_options: TransportedLoadSubsetOptions) => {})
+      const owner = Object.assign(
+        vi.fn((options: TransportedLoadSubsetOptions) => {
+          received.push(options)
+          return Promise.resolve()
+        }),
+        { unloadSubset, onError: vi.fn() },
+      ) satisfies RemoteSubsetOwner
+      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      const shared = { label: `shared` }
+      const cycle: Record<string, unknown> = { label: `cycle` }
+      cycle.self = cycle
+      const buffer = new ArrayBuffer(8)
+      const view = new DataView(buffer, 2, 4)
+      const typed = new Uint16Array(buffer, 0, 2)
+      typed.set([17, 42])
+      const typedArrays = [
+        new Int8Array([-1, 2]),
+        new Uint8Array([0, 255]),
+        new Uint8ClampedArray([0, 255]),
+        new Int16Array([-2, 3]),
+        new Uint16Array([2, 65_535]),
+        new Int32Array([-3, 4]),
+        new Uint32Array([3, 4_000_000_000]),
+        new Float32Array([-0, Number.NaN, Number.POSITIVE_INFINITY]),
+        new Float64Array([Number.NEGATIVE_INFINITY, Math.PI]),
+        new BigInt64Array([-4n, 5n]),
+        new BigUint64Array([4n, 5n]),
+      ]
+      const sparse = new Array<unknown>(3)
+      sparse[1] = undefined
+      const reservedKeys = { constructor: `own constructor value` }
+      Object.defineProperty(reservedKeys, `__proto__`, {
+        value: { label: `own __proto__ value` },
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      })
+      const richValue = {
+        undefinedValue: undefined,
+        nullValue: null,
+        booleanValue: true,
+        stringValue: `wire`,
+        bigintValue: 9_007_199_254_740_993n,
+        nanValue: Number.NaN,
+        positiveInfinity: Number.POSITIVE_INFINITY,
+        negativeInfinity: Number.NEGATIVE_INFINITY,
+        negativeZero: -0,
+        date: new Date(`2026-09-16T12:34:56.000Z`),
+        invalidDate: new Date(Number.NaN),
+        regexp: /wire/giu,
+        buffer,
+        view,
+        typed,
+        typedArrays,
+        map: new Map<unknown, unknown>([[shared, cycle]]),
+        set: new Set<unknown>([shared, cycle]),
+        sparse,
+        reservedKeys,
+        first: shared,
+        second: shared,
+        cycle,
+      }
+      const options = {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`todos`, `payload`]),
+          new IR.Value(richValue),
+        ]),
+        signal: new AbortController().signal,
+        subscription: {
+          on: () => () => {},
+        } as unknown as Subscription,
+      }
+
+      try {
+        // Validation cannot rewrite a request or erase the aliases/cycle that
+        // this receiving witness observes. Frozen records expose accidental writes.
+        for (const value of [
+          options,
+          options.where,
+          options.where.args,
+          richValue,
+          shared,
+          cycle,
+          sparse,
+          reservedKeys,
+          typedArrays,
+        ])
+          Object.freeze(value)
+        const beforeValidation = structuredClone(richValue)
+        expect(validateRemoteSubsetOptions(options)).toBeUndefined()
+        expect(richValue).toEqual(beforeValidation)
+        await leader.requestEnsureRemoteSubset(`todos`, options)
+        await follower.requestEnsureRemoteSubset(`todos`, options)
+        expect(received).toHaveLength(2)
+
+        for (const [routeIndex, decoded] of received.entries()) {
+          const value = (
+            decoded.where as unknown as {
+              args: Array<{ value?: typeof richValue }>
+            }
+          ).args[1]!.value!
+          expect(value).toEqual(beforeValidation)
+          for (const key of Object.keys(richValue) as Array<
+            keyof typeof richValue
+          >) {
+            if (typeof richValue[key] === `object` && richValue[key] !== null)
+              expect(value[key]).not.toBe(richValue[key])
+          }
+          expect(value.undefinedValue).toBeUndefined()
+          expect(value.nullValue).toBeNull()
+          expect(value.booleanValue).toBe(true)
+          expect(value.stringValue).toBe(`wire`)
+          expect(value.bigintValue).toBe(9_007_199_254_740_993n)
+          expect(Object.is(value.nanValue, Number.NaN)).toBe(true)
+          expect(
+            Object.is(value.positiveInfinity, Number.POSITIVE_INFINITY),
+          ).toBe(true)
+          expect(
+            Object.is(value.negativeInfinity, Number.NEGATIVE_INFINITY),
+          ).toBe(true)
+          expect(Object.is(value.negativeZero, -0)).toBe(true)
+          expect(value.date.getTime()).toBe(richValue.date.getTime())
+          expect(Number.isNaN(value.invalidDate.getTime())).toBe(true)
+          expect({
+            source: value.regexp.source,
+            flags: value.regexp.flags,
+            lastIndex: value.regexp.lastIndex,
+          }).toEqual({ source: `wire`, flags: `giu`, lastIndex: 0 })
+          expect(value.buffer).toBeInstanceOf(ArrayBuffer)
+          expect(value.view).toBeInstanceOf(DataView)
+          expect(value.typed).toBeInstanceOf(Uint16Array)
+          expect(Array.from(new Uint8Array(value.buffer))).toEqual(
+            Array.from(new Uint8Array(richValue.buffer)),
+          )
+          expect({
+            byteOffset: value.view.byteOffset,
+            byteLength: value.view.byteLength,
+          }).toEqual({ byteOffset: 2, byteLength: 4 })
+          expect(Array.from(value.typed)).toEqual([17, 42])
+          expect(value.view.buffer).toBe(value.buffer)
+          expect(value.typed.buffer).toBe(value.buffer)
+          expect(value.typedArrays).toHaveLength(typedArrays.length)
+          for (let index = 0; index < typedArrays.length; index++) {
+            const actual = value.typedArrays[index]!
+            const expected = typedArrays[index]!
+            expect(actual.constructor).toBe(expected.constructor)
+            expect(actual.byteOffset).toBe(expected.byteOffset)
+            expect(actual.byteLength).toBe(expected.byteLength)
+            expect(
+              Array.from(
+                new Uint8Array(
+                  actual.buffer,
+                  actual.byteOffset,
+                  actual.byteLength,
+                ),
+              ),
+            ).toEqual(
+              Array.from(
+                new Uint8Array(
+                  expected.buffer,
+                  expected.byteOffset,
+                  expected.byteLength,
+                ),
+              ),
+            )
+          }
+          expect(value.map).toBeInstanceOf(Map)
+          expect(value.set).toBeInstanceOf(Set)
+          expect(value.first).toBe(value.second)
+          expect([...value.map.keys()]).toEqual([value.first])
+          expect(value.map.get(value.first)).toBe(value.cycle)
+          expect(value.set.has(value.first)).toBe(true)
+          expect(value.set.has(value.cycle)).toBe(true)
+          expect(value.cycle.self).toBe(value.cycle)
+          expect(0 in value.sparse).toBe(false)
+          expect(1 in value.sparse).toBe(true)
+          expect(2 in value.sparse).toBe(false)
+          expect(Object.getPrototypeOf(value.reservedKeys)).toBe(
+            Object.prototype,
+          )
+          expect(
+            Object.getOwnPropertyDescriptor(value.reservedKeys, `__proto__`),
+          ).toMatchObject({
+            value: { label: `own __proto__ value` },
+            enumerable: true,
+            writable: true,
+            configurable: true,
+          })
+          expect(value.reservedKeys.constructor).toBe(`own constructor value`)
+          if (routeIndex === 0) {
+            const local = decoded as TransportedLoadSubsetOptions &
+              Pick<LoadSubsetOptions, `signal` | `subscription`>
+            expect(local.signal).toBe(options.signal)
+            expect(local.subscription).toBe(options.subscription)
+          } else {
+            expect(decoded).not.toHaveProperty(`signal`)
+            expect(decoded).not.toHaveProperty(`subscription`)
+          }
+        }
+        // Both routes validate immutable request data. Only process-local
+        // delivery retains live lifecycle references.
+        expect(received[1]).not.toBe(options)
+
+        await leader.requestReleaseRemoteSubset(`todos`, options)
+        await follower.requestReleaseRemoteSubset(`todos`, options)
+        expect(unloadSubset.mock.calls).toHaveLength(received.length)
+        for (const [index, [value]] of unloadSubset.mock.calls.entries())
+          expect(value).toBe(received[index])
+      } finally {
+        unregisterOwner()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`direct leader requests await the registered collection owner`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+
+      let releaseOwner = (): void => {}
+      const owner = withUnusedUnloadSubset(
+        vi.fn(
+          () =>
+            new Promise<void>((resolve) => {
+              releaseOwner = resolve
+            }),
+        ),
+      )
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+
+      try {
+        let settled = false
+        const request = coordinator
+          .requestEnsureRemoteSubset(`todos`, { limit: 2, offset: 1 })
+          .then(() => {
+            settled = true
+          })
+        await Promise.resolve()
+        const beforeRelease = { ownerCalls: owner.mock.calls.length, settled }
+
+        releaseOwner()
+        await request
+
+        expect(beforeRelease).toEqual({ ownerCalls: 1, settled: false })
+        expect(owner).toHaveBeenCalledWith({ limit: 2, offset: 1 })
+      } finally {
+        releaseOwner()
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`preserves the receiver of an explicitly registered adapter owner`, async () => {
+      const receivers: Array<unknown> = []
+      const leaderAdapter = createStubAdapter() as ReturnType<
+        typeof createStubAdapter
+      > & {
+        ensureRemoteSubset: (
+          collectionId: string,
+          options: { limit?: number },
+        ) => Promise<void>
+      }
+      leaderAdapter.ensureRemoteSubset = function (
+        this: typeof leaderAdapter,
+        _collectionId,
+        _options,
+      ) {
+        receivers.push(this)
+        return Promise.resolve()
+      }
+      const leader = createCoordinator(leaderAdapter)
+      const follower = createCoordinator()
+      const owner = withUnusedUnloadSubset(
+        vi.fn((options: TransportedLoadSubsetOptions) =>
+          leaderAdapter.ensureRemoteSubset(`todos`, options),
+        ),
+      )
+      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      try {
+        await follower.requestEnsureRemoteSubset(`todos`, { limit: 1 })
+        expect(receivers).toEqual([leaderAdapter])
+      } finally {
+        unregisterOwner()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`scopes a reused subset options object to each Browser collection`, async () => {
+      const coordinator = createCoordinator()
+      const alpha = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const beta = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const unregisterAlpha = coordinator.registerRemoteSubsetOwner(
+        `alpha`,
+        alpha,
+      )
+      const unregisterBeta = coordinator.registerRemoteSubsetOwner(`beta`, beta)
+      coordinator.subscribe(`alpha`, () => {})
+      coordinator.subscribe(`beta`, () => {})
+      await flush(50)
+      expect({
+        alpha: coordinator.isLeader(`alpha`),
+        beta: coordinator.isLeader(`beta`),
+      }).toEqual({ alpha: true, beta: true })
+
+      const shared: LoadSubsetOptions = { limit: 2, offset: 1 }
+      try {
+        await coordinator.requestEnsureRemoteSubset(`alpha`, shared)
+        await coordinator.requestEnsureRemoteSubset(`beta`, shared)
+        await coordinator.requestEnsureRemoteSubset(`alpha`, shared)
+
+        const afterAcquire = {
+          alphaLoads: alpha.mock.calls.length,
+          betaLoads: beta.mock.calls.length,
+        }
+        await coordinator.requestReleaseRemoteSubset(`alpha`, shared)
+        await coordinator.requestReleaseRemoteSubset(`beta`, shared)
+
+        expect({
+          afterAcquire,
+          alphaUnloads: alpha.unloadSubset.mock.calls.length,
+          betaUnloads: beta.unloadSubset.mock.calls.length,
+        }).toEqual({
+          afterAcquire: { alphaLoads: 1, betaLoads: 1 },
+          alphaUnloads: 1,
+          betaUnloads: 1,
+        })
+      } finally {
+        unregisterAlpha()
+        unregisterBeta()
+        coordinator.dispose()
+      }
+    })
+
+    it(`replays after an earlier Browser leader responds behind a new heartbeat`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      let releaseOwner = (): void => {}
+      const owner = withUnusedUnloadSubset(
+        vi.fn(
+          () =>
+            new Promise<void>((resolve) => {
+              releaseOwner = resolve
+            }),
+        ),
+      )
+      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+      expect({
+        leader: leader.isLeader(`todos`),
+        follower: follower.isLeader(`todos`),
+      }).toEqual({ leader: true, follower: false })
+
+      const leaderInternals = leader as unknown as {
+        nodeId: string
+        channel: { postMessage: (message: unknown) => void }
+      }
+      const followerInternals = follower as unknown as {
+        onChannelMessage: (message: unknown) => void
+        outboundRemoteSubsetAcquisitions: Map<
+          string,
+          { acquiredLeaderId: string | null }
+        >
+      }
+      const originalLeaderPost = leaderInternals.channel.postMessage.bind(
+        leaderInternals.channel,
+      )
+      let heldResponse: unknown
+      leaderInternals.channel.postMessage = (message) => {
+        const type = (message as { payload?: { type?: string } }).payload?.type
+        if (type === `rpc:ensureRemoteSubset:res`) {
+          heldResponse = structuredClone(message)
+          return
+        }
+        originalLeaderPost(message)
+      }
+      let requestPosts = 0
+      observeBroadcastMessage = (message) => {
+        if (
+          (message as { payload?: { type?: string } }).payload?.type ===
+          `rpc:ensureRemoteSubset:req`
+        ) {
+          requestPosts++
+        }
+      }
+
+      try {
+        const request = follower.requestEnsureRemoteSubset(`todos`, {
+          limit: 1,
+        })
+        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
+
+        followerInternals.onChannelMessage({
+          v: 1,
+          dbName: `test-db`,
+          collectionId: `todos`,
+          senderId: `replacement-browser-leader`,
+          ts: Date.now(),
+          payload: {
+            type: `leader:heartbeat`,
+            term: 2,
+            leaderId: `replacement-browser-leader`,
+            latestSeq: 0,
+            latestRowVersion: 0,
+          },
+        })
+        releaseOwner()
+        await vi.waitFor(() => expect(heldResponse).toBeDefined())
+        leader.isLeader = () => false
+        followerInternals.onChannelMessage(heldResponse)
+        await request
+        await flush()
+
+        const [acquisition] =
+          followerInternals.outboundRemoteSubsetAcquisitions.values()
+        expect({
+          requestPosts,
+          acquiredLeaderId: acquisition?.acquiredLeaderId,
+        }).toEqual({
+          requestPosts: 2,
+          acquiredLeaderId: leaderInternals.nodeId,
+        })
+      } finally {
+        observeBroadcastMessage = undefined
+        releaseOwner()
+        unregisterOwner()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`establishes replacement Browser acquisitions for retained demand after an A to B to A leader cycle`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      let releaseFirstLoad = (): void => {}
+      const firstLoadGate = new Promise<void>((resolve) => {
+        releaseFirstLoad = resolve
+      })
+      const owner = Object.assign(
+        vi.fn().mockImplementationOnce(() => firstLoadGate),
+        { unloadSubset: vi.fn(), onError: vi.fn() },
+      )
+      const unregisterOwner = leader.registerRemoteSubsetOwner(`todos`, owner)
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+      const leaderInternals = leader as unknown as {
+        nodeId: string
+        channel: { postMessage: (message: unknown) => void }
+        inboundRemoteSubsetAcquisitions: Map<string, unknown>
+        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
+      }
+      const followerInternals = follower as unknown as {
+        onChannelMessage: (message: unknown) => void
+        outboundRemoteSubsetAcquisitions: Map<
+          string,
+          { acquiredLeaderId: string | null }
+        >
+      }
+      const originalLeaderPost = leaderInternals.channel.postMessage.bind(
+        leaderInternals.channel,
+      )
+      let heldResponse: unknown
+      leaderInternals.channel.postMessage = (message) => {
+        const type = (message as { payload?: { type?: string } }).payload?.type
+        if (
+          type === `rpc:ensureRemoteSubset:res` &&
+          heldResponse === undefined
+        ) {
+          heldResponse = structuredClone(message)
+          return
+        }
+        originalLeaderPost(message)
+      }
+      let requestPosts = 0
+      const wireRequests: Array<{
+        acquisitionId: string
+        rpcId: string
+      }> = []
+      observeBroadcastMessage = (message) => {
+        const payload = (
+          message as {
+            payload?: {
+              type?: string
+              acquisitionId?: string
+              rpcId?: string
+            }
+          }
+        ).payload
+        if (payload?.type === `rpc:ensureRemoteSubset:req`) {
+          requestPosts++
+          wireRequests.push({
+            acquisitionId: payload.acquisitionId!,
+            rpcId: payload.rpcId!,
+          })
+        }
+      }
+      const heartbeat = (leaderId: string, term: number) => ({
+        v: 1,
+        dbName: `test-db`,
+        collectionId: `todos`,
+        senderId: leaderId,
+        ts: Date.now(),
+        payload: {
+          type: `leader:heartbeat`,
+          term,
+          leaderId,
+          latestSeq: 0,
+          latestRowVersion: 0,
+        },
+      })
+      const options: LoadSubsetOptions = { limit: 1 }
+
+      try {
+        const request = follower.requestEnsureRemoteSubset(`todos`, options)
+        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(1))
+        followerInternals.onChannelMessage(
+          heartbeat(`replacement-browser-leader`, 2),
+        )
+        leaderInternals.releaseInboundRemoteSubsetAcquisitions(`todos`)
+        followerInternals.onChannelMessage(heartbeat(leaderInternals.nodeId, 3))
+        releaseFirstLoad()
+        await vi.waitFor(() => expect(heldResponse).toBeDefined())
+        followerInternals.onChannelMessage(heldResponse)
+        await request
+        await vi.waitFor(() => expect(owner).toHaveBeenCalledTimes(2))
+
+        const [acquisition] =
+          followerInternals.outboundRemoteSubsetAcquisitions.values()
+        expect({
+          requestPosts,
+          loads: owner.mock.calls.length,
+          unloads: owner.unloadSubset.mock.calls.length,
+          inbound: leaderInternals.inboundRemoteSubsetAcquisitions.size,
+          acquiredLeaderId: acquisition?.acquiredLeaderId,
+        }).toEqual({
+          requestPosts: 2,
+          loads: 2,
+          unloads: 1,
+          inbound: 1,
+          acquiredLeaderId: leaderInternals.nodeId,
+        })
+        expect(wireRequests).toHaveLength(2)
+        expect(wireRequests[0]!.acquisitionId).not.toBe(``)
+        expect(wireRequests[1]!.acquisitionId).toBe(
+          wireRequests[0]!.acquisitionId,
+        )
+        expect(wireRequests[1]!.rpcId).not.toBe(wireRequests[0]!.rpcId)
+
+        await follower.requestReleaseRemoteSubset(`todos`, options)
+        expect(owner.unloadSubset).toHaveBeenCalledTimes(2)
+      } finally {
+        observeBroadcastMessage = undefined
+        releaseFirstLoad()
+        unregisterOwner()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`contains a failed Browser replay without fail-stopping the owner`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      const replayError = new Error(`replacement owner is not ready`)
+      const ownerErrors: Array<unknown> = []
+      const owner = Object.assign(
+        vi
+          .fn()
+          .mockResolvedValueOnce(undefined)
+          .mockRejectedValueOnce(replayError),
+        {
+          unloadSubset: vi.fn(),
+          onError: (error: unknown) => ownerErrors.push(error),
+        },
+      )
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      const options: LoadSubsetOptions = { limit: 1 }
+      await coordinator.requestEnsureRemoteSubset(`todos`, options)
+      type Acquisition = {
+        acquiredLeaderId: string | null
+        inFlight: Promise<void> | null
+      }
+      const internals = coordinator as unknown as {
+        outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
+        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
+        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
+      }
+      const [acquisition] = internals.outboundRemoteSubsetAcquisitions.values()
+      internals.releaseInboundRemoteSubsetAcquisitions(`todos`)
+      await vi.waitFor(() =>
+        expect(owner.unloadSubset).toHaveBeenCalledTimes(1),
+      )
+      acquisition!.acquiredLeaderId = `retired-browser-leader`
+      const unhandled: Array<unknown> = []
+      const onUnhandled = (error: unknown) => unhandled.push(error)
+      process.on(`unhandledRejection`, onUnhandled)
+
+      try {
+        await internals.replayRemoteSubsetAcquisitions(`todos`)
+        await flush()
+        expect({
+          attempts: owner.mock.calls.length - 1,
+          ownerErrors,
+          acquiredLeaderId: acquisition!.acquiredLeaderId,
+          inFlight: acquisition!.inFlight,
+          unhandled,
+        }).toEqual({
+          attempts: 1,
+          ownerErrors: [],
+          acquiredLeaderId: `retired-browser-leader`,
+          inFlight: null,
+          unhandled: [],
+        })
+      } finally {
+        process.off(`unhandledRejection`, onUnhandled)
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`keeps a failed remote Browser follower replay out of its local owner lifecycle`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      const internals = coordinator as unknown as {
+        onChannelMessage: (message: unknown) => void
+        sendRPC: (collectionId: string, request: unknown) => Promise<unknown>
+        outboundRemoteSubsetAcquisitions: Map<
+          string,
+          { acquiredLeaderId: string | null; inFlight: Promise<void> | null }
+        >
+      }
+      coordinator.isLeader = () => false
+      const heartbeat = (leaderId: string, term: number) =>
+        internals.onChannelMessage({
+          v: 1,
+          dbName: `test-db`,
+          collectionId: `todos`,
+          senderId: leaderId,
+          ts: Date.now(),
+          payload: {
+            type: `leader:heartbeat`,
+            term,
+            leaderId,
+            latestSeq: 0,
+            latestRowVersion: 0,
+          },
+        })
+      heartbeat(`remote-browser-a`, 1)
+      const ownerErrors: Array<unknown> = []
+      const owner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: (error: unknown) => ownerErrors.push(error),
+      })
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      internals.sendRPC = vi.fn().mockResolvedValue({
+        type: `rpc:ensureRemoteSubset:res`,
+        rpcId: `initial-browser`,
+        ok: true,
+        leaderId: `remote-browser-a`,
+      })
+      const options: LoadSubsetOptions = { limit: 1 }
+
+      try {
+        await coordinator.requestEnsureRemoteSubset(`todos`, options)
+        const replayError = new Error(`remote Browser replay transport failed`)
+        const replayRPC = vi.fn().mockRejectedValue(replayError)
+        internals.sendRPC = replayRPC
+        heartbeat(`remote-browser-b`, 2)
+        await vi.waitFor(() => expect(replayRPC).toHaveBeenCalledTimes(1))
+        await vi.waitFor(() => {
+          const [acquisition] =
+            internals.outboundRemoteSubsetAcquisitions.values()
+          expect(acquisition?.inFlight).toBeNull()
+        })
+
+        const [acquisition] =
+          internals.outboundRemoteSubsetAcquisitions.values()
+        expect({
+          ownerErrors,
+          attempts: replayRPC.mock.calls.length,
+          acquiredLeaderId: acquisition?.acquiredLeaderId,
+          retained: internals.outboundRemoteSubsetAcquisitions.size,
+        }).toEqual({
+          ownerErrors: [],
+          attempts: 1,
+          acquiredLeaderId: `remote-browser-a`,
+          retained: 1,
+        })
+      } finally {
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`expires Browser release tombstones after the existing RPC dedupe horizon`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+      const owner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      const now = vi.spyOn(Date, `now`)
+      const internals = coordinator as unknown as {
+        inboundRemoteSubsetAcquisitions: Map<string, unknown>
+      }
+
+      try {
+        for (let index = 0; index < 8; index++) {
+          now.mockReturnValue(index * 60_001)
+          const options = { offset: index }
+          await coordinator.requestEnsureRemoteSubset(`todos`, options)
+          await coordinator.requestReleaseRemoteSubset(`todos`, options)
+        }
+
+        expect({
+          loads: owner.mock.calls.length,
+          unloads: owner.unloadSubset.mock.calls.length,
+          retained: internals.inboundRemoteSubsetAcquisitions.size,
+        }).toEqual({ loads: 8, unloads: 8, retained: 1 })
+      } finally {
+        now.mockRestore()
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`ignores a lower-term Browser heartbeat without replaying to its stale leader`, async () => {
+      // Another holder keeps the leader lock, so this coordinator follows.
+      let releaseHolder!: () => void
+      await new Promise<void>((acquired) => {
+        void navigator.locks.request(`tsdb:leader:test-db:todos`, () => {
+          acquired()
+          return new Promise<void>((resolve) => {
+            releaseHolder = resolve
+          })
+        })
+      })
+      const coordinator = createCoordinator()
+      let forwardedHeartbeats = 0
+      coordinator.subscribe(`todos`, (message) => {
+        if (
+          (message.payload as { type?: unknown }).type === `leader:heartbeat`
+        ) {
+          forwardedHeartbeats++
+        }
+      })
+      const internals = coordinator as unknown as {
+        onChannelMessage: (message: unknown) => void
+        collections: Map<
+          string,
+          { leaderId: string | null; latestTerm: number }
+        >
+        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
+      }
+      const replay = vi.fn(() => Promise.resolve())
+      internals.replayRemoteSubsetAcquisitions = replay
+      const heartbeat = (leaderId: string, term: number) =>
+        internals.onChannelMessage({
+          v: 1,
+          dbName: `test-db`,
+          collectionId: `todos`,
+          senderId: leaderId,
+          ts: Date.now(),
+          payload: {
+            type: `leader:heartbeat`,
+            term,
+            leaderId,
+            latestSeq: 0,
+            latestRowVersion: 0,
+          },
+        })
+
+      try {
+        heartbeat(`remote-browser-b`, 2)
+        replay.mockClear()
+        heartbeat(`retired-browser-a`, 1)
+        const state = internals.collections.get(`todos`)
+
+        expect({
+          leaderId: state?.leaderId,
+          latestTerm: state?.latestTerm,
+          replayCalls: replay.mock.calls.length,
+          forwardedHeartbeats,
+        }).toEqual({
+          leaderId: `remote-browser-b`,
+          latestTerm: 2,
+          replayCalls: 0,
+          forwardedHeartbeats: 1,
+        })
+      } finally {
+        coordinator.dispose()
+        releaseHolder()
+      }
+    })
+
+    it(`establishes a replacement Browser acquisition for retained demand when its owner changes`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+      let releaseFirstLoad = (): void => {}
+      const firstLoadGate = new Promise<void>((resolve) => {
+        releaseFirstLoad = resolve
+      })
+      const firstOwner = Object.assign(
+        vi.fn(() => firstLoadGate),
+        {
+          unloadSubset: vi.fn(),
+          onError: vi.fn(),
+        },
+      )
+      const secondOwner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(
+          (_options: TransportedLoadSubsetOptions) => undefined,
+        ),
+        onError: vi.fn(),
+      })
+      const unregisterFirst = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        firstOwner,
+      )
+      let unregisterSecond: (() => void) | undefined
+      const options: LoadSubsetOptions = { limit: 1 }
+
+      try {
+        const initialAcquire = coordinator.requestEnsureRemoteSubset(
+          `todos`,
+          options,
+        )
+        await vi.waitFor(() => expect(firstOwner).toHaveBeenCalledTimes(1))
+        unregisterFirst()
+        unregisterSecond = coordinator.registerRemoteSubsetOwner(
+          `todos`,
+          secondOwner,
+        )
+        releaseFirstLoad()
+        await initialAcquire
+        await vi.waitFor(() => expect(secondOwner).toHaveBeenCalledTimes(1))
+
+        expect(firstOwner.unloadSubset).toHaveBeenCalledTimes(1)
+        await coordinator.requestReleaseRemoteSubset(`todos`, options)
+        expect(secondOwner.unloadSubset).toHaveBeenCalledTimes(1)
+      } finally {
+        releaseFirstLoad()
+        unregisterFirst()
+        unregisterSecond?.()
+        coordinator.dispose()
+      }
+    })
+
+    it(`establishes a replacement remote Browser acquisition for retained follower demand when the same leader changes owners`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+      expect({
+        leader: leader.isLeader(`todos`),
+        follower: follower.isLeader(`todos`),
+      }).toEqual({ leader: true, follower: false })
+      let releaseFirstLoad = (): void => {}
+      const firstLoadGate = new Promise<void>((resolve) => {
+        releaseFirstLoad = resolve
+      })
+      const firstOwner = Object.assign(
+        vi.fn(() => firstLoadGate),
+        {
+          unloadSubset: vi.fn(),
+          onError: vi.fn(),
+        },
+      )
+      const secondOwner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const unregisterFirst = leader.registerRemoteSubsetOwner(
+        `todos`,
+        firstOwner,
+      )
+      let unregisterSecond: (() => void) | undefined
+      const options: LoadSubsetOptions = { limit: 1 }
+      let requestPosts = 0
+      observeBroadcastMessage = (message) => {
+        if (
+          (message as { payload?: { type?: string } }).payload?.type ===
+          `rpc:ensureRemoteSubset:req`
+        ) {
+          requestPosts++
+        }
+      }
+
+      try {
+        const initialAcquire = follower.requestEnsureRemoteSubset(
+          `todos`,
+          options,
+        )
+        await vi.waitFor(() => expect(firstOwner).toHaveBeenCalledTimes(1))
+        unregisterFirst()
+        unregisterSecond = leader.registerRemoteSubsetOwner(
+          `todos`,
+          secondOwner,
+        )
+        releaseFirstLoad()
+        await initialAcquire
+        await vi.waitFor(() => expect(secondOwner).toHaveBeenCalledTimes(1))
+
+        expect({
+          requestPosts,
+          firstUnloads: firstOwner.unloadSubset.mock.calls.length,
+        }).toEqual({ requestPosts: 1, firstUnloads: 1 })
+        await follower.requestReleaseRemoteSubset(`todos`, options)
+        expect(secondOwner.unloadSubset).toHaveBeenCalledTimes(1)
+      } finally {
+        observeBroadcastMessage = undefined
+        releaseFirstLoad()
+        unregisterFirst()
+        unregisterSecond?.()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`rebinds remote Browser demand when its replacement owner registers after release settlement`, async () => {
+      const leader = createCoordinator()
+      const follower = createCoordinator()
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+      expect({
+        leader: leader.isLeader(`todos`),
+        follower: follower.isLeader(`todos`),
+      }).toEqual({ leader: true, follower: false })
+      const firstOwner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const secondOwner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const unregisterFirst = leader.registerRemoteSubsetOwner(
+        `todos`,
+        firstOwner,
+      )
+      let unregisterSecond: (() => void) | undefined
+      const options: LoadSubsetOptions = { offset: 22 }
+      const leaderInternals = leader as unknown as {
+        inboundRemoteSubsetAcquisitions: Map<string, Record<string, unknown>>
+      }
+
+      try {
+        await follower.requestEnsureRemoteSubset(`todos`, options)
+        unregisterFirst()
+        await vi.waitFor(() =>
+          expect(firstOwner.unloadSubset).toHaveBeenCalledTimes(1),
+        )
+        await flush(0)
+
+        unregisterSecond = leader.registerRemoteSubsetOwner(
+          `todos`,
+          secondOwner,
+        )
+        await flush(0)
+
+        expect({
+          firstLoads: firstOwner.mock.calls.length,
+          firstUnloads: firstOwner.unloadSubset.mock.calls.length,
+          secondLoads: secondOwner.mock.calls.length,
+          inbound: leaderInternals.inboundRemoteSubsetAcquisitions.size,
+        }).toEqual({
+          firstLoads: 1,
+          firstUnloads: 1,
+          secondLoads: 1,
+          inbound: 1,
+        })
+
+        await follower.requestReleaseRemoteSubset(`todos`, options)
+        const [terminal] =
+          leaderInternals.inboundRemoteSubsetAcquisitions.values()
+        expect(secondOwner.unloadSubset).toHaveBeenCalledTimes(1)
+        expect(secondOwner.unloadSubset.mock.calls[0]?.[0]).toBe(
+          secondOwner.mock.calls[0]?.[0],
+        )
+        expect({
+          inbound: leaderInternals.inboundRemoteSubsetAcquisitions.size,
+          terminalKeys: Object.keys(terminal ?? {}).sort(),
+        }).toEqual({
+          inbound: 1,
+          terminalKeys: [
+            `acquisitionId`,
+            `collectionId`,
+            `released`,
+            `requesterId`,
+          ],
+        })
+      } finally {
+        unregisterFirst()
+        unregisterSecond?.()
+        leader.dispose()
+        follower.dispose()
+      }
+    })
+
+    it(`establishes a replacement Browser acquisition for retained demand after leadership retirement`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+      const owner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      const internals = coordinator as unknown as {
+        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
+      }
+      const options: LoadSubsetOptions = { limit: 1 }
+
+      try {
+        await coordinator.requestEnsureRemoteSubset(`todos`, options)
+        internals.releaseInboundRemoteSubsetAcquisitions(`todos`)
+        await vi.waitFor(() =>
+          expect(owner.unloadSubset).toHaveBeenCalledTimes(1),
+        )
+
+        await coordinator.requestEnsureRemoteSubset(`todos`, options)
+        expect(owner).toHaveBeenCalledTimes(2)
+        await coordinator.requestReleaseRemoteSubset(`todos`, options)
+        expect(owner.unloadSubset).toHaveBeenCalledTimes(2)
+      } finally {
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`retries retained Browser demand after a retryable replay failure`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+
+      type Acquisition = {
+        collectionId: string
+        acquisitionId: string
+        options: TransportedLoadSubsetOptions
+        acquiredLeaderId: string | null
+        inFlight: Promise<void> | null
+        forceReplay: boolean
+        retryTimer: ReturnType<typeof setTimeout> | null
+        retryAttempts: number
+      }
+      const acquisition: Acquisition = {
+        collectionId: `todos`,
+        acquisitionId: `retryable-browser-replay`,
+        options: { limit: 1 },
+        acquiredLeaderId: `retired-browser-leader`,
+        inFlight: null,
+        forceReplay: false,
+        retryTimer: null,
+        retryAttempts: 0,
+      }
+      const internals = coordinator as unknown as {
+        nodeId: string
+        outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
+        acquireRemoteSubset: (acquisition: Acquisition) => Promise<void>
+        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
+      }
+      internals.outboundRemoteSubsetAcquisitions.set(
+        JSON.stringify([acquisition.collectionId, acquisition.acquisitionId]),
+        acquisition,
+      )
+      let attempts = 0
+      internals.acquireRemoteSubset = vi.fn((current) => {
+        attempts++
+        if (attempts === 1) {
+          return Promise.reject(
+            new RetryableRemoteSubsetAcquisitionError(`offline`),
+          )
+        }
+        current.acquiredLeaderId = internals.nodeId
+        return Promise.resolve()
+      })
+
+      await internals.replayRemoteSubsetAcquisitions(`todos`)
+      expect(attempts).toBe(1)
+      await vi.waitFor(() => expect(attempts).toBe(2))
+    })
+
+    it.each([`release`, `dispose`] as const)(
+      `cancels a scheduled Browser replay retry on %s`,
+      async (stop) => {
+        const coordinator = createCoordinator()
+        coordinator.subscribe(`todos`, () => {})
+        await flush(50)
+
+        type Acquisition = {
+          collectionId: string
+          acquisitionId: string
+          options: TransportedLoadSubsetOptions
+          acquiredLeaderId: string | null
+          inFlight: Promise<void> | null
+          forceReplay: boolean
+          retryTimer: ReturnType<typeof setTimeout> | null
+          retryAttempts: number
+        }
+        const requestedOptions: LoadSubsetOptions = { limit: 1 }
+        const acquisition: Acquisition = {
+          collectionId: `todos`,
+          acquisitionId: `cancelled-browser-replay`,
+          options: { limit: 1 },
+          acquiredLeaderId: `retired-browser-leader`,
+          inFlight: null,
+          forceReplay: false,
+          retryTimer: null,
+          retryAttempts: 0,
+        }
+        const internals = coordinator as unknown as {
+          remoteSubsetIds: Map<string, WeakMap<LoadSubsetOptions, string>>
+          outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
+          acquireRemoteSubset: (acquisition: Acquisition) => Promise<void>
+          replayRemoteSubsetAcquisitions: (
+            collectionId: string,
+          ) => Promise<void>
+        }
+        internals.remoteSubsetIds.set(
+          `todos`,
+          new WeakMap([[requestedOptions, acquisition.acquisitionId]]),
+        )
+        internals.outboundRemoteSubsetAcquisitions.set(
+          JSON.stringify([acquisition.collectionId, acquisition.acquisitionId]),
+          acquisition,
+        )
+        let attempts = 0
+        internals.acquireRemoteSubset = vi.fn(() => {
+          attempts++
+          return Promise.reject(
+            new RetryableRemoteSubsetAcquisitionError(`offline`),
+          )
+        })
+
+        await internals.replayRemoteSubsetAcquisitions(`todos`)
+        expect(acquisition.retryTimer).not.toBeNull()
+        if (stop === `release`) {
+          await coordinator.requestReleaseRemoteSubset(
+            `todos`,
+            requestedOptions,
+          )
+        } else {
+          coordinator.dispose()
+        }
+        expect(acquisition.retryTimer).toBeNull()
+        await new Promise<void>((resolve) => setTimeout(resolve, 250))
+        expect(attempts).toBe(1)
+      },
+    )
+
+    it(`starts replacement Browser acquisitions without sibling head-of-line blocking`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      const owner = Object.assign(vi.fn(), {
+        unloadSubset: vi.fn(),
+        onError: vi.fn(),
+      })
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 1 })
+      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 2 })
+
+      type Acquisition = {
+        collectionId: string
+        options: TransportedLoadSubsetOptions
+        acquiredLeaderId: string | null
+      }
+      const internals = coordinator as unknown as {
+        outboundRemoteSubsetAcquisitions: Map<string, Acquisition>
+        acquireRemoteSubset: (acquisition: Acquisition) => Promise<void>
+        replayRemoteSubsetAcquisitions: (collectionId: string) => Promise<void>
+      }
+      const acquisitions = [
+        ...internals.outboundRemoteSubsetAcquisitions.values(),
+      ]
+      for (const acquisition of acquisitions) {
+        acquisition.acquiredLeaderId = `retired-browser-leader`
+      }
+      let releaseFirstReplay = (): void => {}
+      const firstReplayGate = new Promise<void>((resolve) => {
+        releaseFirstReplay = resolve
+      })
+      const starts: Array<number | undefined> = []
+      internals.acquireRemoteSubset = async (acquisition) => {
+        starts.push(acquisition.options.offset)
+        if (acquisition.options.offset === 1) await firstReplayGate
+      }
+
+      try {
+        const replay = internals.replayRemoteSubsetAcquisitions(`todos`)
+        await Promise.resolve()
+        const startsBeforeFirstFinished = [...starts]
+        expect(startsBeforeFirstFinished).toEqual([1, 2])
+        releaseFirstReplay()
+        await replay
+      } finally {
+        releaseFirstReplay()
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it(`reports owner unload rejection while completing sibling Browser cleanup`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      const unloadError = new Error(`browser owner unload failed`)
+      const ownerErrors: Array<unknown> = []
+      const unloadSubset = vi.fn((options: TransportedLoadSubsetOptions) =>
+        options.offset === 1 ? Promise.reject(unloadError) : undefined,
+      )
+      const owner = Object.assign(vi.fn(), {
+        unloadSubset,
+        onError: (error: unknown) => ownerErrors.push(error),
+      })
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 1 })
+      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 2 })
+      const unhandled: Array<unknown> = []
+      const onUnhandled = (error: unknown) => unhandled.push(error)
+      process.on(`unhandledRejection`, onUnhandled)
+      const internals = coordinator as unknown as {
+        inboundRemoteSubsetAcquisitions: Map<
+          string,
+          { release: Promise<void> | null }
+        >
+        releaseInboundRemoteSubsetAcquisitions: (collectionId: string) => void
+      }
+
+      try {
+        internals.releaseInboundRemoteSubsetAcquisitions(`todos`)
+        const releases = [
+          ...internals.inboundRemoteSubsetAcquisitions.values(),
+        ].map((acquisition) => acquisition.release!)
+        const outcomes = await Promise.allSettled(releases)
+        await new Promise<void>((resolve) => setTimeout(resolve, 0))
+
+        expect({
+          outcomes: outcomes.map((outcome) =>
+            outcome.status === `rejected` ? outcome.reason : outcome.status,
+          ),
+          unloadOffsets: unloadSubset.mock.calls.map(
+            ([options]) => options.offset,
+          ),
+          ownerErrors,
+          unhandled,
+        }).toEqual({
+          outcomes: [unloadError, `fulfilled`],
+          unloadOffsets: [1, 2],
+          ownerErrors: [unloadError],
+          unhandled: [],
+        })
+      } finally {
+        process.off(`unhandledRejection`, onUnhandled)
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+
+    it.each([
+      { failureMode: `synchronous throw` as const },
+      { failureMode: `asynchronous rejection` as const },
+    ])(
+      `retires a terminal owner release after reporting one $failureMode`,
+      async ({ failureMode }) => {
+        // Previous cleanup laws observed and reported unload rejection, but
+        // never repeated the same terminal caller release. The owner receives
+        // one release attempt; after it reports failure the logical demand is
+        // terminal and must not replay or accrue retry debt here.
+        const coordinator = createCoordinator()
+        coordinator.subscribe(`todos`, () => {})
+        await flush(50)
+        const unloadError = new Error(`transient Browser owner unload failure`)
+        const ownerErrors: Array<unknown> = []
+        let unloadAttempts = 0
+        const owner = Object.assign(vi.fn(), {
+          unloadSubset: vi.fn(() => {
+            unloadAttempts++
+            if (unloadAttempts !== 1) return undefined
+            if (failureMode === `synchronous throw`) throw unloadError
+            return Promise.reject(unloadError)
+          }),
+          onError: (error: unknown) => ownerErrors.push(error),
+        })
+        const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+          `todos`,
+          owner,
+        )
+        const options: LoadSubsetOptions = { offset: 41 }
+        const internals = coordinator as unknown as {
+          outboundRemoteSubsetAcquisitions: Map<string, unknown>
+          replayRemoteSubsetAcquisitions: (
+            collectionId: string,
+          ) => Promise<void>
+        }
+
+        try {
+          await coordinator.requestEnsureRemoteSubset(`todos`, options)
+          await expect(
+            coordinator.requestReleaseRemoteSubset(`todos`, options),
+          ).rejects.toBe(unloadError)
+
+          await expect(
+            coordinator.requestReleaseRemoteSubset(`todos`, options),
+          ).resolves.toBeUndefined()
+          await internals.replayRemoteSubsetAcquisitions(`todos`)
+          expect({ unloadAttempts, ownerErrors }).toEqual({
+            unloadAttempts: 1,
+            ownerErrors: [unloadError],
+          })
+          expect(internals.outboundRemoteSubsetAcquisitions.size).toBe(0)
+          expect(owner).toHaveBeenCalledTimes(1)
+        } finally {
+          unregisterOwner()
+          coordinator.dispose()
+        }
+      },
+    )
+
+    it(`reports local Browser disposal unload rejection once and completes cleanup`, async () => {
+      const coordinator = createCoordinator()
+      coordinator.subscribe(`todos`, () => {})
+      await flush(50)
+      expect(coordinator.isLeader(`todos`)).toBe(true)
+      const unloadError = new Error(`browser disposal unload failed`)
+      const ownerErrors: Array<unknown> = []
+      const unloadSubset = vi.fn((options: TransportedLoadSubsetOptions) =>
+        options.offset === 23 ? Promise.reject(unloadError) : undefined,
+      )
+      const owner = Object.assign(vi.fn(), {
+        unloadSubset,
+        onError: (error: unknown) => ownerErrors.push(error),
+      })
+      const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+        `todos`,
+        owner,
+      )
+      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 23 })
+      await coordinator.requestEnsureRemoteSubset(`todos`, { offset: 24 })
+      const unhandled: Array<unknown> = []
+      const onUnhandled = (error: unknown) => unhandled.push(error)
+      process.on(`unhandledRejection`, onUnhandled)
+      const internals = coordinator as unknown as {
+        collections: Map<string, unknown>
+        pendingRPCs: Map<string, unknown>
+        remoteSubsetOwners: Map<string, unknown>
+        outboundRemoteSubsetAcquisitions: Map<string, unknown>
+        inboundRemoteSubsetAcquisitions: Map<string, unknown>
+      }
+
+      try {
+        coordinator.dispose()
+        await flush(0)
+
+        expect({
+          unloadOffsets: unloadSubset.mock.calls.map(
+            ([options]) => options.offset,
+          ),
+          ownerErrors,
+          unhandled,
+          collections: internals.collections.size,
+          pendingRPCs: internals.pendingRPCs.size,
+          owners: internals.remoteSubsetOwners.size,
+          outbound: internals.outboundRemoteSubsetAcquisitions.size,
+          inbound: internals.inboundRemoteSubsetAcquisitions.size,
+          channelEndpoints: channels.get(`tsdb:coord:test-db`)?.size ?? 0,
+        }).toEqual({
+          unloadOffsets: [23, 24],
+          ownerErrors: [unloadError],
+          unhandled: [],
+          collections: 0,
+          pendingRPCs: 0,
+          owners: 0,
+          outbound: 0,
+          inbound: 0,
+          channelEndpoints: 0,
+        })
+      } finally {
+        process.off(`unhandledRejection`, onUnhandled)
+        unregisterOwner()
+        coordinator.dispose()
+      }
+    })
+  })
+
+  describe(`RPC - pullSince`, () => {
+    it(`leader handles pullSince directly`, async () => {
+      const adapter = createStubAdapter()
+      const coord = createCoordinator(adapter)
+      coord.subscribe(`todos`, () => {})
+      await flush(50)
+
+      const response = await coord.pullSince(`todos`, 0)
+
+      expect(response.ok).toBe(true)
+      if (response.ok) {
+        expect(response.requiresFullReload).toBe(false)
+      }
+
+      coord.dispose()
+    })
+
+    it(`follower routes pullSince to leader`, async () => {
+      const adapter = createStubAdapter()
+      adapter.pullSince = vi.fn().mockResolvedValue({
+        latestRowVersion: 5,
+        requiresFullReload: false,
+        changedKeys: [`key-1`],
+        deletedKeys: [],
+      })
+
+      const leader = createCoordinator(adapter)
+      const follower = createCoordinator(adapter)
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      const response = await follower.pullSince(`todos`, 0)
+
+      expect(response.ok).toBe(true)
+      if (response.ok && !response.requiresFullReload) {
+        expect(response.changedKeys).toEqual([`key-1`])
+        expect(response.latestRowVersion).toBe(5)
+      }
+
+      leader.dispose()
+      follower.dispose()
+    })
+  })
+
+  describe(`RPC - ensurePersistedIndex`, () => {
+    it(`leader ensures index locally`, async () => {
+      const adapter = createStubAdapter()
+      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+
+      const coord = createCoordinator(adapter)
+      coord.subscribe(`todos`, () => {})
+      await flush(50)
+
+      await coord.requestEnsurePersistedIndex(`todos`, `idx-1`, {
+        expressionSql: [`title`],
+      })
+
+      expect(adapter.ensureIndex).toHaveBeenCalledWith(
+        { kind: `eager`, collectionId: `todos` },
+        `idx-1`,
+        {
+          expressionSql: [`title`],
+        },
+      )
+
+      coord.dispose()
+    })
+
+    it(`follower routes ensurePersistedIndex to leader`, async () => {
+      const adapter = createStubAdapter()
+      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+
+      const leader = createCoordinator(adapter)
+      const follower = createCoordinator(adapter)
+
+      leader.subscribe(`todos`, () => {})
+      follower.subscribe(`todos`, () => {})
+      await flush(50)
+
+      await follower.requestEnsurePersistedIndex(`todos`, `idx-2`, {
+        expressionSql: [`id`],
+      })
+
+      expect(adapter.ensureIndex).toHaveBeenCalled()
+
+      leader.dispose()
+      follower.dispose()
+    })
+
+    it(`does not repeat successful leader-local index creation`, async () => {
+      const adapter = createStubAdapter()
+      let leadershipRead!: () => void
+      const leadershipReadPromise = new Promise<void>((resolve) => {
+        leadershipRead = resolve
+      })
+      adapter.getStreamPosition = async () => {
+        leadershipRead()
+        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+      }
+      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+
+      const coord = createCoordinator(adapter)
+      try {
+        coord.subscribe(`todos`, () => {})
+        await leadershipReadPromise
+        await vi.waitFor(() => expect(coord.isLeader(`todos`)).toBe(true))
+
+        const spec = { expressionSql: [`title`] }
+        await adapter.ensureIndex(
+          { kind: `eager`, collectionId: `todos` },
+          `idx-once`,
+          spec,
+        )
+        await coord.requestEnsurePersistedIndex(
+          `todos`,
+          `idx-once`,
+          spec,
+          adapter,
+          true,
+        )
+
+        expect(adapter.ensureIndex).toHaveBeenCalledOnce()
+      } finally {
+        coord.dispose()
+      }
+    })
+
+    it(`keeps production collection bootstrap index work exact-once on the leader`, async () => {
+      const adapter = createStubAdapter()
+      adapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+      const coordinator = createCoordinator(adapter)
+      const leaderReady = createDeferred()
+      observePostedMessage = (data) => {
+        const envelope = data as {
+          collectionId?: string
+          payload?: { type?: string }
+        }
+        if (
+          envelope.collectionId === `leader-bootstrap-index` &&
+          envelope.payload?.type === `leader:heartbeat`
+        ) {
+          leaderReady.resolve()
+        }
+      }
+      const releaseLeader = coordinator.subscribe(
+        `leader-bootstrap-index`,
+        () => {},
+      )
+      await leaderReady.promise
+      observePostedMessage = undefined
+
+      const collection = createCollection(
+        persistedCollectionOptions<{ id: string; title: string }, string>({
+          id: `leader-bootstrap-index`,
+          getKey: (row) => row.id,
+          defaultIndexType: BasicIndex,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      collection.createIndex((row) => row.title, { name: `title` })
+
+      try {
+        await collection.preload()
+        expect(adapter.ensureIndex).toHaveBeenCalledOnce()
+      } finally {
+        await collection.cleanup()
+        releaseLeader()
+        coordinator.dispose()
+      }
+    })
+
+    it(`reaches crossed production RPC leadership only after both hydration scopes exit`, async () => {
+      const bothLocalIndexesEntered = createDeferred()
+      const bothLeaderRPCsEntered = createDeferred()
+      const releaseSchedulerCycle = createDeferred()
+      let localIndexEntries = 0
+      let leaderRPCEntries = 0
+
+      const createTab = () => {
+        const adapter = createStubAdapter()
+        const baseEnsureIndex = adapter.ensureIndex.bind(adapter)
+        let hydrationScopeActive = false
+        const leaderRPCScopeObservations: Array<boolean> = []
+        const scopedAdapter: PersistenceAdapter = {
+          ...adapter,
+          ensureIndex: async (...args) => {
+            localIndexEntries++
+            if (localIndexEntries === 2) bothLocalIndexesEntered.resolve()
+            await bothLocalIndexesEntered.promise
+            await baseEnsureIndex(...args)
+          },
+        }
+        adapter.runInHydrationScope = async (task) => {
+          hydrationScopeActive = true
+          try {
+            return await task(scopedAdapter)
+          } finally {
+            hydrationScopeActive = false
+          }
+        }
+        adapter.ensureIndex = async (...args) => {
+          leaderRPCScopeObservations.push(hydrationScopeActive)
+          leaderRPCEntries++
+          if (leaderRPCEntries === 2) bothLeaderRPCsEntered.resolve()
+          if (hydrationScopeActive) await releaseSchedulerCycle.promise
+          await baseEnsureIndex(...args)
+        }
+        return { adapter, leaderRPCScopeObservations }
+      }
+
+      const tab1 = createTab()
+      const tab2 = createTab()
+      const coordinator1 = createCoordinator(tab1.adapter)
+      const coordinator2 = createCoordinator(tab2.adapter)
+      const leaderCollections = new Set<string>()
+      const bothLeadersReady = createDeferred()
+      observePostedMessage = (data) => {
+        const envelope = data as {
+          collectionId?: string
+          payload?: { type?: string }
+        }
+        if (
+          envelope.payload?.type === `leader:heartbeat` &&
+          (envelope.collectionId === `crossed-a` ||
+            envelope.collectionId === `crossed-b`)
+        ) {
+          leaderCollections.add(envelope.collectionId)
+          if (leaderCollections.size === 2) bothLeadersReady.resolve()
+        }
+      }
+      coordinator1.setAdapterForCollection(`crossed-b`, tab1.adapter)
+      coordinator2.setAdapterForCollection(`crossed-a`, tab2.adapter)
+      const releaseLeaderB = coordinator1.subscribe(`crossed-b`, () => {})
+      const releaseLeaderA = coordinator2.subscribe(`crossed-a`, () => {})
+      await bothLeadersReady.promise
+      observePostedMessage = undefined
+
+      const createFollowerCollection = (
+        id: string,
+        adapter: PersistenceAdapter,
+        coordinator: BrowserCollectionCoordinator,
+      ) => {
+        const collection = createCollection(
+          persistedCollectionOptions<{ id: string; title: string }, string>({
+            id,
+            getKey: (row) => row.id,
+            defaultIndexType: BasicIndex,
+            sync: {
+              sync: ({ markReady }) => {
+                markReady()
+              },
+            },
+            persistence: { adapter, coordinator },
+          }),
+        )
+        collection.createIndex((row) => row.title, { name: `${id}-title` })
+        return collection
+      }
+      const followerA = createFollowerCollection(
+        `crossed-a`,
+        tab1.adapter,
+        coordinator1,
+      )
+      const followerB = createFollowerCollection(
+        `crossed-b`,
+        tab2.adapter,
+        coordinator2,
+      )
+      const preloadA = Promise.resolve(followerA.preload())
+      const preloadB = Promise.resolve(followerB.preload())
+      void preloadA.catch(() => undefined)
+      void preloadB.catch(() => undefined)
+
+      try {
+        await bothLeaderRPCsEntered.promise
+        expect({
+          tab1: tab1.leaderRPCScopeObservations,
+          tab2: tab2.leaderRPCScopeObservations,
+        }).toEqual({ tab1: [false], tab2: [false] })
+        await Promise.all([preloadA, preloadB])
+      } finally {
+        releaseSchedulerCycle.resolve()
+        await Promise.all([preloadA, preloadB]).catch(() => undefined)
+        await Promise.all([followerA.cleanup(), followerB.cleanup()])
+        releaseLeaderA()
+        releaseLeaderB()
+        coordinator2.dispose()
+        coordinator1.dispose()
+      }
+    })
+
+    it(`uses a supplied leader-local adapter when local work is not complete`, async () => {
+      const registeredAdapter = createStubAdapter()
+      const scopedAdapter = createStubAdapter()
+      let leadershipRead!: () => void
+      const leadershipReadPromise = new Promise<void>((resolve) => {
+        leadershipRead = resolve
+      })
+      registeredAdapter.getStreamPosition = async () => {
+        leadershipRead()
+        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+      }
+      registeredAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+      scopedAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+
+      const coord = createCoordinator(registeredAdapter)
+      try {
+        coord.subscribe(`todos`, () => {})
+        await leadershipReadPromise
+        await vi.waitFor(() => expect(coord.isLeader(`todos`)).toBe(true))
+
+        await coord.requestEnsurePersistedIndex(
+          `todos`,
+          `idx-scoped`,
+          { expressionSql: [`title`] },
+          scopedAdapter,
+        )
+
+        expect(scopedAdapter.ensureIndex).toHaveBeenCalledOnce()
+        expect(registeredAdapter.ensureIndex).not.toHaveBeenCalled()
+      } finally {
+        coord.dispose()
+      }
+    })
+
+    it(`keeps leader RPC work on the adapter registered for its collection`, async () => {
+      const todosAdapter = createStubAdapter()
+      const notesAdapter = createStubAdapter()
+      let leadershipRead!: () => void
+      const leadershipReadPromise = new Promise<void>((resolve) => {
+        leadershipRead = resolve
+      })
+      todosAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+      notesAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+      todosAdapter.getStreamPosition = async () => {
+        leadershipRead()
+        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+      }
+
+      const leader = createCoordinator(todosAdapter)
+      const follower = createCoordinator(notesAdapter)
+
+      try {
+        leader.setAdapterForCollection(`todos`, todosAdapter)
+        leader.subscribe(`todos`, () => {})
+        await leadershipReadPromise
+        await vi.waitFor(() => expect(leader.isLeader(`todos`)).toBe(true))
+        follower.subscribe(`todos`, () => {})
+
+        // Resolving a later collection variant must not replace the adapter
+        // already owning leader-side work for `todos`.
+        leader.setAdapter(notesAdapter)
+        await follower.requestEnsurePersistedIndex(`todos`, `idx-todos`, {
+          expressionSql: [`title`],
+        })
+
+        expect(todosAdapter.ensureIndex).toHaveBeenCalledOnce()
+        expect(notesAdapter.ensureIndex).not.toHaveBeenCalled()
+      } finally {
+        follower.dispose()
+        leader.dispose()
+      }
+    })
+
+    it(`re-registers the collection adapter after cleanup and restart`, async () => {
+      const defaultAdapter = createStubAdapter()
+      const collectionAdapter = createStubAdapter()
+      const defaultEnsure = vi.fn().mockResolvedValue(undefined)
+      const collectionEnsure = vi.fn().mockResolvedValue(undefined)
+      defaultAdapter.ensureIndex = defaultEnsure
+      collectionAdapter.ensureIndex = collectionEnsure
+      const coordinator = createCoordinator(defaultAdapter)
+      const collection = createCollection(
+        persistedCollectionOptions<{ id: string; title: string }, string>({
+          id: `todos`,
+          getKey: (row) => row.id,
+          sync: { sync: ({ markReady }) => markReady() },
+          persistence: { adapter: collectionAdapter, coordinator },
+        }),
+      )
+
+      try {
+        await collection.stateWhenReady()
+        await vi.waitFor(() => expect(coordinator.isLeader(`todos`)).toBe(true))
+        await coordinator.requestEnsurePersistedIndex(`todos`, `before`, {
+          expressionSql: [`title`],
+        })
+
+        await collection.cleanup()
+        expect(
+          inspectCoordinator(coordinator).collectionAdapters.has(`todos`),
+        ).toBe(false)
+        await collection.stateWhenReady()
+        await vi.waitFor(() => expect(coordinator.isLeader(`todos`)).toBe(true))
+        await coordinator.requestEnsurePersistedIndex(`todos`, `after`, {
+          expressionSql: [`title`],
+        })
+
+        expect(collectionEnsure.mock.calls.map((call) => call[1])).toEqual([
+          `before`,
+          `after`,
+        ])
+        expect(defaultEnsure).not.toHaveBeenCalled()
+      } finally {
+        await collection.cleanup()
+        coordinator.dispose()
+      }
+    })
+
+    it(`replaces a cached default adapter with its collection registration`, async () => {
+      const defaultAdapter = createStubAdapter()
+      const replacementAdapter = createStubAdapter()
+      let leadershipRead!: () => void
+      const leadershipReadPromise = new Promise<void>((resolve) => {
+        leadershipRead = resolve
+      })
+      defaultAdapter.getStreamPosition = async () => {
+        leadershipRead()
+        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+      }
+      defaultAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+      replacementAdapter.ensureIndex = vi.fn().mockResolvedValue(undefined)
+
+      const coordinator = createCoordinator(defaultAdapter)
+      try {
+        coordinator.subscribe(`todos`, () => {})
+        await leadershipReadPromise
+        await vi.waitFor(() => expect(coordinator.isLeader(`todos`)).toBe(true))
+
+        await coordinator.requestEnsurePersistedIndex(`todos`, `idx-default`, {
+          expressionSql: [`title`],
+        })
+        coordinator.setAdapterForCollection(`todos`, replacementAdapter)
+        await coordinator.requestEnsurePersistedIndex(
+          `todos`,
+          `idx-replacement`,
+          { expressionSql: [`title`] },
+        )
+
+        expect(defaultAdapter.ensureIndex).toHaveBeenCalledOnce()
+        expect(replacementAdapter.ensureIndex).toHaveBeenCalledOnce()
+        expect(replacementAdapter.ensureIndex).toHaveBeenCalledWith(
+          { kind: `eager`, collectionId: `todos` },
+          `idx-replacement`,
+          { expressionSql: [`title`] },
+        )
+      } finally {
+        coordinator.dispose()
+      }
+    })
+  })
+
+  describe(`dispose`, () => {
+    it(`stops Browser RPC retry after disposal and preserves the first failure`, async () => {
+      vi.useFakeTimers()
+      const coordinator = createCoordinator()
+      const firstError = new Error(`browser transport failed during disposal`)
+      let firstAttempt = true
+      const internals = coordinator as unknown as {
+        sendRPC: (
+          collectionId: string,
+          request: {
+            type: `rpc:pullSince:req`
+            rpcId: string
+            fromRowVersion: number
+          },
+        ) => Promise<unknown>
+        sendRPCOnce: () => Promise<unknown>
+      }
+      internals.sendRPCOnce = vi.fn(() => {
+        if (firstAttempt) {
+          firstAttempt = false
+          coordinator.dispose()
+        }
+        return Promise.reject(firstError)
+      })
+      let outcome: { error: unknown } | undefined
+
+      try {
+        const pending = internals
+          .sendRPC(`todos`, {
+            type: `rpc:pullSince:req`,
+            rpcId: `browser-disposal-rpc`,
+            fromRowVersion: 0,
+          })
+          .then(
+            () => ({ error: undefined }),
+            (error: unknown) => ({ error }),
+          )
+          .then((result) => {
+            outcome = result
+            return result
+          })
+        await vi.advanceTimersByTimeAsync(0)
+        const immediate = {
+          calls: vi.mocked(internals.sendRPCOnce).mock.calls.length,
+          settled: outcome !== undefined,
+        }
+        await vi.runAllTimersAsync()
+        const finalOutcome = await pending
+
+        expect(immediate).toEqual({ calls: 1, settled: true })
+        expect(finalOutcome).toEqual({ error: firstError })
+        expect(internals.sendRPCOnce).toHaveBeenCalledTimes(1)
+      } finally {
+        await vi.runAllTimersAsync()
+        vi.useRealTimers()
+        coordinator.dispose()
+      }
+    })
+
+    it(`cleans up on dispose`, async () => {
+      const coord = createCoordinator()
+      coord.subscribe(`todos`, () => {})
+      await flush(50)
+
+      coord.dispose()
+
+      // Should not throw after disposal
+      expect(coord.isLeader(`todos`)).toBe(false)
+    })
+
+    it(`settles an in-flight RPC at dispose without posting retries`, async () => {
+      vi.useFakeTimers()
+      const adapter = createStubAdapter()
+      let leadershipRead!: () => void
+      const leadershipReadPromise = new Promise<void>((resolve) => {
+        leadershipRead = resolve
+      })
+      let firstRequestPosted!: () => void
+      const firstRequestPostedPromise = new Promise<void>((resolve) => {
+        firstRequestPosted = resolve
+      })
+      adapter.getStreamPosition = async () => {
+        leadershipRead()
+        return { latestTerm: 0, latestSeq: 0, latestRowVersion: 0 }
+      }
+
+      const leader = createCoordinator(adapter)
+      const follower = createCoordinator(adapter)
+      let requestPosts = 0
+      let settled = false
+
+      try {
+        leader.subscribe(`todos`, () => {})
+        await leadershipReadPromise
+        await Promise.resolve()
+        follower.subscribe(`todos`, () => {})
+
+        observePostedMessage = (data) => {
+          const type = (data as { payload?: { type?: string } }).payload?.type
+          if (type === `rpc:ensurePersistedIndex:req`) {
+            requestPosts++
+            if (requestPosts === 1) firstRequestPosted()
+          }
+        }
+        dropNextMessageWhen = (data) =>
+          (data as { payload?: { type?: string } }).payload?.type ===
+          `rpc:ensurePersistedIndex:req`
+
+        const request = follower
+          .requestEnsurePersistedIndex(`todos`, `idx-dispose`, {
+            expressionSql: [`title`],
+          })
+          .then(
+            () => {
+              settled = true
+            },
+            () => {
+              settled = true
+            },
+          )
+
+        await firstRequestPostedPromise
+        follower.dispose()
+        for (let microtask = 0; microtask < 8; microtask++) {
+          await Promise.resolve()
+        }
+        const settledAtDispose = settled
+
+        await vi.advanceTimersByTimeAsync(21_000)
+        await request
+
+        expect({ settledAtDispose, requestPosts }).toEqual({
+          settledAtDispose: true,
+          requestPosts: 1,
+        })
+      } finally {
+        follower.dispose()
+        leader.dispose()
+        vi.useRealTimers()
+      }
+    })
+  })
+})
diff --git a/packages/browser-db-sqlite-persistence/tests/opfs-open-outcome-oracle.ts b/packages/browser-db-sqlite-persistence/tests/opfs-open-outcome-oracle.ts
index 3b8585b680..c8a2abf2e6 100644
--- a/packages/browser-db-sqlite-persistence/tests/opfs-open-outcome-oracle.ts
+++ b/packages/browser-db-sqlite-persistence/tests/opfs-open-outcome-oracle.ts
@@ -33,6 +33,7 @@
  * than the WASM response belong to the OPFS page lifecycle oracle.
  */
 import { expect } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 
 /*
  * ## History grammar
@@ -259,3 +260,11 @@ export function expectOpenOutcome(
 export function describeHistory(history: OpenHistory): string {
   return `lookup ${history.lookup}, worker ${history.workerStart}, wasm ${history.wasm}, init ${history.init}, interrupt ${history.interrupt}`
 }
+
+// The model predicts each settlement from the history; the check compares the
+// driver's observation with that prediction. The grammar generates the histories.
+declareOracle({
+  check: [expectOpenOutcome],
+  model: [expectedOpenOutcome],
+  grammar: [openHistories],
+})
diff --git a/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-harness.ts b/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-harness.ts
new file mode 100644
index 0000000000..a74d71b569
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-harness.ts
@@ -0,0 +1,269 @@
+import { expect, vi } from 'vitest'
+import type {
+  BrowserOPFSWorkerErrorCode,
+  BrowserOPFSWorkerRequest,
+  BrowserOPFSWorkerResponse,
+} from '../src/opfs-worker-protocol'
+
+// The fake page and worker that the OPFS page-lifecycle oracle and its scenario
+// tests install. They record listeners, held responses, and termination; the
+// oracle in `opfs-page-lifecycle-oracle.test.ts` owns the laws they check.
+
+export type RequestKind = BrowserOPFSWorkerRequest[`type`]
+
+export type ReleaseDirection = `fifo` | `reverse`
+
+export type TerminalEventType = `error` | `messageerror`
+
+export type WorkerBehavior = {
+  heldResponseType?: RequestKind
+  initErrorCode?: BrowserOPFSWorkerErrorCode
+  closeErrorCode?: BrowserOPFSWorkerErrorCode
+}
+
+export type Settlement = {
+  label: string
+  status: `fulfilled` | `rejected`
+  observation: unknown
+}
+
+export type TrackedResult<T> = {
+  settlement: Settlement
+  value?: T
+}
+
+export class ControlledPage {
+  private readonly pagehideListeners = new Set<(event: Event) => void>()
+  public addCalls = 0
+  public removeCalls = 0
+
+  addEventListener(type: string, listener: (event: Event) => void): void {
+    if (type !== `pagehide`) return
+    this.addCalls++
+    this.pagehideListeners.add(listener)
+  }
+
+  removeEventListener(type: string, listener: (event: Event) => void): void {
+    if (type !== `pagehide`) return
+    this.removeCalls++
+    this.pagehideListeners.delete(listener)
+  }
+
+  dispatchPageHide(persisted: boolean): void {
+    const event = Object.assign(new Event(`pagehide`), { persisted })
+    for (const listener of [...this.pagehideListeners]) listener(event)
+  }
+
+  get listenerCount(): number {
+    return this.pagehideListeners.size
+  }
+}
+
+export class ControlledWorker {
+  static instances: Array<ControlledWorker> = []
+  static behavior: WorkerBehavior = {}
+
+  private readonly listeners: {
+    message: Set<(event: Event) => void>
+    error: Set<(event: Event) => void>
+    messageerror: Set<(event: Event) => void>
+  } = {
+    message: new Set(),
+    error: new Set(),
+    messageerror: new Set(),
+  }
+  private readonly heldResponses: Array<BrowserOPFSWorkerResponse> = []
+  private initialized = false
+
+  public readonly requests: Array<BrowserOPFSWorkerRequest> = []
+  public terminationCalls = 0
+
+  constructor(..._args: Array<unknown>) {
+    ControlledWorker.instances.push(this)
+  }
+
+  addEventListener(
+    type: keyof ControlledWorker[`listeners`],
+    listener: (event: Event) => void,
+  ): void {
+    this.listeners[type].add(listener)
+  }
+
+  removeEventListener(
+    type: keyof ControlledWorker[`listeners`],
+    listener: (event: Event) => void,
+  ): void {
+    this.listeners[type].delete(listener)
+  }
+
+  terminate(): void {
+    this.terminationCalls++
+  }
+
+  postMessage(request: BrowserOPFSWorkerRequest): void {
+    this.requests.push(request)
+    if (this.terminationCalls > 0) return
+
+    queueMicrotask(() => {
+      const response = this.handleRequest(request)
+      if (request.type === ControlledWorker.behavior.heldResponseType) {
+        this.heldResponses.push(response)
+      } else {
+        this.emitMessage(response)
+      }
+    })
+  }
+
+  listenerCount(type: keyof ControlledWorker[`listeners`]): number {
+    return this.listeners[type].size
+  }
+
+  get heldResponseCount(): number {
+    return this.heldResponses.length
+  }
+
+  releaseHeldResponses(
+    count = this.heldResponses.length,
+    direction: ReleaseDirection = `fifo`,
+  ): void {
+    const releaseCount = Math.min(count, this.heldResponses.length)
+    if (releaseCount === 0) return
+    const responses =
+      direction === `fifo`
+        ? this.heldResponses.splice(0, releaseCount)
+        : this.heldResponses.splice(-releaseCount).reverse()
+    for (const response of responses) {
+      this.emitMessage(response)
+    }
+  }
+
+  emitTerminalEvent(type: TerminalEventType): void {
+    for (const listener of this.listeners[type]) listener(new Event(type))
+  }
+
+  private handleRequest(
+    request: BrowserOPFSWorkerRequest,
+  ): BrowserOPFSWorkerResponse {
+    if (request.type === `init`) {
+      if (ControlledWorker.behavior.initErrorCode) {
+        return {
+          type: `response`,
+          requestId: request.requestId,
+          ok: false,
+          code: ControlledWorker.behavior.initErrorCode,
+          error: `controlled init failure`,
+        }
+      }
+      this.initialized = true
+      return { type: `response`, requestId: request.requestId, ok: true }
+    }
+
+    if (request.type === `execute`) {
+      if (!this.initialized) {
+        return {
+          type: `response`,
+          requestId: request.requestId,
+          ok: false,
+          code: `INVALID_CONFIG`,
+          error: `worker not initialized`,
+        }
+      }
+      return {
+        type: `response`,
+        requestId: request.requestId,
+        ok: true,
+        rows: [{ sql: request.sql }],
+      }
+    }
+
+    if (ControlledWorker.behavior.closeErrorCode) {
+      return {
+        type: `response`,
+        requestId: request.requestId,
+        ok: false,
+        code: ControlledWorker.behavior.closeErrorCode,
+        error: `controlled close failure`,
+      }
+    }
+    this.initialized = false
+    return { type: `response`, requestId: request.requestId, ok: true }
+  }
+
+  private emitMessage(response: BrowserOPFSWorkerResponse): void {
+    for (const listener of this.listeners.message) {
+      listener({ data: response } as MessageEvent<BrowserOPFSWorkerResponse>)
+    }
+  }
+}
+
+export function installEnvironment(behavior: WorkerBehavior): ControlledPage {
+  const page = new ControlledPage()
+  ControlledWorker.instances = []
+  ControlledWorker.behavior = behavior
+  vi.stubGlobal(`Worker`, ControlledWorker)
+  vi.stubGlobal(`navigator`, {
+    storage: { getDirectory: () => Promise.resolve({}) },
+  })
+  vi.stubGlobal(`location`, { href: `https://example.test/` })
+  vi.stubGlobal(`addEventListener`, page.addEventListener.bind(page))
+  vi.stubGlobal(`removeEventListener`, page.removeEventListener.bind(page))
+  return page
+}
+
+export async function cleanupEnvironment(): Promise<void> {
+  for (const worker of ControlledWorker.instances) worker.releaseHeldResponses()
+  await Promise.resolve()
+  vi.unstubAllGlobals()
+  ControlledWorker.instances = []
+  ControlledWorker.behavior = {}
+}
+
+export function errorObservation(error: unknown): {
+  name: string
+  message: string
+} {
+  return error instanceof Error
+    ? { name: error.name, message: error.message }
+    : { name: `NonError`, message: String(error) }
+}
+
+export function track<T>(
+  label: string,
+  promise: Promise<T>,
+  fulfilledObservation: (value: T) => unknown,
+  ledger: Array<Settlement>,
+): Promise<TrackedResult<T>> {
+  return promise.then(
+    (value) => {
+      const settlement: Settlement = {
+        label,
+        status: `fulfilled`,
+        observation: fulfilledObservation(value),
+      }
+      ledger.push(settlement)
+      return { settlement, value }
+    },
+    (error: unknown) => {
+      const settlement: Settlement = {
+        label,
+        status: `rejected`,
+        observation: errorObservation(error),
+      }
+      ledger.push(settlement)
+      return { settlement }
+    },
+  )
+}
+
+export function expectDisposed(
+  page: ControlledPage,
+  worker: ControlledWorker,
+): void {
+  expect(worker.terminationCalls).toBe(1)
+  expect(worker.listenerCount(`message`)).toBe(0)
+  expect(worker.listenerCount(`error`)).toBe(0)
+  expect(worker.listenerCount(`messageerror`)).toBe(0)
+  expect(page.listenerCount).toBe(0)
+  expect(page.addCalls).toBe(1)
+  expect(page.removeCalls).toBe(1)
+}
diff --git a/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts b/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts
index b9e9d04a71..812039b765 100644
--- a/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts
+++ b/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts
@@ -1,16 +1,27 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, vi } from 'vitest'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { openBrowserWASQLiteOPFSDatabase } from '../src/opfs-database'
+import {
+  ControlledWorker,
+  cleanupEnvironment,
+  expectDisposed,
+  installEnvironment,
+  track,
+} from './opfs-page-lifecycle-harness'
 import type {
-  BrowserOPFSWorkerErrorCode,
-  BrowserOPFSWorkerRequest,
-  BrowserOPFSWorkerResponse,
-} from '../src/opfs-worker-protocol'
+  ReleaseDirection,
+  RequestKind,
+  Settlement,
+  TerminalEventType,
+  TrackedResult,
+} from './opfs-page-lifecycle-harness'
+import type { BrowserOPFSWorkerErrorCode } from '../src/opfs-worker-protocol'
 
 /**
  * # Who owns an OPFS worker when the browser page leaves?
@@ -53,13 +64,10 @@ import type {
  */
 
 type Database = Awaited<ReturnType<typeof openBrowserWASQLiteOPFSDatabase>>
-type RequestKind = BrowserOPFSWorkerRequest[`type`]
 type DeliveryStage =
   | `pagehide-before-response-production`
   | `pagehide-after-response-production`
   | `response-before-pagehide`
-type ReleaseDirection = `fifo` | `reverse`
-type TerminalEventType = `error` | `messageerror`
 
 type PagehideHistory = {
   pending: RequestKind
@@ -99,243 +107,6 @@ type TerminalEventHistory = {
   executeCount: number
 }
 
-type WorkerBehavior = {
-  heldResponseType?: RequestKind
-  initErrorCode?: BrowserOPFSWorkerErrorCode
-  closeErrorCode?: BrowserOPFSWorkerErrorCode
-}
-
-type Settlement = {
-  label: string
-  status: `fulfilled` | `rejected`
-  observation: unknown
-}
-
-type TrackedResult<T> = {
-  settlement: Settlement
-  value?: T
-}
-
-class ControlledPage {
-  private readonly pagehideListeners = new Set<(event: Event) => void>()
-  public addCalls = 0
-  public removeCalls = 0
-
-  addEventListener(type: string, listener: (event: Event) => void): void {
-    if (type !== `pagehide`) return
-    this.addCalls++
-    this.pagehideListeners.add(listener)
-  }
-
-  removeEventListener(type: string, listener: (event: Event) => void): void {
-    if (type !== `pagehide`) return
-    this.removeCalls++
-    this.pagehideListeners.delete(listener)
-  }
-
-  dispatchPageHide(persisted: boolean): void {
-    const event = Object.assign(new Event(`pagehide`), { persisted })
-    for (const listener of [...this.pagehideListeners]) listener(event)
-  }
-
-  get listenerCount(): number {
-    return this.pagehideListeners.size
-  }
-}
-
-class ControlledWorker {
-  static instances: Array<ControlledWorker> = []
-  static behavior: WorkerBehavior = {}
-
-  private readonly listeners: {
-    message: Set<(event: Event) => void>
-    error: Set<(event: Event) => void>
-    messageerror: Set<(event: Event) => void>
-  } = {
-    message: new Set(),
-    error: new Set(),
-    messageerror: new Set(),
-  }
-  private readonly heldResponses: Array<BrowserOPFSWorkerResponse> = []
-  private initialized = false
-
-  public readonly requests: Array<BrowserOPFSWorkerRequest> = []
-  public terminationCalls = 0
-
-  constructor(..._args: Array<unknown>) {
-    ControlledWorker.instances.push(this)
-  }
-
-  addEventListener(
-    type: keyof ControlledWorker[`listeners`],
-    listener: (event: Event) => void,
-  ): void {
-    this.listeners[type].add(listener)
-  }
-
-  removeEventListener(
-    type: keyof ControlledWorker[`listeners`],
-    listener: (event: Event) => void,
-  ): void {
-    this.listeners[type].delete(listener)
-  }
-
-  terminate(): void {
-    this.terminationCalls++
-  }
-
-  postMessage(request: BrowserOPFSWorkerRequest): void {
-    this.requests.push(request)
-    if (this.terminationCalls > 0) return
-
-    queueMicrotask(() => {
-      const response = this.handleRequest(request)
-      if (request.type === ControlledWorker.behavior.heldResponseType) {
-        this.heldResponses.push(response)
-      } else {
-        this.emitMessage(response)
-      }
-    })
-  }
-
-  listenerCount(type: keyof ControlledWorker[`listeners`]): number {
-    return this.listeners[type].size
-  }
-
-  get heldResponseCount(): number {
-    return this.heldResponses.length
-  }
-
-  releaseHeldResponses(
-    count = this.heldResponses.length,
-    direction: ReleaseDirection = `fifo`,
-  ): void {
-    const releaseCount = Math.min(count, this.heldResponses.length)
-    if (releaseCount === 0) return
-    const responses =
-      direction === `fifo`
-        ? this.heldResponses.splice(0, releaseCount)
-        : this.heldResponses.splice(-releaseCount).reverse()
-    for (const response of responses) {
-      this.emitMessage(response)
-    }
-  }
-
-  emitTerminalEvent(type: TerminalEventType): void {
-    for (const listener of this.listeners[type]) listener(new Event(type))
-  }
-
-  private handleRequest(
-    request: BrowserOPFSWorkerRequest,
-  ): BrowserOPFSWorkerResponse {
-    if (request.type === `init`) {
-      if (ControlledWorker.behavior.initErrorCode) {
-        return {
-          type: `response`,
-          requestId: request.requestId,
-          ok: false,
-          code: ControlledWorker.behavior.initErrorCode,
-          error: `controlled init failure`,
-        }
-      }
-      this.initialized = true
-      return { type: `response`, requestId: request.requestId, ok: true }
-    }
-
-    if (request.type === `execute`) {
-      if (!this.initialized) {
-        return {
-          type: `response`,
-          requestId: request.requestId,
-          ok: false,
-          code: `INVALID_CONFIG`,
-          error: `worker not initialized`,
-        }
-      }
-      return {
-        type: `response`,
-        requestId: request.requestId,
-        ok: true,
-        rows: [{ sql: request.sql }],
-      }
-    }
-
-    if (ControlledWorker.behavior.closeErrorCode) {
-      return {
-        type: `response`,
-        requestId: request.requestId,
-        ok: false,
-        code: ControlledWorker.behavior.closeErrorCode,
-        error: `controlled close failure`,
-      }
-    }
-    this.initialized = false
-    return { type: `response`, requestId: request.requestId, ok: true }
-  }
-
-  private emitMessage(response: BrowserOPFSWorkerResponse): void {
-    for (const listener of this.listeners.message) {
-      listener({ data: response } as MessageEvent<BrowserOPFSWorkerResponse>)
-    }
-  }
-}
-
-function installEnvironment(behavior: WorkerBehavior): ControlledPage {
-  const page = new ControlledPage()
-  ControlledWorker.instances = []
-  ControlledWorker.behavior = behavior
-  vi.stubGlobal(`Worker`, ControlledWorker)
-  vi.stubGlobal(`navigator`, {
-    storage: { getDirectory: () => Promise.resolve({}) },
-  })
-  vi.stubGlobal(`location`, { href: `https://example.test/` })
-  vi.stubGlobal(`addEventListener`, page.addEventListener.bind(page))
-  vi.stubGlobal(`removeEventListener`, page.removeEventListener.bind(page))
-  return page
-}
-
-async function cleanupEnvironment(): Promise<void> {
-  for (const worker of ControlledWorker.instances) worker.releaseHeldResponses()
-  await Promise.resolve()
-  vi.unstubAllGlobals()
-  ControlledWorker.instances = []
-  ControlledWorker.behavior = {}
-}
-
-function errorObservation(error: unknown): { name: string; message: string } {
-  return error instanceof Error
-    ? { name: error.name, message: error.message }
-    : { name: `NonError`, message: String(error) }
-}
-
-function track<T>(
-  label: string,
-  promise: Promise<T>,
-  fulfilledObservation: (value: T) => unknown,
-  ledger: Array<Settlement>,
-): Promise<TrackedResult<T>> {
-  return promise.then(
-    (value) => {
-      const settlement: Settlement = {
-        label,
-        status: `fulfilled`,
-        observation: fulfilledObservation(value),
-      }
-      ledger.push(settlement)
-      return { settlement, value }
-    },
-    (error: unknown) => {
-      const settlement: Settlement = {
-        label,
-        status: `rejected`,
-        observation: errorObservation(error),
-      }
-      ledger.push(settlement)
-      return { settlement }
-    },
-  )
-}
-
 // Authority: the public error classes exported by sqlite-persistence-core and
 // the three protocol classifications in opfs-worker-protocol.ts. Keeping the
 // table declarative makes an accidental production remapping observable.
@@ -468,16 +239,6 @@ function expectSettlementSet(
   expect(canonicalSettlements(actual)).toEqual(canonicalSettlements(expected))
 }
 
-function expectDisposed(page: ControlledPage, worker: ControlledWorker): void {
-  expect(worker.terminationCalls).toBe(1)
-  expect(worker.listenerCount(`message`)).toBe(0)
-  expect(worker.listenerCount(`error`)).toBe(0)
-  expect(worker.listenerCount(`messageerror`)).toBe(0)
-  expect(page.listenerCount).toBe(0)
-  expect(page.addCalls).toBe(1)
-  expect(page.removeCalls).toBe(1)
-}
-
 async function runPagehideHistory(history: PagehideHistory): Promise<void> {
   const page = installEnvironment({ heldResponseType: history.pending })
   const settlements: Array<Settlement> = []
@@ -1145,209 +906,12 @@ opfs.terminal-event, opfs.close, or opfs.failure-cleanup. A seed without a
 path reseeds the unseeded campaigns. Run it with this file's package-local
 Vitest command.
 */
-describe(`OPFS page lifecycle oracle`, () => {
-  it.each([
-    { label: `default`, timeoutMs: undefined, deadline: 30_000 },
-    { label: `overridden`, timeoutMs: 40, deadline: 40 },
-    { label: `minimum positive`, timeoutMs: 1, deadline: 1 },
-  ])(
-    `terminates a silent worker at the $label open deadline`,
-    async ({ timeoutMs, deadline }) => {
-      vi.useFakeTimers()
-      const page = installEnvironment({ heldResponseType: `init` })
-      const settlements: Array<Settlement> = []
-      const opened = track(
-        `init`,
-        openBrowserWASQLiteOPFSDatabase({
-          databaseName: `oracle.sqlite`,
-          ...(timeoutMs === undefined ? {} : { timeoutMs }),
-        }),
-        () => `database`,
-        settlements,
-      )
-      const worker = ControlledWorker.instances[0]!
-
-      await Promise.resolve()
-      expect(worker.heldResponseCount).toBe(1)
-      await vi.advanceTimersByTimeAsync(deadline - 1)
-      expect(settlements).toEqual([])
-      await vi.advanceTimersByTimeAsync(1)
-      expect(settlements).toEqual([
-        {
-          label: `init`,
-          status: `rejected`,
-          observation: {
-            name: `TimeoutError`,
-            message: `Opening browser OPFS database timed out after ${deadline} ms`,
-          },
-        },
-      ])
-      expect((await opened).settlement).toEqual(settlements[0])
-      expectDisposed(page, worker)
-
-      const terminalLedger = [...settlements]
-      worker.releaseHeldResponses()
-      await Promise.resolve()
-      expect(settlements).toEqual(terminalLedger)
-      expect(worker.terminationCalls).toBe(1)
-    },
-  )
-
-  it(`aborts a pending open and ignores its late worker response`, async () => {
-    vi.useFakeTimers()
-    const page = installEnvironment({ heldResponseType: `init` })
-    const controller = new AbortController()
-    const reason = new DOMException(`App stopped opening`, `AbortError`)
-    const settlements: Array<Settlement> = []
-    const opened = track(
-      `init`,
-      openBrowserWASQLiteOPFSDatabase({
-        databaseName: `oracle.sqlite`,
-        timeoutMs: 40,
-        signal: controller.signal,
-      }),
-      () => `database`,
-      settlements,
-    )
-    const worker = ControlledWorker.instances[0]!
-    await Promise.resolve()
-    expect(worker.heldResponseCount).toBe(1)
-
-    controller.abort(reason)
-    expect((await opened).settlement).toEqual({
-      label: `init`,
-      status: `rejected`,
-      observation: { name: `AbortError`, message: `App stopped opening` },
-    })
-    expectDisposed(page, worker)
-    worker.releaseHeldResponses()
-    await vi.advanceTimersByTimeAsync(40)
-    expect(settlements).toHaveLength(1)
-    expect(worker.terminationCalls).toBe(1)
-  })
-
-  it(`does not create a worker for an already-aborted open`, async () => {
-    const page = installEnvironment({})
-    const controller = new AbortController()
-    const reason = new DOMException(`App stopped opening`, `AbortError`)
-    controller.abort(reason)
-
-    await expect(
-      openBrowserWASQLiteOPFSDatabase({
-        databaseName: `oracle.sqlite`,
-        signal: controller.signal,
-      }),
-    ).rejects.toBe(reason)
-    expect(ControlledWorker.instances).toEqual([])
-    expect(page.listenerCount).toBe(0)
-  })
-
-  it(`observes an abort during synchronous option evaluation`, async () => {
-    vi.useFakeTimers()
-    const page = installEnvironment({ heldResponseType: `init` })
-    const controller = new AbortController()
-    const reason = new DOMException(`App stopped opening`, `AbortError`)
-    const settlements: Array<Settlement> = []
-    let vfsNameReads = 0
-    const opened = track(
-      `init`,
-      openBrowserWASQLiteOPFSDatabase({
-        databaseName: `oracle.sqlite`,
-        timeoutMs: 0,
-        signal: controller.signal,
-        get vfsName() {
-          vfsNameReads++
-          controller.abort(reason)
-          return `opfs`
-        },
-      }),
-      () => `database`,
-      settlements,
-    )
-    const worker = ControlledWorker.instances[0]!
-
-    await vi.advanceTimersByTimeAsync(0)
-    expect(vfsNameReads).toBe(1)
-    expect(worker.requests.map((request) => request.type)).toEqual([`init`])
-    expect(settlements).toEqual([
-      {
-        label: `init`,
-        status: `rejected`,
-        observation: { name: `AbortError`, message: `App stopped opening` },
-      },
-    ])
-    expect((await opened).settlement).toEqual(settlements[0])
-    expectDisposed(page, worker)
-
-    worker.releaseHeldResponses()
-    await vi.advanceTimersByTimeAsync(0)
-    expect(settlements).toHaveLength(1)
-  })
-
-  it(`allows an explicit zero deadline while the worker remains silent`, async () => {
-    vi.useFakeTimers()
-    const page = installEnvironment({ heldResponseType: `init` })
-    const settlements: Array<Settlement> = []
-    const opened = track(
-      `init`,
-      openBrowserWASQLiteOPFSDatabase({
-        databaseName: `oracle.sqlite`,
-        timeoutMs: 0,
-      }),
-      () => `database`,
-      settlements,
-    )
-    const worker = ControlledWorker.instances[0]!
-    await Promise.resolve()
-    expect(worker.heldResponseCount).toBe(1)
-
-    await vi.advanceTimersByTimeAsync(60_000)
-    expect(settlements).toEqual([])
-    expect(worker.terminationCalls).toBe(0)
-    worker.releaseHeldResponses()
-    const database = (await opened).value!
-    await database.close?.()
-    expectDisposed(page, worker)
-  })
-
-  it.each([-1, 0.5, Number.POSITIVE_INFINITY, 2_147_483_648])(
-    `rejects invalid open deadline %s before creating a worker`,
-    async (timeoutMs) => {
-      const page = installEnvironment({})
-      await expect(
-        openBrowserWASQLiteOPFSDatabase({
-          databaseName: `oracle.sqlite`,
-          timeoutMs,
-        }),
-      ).rejects.toMatchObject({
-        name: `InvalidPersistedCollectionConfigError`,
-      })
-      expect(ControlledWorker.instances).toEqual([])
-      expect(page.listenerCount).toBe(0)
-    },
-  )
-
-  it(`stops observing the deadline and signal after open succeeds`, async () => {
-    vi.useFakeTimers()
-    const page = installEnvironment({})
-    const controller = new AbortController()
-    const database = await openBrowserWASQLiteOPFSDatabase({
-      databaseName: `oracle.sqlite`,
-      timeoutMs: 40,
-      signal: controller.signal,
-    })
-    const worker = ControlledWorker.instances[0]!
-
-    await vi.advanceTimersByTimeAsync(40)
-    controller.abort()
-    expect(worker.terminationCalls).toBe(0)
-    await expect(database.execute(`SELECT 1`)).resolves.toEqual([
-      { sql: `SELECT 1` },
-    ])
-    await database.close?.()
-    expectDisposed(page, worker)
-  })
+declareOracle({
+  check: [runFailureHistory],
+  model: [expectedCloseSettlements],
+})
 
+describe(`OPFS page lifecycle oracle`, () => {
   oracleReplayTest(fcTest).prop([pagehideHistory], {
     seed: 1844,
     numRuns: oracleRuns(48),
diff --git a/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle.test.ts b/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle.test.ts
new file mode 100644
index 0000000000..6300b9ed04
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle.test.ts
@@ -0,0 +1,225 @@
+/**
+ * Scenario checks for the OPFS page lifecycle: open deadlines, abort during open,
+ * and abort during option evaluation. `opfs-page-lifecycle-oracle.test.ts` owns
+ * the lifecycle law and its generated histories; these tests pin single timing
+ * scenarios with hand-written expectations.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { openBrowserWASQLiteOPFSDatabase } from '../src/opfs-database'
+import {
+  ControlledWorker,
+  cleanupEnvironment,
+  expectDisposed,
+  installEnvironment,
+  track,
+} from './opfs-page-lifecycle-harness'
+import type { Settlement } from './opfs-page-lifecycle-harness'
+
+afterEach(async () => {
+  await cleanupEnvironment()
+  vi.useRealTimers()
+})
+
+describe(`OPFS page lifecycle oracle`, () => {
+  it.each([
+    { label: `default`, timeoutMs: undefined, deadline: 30_000 },
+    { label: `overridden`, timeoutMs: 40, deadline: 40 },
+    { label: `minimum positive`, timeoutMs: 1, deadline: 1 },
+  ])(
+    `terminates a silent worker at the $label open deadline`,
+    async ({ timeoutMs, deadline }) => {
+      vi.useFakeTimers()
+      const page = installEnvironment({ heldResponseType: `init` })
+      const settlements: Array<Settlement> = []
+      const opened = track(
+        `init`,
+        openBrowserWASQLiteOPFSDatabase({
+          databaseName: `oracle.sqlite`,
+          ...(timeoutMs === undefined ? {} : { timeoutMs }),
+        }),
+        () => `database`,
+        settlements,
+      )
+      const worker = ControlledWorker.instances[0]!
+
+      await Promise.resolve()
+      expect(worker.heldResponseCount).toBe(1)
+      await vi.advanceTimersByTimeAsync(deadline - 1)
+      expect(settlements).toEqual([])
+      await vi.advanceTimersByTimeAsync(1)
+      expect(settlements).toEqual([
+        {
+          label: `init`,
+          status: `rejected`,
+          observation: {
+            name: `TimeoutError`,
+            message: `Opening browser OPFS database timed out after ${deadline} ms`,
+          },
+        },
+      ])
+      expect((await opened).settlement).toEqual(settlements[0])
+      expectDisposed(page, worker)
+
+      const terminalLedger = [...settlements]
+      worker.releaseHeldResponses()
+      await Promise.resolve()
+      expect(settlements).toEqual(terminalLedger)
+      expect(worker.terminationCalls).toBe(1)
+    },
+  )
+
+  it(`aborts a pending open and ignores its late worker response`, async () => {
+    vi.useFakeTimers()
+    const page = installEnvironment({ heldResponseType: `init` })
+    const controller = new AbortController()
+    const reason = new DOMException(`App stopped opening`, `AbortError`)
+    const settlements: Array<Settlement> = []
+    const opened = track(
+      `init`,
+      openBrowserWASQLiteOPFSDatabase({
+        databaseName: `oracle.sqlite`,
+        timeoutMs: 40,
+        signal: controller.signal,
+      }),
+      () => `database`,
+      settlements,
+    )
+    const worker = ControlledWorker.instances[0]!
+    await Promise.resolve()
+    expect(worker.heldResponseCount).toBe(1)
+
+    controller.abort(reason)
+    expect((await opened).settlement).toEqual({
+      label: `init`,
+      status: `rejected`,
+      observation: { name: `AbortError`, message: `App stopped opening` },
+    })
+    expectDisposed(page, worker)
+    worker.releaseHeldResponses()
+    await vi.advanceTimersByTimeAsync(40)
+    expect(settlements).toHaveLength(1)
+    expect(worker.terminationCalls).toBe(1)
+  })
+
+  it(`does not create a worker for an already-aborted open`, async () => {
+    const page = installEnvironment({})
+    const controller = new AbortController()
+    const reason = new DOMException(`App stopped opening`, `AbortError`)
+    controller.abort(reason)
+
+    await expect(
+      openBrowserWASQLiteOPFSDatabase({
+        databaseName: `oracle.sqlite`,
+        signal: controller.signal,
+      }),
+    ).rejects.toBe(reason)
+    expect(ControlledWorker.instances).toEqual([])
+    expect(page.listenerCount).toBe(0)
+  })
+
+  it(`observes an abort during synchronous option evaluation`, async () => {
+    vi.useFakeTimers()
+    const page = installEnvironment({ heldResponseType: `init` })
+    const controller = new AbortController()
+    const reason = new DOMException(`App stopped opening`, `AbortError`)
+    const settlements: Array<Settlement> = []
+    let vfsNameReads = 0
+    const opened = track(
+      `init`,
+      openBrowserWASQLiteOPFSDatabase({
+        databaseName: `oracle.sqlite`,
+        timeoutMs: 0,
+        signal: controller.signal,
+        get vfsName() {
+          vfsNameReads++
+          controller.abort(reason)
+          return `opfs`
+        },
+      }),
+      () => `database`,
+      settlements,
+    )
+    const worker = ControlledWorker.instances[0]!
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(vfsNameReads).toBe(1)
+    expect(worker.requests.map((request) => request.type)).toEqual([`init`])
+    expect(settlements).toEqual([
+      {
+        label: `init`,
+        status: `rejected`,
+        observation: { name: `AbortError`, message: `App stopped opening` },
+      },
+    ])
+    expect((await opened).settlement).toEqual(settlements[0])
+    expectDisposed(page, worker)
+
+    worker.releaseHeldResponses()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(settlements).toHaveLength(1)
+  })
+
+  it(`allows an explicit zero deadline while the worker remains silent`, async () => {
+    vi.useFakeTimers()
+    const page = installEnvironment({ heldResponseType: `init` })
+    const settlements: Array<Settlement> = []
+    const opened = track(
+      `init`,
+      openBrowserWASQLiteOPFSDatabase({
+        databaseName: `oracle.sqlite`,
+        timeoutMs: 0,
+      }),
+      () => `database`,
+      settlements,
+    )
+    const worker = ControlledWorker.instances[0]!
+    await Promise.resolve()
+    expect(worker.heldResponseCount).toBe(1)
+
+    await vi.advanceTimersByTimeAsync(60_000)
+    expect(settlements).toEqual([])
+    expect(worker.terminationCalls).toBe(0)
+    worker.releaseHeldResponses()
+    const database = (await opened).value!
+    await database.close?.()
+    expectDisposed(page, worker)
+  })
+
+  it.each([-1, 0.5, Number.POSITIVE_INFINITY, 2_147_483_648])(
+    `rejects invalid open deadline %s before creating a worker`,
+    async (timeoutMs) => {
+      const page = installEnvironment({})
+      await expect(
+        openBrowserWASQLiteOPFSDatabase({
+          databaseName: `oracle.sqlite`,
+          timeoutMs,
+        }),
+      ).rejects.toMatchObject({
+        name: `InvalidPersistedCollectionConfigError`,
+      })
+      expect(ControlledWorker.instances).toEqual([])
+      expect(page.listenerCount).toBe(0)
+    },
+  )
+
+  it(`stops observing the deadline and signal after open succeeds`, async () => {
+    vi.useFakeTimers()
+    const page = installEnvironment({})
+    const controller = new AbortController()
+    const database = await openBrowserWASQLiteOPFSDatabase({
+      databaseName: `oracle.sqlite`,
+      timeoutMs: 40,
+      signal: controller.signal,
+    })
+    const worker = ControlledWorker.instances[0]!
+
+    await vi.advanceTimersByTimeAsync(40)
+    controller.abort()
+    expect(worker.terminationCalls).toBe(0)
+    await expect(database.execute(`SELECT 1`)).resolves.toEqual([
+      { sql: `SELECT 1` },
+    ])
+    await database.close?.()
+    expectDisposed(page, worker)
+  })
+})
diff --git a/packages/browser-db-sqlite-persistence/tests/opfs-request-order-oracle.ts b/packages/browser-db-sqlite-persistence/tests/opfs-request-order-oracle.ts
index d939e7d00b..ecf9ba3f79 100644
--- a/packages/browser-db-sqlite-persistence/tests/opfs-request-order-oracle.ts
+++ b/packages/browser-db-sqlite-persistence/tests/opfs-request-order-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 /**
  * # Does an OPFS connection answer requests in order and close after them?
  *
@@ -227,3 +228,8 @@ export const requestOrderExamples: Array<RequestOrderHistory> = (
     ),
   ),
 )
+
+declareOracle({
+  check: [findRequestOrderViolation],
+  model: [expectedRequestOrder],
+})
diff --git a/packages/browser-db-sqlite-persistence/tests/opfs-worker-diagnostics-oracle.test.ts b/packages/browser-db-sqlite-persistence/tests/opfs-worker-diagnostics-oracle.test.ts
index 4dd3f18970..0dd9f4bc07 100644
--- a/packages/browser-db-sqlite-persistence/tests/opfs-worker-diagnostics-oracle.test.ts
+++ b/packages/browser-db-sqlite-persistence/tests/opfs-worker-diagnostics-oracle.test.ts
@@ -6,6 +6,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import type {
   BrowserOPFSWorkerRequest,
   BrowserOPFSWorkerResponse,
@@ -328,6 +329,8 @@ TANSTACK_DB_ORACLE_SEED, TANSTACK_DB_ORACLE_PATH, and
 TANSTACK_DB_ORACLE_PROPERTY=opfs-worker.diagnostics for direct replay.
 TANSTACK_DB_ORACLE_RUNS_MULTIPLIER scales the generated campaign.
 */
+declareOracle({ check: [checkDiagnostic], model: [referenceMessage] })
+
 describe(`OPFS worker diagnostics oracle`, () => {
   if (!oracleReplayRequested()) {
     it.each(diagnosticExamples)(
diff --git a/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-oracle.test.ts b/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-oracle.test.ts
index 14a9fc19ad..0f7219d939 100644
--- a/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-oracle.test.ts
+++ b/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-oracle.test.ts
@@ -8,44 +8,72 @@ import {
   createCollection,
   createLiveQueryCollection,
   eq,
-  whenSyncAccepted,
 } from '@tanstack/db'
-import { QueryClient } from '@tanstack/query-core'
-import { queryCollectionOptions } from '@tanstack/query-db-collection'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { BrowserCollectionCoordinator } from '../src/browser-coordinator'
 import {
   createBrowserWASQLitePersistence,
   persistedCollectionOptions,
 } from '../src'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { createWASQLiteTestDatabase } from './helpers/wa-sqlite-test-db'
+import {
+  ControlledBroadcastChannel,
+  NO_PRIMARY_FAILURE,
+  captureCleanup,
+  complexSubsetDemand,
+  coordinatorFixtureSnapshot,
+  createCoordinator,
+  createRealTab,
+  createRecordingAdapter,
+  disposeCoordinator,
+  durableTerms,
+  envelopeCollection,
+  heldLocks,
+  installControlledBrowserSeams,
+  liveCoordinators,
+  payloadType,
+  pumpNetwork,
+  queuedLocks,
+  readCoordinatorOracleConfig,
+  registerCollectionAdapter,
+  remoteLeaseGrammarPlan,
+  restoreControlledBrowserSeams,
+  routingGrammarPlan,
+  routingHistoryFromAxes,
+  semanticValue,
+  subsetSemantics,
+  waitFor,
+  waitForWithoutDelivery,
+  withFailurePreservingCleanup,
+  withNativeBrowserTransport,
+} from './per-collection-coordinator-support'
+import type { BrowserCollectionCoordinator } from '../src/browser-coordinator'
 import type {
   PersistedCollectionCoordinator,
   PersistedMutationEnvelope,
-  PersistedStorageTarget,
-  PersistedTx,
   PersistenceAdapter,
   TransportedLoadSubsetOptions,
 } from '@tanstack/db-sqlite-persistence-core'
-import type {
-  Collection,
-  LoadSubsetOptions,
-  Subscription,
-  SyncConfig,
-} from '@tanstack/db'
+import type { LoadSubsetOptions, SyncConfig } from '@tanstack/db'
 import type { BrowserWASQLiteDatabase } from '../src'
+import type {
+  AdapterCall,
+  CleanupDiagnostic,
+  CollectionName,
+  CoordinatorOracleProperty,
+  PullFixtureResult,
+  RealTabRow,
+  RealTabSource,
+  RecordedSubsetOptions,
+  RecordingAdapter,
+  RemoteLeaseHistory,
+  RoutingHistory,
+  SemanticValue,
+  TabName,
+} from './per-collection-coordinator-support'
 
 const FIXED_SEED = 165902
-const DEFAULT_RUNS = 12
-const durableTerms = new Map<string, number>()
-
-type CoordinatorOracleProperty = `remote-lease` | `routing`
-type CoordinatorOracleEnvironment = Record<string, string | undefined>
-type CoordinatorOracleReplay = {
-  property: CoordinatorOracleProperty
-  seed: number
-  path: string
-}
+
 type CoordinatorOracleCampaign = {
   mode: `fixed` | `random` | `replay`
   parameters: {
@@ -55,45 +83,6 @@ type CoordinatorOracleCampaign = {
   }
 }
 
-function readCoordinatorOracleConfig(
-  environment: CoordinatorOracleEnvironment = process.env,
-): { runs: number; replay?: CoordinatorOracleReplay } {
-  const runText =
-    environment.TANSTACK_DB_COORDINATOR_ORACLE_RUNS ?? String(DEFAULT_RUNS)
-  const runs = Number(runText)
-  if (!/^\d+$/.test(runText) || !Number.isSafeInteger(runs) || runs < 1) {
-    throw new Error(`Invalid TANSTACK_DB_COORDINATOR_ORACLE_RUNS`)
-  }
-
-  const seedText = environment.TANSTACK_DB_COORDINATOR_ORACLE_SEED
-  const path = environment.TANSTACK_DB_COORDINATOR_ORACLE_PATH
-  const property = environment.TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY
-  if (seedText === undefined && path === undefined && property === undefined) {
-    return { runs }
-  }
-  if (seedText === undefined || path === undefined || property === undefined) {
-    throw new Error(
-      `Coordinator oracle replay requires SEED, PATH, and PROPERTY together`,
-    )
-  }
-
-  const seed = Number(seedText)
-  if (!/^-?\d+$/.test(seedText) || !Number.isSafeInteger(seed)) {
-    throw new Error(`Invalid TANSTACK_DB_COORDINATOR_ORACLE_SEED`)
-  }
-  if (!/^\d+(?::\d+)*$/.test(path)) {
-    throw new Error(
-      `TANSTACK_DB_COORDINATOR_ORACLE_PATH must be a numeric shrink path`,
-    )
-  }
-  if (property !== `remote-lease` && property !== `routing`) {
-    throw new Error(
-      `TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY must be remote-lease or routing`,
-    )
-  }
-  return { runs, replay: { property, seed, path } }
-}
-
 const { runs: RUNS, replay: REPLAY } = readCoordinatorOracleConfig()
 
 function coordinatorOracleCampaigns(
@@ -212,624 +201,6 @@ Reach, challenge, replay, cleanup, and limits:
   failure, plus cancellation on release and disposal.
 */
 
-type MessageHandler = (event: { data: unknown }) => void
-
-type DelayedDelivery = {
-  channel: string
-  source: ControlledBroadcastChannel
-  target: ControlledBroadcastChannel
-  data: unknown
-}
-
-type CloneAttempt = {
-  data: unknown
-  errorName?: string
-}
-
-class ControlledBroadcastChannel {
-  static readonly endpoints = new Map<string, Set<ControlledBroadcastChannel>>()
-  static readonly delayed: Array<DelayedDelivery> = []
-  static readonly cloneAttempts: Array<CloneAttempt> = []
-  static retiredDeliveries = 0
-
-  readonly name: string
-  onmessage: MessageHandler | null = null
-
-  constructor(name: string) {
-    this.name = name
-    const peers = ControlledBroadcastChannel.endpoints.get(name) ?? new Set()
-    peers.add(this)
-    ControlledBroadcastChannel.endpoints.set(name, peers)
-  }
-
-  postMessage(data: unknown): void {
-    let copy: unknown
-    try {
-      copy = structuredClone(data)
-      ControlledBroadcastChannel.cloneAttempts.push({ data })
-    } catch (error) {
-      ControlledBroadcastChannel.cloneAttempts.push({
-        data,
-        errorName: error instanceof Error ? error.name : String(error),
-      })
-      throw error
-    }
-
-    for (const target of ControlledBroadcastChannel.endpoints.get(this.name) ??
-      []) {
-      if (target === this || !target.onmessage) continue
-      ControlledBroadcastChannel.delayed.push({
-        channel: this.name,
-        source: this,
-        target,
-        data: copy,
-      })
-    }
-  }
-
-  close(): void {
-    const peers = ControlledBroadcastChannel.endpoints.get(this.name)
-    peers?.delete(this)
-    if (peers?.size === 0) {
-      ControlledBroadcastChannel.endpoints.delete(this.name)
-    }
-    for (
-      let index = ControlledBroadcastChannel.delayed.length - 1;
-      index >= 0;
-      index--
-    ) {
-      const delivery = ControlledBroadcastChannel.delayed[index]
-      if (delivery?.source === this || delivery?.target === this) {
-        ControlledBroadcastChannel.delayed.splice(index, 1)
-        ControlledBroadcastChannel.retiredDeliveries++
-      }
-    }
-    this.onmessage = null
-  }
-
-  static deliverAt(index: number): boolean {
-    const [delivery] = this.delayed.splice(index, 1)
-    if (!delivery) return false
-    delivery.target.onmessage?.({ data: delivery.data })
-    return true
-  }
-
-  static deliverWhere(predicate: (data: unknown) => boolean): boolean {
-    const index = this.delayed.findIndex((delivery) => predicate(delivery.data))
-    return index >= 0 ? this.deliverAt(index) : false
-  }
-
-  static reset(): void {
-    this.endpoints.clear()
-    this.delayed.length = 0
-    this.cloneAttempts.length = 0
-    this.retiredDeliveries = 0
-  }
-}
-
-type LockCallback = (lock: { name: string }) => Promise<unknown>
-type LockQueueEntry = {
-  callback: LockCallback
-  signal?: AbortSignal
-  resolve: (value: unknown) => void
-  reject: (error: unknown) => void
-}
-
-const heldLocks = new Set<string>()
-const queuedLocks = new Map<string, Array<LockQueueEntry>>()
-
-function grantNextLock(name: string): void {
-  if (heldLocks.has(name)) return
-  const queue = queuedLocks.get(name)
-  const next = queue?.shift()
-  if (!next) return
-  if (queue?.length === 0) queuedLocks.delete(name)
-  if (next.signal?.aborted) {
-    grantNextLock(name)
-    return
-  }
-
-  heldLocks.add(name)
-  void Promise.resolve(next.callback({ name })).then(
-    (value) => {
-      heldLocks.delete(name)
-      next.resolve(value)
-      grantNextLock(name)
-    },
-    (error) => {
-      heldLocks.delete(name)
-      next.reject(error)
-      grantNextLock(name)
-    },
-  )
-}
-
-const controlledLocks = {
-  request: (
-    name: string,
-    optionsOrCallback: { signal?: AbortSignal } | LockCallback,
-    maybeCallback?: LockCallback,
-  ): Promise<unknown> => {
-    const callback =
-      typeof optionsOrCallback === `function`
-        ? optionsOrCallback
-        : maybeCallback!
-    const signal =
-      typeof optionsOrCallback === `object`
-        ? optionsOrCallback.signal
-        : undefined
-
-    return new Promise((resolve, reject) => {
-      if (signal?.aborted) {
-        reject(new DOMException(`Lock request aborted`, `AbortError`))
-        return
-      }
-      const entry = { callback, signal, resolve, reject }
-      const queue = queuedLocks.get(name) ?? []
-      queue.push(entry)
-      queuedLocks.set(name, queue)
-      signal?.addEventListener(
-        `abort`,
-        () => {
-          const current = queuedLocks.get(name)
-          const index = current?.indexOf(entry) ?? -1
-          if (index >= 0) {
-            current!.splice(index, 1)
-            if (current!.length === 0) queuedLocks.delete(name)
-            reject(new DOMException(`Lock request aborted`, `AbortError`))
-          }
-        },
-        { once: true },
-      )
-      grantNextLock(name)
-    })
-  },
-}
-
-let originalBroadcastChannelDescriptor: PropertyDescriptor | undefined
-let originalNavigatorDescriptor: PropertyDescriptor | undefined
-
-function installControlledBrowserSeams(): void {
-  originalBroadcastChannelDescriptor = Object.getOwnPropertyDescriptor(
-    globalThis,
-    `BroadcastChannel`,
-  )
-  originalNavigatorDescriptor = Object.getOwnPropertyDescriptor(
-    globalThis,
-    `navigator`,
-  )
-  Object.defineProperty(globalThis, `BroadcastChannel`, {
-    value: ControlledBroadcastChannel,
-    writable: true,
-    configurable: true,
-  })
-  Object.defineProperty(globalThis, `navigator`, {
-    value: { locks: controlledLocks },
-    writable: true,
-    configurable: true,
-  })
-}
-
-function restoreControlledBrowserSeams(): void {
-  if (originalBroadcastChannelDescriptor) {
-    Object.defineProperty(
-      globalThis,
-      `BroadcastChannel`,
-      originalBroadcastChannelDescriptor,
-    )
-  } else {
-    Reflect.deleteProperty(globalThis, `BroadcastChannel`)
-  }
-  if (originalNavigatorDescriptor) {
-    Object.defineProperty(globalThis, `navigator`, originalNavigatorDescriptor)
-  } else {
-    Reflect.deleteProperty(globalThis, `navigator`)
-  }
-  originalBroadcastChannelDescriptor = undefined
-  originalNavigatorDescriptor = undefined
-}
-
-function payloadType(data: unknown): string | undefined {
-  if (!data || typeof data !== `object` || !(`payload` in data))
-    return undefined
-  const payload = (data as { payload?: unknown }).payload
-  if (!payload || typeof payload !== `object` || !(`type` in payload)) {
-    return undefined
-  }
-  return String((payload as { type?: unknown }).type)
-}
-
-function envelopeCollection(data: unknown): string | undefined {
-  if (!data || typeof data !== `object` || !(`collectionId` in data)) {
-    return undefined
-  }
-  return String((data as { collectionId?: unknown }).collectionId)
-}
-
-async function pumpNetwork(): Promise<void> {
-  for (let pass = 0; pass < 100; pass++) {
-    while (ControlledBroadcastChannel.deliverAt(0)) {
-      await Promise.resolve()
-    }
-    await nextTurn()
-    if (ControlledBroadcastChannel.delayed.length === 0) return
-  }
-  throw new Error(`controlled network failed to become idle`)
-}
-
-async function waitFor(
-  predicate: () => boolean,
-  checkpoint: string,
-): Promise<void> {
-  for (let pass = 0; pass < 100; pass++) {
-    if (predicate()) return
-    await pumpNetwork()
-    await nextTurn()
-  }
-  throw new Error(`did not reach ${checkpoint}`)
-}
-
-async function waitForWithoutDelivery(
-  predicate: () => boolean,
-  checkpoint: string,
-): Promise<void> {
-  for (let pass = 0; pass < 100; pass++) {
-    if (predicate()) return
-    await nextTurn()
-  }
-  throw new Error(`did not reach ${checkpoint}`)
-}
-
-type CleanupDiagnostic = {
-  resource: string
-  error: string
-}
-
-const NO_PRIMARY_FAILURE = Symbol(`no-primary-failure`)
-
-async function captureCleanup(
-  diagnostics: Array<CleanupDiagnostic>,
-  resource: string,
-  cleanup: () => Promise<void> | void,
-): Promise<void> {
-  try {
-    await cleanup()
-  } catch (error) {
-    diagnostics.push({
-      resource,
-      error:
-        error instanceof Error
-          ? `${error.name}: ${error.message}`
-          : String(error),
-    })
-  }
-}
-
-async function withFailurePreservingCleanup(
-  body: () => Promise<void>,
-  cleanups: ReadonlyArray<readonly [string, () => Promise<void> | void]>,
-): Promise<void> {
-  let primaryFailure: unknown | typeof NO_PRIMARY_FAILURE = NO_PRIMARY_FAILURE
-  const cleanupDiagnostics: Array<CleanupDiagnostic> = []
-  try {
-    await body()
-  } catch (error) {
-    primaryFailure = error
-  }
-  for (const [resource, cleanup] of cleanups) {
-    await captureCleanup(cleanupDiagnostics, resource, cleanup)
-  }
-  expect.soft(cleanupDiagnostics).toEqual([])
-  if (primaryFailure !== NO_PRIMARY_FAILURE) throw primaryFailure
-}
-
-type AdapterCall = {
-  operation: `load` | `apply` | `index` | `position` | `remote-subset` | `pull`
-  adapterId: string
-  collectionId: string
-  ownerAtCall?: string
-  argument?: SemanticValue
-}
-
-type PullFixtureResult = {
-  latestRowVersion: number
-  requiresFullReload: false
-  changedKeys: Array<string | number>
-  deletedKeys: Array<string | number>
-}
-
-type RecordedSubsetOptions = LoadSubsetOptions | TransportedLoadSubsetOptions
-
-function storageId(target: PersistedStorageTarget): string {
-  return target.kind === `managed`
-    ? target.storageCollectionId
-    : target.collectionId
-}
-
-type RecordingAdapter = PersistenceAdapter & {
-  id: string
-  schemaVersion: number
-  policy: `sync-present-reset` | `sync-absent-error`
-  calls: Array<AdapterCall>
-  getStreamPosition: (target: PersistedStorageTarget) => Promise<{
-    latestTerm: number
-    latestSeq: number
-    latestRowVersion: number
-  }>
-  ensureRemoteSubset: (
-    collectionId: string,
-    options: RecordedSubsetOptions,
-  ) => Promise<void>
-  pullSince: (
-    target: PersistedStorageTarget,
-    fromRowVersion: number,
-  ) => Promise<PullFixtureResult>
-}
-
-function createRecordingAdapter(options: {
-  id: string
-  schemaVersion?: number
-  policy?: RecordingAdapter[`policy`]
-  owner?: () => string | undefined
-  remoteSubsetOwner?: (
-    collectionId: string,
-    options: RecordedSubsetOptions,
-  ) => Promise<void>
-  pullResult?: PullFixtureResult
-}): RecordingAdapter {
-  const calls: Array<AdapterCall> = []
-  const record = (
-    operation: AdapterCall[`operation`],
-    collectionId: string,
-    argument?: SemanticValue,
-  ) => {
-    calls.push({
-      operation,
-      adapterId: options.id,
-      collectionId,
-      ownerAtCall: options.owner?.(),
-      ...(argument === undefined ? {} : { argument }),
-    })
-  }
-
-  return {
-    id: options.id,
-    schemaVersion: options.schemaVersion ?? 1,
-    policy: options.policy ?? `sync-present-reset`,
-    calls,
-    loadSubset: (target) => {
-      record(`load`, storageId(target))
-      return Promise.resolve([])
-    },
-    loadResumeSnapshot: () =>
-      Promise.resolve({
-        rows: [],
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }),
-    applyCommittedTx: (target) => {
-      record(`apply`, storageId(target))
-      return Promise.resolve()
-    },
-    ensureIndex: (target, signature, spec) => {
-      record(`index`, storageId(target), semanticValue({ signature, spec }))
-      return Promise.resolve()
-    },
-    getStreamPosition: (target) => {
-      record(`position`, storageId(target))
-      return Promise.resolve({
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-      })
-    },
-    async reserveLeadershipTerm(target, observedTerm) {
-      const collectionId = storageId(target)
-      const position = await this.getStreamPosition(target)
-      const latestTerm =
-        Math.max(
-          position.latestTerm,
-          durableTerms.get(collectionId) ?? 0,
-          observedTerm,
-        ) + 1
-      durableTerms.set(collectionId, latestTerm)
-      return { ...position, latestTerm }
-    },
-    ensureRemoteSubset: (collectionId, subsetOptions) => {
-      record(`remote-subset`, collectionId, subsetSemantics(subsetOptions))
-      if (!options.remoteSubsetOwner) {
-        throw new Error(`no remote subset owner for ${collectionId}`)
-      }
-      return options.remoteSubsetOwner(collectionId, subsetOptions)
-    },
-    pullSince: (target, fromRowVersion) => {
-      record(`pull`, storageId(target), semanticValue({ fromRowVersion }))
-      const result = options.pullResult ?? {
-        latestRowVersion: 0,
-        requiresFullReload: false,
-        changedKeys: [],
-        deletedKeys: [],
-      }
-      return Promise.resolve(structuredClone(result))
-    },
-  }
-}
-
-// The storage oracle exercises the SQLite generation catalog. This small
-// adapter supplies only its public claim/rotation result so the Browser owner
-// oracle can judge the separate coordinator boundary with two live sync runs.
-function createGenerationRecordingAdapter(
-  id: string,
-  claimExpired: () => boolean = () => false,
-): RecordingAdapter & { currentStorageId: () => string } {
-  const adapter = createRecordingAdapter({ id })
-  let currentStorageId = `cache-generation-0`
-  let nextGeneration = 1
-  let nextClaim = 0
-  const claims = new Map<string, string>()
-  adapter.claimCacheGeneration = () => {
-    const claimId = `${id}-claim-${++nextClaim}`
-    claims.set(claimId, currentStorageId)
-    return Promise.resolve({ storageCollectionId: currentStorageId, claimId })
-  }
-  adapter.rotateCacheGeneration = (_collectionId, claimId) => {
-    if (claims.get(claimId) !== currentStorageId && !claimExpired()) {
-      return Promise.reject(new Error(`recovery lost its cache claim`))
-    }
-    const storageCollectionId = `cache-generation-${nextGeneration++}`
-    if (!claimExpired()) currentStorageId = storageCollectionId
-    claims.set(claimId, storageCollectionId)
-    return Promise.resolve({ storageCollectionId, claimId })
-  }
-  adapter.renewCacheGenerationClaim = (storageCollectionId, claimId) =>
-    Promise.resolve(
-      !claimExpired() && claims.get(claimId) === storageCollectionId
-        ? Date.now() + 10_000
-        : undefined,
-    )
-  adapter.releaseCacheGenerationClaim = (claimId) => {
-    claims.delete(claimId)
-    return Promise.resolve()
-  }
-  return Object.assign(adapter, { currentStorageId: () => currentStorageId })
-}
-
-type SemanticValue =
-  | null
-  | boolean
-  | number
-  | string
-  | Array<SemanticValue>
-  | { [key: string]: SemanticValue }
-
-function semanticValue(value: unknown): SemanticValue {
-  if (
-    value === null ||
-    typeof value === `boolean` ||
-    typeof value === `number` ||
-    typeof value === `string`
-  ) {
-    return value
-  }
-  if (value instanceof Date) return { date: value.toISOString() }
-  if (value instanceof Uint8Array) return { bytes: Array.from(value) }
-  if (Array.isArray(value)) return value.map(semanticValue)
-  if (typeof value === `object`) {
-    return Object.fromEntries(
-      Object.entries(value)
-        .sort(([left], [right]) => left.localeCompare(right))
-        .map(([key, entry]) => [key, semanticValue(entry)]),
-    )
-  }
-  throw new Error(`unsupported semantic wire value: ${typeof value}`)
-}
-
-function subsetSemantics(
-  options: LoadSubsetOptions | TransportedLoadSubsetOptions,
-): SemanticValue {
-  return semanticValue({
-    ...(options.where === undefined ? {} : { where: options.where }),
-    ...(options.orderBy === undefined ? {} : { orderBy: options.orderBy }),
-    ...(options.limit === undefined ? {} : { limit: options.limit }),
-    ...(options.cursor === undefined ? {} : { cursor: options.cursor }),
-    ...(options.offset === undefined ? {} : { offset: options.offset }),
-  })
-}
-
-function complexSubsetDemand(includeSubscription: boolean): LoadSubsetOptions {
-  return {
-    where: new IR.Func(`eq`, [
-      new IR.PropRef([`alpha`, `createdAt`]),
-      new IR.Value(new Date(`2026-09-16T12:34:56.000Z`)),
-    ]),
-    orderBy: [
-      {
-        expression: new IR.PropRef([`alpha`, `score`]),
-        compareOptions: { direction: `desc`, nulls: `last` },
-      },
-    ],
-    limit: 3,
-    cursor: {
-      whereFrom: new IR.Func(`gt`, [
-        new IR.PropRef([`alpha`, `token`]),
-        new IR.Value(new Uint8Array([1, 2, 255])),
-      ]),
-      whereCurrent: new IR.Func(`eq`, [
-        new IR.PropRef([`alpha`, `score`]),
-        new IR.Value(42),
-      ]),
-      lastKey: `a-42`,
-    },
-    offset: 1,
-    ...(includeSubscription
-      ? {
-          subscription: {
-            on: () => () => {},
-          } as unknown as Subscription,
-        }
-      : {}),
-  }
-}
-
-const liveCoordinators = new Set<BrowserCollectionCoordinator>()
-
-function createCoordinator(
-  dbName: string,
-  adapter: PersistenceAdapter,
-): BrowserCollectionCoordinator {
-  const coordinator = new BrowserCollectionCoordinator({ dbName, adapter })
-  liveCoordinators.add(coordinator)
-  return coordinator
-}
-
-function registerCollectionAdapter(
-  coordinator: BrowserCollectionCoordinator,
-  collectionId: string,
-  adapter: RecordingAdapter,
-  registerOwner: boolean = true,
-): void {
-  coordinator.setAdapterForCollection(collectionId, adapter)
-  if (!registerOwner) return
-  coordinator.registerRemoteSubsetOwner(
-    collectionId,
-    Object.assign(
-      (options: TransportedLoadSubsetOptions) =>
-        adapter.ensureRemoteSubset(collectionId, options),
-      {
-        // These route/wire laws do not exercise acquisition-release semantics; the
-        // dedicated remote-ownership oracle below owns exact unload behavior.
-        unloadSubset: () => {},
-        onError: () => {},
-      },
-    ),
-  )
-}
-
-async function disposeCoordinator(
-  coordinator?: BrowserCollectionCoordinator,
-): Promise<void> {
-  if (!coordinator || !liveCoordinators.has(coordinator)) return
-  coordinator.dispose()
-  liveCoordinators.delete(coordinator)
-  await nextTurn()
-}
-
-function coordinatorFixtureSnapshot() {
-  return {
-    delayed: ControlledBroadcastChannel.delayed.length,
-    endpoints: ControlledBroadcastChannel.endpoints.size,
-    heldLocks: heldLocks.size,
-    queuedLocks: Array.from(queuedLocks.values()).reduce(
-      (count, queue) => count + queue.length,
-      0,
-    ),
-  }
-}
-
 beforeEach(() => {
   durableTerms.clear()
   installControlledBrowserSeams()
@@ -1072,255 +443,51 @@ describe(`per-collection coordinator wire and acknowledgement oracle`, () => {
     ).toContain(`subset-semantics-mismatch`)
   })
 
-  it(`round-trips supported subset semantics across the emitted message partition`, async () => {
-    const leaderAdapter = createRecordingAdapter({
-      id: `partition-leader`,
-      remoteSubsetOwner: () => Promise.resolve(),
-    })
-    const followerAdapter = createRecordingAdapter({ id: `partition-follower` })
+  it(`calibrates acknowledgement checks against entry-only and false-success faults`, () => {
+    const expected = subsetSemantics(complexSubsetDemand(false))
+    const allowed: SubsetAckTrace = {
+      ownerInvocation: `coordinator`,
+      decoded: expected,
+      expected,
+      prematureResponses: 0,
+      acknowledgedBeforeResponseDelivery: false,
+      ownerCompletedBeforeResponse: true,
+      acknowledgedAfterResponseDelivery: true,
+    }
+    expect(subsetAckViolations(allowed)).toEqual([])
+    expect(
+      subsetAckViolations({
+        ...allowed,
+        ownerCompletedBeforeResponse: false,
+      }),
+    ).toContain(`response-before-owner-completion-checkpoint`)
+    expect(
+      subsetAckViolations({
+        ...allowed,
+        ownerInvocation: `fixture-fallback`,
+        prematureResponses: 1,
+      }),
+    ).toEqual([
+      `leader-owner-not-invoked-by-coordinator`,
+      `response-before-owner-completion`,
+    ])
+  })
+
+  it(`acknowledges a follower subset only after the leader source completed it`, async () => {
+    const upstreamEvents: Array<{
+      phase: `entered` | `completed`
+      semantics: SemanticValue
+    }> = []
+    const releases: Array<() => void> = []
+    const ownerDelegate: {
+      invoke?: (
+        collectionId: string,
+        options: RecordedSubsetOptions,
+      ) => Promise<void>
+    } = {}
     let leader: BrowserCollectionCoordinator | undefined
     let follower: BrowserCollectionCoordinator | undefined
-
-    await withFailurePreservingCleanup(async () => {
-      leader = createCoordinator(`wire-partition`, leaderAdapter)
-      follower = createCoordinator(`wire-partition`, followerAdapter)
-      registerCollectionAdapter(leader, `alpha`, leaderAdapter)
-      registerCollectionAdapter(follower, `alpha`, followerAdapter)
-      leader.subscribe(`alpha`, () => {})
-      follower.subscribe(`alpha`, () => {})
-      await waitFor(
-        () => leader!.isLeader(`alpha`) && !follower!.isLeader(`alpha`),
-        `wire partition leader/follower topology`,
-      )
-
-      const demand = complexSubsetDemand(false)
-      const subsetRequest = follower.requestEnsureRemoteSubset(`alpha`, demand)
-      const queuedSubset = ControlledBroadcastChannel.delayed.find(
-        ({ data }) => payloadType(data) === `rpc:ensureRemoteSubset:req`,
-      )?.data as { payload?: { options?: LoadSubsetOptions } } | undefined
-      expect(subsetSemantics(queuedSubset?.payload?.options ?? {})).toEqual(
-        subsetSemantics(demand),
-      )
-      await pumpNetwork()
-      await subsetRequest
-
-      const mutationValue = {
-        id: `native-values`,
-        at: new Date(`2026-09-16T12:34:56.000Z`),
-        bytes: new Uint8Array([0, 127, 255]),
-      }
-      const mutationRequest = follower.requestApplyLocalMutations(`alpha`, [
-        {
-          mutationId: `native-values`,
-          type: `insert`,
-          key: `native-values`,
-          value: mutationValue,
-        },
-      ])
-      const queuedMutation = ControlledBroadcastChannel.delayed.find(
-        ({ data }) => payloadType(data) === `rpc:applyLocalMutations:req`,
-      )?.data as
-        | {
-            payload?: {
-              mutations?: Array<{ value?: unknown }>
-            }
-          }
-        | undefined
-      expect(
-        semanticValue(queuedMutation?.payload?.mutations?.[0]?.value),
-      ).toEqual(semanticValue(mutationValue))
-      await pumpNetwork()
-      await mutationRequest
-
-      const committedTx: PersistedTx = {
-        txId: `committed-native-values`,
-        term: 0,
-        seq: 0,
-        rowVersion: 0,
-        mutations: [
-          {
-            type: `update`,
-            key: `native-values`,
-            value: mutationValue,
-          },
-        ],
-        rowMetadataMutations: [
-          {
-            type: `set`,
-            key: `native-values`,
-            value: { source: `wire-partition` },
-          },
-        ],
-        collectionMetadataMutations: [
-          { type: `set`, key: `resume`, value: { offset: 4 } },
-        ],
-      }
-      const committedRequest = follower.requestApplyCommittedTx(
-        `alpha`,
-        committedTx,
-      )
-      const queuedCommitted = ControlledBroadcastChannel.delayed.find(
-        ({ data }) => payloadType(data) === `rpc:applyCommittedTx:req`,
-      )?.data as { payload?: { tx?: PersistedTx } } | undefined
-      expect(semanticValue(queuedCommitted?.payload?.tx)).toEqual(
-        semanticValue(committedTx),
-      )
-      await pumpNetwork()
-      const committedResponse = await committedRequest
-      expect(committedResponse).toEqual({
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: expect.any(String),
-        ok: true,
-        term: 1,
-        seq: 2,
-        latestRowVersion: 2,
-      })
-
-      const successfulPayloads = ControlledBroadcastChannel.cloneAttempts
-        .filter(({ errorName }) => errorName === undefined)
-        .map(({ data }) =>
-          data && typeof data === `object` && `payload` in data
-            ? (data as { payload?: unknown }).payload
-            : undefined,
-        )
-      const matchingCommittedResponses = successfulPayloads.filter(
-        (payload) =>
-          payload !== undefined &&
-          payload !== null &&
-          typeof payload === `object` &&
-          `type` in payload &&
-          payload.type === `rpc:applyCommittedTx:res` &&
-          `rpcId` in payload &&
-          payload.rpcId === committedResponse.rpcId,
-      )
-      const matchingCommittedEvents = successfulPayloads.filter(
-        (payload) =>
-          payload !== undefined &&
-          payload !== null &&
-          typeof payload === `object` &&
-          `type` in payload &&
-          payload.type === `tx:committed` &&
-          `txId` in payload &&
-          payload.txId === committedTx.txId,
-      )
-      expect(matchingCommittedResponses).toEqual([committedResponse])
-      expect(matchingCommittedEvents).toEqual([
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 2,
-          txId: `committed-native-values`,
-          latestRowVersion: 2,
-          requiresFullReload: false,
-          changedRows: [{ key: `native-values`, value: mutationValue }],
-          deletedKeys: [],
-          rowMetadataMutations: [
-            {
-              type: `set`,
-              key: `native-values`,
-              value: { source: `wire-partition` },
-            },
-          ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `resume`, value: { offset: 4 } },
-          ],
-        },
-      ])
-
-      const indexRequest = follower.requestEnsurePersistedIndex(
-        `alpha`,
-        `score-index`,
-        { expressionSql: [`score`] },
-      )
-      await pumpNetwork()
-      await indexRequest
-      const pullRequest = follower.pullSince(`alpha`, 0)
-      await pumpNetwork()
-      await pullRequest
-
-      const successfulTypes = new Set(
-        ControlledBroadcastChannel.cloneAttempts
-          .filter(({ errorName }) => errorName === undefined)
-          .map(({ data }) => payloadType(data))
-          .filter((type): type is string => type !== undefined),
-      )
-      expect(successfulTypes).toEqual(
-        new Set([
-          `leader:heartbeat`,
-          `rpc:ensureRemoteSubset:req`,
-          `rpc:ensureRemoteSubset:res`,
-          `rpc:applyLocalMutations:req`,
-          `rpc:applyLocalMutations:res`,
-          `rpc:applyCommittedTx:req`,
-          `rpc:applyCommittedTx:res`,
-          `tx:committed`,
-          `rpc:ensurePersistedIndex:req`,
-          `rpc:ensurePersistedIndex:res`,
-          `rpc:pullSince:req`,
-          `rpc:pullSince:res`,
-        ]),
-      )
-    }, [
-      [
-        `wire partition leader`,
-        async () => {
-          await disposeCoordinator(leader)
-        },
-      ],
-      [
-        `wire partition follower`,
-        async () => {
-          await disposeCoordinator(follower)
-        },
-      ],
-    ])
-  })
-
-  it(`calibrates acknowledgement checks against entry-only and false-success faults`, () => {
-    const expected = subsetSemantics(complexSubsetDemand(false))
-    const allowed: SubsetAckTrace = {
-      ownerInvocation: `coordinator`,
-      decoded: expected,
-      expected,
-      prematureResponses: 0,
-      acknowledgedBeforeResponseDelivery: false,
-      ownerCompletedBeforeResponse: true,
-      acknowledgedAfterResponseDelivery: true,
-    }
-    expect(subsetAckViolations(allowed)).toEqual([])
-    expect(
-      subsetAckViolations({
-        ...allowed,
-        ownerCompletedBeforeResponse: false,
-      }),
-    ).toContain(`response-before-owner-completion-checkpoint`)
-    expect(
-      subsetAckViolations({
-        ...allowed,
-        ownerInvocation: `fixture-fallback`,
-        prematureResponses: 1,
-      }),
-    ).toEqual([
-      `leader-owner-not-invoked-by-coordinator`,
-      `response-before-owner-completion`,
-    ])
-  })
-
-  it(`acknowledges a follower subset only after the leader source completed it`, async () => {
-    const upstreamEvents: Array<{
-      phase: `entered` | `completed`
-      semantics: SemanticValue
-    }> = []
-    const releases: Array<() => void> = []
-    const ownerDelegate: {
-      invoke?: (
-        collectionId: string,
-        options: RecordedSubsetOptions,
-      ) => Promise<void>
-    } = {}
-    let leader: BrowserCollectionCoordinator | undefined
-    let follower: BrowserCollectionCoordinator | undefined
-    let cleanupLeaderCollection: (() => Promise<void>) | undefined
+    let cleanupLeaderCollection: (() => Promise<void>) | undefined
 
     await withFailurePreservingCleanup(async () => {
       const leaderAdapter = createRecordingAdapter({
@@ -1627,943 +794,126 @@ function remoteLeaseTakeoverViolations(
 ): Array<RemoteLeaseTakeoverViolation> {
   const violations: Array<RemoteLeaseTakeoverViolation> = []
   for (const checkpoint of Object.keys(
-    expectedRemoteLeaseTakeoverTrace,
-  ) as Array<keyof RemoteLeaseTakeoverTrace>) {
-    const expected = expectedRemoteLeaseTakeoverTrace[checkpoint]
-    for (const field of Object.keys(expected) as Array<keyof typeof expected>) {
-      if (actual[checkpoint][field] !== expected[field]) {
-        violations.push({
-          checkpoint,
-          field,
-          expected: expected[field],
-          actual: actual[checkpoint][field],
-        })
-      }
-    }
-  }
-  return violations
-}
-
-type CollectionScopedLeaseSnapshot = Record<
-  `alpha` | `beta`,
-  { loads: number; unloads: number; active: number }
->
-
-function collectionScopedLeaseViolations(
-  actual: CollectionScopedLeaseSnapshot,
-  expected: CollectionScopedLeaseSnapshot,
-): Array<string> {
-  const violations: Array<string> = []
-  for (const collectionId of [`alpha`, `beta`] as const) {
-    for (const field of [`loads`, `unloads`, `active`] as const) {
-      if (actual[collectionId][field] !== expected[collectionId][field]) {
-        violations.push(`${collectionId}:${field}`)
-      }
-    }
-  }
-  return violations
-}
-
-type RemoteLeaseHistory = {
-  siblingCount: number
-  releasePrefix: number
-  identical: boolean
-  duplicateRelease: boolean
-  reverseFinalRelease: boolean
-}
-
-type RemoteLeaseHistoryTrace = {
-  firstAfterAcquire: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
-  firstAfterPrefixRelease: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
-  firstAfterTakeover: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
-  secondAfterTakeover: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
-  secondAfterFinalRelease: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
-}
-
-// Grammar bounds: one to three sibling demands, zero to two prefix releases,
-// and both values of each identity, duplicate-release, and final-order switch.
-// The surviving-demand law keeps at least one acquisition through takeover:
-// the marginal plans are one sibling with no prefix release and three siblings
-// with two prefix releases. Zero siblings, release before acquisition, and a
-// prefix that retires every demand are outside this generated history.
-const remoteLeaseHistoryArbitrary = fc.record({
-  siblingCount: fc.integer({ min: 1, max: 3 }),
-  releasePrefix: fc.integer({ min: 0, max: 2 }),
-  identical: fc.boolean(),
-  duplicateRelease: fc.boolean(),
-  reverseFinalRelease: fc.boolean(),
-})
-
-type RemoteLeaseGrammarPlan = {
-  demands: Array<{ limit: number; offset?: number }>
-  releaseCount: number
-  prefixReleaseIndexes: Array<number>
-  finalReleaseIndexes: Array<number>
-  releasePasses: number
-}
-
-function remoteLeaseGrammarPlan(
-  history: RemoteLeaseHistory,
-): RemoteLeaseGrammarPlan {
-  const demands = Array.from(
-    { length: history.siblingCount },
-    (_unused, index) => ({
-      limit: 1,
-      ...(history.identical ? {} : { offset: index }),
-    }),
-  )
-  const releaseCount = Math.min(history.releasePrefix, history.siblingCount - 1)
-  const prefixReleaseIndexes = Array.from(
-    { length: releaseCount },
-    (_unused, index) => index,
-  )
-  const finalReleaseIndexes = Array.from(
-    { length: history.siblingCount - releaseCount },
-    (_unused, index) => releaseCount + index,
-  )
-  if (history.reverseFinalRelease) finalReleaseIndexes.reverse()
-  return {
-    demands,
-    releaseCount,
-    prefixReleaseIndexes,
-    finalReleaseIndexes,
-    releasePasses: history.duplicateRelease ? 2 : 1,
-  }
-}
-
-// Every accepted physical acquisition remains active until its exact
-// acquisition lease is released. Leadership transfer releases retired-owner
-// acquisitions and establishes replacements only for surviving demand.
-function remoteLeaseHistoryViolations(
-  history: RemoteLeaseHistory,
-  actual: RemoteLeaseHistoryTrace,
-): Array<RemoteLeaseTakeoverViolation> {
-  const { releaseCount } = remoteLeaseGrammarPlan(history)
-  const remaining = history.siblingCount - releaseCount
-  const expected: RemoteLeaseHistoryTrace = {
-    firstAfterAcquire: {
-      loads: history.siblingCount,
-      unloads: 0,
-      active: history.siblingCount,
-      exactUnloads: true,
-    },
-    firstAfterPrefixRelease: {
-      loads: history.siblingCount,
-      unloads: releaseCount,
-      active: remaining,
-      exactUnloads: true,
-    },
-    firstAfterTakeover: {
-      loads: history.siblingCount,
-      unloads: history.siblingCount,
-      active: 0,
-      exactUnloads: true,
-    },
-    secondAfterTakeover: {
-      loads: remaining,
-      unloads: 0,
-      active: remaining,
-      exactUnloads: true,
-    },
-    secondAfterFinalRelease: {
-      loads: remaining,
-      unloads: remaining,
-      active: 0,
-      exactUnloads: true,
-    },
-  }
-  const violations: Array<RemoteLeaseTakeoverViolation> = []
-  for (const checkpoint of Object.keys(expected) as Array<
-    keyof RemoteLeaseHistoryTrace
-  >) {
-    for (const field of Object.keys(expected[checkpoint]) as Array<
-      keyof ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
-    >) {
-      if (actual[checkpoint][field] !== expected[checkpoint][field]) {
-        violations.push({
-          checkpoint,
-          field,
-          expected: expected[checkpoint][field],
-          actual: actual[checkpoint][field],
-        })
-      }
-    }
-  }
-  return violations
-}
-
-describe(`persisted cache generation routing oracle`, () => {
-  // A cache generation is a routing boundary, while the public Collection ID
-  // remains the same. The independent model has two run-local source owners:
-  // after the second run loses its resume authority, its demand belongs to
-  // its new generation; the warm run retains its old source row and owner.
-  // The legal history is warm start, source commit, second start, scoped
-  // recovery, then one retained demand and one new demand. Real persisted
-  // wrappers and Browser coordinators drive that history. At each demand
-  // settlement, compare source-call counts, old acquisition release, and the
-  // warm public row. The controlled browser seam
-  // does not establish native multi-tab or OPFS behavior; the SQLite owner
-  // separately proves durable generation separation.
-  it(`routes a recovering run's demand to its own source while a warm run keeps its row`, async () => {
-    type Row = { id: string; title: string }
-    const collectionId = `shared-public-collection`
-    const adapter = createGenerationRecordingAdapter(`shared-cache`)
-    const warmCoordinator = createCoordinator(`generation-routing`, adapter)
-    const recoveringCoordinator = createCoordinator(
-      `generation-routing`,
-      adapter,
-    )
-    let warmSource!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-    let recoveringSource!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-    let warmStarted = false
-    let recoveringStarted = false
-    let warmLoads = 0
-    let warmUnloads = 0
-    let recoveringLoads = 0
-    let recoveringRefetches = 0
-    let releaseWarmLoad!: () => void
-    const warmLoadGate = new Promise<void>((resolve) => {
-      releaseWarmLoad = resolve
-    })
-    let warmCollection: Collection<Row, string> | undefined
-    let recoveringCollection: Collection<Row, string> | undefined
-    const cleanupCollection = async (
-      collection: Collection<Row, string> | undefined,
-      checkpoint: string,
-    ) => {
-      if (!collection) return
-      let settled = false
-      const cleanup = collection.cleanup().finally(() => {
-        settled = true
-      })
-      await waitFor(() => settled, checkpoint)
-      await cleanup
-    }
-
-    await withFailurePreservingCleanup(async () => {
-      warmCollection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              warmSource = params
-              warmStarted = true
-              params.markReady()
-              return {
-                loadSubset: () => {
-                  warmLoads++
-                  return warmLoadGate
-                },
-                unloadSubset: () => {
-                  warmUnloads++
-                  releaseWarmLoad()
-                },
-              }
-            },
-          },
-          persistence: { adapter, coordinator: warmCoordinator },
-        }),
-      )
-      warmCollection.startSyncImmediate()
-      await waitFor(() => warmStarted, `warm source start`)
-      const warmRow = { id: `warm`, title: `Source-backed row` }
-      warmSource.begin()
-      warmSource.write({ type: `insert`, value: warmRow })
-      let warmCommitted = false
-      const warmCommit = Promise.resolve(
-        whenSyncAccepted(warmSource.commit()),
-      ).then(() => {
-        warmCommitted = true
-      })
-      await waitFor(() => warmCommitted, `warm source commit`)
-      await warmCommit
-
-      recoveringCollection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              recoveringSource = params
-              recoveringStarted = true
-              params.markReady()
-              return {
-                // This controlled source has no delayed provider callback.
-                restartAfterScopedRecovery: () => {},
-                loadSubset: (options) => {
-                  recoveringLoads++
-                  if (options.refetch) recoveringRefetches++
-                  return Promise.resolve()
-                },
-              }
-            },
-          },
-          persistence: { adapter, coordinator: recoveringCoordinator },
-        }),
-      )
-      recoveringCollection.startSyncImmediate()
-      await waitFor(() => recoveringStarted, `recovering source`)
-      const retainedDemand = { limit: 1 }
-      let firstSettled = false
-      const firstLoad = Promise.resolve(
-        recoveringCollection._sync.loadSubset(retainedDemand),
-      ).then(() => {
-        firstSettled = true
-      })
-      await waitFor(() => warmLoads === 1, `held pre-recovery demand`)
-      expect(firstSettled).toBe(false)
-      expect({ warmLoads, recoveringLoads }).toEqual({
-        warmLoads: 1,
-        recoveringLoads: 0,
-      })
-
-      let recoverySettled = false
-      const oldStorageId = adapter.currentStorageId()
-      const recovery = recoveringSource.metadata!.persistence!
-        .startScopedRecovery!().then(() => {
-        recoverySettled = true
-      })
-      // Hold the old leader's release acknowledgement while delivering every
-      // other message. The new cache has its own route, so its source demand
-      // must start before that old leader resumes.
-      const isOldRelease = (data: unknown) =>
-        payloadType(data) === `rpc:releaseRemoteSubset:req` &&
-        envelopeCollection(data) === oldStorageId
-      let heldOldRelease = false
-      for (let pass = 0; pass < 100; pass++) {
-        heldOldRelease ||= ControlledBroadcastChannel.delayed.some((delivery) =>
-          isOldRelease(delivery.data),
-        )
-        while (
-          ControlledBroadcastChannel.deliverWhere((data) => !isOldRelease(data))
-        ) {
-          await Promise.resolve()
-        }
-        if (heldOldRelease && recoveringLoads > 0) break
-        await nextTurn()
-      }
-      const loadsBeforeOldRelease = recoveringLoads
-      ControlledBroadcastChannel.deliverWhere(isOldRelease)
-      await pumpNetwork()
-      expect(heldOldRelease).toBe(true)
-      expect(loadsBeforeOldRelease).toBe(1)
-      await waitFor(() => recoverySettled, `scoped recovery with active demand`)
-      await recovery
-      await firstLoad
-      await waitFor(
-        () => recoveringLoads === 1,
-        `retained demand reacquisition`,
-      )
-      expect(recoveringRefetches).toBe(1)
-      expect(warmUnloads).toBe(1)
-
-      // The checkpoint is the settled physical acquisition. A wrong design
-      // using the public ID for both runs sends this request to the warm
-      // leader; a generation-qualified route sends it to the new owner.
-      let settled = false
-      const load = Promise.resolve(
-        recoveringCollection._sync.loadSubset({ limit: 2 }),
-      ).then(() => {
-        settled = true
-      })
-      await waitFor(() => settled, `recovering demand settlement`)
-      await load
-      expect({ warmLoads, recoveringLoads }).toEqual({
-        warmLoads: 1,
-        recoveringLoads: 2,
-      })
-      expect(warmCollection.get(`warm`)).toMatchObject(warmRow)
-
-      // A later committed-cache notification in the new generation cannot
-      // reload from its uncertified SQLite rows. The active demand gets a
-      // fresh source snapshot over the real Browser coordinator wire.
-      const storageId = adapter.currentStorageId()
-      warmCoordinator.publish(storageId, {
-        v: 1,
-        dbName: `generation-routing`,
-        collectionId: storageId,
-        senderId: warmCoordinator.getNodeId(),
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `peer-new-generation-change`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        },
-      })
-      await waitFor(() => recoveringLoads > 2, `new-generation source refresh`)
-      expect(recoveringRefetches).toBeGreaterThan(0)
-      expect(warmLoads).toBe(1)
-      expect(warmCollection.get(`warm`)).toMatchObject(warmRow)
-    }, [
-      [`held warm source`, () => Promise.resolve(releaseWarmLoad())],
-      [
-        `recovering Collection`,
-        () => cleanupCollection(recoveringCollection, `recovering cleanup`),
-      ],
-      [
-        `warm Collection`,
-        () => cleanupCollection(warmCollection, `warm cleanup`),
-      ],
-      [
-        `recovering coordinator`,
-        () => disposeCoordinator(recoveringCoordinator),
-      ],
-      [`warm coordinator`, () => disposeCoordinator(warmCoordinator)],
-    ])
-  })
-
-  // A paused follower may receive a coordinator commit before its renewal
-  // timer runs. Its expired claim cannot authorize that message to reload
-  // cached rows. The independent history expires one claim, delivers a peer
-  // notification, then keeps the demand: the old source row disappears and
-  // the demand obtains a fresh source snapshot in another cache generation.
-  it(`recovers an expired follower claim before applying a peer notification`, async () => {
-    type Row = { id: string; title: string }
-    let expired = false
-    const adapter = createGenerationRecordingAdapter(
-      `expired-receiver`,
-      () => expired,
-    )
-    const originalClaim = adapter.claimCacheGeneration!
-    const originalRotate = adapter.rotateCacheGeneration!
-    adapter.claimCacheGeneration = async (collectionId) => ({
-      ...(await originalClaim(collectionId)),
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async () =>
-      expired ? undefined : Date.now() + 10_000
-    adapter.rotateCacheGeneration = async (...args) => {
-      const claim = await originalRotate(...args)
-      expired = false
-      return { ...claim, expiresAtMs: Date.now() + 10_000 }
-    }
-    const receiver = createCoordinator(`expired-receiver`, adapter)
-    const peer = createCoordinator(`expired-receiver`, adapter)
-    let source!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-    const loads: Array<boolean | undefined> = []
-    let collection: Collection<Row, string> | undefined
-    await withFailurePreservingCleanup(async () => {
-      collection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: `expired-public-collection`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async (options) => {
-                  loads.push(options.refetch)
-                  if (options.refetch) {
-                    source.begin()
-                    source.write({
-                      type: `insert`,
-                      value: { id: `fresh`, title: `New source` },
-                    })
-                    await whenSyncAccepted(source.commit())
-                  }
-                },
-              }
-            },
-          },
-          persistence: { adapter, coordinator: receiver },
-        }),
-      )
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `old`, title: `Old source` },
-      })
-      await whenSyncAccepted(source.commit())
-      await collection._sync.loadSubset({ limit: 1 })
-      expect(collection.get(`old`)).toMatchObject({ id: `old` })
-      expect(loads).toEqual([undefined])
-
-      const oldStorageId = adapter.currentStorageId()
-      expired = true
-      peer.publish(oldStorageId, {
-        v: 1,
-        dbName: `expired-receiver`,
-        collectionId: oldStorageId,
-        senderId: peer.getNodeId(),
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 1,
-          seq: 2,
-          txId: `peer-change-after-pause`,
-          latestRowVersion: 2,
-          requiresFullReload: true,
-        },
-      })
-      // Deliver the queued message at the paused tab's later wall-clock cut,
-      // before JavaScript gets an opportunity to run its renewal timer.
-      const wallNow = Date.now
-      const clock = vi
-        .spyOn(Date, `now`)
-        .mockImplementation(() => wallNow() + 20_000)
-      try {
-        expect(
-          ControlledBroadcastChannel.deliverWhere(
-            (data) =>
-              envelopeCollection(data) === oldStorageId &&
-              payloadType(data) === `tx:committed` &&
-              (data as { payload?: { txId?: string } }).payload?.txId ===
-                `peer-change-after-pause`,
-          ),
-        ).toBe(true)
-      } finally {
-        clock.mockRestore()
-      }
-      await waitFor(() => loads.length > 1, `retained demand reload`)
-      expect(adapter.currentStorageId()).toBe(oldStorageId)
-      expect(loads).toEqual([undefined, true])
-      expect(collection.get(`old`)).toBeUndefined()
-      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
-    }, [
-      [`receiver Collection`, () => collection?.cleanup() ?? Promise.resolve()],
-      [`receiver coordinator`, () => disposeCoordinator(receiver)],
-      [`peer coordinator`, () => disposeCoordinator(peer)],
-    ])
-  })
-
-  // One host clock defines claim expiry for both SQLite and the receiving
-  // runtime. The independent history expires a live claim using the clock
-  // supplied through the public Browser factory, then delivers a targeted
-  // peer commit. Because the old generation is no longer readable, its
-  // notification cannot publish a row. The active demand instead obtains a
-  // fresh source snapshot after rotation. Real SQLite and the composed
-  // Browser coordinator carry the claim and message at this checkpoint.
-  it(`uses the configured host clock before applying a peer notification`, async () => {
-    type Row = { id: string; title: string }
-    const directory = mkdtempSync(join(tmpdir(), `db-claim-clock-`))
-    const database = createWASQLiteTestDatabase({
-      filename: join(directory, `claim.sqlite`),
-    })
-    const receiver = createCoordinator(
-      `claim-clock`,
-      createRecordingAdapter({ id: `clock-receiver-bootstrap` }),
-    )
-    const peer = createCoordinator(
-      `claim-clock`,
-      createRecordingAdapter({ id: `clock-peer` }),
-    )
-    let hostNow = Date.now() + 86_400_000
-    const persistence = createBrowserWASQLitePersistence({
-      database,
-      coordinator: receiver,
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => hostNow,
-    })
-    let source!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-    let collection: Collection<Row, string> | undefined
-    const loads: Array<boolean | undefined> = []
-
-    await withFailurePreservingCleanup(async () => {
-      collection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: `claim-clock-collection`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async (options) => {
-                  loads.push(options.refetch)
-                  if (options.refetch) {
-                    source.begin()
-                    source.write({
-                      type: `insert`,
-                      value: { id: `fresh`, title: `Fresh source` },
-                    })
-                    await whenSyncAccepted(source.commit())
-                  }
-                },
-              }
-            },
-          },
-          persistence,
-        }),
-      )
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `old`, title: `Old source` },
-      })
-      await whenSyncAccepted(source.commit())
-      await collection._sync.loadSubset({})
-      expect(collection.get(`old`)).toMatchObject({ title: `Old source` })
-      expect(loads).toEqual([undefined])
-
-      const head = await database.execute<{ physical_id: string }>(
-        `SELECT physical_id FROM cache_generation
-         WHERE logical_id = ? AND retired = 0`,
-        [`claim-clock-collection`],
-      )
-      const oldStorageId = head[0]?.physical_id
-      if (!oldStorageId) throw new Error(`missing claimed cache generation`)
-      hostNow += 20_000
-      peer.publish(oldStorageId, {
-        v: 1,
-        dbName: `claim-clock`,
-        collectionId: oldStorageId,
-        senderId: peer.getNodeId(),
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 2,
-          seq: 1,
-          txId: `peer-change-after-clock-expiry`,
-          latestRowVersion: 2,
-          requiresFullReload: false,
-          changedRows: [
-            {
-              key: `old`,
-              value: { id: `old`, title: `Stale peer notification` },
-            },
-          ],
-          deletedKeys: [],
-        },
-      })
-      expect(
-        ControlledBroadcastChannel.deliverWhere(
-          (data) =>
-            envelopeCollection(data) === oldStorageId &&
-            payloadType(data) === `tx:committed` &&
-            (data as { payload?: { txId?: string } }).payload?.txId ===
-              `peer-change-after-clock-expiry`,
-        ),
-      ).toBe(true)
-      await pumpNetwork()
-      for (let pass = 0; pass < 10; pass++) await nextTurn()
-      expect(collection.get(`old`)?.title).not.toBe(`Stale peer notification`)
-      await waitFor(() => loads.includes(true), `expired-claim source reload`)
-      expect(collection.get(`old`)).toBeUndefined()
-      expect(collection.get(`fresh`)).toMatchObject({ title: `Fresh source` })
-    }, [
-      [`receiver Collection`, () => collection?.cleanup() ?? Promise.resolve()],
-      [`receiver coordinator`, () => disposeCoordinator(receiver)],
-      [`peer coordinator`, () => disposeCoordinator(peer)],
-      [`real SQLite database`, () => Promise.resolve(database.close?.())],
-      [
-        `real SQLite directory`,
-        () => rmSync(directory, { recursive: true, force: true }),
-      ],
-    ])
-  })
+    expectedRemoteLeaseTakeoverTrace,
+  ) as Array<keyof RemoteLeaseTakeoverTrace>) {
+    const expected = expectedRemoteLeaseTakeoverTrace[checkpoint]
+    for (const field of Object.keys(expected) as Array<keyof typeof expected>) {
+      if (actual[checkpoint][field] !== expected[field]) {
+        violations.push({
+          checkpoint,
+          field,
+          expected: expected[field],
+          actual: actual[checkpoint][field],
+        })
+      }
+    }
+  }
+  return violations
+}
 
-  // Two sync runs can claim one physical cache generation at different clock
-  // cuts. The independent claim rule lets the later warm peer keep that
-  // generation when only the earlier run expires. A commit notification sent
-  // to the expired run before its renewal timer cannot authorize its old row;
-  // its active demand must refetch into private storage. The warm peer keeps
-  // its public row, source ownership, and exact SQLite row at the settled cut.
-  // This receiver crosses the Browser coordinator wire and real wa-sqlite;
-  // the durable peer write is real, but the notice delivery order is controlled
-  // rather than native multi-tab scheduling or coordinator emission.
-  it(`keeps a warm Browser peer while an expired run reloads after a notification`, async () => {
-    type Row = { id: string; title: string }
-    const directory = mkdtempSync(join(tmpdir(), `db-warm-peer-claim-`))
-    const database = createWASQLiteTestDatabase({
-      filename: join(directory, `warm-peer.sqlite`),
-    })
-    const expiredCoordinator = createCoordinator(
-      `warm-peer-claim`,
-      createRecordingAdapter({ id: `expired-bootstrap` }),
-    )
-    const warmCoordinator = createCoordinator(
-      `warm-peer-claim`,
-      createRecordingAdapter({ id: `warm-bootstrap` }),
-    )
-    let hostNow = Date.now() + 86_400_000
-    const makePersistence = (coordinator: BrowserCollectionCoordinator) =>
-      createBrowserWASQLitePersistence({
-        database,
-        coordinator,
-        cacheGenerationClaimTtlMs: 10_000,
-        now: () => hostNow,
-      })
-    const expiredPersistence = makePersistence(expiredCoordinator)
-    const warmPersistence = makePersistence(warmCoordinator)
-    const logicalId = `warm-peer-claim-collection`
-    const expiredAdapter = expiredPersistence.resolvePersistenceForCollection!({
-      collectionId: logicalId,
-      mode: `sync-present`,
-    }).adapter
-    const rotate = expiredAdapter.rotateCacheGeneration!.bind(expiredAdapter)
-    const rotations: Array<{ storageCollectionId: string; claimId: string }> =
-      []
-    expiredAdapter.rotateCacheGeneration = async (...args) => {
-      const next = await rotate(...args)
-      rotations.push(next)
-      return next
+type CollectionScopedLeaseSnapshot = Record<
+  `alpha` | `beta`,
+  { loads: number; unloads: number; active: number }
+>
+
+function collectionScopedLeaseViolations(
+  actual: CollectionScopedLeaseSnapshot,
+  expected: CollectionScopedLeaseSnapshot,
+): Array<string> {
+  const violations: Array<string> = []
+  for (const collectionId of [`alpha`, `beta`] as const) {
+    for (const field of [`loads`, `unloads`, `active`] as const) {
+      if (actual[collectionId][field] !== expected[collectionId][field]) {
+        violations.push(`${collectionId}:${field}`)
+      }
     }
-    const old = { id: `old`, title: `Warm source row` }
-    const fresh = { id: `fresh`, title: `Expired run's fresh row` }
-    let source!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-    let expiredCollection: Collection<Row, string> | undefined
-    let warmCollection: Collection<Row, string> | undefined
-    const expiredLoads: Array<boolean | undefined> = []
-    let expiredRefetchSettled = false
-    const warmLoads: Array<number | undefined> = []
+  }
+  return violations
+}
 
-    await withFailurePreservingCleanup(async () => {
-      expiredCollection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async (options) => {
-                  expiredLoads.push(options.refetch)
-                  if (options.refetch) {
-                    source.begin()
-                    source.write({ type: `insert`, value: fresh })
-                    await whenSyncAccepted(source.commit())
-                    expiredRefetchSettled = true
-                  }
-                },
-              }
-            },
-          },
-          persistence: expiredPersistence,
-        }),
-      )
-      expiredCollection.startSyncImmediate()
-      await expiredCollection.stateWhenReady()
-      source.begin()
-      source.write({ type: `insert`, value: old })
-      await whenSyncAccepted(source.commit())
-      await expiredCollection._sync.loadSubset({ limit: 1 })
-      expect(expiredCollection.get(old.id)).toMatchObject(old)
-
-      const headRows = await database.execute<{ physical_id: string }>(
-        `SELECT physical_id FROM cache_generation
-         WHERE logical_id = ? AND retired = 0`,
-        [logicalId],
-      )
-      const sharedStorageId = headRows[0]?.physical_id
-      if (!sharedStorageId) throw new Error(`missing shared cache generation`)
-      const firstClaims = await database.execute<{
-        claim_id: string
-        expires_at_ms: number
-      }>(
-        `SELECT claim_id, expires_at_ms FROM cache_generation_claim
-         WHERE physical_id = ?`,
-        [sharedStorageId],
-      )
-      expect(firstClaims).toHaveLength(1)
-      const firstClaim = firstClaims[0]!
+type RemoteLeaseHistoryTrace = {
+  firstAfterAcquire: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
+  firstAfterPrefixRelease: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
+  firstAfterTakeover: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
+  secondAfterTakeover: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
+  secondAfterFinalRelease: ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
+}
 
-      hostNow += 5_000
-      warmCollection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: (options) => {
-                  warmLoads.push(options.limit)
-                  return Promise.resolve()
-                },
-              }
-            },
-          },
-          persistence: warmPersistence,
-        }),
-      )
-      warmCollection.startSyncImmediate()
-      await warmCollection.stateWhenReady()
-      let warmLoadSettled = false
-      const warmLoad = Promise.resolve(
-        warmCollection._sync.loadSubset({ limit: 1 }),
-      ).finally(() => {
-        warmLoadSettled = true
-      })
-      void warmLoad.catch(() => undefined)
-      await waitFor(() => warmLoadSettled, `warm peer subset settlement`)
-      await warmLoad
-      expect(warmCollection.get(old.id)).toMatchObject(old)
-      const sharedClaims = await database.execute<{
-        claim_id: string
-        expires_at_ms: number
-      }>(
-        `SELECT claim_id, expires_at_ms FROM cache_generation_claim
-         WHERE physical_id = ? ORDER BY expires_at_ms`,
-        [sharedStorageId],
-      )
-      expect(sharedClaims).toHaveLength(2)
-      expect(sharedClaims[0]).toEqual(firstClaim)
-      const warmClaim = sharedClaims[1]!
-      expect(warmClaim.claim_id).not.toBe(firstClaim.claim_id)
-      expect(warmClaim.expires_at_ms).toBeGreaterThan(firstClaim.expires_at_ms)
-
-      // The controlled notice below describes a committed SQLite transaction.
-      // Read its position, apply the peer write under the warm claim, then use
-      // those exact values in the delivered envelope.
-      const warmAdapter = warmPersistence.resolvePersistenceForCollection!({
-        collectionId: logicalId,
-        mode: `sync-present`,
-      }).adapter
-      const beforePeerWrite = await warmAdapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: sharedStorageId,
-          claimId: warmClaim.claim_id,
-        },
-        { cacheGenerationClaimId: warmClaim.claim_id },
-      )
-      const peerTerm = beforePeerWrite.latestTerm
-      const peerSeq = beforePeerWrite.latestSeq + 1
-      const peerRowVersion = beforePeerWrite.latestRowVersion + 1
-      const peerTxId = `notice-after-one-claim-expires`
-      await warmAdapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: sharedStorageId,
-          claimId: warmClaim.claim_id,
-        },
-        {
-          txId: peerTxId,
-          term: peerTerm,
-          seq: peerSeq,
-          rowVersion: peerRowVersion,
-          cacheGenerationClaimId: warmClaim.claim_id,
-          mutations: [{ type: `update`, key: old.id, value: old }],
-        },
-      )
-      const afterPeerWrite = await warmAdapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: sharedStorageId,
-          claimId: warmClaim.claim_id,
-        },
-        { cacheGenerationClaimId: warmClaim.claim_id },
-      )
-      expect(afterPeerWrite.latestRowVersion).toBe(peerRowVersion)
-      expect(afterPeerWrite.rows.map(({ value }) => value)).toEqual([old])
-
-      hostNow += 5_001
-      warmCoordinator.publish(sharedStorageId, {
-        v: 1,
-        dbName: `warm-peer-claim`,
-        collectionId: sharedStorageId,
-        senderId: warmCoordinator.getNodeId(),
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: peerTerm,
-          seq: peerSeq,
-          txId: peerTxId,
-          latestRowVersion: peerRowVersion,
-          requiresFullReload: false,
-          changedRows: [{ key: old.id, value: old }],
-          deletedKeys: [],
-        },
-      })
-      expect(
-        ControlledBroadcastChannel.deliverWhere(
-          (data) =>
-            envelopeCollection(data) === sharedStorageId &&
-            payloadType(data) === `tx:committed` &&
-            (data as { payload?: { txId?: string } }).payload?.txId ===
-              peerTxId,
-        ),
-      ).toBe(true)
-      await waitFor(
-        () => expiredLoads.includes(true) && expiredRefetchSettled,
-        `expired run's settled source refetch`,
-      )
-      await waitFor(
-        () => expiredCollection?.get(fresh.id)?.title === fresh.title,
-        `fresh public row after source refetch`,
-      )
-      expect(expiredCollection.get(old.id)).toBeUndefined()
-      expect(expiredCollection.get(fresh.id)).toMatchObject(fresh)
-      expect(warmCollection.get(old.id)).toMatchObject(old)
-      expect(warmCollection.get(fresh.id)).toBeUndefined()
-      const warmLoadsBeforeNextDemand = warmLoads.length
-      const expiredLoadsBeforeWarmDemand = [...expiredLoads]
-      await warmCollection._sync.loadSubset({ limit: 2 })
-      expect(warmLoads.slice(warmLoadsBeforeNextDemand)).toEqual([2])
-      expect(expiredLoads).toEqual(expiredLoadsBeforeWarmDemand)
-      expect(rotations).toHaveLength(1)
-      const privateClaim = rotations[0]!
-      expect(privateClaim.storageCollectionId).not.toBe(sharedStorageId)
-
-      const currentHead = await database.execute<{ physical_id: string }>(
-        `SELECT physical_id FROM cache_generation
-         WHERE logical_id = ? AND retired = 0`,
-        [logicalId],
-      )
-      expect(currentHead).toEqual([{ physical_id: sharedStorageId }])
-      const warmClaims = await database.execute<{ claim_id: string }>(
-        `SELECT claim_id FROM cache_generation_claim
-         WHERE physical_id = ? AND expires_at_ms > ?`,
-        [sharedStorageId, hostNow],
-      )
-      expect(warmClaims).toEqual([{ claim_id: warmClaim.claim_id }])
-      const durable = await warmAdapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: sharedStorageId,
-          claimId: warmClaim.claim_id,
-        },
-        {
-          cacheGenerationClaimId: warmClaim.claim_id,
-        },
-      )
-      expect(durable.rows.map(({ value }) => value)).toEqual([old])
-      const privateRows = await expiredAdapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: privateClaim.storageCollectionId,
-          claimId: privateClaim.claimId,
-        },
-        { cacheGenerationClaimId: privateClaim.claimId },
-      )
-      expect(privateRows.rows.map(({ value }) => value)).toEqual([fresh])
-    }, [
-      [
-        `expired Collection`,
-        () => expiredCollection?.cleanup() ?? Promise.resolve(),
-      ],
-      [`warm Collection`, () => warmCollection?.cleanup() ?? Promise.resolve()],
-      [`expired coordinator`, () => disposeCoordinator(expiredCoordinator)],
-      [`warm coordinator`, () => disposeCoordinator(warmCoordinator)],
-      [`real SQLite database`, () => Promise.resolve(database.close?.())],
-      [
-        `real SQLite directory`,
-        () => rmSync(directory, { recursive: true, force: true }),
-      ],
-    ])
-  })
+// Grammar bounds: one to three sibling demands, zero to two prefix releases,
+// and both values of each identity, duplicate-release, and final-order switch.
+// The surviving-demand law keeps at least one acquisition through takeover:
+// the marginal plans are one sibling with no prefix release and three siblings
+// with two prefix releases. Zero siblings, release before acquisition, and a
+// prefix that retires every demand are outside this generated history.
+const remoteLeaseHistoryArbitrary = fc.record({
+  siblingCount: fc.integer({ min: 1, max: 3 }),
+  releasePrefix: fc.integer({ min: 0, max: 2 }),
+  identical: fc.boolean(),
+  duplicateRelease: fc.boolean(),
+  reverseFinalRelease: fc.boolean(),
 })
 
+// Every accepted physical acquisition remains active until its exact
+// acquisition lease is released. Leadership transfer releases retired-owner
+// acquisitions and establishes replacements only for surviving demand.
+function remoteLeaseHistoryViolations(
+  history: RemoteLeaseHistory,
+  actual: RemoteLeaseHistoryTrace,
+): Array<RemoteLeaseTakeoverViolation> {
+  const { releaseCount } = remoteLeaseGrammarPlan(history)
+  const remaining = history.siblingCount - releaseCount
+  const expected: RemoteLeaseHistoryTrace = {
+    firstAfterAcquire: {
+      loads: history.siblingCount,
+      unloads: 0,
+      active: history.siblingCount,
+      exactUnloads: true,
+    },
+    firstAfterPrefixRelease: {
+      loads: history.siblingCount,
+      unloads: releaseCount,
+      active: remaining,
+      exactUnloads: true,
+    },
+    firstAfterTakeover: {
+      loads: history.siblingCount,
+      unloads: history.siblingCount,
+      active: 0,
+      exactUnloads: true,
+    },
+    secondAfterTakeover: {
+      loads: remaining,
+      unloads: 0,
+      active: remaining,
+      exactUnloads: true,
+    },
+    secondAfterFinalRelease: {
+      loads: remaining,
+      unloads: remaining,
+      active: 0,
+      exactUnloads: true,
+    },
+  }
+  const violations: Array<RemoteLeaseTakeoverViolation> = []
+  for (const checkpoint of Object.keys(expected) as Array<
+    keyof RemoteLeaseHistoryTrace
+  >) {
+    for (const field of Object.keys(expected[checkpoint]) as Array<
+      keyof ReturnType<RemoteLeaseOwnerLedger[`snapshot`]>
+    >) {
+      if (actual[checkpoint][field] !== expected[checkpoint][field]) {
+        violations.push({
+          checkpoint,
+          field,
+          expected: expected[checkpoint][field],
+          actual: actual[checkpoint][field],
+        })
+      }
+    }
+  }
+  return violations
+}
+
 describe(`remote subset ownership lease oracle`, () => {
   it(`calibrates collection-scoped acquisition identity against a global-id mutant`, () => {
     const expected: CollectionScopedLeaseSnapshot = {
@@ -2888,68 +1238,6 @@ describe(`remote subset ownership lease oracle`, () => {
     ])
   })
 
-  it(`reconstructs the remote-lease grammar and ablates every declared axis`, () => {
-    const witness: RemoteLeaseHistory = {
-      siblingCount: 3,
-      releasePrefix: 1,
-      identical: false,
-      duplicateRelease: true,
-      reverseFinalRelease: true,
-    }
-    const reconstructed = remoteLeaseGrammarPlan(witness)
-    expect(reconstructed).toEqual({
-      demands: [
-        { limit: 1, offset: 0 },
-        { limit: 1, offset: 1 },
-        { limit: 1, offset: 2 },
-      ],
-      releaseCount: 1,
-      prefixReleaseIndexes: [0],
-      finalReleaseIndexes: [2, 1],
-      releasePasses: 2,
-    })
-
-    const ablations: Array<{
-      axis: keyof RemoteLeaseHistory
-      history: RemoteLeaseHistory
-      observe: (plan: RemoteLeaseGrammarPlan) => unknown
-    }> = [
-      {
-        axis: `siblingCount`,
-        history: { ...witness, siblingCount: 1 },
-        observe: ({ demands }) => demands.length,
-      },
-      {
-        axis: `releasePrefix`,
-        history: { ...witness, releasePrefix: 0 },
-        observe: ({ prefixReleaseIndexes }) => prefixReleaseIndexes,
-      },
-      {
-        axis: `identical`,
-        history: { ...witness, identical: true },
-        observe: ({ demands }) => demands,
-      },
-      {
-        axis: `duplicateRelease`,
-        history: { ...witness, duplicateRelease: false },
-        observe: ({ releasePasses }) => releasePasses,
-      },
-      {
-        axis: `reverseFinalRelease`,
-        history: { ...witness, reverseFinalRelease: false },
-        observe: ({ finalReleaseIndexes }) => finalReleaseIndexes,
-      },
-    ]
-    expect(ablations.map(({ axis }) => axis).sort()).toEqual(
-      (Object.keys(witness) as Array<keyof RemoteLeaseHistory>).sort(),
-    )
-    for (const { history, observe } of ablations) {
-      expect(observe(remoteLeaseGrammarPlan(history))).not.toEqual(
-        observe(reconstructed),
-      )
-    }
-  })
-
   async function runRemoteLeaseCampaign(
     campaign: CoordinatorOracleCampaign,
   ): Promise<void> {
@@ -3274,159 +1562,11 @@ async function readRawCollectionSnapshot(
     registryRowCount: registry.length,
     schemaVersion: row.schema_version,
     resetEpoch: reset[0]?.reset_epoch ?? -1,
-    rowCount: count[0]?.count ?? -1,
-  }
-}
-
-describe(`per-collection adapter and SQLite-state oracle`, () => {
-  // The coordinator constructs a transaction for local mutations. A managed
-  // Collection's claim must survive that construction and the Browser route.
-  // The real SQLite row is the receiving observation: an eager target with a
-  // physical cache ID is rejected, even if a recording adapter accepts it.
-  it(`persists a managed local mutation through its claimed Browser route`, async () => {
-    const directory = mkdtempSync(join(tmpdir(), `db-managed-local-route-`))
-    const database = createWASQLiteTestDatabase({
-      filename: join(directory, `local.sqlite`),
-    })
-    const coordinator = createCoordinator(
-      `managed-local-route`,
-      createRecordingAdapter({ id: `bootstrap` }),
-    )
-    const logicalId = `managed-local-route-collection`
-    const persistence = createBrowserWASQLitePersistence({
-      database,
-      coordinator,
-    })
-    const adapter = persistence.resolvePersistenceForCollection!({
-      collectionId: logicalId,
-      mode: `sync-present`,
-    }).adapter
-    let claim:
-      | Awaited<ReturnType<NonNullable<typeof adapter.claimCacheGeneration>>>
-      | undefined
-    let replacement:
-      | Awaited<ReturnType<NonNullable<typeof adapter.rotateCacheGeneration>>>
-      | undefined
-    await withFailurePreservingCleanup(async () => {
-      claim = await adapter.claimCacheGeneration!(logicalId)
-      coordinator.setAdapterForCollection(
-        claim.storageCollectionId,
-        adapter,
-        claim.claimId,
-      )
-      coordinator.subscribe(claim.storageCollectionId, () => {})
-      await waitFor(
-        () => coordinator.isLeader(claim!.storageCollectionId),
-        `claimed local-mutation route`,
-      )
-      const result = await coordinator.requestApplyLocalMutations(
-        claim.storageCollectionId,
-        [
-          {
-            mutationId: `managed-local-row`,
-            type: `insert`,
-            key: `row`,
-            value: { id: `row` },
-          },
-        ],
-        claim.claimId,
-      )
-      expect(result.ok).toBe(true)
-      const snapshot = await adapter.loadResumeSnapshot({
-        kind: `managed`,
-        storageCollectionId: claim.storageCollectionId,
-        claimId: claim.claimId,
-      })
-      expect(snapshot.rows).toMatchObject([
-        { key: `row`, value: { id: `row` } },
-      ])
-      const oldRegistry = await database.execute<{ table_name: string }>(
-        `SELECT table_name FROM collection_registry WHERE collection_id = ?`,
-        [claim.storageCollectionId],
-      )
-      expect(oldRegistry).toHaveLength(1)
-      const oldTable = oldRegistry[0]?.table_name
-      if (!oldTable) throw new Error(`missing managed row table`)
-      replacement = await adapter.rotateCacheGeneration!(
-        logicalId,
-        claim.claimId,
-      )
-      await expect(
-        coordinator.requestApplyLocalMutations(
-          claim.storageCollectionId,
-          [
-            {
-              mutationId: `late-managed-local-row`,
-              type: `insert`,
-              key: `late`,
-              value: { id: `late` },
-            },
-          ],
-          claim.claimId,
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      expect(
-        await database.execute(
-          `SELECT name FROM sqlite_master WHERE name = ?`,
-          [oldTable],
-        ),
-      ).toEqual([])
-      expect(
-        await database.execute(
-          `SELECT collection_id FROM collection_registry WHERE collection_id = ?`,
-          [claim.storageCollectionId],
-        ),
-      ).toEqual([])
-    }, [
-      [
-        `replacement claim`,
-        async () => {
-          if (replacement) {
-            await adapter.releaseCacheGenerationClaim?.(replacement.claimId)
-          }
-        },
-      ],
-      [
-        `claim`,
-        async () => {
-          if (claim) await adapter.releaseCacheGenerationClaim?.(claim.claimId)
-        },
-      ],
-      [`coordinator`, () => disposeCoordinator(coordinator)],
-      [`database`, () => Promise.resolve(database.close?.())],
-      [`directory`, () => rmSync(directory, { recursive: true, force: true })],
-    ])
-  })
-
-  // A host factory promises the same configured claim lifetime as its core
-  // adapter. The supplied clock makes the claim's expiry exact; this catches
-  // options accepted by the public type but dropped before adapter creation.
-  it(`forwards the configured cache claim lifetime to its SQLite adapter`, async () => {
-    const directory = mkdtempSync(join(tmpdir(), `db-claim-options-`))
-    const database = createWASQLiteTestDatabase({
-      filename: join(directory, `claim.sqlite`),
-    })
-    try {
-      const persistence = createBrowserWASQLitePersistence({
-        database,
-        cacheGenerationClaimTtlMs: 1_234,
-        now: () => 5_000,
-      })
-      const resolve = persistence.resolvePersistenceForCollection
-      if (!resolve) throw new Error(`missing per-collection resolver`)
-      const adapter = resolve({
-        collectionId: `claim-options`,
-        mode: `sync-present`,
-      }).adapter
-      const claim = await adapter.claimCacheGeneration!(`claim-options`)
-      expect(claim.expiresAtMs).toBe(6_234)
-      await adapter.releaseCacheGenerationClaim!(claim.claimId)
-    } finally {
-      await Promise.resolve(database.close?.())
-      rmSync(directory, { recursive: true, force: true })
-    }
-  })
+    rowCount: count[0]?.count ?? -1,
+  }
+}
 
+describe(`per-collection adapter and SQLite-state oracle`, () => {
   it(`preserves alpha rows, schema, and reset epoch when beta registers a different adapter`, async () => {
     let directory: string | undefined
     let database: BrowserWASQLiteDatabase | undefined
@@ -3642,17 +1782,6 @@ describe(`per-collection adapter and SQLite-state oracle`, () => {
   })
 })
 
-type CollectionName = `alpha` | `beta`
-type TabName = `leader` | `follower`
-
-type RoutingHistory = {
-  alphaVersion: number
-  betaVersion: number
-  registrationOrder: [CollectionName, CollectionName]
-  firstDeliveryOrder: [CollectionName, CollectionName]
-  secondDeliveryOrder: [CollectionName, CollectionName]
-}
-
 type RoutedApply = {
   phase: `initial-owner` | `after-takeover`
   collectionId: CollectionName
@@ -3803,22 +1932,6 @@ const orderArbitrary = fc
     forward ? [`alpha`, `beta`] : [`beta`, `alpha`],
   )
 
-type RoutingHistoryAxes = Omit<RoutingHistory, `betaVersion`> & {
-  versionDelta: number
-}
-
-function routingHistoryFromAxes({
-  alphaVersion,
-  versionDelta,
-  ...history
-}: RoutingHistoryAxes): RoutingHistory {
-  return {
-    ...history,
-    alphaVersion,
-    betaVersion: alphaVersion + versionDelta,
-  }
-}
-
 // Grammar bounds: alpha schema version 1..50 and positive delta 1..50 give
 // distinct versions from (1, 2) through (50, 100). Every order axis uses both
 // two-collection permutations. A missing/duplicate registration, equal schema
@@ -3833,33 +1946,6 @@ const routingHistoryArbitrary: fc.Arbitrary<RoutingHistory> = fc
   })
   .map(routingHistoryFromAxes)
 
-type RoutingGrammarPlan = {
-  initialCollection: CollectionName
-  registrationOrder: [CollectionName, CollectionName]
-  firstDeliveryOrder: [CollectionName, CollectionName]
-  secondDeliveryOrder: [CollectionName, CollectionName]
-  adapterIds: Record<TabName, Record<CollectionName, string>>
-}
-
-function routingGrammarPlan(history: RoutingHistory): RoutingGrammarPlan {
-  return {
-    initialCollection: history.registrationOrder[0],
-    registrationOrder: history.registrationOrder,
-    firstDeliveryOrder: history.firstDeliveryOrder,
-    secondDeliveryOrder: history.secondDeliveryOrder,
-    adapterIds: {
-      leader: {
-        alpha: `leader-alpha-v${history.alphaVersion}-reset`,
-        beta: `leader-beta-v${history.betaVersion}-error`,
-      },
-      follower: {
-        alpha: `follower-alpha-v${history.alphaVersion}-reset`,
-        beta: `follower-beta-v${history.betaVersion}-error`,
-      },
-    },
-  }
-}
-
 function mutation(
   collectionId: CollectionName,
   phase: RoutedApply[`phase`],
@@ -3919,48 +2005,6 @@ async function requestBothCollections(
 }
 
 describe(`generated collection-route histories`, () => {
-  it(`requires a complete property, seed, and shrink path for replay`, () => {
-    expect(readCoordinatorOracleConfig({})).toEqual({ runs: DEFAULT_RUNS })
-    for (const environment of [
-      { TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123` },
-      { TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1` },
-      { TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `routing` },
-      {
-        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1`,
-      },
-    ]) {
-      expect(() => readCoordinatorOracleConfig(environment)).toThrow(
-        /requires SEED, PATH, and PROPERTY together/,
-      )
-    }
-    expect(() =>
-      readCoordinatorOracleConfig({
-        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `not-a-path`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `routing`,
-      }),
-    ).toThrow(/numeric shrink path/)
-    expect(() =>
-      readCoordinatorOracleConfig({
-        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `unknown`,
-      }),
-    ).toThrow(/remote-lease or routing/)
-    expect(
-      readCoordinatorOracleConfig({
-        TANSTACK_DB_COORDINATOR_ORACLE_RUNS: `7`,
-        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1`,
-        TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `routing`,
-      }),
-    ).toEqual({
-      runs: 7,
-      replay: { property: `routing`, seed: 123, path: `0:1` },
-    })
-  })
-
   it(`calibrates collection-key comparison against one peer-routed apply`, () => {
     const expected: Array<RoutedApply> = [
       {
@@ -4026,99 +2070,6 @@ describe(`generated collection-route histories`, () => {
     ])
   })
 
-  it(`reconstructs the routing grammar and ablates every declared axis`, () => {
-    const witnessAxes: RoutingHistoryAxes = {
-      alphaVersion: 11,
-      versionDelta: 18,
-      registrationOrder: [`beta`, `alpha`],
-      firstDeliveryOrder: [`alpha`, `beta`],
-      secondDeliveryOrder: [`beta`, `alpha`],
-    }
-    const witness = routingHistoryFromAxes(witnessAxes)
-    expect(witness).toEqual({
-      alphaVersion: 11,
-      betaVersion: 29,
-      registrationOrder: [`beta`, `alpha`],
-      firstDeliveryOrder: [`alpha`, `beta`],
-      secondDeliveryOrder: [`beta`, `alpha`],
-    })
-    const reconstructed = routingGrammarPlan(witness)
-    expect(reconstructed).toEqual({
-      initialCollection: `beta`,
-      registrationOrder: [`beta`, `alpha`],
-      firstDeliveryOrder: [`alpha`, `beta`],
-      secondDeliveryOrder: [`beta`, `alpha`],
-      adapterIds: {
-        leader: {
-          alpha: `leader-alpha-v11-reset`,
-          beta: `leader-beta-v29-error`,
-        },
-        follower: {
-          alpha: `follower-alpha-v11-reset`,
-          beta: `follower-beta-v29-error`,
-        },
-      },
-    })
-
-    const ablations: Array<{
-      axis: keyof RoutingHistoryAxes
-      history: RoutingHistory
-      observe: (plan: RoutingGrammarPlan) => unknown
-    }> = [
-      {
-        axis: `alphaVersion`,
-        history: routingHistoryFromAxes({
-          ...witnessAxes,
-          alphaVersion: 12,
-        }),
-        observe: ({ adapterIds }) => adapterIds.leader.alpha,
-      },
-      {
-        axis: `versionDelta`,
-        history: routingHistoryFromAxes({
-          ...witnessAxes,
-          versionDelta: 19,
-        }),
-        observe: ({ adapterIds }) => adapterIds.leader.beta,
-      },
-      {
-        axis: `registrationOrder`,
-        history: routingHistoryFromAxes({
-          ...witnessAxes,
-          registrationOrder: [`alpha`, `beta`],
-        }),
-        observe: ({ initialCollection, registrationOrder }) => ({
-          initialCollection,
-          registrationOrder,
-        }),
-      },
-      {
-        axis: `firstDeliveryOrder`,
-        history: routingHistoryFromAxes({
-          ...witnessAxes,
-          firstDeliveryOrder: [`beta`, `alpha`],
-        }),
-        observe: ({ firstDeliveryOrder }) => firstDeliveryOrder,
-      },
-      {
-        axis: `secondDeliveryOrder`,
-        history: routingHistoryFromAxes({
-          ...witnessAxes,
-          secondDeliveryOrder: [`alpha`, `beta`],
-        }),
-        observe: ({ secondDeliveryOrder }) => secondDeliveryOrder,
-      },
-    ]
-    expect(ablations.map(({ axis }) => axis).sort()).toEqual(
-      (Object.keys(witnessAxes) as Array<keyof RoutingHistoryAxes>).sort(),
-    )
-    for (const { history, observe } of ablations) {
-      expect(observe(routingGrammarPlan(history))).not.toEqual(
-        observe(reconstructed),
-      )
-    }
-  })
-
   it(`routes every adapter-bound RPC by collection before and after leadership transfer`, async () => {
     const makePullResult = (
       marker: string,
@@ -4762,234 +2713,6 @@ describe(`sync-ingested write ownership oracle`, () => {
       ),
     ).toEqual([{ collectionId: `beta` }])
   })
-
-  it(`routes a rich source commit through the new elected Browser owner`, async () => {
-    type Todo = { id: string; title: string }
-    type SourceParams = Parameters<SyncConfig<Todo, string>[`sync`]>[0]
-    type TxAdapter = PersistenceAdapter & { applied: Array<PersistedTx> }
-
-    const createTxAdapter = (): TxAdapter => {
-      const applied: Array<PersistedTx> = []
-      return {
-        applied,
-        loadSubset: () => Promise.resolve([]),
-        loadResumeSnapshot: () =>
-          Promise.resolve({
-            rows: [],
-            keySet: { status: `consistent` },
-            collectionMetadata: [],
-            latestTerm: 0,
-            latestSeq: 0,
-            latestRowVersion: 0,
-            resetEpoch: 0,
-          }),
-        applyCommittedTx: (_collectionId, tx) => {
-          applied.push(structuredClone(tx))
-          return Promise.resolve()
-        },
-        ensureIndex: () => Promise.resolve(),
-        getStreamPosition: () =>
-          Promise.resolve({
-            latestTerm: 0,
-            latestSeq: 0,
-            latestRowVersion: 0,
-          }),
-        reserveLeadershipTerm: async (collectionId, observedTerm) => {
-          const id = storageId(collectionId)
-          const latestTerm =
-            Math.max(durableTerms.get(id) ?? 0, observedTerm) + 1
-          durableTerms.set(id, latestTerm)
-          return { latestTerm, latestSeq: 0, latestRowVersion: 0 }
-        },
-      }
-    }
-
-    const retiredAdapter = createTxAdapter()
-    const electedAdapter = createTxAdapter()
-    const requesterAdapter = createTxAdapter()
-    const originalElectedApply =
-      electedAdapter.applyCommittedTx.bind(electedAdapter)
-    let electedApplyEntered = false
-    let releaseElectedApply = (): void => {}
-    const electedApplyGate = new Promise<void>((resolve) => {
-      releaseElectedApply = resolve
-    })
-    electedAdapter.applyCommittedTx = async (collectionId, tx) => {
-      electedApplyEntered = true
-      await electedApplyGate
-      await originalElectedApply(collectionId, tx)
-    }
-    let retired: BrowserCollectionCoordinator | undefined
-    let elected: BrowserCollectionCoordinator | undefined
-    let requester: BrowserCollectionCoordinator | undefined
-    let cleanupCollection: (() => Promise<void>) | undefined
-    const electedCommitted: Array<unknown> = []
-    const requesterCommitted: Array<unknown> = []
-
-    await withFailurePreservingCleanup(async () => {
-      const dbName = `source-owner-transfer`
-      retired = createCoordinator(dbName, retiredAdapter)
-      elected = createCoordinator(dbName, electedAdapter)
-      requester = createCoordinator(dbName, requesterAdapter)
-      retired.subscribe(`todos`, () => {})
-      elected.subscribe(`todos`, (message) => {
-        const payload = message.payload as { type?: string }
-        if (payload.type === `tx:committed`) {
-          electedCommitted.push(structuredClone(payload))
-        }
-      })
-      requester.subscribe(`todos`, (message) => {
-        const payload = message.payload as { type?: string }
-        if (payload.type === `tx:committed`) {
-          requesterCommitted.push(structuredClone(payload))
-        }
-      })
-      await waitFor(
-        () =>
-          retired!.isLeader(`todos`) &&
-          !elected!.isLeader(`todos`) &&
-          !requester!.isLeader(`todos`),
-        `initial source owner`,
-      )
-
-      await disposeCoordinator(retired)
-      await waitFor(
-        () => elected!.isLeader(`todos`) && !requester!.isLeader(`todos`),
-        `transferred source owner`,
-      )
-
-      let sourceParams: SourceParams | undefined
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `todos`,
-          getKey: (todo) => todo.id,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-            },
-          },
-          persistence: { adapter: requesterAdapter, coordinator: requester },
-        }),
-      )
-      cleanupCollection = () => collection.cleanup()
-      collection.startSyncImmediate()
-      await waitForWithoutDelivery(
-        () => sourceParams !== undefined,
-        `Browser source controls`,
-      )
-
-      sourceParams!.begin()
-      sourceParams!.metadata?.collection.set(`resume`, { offset: 11 })
-      sourceParams!.truncate()
-      sourceParams!.write({
-        type: `insert`,
-        value: { id: `rich`, title: `through Browser owner` },
-        metadata: { source: `browser-sync` },
-      })
-      const receipt = sourceParams!.commit()
-      let receiptSettled = receipt === true
-      const receiptPromise = receipt === true ? Promise.resolve() : receipt
-      void receiptPromise.then(
-        () => {
-          receiptSettled = true
-        },
-        () => {
-          receiptSettled = true
-        },
-      )
-
-      await pumpNetwork()
-      await waitForWithoutDelivery(
-        () => electedApplyEntered,
-        `elected Browser source apply entry`,
-      )
-      expect({
-        receiptSettled,
-        electedApplies: electedAdapter.applied.length,
-        requesterInvalidations: requesterCommitted.length,
-      }).toEqual({
-        receiptSettled: false,
-        electedApplies: 0,
-        requesterInvalidations: 0,
-      })
-
-      releaseElectedApply()
-      await pumpNetwork()
-      await receiptPromise
-      await pumpNetwork()
-
-      expect(collection.get(`rich`)).toMatchObject({
-        id: `rich`,
-        title: `through Browser owner`,
-      })
-      expect(retiredAdapter.applied).toEqual([])
-      expect(requesterAdapter.applied).toEqual([])
-      expect(electedAdapter.applied).toHaveLength(1)
-      expect(electedAdapter.applied[0]).toMatchObject({
-        truncate: true,
-        mutations: [
-          {
-            type: `update`,
-            key: `rich`,
-            value: { id: `rich`, title: `through Browser owner` },
-          },
-        ],
-        rowMetadataMutations: [
-          {
-            type: `set`,
-            key: `rich`,
-            value: { source: `browser-sync` },
-          },
-        ],
-        collectionMetadataMutations: [
-          { type: `set`, key: `resume`, value: { offset: 11 } },
-        ],
-      })
-      const committedTxId = electedAdapter.applied[0]!.txId
-      const expectedCommitted = {
-        type: `tx:committed`,
-        term: 2,
-        seq: 1,
-        txId: committedTxId,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-      }
-      expect(electedCommitted).toEqual([expectedCommitted])
-      expect(requesterCommitted).toEqual([expectedCommitted])
-    }, [
-      [
-        `elected Browser source apply gate`,
-        () => {
-          releaseElectedApply()
-        },
-      ],
-      [
-        `Browser source collection`,
-        async () => {
-          await cleanupCollection?.()
-        },
-      ],
-      [
-        `retired Browser source owner`,
-        async () => {
-          await disposeCoordinator(retired)
-        },
-      ],
-      [
-        `elected Browser source owner`,
-        async () => {
-          await disposeCoordinator(elected)
-        },
-      ],
-      [
-        `Browser source requester`,
-        async () => {
-          await disposeCoordinator(requester)
-        },
-      ],
-    ])
-  })
 })
 
 /*
@@ -5051,31 +2774,6 @@ own source. Another tab never owns the rotated generation in this topology,
 so the elected-owner notice path has no receiving witness here.
 */
 
-// Node's own BroadcastChannel and Web Locks, captured before any test installs
-// the controlled seams. This lane swaps them in for its body only.
-const nativeBroadcastChannel = globalThis.BroadcastChannel
-const nativeNavigator = globalThis.navigator
-
-function withNativeBrowserTransport<T>(body: () => Promise<T>): Promise<T> {
-  const controlledChannel = globalThis.BroadcastChannel
-  const controlledNavigator = globalThis.navigator
-  const define = (channel: unknown, navigator: unknown) => {
-    Object.defineProperty(globalThis, `BroadcastChannel`, {
-      value: channel,
-      writable: true,
-      configurable: true,
-    })
-    Object.defineProperty(globalThis, `navigator`, {
-      value: navigator,
-      writable: true,
-      configurable: true,
-    })
-  }
-  define(nativeBroadcastChannel, nativeNavigator)
-  return body().finally(() => define(controlledChannel, controlledNavigator))
-}
-
-type RealTabSource = `receipt` | `query-db`
 type RealTabPlacement = `direct` | `queued`
 type RealTabHistory = {
   source: RealTabSource
@@ -5084,7 +2782,6 @@ type RealTabHistory = {
   // A live query over the demand, or the follower Collection's load itself.
   consumer: `live-query` | `load`
 }
-type RealTabRow = { id: string; group: string }
 
 function expectedRealTabFollower(history: RealTabHistory) {
   const applied = history.apply === `ok`
@@ -5109,155 +2806,6 @@ function createDeferredVoid() {
   return { promise, resolve, reject }
 }
 
-// One tab: a real SQLite connection to the shared file, a real coordinator,
-// browser persistence, and the persisted on-demand Collection every tab
-// defines. Only the leader's source runs; a follower routes demand.
-function createRealTab(options: {
-  dbName: string
-  filename: string
-  source: RealTabSource
-  upstream: Map<string, RealTabRow>
-  holdUpstream?: () => Promise<void>
-  readGate?: (rows: ReadonlyArray<unknown>) => Promise<void>
-  now?: () => number
-  // Commit on every load: a newer version of a delivered row (`update`), or
-  // the same row inserted again (`reinsert`, an equal-value insert core
-  // reconciles as an update).
-  commitEachLoad?: `update` | `reinsert`
-}) {
-  const database = createWASQLiteTestDatabase({ filename: options.filename })
-  const gatedDatabase: BrowserWASQLiteDatabase = {
-    execute: async (sql, params) => {
-      const rows = await database.execute(sql, params)
-      if (options.readGate && /^\s*select/i.test(sql)) {
-        await options.readGate(rows)
-      }
-      return rows as never
-    },
-    close: () => database.close?.(),
-  }
-  const coordinator = new BrowserCollectionCoordinator({
-    dbName: options.dbName,
-  })
-  liveCoordinators.add(coordinator)
-  const persistence = createBrowserWASQLitePersistence({
-    database: gatedDatabase,
-    coordinator,
-    ...(options.now
-      ? { now: options.now, cacheGenerationClaimTtlMs: 10_000 }
-      : {}),
-  })
-  const upstreamRows = (where: unknown) => {
-    const wanted = JSON.stringify(where ?? null)
-    return Array.from(options.upstream.values()).filter((row) =>
-      wanted.includes(`"${row.id}"`),
-    )
-  }
-  const queryClient = new QueryClient({
-    defaultOptions: { queries: { retry: false } },
-  })
-  const trace: Array<string> = []
-  let storageCollectionId: string | undefined
-  const setAdapter = coordinator.setAdapterForCollection.bind(coordinator)
-  coordinator.setAdapterForCollection = (collectionId, adapter, claimId) => {
-    if (claimId) storageCollectionId = collectionId
-    setAdapter(collectionId, adapter, claimId)
-  }
-  const ensure = coordinator.requestEnsureRemoteSubset.bind(coordinator)
-  coordinator.requestEnsureRemoteSubset = (collectionId, subset) => {
-    trace.push(`ensure`)
-    return ensure(collectionId, subset).finally(() =>
-      trace.push(`ensure-settled`),
-    )
-  }
-  const loadUpstream = async (where: unknown) => {
-    trace.push(`upstream`)
-    await options.holdUpstream?.()
-    return upstreamRows(where)
-  }
-  const delivered = new Set<string>()
-  let version = 0
-  const receiptSource: SyncConfig<RealTabRow, string> = {
-    sync: ({ begin, write, commit, markReady }) => {
-      markReady()
-      return {
-        loadSubset: async (subset) => {
-          if (options.commitEachLoad) {
-            const fresh = await loadUpstream(subset.where)
-            if (fresh.length === 0) return
-            begin()
-            for (const row of fresh) {
-              const delivered_ = delivered.has(row.id)
-              delivered.add(row.id)
-              if (options.commitEachLoad === `update` && delivered_) {
-                const next = { ...row, group: `v${++version}` }
-                options.upstream.set(row.id, next)
-                write({ type: `update`, value: next })
-              } else write({ type: `insert`, value: row })
-            }
-            await whenSyncAccepted(commit())
-            return
-          }
-          // Like a real source, deliver each upstream row version once.
-          const rows = (await loadUpstream(subset.where)).filter(
-            (row) => !delivered.has(row.id),
-          )
-          for (const row of rows) delivered.add(row.id)
-          if (rows.length === 0) return
-          begin()
-          for (const row of rows) write({ type: `insert`, value: row })
-          await whenSyncAccepted(commit())
-        },
-      }
-    },
-  }
-  const collection =
-    options.source === `receipt`
-      ? createCollection(
-          persistedCollectionOptions<RealTabRow, string>({
-            id: `real-tab-items`,
-            schemaVersion: 1,
-            persistence,
-            syncMode: `on-demand`,
-            getKey: (row) => row.id,
-            sync: receiptSource,
-          }),
-        )
-      : createCollection(
-          persistedCollectionOptions<RealTabRow, string>({
-            id: `real-tab-items`,
-            schemaVersion: 1,
-            persistence,
-            ...queryCollectionOptions<
-              RealTabRow,
-              unknown,
-              Array<string>,
-              string
-            >({
-              queryKey: [`real-tab-items`],
-              queryClient,
-              syncMode: `on-demand`,
-              getKey: (row) => row.id,
-              queryFn: (context) =>
-                loadUpstream(context.meta?.loadSubsetOptions?.where),
-            }),
-          }),
-        )
-  return {
-    coordinator,
-    collection,
-    trace,
-    storageCollectionId: () => storageCollectionId,
-    cleanup: async () => {
-      await collection.cleanup()
-      queryClient.clear()
-      coordinator.dispose()
-      liveCoordinators.delete(coordinator)
-      database.close?.()
-    },
-  }
-}
-
 function assertRealTabFollowerHistory(history: RealTabHistory): Promise<void> {
   return withNativeBrowserTransport(() => runRealTabFollowerHistory(history))
 }
@@ -5430,262 +2978,29 @@ describe(`follower remote-demand settlement across real tabs`, () => {
     (history) => assertRealTabFollowerHistory(history),
     20_000,
   )
-
-  // Rotation across real tabs. When only the follower's cache claim expires,
-  // it rotates into a new generation that no other tab participates in, so
-  // it becomes that generation's owner and serves new demand from its own
-  // source. The model owes the same applied settlement there: the rows it
-  // already showed stay visible, and a new demand settles with its rows.
-  // This topology never routes to another tab's owner, so the
-  // elected-owner notice path stays with the single-runtime follower
-  // generation-notice cells in persisted-oracle.test.ts. Their rotation cell
-  // is pinned as failing under the known gap #2139.
-  it(
-    `keeps a rotated follower's rows and serves its new demand from its own generation`,
-    () =>
-      withNativeBrowserTransport(async () => {
-        const directory = mkdtempSync(join(tmpdir(), `db-real-tab-rotation-`))
-        const filename = join(directory, `tabs.sqlite`)
-        const dbName = `real-tab-rotation-${Math.random().toString(36).slice(2)}`
-        const upstream = new Map<string, RealTabRow>([
-          [`remote`, { id: `remote`, group: `a` }],
-          [`other`, { id: `other`, group: `b` }],
-        ])
-        let followerNow = Date.now()
-        const tabs: Array<ReturnType<typeof createRealTab>> = []
-        const where = (id: string): LoadSubsetOptions => ({
-          where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(id)]),
-        })
-        try {
-          const leader = createRealTab({
-            dbName,
-            filename,
-            source: `receipt`,
-            upstream,
-          })
-          tabs.push(leader)
-          leader.collection.startSyncImmediate()
-          await leader.collection.stateWhenReady()
-          const follower = createRealTab({
-            dbName,
-            filename,
-            source: `receipt`,
-            upstream,
-            now: () => followerNow,
-          })
-          tabs.push(follower)
-          follower.collection.startSyncImmediate()
-          await vi.waitFor(() =>
-            expect(follower.storageCollectionId()).toBeDefined(),
-          )
-          await follower.collection._sync.loadSubset(where(`remote`))
-          const original = follower.storageCollectionId()
-          expect(follower.coordinator.isLeader(original!)).toBe(false)
-          expect(follower.collection.has(`remote`)).toBe(true)
-
-          followerNow += 20_000
-          await follower.collection._sync.loadSubset(where(`other`))
-          const rotated = follower.storageCollectionId()
-          expect(rotated).not.toBe(original)
-          expect(follower.coordinator.isLeader(rotated!)).toBe(true)
-          expect({
-            remote: follower.collection.has(`remote`),
-            other: follower.collection.has(`other`),
-            status: follower.collection.status,
-          }).toEqual({ remote: true, other: true, status: `ready` })
-        } finally {
-          for (const tab of tabs.reverse())
-            await tab.cleanup().catch(() => undefined)
-          rmSync(directory, { recursive: true, force: true })
-        }
-      }),
-    30_000,
-  )
-})
-
-/*
-A leader source may commit on every load: a legal update with a new value, or
-an equal-value insert of a row it already delivered, which core reconciles as
-an update. A follower applies the leader's commit notice from durable rows.
-That apply must not release and request the follower's demand again: a new
-request makes the leader's source load and commit again, and the follower
-would never settle. The model: the follower's query is first ready with the
-leader's row, the follower sends at most two ensures (its demand, and at most
-one replay), and a later leader commit still reaches the follower with the
-leader's current value.
-*/
-describe(`follower stays bounded when the leader commits on every load`, () => {
-  it.each([`update`, `reinsert`] as const)(
-    `settles and stays bounded: commit on every load as $0`,
-    (commitEachLoad) =>
-      withNativeBrowserTransport(async () => {
-        const directory = mkdtempSync(join(tmpdir(), `db-real-tab-each-load-`))
-        const filename = join(directory, `tabs.sqlite`)
-        const dbName = `real-tab-each-load-${Math.random().toString(36).slice(2)}`
-        const upstream = new Map<string, RealTabRow>([
-          [`remote`, { id: `remote`, group: `a` }],
-        ])
-        const tabs: Array<ReturnType<typeof createRealTab>> = []
-        const queries: Array<{ cleanup: () => Promise<void> }> = []
-        const remote: LoadSubsetOptions = {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`id`]),
-            new IR.Value(`remote`),
-          ]),
-        }
-        try {
-          const leader = createRealTab({
-            dbName,
-            filename,
-            source: `receipt`,
-            upstream,
-            commitEachLoad,
-          })
-          tabs.push(leader)
-          leader.collection.startSyncImmediate()
-          await leader.collection.stateWhenReady()
-          const follower = createRealTab({
-            dbName,
-            filename,
-            source: `receipt`,
-            upstream,
-            commitEachLoad,
-          })
-          tabs.push(follower)
-          follower.collection.startSyncImmediate()
-          await vi.waitFor(() =>
-            expect(follower.storageCollectionId()).toBeDefined(),
-          )
-          const items: Collection<RealTabRow, string> = follower.collection
-          const query = createLiveQueryCollection((q) =>
-            q.from({ item: items }).where(({ item }) => eq(item.id, `remote`)),
-          )
-          queries.push(query)
-          let rowsAtFirstReady: Array<string> | undefined
-          query.onFirstReady(() => {
-            rowsAtFirstReady = query.toArray.map((row) => row.id)
-          })
-          void query.preload().catch(() => undefined)
-          await vi.waitFor(() => expect(query.isReady()).toBe(true), {
-            timeout: 8_000,
-          })
-          expect(rowsAtFirstReady).toEqual([`remote`])
-          for (let turn = 0; turn < 200; turn++) await nextTurn()
-          const ensures = () =>
-            follower.trace.filter((entry) => entry === `ensure`).length
-          expect(ensures()).toBeLessThanOrEqual(2)
-
-          // A later leader commit still reaches the follower.
-          await leader.collection._sync.loadSubset(remote)
-          await vi.waitFor(
-            () =>
-              expect(follower.collection.get(`remote`)?.group).toBe(
-                upstream.get(`remote`)!.group,
-              ),
-            { timeout: 8_000 },
-          )
-          for (let turn = 0; turn < 200; turn++) await nextTurn()
-          expect(ensures()).toBeLessThanOrEqual(2)
-        } finally {
-          for (const query of queries)
-            await query.cleanup().catch(() => undefined)
-          for (const tab of tabs.reverse())
-            await tab.cleanup().catch(() => undefined)
-          rmSync(directory, { recursive: true, force: true })
-        }
-      }),
-    30_000,
-  )
 })
 
-describe(`coordinator fixture lifecycle`, () => {
-  it(`releases delayed transport and leadership state before a fresh lifecycle`, async () => {
-    let first: BrowserCollectionCoordinator | undefined
-    let peer: BrowserCollectionCoordinator | undefined
-    let fresh: BrowserCollectionCoordinator | undefined
-
-    await withFailurePreservingCleanup(async () => {
-      first = createCoordinator(
-        `cleanup-first`,
-        createRecordingAdapter({ id: `first` }),
-      )
-      peer = createCoordinator(
-        `cleanup-first`,
-        createRecordingAdapter({ id: `peer` }),
-      )
-      first.subscribe(`alpha`, () => {})
-      peer.subscribe(`alpha`, () => {})
-      await waitFor(
-        () => first!.isLeader(`alpha`) && !peer!.isLeader(`alpha`),
-        `first lifecycle leadership`,
-      )
-
-      const retiredBefore = ControlledBroadcastChannel.retiredDeliveries
-      first.publish(`alpha`, {
-        v: 1,
-        dbName: `cleanup-first`,
-        collectionId: `alpha`,
-        senderId: first.getNodeId(),
-        ts: Date.now(),
-        payload: { type: `lifecycle:pending` },
-      })
-      expect(ControlledBroadcastChannel.delayed.length).toBeGreaterThan(0)
-      await disposeCoordinator(first)
-      await disposeCoordinator(peer)
-      await waitForWithoutDelivery(
-        () => heldLocks.size === 0 && queuedLocks.size === 0,
-        `first lifecycle release`,
-      )
-      expect(ControlledBroadcastChannel.retiredDeliveries).toBeGreaterThan(
-        retiredBefore,
-      )
-      expect(coordinatorFixtureSnapshot()).toEqual({
-        delayed: 0,
-        endpoints: 0,
-        heldLocks: 0,
-        queuedLocks: 0,
-      })
-
-      fresh = createCoordinator(
-        `cleanup-fresh`,
-        createRecordingAdapter({ id: `fresh` }),
-      )
-      fresh.subscribe(`alpha`, () => {})
-      await waitFor(
-        () => fresh!.isLeader(`alpha`),
-        `fresh lifecycle leadership`,
-      )
-      expect(fresh.isLeader(`alpha`)).toBe(true)
-      await disposeCoordinator(fresh)
-      await waitForWithoutDelivery(
-        () => heldLocks.size === 0 && queuedLocks.size === 0,
-        `fresh lifecycle release`,
-      )
-      expect(coordinatorFixtureSnapshot()).toEqual({
-        delayed: 0,
-        endpoints: 0,
-        heldLocks: 0,
-        queuedLocks: 0,
-      })
-    }, [
-      [
-        `first lifecycle coordinator`,
-        async () => {
-          await disposeCoordinator(first)
-        },
-      ],
-      [
-        `first lifecycle peer`,
-        async () => {
-          await disposeCoordinator(peer)
-        },
-      ],
-      [
-        `fresh lifecycle coordinator`,
-        async () => {
-          await disposeCoordinator(fresh)
-        },
-      ],
-    ])
-  })
+// The parts this file defines. The checks compare production observations
+// with the expectations that the models and grammars produce; the models are
+// independent of the coordinator and its adapter routing. Declared last
+// because the model classes are defined above and cannot be read earlier.
+declareOracle({
+  check: [
+    subsetWireViolations,
+    subsetAckViolations,
+    remoteLeaseTakeoverViolations,
+    collectionScopedLeaseViolations,
+    remoteLeaseHistoryViolations,
+    rawSnapshotViolations,
+    freshInitViolations,
+    coordinatorRouteViolations,
+    routeViolations,
+    findUnownedWrites,
+    runRealTabFollowerHistory,
+  ],
+  model: [
+    RemoteLeaseOwnerLedger,
+    PerCollectionRouteOracle,
+    expectedRealTabFollower,
+  ],
 })
diff --git a/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-support.ts b/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-support.ts
new file mode 100644
index 0000000000..521a9c7bca
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator-support.ts
@@ -0,0 +1,938 @@
+// Fixtures shared by per-collection-coordinator-oracle.test.ts and
+// per-collection-coordinator.test.ts: controlled BroadcastChannel and Web Locks
+// seams, coordinator lifecycle and cleanup helpers, and the adapter recorders.
+// Oracle laws and their models stay in the oracle file.
+
+import { setImmediate as nextTurn } from 'node:timers/promises'
+import { IR, createCollection, whenSyncAccepted } from '@tanstack/db'
+import { QueryClient } from '@tanstack/query-core'
+import { queryCollectionOptions } from '@tanstack/query-db-collection'
+import { expect } from 'vitest'
+import { BrowserCollectionCoordinator } from '../src/browser-coordinator'
+import {
+  createBrowserWASQLitePersistence,
+  persistedCollectionOptions,
+} from '../src'
+import { storageId } from './browser-coordinator-support'
+import { createWASQLiteTestDatabase } from './helpers/wa-sqlite-test-db'
+import type {
+  PersistedStorageTarget,
+  PersistenceAdapter,
+  TransportedLoadSubsetOptions,
+} from '@tanstack/db-sqlite-persistence-core'
+import type { LoadSubsetOptions, Subscription, SyncConfig } from '@tanstack/db'
+import type { BrowserWASQLiteDatabase } from '../src'
+
+export const DEFAULT_RUNS = 12
+
+export const durableTerms = new Map<string, number>()
+
+export type CoordinatorOracleProperty = `remote-lease` | `routing`
+
+export type CoordinatorOracleEnvironment = Record<string, string | undefined>
+
+export type CoordinatorOracleReplay = {
+  property: CoordinatorOracleProperty
+  seed: number
+  path: string
+}
+
+export function readCoordinatorOracleConfig(
+  environment: CoordinatorOracleEnvironment = process.env,
+): { runs: number; replay?: CoordinatorOracleReplay } {
+  const runText =
+    environment.TANSTACK_DB_COORDINATOR_ORACLE_RUNS ?? String(DEFAULT_RUNS)
+  const runs = Number(runText)
+  if (!/^\d+$/.test(runText) || !Number.isSafeInteger(runs) || runs < 1) {
+    throw new Error(`Invalid TANSTACK_DB_COORDINATOR_ORACLE_RUNS`)
+  }
+
+  const seedText = environment.TANSTACK_DB_COORDINATOR_ORACLE_SEED
+  const path = environment.TANSTACK_DB_COORDINATOR_ORACLE_PATH
+  const property = environment.TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY
+  if (seedText === undefined && path === undefined && property === undefined) {
+    return { runs }
+  }
+  if (seedText === undefined || path === undefined || property === undefined) {
+    throw new Error(
+      `Coordinator oracle replay requires SEED, PATH, and PROPERTY together`,
+    )
+  }
+
+  const seed = Number(seedText)
+  if (!/^-?\d+$/.test(seedText) || !Number.isSafeInteger(seed)) {
+    throw new Error(`Invalid TANSTACK_DB_COORDINATOR_ORACLE_SEED`)
+  }
+  if (!/^\d+(?::\d+)*$/.test(path)) {
+    throw new Error(
+      `TANSTACK_DB_COORDINATOR_ORACLE_PATH must be a numeric shrink path`,
+    )
+  }
+  if (property !== `remote-lease` && property !== `routing`) {
+    throw new Error(
+      `TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY must be remote-lease or routing`,
+    )
+  }
+  return { runs, replay: { property, seed, path } }
+}
+
+export type MessageHandler = (event: { data: unknown }) => void
+
+export type DelayedDelivery = {
+  channel: string
+  source: ControlledBroadcastChannel
+  target: ControlledBroadcastChannel
+  data: unknown
+}
+
+export type CloneAttempt = {
+  data: unknown
+  errorName?: string
+}
+
+export class ControlledBroadcastChannel {
+  static readonly endpoints = new Map<string, Set<ControlledBroadcastChannel>>()
+  static readonly delayed: Array<DelayedDelivery> = []
+  static readonly cloneAttempts: Array<CloneAttempt> = []
+  static retiredDeliveries = 0
+
+  readonly name: string
+  onmessage: MessageHandler | null = null
+
+  constructor(name: string) {
+    this.name = name
+    const peers = ControlledBroadcastChannel.endpoints.get(name) ?? new Set()
+    peers.add(this)
+    ControlledBroadcastChannel.endpoints.set(name, peers)
+  }
+
+  postMessage(data: unknown): void {
+    let copy: unknown
+    try {
+      copy = structuredClone(data)
+      ControlledBroadcastChannel.cloneAttempts.push({ data })
+    } catch (error) {
+      ControlledBroadcastChannel.cloneAttempts.push({
+        data,
+        errorName: error instanceof Error ? error.name : String(error),
+      })
+      throw error
+    }
+
+    for (const target of ControlledBroadcastChannel.endpoints.get(this.name) ??
+      []) {
+      if (target === this || !target.onmessage) continue
+      ControlledBroadcastChannel.delayed.push({
+        channel: this.name,
+        source: this,
+        target,
+        data: copy,
+      })
+    }
+  }
+
+  close(): void {
+    const peers = ControlledBroadcastChannel.endpoints.get(this.name)
+    peers?.delete(this)
+    if (peers?.size === 0) {
+      ControlledBroadcastChannel.endpoints.delete(this.name)
+    }
+    for (
+      let index = ControlledBroadcastChannel.delayed.length - 1;
+      index >= 0;
+      index--
+    ) {
+      const delivery = ControlledBroadcastChannel.delayed[index]
+      if (delivery?.source === this || delivery?.target === this) {
+        ControlledBroadcastChannel.delayed.splice(index, 1)
+        ControlledBroadcastChannel.retiredDeliveries++
+      }
+    }
+    this.onmessage = null
+  }
+
+  static deliverAt(index: number): boolean {
+    const [delivery] = this.delayed.splice(index, 1)
+    if (!delivery) return false
+    delivery.target.onmessage?.({ data: delivery.data })
+    return true
+  }
+
+  static deliverWhere(predicate: (data: unknown) => boolean): boolean {
+    const index = this.delayed.findIndex((delivery) => predicate(delivery.data))
+    return index >= 0 ? this.deliverAt(index) : false
+  }
+
+  static reset(): void {
+    this.endpoints.clear()
+    this.delayed.length = 0
+    this.cloneAttempts.length = 0
+    this.retiredDeliveries = 0
+  }
+}
+
+export type LockCallback = (lock: { name: string }) => Promise<unknown>
+
+export type LockQueueEntry = {
+  callback: LockCallback
+  signal?: AbortSignal
+  resolve: (value: unknown) => void
+  reject: (error: unknown) => void
+}
+
+export const heldLocks = new Set<string>()
+
+export const queuedLocks = new Map<string, Array<LockQueueEntry>>()
+
+export function grantNextLock(name: string): void {
+  if (heldLocks.has(name)) return
+  const queue = queuedLocks.get(name)
+  const next = queue?.shift()
+  if (!next) return
+  if (queue?.length === 0) queuedLocks.delete(name)
+  if (next.signal?.aborted) {
+    grantNextLock(name)
+    return
+  }
+
+  heldLocks.add(name)
+  void Promise.resolve(next.callback({ name })).then(
+    (value) => {
+      heldLocks.delete(name)
+      next.resolve(value)
+      grantNextLock(name)
+    },
+    (error) => {
+      heldLocks.delete(name)
+      next.reject(error)
+      grantNextLock(name)
+    },
+  )
+}
+
+export const controlledLocks = {
+  request: (
+    name: string,
+    optionsOrCallback: { signal?: AbortSignal } | LockCallback,
+    maybeCallback?: LockCallback,
+  ): Promise<unknown> => {
+    const callback =
+      typeof optionsOrCallback === `function`
+        ? optionsOrCallback
+        : maybeCallback!
+    const signal =
+      typeof optionsOrCallback === `object`
+        ? optionsOrCallback.signal
+        : undefined
+
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(new DOMException(`Lock request aborted`, `AbortError`))
+        return
+      }
+      const entry = { callback, signal, resolve, reject }
+      const queue = queuedLocks.get(name) ?? []
+      queue.push(entry)
+      queuedLocks.set(name, queue)
+      signal?.addEventListener(
+        `abort`,
+        () => {
+          const current = queuedLocks.get(name)
+          const index = current?.indexOf(entry) ?? -1
+          if (index >= 0) {
+            current!.splice(index, 1)
+            if (current!.length === 0) queuedLocks.delete(name)
+            reject(new DOMException(`Lock request aborted`, `AbortError`))
+          }
+        },
+        { once: true },
+      )
+      grantNextLock(name)
+    })
+  },
+}
+
+export let originalBroadcastChannelDescriptor: PropertyDescriptor | undefined
+
+export let originalNavigatorDescriptor: PropertyDescriptor | undefined
+
+export function installControlledBrowserSeams(): void {
+  originalBroadcastChannelDescriptor = Object.getOwnPropertyDescriptor(
+    globalThis,
+    `BroadcastChannel`,
+  )
+  originalNavigatorDescriptor = Object.getOwnPropertyDescriptor(
+    globalThis,
+    `navigator`,
+  )
+  Object.defineProperty(globalThis, `BroadcastChannel`, {
+    value: ControlledBroadcastChannel,
+    writable: true,
+    configurable: true,
+  })
+  Object.defineProperty(globalThis, `navigator`, {
+    value: { locks: controlledLocks },
+    writable: true,
+    configurable: true,
+  })
+}
+
+export function restoreControlledBrowserSeams(): void {
+  if (originalBroadcastChannelDescriptor) {
+    Object.defineProperty(
+      globalThis,
+      `BroadcastChannel`,
+      originalBroadcastChannelDescriptor,
+    )
+  } else {
+    Reflect.deleteProperty(globalThis, `BroadcastChannel`)
+  }
+  if (originalNavigatorDescriptor) {
+    Object.defineProperty(globalThis, `navigator`, originalNavigatorDescriptor)
+  } else {
+    Reflect.deleteProperty(globalThis, `navigator`)
+  }
+  originalBroadcastChannelDescriptor = undefined
+  originalNavigatorDescriptor = undefined
+}
+
+export function payloadType(data: unknown): string | undefined {
+  if (!data || typeof data !== `object` || !(`payload` in data))
+    return undefined
+  const payload = (data as { payload?: unknown }).payload
+  if (!payload || typeof payload !== `object` || !(`type` in payload)) {
+    return undefined
+  }
+  return String((payload as { type?: unknown }).type)
+}
+
+export function envelopeCollection(data: unknown): string | undefined {
+  if (!data || typeof data !== `object` || !(`collectionId` in data)) {
+    return undefined
+  }
+  return String((data as { collectionId?: unknown }).collectionId)
+}
+
+export async function pumpNetwork(): Promise<void> {
+  for (let pass = 0; pass < 100; pass++) {
+    while (ControlledBroadcastChannel.deliverAt(0)) {
+      await Promise.resolve()
+    }
+    await nextTurn()
+    if (ControlledBroadcastChannel.delayed.length === 0) return
+  }
+  throw new Error(`controlled network failed to become idle`)
+}
+
+export async function waitFor(
+  predicate: () => boolean,
+  checkpoint: string,
+): Promise<void> {
+  for (let pass = 0; pass < 100; pass++) {
+    if (predicate()) return
+    await pumpNetwork()
+    await nextTurn()
+  }
+  throw new Error(`did not reach ${checkpoint}`)
+}
+
+export async function waitForWithoutDelivery(
+  predicate: () => boolean,
+  checkpoint: string,
+): Promise<void> {
+  for (let pass = 0; pass < 100; pass++) {
+    if (predicate()) return
+    await nextTurn()
+  }
+  throw new Error(`did not reach ${checkpoint}`)
+}
+
+export type CleanupDiagnostic = {
+  resource: string
+  error: string
+}
+
+export const NO_PRIMARY_FAILURE = Symbol(`no-primary-failure`)
+
+export async function captureCleanup(
+  diagnostics: Array<CleanupDiagnostic>,
+  resource: string,
+  cleanup: () => Promise<void> | void,
+): Promise<void> {
+  try {
+    await cleanup()
+  } catch (error) {
+    diagnostics.push({
+      resource,
+      error:
+        error instanceof Error
+          ? `${error.name}: ${error.message}`
+          : String(error),
+    })
+  }
+}
+
+export async function withFailurePreservingCleanup(
+  body: () => Promise<void>,
+  cleanups: ReadonlyArray<readonly [string, () => Promise<void> | void]>,
+): Promise<void> {
+  let primaryFailure: unknown | typeof NO_PRIMARY_FAILURE = NO_PRIMARY_FAILURE
+  const cleanupDiagnostics: Array<CleanupDiagnostic> = []
+  try {
+    await body()
+  } catch (error) {
+    primaryFailure = error
+  }
+  for (const [resource, cleanup] of cleanups) {
+    await captureCleanup(cleanupDiagnostics, resource, cleanup)
+  }
+  expect.soft(cleanupDiagnostics).toEqual([])
+  if (primaryFailure !== NO_PRIMARY_FAILURE) throw primaryFailure
+}
+
+export type AdapterCall = {
+  operation: `load` | `apply` | `index` | `position` | `remote-subset` | `pull`
+  adapterId: string
+  collectionId: string
+  ownerAtCall?: string
+  argument?: SemanticValue
+}
+
+export type PullFixtureResult = {
+  latestRowVersion: number
+  requiresFullReload: false
+  changedKeys: Array<string | number>
+  deletedKeys: Array<string | number>
+}
+
+export type RecordedSubsetOptions =
+  LoadSubsetOptions | TransportedLoadSubsetOptions
+
+export type RecordingAdapter = PersistenceAdapter & {
+  id: string
+  schemaVersion: number
+  policy: `sync-present-reset` | `sync-absent-error`
+  calls: Array<AdapterCall>
+  getStreamPosition: (target: PersistedStorageTarget) => Promise<{
+    latestTerm: number
+    latestSeq: number
+    latestRowVersion: number
+  }>
+  ensureRemoteSubset: (
+    collectionId: string,
+    options: RecordedSubsetOptions,
+  ) => Promise<void>
+  pullSince: (
+    target: PersistedStorageTarget,
+    fromRowVersion: number,
+  ) => Promise<PullFixtureResult>
+}
+
+export function createRecordingAdapter(options: {
+  id: string
+  schemaVersion?: number
+  policy?: RecordingAdapter[`policy`]
+  owner?: () => string | undefined
+  remoteSubsetOwner?: (
+    collectionId: string,
+    options: RecordedSubsetOptions,
+  ) => Promise<void>
+  pullResult?: PullFixtureResult
+}): RecordingAdapter {
+  const calls: Array<AdapterCall> = []
+  const record = (
+    operation: AdapterCall[`operation`],
+    collectionId: string,
+    argument?: SemanticValue,
+  ) => {
+    calls.push({
+      operation,
+      adapterId: options.id,
+      collectionId,
+      ownerAtCall: options.owner?.(),
+      ...(argument === undefined ? {} : { argument }),
+    })
+  }
+
+  return {
+    id: options.id,
+    schemaVersion: options.schemaVersion ?? 1,
+    policy: options.policy ?? `sync-present-reset`,
+    calls,
+    loadSubset: (target) => {
+      record(`load`, storageId(target))
+      return Promise.resolve([])
+    },
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: (target) => {
+      record(`apply`, storageId(target))
+      return Promise.resolve()
+    },
+    ensureIndex: (target, signature, spec) => {
+      record(`index`, storageId(target), semanticValue({ signature, spec }))
+      return Promise.resolve()
+    },
+    getStreamPosition: (target) => {
+      record(`position`, storageId(target))
+      return Promise.resolve({
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+      })
+    },
+    async reserveLeadershipTerm(target, observedTerm) {
+      const collectionId = storageId(target)
+      const position = await this.getStreamPosition(target)
+      const latestTerm =
+        Math.max(
+          position.latestTerm,
+          durableTerms.get(collectionId) ?? 0,
+          observedTerm,
+        ) + 1
+      durableTerms.set(collectionId, latestTerm)
+      return { ...position, latestTerm }
+    },
+    ensureRemoteSubset: (collectionId, subsetOptions) => {
+      record(`remote-subset`, collectionId, subsetSemantics(subsetOptions))
+      if (!options.remoteSubsetOwner) {
+        throw new Error(`no remote subset owner for ${collectionId}`)
+      }
+      return options.remoteSubsetOwner(collectionId, subsetOptions)
+    },
+    pullSince: (target, fromRowVersion) => {
+      record(`pull`, storageId(target), semanticValue({ fromRowVersion }))
+      const result = options.pullResult ?? {
+        latestRowVersion: 0,
+        requiresFullReload: false,
+        changedKeys: [],
+        deletedKeys: [],
+      }
+      return Promise.resolve(structuredClone(result))
+    },
+  }
+}
+
+export type SemanticValue =
+  | null
+  | boolean
+  | number
+  | string
+  | Array<SemanticValue>
+  | { [key: string]: SemanticValue }
+
+export function semanticValue(value: unknown): SemanticValue {
+  if (
+    value === null ||
+    typeof value === `boolean` ||
+    typeof value === `number` ||
+    typeof value === `string`
+  ) {
+    return value
+  }
+  if (value instanceof Date) return { date: value.toISOString() }
+  if (value instanceof Uint8Array) return { bytes: Array.from(value) }
+  if (Array.isArray(value)) return value.map(semanticValue)
+  if (typeof value === `object`) {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, semanticValue(entry)]),
+    )
+  }
+  throw new Error(`unsupported semantic wire value: ${typeof value}`)
+}
+
+export function subsetSemantics(
+  options: LoadSubsetOptions | TransportedLoadSubsetOptions,
+): SemanticValue {
+  return semanticValue({
+    ...(options.where === undefined ? {} : { where: options.where }),
+    ...(options.orderBy === undefined ? {} : { orderBy: options.orderBy }),
+    ...(options.limit === undefined ? {} : { limit: options.limit }),
+    ...(options.cursor === undefined ? {} : { cursor: options.cursor }),
+    ...(options.offset === undefined ? {} : { offset: options.offset }),
+  })
+}
+
+export function complexSubsetDemand(
+  includeSubscription: boolean,
+): LoadSubsetOptions {
+  return {
+    where: new IR.Func(`eq`, [
+      new IR.PropRef([`alpha`, `createdAt`]),
+      new IR.Value(new Date(`2026-09-16T12:34:56.000Z`)),
+    ]),
+    orderBy: [
+      {
+        expression: new IR.PropRef([`alpha`, `score`]),
+        compareOptions: { direction: `desc`, nulls: `last` },
+      },
+    ],
+    limit: 3,
+    cursor: {
+      whereFrom: new IR.Func(`gt`, [
+        new IR.PropRef([`alpha`, `token`]),
+        new IR.Value(new Uint8Array([1, 2, 255])),
+      ]),
+      whereCurrent: new IR.Func(`eq`, [
+        new IR.PropRef([`alpha`, `score`]),
+        new IR.Value(42),
+      ]),
+      lastKey: `a-42`,
+    },
+    offset: 1,
+    ...(includeSubscription
+      ? {
+          subscription: {
+            on: () => () => {},
+          } as unknown as Subscription,
+        }
+      : {}),
+  }
+}
+
+export const liveCoordinators = new Set<BrowserCollectionCoordinator>()
+
+export function createCoordinator(
+  dbName: string,
+  adapter: PersistenceAdapter,
+): BrowserCollectionCoordinator {
+  const coordinator = new BrowserCollectionCoordinator({ dbName, adapter })
+  liveCoordinators.add(coordinator)
+  return coordinator
+}
+
+export function registerCollectionAdapter(
+  coordinator: BrowserCollectionCoordinator,
+  collectionId: string,
+  adapter: RecordingAdapter,
+  registerOwner: boolean = true,
+): void {
+  coordinator.setAdapterForCollection(collectionId, adapter)
+  if (!registerOwner) return
+  coordinator.registerRemoteSubsetOwner(
+    collectionId,
+    Object.assign(
+      (options: TransportedLoadSubsetOptions) =>
+        adapter.ensureRemoteSubset(collectionId, options),
+      {
+        // These route/wire laws do not exercise acquisition-release semantics; the
+        // dedicated remote-ownership oracle below owns exact unload behavior.
+        unloadSubset: () => {},
+        onError: () => {},
+      },
+    ),
+  )
+}
+
+export async function disposeCoordinator(
+  coordinator?: BrowserCollectionCoordinator,
+): Promise<void> {
+  if (!coordinator || !liveCoordinators.has(coordinator)) return
+  coordinator.dispose()
+  liveCoordinators.delete(coordinator)
+  await nextTurn()
+}
+
+export function coordinatorFixtureSnapshot() {
+  return {
+    delayed: ControlledBroadcastChannel.delayed.length,
+    endpoints: ControlledBroadcastChannel.endpoints.size,
+    heldLocks: heldLocks.size,
+    queuedLocks: Array.from(queuedLocks.values()).reduce(
+      (count, queue) => count + queue.length,
+      0,
+    ),
+  }
+}
+
+export type RemoteLeaseHistory = {
+  siblingCount: number
+  releasePrefix: number
+  identical: boolean
+  duplicateRelease: boolean
+  reverseFinalRelease: boolean
+}
+
+export type RemoteLeaseGrammarPlan = {
+  demands: Array<{ limit: number; offset?: number }>
+  releaseCount: number
+  prefixReleaseIndexes: Array<number>
+  finalReleaseIndexes: Array<number>
+  releasePasses: number
+}
+
+export function remoteLeaseGrammarPlan(
+  history: RemoteLeaseHistory,
+): RemoteLeaseGrammarPlan {
+  const demands = Array.from(
+    { length: history.siblingCount },
+    (_unused, index) => ({
+      limit: 1,
+      ...(history.identical ? {} : { offset: index }),
+    }),
+  )
+  const releaseCount = Math.min(history.releasePrefix, history.siblingCount - 1)
+  const prefixReleaseIndexes = Array.from(
+    { length: releaseCount },
+    (_unused, index) => index,
+  )
+  const finalReleaseIndexes = Array.from(
+    { length: history.siblingCount - releaseCount },
+    (_unused, index) => releaseCount + index,
+  )
+  if (history.reverseFinalRelease) finalReleaseIndexes.reverse()
+  return {
+    demands,
+    releaseCount,
+    prefixReleaseIndexes,
+    finalReleaseIndexes,
+    releasePasses: history.duplicateRelease ? 2 : 1,
+  }
+}
+
+export type CollectionName = `alpha` | `beta`
+
+export type TabName = `leader` | `follower`
+
+export type RoutingHistory = {
+  alphaVersion: number
+  betaVersion: number
+  registrationOrder: [CollectionName, CollectionName]
+  firstDeliveryOrder: [CollectionName, CollectionName]
+  secondDeliveryOrder: [CollectionName, CollectionName]
+}
+
+export type RoutingHistoryAxes = Omit<RoutingHistory, `betaVersion`> & {
+  versionDelta: number
+}
+
+export function routingHistoryFromAxes({
+  alphaVersion,
+  versionDelta,
+  ...history
+}: RoutingHistoryAxes): RoutingHistory {
+  return {
+    ...history,
+    alphaVersion,
+    betaVersion: alphaVersion + versionDelta,
+  }
+}
+
+export type RoutingGrammarPlan = {
+  initialCollection: CollectionName
+  registrationOrder: [CollectionName, CollectionName]
+  firstDeliveryOrder: [CollectionName, CollectionName]
+  secondDeliveryOrder: [CollectionName, CollectionName]
+  adapterIds: Record<TabName, Record<CollectionName, string>>
+}
+
+export function routingGrammarPlan(
+  history: RoutingHistory,
+): RoutingGrammarPlan {
+  return {
+    initialCollection: history.registrationOrder[0],
+    registrationOrder: history.registrationOrder,
+    firstDeliveryOrder: history.firstDeliveryOrder,
+    secondDeliveryOrder: history.secondDeliveryOrder,
+    adapterIds: {
+      leader: {
+        alpha: `leader-alpha-v${history.alphaVersion}-reset`,
+        beta: `leader-beta-v${history.betaVersion}-error`,
+      },
+      follower: {
+        alpha: `follower-alpha-v${history.alphaVersion}-reset`,
+        beta: `follower-beta-v${history.betaVersion}-error`,
+      },
+    },
+  }
+}
+
+// Node's own BroadcastChannel and Web Locks, captured before any test installs
+// the controlled seams. This lane swaps them in for its body only.
+export const nativeBroadcastChannel = globalThis.BroadcastChannel
+
+export const nativeNavigator = globalThis.navigator
+
+export function withNativeBrowserTransport<T>(
+  body: () => Promise<T>,
+): Promise<T> {
+  const controlledChannel = globalThis.BroadcastChannel
+  const controlledNavigator = globalThis.navigator
+  const define = (channel: unknown, navigator: unknown) => {
+    Object.defineProperty(globalThis, `BroadcastChannel`, {
+      value: channel,
+      writable: true,
+      configurable: true,
+    })
+    Object.defineProperty(globalThis, `navigator`, {
+      value: navigator,
+      writable: true,
+      configurable: true,
+    })
+  }
+  define(nativeBroadcastChannel, nativeNavigator)
+  return body().finally(() => define(controlledChannel, controlledNavigator))
+}
+
+export type RealTabSource = `receipt` | `query-db`
+
+export type RealTabRow = { id: string; group: string }
+
+// One tab: a real SQLite connection to the shared file, a real coordinator,
+// browser persistence, and the persisted on-demand Collection every tab
+// defines. Only the leader's source runs; a follower routes demand.
+export function createRealTab(options: {
+  dbName: string
+  filename: string
+  source: RealTabSource
+  upstream: Map<string, RealTabRow>
+  holdUpstream?: () => Promise<void>
+  readGate?: (rows: ReadonlyArray<unknown>) => Promise<void>
+  now?: () => number
+  // Commit on every load: a newer version of a delivered row (`update`), or
+  // the same row inserted again (`reinsert`, an equal-value insert core
+  // reconciles as an update).
+  commitEachLoad?: `update` | `reinsert`
+}) {
+  const database = createWASQLiteTestDatabase({ filename: options.filename })
+  const gatedDatabase: BrowserWASQLiteDatabase = {
+    execute: async (sql, params) => {
+      const rows = await database.execute(sql, params)
+      if (options.readGate && /^\s*select/i.test(sql)) {
+        await options.readGate(rows)
+      }
+      return rows as never
+    },
+    close: () => database.close?.(),
+  }
+  const coordinator = new BrowserCollectionCoordinator({
+    dbName: options.dbName,
+  })
+  liveCoordinators.add(coordinator)
+  const persistence = createBrowserWASQLitePersistence({
+    database: gatedDatabase,
+    coordinator,
+    ...(options.now
+      ? { now: options.now, cacheGenerationClaimTtlMs: 10_000 }
+      : {}),
+  })
+  const upstreamRows = (where: unknown) => {
+    const wanted = JSON.stringify(where ?? null)
+    return Array.from(options.upstream.values()).filter((row) =>
+      wanted.includes(`"${row.id}"`),
+    )
+  }
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  })
+  const trace: Array<string> = []
+  let storageCollectionId: string | undefined
+  const setAdapter = coordinator.setAdapterForCollection.bind(coordinator)
+  coordinator.setAdapterForCollection = (collectionId, adapter, claimId) => {
+    if (claimId) storageCollectionId = collectionId
+    setAdapter(collectionId, adapter, claimId)
+  }
+  const ensure = coordinator.requestEnsureRemoteSubset.bind(coordinator)
+  coordinator.requestEnsureRemoteSubset = (collectionId, subset) => {
+    trace.push(`ensure`)
+    return ensure(collectionId, subset).finally(() =>
+      trace.push(`ensure-settled`),
+    )
+  }
+  const loadUpstream = async (where: unknown) => {
+    trace.push(`upstream`)
+    await options.holdUpstream?.()
+    return upstreamRows(where)
+  }
+  const delivered = new Set<string>()
+  let version = 0
+  const receiptSource: SyncConfig<RealTabRow, string> = {
+    sync: ({ begin, write, commit, markReady }) => {
+      markReady()
+      return {
+        loadSubset: async (subset) => {
+          if (options.commitEachLoad) {
+            const fresh = await loadUpstream(subset.where)
+            if (fresh.length === 0) return
+            begin()
+            for (const row of fresh) {
+              const delivered_ = delivered.has(row.id)
+              delivered.add(row.id)
+              if (options.commitEachLoad === `update` && delivered_) {
+                const next = { ...row, group: `v${++version}` }
+                options.upstream.set(row.id, next)
+                write({ type: `update`, value: next })
+              } else write({ type: `insert`, value: row })
+            }
+            await whenSyncAccepted(commit())
+            return
+          }
+          // Like a real source, deliver each upstream row version once.
+          const rows = (await loadUpstream(subset.where)).filter(
+            (row) => !delivered.has(row.id),
+          )
+          for (const row of rows) delivered.add(row.id)
+          if (rows.length === 0) return
+          begin()
+          for (const row of rows) write({ type: `insert`, value: row })
+          await whenSyncAccepted(commit())
+        },
+      }
+    },
+  }
+  const collection =
+    options.source === `receipt`
+      ? createCollection(
+          persistedCollectionOptions<RealTabRow, string>({
+            id: `real-tab-items`,
+            schemaVersion: 1,
+            persistence,
+            syncMode: `on-demand`,
+            getKey: (row) => row.id,
+            sync: receiptSource,
+          }),
+        )
+      : createCollection(
+          persistedCollectionOptions<RealTabRow, string>({
+            id: `real-tab-items`,
+            schemaVersion: 1,
+            persistence,
+            ...queryCollectionOptions<
+              RealTabRow,
+              unknown,
+              Array<string>,
+              string
+            >({
+              queryKey: [`real-tab-items`],
+              queryClient,
+              syncMode: `on-demand`,
+              getKey: (row) => row.id,
+              queryFn: (context) =>
+                loadUpstream(context.meta?.loadSubsetOptions?.where),
+            }),
+          }),
+        )
+  return {
+    coordinator,
+    collection,
+    trace,
+    storageCollectionId: () => storageCollectionId,
+    cleanup: async () => {
+      await collection.cleanup()
+      queryClient.clear()
+      coordinator.dispose()
+      liveCoordinators.delete(coordinator)
+      database.close?.()
+    },
+  }
+}
diff --git a/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator.test.ts b/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator.test.ts
new file mode 100644
index 0000000000..411657bef0
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/per-collection-coordinator.test.ts
@@ -0,0 +1,1976 @@
+// Scenario tests for the per-collection coordinator: wire and acknowledgement
+// partitioning, persisted cache generation routing, remote subset lease
+// bookkeeping, per-collection adapter routing, SQLite state, sync-ingested
+// ownership, and follower settlement across real tabs. Each test pins one
+// scenario with hand-written expectations. The laws these scenarios touch are
+// owned by per-collection-coordinator-oracle.test.ts, which generates histories
+// and compares production with independent models.
+
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { setImmediate as nextTurn } from 'node:timers/promises'
+import {
+  IR,
+  createCollection,
+  createLiveQueryCollection,
+  eq,
+  whenSyncAccepted,
+} from '@tanstack/db'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createBrowserWASQLitePersistence,
+  persistedCollectionOptions,
+} from '../src'
+import { createWASQLiteTestDatabase } from './helpers/wa-sqlite-test-db'
+import {
+  ControlledBroadcastChannel,
+  DEFAULT_RUNS,
+  captureCleanup,
+  complexSubsetDemand,
+  coordinatorFixtureSnapshot,
+  createCoordinator,
+  createRealTab,
+  createRecordingAdapter,
+  disposeCoordinator,
+  durableTerms,
+  envelopeCollection,
+  heldLocks,
+  installControlledBrowserSeams,
+  liveCoordinators,
+  payloadType,
+  pumpNetwork,
+  queuedLocks,
+  readCoordinatorOracleConfig,
+  registerCollectionAdapter,
+  remoteLeaseGrammarPlan,
+  restoreControlledBrowserSeams,
+  routingGrammarPlan,
+  routingHistoryFromAxes,
+  semanticValue,
+  subsetSemantics,
+  waitFor,
+  waitForWithoutDelivery,
+  withFailurePreservingCleanup,
+  withNativeBrowserTransport,
+} from './per-collection-coordinator-support'
+import { storageId } from './browser-coordinator-support'
+import type { BrowserCollectionCoordinator } from '../src/browser-coordinator'
+import type {
+  PersistedTx,
+  PersistenceAdapter,
+} from '@tanstack/db-sqlite-persistence-core'
+import type { Collection, LoadSubsetOptions, SyncConfig } from '@tanstack/db'
+import type {
+  CleanupDiagnostic,
+  RealTabRow,
+  RecordingAdapter,
+  RemoteLeaseGrammarPlan,
+  RemoteLeaseHistory,
+  RoutingGrammarPlan,
+  RoutingHistory,
+  RoutingHistoryAxes,
+} from './per-collection-coordinator-support'
+
+// The storage oracle exercises the SQLite generation catalog. This small
+// adapter supplies only its public claim/rotation result so the Browser owner
+// oracle can judge the separate coordinator boundary with two live sync runs.
+function createGenerationRecordingAdapter(
+  id: string,
+  claimExpired: () => boolean = () => false,
+): RecordingAdapter & { currentStorageId: () => string } {
+  const adapter = createRecordingAdapter({ id })
+  let currentStorageId = `cache-generation-0`
+  let nextGeneration = 1
+  let nextClaim = 0
+  const claims = new Map<string, string>()
+  adapter.claimCacheGeneration = () => {
+    const claimId = `${id}-claim-${++nextClaim}`
+    claims.set(claimId, currentStorageId)
+    return Promise.resolve({ storageCollectionId: currentStorageId, claimId })
+  }
+  adapter.rotateCacheGeneration = (_collectionId, claimId) => {
+    if (claims.get(claimId) !== currentStorageId && !claimExpired()) {
+      return Promise.reject(new Error(`recovery lost its cache claim`))
+    }
+    const storageCollectionId = `cache-generation-${nextGeneration++}`
+    if (!claimExpired()) currentStorageId = storageCollectionId
+    claims.set(claimId, storageCollectionId)
+    return Promise.resolve({ storageCollectionId, claimId })
+  }
+  adapter.renewCacheGenerationClaim = (storageCollectionId, claimId) =>
+    Promise.resolve(
+      !claimExpired() && claims.get(claimId) === storageCollectionId
+        ? Date.now() + 10_000
+        : undefined,
+    )
+  adapter.releaseCacheGenerationClaim = (claimId) => {
+    claims.delete(claimId)
+    return Promise.resolve()
+  }
+  return Object.assign(adapter, { currentStorageId: () => currentStorageId })
+}
+
+beforeEach(() => {
+  durableTerms.clear()
+  installControlledBrowserSeams()
+})
+
+afterEach(async () => {
+  const cleanupDiagnostics: Array<CleanupDiagnostic> = []
+  for (const coordinator of liveCoordinators) {
+    await captureCleanup(cleanupDiagnostics, `afterEach live coordinator`, () =>
+      coordinator.dispose(),
+    )
+  }
+  liveCoordinators.clear()
+  await captureCleanup(
+    cleanupDiagnostics,
+    `afterEach lock release`,
+    async () => {
+      await waitForWithoutDelivery(
+        () => heldLocks.size === 0 && queuedLocks.size === 0,
+        `afterEach lock release`,
+      )
+    },
+  )
+  const cleanupSnapshot = coordinatorFixtureSnapshot()
+  expect.soft(cleanupSnapshot).toEqual({
+    delayed: 0,
+    endpoints: 0,
+    heldLocks: 0,
+    queuedLocks: 0,
+  })
+  await captureCleanup(
+    cleanupDiagnostics,
+    `global browser descriptors`,
+    restoreControlledBrowserSeams,
+  )
+  await captureCleanup(cleanupDiagnostics, `vitest timers and mocks`, () => {
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+  ControlledBroadcastChannel.reset()
+  heldLocks.clear()
+  queuedLocks.clear()
+  expect.soft(cleanupDiagnostics).toEqual([])
+})
+
+describe(`per-collection coordinator wire and acknowledgement oracle`, () => {
+  it(`round-trips supported subset semantics across the emitted message partition`, async () => {
+    const leaderAdapter = createRecordingAdapter({
+      id: `partition-leader`,
+      remoteSubsetOwner: () => Promise.resolve(),
+    })
+    const followerAdapter = createRecordingAdapter({ id: `partition-follower` })
+    let leader: BrowserCollectionCoordinator | undefined
+    let follower: BrowserCollectionCoordinator | undefined
+
+    await withFailurePreservingCleanup(async () => {
+      leader = createCoordinator(`wire-partition`, leaderAdapter)
+      follower = createCoordinator(`wire-partition`, followerAdapter)
+      registerCollectionAdapter(leader, `alpha`, leaderAdapter)
+      registerCollectionAdapter(follower, `alpha`, followerAdapter)
+      leader.subscribe(`alpha`, () => {})
+      follower.subscribe(`alpha`, () => {})
+      await waitFor(
+        () => leader!.isLeader(`alpha`) && !follower!.isLeader(`alpha`),
+        `wire partition leader/follower topology`,
+      )
+
+      const demand = complexSubsetDemand(false)
+      const subsetRequest = follower.requestEnsureRemoteSubset(`alpha`, demand)
+      const queuedSubset = ControlledBroadcastChannel.delayed.find(
+        ({ data }) => payloadType(data) === `rpc:ensureRemoteSubset:req`,
+      )?.data as { payload?: { options?: LoadSubsetOptions } } | undefined
+      expect(subsetSemantics(queuedSubset?.payload?.options ?? {})).toEqual(
+        subsetSemantics(demand),
+      )
+      await pumpNetwork()
+      await subsetRequest
+
+      const mutationValue = {
+        id: `native-values`,
+        at: new Date(`2026-09-16T12:34:56.000Z`),
+        bytes: new Uint8Array([0, 127, 255]),
+      }
+      const mutationRequest = follower.requestApplyLocalMutations(`alpha`, [
+        {
+          mutationId: `native-values`,
+          type: `insert`,
+          key: `native-values`,
+          value: mutationValue,
+        },
+      ])
+      const queuedMutation = ControlledBroadcastChannel.delayed.find(
+        ({ data }) => payloadType(data) === `rpc:applyLocalMutations:req`,
+      )?.data as
+        | {
+            payload?: {
+              mutations?: Array<{ value?: unknown }>
+            }
+          }
+        | undefined
+      expect(
+        semanticValue(queuedMutation?.payload?.mutations?.[0]?.value),
+      ).toEqual(semanticValue(mutationValue))
+      await pumpNetwork()
+      await mutationRequest
+
+      const committedTx: PersistedTx = {
+        txId: `committed-native-values`,
+        term: 0,
+        seq: 0,
+        rowVersion: 0,
+        mutations: [
+          {
+            type: `update`,
+            key: `native-values`,
+            value: mutationValue,
+          },
+        ],
+        rowMetadataMutations: [
+          {
+            type: `set`,
+            key: `native-values`,
+            value: { source: `wire-partition` },
+          },
+        ],
+        collectionMetadataMutations: [
+          { type: `set`, key: `resume`, value: { offset: 4 } },
+        ],
+      }
+      const committedRequest = follower.requestApplyCommittedTx(
+        `alpha`,
+        committedTx,
+      )
+      const queuedCommitted = ControlledBroadcastChannel.delayed.find(
+        ({ data }) => payloadType(data) === `rpc:applyCommittedTx:req`,
+      )?.data as { payload?: { tx?: PersistedTx } } | undefined
+      expect(semanticValue(queuedCommitted?.payload?.tx)).toEqual(
+        semanticValue(committedTx),
+      )
+      await pumpNetwork()
+      const committedResponse = await committedRequest
+      expect(committedResponse).toEqual({
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: expect.any(String),
+        ok: true,
+        term: 1,
+        seq: 2,
+        latestRowVersion: 2,
+      })
+
+      const successfulPayloads = ControlledBroadcastChannel.cloneAttempts
+        .filter(({ errorName }) => errorName === undefined)
+        .map(({ data }) =>
+          data && typeof data === `object` && `payload` in data
+            ? (data as { payload?: unknown }).payload
+            : undefined,
+        )
+      const matchingCommittedResponses = successfulPayloads.filter(
+        (payload) =>
+          payload !== undefined &&
+          payload !== null &&
+          typeof payload === `object` &&
+          `type` in payload &&
+          payload.type === `rpc:applyCommittedTx:res` &&
+          `rpcId` in payload &&
+          payload.rpcId === committedResponse.rpcId,
+      )
+      const matchingCommittedEvents = successfulPayloads.filter(
+        (payload) =>
+          payload !== undefined &&
+          payload !== null &&
+          typeof payload === `object` &&
+          `type` in payload &&
+          payload.type === `tx:committed` &&
+          `txId` in payload &&
+          payload.txId === committedTx.txId,
+      )
+      expect(matchingCommittedResponses).toEqual([committedResponse])
+      expect(matchingCommittedEvents).toEqual([
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 2,
+          txId: `committed-native-values`,
+          latestRowVersion: 2,
+          requiresFullReload: false,
+          changedRows: [{ key: `native-values`, value: mutationValue }],
+          deletedKeys: [],
+          rowMetadataMutations: [
+            {
+              type: `set`,
+              key: `native-values`,
+              value: { source: `wire-partition` },
+            },
+          ],
+          collectionMetadataMutations: [
+            { type: `set`, key: `resume`, value: { offset: 4 } },
+          ],
+        },
+      ])
+
+      const indexRequest = follower.requestEnsurePersistedIndex(
+        `alpha`,
+        `score-index`,
+        { expressionSql: [`score`] },
+      )
+      await pumpNetwork()
+      await indexRequest
+      const pullRequest = follower.pullSince(`alpha`, 0)
+      await pumpNetwork()
+      await pullRequest
+
+      const successfulTypes = new Set(
+        ControlledBroadcastChannel.cloneAttempts
+          .filter(({ errorName }) => errorName === undefined)
+          .map(({ data }) => payloadType(data))
+          .filter((type): type is string => type !== undefined),
+      )
+      expect(successfulTypes).toEqual(
+        new Set([
+          `leader:heartbeat`,
+          `rpc:ensureRemoteSubset:req`,
+          `rpc:ensureRemoteSubset:res`,
+          `rpc:applyLocalMutations:req`,
+          `rpc:applyLocalMutations:res`,
+          `rpc:applyCommittedTx:req`,
+          `rpc:applyCommittedTx:res`,
+          `tx:committed`,
+          `rpc:ensurePersistedIndex:req`,
+          `rpc:ensurePersistedIndex:res`,
+          `rpc:pullSince:req`,
+          `rpc:pullSince:res`,
+        ]),
+      )
+    }, [
+      [
+        `wire partition leader`,
+        async () => {
+          await disposeCoordinator(leader)
+        },
+      ],
+      [
+        `wire partition follower`,
+        async () => {
+          await disposeCoordinator(follower)
+        },
+      ],
+    ])
+  })
+})
+
+describe(`persisted cache generation routing oracle`, () => {
+  // A cache generation is a routing boundary, while the public Collection ID
+  // remains the same. The independent model has two run-local source owners:
+  // after the second run loses its resume authority, its demand belongs to
+  // its new generation; the warm run retains its old source row and owner.
+  // The legal history is warm start, source commit, second start, scoped
+  // recovery, then one retained demand and one new demand. Real persisted
+  // wrappers and Browser coordinators drive that history. At each demand
+  // settlement, compare source-call counts, old acquisition release, and the
+  // warm public row. The controlled browser seam
+  // does not establish native multi-tab or OPFS behavior; the SQLite owner
+  // separately proves durable generation separation.
+  it(`routes a recovering run's demand to its own source while a warm run keeps its row`, async () => {
+    type Row = { id: string; title: string }
+    const collectionId = `shared-public-collection`
+    const adapter = createGenerationRecordingAdapter(`shared-cache`)
+    const warmCoordinator = createCoordinator(`generation-routing`, adapter)
+    const recoveringCoordinator = createCoordinator(
+      `generation-routing`,
+      adapter,
+    )
+    let warmSource!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+    let recoveringSource!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+    let warmStarted = false
+    let recoveringStarted = false
+    let warmLoads = 0
+    let warmUnloads = 0
+    let recoveringLoads = 0
+    let recoveringRefetches = 0
+    let releaseWarmLoad!: () => void
+    const warmLoadGate = new Promise<void>((resolve) => {
+      releaseWarmLoad = resolve
+    })
+    let warmCollection: Collection<Row, string> | undefined
+    let recoveringCollection: Collection<Row, string> | undefined
+    const cleanupCollection = async (
+      collection: Collection<Row, string> | undefined,
+      checkpoint: string,
+    ) => {
+      if (!collection) return
+      let settled = false
+      const cleanup = collection.cleanup().finally(() => {
+        settled = true
+      })
+      await waitFor(() => settled, checkpoint)
+      await cleanup
+    }
+
+    await withFailurePreservingCleanup(async () => {
+      warmCollection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              warmSource = params
+              warmStarted = true
+              params.markReady()
+              return {
+                loadSubset: () => {
+                  warmLoads++
+                  return warmLoadGate
+                },
+                unloadSubset: () => {
+                  warmUnloads++
+                  releaseWarmLoad()
+                },
+              }
+            },
+          },
+          persistence: { adapter, coordinator: warmCoordinator },
+        }),
+      )
+      warmCollection.startSyncImmediate()
+      await waitFor(() => warmStarted, `warm source start`)
+      const warmRow = { id: `warm`, title: `Source-backed row` }
+      warmSource.begin()
+      warmSource.write({ type: `insert`, value: warmRow })
+      let warmCommitted = false
+      const warmCommit = Promise.resolve(
+        whenSyncAccepted(warmSource.commit()),
+      ).then(() => {
+        warmCommitted = true
+      })
+      await waitFor(() => warmCommitted, `warm source commit`)
+      await warmCommit
+
+      recoveringCollection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              recoveringSource = params
+              recoveringStarted = true
+              params.markReady()
+              return {
+                // This controlled source has no delayed provider callback.
+                restartAfterScopedRecovery: () => {},
+                loadSubset: (options) => {
+                  recoveringLoads++
+                  if (options.refetch) recoveringRefetches++
+                  return Promise.resolve()
+                },
+              }
+            },
+          },
+          persistence: { adapter, coordinator: recoveringCoordinator },
+        }),
+      )
+      recoveringCollection.startSyncImmediate()
+      await waitFor(() => recoveringStarted, `recovering source`)
+      const retainedDemand = { limit: 1 }
+      let firstSettled = false
+      const firstLoad = Promise.resolve(
+        recoveringCollection._sync.loadSubset(retainedDemand),
+      ).then(() => {
+        firstSettled = true
+      })
+      await waitFor(() => warmLoads === 1, `held pre-recovery demand`)
+      expect(firstSettled).toBe(false)
+      expect({ warmLoads, recoveringLoads }).toEqual({
+        warmLoads: 1,
+        recoveringLoads: 0,
+      })
+
+      let recoverySettled = false
+      const oldStorageId = adapter.currentStorageId()
+      const recovery = recoveringSource.metadata!.persistence!
+        .startScopedRecovery!().then(() => {
+        recoverySettled = true
+      })
+      // Hold the old leader's release acknowledgement while delivering every
+      // other message. The new cache has its own route, so its source demand
+      // must start before that old leader resumes.
+      const isOldRelease = (data: unknown) =>
+        payloadType(data) === `rpc:releaseRemoteSubset:req` &&
+        envelopeCollection(data) === oldStorageId
+      let heldOldRelease = false
+      for (let pass = 0; pass < 100; pass++) {
+        heldOldRelease ||= ControlledBroadcastChannel.delayed.some((delivery) =>
+          isOldRelease(delivery.data),
+        )
+        while (
+          ControlledBroadcastChannel.deliverWhere((data) => !isOldRelease(data))
+        ) {
+          await Promise.resolve()
+        }
+        if (heldOldRelease && recoveringLoads > 0) break
+        await nextTurn()
+      }
+      const loadsBeforeOldRelease = recoveringLoads
+      ControlledBroadcastChannel.deliverWhere(isOldRelease)
+      await pumpNetwork()
+      expect(heldOldRelease).toBe(true)
+      expect(loadsBeforeOldRelease).toBe(1)
+      await waitFor(() => recoverySettled, `scoped recovery with active demand`)
+      await recovery
+      await firstLoad
+      await waitFor(
+        () => recoveringLoads === 1,
+        `retained demand reacquisition`,
+      )
+      expect(recoveringRefetches).toBe(1)
+      expect(warmUnloads).toBe(1)
+
+      // The checkpoint is the settled physical acquisition. A wrong design
+      // using the public ID for both runs sends this request to the warm
+      // leader; a generation-qualified route sends it to the new owner.
+      let settled = false
+      const load = Promise.resolve(
+        recoveringCollection._sync.loadSubset({ limit: 2 }),
+      ).then(() => {
+        settled = true
+      })
+      await waitFor(() => settled, `recovering demand settlement`)
+      await load
+      expect({ warmLoads, recoveringLoads }).toEqual({
+        warmLoads: 1,
+        recoveringLoads: 2,
+      })
+      expect(warmCollection.get(`warm`)).toMatchObject(warmRow)
+
+      // A later committed-cache notification in the new generation cannot
+      // reload from its uncertified SQLite rows. The active demand gets a
+      // fresh source snapshot over the real Browser coordinator wire.
+      const storageId = adapter.currentStorageId()
+      warmCoordinator.publish(storageId, {
+        v: 1,
+        dbName: `generation-routing`,
+        collectionId: storageId,
+        senderId: warmCoordinator.getNodeId(),
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `peer-new-generation-change`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        },
+      })
+      await waitFor(() => recoveringLoads > 2, `new-generation source refresh`)
+      expect(recoveringRefetches).toBeGreaterThan(0)
+      expect(warmLoads).toBe(1)
+      expect(warmCollection.get(`warm`)).toMatchObject(warmRow)
+    }, [
+      [`held warm source`, () => Promise.resolve(releaseWarmLoad())],
+      [
+        `recovering Collection`,
+        () => cleanupCollection(recoveringCollection, `recovering cleanup`),
+      ],
+      [
+        `warm Collection`,
+        () => cleanupCollection(warmCollection, `warm cleanup`),
+      ],
+      [
+        `recovering coordinator`,
+        () => disposeCoordinator(recoveringCoordinator),
+      ],
+      [`warm coordinator`, () => disposeCoordinator(warmCoordinator)],
+    ])
+  })
+
+  // A paused follower may receive a coordinator commit before its renewal
+  // timer runs. Its expired claim cannot authorize that message to reload
+  // cached rows. The independent history expires one claim, delivers a peer
+  // notification, then keeps the demand: the old source row disappears and
+  // the demand obtains a fresh source snapshot in another cache generation.
+  it(`recovers an expired follower claim before applying a peer notification`, async () => {
+    type Row = { id: string; title: string }
+    let expired = false
+    const adapter = createGenerationRecordingAdapter(
+      `expired-receiver`,
+      () => expired,
+    )
+    const originalClaim = adapter.claimCacheGeneration!
+    const originalRotate = adapter.rotateCacheGeneration!
+    adapter.claimCacheGeneration = async (collectionId) => ({
+      ...(await originalClaim(collectionId)),
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async () =>
+      expired ? undefined : Date.now() + 10_000
+    adapter.rotateCacheGeneration = async (...args) => {
+      const claim = await originalRotate(...args)
+      expired = false
+      return { ...claim, expiresAtMs: Date.now() + 10_000 }
+    }
+    const receiver = createCoordinator(`expired-receiver`, adapter)
+    const peer = createCoordinator(`expired-receiver`, adapter)
+    let source!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+    const loads: Array<boolean | undefined> = []
+    let collection: Collection<Row, string> | undefined
+    await withFailurePreservingCleanup(async () => {
+      collection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: `expired-public-collection`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async (options) => {
+                  loads.push(options.refetch)
+                  if (options.refetch) {
+                    source.begin()
+                    source.write({
+                      type: `insert`,
+                      value: { id: `fresh`, title: `New source` },
+                    })
+                    await whenSyncAccepted(source.commit())
+                  }
+                },
+              }
+            },
+          },
+          persistence: { adapter, coordinator: receiver },
+        }),
+      )
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `old`, title: `Old source` },
+      })
+      await whenSyncAccepted(source.commit())
+      await collection._sync.loadSubset({ limit: 1 })
+      expect(collection.get(`old`)).toMatchObject({ id: `old` })
+      expect(loads).toEqual([undefined])
+
+      const oldStorageId = adapter.currentStorageId()
+      expired = true
+      peer.publish(oldStorageId, {
+        v: 1,
+        dbName: `expired-receiver`,
+        collectionId: oldStorageId,
+        senderId: peer.getNodeId(),
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 1,
+          seq: 2,
+          txId: `peer-change-after-pause`,
+          latestRowVersion: 2,
+          requiresFullReload: true,
+        },
+      })
+      // Deliver the queued message at the paused tab's later wall-clock cut,
+      // before JavaScript gets an opportunity to run its renewal timer.
+      const wallNow = Date.now
+      const clock = vi
+        .spyOn(Date, `now`)
+        .mockImplementation(() => wallNow() + 20_000)
+      try {
+        expect(
+          ControlledBroadcastChannel.deliverWhere(
+            (data) =>
+              envelopeCollection(data) === oldStorageId &&
+              payloadType(data) === `tx:committed` &&
+              (data as { payload?: { txId?: string } }).payload?.txId ===
+                `peer-change-after-pause`,
+          ),
+        ).toBe(true)
+      } finally {
+        clock.mockRestore()
+      }
+      await waitFor(() => loads.length > 1, `retained demand reload`)
+      expect(adapter.currentStorageId()).toBe(oldStorageId)
+      expect(loads).toEqual([undefined, true])
+      expect(collection.get(`old`)).toBeUndefined()
+      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
+    }, [
+      [`receiver Collection`, () => collection?.cleanup() ?? Promise.resolve()],
+      [`receiver coordinator`, () => disposeCoordinator(receiver)],
+      [`peer coordinator`, () => disposeCoordinator(peer)],
+    ])
+  })
+
+  // One host clock defines claim expiry for both SQLite and the receiving
+  // runtime. The independent history expires a live claim using the clock
+  // supplied through the public Browser factory, then delivers a targeted
+  // peer commit. Because the old generation is no longer readable, its
+  // notification cannot publish a row. The active demand instead obtains a
+  // fresh source snapshot after rotation. Real SQLite and the composed
+  // Browser coordinator carry the claim and message at this checkpoint.
+  it(`uses the configured host clock before applying a peer notification`, async () => {
+    type Row = { id: string; title: string }
+    const directory = mkdtempSync(join(tmpdir(), `db-claim-clock-`))
+    const database = createWASQLiteTestDatabase({
+      filename: join(directory, `claim.sqlite`),
+    })
+    const receiver = createCoordinator(
+      `claim-clock`,
+      createRecordingAdapter({ id: `clock-receiver-bootstrap` }),
+    )
+    const peer = createCoordinator(
+      `claim-clock`,
+      createRecordingAdapter({ id: `clock-peer` }),
+    )
+    let hostNow = Date.now() + 86_400_000
+    const persistence = createBrowserWASQLitePersistence({
+      database,
+      coordinator: receiver,
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => hostNow,
+    })
+    let source!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+    let collection: Collection<Row, string> | undefined
+    const loads: Array<boolean | undefined> = []
+
+    await withFailurePreservingCleanup(async () => {
+      collection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: `claim-clock-collection`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async (options) => {
+                  loads.push(options.refetch)
+                  if (options.refetch) {
+                    source.begin()
+                    source.write({
+                      type: `insert`,
+                      value: { id: `fresh`, title: `Fresh source` },
+                    })
+                    await whenSyncAccepted(source.commit())
+                  }
+                },
+              }
+            },
+          },
+          persistence,
+        }),
+      )
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `old`, title: `Old source` },
+      })
+      await whenSyncAccepted(source.commit())
+      await collection._sync.loadSubset({})
+      expect(collection.get(`old`)).toMatchObject({ title: `Old source` })
+      expect(loads).toEqual([undefined])
+
+      const head = await database.execute<{ physical_id: string }>(
+        `SELECT physical_id FROM cache_generation
+         WHERE logical_id = ? AND retired = 0`,
+        [`claim-clock-collection`],
+      )
+      const oldStorageId = head[0]?.physical_id
+      if (!oldStorageId) throw new Error(`missing claimed cache generation`)
+      hostNow += 20_000
+      peer.publish(oldStorageId, {
+        v: 1,
+        dbName: `claim-clock`,
+        collectionId: oldStorageId,
+        senderId: peer.getNodeId(),
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 2,
+          seq: 1,
+          txId: `peer-change-after-clock-expiry`,
+          latestRowVersion: 2,
+          requiresFullReload: false,
+          changedRows: [
+            {
+              key: `old`,
+              value: { id: `old`, title: `Stale peer notification` },
+            },
+          ],
+          deletedKeys: [],
+        },
+      })
+      expect(
+        ControlledBroadcastChannel.deliverWhere(
+          (data) =>
+            envelopeCollection(data) === oldStorageId &&
+            payloadType(data) === `tx:committed` &&
+            (data as { payload?: { txId?: string } }).payload?.txId ===
+              `peer-change-after-clock-expiry`,
+        ),
+      ).toBe(true)
+      await pumpNetwork()
+      for (let pass = 0; pass < 10; pass++) await nextTurn()
+      expect(collection.get(`old`)?.title).not.toBe(`Stale peer notification`)
+      await waitFor(() => loads.includes(true), `expired-claim source reload`)
+      expect(collection.get(`old`)).toBeUndefined()
+      expect(collection.get(`fresh`)).toMatchObject({ title: `Fresh source` })
+    }, [
+      [`receiver Collection`, () => collection?.cleanup() ?? Promise.resolve()],
+      [`receiver coordinator`, () => disposeCoordinator(receiver)],
+      [`peer coordinator`, () => disposeCoordinator(peer)],
+      [`real SQLite database`, () => Promise.resolve(database.close?.())],
+      [
+        `real SQLite directory`,
+        () => rmSync(directory, { recursive: true, force: true }),
+      ],
+    ])
+  })
+
+  // Two sync runs can claim one physical cache generation at different clock
+  // cuts. The independent claim rule lets the later warm peer keep that
+  // generation when only the earlier run expires. A commit notification sent
+  // to the expired run before its renewal timer cannot authorize its old row;
+  // its active demand must refetch into private storage. The warm peer keeps
+  // its public row, source ownership, and exact SQLite row at the settled cut.
+  // This receiver crosses the Browser coordinator wire and real wa-sqlite;
+  // the durable peer write is real, but the notice delivery order is controlled
+  // rather than native multi-tab scheduling or coordinator emission.
+  it(`keeps a warm Browser peer while an expired run reloads after a notification`, async () => {
+    type Row = { id: string; title: string }
+    const directory = mkdtempSync(join(tmpdir(), `db-warm-peer-claim-`))
+    const database = createWASQLiteTestDatabase({
+      filename: join(directory, `warm-peer.sqlite`),
+    })
+    const expiredCoordinator = createCoordinator(
+      `warm-peer-claim`,
+      createRecordingAdapter({ id: `expired-bootstrap` }),
+    )
+    const warmCoordinator = createCoordinator(
+      `warm-peer-claim`,
+      createRecordingAdapter({ id: `warm-bootstrap` }),
+    )
+    let hostNow = Date.now() + 86_400_000
+    const makePersistence = (coordinator: BrowserCollectionCoordinator) =>
+      createBrowserWASQLitePersistence({
+        database,
+        coordinator,
+        cacheGenerationClaimTtlMs: 10_000,
+        now: () => hostNow,
+      })
+    const expiredPersistence = makePersistence(expiredCoordinator)
+    const warmPersistence = makePersistence(warmCoordinator)
+    const logicalId = `warm-peer-claim-collection`
+    const expiredAdapter = expiredPersistence.resolvePersistenceForCollection!({
+      collectionId: logicalId,
+      mode: `sync-present`,
+    }).adapter
+    const rotate = expiredAdapter.rotateCacheGeneration!.bind(expiredAdapter)
+    const rotations: Array<{ storageCollectionId: string; claimId: string }> =
+      []
+    expiredAdapter.rotateCacheGeneration = async (...args) => {
+      const next = await rotate(...args)
+      rotations.push(next)
+      return next
+    }
+    const old = { id: `old`, title: `Warm source row` }
+    const fresh = { id: `fresh`, title: `Expired run's fresh row` }
+    let source!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+    let expiredCollection: Collection<Row, string> | undefined
+    let warmCollection: Collection<Row, string> | undefined
+    const expiredLoads: Array<boolean | undefined> = []
+    let expiredRefetchSettled = false
+    const warmLoads: Array<number | undefined> = []
+
+    await withFailurePreservingCleanup(async () => {
+      expiredCollection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async (options) => {
+                  expiredLoads.push(options.refetch)
+                  if (options.refetch) {
+                    source.begin()
+                    source.write({ type: `insert`, value: fresh })
+                    await whenSyncAccepted(source.commit())
+                    expiredRefetchSettled = true
+                  }
+                },
+              }
+            },
+          },
+          persistence: expiredPersistence,
+        }),
+      )
+      expiredCollection.startSyncImmediate()
+      await expiredCollection.stateWhenReady()
+      source.begin()
+      source.write({ type: `insert`, value: old })
+      await whenSyncAccepted(source.commit())
+      await expiredCollection._sync.loadSubset({ limit: 1 })
+      expect(expiredCollection.get(old.id)).toMatchObject(old)
+
+      const headRows = await database.execute<{ physical_id: string }>(
+        `SELECT physical_id FROM cache_generation
+         WHERE logical_id = ? AND retired = 0`,
+        [logicalId],
+      )
+      const sharedStorageId = headRows[0]?.physical_id
+      if (!sharedStorageId) throw new Error(`missing shared cache generation`)
+      const firstClaims = await database.execute<{
+        claim_id: string
+        expires_at_ms: number
+      }>(
+        `SELECT claim_id, expires_at_ms FROM cache_generation_claim
+         WHERE physical_id = ?`,
+        [sharedStorageId],
+      )
+      expect(firstClaims).toHaveLength(1)
+      const firstClaim = firstClaims[0]!
+
+      hostNow += 5_000
+      warmCollection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: (options) => {
+                  warmLoads.push(options.limit)
+                  return Promise.resolve()
+                },
+              }
+            },
+          },
+          persistence: warmPersistence,
+        }),
+      )
+      warmCollection.startSyncImmediate()
+      await warmCollection.stateWhenReady()
+      let warmLoadSettled = false
+      const warmLoad = Promise.resolve(
+        warmCollection._sync.loadSubset({ limit: 1 }),
+      ).finally(() => {
+        warmLoadSettled = true
+      })
+      void warmLoad.catch(() => undefined)
+      await waitFor(() => warmLoadSettled, `warm peer subset settlement`)
+      await warmLoad
+      expect(warmCollection.get(old.id)).toMatchObject(old)
+      const sharedClaims = await database.execute<{
+        claim_id: string
+        expires_at_ms: number
+      }>(
+        `SELECT claim_id, expires_at_ms FROM cache_generation_claim
+         WHERE physical_id = ? ORDER BY expires_at_ms`,
+        [sharedStorageId],
+      )
+      expect(sharedClaims).toHaveLength(2)
+      expect(sharedClaims[0]).toEqual(firstClaim)
+      const warmClaim = sharedClaims[1]!
+      expect(warmClaim.claim_id).not.toBe(firstClaim.claim_id)
+      expect(warmClaim.expires_at_ms).toBeGreaterThan(firstClaim.expires_at_ms)
+
+      // The controlled notice below describes a committed SQLite transaction.
+      // Read its position, apply the peer write under the warm claim, then use
+      // those exact values in the delivered envelope.
+      const warmAdapter = warmPersistence.resolvePersistenceForCollection!({
+        collectionId: logicalId,
+        mode: `sync-present`,
+      }).adapter
+      const beforePeerWrite = await warmAdapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: sharedStorageId,
+          claimId: warmClaim.claim_id,
+        },
+        { cacheGenerationClaimId: warmClaim.claim_id },
+      )
+      const peerTerm = beforePeerWrite.latestTerm
+      const peerSeq = beforePeerWrite.latestSeq + 1
+      const peerRowVersion = beforePeerWrite.latestRowVersion + 1
+      const peerTxId = `notice-after-one-claim-expires`
+      await warmAdapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: sharedStorageId,
+          claimId: warmClaim.claim_id,
+        },
+        {
+          txId: peerTxId,
+          term: peerTerm,
+          seq: peerSeq,
+          rowVersion: peerRowVersion,
+          cacheGenerationClaimId: warmClaim.claim_id,
+          mutations: [{ type: `update`, key: old.id, value: old }],
+        },
+      )
+      const afterPeerWrite = await warmAdapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: sharedStorageId,
+          claimId: warmClaim.claim_id,
+        },
+        { cacheGenerationClaimId: warmClaim.claim_id },
+      )
+      expect(afterPeerWrite.latestRowVersion).toBe(peerRowVersion)
+      expect(afterPeerWrite.rows.map(({ value }) => value)).toEqual([old])
+
+      hostNow += 5_001
+      warmCoordinator.publish(sharedStorageId, {
+        v: 1,
+        dbName: `warm-peer-claim`,
+        collectionId: sharedStorageId,
+        senderId: warmCoordinator.getNodeId(),
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: peerTerm,
+          seq: peerSeq,
+          txId: peerTxId,
+          latestRowVersion: peerRowVersion,
+          requiresFullReload: false,
+          changedRows: [{ key: old.id, value: old }],
+          deletedKeys: [],
+        },
+      })
+      expect(
+        ControlledBroadcastChannel.deliverWhere(
+          (data) =>
+            envelopeCollection(data) === sharedStorageId &&
+            payloadType(data) === `tx:committed` &&
+            (data as { payload?: { txId?: string } }).payload?.txId ===
+              peerTxId,
+        ),
+      ).toBe(true)
+      await waitFor(
+        () => expiredLoads.includes(true) && expiredRefetchSettled,
+        `expired run's settled source refetch`,
+      )
+      await waitFor(
+        () => expiredCollection?.get(fresh.id)?.title === fresh.title,
+        `fresh public row after source refetch`,
+      )
+      expect(expiredCollection.get(old.id)).toBeUndefined()
+      expect(expiredCollection.get(fresh.id)).toMatchObject(fresh)
+      expect(warmCollection.get(old.id)).toMatchObject(old)
+      expect(warmCollection.get(fresh.id)).toBeUndefined()
+      const warmLoadsBeforeNextDemand = warmLoads.length
+      const expiredLoadsBeforeWarmDemand = [...expiredLoads]
+      await warmCollection._sync.loadSubset({ limit: 2 })
+      expect(warmLoads.slice(warmLoadsBeforeNextDemand)).toEqual([2])
+      expect(expiredLoads).toEqual(expiredLoadsBeforeWarmDemand)
+      expect(rotations).toHaveLength(1)
+      const privateClaim = rotations[0]!
+      expect(privateClaim.storageCollectionId).not.toBe(sharedStorageId)
+
+      const currentHead = await database.execute<{ physical_id: string }>(
+        `SELECT physical_id FROM cache_generation
+         WHERE logical_id = ? AND retired = 0`,
+        [logicalId],
+      )
+      expect(currentHead).toEqual([{ physical_id: sharedStorageId }])
+      const warmClaims = await database.execute<{ claim_id: string }>(
+        `SELECT claim_id FROM cache_generation_claim
+         WHERE physical_id = ? AND expires_at_ms > ?`,
+        [sharedStorageId, hostNow],
+      )
+      expect(warmClaims).toEqual([{ claim_id: warmClaim.claim_id }])
+      const durable = await warmAdapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: sharedStorageId,
+          claimId: warmClaim.claim_id,
+        },
+        {
+          cacheGenerationClaimId: warmClaim.claim_id,
+        },
+      )
+      expect(durable.rows.map(({ value }) => value)).toEqual([old])
+      const privateRows = await expiredAdapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: privateClaim.storageCollectionId,
+          claimId: privateClaim.claimId,
+        },
+        { cacheGenerationClaimId: privateClaim.claimId },
+      )
+      expect(privateRows.rows.map(({ value }) => value)).toEqual([fresh])
+    }, [
+      [
+        `expired Collection`,
+        () => expiredCollection?.cleanup() ?? Promise.resolve(),
+      ],
+      [`warm Collection`, () => warmCollection?.cleanup() ?? Promise.resolve()],
+      [`expired coordinator`, () => disposeCoordinator(expiredCoordinator)],
+      [`warm coordinator`, () => disposeCoordinator(warmCoordinator)],
+      [`real SQLite database`, () => Promise.resolve(database.close?.())],
+      [
+        `real SQLite directory`,
+        () => rmSync(directory, { recursive: true, force: true }),
+      ],
+    ])
+  })
+})
+
+describe(`remote subset ownership lease oracle`, () => {
+  it(`reconstructs the remote-lease grammar and ablates every declared axis`, () => {
+    const witness: RemoteLeaseHistory = {
+      siblingCount: 3,
+      releasePrefix: 1,
+      identical: false,
+      duplicateRelease: true,
+      reverseFinalRelease: true,
+    }
+    const reconstructed = remoteLeaseGrammarPlan(witness)
+    expect(reconstructed).toEqual({
+      demands: [
+        { limit: 1, offset: 0 },
+        { limit: 1, offset: 1 },
+        { limit: 1, offset: 2 },
+      ],
+      releaseCount: 1,
+      prefixReleaseIndexes: [0],
+      finalReleaseIndexes: [2, 1],
+      releasePasses: 2,
+    })
+
+    const ablations: Array<{
+      axis: keyof RemoteLeaseHistory
+      history: RemoteLeaseHistory
+      observe: (plan: RemoteLeaseGrammarPlan) => unknown
+    }> = [
+      {
+        axis: `siblingCount`,
+        history: { ...witness, siblingCount: 1 },
+        observe: ({ demands }) => demands.length,
+      },
+      {
+        axis: `releasePrefix`,
+        history: { ...witness, releasePrefix: 0 },
+        observe: ({ prefixReleaseIndexes }) => prefixReleaseIndexes,
+      },
+      {
+        axis: `identical`,
+        history: { ...witness, identical: true },
+        observe: ({ demands }) => demands,
+      },
+      {
+        axis: `duplicateRelease`,
+        history: { ...witness, duplicateRelease: false },
+        observe: ({ releasePasses }) => releasePasses,
+      },
+      {
+        axis: `reverseFinalRelease`,
+        history: { ...witness, reverseFinalRelease: false },
+        observe: ({ finalReleaseIndexes }) => finalReleaseIndexes,
+      },
+    ]
+    expect(ablations.map(({ axis }) => axis).sort()).toEqual(
+      (Object.keys(witness) as Array<keyof RemoteLeaseHistory>).sort(),
+    )
+    for (const { history, observe } of ablations) {
+      expect(observe(remoteLeaseGrammarPlan(history))).not.toEqual(
+        observe(reconstructed),
+      )
+    }
+  })
+})
+
+describe(`per-collection adapter and SQLite-state oracle`, () => {
+  // The coordinator constructs a transaction for local mutations. A managed
+  // Collection's claim must survive that construction and the Browser route.
+  // The real SQLite row is the receiving observation: an eager target with a
+  // physical cache ID is rejected, even if a recording adapter accepts it.
+  it(`persists a managed local mutation through its claimed Browser route`, async () => {
+    const directory = mkdtempSync(join(tmpdir(), `db-managed-local-route-`))
+    const database = createWASQLiteTestDatabase({
+      filename: join(directory, `local.sqlite`),
+    })
+    const coordinator = createCoordinator(
+      `managed-local-route`,
+      createRecordingAdapter({ id: `bootstrap` }),
+    )
+    const logicalId = `managed-local-route-collection`
+    const persistence = createBrowserWASQLitePersistence({
+      database,
+      coordinator,
+    })
+    const adapter = persistence.resolvePersistenceForCollection!({
+      collectionId: logicalId,
+      mode: `sync-present`,
+    }).adapter
+    let claim:
+      | Awaited<ReturnType<NonNullable<typeof adapter.claimCacheGeneration>>>
+      | undefined
+    let replacement:
+      | Awaited<ReturnType<NonNullable<typeof adapter.rotateCacheGeneration>>>
+      | undefined
+    await withFailurePreservingCleanup(async () => {
+      claim = await adapter.claimCacheGeneration!(logicalId)
+      coordinator.setAdapterForCollection(
+        claim.storageCollectionId,
+        adapter,
+        claim.claimId,
+      )
+      coordinator.subscribe(claim.storageCollectionId, () => {})
+      await waitFor(
+        () => coordinator.isLeader(claim!.storageCollectionId),
+        `claimed local-mutation route`,
+      )
+      const result = await coordinator.requestApplyLocalMutations(
+        claim.storageCollectionId,
+        [
+          {
+            mutationId: `managed-local-row`,
+            type: `insert`,
+            key: `row`,
+            value: { id: `row` },
+          },
+        ],
+        claim.claimId,
+      )
+      expect(result.ok).toBe(true)
+      const snapshot = await adapter.loadResumeSnapshot({
+        kind: `managed`,
+        storageCollectionId: claim.storageCollectionId,
+        claimId: claim.claimId,
+      })
+      expect(snapshot.rows).toMatchObject([
+        { key: `row`, value: { id: `row` } },
+      ])
+      const oldRegistry = await database.execute<{ table_name: string }>(
+        `SELECT table_name FROM collection_registry WHERE collection_id = ?`,
+        [claim.storageCollectionId],
+      )
+      expect(oldRegistry).toHaveLength(1)
+      const oldTable = oldRegistry[0]?.table_name
+      if (!oldTable) throw new Error(`missing managed row table`)
+      replacement = await adapter.rotateCacheGeneration!(
+        logicalId,
+        claim.claimId,
+      )
+      await expect(
+        coordinator.requestApplyLocalMutations(
+          claim.storageCollectionId,
+          [
+            {
+              mutationId: `late-managed-local-row`,
+              type: `insert`,
+              key: `late`,
+              value: { id: `late` },
+            },
+          ],
+          claim.claimId,
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      expect(
+        await database.execute(
+          `SELECT name FROM sqlite_master WHERE name = ?`,
+          [oldTable],
+        ),
+      ).toEqual([])
+      expect(
+        await database.execute(
+          `SELECT collection_id FROM collection_registry WHERE collection_id = ?`,
+          [claim.storageCollectionId],
+        ),
+      ).toEqual([])
+    }, [
+      [
+        `replacement claim`,
+        async () => {
+          if (replacement) {
+            await adapter.releaseCacheGenerationClaim?.(replacement.claimId)
+          }
+        },
+      ],
+      [
+        `claim`,
+        async () => {
+          if (claim) await adapter.releaseCacheGenerationClaim?.(claim.claimId)
+        },
+      ],
+      [`coordinator`, () => disposeCoordinator(coordinator)],
+      [`database`, () => Promise.resolve(database.close?.())],
+      [`directory`, () => rmSync(directory, { recursive: true, force: true })],
+    ])
+  })
+
+  // A host factory promises the same configured claim lifetime as its core
+  // adapter. The supplied clock makes the claim's expiry exact; this catches
+  // options accepted by the public type but dropped before adapter creation.
+  it(`forwards the configured cache claim lifetime to its SQLite adapter`, async () => {
+    const directory = mkdtempSync(join(tmpdir(), `db-claim-options-`))
+    const database = createWASQLiteTestDatabase({
+      filename: join(directory, `claim.sqlite`),
+    })
+    try {
+      const persistence = createBrowserWASQLitePersistence({
+        database,
+        cacheGenerationClaimTtlMs: 1_234,
+        now: () => 5_000,
+      })
+      const resolve = persistence.resolvePersistenceForCollection
+      if (!resolve) throw new Error(`missing per-collection resolver`)
+      const adapter = resolve({
+        collectionId: `claim-options`,
+        mode: `sync-present`,
+      }).adapter
+      const claim = await adapter.claimCacheGeneration!(`claim-options`)
+      expect(claim.expiresAtMs).toBe(6_234)
+      await adapter.releaseCacheGenerationClaim!(claim.claimId)
+    } finally {
+      await Promise.resolve(database.close?.())
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})
+
+describe(`generated collection-route histories`, () => {
+  it(`requires a complete property, seed, and shrink path for replay`, () => {
+    expect(readCoordinatorOracleConfig({})).toEqual({ runs: DEFAULT_RUNS })
+    for (const environment of [
+      { TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123` },
+      { TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1` },
+      { TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `routing` },
+      {
+        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1`,
+      },
+    ]) {
+      expect(() => readCoordinatorOracleConfig(environment)).toThrow(
+        /requires SEED, PATH, and PROPERTY together/,
+      )
+    }
+    expect(() =>
+      readCoordinatorOracleConfig({
+        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `not-a-path`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `routing`,
+      }),
+    ).toThrow(/numeric shrink path/)
+    expect(() =>
+      readCoordinatorOracleConfig({
+        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `unknown`,
+      }),
+    ).toThrow(/remote-lease or routing/)
+    expect(
+      readCoordinatorOracleConfig({
+        TANSTACK_DB_COORDINATOR_ORACLE_RUNS: `7`,
+        TANSTACK_DB_COORDINATOR_ORACLE_SEED: `123`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PATH: `0:1`,
+        TANSTACK_DB_COORDINATOR_ORACLE_PROPERTY: `routing`,
+      }),
+    ).toEqual({
+      runs: 7,
+      replay: { property: `routing`, seed: 123, path: `0:1` },
+    })
+  })
+
+  it(`reconstructs the routing grammar and ablates every declared axis`, () => {
+    const witnessAxes: RoutingHistoryAxes = {
+      alphaVersion: 11,
+      versionDelta: 18,
+      registrationOrder: [`beta`, `alpha`],
+      firstDeliveryOrder: [`alpha`, `beta`],
+      secondDeliveryOrder: [`beta`, `alpha`],
+    }
+    const witness = routingHistoryFromAxes(witnessAxes)
+    expect(witness).toEqual({
+      alphaVersion: 11,
+      betaVersion: 29,
+      registrationOrder: [`beta`, `alpha`],
+      firstDeliveryOrder: [`alpha`, `beta`],
+      secondDeliveryOrder: [`beta`, `alpha`],
+    })
+    const reconstructed = routingGrammarPlan(witness)
+    expect(reconstructed).toEqual({
+      initialCollection: `beta`,
+      registrationOrder: [`beta`, `alpha`],
+      firstDeliveryOrder: [`alpha`, `beta`],
+      secondDeliveryOrder: [`beta`, `alpha`],
+      adapterIds: {
+        leader: {
+          alpha: `leader-alpha-v11-reset`,
+          beta: `leader-beta-v29-error`,
+        },
+        follower: {
+          alpha: `follower-alpha-v11-reset`,
+          beta: `follower-beta-v29-error`,
+        },
+      },
+    })
+
+    const ablations: Array<{
+      axis: keyof RoutingHistoryAxes
+      history: RoutingHistory
+      observe: (plan: RoutingGrammarPlan) => unknown
+    }> = [
+      {
+        axis: `alphaVersion`,
+        history: routingHistoryFromAxes({
+          ...witnessAxes,
+          alphaVersion: 12,
+        }),
+        observe: ({ adapterIds }) => adapterIds.leader.alpha,
+      },
+      {
+        axis: `versionDelta`,
+        history: routingHistoryFromAxes({
+          ...witnessAxes,
+          versionDelta: 19,
+        }),
+        observe: ({ adapterIds }) => adapterIds.leader.beta,
+      },
+      {
+        axis: `registrationOrder`,
+        history: routingHistoryFromAxes({
+          ...witnessAxes,
+          registrationOrder: [`alpha`, `beta`],
+        }),
+        observe: ({ initialCollection, registrationOrder }) => ({
+          initialCollection,
+          registrationOrder,
+        }),
+      },
+      {
+        axis: `firstDeliveryOrder`,
+        history: routingHistoryFromAxes({
+          ...witnessAxes,
+          firstDeliveryOrder: [`beta`, `alpha`],
+        }),
+        observe: ({ firstDeliveryOrder }) => firstDeliveryOrder,
+      },
+      {
+        axis: `secondDeliveryOrder`,
+        history: routingHistoryFromAxes({
+          ...witnessAxes,
+          secondDeliveryOrder: [`alpha`, `beta`],
+        }),
+        observe: ({ secondDeliveryOrder }) => secondDeliveryOrder,
+      },
+    ]
+    expect(ablations.map(({ axis }) => axis).sort()).toEqual(
+      (Object.keys(witnessAxes) as Array<keyof RoutingHistoryAxes>).sort(),
+    )
+    for (const { history, observe } of ablations) {
+      expect(observe(routingGrammarPlan(history))).not.toEqual(
+        observe(reconstructed),
+      )
+    }
+  })
+})
+
+describe(`sync-ingested write ownership oracle`, () => {
+  it(`routes a rich source commit through the new elected Browser owner`, async () => {
+    type Todo = { id: string; title: string }
+    type SourceParams = Parameters<SyncConfig<Todo, string>[`sync`]>[0]
+    type TxAdapter = PersistenceAdapter & { applied: Array<PersistedTx> }
+
+    const createTxAdapter = (): TxAdapter => {
+      const applied: Array<PersistedTx> = []
+      return {
+        applied,
+        loadSubset: () => Promise.resolve([]),
+        loadResumeSnapshot: () =>
+          Promise.resolve({
+            rows: [],
+            keySet: { status: `consistent` },
+            collectionMetadata: [],
+            latestTerm: 0,
+            latestSeq: 0,
+            latestRowVersion: 0,
+            resetEpoch: 0,
+          }),
+        applyCommittedTx: (_collectionId, tx) => {
+          applied.push(structuredClone(tx))
+          return Promise.resolve()
+        },
+        ensureIndex: () => Promise.resolve(),
+        getStreamPosition: () =>
+          Promise.resolve({
+            latestTerm: 0,
+            latestSeq: 0,
+            latestRowVersion: 0,
+          }),
+        reserveLeadershipTerm: async (collectionId, observedTerm) => {
+          const id = storageId(collectionId)
+          const latestTerm =
+            Math.max(durableTerms.get(id) ?? 0, observedTerm) + 1
+          durableTerms.set(id, latestTerm)
+          return { latestTerm, latestSeq: 0, latestRowVersion: 0 }
+        },
+      }
+    }
+
+    const retiredAdapter = createTxAdapter()
+    const electedAdapter = createTxAdapter()
+    const requesterAdapter = createTxAdapter()
+    const originalElectedApply =
+      electedAdapter.applyCommittedTx.bind(electedAdapter)
+    let electedApplyEntered = false
+    let releaseElectedApply = (): void => {}
+    const electedApplyGate = new Promise<void>((resolve) => {
+      releaseElectedApply = resolve
+    })
+    electedAdapter.applyCommittedTx = async (collectionId, tx) => {
+      electedApplyEntered = true
+      await electedApplyGate
+      await originalElectedApply(collectionId, tx)
+    }
+    let retired: BrowserCollectionCoordinator | undefined
+    let elected: BrowserCollectionCoordinator | undefined
+    let requester: BrowserCollectionCoordinator | undefined
+    let cleanupCollection: (() => Promise<void>) | undefined
+    const electedCommitted: Array<unknown> = []
+    const requesterCommitted: Array<unknown> = []
+
+    await withFailurePreservingCleanup(async () => {
+      const dbName = `source-owner-transfer`
+      retired = createCoordinator(dbName, retiredAdapter)
+      elected = createCoordinator(dbName, electedAdapter)
+      requester = createCoordinator(dbName, requesterAdapter)
+      retired.subscribe(`todos`, () => {})
+      elected.subscribe(`todos`, (message) => {
+        const payload = message.payload as { type?: string }
+        if (payload.type === `tx:committed`) {
+          electedCommitted.push(structuredClone(payload))
+        }
+      })
+      requester.subscribe(`todos`, (message) => {
+        const payload = message.payload as { type?: string }
+        if (payload.type === `tx:committed`) {
+          requesterCommitted.push(structuredClone(payload))
+        }
+      })
+      await waitFor(
+        () =>
+          retired!.isLeader(`todos`) &&
+          !elected!.isLeader(`todos`) &&
+          !requester!.isLeader(`todos`),
+        `initial source owner`,
+      )
+
+      await disposeCoordinator(retired)
+      await waitFor(
+        () => elected!.isLeader(`todos`) && !requester!.isLeader(`todos`),
+        `transferred source owner`,
+      )
+
+      let sourceParams: SourceParams | undefined
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `todos`,
+          getKey: (todo) => todo.id,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+            },
+          },
+          persistence: { adapter: requesterAdapter, coordinator: requester },
+        }),
+      )
+      cleanupCollection = () => collection.cleanup()
+      collection.startSyncImmediate()
+      await waitForWithoutDelivery(
+        () => sourceParams !== undefined,
+        `Browser source controls`,
+      )
+
+      sourceParams!.begin()
+      sourceParams!.metadata?.collection.set(`resume`, { offset: 11 })
+      sourceParams!.truncate()
+      sourceParams!.write({
+        type: `insert`,
+        value: { id: `rich`, title: `through Browser owner` },
+        metadata: { source: `browser-sync` },
+      })
+      const receipt = sourceParams!.commit()
+      let receiptSettled = receipt === true
+      const receiptPromise = receipt === true ? Promise.resolve() : receipt
+      void receiptPromise.then(
+        () => {
+          receiptSettled = true
+        },
+        () => {
+          receiptSettled = true
+        },
+      )
+
+      await pumpNetwork()
+      await waitForWithoutDelivery(
+        () => electedApplyEntered,
+        `elected Browser source apply entry`,
+      )
+      expect({
+        receiptSettled,
+        electedApplies: electedAdapter.applied.length,
+        requesterInvalidations: requesterCommitted.length,
+      }).toEqual({
+        receiptSettled: false,
+        electedApplies: 0,
+        requesterInvalidations: 0,
+      })
+
+      releaseElectedApply()
+      await pumpNetwork()
+      await receiptPromise
+      await pumpNetwork()
+
+      expect(collection.get(`rich`)).toMatchObject({
+        id: `rich`,
+        title: `through Browser owner`,
+      })
+      expect(retiredAdapter.applied).toEqual([])
+      expect(requesterAdapter.applied).toEqual([])
+      expect(electedAdapter.applied).toHaveLength(1)
+      expect(electedAdapter.applied[0]).toMatchObject({
+        truncate: true,
+        mutations: [
+          {
+            type: `update`,
+            key: `rich`,
+            value: { id: `rich`, title: `through Browser owner` },
+          },
+        ],
+        rowMetadataMutations: [
+          {
+            type: `set`,
+            key: `rich`,
+            value: { source: `browser-sync` },
+          },
+        ],
+        collectionMetadataMutations: [
+          { type: `set`, key: `resume`, value: { offset: 11 } },
+        ],
+      })
+      const committedTxId = electedAdapter.applied[0]!.txId
+      const expectedCommitted = {
+        type: `tx:committed`,
+        term: 2,
+        seq: 1,
+        txId: committedTxId,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+      }
+      expect(electedCommitted).toEqual([expectedCommitted])
+      expect(requesterCommitted).toEqual([expectedCommitted])
+    }, [
+      [
+        `elected Browser source apply gate`,
+        () => {
+          releaseElectedApply()
+        },
+      ],
+      [
+        `Browser source collection`,
+        async () => {
+          await cleanupCollection?.()
+        },
+      ],
+      [
+        `retired Browser source owner`,
+        async () => {
+          await disposeCoordinator(retired)
+        },
+      ],
+      [
+        `elected Browser source owner`,
+        async () => {
+          await disposeCoordinator(elected)
+        },
+      ],
+      [
+        `Browser source requester`,
+        async () => {
+          await disposeCoordinator(requester)
+        },
+      ],
+    ])
+  })
+})
+
+describe(`follower remote-demand settlement across real tabs`, () => {
+  // Rotation across real tabs. When only the follower's cache claim expires,
+  // it rotates into a new generation that no other tab participates in, so
+  // it becomes that generation's owner and serves new demand from its own
+  // source. The model owes the same applied settlement there: the rows it
+  // already showed stay visible, and a new demand settles with its rows.
+  // This topology never routes to another tab's owner, so the
+  // elected-owner notice path stays with the single-runtime follower
+  // generation-notice cells in persisted-oracle.test.ts. Their rotation cell
+  // is pinned as failing under the known gap #2139.
+  it(
+    `keeps a rotated follower's rows and serves its new demand from its own generation`,
+    () =>
+      withNativeBrowserTransport(async () => {
+        const directory = mkdtempSync(join(tmpdir(), `db-real-tab-rotation-`))
+        const filename = join(directory, `tabs.sqlite`)
+        const dbName = `real-tab-rotation-${Math.random().toString(36).slice(2)}`
+        const upstream = new Map<string, RealTabRow>([
+          [`remote`, { id: `remote`, group: `a` }],
+          [`other`, { id: `other`, group: `b` }],
+        ])
+        let followerNow = Date.now()
+        const tabs: Array<ReturnType<typeof createRealTab>> = []
+        const where = (id: string): LoadSubsetOptions => ({
+          where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(id)]),
+        })
+        try {
+          const leader = createRealTab({
+            dbName,
+            filename,
+            source: `receipt`,
+            upstream,
+          })
+          tabs.push(leader)
+          leader.collection.startSyncImmediate()
+          await leader.collection.stateWhenReady()
+          const follower = createRealTab({
+            dbName,
+            filename,
+            source: `receipt`,
+            upstream,
+            now: () => followerNow,
+          })
+          tabs.push(follower)
+          follower.collection.startSyncImmediate()
+          await vi.waitFor(() =>
+            expect(follower.storageCollectionId()).toBeDefined(),
+          )
+          await follower.collection._sync.loadSubset(where(`remote`))
+          const original = follower.storageCollectionId()
+          expect(follower.coordinator.isLeader(original!)).toBe(false)
+          expect(follower.collection.has(`remote`)).toBe(true)
+
+          followerNow += 20_000
+          await follower.collection._sync.loadSubset(where(`other`))
+          const rotated = follower.storageCollectionId()
+          expect(rotated).not.toBe(original)
+          expect(follower.coordinator.isLeader(rotated!)).toBe(true)
+          expect({
+            remote: follower.collection.has(`remote`),
+            other: follower.collection.has(`other`),
+            status: follower.collection.status,
+          }).toEqual({ remote: true, other: true, status: `ready` })
+        } finally {
+          for (const tab of tabs.reverse())
+            await tab.cleanup().catch(() => undefined)
+          rmSync(directory, { recursive: true, force: true })
+        }
+      }),
+    30_000,
+  )
+})
+
+/*
+A leader source may commit on every load: a legal update with a new value, or
+an equal-value insert of a row it already delivered, which core reconciles as
+an update. A follower applies the leader's commit notice from durable rows.
+That apply must not release and request the follower's demand again: a new
+request makes the leader's source load and commit again, and the follower
+would never settle. The model: the follower's query is first ready with the
+leader's row, the follower sends at most two ensures (its demand, and at most
+one replay), and a later leader commit still reaches the follower with the
+leader's current value.
+*/
+describe(`follower stays bounded when the leader commits on every load`, () => {
+  it.each([`update`, `reinsert`] as const)(
+    `settles and stays bounded: commit on every load as $0`,
+    (commitEachLoad) =>
+      withNativeBrowserTransport(async () => {
+        const directory = mkdtempSync(join(tmpdir(), `db-real-tab-each-load-`))
+        const filename = join(directory, `tabs.sqlite`)
+        const dbName = `real-tab-each-load-${Math.random().toString(36).slice(2)}`
+        const upstream = new Map<string, RealTabRow>([
+          [`remote`, { id: `remote`, group: `a` }],
+        ])
+        const tabs: Array<ReturnType<typeof createRealTab>> = []
+        const queries: Array<{ cleanup: () => Promise<void> }> = []
+        const remote: LoadSubsetOptions = {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`id`]),
+            new IR.Value(`remote`),
+          ]),
+        }
+        try {
+          const leader = createRealTab({
+            dbName,
+            filename,
+            source: `receipt`,
+            upstream,
+            commitEachLoad,
+          })
+          tabs.push(leader)
+          leader.collection.startSyncImmediate()
+          await leader.collection.stateWhenReady()
+          const follower = createRealTab({
+            dbName,
+            filename,
+            source: `receipt`,
+            upstream,
+            commitEachLoad,
+          })
+          tabs.push(follower)
+          follower.collection.startSyncImmediate()
+          await vi.waitFor(() =>
+            expect(follower.storageCollectionId()).toBeDefined(),
+          )
+          const items: Collection<RealTabRow, string> = follower.collection
+          const query = createLiveQueryCollection((q) =>
+            q.from({ item: items }).where(({ item }) => eq(item.id, `remote`)),
+          )
+          queries.push(query)
+          let rowsAtFirstReady: Array<string> | undefined
+          query.onFirstReady(() => {
+            rowsAtFirstReady = query.toArray.map((row) => row.id)
+          })
+          void query.preload().catch(() => undefined)
+          await vi.waitFor(() => expect(query.isReady()).toBe(true), {
+            timeout: 8_000,
+          })
+          expect(rowsAtFirstReady).toEqual([`remote`])
+          for (let turn = 0; turn < 200; turn++) await nextTurn()
+          const ensures = () =>
+            follower.trace.filter((entry) => entry === `ensure`).length
+          expect(ensures()).toBeLessThanOrEqual(2)
+
+          // A later leader commit still reaches the follower.
+          await leader.collection._sync.loadSubset(remote)
+          await vi.waitFor(
+            () =>
+              expect(follower.collection.get(`remote`)?.group).toBe(
+                upstream.get(`remote`)!.group,
+              ),
+            { timeout: 8_000 },
+          )
+          for (let turn = 0; turn < 200; turn++) await nextTurn()
+          expect(ensures()).toBeLessThanOrEqual(2)
+        } finally {
+          for (const query of queries)
+            await query.cleanup().catch(() => undefined)
+          for (const tab of tabs.reverse())
+            await tab.cleanup().catch(() => undefined)
+          rmSync(directory, { recursive: true, force: true })
+        }
+      }),
+    30_000,
+  )
+})
+
+describe(`coordinator fixture lifecycle`, () => {
+  it(`releases delayed transport and leadership state before a fresh lifecycle`, async () => {
+    let first: BrowserCollectionCoordinator | undefined
+    let peer: BrowserCollectionCoordinator | undefined
+    let fresh: BrowserCollectionCoordinator | undefined
+
+    await withFailurePreservingCleanup(async () => {
+      first = createCoordinator(
+        `cleanup-first`,
+        createRecordingAdapter({ id: `first` }),
+      )
+      peer = createCoordinator(
+        `cleanup-first`,
+        createRecordingAdapter({ id: `peer` }),
+      )
+      first.subscribe(`alpha`, () => {})
+      peer.subscribe(`alpha`, () => {})
+      await waitFor(
+        () => first!.isLeader(`alpha`) && !peer!.isLeader(`alpha`),
+        `first lifecycle leadership`,
+      )
+
+      const retiredBefore = ControlledBroadcastChannel.retiredDeliveries
+      first.publish(`alpha`, {
+        v: 1,
+        dbName: `cleanup-first`,
+        collectionId: `alpha`,
+        senderId: first.getNodeId(),
+        ts: Date.now(),
+        payload: { type: `lifecycle:pending` },
+      })
+      expect(ControlledBroadcastChannel.delayed.length).toBeGreaterThan(0)
+      await disposeCoordinator(first)
+      await disposeCoordinator(peer)
+      await waitForWithoutDelivery(
+        () => heldLocks.size === 0 && queuedLocks.size === 0,
+        `first lifecycle release`,
+      )
+      expect(ControlledBroadcastChannel.retiredDeliveries).toBeGreaterThan(
+        retiredBefore,
+      )
+      expect(coordinatorFixtureSnapshot()).toEqual({
+        delayed: 0,
+        endpoints: 0,
+        heldLocks: 0,
+        queuedLocks: 0,
+      })
+
+      fresh = createCoordinator(
+        `cleanup-fresh`,
+        createRecordingAdapter({ id: `fresh` }),
+      )
+      fresh.subscribe(`alpha`, () => {})
+      await waitFor(
+        () => fresh!.isLeader(`alpha`),
+        `fresh lifecycle leadership`,
+      )
+      expect(fresh.isLeader(`alpha`)).toBe(true)
+      await disposeCoordinator(fresh)
+      await waitForWithoutDelivery(
+        () => heldLocks.size === 0 && queuedLocks.size === 0,
+        `fresh lifecycle release`,
+      )
+      expect(coordinatorFixtureSnapshot()).toEqual({
+        delayed: 0,
+        endpoints: 0,
+        heldLocks: 0,
+        queuedLocks: 0,
+      })
+    }, [
+      [
+        `first lifecycle coordinator`,
+        async () => {
+          await disposeCoordinator(first)
+        },
+      ],
+      [
+        `first lifecycle peer`,
+        async () => {
+          await disposeCoordinator(peer)
+        },
+      ],
+      [
+        `fresh lifecycle coordinator`,
+        async () => {
+          await disposeCoordinator(fresh)
+        },
+      ],
+    ])
+  })
+})
diff --git a/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-config.ts b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-config.ts
new file mode 100644
index 0000000000..c9144a0110
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-config.ts
@@ -0,0 +1,68 @@
+import type { SharedDriverFairnessOptions } from './shared-driver-fairness-oracle'
+
+// Replay and calibration environment for the shared-driver fairness oracle and
+// its ordinary configuration tests. The oracle in `shared-driver-fairness-oracle.test.ts` owns the law.
+
+export const FIXED_SEED = 165_905
+
+export type FairnessReplayEnvironment = Record<string, string | undefined>
+
+export type FairnessReplayConfig = {
+  seed: number
+  path: string
+}
+
+export type FairnessPropertyMode = {
+  label: `fixed-seed` | `seedless-random` | `checked-replay`
+  seed?: number
+  path?: string
+}
+
+export function readFairnessReplayConfig(
+  environment: FairnessReplayEnvironment = process.env,
+): FairnessReplayConfig | undefined {
+  const seedText = environment.TANSTACK_DB_DRIVER_FAIRNESS_SEED
+  const path = environment.TANSTACK_DB_DRIVER_FAIRNESS_PATH
+  if (seedText === undefined && path === undefined) return undefined
+  if (seedText === undefined || path === undefined) {
+    throw new Error(
+      `TANSTACK_DB_DRIVER_FAIRNESS_SEED and TANSTACK_DB_DRIVER_FAIRNESS_PATH must be supplied together`,
+    )
+  }
+
+  const seed = Number(seedText)
+  if (seedText.trim() === `` || !Number.isSafeInteger(seed)) {
+    throw new Error(`TANSTACK_DB_DRIVER_FAIRNESS_SEED must be an integer`)
+  }
+  if (!/^\d+(?::\d+)*$/.test(path)) {
+    throw new Error(
+      `TANSTACK_DB_DRIVER_FAIRNESS_PATH must contain colon-separated nonnegative integers`,
+    )
+  }
+  return { seed, path }
+}
+
+export function createFairnessPropertyModes(
+  replay: FairnessReplayConfig | undefined,
+): ReadonlyArray<FairnessPropertyMode> {
+  if (replay) {
+    return [{ label: `checked-replay`, ...replay }]
+  }
+  return [
+    { label: `fixed-seed`, seed: FIXED_SEED },
+    { label: `seedless-random` },
+  ]
+}
+
+export function readFairnessCalibration(
+  environment: FairnessReplayEnvironment = process.env,
+): SharedDriverFairnessOptions {
+  const fault = environment.TANSTACK_DB_DRIVER_FAIRNESS_CALIBRATION
+  if (fault === undefined) return {}
+  if (fault !== `persist-first-fifo`) {
+    throw new Error(
+      `TANSTACK_DB_DRIVER_FAIRNESS_CALIBRATION must be persist-first-fifo`,
+    )
+  }
+  return { schedulingFault: fault }
+}
diff --git a/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.test.ts b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.test.ts
index dccdecafd4..38cb256ae3 100644
--- a/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.test.ts
+++ b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.test.ts
@@ -26,6 +26,7 @@ import { join } from 'node:path'
 import fc from 'fast-check'
 import { describe, expect, it } from 'vitest'
 import { oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import {
   SHARED_DRIVER_FAIRNESS_BOUND,
   createPersistFirstFaultObservation,
@@ -34,6 +35,12 @@ import {
   observeSharedDriverFairness,
 } from './shared-driver-fairness-oracle'
 import { createWASQLiteTestDatabase } from './helpers/wa-sqlite-test-db'
+import {
+  FIXED_SEED,
+  createFairnessPropertyModes,
+  readFairnessCalibration,
+  readFairnessReplayConfig,
+} from './shared-driver-fairness-config'
 import type {
   SharedDriverFairnessObservation,
   SharedDriverFairnessOptions,
@@ -41,25 +48,11 @@ import type {
   SharedDriverFairnessWork,
 } from './shared-driver-fairness-oracle'
 
-const FIXED_SEED = 165_905
 const GENERATED_RUNS = 12
 const HYDRATE_COUNT_RANGE = { min: 2, max: 7 } as const
 const PERSIST_COUNT_RANGE = { min: 3, max: 7 } as const
 const MUTATIONS_PER_PERSIST_RANGE = { min: 1, max: 3 } as const
 
-type FairnessReplayEnvironment = Record<string, string | undefined>
-
-type FairnessReplayConfig = {
-  seed: number
-  path: string
-}
-
-type FairnessPropertyMode = {
-  label: `fixed-seed` | `seedless-random` | `checked-replay`
-  seed?: number
-  path?: string
-}
-
 class FairnessOracleFailure extends Error {
   constructor(
     readonly law: string,
@@ -78,55 +71,6 @@ function checkAt(law: string, checkpoint: string, assertion: () => void): void {
   }
 }
 
-function readFairnessReplayConfig(
-  environment: FairnessReplayEnvironment = process.env,
-): FairnessReplayConfig | undefined {
-  const seedText = environment.TANSTACK_DB_DRIVER_FAIRNESS_SEED
-  const path = environment.TANSTACK_DB_DRIVER_FAIRNESS_PATH
-  if (seedText === undefined && path === undefined) return undefined
-  if (seedText === undefined || path === undefined) {
-    throw new Error(
-      `TANSTACK_DB_DRIVER_FAIRNESS_SEED and TANSTACK_DB_DRIVER_FAIRNESS_PATH must be supplied together`,
-    )
-  }
-
-  const seed = Number(seedText)
-  if (seedText.trim() === `` || !Number.isSafeInteger(seed)) {
-    throw new Error(`TANSTACK_DB_DRIVER_FAIRNESS_SEED must be an integer`)
-  }
-  if (!/^\d+(?::\d+)*$/.test(path)) {
-    throw new Error(
-      `TANSTACK_DB_DRIVER_FAIRNESS_PATH must contain colon-separated nonnegative integers`,
-    )
-  }
-  return { seed, path }
-}
-
-function createFairnessPropertyModes(
-  replay: FairnessReplayConfig | undefined,
-): ReadonlyArray<FairnessPropertyMode> {
-  if (replay) {
-    return [{ label: `checked-replay`, ...replay }]
-  }
-  return [
-    { label: `fixed-seed`, seed: FIXED_SEED },
-    { label: `seedless-random` },
-  ]
-}
-
-function readFairnessCalibration(
-  environment: FairnessReplayEnvironment = process.env,
-): SharedDriverFairnessOptions {
-  const fault = environment.TANSTACK_DB_DRIVER_FAIRNESS_CALIBRATION
-  if (fault === undefined) return {}
-  if (fault !== `persist-first-fifo`) {
-    throw new Error(
-      `TANSTACK_DB_DRIVER_FAIRNESS_CALIBRATION must be persist-first-fifo`,
-    )
-  }
-  return { schedulingFault: fault }
-}
-
 const fairnessPropertyModes = createFairnessPropertyModes(
   readFairnessReplayConfig(),
 )
@@ -333,6 +277,10 @@ function reachesHydrateBeforeLaterPersist(
 
 const generatedHistoryArbitrary = createGeneratedHistoryArbitrary(`varied`)
 const tailOrderAblatedArbitrary = createGeneratedHistoryArbitrary(`removed`)
+
+declareOracle({
+  grammar: [generatedHistoryArbitrary, tailOrderAblatedArbitrary],
+})
 let generatedPropertyExecutions = 0
 type GeneratedFailureRecord = {
   law: string
@@ -385,60 +333,6 @@ const generatedFairnessProperty = fc.asyncProperty(
 )
 
 describe(`shared BrowserWASQLiteDriver fairness oracle`, () => {
-  it(`selects fixed and seedless lanes by default and only replay when requested`, () => {
-    expect(createFairnessPropertyModes(readFairnessReplayConfig({}))).toEqual([
-      { label: `fixed-seed`, seed: FIXED_SEED },
-      { label: `seedless-random` },
-    ])
-    expect(
-      createFairnessPropertyModes(
-        readFairnessReplayConfig({
-          TANSTACK_DB_DRIVER_FAIRNESS_SEED: `42`,
-          TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0:1`,
-        }),
-      ),
-    ).toEqual([{ label: `checked-replay`, seed: 42, path: `0:1` }])
-    expect(readFairnessCalibration({})).toEqual({})
-    expect(
-      readFairnessCalibration({
-        TANSTACK_DB_DRIVER_FAIRNESS_CALIBRATION: `persist-first-fifo`,
-      }),
-    ).toEqual({ schedulingFault: `persist-first-fifo` })
-  })
-
-  it.each([
-    {
-      name: `seed without path`,
-      environment: { TANSTACK_DB_DRIVER_FAIRNESS_SEED: `42` },
-      message: `must be supplied together`,
-    },
-    {
-      name: `path without seed`,
-      environment: { TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0` },
-      message: `must be supplied together`,
-    },
-    {
-      name: `non-integer seed`,
-      environment: {
-        TANSTACK_DB_DRIVER_FAIRNESS_SEED: `4.2`,
-        TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0`,
-      },
-      message: `must be an integer`,
-    },
-    {
-      name: `invalid shrink path`,
-      environment: {
-        TANSTACK_DB_DRIVER_FAIRNESS_SEED: `42`,
-        TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0:-1`,
-      },
-      message: `colon-separated nonnegative integers`,
-    },
-  ])(`rejects incomplete or invalid replay coordinates: $name`, (probe) => {
-    expect(() => readFairnessReplayConfig(probe.environment)).toThrow(
-      probe.message,
-    )
-  })
-
   it(`reconstructs the known persist-first witness, covers range marginals, and rejects a nearby invalid storm`, async () => {
     const knownWitness = buildGeneratedHistory(2, 4, 1, [
       { kind: `persist`, token: `p1` },
@@ -766,7 +660,10 @@ describe(`shared BrowserWASQLiteDriver fairness oracle`, () => {
   })
 
   it(`proves tail-order ablation removes a hydrate-before-later-persist history`, () => {
-    const sampleOptions = { seed: FIXED_SEED, numRuns: GENERATED_RUNS }
+    const sampleOptions = {
+      seed: FIXED_SEED,
+      numRuns: oracleRuns(GENERATED_RUNS),
+    }
     const completeGrammar = fc.sample(generatedHistoryArbitrary, sampleOptions)
     const tailOrderAblatedGrammar = fc.sample(
       tailOrderAblatedArbitrary,
diff --git a/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.ts b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.ts
index 220a89505d..43362d9f80 100644
--- a/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.ts
+++ b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 /**
  * # When does a cold hydrate get a turn on a shared SQLite driver?
  *
@@ -963,3 +964,11 @@ export async function observeSharedDriverFairness(
   }
   return observation
 }
+
+declareOracle({
+  check: [
+    findSharedDriverFairnessViolation,
+    findSharedDriverFairnessLawViolations,
+  ],
+  model: [createFairnessReference],
+})
diff --git a/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness.test.ts b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness.test.ts
new file mode 100644
index 0000000000..62b76239a2
--- /dev/null
+++ b/packages/browser-db-sqlite-persistence/tests/shared-driver-fairness.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import {
+  FIXED_SEED,
+  createFairnessPropertyModes,
+  readFairnessCalibration,
+  readFairnessReplayConfig,
+} from './shared-driver-fairness-config'
+
+// Configuration tests for the shared BrowserWASQLiteDriver fairness oracle in
+// `shared-driver-fairness-oracle.test.ts`, which owns the law. These pin the replay
+// and calibration environment parsing.
+describe(`shared BrowserWASQLiteDriver fairness oracle`, () => {
+  it(`selects fixed and seedless lanes by default and only replay when requested`, () => {
+    expect(createFairnessPropertyModes(readFairnessReplayConfig({}))).toEqual([
+      { label: `fixed-seed`, seed: FIXED_SEED },
+      { label: `seedless-random` },
+    ])
+    expect(
+      createFairnessPropertyModes(
+        readFairnessReplayConfig({
+          TANSTACK_DB_DRIVER_FAIRNESS_SEED: `42`,
+          TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0:1`,
+        }),
+      ),
+    ).toEqual([{ label: `checked-replay`, seed: 42, path: `0:1` }])
+    expect(readFairnessCalibration({})).toEqual({})
+    expect(
+      readFairnessCalibration({
+        TANSTACK_DB_DRIVER_FAIRNESS_CALIBRATION: `persist-first-fifo`,
+      }),
+    ).toEqual({ schedulingFault: `persist-first-fifo` })
+  })
+
+  it.each([
+    {
+      name: `seed without path`,
+      environment: { TANSTACK_DB_DRIVER_FAIRNESS_SEED: `42` },
+      message: `must be supplied together`,
+    },
+    {
+      name: `path without seed`,
+      environment: { TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0` },
+      message: `must be supplied together`,
+    },
+    {
+      name: `non-integer seed`,
+      environment: {
+        TANSTACK_DB_DRIVER_FAIRNESS_SEED: `4.2`,
+        TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0`,
+      },
+      message: `must be an integer`,
+    },
+    {
+      name: `invalid shrink path`,
+      environment: {
+        TANSTACK_DB_DRIVER_FAIRNESS_SEED: `42`,
+        TANSTACK_DB_DRIVER_FAIRNESS_PATH: `0:-1`,
+      },
+      message: `colon-separated nonnegative integers`,
+    },
+  ])(`rejects incomplete or invalid replay coordinates: $name`, (probe) => {
+    expect(() => readFairnessReplayConfig(probe.environment)).toThrow(
+      probe.message,
+    )
+  })
+})
diff --git a/packages/convex-db-collection/e2e/auth-app-oracle.test.ts b/packages/convex-db-collection/e2e/auth-app-oracle.test.ts
index d193e14b36..4ced1700e0 100644
--- a/packages/convex-db-collection/e2e/auth-app-oracle.test.ts
+++ b/packages/convex-db-collection/e2e/auth-app-oracle.test.ts
@@ -19,6 +19,7 @@ import { makeFunctionReference } from 'convex/server'
 import { createCollection } from '@tanstack/db'
 import { expect, inject, it } from 'vitest'
 import { convexCollectionOptions } from '../src/index'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { withTestCleanup } from '../tests/helpers'
 
 declare module 'vitest' {
@@ -54,7 +55,31 @@ const permitted: Record<Role, ReadonlyArray<Operation>> = {
   write: [`send`],
   admin: [`send`, `delete`],
 }
-const history: ReadonlyArray<{ role: Role; operation: Operation }> = [
+type Step = { role: Role; operation: Operation }
+
+/**
+ * The model: one authored step, from the message multiset before it to the
+ * multiset after it. A permitted send adds the body and a permitted delete
+ * removes one copy of it. A denied step leaves the multiset unchanged. The
+ * permitted table above is the model's authority.
+ */
+function stepModel(
+  model: ReadonlyArray<string>,
+  step: Step,
+  body: string,
+): { allowed: boolean; next: Array<string> } {
+  const next = [...model]
+  const allowed = permitted[step.role].includes(step.operation)
+  if (allowed) {
+    if (step.operation === `send`) next.push(body)
+    else next.splice(next.indexOf(body), 1)
+  }
+  return { allowed, next }
+}
+
+declareOracle({ model: [stepModel] })
+
+const history: ReadonlyArray<Step> = [
   { role: `read`, operation: `send` },
   { role: `write`, operation: `send` },
   { role: `write`, operation: `delete` },
@@ -116,11 +141,11 @@ it.each([`javascript`, `react`] as const)(
     await withTestCleanup(
       async () => {
         await collection.preload()
-        const model: Array<string> = []
+        let model: Array<string> = []
         for (const step of history) {
           // This is the upstream demo's public role selector, not admin auth.
           await client.mutation(role, { role: step.role })
-          const allowed = permitted[step.role].includes(step.operation)
+          const predicted = stepModel(model, step, marker)
           const inserted = [...collection.values()].find(
             (row) => row.body === marker,
           )
@@ -128,10 +153,9 @@ it.each([`javascript`, `react`] as const)(
             step.operation === `send`
               ? client.mutation(send, { body: marker })
               : client.mutation(remove, { messageId: inserted!._id })
-          if (allowed) {
+          if (predicted.allowed) {
             await attempt
-            if (step.operation === `send`) model.push(marker)
-            else model.splice(model.indexOf(marker), 1)
+            model = predicted.next
           } else
             await expect(attempt).rejects.toThrow(`Insufficient permissions`)
           await collection.utils.awaitSync()
diff --git a/packages/convex-db-collection/e2e/backend-oracle.test.ts b/packages/convex-db-collection/e2e/backend-oracle.test.ts
index f1e06b4e10..fc54fa5466 100644
--- a/packages/convex-db-collection/e2e/backend-oracle.test.ts
+++ b/packages/convex-db-collection/e2e/backend-oracle.test.ts
@@ -37,21 +37,13 @@ import { describe, expect, inject, it } from 'vitest'
 import { convexPaginatedCollectionOptions } from '../src/index'
 import { withTestCleanup } from '../tests/helpers'
 import { runOracleCampaign } from '../../db/tests/oracle-campaign'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import { all, seed } from './backend-support'
+import type { Task } from './backend-support'
 import type { Value } from 'convex/values'
 import type { ConvexCollectionClient } from '../src/index'
 import type { PaginationOptions, PaginationResult } from 'convex/server'
 
-type Task = {
-  _id: string
-  _creationTime: number
-  clientId: string
-  text: string
-  rank: number
-  payload?: Value
-}
-const seed = makeFunctionReference<`mutation`, { count: number }, null>(
-  `tasks:seed`,
-)
 const write = makeFunctionReference<
   `mutation`,
   {
@@ -63,42 +55,39 @@ const write = makeFunctionReference<
   },
   null
 >(`tasks:write`)
-const all = makeFunctionReference<`query`, {}, Array<Task>>(`tasks:all`)
 const url = inject(`convexUrl`)
 
+/**
+ * The check, a second formulation: after the source accepts each write, the
+ * mirrored Collection equals the unpaginated tasks:all query in rank order.
+ * That query does not paginate or use the adapter.
+ */
+async function expectMirrorsAllTasks(
+  client: ConvexClient | ConvexReactClient,
+  collection: {
+    utils: { awaitSync: () => Promise<unknown> }
+    values: () => Iterable<Task>
+  },
+): Promise<void> {
+  const expected = await client.query(all, {})
+  await collection.utils.awaitSync()
+  const actual = [...collection.values()]
+    .map(({ clientId, text, rank }) => ({ clientId, text, rank }))
+    .sort((a, b) => a.rank - b.rank)
+  expect(actual).toEqual(
+    expected.map(({ clientId, text, rank }) => ({
+      clientId,
+      text,
+      rank,
+    })),
+  )
+}
+
+declareOracle({ check: [expectMirrorsAllTasks] })
+
 describe.each([`javascript`, `react`] as const)(
   `real backend with %s client`,
   (kind) => {
-    it(`rejects a mirror beyond its row bound without publishing a partial result`, async () => {
-      const client =
-        kind === `javascript`
-          ? new ConvexClient(url, { unsavedChangesWarning: false })
-          : new ConvexReactClient(url, { unsavedChangesWarning: false })
-      const collection = createCollection(
-        convexPaginatedCollectionOptions({
-          client,
-          query: makeFunctionReference<
-            `query`,
-            { paginationOpts: PaginationOptions },
-            PaginationResult<Task>
-          >(`tasks:list`),
-          queryArgs: {},
-          pageSize: 4,
-          maxRows: 5,
-          getKey: (task) => task.clientId,
-          gcTime: 0,
-        }),
-      )
-      await withTestCleanup(
-        async () => {
-          await client.mutation(seed, { count: 23 })
-          await expect(collection.preload()).rejects.toBeInstanceOf(RangeError)
-          expect([...collection.values()]).toEqual([])
-        },
-        () => collection.cleanup(),
-        () => client.close(),
-      )
-    })
     it.each([`list`, `split`] as const)(
       `loads %s pages through inserts, moves, deletions, and server splits`,
       async (functionName) => {
@@ -160,20 +149,7 @@ describe.each([`javascript`, `react`] as const)(
             gcTime: 0,
           }),
         )
-        const check = async () => {
-          const expected = await client.query(all, {})
-          await collection.utils.awaitSync()
-          const actual = [...collection.values()]
-            .map(({ clientId, text, rank }) => ({ clientId, text, rank }))
-            .sort((a, b) => a.rank - b.rank)
-          expect(actual).toEqual(
-            expected.map(({ clientId, text, rank }) => ({
-              clientId,
-              text,
-              rank,
-            })),
-          )
-        }
+        const check = () => expectMirrorsAllTasks(client, collection)
         await withTestCleanup(
           async () => {
             await client.mutation(seed, { count: 23 })
diff --git a/packages/convex-db-collection/e2e/backend-startup-oracle.test.ts b/packages/convex-db-collection/e2e/backend-startup.test.ts
similarity index 96%
rename from packages/convex-db-collection/e2e/backend-startup-oracle.test.ts
rename to packages/convex-db-collection/e2e/backend-startup.test.ts
index 3d4810e1c0..19ed4b8df7 100644
--- a/packages/convex-db-collection/e2e/backend-startup-oracle.test.ts
+++ b/packages/convex-db-collection/e2e/backend-startup.test.ts
@@ -10,6 +10,9 @@
  * of the pinned upstream messages query. The test never calculates which free
  * port the CLI should choose or reads the launcher's selection logic.
  *
+ * This is a fixed test, not an oracle: its expected port and rows are written
+ * values, so it has no oracle owner (tracked in #2264).
+ *
  * This fixed history holds the old port, calls the actual public-pagination
  * global setup, observes its provided URL, then executes the public query.
  * EADDRINUSE is also a valid occupied-port precondition, and its external owner
diff --git a/packages/convex-db-collection/e2e/backend-support.ts b/packages/convex-db-collection/e2e/backend-support.ts
new file mode 100644
index 0000000000..717df3fbd8
--- /dev/null
+++ b/packages/convex-db-collection/e2e/backend-support.ts
@@ -0,0 +1,16 @@
+/** The task functions and row type that the backend oracle and its fixed tests share. */
+import { makeFunctionReference } from 'convex/server'
+import type { Value } from 'convex/values'
+
+export type Task = {
+  _id: string
+  _creationTime: number
+  clientId: string
+  text: string
+  rank: number
+  payload?: Value
+}
+export const seed = makeFunctionReference<`mutation`, { count: number }, null>(
+  `tasks:seed`,
+)
+export const all = makeFunctionReference<`query`, {}, Array<Task>>(`tasks:all`)
diff --git a/packages/convex-db-collection/e2e/backend.test.ts b/packages/convex-db-collection/e2e/backend.test.ts
new file mode 100644
index 0000000000..f0c3f69fe1
--- /dev/null
+++ b/packages/convex-db-collection/e2e/backend.test.ts
@@ -0,0 +1,54 @@
+/**
+ * Fixed scenarios against the real local backend: a mirror beyond its row bound
+ * rejects without publishing a partial result. The provider-boundary law and its
+ * receiving histories are owned by backend-oracle.test.ts. These fixed tests
+ * compare with written values and have no oracle owner (tracked in #2264).
+ */
+import { createCollection } from '@tanstack/db'
+import { ConvexClient } from 'convex/browser'
+import { ConvexReactClient } from 'convex/react'
+import { makeFunctionReference } from 'convex/server'
+import { describe, expect, inject, it } from 'vitest'
+import { convexPaginatedCollectionOptions } from '../src/index'
+import { withTestCleanup } from '../tests/helpers'
+import { seed } from './backend-support'
+import type { Task } from './backend-support'
+import type { PaginationOptions, PaginationResult } from 'convex/server'
+
+const url = inject(`convexUrl`)
+
+describe.each([`javascript`, `react`] as const)(
+  `real backend with %s client`,
+  (kind) => {
+    it(`rejects a mirror beyond its row bound without publishing a partial result`, async () => {
+      const client =
+        kind === `javascript`
+          ? new ConvexClient(url, { unsavedChangesWarning: false })
+          : new ConvexReactClient(url, { unsavedChangesWarning: false })
+      const collection = createCollection(
+        convexPaginatedCollectionOptions({
+          client,
+          query: makeFunctionReference<
+            `query`,
+            { paginationOpts: PaginationOptions },
+            PaginationResult<Task>
+          >(`tasks:list`),
+          queryArgs: {},
+          pageSize: 4,
+          maxRows: 5,
+          getKey: (task) => task.clientId,
+          gcTime: 0,
+        }),
+      )
+      await withTestCleanup(
+        async () => {
+          await client.mutation(seed, { count: 23 })
+          await expect(collection.preload()).rejects.toBeInstanceOf(RangeError)
+          expect([...collection.values()]).toEqual([])
+        },
+        () => collection.cleanup(),
+        () => client.close(),
+      )
+    })
+  },
+)
diff --git a/packages/convex-db-collection/e2e/public-pagination-oracle.test.ts b/packages/convex-db-collection/e2e/public-pagination-oracle.test.ts
index 07ca2345e1..a872f5579f 100644
--- a/packages/convex-db-collection/e2e/public-pagination-oracle.test.ts
+++ b/packages/convex-db-collection/e2e/public-pagination-oracle.test.ts
@@ -44,6 +44,7 @@ import { ConvexReactClient } from 'convex/react'
 import { makeFunctionReference } from 'convex/server'
 import { describe, expect, inject, it } from 'vitest'
 import { convexPaginatedCollectionOptions } from '../src/index'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { withTestCleanup } from '../tests/helpers'
 import { createNetworkGate } from './network-gate'
 import type { PaginationOptions, PaginationResult } from 'convex/server'
@@ -72,6 +73,10 @@ function expectedRows(
     )
 }
 
+// The model: the append-only ledger in reverse insertion order, with the
+// query's author predicate and text transformation.
+declareOracle({ model: [expectedRows] })
+
 // The backend starts with a new runtime directory and empty database. File and
 // test execution are sequential, so this ledger includes all successful writes
 // across the six histories, including rows outside the requested author scope.
diff --git a/packages/convex-db-collection/tests/lazy-paging-model-oracle.ts b/packages/convex-db-collection/tests/lazy-paging-model-oracle.ts
index c7877a1431..57cce670e3 100644
--- a/packages/convex-db-collection/tests/lazy-paging-model-oracle.ts
+++ b/packages/convex-db-collection/tests/lazy-paging-model-oracle.ts
@@ -13,6 +13,8 @@
  * Limits: finite numeric rank, unique string IDs, one aligned query; provider
  * cache coherence, native cursor correctness and timing need receiving drivers.
  */
+import { declareOracle } from '../../db/tests/oracle-declaration'
+
 export type LazyRow = { id: string; rank: number; text: string }
 export type LazyScope = {
   offset?: number
@@ -160,3 +162,15 @@ export function assertLazyPublications(
       )
   }
 }
+
+// The row, coverage, completeness, and cleanup models predict; the assertions
+// compare production observations with them.
+declareOracle({
+  model: [
+    expectedLazyRows,
+    expectedLazyCoverage,
+    deliveredScopeComplete,
+    LazyTerminalGraphModel,
+  ],
+  check: [assertLazyCoverage, assertLazySourceFacts, assertLazyPublications],
+})
diff --git a/packages/convex-db-collection/tests/lazy-paging-oracle.property.test.ts b/packages/convex-db-collection/tests/lazy-paging-oracle.property.test.ts
index 8fefdb4cbe..31cca2d890 100644
--- a/packages/convex-db-collection/tests/lazy-paging-oracle.property.test.ts
+++ b/packages/convex-db-collection/tests/lazy-paging-oracle.property.test.ts
@@ -46,7 +46,6 @@ import {
   ordered,
 } from './lazy-paging-model-oracle'
 import type { LazyRow } from './lazy-paging-model-oracle'
-import type { ConvexPaginatedCollectionConfig } from '../src/index'
 
 const history = fc.record({
   size: fc.integer({ min: 16, max: 32 }),
@@ -896,24 +895,6 @@ it(`rejects wrong coverage and transient windows while preserving discovery free
   }
 })
 
-// Configuration contradictions fail before a subscription can acquire state.
-it.each([
-  { field: `rank`, direction: `sideways` },
-  { field: 1, direction: `asc` },
-  { field: ``, direction: `asc` },
-])(`rejects malformed order declarations %j`, (queryOrder) => {
-  expect(() =>
-    convexPaginatedCollectionOptions({
-      client: {},
-      query: lazyQuery,
-      queryArgs: {},
-      syncMode: `on-demand`,
-      queryOrder,
-      getKey: (row: LazyRow) => row.id,
-    } as unknown as ConvexPaginatedCollectionConfig<typeof lazyQuery>),
-  ).toThrow(TypeError)
-})
-
 it.each([0, -1, 1.5, Infinity, NaN])(
   `rejects invalid lazy row caps before readiness: %s`,
   async (maxRows) => {
diff --git a/packages/convex-db-collection/tests/lazy-paging-receipt-model.ts b/packages/convex-db-collection/tests/lazy-paging-receipt-model.ts
index 4fd7a1f4b5..25159edcdc 100644
--- a/packages/convex-db-collection/tests/lazy-paging-receipt-model.ts
+++ b/packages/convex-db-collection/tests/lazy-paging-receipt-model.ts
@@ -21,6 +21,8 @@
  * actual pending receipts to reject as abandoned (SyncAppliedReceipt). Merely
  * calling cleanup does not discharge a receipt; its rejection must be observed.
  */
+import { declareOracle } from '../../db/tests/oracle-declaration'
+
 export class LazyReceiptModel {
   readonly events: Array<string> = []
   private readonly attempts = new Map<
@@ -160,3 +162,7 @@ export class LazyReceiptModel {
         throw new Error(`receipt law: accepted work ${id} abandoned`)
   }
 }
+
+// The settlement model that the receipt, interleaving, and revalidation oracles
+// step: it decides which caller outcomes each history permits.
+declareOracle({ model: [LazyReceiptModel] })
diff --git a/packages/convex-db-collection/tests/lazy-paging-version-model-oracle.ts b/packages/convex-db-collection/tests/lazy-paging-version-model-oracle.ts
index 8ce2e6a87d..d33915a719 100644
--- a/packages/convex-db-collection/tests/lazy-paging-version-model-oracle.ts
+++ b/packages/convex-db-collection/tests/lazy-paging-version-model-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import type { LazyRow } from './lazy-paging-model-oracle'
 
 /**
@@ -53,3 +54,6 @@ export class LazyVersionModel {
     )
   }
 }
+
+// The revision model: it decides which public observations a history permits.
+declareOracle({ model: [LazyVersionModel] })
diff --git a/packages/convex-db-collection/tests/lazy-paging-write-model-oracle.ts b/packages/convex-db-collection/tests/lazy-paging-write-model-oracle.ts
index abd1bb1eaa..1b31390fc9 100644
--- a/packages/convex-db-collection/tests/lazy-paging-write-model-oracle.ts
+++ b/packages/convex-db-collection/tests/lazy-paging-write-model-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { copyLazyRows, expectedLazyRows } from './lazy-paging-model-oracle'
 import type { LazyRow, LazyScope } from './lazy-paging-model-oracle'
 
@@ -133,3 +134,6 @@ export class LazyWriteModel {
       )
   }
 }
+
+// The write ledger: it decides which public windows a write history permits.
+declareOracle({ model: [LazyWriteModel] })
diff --git a/packages/convex-db-collection/tests/lazy-paging.test.ts b/packages/convex-db-collection/tests/lazy-paging.test.ts
new file mode 100644
index 0000000000..86884a5f57
--- /dev/null
+++ b/packages/convex-db-collection/tests/lazy-paging.test.ts
@@ -0,0 +1,30 @@
+/**
+ * Fixed scenarios for lazy paging configuration: a malformed order declaration
+ * fails before a subscription can acquire state. The lazy-paging laws and their
+ * generated histories are owned by lazy-paging-oracle.property.test.ts. These
+ * fixed tests compare with written values and have no oracle owner (tracked in
+ * #2264).
+ */
+import { expect, it } from 'vitest'
+import { convexPaginatedCollectionOptions } from '../src/index'
+import { lazyQuery } from './lazy-paging-driver'
+import type { LazyRow } from './lazy-paging-model-oracle'
+import type { ConvexPaginatedCollectionConfig } from '../src/index'
+
+// Configuration contradictions fail before a subscription can acquire state.
+it.each([
+  { field: `rank`, direction: `sideways` },
+  { field: 1, direction: `asc` },
+  { field: ``, direction: `asc` },
+])(`rejects malformed order declarations %j`, (queryOrder) => {
+  expect(() =>
+    convexPaginatedCollectionOptions({
+      client: {},
+      query: lazyQuery,
+      queryArgs: {},
+      syncMode: `on-demand`,
+      queryOrder,
+      getKey: (row: LazyRow) => row.id,
+    } as unknown as ConvexPaginatedCollectionConfig<typeof lazyQuery>),
+  ).toThrow(TypeError)
+})
diff --git a/packages/convex-db-collection/tests/pagination-oracle.property.test.ts b/packages/convex-db-collection/tests/pagination-oracle.property.test.ts
index efd0236c85..f385726738 100644
--- a/packages/convex-db-collection/tests/pagination-oracle.property.test.ts
+++ b/packages/convex-db-collection/tests/pagination-oracle.property.test.ts
@@ -23,138 +23,14 @@
  */
 import fc from 'fast-check'
 import { createCollection } from '@tanstack/db'
-import { makeFunctionReference } from 'convex/server'
 import { expect, it } from 'vitest'
 import { convexPaginatedCollectionOptions } from '../src/index'
 import { runOracleCampaign } from '../../db/tests/oracle-campaign'
 import { oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { withTestCleanup } from './helpers'
-import type { PaginationOptions, PaginationResult } from 'convex/server'
-import type { ConvexCollectionClient } from '../src/index'
-
-type Row = { id: string; rank: number; text: string }
-const query = makeFunctionReference<
-  `query`,
-  { paginationOpts: PaginationOptions },
-  PaginationResult<Row>
->(`rows:list`)
-type Slot = {
-  options: PaginationOptions
-  current?: PaginationResult<Row>
-  callback: (value: PaginationResult<Row>) => void
-  active: boolean
-}
-function provider(
-  reverse: boolean,
-  split: `none` | `required` | `recommended`,
-) {
-  const slots: Array<Slot> = []
-  let rowVisits = 0
-  const client = {
-    onUpdate: (
-      _query: unknown,
-      args: { paginationOpts: PaginationOptions },
-      callback: Slot[`callback`],
-    ) => {
-      const slot: Slot = {
-        options: args.paginationOpts,
-        callback,
-        active: true,
-      }
-      slots.push(slot)
-      return Object.assign(
-        () => {
-          slot.active = false
-        },
-        { getCurrentValue: () => slot.current },
-      )
-    },
-  } as ConvexCollectionClient
-  return {
-    client,
-    slots,
-    get rowVisits() {
-      return rowVisits
-    },
-    publish: async (rows: Array<Row>, checkpoint?: () => void) => {
-      const served = new Set<Slot>()
-      for (let turn = 0; turn < 100; turn++) {
-        const pending = slots.filter((slot) => slot.active && !served.has(slot))
-        if (reverse) pending.reverse()
-        for (const slot of pending) {
-          served.add(slot)
-          const { cursor, endCursor, numItems } = slot.options
-          const from = cursor === null ? -Infinity : Number(cursor)
-          const to = endCursor == null ? Infinity : Number(endCursor)
-          const interval = rows
-            .filter((row) => row.rank > from && row.rank <= to)
-            .sort((a, b) => a.rank - b.rank)
-          const page =
-            endCursor == null ? interval.slice(0, numItems) : interval
-          const boundary = endCursor ?? String(page.at(-1)?.rank ?? from)
-          // A split belongs strictly inside the returned cursor range. For an
-          // unbounded query that range ends at the returned page's boundary,
-          // not at the end of all rows matching the query.
-          const needsSplit = split !== `none` && page.length > 2
-          const splitCursor = needsSplit
-            ? String(page[Math.floor((page.length - 1) / 2)]!.rank)
-            : undefined
-          if (splitCursor !== undefined) {
-            expect(Number(splitCursor)).toBeGreaterThan(from)
-            expect(Number(splitCursor)).toBeLessThan(Number(boundary))
-          }
-          slot.current = {
-            page: new Proxy(needsSplit && split === `required` ? [] : page, {
-              get(target, key, receiver) {
-                if (typeof key === `string` && /^\d+$/.test(key)) rowVisits++
-                return Reflect.get(target, key, receiver)
-              },
-            }),
-            continueCursor: boundary,
-            isDone: endCursor == null && page.length === interval.length,
-            ...(needsSplit
-              ? {
-                  pageStatus:
-                    split === `required`
-                      ? (`SplitRequired` as const)
-                      : (`SplitRecommended` as const),
-                  splitCursor,
-                }
-              : {}),
-          }
-          slot.callback(slot.current)
-        }
-        await Promise.resolve()
-        if (slots.some((slot) => slot.active && slot.current === undefined)) {
-          // Drain the acquisition's scheduled flush before checking. Otherwise
-          // the fixture could fill its new subscriptions before production ever
-          // reaches the incomplete-range path, hiding partial publication.
-          await Promise.resolve()
-          checkpoint?.()
-        }
-        if (slots.every((slot) => !slot.active || served.has(slot))) return
-      }
-      throw new Error(`Pagination did not exhaust finite fixture`)
-    },
-  }
-}
-
-// Shrinking must retain the law mismatch even when disposal also fails.
-it(`retains the primary comparison when cleanup also fails`, async () => {
-  const primary = new Error(`row mismatch`)
-  const cleanup = new Error(`release mismatch`)
-  let lastReleased = false
-  await expect(
-    withTestCleanup(
-      () => Promise.reject(primary),
-      () => Promise.reject(cleanup),
-      () => {
-        lastReleased = true
-      },
-    ),
-  ).rejects.toMatchObject({ cause: primary, errors: [primary, cleanup] })
-  expect(lastReleased).toBe(true)
-})
+import { copyRows, keyedRows, provider, query } from './pagination-support'
+import type { Row } from './pagination-support'
 
 const snapshot = fc.shuffledSubarray([0, 1, 2, 3, 4, 5, 6, 7]).chain((ids) =>
   fc
@@ -193,12 +69,6 @@ const rowStates = [
   `public-snapshot-publication`,
 ] as const
 
-function copyRows(rows: ReadonlyArray<Row>): Array<Row> {
-  return rows.map(({ id, rank, text }) => ({ id, rank, text }))
-}
-function keyedRows(rows: ReadonlyArray<Row>): Array<Row> {
-  return copyRows(rows).sort((a, b) => a.id.localeCompare(b.id))
-}
 function sameRows(
   left: ReadonlyArray<Row>,
   right: ReadonlyArray<Row>,
@@ -236,6 +106,10 @@ function expectRevisionTrace(
   }
 }
 
+// The check below compares each observed snapshot with the model's prior and
+// current complete snapshots; the grammar draws the source histories.
+declareOracle({ check: [expectRevisionTrace], grammar: [history, snapshot] })
+
 // Calibrate both recorders' shared trace relation without imposing one callback
 // per revision. Repeated old/new snapshots are legal; prefixes and rollback
 // after the new snapshot are not, even when a final callback repairs the result.
@@ -544,66 +418,3 @@ it(`rejects an oversized eager mirror before continuing and preserves accepted r
     { fixedSeed: 20261023 },
   )
 })
-
-it.each([0, -1, 1.5, Infinity, NaN])(
-  `rejects invalid maxRows %s`,
-  async (maxRows) => {
-    const source = provider(false, `none`)
-    const collection = createCollection(
-      convexPaginatedCollectionOptions({
-        client: source.client,
-        query,
-        queryArgs: {},
-        maxRows,
-        getKey: (row) => row.id,
-      }),
-    )
-    try {
-      await expect(collection.preload()).rejects.toThrow(`maxRows`)
-      expect(source.slots).toHaveLength(0)
-    } finally {
-      await collection.cleanup()
-    }
-  },
-)
-
-// The omitted default needs both adjacent observations. Rejection at 10,001
-// alone also accepts a wrong default of 9,999; acceptance at 10,000 rejects it.
-// Calibration: defaults of 9,999 and 10,001 fail the accepted-error and
-// over-cap-error comparisons respectively; the documented default passes both.
-it(`accepts ten thousand rows and rejects the next row under the default cap`, async () => {
-  const source = provider(false, `none`)
-  const collection = createCollection(
-    convexPaginatedCollectionOptions({
-      client: source.client,
-      query,
-      queryArgs: {},
-      pageSize: 10_001,
-      getKey: (row) => row.id,
-    }),
-  )
-  collection.startSyncImmediate()
-  await withTestCleanup(
-    async () => {
-      const rows = Array.from({ length: 10_001 }, (_, rank) => ({
-        id: String(rank),
-        rank,
-        text: String(rank),
-      }))
-      const accepted = rows.slice(0, 10_000)
-      await source.publish(accepted)
-      expect(collection.utils.getSyncError()).toBeUndefined()
-      await collection.utils.awaitSync()
-      expect(collection.status).toBe(`ready`)
-      expect(keyedRows([...collection.values()])).toEqual(keyedRows(accepted))
-      await source.publish(rows)
-      expect(collection.utils.getSyncError()).toBeInstanceOf(RangeError)
-      expect(keyedRows([...collection.values()])).toEqual(keyedRows(accepted))
-      expect(source.slots).toHaveLength(1)
-      await expect(collection.utils.awaitSync()).rejects.toBeInstanceOf(
-        RangeError,
-      )
-    },
-    () => collection.cleanup(),
-  )
-})
diff --git a/packages/convex-db-collection/tests/pagination-support.ts b/packages/convex-db-collection/tests/pagination-support.ts
new file mode 100644
index 0000000000..ad77d34b74
--- /dev/null
+++ b/packages/convex-db-collection/tests/pagination-support.ts
@@ -0,0 +1,125 @@
+/**
+ * The pagination fixture that pagination-oracle.property.test.ts and the fixed
+ * tests in pagination.test.ts share. The provider answers mathematical rank
+ * intervals rather than following the adapter's page state; the oracle file
+ * states its premises.
+ */
+import { makeFunctionReference } from 'convex/server'
+import { expect } from 'vitest'
+import type { PaginationOptions, PaginationResult } from 'convex/server'
+import type { ConvexCollectionClient } from '../src/index'
+
+export type Row = { id: string; rank: number; text: string }
+export const query = makeFunctionReference<
+  `query`,
+  { paginationOpts: PaginationOptions },
+  PaginationResult<Row>
+>(`rows:list`)
+type Slot = {
+  options: PaginationOptions
+  current?: PaginationResult<Row>
+  callback: (value: PaginationResult<Row>) => void
+  active: boolean
+}
+export function provider(
+  reverse: boolean,
+  split: `none` | `required` | `recommended`,
+) {
+  const slots: Array<Slot> = []
+  let rowVisits = 0
+  const client = {
+    onUpdate: (
+      _query: unknown,
+      args: { paginationOpts: PaginationOptions },
+      callback: Slot[`callback`],
+    ) => {
+      const slot: Slot = {
+        options: args.paginationOpts,
+        callback,
+        active: true,
+      }
+      slots.push(slot)
+      return Object.assign(
+        () => {
+          slot.active = false
+        },
+        { getCurrentValue: () => slot.current },
+      )
+    },
+  } as ConvexCollectionClient
+  return {
+    client,
+    slots,
+    get rowVisits() {
+      return rowVisits
+    },
+    publish: async (rows: Array<Row>, checkpoint?: () => void) => {
+      const served = new Set<Slot>()
+      for (let turn = 0; turn < 100; turn++) {
+        const pending = slots.filter((slot) => slot.active && !served.has(slot))
+        if (reverse) pending.reverse()
+        for (const slot of pending) {
+          served.add(slot)
+          const { cursor, endCursor, numItems } = slot.options
+          const from = cursor === null ? -Infinity : Number(cursor)
+          const to = endCursor == null ? Infinity : Number(endCursor)
+          const interval = rows
+            .filter((row) => row.rank > from && row.rank <= to)
+            .sort((a, b) => a.rank - b.rank)
+          const page =
+            endCursor == null ? interval.slice(0, numItems) : interval
+          const boundary = endCursor ?? String(page.at(-1)?.rank ?? from)
+          // A split belongs strictly inside the returned cursor range. For an
+          // unbounded query that range ends at the returned page's boundary,
+          // not at the end of all rows matching the query.
+          const needsSplit = split !== `none` && page.length > 2
+          const splitCursor = needsSplit
+            ? String(page[Math.floor((page.length - 1) / 2)]!.rank)
+            : undefined
+          if (splitCursor !== undefined) {
+            expect(Number(splitCursor)).toBeGreaterThan(from)
+            expect(Number(splitCursor)).toBeLessThan(Number(boundary))
+          }
+          slot.current = {
+            page: new Proxy(needsSplit && split === `required` ? [] : page, {
+              get(target, key, receiver) {
+                if (typeof key === `string` && /^\d+$/.test(key)) rowVisits++
+                return Reflect.get(target, key, receiver)
+              },
+            }),
+            continueCursor: boundary,
+            isDone: endCursor == null && page.length === interval.length,
+            ...(needsSplit
+              ? {
+                  pageStatus:
+                    split === `required`
+                      ? (`SplitRequired` as const)
+                      : (`SplitRecommended` as const),
+                  splitCursor,
+                }
+              : {}),
+          }
+          slot.callback(slot.current)
+        }
+        await Promise.resolve()
+        if (slots.some((slot) => slot.active && slot.current === undefined)) {
+          // Drain the acquisition's scheduled flush before checking. Otherwise
+          // the fixture could fill its new subscriptions before production ever
+          // reaches the incomplete-range path, hiding partial publication.
+          await Promise.resolve()
+          checkpoint?.()
+        }
+        if (slots.every((slot) => !slot.active || served.has(slot))) return
+      }
+      throw new Error(`Pagination did not exhaust finite fixture`)
+    },
+  }
+}
+
+export function copyRows(rows: ReadonlyArray<Row>): Array<Row> {
+  return rows.map(({ id, rank, text }) => ({ id, rank, text }))
+}
+/** Collection iteration order is not query order, so rows compare by key. */
+export function keyedRows(rows: ReadonlyArray<Row>): Array<Row> {
+  return copyRows(rows).sort((a, b) => a.id.localeCompare(b.id))
+}
diff --git a/packages/convex-db-collection/tests/pagination.test.ts b/packages/convex-db-collection/tests/pagination.test.ts
new file mode 100644
index 0000000000..dd7df055d2
--- /dev/null
+++ b/packages/convex-db-collection/tests/pagination.test.ts
@@ -0,0 +1,92 @@
+/**
+ * Fixed scenarios for automatic pagination: harness cleanup fidelity, maxRows
+ * validation, and the default row cap. The complete-snapshot law and its
+ * generated histories are owned by pagination-oracle.property.test.ts. These
+ * fixed tests compare with written values and have no oracle owner (tracked in
+ * #2264).
+ */
+import { createCollection } from '@tanstack/db'
+import { expect, it } from 'vitest'
+import { convexPaginatedCollectionOptions } from '../src/index'
+import { withTestCleanup } from './helpers'
+import { keyedRows, provider, query } from './pagination-support'
+
+// Shrinking must retain the law mismatch even when disposal also fails.
+it(`retains the primary comparison when cleanup also fails`, async () => {
+  const primary = new Error(`row mismatch`)
+  const cleanup = new Error(`release mismatch`)
+  let lastReleased = false
+  await expect(
+    withTestCleanup(
+      () => Promise.reject(primary),
+      () => Promise.reject(cleanup),
+      () => {
+        lastReleased = true
+      },
+    ),
+  ).rejects.toMatchObject({ cause: primary, errors: [primary, cleanup] })
+  expect(lastReleased).toBe(true)
+})
+
+it.each([0, -1, 1.5, Infinity, NaN])(
+  `rejects invalid maxRows %s`,
+  async (maxRows) => {
+    const source = provider(false, `none`)
+    const collection = createCollection(
+      convexPaginatedCollectionOptions({
+        client: source.client,
+        query,
+        queryArgs: {},
+        maxRows,
+        getKey: (row) => row.id,
+      }),
+    )
+    try {
+      await expect(collection.preload()).rejects.toThrow(`maxRows`)
+      expect(source.slots).toHaveLength(0)
+    } finally {
+      await collection.cleanup()
+    }
+  },
+)
+
+// The omitted default needs both adjacent observations. Rejection at 10,001
+// alone also accepts a wrong default of 9,999; acceptance at 10,000 rejects it.
+// Calibration: defaults of 9,999 and 10,001 fail the accepted-error and
+// over-cap-error comparisons respectively; the documented default passes both.
+it(`accepts ten thousand rows and rejects the next row under the default cap`, async () => {
+  const source = provider(false, `none`)
+  const collection = createCollection(
+    convexPaginatedCollectionOptions({
+      client: source.client,
+      query,
+      queryArgs: {},
+      pageSize: 10_001,
+      getKey: (row) => row.id,
+    }),
+  )
+  collection.startSyncImmediate()
+  await withTestCleanup(
+    async () => {
+      const rows = Array.from({ length: 10_001 }, (_, rank) => ({
+        id: String(rank),
+        rank,
+        text: String(rank),
+      }))
+      const accepted = rows.slice(0, 10_000)
+      await source.publish(accepted)
+      expect(collection.utils.getSyncError()).toBeUndefined()
+      await collection.utils.awaitSync()
+      expect(collection.status).toBe(`ready`)
+      expect(keyedRows([...collection.values()])).toEqual(keyedRows(accepted))
+      await source.publish(rows)
+      expect(collection.utils.getSyncError()).toBeInstanceOf(RangeError)
+      expect(keyedRows([...collection.values()])).toEqual(keyedRows(accepted))
+      expect(source.slots).toHaveLength(1)
+      await expect(collection.utils.awaitSync()).rejects.toBeInstanceOf(
+        RangeError,
+      )
+    },
+    () => collection.cleanup(),
+  )
+})
diff --git a/packages/db-collection-e2e/src/fixtures/persisted-conformance-manifest.ts b/packages/db-collection-e2e/src/fixtures/persisted-conformance-manifest.ts
index 6ccc6436f5..a77f8c749a 100644
--- a/packages/db-collection-e2e/src/fixtures/persisted-conformance-manifest.ts
+++ b/packages/db-collection-e2e/src/fixtures/persisted-conformance-manifest.ts
@@ -122,8 +122,8 @@ export const persistedConformanceLaws = [
   'Live Updates Suite > Reactive Updates > should receive updates when backend data changes',
   'Live Updates Suite > Reactive Updates > should add new records that match query predicate',
   'Live Updates Suite > Reactive Updates > should remove records that no longer match predicate',
-  'Live Updates Suite > Subscription Lifecycle > should receive updates when subscribed',
   'Live Updates Suite > Update Existing Records > should update existing records in query results',
+  'Live Updates Suite > Subscription Lifecycle > should receive updates when subscribed',
 ] as const
 
 export function getPersistedConformanceTestNames(
diff --git a/packages/db-collection-e2e/src/index.ts b/packages/db-collection-e2e/src/index.ts
index ec748f27c3..52b6e2b13d 100644
--- a/packages/db-collection-e2e/src/index.ts
+++ b/packages/db-collection-e2e/src/index.ts
@@ -24,6 +24,7 @@ export { createJoinsTestSuite } from './suites/joins-oracle.suite'
 export { createDeduplicationTestSuite } from './suites/deduplication.suite'
 export { createCollationTestSuite } from './suites/collation.suite'
 export { createMutationsTestSuite } from './suites/mutations.suite'
+export { createLiveUpdatesUnitTestSuite } from './suites/live-updates.suite'
 export { createLiveUpdatesTestSuite } from './suites/live-updates-oracle.suite'
 export { createProgressiveTestSuite } from './suites/progressive.suite'
 export { createMovesTestSuite } from './suites/moves-oracle.suite'
diff --git a/packages/db-collection-e2e/src/suites/joins-oracle.suite.ts b/packages/db-collection-e2e/src/suites/joins-oracle.suite.ts
index 4958bb894d..f1cbe34f15 100644
--- a/packages/db-collection-e2e/src/suites/joins-oracle.suite.ts
+++ b/packages/db-collection-e2e/src/suites/joins-oracle.suite.ts
@@ -7,6 +7,7 @@ import { randomUUID } from 'node:crypto'
 import { createLiveQueryCollection, eq, gt, isNull } from '@tanstack/db'
 
 import { describe, expect, it, vi } from 'vitest'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import { waitFor, waitForQueryData } from '../utils/helpers'
 import type {
   Comment,
@@ -951,3 +952,5 @@ export function createJoinsTestSuite(getConfig: () => Promise<E2ETestConfig>) {
     })
   })
 }
+
+declareOracle({ check: [withJoinHistory], model: [createJoinOracle] })
diff --git a/packages/db-collection-e2e/src/suites/live-updates-oracle.suite.ts b/packages/db-collection-e2e/src/suites/live-updates-oracle.suite.ts
index 111ae93c64..d44e7bba1c 100644
--- a/packages/db-collection-e2e/src/suites/live-updates-oracle.suite.ts
+++ b/packages/db-collection-e2e/src/suites/live-updates-oracle.suite.ts
@@ -1,16 +1,15 @@
 /** Reactive backend updates with complete owned rows and unchanged-peer frames. */
 import { describe, expect, it, vi } from 'vitest'
-import { createLiveQueryCollection, gt } from '@tanstack/db'
+import { createLiveQueryCollection } from '@tanstack/db'
 import { waitForQueryData } from '../utils/helpers'
 import {
   expectNotificationHistory,
   expectNotificationsStopped,
 } from '../utils/notification-laws-oracle'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import {
-  assertUserRows,
   captureUserRows,
   userFixture,
-  waitForOwnedUser,
   waitForUserRows,
   withOwnedUsers,
 } from './mutations.suite'
@@ -20,104 +19,6 @@ export function createLiveUpdatesTestSuite(
   getConfig: () => Promise<E2ETestConfig>,
 ) {
   describe('Live Updates Suite', () => {
-    describe('Reactive Updates', () => {
-      it('should receive updates when backend data changes', async () => {
-        const config = await getConfig()
-        await withOwnedUsers(config, async (owned) => {
-          const query = owned.track(
-            createLiveQueryCollection((q) =>
-              q
-                .from({ user: config.collections.onDemand.users })
-                .where(({ user }) => gt(user.age, 30)),
-            ),
-          )
-          await query.preload()
-          await waitForQueryData(query, { minSize: 1 })
-          const peers = captureUserRows(query.values())
-          const initialSize = query.size
-          expect(initialSize).toBeGreaterThan(0)
-          const row = userFixture('Live Update User', 45)
-          row.metadata = { owned: true }
-          const remove = await owned.insert(row)
-          const observed = await waitForUserRows(query, [...peers, row])
-          expect(query.size).toBe(initialSize + 1)
-          const wrongKey = structuredClone(observed)
-          wrongKey[0]!.id += '-wrong'
-          expect(() => assertUserRows(wrongKey, [...peers, row])).toThrow()
-          const wrongMetadata = structuredClone(observed)
-          const metadataPeer = wrongMetadata.find(
-            (value) => value.id === row.id,
-          )
-          if (!metadataPeer || metadataPeer.metadata === null)
-            throw new Error('Expected the owned row with non-null metadata')
-          Object.defineProperty(metadataPeer.metadata, 'unexpected', {
-            value: undefined,
-            enumerable: true,
-          })
-          expect(
-            Object.prototype.hasOwnProperty.call(
-              metadataPeer.metadata,
-              'unexpected',
-            ),
-          ).toBe(true)
-          expect(() => assertUserRows(wrongMetadata, [...peers, row])).toThrow()
-          await remove()
-          await waitForUserRows(query, peers)
-          assertUserRows(observed, [...peers, row])
-        })
-      })
-
-      it('should add new records that match query predicate', async () => {
-        const config = await getConfig()
-        await withOwnedUsers(config, async (owned) => {
-          const query = owned.track(
-            createLiveQueryCollection((q) =>
-              q
-                .from({ user: config.collections.onDemand.users })
-                .where(({ user }) => gt(user.age, 30)),
-            ),
-          )
-          await query.preload()
-          await waitForQueryData(query, { minSize: 1 })
-          const peers = captureUserRows(query.values())
-          const initialSize = query.size
-          expect(initialSize).toBeGreaterThan(0)
-          const row = userFixture('Matching User', 35)
-          const remove = await owned.insert(row)
-          await waitForUserRows(query, [...peers, row])
-          expect(query.size).toBe(initialSize + 1)
-          await remove()
-          await waitForUserRows(query, peers)
-        })
-      })
-
-      it('should remove records that no longer match predicate', async () => {
-        const config = await getConfig()
-        await withOwnedUsers(config, async (owned) => {
-          const query = owned.track(
-            createLiveQueryCollection((q) =>
-              q
-                .from({ user: config.collections.onDemand.users })
-                .where(({ user }) => gt(user.age, 30)),
-            ),
-          )
-          await query.preload()
-          await waitForQueryData(query, { minSize: 1 })
-          const peers = captureUserRows(query.values())
-          const row = userFixture('Live Exit User', 45)
-          await owned.insert(row)
-          await waitForUserRows(query, [...peers, row])
-          const initialSize = query.size
-          expect(initialSize).toBeGreaterThan(0)
-          await config.mutations!.updateUser(row.id, { age: 25 })
-          await waitForOwnedUser(config, { ...row, age: 25 })
-          await waitForUserRows(query, peers)
-          expect(query.size).toBe(initialSize - 1)
-          expect(query.has(row.id)).toBe(false)
-        })
-      })
-    })
-
     describe('Subscription Lifecycle', () => {
       it('should receive updates when subscribed', async () => {
         const config = await getConfig()
@@ -224,30 +125,9 @@ export function createLiveUpdatesTestSuite(
         })
       })
     })
-
-    describe('Update Existing Records', () => {
-      it('should update existing records in query results', async () => {
-        const config = await getConfig()
-        await withOwnedUsers(config, async (owned) => {
-          const query = owned.track(
-            createLiveQueryCollection((q) =>
-              q.from({ user: config.collections.onDemand.users }),
-            ),
-          )
-          await query.preload()
-          await waitForQueryData(query, { minSize: 1 })
-          const peers = captureUserRows(query.values())
-          const row = userFixture('Existing Owned User', 38)
-          await owned.insert(row)
-          await waitForUserRows(query, [...peers, row])
-          const originalAge = row.age
-          await config.mutations!.updateUser(row.id, { age: originalAge + 10 })
-          const updated = { ...row, age: originalAge + 10 }
-          await waitForOwnedUser(config, updated)
-          await waitForUserRows(query, [...peers, updated])
-          expect(query.get(row.id)?.age).toBe(originalAge + 10)
-        })
-      })
-    })
   })
 }
+
+declareOracle({
+  check: [expectNotificationHistory, expectNotificationsStopped],
+})
diff --git a/packages/db-collection-e2e/src/suites/live-updates.suite.ts b/packages/db-collection-e2e/src/suites/live-updates.suite.ts
new file mode 100644
index 0000000000..ecae173eb4
--- /dev/null
+++ b/packages/db-collection-e2e/src/suites/live-updates.suite.ts
@@ -0,0 +1,147 @@
+/**
+ * Reactive update and update-in-place cases whose expectations are written
+ * out row by row. The notification history and unsubscribe laws that the
+ * oracle suite declares are in live-updates-oracle.suite.ts, which runs this
+ * suite too.
+ */
+import { describe, expect, it } from 'vitest'
+import { createLiveQueryCollection, gt } from '@tanstack/db'
+import { waitForQueryData } from '../utils/helpers'
+import {
+  assertUserRows,
+  captureUserRows,
+  userFixture,
+  waitForOwnedUser,
+  waitForUserRows,
+  withOwnedUsers,
+} from './mutations.suite'
+import type { E2ETestConfig } from '../types'
+
+export function createLiveUpdatesUnitTestSuite(
+  getConfig: () => Promise<E2ETestConfig>,
+) {
+  describe('Live Updates Suite', () => {
+    describe('Reactive Updates', () => {
+      it('should receive updates when backend data changes', async () => {
+        const config = await getConfig()
+        await withOwnedUsers(config, async (owned) => {
+          const query = owned.track(
+            createLiveQueryCollection((q) =>
+              q
+                .from({ user: config.collections.onDemand.users })
+                .where(({ user }) => gt(user.age, 30)),
+            ),
+          )
+          await query.preload()
+          await waitForQueryData(query, { minSize: 1 })
+          const peers = captureUserRows(query.values())
+          const initialSize = query.size
+          expect(initialSize).toBeGreaterThan(0)
+          const row = userFixture('Live Update User', 45)
+          row.metadata = { owned: true }
+          const remove = await owned.insert(row)
+          const observed = await waitForUserRows(query, [...peers, row])
+          expect(query.size).toBe(initialSize + 1)
+          const wrongKey = structuredClone(observed)
+          wrongKey[0]!.id += '-wrong'
+          expect(() => assertUserRows(wrongKey, [...peers, row])).toThrow()
+          const wrongMetadata = structuredClone(observed)
+          const metadataPeer = wrongMetadata.find(
+            (value) => value.id === row.id,
+          )
+          if (!metadataPeer || metadataPeer.metadata === null)
+            throw new Error('Expected the owned row with non-null metadata')
+          Object.defineProperty(metadataPeer.metadata, 'unexpected', {
+            value: undefined,
+            enumerable: true,
+          })
+          expect(
+            Object.prototype.hasOwnProperty.call(
+              metadataPeer.metadata,
+              'unexpected',
+            ),
+          ).toBe(true)
+          expect(() => assertUserRows(wrongMetadata, [...peers, row])).toThrow()
+          await remove()
+          await waitForUserRows(query, peers)
+          assertUserRows(observed, [...peers, row])
+        })
+      })
+
+      it('should add new records that match query predicate', async () => {
+        const config = await getConfig()
+        await withOwnedUsers(config, async (owned) => {
+          const query = owned.track(
+            createLiveQueryCollection((q) =>
+              q
+                .from({ user: config.collections.onDemand.users })
+                .where(({ user }) => gt(user.age, 30)),
+            ),
+          )
+          await query.preload()
+          await waitForQueryData(query, { minSize: 1 })
+          const peers = captureUserRows(query.values())
+          const initialSize = query.size
+          expect(initialSize).toBeGreaterThan(0)
+          const row = userFixture('Matching User', 35)
+          const remove = await owned.insert(row)
+          await waitForUserRows(query, [...peers, row])
+          expect(query.size).toBe(initialSize + 1)
+          await remove()
+          await waitForUserRows(query, peers)
+        })
+      })
+
+      it('should remove records that no longer match predicate', async () => {
+        const config = await getConfig()
+        await withOwnedUsers(config, async (owned) => {
+          const query = owned.track(
+            createLiveQueryCollection((q) =>
+              q
+                .from({ user: config.collections.onDemand.users })
+                .where(({ user }) => gt(user.age, 30)),
+            ),
+          )
+          await query.preload()
+          await waitForQueryData(query, { minSize: 1 })
+          const peers = captureUserRows(query.values())
+          const row = userFixture('Live Exit User', 45)
+          await owned.insert(row)
+          await waitForUserRows(query, [...peers, row])
+          const initialSize = query.size
+          expect(initialSize).toBeGreaterThan(0)
+          await config.mutations!.updateUser(row.id, { age: 25 })
+          await waitForOwnedUser(config, { ...row, age: 25 })
+          await waitForUserRows(query, peers)
+          expect(query.size).toBe(initialSize - 1)
+          expect(query.has(row.id)).toBe(false)
+        })
+      })
+    })
+
+    describe('Update Existing Records', () => {
+      it('should update existing records in query results', async () => {
+        const config = await getConfig()
+        await withOwnedUsers(config, async (owned) => {
+          const query = owned.track(
+            createLiveQueryCollection((q) =>
+              q.from({ user: config.collections.onDemand.users }),
+            ),
+          )
+          await query.preload()
+          await waitForQueryData(query, { minSize: 1 })
+          const peers = captureUserRows(query.values())
+          const row = userFixture('Existing Owned User', 38)
+          await owned.insert(row)
+          await waitForUserRows(query, [...peers, row])
+          const originalAge = row.age
+          await config.mutations!.updateUser(row.id, { age: originalAge + 10 })
+          const updated = { ...row, age: originalAge + 10 }
+          await waitForOwnedUser(config, updated)
+          await waitForUserRows(query, [...peers, updated])
+          expect(query.get(row.id)?.age).toBe(originalAge + 10)
+        })
+      })
+    })
+  })
+}
diff --git a/packages/db-collection-e2e/src/suites/moves-oracle.suite.ts b/packages/db-collection-e2e/src/suites/moves-oracle.suite.ts
index e6301f2d35..6609813c4e 100644
--- a/packages/db-collection-e2e/src/suites/moves-oracle.suite.ts
+++ b/packages/db-collection-e2e/src/suites/moves-oracle.suite.ts
@@ -9,6 +9,7 @@ import { randomUUID } from 'node:crypto'
 import { beforeAll, describe, expect, it, vi } from 'vitest'
 import { createCollection } from '@tanstack/db'
 import { electricCollectionOptions } from '@tanstack/electric-db-collection'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import { waitFor } from '../utils/helpers'
 import { expectNotificationHistory } from '../utils/notification-laws-oracle'
 import type { E2ETestConfig, Post, User } from '../types'
@@ -1006,3 +1007,5 @@ export function createMovesTestSuite(getConfig: () => Promise<TagsTestConfig>) {
     runTestsForSyncMode('progressive')
   })
 }
+
+declareOracle({ check: [assertOwnedPosts] })
diff --git a/packages/db-collection-e2e/src/suites/pagination-oracle.suite.ts b/packages/db-collection-e2e/src/suites/pagination-oracle.suite.ts
index d061c17bbb..da96cee71b 100644
--- a/packages/db-collection-e2e/src/suites/pagination-oracle.suite.ts
+++ b/packages/db-collection-e2e/src/suites/pagination-oracle.suite.ts
@@ -6,6 +6,7 @@
 
 import { describe, expect, it, vi } from 'vitest'
 import { createLiveQueryCollection, eq } from '@tanstack/db'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import {
   assertAllItemsMatch,
   assertCollectionSize,
@@ -1516,3 +1517,5 @@ export function createPaginationTestSuite(
     })
   })
 }
+
+declareOracle({ check: [withPaginationHistory], model: [createWindowOracle] })
diff --git a/packages/db-collection-e2e/src/suites/predicates-oracle.suite.ts b/packages/db-collection-e2e/src/suites/predicates-oracle.suite.ts
index 062c325bf1..51977a6d7b 100644
--- a/packages/db-collection-e2e/src/suites/predicates-oracle.suite.ts
+++ b/packages/db-collection-e2e/src/suites/predicates-oracle.suite.ts
@@ -22,6 +22,7 @@ import {
   not,
   or,
 } from '@tanstack/db'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import { assertAllItemsMatch, assertCollectionSize } from '../utils/assertions'
 import { waitForQueryData } from '../utils/helpers'
 import type { E2ETestConfig, Post, User } from '../types'
@@ -1211,3 +1212,5 @@ export function createPredicatesTestSuite(
     })
   })
 }
+
+declareOracle({ check: [assertPredicateRows], model: [orderedAliceRows] })
diff --git a/packages/db-collection-e2e/src/utils/notification-laws-oracle.ts b/packages/db-collection-e2e/src/utils/notification-laws-oracle.ts
index b2b637090d..0b48ccae49 100644
--- a/packages/db-collection-e2e/src/utils/notification-laws-oracle.ts
+++ b/packages/db-collection-e2e/src/utils/notification-laws-oracle.ts
@@ -1,4 +1,5 @@
 import { expect } from 'vitest'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 
 export type Notification<Row> = {
   events: Array<{
@@ -52,3 +53,7 @@ export function expectNotificationsStopped<Row>(
 ): void {
   expect(callbacks).toStrictEqual(archived)
 }
+
+declareOracle({
+  check: [expectNotificationHistory, expectNotificationsStopped],
+})
diff --git a/packages/db-ivm/tests/d2-work-oracle.test.ts b/packages/db-ivm/tests/d2-work.test.ts
similarity index 100%
rename from packages/db-ivm/tests/d2-work-oracle.test.ts
rename to packages/db-ivm/tests/d2-work.test.ts
diff --git a/packages/db-ivm/tests/hash-collision-support.ts b/packages/db-ivm/tests/hash-collision-support.ts
new file mode 100644
index 0000000000..9596415259
--- /dev/null
+++ b/packages/db-ivm/tests/hash-collision-support.ts
@@ -0,0 +1,15 @@
+// Shared by the hash identity oracle and its ordinary tests: a second module
+// copy whose initialization draws are all equal, so every type marker has the
+// same hash number. Its top-K batch is loaded right after it, so it binds to
+// that copy.
+import { captureHashSession } from './hash-session'
+
+// A second module copy whose initialization draws are all equal. Every
+// random constant, including every type marker, gets the same number, so a
+// design that tells types apart by marker number fails here.
+const nativeTape = (await captureHashSession()).tape
+export const colliding = await captureHashSession(nativeTape.map(() => 0.5))
+// Loaded right after the colliding module, so it binds to that copy.
+export const { topKBatch: collidingTopKBatch } = await import(
+  `../src/operators/topKState.js`
+)
diff --git a/packages/db-ivm/tests/hash-failure-retry-oracle.property.test.ts b/packages/db-ivm/tests/hash-failure-retry-oracle.property.test.ts
index 08e2e61508..ce6ba92d94 100644
--- a/packages/db-ivm/tests/hash-failure-retry-oracle.property.test.ts
+++ b/packages/db-ivm/tests/hash-failure-retry-oracle.property.test.ts
@@ -6,6 +6,8 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import { expectFailureCut } from './hash-support.js'
 
 /**
  * A failed structural traversal must publish no reusable hash state.
@@ -51,14 +53,36 @@ const retryHistoryArbitrary = fc.record({
 // recorded seed and path of this property when replayed.
 const retryProperty = `ivm.hash-failure-retry`
 
-function expectFailureCut(
-  error: unknown,
-  reads: Array<number>,
-  expectedError: Error,
-  expectedReads: Array<number>,
-): void {
-  expect(error).toBe(expectedError)
-  expect(reads).toEqual(expectedReads)
+// Model: after a failed attempt, the prefix through the rejecting getter has
+// been read once more, and the untouched tail has not been read at all.
+function expectedFailedReads(
+  completed: number,
+  length: number,
+  attempt: number,
+): Array<number> {
+  return Array.from({ length }, (_, index) =>
+    index <= completed ? attempt : 0,
+  )
+}
+
+// Model: after the successful traversal, the prefix has been read on every
+// attempt plus the success, and the tail is read once by the success.
+function expectedSuccessReads(
+  completed: number,
+  length: number,
+  failures: number,
+): Array<number> {
+  return Array.from({ length }, (_, index) =>
+    index <= completed ? failures + 1 : 1,
+  )
+}
+
+// Model: the plain structural copy whose hash the successful root must match.
+function expectedPlainCopy(
+  length: number,
+  value: number,
+): Array<{ value: number }> {
+  return Array.from({ length }, (_, index) => ({ value: value + index }))
 }
 
 function expectRetryHistory(history: History): void {
@@ -86,21 +110,24 @@ function expectRetryHistory(history: History): void {
       actualError,
       [...reads],
       error,
-      reads.map((_, index) => (index <= completed ? attempt : 0)),
+      expectedFailedReads(completed, reads.length, attempt),
     )
   }
   rejecting = false
-  const expected = reads.map((_, index) => ({ value: value + index }))
+  const expected = expectedPlainCopy(reads.length, value)
   const result = hash(root)
   expect(result).toBe(hash(expected))
-  const afterSuccess = reads.map((_, index) =>
-    index <= completed ? failures + 1 : 1,
-  )
+  const afterSuccess = expectedSuccessReads(completed, reads.length, failures)
   expect(reads).toEqual(afterSuccess)
   expect(hash(root)).toBe(result)
   expect(reads).toEqual(afterSuccess)
 }
 
+declareOracle({
+  check: [expectRetryHistory],
+  model: [expectedFailedReads, expectedSuccessReads, expectedPlainCopy],
+})
+
 describe(`getter failure does not publish partial structural hashes`, () => {
   it.each([0, 1, 2, 3])(
     `retries the same root after %s completed siblings`,
@@ -150,33 +177,4 @@ describe(`getter failure does not publish partial structural hashes`, () => {
     expect(() => expectFailureCut(error, [2, 2, 1], error, [2, 2, 0])).toThrow()
     expectRetryHistory({ completed: 1, tail: 1, failures: 2, value: 0 })
   })
-
-  it(`shrinks and replays a retry that skips a completed sibling`, () => {
-    const property = fc.property(
-      fc.integer({ min: 1, max: 3 }),
-      (completed) => {
-        // Keep this synthetic mismatch isolated: shrinking must not replace
-        // it with a failure from the production traversal.
-        const error = new Error(`getter rejected`)
-        const expected = [...Array.from({ length: completed + 1 }, () => 2), 0]
-        const stale = [...expected]
-        stale[0] = 1
-        expectFailureCut(error, stale, error, expected)
-      },
-    )
-    const failed = fc.check(property, { seed: 205203, numRuns: 1 })
-    expect(failed.numShrinks).toBeGreaterThan(0)
-    expect(failed.counterexamplePath).toBe(`0:0`)
-    expect(failed.errorInstance).toMatchObject({ name: `AssertionError` })
-    expect(failed.counterexample).toEqual([1])
-    if (failed.counterexamplePath === null)
-      throw new Error(`Missing retry replay path`)
-    const replay = fc.check(property, {
-      seed: failed.seed,
-      path: failed.counterexamplePath,
-      endOnFailure: true,
-    })
-    expect(replay.counterexample).toEqual(failed.counterexample)
-    expect(replay.errorInstance).toMatchObject({ name: `AssertionError` })
-  })
 })
diff --git a/packages/db-ivm/tests/hash-failure-retry.test.ts b/packages/db-ivm/tests/hash-failure-retry.test.ts
new file mode 100644
index 0000000000..750b146674
--- /dev/null
+++ b/packages/db-ivm/tests/hash-failure-retry.test.ts
@@ -0,0 +1,37 @@
+// Ordinary tests of the failed-traversal retry harness: a synthetic mismatch
+// must shrink and replay under a fixed seed. hash-failure-retry-oracle.property.test.ts
+// owns the retry law and declares its check.
+import { describe, expect, it } from 'vitest'
+import { fc } from '@fast-check/vitest'
+import { expectFailureCut } from './hash-support.js'
+
+describe(`getter failure does not publish partial structural hashes`, () => {
+  it(`shrinks and replays a retry that skips a completed sibling`, () => {
+    const property = fc.property(
+      fc.integer({ min: 1, max: 3 }),
+      (completed) => {
+        // Keep this synthetic mismatch isolated: shrinking must not replace
+        // it with a failure from the production traversal.
+        const error = new Error(`getter rejected`)
+        const expected = [...Array.from({ length: completed + 1 }, () => 2), 0]
+        const stale = [...expected]
+        stale[0] = 1
+        expectFailureCut(error, stale, error, expected)
+      },
+    )
+    const failed = fc.check(property, { seed: 205203, numRuns: 1 })
+    expect(failed.numShrinks).toBeGreaterThan(0)
+    expect(failed.counterexamplePath).toBe(`0:0`)
+    expect(failed.errorInstance).toMatchObject({ name: `AssertionError` })
+    expect(failed.counterexample).toEqual([1])
+    if (failed.counterexamplePath === null)
+      throw new Error(`Missing retry replay path`)
+    const replay = fc.check(property, {
+      seed: failed.seed,
+      path: failed.counterexamplePath,
+      endOnFailure: true,
+    })
+    expect(replay.counterexample).toEqual(failed.counterexample)
+    expect(replay.errorInstance).toMatchObject({ name: `AssertionError` })
+  })
+})
diff --git a/packages/db-ivm/tests/hash-graph-oracle.property.test.ts b/packages/db-ivm/tests/hash-graph-oracle.property.test.ts
index da44da110a..73fc6297a7 100644
--- a/packages/db-ivm/tests/hash-graph-oracle.property.test.ts
+++ b/packages/db-ivm/tests/hash-graph-oracle.property.test.ts
@@ -6,6 +6,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 /**
  * Structural hash follows the reachable value graph, not object identity.
@@ -19,9 +20,10 @@ import {
  * every attempt, while an unreachable cycle is irrelevant. Named witnesses
  * keep rare topology classes present even when random generation misses them.
  * The generated topology claim is limited to plain objects with numeric
- * labels and array edges, at most six nodes and three edges per node. Fixed
- * cases also cover cycle rejection through other containers. This file does
- * not establish collision freedom or complexity limits.
+ * labels and array edges, at most six nodes and three edges per node. Cycle
+ * rejection through other containers is pinned by hash-graph.test.ts, an
+ * ordinary test file. This file does not establish collision freedom or
+ * complexity limits.
  */
 
 const fixedSeed = 1657019
@@ -68,6 +70,16 @@ const graphArbitrary = fc
     edges.map((targets) => targets.map((target) => target % edges.length)),
   )
 
+// Model: the tree that an acyclic graph denotes from `node`. Sharing is
+// unfolded into equal but distinct subtrees. Hash identity must depend on
+// values, not whether the graph reused an object reference.
+function unfoldEdges(edges: Array<Array<number>>, node: number): unknown {
+  return {
+    value: node,
+    children: edges[node]!.map((child) => unfoldEdges(edges, child)),
+  }
+}
+
 function expectGraphHash(
   edges: Array<Array<number>>,
   hashValue: (value: unknown) => number = hash,
@@ -87,15 +99,14 @@ function expectGraphHash(
     }
     return
   }
-  // Unfold sharing into equal but distinct subtrees. Hash identity must
-  // depend on values, not whether the graph reused an object reference.
-  const unfold = (node: number): unknown => ({
-    value: node,
-    children: edges[node]!.map(unfold),
-  })
-  expect(hashValue(nodes[0])).toBe(hashValue(unfold(0)))
+  expect(hashValue(nodes[0])).toBe(hashValue(unfoldEdges(edges, 0)))
 }
 
+declareOracle({
+  check: [expectGraphHash],
+  model: [isAcyclic, unfoldEdges],
+})
+
 // Named semantic cells run on every campaign; random frequency is not evidence
 // that disconnected cycles, repeated references, or duplicate edges were reached.
 const graphWitnesses: Array<{
@@ -122,37 +133,6 @@ const graphWitnesses: Array<{
 ]
 
 describe(`structural hash graph boundary`, () => {
-  it.each([
-    `object`,
-    `array`,
-    `map-key`,
-    `map-value`,
-    `set`,
-    `symbol`,
-  ] as const)(`rejects a cycle through %s on every attempt`, (kind) => {
-    const record: Record<PropertyKey, unknown> = {}
-    const array: Array<unknown> = []
-    const map = new Map<unknown, unknown>()
-    const set = new Set<unknown>()
-    const input =
-      kind === `array`
-        ? array
-        : kind.startsWith(`map`)
-          ? map
-          : kind === `set`
-            ? set
-            : record
-    if (kind === `object`) record.self = input
-    if (kind === `symbol`) record[Symbol(`self`)] = input
-    if (kind === `array`) array.push(input)
-    if (kind === `map-key`) map.set(input, 1)
-    if (kind === `map-value`) map.set(1, input)
-    if (kind === `set`) set.add(input)
-    for (let attempt = 0; attempt < 2; attempt++) {
-      expect(() => hash(input)).toThrow(`Cannot hash cyclic structural values`)
-    }
-  })
-
   it.each(graphWitnesses)(`matches the $name witness`, ({ edges, acyclic }) => {
     // These expected categories are specified independently of Kahn's result.
     expect(isAcyclic(edges)).toBe(acyclic)
@@ -237,21 +217,4 @@ describe(`structural hash graph boundary`, () => {
     expect(calls).toBe(2)
     expectGraphHash([[1, 2], [3], [3], []])
   })
-
-  it(`leaves completed siblings uncached after a cycle rejects the root`, () => {
-    let reads = 0
-    const sibling = {
-      get value() {
-        return ++reads
-      },
-    }
-    const root: Record<string, unknown> = { a: sibling }
-    root.z = root
-    expect(() => hash(root)).toThrow(`Cannot hash cyclic structural values`)
-    expect(() => hash(root)).toThrow(`Cannot hash cyclic structural values`)
-    expect(reads).toBe(2)
-    delete root.z
-    expect(hash(root)).toBe(hash({ a: { value: 3 } }))
-    expect(reads).toBe(3)
-  })
 })
diff --git a/packages/db-ivm/tests/hash-graph.test.ts b/packages/db-ivm/tests/hash-graph.test.ts
new file mode 100644
index 0000000000..6cbf3a5444
--- /dev/null
+++ b/packages/db-ivm/tests/hash-graph.test.ts
@@ -0,0 +1,56 @@
+// Ordinary structural-hash graph tests: a cycle through each container kind,
+// and a completed sibling left uncached when a cycle rejects the root. Both
+// compare production with fixed expectations. hash-graph-oracle.property.test.ts
+// owns the reachable-graph law and declares its check.
+import { describe, expect, it } from 'vitest'
+import { hash } from '../src/hashing/hash'
+
+describe(`structural hash graph boundary`, () => {
+  it.each([
+    `object`,
+    `array`,
+    `map-key`,
+    `map-value`,
+    `set`,
+    `symbol`,
+  ] as const)(`rejects a cycle through %s on every attempt`, (kind) => {
+    const record: Record<PropertyKey, unknown> = {}
+    const array: Array<unknown> = []
+    const map = new Map<unknown, unknown>()
+    const set = new Set<unknown>()
+    const input =
+      kind === `array`
+        ? array
+        : kind.startsWith(`map`)
+          ? map
+          : kind === `set`
+            ? set
+            : record
+    if (kind === `object`) record.self = input
+    if (kind === `symbol`) record[Symbol(`self`)] = input
+    if (kind === `array`) array.push(input)
+    if (kind === `map-key`) map.set(input, 1)
+    if (kind === `map-value`) map.set(1, input)
+    if (kind === `set`) set.add(input)
+    for (let attempt = 0; attempt < 2; attempt++) {
+      expect(() => hash(input)).toThrow(`Cannot hash cyclic structural values`)
+    }
+  })
+
+  it(`leaves completed siblings uncached after a cycle rejects the root`, () => {
+    let reads = 0
+    const sibling = {
+      get value() {
+        return ++reads
+      },
+    }
+    const root: Record<string, unknown> = { a: sibling }
+    root.z = root
+    expect(() => hash(root)).toThrow(`Cannot hash cyclic structural values`)
+    expect(() => hash(root)).toThrow(`Cannot hash cyclic structural values`)
+    expect(reads).toBe(2)
+    delete root.z
+    expect(hash(root)).toBe(hash({ a: { value: 3 } }))
+    expect(reads).toBe(3)
+  })
+})
diff --git a/packages/db-ivm/tests/hash-identity-oracle.property.test.ts b/packages/db-ivm/tests/hash-identity-oracle.property.test.ts
index 45300a1d8e..6ce85f5817 100644
--- a/packages/db-ivm/tests/hash-identity-oracle.property.test.ts
+++ b/packages/db-ivm/tests/hash-identity-oracle.property.test.ts
@@ -1,8 +1,6 @@
-import { runInNewContext } from 'node:vm'
 import { Temporal } from 'temporal-polyfill'
 import { describe, expect, it as vitestIt } from 'vitest'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { MultiSet } from '../src/multiset.js'
 import {
   equalHashValues,
   hash,
@@ -13,7 +11,8 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
-import { captureHashSession } from './hash-session'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import { colliding } from './hash-collision-support.js'
 
 /**
  * # Which values share D2 value identity?
@@ -58,15 +57,15 @@ import { captureHashSession } from './hash-session'
  * `8283f2e8`, which this file pins before the hash dispatch refactor.
  *
  * Limits:
- * - Arrays from another realm (`node:vm`) are outside the grammar. One pinned
- *   case keeps equality's length check for them.
+ * - Arrays from another realm (`node:vm`) are outside the grammar. An ordinary
+ *   test in hash-identity.test.ts keeps equality's length check for them.
  * - Work and depth caps belong to `hash-work.test.ts`.
  * - Map and Set order sensitivity and ignored Map/Set properties are current
  *   behavior. No contract promises them.
  * - Getters and proxies are outside the grammar.
  * - A RegExp with a `NaN` `lastIndex` is outside the grammar: equality
- *   compares RegExp fields with `===`, but hashing normalizes `NaN`. One
- *   pinned case holds the equality side.
+ *   compares RegExp fields with `===`, but hashing normalizes `NaN`. An
+ *   ordinary test in hash-identity.test.ts holds the equality side.
  * - Cycles run through arrays, Map values, Sets, and plain objects. Cycles
  *   through other carriers, and pairs that differ only in a back-edge target,
  *   would need a bisimulation model.
@@ -727,16 +726,6 @@ const cyclicArb: fc.Arbitrary<CyclicPair> = fc
 // ---------------------------------------------------------------------------
 // Production driver and refinement checks.
 
-// A second module copy whose initialization draws are all equal. Every
-// random constant, including every type marker, gets the same number, so a
-// design that tells types apart by marker number fails here.
-const nativeTape = (await captureHashSession()).tape
-const colliding = await captureHashSession(nativeTape.map(() => 0.5))
-// Loaded right after the colliding module, so it binds to that copy.
-const { topKBatch: collidingTopKBatch } = await import(
-  `../src/operators/topKState.js`
-)
-
 type Module = {
   name: string
   hash: (value: unknown) => number
@@ -790,6 +779,14 @@ function expectCyclicPair({ spec, changed, seeds }: CyclicPair): void {
   }
 }
 
+// The model is `identity` (and its encoding `canon`): equal identities must
+// share a verdict and hash. The grammar `pairArb` is calibrated below.
+declareOracle({
+  check: [expectPair, expectCyclicPair],
+  model: [identity, canon],
+  grammar: [pairArb],
+})
+
 // ---------------------------------------------------------------------------
 // Campaigns. Each generated property has a fixed campaign and a random
 // campaign over the same grammar and check. A path replay of one property
@@ -1038,37 +1035,6 @@ describe(`hash identity oracle`, () => {
       expectPair({ left, right, mutation: `replace` }, seeds)
   })
 
-  // Real Temporal types print distinct formats, so only a polyfill-shaped
-  // value can share text across types. The contract still names the tag.
-  it(`Temporal-shaped values with the same text and different types differ`, () => {
-    const temporalLike = (tag: string) =>
-      new (class {
-        get [Symbol.toStringTag]() {
-          return tag
-        }
-        toString() {
-          return `2024-01`
-        }
-      })()
-    const date = temporalLike(`Temporal.PlainDate`)
-    const month = temporalLike(`Temporal.PlainYearMonth`)
-    expect(equalHashValues(date, temporalLike(`Temporal.PlainDate`))).toBe(true)
-    expect(hash(date)).toBe(hash(temporalLike(`Temporal.PlainDate`)))
-    expect(equalHashValues(date, month)).toBe(false)
-  })
-
-  // Current behavior outside the grammar: an array from another realm takes
-  // the object marker, but equality still compares array lengths.
-  // Current behavior outside the grammar: equality compares RegExp fields
-  // with `===`, so a NaN `lastIndex` never equals itself, and `-0` equals `0`.
-  // Hashing normalizes both, so the NaN pair hashes equal.
-  it(`compares RegExp lastIndex with strict equality`, () => {
-    const withLastIndex = (lastIndex: number) =>
-      Object.assign(/a/g, { lastIndex })
-    expect(equalHashValues(withLastIndex(NaN), withLastIndex(NaN))).toBe(false)
-    expect(equalHashValues(withLastIndex(-0), withLastIndex(0))).toBe(true)
-  })
-
   it(`does not accept a second copy because the first copy matched`, () => {
     const spec: Spec = {
       k: `twice`,
@@ -1086,29 +1052,6 @@ describe(`hash identity oracle`, () => {
       expectPair({ left: spec, right: split, mutation: `split` }, [seed, seed])
   })
 
-  it(`keeps the equality length check for arrays from another realm`, () => {
-    const withHole = runInNewContext(`const a = [1]; a.length = 2; a`)
-    const short = runInNewContext(`[1]`)
-    expect(equalHashValues(withHole, short)).toBe(false)
-    expect(
-      equalHashValues(runInNewContext(`[1, 2]`), runInNewContext(`[1, 2]`)),
-    ).toBe(true)
-  })
-
-  // The colliding copy is only a useful control if its markers collide.
-  it(`gives every type marker the same hash number in the colliding module`, () => {
-    const empty = [
-      new Map(),
-      new Set(),
-      {},
-      Object.assign(new RegExp(``), { lastIndex: 0 }),
-    ]
-    const hashes = new Set(empty.map((value) => colliding.hash(value)))
-    expect(hashes.size).toBe(2) // A RegExp still hashes its header fields.
-    expect(colliding.hash(new Map())).toBe(colliding.hash(new Set()))
-    expect(colliding.hash(new Map())).toBe(colliding.hash({}))
-  })
-
   it(`keeps distinct identities separate when their digests collide`, () => {
     const pair: Pair = {
       left: { k: `map`, entries: [] },
@@ -1127,24 +1070,6 @@ describe(`hash identity oracle`, () => {
     expectPair(pair, [1, 2])
   })
 
-  it(`keeps a Map-to-Set replacement in topKBatch when markers collide`, () => {
-    const batch = collidingTopKBatch([
-      new MultiSet<[number, unknown]>([
-        [[1, new Map()], -1],
-        [[1, new Set()], 1],
-      ]),
-    ])
-    expect(
-      [...batch].map(([[, value], weight]) => [
-        value instanceof Map ? `map` : value instanceof Set ? `set` : `other`,
-        weight,
-      ]),
-    ).toEqual([
-      [`map`, -1],
-      [`set`, 1],
-    ])
-  })
-
   it(`treats shared and copied subtrees, prototypes, and hidden properties as equal`, () => {
     const spec: Spec = {
       k: `twice`,
diff --git a/packages/db-ivm/tests/hash-identity.test.ts b/packages/db-ivm/tests/hash-identity.test.ts
new file mode 100644
index 0000000000..40d2f2eb24
--- /dev/null
+++ b/packages/db-ivm/tests/hash-identity.test.ts
@@ -0,0 +1,83 @@
+// Ordinary hash identity tests: fixed Temporal-shaped, RegExp, realm, and
+// colliding-control checks. Each compares production with literal expectations
+// and reaches no declared part. hash-identity-oracle.property.test.ts owns the
+// identity law and declares its checks and model.
+import { runInNewContext } from 'node:vm'
+import { describe, expect, it } from 'vitest'
+import { MultiSet } from '../src/multiset.js'
+import { equalHashValues, hash } from '../src/hashing/hash.js'
+import { colliding, collidingTopKBatch } from './hash-collision-support.js'
+
+describe(`hash identity oracle`, () => {
+  // Real Temporal types print distinct formats, so only a polyfill-shaped
+  // value can share text across types. The contract still names the tag.
+  it(`Temporal-shaped values with the same text and different types differ`, () => {
+    const temporalLike = (tag: string) =>
+      new (class {
+        get [Symbol.toStringTag]() {
+          return tag
+        }
+        toString() {
+          return `2024-01`
+        }
+      })()
+    const date = temporalLike(`Temporal.PlainDate`)
+    const month = temporalLike(`Temporal.PlainYearMonth`)
+    expect(equalHashValues(date, temporalLike(`Temporal.PlainDate`))).toBe(true)
+    expect(hash(date)).toBe(hash(temporalLike(`Temporal.PlainDate`)))
+    expect(equalHashValues(date, month)).toBe(false)
+  })
+
+  // Current behavior outside the grammar: equality compares RegExp fields
+  // with `===`, so a NaN `lastIndex` never equals itself, and `-0` equals `0`.
+  // Hashing normalizes both, so the NaN pair hashes equal.
+  it(`compares RegExp lastIndex with strict equality`, () => {
+    const withLastIndex = (lastIndex: number) =>
+      Object.assign(/a/g, { lastIndex })
+    expect(equalHashValues(withLastIndex(NaN), withLastIndex(NaN))).toBe(false)
+    expect(equalHashValues(withLastIndex(-0), withLastIndex(0))).toBe(true)
+  })
+
+  // Current behavior outside the grammar: an array from another realm takes
+  // the object marker, but equality still compares array lengths.
+  it(`keeps the equality length check for arrays from another realm`, () => {
+    const withHole = runInNewContext(`const a = [1]; a.length = 2; a`)
+    const short = runInNewContext(`[1]`)
+    expect(equalHashValues(withHole, short)).toBe(false)
+    expect(
+      equalHashValues(runInNewContext(`[1, 2]`), runInNewContext(`[1, 2]`)),
+    ).toBe(true)
+  })
+
+  // The colliding copy is only a useful control if its markers collide.
+  it(`gives every type marker the same hash number in the colliding module`, () => {
+    const empty = [
+      new Map(),
+      new Set(),
+      {},
+      Object.assign(new RegExp(``), { lastIndex: 0 }),
+    ]
+    const hashes = new Set(empty.map((value) => colliding.hash(value)))
+    expect(hashes.size).toBe(2) // A RegExp still hashes its header fields.
+    expect(colliding.hash(new Map())).toBe(colliding.hash(new Set()))
+    expect(colliding.hash(new Map())).toBe(colliding.hash({}))
+  })
+
+  it(`keeps a Map-to-Set replacement in topKBatch when markers collide`, () => {
+    const batch = collidingTopKBatch([
+      new MultiSet<[number, unknown]>([
+        [[1, new Map()], -1],
+        [[1, new Set()], 1],
+      ]),
+    ])
+    expect(
+      [...batch].map(([[, value], weight]) => [
+        value instanceof Map ? `map` : value instanceof Set ? `set` : `other`,
+        weight,
+      ]),
+    ).toEqual([
+      [`map`, -1],
+      [`set`, 1],
+    ])
+  })
+})
diff --git a/packages/db-ivm/tests/hash-mixed-graph-oracle.property.test.ts b/packages/db-ivm/tests/hash-mixed-graph-oracle.property.test.ts
index 8125e933e6..feadf36119 100644
--- a/packages/db-ivm/tests/hash-mixed-graph-oracle.property.test.ts
+++ b/packages/db-ivm/tests/hash-mixed-graph-oracle.property.test.ts
@@ -7,6 +7,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 /**
  * Mixed-carrier graphs extend the established structural-hash graph law across
@@ -116,6 +117,17 @@ function carry(carrier: Carrier, target: unknown, symbol: symbol): unknown {
   }
 }
 
+// Model: the value that an acyclic graph denotes from node `id`. Sharing is
+// unfolded into distinct equal values, and each edge keeps its carrier.
+function unfoldGraph(graph: Graph, id: number, symbol: symbol): unknown {
+  return {
+    label: graph[id]!.label,
+    edges: graph[id]!.edges.map((edge) =>
+      carry(edge.carrier, unfoldGraph(graph, edge.target, symbol), symbol),
+    ),
+  }
+}
+
 function expectMixedGraph(
   graph: Graph,
   hashValue: (value: unknown) => number = hash,
@@ -140,15 +152,14 @@ function expectMixedGraph(
     }
     return
   }
-  const unfold = (id: number): unknown => ({
-    label: graph[id]!.label,
-    edges: graph[id]!.edges.map((edge) =>
-      carry(edge.carrier, unfold(edge.target), symbol),
-    ),
-  })
-  expect(hashValue(nodes[0])).toBe(hashValue(unfold(0)))
+  expect(hashValue(nodes[0])).toBe(hashValue(unfoldGraph(graph, 0, symbol)))
 }
 
+declareOracle({
+  check: [expectMixedGraph],
+  model: [isAcyclic, unfoldGraph],
+})
+
 function mixedGraphProperty(
   hashValue: (value: unknown) => number = hash,
   recordCheck: () => void = () => {},
diff --git a/packages/db-ivm/tests/hash-oracle.property.test.ts b/packages/db-ivm/tests/hash-oracle.property.test.ts
index a637ea9440..0c6a505ad0 100644
--- a/packages/db-ivm/tests/hash-oracle.property.test.ts
+++ b/packages/db-ivm/tests/hash-oracle.property.test.ts
@@ -6,6 +6,9 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import { expectEqualHashes } from './hash-support.js'
+import type { HashValue } from './hash-support.js'
 import type { Arbitrary } from 'fast-check'
 
 /**
@@ -45,16 +48,6 @@ const arbitrarySimpleObject = fc.dictionary(fc.string(), fc.integer(), {
 
 const arbitrarySimpleArray = fc.array(fc.integer(), { maxLength: 10 })
 
-type HashValue = (value: unknown) => number
-
-function expectEqualHashes(
-  value: unknown,
-  equivalent: unknown,
-  hashValue: HashValue = hash,
-): void {
-  expect(hashValue(value)).toBe(hashValue(equivalent))
-}
-
 // Prefixing preserves arbitrary string content while excluding integer-index
 // keys. Unique keys and at least two entries make reversal consequential.
 // Canonically equivalent spellings are distinct keys that locale collation
@@ -81,6 +74,8 @@ function expectPermutedHashes(
   expect(original).toEqual(reversed)
   expectEqualHashes(original, reversed, hashValue)
 }
+// The key-order law: permuting the keys of an object leaves its hash unchanged.
+declareOracle({ check: [expectPermutedHashes] })
 
 // The reusable value laws run with identical generators and checks in a
 // fixed campaign and a random campaign. A path replay of `ivm.hash-value`
@@ -196,23 +191,6 @@ describe(`hash property-based tests`, () => {
   })
 
   describe(`property order independence`, () => {
-    it(`hashes an array with holes and extra keys the same in any key order`, () => {
-      // Only a dense array keeps its index order unsorted; this one sorts.
-      const first = [] as unknown as Array<number> & Record<string, number>
-      first.length = 4
-      first[1] = 1
-      first[3] = 3
-      first.x = 1
-      first.y = 2
-      const second = [] as unknown as Array<number> & Record<string, number>
-      second.length = 4
-      second[1] = 1
-      second[3] = 3
-      second.y = 2
-      second.x = 1
-      expectEqualHashes(first, second)
-    })
-
     hashProp([
       fc.uniqueArray(
         fc.string().filter((s) => s !== `` && s !== `__proto__`),
@@ -349,16 +327,6 @@ describe(`hash property-based tests`, () => {
   })
 
   describe(`law checker calibration`, () => {
-    it.each([0, 42, ``, `reconstructed`])(
-      `rejects inconsistent equal-value hashes for %j`,
-      (value) => {
-        let calls = 0
-        expect(() => expectEqualHashes(value, value, () => ++calls)).toThrow()
-        expect(calls).toBe(2)
-        expectEqualHashes(value, value)
-      },
-    )
-
     it(`rejects an insertion-order-sensitive result but accepts equal structures`, () => {
       const entries: Array<[string, number]> = [
         [`key:left`, 1],
diff --git a/packages/db-ivm/tests/hash-support.ts b/packages/db-ivm/tests/hash-support.ts
new file mode 100644
index 0000000000..dbaea7324f
--- /dev/null
+++ b/packages/db-ivm/tests/hash-support.ts
@@ -0,0 +1,24 @@
+import { expect } from 'vitest'
+import { hash } from '../src/hashing/hash'
+
+// Shared by the hash law oracle and its ordinary tests. The law that
+// expectEqualHashes asserts is owned by hash-oracle.property.test.ts.
+export type HashValue = (value: unknown) => number
+
+export function expectEqualHashes(
+  value: unknown,
+  equivalent: unknown,
+  hashValue: HashValue = hash,
+): void {
+  expect(hashValue(value)).toBe(hashValue(equivalent))
+}
+
+export function expectFailureCut(
+  error: unknown,
+  reads: Array<number>,
+  expectedError: Error,
+  expectedReads: Array<number>,
+): void {
+  expect(error).toBe(expectedError)
+  expect(reads).toEqual(expectedReads)
+}
diff --git a/packages/db-ivm/tests/hash.test.ts b/packages/db-ivm/tests/hash.test.ts
new file mode 100644
index 0000000000..aadcdae285
--- /dev/null
+++ b/packages/db-ivm/tests/hash.test.ts
@@ -0,0 +1,38 @@
+// Ordinary hash tests: a key-order case with holes and extra keys, and the
+// calibration of the equal-hash assertion. hash-oracle.property.test.ts owns
+// the hash laws and declares the key-order check.
+import { describe, expect, it } from 'vitest'
+import { expectEqualHashes } from './hash-support.js'
+
+describe(`hash property-based tests`, () => {
+  describe(`property order independence`, () => {
+    it(`hashes an array with holes and extra keys the same in any key order`, () => {
+      // Only a dense array keeps its index order unsorted; this one sorts.
+      const first = [] as unknown as Array<number> & Record<string, number>
+      first.length = 4
+      first[1] = 1
+      first[3] = 3
+      first.x = 1
+      first.y = 2
+      const second = [] as unknown as Array<number> & Record<string, number>
+      second.length = 4
+      second[1] = 1
+      second[3] = 3
+      second.y = 2
+      second.x = 1
+      expectEqualHashes(first, second)
+    })
+  })
+
+  describe(`law checker calibration`, () => {
+    it.each([0, 42, ``, `reconstructed`])(
+      `rejects inconsistent equal-value hashes for %j`,
+      (value) => {
+        let calls = 0
+        expect(() => expectEqualHashes(value, value, () => ++calls)).toThrow()
+        expect(calls).toBe(2)
+        expectEqualHashes(value, value)
+      },
+    )
+  })
+})
diff --git a/packages/db-ivm/tests/incrementalization-law-oracle.property.test.ts b/packages/db-ivm/tests/incrementalization-law-oracle.property.test.ts
index d503291b6a..65f98b70c8 100644
--- a/packages/db-ivm/tests/incrementalization-law-oracle.property.test.ts
+++ b/packages/db-ivm/tests/incrementalization-law-oracle.property.test.ts
@@ -20,6 +20,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
   assertBinaryIncrementalization,
   assertUnaryIncrementalization,
@@ -540,6 +541,10 @@ const orderedHistory: fc.Arbitrary<Array<Weighted<Keyed>>> = fc
     return worlds
   })
 
+// The grammar of legal ordered histories. Its calibration test checks that the
+// generated steps reach row promotions, which the ordered laws need.
+declareOracle({ grammar: [orderedHistory] })
+
 function firstThree(input: Weighted<Keyed>): Weighted<Keyed> {
   return keyedIdentity(input)
     .sort(([[leftKey, leftRank]], [[rightKey, rightRank]]) =>
diff --git a/packages/db-ivm/tests/incrementalization-law-oracle.ts b/packages/db-ivm/tests/incrementalization-law-oracle.ts
index e30d97d00e..3cbe699bdf 100644
--- a/packages/db-ivm/tests/incrementalization-law-oracle.ts
+++ b/packages/db-ivm/tests/incrementalization-law-oracle.ts
@@ -1,4 +1,5 @@
 import { fc } from '@fast-check/vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import { D2 } from '../src/d2.js'
 import { MultiSet } from '../src/multiset.js'
 import { output } from '../src/operators/output.js'
@@ -500,3 +501,7 @@ export function assertBinaryIncrementalization<Left, Right, Output>(
     splitDeliveries: split.deliveries,
   }
 }
+
+declareOracle({
+  check: [assertUnaryIncrementalization, assertBinaryIncrementalization],
+})
diff --git a/packages/db-ivm/tests/index-refinement-oracle.property.test.ts b/packages/db-ivm/tests/index-refinement-oracle.property.test.ts
index 0901900f6f..856e22cc87 100644
--- a/packages/db-ivm/tests/index-refinement-oracle.property.test.ts
+++ b/packages/db-ivm/tests/index-refinement-oracle.property.test.ts
@@ -59,6 +59,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 type Prefix = number | string | bigint
 type Value = [Prefix, number | string] | number | string
@@ -231,6 +232,14 @@ function expectRefinement(
   }
 }
 
+// The refinement law is declared with its model, the multiset of values per
+// key, and its grammar, the generated addition histories.
+declareOracle({
+  check: [expectRefinement],
+  model: [expectedIndex],
+  grammar: [historyArbitrary],
+})
+
 // ---------------------------------------------------------------------------
 // Campaigns. The fixed and random campaigns run the same property, grammar,
 // check, and budget. A seed alone reseeds the random campaign. A path replay
diff --git a/packages/db-ivm/tests/multiset-consolidate-oracle.property.test.ts b/packages/db-ivm/tests/multiset-consolidate-oracle.property.test.ts
index 4fd317e87d..9555e9bf6e 100644
--- a/packages/db-ivm/tests/multiset-consolidate-oracle.property.test.ts
+++ b/packages/db-ivm/tests/multiset-consolidate-oracle.property.test.ts
@@ -6,6 +6,9 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import { contentsOf } from './multiset-support.js'
+import type { Data } from './multiset-support.js'
 import type { MultiSetArray } from '../src/multiset.js'
 
 /**
@@ -49,7 +52,6 @@ import type { MultiSetArray } from '../src/multiset.js'
  *   structural histories; equal objects must merge whatever the order.
  */
 
-type Data = unknown
 type Spec =
   | { kind: `prim`; i: number }
   | { kind: `obj`; i: number }
@@ -399,30 +401,6 @@ function buildRecords(history: History): MultiSetArray<Data> {
 // ---------------------------------------------------------------------------
 // Production driver and refinement check.
 
-// A tagged encoding of every record's contents. Reusing identities across
-// snapshots exposes replacement by a distinct reference with equal contents.
-// Symbol and function identities remain distinct; tags keep `-0`, `NaN`, and
-// `undefined` distinct.
-function contentsOf(
-  records: MultiSetArray<Data>,
-  ids: Map<object | symbol, number>,
-): string {
-  const encode = (value: Data): Data => {
-    if (typeof value === `symbol` || typeof value === `function`) {
-      if (!ids.has(value)) ids.set(value, ids.size)
-      return [typeof value, ids.get(value)]
-    }
-    if (value === null || typeof value !== `object`)
-      return [typeof value, Object.is(value, -0) ? `-0` : String(value)]
-    if (!ids.has(value)) ids.set(value, ids.size)
-    return [
-      ids.get(value),
-      Object.entries(value).map(([key, item]) => [key, encode(item)]),
-    ]
-  }
-  return JSON.stringify(records.map(([data, m]) => [encode(data), m]))
-}
-
 function expectRecordsConsolidated(records: MultiSetArray<Data>): void {
   const inputSnapshot = records.map(([data, m]) => [data, m] as const)
   const contentIds = new Map<object | symbol, number>()
@@ -466,6 +444,12 @@ function expectConsolidation(history: History): void {
   expectRecordsConsolidated(buildRecords(history))
 }
 
+declareOracle({
+  check: [expectRecordsConsolidated],
+  model: [expectedConsolidation],
+  grammar: [historyArb],
+})
+
 // ---------------------------------------------------------------------------
 // Campaigns. The fixed and random campaigns run the same property, grammar,
 // check, and budget. A path replay of `ivm.multiset-consolidate` runs its
@@ -478,14 +462,6 @@ const CONSOLIDATE = `ivm.multiset-consolidate`
 const it = oracleReplayTest(vitestIt)
 
 describe(`MultiSet consolidation oracle`, () => {
-  it(`detects replacement of an input value with equal contents`, () => {
-    const records: MultiSetArray<Data> = [[[0, { v: 1 }], 1]]
-    const ids = new Map<object | symbol, number>()
-    const inputContents = contentsOf(records, ids)
-    ;(records[0]![0] as [number, Data])[1] = { v: 1 }
-    expect(contentsOf(records, ids)).not.toBe(inputContents)
-  })
-
   it.each(collisionCases)(`$name`, ({ records }) =>
     expectRecordsConsolidated(records),
   )
diff --git a/packages/db-ivm/tests/multiset-consolidate.test.ts b/packages/db-ivm/tests/multiset-consolidate.test.ts
new file mode 100644
index 0000000000..fe98c20949
--- /dev/null
+++ b/packages/db-ivm/tests/multiset-consolidate.test.ts
@@ -0,0 +1,18 @@
+// Ordinary consolidation tests: the detector that a replaced input record
+// changes the contents encoding. The encoding is the oracle's own snapshot
+// machinery, so this self-test reaches no declared part.
+// multiset-consolidate-oracle.property.test.ts owns the consolidation law.
+import { describe, expect, it } from 'vitest'
+import { contentsOf } from './multiset-support.js'
+import type { Data } from './multiset-support.js'
+import type { MultiSetArray } from '../src/multiset.js'
+
+describe(`MultiSet consolidation oracle`, () => {
+  it(`detects replacement of an input value with equal contents`, () => {
+    const records: MultiSetArray<Data> = [[[0, { v: 1 }], 1]]
+    const ids = new Map<object | symbol, number>()
+    const inputContents = contentsOf(records, ids)
+    ;(records[0]![0] as [number, Data])[1] = { v: 1 }
+    expect(contentsOf(records, ids)).not.toBe(inputContents)
+  })
+})
diff --git a/packages/db-ivm/tests/multiset-support.ts b/packages/db-ivm/tests/multiset-support.ts
new file mode 100644
index 0000000000..d4778549e4
--- /dev/null
+++ b/packages/db-ivm/tests/multiset-support.ts
@@ -0,0 +1,29 @@
+// Shared by the MultiSet consolidation oracle and its ordinary tests: the
+// tagged encoding of record contents that detects a replaced input record.
+import type { MultiSetArray } from '../src/multiset.js'
+
+export type Data = unknown
+
+// A tagged encoding of every record's contents. Reusing identities across
+// snapshots exposes replacement by a distinct reference with equal contents.
+// Symbol and function identities remain distinct; tags keep `-0`, `NaN`, and
+// `undefined` distinct.
+export function contentsOf(
+  records: MultiSetArray<Data>,
+  ids: Map<object | symbol, number>,
+): string {
+  const encode = (value: Data): Data => {
+    if (typeof value === `symbol` || typeof value === `function`) {
+      if (!ids.has(value)) ids.set(value, ids.size)
+      return [typeof value, ids.get(value)]
+    }
+    if (value === null || typeof value !== `object`)
+      return [typeof value, Object.is(value, -0) ? `-0` : String(value)]
+    if (!ids.has(value)) ids.set(value, ids.size)
+    return [
+      ids.get(value),
+      Object.entries(value).map(([key, item]) => [key, encode(item)]),
+    ]
+  }
+  return JSON.stringify(records.map(([data, m]) => [encode(data), m]))
+}
diff --git a/packages/db-ivm/tests/murmur-stream-oracle.property.test.ts b/packages/db-ivm/tests/murmur-stream-oracle.property.test.ts
index 7e736c28b5..eff82ae784 100644
--- a/packages/db-ivm/tests/murmur-stream-oracle.property.test.ts
+++ b/packages/db-ivm/tests/murmur-stream-oracle.property.test.ts
@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import { fc } from '@fast-check/vitest'
 import { oracleRuns } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 /**
  * # Does the murmur stream hash the bytes it is given?
@@ -81,6 +82,17 @@ function digests(
   })
 }
 
+// The law of the byte framing: the stream digests each history as the
+// byte-at-a-time reference stream does, for every prefix.
+function expectDigestsMatchReference(
+  Stream: typeof Current,
+  Model: typeof Current,
+  chunks: Array<Chunk>,
+): void {
+  expect(digests(Stream, chunks)).toEqual(digests(Model, chunks))
+}
+declareOracle({ check: [expectDigestsMatchReference] })
+
 describe(`MurmurHashStream`, () => {
   it(`digests every chunk sequence as the byte-at-a-time stream does`, () => {
     fc.assert(
@@ -98,7 +110,7 @@ describe(`MurmurHashStream`, () => {
   ] as Array<[string, Array<Chunk>]>)(
     `digests the words that follow a block offset of %s`,
     (_, chunks) => {
-      expect(digests(Current, chunks)).toEqual(digests(Reference, chunks))
+      expectDigestsMatchReference(Current, Reference, chunks)
     },
   )
 })
diff --git a/packages/db-ivm/tests/murmur-stream-reference-oracle.ts b/packages/db-ivm/tests/murmur-stream-reference-oracle.ts
index 697400c1e0..d745ea5f50 100644
--- a/packages/db-ivm/tests/murmur-stream-reference-oracle.ts
+++ b/packages/db-ivm/tests/murmur-stream-reference-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 /**
  * Reference model for the murmur stream oracle: the stream as it was before
  * it wrote whole words, with one `writeByte` call per byte. Load it after
@@ -104,3 +105,5 @@ export class ReferenceByteStream {
     return this.hash >>> 0
   }
 }
+
+declareOracle({ model: [ReferenceByteStream] })
diff --git a/packages/db-ivm/tests/operators/topKWithFractionalIndex-oracle.test.ts b/packages/db-ivm/tests/operators/topKWithFractionalIndex-oracle.test.ts
index 38f34828cb..6bb58b09f4 100644
--- a/packages/db-ivm/tests/operators/topKWithFractionalIndex-oracle.test.ts
+++ b/packages/db-ivm/tests/operators/topKWithFractionalIndex-oracle.test.ts
@@ -6,11 +6,7 @@ import { MultiSet } from '../../src/multiset.js'
 import { topKWithFractionalIndex } from '../../src/operators/topKWithFractionalIndex.js'
 import { groupedTopKWithFractionalIndex } from '../../src/operators/groupedTopKWithFractionalIndex.js'
 import { join, map, output } from '../../src/operators/index.js'
-import {
-  MessageTracker,
-  assertOnlyKeysAffected,
-  compareFractionalIndex,
-} from '../test-utils.js'
+import { assertOnlyKeysAffected } from '../test-utils.js'
 import { oracleRuns } from '../../../db/tests/oracle-config.js'
 import { TopKMessageTracker, TopKRelation } from './topk-relation-oracle.js'
 
@@ -575,45 +571,6 @@ describe(`Operators`, () => {
       expect(updateResult.sortedResults.length).toBeGreaterThan(0) // Should have the new element
     })
 
-    it(`should ignore duplicate values`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const allMessages: Array<any> = []
-
-      input.pipe(
-        topK((a, b) => a.value.localeCompare(b.value)),
-        output((message) => {
-          allMessages.push(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have all elements with fractional indices
-      const initialResult = allMessages[0].getInner()
-      expect(initialResult.length).toBe(5)
-
-      // Now add entryForC again
-      input.sendData(new MultiSet([[[3, { id: 3, value: `c` }], 1]]))
-      graph.run()
-
-      // Check that no message was emitted
-      // since there were no changes to the topK
-      expect(allMessages.length).toBe(1)
-    })
-
     it(`should handle limit and offset correctly`, () => {
       const graph = new D2()
       const input = graph.newInput<[number, { id: number; value: string }]>()
@@ -1177,999 +1134,3 @@ describe(`Operators`, () => {
     })
   })
 })
-
-describe(`Operators`, () => {
-  describe(`TopKWithFractionalIndex operator window moves without rows`, () => {
-    // A lazy source loads rows only after a window move reports a change, so
-    // the ungrouped window must report it even after every row has left.
-    it(`reports a changed window after all rows were retracted`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { value: string }]>()
-      const messages: Array<Array<unknown>> = []
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | undefined
-
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 0,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          messages.push(message.getInner())
-        }),
-      )
-      graph.finalize()
-
-      const row = { value: `a` }
-      input.sendData(new MultiSet([[[1, row], 1]]))
-      graph.run()
-      input.sendData(new MultiSet([[[1, row], -1]]))
-      graph.run()
-      const beforeMove = messages.length
-
-      windowFn!({ offset: 2, limit: 2 })
-      graph.run()
-
-      expect(messages.slice(beforeMove)).toEqual([[]])
-    })
-  })
-
-  describe(`TopKWithFractionalIndex operator with array`, () => {
-    it(`should support moving topK window past current window using setWindowFn callback`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | undefined
-
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 3,
-          offset: 0,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have first 3 elements (a, b, c)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(3)
-      expect(initialResult.deltaCount).toBeLessThanOrEqual(6)
-
-      // Verify initial order
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`a`, `b`, `c`])
-
-      // Verify windowFn was set
-      expect(windowFn).toBeDefined()
-
-      const priorDeltaCount = tracker.getResult().deltaCount
-
-      // Move the window to show elements d, e, f (offset: 3, limit: 3)
-      windowFn!({ offset: 3, limit: 3 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show d, e, f
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`d`, `e`, `f`])
-
-      // Check that only the affected keys produce weighted deltas
-      const affectedKeys = moveResult.weightedDeltas.map(([key, _]) => key[0])
-      expect(affectedKeys.length).toBe(priorDeltaCount + 6)
-      expect(affectedKeys).toEqual(expect.arrayContaining([1, 2, 3, 4, 5, 6]))
-    })
-
-    it(`should support moving topK window before current window using setWindowFn callback`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | undefined
-
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 3,
-          offset: 3,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have first 3 elements (a, b, c)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(3)
-      expect(initialResult.deltaCount).toBeLessThanOrEqual(6)
-
-      // Verify initial order
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`d`, `e`, `f`])
-
-      // Verify windowFn was set
-      expect(windowFn).toBeDefined()
-
-      const priorDeltaCount = tracker.getResult().deltaCount
-
-      // Move the window to show elements d, e, f (offset: 3, limit: 3)
-      windowFn!({ offset: 0, limit: 3 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show d, e, f
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`a`, `b`, `c`])
-
-      // Check that only the affected keys produce weighted deltas
-      const affectedKeys = moveResult.weightedDeltas.map(([key, _]) => key[0])
-      expect(affectedKeys.length).toBe(priorDeltaCount + 6)
-      expect(affectedKeys).toEqual(expect.arrayContaining([1, 2, 3, 4, 5, 6]))
-    })
-
-    it(`should support moving offset while keeping limit constant`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 0,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have first 2 elements (a, b)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(2)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`a`, `b`])
-
-      // tracker.reset()
-
-      // Move offset to 1, keeping limit at 2 (should show b, c)
-      windowFn!({ offset: 1, limit: 2 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`b`, `c`])
-
-      // tracker.reset()
-
-      // Move offset to 2, keeping limit at 2 (should show c, d)
-      windowFn!({ offset: 2, limit: 2 })
-      graph.run()
-
-      const moveResult2 = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues2 = moveResult2.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues2).toEqual([`c`, `d`])
-
-      // Move offset back to 0, keeping limit at 2 (should show a, b)
-      windowFn!({ offset: 0, limit: 2 })
-      graph.run()
-
-      const moveResult3 = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues3 = moveResult3.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues3).toEqual([`a`, `b`])
-    })
-
-    it(`should support moving limit while keeping offset constant`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 1,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have 2 elements starting from offset 1 (b, c)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(2)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`b`, `c`])
-
-      // Increase limit to 3, keeping offset at 1 (should show b, c, d)
-      windowFn!({ offset: 1, limit: 3 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`b`, `c`, `d`])
-
-      // Decrease limit to 1, keeping offset at 1 (should show just b)
-      windowFn!({ offset: 1, limit: 1 })
-      graph.run()
-
-      const moveResult2 = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues2 = moveResult2.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues2).toEqual([`b`])
-    })
-
-    it(`should handle edge cases when moving beyond available data`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 0,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - only 3 elements: a, b, c
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have first 2 elements (a, b)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(2)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`a`, `b`])
-
-      // Move to offset 2, limit 2 (should show only c, since we only have 3 total elements)
-      windowFn!({ offset: 2, limit: 2 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`c`]) // Only 1 element available at offset 2
-
-      // Move to offset 5, limit 2 (should show no elements, beyond available data)
-      windowFn!({ offset: 5, limit: 2 })
-      graph.run()
-
-      const moveResult2 = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues2 = moveResult2.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues2).toEqual([]) // No elements available at offset 5
-
-      // Move to a negative offset and limit (should show no elements)
-      windowFn!({ offset: -5, limit: 2 })
-      graph.run()
-
-      const moveResult3 = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues3 = moveResult3.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues3).toEqual([])
-
-      // Move back to a valid window
-      windowFn!({ offset: 0, limit: 2 })
-      graph.run()
-
-      const moveResult4 = tracker.getResult(compareFractionalIndex)
-
-      const moveSortedValues4 = moveResult4.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues4).toEqual([`a`, `b`])
-    })
-
-    it(`should handle moving window from infinite limit to finite limit with same offset`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with no limit (infinite limit)
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have all 6 elements (no limit)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(6)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`a`, `b`, `c`, `d`, `e`, `f`])
-
-      // Verify windowFn was set
-      expect(windowFn).toBeDefined()
-
-      // Move to finite limit of 3 (should show a, b, c)
-      windowFn!({ offset: 0, limit: 3 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show only first 3 elements
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`a`, `b`, `c`])
-
-      // Check that we have changes (elements d, e, f should be removed)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from infinite limit to finite limit while moving offset forward`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with no limit (infinite limit)
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          offset: 0,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have all 6 elements (no limit)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(6)
-
-      // Move to offset 2, limit 3 (should show c, d, e)
-      windowFn!({ offset: 2, limit: 3 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements c, d, e
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`c`, `d`, `e`])
-
-      // Check that we have changes
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from infinite limit to finite limit while moving offset backward`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with no limit (infinite limit) and offset 3
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          offset: 3,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have elements d, e, f (no limit, offset 3)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(3)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`d`, `e`, `f`])
-
-      // Move to finite limit of 2, moving offset backward to 1 (should show b, c)
-      windowFn!({ offset: 1, limit: 2 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements b, c (offset 1, limit 2)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`b`, `c`])
-
-      // Check that we have changes (elements d, e, f should be removed, b, c should be added)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from infinite limit to infinite limit with same offset (no-op)`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with no limit (infinite limit) and offset 2
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          offset: 2,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have elements c, d, e, f (no limit, offset 2)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(4)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`c`, `d`, `e`, `f`])
-
-      // Move to same offset, still no limit (should show same elements c, d, e, f)
-      windowFn!({ offset: 2 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should show same elements c, d, e, f (offset 2, no limit)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`c`, `d`, `e`, `f`])
-
-      // Check that we have no more changes (this should be a no-op)
-      expect(moveResult.deltaCount).toBe(initialResult.deltaCount)
-    })
-
-    it(`should handle moving window from infinite limit to infinite limit while moving offset forward`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with no limit (infinite limit) and offset 0
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          offset: 0,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have all 6 elements (no limit, offset 0)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(6)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`a`, `b`, `c`, `d`, `e`, `f`])
-
-      // Move to offset 2, still no limit (should show c, d, e, f)
-      windowFn!({ offset: 2 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements c, d, e, f (offset 2, no limit)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`c`, `d`, `e`, `f`])
-
-      // Check that we have changes (elements a, b should be removed)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from infinite limit to infinite limit while moving offset backward`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with no limit (infinite limit) and offset 3
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          offset: 3,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have elements d, e, f (no limit, offset 3)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(3)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`d`, `e`, `f`])
-
-      // Move to offset 1, still no limit (should show b, c, d, e, f)
-      windowFn!({ offset: 1 })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements b, c, d, e, f (offset 1, no limit)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`b`, `c`, `d`, `e`, `f`])
-
-      // Check that we have changes (elements b, c should be added)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from finite limit to infinite limit with same offset`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with finite limit of 2 and offset 2
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 2,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have 2 elements starting from offset 2 (c, d)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(2)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`c`, `d`])
-
-      // Move to infinite limit, keeping offset 2 (should show c, d, e, f)
-      windowFn!({ offset: 2, limit: Infinity })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements c, d, e, f (offset 2, no limit)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`c`, `d`, `e`, `f`])
-
-      // Check that we have changes (elements e, f should be added)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from finite limit to infinite limit while moving offset forward`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with finite limit of 2 and offset 1
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 1,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have 2 elements starting from offset 1 (b, c)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(2)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`b`, `c`])
-
-      // Move to infinite limit, moving offset forward to 3 (should show d, e, f)
-      windowFn!({ offset: 3, limit: Infinity })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements d, e, f (offset 3, no limit)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`d`, `e`, `f`])
-
-      // Check that we have changes (elements b, c should be removed, d, e, f should be added)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-
-    it(`should handle moving window from finite limit to infinite limit while moving offset backward`, () => {
-      const graph = new D2()
-      const input = graph.newInput<[number, { id: number; value: string }]>()
-      const tracker = new MessageTracker<
-        [number, [{ id: number; value: string }, string]]
-      >()
-
-      let windowFn:
-        ((options: { offset?: number; limit?: number }) => void) | null = null
-
-      // Start with finite limit of 2 and offset 3
-      input.pipe(
-        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
-          limit: 2,
-          offset: 3,
-          setWindowFn: (fn) => {
-            windowFn = fn
-          },
-        }),
-        output((message) => {
-          tracker.addMessage(message)
-        }),
-      )
-
-      graph.finalize()
-
-      // Initial data - a, b, c, d, e, f
-      input.sendData(
-        new MultiSet([
-          [[1, { id: 1, value: `a` }], 1],
-          [[2, { id: 2, value: `b` }], 1],
-          [[3, { id: 3, value: `c` }], 1],
-          [[4, { id: 4, value: `d` }], 1],
-          [[5, { id: 5, value: `e` }], 1],
-          [[6, { id: 6, value: `f` }], 1],
-        ]),
-      )
-      graph.run()
-
-      // Initial result should have 2 elements starting from offset 3 (d, e)
-      const initialResult = tracker.getResult(compareFractionalIndex)
-      expect(initialResult.sortedResults.length).toBe(2)
-
-      const initialSortedValues = initialResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(initialSortedValues).toEqual([`d`, `e`])
-
-      // Move to infinite limit, moving offset backward to 1 (should show b, c, d, e, f)
-      windowFn!({ offset: 1, limit: Infinity })
-      graph.run()
-
-      const moveResult = tracker.getResult(compareFractionalIndex)
-
-      // Should now show elements b, c, d, e, f (offset 1, no limit)
-      const moveSortedValues = moveResult.sortedResults.map(
-        ([_key, [value, _index]]) => value.value,
-      )
-      expect(moveSortedValues).toEqual([`b`, `c`, `d`, `e`, `f`])
-
-      // Check that we have changes (elements b, c, f should be added, d, e should remain)
-      expect(moveResult.deltaCount).toBeGreaterThan(0)
-    })
-  })
-})
diff --git a/packages/db-ivm/tests/operators/topKWithFractionalIndex.test.ts b/packages/db-ivm/tests/operators/topKWithFractionalIndex.test.ts
new file mode 100644
index 0000000000..f1a7c1a617
--- /dev/null
+++ b/packages/db-ivm/tests/operators/topKWithFractionalIndex.test.ts
@@ -0,0 +1,1050 @@
+// Ordinary top-K window tests: a duplicate-value case and window moves that
+// compare emitted rows with literal expectations. Each reaches no declared part.
+// topKWithFractionalIndex-oracle.test.ts owns the signed top-K law and its checks.
+import { describe, expect, it } from 'vitest'
+import { D2 } from '../../src/d2.js'
+import { MultiSet } from '../../src/multiset.js'
+import { topKWithFractionalIndex } from '../../src/operators/topKWithFractionalIndex.js'
+import { output } from '../../src/operators/index.js'
+import { MessageTracker, compareFractionalIndex } from '../test-utils.js'
+
+describe(`Operators`, () => {
+  describe(`TopKWithFractionalIndex operator`, () => {
+    const topK = topKWithFractionalIndex
+
+    it(`should ignore duplicate values`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const allMessages: Array<any> = []
+
+      input.pipe(
+        topK((a, b) => a.value.localeCompare(b.value)),
+        output((message) => {
+          allMessages.push(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have all elements with fractional indices
+      const initialResult = allMessages[0].getInner()
+      expect(initialResult.length).toBe(5)
+
+      // Now add entryForC again
+      input.sendData(new MultiSet([[[3, { id: 3, value: `c` }], 1]]))
+      graph.run()
+
+      // Check that no message was emitted
+      // since there were no changes to the topK
+      expect(allMessages.length).toBe(1)
+    })
+  })
+})
+
+describe(`Operators`, () => {
+  describe(`TopKWithFractionalIndex operator window moves without rows`, () => {
+    // A lazy source loads rows only after a window move reports a change, so
+    // the ungrouped window must report it even after every row has left.
+    it(`reports a changed window after all rows were retracted`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { value: string }]>()
+      const messages: Array<Array<unknown>> = []
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | undefined
+
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 0,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          messages.push(message.getInner())
+        }),
+      )
+      graph.finalize()
+
+      const row = { value: `a` }
+      input.sendData(new MultiSet([[[1, row], 1]]))
+      graph.run()
+      input.sendData(new MultiSet([[[1, row], -1]]))
+      graph.run()
+      const beforeMove = messages.length
+
+      windowFn!({ offset: 2, limit: 2 })
+      graph.run()
+
+      expect(messages.slice(beforeMove)).toEqual([[]])
+    })
+  })
+
+  describe(`TopKWithFractionalIndex operator with array`, () => {
+    it(`should support moving topK window past current window using setWindowFn callback`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | undefined
+
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 3,
+          offset: 0,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have first 3 elements (a, b, c)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(3)
+      expect(initialResult.deltaCount).toBeLessThanOrEqual(6)
+
+      // Verify initial order
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`a`, `b`, `c`])
+
+      // Verify windowFn was set
+      expect(windowFn).toBeDefined()
+
+      const priorDeltaCount = tracker.getResult().deltaCount
+
+      // Move the window to show elements d, e, f (offset: 3, limit: 3)
+      windowFn!({ offset: 3, limit: 3 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show d, e, f
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`d`, `e`, `f`])
+
+      // Check that only the affected keys produce weighted deltas
+      const affectedKeys = moveResult.weightedDeltas.map(([key, _]) => key[0])
+      expect(affectedKeys.length).toBe(priorDeltaCount + 6)
+      expect(affectedKeys).toEqual(expect.arrayContaining([1, 2, 3, 4, 5, 6]))
+    })
+
+    it(`should support moving topK window before current window using setWindowFn callback`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | undefined
+
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 3,
+          offset: 3,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have first 3 elements (a, b, c)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(3)
+      expect(initialResult.deltaCount).toBeLessThanOrEqual(6)
+
+      // Verify initial order
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`d`, `e`, `f`])
+
+      // Verify windowFn was set
+      expect(windowFn).toBeDefined()
+
+      const priorDeltaCount = tracker.getResult().deltaCount
+
+      // Move the window to show elements d, e, f (offset: 3, limit: 3)
+      windowFn!({ offset: 0, limit: 3 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show d, e, f
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`a`, `b`, `c`])
+
+      // Check that only the affected keys produce weighted deltas
+      const affectedKeys = moveResult.weightedDeltas.map(([key, _]) => key[0])
+      expect(affectedKeys.length).toBe(priorDeltaCount + 6)
+      expect(affectedKeys).toEqual(expect.arrayContaining([1, 2, 3, 4, 5, 6]))
+    })
+
+    it(`should support moving offset while keeping limit constant`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 0,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have first 2 elements (a, b)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(2)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`a`, `b`])
+
+      // tracker.reset()
+
+      // Move offset to 1, keeping limit at 2 (should show b, c)
+      windowFn!({ offset: 1, limit: 2 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`b`, `c`])
+
+      // tracker.reset()
+
+      // Move offset to 2, keeping limit at 2 (should show c, d)
+      windowFn!({ offset: 2, limit: 2 })
+      graph.run()
+
+      const moveResult2 = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues2 = moveResult2.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues2).toEqual([`c`, `d`])
+
+      // Move offset back to 0, keeping limit at 2 (should show a, b)
+      windowFn!({ offset: 0, limit: 2 })
+      graph.run()
+
+      const moveResult3 = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues3 = moveResult3.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues3).toEqual([`a`, `b`])
+    })
+
+    it(`should support moving limit while keeping offset constant`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 1,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have 2 elements starting from offset 1 (b, c)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(2)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`b`, `c`])
+
+      // Increase limit to 3, keeping offset at 1 (should show b, c, d)
+      windowFn!({ offset: 1, limit: 3 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`b`, `c`, `d`])
+
+      // Decrease limit to 1, keeping offset at 1 (should show just b)
+      windowFn!({ offset: 1, limit: 1 })
+      graph.run()
+
+      const moveResult2 = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues2 = moveResult2.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues2).toEqual([`b`])
+    })
+
+    it(`should handle edge cases when moving beyond available data`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 0,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - only 3 elements: a, b, c
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have first 2 elements (a, b)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(2)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`a`, `b`])
+
+      // Move to offset 2, limit 2 (should show only c, since we only have 3 total elements)
+      windowFn!({ offset: 2, limit: 2 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`c`]) // Only 1 element available at offset 2
+
+      // Move to offset 5, limit 2 (should show no elements, beyond available data)
+      windowFn!({ offset: 5, limit: 2 })
+      graph.run()
+
+      const moveResult2 = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues2 = moveResult2.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues2).toEqual([]) // No elements available at offset 5
+
+      // Move to a negative offset and limit (should show no elements)
+      windowFn!({ offset: -5, limit: 2 })
+      graph.run()
+
+      const moveResult3 = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues3 = moveResult3.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues3).toEqual([])
+
+      // Move back to a valid window
+      windowFn!({ offset: 0, limit: 2 })
+      graph.run()
+
+      const moveResult4 = tracker.getResult(compareFractionalIndex)
+
+      const moveSortedValues4 = moveResult4.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues4).toEqual([`a`, `b`])
+    })
+
+    it(`should handle moving window from infinite limit to finite limit with same offset`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with no limit (infinite limit)
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have all 6 elements (no limit)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(6)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`a`, `b`, `c`, `d`, `e`, `f`])
+
+      // Verify windowFn was set
+      expect(windowFn).toBeDefined()
+
+      // Move to finite limit of 3 (should show a, b, c)
+      windowFn!({ offset: 0, limit: 3 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show only first 3 elements
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`a`, `b`, `c`])
+
+      // Check that we have changes (elements d, e, f should be removed)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from infinite limit to finite limit while moving offset forward`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with no limit (infinite limit)
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          offset: 0,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have all 6 elements (no limit)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(6)
+
+      // Move to offset 2, limit 3 (should show c, d, e)
+      windowFn!({ offset: 2, limit: 3 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements c, d, e
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`c`, `d`, `e`])
+
+      // Check that we have changes
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from infinite limit to finite limit while moving offset backward`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with no limit (infinite limit) and offset 3
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          offset: 3,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have elements d, e, f (no limit, offset 3)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(3)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`d`, `e`, `f`])
+
+      // Move to finite limit of 2, moving offset backward to 1 (should show b, c)
+      windowFn!({ offset: 1, limit: 2 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements b, c (offset 1, limit 2)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`b`, `c`])
+
+      // Check that we have changes (elements d, e, f should be removed, b, c should be added)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from infinite limit to infinite limit with same offset (no-op)`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with no limit (infinite limit) and offset 2
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          offset: 2,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have elements c, d, e, f (no limit, offset 2)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(4)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`c`, `d`, `e`, `f`])
+
+      // Move to same offset, still no limit (should show same elements c, d, e, f)
+      windowFn!({ offset: 2 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should show same elements c, d, e, f (offset 2, no limit)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`c`, `d`, `e`, `f`])
+
+      // Check that we have no more changes (this should be a no-op)
+      expect(moveResult.deltaCount).toBe(initialResult.deltaCount)
+    })
+
+    it(`should handle moving window from infinite limit to infinite limit while moving offset forward`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with no limit (infinite limit) and offset 0
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          offset: 0,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have all 6 elements (no limit, offset 0)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(6)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`a`, `b`, `c`, `d`, `e`, `f`])
+
+      // Move to offset 2, still no limit (should show c, d, e, f)
+      windowFn!({ offset: 2 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements c, d, e, f (offset 2, no limit)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`c`, `d`, `e`, `f`])
+
+      // Check that we have changes (elements a, b should be removed)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from infinite limit to infinite limit while moving offset backward`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with no limit (infinite limit) and offset 3
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          offset: 3,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have elements d, e, f (no limit, offset 3)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(3)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`d`, `e`, `f`])
+
+      // Move to offset 1, still no limit (should show b, c, d, e, f)
+      windowFn!({ offset: 1 })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements b, c, d, e, f (offset 1, no limit)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`b`, `c`, `d`, `e`, `f`])
+
+      // Check that we have changes (elements b, c should be added)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from finite limit to infinite limit with same offset`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with finite limit of 2 and offset 2
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 2,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have 2 elements starting from offset 2 (c, d)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(2)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`c`, `d`])
+
+      // Move to infinite limit, keeping offset 2 (should show c, d, e, f)
+      windowFn!({ offset: 2, limit: Infinity })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements c, d, e, f (offset 2, no limit)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`c`, `d`, `e`, `f`])
+
+      // Check that we have changes (elements e, f should be added)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from finite limit to infinite limit while moving offset forward`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with finite limit of 2 and offset 1
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 1,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have 2 elements starting from offset 1 (b, c)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(2)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`b`, `c`])
+
+      // Move to infinite limit, moving offset forward to 3 (should show d, e, f)
+      windowFn!({ offset: 3, limit: Infinity })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements d, e, f (offset 3, no limit)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`d`, `e`, `f`])
+
+      // Check that we have changes (elements b, c should be removed, d, e, f should be added)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+
+    it(`should handle moving window from finite limit to infinite limit while moving offset backward`, () => {
+      const graph = new D2()
+      const input = graph.newInput<[number, { id: number; value: string }]>()
+      const tracker = new MessageTracker<
+        [number, [{ id: number; value: string }, string]]
+      >()
+
+      let windowFn:
+        ((options: { offset?: number; limit?: number }) => void) | null = null
+
+      // Start with finite limit of 2 and offset 3
+      input.pipe(
+        topKWithFractionalIndex((a, b) => a.value.localeCompare(b.value), {
+          limit: 2,
+          offset: 3,
+          setWindowFn: (fn) => {
+            windowFn = fn
+          },
+        }),
+        output((message) => {
+          tracker.addMessage(message)
+        }),
+      )
+
+      graph.finalize()
+
+      // Initial data - a, b, c, d, e, f
+      input.sendData(
+        new MultiSet([
+          [[1, { id: 1, value: `a` }], 1],
+          [[2, { id: 2, value: `b` }], 1],
+          [[3, { id: 3, value: `c` }], 1],
+          [[4, { id: 4, value: `d` }], 1],
+          [[5, { id: 5, value: `e` }], 1],
+          [[6, { id: 6, value: `f` }], 1],
+        ]),
+      )
+      graph.run()
+
+      // Initial result should have 2 elements starting from offset 3 (d, e)
+      const initialResult = tracker.getResult(compareFractionalIndex)
+      expect(initialResult.sortedResults.length).toBe(2)
+
+      const initialSortedValues = initialResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(initialSortedValues).toEqual([`d`, `e`])
+
+      // Move to infinite limit, moving offset backward to 1 (should show b, c, d, e, f)
+      windowFn!({ offset: 1, limit: Infinity })
+      graph.run()
+
+      const moveResult = tracker.getResult(compareFractionalIndex)
+
+      // Should now show elements b, c, d, e, f (offset 1, no limit)
+      const moveSortedValues = moveResult.sortedResults.map(
+        ([_key, [value, _index]]) => value.value,
+      )
+      expect(moveSortedValues).toEqual([`b`, `c`, `d`, `e`, `f`])
+
+      // Check that we have changes (elements b, c, f should be added, d, e should remain)
+      expect(moveResult.deltaCount).toBeGreaterThan(0)
+    })
+  })
+})
diff --git a/packages/db-ivm/tests/operators/topk-batch-contract-oracle.test.ts b/packages/db-ivm/tests/operators/topk-batch-contract-oracle.test.ts
index 424ebd9f0e..f76b452f72 100644
--- a/packages/db-ivm/tests/operators/topk-batch-contract-oracle.test.ts
+++ b/packages/db-ivm/tests/operators/topk-batch-contract-oracle.test.ts
@@ -237,36 +237,6 @@ it.each(
   },
 )
 
-it.each([
-  { name: `RegExp source`, before: /old/g, after: /new/g },
-  { name: `RegExp flags`, before: /same/g, after: /same/i },
-  {
-    name: `RegExp position`,
-    before: Object.assign(/same/g, { lastIndex: 0 }),
-    after: Object.assign(/same/g, { lastIndex: 1 }),
-  },
-  { name: `sparse-array length`, before: [], after: Array(2) },
-])(
-  `keeps a $name replacement through hash consolidation`,
-  ({ before, after }) => {
-    // Relation: a retraction and a distinct addition must remain observable to
-    // an ordered operator even when an earlier stage consolidates the batch.
-    const previous = { id: 1, value: before }
-    const next = { id: 1, value: after }
-    expect(
-      new MultiSet([
-        [previous, -1],
-        [next, 1],
-      ])
-        .consolidate()
-        .getInner(),
-    ).toEqual([
-      [previous, -1],
-      [next, 1],
-    ])
-  },
-)
-
 it.each([true, false])(
   `replaces ordinary rows with File available=%s`,
   (available) => {
@@ -310,16 +280,6 @@ it.each([true, false])(
   },
 )
 
-it(`keeps distinct row keys when structural hashes collide`, () => {
-  // A hash is an accelerator, never proof that two keyed rows are equal.
-  vi.spyOn(hashing, `hash`).mockReturnValue(7)
-  const batch = new MultiSet<[string | number, { id: number }]>([
-    [[1, { id: 1 }], 1],
-    [[`1`, { id: 2 }], 1],
-  ])
-  expect([...topKBatch([batch])]).toEqual(batch.getInner())
-})
-
 it(`compares shared subtrees without expanding every path`, () => {
   vi.spyOn(hashing, `hash`).mockReturnValue(7)
   fc.assert(
@@ -351,28 +311,6 @@ it(`compares shared subtrees without expanding every path`, () => {
   )
 })
 
-it(`does not inspect payloads when each key occurs once`, () => {
-  let reads = 0
-  const rows = Array.from({ length: 100 }, (_, id) => ({
-    id,
-    get unused() {
-      reads++
-      return id
-    },
-  }))
-  const batch = new MultiSet<[number, (typeof rows)[number]]>(
-    rows.map((row) => [[row.id, row], 1]),
-  )
-  const actual = [...topKBatch([batch])]
-  expect(reads).toBe(0)
-  expect(actual).toHaveLength(rows.length)
-  for (const [index, [[key, row], weight]] of actual.entries()) {
-    expect(key).toBe(index)
-    expect(row).toBe(rows[index])
-    expect(weight).toBe(1)
-  }
-})
-
 it(`short-circuits replacements without hashing unrelated payloads`, () => {
   fc.assert(
     fc.property(fc.integer({ min: 1, max: 100 }), (count) => {
@@ -409,77 +347,3 @@ it(`cancels long same-key histories with independently allocated values`, () =>
     { seed: 409037, numRuns: 25 },
   )
 })
-
-it.each([TypeError, RangeError])(
-  `does not swallow user %s exceptions while bucketing`,
-  (ErrorType) => {
-    const error = new ErrorType(`Cannot hash cyclic structural values`)
-    const row = {
-      get value(): number {
-        throw error
-      },
-    }
-    let observed: unknown
-    try {
-      Array.from(
-        topKBatch([
-          new MultiSet<[number, object]>([
-            [[1, row], 1],
-            [[1, row], -1],
-            [[1, { value: 2 }], 1],
-          ]),
-        ]),
-      )
-    } catch (caught) {
-      observed = caught
-    }
-    expect(observed).toBe(error)
-  },
-)
-
-it.each([`plain cycle`, `class cycle`, `large payload`] as const)(
-  `orders a unique key without imposing a structural hash domain: %s`,
-  (kind) => {
-    class Row {
-      id = 1
-      payload: unknown
-    }
-    const row =
-      kind === `class cycle`
-        ? new Row()
-        : { id: 1, payload: undefined as unknown }
-    row.payload = kind === `large payload` ? new Array(1_000_001).fill(0) : row
-    const entries = [
-      ...topKBatch([new MultiSet<[number, typeof row]>([[[1, row], 1]])]),
-    ]
-    expect(entries).toHaveLength(1)
-    expect(entries[0]![0][1]).toBe(row)
-    expect(entries[0]![1]).toBe(1)
-    const graph = new D2()
-    const input = graph.newInput<[number, typeof row]>()
-    const observed: Array<[[number, [typeof row, string]], number]> = []
-    input.pipe(
-      topKWithFractionalIndex((a, b) => a.id - b.id, { limit: 1 }),
-      output((message) => observed.push(...message.getInner())),
-    )
-    graph.finalize()
-    input.sendData(new MultiSet([[[1, row], 1]]))
-    graph.run()
-    expect(observed).toHaveLength(1)
-    expect(observed[0]![0][1][0]).toBe(row)
-    expect(observed[0]![1]).toBe(1)
-  },
-)
-
-it(`consolidates structurally equal fresh transient values before replacements`, () => {
-  const batch = new MultiSet<[number, { value: string }]>([
-    [[1, { value: `new` }], 1],
-    [[1, { value: `temporary` }], 1],
-    [[1, { value: `old` }], -1],
-    [[1, { value: `temporary` }], -1],
-  ])
-  expect([...topKBatch([batch])]).toEqual([
-    [[1, { value: `old` }], -1],
-    [[1, { value: `new` }], 1],
-  ])
-})
diff --git a/packages/db-ivm/tests/operators/topk-batch.test.ts b/packages/db-ivm/tests/operators/topk-batch.test.ts
new file mode 100644
index 0000000000..c88e4e239b
--- /dev/null
+++ b/packages/db-ivm/tests/operators/topk-batch.test.ts
@@ -0,0 +1,149 @@
+// Ordinary top-K batch tests: fixed replacements, collisions, and payload
+// access, plus exception propagation. Each compares production with literal
+// or input-derived expectations and reaches no declared part.
+// topk-batch-contract-oracle.test.ts owns the cancellation and replacement law.
+import { afterEach, expect, it, vi } from 'vitest'
+import { MultiSet } from '../../src/multiset.js'
+import * as hashing from '../../src/hashing/index.js'
+import { topKBatch } from '../../src/operators/topKState.js'
+import { D2 } from '../../src/d2.js'
+import { topKWithFractionalIndex } from '../../src/operators/topKWithFractionalIndex.js'
+import { output } from '../../src/operators/index.js'
+
+afterEach(() => vi.restoreAllMocks())
+
+it.each([
+  { name: `RegExp source`, before: /old/g, after: /new/g },
+  { name: `RegExp flags`, before: /same/g, after: /same/i },
+  {
+    name: `RegExp position`,
+    before: Object.assign(/same/g, { lastIndex: 0 }),
+    after: Object.assign(/same/g, { lastIndex: 1 }),
+  },
+  { name: `sparse-array length`, before: [], after: Array(2) },
+])(
+  `keeps a $name replacement through hash consolidation`,
+  ({ before, after }) => {
+    // Relation: a retraction and a distinct addition must remain observable to
+    // an ordered operator even when an earlier stage consolidates the batch.
+    const previous = { id: 1, value: before }
+    const next = { id: 1, value: after }
+    expect(
+      new MultiSet([
+        [previous, -1],
+        [next, 1],
+      ])
+        .consolidate()
+        .getInner(),
+    ).toEqual([
+      [previous, -1],
+      [next, 1],
+    ])
+  },
+)
+
+it(`keeps distinct row keys when structural hashes collide`, () => {
+  // A hash is an accelerator, never proof that two keyed rows are equal.
+  vi.spyOn(hashing, `hash`).mockReturnValue(7)
+  const batch = new MultiSet<[string | number, { id: number }]>([
+    [[1, { id: 1 }], 1],
+    [[`1`, { id: 2 }], 1],
+  ])
+  expect([...topKBatch([batch])]).toEqual(batch.getInner())
+})
+
+it(`does not inspect payloads when each key occurs once`, () => {
+  let reads = 0
+  const rows = Array.from({ length: 100 }, (_, id) => ({
+    id,
+    get unused() {
+      reads++
+      return id
+    },
+  }))
+  const batch = new MultiSet<[number, (typeof rows)[number]]>(
+    rows.map((row) => [[row.id, row], 1]),
+  )
+  const actual = [...topKBatch([batch])]
+  expect(reads).toBe(0)
+  expect(actual).toHaveLength(rows.length)
+  for (const [index, [[key, row], weight]] of actual.entries()) {
+    expect(key).toBe(index)
+    expect(row).toBe(rows[index])
+    expect(weight).toBe(1)
+  }
+})
+
+it.each([TypeError, RangeError])(
+  `does not swallow user %s exceptions while bucketing`,
+  (ErrorType) => {
+    const error = new ErrorType(`Cannot hash cyclic structural values`)
+    const row = {
+      get value(): number {
+        throw error
+      },
+    }
+    let observed: unknown
+    try {
+      Array.from(
+        topKBatch([
+          new MultiSet<[number, object]>([
+            [[1, row], 1],
+            [[1, row], -1],
+            [[1, { value: 2 }], 1],
+          ]),
+        ]),
+      )
+    } catch (caught) {
+      observed = caught
+    }
+    expect(observed).toBe(error)
+  },
+)
+
+it.each([`plain cycle`, `class cycle`, `large payload`] as const)(
+  `orders a unique key without imposing a structural hash domain: %s`,
+  (kind) => {
+    class Row {
+      id = 1
+      payload: unknown
+    }
+    const row =
+      kind === `class cycle`
+        ? new Row()
+        : { id: 1, payload: undefined as unknown }
+    row.payload = kind === `large payload` ? new Array(1_000_001).fill(0) : row
+    const entries = [
+      ...topKBatch([new MultiSet<[number, typeof row]>([[[1, row], 1]])]),
+    ]
+    expect(entries).toHaveLength(1)
+    expect(entries[0]![0][1]).toBe(row)
+    expect(entries[0]![1]).toBe(1)
+    const graph = new D2()
+    const input = graph.newInput<[number, typeof row]>()
+    const observed: Array<[[number, [typeof row, string]], number]> = []
+    input.pipe(
+      topKWithFractionalIndex((a, b) => a.id - b.id, { limit: 1 }),
+      output((message) => observed.push(...message.getInner())),
+    )
+    graph.finalize()
+    input.sendData(new MultiSet([[[1, row], 1]]))
+    graph.run()
+    expect(observed).toHaveLength(1)
+    expect(observed[0]![0][1][0]).toBe(row)
+    expect(observed[0]![1]).toBe(1)
+  },
+)
+
+it(`consolidates structurally equal fresh transient values before replacements`, () => {
+  const batch = new MultiSet<[number, { value: string }]>([
+    [[1, { value: `new` }], 1],
+    [[1, { value: `temporary` }], 1],
+    [[1, { value: `old` }], -1],
+    [[1, { value: `temporary` }], -1],
+  ])
+  expect([...topKBatch([batch])]).toEqual([
+    [[1, { value: `old` }], -1],
+    [[1, { value: `new` }], 1],
+  ])
+})
diff --git a/packages/db-ivm/tests/operators/topk-relation-oracle.test.ts b/packages/db-ivm/tests/operators/topk-relation-oracle.test.ts
index 6698847b79..bbd53dcf5c 100644
--- a/packages/db-ivm/tests/operators/topk-relation-oracle.test.ts
+++ b/packages/db-ivm/tests/operators/topk-relation-oracle.test.ts
@@ -1,7 +1,10 @@
 import { describe, expect, it } from 'vitest'
 import fc from 'fast-check'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import { TopKRelation } from './topk-relation-oracle.js'
 
+declareOracle({ check: [TopKRelation] })
+
 /**
  * # How do we know the top-K oracle can detect a fault?
  *
diff --git a/packages/db-ivm/tests/operators/topk-relation-oracle.ts b/packages/db-ivm/tests/operators/topk-relation-oracle.ts
index df51cdfcb9..a8e176a630 100644
--- a/packages/db-ivm/tests/operators/topk-relation-oracle.ts
+++ b/packages/db-ivm/tests/operators/topk-relation-oracle.ts
@@ -1,4 +1,5 @@
 import { expect } from 'vitest'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import { MessageTracker } from '../test-utils.js'
 import type { MultiSet } from '../../src/multiset.js'
 
@@ -74,3 +75,5 @@ export class TopKMessageTracker<
     super.addMessage(message)
   }
 }
+
+declareOracle({ check: [TopKRelation] })
diff --git a/packages/db-ivm/tests/operators/topk-support-window-oracle.test.ts b/packages/db-ivm/tests/operators/topk-support-window-oracle.test.ts
index 9e2726bf79..042a9aa684 100644
--- a/packages/db-ivm/tests/operators/topk-support-window-oracle.test.ts
+++ b/packages/db-ivm/tests/operators/topk-support-window-oracle.test.ts
@@ -10,8 +10,11 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../../db/tests/oracle-config.js'
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
 import { TopKRelation } from './topk-relation-oracle.js'
 
+declareOracle({ check: [TopKRelation] })
+
 /**
  * A top-K window selects support from a signed, typed-key relation.
  *
diff --git a/packages/db-ivm/tests/structural-identity-oracle.property.test.ts b/packages/db-ivm/tests/structural-identity-oracle.property.test.ts
index 334c4a2508..c901793348 100644
--- a/packages/db-ivm/tests/structural-identity-oracle.property.test.ts
+++ b/packages/db-ivm/tests/structural-identity-oracle.property.test.ts
@@ -5,6 +5,7 @@ import {
   oraclePropertyOptions,
   readOracleRunConfig,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 /**
  * # Does a structural identity agree with D2 value identity?
@@ -38,9 +39,9 @@ import {
  * `lastIndex`, Maps and Sets with zero to two entries, arrays with an
  * enumerable non-index field, small binary values, holes, and nesting deeper
  * than the identity's depth cap.
- * Pinned pairs cover joins a random short string cannot build, distinct
- * symbols with the same description, and different object kinds with the same
- * body. Fixed representation witnesses verify that the driver reaches each
+ * Pinned pairs cover distinct symbols with the same description, and different
+ * object kinds with the same body. Hand-written collision pairs are ordinary
+ * tests in structural-identity.test.ts. Fixed representation witnesses verify that the driver reaches each
  * prototype, key-order, and hidden-symbol variant it claims. The depth cap
  * bounds work and recursion, including on a cyclic value;
  * it does not decide equality, so raising it changes no law here.
@@ -366,15 +367,7 @@ function expectAgreement(
     expect(equal, `a shared identity: ${leftIdentity}`).toBe(true)
 }
 
-// Different values whose parts, read without lengths, join to the same text.
-// A random four-character string never embeds a whole later part, so these
-// pairs pin the cases that a missing length prefix would merge.
-const collisionPairs: Array<[string, unknown, unknown]> = [
-  [`string spans a later key`, { a: `x|1:b="y` }, { a: `x`, b: `y` }],
-  [`key spans a later key`, { [`a="1:x|b`]: `y` }, { a: `x`, b: `y` }],
-  [`string spans a later element`, [`x|1:1="y`, ``], [`x`, `y`]],
-  [`header spans the body`, [`#1`], [1]],
-]
+declareOracle({ check: [expectAgreement], model: [normal] })
 
 function decisions(...values: Array<boolean>): () => boolean {
   let index = 0
@@ -418,22 +411,6 @@ describe(`structuralIdentity`, () => {
     expectAgreement(spec, spec, plain, nullPrototype)
   })
 
-  it.each(collisionPairs)(
-    `gives different values different identities: %s`,
-    (_, left, right) => {
-      expect(equalHashValues(left, right)).toBe(false)
-      const leftIdentity = structuralIdentity(left)
-      expect(leftIdentity).toBeDefined()
-      expect(leftIdentity).not.toBe(structuralIdentity(right))
-    },
-  )
-
-  it(`returns no identity for a cyclic value`, () => {
-    const cyclic: Record<string, unknown> = {}
-    cyclic.self = cyclic
-    expect(structuralIdentity(cyclic)).toBeUndefined()
-  })
-
   it(`agrees with D2 value identity for equal representations`, async () => {
     if (
       replayProperty !== undefined &&
diff --git a/packages/db-ivm/tests/structural-identity.test.ts b/packages/db-ivm/tests/structural-identity.test.ts
new file mode 100644
index 0000000000..ccc03ad3ef
--- /dev/null
+++ b/packages/db-ivm/tests/structural-identity.test.ts
@@ -0,0 +1,34 @@
+// Ordinary structural-identity tests: hand-written collision pairs that a
+// missing length prefix would merge, and a cyclic value with no identity. Both
+// compare production with fixed expectations. structural-identity-oracle.property.test.ts
+// owns the identity law (agreement with D2 value identity) and its checks.
+import { describe, expect, it } from 'vitest'
+import { equalHashValues, structuralIdentity } from '../src/hashing/hash.js'
+
+// Different values whose parts, read without lengths, join to the same text.
+// A random four-character string never embeds a whole later part, so these
+// pairs pin the cases that a missing length prefix would merge.
+const collisionPairs: Array<[string, unknown, unknown]> = [
+  [`string spans a later key`, { a: `x|1:b="y` }, { a: `x`, b: `y` }],
+  [`key spans a later key`, { [`a="1:x|b`]: `y` }, { a: `x`, b: `y` }],
+  [`string spans a later element`, [`x|1:1="y`, ``], [`x`, `y`]],
+  [`header spans the body`, [`#1`], [1]],
+]
+
+describe(`structuralIdentity`, () => {
+  it.each(collisionPairs)(
+    `gives different values different identities: %s`,
+    (_, left, right) => {
+      expect(equalHashValues(left, right)).toBe(false)
+      const leftIdentity = structuralIdentity(left)
+      expect(leftIdentity).toBeDefined()
+      expect(leftIdentity).not.toBe(structuralIdentity(right))
+    },
+  )
+
+  it(`returns no identity for a cyclic value`, () => {
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+    expect(structuralIdentity(cyclic)).toBeUndefined()
+  })
+})
diff --git a/packages/db-ivm/tests/temporal-group-key-oracle.test.ts b/packages/db-ivm/tests/temporal-group-key-oracle.test.ts
index 9af0e49197..5bb5b1e490 100644
--- a/packages/db-ivm/tests/temporal-group-key-oracle.test.ts
+++ b/packages/db-ivm/tests/temporal-group-key-oracle.test.ts
@@ -8,6 +8,7 @@ import {
   output,
   serializeValue,
 } from '../src/index.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 /**
  * Temporal values are valid db-ivm group keys. The established hash key domain
@@ -67,6 +68,8 @@ const temporalCases = [
   },
 ] as const
 
+// The model: each identity class is one group, so its size is the number of
+// values that the fixture labels with that class.
 function expectedGroupCounts(classes: ReadonlyArray<string>): Array<number> {
   const counts = new Map<string, number>()
   for (const group of classes) {
@@ -74,6 +77,7 @@ function expectedGroupCounts(classes: ReadonlyArray<string>): Array<number> {
   }
   return [...counts.values()].sort((left, right) => left - right)
 }
+declareOracle({ model: [expectedGroupCounts] })
 
 function observedGroupCounts(rows: Array<{ date: object }>): Array<number> {
   const graph = new D2()
@@ -139,23 +143,6 @@ describe('Temporal group keys', () => {
     )
   })
 
-  it('keeps a Temporal value distinct from an empty object', () => {
-    const date = Temporal.PlainDate.from('2024-01-15')
-    const anotherDate = Temporal.PlainDate.from('2024-06-15')
-    expect(serializeValue(date)).not.toBe(serializeValue({}))
-    expect(serializeValue(date)).not.toBe(serializeValue(date.toString()))
-    expect(serializeValue({ date })).not.toBe(serializeValue({ date: {} }))
-    expect(serializeValue({ dates: [date] })).not.toBe(
-      serializeValue({ dates: [anotherDate] }),
-    )
-    expect(serializeValue(new Map([['date', date]]))).not.toBe(
-      serializeValue(new Map([['date', anotherDate]])),
-    )
-    expect(serializeValue(new Set([date]))).not.toBe(
-      serializeValue(new Set([anotherDate])),
-    )
-  })
-
   it('keeps a plain object with a Temporal tag distinct from a Temporal value', () => {
     const date = Temporal.PlainDate.from('2024-01-15')
     const taggedObject = {
diff --git a/packages/db-ivm/tests/temporal-group-key.test.ts b/packages/db-ivm/tests/temporal-group-key.test.ts
new file mode 100644
index 0000000000..055044ca8f
--- /dev/null
+++ b/packages/db-ivm/tests/temporal-group-key.test.ts
@@ -0,0 +1,25 @@
+import { Temporal } from 'temporal-polyfill'
+import { describe, expect, it } from 'vitest'
+import { serializeValue } from '../src/index.js'
+
+// Ordinary tests for Temporal group keys: serialized identity of Temporal
+// values inside plain objects, arrays, Maps, and Sets. The grouping law
+// belongs to temporal-group-key-oracle.test.ts.
+describe('Temporal group keys', () => {
+  it('keeps a Temporal value distinct from an empty object', () => {
+    const date = Temporal.PlainDate.from('2024-01-15')
+    const anotherDate = Temporal.PlainDate.from('2024-06-15')
+    expect(serializeValue(date)).not.toBe(serializeValue({}))
+    expect(serializeValue(date)).not.toBe(serializeValue(date.toString()))
+    expect(serializeValue({ date })).not.toBe(serializeValue({ date: {} }))
+    expect(serializeValue({ dates: [date] })).not.toBe(
+      serializeValue({ dates: [anotherDate] }),
+    )
+    expect(serializeValue(new Map([['date', date]]))).not.toBe(
+      serializeValue(new Map([['date', anotherDate]])),
+    )
+    expect(serializeValue(new Set([date]))).not.toBe(
+      serializeValue(new Set([anotherDate])),
+    )
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/collection-setup-reopen-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/collection-setup-reopen-oracle.test.ts
index b2e8b3b178..cfba613d5b 100644
--- a/packages/db-sqlite-persistence-core/tests/collection-setup-reopen-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/collection-setup-reopen-oracle.test.ts
@@ -1,6 +1,7 @@
 import { DatabaseSync } from 'node:sqlite'
 import { describe, expect, it } from 'vitest'
 import { SQLiteCorePersistenceAdapter, createPersistedTableName } from '../src'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import type { PersistedTx, SQLiteDriver } from '../src'
 
 /**
@@ -379,6 +380,8 @@ function workLawApplies(start: Start): boolean {
   return start.absent.length === 0 && start.reopenSchemaVersion === undefined
 }
 
+declareOracle({ model: [modelSchemaObjects] })
+
 describe(`collection setup reopen oracle`, () => {
   it(`repairs every legal starting state to a fresh install and skips complete setup`, async () => {
     const expectedSchema = await freshInstallSchema()
diff --git a/packages/db-sqlite-persistence-core/tests/contracts/persisted-collection-conformance-contract.ts b/packages/db-sqlite-persistence-core/tests/contracts/persisted-collection-conformance-contract.ts
index 31f019acee..f79b33face 100644
--- a/packages/db-sqlite-persistence-core/tests/contracts/persisted-collection-conformance-contract.ts
+++ b/packages/db-sqlite-persistence-core/tests/contracts/persisted-collection-conformance-contract.ts
@@ -2,6 +2,7 @@ import { describe } from 'vitest'
 import { createCollationTestSuite } from '../../../db-collection-e2e/src/suites/collation.suite'
 import { createDeduplicationTestSuite } from '../../../db-collection-e2e/src/suites/deduplication.suite'
 import { createJoinsTestSuite } from '../../../db-collection-e2e/src/suites/joins-oracle.suite'
+import { createLiveUpdatesUnitTestSuite } from '../../../db-collection-e2e/src/suites/live-updates.suite'
 import { createLiveUpdatesTestSuite } from '../../../db-collection-e2e/src/suites/live-updates-oracle.suite'
 import { createMutationsTestSuite } from '../../../db-collection-e2e/src/suites/mutations.suite'
 import { createPaginationTestSuite } from '../../../db-collection-e2e/src/suites/pagination-oracle.suite'
@@ -64,6 +65,7 @@ export function runPersistedCollectionConformanceSuite(
       createMutationsTestSuite(getConfig)
     }
     if (includeLiveUpdates) {
+      createLiveUpdatesUnitTestSuite(getConfig)
       createLiveUpdatesTestSuite(getConfig)
     }
   })
diff --git a/packages/db-sqlite-persistence-core/tests/contracts/sqlite-core-adapter-contract.ts b/packages/db-sqlite-persistence-core/tests/contracts/sqlite-core-adapter-contract.ts
index 6fd445f37f..6d4bfa69ba 100644
--- a/packages/db-sqlite-persistence-core/tests/contracts/sqlite-core-adapter-contract.ts
+++ b/packages/db-sqlite-persistence-core/tests/contracts/sqlite-core-adapter-contract.ts
@@ -1,4 +1,2 @@
-export {
-  runSQLiteCoreAdapterContractSuite,
-  type SQLiteCoreAdapterHarnessFactory,
-} from '../sqlite-core-adapter-oracle.test'
+export { runSQLiteCoreAdapterContractSuite } from '../sqlite-core-adapter-contract-suite'
+export type { SQLiteCoreAdapterHarnessFactory } from '../sqlite-core-adapter-support'
diff --git a/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-oracle.ts b/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-oracle.ts
index 16d5ff3a18..21ea4caf2a 100644
--- a/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-oracle.ts
+++ b/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-oracle.ts
@@ -1,32 +1,32 @@
-import { DatabaseSync } from 'node:sqlite'
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { describe, expect, it, vi } from 'vitest'
 import { oraclePropertyOptions, oracleRuns } from '../../db/tests/oracle-config'
-import { SQLiteCorePersistenceAdapter, createPersistedTableName } from '../src'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import { createPersistedTableName } from '../src'
 import {
   Temporal,
   observeTemporal,
   temporalFamilies,
   temporalValue,
 } from './temporal-value-oracle'
-import type { PersistedTx, SQLiteDriver } from '../src'
-
-type Row = Record<
-  string,
-  string | number | Temporal.Instant | Temporal.PlainDate
->
-type Tx = PersistedTx<Row, string>
-type SnapshotRow = { key: string; value: Row; metadata?: unknown }
-type Tombstone = { key: string; value: Row; rowVersion: number }
-type Observation = {
-  rows: Array<SnapshotRow>
-  collectionMetadata: Array<{ key: string; value: unknown }>
-  keySet: unknown
-  expectedKeys: Array<string>
-  tombstones: Array<Tombstone>
-  position: { term: number; seq: number; rowVersion: number }
-  applied: Array<{ txId: string; rowVersion: number }>
-}
+import {
+  beginMeasuredWrite,
+  clone,
+  finishMeasuredWrite,
+  fixture,
+  insertRows,
+  observe,
+  sortRows,
+  sortedKeys,
+  transaction,
+} from './ordinary-transaction-work-support'
+import type {
+  Observation,
+  Row,
+  Tombstone,
+  Tx,
+  WriteCounts,
+} from './ordinary-transaction-work-support'
 
 /**
  * # Can an ordinary committed SQLite transaction persist many rows in bounded work?
@@ -103,27 +103,6 @@ type Observation = {
  * write work and does not replace driver admission or host receiving witnesses.
  */
 
-function clone<T>(value: T): T {
-  // Native Temporal values are immutable. structuredClone erases their slots.
-  if (value instanceof Temporal.Instant || value instanceof Temporal.PlainDate)
-    return value
-  if (Array.isArray(value)) return value.map(clone) as T
-  if (value !== null && typeof value === `object`) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [key, clone(entry)]),
-    ) as T
-  }
-  return value
-}
-
-function sortedKeys(values: Iterable<string>): Array<string> {
-  return [...values].sort()
-}
-
-function sortRows(rows: Array<SnapshotRow>): Array<SnapshotRow> {
-  return [...rows].sort((a, b) => a.key.localeCompare(b.key))
-}
-
 // The model replays semantic actions from their contract, never from SQL.
 function modelAfter(history: ReadonlyArray<Tx>): Observation {
   const rows = new Map<string, { value: Row; metadata?: unknown }>()
@@ -190,223 +169,6 @@ function modelAfter(history: ReadonlyArray<Tx>): Observation {
   }
 }
 
-type Fixture = {
-  adapter: SQLiteCorePersistenceAdapter
-  driver: SQLiteDriver
-  counts: {
-    query: number
-    run: number
-    transactions: number
-    maxParams: number
-  }
-  failAfterRowWriteCount: (count: number | undefined) => void
-  failRunMatching: (pattern: RegExp | undefined) => void
-  corruptRowMetadata: (enabled: boolean) => void
-  close: () => void
-}
-
-function binding(value: unknown): string | number | bigint | null {
-  if (value == null) return null
-  if (typeof value === 'boolean') return value ? 1 : 0
-  if (
-    typeof value === 'string' ||
-    typeof value === 'number' ||
-    typeof value === 'bigint'
-  )
-    return value
-  return String(value)
-}
-
-function fixture(maxBoundParameters: number): Fixture {
-  const database = new DatabaseSync(':memory:')
-  const counts = { query: 0, run: 0, transactions: 0, maxParams: 0 }
-  let failAfter: number | undefined
-  let rowWriteCount = 0
-  let failRunPattern: RegExp | undefined
-  let corruptMetadata = false
-  const rowWritePattern =
-    /INSERT INTO "c_[^"]+" \(key, value, metadata, row_version\)/
-  const checkParams = (params: ReadonlyArray<unknown>) => {
-    counts.maxParams = Math.max(counts.maxParams, params.length)
-    if (params.length > maxBoundParameters) {
-      throw new Error(
-        `binding cap ${maxBoundParameters} exceeded: ${params.length}`,
-      )
-    }
-  }
-  const driver: SQLiteDriver = {
-    maxBoundParameters,
-    exec: async (sql) => {
-      database.exec(sql)
-    },
-    query: async <T>(sql: string, params: ReadonlyArray<unknown> = []) => {
-      counts.query++
-      checkParams(params)
-      return database
-        .prepare(sql)
-        .all(...params.map(binding))
-        .map((row) => ({ ...row })) as Array<T>
-    },
-    run: async (sql, params = []) => {
-      counts.run++
-      checkParams(params)
-      if (rowWritePattern.test(sql)) {
-        rowWriteCount += params.length / 4
-        if (failAfter !== undefined && rowWriteCount > failAfter) {
-          throw new Error('injected later row-write failure')
-        }
-      }
-      if (failRunPattern?.test(sql))
-        throw new Error('injected late bookkeeping failure')
-      const actualParams =
-        corruptMetadata && rowWritePattern.test(sql)
-          ? params.map((param, index) => (index % 4 === 2 ? null : param))
-          : params
-      database.prepare(sql).run(...actualParams.map(binding))
-    },
-    transaction: async <T>(fn: (tx: SQLiteDriver) => Promise<T>) => {
-      counts.transactions++
-      database.exec('BEGIN IMMEDIATE')
-      try {
-        const result = await fn(driver)
-        database.exec('COMMIT')
-        return result
-      } catch (error) {
-        database.exec('ROLLBACK')
-        throw error
-      }
-    },
-  }
-  return {
-    adapter: new SQLiteCorePersistenceAdapter({ driver }),
-    driver,
-    counts,
-    failAfterRowWriteCount: (count) => {
-      failAfter = count
-      rowWriteCount = 0
-    },
-    failRunMatching: (pattern) => {
-      failRunPattern = pattern
-    },
-    corruptRowMetadata: (enabled) => {
-      corruptMetadata = enabled
-    },
-    close: () => database.close(),
-  }
-}
-
-type WriteCounts = Readonly<Fixture['counts']>
-
-function beginMeasuredWrite(host: Fixture): void {
-  host.counts.query = 0
-  host.counts.run = 0
-  host.counts.transactions = 0
-  host.counts.maxParams = 0
-}
-
-function finishMeasuredWrite(
-  host: Fixture,
-  checkpoint: string,
-  extraTransactions = 0,
-): WriteCounts {
-  // The optional increment is a checker control, never a production path.
-  host.counts.transactions += extraTransactions
-  const counts = { ...host.counts }
-  expect(counts.transactions, `${checkpoint}: one SQLite transaction`).toBe(1)
-  return counts
-}
-
-function publicKey(encoded: string): string {
-  if (!encoded.startsWith('s:'))
-    throw new Error(`unexpected raw key ${encoded}`)
-  return encoded.slice(2)
-}
-
-async function observe(
-  adapter: SQLiteCorePersistenceAdapter,
-  driver: SQLiteDriver,
-  collectionId: string,
-): Promise<Observation> {
-  const snapshot = await adapter.loadResumeSnapshot({
-    kind: `eager`,
-    collectionId: collectionId,
-  })
-  const table = createPersistedTableName(collectionId, 't')
-  const [expected, tombstones, applied] = await Promise.all([
-    driver.query<{ key: string }>(
-      'SELECT key FROM collection_expected_keys WHERE collection_id = ? ORDER BY key',
-      [collectionId],
-    ),
-    driver.query<{ key: string; value: string; row_version: number }>(
-      `SELECT key, value, row_version FROM "${table}" ORDER BY key`,
-    ),
-    driver.query<{ tx_id: string; row_version: number }>(
-      'SELECT tx_id, row_version FROM applied_tx WHERE collection_id = ? ORDER BY term, seq',
-      [collectionId],
-    ),
-  ])
-  return {
-    rows: sortRows(snapshot.rows as Array<SnapshotRow>),
-    collectionMetadata: [...snapshot.collectionMetadata].sort((a, b) =>
-      a.key.localeCompare(b.key),
-    ),
-    keySet: snapshot.keySet,
-    expectedKeys: sortedKeys(expected.map((row) => publicKey(row.key))),
-    tombstones: tombstones
-      .map((row) => ({
-        key: publicKey(row.key),
-        value: JSON.parse(row.value) as Row,
-        rowVersion: row.row_version,
-      }))
-      .sort((a, b) => a.key.localeCompare(b.key)),
-    position: {
-      term: snapshot.latestTerm,
-      seq: snapshot.latestSeq,
-      rowVersion: snapshot.latestRowVersion,
-    },
-    applied: applied.map((row) => ({
-      txId: row.tx_id,
-      rowVersion: row.row_version,
-    })),
-  }
-}
-
-function transaction(
-  txId: string,
-  seq: number,
-  mutations: Tx['mutations'],
-  rowMetadataMutations: Tx['rowMetadataMutations'] = [],
-  collectionMetadataMutations: Tx['collectionMetadataMutations'] = [],
-): Tx {
-  return {
-    txId,
-    term: 1,
-    seq,
-    rowVersion: seq,
-    mutations,
-    rowMetadataMutations,
-    collectionMetadataMutations,
-  }
-}
-
-function insertRows(count: number): Tx {
-  const rows = Array.from({ length: count }, (_, index) => ({
-    id: `row-${index}`,
-    version: 1,
-  }))
-  return transaction(
-    `insert-${count}`,
-    1,
-    rows.map((row) => ({ type: 'insert', key: row.id, value: row })),
-    rows.map((row) => ({
-      type: 'set',
-      key: row.id,
-      value: { source: 'feed' },
-    })),
-    [{ type: 'set', key: 'cursor', value: { offset: count } }],
-  )
-}
-
 type Case = {
   name: string
   cap: number
@@ -1174,6 +936,16 @@ async function assertGeneratedHistory(
   if (primary !== undefined) throw primary
 }
 
+// The check runs a fixed or generated history through the production adapter,
+// then compares each durable checkpoint with modelAfter, the independent model of
+// committed work. The generated histories and independent-key cases come from
+// the grammars, and the work bound is the write-count law at each checkpoint.
+declareOracle({
+  check: [assertGeneratedHistory, assertIndependentWork],
+  model: [modelAfter],
+  grammar: [generatedHistoryArbitrary, independentWorkArbitrary],
+})
+
 export function runOrdinaryTransactionWorkOracle(): void {
   describe('ordinary SQLite committed transaction oracle', () => {
     // The native dimension reuses the existing action model and work counter.
@@ -1426,39 +1198,6 @@ export function runOrdinaryTransactionWorkOracle(): void {
       expect(sameObservation(wrong, expected)).toBe(false)
     })
 
-    it('calibrates the synthetic 100-parameter host guard at its boundary', async () => {
-      const host = fixture(100)
-      let primary: unknown
-      try {
-        await host.driver.exec('CREATE TABLE cap_probe (value INTEGER)')
-        const statement = (n: number) =>
-          `INSERT INTO cap_probe (value) VALUES ${Array.from({ length: n }, () => '(?)').join(', ')}`
-        await host.driver.run(statement(100), Array(100).fill(1))
-        await expect(
-          host.driver.run(statement(101), Array(101).fill(1)),
-        ).rejects.toThrow('binding cap 100 exceeded: 101')
-        expect(
-          await host.driver.query<{ count: number }>(
-            'SELECT COUNT(*) AS count FROM cap_probe',
-          ),
-        ).toEqual([{ count: 100 }])
-      } catch (error) {
-        primary = error
-      }
-      try {
-        host.close()
-      } catch (cleanup) {
-        if (primary !== undefined)
-          throw new AggregateError(
-            [primary, cleanup],
-            'primary and cleanup failed',
-            { cause: primary },
-          )
-        throw cleanup
-      }
-      if (primary !== undefined) throw primary
-    })
-
     it('refines durable semantics for the bounded process and design grammar; ordinary large writes are chunk-bounded', async () => {
       const workObservations: Array<{
         case: string
@@ -1588,135 +1327,6 @@ export function runOrdinaryTransactionWorkOracle(): void {
       if (primary !== undefined) throw primary
     })
 
-    it('rejects invalid values even when a later same-key action overwrites them', async () => {
-      const host = fixture(100)
-      const collectionId = 'oracle-overwritten-invalid-value'
-      let primary: unknown
-      try {
-        await host.adapter.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: collectionId,
-        })
-        const seed = transaction('seed', 1, [
-          { type: 'insert', key: 'same', value: { id: 'same' } },
-        ])
-        await host.adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          seed,
-        )
-        const before = await observe(host.adapter, host.driver, collectionId)
-        const invalid = new Date(Number.NaN)
-        const candidates: Array<PersistedTx> = [
-          {
-            txId: 'invalid-row',
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [
-              { type: 'insert', key: 'same', value: { invalid } },
-              { type: 'insert', key: 'same', value: { id: 'same' } },
-            ],
-          },
-          {
-            txId: 'invalid-row-before-delete',
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [
-              { type: 'insert', key: 'same', value: { invalid } },
-              { type: 'delete', key: 'same', value: { id: 'same' } },
-            ],
-          },
-          {
-            txId: 'invalid-inline-metadata',
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [
-              {
-                type: 'insert',
-                key: 'same',
-                value: { id: 'same' },
-                metadataChanged: true,
-                metadata: invalid,
-              },
-              {
-                type: 'insert',
-                key: 'same',
-                value: { id: 'same' },
-                metadataChanged: true,
-                metadata: { source: 'valid' },
-              },
-            ],
-          },
-          {
-            txId: 'invalid-row-metadata',
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [],
-            rowMetadataMutations: [
-              { type: 'set', key: 'same', value: invalid },
-              { type: 'delete', key: 'same' },
-            ],
-          },
-          {
-            txId: 'invalid-collection-metadata',
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [],
-            collectionMetadataMutations: [
-              { type: 'set', key: 'cursor', value: invalid },
-              { type: 'delete', key: 'cursor' },
-            ],
-          },
-          {
-            txId: 'undefined-collection-metadata',
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [],
-            collectionMetadataMutations: [
-              { type: 'set', key: 'cursor', value: undefined },
-              { type: 'delete', key: 'cursor' },
-            ],
-          },
-        ]
-        for (const candidate of candidates) {
-          await expect(
-            host.adapter.applyCommittedTx(
-              { kind: `eager`, collectionId: collectionId },
-              candidate,
-            ),
-          ).rejects.toThrow()
-          expect(
-            await observe(host.adapter, host.driver, collectionId),
-          ).toEqual(before)
-        }
-      } catch (error) {
-        primary = error
-      }
-      try {
-        host.close()
-      } catch (cleanup) {
-        if (primary !== undefined)
-          throw new AggregateError(
-            [primary, cleanup],
-            'primary and cleanup failed',
-            { cause: primary },
-          )
-        throw cleanup
-      }
-      if (primary !== undefined) throw primary
-    })
-
     it('rejects a low-call replacement that loses metadata', async () => {
       const host = fixture(100)
       const collectionId = 'oracle-hostile-batch'
@@ -1879,71 +1489,6 @@ export function runOrdinaryTransactionWorkOracle(): void {
       if (primary !== undefined) throw primary
     })
 
-    it('preserves public replay below the threshold and full reload above it', async () => {
-      for (const size of [64, 65]) {
-        const host = fixture(999)
-        const collectionId = `oracle-replay-${size}`
-        let primary: unknown
-        try {
-          const candidate = clone(insertRows(size))
-          candidate.collectionMetadataMutations = []
-          await host.adapter.applyCommittedTx(
-            { kind: `eager`, collectionId: collectionId },
-            candidate,
-          )
-          const actual = await host.adapter.pullSince(
-            { kind: `eager`, collectionId: collectionId },
-            0,
-          )
-          if (size === 65) {
-            expect(actual).toEqual({
-              latestRowVersion: 1,
-              requiresFullReload: true,
-            })
-          } else {
-            expect(actual.requiresFullReload).toBe(false)
-            if (actual.requiresFullReload) throw new Error('expected replay')
-            expect(actual.latestRowVersion).toBe(1)
-            expect([...actual.changedKeys].sort()).toEqual(
-              candidate.mutations.map((change) => change.key).sort(),
-            )
-            expect(actual.deletedKeys).toEqual([])
-            expect(actual.deltas).toEqual([
-              {
-                txId: candidate.txId,
-                latestRowVersion: 1,
-                changedRows: candidate.mutations.map((change) => ({
-                  key: change.key,
-                  value: clone(change.value),
-                })),
-                deletedKeys: [],
-                rowMetadataMutations: clone(
-                  candidate.rowMetadataMutations ?? [],
-                ),
-                collectionMetadataMutations: clone(
-                  candidate.collectionMetadataMutations ?? [],
-                ),
-              },
-            ])
-          }
-        } catch (error) {
-          primary = error
-        }
-        try {
-          host.close()
-        } catch (cleanup) {
-          if (primary !== undefined)
-            throw new AggregateError(
-              [primary, cleanup],
-              'primary and cleanup failed',
-              { cause: primary },
-            )
-          throw cleanup
-        }
-        if (primary !== undefined) throw primary
-      }
-    })
-
     it('rolls back rows, metadata, evidence and position after a later row-write fault', async () => {
       const host = fixture(100)
       const collectionId = 'oracle-later-fault'
diff --git a/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-support.ts b/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-support.ts
new file mode 100644
index 0000000000..110386e11c
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work-support.ts
@@ -0,0 +1,263 @@
+// Shared fixtures and helpers for the ordinary SQLite committed-transaction tests.
+// The law and its independent model live in ordinary-transaction-work-oracle.ts.
+import { DatabaseSync } from 'node:sqlite'
+import { expect } from 'vitest'
+import { SQLiteCorePersistenceAdapter, createPersistedTableName } from '../src'
+import { Temporal } from './temporal-value-oracle'
+import type { PersistedTx, SQLiteDriver } from '../src'
+
+export type Row = Record<
+  string,
+  string | number | Temporal.Instant | Temporal.PlainDate
+>
+export type Tx = PersistedTx<Row, string>
+
+export function clone<T>(value: T): T {
+  // Native Temporal values are immutable. structuredClone erases their slots.
+  if (value instanceof Temporal.Instant || value instanceof Temporal.PlainDate)
+    return value
+  if (Array.isArray(value)) return value.map(clone) as T
+  if (value !== null && typeof value === `object`) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, clone(entry)]),
+    ) as T
+  }
+  return value
+}
+
+type Fixture = {
+  adapter: SQLiteCorePersistenceAdapter
+  driver: SQLiteDriver
+  counts: {
+    query: number
+    run: number
+    transactions: number
+    maxParams: number
+  }
+  failAfterRowWriteCount: (count: number | undefined) => void
+  failRunMatching: (pattern: RegExp | undefined) => void
+  corruptRowMetadata: (enabled: boolean) => void
+  close: () => void
+}
+
+function binding(value: unknown): string | number | bigint | null {
+  if (value == null) return null
+  if (typeof value === 'boolean') return value ? 1 : 0
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'bigint'
+  )
+    return value
+  return String(value)
+}
+
+export function fixture(maxBoundParameters: number): Fixture {
+  const database = new DatabaseSync(':memory:')
+  const counts = { query: 0, run: 0, transactions: 0, maxParams: 0 }
+  let failAfter: number | undefined
+  let rowWriteCount = 0
+  let failRunPattern: RegExp | undefined
+  let corruptMetadata = false
+  const rowWritePattern =
+    /INSERT INTO "c_[^"]+" \(key, value, metadata, row_version\)/
+  const checkParams = (params: ReadonlyArray<unknown>) => {
+    counts.maxParams = Math.max(counts.maxParams, params.length)
+    if (params.length > maxBoundParameters) {
+      throw new Error(
+        `binding cap ${maxBoundParameters} exceeded: ${params.length}`,
+      )
+    }
+  }
+  const driver: SQLiteDriver = {
+    maxBoundParameters,
+    exec: async (sql) => {
+      database.exec(sql)
+    },
+    query: async <T>(sql: string, params: ReadonlyArray<unknown> = []) => {
+      counts.query++
+      checkParams(params)
+      return database
+        .prepare(sql)
+        .all(...params.map(binding))
+        .map((row) => ({ ...row })) as Array<T>
+    },
+    run: async (sql, params = []) => {
+      counts.run++
+      checkParams(params)
+      if (rowWritePattern.test(sql)) {
+        rowWriteCount += params.length / 4
+        if (failAfter !== undefined && rowWriteCount > failAfter) {
+          throw new Error('injected later row-write failure')
+        }
+      }
+      if (failRunPattern?.test(sql))
+        throw new Error('injected late bookkeeping failure')
+      const actualParams =
+        corruptMetadata && rowWritePattern.test(sql)
+          ? params.map((param, index) => (index % 4 === 2 ? null : param))
+          : params
+      database.prepare(sql).run(...actualParams.map(binding))
+    },
+    transaction: async <T>(fn: (tx: SQLiteDriver) => Promise<T>) => {
+      counts.transactions++
+      database.exec('BEGIN IMMEDIATE')
+      try {
+        const result = await fn(driver)
+        database.exec('COMMIT')
+        return result
+      } catch (error) {
+        database.exec('ROLLBACK')
+        throw error
+      }
+    },
+  }
+  return {
+    adapter: new SQLiteCorePersistenceAdapter({ driver }),
+    driver,
+    counts,
+    failAfterRowWriteCount: (count) => {
+      failAfter = count
+      rowWriteCount = 0
+    },
+    failRunMatching: (pattern) => {
+      failRunPattern = pattern
+    },
+    corruptRowMetadata: (enabled) => {
+      corruptMetadata = enabled
+    },
+    close: () => database.close(),
+  }
+}
+
+export type WriteCounts = Readonly<Fixture['counts']>
+
+export function beginMeasuredWrite(host: Fixture): void {
+  host.counts.query = 0
+  host.counts.run = 0
+  host.counts.transactions = 0
+  host.counts.maxParams = 0
+}
+
+export function finishMeasuredWrite(
+  host: Fixture,
+  checkpoint: string,
+  extraTransactions = 0,
+): WriteCounts {
+  // The optional increment is a checker control, never a production path.
+  host.counts.transactions += extraTransactions
+  const counts = { ...host.counts }
+  expect(counts.transactions, `${checkpoint}: one SQLite transaction`).toBe(1)
+  return counts
+}
+
+export function transaction(
+  txId: string,
+  seq: number,
+  mutations: Tx['mutations'],
+  rowMetadataMutations: Tx['rowMetadataMutations'] = [],
+  collectionMetadataMutations: Tx['collectionMetadataMutations'] = [],
+): Tx {
+  return {
+    txId,
+    term: 1,
+    seq,
+    rowVersion: seq,
+    mutations,
+    rowMetadataMutations,
+    collectionMetadataMutations,
+  }
+}
+
+export function insertRows(count: number): Tx {
+  const rows = Array.from({ length: count }, (_, index) => ({
+    id: `row-${index}`,
+    version: 1,
+  }))
+  return transaction(
+    `insert-${count}`,
+    1,
+    rows.map((row) => ({ type: 'insert', key: row.id, value: row })),
+    rows.map((row) => ({
+      type: 'set',
+      key: row.id,
+      value: { source: 'feed' },
+    })),
+    [{ type: 'set', key: 'cursor', value: { offset: count } }],
+  )
+}
+
+export type SnapshotRow = { key: string; value: Row; metadata?: unknown }
+export type Tombstone = { key: string; value: Row; rowVersion: number }
+export type Observation = {
+  rows: Array<SnapshotRow>
+  collectionMetadata: Array<{ key: string; value: unknown }>
+  keySet: unknown
+  expectedKeys: Array<string>
+  tombstones: Array<Tombstone>
+  position: { term: number; seq: number; rowVersion: number }
+  applied: Array<{ txId: string; rowVersion: number }>
+}
+
+export function sortedKeys(values: Iterable<string>): Array<string> {
+  return [...values].sort()
+}
+
+export function sortRows(rows: Array<SnapshotRow>): Array<SnapshotRow> {
+  return [...rows].sort((a, b) => a.key.localeCompare(b.key))
+}
+
+function publicKey(encoded: string): string {
+  if (!encoded.startsWith('s:'))
+    throw new Error(`unexpected raw key ${encoded}`)
+  return encoded.slice(2)
+}
+
+export async function observe(
+  adapter: SQLiteCorePersistenceAdapter,
+  driver: SQLiteDriver,
+  collectionId: string,
+): Promise<Observation> {
+  const snapshot = await adapter.loadResumeSnapshot({
+    kind: `eager`,
+    collectionId: collectionId,
+  })
+  const table = createPersistedTableName(collectionId, 't')
+  const [expected, tombstones, applied] = await Promise.all([
+    driver.query<{ key: string }>(
+      'SELECT key FROM collection_expected_keys WHERE collection_id = ? ORDER BY key',
+      [collectionId],
+    ),
+    driver.query<{ key: string; value: string; row_version: number }>(
+      `SELECT key, value, row_version FROM "${table}" ORDER BY key`,
+    ),
+    driver.query<{ tx_id: string; row_version: number }>(
+      'SELECT tx_id, row_version FROM applied_tx WHERE collection_id = ? ORDER BY term, seq',
+      [collectionId],
+    ),
+  ])
+  return {
+    rows: sortRows(snapshot.rows as Array<SnapshotRow>),
+    collectionMetadata: [...snapshot.collectionMetadata].sort((a, b) =>
+      a.key.localeCompare(b.key),
+    ),
+    keySet: snapshot.keySet,
+    expectedKeys: sortedKeys(expected.map((row) => publicKey(row.key))),
+    tombstones: tombstones
+      .map((row) => ({
+        key: publicKey(row.key),
+        value: JSON.parse(row.value) as Row,
+        rowVersion: row.row_version,
+      }))
+      .sort((a, b) => a.key.localeCompare(b.key)),
+    position: {
+      term: snapshot.latestTerm,
+      seq: snapshot.latestSeq,
+      rowVersion: snapshot.latestRowVersion,
+    },
+    applied: applied.map((row) => ({
+      txId: row.tx_id,
+      rowVersion: row.row_version,
+    })),
+  }
+}
diff --git a/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work.test.ts b/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work.test.ts
new file mode 100644
index 0000000000..b1e215e106
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/ordinary-transaction-work.test.ts
@@ -0,0 +1,238 @@
+// Ordinary tests for the SQLite committed-transaction fixture: a host-guard calibration
+// and the public replay threshold. The law owner is ordinary-transaction-work-oracle.ts.
+import { describe, expect, it } from 'vitest'
+import {
+  clone,
+  fixture,
+  insertRows,
+  observe,
+  transaction,
+} from './ordinary-transaction-work-support'
+import type { PersistedTx } from '../src'
+
+describe('ordinary SQLite committed transaction oracle', () => {
+  it('calibrates the synthetic 100-parameter host guard at its boundary', async () => {
+    const host = fixture(100)
+    let primary: unknown
+    try {
+      await host.driver.exec('CREATE TABLE cap_probe (value INTEGER)')
+      const statement = (n: number) =>
+        `INSERT INTO cap_probe (value) VALUES ${Array.from({ length: n }, () => '(?)').join(', ')}`
+      await host.driver.run(statement(100), Array(100).fill(1))
+      await expect(
+        host.driver.run(statement(101), Array(101).fill(1)),
+      ).rejects.toThrow('binding cap 100 exceeded: 101')
+      expect(
+        await host.driver.query<{ count: number }>(
+          'SELECT COUNT(*) AS count FROM cap_probe',
+        ),
+      ).toEqual([{ count: 100 }])
+    } catch (error) {
+      primary = error
+    }
+    try {
+      host.close()
+    } catch (cleanup) {
+      if (primary !== undefined)
+        throw new AggregateError(
+          [primary, cleanup],
+          'primary and cleanup failed',
+          { cause: primary },
+        )
+      throw cleanup
+    }
+    if (primary !== undefined) throw primary
+  })
+
+  it('rejects invalid values even when a later same-key action overwrites them', async () => {
+    const host = fixture(100)
+    const collectionId = 'oracle-overwritten-invalid-value'
+    let primary: unknown
+    try {
+      await host.adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      const seed = transaction('seed', 1, [
+        { type: 'insert', key: 'same', value: { id: 'same' } },
+      ])
+      await host.adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        seed,
+      )
+      const before = await observe(host.adapter, host.driver, collectionId)
+      const invalid = new Date(Number.NaN)
+      const candidates: Array<PersistedTx> = [
+        {
+          txId: 'invalid-row',
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [
+            { type: 'insert', key: 'same', value: { invalid } },
+            { type: 'insert', key: 'same', value: { id: 'same' } },
+          ],
+        },
+        {
+          txId: 'invalid-row-before-delete',
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [
+            { type: 'insert', key: 'same', value: { invalid } },
+            { type: 'delete', key: 'same', value: { id: 'same' } },
+          ],
+        },
+        {
+          txId: 'invalid-inline-metadata',
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [
+            {
+              type: 'insert',
+              key: 'same',
+              value: { id: 'same' },
+              metadataChanged: true,
+              metadata: invalid,
+            },
+            {
+              type: 'insert',
+              key: 'same',
+              value: { id: 'same' },
+              metadataChanged: true,
+              metadata: { source: 'valid' },
+            },
+          ],
+        },
+        {
+          txId: 'invalid-row-metadata',
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [],
+          rowMetadataMutations: [
+            { type: 'set', key: 'same', value: invalid },
+            { type: 'delete', key: 'same' },
+          ],
+        },
+        {
+          txId: 'invalid-collection-metadata',
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [],
+          collectionMetadataMutations: [
+            { type: 'set', key: 'cursor', value: invalid },
+            { type: 'delete', key: 'cursor' },
+          ],
+        },
+        {
+          txId: 'undefined-collection-metadata',
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [],
+          collectionMetadataMutations: [
+            { type: 'set', key: 'cursor', value: undefined },
+            { type: 'delete', key: 'cursor' },
+          ],
+        },
+      ]
+      for (const candidate of candidates) {
+        await expect(
+          host.adapter.applyCommittedTx(
+            { kind: `eager`, collectionId: collectionId },
+            candidate,
+          ),
+        ).rejects.toThrow()
+        expect(await observe(host.adapter, host.driver, collectionId)).toEqual(
+          before,
+        )
+      }
+    } catch (error) {
+      primary = error
+    }
+    try {
+      host.close()
+    } catch (cleanup) {
+      if (primary !== undefined)
+        throw new AggregateError(
+          [primary, cleanup],
+          'primary and cleanup failed',
+          { cause: primary },
+        )
+      throw cleanup
+    }
+    if (primary !== undefined) throw primary
+  })
+
+  it('preserves public replay below the threshold and full reload above it', async () => {
+    for (const size of [64, 65]) {
+      const host = fixture(999)
+      const collectionId = `oracle-replay-${size}`
+      let primary: unknown
+      try {
+        const candidate = clone(insertRows(size))
+        candidate.collectionMetadataMutations = []
+        await host.adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          candidate,
+        )
+        const actual = await host.adapter.pullSince(
+          { kind: `eager`, collectionId: collectionId },
+          0,
+        )
+        if (size === 65) {
+          expect(actual).toEqual({
+            latestRowVersion: 1,
+            requiresFullReload: true,
+          })
+        } else {
+          expect(actual.requiresFullReload).toBe(false)
+          if (actual.requiresFullReload) throw new Error('expected replay')
+          expect(actual.latestRowVersion).toBe(1)
+          expect([...actual.changedKeys].sort()).toEqual(
+            candidate.mutations.map((change) => change.key).sort(),
+          )
+          expect(actual.deletedKeys).toEqual([])
+          expect(actual.deltas).toEqual([
+            {
+              txId: candidate.txId,
+              latestRowVersion: 1,
+              changedRows: candidate.mutations.map((change) => ({
+                key: change.key,
+                value: clone(change.value),
+              })),
+              deletedKeys: [],
+              rowMetadataMutations: clone(candidate.rowMetadataMutations ?? []),
+              collectionMetadataMutations: clone(
+                candidate.collectionMetadataMutations ?? [],
+              ),
+            },
+          ])
+        }
+      } catch (error) {
+        primary = error
+      }
+      try {
+        host.close()
+      } catch (cleanup) {
+        if (primary !== undefined)
+          throw new AggregateError(
+            [primary, cleanup],
+            'primary and cleanup failed',
+            { cause: primary },
+          )
+        throw cleanup
+      }
+      if (primary !== undefined) throw primary
+    }
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-cache-claims.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-cache-claims.test.ts
new file mode 100644
index 0000000000..f39d9443ed
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-cache-claims.test.ts
@@ -0,0 +1,2641 @@
+/**
+ * Ordinary regression tests for persisted cache-generation claims, scoped refresh, and seq-gap replay timing, as fixed scenarios. The claim and replay laws are owned by persisted-oracle.test.ts, which keeps its generated notice histories.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BasicIndex,
+  IR,
+  SyncTransactionAbortedError,
+  createCollection,
+  createLiveQueryCollection,
+  eq,
+  whenSyncAccepted,
+} from '@tanstack/db'
+import {
+  InvalidPersistedCollectionConfigError,
+  persistedCollectionOptions,
+} from '../src'
+import {
+  assertGenerationNoticeHistory,
+  atPersistedOracleCheckpoint,
+  createCoordinatorHarness,
+  createDeferred,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createFollowerTab,
+  createRecordingAdapter,
+  flushAsyncWork,
+  observeSettlement,
+  recordedStorageId,
+  within,
+} from './persisted-support'
+import type {
+  LoadSubsetOptions,
+  SyncConfig,
+  SyncMetadataApi,
+} from '@tanstack/db'
+import type {
+  PersistedCollectionCoordinator,
+  PersistenceAdapter,
+  ProtocolEnvelope,
+  TxCommitted,
+} from '../src'
+import type { FollowerRow, Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  // Removing an index revokes its durable accelerator after all event work
+  // settles. The independent index registry follows the Collection's current
+  // declarations, even when an earlier add operation is held in the adapter.
+  // At the removal checkpoint the index is absent; the late add must not
+  // resurrect it at the final checkpoint.
+  it(`keeps a removed persisted index retired after its add completes late`, async () => {
+    const adapter = createRecordingAdapter()
+    const ensureEntered = createEventGate()
+    const releaseEnsure = createEventGate()
+    const ensureSettled = createEventGate()
+    const removeSettled = createEventGate()
+    const durableIndexes = new Map<string, boolean>()
+    const operations: Array<string> = []
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `index-remove-storage`,
+      claimId: `index-remove-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: `index-remove-new`,
+      claimId: `index-remove-claim`,
+    })
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (_id, signature) => {
+      operations.push(`ensure-enter`)
+      ensureEntered.resolve()
+      await releaseEnsure.promise
+      durableIndexes.set(signature, true)
+      operations.push(`ensure-settled`)
+      ensureSettled.resolve()
+    }
+    adapter.markIndexRemoved = async (_id, signature) => {
+      durableIndexes.set(signature, false)
+      operations.push(`remove-settled`)
+      removeSettled.resolve()
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `late-index-add-after-removal`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: { sync: ({ markReady }) => markReady() },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      const index = collection.createIndex((row) => row.title, {
+        name: `transient-index`,
+      })
+      const signature = collection
+        .getIndexMetadata()
+        .find((metadata) => metadata.indexId === index.id)?.signature
+      if (!signature) throw new Error(`Missing index signature`)
+      await atPersistedOracleCheckpoint(
+        ensureEntered.promise,
+        `index add entered`,
+      )
+      expect(collection.removeIndex(index)).toBe(true)
+      await atPersistedOracleCheckpoint(
+        removeSettled.promise,
+        `index removal settled`,
+      )
+      expect(durableIndexes.get(signature)).toBe(false)
+      releaseEnsure.resolve()
+      await atPersistedOracleCheckpoint(
+        ensureSettled.promise,
+        `late index add settled`,
+      )
+      await flushAsyncWork()
+      expect(collection.getIndexMetadata()).toEqual([])
+      expect(durableIndexes.get(signature)).toBe(false)
+      expect(operations.slice(0, 3)).toEqual([
+        `ensure-enter`,
+        `remove-settled`,
+        `ensure-settled`,
+      ])
+      expect(operations.at(-1)).toBe(`remove-settled`)
+    } finally {
+      releaseEnsure.resolve()
+      await collection.cleanup()
+    }
+  })
+
+  // Re-adding the same index signature reverses the expected final state.
+  // A held removal from the old declaration cannot deactivate the current
+  // declaration after its add has completed. Signature, rather than object
+  // identity, names the durable SQLite accelerator in this history.
+  it(`keeps a re-added persisted index active after its removal completes late`, async () => {
+    const adapter = createRecordingAdapter()
+    const removeEntered = createEventGate()
+    const releaseRemove = createEventGate()
+    const removeSettled = createEventGate()
+    const durableIndexes = new Map<string, boolean>()
+    let ensureCalls = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `index-readd-storage`,
+      claimId: `index-readd-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: `index-readd-new`,
+      claimId: `index-readd-claim`,
+    })
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (_id, signature) => {
+      ensureCalls++
+      durableIndexes.set(signature, true)
+    }
+    adapter.markIndexRemoved = async (_id, signature) => {
+      removeEntered.resolve()
+      await releaseRemove.promise
+      durableIndexes.set(signature, false)
+      removeSettled.resolve()
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `late-index-removal-after-readd`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: { sync: ({ markReady }) => markReady() },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      const first = collection.createIndex((row) => row.title)
+      const signature = collection
+        .getIndexMetadata()
+        .find((metadata) => metadata.indexId === first.id)?.signature
+      if (!signature) throw new Error(`Missing index signature`)
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(ensureCalls).toBe(1)),
+        `first index add`,
+      )
+      expect(collection.removeIndex(first)).toBe(true)
+      await atPersistedOracleCheckpoint(
+        removeEntered.promise,
+        `old index removal entered`,
+      )
+      const second = collection.createIndex((row) => row.title)
+      expect(
+        collection
+          .getIndexMetadata()
+          .find((metadata) => metadata.indexId === second.id)?.signature,
+      ).toBe(signature)
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(ensureCalls).toBe(2)),
+        `replacement index add`,
+      )
+      releaseRemove.resolve()
+      await atPersistedOracleCheckpoint(
+        removeSettled.promise,
+        `old removal settled`,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(durableIndexes.get(signature)).toBe(true)),
+        `current index restored`,
+      )
+      expect(collection.getIndexMetadata()).toHaveLength(1)
+    } finally {
+      releaseRemove.resolve()
+      await collection.cleanup()
+    }
+  })
+
+  // Rotation rebuilds current index declarations on a new physical table.
+  // Removing one while its new-table bootstrap call is held must leave that
+  // table without the index once recovery and the removal event both settle.
+  // This is the neighboring bootstrap route for the add/remove race above.
+  it(`removes an index deleted during held cache-rotation bootstrap`, async () => {
+    const adapter = createRecordingAdapter()
+    const bootstrapEntered = createEventGate()
+    const releaseBootstrap = createEventGate()
+    const removalSettled = createEventGate()
+    const durableIndexes = new Map<string, boolean>()
+    let storageId = `bootstrap-removal-old`
+    let recovery!: () => Promise<void>
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `bootstrap-removal-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: (storageId = `bootstrap-removal-new`),
+      claimId: `bootstrap-removal-claim`,
+    })
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (id, signature) => {
+      if (recordedStorageId(id) === `bootstrap-removal-new`) {
+        bootstrapEntered.resolve()
+        await releaseBootstrap.promise
+      }
+      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, true)
+    }
+    adapter.markIndexRemoved = async (id, signature) => {
+      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, false)
+      removalSettled.resolve()
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `bootstrap-index-removal`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: (params) => {
+            recovery = params.metadata!.persistence!.startScopedRecovery!
+            params.markReady()
+            return { restartAfterScopedRecovery: (gate) => gate }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const index = collection.createIndex((row) => row.title)
+    const signature = collection
+      .getIndexMetadata()
+      .find((metadata) => metadata.indexId === index.id)?.signature
+    if (!signature) throw new Error(`Missing index signature`)
+    let activeRecovery: Promise<void> | undefined
+    try {
+      await collection.stateWhenReady()
+      activeRecovery = recovery()
+      await atPersistedOracleCheckpoint(
+        bootstrapEntered.promise,
+        `new-table index bootstrap`,
+      )
+      expect(collection.removeIndex(index)).toBe(true)
+      expect(collection.getIndexMetadata()).toEqual([])
+      // The removal finishes first; the old bootstrap call can still finish
+      // afterward and must not recreate the retired physical index.
+      await atPersistedOracleCheckpoint(
+        removalSettled.promise,
+        `index removal before late bootstrap ensure`,
+      )
+      expect(durableIndexes.get(`bootstrap-removal-new:${signature}`)).toBe(
+        false,
+      )
+      releaseBootstrap.resolve()
+      await atPersistedOracleCheckpoint(
+        activeRecovery,
+        `cache rotation after index removal`,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() =>
+          expect(durableIndexes.get(`bootstrap-removal-new:${signature}`)).toBe(
+            false,
+          ),
+        ),
+        `new-table index removal`,
+      )
+    } finally {
+      releaseBootstrap.resolve()
+      await Promise.allSettled([activeRecovery])
+      await collection.cleanup()
+    }
+  })
+
+  // The same signature can be declared again while bootstrap repairs a late
+  // ensure. After that held removal finishes, the current Collection registry
+  // requires the physical index to be present. This is the reverse boundary
+  // of the preceding witness: the final declaration, not the order in which
+  // obsolete adapter calls finish, determines the durable accelerator.
+  it(`restores an index re-added during cache-rotation reconciliation`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstEnsureEntered = createEventGate()
+    const releaseFirstEnsure = createEventGate()
+    const firstRemovalSettled = createEventGate()
+    const secondRemovalEntered = createEventGate()
+    const releaseSecondRemoval = createEventGate()
+    const durableIndexes = new Map<string, boolean>()
+    let storageId = `bootstrap-readd-old`
+    let recovery!: () => Promise<void>
+    let newStorageEnsures = 0
+    let removals = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `bootstrap-readd-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: (storageId = `bootstrap-readd-new`),
+      claimId: `bootstrap-readd-claim`,
+    })
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (id, signature) => {
+      if (
+        recordedStorageId(id) === `bootstrap-readd-new` &&
+        ++newStorageEnsures === 1
+      ) {
+        firstEnsureEntered.resolve()
+        await releaseFirstEnsure.promise
+      }
+      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, true)
+    }
+    adapter.markIndexRemoved = async (id, signature) => {
+      if (++removals === 2) {
+        secondRemovalEntered.resolve()
+        await releaseSecondRemoval.promise
+      }
+      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, false)
+      firstRemovalSettled.resolve()
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `bootstrap-index-readd`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: (params) => {
+            recovery = params.metadata!.persistence!.startScopedRecovery!
+            params.markReady()
+            return { restartAfterScopedRecovery: (gate) => gate }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const initial = collection.createIndex((row) => row.title)
+    const signature = collection
+      .getIndexMetadata()
+      .find((metadata) => metadata.indexId === initial.id)?.signature
+    if (!signature) throw new Error(`Missing index signature`)
+    let activeRecovery: Promise<void> | undefined
+    try {
+      await collection.stateWhenReady()
+      activeRecovery = recovery()
+      await atPersistedOracleCheckpoint(
+        firstEnsureEntered.promise,
+        `first new-table ensure`,
+      )
+      expect(collection.removeIndex(initial)).toBe(true)
+      await atPersistedOracleCheckpoint(
+        firstRemovalSettled.promise,
+        `old declaration removed`,
+      )
+      releaseFirstEnsure.resolve()
+      await atPersistedOracleCheckpoint(
+        secondRemovalEntered.promise,
+        `bootstrap reconciliation removal`,
+      )
+      const current = collection.createIndex((row) => row.title)
+      expect(
+        collection
+          .getIndexMetadata()
+          .find((metadata) => metadata.indexId === current.id)?.signature,
+      ).toBe(signature)
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(newStorageEnsures).toBeGreaterThan(1)),
+        `re-added index ensure`,
+      )
+      releaseSecondRemoval.resolve()
+      await atPersistedOracleCheckpoint(
+        activeRecovery,
+        `reconciled cache rotation`,
+      )
+      expect(collection.getIndexMetadata()).toHaveLength(1)
+      expect(durableIndexes.get(`bootstrap-readd-new:${signature}`)).toBe(true)
+    } finally {
+      releaseFirstEnsure.resolve()
+      releaseSecondRemoval.resolve()
+      await Promise.allSettled([activeRecovery])
+      await collection.cleanup()
+    }
+  })
+
+  // A second recovery may be requested while the first is still rebuilding
+  // indexes. The first completion cannot reopen source commit admission while
+  // the second rotation is held. The two storage IDs and held index/rotation
+  // gates make that distinction visible before the final cache is accepted.
+  it(`keeps source commits quarantined through overlapping cache rotations`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstIndexEntered = createEventGate()
+    const releaseFirstIndex = createEventGate()
+    const secondRotationEntered = createEventGate()
+    const releaseSecondRotation = createEventGate()
+    let storageId = `overlap-old`
+    let rotations = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `overlap-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      if (++rotations === 2) {
+        secondRotationEntered.resolve()
+        await releaseSecondRotation.promise
+      }
+      storageId = `overlap-new-${rotations}`
+      return { storageCollectionId: storageId, claimId: `overlap-claim` }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (id) => {
+      if (recordedStorageId(id) === `overlap-new-1`) {
+        firstIndexEntered.resolve()
+        await releaseFirstIndex.promise
+      }
+    }
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `overlap-cache-rotation`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { restartAfterScopedRecovery: (gate) => gate }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.createIndex((row) => row.title)
+    let first: Promise<void> | undefined
+    let second: Promise<void> | undefined
+    try {
+      await collection.stateWhenReady()
+      first = source.metadata!.persistence!.startScopedRecovery!()
+      await atPersistedOracleCheckpoint(
+        firstIndexEntered.promise,
+        `first rotation index bootstrap`,
+      )
+      second = source.metadata!.persistence!.startScopedRecovery!()
+      releaseFirstIndex.resolve()
+      await atPersistedOracleCheckpoint(
+        secondRotationEntered.promise,
+        `second cache rotation`,
+      )
+      await first
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `intermediate`, title: `Unaccepted` },
+      })
+      await expect(source.commit()).rejects.toBeInstanceOf(
+        SyncTransactionAbortedError,
+      )
+      expect(collection.get(`intermediate`)).toBeUndefined()
+      releaseSecondRotation.resolve()
+      await second
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `final`, title: `Accepted` },
+      })
+      await whenSyncAccepted(source.commit())
+      expect(collection.get(`final`)).toMatchObject({ id: `final` })
+      expect(storageId).toBe(`overlap-new-2`)
+    } finally {
+      releaseFirstIndex.resolve()
+      releaseSecondRotation.resolve()
+      await Promise.allSettled([first, second])
+      await collection.cleanup()
+    }
+  })
+
+  // Indexes are optional accelerators. An index event whose claim check hits
+  // a temporary adapter error must settle its asynchronous listener without
+  // changing the Collection's ready state. The adapter is held until after
+  // the event so the checkpoint observes the listener's rejection path.
+  it(`keeps a failed runtime index check best-effort`, async () => {
+    const adapter = createRecordingAdapter()
+    const indexCheckEntered = createEventGate()
+    const releaseIndexCheck = createEventGate()
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let failIndexCheck = false
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `index-check-storage`,
+      claimId: `index-check-claim`,
+    })
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: `index-check-replacement`,
+      claimId: `index-check-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      if (failIndexCheck) {
+        indexCheckEntered.resolve()
+        await releaseIndexCheck.promise
+        throw new Error(`temporary index claim check failure`)
+      }
+      return Date.now() + 10_000
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `index-check-best-effort`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: { sync: ({ markReady }) => markReady() },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      failIndexCheck = true
+      collection.createIndex((row) => row.title, { name: `optional-index` })
+      await atPersistedOracleCheckpoint(
+        indexCheckEntered.promise,
+        `runtime index claim check`,
+      )
+      releaseIndexCheck.resolve()
+      await flushAsyncWork()
+      expect(collection.status).toBe(`ready`)
+      expect(warning).toHaveBeenCalledWith(
+        `Failed to ensure persisted index after index:added:`,
+        expect.any(Error),
+      )
+    } finally {
+      releaseIndexCheck.resolve()
+      warning.mockRestore()
+      await collection.cleanup()
+    }
+  })
+
+  // A demand waiting for startup has not reached the source or cache. Its
+  // caller may cancel while a private cache rotation is held. The canceled
+  // demand must reject promptly with AbortError; a sibling keeps waiting and
+  // obtains source rows after rotation. The model treats cancellation as one
+  // demand's settlement, not cancellation of the shared startup or rotation.
+  // The held rotation separates the abort checkpoint from source entry.
+  it(`settles an aborted startup demand while a sibling waits for cache rotation`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstIndexEntered = createEventGate()
+    const releaseFirstIndex = createEventGate()
+    const rotationEntered = createEventGate()
+    const releaseRotation = createEventGate()
+    const sourceStarted = createEventGate()
+    let expired = false
+    let storageId = `abort-startup-old`
+    let indexCalls = 0
+    let sourceLoads = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `abort-startup-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () =>
+      expired ? undefined : Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      expired = false
+      storageId = `abort-startup-new`
+      return { storageCollectionId: storageId, claimId: `abort-startup-claim` }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async () => {
+      if (++indexCalls === 1) {
+        firstIndexEntered.resolve()
+        await releaseFirstIndex.promise
+      }
+    }
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `abort-startup-rotation`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            sourceStarted.resolve()
+            return {
+              restartAfterScopedRecovery: () => {},
+              loadSubset: async () => {
+                sourceLoads++
+                source.begin()
+                source.write({
+                  type: `insert`,
+                  value: { id: `fresh`, title: `New storage` },
+                })
+                await whenSyncAccepted(source.commit())
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.createIndex((row) => row.title, { name: `held-title` })
+    const controller = new AbortController()
+    try {
+      collection.startSyncImmediate()
+      await atPersistedOracleCheckpoint(
+        firstIndexEntered.promise,
+        `startup index`,
+      )
+      expired = true
+      collection.createIndex((row) => row.id, { name: `dynamic-id` })
+      await atPersistedOracleCheckpoint(
+        rotationEntered.promise,
+        `startup rotation`,
+      )
+
+      const canceled = Promise.resolve(
+        collection._sync.loadSubset({ limit: 1, signal: controller.signal }),
+      )
+      void canceled.catch(() => undefined)
+      const sibling = Promise.resolve(collection._sync.loadSubset({ limit: 2 }))
+      let siblingSettled = false
+      void sibling.then(
+        () => {
+          siblingSettled = true
+        },
+        () => {
+          siblingSettled = true
+        },
+      )
+      controller.abort()
+      await expect(
+        atPersistedOracleCheckpoint(canceled, `aborted startup demand`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      expect(siblingSettled).toBe(false)
+      expect(sourceLoads).toBe(0)
+
+      releaseFirstIndex.resolve()
+      releaseRotation.resolve()
+      await atPersistedOracleCheckpoint(sourceStarted.promise, `source entry`)
+      await atPersistedOracleCheckpoint(sibling, `sibling startup demand`)
+      expect(sourceLoads).toBe(1)
+      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
+    } finally {
+      controller.abort()
+      releaseFirstIndex.resolve()
+      releaseRotation.resolve()
+      await collection.cleanup()
+    }
+  })
+
+  // Source entry may finish before a recovery rotation takes the apply mutex.
+  // A demand admitted behind that mutex still belongs to its own caller: an
+  // explicit abort must reject before rotation settles, while a sibling
+  // remains pending and succeeds afterward. This cut differs from a demand
+  // held before source entry, because the wrapper has already crossed its
+  // startup promises and is waiting inside the persisted runtime.
+  it(`settles an aborted demand behind a held recovery rotation`, async () => {
+    const adapter = createRecordingAdapter()
+    const rotationEntered = createEventGate()
+    const releaseRotation = createEventGate()
+    let storageId = `abort-recovery-old`
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `abort-recovery-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      storageId = `abort-recovery-new`
+      return { storageCollectionId: storageId, claimId: `abort-recovery-claim` }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const controller = new AbortController()
+    let source!: TodoSyncParams
+    const sourceLimits: Array<number | undefined> = []
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `abort-held-recovery`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return {
+              restartAfterScopedRecovery: () => {},
+              loadSubset: (options) => {
+                sourceLimits.push(options.limit)
+                return true
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let recovery: Promise<void> | undefined
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      recovery = source.metadata!.persistence!.startScopedRecovery!()
+      await atPersistedOracleCheckpoint(
+        rotationEntered.promise,
+        `held rotation`,
+      )
+
+      const canceled = Promise.resolve(
+        collection._sync.loadSubset({ limit: 1, signal: controller.signal }),
+      )
+      void canceled.catch(() => undefined)
+      const sibling = Promise.resolve(collection._sync.loadSubset({ limit: 2 }))
+      let siblingSettled = false
+      void sibling.then(
+        () => {
+          siblingSettled = true
+        },
+        () => {
+          siblingSettled = true
+        },
+      )
+      await flushAsyncWork()
+      expect(siblingSettled).toBe(false)
+      controller.abort()
+      await expect(
+        atPersistedOracleCheckpoint(canceled, `aborted recovery demand`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      expect(siblingSettled).toBe(false)
+
+      releaseRotation.resolve()
+      await atPersistedOracleCheckpoint(recovery, `rotation recovery`)
+      await atPersistedOracleCheckpoint(sibling, `sibling recovery demand`)
+      expect(sourceLimits).toContain(2)
+      expect(sourceLimits).not.toContain(1)
+      expect(collection.status).toBe(`ready`)
+    } finally {
+      controller.abort()
+      releaseRotation.resolve()
+      await Promise.allSettled([recovery])
+      await collection.cleanup()
+    }
+  })
+
+  // A custom adapter may opt into managed cache generations. Claiming alone
+  // cannot enforce rotation, expiry, or release; accepting that partial bundle
+  // would make stale durable rows appear authoritative on a later run. The
+  // contract refuses the configuration before a claim or source load begins.
+  it.each([
+    `rotateCacheGeneration`,
+    `renewCacheGenerationClaim`,
+    `releaseCacheGenerationClaim`,
+  ] as const)(`refuses a managed cache adapter without %s`, async (missing) => {
+    const adapter = createRecordingAdapter()
+    adapter.claimCacheGeneration = vi.fn(async () => ({
+      storageCollectionId: `managed-storage`,
+      claimId: `managed-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    }))
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: `rotated-storage`,
+      claimId: `managed-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.releaseCacheGenerationClaim = async () => {}
+    delete adapter[missing]
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `partial-managed-adapter-${missing}`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: { sync: (params) => params.markReady() },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await expect(collection.stateWhenReady()).rejects.toThrow(
+        `managed cache generation adapter`,
+      )
+      expect(adapter.claimCacheGeneration).not.toHaveBeenCalled()
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // Losing a durable claim removes authority to hydrate its rows, not the
+  // public demand. The model keeps that demand, clears the old source base,
+  // and satisfies it from one new source snapshot. This driver lets renewal
+  // fail just before demand admission; stale durable rows remain in the fake
+  // adapter so the public row comparison rejects a missing recovery guard.
+  it(`reloads a demanded subset after its persisted cache claim expires`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `stale`, title: `Old persisted row` },
+    ])
+    let storageId = `expired-old-storage`
+    const claimId = `expiring-claim`
+    let renewals = 0
+    let revokeClaim = false
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      if (revokeClaim) {
+        revokeClaim = false
+        return undefined
+      }
+      return Date.now() + 10_000
+    }
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: (storageId = `expired-private-storage`),
+      claimId,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.releaseCacheGenerationClaim = async () => {}
+    let source!: TodoSyncParams
+    let sourceLoads = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `expired-demand-reload`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return {
+              // Every source load is synchronous up to its tracked commit;
+              // there is no old provider callback to deliver after restart.
+              restartAfterScopedRecovery: () => {},
+              loadSubset: async () => {
+                sourceLoads++
+                source.begin()
+                source.write({
+                  type: `insert`,
+                  value: { id: `fresh`, title: `Fresh source row` },
+                })
+                await whenSyncAccepted(source.commit())
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      revokeClaim = true
+      await collection._sync.loadSubset({ limit: 1 })
+      expect(renewals).toBeGreaterThan(0)
+      expect(sourceLoads).toBe(1)
+      expect(collection.get(`stale`)).toBeUndefined()
+      expect(collection.get(`fresh`)).toMatchObject({
+        id: `fresh`,
+        title: `Fresh source row`,
+      })
+      expect(
+        adapter.applyCommittedTxCalls
+          .filter((call) =>
+            call.tx.mutations.some((mutation) => mutation.key === `fresh`),
+          )
+          .map((call) => call.collectionId),
+      ).toEqual([`expired-private-storage`])
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  /**
+   * A physical cache generation starts a new row-version history. The model
+   * retains one active subset demand through rotation and requires a peer
+   * commit in the replacement generation to reacquire source evidence while
+   * scoped recovery quarantines durable rows. Its row version starts at one
+   * even when the retired generation had reached ten. The zero-version
+   * neighbor shows that the same notification reaches the refresh path when
+   * no retired version can accidentally classify it as already published.
+   * The coordinator records source reacquisition after each public cut; the
+   * old durable row must be absent after rotation.
+   */
+  it.each([
+    { retiredRowVersion: 0, oldRows: [] as Array<Todo> },
+    {
+      retiredRowVersion: 10,
+      oldRows: [{ id: `retired`, title: `Retired cache row` }],
+    },
+  ])(
+    `reacquires a scoped subset after a new-generation peer notice with retired row version $retiredRowVersion`,
+    async ({ retiredRowVersion, oldRows }) => {
+      const adapter = createRecordingAdapter(oldRows)
+      const coordinator = createCoordinatorHarness()
+      const oldStorageId = `peer-rotation-old-${retiredRowVersion}`
+      const newStorageId = `peer-rotation-new-${retiredRowVersion}`
+      let storageId = oldStorageId
+      const remoteEnsures: Array<string> = []
+      const originalLoadResumeSnapshot = adapter.loadResumeSnapshot
+      adapter.loadResumeSnapshot = async (id, context) => {
+        const snapshot = await originalLoadResumeSnapshot(id, context)
+        return {
+          ...snapshot,
+          latestTerm: recordedStorageId(id) === oldStorageId ? 1 : 0,
+          latestSeq:
+            recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
+          latestRowVersion:
+            recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
+        }
+      }
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: storageId,
+        claimId: `peer-rotation-claim-${retiredRowVersion}`,
+        expiresAtMs: Date.now() + 60_000,
+      })
+      adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
+      adapter.rotateCacheGeneration = async () => ({
+        storageCollectionId: (storageId = newStorageId),
+        claimId: `peer-rotation-claim-${retiredRowVersion}`,
+        expiresAtMs: Date.now() + 60_000,
+      })
+      adapter.releaseCacheGenerationClaim = async () => {}
+      coordinator.requestEnsureRemoteSubset = async (id) => {
+        remoteEnsures.push(id)
+      }
+
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `peer-rotation-${retiredRowVersion}`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: async (cacheRotated) => {
+                  await cacheRotated
+                },
+                loadSubset: async () => {},
+                unloadSubset: async () => {},
+              }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      try {
+        collection.startSyncImmediate()
+        await collection.stateWhenReady()
+        await source.metadata!.persistence!.hydrateBaseline()
+        expect(collection.get(`retired`)?.title).toBe(oldRows[0]?.title)
+
+        const persistence = source.metadata?.persistence
+        if (!persistence?.startScopedRecovery) {
+          throw new Error(`Expected scoped recovery capability`)
+        }
+        await persistence.startScopedRecovery()
+        await vi.waitFor(() => expect(remoteEnsures).toContain(newStorageId))
+        expect(collection.get(`retired`)).toBeUndefined()
+        const ensuresAfterRotation = remoteEnsures.length
+        expect(ensuresAfterRotation).toBe(1)
+
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `new-generation-peer-row`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows: [
+              {
+                key: `fresh`,
+                value: { id: `fresh`, title: `Fresh source row` },
+              },
+            ],
+            deletedKeys: [],
+          },
+          `peer`,
+          newStorageId,
+        )
+        await atPersistedOracleCheckpoint(
+          vi.waitFor(() =>
+            expect(remoteEnsures).toHaveLength(ensuresAfterRotation + 1),
+          ),
+          `source reacquisition after a new-generation peer notice`,
+        )
+        expect(remoteEnsures.at(-1)).toBe(newStorageId)
+      } finally {
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each([
+    { retiredNotice: `commit`, retiredRowVersion: 1, newRowVersion: 3 },
+    { retiredNotice: `reset`, retiredRowVersion: 1, newRowVersion: 3 },
+    { retiredNotice: `commit`, retiredRowVersion: 10, newRowVersion: 1 },
+    { retiredNotice: `reset`, retiredRowVersion: 10, newRowVersion: 1 },
+  ] as const)(
+    `does not let a queued retired-generation $retiredNotice at row version $retiredRowVersion affect a new-generation peer notice`,
+    ({ retiredNotice, retiredRowVersion, newRowVersion }) =>
+      assertGenerationNoticeHistory({
+        retiredNotice,
+        retiredRowVersion,
+        newRowVersion,
+        newNotice: true,
+      }),
+  )
+
+  // A reset clears the owner's durable rows. Its rows return only when the
+  // follower requests its demand again, so the model predicts one more
+  // ensure, the owner's row visible again, and no further ensures: replacing
+  // rows in place must not drop the replay that a reset owes. Only a node
+  // that follows replaces rows in place. A node elected leader that still
+  // routes demand through the coordinator truncates and replays as the
+  // leader does; this follower-only cell does not exercise that path.
+  // A renewal that fails after the owner replied does not establish claim
+  // loss. The load cannot confirm its rows, so it rejects, as a failed ensure
+  // does; the demand stays active and retries, so the owner's acquisition
+  // is kept. The model predicts the rejected load, no release, one retried
+  // ensure, the owner's row still visible, and a healthy source.
+  it(`keeps a follower's demand when a renewal fails transiently at its reply`, async () => {
+    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const tab = createFollowerTab({
+      placement: `direct`,
+      apply: `ok`,
+      consumer: `load`,
+      renewal: `fails-at-reply`,
+    })
+    try {
+      tab.releaseApply()
+      let outcome: `pending` | `fulfilled` | `rejected` = `pending`
+      const settled = Promise.resolve(
+        tab.source._sync.loadSubset({
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`group`]),
+            new IR.Value(`a`),
+          ]),
+        }),
+      ).then(
+        () => (outcome = `fulfilled`),
+        () => (outcome = `rejected`),
+      )
+      await within(settled, 1_000)
+      for (let i = 0; i < 5; i++)
+        await new Promise((resolve) => setTimeout(resolve, 0))
+      // Checkpoint: the load settled and any retry has run.
+      expect({
+        outcome,
+        releases: tab.releases(),
+        ensures: tab.ensures(),
+        rows: Array.from(tab.source.values()).map((row) => row.id),
+        status: tab.source.status === `crashed` ? `crashed` : `healthy`,
+      }).toEqual({
+        outcome: `rejected`,
+        releases: 0,
+        ensures: 2,
+        rows: [`remote`],
+        status: `healthy`,
+      })
+    } finally {
+      await tab.source.cleanup()
+      errors.mockRestore()
+      warnings.mockRestore()
+    }
+  })
+
+  it(`a follower requests its demand again after the owner resets, once`, async () => {
+    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const tab = createFollowerTab({
+      placement: `direct`,
+      apply: `ok`,
+      consumer: `live-query`,
+    })
+    const query = createLiveQueryCollection((q) =>
+      q.from({ row: tab.source }).where(({ row }) => eq(row.group, `a`)),
+    )
+    try {
+      void query.preload()
+      await within(tab.applyReadStarted)
+      tab.releaseApply()
+      await vi.waitFor(() => expect(query.size).toBe(1), { timeout: 1_000 })
+      expect(tab.ensures()).toBe(1)
+
+      tab.resetOwner()
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      expect({
+        ensures: tab.ensures(),
+        rows: query.toArray.map((row) => (row as FollowerRow).id),
+        status: query.status,
+      }).toEqual({ ensures: 2, rows: [`remote`], status: `ready` })
+    } finally {
+      await query.cleanup()
+      await tab.source.cleanup()
+      errors.mockRestore()
+      warnings.mockRestore()
+    }
+  })
+
+  // The same law holds when no demand is active as recovery starts: with
+  // nothing reacquired and no new generation, a later load must still not
+  // hydrate the untrusted rows.
+  it.each([`active demand`, `no active demand`] as const)(
+    `does not trust untrusted durable rows after a recovery without rotation: %s`,
+    async (activeAtRecovery) => {
+      const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
+      const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const durable: Array<FollowerRow> = [{ id: `stale`, group: `a` }]
+      let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+      let seq = 0
+      const notice = (collectionId: string, value: FollowerRow) => {
+        seq++
+        if (!durable.some((row) => row.id === value.id)) durable.push(value)
+        const payload: TxCommitted = {
+          type: `tx:committed`,
+          term: 1,
+          seq,
+          txId: `owner-tx-${seq}`,
+          latestRowVersion: seq,
+          requiresFullReload: false,
+          changedRows: [{ key: value.id, value }],
+          deletedKeys: [],
+        }
+        subscriber?.({
+          v: 1,
+          dbName: `test-db`,
+          collectionId,
+          senderId: `owner`,
+          ts: Date.now(),
+          payload,
+        })
+      }
+      let ensures = 0
+      const adapter = {
+        loadSubset: async () =>
+          durable.map((value) => ({ key: value.id, value })),
+        loadResumeSnapshot: () =>
+          Promise.resolve({
+            rows: [],
+            keySet: { status: `consistent` },
+            collectionMetadata: [],
+            latestTerm: 0,
+            latestSeq: 0,
+            latestRowVersion: 0,
+            resetEpoch: 0,
+          }),
+        applyCommittedTx: async () => {},
+        ensureIndex: async () => {},
+      } as unknown as PersistenceAdapter
+      const coordinator = {
+        getNodeId: () => `follower`,
+        subscribe: (
+          _collectionId: string,
+          onMessage: (message: ProtocolEnvelope<unknown>) => void,
+        ) => {
+          subscriber = onMessage
+          return () => {
+            subscriber = undefined
+          }
+        },
+        publish: () => {},
+        isLeader: () => false,
+        ensureLeadership: async () => {},
+        requestEnsurePersistedIndex: async () => {},
+        requestEnsureRemoteSubset: async (collectionId: string) => {
+          if (++ensures === 1)
+            notice(collectionId, { id: `remote`, group: `a` })
+        },
+        requestReleaseRemoteSubset: async () => {},
+        registerRemoteSubsetOwner: () => () => {},
+        requestApplyCommittedTx: (_collectionId: string, tx: TxCommitted) =>
+          Promise.resolve({
+            type: `rpc:applyCommittedTx:res`,
+            rpcId: tx.txId,
+            ok: true,
+            term: tx.term,
+            seq: tx.seq,
+            latestRowVersion: seq,
+          }),
+        pullSince: () =>
+          Promise.resolve({
+            type: `rpc:pullSince:res`,
+            rpcId: `unrotated-pull`,
+            ok: true,
+            latestTerm: 1,
+            latestSeq: seq,
+            latestRowVersion: seq,
+            requiresFullReload: false,
+            changedKeys: [],
+            deletedKeys: [],
+          }),
+      } as unknown as PersistedCollectionCoordinator
+      let sourceParams: SyncConfig<FollowerRow, string>[`sync`] extends (
+        params: infer P,
+      ) => unknown
+        ? P
+        : never
+      const source = createCollection(
+        persistedCollectionOptions<FollowerRow, string>({
+          id: `follower-unrotated-${Math.random().toString(36).slice(2)}`,
+          getKey: (row) => row.id,
+          persistence: { adapter, coordinator },
+          syncMode: `on-demand`,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              return {
+                loadSubset: () => Promise.resolve(),
+                restartAfterScopedRecovery: () => {},
+              }
+            },
+          },
+        }),
+      )
+      source.startSyncImmediate()
+      const query = createLiveQueryCollection((q) =>
+        q.from({ row: source }).where(({ row }) => eq(row.group, `a`)),
+      )
+      try {
+        if (activeAtRecovery === `active demand`) {
+          await query.preload()
+          expect(Array.from(source.keys()).sort()).toEqual([`remote`, `stale`])
+        } else {
+          // Start the source without any demand.
+          void source.preload().catch(() => undefined)
+          await vi.waitFor(() => expect(sourceParams).toBeDefined())
+        }
+
+        // The source reports that the old durable rows are untrusted.
+        await sourceParams!.metadata!.persistence!.startScopedRecovery!()
+        await new Promise((resolve) => setTimeout(resolve, 50))
+        if (activeAtRecovery === `no active demand`) {
+          void query.preload().catch(() => undefined)
+        }
+        notice(source.id, { id: `fresh`, group: `a` })
+        await new Promise((resolve) => setTimeout(resolve, 100))
+        expect(Array.from(source.keys())).not.toContain(`stale`)
+      } finally {
+        await query.cleanup()
+        await source.cleanup()
+        errors.mockRestore()
+        warnings.mockRestore()
+      }
+    },
+  )
+
+  // The model has one one-shot refresh lease. The grammar crosses cleanup
+  // before and after source settlement. Whichever event wins releases the
+  // lease once. The raw release log retains multiplicity at both checkpoints.
+  it.each([false, true])(
+    `releases a scoped refresh once when settlement precedes cleanup: %s`,
+    async (settleBeforeCleanup) => {
+      const adapter = createRecordingAdapter()
+      const coordinator = createCoordinatorHarness()
+      const logicalId = `scoped-refresh-cleanup`
+      const oldStorageId = `scoped-refresh-old`
+      const newStorageId = `scoped-refresh-new`
+      const refreshEntered = createEventGate()
+      const releaseRefresh = createEventGate()
+      const releaseCalls: Array<LoadSubsetOptions> = []
+      let watchRefresh = false
+      let refreshOptions: LoadSubsetOptions | undefined
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: oldStorageId,
+        claimId: `scoped-refresh-claim`,
+        expiresAtMs: Date.now() + 60_000,
+      })
+      adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
+      adapter.rotateCacheGeneration = async () => ({
+        storageCollectionId: newStorageId,
+        claimId: `scoped-refresh-claim`,
+        expiresAtMs: Date.now() + 60_000,
+      })
+      adapter.releaseCacheGenerationClaim = async () => {}
+      coordinator.requestEnsureRemoteSubset = async (_id, options) => {
+        if (watchRefresh && options.refetch === true) {
+          refreshOptions = options
+          refreshEntered.resolve()
+          await releaseRefresh.promise
+        }
+      }
+      coordinator.requestReleaseRemoteSubset = async (_id, options) => {
+        releaseCalls.push(options)
+      }
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: (cacheRotated) => cacheRotated,
+                loadSubset: async () => {},
+              }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      try {
+        collection.startSyncImmediate()
+        await atPersistedOracleCheckpoint(
+          vi.waitFor(() => expect(source).toBeDefined()),
+          `source sync entered`,
+        )
+        await collection._sync.loadSubset({ limit: 1 })
+        await source.metadata!.persistence!.startScopedRecovery!()
+        watchRefresh = true
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `scoped-refresh-notice`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows: [
+              { key: `fresh`, value: { id: `fresh`, title: `Fresh` } },
+            ],
+            deletedKeys: [],
+          },
+          `peer`,
+          newStorageId,
+        )
+        await atPersistedOracleCheckpoint(
+          refreshEntered.promise,
+          `scoped refresh acquisition entered`,
+        )
+        if (settleBeforeCleanup) {
+          releaseRefresh.resolve()
+          await atPersistedOracleCheckpoint(
+            vi.waitFor(() =>
+              expect(
+                releaseCalls.filter((options) => options === refreshOptions),
+              ).toHaveLength(1),
+            ),
+            `refresh settlement released its lease`,
+          )
+        }
+        const cleanup = collection.cleanup()
+        await atPersistedOracleCheckpoint(cleanup, `cleanup released refresh`)
+        expect(
+          releaseCalls.filter((options) => options === refreshOptions),
+        ).toHaveLength(1)
+        releaseRefresh.resolve()
+        await flushAsyncWork()
+        expect(
+          releaseCalls.filter((options) => options === refreshOptions),
+        ).toHaveLength(1)
+      } finally {
+        releaseRefresh.resolve()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A cached read may start under a live claim, then return after a paused
+  // tab's claim expires while its renewal timer is still queued. The read's
+  // old rows have no publication authority at that cut. The model discards
+  // them, rotates privately, and completes the retained demand from a new
+  // source snapshot. This gate holds the adapter result across the expiry;
+  // public rows, durable destination, and demand settlement distinguish a
+  // post-read fence from a check made only before the read.
+  it.each([
+    { outcome: `old rows returned`, expires: true },
+    { outcome: `claim check rejected`, expires: true },
+    { outcome: `live claim I/O failure`, expires: false },
+  ] as const)(
+    `handles a held subset read when $outcome`,
+    async ({ outcome, expires }) => {
+      const adapter = createRecordingAdapter()
+      const readEntered = createEventGate()
+      const releaseRead = createEventGate()
+      let now = 1_000
+      let storageId = `read-expiry-old`
+      let sourceLoads = 0
+      const ioFailure = new Error(`subset read I/O failure`)
+      adapter.getCacheGenerationNow = () => now
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: storageId,
+        claimId: `read-expiry-claim`,
+        expiresAtMs: 11_000,
+      })
+      adapter.renewCacheGenerationClaim = async (id) =>
+        id === `read-expiry-old` && now >= 11_000 ? undefined : now + 10_000
+      adapter.rotateCacheGeneration = async () => {
+        return {
+          storageCollectionId: (storageId = `read-expiry-new`),
+          claimId: `read-expiry-claim`,
+          expiresAtMs: now + 10_000,
+        }
+      }
+      adapter.releaseCacheGenerationClaim = async () => {}
+      adapter.loadSubset = async (id) => {
+        if (recordedStorageId(id) === `read-expiry-old`) {
+          readEntered.resolve()
+          await releaseRead.promise
+          if (outcome === `claim check rejected`) {
+            throw new InvalidPersistedCollectionConfigError(
+              `Persisted cache claim is no longer active for collection "${id}"`,
+            )
+          }
+          if (outcome === `live claim I/O failure`) throw ioFailure
+          return [
+            {
+              key: `stale`,
+              value: { id: `stale`, title: `Expired cached row` },
+            },
+          ]
+        }
+        return []
+      }
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `read-expiry-publication`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async () => {
+                  expect(collection.get(`stale`)).toBeUndefined()
+                  sourceLoads++
+                  source.begin()
+                  source.write({
+                    type: `insert`,
+                    value: { id: `fresh`, title: `New source row` },
+                  })
+                  await whenSyncAccepted(source.commit())
+                },
+              }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      try {
+        await collection.stateWhenReady()
+        const demand = Promise.resolve(
+          collection._sync.loadSubset({ limit: 1 }),
+        )
+        void demand.catch(() => undefined)
+        await atPersistedOracleCheckpoint(readEntered.promise, `old cache read`)
+        if (expires) now = 11_001
+        releaseRead.resolve()
+        const [settlement] = await atPersistedOracleCheckpoint(
+          Promise.allSettled([demand]),
+          `held subset demand settlement`,
+        )
+        if (!expires) {
+          expect(settlement).toEqual({ status: `rejected`, reason: ioFailure })
+          expect(storageId).toBe(`read-expiry-old`)
+          expect(sourceLoads).toBe(0)
+          expect(collection.get(`stale`)).toBeUndefined()
+          return
+        }
+        expect(settlement.status).toBe(`fulfilled`)
+        expect(collection.get(`stale`)).toBeUndefined()
+        expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
+        expect(storageId).toBe(`read-expiry-new`)
+        expect(sourceLoads).toBe(1)
+        expect(
+          adapter.applyCommittedTxCalls
+            .filter((call) =>
+              call.tx.mutations.some((mutation) => mutation.key === `fresh`),
+            )
+            .map((call) => call.collectionId),
+        ).toEqual([`read-expiry-new`])
+      } finally {
+        releaseRead.resolve()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // Resume certification is another consumer of a persisted snapshot. A read
+  // may pass SQLite's claim check while live, then return after expiry. The
+  // independent rule gives neither its old answer nor its claim-check failure
+  // authority to certify the old key set: the run moves to private storage.
+  // A still-live claim with an unrelated I/O failure is terminal instead.
+  // The history holds only certification, optionally expires the claim, then
+  // compares settlement, evidence, storage route, and public status. Startup,
+  // hydration, and replay have separate held-read witnesses; none exercises
+  // this resume-certification boundary.
+  it.each([
+    { readOutcome: `old snapshot returned`, failure: `none`, expires: true },
+    { readOutcome: `claim check rejected`, failure: `claim`, expires: true },
+    { readOutcome: `live claim I/O failure`, failure: `io`, expires: false },
+  ] as const)(
+    `handles held resume certification when $readOutcome`,
+    async ({ failure, expires }) => {
+      const adapter = createRecordingAdapter()
+      const readEntered = createEventGate()
+      const releaseRead = createEventGate()
+      const oldStorageId = `certification-expiry-old`
+      const newStorageId = `certification-expiry-new`
+      let storageId = oldStorageId
+      let now = 1_000
+      let rotations = 0
+      let holdCertification = false
+      const ioFailure = new Error(`certification read I/O failure`)
+      adapter.getCacheGenerationNow = () => now
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: storageId,
+        claimId: `certification-expiry-claim`,
+        expiresAtMs: 11_000,
+      })
+      adapter.renewCacheGenerationClaim = async (id) =>
+        id === oldStorageId && now >= 11_000 ? undefined : now + 10_000
+      adapter.rotateCacheGeneration = async () => {
+        rotations++
+        storageId = newStorageId
+        return {
+          storageCollectionId: newStorageId,
+          claimId: `certification-expiry-claim`,
+          expiresAtMs: now + 10_000,
+        }
+      }
+      adapter.releaseCacheGenerationClaim = async () => {}
+      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+      adapter.loadResumeSnapshot = async (...args) => {
+        const snapshot = await loadResumeSnapshot(...args)
+        if (holdCertification && recordedStorageId(args[0]) === oldStorageId) {
+          readEntered.resolve()
+          await releaseRead.promise
+          if (failure === `claim`) {
+            throw new InvalidPersistedCollectionConfigError(
+              `Persisted cache claim is no longer active for collection "${oldStorageId}"`,
+            )
+          }
+          if (failure === `io`) throw ioFailure
+        }
+        return snapshot
+      }
+      let persistenceCapability:
+        SyncMetadataApi<string>[`persistence`] | undefined
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `certification-expiry-public`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              persistenceCapability = params.metadata?.persistence
+              params.markReady()
+              return { restartAfterScopedRecovery: () => {} }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      let certification: Promise<void> | undefined
+      try {
+        await collection.stateWhenReady()
+        expect(
+          persistenceCapability?.resumeSnapshot.getKeySetEvidence(),
+        ).toEqual({ status: `consistent` })
+        holdCertification = true
+        certification = persistenceCapability?.resumeSnapshot.certify()
+        if (!certification) throw new Error(`Missing resume certification`)
+        void certification.catch(() => undefined)
+        await atPersistedOracleCheckpoint(
+          readEntered.promise,
+          `held resume certification`,
+        )
+        if (expires) now = 11_001
+        releaseRead.resolve()
+        const outcome = await atPersistedOracleCheckpoint(
+          Promise.allSettled([certification]),
+          `held resume certification settlement`,
+        )
+        if (expires) {
+          expect(outcome[0].status).toBe(`fulfilled`)
+          expect(rotations).toBe(1)
+          expect(storageId).toBe(newStorageId)
+          expect(
+            persistenceCapability?.resumeSnapshot.getKeySetEvidence(),
+          ).toEqual({ status: `incompatible` })
+          expect(collection.status).not.toBe(`crashed`)
+        } else {
+          expect(outcome).toEqual([{ status: `rejected`, reason: ioFailure }])
+          expect(rotations).toBe(0)
+          expect(storageId).toBe(oldStorageId)
+          expect(collection.status).toBe(`crashed`)
+        }
+      } finally {
+        releaseRead.resolve()
+        await Promise.allSettled([certification])
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A peer notification may begin a full reload while the cache claim is
+  // valid, then hold its persisted read until that claim expires. The cached
+  // result loses publication authority at that cut. The independent rule is
+  // the same as for a direct subset read: discard the old result, rotate this
+  // run's cache, and reload its retained demand from the source. The adapter
+  // may return the old rows or reject at its second claim check. A still-live
+  // claim with an unrelated read failure is a control: it must remain terminal.
+  // A check only when the notification arrives misses both expiry histories.
+  // The held adapter read fixes the order; public rows and Collection status
+  // after release are the comparison cut.
+  it.each([
+    { readOutcome: `old rows returned`, failure: `none`, expires: true },
+    { readOutcome: `claim check rejected`, failure: `claim`, expires: true },
+    { readOutcome: `live claim I/O error`, failure: `io`, expires: false },
+  ])(
+    `handles a peer full reload when $readOutcome`,
+    async ({ failure, expires }) => {
+      const adapter = createRecordingAdapter()
+      const oldStorageId = `peer-reload-old`
+      const newStorageId = `peer-reload-new`
+      const coordinator = createFailStopCoordinatorHarness(oldStorageId)
+      const readEntered = createEventGate()
+      const releaseRead = createEventGate()
+      const readError = new Error(`Persisted peer reload I/O failed`)
+      let now = 1_000
+      let expiresAtMs = 11_000
+      let readCount = 0
+      let rotations = 0
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: oldStorageId,
+        claimId: `peer-reload-claim`,
+        expiresAtMs,
+      })
+      adapter.getCacheGenerationNow = () => now
+      adapter.renewCacheGenerationClaim = async () => {
+        if (now >= expiresAtMs) return undefined
+        expiresAtMs = now + 10_000
+        return expiresAtMs
+      }
+      adapter.rotateCacheGeneration = async () => {
+        rotations++
+        return {
+          storageCollectionId: newStorageId,
+          claimId: `peer-reload-claim`,
+          expiresAtMs: now + 10_000,
+        }
+      }
+      adapter.releaseCacheGenerationClaim = async () => {}
+      adapter.loadSubset = async (storageId) => {
+        if (recordedStorageId(storageId) !== oldStorageId) return []
+        if (++readCount === 1) {
+          return [{ key: `old`, value: { id: `old`, title: `Initial row` } }]
+        }
+        readEntered.resolve()
+        await releaseRead.promise
+        if (failure === `claim`) {
+          throw new InvalidPersistedCollectionConfigError(
+            `Persisted cache claim is no longer active for collection "${oldStorageId}"`,
+          )
+        }
+        if (failure === `io`) throw readError
+        return [{ key: `old`, value: { id: `old`, title: `Expired peer row` } }]
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `peer-reload-expiry`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (source) => {
+              source.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: () => true,
+              }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      try {
+        collection.startSyncImmediate()
+        await collection.stateWhenReady()
+        await collection._sync.loadSubset({ limit: 1 })
+        expect(collection.get(`old`)?.title).toBe(`Initial row`)
+
+        coordinator.emit({
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `peer-full-reload`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        })
+        await atPersistedOracleCheckpoint(
+          readEntered.promise,
+          `peer reload read`,
+        )
+        if (expires) now = expiresAtMs + 1
+        releaseRead.resolve()
+        await flushAsyncWork()
+
+        if (failure === `io`) {
+          expect(collection.status).toBe(`crashed`)
+          expect(collection.get(`old`)?.title).toBe(`Initial row`)
+          expect(rotations).toBe(0)
+          await expect(collection._sync.loadSubset({})).rejects.toBe(readError)
+          return
+        }
+        expect(collection.get(`old`)?.title).not.toBe(`Expired peer row`)
+        expect(collection.status).not.toBe(`crashed`)
+        await vi.waitFor(() => expect(rotations).toBe(1))
+        expect(collection.get(`old`)).toBeUndefined()
+      } finally {
+        releaseRead.resolve()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A persisted row scan is an exposed read, even though it does not publish
+  // rows to the Collection. Two sync runs initially claim the same cache
+  // generation. The model keeps the warm peer's claim and rows intact when the
+  // other claim expires. A held old scan must not return those rows to its
+  // caller; it retries against that run's private generation instead. The
+  // adapter gate fixes expiry after the old read but before its result reaches
+  // the caller. Both scan results and the peer's later read are observations.
+  it(`retries a held persisted row scan after only its claim expires`, async () => {
+    const adapter = createRecordingAdapter()
+    const scanEntered = createEventGate()
+    const releaseScan = createEventGate()
+    const oldRow = { key: `old`, value: { id: `old`, title: `Warm peer row` } }
+    const freshRow = {
+      key: `fresh`,
+      value: { id: `fresh`, title: `Private generation row` },
+    }
+    const scanRoutes: Array<{ storageId: string; claimId?: string }> = []
+    let claims = 0
+    let expired = false
+    let rotations = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `scan-old-storage`,
+      claimId: ++claims === 1 ? `scan-warm-claim` : `scan-expiring-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async (_storageId, claimId) =>
+      expired && claimId === `scan-expiring-claim`
+        ? undefined
+        : Date.now() + 10_000
+    adapter.rotateCacheGeneration = async (
+      _collectionId,
+      claimId,
+      _resetMetadata,
+      expectedStorageId,
+    ) => {
+      expect(claimId).toBe(`scan-expiring-claim`)
+      expect(expectedStorageId).toBe(`scan-old-storage`)
+      rotations++
+      return {
+        storageCollectionId: `scan-private-storage`,
+        claimId: `scan-private-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.scanRows = async (storageId, _options, context) => {
+      scanRoutes.push({
+        storageId: recordedStorageId(storageId),
+        claimId: context?.cacheGenerationClaimId,
+      })
+      if (
+        recordedStorageId(storageId) === `scan-old-storage` &&
+        context?.cacheGenerationClaimId === `scan-expiring-claim`
+      ) {
+        scanEntered.resolve()
+        await releaseScan.promise
+      }
+      return recordedStorageId(storageId) === `scan-private-storage`
+        ? [freshRow]
+        : [oldRow]
+    }
+
+    let warmSource!: TodoSyncParams
+    let expiringSource!: TodoSyncParams
+    const makePeer = (onStart: (source: TodoSyncParams) => void) =>
+      createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `held-scan-peers`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              onStart(params)
+              params.markReady()
+              return { restartAfterScopedRecovery: () => {} }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+    const warm = makePeer((source) => {
+      warmSource = source
+    })
+    const expiring = makePeer((source) => {
+      expiringSource = source
+    })
+    try {
+      warm.startSyncImmediate()
+      await warm.stateWhenReady()
+      expiring.startSyncImmediate()
+      await expiring.stateWhenReady()
+      expect(
+        await warmSource.metadata!.persistence!.scanPersistedRows(),
+      ).toEqual([oldRow])
+
+      const heldScan = expiringSource.metadata!.persistence!.scanPersistedRows()
+      await atPersistedOracleCheckpoint(scanEntered.promise, `old row scan`)
+      expired = true
+      releaseScan.resolve()
+      expect(
+        await atPersistedOracleCheckpoint(heldScan, `private row scan`),
+      ).toEqual([freshRow])
+      expect(rotations).toBe(1)
+      expect(scanRoutes).toContainEqual({
+        storageId: `scan-private-storage`,
+        claimId: `scan-private-claim`,
+      })
+      expect(
+        await warmSource.metadata!.persistence!.scanPersistedRows(),
+      ).toEqual([oldRow])
+      expect(warm.status).toBe(`ready`)
+    } finally {
+      releaseScan.resolve()
+      await expiring.cleanup()
+      await warm.cleanup()
+    }
+  })
+
+  // A coordinator replay may read a valid persisted cache generation, then
+  // return after this sync run's claim expires. Its deltas cannot publish
+  // under that expired claim. The independent model leaves the peer's head
+  // intact and rotates only this run's cache before any old row is visible.
+  // The held pull fixes the expiry cut; public rows and the private rotation
+  // are checked after the response rather than at request admission.
+  it(`discards a seq-gap replay returned after its cache claim expires`, async () => {
+    const adapter = createRecordingAdapter()
+    const id = `expired-seq-gap-replay`
+    const coordinator = createFailStopCoordinatorHarness(`replay-old-storage`)
+    const pullEntered = createEventGate()
+    const releasePull = createEventGate()
+    let expired = false
+    let storageId = `replay-old-storage`
+    let rotations = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `replay-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async () =>
+      expired ? undefined : Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      return {
+        storageCollectionId: (storageId = `replay-private-storage`),
+        claimId: `replay-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    coordinator.pullSince = async () => {
+      pullEntered.resolve()
+      await releasePull.promise
+      return {
+        type: `rpc:pullSince:res`,
+        rpcId: `expired-pull`,
+        ok: true,
+        latestTerm: 1,
+        latestSeq: 2,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedKeys: [`old`],
+        deletedKeys: [],
+        deltas: [
+          {
+            txId: `old-delta`,
+            latestRowVersion: 2,
+            changedRows: [
+              {
+                key: `old`,
+                value: { id: `old`, title: `Expired replay row` },
+              },
+            ],
+            deletedKeys: [],
+            rowMetadataMutations: [],
+            collectionMetadataMutations: [],
+          },
+        ],
+      }
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            params.markReady()
+            return {
+              loadSubset: async () => {},
+              restartAfterScopedRecovery: () => {},
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      await collection._sync.loadSubset({})
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `gap-trigger`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(pullEntered.promise, `seq-gap pull`)
+      expired = true
+      releasePull.resolve()
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(collection.get(`old`)).toBeUndefined()
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(rotations).toBe(1)),
+        `private replay recovery`,
+      )
+      expect(storageId).toBe(`replay-private-storage`)
+    } finally {
+      releasePull.resolve()
+      await collection.cleanup()
+    }
+  })
+
+  // A source commit that arrives before a paused tab's renewal timer runs
+  // must not publish or persist under the expired claim. The independent
+  // history expires the claim immediately before commit admission, then lets
+  // recovery advance to private empty storage. The rejected receipt and
+  // exact destination of the following commit are the observations.
+  it(`rejects an old source commit after cache claim expiry and permits a new one`, async () => {
+    const adapter = createRecordingAdapter()
+    const claimId = `expired-write-claim`
+    let storageId = `expired-write-old`
+    let active = true
+    let renewals = 0
+    let rotations = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      return active ? Date.now() + 10_000 : undefined
+    }
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      active = true
+      return {
+        storageCollectionId: (storageId = `expired-write-new`),
+        claimId,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    let source!: TodoSyncParams
+    const sourceRestarted = createEventGate()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `expired-source-write`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            // Both old commits have entered the wrapper before rotation.
+            return {
+              // An on-demand source serves the subsets that recovery
+              // reacquires in the new generation.
+              loadSubset: () => true,
+              restartAfterScopedRecovery: (cacheRotated) =>
+                cacheRotated.then(() => sourceRestarted.resolve()),
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      await source.metadata!.persistence!.hydrateBaseline()
+      // Baseline hydration is still authorized; expiry starts at commit admission.
+      active = false
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `old`, title: `Expired claim` },
+      })
+      const oldReceipt = source.commit()
+      if (oldReceipt === true) throw new Error(`source receipt was not tracked`)
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `second-old`, title: `Queued expired claim` },
+      })
+      const secondOldReceipt = source.commit()
+      if (secondOldReceipt === true)
+        throw new Error(`second source receipt was not tracked`)
+      await expect(oldReceipt).rejects.toBeInstanceOf(
+        SyncTransactionAbortedError,
+      )
+      await expect(secondOldReceipt).rejects.toBeInstanceOf(
+        SyncTransactionAbortedError,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(storageId).toBe(`expired-write-new`)),
+        `claim expiry recovery`,
+      )
+      await atPersistedOracleCheckpoint(
+        sourceRestarted.promise,
+        `replacement source restart`,
+      )
+      expect(rotations).toBe(1)
+      expect(renewals).toBeGreaterThan(0)
+      expect(collection.get(`old`)).toBeUndefined()
+      expect(collection.get(`second-old`)).toBeUndefined()
+      expect(
+        adapter.applyCommittedTxCalls.filter((call) =>
+          call.tx.mutations.some(
+            (mutation) =>
+              mutation.key === `old` || mutation.key === `second-old`,
+          ),
+        ),
+      ).toEqual([])
+      // Recovery succeeded: the Collection still accepts sync data.
+      expect(collection.status).toBe(`ready`)
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `new`, title: `New private generation` },
+      })
+      await whenSyncAccepted(source.commit())
+      expect(collection.get(`new`)).toMatchObject({ id: `new` })
+      expect(
+        adapter.applyCommittedTxCalls
+          .filter((call) =>
+            call.tx.mutations.some((mutation) => mutation.key === `new`),
+          )
+          .map((call) => call.collectionId),
+      ).toEqual([`expired-write-new`])
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // Claim expiry revokes durable source authority, but it does not settle a
+  // local optimistic transaction. The model keeps that row visible until its
+  // mutation function settles, clears the old source base, then accepts a
+  // fresh source commit in the new generation. This checkpoint also detects
+  // a recovery that waits for visibility of its truncate behind the mutation.
+  it(`recovers an expired cache claim beneath a persisting optimistic mutation`, async () => {
+    const adapter = createRecordingAdapter()
+    let storageId = `optimistic-expiry-old`
+    let expired = false
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `optimistic-expiry-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async () =>
+      expired ? undefined : Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      expired = false
+      return {
+        storageCollectionId: (storageId = `optimistic-expiry-new`),
+        claimId: `optimistic-expiry-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const entered = createDeferred()
+    const release = createDeferred()
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `optimistic-expiry`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            // This controlled source delivers only explicit test writes.
+            return { restartAfterScopedRecovery: () => {} }
+          },
+        },
+        persistence: { adapter },
+        onInsert: async () => {
+          entered.resolve()
+          await release.promise
+        },
+      }),
+    )
+    let mutation: ReturnType<typeof collection.insert> | undefined
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      mutation = collection.insert({ id: `local`, title: `Pending` })
+      await entered.promise
+      expect(collection.get(`local`)).toMatchObject({ id: `local` })
+      expired = true
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `old`, title: `Expired source` },
+      })
+      const staleReceipt = source.commit()
+      if (staleReceipt === true)
+        throw new Error(`source receipt was not tracked`)
+      await expect(staleReceipt).rejects.toBeInstanceOf(
+        SyncTransactionAbortedError,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(storageId).toBe(`optimistic-expiry-new`)),
+        `expired optimistic recovery`,
+      )
+      expect(collection.get(`local`)).toMatchObject({ id: `local` })
+      expect(collection.get(`old`)).toBeUndefined()
+      release.resolve()
+      await mutation.isPersisted.promise
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `fresh`, title: `New source` },
+      })
+      await whenSyncAccepted(source.commit())
+      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
+      expect(
+        adapter.applyCommittedTxCalls
+          .filter((call) =>
+            call.tx.mutations.some((entry) => entry.key === `fresh`),
+          )
+          .map((call) => call.collectionId),
+      ).toEqual([`optimistic-expiry-new`])
+    } finally {
+      release.resolve()
+      await mutation?.isPersisted.promise.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+
+  // A warm run with an active demand renews its claim while timers run. If a
+  // long pause lets the claim expire, that timer must start scoped recovery
+  // and reacquire the active subset from the source. The held wall-clock
+  // interval is bounded; the source call log distinguishes a wakeup from a
+  // run that silently stays on the old cache.
+  it(`reloads an active subset when its renewal timer finds an expired claim`, async () => {
+    const adapter = createRecordingAdapter()
+    let storageId = `timer-old-storage`
+    let renewals = 0
+    let rotations = 0
+    let expired = false
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `timer-claim`,
+      expiresAtMs: Date.now() + 80,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      return expired ? undefined : Date.now() + 80
+    }
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      return {
+        storageCollectionId: (storageId = `timer-new-storage`),
+        claimId: `timer-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const sourceLoads: Array<{ refetch?: boolean }> = []
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `timer-claim-reload`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            params.markReady()
+            return {
+              // The first load has settled before the claim-expiry timer.
+              restartAfterScopedRecovery: () => {},
+              loadSubset: (options) => {
+                sourceLoads.push({ refetch: options.refetch })
+                return Promise.resolve()
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      await collection._sync.loadSubset({ limit: 1 })
+      expect(sourceLoads).toEqual([{ refetch: undefined }])
+      expired = true
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(rotations).toBe(1)),
+        `expired timer recovery`,
+      )
+      expect(renewals).toBeGreaterThan(0)
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(sourceLoads).toHaveLength(2)),
+        `active subset reload`,
+      )
+      expect(sourceLoads[1]).toEqual({ refetch: true })
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // A live claim with more than one timer interval remaining needs no durable
+  // renewal write for each source commit or subset read. The adapter checks
+  // claim authority at its storage boundary, while the timer maintains an
+  // otherwise idle run. The independent clock and call ledger require zero
+  // foreground renewals far from expiry and one when less than a minute
+  // remains. The row receipts and subset loads still complete at both cuts.
+  it(`renews a live cache claim only near expiry during foreground work`, async () => {
+    const adapter = createRecordingAdapter()
+    let now = 1_000
+    let expiresAtMs = 301_000
+    let renewals = 0
+    let rotations = 0
+    adapter.getCacheGenerationNow = () => now
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `foreground-renewal-storage`,
+      claimId: `foreground-renewal-claim`,
+      expiresAtMs,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      if (now >= expiresAtMs) return undefined
+      return (expiresAtMs = now + 300_000)
+    }
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      return {
+        storageCollectionId: `foreground-renewal-new`,
+        claimId: `foreground-renewal-claim`,
+        expiresAtMs: (expiresAtMs = now + 300_000),
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `foreground-claim-renewal`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { restartAfterScopedRecovery: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const commit = async (id: string) => {
+      source.begin()
+      source.write({ type: `insert`, value: { id, title: id } })
+      await whenSyncAccepted(source.commit())
+    }
+    try {
+      await collection.stateWhenReady()
+      const startupRenewals = renewals
+      for (let index = 0; index < 6; index++) {
+        await commit(`far-${index}`)
+        await collection._sync.loadSubset({ limit: index + 1 })
+      }
+      expect(renewals).toBe(startupRenewals)
+      expect(collection.get(`far-5`)).toMatchObject({ id: `far-5` })
+      expect(rotations).toBe(0)
+
+      now = 251_000
+      await commit(`near`)
+      expect(renewals).toBe(startupRenewals + 1)
+      expect(collection.get(`near`)).toMatchObject({ id: `near` })
+      await collection._sync.loadSubset({ limit: 7 })
+      expect(renewals).toBe(startupRenewals + 1)
+      expect(rotations).toBe(0)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // Skipping a far-from-expiry timer check must arm its successor. This
+  // virtual-clock history observes no durable renewal at the first minute,
+  // then one renewal when the same idle claim enters the one-minute window.
+  // It distinguishes a cheap timer wake from accidentally consuming the only
+  // renewal opportunity.
+  it(`reschedules a skipped cache-claim timer until renewal is due`, async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(1_000)
+    const adapter = createRecordingAdapter()
+    let expiresAtMs = Date.now() + 180_000
+    let renewals = 0
+    let rotations = 0
+    adapter.getCacheGenerationNow = () => Date.now()
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `idle-renewal-storage`,
+      claimId: `idle-renewal-claim`,
+      expiresAtMs,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      if (Date.now() >= expiresAtMs) return undefined
+      return (expiresAtMs = Date.now() + 180_000)
+    }
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      return {
+        storageCollectionId: `idle-renewal-new`,
+        claimId: `idle-renewal-claim`,
+        expiresAtMs: (expiresAtMs = Date.now() + 180_000),
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `idle-claim-renewal`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { restartAfterScopedRecovery: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      const startupRenewals = renewals
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(renewals).toBe(startupRenewals)
+      expect(collection.status).toBe(`ready`)
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(renewals).toBe(startupRenewals + 1)
+      expect(rotations).toBe(0)
+      expect(collection.status).toBe(`ready`)
+    } finally {
+      await collection.cleanup()
+      vi.useRealTimers()
+    }
+  })
+
+  // A timer's transient renewal failure does not prove that the claim has
+  // expired. The independent clock model keeps the old claim through the
+  // failed attempt, retries before expiry, and never publishes an error or
+  // rotates storage. The scheduled retry, status and storage route are checked
+  // after each virtual-clock cut; treating every rejection as terminal fails
+  // at the first cut.
+  it(`retries a transient cache-claim renewal error while the claim is live`, async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(1_000)
+    const adapter = createRecordingAdapter()
+    let renewals = 0
+    let rotations = 0
+    let failNextRenewal = false
+    adapter.getCacheGenerationNow = () => Date.now()
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `timer-transient-old`,
+      claimId: `timer-transient-claim`,
+      expiresAtMs: Date.now() + 1_000,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      if (failNextRenewal) {
+        failNextRenewal = false
+        throw new Error(`transient SQLITE_BUSY`)
+      }
+      return Date.now() + 1_000
+    }
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      return {
+        storageCollectionId: `timer-transient-new`,
+        claimId: `timer-transient-claim`,
+        expiresAtMs: Date.now() + 1_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `timer-transient-renewal`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            params.markReady()
+            return { restartAfterScopedRecovery: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      failNextRenewal = true
+      await vi.advanceTimersByTimeAsync(500)
+      expect(collection.status).toBe(`ready`)
+      expect(rotations).toBe(0)
+      const countAfterFailure = renewals
+      await vi.advanceTimersByTimeAsync(250)
+      expect(renewals).toBeGreaterThan(countAfterFailure)
+      expect(collection.status).toBe(`ready`)
+      expect(rotations).toBe(0)
+    } finally {
+      await collection.cleanup()
+      vi.useRealTimers()
+    }
+  })
+
+  // Recovery can accept a new storage generation while its source restart is
+  // still held. A renewal timer consumed during that hold cannot renew: its
+  // own claim check joins the in-flight recovery. The independent clock model
+  // therefore starts the new timer after source restart, then renews before
+  // the replacement claim expires. No further demand drives this checkpoint.
+  it(`renews a replacement cache claim after a held source restart`, async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(1_000)
+    const adapter = createRecordingAdapter()
+    const sourceHeld = createEventGate()
+    const releaseSource = createEventGate()
+    const sourceFinished = createEventGate()
+    let renewals = 0
+    let rotations = 0
+    adapter.getCacheGenerationNow = () => Date.now()
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `held-source-old`,
+      claimId: `held-source-claim`,
+      expiresAtMs: 2_000,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      renewals++
+      return rotations === 0 && Date.now() >= 2_000
+        ? undefined
+        : Date.now() + 1_000
+    }
+    adapter.rotateCacheGeneration = async () => {
+      rotations++
+      return {
+        storageCollectionId: `held-source-new`,
+        claimId: `held-source-claim`,
+        expiresAtMs: Date.now() + 1_000,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `held-source-renewal`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            params.markReady()
+            return {
+              restartAfterScopedRecovery: (cacheRotated) =>
+                cacheRotated.then(async () => {
+                  sourceHeld.resolve()
+                  await releaseSource.promise
+                  sourceFinished.resolve()
+                }),
+              loadSubset: () => Promise.resolve(),
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      vi.setSystemTime(2_100)
+      await vi.advanceTimersByTimeAsync(500)
+      await sourceHeld.promise
+      expect(rotations).toBe(1)
+      await vi.advanceTimersByTimeAsync(500)
+      releaseSource.resolve()
+      await sourceFinished.promise
+      for (let turn = 0; turn < 20; turn++) await Promise.resolve()
+      const afterRecovery = renewals
+      await vi.advanceTimersByTimeAsync(260)
+      expect(renewals).toBeGreaterThan(afterRecovery)
+      expect(collection.status).toBe(`ready`)
+    } finally {
+      releaseSource.resolve()
+      await collection.cleanup()
+      vi.useRealTimers()
+    }
+  })
+
+  // A local cache clear supplies no source-readiness evidence. The model starts
+  // loading, accepts the scoped truncate, and remains loading until the source
+  // explicitly marks ready. This wrapper-path check observes status after the
+  // truncate commit, where the core default could otherwise publish readiness.
+  it(`keeps initial Collection loading through a scoped cache clear`, async () => {
+    const adapter = createRecordingAdapter()
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `scoped-clear-readiness`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await flushAsyncWork()
+      expect(collection.status).toBe(`loading`)
+      await source.metadata!.persistence!.startScopedRecovery!()
+      expect(collection.status).toBe(`loading`)
+      source.markReady()
+      await flushAsyncWork()
+      expect(collection.status).toBe(`ready`)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // Core applies an accepted truncate even while a local optimistic handler
+  // persists. The source may continue after this accepted clear; a later subset
+  // still waits for its own applied rows. This held-handler cut tests the
+  // review's proposed acceptance/application cycle on the actual wrapper path.
+  it(`accepts a scoped cache clear while an optimistic handler is held`, async () => {
+    const adapter = createRecordingAdapter()
+    const entered = createDeferred()
+    const release = createDeferred()
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `scoped-clear-held-handler`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+        onInsert: async () => {
+          entered.resolve()
+          await release.promise
+        },
+      }),
+    )
+    let mutation: ReturnType<typeof collection.insert> | undefined
+
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      mutation = collection.insert({ id: `local`, title: `Pending` })
+      await entered.promise
+      const recovery = observeSettlement(
+        source.metadata!.persistence!.startScopedRecovery!(),
+      )
+      await flushAsyncWork()
+      expect(recovery.read()).toEqual({ status: `fulfilled` })
+      expect(collection.get(`local`)).toBeDefined()
+      release.resolve()
+      await mutation.isPersisted.promise
+    } finally {
+      release.resolve()
+      await mutation?.isPersisted.promise.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-cleanup.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-cleanup.test.ts
new file mode 100644
index 0000000000..a2000099a6
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-cleanup.test.ts
@@ -0,0 +1,55 @@
+/**
+ * Harness self-test for the persisted oracle's cleanup helper: every cleanup action runs, and a primary failure is not hidden. The cleanup law is owned by persisted-oracle.test.ts through cleanupPersistedOracle; this file is an ordinary test of that machinery.
+ */
+import { expect, it, vi } from 'vitest'
+import { cleanupPersistedOracle } from './persisted-support'
+
+it.each([false, true])(
+  `persisted oracle cleanup attempts every action without hiding a primary failure: %s`,
+  async (hasPrimaryFailure) => {
+    const firstFailure = new Error(`first oracle cleanup failure`)
+    const secondFailure = new Error(`second oracle cleanup failure`)
+    const attempts: Array<string> = []
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+
+    try {
+      const outcome = await cleanupPersistedOracle(
+        [
+          () => {
+            attempts.push(`first`)
+            throw firstFailure
+          },
+          () => {
+            attempts.push(`second`)
+            return Promise.reject(secondFailure)
+          },
+          () => {
+            attempts.push(`last`)
+          },
+        ],
+        hasPrimaryFailure,
+      ).then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+
+      expect(attempts).toEqual([`first`, `second`, `last`])
+      if (hasPrimaryFailure) {
+        expect(outcome).toBeUndefined()
+        expect(warning).toHaveBeenCalledWith(
+          `Persisted oracle cleanup failed after the primary failure:`,
+          [firstFailure, secondFailure],
+        )
+      } else {
+        expect(outcome).toBeInstanceOf(AggregateError)
+        expect((outcome as AggregateError).errors).toEqual([
+          firstFailure,
+          secondFailure,
+        ])
+        expect(warning).not.toHaveBeenCalled()
+      }
+    } finally {
+      warning.mockRestore()
+    }
+  },
+)
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-demand.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-demand.test.ts
new file mode 100644
index 0000000000..6327bdafd4
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-demand.test.ts
@@ -0,0 +1,2397 @@
+/**
+ * Ordinary regression tests for persisted retained demand: synchronous answers from hydrated rows, failed reloads, partial updates, and acquisitions, as fixed scenarios. The demand laws are owned by persisted-oracle.test.ts, whose retained-demand property stays there.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection, createLiveQueryCollection, eq } from '@tanstack/db'
+import { persistedCollectionOptions } from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  configureHydrationScope,
+  createCoordinatorHarness,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createLocalCoordinatorHarness,
+  createRecordingAdapter,
+  flushAsyncWork,
+  hydrationScopeModes,
+  itUnlessAnyOracleReplay,
+  observeSettlement,
+  overrideBaselineRows,
+  stripVirtualProps,
+} from './persisted-support'
+import type { LoadSubsetOptions } from '@tanstack/db'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`answers only retained exact demands synchronously from hydrated rows`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `one` },
+      { id: `2`, title: `two` },
+    ])
+    const loadRows = adapter.loadSubset
+    adapter.loadSubset = async (...args) => {
+      const rows = await loadRows(...args)
+      return rows.slice(0, args[1].limit)
+    }
+    const coordinator = createLocalCoordinatorHarness()
+    const upstreamLoads: Array<LoadSubsetOptions> = []
+    const upstreamUnloads: Array<LoadSubsetOptions> = []
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: (options) => {
+                upstreamLoads.push(options)
+                return true
+              },
+              unloadSubset: (options) => upstreamUnloads.push(options),
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    collection.startSyncImmediate()
+    const first: LoadSubsetOptions = { limit: 2 }
+    const sibling: LoadSubsetOptions = { limit: 2 }
+    try {
+      await collection._sync.loadSubset(first)
+      const persistedReads = adapter.loadSubsetCalls.length
+
+      expect(collection._sync.loadSubset(sibling)).toBe(true)
+      expect(adapter.loadSubsetCalls).toHaveLength(persistedReads)
+      expect(upstreamLoads).toEqual([first, sibling])
+
+      collection._sync.unloadSubset(first)
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `retained-sibling`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+      })
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(collection.size).toBe(2)
+
+      collection._sync.unloadSubset(sibling)
+      const narrow: LoadSubsetOptions = { limit: 1 }
+      await collection._sync.loadSubset(narrow)
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `drop-released-demand`,
+        latestRowVersion: 2,
+        requiresFullReload: true,
+      })
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(collection.size).toBe(1)
+
+      const reacquired = collection._sync.loadSubset({ limit: 2 })
+      expect(reacquired).not.toBe(true)
+      await reacquired
+      expect(collection.size).toBe(2)
+      expect(upstreamUnloads).toEqual([first, sibling])
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`makes a sibling live query synchronously ready from a retained hydrated demand`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
+    const source = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydrated-demand-live-query`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    source.startSyncImmediate()
+    const query = () =>
+      createLiveQueryCollection({
+        query: (q) =>
+          q.from({ todo: source }).where(({ todo }) => eq(todo.id, `1`)),
+      })
+    const owner = query()
+    let sibling: ReturnType<typeof query> | undefined
+    try {
+      await owner.preload()
+      sibling = query()
+      // A live query is ready only after a subscriber or a preload asks for
+      // its data. Its first preload starts its sync run, so the retained demand
+      // makes it ready before that call returns.
+      void sibling.preload()
+      expect(sibling.status).toBe(`ready`)
+      expect(sibling.toArray.map(({ id }) => id)).toEqual([`1`])
+    } finally {
+      await sibling?.cleanup()
+      await owner.cleanup()
+      await source.cleanup()
+    }
+  })
+
+  it(`makes a loopback sibling synchronously ready from a retained hydrated demand`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
+    const source = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `loopback-hydrated-demand-live-query`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        persistence: { adapter },
+      }),
+    )
+    source.startSyncImmediate()
+    const query = () =>
+      createLiveQueryCollection({
+        query: (q) =>
+          q.from({ todo: source }).where(({ todo }) => eq(todo.id, `1`)),
+      })
+    const owner = query()
+    let sibling: ReturnType<typeof query> | undefined
+    try {
+      await owner.preload()
+      sibling = query()
+      // A live query is ready only after a subscriber or a preload asks for
+      // its data. Its first preload starts its sync run, so the retained demand
+      // makes it ready before that call returns.
+      void sibling.preload()
+      expect(sibling.status).toBe(`ready`)
+      expect(sibling.toArray.map(({ id }) => id)).toEqual([`1`])
+    } finally {
+      await sibling?.cleanup()
+      await owner.cleanup()
+      await source.cleanup()
+    }
+  })
+
+  it(`invalidates hydrated demand when the source truncates`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
+    let truncateSource!: () => void
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydrated-demand-truncate`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, truncate, commit, markReady }) => {
+            truncateSource = () => {
+              begin()
+              truncate()
+              commit()
+            }
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.startSyncImmediate()
+    try {
+      await collection._sync.loadSubset({ limit: 1 })
+      expect(collection.size).toBe(1)
+      truncateSource()
+      expect(collection.size).toBe(0)
+
+      const persistedReads = adapter.loadSubsetCalls.length
+      const reacquired = collection._sync.loadSubset({ limit: 1 })
+      expect(reacquired).not.toBe(true)
+      await reacquired
+      expect(adapter.loadSubsetCalls).toHaveLength(persistedReads + 1)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not restore hydrated coverage after a truncate overtakes a reload`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
+    const readSubset = adapter.loadSubset
+    let subsetReads = 0
+    let enterReload!: () => void
+    let releaseReload!: () => void
+    const reloadEntered = new Promise<void>((resolve) => {
+      enterReload = resolve
+    })
+    const reloadGate = new Promise<void>((resolve) => {
+      releaseReload = resolve
+    })
+    adapter.loadSubset = async (...args) => {
+      subsetReads++
+      if (subsetReads === 2) {
+        enterReload()
+        await reloadGate
+      }
+      return readSubset(...args)
+    }
+    const coordinator = createLocalCoordinatorHarness()
+    let truncateSource!: () => void
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, truncate, commit, markReady }) => {
+            truncateSource = () => {
+              begin()
+              truncate()
+              commit()
+            }
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    collection.startSyncImmediate()
+    try {
+      await collection._sync.loadSubset({ limit: 1 })
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `reload-before-truncate`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+      })
+      await reloadEntered
+      truncateSource()
+      releaseReload()
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(collection.size).toBe(0)
+
+      const readsBeforeReacquire = adapter.loadSubsetCalls.length
+      const reacquired = collection._sync.loadSubset({ limit: 1 })
+      expect(reacquired).not.toBe(true)
+      await reacquired
+      expect(adapter.loadSubsetCalls).toHaveLength(readsBeforeReacquire + 1)
+    } finally {
+      releaseReload()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not advertise hydrated coverage after a terminal reset reload failure`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
+    const readSubset = adapter.loadSubset
+    const failure = new Error(`reset reload failed`)
+    let failNextRead = false
+    adapter.loadSubset = async (...args) => {
+      if (failNextRead) {
+        failNextRead = false
+        throw failure
+      }
+      return readSubset(...args)
+    }
+    const coordinator = createLocalCoordinatorHarness()
+    const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: { sync: ({ markReady }) => (markReady(), {}) },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    collection.startSyncImmediate()
+    try {
+      const retained: LoadSubsetOptions = { limit: 1 }
+      await collection._sync.loadSubset(retained)
+      expect(collection.size).toBe(1)
+
+      failNextRead = true
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 1,
+      })
+      await flushAsyncWork()
+      await flushAsyncWork()
+      // Failed durable validation cannot retract the last public row. The
+      // failed run must still reject a later acquisition instead of treating
+      // that retained row as proof of hydrated coverage.
+      expect(stripVirtualProps(collection.get(`1`))).toEqual({
+        id: `1`,
+        title: `cached`,
+      })
+
+      const readsBeforeReacquire = adapter.loadSubsetCalls.length
+      const reacquired = collection._sync.loadSubset({ limit: 1 })
+      expect(reacquired).not.toBe(true)
+      await expect(Promise.resolve(reacquired)).rejects.toBe(failure)
+      expect(adapter.loadSubsetCalls).toHaveLength(readsBeforeReacquire)
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(failure)
+    } finally {
+      warn.mockRestore()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not retain refresh history as permanent subset demand`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Before` }])
+    const coordinator = createCoordinatorHarness()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        persistence: { adapter, coordinator },
+      }),
+    )
+    collection.startSyncImmediate()
+    try {
+      await collection._sync.loadSubset({ limit: 1 })
+      for (let i = 0; i < 20; i++)
+        await collection.utils.forceReloadSubset!({ limit: 1 })
+      const before = adapter.loadSubsetCalls.length
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `refresh-invalidation`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+      })
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(adapter.loadSubsetCalls.length - before).toBe(1)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`reports a non-abort upstream failure rather than treating hydration as remote success`, async () => {
+    const failure = new Error(`remote acquisition failed`)
+    const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `remote-acquisition-failure`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => Promise.reject(failure),
+            }
+          },
+        },
+        persistence: {
+          adapter: createRecordingAdapter([
+            { id: `cached`, title: `Last known row` },
+          ]),
+        },
+      }),
+    )
+    collection.startSyncImmediate()
+    try {
+      await expect(
+        Promise.resolve(collection._sync.loadSubset({})),
+      ).rejects.toBe(failure)
+      expect(stripVirtualProps(collection.get(`cached`))).toEqual({
+        id: `cached`,
+        title: `Last known row`,
+      })
+    } finally {
+      warn.mockRestore()
+      await collection.cleanup()
+    }
+  })
+
+  it(`keeps an incremental persisted subset failure request-local and retries without restart`, async () => {
+    const hydrationFailure = new Error(`later on-demand hydration failed`)
+    const adapter = createRecordingAdapter([
+      { id: `cached`, title: `Last successful snapshot` },
+    ])
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-on-demand-hydration-failure`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `on-demand collection initially ready`,
+      )
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
+        `initial persisted subset hydration`,
+      )
+      expect(stripVirtualProps(collection.get(`cached`))).toEqual({
+        id: `cached`,
+        title: `Last successful snapshot`,
+      })
+      expect(collection.status).toBe(`ready`)
+      adapter.loadSubset = () => Promise.reject(hydrationFailure)
+
+      // A distinct demand must still reach persistence; the retained exact
+      // demand above is eligible for the synchronous hydrated fast path.
+      await expect(
+        atPersistedOracleCheckpoint(
+          Promise.resolve(collection._sync.loadSubset({ limit: 2 })),
+          `later on-demand hydration rejected`,
+        ),
+      ).rejects.toBe(hydrationFailure)
+
+      expect(collection.status).toBe(`ready`)
+      expect(collection._lifecycle.getSyncError()).toBeUndefined()
+      expect(stripVirtualProps(collection.get(`cached`))).toEqual({
+        id: `cached`,
+        title: `Last successful snapshot`,
+      })
+      expect(adapter.applyCommittedTxCalls).toEqual([])
+
+      adapter.rows.set(`retry`, {
+        id: `retry`,
+        title: `Explicit retry succeeded`,
+      })
+      adapter.loadSubset = async () =>
+        Array.from(adapter.rows, ([key, value]) => ({ key, value }))
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(collection._sync.loadSubset({ limit: 2 })),
+        `request-local persisted subset retry`,
+      )
+      expect(stripVirtualProps(collection.get(`retry`))).toEqual({
+        id: `retry`,
+        title: `Explicit retry succeeded`,
+      })
+      expect(collection.status).toBe(`ready`)
+      expect(collection._lifecycle.getSyncError()).toBeUndefined()
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  itUnlessAnyOracleReplay.each(hydrationScopeModes)(
+    `settles hydration-buffered source work and reconciles an overlapping retry after incremental load rejection (%s scope)`,
+    async (scopeMode) => {
+      const failure = new Error(`incremental subset rejected exactly`)
+      const adapter = createRecordingAdapter()
+      const loadPersistedRows = adapter.loadSubset.bind(adapter)
+      const loadEntered = createEventGate()
+      const rejectLoad = createEventGate()
+      adapter.loadSubset = async () => {
+        loadEntered.resolve()
+        await rejectLoad.promise
+        throw failure
+      }
+      const routing = configureHydrationScope(adapter, scopeMode)
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `request-local-failure-releases-source-receipt`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      let load: Promise<void> | undefined
+      let receipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
+
+      try {
+        await atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `request-local receipt collection ready`,
+        )
+        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+          () => undefined,
+        )
+        void load.catch(() => undefined)
+        await atPersistedOracleCheckpoint(
+          loadEntered.promise,
+          `request-local hydration entered`,
+        )
+
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `source`, title: `Must outlive request failure` },
+        })
+        receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+        const receiptState = observeSettlement(receipt)
+        expect(receiptState.read()).toEqual({ status: `pending` })
+
+        rejectLoad.resolve()
+        await expect(
+          atPersistedOracleCheckpoint(load, `request-local load rejected`),
+        ).rejects.toBe(failure)
+        await atPersistedOracleCheckpoint(
+          receipt,
+          `hydration-buffered source receipt settled`,
+        )
+
+        expect({
+          receipt: receiptState.read(),
+          status: collection.status,
+          publicError: collection._lifecycle.getSyncError(),
+          publicRow: stripVirtualProps(collection.get(`source`)),
+          durableRow: adapter.rows.get(`source`),
+        }).toEqual({
+          receipt: { status: `fulfilled` },
+          status: `ready`,
+          publicError: undefined,
+          publicRow: { id: `source`, title: `Must outlive request failure` },
+          durableRow: { id: `source`, title: `Must outlive request failure` },
+        })
+
+        expect(
+          routing?.violations() ?? [],
+          `failed incremental reads retain the current scope for surviving source work`,
+        ).toEqual([])
+        adapter.loadSubset = loadPersistedRows
+        await atPersistedOracleCheckpoint(
+          Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
+          `overlapping request-local retry loaded durable source row`,
+        )
+        expect({
+          status: collection.status,
+          publicError: collection._lifecycle.getSyncError(),
+          publicRows: [...collection.values()].map(stripVirtualProps),
+          durableRows: [...adapter.rows.values()],
+        }).toEqual({
+          status: `ready`,
+          publicError: undefined,
+          publicRows: [{ id: `source`, title: `Must outlive request failure` }],
+          durableRows: [
+            { id: `source`, title: `Must outlive request failure` },
+          ],
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        rejectLoad.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => load?.catch(() => undefined),
+            () => receipt?.catch(() => undefined),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`fail-stops when a buffered partial update cannot reconstruct its persisted baseline`, async () => {
+    const requestFailure = new Error(`incremental subset rejected`)
+    const baselineFailure = new Error(
+      `persisted baseline reconstruction failed`,
+    )
+    const adapter = createRecordingAdapter([
+      {
+        id: `shared`,
+        title: `Persisted baseline`,
+        detail: `required baseline field`,
+      },
+    ])
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw requestFailure
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-partial-baseline-failure`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<void> | undefined
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `partial baseline failure collection ready`,
+      )
+      adapter.loadResumeSnapshot = () => Promise.reject(baselineFailure)
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        loadEntered.promise,
+        `partial baseline failure load entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `shared`, title: `Partial update` },
+      })
+      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      void receipt.catch(() => undefined)
+      expect(observeSettlement(receipt).read()).toEqual({ status: `pending` })
+
+      rejectLoad.resolve()
+      await expect(
+        atPersistedOracleCheckpoint(load, `partial baseline load rejected`),
+      ).rejects.toBe(baselineFailure)
+      await expect(
+        atPersistedOracleCheckpoint(
+          receipt,
+          `partial baseline source receipt rejected`,
+        ),
+      ).rejects.toBe(baselineFailure)
+      expect({
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === baselineFailure,
+        publicRow: collection.get(`shared`),
+        durableRow: adapter.rows.get(`shared`),
+        durabilityCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        status: `crashed`,
+        exactPublicError: true,
+        publicRow: undefined,
+        durableRow: {
+          id: `shared`,
+          title: `Persisted baseline`,
+          detail: `required baseline field`,
+        },
+        durabilityCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          () => receipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`applies a partial upsert when the persisted snapshot proves the key absent`, async () => {
+    const requestFailure = new Error(`incremental subset rejected`)
+    const adapter = createRecordingAdapter()
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw requestFailure
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-missing-partial-baseline`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<void> | undefined
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await loadEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `missing`, title: `partial` },
+      })
+      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      void receipt.catch(() => undefined)
+      rejectLoad.resolve()
+
+      await expect(load).rejects.toBe(requestFailure)
+      await receipt
+      expect({
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        publicRow: stripVirtualProps(collection.get(`missing`)),
+        durableRow: adapter.rows.get(`missing`),
+        durabilityCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        status: `ready`,
+        publicError: undefined,
+        publicRow: { id: `missing`, title: `partial` },
+        durableRow: { id: `missing`, title: `partial` },
+        durabilityCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          () => receipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects a transaction begun before hydration at its write cut`, async () => {
+    const requestFailure = new Error(`incremental subset rejected`)
+    const baseline: Todo = {
+      id: `shared`,
+      title: `Persisted baseline`,
+      detail: `required baseline field`,
+    }
+    const adapter = createRecordingAdapter([baseline])
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw requestFailure
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-begin-before-hydration`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      sourceParams.begin()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await loadEntered.promise
+
+      expect(() =>
+        sourceParams.write({
+          type: `update`,
+          value: { id: baseline.id, title: `Source update` },
+        }),
+      ).toThrow(`cannot cross a hydration cycle`)
+      expect(() => sourceParams.commit()).toThrow(
+        `cannot cross a hydration cycle`,
+      )
+      rejectLoad.resolve()
+
+      await expect(load).rejects.toBe(requestFailure)
+      expect({
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        publicRow: stripVirtualProps(collection.get(baseline.id)),
+        durableRow: adapter.rows.get(baseline.id),
+        recoverySnapshotCalls: adapter.loadResumeSnapshotCalls.filter(
+          ({ includeRows }) => includeRows === true,
+        ).length,
+      }).toEqual({
+        status: `ready`,
+        publicError: undefined,
+        publicRow: undefined,
+        durableRow: baseline,
+        recoverySnapshotCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      await cleanupPersistedOracle(
+        [() => load?.catch(() => undefined), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`publishes a recovered baseline and dependent partial update atomically`, async () => {
+    const requestFailure = new Error(`incremental subset rejected`)
+    const baseline: Todo = {
+      id: `shared`,
+      title: `Persisted baseline`,
+      detail: `required baseline field`,
+    }
+    const expected: Todo = { ...baseline, title: `Source update` }
+    const adapter = createRecordingAdapter([baseline])
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw requestFailure
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-atomic-baseline-recovery`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const abortController = new AbortController()
+    const publicCuts: Array<Todo | undefined> = []
+    const subscription = collection.subscribeChanges((changes) => {
+      if (changes.some(({ key }) => key === baseline.id)) {
+        publicCuts.push(stripVirtualProps(collection.get(baseline.id)))
+        abortController.abort()
+      }
+    })
+    let load: Promise<void> | undefined
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await loadEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: baseline.id, title: expected.title },
+      })
+      receipt = Promise.resolve(
+        sourceParams.commit(abortController.signal),
+      ).then(() => undefined)
+      rejectLoad.resolve()
+
+      await expect(load).rejects.toBe(requestFailure)
+      await receipt
+      expect({
+        abortedFromPublication: abortController.signal.aborted,
+        publicCuts,
+        publicRow: stripVirtualProps(collection.get(baseline.id)),
+        durableRow: adapter.rows.get(baseline.id),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        abortedFromPublication: true,
+        publicCuts: [expected],
+        publicRow: expected,
+        durableRow: expected,
+        status: `ready`,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      subscription.unsubscribe()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          () => receipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it.each([`delete`, `truncate`] as const)(
+    `treats a buffered %s prefix as authoritative absence for a partial upsert`,
+    async (prefix) => {
+      const requestFailure = new Error(`incremental subset rejected`)
+      const baseline: Todo = {
+        id: `shared`,
+        title: `Persisted baseline`,
+        detail: `required baseline field`,
+      }
+      const adapter = createRecordingAdapter([baseline])
+      const loadEntered = createEventGate()
+      const rejectLoad = createEventGate()
+      adapter.loadSubset = async () => {
+        loadEntered.resolve()
+        await rejectLoad.promise
+        throw requestFailure
+      }
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `request-local-${prefix}-partial-prefix`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            rowUpdateMode: `partial`,
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      let load: Promise<void> | undefined
+      let prefixReceipt: Promise<void> | undefined
+      let partialReceipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
+
+      try {
+        await collection.stateWhenReady()
+        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+          () => undefined,
+        )
+        void load.catch(() => undefined)
+        await loadEntered.promise
+
+        sourceParams.begin()
+        if (prefix === `delete`) {
+          sourceParams.write({ type: `delete`, key: baseline.id })
+        } else {
+          sourceParams.truncate()
+        }
+        prefixReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void prefixReceipt.catch(() => undefined)
+
+        sourceParams.begin()
+        sourceParams.write({
+          type: `update`,
+          value: { id: baseline.id, title: `partial after ${prefix}` },
+        })
+        partialReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void partialReceipt.catch(() => undefined)
+        rejectLoad.resolve()
+
+        await expect(load).rejects.toBe(requestFailure)
+        await prefixReceipt
+        await partialReceipt
+        expect({
+          status: collection.status,
+          publicError: collection._lifecycle.getSyncError(),
+          publicRow: collection.get(baseline.id),
+          durableRow: adapter.rows.get(baseline.id),
+          durableOrder: adapter.applyCommittedTxCalls.map(({ tx }) =>
+            tx.truncate ? `truncate` : tx.mutations[0]?.type,
+          ),
+        }).toEqual({
+          status: `ready`,
+          publicError: undefined,
+          publicRow: expect.objectContaining({
+            id: baseline.id,
+            title: `partial after ${prefix}`,
+          }),
+          durableRow: {
+            id: baseline.id,
+            title: `partial after ${prefix}`,
+          },
+          durableOrder: [prefix, `update`],
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        rejectLoad.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => load?.catch(() => undefined),
+            () => prefixReceipt?.catch(() => undefined),
+            () => partialReceipt?.catch(() => undefined),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it.each([`delete`, `truncate`] as const)(
+    `treats a same-transaction %s prefix as authoritative absence for a partial upsert`,
+    async (prefix) => {
+      const baseline: Todo = {
+        id: `shared`,
+        title: `Persisted baseline`,
+        detail: `required baseline field`,
+      }
+      const adapter = createRecordingAdapter([baseline])
+      const loadEntered = createEventGate()
+      const rejectLoad = createEventGate()
+      adapter.loadSubset = async () => {
+        loadEntered.resolve()
+        await rejectLoad.promise
+        throw new Error(`incremental subset rejected`)
+      }
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `request-local-same-transaction-${prefix}-partial`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            rowUpdateMode: `partial`,
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      let load: Promise<void> | undefined
+      let receipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
+
+      try {
+        await collection.stateWhenReady()
+        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+          () => undefined,
+        )
+        void load.catch(() => undefined)
+        await loadEntered.promise
+
+        sourceParams.begin()
+        if (prefix === `delete`) {
+          sourceParams.write({ type: `delete`, key: baseline.id })
+        } else {
+          sourceParams.truncate()
+        }
+        sourceParams.write({
+          type: `update`,
+          value: { id: baseline.id, title: `partial after ${prefix}` },
+        })
+        receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+        void receipt.catch(() => undefined)
+        rejectLoad.resolve()
+
+        await expect(load).rejects.toThrow(`incremental subset rejected`)
+        await receipt
+        expect({
+          status: collection.status,
+          publicRow: stripVirtualProps(collection.get(baseline.id)),
+          durableRow: adapter.rows.get(baseline.id),
+          durabilityCalls: adapter.applyCommittedTxCalls.length,
+          recoverySnapshotCalls: adapter.loadResumeSnapshotCalls.filter(
+            ({ includeRows }) => includeRows === true,
+          ).length,
+        }).toEqual({
+          status: `ready`,
+          publicRow: {
+            id: baseline.id,
+            title: `partial after ${prefix}`,
+          },
+          durableRow: {
+            id: baseline.id,
+            title: `partial after ${prefix}`,
+          },
+          durabilityCalls: 1,
+          recoverySnapshotCalls: 0,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        rejectLoad.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => load?.catch(() => undefined),
+            () => receipt?.catch(() => undefined),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`keeps fallback-snapshot admissions inside buffered baseline recovery`, async () => {
+    const rows: Array<Todo> = [
+      { id: `a`, title: `A baseline`, detail: `A required` },
+      { id: `b`, title: `B baseline`, detail: `B required` },
+    ]
+    const adapter = createRecordingAdapter(rows)
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    const fallbackEntered = createEventGate()
+    const releaseFallback = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw new Error(`incremental subset rejected`)
+    }
+    const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
+      fallbackEntered.resolve()
+      await releaseFallback.promise
+      return rows.map((value) => ({ key: value.id, value }))
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-fallback-admission`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<void> | undefined
+    const receipts: Array<Promise<void>> = []
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await loadEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `a`, title: `A source` },
+      })
+      receipts.push(
+        Promise.resolve(sourceParams.commit()).then(() => undefined),
+      )
+      receipts.forEach((receipt) => void receipt.catch(() => undefined))
+      rejectLoad.resolve()
+      await fallbackEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `b`, title: `B source` },
+      })
+      const lateReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      receipts.push(lateReceipt)
+      void lateReceipt.catch(() => undefined)
+      expect(observeSettlement(lateReceipt).read()).toEqual({
+        status: `pending`,
+      })
+
+      releaseFallback.resolve()
+      await expect(load).rejects.toThrow(`incremental subset rejected`)
+      await Promise.all(receipts)
+      expect({
+        publicRows: [`a`, `b`].map((key) =>
+          stripVirtualProps(collection.get(key)),
+        ),
+        durableRows: [`a`, `b`].map((key) => adapter.rows.get(key)),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        publicRows: [
+          { id: `a`, title: `A source`, detail: `A required` },
+          { id: `b`, title: `B source`, detail: `B required` },
+        ],
+        durableRows: [
+          { id: `a`, title: `A source`, detail: `A required` },
+          { id: `b`, title: `B source`, detail: `B required` },
+        ],
+        status: `ready`,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      releaseFallback.resolve()
+      restoreBaselineRows()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not publish a fallback baseline for an aborted dependent update`, async () => {
+    const baseline: Todo = {
+      id: `shared`,
+      title: `Persisted baseline`,
+      detail: `required baseline field`,
+    }
+    const adapter = createRecordingAdapter([baseline])
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    const fallbackEntered = createEventGate()
+    const releaseFallback = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw new Error(`incremental subset rejected`)
+    }
+    const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
+      fallbackEntered.resolve()
+      await releaseFallback.promise
+      return [{ key: baseline.id, value: baseline }]
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-aborted-partial-baseline`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const publicEvents: Array<string> = []
+    const subscription = collection.subscribeChanges((changes) => {
+      publicEvents.push(
+        ...changes.map((change) => `${change.type}:${change.key}`),
+      )
+    })
+    const abortController = new AbortController()
+    let load: Promise<void> | undefined
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await loadEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: baseline.id, title: `aborted partial` },
+      })
+      receipt = Promise.resolve(
+        sourceParams.commit(abortController.signal),
+      ).then(() => undefined)
+      void receipt.catch(() => undefined)
+      rejectLoad.resolve()
+      await fallbackEntered.promise
+      abortController.abort()
+      releaseFallback.resolve()
+
+      await expect(load).rejects.toThrow(`incremental subset rejected`)
+      await expect(receipt).rejects.toMatchObject({ name: `AbortError` })
+      expect({
+        publicEvents,
+        publicRow: collection.get(baseline.id),
+        durableRow: adapter.rows.get(baseline.id),
+        durabilityCalls: adapter.applyCommittedTxCalls.length,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        publicEvents: [],
+        publicRow: undefined,
+        durableRow: baseline,
+        durabilityCalls: 0,
+        status: `ready`,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      releaseFallback.resolve()
+      restoreBaselineRows()
+      subscription.unsubscribe()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          () => receipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not let a later fallback dependency preserve metadata deleted by a fresh insert`, async () => {
+    const baseline: Todo = {
+      id: `shared`,
+      title: `Persisted baseline`,
+      detail: `old detail`,
+    }
+    const adapter = createRecordingAdapter([baseline])
+    adapter.rowMetadata.set(baseline.id, { owner: `stale` })
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw new Error(`incremental subset rejected`)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-insert-partial-metadata`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<void> | undefined
+    const receipts: Array<Promise<void>> = []
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await loadEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: baseline.id, title: `Fresh insert`, detail: `new detail` },
+      })
+      receipts.push(
+        Promise.resolve(sourceParams.commit()).then(() => undefined),
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: baseline.id, title: `Later partial` },
+      })
+      receipts.push(
+        Promise.resolve(sourceParams.commit()).then(() => undefined),
+      )
+      receipts.forEach((receipt) => void receipt.catch(() => undefined))
+      rejectLoad.resolve()
+
+      await expect(load).rejects.toThrow(`incremental subset rejected`)
+      await Promise.all(receipts)
+      expect({
+        publicRow: stripVirtualProps(collection.get(baseline.id)),
+        durableRow: adapter.rows.get(baseline.id),
+        publicMetadata: sourceParams.metadata!.row.get(baseline.id),
+        durableMetadata: adapter.rowMetadata.get(baseline.id),
+      }).toEqual({
+        publicRow: {
+          id: baseline.id,
+          title: `Later partial`,
+          detail: `new detail`,
+        },
+        durableRow: {
+          id: baseline.id,
+          title: `Later partial`,
+          detail: `new detail`,
+        },
+        publicMetadata: undefined,
+        durableMetadata: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`preserves an overlapping subset demand when its predecessor fails`, async () => {
+    const failure = new Error(`failed demand is not active`)
+    const adapter = createRecordingAdapter()
+    const failedOptions: LoadSubsetOptions = { limit: 1 }
+    const replacementOptions: LoadSubsetOptions = { limit: 1 }
+    const firstLoadEntered = createEventGate()
+    const rejectFirstLoad = createEventGate()
+    const reloadCalls: Array<LoadSubsetOptions> = []
+    let initialCalls = 0
+    let reloading = false
+    adapter.loadSubset = async (_collectionId, requestedOptions) => {
+      if (reloading) {
+        reloadCalls.push(requestedOptions)
+      }
+      if (!reloading) {
+        initialCalls++
+        if (initialCalls === 1) {
+          firstLoadEntered.resolve()
+          await rejectFirstLoad.promise
+          throw failure
+        }
+      }
+      if (requestedOptions === failedOptions) {
+        return [
+          {
+            key: `phantom`,
+            value: { id: `phantom`, title: `Failed demand leaked` },
+          },
+        ]
+      }
+      return [
+        {
+          key: `replacement`,
+          value: {
+            id: `replacement`,
+            title: reloading ? `Replacement reloaded` : `Replacement initial`,
+          },
+        },
+      ]
+    }
+    const coordinator = createFailStopCoordinatorHarness(
+      `request-local-active-subset-identity`,
+    )
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-active-subset-identity`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let firstLoad: Promise<void> | undefined
+    let replacementLoad: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `active-subset identity collection ready`,
+      )
+      firstLoad = Promise.resolve(
+        collection._sync.loadSubset(failedOptions),
+      ).then(() => undefined)
+      void firstLoad.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstLoadEntered.promise,
+        `failed subset demand entered hydration`,
+      )
+      replacementLoad = Promise.resolve(
+        collection._sync.loadSubset(replacementOptions),
+      ).then(() => undefined)
+      void replacementLoad.catch(() => undefined)
+      expect(observeSettlement(replacementLoad).read()).toEqual({
+        status: `pending`,
+      })
+      rejectFirstLoad.resolve()
+      await expect(firstLoad).rejects.toBe(failure)
+      await atPersistedOracleCheckpoint(
+        replacementLoad,
+        `replacement subset loaded`,
+      )
+
+      reloading = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `reload-active-subsets`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await vi.waitFor(() =>
+        expect(stripVirtualProps(collection.get(`replacement`))).toEqual({
+          id: `replacement`,
+          title: `Replacement reloaded`,
+        }),
+      )
+
+      expect({
+        reloadCalls,
+        phantom: collection.get(`phantom`),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        reloadCalls: [replacementOptions],
+        phantom: undefined,
+        status: `ready`,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectFirstLoad.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => firstLoad?.catch(() => undefined),
+          () => replacementLoad?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`reports a persisted subset failure only to its requesting subscription`, async () => {
+    const failure = new Error(`requesting subscription failed exactly`)
+    const adapter = createRecordingAdapter([
+      { id: `cached`, title: `Shared cached row` },
+    ])
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    let calls = 0
+    adapter.loadSubset = (...args) => {
+      calls++
+      return calls === 1 ? Promise.reject(failure) : loadSubset(...args)
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `request-local-subscription-hydration-failure`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const failing = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    const healthy = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    const reported: Array<unknown> = []
+    failing.on(`loadSubset:error`, ({ error }) => reported.push(error))
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `subscription-isolation collection ready`,
+      )
+      failing.requestSnapshot({ optimizedOnly: false })
+      healthy.requestSnapshot({ optimizedOnly: false })
+      await flushAsyncWork()
+
+      expect({
+        reported,
+        failingError: failing.lastError,
+        healthyError: healthy.lastError,
+        failingStatus: failing.status,
+        healthyStatus: healthy.status,
+        collectionStatus: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        cached: stripVirtualProps(collection.get(`cached`)),
+      }).toEqual({
+        reported: [failure],
+        failingError: failure,
+        healthyError: undefined,
+        failingStatus: `ready`,
+        healthyStatus: `ready`,
+        collectionStatus: `ready`,
+        publicError: undefined,
+        cached: { id: `cached`, title: `Shared cached row` },
+      })
+
+      adapter.rows.set(`retry`, {
+        id: `retry`,
+        title: `Retry visible to both owners`,
+      })
+      failing.requestSnapshot({ optimizedOnly: false, refetch: true })
+      await flushAsyncWork()
+      expect(stripVirtualProps(collection.get(`retry`))).toEqual({
+        id: `retry`,
+        title: `Retry visible to both owners`,
+      })
+      expect(collection.status).toBe(`ready`)
+      expect(collection._lifecycle.getSyncError()).toBeUndefined()
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      failing.unsubscribe()
+      healthy.unsubscribe()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`marks the collection errored and rejects later forced work after a hydration failure`, async () => {
+    const hydrationFailure = new Error(`later forced hydration failed`)
+    const adapter = createRecordingAdapter()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `later-forced-hydration-failure`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `forced-hydration collection initially ready`,
+      )
+      expect(collection.status).toBe(`ready`)
+      adapter.loadSubset = () => Promise.reject(hydrationFailure)
+
+      await expect(
+        atPersistedOracleCheckpoint(
+          Promise.resolve(collection.utils.forceReloadSubset!({ limit: 1 })),
+          `later forced hydration rejected`,
+        ),
+      ).rejects.toBe(hydrationFailure)
+
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure)
+      expect([...collection.values()]).toEqual([])
+      expect(adapter.rows.size).toBe(0)
+      expect(adapter.applyCommittedTxCalls).toEqual([])
+
+      let laterAdapterCalls = 0
+      adapter.loadSubset = () => {
+        laterAdapterCalls++
+        return Promise.resolve([
+          {
+            key: `late-forced`,
+            value: { id: `late-forced`, title: `must not be admitted` },
+          },
+        ])
+      }
+      await expect(
+        atPersistedOracleCheckpoint(
+          Promise.resolve(collection.utils.forceReloadSubset!({ limit: 2 })),
+          `later forced subset work settled`,
+        ),
+      ).rejects.toBe(hydrationFailure)
+      expect({
+        laterAdapterCalls,
+        visible: collection.get(`late-forced`),
+        durable: adapter.rows.get(`late-forced`),
+        durabilityCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        laterAdapterCalls: 0,
+        visible: undefined,
+        durable: undefined,
+        durabilityCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects subset work admitted after a terminal hydration failure`, async () => {
+    const hydrationFailure = new Error(`terminal hydration failed`)
+    const adapter = createRecordingAdapter()
+    const coordinator = createFailStopCoordinatorHarness(
+      `terminal-hydration-rejects-later-work`,
+    )
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-hydration-rejects-later-work`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let hasPrimaryFailure = false
+    const demand = { limit: 1 }
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `terminal hydration collection initially ready`,
+      )
+      await collection._sync.loadSubset(demand)
+      adapter.loadSubset = () => Promise.reject(hydrationFailure)
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `terminal-hydration-rejects-later-work`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await vi.waitFor(() =>
+        expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure),
+      )
+      expect(collection.status).toBe(`crashed`)
+
+      let laterAdapterCalls = 0
+      adapter.loadSubset = () => {
+        laterAdapterCalls++
+        return Promise.resolve([
+          {
+            key: `late`,
+            value: { id: `late`, title: `must not be admitted` },
+          },
+        ])
+      }
+      const laterOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(collection._sync.loadSubset({ limit: 2 })).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `later subset work settled`,
+      )
+
+      expect({
+        status: laterOutcome.status,
+        exactReason:
+          laterOutcome.status === `rejected` &&
+          laterOutcome.reason === hydrationFailure,
+        laterAdapterCalls,
+        visible: collection.get(`late`),
+        durable: adapter.rows.get(`late`),
+        durabilityCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        status: `rejected`,
+        exactReason: true,
+        laterAdapterCalls: 0,
+        visible: undefined,
+        durable: undefined,
+        durabilityCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      collection._sync.unloadSubset(demand)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects new source transactions after a terminal hydration failure`, async () => {
+    const hydrationFailure = new Error(`terminal source hydration failed`)
+    const adapter = createRecordingAdapter()
+    const coordinator = createFailStopCoordinatorHarness(
+      `terminal-hydration-rejects-new-source-work`,
+    )
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-hydration-rejects-new-source-work`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let hasPrimaryFailure = false
+    const demand = { limit: 1 }
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `terminal source hydration collection initially ready`,
+      )
+      await collection._sync.loadSubset(demand)
+      adapter.loadSubset = () => Promise.reject(hydrationFailure)
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `terminal-hydration-rejects-new-source-work`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await vi.waitFor(() =>
+        expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure),
+      )
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure)
+
+      remoteBegin!()
+      remoteWrite!({
+        type: `insert`,
+        value: { id: `late`, title: `must not be admitted` },
+      })
+      const lateOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(remoteCommit!()).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `late terminal hydration source receipt`,
+      )
+
+      expect({
+        receiptStatus: lateOutcome.status,
+        exactReceipt:
+          lateOutcome.status === `rejected` &&
+          lateOutcome.reason === hydrationFailure,
+        publicErrorIsHydration:
+          collection._lifecycle.getSyncError() === hydrationFailure,
+        status: collection.status,
+        lateVisible: collection.get(`late`),
+        lateDurable: adapter.rows.get(`late`),
+        applyCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        receiptStatus: `rejected`,
+        exactReceipt: true,
+        publicErrorIsHydration: true,
+        status: `crashed`,
+        lateVisible: undefined,
+        lateDurable: undefined,
+        applyCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      collection._sync.unloadSubset(demand)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it.each([`throw`, `reject`] as const)(
+    `releases only transferred upstream ownership after a load %s`,
+    async (mode) => {
+      const failure = new Error(`failed upstream load`)
+      const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const peer: LoadSubsetOptions = { limit: 1 }
+      const failed: LoadSubsetOptions = { limit: 1 }
+      const leases = new Set<LoadSubsetOptions>()
+      let publish!: (title: string) => Promise<void>
+      const unload = vi.fn((options: LoadSubsetOptions) => {
+        leases.delete(options)
+      })
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `failed-load-ownership-${mode}`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: ({ begin, write, commit, markReady }) => {
+              publish = async (title) => {
+                if (!leases.has(peer)) return
+                begin()
+                write({
+                  type: collection.has(`live`) ? `update` : `insert`,
+                  value: { id: `live`, title },
+                })
+                await commit()
+              }
+              markReady()
+              return {
+                loadSubset: (options) => {
+                  if (options === failed && mode === `throw`) throw failure
+                  // Returning a promise transfers the ongoing lease, even if
+                  // fetching its initial snapshot subsequently fails.
+                  leases.add(options)
+                  return options === failed ? Promise.reject(failure) : true
+                },
+                unloadSubset: unload,
+              }
+            },
+          },
+          persistence: { adapter: createRecordingAdapter() },
+        }),
+      )
+      collection.startSyncImmediate()
+      try {
+        await collection._sync.loadSubset(peer)
+        await expect(collection._sync.loadSubset(failed)).rejects.toBe(failure)
+        expect(leases.has(failed)).toBe(mode === `reject`)
+        collection._sync.unloadSubset(failed)
+        expect(unload.mock.calls.map(([options]) => options)).toEqual(
+          mode === `reject` ? [failed] : [],
+        )
+        expect(leases).toEqual(new Set([peer]))
+        await publish(`Peer still live`)
+        expect(collection.get(`live`)?.title).toBe(`Peer still live`)
+        collection._sync.unloadSubset(peer)
+        expect(leases.size).toBe(0)
+        await publish(`Must not arrive`)
+        expect(collection.get(`live`)?.title).toBe(`Peer still live`)
+      } finally {
+        warn.mockRestore()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`does not mark a demand hydrated after its last acquisition leaves mid-read`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `one` },
+      { id: `2`, title: `two` },
+      { id: `3`, title: `three` },
+    ])
+    const readSubset = adapter.loadSubset
+    let releaseRead!: () => void
+    let enterRead!: () => void
+    const readGate = new Promise<void>((resolve) => {
+      releaseRead = resolve
+    })
+    const readEntered = new Promise<void>((resolve) => {
+      enterRead = resolve
+    })
+    let blockNextRead = true
+    adapter.loadSubset = async (...args) => {
+      if (blockNextRead) {
+        blockNextRead = false
+        enterRead()
+        await readGate
+      }
+      return readSubset(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `released-mid-read`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true, unloadSubset: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.startSyncImmediate()
+
+    try {
+      const first: LoadSubsetOptions = { limit: 3 }
+      const pending = collection._sync.loadSubset(first)
+      await readEntered
+      collection._sync.unloadSubset(first)
+      releaseRead()
+      await pending
+
+      const reacquired = collection._sync.loadSubset({ limit: 3 })
+      expect(reacquired).not.toBe(true)
+      await reacquired
+      expect(collection.get(`3`)).toBeDefined()
+    } finally {
+      releaseRead()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not answer a registered but unread demand synchronously`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `one` }])
+    const readSubset = adapter.loadSubset
+    let releaseRead!: () => void
+    let enterRead!: () => void
+    const readGate = new Promise<void>((resolve) => {
+      releaseRead = resolve
+    })
+    const readEntered = new Promise<void>((resolve) => {
+      enterRead = resolve
+    })
+    let blockNextRead = true
+    adapter.loadSubset = async (...args) => {
+      if (blockNextRead) {
+        blockNextRead = false
+        enterRead()
+        await readGate
+      }
+      return readSubset(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `registered-before-read`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true, unloadSubset: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.startSyncImmediate()
+
+    try {
+      const first = collection._sync.loadSubset({ limit: 1 })
+      await readEntered
+      const second = collection._sync.loadSubset({ limit: 1 })
+      expect(second).not.toBe(true)
+      releaseRead()
+      await Promise.all([first, second])
+      expect(collection.get(`1`)).toBeDefined()
+    } finally {
+      releaseRead()
+      await collection.cleanup()
+    }
+  })
+
+  it(`stops ensuring an aborted coordinator acquisition`, async () => {
+    vi.useFakeTimers()
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const abortError = Object.assign(new Error(`abort`), { name: `AbortError` })
+    const ensured: Array<LoadSubsetOptions> = []
+    const first: LoadSubsetOptions = { limit: 1 }
+    const second: LoadSubsetOptions = { limit: 1 }
+    const coordinator = createCoordinatorHarness()
+    coordinator.requestEnsureRemoteSubset = (_id, options) => {
+      ensured.push(options)
+      return options === second ? Promise.reject(abortError) : Promise.resolve()
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `fast-path-abort`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true, unloadSubset: () => {} }
+          },
+        },
+        persistence: {
+          adapter: createRecordingAdapter([{ id: `1`, title: `one` }]),
+          coordinator,
+        },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await collection._sync.loadSubset(first)
+      const result = await Promise.resolve(
+        collection._sync.loadSubset(second),
+      ).then(
+        () => `ready`,
+        (error: unknown) => error,
+      )
+      expect(result).toBe(abortError)
+
+      const callsBeforeRetry = ensured.filter(
+        (options) => options === second,
+      ).length
+      await vi.advanceTimersByTimeAsync(500)
+      expect(ensured.filter((options) => options === second)).toHaveLength(
+        callsBeforeRetry,
+      )
+    } finally {
+      await collection.cleanup()
+      warning.mockRestore()
+      vi.useRealTimers()
+    }
+  })
+
+  it(`does not release or acquire an upstream lease cancelled during hydration`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrate = adapter.loadSubset
+    let blocked = false
+    let enterHydration!: () => void
+    let finishHydration!: () => void
+    const entered = new Promise<void>((resolve) => {
+      enterHydration = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      finishHydration = resolve
+    })
+    adapter.loadSubset = async (...args) => {
+      if (blocked) {
+        enterHydration()
+        await gate
+      }
+      return hydrate(...args)
+    }
+    let leases = 0
+    let loads = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `cancelled-hydration-lease`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                leases++
+                return true
+              },
+              unloadSubset: () => {
+                leases--
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.startSyncImmediate()
+    const first: LoadSubsetOptions = { limit: 1 }
+    const second: LoadSubsetOptions = { limit: 2 }
+    try {
+      await collection._sync.loadSubset(first)
+      expect(leases).toBe(1)
+      blocked = true
+      const pending = collection._sync.loadSubset(second)
+      await entered
+      collection._sync.unloadSubset(second)
+      expect(leases).toBe(1)
+      finishHydration()
+      await pending
+      expect(loads).toBe(1)
+      collection._sync.unloadSubset(first)
+      expect(leases).toBe(0)
+    } finally {
+      finishHydration()
+      await collection.cleanup()
+    }
+  })
+
+  it.each([
+    {
+      action: `retain` as const,
+      expectedEnsures: 1,
+      expectedReleases: 0,
+    },
+    {
+      action: `unload` as const,
+      expectedEnsures: 0,
+      expectedReleases: 1,
+    },
+    {
+      action: `abort` as const,
+      expectedEnsures: 0,
+      expectedReleases: 0,
+    },
+  ])(
+    `acquires coordinator demand after hydration iff it remains active: $action`,
+    async ({ action, expectedEnsures, expectedReleases }) => {
+      const adapter = createRecordingAdapter()
+      const hydrate = adapter.loadSubset
+      let enterHydration!: () => void
+      let finishHydration!: () => void
+      const entered = new Promise<void>((resolve) => {
+        enterHydration = resolve
+      })
+      const gate = new Promise<void>((resolve) => {
+        finishHydration = resolve
+      })
+      adapter.loadSubset = async (...args) => {
+        enterHydration()
+        await gate
+        return hydrate(...args)
+      }
+      const ensure = vi.fn(async () => {})
+      const release = vi.fn(async () => {})
+      const coordinator = createCoordinatorHarness()
+      coordinator.isLeader = () => false
+      coordinator.requestEnsureRemoteSubset = ensure
+      coordinator.requestReleaseRemoteSubset = release
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `coordinator-hydration-demand-${action}`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {}
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const controller = new AbortController()
+      const options: LoadSubsetOptions = {
+        limit: 1,
+        signal: controller.signal,
+      }
+
+      try {
+        collection.startSyncImmediate()
+        const pending = collection._sync.loadSubset(options)
+        await entered
+        if (action === `unload`) collection._sync.unloadSubset(options)
+        if (action === `abort`) controller.abort()
+        finishHydration()
+        // An explicit abort of a retained demand now rejects promptly. The
+        // earlier law treated it as a fulfilled load, even though hydration
+        // must still suppress the remote acquisition. Release stays quiet.
+        if (action === `abort`) {
+          await expect(pending).rejects.toMatchObject({ name: `AbortError` })
+        } else {
+          await pending
+        }
+
+        // The earlier history law cancelled only after remote acquisition had
+        // begun. Holding the real adapter hydration seam exposes the distinct
+        // post-hydration transfer boundary. `retain` is the hostile control:
+        // the cancellation guard must not suppress live demand.
+        expect({
+          ensures: ensure.mock.calls.length,
+          releases: release.mock.calls.length,
+        }).toEqual({
+          ensures: expectedEnsures,
+          releases: expectedReleases,
+        })
+      } finally {
+        finishHydration()
+        await collection.cleanup()
+      }
+    },
+  )
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-follower-indexes.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-follower-indexes.test.ts
new file mode 100644
index 0000000000..911b0b9071
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-follower-indexes.test.ts
@@ -0,0 +1,2701 @@
+/**
+ * Ordinary regression tests for persisted follower hydration and persisted index lifecycle, as fixed scenarios. The follower and index laws are owned by persisted-oracle.test.ts, which keeps the generated follower and index histories.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BasicIndex,
+  IR,
+  SyncTransactionAbortedError,
+  createCollection,
+  whenSyncAccepted,
+} from '@tanstack/db'
+import {
+  InvalidPersistedCollectionConfigError,
+  PersistedCollectionDurabilityError,
+  persistedCollectionOptions,
+  toTransportedLoadSubsetOptions,
+} from '../src'
+import { Temporal } from './temporal-value-oracle'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createDeferred,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createLocalCoordinatorHarness,
+  createRecordingAdapter,
+  flushAsyncWork,
+  recordedStorageId,
+  stripVirtualProps,
+} from './persisted-support'
+import type {
+  PersistedCollectionCoordinator,
+  PullSinceResponse,
+  RemoteSubsetOwner,
+  TxCommitted,
+} from '../src'
+import type { LoadSubsetOptions, PendingMutation } from '@tanstack/db'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`hydrates a multiprocess follower locally while only the elected owner acquires remote demand`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `persisted`, title: `Persisted follower row` },
+    ])
+    let releaseRemoteLoad = (): void => {}
+    const remoteLoadGate = new Promise<void>((resolve) => {
+      releaseRemoteLoad = resolve
+    })
+    let registeredOwner: RemoteSubsetOwner | undefined
+    const ensureRemote = vi.fn(() => remoteLoadGate)
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `follower-node`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => false,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      requestEnsureRemoteSubset: ensureRemote,
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: (_collectionId, owner) => {
+        registeredOwner = owner
+        return () => {
+          if (registeredOwner === owner) registeredOwner = undefined
+        }
+      },
+    }
+    const followerUpstreamLoad = vi.fn(() => Promise.resolve())
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `multiprocess-follower-subset`,
+        getKey: (todo) => todo.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: followerUpstreamLoad,
+              unloadSubset: vi.fn(),
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const options: LoadSubsetOptions = { limit: 1 }
+
+    try {
+      collection.startSyncImmediate()
+      let settled = false
+      const load = Promise.resolve(collection._sync.loadSubset(options)).then(
+        () => {
+          settled = true
+        },
+      )
+
+      await vi.waitFor(() => {
+        expect(adapter.loadSubsetCalls.length).toBeGreaterThan(0)
+        expect(ensureRemote).toHaveBeenCalledWith(
+          `multiprocess-follower-subset`,
+          options,
+        )
+      })
+      const persistedRow = collection.get(`persisted`)
+      expect({
+        persistedRow: persistedRow
+          ? { id: persistedRow.id, title: persistedRow.title }
+          : undefined,
+        followerUpstreamCalls: followerUpstreamLoad.mock.calls.length,
+        registeredOwner: registeredOwner !== undefined,
+        settled,
+      }).toEqual({
+        persistedRow: { id: `persisted`, title: `Persisted follower row` },
+        followerUpstreamCalls: 0,
+        registeredOwner: true,
+        settled: false,
+      })
+
+      releaseRemoteLoad()
+      await load
+      expect({
+        routedEnsures: ensureRemote.mock.calls.length,
+        followerUpstreamCalls: followerUpstreamLoad.mock.calls.length,
+      }).toEqual({
+        routedEnsures: 1,
+        followerUpstreamCalls: 0,
+      })
+    } finally {
+      releaseRemoteLoad()
+      await collection.cleanup()
+    }
+  })
+
+  it.each([`abort`, `signal-abort`, `release`, `offline`] as const)(
+    `handles remote ensure after %s without resurrecting cancelled demand`,
+    async (action) => {
+      vi.useFakeTimers()
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const failure = Object.assign(new Error(action), {
+        name: action === `abort` ? `AbortError` : `Error`,
+      })
+      const ensure = vi.fn(async () => {
+        throw failure
+      })
+      const followerUpstreamLoad = vi.fn(async () => {
+        throw new Error(`follower-local source must not own remote demand`)
+      })
+      const coordinator: PersistedCollectionCoordinator = {
+        getNodeId: () => `cancel-ensure`,
+        subscribe: () => () => {},
+        publish: () => {},
+        isLeader: () => true,
+        ensureLeadership: async () => {},
+        requestEnsurePersistedIndex: async () => {},
+        requestApplyCommittedTx: (_collectionId, tx) =>
+          Promise.resolve({
+            type: `rpc:applyCommittedTx:res`,
+            rpcId: tx.txId,
+            ok: true,
+            term: tx.term,
+            seq: tx.seq,
+            latestRowVersion: tx.rowVersion,
+          }),
+        requestEnsureRemoteSubset: ensure,
+        // This fixture isolates ensure retry/cancellation, not ownership.
+        requestReleaseRemoteSubset: async () => {},
+        registerRemoteSubsetOwner: () => () => {},
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `cancel-ensure-${action}`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {
+                loadSubset: followerUpstreamLoad,
+              }
+            },
+          },
+          persistence: { adapter: createRecordingAdapter(), coordinator },
+        }),
+      )
+      const controller = new AbortController()
+      const options: LoadSubsetOptions = {
+        limit: 1,
+        ...(action === `signal-abort` ? { signal: controller.signal } : {}),
+      }
+      try {
+        collection.startSyncImmediate()
+        const result = await Promise.resolve(
+          collection._sync.loadSubset(options),
+        ).then(
+          () => `ready`,
+          (error: unknown) => error,
+        )
+        if (action === `release`) collection._sync.unloadSubset(options)
+        if (action === `signal-abort`) controller.abort()
+        const callsBeforeRetry = ensure.mock.calls.length
+        await vi.advanceTimersByTimeAsync(200)
+        // The old matrix supplied an AbortError or explicitly unloaded demand,
+        // but never aborted an already-queued retry. The signal row owns that
+        // distinct boundary; offline is its hostile liveness control.
+        expect(result).toBe(failure)
+        expect(followerUpstreamLoad).not.toHaveBeenCalled()
+        if (action === `offline`) {
+          expect(ensure.mock.calls.length).toBeGreaterThan(callsBeforeRetry)
+        } else {
+          expect(ensure).toHaveBeenCalledTimes(callsBeforeRetry)
+        }
+      } finally {
+        await collection.cleanup()
+        warning.mockRestore()
+        vi.useRealTimers()
+      }
+    },
+  )
+
+  // Remote admission must validate without constructing a discarded wire
+  // snapshot. The authorized work bound is at most one detached payload copy per
+  // coordinator attempt, and none when hydration retires the demand first.
+  // This extends the persisted owner with construction work, not elapsed time.
+  // The controlled coordinator calls the real wire encoder; browser/Electron
+  // owners separately establish actual transport and local lifecycle delivery.
+  it.sequential.each(
+    [
+      `follower`,
+      `leader-to-follower`,
+      `retry`,
+      `abort`,
+      `release`,
+      `recovery`,
+    ].flatMap((routing) => [0, 1, 33].map((size) => ({ routing, size }))),
+  )(
+    `copies a wire payload only for a coordinator attempt / $routing / $size bytes`,
+    async ({ routing, size }) => {
+      const id = `wire-copy-work-${routing}-${size}`
+      const adapter = createRecordingAdapter()
+      const coordinator = createFailStopCoordinatorHarness(id)
+      let leader = routing === `leader-to-follower` || routing === `recovery`
+      coordinator.isLeader = () => leader
+      const hydrationStarted = createDeferred()
+      const hydrationGate = createDeferred()
+      const retryFinished = createDeferred()
+      const holdHydration = [`leader-to-follower`, `abort`, `release`].includes(
+        routing,
+      )
+      if (holdHydration) {
+        const hydrate = adapter.loadSubset
+        adapter.loadSubset = async (...args) => {
+          hydrationStarted.resolve()
+          await hydrationGate.promise
+          return hydrate(...args)
+        }
+      }
+      const buffer = new ArrayBuffer(size)
+      new Uint8Array(buffer)[0] = 7
+      const label = `wire-copy-work-${routing}-${size}`
+      const literal = Object.freeze({
+        label,
+        buffer,
+        view: new Uint8Array(buffer),
+      })
+      const controller = new AbortController()
+      const options: LoadSubsetOptions = {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`payload`]),
+          new IR.Value(literal),
+        ]),
+        signal: controller.signal,
+      }
+      const snapshots: Array<
+        ReturnType<typeof toTransportedLoadSubsetOptions>
+      > = []
+      const offline = new Error(`transient transport failure`)
+      coordinator.requestEnsureRemoteSubset = (_id, request) => {
+        expect(request).toBe(options)
+        snapshots.push(toTransportedLoadSubsetOptions(request))
+        if (routing === `retry` && snapshots.length === 1) {
+          return Promise.reject(offline)
+        }
+        retryFinished.resolve()
+        return Promise.resolve()
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {}
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      // Track descendants too: copying a prepared copy is still duplicate work.
+      // The positive control fails if the encoder stops using this copy seam.
+      const buffers = new WeakSet([buffer])
+      const slice = ArrayBuffer.prototype.slice
+      let copies = 0
+      const copy = vi
+        .spyOn(ArrayBuffer.prototype, `slice`)
+        .mockImplementation(function (this: ArrayBuffer, start, end) {
+          const result = slice.call(this, start, end)
+          if (buffers.has(this)) {
+            buffers.add(result)
+            copies++
+          }
+          return result
+        })
+      const defineProperty = Object.defineProperty
+      let recordCopies = 0
+      const recordCopy = vi
+        .spyOn(Object, `defineProperty`)
+        .mockImplementation((target, key, descriptor) => {
+          if (key === `label` && descriptor.value === label) recordCopies++
+          return defineProperty(target, key, descriptor)
+        })
+      let hasPrimaryFailure = false
+      try {
+        toTransportedLoadSubsetOptions(options)
+        expect({ copies, recordCopies }).toEqual({ copies: 1, recordCopies: 1 })
+        copies = 0
+        recordCopies = 0
+        collection.startSyncImmediate()
+        await flushAsyncWork()
+        const load = Promise.resolve(collection._sync.loadSubset(options))
+        if (holdHydration) {
+          await hydrationStarted.promise
+          if (routing === `leader-to-follower`) leader = false
+          if (routing === `abort`) controller.abort()
+          if (routing === `release`) collection._sync.unloadSubset(options)
+          hydrationGate.resolve()
+        }
+        if (routing === `retry`) {
+          await expect(load).rejects.toBe(offline)
+          await retryFinished.promise
+        } else if (routing === `abort`) {
+          // Aborting a retained demand rejects rather than reporting a
+          // completed load; the transport-attempt prediction remains zero.
+          await expect(load).rejects.toMatchObject({ name: `AbortError` })
+        } else {
+          await load
+        }
+        if (routing === `recovery`) {
+          expect(snapshots).toHaveLength(0)
+          leader = false
+          coordinator.emit({
+            type: `tx:committed`,
+            term: 1,
+            seq: 2,
+            txId: `gap`,
+            latestRowVersion: 2,
+            changedRows: [],
+            deletedKeys: [],
+            requiresFullReload: true,
+          })
+          await retryFinished.promise
+        }
+        // The independent schedule predicts the number of transport attempts.
+        // At settlement, each snapshot must retain its bytes and shared backing
+        // buffer after the caller changes its input. Identity remains local.
+        const attempts =
+          routing === `retry`
+            ? 2
+            : routing === `abort` || routing === `release`
+              ? 0
+              : 1
+        expect(snapshots).toHaveLength(attempts)
+        new Uint8Array(buffer)[0] = 99
+        for (const snapshot of snapshots) {
+          const expression = snapshot.where
+          expect(expression?.type).toBe(`func`)
+          if (expression?.type !== `func`)
+            throw new Error(`missing wire predicate`)
+          const value = expression.args[1]
+          expect(value?.type).toBe(`val`)
+          if (value?.type !== `val`) throw new Error(`missing wire literal`)
+          const received = value.value as typeof literal
+          expect(received).not.toBe(literal)
+          expect(received.label).toBe(label)
+          expect(received.buffer).not.toBe(buffer)
+          expect(received.view.buffer).toBe(received.buffer)
+          expect(Array.from(received.view)).toEqual(
+            Array.from({ length: size }, (_, index) => (index === 0 ? 7 : 0)),
+          )
+          expect(snapshot).not.toHaveProperty(`signal`)
+        }
+        expect(options.signal).toBe(controller.signal)
+        expect(copies).toBeLessThanOrEqual(attempts)
+        expect(recordCopies).toBeLessThanOrEqual(attempts)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        hydrationGate.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => copy.mockRestore(),
+            () => recordCopy.mockRestore(),
+            () => warning.mockRestore(),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Wire-domain rejection precedes admission to the remote-demand retry path.
+  // Ownerless leaders can become followers while hydration waits; string
+  // controls must dispatch exactly once, while native input never dispatches.
+  // Existing transient-failure histories below retain retry as a separate law.
+  it.each([
+    [`Instant`, `immediate`],
+    [`PlainDate`, `immediate`],
+    [`Instant`, `leader-to-follower`],
+    [`PlainDate`, `leader-to-follower`],
+    [`string`, `immediate`],
+    [`string`, `leader-to-follower`],
+  ] as const)(
+    `applies wire admission before coordinator dispatch / %s / %s`,
+    async (kind, routing) => {
+      const id = `native-wire-${kind}-${routing}`
+      const adapter = createRecordingAdapter()
+      const coordinator = createFailStopCoordinatorHarness(id)
+      const hydrationStarted = createDeferred()
+      const hydrationGate = createDeferred()
+      let isLeader = true
+      coordinator.isLeader = () => isLeader
+      if (routing === `leader-to-follower`) {
+        const hydrate = adapter.loadSubset
+        adapter.loadSubset = async (...args) => {
+          hydrationStarted.resolve()
+          await hydrationGate.promise
+          return hydrate(...args)
+        }
+      }
+      const ensure = vi.fn(
+        (_collectionId: string, options: LoadSubsetOptions) => {
+          toTransportedLoadSubsetOptions(options)
+          return Promise.resolve()
+        },
+      )
+      coordinator.requestEnsureRemoteSubset = ensure
+      const loadSubset = vi.fn()
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return routing === `immediate` ? { loadSubset } : {}
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      try {
+        collection.startSyncImmediate()
+        await flushAsyncWork()
+        const value =
+          kind === `Instant`
+            ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+            : kind === `PlainDate`
+              ? Temporal.PlainDate.from(`2026-01-02`)
+              : `2026-01-02`
+        const options: LoadSubsetOptions = {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`stamp`]),
+            new IR.Value(value),
+          ]),
+        }
+        const load = Promise.resolve().then(async () => {
+          await collection._sync.loadSubset(options)
+        })
+        if (routing === `leader-to-follower`) {
+          await hydrationStarted.promise
+          isLeader = false
+          hydrationGate.resolve()
+        }
+        if (kind === `string`) {
+          await expect(load).resolves.toBeUndefined()
+        } else {
+          await expect(load).rejects.toMatchObject({
+            name: `RemoteSubsetWireValueError`,
+          })
+        }
+        await flushAsyncWork(120)
+        expect(ensure).toHaveBeenCalledTimes(kind === `string` ? 1 : 0)
+        expect(loadSubset).not.toHaveBeenCalled()
+        expect(coordinator.remoteReleaseCalls).toEqual([])
+      } finally {
+        hydrationGate.resolve()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A completed local acquisition remains active across a later role change.
+  // Gap recovery must validate that retained demand before retry admission.
+  it.each([`Instant`, `PlainDate`, `string`] as const)(
+    `validates retained demand after local success and follower recovery / %s`,
+    async (kind) => {
+      const id = `native-post-load-${kind}`
+      const adapter = createRecordingAdapter()
+      const coordinator = createFailStopCoordinatorHarness(id)
+      let leader = true
+      coordinator.isLeader = () => leader
+      const ensure = vi.fn((_id: string, options: LoadSubsetOptions) => {
+        toTransportedLoadSubsetOptions(options)
+        return Promise.resolve()
+      })
+      coordinator.requestEnsureRemoteSubset = ensure
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {}
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      try {
+        collection.startSyncImmediate()
+        await flushAsyncWork()
+        const value =
+          kind === `Instant`
+            ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+            : kind === `PlainDate`
+              ? Temporal.PlainDate.from(`2026-01-02`)
+              : `2026-01-02`
+        const options: LoadSubsetOptions = {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`stamp`]),
+            new IR.Value(value),
+          ]),
+        }
+        await collection._sync.loadSubset(options)
+        expect(ensure).not.toHaveBeenCalled()
+        leader = false
+        coordinator.emit({
+          type: `tx:committed`,
+          term: 1,
+          seq: 2,
+          txId: `gap`,
+          latestRowVersion: 2,
+          changedRows: [],
+          deletedKeys: [],
+          requiresFullReload: true,
+        })
+        await flushAsyncWork()
+        if (kind === `string`) {
+          expect(collection.status).toBe(`ready`)
+          expect(ensure).toHaveBeenCalledTimes(1)
+        } else {
+          expect(collection.status).toBe(`crashed`)
+          await expect(
+            Promise.resolve().then(async () => {
+              await collection._sync.loadSubset(options)
+            }),
+          ).rejects.toMatchObject({ name: `RemoteSubsetWireValueError` })
+          expect(ensure).not.toHaveBeenCalled()
+        }
+      } finally {
+        await collection.cleanup()
+        warning.mockRestore()
+      }
+    },
+  )
+
+  // M7 selects Collection-wide fail-stop for failed fallback gap recovery.
+  // Admission is ordered: a valid prefix may already be in flight, but a
+  // retained invalid demand terminates the run and fences every later demand.
+  // Abort cancels admission without retiring its lease; release retires it.
+  // This bounded model names two demands independently of runtime queues.
+  // It judges dispatch coverage, not retry-attempt multiplicity. Successful
+  // pullSince replay and real-host election timing have separate owners.
+  it.each(
+    ([`Instant`, `PlainDate`, `string`] as const).flatMap((kind) =>
+      ([`candidate-first`, `candidate-last`] as const).flatMap((order) =>
+        ([`retained`, `aborted`, `released`] as const).map((lifetime) => ({
+          kind,
+          order,
+          lifetime,
+        })),
+      ),
+    ),
+  )(
+    `preserves the recovery failure boundary for mixed demands / $kind / $order / $lifetime`,
+    async ({ kind, order, lifetime }) => {
+      const terminal = kind !== `string` && lifetime === `retained`
+      const expectedDispatches =
+        terminal && order === `candidate-first`
+          ? []
+          : lifetime !== `retained` || terminal
+            ? [`sibling`]
+            : [`candidate`, `sibling`]
+      const id = `mixed-recovery-${kind}-${order}-${lifetime}`
+      const adapter = createRecordingAdapter()
+      const coordinator = createFailStopCoordinatorHarness(id)
+      let leader = true
+      coordinator.isLeader = () => leader
+      const controller = new AbortController()
+      const value =
+        kind === `Instant`
+          ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+          : kind === `PlainDate`
+            ? Temporal.PlainDate.from(`2026-01-02`)
+            : `2026-01-02`
+      const candidate: LoadSubsetOptions = {
+        signal: controller.signal,
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`stamp`]),
+          new IR.Value(value),
+        ]),
+      }
+      const sibling: LoadSubsetOptions = { limit: 1 }
+      const demands =
+        order === `candidate-first`
+          ? [candidate, sibling]
+          : [sibling, candidate]
+      const remoteSettlement = createEventGate()
+      // Observe attempted dispatch before the transport settles. A late
+      // rejection after fail-stop must not resurrect the valid prefix's retry.
+      const attempts: Array<LoadSubsetOptions> = []
+      coordinator.requestEnsureRemoteSubset = (_id, options) => {
+        attempts.push(options)
+        toTransportedLoadSubsetOptions(options)
+        return remoteSettlement.promise
+      }
+      const errorReported = createEventGate()
+      const reported: Array<unknown> = []
+      let reentrantFailure: Promise<unknown> | undefined
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {}
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const crash = collection._lifecycle.crash.bind(collection._lifecycle)
+      const report = vi
+        .spyOn(collection._lifecycle, `crash`)
+        .mockImplementation((error) => {
+          reported.push(error)
+          // Invoke while the error is being reported, before core marks the
+          // Collection failed. The runtime must already reject this sibling.
+          reentrantFailure = Promise.resolve(
+            collection._sync.loadSubset(sibling),
+          ).catch((reason: unknown) => reason)
+          crash(error)
+          errorReported.resolve()
+        })
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        for (const demand of demands) await collection._sync.loadSubset(demand)
+        expect(attempts).toEqual([])
+        if (lifetime === `aborted`) controller.abort()
+        if (lifetime === `released`) collection._sync.unloadSubset(candidate)
+        leader = false
+        const emitGap = (seq: number) =>
+          coordinator.emit({
+            type: `tx:committed`,
+            term: 1,
+            seq,
+            txId: `gap-${seq}`,
+            latestRowVersion: seq,
+            changedRows: [],
+            deletedKeys: [],
+            requiresFullReload: true,
+          })
+        emitGap(2)
+        // Recording-adapter I/O is immediate. Drain the turn while transport
+        // remains held; this is not a real-host timing or latency assertion.
+        await flushAsyncWork()
+        expect(collection.status).toBe(terminal ? `crashed` : `ready`)
+        if (terminal) {
+          await atPersistedOracleCheckpoint(
+            errorReported.promise,
+            `mixed recovery error reported`,
+          )
+        } else {
+          // Successful remote work may drain serially. Demand coverage is
+          // required after the prefix settles, not while it remains held.
+          remoteSettlement.resolve()
+          await flushAsyncWork()
+        }
+        const names = attempts.map((options) => {
+          expect(demands).toContain(options)
+          return options === candidate ? `candidate` : `sibling`
+        })
+        expect([...new Set(names)].sort()).toEqual(
+          expectedDispatches.slice().sort(),
+        )
+        const failure = collection._lifecycle.getSyncError()
+        if (terminal) {
+          expect(failure).toMatchObject({ name: `RemoteSubsetWireValueError` })
+          expect(reported).toHaveLength(1)
+          expect(reported[0]).toBe(failure)
+          await expect(reentrantFailure).resolves.toBe(failure)
+          const loads = adapter.loadSubsetCalls.length
+          const dispatched = attempts.length
+          vi.useFakeTimers()
+          if (dispatched > 0) {
+            remoteSettlement.reject(new Error(`late transport failure`))
+          } else {
+            remoteSettlement.resolve()
+          }
+          await vi.advanceTimersByTimeAsync(0)
+          emitGap(3)
+          emitGap(4)
+          await vi.advanceTimersByTimeAsync(1_000)
+          await expect(
+            Promise.resolve(collection._sync.loadSubset(sibling)),
+          ).rejects.toBe(failure)
+          expect(adapter.loadSubsetCalls).toHaveLength(loads)
+          expect(attempts).toHaveLength(dispatched)
+          expect(reported).toHaveLength(1)
+          vi.useRealTimers()
+        } else {
+          expect(failure).toBeUndefined()
+          expect(reported).toEqual([])
+        }
+        // Every retained lease remains releasable, including after abort or
+        // Collection failure. Compare object identity, not structural equality.
+        for (const demand of demands) {
+          if (lifetime !== `released` || demand !== candidate) {
+            collection._sync.unloadSubset(demand)
+          }
+        }
+        const releases =
+          lifetime === `released` ? [candidate, sibling] : demands
+        expect(coordinator.remoteReleaseCalls).toHaveLength(releases.length)
+        releases.forEach((options, index) => {
+          expect(coordinator.remoteReleaseCalls[index]).toBe(options)
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        vi.useRealTimers()
+        remoteSettlement.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => report.mockRestore(),
+            () => collection.cleanup(),
+            () => warning.mockRestore(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`retries queued remote subset ensure after transient failures`, async () => {
+    const adapter = createRecordingAdapter()
+    let ensureCalls = 0
+    const offline = new Error(`offline`)
+
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `retry-node`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => true,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      requestEnsureRemoteSubset: async () => {
+        ensureCalls++
+        if (ensureCalls === 1) {
+          throw offline
+        }
+      },
+      // This fixture isolates ensure retry behavior, not ownership.
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-retry`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: vi.fn() }
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await flushAsyncWork()
+
+    const firstResult = await Promise.resolve(
+      (collection as any)._sync.loadSubset({ limit: 1 }),
+    ).then(
+      () => `ready`,
+      (error: unknown) => error,
+    )
+    await flushAsyncWork(120)
+
+    expect(firstResult).toBe(offline)
+    expect(ensureCalls).toBeGreaterThanOrEqual(2)
+  })
+
+  it(`does not route remote demand from an ownerless elected leader`, async () => {
+    const ensure = vi.fn(async () => {
+      throw new Error(`no remote subset owner registered`)
+    })
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `ownerless-node`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => true,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      requestEnsureRemoteSubset: ensure,
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `ownerless-on-demand-source`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter: createRecordingAdapter(),
+          coordinator,
+        },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await flushAsyncWork()
+
+      await expect(
+        Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
+      ).resolves.toBeUndefined()
+      await flushAsyncWork(120)
+
+      expect(ensure).not.toHaveBeenCalled()
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`uses dispatch-time ownership after follower hydration becomes ownerless leader`, async () => {
+    const adapter = createRecordingAdapter()
+    const loadSubset = adapter.loadSubset
+    let markHydrationStarted = (): void => {}
+    const hydrationStarted = new Promise<void>((resolve) => {
+      markHydrationStarted = resolve
+    })
+    let releaseHydration = (): void => {}
+    const hydrationGate = new Promise<void>((resolve) => {
+      releaseHydration = resolve
+    })
+    adapter.loadSubset = async (...args) => {
+      markHydrationStarted()
+      await hydrationGate
+      return loadSubset(...args)
+    }
+
+    let isLeader = false
+    const staleEnsure = new Error(`ownerless leader must not route demand`)
+    const ensure = vi.fn(() => Promise.reject(staleEnsure))
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `transitioning-node`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => isLeader,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      requestEnsureRemoteSubset: ensure,
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `dispatch-time-ownerless-leader`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {}
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await flushAsyncWork()
+      const load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+      await hydrationStarted
+      isLeader = true
+      releaseHydration()
+
+      await expect(load).resolves.toBeUndefined()
+      expect(ensure).not.toHaveBeenCalled()
+    } finally {
+      releaseHydration()
+      await collection.cleanup()
+    }
+  })
+
+  it(`routes follower demand without a local subset owner`, async () => {
+    const ensure = vi.fn(async () => {})
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `ownerless-follower`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => false,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      requestEnsureRemoteSubset: ensure,
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+    }
+    const collectionId = `ownerless-on-demand-follower`
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter: createRecordingAdapter(),
+          coordinator,
+        },
+      }),
+    )
+    const options = { limit: 1 }
+
+    try {
+      collection.startSyncImmediate()
+      await flushAsyncWork()
+
+      await expect(
+        Promise.resolve(collection._sync.loadSubset(options)),
+      ).resolves.toBeUndefined()
+
+      expect(ensure).toHaveBeenCalledTimes(1)
+      expect(ensure).toHaveBeenCalledWith(collectionId, options)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`fails sync-absent persistence when follower ack omits mutation ids`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `follower-node`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => false,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      // This fixture isolates follower transaction acknowledgements.
+      requestEnsureRemoteSubset: async () => {},
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+      requestApplyLocalMutations: async () => ({
+        type: `rpc:applyLocalMutations:res`,
+        rpcId: `ack-1`,
+        ok: true,
+        term: 1,
+        seq: 1,
+        latestRowVersion: 1,
+        acceptedMutationIds: [],
+      }),
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-absent-ack`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    const tx = collection.insert({
+      id: `ack-mismatch`,
+      title: `Ack mismatch`,
+    })
+
+    await expect(tx.isPersisted.promise).rejects.toThrow(
+      /partial acceptance is not supported/,
+    )
+    expect(collection.get(`ack-mismatch`)).toBeUndefined()
+  })
+
+  it.each([
+    {
+      boundary: `follower` as const,
+      responseCode: `PERSISTENCE_ERROR` as const,
+      expectedDurabilityError: true,
+    },
+    {
+      boundary: `elected-leader` as const,
+      responseCode: `PERSISTENCE_ERROR` as const,
+      expectedDurabilityError: true,
+    },
+    {
+      boundary: `follower` as const,
+      responseCode: `NOT_LEADER` as const,
+      expectedDurabilityError: false,
+    },
+    {
+      boundary: `follower` as const,
+      responseCode: `VALIDATION_ERROR` as const,
+      expectedDurabilityError: false,
+    },
+    {
+      boundary: `follower` as const,
+      responseCode: `CONFLICT` as const,
+      expectedDurabilityError: false,
+    },
+    {
+      boundary: `follower` as const,
+      responseCode: `TIMEOUT` as const,
+      expectedDurabilityError: false,
+    },
+  ])(
+    `classifies public local-mutation failure at the $boundary boundary: $responseCode`,
+    async ({ boundary, responseCode, expectedDurabilityError }) => {
+      const persistenceResponse =
+        responseCode === `PERSISTENCE_ERROR`
+          ? {
+              type: `rpc:applyLocalMutations:res` as const,
+              rpcId: `local-${boundary}-persistence-response`,
+              ok: false as const,
+              code: `PERSISTENCE_ERROR` as const,
+              error: `disk write failed`,
+              sourceCode: `SQLITE_IOERR_FSYNC`,
+              path: [`database`, `wal`] as const,
+            }
+          : {
+              type: `rpc:applyLocalMutations:res` as const,
+              rpcId: `local-${boundary}-failure-response`,
+              ok: false as const,
+              code: responseCode,
+              error: `mutation route changed`,
+            }
+      const coordinator = createCoordinatorHarness()
+      coordinator.isLeader = () => boundary === `elected-leader`
+      coordinator.requestApplyLocalMutations = () =>
+        Promise.resolve(persistenceResponse)
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `local-mutation-${boundary}-${responseCode}`,
+          getKey: (item) => item.id,
+          persistence: {
+            adapter: createRecordingAdapter(),
+            coordinator,
+          },
+        }),
+      )
+
+      try {
+        const tx = collection.insert({
+          id: `local-failure`,
+          title: `Must not persist`,
+        })
+        const rejection = await tx.isPersisted.promise.then(
+          () => undefined,
+          (error: unknown) => error,
+        )
+
+        // Earlier laws covered external-sync commit classification and a
+        // successful follower mutation acknowledgement. They never varied a
+        // serialized applyLocalMutations failure by route. The elected-leader
+        // and non-durability rows are hostile controls for topology parity and
+        // for avoiding an over-broad fail-stop classifier.
+        if (expectedDurabilityError) {
+          expect(rejection).toMatchObject({
+            name: `PersistedCollectionDurabilityError`,
+            code: `SQLITE_IOERR_FSYNC`,
+            path: [`database`, `wal`],
+            cause: persistenceResponse,
+          })
+          expect(collection.status).toBe(`crashed`)
+          expect(collection._lifecycle.getSyncError()).toBe(rejection)
+        } else {
+          expect(rejection).toMatchObject({
+            name: `Error`,
+            message:
+              `failed to apply local mutations through coordinator: ` +
+              `mutation route changed`,
+          })
+          expect(collection._lifecycle.getSyncError()).toBeUndefined()
+        }
+      } finally {
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`installs terminal state before synchronously reporting a local coordinator durability error`, async () => {
+    const coordinator = createCoordinatorHarness()
+    let requestCalls = 0
+    coordinator.requestApplyLocalMutations = async (
+      _collectionId,
+      mutations,
+    ) => {
+      requestCalls++
+      if (requestCalls === 1) {
+        return {
+          type: `rpc:applyLocalMutations:res`,
+          rpcId: `local-reentrant-failure`,
+          ok: false,
+          code: `PERSISTENCE_ERROR`,
+          error: `disk write failed`,
+          sourceCode: `SQLITE_IOERR_FSYNC`,
+          path: [`database`, `wal`],
+        }
+      }
+      return {
+        type: `rpc:applyLocalMutations:res`,
+        rpcId: `local-reentrant-success`,
+        ok: true,
+        term: 1,
+        seq: requestCalls,
+        latestRowVersion: requestCalls,
+        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
+      }
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `local-terminal-before-report`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter: createRecordingAdapter(),
+          coordinator,
+        },
+      }),
+    )
+    const now = new Date()
+    const reentrantRow = {
+      id: `reentrant-local`,
+      title: `must not reach the coordinator`,
+    }
+    const reentrantMutation: PendingMutation<Todo, `insert`> = {
+      mutationId: `reentrant-local-mutation`,
+      original: {},
+      modified: reentrantRow,
+      changes: reentrantRow,
+      globalKey: `local-terminal-before-report:reentrant-local`,
+      key: reentrantRow.id,
+      type: `insert`,
+      metadata: undefined,
+      syncMetadata: {},
+      optimistic: true,
+      createdAt: now,
+      updatedAt: now,
+      collection,
+    }
+    let reentrantOutcome:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      const originalCrash = collection._lifecycle.crash.bind(
+        collection._lifecycle,
+      )
+      vi.spyOn(collection._lifecycle, `crash`).mockImplementation((error) => {
+        reentrantOutcome = Promise.resolve(
+          collection.utils.acceptMutations({
+            mutations: [
+              reentrantMutation as unknown as PendingMutation<
+                Record<string, unknown>
+              >,
+            ],
+          }),
+        ).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        )
+        originalCrash(error)
+      })
+
+      const primary = collection.insert({
+        id: `primary-local`,
+        title: `must install terminal state`,
+      })
+      const primaryOutcome = await primary.isPersisted.promise.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      const reentrant = await atPersistedOracleCheckpoint(
+        reentrantOutcome!,
+        `reentrant local mutation after durability error`,
+      )
+      const terminalError =
+        primaryOutcome.status === `rejected` ? primaryOutcome.reason : undefined
+
+      expect({
+        primaryStatus: primaryOutcome.status,
+        reentrantStatus: reentrant.status,
+        sameTerminal:
+          reentrant.status === `rejected` && reentrant.reason === terminalError,
+        requestCalls,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+        reentrantVisible: collection.get(reentrantRow.id),
+      }).toEqual({
+        primaryStatus: `rejected`,
+        reentrantStatus: `rejected`,
+        sameTerminal: true,
+        requestCalls: 1,
+        exactPublicError: true,
+        reentrantVisible: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => reentrantOutcome, () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`preserves lifecycle abort classification when cleanup wins a local adapter race`, async () => {
+    const adapter = createRecordingAdapter()
+    const successfulApply = adapter.applyCommittedTx.bind(adapter)
+    const persistenceEntered = createEventGate()
+    const releasePersistence = createEventGate()
+    adapter.applyCommittedTx = async (...args) => {
+      persistenceEntered.resolve()
+      await releasePersistence.promise
+      await successfulApply(...args)
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `local-cleanup-durability-race`,
+        getKey: (item) => item.id,
+        persistence: { adapter },
+      }),
+    )
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      const transaction = collection.insert({
+        id: `old-local`,
+        title: `durable only in the replaced lifecycle`,
+      })
+      const settlement = transaction.isPersisted.promise.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        persistenceEntered.promise,
+        `local adapter entered before cleanup`,
+      )
+
+      await collection.cleanup()
+      cleanedUp = true
+      releasePersistence.resolve()
+      const outcome = await atPersistedOracleCheckpoint(
+        settlement,
+        `old local mutation settled after cleanup`,
+      )
+
+      expect({
+        status: outcome.status,
+        aborted:
+          outcome.status === `rejected` &&
+          outcome.reason instanceof SyncTransactionAbortedError,
+        durability:
+          outcome.status === `rejected` &&
+          outcome.reason instanceof PersistedCollectionDurabilityError,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        status: `rejected`,
+        aborted: true,
+        durability: false,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releasePersistence.resolve()
+      await cleanupPersistedOracle(
+        [() => (cleanedUp ? undefined : collection.cleanup())],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`checks durable row authority when a targeted public-key change could be a replacement`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `Original`, detail: `removed by insert` },
+    ])
+    const coordinator = createCoordinatorHarness()
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+    const loadSubsetCallsAfterPreload = adapter.loadSubsetCalls.length
+
+    // The envelope has no insert/update certificate. Durable insert may have
+    // replaced the entire row, including a field omitted from the notice.
+    adapter.rows.set(`1`, { id: `1`, title: `Updated` })
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-targeted`,
+      latestRowVersion: 1,
+      requiresFullReload: false,
+      changedRows: [{ key: `1`, value: { id: `1`, title: `Updated` } }],
+      deletedKeys: [],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(adapter.loadSubsetCalls.length).toBe(loadSubsetCallsAfterPreload + 1)
+    expect(stripVirtualProps(collection.get(`1`))).toEqual({
+      id: `1`,
+      title: `Updated`,
+    })
+  })
+
+  it(`targeted update removes row that no longer matches WHERE`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `Keep` },
+      { id: `2`, title: `Keep` },
+    ])
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    adapter.loadSubset = async (id, options, context) =>
+      (await loadSubset(id, options, context)).filter(
+        (row) => !options.where || row.value.title === `Keep`,
+      )
+    const coordinator = createCoordinatorHarness()
+
+    const whereExpr = new IR.Func(`eq`, [
+      new IR.PropRef([`title`]),
+      new IR.Value(`Keep`),
+    ])
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await flushAsyncWork()
+
+    // Load a filtered subset with WHERE title = 'Keep'
+    await (collection as any)._sync.loadSubset({ where: whereExpr })
+    await flushAsyncWork()
+    expect(stripVirtualProps(collection.get(`2`))).toEqual({
+      id: `2`,
+      title: `Keep`,
+    })
+
+    // Change the row so it no longer matches WHERE title = 'Keep'
+    adapter.rows.set(`2`, { id: `2`, title: `Changed` })
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-where`,
+      latestRowVersion: 1,
+      requiresFullReload: false,
+      changedRows: [{ key: `2`, value: { id: `2`, title: `Changed` } }],
+      deletedKeys: [],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    // Row no longer matches WHERE — should be removed from collection
+    expect(collection.get(`2`)).toBeUndefined()
+  })
+
+  it(`paginated subset falls back to full reload`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Row 1` }])
+    const coordinator = createCoordinatorHarness()
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await flushAsyncWork()
+
+    // Add a paginated subset (limit)
+    await (collection as any)._sync.loadSubset({ limit: 10 })
+    await flushAsyncWork()
+    const loadSubsetCallsAfterPaginated = adapter.loadSubsetCalls.length
+
+    // Update the row in the adapter backing store
+    adapter.rows.set(`1`, { id: `1`, title: `Updated` })
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-paginated`,
+      latestRowVersion: 1,
+      requiresFullReload: false,
+      changedRows: [{ key: `1`, value: { id: `1`, title: `Updated` } }],
+      deletedKeys: [],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    // With a paginated subset active, should fall back to full reload
+    expect(adapter.loadSubsetCalls.length).toBeGreaterThan(
+      loadSubsetCallsAfterPaginated,
+    )
+    expect(stripVirtualProps(collection.get(`1`))).toEqual({
+      id: `1`,
+      title: `Updated`,
+    })
+  })
+
+  // A scoped source snapshot establishes row 1. A coordinator notification
+  // cannot replace it from an uncertified cache; instead the active demand
+  // must request fresh source evidence. The five legal histories cross targeted,
+  // paginated, full-reload, sequence-gap, and reset notifications. The recording adapter is
+  // durable state, not the expected source result. The apply-mutex fence below
+  // places the public-row comparison after coordinator processing and checks
+  // a second source acquisition. This owner
+  // isolates the wrapper boundary; installed Electric delivery has a receiver.
+  it.each([
+    `targeted change`,
+    `paginated change`,
+    `full reload`,
+    `sequence gap`,
+    `durable reset`,
+  ] as const)(`keeps an active scoped source row after %s`, async (event) => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createLocalCoordinatorHarness()
+    let source!: TodoSyncParams
+    let sourceLoads = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return {
+              loadSubset: async () => {
+                sourceLoads++
+              },
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await flushAsyncWork()
+    const capability = source.metadata?.persistence
+    expect(capability?.startScopedRecovery).toBeTypeOf(`function`)
+    await capability!.startScopedRecovery!()
+
+    const sourceRow: Todo = { id: `1`, title: `Source row` }
+    source.begin()
+    source.write({ type: `insert`, value: sourceRow })
+    await whenSyncAccepted(source.commit())
+    await collection._sync.loadSubset(
+      event === `targeted change` ? {} : { limit: 10 },
+    )
+    expect(sourceLoads).toBe(1)
+    expect(stripVirtualProps(collection.get(`1`))).toEqual(sourceRow)
+
+    const latest = adapter.applyCommittedTxCalls.at(-1)!.tx
+    if (event === `durable reset`) {
+      adapter.rows.clear()
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 1,
+      })
+    } else if (event === `sequence gap`) {
+      Object.assign(coordinator, {
+        pullSince: (): Promise<PullSinceResponse> =>
+          Promise.resolve({
+            type: `rpc:pullSince:res`,
+            rpcId: `scoped-gap`,
+            ok: true,
+            latestTerm: latest.term,
+            latestSeq: latest.seq + 2,
+            latestRowVersion: latest.rowVersion + 2,
+            requiresFullReload: true,
+          }),
+      })
+      coordinator.emit({
+        type: `tx:committed`,
+        term: latest.term,
+        seq: latest.seq + 2,
+        txId: `scoped-sequence-gap`,
+        latestRowVersion: latest.rowVersion + 2,
+        requiresFullReload: true,
+      })
+    } else if (event === `full reload`) {
+      // A transaction above the coordinator's targeted-invalidation limit can
+      // change many unrelated durable rows without changing source row 1.
+      for (let id = 2; id <= 130; id++) {
+        adapter.rows.set(String(id), { id: String(id), title: `Other ${id}` })
+      }
+      coordinator.emit({
+        type: `tx:committed`,
+        term: latest.term,
+        seq: latest.seq + 1,
+        txId: `large-scoped-change`,
+        latestRowVersion: latest.rowVersion + 1,
+        requiresFullReload: true,
+      })
+    } else {
+      const durableRow: Todo =
+        event === `targeted change`
+          ? { id: `1`, title: `Uncertified durable update` }
+          : { id: `2`, title: `Unrelated durable row` }
+      adapter.rows.set(durableRow.id, durableRow)
+      coordinator.emit({
+        type: `tx:committed`,
+        term: latest.term,
+        seq: latest.seq + 1,
+        txId: `scoped-change`,
+        latestRowVersion: latest.rowVersion + 1,
+        requiresFullReload: false,
+        changedRows: [{ key: durableRow.id, value: durableRow }],
+        deletedKeys: [],
+      })
+    }
+
+    // scanPersistedRows enters the same apply mutex after event admission, so
+    // this observes the settled coordinator invalidation rather than a race.
+    await capability!.scanPersistedRows()
+    expect(stripVirtualProps(collection.get(`1`))).toEqual(sourceRow)
+    expect(adapter.loadSubsetCalls).toEqual([])
+    await vi.waitFor(() => expect(sourceLoads).toBe(2))
+  })
+
+  // This deliberately wrong global-eviction message is a hostile control for
+  // the two-run Browser generation-routing oracle. A global full reload makes
+  // the warm run lose a valid source row, so it cannot implement cache
+  // retirement. This driver checks that the public-row comparison detects
+  // the fault; no production path emits this fabricated cacheEviction field.
+  it(`detects that global cache eviction removes a warm source row`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createLocalCoordinatorHarness()
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await vi.waitFor(() => expect(source).toBeDefined())
+      const sourceRow = { id: `warm`, title: `Valid source row` }
+      source.begin()
+      source.write({ type: `insert`, value: sourceRow })
+      await whenSyncAccepted(source.commit())
+      await collection._sync.loadSubset({ limit: 10 })
+      const readsBeforeEviction = adapter.loadSubsetCalls.length
+      const latest = adapter.applyCommittedTxCalls.at(-1)!.tx
+
+      adapter.rows.clear()
+      coordinator.emit({
+        type: `tx:committed`,
+        term: latest.term,
+        seq: latest.seq + 1,
+        txId: `peer-cache-eviction`,
+        latestRowVersion: latest.rowVersion + 1,
+        requiresFullReload: true,
+        cacheEviction: true,
+      } as unknown as TxCommitted)
+
+      await source.metadata!.persistence!.scanPersistedRows()
+      expect(stripVirtualProps(collection.get(`warm`))).toBeUndefined()
+      expect(adapter.loadSubsetCalls.length).toBeGreaterThan(
+        readsBeforeEviction,
+      )
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // Scoped recovery removes durable rows' authority to enter the public
+  // Collection. This recording adapter has no generation catalog, so its old
+  // rows remain on disk in the model; the SQLite owner checks physical
+  // retirement separately. A later baseline capability call cannot revive
+  // the row. This driver checks public visibility and the adapter read boundary.
+  it(`does not hydrate durable baseline rows during scoped recovery`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `Stale durable row` },
+    ])
+    const resetMarker = { kind: `reset`, updatedAt: 1 }
+    adapter.collectionMetadata.set(`electric:resume`, resetMarker)
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `scoped-baseline-quarantine`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await flushAsyncWork()
+      const capability = source.metadata!.persistence!
+      await capability.startScopedRecovery!()
+      expect(collection.get(`1`)).toBeUndefined()
+      expect(adapter.rows.has(`1`)).toBe(true)
+      expect(adapter.collectionMetadata.get(`electric:resume`)).toEqual(
+        resetMarker,
+      )
+      await capability.hydrateBaseline()
+      expect(collection.get(`1`)).toBeUndefined()
+      expect(
+        adapter.loadResumeSnapshotCalls.filter(
+          (call) => call.includeRows === true,
+        ),
+      ).toEqual([])
+
+      // A later loss of authority in the same sync run must retire rows that
+      // arrived after the first clear, rather than growing the cache forever.
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `2`, title: `Later source row` },
+      })
+      await whenSyncAccepted(source.commit())
+      expect(adapter.rows.has(`2`)).toBe(true)
+      await capability.startScopedRecovery!()
+      expect(collection.get(`2`)).toBeUndefined()
+      expect(adapter.rows.has(`1`)).toBe(true)
+      expect(adapter.rows.has(`2`)).toBe(true)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // A local load can begin before scoped recovery claims the Collection.
+  // When that load fails, queued partial source work may ask for a durable
+  // baseline. The independent source model permits the partial source fields,
+  // but no old durable field has authority after the scoped clear. The gate
+  // fixes the order at the adapter boundary; the observations are the stale
+  // public field and full-row read count.
+  it(`keeps a failed local load from restoring scoped durable rows`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `shared`, title: `Stale durable`, detail: `stale detail` },
+    ])
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    const localFailure = new Error(`local load failed`)
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw localFailure
+    }
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `scoped-failed-local-load`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<unknown> | undefined
+    let receipt: Promise<unknown> | undefined
+    let scoped: Promise<void> | undefined
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `scoped failed local load startup`,
+      )
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+      void load.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        loadEntered.promise,
+        `scoped failed local load entered`,
+      )
+      source.begin()
+      source.write({
+        type: `update`,
+        value: { id: `shared`, title: `Partial source` } as Todo,
+      })
+      receipt = Promise.resolve(source.commit())
+      void receipt.catch(() => undefined)
+      scoped = source.metadata!.persistence!.startScopedRecovery!()
+      rejectLoad.resolve()
+      await expect(load).rejects.toBe(localFailure)
+      await atPersistedOracleCheckpoint(scoped, `scoped failed load clear`)
+      await Promise.allSettled([receipt])
+      expect(collection.get(`shared`)).toMatchObject({
+        id: `shared`,
+        title: `Partial source`,
+      })
+      expect(collection.get(`shared`)?.detail).toBeUndefined()
+      expect(
+        adapter.loadResumeSnapshotCalls.filter(
+          (call) => call.includeRows === true,
+        ),
+      ).toEqual([])
+    } finally {
+      rejectLoad.resolve()
+      await Promise.allSettled([load, receipt, scoped])
+      await collection.cleanup()
+    }
+  })
+
+  // Source work admitted while an old cache read is in flight belongs to the
+  // old persisted cache generation. Rotation may overtake that work at the
+  // apply mutex, but it cannot turn the old source result into a row in the
+  // new generation. The held local read fixes the ordering; the applied
+  // receipt and durable write destination are the comparison checkpoint.
+  // A sync adapter reports through its own sync params that served pages
+  // may have shifted. Under a managed cache generation the wrapper gives each
+  // source session its own params, so the report must reach the public
+  // Collection from the current session and be dropped from a retired one;
+  // otherwise a stale source could start repairs on the replacement.
+  it(`forwards a loaded-subset report only from the current source session`, async () => {
+    const adapter = createRecordingAdapter()
+    let currentStorageId = `report-old-storage`
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: currentStorageId,
+      claimId: `report-claim`,
+    })
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: (currentStorageId = `report-new-storage`),
+      claimId: `report-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const sessions: Array<TodoSyncParams> = []
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `loaded-subset-report-sessions`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sessions.push(params)
+            params.markReady()
+            // Without its own restart hook, the source is retired and
+            // re-entered with fresh params after a scoped rotation.
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let reports = 0
+    const unsubscribe = collection.on(`loadedSubsets:invalidated`, () => {
+      reports++
+    })
+    // Reports are coalesced into a microtask; a macrotask lets them land.
+    const reportsAfter = async (report: () => void) => {
+      const before = reports
+      report()
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      return reports - before
+    }
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      const first = sessions[0]!
+      expect(await reportsAfter(() => first.invalidateLoadedSubsets())).toBe(1)
+
+      await atPersistedOracleCheckpoint(
+        first.metadata!.persistence!.startScopedRecovery!(),
+        `scoped rotation`,
+      )
+      expect(sessions).toHaveLength(2)
+      const replacement = sessions[1]!
+      expect({
+        retired: await reportsAfter(() => first.invalidateLoadedSubsets()),
+        replacement: await reportsAfter(() =>
+          replacement.invalidateLoadedSubsets(),
+        ),
+      }).toEqual({ retired: 0, replacement: 1 })
+    } finally {
+      unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`rejects a queued old-generation source commit after scoped rotation`, async () => {
+    const adapter = createRecordingAdapter()
+    const loadEntered = createEventGate()
+    const releaseLoad = createEventGate()
+    const claimId = `queued-old-claim`
+    let currentStorageId = `queued-old-storage`
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: currentStorageId,
+      claimId,
+    })
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: (currentStorageId = `queued-new-storage`),
+      claimId,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await releaseLoad.promise
+      return []
+    }
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `queued-generation-rotation`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            // The controlled source has no pending asynchronous callback.
+            // Its old commit is already queued inside the persisted wrapper.
+            return {
+              // An on-demand source serves the subsets that recovery
+              // reacquires in the new generation.
+              loadSubset: () => true,
+              restartAfterScopedRecovery: () => {},
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    let load: Promise<unknown> | undefined
+    let receipt: Promise<unknown> | undefined
+    let recovery: Promise<void> | undefined
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+      void load.catch(() => undefined)
+      await atPersistedOracleCheckpoint(loadEntered.promise, `old cache read`)
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `old-source`, title: `Old source result` },
+      })
+      receipt = Promise.resolve(source.commit())
+      void receipt.catch(() => undefined)
+      recovery = source.metadata!.persistence!.startScopedRecovery!()
+      releaseLoad.resolve()
+      await atPersistedOracleCheckpoint(recovery, `scoped rotation`)
+      await expect(receipt).rejects.toBeInstanceOf(SyncTransactionAbortedError)
+      expect(
+        adapter.applyCommittedTxCalls.filter(
+          (call) => call.collectionId === `queued-new-storage`,
+        ),
+      ).toEqual([])
+      expect(collection.get(`old-source`)).toBeUndefined()
+
+      // Cancellation belongs only to the old admission. Fresh work in the
+      // new generation still applies and persists through the same sync run.
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `new-source`, title: `New source result` },
+      })
+      await whenSyncAccepted(source.commit())
+      // Recovery succeeded: the Collection still accepts sync data.
+      expect(collection.status).toBe(`ready`)
+      expect(collection.get(`new-source`)).toMatchObject({
+        id: `new-source`,
+        title: `New source result`,
+      })
+      expect(
+        adapter.applyCommittedTxCalls
+          .filter((call) => call.collectionId === `queued-new-storage`)
+          .flatMap((call) => call.tx.mutations.map((mutation) => mutation.key)),
+      ).toEqual([`new-source`])
+    } finally {
+      releaseLoad.resolve()
+      await Promise.allSettled([load, receipt, recovery])
+      await collection.cleanup()
+    }
+  })
+
+  // Cleanup can release the original claim while a rotation is paused before
+  // SQLite admission. If rotation then creates a private generation, that
+  // late claim still belongs to the cleaned-up sync run and must be released.
+  // The independent claim ledger observes ownership after both operations
+  // settle; checking only the public Collection would miss leaked storage.
+  it(`releases a cache claim created by rotation after cleanup`, async () => {
+    const adapter = createRecordingAdapter()
+    const liveClaims = new Set<string>()
+    const rotationEntered = createEventGate()
+    const releaseRotation = createEventGate()
+    adapter.claimCacheGeneration = async () => {
+      liveClaims.add(`old-claim`)
+      return { storageCollectionId: `old-storage`, claimId: `old-claim` }
+    }
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      expect(liveClaims.has(`old-claim`)).toBe(false)
+      liveClaims.add(`private-claim`)
+      return {
+        storageCollectionId: `private-storage`,
+        claimId: `private-claim`,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async (claimId) => {
+      liveClaims.delete(claimId)
+    }
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `cleanup-during-cache-rotation`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { restartAfterScopedRecovery: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let recovery: Promise<void> | undefined
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      recovery = source.metadata!.persistence!.startScopedRecovery!()
+      void recovery.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        rotationEntered.promise,
+        `held cache rotation`,
+      )
+      await collection.cleanup()
+      expect(liveClaims.size).toBe(0)
+      releaseRotation.resolve()
+      await Promise.allSettled([recovery])
+      expect([...liveClaims]).toEqual([])
+    } finally {
+      releaseRotation.resolve()
+      await Promise.allSettled([recovery])
+      await collection.cleanup()
+    }
+  })
+
+  // A custom source is allowed to omit a provider-specific restart hook. Its
+  // Collection must still recover after claim expiry: the wrapper ends the old
+  // source session, rotates storage, and starts a fresh source session. A held
+  // callback from the retired session has no authority over new public rows or
+  // durable storage. The source-session and row ledgers are independent of the
+  // wrapper's recovery flags.
+  it.each([false, true])(
+    `restarts a custom on-demand source after its cache claim expires (prior demand=%s)`,
+    async (priorDemand) => {
+      const adapter = createRecordingAdapter([
+        { id: `stale`, title: `Old persisted row` },
+      ])
+      let rotations = 0
+      let sourceStarts = 0
+      let sourceCleanups = 0
+      const sourceSessions: Array<TodoSyncParams> = []
+      let revokeClaim = false
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: `old-storage`,
+        claimId: `old-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      })
+      adapter.renewCacheGenerationClaim = async (_storageId, claimId) =>
+        revokeClaim && claimId === `old-claim` ? undefined : Date.now() + 10_000
+      adapter.rotateCacheGeneration = async () => {
+        rotations++
+        return {
+          storageCollectionId: `new-storage`,
+          claimId: `new-claim`,
+        }
+      }
+      adapter.releaseCacheGenerationClaim = async () => {}
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `custom-cache-source`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              const session = ++sourceStarts
+              sourceSessions.push(params)
+              params.markReady()
+              return {
+                cleanup: () => {
+                  sourceCleanups++
+                },
+                loadSubset: async () => {
+                  params.begin()
+                  params.write({
+                    type: `update`,
+                    value: {
+                      id: `row-${session}`,
+                      title: `Session ${session}`,
+                    },
+                  })
+                  await params.commit()
+                },
+              }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const releaseOldCallback = createEventGate()
+      let lateCallback: Promise<void> | undefined
+
+      try {
+        await collection.stateWhenReady()
+        expect(sourceStarts).toBe(1)
+        const oldSource = sourceSessions[0]!
+        lateCallback = (async () => {
+          await releaseOldCallback.promise
+          oldSource.begin()
+          oldSource.write({
+            type: `insert`,
+            value: { id: `late-old`, title: `Retired session` },
+          })
+          await oldSource.commit()
+        })()
+        if (priorDemand) {
+          await collection._sync.loadSubset({ limit: 2 })
+          expect(collection.get(`row-1`)).toBeDefined()
+        }
+        revokeClaim = true
+        await collection._sync.loadSubset({ limit: 1 })
+        expect(sourceStarts).toBe(2)
+        expect(sourceCleanups).toBe(1)
+        expect(rotations).toBe(1)
+        expect(collection.get(`stale`)).toBeUndefined()
+        expect(collection.get(`row-1`)).toBeUndefined()
+        expect(collection.get(`row-2`)).toMatchObject({
+          id: `row-2`,
+          title: `Session 2`,
+        })
+        releaseOldCallback.resolve()
+        await lateCallback
+        expect(collection.get(`late-old`)).toBeUndefined()
+        expect(
+          adapter.applyCommittedTxCalls.some(({ tx }) =>
+            tx.mutations.some(({ key }) => key === `late-old`),
+          ),
+        ).toBe(false)
+        // The retired session's reports have no authority over the node:
+        // its error does not show, and its recovery does not clear the live
+        // session's problem.
+        oldSource.reportError(new Error(`retired session`))
+        await flushAsyncWork()
+        expect(collection.health.failureReason).toBeNull()
+        sourceSessions[1]!.reportError(new Error(`live session`))
+        await flushAsyncWork()
+        oldSource.reportHealthy()
+        await flushAsyncWork()
+        expect(collection.health.failureReason?.message).toBe(`live session`)
+      } finally {
+        releaseOldCallback.resolve()
+        await Promise.allSettled([lateCallback])
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // Cleanup can win after the old custom session retires but before SQLite
+  // returns its replacement claim. That history owns one source cleanup and
+  // must not start another source session after Collection disposal.
+  it(`does not restart a custom source after cleanup wins a held rotation`, async () => {
+    const adapter = createRecordingAdapter()
+    const rotationEntered = createEventGate()
+    const releaseRotation = createEventGate()
+    let sourceStarts = 0
+    let sourceCleanups = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `old-storage`,
+      claimId: `old-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      return { storageCollectionId: `new-storage`, claimId: `new-claim` }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `custom-cleanup-during-rotation`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceStarts++
+            source = params
+            params.markReady()
+            return {
+              cleanup: () => {
+                sourceCleanups++
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let recovery: Promise<void> | undefined
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      recovery = source.metadata!.persistence!.startScopedRecovery!()
+      void recovery.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        rotationEntered.promise,
+        `held custom cache rotation`,
+      )
+      await collection.cleanup()
+      releaseRotation.resolve()
+      await Promise.allSettled([recovery])
+      expect({ sourceStarts, sourceCleanups }).toEqual({
+        sourceStarts: 1,
+        sourceCleanups: 1,
+      })
+    } finally {
+      releaseRotation.resolve()
+      await Promise.allSettled([recovery])
+      await collection.cleanup()
+    }
+  })
+
+  // A startup resume read may pass SQLite's first claim check, then fail its
+  // second check after the claim expires. The independent authority rule
+  // discards that old read and rotates privately before source entry. A read
+  // error while the claim remains live has no such explanation and stays
+  // terminal. The held read and clock distinguish these histories at source
+  // entry, Collection readiness, and physical storage choice.
+  it.each([
+    { outcome: `expired claim`, expires: true },
+    { outcome: `live I/O failure`, expires: false },
+  ])(
+    `classifies a rejected startup resume read: $outcome`,
+    async ({ expires }) => {
+      const adapter = createRecordingAdapter()
+      const readEntered = createEventGate()
+      const releaseRead = createEventGate()
+      const storageId = `startup-rejected-old`
+      let currentStorageId = storageId
+      let now = 1_000
+      let expiresAtMs = 2_000
+      let rotations = 0
+      let sourceStarts = 0
+      const ioFailure = new Error(`live startup read failed`)
+      const claimFailure = new InvalidPersistedCollectionConfigError(
+        `Persisted cache claim is no longer active for collection "${storageId}"`,
+      )
+      adapter.getCacheGenerationNow = () => now
+      adapter.claimCacheGeneration = async () => ({
+        storageCollectionId: currentStorageId,
+        claimId: `startup-rejected-claim`,
+        expiresAtMs,
+      })
+      adapter.renewCacheGenerationClaim = async () =>
+        now < expiresAtMs ? (expiresAtMs = now + 1_000) : undefined
+      adapter.rotateCacheGeneration = async () => {
+        rotations++
+        currentStorageId = `startup-rejected-new`
+        expiresAtMs = now + 1_000
+        return {
+          storageCollectionId: currentStorageId,
+          claimId: `startup-rejected-claim`,
+          expiresAtMs,
+        }
+      }
+      adapter.releaseCacheGenerationClaim = async () => {}
+      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+      adapter.loadResumeSnapshot = async (id, options) => {
+        if (recordedStorageId(id) === storageId) {
+          readEntered.resolve()
+          await releaseRead.promise
+          throw expires ? claimFailure : ioFailure
+        }
+        return loadResumeSnapshot(id, options)
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `startup-rejected-resume-read-${expires}`,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              sourceStarts++
+              markReady()
+              return { restartAfterScopedRecovery: () => {} }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      try {
+        collection.startSyncImmediate()
+        const ready = collection.stateWhenReady()
+        void ready.catch(() => undefined)
+        await atPersistedOracleCheckpoint(
+          readEntered.promise,
+          `startup resume read entered`,
+        )
+        if (expires) now = 2_100
+        releaseRead.resolve()
+        if (expires) {
+          await atPersistedOracleCheckpoint(ready, `recovered source readiness`)
+          expect(collection.status).toBe(`ready`)
+          expect(sourceStarts).toBe(1)
+          expect(rotations).toBe(1)
+          expect(currentStorageId).toBe(`startup-rejected-new`)
+        } else {
+          await expect(ready).rejects.toBe(ioFailure)
+          expect(collection.status).toBe(`crashed`)
+          expect(sourceStarts).toBe(0)
+          expect(rotations).toBe(0)
+        }
+      } finally {
+        releaseRead.resolve()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // Each claim expiry is a loss of authority, not an exhausted retry budget.
+  // The independent clock pauses this run during two successive SQLite resume
+  // reads, then lets a third read finish with a live claim. The source must
+  // start exactly once under that final storage ID, with no old read admitted.
+  it(`recovers after successive startup resume claims expire`, async () => {
+    const adapter = createRecordingAdapter()
+    let now = 1_000
+    let expiresAtMs = 2_000
+    let storageId = `successive-startup-old`
+    let reads = 0
+    let rotations = 0
+    let sourceStarts = 0
+    adapter.getCacheGenerationNow = () => now
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `successive-startup-claim`,
+      expiresAtMs,
+    })
+    adapter.renewCacheGenerationClaim = async () =>
+      now < expiresAtMs ? (expiresAtMs = now + 1_000) : undefined
+    adapter.rotateCacheGeneration = async () => {
+      storageId = `successive-startup-new-${++rotations}`
+      expiresAtMs = now + 1_000
+      return {
+        storageCollectionId: storageId,
+        claimId: `successive-startup-claim`,
+        expiresAtMs,
+      }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (id, options) => {
+      if (++reads <= 2) {
+        now = expiresAtMs + 1
+        throw new InvalidPersistedCollectionConfigError(
+          `Persisted cache claim is no longer active for collection "${id}"`,
+        )
+      }
+      return loadResumeSnapshot(id, options)
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `successive-startup-expiry`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            sourceStarts++
+            markReady()
+            return { restartAfterScopedRecovery: () => {} }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `source entry after successive claim expiry`,
+      )
+      expect(collection.status).toBe(`ready`)
+      expect(reads).toBe(3)
+      expect(rotations).toBe(2)
+      expect(storageId).toBe(`successive-startup-new-2`)
+      expect(sourceStarts).toBe(1)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // An expired cache claim may start a private rotation while startup is
+  // creating a persisted index. The source cannot enter until that rotation
+  // settles: before its sync callback returns there is no provider-session
+  // restart capability to retire callbacks bound to the old cache. This
+  // controlled adapter permits the index and rotation to overlap. The model
+  // starts the source once, under the rotated storage ID; the observations
+  // are source-entry timing and the durable destination of its first write.
+  it(`waits for a private startup rotation before entering the source`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstIndexEntered = createEventGate()
+    const releaseFirstIndex = createEventGate()
+    const rotationEntered = createEventGate()
+    const releaseRotation = createEventGate()
+    const sourceStarted = createEventGate()
+    let expired = false
+    let storageId = `startup-old-storage`
+    let indexCalls = 0
+    const indexRoutes: Array<{ storageId: string; signature: string }> = []
+    let sourceStarts = 0
+    let restarts = 0
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `startup-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () =>
+      expired ? undefined : Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      storageId = `startup-new-storage`
+      expired = false
+      return { storageCollectionId: storageId, claimId: `startup-claim` }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (id, signature) => {
+      indexRoutes.push({ storageId: recordedStorageId(id), signature })
+      if (++indexCalls === 1) {
+        firstIndexEntered.resolve()
+        await releaseFirstIndex.promise
+      }
+    }
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `startup-rotation-before-source`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: (params) => {
+            source = params
+            sourceStarts++
+            params.markReady()
+            sourceStarted.resolve()
+            return {
+              restartAfterScopedRecovery: () => {
+                restarts++
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    collection.createIndex((row) => row.title, { name: `held-title` })
+    try {
+      collection.startSyncImmediate()
+      await atPersistedOracleCheckpoint(
+        firstIndexEntered.promise,
+        `first startup index`,
+      )
+      expired = true
+      const dynamicIndex = collection.createIndex((row) => row.id, {
+        name: `dynamic-id`,
+      })
+      const dynamicSignature = collection
+        .getIndexMetadata()
+        .find((metadata) => metadata.indexId === dynamicIndex.id)?.signature
+      if (!dynamicSignature) throw new Error(`Missing dynamic index signature`)
+      await atPersistedOracleCheckpoint(
+        rotationEntered.promise,
+        `private startup rotation`,
+      )
+      releaseFirstIndex.resolve()
+      await flushAsyncWork()
+      expect(sourceStarts).toBe(0)
+      releaseRotation.resolve()
+      await atPersistedOracleCheckpoint(sourceStarted.promise, `source entry`)
+      await collection.stateWhenReady()
+      expect(sourceStarts).toBe(1)
+      expect(restarts).toBe(0)
+      expect(indexRoutes).toContainEqual({
+        storageId: `startup-new-storage`,
+        signature: dynamicSignature,
+      })
+
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `fresh`, title: `New storage` },
+      })
+      await whenSyncAccepted(source.commit())
+      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
+      expect(
+        adapter.applyCommittedTxCalls
+          .filter((call) =>
+            call.tx.mutations.some((mutation) => mutation.key === `fresh`),
+          )
+          .map((call) => call.collectionId),
+      ).toEqual([`startup-new-storage`])
+    } finally {
+      releaseFirstIndex.resolve()
+      releaseRotation.resolve()
+      await collection.cleanup()
+    }
+  })
+
+  // An active scoped rotation changes the physical index destination. The
+  // independent registry is the Collection's current index metadata: every
+  // index still present after rotation, including one added after bootstrap
+  // captured its snapshot, must be routed to the new storage ID.
+  it(`rebuilds current persisted indexes after active cache rotation`, async () => {
+    const adapter = createRecordingAdapter()
+    const rotationEntered = createEventGate()
+    const releaseRotation = createEventGate()
+    const bootstrapEntered = createEventGate()
+    const releaseBootstrap = createEventGate()
+    let storageId = `active-index-old`
+    let recovery!: () => Promise<void>
+    const indexRoutes: Array<{ storageId: string; signature: string }> = []
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: storageId,
+      claimId: `active-index-claim`,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
+    adapter.rotateCacheGeneration = async () => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      storageId = `active-index-new`
+      return { storageCollectionId: storageId, claimId: `active-index-claim` }
+    }
+    adapter.releaseCacheGenerationClaim = async () => {}
+    adapter.ensureIndex = async (id, signature) => {
+      indexRoutes.push({ storageId: recordedStorageId(id), signature })
+      if (
+        recordedStorageId(id) === `active-index-new` &&
+        signature === initialSignature
+      ) {
+        bootstrapEntered.resolve()
+        await releaseBootstrap.promise
+      }
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `active-index-rotation`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: (params) => {
+            recovery = params.metadata!.persistence!.startScopedRecovery!
+            params.markReady()
+            return { restartAfterScopedRecovery: (gate) => gate }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const initial = collection.createIndex((row) => row.title, {
+      name: `initial-title`,
+    })
+    const initialSignature = collection
+      .getIndexMetadata()
+      .find((metadata) => metadata.indexId === initial.id)?.signature
+    let activeRecovery: Promise<void> | undefined
+    try {
+      await collection.stateWhenReady()
+      activeRecovery = recovery()
+      await atPersistedOracleCheckpoint(
+        rotationEntered.promise,
+        `active index rotation`,
+      )
+      const added = collection.createIndex((row) => row.id, {
+        name: `added-during-rotation`,
+      })
+      releaseRotation.resolve()
+      await atPersistedOracleCheckpoint(
+        bootstrapEntered.promise,
+        `new-storage index bootstrap`,
+      )
+      const addedDuringBootstrap = collection.createIndex((row) => row.detail, {
+        name: `added-during-bootstrap`,
+      })
+      const signatures = [initial.id, added.id, addedDuringBootstrap.id].map(
+        (id) =>
+          collection
+            .getIndexMetadata()
+            .find((metadata) => metadata.indexId === id)?.signature,
+      )
+      if (signatures.some((signature) => !signature)) {
+        throw new Error(`Missing current index signature`)
+      }
+      releaseBootstrap.resolve()
+      await atPersistedOracleCheckpoint(activeRecovery, `active index recovery`)
+      for (const signature of signatures) {
+        expect(indexRoutes).toContainEqual({
+          storageId: `active-index-new`,
+          signature,
+        })
+      }
+    } finally {
+      releaseRotation.resolve()
+      releaseBootstrap.resolve()
+      await Promise.allSettled([activeRecovery])
+      await collection.cleanup()
+    }
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-hydration-queue.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-hydration-queue.test.ts
new file mode 100644
index 0000000000..f50df4d92c
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-hydration-queue.test.ts
@@ -0,0 +1,2796 @@
+/**
+ * Ordinary regression tests for persisted hydration queues: source writes and deletes admitted behind hydration, refused inserts, and partial-update dependency work, as fixed scenarios. The queue and admission laws are owned by persisted-oracle.test.ts, which keeps the generated and model-checked cases.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BasicIndex,
+  DbClient,
+  NoPendingSyncTransactionCommitError,
+  NoPendingSyncTransactionWriteError,
+  collectionOptions,
+  createCollection,
+  createTransaction,
+  whenSyncAccepted,
+} from '@tanstack/db'
+import { persistedCollectionOptions } from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createRecordingAdapter,
+  expectPendingKeyMembershipWork,
+  flushAsyncWork,
+  hydrationScopeModes,
+  observeSettlement,
+  overrideBaselineRows,
+  refusalHistories,
+  runRejectedHydrationBufferWitness,
+  stripVirtualProps,
+} from './persisted-support'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`keeps hydrated rows ahead of persisted startup rows`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `Persisted title` },
+    ])
+    const descriptor = collectionOptions(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydration-precedence`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+    const client = new DbClient()
+    client.hydrate({
+      collections: [
+        {
+          collectionId: descriptor.id,
+          rows: [
+            {
+              key: `1`,
+              value: { id: `1`, title: `SSR title` },
+            },
+          ],
+        },
+      ],
+    })
+
+    const collection = client.collection(descriptor)
+    await collection.stateWhenReady()
+    await flushAsyncWork()
+
+    expect(collection.get(`1`)).toMatchObject({
+      id: `1`,
+      title: `SSR title`,
+    })
+
+    await client.cleanup()
+  })
+
+  it(`bootstraps and tracks persisted index lifecycle in sync-present mode`, async () => {
+    const adapter = createRecordingAdapter()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-indexes`,
+        getKey: (item) => item.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    const preSyncIndex = collection.createIndex((row) => row.title, {
+      name: `pre-sync-title`,
+    })
+    const expectedPreSyncSignature = collection.getIndexMetadata()[0]?.signature
+
+    await collection.preload()
+    await flushAsyncWork()
+
+    expect(expectedPreSyncSignature).toBeDefined()
+    expect(
+      adapter.ensureIndexCalls.some(
+        (call) => call.signature === expectedPreSyncSignature,
+      ),
+    ).toBe(true)
+
+    const runtimeIndex = collection.createIndex((row) => row.id, {
+      name: `runtime-id`,
+    })
+    await flushAsyncWork()
+
+    const runtimeSignature = collection
+      .getIndexMetadata()
+      .find((index) => index.indexId === runtimeIndex.id)?.signature
+    expect(runtimeSignature).toBeDefined()
+    expect(
+      adapter.ensureIndexCalls.some(
+        (call) => call.signature === runtimeSignature,
+      ),
+    ).toBe(true)
+
+    collection.removeIndex(preSyncIndex)
+    await flushAsyncWork()
+    expect(
+      adapter.markIndexRemovedCalls.some(
+        (call) => call.signature === expectedPreSyncSignature,
+      ),
+    ).toBe(true)
+  })
+
+  it(`queues remote sync writes that arrive during hydration`, async () => {
+    const adapter = createRecordingAdapter([
+      {
+        id: `cached-1`,
+        title: `Cached row`,
+      },
+    ])
+    let resolveLoadSubset: (() => void) | undefined
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => {
+      if (args[1]?.includeRows === true) {
+        await new Promise<void>((resolve) => {
+          resolveLoadSubset = resolve
+        })
+      }
+      return loadResumeSnapshot(...args)
+    }
+
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => void) | undefined
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+    const readyPromise = collection.stateWhenReady()
+    for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
+      await flushAsyncWork()
+    }
+
+    expect(resolveLoadSubset).toBeDefined()
+    expect(remoteBegin).toBeDefined()
+
+    remoteBegin?.()
+    remoteWrite?.({
+      type: `insert`,
+      value: {
+        id: `during-hydrate`,
+        title: `During hydrate`,
+      },
+    })
+    remoteCommit?.()
+
+    resolveLoadSubset?.()
+    await readyPromise
+    await flushAsyncWork()
+
+    expect(stripVirtualProps(collection.get(`cached-1`))).toEqual({
+      id: `cached-1`,
+      title: `Cached row`,
+    })
+    expect(stripVirtualProps(collection.get(`during-hydrate`))).toEqual({
+      id: `during-hydrate`,
+      title: `During hydrate`,
+    })
+  })
+
+  it(`queues a source write behind its owning hydration baseline`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `shared`, title: `Persisted baseline` },
+    ])
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return [
+        {
+          key: `shared`,
+          value: { id: `shared`, title: `Persisted baseline` },
+        },
+      ]
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `source-write-during-hydration`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const ready = collection.stateWhenReady()
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `source write hydration entered`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `shared`, title: `Newer source value` },
+      })
+      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      const settlement = observeSettlement(receipt)
+      await Promise.resolve()
+
+      expect({
+        visible: collection.get(`shared`),
+        receipt: settlement.read(),
+        applyCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        visible: undefined,
+        receipt: { status: `pending` },
+        applyCalls: 0,
+      })
+
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(ready, `source write hydration ready`)
+      await atPersistedOracleCheckpoint(
+        receipt,
+        `source write hydration receipt`,
+      )
+      expect({
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        durableRow: adapter.rows.get(`shared`),
+        status: collection.status,
+      }).toEqual({
+        publicRow: { id: `shared`, title: `Newer source value` },
+        durableRow: { id: `shared`, title: `Newer source value` },
+        status: `ready`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => ready.catch(() => undefined),
+          () => receipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`preserves a source transaction committed before the next persisted hydration`, async () => {
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    const adapter = createRecordingAdapter()
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `before-hydration-boundary`,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      collection.startSyncImmediate()
+      await vi.waitFor(() => {
+        expect(remoteBegin).toBeTypeOf(`function`)
+        expect(remoteWrite).toBeTypeOf(`function`)
+        expect(remoteCommit).toBeTypeOf(`function`)
+      })
+      const row = { id: `before`, title: `before` }
+      remoteBegin?.()
+      remoteWrite?.({ type: `insert`, value: row })
+      const receipt = remoteCommit?.()
+      expect(receipt).toBeInstanceOf(Promise)
+      await receipt
+      adapter.loadSubset = async () => {
+        hydrationEntered.resolve()
+        await hydration.promise
+        return Array.from(adapter.rows, ([key, value]) => ({ key, value }))
+      }
+      const rehydrating = Promise.resolve(collection._sync.loadSubset({}))
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `on-demand hydration entered`,
+      )
+
+      expect(stripVirtualProps(collection.get(`before`))).toEqual(row)
+      expect(adapter.rows.get(`before`)).toEqual(row)
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(
+        rehydrating,
+        `on-demand hydration completed`,
+      )
+      expect(stripVirtualProps(collection.get(`before`))).toEqual(row)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  describe.each(hydrationScopeModes)(
+    `hydration failure with %s scope`,
+    (scopeMode) => {
+      it(`rejects every buffered receipt with the exact persisted hydration failure`, async () => {
+        await runRejectedHydrationBufferWitness(
+          `rejected-hydration-buffer-fixed`,
+          [
+            { id: `first`, title: `first buffered commit` },
+            { id: `second`, title: `second buffered commit` },
+          ],
+          { scopeMode },
+        )
+      })
+
+      it(`rejects a hydration-straddling transaction committed after hydration fails`, async () => {
+        await runRejectedHydrationBufferWitness(
+          `rejected-hydration-late-commit-fixed`,
+          [{ id: `late`, title: `must not cross a failed baseline` }],
+          { commitAfterHydrationFailure: true, scopeMode },
+        )
+      })
+
+      it.each([
+        {
+          schedule: `one late commit`,
+          rows: [{ id: `one-late`, title: `` }],
+        },
+        {
+          schedule: `two sibling late commits`,
+          rows: [
+            { id: `late-a`, title: `a` },
+            { id: `late-b`, title: `b` },
+          ],
+        },
+        {
+          schedule: `same-key late replacements`,
+          rows: [
+            { id: `late-shared`, title: `old` },
+            { id: `late-shared`, title: `new` },
+          ],
+        },
+      ])(
+        `rejects generated late commits after hydration failure: $schedule`,
+        async ({ schedule, rows }) => {
+          await runRejectedHydrationBufferWitness(
+            `rejected-hydration-late-${schedule.replaceAll(` `, `-`)}`,
+            rows,
+            { commitAfterHydrationFailure: true, scopeMode },
+          )
+        },
+      )
+
+      it.each([
+        {
+          schedule: `one buffered commit`,
+          rows: [{ id: `one`, title: `one` }],
+        },
+        {
+          schedule: `three sibling commits`,
+          rows: [
+            { id: `a`, title: `a` },
+            { id: `b`, title: `b` },
+            { id: `c`, title: `c` },
+          ],
+        },
+        {
+          schedule: `same-key replacement commits`,
+          rows: [
+            { id: `shared`, title: `old` },
+            { id: `shared`, title: `new` },
+          ],
+        },
+      ])(
+        `rejects all receipts and adopts no rows after hydration failure: $schedule`,
+        async ({ schedule, rows }) => {
+          await runRejectedHydrationBufferWitness(
+            `rejected-hydration-${schedule.replaceAll(` `, `-`)}`,
+            rows,
+            { scopeMode },
+          )
+        },
+      )
+    },
+  )
+
+  it(`discards a hydration-buffered transaction aborted before replay`, async () => {
+    const adapter = createRecordingAdapter()
+    let resolveLoadSubset: (() => void) | undefined
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => {
+      if (args[1]?.includeRows === true) {
+        await new Promise<void>((resolve) => {
+          resolveLoadSubset = resolve
+        })
+      }
+      return loadResumeSnapshot(...args)
+    }
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-aborted-hydration-queue`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      const ready = collection.stateWhenReady()
+      for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
+        await flushAsyncWork()
+      }
+      const abortController = new AbortController()
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `aborted`, title: `Must not replay` },
+      })
+      const applied = remoteCommit?.(abortController.signal)
+      abortController.abort()
+      resolveLoadSubset?.()
+      await ready
+      if (applied !== true) {
+        await expect(applied).rejects.toMatchObject({ name: `AbortError` })
+      }
+      await flushAsyncWork()
+
+      expect(collection.get(`aborted`)).toBeUndefined()
+      expect(adapter.applyCommittedTxCalls).toHaveLength(0)
+    } finally {
+      resolveLoadSubset?.()
+      await collection.cleanup()
+    }
+  })
+
+  it(`continues an independent hydration queue after an in-flight sibling aborts`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    const prefixPersistenceEntered = createEventGate()
+    const releasePrefixPersistence = createEventGate()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    adapter.applyCommittedTx = async (...args) => {
+      if (args[1].mutations.some((mutation) => mutation.key === `prefix`)) {
+        prefixPersistenceEntered.resolve()
+        await releasePrefixPersistence.promise
+      }
+      return applyCommittedTx(...args)
+    }
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return []
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `independent-hydration-abort`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const aborted = new AbortController()
+    let prefixReceipt: Promise<void> | undefined
+    let abortedReceipt: Promise<void> | undefined
+    let independentReceipt: Promise<void> | undefined
+    const ready = collection.stateWhenReady()
+    void ready.catch(() => undefined)
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `independent abort hydration entered`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `prefix`, title: `durability held` },
+      })
+      prefixReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void prefixReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `aborted`, title: `must not publish` },
+      })
+      abortedReceipt = Promise.resolve(
+        sourceParams.commit(aborted.signal),
+      ).then(() => undefined)
+      void abortedReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `independent`, title: `must survive sibling abort` },
+      })
+      independentReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void independentReceipt.catch(() => undefined)
+
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(
+        prefixPersistenceEntered.promise,
+        `in-flight hydration prefix entered durability`,
+      )
+      aborted.abort()
+      const independentSettlement = observeSettlement(independentReceipt)
+      await Promise.resolve()
+      expect({
+        independent: independentSettlement.read(),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        independent: { status: `pending` },
+        status: `loading`,
+        publicError: undefined,
+      })
+
+      releasePrefixPersistence.resolve()
+      await atPersistedOracleCheckpoint(
+        prefixReceipt,
+        `independent abort prefix settled`,
+      )
+      await expect(
+        atPersistedOracleCheckpoint(
+          abortedReceipt,
+          `in-flight hydration sibling aborted`,
+        ),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      await atPersistedOracleCheckpoint(
+        independentReceipt,
+        `independent hydration sibling applied`,
+      )
+      await atPersistedOracleCheckpoint(ready, `independent abort ready`)
+      expect({
+        status: collection.status,
+        prefix: stripVirtualProps(collection.get(`prefix`)),
+        aborted: collection.get(`aborted`),
+        independent: stripVirtualProps(collection.get(`independent`)),
+        durable: adapter.rows.get(`independent`),
+      }).toEqual({
+        status: `ready`,
+        prefix: { id: `prefix`, title: `durability held` },
+        aborted: undefined,
+        independent: {
+          id: `independent`,
+          title: `must survive sibling abort`,
+        },
+        durable: {
+          id: `independent`,
+          title: `must survive sibling abort`,
+        },
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      aborted.abort()
+      releasePrefixPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => prefixReceipt?.catch(() => undefined),
+          () => abortedReceipt?.catch(() => undefined),
+          () => independentReceipt?.catch(() => undefined),
+          () => ready.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects every hydration-buffered receipt when replay fails`, async () => {
+    const adapter = createRecordingAdapter()
+    let resolveLoadSubset: (() => void) | undefined
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => {
+      if (args[1]?.includeRows === true) {
+        await new Promise<void>((resolve) => {
+          resolveLoadSubset = resolve
+        })
+      }
+      return loadResumeSnapshot(...args)
+    }
+
+    const replayError = new Error(`replay application failed`)
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-replay-failure-receipt`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    const readyOutcome = collection.stateWhenReady().then(
+      () => ({ status: `fulfilled` as const }),
+      (reason: unknown) => ({ status: `rejected` as const, reason }),
+    )
+    for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
+      await flushAsyncWork()
+    }
+
+    remoteBegin?.()
+    remoteWrite?.({
+      type: `insert`,
+      value: { id: `during-hydrate`, title: `During hydrate` },
+    })
+    const failingReceipt = remoteCommit?.()
+    remoteBegin?.()
+    remoteWrite?.({
+      type: `insert`,
+      value: { id: `sibling`, title: `Sibling` },
+    })
+    const siblingReceipt = remoteCommit?.()
+    expect(failingReceipt).toBeInstanceOf(Promise)
+    expect(siblingReceipt).toBeInstanceOf(Promise)
+    const setSyncedRow = collection._state.syncedData.set.bind(
+      collection._state.syncedData,
+    )
+    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
+      (key, value) => {
+        if (key === `during-hydrate`) throw replayError
+        return setSyncedRow(key, value)
+      },
+    )
+    const failingExpectation = expect(
+      Promise.resolve(failingReceipt),
+    ).rejects.toBe(replayError)
+    const siblingExpectation = expect(
+      Promise.resolve(siblingReceipt),
+    ).rejects.toBe(replayError)
+
+    resolveLoadSubset?.()
+    const ready = await atPersistedOracleCheckpoint(
+      readyOutcome,
+      `replay-failed hydration readiness settled`,
+    )
+    await failingExpectation
+    await siblingExpectation
+    remoteBegin?.()
+    remoteWrite?.({
+      type: `insert`,
+      value: { id: `after-replay-failure`, title: `must not be admitted` },
+    })
+    const lateOutcome = await atPersistedOracleCheckpoint(
+      Promise.resolve(remoteCommit?.()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      ),
+      `post-replay-failure source receipt`,
+    )
+
+    expect({
+      readyStatus: ready.status,
+      readyExact: ready.status === `rejected` && ready.reason === replayError,
+      lateStatus: lateOutcome.status,
+      lateExact:
+        lateOutcome.status === `rejected` && lateOutcome.reason === replayError,
+      status: collection.status,
+      exactPublicError: collection._lifecycle.getSyncError() === replayError,
+      visibleLate: collection.get(`after-replay-failure`),
+      durableLate: adapter.rows.get(`after-replay-failure`),
+      applyCalls: adapter.applyCommittedTxCalls.length,
+    }).toEqual({
+      readyStatus: `rejected`,
+      readyExact: true,
+      lateStatus: `rejected`,
+      lateExact: true,
+      status: `crashed`,
+      exactPublicError: true,
+      visibleLate: undefined,
+      durableLate: undefined,
+      applyCalls: 0,
+    })
+
+    await collection.cleanup()
+  })
+
+  it.each([`metadata-snapshot`, `baseline-snapshot`, `row-apply`] as const)(
+    `fail-stops startup when the %s phase fails`,
+    async (phase) => {
+      const phaseError = new Error(`${phase} failed exactly`)
+      const adapter = createRecordingAdapter(
+        phase === `row-apply`
+          ? [{ id: `row-apply-failure`, title: `must not apply` }]
+          : [],
+      )
+      if (phase !== `row-apply`) {
+        const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+        adapter.loadResumeSnapshot = (...args) =>
+          args[1]?.includeRows === (phase === `baseline-snapshot`)
+            ? Promise.reject(phaseError)
+            : loadResumeSnapshot(...args)
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `terminal-startup-${phase}`,
+          getKey: (row) => {
+            if (phase === `row-apply` && row.id === `row-apply-failure`) {
+              throw phaseError
+            }
+            return row.id
+          },
+          persistence: { adapter },
+        }),
+      )
+      let hasPrimaryFailure = false
+
+      try {
+        const startupOutcome = await atPersistedOracleCheckpoint(
+          collection.stateWhenReady().then(
+            () => ({ status: `fulfilled` as const }),
+            (reason: unknown) => ({ status: `rejected` as const, reason }),
+          ),
+          `${phase} startup boundary settled`,
+        )
+
+        expect({
+          startupStatus: startupOutcome.status,
+          startupExact:
+            startupOutcome.status === `rejected` &&
+            startupOutcome.reason === phaseError,
+          status: collection.status,
+          exactPublicError: collection._lifecycle.getSyncError() === phaseError,
+          visibleRows: Array.from(collection.values()).map(stripVirtualProps),
+          durableRows: Array.from(adapter.rows.values()),
+          applyCalls: adapter.applyCommittedTxCalls.length,
+        }).toEqual({
+          startupStatus: `rejected`,
+          startupExact: true,
+          status: `crashed`,
+          exactPublicError: true,
+          visibleRows: [],
+          durableRows:
+            phase === `row-apply`
+              ? [{ id: `row-apply-failure`, title: `must not apply` }]
+              : [],
+          applyCalls: 0,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`fail-stops a coordinator transaction flushed after hydration`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return []
+    })
+    const flushError = new Error(`coordinator hydration flush failed exactly`)
+    const coordinator = createFailStopCoordinatorHarness(
+      `terminal-coordinator-hydration-flush`,
+    )
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-coordinator-hydration-flush`,
+        getKey: (row) => {
+          if (row.id === `coordinator-bad`) throw flushError
+          return row.id
+        },
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const readyOutcome = collection.stateWhenReady().then(
+      () => ({ status: `fulfilled` as const }),
+      (reason: unknown) => ({ status: `rejected` as const, reason }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `coordinator flush hydration entered`,
+      )
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `coordinator-flush-failure`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          {
+            key: `coordinator-bad`,
+            value: { id: `coordinator-bad`, title: `must not publish` },
+          },
+        ],
+        deletedKeys: [],
+      })
+      hydration.resolve()
+      const ready = await atPersistedOracleCheckpoint(
+        readyOutcome,
+        `coordinator flush readiness settled`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `late`, title: `must not be admitted` },
+      })
+      const late = await atPersistedOracleCheckpoint(
+        Promise.resolve(sourceParams.commit()).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `coordinator flush late receipt`,
+      )
+
+      expect({
+        readyStatus: ready.status,
+        readyExact: ready.status === `rejected` && ready.reason === flushError,
+        lateStatus: late.status,
+        lateExact: late.status === `rejected` && late.reason === flushError,
+        status: collection.status,
+        exactPublicError: collection._lifecycle.getSyncError() === flushError,
+        visibleBad: collection.get(`coordinator-bad`),
+        visibleLate: collection.get(`late`),
+        durableLate: adapter.rows.get(`late`),
+        applyCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        readyStatus: `rejected`,
+        readyExact: true,
+        lateStatus: `rejected`,
+        lateExact: true,
+        status: `crashed`,
+        exactPublicError: true,
+        visibleBad: undefined,
+        visibleLate: undefined,
+        durableLate: undefined,
+        applyCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`applies hydration-queued sync work after an unrelated local persistence rollback`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return []
+    })
+    const appliedError = new Error(`hydration applied receipt failed exactly`)
+    const localPersistence = createEventGate()
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-hydration-applied-receipt`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const localTransaction = createTransaction({
+      mutationFn: () => localPersistence.promise,
+    })
+    const readyOutcome = collection.stateWhenReady().then(
+      () => ({ status: `fulfilled` as const }),
+      (reason: unknown) => ({ status: `rejected` as const, reason }),
+    )
+    let remoteReceipt: true | Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `applied-receipt hydration entered`,
+      )
+      localTransaction.mutate(() => {
+        collection.insert({ id: `local-gate`, title: `local pending` })
+      })
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: {
+          id: `remote-applied`,
+          title: `applies after local rollback`,
+        },
+      })
+      remoteReceipt = sourceParams.commit()
+      expect(remoteReceipt).toBeInstanceOf(Promise)
+      hydration.resolve()
+      await flushAsyncWork()
+      localPersistence.reject(appliedError)
+
+      const ready = await atPersistedOracleCheckpoint(
+        readyOutcome,
+        `applied-receipt readiness settled`,
+      )
+      const remote = await atPersistedOracleCheckpoint(
+        Promise.resolve(remoteReceipt).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `hydration-applied remote receipt settled`,
+      )
+
+      expect({
+        readyStatus: ready.status,
+        remoteStatus: remote.status,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        durableRemote: adapter.rows.get(`remote-applied`),
+        applyCalls: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        readyStatus: `fulfilled`,
+        remoteStatus: `fulfilled`,
+        status: `ready`,
+        publicError: undefined,
+        durableRemote: {
+          id: `remote-applied`,
+          title: `applies after local rollback`,
+        },
+        applyCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      localPersistence.reject(appliedError)
+      await localTransaction.isPersisted.promise.catch(() => undefined)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it.each(refusalHistories)(
+    `drops a refused insert and applies source turns on its key: %j`,
+    async ({ timing, firstWrite }) => {
+      const adapter = createRecordingAdapter()
+      const refused = new Error(`outbound save refused`)
+      const outbound = createEventGate()
+      const handlerEntered = createEventGate()
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `refused-insert-source-${timing}-${firstWrite}`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+            },
+          },
+          persistence: { adapter },
+          onInsert: async () => {
+            handlerEntered.resolve()
+            await outbound.promise
+          },
+        }),
+      )
+      let transaction: ReturnType<typeof collection.insert> | undefined
+      let firstReceipt: true | Promise<void> | undefined
+      let secondReceipt: true | Promise<void> | undefined
+      let expectedSource: Todo | undefined
+      let hasPrimaryFailure = false
+      const sourceRow: Todo = { id: `local`, title: `source row` }
+      const laterRow: Todo = { id: `local`, title: `later source row` }
+
+      // A source turn is an authoritative edit. This tiny model uses no
+      // persisted-wrapper or Collection state to predict the next row.
+      const checkSource = (checkpoint: string) => {
+        const live = collection.get(`local`)
+        expect(
+          {
+            live: stripVirtualProps(live),
+            base: collection.base.get(`local`),
+            durable: adapter.rows.get(`local`),
+          },
+          checkpoint,
+        ).toEqual({
+          live: expectedSource,
+          base: expectedSource,
+          durable: expectedSource,
+        })
+        if (expectedSource) expect(live?.$origin, checkpoint).toBe(`remote`)
+      }
+      const writeSource = (type: `insert` | `delete`, row = sourceRow) => {
+        sourceParams.begin()
+        if (type === `insert`) sourceParams.write({ type, value: row })
+        else sourceParams.write({ type, key: `local` })
+        return sourceParams.commit()
+      }
+
+      try {
+        await atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `refused insert collection ready`,
+        )
+        transaction = collection.insert({ id: `local`, title: `optimistic` })
+        await atPersistedOracleCheckpoint(
+          handlerEntered.promise,
+          `refused insert handler entered`,
+        )
+        expect(collection.get(`local`)?.title).toBe(`optimistic`)
+        expect(collection.base.has(`local`)).toBe(false)
+        expect(adapter.rows.has(`local`)).toBe(false)
+
+        if (timing === `before`) {
+          firstReceipt = writeSource(firstWrite)
+          expectedSource = firstWrite === `insert` ? sourceRow : undefined
+          await atPersistedOracleCheckpoint(
+            Promise.resolve(whenSyncAccepted(firstReceipt)).then(
+              () => undefined,
+            ),
+            `source turn durable before refusal`,
+          )
+          expect(collection.get(`local`)?.title).toBe(`optimistic`)
+          expect(adapter.rows.get(`local`)).toEqual(expectedSource)
+          // Durability accepts the source turn. Its receipt still waits for
+          // the refused mutation to settle and release core publication.
+          const receiptState = observeSettlement(
+            Promise.resolve(firstReceipt).then(() => undefined),
+          )
+          await flushAsyncWork()
+          expect(receiptState.read()).toEqual({ status: `pending` })
+        }
+
+        outbound.reject(refused)
+        await expect(transaction.isPersisted.promise).rejects.toBe(refused)
+        expect(transaction.state).toBe(`failed`)
+        checkSource(`after refused mutation settled`)
+        if (firstReceipt !== undefined) {
+          await Promise.resolve(firstReceipt)
+          checkSource(`after held source receipt`)
+        }
+
+        if (timing === `after`) {
+          firstReceipt = writeSource(firstWrite)
+          expectedSource = firstWrite === `insert` ? sourceRow : undefined
+          await atPersistedOracleCheckpoint(
+            Promise.resolve(firstReceipt).then(() => undefined),
+            `first post-failure source turn applied`,
+          )
+          checkSource(`after first source receipt`)
+        }
+
+        const secondWrite = firstWrite === `insert` ? `delete` : `insert`
+        secondReceipt = writeSource(secondWrite, laterRow)
+        expectedSource = secondWrite === `insert` ? laterRow : undefined
+        await atPersistedOracleCheckpoint(
+          Promise.resolve(secondReceipt).then(() => undefined),
+          `second post-failure source turn applied`,
+        )
+        checkSource(`after second source receipt`)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        if (transaction) outbound.reject(refused)
+        await cleanupPersistedOracle(
+          [
+            () => transaction?.isPersisted.promise.catch(() => undefined),
+            () =>
+              firstReceipt === undefined
+                ? undefined
+                : Promise.resolve(firstReceipt).catch(() => undefined),
+            () =>
+              secondReceipt === undefined
+                ? undefined
+                : Promise.resolve(secondReceipt).catch(() => undefined),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // The synced wrapper forwards accepted source transactions to core without
+  // a client identity. Under the key-and-timing rule, the first same-key turn
+  // consumes a successful mutation's local attribution. A second accepted
+  // turn replaces it with remote attribution. The independent source order
+  // predicts the final row; compare it when the mutation and receipts settle.
+  it.each([1, 2] as const)(
+    `attributes only the first of %i persisted same-key source turns locally`,
+    async (sourceTurns) => {
+      const adapter = createRecordingAdapter()
+      const handlerEntered = createEventGate()
+      const releaseHandler = createEventGate()
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `persisted-origin-${sourceTurns}`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+            },
+          },
+          persistence: { adapter },
+          onInsert: async () => {
+            handlerEntered.resolve()
+            await releaseHandler.promise
+          },
+        }),
+      )
+      let transaction: ReturnType<typeof collection.insert> | undefined
+      const receipts: Array<true | Promise<void>> = []
+      let hasPrimaryFailure = false
+
+      try {
+        await atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `persisted origin collection ready`,
+        )
+        transaction = collection.insert({ id: `local`, title: `optimistic` })
+        await atPersistedOracleCheckpoint(
+          handlerEntered.promise,
+          `persisted origin handler entered`,
+        )
+        for (let turn = 1; turn <= sourceTurns; turn++) {
+          source.begin()
+          source.write({
+            type: turn === 1 ? `insert` : `update`,
+            value: { id: `local`, title: `source ${turn}` },
+          })
+          const receipt = source.commit()
+          receipts.push(receipt)
+          await atPersistedOracleCheckpoint(
+            Promise.resolve(whenSyncAccepted(receipt)).then(() => undefined),
+            `source turn ${turn} accepted`,
+          )
+        }
+        expect(collection.get(`local`)?.title).toBe(`optimistic`)
+
+        releaseHandler.resolve()
+        await atPersistedOracleCheckpoint(
+          transaction.isPersisted.promise.then(() => undefined),
+          `successful persisted origin mutation settled`,
+        )
+        await Promise.all(receipts.map((receipt) => Promise.resolve(receipt)))
+        const row = { id: `local`, title: `source ${sourceTurns}` }
+        expect(stripVirtualProps(collection.get(`local`))).toEqual(row)
+        expect(collection.get(`local`)?.$origin).toBe(
+          sourceTurns === 1 ? `local` : `remote`,
+        )
+        expect(collection.base.get(`local`)).toEqual(row)
+        expect(adapter.rows.get(`local`)).toEqual(row)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        releaseHandler.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => transaction?.isPersisted.promise.catch(() => undefined),
+            ...receipts.map(
+              (receipt) => () =>
+                Promise.resolve(receipt).catch(() => undefined),
+            ),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // A source commit made while a local mutation persists is accepted and
+  // durably stored. Its rows stay hidden until that mutation settles.
+  it(`accepts and stores a source commit made beneath a persisting mutation`, async () => {
+    const adapter = createRecordingAdapter()
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `source-commit-beneath-mutation`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const localPersistence = createEventGate()
+    const localTransaction = createTransaction({
+      autoCommit: false,
+      mutationFn: () => localPersistence.promise,
+    })
+    let localCommit: Promise<unknown> | undefined
+    let remoteReceipt: true | Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `source commit collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `seed`, title: `baseline` },
+      })
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(sourceParams.commit()),
+        `source commit seed persisted`,
+      )
+
+      localTransaction.mutate(() => {
+        collection.update(`seed`, (draft) => {
+          draft.title = `local pending`
+        })
+      })
+      localCommit = localTransaction.commit()
+      void localCommit.catch(() => undefined)
+      expect(localTransaction.state).toBe(`persisting`)
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `remote`, title: `source commit` },
+      })
+      remoteReceipt = sourceParams.commit()
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(whenSyncAccepted(remoteReceipt)).then(() => undefined),
+        `source commit accepted before local settlement`,
+      )
+      // Accepted, but held: it becomes visible when the mutation settles.
+      expect(remoteReceipt).not.toBe(true)
+      const remoteSettlement = observeSettlement(remoteReceipt as Promise<void>)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(remoteSettlement.read()).toEqual({ status: `pending` })
+      expect({
+        localState: localTransaction.state,
+        remoteVisible: collection.has(`remote`),
+        remoteDurable: adapter.rows.get(`remote`),
+      }).toEqual({
+        localState: `persisting`,
+        remoteVisible: false,
+        remoteDurable: { id: `remote`, title: `source commit` },
+      })
+
+      localPersistence.resolve()
+      await atPersistedOracleCheckpoint(
+        localTransaction.isPersisted.promise,
+        `local settlement publishes the source commit`,
+      )
+      expect(stripVirtualProps(collection.get(`remote`))).toEqual({
+        id: `remote`,
+        title: `source commit`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      localPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => localCommit,
+          () =>
+            remoteReceipt === true ? undefined : Promise.resolve(remoteReceipt),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  // A handler may write, and await, a source commit queued behind an earlier
+  // parked source commit. Both apply in commit order when it settles.
+  it(`accepts a handler source commit queued behind a parked source commit`, async () => {
+    const adapter = createRecordingAdapter()
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `handler-source-dependency`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const mutationEntered = createEventGate()
+    const startDependency = createEventGate()
+    const dependencySubmitted = createEventGate()
+    let dependencyReceipt: true | Promise<void> | undefined
+    const localTransaction = createTransaction({
+      mutationFn: async () => {
+        mutationEntered.resolve()
+        await startDependency.promise
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `dependency`, title: `releases user persistence` },
+        })
+        dependencyReceipt = sourceParams.commit()
+        dependencySubmitted.resolve()
+        await whenSyncAccepted(dependencyReceipt)
+      },
+    })
+    const normalAbort = new AbortController()
+    let normalReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `handler dependency collection ready`,
+      )
+      localTransaction.mutate(() => {
+        collection.insert({ id: `local`, title: `user persistence pending` })
+      })
+      await atPersistedOracleCheckpoint(
+        mutationEntered.promise,
+        `user persistence entered`,
+      )
+      expect(localTransaction.state).toBe(`persisting`)
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `parked`, title: `waits for user persistence` },
+      })
+      normalReceipt = Promise.resolve(
+        sourceParams.commit(normalAbort.signal),
+      ).then(() => undefined)
+      void normalReceipt.catch(() => undefined)
+      expect(
+        collection._state.pendingSyncedTransactions.some(
+          (transaction) => transaction.committed,
+        ),
+      ).toBe(true)
+
+      startDependency.resolve()
+      await atPersistedOracleCheckpoint(
+        dependencySubmitted.promise,
+        `handler dependency submitted`,
+      )
+      await atPersistedOracleCheckpoint(
+        localTransaction.isPersisted.promise,
+        `user persistence completes after its awaited source commit`,
+      )
+      await atPersistedOracleCheckpoint(
+        normalReceipt,
+        `parked predecessor receipt`,
+      )
+      expect({
+        dependencyVisible: stripVirtualProps(collection.get(`dependency`)),
+        dependencyDurable: adapter.rows.get(`dependency`),
+        parkedVisible: stripVirtualProps(collection.get(`parked`)),
+        parkedDurable: adapter.rows.get(`parked`),
+        durableOrder: adapter.applyCommittedTxCalls.flatMap((call) =>
+          call.tx.mutations.map((mutation) => mutation.key),
+        ),
+        status: collection.status,
+      }).toEqual({
+        dependencyVisible: {
+          id: `dependency`,
+          title: `releases user persistence`,
+        },
+        dependencyDurable: {
+          id: `dependency`,
+          title: `releases user persistence`,
+        },
+        parkedVisible: { id: `parked`, title: `waits for user persistence` },
+        parkedDurable: { id: `parked`, title: `waits for user persistence` },
+        durableOrder: expect.arrayContaining([`parked`, `dependency`]),
+        status: `ready`,
+      })
+      const durableKeys = adapter.applyCommittedTxCalls.flatMap((call) =>
+        call.tx.mutations.map((mutation) => mutation.key),
+      )
+      expect(durableKeys.indexOf(`parked`)).toBeLessThan(
+        durableKeys.indexOf(`dependency`),
+      )
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      startDependency.resolve()
+      normalAbort.abort()
+      await cleanupPersistedOracle(
+        [
+          () => localTransaction.isPersisted.promise.catch(() => undefined),
+          () => normalReceipt?.catch(() => undefined),
+          () =>
+            dependencyReceipt === true
+              ? undefined
+              : Promise.resolve(dependencyReceipt).catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`replays source transactions one by one behind a held predecessor`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    const persistedSharedTitles: Array<string> = []
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      for (const mutation of args[1].mutations) {
+        if (mutation.type !== `delete` && mutation.key === `shared`) {
+          persistedSharedTitles.push((mutation.value as Todo).title)
+        }
+      }
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await applyCommittedTx(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `source-fifo-order`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let gateReceipt: Promise<void> | undefined
+    let olderReceipt: Promise<void> | undefined
+    let newerReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `source FIFO ordering collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `gate`, title: `holds adapter` },
+      })
+      gateReceipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      void gateReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `source FIFO ordering predecessor persistence entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `shared`, title: `older normal` },
+      })
+      olderReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void olderReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `shared`, title: `newer source value` },
+      })
+      newerReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void newerReceipt.catch(() => undefined)
+
+      expect(collection.get(`shared`)).toBeUndefined()
+
+      releaseFirstPersistence.resolve()
+      await atPersistedOracleCheckpoint(gateReceipt, `ordering gate persisted`)
+      await atPersistedOracleCheckpoint(
+        olderReceipt,
+        `older normal source receipt`,
+      )
+      await atPersistedOracleCheckpoint(
+        newerReceipt,
+        `newer source FIFO receipt`,
+      )
+
+      expect({
+        status: collection.status,
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        durableRow: adapter.rows.get(`shared`),
+        persistedTitles: persistedSharedTitles,
+      }).toEqual({
+        status: `ready`,
+        publicRow: { id: `shared`, title: `newer source value` },
+        durableRow: { id: `shared`, title: `newer source value` },
+        persistedTitles: [`older normal`, `newer source value`],
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => gateReceipt?.catch(() => undefined),
+          () => olderReceipt?.catch(() => undefined),
+          () => newerReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`admits a queued insert after an earlier queued delete of the same key`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `shared`, title: `Original row` },
+    ])
+    const persistenceEntered = createEventGate()
+    const releasePersistence = createEventGate()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        persistenceEntered.resolve()
+        await releasePersistence.promise
+      }
+      await applyCommittedTx(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `queued-delete-insert-prefix`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let gateReceipt: Promise<void> | undefined
+    let deleteReceipt: Promise<void> | undefined
+    let insertReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `queued-prefix collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `gate`, title: `Hold durability` },
+      })
+      gateReceipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      void gateReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        persistenceEntered.promise,
+        `queued-prefix durability held`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({ type: `delete`, key: `shared` })
+      deleteReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void deleteReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      expect(() =>
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `shared`, title: `Replacement row` },
+        }),
+      ).not.toThrow()
+      insertReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void insertReceipt.catch(() => undefined)
+
+      expect({
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        deleteReceipt: observeSettlement(deleteReceipt).read(),
+        insertReceipt: observeSettlement(insertReceipt).read(),
+      }).toEqual({
+        publicRow: { id: `shared`, title: `Original row` },
+        deleteReceipt: { status: `pending` },
+        insertReceipt: { status: `pending` },
+      })
+
+      releasePersistence.resolve()
+      await atPersistedOracleCheckpoint(gateReceipt, `queued-prefix gate`)
+      await atPersistedOracleCheckpoint(deleteReceipt, `queued-prefix delete`)
+      await atPersistedOracleCheckpoint(insertReceipt, `queued-prefix insert`)
+      expect({
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        durableRow: adapter.rows.get(`shared`),
+        status: collection.status,
+      }).toEqual({
+        publicRow: { id: `shared`, title: `Replacement row` },
+        durableRow: { id: `shared`, title: `Replacement row` },
+        status: `ready`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releasePersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => gateReceipt?.catch(() => undefined),
+          () => deleteReceipt?.catch(() => undefined),
+          () => insertReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`stores reentrant source commits from a publication callback in staging order`, async () => {
+    const adapter = createRecordingAdapter()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    const persistedTitles: Array<string> = []
+    adapter.applyCommittedTx = async (...args) => {
+      for (const mutation of args[1].mutations) {
+        if (mutation.type !== `delete` && mutation.key === `shared`) {
+          persistedTitles.push((mutation.value as Todo).title)
+        }
+      }
+      await applyCommittedTx(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `core-publication-source-order`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let earlierReceipt: Promise<void> | undefined
+    let laterReceipt: Promise<void> | undefined
+    let callbackCount = 0
+    const publication = collection.subscribeChanges((changes) => {
+      if (
+        callbackCount === 0 &&
+        changes.some((change) => change.key === `trigger`)
+      ) {
+        callbackCount++
+        sourceParams.begin()
+        sourceParams.write({
+          type: `update`,
+          value: { id: `shared`, title: `earlier` },
+        })
+        earlierReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void earlierReceipt.catch(() => undefined)
+
+        sourceParams.begin()
+        sourceParams.write({
+          type: `update`,
+          value: { id: `shared`, title: `later` },
+        })
+        laterReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void laterReceipt.catch(() => undefined)
+      }
+    })
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `core-publication ordering collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `trigger`, title: `Triggers source reentry` },
+      })
+      await Promise.resolve(sourceParams.commit())
+      await vi.waitFor(() => expect(callbackCount).toBe(1))
+      expect(earlierReceipt).toBeInstanceOf(Promise)
+      expect(laterReceipt).toBeInstanceOf(Promise)
+      await atPersistedOracleCheckpoint(
+        earlierReceipt!,
+        `core-publication earlier receipt`,
+      )
+      await atPersistedOracleCheckpoint(
+        laterReceipt!,
+        `core-publication later receipt`,
+      )
+
+      expect({
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        durableRow: adapter.rows.get(`shared`),
+        persistedTitles,
+        status: collection.status,
+      }).toEqual({
+        publicRow: { id: `shared`, title: `later` },
+        durableRow: { id: `shared`, title: `later` },
+        persistedTitles: [`earlier`, `later`],
+        status: `ready`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      publication.unsubscribe()
+      await cleanupPersistedOracle(
+        [
+          () => earlierReceipt?.catch(() => undefined),
+          () => laterReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`stores a source turn beneath an optimistic mutation and publishes it at settlement`, async () => {
+    const adapter = createRecordingAdapter()
+    const mutationEntered = createEventGate()
+    const allowDemand = createEventGate()
+    let upstreamLoads = 0
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `source-publication-before-mutation-demand`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return {
+              loadSubset: () => {
+                upstreamLoads++
+                return true
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const subset = { limit: 1 }
+    let localReceipt: Promise<unknown> | undefined
+    let sourceReceipt: Promise<void> | undefined
+    let demand: Promise<unknown> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      const local = createTransaction({
+        // A handler awaiting an on-demand load of its own Collection would
+        // wait for itself: the load's rows publish when this mutation settles.
+        mutationFn: async () => {
+          mutationEntered.resolve()
+          await allowDemand.promise
+          demand = Promise.resolve(collection._sync.loadSubset(subset))
+          void demand.catch(() => undefined)
+        },
+      })
+      local.mutate(() => {
+        collection.insert({ id: `local`, title: `optimistic local` })
+      })
+      localReceipt = local.isPersisted.promise
+      void localReceipt.catch(() => undefined)
+      await mutationEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `remote`, title: `authoritative source` },
+      })
+      const sourceCommit = sourceParams.commit()
+      sourceReceipt = Promise.resolve(sourceCommit).then(() => undefined)
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(whenSyncAccepted(sourceCommit)),
+        `source commit accepted beneath optimistic mutation`,
+      )
+
+      expect({
+        local: stripVirtualProps(collection.get(`local`)),
+        remote: stripVirtualProps(collection.get(`remote`)),
+        durableRemote: adapter.rows.get(`remote`),
+        localState: local.state,
+      }).toEqual({
+        local: { id: `local`, title: `optimistic local` },
+        remote: undefined,
+        durableRemote: { id: `remote`, title: `authoritative source` },
+        localState: `persisting`,
+      })
+
+      allowDemand.resolve()
+      await atPersistedOracleCheckpoint(
+        localReceipt,
+        `mutation settles after starting its demand`,
+      )
+      await atPersistedOracleCheckpoint(
+        demand!,
+        `demand settles after mutation`,
+      )
+      expect({
+        remote: stripVirtualProps(collection.get(`remote`)),
+        status: collection.status,
+        upstreamLoads,
+      }).toEqual({
+        remote: { id: `remote`, title: `authoritative source` },
+        status: `ready`,
+        upstreamLoads: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      allowDemand.resolve()
+      collection._sync.unloadSubset(subset)
+      await cleanupPersistedOracle(
+        [
+          () => sourceReceipt?.catch(() => undefined),
+          () => localReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`queues independent demand behind normal source publication without rejecting it`, async () => {
+    const adapter = createRecordingAdapter()
+    const mutationEntered = createEventGate()
+    const releaseMutation = createEventGate()
+    let upstreamLoads = 0
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `independent-demand-behind-source-publication`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return {
+              loadSubset: () => {
+                upstreamLoads++
+                return true
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const subset = { limit: 1 }
+    let localReceipt: Promise<unknown> | undefined
+    let sourceReceipt: Promise<void> | undefined
+    let demand: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      const local = createTransaction({
+        mutationFn: async () => {
+          mutationEntered.resolve()
+          await releaseMutation.promise
+        },
+      })
+      local.mutate(() => {
+        collection.insert({ id: `local`, title: `optimistic local` })
+      })
+      localReceipt = local.isPersisted.promise
+      void localReceipt.catch(() => undefined)
+      await mutationEntered.promise
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `remote`, title: `normal source` },
+      })
+      sourceReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void sourceReceipt.catch(() => undefined)
+      demand = Promise.resolve(collection._sync.loadSubset(subset)).then(
+        () => undefined,
+      )
+      void demand.catch(() => undefined)
+      const sourceSettlement = observeSettlement(sourceReceipt)
+      const demandSettlement = observeSettlement(demand)
+      await Promise.resolve()
+      expect({
+        source: sourceSettlement.read(),
+        demand: demandSettlement.read(),
+        status: collection.status,
+      }).toEqual({
+        source: { status: `pending` },
+        demand: { status: `pending` },
+        status: `ready`,
+      })
+
+      releaseMutation.resolve()
+      await atPersistedOracleCheckpoint(
+        Promise.all([localReceipt, sourceReceipt, demand]),
+        `independent demand after normal source publication`,
+      )
+      expect({
+        status: collection.status,
+        source: sourceSettlement.read(),
+        demand: demandSettlement.read(),
+        upstreamLoads,
+        durableRemote: adapter.rows.get(`remote`),
+      }).toEqual({
+        status: `ready`,
+        source: { status: `fulfilled`, value: undefined },
+        demand: { status: `fulfilled`, value: undefined },
+        upstreamLoads: 1,
+        durableRemote: { id: `remote`, title: `normal source` },
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseMutation.resolve()
+      collection._sync.unloadSubset(subset)
+      await cleanupPersistedOracle(
+        [
+          () => demand?.catch(() => undefined),
+          () => sourceReceipt?.catch(() => undefined),
+          () => localReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`queues a source suffix behind held durability and fails it with the prefix`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const firstDurabilityEntered = createEventGate()
+    const releaseFirstDurability = createEventGate()
+    const persistenceResponse = {
+      type: `rpc:applyCommittedTx:res` as const,
+      rpcId: `failed-prefix`,
+      ok: false as const,
+      code: `PERSISTENCE_ERROR` as const,
+      error: `prefix durability failed`,
+      sourceCode: `SQLITE_IOERR_FSYNC`,
+      path: [`database`, `wal`] as const,
+    }
+    let durabilityCalls = 0
+    coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
+      durabilityCalls++
+      if (durabilityCalls === 1) {
+        firstDurabilityEntered.resolve()
+        await releaseFirstDurability.promise
+        return { ...persistenceResponse, rpcId: tx.txId }
+      }
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        tx,
+      )
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `source-prefix-fail-stop`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let prefixReceipt: Promise<void> | undefined
+    let suffixReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `source prefix fail-stop collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `prefix`, title: `fails durability` },
+      })
+      prefixReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void prefixReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstDurabilityEntered.promise,
+        `failed source prefix entered durability`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `suffix`, title: `must not become durable` },
+      })
+      suffixReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void suffixReceipt.catch(() => undefined)
+      const prefixSettlement = observeSettlement(prefixReceipt)
+      const suffixSettlement = observeSettlement(suffixReceipt)
+      await Promise.resolve()
+
+      expect({
+        prefixPublic: stripVirtualProps(collection.get(`prefix`)),
+        suffixPublic: stripVirtualProps(collection.get(`suffix`)),
+        prefixReceipt: prefixSettlement.read(),
+        suffixReceipt: suffixSettlement.read(),
+        durabilityCalls,
+        prefixDurable: adapter.rows.get(`prefix`),
+        suffixDurable: adapter.rows.get(`suffix`),
+      }).toEqual({
+        prefixPublic: { id: `prefix`, title: `fails durability` },
+        suffixPublic: undefined,
+        prefixReceipt: { status: `pending` },
+        suffixReceipt: { status: `pending` },
+        durabilityCalls: 1,
+        prefixDurable: undefined,
+        suffixDurable: undefined,
+      })
+
+      releaseFirstDurability.resolve()
+      const prefixOutcome = await atPersistedOracleCheckpoint(
+        prefixReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `failed source prefix receipt`,
+      )
+      const suffixOutcome = await atPersistedOracleCheckpoint(
+        suffixReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `failed source suffix receipt`,
+      )
+      const terminalError =
+        prefixOutcome.status === `rejected` ? prefixOutcome.reason : undefined
+      expect({
+        prefixStatus: prefixOutcome.status,
+        terminalName:
+          terminalError instanceof Error ? terminalError.name : undefined,
+        terminalCause:
+          terminalError instanceof Error ? terminalError.cause : undefined,
+        suffixStatus: suffixOutcome.status,
+        suffixName:
+          suffixOutcome.status === `rejected` &&
+          suffixOutcome.reason instanceof Error
+            ? suffixOutcome.reason.name
+            : undefined,
+        sameTerminal:
+          suffixOutcome.status === `rejected` &&
+          suffixOutcome.reason === terminalError,
+        durabilityCalls,
+        suffixDurable: adapter.rows.get(`suffix`),
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+      }).toEqual({
+        prefixStatus: `rejected`,
+        terminalName: `PersistedCollectionDurabilityError`,
+        terminalCause: expect.objectContaining({
+          code: `PERSISTENCE_ERROR`,
+          path: [`database`, `wal`],
+        }),
+        suffixStatus: `rejected`,
+        suffixName: `PersistedCollectionDurabilityError`,
+        sameTerminal: true,
+        durabilityCalls: 1,
+        suffixDurable: undefined,
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstDurability.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => prefixReceipt?.catch(() => undefined),
+          () => suffixReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`bounds partial-update dependency work by pending owner count`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return []
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `pending-key-membership-work`,
+        getKey: (row) => row.id,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const ready = collection.stateWhenReady()
+    const ownerSizes = [47, 83] as const
+    const partialWrites = 19
+    const ownerReceipts: Array<Promise<void>> = []
+    const abortedReceipts: Array<Promise<unknown>> = []
+    let hasPrimaryFailure = false
+    let membershipChecks = 0
+    let membershipSpy: ReturnType<typeof vi.spyOn> | undefined
+
+    try {
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `key-membership hydration entered`,
+      )
+      for (const [ownerIndex, size] of ownerSizes.entries()) {
+        sourceParams.begin()
+        for (let keyIndex = 0; keyIndex < size; keyIndex++) {
+          sourceParams.write({
+            type: `insert`,
+            value: {
+              id: `owner-${ownerIndex}-${keyIndex}`,
+              title: `Queued owner row`,
+            },
+          })
+        }
+        const receipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void receipt.catch(() => undefined)
+        ownerReceipts.push(receipt)
+      }
+
+      const originalHas = Set.prototype.has
+      membershipSpy = vi
+        .spyOn(Set.prototype, `has`)
+        .mockImplementation(function (this: Set<unknown>, value: unknown) {
+          if (
+            typeof value === `string` &&
+            value.startsWith(`partial-`) &&
+            ownerSizes.includes(this.size as (typeof ownerSizes)[number])
+          ) {
+            membershipChecks++
+          }
+          return originalHas.call(this, value)
+        })
+      for (let index = 0; index < partialWrites; index++) {
+        const aborted = new AbortController()
+        aborted.abort()
+        sourceParams.begin()
+        sourceParams.write({
+          type: `update`,
+          value: { id: `partial-${index}`, title: `Partial update` },
+        })
+        abortedReceipts.push(
+          Promise.resolve(sourceParams.commit(aborted.signal)).catch(
+            (error) => error,
+          ),
+        )
+      }
+      membershipSpy.mockRestore()
+      membershipSpy = undefined
+
+      expectPendingKeyMembershipWork(
+        membershipChecks,
+        ownerSizes.length,
+        partialWrites,
+      )
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(ready, `key-membership hydration ready`)
+      await Promise.all(
+        ownerReceipts.map((receipt, index) =>
+          atPersistedOracleCheckpoint(receipt, `queued owner ${index} settled`),
+        ),
+      )
+      await Promise.all(abortedReceipts)
+      expect({
+        durableRows: adapter.rows.size,
+        status: collection.status,
+      }).toEqual({
+        durableRows: ownerSizes[0] + ownerSizes[1],
+        status: `ready`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      membershipSpy?.mockRestore()
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => ready.catch(() => undefined),
+          ...ownerReceipts.map(
+            (receipt) => () => receipt.catch(() => undefined),
+          ),
+          () => Promise.all(abortedReceipts).then(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects the old operation-scan answer for pending-key work`, () => {
+    const pendingOwnerSizes = [47, 83]
+    const partialWrites = 19
+    expect(() =>
+      expectPendingKeyMembershipWork(
+        pendingOwnerSizes.reduce((sum, size) => sum + size, 0) * partialWrites,
+        pendingOwnerSizes.length,
+        partialWrites,
+      ),
+    ).toThrow()
+    expect(() =>
+      expectPendingKeyMembershipWork(
+        pendingOwnerSizes.length * partialWrites,
+        pendingOwnerSizes.length,
+        partialWrites,
+      ),
+    ).not.toThrow()
+  })
+
+  it(`fail-stops a same-key partial suffix when its staged predecessor aborts`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await applyCommittedTx(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `same-key-abort-dependency`,
+        getKey: (row) => row.id,
+        sync: {
+          rowUpdateMode: `partial`,
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const aborted = new AbortController()
+    let gateReceipt: Promise<void> | undefined
+    let abortedReceipt: Promise<void> | undefined
+    let dependentReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `same-key dependency collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `gate`, title: `holds adapter` },
+      })
+      gateReceipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      void gateReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `same-key dependency persistence entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: {
+          id: `shared`,
+          title: `predecessor`,
+          detail: `required inherited field`,
+        },
+      })
+      abortedReceipt = Promise.resolve(
+        sourceParams.commit(aborted.signal),
+      ).then(() => undefined)
+      void abortedReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `update`,
+        value: { id: `shared`, title: `dependent suffix` },
+      })
+      dependentReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void dependentReceipt.catch(() => undefined)
+
+      aborted.abort()
+      releaseFirstPersistence.resolve()
+      await atPersistedOracleCheckpoint(
+        gateReceipt,
+        `dependency gate persisted`,
+      )
+      const abortedOutcome = await atPersistedOracleCheckpoint(
+        abortedReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `same-key predecessor aborted`,
+      )
+      const dependentOutcome = await atPersistedOracleCheckpoint(
+        dependentReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `same-key dependent suffix settled`,
+      )
+      const terminalError =
+        abortedOutcome.status === `rejected` ? abortedOutcome.reason : undefined
+
+      expect({
+        abortedStatus: abortedOutcome.status,
+        abortedName:
+          terminalError instanceof Error ? terminalError.name : undefined,
+        dependentStatus: dependentOutcome.status,
+        dependentExact:
+          dependentOutcome.status === `rejected` &&
+          dependentOutcome.reason === terminalError,
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+        publicRow: collection.get(`shared`),
+        durableRow: adapter.rows.get(`shared`),
+        pendingMarkers: collection._state.pendingSyncedTransactions.length,
+      }).toEqual({
+        abortedStatus: `rejected`,
+        abortedName: `AbortError`,
+        dependentStatus: `rejected`,
+        dependentExact: true,
+        status: `crashed`,
+        exactPublicError: true,
+        publicRow: undefined,
+        durableRow: undefined,
+        pendingMarkers: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => gateReceipt?.catch(() => undefined),
+          () => abortedReceipt?.catch(() => undefined),
+          () => dependentReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`closes a reentrant internal transaction after a terminal failure`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `hydrated`, title: `starts reentrant transaction` },
+    ])
+    const hydrationEntered = createEventGate()
+    const releaseHydration = createEventGate()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await releaseHydration.promise
+      return [
+        {
+          key: `hydrated`,
+          value: { id: `hydrated`, title: `starts reentrant transaction` },
+        },
+      ]
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-internal-transaction`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let internalReservationStarted = false
+    const subscription = collection.subscribeChanges((changes) => {
+      if (
+        !internalReservationStarted &&
+        changes.some((change) => change.key === `hydrated`)
+      ) {
+        internalReservationStarted = true
+        sourceParams.begin()
+      }
+    })
+    const terminalError = new Error(`terminal transaction failure`)
+    let externalReceipt: Promise<void> | undefined
+    let internalReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      const ready = collection.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `reentrant transaction hydration entered`,
+      )
+      await vi.waitFor(() => expect(sourceParams).toBeDefined())
+      releaseHydration.resolve()
+      await atPersistedOracleCheckpoint(ready, `reentrant transaction ready`)
+      expect({
+        internalReservationStarted,
+        pendingMarkers: collection._state.pendingSyncedTransactions.length,
+      }).toEqual({
+        internalReservationStarted: true,
+        pendingMarkers: 0,
+      })
+
+      adapter.applyCommittedTx = () => Promise.reject(terminalError)
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `terminal`, title: `published before failure` },
+      })
+      externalReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void externalReceipt.catch(() => undefined)
+      await expect(
+        atPersistedOracleCheckpoint(
+          externalReceipt,
+          `external durability failure`,
+        ),
+      ).rejects.toMatchObject({
+        name: `PersistedCollectionDurabilityError`,
+        cause: terminalError,
+      })
+
+      internalReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void internalReceipt.catch(() => undefined)
+      await expect(
+        atPersistedOracleCheckpoint(
+          internalReceipt,
+          `terminal internal transaction rejected`,
+        ),
+      ).rejects.toMatchObject({ name: `PersistedCollectionDurabilityError` })
+      expect({
+        status: collection.status,
+        pendingMarkers: collection._state.pendingSyncedTransactions.length,
+      }).toEqual({ status: `crashed`, pendingMarkers: 0 })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseHydration.resolve()
+      subscription.unsubscribe()
+      await cleanupPersistedOracle(
+        [
+          () => externalReceipt?.catch(() => undefined),
+          () => internalReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`keeps bare sync operations away from another owner's queued marker`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await applyCommittedTx(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `two-owner-marker-isolation`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let firstReceipt: Promise<void> | undefined
+    let queuedReceipt: Promise<void> | undefined
+    let strayCommitReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `two-owner marker collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `first`, title: `holds adapter` },
+      })
+      firstReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void firstReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `first owner persistence entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `queued`, title: `owns queued marker` },
+      })
+      queuedReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void queuedReceipt.catch(() => undefined)
+
+      let writeError: unknown
+      try {
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `stray`, title: `must not steal marker` },
+        })
+      } catch (error) {
+        writeError = error
+      }
+      let commitError: unknown
+      try {
+        const receipt = sourceParams.commit()
+        if (receipt !== true) {
+          strayCommitReceipt = Promise.resolve(receipt).then(() => undefined)
+          void strayCommitReceipt.catch(() => undefined)
+        }
+      } catch (error) {
+        commitError = error
+      }
+
+      expect({
+        writeErrorIsOwned:
+          writeError instanceof NoPendingSyncTransactionWriteError,
+        commitErrorIsOwned:
+          commitError instanceof NoPendingSyncTransactionCommitError,
+        queuedVisible: collection.has(`queued`),
+        strayVisible: collection.has(`stray`),
+      }).toEqual({
+        writeErrorIsOwned: true,
+        commitErrorIsOwned: true,
+        queuedVisible: false,
+        strayVisible: false,
+      })
+
+      releaseFirstPersistence.resolve()
+      await atPersistedOracleCheckpoint(firstReceipt, `first owner persisted`)
+      await atPersistedOracleCheckpoint(queuedReceipt, `queued owner persisted`)
+      expect({
+        queued: stripVirtualProps(collection.get(`queued`)),
+        stray: collection.get(`stray`),
+      }).toEqual({
+        queued: { id: `queued`, title: `owns queued marker` },
+        stray: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => firstReceipt?.catch(() => undefined),
+          () => queuedReceipt?.catch(() => undefined),
+          () => strayCommitReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-hydration-scope.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-hydration-scope.test.ts
new file mode 100644
index 0000000000..f62a921683
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-hydration-scope.test.ts
@@ -0,0 +1,165 @@
+/**
+ * Ordinary regression tests for cleanup of a persisted source that has a queued receipt, then restarts with the same
+ * persistence: the queued receipt is fenced, and the restarted owner accepts its own writes, in startup and subscription
+ * hydration phases, with and without the hydration routing probe. The fencing law is owned by persisted-oracle.test.ts,
+ * which keeps its model-checked hydration cases. The last test is a self-test of expectHydrationReceiptsPending from
+ * persisted-support.ts, the receipt-pending check the oracle file uses; it is not an oracle.
+ */
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '@tanstack/db'
+import { persistedCollectionOptions } from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createDeferred,
+  createRecordingAdapter,
+  expectHydrationReceiptsPending,
+  flushAsyncWork,
+  installHydrationRoutingProbe,
+  observeSettlement,
+  stripVirtualProps,
+} from './persisted-support'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`hydration source durability routing`, () => {
+  // Cleanup is a history action here, not only teardown. Queued source work
+  // has not entered storage when cleanup invalidates its sync run; releasing
+  // the old read cannot publish/store it in the replacement run. An already
+  // issued storage operation is outside this witness's no-write premise.
+  it.each(
+    [false, true].flatMap((scoped) =>
+      [`startup`, `subscription`].map((phase) => ({ scoped, phase })),
+    ),
+  )(
+    `cleanup fences a queued source receipt and permits restart: $phase scoped=$scoped`,
+    async ({ scoped, phase }) => {
+      const adapter = createRecordingAdapter()
+      const entered = createDeferred()
+      const release = createDeferred()
+      let holdRead = phase === `startup`
+      const resume = adapter.loadResumeSnapshot.bind(adapter)
+      const load = adapter.loadSubset.bind(adapter)
+      const hold = async <T>(snapshot: T) => {
+        if (holdRead) {
+          holdRead = false
+          entered.resolve()
+          await release.promise
+        }
+        return snapshot
+      }
+      adapter.loadResumeSnapshot = async (...args) => {
+        const snapshot = await resume(...args)
+        return args[1]?.includeRows === false ? snapshot : hold(snapshot)
+      }
+      adapter.loadSubset = async (...args) => hold(await load(...args))
+      const probe = scoped ? installHydrationRoutingProbe(adapter) : undefined
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `scoped-cleanup-restart`,
+          getKey: (row) => row.id,
+          syncMode: phase === `subscription` ? `on-demand` : `eager`,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const ready = collection.stateWhenReady()
+      void ready.catch(() => undefined)
+      let subset: Promise<unknown> | undefined
+      let receipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
+      try {
+        if (phase === `subscription`) {
+          await atPersistedOracleCheckpoint(ready, `cleanup initial readiness`)
+          holdRead = true
+          subset = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+          void subset.catch(() => undefined)
+        }
+        await atPersistedOracleCheckpoint(entered.promise, `cleanup held read`)
+        source.begin()
+        source.write({
+          type: `insert`,
+          value: { id: `obsolete`, title: `retired sync run` },
+        })
+        receipt = Promise.resolve(source.commit()).then(() => undefined)
+        const receiptState = observeSettlement(receipt)
+        const oldSource = source
+        const cleaning = collection.cleanup()
+        void cleaning.catch(() => undefined)
+        release.resolve()
+        await atPersistedOracleCheckpoint(
+          Promise.allSettled([cleaning, receipt, ready, subset]),
+          `cleanup invalidates buffered work`,
+        )
+        expect(receiptState.read().status).toBe(`rejected`)
+        expect(adapter.applyCommittedTxCalls).toEqual([])
+        expect(adapter.rows.size).toBe(0)
+        expect(collection.status).toBe(`cleaned-up`)
+        await atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `replacement sync run ready`,
+        )
+        oldSource.begin()
+        oldSource.write({
+          type: `insert`,
+          value: { id: `obsolete`, title: `late callback` },
+        })
+        await oldSource.commit()
+        source.begin()
+        source.write({
+          type: `insert`,
+          value: { id: `fresh`, title: `replacement source` },
+        })
+        await atPersistedOracleCheckpoint(
+          Promise.resolve(source.commit()),
+          `replacement source durable`,
+        )
+        expect(collection.get(`obsolete`)).toBeUndefined()
+        expect(adapter.rows.has(`obsolete`)).toBe(false)
+        expect(stripVirtualProps(collection.get(`fresh`))).toEqual({
+          id: `fresh`,
+          title: `replacement source`,
+        })
+        expect(adapter.rows.get(`fresh`)).toEqual({
+          id: `fresh`,
+          title: `replacement source`,
+        })
+        expect(probe?.violations() ?? []).toEqual([])
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        release.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => Promise.allSettled([ready, subset, receipt]),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`rejects an early individual receipt even while its sibling is pending`, async () => {
+    const pending = createDeferred()
+    const receipts = [
+      observeSettlement(Promise.resolve()),
+      observeSettlement(pending.promise),
+    ]
+    // A task boundary drains promise reactions; no elapsed duration is treated
+    // as progress evidence. The other receipt remains causally held by a gate.
+    await flushAsyncWork()
+    try {
+      expect(() => expectHydrationReceiptsPending(receipts)).toThrow()
+    } finally {
+      pending.resolve()
+    }
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts
index 41a1d9ccc7..74f3ddbf7d 100644
--- a/packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts
@@ -7,59 +7,63 @@ import {
   NoPendingSyncTransactionCommitError,
   NoPendingSyncTransactionWriteError,
   SyncTransactionAbortedError,
-  coalesce,
   collectionOptions,
   createCollection,
   createLiveQueryCollection,
-  createTransaction,
   eq,
   whenSyncAccepted,
 } from '@tanstack/db'
+import {
+  PersistedCollectionDurabilityError,
+  persistedCollectionOptions,
+} from '../src'
 import {
   oraclePropertyOptions,
   oracleReplayRequested,
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
-  IndeterminateCommitError,
-  InvalidPersistedCollectionConfigError,
-  InvalidPersistedCollectionCoordinatorError,
-  InvalidPersistedStorageKeyEncodingError,
-  InvalidPersistedStorageKeyError,
-  InvalidSyncConfigError,
-  PersistedCollectionDurabilityError,
-  SingleProcessCoordinator,
-  createPersistedTableName,
-  decodePersistedStorageKey,
-  encodePersistedStorageKey,
-  persistedCollectionOptions,
-  toTransportedLoadSubsetOptions,
-  validateRemoteSubsetOptions,
-} from '../src'
-import { Temporal } from './temporal-value-oracle'
-import { cleanupTestActions } from './test-cleanup'
+  assertGenerationNoticeHistory,
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  configureHydrationScope,
+  createCoordinatorHarness,
+  createDeferred,
+  createEventGate,
+  createFollowerTab,
+  createRecordingAdapter,
+  describeUnlessAnyOracleReplay,
+  describeUnlessOracleReplay,
+  expectExactSnapshot,
+  expectHydrationReceiptsPending,
+  flushAsyncWork,
+  generationNoticeHistory,
+  hydrationScopeModes,
+  installHydrationRoutingProbe,
+  itUnlessAnyOracleReplay,
+  observeSettlement,
+  overrideBaselineRows,
+  recordedStorageId,
+  stripVirtualProps,
+  within,
+} from './persisted-support'
 import type {
-  CollectionReset,
   PersistedCollectionCoordinator,
-  PersistedCollectionPersistence,
   PersistedStorageTarget,
-  PersistedSyncWrappedOptions,
   PersistedTx,
   PersistenceAdapter,
   ProtocolEnvelope,
-  PullSinceResponse,
-  RemoteSubsetOwner,
   TxCommitted,
 } from '../src'
+import type { Collection, LoadSubsetOptions, SyncConfig } from '@tanstack/db'
 import type {
-  Collection,
-  LoadSubsetOptions,
-  PendingMutation,
-  Subscription,
-  SyncConfig,
-  SyncMetadataApi,
-} from '@tanstack/db'
+  FollowerRemoteDemandHistory,
+  FollowerRow,
+  Todo,
+  TodoSyncParams,
+} from './persisted-support'
 
 /**
  * # Does persisted wrapping preserve one Collection history?
@@ -82,43 +86,26 @@ import type {
  * persisted rows. Reading those rows for a subset demand or a coordinator
  * notification may delay publication, but cannot revoke acceptance. Truncate
  * replay replaces earlier source rows; later sync transactions apply to that
- * replacement. The settled-result oracle below compares queued and completed
- * persistence reads against the same independent snapshot algebra.
- * A descriptor with mutable persistence state has one Collection owner only
- * after construction succeeds. A synchronous construction failure leaves it
- * unclaimed, so a corrected retry can own and use it; a third construction
- * cannot displace that successful owner. Controlled startup failures do not
- * establish asynchronous or native-host resource teardown.
- * Existing admission tests separately retain the rejection of transactions
- * still open when another persistence read begins. They characterize the
- * current restriction; they do not establish that reading makes work obsolete.
+ * replacement. The queued and completed persistence reads in this file are
+ * compared with the same independent snapshot algebra.
  * Buffered hydration transactions retain the row metadata ownership captured
  * from their original persistence read.
- * A managed on-demand cache has a separate claim boundary. Once its claim
- * expires, old rows and source callbacks cannot populate the replacement
- * generation. A source with its own restart hook controls that handoff; a
- * custom source without one is cleaned up and reentered with fresh callbacks.
- * Recovery reacquires active subsets, current index declarations,
- * and a renewal timer after the source restarts. A transient renewal error
- * alone does not establish claim loss; adapter operations still check claims.
- *
- * `foldDurabilityLedger` is the independent model for append-only source
- * obligations. The recording adapter is a plain durable-state model: Maps for
- * rows and metadata plus ordered transaction, index, load, and reload calls.
- * Histories cross hydration, held adapters, source FIFO ordering,
- * independent/dependent aborts, open-transaction failure boundaries, ambient owner
- * operations, applied-receipt rejection, remote subset demand, acquisition
- * release, retry, coordinator replay, queued startup reloads, unscheduled
- * startup/reset overlap, cleanup, and restart. Tests drive the
- * real persisted wrapper, Collection, coordinator, adapter, transactions,
- * indexes, and local mutation path.
- * Cleanup waits for source and persistence release work after any teardown
- * failure. A retired source sync cannot publish new remote subset ownership.
  * A source abort before core application rejects that transaction's receipt.
  * It does not invalidate the durable baseline or an independent queued source
  * transaction when the failed transaction made no public or durable change.
- * A terminal durability failure also rejects an exact retained on-demand
- * acquisition. Hydrated rows cannot turn that failed sync run back to ready.
+ * Recovery reacquires active subsets, current index declarations, and a renewal
+ * timer after the source restarts.
+ * A retired source sync cannot publish new remote subset ownership.
+ *
+ * `foldDurabilityLedger` is the independent model for append-only source
+ * obligations. The recording adapter in persisted-support.ts is a plain
+ * durable-state model: Maps for rows and metadata plus ordered transaction,
+ * index, load, and reload calls. Histories cross hydration, held adapters,
+ * source FIFO ordering, independent/dependent aborts, open-transaction failure
+ * boundaries, ambient owner operations, remote subset demand, follower rotation
+ * and scoped recovery, queued startup reloads, and on-demand evidence. Tests
+ * drive the real persisted wrapper, Collection, coordinator, adapter,
+ * transactions, indexes, and local mutation path.
  *
  * Refinement checkpoints compare public rows, durable state, metadata, request
  * data, sequence evidence, exact errors, and late-work fencing. Fixed hostile
@@ -134,20 +121,20 @@ import type {
  * does not route, while a follower may route to the elected owner's registered
  * source. During scoped recovery a follower takes a current-generation commit
  * notice from the elected owner as source evidence and publishes its demanded
- * durable rows; a notice from any other sender still requests a refetch. Native SQLite hosts, live Electric service behavior, adapter
- * cancellation, and the open B2-failure/E4 schedule remain separate evidence.
+ * durable rows; a notice from any other sender still requests a refetch. Native
+ * SQLite hosts, live Electric service behavior, adapter cancellation, and the
+ * open B2-failure/E4 schedule remain separate evidence.
+ *
+ * Fixed scenarios that once lived in this file are ordinary tests in
+ * persisted.test.ts, persisted-startup.test.ts, persisted-subset.test.ts,
+ * persisted-source-receipts.test.ts, persisted-hydration-queue.test.ts,
+ * persisted-reload-metadata.test.ts, persisted-demand.test.ts,
+ * persisted-follower-indexes.test.ts, persisted-cache-claims.test.ts,
+ * persisted-reset-startup.test.ts, persisted-hydration-scope.test.ts,
+ * persisted-reconciliation.test.ts, and persisted-cleanup.test.ts. They keep
+ * their titles and literal expectations and are not oracle evidence.
  */
 
-type Todo = {
-  id: string
-  title: string
-  detail?: string
-  payload?: { rank: number }
-  values?: Array<string | null>
-}
-
-type TodoSyncParams = Parameters<SyncConfig<Todo, string>[`sync`]>[0]
-
 // A complete durable row is a value, including its exact set of fields. The
 // model deliberately uses only Maps and authored input rows; it does not
 // classify production sync writes or copy their update/replace algorithm.
@@ -201,34 +188,6 @@ function expectedTargetedSnapshot(
   )
 }
 
-function expectExactSnapshot(
-  actual: ReadonlyMap<string, Todo>,
-  expected: ReadonlyMap<string, Todo>,
-): void {
-  expect(Array.from(actual.keys()).sort()).toEqual(
-    Array.from(expected.keys()).sort(),
-  )
-  for (const [key, row] of expected) expect(actual.get(key)).toStrictEqual(row)
-}
-
-// A path replay of one of these properties runs this suite. A replay of any
-// other property stands it aside.
-const describeUnlessOracleReplay = oracleReplayTest(
-  describe,
-  `persistence.retained-demand`,
-  `persistence.generation-notice`,
-  `persistence.follower-remote-demand`,
-)
-
-const itUnlessAnyOracleReplay = oracleReplayTest(it)
-const describeUnlessAnyOracleReplay = oracleReplayTest(describe)
-
-const hydrationScopeModes = [
-  `none`,
-  `same-adapter`,
-  `distinct-adapter`,
-] as const
-
 const persistedKeySetEvidenceStatuses = [
   `consistent`,
   `unknown`,
@@ -263,535 +222,6 @@ function expectOnDemandEvidenceLaw(
   }
 }
 
-type RecordingAdapter = PersistenceAdapter & {
-  applyCommittedTxCalls: Array<{
-    collectionId: string
-    tx: {
-      term: number
-      seq: number
-      rowVersion: number
-      truncate?: boolean
-      mutations: Array<{
-        type: `insert` | `update` | `delete`
-        key: string | number
-      }>
-    }
-  }>
-  ensureIndexCalls: Array<{ collectionId: string; signature: string }>
-  markIndexRemovedCalls: Array<{ collectionId: string; signature: string }>
-  loadSubsetCalls: Array<{
-    collectionId: string
-    options: LoadSubsetOptions
-    requiredIndexSignatures: ReadonlyArray<string>
-  }>
-  loadCollectionMetadataCalls: Array<string>
-  loadResumeSnapshotCalls: Array<{
-    collectionId: string
-    includeRows: boolean | undefined
-    requiredIndexSignatures: ReadonlyArray<string>
-  }>
-  rows: Map<string, Todo>
-  rowMetadata: Map<string, unknown>
-  collectionMetadata: Map<string, unknown>
-}
-
-// This fixture records the addressed storage name; it does not decide whether
-// the target's managed claim is valid. The SQLite owner judges that boundary.
-function recordedStorageId(target: PersistedStorageTarget): string {
-  return target.kind === `eager`
-    ? target.collectionId
-    : target.storageCollectionId
-}
-
-function createRecordingAdapter(
-  initialRows: Array<Todo> = [],
-): RecordingAdapter {
-  const rows = new Map(initialRows.map((row) => [row.id, row]))
-  const rowMetadata = new Map<string, unknown>()
-
-  const adapter: RecordingAdapter = {
-    rows,
-    rowMetadata,
-    collectionMetadata: new Map(),
-    applyCommittedTxCalls: [],
-    ensureIndexCalls: [],
-    markIndexRemovedCalls: [],
-    loadSubsetCalls: [],
-    loadCollectionMetadataCalls: [],
-    loadResumeSnapshotCalls: [],
-    loadSubset: (collectionId, options, ctx) => {
-      adapter.loadSubsetCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        options,
-        requiredIndexSignatures: ctx?.requiredIndexSignatures ?? [],
-      })
-      return Promise.resolve(
-        Array.from(rows.values()).map((value) => ({
-          key: value.id,
-          value,
-          metadata: rowMetadata.get(value.id),
-        })),
-      )
-    },
-    loadResumeSnapshot: (collectionId, options) => {
-      adapter.loadResumeSnapshotCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        includeRows: options?.includeRows,
-        requiredIndexSignatures: options?.requiredIndexSignatures ?? [],
-      })
-      const latest = adapter.applyCommittedTxCalls.at(-1)?.tx
-      return Promise.resolve({
-        rows:
-          options?.includeRows === false
-            ? []
-            : Array.from(rows.values()).map((value) => ({
-                key: value.id,
-                value,
-                metadata: rowMetadata.get(value.id),
-              })),
-        keySet: { status: `consistent` },
-        collectionMetadata: Array.from(
-          adapter.collectionMetadata,
-          ([key, value]) => ({ key, value }),
-        ),
-        latestTerm: latest?.term ?? 0,
-        latestSeq: latest?.seq ?? 0,
-        latestRowVersion: latest?.rowVersion ?? 0,
-        resetEpoch: 0,
-      })
-    },
-    loadCollectionMetadata: (collectionId) => {
-      adapter.loadCollectionMetadataCalls.push(recordedStorageId(collectionId))
-      return Promise.resolve(
-        Array.from(adapter.collectionMetadata.entries()).map(
-          ([key, value]) => ({
-            key,
-            value,
-          }),
-        ),
-      )
-    },
-    scanRows: () =>
-      Promise.resolve(
-        Array.from(rows.values()).map((value) => ({
-          key: value.id,
-          value,
-          metadata: rowMetadata.get(value.id),
-        })),
-      ),
-    applyCommittedTx: (collectionId, tx) => {
-      adapter.applyCommittedTxCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        tx: {
-          term: tx.term,
-          seq: tx.seq,
-          rowVersion: tx.rowVersion,
-          truncate: tx.truncate,
-          mutations: tx.mutations.map((mutation) => ({
-            type: mutation.type,
-            key: mutation.key,
-          })),
-        },
-      })
-
-      if (tx.truncate) {
-        rows.clear()
-        rowMetadata.clear()
-      }
-
-      for (const mutation of tx.mutations) {
-        if (mutation.type === `delete`) {
-          rows.delete(mutation.key as string)
-          rowMetadata.delete(mutation.key as string)
-        } else if (mutation.type === `update`) {
-          rows.set(mutation.key as string, {
-            ...rows.get(mutation.key as string),
-            ...(mutation.value as Todo),
-          })
-          if (mutation.metadataChanged) {
-            rowMetadata.set(mutation.key as string, mutation.metadata)
-          }
-        } else {
-          rows.set(mutation.key as string, mutation.value as Todo)
-          if (mutation.metadataChanged) {
-            rowMetadata.set(mutation.key as string, mutation.metadata)
-          }
-        }
-      }
-      for (const rowMetadataMutation of tx.rowMetadataMutations ?? []) {
-        if (rowMetadataMutation.type === `delete`) {
-          rowMetadata.delete(rowMetadataMutation.key as string)
-        } else {
-          rowMetadata.set(
-            rowMetadataMutation.key as string,
-            rowMetadataMutation.value,
-          )
-        }
-      }
-      for (const metadataMutation of tx.collectionMetadataMutations ?? []) {
-        if (metadataMutation.type === `delete`) {
-          adapter.collectionMetadata.delete(metadataMutation.key)
-        } else {
-          adapter.collectionMetadata.set(
-            metadataMutation.key,
-            metadataMutation.value,
-          )
-        }
-      }
-      return Promise.resolve()
-    },
-    ensureIndex: (collectionId, signature) => {
-      adapter.ensureIndexCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        signature,
-      })
-      return Promise.resolve()
-    },
-    markIndexRemoved: (collectionId, signature) => {
-      adapter.markIndexRemovedCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        signature,
-      })
-      return Promise.resolve()
-    },
-  }
-
-  return adapter
-}
-
-function overrideBaselineRows(
-  adapter: RecordingAdapter,
-  loadRows: () =>
-    | Array<{ key: string; value: Todo; metadata?: unknown }>
-    | Promise<Array<{ key: string; value: Todo; metadata?: unknown }>>,
-): () => void {
-  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-  adapter.loadResumeSnapshot = async (...args) => {
-    const snapshot = await loadResumeSnapshot(...args)
-    if (args[1]?.includeRows === false) return snapshot
-    return { ...snapshot, rows: await loadRows() }
-  }
-  return () => {
-    adapter.loadResumeSnapshot = loadResumeSnapshot
-  }
-}
-
-function createNoopAdapter(): PersistenceAdapter {
-  return {
-    loadSubset: () => Promise.resolve([]),
-    loadResumeSnapshot: () =>
-      Promise.resolve({
-        rows: [],
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }),
-    applyCommittedTx: () => Promise.resolve(),
-    ensureIndex: () => Promise.resolve(),
-  }
-}
-
-type CoordinatorHarness = PersistedCollectionCoordinator & {
-  emit: (
-    payload: TxCommitted | CollectionReset,
-    senderId?: string,
-    collectionId?: string,
-  ) => void
-  pullSinceCalls: number
-  setPullSinceResponse: (response: PullSinceResponse) => void
-}
-
-function createCoordinatorHarness(): CoordinatorHarness {
-  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined =
-    undefined
-  let pullSinceResponse: PullSinceResponse = {
-    type: `rpc:pullSince:res`,
-    rpcId: `pull-0`,
-    ok: true,
-    latestTerm: 1,
-    latestSeq: 0,
-    latestRowVersion: 0,
-    requiresFullReload: false,
-    changedKeys: [],
-    deletedKeys: [],
-  }
-
-  const harness: CoordinatorHarness = {
-    pullSinceCalls: 0,
-    getNodeId: () => `coordinator-node`,
-    subscribe: (_collectionId, onMessage) => {
-      subscriber = onMessage
-      return () => {
-        subscriber = undefined
-      }
-    },
-    publish: () => {},
-    isLeader: () => true,
-    ensureLeadership: async () => {},
-    requestEnsurePersistedIndex: async () => {},
-    requestEnsureRemoteSubset: async () => {},
-    // Remote subset ownership is outside this protocol-delivery harness.
-    requestReleaseRemoteSubset: async () => {},
-    registerRemoteSubsetOwner: () => () => {},
-    requestApplyCommittedTx: (_collectionId, tx) =>
-      Promise.resolve({
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }),
-    pullSince: () => {
-      harness.pullSinceCalls++
-      return Promise.resolve(pullSinceResponse)
-    },
-    emit: (
-      payload,
-      senderId = `remote-node`,
-      collectionId = `sync-present`,
-    ) => {
-      subscriber?.({
-        v: 1,
-        dbName: `test-db`,
-        collectionId,
-        senderId,
-        ts: Date.now(),
-        payload,
-      })
-    },
-    setPullSinceResponse: (response) => {
-      pullSinceResponse = response
-    },
-  }
-
-  return harness
-}
-
-function createLocalCoordinatorHarness() {
-  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-  return Object.assign(new SingleProcessCoordinator(), {
-    subscribe: (
-      _collectionId: string,
-      onMessage: (message: ProtocolEnvelope<unknown>) => void,
-    ) => {
-      subscriber = onMessage
-      return () => {
-        subscriber = undefined
-      }
-    },
-    emit: (payload: TxCommitted | CollectionReset) => {
-      subscriber?.({
-        v: 1,
-        dbName: `test-db`,
-        collectionId: `sync-present`,
-        senderId: `remote-node`,
-        ts: Date.now(),
-        payload,
-      })
-    },
-  })
-}
-
-type FailStopCoordinatorHarness = PersistedCollectionCoordinator & {
-  emit: (payload: unknown, senderId?: string) => void
-  publishCalls: Array<ProtocolEnvelope<unknown>>
-  remoteEnsureCalls: Array<LoadSubsetOptions>
-  remoteReleaseCalls: Array<LoadSubsetOptions>
-  unsubscribeCalls: number
-}
-
-function createFailStopCoordinatorHarness(
-  collectionId: string,
-): FailStopCoordinatorHarness {
-  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-  const harness: FailStopCoordinatorHarness = {
-    publishCalls: [],
-    remoteEnsureCalls: [],
-    remoteReleaseCalls: [],
-    unsubscribeCalls: 0,
-    getNodeId: () => `fail-stop-coordinator`,
-    subscribe: (_collectionId, onMessage) => {
-      subscriber = onMessage
-      return () => {
-        harness.unsubscribeCalls++
-        subscriber = undefined
-      }
-    },
-    publish: (_collectionId, message) => {
-      harness.publishCalls.push(message)
-    },
-    isLeader: () => true,
-    ensureLeadership: async () => {},
-    requestEnsurePersistedIndex: async () => {},
-    requestEnsureRemoteSubset: async (_collectionId, options) => {
-      harness.remoteEnsureCalls.push(options)
-    },
-    requestReleaseRemoteSubset: async (_collectionId, options) => {
-      harness.remoteReleaseCalls.push(options)
-    },
-    registerRemoteSubsetOwner: () => () => {},
-    requestApplyCommittedTx: (_collectionId, tx) =>
-      Promise.resolve({
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }),
-    emit: (payload, senderId = `remote-fail-stop-peer`) => {
-      subscriber?.({
-        v: 1,
-        dbName: `test-db`,
-        collectionId,
-        senderId,
-        ts: Date.now(),
-        payload,
-      })
-    },
-  }
-  return harness
-}
-
-const stripVirtualProps = <T extends Record<string, any> | undefined>(
-  value: T,
-): T => {
-  if (!value || typeof value !== `object`) return value
-  const {
-    $hasPendingWrites: _hasPendingWrites,
-    $synced: _synced,
-    $origin: _origin,
-    $key: _key,
-    $collectionId: _collectionId,
-    ...rest
-  } = value as Record<string, unknown>
-  return rest as T
-}
-
-async function flushAsyncWork(delayMs: number = 0): Promise<void> {
-  await new Promise((resolve) => setTimeout(resolve, delayMs))
-}
-
-function createDeferred<T = void>(): {
-  promise: Promise<T>
-  resolve: (value: T) => void
-} {
-  let resolve!: (value: T) => void
-  const promise = new Promise<T>((settle) => {
-    resolve = settle
-  })
-  return { promise, resolve }
-}
-
-function createEventGate(): {
-  promise: Promise<void>
-  resolve: () => void
-  reject: (error: unknown) => void
-} {
-  let resolve!: () => void
-  let reject!: (error: unknown) => void
-  const promise = new Promise<void>((resolvePromise, rejectPromise) => {
-    resolve = resolvePromise
-    reject = rejectPromise
-  })
-  return { promise, resolve, reject }
-}
-
-async function atPersistedOracleCheckpoint<T>(
-  promise: Promise<T>,
-  label: string,
-  timeout = 1000,
-): Promise<T> {
-  let timer: ReturnType<typeof setTimeout> | undefined
-  try {
-    return await Promise.race([
-      promise,
-      new Promise<never>((_resolve, reject) => {
-        timer = setTimeout(
-          () =>
-            reject(
-              new Error(`Persisted oracle checkpoint timed out: ${label}`),
-            ),
-          timeout,
-        )
-      }),
-    ])
-  } finally {
-    clearTimeout(timer)
-  }
-}
-
-async function cleanupPersistedOracle(
-  actions: Array<() => void | Promise<unknown>>,
-  hasPrimaryFailure: boolean,
-): Promise<void> {
-  await cleanupTestActions(
-    actions,
-    hasPrimaryFailure,
-    `Persisted oracle`,
-    (action, index) =>
-      atPersistedOracleCheckpoint(
-        Promise.resolve().then(action),
-        `cleanup stage ${index}`,
-        250,
-      ),
-  )
-}
-
-it.each([false, true])(
-  `persisted oracle cleanup attempts every action without hiding a primary failure: %s`,
-  async (hasPrimaryFailure) => {
-    const firstFailure = new Error(`first oracle cleanup failure`)
-    const secondFailure = new Error(`second oracle cleanup failure`)
-    const attempts: Array<string> = []
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-
-    try {
-      const outcome = await cleanupPersistedOracle(
-        [
-          () => {
-            attempts.push(`first`)
-            throw firstFailure
-          },
-          () => {
-            attempts.push(`second`)
-            return Promise.reject(secondFailure)
-          },
-          () => {
-            attempts.push(`last`)
-          },
-        ],
-        hasPrimaryFailure,
-      ).then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-
-      expect(attempts).toEqual([`first`, `second`, `last`])
-      if (hasPrimaryFailure) {
-        expect(outcome).toBeUndefined()
-        expect(warning).toHaveBeenCalledWith(
-          `Persisted oracle cleanup failed after the primary failure:`,
-          [firstFailure, secondFailure],
-        )
-      } else {
-        expect(outcome).toBeInstanceOf(AggregateError)
-        expect((outcome as AggregateError).errors).toEqual([
-          firstFailure,
-          secondFailure,
-        ])
-        expect(warning).not.toHaveBeenCalled()
-      }
-    } finally {
-      warning.mockRestore()
-    }
-  },
-)
-
 type DurabilityLedgerEvent =
   | { type: `begin`; transactionId: string }
   | { type: `write`; transactionId: string; row: Todo }
@@ -830,29655 +260,4462 @@ function foldDurabilityLedger(events: ReadonlyArray<DurabilityLedgerEvent>): {
   return { committedRows, commitOrder }
 }
 
-// The immutable authored order is crossing→later. The model has no coordinator
-// route or runtime lifecycle: a durable exact-ID hit contributes crossing once;
-// otherwise a certified empty interval lets the replacement apply it once.
-function modelSourceReconciliation(committedBeforeClose: boolean) {
-  const before = committedBeforeClose ? [`crossing`] : []
-  return {
-    atUncertain: {
-      publicIds: [`crossing`],
-      durableIds: before,
-      cursor: committedBeforeClose ? `crossing` : null,
-    },
-    afterReconciliation: {
-      publicIds: [`crossing`],
-      liveIds: [`crossing`],
-      liveStatus: `ready`,
-      durableIds: [`crossing`],
-      cursor: `crossing`,
-      syncRuns: 1,
-      durableTxCount: 1,
-    },
-    afterSuffix: {
-      publicIds: [`crossing`, `later`],
-      liveIds: [`crossing`, `later`],
-      liveStatus: `ready`,
-      durableIds: [`crossing`, `later`],
-      cursor: `later`,
-      syncRuns: 1,
-      durableTxCount: 2,
-    },
-  }
-}
+let generatedOwnershipHistoryId = 0
 
-// The controlled coordinator loses one source RPC answer after either storing
-// its transaction or storing nothing. It holds the exact-ID reconciliation so
-// the driver can compare the pending receipt and public/durable state at the
-// uncertainty cut. Browser/SQLite owns the atomic absence proof and actual
-// election; this driver checks the wrapped receipt and dependent query path.
-it.each([false, true])(
-  `reconciles a source receipt without ending its dependent live query when applied=%s`,
-  async (committedBeforeClose) => {
-    const expected = modelSourceReconciliation(committedBeforeClose)
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const error = new IndeterminateCommitError({
-      collectionId: `source-restart`,
-      requestType: `rpc:applyCommittedTx:req`,
-      previousLeaderId: `retired`,
-      previousTerm: 1,
-      currentLeaderId: `replacement`,
-      currentTerm: 2,
-      cause: new Error(`lost response`),
-    })
-    let first = true
-    const reconciliationEntered = createDeferred()
-    const releaseReconciliation = createDeferred()
-    let durableFirstTx: PersistedTx | undefined
-    coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
-      if (first) {
-        first = false
-        if (committedBeforeClose) {
-          await adapter.applyCommittedTx(
-            { kind: `eager`, collectionId: collectionId },
-            tx,
-          )
-          durableFirstTx = tx
-        }
-        throw error
-      }
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        tx,
-      )
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-    coordinator.reconcileCommittedTx = async (collectionId, tx, anchor) => {
-      expect(anchor.latestRowVersion).toBe(0)
-      reconciliationEntered.resolve()
-      await releaseReconciliation.promise
-      const alreadyApplied = durableFirstTx !== undefined
-      const committed = alreadyApplied
-        ? durableFirstTx!
-        : { ...tx, term: 2, seq: 1, rowVersion: 1 }
-      if (!alreadyApplied)
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          committed,
-        )
-      return {
-        type: `rpc:reconcileCommittedTx:res`,
-        rpcId: `controlled-reconciliation`,
-        ok: true,
-        alreadyApplied,
-        committed: {
-          term: committed.term,
-          seq: committed.seq,
-          rowVersion: committed.rowVersion,
-        },
-      }
-    }
+function sortedTodoRows(rows: Iterable<Todo>): Array<Todo> {
+  return Array.from(rows).sort((left, right) => left.id.localeCompare(right.id))
+}
 
-    let source!: TodoSyncParams
-    let syncRuns = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `source-restart`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            syncRuns++
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const live = createLiveQueryCollection((q) => q.from({ row: collection }))
-    const livePublishedKeys: Array<string> = []
-    const liveSubscription = live.subscribeChanges((changes) => {
-      livePublishedKeys.push(...changes.map(({ key }) => String(key)))
-    })
-    let hasPrimaryFailure = false
-    const observe = () => ({
-      publicIds: [...collection.keys()].sort(),
-      liveIds: [...live.keys()].sort(),
-      liveStatus: live.status,
-      durableIds: [...adapter.rows.keys()].sort(),
-      cursor: adapter.collectionMetadata.get(`probe:cursor`) ?? null,
-    })
+type SourceFifoOrderingObservation = {
+  publicRows: Array<Todo>
+  durableRows: Array<Todo>
+  status: string
+  pendingMarkers: number
+}
 
-    try {
-      await atPersistedOracleCheckpoint(collection.preload(), `initial ready`)
-      await atPersistedOracleCheckpoint(
-        live.preload(),
-        `dependent live query ready`,
-      )
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `crossing`, title: `source` },
-      })
-      source.metadata?.collection.set(`probe:cursor`, `crossing`)
-      const firstReceipt = Promise.resolve(source.commit()).then(
-        () => undefined,
-      )
-      const firstSettlement = observeSettlement(firstReceipt)
-      await atPersistedOracleCheckpoint(
-        reconciliationEntered.promise,
-        `exact-ID reconciliation entered`,
-      )
-      expect(firstSettlement.read()).toEqual({ status: `pending` })
-      expect({
-        publicIds: [...collection.keys()].sort(),
-        durableIds: [...adapter.rows.keys()].sort(),
-        cursor: adapter.collectionMetadata.get(`probe:cursor`) ?? null,
-      }).toEqual(expected.atUncertain)
-      expect(live.status).toBe(`ready`)
-      releaseReconciliation.resolve()
-      await atPersistedOracleCheckpoint(
-        firstReceipt,
-        `reconciled source receipt`,
-      )
+function expectSourceFifoOrderingObservation(
+  actual: SourceFifoOrderingObservation,
+  expectedRows: ReadonlyArray<Todo>,
+): void {
+  expect(actual).toEqual({
+    publicRows: expectedRows,
+    durableRows: expectedRows,
+    status: `ready`,
+    pendingMarkers: 0,
+  })
+}
 
-      expect(firstSettlement.read()).toEqual({ status: `fulfilled` })
-      expect({ status: collection.status, syncRuns }).toEqual({
-        status: `ready`,
-        syncRuns: 1,
-      })
-      expect({
-        ...observe(),
-        syncRuns,
-        durableTxCount: adapter.applyCommittedTxCalls.length,
-      }).toEqual(expected.afterReconciliation)
-      expect(livePublishedKeys).toContain(`crossing`)
+type AbortGraphObservation = {
+  predecessorStatus: `fulfilled` | `rejected`
+  predecessorName: string | undefined
+  successorStatus: `fulfilled` | `rejected`
+  sameFailure: boolean
+  status: string
+  publicSuccessor: Todo | undefined
+  durableSuccessor: Todo | undefined
+  pendingMarkers: number
+}
 
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `later`, title: `source suffix` },
-      })
-      source.metadata?.collection.set(`probe:cursor`, `later`)
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(source.commit()),
-        `later source receipt`,
-      )
-      expect({
-        ...observe(),
-        syncRuns,
-        durableTxCount: adapter.applyCommittedTxCalls.length,
-      }).toEqual(expected.afterSuffix)
-      expect(livePublishedKeys).toContain(`later`)
-    } catch (failure) {
-      hasPrimaryFailure = true
-      throw failure
-    } finally {
-      releaseReconciliation.resolve()
-      liveSubscription.unsubscribe()
-      await cleanupPersistedOracle(
-        [() => live.cleanup(), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
+function expectAbortGraphObservation(
+  actual: AbortGraphObservation,
+  relationship: `independent` | `same-key`,
+  successorKey: string,
+  successorTitle: string,
+): void {
+  expect(actual).toEqual(
+    relationship === `same-key`
+      ? {
+          predecessorStatus: `rejected`,
+          predecessorName: `AbortError`,
+          successorStatus: `rejected`,
+          sameFailure: true,
+          status: `crashed`,
+          publicSuccessor: undefined,
+          durableSuccessor: undefined,
+          pendingMarkers: 0,
+        }
+      : {
+          predecessorStatus: `rejected`,
+          predecessorName: `AbortError`,
+          successorStatus: `fulfilled`,
+          sameFailure: false,
+          status: `ready`,
+          publicSuccessor: { id: successorKey, title: successorTitle },
+          durableSuccessor: { id: successorKey, title: successorTitle },
+          pendingMarkers: 0,
+        },
+  )
+}
 
-// The design grammar's X-then-Y history joins two previously separate facts:
-// exact-ID reconciliation acknowledges X at version 1 after a same-key peer
-// write advances durable storage to version 2, and resume certification must
-// fail closed when the wrapper's owned generation is not the latest durable
-// generation. The controlled coordinator supplies the two durable writes and
-// the original-position response. The real persisted wrapper owns the source
-// receipt, public row, and resume-evidence checkpoint. SQLite separately owns
-// the atomic exact-ID proof; this test does not emulate its SQL decision.
-it(`keeps the original receipt position after a peer write and fails closed on resume evidence`, async () => {
-  const collectionId = `reconciled-peer-resume-generation`
-  const adapter = createRecordingAdapter()
-  const coordinator = createCoordinatorHarness()
-  const error = new IndeterminateCommitError({
-    collectionId,
-    requestType: `rpc:applyCommittedTx:req`,
-    previousLeaderId: `retired`,
-    previousTerm: 1,
-    currentLeaderId: `replacement`,
-    currentTerm: 2,
-    cause: new Error(`lost response`),
+type OwnerIsolationAdmissionObservation = {
+  exactError: boolean
+  strayVisible: boolean
+}
+
+function expectOwnerIsolationAdmission(
+  actual: OwnerIsolationAdmissionObservation,
+): void {
+  expect(actual).toEqual({ exactError: true, strayVisible: false })
+}
+
+type OpenTransactionBoundaryObservation = {
+  status: string
+  pendingMarkers: number
+}
+
+type RequestLocalFailureObservation = {
+  receiptStatus: `pending` | `fulfilled` | `rejected`
+  publicRows: Array<Todo>
+  durableRows: Array<Todo>
+  status: string
+  publicError: unknown
+}
+
+function expectOpenTransactionBoundaryObservation(
+  actual: OpenTransactionBoundaryObservation,
+  boundary: `abort` | `cleanup` | `terminal-failure`,
+): void {
+  expect(actual).toEqual({
+    status:
+      boundary === `cleanup`
+        ? `cleaned-up`
+        : boundary === `abort`
+          ? `ready`
+          : `crashed`,
+    pendingMarkers: 0,
   })
-  let source!: TodoSyncParams
-  let capability: SyncMetadataApi<string>[`persistence`] | undefined
-  let originalTx: PersistedTx | undefined
-  let syncRuns = 0
+}
 
-  coordinator.requestApplyCommittedTx = async (id, tx) => {
-    originalTx = { ...tx, term: 1, seq: 1, rowVersion: 1 }
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: id },
-      originalTx,
-    )
-    const peerTx: PersistedTx = {
-      ...tx,
-      txId: `peer-after-original`,
-      term: 2,
-      seq: 1,
-      rowVersion: 2,
-      mutations: [
-        {
-          type: `update`,
-          key: `shared`,
-          value: { id: `shared`, title: `peer` },
-        },
-      ],
-      rowMetadataMutations: [],
-      collectionMetadataMutations: [
-        { type: `set`, key: `cursor`, value: `peer` },
-      ],
+function expectRequestLocalFailureObservation(
+  actual: RequestLocalFailureObservation,
+  expectedRows: ReadonlyArray<Todo>,
+): void {
+  expect(actual).toEqual({
+    receiptStatus: `fulfilled`,
+    publicRows: expectedRows,
+    durableRows: expectedRows,
+    status: `ready`,
+    publicError: undefined,
+  })
+}
+
+async function runSourceFifoOrderingLaw(
+  relation: `same-key` | `disjoint`,
+  olderTitle: string,
+  newerTitle: string,
+): Promise<void> {
+  const historyId = ++generatedOwnershipHistoryId
+  const adapter = createRecordingAdapter()
+  const firstPersistenceEntered = createEventGate()
+  const releaseFirstPersistence = createEventGate()
+  const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+  let applyCalls = 0
+  adapter.applyCommittedTx = async (...args) => {
+    applyCalls++
+    if (applyCalls === 1) {
+      firstPersistenceEntered.resolve()
+      await releaseFirstPersistence.promise
     }
-    await adapter.applyCommittedTx({ kind: `eager`, collectionId: id }, peerTx)
-    throw error
-  }
-  coordinator.reconcileCommittedTx = (id, tx, anchor) => {
-    expect(id).toBe(collectionId)
-    expect(tx.txId).toBe(originalTx?.txId)
-    expect(anchor).toEqual({ latestRowVersion: 0, resetEpoch: 0 })
-    return Promise.resolve({
-      type: `rpc:reconcileCommittedTx:res`,
-      rpcId: `exact-after-peer`,
-      ok: true,
-      alreadyApplied: true,
-      committed: { term: 1, seq: 1, rowVersion: 1 },
-    })
+    await applyCommittedTx(...args)
   }
-
+  let sourceParams!: TodoSyncParams
   const collection = createCollection(
     persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      syncMode: `on-demand`,
-      getKey: (item) => item.id,
+      id: `generated-source-fifo-order-${historyId}`,
+      getKey: (row) => row.id,
       sync: {
         sync: (params) => {
-          source = params
-          capability = params.metadata?.persistence
-          syncRuns++
+          sourceParams = params
           params.markReady()
         },
       },
-      persistence: { adapter, coordinator },
+      persistence: { adapter },
     }),
   )
+  const receipts: Array<Promise<void>> = []
+  let hasPrimaryFailure = false
 
   try {
-    collection.startSyncImmediate()
-    await vi.waitFor(() => expect(capability).toBeDefined())
-    source.begin()
-    capability?.resumeSnapshot.expectCurrentCommit()
-    source.write({
+    await atPersistedOracleCheckpoint(
+      collection.stateWhenReady(),
+      `generated source FIFO ordering ready`,
+    )
+    sourceParams.begin()
+    sourceParams.write({
       type: `insert`,
-      value: { id: `shared`, title: `source` },
+      value: { id: `gate`, title: `holds adapter` },
     })
-    source.metadata?.collection.set(`cursor`, `source`)
+    receipts.push(Promise.resolve(sourceParams.commit()).then(() => undefined))
+    receipts.forEach((receipt) => void receipt.catch(() => undefined))
     await atPersistedOracleCheckpoint(
-      Promise.resolve(source.commit()),
-      `exact-ID source receipt after peer write`,
+      firstPersistenceEntered.promise,
+      `generated source FIFO ordering adapter hold`,
     )
 
-    expect(syncRuns).toBe(1)
-    expect(adapter.applyCommittedTxCalls).toHaveLength(2)
-    expect(collection.get(`shared`)?.title).toBe(`source`)
-    expect(adapter.rows.get(`shared`)?.title).toBe(`peer`)
-    expect(adapter.collectionMetadata.get(`cursor`)).toBe(`peer`)
+    const olderKey = relation === `same-key` ? `shared` : `older`
+    const newerKey = relation === `same-key` ? `shared` : `newer`
 
-    await capability?.resumeSnapshot.certify()
-    expect(adapter.loadResumeSnapshotCalls.at(-1)?.includeRows).toBe(false)
-    expect(capability?.resumeSnapshot.getKeySetEvidence()).toEqual({
-      status: `incompatible`,
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: { id: olderKey, title: olderTitle },
     })
-  } finally {
-    await collection.cleanup()
-  }
-})
+    const olderReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(olderReceipt)
+    void olderReceipt.catch(() => undefined)
 
-// A logical subset owner can retire while a managed cache claim is being
-// renewed. The independent ownership law says only a retained demand may
-// establish a physical remote acquisition. Hold renewal after the wrapper's
-// admission check, then either retire or retain the request before releasing
-// the gate. Compare coordinator acquisition work when the load settles; the
-// retained neighbor proves this cut still permits one valid acquisition.
-it.each([false, true])(
-  `starts remote acquisition after claim renewal only when demand remains retained (retire=%s)`,
-  async (retire) => {
-    const adapter = createRecordingAdapter()
-    const renewalEntered = createEventGate()
-    const releaseRenewal = createEventGate()
-    let holdRenewal = false
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `review-claim-storage`,
-      claimId: `review-claim`,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      if (holdRenewal) {
-        renewalEntered.resolve()
-        await releaseRenewal.promise
-      }
-      return Date.now() + 10_000
-    }
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: `review-rotated-storage`,
-      claimId: `review-claim`,
-      expiresAtMs: Date.now() + 10_000,
+    sourceParams.begin()
+    sourceParams.write({
+      type: relation === `same-key` ? `update` : `insert`,
+      value: { id: newerKey, title: newerTitle },
     })
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const coordinator = createFailStopCoordinatorHarness(`review-unload`)
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `review-unload`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            params.markReady()
-            return {
-              loadSubset: async () => {},
-              restartAfterScopedRecovery: () => {},
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
+    const newerReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
     )
-    const options: LoadSubsetOptions = { limit: 1 }
-    try {
-      await collection.stateWhenReady()
-      holdRenewal = true
-      const load = Promise.resolve(collection._sync.loadSubset(options))
+    receipts.push(newerReceipt)
+    void newerReceipt.catch(() => undefined)
+
+    expect(
+      sortedTodoRows(Array.from(collection.values()).map(stripVirtualProps)),
+    ).toEqual(sortedTodoRows([{ id: `gate`, title: `holds adapter` }]))
+
+    releaseFirstPersistence.resolve()
+    for (const [index, receipt] of receipts.entries()) {
       await atPersistedOracleCheckpoint(
-        renewalEntered.promise,
-        `claim renewal entered`,
+        receipt,
+        `generated source FIFO receipt ${index}`,
       )
-      if (retire) collection._sync.unloadSubset(options)
-      releaseRenewal.resolve()
-      await atPersistedOracleCheckpoint(load, `late load settled`)
-      expect(coordinator.remoteEnsureCalls).toHaveLength(retire ? 0 : 1)
-    } finally {
-      releaseRenewal.resolve()
-      await collection.cleanup()
-    }
-  },
-)
-
-// A cache read can lose its claim at the post-read check. The reference
-// ownership law keeps the admitted demand through rotation and gives it one
-// replacement acquisition. Hold that acquisition to compare both its work
-// count and the caller's settlement before and after source completion.
-// The neighboring pre-read loss and peer-notice histories exercise different
-// rotation cuts; this one specifically reaches the post-read renewal cut.
-it(`does not request a rotated in-flight subset twice`, async () => {
-  const adapter = createRecordingAdapter()
-  const coordinator = createFailStopCoordinatorHarness(`review-duplicate`)
-  const ensureStarted = createEventGate()
-  const releaseEnsure = createEventGate()
-  coordinator.requestEnsureRemoteSubset = async (_id, options) => {
-    coordinator.remoteEnsureCalls.push(options)
-    ensureStarted.resolve()
-    await releaseEnsure.promise
-  }
-  let storageId = `review-duplicate-old`
-  let loseClaim = false
-  let loseAfterRead = false
-  const originalLoadSubset = adapter.loadSubset.bind(adapter)
-  adapter.loadSubset = async (...args) => {
-    const rows = await originalLoadSubset(...args)
-    if (loseAfterRead) {
-      loseAfterRead = false
-      loseClaim = true
-    }
-    return rows
-  }
-  adapter.claimCacheGeneration = async () => ({
-    storageCollectionId: storageId,
-    claimId: `review-duplicate-claim`,
-    expiresAtMs: Date.now() + 10_000,
-  })
-  adapter.renewCacheGenerationClaim = async () =>
-    loseClaim ? undefined : Date.now() + 10_000
-  adapter.rotateCacheGeneration = async () => {
-    loseClaim = false
-    storageId = `review-duplicate-new`
-    return {
-      storageCollectionId: storageId,
-      claimId: `review-duplicate-claim`,
-      expiresAtMs: Date.now() + 10_000,
     }
-  }
-  adapter.releaseCacheGenerationClaim = async () => {}
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `review-duplicate`,
-      syncMode: `on-demand`,
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: async () => {},
-            restartAfterScopedRecovery: () => {},
-          }
-        },
+    expectSourceFifoOrderingObservation(
+      {
+        publicRows: sortedTodoRows(
+          Array.from(collection.values()).map(stripVirtualProps),
+        ),
+        durableRows: sortedTodoRows(adapter.rows.values()),
+        status: collection.status,
+        pendingMarkers: collection._state.pendingSyncedTransactions.length,
       },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  try {
-    await collection.stateWhenReady()
-    loseAfterRead = true
-    const load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-    await atPersistedOracleCheckpoint(
-      ensureStarted.promise,
-      `replacement acquisition`,
+      sortedTodoRows(
+        expectedSourceFifoOrderingRows(
+          relation,
+          olderTitle,
+          newerTitle,
+        ).values(),
+      ),
     )
-    await flushAsyncWork()
-    expect(storageId).toBe(`review-duplicate-new`)
-    expect(coordinator.remoteEnsureCalls).toHaveLength(1)
-    let settled = false
-    void load.then(
-      () => {
-        settled = true
-      },
-      () => {
-        settled = true
-      },
-    )
-    await flushAsyncWork()
-    expect(settled).toBe(false)
-    releaseEnsure.resolve()
-    await atPersistedOracleCheckpoint(load, `replacement demand settlement`)
-    expect(coordinator.remoteEnsureCalls).toHaveLength(1)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
   } finally {
-    releaseEnsure.resolve()
-    await collection.cleanup()
+    releaseFirstPersistence.resolve()
+    await cleanupPersistedOracle(
+      [
+        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
+        () => collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
   }
-})
+}
+
+// Source FIFO ordering law: the gate write holds the adapter, then the older
+// and newer source writes commit in submission order. The final rows are the
+// gate plus both writes, and a newer write to the same key replaces the older.
+// The model takes only the relation and titles, not the production write path.
+function expectedSourceFifoOrderingRows(
+  relation: `same-key` | `disjoint`,
+  olderTitle: string,
+  newerTitle: string,
+): Map<string, Todo> {
+  const olderKey = relation === `same-key` ? `shared` : `older`
+  const newerKey = relation === `same-key` ? `shared` : `newer`
+  const expected = new Map<string, Todo>([
+    [`gate`, { id: `gate`, title: `holds adapter` }],
+  ])
+  expected.set(olderKey, { id: olderKey, title: olderTitle })
+  expected.set(newerKey, { id: newerKey, title: newerTitle })
+  return expected
+}
 
-// Reconciliation after a lost answer can arrive even when a peer already
-// published the original tx:committed. A duplicate proof must not turn an
-// unchanged durable snapshot into a second public change batch. This owner
-// checks the persisted wrapper and mounted dependent graph, not SQLite or a
-// browser transport. The notification's explicit flag reaches the equal-seq
-// branch that ordinary tx deduplication would skip. An orphan row-metadata
-// entry is not part of the loaded row snapshot; an unchanged-row shortcut
-// must still remove it, as an ordinary full replacement does. The held subset
-// read exposes the pending cut; the final comparison waits for the public
-// metadata cleanup and checks that neither Collection published a row event.
-it(`does not republish unchanged rows for a repeated reconciliation notice`, async () => {
-  const adapter = createRecordingAdapter([{ id: `crossing`, title: `settled` }])
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-reconciliation-repeat`
-  const reloadEntered = createDeferred()
-  const releaseReload = createDeferred()
-  let source!: TodoSyncParams
+async function runAbortRelationshipLaw(
+  relationship: `independent` | `same-key`,
+  predecessorTitle: string,
+  successorTitle: string,
+): Promise<void> {
+  const historyId = ++generatedOwnershipHistoryId
+  const adapter = createRecordingAdapter()
+  const firstPersistenceEntered = createEventGate()
+  const releaseFirstPersistence = createEventGate()
+  const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+  let applyCalls = 0
+  adapter.applyCommittedTx = async (...args) => {
+    applyCalls++
+    if (applyCalls === 1) {
+      firstPersistenceEntered.resolve()
+      await releaseFirstPersistence.promise
+    }
+    await applyCommittedTx(...args)
+  }
+  let sourceParams!: TodoSyncParams
   const collection = createCollection(
     persistedCollectionOptions<Todo, string>({
-      id: collectionId,
+      id: `generated-abort-graph-${historyId}`,
       getKey: (row) => row.id,
       sync: {
+        rowUpdateMode: `partial`,
         sync: (params) => {
-          source = params
+          sourceParams = params
           params.markReady()
         },
       },
-      persistence: { adapter, coordinator },
+      persistence: { adapter },
     }),
   )
-  const live = createLiveQueryCollection((q) => q.from({ row: collection }))
+  const abortController = new AbortController()
+  const receipts: Array<Promise<void>> = []
   let hasPrimaryFailure = false
+
   try {
-    await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
-    await atPersistedOracleCheckpoint(live.preload(), `live query ready`)
-    source.begin()
-    source.metadata?.row.set(`ghost`, { stale: true })
     await atPersistedOracleCheckpoint(
-      Promise.resolve(source.commit()),
-      `orphan row metadata applied`,
+      collection.stateWhenReady(),
+      `generated abort graph ready`,
+    )
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: { id: `gate`, title: `holds adapter` },
+    })
+    const gateReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(gateReceipt)
+    void gateReceipt.catch(() => undefined)
+    await atPersistedOracleCheckpoint(
+      firstPersistenceEntered.promise,
+      `generated abort graph adapter hold`,
     )
-    expect(source.metadata?.row.get(`ghost`)).toEqual({ stale: true })
-    const sourceEvents: Array<string> = []
-    const liveEvents: Array<string> = []
-    const sourceSubscription = collection.subscribeChanges((changes) => {
-      sourceEvents.push(...changes.map(({ key }) => String(key)))
+
+    const predecessorKey = relationship === `same-key` ? `shared` : `aborted`
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: {
+        id: predecessorKey,
+        title: predecessorTitle,
+        detail: `predecessor-only`,
+      },
     })
-    const liveSubscription = live.subscribeChanges((changes) => {
-      liveEvents.push(...changes.map(({ key }) => String(key)))
+    const predecessorReceipt = Promise.resolve(
+      sourceParams.commit(abortController.signal),
+    ).then(() => undefined)
+    receipts.push(predecessorReceipt)
+    void predecessorReceipt.catch(() => undefined)
+
+    const successorKey = relationship === `same-key` ? `shared` : `survivor`
+    sourceParams.begin()
+    sourceParams.write({
+      type: relationship === `same-key` ? `update` : `insert`,
+      value: { id: successorKey, title: successorTitle },
     })
-    try {
-      const loadSubset = adapter.loadSubset
-      adapter.loadSubset = async (...args) => {
-        reloadEntered.resolve()
-        await releaseReload.promise
-        return loadSubset(...args)
-      }
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `crossing`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-          reconciliationReload: true,
-        },
-        `replacement`,
-        collectionId,
-      )
-      await atPersistedOracleCheckpoint(
-        reloadEntered.promise,
-        `reconciliation reload entered`,
-      )
-      await flushAsyncWork()
-      expect(source.metadata?.row.get(`ghost`)).toEqual({ stale: true })
-      expect({ sourceEvents, liveEvents }).toEqual({
-        sourceEvents: [],
-        liveEvents: [],
-      })
-      releaseReload.resolve()
-      await vi.waitFor(() =>
-        expect(source.metadata?.row.get(`ghost`)).toBeUndefined(),
-      )
-      await flushAsyncWork()
-      expect({
-        sourceEvents,
-        liveEvents,
-        sourceIds: [...collection.keys()].sort(),
-        liveIds: [...live.keys()].sort(),
-        orphanMetadata: source.metadata?.row.get(`ghost`),
+    const successorReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(successorReceipt)
+    void successorReceipt.catch(() => undefined)
+
+    abortController.abort()
+    releaseFirstPersistence.resolve()
+    await atPersistedOracleCheckpoint(gateReceipt, `generated abort gate`)
+    const predecessor = await atPersistedOracleCheckpoint(
+      predecessorReceipt.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      ),
+      `generated predecessor abort`,
+    )
+    const successor = await atPersistedOracleCheckpoint(
+      successorReceipt.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      ),
+      `generated successor settlement`,
+    )
+    const abortError =
+      predecessor.status === `rejected` ? predecessor.reason : undefined
+
+    expectAbortGraphObservation(
+      {
+        predecessorStatus: predecessor.status,
+        predecessorName:
+          abortError instanceof Error ? abortError.name : undefined,
+        successorStatus: successor.status,
+        sameFailure:
+          successor.status === `rejected` && successor.reason === abortError,
         status: collection.status,
-        liveStatus: live.status,
-      }).toEqual({
-        sourceEvents: [],
-        liveEvents: [],
-        sourceIds: [`crossing`],
-        liveIds: [`crossing`],
-        orphanMetadata: undefined,
-        status: `ready`,
-        liveStatus: `ready`,
-      })
-    } finally {
-      liveSubscription.unsubscribe()
-      sourceSubscription.unsubscribe()
-    }
+        publicSuccessor: stripVirtualProps(collection.get(successorKey)),
+        durableSuccessor: adapter.rows.get(successorKey),
+        pendingMarkers: collection._state.pendingSyncedTransactions.length,
+      },
+      relationship,
+      successorKey,
+      successorTitle,
+    )
   } catch (error) {
     hasPrimaryFailure = true
     throw error
   } finally {
-    releaseReload.resolve()
+    releaseFirstPersistence.resolve()
     await cleanupPersistedOracle(
-      [() => live.cleanup(), () => collection.cleanup()],
+      [
+        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
+        () => collection.cleanup(),
+      ],
       hasPrimaryFailure,
     )
   }
-})
+}
 
-// SQLite stores array holes as null and omits enumerable array properties
-// outside the indexed elements. A source Collection can still hold the
-// authored array shape before a reconciliation reload. The durable row below
-// is the independent reference; the public source and live-query rows must
-// publish it at this checkpoint, even when general change-event equality
-// considers the arrays equal. The held subset read keeps the authored shape
-// visible at the pending cut; the settled cut compares both public shapes.
-it.each([`sparse slot`, `extra array property`] as const)(
-  `publishes the durable array shape after a reconciliation reload: %s`,
-  async (shape) => {
-    const authoredValues: Array<string | null> =
-      shape === `sparse slot`
-        ? Array<string | null>(1)
-        : Object.assign([`kept`], { extra: `not durable` })
-    const durableValues: Array<string | null> =
-      shape === `sparse slot` ? [null] : [`kept`]
-    const adapter = createRecordingAdapter([
-      { id: `crossing`, title: `source`, values: authoredValues },
-    ])
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `source-array-shape-${shape}`
-    const reloadEntered = createDeferred()
-    const releaseReload = createDeferred()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        getKey: (row) => row.id,
-        sync: { sync: (params) => params.markReady() },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const live = createLiveQueryCollection((q) => q.from({ row: collection }))
-    let hasPrimaryFailure = false
-    const shapeOf = (values: Array<string | null> | undefined) => ({
-      indexedKeys: values
-        ? Object.keys(values).filter((key) => key === `0`)
-        : [],
-      firstValue: values?.[0],
-      hasExtra: values ? Object.hasOwn(values, `extra`) : false,
-    })
-    try {
-      await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
-      await atPersistedOracleCheckpoint(live.preload(), `live query ready`)
-      const loadSubset = adapter.loadSubset
-      adapter.loadSubset = async (...args) => {
-        reloadEntered.resolve()
-        await releaseReload.promise
-        return loadSubset(...args)
-      }
-      adapter.rows.set(`crossing`, {
-        id: `crossing`,
-        title: `source`,
-        values: durableValues,
-      })
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `crossing`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-          reconciliationReload: true,
-        },
-        `replacement`,
-        collectionId,
-      )
-      await atPersistedOracleCheckpoint(
-        reloadEntered.promise,
-        `durable array reload entered`,
-      )
-      await flushAsyncWork()
-      const expectedShape = shapeOf(durableValues)
-      const authoredShape = shapeOf(authoredValues)
-      expect({
-        source: shapeOf(collection.get(`crossing`)?.values),
-        live: shapeOf(live.get(`crossing`)?.values),
-        durable: shapeOf(adapter.rows.get(`crossing`)?.values),
-      }).toEqual({
-        source: authoredShape,
-        live: authoredShape,
-        durable: expectedShape,
-      })
-      releaseReload.resolve()
-      await vi.waitFor(() =>
-        expect({
-          source: shapeOf(collection.get(`crossing`)?.values),
-          live: shapeOf(live.get(`crossing`)?.values),
-        }).toEqual({ source: expectedShape, live: expectedShape }),
-      )
-      await flushAsyncWork()
-      expect({
-        source: shapeOf(collection.get(`crossing`)?.values),
-        live: shapeOf(live.get(`crossing`)?.values),
-        durable: shapeOf(adapter.rows.get(`crossing`)?.values),
-      }).toEqual({
-        source: expectedShape,
-        live: expectedShape,
-        durable: expectedShape,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseReload.resolve()
-      await cleanupPersistedOracle(
-        [() => live.cleanup(), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
+async function runBareOwnerOperationLaw(
+  operation: `write` | `commit` | `truncate`,
+  queuedTitle: string,
+): Promise<void> {
+  const historyId = ++generatedOwnershipHistoryId
+  const adapter = createRecordingAdapter()
+  const firstPersistenceEntered = createEventGate()
+  const releaseFirstPersistence = createEventGate()
+  const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+  let applyCalls = 0
+  adapter.applyCommittedTx = async (...args) => {
+    applyCalls++
+    if (applyCalls === 1) {
+      firstPersistenceEntered.resolve()
+      await releaseFirstPersistence.promise
     }
-  },
-)
-
-// A reconciliation reload compares the resulting public snapshot, not the raw
-// durable relation. A DbClient seed can be absent from storage or have an older
-// durable value while an ordinary row is unchanged. The independent model
-// overlays that seed on the durable relation, then expects zero new change
-// batches at the settled reload checkpoint. The ordinary row makes a delete-
-// then-reinsert shortcut observable even though final rows would match.
-it.each([`absent`, `older`] as const)(
-  `does not republish an unchanged row beside an %s hydrated seed`,
-  async (seedCache) => {
-    const ordinary = { id: `ordinary`, title: `Durable` }
-    const seed = { id: `seed`, title: `Hydrated` }
-    const olderSeed = { id: seed.id, title: `Older durable` }
-    const adapter = createRecordingAdapter([
-      ordinary,
-      ...(seedCache === `older` ? [olderSeed] : []),
-    ])
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `reconciliation-seed-${seedCache}`
-    let source!: TodoSyncParams
-    const descriptor = collectionOptions(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
+    await applyCommittedTx(...args)
+  }
+  let sourceParams!: TodoSyncParams
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: `generated-owner-isolation-${historyId}`,
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          sourceParams = params
+          params.markReady()
         },
-        persistence: { adapter, coordinator },
-      }),
+      },
+      persistence: { adapter },
+    }),
+  )
+  const receipts: Array<Promise<void>> = []
+  let unexpectedReceipt: Promise<void> | undefined
+  let hasPrimaryFailure = false
+
+  try {
+    await atPersistedOracleCheckpoint(
+      collection.stateWhenReady(),
+      `generated owner isolation ready`,
     )
-    const client = new DbClient()
-    const seedMetadata = { owner: `hydrated` }
-    client.hydrate({
-      collections: [
-        {
-          collectionId,
-          rows: [{ key: seed.id, value: seed, metadata: seedMetadata }],
-        },
-      ],
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: { id: `first`, title: `must survive` },
     })
-    const collection = client.collection(descriptor)
-    const demand = {}
-    let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
-    let hasPrimaryFailure = false
+    const firstReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(firstReceipt)
+    void firstReceipt.catch(() => undefined)
+    await atPersistedOracleCheckpoint(
+      firstPersistenceEntered.promise,
+      `generated owner isolation adapter hold`,
+    )
+
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: { id: `queued`, title: queuedTitle },
+    })
+    const queuedReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(queuedReceipt)
+    void queuedReceipt.catch(() => undefined)
+
+    let observedError: unknown
     try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await collection._sync.loadSubset(demand)
-      const expected = new Map<string, Todo>([
-        [ordinary.id, ordinary],
-        [seed.id, seed],
-      ])
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      expectExactSnapshot(publicRows(), expected)
-      expect(source.metadata?.row.get(seed.id)).toEqual(seedMetadata)
-      const eventKeys: Array<string> = []
-      subscription = collection.subscribeChanges(
-        (changes) => {
-          eventKeys.push(...changes.map(({ key }) => String(key)))
-        },
-        { includeInitialState: false },
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId },
-        { txId: `repeat`, term: 1, seq: 1, rowVersion: 1, mutations: [] },
-      )
-      const reloadSettled = createEventGate()
-      adapter.runInHydrationScope = async (task) => {
-        const result = await task(adapter)
-        reloadSettled.resolve()
-        return result
+      if (operation === `write`) {
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `stray`, title: `must not publish` },
+        })
+      } else if (operation === `truncate`) {
+        sourceParams.truncate()
+      } else {
+        const result = sourceParams.commit()
+        if (result !== true) {
+          unexpectedReceipt = Promise.resolve(result).then(() => undefined)
+          void unexpectedReceipt.catch(() => undefined)
+        }
       }
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `repeat`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-          reconciliationReload: true,
-        },
-        undefined,
-        collectionId,
-      )
-      await atPersistedOracleCheckpoint(
-        reloadSettled.promise,
-        `seed reconciliation reload settled`,
-      )
-      await flushAsyncWork()
-      expectExactSnapshot(publicRows(), expected)
-      expect(source.metadata?.row.get(seed.id)).toEqual(seedMetadata)
-      expect(eventKeys).toEqual([])
     } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      subscription?.unsubscribe()
-      collection._sync.unloadSubset(demand)
-      await cleanupPersistedOracle([() => client.cleanup()], hasPrimaryFailure)
+      observedError = error
     }
-  },
-)
+    expectOwnerIsolationAdmission({
+      exactError:
+        operation === `commit`
+          ? observedError instanceof NoPendingSyncTransactionCommitError
+          : observedError instanceof NoPendingSyncTransactionWriteError,
+      strayVisible: collection.has(`stray`),
+    })
 
-// A real version gap can arrive after a baseline row was published while the
-// coordinator offers no pullSince capability. The independent durable ledger
-// has versions 1, 2, and 3; the passive Collection sees only version 3's notice.
-// The fallback must replace its rows in one public publication. Recording each
-// change callback catches a transient empty snapshot that a final-only
-// assertion would miss.
-it(`publishes a durable gap reload without an empty intermediate snapshot`, async () => {
-  const adapter = createRecordingAdapter()
-  const coordinator = createCoordinatorHarness()
-  coordinator.pullSince = undefined
-  const collectionId = `source-atomic-gap-fallback`
-  const durableWrite = (id: string, term: number, rowVersion: number) =>
-    adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        txId: id,
-        term,
-        seq: 1,
-        rowVersion,
-        mutations: [{ type: `insert`, key: id, value: { id, title: id } }],
-      },
-    )
-  await durableWrite(`old`, 1, 1)
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      getKey: (row) => row.id,
-      sync: { sync: (params) => params.markReady() },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  const exposed: Array<Array<string>> = []
-  let stopPublication = () => {}
-  let hasPrimaryFailure = false
-  try {
-    await atPersistedOracleCheckpoint(collection.preload(), `baseline ready`)
-    expect([...collection.keys()]).toEqual([`old`])
-    const publication = collection.subscribeChanges(
-      () => exposed.push([...collection.keys()].sort()),
-      { includeInitialState: false },
-    )
-    stopPublication = () => publication.unsubscribe()
-    await durableWrite(`missed`, 2, 2)
-    await durableWrite(`received`, 3, 3)
-    coordinator.emit(
-      {
-        type: `tx:committed`,
-        term: 3,
-        seq: 1,
-        txId: `received`,
-        latestRowVersion: 3,
-        requiresFullReload: false,
-        changedRows: [
-          { key: `received`, value: { id: `received`, title: `received` } },
-        ],
-        deletedKeys: [],
-      },
-      `replacement`,
-      collectionId,
-    )
-    await vi.waitFor(() =>
-      expect([...collection.keys()].sort()).toEqual([
-        `missed`,
-        `old`,
-        `received`,
+    releaseFirstPersistence.resolve()
+    await atPersistedOracleCheckpoint(firstReceipt, `generated first owner`)
+    await atPersistedOracleCheckpoint(queuedReceipt, `generated queued owner`)
+    expect({
+      publicRows: sortedTodoRows(
+        Array.from(collection.values()).map(stripVirtualProps),
+      ),
+      durableRows: sortedTodoRows(adapter.rows.values()),
+      pendingMarkers: collection._state.pendingSyncedTransactions.length,
+    }).toEqual({
+      publicRows: sortedTodoRows([
+        { id: `first`, title: `must survive` },
+        { id: `queued`, title: queuedTitle },
       ]),
-    )
-    expect(exposed.length).toBeGreaterThan(0)
-    const complete = [`missed`, `old`, `received`]
-    for (const rows of exposed) {
-      expect([[`old`], complete]).toContainEqual(rows)
-    }
-    expect(exposed.at(-1)).toEqual(complete)
-    expect(coordinator.pullSinceCalls).toBe(0)
+      durableRows: sortedTodoRows([
+        { id: `first`, title: `must survive` },
+        { id: `queued`, title: queuedTitle },
+      ]),
+      pendingMarkers: 0,
+    })
   } catch (error) {
     hasPrimaryFailure = true
     throw error
   } finally {
-    stopPublication()
+    releaseFirstPersistence.resolve()
     await cleanupPersistedOracle(
-      [() => collection.cleanup()],
+      [
+        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
+        () => unexpectedReceipt?.catch(() => undefined),
+        () => collection.cleanup(),
+      ],
       hasPrimaryFailure,
     )
   }
-})
+}
 
-// Row versions cross election terms even when an owner commits no rows.
-// The authored durable ledger has a missed term-1 row, an empty term-2
-// election, and a term-3 row. The passive Collection only receives the final
-// notification. Its public snapshot must contain both durable rows after that
-// notification settles; applying only the term-3 delta is a false green if the
-// oracle checks only the latest key. This controlled adapter supplies durable
-// writes and the coordinator supplies the lost-notice schedule.
-it(`recovers a missed commit across a no-write election`, async () => {
-  const adapter = createRecordingAdapter()
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-empty-election-gap`
+async function runInternalOpenTransactionBoundaryLaw(
+  boundary: `abort` | `cleanup` | `terminal-failure`,
+  hydratedTitle: string,
+): Promise<void> {
+  const historyId = ++generatedOwnershipHistoryId
+  const hydrated = { id: `hydrated`, title: hydratedTitle }
+  const adapter = createRecordingAdapter([hydrated])
+  const hydrationEntered = createEventGate()
+  const releaseHydration = createEventGate()
+  overrideBaselineRows(adapter, async () => {
+    hydrationEntered.resolve()
+    await releaseHydration.promise
+    return [{ key: hydrated.id, value: hydrated }]
+  })
+  let sourceParams!: TodoSyncParams
   const collection = createCollection(
     persistedCollectionOptions<Todo, string>({
-      id: collectionId,
+      id: `generated-internal-transaction-${historyId}`,
       getKey: (row) => row.id,
-      sync: { sync: (params) => params.markReady() },
-      persistence: { adapter, coordinator },
+      sync: {
+        sync: (params) => {
+          sourceParams = params
+          params.markReady()
+        },
+      },
+      persistence: { adapter },
     }),
   )
+  let internalReservationStarted = false
+  const subscription = collection.subscribeChanges((changes) => {
+    if (
+      !internalReservationStarted &&
+      changes.some((change) => change.key === hydrated.id)
+    ) {
+      internalReservationStarted = true
+      sourceParams.begin()
+    }
+  })
+  const receipts: Array<Promise<void>> = []
+  let cleanedUp = false
   let hasPrimaryFailure = false
+
   try {
-    await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
-    const durableWrite = async (
-      txId: string,
-      term: number,
-      rowVersion: number,
-    ) => {
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
+    const ready = collection.stateWhenReady()
+    await atPersistedOracleCheckpoint(
+      hydrationEntered.promise,
+      `generated internal hydration entered`,
+    )
+    releaseHydration.resolve()
+    await atPersistedOracleCheckpoint(ready, `generated internal ready`)
+    expect({
+      internalReservationStarted,
+      pendingMarkers: collection._state.pendingSyncedTransactions.length,
+    }).toEqual({ internalReservationStarted: true, pendingMarkers: 0 })
+
+    if (boundary === `cleanup`) {
+      await atPersistedOracleCheckpoint(
+        collection.cleanup(),
+        `generated internal cleanup`,
+      )
+      cleanedUp = true
+      expectOpenTransactionBoundaryObservation(
         {
-          txId,
-          term,
-          seq: 1,
-          rowVersion,
-          mutations: [
-            { type: `insert`, key: txId, value: { id: txId, title: txId } },
-          ],
+          status: collection.status,
+          pendingMarkers: collection._state.pendingSyncedTransactions.length,
+        },
+        boundary,
+      )
+      return
+    }
+
+    if (boundary === `abort`) {
+      const abortController = new AbortController()
+      abortController.abort()
+      const receipt = Promise.resolve(
+        sourceParams.commit(abortController.signal),
+      ).then(() => undefined)
+      receipts.push(receipt)
+      void receipt.catch(() => undefined)
+      await expect(
+        atPersistedOracleCheckpoint(receipt, `generated internal abort`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      expectOpenTransactionBoundaryObservation(
+        {
+          status: collection.status,
+          pendingMarkers: collection._state.pendingSyncedTransactions.length,
         },
+        boundary,
       )
+      return
     }
-    await durableWrite(`missed`, 1, 1)
-    // The controlled ledger jumps over term 2 without simulating its election.
-    // The real SQLite/OPFS owner checks durable no-write term reservation.
-    await durableWrite(`received`, 3, 2)
-    expect([...collection.keys()]).toEqual([])
-    coordinator.emit(
+
+    const terminalError = new Error(`generated terminal transaction failure`)
+    adapter.applyCommittedTx = () => Promise.reject(terminalError)
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: { id: `terminal`, title: `published before failure` },
+    })
+    const externalReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(externalReceipt)
+    void externalReceipt.catch(() => undefined)
+    await expect(
+      atPersistedOracleCheckpoint(
+        externalReceipt,
+        `generated external terminal failure`,
+      ),
+    ).rejects.toMatchObject({
+      name: `PersistedCollectionDurabilityError`,
+      cause: terminalError,
+    })
+
+    const internalReceipt = Promise.resolve(sourceParams.commit()).then(
+      () => undefined,
+    )
+    receipts.push(internalReceipt)
+    void internalReceipt.catch(() => undefined)
+    await expect(
+      atPersistedOracleCheckpoint(
+        internalReceipt,
+        `generated terminal internal settlement`,
+      ),
+    ).rejects.toMatchObject({ name: `PersistedCollectionDurabilityError` })
+    expectOpenTransactionBoundaryObservation(
       {
-        type: `tx:committed`,
-        term: 3,
-        seq: 1,
-        txId: `received`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [
-          { key: `received`, value: { id: `received`, title: `received` } },
-        ],
-        deletedKeys: [],
+        status: collection.status,
+        pendingMarkers: collection._state.pendingSyncedTransactions.length,
       },
-      `replacement`,
-      collectionId,
-    )
-    await vi.waitFor(() =>
-      expect([...collection.keys()].sort()).toEqual([`missed`, `received`]),
+      boundary,
     )
-    expect(coordinator.pullSinceCalls).toBe(1)
-    expect([...adapter.rows.keys()].sort()).toEqual([`missed`, `received`])
   } catch (error) {
     hasPrimaryFailure = true
     throw error
   } finally {
+    releaseHydration.resolve()
+    subscription.unsubscribe()
     await cleanupPersistedOracle(
-      [() => collection.cleanup()],
+      [
+        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
+        () => (cleanedUp ? undefined : collection.cleanup()),
+      ],
       hasPrimaryFailure,
     )
   }
-})
+}
 
-// Metadata-only certification can observe a durable stream position without
-// loading its rows. That evidence must not make a later same-position notice
-// look publicly applied. The authored log again has two durable rows; the
-// Collection is empty at the certification cut, then receives the term-3
-// notice and must recover both rows at the settled public checkpoint.
-it(`recovers missed rows after position-only resume certification`, async () => {
-  const adapter = createRecordingAdapter()
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-position-only-certification-gap`
-  let persistenceCapability:
-    NonNullable<SyncMetadataApi<string>[`persistence`]> | undefined
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      syncMode: `on-demand`,
+type RequestLocalFailureOperation = `partial-update` | `delete` | `insert`
+
+async function runRequestLocalFailureOperationLaw(
+  operation: RequestLocalFailureOperation,
+  baselineTitle: string,
+  sourceTitle: string,
+): Promise<void> {
+  const historyId = ++generatedOwnershipHistoryId
+  const baseline: Todo = {
+    id: `shared`,
+    title: baselineTitle,
+    detail: `required baseline detail`,
+  }
+  const inserted: Todo = {
+    id: baseline.id,
+    title: sourceTitle,
+    detail: `complete insert detail`,
+  }
+  const adapter = createRecordingAdapter(
+    operation === `insert` ? [] : [baseline],
+  )
+  const loadPersistedRows = adapter.loadSubset.bind(adapter)
+  const loadEntered = createEventGate()
+  const rejectLoad = createEventGate()
+  const loadFailure = new Error(
+    `generated request-local ${operation} load failure`,
+  )
+  let loadCalls = 0
+  adapter.loadSubset = async (...args) => {
+    loadCalls++
+    if (loadCalls === 1) {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw loadFailure
+    }
+    return loadPersistedRows(...args)
+  }
+  let sourceParams!: TodoSyncParams
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: `generated-request-local-failure-${historyId}`,
       getKey: (row) => row.id,
+      syncMode: `on-demand`,
       sync: {
-        sync: ({ markReady, metadata }) => {
-          persistenceCapability = metadata?.persistence ?? undefined
-          markReady()
+        rowUpdateMode: `partial`,
+        sync: (params) => {
+          sourceParams = params
+          params.markReady()
           return { loadSubset: () => true }
         },
       },
-      persistence: { adapter, coordinator },
+      persistence: { adapter },
     }),
   )
+  const expectedRows =
+    operation === `delete`
+      ? []
+      : operation === `insert`
+        ? [inserted]
+        : [{ ...baseline, title: sourceTitle }]
+  let load: Promise<void> | undefined
+  let receipt: Promise<void> | undefined
   let hasPrimaryFailure = false
-  try {
-    collection.startSyncImmediate()
-    await vi.waitFor(() => expect(persistenceCapability).toBeDefined())
-    await atPersistedOracleCheckpoint(
-      Promise.resolve(collection._sync.loadSubset({})).then(() => undefined),
-      `empty subset loaded before position certification`,
-    )
-    const durableWrite = async (
-      txId: string,
-      term: number,
-      rowVersion: number,
-    ) =>
-      adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId,
-          term,
-          seq: 1,
-          rowVersion,
-          mutations: [
-            { type: `insert`, key: txId, value: { id: txId, title: txId } },
-          ],
-        },
-      )
-    await durableWrite(`missed`, 1, 1)
-    await durableWrite(`received`, 3, 2)
-    await atPersistedOracleCheckpoint(
-      persistenceCapability!.resumeSnapshot.certify(),
-      `position-only certification`,
-    )
-    expect([...collection.keys()]).toEqual([])
-    coordinator.emit(
-      {
-        type: `tx:committed`,
-        term: 3,
-        seq: 1,
-        txId: `received`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [
-          { key: `received`, value: { id: `received`, title: `received` } },
-        ],
-        deletedKeys: [],
-      },
-      `replacement`,
-      collectionId,
-    )
-    await vi.waitFor(() =>
-      expect([...collection.keys()].sort()).toEqual([`missed`, `received`]),
-    )
-    expect(coordinator.pullSinceCalls).toBe(1)
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    await cleanupPersistedOracle(
-      [() => collection.cleanup()],
-      hasPrimaryFailure,
-    )
-  }
-})
 
-// A schema reset starts a new row-version series. The independent ledger is
-// five published rows, a durable reset to an empty table at version 0, then a
-// new leader's first version-1 row. The controlled snapshot supplies the
-// reset epoch and position while the real wrapper handles the notification.
-// At the settled cut, the public Collection must contain only the new row.
-it(`accepts a lower row version after a collection reset`, async () => {
-  const initial = Array.from({ length: 5 }, (_, index) => ({
-    id: `old-${index + 1}`,
-    title: `old`,
-  }))
-  const adapter = createRecordingAdapter(initial)
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-reset-version-rebase`
-  let position = { term: 1, seq: 5, rowVersion: 5, resetEpoch: 0 }
-  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-  adapter.loadResumeSnapshot = async (...args) => ({
-    ...(await loadResumeSnapshot(...args)),
-    latestTerm: position.term,
-    latestSeq: position.seq,
-    latestRowVersion: position.rowVersion,
-    resetEpoch: position.resetEpoch,
-  })
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      getKey: (row) => row.id,
-      sync: { sync: (params) => params.markReady() },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  let hasPrimaryFailure = false
   try {
     await atPersistedOracleCheckpoint(
-      collection.preload(),
-      `reset source ready`,
+      collection.stateWhenReady(),
+      `generated request-local collection ready`,
     )
-    expect([...collection.keys()].sort()).toEqual(initial.map((row) => row.id))
-
-    const resetSettled = createEventGate()
-    adapter.runInHydrationScope = async (task) => {
-      const result = await task(adapter)
-      resetSettled.resolve()
-      return result
-    }
-
-    adapter.rows.clear()
-    position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
-    coordinator.emit(
-      { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
-      `replacement`,
-      collectionId,
+    load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+      () => undefined,
     )
+    void load.catch(() => undefined)
     await atPersistedOracleCheckpoint(
-      resetSettled.promise,
-      `reset reload and position read settled`,
+      loadEntered.promise,
+      `generated request-local load entered`,
     )
-    expect([...collection.keys()]).toEqual([])
 
-    const newRow = { id: `new`, title: `after reset` }
-    adapter.rows.set(newRow.id, newRow)
-    position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
-    coordinator.emit(
-      {
-        type: `tx:committed`,
-        term: 2,
-        seq: 1,
-        txId: `post-reset`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [{ key: newRow.id, value: newRow }],
-        deletedKeys: [],
-      },
-      `replacement`,
-      collectionId,
-    )
-    await vi.waitFor(() => expect([...collection.keys()]).toEqual([`new`]))
-    expect(collection.get(`new`)).toMatchObject(newRow)
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    await cleanupPersistedOracle(
-      [() => collection.cleanup()],
-      hasPrimaryFailure,
+    sourceParams.begin()
+    sourceParams.write(
+      operation === `delete`
+        ? { type: `delete`, key: baseline.id }
+        : operation === `insert`
+          ? { type: `insert`, value: inserted }
+          : {
+              type: `update`,
+              value: { id: baseline.id, title: sourceTitle } as Todo,
+            },
     )
-  }
-})
+    receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+    const receiptState = observeSettlement(receipt)
+    expect(receiptState.read()).toEqual({ status: `pending` })
 
-// The reset envelope has an epoch, but tx:committed does not. This controlled
-// ledger keeps the same term after reset, then delivers a current notice, an
-// old-epoch notice, and another current notice. Their terms alone cannot
-// authorize row deltas. At each settled cut, the public Collection must equal
-// durable rows and never expose the old-epoch row. The load counter records
-// the conservative cost of checking each ambiguous notice against storage.
-it(`checks same-term post-reset notices against durable rows`, async () => {
-  const adapter = createRecordingAdapter([{ id: `old`, title: `old epoch` }])
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-reset-same-term`
-  let position = { term: 1, seq: 1, rowVersion: 1, resetEpoch: 0 }
-  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-  adapter.loadResumeSnapshot = async (...args) => ({
-    ...(await loadResumeSnapshot(...args)),
-    latestTerm: position.term,
-    latestSeq: position.seq,
-    latestRowVersion: position.rowVersion,
-    resetEpoch: position.resetEpoch,
-  })
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      getKey: (row) => row.id,
-      sync: { sync: (params) => params.markReady() },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  let hasPrimaryFailure = false
-  try {
-    await atPersistedOracleCheckpoint(collection.preload(), `baseline ready`)
-    expect([...collection.keys()]).toEqual([`old`])
-    adapter.rows.clear()
-    position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
-    coordinator.emit(
-      { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
-      `replacement`,
-      collectionId,
+    rejectLoad.resolve()
+    await expect(
+      atPersistedOracleCheckpoint(load, `generated request-local rejection`),
+    ).rejects.toBe(loadFailure)
+    await atPersistedOracleCheckpoint(
+      receipt,
+      `generated request-local receipt settlement`,
     )
-    await vi.waitFor(() => expect([...collection.keys()]).toEqual([]))
-    const loadsAfterReset = adapter.loadSubsetCalls.length
-
-    const first = { id: `first`, title: `new epoch` }
-    adapter.rows.set(first.id, first)
-    position = { term: 1, seq: 1, rowVersion: 1, resetEpoch: 1 }
-    coordinator.emit(
+    expectRequestLocalFailureObservation(
       {
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `new-first`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [{ key: first.id, value: first }],
-        deletedKeys: [],
+        receiptStatus: receiptState.read().status,
+        publicRows: sortedTodoRows(
+          [...collection.values()].map(stripVirtualProps),
+        ),
+        durableRows: sortedTodoRows(adapter.rows.values()),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
       },
-      `replacement`,
-      collectionId,
+      expectedRows,
     )
-    await vi.waitFor(() => expect([...collection.keys()]).toEqual([`first`]))
 
-    const stale = { id: `stale`, title: `old epoch` }
-    coordinator.emit(
-      {
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `old-delayed`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [{ key: stale.id, value: stale }],
-        deletedKeys: [],
-      },
-      `replacement`,
-      collectionId,
-    )
-    await flushAsyncWork()
-    expect([...collection.keys()]).toEqual([`first`])
-    await vi.waitFor(() =>
-      expect(adapter.loadSubsetCalls).toHaveLength(loadsAfterReset + 2),
+    await atPersistedOracleCheckpoint(
+      Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
+      `generated request-local retry`,
     )
-
-    const second = { id: `second`, title: `new epoch` }
-    adapter.rows.set(second.id, second)
-    position = { term: 1, seq: 2, rowVersion: 2, resetEpoch: 1 }
-    coordinator.emit(
+    expectRequestLocalFailureObservation(
       {
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `new-second`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [{ key: second.id, value: second }],
-        deletedKeys: [],
+        receiptStatus: receiptState.read().status,
+        publicRows: sortedTodoRows(
+          [...collection.values()].map(stripVirtualProps),
+        ),
+        durableRows: sortedTodoRows(adapter.rows.values()),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
       },
-      `replacement`,
-      collectionId,
-    )
-    await vi.waitFor(() =>
-      expect([...collection.keys()].sort()).toEqual([`first`, `second`]),
+      expectedRows,
     )
-    expect(adapter.loadSubsetCalls).toHaveLength(loadsAfterReset + 3)
   } catch (error) {
     hasPrimaryFailure = true
     throw error
   } finally {
+    rejectLoad.resolve()
     await cleanupPersistedOracle(
-      [() => collection.cleanup()],
+      [
+        () => load?.catch(() => undefined),
+        () => receipt?.catch(() => undefined),
+        () => collection.cleanup(),
+      ],
       hasPrimaryFailure,
     )
   }
-})
+}
 
-// A delayed pre-reset notification can have the same row version as a new
-// post-reset transaction. Term and sequence alone cannot certify its reset
-// epoch. Reread the durable snapshot for an old term even after a newer term
-// has appeared. Both notice orders must leave only post-reset rows public.
-it.each([`stale-first`, `fresh-first`] as const)(
-  `does not republish a delayed pre-reset row after collection reset / %s`,
-  async (order) => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `source-reset-stale-notice`
-    let position = { term: 0, seq: 0, rowVersion: 0, resetEpoch: 0 }
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => ({
-      ...(await loadResumeSnapshot(...args)),
-      latestTerm: position.term,
-      latestSeq: position.seq,
-      latestRowVersion: position.rowVersion,
-      resetEpoch: position.resetEpoch,
-    })
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        getKey: (row) => row.id,
-        sync: { sync: (params) => params.markReady() },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let hasPrimaryFailure = false
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.preload(),
-        `stale source ready`,
-      )
-      const resetSettled = createEventGate()
-      const staleReloadSettled = createEventGate()
-      let scopeCount = 0
-      adapter.runInHydrationScope = async (task) => {
-        const result = await task(adapter)
-        scopeCount++
-        if (scopeCount === 1) resetSettled.resolve()
-        if (scopeCount === 2) staleReloadSettled.resolve()
-        return result
-      }
-      const stale = { id: `stale`, title: `before reset` }
-      adapter.rows.set(stale.id, stale)
-      position = { term: 1, seq: 2, rowVersion: 2, resetEpoch: 0 }
-      // The original notification is lost; only the durable ledger saw it.
-      adapter.rows.clear()
-      position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
-      coordinator.emit(
-        { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
-        `replacement`,
-        collectionId,
-      )
-      await atPersistedOracleCheckpoint(resetSettled.promise, `reset settled`)
-      expect([...collection.keys()]).toEqual([])
+type GeneratedPersistenceHistory = {
+  axes: Array<string>
+  titles: Array<string>
+}
 
-      const fresh = { id: `fresh`, title: `after reset` }
-      const emitStale = () =>
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 2,
-            txId: `pre-reset`,
-            latestRowVersion: 2,
-            requiresFullReload: false,
-            changedRows: [{ key: stale.id, value: stale }],
-            deletedKeys: [],
-          },
-          `replacement`,
-          collectionId,
-        )
-      const emitFresh = () =>
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 2,
-            seq: 1,
-            txId: `post-reset`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows: [{ key: fresh.id, value: fresh }],
-            deletedKeys: [],
-          },
-          `replacement`,
-          collectionId,
-        )
-      if (order === `fresh-first`) {
-        adapter.rows.set(fresh.id, fresh)
-        position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
-        emitFresh()
-        await vi.waitFor(() =>
-          expect(collection.get(`fresh`)).toMatchObject(fresh),
-        )
-        emitStale()
-      } else {
-        emitStale()
-      }
-      await atPersistedOracleCheckpoint(
-        staleReloadSettled.promise,
-        `old-term reload settled`,
-      )
-      await flushAsyncWork()
-      if (order === `stale-first`) {
-        adapter.rows.set(fresh.id, fresh)
-        position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
-        emitFresh()
-        await vi.waitFor(() =>
-          expect(collection.get(`fresh`)).toMatchObject(fresh),
-        )
-      }
-      expect([...collection.keys()]).toEqual([`fresh`])
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
+type GeneratedPersistenceGrammar = {
+  property: string
+  axes: ReadonlyArray<string>
+  axisContribution: Readonly<Record<string, string>>
+  titleCount: number
+  witness: GeneratedPersistenceHistory
+}
 
-// A metadata-only read after a reset reload cannot certify rows that were
-// committed between the two reads. The controlled adapter holds that exact
-// boundary: the public snapshot is empty, then a new term commits row 1 before
-// the position-only read returns. When row 2 is announced, recovery must load
-// both rows rather than treating the observed position as public coverage.
-it(`recovers a row committed between reset reload and position observation`, async () => {
-  const adapter = createRecordingAdapter()
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-reset-position-race`
-  let position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 0 }
-  let holdResetPositionRead = false
-  const positionReadEntered = createEventGate()
-  const releasePositionRead = createEventGate()
-  const resetSettled = createEventGate()
-  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-  adapter.loadResumeSnapshot = async (...args) => {
-    if (holdResetPositionRead && args[1]?.includeRows === false) {
-      holdResetPositionRead = false
-      positionReadEntered.resolve()
-      await releasePositionRead.promise
-    }
-    return {
-      ...(await loadResumeSnapshot(...args)),
-      latestTerm: position.term,
-      latestSeq: position.seq,
-      latestRowVersion: position.rowVersion,
-      resetEpoch: position.resetEpoch,
-    }
-  }
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      getKey: (row) => row.id,
-      sync: { sync: (params) => params.markReady() },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  let hasPrimaryFailure = false
-  try {
-    await atPersistedOracleCheckpoint(collection.preload(), `race source ready`)
-    adapter.runInHydrationScope = async (task) => {
-      const result = await task(adapter)
-      resetSettled.resolve()
-      return result
-    }
-    position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
-    holdResetPositionRead = true
-    coordinator.emit(
-      { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
-      `replacement`,
-      collectionId,
-    )
-    await atPersistedOracleCheckpoint(
-      positionReadEntered.promise,
-      `position read held after empty reload`,
-    )
-    expect([...collection.keys()]).toEqual([])
-
-    const missed = { id: `missed`, title: `committed during reset` }
-    adapter.rows.set(missed.id, missed)
-    position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
-    releasePositionRead.resolve()
-    await atPersistedOracleCheckpoint(resetSettled.promise, `reset settled`)
-    expect([...collection.keys()]).toEqual([])
+const sourceFifoOrderingAxes = [`same-key`, `disjoint`] as const
+const abortGraphAxes = [`independent`, `same-key`] as const
+const ownerIsolationAxes = [`write`, `commit`, `truncate`] as const
+const openTransactionBoundaryAxes = [
+  `abort`,
+  `cleanup`,
+  `terminal-failure`,
+] as const
+const requestLocalFailureAxes = [`partial-update`, `delete`, `insert`] as const
+const generatedTitleMaxLength = 12
+const generatedPersistenceFixedSeeds = {
+  sourceFifoOrdering: 18_530_101,
+  abortGraph: 18_530_102,
+  ownerIsolation: 18_530_103,
+  openTransactionBoundary: 18_530_104,
+  requestLocalFailure: 18_530_105,
+} as const
 
-    const received = { id: `received`, title: `later commit` }
-    adapter.rows.set(received.id, received)
-    position = { term: 3, seq: 1, rowVersion: 2, resetEpoch: 1 }
-    coordinator.emit(
-      {
-        type: `tx:committed`,
-        term: 3,
-        seq: 1,
-        txId: `received`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [{ key: received.id, value: received }],
-        deletedKeys: [],
+const generatedPersistenceGrammars: ReadonlyArray<GeneratedPersistenceGrammar> =
+  [
+    {
+      property: `sqlite-persistence.source-fifo-order`,
+      axes: sourceFifoOrderingAxes,
+      axisContribution: {
+        [`same-key`]: `the later source value wins in source order`,
+        disjoint: `both unrelated values and receipts survive`,
       },
-      `replacement`,
-      collectionId,
-    )
-    await vi.waitFor(() =>
-      expect([...collection.keys()].sort()).toEqual([`missed`, `received`]),
-    )
-    expect(coordinator.pullSinceCalls).toBe(1)
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releasePositionRead.resolve()
-    await cleanupPersistedOracle(
-      [() => collection.cleanup()],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-// SQLite encodes a nested class value as a plain durable record. The
-// independent reference is the durable row's prototype category: after a
-// reconciliation reload settles, the public source row must have that shape.
-// An equal keyed class is a distinguishing wrong answer because ordinary
-// change-event equality accepts it as equal to a plain record. The held read
-// exposes the authored intermediate cut; this controlled adapter does not
-// itself establish the real SQLite serialization premise.
-it(`replaces an equal nested class with its durable plain record`, async () => {
-  class DetailBox {
-    constructor(public rank: number) {}
-  }
-  const adapter = createRecordingAdapter()
-  const coordinator = createCoordinatorHarness()
-  const collectionId = `source-nested-prototype-reload`
-  const reloadEntered = createDeferred()
-  const releaseReload = createDeferred()
-  let source!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: collectionId,
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          source = params
-          params.markReady()
-        },
+      titleCount: 2,
+      witness: {
+        axes: [`same-key`, `disjoint`],
+        titles: [`older`, `newer`],
       },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  const live = createLiveQueryCollection((q) => q.from({ row: collection }))
-  let hasPrimaryFailure = false
-  try {
-    await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
-    await atPersistedOracleCheckpoint(live.preload(), `live query ready`)
-    source.begin()
-    source.write({
-      type: `insert`,
-      value: { id: `crossing`, title: `source`, payload: new DetailBox(7) },
-    })
-    await atPersistedOracleCheckpoint(
-      Promise.resolve(source.commit()),
-      `authored source receipt`,
-    )
-    expect(collection.get(`crossing`)?.payload).toBeInstanceOf(DetailBox)
-    await vi.waitFor(() =>
-      expect(live.get(`crossing`)?.payload).toBeInstanceOf(DetailBox),
-    )
-    const loadSubset = adapter.loadSubset
-    adapter.loadSubset = async (...args) => {
-      reloadEntered.resolve()
-      await releaseReload.promise
-      return loadSubset(...args)
-    }
-    adapter.rows.set(`crossing`, {
-      id: `crossing`,
-      title: `source`,
-      payload: { rank: 7 },
-    })
-    coordinator.emit(
-      {
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `crossing`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-        reconciliationReload: true,
+    },
+    {
+      property: `sqlite-persistence.abort-graph`,
+      axes: abortGraphAxes,
+      axisContribution: {
+        independent: `an unrelated sibling survives the abort`,
+        [`same-key`]: `a dependent suffix shares the predecessor failure`,
       },
-      `replacement`,
-      collectionId,
-    )
-    await atPersistedOracleCheckpoint(
-      reloadEntered.promise,
-      `nested shape reload entered`,
+      titleCount: 2,
+      witness: {
+        axes: [`independent`, `same-key`],
+        titles: [`predecessor`, `successor`],
+      },
+    },
+    {
+      property: `sqlite-persistence.owner-isolation`,
+      axes: ownerIsolationAxes,
+      axisContribution: {
+        write: `bare write rejects without publishing a stray row`,
+        commit: `bare commit rejects without settling another owner`,
+        truncate: `bare truncate rejects without clearing another owner`,
+      },
+      titleCount: 1,
+      witness: {
+        axes: [`write`, `commit`, `truncate`],
+        titles: [`queued`],
+      },
+    },
+    {
+      property: `sqlite-persistence.open-transaction-boundary`,
+      axes: openTransactionBoundaryAxes,
+      axisContribution: {
+        abort: `explicit abort leaves no core transaction`,
+        cleanup: `cleanup leaves no core transaction`,
+        [`terminal-failure`]: `fail-stop leaves no core transaction`,
+      },
+      titleCount: 1,
+      witness: {
+        axes: [`abort`, `cleanup`, `terminal-failure`],
+        titles: [`hydrated`],
+      },
+    },
+    {
+      property: `sqlite-persistence.request-local-failure-buffered-source`,
+      axes: requestLocalFailureAxes,
+      axisContribution: {
+        [`partial-update`]: `an unseen persisted baseline is reconstructed`,
+        delete: `a buffered delete settles without resurrection`,
+        insert: `a complete buffered insert settles without duplication`,
+      },
+      titleCount: 2,
+      witness: {
+        axes: [`partial-update`, `delete`, `insert`],
+        titles: [`baseline`, `source`],
+      },
+    },
+  ]
+
+function reconstructGeneratedPersistenceHistory(
+  grammar: GeneratedPersistenceGrammar,
+  history: GeneratedPersistenceHistory,
+): GeneratedPersistenceHistory {
+  const requiredAxes = new Set(grammar.axes)
+  const axesAreExact =
+    history.axes.length === grammar.axes.length &&
+    new Set(history.axes).size === grammar.axes.length &&
+    history.axes.every((axis) => requiredAxes.has(axis))
+  const titlesAreInRange =
+    history.titles.length === grammar.titleCount &&
+    history.titles.every(
+      (title) => [...title].length <= generatedTitleMaxLength,
     )
-    expect(collection.get(`crossing`)?.payload).toBeInstanceOf(DetailBox)
-    expect(live.get(`crossing`)?.payload).toBeInstanceOf(DetailBox)
-    releaseReload.resolve()
-    await vi.waitFor(() => {
-      expect(Object.getPrototypeOf(collection.get(`crossing`)?.payload)).toBe(
-        Object.prototype,
-      )
-      expect(Object.getPrototypeOf(live.get(`crossing`)?.payload)).toBe(
-        Object.prototype,
-      )
-    })
-    expect(collection.get(`crossing`)?.payload).toEqual({ rank: 7 })
-    expect(live.get(`crossing`)?.payload).toEqual({ rank: 7 })
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseReload.resolve()
-    await cleanupPersistedOracle(
-      [() => live.cleanup(), () => collection.cleanup()],
-      hasPrimaryFailure,
+  if (!axesAreExact || !titlesAreInRange) {
+    throw new Error(
+      `invalid generated persistence history: ${grammar.property}`,
     )
   }
+  return {
+    axes: [...history.axes],
+    titles: [...history.titles],
+  }
+}
+
+function fullAxisOrder<Axis extends string>(
+  axes: ReadonlyArray<Axis>,
+): fc.Arbitrary<Array<Axis>> {
+  return fc.shuffledSubarray([...axes], {
+    minLength: axes.length,
+    maxLength: axes.length,
+  })
+}
+
+const generatedTitle = fc.string({ maxLength: generatedTitleMaxLength })
+
+type SourceFifoOrderingHistory = {
+  relations: Array<`same-key` | `disjoint`>
+  titles: [string, string]
+}
+
+type AbortGraphHistory = {
+  relationships: Array<`independent` | `same-key`>
+  titles: [string, string]
+}
+
+type OwnerIsolationHistory = {
+  operations: Array<`write` | `commit` | `truncate`>
+  queuedTitle: string
+}
+
+type OpenTransactionBoundaryHistory = {
+  boundaries: Array<`abort` | `cleanup` | `terminal-failure`>
+  hydratedTitle: string
+}
+
+type RequestLocalFailureHistory = {
+  operations: Array<RequestLocalFailureOperation>
+  titles: [string, string]
+}
+
+const sourceFifoOrderingHistory: fc.Arbitrary<SourceFifoOrderingHistory> =
+  fc.record({
+    relations: fullAxisOrder(sourceFifoOrderingAxes),
+    titles: fc.tuple(generatedTitle, generatedTitle),
+  })
+
+const abortGraphHistory: fc.Arbitrary<AbortGraphHistory> = fc.record({
+  relationships: fullAxisOrder(abortGraphAxes),
+  titles: fc.tuple(generatedTitle, generatedTitle),
 })
 
-// A source commit accepted while persisted restore is reading waits behind the
-// hydration baseline. Its queued applied receipt remains one obligation when
-// the coordinator answer is lost. The independent authored ledger is baseline
-// → crossing → later; no second source sync run or queue re-admission exists in
-// that model. The controlled adapter holds the baseline and then the exact-ID
-// decision so both pending checkpoints are observable.
-it(`reconciles a source receipt queued behind persisted hydration`, async () => {
-  const adapter = createRecordingAdapter([{ id: `shared`, title: `baseline` }])
-  const hydrationEntered = createEventGate()
-  const releaseHydration = createEventGate()
-  overrideBaselineRows(adapter, async () => {
-    hydrationEntered.resolve()
-    await releaseHydration.promise
-    return [
-      {
-        key: `shared`,
-        value: { id: `shared`, title: `baseline` },
-      },
-    ]
+const ownerIsolationHistory: fc.Arbitrary<OwnerIsolationHistory> = fc.record({
+  operations: fullAxisOrder(ownerIsolationAxes),
+  queuedTitle: generatedTitle,
+})
+
+const openTransactionBoundaryHistory: fc.Arbitrary<OpenTransactionBoundaryHistory> =
+  fc.record({
+    boundaries: fullAxisOrder(openTransactionBoundaryAxes),
+    hydratedTitle: generatedTitle,
   })
-  const coordinator = createCoordinatorHarness()
-  const reconcileEntered = createEventGate()
-  const releaseReconcile = createEventGate()
-  const uncertain = new IndeterminateCommitError({
-    collectionId: `queued-reconciliation`,
-    requestType: `rpc:applyCommittedTx:req`,
-    previousLeaderId: `retired`,
-    previousTerm: 1,
-    currentLeaderId: `replacement`,
-    currentTerm: 2,
-    cause: new Error(`lost answer`),
+
+const requestLocalFailureHistory: fc.Arbitrary<RequestLocalFailureHistory> =
+  fc.record({
+    operations: fullAxisOrder(requestLocalFailureAxes),
+    titles: fc.tuple(generatedTitle, generatedTitle),
   })
-  let first = true
-  coordinator.requestApplyCommittedTx = async (
-    collectionId,
-    tx,
-    scopedAdapter,
-  ) => {
-    if (first) {
-      first = false
-      expect(scopedAdapter).toBeDefined()
-      throw uncertain
-    }
-    await (scopedAdapter ?? adapter).applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      tx,
+
+function generatedPersistenceGrammarSamples(): ReadonlyArray<{
+  grammar: GeneratedPersistenceGrammar
+  histories: Array<GeneratedPersistenceHistory>
+}> {
+  const grammar = (property: string): GeneratedPersistenceGrammar => {
+    const match = generatedPersistenceGrammars.find(
+      (candidate) => candidate.property === property,
     )
-    return {
-      type: `rpc:applyCommittedTx:res`,
-      rpcId: tx.txId,
-      ok: true,
-      term: tx.term,
-      seq: tx.seq,
-      latestRowVersion: tx.rowVersion,
-    }
+    if (match === undefined) throw new Error(`missing grammar: ${property}`)
+    return match
   }
-  coordinator.reconcileCommittedTx = async (
-    collectionId,
-    tx,
-    anchor,
-    scopedAdapter,
-  ) => {
-    expect(anchor).toEqual({ latestRowVersion: 0, resetEpoch: 0 })
-    expect(scopedAdapter).toBeDefined()
-    reconcileEntered.resolve()
-    await releaseReconcile.promise
-    const committed = { ...tx, term: 2, seq: 1, rowVersion: 1 }
-    await (scopedAdapter ?? adapter).applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      committed,
-    )
-    return {
-      type: `rpc:reconcileCommittedTx:res`,
-      rpcId: tx.txId,
-      ok: true,
-      alreadyApplied: false,
-      committed: { term: 2, seq: 1, rowVersion: 1 },
-    }
-  }
-  let source!: TodoSyncParams
-  let syncRuns = 0
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `queued-reconciliation`,
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          source = params
-          syncRuns++
-          params.markReady()
-        },
-      },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  const ready = collection.stateWhenReady()
-  let firstReceipt: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await atPersistedOracleCheckpoint(hydrationEntered.promise, `held baseline`)
-    source.begin()
-    source.write({
-      type: `update`,
-      value: { id: `shared`, title: `crossing` },
-    })
-    source.metadata?.collection.set(`probe:cursor`, `crossing`)
-    firstReceipt = Promise.resolve(source.commit()).then(() => undefined)
-    const settlement = observeSettlement(firstReceipt)
-    expect(settlement.read()).toEqual({ status: `pending` })
-    expect(adapter.applyCommittedTxCalls).toHaveLength(0)
-    releaseHydration.resolve()
-    await atPersistedOracleCheckpoint(
-      reconcileEntered.promise,
-      `queued reconciliation entered`,
-    )
-    expect(settlement.read()).toEqual({ status: `pending` })
-    expect(adapter.rows.get(`shared`)?.title).toBe(`baseline`)
-    releaseReconcile.resolve()
-    await atPersistedOracleCheckpoint(firstReceipt, `queued source receipt`)
-    await atPersistedOracleCheckpoint(ready, `persisted restore ready`)
-    expect({
-      receipt: settlement.read(),
-      status: collection.status,
-      syncRuns,
-      publicTitle: collection.get(`shared`)?.title,
-      durableTitle: adapter.rows.get(`shared`)?.title,
-      cursor: adapter.collectionMetadata.get(`probe:cursor`),
-      durableTxCount: adapter.applyCommittedTxCalls.length,
-    }).toEqual({
-      receipt: { status: `fulfilled` },
-      status: `ready`,
-      syncRuns: 1,
-      publicTitle: `crossing`,
-      durableTitle: `crossing`,
-      cursor: `crossing`,
-      durableTxCount: 1,
-    })
-    source.begin()
-    source.write({
-      type: `update`,
-      value: { id: `shared`, title: `later` },
-    })
-    source.metadata?.collection.set(`probe:cursor`, `later`)
-    await atPersistedOracleCheckpoint(
-      Promise.resolve(source.commit()),
-      `queued source suffix`,
-    )
-    expect({
-      status: collection.status,
-      syncRuns,
-      publicTitle: collection.get(`shared`)?.title,
-      durableTitle: adapter.rows.get(`shared`)?.title,
-      cursor: adapter.collectionMetadata.get(`probe:cursor`),
-      durableTxCount: adapter.applyCommittedTxCalls.length,
-    }).toEqual({
-      status: `ready`,
-      syncRuns: 1,
-      publicTitle: `later`,
-      durableTitle: `later`,
-      cursor: `later`,
-      durableTxCount: 2,
-    })
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseHydration.resolve()
-    releaseReconcile.resolve()
-    await cleanupPersistedOracle(
-      [
-        () => ready.catch(() => undefined),
-        () => firstReceipt?.catch(() => undefined),
-        () => collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-// A missing exact-ID proof leaves the original uncertainty visible. A known
-// SQLite failure keeps its durability class and details, whether it arrived as
-// a remote response or a direct local throw. In all three histories the source
-// has no safe suffix: a later commit cannot advance durable rows or cursor.
-it.each([`unknown`, `remote-durability`, `local-durability`] as const)(
-  `fails the source run after %s reconciliation`,
-  async (failureMode) => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const uncertain = new IndeterminateCommitError({
-      collectionId: `failed-reconciliation`,
-      requestType: `rpc:applyCommittedTx:req`,
-      previousLeaderId: `retired`,
-      previousTerm: 1,
-      currentLeaderId: `replacement`,
-      currentTerm: 2,
-      cause: new Error(`lost answer`),
-    })
-    const localFailure = new PersistedCollectionDurabilityError(
-      `SQLite reconciliation failed`,
-      { code: `SQLITE_IOERR_FSYNC`, path: [`database`, `wal`] },
-    )
-    coordinator.requestApplyCommittedTx = async () => {
-      throw uncertain
-    }
-    coordinator.reconcileCommittedTx = async () => {
-      if (failureMode === `local-durability`) throw localFailure
-      if (failureMode === `remote-durability`) {
-        return {
-          type: `rpc:reconcileCommittedTx:res`,
-          rpcId: `known-failure`,
-          ok: false,
-          code: `PERSISTENCE_ERROR`,
-          error: `disk write failed`,
-          sourceCode: `SQLITE_IOERR_FSYNC`,
-          path: [`database`, `wal`],
-        }
-      }
-      return {
-        type: `rpc:reconcileCommittedTx:res`,
-        rpcId: `unknown`,
-        ok: false,
-        code: `UNDETERMINED`,
-        error: `newer write exists`,
-      }
-    }
-    let source!: TodoSyncParams
-    let syncRuns = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `failed-reconciliation`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            syncRuns++
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const live = createLiveQueryCollection((q) => q.from({ row: collection }))
-    const subscription = live.subscribeChanges(() => {})
-    let hasPrimaryFailure = false
-    try {
-      await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
-      await atPersistedOracleCheckpoint(live.preload(), `live ready`)
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `crossing`, title: `source` },
-      })
-      source.metadata?.collection.set(`probe:cursor`, `crossing`)
-      let firstFailure: unknown
-      try {
-        await atPersistedOracleCheckpoint(
-          Promise.resolve(source.commit()),
-          `failed source receipt`,
+  const sampleOptions = (seed: number) => ({ seed, numRuns: oracleRuns(4) })
+  return [
+    {
+      grammar: grammar(`sqlite-persistence.source-fifo-order`),
+      histories: fc
+        .sample(
+          sourceFifoOrderingHistory,
+          sampleOptions(generatedPersistenceFixedSeeds.sourceFifoOrdering),
         )
-      } catch (error) {
-        firstFailure = error
-      }
-      if (failureMode === `unknown`) {
-        expect(firstFailure).toBe(uncertain)
-      } else if (failureMode === `local-durability`) {
-        expect(firstFailure).toBe(localFailure)
-      } else {
-        expect(firstFailure).toMatchObject({
-          name: `PersistedCollectionDurabilityError`,
-          code: `SQLITE_IOERR_FSYNC`,
-          path: [`database`, `wal`],
-        })
-      }
-      let suffixFailure: unknown
-      try {
-        source.begin()
-        source.write({ type: `insert`, value: { id: `later`, title: `later` } })
-        await Promise.resolve(source.commit())
-      } catch (error) {
-        suffixFailure = error
-      }
-      expect(suffixFailure).toBe(firstFailure)
-      expect({
-        sourceStatus: collection.status,
-        liveStatus: live.status,
-        syncRuns,
-        durableIds: [...adapter.rows.keys()],
-        durableCursor: adapter.collectionMetadata.get(`probe:cursor`),
-        durableTxCount: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        sourceStatus: `crashed`,
-        liveStatus: `crashed`,
-        syncRuns: 1,
-        durableIds: [],
-        durableCursor: undefined,
-        durableTxCount: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      subscription.unsubscribe()
-      await cleanupPersistedOracle(
-        [() => live.cleanup(), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
-
-function observeSettlement(promise: Promise<void>): {
-  read: () =>
-    | { status: `pending` }
-    | { status: `fulfilled` }
-    | { status: `rejected`; reason: unknown }
-} {
-  let outcome:
-    | { status: `pending` }
-    | { status: `fulfilled` }
-    | { status: `rejected`; reason: unknown } = { status: `pending` }
-  void promise.then(
-    () => {
-      outcome = { status: `fulfilled` }
+        .map((history) => ({
+          axes: history.relations,
+          titles: [...history.titles],
+        })),
+    },
+    {
+      grammar: grammar(`sqlite-persistence.abort-graph`),
+      histories: fc
+        .sample(
+          abortGraphHistory,
+          sampleOptions(generatedPersistenceFixedSeeds.abortGraph),
+        )
+        .map((history) => ({
+          axes: history.relationships,
+          titles: [...history.titles],
+        })),
     },
-    (reason: unknown) => {
-      outcome = { status: `rejected`, reason }
+    {
+      grammar: grammar(`sqlite-persistence.owner-isolation`),
+      histories: fc
+        .sample(
+          ownerIsolationHistory,
+          sampleOptions(generatedPersistenceFixedSeeds.ownerIsolation),
+        )
+        .map((history) => ({
+          axes: history.operations,
+          titles: [history.queuedTitle],
+        })),
     },
-  )
-  return { read: () => outcome }
+    {
+      grammar: grammar(`sqlite-persistence.open-transaction-boundary`),
+      histories: fc
+        .sample(
+          openTransactionBoundaryHistory,
+          sampleOptions(generatedPersistenceFixedSeeds.openTransactionBoundary),
+        )
+        .map((history) => ({
+          axes: history.boundaries,
+          titles: [history.hydratedTitle],
+        })),
+    },
+    {
+      grammar: grammar(
+        `sqlite-persistence.request-local-failure-buffered-source`,
+      ),
+      histories: fc
+        .sample(
+          requestLocalFailureHistory,
+          sampleOptions(generatedPersistenceFixedSeeds.requestLocalFailure),
+        )
+        .map((history) => ({
+          axes: history.operations,
+          titles: [...history.titles],
+        })),
+    },
+  ]
 }
 
-function expectPendingKeyMembershipWork(
-  actual: number,
-  pendingOwners: number,
-  partialWrites: number,
-): void {
-  expect(
-    actual,
-    `one key-membership lookup per pending owner and partial write`,
-  ).toBe(pendingOwners * partialWrites)
+async function runGeneratedSourceFifoOrderingHistory(
+  history: SourceFifoOrderingHistory,
+): Promise<void> {
+  for (const relation of history.relations) {
+    await runSourceFifoOrderingLaw(
+      relation,
+      history.titles[0],
+      history.titles[1],
+    )
+  }
 }
 
-async function runRejectedHydrationBufferWitness(
-  id: string,
-  rows: ReadonlyArray<Todo>,
-  options: {
-    commitAfterHydrationFailure?: boolean
-    scopeMode?: (typeof hydrationScopeModes)[number]
-  } = {},
+async function runGeneratedAbortGraphHistory(
+  history: AbortGraphHistory,
 ): Promise<void> {
-  const hydrationEntered = createEventGate()
-  const releaseHydration = createEventGate()
-  const hydrationRejected = createEventGate()
-  const hydrationError = new Error(`persisted hydration rejected exactly`)
-  const adapter = createRecordingAdapter()
-  const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
-    hydrationEntered.resolve()
-    await releaseHydration.promise
-    hydrationRejected.resolve()
-    throw hydrationError
-  })
-
-  const routing = configureHydrationScope(adapter, options.scopeMode ?? `none`)
-  let remoteBegin: (() => void) | undefined
-  let remoteWrite:
-    ((message: { type: `insert`; value: Todo }) => void) | undefined
-  let remoteCommit: (() => true | Promise<void>) | undefined
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (item) => item.id,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          remoteBegin = begin
-          remoteWrite = write as (message: {
-            type: `insert`
-            value: Todo
-          }) => void
-          remoteCommit = commit
-          markReady()
-        },
-      },
-      persistence: { adapter },
-    }),
-  )
-  let hasPrimaryFailure = false
-  let initialCollectionCleaned = false
-  const cleanupActions: Array<() => void | Promise<unknown>> = [
-    () => (initialCollectionCleaned ? undefined : collection.cleanup()),
-  ]
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-
-  try {
-    void collection.stateWhenReady().catch(() => undefined)
-    await atPersistedOracleCheckpoint(
-      hydrationEntered.promise,
-      `${id} hydration entered`,
+  for (const relationship of history.relationships) {
+    await runAbortRelationshipLaw(
+      relationship,
+      history.titles[0],
+      history.titles[1],
     )
-    expect(remoteBegin).toBeTypeOf(`function`)
-    expect(remoteWrite).toBeTypeOf(`function`)
-    expect(remoteCommit).toBeTypeOf(`function`)
+  }
+}
 
-    const committers = rows.map((row) => {
-      remoteBegin!()
-      remoteWrite!({ type: `insert`, value: row })
-      return () => {
-        const receipt = remoteCommit!()
-        expect(receipt).toBeInstanceOf(Promise)
-        return observeSettlement(Promise.resolve(receipt).then(() => undefined))
-      }
-    })
-    let receipts = options.commitAfterHydrationFailure
-      ? []
-      : committers.map((commit) => commit())
+async function runGeneratedOwnerIsolationHistory(
+  history: OwnerIsolationHistory,
+): Promise<void> {
+  for (const operation of history.operations) {
+    await runBareOwnerOperationLaw(operation, history.queuedTitle)
+  }
+}
 
-    releaseHydration.resolve()
-    await atPersistedOracleCheckpoint(
-      hydrationRejected.promise,
-      `${id} hydration rejected`,
+async function runGeneratedOpenTransactionBoundaryHistory(
+  history: OpenTransactionBoundaryHistory,
+): Promise<void> {
+  for (const boundary of history.boundaries) {
+    await runInternalOpenTransactionBoundaryLaw(boundary, history.hydratedTitle)
+  }
+}
+
+async function runGeneratedRequestLocalFailureHistory(
+  history: RequestLocalFailureHistory,
+): Promise<void> {
+  for (const operation of history.operations) {
+    await runRequestLocalFailureOperationLaw(
+      operation,
+      history.titles[0],
+      history.titles[1],
     )
-    await flushAsyncWork()
+  }
+}
 
-    if (options.commitAfterHydrationFailure) {
-      receipts = committers.map((commit) => commit())
-      await flushAsyncWork()
-    }
+function registerGeneratedPersistenceProperty<Value>(options: {
+  property: string
+  title: string
+  arbitrary: fc.Arbitrary<Value>
+  fixedSeed: number
+  run: (value: Value) => Promise<void>
+}): void {
+  const { property, title, arbitrary, fixedSeed, run } = options
+  oracleReplayTest(fcTest).prop([arbitrary], {
+    seed: fixedSeed,
+    numRuns: oracleRuns(4),
+  })(`${title} (fixed)`, run)
+  oracleReplayTest(fcTest, property).prop(
+    [arbitrary],
+    oraclePropertyOptions(4, property),
+  )(`${title} (random)`, run)
+}
 
-    const receiptOutcomes = receipts.map((receipt) => {
-      const outcome = receipt.read()
-      return outcome.status === `rejected`
-        ? {
-            status: outcome.status,
-            exactReason: outcome.reason === hydrationError,
-          }
-        : outcome
-    })
-    expect({
-      status: collection.status,
-      exactPublicError: collection._lifecycle.getSyncError() === hydrationError,
-      receiptOutcomes,
-      visibleRows: rows.filter((row) => collection.has(row.id)),
-      durableRows: rows.filter((row) => adapter.rows.has(row.id)),
-      durabilityCalls: adapter.applyCommittedTxCalls.length,
-    }).toEqual({
-      status: `crashed`,
-      exactPublicError: true,
-      receiptOutcomes: rows.map(() => ({
-        status: `rejected`,
-        exactReason: true,
-      })),
-      visibleRows: [],
-      durableRows: [],
-      durabilityCalls: 0,
-    })
+// The durability drivers run generated histories through the laws in this
+// file. The models predict public rows, durable rows, and metadata from the
+// authored inputs; the check drivers compare production observations with
+// them, and the grammar reaches the generated histories.
+declareOracle({
+  check: [
+    runGeneratedSourceFifoOrderingHistory,
+    runGeneratedAbortGraphHistory,
+    runGeneratedOwnerIsolationHistory,
+    runGeneratedOpenTransactionBoundaryHistory,
+    runGeneratedRequestLocalFailureHistory,
+    expectOnDemandEvidenceLaw,
+  ],
+  model: [
+    expectedScopedSnapshot,
+    expectedTargetedSnapshot,
+    foldDurabilityLedger,
+    expectedSourceFifoOrderingRows,
+  ],
+  grammar: [
+    generatedPersistenceGrammars,
+    sourceFifoOrderingHistory,
+    abortGraphHistory,
+    ownerIsolationHistory,
+    openTransactionBoundaryHistory,
+    requestLocalFailureHistory,
+  ],
+})
 
-    await atPersistedOracleCheckpoint(
-      collection.cleanup(),
-      `${id} failed collection cleanup`,
-    )
-    expect(routing?.violations() ?? []).toEqual([])
-    initialCollectionCleaned = true
-    restoreBaselineRows()
+// Each check compares an observation with the law that its own inputs fix:
+// the abort relationship, the owner-isolation admission, or the open-transaction
+// boundary outcome. The models recompute the hydrated source snapshot from the
+// authored edit log and the transactions that reach durable admission.
+declareOracle({
+  check: [
+    expectAbortGraphObservation,
+    expectOwnerIsolationAdmission,
+    expectOpenTransactionBoundaryObservation,
+  ],
+  model: [hydrationSourceSnapshot, expectedDurableHydrationTransactions],
+})
 
-    const reopened = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (item) => item.id,
-        persistence: { adapter },
-      }),
-    )
-    cleanupActions.push(() => reopened.cleanup())
-    await atPersistedOracleCheckpoint(
-      reopened.stateWhenReady(),
-      `${id} reopened hydration`,
-    )
-    await flushAsyncWork()
+const describeDurabilityOracles = oracleReplayTest(
+  describe,
+  `sqlite-persistence.source-fifo-order`,
+  `sqlite-persistence.abort-graph`,
+  `sqlite-persistence.owner-isolation`,
+  `sqlite-persistence.open-transaction-boundary`,
+  `sqlite-persistence.request-local-failure-buffered-source`,
+)
 
-    expect({
-      visibleRows: rows.filter((row) => reopened.has(row.id)),
-      durableRows: rows.filter((row) => adapter.rows.has(row.id)),
-      rowMetadata: Array.from(adapter.rowMetadata.entries()),
-      collectionMetadata: Array.from(adapter.collectionMetadata.entries()),
-      durabilityCalls: adapter.applyCommittedTxCalls.length,
-    }).toEqual({
-      visibleRows: [],
-      durableRows: [],
-      rowMetadata: [],
-      collectionMetadata: [],
-      durabilityCalls: 0,
-    })
+describeDurabilityOracles(`generated persistence durability oracles`, () => {
+  if (!oracleReplayRequested()) {
+    it(`reconstructs the full grammar and rejects ablated, out-of-range, and foreign histories`, () => {
+      for (const {
+        grammar,
+        histories,
+      } of generatedPersistenceGrammarSamples()) {
+        for (const history of histories) {
+          expect(
+            reconstructGeneratedPersistenceHistory(grammar, history),
+          ).toEqual(history)
+        }
+      }
 
-    const freshRow = { id: `${id}:fresh`, title: `post-restart control` }
-    const freshTransaction = reopened.insert(freshRow)
-    await atPersistedOracleCheckpoint(
-      (async () => {
-        await freshTransaction.isPersisted.promise
-      })(),
-      `${id} fresh transaction persisted`,
-    )
-    await flushAsyncWork()
+      for (const grammar of generatedPersistenceGrammars) {
+        expect(Object.keys(grammar.axisContribution).sort()).toEqual(
+          [...grammar.axes].sort(),
+        )
+        for (const contribution of Object.values(grammar.axisContribution)) {
+          expect(contribution).not.toBe(``)
+        }
+        expect(
+          reconstructGeneratedPersistenceHistory(grammar, grammar.witness),
+        ).toEqual(grammar.witness)
 
-    expect({
-      visibleFreshRow: stripVirtualProps(reopened.get(freshRow.id)),
-      durableFreshRow: adapter.rows.get(freshRow.id),
-      staleVisibleRows: rows.filter((row) => reopened.has(row.id)),
-      staleDurableRows: rows.filter((row) => adapter.rows.has(row.id)),
-      rowMetadata: Array.from(adapter.rowMetadata.entries()),
-      collectionMetadata: Array.from(adapter.collectionMetadata.entries()),
-      appliedKeys: adapter.applyCommittedTxCalls.flatMap(({ tx }) =>
-        tx.mutations.map((mutation) => mutation.key),
-      ),
-    }).toEqual({
-      visibleFreshRow: freshRow,
-      durableFreshRow: freshRow,
-      staleVisibleRows: [],
-      staleDurableRows: [],
-      rowMetadata: [],
-      collectionMetadata: [],
-      appliedKeys: [freshRow.id],
+        for (const omittedAxis of grammar.axes) {
+          expect(() =>
+            reconstructGeneratedPersistenceHistory(grammar, {
+              ...grammar.witness,
+              axes: grammar.witness.axes.filter((axis) => axis !== omittedAxis),
+            }),
+          ).toThrow(`invalid generated persistence history`)
+        }
+
+        expect(
+          reconstructGeneratedPersistenceHistory(grammar, {
+            axes: [...grammar.axes],
+            titles: Array.from({ length: grammar.titleCount }, () =>
+              `x`.repeat(generatedTitleMaxLength),
+            ),
+          }).titles,
+        ).toEqual(
+          Array.from({ length: grammar.titleCount }, () =>
+            `x`.repeat(generatedTitleMaxLength),
+          ),
+        )
+        expect(
+          reconstructGeneratedPersistenceHistory(grammar, {
+            axes: [...grammar.axes],
+            titles: Array.from({ length: grammar.titleCount }, () => ``),
+          }).titles,
+        ).toEqual(Array.from({ length: grammar.titleCount }, () => ``))
+        expect(() =>
+          reconstructGeneratedPersistenceHistory(grammar, {
+            axes: [...grammar.axes],
+            titles: [
+              `x`.repeat(generatedTitleMaxLength + 1),
+              ...Array.from(
+                { length: Math.max(0, grammar.titleCount - 1) },
+                () => ``,
+              ),
+            ],
+          }),
+        ).toThrow(`invalid generated persistence history`)
+        expect(() =>
+          reconstructGeneratedPersistenceHistory(grammar, {
+            ...grammar.witness,
+            axes: grammar.axes.map((axis, index) =>
+              index === grammar.axes.length - 1 ? grammar.axes[0]! : axis,
+            ),
+          }),
+        ).toThrow(`invalid generated persistence history`)
+        expect(() =>
+          reconstructGeneratedPersistenceHistory(grammar, {
+            ...grammar.witness,
+            axes: [...grammar.axes.slice(0, -1), `foreign-axis`],
+          }),
+        ).toThrow(`invalid generated persistence history`)
+      }
+    })
+
+    it.each([
+      {
+        name: `source-fifo-order older same-key value wins`,
+        reject: () =>
+          expectSourceFifoOrderingObservation(
+            {
+              publicRows: [{ id: `shared`, title: `older` }],
+              durableRows: [{ id: `shared`, title: `older` }],
+              status: `ready`,
+              pendingMarkers: 0,
+            },
+            [{ id: `shared`, title: `newer` }],
+          ),
+      },
+      {
+        name: `abort-graph independent sibling inherits the abort`,
+        reject: () =>
+          expectAbortGraphObservation(
+            {
+              predecessorStatus: `rejected`,
+              predecessorName: `AbortError`,
+              successorStatus: `rejected`,
+              sameFailure: true,
+              status: `crashed`,
+              publicSuccessor: undefined,
+              durableSuccessor: undefined,
+              pendingMarkers: 0,
+            },
+            `independent`,
+            `survivor`,
+            `must survive`,
+          ),
+      },
+      {
+        name: `owner-isolation bare write steals and publishes a queued marker`,
+        reject: () =>
+          expectOwnerIsolationAdmission({
+            exactError: false,
+            strayVisible: true,
+          }),
+      },
+      {
+        name: `open-transaction boundary leaks one core marker`,
+        reject: () =>
+          expectOpenTransactionBoundaryObservation(
+            { status: `crashed`, pendingMarkers: 1 },
+            `terminal-failure`,
+          ),
+      },
+      {
+        name: `request-local partial update drops the unseen baseline field`,
+        reject: () =>
+          expectRequestLocalFailureObservation(
+            {
+              receiptStatus: `fulfilled`,
+              publicRows: [{ id: `shared`, title: `source` }],
+              durableRows: [
+                {
+                  id: `shared`,
+                  title: `source`,
+                  detail: `required baseline detail`,
+                },
+              ],
+              status: `ready`,
+              publicError: undefined,
+            },
+            [
+              {
+                id: `shared`,
+                title: `source`,
+                detail: `required baseline detail`,
+              },
+            ],
+          ),
+      },
+    ])(`rejects named wrong answer: $name`, ({ reject }) => {
+      expect(reject).toThrow()
     })
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseHydration.resolve()
-    warning.mockRestore()
-    await cleanupPersistedOracle(cleanupActions, hasPrimaryFailure)
   }
-}
 
-let generatedOwnershipHistoryId = 0
+  registerGeneratedPersistenceProperty({
+    property: `sqlite-persistence.source-fifo-order`,
+    title: `serialized histories preserve source order and settle every receipt`,
+    arbitrary: sourceFifoOrderingHistory,
+    fixedSeed: generatedPersistenceFixedSeeds.sourceFifoOrdering,
+    run: runGeneratedSourceFifoOrderingHistory,
+  })
+  registerGeneratedPersistenceProperty({
+    property: `sqlite-persistence.abort-graph`,
+    title: `abort graphs preserve independent siblings and reject dependent suffixes`,
+    arbitrary: abortGraphHistory,
+    fixedSeed: generatedPersistenceFixedSeeds.abortGraph,
+    run: runGeneratedAbortGraphHistory,
+  })
+  registerGeneratedPersistenceProperty({
+    property: `sqlite-persistence.owner-isolation`,
+    title: `bare operations cannot capture another owner's transaction`,
+    arbitrary: ownerIsolationHistory,
+    fixedSeed: generatedPersistenceFixedSeeds.ownerIsolation,
+    run: runGeneratedOwnerIsolationHistory,
+  })
+  registerGeneratedPersistenceProperty({
+    property: `sqlite-persistence.open-transaction-boundary`,
+    title: `open transaction boundaries leave no core marker`,
+    arbitrary: openTransactionBoundaryHistory,
+    fixedSeed: generatedPersistenceFixedSeeds.openTransactionBoundary,
+    run: runGeneratedOpenTransactionBoundaryHistory,
+  })
+  registerGeneratedPersistenceProperty({
+    property: `sqlite-persistence.request-local-failure-buffered-source`,
+    title: `request-local load failure preserves buffered source semantics`,
+    arbitrary: requestLocalFailureHistory,
+    fixedSeed: generatedPersistenceFixedSeeds.requestLocalFailure,
+    run: runGeneratedRequestLocalFailureHistory,
+  })
+})
 
-function sortedTodoRows(rows: Iterable<Todo>): Array<Todo> {
-  return Array.from(rows).sort((left, right) => left.id.localeCompare(right.id))
-}
+describeUnlessOracleReplay(`persistedCollectionOptions`, () => {
+  it.todo(
+    `loads active subsets and collection metadata from one atomic full-reload generation`,
+  )
 
-type SourceFifoOrderingObservation = {
-  publicRows: Array<Todo>
-  durableRows: Array<Todo>
-  status: string
-  pendingMarkers: number
-}
+  it.each([`during`, `straddles`, `after`] as const)(
+    `durably settles a source transaction that commits %s persisted hydration`,
+    async (position) => {
+      const hydrationEntered = createEventGate()
+      const hydration = createEventGate()
+      const adapter = createRecordingAdapter()
+      const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
+        hydrationEntered.resolve()
+        await hydration.promise
+        return []
+      })
 
-function expectSourceFifoOrderingObservation(
-  actual: SourceFifoOrderingObservation,
-  expectedRows: ReadonlyArray<Todo>,
-): void {
-  expect(actual).toEqual({
-    publicRows: expectedRows,
-    durableRows: expectedRows,
-    status: `ready`,
-    pendingMarkers: 0,
-  })
-}
+      const persistedTransactionOrder: Array<string> = []
+      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+      adapter.applyCommittedTx = async (...args) => {
+        const title = args[1].mutations.find(
+          (mutation) => mutation.type !== `delete`,
+        )?.value as Todo | undefined
+        if (title) persistedTransactionOrder.push(title.title)
+        await applyCommittedTx(...args)
+      }
 
-type AbortGraphObservation = {
-  predecessorStatus: `fulfilled` | `rejected`
-  predecessorName: string | undefined
-  successorStatus: `fulfilled` | `rejected`
-  sameFailure: boolean
-  status: string
-  publicSuccessor: Todo | undefined
-  durableSuccessor: Todo | undefined
-  pendingMarkers: number
-}
+      let remoteBegin: (() => void) | undefined
+      let remoteWrite:
+        ((message: { type: `insert`; value: Todo }) => void) | undefined
+      let remoteCommit: (() => true | Promise<void>) | undefined
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `hydration-boundary-${position}`,
+          getKey: (item) => item.id,
+          sync: {
+            sync: ({ begin, write, commit, markReady }) => {
+              remoteBegin = begin
+              remoteWrite = write as (message: {
+                type: `insert`
+                value: Todo
+              }) => void
+              remoteCommit = commit
+              markReady()
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const ledger: Array<DurabilityLedgerEvent> = []
+      const transactionId = position
+      const row = { id: `shared`, title: position }
+      let receipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
 
-function expectAbortGraphObservation(
-  actual: AbortGraphObservation,
-  relationship: `independent` | `same-key`,
-  successorKey: string,
-  successorTitle: string,
-): void {
-  expect(actual).toEqual(
-    relationship === `same-key`
-      ? {
-          predecessorStatus: `rejected`,
-          predecessorName: `AbortError`,
-          successorStatus: `rejected`,
-          sameFailure: true,
-          status: `crashed`,
-          publicSuccessor: undefined,
-          durableSuccessor: undefined,
-          pendingMarkers: 0,
-        }
-      : {
-          predecessorStatus: `rejected`,
-          predecessorName: `AbortError`,
-          successorStatus: `fulfilled`,
-          sameFailure: false,
-          status: `ready`,
-          publicSuccessor: { id: successorKey, title: successorTitle },
-          durableSuccessor: { id: successorKey, title: successorTitle },
-          pendingMarkers: 0,
-        },
-  )
-}
+      const beginAndWrite = () => {
+        ledger.push({ type: `begin`, transactionId })
+        remoteBegin?.()
+        ledger.push({ type: `write`, transactionId, row })
+        remoteWrite?.({ type: `insert`, value: row })
+      }
+      const commit = () => {
+        ledger.push({ type: `commit`, transactionId })
+        const applied = remoteCommit?.()
+        expect(applied).toBeInstanceOf(Promise)
+        receipt = Promise.resolve(applied).then(() => undefined)
+      }
 
-type OwnerIsolationAdmissionObservation = {
-  exactError: boolean
-  strayVisible: boolean
-}
+      try {
+        const ready = collection.stateWhenReady()
+        await atPersistedOracleCheckpoint(
+          hydrationEntered.promise,
+          `${position} hydration entered`,
+        )
+        expect(remoteBegin).toBeTypeOf(`function`)
+        expect(remoteCommit).toBeTypeOf(`function`)
 
-function expectOwnerIsolationAdmission(
-  actual: OwnerIsolationAdmissionObservation,
-): void {
-  expect(actual).toEqual({ exactError: true, strayVisible: false })
-}
+        if (position === `during`) {
+          beginAndWrite()
+          commit()
+          hydration.resolve()
+          await atPersistedOracleCheckpoint(
+            ready,
+            `${position} hydration completed`,
+          )
+        } else {
+          if (position === `straddles`) beginAndWrite()
+          hydration.resolve()
+          await atPersistedOracleCheckpoint(
+            ready,
+            `${position} hydration completed`,
+          )
+          if (position === `after`) beginAndWrite()
+          commit()
+        }
 
-type OpenTransactionBoundaryObservation = {
-  status: string
-  pendingMarkers: number
-}
+        const settlement = observeSettlement(receipt!)
+        const checkpointId = `checkpoint-${position}`
+        const checkpointRow = { id: checkpointId, title: checkpointId }
+        ledger.push({ type: `begin`, transactionId: checkpointId })
+        remoteBegin?.()
+        ledger.push({
+          type: `write`,
+          transactionId: checkpointId,
+          row: checkpointRow,
+        })
+        remoteWrite?.({ type: `insert`, value: checkpointRow })
+        ledger.push({ type: `commit`, transactionId: checkpointId })
+        const checkpointReceipt = remoteCommit?.()
+        expect(checkpointReceipt).toBeInstanceOf(Promise)
+        await atPersistedOracleCheckpoint(
+          Promise.resolve(checkpointReceipt),
+          `${position} later durable receipt`,
+        )
 
-type RequestLocalFailureObservation = {
-  receiptStatus: `pending` | `fulfilled` | `rejected`
-  publicRows: Array<Todo>
-  durableRows: Array<Todo>
-  status: string
-  publicError: unknown
-}
+        // A settled later durable receipt is the exact cut: FIFO forbids it
+        // from overtaking an earlier commit opened in the old phase.
+        expect(settlement.read()).toEqual({ status: `fulfilled` })
+        const expected = foldDurabilityLedger(ledger)
+        expect(persistedTransactionOrder).toEqual(expected.commitOrder)
+        expect(stripVirtualProps(collection.get(`shared`))).toEqual(row)
+        expect(adapter.rows.get(`shared`)).toEqual(row)
+        expect(adapter.rows.get(checkpointId)).toEqual(checkpointRow)
 
-function expectOpenTransactionBoundaryObservation(
-  actual: OpenTransactionBoundaryObservation,
-  boundary: `abort` | `cleanup` | `terminal-failure`,
-): void {
-  expect(actual).toEqual({
-    status:
-      boundary === `cleanup`
-        ? `cleaned-up`
-        : boundary === `abort`
-          ? `ready`
-          : `crashed`,
-    pendingMarkers: 0,
-  })
-}
+        await collection.cleanup()
+        restoreBaselineRows()
+        const reopened = createCollection(
+          persistedCollectionOptions<Todo, string>({
+            id: `hydration-boundary-${position}`,
+            getKey: (item) => item.id,
+            sync: { sync: ({ markReady }) => markReady() },
+            persistence: { adapter },
+          }),
+        )
+        let hasReopenFailure = false
+        try {
+          await atPersistedOracleCheckpoint(
+            reopened.stateWhenReady(),
+            `${position} reopened hydration completed`,
+          )
+          expect(stripVirtualProps(reopened.get(`shared`))).toEqual(
+            expected.committedRows.get(`shared`),
+          )
+        } catch (error) {
+          hasReopenFailure = true
+          throw error
+        } finally {
+          await cleanupPersistedOracle(
+            [() => reopened.cleanup()],
+            hasReopenFailure,
+          )
+        }
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        hydration.resolve()
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
 
-function expectRequestLocalFailureObservation(
-  actual: RequestLocalFailureObservation,
-  expectedRows: ReadonlyArray<Todo>,
-): void {
-  expect(actual).toEqual({
-    receiptStatus: `fulfilled`,
-    publicRows: expectedRows,
-    durableRows: expectedRows,
-    status: `ready`,
-    publicError: undefined,
-  })
-}
+  it(`does not let a later same-key transaction overtake a hydration-straddling commit`, async () => {
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    const adapter = createRecordingAdapter()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return []
+    })
+    const persistedTransactionOrder: Array<string> = []
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    adapter.applyCommittedTx = async (...args) => {
+      const row = args[1].mutations.find(
+        (mutation) => mutation.type !== `delete`,
+      )?.value as Todo | undefined
+      if (row) persistedTransactionOrder.push(row.title)
+      await applyCommittedTx(...args)
+    }
 
-async function runSourceFifoOrderingLaw(
-  relation: `same-key` | `disjoint`,
-  olderTitle: string,
-  newerTitle: string,
-): Promise<void> {
-  const historyId = ++generatedOwnershipHistoryId
-  const adapter = createRecordingAdapter()
-  const firstPersistenceEntered = createEventGate()
-  const releaseFirstPersistence = createEventGate()
-  const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-  let applyCalls = 0
-  adapter.applyCommittedTx = async (...args) => {
-    applyCalls++
-    if (applyCalls === 1) {
-      firstPersistenceEntered.resolve()
-      await releaseFirstPersistence.promise
-    }
-    await applyCommittedTx(...args)
-  }
-  let sourceParams!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `generated-source-fifo-order-${historyId}`,
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          sourceParams = params
-          params.markReady()
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydration-straddle-sibling-fifo`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
         },
-      },
-      persistence: { adapter },
-    }),
-  )
-  const receipts: Array<Promise<void>> = []
-  let hasPrimaryFailure = false
-
-  try {
-    await atPersistedOracleCheckpoint(
-      collection.stateWhenReady(),
-      `generated source FIFO ordering ready`,
-    )
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: `gate`, title: `holds adapter` },
-    })
-    receipts.push(Promise.resolve(sourceParams.commit()).then(() => undefined))
-    receipts.forEach((receipt) => void receipt.catch(() => undefined))
-    await atPersistedOracleCheckpoint(
-      firstPersistenceEntered.promise,
-      `generated source FIFO ordering adapter hold`,
+        persistence: { adapter },
+      }),
     )
+    const ledger: Array<DurabilityLedgerEvent> = []
+    let firstReceipt: Promise<void> | undefined
+    let secondReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
 
-    const olderKey = relation === `same-key` ? `shared` : `older`
-    const newerKey = relation === `same-key` ? `shared` : `newer`
-    const expected = new Map<string, Todo>([
-      [`gate`, { id: `gate`, title: `holds adapter` }],
-    ])
-    expected.set(olderKey, { id: olderKey, title: olderTitle })
-
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: olderKey, title: olderTitle },
-    })
-    const olderReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(olderReceipt)
-    void olderReceipt.catch(() => undefined)
+    const sourceTransaction = (transactionId: string, title: string) => {
+      const row = { id: `shared`, title }
+      ledger.push({ type: `begin`, transactionId })
+      remoteBegin?.()
+      ledger.push({ type: `write`, transactionId, row })
+      remoteWrite?.({ type: `insert`, value: row })
+      ledger.push({ type: `commit`, transactionId })
+      return Promise.resolve(remoteCommit?.()).then(() => undefined)
+    }
 
-    sourceParams.begin()
-    sourceParams.write({
-      type: relation === `same-key` ? `update` : `insert`,
-      value: { id: newerKey, title: newerTitle },
-    })
-    expected.set(newerKey, { id: newerKey, title: newerTitle })
-    const newerReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(newerReceipt)
-    void newerReceipt.catch(() => undefined)
+    try {
+      const ready = collection.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `FIFO hydration entered`,
+      )
 
-    expect(
-      sortedTodoRows(Array.from(collection.values()).map(stripVirtualProps)),
-    ).toEqual(sortedTodoRows([{ id: `gate`, title: `holds adapter` }]))
+      const firstRow = { id: `shared`, title: `first` }
+      ledger.push({ type: `begin`, transactionId: `first` })
+      remoteBegin?.()
+      ledger.push({ type: `write`, transactionId: `first`, row: firstRow })
+      remoteWrite?.({ type: `insert`, value: firstRow })
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(ready, `FIFO hydration completed`)
+      ledger.push({ type: `commit`, transactionId: `first` })
+      firstReceipt = Promise.resolve(remoteCommit?.()).then(() => undefined)
+      const firstSettlement = observeSettlement(firstReceipt)
 
-    releaseFirstPersistence.resolve()
-    for (const [index, receipt] of receipts.entries()) {
+      secondReceipt = sourceTransaction(`second`, `second`)
+      const secondSettlement = observeSettlement(secondReceipt)
       await atPersistedOracleCheckpoint(
-        receipt,
-        `generated source FIFO receipt ${index}`,
+        secondReceipt,
+        `later same-key receipt settled`,
       )
-    }
-    expectSourceFifoOrderingObservation(
-      {
-        publicRows: sortedTodoRows(
-          Array.from(collection.values()).map(stripVirtualProps),
-        ),
-        durableRows: sortedTodoRows(adapter.rows.values()),
-        status: collection.status,
-        pendingMarkers: collection._state.pendingSyncedTransactions.length,
-      },
-      sortedTodoRows(expected.values()),
-    )
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseFirstPersistence.resolve()
-    await cleanupPersistedOracle(
-      [
-        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
-        () => collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-}
 
-async function runAbortRelationshipLaw(
-  relationship: `independent` | `same-key`,
-  predecessorTitle: string,
-  successorTitle: string,
-): Promise<void> {
-  const historyId = ++generatedOwnershipHistoryId
-  const adapter = createRecordingAdapter()
-  const firstPersistenceEntered = createEventGate()
-  const releaseFirstPersistence = createEventGate()
-  const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-  let applyCalls = 0
-  adapter.applyCommittedTx = async (...args) => {
-    applyCalls++
-    if (applyCalls === 1) {
-      firstPersistenceEntered.resolve()
-      await releaseFirstPersistence.promise
+      const expected = foldDurabilityLedger(ledger)
+      expect(persistedTransactionOrder).toEqual(expected.commitOrder)
+      expect(firstSettlement.read()).toEqual({ status: `fulfilled` })
+      expect(secondSettlement.read()).toEqual({ status: `fulfilled` })
+      expect(adapter.rows.get(`shared`)).toEqual(
+        expected.committedRows.get(`shared`),
+      )
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
     }
-    await applyCommittedTx(...args)
-  }
-  let sourceParams!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `generated-abort-graph-${historyId}`,
-      getKey: (row) => row.id,
-      sync: {
-        rowUpdateMode: `partial`,
-        sync: (params) => {
-          sourceParams = params
-          params.markReady()
-        },
-      },
-      persistence: { adapter },
-    }),
-  )
-  const abortController = new AbortController()
-  const receipts: Array<Promise<void>> = []
-  let hasPrimaryFailure = false
+  })
 
-  try {
-    await atPersistedOracleCheckpoint(
-      collection.stateWhenReady(),
-      `generated abort graph ready`,
-    )
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: `gate`, title: `holds adapter` },
+  it(`settles an aborted hydration-straddling commit without applying it`, async () => {
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    const adapter = createRecordingAdapter()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return []
     })
-    const gateReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(gateReceipt)
-    void gateReceipt.catch(() => undefined)
-    await atPersistedOracleCheckpoint(
-      firstPersistenceEntered.promise,
-      `generated abort graph adapter hold`,
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `aborted-hydration-straddle`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
     )
+    const ledger: Array<DurabilityLedgerEvent> = []
+    const controller = new AbortController()
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
 
-    const predecessorKey = relationship === `same-key` ? `shared` : `aborted`
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: {
-        id: predecessorKey,
-        title: predecessorTitle,
-        detail: `predecessor-only`,
-      },
-    })
-    const predecessorReceipt = Promise.resolve(
-      sourceParams.commit(abortController.signal),
-    ).then(() => undefined)
-    receipts.push(predecessorReceipt)
-    void predecessorReceipt.catch(() => undefined)
-
-    const successorKey = relationship === `same-key` ? `shared` : `survivor`
-    sourceParams.begin()
-    sourceParams.write({
-      type: relationship === `same-key` ? `update` : `insert`,
-      value: { id: successorKey, title: successorTitle },
-    })
-    const successorReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(successorReceipt)
-    void successorReceipt.catch(() => undefined)
-
-    abortController.abort()
-    releaseFirstPersistence.resolve()
-    await atPersistedOracleCheckpoint(gateReceipt, `generated abort gate`)
-    const predecessor = await atPersistedOracleCheckpoint(
-      predecessorReceipt.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      ),
-      `generated predecessor abort`,
-    )
-    const successor = await atPersistedOracleCheckpoint(
-      successorReceipt.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      ),
-      `generated successor settlement`,
-    )
-    const abortError =
-      predecessor.status === `rejected` ? predecessor.reason : undefined
+    try {
+      const ready = collection.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `abort hydration entered`,
+      )
+      ledger.push({ type: `begin`, transactionId: `aborted` })
+      remoteBegin?.()
+      const row = { id: `aborted`, title: `must not apply` }
+      ledger.push({ type: `write`, transactionId: `aborted`, row })
+      remoteWrite?.({ type: `insert`, value: row })
+      controller.abort()
+      ledger.push({ type: `abort`, transactionId: `aborted` })
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(ready, `abort hydration completed`)
+      receipt = Promise.resolve(remoteCommit?.(controller.signal)).then(
+        () => undefined,
+      )
+      await expect(
+        atPersistedOracleCheckpoint(receipt, `aborted receipt settled`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      expect(foldDurabilityLedger(ledger).committedRows.size).toBe(0)
+      expect(collection.get(`aborted`)).toBeUndefined()
+      expect(adapter.rows.get(`aborted`)).toBeUndefined()
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
 
-    expectAbortGraphObservation(
+  it(`append-only transaction judgment rejects omission and reordering`, () => {
+    const events: Array<DurabilityLedgerEvent> = [
+      { type: `begin`, transactionId: `first` },
       {
-        predecessorStatus: predecessor.status,
-        predecessorName:
-          abortError instanceof Error ? abortError.name : undefined,
-        successorStatus: successor.status,
-        sameFailure:
-          successor.status === `rejected` && successor.reason === abortError,
-        status: collection.status,
-        publicSuccessor: stripVirtualProps(collection.get(successorKey)),
-        durableSuccessor: adapter.rows.get(successorKey),
-        pendingMarkers: collection._state.pendingSyncedTransactions.length,
+        type: `write`,
+        transactionId: `first`,
+        row: { id: `shared`, title: `first` },
       },
-      relationship,
-      successorKey,
-      successorTitle,
-    )
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseFirstPersistence.resolve()
-    await cleanupPersistedOracle(
-      [
-        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
-        () => collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-}
-
-async function runBareOwnerOperationLaw(
-  operation: `write` | `commit` | `truncate`,
-  queuedTitle: string,
-): Promise<void> {
-  const historyId = ++generatedOwnershipHistoryId
-  const adapter = createRecordingAdapter()
-  const firstPersistenceEntered = createEventGate()
-  const releaseFirstPersistence = createEventGate()
-  const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-  let applyCalls = 0
-  adapter.applyCommittedTx = async (...args) => {
-    applyCalls++
-    if (applyCalls === 1) {
-      firstPersistenceEntered.resolve()
-      await releaseFirstPersistence.promise
-    }
-    await applyCommittedTx(...args)
-  }
-  let sourceParams!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `generated-owner-isolation-${historyId}`,
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          sourceParams = params
-          params.markReady()
-        },
+      { type: `commit`, transactionId: `first` },
+      { type: `begin`, transactionId: `second` },
+      {
+        type: `write`,
+        transactionId: `second`,
+        row: { id: `shared`, title: `second` },
       },
-      persistence: { adapter },
-    }),
-  )
-  const receipts: Array<Promise<void>> = []
-  let unexpectedReceipt: Promise<void> | undefined
-  let hasPrimaryFailure = false
-
-  try {
-    await atPersistedOracleCheckpoint(
-      collection.stateWhenReady(),
-      `generated owner isolation ready`,
-    )
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: `first`, title: `must survive` },
-    })
-    const firstReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(firstReceipt)
-    void firstReceipt.catch(() => undefined)
-    await atPersistedOracleCheckpoint(
-      firstPersistenceEntered.promise,
-      `generated owner isolation adapter hold`,
-    )
+      { type: `commit`, transactionId: `second` },
+    ]
+    const expected = foldDurabilityLedger(events)
 
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: `queued`, title: queuedTitle },
+    expect(expected.commitOrder).toEqual([`first`, `second`])
+    expect(expected.commitOrder).not.toEqual([`second`])
+    expect(expected.commitOrder).not.toEqual([`second`, `first`])
+    expect(expected.committedRows.get(`shared`)).toEqual({
+      id: `shared`,
+      title: `second`,
     })
-    const queuedReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(queuedReceipt)
-    void queuedReceipt.catch(() => undefined)
+  })
 
-    let observedError: unknown
-    try {
-      if (operation === `write`) {
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `stray`, title: `must not publish` },
-        })
-      } else if (operation === `truncate`) {
-        sourceParams.truncate()
-      } else {
-        const result = sourceParams.commit()
-        if (result !== true) {
-          unexpectedReceipt = Promise.resolve(result).then(() => undefined)
-          void unexpectedReceipt.catch(() => undefined)
+  it.each([`startup`, `resume`, `reset`] as const)(
+    `keeps the %s hydration ready after a buffered pre-application abort`,
+    async (entry) => {
+      const adapter = createRecordingAdapter()
+      const hydrationEntered = createEventGate()
+      const releaseHydration = createEventGate()
+      const coordinator =
+        entry === `reset` ? createCoordinatorHarness() : undefined
+      if (coordinator) {
+        coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
+          await adapter.applyCommittedTx(
+            { kind: `eager`, collectionId: collectionId },
+            tx,
+          )
+          return {
+            type: `rpc:applyCommittedTx:res`,
+            rpcId: tx.txId,
+            ok: true,
+            term: tx.term,
+            seq: tx.seq,
+            latestRowVersion: tx.rowVersion,
+          }
         }
+      } else {
+        overrideBaselineRows(adapter, async () => {
+          hydrationEntered.resolve()
+          await releaseHydration.promise
+          return []
+        })
       }
-    } catch (error) {
-      observedError = error
-    }
-    expectOwnerIsolationAdmission({
-      exactError:
-        operation === `commit`
-          ? observedError instanceof NoPendingSyncTransactionCommitError
-          : observedError instanceof NoPendingSyncTransactionWriteError,
-      strayVisible: collection.has(`stray`),
-    })
-
-    releaseFirstPersistence.resolve()
-    await atPersistedOracleCheckpoint(firstReceipt, `generated first owner`)
-    await atPersistedOracleCheckpoint(queuedReceipt, `generated queued owner`)
-    expect({
-      publicRows: sortedTodoRows(
-        Array.from(collection.values()).map(stripVirtualProps),
-      ),
-      durableRows: sortedTodoRows(adapter.rows.values()),
-      pendingMarkers: collection._state.pendingSyncedTransactions.length,
-    }).toEqual({
-      publicRows: sortedTodoRows([
-        { id: `first`, title: `must survive` },
-        { id: `queued`, title: queuedTitle },
-      ]),
-      durableRows: sortedTodoRows([
-        { id: `first`, title: `must survive` },
-        { id: `queued`, title: queuedTitle },
-      ]),
-      pendingMarkers: 0,
-    })
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseFirstPersistence.resolve()
-    await cleanupPersistedOracle(
-      [
-        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
-        () => unexpectedReceipt?.catch(() => undefined),
-        () => collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-}
-
-async function runInternalOpenTransactionBoundaryLaw(
-  boundary: `abort` | `cleanup` | `terminal-failure`,
-  hydratedTitle: string,
-): Promise<void> {
-  const historyId = ++generatedOwnershipHistoryId
-  const hydrated = { id: `hydrated`, title: hydratedTitle }
-  const adapter = createRecordingAdapter([hydrated])
-  const hydrationEntered = createEventGate()
-  const releaseHydration = createEventGate()
-  overrideBaselineRows(adapter, async () => {
-    hydrationEntered.resolve()
-    await releaseHydration.promise
-    return [{ key: hydrated.id, value: hydrated }]
-  })
-  let sourceParams!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `generated-internal-transaction-${historyId}`,
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          sourceParams = params
-          params.markReady()
-        },
-      },
-      persistence: { adapter },
-    }),
-  )
-  let internalReservationStarted = false
-  const subscription = collection.subscribeChanges((changes) => {
-    if (
-      !internalReservationStarted &&
-      changes.some((change) => change.key === hydrated.id)
-    ) {
-      internalReservationStarted = true
-      sourceParams.begin()
-    }
-  })
-  const receipts: Array<Promise<void>> = []
-  let cleanedUp = false
-  let hasPrimaryFailure = false
+      let sourceParams!: TodoSyncParams
+      let hydrateResumeBaseline: (() => Promise<void>) | undefined
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: coordinator ? `sync-present` : `buffered-abort-${entry}`,
+          getKey: (row) => row.id,
+          syncMode: entry === `resume` ? `on-demand` : `eager`,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              hydrateResumeBaseline =
+                params.metadata?.persistence?.hydrateBaseline
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const aborted = new AbortController()
+      let keyReads = 0
+      let hydration: Promise<unknown> | undefined
+      let abortedReceipt: Promise<void> | undefined
+      let independentReceipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
 
-  try {
-    const ready = collection.stateWhenReady()
-    await atPersistedOracleCheckpoint(
-      hydrationEntered.promise,
-      `generated internal hydration entered`,
-    )
-    releaseHydration.resolve()
-    await atPersistedOracleCheckpoint(ready, `generated internal ready`)
-    expect({
-      internalReservationStarted,
-      pendingMarkers: collection._state.pendingSyncedTransactions.length,
-    }).toEqual({ internalReservationStarted: true, pendingMarkers: 0 })
+      try {
+        if (entry === `resume`) {
+          collection.startSyncImmediate()
+          await atPersistedOracleCheckpoint(
+            collection.stateWhenReady(),
+            `resume collection ready before baseline`,
+          )
+          expect(hydrateResumeBaseline).toBeTypeOf(`function`)
+          hydration = hydrateResumeBaseline!()
+        } else if (coordinator) {
+          await atPersistedOracleCheckpoint(
+            collection.stateWhenReady(),
+            `reset collection ready before reload`,
+          )
+          const loadSubset = adapter.loadSubset.bind(adapter)
+          adapter.loadSubset = async (...args) => {
+            hydrationEntered.resolve()
+            await releaseHydration.promise
+            return loadSubset(...args)
+          }
+          coordinator.emit({
+            type: `collection:reset`,
+            schemaVersion: 1,
+            resetEpoch: 1,
+          })
+          hydration = Promise.resolve()
+        } else {
+          hydration = collection.stateWhenReady()
+        }
+        void hydration.catch(() => undefined)
+        await atPersistedOracleCheckpoint(
+          hydrationEntered.promise,
+          `${entry} hydration entered`,
+        )
 
-    if (boundary === `cleanup`) {
-      await atPersistedOracleCheckpoint(
-        collection.cleanup(),
-        `generated internal cleanup`,
-      )
-      cleanedUp = true
-      expectOpenTransactionBoundaryObservation(
-        {
-          status: collection.status,
-          pendingMarkers: collection._state.pendingSyncedTransactions.length,
-        },
-        boundary,
-      )
-      return
-    }
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `prefix`, title: `staged before abort` },
+        })
+        sourceParams.write({
+          type: `insert`,
+          value: {
+            get id() {
+              keyReads++
+              if (keyReads === 2) aborted.abort()
+              return `aborting`
+            },
+            title: `cancel before core application`,
+          },
+        })
+        abortedReceipt = Promise.resolve(
+          sourceParams.commit(aborted.signal),
+        ).then(() => undefined)
+        void abortedReceipt.catch(() => undefined)
 
-    if (boundary === `abort`) {
-      const abortController = new AbortController()
-      abortController.abort()
-      const receipt = Promise.resolve(
-        sourceParams.commit(abortController.signal),
-      ).then(() => undefined)
-      receipts.push(receipt)
-      void receipt.catch(() => undefined)
-      await expect(
-        atPersistedOracleCheckpoint(receipt, `generated internal abort`),
-      ).rejects.toMatchObject({ name: `AbortError` })
-      expectOpenTransactionBoundaryObservation(
-        {
-          status: collection.status,
-          pendingMarkers: collection._state.pendingSyncedTransactions.length,
-        },
-        boundary,
-      )
-      return
-    }
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `independent`, title: `survives abort` },
+        })
+        independentReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void independentReceipt.catch(() => undefined)
 
-    const terminalError = new Error(`generated terminal transaction failure`)
-    adapter.applyCommittedTx = () => Promise.reject(terminalError)
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: `terminal`, title: `published before failure` },
-    })
-    const externalReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(externalReceipt)
-    void externalReceipt.catch(() => undefined)
-    await expect(
-      atPersistedOracleCheckpoint(
-        externalReceipt,
-        `generated external terminal failure`,
-      ),
-    ).rejects.toMatchObject({
-      name: `PersistedCollectionDurabilityError`,
-      cause: terminalError,
-    })
+        releaseHydration.resolve()
+        const outcomes = await atPersistedOracleCheckpoint(
+          Promise.allSettled([hydration, abortedReceipt, independentReceipt]),
+          `${entry} buffered abort settled`,
+        )
+        const expected = foldDurabilityLedger([
+          { type: `begin`, transactionId: `aborted` },
+          {
+            type: `write`,
+            transactionId: `aborted`,
+            row: { id: `prefix`, title: `staged before abort` },
+          },
+          { type: `abort`, transactionId: `aborted` },
+          { type: `begin`, transactionId: `independent` },
+          {
+            type: `write`,
+            transactionId: `independent`,
+            row: { id: `independent`, title: `survives abort` },
+          },
+          { type: `commit`, transactionId: `independent` },
+        ])
 
-    const internalReceipt = Promise.resolve(sourceParams.commit()).then(
-      () => undefined,
-    )
-    receipts.push(internalReceipt)
-    void internalReceipt.catch(() => undefined)
-    await expect(
-      atPersistedOracleCheckpoint(
-        internalReceipt,
-        `generated terminal internal settlement`,
-      ),
-    ).rejects.toMatchObject({ name: `PersistedCollectionDurabilityError` })
-    expectOpenTransactionBoundaryObservation(
-      {
-        status: collection.status,
-        pendingMarkers: collection._state.pendingSyncedTransactions.length,
-      },
-      boundary,
-    )
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseHydration.resolve()
-    subscription.unsubscribe()
-    await cleanupPersistedOracle(
-      [
-        ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
-        () => (cleanedUp ? undefined : collection.cleanup()),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-}
-
-type RequestLocalFailureOperation = `partial-update` | `delete` | `insert`
-
-async function runRequestLocalFailureOperationLaw(
-  operation: RequestLocalFailureOperation,
-  baselineTitle: string,
-  sourceTitle: string,
-): Promise<void> {
-  const historyId = ++generatedOwnershipHistoryId
-  const baseline: Todo = {
-    id: `shared`,
-    title: baselineTitle,
-    detail: `required baseline detail`,
-  }
-  const inserted: Todo = {
-    id: baseline.id,
-    title: sourceTitle,
-    detail: `complete insert detail`,
-  }
-  const adapter = createRecordingAdapter(
-    operation === `insert` ? [] : [baseline],
-  )
-  const loadPersistedRows = adapter.loadSubset.bind(adapter)
-  const loadEntered = createEventGate()
-  const rejectLoad = createEventGate()
-  const loadFailure = new Error(
-    `generated request-local ${operation} load failure`,
-  )
-  let loadCalls = 0
-  adapter.loadSubset = async (...args) => {
-    loadCalls++
-    if (loadCalls === 1) {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw loadFailure
-    }
-    return loadPersistedRows(...args)
-  }
-  let sourceParams!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id: `generated-request-local-failure-${historyId}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        rowUpdateMode: `partial`,
-        sync: (params) => {
-          sourceParams = params
-          params.markReady()
-          return { loadSubset: () => true }
-        },
-      },
-      persistence: { adapter },
-    }),
-  )
-  const expectedRows =
-    operation === `delete`
-      ? []
-      : operation === `insert`
-        ? [inserted]
-        : [{ ...baseline, title: sourceTitle }]
-  let load: Promise<void> | undefined
-  let receipt: Promise<void> | undefined
-  let hasPrimaryFailure = false
-
-  try {
-    await atPersistedOracleCheckpoint(
-      collection.stateWhenReady(),
-      `generated request-local collection ready`,
-    )
-    load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-      () => undefined,
-    )
-    void load.catch(() => undefined)
-    await atPersistedOracleCheckpoint(
-      loadEntered.promise,
-      `generated request-local load entered`,
-    )
-
-    sourceParams.begin()
-    sourceParams.write(
-      operation === `delete`
-        ? { type: `delete`, key: baseline.id }
-        : operation === `insert`
-          ? { type: `insert`, value: inserted }
-          : {
-              type: `update`,
-              value: { id: baseline.id, title: sourceTitle } as Todo,
-            },
-    )
-    receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-    const receiptState = observeSettlement(receipt)
-    expect(receiptState.read()).toEqual({ status: `pending` })
-
-    rejectLoad.resolve()
-    await expect(
-      atPersistedOracleCheckpoint(load, `generated request-local rejection`),
-    ).rejects.toBe(loadFailure)
-    await atPersistedOracleCheckpoint(
-      receipt,
-      `generated request-local receipt settlement`,
-    )
-    expectRequestLocalFailureObservation(
-      {
-        receiptStatus: receiptState.read().status,
-        publicRows: sortedTodoRows(
-          [...collection.values()].map(stripVirtualProps),
-        ),
-        durableRows: sortedTodoRows(adapter.rows.values()),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      },
-      expectedRows,
-    )
-
-    await atPersistedOracleCheckpoint(
-      Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
-      `generated request-local retry`,
-    )
-    expectRequestLocalFailureObservation(
-      {
-        receiptStatus: receiptState.read().status,
-        publicRows: sortedTodoRows(
-          [...collection.values()].map(stripVirtualProps),
-        ),
-        durableRows: sortedTodoRows(adapter.rows.values()),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      },
-      expectedRows,
-    )
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    rejectLoad.resolve()
-    await cleanupPersistedOracle(
-      [
-        () => load?.catch(() => undefined),
-        () => receipt?.catch(() => undefined),
-        () => collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-}
-
-type GeneratedPersistenceHistory = {
-  axes: Array<string>
-  titles: Array<string>
-}
-
-type GeneratedPersistenceGrammar = {
-  property: string
-  axes: ReadonlyArray<string>
-  axisContribution: Readonly<Record<string, string>>
-  titleCount: number
-  witness: GeneratedPersistenceHistory
-}
-
-const sourceFifoOrderingAxes = [`same-key`, `disjoint`] as const
-const abortGraphAxes = [`independent`, `same-key`] as const
-const ownerIsolationAxes = [`write`, `commit`, `truncate`] as const
-const openTransactionBoundaryAxes = [
-  `abort`,
-  `cleanup`,
-  `terminal-failure`,
-] as const
-const requestLocalFailureAxes = [`partial-update`, `delete`, `insert`] as const
-const generatedTitleMaxLength = 12
-const generatedPersistenceFixedSeeds = {
-  sourceFifoOrdering: 18_530_101,
-  abortGraph: 18_530_102,
-  ownerIsolation: 18_530_103,
-  openTransactionBoundary: 18_530_104,
-  requestLocalFailure: 18_530_105,
-} as const
-
-const generatedPersistenceGrammars: ReadonlyArray<GeneratedPersistenceGrammar> =
-  [
-    {
-      property: `sqlite-persistence.source-fifo-order`,
-      axes: sourceFifoOrderingAxes,
-      axisContribution: {
-        [`same-key`]: `the later source value wins in source order`,
-        disjoint: `both unrelated values and receipts survive`,
-      },
-      titleCount: 2,
-      witness: {
-        axes: [`same-key`, `disjoint`],
-        titles: [`older`, `newer`],
-      },
-    },
-    {
-      property: `sqlite-persistence.abort-graph`,
-      axes: abortGraphAxes,
-      axisContribution: {
-        independent: `an unrelated sibling survives the abort`,
-        [`same-key`]: `a dependent suffix shares the predecessor failure`,
-      },
-      titleCount: 2,
-      witness: {
-        axes: [`independent`, `same-key`],
-        titles: [`predecessor`, `successor`],
-      },
-    },
-    {
-      property: `sqlite-persistence.owner-isolation`,
-      axes: ownerIsolationAxes,
-      axisContribution: {
-        write: `bare write rejects without publishing a stray row`,
-        commit: `bare commit rejects without settling another owner`,
-        truncate: `bare truncate rejects without clearing another owner`,
-      },
-      titleCount: 1,
-      witness: {
-        axes: [`write`, `commit`, `truncate`],
-        titles: [`queued`],
-      },
-    },
-    {
-      property: `sqlite-persistence.open-transaction-boundary`,
-      axes: openTransactionBoundaryAxes,
-      axisContribution: {
-        abort: `explicit abort leaves no core transaction`,
-        cleanup: `cleanup leaves no core transaction`,
-        [`terminal-failure`]: `fail-stop leaves no core transaction`,
-      },
-      titleCount: 1,
-      witness: {
-        axes: [`abort`, `cleanup`, `terminal-failure`],
-        titles: [`hydrated`],
-      },
-    },
-    {
-      property: `sqlite-persistence.request-local-failure-buffered-source`,
-      axes: requestLocalFailureAxes,
-      axisContribution: {
-        [`partial-update`]: `an unseen persisted baseline is reconstructed`,
-        delete: `a buffered delete settles without resurrection`,
-        insert: `a complete buffered insert settles without duplication`,
-      },
-      titleCount: 2,
-      witness: {
-        axes: [`partial-update`, `delete`, `insert`],
-        titles: [`baseline`, `source`],
-      },
-    },
-  ]
-
-function reconstructGeneratedPersistenceHistory(
-  grammar: GeneratedPersistenceGrammar,
-  history: GeneratedPersistenceHistory,
-): GeneratedPersistenceHistory {
-  const requiredAxes = new Set(grammar.axes)
-  const axesAreExact =
-    history.axes.length === grammar.axes.length &&
-    new Set(history.axes).size === grammar.axes.length &&
-    history.axes.every((axis) => requiredAxes.has(axis))
-  const titlesAreInRange =
-    history.titles.length === grammar.titleCount &&
-    history.titles.every(
-      (title) => [...title].length <= generatedTitleMaxLength,
-    )
-  if (!axesAreExact || !titlesAreInRange) {
-    throw new Error(
-      `invalid generated persistence history: ${grammar.property}`,
-    )
-  }
-  return {
-    axes: [...history.axes],
-    titles: [...history.titles],
-  }
-}
-
-function fullAxisOrder<Axis extends string>(
-  axes: ReadonlyArray<Axis>,
-): fc.Arbitrary<Array<Axis>> {
-  return fc.shuffledSubarray([...axes], {
-    minLength: axes.length,
-    maxLength: axes.length,
-  })
-}
-
-const generatedTitle = fc.string({ maxLength: generatedTitleMaxLength })
-
-type SourceFifoOrderingHistory = {
-  relations: Array<`same-key` | `disjoint`>
-  titles: [string, string]
-}
-
-type AbortGraphHistory = {
-  relationships: Array<`independent` | `same-key`>
-  titles: [string, string]
-}
-
-type OwnerIsolationHistory = {
-  operations: Array<`write` | `commit` | `truncate`>
-  queuedTitle: string
-}
-
-type OpenTransactionBoundaryHistory = {
-  boundaries: Array<`abort` | `cleanup` | `terminal-failure`>
-  hydratedTitle: string
-}
-
-type RequestLocalFailureHistory = {
-  operations: Array<RequestLocalFailureOperation>
-  titles: [string, string]
-}
-
-const sourceFifoOrderingHistory: fc.Arbitrary<SourceFifoOrderingHistory> =
-  fc.record({
-    relations: fullAxisOrder(sourceFifoOrderingAxes),
-    titles: fc.tuple(generatedTitle, generatedTitle),
-  })
-
-const abortGraphHistory: fc.Arbitrary<AbortGraphHistory> = fc.record({
-  relationships: fullAxisOrder(abortGraphAxes),
-  titles: fc.tuple(generatedTitle, generatedTitle),
-})
-
-const ownerIsolationHistory: fc.Arbitrary<OwnerIsolationHistory> = fc.record({
-  operations: fullAxisOrder(ownerIsolationAxes),
-  queuedTitle: generatedTitle,
-})
-
-const openTransactionBoundaryHistory: fc.Arbitrary<OpenTransactionBoundaryHistory> =
-  fc.record({
-    boundaries: fullAxisOrder(openTransactionBoundaryAxes),
-    hydratedTitle: generatedTitle,
-  })
-
-const requestLocalFailureHistory: fc.Arbitrary<RequestLocalFailureHistory> =
-  fc.record({
-    operations: fullAxisOrder(requestLocalFailureAxes),
-    titles: fc.tuple(generatedTitle, generatedTitle),
-  })
-
-function generatedPersistenceGrammarSamples(): ReadonlyArray<{
-  grammar: GeneratedPersistenceGrammar
-  histories: Array<GeneratedPersistenceHistory>
-}> {
-  const grammar = (property: string): GeneratedPersistenceGrammar => {
-    const match = generatedPersistenceGrammars.find(
-      (candidate) => candidate.property === property,
-    )
-    if (match === undefined) throw new Error(`missing grammar: ${property}`)
-    return match
-  }
-  const sampleOptions = (seed: number) => ({ seed, numRuns: oracleRuns(4) })
-  return [
-    {
-      grammar: grammar(`sqlite-persistence.source-fifo-order`),
-      histories: fc
-        .sample(
-          sourceFifoOrderingHistory,
-          sampleOptions(generatedPersistenceFixedSeeds.sourceFifoOrdering),
-        )
-        .map((history) => ({
-          axes: history.relations,
-          titles: [...history.titles],
-        })),
-    },
-    {
-      grammar: grammar(`sqlite-persistence.abort-graph`),
-      histories: fc
-        .sample(
-          abortGraphHistory,
-          sampleOptions(generatedPersistenceFixedSeeds.abortGraph),
-        )
-        .map((history) => ({
-          axes: history.relationships,
-          titles: [...history.titles],
-        })),
-    },
-    {
-      grammar: grammar(`sqlite-persistence.owner-isolation`),
-      histories: fc
-        .sample(
-          ownerIsolationHistory,
-          sampleOptions(generatedPersistenceFixedSeeds.ownerIsolation),
-        )
-        .map((history) => ({
-          axes: history.operations,
-          titles: [history.queuedTitle],
-        })),
-    },
-    {
-      grammar: grammar(`sqlite-persistence.open-transaction-boundary`),
-      histories: fc
-        .sample(
-          openTransactionBoundaryHistory,
-          sampleOptions(generatedPersistenceFixedSeeds.openTransactionBoundary),
-        )
-        .map((history) => ({
-          axes: history.boundaries,
-          titles: [history.hydratedTitle],
-        })),
-    },
-    {
-      grammar: grammar(
-        `sqlite-persistence.request-local-failure-buffered-source`,
-      ),
-      histories: fc
-        .sample(
-          requestLocalFailureHistory,
-          sampleOptions(generatedPersistenceFixedSeeds.requestLocalFailure),
-        )
-        .map((history) => ({
-          axes: history.operations,
-          titles: [...history.titles],
-        })),
-    },
-  ]
-}
-
-async function runGeneratedSourceFifoOrderingHistory(
-  history: SourceFifoOrderingHistory,
-): Promise<void> {
-  for (const relation of history.relations) {
-    await runSourceFifoOrderingLaw(
-      relation,
-      history.titles[0],
-      history.titles[1],
-    )
-  }
-}
-
-async function runGeneratedAbortGraphHistory(
-  history: AbortGraphHistory,
-): Promise<void> {
-  for (const relationship of history.relationships) {
-    await runAbortRelationshipLaw(
-      relationship,
-      history.titles[0],
-      history.titles[1],
-    )
-  }
-}
-
-async function runGeneratedOwnerIsolationHistory(
-  history: OwnerIsolationHistory,
-): Promise<void> {
-  for (const operation of history.operations) {
-    await runBareOwnerOperationLaw(operation, history.queuedTitle)
-  }
-}
-
-async function runGeneratedOpenTransactionBoundaryHistory(
-  history: OpenTransactionBoundaryHistory,
-): Promise<void> {
-  for (const boundary of history.boundaries) {
-    await runInternalOpenTransactionBoundaryLaw(boundary, history.hydratedTitle)
-  }
-}
-
-async function runGeneratedRequestLocalFailureHistory(
-  history: RequestLocalFailureHistory,
-): Promise<void> {
-  for (const operation of history.operations) {
-    await runRequestLocalFailureOperationLaw(
-      operation,
-      history.titles[0],
-      history.titles[1],
-    )
-  }
-}
-
-function registerGeneratedPersistenceProperty<Value>(options: {
-  property: string
-  title: string
-  arbitrary: fc.Arbitrary<Value>
-  fixedSeed: number
-  run: (value: Value) => Promise<void>
-}): void {
-  const { property, title, arbitrary, fixedSeed, run } = options
-  oracleReplayTest(fcTest).prop([arbitrary], {
-    seed: fixedSeed,
-    numRuns: oracleRuns(4),
-  })(`${title} (fixed)`, run)
-  oracleReplayTest(fcTest, property).prop(
-    [arbitrary],
-    oraclePropertyOptions(4, property),
-  )(`${title} (random)`, run)
-}
-
-const describeDurabilityOracles = oracleReplayTest(
-  describe,
-  `sqlite-persistence.source-fifo-order`,
-  `sqlite-persistence.abort-graph`,
-  `sqlite-persistence.owner-isolation`,
-  `sqlite-persistence.open-transaction-boundary`,
-  `sqlite-persistence.request-local-failure-buffered-source`,
-)
-
-describeDurabilityOracles(`generated persistence durability oracles`, () => {
-  if (!oracleReplayRequested()) {
-    it(`reconstructs the full grammar and rejects ablated, out-of-range, and foreign histories`, () => {
-      for (const {
-        grammar,
-        histories,
-      } of generatedPersistenceGrammarSamples()) {
-        for (const history of histories) {
-          expect(
-            reconstructGeneratedPersistenceHistory(grammar, history),
-          ).toEqual(history)
-        }
-      }
-
-      for (const grammar of generatedPersistenceGrammars) {
-        expect(Object.keys(grammar.axisContribution).sort()).toEqual(
-          [...grammar.axes].sort(),
-        )
-        for (const contribution of Object.values(grammar.axisContribution)) {
-          expect(contribution).not.toBe(``)
-        }
-        expect(
-          reconstructGeneratedPersistenceHistory(grammar, grammar.witness),
-        ).toEqual(grammar.witness)
-
-        for (const omittedAxis of grammar.axes) {
-          expect(() =>
-            reconstructGeneratedPersistenceHistory(grammar, {
-              ...grammar.witness,
-              axes: grammar.witness.axes.filter((axis) => axis !== omittedAxis),
-            }),
-          ).toThrow(`invalid generated persistence history`)
-        }
-
-        expect(
-          reconstructGeneratedPersistenceHistory(grammar, {
-            axes: [...grammar.axes],
-            titles: Array.from({ length: grammar.titleCount }, () =>
-              `x`.repeat(generatedTitleMaxLength),
-            ),
-          }).titles,
-        ).toEqual(
-          Array.from({ length: grammar.titleCount }, () =>
-            `x`.repeat(generatedTitleMaxLength),
-          ),
-        )
-        expect(
-          reconstructGeneratedPersistenceHistory(grammar, {
-            axes: [...grammar.axes],
-            titles: Array.from({ length: grammar.titleCount }, () => ``),
-          }).titles,
-        ).toEqual(Array.from({ length: grammar.titleCount }, () => ``))
-        expect(() =>
-          reconstructGeneratedPersistenceHistory(grammar, {
-            axes: [...grammar.axes],
-            titles: [
-              `x`.repeat(generatedTitleMaxLength + 1),
-              ...Array.from(
-                { length: Math.max(0, grammar.titleCount - 1) },
-                () => ``,
-              ),
-            ],
-          }),
-        ).toThrow(`invalid generated persistence history`)
-        expect(() =>
-          reconstructGeneratedPersistenceHistory(grammar, {
-            ...grammar.witness,
-            axes: grammar.axes.map((axis, index) =>
-              index === grammar.axes.length - 1 ? grammar.axes[0]! : axis,
-            ),
-          }),
-        ).toThrow(`invalid generated persistence history`)
-        expect(() =>
-          reconstructGeneratedPersistenceHistory(grammar, {
-            ...grammar.witness,
-            axes: [...grammar.axes.slice(0, -1), `foreign-axis`],
-          }),
-        ).toThrow(`invalid generated persistence history`)
-      }
-    })
-
-    it.each([
-      {
-        name: `source-fifo-order older same-key value wins`,
-        reject: () =>
-          expectSourceFifoOrderingObservation(
-            {
-              publicRows: [{ id: `shared`, title: `older` }],
-              durableRows: [{ id: `shared`, title: `older` }],
-              status: `ready`,
-              pendingMarkers: 0,
-            },
-            [{ id: `shared`, title: `newer` }],
-          ),
-      },
-      {
-        name: `abort-graph independent sibling inherits the abort`,
-        reject: () =>
-          expectAbortGraphObservation(
-            {
-              predecessorStatus: `rejected`,
-              predecessorName: `AbortError`,
-              successorStatus: `rejected`,
-              sameFailure: true,
-              status: `crashed`,
-              publicSuccessor: undefined,
-              durableSuccessor: undefined,
-              pendingMarkers: 0,
-            },
-            `independent`,
-            `survivor`,
-            `must survive`,
-          ),
-      },
-      {
-        name: `owner-isolation bare write steals and publishes a queued marker`,
-        reject: () =>
-          expectOwnerIsolationAdmission({
-            exactError: false,
-            strayVisible: true,
-          }),
-      },
-      {
-        name: `open-transaction boundary leaks one core marker`,
-        reject: () =>
-          expectOpenTransactionBoundaryObservation(
-            { status: `crashed`, pendingMarkers: 1 },
-            `terminal-failure`,
-          ),
-      },
-      {
-        name: `request-local partial update drops the unseen baseline field`,
-        reject: () =>
-          expectRequestLocalFailureObservation(
-            {
-              receiptStatus: `fulfilled`,
-              publicRows: [{ id: `shared`, title: `source` }],
-              durableRows: [
-                {
-                  id: `shared`,
-                  title: `source`,
-                  detail: `required baseline detail`,
-                },
-              ],
-              status: `ready`,
-              publicError: undefined,
-            },
-            [
-              {
-                id: `shared`,
-                title: `source`,
-                detail: `required baseline detail`,
-              },
-            ],
-          ),
-      },
-    ])(`rejects named wrong answer: $name`, ({ reject }) => {
-      expect(reject).toThrow()
-    })
-  }
-
-  registerGeneratedPersistenceProperty({
-    property: `sqlite-persistence.source-fifo-order`,
-    title: `serialized histories preserve source order and settle every receipt`,
-    arbitrary: sourceFifoOrderingHistory,
-    fixedSeed: generatedPersistenceFixedSeeds.sourceFifoOrdering,
-    run: runGeneratedSourceFifoOrderingHistory,
-  })
-  registerGeneratedPersistenceProperty({
-    property: `sqlite-persistence.abort-graph`,
-    title: `abort graphs preserve independent siblings and reject dependent suffixes`,
-    arbitrary: abortGraphHistory,
-    fixedSeed: generatedPersistenceFixedSeeds.abortGraph,
-    run: runGeneratedAbortGraphHistory,
-  })
-  registerGeneratedPersistenceProperty({
-    property: `sqlite-persistence.owner-isolation`,
-    title: `bare operations cannot capture another owner's transaction`,
-    arbitrary: ownerIsolationHistory,
-    fixedSeed: generatedPersistenceFixedSeeds.ownerIsolation,
-    run: runGeneratedOwnerIsolationHistory,
-  })
-  registerGeneratedPersistenceProperty({
-    property: `sqlite-persistence.open-transaction-boundary`,
-    title: `open transaction boundaries leave no core marker`,
-    arbitrary: openTransactionBoundaryHistory,
-    fixedSeed: generatedPersistenceFixedSeeds.openTransactionBoundary,
-    run: runGeneratedOpenTransactionBoundaryHistory,
-  })
-  registerGeneratedPersistenceProperty({
-    property: `sqlite-persistence.request-local-failure-buffered-source`,
-    title: `request-local load failure preserves buffered source semantics`,
-    arbitrary: requestLocalFailureHistory,
-    fixedSeed: generatedPersistenceFixedSeeds.requestLocalFailure,
-    run: runGeneratedRequestLocalFailureHistory,
-  })
-})
-
-async function createTerminalFailureHarness(
-  kind: `hydration` | `durability`,
-  id: string,
-) {
-  const seed = { id: `seed`, title: `stable before terminal failure` }
-  const adapter = createRecordingAdapter([seed])
-  adapter.rowMetadata.set(seed.id, `row-metadata-before-failure`)
-  adapter.collectionMetadata.set(`resume`, `collection-metadata-before-failure`)
-  const coordinator = createFailStopCoordinatorHarness(id)
-  const upstreamLoads: Array<LoadSubsetOptions> = []
-  const upstreamUnloads: Array<LoadSubsetOptions> = []
-  let sourceParams!: TodoSyncParams
-  const collection = createCollection(
-    persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          sourceParams = params
-          params.markReady()
-          return {
-            loadSubset: (options) => {
-              upstreamLoads.push(options)
-              return true
-            },
-            unloadSubset: (options) => {
-              upstreamUnloads.push(options)
-            },
-          }
-        },
-      },
-      persistence: { adapter, coordinator },
-    }),
-  )
-  const initialLease: LoadSubsetOptions = { limit: 1 }
-  await atPersistedOracleCheckpoint(
-    collection.stateWhenReady(),
-    `${id} initially ready`,
-  )
-  await atPersistedOracleCheckpoint(
-    Promise.resolve(collection._sync.loadSubset(initialLease)),
-    `${id} initial lease hydrated`,
-  )
-  await flushAsyncWork()
-
-  let terminalError: unknown
-  if (kind === `hydration`) {
-    const hydrationError = new Error(`${id} terminal hydration failure`)
-    adapter.loadSubset = () => Promise.reject(hydrationError)
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `${id}-failed-full-reload`,
-      latestRowVersion: 1,
-      requiresFullReload: true,
-      changedRows: [],
-      deletedKeys: [],
-    })
-    await vi.waitFor(() =>
-      expect(collection._lifecycle.getSyncError()).toBe(hydrationError),
-    )
-    terminalError = hydrationError
-  } else {
-    const adapterError = Object.assign(new Error(`${id} storage failure`), {
-      code: `SQLITE_FULL`,
-      path: `adapter.applyCommittedTx`,
-    })
-    coordinator.requestApplyCommittedTx = () =>
-      Promise.reject(
-        new PersistedCollectionDurabilityError(
-          `Failed to durably persist collection "${id}"`,
-          {
-            cause: adapterError,
-            code: adapterError.code,
-            path: adapterError.path,
-          },
-        ),
-      )
-    sourceParams.begin()
-    sourceParams.write({
-      type: `insert`,
-      value: { id: `first`, title: `published before terminal failure` },
-    })
-    const outcome = await atPersistedOracleCheckpoint(
-      Promise.resolve(sourceParams.commit()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      ),
-      `${id} durability failure settled`,
-    )
-    expect(outcome.status).toBe(`rejected`)
-    terminalError = outcome.status === `rejected` ? outcome.reason : undefined
-    expect(terminalError).toBeInstanceOf(PersistedCollectionDurabilityError)
-    expect(
-      terminalError instanceof Error ? terminalError.cause : undefined,
-    ).toBe(adapterError)
-  }
-
-  expect(collection.status).toBe(`crashed`)
-  expect(collection._lifecycle.getSyncError()).toBe(terminalError)
-
-  return {
-    adapter,
-    collection,
-    coordinator,
-    initialLease,
-    seed,
-    sourceParams,
-    terminalError,
-    upstreamLoads,
-    upstreamUnloads,
-  }
-}
-
-describeUnlessOracleReplay(`persistedCollectionOptions`, () => {
-  // A descriptor's one-owner claim is consumed by a constructed Collection,
-  // not by a constructor attempt that failed before binding the runtime.
-  // The independent admission model has unclaimed and claimed states; this
-  // invalid-then-corrected history must remain unclaimed after the first
-  // throw. The checkpoint is the second createCollection call and its later
-  // durable write. A successful first construction is checked below.
-  it(`permits a corrected descriptor after construction fails before owner binding`, async () => {
-    const adapter = createRecordingAdapter()
-    const options = persistedCollectionOptions<Todo, string>({
-      id: `failed-construction-retry`,
-      getKey: (row) => row.id,
-      autoIndex: `eager`,
-      persistence: { adapter },
-    })
-    expect(() => createCollection(options)).toThrow(/autoIndex/)
-    options.defaultIndexType = BasicIndex
-    const collection = createCollection(options)
-    let unexpectedThird: typeof collection | undefined
-    let hasPrimaryFailure = false
-    try {
-      await collection.stateWhenReady()
-      expect(() => {
-        unexpectedThird = createCollection(options)
-      }).toThrow(InvalidPersistedCollectionConfigError)
-      const receipt = collection.insert({ id: `owned`, title: `Retried owner` })
-      await receipt.isPersisted.promise
-      expect(stripVirtualProps(collection.get(`owned`))).toEqual({
-        id: `owned`,
-        title: `Retried owner`,
-      })
-      expect(adapter.rows.get(`owned`)).toEqual({
-        id: `owned`,
-        title: `Retried owner`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => unexpectedThird?.cleanup(), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // Law: only a successfully constructed Collection consumes an options
-  // descriptor. The same unclaimed -> claimed admission model applies if a
-  // synchronous collaborator fails after sync startup begins. The first
-  // attempt must expose that failure; after correction, the same descriptor
-  // must construct and persist normally. This tests the public constructor
-  // and durability receipt, rather than inspecting the private claim flag.
-  // Both local-only and wrapped-source startup bind through distinct paths.
-  // A subscription ledger checks that the failed attempt has no live listener,
-  // the corrected owner has one, and cleanup releases it.
-  it.each([`local-only`, `wrapped source`] as const)(
-    `permits a corrected %s descriptor after sync-start construction fails`,
-    async (mode) => {
-      const adapter = createRecordingAdapter()
-      const coordinator = createCoordinatorHarness()
-      coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
-        await adapter.applyCommittedTx({ kind: `eager`, collectionId }, tx)
-        return {
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }
-      }
-      const subscribe = coordinator.subscribe.bind(coordinator)
-      const fault = new Error(`coordinator subscription failed`)
-      let failSubscription = true
-      let activeSubscriptions = 0
-      coordinator.subscribe = (...args) => {
-        if (failSubscription) throw fault
-        const unsubscribe = subscribe(...args)
-        activeSubscriptions++
-        return () => {
-          activeSubscriptions--
-          unsubscribe()
-        }
-      }
-      const base = {
-        id: `failed-sync-start-construction-retry-${mode}`,
-        getKey: (row: Todo) => row.id,
-        startSync: true as const,
-        persistence: { adapter, coordinator },
-      }
-      let source!: TodoSyncParams
-      const construct =
-        mode === `wrapped source`
-          ? (() => {
-              const options = persistedCollectionOptions<Todo, string>({
-                ...base,
-                sync: {
-                  sync: (params) => {
-                    source = params
-                    params.markReady()
-                  },
-                },
-              })
-              return () => createCollection(options)
-            })()
-          : (() => {
-              const options = persistedCollectionOptions<Todo, string>(base)
-              return () => createCollection(options)
-            })()
-      expect(construct).toThrow(fault)
-      expect(activeSubscriptions).toBe(0)
-      failSubscription = false
-      const collection = construct()
-      let unexpectedThird: typeof collection | undefined
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        expect(activeSubscriptions).toBe(1)
-        if (mode === `wrapped source`) await flushAsyncWork()
-        expect(() => {
-          unexpectedThird = construct()
-        }).toThrow(InvalidPersistedCollectionConfigError)
-        const row = { id: `owned`, title: `Retried owner` }
-        if (mode === `wrapped source`) {
-          source.begin()
-          source.write({ type: `insert`, value: row })
-          await source.commit()
-        } else {
-          await collection.insert(row).isPersisted.promise
-        }
-        expect(stripVirtualProps(collection.get(`owned`))).toEqual({
-          id: `owned`,
-          title: `Retried owner`,
-        })
-        expect(adapter.rows.get(`owned`)).toEqual({
-          id: `owned`,
-          title: `Retried owner`,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [
-            () => unexpectedThird?.cleanup(),
-            () => collection.cleanup(),
-            () => {
-              expect(activeSubscriptions).toBe(0)
-            },
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // A persisted options descriptor owns one mutable runtime. The independent
-  // ownership rule is one Collection per descriptor, including a spread copy:
-  // copying fields cannot create a second runtime. The public creation boundary
-  // must reject the second Collection before it can redirect the first one's
-  // writes. Fresh descriptors remain legal and are covered elsewhere here and
-  // by DbClient materialization. The checkpoint is createCollection itself,
-  // then the first owner's durable receipt and public row after the rejection.
-  it.each([`same object`, `spread copy`] as const)(
-    `keeps one persisted options runtime bound to its first Collection (%s)`,
-    async (reuse) => {
-      const adapter = createRecordingAdapter()
-      const options = persistedCollectionOptions<Todo, string>({
-        id: `one-owner-${reuse}`,
-        getKey: (row) => row.id,
-        persistence: { adapter },
-      })
-      const first = createCollection(options)
-      let second: typeof first | undefined
-      let hasPrimaryFailure = false
-      try {
-        await first.stateWhenReady()
-        expect(() => {
-          second = createCollection(
-            reuse === `same object` ? options : { ...options },
-          )
-        }).toThrow(InvalidPersistedCollectionConfigError)
-
-        const receipt = first.insert({ id: `owned`, title: `First owner` })
-        await receipt.isPersisted.promise
-        expect(stripVirtualProps(first.get(`owned`))).toEqual({
-          id: `owned`,
-          title: `First owner`,
-        })
-        expect(adapter.rows.get(`owned`)).toEqual({
-          id: `owned`,
-          title: `First owner`,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => second?.cleanup(), () => first.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // The same ownership rule applies when an upstream sync source is wrapped.
-  // A source commit through the first Collection must remain public and durable
-  // after a second Collection is rejected at admission.
-  it.each([`same object`, `spread copy`] as const)(
-    `keeps a wrapped sync source bound to its first Collection (%s)`,
-    async (reuse) => {
-      const adapter = createRecordingAdapter()
-      let source!: TodoSyncParams
-      const options = persistedCollectionOptions<Todo, string>({
-        id: `one-source-owner-${reuse}`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      })
-      const first = createCollection(options)
-      let second: typeof first | undefined
-      let hasPrimaryFailure = false
-      try {
-        await first.stateWhenReady()
-        expect(() => {
-          second = createCollection(
-            reuse === `same object` ? options : { ...options },
-          )
-        }).toThrow(InvalidPersistedCollectionConfigError)
-
-        source.begin()
-        source.write({
-          type: `insert`,
-          value: { id: `owned`, title: `First source` },
-        })
-        await Promise.resolve(source.commit())
-        expect(stripVirtualProps(first.get(`owned`))).toEqual({
-          id: `owned`,
-          title: `First source`,
-        })
-        expect(adapter.rows.get(`owned`)).toEqual({
-          id: `owned`,
-          title: `First source`,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => second?.cleanup(), () => first.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Selecting only the public sync config bypasses the descriptor's claim.
-  // The runtime's fallback guard must reject that second Collection before
-  // changing the first owner's controls. This is a legal JavaScript copy of
-  // the exposed config, not a second independent persisted options runtime.
-  it.each([`local-only`, `sync-present`] as const)(
-    `preserves the first owner after a copied sync config is rejected (%s)`,
-    async (mode) => {
-      const adapter = createRecordingAdapter()
-      let source!: TodoSyncParams
-      const base = {
-        id: `selected-sync-${mode}`,
-        getKey: (row: Todo) => row.id,
-        persistence: { adapter },
-      }
-      const options =
-        mode === `sync-present`
-          ? persistedCollectionOptions<Todo, string>({
-              ...base,
-              sync: {
-                sync: (params) => {
-                  source = params
-                  params.markReady()
-                },
-              },
-            })
-          : persistedCollectionOptions<Todo, string>(base)
-      const first = createCollection(options)
-      const second = createCollection({
-        id: `unclaimed-${mode}`,
-        getKey: (row: Todo) => row.id,
-        sync: options.sync,
-        startSync: false,
-      })
-      let hasPrimaryFailure = false
-      try {
-        await first.stateWhenReady()
-        if (mode === `sync-present`) {
-          source.begin()
-          source.write({
-            type: `insert`,
-            value: { id: `owned`, title: `First source` },
-          })
-        }
-        expect(() => second.startSyncImmediate()).toThrow(
-          InvalidPersistedCollectionConfigError,
-        )
-
-        if (mode === `sync-present`) {
-          await Promise.resolve(source.commit())
-        } else {
-          await first.insert({ id: `owned`, title: `First owner` }).isPersisted
-            .promise
-        }
-        expect(first.has(`owned`)).toBe(true)
-        expect(second.has(`owned`)).toBe(false)
-        expect(adapter.rows.get(`owned`)?.id).toBe(`owned`)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => second.cleanup(), () => first.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Construction, rather than first sync startup, assigns the descriptor's
-  // Collection owner. A lazy wrapped source leaves a legal interval in which a
-  // second Collection can select only its public sync field and start first.
-  // The independent admission rule still gives the first constructed owner
-  // the runtime; the selected copy must fail before it installs controls.
-  it(`rejects a selected sync that starts before its lazy descriptor owner`, async () => {
-    const adapter = createRecordingAdapter()
-    let source!: TodoSyncParams
-    const options = persistedCollectionOptions<Todo, string>({
-      id: `lazy-selected-sync-owner`,
-      getKey: (row) => row.id,
-      startSync: false,
-      sync: {
-        sync: (params) => {
-          source = params
-          params.markReady()
-        },
-      },
-      persistence: { adapter },
-    })
-    const first = createCollection(options)
-    const selected = createCollection({
-      id: `lazy-selected-sync-copy`,
-      getKey: (row: Todo) => row.id,
-      sync: options.sync,
-      startSync: false,
-    })
-    let hasPrimaryFailure = false
-    try {
-      expect(() => selected.startSyncImmediate()).toThrow(
-        InvalidPersistedCollectionConfigError,
-      )
-      first.startSyncImmediate()
-      await first.stateWhenReady()
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `owned`, title: `Original owner` },
-      })
-      await Promise.resolve(source.commit())
-      expect(stripVirtualProps(first.get(`owned`))).toEqual({
-        id: `owned`,
-        title: `Original owner`,
-      })
-      expect(selected.has(`owned`)).toBe(false)
-      expect(adapter.rows.get(`owned`)).toEqual({
-        id: `owned`,
-        title: `Original owner`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => selected.cleanup(), () => first.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not reuse a persisted runtime after its Collection cleans up`, async () => {
-    const options = persistedCollectionOptions<Todo, string>({
-      id: `cleaned-up-owner`,
-      getKey: (row) => row.id,
-      persistence: { adapter: createRecordingAdapter() },
-    })
-    const first = createCollection(options)
-    await first.cleanup()
-    expect(() => createCollection(options)).toThrow(
-      InvalidPersistedCollectionConfigError,
-    )
-  })
-
-  // Cleanup ends a sync run, not the descriptor's permanent Collection claim.
-  // Selecting only the wrapped sync field omits the public claim hook, so this
-  // history checks the runtime guard after cleanup and the original owner's
-  // ability to restart. The two modes cross local and upstream source controls.
-  it.each([`local-only`, `sync-present`] as const)(
-    `rejects a copied sync owner after cleanup and permits the first owner to restart (%s)`,
-    async (mode) => {
-      const adapter = createRecordingAdapter()
-      let source!: TodoSyncParams
-      const base = {
-        id: `cleaned-selected-sync-${mode}`,
-        getKey: (row: Todo) => row.id,
-        persistence: { adapter },
-      }
-      const options =
-        mode === `sync-present`
-          ? persistedCollectionOptions<Todo, string>({
-              ...base,
-              sync: {
-                sync: (params) => {
-                  source = params
-                  params.markReady()
-                },
-              },
-            })
-          : persistedCollectionOptions<Todo, string>(base)
-      const first = createCollection(options)
-      const second = createCollection({
-        id: `post-cleanup-copy-${mode}`,
-        getKey: (row: Todo) => row.id,
-        sync: options.sync,
-        startSync: false,
-      })
-      let hasPrimaryFailure = false
-      try {
-        await first.stateWhenReady()
-        await first.cleanup()
-        expect(() => second.startSyncImmediate()).toThrow(
-          InvalidPersistedCollectionConfigError,
-        )
-
-        const replacementReady = createEventGate()
-        const unsubscribe = first.on(`status:ready`, () =>
-          replacementReady.resolve(),
-        )
-        try {
-          first.startSyncImmediate()
-          await atPersistedOracleCheckpoint(
-            replacementReady.promise,
-            `original persisted owner restarts`,
-          )
-        } finally {
-          unsubscribe()
-        }
-
-        if (mode === `sync-present`) {
-          source.begin()
-          source.write({
-            type: `insert`,
-            value: { id: `after-restart`, title: `First source` },
-          })
-          await Promise.resolve(source.commit())
-        } else {
-          await first.insert({ id: `after-restart`, title: `First owner` })
-            .isPersisted.promise
-        }
-        expect(first.has(`after-restart`)).toBe(true)
-        expect(second.has(`after-restart`)).toBe(false)
-        expect(adapter.rows.get(`after-restart`)?.id).toBe(`after-restart`)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => second.cleanup(), () => first.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`materializes one independent persisted runtime for each DbClient`, async () => {
-    const adapter = createRecordingAdapter([{ id: `stored`, title: `Stored` }])
-    const descriptor = collectionOptions(
-      persistedCollectionOptions<Todo, string>({
-        id: `client-owned-persistence`,
-        getKey: (row) => row.id,
-        persistence: { adapter },
-      }),
-    )
-    const firstClient = new DbClient()
-    const secondClient = new DbClient()
-    let hasPrimaryFailure = false
-    try {
-      const first = firstClient.collection(descriptor)
-      const second = secondClient.collection(descriptor)
-      expect(first).not.toBe(second)
-      await Promise.all([first.stateWhenReady(), second.stateWhenReady()])
-      expect(stripVirtualProps(first.get(`stored`))).toEqual({
-        id: `stored`,
-        title: `Stored`,
-      })
-      expect(stripVirtualProps(second.get(`stored`))).toEqual({
-        id: `stored`,
-        title: `Stored`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => secondClient.cleanup(), () => firstClient.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`preserves exact reconciliation context for an indeterminate commit`, () => {
-    const cause = new Error(`response channel closed`)
-    const error = new IndeterminateCommitError({
-      collectionId: `todos`,
-      requestType: `rpc:applyCommittedTx:req`,
-      previousLeaderId: `leader-a`,
-      previousTerm: 4,
-      currentLeaderId: `leader-b`,
-      currentTerm: 5,
-      cause,
-    })
-
-    expect(error).toMatchObject({
-      name: `IndeterminateCommitError`,
-      code: `INDETERMINATE_COMMIT`,
-      collectionId: `todos`,
-      requestType: `rpc:applyCommittedTx:req`,
-      previousLeaderId: `leader-a`,
-      previousTerm: 4,
-      currentLeaderId: `leader-b`,
-      currentTerm: 5,
-      cause,
-    })
-    expect(error.message).toContain(
-      `rpc:applyCommittedTx:req crossed leadership from leader-a (term 4) to leader-b (term 5)`,
-    )
-  })
-
-  it(`provides a sync-absent loopback configuration with persisted utils`, async () => {
-    const adapter = createRecordingAdapter()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `persisted-loopback`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    const insertTx = collection.insert({
-      id: `1`,
-      title: `Phase 0`,
-    })
-
-    await insertTx.isPersisted.promise
-
-    expect(stripVirtualProps(collection.get(`1`))).toEqual({
-      id: `1`,
-      title: `Phase 0`,
-    })
-    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-    expect(adapter.applyCommittedTxCalls[0]?.tx.mutations[0]?.type).toBe(
-      `insert`,
-    )
-    expect(typeof collection.utils.acceptMutations).toBe(`function`)
-    expect(collection.utils.getLeadershipState?.().isLeader).toBe(true)
-  })
-
-  it(`hydrates a local-only baseline after a managed write advances startup evidence`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `baseline`, title: `Persisted before startup` },
-    ])
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    let releaseInitialSnapshot!: () => void
-    const initialSnapshotRelease = new Promise<void>((resolve) => {
-      releaseInitialSnapshot = resolve
-    })
-    let reportInitialSnapshot!: () => void
-    const initialSnapshotCaptured = new Promise<void>((resolve) => {
-      reportInitialSnapshot = resolve
-    })
-    let snapshotCalls = 0
-    adapter.loadResumeSnapshot = async (...args) => {
-      const snapshot = await loadResumeSnapshot(...args)
-      snapshotCalls++
-      if (snapshotCalls === 1) {
-        reportInitialSnapshot()
-        await initialSnapshotRelease
-      }
-      return snapshot
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `local-only-startup-write`,
-        startSync: false,
-        getKey: (item) => item.id,
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await initialSnapshotCaptured
-
-      const insert = collection.insert({
-        id: `concurrent`,
-        title: `Managed during startup`,
-      })
-      releaseInitialSnapshot()
-      await insert.isPersisted.promise
-      await collection.stateWhenReady()
-      await vi.waitFor(() => expect(snapshotCalls).toBeGreaterThanOrEqual(2))
-
-      expect(
-        Array.from(collection.values(), (row) => stripVirtualProps(row)).sort(
-          (left, right) => left.id.localeCompare(right.id),
-        ),
-      ).toEqual([
-        { id: `baseline`, title: `Persisted before startup` },
-        { id: `concurrent`, title: `Managed during startup` },
-      ])
-    } finally {
-      releaseInitialSnapshot()
-      await collection.cleanup()
-    }
-  })
-
-  it(`supports acceptMutations for manual transactions`, async () => {
-    const adapter = createRecordingAdapter()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `persisted-manual`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    const tx = createTransaction({
-      autoCommit: false,
-      mutationFn: async ({ transaction }) => {
-        await collection.utils.acceptMutations(transaction)
-      },
-    })
-
-    tx.mutate(() => {
-      collection.insert({
-        id: `manual-1`,
-        title: `Manual`,
-      })
-    })
-
-    await tx.commit()
-
-    expect(stripVirtualProps(collection.get(`manual-1`))).toEqual({
-      id: `manual-1`,
-      title: `Manual`,
-    })
-    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-  })
-
-  it(`loads collection metadata into collection state during startup`, async () => {
-    const adapter = createRecordingAdapter()
-    adapter.collectionMetadata.set(`electric:resume`, {
-      kind: `resume`,
-      offset: `10_0`,
-      handle: `handle-1`,
-      shapeId: `shape-1`,
-      updatedAt: 1,
-    })
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `persisted-startup-metadata`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    await collection.stateWhenReady()
-
-    expect(adapter.loadResumeSnapshotCalls[0]).toMatchObject({
-      collectionId: `persisted-startup-metadata`,
-      includeRows: false,
-    })
-    expect(
-      collection._state.syncedCollectionMetadata.get(`electric:resume`),
-    ).toEqual({
-      kind: `resume`,
-      offset: `10_0`,
-      handle: `handle-1`,
-      shapeId: `shape-1`,
-      updatedAt: 1,
-    })
-  })
-
-  it(`restores row and collection metadata after metadata-bearing full reload`, async () => {
-    const adapter = createRecordingAdapter([
-      {
-        id: `1`,
-        title: `Tracked`,
-      },
-    ])
-    adapter.rowMetadata.set(`1`, {
-      source: `initial`,
-    })
-    adapter.collectionMetadata.set(`electric:resume`, {
-      kind: `resume`,
-      offset: `10_0`,
-      handle: `handle-1`,
-      shapeId: `shape-1`,
-      updatedAt: 1,
-    })
-    const coordinator = createCoordinatorHarness()
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-
-    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
-      source: `initial`,
-    })
-    expect(
-      collection._state.syncedCollectionMetadata.get(`electric:resume`),
-    ).toEqual({
-      kind: `resume`,
-      offset: `10_0`,
-      handle: `handle-1`,
-      shapeId: `shape-1`,
-      updatedAt: 1,
-    })
-
-    adapter.rowMetadata.set(`1`, {
-      source: `reloaded`,
-    })
-    adapter.collectionMetadata.delete(`electric:resume`)
-    adapter.collectionMetadata.set(`queryCollection:gc:q1`, {
-      queryHash: `q1`,
-      mode: `until-revalidated`,
-    })
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-reload`,
-      latestRowVersion: 1,
-      requiresFullReload: true,
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
-      source: `reloaded`,
-    })
-    expect(
-      collection._state.syncedCollectionMetadata.has(`electric:resume`),
-    ).toBe(false)
-    expect(
-      collection._state.syncedCollectionMetadata.get(`queryCollection:gc:q1`),
-    ).toEqual({
-      queryHash: `q1`,
-      mode: `until-revalidated`,
-    })
-  })
-
-  it.todo(
-    `loads active subsets and collection metadata from one atomic full-reload generation`,
-  )
-
-  it(`persists metadata-only wrapped sync transactions`, async () => {
-    const adapter = createRecordingAdapter()
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `persisted-metadata-only`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, commit, markReady, metadata }) => {
-            begin()
-            metadata?.collection.set(`runtime:key`, { persisted: true })
-            commit()
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    await collection.stateWhenReady()
-    await flushAsyncWork()
-
-    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-    expect(adapter.applyCommittedTxCalls[0]?.tx.mutations).toEqual([])
-    expect(adapter.collectionMetadata.get(`runtime:key`)).toEqual({
-      persisted: true,
-    })
-    expect(
-      collection._state.syncedCollectionMetadata.get(`runtime:key`),
-    ).toEqual({
-      persisted: true,
-    })
-  })
-
-  it(`replays metadata-only tx:committed deltas without full reload`, async () => {
-    const adapter = createRecordingAdapter([
-      {
-        id: `1`,
-        title: `Tracked`,
-      },
-    ])
-    adapter.rowMetadata.set(`1`, { source: `initial` })
-    const coordinator = createCoordinatorHarness()
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-    const loadSubsetCallsAfterPreload = adapter.loadSubsetCalls.length
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-metadata-only`,
-      // The seeded row has no stream position; this is its first contiguous
-      // notification. A jump to version 2 would correctly require recovery.
-      latestRowVersion: 1,
-      requiresFullReload: false,
-      changedRows: [],
-      deletedKeys: [],
-      rowMetadataMutations: [
-        {
-          type: `set`,
-          key: `1`,
-          value: { source: `replayed` },
-        },
-      ],
-      collectionMetadataMutations: [
-        {
-          type: `set`,
-          key: `electric:resume`,
-          value: {
-            kind: `reset`,
-            updatedAt: 2,
-          },
-        },
-      ],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(adapter.loadSubsetCalls.length).toBe(loadSubsetCallsAfterPreload)
-    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
-      source: `replayed`,
-    })
-    expect(
-      collection._state.syncedCollectionMetadata.get(`electric:resume`),
-    ).toEqual({
-      kind: `reset`,
-      updatedAt: 2,
-    })
-  })
-
-  it(`uses pullSince replay deltas for metadata-bearing seq-gap recovery`, async () => {
-    const adapter = createRecordingAdapter([
-      {
-        id: `1`,
-        title: `Tracked`,
-      },
-    ])
-    adapter.rowMetadata.set(`1`, { source: `initial` })
-    const coordinator = createCoordinatorHarness()
-    coordinator.setPullSinceResponse({
-      type: `rpc:pullSince:res`,
-      rpcId: `pull-metadata`,
-      ok: true,
-      latestTerm: 1,
-      latestSeq: 3,
-      latestRowVersion: 3,
-      requiresFullReload: false,
-      changedKeys: [],
-      deletedKeys: [],
-      deltas: [
-        {
-          txId: `tx-gap-1`,
-          latestRowVersion: 2,
-          changedRows: [],
-          deletedKeys: [],
-          rowMetadataMutations: [
-            {
-              type: `set`,
-              key: `1`,
-              value: { source: `gap-replayed` },
-            },
-          ],
-          collectionMetadataMutations: [],
-        },
-        {
-          txId: `tx-gap-2`,
-          latestRowVersion: 3,
-          changedRows: [],
-          deletedKeys: [],
-          rowMetadataMutations: [],
-          collectionMetadataMutations: [
-            {
-              type: `set`,
-              key: `queryCollection:gc:q1`,
-              value: {
-                queryHash: `q1`,
-                mode: `until-revalidated`,
-              },
-            },
-          ],
-        },
-      ],
-    })
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-    const loadSubsetCallsAfterPreload = adapter.loadSubsetCalls.length
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 3,
-      txId: `tx-gap-trigger`,
-      latestRowVersion: 3,
-      requiresFullReload: false,
-      changedRows: [],
-      deletedKeys: [],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(coordinator.pullSinceCalls).toBe(1)
-    expect(adapter.loadSubsetCalls.length).toBe(loadSubsetCallsAfterPreload)
-    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
-      source: `gap-replayed`,
-    })
-    expect(
-      collection._state.syncedCollectionMetadata.get(`queryCollection:gc:q1`),
-    ).toEqual({
-      queryHash: `q1`,
-      mode: `until-revalidated`,
-    })
-  })
-
-  it(`throws InvalidSyncConfigError when sync key is present but null`, () => {
-    const invalidOptions = {
-      id: `invalid-sync-null`,
-      getKey: (item: Todo) => item.id,
-      sync: null,
-      persistence: {
-        adapter: createNoopAdapter(),
-      },
-    } as unknown as PersistedSyncWrappedOptions<Todo, string>
-
-    expect(() => persistedCollectionOptions(invalidOptions)).toThrow(
-      InvalidSyncConfigError,
-    )
-  })
-
-  it(`throws InvalidSyncConfigError when sync key is present but invalid`, () => {
-    const invalidOptions = {
-      id: `invalid-sync-shape`,
-      getKey: (item: Todo) => item.id,
-      sync: {} as unknown as SyncConfig<Todo, string>,
-      persistence: {
-        adapter: createNoopAdapter(),
-      },
-    } as PersistedSyncWrappedOptions<Todo, string>
-
-    expect(() => persistedCollectionOptions(invalidOptions)).toThrow(
-      InvalidSyncConfigError,
-    )
-  })
-
-  it(`uses SingleProcessCoordinator when coordinator is omitted`, () => {
-    const options = persistedCollectionOptions<Todo, string>({
-      id: `default-coordinator`,
-      getKey: (item) => item.id,
-      persistence: {
-        adapter: createNoopAdapter(),
-      },
-    })
-
-    expect(options.persistence.coordinator).toBeInstanceOf(
-      SingleProcessCoordinator,
-    )
-  })
-
-  it(`coalesces duplicate single-process subset acknowledgements until owner work finishes`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-coalesced`)
-    let releaseLoad = (): void => {}
-    const loadGate = new Promise<void>((resolve) => {
-      releaseLoad = resolve
-    })
-    const owner = Object.assign(
-      vi.fn(() => loadGate),
-      { unloadSubset: vi.fn(), onError: vi.fn() },
-    )
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-    const options: LoadSubsetOptions = { limit: 1 }
-
-    try {
-      let firstSettled = false
-      let duplicateSettled = false
-      const first = coordinator
-        .requestEnsureRemoteSubset(`todos`, options)
-        .then(() => {
-          firstSettled = true
-        })
-      await Promise.resolve()
-      const duplicate = coordinator
-        .requestEnsureRemoteSubset(`todos`, options)
-        .then(() => {
-          duplicateSettled = true
-        })
-      await Promise.resolve()
-
-      expect({
-        ownerCalls: owner.mock.calls.length,
-        firstSettled,
-        duplicateSettled,
-      }).toEqual({
-        ownerCalls: 1,
-        firstSettled: false,
-        duplicateSettled: false,
-      })
-
-      releaseLoad()
-      await Promise.all([first, duplicate])
-    } finally {
-      releaseLoad()
-      unregisterOwner()
-    }
-  })
-
-  it(`preserves process-local subset lifecycle fields for owner load and unload`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-live-fields`)
-    const owner = Object.assign(vi.fn(), {
-      unloadSubset: vi.fn(),
-      onError: vi.fn(),
-    })
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-    const signal = new AbortController().signal
-    const subscription = {
-      on: () => () => {},
-    } as unknown as Subscription
-    const options: LoadSubsetOptions = { limit: 1, signal, subscription }
-
-    try {
-      await coordinator.requestEnsureRemoteSubset(`todos`, options)
-      expect(owner).toHaveBeenCalledTimes(1)
-      const delivered = owner.mock.calls[0]![0] as LoadSubsetOptions
-      expect(delivered).toMatchObject({ limit: 1 })
-      expect(delivered.signal).toBe(signal)
-      expect(delivered.subscription).toBe(subscription)
-
-      await coordinator.requestReleaseRemoteSubset(`todos`, options)
-      expect(owner.unloadSubset).toHaveBeenCalledTimes(1)
-      expect(owner.unloadSubset).toHaveBeenCalledWith(delivered)
-    } finally {
-      unregisterOwner()
-    }
-  })
-
-  it(`coalesces same-stack single-process subset reentry until owner work finishes`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-reentrant`)
-    let releaseLoad = (): void => {}
-    const loadGate = new Promise<void>((resolve) => {
-      releaseLoad = resolve
-    })
-    const options: LoadSubsetOptions = { limit: 1 }
-    let duplicate: Promise<void> | undefined
-    let didReenter = false
-    const owner = Object.assign(
-      vi.fn(() => {
-        if (!didReenter) {
-          didReenter = true
-          duplicate = coordinator.requestEnsureRemoteSubset(`todos`, options)
-        }
-        return loadGate
-      }),
-      { unloadSubset: vi.fn(), onError: vi.fn() },
-    )
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-
-    try {
-      let firstSettled = false
-      let duplicateSettled = false
-      const first = coordinator
-        .requestEnsureRemoteSubset(`todos`, options)
-        .then(() => {
-          firstSettled = true
-        })
-      await Promise.resolve()
-      const duplicateResult = duplicate!.then(() => {
-        duplicateSettled = true
-      })
-      await Promise.resolve()
-
-      expect({
-        ownerCalls: owner.mock.calls.length,
-        firstSettled,
-        duplicateSettled,
-      }).toEqual({
-        ownerCalls: 1,
-        firstSettled: false,
-        duplicateSettled: false,
-      })
-
-      releaseLoad()
-      await Promise.all([first, duplicateResult])
-    } finally {
-      releaseLoad()
-      unregisterOwner()
-    }
-  })
-
-  // Acquisition release gives the owner its cancellation opportunity before
-  // the source load settles. A load that needs unload to settle is legal;
-  // waiting for that load before calling unload deadlocks scoped recovery.
-  it(`unloads a pending single-process subset before waiting for its source load`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-release-order`)
-    let releaseLoad = (): void => {}
-    const loadGate = new Promise<void>((resolve) => {
-      releaseLoad = resolve
-    })
-    const events: Array<string> = []
-    const owner = Object.assign(
-      vi.fn(async () => {
-        events.push(`load-start`)
-        await loadGate
-        events.push(`load-finish`)
-      }),
-      {
-        unloadSubset: vi.fn(() => {
-          events.push(`unload`)
-        }),
-        onError: vi.fn(),
-      },
-    )
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-    const options: LoadSubsetOptions = { limit: 1 }
-
-    try {
-      const load = coordinator.requestEnsureRemoteSubset(`todos`, options)
-      await Promise.resolve()
-      let releaseSettled = false
-      const release = coordinator
-        .requestReleaseRemoteSubset(`todos`, options)
-        .then(() => {
-          releaseSettled = true
-        })
-      await atPersistedOracleCheckpoint(
-        release,
-        `release before source settlement`,
-      )
-
-      const beforeLoadRelease = { events: [...events], releaseSettled }
-      expect(beforeLoadRelease).toEqual({
-        events: [`load-start`, `unload`],
-        releaseSettled: true,
-      })
-
-      releaseLoad()
-      await Promise.all([load, release])
-      expect(events).toEqual([`load-start`, `unload`, `load-finish`])
-    } finally {
-      releaseLoad()
-      unregisterOwner()
-    }
-  })
-
-  it(`rejects unsupported single-process subset values before owner work`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-wire-domain`)
-    const owner = Object.assign(vi.fn(), {
-      unloadSubset: vi.fn(),
-      onError: vi.fn(),
-    })
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-
-    try {
-      await expect(
-        coordinator.requestEnsureRemoteSubset(`todos`, {
-          where: new IR.Func(`in`, [
-            new IR.PropRef([`todos`, `status`]),
-            new IR.Value([`kept`, () => {}]),
-          ]),
-        }),
-      ).rejects.toMatchObject({
-        name: `RemoteSubsetWireValueError`,
-        path: `options.where.args[1].value[1]`,
-      })
-      expect(owner).not.toHaveBeenCalled()
-    } finally {
-      unregisterOwner()
-    }
-  })
-
-  it(`rejects a sparse function argument at its exact expression path`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-wire-hole`)
-    const owner = Object.assign(vi.fn(), {
-      unloadSubset: vi.fn(),
-      onError: vi.fn(),
-    })
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-    const args = [new IR.PropRef([`todos`, `status`])]
-    args.length = 2
-
-    try {
-      await expect(
-        coordinator.requestEnsureRemoteSubset(`todos`, {
-          where: new IR.Func(`eq`, args),
-        }),
-      ).rejects.toMatchObject({
-        name: `RemoteSubsetWireValueError`,
-        path: `options.where.args[1]`,
-      })
-      expect(owner).not.toHaveBeenCalled()
-    } finally {
-      unregisterOwner()
-    }
-  })
-
-  it(`preserves an explicit source alias through remote subset projection`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-wire-alias`)
-    const owner = Object.assign(vi.fn(), {
-      unloadSubset: vi.fn(),
-      onError: vi.fn(),
-    })
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-    const options: LoadSubsetOptions = {
-      where: new IR.Func(`eq`, [
-        new IR.PropRef([`todos`, `status`], `todos`),
-        new IR.Value(`kept`),
-      ]),
-    }
-
-    try {
-      await coordinator.requestEnsureRemoteSubset(`todos`, options)
-      expect(owner).toHaveBeenCalledWith({
-        where: {
-          type: `func`,
-          name: `eq`,
-          args: [
-            { type: `ref`, path: [`todos`, `status`], sourceAlias: `todos` },
-            { type: `val`, value: `kept` },
-          ],
-        },
-      })
-    } finally {
-      await coordinator.requestReleaseRemoteSubset(`todos`, options)
-      unregisterOwner()
-    }
-  })
-
-  it(`rejects a remote subset source alias that disagrees with its path`, () => {
-    expect(() =>
-      toTransportedLoadSubsetOptions({
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`todos`, `status`], `other`),
-          new IR.Value(`kept`),
-        ]),
-      }),
-    ).toThrowError(/options\.where\.args\[0\]\.sourceAlias/)
-  })
-
-  // A projection is a detached snapshot at one call boundary. A later call on
-  // reused input must observe its current data, without changing the first
-  // snapshot. This distinguishes safe per-call reuse from a global identity cache.
-  it(`takes a fresh detached wire snapshot on each projection`, () => {
-    const literal = new IR.Value({ label: `before` })
-    const options = {
-      where: new IR.Func(`eq`, [new IR.PropRef([`value`]), literal]),
-    }
-    const first = toTransportedLoadSubsetOptions(options)
-    literal.value.label = `after`
-    const second = toTransportedLoadSubsetOptions(options)
-    expect(first.where).toMatchObject({
-      args: [{}, { value: { label: `before` } }],
-    })
-    expect(second.where).toMatchObject({
-      args: [{}, { value: { label: `after` } }],
-    })
-    expect(first).not.toBe(second)
-  })
-
-  // Read-only admission is a law about caller state, including builtin internal
-  // slots that Object.freeze cannot protect. Capture expectations before either
-  // traversal, and retain them when a later invalid field rejects the request.
-  // Fresh snapshots must preserve internal aliases but share no mutable payload
-  // with the caller or a later projection. These are two call-boundary histories,
-  // not a reference implementation of the encoder.
-  it.each([false, true])(
-    `preserves caller state and detached snapshots / rejected suffix %s`,
-    (rejectedSuffix) => {
-      const date = new Date(`2026-09-16T12:34:56.123Z`)
-      const buffer = new Uint8Array([7, 8]).buffer
-      const shared = { label: `before` }
-      const payload = {
-        date,
-        buffer,
-        view: new Uint8Array(buffer),
-        map: new Map([[shared, date]]),
-        set: new Set([shared]),
-        first: shared,
-        second: shared,
-      }
-      // Compare values and aliases explicitly. In jsdom, structuredClone can
-      // return a buffer from another realm, which Vitest's object comparison
-      // does not equate with this realm's otherwise identical ArrayBuffer.
-      // These observations preserve contents, order, multiplicity and identity
-      // relationships without requiring cross-realm object equality.
-      const observe = (value: typeof payload) => ({
-        keys: Reflect.ownKeys(value),
-        recordKeys: [
-          Reflect.ownKeys(value.first),
-          Reflect.ownKeys(value.second),
-        ],
-        date: value.date.getTime(),
-        bytes: Array.from(new Uint8Array(value.buffer)),
-        view: Array.from(value.view),
-        map: [...value.map].map(([key, entry]) => ({
-          label: key.label,
-          date: entry.getTime(),
-          keyIsFirst: key === value.first,
-          valueIsDate: entry === value.date,
-        })),
-        set: [...value.set].map((entry) => ({
-          label: entry.label,
-          isFirst: entry === value.first,
-        })),
-        first: value.first.label,
-        second: value.second.label,
-        sharedRecord: value.first === value.second,
-        sharedBuffer: value.view.buffer === value.buffer,
-      })
-      const before = {
-        keys: [`date`, `buffer`, `view`, `map`, `set`, `first`, `second`],
-        recordKeys: [[`label`], [`label`]],
-        date: Date.UTC(2026, 8, 16, 12, 34, 56, 123),
-        bytes: [7, 8],
-        view: [7, 8],
-        map: [
-          {
-            label: `before`,
-            date: Date.UTC(2026, 8, 16, 12, 34, 56, 123),
-            keyIsFirst: true,
-            valueIsDate: true,
-          },
-        ],
-        set: [{ label: `before`, isFirst: true }],
-        first: `before`,
-        second: `before`,
-        sharedRecord: true,
-        sharedBuffer: true,
-      }
-      // Calibrate the fixture before entering either production traversal.
-      expect(observe(payload)).toEqual(before)
-      const options = {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`payload`]),
-          new IR.Value(payload),
-        ]),
-        ...(rejectedSuffix ? { limit: -1 } : {}),
-      }
-      if (rejectedSuffix) {
-        for (const visit of [
-          validateRemoteSubsetOptions,
-          toTransportedLoadSubsetOptions,
-        ]) {
-          expect(() => visit(options)).toThrowError(
-            expect.objectContaining({
-              name: `RemoteSubsetWireValueError`,
-              path: `options.limit`,
-            }),
-          )
-          expect(observe(payload)).toEqual(before)
-        }
-        return
-      }
-      expect(validateRemoteSubsetOptions(options)).toBeUndefined()
-      expect(observe(payload)).toEqual(before)
-      const first = toTransportedLoadSubsetOptions(options)
-      expect(observe(payload)).toEqual(before)
-      date.setTime(1)
-      new Uint8Array(buffer)[0] = 9
-      shared.label = `after`
-      payload.map.clear()
-      payload.set.clear()
-      const after = {
-        ...before,
-        date: 1,
-        bytes: [9, 8],
-        view: [9, 8],
-        map: [],
-        set: [],
-        first: `after`,
-        second: `after`,
-      }
-      expect(observe(payload)).toEqual(after)
-      expect(validateRemoteSubsetOptions(options)).toBeUndefined()
-      expect(observe(payload)).toEqual(after)
-      const second = toTransportedLoadSubsetOptions(options)
-      expect(observe(payload)).toEqual(after)
-      for (const [snapshot, expected] of [
-        [first, before],
-        [second, after],
-      ] as const) {
-        if (snapshot.where?.type !== `func`)
-          throw new Error(`missing predicate`)
-        const literal = snapshot.where.args[1]
-        if (literal?.type !== `val`) throw new Error(`missing literal`)
-        const value = literal.value as typeof payload
-        expect(observe(value)).toEqual(expected)
-        expect(value.first).toBe(value.second)
-        expect(value.view.buffer).toBe(value.buffer)
-        for (const key of Object.keys(payload) as Array<keyof typeof payload>)
-          expect(value[key]).not.toBe(payload[key])
-      }
-    },
-  )
-
-  // Both modes enforce the complete request schema. Validation must only read
-  // the caller's frozen graph; projection still returns detached request data.
-  it.each([`lexical`, `locale`] as const)(
-    `validates frozen request fields without projecting or rewriting them / %s`,
-    (stringSort) => {
-      const reference = new IR.PropRef([`todos`, `title`], `todos`)
-      const literal = new IR.Value({ label: `unchanged` })
-      const where = new IR.Func(`eq`, [reference, literal])
-      const compareOptions = {
-        direction: `asc` as const,
-        nulls: `last` as const,
-        stringSort,
-        locale: `en`,
-        localeOptions: { sensitivity: `base` as const },
-      }
-      const clause = { expression: reference, compareOptions }
-      const options = {
-        where,
-        orderBy: [clause, clause],
-        cursor: { whereFrom: where, whereCurrent: where, lastKey: `last` },
-        limit: 0,
-        offset: Number.MAX_SAFE_INTEGER,
-        signal: new AbortController().signal,
-      }
-      for (const value of [
-        options,
-        where,
-        where.args,
-        reference,
-        reference.path,
-        literal,
-        literal.value,
-        options.orderBy,
-        clause,
-        compareOptions,
-        compareOptions.localeOptions,
-        options.cursor,
-      ])
-        Object.freeze(value)
-      expect(validateRemoteSubsetOptions(options)).toBeUndefined()
-      const result = toTransportedLoadSubsetOptions(options)
-      expect(result).toMatchObject({
-        limit: 0,
-        offset: Number.MAX_SAFE_INTEGER,
-      })
-      expect(result.where).not.toBe(where)
-      expect(result.cursor?.whereFrom).toBe(result.where)
-      expect(result.cursor?.whereCurrent).toBe(result.where)
-      expect(result.orderBy?.[0]).toBe(result.orderBy?.[1])
-      expect(result.orderBy?.[0]?.compareOptions).toEqual(
-        stringSort === `lexical`
-          ? { direction: `asc`, nulls: `last`, stringSort }
-          : compareOptions,
-      )
-      expect(options.cursor.whereFrom).toBe(where)
-      expect(options.orderBy[0]).toBe(clause)
-    },
-  )
-
-  it(`projects lexical comparison options without locale-only wire fields`, () => {
-    const projected = toTransportedLoadSubsetOptions({
-      orderBy: [
-        {
-          expression: new IR.PropRef([`todos`, `title`]),
-          compareOptions: {
-            direction: `asc`,
-            nulls: `last`,
-            stringSort: `lexical`,
-            locale: `en`,
-            localeOptions: { sensitivity: `base` },
-          },
-        },
-      ],
-    } as unknown as LoadSubsetOptions)
-
-    expect(projected.orderBy?.[0]?.compareOptions).toEqual({
-      direction: `asc`,
-      nulls: `last`,
-      stringSort: `lexical`,
-    })
-  })
-
-  it(`preserves locale comparison fields when the optional sort mode is omitted`, () => {
-    const projected = toTransportedLoadSubsetOptions({
-      orderBy: [
-        {
-          expression: new IR.PropRef([`todos`, `title`]),
-          compareOptions: {
-            direction: `asc`,
-            nulls: `last`,
-            locale: `en`,
-            localeOptions: { sensitivity: `base` },
-          },
-        },
-      ],
-    } as LoadSubsetOptions)
-
-    expect(projected.orderBy?.[0]?.compareOptions).toEqual({
-      direction: `asc`,
-      nulls: `last`,
-      locale: `en`,
-      localeOptions: { sensitivity: `base` },
-    })
-  })
-
-  it.each([
-    [`limit`, { limit: Number.NaN }, `options.limit`],
-    [`limit`, { limit: Number.POSITIVE_INFINITY }, `options.limit`],
-    [`limit`, { limit: -1 }, `options.limit`],
-    [`limit`, { limit: 0.5 }, `options.limit`],
-    [`limit`, { limit: Number.MAX_SAFE_INTEGER + 1 }, `options.limit`],
-    [`offset`, { offset: Number.NaN }, `options.offset`],
-    [`offset`, { offset: Number.NEGATIVE_INFINITY }, `options.offset`],
-    [`offset`, { offset: -1 }, `options.offset`],
-    [`offset`, { offset: 0.5 }, `options.offset`],
-    [`offset`, { offset: Number.MAX_SAFE_INTEGER + 1 }, `options.offset`],
-  ] as const)(
-    `rejects an invalid transported subset %s before owner work`,
-    (_field, options, path) => {
-      let error: unknown
-      try {
-        toTransportedLoadSubsetOptions(options)
-      } catch (caught) {
-        error = caught
-      }
-      expect(error).toMatchObject({
-        name: `RemoteSubsetWireValueError`,
-        path,
-      })
-    },
-  )
-
-  it(`preserves valid transported subset window boundaries`, () => {
-    expect(
-      toTransportedLoadSubsetOptions({
-        limit: 0,
-        offset: Number.MAX_SAFE_INTEGER,
-      }),
-    ).toEqual({ limit: 0, offset: Number.MAX_SAFE_INTEGER })
-  })
-
-  it(`transports an explicit source refetch without changing subset data`, () => {
-    expect(toTransportedLoadSubsetOptions({ limit: 1, refetch: true })).toEqual(
-      {
-        limit: 1,
-        refetch: true,
-      },
-    )
-    expect(() =>
-      toTransportedLoadSubsetOptions({ refetch: `true` } as never),
-    ).toThrow(`options.refetch`)
-  })
-
-  it(`reports and rethrows a single-process owner unload rejection`, async () => {
-    const coordinator = new SingleProcessCoordinator(`single-unload-error`)
-    const unloadError = new Error(`single-process owner unload failed`)
-    const ownerErrors: Array<unknown> = []
-    const owner = Object.assign(vi.fn(), {
-      unloadSubset: vi.fn(() =>
-        Promise.reject(unloadError),
-      ) as unknown as RemoteSubsetOwner[`unloadSubset`],
-      onError: (error: unknown) => ownerErrors.push(error),
-    })
-    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
-      `todos`,
-      owner,
-    )
-    const options: LoadSubsetOptions = { limit: 1 }
-
-    try {
-      await coordinator.requestEnsureRemoteSubset(`todos`, options)
-      await expect(
-        coordinator.requestReleaseRemoteSubset(`todos`, options),
-      ).rejects.toBe(unloadError)
-      expect(ownerErrors).toEqual([unloadError])
-    } finally {
-      unregisterOwner()
-    }
-  })
-
-  // An adapter's unloadSubset that rejects broke its contract. Core reports a
-  // throwing unloadSubset uncaught and fails no load, replay, or caller
-  // (subscription.ts, releaseAcquisition); the wrapper forwards the call as
-  // core makes it, so a rejection surfaces uncaught once and changes neither
-  // the status nor the node, whether or not the sync adapter gave up first.
-  // The supplemental witness for the persisted sync-run oracle's
-  // `unload-reject` site.
-  it.each([false, true])(
-    `reports a single-process async unload rejection uncaught without changing the Collection (sync adapter gave up first: %s)`,
-    async (gaveUpFirst) => {
-      const unloadError = new Error(`remote owner unload failed`)
-      const gaveUp = new Error(`sync adapter gave up`)
-      let giveUp: ((error: unknown) => void) | undefined
-      let unloadThenCalls = 0
-      const rejectingThenable = {
-        then: (
-          _resolve: (value?: void) => void,
-          reject: (error: unknown) => void,
-        ) => {
-          unloadThenCalls++
-          queueMicrotask(() => reject(unloadError))
-        },
-      }
-      const sourceUnloadMock = vi.fn((options: LoadSubsetOptions) =>
-        options.limit === 1 ? rejectingThenable : undefined,
-      )
-      const sourceUnload = sourceUnloadMock as unknown as (
-        options: LoadSubsetOptions,
-      ) => void
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `owner-unload-error`,
-          getKey: (todo) => todo.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: ({ markReady, fail }) => {
-              markReady()
-              giveUp = fail
-              return {
-                loadSubset: () => true,
-                unloadSubset: sourceUnload,
-              }
-            },
-          },
-          persistence: {
-            adapter: createRecordingAdapter(),
-          },
-        }),
-      )
-      const failing: LoadSubsetOptions = { limit: 1 }
-      const sibling: LoadSubsetOptions = { limit: 2 }
-      const crash = vi.spyOn(collection._lifecycle, `crash`)
-      const unhandled: Array<unknown> = []
-      const captureUnhandled = (error: unknown) => unhandled.push(error)
-      process.on(`unhandledRejection`, captureUnhandled)
-      const uncaught: Array<unknown> = []
-      const queue = globalThis.queueMicrotask.bind(globalThis)
-      const microtasks = vi
-        .spyOn(globalThis, `queueMicrotask`)
-        .mockImplementation((task) =>
-          queue(() => {
-            try {
-              task()
-            } catch (error) {
-              uncaught.push(error)
-            }
-          }),
-        )
-
-      try {
-        collection.startSyncImmediate()
-        await collection._sync.loadSubset(failing)
-        await collection._sync.loadSubset(sibling)
-        if (gaveUpFirst) {
-          giveUp!(gaveUp)
-          await flushAsyncWork()
-          expect(collection.status).toBe(`ready`)
-          expect(collection.health.error?.cause).toBe(gaveUp)
-        }
-        collection._sync.unloadSubset(failing)
-        collection._sync.unloadSubset(sibling)
-        await flushAsyncWork()
-        await flushAsyncWork()
-
-        expect({
-          status: collection.status,
-          error: collection.health.error?.cause,
-          failureReason: collection.health.failureReason,
-          unloadThenCalls,
-          unloadOptions: sourceUnloadMock.mock.calls.map(
-            ([options]) => options,
-          ),
-          lifecycleErrors: crash.mock.calls.map(([error]) => error),
-          uncaught,
-          unhandled,
-        }).toEqual({
-          status: `ready`,
-          error: gaveUpFirst ? gaveUp : undefined,
-          failureReason: null,
-          unloadThenCalls: 1,
-          unloadOptions: [failing, sibling],
-          lifecycleErrors: [],
-          uncaught: [unloadError],
-          unhandled: [],
-        })
-
-        await flushAsyncWork()
-        expect(sourceUnloadMock).toHaveBeenCalledTimes(2)
-        expect(crash).not.toHaveBeenCalled()
-      } finally {
-        microtasks.mockRestore()
-        process.off(`unhandledRejection`, captureUnhandled)
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`surfaces duplicate remote-subset owner registration through the collection lifecycle`, async () => {
-    const coordinator = new SingleProcessCoordinator()
-    const unhandled: Array<unknown> = []
-    const sourceLoads: Array<string> = []
-    const onUnhandled = (error: unknown) => unhandled.push(error)
-    process.on(`unhandledRejection`, onUnhandled)
-    const create = (label: string) =>
-      createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `duplicate-owner-lifecycle`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {
-                loadSubset: () => {
-                  sourceLoads.push(label)
-                  return true
-                },
-                unloadSubset: () => {},
-              }
-            },
-          },
-          persistence: { adapter: createRecordingAdapter(), coordinator },
-        }),
-      )
-    const first = create(`first`)
-    let duplicate: ReturnType<typeof create> | undefined
-
-    try {
-      first.startSyncImmediate()
-      await first.stateWhenReady()
-      await vi.waitFor(() =>
-        expect(
-          (
-            coordinator as unknown as {
-              remoteSubsetOwners: Map<string, RemoteSubsetOwner>
-            }
-          ).remoteSubsetOwners.size,
-        ).toBe(1),
-      )
-      duplicate = create(`duplicate`)
-      duplicate.startSyncImmediate()
-      const readinessError = await duplicate.stateWhenReady().then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-      await flushAsyncWork()
-
-      expect(readinessError).toMatchObject({
-        name: `DuplicateRemoteSubsetOwnerError`,
-        collectionId: `duplicate-owner-lifecycle`,
-      })
-      expect(duplicate.status).toBe(`error`)
-      expect(sourceLoads).toEqual([])
-      expect(unhandled).toEqual([])
-    } finally {
-      process.off(`unhandledRejection`, onUnhandled)
-      await duplicate?.cleanup()
-      await first.cleanup()
-    }
-  })
-
-  it(`resolves persistence per collection and forwards schemaVersion`, () => {
-    const baseAdapter = createNoopAdapter()
-    const syncAdapter = createNoopAdapter()
-    const localAdapter = createNoopAdapter()
-    const resolverCalls: Array<{
-      collectionId: string
-      mode: `sync-present` | `sync-absent`
-      schemaVersion?: number
-    }> = []
-
-    const persistence: PersistedCollectionPersistence = {
-      adapter: baseAdapter,
-      resolvePersistenceForCollection: (options) => {
-        resolverCalls.push(options)
-        return {
-          adapter: options.mode === `sync-present` ? syncAdapter : localAdapter,
-        }
-      },
-    }
-
-    const syncOptions = persistedCollectionOptions<Todo, string>({
-      id: `sync-collection`,
-      getKey: (item) => item.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-        },
-      },
-      schemaVersion: 7,
-      persistence,
-    })
-    expect(syncOptions.persistence.adapter).toBe(syncAdapter)
-
-    const localOptions = persistedCollectionOptions<Todo, string>({
-      id: `local-collection`,
-      getKey: (item) => item.id,
-      schemaVersion: 3,
-      persistence,
-    })
-    expect(localOptions.persistence.adapter).toBe(localAdapter)
-
-    expect(resolverCalls).toEqual([
-      {
-        collectionId: `sync-collection`,
-        mode: `sync-present`,
-        schemaVersion: 7,
-      },
-      {
-        collectionId: `local-collection`,
-        mode: `sync-absent`,
-        schemaVersion: 3,
-      },
-    ])
-  })
-
-  it(`throws for invalid coordinator implementations`, () => {
-    const invalidCoordinator = {
-      getNodeId: () => `node-1`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => true,
-      ensureLeadership: async () => {},
-      // requestEnsurePersistedIndex is intentionally missing
-    } as unknown as PersistedCollectionCoordinator
-
-    expect(() =>
-      persistedCollectionOptions<Todo, string>({
-        id: `invalid-coordinator`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter: createNoopAdapter(),
-          coordinator: invalidCoordinator,
-        },
-      }),
-    ).toThrow(InvalidPersistedCollectionCoordinatorError)
-  })
-
-  // Every coordinator method the runtime calls is part of the contract, so a
-  // coordinator missing any one of them fails at configuration, naming it,
-  // rather than later inside message dispatch.
-  it.each([
-    `getNodeId`,
-    `subscribe`,
-    `publish`,
-    `isLeader`,
-    `ensureLeadership`,
-    `requestEnsureRemoteSubset`,
-    `requestReleaseRemoteSubset`,
-    `registerRemoteSubsetOwner`,
-    `requestEnsurePersistedIndex`,
-    `requestApplyCommittedTx`,
-  ] as const)(`rejects a coordinator without %s`, (method) => {
-    const complete: Record<string, unknown> = {
-      getNodeId: () => `node-1`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => true,
-      ensureLeadership: async () => {},
-      requestEnsureRemoteSubset: async () => {},
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: async () => ({ term: 1, seq: 1 }),
-    }
-    delete complete[method]
-
-    expect(() =>
-      persistedCollectionOptions<Todo, string>({
-        id: `coordinator-without-${method}`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter: createNoopAdapter(),
-          coordinator: complete as unknown as PersistedCollectionCoordinator,
-        },
-      }),
-    ).toThrow(
-      `Invalid persisted collection coordinator: missing required "${method}" method`,
-    )
-  })
-
-  it(`rejects an incomplete coordinator before starting a rich sync source`, async () => {
-    type SourceParams = Parameters<SyncConfig<Todo, string>[`sync`]>[0]
-
-    const adapter = createRecordingAdapter()
-    const applyCommittedTx = adapter.applyCommittedTx
-    let adapterApplies = 0
-    adapter.applyCommittedTx = (...args) => {
-      adapterApplies++
-      return applyCommittedTx(...args)
-    }
-    let sourceCalls = 0
-    let legacyCalls = 0
-    let sourceParams: SourceParams | undefined
-    let collectionConstructed = false
-    let visible = false
-    let configurationError: { name: string; message: string } | null = null
-    let collection: Collection<Todo, string> | undefined
-
-    const incompleteCoordinator = {
-      getNodeId: () => `incomplete-rich-sync`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => false,
-      ensureLeadership: () => Promise.resolve(),
-      requestEnsurePersistedIndex: () => Promise.resolve(),
-      // Remote subset routing is complete so this fixture isolates the
-      // required committed-transaction method named by the assertion.
-      requestEnsureRemoteSubset: () => Promise.resolve(),
-      requestReleaseRemoteSubset: () => Promise.resolve(),
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyLocalMutations: () => {
-        legacyCalls++
-        return Promise.resolve({
-          type: `rpc:applyLocalMutations:res` as const,
-          rpcId: `legacy`,
-          ok: true as const,
-          term: 1,
-          seq: 1,
-          latestRowVersion: 1,
-          acceptedMutationIds: [],
-        })
-      },
-    } as unknown as PersistedCollectionCoordinator
-
-    try {
-      try {
-        const options = persistedCollectionOptions<Todo, string>({
-          id: `incomplete-rich-sync`,
-          getKey: (todo) => todo.id,
-          sync: {
-            sync: (params) => {
-              sourceCalls++
-              sourceParams = params
-              params.markReady()
-            },
-          },
-          persistence: { adapter, coordinator: incompleteCoordinator },
-        })
-        collection = createCollection(options)
-        collectionConstructed = true
-      } catch (error) {
-        const resolvedError =
-          error instanceof Error ? error : new Error(String(error))
-        configurationError = {
-          name: resolvedError.name,
-          message: resolvedError.message,
-        }
-      }
-
-      if (collection) {
-        collection.startSyncImmediate()
-        await vi.waitFor(() => expect(sourceParams).toBeDefined())
-        sourceParams!.begin()
-        sourceParams!.metadata?.collection.set(`resume`, { offset: 7 })
-        sourceParams!.truncate()
-        sourceParams!.write({
-          type: `insert`,
-          value: { id: `rich`, title: `Visible before rejection` },
-          metadata: { source: `remote` },
-        })
-        await Promise.resolve(sourceParams!.commit()).catch(() => undefined)
-        visible = collection.has(`rich`)
-      }
-    } finally {
-      await collection?.cleanup()
-    }
-
-    expect({
-      configurationError,
-      sourceCalls,
-      collectionConstructed,
-      visible,
-      adapterApplies,
-      legacyCalls,
-    }).toEqual({
-      configurationError: {
-        name: `InvalidPersistedCollectionCoordinatorError`,
-        message:
-          'Invalid persisted collection coordinator: missing required "requestApplyCommittedTx" method',
-      },
-      sourceCalls: 0,
-      collectionConstructed: false,
-      visible: false,
-      adapterApplies: 0,
-      legacyCalls: 0,
-    })
-  })
-
-  it(`preserves valid sync config in sync-present mode`, async () => {
-    const adapter = createRecordingAdapter()
-    const sync: SyncConfig<Todo, string> = {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({
-          type: `insert`,
-          value: {
-            id: `remote-1`,
-            title: `From remote`,
-          },
-        })
-        commit()
-        markReady()
-      },
-    }
-
-    const options = persistedCollectionOptions<Todo, string>({
-      id: `sync-present`,
-      getKey: (item: Todo) => item.id,
-      sync,
-      persistence: {
-        adapter,
-      },
-    })
-
-    const collection = createCollection(options)
-    await collection.stateWhenReady()
-    await flushAsyncWork()
-
-    expect(stripVirtualProps(collection.get(`remote-1`))).toEqual({
-      id: `remote-1`,
-      title: `From remote`,
-    })
-    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-    expect(adapter.applyCommittedTxCalls[0]?.tx.mutations[0]?.type).toBe(
-      `update`,
-    )
-  })
-
-  it(`does not apply or persist a wrapped sync transaction committed with an aborted signal`, async () => {
-    const adapter = createRecordingAdapter()
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-aborted-commit`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      const abortController = new AbortController()
-      abortController.abort()
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `aborted`, title: `Must not publish` },
-      })
-      await expect(
-        remoteCommit?.(abortController.signal),
-      ).rejects.toMatchObject({ name: `AbortError` })
-      await flushAsyncWork()
-
-      expect(collection.get(`aborted`)).toBeUndefined()
-      expect(adapter.applyCommittedTxCalls).toHaveLength(0)
-      expect(collection._state.pendingSyncedTransactions).toHaveLength(0)
-
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `recovered`, title: `Later transaction` },
-      })
-      await remoteCommit?.()
-
-      expect(stripVirtualProps(collection.get(`recovered`))).toEqual({
-        id: `recovered`,
-        title: `Later transaction`,
-      })
-      expect(adapter.rows.get(`recovered`)).toEqual({
-        id: `recovered`,
-        title: `Later transaction`,
-      })
-      expect(collection._state.pendingSyncedTransactions).toHaveLength(0)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not publish or allocate a sequence for an empty external source transaction`, async () => {
-    const adapter = Object.assign(createRecordingAdapter(), {
-      getStreamPosition: () =>
-        Promise.resolve({
-          latestTerm: 1,
-          latestSeq: 10,
-          latestRowVersion: 10,
-        }),
-    })
-    let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-    const published: Array<ProtocolEnvelope<unknown>> = []
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `empty-source-follower`,
-      subscribe: (_collectionId, onMessage) => {
-        subscriber = onMessage
-        return () => {
-          subscriber = undefined
-        }
-      },
-      publish: (_collectionId, message) => published.push(message),
-      isLeader: () => false,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestEnsureRemoteSubset: async () => {},
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-    }
-    let sourceBegin: (() => void) | undefined
-    let sourceCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `empty-source-sequence`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ begin, commit, markReady }) => {
-            sourceBegin = begin
-            sourceCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    try {
-      await collection.stateWhenReady()
-      sourceBegin?.()
-      await sourceCommit?.()
-      await flushAsyncWork()
-
-      expect(published).toEqual([])
-
-      subscriber?.({
-        v: 1,
-        dbName: `empty-source-sequence`,
-        collectionId: `empty-source-sequence`,
-        senderId: `elected-owner`,
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 1,
-          seq: 11,
-          txId: `first-real-coordinator-sequence`,
-          latestRowVersion: 11,
-          requiresFullReload: false,
-          changedRows: [
-            {
-              key: `kept`,
-              value: { id: `kept`, title: `First real write` },
-            },
-          ],
-          deletedKeys: [],
-        },
-      })
-      await flushAsyncWork()
-
-      expect(stripVirtualProps(collection.get(`kept`))).toEqual({
-        id: `kept`,
-        title: `First real write`,
-      })
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`persists a wrapped sync transaction when abort follows application`, async () => {
-    const adapter = createRecordingAdapter()
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-abort-after-application`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let releaseMutation!: () => void
-    const mutationGate = new Promise<void>((resolve) => {
-      releaseMutation = resolve
-    })
-    const transaction = createTransaction({
-      mutationFn: () => mutationGate,
-    })
-
-    try {
-      await collection.stateWhenReady()
-      transaction.mutate(() => {
-        collection.insert({ id: `local`, title: `Optimistic gate` })
-      })
-
-      const abortController = new AbortController()
-      let appliedPublications = 0
-      const subscription = collection.subscribeChanges((changes) => {
-        if (changes.some((change) => change.key === `remote`)) {
-          appliedPublications++
-          abortController.abort()
-        }
-      })
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `remote`, title: `Already visible` },
-      })
-      const receipt = remoteCommit?.(abortController.signal)
-      expect(receipt).toBeInstanceOf(Promise)
-
-      releaseMutation()
-      await transaction.isPersisted.promise
-      await receipt
-      subscription.unsubscribe()
-
-      expect(appliedPublications).toBe(1)
-      expect(abortController.signal.aborted).toBe(true)
-      expect(stripVirtualProps(collection.get(`remote`))).toEqual({
-        id: `remote`,
-        title: `Already visible`,
-      })
-      expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-    } finally {
-      releaseMutation()
-      await transaction.isPersisted.promise.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-
-  // An accepted sync transaction always applies, in commit order. A later
-  // abort of its signal cannot remove it or the suffix that depends on it.
-  it(`applies an accepted predecessor and its suffix after the predecessor's signal aborts`, async () => {
-    const adapter = createRecordingAdapter()
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-abort-before-publication-suffix`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            remoteBegin = params.begin
-            remoteWrite = params.write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = params.commit
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const localPersistence = createEventGate()
-    const localTransaction = createTransaction({
-      mutationFn: () => localPersistence.promise,
-    })
-    const aborted = new AbortController()
-    let abortedReceipt: Promise<void> | undefined
-    let dependentReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      localTransaction.mutate(() => {
-        collection.insert({ id: `local`, title: `publication gate` })
-      })
-
-      remoteBegin?.()
-      sourceParams.metadata!.row.set(`shared`, { owner: `aborted` })
-      abortedReceipt = Promise.resolve(remoteCommit?.(aborted.signal)).then(
-        () => undefined,
-      )
-      void abortedReceipt.catch(() => undefined)
-
-      remoteBegin?.()
-      const stagedOwner = sourceParams.metadata!.row.get(`shared`)
-      remoteWrite?.({
-        type: `insert`,
-        value: {
-          id: `dependent`,
-          title:
-            (stagedOwner as { owner?: string } | undefined)?.owner ?? `missing`,
-        },
-      })
-      dependentReceipt = Promise.resolve(remoteCommit?.()).then(() => undefined)
-      void dependentReceipt.catch(() => undefined)
-
-      expect(stagedOwner).toEqual({ owner: `aborted` })
-      aborted.abort()
-      expect(collection.get(`dependent`)).toBeUndefined()
-      localPersistence.resolve()
-      await localTransaction.isPersisted.promise
-      const abortedOutcome = await atPersistedOracleCheckpoint(
-        abortedReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `accepted predecessor receipt settled`,
-      )
-      const dependentOutcome = await atPersistedOracleCheckpoint(
-        dependentReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `post-abort staged suffix settled`,
-      )
-      expect({
-        abortedStatus: abortedOutcome.status,
-        dependentStatus: dependentOutcome.status,
-        status: collection.status,
-        visibleDependent: stripVirtualProps(collection.get(`dependent`)),
-        durableDependent: adapter.rows.get(`dependent`),
-        durableMetadata: adapter.rowMetadata.get(`shared`),
-      }).toEqual({
-        abortedStatus: `fulfilled`,
-        dependentStatus: `fulfilled`,
-        status: `ready`,
-        visibleDependent: { id: `dependent`, title: `aborted` },
-        durableDependent: { id: `dependent`, title: `aborted` },
-        durableMetadata: { owner: `aborted` },
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      localPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => localTransaction.isPersisted.promise.catch(() => undefined),
-          () => abortedReceipt?.catch(() => undefined),
-          () => dependentReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects a wrapped sync receipt with a named terminal persistence error`, async () => {
-    const adapter = createRecordingAdapter()
-    const adapterError = Object.assign(
-      new Error(`adapter write failed exactly`),
-      {
-        code: `SQLITE_FULL`,
-        path: `adapter.applyCommittedTx`,
-      },
-    )
-    const persistenceEntered = createEventGate()
-    const persistence = createEventGate()
-    adapter.applyCommittedTx = async () => {
-      persistenceEntered.resolve()
-      await persistence.promise
-    }
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-persistence-error`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `failed`, title: `Not durable` },
-      })
-      const receipt = Promise.resolve(remoteCommit?.()).then(() => undefined)
-      const settlement = observeSettlement(receipt)
-      await atPersistedOracleCheckpoint(
-        persistenceEntered.promise,
-        `terminal persistence entered`,
-      )
-      await flushAsyncWork()
-
-      expect({
-        receipt: settlement.read(),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        visible: stripVirtualProps(collection.get(`failed`)),
-        durable: adapter.rows.get(`failed`),
-      }).toEqual({
-        receipt: { status: `pending` },
-        status: `ready`,
-        publicError: undefined,
-        visible: { id: `failed`, title: `Not durable` },
-        durable: undefined,
-      })
-
-      persistence.reject(adapterError)
-      const outcome = await receipt.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-
-      const publicError = collection._lifecycle.getSyncError()
-      const receiptError =
-        outcome.status === `rejected` && outcome.reason instanceof Error
-          ? (outcome.reason as Error & {
-              code?: unknown
-              path?: unknown
-            })
-          : undefined
-      expect({
-        receiptStatus: outcome.status,
-        receiptErrorName: receiptError?.name,
-        receiptHasNamedPersistenceSemantics:
-          outcome.status === `rejected` &&
-          outcome.reason instanceof PersistedCollectionDurabilityError,
-        receiptCauseIsAdapterError: receiptError?.cause === adapterError,
-        receiptErrorCode: receiptError?.code,
-        receiptErrorPath: receiptError?.path,
-        publicErrorIsReceipt:
-          outcome.status === `rejected` && publicError === outcome.reason,
-        status: collection.status,
-        visible: stripVirtualProps(collection.get(`failed`)),
-        durable: adapter.rows.get(`failed`),
-      }).toEqual({
-        receiptStatus: `rejected`,
-        receiptErrorName: `PersistedCollectionDurabilityError`,
-        receiptHasNamedPersistenceSemantics: true,
-        receiptCauseIsAdapterError: true,
-        receiptErrorCode: `SQLITE_FULL`,
-        receiptErrorPath: `adapter.applyCommittedTx`,
-        publicErrorIsReceipt: true,
-        status: `crashed`,
-        visible: { id: `failed`, title: `Not durable` },
-        durable: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      persistence.reject(adapterError)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`publishes before persistence settles, then fails with the named durability error`, async () => {
-    const adapter = createRecordingAdapter()
-    const persistenceError = Object.assign(new Error(`persistence failed`), {
-      code: `SQLITE_IOERR_WRITE`,
-      path: `todos.sqlite-wal`,
-    })
-    let rejectPersistence: ((error: unknown) => void) | undefined
-    adapter.applyCommittedTx = () =>
-      new Promise<void>((_resolve, reject) => {
-        rejectPersistence = reject
-      })
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-persistence-error-main`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      await collection.stateWhenReady()
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `failed`, title: `Not durable` },
-      })
-      const receipt = Promise.resolve(remoteCommit?.())
-      let settled = false
-      void receipt.then(
-        () => {
-          settled = true
-        },
-        () => {
-          settled = true
-        },
-      )
-
-      expect(stripVirtualProps(collection.get(`failed`))).toEqual({
-        id: `failed`,
-        title: `Not durable`,
-      })
-      expect(settled).toBe(false)
-      await vi.waitFor(() => expect(rejectPersistence).toBeTypeOf(`function`))
-
-      rejectPersistence!(persistenceError)
-      const rejection = await receipt.then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-
-      expect(rejection).not.toBe(persistenceError)
-      expect(rejection).toMatchObject({
-        name: `PersistedCollectionDurabilityError`,
-        code: `SQLITE_IOERR_WRITE`,
-        path: `todos.sqlite-wal`,
-        cause: persistenceError,
-      })
-      expect(adapter.rows.get(`failed`)).toBeUndefined()
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(rejection)
-    } finally {
-      rejectPersistence?.(persistenceError)
-      await collection.cleanup()
-    }
-  })
-
-  it(`preserves a coordinator persistence classification without converting it to conflict`, async () => {
-    const coordinator = createCoordinatorHarness()
-    const persistenceResponse = {
-      type: `rpc:applyCommittedTx:res` as const,
-      rpcId: `persistence-response`,
-      ok: false as const,
-      code: `PERSISTENCE_ERROR` as const,
-      error: `disk write failed`,
-      sourceCode: `SQLITE_IOERR_FSYNC`,
-      path: [`database`, `wal`] as const,
-    }
-    coordinator.requestApplyCommittedTx = () =>
-      Promise.resolve(persistenceResponse)
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `coordinator-persistence-error`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter: createRecordingAdapter(), coordinator },
-      }),
-    )
-
-    try {
-      await collection.stateWhenReady()
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `remote-failure`, title: `Published once` },
-      })
-      const rejection = await Promise.resolve(remoteCommit?.()).then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-
-      expect(rejection).toMatchObject({
-        name: `PersistedCollectionDurabilityError`,
-        code: `SQLITE_IOERR_FSYNC`,
-        path: [`database`, `wal`],
-        cause: persistenceResponse,
-      })
-      expect(String(rejection)).not.toContain(`CONFLICT`)
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(rejection)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it.each([`response`, `rejection`] as const)(
-    `installs terminal state before synchronously reporting an external coordinator persistence %s`,
-    async (failureMode) => {
-      const coordinator = createCoordinatorHarness()
-      const persistenceResponse = {
-        type: `rpc:applyCommittedTx:res` as const,
-        rpcId: `reentrant-${failureMode}`,
-        ok: false as const,
-        code: `PERSISTENCE_ERROR` as const,
-        error: `disk write failed`,
-        sourceCode: `SQLITE_IOERR_FSYNC`,
-        path: [`database`, `wal`] as const,
-      }
-      const rejectedError = new PersistedCollectionDurabilityError(
-        `coordinator persistence request rejected`,
-        {
-          cause: persistenceResponse,
-          code: persistenceResponse.sourceCode,
-          path: persistenceResponse.path,
-        },
-      )
-      const requestApplyCommittedTx = vi.fn(() =>
-        failureMode === `response`
-          ? Promise.resolve(persistenceResponse)
-          : Promise.reject(rejectedError),
-      )
-      coordinator.requestApplyCommittedTx = requestApplyCommittedTx
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `terminal-before-report-${failureMode}`,
-          getKey: (item) => item.id,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-            },
-          },
-          persistence: { adapter: createRecordingAdapter(), coordinator },
-        }),
-      )
-      let reentrantKeyReads = 0
-      let reentrantReceipt:
-        | Promise<
-            { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-          >
-        | undefined
-      let hasPrimaryFailure = false
-
-      try {
-        await collection.stateWhenReady()
-        const originalCrash = collection._lifecycle.crash.bind(
-          collection._lifecycle,
-        )
-        vi.spyOn(collection._lifecycle, `crash`).mockImplementation((error) => {
-          sourceParams.begin()
-          sourceParams.write({
-            type: `insert`,
-            value: {
-              get id() {
-                reentrantKeyReads++
-                return `reentrant`
-              },
-              title: `must be fenced before error observation`,
-            },
-          })
-          reentrantReceipt = Promise.resolve(sourceParams.commit()).then(
-            () => ({ status: `fulfilled` as const }),
-            (reason: unknown) => ({ status: `rejected` as const, reason }),
-          )
-          originalCrash(error)
-        })
-
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `failed`, title: `must become terminal first` },
-        })
-        const primaryOutcome = await Promise.resolve(
-          sourceParams.commit(),
-        ).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        )
-        const reentrantOutcome = await atPersistedOracleCheckpoint(
-          reentrantReceipt!,
-          `reentrant source receipt after coordinator ${failureMode}`,
-        )
-        const terminalError =
-          primaryOutcome.status === `rejected`
-            ? primaryOutcome.reason
-            : undefined
-
-        expect({
-          primaryStatus: primaryOutcome.status,
-          reentrantStatus: reentrantOutcome.status,
-          sameTerminal:
-            reentrantOutcome.status === `rejected` &&
-            reentrantOutcome.reason === terminalError,
-          reentrantKeyReads,
-          coordinatorCalls: requestApplyCommittedTx.mock.calls.length,
-          exactPublicError:
-            collection._lifecycle.getSyncError() === terminalError,
-        }).toEqual({
-          primaryStatus: `rejected`,
-          reentrantStatus: `rejected`,
-          sameTerminal: true,
-          reentrantKeyReads: 0,
-          coordinatorCalls: 1,
-          exactPublicError: true,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => reentrantReceipt, () => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`keeps durability failure terminal when publication aborts the signal`, async () => {
-    const adapter = createRecordingAdapter()
-    const storageError = Object.assign(
-      new Error(`post-publication durability failed exactly`),
-      {
-        code: `SQLITE_IOERR`,
-        path: `adapter.applyCommittedTx`,
-      },
-    )
-    const persistenceEntered = createEventGate()
-    const releasePersistence = createEventGate()
-    adapter.applyCommittedTx = async () => {
-      persistenceEntered.resolve()
-      await releasePersistence.promise
-      throw storageError
-    }
-    let sourceParams!: TodoSyncParams
-    const abortController = new AbortController()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `post-publication-abort-durability`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const publication = collection.subscribeChanges((changes) => {
-      if (changes.some((entry) => entry.key === `failed`)) {
-        abortController.abort()
-      }
-    })
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `post-publication abort collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `failed`, title: `visible before durability` },
-      })
-      receipt = Promise.resolve(
-        sourceParams.commit(abortController.signal),
-      ).then(() => undefined)
-      void receipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        persistenceEntered.promise,
-        `post-publication abort persistence entered`,
-      )
-
-      expect({
-        signalAborted: abortController.signal.aborted,
-        visible: stripVirtualProps(collection.get(`failed`)),
-        status: collection.status,
-      }).toEqual({
-        signalAborted: true,
-        visible: { id: `failed`, title: `visible before durability` },
-        status: `ready`,
-      })
-
-      releasePersistence.resolve()
-      const outcome = await atPersistedOracleCheckpoint(
-        receipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `post-publication abort durability receipt`,
-      )
-      const terminalError =
-        outcome.status === `rejected` ? outcome.reason : undefined
-
-      expect({
-        receiptStatus: outcome.status,
-        namedDurability:
-          terminalError instanceof PersistedCollectionDurabilityError,
-        cause: terminalError instanceof Error ? terminalError.cause : undefined,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-        status: collection.status,
-        durable: adapter.rows.get(`failed`),
-      }).toEqual({
-        receiptStatus: `rejected`,
-        namedDurability: true,
-        cause: storageError,
-        exactPublicError: true,
-        status: `crashed`,
-        durable: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releasePersistence.resolve()
-      publication.unsubscribe()
-      await cleanupPersistedOracle(
-        [() => receipt?.catch(() => undefined), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`reserves FIFO admission before a publication callback commits a sibling`, async () => {
-    const adapter = createRecordingAdapter()
-    const successfulApply = adapter.applyCommittedTx.bind(adapter)
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    const firstStorageError = new Error(`reentrant first durability failed`)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-        throw firstStorageError
-      }
-      await successfulApply(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `reentrant-fifo-admission`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let siblingReceipt: Promise<void> | undefined
-    let publicationTriggers = 0
-    const subscription = collection.subscribeChanges((changes) => {
-      if (
-        publicationTriggers === 0 &&
-        changes.some((entry) => entry.key === `first`)
-      ) {
-        publicationTriggers++
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `sibling`, title: `must remain queued` },
-        })
-        siblingReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void siblingReceipt.catch(() => undefined)
-      }
-    })
-    let firstReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `reentrant FIFO collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `first`, title: `publishes before durability` },
-      })
-      firstReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void firstReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `reentrant first persistence entered`,
-      )
-      await Promise.resolve()
-
-      expect(siblingReceipt).toBeInstanceOf(Promise)
-      const firstSettlement = observeSettlement(firstReceipt)
-      const siblingSettlement = observeSettlement(siblingReceipt!)
-      await Promise.resolve()
-      expect({
-        publicationTriggers,
-        applyCalls,
-        firstReceipt: firstSettlement.read(),
-        siblingReceipt: siblingSettlement.read(),
-        visibleFirst: stripVirtualProps(collection.get(`first`)),
-        visibleSibling: collection.get(`sibling`),
-        durableFirst: adapter.rows.get(`first`),
-        durableSibling: adapter.rows.get(`sibling`),
-      }).toEqual({
-        publicationTriggers: 1,
-        applyCalls: 1,
-        firstReceipt: { status: `pending` },
-        siblingReceipt: { status: `pending` },
-        visibleFirst: { id: `first`, title: `publishes before durability` },
-        visibleSibling: undefined,
-        durableFirst: undefined,
-        durableSibling: undefined,
-      })
-
-      releaseFirstPersistence.resolve()
-      const firstOutcome = await atPersistedOracleCheckpoint(
-        firstReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `reentrant first receipt rejected`,
-      )
-      const siblingOutcome = await atPersistedOracleCheckpoint(
-        siblingReceipt!.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `reentrant sibling receipt rejected`,
-      )
-      const terminalError =
-        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
-      expect({
-        firstStatus: firstOutcome.status,
-        siblingStatus: siblingOutcome.status,
-        sameTerminal:
-          siblingOutcome.status === `rejected` &&
-          siblingOutcome.reason === terminalError,
-        status: collection.status,
-        publicErrorIsFirst:
-          collection._lifecycle.getSyncError() === terminalError,
-        visibleSibling: collection.get(`sibling`),
-        durableSibling: adapter.rows.get(`sibling`),
-        applyCalls,
-      }).toEqual({
-        firstStatus: `rejected`,
-        siblingStatus: `rejected`,
-        sameTerminal: true,
-        status: `crashed`,
-        publicErrorIsFirst: true,
-        visibleSibling: undefined,
-        durableSibling: undefined,
-        applyCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      subscription.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => firstReceipt?.catch(() => undefined),
-          () => siblingReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`keeps a reentrant sibling behind its hydration-drained parent outcome`, async () => {
-    const adapter = createRecordingAdapter()
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    const subsetFailure = new Error(`request-local hydration failed`)
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw subsetFailure
-    }
-    const persistenceEntered = createEventGate()
-    const releasePersistence = createEventGate()
-    const durabilityFailure = new Error(`hydration-drained durability failed`)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async () => {
-      applyCalls++
-      persistenceEntered.resolve()
-      await releasePersistence.promise
-      throw durabilityFailure
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydration-drained-reentrant-fifo`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let siblingReceipt: Promise<void> | undefined
-    const publication = collection.subscribeChanges((changes) => {
-      if (
-        siblingReceipt === undefined &&
-        changes.some((change) => change.key === `parent`)
-      ) {
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `sibling`, title: `Must await parent outcome` },
-        })
-        siblingReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void siblingReceipt.catch(() => undefined)
-      }
-    })
-    let load: Promise<void> | undefined
-    let parentReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `hydration-drained FIFO collection ready`,
-      )
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        loadEntered.promise,
-        `hydration-drained load entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `parent`, title: `Publishes during failure drain` },
-      })
-      parentReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void parentReceipt.catch(() => undefined)
-      rejectLoad.resolve()
-      await atPersistedOracleCheckpoint(
-        persistenceEntered.promise,
-        `hydration-drained parent persistence entered`,
-      )
-      await Promise.resolve()
-
-      expect(siblingReceipt).toBeInstanceOf(Promise)
-      const parentSettlement = observeSettlement(parentReceipt)
-      const siblingSettlement = observeSettlement(siblingReceipt!)
-      await Promise.resolve()
-      expect({
-        applyCalls,
-        parentReceipt: parentSettlement.read(),
-        siblingReceipt: siblingSettlement.read(),
-        publicParent: stripVirtualProps(collection.get(`parent`)),
-        publicSibling: collection.get(`sibling`),
-        durableSibling: adapter.rows.get(`sibling`),
-      }).toEqual({
-        applyCalls: 1,
-        parentReceipt: { status: `pending` },
-        siblingReceipt: { status: `pending` },
-        publicParent: { id: `parent`, title: `Publishes during failure drain` },
-        publicSibling: undefined,
-        durableSibling: undefined,
-      })
-
-      releasePersistence.resolve()
-      const parentOutcome = await atPersistedOracleCheckpoint(
-        parentReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `hydration-drained parent rejected`,
-      )
-      const siblingOutcome = await atPersistedOracleCheckpoint(
-        siblingReceipt!.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `hydration-drained sibling rejected`,
-      )
-      const loadOutcome = await atPersistedOracleCheckpoint(
-        load.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `hydration-drained load settled`,
-      )
-      const terminalError =
-        parentOutcome.status === `rejected` ? parentOutcome.reason : undefined
-
-      expect({
-        parentStatus: parentOutcome.status,
-        siblingStatus: siblingOutcome.status,
-        loadStatus: loadOutcome.status,
-        sameSibling:
-          siblingOutcome.status === `rejected` &&
-          siblingOutcome.reason === terminalError,
-        sameLoad:
-          loadOutcome.status === `rejected` &&
-          loadOutcome.reason === terminalError,
-        namedDurability:
-          terminalError instanceof PersistedCollectionDurabilityError,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        publicSibling: collection.get(`sibling`),
-        applyCalls,
-      }).toEqual({
-        parentStatus: `rejected`,
-        siblingStatus: `rejected`,
-        loadStatus: `rejected`,
-        sameSibling: true,
-        sameLoad: true,
-        namedDurability: true,
-        status: `crashed`,
-        publicError: terminalError,
-        publicSibling: undefined,
-        applyCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      releasePersistence.resolve()
-      publication.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          () => parentReceipt?.catch(() => undefined),
-          () => siblingReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects a queued suffix derived from an aborted staged metadata layer`, async () => {
-    const adapter = createRecordingAdapter()
-    const successfulApply = adapter.applyCommittedTx.bind(adapter)
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-      }
-      await successfulApply(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `aborted-staged-metadata-suffix`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const aborted = new AbortController()
-    let firstReceipt: Promise<void> | undefined
-    let abortedReceipt: Promise<void> | undefined
-    let dependentReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `aborted staged metadata collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `first`, title: `durability gate` },
-      })
-      firstReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void firstReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `first persistence entered before staged suffix`,
-      )
-
-      sourceParams.begin()
-      sourceParams.metadata!.row.set(`shared`, { owner: `aborted` })
-      abortedReceipt = Promise.resolve(
-        sourceParams.commit(aborted.signal),
-      ).then(() => undefined)
-      void abortedReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      const stagedOwner = sourceParams.metadata!.row.get(`shared`)
-      sourceParams.write({
-        type: `insert`,
-        value: {
-          id: `dependent`,
-          title:
-            (stagedOwner as { owner?: string } | undefined)?.owner ?? `missing`,
-        },
-      })
-      dependentReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void dependentReceipt.catch(() => undefined)
-
-      expect(stagedOwner).toEqual({ owner: `aborted` })
-      aborted.abort()
-      releaseFirstPersistence.resolve()
-      await atPersistedOracleCheckpoint(
-        firstReceipt,
-        `first durability gate settled`,
-      )
-      const abortedOutcome = await atPersistedOracleCheckpoint(
-        abortedReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `aborted staged receipt settled`,
-      )
-      const dependentOutcome = await atPersistedOracleCheckpoint(
-        dependentReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `dependent staged receipt settled`,
-      )
-      const terminalError =
-        abortedOutcome.status === `rejected` ? abortedOutcome.reason : undefined
-
-      expect({
-        abortedStatus: abortedOutcome.status,
-        abortedName:
-          terminalError instanceof Error ? terminalError.name : undefined,
-        dependentStatus: dependentOutcome.status,
-        dependentExact:
-          dependentOutcome.status === `rejected` &&
-          dependentOutcome.reason === terminalError,
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-        visibleDependent: collection.get(`dependent`),
-        durableDependent: adapter.rows.get(`dependent`),
-        durableMetadata: adapter.rowMetadata.get(`shared`),
-        applyCalls,
-      }).toEqual({
-        abortedStatus: `rejected`,
-        abortedName: `AbortError`,
-        dependentStatus: `rejected`,
-        dependentExact: true,
-        status: `crashed`,
-        exactPublicError: true,
-        visibleDependent: undefined,
-        durableDependent: undefined,
-        durableMetadata: undefined,
-        applyCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => firstReceipt?.catch(() => undefined),
-          () => abortedReceipt?.catch(() => undefined),
-          () => dependentReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not fail-stop when an aborted staged collection metadata write was superseded`, async () => {
-    const adapter = createRecordingAdapter()
-    const successfulApply = adapter.applyCommittedTx.bind(adapter)
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-      }
-      await successfulApply(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `superseded-staged-collection-metadata`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const olderAbort = new AbortController()
-    let firstReceipt: Promise<void> | undefined
-    let olderReceipt: Promise<void> | undefined
-    let newerReceipt: Promise<void> | undefined
-    let dependentReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `superseded collection metadata owner ready`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `first`, title: `durability gate` },
-      })
-      firstReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void firstReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `first persistence entered before superseded metadata writes`,
-      )
-
-      sourceParams.begin()
-      sourceParams.metadata!.collection.set(`shared`, { owner: `older` })
-      olderReceipt = Promise.resolve(
-        sourceParams.commit(olderAbort.signal),
-      ).then(() => undefined)
-      void olderReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      sourceParams.metadata!.collection.set(`shared`, { owner: `newer` })
-      newerReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void newerReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      const stagedOwner = sourceParams
-        .metadata!.collection.list()
-        .find(({ key }) => key === `shared`)?.value
-      sourceParams.write({
-        type: `insert`,
-        value: {
-          id: `dependent`,
-          title:
-            (stagedOwner as { owner?: string } | undefined)?.owner ?? `missing`,
-        },
-      })
-      dependentReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void dependentReceipt.catch(() => undefined)
-
-      expect(stagedOwner).toEqual({ owner: `newer` })
-      olderAbort.abort()
-      releaseFirstPersistence.resolve()
-      await atPersistedOracleCheckpoint(
-        firstReceipt,
-        `superseded metadata durability gate settled`,
-      )
-      const olderOutcome = await atPersistedOracleCheckpoint(
-        olderReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `superseded older metadata receipt settled`,
-      )
-      const newerOutcome = await atPersistedOracleCheckpoint(
-        newerReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `newer metadata receipt settled`,
-      )
-      const dependentOutcome = await atPersistedOracleCheckpoint(
-        dependentReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `newest-owner dependent receipt settled`,
-      )
-
-      expect({
-        olderStatus: olderOutcome.status,
-        newerStatus: newerOutcome.status,
-        dependentStatus: dependentOutcome.status,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        visibleDependent: stripVirtualProps(collection.get(`dependent`)),
-        durableDependent: adapter.rows.get(`dependent`),
-        durableMetadata: adapter.collectionMetadata.get(`shared`),
-        applyCalls,
-      }).toEqual({
-        olderStatus: `rejected`,
-        newerStatus: `fulfilled`,
-        dependentStatus: `fulfilled`,
-        status: `ready`,
-        publicError: undefined,
-        visibleDependent: { id: `dependent`, title: `newer` },
-        durableDependent: { id: `dependent`, title: `newer` },
-        durableMetadata: { owner: `newer` },
-        applyCalls: 3,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => firstReceipt?.catch(() => undefined),
-          () => olderReceipt?.catch(() => undefined),
-          () => newerReceipt?.catch(() => undefined),
-          () => dependentReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not let an old external coordinator success affect a restarted lifecycle`, async () => {
-    const id = `external-lifecycle-success`
-    const adapter = createRecordingAdapter()
-    const oldPersistenceEntered = createEventGate()
-    const releaseOldPersistence = createEventGate()
-    const coordinator = createFailStopCoordinatorHarness(id)
-    let requestCalls = 0
-    coordinator.requestApplyCommittedTx = async (_collectionId, tx) => {
-      requestCalls++
-      oldPersistenceEntered.resolve()
-      await releaseOldPersistence.promise
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-    let sourceParams!: TodoSyncParams
-    const replacement = {
-      id: `replacement`,
-      title: `owned by restarted lifecycle`,
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let oldSettlement:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `${id} initial lifecycle ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `old`, title: `must remain owned by old lifecycle` },
-      })
-      oldSettlement = Promise.resolve(sourceParams.commit()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        oldPersistenceEntered.promise,
-        `${id} old persistence entered`,
-      )
-
-      await collection.cleanup()
-      cleanedUp = true
-      adapter.rows.set(replacement.id, replacement)
-      collection.startSyncImmediate()
-      cleanedUp = false
-      const replacementSettlement = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      releaseOldPersistence.resolve()
-
-      const oldOutcome = await atPersistedOracleCheckpoint(
-        oldSettlement,
-        `${id} old receipt settled`,
-      )
-      const replacementOutcome = await atPersistedOracleCheckpoint(
-        replacementSettlement,
-        `${id} replacement lifecycle settled`,
-      )
-      await flushAsyncWork()
-
-      expect({
-        oldReceiptStatus: oldOutcome.status,
-        replacementStatus: replacementOutcome.status,
-        replacementVisible: stripVirtualProps(collection.get(replacement.id)),
-        replacementPublicError: collection._lifecycle.getSyncError(),
-        staleBroadcasts: coordinator.publishCalls.length,
-        requestCalls,
-      }).toEqual({
-        oldReceiptStatus: `fulfilled`,
-        replacementStatus: `fulfilled`,
-        replacementVisible: replacement,
-        replacementPublicError: undefined,
-        staleBroadcasts: 0,
-        requestCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseOldPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => oldSettlement,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not let an old external coordinator failure poison a restarted lifecycle`, async () => {
-    const id = `external-lifecycle-failure`
-    const adapter = createRecordingAdapter()
-    const oldPersistenceEntered = createEventGate()
-    const releaseOldPersistence = createEventGate()
-    const oldCoordinatorError = new PersistedCollectionDurabilityError(
-      `old lifecycle coordinator failure`,
-      { code: `SQLITE_IOERR_FSYNC`, path: [`database`, `wal`] },
-    )
-    const coordinator = createFailStopCoordinatorHarness(id)
-    let requestCalls = 0
-    coordinator.requestApplyCommittedTx = async (_collectionId, tx) => {
-      requestCalls++
-      if (requestCalls === 1) {
-        oldPersistenceEntered.resolve()
-        await releaseOldPersistence.promise
-        throw oldCoordinatorError
-      }
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-    let sourceParams!: TodoSyncParams
-    const replacement = {
-      id: `replacement`,
-      title: `owned by restarted lifecycle`,
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const startAndWaitForReady = async (label: string) => {
-      const ready = createEventGate()
-      const unsubscribe = collection.on(`status:ready`, () => ready.resolve())
-      collection.startSyncImmediate()
-      try {
-        await atPersistedOracleCheckpoint(ready.promise, label)
-      } finally {
-        unsubscribe()
-      }
-    }
-    let oldSettlement:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let replacementReceipt:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await startAndWaitForReady(`${id} initial lifecycle ready`)
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `old`, title: `must remain owned by old lifecycle` },
-      })
-      oldSettlement = Promise.resolve(sourceParams.commit()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        oldPersistenceEntered.promise,
-        `${id} old persistence entered`,
-      )
-
-      await collection.cleanup()
-      await startAndWaitForReady(
-        `${id} replacement lifecycle ready before old failure`,
-      )
-      sourceParams.begin()
-      sourceParams.write({ type: `insert`, value: replacement })
-      replacementReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      releaseOldPersistence.resolve()
-
-      const oldOutcome = await atPersistedOracleCheckpoint(
-        oldSettlement,
-        `${id} old receipt settled`,
-      )
-      const replacementOutcome = await atPersistedOracleCheckpoint(
-        replacementReceipt,
-        `${id} replacement transaction settled`,
-      )
-      await flushAsyncWork()
-
-      expect({
-        oldReceiptStatus: oldOutcome.status,
-        replacementStatus: replacementOutcome.status,
-        replacementVisible: stripVirtualProps(collection.get(replacement.id)),
-        replacementPublicError: collection._lifecycle.getSyncError(),
-        broadcasts: coordinator.publishCalls.length,
-        requestCalls,
-      }).toEqual({
-        oldReceiptStatus: `rejected`,
-        replacementStatus: `fulfilled`,
-        replacementVisible: replacement,
-        replacementPublicError: undefined,
-        broadcasts: 0,
-        requestCalls: 2,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseOldPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => oldSettlement,
-          () => replacementReceipt,
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not deliver coordinator work accepted before lifecycle replacement into the new owner`, async () => {
-    const id = `queued-coordinator-lifecycle`
-    const adapter = createRecordingAdapter()
-    const oldReloadEntered = createEventGate()
-    const releaseOldReload = createEventGate()
-    const replacementHydrationEntered = createEventGate()
-    const releaseReplacementHydration = createEventGate()
-    let baselineCalls = 0
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 2) {
-        replacementHydrationEntered.resolve()
-        await releaseReplacementHydration.promise
-        return [
-          {
-            key: `replacement`,
-            value: { id: `replacement`, title: `new owner baseline` },
-          },
-        ]
-      }
-      return []
-    })
-    let subsetCalls = 0
-    adapter.loadSubset = async () => {
-      subsetCalls++
-      if (subsetCalls === 1) {
-        oldReloadEntered.resolve()
-        await releaseOldReload.promise
-      }
-      return []
-    }
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const replacementControlsReady = createEventGate()
-    let sourceRuns = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            sourceRuns++
-            if (sourceRuns === 2) replacementControlsReady.resolve()
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `queued coordinator initial owner ready`,
-      )
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `old-reload-gate`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-      })
-      await atPersistedOracleCheckpoint(
-        oldReloadEntered.promise,
-        `old coordinator reload entered`,
-      )
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `queued-before-restart`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [
-          {
-            key: `stale`,
-            value: { id: `stale`, title: `must stay with old owner` },
-          },
-        ],
-        deletedKeys: [],
-      })
-
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        replacementControlsReady.promise,
-        `replacement sync controls installed`,
-      )
-      releaseOldReload.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementHydrationEntered.promise,
-        `replacement hydration entered after queued coordinator work`,
-      )
-
-      expect({
-        sourceRuns,
-        baselineCalls,
-        subsetCalls,
-        staleVisible: collection.get(`stale`),
-        staleDurable: adapter.rows.get(`stale`),
-        replacementPublicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        sourceRuns: 2,
-        baselineCalls: 2,
-        subsetCalls: 1,
-        staleVisible: undefined,
-        staleDurable: undefined,
-        replacementPublicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseOldReload.resolve()
-      releaseReplacementHydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`discards a queued collection reset when its owner is cleaned up`, async () => {
-    const id = `queued-reset-lifecycle`
-    const adapter = createRecordingAdapter()
-    const oldReloadEntered = createEventGate()
-    const releaseOldReload = createEventGate()
-    let subsetCalls = 0
-    adapter.loadSubset = async () => {
-      subsetCalls++
-      if (subsetCalls === 1) {
-        oldReloadEntered.resolve()
-        await releaseOldReload.promise
-      }
-      return []
-    }
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `queued reset initial owner ready`,
-      )
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `old-reset-gate`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-      })
-      await atPersistedOracleCheckpoint(
-        oldReloadEntered.promise,
-        `old reload entered before queued reset`,
-      )
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 1,
-      })
-
-      await collection.cleanup()
-      cleanedUp = true
-      releaseOldReload.resolve()
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      expect({
-        subsetCalls,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        subsetCalls: 1,
-        status: `cleaned-up`,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseOldReload.resolve()
-      await cleanupPersistedOracle(
-        [() => (cleanedUp ? undefined : collection.cleanup())],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not apply a delayed seq-gap replay response into a restarted lifecycle`, async () => {
-    const id = `delayed-pull-since-lifecycle`
-    const adapter = createRecordingAdapter()
-    const pullEntered = createEventGate()
-    const releasePull = createEventGate()
-    const replacementHydrationEntered = createEventGate()
-    const releaseReplacementHydration = createEventGate()
-    let baselineCalls = 0
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 2) {
-        replacementHydrationEntered.resolve()
-        await releaseReplacementHydration.promise
-        return [
-          {
-            key: `replacement`,
-            value: { id: `replacement`, title: `new owner baseline` },
-          },
-        ]
-      }
-      return []
-    })
-    const coordinator = createFailStopCoordinatorHarness(id)
-    coordinator.pullSince = async () => {
-      pullEntered.resolve()
-      await releasePull.promise
-      return {
-        type: `rpc:pullSince:res`,
-        rpcId: `old-delayed-pull`,
-        ok: true,
-        latestTerm: 1,
-        latestSeq: 2,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedKeys: [`stale`],
-        deletedKeys: [],
-        deltas: [
-          {
-            txId: `old-delayed-delta`,
-            latestRowVersion: 2,
-            changedRows: [
-              {
-                key: `stale`,
-                value: { id: `stale`, title: `must stay with old owner` },
-              },
-            ],
-            deletedKeys: [],
-            rowMetadataMutations: [],
-            collectionMetadataMutations: [],
-          },
-        ],
-      }
-    }
-    const replacementControlsReady = createEventGate()
-    let sourceRuns = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            sourceRuns++
-            if (sourceRuns === 2) replacementControlsReady.resolve()
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `delayed pull initial owner ready`,
-      )
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `gap-trigger`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        pullEntered.promise,
-        `old pullSince entered`,
-      )
-
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        replacementControlsReady.promise,
-        `delayed pull replacement controls installed`,
-      )
-      releasePull.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementHydrationEntered.promise,
-        `replacement hydration entered after delayed pull replay`,
-      )
-
-      expect({
-        sourceRuns,
-        baselineCalls,
-        staleVisible: collection.get(`stale`),
-        staleDurable: adapter.rows.get(`stale`),
-        replacementPublicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        sourceRuns: 2,
-        baselineCalls: 2,
-        staleVisible: undefined,
-        staleDurable: undefined,
-        replacementPublicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releasePull.resolve()
-      releaseReplacementHydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not apply a later seq-gap replay delta through replacement controls`, async () => {
-    const id = `two-delta-replay-lifecycle`
-    const firstReceiptEntered = createEventGate()
-    const releaseFirstReceipt = createEventGate()
-    const replacementControlsInstalled = createEventGate()
-    const replacementHydrationEntered = createEventGate()
-    const releaseReplacementHydration = createEventGate()
-    let baselineCalls = 0
-    const adapter = createRecordingAdapter()
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 2) {
-        replacementHydrationEntered.resolve()
-        await releaseReplacementHydration.promise
-        return [
-          {
-            key: `replacement`,
-            value: { id: `replacement`, title: `B baseline` },
-          },
-        ]
-      }
-      return []
-    })
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const pullArguments: Array<{
-      collectionId: string
-      fromRowVersion: number
-    }> = []
-    coordinator.pullSince = async (collectionId, fromRowVersion) => {
-      pullArguments.push({ collectionId, fromRowVersion })
-      return {
-        type: `rpc:pullSince:res`,
-        rpcId: `two-delta-replay`,
-        ok: true,
-        latestTerm: 1,
-        latestSeq: 3,
-        latestRowVersion: 3,
-        requiresFullReload: false,
-        changedKeys: [`first`, `second`],
-        deletedKeys: [],
-        deltas: [
-          {
-            txId: `A-delta-1`,
-            latestRowVersion: 1,
-            changedRows: [
-              {
-                key: `first`,
-                value: { id: `first`, title: `A first delta` },
-              },
-            ],
-            deletedKeys: [],
-            rowMetadataMutations: [
-              { type: `set`, key: `first`, value: { owner: `A-first` } },
-            ],
-            collectionMetadataMutations: [
-              { type: `set`, key: `replay:first`, value: `A-first` },
-            ],
-          },
-          {
-            txId: `A-delta-2`,
-            latestRowVersion: 2,
-            changedRows: [
-              {
-                key: `second`,
-                value: { id: `second`, title: `A second delta` },
-              },
-            ],
-            deletedKeys: [],
-            rowMetadataMutations: [
-              { type: `set`, key: `second`, value: { owner: `A-second` } },
-            ],
-            collectionMetadataMutations: [
-              { type: `set`, key: `replay:second`, value: `A-second` },
-            ],
-          },
-        ],
-      }
-    }
-
-    let gateNextApplicationReceipt = false
-    let controlsRun = 0
-    const applicationReceipts: Array<{
-      controlsOwner: `A` | `B`
-      returnedReceipt: `actual` | `held`
-      rowMetadataKeys: Array<string>
-      collectionMetadataKeys: Array<string>
-    }> = []
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: { sync: ({ markReady }) => markReady() },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) => {
-          controlsRun++
-          const controlsOwner =
-            controlsRun === 1 ? (`A` as const) : (`B` as const)
-          if (controlsOwner === `B`) replacementControlsInstalled.resolve()
-          let rowMetadataKeys: Array<string> = []
-          let collectionMetadataKeys: Array<string> = []
-          return baseSync({
-            ...params,
-            begin: () => {
-              rowMetadataKeys = []
-              collectionMetadataKeys = []
-              return params.begin()
-            },
-            metadata: {
-              persistence: params.metadata!.persistence,
-              row: {
-                ...params.metadata!.row,
-                set: (key, value) => {
-                  rowMetadataKeys.push(String(key))
-                  params.metadata!.row.set(key, value)
-                },
-                delete: (key) => {
-                  rowMetadataKeys.push(String(key))
-                  params.metadata!.row.delete(key)
-                },
-              },
-              collection: {
-                ...params.metadata!.collection,
-                set: (key, value) => {
-                  collectionMetadataKeys.push(key)
-                  params.metadata!.collection.set(key, value)
-                },
-                delete: (key) => {
-                  collectionMetadataKeys.push(key)
-                  params.metadata!.collection.delete(key)
-                },
-              },
-            },
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (
-                !gateNextApplicationReceipt &&
-                applicationReceipts.length === 0
-              ) {
-                return actualReceipt
-              }
-              const trace = {
-                controlsOwner,
-                returnedReceipt: `actual` as `actual` | `held`,
-                rowMetadataKeys: [...rowMetadataKeys],
-                collectionMetadataKeys: [...collectionMetadataKeys],
-              }
-              applicationReceipts.push(trace)
-              if (gateNextApplicationReceipt) {
-                gateNextApplicationReceipt = false
-                trace.returnedReceipt = `held`
-                firstReceiptEntered.resolve()
-                void Promise.resolve(actualReceipt).catch(() => undefined)
-                return releaseFirstReceipt.promise
-              }
-              return actualReceipt
-            },
-          })
-        },
-      },
-    })
-    let replacementReady: Promise<unknown> | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `two-delta A lifecycle ready`,
-      )
-      applicationReceipts.length = 0
-      gateNextApplicationReceipt = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 3,
-        txId: `gap-trigger`,
-        latestRowVersion: 3,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        firstReceiptEntered.promise,
-        `two-delta first A receipt held`,
-      )
-      expect(collection.get(`first`)?.title).toBe(`A first delta`)
-
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        replacementControlsInstalled.promise,
-        `two-delta B controls installed`,
-      )
-
-      releaseFirstReceipt.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementHydrationEntered.promise,
-        `two-delta B hydration held`,
-      )
-      await Promise.resolve()
-
-      const secondReceipts = applicationReceipts.filter(
-        (receipt) =>
-          receipt.rowMetadataKeys.includes(`second`) ||
-          receipt.collectionMetadataKeys.includes(`replay:second`),
-      )
-      expect({
-        controlsRun,
-        pullArguments,
-        secondReceipts,
-        secondRowMetadata: collection._state.syncedMetadata.get(`second`),
-        secondCollectionMetadata:
-          collection._state.syncedCollectionMetadata.get(`replay:second`),
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        controlsRun: 2,
-        pullArguments: [{ collectionId: id, fromRowVersion: 0 }],
-        secondReceipts: [],
-        secondRowMetadata: undefined,
-        secondCollectionMetadata: undefined,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstReceipt.resolve()
-      releaseReplacementHydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not confirm a delayed local coordinator response through a restarted owner`, async () => {
-    const id = `delayed-local-confirmation-lifecycle`
-    const adapter = createRecordingAdapter()
-    const replacementHydrationEntered = createEventGate()
-    const releaseReplacementHydration = createEventGate()
-    let baselineCalls = 0
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 2) {
-        replacementHydrationEntered.resolve()
-        await releaseReplacementHydration.promise
-        return [
-          {
-            key: `replacement`,
-            value: { id: `replacement`, title: `new owner baseline` },
-          },
-        ]
-      }
-      return []
-    })
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const requestEntered = createEventGate()
-    const releaseRequest = createEventGate()
-    coordinator.requestApplyLocalMutations = async (
-      _collectionId,
-      mutations,
-    ) => {
-      requestEntered.resolve()
-      await releaseRequest.promise
-      return {
-        type: `rpc:applyLocalMutations:res`,
-        rpcId: `old-delayed-local`,
-        ok: true,
-        term: 1,
-        seq: 1,
-        latestRowVersion: 1,
-        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
-      }
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const oldRow = { id: `old-local`, title: `must stay with old owner` }
-    let localTransaction: ReturnType<typeof collection.insert> | undefined
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `delayed local initial owner ready`,
-      )
-      localTransaction = collection.insert(oldRow)
-      await atPersistedOracleCheckpoint(
-        requestEntered.promise,
-        `old local coordinator request entered`,
-      )
-
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      releaseRequest.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementHydrationEntered.promise,
-        `replacement hydration entered after delayed local confirmation`,
-      )
-
-      expect({
-        baselineCalls,
-        staleVisible: collection.get(oldRow.id),
-        staleDurable: adapter.rows.get(oldRow.id),
-        replacementPublicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        baselineCalls: 2,
-        staleVisible: undefined,
-        staleDurable: undefined,
-        replacementPublicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseRequest.resolve()
-      releaseReplacementHydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => localTransaction?.isPersisted.promise.catch(() => undefined),
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not admit an old pending user hook through a restarted coordinator`, async () => {
-    const id = `pending-user-hook-lifecycle`
-    const adapter = createRecordingAdapter()
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const hookEntered = createEventGate()
-    const releaseHook = createEventGate()
-    let coordinatorRequests = 0
-    coordinator.requestApplyLocalMutations = async (
-      _collectionId,
-      mutations,
-    ) => {
-      coordinatorRequests++
-      return {
-        type: `rpc:applyLocalMutations:res`,
-        rpcId: `stale-user-hook-request`,
-        ok: true,
-        term: 1,
-        seq: 1,
-        latestRowVersion: 1,
-        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
-      }
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        onInsert: async () => {
-          hookEntered.resolve()
-          await releaseHook.promise
-          return {}
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let transaction: ReturnType<typeof collection.insert> | undefined
-    let transactionOutcome:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `pending user hook initial owner ready`,
-      )
-      transaction = collection.insert({
-        id: `old-hook`,
-        title: `must not enter replacement coordinator`,
-      })
-      transactionOutcome = transaction.isPersisted.promise.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        hookEntered.promise,
-        `old user hook entered before coordinator admission`,
-      )
-      expect(coordinatorRequests).toBe(0)
-
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      // Readiness counts the replacement's accepted startup rows, which the
-      // old hook's still-persisting transaction holds.
-      const replacementOutcome = await atPersistedOracleCheckpoint(
-        replacementReady,
-        `pending user hook replacement owner ready`,
-      )
-      releaseHook.resolve()
-      const outcome = await atPersistedOracleCheckpoint(
-        transactionOutcome,
-        `pending user hook transaction settled`,
-      )
-
-      expect({
-        replacementStatus: replacementOutcome.status,
-        transactionStatus: outcome.status,
-        coordinatorRequests,
-        durableOldRow: adapter.rows.get(`old-hook`),
-      }).toEqual({
-        replacementStatus: `fulfilled`,
-        transactionStatus: `rejected`,
-        coordinatorRequests: 0,
-        durableOldRow: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseHook.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => transactionOutcome,
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not let old loopback readiness complete a restarted hydration`, async () => {
-    const adapter = createRecordingAdapter()
-    const oldHydrationEntered = createEventGate()
-    const releaseOldHydration = createEventGate()
-    const replacementHydrationEntered = createEventGate()
-    const releaseReplacementHydration = createEventGate()
-    let baselineCalls = 0
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 1) {
-        oldHydrationEntered.resolve()
-        await releaseOldHydration.promise
-        return []
-      }
-      replacementHydrationEntered.resolve()
-      await releaseReplacementHydration.promise
-      return [
-        {
-          key: `replacement`,
-          value: { id: `replacement`, title: `new owner baseline` },
-        },
-      ]
-    })
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `loopback-late-readiness-lifecycle`,
-        getKey: (row) => row.id,
-        persistence: { adapter },
-      }),
-    )
-    const oldReady = collection.stateWhenReady().then(
-      () => ({ status: `fulfilled` as const }),
-      (reason: unknown) => ({ status: `rejected` as const, reason }),
-    )
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        oldHydrationEntered.promise,
-        `old loopback hydration entered`,
-      )
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-
-      releaseOldHydration.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementHydrationEntered.promise,
-        `replacement loopback hydration entered`,
-      )
-      await flushAsyncWork()
-
-      expect({
-        baselineCalls,
-        replacementIsReady: collection.isReady(),
-        replacementVisible: collection.get(`replacement`),
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        baselineCalls: 2,
-        replacementIsReady: false,
-        replacementVisible: undefined,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseOldHydration.resolve()
-      releaseReplacementHydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => oldReady,
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`fulfill`, `reject`] as const)(
-    `keeps retired loopback startup inert after cleanup: %s`,
-    async (outcome) => {
-      const adapter = createRecordingAdapter()
-      const hydrationEntered = createEventGate()
-      const hydrationGate = createEventGate()
-      const startupError = new Error(`retired loopback startup failed`)
-      const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
-        hydrationEntered.resolve()
-        await hydrationGate.promise
-        if (outcome === `reject`) throw startupError
-        return []
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `retired-loopback-startup-${outcome}`,
-          getKey: (row) => row.id,
-          persistence: { adapter },
-        }),
-      )
-      const readiness = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const unhandled: Array<unknown> = []
-      const captureUnhandled = (error: unknown) => unhandled.push(error)
-      process.on(`unhandledRejection`, captureUnhandled)
-      const peer = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `retired-loopback-peer-${outcome}`,
-          getKey: (row) => row.id,
-          persistence: { adapter: createRecordingAdapter() },
-        }),
-      )
-      let hasPrimaryFailure = false
-
-      try {
-        await atPersistedOracleCheckpoint(
-          hydrationEntered.promise,
-          `retired loopback hydration entered`,
-        )
-        await collection.cleanup()
-        const retiredStatus = collection.status
-
-        hydrationGate.resolve()
-        await flushAsyncWork()
-        await flushAsyncWork()
-        const readinessOutcome = await readiness
-        await atPersistedOracleCheckpoint(
-          peer.stateWhenReady(),
-          `independent loopback peer ready`,
-        )
-
-        expect({
-          retiredStatus,
-          finalStatus: collection.status,
-          readinessStatus: readinessOutcome.status,
-          readinessErrorName:
-            readinessOutcome.status === `rejected` &&
-            readinessOutcome.reason instanceof Error
-              ? readinessOutcome.reason.name
-              : undefined,
-          publicError: collection._lifecycle.getSyncError(),
-          warnings: warnings.mock.calls,
-          unhandled,
-          peerStatus: peer.status,
-        }).toEqual({
-          retiredStatus: `cleaned-up`,
-          finalStatus: `cleaned-up`,
-          readinessStatus: `rejected`,
-          readinessErrorName: `AbortError`,
-          publicError: undefined,
-          warnings: [],
-          unhandled: [],
-          peerStatus: `ready`,
-        })
-
-        // This hostile control bypasses the sync-run-owned callback. It proves
-        // the status observation above would reject an unfenced late ready.
-        expect(() => collection._lifecycle.markReady()).toThrowError(
-          expect.objectContaining({ name: `CollectionStateError` }),
-        )
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        restoreBaselineRows()
-        hydrationGate.resolve()
-        process.off(`unhandledRejection`, captureUnhandled)
-        warnings.mockRestore()
-        await cleanupPersistedOracle(
-          [() => readiness, () => collection.cleanup(), () => peer.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`settles old source cleanup before hydrating a same-resource replacement`, async () => {
-    const id = `same-resource-cleanup-settlement`
-    const adapter = createRecordingAdapter()
-    adapter.rows.set(`retired`, {
-      id: `retired`,
-      title: `must not survive old cleanup`,
-    })
-    const cleanupGate = createEventGate()
-    let sourceCleanupSettled = false
-    const create = (withCleanup: boolean) =>
-      createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return withCleanup
-                ? {
-                    cleanup: () =>
-                      cleanupGate.promise.then(() => {
-                        adapter.rows.delete(`retired`)
-                        sourceCleanupSettled = true
-                      }),
-                  }
-                : undefined
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-    const oldCollection = create(true)
-    let replacement: ReturnType<typeof create> | undefined
-    let replacementReady: Promise<unknown> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        oldCollection.stateWhenReady(),
-        `old same-resource owner ready`,
-      )
-      expect(stripVirtualProps(oldCollection.get(`retired`))).toEqual({
-        id: `retired`,
-        title: `must not survive old cleanup`,
-      })
-
-      const replacementStarted = oldCollection.cleanup().then(() => {
-        replacement = create(false)
-        replacementReady = replacement.stateWhenReady()
-        return replacementReady
-      })
-      await flushAsyncWork()
-
-      expect(sourceCleanupSettled).toBe(false)
-      expect(replacement).toBeUndefined()
-
-      cleanupGate.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementStarted,
-        `same-resource replacement ready after cleanup`,
-      )
-
-      expect(sourceCleanupSettled).toBe(true)
-      expect(adapter.rows.has(`retired`)).toBe(false)
-      expect(replacement?.get(`retired`)).toBeUndefined()
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      cleanupGate.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => replacementReady,
-          () => oldCollection.cleanup(),
-          () => replacement?.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`fulfill`, `reject`] as const)(
-    `awaits cleanup returned after reentrant persisted source retirement: %s`,
-    async (outcome) => {
-      const adapter = createRecordingAdapter()
-      const sourceEntered = createEventGate()
-      const cleanupGate = createEventGate()
-      const sourceError = new Error(`reentrant source cleanup failed`)
-      let cleanupCalls = 0
-      let cleanupFromReentry: Promise<void> | undefined
-      let reenterCleanup = true
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `reentrant-persisted-source-cleanup-${outcome}`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ collection: publicCollection, markReady }) => {
-              if (!reenterCleanup) {
-                markReady()
-                return
-              }
-              reenterCleanup = false
-              cleanupFromReentry = publicCollection.cleanup()
-              sourceEntered.resolve()
-              return {
-                cleanup: () => {
-                  cleanupCalls++
-                  return cleanupGate.promise.then(() => {
-                    if (outcome === `reject`) throw sourceError
-                  })
-                },
-              }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      let cleanupSettled = false
-      let hasPrimaryFailure = false
-
-      try {
-        collection.startSyncImmediate()
-        await atPersistedOracleCheckpoint(
-          sourceEntered.promise,
-          `reentrant persisted source entered`,
-        )
-        if (!cleanupFromReentry) {
-          throw new Error(`reentrant cleanup was not captured`)
-        }
-        void cleanupFromReentry.then(
-          () => {
-            cleanupSettled = true
-          },
-          () => {
-            cleanupSettled = true
-          },
-        )
-        await flushAsyncWork()
-
-        expect({ cleanupCalls, cleanupSettled }).toEqual({
-          cleanupCalls: 1,
-          cleanupSettled: false,
-        })
-
-        cleanupGate.resolve()
-        if (outcome === `reject`) {
-          await expect(cleanupFromReentry).rejects.toMatchObject({
-            name: `SyncCleanupError`,
-            cause: sourceError,
-          })
-        } else {
-          await expect(cleanupFromReentry).resolves.toBeUndefined()
-        }
-        expect(collection.status).toBe(`cleaned-up`)
-        expect(cleanupCalls).toBe(1)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        cleanupGate.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => cleanupFromReentry?.catch(() => undefined),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`does not register remote ownership returned by a retired source sync`, async () => {
-    const id = `reentrant-retired-remote-owner`
-    const adapter = createRecordingAdapter()
-    const coordinator = new SingleProcessCoordinator()
-    const sourceEntered = createEventGate()
-    let cleanupFromReentry: Promise<void> | undefined
-    let retiredSourceLoads = 0
-    const oldCollection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ collection: publicCollection }) => {
-            cleanupFromReentry = publicCollection.cleanup()
-            sourceEntered.resolve()
-            return {
-              loadSubset: () => {
-                retiredSourceLoads++
-                return true
-              },
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let replacement: Collection<Todo, string> | undefined
-    let replacementReady: Promise<unknown> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      oldCollection.startSyncImmediate()
-      await atPersistedOracleCheckpoint(
-        sourceEntered.promise,
-        `retired remote-owner source entered`,
-      )
-      if (!cleanupFromReentry) {
-        throw new Error(`reentrant cleanup was not captured`)
-      }
-      await atPersistedOracleCheckpoint(
-        cleanupFromReentry,
-        `retired remote-owner cleanup settled`,
-      )
-
-      replacement = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      replacementReady = replacement.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        replacementReady,
-        `same-id replacement ready after retired source entry`,
-      )
-
-      expect({
-        oldStatus: oldCollection.status,
-        replacementStatus: replacement.status,
-        retiredSourceLoads,
-      }).toEqual({
-        oldStatus: `cleaned-up`,
-        replacementStatus: `ready`,
-        retiredSourceLoads: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [
-          () => cleanupFromReentry,
-          () => replacementReady,
-          () => oldCollection.cleanup(),
-          () => replacement?.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`settles every cleanup task after synchronous runtime teardown failures`, async () => {
-    const id = `synchronous-runtime-cleanup-failure`
-    const adapter = createRecordingAdapter()
-    const coordinator = new SingleProcessCoordinator()
-    const sourceCleanupGate = createEventGate()
-    const firstRuntimeError = new Error(`coordinator unsubscribe failed`)
-    const laterRuntimeError = new Error(`remote owner unsubscribe failed`)
-    const cleanupEvents: Array<string> = []
-    let subscriptionCount = 0
-    let ownerCount = 0
-    const subscribe = coordinator.subscribe.bind(coordinator)
-    coordinator.subscribe = () => {
-      const unsubscribe = subscribe()
-      const fail = subscriptionCount++ === 0
-      return () => {
-        unsubscribe()
-        cleanupEvents.push(`coordinator`)
-        if (fail) throw firstRuntimeError
-      }
-    }
-    const registerRemoteSubsetOwner =
-      coordinator.registerRemoteSubsetOwner.bind(coordinator)
-    coordinator.registerRemoteSubsetOwner = (collectionId, owner) => {
-      const unregister = registerRemoteSubsetOwner(collectionId, owner)
-      const fail = ownerCount++ === 0
-      return () => {
-        unregister()
-        cleanupEvents.push(`remote-owner`)
-        if (fail) throw laterRuntimeError
-      }
-    }
-    let sourceCleanupCalls = 0
-    const oldCollection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              cleanup: () => {
-                sourceCleanupCalls++
-                return sourceCleanupGate.promise
-              },
-              loadSubset: () => true,
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let replacement: Collection<Todo, string> | undefined
-    let replacementReady: Promise<unknown> | undefined
-    let cleanupSettled = false
-    let cleanupOutcome:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; error: unknown }
-        >
-      | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        oldCollection.stateWhenReady(),
-        `runtime-cleanup source ready`,
-      )
-      cleanupOutcome = oldCollection.cleanup().then(
-        () => ({ status: `fulfilled` as const }),
-        (error: unknown) => ({ status: `rejected` as const, error }),
-      )
-      void cleanupOutcome.then(() => {
-        cleanupSettled = true
-      })
-      await flushAsyncWork()
-
-      expect({ sourceCleanupCalls, cleanupSettled }).toEqual({
-        sourceCleanupCalls: 1,
-        cleanupSettled: false,
-      })
-
-      sourceCleanupGate.resolve()
-      const outcome = await atPersistedOracleCheckpoint(
-        cleanupOutcome,
-        `runtime cleanup tasks settled`,
-      )
-      expect(outcome.status).toBe(`rejected`)
-      if (outcome.status !== `rejected`) {
-        throw new Error(`expected runtime cleanup to reject`)
-      }
-      expect(outcome.error).toMatchObject({ name: `SyncCleanupError` })
-      const syncCleanupError = outcome.error as { cause?: unknown }
-      expect(syncCleanupError.cause).toBeInstanceOf(AggregateError)
-      const aggregate = syncCleanupError.cause as AggregateError
-      expect(aggregate.cause).toBe(firstRuntimeError)
-      expect(aggregate.errors).toEqual([firstRuntimeError, laterRuntimeError])
-      expect(cleanupEvents).toEqual([`coordinator`, `remote-owner`])
-
-      replacement = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      replacementReady = replacement.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        replacementReady,
-        `replacement ready after failed runtime cleanup`,
-      )
-      expect(replacement.status).toBe(`ready`)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      sourceCleanupGate.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => cleanupOutcome,
-          () => replacementReady,
-          () => oldCollection.cleanup(),
-          () => replacement?.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`preserves source and runtime failures when persisted cleanup has both`, async () => {
-    const id = `source-and-runtime-cleanup-failures`
-    const adapter = createRecordingAdapter()
-    const coordinator = new SingleProcessCoordinator()
-    const sourceCleanupGate = createEventGate()
-    const sourceError = new Error(`source cleanup failed exactly`)
-    const runtimeError = new Error(`runtime cleanup failed exactly`)
-    let sourceCleanupCalls = 0
-    let runtimeCleanupCalls = 0
-    const subscribe = coordinator.subscribe.bind(coordinator)
-    coordinator.subscribe = () => {
-      const unsubscribe = subscribe()
-      return () => {
-        unsubscribe()
-        runtimeCleanupCalls++
-        throw runtimeError
-      }
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              cleanup: () => {
-                sourceCleanupCalls++
-                return sourceCleanupGate.promise
-              },
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let cleanupOutcome:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; error: unknown }
-        >
-      | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `dual-failure persisted collection ready`,
-      )
-      cleanupOutcome = collection.cleanup().then(
-        () => ({ status: `fulfilled` as const }),
-        (error: unknown) => ({ status: `rejected` as const, error }),
-      )
-      await flushAsyncWork()
-
-      expect({ sourceCleanupCalls, runtimeCleanupCalls }).toEqual({
-        sourceCleanupCalls: 1,
-        runtimeCleanupCalls: 1,
-      })
-
-      sourceCleanupGate.reject(sourceError)
-      const outcome = await atPersistedOracleCheckpoint(
-        cleanupOutcome,
-        `source and runtime cleanup failures settled`,
-      )
-      expect(outcome.status).toBe(`rejected`)
-      if (outcome.status !== `rejected`) {
-        throw new Error(`expected persisted cleanup to reject`)
-      }
-      expect(outcome.error).toMatchObject({ name: `SyncCleanupError` })
-      const syncCleanupError = outcome.error as { cause?: unknown }
-      expect(syncCleanupError.cause).toBeInstanceOf(AggregateError)
-      const aggregate = syncCleanupError.cause as AggregateError
-      expect(aggregate.cause).toBe(sourceError)
-      expect(aggregate.errors).toEqual([sourceError, runtimeError])
-      expect(collection.status).toBe(`cleaned-up`)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      sourceCleanupGate.resolve()
-      await cleanupPersistedOracle(
-        [() => cleanupOutcome, () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`marks a targeted invalidation commit-receipt rejection terminal`, async () => {
-    const id = `targeted-invalidation-receipt`
-    const adapter = createRecordingAdapter()
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const receiptEntered = createEventGate()
-    const rejectedReceipt = createEventGate()
-    const receiptError = new Error(
-      `targeted invalidation receipt failed exactly`,
-    )
-    let rejectNextCommit = false
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-        },
-      },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (!rejectNextCommit) return actualReceipt
-              rejectNextCommit = false
-              receiptEntered.resolve()
-              void Promise.resolve(actualReceipt).catch(() => undefined)
-              return rejectedReceipt.promise
-            },
-          }),
-      },
-    })
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `targeted receipt collection ready`,
-      )
-      rejectNextCommit = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `targeted-receipt-failure`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          {
-            key: `targeted`,
-            value: { id: `targeted`, title: `publication attempted` },
-          },
-        ],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        receiptEntered.promise,
-        `targeted invalidation receipt entered`,
-      )
-      rejectedReceipt.reject(receiptError)
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      expect({
-        status: collection.status,
-        exactPublicError: collection._lifecycle.getSyncError() === receiptError,
-      }).toEqual({
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectedReceipt.reject(receiptError)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`waits for a reset truncate receipt before reloading`, async () => {
-    const id = `reset-truncate-receipt`
-    const seed = { id: `seed`, title: `must survive a failed reset` }
-    const adapter = createRecordingAdapter([seed])
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const receiptEntered = createEventGate()
-    const rejectedReceipt = createEventGate()
-    const receiptError = new Error(`reset truncate receipt failed exactly`)
-    let rejectNextCommit = false
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-        },
-      },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (!rejectNextCommit) return actualReceipt
-              rejectNextCommit = false
-              receiptEntered.resolve()
-              void Promise.resolve(actualReceipt).catch(() => undefined)
-              return rejectedReceipt.promise
-            },
-          }),
-      },
-    })
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `reset receipt collection ready`,
-      )
-      const baselineLoadCount = adapter.loadSubsetCalls.length
-      rejectNextCommit = true
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 1,
-      })
-      await atPersistedOracleCheckpoint(
-        receiptEntered.promise,
-        `reset truncate receipt entered`,
-      )
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      expect(adapter.loadSubsetCalls.length).toBe(baselineLoadCount)
-
-      rejectedReceipt.reject(receiptError)
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      expect({
-        status: collection.status,
-        exactPublicError: collection._lifecycle.getSyncError() === receiptError,
-      }).toEqual({
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectedReceipt.reject(receiptError)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`keeps local persistence pending through confirmation receipt settlement`, async () => {
-    const id = `local-confirmation-receipt`
-    const adapter = createRecordingAdapter()
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const receiptEntered = createEventGate()
-    const rejectedReceipt = createEventGate()
-    const receiptError = new Error(`local confirmation receipt failed exactly`)
-    let rejectNextCommit = false
-    coordinator.requestApplyLocalMutations = async (
-      _collectionId,
-      mutations,
-    ) => {
-      rejectNextCommit = true
-      return {
-        type: `rpc:applyLocalMutations:res`,
-        rpcId: `local-confirmation`,
-        ok: true,
-        term: 1,
-        seq: 1,
-        latestRowVersion: 1,
-        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
-      }
-    }
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (!rejectNextCommit) return actualReceipt
-              rejectNextCommit = false
-              receiptEntered.resolve()
-              void Promise.resolve(actualReceipt).catch(() => undefined)
-              return rejectedReceipt.promise
-            },
-          }),
-      },
-    })
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `local confirmation receipt collection ready`,
-      )
-      const transaction = collection.insert({
-        id: `local`,
-        title: `durable before confirmation settles`,
-      })
-      const transactionOutcome = transaction.isPersisted.promise.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        receiptEntered.promise,
-        `local confirmation receipt entered`,
-      )
-      const pending = observeSettlement(
-        transactionOutcome.then(() => undefined),
-      )
-      await Promise.resolve()
-      expect(pending.read()).toEqual({ status: `pending` })
-
-      rejectedReceipt.reject(receiptError)
-      const outcome = await atPersistedOracleCheckpoint(
-        transactionOutcome,
-        `local confirmation transaction settled`,
-      )
-      await flushAsyncWork()
-
-      expect({
-        transactionStatus: outcome.status,
-        transactionExact:
-          outcome.status === `rejected` && outcome.reason === receiptError,
-        status: collection.status,
-        exactPublicError: collection._lifecycle.getSyncError() === receiptError,
-      }).toEqual({
-        transactionStatus: `rejected`,
-        transactionExact: true,
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectedReceipt.reject(receiptError)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not continue an old hydration into a replacement after its applied receipt settles`, async () => {
-    const id = `hydration-applied-receipt-lifecycle`
-    const adapter = createRecordingAdapter()
-    const receiptEntered = createEventGate()
-    const releaseReceipt = createEventGate()
-    let gateNextCommit = false
-    let baselineCalls = 0
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 1) {
-        gateNextCommit = true
-        return [
-          {
-            key: `old`,
-            value: { id: `old`, title: `old owner hydration` },
-          },
-        ]
-      }
-      return [
-        {
-          key: `replacement`,
-          value: { id: `replacement`, title: `new owner hydration` },
-        },
-      ]
-    })
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-        },
-      },
-      persistence: { adapter },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (!gateNextCommit) return actualReceipt
-              gateNextCommit = false
-              receiptEntered.resolve()
-              void Promise.resolve(actualReceipt).catch(() => undefined)
-              return releaseReceipt.promise
-            },
-          }),
-      },
-    })
-    const oldReady = collection.stateWhenReady().then(
-      () => ({ status: `fulfilled` as const }),
-      (reason: unknown) => ({ status: `rejected` as const, reason }),
-    )
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        receiptEntered.promise,
-        `old hydration applied receipt entered`,
-      )
-      expect(stripVirtualProps(collection.get(`old`))).toEqual({
-        id: `old`,
-        title: `old owner hydration`,
-      })
-
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      releaseReceipt.resolve()
-      const replacementOutcome = await atPersistedOracleCheckpoint(
-        replacementReady,
-        `replacement hydration after old applied receipt`,
-      )
-
-      expect({
-        replacementStatus: replacementOutcome.status,
-        baselineCalls,
-        oldVisible: collection.get(`old`),
-        replacementVisible: stripVirtualProps(collection.get(`replacement`)),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        replacementStatus: `fulfilled`,
-        baselineCalls: 2,
-        oldVisible: undefined,
-        replacementVisible: {
-          id: `replacement`,
-          title: `new owner hydration`,
-        },
-        status: `ready`,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseReceipt.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => oldReady,
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not let an old post-receipt continuation flush replacement coordinator work`, async () => {
-    const id = `post-receipt-queue-lifecycle`
-    const adapter = createRecordingAdapter()
-    const coordinator = createFailStopCoordinatorHarness(id)
-    const receiptEntered = createEventGate()
-    const releaseReceipt = createEventGate()
-    const replacementSourceStarted = createEventGate()
-    const replacementHydrationEntered = createEventGate()
-    const releaseReplacementHydration = createEventGate()
-    let gateNextCommit = false
-    let baselineCalls = 0
-    let sourceRuns = 0
-    overrideBaselineRows(adapter, async () => {
-      baselineCalls++
-      if (baselineCalls === 1) {
-        gateNextCommit = true
-        return [
-          {
-            key: `old`,
-            value: { id: `old`, title: `old owner hydration` },
-          },
-        ]
-      }
-      replacementHydrationEntered.resolve()
-      await releaseReplacementHydration.promise
-      return [
-        {
-          key: `replacement`,
-          value: { id: `replacement`, title: `new owner hydration` },
-        },
-      ]
-    })
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          sourceRuns++
-          if (sourceRuns === 2) replacementSourceStarted.resolve()
-          markReady()
-        },
-      },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (!gateNextCommit) return actualReceipt
-              gateNextCommit = false
-              receiptEntered.resolve()
-              void Promise.resolve(actualReceipt).catch(() => undefined)
-              return releaseReceipt.promise
-            },
-          }),
-      },
-    })
-    const oldReady = collection.stateWhenReady().then(
-      () => ({ status: `fulfilled` as const }),
-      (reason: unknown) => ({ status: `rejected` as const, reason }),
-    )
-    let replacementReady:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        receiptEntered.promise,
-        `old post-receipt hydration entered`,
-      )
-      await collection.cleanup()
-      cleanedUp = true
-      collection.startSyncImmediate()
-      cleanedUp = false
-      replacementReady = collection.stateWhenReady().then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        replacementSourceStarted.promise,
-        `replacement source subscribed behind old receipt`,
-      )
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `replacement-queued-work`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          {
-            key: `queued`,
-            value: {
-              id: `queued`,
-              title: `belongs after replacement hydrate`,
-            },
-          },
-        ],
-        deletedKeys: [],
-      })
-
-      releaseReceipt.resolve()
-      await atPersistedOracleCheckpoint(
-        replacementHydrationEntered.promise,
-        `replacement hydration entered after old receipt`,
-      )
-      await flushAsyncWork()
-
-      expect({
-        sourceRuns,
-        baselineCalls,
-        queuedVisible: collection.get(`queued`),
-      }).toEqual({
-        sourceRuns: 2,
-        baselineCalls: 2,
-        queuedVisible: undefined,
-      })
-
-      releaseReplacementHydration.resolve()
-      const replacementOutcome = await atPersistedOracleCheckpoint(
-        replacementReady,
-        `replacement hydration settled before coordinator work`,
-      )
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      expect({
-        replacementStatus: replacementOutcome.status,
-        oldVisible: collection.get(`old`),
-        replacementVisible: stripVirtualProps(collection.get(`replacement`)),
-        queuedVisible: stripVirtualProps(collection.get(`queued`)),
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        replacementStatus: `fulfilled`,
-        oldVisible: undefined,
-        replacementVisible: {
-          id: `replacement`,
-          title: `new owner hydration`,
-        },
-        queuedVisible: {
-          id: `queued`,
-          title: `belongs after replacement hydrate`,
-        },
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseReceipt.resolve()
-      releaseReplacementHydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => oldReady,
-          () => replacementReady,
-          () => (cleanedUp ? undefined : collection.cleanup()),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects new source transactions after a terminal persistence failure`, async () => {
-    const adapter = createRecordingAdapter()
-    const adapterError = Object.assign(
-      new Error(`terminal adapter write failed exactly`),
-      {
-        code: `SQLITE_FULL`,
-        path: `adapter.applyCommittedTx`,
-      },
-    )
-    const successfulApply = adapter.applyCommittedTx.bind(adapter)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (collectionId, tx) => {
-      applyCalls++
-      if (applyCalls === 1) throw adapterError
-      await successfulApply(collectionId, tx)
-    }
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-terminal-persistence-admission`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `terminal persistence admission collection ready`,
-      )
-      remoteBegin!()
-      remoteWrite!({
-        type: `insert`,
-        value: { id: `first`, title: `published before persistence` },
-      })
-      const firstOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(remoteCommit!()).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `first terminal persistence receipt`,
-      )
-      const terminalError =
-        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
-
-      expect({
-        receiptStatus: firstOutcome.status,
-        errorName:
-          terminalError instanceof Error ? terminalError.name : undefined,
-        cause: terminalError instanceof Error ? terminalError.cause : undefined,
-        publicErrorIsReceipt:
-          collection._lifecycle.getSyncError() === terminalError,
-        status: collection.status,
-        firstVisible: stripVirtualProps(collection.get(`first`)),
-        firstDurable: adapter.rows.get(`first`),
-        applyCalls,
-      }).toEqual({
-        receiptStatus: `rejected`,
-        errorName: `PersistedCollectionDurabilityError`,
-        cause: adapterError,
-        publicErrorIsReceipt: true,
-        status: `crashed`,
-        firstVisible: {
-          id: `first`,
-          title: `published before persistence`,
-        },
-        firstDurable: undefined,
-        applyCalls: 1,
-      })
-
-      remoteBegin!()
-      remoteWrite!({
-        type: `insert`,
-        value: { id: `late`, title: `must not be admitted` },
-      })
-      const lateOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(remoteCommit!()).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `late terminal persistence receipt`,
-      )
-
-      expect({
-        receiptStatus: lateOutcome.status,
-        exactReceipt:
-          lateOutcome.status === `rejected` &&
-          lateOutcome.reason === terminalError,
-        publicErrorIsTerminal:
-          collection._lifecycle.getSyncError() === terminalError,
-        status: collection.status,
-        lateVisible: collection.get(`late`),
-        lateDurable: adapter.rows.get(`late`),
-        applyCalls,
-      }).toEqual({
-        receiptStatus: `rejected`,
-        exactReceipt: true,
-        publicErrorIsTerminal: true,
-        status: `crashed`,
-        lateVisible: undefined,
-        lateDurable: undefined,
-        applyCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`hydration`, `durability`] as const)(
-    `fences metadata and truncate transactions after a terminal %s failure`,
-    async (failureKind) => {
-      const harness = await createTerminalFailureHarness(
-        failureKind,
-        `terminal-transaction-surface-${failureKind}`,
-      )
-      const {
-        adapter,
-        collection,
-        coordinator,
-        seed,
-        sourceParams,
-        terminalError,
-      } = harness
-      const applyCallsBefore = adapter.applyCommittedTxCalls.length
-      const publishCallsBefore = coordinator.publishCalls.length
-      const operations: Array<{ name: string; apply: () => void }> = [
-        {
-          name: `row metadata set`,
-          apply: () =>
-            sourceParams.metadata!.row.set(seed.id, `must-not-replace-row`),
-        },
-        {
-          name: `row metadata delete`,
-          apply: () => sourceParams.metadata!.row.delete(seed.id),
-        },
-        {
-          name: `collection metadata set`,
-          apply: () =>
-            sourceParams.metadata!.collection.set(
-              `resume`,
-              `must-not-replace-collection`,
-            ),
-        },
-        {
-          name: `collection metadata delete`,
-          apply: () => sourceParams.metadata!.collection.delete(`resume`),
-        },
-        {
-          name: `truncate`,
-          apply: () => sourceParams.truncate(),
-        },
-      ]
-      let hasPrimaryFailure = false
-
-      try {
-        for (const operation of operations) {
-          sourceParams.begin()
-          const operationOutcome = await Promise.resolve()
-            .then(operation.apply)
-            .then(
-              () => ({ status: `fulfilled` as const }),
-              (reason: unknown) => ({ status: `rejected` as const, reason }),
-            )
-          const receiptOutcome = await atPersistedOracleCheckpoint(
-            Promise.resolve(sourceParams.commit()).then(
-              () => ({ status: `fulfilled` as const }),
-              (reason: unknown) => ({ status: `rejected` as const, reason }),
-            ),
-            `${failureKind} ${operation.name} terminal receipt`,
-          )
-
-          expect({
-            operation: operationOutcome.status,
-            receipt: receiptOutcome.status,
-            exactReceipt:
-              receiptOutcome.status === `rejected` &&
-              receiptOutcome.reason === terminalError,
-            visibleSeed: stripVirtualProps(collection.get(seed.id)),
-            durableSeed: adapter.rows.get(seed.id),
-            rowMetadata: sourceParams.metadata!.row.get(seed.id),
-            collectionMetadata: sourceParams.metadata!.collection.get(`resume`),
-            applyCalls: adapter.applyCommittedTxCalls.length,
-            publishCalls: coordinator.publishCalls.length,
-            status: collection.status,
-            exactPublicError:
-              collection._lifecycle.getSyncError() === terminalError,
-          }).toEqual({
-            operation: `fulfilled`,
-            receipt: `rejected`,
-            exactReceipt: true,
-            visibleSeed: seed,
-            durableSeed: seed,
-            rowMetadata: `row-metadata-before-failure`,
-            collectionMetadata: `collection-metadata-before-failure`,
-            applyCalls: applyCallsBefore,
-            publishCalls: publishCallsBefore,
-            status: `crashed`,
-            exactPublicError: true,
-          })
-        }
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`fences reload, upstream hydration, and late readiness after terminal persistence failure`, async () => {
-    const harness = await createTerminalFailureHarness(
-      `durability`,
-      `terminal-persistence-reload-surfaces`,
-    )
-    const {
-      adapter,
-      collection,
-      coordinator,
-      sourceParams,
-      terminalError,
-      upstreamLoads,
-    } = harness
-    const late = { id: `late-reload`, title: `must not hydrate` }
-    const loadCallsBefore = adapter.loadSubsetCalls.length
-    const upstreamCallsBefore = upstreamLoads.length
-    const publishCallsBefore = coordinator.publishCalls.length
-    adapter.loadSubset = (collectionId, options, context) => {
-      adapter.loadSubsetCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        options,
-        requiredIndexSignatures: context?.requiredIndexSignatures ?? [],
-      })
-      return Promise.resolve([{ key: late.id, value: late }])
-    }
-    let hasPrimaryFailure = false
-
-    try {
-      const loadOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(collection._sync.loadSubset({ limit: 3 })).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `post-persistence terminal loadSubset`,
-      )
-      sourceParams.markReady()
-      await flushAsyncWork()
-
-      expect({
-        loadStatus: loadOutcome.status,
-        loadExact:
-          loadOutcome.status === `rejected` &&
-          loadOutcome.reason === terminalError,
-        adapterLoads: adapter.loadSubsetCalls.length,
-        upstreamLoads: upstreamLoads.length,
-        publishCalls: coordinator.publishCalls.length,
-        visibleLate: collection.get(late.id),
-        durableLate: adapter.rows.get(late.id),
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-      }).toEqual({
-        loadStatus: `rejected`,
-        loadExact: true,
-        adapterLoads: loadCallsBefore,
-        upstreamLoads: upstreamCallsBefore,
-        publishCalls: publishCallsBefore,
-        visibleLate: undefined,
-        durableLate: undefined,
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects an already-admitted sibling when the preceding persistence fails`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstPersistenceEntered = createEventGate()
-    const firstPersistence = createEventGate()
-    const adapterError = new Error(`first pending persistence failed exactly`)
-    const coordinator = createFailStopCoordinatorHarness(
-      `terminal-pending-sibling`,
-    )
-    let applyCalls = 0
-    coordinator.requestApplyCommittedTx = async (_collectionId, tx) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        try {
-          await firstPersistence.promise
-        } catch (error) {
-          throw new PersistedCollectionDurabilityError(
-            `first pending persistence failed`,
-            { cause: error },
-          )
-        }
-      }
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-pending-sibling`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `pending sibling collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `a`, title: `first publishes before persistence` },
-      })
-      const firstReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `first persistence entered before sibling admission`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `b`, title: `must not publish or persist` },
-      })
-      const secondReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      const secondSettlement = observeSettlement(
-        secondReceipt.then(
-          () => undefined,
-          () => undefined,
-        ),
-      )
-      expect(secondSettlement.read()).toEqual({ status: `pending` })
-
-      firstPersistence.reject(adapterError)
-      const firstOutcome = await atPersistedOracleCheckpoint(
-        firstReceipt,
-        `first failed persistence receipt`,
-      )
-      const terminalError =
-        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
-      const secondOutcome = await atPersistedOracleCheckpoint(
-        secondReceipt,
-        `already-admitted sibling terminal receipt`,
-      )
-
-      expect({
-        firstStatus: firstOutcome.status,
-        terminalName:
-          terminalError instanceof Error ? terminalError.name : undefined,
-        terminalCause:
-          terminalError instanceof Error ? terminalError.cause : undefined,
-        secondStatus: secondOutcome.status,
-        secondExact:
-          secondOutcome.status === `rejected` &&
-          secondOutcome.reason === terminalError,
-        applyCalls,
-        firstVisible: stripVirtualProps(collection.get(`a`)),
-        firstDurable: adapter.rows.get(`a`),
-        secondVisible: collection.get(`b`),
-        secondDurable: adapter.rows.get(`b`),
-        publishCalls: coordinator.publishCalls.length,
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-      }).toEqual({
-        firstStatus: `rejected`,
-        terminalName: `PersistedCollectionDurabilityError`,
-        terminalCause: adapterError,
-        secondStatus: `rejected`,
-        secondExact: true,
-        applyCalls: 1,
-        firstVisible: {
-          id: `a`,
-          title: `first publishes before persistence`,
-        },
-        firstDurable: undefined,
-        secondVisible: undefined,
-        secondDurable: undefined,
-        publishCalls: 0,
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      firstPersistence.reject(adapterError)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`marks direct adapter failure terminal and fences later local mutations`, async () => {
-    const adapter = createRecordingAdapter()
-    const adapterError = Object.assign(
-      new Error(`local adapter failed exactly`),
-      {
-        code: `SQLITE_IOERR`,
-        path: `adapter.applyCommittedTx`,
-      },
-    )
-    const successfulApply = adapter.applyCommittedTx.bind(adapter)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) throw adapterError
-      await successfulApply(...args)
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-loopback-local-durability`,
-        getKey: (row) => row.id,
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `local durability collection ready`,
-      )
-      const firstTransaction = collection.insert({
-        id: `first-local`,
-        title: `must roll back`,
-      })
-      const firstOutcome = await atPersistedOracleCheckpoint(
-        firstTransaction.isPersisted.promise.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `first local durability failure`,
-      )
-      const terminalError =
-        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
-
-      const loadCallsBefore = adapter.loadSubsetCalls.length
-      adapter.loadSubset = (collectionId, options, context) => {
-        adapter.loadSubsetCalls.push({
-          collectionId: recordedStorageId(collectionId),
-          options,
-          requiredIndexSignatures: context?.requiredIndexSignatures ?? [],
-        })
-        return Promise.resolve([
-          {
-            key: `forced-late`,
-            value: { id: `forced-late`, title: `must not hydrate` },
-          },
-        ])
-      }
-      const forceOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(collection.utils.forceReloadSubset!({ limit: 4 })).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `force reload after local durability failure`,
-      )
-
-      const lateOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve()
-          .then(async () => {
-            const lateTransaction = collection.insert({
-              id: `late-local`,
-              title: `must not be admitted`,
-            })
-            await lateTransaction.isPersisted.promise
-          })
-          .then(
-            () => ({ status: `fulfilled` as const }),
-            (reason: unknown) => ({ status: `rejected` as const, reason }),
-          ),
-        `late local terminal receipt`,
-      )
-
-      expect({
-        firstStatus: firstOutcome.status,
-        errorName:
-          terminalError instanceof Error ? terminalError.name : undefined,
-        errorCause:
-          terminalError instanceof Error ? terminalError.cause : undefined,
-        errorCode:
-          terminalError instanceof Error
-            ? (terminalError as Error & { code?: unknown }).code
-            : undefined,
-        forceStatus: forceOutcome.status,
-        forceExact:
-          forceOutcome.status === `rejected` &&
-          forceOutcome.reason === terminalError,
-        loadCalls: adapter.loadSubsetCalls.length,
-        forceVisible: collection.get(`forced-late`),
-        lateStatus: lateOutcome.status,
-        lateErrorName:
-          lateOutcome.status === `rejected` &&
-          lateOutcome.reason instanceof Error
-            ? lateOutcome.reason.name
-            : undefined,
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-        applyCalls,
-        firstVisible: collection.get(`first-local`),
-        firstDurable: adapter.rows.get(`first-local`),
-        lateVisible: collection.get(`late-local`),
-        lateDurable: adapter.rows.get(`late-local`),
-      }).toEqual({
-        firstStatus: `rejected`,
-        errorName: `PersistedCollectionDurabilityError`,
-        errorCause: adapterError,
-        errorCode: `SQLITE_IOERR`,
-        forceStatus: `rejected`,
-        forceExact: true,
-        loadCalls: loadCallsBefore,
-        forceVisible: undefined,
-        lateStatus: `rejected`,
-        lateErrorName: `CollectionStateError`,
-        status: `crashed`,
-        exactPublicError: true,
-        applyCalls: 1,
-        firstVisible: undefined,
-        firstDurable: undefined,
-        lateVisible: undefined,
-        lateDurable: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`fences direct acceptMutations and local mutations after hydration failure`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrationError = new Error(`loopback hydration failed exactly`)
-    const restoreBaselineRows = overrideBaselineRows(adapter, () =>
-      Promise.reject(hydrationError),
-    )
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-loopback-hydration`,
-        getKey: (row) => row.id,
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await expect(
-        atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `loopback hydration rejected`,
-        ),
-      ).rejects.toBe(hydrationError)
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(hydrationError)
-
-      restoreBaselineRows()
-      const now = new Date()
-      const directRow = { id: `direct`, title: `must not be accepted` }
-      const directMutation: PendingMutation<Todo, `insert`> = {
-        mutationId: `direct-after-hydration`,
-        original: {},
-        modified: directRow,
-        changes: directRow,
-        globalKey: `terminal-loopback-hydration:direct`,
-        key: directRow.id,
-        type: `insert`,
-        metadata: undefined,
-        syncMetadata: {},
-        optimistic: true,
-        createdAt: now,
-        updatedAt: now,
-        collection,
-      }
-      const directOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(
-          collection.utils.acceptMutations({
-            mutations: [
-              directMutation as unknown as PendingMutation<
-                Record<string, unknown>
-              >,
-            ],
-          }),
-        ).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `direct acceptMutations after hydration failure`,
-      )
-      const localOutcome = await Promise.resolve()
-        .then(() =>
-          collection.insert({
-            id: `late-local-hydration`,
-            title: `must not be admitted`,
-          }),
-        )
-        .then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        )
-
-      expect({
-        directStatus: directOutcome.status,
-        directExact:
-          directOutcome.status === `rejected` &&
-          directOutcome.reason === hydrationError,
-        localStatus: localOutcome.status,
-        localErrorName:
-          localOutcome.status === `rejected` &&
-          localOutcome.reason instanceof Error
-            ? localOutcome.reason.name
-            : undefined,
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === hydrationError,
-        applyCalls: adapter.applyCommittedTxCalls.length,
-        directVisible: collection.get(directRow.id),
-        directDurable: adapter.rows.get(directRow.id),
-        localVisible: collection.get(`late-local-hydration`),
-        localDurable: adapter.rows.get(`late-local-hydration`),
-      }).toEqual({
-        directStatus: `rejected`,
-        directExact: true,
-        localStatus: `rejected`,
-        localErrorName: `CollectionStateError`,
-        status: `crashed`,
-        exactPublicError: true,
-        applyCalls: 0,
-        directVisible: undefined,
-        directDurable: undefined,
-        localVisible: undefined,
-        localDurable: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`replays a hydration-buffered write before its named durability rejection`, async () => {
-    const adapter = createRecordingAdapter()
-    let releaseHydration: (() => void) | undefined
-    adapter.loadResumeSnapshot = (_collectionId, options) => {
-      const snapshot = {
-        rows: [],
-        keySet: { status: `consistent` as const },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }
-      if (options?.includeRows === false) {
-        return Promise.resolve(snapshot)
-      }
-      return new Promise((resolve) => {
-        releaseHydration = () => resolve(snapshot)
-      })
-    }
-    const persistenceError = Object.assign(
-      new Error(`buffered persistence failed`),
-      {
-        code: `SQLITE_FULL`,
-        path: `todos.sqlite`,
-      },
-    )
-    let rejectPersistence: ((error: unknown) => void) | undefined
-    adapter.applyCommittedTx = () =>
-      new Promise<void>((_resolve, reject) => {
-        rejectPersistence = reject
-      })
-
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydration-buffered-persistence-error`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      void collection.stateWhenReady().catch(() => undefined)
-      await vi.waitFor(() => {
-        expect(releaseHydration).toBeTypeOf(`function`)
-        expect(remoteCommit).toBeTypeOf(`function`)
-      })
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `buffered`, title: `Published before failure` },
-      })
-      const receipt = Promise.resolve(remoteCommit?.())
-      let settled = false
-      void receipt.then(
-        () => {
-          settled = true
-        },
-        () => {
-          settled = true
-        },
-      )
-
-      expect(collection.get(`buffered`)).toBeUndefined()
-      expect(settled).toBe(false)
-      releaseHydration!()
-      await vi.waitFor(() => expect(rejectPersistence).toBeTypeOf(`function`))
-
-      expect(stripVirtualProps(collection.get(`buffered`))).toEqual({
-        id: `buffered`,
-        title: `Published before failure`,
-      })
-      expect(settled).toBe(false)
-
-      rejectPersistence!(persistenceError)
-      const rejection = await receipt.then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-
-      expect(rejection).not.toBe(persistenceError)
-      expect(rejection).toMatchObject({
-        name: `PersistedCollectionDurabilityError`,
-        code: `SQLITE_FULL`,
-        path: `todos.sqlite`,
-        cause: persistenceError,
-      })
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(rejection)
-    } finally {
-      releaseHydration?.()
-      rejectPersistence?.(persistenceError)
-      await collection.cleanup()
-      warning.mockRestore()
-    }
-  })
-
-  it(`preserves row metadata set before a metadata-less insert in the same sync transaction`, async () => {
-    const adapter = createRecordingAdapter()
-    const ownership = { queryCollection: { owners: [`gc:q1`] } }
-    const sync: SyncConfig<Todo, string> = {
-      sync: ({ begin, write, commit, markReady, metadata }) => {
-        begin()
-        metadata?.row.set(`remote-1`, ownership)
-        write({
-          type: `insert`,
-          value: {
-            id: `remote-1`,
-            title: `From remote`,
-          },
-        })
-        commit()
-        markReady()
-      },
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item: Todo) => item.id,
-        sync,
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    await collection.stateWhenReady()
-    await flushAsyncWork()
-
-    expect(adapter.rowMetadata.get(`remote-1`)).toEqual(ownership)
-    expect(collection._state.syncedMetadata.get(`remote-1`)).toEqual(ownership)
-  })
-
-  it(`resets stale row metadata for a metadata-less insert with no queued metadata`, async () => {
-    const adapter = createRecordingAdapter()
-    adapter.rowMetadata.set(`remote-1`, { stale: true })
-    const sync: SyncConfig<Todo, string> = {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({
-          type: `insert`,
-          value: {
-            id: `remote-1`,
-            title: `From remote`,
-          },
-        })
-        commit()
-        markReady()
-      },
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item: Todo) => item.id,
-        sync,
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    await collection.stateWhenReady()
-    await flushAsyncWork()
-
-    expect(adapter.rowMetadata.has(`remote-1`)).toBe(false)
-  })
-
-  it(`uses a stable generated collection id in sync-present mode when id is omitted`, async () => {
-    const adapter = createRecordingAdapter()
-    const options = persistedCollectionOptions<Todo, string>({
-      getKey: (item) => item.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-        },
-      },
-      persistence: {
-        adapter,
-      },
-    })
-
-    expect(options.id).toBeDefined()
-
-    const collection = createCollection(options)
-    await collection.preload()
-    await flushAsyncWork()
-
-    expect(collection.id).toBe(options.id)
-    expect(adapter.loadResumeSnapshotCalls[0]?.collectionId).toBe(collection.id)
-  })
-
-  it(`keeps hydrated rows ahead of persisted startup rows`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `Persisted title` },
-    ])
-    const descriptor = collectionOptions(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydration-precedence`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-    const client = new DbClient()
-    client.hydrate({
-      collections: [
-        {
-          collectionId: descriptor.id,
-          rows: [
-            {
-              key: `1`,
-              value: { id: `1`, title: `SSR title` },
-            },
-          ],
-        },
-      ],
-    })
-
-    const collection = client.collection(descriptor)
-    await collection.stateWhenReady()
-    await flushAsyncWork()
-
-    expect(collection.get(`1`)).toMatchObject({
-      id: `1`,
-      title: `SSR title`,
-    })
-
-    await client.cleanup()
-  })
-
-  it(`bootstraps and tracks persisted index lifecycle in sync-present mode`, async () => {
-    const adapter = createRecordingAdapter()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-indexes`,
-        getKey: (item) => item.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    const preSyncIndex = collection.createIndex((row) => row.title, {
-      name: `pre-sync-title`,
-    })
-    const expectedPreSyncSignature = collection.getIndexMetadata()[0]?.signature
-
-    await collection.preload()
-    await flushAsyncWork()
-
-    expect(expectedPreSyncSignature).toBeDefined()
-    expect(
-      adapter.ensureIndexCalls.some(
-        (call) => call.signature === expectedPreSyncSignature,
-      ),
-    ).toBe(true)
-
-    const runtimeIndex = collection.createIndex((row) => row.id, {
-      name: `runtime-id`,
-    })
-    await flushAsyncWork()
-
-    const runtimeSignature = collection
-      .getIndexMetadata()
-      .find((index) => index.indexId === runtimeIndex.id)?.signature
-    expect(runtimeSignature).toBeDefined()
-    expect(
-      adapter.ensureIndexCalls.some(
-        (call) => call.signature === runtimeSignature,
-      ),
-    ).toBe(true)
-
-    collection.removeIndex(preSyncIndex)
-    await flushAsyncWork()
-    expect(
-      adapter.markIndexRemovedCalls.some(
-        (call) => call.signature === expectedPreSyncSignature,
-      ),
-    ).toBe(true)
-  })
-
-  it(`queues remote sync writes that arrive during hydration`, async () => {
-    const adapter = createRecordingAdapter([
-      {
-        id: `cached-1`,
-        title: `Cached row`,
-      },
-    ])
-    let resolveLoadSubset: (() => void) | undefined
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => {
-      if (args[1]?.includeRows === true) {
-        await new Promise<void>((resolve) => {
-          resolveLoadSubset = resolve
-        })
-      }
-      return loadResumeSnapshot(...args)
-    }
-
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => void) | undefined
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-    const readyPromise = collection.stateWhenReady()
-    for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
-      await flushAsyncWork()
-    }
-
-    expect(resolveLoadSubset).toBeDefined()
-    expect(remoteBegin).toBeDefined()
-
-    remoteBegin?.()
-    remoteWrite?.({
-      type: `insert`,
-      value: {
-        id: `during-hydrate`,
-        title: `During hydrate`,
-      },
-    })
-    remoteCommit?.()
-
-    resolveLoadSubset?.()
-    await readyPromise
-    await flushAsyncWork()
-
-    expect(stripVirtualProps(collection.get(`cached-1`))).toEqual({
-      id: `cached-1`,
-      title: `Cached row`,
-    })
-    expect(stripVirtualProps(collection.get(`during-hydrate`))).toEqual({
-      id: `during-hydrate`,
-      title: `During hydrate`,
-    })
-  })
-
-  it(`queues a source write behind its owning hydration baseline`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `shared`, title: `Persisted baseline` },
-    ])
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return [
-        {
-          key: `shared`,
-          value: { id: `shared`, title: `Persisted baseline` },
-        },
-      ]
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `source-write-during-hydration`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const ready = collection.stateWhenReady()
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `source write hydration entered`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `shared`, title: `Newer source value` },
-      })
-      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      const settlement = observeSettlement(receipt)
-      await Promise.resolve()
-
-      expect({
-        visible: collection.get(`shared`),
-        receipt: settlement.read(),
-        applyCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        visible: undefined,
-        receipt: { status: `pending` },
-        applyCalls: 0,
-      })
-
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(ready, `source write hydration ready`)
-      await atPersistedOracleCheckpoint(
-        receipt,
-        `source write hydration receipt`,
-      )
-      expect({
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        durableRow: adapter.rows.get(`shared`),
-        status: collection.status,
-      }).toEqual({
-        publicRow: { id: `shared`, title: `Newer source value` },
-        durableRow: { id: `shared`, title: `Newer source value` },
-        status: `ready`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => ready.catch(() => undefined),
-          () => receipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`preserves a source transaction committed before the next persisted hydration`, async () => {
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    const adapter = createRecordingAdapter()
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `before-hydration-boundary`,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() => {
-        expect(remoteBegin).toBeTypeOf(`function`)
-        expect(remoteWrite).toBeTypeOf(`function`)
-        expect(remoteCommit).toBeTypeOf(`function`)
-      })
-      const row = { id: `before`, title: `before` }
-      remoteBegin?.()
-      remoteWrite?.({ type: `insert`, value: row })
-      const receipt = remoteCommit?.()
-      expect(receipt).toBeInstanceOf(Promise)
-      await receipt
-      adapter.loadSubset = async () => {
-        hydrationEntered.resolve()
-        await hydration.promise
-        return Array.from(adapter.rows, ([key, value]) => ({ key, value }))
-      }
-      const rehydrating = Promise.resolve(collection._sync.loadSubset({}))
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `on-demand hydration entered`,
-      )
-
-      expect(stripVirtualProps(collection.get(`before`))).toEqual(row)
-      expect(adapter.rows.get(`before`)).toEqual(row)
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(
-        rehydrating,
-        `on-demand hydration completed`,
-      )
-      expect(stripVirtualProps(collection.get(`before`))).toEqual(row)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`during`, `straddles`, `after`] as const)(
-    `durably settles a source transaction that commits %s persisted hydration`,
-    async (position) => {
-      const hydrationEntered = createEventGate()
-      const hydration = createEventGate()
-      const adapter = createRecordingAdapter()
-      const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
-        hydrationEntered.resolve()
-        await hydration.promise
-        return []
-      })
-
-      const persistedTransactionOrder: Array<string> = []
-      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-      adapter.applyCommittedTx = async (...args) => {
-        const title = args[1].mutations.find(
-          (mutation) => mutation.type !== `delete`,
-        )?.value as Todo | undefined
-        if (title) persistedTransactionOrder.push(title.title)
-        await applyCommittedTx(...args)
-      }
-
-      let remoteBegin: (() => void) | undefined
-      let remoteWrite:
-        ((message: { type: `insert`; value: Todo }) => void) | undefined
-      let remoteCommit: (() => true | Promise<void>) | undefined
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `hydration-boundary-${position}`,
-          getKey: (item) => item.id,
-          sync: {
-            sync: ({ begin, write, commit, markReady }) => {
-              remoteBegin = begin
-              remoteWrite = write as (message: {
-                type: `insert`
-                value: Todo
-              }) => void
-              remoteCommit = commit
-              markReady()
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const ledger: Array<DurabilityLedgerEvent> = []
-      const transactionId = position
-      const row = { id: `shared`, title: position }
-      let receipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-
-      const beginAndWrite = () => {
-        ledger.push({ type: `begin`, transactionId })
-        remoteBegin?.()
-        ledger.push({ type: `write`, transactionId, row })
-        remoteWrite?.({ type: `insert`, value: row })
-      }
-      const commit = () => {
-        ledger.push({ type: `commit`, transactionId })
-        const applied = remoteCommit?.()
-        expect(applied).toBeInstanceOf(Promise)
-        receipt = Promise.resolve(applied).then(() => undefined)
-      }
-
-      try {
-        const ready = collection.stateWhenReady()
-        await atPersistedOracleCheckpoint(
-          hydrationEntered.promise,
-          `${position} hydration entered`,
-        )
-        expect(remoteBegin).toBeTypeOf(`function`)
-        expect(remoteCommit).toBeTypeOf(`function`)
-
-        if (position === `during`) {
-          beginAndWrite()
-          commit()
-          hydration.resolve()
-          await atPersistedOracleCheckpoint(
-            ready,
-            `${position} hydration completed`,
-          )
-        } else {
-          if (position === `straddles`) beginAndWrite()
-          hydration.resolve()
-          await atPersistedOracleCheckpoint(
-            ready,
-            `${position} hydration completed`,
-          )
-          if (position === `after`) beginAndWrite()
-          commit()
-        }
-
-        const settlement = observeSettlement(receipt!)
-        const checkpointId = `checkpoint-${position}`
-        const checkpointRow = { id: checkpointId, title: checkpointId }
-        ledger.push({ type: `begin`, transactionId: checkpointId })
-        remoteBegin?.()
-        ledger.push({
-          type: `write`,
-          transactionId: checkpointId,
-          row: checkpointRow,
-        })
-        remoteWrite?.({ type: `insert`, value: checkpointRow })
-        ledger.push({ type: `commit`, transactionId: checkpointId })
-        const checkpointReceipt = remoteCommit?.()
-        expect(checkpointReceipt).toBeInstanceOf(Promise)
-        await atPersistedOracleCheckpoint(
-          Promise.resolve(checkpointReceipt),
-          `${position} later durable receipt`,
-        )
-
-        // A settled later durable receipt is the exact cut: FIFO forbids it
-        // from overtaking an earlier commit opened in the old phase.
-        expect(settlement.read()).toEqual({ status: `fulfilled` })
-        const expected = foldDurabilityLedger(ledger)
-        expect(persistedTransactionOrder).toEqual(expected.commitOrder)
-        expect(stripVirtualProps(collection.get(`shared`))).toEqual(row)
-        expect(adapter.rows.get(`shared`)).toEqual(row)
-        expect(adapter.rows.get(checkpointId)).toEqual(checkpointRow)
-
-        await collection.cleanup()
-        restoreBaselineRows()
-        const reopened = createCollection(
-          persistedCollectionOptions<Todo, string>({
-            id: `hydration-boundary-${position}`,
-            getKey: (item) => item.id,
-            sync: { sync: ({ markReady }) => markReady() },
-            persistence: { adapter },
-          }),
-        )
-        let hasReopenFailure = false
-        try {
-          await atPersistedOracleCheckpoint(
-            reopened.stateWhenReady(),
-            `${position} reopened hydration completed`,
-          )
-          expect(stripVirtualProps(reopened.get(`shared`))).toEqual(
-            expected.committedRows.get(`shared`),
-          )
-        } catch (error) {
-          hasReopenFailure = true
-          throw error
-        } finally {
-          await cleanupPersistedOracle(
-            [() => reopened.cleanup()],
-            hasReopenFailure,
-          )
-        }
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        hydration.resolve()
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`does not let a later same-key transaction overtake a hydration-straddling commit`, async () => {
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    const adapter = createRecordingAdapter()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return []
-    })
-    const persistedTransactionOrder: Array<string> = []
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    adapter.applyCommittedTx = async (...args) => {
-      const row = args[1].mutations.find(
-        (mutation) => mutation.type !== `delete`,
-      )?.value as Todo | undefined
-      if (row) persistedTransactionOrder.push(row.title)
-      await applyCommittedTx(...args)
-    }
-
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydration-straddle-sibling-fifo`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const ledger: Array<DurabilityLedgerEvent> = []
-    let firstReceipt: Promise<void> | undefined
-    let secondReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    const sourceTransaction = (transactionId: string, title: string) => {
-      const row = { id: `shared`, title }
-      ledger.push({ type: `begin`, transactionId })
-      remoteBegin?.()
-      ledger.push({ type: `write`, transactionId, row })
-      remoteWrite?.({ type: `insert`, value: row })
-      ledger.push({ type: `commit`, transactionId })
-      return Promise.resolve(remoteCommit?.()).then(() => undefined)
-    }
-
-    try {
-      const ready = collection.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `FIFO hydration entered`,
-      )
-
-      const firstRow = { id: `shared`, title: `first` }
-      ledger.push({ type: `begin`, transactionId: `first` })
-      remoteBegin?.()
-      ledger.push({ type: `write`, transactionId: `first`, row: firstRow })
-      remoteWrite?.({ type: `insert`, value: firstRow })
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(ready, `FIFO hydration completed`)
-      ledger.push({ type: `commit`, transactionId: `first` })
-      firstReceipt = Promise.resolve(remoteCommit?.()).then(() => undefined)
-      const firstSettlement = observeSettlement(firstReceipt)
-
-      secondReceipt = sourceTransaction(`second`, `second`)
-      const secondSettlement = observeSettlement(secondReceipt)
-      await atPersistedOracleCheckpoint(
-        secondReceipt,
-        `later same-key receipt settled`,
-      )
-
-      const expected = foldDurabilityLedger(ledger)
-      expect(persistedTransactionOrder).toEqual(expected.commitOrder)
-      expect(firstSettlement.read()).toEqual({ status: `fulfilled` })
-      expect(secondSettlement.read()).toEqual({ status: `fulfilled` })
-      expect(adapter.rows.get(`shared`)).toEqual(
-        expected.committedRows.get(`shared`),
-      )
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`settles an aborted hydration-straddling commit without applying it`, async () => {
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    const adapter = createRecordingAdapter()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return []
-    })
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `aborted-hydration-straddle`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const ledger: Array<DurabilityLedgerEvent> = []
-    const controller = new AbortController()
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      const ready = collection.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `abort hydration entered`,
-      )
-      ledger.push({ type: `begin`, transactionId: `aborted` })
-      remoteBegin?.()
-      const row = { id: `aborted`, title: `must not apply` }
-      ledger.push({ type: `write`, transactionId: `aborted`, row })
-      remoteWrite?.({ type: `insert`, value: row })
-      controller.abort()
-      ledger.push({ type: `abort`, transactionId: `aborted` })
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(ready, `abort hydration completed`)
-      receipt = Promise.resolve(remoteCommit?.(controller.signal)).then(
-        () => undefined,
-      )
-      await expect(
-        atPersistedOracleCheckpoint(receipt, `aborted receipt settled`),
-      ).rejects.toMatchObject({ name: `AbortError` })
-      expect(foldDurabilityLedger(ledger).committedRows.size).toBe(0)
-      expect(collection.get(`aborted`)).toBeUndefined()
-      expect(adapter.rows.get(`aborted`)).toBeUndefined()
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  describe.each(hydrationScopeModes)(
-    `hydration failure with %s scope`,
-    (scopeMode) => {
-      it(`rejects every buffered receipt with the exact persisted hydration failure`, async () => {
-        await runRejectedHydrationBufferWitness(
-          `rejected-hydration-buffer-fixed`,
-          [
-            { id: `first`, title: `first buffered commit` },
-            { id: `second`, title: `second buffered commit` },
-          ],
-          { scopeMode },
-        )
-      })
-
-      it(`rejects a hydration-straddling transaction committed after hydration fails`, async () => {
-        await runRejectedHydrationBufferWitness(
-          `rejected-hydration-late-commit-fixed`,
-          [{ id: `late`, title: `must not cross a failed baseline` }],
-          { commitAfterHydrationFailure: true, scopeMode },
-        )
-      })
-
-      it.each([
-        {
-          schedule: `one late commit`,
-          rows: [{ id: `one-late`, title: `` }],
-        },
-        {
-          schedule: `two sibling late commits`,
-          rows: [
-            { id: `late-a`, title: `a` },
-            { id: `late-b`, title: `b` },
-          ],
-        },
-        {
-          schedule: `same-key late replacements`,
-          rows: [
-            { id: `late-shared`, title: `old` },
-            { id: `late-shared`, title: `new` },
-          ],
-        },
-      ])(
-        `rejects generated late commits after hydration failure: $schedule`,
-        async ({ schedule, rows }) => {
-          await runRejectedHydrationBufferWitness(
-            `rejected-hydration-late-${schedule.replaceAll(` `, `-`)}`,
-            rows,
-            { commitAfterHydrationFailure: true, scopeMode },
-          )
-        },
-      )
-
-      it.each([
-        {
-          schedule: `one buffered commit`,
-          rows: [{ id: `one`, title: `one` }],
-        },
-        {
-          schedule: `three sibling commits`,
-          rows: [
-            { id: `a`, title: `a` },
-            { id: `b`, title: `b` },
-            { id: `c`, title: `c` },
-          ],
-        },
-        {
-          schedule: `same-key replacement commits`,
-          rows: [
-            { id: `shared`, title: `old` },
-            { id: `shared`, title: `new` },
-          ],
-        },
-      ])(
-        `rejects all receipts and adopts no rows after hydration failure: $schedule`,
-        async ({ schedule, rows }) => {
-          await runRejectedHydrationBufferWitness(
-            `rejected-hydration-${schedule.replaceAll(` `, `-`)}`,
-            rows,
-            { scopeMode },
-          )
-        },
-      )
-    },
-  )
-
-  it(`append-only transaction judgment rejects omission and reordering`, () => {
-    const events: Array<DurabilityLedgerEvent> = [
-      { type: `begin`, transactionId: `first` },
-      {
-        type: `write`,
-        transactionId: `first`,
-        row: { id: `shared`, title: `first` },
-      },
-      { type: `commit`, transactionId: `first` },
-      { type: `begin`, transactionId: `second` },
-      {
-        type: `write`,
-        transactionId: `second`,
-        row: { id: `shared`, title: `second` },
-      },
-      { type: `commit`, transactionId: `second` },
-    ]
-    const expected = foldDurabilityLedger(events)
-
-    expect(expected.commitOrder).toEqual([`first`, `second`])
-    expect(expected.commitOrder).not.toEqual([`second`])
-    expect(expected.commitOrder).not.toEqual([`second`, `first`])
-    expect(expected.committedRows.get(`shared`)).toEqual({
-      id: `shared`,
-      title: `second`,
-    })
-  })
-
-  it(`discards a hydration-buffered transaction aborted before replay`, async () => {
-    const adapter = createRecordingAdapter()
-    let resolveLoadSubset: (() => void) | undefined
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => {
-      if (args[1]?.includeRows === true) {
-        await new Promise<void>((resolve) => {
-          resolveLoadSubset = resolve
-        })
-      }
-      return loadResumeSnapshot(...args)
-    }
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-aborted-hydration-queue`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      const ready = collection.stateWhenReady()
-      for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
-        await flushAsyncWork()
-      }
-      const abortController = new AbortController()
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `aborted`, title: `Must not replay` },
-      })
-      const applied = remoteCommit?.(abortController.signal)
-      abortController.abort()
-      resolveLoadSubset?.()
-      await ready
-      if (applied !== true) {
-        await expect(applied).rejects.toMatchObject({ name: `AbortError` })
-      }
-      await flushAsyncWork()
-
-      expect(collection.get(`aborted`)).toBeUndefined()
-      expect(adapter.applyCommittedTxCalls).toHaveLength(0)
-    } finally {
-      resolveLoadSubset?.()
-      await collection.cleanup()
-    }
-  })
-
-  it(`continues an independent hydration queue after an in-flight sibling aborts`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    const prefixPersistenceEntered = createEventGate()
-    const releasePrefixPersistence = createEventGate()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    adapter.applyCommittedTx = async (...args) => {
-      if (args[1].mutations.some((mutation) => mutation.key === `prefix`)) {
-        prefixPersistenceEntered.resolve()
-        await releasePrefixPersistence.promise
-      }
-      return applyCommittedTx(...args)
-    }
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return []
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `independent-hydration-abort`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const aborted = new AbortController()
-    let prefixReceipt: Promise<void> | undefined
-    let abortedReceipt: Promise<void> | undefined
-    let independentReceipt: Promise<void> | undefined
-    const ready = collection.stateWhenReady()
-    void ready.catch(() => undefined)
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `independent abort hydration entered`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `prefix`, title: `durability held` },
-      })
-      prefixReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void prefixReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `aborted`, title: `must not publish` },
-      })
-      abortedReceipt = Promise.resolve(
-        sourceParams.commit(aborted.signal),
-      ).then(() => undefined)
-      void abortedReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `independent`, title: `must survive sibling abort` },
-      })
-      independentReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void independentReceipt.catch(() => undefined)
-
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(
-        prefixPersistenceEntered.promise,
-        `in-flight hydration prefix entered durability`,
-      )
-      aborted.abort()
-      const independentSettlement = observeSettlement(independentReceipt)
-      await Promise.resolve()
-      expect({
-        independent: independentSettlement.read(),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        independent: { status: `pending` },
-        status: `loading`,
-        publicError: undefined,
-      })
-
-      releasePrefixPersistence.resolve()
-      await atPersistedOracleCheckpoint(
-        prefixReceipt,
-        `independent abort prefix settled`,
-      )
-      await expect(
-        atPersistedOracleCheckpoint(
-          abortedReceipt,
-          `in-flight hydration sibling aborted`,
-        ),
-      ).rejects.toMatchObject({ name: `AbortError` })
-      await atPersistedOracleCheckpoint(
-        independentReceipt,
-        `independent hydration sibling applied`,
-      )
-      await atPersistedOracleCheckpoint(ready, `independent abort ready`)
-      expect({
-        status: collection.status,
-        prefix: stripVirtualProps(collection.get(`prefix`)),
-        aborted: collection.get(`aborted`),
-        independent: stripVirtualProps(collection.get(`independent`)),
-        durable: adapter.rows.get(`independent`),
-      }).toEqual({
-        status: `ready`,
-        prefix: { id: `prefix`, title: `durability held` },
-        aborted: undefined,
-        independent: {
-          id: `independent`,
-          title: `must survive sibling abort`,
-        },
-        durable: {
-          id: `independent`,
-          title: `must survive sibling abort`,
-        },
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      aborted.abort()
-      releasePrefixPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => prefixReceipt?.catch(() => undefined),
-          () => abortedReceipt?.catch(() => undefined),
-          () => independentReceipt?.catch(() => undefined),
-          () => ready.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`startup`, `resume`, `reset`] as const)(
-    `keeps the %s hydration ready after a buffered pre-application abort`,
-    async (entry) => {
-      const adapter = createRecordingAdapter()
-      const hydrationEntered = createEventGate()
-      const releaseHydration = createEventGate()
-      const coordinator =
-        entry === `reset` ? createCoordinatorHarness() : undefined
-      if (coordinator) {
-        coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
-          await adapter.applyCommittedTx(
-            { kind: `eager`, collectionId: collectionId },
-            tx,
-          )
-          return {
-            type: `rpc:applyCommittedTx:res`,
-            rpcId: tx.txId,
-            ok: true,
-            term: tx.term,
-            seq: tx.seq,
-            latestRowVersion: tx.rowVersion,
-          }
-        }
-      } else {
-        overrideBaselineRows(adapter, async () => {
-          hydrationEntered.resolve()
-          await releaseHydration.promise
-          return []
-        })
-      }
-      let sourceParams!: TodoSyncParams
-      let hydrateResumeBaseline: (() => Promise<void>) | undefined
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: coordinator ? `sync-present` : `buffered-abort-${entry}`,
-          getKey: (row) => row.id,
-          syncMode: entry === `resume` ? `on-demand` : `eager`,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              hydrateResumeBaseline =
-                params.metadata?.persistence?.hydrateBaseline
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const aborted = new AbortController()
-      let keyReads = 0
-      let hydration: Promise<unknown> | undefined
-      let abortedReceipt: Promise<void> | undefined
-      let independentReceipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-
-      try {
-        if (entry === `resume`) {
-          collection.startSyncImmediate()
-          await atPersistedOracleCheckpoint(
-            collection.stateWhenReady(),
-            `resume collection ready before baseline`,
-          )
-          expect(hydrateResumeBaseline).toBeTypeOf(`function`)
-          hydration = hydrateResumeBaseline!()
-        } else if (coordinator) {
-          await atPersistedOracleCheckpoint(
-            collection.stateWhenReady(),
-            `reset collection ready before reload`,
-          )
-          const loadSubset = adapter.loadSubset.bind(adapter)
-          adapter.loadSubset = async (...args) => {
-            hydrationEntered.resolve()
-            await releaseHydration.promise
-            return loadSubset(...args)
-          }
-          coordinator.emit({
-            type: `collection:reset`,
-            schemaVersion: 1,
-            resetEpoch: 1,
-          })
-          hydration = Promise.resolve()
-        } else {
-          hydration = collection.stateWhenReady()
-        }
-        void hydration.catch(() => undefined)
-        await atPersistedOracleCheckpoint(
-          hydrationEntered.promise,
-          `${entry} hydration entered`,
-        )
-
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `prefix`, title: `staged before abort` },
-        })
-        sourceParams.write({
-          type: `insert`,
-          value: {
-            get id() {
-              keyReads++
-              if (keyReads === 2) aborted.abort()
-              return `aborting`
-            },
-            title: `cancel before core application`,
-          },
-        })
-        abortedReceipt = Promise.resolve(
-          sourceParams.commit(aborted.signal),
-        ).then(() => undefined)
-        void abortedReceipt.catch(() => undefined)
-
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `independent`, title: `survives abort` },
-        })
-        independentReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void independentReceipt.catch(() => undefined)
-
-        releaseHydration.resolve()
-        const outcomes = await atPersistedOracleCheckpoint(
-          Promise.allSettled([hydration, abortedReceipt, independentReceipt]),
-          `${entry} buffered abort settled`,
-        )
-        const expected = foldDurabilityLedger([
-          { type: `begin`, transactionId: `aborted` },
-          {
-            type: `write`,
-            transactionId: `aborted`,
-            row: { id: `prefix`, title: `staged before abort` },
-          },
-          { type: `abort`, transactionId: `aborted` },
-          { type: `begin`, transactionId: `independent` },
-          {
-            type: `write`,
-            transactionId: `independent`,
-            row: { id: `independent`, title: `survives abort` },
-          },
-          { type: `commit`, transactionId: `independent` },
-        ])
-
-        expect(keyReads).toBeGreaterThanOrEqual(2)
-        expect(outcomes.map((outcome) => outcome.status)).toEqual([
-          `fulfilled`,
-          `rejected`,
-          `fulfilled`,
-        ])
-        if (outcomes[1].status === `rejected`) {
-          expect(outcomes[1].reason).toBeInstanceOf(SyncTransactionAbortedError)
-        }
-        expect(collection.status).toBe(`ready`)
-        expect(collection._lifecycle.getSyncError()).toBeUndefined()
-        expect(collection.get(`prefix`)).toBeUndefined()
-        expect(collection.get(`aborting`)).toBeUndefined()
-        expect(stripVirtualProps(collection.get(`independent`))).toEqual(
-          expected.committedRows.get(`independent`),
-        )
-        expect(adapter.rows).toEqual(expected.committedRows)
-        expect(
-          adapter.applyCommittedTxCalls.map(({ tx }) =>
-            tx.mutations.map(({ key }) => key),
-          ),
-        ).toEqual([[`independent`]])
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        releaseHydration.resolve()
-        aborted.abort()
-        await cleanupPersistedOracle(
-          [
-            () => hydration?.catch(() => undefined),
-            () => abortedReceipt?.catch(() => undefined),
-            () => independentReceipt?.catch(() => undefined),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`rejects every hydration-buffered receipt when replay fails`, async () => {
-    const adapter = createRecordingAdapter()
-    let resolveLoadSubset: (() => void) | undefined
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => {
-      if (args[1]?.includeRows === true) {
-        await new Promise<void>((resolve) => {
-          resolveLoadSubset = resolve
-        })
-      }
-      return loadResumeSnapshot(...args)
-    }
-
-    const replayError = new Error(`replay application failed`)
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-replay-failure-receipt`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    const readyOutcome = collection.stateWhenReady().then(
-      () => ({ status: `fulfilled` as const }),
-      (reason: unknown) => ({ status: `rejected` as const, reason }),
-    )
-    for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
-      await flushAsyncWork()
-    }
-
-    remoteBegin?.()
-    remoteWrite?.({
-      type: `insert`,
-      value: { id: `during-hydrate`, title: `During hydrate` },
-    })
-    const failingReceipt = remoteCommit?.()
-    remoteBegin?.()
-    remoteWrite?.({
-      type: `insert`,
-      value: { id: `sibling`, title: `Sibling` },
-    })
-    const siblingReceipt = remoteCommit?.()
-    expect(failingReceipt).toBeInstanceOf(Promise)
-    expect(siblingReceipt).toBeInstanceOf(Promise)
-    const setSyncedRow = collection._state.syncedData.set.bind(
-      collection._state.syncedData,
-    )
-    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
-      (key, value) => {
-        if (key === `during-hydrate`) throw replayError
-        return setSyncedRow(key, value)
-      },
-    )
-    const failingExpectation = expect(
-      Promise.resolve(failingReceipt),
-    ).rejects.toBe(replayError)
-    const siblingExpectation = expect(
-      Promise.resolve(siblingReceipt),
-    ).rejects.toBe(replayError)
-
-    resolveLoadSubset?.()
-    const ready = await atPersistedOracleCheckpoint(
-      readyOutcome,
-      `replay-failed hydration readiness settled`,
-    )
-    await failingExpectation
-    await siblingExpectation
-    remoteBegin?.()
-    remoteWrite?.({
-      type: `insert`,
-      value: { id: `after-replay-failure`, title: `must not be admitted` },
-    })
-    const lateOutcome = await atPersistedOracleCheckpoint(
-      Promise.resolve(remoteCommit?.()).then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      ),
-      `post-replay-failure source receipt`,
-    )
-
-    expect({
-      readyStatus: ready.status,
-      readyExact: ready.status === `rejected` && ready.reason === replayError,
-      lateStatus: lateOutcome.status,
-      lateExact:
-        lateOutcome.status === `rejected` && lateOutcome.reason === replayError,
-      status: collection.status,
-      exactPublicError: collection._lifecycle.getSyncError() === replayError,
-      visibleLate: collection.get(`after-replay-failure`),
-      durableLate: adapter.rows.get(`after-replay-failure`),
-      applyCalls: adapter.applyCommittedTxCalls.length,
-    }).toEqual({
-      readyStatus: `rejected`,
-      readyExact: true,
-      lateStatus: `rejected`,
-      lateExact: true,
-      status: `crashed`,
-      exactPublicError: true,
-      visibleLate: undefined,
-      durableLate: undefined,
-      applyCalls: 0,
-    })
-
-    await collection.cleanup()
-  })
-
-  it.each([`metadata-snapshot`, `baseline-snapshot`, `row-apply`] as const)(
-    `fail-stops startup when the %s phase fails`,
-    async (phase) => {
-      const phaseError = new Error(`${phase} failed exactly`)
-      const adapter = createRecordingAdapter(
-        phase === `row-apply`
-          ? [{ id: `row-apply-failure`, title: `must not apply` }]
-          : [],
-      )
-      if (phase !== `row-apply`) {
-        const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-        adapter.loadResumeSnapshot = (...args) =>
-          args[1]?.includeRows === (phase === `baseline-snapshot`)
-            ? Promise.reject(phaseError)
-            : loadResumeSnapshot(...args)
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `terminal-startup-${phase}`,
-          getKey: (row) => {
-            if (phase === `row-apply` && row.id === `row-apply-failure`) {
-              throw phaseError
-            }
-            return row.id
-          },
-          persistence: { adapter },
-        }),
-      )
-      let hasPrimaryFailure = false
-
-      try {
-        const startupOutcome = await atPersistedOracleCheckpoint(
-          collection.stateWhenReady().then(
-            () => ({ status: `fulfilled` as const }),
-            (reason: unknown) => ({ status: `rejected` as const, reason }),
-          ),
-          `${phase} startup boundary settled`,
-        )
-
-        expect({
-          startupStatus: startupOutcome.status,
-          startupExact:
-            startupOutcome.status === `rejected` &&
-            startupOutcome.reason === phaseError,
-          status: collection.status,
-          exactPublicError: collection._lifecycle.getSyncError() === phaseError,
-          visibleRows: Array.from(collection.values()).map(stripVirtualProps),
-          durableRows: Array.from(adapter.rows.values()),
-          applyCalls: adapter.applyCommittedTxCalls.length,
-        }).toEqual({
-          startupStatus: `rejected`,
-          startupExact: true,
-          status: `crashed`,
-          exactPublicError: true,
-          visibleRows: [],
-          durableRows:
-            phase === `row-apply`
-              ? [{ id: `row-apply-failure`, title: `must not apply` }]
-              : [],
-          applyCalls: 0,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`fail-stops a coordinator transaction flushed after hydration`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return []
-    })
-    const flushError = new Error(`coordinator hydration flush failed exactly`)
-    const coordinator = createFailStopCoordinatorHarness(
-      `terminal-coordinator-hydration-flush`,
-    )
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-coordinator-hydration-flush`,
-        getKey: (row) => {
-          if (row.id === `coordinator-bad`) throw flushError
-          return row.id
-        },
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const readyOutcome = collection.stateWhenReady().then(
-      () => ({ status: `fulfilled` as const }),
-      (reason: unknown) => ({ status: `rejected` as const, reason }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `coordinator flush hydration entered`,
-      )
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `coordinator-flush-failure`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          {
-            key: `coordinator-bad`,
-            value: { id: `coordinator-bad`, title: `must not publish` },
-          },
-        ],
-        deletedKeys: [],
-      })
-      hydration.resolve()
-      const ready = await atPersistedOracleCheckpoint(
-        readyOutcome,
-        `coordinator flush readiness settled`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `late`, title: `must not be admitted` },
-      })
-      const late = await atPersistedOracleCheckpoint(
-        Promise.resolve(sourceParams.commit()).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `coordinator flush late receipt`,
-      )
-
-      expect({
-        readyStatus: ready.status,
-        readyExact: ready.status === `rejected` && ready.reason === flushError,
-        lateStatus: late.status,
-        lateExact: late.status === `rejected` && late.reason === flushError,
-        status: collection.status,
-        exactPublicError: collection._lifecycle.getSyncError() === flushError,
-        visibleBad: collection.get(`coordinator-bad`),
-        visibleLate: collection.get(`late`),
-        durableLate: adapter.rows.get(`late`),
-        applyCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        readyStatus: `rejected`,
-        readyExact: true,
-        lateStatus: `rejected`,
-        lateExact: true,
-        status: `crashed`,
-        exactPublicError: true,
-        visibleBad: undefined,
-        visibleLate: undefined,
-        durableLate: undefined,
-        applyCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`applies hydration-queued sync work after an unrelated local persistence rollback`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return []
-    })
-    const appliedError = new Error(`hydration applied receipt failed exactly`)
-    const localPersistence = createEventGate()
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-hydration-applied-receipt`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const localTransaction = createTransaction({
-      mutationFn: () => localPersistence.promise,
-    })
-    const readyOutcome = collection.stateWhenReady().then(
-      () => ({ status: `fulfilled` as const }),
-      (reason: unknown) => ({ status: `rejected` as const, reason }),
-    )
-    let remoteReceipt: true | Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `applied-receipt hydration entered`,
-      )
-      localTransaction.mutate(() => {
-        collection.insert({ id: `local-gate`, title: `local pending` })
-      })
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: {
-          id: `remote-applied`,
-          title: `applies after local rollback`,
-        },
-      })
-      remoteReceipt = sourceParams.commit()
-      expect(remoteReceipt).toBeInstanceOf(Promise)
-      hydration.resolve()
-      await flushAsyncWork()
-      localPersistence.reject(appliedError)
-
-      const ready = await atPersistedOracleCheckpoint(
-        readyOutcome,
-        `applied-receipt readiness settled`,
-      )
-      const remote = await atPersistedOracleCheckpoint(
-        Promise.resolve(remoteReceipt).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `hydration-applied remote receipt settled`,
-      )
-
-      expect({
-        readyStatus: ready.status,
-        remoteStatus: remote.status,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        durableRemote: adapter.rows.get(`remote-applied`),
-        applyCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        readyStatus: `fulfilled`,
-        remoteStatus: `fulfilled`,
-        status: `ready`,
-        publicError: undefined,
-        durableRemote: {
-          id: `remote-applied`,
-          title: `applies after local rollback`,
-        },
-        applyCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      localPersistence.reject(appliedError)
-      await localTransaction.isPersisted.promise.catch(() => undefined)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // The core optimistic-history law drops a refused insert at settlement;
-  // accepted source transactions remain authoritative. The independent
-  // single-row source reference state starts empty. Each accepted source turn
-  // changes only its named key.
-  // Cross first-turn insert/delete with commitment before/after refusal, then
-  // apply the opposite turn. Compare at mutation settlement and each receipt,
-  // before a later source turn can hide a ghost.
-  // A failed transaction contributes no lasting local attribution. A source
-  // row that survives its rejection has remote public origin at publication,
-  // whether the source turn was accepted before or after the rejection.
-  const refusalHistories = ([`before`, `after`] as const).flatMap((timing) =>
-    ([`delete`, `insert`] as const).map((firstWrite) => ({
-      timing,
-      firstWrite,
-    })),
-  )
-  it.each(refusalHistories)(
-    `drops a refused insert and applies source turns on its key: %j`,
-    async ({ timing, firstWrite }) => {
-      const adapter = createRecordingAdapter()
-      const refused = new Error(`outbound save refused`)
-      const outbound = createEventGate()
-      const handlerEntered = createEventGate()
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `refused-insert-source-${timing}-${firstWrite}`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-            },
-          },
-          persistence: { adapter },
-          onInsert: async () => {
-            handlerEntered.resolve()
-            await outbound.promise
-          },
-        }),
-      )
-      let transaction: ReturnType<typeof collection.insert> | undefined
-      let firstReceipt: true | Promise<void> | undefined
-      let secondReceipt: true | Promise<void> | undefined
-      let expectedSource: Todo | undefined
-      let hasPrimaryFailure = false
-      const sourceRow: Todo = { id: `local`, title: `source row` }
-      const laterRow: Todo = { id: `local`, title: `later source row` }
-
-      // A source turn is an authoritative edit. This tiny model uses no
-      // persisted-wrapper or Collection state to predict the next row.
-      const checkSource = (checkpoint: string) => {
-        const live = collection.get(`local`)
-        expect(
-          {
-            live: stripVirtualProps(live),
-            base: collection.base.get(`local`),
-            durable: adapter.rows.get(`local`),
-          },
-          checkpoint,
-        ).toEqual({
-          live: expectedSource,
-          base: expectedSource,
-          durable: expectedSource,
-        })
-        if (expectedSource) expect(live?.$origin, checkpoint).toBe(`remote`)
-      }
-      const writeSource = (type: `insert` | `delete`, row = sourceRow) => {
-        sourceParams.begin()
-        if (type === `insert`) sourceParams.write({ type, value: row })
-        else sourceParams.write({ type, key: `local` })
-        return sourceParams.commit()
-      }
-
-      try {
-        await atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `refused insert collection ready`,
-        )
-        transaction = collection.insert({ id: `local`, title: `optimistic` })
-        await atPersistedOracleCheckpoint(
-          handlerEntered.promise,
-          `refused insert handler entered`,
-        )
-        expect(collection.get(`local`)?.title).toBe(`optimistic`)
-        expect(collection.base.has(`local`)).toBe(false)
-        expect(adapter.rows.has(`local`)).toBe(false)
-
-        if (timing === `before`) {
-          firstReceipt = writeSource(firstWrite)
-          expectedSource = firstWrite === `insert` ? sourceRow : undefined
-          await atPersistedOracleCheckpoint(
-            Promise.resolve(whenSyncAccepted(firstReceipt)).then(
-              () => undefined,
-            ),
-            `source turn durable before refusal`,
-          )
-          expect(collection.get(`local`)?.title).toBe(`optimistic`)
-          expect(adapter.rows.get(`local`)).toEqual(expectedSource)
-          // Durability accepts the source turn. Its receipt still waits for
-          // the refused mutation to settle and release core publication.
-          const receiptState = observeSettlement(
-            Promise.resolve(firstReceipt).then(() => undefined),
-          )
-          await flushAsyncWork()
-          expect(receiptState.read()).toEqual({ status: `pending` })
-        }
-
-        outbound.reject(refused)
-        await expect(transaction.isPersisted.promise).rejects.toBe(refused)
-        expect(transaction.state).toBe(`failed`)
-        checkSource(`after refused mutation settled`)
-        if (firstReceipt !== undefined) {
-          await Promise.resolve(firstReceipt)
-          checkSource(`after held source receipt`)
-        }
-
-        if (timing === `after`) {
-          firstReceipt = writeSource(firstWrite)
-          expectedSource = firstWrite === `insert` ? sourceRow : undefined
-          await atPersistedOracleCheckpoint(
-            Promise.resolve(firstReceipt).then(() => undefined),
-            `first post-failure source turn applied`,
-          )
-          checkSource(`after first source receipt`)
-        }
-
-        const secondWrite = firstWrite === `insert` ? `delete` : `insert`
-        secondReceipt = writeSource(secondWrite, laterRow)
-        expectedSource = secondWrite === `insert` ? laterRow : undefined
-        await atPersistedOracleCheckpoint(
-          Promise.resolve(secondReceipt).then(() => undefined),
-          `second post-failure source turn applied`,
-        )
-        checkSource(`after second source receipt`)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        if (transaction) outbound.reject(refused)
-        await cleanupPersistedOracle(
-          [
-            () => transaction?.isPersisted.promise.catch(() => undefined),
-            () =>
-              firstReceipt === undefined
-                ? undefined
-                : Promise.resolve(firstReceipt).catch(() => undefined),
-            () =>
-              secondReceipt === undefined
-                ? undefined
-                : Promise.resolve(secondReceipt).catch(() => undefined),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // The synced wrapper forwards accepted source transactions to core without
-  // a client identity. Under the key-and-timing rule, the first same-key turn
-  // consumes a successful mutation's local attribution. A second accepted
-  // turn replaces it with remote attribution. The independent source order
-  // predicts the final row; compare it when the mutation and receipts settle.
-  it.each([1, 2] as const)(
-    `attributes only the first of %i persisted same-key source turns locally`,
-    async (sourceTurns) => {
-      const adapter = createRecordingAdapter()
-      const handlerEntered = createEventGate()
-      const releaseHandler = createEventGate()
-      let source!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `persisted-origin-${sourceTurns}`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-            },
-          },
-          persistence: { adapter },
-          onInsert: async () => {
-            handlerEntered.resolve()
-            await releaseHandler.promise
-          },
-        }),
-      )
-      let transaction: ReturnType<typeof collection.insert> | undefined
-      const receipts: Array<true | Promise<void>> = []
-      let hasPrimaryFailure = false
-
-      try {
-        await atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `persisted origin collection ready`,
-        )
-        transaction = collection.insert({ id: `local`, title: `optimistic` })
-        await atPersistedOracleCheckpoint(
-          handlerEntered.promise,
-          `persisted origin handler entered`,
-        )
-        for (let turn = 1; turn <= sourceTurns; turn++) {
-          source.begin()
-          source.write({
-            type: turn === 1 ? `insert` : `update`,
-            value: { id: `local`, title: `source ${turn}` },
-          })
-          const receipt = source.commit()
-          receipts.push(receipt)
-          await atPersistedOracleCheckpoint(
-            Promise.resolve(whenSyncAccepted(receipt)).then(() => undefined),
-            `source turn ${turn} accepted`,
-          )
-        }
-        expect(collection.get(`local`)?.title).toBe(`optimistic`)
-
-        releaseHandler.resolve()
-        await atPersistedOracleCheckpoint(
-          transaction.isPersisted.promise.then(() => undefined),
-          `successful persisted origin mutation settled`,
-        )
-        await Promise.all(receipts.map((receipt) => Promise.resolve(receipt)))
-        const row = { id: `local`, title: `source ${sourceTurns}` }
-        expect(stripVirtualProps(collection.get(`local`))).toEqual(row)
-        expect(collection.get(`local`)?.$origin).toBe(
-          sourceTurns === 1 ? `local` : `remote`,
-        )
-        expect(collection.base.get(`local`)).toEqual(row)
-        expect(adapter.rows.get(`local`)).toEqual(row)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        releaseHandler.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => transaction?.isPersisted.promise.catch(() => undefined),
-            ...receipts.map(
-              (receipt) => () =>
-                Promise.resolve(receipt).catch(() => undefined),
-            ),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // A source commit made while a local mutation persists is accepted and
-  // durably stored. Its rows stay hidden until that mutation settles.
-  it(`accepts and stores a source commit made beneath a persisting mutation`, async () => {
-    const adapter = createRecordingAdapter()
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `source-commit-beneath-mutation`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const localPersistence = createEventGate()
-    const localTransaction = createTransaction({
-      autoCommit: false,
-      mutationFn: () => localPersistence.promise,
-    })
-    let localCommit: Promise<unknown> | undefined
-    let remoteReceipt: true | Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `source commit collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `seed`, title: `baseline` },
-      })
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(sourceParams.commit()),
-        `source commit seed persisted`,
-      )
-
-      localTransaction.mutate(() => {
-        collection.update(`seed`, (draft) => {
-          draft.title = `local pending`
-        })
-      })
-      localCommit = localTransaction.commit()
-      void localCommit.catch(() => undefined)
-      expect(localTransaction.state).toBe(`persisting`)
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `remote`, title: `source commit` },
-      })
-      remoteReceipt = sourceParams.commit()
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(whenSyncAccepted(remoteReceipt)).then(() => undefined),
-        `source commit accepted before local settlement`,
-      )
-      // Accepted, but held: it becomes visible when the mutation settles.
-      expect(remoteReceipt).not.toBe(true)
-      const remoteSettlement = observeSettlement(remoteReceipt as Promise<void>)
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      expect(remoteSettlement.read()).toEqual({ status: `pending` })
-      expect({
-        localState: localTransaction.state,
-        remoteVisible: collection.has(`remote`),
-        remoteDurable: adapter.rows.get(`remote`),
-      }).toEqual({
-        localState: `persisting`,
-        remoteVisible: false,
-        remoteDurable: { id: `remote`, title: `source commit` },
-      })
-
-      localPersistence.resolve()
-      await atPersistedOracleCheckpoint(
-        localTransaction.isPersisted.promise,
-        `local settlement publishes the source commit`,
-      )
-      expect(stripVirtualProps(collection.get(`remote`))).toEqual({
-        id: `remote`,
-        title: `source commit`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      localPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => localCommit,
-          () =>
-            remoteReceipt === true ? undefined : Promise.resolve(remoteReceipt),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // A handler may write, and await, a source commit queued behind an earlier
-  // parked source commit. Both apply in commit order when it settles.
-  it(`accepts a handler source commit queued behind a parked source commit`, async () => {
-    const adapter = createRecordingAdapter()
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `handler-source-dependency`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const mutationEntered = createEventGate()
-    const startDependency = createEventGate()
-    const dependencySubmitted = createEventGate()
-    let dependencyReceipt: true | Promise<void> | undefined
-    const localTransaction = createTransaction({
-      mutationFn: async () => {
-        mutationEntered.resolve()
-        await startDependency.promise
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `dependency`, title: `releases user persistence` },
-        })
-        dependencyReceipt = sourceParams.commit()
-        dependencySubmitted.resolve()
-        await whenSyncAccepted(dependencyReceipt)
-      },
-    })
-    const normalAbort = new AbortController()
-    let normalReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `handler dependency collection ready`,
-      )
-      localTransaction.mutate(() => {
-        collection.insert({ id: `local`, title: `user persistence pending` })
-      })
-      await atPersistedOracleCheckpoint(
-        mutationEntered.promise,
-        `user persistence entered`,
-      )
-      expect(localTransaction.state).toBe(`persisting`)
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `parked`, title: `waits for user persistence` },
-      })
-      normalReceipt = Promise.resolve(
-        sourceParams.commit(normalAbort.signal),
-      ).then(() => undefined)
-      void normalReceipt.catch(() => undefined)
-      expect(
-        collection._state.pendingSyncedTransactions.some(
-          (transaction) => transaction.committed,
-        ),
-      ).toBe(true)
-
-      startDependency.resolve()
-      await atPersistedOracleCheckpoint(
-        dependencySubmitted.promise,
-        `handler dependency submitted`,
-      )
-      await atPersistedOracleCheckpoint(
-        localTransaction.isPersisted.promise,
-        `user persistence completes after its awaited source commit`,
-      )
-      await atPersistedOracleCheckpoint(
-        normalReceipt,
-        `parked predecessor receipt`,
-      )
-      expect({
-        dependencyVisible: stripVirtualProps(collection.get(`dependency`)),
-        dependencyDurable: adapter.rows.get(`dependency`),
-        parkedVisible: stripVirtualProps(collection.get(`parked`)),
-        parkedDurable: adapter.rows.get(`parked`),
-        durableOrder: adapter.applyCommittedTxCalls.flatMap((call) =>
-          call.tx.mutations.map((mutation) => mutation.key),
-        ),
-        status: collection.status,
-      }).toEqual({
-        dependencyVisible: {
-          id: `dependency`,
-          title: `releases user persistence`,
-        },
-        dependencyDurable: {
-          id: `dependency`,
-          title: `releases user persistence`,
-        },
-        parkedVisible: { id: `parked`, title: `waits for user persistence` },
-        parkedDurable: { id: `parked`, title: `waits for user persistence` },
-        durableOrder: expect.arrayContaining([`parked`, `dependency`]),
-        status: `ready`,
-      })
-      const durableKeys = adapter.applyCommittedTxCalls.flatMap((call) =>
-        call.tx.mutations.map((mutation) => mutation.key),
-      )
-      expect(durableKeys.indexOf(`parked`)).toBeLessThan(
-        durableKeys.indexOf(`dependency`),
-      )
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      startDependency.resolve()
-      normalAbort.abort()
-      await cleanupPersistedOracle(
-        [
-          () => localTransaction.isPersisted.promise.catch(() => undefined),
-          () => normalReceipt?.catch(() => undefined),
-          () =>
-            dependencyReceipt === true
-              ? undefined
-              : Promise.resolve(dependencyReceipt).catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`replays source transactions one by one behind a held predecessor`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    const persistedSharedTitles: Array<string> = []
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      for (const mutation of args[1].mutations) {
-        if (mutation.type !== `delete` && mutation.key === `shared`) {
-          persistedSharedTitles.push((mutation.value as Todo).title)
-        }
-      }
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-      }
-      await applyCommittedTx(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `source-fifo-order`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let gateReceipt: Promise<void> | undefined
-    let olderReceipt: Promise<void> | undefined
-    let newerReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `source FIFO ordering collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `gate`, title: `holds adapter` },
-      })
-      gateReceipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      void gateReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `source FIFO ordering predecessor persistence entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `shared`, title: `older normal` },
-      })
-      olderReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void olderReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `shared`, title: `newer source value` },
-      })
-      newerReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void newerReceipt.catch(() => undefined)
-
-      expect(collection.get(`shared`)).toBeUndefined()
-
-      releaseFirstPersistence.resolve()
-      await atPersistedOracleCheckpoint(gateReceipt, `ordering gate persisted`)
-      await atPersistedOracleCheckpoint(
-        olderReceipt,
-        `older normal source receipt`,
-      )
-      await atPersistedOracleCheckpoint(
-        newerReceipt,
-        `newer source FIFO receipt`,
-      )
-
-      expect({
-        status: collection.status,
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        durableRow: adapter.rows.get(`shared`),
-        persistedTitles: persistedSharedTitles,
-      }).toEqual({
-        status: `ready`,
-        publicRow: { id: `shared`, title: `newer source value` },
-        durableRow: { id: `shared`, title: `newer source value` },
-        persistedTitles: [`older normal`, `newer source value`],
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => gateReceipt?.catch(() => undefined),
-          () => olderReceipt?.catch(() => undefined),
-          () => newerReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`admits a queued insert after an earlier queued delete of the same key`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `shared`, title: `Original row` },
-    ])
-    const persistenceEntered = createEventGate()
-    const releasePersistence = createEventGate()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        persistenceEntered.resolve()
-        await releasePersistence.promise
-      }
-      await applyCommittedTx(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `queued-delete-insert-prefix`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let gateReceipt: Promise<void> | undefined
-    let deleteReceipt: Promise<void> | undefined
-    let insertReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `queued-prefix collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `gate`, title: `Hold durability` },
-      })
-      gateReceipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      void gateReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        persistenceEntered.promise,
-        `queued-prefix durability held`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({ type: `delete`, key: `shared` })
-      deleteReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void deleteReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      expect(() =>
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `shared`, title: `Replacement row` },
-        }),
-      ).not.toThrow()
-      insertReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void insertReceipt.catch(() => undefined)
-
-      expect({
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        deleteReceipt: observeSettlement(deleteReceipt).read(),
-        insertReceipt: observeSettlement(insertReceipt).read(),
-      }).toEqual({
-        publicRow: { id: `shared`, title: `Original row` },
-        deleteReceipt: { status: `pending` },
-        insertReceipt: { status: `pending` },
-      })
-
-      releasePersistence.resolve()
-      await atPersistedOracleCheckpoint(gateReceipt, `queued-prefix gate`)
-      await atPersistedOracleCheckpoint(deleteReceipt, `queued-prefix delete`)
-      await atPersistedOracleCheckpoint(insertReceipt, `queued-prefix insert`)
-      expect({
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        durableRow: adapter.rows.get(`shared`),
-        status: collection.status,
-      }).toEqual({
-        publicRow: { id: `shared`, title: `Replacement row` },
-        durableRow: { id: `shared`, title: `Replacement row` },
-        status: `ready`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releasePersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => gateReceipt?.catch(() => undefined),
-          () => deleteReceipt?.catch(() => undefined),
-          () => insertReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`stores reentrant source commits from a publication callback in staging order`, async () => {
-    const adapter = createRecordingAdapter()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    const persistedTitles: Array<string> = []
-    adapter.applyCommittedTx = async (...args) => {
-      for (const mutation of args[1].mutations) {
-        if (mutation.type !== `delete` && mutation.key === `shared`) {
-          persistedTitles.push((mutation.value as Todo).title)
-        }
-      }
-      await applyCommittedTx(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `core-publication-source-order`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let earlierReceipt: Promise<void> | undefined
-    let laterReceipt: Promise<void> | undefined
-    let callbackCount = 0
-    const publication = collection.subscribeChanges((changes) => {
-      if (
-        callbackCount === 0 &&
-        changes.some((change) => change.key === `trigger`)
-      ) {
-        callbackCount++
-        sourceParams.begin()
-        sourceParams.write({
-          type: `update`,
-          value: { id: `shared`, title: `earlier` },
-        })
-        earlierReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void earlierReceipt.catch(() => undefined)
-
-        sourceParams.begin()
-        sourceParams.write({
-          type: `update`,
-          value: { id: `shared`, title: `later` },
-        })
-        laterReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void laterReceipt.catch(() => undefined)
-      }
-    })
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `core-publication ordering collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `trigger`, title: `Triggers source reentry` },
-      })
-      await Promise.resolve(sourceParams.commit())
-      await vi.waitFor(() => expect(callbackCount).toBe(1))
-      expect(earlierReceipt).toBeInstanceOf(Promise)
-      expect(laterReceipt).toBeInstanceOf(Promise)
-      await atPersistedOracleCheckpoint(
-        earlierReceipt!,
-        `core-publication earlier receipt`,
-      )
-      await atPersistedOracleCheckpoint(
-        laterReceipt!,
-        `core-publication later receipt`,
-      )
-
-      expect({
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        durableRow: adapter.rows.get(`shared`),
-        persistedTitles,
-        status: collection.status,
-      }).toEqual({
-        publicRow: { id: `shared`, title: `later` },
-        durableRow: { id: `shared`, title: `later` },
-        persistedTitles: [`earlier`, `later`],
-        status: `ready`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      publication.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => earlierReceipt?.catch(() => undefined),
-          () => laterReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`stores a source turn beneath an optimistic mutation and publishes it at settlement`, async () => {
-    const adapter = createRecordingAdapter()
-    const mutationEntered = createEventGate()
-    const allowDemand = createEventGate()
-    let upstreamLoads = 0
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `source-publication-before-mutation-demand`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return {
-              loadSubset: () => {
-                upstreamLoads++
-                return true
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const subset = { limit: 1 }
-    let localReceipt: Promise<unknown> | undefined
-    let sourceReceipt: Promise<void> | undefined
-    let demand: Promise<unknown> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      const local = createTransaction({
-        // A handler awaiting an on-demand load of its own Collection would
-        // wait for itself: the load's rows publish when this mutation settles.
-        mutationFn: async () => {
-          mutationEntered.resolve()
-          await allowDemand.promise
-          demand = Promise.resolve(collection._sync.loadSubset(subset))
-          void demand.catch(() => undefined)
-        },
-      })
-      local.mutate(() => {
-        collection.insert({ id: `local`, title: `optimistic local` })
-      })
-      localReceipt = local.isPersisted.promise
-      void localReceipt.catch(() => undefined)
-      await mutationEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `remote`, title: `authoritative source` },
-      })
-      const sourceCommit = sourceParams.commit()
-      sourceReceipt = Promise.resolve(sourceCommit).then(() => undefined)
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(whenSyncAccepted(sourceCommit)),
-        `source commit accepted beneath optimistic mutation`,
-      )
-
-      expect({
-        local: stripVirtualProps(collection.get(`local`)),
-        remote: stripVirtualProps(collection.get(`remote`)),
-        durableRemote: adapter.rows.get(`remote`),
-        localState: local.state,
-      }).toEqual({
-        local: { id: `local`, title: `optimistic local` },
-        remote: undefined,
-        durableRemote: { id: `remote`, title: `authoritative source` },
-        localState: `persisting`,
-      })
-
-      allowDemand.resolve()
-      await atPersistedOracleCheckpoint(
-        localReceipt,
-        `mutation settles after starting its demand`,
-      )
-      await atPersistedOracleCheckpoint(
-        demand!,
-        `demand settles after mutation`,
-      )
-      expect({
-        remote: stripVirtualProps(collection.get(`remote`)),
-        status: collection.status,
-        upstreamLoads,
-      }).toEqual({
-        remote: { id: `remote`, title: `authoritative source` },
-        status: `ready`,
-        upstreamLoads: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      allowDemand.resolve()
-      collection._sync.unloadSubset(subset)
-      await cleanupPersistedOracle(
-        [
-          () => sourceReceipt?.catch(() => undefined),
-          () => localReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`queues independent demand behind normal source publication without rejecting it`, async () => {
-    const adapter = createRecordingAdapter()
-    const mutationEntered = createEventGate()
-    const releaseMutation = createEventGate()
-    let upstreamLoads = 0
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `independent-demand-behind-source-publication`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return {
-              loadSubset: () => {
-                upstreamLoads++
-                return true
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const subset = { limit: 1 }
-    let localReceipt: Promise<unknown> | undefined
-    let sourceReceipt: Promise<void> | undefined
-    let demand: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      const local = createTransaction({
-        mutationFn: async () => {
-          mutationEntered.resolve()
-          await releaseMutation.promise
-        },
-      })
-      local.mutate(() => {
-        collection.insert({ id: `local`, title: `optimistic local` })
-      })
-      localReceipt = local.isPersisted.promise
-      void localReceipt.catch(() => undefined)
-      await mutationEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `remote`, title: `normal source` },
-      })
-      sourceReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void sourceReceipt.catch(() => undefined)
-      demand = Promise.resolve(collection._sync.loadSubset(subset)).then(
-        () => undefined,
-      )
-      void demand.catch(() => undefined)
-      const sourceSettlement = observeSettlement(sourceReceipt)
-      const demandSettlement = observeSettlement(demand)
-      await Promise.resolve()
-      expect({
-        source: sourceSettlement.read(),
-        demand: demandSettlement.read(),
-        status: collection.status,
-      }).toEqual({
-        source: { status: `pending` },
-        demand: { status: `pending` },
-        status: `ready`,
-      })
-
-      releaseMutation.resolve()
-      await atPersistedOracleCheckpoint(
-        Promise.all([localReceipt, sourceReceipt, demand]),
-        `independent demand after normal source publication`,
-      )
-      expect({
-        status: collection.status,
-        source: sourceSettlement.read(),
-        demand: demandSettlement.read(),
-        upstreamLoads,
-        durableRemote: adapter.rows.get(`remote`),
-      }).toEqual({
-        status: `ready`,
-        source: { status: `fulfilled`, value: undefined },
-        demand: { status: `fulfilled`, value: undefined },
-        upstreamLoads: 1,
-        durableRemote: { id: `remote`, title: `normal source` },
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseMutation.resolve()
-      collection._sync.unloadSubset(subset)
-      await cleanupPersistedOracle(
-        [
-          () => demand?.catch(() => undefined),
-          () => sourceReceipt?.catch(() => undefined),
-          () => localReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`queues a source suffix behind held durability and fails it with the prefix`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const firstDurabilityEntered = createEventGate()
-    const releaseFirstDurability = createEventGate()
-    const persistenceResponse = {
-      type: `rpc:applyCommittedTx:res` as const,
-      rpcId: `failed-prefix`,
-      ok: false as const,
-      code: `PERSISTENCE_ERROR` as const,
-      error: `prefix durability failed`,
-      sourceCode: `SQLITE_IOERR_FSYNC`,
-      path: [`database`, `wal`] as const,
-    }
-    let durabilityCalls = 0
-    coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
-      durabilityCalls++
-      if (durabilityCalls === 1) {
-        firstDurabilityEntered.resolve()
-        await releaseFirstDurability.promise
-        return { ...persistenceResponse, rpcId: tx.txId }
-      }
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        tx,
-      )
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `source-prefix-fail-stop`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let prefixReceipt: Promise<void> | undefined
-    let suffixReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `source prefix fail-stop collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `prefix`, title: `fails durability` },
-      })
-      prefixReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void prefixReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstDurabilityEntered.promise,
-        `failed source prefix entered durability`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `suffix`, title: `must not become durable` },
-      })
-      suffixReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void suffixReceipt.catch(() => undefined)
-      const prefixSettlement = observeSettlement(prefixReceipt)
-      const suffixSettlement = observeSettlement(suffixReceipt)
-      await Promise.resolve()
-
-      expect({
-        prefixPublic: stripVirtualProps(collection.get(`prefix`)),
-        suffixPublic: stripVirtualProps(collection.get(`suffix`)),
-        prefixReceipt: prefixSettlement.read(),
-        suffixReceipt: suffixSettlement.read(),
-        durabilityCalls,
-        prefixDurable: adapter.rows.get(`prefix`),
-        suffixDurable: adapter.rows.get(`suffix`),
-      }).toEqual({
-        prefixPublic: { id: `prefix`, title: `fails durability` },
-        suffixPublic: undefined,
-        prefixReceipt: { status: `pending` },
-        suffixReceipt: { status: `pending` },
-        durabilityCalls: 1,
-        prefixDurable: undefined,
-        suffixDurable: undefined,
-      })
-
-      releaseFirstDurability.resolve()
-      const prefixOutcome = await atPersistedOracleCheckpoint(
-        prefixReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `failed source prefix receipt`,
-      )
-      const suffixOutcome = await atPersistedOracleCheckpoint(
-        suffixReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `failed source suffix receipt`,
-      )
-      const terminalError =
-        prefixOutcome.status === `rejected` ? prefixOutcome.reason : undefined
-      expect({
-        prefixStatus: prefixOutcome.status,
-        terminalName:
-          terminalError instanceof Error ? terminalError.name : undefined,
-        terminalCause:
-          terminalError instanceof Error ? terminalError.cause : undefined,
-        suffixStatus: suffixOutcome.status,
-        suffixName:
-          suffixOutcome.status === `rejected` &&
-          suffixOutcome.reason instanceof Error
-            ? suffixOutcome.reason.name
-            : undefined,
-        sameTerminal:
-          suffixOutcome.status === `rejected` &&
-          suffixOutcome.reason === terminalError,
-        durabilityCalls,
-        suffixDurable: adapter.rows.get(`suffix`),
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-      }).toEqual({
-        prefixStatus: `rejected`,
-        terminalName: `PersistedCollectionDurabilityError`,
-        terminalCause: expect.objectContaining({
-          code: `PERSISTENCE_ERROR`,
-          path: [`database`, `wal`],
-        }),
-        suffixStatus: `rejected`,
-        suffixName: `PersistedCollectionDurabilityError`,
-        sameTerminal: true,
-        durabilityCalls: 1,
-        suffixDurable: undefined,
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstDurability.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => prefixReceipt?.catch(() => undefined),
-          () => suffixReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`bounds partial-update dependency work by pending owner count`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return []
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `pending-key-membership-work`,
-        getKey: (row) => row.id,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const ready = collection.stateWhenReady()
-    const ownerSizes = [47, 83] as const
-    const partialWrites = 19
-    const ownerReceipts: Array<Promise<void>> = []
-    const abortedReceipts: Array<Promise<unknown>> = []
-    let hasPrimaryFailure = false
-    let membershipChecks = 0
-    let membershipSpy: ReturnType<typeof vi.spyOn> | undefined
-
-    try {
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `key-membership hydration entered`,
-      )
-      for (const [ownerIndex, size] of ownerSizes.entries()) {
-        sourceParams.begin()
-        for (let keyIndex = 0; keyIndex < size; keyIndex++) {
-          sourceParams.write({
-            type: `insert`,
-            value: {
-              id: `owner-${ownerIndex}-${keyIndex}`,
-              title: `Queued owner row`,
-            },
-          })
-        }
-        const receipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void receipt.catch(() => undefined)
-        ownerReceipts.push(receipt)
-      }
-
-      const originalHas = Set.prototype.has
-      membershipSpy = vi
-        .spyOn(Set.prototype, `has`)
-        .mockImplementation(function (this: Set<unknown>, value: unknown) {
-          if (
-            typeof value === `string` &&
-            value.startsWith(`partial-`) &&
-            ownerSizes.includes(this.size as (typeof ownerSizes)[number])
-          ) {
-            membershipChecks++
-          }
-          return originalHas.call(this, value)
-        })
-      for (let index = 0; index < partialWrites; index++) {
-        const aborted = new AbortController()
-        aborted.abort()
-        sourceParams.begin()
-        sourceParams.write({
-          type: `update`,
-          value: { id: `partial-${index}`, title: `Partial update` },
-        })
-        abortedReceipts.push(
-          Promise.resolve(sourceParams.commit(aborted.signal)).catch(
-            (error) => error,
-          ),
-        )
-      }
-      membershipSpy.mockRestore()
-      membershipSpy = undefined
-
-      expectPendingKeyMembershipWork(
-        membershipChecks,
-        ownerSizes.length,
-        partialWrites,
-      )
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(ready, `key-membership hydration ready`)
-      await Promise.all(
-        ownerReceipts.map((receipt, index) =>
-          atPersistedOracleCheckpoint(receipt, `queued owner ${index} settled`),
-        ),
-      )
-      await Promise.all(abortedReceipts)
-      expect({
-        durableRows: adapter.rows.size,
-        status: collection.status,
-      }).toEqual({
-        durableRows: ownerSizes[0] + ownerSizes[1],
-        status: `ready`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      membershipSpy?.mockRestore()
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => ready.catch(() => undefined),
-          ...ownerReceipts.map(
-            (receipt) => () => receipt.catch(() => undefined),
-          ),
-          () => Promise.all(abortedReceipts).then(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects the old operation-scan answer for pending-key work`, () => {
-    const pendingOwnerSizes = [47, 83]
-    const partialWrites = 19
-    expect(() =>
-      expectPendingKeyMembershipWork(
-        pendingOwnerSizes.reduce((sum, size) => sum + size, 0) * partialWrites,
-        pendingOwnerSizes.length,
-        partialWrites,
-      ),
-    ).toThrow()
-    expect(() =>
-      expectPendingKeyMembershipWork(
-        pendingOwnerSizes.length * partialWrites,
-        pendingOwnerSizes.length,
-        partialWrites,
-      ),
-    ).not.toThrow()
-  })
-
-  it(`fail-stops a same-key partial suffix when its staged predecessor aborts`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-      }
-      await applyCommittedTx(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `same-key-abort-dependency`,
-        getKey: (row) => row.id,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const aborted = new AbortController()
-    let gateReceipt: Promise<void> | undefined
-    let abortedReceipt: Promise<void> | undefined
-    let dependentReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `same-key dependency collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `gate`, title: `holds adapter` },
-      })
-      gateReceipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      void gateReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `same-key dependency persistence entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: {
-          id: `shared`,
-          title: `predecessor`,
-          detail: `required inherited field`,
-        },
-      })
-      abortedReceipt = Promise.resolve(
-        sourceParams.commit(aborted.signal),
-      ).then(() => undefined)
-      void abortedReceipt.catch(() => undefined)
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `shared`, title: `dependent suffix` },
-      })
-      dependentReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void dependentReceipt.catch(() => undefined)
-
-      aborted.abort()
-      releaseFirstPersistence.resolve()
-      await atPersistedOracleCheckpoint(
-        gateReceipt,
-        `dependency gate persisted`,
-      )
-      const abortedOutcome = await atPersistedOracleCheckpoint(
-        abortedReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `same-key predecessor aborted`,
-      )
-      const dependentOutcome = await atPersistedOracleCheckpoint(
-        dependentReceipt.then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `same-key dependent suffix settled`,
-      )
-      const terminalError =
-        abortedOutcome.status === `rejected` ? abortedOutcome.reason : undefined
-
-      expect({
-        abortedStatus: abortedOutcome.status,
-        abortedName:
-          terminalError instanceof Error ? terminalError.name : undefined,
-        dependentStatus: dependentOutcome.status,
-        dependentExact:
-          dependentOutcome.status === `rejected` &&
-          dependentOutcome.reason === terminalError,
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-        publicRow: collection.get(`shared`),
-        durableRow: adapter.rows.get(`shared`),
-        pendingMarkers: collection._state.pendingSyncedTransactions.length,
-      }).toEqual({
-        abortedStatus: `rejected`,
-        abortedName: `AbortError`,
-        dependentStatus: `rejected`,
-        dependentExact: true,
-        status: `crashed`,
-        exactPublicError: true,
-        publicRow: undefined,
-        durableRow: undefined,
-        pendingMarkers: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => gateReceipt?.catch(() => undefined),
-          () => abortedReceipt?.catch(() => undefined),
-          () => dependentReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`closes a reentrant internal transaction after a terminal failure`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `hydrated`, title: `starts reentrant transaction` },
-    ])
-    const hydrationEntered = createEventGate()
-    const releaseHydration = createEventGate()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await releaseHydration.promise
-      return [
-        {
-          key: `hydrated`,
-          value: { id: `hydrated`, title: `starts reentrant transaction` },
-        },
-      ]
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-internal-transaction`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let internalReservationStarted = false
-    const subscription = collection.subscribeChanges((changes) => {
-      if (
-        !internalReservationStarted &&
-        changes.some((change) => change.key === `hydrated`)
-      ) {
-        internalReservationStarted = true
-        sourceParams.begin()
-      }
-    })
-    const terminalError = new Error(`terminal transaction failure`)
-    let externalReceipt: Promise<void> | undefined
-    let internalReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      const ready = collection.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `reentrant transaction hydration entered`,
-      )
-      await vi.waitFor(() => expect(sourceParams).toBeDefined())
-      releaseHydration.resolve()
-      await atPersistedOracleCheckpoint(ready, `reentrant transaction ready`)
-      expect({
-        internalReservationStarted,
-        pendingMarkers: collection._state.pendingSyncedTransactions.length,
-      }).toEqual({
-        internalReservationStarted: true,
-        pendingMarkers: 0,
-      })
-
-      adapter.applyCommittedTx = () => Promise.reject(terminalError)
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `terminal`, title: `published before failure` },
-      })
-      externalReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void externalReceipt.catch(() => undefined)
-      await expect(
-        atPersistedOracleCheckpoint(
-          externalReceipt,
-          `external durability failure`,
-        ),
-      ).rejects.toMatchObject({
-        name: `PersistedCollectionDurabilityError`,
-        cause: terminalError,
-      })
-
-      internalReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void internalReceipt.catch(() => undefined)
-      await expect(
-        atPersistedOracleCheckpoint(
-          internalReceipt,
-          `terminal internal transaction rejected`,
-        ),
-      ).rejects.toMatchObject({ name: `PersistedCollectionDurabilityError` })
-      expect({
-        status: collection.status,
-        pendingMarkers: collection._state.pendingSyncedTransactions.length,
-      }).toEqual({ status: `crashed`, pendingMarkers: 0 })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseHydration.resolve()
-      subscription.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => externalReceipt?.catch(() => undefined),
-          () => internalReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`keeps bare sync operations away from another owner's queued marker`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-      }
-      await applyCommittedTx(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `two-owner-marker-isolation`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let firstReceipt: Promise<void> | undefined
-    let queuedReceipt: Promise<void> | undefined
-    let strayCommitReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `two-owner marker collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `first`, title: `holds adapter` },
-      })
-      firstReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void firstReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `first owner persistence entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `queued`, title: `owns queued marker` },
-      })
-      queuedReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void queuedReceipt.catch(() => undefined)
-
-      let writeError: unknown
-      try {
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `stray`, title: `must not steal marker` },
-        })
-      } catch (error) {
-        writeError = error
-      }
-      let commitError: unknown
-      try {
-        const receipt = sourceParams.commit()
-        if (receipt !== true) {
-          strayCommitReceipt = Promise.resolve(receipt).then(() => undefined)
-          void strayCommitReceipt.catch(() => undefined)
-        }
-      } catch (error) {
-        commitError = error
-      }
-
-      expect({
-        writeErrorIsOwned:
-          writeError instanceof NoPendingSyncTransactionWriteError,
-        commitErrorIsOwned:
-          commitError instanceof NoPendingSyncTransactionCommitError,
-        queuedVisible: collection.has(`queued`),
-        strayVisible: collection.has(`stray`),
-      }).toEqual({
-        writeErrorIsOwned: true,
-        commitErrorIsOwned: true,
-        queuedVisible: false,
-        strayVisible: false,
-      })
-
-      releaseFirstPersistence.resolve()
-      await atPersistedOracleCheckpoint(firstReceipt, `first owner persisted`)
-      await atPersistedOracleCheckpoint(queuedReceipt, `queued owner persisted`)
-      expect({
-        queued: stripVirtualProps(collection.get(`queued`)),
-        stray: collection.get(`stray`),
-      }).toEqual({
-        queued: { id: `queued`, title: `owns queued marker` },
-        stray: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => firstReceipt?.catch(() => undefined),
-          () => queuedReceipt?.catch(() => undefined),
-          () => strayCommitReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`keeps a bare truncate away from another owner's queued marker`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstPersistenceEntered = createEventGate()
-    const releaseFirstPersistence = createEventGate()
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    let applyCalls = 0
-    adapter.applyCommittedTx = async (...args) => {
-      applyCalls++
-      if (applyCalls === 1) {
-        firstPersistenceEntered.resolve()
-        await releaseFirstPersistence.promise
-      }
-      await applyCommittedTx(...args)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `bare-truncate-owner-isolation`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let firstReceipt: Promise<void> | undefined
-    let queuedReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `bare truncate collection ready`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `first`, title: `must survive` },
-      })
-      firstReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void firstReceipt.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstPersistenceEntered.promise,
-        `bare truncate first owner persistence entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `queued`, title: `owns queued marker` },
-      })
-      queuedReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void queuedReceipt.catch(() => undefined)
-
-      let truncateError: unknown
-      try {
-        sourceParams.truncate()
-      } catch (error) {
-        truncateError = error
-      }
-      expect({
-        truncateErrorIsOwned:
-          truncateError instanceof NoPendingSyncTransactionWriteError,
-        firstVisible: stripVirtualProps(collection.get(`first`)),
-        queuedVisible: collection.has(`queued`),
-      }).toEqual({
-        truncateErrorIsOwned: true,
-        firstVisible: { id: `first`, title: `must survive` },
-        queuedVisible: false,
-      })
-
-      releaseFirstPersistence.resolve()
-      await atPersistedOracleCheckpoint(firstReceipt, `first owner persisted`)
-      await atPersistedOracleCheckpoint(queuedReceipt, `queued owner persisted`)
-      expect({
-        publicRows: Array.from(collection.values()).map(stripVirtualProps),
-        durableRows: Array.from(adapter.rows.values()),
-      }).toEqual({
-        publicRows: [
-          { id: `first`, title: `must survive` },
-          { id: `queued`, title: `owns queued marker` },
-        ],
-        durableRows: [
-          { id: `first`, title: `must survive` },
-          { id: `queued`, title: `owns queued marker` },
-        ],
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirstPersistence.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => firstReceipt?.catch(() => undefined),
-          () => queuedReceipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`marks the collection errored with the exact persisted startup hydration failure`, async () => {
-    const adapter = createRecordingAdapter()
-    const startupError = new Error(`startup hydration failed exactly`)
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = (...args) => {
-      if (args[1]?.includeRows === true) {
-        return Promise.reject(startupError)
-      }
-      return loadResumeSnapshot(...args)
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-mark-ready-on-startup-failure`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let hasPrimaryFailure = false
-    try {
-      await expect(collection.stateWhenReady()).rejects.toBe(startupError)
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(startupError)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      warning.mockRestore()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`reads staged metadata writes during hydration-queued transactions`, async () => {
-    const adapter = createRecordingAdapter([
-      {
-        id: `cached-1`,
-        title: `Cached row`,
-      },
-    ])
-    adapter.rowMetadata.set(`cached-1`, { source: `persisted` })
-    adapter.collectionMetadata.set(`startup:key`, { ready: true })
-
-    let resolveLoadSubset: (() => void) | undefined
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => {
-      if (args[1]?.includeRows === true) {
-        await new Promise<void>((resolve) => {
-          resolveLoadSubset = resolve
-        })
-      }
-      return loadResumeSnapshot(...args)
-    }
-
-    let remoteBegin: (() => void) | undefined
-    let remoteCommit: (() => void) | undefined
-    let remoteTruncate: (() => void) | undefined
-    let remoteMetadata:
-      Parameters<SyncConfig<Todo, string>[`sync`]>[0][`metadata`] | undefined
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-metadata-read`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, commit, truncate, markReady, metadata }) => {
-            remoteBegin = begin
-            remoteCommit = commit
-            remoteTruncate = truncate
-            remoteMetadata = metadata
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    const readyPromise = collection.stateWhenReady()
-    for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
-      await flushAsyncWork()
-    }
-
-    expect(resolveLoadSubset).toBeDefined()
-    expect(remoteBegin).toBeDefined()
-    expect(remoteMetadata).toBeDefined()
-
-    remoteBegin?.()
-    remoteMetadata?.row.set(`cached-1`, { source: `staged` })
-    remoteMetadata?.collection.set(`runtime:key`, { persisted: true })
-
-    expect(remoteMetadata?.row.get(`cached-1`)).toEqual({ source: `staged` })
-    expect(remoteMetadata?.collection.get(`runtime:key`)).toEqual({
-      persisted: true,
-    })
-    expect(remoteMetadata?.collection.list()).toContainEqual({
-      key: `runtime:key`,
-      value: { persisted: true },
-    })
-
-    remoteTruncate?.()
-
-    expect(remoteMetadata?.row.get(`cached-1`)).toBeUndefined()
-    expect(remoteMetadata?.collection.get(`startup:key`)).toEqual({
-      ready: true,
-    })
-
-    remoteCommit?.()
-    resolveLoadSubset?.()
-    await readyPromise
-  })
-
-  it(`preserves metadata only for rows supplied by the owning hydration`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `hydrated`, title: `Persisted baseline` },
-    ])
-    adapter.rowMetadata.set(`hydrated`, { source: `persisted` })
-    adapter.rowMetadata.set(`new`, { source: `orphaned` })
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    let durableMetadataMutations: Array<unknown> = []
-    adapter.applyCommittedTx = async (...args) => {
-      durableMetadataMutations = [...(args[1].rowMetadataMutations ?? [])]
-      await applyCommittedTx(...args)
-    }
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    overrideBaselineRows(adapter, async () => {
-      hydrationEntered.resolve()
-      await hydration.promise
-      return [
-        {
-          key: `hydrated`,
-          value: { id: `hydrated`, title: `Persisted baseline` },
-          metadata: { source: `persisted` },
-        },
-      ]
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydration-owned-metadata`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const ready = collection.stateWhenReady()
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `metadata hydration entered`,
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `hydrated`, title: `Source replacement` },
-      })
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `new`, title: `Genuinely new row` },
-      })
-
-      // Commit after hydration clears its runtime marker. The transaction's
-      // captured hydration ownership must still distinguish these two keys.
-      hydration.resolve()
-      await atPersistedOracleCheckpoint(ready, `metadata hydration ready`)
-      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      await atPersistedOracleCheckpoint(receipt, `metadata source receipt`)
-
-      expect({
-        publicHydrated: stripVirtualProps(collection.get(`hydrated`)),
-        publicNew: stripVirtualProps(collection.get(`new`)),
-        hydratedMetadata: adapter.rowMetadata.get(`hydrated`),
-        newMetadata: adapter.rowMetadata.get(`new`),
-        durableMetadataMutations,
-      }).toEqual({
-        publicHydrated: { id: `hydrated`, title: `Source replacement` },
-        publicNew: { id: `new`, title: `Genuinely new row` },
-        hydratedMetadata: { source: `persisted` },
-        newMetadata: undefined,
-        durableMetadataMutations: [{ type: `delete`, key: `new` }],
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => ready.catch(() => undefined),
-          () => receipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // Commit acceptance creates a source obligation. Successful subset hydration
-  // queued ahead of publication cannot revoke it. This finite grammar crosses
-  // one/two/three queued hydrations, unreserved/reserved commit turns,
-  // insert/update, and absent/present dependent successors. The two-read
-  // unreserved case
-  // reconstructs the report; one and three distinguish a misplaced threshold.
-  // Open transactions crossing hydration are excluded here and rejected below.
-  // This driver supplies adapter scheduling, not live Electric or OPFS delivery.
-  it.each(
-    ([`insert`, `update`] as const).flatMap((type) =>
-      [1, 2, 3].flatMap((hydrationCount) =>
-        [false, true].flatMap((reserveCommitTurn) =>
-          [false, true].map((hasSuccessor) => ({
-            type,
-            hydrationCount,
-            reserveCommitTurn,
-            hasSuccessor,
-          })),
-        ),
-      ),
-    ),
-  )(
-    `publishes committed source $type after $hydrationCount queued hydrations (reserveCommitTurn=$reserveCommitTurn, successor=$hasSuccessor)`,
-    async ({ type, hydrationCount, reserveCommitTurn, hasSuccessor }) => {
-      // https://github.com/TanStack/db/issues/2036
-      const adapter = createRecordingAdapter([
-        { id: `shared`, title: `persisted`, detail: `retained baseline` },
-      ])
-      adapter.rowMetadata.set(`shared`, { owner: `persisted` })
-      const persistenceEntered = createEventGate()
-      const releasePersistence = createEventGate()
-      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-      let applyCalls = 0
-      adapter.applyCommittedTx = async (...args) => {
-        if (++applyCalls === 1) {
-          persistenceEntered.resolve()
-          await releasePersistence.promise
-        }
-        await applyCommittedTx(...args)
-        for (const mutation of args[1].mutations) {
-          if (mutation.type !== `delete` && mutation.key === `shared`) {
-            durableSourceTitles.push((mutation.value as Todo).title)
-          }
-        }
-      }
-      const durableSourceTitles: Array<string> = []
-      const hydrationTitles: Array<string | undefined> = []
-      const loadSubset = adapter.loadSubset.bind(adapter)
-      adapter.loadSubset = async (...args) => {
-        hydrationTitles.push(collection.get(`shared`)?.title)
-        return loadSubset(...args)
-      }
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `committed-source-${type}-queued-behind-hydration`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const options = Array.from({ length: hydrationCount }, (_, index) => ({
-        limit: index + 1,
-      }))
-      // Model complete source obligations independently of production queues.
-      // Hydration establishes the baseline first; source patches retain detail.
-      // Fresh inserts reset metadata, while updates keep baseline ownership.
-      // Row values retain the pre-existing quiescent wrapper semantics: source
-      // inserts are upserts, and partial mode retains omitted baseline fields.
-      // Metadata reset does not imply replacement of the complete row value.
-      const sourceTitles = hasSuccessor
-        ? [`first source value`, `second source value`]
-        : [`first source value`]
-      const expected = foldDurabilityLedger(
-        sourceTitles.flatMap((title): Array<DurabilityLedgerEvent> => [
-          { type: `begin`, transactionId: title },
-          {
-            type: `write`,
-            transactionId: title,
-            row: { id: `shared`, title, detail: `retained baseline` },
-          },
-          { type: `commit`, transactionId: title },
-        ]),
-      )
-      const receipts: Array<Promise<true | void>> = []
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `gate`, title: `holds apply mutex` },
-        })
-        const gateReceipt = Promise.resolve(sourceParams.commit())
-        void gateReceipt.catch(() => undefined)
-        receipts.push(gateReceipt)
-        await atPersistedOracleCheckpoint(
-          persistenceEntered.promise,
-          `predecessor persistence entered`,
-        )
-
-        // Reserve hydrations while the predecessor holds the mutex.
-        // None has started when the source transaction begins and commits.
-        for (const option of options) {
-          const hydration = Promise.resolve(collection._sync.loadSubset(option))
-          void hydration.catch(() => undefined)
-          receipts.push(hydration)
-        }
-        await flushAsyncWork()
-        expect(adapter.loadSubsetCalls).toHaveLength(0)
-        sourceParams.begin()
-        if (reserveCommitTurn) {
-          sourceParams.metadata!.persistence!.reserveCommitTurn()
-        }
-        sourceParams.write({
-          type,
-          value: { id: `shared`, title: `first source value` },
-        })
-        sourceParams.metadata!.collection.set(`cursor`, `first`)
-        const firstReceipt = Promise.resolve(sourceParams.commit())
-        void firstReceipt.catch(() => undefined)
-        receipts.push(firstReceipt)
-
-        if (hasSuccessor) {
-          sourceParams.begin()
-          if (reserveCommitTurn) {
-            sourceParams.metadata!.persistence!.reserveCommitTurn()
-          }
-          expect(sourceParams.metadata!.collection.get(`cursor`)).toBe(`first`)
-          sourceParams.write({
-            type: `update`,
-            value: { id: `shared`, title: `second source value` },
-          })
-          sourceParams.metadata!.collection.set(`cursor`, `second`)
-          const secondReceipt = Promise.resolve(sourceParams.commit())
-          void secondReceipt.catch(() => undefined)
-          receipts.push(secondReceipt)
-        }
-        expect(collection.get(`shared`)).toBeUndefined()
-
-        releasePersistence.resolve()
-        // Observe every receipt before cleanup. allSettled preserves rejection
-        // identity alongside the wrong public/durable snapshot on main.
-        const outcomes = await atPersistedOracleCheckpoint(
-          Promise.allSettled(receipts),
-          `committed source receipts after queued hydrations`,
-        )
-        expect({
-          outcomes,
-          hydrationTitles,
-          durableSourceTitles,
-          status: collection.status,
-          publicRow: stripVirtualProps(collection.get(`shared`)),
-          durableRow: adapter.rows.get(`shared`),
-          rowMetadata: adapter.rowMetadata.get(`shared`),
-          cursor: adapter.collectionMetadata.get(`cursor`),
-          durableKeys: adapter.applyCommittedTxCalls.map(({ tx }) =>
-            tx.mutations.map(({ key }) => key),
-          ),
-        }).toEqual({
-          outcomes: receipts.map(() => ({
-            status: `fulfilled`,
-            value: undefined,
-          })),
-          hydrationTitles: options.map((_, index) =>
-            index === 0 ? undefined : `persisted`,
-          ),
-          durableSourceTitles: expected.commitOrder,
-          status: `ready`,
-          publicRow: expected.committedRows.get(`shared`),
-          durableRow: expected.committedRows.get(`shared`),
-          rowMetadata: type === `insert` ? undefined : { owner: `persisted` },
-          cursor: hasSuccessor ? `second` : `first`,
-          durableKeys: [[`gate`], ...sourceTitles.map(() => [`shared`])],
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        releasePersistence.resolve()
-        await cleanupPersistedOracle(
-          [
-            ...options.map(
-              (option) => () => collection._sync.unloadSubset(option),
-            ),
-            () => Promise.allSettled(receipts),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // A source transaction may begin during hydration and commit after that
-  // same hydration finishes (the metadata-owner test above establishes this
-  // history). Commit acceptance must survive later queued hydration. Starting
-  // during hydration captures metadata ownership; it does not require replay
-  // inside that hydration. This grammar varies the captured key membership,
-  // commit-turn reservation, and the number of later hydrations. The first
-  // scope is held after its task finishes. Without a reserved commit turn, later
-  // reads run first. The adapter capability reserveCommitTurn holds those reads
-  // behind the sync transaction, as Electric does for an overlapping stream.
-  // All receipts settle before public/durable rows and metadata are compared.
-  it.each(
-    [false, true].flatMap((ownerSuppliesRow) =>
-      [false, true].flatMap((reserveCommitTurn) =>
-        [1, 2].map((laterHydrations) => ({
-          ownerSuppliesRow,
-          reserveCommitTurn,
-          laterHydrations,
-        })),
-      ),
-    ),
-  )(
-    `publishes a source begun during hydration after $laterHydrations later hydrations (ownerSuppliesRow=$ownerSuppliesRow, reserveCommitTurn=$reserveCommitTurn)`,
-    async ({ ownerSuppliesRow, reserveCommitTurn, laterHydrations }) => {
-      const baseline = { id: `shared`, title: `persisted`, detail: `baseline` }
-      const adapter = createRecordingAdapter([baseline])
-      adapter.rowMetadata.set(`shared`, { owner: `persisted` })
-      const loadEntered = createEventGate()
-      const releaseLoad = createEventGate()
-      const firstPublished = createEventGate()
-      const releaseScope = createEventGate()
-      const loadSubset = adapter.loadSubset.bind(adapter)
-      let loads = 0
-      adapter.loadSubset = async (...args) => {
-        if (++loads === 1) {
-          loadEntered.resolve()
-          await releaseLoad.promise
-          return ownerSuppliesRow ? loadSubset(...args) : []
-        }
-        return loadSubset(...args)
-      }
-      let sourcePersistenceLoads = 0
-      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-      adapter.applyCommittedTx = async (...args) => {
-        await applyCommittedTx(...args)
-        if (args[1].mutations.some(({ key }) => key === `shared`)) {
-          sourcePersistenceLoads = loads
-        }
-      }
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `source-begun-during-hydration`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const options = Array.from(
-        { length: laterHydrations + 1 },
-        (_, index) => ({
-          limit: index + 1,
-        }),
-      )
-      const receipts: Array<Promise<true | void>> = []
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        let scopes = 0
-        adapter.runInHydrationScope = async (task) => {
-          const first = ++scopes === 1
-          const result = await task(adapter)
-          if (first) {
-            firstPublished.resolve()
-            await releaseScope.promise
-          }
-          return result
-        }
-        const first = Promise.resolve(collection._sync.loadSubset(options[0]!))
-        void first.catch(() => undefined)
-        receipts.push(first)
-        await atPersistedOracleCheckpoint(
-          loadEntered.promise,
-          `owning hydration entered`,
-        )
-        sourceParams.begin()
-        if (reserveCommitTurn) {
-          sourceParams.metadata!.persistence!.reserveCommitTurn()
-        }
-        sourceParams.write({
-          type: `insert`,
-          value: { ...baseline, title: `source` },
-        })
-        releaseLoad.resolve()
-        await atPersistedOracleCheckpoint(
-          firstPublished.promise,
-          `owning hydration published`,
-        )
-        expect(collection.get(`shared`)?.title).toBe(
-          ownerSuppliesRow ? `persisted` : undefined,
-        )
-        for (const option of options.slice(1)) {
-          const load = Promise.resolve(collection._sync.loadSubset(option))
-          void load.catch(() => undefined)
-          receipts.push(load)
-        }
-        await flushAsyncWork()
-        expect(loads).toBe(1)
-        const committed = Promise.resolve(sourceParams.commit())
-        void committed.catch(() => undefined)
-        receipts.push(committed)
-        releaseScope.resolve()
-        const outcomes = await atPersistedOracleCheckpoint(
-          Promise.allSettled(receipts),
-          `source begun during hydration settled`,
-        )
-        // Accepted source writes follow the baseline; metadata survival belongs
-        // to the rows supplied by the original owning hydration, not later loads.
-        expect({
-          outcomes,
-          loads,
-          sourcePersistenceLoads,
-          status: collection.status,
-          publicRow: stripVirtualProps(collection.get(`shared`)),
-          durableRow: adapter.rows.get(`shared`),
-          metadata: adapter.rowMetadata.get(`shared`),
-        }).toEqual({
-          outcomes: receipts.map(() => ({
-            status: `fulfilled`,
-            value: undefined,
-          })),
-          loads: laterHydrations + 1,
-          sourcePersistenceLoads: reserveCommitTurn ? 1 : laterHydrations + 1,
-          status: `ready`,
-          publicRow: { ...baseline, title: `source` },
-          durableRow: { ...baseline, title: `source` },
-          metadata: ownerSuppliesRow ? { owner: `persisted` } : undefined,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        releaseLoad.resolve()
-        releaseScope.resolve()
-        await cleanupPersistedOracle(
-          [
-            ...options.map(
-              (option) => () => collection._sync.unloadSubset(option),
-            ),
-            () => Promise.allSettled(receipts),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // An on-demand Collection has no unconstrained persisted row demand before
-  // its first subset request. A coordinator notification changes durable
-  // authority but cannot manufacture that demand. The independent model has
-  // zero or one active demand: zero requests no new rows; one unconstrained
-  // demand requests the durable snapshot. A retired demand may leave its old
-  // public row visible, so a peer full-reload notice must validate that row
-  // immediately. The notice may not add unrelated durable rows. This history
-  // checks both full-reload cuts and the later demand's public Collection and
-  // adapter-call boundaries.
-  // The reset history below applies the same demand law at a new cache epoch.
-  it(`validates visible rows on a no-demand full reload without adding stored rows`, async () => {
-    const stored = { id: `stored`, title: `Durable row` }
-    const retained = { id: `retained`, title: `Still durable` }
-    const adapter = createRecordingAdapter([stored, retained])
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `zero-demand-full-reload`
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let hasPrimaryFailure = false
-    try {
-      await collection.stateWhenReady()
-      expect(collection.has(`stored`)).toBe(false)
-      expect(adapter.loadSubsetCalls).toHaveLength(0)
-      const metadataReadsBefore = adapter.loadCollectionMetadataCalls.length
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `zero-demand-reload`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        },
-        undefined,
-        collectionId,
-      )
-      await vi.waitFor(() =>
-        expect(adapter.loadCollectionMetadataCalls).toHaveLength(
-          metadataReadsBefore + 1,
-        ),
-      )
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(adapter.loadSubsetCalls).toHaveLength(0)
-      expect(collection.has(`stored`)).toBe(false)
-
-      const demand = {}
-      await collection._sync.loadSubset(demand)
-      expect(adapter.loadSubsetCalls).toHaveLength(1)
-      expect(stripVirtualProps(collection.get(`stored`))).toEqual(stored)
-      collection._sync.unloadSubset(demand)
-
-      // A peer removes the row after demand retirement. Its full-reload notice
-      // must retract the visible row without creating a new row demand.
-      adapter.rows.delete(`stored`)
-      const metadataReadsAfterRetirement =
-        adapter.loadCollectionMetadataCalls.length
-      const validationReads = adapter.loadResumeSnapshotCalls.length
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 2,
-          txId: `retired-demand-reload`,
-          latestRowVersion: 2,
-          requiresFullReload: true,
-        },
-        undefined,
-        collectionId,
-      )
-      await vi.waitFor(() => {
-        expect(adapter.loadResumeSnapshotCalls).toHaveLength(
-          validationReads + 1,
-        )
-        expect(collection.has(`stored`)).toBe(false)
-      })
-      expect(adapter.loadCollectionMetadataCalls).toHaveLength(
-        metadataReadsAfterRetirement,
-      )
-      expect(adapter.loadSubsetCalls).toHaveLength(1)
-      expect(collection.has(`stored`)).toBe(false)
-      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
-      const newDemand = {}
-      await collection._sync.loadSubset(newDemand)
-      expect(adapter.loadSubsetCalls).toHaveLength(2)
-      expect(adapter.loadResumeSnapshotCalls).toHaveLength(validationReads + 1)
-      expect(collection.has(`stored`)).toBe(false)
-      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
-      collection._sync.unloadSubset(newDemand)
-
-      // A bounded subset proves nothing about keys outside that subset.
-      const loadSubset = adapter.loadSubset.bind(adapter)
-      adapter.loadSubset = (id, options, context) =>
-        options.limit === 0
-          ? Promise.resolve([])
-          : loadSubset(id, options, context)
-      const emptyPage = { limit: 0 }
-      await collection._sync.loadSubset(emptyPage)
-      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
-      collection._sync.unloadSubset(emptyPage)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // A reset changes the durable cache epoch, not the Collection's demand.
-  // The independent snapshot rule permits only keys already public when no
-  // subset is retained: validate them against the new durable state, and add
-  // no unrelated key. These controlled histories enter through the reset
-  // notification and compare the public snapshot after its hydration scope
-  // settles. They cover empty, changed, and deleted visible-key scopes, not
-  // native-host notification delivery.
-  it.each([`empty`, `updated`, `deleted`] as const)(
-    `keeps a no-demand reset scoped to previously visible rows (%s)`,
-    async (history) => {
-      const visible = { id: `visible`, title: `Old row` }
-      const unrelated = { id: `unrelated`, title: `Stored only` }
-      const adapter = createRecordingAdapter(
-        history === `empty` ? [unrelated] : [visible],
-      )
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `reset-visible-scope-${history}`
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      let hasPrimaryFailure = false
-      try {
-        collection.startSyncImmediate()
-        await atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `reset visible scope ready`,
-        )
-        if (history !== `empty`) {
-          const demand = {}
-          await collection._sync.loadSubset(demand)
-          collection._sync.unloadSubset(demand)
-        }
-        expect(collection.has(visible.id)).toBe(history !== `empty`)
-
-        if (history === `updated`) {
-          adapter.rows.set(visible.id, { ...visible, title: `New row` })
-        } else if (history === `deleted`) {
-          adapter.rows.delete(visible.id)
-        }
-        adapter.rows.set(unrelated.id, unrelated)
-
-        const resetSettled = createEventGate()
-        adapter.runInHydrationScope = async (task) => {
-          const result = await task(adapter)
-          resetSettled.resolve()
-          return result
-        }
-        const subsetReads = adapter.loadSubsetCalls.length
-        coordinator.emit(
-          { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
-          undefined,
-          collectionId,
-        )
-        await atPersistedOracleCheckpoint(
-          resetSettled.promise,
-          `reset visible scope published`,
-        )
-        expect({
-          publicRows: new Map(
-            Array.from(collection.values(), (row) => [
-              row.id,
-              stripVirtualProps(row),
-            ]),
-          ),
-          subsetReads: adapter.loadSubsetCalls.length,
-        }).toEqual({
-          publicRows: new Map(
-            history === `updated`
-              ? [[visible.id, { ...visible, title: `New row` }]]
-              : [],
-          ),
-          subsetReads,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // A DbClient-hydrated row is already public but has not been confirmed by
-  // the source. A complete persisted read can validate source-owned public
-  // rows, but an absent or older cache row cannot revoke the hydration seed.
-  // The independent model gives the seed precedence until a source change
-  // confirms its key. These histories cross an unconstrained demand, a
-  // no-demand peer notice, and a bounded empty-demand peer notice with absent,
-  // older, and equal durable rows. At the settled Collection checkpoint, the
-  // public row and change log must still equal the seed. The ordinary
-  // non-hydrated correction is checked above.
-  it.each(
-    (
-      [
-        `complete demand`,
-        `no-demand peer notice`,
-        `bounded peer notice`,
-      ] as const
-    ).flatMap((path) =>
-      ([`absent`, `older`, `equal`] as const).map((durable) => ({
-        path,
-        durable,
-      })),
-    ),
-  )(
-    `keeps a DbClient hydration seed across $path with $durable durable data`,
-    async ({ path, durable }) => {
-      const seed = { id: `seed`, title: `Hydrated row` }
-      const stored =
-        durable === `absent`
-          ? []
-          : [
-              {
-                id: `seed`,
-                title: durable === `equal` ? seed.title : `Old row`,
-              },
-            ]
-      const adapter = createRecordingAdapter(stored)
-      if (path === `bounded peer notice`) {
-        const loadSubset = adapter.loadSubset.bind(adapter)
-        adapter.loadSubset = async (...args) => {
-          const rows = await loadSubset(...args)
-          return args[1].limit === 0 ? [] : rows
-        }
-      }
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `hydrated-validation-${path}-${durable}`
-      const descriptor = collectionOptions(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const client = new DbClient()
-      client.hydrate({
-        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
-      })
-      const collection = client.collection(descriptor)
-      const changes: Array<string> = []
-      const subscription = collection.subscribeChanges((batch) => {
-        changes.push(...batch.map((change) => `${change.type}:${change.key}`))
-      })
-      let hasPrimaryFailure = false
-      const boundedDemand = { limit: 0 }
-      try {
-        await collection.stateWhenReady()
-        expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
-        if (path === `bounded peer notice`) {
-          await collection._sync.loadSubset(boundedDemand)
-          expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
-        }
-        if (path === `complete demand`) {
-          const demand = {}
-          await collection._sync.loadSubset(demand)
-          collection._sync.unloadSubset(demand)
-        } else {
-          const reads = adapter.loadResumeSnapshotCalls.length
-          const subsetReads = adapter.loadSubsetCalls.length
-          coordinator.emit(
-            {
-              type: `tx:committed`,
-              term: 1,
-              seq: 1,
-              txId: `hydrated-validation`,
-              latestRowVersion: 1,
-              requiresFullReload: true,
-            },
-            undefined,
-            collectionId,
-          )
-          await vi.waitFor(() => {
-            if (path === `bounded peer notice`)
-              expect(adapter.loadSubsetCalls).toHaveLength(subsetReads + 1)
-            else expect(adapter.loadResumeSnapshotCalls).toHaveLength(reads + 1)
-          })
-          await flushAsyncWork()
-          await flushAsyncWork()
-        }
-        expect({
-          publicRow: stripVirtualProps(collection.get(seed.id)),
-          changes,
-        }).toEqual({ publicRow: seed, changes: [] })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        if (path === `bounded peer notice`)
-          collection._sync.unloadSubset(boundedDemand)
-        subscription.unsubscribe()
-        await cleanupPersistedOracle(
-          [() => client.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Preserving the seed cannot make an active reload ignore other rows. The
-  // independent snapshot rule keeps the unconfirmed seed, replaces complete
-  // durable values, removes absent ordinary keys, and admits new requested
-  // keys. A second notice checks that the seed's protection survived the first
-  // publication. The row values are observed after each settled peer notice.
-  it(`preserves a hydration seed while replacing the rest of an active snapshot`, async () => {
-    const seed = { id: `seed`, title: `Hydrated` }
-    const old = { id: `ordinary`, title: `Old`, detail: `remove this field` }
-    const removed = { id: `removed`, title: `Removed` }
-    const adapter = createRecordingAdapter([old, removed])
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `mixed-hydration-replacement`
-    const descriptor = collectionOptions(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const client = new DbClient()
-    client.hydrate({
-      collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
-    })
-    const collection = client.collection(descriptor)
-    const demand = { limit: 10 }
-    let hasPrimaryFailure = false
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await collection._sync.loadSubset(demand)
-      expect(collection._hasHydratedKey(seed.id)).toBe(true)
-      const fresh = { id: `ordinary`, title: `Fresh` }
-      const added = { id: `added`, title: `New` }
-      adapter.rows.set(fresh.id, fresh)
-      adapter.rows.delete(removed.id)
-      adapter.rows.set(added.id, added)
-      const firstReads =
-        adapter.loadSubsetCalls.length + adapter.loadResumeSnapshotCalls.length
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `mixed-first`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        },
-        undefined,
-        collectionId,
-      )
-      await vi.waitFor(() =>
-        expect(
-          adapter.loadSubsetCalls.length +
-            adapter.loadResumeSnapshotCalls.length,
-        ).toBe(firstReads + 1),
-      )
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect({
-        seed: stripVirtualProps(collection.get(seed.id)),
-        ordinary: stripVirtualProps(collection.get(old.id)),
-        removed: collection.has(removed.id),
-        added: stripVirtualProps(collection.get(added.id)),
-        seedProtected: collection._hasHydratedKey(seed.id),
-      }).toEqual({
-        seed,
-        ordinary: fresh,
-        removed: false,
-        added,
-        seedProtected: true,
-      })
-
-      adapter.rows.set(seed.id, { id: seed.id, title: `Stale cache` })
-      const secondReads =
-        adapter.loadSubsetCalls.length + adapter.loadResumeSnapshotCalls.length
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 2,
-          txId: `mixed-second`,
-          latestRowVersion: 2,
-          requiresFullReload: true,
-        },
-        undefined,
-        collectionId,
-      )
-      await vi.waitFor(() =>
-        expect(
-          adapter.loadSubsetCalls.length +
-            adapter.loadResumeSnapshotCalls.length,
-        ).toBe(secondReads + 1),
-      )
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
-      expect(collection._hasHydratedKey(seed.id)).toBe(true)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      collection._sync.unloadSubset(demand)
-      await cleanupPersistedOracle([() => client.cleanup()], hasPrimaryFailure)
-    }
-  })
-
-  // A full-reload notice makes row metadata for absent public keys obsolete,
-  // even when no subset demand remains. The reference snapshot has zero orphan
-  // metadata keys; a public row's presence changes whether the wrapper reads
-  // a durable row snapshot, but not that judgment. The sync metadata API is
-  // the observable boundary at the settled notice checkpoint. A source
-  // metadata-only transaction establishes the orphan through the real path.
-  it.each([false, true])(
-    `clears orphan row metadata after a no-demand peer reload (public row=%s)`,
-    async (hasPublicRow) => {
-      const row = { id: `visible`, title: `Visible row` }
-      const adapter = createRecordingAdapter(hasPublicRow ? [row] : [])
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `zero-demand-orphan-${hasPublicRow}`
-      let source!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (value) => value.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        if (hasPublicRow) {
-          const demand = {}
-          await collection._sync.loadSubset(demand)
-          collection._sync.unloadSubset(demand)
-        }
-        expect(collection.has(row.id)).toBe(hasPublicRow)
-        source.begin()
-        source.metadata?.row.set(`ghost`, { obsolete: true })
-        await whenSyncAccepted(source.commit())
-        expect(source.metadata?.row.get(`ghost`)).toEqual({ obsolete: true })
-        expect(collection.has(row.id)).toBe(hasPublicRow)
-        expect(adapter.rows.has(row.id)).toBe(hasPublicRow)
-        const metadataReads = adapter.loadCollectionMetadataCalls.length
-        const snapshotReads = adapter.loadResumeSnapshotCalls.length
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 2,
-            txId: `orphan-peer-reload`,
-            latestRowVersion: 2,
-            requiresFullReload: true,
-          },
-          undefined,
-          collectionId,
-        )
-        await vi.waitFor(() =>
-          expect(
-            adapter.loadCollectionMetadataCalls.length +
-              adapter.loadResumeSnapshotCalls.length,
-          ).toBe(metadataReads + snapshotReads + 1),
-        )
-        await flushAsyncWork()
-        await flushAsyncWork()
-        expect({
-          orphan: source.metadata?.row.get(`ghost`),
-          publicRow: stripVirtualProps(collection.get(row.id)),
-        }).toEqual({
-          orphan: undefined,
-          publicRow: hasPublicRow ? row : undefined,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // An equal durable value and row metadata require no public change batch.
-  // This controlled history reaches the real sync metadata controls, then
-  // retires its only demand before a peer notice. The Collection event log at
-  // the settled notice checkpoint distinguishes a no-op from a redundant
-  // update; core always supplies metadata controls to this adapter.
-  it(`does not republish an unchanged metadata-bearing row after demand retirement`, async () => {
-    const row = { id: `same`, title: `Unchanged` }
-    const adapter = createRecordingAdapter([row])
-    adapter.rowMetadata.set(row.id, { owner: `durable` })
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `metadata-noop-peer`
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        syncMode: `on-demand`,
-        getKey: (value) => value.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let hasPrimaryFailure = false
-    try {
-      await collection.stateWhenReady()
-      const demand = {}
-      await collection._sync.loadSubset(demand)
-      collection._sync.unloadSubset(demand)
-      expect(source.metadata?.row.get(row.id)).toEqual({ owner: `durable` })
-      const changes: Array<string> = []
-      const subscription = collection.subscribeChanges((batch) => {
-        changes.push(...batch.map((change) => `${change.type}:${change.key}`))
-      })
-      try {
-        const reads = adapter.loadResumeSnapshotCalls.length
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `same-metadata-peer`,
-            latestRowVersion: 1,
-            requiresFullReload: true,
-          },
-          undefined,
-          collectionId,
-        )
-        await vi.waitFor(() =>
-          expect(adapter.loadResumeSnapshotCalls).toHaveLength(reads + 1),
-        )
-        await flushAsyncWork()
-        await flushAsyncWork()
-        expect({
-          row: stripVirtualProps(collection.get(row.id)),
-          metadata: source.metadata?.row.get(row.id),
-          changes,
-        }).toEqual({ row, metadata: { owner: `durable` }, changes: [] })
-      } finally {
-        subscription.unsubscribe()
-      }
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // A fresh acquisition of the same constrained demand must not keep a row
-  // that its settled storage result excludes. The peer notice arrives after
-  // demand retirement and must first correct the prior public rows without
-  // publishing unrelated durable rows.
-  // This controlled predicate has exactly one possible matching key.
-  it(`corrects retired rows on a peer notice before constrained reacquisition`, async () => {
-    const stored = { id: `stored`, title: `Durable row` }
-    const retained = { id: `retained`, title: `Old durable value` }
-    const adapter = createRecordingAdapter([stored, retained])
-    adapter.rowMetadata.set(`retained`, { source: `old` })
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    adapter.loadSubset = async (id, options, context) =>
-      (await loadSubset(id, options, context)).filter(
-        (row) => !options.where || row.key === `stored`,
-      )
-    const coordinator = createCoordinatorHarness()
-    const collectionId = `retired-constrained-demand`
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const demand = {
-      where: new IR.Func(`eq`, [
-        new IR.PropRef([`id`]),
-        new IR.Value(`stored`),
-      ]),
-    }
-    let hasPrimaryFailure = false
-    try {
-      await collection.stateWhenReady()
-      const originalDemand = {}
-      await collection._sync.loadSubset(originalDemand)
-      expect(stripVirtualProps(collection.get(`stored`))).toEqual(stored)
-      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
-      expect(source.metadata!.row.get(`retained`)).toEqual({ source: `old` })
-      collection._sync.unloadSubset(originalDemand)
-
-      adapter.rows.delete(`stored`)
-      adapter.rowMetadata.delete(`retained`)
-      adapter.rows.set(`retained`, {
-        id: `retained`,
-        title: `New durable value`,
-      })
-      adapter.rows.set(`unrequested`, {
-        id: `unrequested`,
-        title: `Not in the filtered demand`,
-      })
-      const metadataReads = adapter.loadCollectionMetadataCalls.length
-      const validationReads = adapter.loadResumeSnapshotCalls.length
-      coordinator.emit(
-        {
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `constrained-peer-delete`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        },
-        undefined,
-        collectionId,
-      )
-      await vi.waitFor(() => {
-        expect(adapter.loadResumeSnapshotCalls).toHaveLength(
-          validationReads + 1,
-        )
-        expect(collection.has(`stored`)).toBe(false)
-      })
-      expect(adapter.loadCollectionMetadataCalls).toHaveLength(metadataReads)
-      expect(adapter.loadSubsetCalls).toHaveLength(1)
-      expect(collection.has(`stored`)).toBe(false)
-      expect(collection.get(`retained`)?.title).toBe(`New durable value`)
-      expect(source.metadata!.row.get(`retained`)).toBeUndefined()
-      expect(collection.has(`unrequested`)).toBe(false)
-      await collection._sync.loadSubset(demand)
-      expect(adapter.loadSubsetCalls).toHaveLength(2)
-      expect(adapter.loadResumeSnapshotCalls).toHaveLength(validationReads + 1)
-      expect(collection.has(`stored`)).toBe(false)
-      expect(collection.get(`retained`)?.title).toBe(`New durable value`)
-      expect(collection.has(`unrequested`)).toBe(false)
-      collection._sync.unloadSubset(demand)
-
-      await collection._sync.loadSubset(demand)
-      expect(adapter.loadResumeSnapshotCalls).toHaveLength(validationReads + 1)
-      collection._sync.unloadSubset(demand)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  // Law: a complete persisted value replaces the old value in every field,
-  // including field absence. This follows the durable snapshot contract and
-  // the chosen demand-scoped notice/reset contract above. The model at the top
-  // of this file selects keys using demand and seed authority, then takes the
-  // authored durable value whole. The legal grammar crosses complete demand,
-  // retired-demand peer notice, and retired-demand reset with field removal,
-  // addition, present-undefined transitions in a custom adapter, and scalar
-  // replacement. Field-only changes keep title unchanged to reject a
-  // comparator that watches title alone. The Collection and coordinator are
-  // the driver; whole public rows at the settled publication checkpoint are
-  // the observation. The old title-only checks could not see a retained field.
-  // The removal arm reconstructs that counterexample. Removing it would lose
-  // the stale-field witness; removing a route would lose its distinct admission
-  // path. Addition and scalar change are neighboring controls, not a claim
-  // about arbitrary nested values. Keys agree with row IDs and the fixture has
-  // no accepted source transaction; a mismatched key or source-owned ordinary
-  // row is outside this grammar and has a separate owner below.
-  // Built-in SQLite drops undefined object fields during encoding, so those
-  // two arms exercise the generic adapter boundary only; removal of a defined
-  // field is the receiving SQLite-representable case.
-  it.each(
-    (
-      [`complete demand`, `retired peer notice`, `retired reset`] as const
-    ).flatMap((route) =>
-      (
-        [
-          `remove`,
-          `remove with metadata`,
-          `add`,
-          `remove undefined`,
-          `add undefined`,
-          `scalar`,
-        ] as const
-      ).map((shape) => ({
-        route,
-        shape,
-      })),
-    ),
-  )(
-    `publishes exact durable row shape within $route ($shape)`,
-    async ({ route, shape }) => {
-      const ordinary: Todo =
-        shape === `add undefined`
-          ? { id: `ordinary`, title: `Old` }
-          : shape === `remove undefined`
-            ? { id: `ordinary`, title: `Old`, detail: undefined }
-            : { id: `ordinary`, title: `Old`, detail: `obsolete` }
-      const removed = { id: `removed`, title: `Old` }
-      const seed = { id: `seed`, title: `Hydrated`, detail: `source-owned` }
-      const unseen = { id: `unseen`, title: `Only in storage` }
-      const fresh: Todo =
-        shape === `remove` ||
-        shape === `remove with metadata` ||
-        shape === `remove undefined`
-          ? { id: ordinary.id, title: ordinary.title }
-          : shape === `add`
-            ? { ...ordinary, payload: { rank: 1 } }
-            : shape === `add undefined`
-              ? { ...ordinary, detail: undefined }
-              : { ...ordinary, title: `Fresh` }
-      const expectedFresh = structuredClone(fresh)
-      const before = new Map<string, Todo>([
-        [ordinary.id, structuredClone(ordinary)],
-        [removed.id, structuredClone(removed)],
-        [seed.id, structuredClone(seed)],
-      ])
-      const after = new Map<string, Todo>([
-        [fresh.id, fresh],
-        [unseen.id, unseen],
-        [seed.id, { id: seed.id, title: `Older durable seed` }],
-      ])
-      const adapter = createRecordingAdapter([ordinary, removed])
-      if (shape === `remove with metadata`)
-        adapter.rowMetadata.set(ordinary.id, { source: `durable` })
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `exact-shape-${route}-${shape}`
-      let source!: TodoSyncParams
-      const descriptor = collectionOptions(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const client = new DbClient()
-      client.hydrate({
-        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
-      })
-      const collection = client.collection(descriptor)
-      const firstDemand = { limit: 10 }
-      const publishedOrdinaryValues: Array<Todo> = []
-      const publishedChanges: Array<string> = []
-      const publishedSnapshots: Array<Map<string, Todo>> = []
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        collection.startSyncImmediate()
-        await collection.stateWhenReady()
-        await collection._sync.loadSubset(firstDemand)
-        expectExactSnapshot(publicRows(), before)
-        if (route !== `complete demand`)
-          collection._sync.unloadSubset(firstDemand)
-        // An initial-state subscription would itself acquire subset demand.
-        // Observe subsequent changes without changing this route's demand.
-        subscription = collection.subscribeChanges(
-          (batch) => {
-            publishedSnapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            publishedChanges.push(
-              ...batch.map((change) => `${change.type}:${change.key}`),
-            )
-            for (const change of batch) {
-              if (change.key === ordinary.id && change.type !== `delete`) {
-                publishedOrdinaryValues.push(
-                  structuredClone(stripVirtualProps(change.value)),
-                )
-              }
-            }
-          },
-          { includeInitialState: false },
-        )
-        const subsetReadsBeforeRevision = adapter.loadSubsetCalls.length
-
-        adapter.rows.clear()
-        for (const [key, row] of after) adapter.rows.set(key, row)
-        // The peer/reset signal and its subsequent durable read describe one
-        // coherent generation. Direct fixture row edits do not advance the
-        // recording adapter's transaction ledger, so supply that position here.
-        const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-        adapter.loadResumeSnapshot = async (...args) => ({
-          ...(await loadResumeSnapshot(...args)),
-          latestTerm: route === `retired peer notice` ? 1 : 0,
-          latestSeq: route === `retired peer notice` ? 1 : 0,
-          latestRowVersion: route === `retired peer notice` ? 1 : 0,
-          resetEpoch: route === `retired reset` ? 1 : 0,
-        })
-        const expected = expectedScopedSnapshot(
-          before,
-          after,
-          new Map([[seed.id, before.get(seed.id)!]]),
-          route === `complete demand`,
-        )
-        const published = createEventGate()
-        const runInHydrationScope = adapter.runInHydrationScope?.bind(adapter)
-        adapter.runInHydrationScope = async (task) => {
-          const result = await (runInHydrationScope?.(task) ?? task(adapter))
-          published.resolve()
-          return result
-        }
-        if (route === `complete demand`) {
-          const completeDemand = {}
-          await collection._sync.loadSubset(completeDemand)
-          collection._sync.unloadSubset(completeDemand)
-        } else if (route === `retired peer notice`) {
-          coordinator.emit(
-            {
-              type: `tx:committed`,
-              term: 1,
-              seq: 1,
-              txId: `exact-shape`,
-              latestRowVersion: 1,
-              requiresFullReload: true,
-            },
-            undefined,
-            collectionId,
-          )
-          await atPersistedOracleCheckpoint(
-            published.promise,
-            `exact-shape peer notice published`,
-          )
-        } else {
-          coordinator.emit(
-            { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
-            undefined,
-            collectionId,
-          )
-          await atPersistedOracleCheckpoint(
-            published.promise,
-            `exact-shape reset published`,
-          )
-        }
-        expectExactSnapshot(publicRows(), expected)
-        expect(publishedSnapshots).toHaveLength(1)
-        for (const snapshot of publishedSnapshots)
-          expectExactSnapshot(snapshot, expected)
-        if (shape === `remove with metadata`)
-          expect(source.metadata?.row.get(ordinary.id)).toStrictEqual({
-            source: `durable`,
-          })
-        expect(adapter.loadSubsetCalls).toHaveLength(
-          subsetReadsBeforeRevision + (route === `complete demand` ? 1 : 0),
-        )
-        expect(publishedOrdinaryValues.length).toBeGreaterThan(0)
-        for (const row of publishedOrdinaryValues)
-          expect(row).toStrictEqual(expectedFresh)
-        expect(publishedChanges).toContain(`delete:removed`)
-        expect(
-          publishedChanges.some((change) => change.endsWith(`:seed`)),
-        ).toBe(false)
-        if (route === `complete demand`)
-          expect(publishedChanges).toContain(`insert:unseen`)
-        else
-          expect(
-            publishedChanges.some((change) => change.endsWith(`:unseen`)),
-          ).toBe(false)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        if (route === `complete demand`)
-          collection._sync.unloadSubset(firstDemand)
-        await cleanupPersistedOracle(
-          [() => client.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Law: a small peer delta must lead to the same demand-scoped public rows as
-  // the committed durable relation. The wire value is a partial source patch,
-  // so its omitted predicate and payload fields are not evidence of absence.
-  // A retired demand validates previously public keys but admits no new key.
-  // The model above chooses from authored full durable rows; the recording
-  // adapter applies the patch before the notice and is checked against that
-  // authored state. The driver then delivers the real targeted-notice entry
-  // point. A change callback establishes the publication checkpoint, and the
-  // comparison checks exact public keys and row fields. `stay` omits the
-  // predicate field, `enter` omits an existing payload field, and `leave`
-  // changes the predicate; each has a neighboring route with no active demand.
-  // These controlled notices do not prove native SQLite sender or host delivery.
-  it.each(
-    ([`active filter`, `retired demand`] as const).flatMap((route) =>
-      ([`stay`, `enter`, `leave`] as const).map((transition) => ({
-        route,
-        transition,
-      })),
-    ),
-  )(
-    `publishes the durable result of a targeted partial $transition with $route`,
-    async ({ route, transition }) => {
-      const old: Todo = {
-        id: `ordinary`,
-        title: transition === `enter` ? `Other` : `Keep`,
-        detail: `retained field`,
-      }
-      const patch: Partial<Todo> & Pick<Todo, `id`> =
-        transition === `stay`
-          ? { id: old.id, detail: `new detail` }
-          : { id: old.id, title: transition === `enter` ? `Keep` : `Other` }
-      const durable: Todo = {
-        ...old,
-        ...patch,
-      }
-      const unseen: Todo = { id: `unseen`, title: `Keep` }
-      const adapter = createRecordingAdapter([old])
-      const originalLoad = adapter.loadSubset.bind(adapter)
-      adapter.loadSubset = async (id, options, context) =>
-        (await originalLoad(id, options, context)).filter(
-          (row) => !options.where || row.value.title === `Keep`,
-        )
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `targeted-partial-${route}-${transition}`
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const demand =
-        route === `active filter`
-          ? {
-              where: new IR.Func(`eq`, [
-                new IR.PropRef([`title`]),
-                new IR.Value(`Keep`),
-              ]),
-            }
-          : {}
-      const published = createEventGate()
-      const publishedSnapshots: Array<Map<string, Todo>> = []
-      const publishedOrdinaryValues: Array<Todo> = []
-      const publishedChanges: Array<string> = []
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        await collection._sync.loadSubset(demand)
-        const before = new Map(
-          Array.from(publicRows(), ([key, row]) => [key, structuredClone(row)]),
-        )
-        expectExactSnapshot(
-          before,
-          new Map(
-            route === `active filter` && transition === `enter`
-              ? []
-              : [[old.id, old]],
-          ),
-        )
-        if (route === `retired demand`) collection._sync.unloadSubset(demand)
-        subscription = collection.subscribeChanges(
-          (batch) => {
-            publishedSnapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            publishedChanges.push(
-              ...batch.map((change) => `${change.type}:${change.key}`),
-            )
-            for (const change of batch) {
-              if (change.key === old.id && change.type !== `delete`)
-                publishedOrdinaryValues.push(
-                  structuredClone(stripVirtualProps(change.value)),
-                )
-            }
-            published.resolve()
-          },
-          { includeInitialState: false },
-        )
-        const mutations: PersistedTx[`mutations`] = [
-          { type: `update`, key: old.id, value: patch },
-          ...(route === `retired demand`
-            ? [{ type: `insert` as const, key: unseen.id, value: unseen }]
-            : []),
-        ]
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId },
-          {
-            txId: `targeted-partial`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations,
-          },
-        )
-        const authoredDurable = new Map<string, Todo>([
-          [old.id, durable],
-          ...(route === `retired demand`
-            ? ([[unseen.id, unseen]] as Array<[string, Todo]>)
-            : []),
-        ])
-        expectExactSnapshot(adapter.rows, authoredDurable)
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `targeted-partial`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows: [
-              { key: old.id, value: patch },
-              ...(route === `retired demand`
-                ? [{ key: unseen.id, value: unseen }]
-                : []),
-            ],
-            deletedKeys: [],
-          },
-          undefined,
-          collectionId,
-        )
-        await atPersistedOracleCheckpoint(
-          published.promise,
-          `targeted partial notice published`,
-        )
-        await flushAsyncWork()
-        const expected = expectedTargetedSnapshot(
-          before,
-          authoredDurable,
-          route === `active filter` ? `Keep` : undefined,
-        )
-        expectExactSnapshot(publicRows(), expected)
-        expect(publishedSnapshots).toHaveLength(1)
-        for (const snapshot of publishedSnapshots)
-          expectExactSnapshot(snapshot, expected)
-        if (expected.has(old.id)) {
-          expect(publishedOrdinaryValues).toHaveLength(1)
-          expect(publishedOrdinaryValues[0]).toStrictEqual(durable)
-        } else {
-          expect(publishedChanges).toContain(`delete:${old.id}`)
-        }
-        if (route === `retired demand`)
-          expect(
-            publishedChanges.some((change) => change.endsWith(`:unseen`)),
-          ).toBe(false)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        if (route === `active filter`) collection._sync.unloadSubset(demand)
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Active demands form a union, not a first-match or last-match choice. A
-  // targeted row can leave title=Keep while entering title=Other. Both
-  // constrained demands remain active. The two acquisition orders reject
-  // first-match and last-match shortcuts; a complete-demand shortcut cannot
-  // pass either case. The adapter branches on the authored demand identity
-  // only to supply controlled provider rows. The independent expectation is
-  // the durable row admitted by title=Other. The callback and next task-turn
-  // Collection snapshots must both contain the full row.
-  it.each([`Keep first`, `Other first`] as const)(
-    `keeps a targeted row requested by either active subset (%s)`,
-    async (route) => {
-      const old = { id: `ordinary`, title: `Keep`, detail: `retained` }
-      const patch = { id: old.id, title: `Other` }
-      const durable = { ...old, ...patch }
-      const keepDemand = {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`title`]),
-          new IR.Value(`Keep`),
-        ]),
-      }
-      const otherDemand = {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`title`]),
-          new IR.Value(`Other`),
-        ]),
-      }
-      const adapter = createRecordingAdapter([old])
-      const originalLoad = adapter.loadSubset.bind(adapter)
-      adapter.loadSubset = async (id, options, context) => {
-        const title =
-          options.where === keepDemand.where
-            ? `Keep`
-            : options.where === otherDemand.where
-              ? `Other`
-              : undefined
-        expect(title).toBeDefined()
-        return (await originalLoad(id, options, context)).filter(
-          (row) => row.value.title === title,
-        )
-      }
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `targeted-union-${route}`
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const demands =
-        route === `Keep first`
-          ? [keepDemand, otherDemand]
-          : [otherDemand, keepDemand]
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      const published = createEventGate()
-      const snapshots: Array<Map<string, Todo>> = []
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        for (const demand of demands) await collection._sync.loadSubset(demand)
-        expectExactSnapshot(publicRows(), new Map([[old.id, old]]))
-        subscription = collection.subscribeChanges(
-          () => {
-            snapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            published.resolve()
-          },
-          { includeInitialState: false },
-        )
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId },
-          {
-            txId: `targeted-union`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [{ type: `update`, key: old.id, value: patch }],
-          },
-        )
-        expectExactSnapshot(adapter.rows, new Map([[old.id, durable]]))
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `targeted-union`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows: [{ key: old.id, value: patch }],
-            deletedKeys: [],
-          },
-          undefined,
-          collectionId,
-        )
-        await atPersistedOracleCheckpoint(
-          published.promise,
-          `targeted union notice published`,
-        )
-        await flushAsyncWork()
-        const expected = new Map([[old.id, durable]])
-        expectExactSnapshot(publicRows(), expected)
-        expect(snapshots).toHaveLength(1)
-        for (const snapshot of snapshots)
-          expectExactSnapshot(snapshot, expected)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        for (const demand of demands) collection._sync.unloadSubset(demand)
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // A filtered acquisition proves only its predicate. Retiring an earlier
-  // broad demand does not itself delete the rows it exposed. When a new
-  // title=Keep demand is active, its persisted read of B says nothing about
-  // previously public A outside that predicate. The independent model keeps
-  // A unless durable evidence changes or deletes it, and applies the complete
-  // durable B value. The same authored durable state and demands cross targeted
-  // full-reload, and reset peer notices; their public snapshots must agree after
-  // publication. Updated and deleted A reject a repair that merely preserves
-  // an obsolete out-of-filter row. A DbClient seed stays source-owned across
-  // every peer route, whether the durable snapshot lacks it or holds an older
-  // value. The reset route must preserve it without an empty publication.
-  it.each(
-    ([`targeted`, `full reload`, `reset`] as const).flatMap((notice) =>
-      ([`unchanged`, `updated`, `deleted`] as const).flatMap((outsideChange) =>
-        ([`absent`, `older`] as const).map((seedCache) => ({
-          notice,
-          outsideChange,
-          seedCache,
-        })),
-      ),
-    ),
-  )(
-    `validates a previously public $outsideChange row and an $seedCache seed after a $notice notice`,
-    async ({ notice, outsideChange, seedCache }) => {
-      const outside = { id: `outside`, title: `Other` }
-      const outsideUpdated = { ...outside, title: `Other now` }
-      const inside = { id: `inside`, title: `Keep`, detail: `old` }
-      const insideUpdated = { ...inside, detail: `new` }
-      const seed = { id: `seed`, title: `Keep`, detail: `source-owned` }
-      const storedSeed = { id: seed.id, title: `Other`, detail: `older` }
-      const adapter = createRecordingAdapter([
-        outside,
-        inside,
-        ...(seedCache === `older` ? [storedSeed] : []),
-      ])
-      const loadSubset = adapter.loadSubset.bind(adapter)
-      adapter.loadSubset = async (id, options, context) =>
-        (await loadSubset(id, options, context)).filter(
-          (row) => !options.where || row.value.title === `Keep`,
-        )
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `mixed-demand-notice-${notice}-${outsideChange}-${seedCache}`
-      const descriptor = collectionOptions(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const client = new DbClient()
-      client.hydrate({
-        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
-      })
-      const collection = client.collection(descriptor)
-      const broadDemand = {}
-      const filteredDemand = {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`title`]),
-          new IR.Value(`Keep`),
-        ]),
-      }
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      const before = new Map<string, Todo>([
-        [outside.id, outside],
-        [inside.id, inside],
-        [seed.id, seed],
-      ])
-      const durableExpected = new Map<string, Todo>([
-        ...(outsideChange === `deleted`
-          ? []
-          : [
-              [
-                outside.id,
-                outsideChange === `updated` ? outsideUpdated : outside,
-              ] as [string, Todo],
-            ]),
-        [insideUpdated.id, insideUpdated],
-        ...(seedCache === `older`
-          ? ([[storedSeed.id, storedSeed]] as Array<[string, Todo]>)
-          : []),
-      ])
-      const expected = new Map([...durableExpected, [seed.id, seed] as const])
-      const published = createEventGate()
-      const snapshots: Array<Map<string, Todo>> = []
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        collection.startSyncImmediate()
-        await collection.stateWhenReady()
-        await collection._sync.loadSubset(broadDemand)
-        expectExactSnapshot(publicRows(), before)
-        collection._sync.unloadSubset(broadDemand)
-        await collection._sync.loadSubset(filteredDemand)
-        expectExactSnapshot(publicRows(), before)
-        subscription = collection.subscribeChanges(
-          () => {
-            snapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            published.resolve()
-          },
-          { includeInitialState: false },
-        )
-        const mutations: PersistedTx[`mutations`] = [
-          {
-            type: `update`,
-            key: insideUpdated.id,
-            value: { id: insideUpdated.id, detail: `new` },
-          },
-          ...(outsideChange === `updated`
-            ? ([
-                {
-                  type: `update`,
-                  key: outside.id,
-                  value: { id: outside.id, title: outsideUpdated.title },
-                },
-              ] as PersistedTx[`mutations`])
-            : outsideChange === `deleted`
-              ? ([
-                  { type: `delete`, key: outside.id, value: outside },
-                ] as PersistedTx[`mutations`])
-              : []),
-        ]
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId },
-          {
-            txId: `mixed-demand-notice`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            truncate: notice === `reset`,
-            mutations:
-              notice === `reset`
-                ? Array.from(durableExpected, ([key, value]) => ({
-                    type: `insert` as const,
-                    key,
-                    value,
-                  }))
-                : mutations,
-          },
-        )
-        expectExactSnapshot(adapter.rows, durableExpected)
-        const envelope: TxCommitted | CollectionReset =
-          notice === `reset`
-            ? { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 }
-            : notice === `full reload`
-              ? {
-                  type: `tx:committed`,
-                  term: 1,
-                  seq: 1,
-                  txId: `mixed-demand-notice`,
-                  latestRowVersion: 1,
-                  requiresFullReload: true,
-                }
-              : {
-                  type: `tx:committed`,
-                  term: 1,
-                  seq: 1,
-                  txId: `mixed-demand-notice`,
-                  latestRowVersion: 1,
-                  requiresFullReload: false,
-                  changedRows: mutations
-                    .filter((mutation) => mutation.type !== `delete`)
-                    .map((mutation) => ({
-                      key: mutation.key,
-                      value: mutation.value,
-                    })),
-                  deletedKeys: outsideChange === `deleted` ? [outside.id] : [],
-                }
-        coordinator.emit(envelope, undefined, collectionId)
-        await atPersistedOracleCheckpoint(
-          published.promise,
-          `mixed-demand peer publication`,
-        )
-        await flushAsyncWork()
-        expect(snapshots).toHaveLength(1)
-        for (const snapshot of snapshots)
-          expectExactSnapshot(snapshot, expected)
-        expectExactSnapshot(publicRows(), expected)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        collection._sync.unloadSubset(filteredDemand)
-        await cleanupPersistedOracle(
-          [() => client.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // The same targeted path must respect DbClient hydration authority. A seed
-  // key may also exist in older durable storage. Active complete and filtered
-  // demand, and retired demand, cannot let a peer delta replace that
-  // source-owned value. The filtered case makes the durable row leave the
-  // predicate while the hydrated seed still matches it. The ordinary row
-  // beside it proves the notice was processed, so a
-  // subject that simply drops all targeted messages cannot pass. The model is
-  // the authored durable snapshot with the protected seed overlaid; public
-  // rows and change keys are checked after the targeted commit publishes.
-  it.each(
-    ([`active demand`, `active filter`, `retired demand`] as const).flatMap(
-      (route) =>
-        ([`replacement`, `partial update`, `deletion`] as const).flatMap(
-          (mutation) =>
-            ([`set`, `delete`] as const).map((metadataAction) => ({
-              route,
-              mutation,
-              metadataAction,
-            })),
-        ),
-    ),
-  )(
-    `preserves a hydrated seed and metadata during a targeted $mutation with $route ($metadataAction)`,
-    async ({ route, mutation, metadataAction }) => {
-      const ordinary =
-        route === `active filter`
-          ? { id: `ordinary`, title: `Keep`, detail: `old` }
-          : { id: `ordinary`, title: `Old durable` }
-      const ordinaryPatch =
-        route === `active filter`
-          ? { id: ordinary.id, detail: `fresh` }
-          : { id: ordinary.id, title: `Fresh durable` }
-      const durableOrdinary = { ...ordinary, ...ordinaryPatch }
-      const seed = {
-        id: `seed`,
-        title: route === `active filter` ? `Keep` : `Hydrated seed`,
-        detail: `source-owned`,
-      }
-      const storedSeed = {
-        id: `seed`,
-        title: route === `active filter` ? `Keep` : `Older durable seed`,
-        detail: `older`,
-      }
-      const seedMutation: PersistedTx[`mutations`][number] =
-        mutation === `deletion`
-          ? { type: `delete`, key: seed.id, value: storedSeed }
-          : mutation === `partial update`
-            ? {
-                type: `update`,
-                key: seed.id,
-                value:
-                  route === `active filter`
-                    ? { id: seed.id, title: `Other` }
-                    : { id: seed.id, detail: `still older` },
-              }
-            : {
-                type: `update`,
-                key: seed.id,
-                value: {
-                  id: seed.id,
-                  title:
-                    route === `active filter` ? `Other` : `Still older durable`,
-                  detail: `older`,
-                },
-              }
-      const durableSeed: Todo | undefined =
-        mutation === `deletion`
-          ? undefined
-          : mutation === `partial update`
-            ? route === `active filter`
-              ? { ...storedSeed, title: `Other` }
-              : { ...storedSeed, detail: `still older` }
-            : {
-                ...storedSeed,
-                title:
-                  route === `active filter` ? `Other` : `Still older durable`,
-              }
-      const adapter = createRecordingAdapter([ordinary, storedSeed])
-      adapter.rowMetadata.set(seed.id, { owner: `older durable` })
-      if (route === `active filter`) {
-        const originalLoad = adapter.loadSubset.bind(adapter)
-        adapter.loadSubset = async (id, options, context) =>
-          (await originalLoad(id, options, context)).filter(
-            (row) => !options.where || row.value.title === `Keep`,
-          )
-      }
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `targeted-seed-${route}`
-      let sourceParams!: TodoSyncParams
-      const descriptor = collectionOptions(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const client = new DbClient()
-      const seedMetadata = { owner: `hydrated source` }
-      client.hydrate({
-        collections: [
-          {
-            collectionId,
-            rows: [{ key: seed.id, value: seed, metadata: seedMetadata }],
-          },
-        ],
-      })
-      const collection = client.collection(descriptor)
-      const demand =
-        route === `active filter`
-          ? {
-              where: new IR.Func(`eq`, [
-                new IR.PropRef([`title`]),
-                new IR.Value(`Keep`),
-              ]),
-            }
-          : {}
-      const published = createEventGate()
-      const publishedKeys: Array<string> = []
-      const publishedOrdinaryValues: Array<Todo> = []
-      const publishedSnapshots: Array<Map<string, Todo>> = []
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        collection.startSyncImmediate()
-        await collection.stateWhenReady()
-        await collection._sync.loadSubset(demand)
-        const before = new Map<string, Todo>([
-          [ordinary.id, ordinary],
-          [seed.id, seed],
-        ])
-        expectExactSnapshot(publicRows(), before)
-        expect(sourceParams.metadata?.row.get(seed.id)).toEqual(seedMetadata)
-        if (route === `retired demand`) collection._sync.unloadSubset(demand)
-        subscription = collection.subscribeChanges(
-          (batch) => {
-            publishedSnapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            publishedKeys.push(...batch.map((change) => String(change.key)))
-            for (const change of batch) {
-              if (change.key === ordinary.id && change.type !== `delete`)
-                publishedOrdinaryValues.push(
-                  structuredClone(stripVirtualProps(change.value)),
-                )
-            }
-            published.resolve()
-          },
-          { includeInitialState: false },
-        )
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId },
-          {
-            txId: `targeted-seed`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [
-              {
-                type: `update`,
-                key: ordinary.id,
-                value: ordinaryPatch,
-              },
-              seedMutation,
-            ],
-            rowMetadataMutations: [
-              metadataAction === `set`
-                ? {
-                    type: `set`,
-                    key: seed.id,
-                    value: { owner: `peer durable` },
-                  }
-                : { type: `delete`, key: seed.id },
-            ],
-          },
-        )
-        const authoredDurable = new Map<string, Todo>([
-          [ordinary.id, durableOrdinary],
-          ...(durableSeed
-            ? ([[seed.id, durableSeed]] as Array<[string, Todo]>)
-            : []),
-        ])
-        expectExactSnapshot(adapter.rows, authoredDurable)
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `targeted-seed`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows: [
-              { key: ordinary.id, value: ordinaryPatch },
-              ...(seedMutation.type === `delete`
-                ? []
-                : [{ key: seed.id, value: seedMutation.value }]),
-            ],
-            deletedKeys: seedMutation.type === `delete` ? [seed.id] : [],
-            rowMetadataMutations: [
-              metadataAction === `set`
-                ? {
-                    type: `set`,
-                    key: seed.id,
-                    value: { owner: `peer durable` },
-                  }
-                : { type: `delete`, key: seed.id },
-            ],
-          },
-          undefined,
-          collectionId,
-        )
-        await atPersistedOracleCheckpoint(
-          published.promise,
-          `targeted seed notice published`,
-        )
-        await flushAsyncWork()
-        const expected =
-          route === `active filter`
-            ? new Map([
-                ...expectedTargetedSnapshot(before, authoredDurable, `Keep`),
-                [seed.id, seed] as const,
-              ])
-            : expectedScopedSnapshot(
-                before,
-                authoredDurable,
-                new Map([[seed.id, seed]]),
-                route === `active demand`,
-              )
-        expectExactSnapshot(publicRows(), expected)
-        expect(sourceParams.metadata?.row.get(seed.id)).toEqual(seedMetadata)
-        expect(publishedSnapshots).toHaveLength(1)
-        for (const snapshot of publishedSnapshots)
-          expectExactSnapshot(snapshot, expected)
-        expect(publishedOrdinaryValues).toEqual([durableOrdinary])
-        expect(publishedKeys).toContain(ordinary.id)
-        expect(publishedKeys).not.toContain(seed.id)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        if (route !== `retired demand`) collection._sync.unloadSubset(demand)
-        await cleanupPersistedOracle(
-          [() => client.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Hydration authority is temporary. A DbClient seed wins over durable data
-  // only until an accepted source transaction confirms that key. After its
-  // applied receipt, a later peer transaction has ordinary durable authority.
-  // The model is the source-confirmed row or absence followed by the peer's
-  // complete durable result. A source insert or update permits a later peer
-  // update or delete; a source delete permits a later peer insert. Targeted and full-reload
-  // notices use different production paths, but both must publish the same
-  // public result at their settled change callback and afterward. An ordinary
-  // sibling changes in every notice, so perpetual seed protection reaches the
-  // exact-row comparison rather than only timing out waiting for a callback.
-  // This is the neighboring witness to the protected-seed histories above: an
-  // implementation that protects every hydrated key forever fails here.
-  it.each(
-    ([`targeted`, `full reload`] as const).flatMap((notice) => [
-      { notice, confirmation: `update` as const, change: `update` as const },
-      { notice, confirmation: `update` as const, change: `delete` as const },
-      { notice, confirmation: `insert` as const, change: `update` as const },
-      { notice, confirmation: `insert` as const, change: `delete` as const },
-      { notice, confirmation: `delete` as const, change: `insert` as const },
-    ]),
-  )(
-    `ends hydration protection after source $confirmation before a $notice peer $change`,
-    async ({ notice, confirmation, change }) => {
-      const seed = { id: `seed`, title: `Hydrated`, detail: `seed field` }
-      const confirmed = { id: seed.id, title: `Source`, detail: `source field` }
-      const peer = { id: seed.id, title: `Peer`, detail: `peer field` }
-      const ordinary = { id: `ordinary`, title: `Old ordinary` }
-      const ordinaryPeer = { id: ordinary.id, title: `New ordinary` }
-      const adapter = createRecordingAdapter([ordinary])
-      const coordinator = createCoordinatorHarness()
-      coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
-        await adapter.applyCommittedTx({ kind: `eager`, collectionId }, tx)
-        return {
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }
-      }
-      const collectionId = `confirmed-seed-${confirmation}-${notice}-${change}`
-      let source!: TodoSyncParams
-      const descriptor = collectionOptions(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const client = new DbClient()
-      client.hydrate({
-        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
-      })
-      const collection = client.collection(descriptor)
-      const demand = {}
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      const published = createEventGate()
-      const snapshots: Array<Map<string, Todo>> = []
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        collection.startSyncImmediate()
-        await collection.stateWhenReady()
-        await collection._sync.loadSubset(demand)
-        expectExactSnapshot(
-          publicRows(),
-          new Map([
-            [seed.id, seed],
-            [ordinary.id, ordinary],
-          ]),
-        )
-
-        source.begin()
-        source.write(
-          confirmation === `delete`
-            ? { type: `delete`, key: seed.id }
-            : { type: confirmation, value: confirmed },
-        )
-        await source.commit()
-        const confirmedRows = new Map<string, Todo>([
-          ...(confirmation === `delete`
-            ? []
-            : ([[seed.id, confirmed]] as Array<[string, Todo]>)),
-          [ordinary.id, ordinary],
-        ])
-        expectExactSnapshot(publicRows(), confirmedRows)
-        expectExactSnapshot(adapter.rows, confirmedRows)
-
-        subscription = collection.subscribeChanges(
-          () => {
-            snapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            published.resolve()
-          },
-          { includeInitialState: false },
-        )
-        const mutations: PersistedTx[`mutations`] = [
-          { type: `update`, key: ordinary.id, value: ordinaryPeer },
-          change === `delete`
-            ? { type: `delete`, key: seed.id, value: confirmed }
-            : { type: change, key: seed.id, value: peer },
-        ]
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId },
-          {
-            txId: `confirmed-seed-peer`,
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            mutations,
-          },
-        )
-        const expected = new Map<string, Todo>(
-          change !== `delete`
-            ? [
-                [seed.id, peer],
-                [ordinary.id, ordinaryPeer],
-              ]
-            : [[ordinary.id, ordinaryPeer]],
-        )
-        expectExactSnapshot(adapter.rows, expected)
-        const envelope: TxCommitted =
-          notice === `full reload`
-            ? {
-                type: `tx:committed`,
-                term: 1,
-                seq: 2,
-                txId: `confirmed-seed-peer`,
-                latestRowVersion: 2,
-                requiresFullReload: true,
-              }
-            : {
-                type: `tx:committed`,
-                term: 1,
-                seq: 2,
-                txId: `confirmed-seed-peer`,
-                latestRowVersion: 2,
-                requiresFullReload: false,
-                changedRows:
-                  change !== `delete`
-                    ? [
-                        { key: seed.id, value: peer },
-                        { key: ordinary.id, value: ordinaryPeer },
-                      ]
-                    : [{ key: ordinary.id, value: ordinaryPeer }],
-                deletedKeys: change === `delete` ? [seed.id] : [],
-              }
-        coordinator.emit(envelope, undefined, collectionId)
-        await atPersistedOracleCheckpoint(
-          published.promise,
-          `confirmed seed peer publication`,
-        )
-        await flushAsyncWork()
-        expect(snapshots).toHaveLength(1)
-        for (const snapshot of snapshots)
-          expectExactSnapshot(snapshot, expected)
-        expectExactSnapshot(publicRows(), expected)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        collection._sync.unloadSubset(demand)
-        await cleanupPersistedOracle(
-          [() => client.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // A source transaction can write the same key more than once. The durable
-  // store folds operations in order, but the targeted notice separates all
-  // changed rows from deleted keys. Delete -> update and update -> delete have
-  // identical wire arrays and opposite durable outcomes, so a receiver cannot
-  // reconstruct either result from that envelope alone. The independent case
-  // table authors the final durable relation; the recording adapter checks
-  // that each operation sequence reaches it before the notice is delivered.
-  // A same-key insert also shares the targeted changedRows shape with an
-  // update, yet replaces rather than merges the durable row. Both active
-  // complete and retired demand compare the public row at each callback and
-  // after the next task turn. Two updates are a neighboring control that
-  // retains the old field omitted by each patch.
-  it.each(
-    ([`active demand`, `retired demand`] as const).flatMap((route) =>
-      (
-        [
-          `delete then update`,
-          `update then delete`,
-          `two updates`,
-          `insert replacement`,
-        ] as const
-      ).map((sequence) => ({ route, sequence })),
-    ),
-  )(
-    `follows durable same-key order for targeted $sequence with $route`,
-    async ({ route, sequence }) => {
-      const old = { id: `row`, title: `Old`, detail: `old detail` }
-      const fresh = { id: old.id, title: `Fresh` }
-      const detailPatch = { id: old.id, detail: `new detail` }
-      const titlePatch = { id: old.id, title: `Fresh` }
-      const mutations: PersistedTx[`mutations`] =
-        sequence === `delete then update`
-          ? [
-              { type: `delete`, key: old.id, value: old },
-              { type: `update`, key: old.id, value: fresh },
-            ]
-          : sequence === `update then delete`
-            ? [
-                { type: `update`, key: old.id, value: fresh },
-                { type: `delete`, key: old.id, value: old },
-              ]
-            : sequence === `insert replacement`
-              ? [{ type: `insert`, key: old.id, value: fresh }]
-              : [
-                  { type: `update`, key: old.id, value: detailPatch },
-                  { type: `update`, key: old.id, value: titlePatch },
-                ]
-      const authoredDurable = new Map<string, Todo>(
-        sequence === `update then delete`
-          ? []
-          : sequence === `delete then update` ||
-              sequence === `insert replacement`
-            ? [[old.id, fresh]]
-            : [[old.id, { ...old, ...detailPatch, ...titlePatch }]],
-      )
-      const adapter = createRecordingAdapter([old])
-      const coordinator = createCoordinatorHarness()
-      const collectionId = `targeted-order-${route}-${sequence}`
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const demand = {}
-      const published = createEventGate()
-      const publishedSnapshots: Array<Map<string, Todo>> = []
-      const publicRows = () =>
-        new Map(
-          Array.from(collection.values(), (row) => [
-            row.id,
-            stripVirtualProps(row),
-          ]),
-        )
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        await collection._sync.loadSubset(demand)
-        expectExactSnapshot(publicRows(), new Map([[old.id, old]]))
-        if (route === `retired demand`) collection._sync.unloadSubset(demand)
-        subscription = collection.subscribeChanges(
-          () => {
-            publishedSnapshots.push(
-              new Map(
-                Array.from(publicRows(), ([key, row]) => [
-                  key,
-                  structuredClone(row),
-                ]),
-              ),
-            )
-            published.resolve()
-          },
-          { includeInitialState: false },
-        )
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId },
-          {
-            txId: `targeted-order`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations,
-          },
-        )
-        expectExactSnapshot(adapter.rows, authoredDurable)
-        const changedRows =
-          sequence === `two updates`
-            ? [
-                { key: old.id, value: detailPatch },
-                { key: old.id, value: titlePatch },
-              ]
-            : [{ key: old.id, value: fresh }]
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `targeted-order`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows,
-            deletedKeys:
-              sequence === `two updates` || sequence === `insert replacement`
-                ? []
-                : [old.id],
-          },
-          undefined,
-          collectionId,
-        )
-        await atPersistedOracleCheckpoint(
-          published.promise,
-          `targeted same-key notice published`,
-        )
-        await flushAsyncWork()
-        const expected = expectedScopedSnapshot(
-          new Map([[old.id, old]]),
-          authoredDurable,
-          new Map(),
-          route === `active demand`,
-        )
-        expectExactSnapshot(publicRows(), expected)
-        expect(publishedSnapshots).toHaveLength(1)
-        for (const snapshot of publishedSnapshots)
-          expectExactSnapshot(snapshot, expected)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        subscription?.unsubscribe()
-        if (route === `active demand`) collection._sync.unloadSubset(demand)
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Hostile output controls calibrate the same comparison used above and by
-  // the captured-read source history. A missing key, an obsolete defined
-  // field, and an obsolete own-undefined field must all be rejected. These
-  // controls do not substitute for the production RED witnesses above.
-  it(`rejects omitted keys and retained fields at the exact snapshot comparison`, () => {
-    const expected = new Map<string, Todo>([
-      [`shared`, { id: `shared`, title: `Current` }],
-      [`new`, { id: `new`, title: `New` }],
-    ])
-    expect(() =>
-      expectExactSnapshot(
-        new Map([[`shared`, { id: `shared`, title: `Current` }]]),
-        expected,
-      ),
-    ).toThrow()
-    for (const detail of [`obsolete`, undefined]) {
-      expect(() =>
-        expectExactSnapshot(
-          new Map<string, Todo>([
-            [`shared`, { id: `shared`, title: `Current`, detail }],
-            [`new`, { id: `new`, title: `New` }],
-          ]),
-          expected,
-        ),
-      ).toThrow()
-    }
-  })
-
-  // Persisted rows are a baseline for newer sync-adapter changes. The maintainer
-  // decision recorded in issue-2036-admission-follow-up.md gives accepted sync
-  // transactions precedence over that baseline. A persistence read cannot revoke
-  // acceptance. A later truncate replay can supersede earlier source writes.
-  //
-  // A distinct overlap holds a complete read after it has captured the old
-  // durable value. A source change submitted during that wait must prevail at
-  // settlement after its receipt; the runtime may defer acceptance until the
-  // held read ends.
-  // The model is the authored baseline followed by one source operation. It
-  // crosses same-key replacement/deletion and a new key absent from the read;
-  // no intermediate publication timing is assumed before its receipt settles.
-  it.each([`insert same`, `insert new`, `update`, `delete`] as const)(
-    `keeps a source %s after a captured complete read`,
-    async (operation) => {
-      const old = { id: `shared`, title: `Persisted` }
-      const fresh = {
-        id: operation === `insert new` ? `new` : `shared`,
-        title: `Source`,
-      }
-      const expectedRows = new Map<string, Todo>(
-        operation === `delete`
-          ? []
-          : operation === `insert new`
-            ? [
-                [old.id, structuredClone(old)],
-                [fresh.id, structuredClone(fresh)],
-              ]
-            : [[fresh.id, structuredClone(fresh)]],
-      )
-      const adapter = createRecordingAdapter([old])
-      const originalLoad = adapter.loadSubset.bind(adapter)
-      const readEntered = createEventGate()
-      const releaseRead = createEventGate()
-      adapter.loadSubset = async (...args) => {
-        const captured = (await originalLoad(...args)).map((row) => ({
-          ...row,
-          value: structuredClone(row.value),
-        }))
-        readEntered.resolve()
-        await releaseRead.promise
-        return captured
-      }
-      let source!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `captured-complete-read-${operation}`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const demand = {}
-      let pendingRead: Promise<unknown> | undefined
-      let receipt: Promise<unknown> | undefined
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        pendingRead = Promise.resolve(collection._sync.loadSubset(demand))
-        void pendingRead.catch(() => undefined)
-        await atPersistedOracleCheckpoint(
-          readEntered.promise,
-          `complete read captured durable baseline`,
-        )
-        source.begin()
-        source.write(
-          operation === `delete`
-            ? { type: `delete`, key: old.id }
-            : {
-                type: operation.startsWith(`insert`) ? `insert` : `update`,
-                value: fresh,
-              },
-        )
-        receipt = Promise.resolve(source.commit())
-        void receipt.catch(() => undefined)
-        await flushAsyncWork()
-        expect(collection.get(old.id)?.title).not.toBe(old.title)
-        releaseRead.resolve()
-        await atPersistedOracleCheckpoint(
-          Promise.all([pendingRead, receipt]),
-          `captured complete read and source receipt settled`,
-        )
-        expectExactSnapshot(
-          new Map(
-            Array.from(collection.values(), (row) => [
-              row.id,
-              stripVirtualProps(row),
-            ]),
-          ),
-          expectedRows,
-        )
-        expectExactSnapshot(adapter.rows, expectedRows)
-        expect(collection.status).toBe(`ready`)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        releaseRead.resolve()
-        collection._sync.unloadSubset(demand)
-        await cleanupPersistedOracle(
-          [
-            () => Promise.allSettled([pendingRead, receipt]),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // This bounded grammar crosses insert/update/delete with no truncate replay,
-  // replay before the change, and replay after it. Each history runs with the
-  // persistence read already finished and with accepted commits waiting behind
-  // that read. Both schedules must satisfy the same independent result below.
-  // Eager and on-demand Collections receive reset/full-reload notifications;
-  // on-demand Collections acquire bounded or complete subsets. A full reload
-  // with no demand validates already public rows without publishing unrelated
-  // stored rows. The controlled coordinator does not prove host delivery.
-  it.each(
-    (
-      [
-        { syncMode: `on-demand`, route: `subset` },
-        { syncMode: `on-demand`, route: `complete subset` },
-        { syncMode: `on-demand`, route: `collection-reset` },
-        { syncMode: `on-demand`, route: `full-reload` },
-        { syncMode: `eager`, route: `collection-reset` },
-        { syncMode: `eager`, route: `full-reload` },
-      ] as const
-    ).flatMap(({ syncMode, route }) =>
-      ([`insert`, `update`, `delete`] as const).flatMap((operation) =>
-        ([`none`, `before`, `after`] as const).flatMap((truncateReplay) =>
-          [false, true].map((commitBeforeRead) => ({
-            syncMode,
-            route,
-            operation,
-            truncateReplay,
-            commitBeforeRead,
-          })),
-        ),
-      ),
-    ),
-  )(
-    `preserves sync history over persisted reads ($syncMode, $route, $operation, truncate=$truncateReplay, queued=$commitBeforeRead)`,
-    async ({
-      syncMode,
-      route,
-      operation,
-      truncateReplay,
-      commitBeforeRead,
-    }) => {
-      const storedRow = { id: `shared`, title: `persisted`, detail: `old` }
-      const storedOnly = { id: `stored-only`, title: `removed by truncate` }
-      const gateRow = { id: `gate`, title: `earlier sync transaction` }
-      const networkRow = { id: `shared`, title: `network`, detail: `new` }
-      const replacementRow = { id: `replacement`, title: `truncate replay` }
-      const adapter = createRecordingAdapter([
-        { ...storedRow },
-        { ...storedOnly },
-      ])
-      adapter.rowMetadata.set(`shared`, { owner: `persisted` })
-      adapter.collectionMetadata.set(`cursor`, `persisted`)
-      const coordinator = createFailStopCoordinatorHarness(
-        `persisted-read-precedence`,
-      )
-      const persistenceEntered = createEventGate()
-      const releasePersistence = createEventGate()
-      const readApplied = createEventGate()
-      const trace: Array<string> = []
-      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-      adapter.applyCommittedTx = async (...args) => {
-        if (args[1].mutations.some(({ key }) => key === `gate`)) {
-          persistenceEntered.resolve()
-          await releasePersistence.promise
-        }
-        await applyCommittedTx(...args)
-        // Record durable completion, including a delete or truncate. A rejected
-        // adapter write must never appear as a completed source obligation.
-        if (args[1].truncate) trace.push(`replacement`)
-        else if (args[1].mutations.some(({ key }) => key === `shared`)) {
-          trace.push(`network`)
-        }
-      }
-      coordinator.requestApplyCommittedTx = async (id, tx) => {
-        await adapter.applyCommittedTx({ kind: `eager`, collectionId: id }, tx)
-        return {
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }
-      }
-      const loadSubset = adapter.loadSubset.bind(adapter)
-      const readRows: Array<Array<Record<string, unknown>>> = []
-      adapter.loadSubset = async (...args) => {
-        const rows = await loadSubset(...args)
-        readRows.push(rows.map(({ value }) => ({ ...value })))
-        trace.push(`persisted read`)
-        return rows
-      }
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `persisted-read-precedence`,
-          getKey: (row) => row.id,
-          syncMode,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const options = route === `complete subset` ? {} : { limit: 100 }
-      const sourceSteps =
-        truncateReplay === `none`
-          ? [`network`]
-          : truncateReplay === `before`
-            ? [`replacement`, `network`]
-            : [`network`, `replacement`]
-      const noDemandRead =
-        syncMode === `on-demand` &&
-        route !== `subset` &&
-        route !== `complete subset`
-
-      // Independent snapshot algebra: a later replacement discards everything
-      // before it. Otherwise the baseline survives only when there is no
-      // replacement, and the newer change decides the shared key. Complete row
-      // values and explicit metadata avoid the separate partial-update contract.
-      // Source steps are input history, never observations from production.
-      const expectedRows =
-        truncateReplay === `after`
-          ? [replacementRow]
-          : [
-              ...(truncateReplay === `before`
-                ? [replacementRow]
-                : [storedOnly, gateRow]),
-              ...(operation === `delete` ? [] : [networkRow]),
-            ]
-      const expectedPublicRows =
-        noDemandRead && truncateReplay === `none`
-          ? [gateRow, ...(operation === `delete` ? [] : [networkRow])]
-          : expectedRows
-      const expectedMetadata = new Map<string, unknown>([
-        ...(truncateReplay === `none`
-          ? []
-          : [[`replacement`, { owner: `replacement` }] as const]),
-        ...(truncateReplay !== `after` && operation !== `delete`
-          ? [[`shared`, { owner: `network` }] as const]
-          : []),
-      ])
-      const expectedCursor =
-        truncateReplay === `after` ? `replacement` : `network`
-      // Await applied receipts and the optional subset-load promise.
-      const pendingOperations: Array<Promise<true | void>> = []
-      const retainOperation = (receipt: true | void | Promise<true | void>) => {
-        const pending = Promise.resolve(receipt)
-        void pending.catch(() => undefined)
-        pendingOperations.push(pending)
-      }
-      let hasPrimaryFailure = false
-      try {
-        await atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `precedence collection ready`,
-        )
-        // Hold an earlier durable write so the real runtime queues its read and
-        // ordinary sync transactions. The scope callback witnesses publication,
-        // not just completion of the adapter's load promise.
-        adapter.runInHydrationScope = async (task) => {
-          const result = await task(adapter)
-          readApplied.resolve()
-          return result
-        }
-        sourceParams.begin()
-        sourceParams.write({ type: `insert`, value: { ...gateRow } })
-        retainOperation(sourceParams.commit())
-        await atPersistedOracleCheckpoint(
-          persistenceEntered.promise,
-          `precedence predecessor held`,
-        )
-        if (route === `subset` || route === `complete subset`) {
-          retainOperation(collection._sync.loadSubset(options))
-        } else if (route === `collection-reset`) {
-          coordinator.emit({
-            type: `collection:reset`,
-            schemaVersion: 1,
-            resetEpoch: 1,
-          })
-        } else {
-          coordinator.emit({
-            type: `tx:committed`,
-            term: 1,
-            seq: 2,
-            txId: `remote-reload`,
-            latestRowVersion: 2,
-            requiresFullReload: true,
-          })
-        }
-        await flushAsyncWork()
-        expect(readRows).toEqual([])
-        expect(collection.get(`shared`)?.title).toBe(
-          syncMode === `eager` ? `persisted` : undefined,
-        )
-        if (!commitBeforeRead) {
-          releasePersistence.resolve()
-          await atPersistedOracleCheckpoint(
-            readApplied.promise,
-            `persistence read published before commit`,
-          )
-        }
-        for (const step of sourceSteps) {
-          sourceParams.begin()
-          if (step === `replacement`) {
-            sourceParams.truncate()
-            sourceParams.write({ type: `insert`, value: { ...replacementRow } })
-            sourceParams.metadata!.row.set(`replacement`, {
-              owner: `replacement`,
-            })
-          } else if (operation === `delete`) {
-            sourceParams.write({ type: `delete`, key: `shared` })
-          } else {
-            sourceParams.write({ type: operation, value: { ...networkRow } })
-            sourceParams.metadata!.row.set(`shared`, { owner: `network` })
-          }
-          sourceParams.metadata!.collection.set(`cursor`, step)
-          retainOperation(sourceParams.commit())
-        }
-        releasePersistence.resolve()
-        const outcomes = await atPersistedOracleCheckpoint(
-          Promise.allSettled(pendingOperations),
-          `sync history applied and durable`,
-        )
-        // Compare after applied receipts and the subset load settle, before cleanup. Exact
-        // keys detect resurrected deletes and rows wrongly retained by truncate.
-        // Read contents and completion order prove that the older baseline ran
-        // first in both schedules. No intermediate-publication claim is made.
-        const metadataKeys = [`shared`, `stored-only`, `gate`, `replacement`]
-        expect({
-          outcomes,
-          trace,
-          readRows,
-          status: collection.status,
-          publicRows: new Map(
-            Array.from(collection.values(), (row) => [
-              row.id,
-              stripVirtualProps(row),
-            ]),
-          ),
-          durableRows: adapter.rows,
-          publicMetadata: metadataKeys.map((key) =>
-            sourceParams.metadata!.row.get(key),
-          ),
-          durableMetadata: metadataKeys.map((key) =>
-            adapter.rowMetadata.get(key),
-          ),
-          publicCursor: sourceParams.metadata!.collection.get(`cursor`),
-          durableCursor: adapter.collectionMetadata.get(`cursor`),
-        }).toEqual({
-          outcomes: pendingOperations.map(() => ({
-            status: `fulfilled`,
-            value: undefined,
-          })),
-          trace: [...(noDemandRead ? [] : [`persisted read`]), ...sourceSteps],
-          readRows: noDemandRead ? [] : [[storedRow, storedOnly, gateRow]],
-          status: `ready`,
-          publicRows: new Map(expectedPublicRows.map((row) => [row.id, row])),
-          durableRows: new Map(expectedRows.map((row) => [row.id, row])),
-          publicMetadata: metadataKeys.map((key) => expectedMetadata.get(key)),
-          durableMetadata: metadataKeys.map((key) => expectedMetadata.get(key)),
-          publicCursor: expectedCursor,
-          durableCursor: expectedCursor,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        releasePersistence.resolve()
-        await cleanupPersistedOracle(
-          [
-            ...(route === `subset` || route === `complete subset`
-              ? [() => collection._sync.unloadSubset(options)]
-              : []),
-            () => Promise.allSettled(pendingOperations),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`rejects a source transaction that crosses a hydration cycle`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstEntered = createEventGate()
-    const releaseFirst = createEventGate()
-    const secondEntered = createEventGate()
-    const releaseSecond = createEventGate()
-    let loads = 0
-    adapter.loadSubset = async () => {
-      loads++
-      if (loads === 1) {
-        firstEntered.resolve()
-        await releaseFirst.promise
-        return []
-      }
-      secondEntered.resolve()
-      await releaseSecond.promise
-      const value = { id: `shared`, title: `second hydration` }
-      adapter.rows.set(value.id, value)
-      adapter.rowMetadata.set(value.id, { owner: `second hydration` })
-      return [
-        {
-          key: value.id,
-          value,
-          metadata: adapter.rowMetadata.get(value.id),
-        },
-      ]
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `bounded-cross-hydration-source`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const firstOptions = { limit: 1 }
-    const secondOptions = { limit: 2 }
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      const first = Promise.resolve(collection._sync.loadSubset(firstOptions))
-      await firstEntered.promise
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `shared`, title: `source value` },
-      })
-      releaseFirst.resolve()
-      await first
-
-      const second = Promise.resolve(collection._sync.loadSubset(secondOptions))
-      await secondEntered.promise
-      expect(() => sourceParams.commit()).toThrow(
-        `cannot cross a hydration cycle`,
-      )
-      releaseSecond.resolve()
-      await second
-
-      expect({
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        durableRow: adapter.rows.get(`shared`),
-        durableMetadata: adapter.rowMetadata.get(`shared`),
-        status: collection.status,
-      }).toEqual({
-        publicRow: { id: `shared`, title: `second hydration` },
-        durableRow: { id: `shared`, title: `second hydration` },
-        durableMetadata: { owner: `second hydration` },
-        status: `ready`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseFirst.resolve()
-      releaseSecond.resolve()
-      collection._sync.unloadSubset(firstOptions)
-      collection._sync.unloadSubset(secondOptions)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects a source transaction begun before hydration and committed after it`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrationEntered = createEventGate()
-    const releaseHydration = createEventGate()
-    adapter.loadSubset = async () => {
-      hydrationEntered.resolve()
-      await releaseHydration.promise
-      const value = { id: `shared`, title: `hydrated value` }
-      adapter.rows.set(value.id, value)
-      adapter.rowMetadata.set(value.id, { owner: `hydration` })
-      return [
-        {
-          key: value.id,
-          value,
-          metadata: adapter.rowMetadata.get(value.id),
-        },
-      ]
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `bounded-hydration-bracketing-source`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const options = { limit: 1 }
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `shared`, title: `source value` },
-      })
-
-      const hydration = Promise.resolve(collection._sync.loadSubset(options))
-      await hydrationEntered.promise
-      releaseHydration.resolve()
-      await hydration
-
-      expect(() => sourceParams.commit()).toThrow(
-        `cannot cross a hydration cycle`,
-      )
-      expect({
-        publicRow: stripVirtualProps(collection.get(`shared`)),
-        durableRow: adapter.rows.get(`shared`),
-        durableMetadata: adapter.rowMetadata.get(`shared`),
-        status: collection.status,
-      }).toEqual({
-        publicRow: { id: `shared`, title: `hydrated value` },
-        durableRow: { id: `shared`, title: `hydrated value` },
-        durableMetadata: { owner: `hydration` },
-        status: `ready`,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseHydration.resolve()
-      collection._sync.unloadSubset(options)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`preserves full-reload metadata only for rows supplied by that reload`, async () => {
-    const adapter = createRecordingAdapter()
-    adapter.rowMetadata.set(`hydrated`, { source: `persisted` })
-    adapter.rowMetadata.set(`new`, { source: `orphaned` })
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    let durableMetadataMutations: Array<unknown> = []
-    adapter.applyCommittedTx = async (...args) => {
-      durableMetadataMutations = [...(args[1].rowMetadataMutations ?? [])]
-      await applyCommittedTx(...args)
-    }
-    const hydrationEntered = createEventGate()
-    const hydration = createEventGate()
-    let holdReload = false
-    adapter.loadSubset = async () => {
-      if (!holdReload) return []
-      hydrationEntered.resolve()
-      await hydration.promise
-      return [
-        {
-          key: `hydrated`,
-          value: { id: `hydrated`, title: `Persisted reload row` },
-          metadata: { source: `persisted` },
-        },
-      ]
-    }
-    const coordinator = createFailStopCoordinatorHarness(
-      `full-reload-hydration-owned-metadata`,
-    )
-    coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        tx,
-      )
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `full-reload-hydration-owned-metadata`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let receipt: Promise<void> | undefined
-    const demand = { limit: 1 }
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `full-reload metadata collection ready`,
-      )
-      await collection._sync.loadSubset(demand)
-      holdReload = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `full-reload-metadata`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        hydrationEntered.promise,
-        `full-reload metadata hydration entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `hydrated`, title: `Source replacement` },
-      })
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `new`, title: `Genuinely new row` },
-      })
-
-      // Commit only after the reload's runtime marker clears. Ownership must
-      // remain attached to the transaction rather than ambient runtime state.
-      hydration.resolve()
-      await vi.waitFor(() =>
-        expect(stripVirtualProps(collection.get(`hydrated`))).toEqual({
-          id: `hydrated`,
-          title: `Persisted reload row`,
-        }),
-      )
-      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      await atPersistedOracleCheckpoint(
-        receipt,
-        `full-reload metadata source receipt`,
-      )
-
-      expect({
-        publicHydrated: stripVirtualProps(collection.get(`hydrated`)),
-        publicNew: stripVirtualProps(collection.get(`new`)),
-        hydratedMetadata: adapter.rowMetadata.get(`hydrated`),
-        newMetadata: adapter.rowMetadata.get(`new`),
-        durableMetadataMutations,
-      }).toEqual({
-        publicHydrated: { id: `hydrated`, title: `Source replacement` },
-        publicNew: { id: `new`, title: `Genuinely new row` },
-        hydratedMetadata: { source: `persisted` },
-        newMetadata: undefined,
-        durableMetadataMutations: [{ type: `delete`, key: `new` }],
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      hydration.resolve()
-      collection._sync.unloadSubset(demand)
-      await cleanupPersistedOracle(
-        [() => receipt?.catch(() => undefined), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`persists truncate transactions and preserves intended collection metadata`, async () => {
-    const adapter = createRecordingAdapter()
-
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => void) | undefined
-    let remoteTruncate: (() => void) | undefined
-    let remoteMetadata:
-      Parameters<SyncConfig<Todo, string>[`sync`]>[0][`metadata`] | undefined
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-truncate`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, write, commit, truncate, markReady, metadata }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            remoteTruncate = truncate
-            remoteMetadata = metadata
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    await collection.stateWhenReady()
-    await flushAsyncWork()
-
-    remoteBegin?.()
-    remoteWrite?.({
-      type: `insert`,
-      value: {
-        id: `pre-truncate`,
-        title: `Pre truncate`,
-      },
-    })
-    remoteMetadata?.collection.set(`electric:resume`, {
-      kind: `reset`,
-      updatedAt: 1,
-    })
-    remoteTruncate?.()
-    remoteWrite?.({
-      type: `insert`,
-      value: {
-        id: `post-truncate`,
-        title: `Post truncate`,
-      },
-    })
-    remoteCommit?.()
-    await flushAsyncWork()
-
-    expect(adapter.applyCommittedTxCalls.at(-1)?.tx.truncate).toBe(true)
-
-    const reloadedCollection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-truncate`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-        },
-      }),
-    )
-
-    await reloadedCollection.preload()
-    await flushAsyncWork()
-
-    expect(reloadedCollection.get(`pre-truncate`)).toBeUndefined()
-    expect(stripVirtualProps(reloadedCollection.get(`post-truncate`))).toEqual({
-      id: `post-truncate`,
-      title: `Post truncate`,
-    })
-    expect(
-      reloadedCollection._state.syncedCollectionMetadata.get(`electric:resume`),
-    ).toEqual({
-      kind: `reset`,
-      updatedAt: 1,
-    })
-  })
-
-  it(`fail-stops an OK seq-gap delta when its application receipt rejects`, async () => {
-    const id = `gap-targeted-receipt`
-    const receiptError = new Error(`gap targeted receipt failed exactly`)
-    const firstApplied = createEventGate()
-    const receiptEntered = createEventGate()
-    const terminal = createEventGate()
-    const fallbackReload = createEventGate()
-    const barrierApplied = createEventGate()
-    let loadCalls = 0
-    const adapter = createRecordingAdapter()
-    adapter.loadSubset = async () => {
-      loadCalls++
-      if (loadCalls > 1) fallbackReload.resolve()
-      return []
-    }
-    const coordinator = createFailStopCoordinatorHarness(id)
-    coordinator.pullSince = async () => ({
-      type: `rpc:pullSince:res`,
-      rpcId: `targeted-replay`,
-      ok: true,
-      latestTerm: 1,
-      latestSeq: 3,
-      latestRowVersion: 3,
-      requiresFullReload: false,
-      changedKeys: [`replayed`],
-      deletedKeys: [],
-      deltas: [
-        {
-          txId: `replayed-delta`,
-          latestRowVersion: 2,
-          changedRows: [
-            {
-              key: `replayed`,
-              value: { id: `replayed`, title: `targeted replay` },
-            },
-          ],
-          deletedKeys: [],
-          rowMetadataMutations: [],
-          collectionMetadataMutations: [],
-        },
-      ],
-    })
-    let rejectNextCommit = false
-    let observeNextCommit = false
-    let observeBarrierCommit = false
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: { sync: ({ markReady }) => markReady() },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (rejectNextCommit) {
-                rejectNextCommit = false
-                receiptEntered.resolve()
-                void Promise.resolve(actualReceipt).catch(() => undefined)
-                return Promise.reject(receiptError)
-              }
-              if (observeNextCommit) {
-                observeNextCommit = false
-                void Promise.resolve(actualReceipt).then(() =>
-                  firstApplied.resolve(),
-                )
-              }
-              if (observeBarrierCommit) {
-                observeBarrierCommit = false
-                void Promise.resolve(actualReceipt).then(() =>
-                  barrierApplied.resolve(),
-                )
-              }
-              return actualReceipt
-            },
-          }),
-      },
-    })
-    const unsubscribeError = collection.on(`status:crashed`, () => {
-      terminal.resolve()
-    })
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `targeted gap initial ready`,
-      )
-      observeNextCommit = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `first`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          { key: `first`, value: { id: `first`, title: `first committed` } },
-        ],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        firstApplied.promise,
-        `targeted gap first transaction applied`,
-      )
-
-      rejectNextCommit = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 3,
-        txId: `gap`,
-        latestRowVersion: 3,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        receiptEntered.promise,
-        `targeted replay receipt entered`,
-      )
-      const outcome = await atPersistedOracleCheckpoint(
-        Promise.race([
-          terminal.promise.then(() => ({ kind: `terminal` as const })),
-          fallbackReload.promise.then(() => ({ kind: `fallback` as const })),
-        ]),
-        `targeted terminal error or fallback reload`,
-      )
-      if (outcome.kind === `fallback`) {
-        observeBarrierCommit = true
-        coordinator.emit({
-          type: `tx:committed`,
-          term: 1,
-          seq: 4,
-          txId: `barrier`,
-          latestRowVersion: 4,
-          requiresFullReload: false,
-          changedRows: [],
-          deletedKeys: [],
-        })
-        await atPersistedOracleCheckpoint(
-          barrierApplied.promise,
-          `targeted fallback barrier`,
-        )
-      }
-
-      expect({
-        outcome: outcome.kind,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        loadCalls,
-      }).toEqual({
-        outcome: `terminal`,
-        status: `crashed`,
-        publicError: receiptError,
-        loadCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      unsubscribeError()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`fail-stops an OK seq-gap full reload when adapter loading rejects`, async () => {
-    const id = `gap-full-reload-load`
-    const loadError = new Error(`gap full reload load failed exactly`)
-    const firstApplied = createEventGate()
-    const failingLoadEntered = createEventGate()
-    const terminal = createEventGate()
-    const fallbackReload = createEventGate()
-    const barrierApplied = createEventGate()
-    let loadCalls = 0
-    const adapter = createRecordingAdapter()
-    adapter.loadSubset = async () => {
-      loadCalls++
-      if (loadCalls === 1) {
-        failingLoadEntered.resolve()
-        throw loadError
-      }
-      if (loadCalls === 2) fallbackReload.resolve()
-      return []
-    }
-    const coordinator = createFailStopCoordinatorHarness(id)
-    coordinator.pullSince = async () => ({
-      type: `rpc:pullSince:res`,
-      rpcId: `full-reload`,
-      ok: true,
-      latestTerm: 1,
-      latestSeq: 3,
-      latestRowVersion: 3,
-      requiresFullReload: true,
-    })
-    let observeNextCommit = false
-    let observeBarrierCommit = false
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: { sync: ({ markReady }) => markReady() },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (observeNextCommit) {
-                observeNextCommit = false
-                void Promise.resolve(actualReceipt).then(() =>
-                  firstApplied.resolve(),
-                )
-              }
-              if (observeBarrierCommit) {
-                observeBarrierCommit = false
-                void Promise.resolve(actualReceipt).then(() =>
-                  barrierApplied.resolve(),
-                )
-              }
-              return actualReceipt
-            },
-          }),
-      },
-    })
-    const unsubscribeError = collection.on(`status:crashed`, () => {
-      terminal.resolve()
-    })
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `full reload gap initial ready`,
-      )
-      observeNextCommit = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `first`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          { key: `first`, value: { id: `first`, title: `first committed` } },
-        ],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        firstApplied.promise,
-        `full reload gap first transaction applied`,
-      )
-
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 3,
-        txId: `gap`,
-        latestRowVersion: 3,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        failingLoadEntered.promise,
-        `full reload gap failing load entered`,
-      )
-      const outcome = await atPersistedOracleCheckpoint(
-        Promise.race([
-          terminal.promise.then(() => ({ kind: `terminal` as const })),
-          fallbackReload.promise.then(() => ({ kind: `fallback` as const })),
-        ]),
-        `full reload terminal error or second fallback reload`,
-      )
-      if (outcome.kind === `fallback`) {
-        observeBarrierCommit = true
-        coordinator.emit({
-          type: `tx:committed`,
-          term: 1,
-          seq: 4,
-          txId: `barrier`,
-          latestRowVersion: 4,
-          requiresFullReload: false,
-          changedRows: [],
-          deletedKeys: [],
-        })
-        await atPersistedOracleCheckpoint(
-          barrierApplied.promise,
-          `full reload fallback barrier`,
-        )
-      }
-
-      expect({
-        outcome: outcome.kind,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        loadCalls,
-      }).toEqual({
-        outcome: `terminal`,
-        status: `crashed`,
-        publicError: loadError,
-        loadCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      unsubscribeError()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`keeps seq-gap pull transport rejection on the fallback path`, async () => {
-    const id = `gap-transport-control`
-    const transportError = new Error(`gap pull transport failed exactly`)
-    const firstApplied = createEventGate()
-    const fallbackReload = createEventGate()
-    const barrierApplied = createEventGate()
-    let loadCalls = 0
-    const adapter = createRecordingAdapter()
-    adapter.loadSubset = async () => {
-      loadCalls++
-      if (loadCalls === 1) fallbackReload.resolve()
-      return []
-    }
-    const coordinator = createFailStopCoordinatorHarness(id)
-    coordinator.pullSince = async () => {
-      throw transportError
-    }
-    let observeNextCommit = false
-    let observeBarrierCommit = false
-    const baseOptions = persistedCollectionOptions<Todo, string>({
-      id,
-      getKey: (row) => row.id,
-      sync: { sync: ({ markReady }) => markReady() },
-      persistence: { adapter, coordinator },
-    })
-    const baseSync = baseOptions.sync.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        ...baseOptions.sync,
-        sync: (params) =>
-          baseSync({
-            ...params,
-            commit: (signal) => {
-              const actualReceipt = params.commit(signal)
-              if (observeNextCommit) {
-                observeNextCommit = false
-                void Promise.resolve(actualReceipt).then(() =>
-                  firstApplied.resolve(),
-                )
-              }
-              if (observeBarrierCommit) {
-                observeBarrierCommit = false
-                void Promise.resolve(actualReceipt).then(() =>
-                  barrierApplied.resolve(),
-                )
-              }
-              return actualReceipt
-            },
-          }),
-      },
-    })
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `transport gap initial ready`,
-      )
-      observeNextCommit = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `first`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          { key: `first`, value: { id: `first`, title: `first committed` } },
-        ],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        firstApplied.promise,
-        `transport gap first transaction applied`,
-      )
-
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 3,
-        txId: `gap`,
-        latestRowVersion: 3,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        fallbackReload.promise,
-        `transport gap fallback reload`,
-      )
-      observeBarrierCommit = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 4,
-        txId: `barrier`,
-        latestRowVersion: 4,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(
-        barrierApplied.promise,
-        `transport fallback barrier`,
-      )
-
-      expect(warning).toHaveBeenCalledWith(
-        `Failed pullSince recovery attempt:`,
-        transportError,
-      )
-      expect({
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        loadCalls,
-      }).toEqual({
-        status: `ready`,
-        publicError: undefined,
-        loadCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      warning.mockRestore()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`uses pullSince recovery when tx sequence gaps are detected`, async () => {
-    const adapter = createRecordingAdapter([
-      {
-        id: `1`,
-        title: `Initial`,
-      },
-    ])
-    const coordinator = createCoordinatorHarness()
-    coordinator.setPullSinceResponse({
-      type: `rpc:pullSince:res`,
-      rpcId: `pull-1`,
-      ok: true,
-      latestTerm: 1,
-      latestSeq: 3,
-      latestRowVersion: 3,
-      requiresFullReload: false,
-      changedKeys: [`2`],
-      deletedKeys: [],
-    })
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    await collection.preload()
-
-    adapter.rows.set(`2`, {
-      id: `2`,
-      title: `Recovered`,
-    })
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-1`,
-      latestRowVersion: 1,
-      requiresFullReload: false,
-      changedRows: [{ key: `1`, value: { id: `1`, title: `Initial` } }],
-      deletedKeys: [],
-    })
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 3,
-      txId: `tx-3`,
-      latestRowVersion: 3,
-      requiresFullReload: false,
-      changedRows: [{ key: `2`, value: { id: `2`, title: `Recovered` } }],
-      deletedKeys: [],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(coordinator.pullSinceCalls).toBe(1)
-    expect(stripVirtualProps(collection.get(`2`))).toEqual({
-      id: `2`,
-      title: `Recovered`,
-    })
-  })
-
-  it(`removes deleted rows after tx:committed invalidation reload`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `Keep` },
-      { id: `2`, title: `Delete` },
-    ])
-    const coordinator = createCoordinatorHarness()
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-    expect(stripVirtualProps(collection.get(`2`))).toEqual({
-      id: `2`,
-      title: `Delete`,
-    })
-
-    adapter.rows.delete(`2`)
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-delete`,
-      latestRowVersion: 1,
-      requiresFullReload: false,
-      changedRows: [],
-      deletedKeys: [`2`],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(collection.get(`2`)).toBeUndefined()
-  })
-
-  it(`does not let a stale invalidation reload overwrite a restarted lifecycle`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial` }])
-    const coordinator = createCoordinatorHarness()
-    const originalLoadSubset = adapter.loadSubset.bind(adapter)
-    let loadCalls = 0
-    let releaseStaleReload!: () => void
-    const staleReloadGate = new Promise<void>((resolve) => {
-      releaseStaleReload = resolve
-    })
-    adapter.loadSubset = async (...args) => {
-      loadCalls++
-      if (loadCalls === 1) {
-        await staleReloadGate
-        return [
-          {
-            key: `1`,
-            value: { id: `1`, title: `Stale reload` },
-          },
-        ]
-      }
-      return originalLoadSubset(...args)
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-stale-reload`,
-      latestRowVersion: 1,
-      requiresFullReload: true,
-    })
-    for (let attempt = 0; attempt < 20 && loadCalls < 1; attempt++) {
-      await flushAsyncWork()
-    }
-    expect(loadCalls).toBe(1)
-
-    await collection.cleanup()
-    adapter.rows.set(`1`, { id: `1`, title: `Restarted` })
-    collection.startSyncImmediate()
-    releaseStaleReload()
-    expect(collection.get(`1`)?.title).not.toBe(`Stale reload`)
-
-    for (
-      let attempt = 0;
-      attempt < 20 && collection.get(`1`)?.title !== `Restarted`;
-      attempt++
-    ) {
-      await flushAsyncWork()
-    }
-    expect(stripVirtualProps(collection.get(`1`))).toEqual({
-      id: `1`,
-      title: `Restarted`,
-    })
-    await collection.cleanup()
-  })
-
-  it(`does not let stale reload metadata start row loading after restart`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial` }])
-    const coordinator = createCoordinatorHarness()
-    const originalLoadCollectionMetadata =
-      adapter.loadCollectionMetadata!.bind(adapter)
-    const originalLoadSubset = adapter.loadSubset.bind(adapter)
-    let metadataCalls = 0
-    let subsetCalls = 0
-    let releaseStaleMetadata!: () => void
-    const staleMetadataGate = new Promise<void>((resolve) => {
-      releaseStaleMetadata = resolve
-    })
-    adapter.loadCollectionMetadata = async (...args) => {
-      metadataCalls++
-      if (metadataCalls === 1) await staleMetadataGate
-      return originalLoadCollectionMetadata(...args)
-    }
-    adapter.loadSubset = async (...args) => {
-      subsetCalls++
-      return originalLoadSubset(...args)
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-    expect(metadataCalls).toBe(0)
-    expect(subsetCalls).toBe(0)
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-stale-metadata`,
-      latestRowVersion: 1,
-      requiresFullReload: true,
-    })
-    for (let attempt = 0; attempt < 20 && metadataCalls < 1; attempt++) {
-      await flushAsyncWork()
-    }
-    expect(metadataCalls).toBe(1)
-    expect(subsetCalls).toBe(0)
-
-    await collection.cleanup()
-    adapter.rows.set(`1`, { id: `1`, title: `Restarted` })
-    collection.startSyncImmediate()
-    releaseStaleMetadata()
-    for (
-      let attempt = 0;
-      attempt < 20 && collection.get(`1`)?.title !== `Restarted`;
-      attempt++
-    ) {
-      await flushAsyncWork()
-    }
-
-    expect(metadataCalls).toBe(1)
-    expect(subsetCalls).toBe(0)
-    expect(stripVirtualProps(collection.get(`1`))).toEqual({
-      id: `1`,
-      title: `Restarted`,
-    })
-    await collection.cleanup()
-  })
-
-  it.each(
-    [false, true].flatMap((sharedSubscription) =>
-      [false, true].map((identical) => ({ sharedSubscription, identical })),
-    ),
-  )(
-    `keeps sibling requests owned after one release: %j`,
-    async ({ sharedSubscription, identical }) => {
-      const adapter = createRecordingAdapter([
-        { id: `1`, title: `Page row` },
-        { id: `2`, title: `All-only row` },
-      ])
-      // This finite provider honors the only selection this law generates.
-      const loadRows = adapter.loadSubset
-      adapter.loadSubset = async (...args) => {
-        const rows = await loadRows(...args)
-        return rows.slice(0, args[1].limit)
-      }
-      const coordinator = createCoordinatorHarness()
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `sync-present`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      collection.startSyncImmediate()
-      const subscription = collection.subscribeChanges(() => {})
-      const owner = sharedSubscription ? { subscription } : {}
-      const page: LoadSubsetOptions = {
-        ...owner,
-        ...(identical ? {} : { limit: 1 }),
-      }
-      const all: LoadSubsetOptions = { ...owner }
-      try {
-        await collection._sync.loadSubset(page)
-        expect([...collection.keys()]).toEqual(identical ? [`1`, `2`] : [`1`])
-        await collection._sync.loadSubset(all)
-        expect([...collection.keys()]).toEqual([`1`, `2`])
-        collection._sync.unloadSubset(page)
-        adapter.rows.set(`2`, { id: `2`, title: `After page release` })
-        const beforeReload = adapter.loadSubsetCalls.length
-        coordinator.emit({
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `sibling-update`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
-        })
-        await flushAsyncWork()
-        await flushAsyncWork()
-        expect(
-          adapter.loadSubsetCalls
-            .slice(beforeReload)
-            .map(({ options }) => options.limit),
-        ).toEqual([undefined])
-        expect([...collection.values()].map(stripVirtualProps)).toEqual([
-          { id: `1`, title: `Page row` },
-          { id: `2`, title: `After page release` },
-        ])
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`answers only retained exact demands synchronously from hydrated rows`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `one` },
-      { id: `2`, title: `two` },
-    ])
-    const loadRows = adapter.loadSubset
-    adapter.loadSubset = async (...args) => {
-      const rows = await loadRows(...args)
-      return rows.slice(0, args[1].limit)
-    }
-    const coordinator = createLocalCoordinatorHarness()
-    const upstreamLoads: Array<LoadSubsetOptions> = []
-    const upstreamUnloads: Array<LoadSubsetOptions> = []
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: (options) => {
-                upstreamLoads.push(options)
-                return true
-              },
-              unloadSubset: (options) => upstreamUnloads.push(options),
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    collection.startSyncImmediate()
-    const first: LoadSubsetOptions = { limit: 2 }
-    const sibling: LoadSubsetOptions = { limit: 2 }
-    try {
-      await collection._sync.loadSubset(first)
-      const persistedReads = adapter.loadSubsetCalls.length
-
-      expect(collection._sync.loadSubset(sibling)).toBe(true)
-      expect(adapter.loadSubsetCalls).toHaveLength(persistedReads)
-      expect(upstreamLoads).toEqual([first, sibling])
-
-      collection._sync.unloadSubset(first)
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `retained-sibling`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-      })
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(collection.size).toBe(2)
-
-      collection._sync.unloadSubset(sibling)
-      const narrow: LoadSubsetOptions = { limit: 1 }
-      await collection._sync.loadSubset(narrow)
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `drop-released-demand`,
-        latestRowVersion: 2,
-        requiresFullReload: true,
-      })
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(collection.size).toBe(1)
-
-      const reacquired = collection._sync.loadSubset({ limit: 2 })
-      expect(reacquired).not.toBe(true)
-      await reacquired
-      expect(collection.size).toBe(2)
-      expect(upstreamUnloads).toEqual([first, sibling])
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`makes a sibling live query synchronously ready from a retained hydrated demand`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
-    const source = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydrated-demand-live-query`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    source.startSyncImmediate()
-    const query = () =>
-      createLiveQueryCollection({
-        query: (q) =>
-          q.from({ todo: source }).where(({ todo }) => eq(todo.id, `1`)),
-      })
-    const owner = query()
-    let sibling: ReturnType<typeof query> | undefined
-    try {
-      await owner.preload()
-      sibling = query()
-      // A live query is ready only after a subscriber or a preload asks for
-      // its data. Its first preload starts its sync run, so the retained demand
-      // makes it ready before that call returns.
-      void sibling.preload()
-      expect(sibling.status).toBe(`ready`)
-      expect(sibling.toArray.map(({ id }) => id)).toEqual([`1`])
-    } finally {
-      await sibling?.cleanup()
-      await owner.cleanup()
-      await source.cleanup()
-    }
-  })
-
-  it(`makes a loopback sibling synchronously ready from a retained hydrated demand`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
-    const source = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `loopback-hydrated-demand-live-query`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        persistence: { adapter },
-      }),
-    )
-    source.startSyncImmediate()
-    const query = () =>
-      createLiveQueryCollection({
-        query: (q) =>
-          q.from({ todo: source }).where(({ todo }) => eq(todo.id, `1`)),
-      })
-    const owner = query()
-    let sibling: ReturnType<typeof query> | undefined
-    try {
-      await owner.preload()
-      sibling = query()
-      // A live query is ready only after a subscriber or a preload asks for
-      // its data. Its first preload starts its sync run, so the retained demand
-      // makes it ready before that call returns.
-      void sibling.preload()
-      expect(sibling.status).toBe(`ready`)
-      expect(sibling.toArray.map(({ id }) => id)).toEqual([`1`])
-    } finally {
-      await sibling?.cleanup()
-      await owner.cleanup()
-      await source.cleanup()
-    }
-  })
-
-  type RetainedDemandOperation =
-    | { type: `acquire` | `release`; demand: `one` | `two` }
-    | { type: `truncate` }
-  // The generated prefix varies demand ownership and reset history. Its
-  // terminal suffix reaches a retained hydrated demand, fails a source write,
-  // then checks the exact error and absence of a new upstream acquisition.
-  // The pre-fix fast path returned true and incremented upstreamLoads here.
-  // This recording adapter does not establish browser/OPFS behavior.
-  const retainedDemandHistory = fc
-    .array(
-      fc.record({
-        type: fc.constantFrom(`acquire` as const, `release` as const),
-        demand: fc.constantFrom(`one` as const, `two` as const),
-      }),
-      { minLength: 1, maxLength: 20 },
-    )
-    .chain((operations) =>
-      fc
-        .array(fc.integer({ min: 0, max: operations.length }), {
-          maxLength: 4,
-        })
-        .map((truncatePositions): Array<RetainedDemandOperation> => {
-          const positions = new Set(truncatePositions)
-          return operations.flatMap((operation, index) =>
-            positions.has(index)
-              ? [{ type: `truncate` as const }, operation]
-              : [operation],
-          )
-        }),
-    )
-  const runRetainedDemandHistory = async (
-    history: ReadonlyArray<RetainedDemandOperation>,
-  ): Promise<void> => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `one` },
-      { id: `2`, title: `two` },
-    ])
-    const loadRows = adapter.loadSubset
-    adapter.loadSubset = async (...args) => {
-      const rows = await loadRows(...args)
-      return rows.slice(0, args[1].limit)
-    }
-    let truncateSource: (() => void) | undefined
-    let failSource: (() => true | Promise<void>) | undefined
-    let upstreamLoads = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydrated-demand-history`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, write, truncate, commit, markReady }) => {
-            truncateSource = () => {
-              begin()
-              truncate()
-              commit()
-            }
-            failSource = () => {
-              begin()
-              write({
-                type: `insert`,
-                value: { id: `terminal-write`, title: `must not persist` },
-              })
-              return commit()
-            }
-            markReady()
-            return {
-              loadSubset: () => {
-                upstreamLoads++
-                return true
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.startSyncImmediate()
-    for (let attempt = 0; attempt < 20 && !truncateSource; attempt++) {
-      await flushAsyncWork()
-    }
-    expect(truncateSource).toBeTypeOf(`function`)
-
-    const active: Record<`one` | `two`, Array<LoadSubsetOptions>> = {
-      one: [],
-      two: [],
-    }
-    const hydrated = new Set<`one` | `two`>()
-    const optionsFor = (demand: `one` | `two`): LoadSubsetOptions => ({
-      limit: demand === `one` ? 1 : 2,
-    })
-
-    try {
-      for (const operation of history) {
-        if (operation.type === `truncate`) {
-          truncateSource?.()
-          hydrated.clear()
-          continue
-        }
-
-        const demand = operation.demand
-        if (operation.type === `release`) {
-          const options = active[demand].pop()
-          if (!options) continue
-          collection._sync.unloadSubset(options)
-          if (active[demand].length === 0) hydrated.delete(demand)
-          continue
-        }
-
-        const options = optionsFor(demand)
-        const result = collection._sync.loadSubset(options)
-        expect(result === true).toBe(hydrated.has(demand))
-        if (result !== true) await result
-        active[demand].push(options)
-        hydrated.add(demand)
-      }
-
-      // A terminal durability failure is absorbing even when a retained
-      // demand still has hydrated rows. No later acquisition owns a new
-      // upstream lease or receives synchronous readiness.
-      const retained = optionsFor(`one`)
-      const retainedResult = collection._sync.loadSubset(retained)
-      if (retainedResult !== true) await retainedResult
-      const adapterFailure = new Error(`retained demand durability failed`)
-      adapter.applyCommittedTx = () => Promise.reject(adapterFailure)
-      const failedReceipt = failSource?.()
-      if (!(failedReceipt instanceof Promise)) {
-        throw new Error(`expected a failing source receipt`)
-      }
-      const receiptOutcome = await failedReceipt.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      const terminalError = collection._lifecycle.getSyncError()
-      expect(receiptOutcome).toEqual({
-        status: `rejected`,
-        reason: terminalError,
-      })
-      expect(terminalError).toMatchObject({
-        name: `PersistedCollectionDurabilityError`,
-        cause: adapterFailure,
-      })
-
-      const loadsBeforeRetry = upstreamLoads
-      let retryFailure: unknown
-      try {
-        await collection._sync.loadSubset(optionsFor(`one`))
-      } catch (error) {
-        retryFailure = error
-      }
-      expect({ retryFailure, upstreamLoads }).toEqual({
-        retryFailure: terminalError,
-        upstreamLoads: loadsBeforeRetry,
-      })
-    } finally {
-      await collection.cleanup()
-    }
-  }
-
-  fcTest.prop([retainedDemandHistory], {
-    numRuns: oracleRuns(50),
-    seed: 186001,
-  })(
-    `matches the retained exact-demand model with a fixed seed`,
-    runRetainedDemandHistory,
-  )
-  fcTest.prop(
-    [retainedDemandHistory],
-    oraclePropertyOptions(50, `persistence.retained-demand`),
-  )(
-    `matches the retained exact-demand model with a random or replayed seed`,
-    runRetainedDemandHistory,
-  )
-
-  it(`invalidates hydrated demand when the source truncates`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
-    let truncateSource!: () => void
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `hydrated-demand-truncate`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, truncate, commit, markReady }) => {
-            truncateSource = () => {
-              begin()
-              truncate()
-              commit()
-            }
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.startSyncImmediate()
-    try {
-      await collection._sync.loadSubset({ limit: 1 })
-      expect(collection.size).toBe(1)
-      truncateSource()
-      expect(collection.size).toBe(0)
-
-      const persistedReads = adapter.loadSubsetCalls.length
-      const reacquired = collection._sync.loadSubset({ limit: 1 })
-      expect(reacquired).not.toBe(true)
-      await reacquired
-      expect(adapter.loadSubsetCalls).toHaveLength(persistedReads + 1)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not restore hydrated coverage after a truncate overtakes a reload`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
-    const readSubset = adapter.loadSubset
-    let subsetReads = 0
-    let enterReload!: () => void
-    let releaseReload!: () => void
-    const reloadEntered = new Promise<void>((resolve) => {
-      enterReload = resolve
-    })
-    const reloadGate = new Promise<void>((resolve) => {
-      releaseReload = resolve
-    })
-    adapter.loadSubset = async (...args) => {
-      subsetReads++
-      if (subsetReads === 2) {
-        enterReload()
-        await reloadGate
-      }
-      return readSubset(...args)
-    }
-    const coordinator = createLocalCoordinatorHarness()
-    let truncateSource!: () => void
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, truncate, commit, markReady }) => {
-            truncateSource = () => {
-              begin()
-              truncate()
-              commit()
-            }
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    collection.startSyncImmediate()
-    try {
-      await collection._sync.loadSubset({ limit: 1 })
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `reload-before-truncate`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-      })
-      await reloadEntered
-      truncateSource()
-      releaseReload()
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(collection.size).toBe(0)
-
-      const readsBeforeReacquire = adapter.loadSubsetCalls.length
-      const reacquired = collection._sync.loadSubset({ limit: 1 })
-      expect(reacquired).not.toBe(true)
-      await reacquired
-      expect(adapter.loadSubsetCalls).toHaveLength(readsBeforeReacquire + 1)
-    } finally {
-      releaseReload()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not advertise hydrated coverage after a terminal reset reload failure`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
-    const readSubset = adapter.loadSubset
-    const failure = new Error(`reset reload failed`)
-    let failNextRead = false
-    adapter.loadSubset = async (...args) => {
-      if (failNextRead) {
-        failNextRead = false
-        throw failure
-      }
-      return readSubset(...args)
-    }
-    const coordinator = createLocalCoordinatorHarness()
-    const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: { sync: ({ markReady }) => (markReady(), {}) },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    collection.startSyncImmediate()
-    try {
-      const retained: LoadSubsetOptions = { limit: 1 }
-      await collection._sync.loadSubset(retained)
-      expect(collection.size).toBe(1)
-
-      failNextRead = true
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 1,
-      })
-      await flushAsyncWork()
-      await flushAsyncWork()
-      // Failed durable validation cannot retract the last public row. The
-      // failed run must still reject a later acquisition instead of treating
-      // that retained row as proof of hydrated coverage.
-      expect(stripVirtualProps(collection.get(`1`))).toEqual({
-        id: `1`,
-        title: `cached`,
-      })
-
-      const readsBeforeReacquire = adapter.loadSubsetCalls.length
-      const reacquired = collection._sync.loadSubset({ limit: 1 })
-      expect(reacquired).not.toBe(true)
-      await expect(Promise.resolve(reacquired)).rejects.toBe(failure)
-      expect(adapter.loadSubsetCalls).toHaveLength(readsBeforeReacquire)
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(failure)
-    } finally {
-      warn.mockRestore()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not retain refresh history as permanent subset demand`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Before` }])
-    const coordinator = createCoordinatorHarness()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        persistence: { adapter, coordinator },
-      }),
-    )
-    collection.startSyncImmediate()
-    try {
-      await collection._sync.loadSubset({ limit: 1 })
-      for (let i = 0; i < 20; i++)
-        await collection.utils.forceReloadSubset!({ limit: 1 })
-      const before = adapter.loadSubsetCalls.length
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `refresh-invalidation`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-      })
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(adapter.loadSubsetCalls.length - before).toBe(1)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`reports a non-abort upstream failure rather than treating hydration as remote success`, async () => {
-    const failure = new Error(`remote acquisition failed`)
-    const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `remote-acquisition-failure`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => Promise.reject(failure),
-            }
-          },
-        },
-        persistence: {
-          adapter: createRecordingAdapter([
-            { id: `cached`, title: `Last known row` },
-          ]),
-        },
-      }),
-    )
-    collection.startSyncImmediate()
-    try {
-      await expect(
-        Promise.resolve(collection._sync.loadSubset({})),
-      ).rejects.toBe(failure)
-      expect(stripVirtualProps(collection.get(`cached`))).toEqual({
-        id: `cached`,
-        title: `Last known row`,
-      })
-    } finally {
-      warn.mockRestore()
-      await collection.cleanup()
-    }
-  })
-
-  it(`keeps an incremental persisted subset failure request-local and retries without restart`, async () => {
-    const hydrationFailure = new Error(`later on-demand hydration failed`)
-    const adapter = createRecordingAdapter([
-      { id: `cached`, title: `Last successful snapshot` },
-    ])
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-on-demand-hydration-failure`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `on-demand collection initially ready`,
-      )
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
-        `initial persisted subset hydration`,
-      )
-      expect(stripVirtualProps(collection.get(`cached`))).toEqual({
-        id: `cached`,
-        title: `Last successful snapshot`,
-      })
-      expect(collection.status).toBe(`ready`)
-      adapter.loadSubset = () => Promise.reject(hydrationFailure)
-
-      // A distinct demand must still reach persistence; the retained exact
-      // demand above is eligible for the synchronous hydrated fast path.
-      await expect(
-        atPersistedOracleCheckpoint(
-          Promise.resolve(collection._sync.loadSubset({ limit: 2 })),
-          `later on-demand hydration rejected`,
-        ),
-      ).rejects.toBe(hydrationFailure)
-
-      expect(collection.status).toBe(`ready`)
-      expect(collection._lifecycle.getSyncError()).toBeUndefined()
-      expect(stripVirtualProps(collection.get(`cached`))).toEqual({
-        id: `cached`,
-        title: `Last successful snapshot`,
-      })
-      expect(adapter.applyCommittedTxCalls).toEqual([])
-
-      adapter.rows.set(`retry`, {
-        id: `retry`,
-        title: `Explicit retry succeeded`,
-      })
-      adapter.loadSubset = async () =>
-        Array.from(adapter.rows, ([key, value]) => ({ key, value }))
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(collection._sync.loadSubset({ limit: 2 })),
-        `request-local persisted subset retry`,
-      )
-      expect(stripVirtualProps(collection.get(`retry`))).toEqual({
-        id: `retry`,
-        title: `Explicit retry succeeded`,
-      })
-      expect(collection.status).toBe(`ready`)
-      expect(collection._lifecycle.getSyncError()).toBeUndefined()
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  itUnlessAnyOracleReplay.each(hydrationScopeModes)(
-    `settles hydration-buffered source work and reconciles an overlapping retry after incremental load rejection (%s scope)`,
-    async (scopeMode) => {
-      const failure = new Error(`incremental subset rejected exactly`)
-      const adapter = createRecordingAdapter()
-      const loadPersistedRows = adapter.loadSubset.bind(adapter)
-      const loadEntered = createEventGate()
-      const rejectLoad = createEventGate()
-      adapter.loadSubset = async () => {
-        loadEntered.resolve()
-        await rejectLoad.promise
-        throw failure
-      }
-      const routing = configureHydrationScope(adapter, scopeMode)
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `request-local-failure-releases-source-receipt`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      let load: Promise<void> | undefined
-      let receipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-
-      try {
-        await atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `request-local receipt collection ready`,
-        )
-        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-          () => undefined,
-        )
-        void load.catch(() => undefined)
-        await atPersistedOracleCheckpoint(
-          loadEntered.promise,
-          `request-local hydration entered`,
-        )
-
-        sourceParams.begin()
-        sourceParams.write({
-          type: `insert`,
-          value: { id: `source`, title: `Must outlive request failure` },
-        })
-        receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-        const receiptState = observeSettlement(receipt)
-        expect(receiptState.read()).toEqual({ status: `pending` })
-
-        rejectLoad.resolve()
-        await expect(
-          atPersistedOracleCheckpoint(load, `request-local load rejected`),
-        ).rejects.toBe(failure)
-        await atPersistedOracleCheckpoint(
-          receipt,
-          `hydration-buffered source receipt settled`,
-        )
-
-        expect({
-          receipt: receiptState.read(),
-          status: collection.status,
-          publicError: collection._lifecycle.getSyncError(),
-          publicRow: stripVirtualProps(collection.get(`source`)),
-          durableRow: adapter.rows.get(`source`),
-        }).toEqual({
-          receipt: { status: `fulfilled` },
-          status: `ready`,
-          publicError: undefined,
-          publicRow: { id: `source`, title: `Must outlive request failure` },
-          durableRow: { id: `source`, title: `Must outlive request failure` },
-        })
-
-        expect(
-          routing?.violations() ?? [],
-          `failed incremental reads retain the current scope for surviving source work`,
-        ).toEqual([])
-        adapter.loadSubset = loadPersistedRows
-        await atPersistedOracleCheckpoint(
-          Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
-          `overlapping request-local retry loaded durable source row`,
-        )
-        expect({
-          status: collection.status,
-          publicError: collection._lifecycle.getSyncError(),
-          publicRows: [...collection.values()].map(stripVirtualProps),
-          durableRows: [...adapter.rows.values()],
-        }).toEqual({
-          status: `ready`,
-          publicError: undefined,
-          publicRows: [{ id: `source`, title: `Must outlive request failure` }],
-          durableRows: [
-            { id: `source`, title: `Must outlive request failure` },
-          ],
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        rejectLoad.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => load?.catch(() => undefined),
-            () => receipt?.catch(() => undefined),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`fail-stops when a buffered partial update cannot reconstruct its persisted baseline`, async () => {
-    const requestFailure = new Error(`incremental subset rejected`)
-    const baselineFailure = new Error(
-      `persisted baseline reconstruction failed`,
-    )
-    const adapter = createRecordingAdapter([
-      {
-        id: `shared`,
-        title: `Persisted baseline`,
-        detail: `required baseline field`,
-      },
-    ])
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw requestFailure
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-partial-baseline-failure`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let load: Promise<void> | undefined
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `partial baseline failure collection ready`,
-      )
-      adapter.loadResumeSnapshot = () => Promise.reject(baselineFailure)
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        loadEntered.promise,
-        `partial baseline failure load entered`,
-      )
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `shared`, title: `Partial update` },
-      })
-      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      void receipt.catch(() => undefined)
-      expect(observeSettlement(receipt).read()).toEqual({ status: `pending` })
-
-      rejectLoad.resolve()
-      await expect(
-        atPersistedOracleCheckpoint(load, `partial baseline load rejected`),
-      ).rejects.toBe(baselineFailure)
-      await expect(
-        atPersistedOracleCheckpoint(
-          receipt,
-          `partial baseline source receipt rejected`,
-        ),
-      ).rejects.toBe(baselineFailure)
-      expect({
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === baselineFailure,
-        publicRow: collection.get(`shared`),
-        durableRow: adapter.rows.get(`shared`),
-        durabilityCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        status: `crashed`,
-        exactPublicError: true,
-        publicRow: undefined,
-        durableRow: {
-          id: `shared`,
-          title: `Persisted baseline`,
-          detail: `required baseline field`,
-        },
-        durabilityCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          () => receipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`applies a partial upsert when the persisted snapshot proves the key absent`, async () => {
-    const requestFailure = new Error(`incremental subset rejected`)
-    const adapter = createRecordingAdapter()
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw requestFailure
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-missing-partial-baseline`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let load: Promise<void> | undefined
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await loadEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `missing`, title: `partial` },
-      })
-      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-      void receipt.catch(() => undefined)
-      rejectLoad.resolve()
-
-      await expect(load).rejects.toBe(requestFailure)
-      await receipt
-      expect({
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        publicRow: stripVirtualProps(collection.get(`missing`)),
-        durableRow: adapter.rows.get(`missing`),
-        durabilityCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        status: `ready`,
-        publicError: undefined,
-        publicRow: { id: `missing`, title: `partial` },
-        durableRow: { id: `missing`, title: `partial` },
-        durabilityCalls: 1,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          () => receipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects a transaction begun before hydration at its write cut`, async () => {
-    const requestFailure = new Error(`incremental subset rejected`)
-    const baseline: Todo = {
-      id: `shared`,
-      title: `Persisted baseline`,
-      detail: `required baseline field`,
-    }
-    const adapter = createRecordingAdapter([baseline])
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw requestFailure
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-begin-before-hydration`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let load: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      sourceParams.begin()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await loadEntered.promise
-
-      expect(() =>
-        sourceParams.write({
-          type: `update`,
-          value: { id: baseline.id, title: `Source update` },
-        }),
-      ).toThrow(`cannot cross a hydration cycle`)
-      expect(() => sourceParams.commit()).toThrow(
-        `cannot cross a hydration cycle`,
-      )
-      rejectLoad.resolve()
-
-      await expect(load).rejects.toBe(requestFailure)
-      expect({
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        publicRow: stripVirtualProps(collection.get(baseline.id)),
-        durableRow: adapter.rows.get(baseline.id),
-        recoverySnapshotCalls: adapter.loadResumeSnapshotCalls.filter(
-          ({ includeRows }) => includeRows === true,
-        ).length,
-      }).toEqual({
-        status: `ready`,
-        publicError: undefined,
-        publicRow: undefined,
-        durableRow: baseline,
-        recoverySnapshotCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      await cleanupPersistedOracle(
-        [() => load?.catch(() => undefined), () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`publishes a recovered baseline and dependent partial update atomically`, async () => {
-    const requestFailure = new Error(`incremental subset rejected`)
-    const baseline: Todo = {
-      id: `shared`,
-      title: `Persisted baseline`,
-      detail: `required baseline field`,
-    }
-    const expected: Todo = { ...baseline, title: `Source update` }
-    const adapter = createRecordingAdapter([baseline])
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw requestFailure
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-atomic-baseline-recovery`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const abortController = new AbortController()
-    const publicCuts: Array<Todo | undefined> = []
-    const subscription = collection.subscribeChanges((changes) => {
-      if (changes.some(({ key }) => key === baseline.id)) {
-        publicCuts.push(stripVirtualProps(collection.get(baseline.id)))
-        abortController.abort()
-      }
-    })
-    let load: Promise<void> | undefined
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await loadEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: baseline.id, title: expected.title },
-      })
-      receipt = Promise.resolve(
-        sourceParams.commit(abortController.signal),
-      ).then(() => undefined)
-      rejectLoad.resolve()
-
-      await expect(load).rejects.toBe(requestFailure)
-      await receipt
-      expect({
-        abortedFromPublication: abortController.signal.aborted,
-        publicCuts,
-        publicRow: stripVirtualProps(collection.get(baseline.id)),
-        durableRow: adapter.rows.get(baseline.id),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        abortedFromPublication: true,
-        publicCuts: [expected],
-        publicRow: expected,
-        durableRow: expected,
-        status: `ready`,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      subscription.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          () => receipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`delete`, `truncate`] as const)(
-    `treats a buffered %s prefix as authoritative absence for a partial upsert`,
-    async (prefix) => {
-      const requestFailure = new Error(`incremental subset rejected`)
-      const baseline: Todo = {
-        id: `shared`,
-        title: `Persisted baseline`,
-        detail: `required baseline field`,
-      }
-      const adapter = createRecordingAdapter([baseline])
-      const loadEntered = createEventGate()
-      const rejectLoad = createEventGate()
-      adapter.loadSubset = async () => {
-        loadEntered.resolve()
-        await rejectLoad.promise
-        throw requestFailure
-      }
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `request-local-${prefix}-partial-prefix`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            rowUpdateMode: `partial`,
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      let load: Promise<void> | undefined
-      let prefixReceipt: Promise<void> | undefined
-      let partialReceipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-
-      try {
-        await collection.stateWhenReady()
-        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-          () => undefined,
-        )
-        void load.catch(() => undefined)
-        await loadEntered.promise
-
-        sourceParams.begin()
-        if (prefix === `delete`) {
-          sourceParams.write({ type: `delete`, key: baseline.id })
-        } else {
-          sourceParams.truncate()
-        }
-        prefixReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void prefixReceipt.catch(() => undefined)
-
-        sourceParams.begin()
-        sourceParams.write({
-          type: `update`,
-          value: { id: baseline.id, title: `partial after ${prefix}` },
-        })
-        partialReceipt = Promise.resolve(sourceParams.commit()).then(
-          () => undefined,
-        )
-        void partialReceipt.catch(() => undefined)
-        rejectLoad.resolve()
-
-        await expect(load).rejects.toBe(requestFailure)
-        await prefixReceipt
-        await partialReceipt
-        expect({
-          status: collection.status,
-          publicError: collection._lifecycle.getSyncError(),
-          publicRow: collection.get(baseline.id),
-          durableRow: adapter.rows.get(baseline.id),
-          durableOrder: adapter.applyCommittedTxCalls.map(({ tx }) =>
-            tx.truncate ? `truncate` : tx.mutations[0]?.type,
-          ),
-        }).toEqual({
-          status: `ready`,
-          publicError: undefined,
-          publicRow: expect.objectContaining({
-            id: baseline.id,
-            title: `partial after ${prefix}`,
-          }),
-          durableRow: {
-            id: baseline.id,
-            title: `partial after ${prefix}`,
-          },
-          durableOrder: [prefix, `update`],
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        rejectLoad.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => load?.catch(() => undefined),
-            () => prefixReceipt?.catch(() => undefined),
-            () => partialReceipt?.catch(() => undefined),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it.each([`delete`, `truncate`] as const)(
-    `treats a same-transaction %s prefix as authoritative absence for a partial upsert`,
-    async (prefix) => {
-      const baseline: Todo = {
-        id: `shared`,
-        title: `Persisted baseline`,
-        detail: `required baseline field`,
-      }
-      const adapter = createRecordingAdapter([baseline])
-      const loadEntered = createEventGate()
-      const rejectLoad = createEventGate()
-      adapter.loadSubset = async () => {
-        loadEntered.resolve()
-        await rejectLoad.promise
-        throw new Error(`incremental subset rejected`)
-      }
-      let sourceParams!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `request-local-same-transaction-${prefix}-partial`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            rowUpdateMode: `partial`,
-            sync: (params) => {
-              sourceParams = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      let load: Promise<void> | undefined
-      let receipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-
-      try {
-        await collection.stateWhenReady()
-        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-          () => undefined,
-        )
-        void load.catch(() => undefined)
-        await loadEntered.promise
-
-        sourceParams.begin()
-        if (prefix === `delete`) {
-          sourceParams.write({ type: `delete`, key: baseline.id })
-        } else {
-          sourceParams.truncate()
-        }
-        sourceParams.write({
-          type: `update`,
-          value: { id: baseline.id, title: `partial after ${prefix}` },
-        })
-        receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
-        void receipt.catch(() => undefined)
-        rejectLoad.resolve()
-
-        await expect(load).rejects.toThrow(`incremental subset rejected`)
-        await receipt
-        expect({
-          status: collection.status,
-          publicRow: stripVirtualProps(collection.get(baseline.id)),
-          durableRow: adapter.rows.get(baseline.id),
-          durabilityCalls: adapter.applyCommittedTxCalls.length,
-          recoverySnapshotCalls: adapter.loadResumeSnapshotCalls.filter(
-            ({ includeRows }) => includeRows === true,
-          ).length,
-        }).toEqual({
-          status: `ready`,
-          publicRow: {
-            id: baseline.id,
-            title: `partial after ${prefix}`,
-          },
-          durableRow: {
-            id: baseline.id,
-            title: `partial after ${prefix}`,
-          },
-          durabilityCalls: 1,
-          recoverySnapshotCalls: 0,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        rejectLoad.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => load?.catch(() => undefined),
-            () => receipt?.catch(() => undefined),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`keeps fallback-snapshot admissions inside buffered baseline recovery`, async () => {
-    const rows: Array<Todo> = [
-      { id: `a`, title: `A baseline`, detail: `A required` },
-      { id: `b`, title: `B baseline`, detail: `B required` },
-    ]
-    const adapter = createRecordingAdapter(rows)
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    const fallbackEntered = createEventGate()
-    const releaseFallback = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw new Error(`incremental subset rejected`)
-    }
-    const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
-      fallbackEntered.resolve()
-      await releaseFallback.promise
-      return rows.map((value) => ({ key: value.id, value }))
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-fallback-admission`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let load: Promise<void> | undefined
-    const receipts: Array<Promise<void>> = []
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await loadEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `a`, title: `A source` },
-      })
-      receipts.push(
-        Promise.resolve(sourceParams.commit()).then(() => undefined),
-      )
-      receipts.forEach((receipt) => void receipt.catch(() => undefined))
-      rejectLoad.resolve()
-      await fallbackEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: `b`, title: `B source` },
-      })
-      const lateReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      receipts.push(lateReceipt)
-      void lateReceipt.catch(() => undefined)
-      expect(observeSettlement(lateReceipt).read()).toEqual({
-        status: `pending`,
-      })
-
-      releaseFallback.resolve()
-      await expect(load).rejects.toThrow(`incremental subset rejected`)
-      await Promise.all(receipts)
-      expect({
-        publicRows: [`a`, `b`].map((key) =>
-          stripVirtualProps(collection.get(key)),
-        ),
-        durableRows: [`a`, `b`].map((key) => adapter.rows.get(key)),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        publicRows: [
-          { id: `a`, title: `A source`, detail: `A required` },
-          { id: `b`, title: `B source`, detail: `B required` },
-        ],
-        durableRows: [
-          { id: `a`, title: `A source`, detail: `A required` },
-          { id: `b`, title: `B source`, detail: `B required` },
-        ],
-        status: `ready`,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      releaseFallback.resolve()
-      restoreBaselineRows()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not publish a fallback baseline for an aborted dependent update`, async () => {
-    const baseline: Todo = {
-      id: `shared`,
-      title: `Persisted baseline`,
-      detail: `required baseline field`,
-    }
-    const adapter = createRecordingAdapter([baseline])
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    const fallbackEntered = createEventGate()
-    const releaseFallback = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw new Error(`incremental subset rejected`)
-    }
-    const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
-      fallbackEntered.resolve()
-      await releaseFallback.promise
-      return [{ key: baseline.id, value: baseline }]
-    })
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-aborted-partial-baseline`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const publicEvents: Array<string> = []
-    const subscription = collection.subscribeChanges((changes) => {
-      publicEvents.push(
-        ...changes.map((change) => `${change.type}:${change.key}`),
-      )
-    })
-    const abortController = new AbortController()
-    let load: Promise<void> | undefined
-    let receipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await loadEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: baseline.id, title: `aborted partial` },
-      })
-      receipt = Promise.resolve(
-        sourceParams.commit(abortController.signal),
-      ).then(() => undefined)
-      void receipt.catch(() => undefined)
-      rejectLoad.resolve()
-      await fallbackEntered.promise
-      abortController.abort()
-      releaseFallback.resolve()
-
-      await expect(load).rejects.toThrow(`incremental subset rejected`)
-      await expect(receipt).rejects.toMatchObject({ name: `AbortError` })
-      expect({
-        publicEvents,
-        publicRow: collection.get(baseline.id),
-        durableRow: adapter.rows.get(baseline.id),
-        durabilityCalls: adapter.applyCommittedTxCalls.length,
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        publicEvents: [],
-        publicRow: undefined,
-        durableRow: baseline,
-        durabilityCalls: 0,
-        status: `ready`,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      releaseFallback.resolve()
-      restoreBaselineRows()
-      subscription.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          () => receipt?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`does not let a later fallback dependency preserve metadata deleted by a fresh insert`, async () => {
-    const baseline: Todo = {
-      id: `shared`,
-      title: `Persisted baseline`,
-      detail: `old detail`,
-    }
-    const adapter = createRecordingAdapter([baseline])
-    adapter.rowMetadata.set(baseline.id, { owner: `stale` })
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw new Error(`incremental subset rejected`)
-    }
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-insert-partial-metadata`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let load: Promise<void> | undefined
-    const receipts: Array<Promise<void>> = []
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      void load.catch(() => undefined)
-      await loadEntered.promise
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: baseline.id, title: `Fresh insert`, detail: `new detail` },
-      })
-      receipts.push(
-        Promise.resolve(sourceParams.commit()).then(() => undefined),
-      )
-      sourceParams.begin()
-      sourceParams.write({
-        type: `update`,
-        value: { id: baseline.id, title: `Later partial` },
-      })
-      receipts.push(
-        Promise.resolve(sourceParams.commit()).then(() => undefined),
-      )
-      receipts.forEach((receipt) => void receipt.catch(() => undefined))
-      rejectLoad.resolve()
-
-      await expect(load).rejects.toThrow(`incremental subset rejected`)
-      await Promise.all(receipts)
-      expect({
-        publicRow: stripVirtualProps(collection.get(baseline.id)),
-        durableRow: adapter.rows.get(baseline.id),
-        publicMetadata: sourceParams.metadata!.row.get(baseline.id),
-        durableMetadata: adapter.rowMetadata.get(baseline.id),
-      }).toEqual({
-        publicRow: {
-          id: baseline.id,
-          title: `Later partial`,
-          detail: `new detail`,
-        },
-        durableRow: {
-          id: baseline.id,
-          title: `Later partial`,
-          detail: `new detail`,
-        },
-        publicMetadata: undefined,
-        durableMetadata: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectLoad.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => load?.catch(() => undefined),
-          ...receipts.map((receipt) => () => receipt.catch(() => undefined)),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`preserves an overlapping subset demand when its predecessor fails`, async () => {
-    const failure = new Error(`failed demand is not active`)
-    const adapter = createRecordingAdapter()
-    const failedOptions: LoadSubsetOptions = { limit: 1 }
-    const replacementOptions: LoadSubsetOptions = { limit: 1 }
-    const firstLoadEntered = createEventGate()
-    const rejectFirstLoad = createEventGate()
-    const reloadCalls: Array<LoadSubsetOptions> = []
-    let initialCalls = 0
-    let reloading = false
-    adapter.loadSubset = async (_collectionId, requestedOptions) => {
-      if (reloading) {
-        reloadCalls.push(requestedOptions)
-      }
-      if (!reloading) {
-        initialCalls++
-        if (initialCalls === 1) {
-          firstLoadEntered.resolve()
-          await rejectFirstLoad.promise
-          throw failure
-        }
-      }
-      if (requestedOptions === failedOptions) {
-        return [
-          {
-            key: `phantom`,
-            value: { id: `phantom`, title: `Failed demand leaked` },
-          },
-        ]
-      }
-      return [
-        {
-          key: `replacement`,
-          value: {
-            id: `replacement`,
-            title: reloading ? `Replacement reloaded` : `Replacement initial`,
-          },
-        },
-      ]
-    }
-    const coordinator = createFailStopCoordinatorHarness(
-      `request-local-active-subset-identity`,
-    )
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-active-subset-identity`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let firstLoad: Promise<void> | undefined
-    let replacementLoad: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `active-subset identity collection ready`,
-      )
-      firstLoad = Promise.resolve(
-        collection._sync.loadSubset(failedOptions),
-      ).then(() => undefined)
-      void firstLoad.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        firstLoadEntered.promise,
-        `failed subset demand entered hydration`,
-      )
-      replacementLoad = Promise.resolve(
-        collection._sync.loadSubset(replacementOptions),
-      ).then(() => undefined)
-      void replacementLoad.catch(() => undefined)
-      expect(observeSettlement(replacementLoad).read()).toEqual({
-        status: `pending`,
-      })
-      rejectFirstLoad.resolve()
-      await expect(firstLoad).rejects.toBe(failure)
-      await atPersistedOracleCheckpoint(
-        replacementLoad,
-        `replacement subset loaded`,
-      )
-
-      reloading = true
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `reload-active-subsets`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await vi.waitFor(() =>
-        expect(stripVirtualProps(collection.get(`replacement`))).toEqual({
-          id: `replacement`,
-          title: `Replacement reloaded`,
-        }),
-      )
-
-      expect({
-        reloadCalls,
-        phantom: collection.get(`phantom`),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        reloadCalls: [replacementOptions],
-        phantom: undefined,
-        status: `ready`,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      rejectFirstLoad.resolve()
-      await cleanupPersistedOracle(
-        [
-          () => firstLoad?.catch(() => undefined),
-          () => replacementLoad?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`reports a persisted subset failure only to its requesting subscription`, async () => {
-    const failure = new Error(`requesting subscription failed exactly`)
-    const adapter = createRecordingAdapter([
-      { id: `cached`, title: `Shared cached row` },
-    ])
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    let calls = 0
-    adapter.loadSubset = (...args) => {
-      calls++
-      return calls === 1 ? Promise.reject(failure) : loadSubset(...args)
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `request-local-subscription-hydration-failure`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const failing = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    const healthy = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    const reported: Array<unknown> = []
-    failing.on(`loadSubset:error`, ({ error }) => reported.push(error))
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `subscription-isolation collection ready`,
-      )
-      failing.requestSnapshot({ optimizedOnly: false })
-      healthy.requestSnapshot({ optimizedOnly: false })
-      await flushAsyncWork()
-
-      expect({
-        reported,
-        failingError: failing.lastError,
-        healthyError: healthy.lastError,
-        failingStatus: failing.status,
-        healthyStatus: healthy.status,
-        collectionStatus: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
-        cached: stripVirtualProps(collection.get(`cached`)),
-      }).toEqual({
-        reported: [failure],
-        failingError: failure,
-        healthyError: undefined,
-        failingStatus: `ready`,
-        healthyStatus: `ready`,
-        collectionStatus: `ready`,
-        publicError: undefined,
-        cached: { id: `cached`, title: `Shared cached row` },
-      })
-
-      adapter.rows.set(`retry`, {
-        id: `retry`,
-        title: `Retry visible to both owners`,
-      })
-      failing.requestSnapshot({ optimizedOnly: false, refetch: true })
-      await flushAsyncWork()
-      expect(stripVirtualProps(collection.get(`retry`))).toEqual({
-        id: `retry`,
-        title: `Retry visible to both owners`,
-      })
-      expect(collection.status).toBe(`ready`)
-      expect(collection._lifecycle.getSyncError()).toBeUndefined()
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      failing.unsubscribe()
-      healthy.unsubscribe()
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`marks the collection errored and rejects later forced work after a hydration failure`, async () => {
-    const hydrationFailure = new Error(`later forced hydration failed`)
-    const adapter = createRecordingAdapter()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `later-forced-hydration-failure`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        persistence: { adapter },
-      }),
-    )
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `forced-hydration collection initially ready`,
-      )
-      expect(collection.status).toBe(`ready`)
-      adapter.loadSubset = () => Promise.reject(hydrationFailure)
-
-      await expect(
-        atPersistedOracleCheckpoint(
-          Promise.resolve(collection.utils.forceReloadSubset!({ limit: 1 })),
-          `later forced hydration rejected`,
-        ),
-      ).rejects.toBe(hydrationFailure)
-
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure)
-      expect([...collection.values()]).toEqual([])
-      expect(adapter.rows.size).toBe(0)
-      expect(adapter.applyCommittedTxCalls).toEqual([])
-
-      let laterAdapterCalls = 0
-      adapter.loadSubset = () => {
-        laterAdapterCalls++
-        return Promise.resolve([
-          {
-            key: `late-forced`,
-            value: { id: `late-forced`, title: `must not be admitted` },
-          },
-        ])
-      }
-      await expect(
-        atPersistedOracleCheckpoint(
-          Promise.resolve(collection.utils.forceReloadSubset!({ limit: 2 })),
-          `later forced subset work settled`,
-        ),
-      ).rejects.toBe(hydrationFailure)
-      expect({
-        laterAdapterCalls,
-        visible: collection.get(`late-forced`),
-        durable: adapter.rows.get(`late-forced`),
-        durabilityCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        laterAdapterCalls: 0,
-        visible: undefined,
-        durable: undefined,
-        durabilityCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects subset work admitted after a terminal hydration failure`, async () => {
-    const hydrationFailure = new Error(`terminal hydration failed`)
-    const adapter = createRecordingAdapter()
-    const coordinator = createFailStopCoordinatorHarness(
-      `terminal-hydration-rejects-later-work`,
-    )
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-hydration-rejects-later-work`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let hasPrimaryFailure = false
-    const demand = { limit: 1 }
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `terminal hydration collection initially ready`,
-      )
-      await collection._sync.loadSubset(demand)
-      adapter.loadSubset = () => Promise.reject(hydrationFailure)
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `terminal-hydration-rejects-later-work`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await vi.waitFor(() =>
-        expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure),
-      )
-      expect(collection.status).toBe(`crashed`)
-
-      let laterAdapterCalls = 0
-      adapter.loadSubset = () => {
-        laterAdapterCalls++
-        return Promise.resolve([
-          {
-            key: `late`,
-            value: { id: `late`, title: `must not be admitted` },
-          },
-        ])
-      }
-      const laterOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(collection._sync.loadSubset({ limit: 2 })).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `later subset work settled`,
-      )
-
-      expect({
-        status: laterOutcome.status,
-        exactReason:
-          laterOutcome.status === `rejected` &&
-          laterOutcome.reason === hydrationFailure,
-        laterAdapterCalls,
-        visible: collection.get(`late`),
-        durable: adapter.rows.get(`late`),
-        durabilityCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        status: `rejected`,
-        exactReason: true,
-        laterAdapterCalls: 0,
-        visible: undefined,
-        durable: undefined,
-        durabilityCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      collection._sync.unloadSubset(demand)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`rejects new source transactions after a terminal hydration failure`, async () => {
-    const hydrationFailure = new Error(`terminal source hydration failed`)
-    const adapter = createRecordingAdapter()
-    const coordinator = createFailStopCoordinatorHarness(
-      `terminal-hydration-rejects-new-source-work`,
-    )
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-hydration-rejects-new-source-work`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    let hasPrimaryFailure = false
-    const demand = { limit: 1 }
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `terminal source hydration collection initially ready`,
-      )
-      await collection._sync.loadSubset(demand)
-      adapter.loadSubset = () => Promise.reject(hydrationFailure)
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `terminal-hydration-rejects-new-source-work`,
-        latestRowVersion: 1,
-        requiresFullReload: true,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await vi.waitFor(() =>
-        expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure),
-      )
-      expect(collection.status).toBe(`crashed`)
-      expect(collection._lifecycle.getSyncError()).toBe(hydrationFailure)
-
-      remoteBegin!()
-      remoteWrite!({
-        type: `insert`,
-        value: { id: `late`, title: `must not be admitted` },
-      })
-      const lateOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(remoteCommit!()).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `late terminal hydration source receipt`,
-      )
-
-      expect({
-        receiptStatus: lateOutcome.status,
-        exactReceipt:
-          lateOutcome.status === `rejected` &&
-          lateOutcome.reason === hydrationFailure,
-        publicErrorIsHydration:
-          collection._lifecycle.getSyncError() === hydrationFailure,
-        status: collection.status,
-        lateVisible: collection.get(`late`),
-        lateDurable: adapter.rows.get(`late`),
-        applyCalls: adapter.applyCommittedTxCalls.length,
-      }).toEqual({
-        receiptStatus: `rejected`,
-        exactReceipt: true,
-        publicErrorIsHydration: true,
-        status: `crashed`,
-        lateVisible: undefined,
-        lateDurable: undefined,
-        applyCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      collection._sync.unloadSubset(demand)
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it.each([`throw`, `reject`] as const)(
-    `releases only transferred upstream ownership after a load %s`,
-    async (mode) => {
-      const failure = new Error(`failed upstream load`)
-      const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const peer: LoadSubsetOptions = { limit: 1 }
-      const failed: LoadSubsetOptions = { limit: 1 }
-      const leases = new Set<LoadSubsetOptions>()
-      let publish!: (title: string) => Promise<void>
-      const unload = vi.fn((options: LoadSubsetOptions) => {
-        leases.delete(options)
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `failed-load-ownership-${mode}`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: ({ begin, write, commit, markReady }) => {
-              publish = async (title) => {
-                if (!leases.has(peer)) return
-                begin()
-                write({
-                  type: collection.has(`live`) ? `update` : `insert`,
-                  value: { id: `live`, title },
-                })
-                await commit()
-              }
-              markReady()
-              return {
-                loadSubset: (options) => {
-                  if (options === failed && mode === `throw`) throw failure
-                  // Returning a promise transfers the ongoing lease, even if
-                  // fetching its initial snapshot subsequently fails.
-                  leases.add(options)
-                  return options === failed ? Promise.reject(failure) : true
-                },
-                unloadSubset: unload,
-              }
-            },
-          },
-          persistence: { adapter: createRecordingAdapter() },
-        }),
-      )
-      collection.startSyncImmediate()
-      try {
-        await collection._sync.loadSubset(peer)
-        await expect(collection._sync.loadSubset(failed)).rejects.toBe(failure)
-        expect(leases.has(failed)).toBe(mode === `reject`)
-        collection._sync.unloadSubset(failed)
-        expect(unload.mock.calls.map(([options]) => options)).toEqual(
-          mode === `reject` ? [failed] : [],
-        )
-        expect(leases).toEqual(new Set([peer]))
-        await publish(`Peer still live`)
-        expect(collection.get(`live`)?.title).toBe(`Peer still live`)
-        collection._sync.unloadSubset(peer)
-        expect(leases.size).toBe(0)
-        await publish(`Must not arrive`)
-        expect(collection.get(`live`)?.title).toBe(`Peer still live`)
-      } finally {
-        warn.mockRestore()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`does not mark a demand hydrated after its last acquisition leaves mid-read`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `one` },
-      { id: `2`, title: `two` },
-      { id: `3`, title: `three` },
-    ])
-    const readSubset = adapter.loadSubset
-    let releaseRead!: () => void
-    let enterRead!: () => void
-    const readGate = new Promise<void>((resolve) => {
-      releaseRead = resolve
-    })
-    const readEntered = new Promise<void>((resolve) => {
-      enterRead = resolve
-    })
-    let blockNextRead = true
-    adapter.loadSubset = async (...args) => {
-      if (blockNextRead) {
-        blockNextRead = false
-        enterRead()
-        await readGate
-      }
-      return readSubset(...args)
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `released-mid-read`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true, unloadSubset: () => {} }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.startSyncImmediate()
-
-    try {
-      const first: LoadSubsetOptions = { limit: 3 }
-      const pending = collection._sync.loadSubset(first)
-      await readEntered
-      collection._sync.unloadSubset(first)
-      releaseRead()
-      await pending
-
-      const reacquired = collection._sync.loadSubset({ limit: 3 })
-      expect(reacquired).not.toBe(true)
-      await reacquired
-      expect(collection.get(`3`)).toBeDefined()
-    } finally {
-      releaseRead()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not answer a registered but unread demand synchronously`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `one` }])
-    const readSubset = adapter.loadSubset
-    let releaseRead!: () => void
-    let enterRead!: () => void
-    const readGate = new Promise<void>((resolve) => {
-      releaseRead = resolve
-    })
-    const readEntered = new Promise<void>((resolve) => {
-      enterRead = resolve
-    })
-    let blockNextRead = true
-    adapter.loadSubset = async (...args) => {
-      if (blockNextRead) {
-        blockNextRead = false
-        enterRead()
-        await readGate
-      }
-      return readSubset(...args)
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `registered-before-read`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true, unloadSubset: () => {} }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.startSyncImmediate()
-
-    try {
-      const first = collection._sync.loadSubset({ limit: 1 })
-      await readEntered
-      const second = collection._sync.loadSubset({ limit: 1 })
-      expect(second).not.toBe(true)
-      releaseRead()
-      await Promise.all([first, second])
-      expect(collection.get(`1`)).toBeDefined()
-    } finally {
-      releaseRead()
-      await collection.cleanup()
-    }
-  })
-
-  it(`stops ensuring an aborted coordinator acquisition`, async () => {
-    vi.useFakeTimers()
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const abortError = Object.assign(new Error(`abort`), { name: `AbortError` })
-    const ensured: Array<LoadSubsetOptions> = []
-    const first: LoadSubsetOptions = { limit: 1 }
-    const second: LoadSubsetOptions = { limit: 1 }
-    const coordinator = createCoordinatorHarness()
-    coordinator.requestEnsureRemoteSubset = (_id, options) => {
-      ensured.push(options)
-      return options === second ? Promise.reject(abortError) : Promise.resolve()
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `fast-path-abort`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: () => true, unloadSubset: () => {} }
-          },
-        },
-        persistence: {
-          adapter: createRecordingAdapter([{ id: `1`, title: `one` }]),
-          coordinator,
-        },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await collection._sync.loadSubset(first)
-      const result = await Promise.resolve(
-        collection._sync.loadSubset(second),
-      ).then(
-        () => `ready`,
-        (error: unknown) => error,
-      )
-      expect(result).toBe(abortError)
-
-      const callsBeforeRetry = ensured.filter(
-        (options) => options === second,
-      ).length
-      await vi.advanceTimersByTimeAsync(500)
-      expect(ensured.filter((options) => options === second)).toHaveLength(
-        callsBeforeRetry,
-      )
-    } finally {
-      await collection.cleanup()
-      warning.mockRestore()
-      vi.useRealTimers()
-    }
-  })
-
-  it(`does not release or acquire an upstream lease cancelled during hydration`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrate = adapter.loadSubset
-    let blocked = false
-    let enterHydration!: () => void
-    let finishHydration!: () => void
-    const entered = new Promise<void>((resolve) => {
-      enterHydration = resolve
-    })
-    const gate = new Promise<void>((resolve) => {
-      finishHydration = resolve
-    })
-    adapter.loadSubset = async (...args) => {
-      if (blocked) {
-        enterHydration()
-        await gate
-      }
-      return hydrate(...args)
-    }
-    let leases = 0
-    let loads = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `cancelled-hydration-lease`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                leases++
-                return true
-              },
-              unloadSubset: () => {
-                leases--
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.startSyncImmediate()
-    const first: LoadSubsetOptions = { limit: 1 }
-    const second: LoadSubsetOptions = { limit: 2 }
-    try {
-      await collection._sync.loadSubset(first)
-      expect(leases).toBe(1)
-      blocked = true
-      const pending = collection._sync.loadSubset(second)
-      await entered
-      collection._sync.unloadSubset(second)
-      expect(leases).toBe(1)
-      finishHydration()
-      await pending
-      expect(loads).toBe(1)
-      collection._sync.unloadSubset(first)
-      expect(leases).toBe(0)
-    } finally {
-      finishHydration()
-      await collection.cleanup()
-    }
-  })
-
-  it.each([
-    {
-      action: `retain` as const,
-      expectedEnsures: 1,
-      expectedReleases: 0,
-    },
-    {
-      action: `unload` as const,
-      expectedEnsures: 0,
-      expectedReleases: 1,
-    },
-    {
-      action: `abort` as const,
-      expectedEnsures: 0,
-      expectedReleases: 0,
-    },
-  ])(
-    `acquires coordinator demand after hydration iff it remains active: $action`,
-    async ({ action, expectedEnsures, expectedReleases }) => {
-      const adapter = createRecordingAdapter()
-      const hydrate = adapter.loadSubset
-      let enterHydration!: () => void
-      let finishHydration!: () => void
-      const entered = new Promise<void>((resolve) => {
-        enterHydration = resolve
-      })
-      const gate = new Promise<void>((resolve) => {
-        finishHydration = resolve
-      })
-      adapter.loadSubset = async (...args) => {
-        enterHydration()
-        await gate
-        return hydrate(...args)
-      }
-      const ensure = vi.fn(async () => {})
-      const release = vi.fn(async () => {})
-      const coordinator = createCoordinatorHarness()
-      coordinator.isLeader = () => false
-      coordinator.requestEnsureRemoteSubset = ensure
-      coordinator.requestReleaseRemoteSubset = release
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `coordinator-hydration-demand-${action}`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {}
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const controller = new AbortController()
-      const options: LoadSubsetOptions = {
-        limit: 1,
-        signal: controller.signal,
-      }
-
-      try {
-        collection.startSyncImmediate()
-        const pending = collection._sync.loadSubset(options)
-        await entered
-        if (action === `unload`) collection._sync.unloadSubset(options)
-        if (action === `abort`) controller.abort()
-        finishHydration()
-        // An explicit abort of a retained demand now rejects promptly. The
-        // earlier law treated it as a fulfilled load, even though hydration
-        // must still suppress the remote acquisition. Release stays quiet.
-        if (action === `abort`) {
-          await expect(pending).rejects.toMatchObject({ name: `AbortError` })
-        } else {
-          await pending
-        }
-
-        // The earlier history law cancelled only after remote acquisition had
-        // begun. Holding the real adapter hydration seam exposes the distinct
-        // post-hydration transfer boundary. `retain` is the hostile control:
-        // the cancellation guard must not suppress live demand.
-        expect({
-          ensures: ensure.mock.calls.length,
-          releases: release.mock.calls.length,
-        }).toEqual({
-          ensures: expectedEnsures,
-          releases: expectedReleases,
-        })
-      } finally {
-        finishHydration()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`hydrates a multiprocess follower locally while only the elected owner acquires remote demand`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `persisted`, title: `Persisted follower row` },
-    ])
-    let releaseRemoteLoad = (): void => {}
-    const remoteLoadGate = new Promise<void>((resolve) => {
-      releaseRemoteLoad = resolve
-    })
-    let registeredOwner: RemoteSubsetOwner | undefined
-    const ensureRemote = vi.fn(() => remoteLoadGate)
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `follower-node`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => false,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      requestEnsureRemoteSubset: ensureRemote,
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: (_collectionId, owner) => {
-        registeredOwner = owner
-        return () => {
-          if (registeredOwner === owner) registeredOwner = undefined
-        }
-      },
-    }
-    const followerUpstreamLoad = vi.fn(() => Promise.resolve())
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `multiprocess-follower-subset`,
-        getKey: (todo) => todo.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: followerUpstreamLoad,
-              unloadSubset: vi.fn(),
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const options: LoadSubsetOptions = { limit: 1 }
-
-    try {
-      collection.startSyncImmediate()
-      let settled = false
-      const load = Promise.resolve(collection._sync.loadSubset(options)).then(
-        () => {
-          settled = true
-        },
-      )
-
-      await vi.waitFor(() => {
-        expect(adapter.loadSubsetCalls.length).toBeGreaterThan(0)
-        expect(ensureRemote).toHaveBeenCalledWith(
-          `multiprocess-follower-subset`,
-          options,
-        )
-      })
-      const persistedRow = collection.get(`persisted`)
-      expect({
-        persistedRow: persistedRow
-          ? { id: persistedRow.id, title: persistedRow.title }
-          : undefined,
-        followerUpstreamCalls: followerUpstreamLoad.mock.calls.length,
-        registeredOwner: registeredOwner !== undefined,
-        settled,
-      }).toEqual({
-        persistedRow: { id: `persisted`, title: `Persisted follower row` },
-        followerUpstreamCalls: 0,
-        registeredOwner: true,
-        settled: false,
-      })
-
-      releaseRemoteLoad()
-      await load
-      expect({
-        routedEnsures: ensureRemote.mock.calls.length,
-        followerUpstreamCalls: followerUpstreamLoad.mock.calls.length,
-      }).toEqual({
-        routedEnsures: 1,
-        followerUpstreamCalls: 0,
-      })
-    } finally {
-      releaseRemoteLoad()
-      await collection.cleanup()
-    }
-  })
-
-  it.each([`abort`, `signal-abort`, `release`, `offline`] as const)(
-    `handles remote ensure after %s without resurrecting cancelled demand`,
-    async (action) => {
-      vi.useFakeTimers()
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const failure = Object.assign(new Error(action), {
-        name: action === `abort` ? `AbortError` : `Error`,
-      })
-      const ensure = vi.fn(async () => {
-        throw failure
-      })
-      const followerUpstreamLoad = vi.fn(async () => {
-        throw new Error(`follower-local source must not own remote demand`)
-      })
-      const coordinator: PersistedCollectionCoordinator = {
-        getNodeId: () => `cancel-ensure`,
-        subscribe: () => () => {},
-        publish: () => {},
-        isLeader: () => true,
-        ensureLeadership: async () => {},
-        requestEnsurePersistedIndex: async () => {},
-        requestApplyCommittedTx: (_collectionId, tx) =>
-          Promise.resolve({
-            type: `rpc:applyCommittedTx:res`,
-            rpcId: tx.txId,
-            ok: true,
-            term: tx.term,
-            seq: tx.seq,
-            latestRowVersion: tx.rowVersion,
-          }),
-        requestEnsureRemoteSubset: ensure,
-        // This fixture isolates ensure retry/cancellation, not ownership.
-        requestReleaseRemoteSubset: async () => {},
-        registerRemoteSubsetOwner: () => () => {},
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `cancel-ensure-${action}`,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {
-                loadSubset: followerUpstreamLoad,
-              }
-            },
-          },
-          persistence: { adapter: createRecordingAdapter(), coordinator },
-        }),
-      )
-      const controller = new AbortController()
-      const options: LoadSubsetOptions = {
-        limit: 1,
-        ...(action === `signal-abort` ? { signal: controller.signal } : {}),
-      }
-      try {
-        collection.startSyncImmediate()
-        const result = await Promise.resolve(
-          collection._sync.loadSubset(options),
-        ).then(
-          () => `ready`,
-          (error: unknown) => error,
-        )
-        if (action === `release`) collection._sync.unloadSubset(options)
-        if (action === `signal-abort`) controller.abort()
-        const callsBeforeRetry = ensure.mock.calls.length
-        await vi.advanceTimersByTimeAsync(200)
-        // The old matrix supplied an AbortError or explicitly unloaded demand,
-        // but never aborted an already-queued retry. The signal row owns that
-        // distinct boundary; offline is its hostile liveness control.
-        expect(result).toBe(failure)
-        expect(followerUpstreamLoad).not.toHaveBeenCalled()
-        if (action === `offline`) {
-          expect(ensure.mock.calls.length).toBeGreaterThan(callsBeforeRetry)
-        } else {
-          expect(ensure).toHaveBeenCalledTimes(callsBeforeRetry)
-        }
-      } finally {
-        await collection.cleanup()
-        warning.mockRestore()
-        vi.useRealTimers()
-      }
-    },
-  )
-
-  // Remote admission must validate without constructing a discarded wire
-  // snapshot. The authorized work bound is at most one detached payload copy per
-  // coordinator attempt, and none when hydration retires the demand first.
-  // This extends the persisted owner with construction work, not elapsed time.
-  // The controlled coordinator calls the real wire encoder; browser/Electron
-  // owners separately establish actual transport and local lifecycle delivery.
-  it.sequential.each(
-    [
-      `follower`,
-      `leader-to-follower`,
-      `retry`,
-      `abort`,
-      `release`,
-      `recovery`,
-    ].flatMap((routing) => [0, 1, 33].map((size) => ({ routing, size }))),
-  )(
-    `copies a wire payload only for a coordinator attempt / $routing / $size bytes`,
-    async ({ routing, size }) => {
-      const id = `wire-copy-work-${routing}-${size}`
-      const adapter = createRecordingAdapter()
-      const coordinator = createFailStopCoordinatorHarness(id)
-      let leader = routing === `leader-to-follower` || routing === `recovery`
-      coordinator.isLeader = () => leader
-      const hydrationStarted = createDeferred()
-      const hydrationGate = createDeferred()
-      const retryFinished = createDeferred()
-      const holdHydration = [`leader-to-follower`, `abort`, `release`].includes(
-        routing,
-      )
-      if (holdHydration) {
-        const hydrate = adapter.loadSubset
-        adapter.loadSubset = async (...args) => {
-          hydrationStarted.resolve()
-          await hydrationGate.promise
-          return hydrate(...args)
-        }
-      }
-      const buffer = new ArrayBuffer(size)
-      new Uint8Array(buffer)[0] = 7
-      const label = `wire-copy-work-${routing}-${size}`
-      const literal = Object.freeze({
-        label,
-        buffer,
-        view: new Uint8Array(buffer),
-      })
-      const controller = new AbortController()
-      const options: LoadSubsetOptions = {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`payload`]),
-          new IR.Value(literal),
-        ]),
-        signal: controller.signal,
-      }
-      const snapshots: Array<
-        ReturnType<typeof toTransportedLoadSubsetOptions>
-      > = []
-      const offline = new Error(`transient transport failure`)
-      coordinator.requestEnsureRemoteSubset = (_id, request) => {
-        expect(request).toBe(options)
-        snapshots.push(toTransportedLoadSubsetOptions(request))
-        if (routing === `retry` && snapshots.length === 1) {
-          return Promise.reject(offline)
-        }
-        retryFinished.resolve()
-        return Promise.resolve()
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {}
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      // Track descendants too: copying a prepared copy is still duplicate work.
-      // The positive control fails if the encoder stops using this copy seam.
-      const buffers = new WeakSet([buffer])
-      const slice = ArrayBuffer.prototype.slice
-      let copies = 0
-      const copy = vi
-        .spyOn(ArrayBuffer.prototype, `slice`)
-        .mockImplementation(function (this: ArrayBuffer, start, end) {
-          const result = slice.call(this, start, end)
-          if (buffers.has(this)) {
-            buffers.add(result)
-            copies++
-          }
-          return result
-        })
-      const defineProperty = Object.defineProperty
-      let recordCopies = 0
-      const recordCopy = vi
-        .spyOn(Object, `defineProperty`)
-        .mockImplementation((target, key, descriptor) => {
-          if (key === `label` && descriptor.value === label) recordCopies++
-          return defineProperty(target, key, descriptor)
-        })
-      let hasPrimaryFailure = false
-      try {
-        toTransportedLoadSubsetOptions(options)
-        expect({ copies, recordCopies }).toEqual({ copies: 1, recordCopies: 1 })
-        copies = 0
-        recordCopies = 0
-        collection.startSyncImmediate()
-        await flushAsyncWork()
-        const load = Promise.resolve(collection._sync.loadSubset(options))
-        if (holdHydration) {
-          await hydrationStarted.promise
-          if (routing === `leader-to-follower`) leader = false
-          if (routing === `abort`) controller.abort()
-          if (routing === `release`) collection._sync.unloadSubset(options)
-          hydrationGate.resolve()
-        }
-        if (routing === `retry`) {
-          await expect(load).rejects.toBe(offline)
-          await retryFinished.promise
-        } else if (routing === `abort`) {
-          // Aborting a retained demand rejects rather than reporting a
-          // completed load; the transport-attempt prediction remains zero.
-          await expect(load).rejects.toMatchObject({ name: `AbortError` })
-        } else {
-          await load
-        }
-        if (routing === `recovery`) {
-          expect(snapshots).toHaveLength(0)
-          leader = false
-          coordinator.emit({
-            type: `tx:committed`,
-            term: 1,
-            seq: 2,
-            txId: `gap`,
-            latestRowVersion: 2,
-            changedRows: [],
-            deletedKeys: [],
-            requiresFullReload: true,
-          })
-          await retryFinished.promise
-        }
-        // The independent schedule predicts the number of transport attempts.
-        // At settlement, each snapshot must retain its bytes and shared backing
-        // buffer after the caller changes its input. Identity remains local.
-        const attempts =
-          routing === `retry`
-            ? 2
-            : routing === `abort` || routing === `release`
-              ? 0
-              : 1
-        expect(snapshots).toHaveLength(attempts)
-        new Uint8Array(buffer)[0] = 99
-        for (const snapshot of snapshots) {
-          const expression = snapshot.where
-          expect(expression?.type).toBe(`func`)
-          if (expression?.type !== `func`)
-            throw new Error(`missing wire predicate`)
-          const value = expression.args[1]
-          expect(value?.type).toBe(`val`)
-          if (value?.type !== `val`) throw new Error(`missing wire literal`)
-          const received = value.value as typeof literal
-          expect(received).not.toBe(literal)
-          expect(received.label).toBe(label)
-          expect(received.buffer).not.toBe(buffer)
-          expect(received.view.buffer).toBe(received.buffer)
-          expect(Array.from(received.view)).toEqual(
-            Array.from({ length: size }, (_, index) => (index === 0 ? 7 : 0)),
-          )
-          expect(snapshot).not.toHaveProperty(`signal`)
-        }
-        expect(options.signal).toBe(controller.signal)
-        expect(copies).toBeLessThanOrEqual(attempts)
-        expect(recordCopies).toBeLessThanOrEqual(attempts)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        hydrationGate.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => copy.mockRestore(),
-            () => recordCopy.mockRestore(),
-            () => warning.mockRestore(),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  // Wire-domain rejection precedes admission to the remote-demand retry path.
-  // Ownerless leaders can become followers while hydration waits; string
-  // controls must dispatch exactly once, while native input never dispatches.
-  // Existing transient-failure histories below retain retry as a separate law.
-  it.each([
-    [`Instant`, `immediate`],
-    [`PlainDate`, `immediate`],
-    [`Instant`, `leader-to-follower`],
-    [`PlainDate`, `leader-to-follower`],
-    [`string`, `immediate`],
-    [`string`, `leader-to-follower`],
-  ] as const)(
-    `applies wire admission before coordinator dispatch / %s / %s`,
-    async (kind, routing) => {
-      const id = `native-wire-${kind}-${routing}`
-      const adapter = createRecordingAdapter()
-      const coordinator = createFailStopCoordinatorHarness(id)
-      const hydrationStarted = createDeferred()
-      const hydrationGate = createDeferred()
-      let isLeader = true
-      coordinator.isLeader = () => isLeader
-      if (routing === `leader-to-follower`) {
-        const hydrate = adapter.loadSubset
-        adapter.loadSubset = async (...args) => {
-          hydrationStarted.resolve()
-          await hydrationGate.promise
-          return hydrate(...args)
-        }
-      }
-      const ensure = vi.fn(
-        (_collectionId: string, options: LoadSubsetOptions) => {
-          toTransportedLoadSubsetOptions(options)
-          return Promise.resolve()
-        },
-      )
-      coordinator.requestEnsureRemoteSubset = ensure
-      const loadSubset = vi.fn()
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return routing === `immediate` ? { loadSubset } : {}
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      try {
-        collection.startSyncImmediate()
-        await flushAsyncWork()
-        const value =
-          kind === `Instant`
-            ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-            : kind === `PlainDate`
-              ? Temporal.PlainDate.from(`2026-01-02`)
-              : `2026-01-02`
-        const options: LoadSubsetOptions = {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`stamp`]),
-            new IR.Value(value),
-          ]),
-        }
-        const load = Promise.resolve().then(async () => {
-          await collection._sync.loadSubset(options)
-        })
-        if (routing === `leader-to-follower`) {
-          await hydrationStarted.promise
-          isLeader = false
-          hydrationGate.resolve()
-        }
-        if (kind === `string`) {
-          await expect(load).resolves.toBeUndefined()
-        } else {
-          await expect(load).rejects.toMatchObject({
-            name: `RemoteSubsetWireValueError`,
-          })
-        }
-        await flushAsyncWork(120)
-        expect(ensure).toHaveBeenCalledTimes(kind === `string` ? 1 : 0)
-        expect(loadSubset).not.toHaveBeenCalled()
-        expect(coordinator.remoteReleaseCalls).toEqual([])
-      } finally {
-        hydrationGate.resolve()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A completed local acquisition remains active across a later role change.
-  // Gap recovery must validate that retained demand before retry admission.
-  it.each([`Instant`, `PlainDate`, `string`] as const)(
-    `validates retained demand after local success and follower recovery / %s`,
-    async (kind) => {
-      const id = `native-post-load-${kind}`
-      const adapter = createRecordingAdapter()
-      const coordinator = createFailStopCoordinatorHarness(id)
-      let leader = true
-      coordinator.isLeader = () => leader
-      const ensure = vi.fn((_id: string, options: LoadSubsetOptions) => {
-        toTransportedLoadSubsetOptions(options)
-        return Promise.resolve()
-      })
-      coordinator.requestEnsureRemoteSubset = ensure
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {}
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      try {
-        collection.startSyncImmediate()
-        await flushAsyncWork()
-        const value =
-          kind === `Instant`
-            ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-            : kind === `PlainDate`
-              ? Temporal.PlainDate.from(`2026-01-02`)
-              : `2026-01-02`
-        const options: LoadSubsetOptions = {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`stamp`]),
-            new IR.Value(value),
-          ]),
-        }
-        await collection._sync.loadSubset(options)
-        expect(ensure).not.toHaveBeenCalled()
-        leader = false
-        coordinator.emit({
-          type: `tx:committed`,
-          term: 1,
-          seq: 2,
-          txId: `gap`,
-          latestRowVersion: 2,
-          changedRows: [],
-          deletedKeys: [],
-          requiresFullReload: true,
-        })
-        await flushAsyncWork()
-        if (kind === `string`) {
-          expect(collection.status).toBe(`ready`)
-          expect(ensure).toHaveBeenCalledTimes(1)
-        } else {
-          expect(collection.status).toBe(`crashed`)
-          await expect(
-            Promise.resolve().then(async () => {
-              await collection._sync.loadSubset(options)
-            }),
-          ).rejects.toMatchObject({ name: `RemoteSubsetWireValueError` })
-          expect(ensure).not.toHaveBeenCalled()
-        }
-      } finally {
-        await collection.cleanup()
-        warning.mockRestore()
-      }
-    },
-  )
-
-  // M7 selects Collection-wide fail-stop for failed fallback gap recovery.
-  // Admission is ordered: a valid prefix may already be in flight, but a
-  // retained invalid demand terminates the run and fences every later demand.
-  // Abort cancels admission without retiring its lease; release retires it.
-  // This bounded model names two demands independently of runtime queues.
-  // It judges dispatch coverage, not retry-attempt multiplicity. Successful
-  // pullSince replay and real-host election timing have separate owners.
-  it.each(
-    ([`Instant`, `PlainDate`, `string`] as const).flatMap((kind) =>
-      ([`candidate-first`, `candidate-last`] as const).flatMap((order) =>
-        ([`retained`, `aborted`, `released`] as const).map((lifetime) => ({
-          kind,
-          order,
-          lifetime,
-        })),
-      ),
-    ),
-  )(
-    `preserves the recovery failure boundary for mixed demands / $kind / $order / $lifetime`,
-    async ({ kind, order, lifetime }) => {
-      const terminal = kind !== `string` && lifetime === `retained`
-      const expectedDispatches =
-        terminal && order === `candidate-first`
-          ? []
-          : lifetime !== `retained` || terminal
-            ? [`sibling`]
-            : [`candidate`, `sibling`]
-      const id = `mixed-recovery-${kind}-${order}-${lifetime}`
-      const adapter = createRecordingAdapter()
-      const coordinator = createFailStopCoordinatorHarness(id)
-      let leader = true
-      coordinator.isLeader = () => leader
-      const controller = new AbortController()
-      const value =
-        kind === `Instant`
-          ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-          : kind === `PlainDate`
-            ? Temporal.PlainDate.from(`2026-01-02`)
-            : `2026-01-02`
-      const candidate: LoadSubsetOptions = {
-        signal: controller.signal,
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`stamp`]),
-          new IR.Value(value),
-        ]),
-      }
-      const sibling: LoadSubsetOptions = { limit: 1 }
-      const demands =
-        order === `candidate-first`
-          ? [candidate, sibling]
-          : [sibling, candidate]
-      const remoteSettlement = createEventGate()
-      // Observe attempted dispatch before the transport settles. A late
-      // rejection after fail-stop must not resurrect the valid prefix's retry.
-      const attempts: Array<LoadSubsetOptions> = []
-      coordinator.requestEnsureRemoteSubset = (_id, options) => {
-        attempts.push(options)
-        toTransportedLoadSubsetOptions(options)
-        return remoteSettlement.promise
-      }
-      const errorReported = createEventGate()
-      const reported: Array<unknown> = []
-      let reentrantFailure: Promise<unknown> | undefined
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {}
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      const crash = collection._lifecycle.crash.bind(collection._lifecycle)
-      const report = vi
-        .spyOn(collection._lifecycle, `crash`)
-        .mockImplementation((error) => {
-          reported.push(error)
-          // Invoke while the error is being reported, before core marks the
-          // Collection failed. The runtime must already reject this sibling.
-          reentrantFailure = Promise.resolve(
-            collection._sync.loadSubset(sibling),
-          ).catch((reason: unknown) => reason)
-          crash(error)
-          errorReported.resolve()
-        })
-      let hasPrimaryFailure = false
-      try {
-        await collection.stateWhenReady()
-        for (const demand of demands) await collection._sync.loadSubset(demand)
-        expect(attempts).toEqual([])
-        if (lifetime === `aborted`) controller.abort()
-        if (lifetime === `released`) collection._sync.unloadSubset(candidate)
-        leader = false
-        const emitGap = (seq: number) =>
-          coordinator.emit({
-            type: `tx:committed`,
-            term: 1,
-            seq,
-            txId: `gap-${seq}`,
-            latestRowVersion: seq,
-            changedRows: [],
-            deletedKeys: [],
-            requiresFullReload: true,
-          })
-        emitGap(2)
-        // Recording-adapter I/O is immediate. Drain the turn while transport
-        // remains held; this is not a real-host timing or latency assertion.
-        await flushAsyncWork()
-        expect(collection.status).toBe(terminal ? `crashed` : `ready`)
-        if (terminal) {
-          await atPersistedOracleCheckpoint(
-            errorReported.promise,
-            `mixed recovery error reported`,
-          )
-        } else {
-          // Successful remote work may drain serially. Demand coverage is
-          // required after the prefix settles, not while it remains held.
-          remoteSettlement.resolve()
-          await flushAsyncWork()
-        }
-        const names = attempts.map((options) => {
-          expect(demands).toContain(options)
-          return options === candidate ? `candidate` : `sibling`
-        })
-        expect([...new Set(names)].sort()).toEqual(
-          expectedDispatches.slice().sort(),
-        )
-        const failure = collection._lifecycle.getSyncError()
-        if (terminal) {
-          expect(failure).toMatchObject({ name: `RemoteSubsetWireValueError` })
-          expect(reported).toHaveLength(1)
-          expect(reported[0]).toBe(failure)
-          await expect(reentrantFailure).resolves.toBe(failure)
-          const loads = adapter.loadSubsetCalls.length
-          const dispatched = attempts.length
-          vi.useFakeTimers()
-          if (dispatched > 0) {
-            remoteSettlement.reject(new Error(`late transport failure`))
-          } else {
-            remoteSettlement.resolve()
-          }
-          await vi.advanceTimersByTimeAsync(0)
-          emitGap(3)
-          emitGap(4)
-          await vi.advanceTimersByTimeAsync(1_000)
-          await expect(
-            Promise.resolve(collection._sync.loadSubset(sibling)),
-          ).rejects.toBe(failure)
-          expect(adapter.loadSubsetCalls).toHaveLength(loads)
-          expect(attempts).toHaveLength(dispatched)
-          expect(reported).toHaveLength(1)
-          vi.useRealTimers()
-        } else {
-          expect(failure).toBeUndefined()
-          expect(reported).toEqual([])
-        }
-        // Every retained lease remains releasable, including after abort or
-        // Collection failure. Compare object identity, not structural equality.
-        for (const demand of demands) {
-          if (lifetime !== `released` || demand !== candidate) {
-            collection._sync.unloadSubset(demand)
-          }
-        }
-        const releases =
-          lifetime === `released` ? [candidate, sibling] : demands
-        expect(coordinator.remoteReleaseCalls).toHaveLength(releases.length)
-        releases.forEach((options, index) => {
-          expect(coordinator.remoteReleaseCalls[index]).toBe(options)
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        vi.useRealTimers()
-        remoteSettlement.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => report.mockRestore(),
-            () => collection.cleanup(),
-            () => warning.mockRestore(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`retries queued remote subset ensure after transient failures`, async () => {
-    const adapter = createRecordingAdapter()
-    let ensureCalls = 0
-    const offline = new Error(`offline`)
-
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `retry-node`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => true,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      requestEnsureRemoteSubset: async () => {
-        ensureCalls++
-        if (ensureCalls === 1) {
-          throw offline
-        }
-      },
-      // This fixture isolates ensure retry behavior, not ownership.
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-retry`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { loadSubset: vi.fn() }
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    collection.startSyncImmediate()
-    await flushAsyncWork()
-
-    const firstResult = await Promise.resolve(
-      (collection as any)._sync.loadSubset({ limit: 1 }),
-    ).then(
-      () => `ready`,
-      (error: unknown) => error,
-    )
-    await flushAsyncWork(120)
-
-    expect(firstResult).toBe(offline)
-    expect(ensureCalls).toBeGreaterThanOrEqual(2)
-  })
-
-  it(`does not route remote demand from an ownerless elected leader`, async () => {
-    const ensure = vi.fn(async () => {
-      throw new Error(`no remote subset owner registered`)
-    })
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `ownerless-node`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => true,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      requestEnsureRemoteSubset: ensure,
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `ownerless-on-demand-source`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter: createRecordingAdapter(),
-          coordinator,
-        },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await flushAsyncWork()
-
-      await expect(
-        Promise.resolve(collection._sync.loadSubset({ limit: 1 })),
-      ).resolves.toBeUndefined()
-      await flushAsyncWork(120)
-
-      expect(ensure).not.toHaveBeenCalled()
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`uses dispatch-time ownership after follower hydration becomes ownerless leader`, async () => {
-    const adapter = createRecordingAdapter()
-    const loadSubset = adapter.loadSubset
-    let markHydrationStarted = (): void => {}
-    const hydrationStarted = new Promise<void>((resolve) => {
-      markHydrationStarted = resolve
-    })
-    let releaseHydration = (): void => {}
-    const hydrationGate = new Promise<void>((resolve) => {
-      releaseHydration = resolve
-    })
-    adapter.loadSubset = async (...args) => {
-      markHydrationStarted()
-      await hydrationGate
-      return loadSubset(...args)
-    }
-
-    let isLeader = false
-    const staleEnsure = new Error(`ownerless leader must not route demand`)
-    const ensure = vi.fn(() => Promise.reject(staleEnsure))
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `transitioning-node`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => isLeader,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      requestEnsureRemoteSubset: ensure,
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `dispatch-time-ownerless-leader`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {}
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await flushAsyncWork()
-      const load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-      await hydrationStarted
-      isLeader = true
-      releaseHydration()
-
-      await expect(load).resolves.toBeUndefined()
-      expect(ensure).not.toHaveBeenCalled()
-    } finally {
-      releaseHydration()
-      await collection.cleanup()
-    }
-  })
-
-  it(`routes follower demand without a local subset owner`, async () => {
-    const ensure = vi.fn(async () => {})
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `ownerless-follower`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => false,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      requestEnsureRemoteSubset: ensure,
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-    }
-    const collectionId = `ownerless-on-demand-follower`
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: collectionId,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {}
-          },
-        },
-        persistence: {
-          adapter: createRecordingAdapter(),
-          coordinator,
-        },
-      }),
-    )
-    const options = { limit: 1 }
-
-    try {
-      collection.startSyncImmediate()
-      await flushAsyncWork()
-
-      await expect(
-        Promise.resolve(collection._sync.loadSubset(options)),
-      ).resolves.toBeUndefined()
-
-      expect(ensure).toHaveBeenCalledTimes(1)
-      expect(ensure).toHaveBeenCalledWith(collectionId, options)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`fails sync-absent persistence when follower ack omits mutation ids`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `follower-node`,
-      subscribe: () => () => {},
-      publish: () => {},
-      isLeader: () => false,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      // This fixture isolates follower transaction acknowledgements.
-      requestEnsureRemoteSubset: async () => {},
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyLocalMutations: async () => ({
-        type: `rpc:applyLocalMutations:res`,
-        rpcId: `ack-1`,
-        ok: true,
-        term: 1,
-        seq: 1,
-        latestRowVersion: 1,
-        acceptedMutationIds: [],
-      }),
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-absent-ack`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    const tx = collection.insert({
-      id: `ack-mismatch`,
-      title: `Ack mismatch`,
-    })
-
-    await expect(tx.isPersisted.promise).rejects.toThrow(
-      /partial acceptance is not supported/,
-    )
-    expect(collection.get(`ack-mismatch`)).toBeUndefined()
-  })
-
-  it.each([
-    {
-      boundary: `follower` as const,
-      responseCode: `PERSISTENCE_ERROR` as const,
-      expectedDurabilityError: true,
-    },
-    {
-      boundary: `elected-leader` as const,
-      responseCode: `PERSISTENCE_ERROR` as const,
-      expectedDurabilityError: true,
-    },
-    {
-      boundary: `follower` as const,
-      responseCode: `NOT_LEADER` as const,
-      expectedDurabilityError: false,
-    },
-    {
-      boundary: `follower` as const,
-      responseCode: `VALIDATION_ERROR` as const,
-      expectedDurabilityError: false,
-    },
-    {
-      boundary: `follower` as const,
-      responseCode: `CONFLICT` as const,
-      expectedDurabilityError: false,
-    },
-    {
-      boundary: `follower` as const,
-      responseCode: `TIMEOUT` as const,
-      expectedDurabilityError: false,
-    },
-  ])(
-    `classifies public local-mutation failure at the $boundary boundary: $responseCode`,
-    async ({ boundary, responseCode, expectedDurabilityError }) => {
-      const persistenceResponse =
-        responseCode === `PERSISTENCE_ERROR`
-          ? {
-              type: `rpc:applyLocalMutations:res` as const,
-              rpcId: `local-${boundary}-persistence-response`,
-              ok: false as const,
-              code: `PERSISTENCE_ERROR` as const,
-              error: `disk write failed`,
-              sourceCode: `SQLITE_IOERR_FSYNC`,
-              path: [`database`, `wal`] as const,
-            }
-          : {
-              type: `rpc:applyLocalMutations:res` as const,
-              rpcId: `local-${boundary}-failure-response`,
-              ok: false as const,
-              code: responseCode,
-              error: `mutation route changed`,
-            }
-      const coordinator = createCoordinatorHarness()
-      coordinator.isLeader = () => boundary === `elected-leader`
-      coordinator.requestApplyLocalMutations = () =>
-        Promise.resolve(persistenceResponse)
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `local-mutation-${boundary}-${responseCode}`,
-          getKey: (item) => item.id,
-          persistence: {
-            adapter: createRecordingAdapter(),
-            coordinator,
-          },
-        }),
-      )
-
-      try {
-        const tx = collection.insert({
-          id: `local-failure`,
-          title: `Must not persist`,
-        })
-        const rejection = await tx.isPersisted.promise.then(
-          () => undefined,
-          (error: unknown) => error,
-        )
-
-        // Earlier laws covered external-sync commit classification and a
-        // successful follower mutation acknowledgement. They never varied a
-        // serialized applyLocalMutations failure by route. The elected-leader
-        // and non-durability rows are hostile controls for topology parity and
-        // for avoiding an over-broad fail-stop classifier.
-        if (expectedDurabilityError) {
-          expect(rejection).toMatchObject({
-            name: `PersistedCollectionDurabilityError`,
-            code: `SQLITE_IOERR_FSYNC`,
-            path: [`database`, `wal`],
-            cause: persistenceResponse,
-          })
-          expect(collection.status).toBe(`crashed`)
-          expect(collection._lifecycle.getSyncError()).toBe(rejection)
-        } else {
-          expect(rejection).toMatchObject({
-            name: `Error`,
-            message:
-              `failed to apply local mutations through coordinator: ` +
-              `mutation route changed`,
-          })
-          expect(collection._lifecycle.getSyncError()).toBeUndefined()
-        }
-      } finally {
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`installs terminal state before synchronously reporting a local coordinator durability error`, async () => {
-    const coordinator = createCoordinatorHarness()
-    let requestCalls = 0
-    coordinator.requestApplyLocalMutations = async (
-      _collectionId,
-      mutations,
-    ) => {
-      requestCalls++
-      if (requestCalls === 1) {
-        return {
-          type: `rpc:applyLocalMutations:res`,
-          rpcId: `local-reentrant-failure`,
-          ok: false,
-          code: `PERSISTENCE_ERROR`,
-          error: `disk write failed`,
-          sourceCode: `SQLITE_IOERR_FSYNC`,
-          path: [`database`, `wal`],
-        }
-      }
-      return {
-        type: `rpc:applyLocalMutations:res`,
-        rpcId: `local-reentrant-success`,
-        ok: true,
-        term: 1,
-        seq: requestCalls,
-        latestRowVersion: requestCalls,
-        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
-      }
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `local-terminal-before-report`,
-        getKey: (item) => item.id,
-        persistence: {
-          adapter: createRecordingAdapter(),
-          coordinator,
-        },
-      }),
-    )
-    const now = new Date()
-    const reentrantRow = {
-      id: `reentrant-local`,
-      title: `must not reach the coordinator`,
-    }
-    const reentrantMutation: PendingMutation<Todo, `insert`> = {
-      mutationId: `reentrant-local-mutation`,
-      original: {},
-      modified: reentrantRow,
-      changes: reentrantRow,
-      globalKey: `local-terminal-before-report:reentrant-local`,
-      key: reentrantRow.id,
-      type: `insert`,
-      metadata: undefined,
-      syncMetadata: {},
-      optimistic: true,
-      createdAt: now,
-      updatedAt: now,
-      collection,
-    }
-    let reentrantOutcome:
-      | Promise<
-          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-        >
-      | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      const originalCrash = collection._lifecycle.crash.bind(
-        collection._lifecycle,
-      )
-      vi.spyOn(collection._lifecycle, `crash`).mockImplementation((error) => {
-        reentrantOutcome = Promise.resolve(
-          collection.utils.acceptMutations({
-            mutations: [
-              reentrantMutation as unknown as PendingMutation<
-                Record<string, unknown>
-              >,
-            ],
-          }),
-        ).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        )
-        originalCrash(error)
-      })
-
-      const primary = collection.insert({
-        id: `primary-local`,
-        title: `must install terminal state`,
-      })
-      const primaryOutcome = await primary.isPersisted.promise.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      const reentrant = await atPersistedOracleCheckpoint(
-        reentrantOutcome!,
-        `reentrant local mutation after durability error`,
-      )
-      const terminalError =
-        primaryOutcome.status === `rejected` ? primaryOutcome.reason : undefined
-
-      expect({
-        primaryStatus: primaryOutcome.status,
-        reentrantStatus: reentrant.status,
-        sameTerminal:
-          reentrant.status === `rejected` && reentrant.reason === terminalError,
-        requestCalls,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
-        reentrantVisible: collection.get(reentrantRow.id),
-      }).toEqual({
-        primaryStatus: `rejected`,
-        reentrantStatus: `rejected`,
-        sameTerminal: true,
-        requestCalls: 1,
-        exactPublicError: true,
-        reentrantVisible: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => reentrantOutcome, () => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`preserves lifecycle abort classification when cleanup wins a local adapter race`, async () => {
-    const adapter = createRecordingAdapter()
-    const successfulApply = adapter.applyCommittedTx.bind(adapter)
-    const persistenceEntered = createEventGate()
-    const releasePersistence = createEventGate()
-    adapter.applyCommittedTx = async (...args) => {
-      persistenceEntered.resolve()
-      await releasePersistence.promise
-      await successfulApply(...args)
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `local-cleanup-durability-race`,
-        getKey: (item) => item.id,
-        persistence: { adapter },
-      }),
-    )
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      await collection.stateWhenReady()
-      const transaction = collection.insert({
-        id: `old-local`,
-        title: `durable only in the replaced lifecycle`,
-      })
-      const settlement = transaction.isPersisted.promise.then(
-        () => ({ status: `fulfilled` as const }),
-        (reason: unknown) => ({ status: `rejected` as const, reason }),
-      )
-      await atPersistedOracleCheckpoint(
-        persistenceEntered.promise,
-        `local adapter entered before cleanup`,
-      )
-
-      await collection.cleanup()
-      cleanedUp = true
-      releasePersistence.resolve()
-      const outcome = await atPersistedOracleCheckpoint(
-        settlement,
-        `old local mutation settled after cleanup`,
-      )
-
-      expect({
-        status: outcome.status,
-        aborted:
-          outcome.status === `rejected` &&
-          outcome.reason instanceof SyncTransactionAbortedError,
-        durability:
-          outcome.status === `rejected` &&
-          outcome.reason instanceof PersistedCollectionDurabilityError,
-        publicError: collection._lifecycle.getSyncError(),
-      }).toEqual({
-        status: `rejected`,
-        aborted: true,
-        durability: false,
-        publicError: undefined,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releasePersistence.resolve()
-      await cleanupPersistedOracle(
-        [() => (cleanedUp ? undefined : collection.cleanup())],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`checks durable row authority when a targeted public-key change could be a replacement`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `Original`, detail: `removed by insert` },
-    ])
-    const coordinator = createCoordinatorHarness()
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    await collection.preload()
-    await flushAsyncWork()
-    const loadSubsetCallsAfterPreload = adapter.loadSubsetCalls.length
-
-    // The envelope has no insert/update certificate. Durable insert may have
-    // replaced the entire row, including a field omitted from the notice.
-    adapter.rows.set(`1`, { id: `1`, title: `Updated` })
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-targeted`,
-      latestRowVersion: 1,
-      requiresFullReload: false,
-      changedRows: [{ key: `1`, value: { id: `1`, title: `Updated` } }],
-      deletedKeys: [],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(adapter.loadSubsetCalls.length).toBe(loadSubsetCallsAfterPreload + 1)
-    expect(stripVirtualProps(collection.get(`1`))).toEqual({
-      id: `1`,
-      title: `Updated`,
-    })
-  })
-
-  it(`targeted update removes row that no longer matches WHERE`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `Keep` },
-      { id: `2`, title: `Keep` },
-    ])
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    adapter.loadSubset = async (id, options, context) =>
-      (await loadSubset(id, options, context)).filter(
-        (row) => !options.where || row.value.title === `Keep`,
-      )
-    const coordinator = createCoordinatorHarness()
-
-    const whereExpr = new IR.Func(`eq`, [
-      new IR.PropRef([`title`]),
-      new IR.Value(`Keep`),
-    ])
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    collection.startSyncImmediate()
-    await flushAsyncWork()
-
-    // Load a filtered subset with WHERE title = 'Keep'
-    await (collection as any)._sync.loadSubset({ where: whereExpr })
-    await flushAsyncWork()
-    expect(stripVirtualProps(collection.get(`2`))).toEqual({
-      id: `2`,
-      title: `Keep`,
-    })
-
-    // Change the row so it no longer matches WHERE title = 'Keep'
-    adapter.rows.set(`2`, { id: `2`, title: `Changed` })
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-where`,
-      latestRowVersion: 1,
-      requiresFullReload: false,
-      changedRows: [{ key: `2`, value: { id: `2`, title: `Changed` } }],
-      deletedKeys: [],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    // Row no longer matches WHERE — should be removed from collection
-    expect(collection.get(`2`)).toBeUndefined()
-  })
-
-  it(`paginated subset falls back to full reload`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Row 1` }])
-    const coordinator = createCoordinatorHarness()
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: {
-          adapter,
-          coordinator,
-        },
-      }),
-    )
-
-    collection.startSyncImmediate()
-    await flushAsyncWork()
-
-    // Add a paginated subset (limit)
-    await (collection as any)._sync.loadSubset({ limit: 10 })
-    await flushAsyncWork()
-    const loadSubsetCallsAfterPaginated = adapter.loadSubsetCalls.length
-
-    // Update the row in the adapter backing store
-    adapter.rows.set(`1`, { id: `1`, title: `Updated` })
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-paginated`,
-      latestRowVersion: 1,
-      requiresFullReload: false,
-      changedRows: [{ key: `1`, value: { id: `1`, title: `Updated` } }],
-      deletedKeys: [],
-    })
-
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    // With a paginated subset active, should fall back to full reload
-    expect(adapter.loadSubsetCalls.length).toBeGreaterThan(
-      loadSubsetCallsAfterPaginated,
-    )
-    expect(stripVirtualProps(collection.get(`1`))).toEqual({
-      id: `1`,
-      title: `Updated`,
-    })
-  })
-
-  // A scoped source snapshot establishes row 1. A coordinator notification
-  // cannot replace it from an uncertified cache; instead the active demand
-  // must request fresh source evidence. The five legal histories cross targeted,
-  // paginated, full-reload, sequence-gap, and reset notifications. The recording adapter is
-  // durable state, not the expected source result. The apply-mutex fence below
-  // places the public-row comparison after coordinator processing and checks
-  // a second source acquisition. This owner
-  // isolates the wrapper boundary; installed Electric delivery has a receiver.
-  it.each([
-    `targeted change`,
-    `paginated change`,
-    `full reload`,
-    `sequence gap`,
-    `durable reset`,
-  ] as const)(`keeps an active scoped source row after %s`, async (event) => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createLocalCoordinatorHarness()
-    let source!: TodoSyncParams
-    let sourceLoads = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return {
-              loadSubset: async () => {
-                sourceLoads++
-              },
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    collection.startSyncImmediate()
-    await flushAsyncWork()
-    const capability = source.metadata?.persistence
-    expect(capability?.startScopedRecovery).toBeTypeOf(`function`)
-    await capability!.startScopedRecovery!()
-
-    const sourceRow: Todo = { id: `1`, title: `Source row` }
-    source.begin()
-    source.write({ type: `insert`, value: sourceRow })
-    await whenSyncAccepted(source.commit())
-    await collection._sync.loadSubset(
-      event === `targeted change` ? {} : { limit: 10 },
-    )
-    expect(sourceLoads).toBe(1)
-    expect(stripVirtualProps(collection.get(`1`))).toEqual(sourceRow)
-
-    const latest = adapter.applyCommittedTxCalls.at(-1)!.tx
-    if (event === `durable reset`) {
-      adapter.rows.clear()
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 1,
-      })
-    } else if (event === `sequence gap`) {
-      Object.assign(coordinator, {
-        pullSince: (): Promise<PullSinceResponse> =>
-          Promise.resolve({
-            type: `rpc:pullSince:res`,
-            rpcId: `scoped-gap`,
-            ok: true,
-            latestTerm: latest.term,
-            latestSeq: latest.seq + 2,
-            latestRowVersion: latest.rowVersion + 2,
-            requiresFullReload: true,
-          }),
-      })
-      coordinator.emit({
-        type: `tx:committed`,
-        term: latest.term,
-        seq: latest.seq + 2,
-        txId: `scoped-sequence-gap`,
-        latestRowVersion: latest.rowVersion + 2,
-        requiresFullReload: true,
-      })
-    } else if (event === `full reload`) {
-      // A transaction above the coordinator's targeted-invalidation limit can
-      // change many unrelated durable rows without changing source row 1.
-      for (let id = 2; id <= 130; id++) {
-        adapter.rows.set(String(id), { id: String(id), title: `Other ${id}` })
-      }
-      coordinator.emit({
-        type: `tx:committed`,
-        term: latest.term,
-        seq: latest.seq + 1,
-        txId: `large-scoped-change`,
-        latestRowVersion: latest.rowVersion + 1,
-        requiresFullReload: true,
-      })
-    } else {
-      const durableRow: Todo =
-        event === `targeted change`
-          ? { id: `1`, title: `Uncertified durable update` }
-          : { id: `2`, title: `Unrelated durable row` }
-      adapter.rows.set(durableRow.id, durableRow)
-      coordinator.emit({
-        type: `tx:committed`,
-        term: latest.term,
-        seq: latest.seq + 1,
-        txId: `scoped-change`,
-        latestRowVersion: latest.rowVersion + 1,
-        requiresFullReload: false,
-        changedRows: [{ key: durableRow.id, value: durableRow }],
-        deletedKeys: [],
-      })
-    }
-
-    // scanPersistedRows enters the same apply mutex after event admission, so
-    // this observes the settled coordinator invalidation rather than a race.
-    await capability!.scanPersistedRows()
-    expect(stripVirtualProps(collection.get(`1`))).toEqual(sourceRow)
-    expect(adapter.loadSubsetCalls).toEqual([])
-    await vi.waitFor(() => expect(sourceLoads).toBe(2))
-  })
-
-  // This deliberately wrong global-eviction message is a hostile control for
-  // the two-run Browser generation-routing oracle. A global full reload makes
-  // the warm run lose a valid source row, so it cannot implement cache
-  // retirement. This driver checks that the public-row comparison detects
-  // the fault; no production path emits this fabricated cacheEviction field.
-  it(`detects that global cache eviction removes a warm source row`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createLocalCoordinatorHarness()
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(source).toBeDefined())
-      const sourceRow = { id: `warm`, title: `Valid source row` }
-      source.begin()
-      source.write({ type: `insert`, value: sourceRow })
-      await whenSyncAccepted(source.commit())
-      await collection._sync.loadSubset({ limit: 10 })
-      const readsBeforeEviction = adapter.loadSubsetCalls.length
-      const latest = adapter.applyCommittedTxCalls.at(-1)!.tx
-
-      adapter.rows.clear()
-      coordinator.emit({
-        type: `tx:committed`,
-        term: latest.term,
-        seq: latest.seq + 1,
-        txId: `peer-cache-eviction`,
-        latestRowVersion: latest.rowVersion + 1,
-        requiresFullReload: true,
-        cacheEviction: true,
-      } as unknown as TxCommitted)
-
-      await source.metadata!.persistence!.scanPersistedRows()
-      expect(stripVirtualProps(collection.get(`warm`))).toBeUndefined()
-      expect(adapter.loadSubsetCalls.length).toBeGreaterThan(
-        readsBeforeEviction,
-      )
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // Scoped recovery removes durable rows' authority to enter the public
-  // Collection. This recording adapter has no generation catalog, so its old
-  // rows remain on disk in the model; the SQLite owner checks physical
-  // retirement separately. A later baseline capability call cannot revive
-  // the row. This driver checks public visibility and the adapter read boundary.
-  it(`does not hydrate durable baseline rows during scoped recovery`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `1`, title: `Stale durable row` },
-    ])
-    const resetMarker = { kind: `reset`, updatedAt: 1 }
-    adapter.collectionMetadata.set(`electric:resume`, resetMarker)
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `scoped-baseline-quarantine`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await flushAsyncWork()
-      const capability = source.metadata!.persistence!
-      await capability.startScopedRecovery!()
-      expect(collection.get(`1`)).toBeUndefined()
-      expect(adapter.rows.has(`1`)).toBe(true)
-      expect(adapter.collectionMetadata.get(`electric:resume`)).toEqual(
-        resetMarker,
-      )
-      await capability.hydrateBaseline()
-      expect(collection.get(`1`)).toBeUndefined()
-      expect(
-        adapter.loadResumeSnapshotCalls.filter(
-          (call) => call.includeRows === true,
-        ),
-      ).toEqual([])
-
-      // A later loss of authority in the same sync run must retire rows that
-      // arrived after the first clear, rather than growing the cache forever.
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `2`, title: `Later source row` },
-      })
-      await whenSyncAccepted(source.commit())
-      expect(adapter.rows.has(`2`)).toBe(true)
-      await capability.startScopedRecovery!()
-      expect(collection.get(`2`)).toBeUndefined()
-      expect(adapter.rows.has(`1`)).toBe(true)
-      expect(adapter.rows.has(`2`)).toBe(true)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // A local load can begin before scoped recovery claims the Collection.
-  // When that load fails, queued partial source work may ask for a durable
-  // baseline. The independent source model permits the partial source fields,
-  // but no old durable field has authority after the scoped clear. The gate
-  // fixes the order at the adapter boundary; the observations are the stale
-  // public field and full-row read count.
-  it(`keeps a failed local load from restoring scoped durable rows`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `shared`, title: `Stale durable`, detail: `stale detail` },
-    ])
-    const loadEntered = createEventGate()
-    const rejectLoad = createEventGate()
-    const localFailure = new Error(`local load failed`)
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await rejectLoad.promise
-      throw localFailure
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `scoped-failed-local-load`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          rowUpdateMode: `partial`,
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let load: Promise<unknown> | undefined
-    let receipt: Promise<unknown> | undefined
-    let scoped: Promise<void> | undefined
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `scoped failed local load startup`,
-      )
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-      void load.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        loadEntered.promise,
-        `scoped failed local load entered`,
-      )
-      source.begin()
-      source.write({
-        type: `update`,
-        value: { id: `shared`, title: `Partial source` } as Todo,
-      })
-      receipt = Promise.resolve(source.commit())
-      void receipt.catch(() => undefined)
-      scoped = source.metadata!.persistence!.startScopedRecovery!()
-      rejectLoad.resolve()
-      await expect(load).rejects.toBe(localFailure)
-      await atPersistedOracleCheckpoint(scoped, `scoped failed load clear`)
-      await Promise.allSettled([receipt])
-      expect(collection.get(`shared`)).toMatchObject({
-        id: `shared`,
-        title: `Partial source`,
-      })
-      expect(collection.get(`shared`)?.detail).toBeUndefined()
-      expect(
-        adapter.loadResumeSnapshotCalls.filter(
-          (call) => call.includeRows === true,
-        ),
-      ).toEqual([])
-    } finally {
-      rejectLoad.resolve()
-      await Promise.allSettled([load, receipt, scoped])
-      await collection.cleanup()
-    }
-  })
-
-  // Source work admitted while an old cache read is in flight belongs to the
-  // old persisted cache generation. Rotation may overtake that work at the
-  // apply mutex, but it cannot turn the old source result into a row in the
-  // new generation. The held local read fixes the ordering; the applied
-  // receipt and durable write destination are the comparison checkpoint.
-  // A sync adapter reports through its own sync params that served pages
-  // may have shifted. Under a managed cache generation the wrapper gives each
-  // source session its own params, so the report must reach the public
-  // Collection from the current session and be dropped from a retired one;
-  // otherwise a stale source could start repairs on the replacement.
-  it(`forwards a loaded-subset report only from the current source session`, async () => {
-    const adapter = createRecordingAdapter()
-    let currentStorageId = `report-old-storage`
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: currentStorageId,
-      claimId: `report-claim`,
-    })
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: (currentStorageId = `report-new-storage`),
-      claimId: `report-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const sessions: Array<TodoSyncParams> = []
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `loaded-subset-report-sessions`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sessions.push(params)
-            params.markReady()
-            // Without its own restart hook, the source is retired and
-            // re-entered with fresh params after a scoped rotation.
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let reports = 0
-    const unsubscribe = collection.on(`loadedSubsets:invalidated`, () => {
-      reports++
-    })
-    // Reports are coalesced into a microtask; a macrotask lets them land.
-    const reportsAfter = async (report: () => void) => {
-      const before = reports
-      report()
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      return reports - before
-    }
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      const first = sessions[0]!
-      expect(await reportsAfter(() => first.invalidateLoadedSubsets())).toBe(1)
-
-      await atPersistedOracleCheckpoint(
-        first.metadata!.persistence!.startScopedRecovery!(),
-        `scoped rotation`,
-      )
-      expect(sessions).toHaveLength(2)
-      const replacement = sessions[1]!
-      expect({
-        retired: await reportsAfter(() => first.invalidateLoadedSubsets()),
-        replacement: await reportsAfter(() =>
-          replacement.invalidateLoadedSubsets(),
-        ),
-      }).toEqual({ retired: 0, replacement: 1 })
-    } finally {
-      unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`rejects a queued old-generation source commit after scoped rotation`, async () => {
-    const adapter = createRecordingAdapter()
-    const loadEntered = createEventGate()
-    const releaseLoad = createEventGate()
-    const claimId = `queued-old-claim`
-    let currentStorageId = `queued-old-storage`
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: currentStorageId,
-      claimId,
-    })
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: (currentStorageId = `queued-new-storage`),
-      claimId,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.loadSubset = async () => {
-      loadEntered.resolve()
-      await releaseLoad.promise
-      return []
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `queued-generation-rotation`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            // The controlled source has no pending asynchronous callback.
-            // Its old commit is already queued inside the persisted wrapper.
-            return {
-              // An on-demand source serves the subsets that recovery
-              // reacquires in the new generation.
-              loadSubset: () => true,
-              restartAfterScopedRecovery: () => {},
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    let load: Promise<unknown> | undefined
-    let receipt: Promise<unknown> | undefined
-    let recovery: Promise<void> | undefined
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-      void load.catch(() => undefined)
-      await atPersistedOracleCheckpoint(loadEntered.promise, `old cache read`)
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `old-source`, title: `Old source result` },
-      })
-      receipt = Promise.resolve(source.commit())
-      void receipt.catch(() => undefined)
-      recovery = source.metadata!.persistence!.startScopedRecovery!()
-      releaseLoad.resolve()
-      await atPersistedOracleCheckpoint(recovery, `scoped rotation`)
-      await expect(receipt).rejects.toBeInstanceOf(SyncTransactionAbortedError)
-      expect(
-        adapter.applyCommittedTxCalls.filter(
-          (call) => call.collectionId === `queued-new-storage`,
-        ),
-      ).toEqual([])
-      expect(collection.get(`old-source`)).toBeUndefined()
-
-      // Cancellation belongs only to the old admission. Fresh work in the
-      // new generation still applies and persists through the same sync run.
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `new-source`, title: `New source result` },
-      })
-      await whenSyncAccepted(source.commit())
-      // Recovery succeeded: the Collection still accepts sync data.
-      expect(collection.status).toBe(`ready`)
-      expect(collection.get(`new-source`)).toMatchObject({
-        id: `new-source`,
-        title: `New source result`,
-      })
-      expect(
-        adapter.applyCommittedTxCalls
-          .filter((call) => call.collectionId === `queued-new-storage`)
-          .flatMap((call) => call.tx.mutations.map((mutation) => mutation.key)),
-      ).toEqual([`new-source`])
-    } finally {
-      releaseLoad.resolve()
-      await Promise.allSettled([load, receipt, recovery])
-      await collection.cleanup()
-    }
-  })
-
-  // Cleanup can release the original claim while a rotation is paused before
-  // SQLite admission. If rotation then creates a private generation, that
-  // late claim still belongs to the cleaned-up sync run and must be released.
-  // The independent claim ledger observes ownership after both operations
-  // settle; checking only the public Collection would miss leaked storage.
-  it(`releases a cache claim created by rotation after cleanup`, async () => {
-    const adapter = createRecordingAdapter()
-    const liveClaims = new Set<string>()
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    adapter.claimCacheGeneration = async () => {
-      liveClaims.add(`old-claim`)
-      return { storageCollectionId: `old-storage`, claimId: `old-claim` }
-    }
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      expect(liveClaims.has(`old-claim`)).toBe(false)
-      liveClaims.add(`private-claim`)
-      return {
-        storageCollectionId: `private-storage`,
-        claimId: `private-claim`,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async (claimId) => {
-      liveClaims.delete(claimId)
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `cleanup-during-cache-rotation`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { restartAfterScopedRecovery: () => {} }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let recovery: Promise<void> | undefined
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      recovery = source.metadata!.persistence!.startScopedRecovery!()
-      void recovery.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `held cache rotation`,
-      )
-      await collection.cleanup()
-      expect(liveClaims.size).toBe(0)
-      releaseRotation.resolve()
-      await Promise.allSettled([recovery])
-      expect([...liveClaims]).toEqual([])
-    } finally {
-      releaseRotation.resolve()
-      await Promise.allSettled([recovery])
-      await collection.cleanup()
-    }
-  })
-
-  // A custom source is allowed to omit a provider-specific restart hook. Its
-  // Collection must still recover after claim expiry: the wrapper ends the old
-  // source session, rotates storage, and starts a fresh source session. A held
-  // callback from the retired session has no authority over new public rows or
-  // durable storage. The source-session and row ledgers are independent of the
-  // wrapper's recovery flags.
-  it.each([false, true])(
-    `restarts a custom on-demand source after its cache claim expires (prior demand=%s)`,
-    async (priorDemand) => {
-      const adapter = createRecordingAdapter([
-        { id: `stale`, title: `Old persisted row` },
-      ])
-      let rotations = 0
-      let sourceStarts = 0
-      let sourceCleanups = 0
-      const sourceSessions: Array<TodoSyncParams> = []
-      let revokeClaim = false
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: `old-storage`,
-        claimId: `old-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      })
-      adapter.renewCacheGenerationClaim = async (_storageId, claimId) =>
-        revokeClaim && claimId === `old-claim` ? undefined : Date.now() + 10_000
-      adapter.rotateCacheGeneration = async () => {
-        rotations++
-        return {
-          storageCollectionId: `new-storage`,
-          claimId: `new-claim`,
-        }
-      }
-      adapter.releaseCacheGenerationClaim = async () => {}
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `custom-cache-source`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              const session = ++sourceStarts
-              sourceSessions.push(params)
-              params.markReady()
-              return {
-                cleanup: () => {
-                  sourceCleanups++
-                },
-                loadSubset: async () => {
-                  params.begin()
-                  params.write({
-                    type: `update`,
-                    value: {
-                      id: `row-${session}`,
-                      title: `Session ${session}`,
-                    },
-                  })
-                  await params.commit()
-                },
-              }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const releaseOldCallback = createEventGate()
-      let lateCallback: Promise<void> | undefined
-
-      try {
-        await collection.stateWhenReady()
-        expect(sourceStarts).toBe(1)
-        const oldSource = sourceSessions[0]!
-        lateCallback = (async () => {
-          await releaseOldCallback.promise
-          oldSource.begin()
-          oldSource.write({
-            type: `insert`,
-            value: { id: `late-old`, title: `Retired session` },
-          })
-          await oldSource.commit()
-        })()
-        if (priorDemand) {
-          await collection._sync.loadSubset({ limit: 2 })
-          expect(collection.get(`row-1`)).toBeDefined()
-        }
-        revokeClaim = true
-        await collection._sync.loadSubset({ limit: 1 })
-        expect(sourceStarts).toBe(2)
-        expect(sourceCleanups).toBe(1)
-        expect(rotations).toBe(1)
-        expect(collection.get(`stale`)).toBeUndefined()
-        expect(collection.get(`row-1`)).toBeUndefined()
-        expect(collection.get(`row-2`)).toMatchObject({
-          id: `row-2`,
-          title: `Session 2`,
-        })
-        releaseOldCallback.resolve()
-        await lateCallback
-        expect(collection.get(`late-old`)).toBeUndefined()
-        expect(
-          adapter.applyCommittedTxCalls.some(({ tx }) =>
-            tx.mutations.some(({ key }) => key === `late-old`),
-          ),
-        ).toBe(false)
-        // The retired session's reports have no authority over the node:
-        // its error does not show, and its recovery does not clear the live
-        // session's problem.
-        oldSource.reportError(new Error(`retired session`))
-        await flushAsyncWork()
-        expect(collection.health.failureReason).toBeNull()
-        sourceSessions[1]!.reportError(new Error(`live session`))
-        await flushAsyncWork()
-        oldSource.reportHealthy()
-        await flushAsyncWork()
-        expect(collection.health.failureReason?.message).toBe(`live session`)
-      } finally {
-        releaseOldCallback.resolve()
-        await Promise.allSettled([lateCallback])
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // Cleanup can win after the old custom session retires but before SQLite
-  // returns its replacement claim. That history owns one source cleanup and
-  // must not start another source session after Collection disposal.
-  it(`does not restart a custom source after cleanup wins a held rotation`, async () => {
-    const adapter = createRecordingAdapter()
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    let sourceStarts = 0
-    let sourceCleanups = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `old-storage`,
-      claimId: `old-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      return { storageCollectionId: `new-storage`, claimId: `new-claim` }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `custom-cleanup-during-rotation`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceStarts++
-            source = params
-            params.markReady()
-            return {
-              cleanup: () => {
-                sourceCleanups++
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let recovery: Promise<void> | undefined
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      recovery = source.metadata!.persistence!.startScopedRecovery!()
-      void recovery.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `held custom cache rotation`,
-      )
-      await collection.cleanup()
-      releaseRotation.resolve()
-      await Promise.allSettled([recovery])
-      expect({ sourceStarts, sourceCleanups }).toEqual({
-        sourceStarts: 1,
-        sourceCleanups: 1,
-      })
-    } finally {
-      releaseRotation.resolve()
-      await Promise.allSettled([recovery])
-      await collection.cleanup()
-    }
-  })
-
-  // A startup resume read may pass SQLite's first claim check, then fail its
-  // second check after the claim expires. The independent authority rule
-  // discards that old read and rotates privately before source entry. A read
-  // error while the claim remains live has no such explanation and stays
-  // terminal. The held read and clock distinguish these histories at source
-  // entry, Collection readiness, and physical storage choice.
-  it.each([
-    { outcome: `expired claim`, expires: true },
-    { outcome: `live I/O failure`, expires: false },
-  ])(
-    `classifies a rejected startup resume read: $outcome`,
-    async ({ expires }) => {
-      const adapter = createRecordingAdapter()
-      const readEntered = createEventGate()
-      const releaseRead = createEventGate()
-      const storageId = `startup-rejected-old`
-      let currentStorageId = storageId
-      let now = 1_000
-      let expiresAtMs = 2_000
-      let rotations = 0
-      let sourceStarts = 0
-      const ioFailure = new Error(`live startup read failed`)
-      const claimFailure = new InvalidPersistedCollectionConfigError(
-        `Persisted cache claim is no longer active for collection "${storageId}"`,
-      )
-      adapter.getCacheGenerationNow = () => now
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: currentStorageId,
-        claimId: `startup-rejected-claim`,
-        expiresAtMs,
-      })
-      adapter.renewCacheGenerationClaim = async () =>
-        now < expiresAtMs ? (expiresAtMs = now + 1_000) : undefined
-      adapter.rotateCacheGeneration = async () => {
-        rotations++
-        currentStorageId = `startup-rejected-new`
-        expiresAtMs = now + 1_000
-        return {
-          storageCollectionId: currentStorageId,
-          claimId: `startup-rejected-claim`,
-          expiresAtMs,
-        }
-      }
-      adapter.releaseCacheGenerationClaim = async () => {}
-      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-      adapter.loadResumeSnapshot = async (id, options) => {
-        if (recordedStorageId(id) === storageId) {
-          readEntered.resolve()
-          await releaseRead.promise
-          throw expires ? claimFailure : ioFailure
-        }
-        return loadResumeSnapshot(id, options)
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `startup-rejected-resume-read-${expires}`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: ({ markReady }) => {
-              sourceStarts++
-              markReady()
-              return { restartAfterScopedRecovery: () => {} }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      try {
-        collection.startSyncImmediate()
-        const ready = collection.stateWhenReady()
-        void ready.catch(() => undefined)
-        await atPersistedOracleCheckpoint(
-          readEntered.promise,
-          `startup resume read entered`,
-        )
-        if (expires) now = 2_100
-        releaseRead.resolve()
-        if (expires) {
-          await atPersistedOracleCheckpoint(ready, `recovered source readiness`)
-          expect(collection.status).toBe(`ready`)
-          expect(sourceStarts).toBe(1)
-          expect(rotations).toBe(1)
-          expect(currentStorageId).toBe(`startup-rejected-new`)
-        } else {
-          await expect(ready).rejects.toBe(ioFailure)
-          expect(collection.status).toBe(`crashed`)
-          expect(sourceStarts).toBe(0)
-          expect(rotations).toBe(0)
-        }
-      } finally {
-        releaseRead.resolve()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // Each claim expiry is a loss of authority, not an exhausted retry budget.
-  // The independent clock pauses this run during two successive SQLite resume
-  // reads, then lets a third read finish with a live claim. The source must
-  // start exactly once under that final storage ID, with no old read admitted.
-  it(`recovers after successive startup resume claims expire`, async () => {
-    const adapter = createRecordingAdapter()
-    let now = 1_000
-    let expiresAtMs = 2_000
-    let storageId = `successive-startup-old`
-    let reads = 0
-    let rotations = 0
-    let sourceStarts = 0
-    adapter.getCacheGenerationNow = () => now
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `successive-startup-claim`,
-      expiresAtMs,
-    })
-    adapter.renewCacheGenerationClaim = async () =>
-      now < expiresAtMs ? (expiresAtMs = now + 1_000) : undefined
-    adapter.rotateCacheGeneration = async () => {
-      storageId = `successive-startup-new-${++rotations}`
-      expiresAtMs = now + 1_000
-      return {
-        storageCollectionId: storageId,
-        claimId: `successive-startup-claim`,
-        expiresAtMs,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (id, options) => {
-      if (++reads <= 2) {
-        now = expiresAtMs + 1
-        throw new InvalidPersistedCollectionConfigError(
-          `Persisted cache claim is no longer active for collection "${id}"`,
-        )
-      }
-      return loadResumeSnapshot(id, options)
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `successive-startup-expiry`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            sourceStarts++
-            markReady()
-            return { restartAfterScopedRecovery: () => {} }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `source entry after successive claim expiry`,
-      )
-      expect(collection.status).toBe(`ready`)
-      expect(reads).toBe(3)
-      expect(rotations).toBe(2)
-      expect(storageId).toBe(`successive-startup-new-2`)
-      expect(sourceStarts).toBe(1)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // An expired cache claim may start a private rotation while startup is
-  // creating a persisted index. The source cannot enter until that rotation
-  // settles: before its sync callback returns there is no provider-session
-  // restart capability to retire callbacks bound to the old cache. This
-  // controlled adapter permits the index and rotation to overlap. The model
-  // starts the source once, under the rotated storage ID; the observations
-  // are source-entry timing and the durable destination of its first write.
-  it(`waits for a private startup rotation before entering the source`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstIndexEntered = createEventGate()
-    const releaseFirstIndex = createEventGate()
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    const sourceStarted = createEventGate()
-    let expired = false
-    let storageId = `startup-old-storage`
-    let indexCalls = 0
-    const indexRoutes: Array<{ storageId: string; signature: string }> = []
-    let sourceStarts = 0
-    let restarts = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `startup-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () =>
-      expired ? undefined : Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      storageId = `startup-new-storage`
-      expired = false
-      return { storageCollectionId: storageId, claimId: `startup-claim` }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (id, signature) => {
-      indexRoutes.push({ storageId: recordedStorageId(id), signature })
-      if (++indexCalls === 1) {
-        firstIndexEntered.resolve()
-        await releaseFirstIndex.promise
-      }
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `startup-rotation-before-source`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: (params) => {
-            source = params
-            sourceStarts++
-            params.markReady()
-            sourceStarted.resolve()
-            return {
-              restartAfterScopedRecovery: () => {
-                restarts++
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.createIndex((row) => row.title, { name: `held-title` })
-    try {
-      collection.startSyncImmediate()
-      await atPersistedOracleCheckpoint(
-        firstIndexEntered.promise,
-        `first startup index`,
-      )
-      expired = true
-      const dynamicIndex = collection.createIndex((row) => row.id, {
-        name: `dynamic-id`,
-      })
-      const dynamicSignature = collection
-        .getIndexMetadata()
-        .find((metadata) => metadata.indexId === dynamicIndex.id)?.signature
-      if (!dynamicSignature) throw new Error(`Missing dynamic index signature`)
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `private startup rotation`,
-      )
-      releaseFirstIndex.resolve()
-      await flushAsyncWork()
-      expect(sourceStarts).toBe(0)
-      releaseRotation.resolve()
-      await atPersistedOracleCheckpoint(sourceStarted.promise, `source entry`)
-      await collection.stateWhenReady()
-      expect(sourceStarts).toBe(1)
-      expect(restarts).toBe(0)
-      expect(indexRoutes).toContainEqual({
-        storageId: `startup-new-storage`,
-        signature: dynamicSignature,
-      })
-
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `fresh`, title: `New storage` },
-      })
-      await whenSyncAccepted(source.commit())
-      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
-      expect(
-        adapter.applyCommittedTxCalls
-          .filter((call) =>
-            call.tx.mutations.some((mutation) => mutation.key === `fresh`),
-          )
-          .map((call) => call.collectionId),
-      ).toEqual([`startup-new-storage`])
-    } finally {
-      releaseFirstIndex.resolve()
-      releaseRotation.resolve()
-      await collection.cleanup()
-    }
-  })
-
-  // An active scoped rotation changes the physical index destination. The
-  // independent registry is the Collection's current index metadata: every
-  // index still present after rotation, including one added after bootstrap
-  // captured its snapshot, must be routed to the new storage ID.
-  it(`rebuilds current persisted indexes after active cache rotation`, async () => {
-    const adapter = createRecordingAdapter()
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    const bootstrapEntered = createEventGate()
-    const releaseBootstrap = createEventGate()
-    let storageId = `active-index-old`
-    let recovery!: () => Promise<void>
-    const indexRoutes: Array<{ storageId: string; signature: string }> = []
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `active-index-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      storageId = `active-index-new`
-      return { storageCollectionId: storageId, claimId: `active-index-claim` }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (id, signature) => {
-      indexRoutes.push({ storageId: recordedStorageId(id), signature })
-      if (
-        recordedStorageId(id) === `active-index-new` &&
-        signature === initialSignature
-      ) {
-        bootstrapEntered.resolve()
-        await releaseBootstrap.promise
-      }
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `active-index-rotation`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: (params) => {
-            recovery = params.metadata!.persistence!.startScopedRecovery!
-            params.markReady()
-            return { restartAfterScopedRecovery: (gate) => gate }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const initial = collection.createIndex((row) => row.title, {
-      name: `initial-title`,
-    })
-    const initialSignature = collection
-      .getIndexMetadata()
-      .find((metadata) => metadata.indexId === initial.id)?.signature
-    let activeRecovery: Promise<void> | undefined
-    try {
-      await collection.stateWhenReady()
-      activeRecovery = recovery()
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `active index rotation`,
-      )
-      const added = collection.createIndex((row) => row.id, {
-        name: `added-during-rotation`,
-      })
-      releaseRotation.resolve()
-      await atPersistedOracleCheckpoint(
-        bootstrapEntered.promise,
-        `new-storage index bootstrap`,
-      )
-      const addedDuringBootstrap = collection.createIndex((row) => row.detail, {
-        name: `added-during-bootstrap`,
-      })
-      const signatures = [initial.id, added.id, addedDuringBootstrap.id].map(
-        (id) =>
-          collection
-            .getIndexMetadata()
-            .find((metadata) => metadata.indexId === id)?.signature,
-      )
-      if (signatures.some((signature) => !signature)) {
-        throw new Error(`Missing current index signature`)
-      }
-      releaseBootstrap.resolve()
-      await atPersistedOracleCheckpoint(activeRecovery, `active index recovery`)
-      for (const signature of signatures) {
-        expect(indexRoutes).toContainEqual({
-          storageId: `active-index-new`,
-          signature,
-        })
-      }
-    } finally {
-      releaseRotation.resolve()
-      releaseBootstrap.resolve()
-      await Promise.allSettled([activeRecovery])
-      await collection.cleanup()
-    }
-  })
-
-  // Removing an index revokes its durable accelerator after all event work
-  // settles. The independent index registry follows the Collection's current
-  // declarations, even when an earlier add operation is held in the adapter.
-  // At the removal checkpoint the index is absent; the late add must not
-  // resurrect it at the final checkpoint.
-  it(`keeps a removed persisted index retired after its add completes late`, async () => {
-    const adapter = createRecordingAdapter()
-    const ensureEntered = createEventGate()
-    const releaseEnsure = createEventGate()
-    const ensureSettled = createEventGate()
-    const removeSettled = createEventGate()
-    const durableIndexes = new Map<string, boolean>()
-    const operations: Array<string> = []
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `index-remove-storage`,
-      claimId: `index-remove-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: `index-remove-new`,
-      claimId: `index-remove-claim`,
-    })
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (_id, signature) => {
-      operations.push(`ensure-enter`)
-      ensureEntered.resolve()
-      await releaseEnsure.promise
-      durableIndexes.set(signature, true)
-      operations.push(`ensure-settled`)
-      ensureSettled.resolve()
-    }
-    adapter.markIndexRemoved = async (_id, signature) => {
-      durableIndexes.set(signature, false)
-      operations.push(`remove-settled`)
-      removeSettled.resolve()
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `late-index-add-after-removal`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: { sync: ({ markReady }) => markReady() },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      const index = collection.createIndex((row) => row.title, {
-        name: `transient-index`,
-      })
-      const signature = collection
-        .getIndexMetadata()
-        .find((metadata) => metadata.indexId === index.id)?.signature
-      if (!signature) throw new Error(`Missing index signature`)
-      await atPersistedOracleCheckpoint(
-        ensureEntered.promise,
-        `index add entered`,
-      )
-      expect(collection.removeIndex(index)).toBe(true)
-      await atPersistedOracleCheckpoint(
-        removeSettled.promise,
-        `index removal settled`,
-      )
-      expect(durableIndexes.get(signature)).toBe(false)
-      releaseEnsure.resolve()
-      await atPersistedOracleCheckpoint(
-        ensureSettled.promise,
-        `late index add settled`,
-      )
-      await flushAsyncWork()
-      expect(collection.getIndexMetadata()).toEqual([])
-      expect(durableIndexes.get(signature)).toBe(false)
-      expect(operations.slice(0, 3)).toEqual([
-        `ensure-enter`,
-        `remove-settled`,
-        `ensure-settled`,
-      ])
-      expect(operations.at(-1)).toBe(`remove-settled`)
-    } finally {
-      releaseEnsure.resolve()
-      await collection.cleanup()
-    }
-  })
-
-  // Re-adding the same index signature reverses the expected final state.
-  // A held removal from the old declaration cannot deactivate the current
-  // declaration after its add has completed. Signature, rather than object
-  // identity, names the durable SQLite accelerator in this history.
-  it(`keeps a re-added persisted index active after its removal completes late`, async () => {
-    const adapter = createRecordingAdapter()
-    const removeEntered = createEventGate()
-    const releaseRemove = createEventGate()
-    const removeSettled = createEventGate()
-    const durableIndexes = new Map<string, boolean>()
-    let ensureCalls = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `index-readd-storage`,
-      claimId: `index-readd-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: `index-readd-new`,
-      claimId: `index-readd-claim`,
-    })
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (_id, signature) => {
-      ensureCalls++
-      durableIndexes.set(signature, true)
-    }
-    adapter.markIndexRemoved = async (_id, signature) => {
-      removeEntered.resolve()
-      await releaseRemove.promise
-      durableIndexes.set(signature, false)
-      removeSettled.resolve()
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `late-index-removal-after-readd`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: { sync: ({ markReady }) => markReady() },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      const first = collection.createIndex((row) => row.title)
-      const signature = collection
-        .getIndexMetadata()
-        .find((metadata) => metadata.indexId === first.id)?.signature
-      if (!signature) throw new Error(`Missing index signature`)
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(ensureCalls).toBe(1)),
-        `first index add`,
-      )
-      expect(collection.removeIndex(first)).toBe(true)
-      await atPersistedOracleCheckpoint(
-        removeEntered.promise,
-        `old index removal entered`,
-      )
-      const second = collection.createIndex((row) => row.title)
-      expect(
-        collection
-          .getIndexMetadata()
-          .find((metadata) => metadata.indexId === second.id)?.signature,
-      ).toBe(signature)
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(ensureCalls).toBe(2)),
-        `replacement index add`,
-      )
-      releaseRemove.resolve()
-      await atPersistedOracleCheckpoint(
-        removeSettled.promise,
-        `old removal settled`,
-      )
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(durableIndexes.get(signature)).toBe(true)),
-        `current index restored`,
-      )
-      expect(collection.getIndexMetadata()).toHaveLength(1)
-    } finally {
-      releaseRemove.resolve()
-      await collection.cleanup()
-    }
-  })
-
-  // Rotation rebuilds current index declarations on a new physical table.
-  // Removing one while its new-table bootstrap call is held must leave that
-  // table without the index once recovery and the removal event both settle.
-  // This is the neighboring bootstrap route for the add/remove race above.
-  it(`removes an index deleted during held cache-rotation bootstrap`, async () => {
-    const adapter = createRecordingAdapter()
-    const bootstrapEntered = createEventGate()
-    const releaseBootstrap = createEventGate()
-    const removalSettled = createEventGate()
-    const durableIndexes = new Map<string, boolean>()
-    let storageId = `bootstrap-removal-old`
-    let recovery!: () => Promise<void>
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `bootstrap-removal-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: (storageId = `bootstrap-removal-new`),
-      claimId: `bootstrap-removal-claim`,
-    })
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (id, signature) => {
-      if (recordedStorageId(id) === `bootstrap-removal-new`) {
-        bootstrapEntered.resolve()
-        await releaseBootstrap.promise
-      }
-      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, true)
-    }
-    adapter.markIndexRemoved = async (id, signature) => {
-      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, false)
-      removalSettled.resolve()
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `bootstrap-index-removal`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: (params) => {
-            recovery = params.metadata!.persistence!.startScopedRecovery!
-            params.markReady()
-            return { restartAfterScopedRecovery: (gate) => gate }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const index = collection.createIndex((row) => row.title)
-    const signature = collection
-      .getIndexMetadata()
-      .find((metadata) => metadata.indexId === index.id)?.signature
-    if (!signature) throw new Error(`Missing index signature`)
-    let activeRecovery: Promise<void> | undefined
-    try {
-      await collection.stateWhenReady()
-      activeRecovery = recovery()
-      await atPersistedOracleCheckpoint(
-        bootstrapEntered.promise,
-        `new-table index bootstrap`,
-      )
-      expect(collection.removeIndex(index)).toBe(true)
-      expect(collection.getIndexMetadata()).toEqual([])
-      // The removal finishes first; the old bootstrap call can still finish
-      // afterward and must not recreate the retired physical index.
-      await atPersistedOracleCheckpoint(
-        removalSettled.promise,
-        `index removal before late bootstrap ensure`,
-      )
-      expect(durableIndexes.get(`bootstrap-removal-new:${signature}`)).toBe(
-        false,
-      )
-      releaseBootstrap.resolve()
-      await atPersistedOracleCheckpoint(
-        activeRecovery,
-        `cache rotation after index removal`,
-      )
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() =>
-          expect(durableIndexes.get(`bootstrap-removal-new:${signature}`)).toBe(
-            false,
-          ),
-        ),
-        `new-table index removal`,
-      )
-    } finally {
-      releaseBootstrap.resolve()
-      await Promise.allSettled([activeRecovery])
-      await collection.cleanup()
-    }
-  })
-
-  // The same signature can be declared again while bootstrap repairs a late
-  // ensure. After that held removal finishes, the current Collection registry
-  // requires the physical index to be present. This is the reverse boundary
-  // of the preceding witness: the final declaration, not the order in which
-  // obsolete adapter calls finish, determines the durable accelerator.
-  it(`restores an index re-added during cache-rotation reconciliation`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstEnsureEntered = createEventGate()
-    const releaseFirstEnsure = createEventGate()
-    const firstRemovalSettled = createEventGate()
-    const secondRemovalEntered = createEventGate()
-    const releaseSecondRemoval = createEventGate()
-    const durableIndexes = new Map<string, boolean>()
-    let storageId = `bootstrap-readd-old`
-    let recovery!: () => Promise<void>
-    let newStorageEnsures = 0
-    let removals = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `bootstrap-readd-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: (storageId = `bootstrap-readd-new`),
-      claimId: `bootstrap-readd-claim`,
-    })
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (id, signature) => {
-      if (
-        recordedStorageId(id) === `bootstrap-readd-new` &&
-        ++newStorageEnsures === 1
-      ) {
-        firstEnsureEntered.resolve()
-        await releaseFirstEnsure.promise
-      }
-      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, true)
-    }
-    adapter.markIndexRemoved = async (id, signature) => {
-      if (++removals === 2) {
-        secondRemovalEntered.resolve()
-        await releaseSecondRemoval.promise
-      }
-      durableIndexes.set(`${recordedStorageId(id)}:${signature}`, false)
-      firstRemovalSettled.resolve()
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `bootstrap-index-readd`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: (params) => {
-            recovery = params.metadata!.persistence!.startScopedRecovery!
-            params.markReady()
-            return { restartAfterScopedRecovery: (gate) => gate }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const initial = collection.createIndex((row) => row.title)
-    const signature = collection
-      .getIndexMetadata()
-      .find((metadata) => metadata.indexId === initial.id)?.signature
-    if (!signature) throw new Error(`Missing index signature`)
-    let activeRecovery: Promise<void> | undefined
-    try {
-      await collection.stateWhenReady()
-      activeRecovery = recovery()
-      await atPersistedOracleCheckpoint(
-        firstEnsureEntered.promise,
-        `first new-table ensure`,
-      )
-      expect(collection.removeIndex(initial)).toBe(true)
-      await atPersistedOracleCheckpoint(
-        firstRemovalSettled.promise,
-        `old declaration removed`,
-      )
-      releaseFirstEnsure.resolve()
-      await atPersistedOracleCheckpoint(
-        secondRemovalEntered.promise,
-        `bootstrap reconciliation removal`,
-      )
-      const current = collection.createIndex((row) => row.title)
-      expect(
-        collection
-          .getIndexMetadata()
-          .find((metadata) => metadata.indexId === current.id)?.signature,
-      ).toBe(signature)
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(newStorageEnsures).toBeGreaterThan(1)),
-        `re-added index ensure`,
-      )
-      releaseSecondRemoval.resolve()
-      await atPersistedOracleCheckpoint(
-        activeRecovery,
-        `reconciled cache rotation`,
-      )
-      expect(collection.getIndexMetadata()).toHaveLength(1)
-      expect(durableIndexes.get(`bootstrap-readd-new:${signature}`)).toBe(true)
-    } finally {
-      releaseFirstEnsure.resolve()
-      releaseSecondRemoval.resolve()
-      await Promise.allSettled([activeRecovery])
-      await collection.cleanup()
-    }
-  })
-
-  // A second recovery may be requested while the first is still rebuilding
-  // indexes. The first completion cannot reopen source commit admission while
-  // the second rotation is held. The two storage IDs and held index/rotation
-  // gates make that distinction visible before the final cache is accepted.
-  it(`keeps source commits quarantined through overlapping cache rotations`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstIndexEntered = createEventGate()
-    const releaseFirstIndex = createEventGate()
-    const secondRotationEntered = createEventGate()
-    const releaseSecondRotation = createEventGate()
-    let storageId = `overlap-old`
-    let rotations = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `overlap-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      if (++rotations === 2) {
-        secondRotationEntered.resolve()
-        await releaseSecondRotation.promise
-      }
-      storageId = `overlap-new-${rotations}`
-      return { storageCollectionId: storageId, claimId: `overlap-claim` }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async (id) => {
-      if (recordedStorageId(id) === `overlap-new-1`) {
-        firstIndexEntered.resolve()
-        await releaseFirstIndex.promise
-      }
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `overlap-cache-rotation`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { restartAfterScopedRecovery: (gate) => gate }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.createIndex((row) => row.title)
-    let first: Promise<void> | undefined
-    let second: Promise<void> | undefined
-    try {
-      await collection.stateWhenReady()
-      first = source.metadata!.persistence!.startScopedRecovery!()
-      await atPersistedOracleCheckpoint(
-        firstIndexEntered.promise,
-        `first rotation index bootstrap`,
-      )
-      second = source.metadata!.persistence!.startScopedRecovery!()
-      releaseFirstIndex.resolve()
-      await atPersistedOracleCheckpoint(
-        secondRotationEntered.promise,
-        `second cache rotation`,
-      )
-      await first
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `intermediate`, title: `Unaccepted` },
-      })
-      await expect(source.commit()).rejects.toBeInstanceOf(
-        SyncTransactionAbortedError,
-      )
-      expect(collection.get(`intermediate`)).toBeUndefined()
-      releaseSecondRotation.resolve()
-      await second
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `final`, title: `Accepted` },
-      })
-      await whenSyncAccepted(source.commit())
-      expect(collection.get(`final`)).toMatchObject({ id: `final` })
-      expect(storageId).toBe(`overlap-new-2`)
-    } finally {
-      releaseFirstIndex.resolve()
-      releaseSecondRotation.resolve()
-      await Promise.allSettled([first, second])
-      await collection.cleanup()
-    }
-  })
-
-  // Indexes are optional accelerators. An index event whose claim check hits
-  // a temporary adapter error must settle its asynchronous listener without
-  // changing the Collection's ready state. The adapter is held until after
-  // the event so the checkpoint observes the listener's rejection path.
-  it(`keeps a failed runtime index check best-effort`, async () => {
-    const adapter = createRecordingAdapter()
-    const indexCheckEntered = createEventGate()
-    const releaseIndexCheck = createEventGate()
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let failIndexCheck = false
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `index-check-storage`,
-      claimId: `index-check-claim`,
-    })
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: `index-check-replacement`,
-      claimId: `index-check-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      if (failIndexCheck) {
-        indexCheckEntered.resolve()
-        await releaseIndexCheck.promise
-        throw new Error(`temporary index claim check failure`)
-      }
-      return Date.now() + 10_000
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `index-check-best-effort`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: { sync: ({ markReady }) => markReady() },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      failIndexCheck = true
-      collection.createIndex((row) => row.title, { name: `optional-index` })
-      await atPersistedOracleCheckpoint(
-        indexCheckEntered.promise,
-        `runtime index claim check`,
-      )
-      releaseIndexCheck.resolve()
-      await flushAsyncWork()
-      expect(collection.status).toBe(`ready`)
-      expect(warning).toHaveBeenCalledWith(
-        `Failed to ensure persisted index after index:added:`,
-        expect.any(Error),
-      )
-    } finally {
-      releaseIndexCheck.resolve()
-      warning.mockRestore()
-      await collection.cleanup()
-    }
-  })
-
-  // A demand waiting for startup has not reached the source or cache. Its
-  // caller may cancel while a private cache rotation is held. The canceled
-  // demand must reject promptly with AbortError; a sibling keeps waiting and
-  // obtains source rows after rotation. The model treats cancellation as one
-  // demand's settlement, not cancellation of the shared startup or rotation.
-  // The held rotation separates the abort checkpoint from source entry.
-  it(`settles an aborted startup demand while a sibling waits for cache rotation`, async () => {
-    const adapter = createRecordingAdapter()
-    const firstIndexEntered = createEventGate()
-    const releaseFirstIndex = createEventGate()
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    const sourceStarted = createEventGate()
-    let expired = false
-    let storageId = `abort-startup-old`
-    let indexCalls = 0
-    let sourceLoads = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `abort-startup-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () =>
-      expired ? undefined : Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      expired = false
-      storageId = `abort-startup-new`
-      return { storageCollectionId: storageId, claimId: `abort-startup-claim` }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.ensureIndex = async () => {
-      if (++indexCalls === 1) {
-        firstIndexEntered.resolve()
-        await releaseFirstIndex.promise
-      }
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `abort-startup-rotation`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            sourceStarted.resolve()
-            return {
-              restartAfterScopedRecovery: () => {},
-              loadSubset: async () => {
-                sourceLoads++
-                source.begin()
-                source.write({
-                  type: `insert`,
-                  value: { id: `fresh`, title: `New storage` },
-                })
-                await whenSyncAccepted(source.commit())
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    collection.createIndex((row) => row.title, { name: `held-title` })
-    const controller = new AbortController()
-    try {
-      collection.startSyncImmediate()
-      await atPersistedOracleCheckpoint(
-        firstIndexEntered.promise,
-        `startup index`,
-      )
-      expired = true
-      collection.createIndex((row) => row.id, { name: `dynamic-id` })
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `startup rotation`,
-      )
-
-      const canceled = Promise.resolve(
-        collection._sync.loadSubset({ limit: 1, signal: controller.signal }),
-      )
-      void canceled.catch(() => undefined)
-      const sibling = Promise.resolve(collection._sync.loadSubset({ limit: 2 }))
-      let siblingSettled = false
-      void sibling.then(
-        () => {
-          siblingSettled = true
-        },
-        () => {
-          siblingSettled = true
-        },
-      )
-      controller.abort()
-      await expect(
-        atPersistedOracleCheckpoint(canceled, `aborted startup demand`),
-      ).rejects.toMatchObject({ name: `AbortError` })
-      expect(siblingSettled).toBe(false)
-      expect(sourceLoads).toBe(0)
-
-      releaseFirstIndex.resolve()
-      releaseRotation.resolve()
-      await atPersistedOracleCheckpoint(sourceStarted.promise, `source entry`)
-      await atPersistedOracleCheckpoint(sibling, `sibling startup demand`)
-      expect(sourceLoads).toBe(1)
-      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
-    } finally {
-      controller.abort()
-      releaseFirstIndex.resolve()
-      releaseRotation.resolve()
-      await collection.cleanup()
-    }
-  })
-
-  // Source entry may finish before a recovery rotation takes the apply mutex.
-  // A demand admitted behind that mutex still belongs to its own caller: an
-  // explicit abort must reject before rotation settles, while a sibling
-  // remains pending and succeeds afterward. This cut differs from a demand
-  // held before source entry, because the wrapper has already crossed its
-  // startup promises and is waiting inside the persisted runtime.
-  it(`settles an aborted demand behind a held recovery rotation`, async () => {
-    const adapter = createRecordingAdapter()
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    let storageId = `abort-recovery-old`
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `abort-recovery-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      storageId = `abort-recovery-new`
-      return { storageCollectionId: storageId, claimId: `abort-recovery-claim` }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const controller = new AbortController()
-    let source!: TodoSyncParams
-    const sourceLimits: Array<number | undefined> = []
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `abort-held-recovery`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return {
-              restartAfterScopedRecovery: () => {},
-              loadSubset: (options) => {
-                sourceLimits.push(options.limit)
-                return true
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let recovery: Promise<void> | undefined
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      recovery = source.metadata!.persistence!.startScopedRecovery!()
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `held rotation`,
-      )
-
-      const canceled = Promise.resolve(
-        collection._sync.loadSubset({ limit: 1, signal: controller.signal }),
-      )
-      void canceled.catch(() => undefined)
-      const sibling = Promise.resolve(collection._sync.loadSubset({ limit: 2 }))
-      let siblingSettled = false
-      void sibling.then(
-        () => {
-          siblingSettled = true
-        },
-        () => {
-          siblingSettled = true
-        },
-      )
-      await flushAsyncWork()
-      expect(siblingSettled).toBe(false)
-      controller.abort()
-      await expect(
-        atPersistedOracleCheckpoint(canceled, `aborted recovery demand`),
-      ).rejects.toMatchObject({ name: `AbortError` })
-      expect(siblingSettled).toBe(false)
-
-      releaseRotation.resolve()
-      await atPersistedOracleCheckpoint(recovery, `rotation recovery`)
-      await atPersistedOracleCheckpoint(sibling, `sibling recovery demand`)
-      expect(sourceLimits).toContain(2)
-      expect(sourceLimits).not.toContain(1)
-      expect(collection.status).toBe(`ready`)
-    } finally {
-      controller.abort()
-      releaseRotation.resolve()
-      await Promise.allSettled([recovery])
-      await collection.cleanup()
-    }
-  })
-
-  // A custom adapter may opt into managed cache generations. Claiming alone
-  // cannot enforce rotation, expiry, or release; accepting that partial bundle
-  // would make stale durable rows appear authoritative on a later run. The
-  // contract refuses the configuration before a claim or source load begins.
-  it.each([
-    `rotateCacheGeneration`,
-    `renewCacheGenerationClaim`,
-    `releaseCacheGenerationClaim`,
-  ] as const)(`refuses a managed cache adapter without %s`, async (missing) => {
-    const adapter = createRecordingAdapter()
-    adapter.claimCacheGeneration = vi.fn(async () => ({
-      storageCollectionId: `managed-storage`,
-      claimId: `managed-claim`,
-      expiresAtMs: Date.now() + 10_000,
-    }))
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: `rotated-storage`,
-      claimId: `managed-claim`,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 10_000
-    adapter.releaseCacheGenerationClaim = async () => {}
-    delete adapter[missing]
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `partial-managed-adapter-${missing}`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: { sync: (params) => params.markReady() },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await expect(collection.stateWhenReady()).rejects.toThrow(
-        `managed cache generation adapter`,
-      )
-      expect(adapter.claimCacheGeneration).not.toHaveBeenCalled()
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // Losing a durable claim removes authority to hydrate its rows, not the
-  // public demand. The model keeps that demand, clears the old source base,
-  // and satisfies it from one new source snapshot. This driver lets renewal
-  // fail just before demand admission; stale durable rows remain in the fake
-  // adapter so the public row comparison rejects a missing recovery guard.
-  it(`reloads a demanded subset after its persisted cache claim expires`, async () => {
-    const adapter = createRecordingAdapter([
-      { id: `stale`, title: `Old persisted row` },
-    ])
-    let storageId = `expired-old-storage`
-    const claimId = `expiring-claim`
-    let renewals = 0
-    let revokeClaim = false
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      if (revokeClaim) {
-        revokeClaim = false
-        return undefined
-      }
-      return Date.now() + 10_000
-    }
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: (storageId = `expired-private-storage`),
-      claimId,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.releaseCacheGenerationClaim = async () => {}
-    let source!: TodoSyncParams
-    let sourceLoads = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `expired-demand-reload`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return {
-              // Every source load is synchronous up to its tracked commit;
-              // there is no old provider callback to deliver after restart.
-              restartAfterScopedRecovery: () => {},
-              loadSubset: async () => {
-                sourceLoads++
-                source.begin()
-                source.write({
-                  type: `insert`,
-                  value: { id: `fresh`, title: `Fresh source row` },
-                })
-                await whenSyncAccepted(source.commit())
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      revokeClaim = true
-      await collection._sync.loadSubset({ limit: 1 })
-      expect(renewals).toBeGreaterThan(0)
-      expect(sourceLoads).toBe(1)
-      expect(collection.get(`stale`)).toBeUndefined()
-      expect(collection.get(`fresh`)).toMatchObject({
-        id: `fresh`,
-        title: `Fresh source row`,
-      })
-      expect(
-        adapter.applyCommittedTxCalls
-          .filter((call) =>
-            call.tx.mutations.some((mutation) => mutation.key === `fresh`),
-          )
-          .map((call) => call.collectionId),
-      ).toEqual([`expired-private-storage`])
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  /**
-   * A physical cache generation starts a new row-version history. The model
-   * retains one active subset demand through rotation and requires a peer
-   * commit in the replacement generation to reacquire source evidence while
-   * scoped recovery quarantines durable rows. Its row version starts at one
-   * even when the retired generation had reached ten. The zero-version
-   * neighbor shows that the same notification reaches the refresh path when
-   * no retired version can accidentally classify it as already published.
-   * The coordinator records source reacquisition after each public cut; the
-   * old durable row must be absent after rotation.
-   */
-  it.each([
-    { retiredRowVersion: 0, oldRows: [] as Array<Todo> },
-    {
-      retiredRowVersion: 10,
-      oldRows: [{ id: `retired`, title: `Retired cache row` }],
-    },
-  ])(
-    `reacquires a scoped subset after a new-generation peer notice with retired row version $retiredRowVersion`,
-    async ({ retiredRowVersion, oldRows }) => {
-      const adapter = createRecordingAdapter(oldRows)
-      const coordinator = createCoordinatorHarness()
-      const oldStorageId = `peer-rotation-old-${retiredRowVersion}`
-      const newStorageId = `peer-rotation-new-${retiredRowVersion}`
-      let storageId = oldStorageId
-      const remoteEnsures: Array<string> = []
-      const originalLoadResumeSnapshot = adapter.loadResumeSnapshot
-      adapter.loadResumeSnapshot = async (id, context) => {
-        const snapshot = await originalLoadResumeSnapshot(id, context)
-        return {
-          ...snapshot,
-          latestTerm: recordedStorageId(id) === oldStorageId ? 1 : 0,
-          latestSeq:
-            recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
-          latestRowVersion:
-            recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
-        }
-      }
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: storageId,
-        claimId: `peer-rotation-claim-${retiredRowVersion}`,
-        expiresAtMs: Date.now() + 60_000,
-      })
-      adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
-      adapter.rotateCacheGeneration = async () => ({
-        storageCollectionId: (storageId = newStorageId),
-        claimId: `peer-rotation-claim-${retiredRowVersion}`,
-        expiresAtMs: Date.now() + 60_000,
-      })
-      adapter.releaseCacheGenerationClaim = async () => {}
-      coordinator.requestEnsureRemoteSubset = async (id) => {
-        remoteEnsures.push(id)
-      }
-
-      let source!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `peer-rotation-${retiredRowVersion}`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: async (cacheRotated) => {
-                  await cacheRotated
-                },
-                loadSubset: async () => {},
-                unloadSubset: async () => {},
-              }
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      try {
-        collection.startSyncImmediate()
-        await collection.stateWhenReady()
-        await source.metadata!.persistence!.hydrateBaseline()
-        expect(collection.get(`retired`)?.title).toBe(oldRows[0]?.title)
-
-        const persistence = source.metadata?.persistence
-        if (!persistence?.startScopedRecovery) {
-          throw new Error(`Expected scoped recovery capability`)
-        }
-        await persistence.startScopedRecovery()
-        await vi.waitFor(() => expect(remoteEnsures).toContain(newStorageId))
-        expect(collection.get(`retired`)).toBeUndefined()
-        const ensuresAfterRotation = remoteEnsures.length
-        expect(ensuresAfterRotation).toBe(1)
-
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `new-generation-peer-row`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows: [
-              {
-                key: `fresh`,
-                value: { id: `fresh`, title: `Fresh source row` },
-              },
-            ],
-            deletedKeys: [],
-          },
-          `peer`,
-          newStorageId,
-        )
-        await atPersistedOracleCheckpoint(
-          vi.waitFor(() =>
-            expect(remoteEnsures).toHaveLength(ensuresAfterRotation + 1),
-          ),
-          `source reacquisition after a new-generation peer notice`,
-        )
-        expect(remoteEnsures.at(-1)).toBe(newStorageId)
-      } finally {
-        await collection.cleanup()
-      }
-    },
-  )
-
-  /**
-   * A notification is scoped to the physical cache generation that received
-   * it. A peer may deliver an old-generation commit or reset while rotation holds the
-   * wrapper's apply mutex; processing begins only after the new generation
-   * binds. The model discards that old version at the generation boundary,
-   * then requires the next new-generation notice to request reacquisition of
-   * the active subset. The old generation may have a lower or higher row version than
-   * the new notice, so physical identity rather than version order decides
-   * authority. The history grammar varies an absent, commit, or reset old
-   * notice; row versions on both sides; and an absent or present new notice.
-   * No old notice and no new notice are work-count controls. This driver holds
-   * rotation, queues any old notice before the physical ID changes, and checks
-   * source requests after the old callback has crossed the apply mutex. A
-   * persisting optimistic mutation holds the new source snapshot's applied
-   * receipt. A constrained demand already pending at the coordinator must
-   * remain pending until that receipt publishes the source row. Until then,
-   * the refresh acquisition remains owned and the distinct notice-only row
-   * cannot become public during scoped recovery. The controlled coordinator
-   * supplies the receipt wait; the wrapper's settlement and publication are
-   * the observations at this boundary.
-   */
-  type GenerationNoticeHistory = {
-    retiredNotice: `none` | `commit` | `reset`
-    retiredRowVersion: 1 | 10
-    newRowVersion: 1 | 3
-    newNotice: boolean
-  }
-  const assertGenerationNoticeHistory = async ({
-    retiredNotice,
-    retiredRowVersion,
-    newRowVersion,
-    newNotice,
-  }: GenerationNoticeHistory): Promise<void> => {
-    const adapter = createRecordingAdapter([
-      { id: `retired`, title: `Retired cache row` },
-    ])
-    const coordinator = createCoordinatorHarness()
-    const logicalId = `queued-peer-rotation`
-    const oldStorageId = `queued-peer-old-storage`
-    const newStorageId = `queued-peer-new-storage`
-    const rotationEntered = createEventGate()
-    const releaseRotation = createEventGate()
-    const remoteEnsures: Array<string> = []
-    const remoteEnsureOptions: Array<{
-      id: string
-      options: LoadSubsetOptions
-    }> = []
-    const demandEnsureEntered = createEventGate()
-    const demandOptions: LoadSubsetOptions = {
-      limit: 2,
-      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(`fresh`)]),
-    }
-    const sourceCommitReturned = createEventGate()
-    const mutationEntered = createEventGate()
-    const releaseMutation = createEventGate()
-    let refreshReceipt: Promise<void> | undefined
-    let refreshApplied = false
-    const releaseCalls: Array<{
-      id: string
-      options: LoadSubsetOptions
-      appliedAtRelease: boolean
-    }> = []
-    let freshRequestOptions: LoadSubsetOptions | undefined
-    let newNoticeDelivered = false
-    let freshWorkStarted = false
-    let wrongGenerationReads = 0
-    const originalLoadResumeSnapshot = adapter.loadResumeSnapshot
-    adapter.loadResumeSnapshot = async (id, context) => {
-      if (recordedStorageId(id) === logicalId) {
-        wrongGenerationReads++
-        throw new Error(`Retired reset must not read the logical cache ID`)
-      }
-      const snapshot = await originalLoadResumeSnapshot(id, context)
-      return {
-        ...snapshot,
-        latestTerm: recordedStorageId(id) === oldStorageId ? 1 : 0,
-        latestSeq:
-          recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
-        latestRowVersion:
-          recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
-      }
-    }
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: oldStorageId,
-      claimId: `queued-peer-claim`,
-      expiresAtMs: Date.now() + 60_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
-    adapter.rotateCacheGeneration = async () => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      return {
-        storageCollectionId: newStorageId,
-        claimId: `queued-peer-claim`,
-        expiresAtMs: Date.now() + 60_000,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    coordinator.requestEnsureRemoteSubset = async (id, options) => {
-      remoteEnsures.push(id)
-      remoteEnsureOptions.push({ id, options })
-      if (options === demandOptions) {
-        demandEnsureEntered.resolve()
-        await sourceCommitReturned.promise
-        await refreshReceipt
-        return
-      }
-      if (
-        newNoticeDelivered &&
-        !freshWorkStarted &&
-        options.refetch === true &&
-        options.limit === demandOptions.limit
-      ) {
-        freshWorkStarted = true
-        freshRequestOptions = options
-        source.begin()
-        source.write({
-          type: `insert`,
-          value: { id: `fresh`, title: `Fresh source row` },
-        })
-        const receipt = source.commit()
-        if (receipt === true) throw new Error(`Source receipt was untracked`)
-        refreshReceipt = receipt
-        sourceCommitReturned.resolve()
-        await receipt
-        refreshApplied = true
-      }
-    }
-    coordinator.requestReleaseRemoteSubset = async (id, options) => {
-      releaseCalls.push({ id, options, appliedAtRelease: refreshApplied })
-    }
-
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: logicalId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return {
-              restartAfterScopedRecovery: async (cacheRotated) => {
-                await cacheRotated
-              },
-              loadSubset: async () => {},
-              unloadSubset: async () => {},
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-        onInsert: async () => {
-          mutationEntered.resolve()
-          await releaseMutation.promise
-        },
-      }),
-    )
-    let mutation: ReturnType<typeof collection.insert> | undefined
-    let recovery: Promise<void> | undefined
-    let demand: Promise<void> | undefined
-    const publishedFreshTitles: Array<string | undefined> = []
-    const publication = collection.subscribeChanges(
-      (changes) => {
-        if (changes.some((change) => change.key === `fresh`)) {
-          publishedFreshTitles.push(collection.get(`fresh`)?.title)
-        }
-      },
-      { includeInitialState: false },
-    )
-    let hasPrimaryFailure = false
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await source.metadata!.persistence!.hydrateBaseline()
-      expect(collection.get(`retired`)?.title).toBe(`Retired cache row`)
-
-      const persistence = source.metadata?.persistence
-      if (!persistence?.startScopedRecovery) {
-        throw new Error(`Expected scoped recovery capability`)
-      }
-      recovery = persistence.startScopedRecovery()
-      void recovery.catch(() => undefined)
-      await atPersistedOracleCheckpoint(
-        rotationEntered.promise,
-        `old physical cache rotation entered`,
-      )
-      // A queued old notice belongs to the still-subscribed old physical ID.
-      if (retiredNotice !== `none`) {
-        coordinator.emit(
-          retiredNotice === `commit`
-            ? {
-                type: `tx:committed`,
-                term: 1,
-                seq: retiredRowVersion + 1,
-                txId: `retired-generation-peer-row`,
-                latestRowVersion: retiredRowVersion + 1,
-                requiresFullReload: false,
-                changedRows: [
-                  {
-                    key: `retired`,
-                    value: { id: `retired`, title: `Old peer row` },
-                  },
-                ],
-                deletedKeys: [],
-              }
-            : { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
-          `peer`,
-          oldStorageId,
-        )
-      }
-      releaseRotation.resolve()
-      await atPersistedOracleCheckpoint(recovery, `cache rotation settled`)
-      // This scan enters the same apply mutex behind the old notice. Its
-      // settlement is the checkpoint at which that notice can no longer
-      // change the new generation's row-version observation.
-      await persistence.scanPersistedRows()
-      expect(wrongGenerationReads).toBe(0)
-      expect(collection.status).toBe(`ready`)
-      expect(collection.get(`retired`)).toBeUndefined()
-      // Rotation reacquires this active subset once. The queued old notice
-      // must not add another source request against the replacement cache.
-      expect(remoteEnsures).toEqual([newStorageId])
-
-      if (newNotice) {
-        const pendingDemand = Promise.resolve(
-          collection._sync.loadSubset(demandOptions),
-        ).then(() => undefined)
-        demand = pendingDemand
-        void pendingDemand.catch(() => undefined)
-        await atPersistedOracleCheckpoint(
-          demandEnsureEntered.promise,
-          `constrained demand entered source coordinator`,
-        )
-        expect(
-          remoteEnsureOptions.filter(
-            ({ options }) => options === demandOptions,
-          ),
-        ).toEqual([{ id: newStorageId, options: demandOptions }])
-        const demandSettlement = observeSettlement(pendingDemand)
-        await flushAsyncWork()
-        expect(demandSettlement.read()).toEqual({ status: `pending` })
-        const ensuresBeforeNotice = remoteEnsures.length
-        mutation = collection.insert({ id: `local`, title: `Pending` })
-        await atPersistedOracleCheckpoint(
-          mutationEntered.promise,
-          `optimistic publication hold before new notice`,
-        )
-        newNoticeDelivered = true
-        coordinator.emit(
-          {
-            type: `tx:committed`,
-            term: 1,
-            seq: newRowVersion,
-            txId: `new-generation-peer-row`,
-            latestRowVersion: newRowVersion,
-            requiresFullReload: false,
-            changedRows: [
-              {
-                key: `fresh`,
-                value: { id: `fresh`, title: `Notice-only row` },
-              },
-            ],
-            deletedKeys: [],
-          },
-          `peer`,
-          newStorageId,
-        )
-        await atPersistedOracleCheckpoint(
-          vi.waitFor(() =>
-            expect(remoteEnsures.length).toBeGreaterThan(ensuresBeforeNotice),
-          ),
-          `new-generation source reacquisition after an old notice`,
-        )
-        expect(remoteEnsures.at(-1)).toBe(newStorageId)
-        await atPersistedOracleCheckpoint(
-          sourceCommitReturned.promise,
-          `new-generation source receipt returned`,
-        )
-        expect(remoteEnsureOptions).toContainEqual({
-          id: newStorageId,
-          options: { ...demandOptions, refetch: true },
-        })
-        const applied = observeSettlement(refreshReceipt!)
-        await flushAsyncWork()
-        expect(freshRequestOptions).toBeDefined()
-        expect(applied.read()).toEqual({ status: `pending` })
-        expect(demandSettlement.read()).toEqual({ status: `pending` })
-        expect(refreshApplied).toBe(false)
-        expect(
-          releaseCalls.filter(({ options }) => options === freshRequestOptions),
-        ).toEqual([])
-        expect(collection.get(`retired`)).toBeUndefined()
-        expect(collection.get(`fresh`)).toBeUndefined()
-        expect(publishedFreshTitles).toEqual([])
-        releaseMutation.resolve()
-        await atPersistedOracleCheckpoint<unknown>(
-          mutation.isPersisted.promise,
-          `optimistic publication released`,
-        )
-        await atPersistedOracleCheckpoint(
-          vi.waitFor(() => expect(refreshApplied).toBe(true)),
-          `fresh source snapshot applied`,
-        )
-        await atPersistedOracleCheckpoint(
-          vi.waitFor(() =>
-            expect(
-              releaseCalls.filter(
-                ({ options }) => options === freshRequestOptions,
-              ),
-            ).toHaveLength(1),
-          ),
-          `refresh acquisition released after application`,
-        )
-        expect(
-          releaseCalls.filter(({ options }) => options === freshRequestOptions),
-        ).toEqual([
-          {
-            id: newStorageId,
-            options: freshRequestOptions,
-            appliedAtRelease: true,
-          },
-        ])
-        expect(collection.get(`fresh`)).toMatchObject({
-          id: `fresh`,
-          title: `Fresh source row`,
-        })
-        await atPersistedOracleCheckpoint(
-          pendingDemand,
-          `constrained demand settled`,
-        )
-        expect(demandSettlement.read()).toEqual({ status: `fulfilled` })
-        expect(publishedFreshTitles).toEqual([`Fresh source row`])
-      } else {
-        await persistence.scanPersistedRows()
-        expect(remoteEnsures).toEqual([newStorageId])
-      }
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseRotation.resolve()
-      releaseMutation.resolve()
-      publication.unsubscribe()
-      await cleanupPersistedOracle(
-        [
-          () => recovery,
-          () => mutation?.isPersisted.promise.catch(() => undefined),
-          () => demand?.catch(() => undefined),
-          () => collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  }
-
-  it.each([
-    { retiredNotice: `commit`, retiredRowVersion: 1, newRowVersion: 3 },
-    { retiredNotice: `reset`, retiredRowVersion: 1, newRowVersion: 3 },
-    { retiredNotice: `commit`, retiredRowVersion: 10, newRowVersion: 1 },
-    { retiredNotice: `reset`, retiredRowVersion: 10, newRowVersion: 1 },
-  ] as const)(
-    `does not let a queued retired-generation $retiredNotice at row version $retiredRowVersion affect a new-generation peer notice`,
-    ({ retiredNotice, retiredRowVersion, newRowVersion }) =>
-      assertGenerationNoticeHistory({
-        retiredNotice,
-        retiredRowVersion,
-        newRowVersion,
-        newNotice: true,
-      }),
-  )
-
-  const generationNoticeHistory = fc.record({
-    retiredNotice: fc.constantFrom<GenerationNoticeHistory[`retiredNotice`]>(
-      `none`,
-      `commit`,
-      `reset`,
-    ),
-    retiredRowVersion: fc.constantFrom<
-      GenerationNoticeHistory[`retiredRowVersion`]
-    >(1, 10),
-    newRowVersion: fc.constantFrom<GenerationNoticeHistory[`newRowVersion`]>(
-      1,
-      3,
-    ),
-    newNotice: fc.boolean(),
-  })
-  fcTest.prop([generationNoticeHistory], {
-    seed: 2069,
-    numRuns: oracleRuns(24),
-  })(
-    `checks generated cache-generation notice histories (fixed)`,
-    assertGenerationNoticeHistory,
-  )
-  fcTest.prop(
-    [generationNoticeHistory],
-    oraclePropertyOptions(24, `persistence.generation-notice`),
-  )(
-    `checks generated cache-generation notice histories (random or replayed)`,
-    assertGenerationNoticeHistory,
-  )
-
-  /**
-   * A follower has no local source. It routes demand to the elected owner,
-   * and the owner's commits reach it only as durable rows plus a commit
-   * notice. After a cache rotation the follower is in scoped recovery, where
-   * durable rows cannot replace source rows. Rotation gives the follower a
-   * fresh cache generation, and the follower asks the owner to reacquire
-   * every active demand into it. Once those reacquisitions settle, the new
-   * generation holds exactly the owner's rows for that demand, so durable
-   * rows are authoritative again. The law is therefore: while the
-   * reacquisitions are in flight, the follower holds the generation's commit
-   * notices; when they settle, scoped recovery ends for that generation and
-   * the held notices, and every later one, apply through the normal path.
-   * No sender is special: a peer's notice after recovery is an ordinary
-   * invalidation that rereads durable rows.
-   *
-   * The independent model is `expectedScopedSnapshot` with complete demand
-   * over the authored durable rows of the current generation. It knows
-   * nothing about notices or scoped recovery; the driver applies it only at
-   * checkpoints where the owner's evidence has arrived. The ensure log is a
-   * separate observation: one acquisition and one reacquisition after
-   * rotation, and no other ensure. A bounded leader that re-commits on every
-   * ensure makes the alternative design (answer every notice during scoped
-   * recovery with a refetch) loop, and the bound turns that loop into an
-   * assertion failure.
-   *
-   * The grammar crosses when the owner first commits the row (before or
-   * after the rotation) with a later broadcast for the same key: none, an
-   * owner update, or a peer notice that claims a different value. An owner
-   * update's durable read either succeeds or fails. Recovery has ended, so a
-   * failed read of it is a real failure: the follower becomes terminal and
-   * keeps the rows it showed, instead of silently ignoring the failure as if
-   * a new recovery had started during the read.
-   * The
-   * observations are the follower's rows when its first load settles, after
-   * the rotation's reacquisition, and after the later broadcast, plus the
-   * ensure log at quiescence. The coordinator is a controlled double of an
-   * elected owner; it does not prove the browser transport.
-   *
-   * Known gap (#2139): production does not end a rotated follower's scoped
-   * recovery, so this lane's cells are pinned as failing until it does.
-   */
-  type FollowerGenerationNoticeHistory = {
-    ownerCommit: `before-rotation` | `after-rotation`
-    later: `none` | `owner` | `peer`
-    // Applies only to a later owner update.
-    ownerRead: `ok` | `fails`
-    // Control: an owner notice's read is in flight when rotation starts, and
-    // then fails. Recovery owns that read, so its failure is ignored.
-    readFailsAsRotationStarts?: boolean
-    // How the owner's notices in the rotated generation reach the follower:
-    // in order, after a gap in the stream position (the follower's position
-    // restarts at zero when it rotates), or as an exact-ID reconciliation
-    // reload. Each must publish the same rows once recovery ends.
-    noticeShape?: `plain` | `gap` | `reconciliation`
-  }
-  const assertFollowerGenerationNoticeHistory = async ({
-    ownerCommit,
-    later,
-    ownerRead,
-    readFailsAsRotationStarts = false,
-    noticeShape = `plain`,
-  }: FollowerGenerationNoticeHistory): Promise<void> => {
-    const readFailure = new Error(`owner update read failed`)
-    let failNextRead = false
-    let holdNextRead:
-      { promise: Promise<void>; reject: (e: unknown) => void } | undefined
-    const oldStorageId = `follower-notice-old`
-    const newStorageId = `follower-notice-new`
-    const ownerId = `elected-owner`
-    const v1: Todo = { id: `remote`, title: `Owner row` }
-    const v2: Todo = { id: `remote`, title: `Owner update` }
-    const durable = new Map<string, Map<string, Todo>>([
-      [oldStorageId, new Map()],
-      [newStorageId, new Map()],
-    ])
-    let storageId = oldStorageId
-    // The owner's upstream row: present from the start, or only once the
-    // owner fetched it after the rotation began.
-    let upstream: Todo | undefined =
-      ownerCommit === `before-rotation` ? v1 : undefined
-    const ensures: Array<{ id: string; refetch: boolean }> = []
-    const subscribers = new Map<
-      string,
-      (message: ProtocolEnvelope<unknown>) => void
-    >()
-    const versions = new Map<string, number>()
-    // Enough commits for every legal history; a refetch loop exceeds it.
-    const commitBudget = 8
-    let commits = 0
-    const notify = (id: string, row: Todo, senderId: string) => {
-      // A gap skips one stream position in the rotated generation.
-      const skip =
-        noticeShape === `gap` && id === newStorageId && !versions.has(id)
-          ? 1
-          : 0
-      const version = (versions.get(id) ?? 0) + 1 + skip
-      versions.set(id, version)
-      const reconciliation =
-        noticeShape === `reconciliation` && id === newStorageId
-      subscribers.get(id)?.({
-        v: 1,
-        dbName: `test-db`,
-        collectionId: id,
-        senderId,
-        ts: Date.now(),
-        payload: {
-          type: `tx:committed`,
-          term: 1,
-          seq: version,
-          txId: `${senderId}-${id}-${version}`,
-          latestRowVersion: version,
-          requiresFullReload: reconciliation,
-          ...(reconciliation ? { reconciliationReload: true } : {}),
-          changedRows: [{ key: row.id, value: { ...row } }],
-          deletedKeys: [],
-        } satisfies TxCommitted,
-      })
-    }
-    const ownerCommits = (id: string, row: Todo) => {
-      if (commits++ >= commitBudget) return
-      durable.get(id)!.set(row.id, structuredClone(row))
-      notify(id, row, ownerId)
-    }
-    const adapter: PersistenceAdapter = {
-      loadSubset: async (target) => {
-        const hold = holdNextRead
-        if (hold) {
-          holdNextRead = undefined
-          await hold.promise
-        }
-        if (failNextRead) {
-          failNextRead = false
-          throw readFailure
-        }
-        return Array.from(
-          durable.get(recordedStorageId(target))!.values(),
-          (value) => ({
-            key: value.id,
-            value: structuredClone(value),
-          }),
-        )
-      },
-      claimCacheGeneration: async () => ({
-        storageCollectionId: oldStorageId,
-        claimId: `follower-notice-claim`,
-        expiresAtMs: Date.now() + 60_000,
-      }),
-      renewCacheGenerationClaim: async () => Date.now() + 60_000,
-      rotateCacheGeneration: async () => {
-        storageId = newStorageId
-        if (ownerCommit === `after-rotation`) upstream = v1
-        return {
-          storageCollectionId: newStorageId,
-          claimId: `follower-notice-claim`,
-          expiresAtMs: Date.now() + 60_000,
-        }
-      },
-      releaseCacheGenerationClaim: async () => {},
-      loadResumeSnapshot: async () => ({
-        rows: [],
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }),
-      applyCommittedTx: async () => {},
-      ensureIndex: async () => {},
-    }
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `follower-node`,
-      subscribe: (id, onMessage) => {
-        subscribers.set(id, onMessage)
-        return () => {
-          if (subscribers.get(id) === onMessage) subscribers.delete(id)
-        }
-      },
-      publish: () => {},
-      isLeader: () => false,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      // The elected owner loads its upstream and commits it into the
-      // requested generation before it replies, on every ensure.
-      requestEnsureRemoteSubset: async (id, options) => {
-        ensures.push({ id, refetch: options.refetch === true })
-        if (upstream) ownerCommits(id, upstream)
-      },
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyCommittedTx: (_id, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      pullSince: () =>
-        Promise.resolve({
-          type: `rpc:pullSince:res`,
-          rpcId: `follower-notice-pull`,
-          ok: true,
-          latestTerm: 1,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          requiresFullReload: false,
-          changedKeys: [],
-          deletedKeys: [],
-        }),
-    }
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `follower-generation-notice`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return {
-              loadSubset: async () => {},
-              restartAfterScopedRecovery: async (cacheRotated) => {
-                await cacheRotated
-              },
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const demand: LoadSubsetOptions = { limit: 10 }
-    const publicRows = () =>
-      new Map(
-        Array.from(collection.state, ([key, row]) => [
-          String(key),
-          stripVirtualProps(row) as Todo,
-        ]),
-      )
-    // A checkpoint after the follower has processed every delivered notice:
-    // the scan crosses the same apply mutex the notices use.
-    const settled = async (label: string) => {
-      await flushAsyncWork()
-      await atPersistedOracleCheckpoint(
-        source.metadata!.persistence!.scanPersistedRows(),
-        label,
-      )
-      await flushAsyncWork()
-    }
-    const expectOwnerEvidence = (previous: ReadonlyMap<string, Todo>) => {
-      const expected = expectedScopedSnapshot(
-        previous,
-        durable.get(storageId)!,
-        new Map(),
-        true,
-      )
-      expectExactSnapshot(publicRows(), expected)
-      return expected
-    }
-    let hasPrimaryFailure = false
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await atPersistedOracleCheckpoint(
-        Promise.resolve(collection._sync.loadSubset(demand)),
-        `follower demand settled`,
-      )
-      await settled(`first-ready notices processed`)
-      let visible = expectOwnerEvidence(new Map())
-
-      const persistence = source.metadata?.persistence
-      if (!persistence?.startScopedRecovery) {
-        throw new Error(`Expected scoped recovery capability`)
-      }
-      let rotation: Promise<void>
-      if (readFailsAsRotationStarts) {
-        let reject!: (error: unknown) => void
-        const promise = new Promise<void>((_resolve, rejectRead) => {
-          reject = rejectRead
-        })
-        void promise.catch(() => undefined)
-        holdNextRead = { promise, reject }
-        ownerCommits(oldStorageId, {
-          id: `remote`,
-          title: `Pre-rotation update`,
-        })
-        await flushAsyncWork()
-        rotation = persistence.startScopedRecovery()
-        reject(readFailure)
-      } else {
-        rotation = persistence.startScopedRecovery()
-      }
-      await atPersistedOracleCheckpoint(
-        rotation,
-        `follower cache rotation settled`,
-      )
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() =>
-          expect(ensures.map(({ id }) => id)).toContain(newStorageId),
-        ),
-        `reacquisition reached the owner`,
-      )
-      await settled(`reacquisition notices processed`)
-      // Answering the owner's notice with another refetch would make the
-      // owner commit again, and the follower would refetch forever.
-      expect.soft(ensures).toHaveLength(2)
-      visible = expectOwnerEvidence(visible)
-
-      if (later === `owner`) {
-        upstream = v2
-        failNextRead = ownerRead === `fails`
-        ownerCommits(newStorageId, v2)
-        if (ownerRead === `fails`) {
-          // Not settled(): a terminal runtime rejects the checkpoint scan.
-          await flushAsyncWork()
-          await vi.waitFor(() => expect(collection.status).toBe(`crashed`))
-          expectExactSnapshot(publicRows(), visible)
-        } else {
-          await settled(`owner update processed`)
-          expectOwnerEvidence(visible)
-        }
-      } else if (later === `peer`) {
-        // A peer's notice after recovery is an ordinary invalidation: the
-        // follower rereads durable rows, which the peer did not change, so
-        // its rows stay as they were and it sends no other ensure.
-        notify(newStorageId, { id: `remote`, title: `Peer claim` }, `peer-node`)
-        await settled(`peer notice processed`)
-        expectOwnerEvidence(visible)
-      }
-
-      expect(ensures).toEqual([
-        { id: oldStorageId, refetch: false },
-        { id: newStorageId, refetch: true },
-      ])
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => collection.cleanup()],
-        hasPrimaryFailure,
-      )
-    }
-  }
-
-  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
-  // the owner's rows in the new generation never become visible.
-  it.fails.each([
-    { ownerCommit: `before-rotation`, later: `none` },
-    { ownerCommit: `after-rotation`, later: `none` },
-    { ownerCommit: `after-rotation`, later: `owner` },
-    { ownerCommit: `before-rotation`, later: `peer` },
-  ] as const)(
-    `publishes an elected owner's rows to a follower after rotation: commit $ownerCommit, later $later`,
-    (history) =>
-      assertFollowerGenerationNoticeHistory({ ...history, ownerRead: `ok` }),
-  )
-
-  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
-  // the owner's rows in the new generation never become visible.
-  it.fails.each(
-    ([`gap`, `reconciliation`] as const).flatMap((noticeShape) =>
-      ([`before-rotation`, `after-rotation`] as const).flatMap((ownerCommit) =>
-        ([`none`, `owner`] as const).map((later) => ({
-          ownerCommit,
-          later,
-          noticeShape,
-        })),
-      ),
-    ),
-  )(
-    `publishes an elected owner's rows after rotation when its notice is a $noticeShape: commit $ownerCommit, later $later`,
-    (history) =>
-      assertFollowerGenerationNoticeHistory({ ...history, ownerRead: `ok` }),
-  )
-
-  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
-  // the owner's rows in the new generation never become visible.
-  it.fails.each([
-    { ownerCommit: `before-rotation`, later: `owner` },
-    { ownerCommit: `after-rotation`, later: `owner` },
-  ] as const)(
-    `fails a follower when its elected owner's update cannot be read after rotation: commit $ownerCommit`,
-    (history) =>
-      assertFollowerGenerationNoticeHistory({ ...history, ownerRead: `fails` }),
-  )
-
-  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
-  // the owner's rows in the new generation never become visible.
-  it.fails(
-    `ignores a follower read failure when rotation starts while the read is in flight`,
-    () =>
-      assertFollowerGenerationNoticeHistory({
-        ownerCommit: `before-rotation`,
-        later: `none`,
-        ownerRead: `ok`,
-        readFailsAsRotationStarts: true,
-      }),
-  )
-
-  const followerGenerationNoticeHistory = fc.record({
-    ownerCommit: fc.constantFrom<
-      FollowerGenerationNoticeHistory[`ownerCommit`]
-    >(`before-rotation`, `after-rotation`),
-    later: fc.constantFrom<FollowerGenerationNoticeHistory[`later`]>(
-      `none`,
-      `owner`,
-      `peer`,
-    ),
-    ownerRead: fc.constantFrom<FollowerGenerationNoticeHistory[`ownerRead`]>(
-      `ok`,
-      `fails`,
-    ),
-  })
-  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
-  // the owner's rows in the new generation never become visible. Some
-  // generated histories pass today, so a random draw cannot be pinned as
-  // failing; this fixed seed pins the gap. The fix for #2139 adds the random
-  // and replayed campaign back.
-  it.fails(
-    `checks generated follower generation-notice histories (fixed)`,
-    () =>
-      fc.assert(
-        fc.asyncProperty(
-          followerGenerationNoticeHistory,
-          assertFollowerGenerationNoticeHistory,
-        ),
-        { seed: 2128, numRuns: oracleRuns(12) },
-      ),
-  )
-  /**
-   * A follower routes demand it cannot serve to the elected owner. The owner
-   * loads the rows upstream, commits them durably, and broadcasts the commit
-   * before it answers the ensure request on the same channel. The follower
-   * applies that broadcast asynchronously, by reading durable rows under its
-   * apply mutex. Law 7 therefore owes: the follower's load settles only after
-   * the broadcasts that preceded the reply have applied here, and it rejects,
-   * with the runtime terminal, if applying them failed.
-   *
-   * The independent model knows only whether the owner's commit applies.
-   * While that apply is held, no consumer of the demand has settled. If it
-   * applies, the consumer settles successfully with the owner's row visible.
-   * If it fails, the consumer rejects without the row, and the source is in
-   * error. The model does not know how the follower queues commits.
-   *
-   * The grammar crosses where the owner's broadcast meets the follower with
-   * whether its apply succeeds. A direct broadcast applies at once. A queued
-   * broadcast arrives while another subset's hydration holds the apply mutex,
-   * so it waits in the queue. A rotated history loses the cache claim after
-   * the first hydration read, so the demand reacquires through the owner
-   * under a new generation. An expired history lets the follower's cache
-   * claim lapse while its ensure is in flight, so the owner's notice arrives
-   * while the claim is expired; renewal keeps the same generation. The read
-   * that applies the owner's row is the one
-   * whose durable snapshot contains it; the driver holds that read to observe
-   * the not-ready checkpoint, or fails it. The consumer is a live query
-   * over the demanded rows or the follower's load itself. Observations, while
-   * the apply is held and after it settles: whether the consumer settled, its
-   * outcome, the demanded rows it sees when it settles (the query's
-   * first-ready rows, or the source's rows at load settlement), and the
-   * query's and source's status. A load that rejects owes the release of the
-   * remote acquisition the owner granted it (LoadSubsetFn), so for the load
-   * consumer the model also counts the follower's release requests for the
-   * current cache generation when it settles. The coordinator
-   * is a controlled double of an elected owner that broadcasts before it
-   * replies, as the built-in coordinator does; the two-tab OPFS suite is the
-   * receiving witness for the browser transport.
-   *
-   * A separate cell lets the claim lapse after the owner's row applied, so
-   * the follower's renewal at the reply fails transiently. That is not claim
-   * loss: the load rejects as after a failed ensure, and the demand stays
-   * active and retries instead of releasing the owner's acquisition.
-   *
-   * Known gap (#2139): a rotated follower never ends scoped recovery, so the
-   * owner's row never becomes visible in the rotated placement. Its cells are
-   * pinned as failing, and the generated histories omit that placement. A
-   * rotation that starts while a load waits for the owner's commits is also
-   * outside this lane and tracked there.
-   */
-  type FollowerRemoteDemandHistory = {
-    placement: `direct` | `queued` | `rotated` | `expired`
-    apply: `ok` | `fails`
-    // A live query over the demand, or the follower's load itself.
-    consumer: `live-query` | `load`
-    // The owner's row applies, then the claim lapses before the reply and
-    // the follower's first renewal fails transiently.
-    renewal?: `fails-at-reply`
-  }
-  type FollowerRow = { id: string; group: string }
-
-  const expectedFollowerRemoteDemand = (
-    history: FollowerRemoteDemandHistory,
-  ) => {
-    const applied = history.apply === `ok`
-    return {
-      // While the owner's commit has not applied here, nothing has settled.
-      whileApplyHeld: { settled: false, rows: undefined },
-      settled:
-        history.consumer === `live-query`
-          ? applied
-            ? { outcome: `fulfilled`, rows: [`remote`], status: `ready` }
-            : { outcome: `rejected`, rows: undefined, status: `crashed` }
-          : applied
-            ? {
-                outcome: `fulfilled`,
-                rows: [`remote`],
-                status: undefined,
-                releases: 0,
-              }
-            : {
-                outcome: `rejected`,
-                rows: undefined,
-                status: `crashed`,
-                releases: 1,
-              },
-    }
-  }
-
-  function createFollowerTab(history: FollowerRemoteDemandHistory) {
-    const durable: Array<FollowerRow> = []
-    const applyRead = createDeferred()
-    const applyReadStarted = createDeferred()
-    const otherHydrationStarted = createDeferred()
-    const otherHydration = createDeferred()
-    let reads = 0
-    let storageId = `follower-demand-cache-1`
-    let loseClaim = false
-    const claim = () => ({
-      storageCollectionId: storageId,
-      claimId: `follower-demand-claim`,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    const rotated = history.placement === `rotated`
-    const expiring = history.placement === `expired`
-    const renewalFailsAtReply = history.renewal === `fails-at-reply`
-    let failRenewal = false
-    let now = 1_000_000
-    const adapter: PersistenceAdapter = {
-      loadSubset: async () => {
-        const read = ++reads
-        const snapshot = durable.slice()
-        if (snapshot.some((row) => row.id === `remote`)) {
-          applyReadStarted.resolve()
-          await applyRead.promise
-          if (history.apply === `fails`) throw new Error(`apply read failed`)
-        } else if (history.placement === `queued` && read === 2) {
-          otherHydrationStarted.resolve()
-          await otherHydration.promise
-        }
-        if (rotated && read === 1) loseClaim = true
-        return snapshot.map((value) => ({ key: value.id, value }))
-      },
-      ...(expiring
-        ? {
-            getCacheGenerationNow: () => now,
-            claimCacheGeneration: async () => ({
-              storageCollectionId: storageId,
-              claimId: `follower-demand-claim`,
-              expiresAtMs: now + 10_000,
-            }),
-            // The claim is still held, so renewal keeps this generation.
-            renewCacheGenerationClaim: async () => now + 10_000,
-            rotateCacheGeneration: async () => {
-              throw new Error(`an expired history must not rotate`)
-            },
-            releaseCacheGenerationClaim: async () => {},
-          }
-        : {}),
-      ...(renewalFailsAtReply
-        ? {
-            getCacheGenerationNow: () => now,
-            claimCacheGeneration: async () => ({
-              storageCollectionId: storageId,
-              claimId: `follower-demand-claim`,
-              expiresAtMs: now + 10_000,
-            }),
-            // A transient storage error, not a lost claim.
-            renewCacheGenerationClaim: async () => {
-              if (failRenewal) {
-                failRenewal = false
-                throw new Error(`transient renewal failure`)
-              }
-              return now + 10_000
-            },
-            rotateCacheGeneration: async () => {
-              throw new Error(`a transient renewal failure must not rotate`)
-            },
-            releaseCacheGenerationClaim: async () => {},
-          }
-        : {}),
-      ...(rotated
-        ? {
-            claimCacheGeneration: async () => claim(),
-            renewCacheGenerationClaim: async () =>
-              loseClaim ? undefined : Date.now() + 10_000,
-            rotateCacheGeneration: async () => {
-              loseClaim = false
-              storageId = `follower-demand-cache-2`
-              return claim()
-            },
-            releaseCacheGenerationClaim: async () => {},
-          }
-        : {}),
-      loadResumeSnapshot: () =>
-        Promise.resolve({
-          rows: [],
-          keySet: { status: `consistent` },
-          collectionMetadata: [],
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          resetEpoch: 0,
-        }),
-      applyCommittedTx: async () => {},
-      ensureIndex: async () => {},
-    } as PersistenceAdapter
-    let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-    let ensures = 0
-    let releases = 0
-    let resetPending = false
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `follower`,
-      subscribe: (_collectionId, onMessage) => {
-        subscriber = onMessage
-        return () => {
-          subscriber = undefined
-        }
-      },
-      publish: () => {},
-      isLeader: () => false,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      // The owner commits once, broadcasts, then replies; later ensures find
-      // nothing new.
-      requestEnsureRemoteSubset: async (collectionId) => {
-        if (++ensures > 1 && !resetPending) return
-        resetPending = false
-        if (history.placement === `queued`) await otherHydrationStarted.promise
-        // The follower's claim lapses before the owner's notice reaches it.
-        if (expiring) now += 20_000
-        const value = { id: `remote`, group: `a` }
-        durable.push(value)
-        const payload: TxCommitted = {
-          type: `tx:committed`,
-          term: 1,
-          seq: ensures,
-          txId: `owner-tx-${ensures}`,
-          latestRowVersion: ensures,
-          requiresFullReload: false,
-          changedRows: [{ key: value.id, value }],
-          deletedKeys: [],
-        }
-        subscriber?.({
-          v: 1,
-          dbName: `test-db`,
-          collectionId,
-          senderId: `owner`,
-          ts: Date.now(),
-          payload,
-        })
-        if (renewalFailsAtReply) {
-          // Let the owner's row apply here before the claim lapses.
-          for (let i = 0; i < 5; i++)
-            await new Promise((resolve) => setTimeout(resolve, 0))
-          now += 20_000
-          failRenewal = true
-        }
-      },
-      // Rotation legitimately releases the previous generation's
-      // acquisition, so only the current generation's releases count.
-      requestReleaseRemoteSubset: async (collectionId) => {
-        if (!rotated || collectionId === storageId) releases++
-      },
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-      pullSince: () =>
-        Promise.resolve({
-          type: `rpc:pullSince:res`,
-          rpcId: `follower-demand-pull`,
-          ok: true,
-          latestTerm: 1,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          requiresFullReload: false,
-          changedKeys: [],
-          deletedKeys: [],
-        }),
-    }
-    const source = createCollection(
-      persistedCollectionOptions<FollowerRow, string>({
-        id: `follower-demand-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        persistence: { adapter, coordinator },
-        syncMode: `on-demand`,
-        sync: {
-          sync: () => ({
-            loadSubset: () => Promise.resolve(),
-            restartAfterScopedRecovery: () => {},
-          }),
-        },
-      }),
-    )
-    source.startSyncImmediate()
-    return {
-      source,
-      applyReadStarted: applyReadStarted.promise,
-      otherHydrationStarted: otherHydrationStarted.promise,
-      releaseApply: () => applyRead.resolve(),
-      releaseOtherHydration: () => otherHydration.resolve(),
-      releases: () => releases,
-      ensures: () => ensures,
-      // The owner resets durable storage and announces it; it loads the
-      // demanded row again on the next ensure.
-      resetOwner: () => {
-        durable.length = 0
-        resetPending = true
-        subscriber?.({
-          v: 1,
-          dbName: `test-db`,
-          collectionId: source.id,
-          senderId: `owner`,
-          ts: Date.now(),
-          payload: {
-            type: `collection:reset`,
-            schemaVersion: 1,
-            resetEpoch: 1,
-          },
-        })
-      },
-    }
-  }
-
-  // Wait for a driver event, but turn a missing event into an observation
-  // rather than a timeout.
-  const within = (promise: Promise<unknown>, ms = 200) =>
-    Promise.race([
-      promise.then(() => true),
-      new Promise<boolean>((resolve) => setTimeout(() => resolve(false), ms)),
-    ])
-
-  const assertFollowerRemoteDemandHistory = async (
-    history: FollowerRemoteDemandHistory,
-  ) => {
-    const expected = expectedFollowerRemoteDemand(history)
-    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const tab = createFollowerTab(history)
-    const groupQuery = (group: string) =>
-      createLiveQueryCollection((q) =>
-        q.from({ row: tab.source }).where(({ row }) => eq(row.group, group)),
-      )
-    const query = groupQuery(`a`)
-    const other = groupQuery(`b`)
-    try {
-      // The consumer's observation: its outcome, and the demanded rows it
-      // sees when it settles.
-      const seen: {
-        outcome: `pending` | `fulfilled` | `rejected`
-        rows?: Array<string>
-      } = { outcome: `pending` }
-      const demandedRows = () =>
-        Array.from(tab.source.values())
-          .filter((row) => row.group === `a`)
-          .map((row) => row.id)
-          .sort()
-      let settled: Promise<unknown>
-      if (history.consumer === `live-query`) {
-        query.onFirstReady(() => {
-          seen.rows = query.toArray.map((row) => (row as FollowerRow).id).sort()
-        })
-        settled = query.preload().then(
-          () => (seen.outcome = `fulfilled`),
-          () => (seen.outcome = `rejected`),
-        )
-      } else {
-        settled = Promise.resolve(
-          tab.source._sync.loadSubset({
-            where: new IR.Func(`eq`, [
-              new IR.PropRef([`group`]),
-              new IR.Value(`a`),
-            ]),
-          }),
-        ).then(
-          () => {
-            seen.outcome = `fulfilled`
-            seen.rows = demandedRows()
-          },
-          () => (seen.outcome = `rejected`),
-        )
-      }
-      if (history.placement === `queued`) void other.preload().catch(() => {})
-
-      if (history.placement === `queued`) {
-        // The owner's broadcast arrives while this hydration holds the apply
-        // mutex, so it waits in the queue until the hydration ends.
-        await within(tab.otherHydrationStarted)
-        await new Promise((resolve) => setTimeout(resolve, 0))
-        tab.releaseOtherHydration()
-      }
-      const applyStarted = await within(tab.applyReadStarted)
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      // Checkpoint: the owner has replied, but its row has not applied here.
-      expect({
-        applyStarted,
-        settled: seen.outcome !== `pending`,
-        rows: seen.rows,
-      }).toEqual({ applyStarted: true, ...expected.whileApplyHeld })
-
-      tab.releaseApply()
-      await within(settled)
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      // Checkpoint: the apply settled.
-      const releasesAtSettle = tab.releases()
-      expect({
-        outcome: seen.outcome,
-        rows: seen.rows,
-        ...(`releases` in expected.settled
-          ? { releases: releasesAtSettle }
-          : {}),
-        status:
-          expected.settled.status === undefined
-            ? undefined
-            : history.consumer === `live-query` &&
-                expected.settled.status === `ready`
-              ? query.status
-              : expected.settled.status === `crashed`
-                ? history.consumer === `live-query`
-                  ? `${query.status}/${tab.source.status}`
-                  : tab.source.status
-                : tab.source.status,
-      }).toEqual({
-        outcome: expected.settled.outcome,
-        rows: expected.settled.rows,
-        ...(`releases` in expected.settled
-          ? { releases: expected.settled.releases }
-          : {}),
-        status:
-          expected.settled.status === `crashed` &&
-          history.consumer === `live-query`
-            ? `crashed/crashed`
-            : expected.settled.status,
-      })
-    } finally {
-      await query.cleanup()
-      await other.cleanup()
-      await tab.source.cleanup()
-      errors.mockRestore()
-      warnings.mockRestore()
-    }
-  }
-
-  const followerRemoteDemandHistories: Array<FollowerRemoteDemandHistory> = (
-    [`direct`, `queued`, `rotated`, `expired`] as const
-  ).flatMap((placement) =>
-    ([`ok`, `fails`] as const).flatMap((apply) =>
-      ([`live-query`, `load`] as const).map((consumer) => ({
-        placement,
-        apply,
-        consumer,
-      })),
-    ),
-  )
-  it.each(
-    followerRemoteDemandHistories.filter(
-      ({ placement }) => placement !== `rotated`,
-    ),
-  )(
-    `settles a follower's remote demand with the owner's applied rows: $placement broadcast, apply $apply, $consumer`,
-    assertFollowerRemoteDemandHistory,
-  )
-  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
-  // the owner's rows in the new generation never become visible.
-  it.fails.each(
-    followerRemoteDemandHistories.filter(
-      ({ placement }) => placement === `rotated`,
-    ),
-  )(
-    `settles a follower's remote demand with the owner's applied rows: $placement broadcast, apply $apply, $consumer`,
-    assertFollowerRemoteDemandHistory,
-  )
-  // A reset clears the owner's durable rows. Its rows return only when the
-  // follower requests its demand again, so the model predicts one more
-  // ensure, the owner's row visible again, and no further ensures: replacing
-  // rows in place must not drop the replay that a reset owes. Only a node
-  // that follows replaces rows in place. A node elected leader that still
-  // routes demand through the coordinator truncates and replays as the
-  // leader does; this follower-only cell does not exercise that path.
-  // A renewal that fails after the owner replied does not establish claim
-  // loss. The load cannot confirm its rows, so it rejects, as a failed ensure
-  // does; the demand stays active and retries, so the owner's acquisition
-  // is kept. The model predicts the rejected load, no release, one retried
-  // ensure, the owner's row still visible, and a healthy source.
-  it(`keeps a follower's demand when a renewal fails transiently at its reply`, async () => {
-    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const tab = createFollowerTab({
-      placement: `direct`,
-      apply: `ok`,
-      consumer: `load`,
-      renewal: `fails-at-reply`,
-    })
-    try {
-      tab.releaseApply()
-      let outcome: `pending` | `fulfilled` | `rejected` = `pending`
-      const settled = Promise.resolve(
-        tab.source._sync.loadSubset({
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`group`]),
-            new IR.Value(`a`),
-          ]),
-        }),
-      ).then(
-        () => (outcome = `fulfilled`),
-        () => (outcome = `rejected`),
-      )
-      await within(settled, 1_000)
-      for (let i = 0; i < 5; i++)
-        await new Promise((resolve) => setTimeout(resolve, 0))
-      // Checkpoint: the load settled and any retry has run.
-      expect({
-        outcome,
-        releases: tab.releases(),
-        ensures: tab.ensures(),
-        rows: Array.from(tab.source.values()).map((row) => row.id),
-        status: tab.source.status === `crashed` ? `crashed` : `healthy`,
-      }).toEqual({
-        outcome: `rejected`,
-        releases: 0,
-        ensures: 2,
-        rows: [`remote`],
-        status: `healthy`,
-      })
-    } finally {
-      await tab.source.cleanup()
-      errors.mockRestore()
-      warnings.mockRestore()
-    }
-  })
-
-  it(`a follower requests its demand again after the owner resets, once`, async () => {
-    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const tab = createFollowerTab({
-      placement: `direct`,
-      apply: `ok`,
-      consumer: `live-query`,
-    })
-    const query = createLiveQueryCollection((q) =>
-      q.from({ row: tab.source }).where(({ row }) => eq(row.group, `a`)),
-    )
-    try {
-      void query.preload()
-      await within(tab.applyReadStarted)
-      tab.releaseApply()
-      await vi.waitFor(() => expect(query.size).toBe(1), { timeout: 1_000 })
-      expect(tab.ensures()).toBe(1)
-
-      tab.resetOwner()
-      await new Promise((resolve) => setTimeout(resolve, 100))
-      expect({
-        ensures: tab.ensures(),
-        rows: query.toArray.map((row) => (row as FollowerRow).id),
-        status: query.status,
-      }).toEqual({ ensures: 2, rows: [`remote`], status: `ready` })
-    } finally {
-      await query.cleanup()
-      await tab.source.cleanup()
-      errors.mockRestore()
-      warnings.mockRestore()
-    }
-  })
-
-  // Scoped recovery means durable rows cannot replace source rows. Owner
-  // evidence is an exception only in a rotated generation, which holds
-  // nothing but the owner's writes. Without a managed generation the old
-  // durable cache stays in place, so the model predicts that an owner notice
-  // during that recovery republishes none of the untrusted durable rows.
-  /**
-   * After a cache rotation, a follower reacquires every active demand into
-   * the new generation through the owner. The owner commits each demand's
-   * rows into that generation and broadcasts them before it replies, so the
-   * follower holds those notices. Scoped recovery may end only once every
-   * reacquisition has succeeded: before that, the new generation is still
-   * incomplete and its durable rows have no authority. Starting scoped
-   * recovery withdraws the old generation's rows.
-   *
-   * The independent model knows each demand's row version per generation:
-   * the owner wrote version 1 into the old generation and writes version 2
-   * into the new one when it reacquires the demand. Until every
-   * reacquisition has settled, neither demand shows a row. If all succeed,
-   * both show the new generation's rows, including an owner update that
-   * arrived while the reacquisitions were settling. If any fails, the
-   * follower stays in scoped recovery, shows no row from the incomplete
-   * generation, and the source reports the failure as soon as that
-   * reacquisition settles. A reacquisition is a remote request, so the
-   * failure is the ready source's failure reason (`reportError()`: the source
-   * keeps syncing), never a crash; a crash is only for local storage or an
-   * internal invariant (glossary "crash"; maintainer decision for PR #2168).
-   *
-   * A demand that the caller releases or aborts while it reacquires no longer
-   * needs the new generation's rows: its aborted ensure is neither a failure
-   * nor a reported error, and the other demands decide the outcome. Releasing
-   * it twice changes nothing. A load that fails on its own still counts as a
-   * failure even though the failed load gives up its demand.
-   *
-   * A new demand loaded while the reacquisitions are in flight settles only
-   * once they all have: with the rows of the new generation if recovery
-   * ended, or rejected if it did not. Its own ensure answering early does not
-   * make its held rows visible.
-   *
-   * Only a recovery that rotated can end this way. A recovery that keeps the
-   * old generation, or one in which this node is the leader, leaves scoped
-   * recovery in place, and a newer rotation supersedes an older one's
-   * reacquisition.
-   *
-   * Known gap (#2139): production does not yet end scoped recovery after a
-   * rotation, so the histories in which recovery should end, or in which a
-   * new demand waits for it, are pinned as failing.
-   *
-   * Limits. A failed reacquisition is not retried; the follower stays in
-   * scoped recovery until a later recovery rotates again.
-   *
-   * The grammar crosses the order in which two demands' reacquisitions
-   * settle, whether the owner updates demand a's row (version 3) between
-   * the first and last settlement, which reacquisitions fail or are released,
-   * and whether a new demand loads during reacquisition. Separate cells start
-   * rotation from two reads that find the claim lost, supersede reacquisition
-   * by a rotation as leader, and recover without rotating. The driver
-   * observes the rows, the new load's outcome, and the source status after
-   * every settlement, plus the ensure count, which a refetch loop would
-   * exceed.
-   */
-  type RotatedReacquisitionHistory = {
-    order: [`a`, `b`] | [`b`, `a`]
-    noticeBetween: boolean
-    // Which reacquisitions fail. `released` means demand b is released
-    // while it reacquires, so its ensure aborts; that is not a failure.
-    fails: `none` | `a` | `b` | `both` | `released`
-    // A new demand, c, loads while the reacquisitions are in flight.
-    newDemand?: boolean
-    // While reacquisition is in flight, the node is elected leader and a
-    // second rotation supersedes the first; it then follows again, and a new
-    // demand c loads. With nothing reacquiring, the node stays in scoped
-    // recovery: held notices must still be handled, not queued forever.
-    supersededAsLeader?: boolean
-    // How rotation starts: the source asks for scoped recovery after both
-    // demands loaded, or both demands' first reads are in flight when the
-    // cache claim is found lost.
-    trigger?: `source` | `claim-lost-during-reads`
-  }
-  type VersionedRow = { id: string; group: string; v: number }
-  type ReacquisitionObservation = {
-    rows: Record<`a` | `b` | `c`, number | undefined>
-    // The new demand's load, when the history has one.
-    newLoad?: `pending` | `fulfilled` | `rejected`
-    // `retrying`: ready, with a failure reason.
-    status: `crashed` | `retrying` | `healthy`
-  }
-  const expectedReacquisition = (
-    history: RotatedReacquisitionHistory,
-    settled: number,
-  ): ReacquisitionObservation => {
-    const fails = (group: `a` | `b`) =>
-      history.fails === group || history.fails === `both`
-    const allSettled = settled === 2
-    const ended = allSettled && !fails(`a`) && !fails(`b`)
-    // A failed reacquisition is reported when it settles, and the next
-    // remote request that succeeds clears it (maintainer decision: a coarse
-    // clear). A released demand's aborted ensure is neither.
-    let failed = false
-    for (const group of history.order.slice(0, settled))
-      if (fails(group)) failed = true
-      else if (!(group === `b` && history.fails === `released`)) failed = false
-    return {
-      rows: ended
-        ? {
-            a: history.noticeBetween ? 3 : 2,
-            // A released demand's held notice still applies once recovery
-            // ends; the new generation's rows are trusted then.
-            b: 2,
-            c: history.newDemand ? 2 : undefined,
-          }
-        : { a: undefined, b: undefined, c: undefined },
-      ...(history.newDemand
-        ? {
-            newLoad: !allSettled
-              ? (`pending` as const)
-              : ended
-                ? (`fulfilled` as const)
-                : (`rejected` as const),
-          }
-        : {}),
-      status: failed ? `retrying` : `healthy`,
-    }
-  }
-
-  const assertRotatedReacquisition = async (
-    history: RotatedReacquisitionHistory,
-  ) => {
-    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const oldStorageId = `reacquire-old`
-    const newStorageId = `reacquire-new`
-    const durable = new Map<string, Map<string, VersionedRow>>([
-      [oldStorageId, new Map()],
-      [newStorageId, new Map()],
-    ])
-    let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-    const seqs = new Map<string, number>()
-    const ownerCommits = (storageId: string, row: VersionedRow) => {
-      const seq = (seqs.get(storageId) ?? 0) + 1
-      seqs.set(storageId, seq)
-      durable.get(storageId)!.set(row.id, row)
-      const payload: TxCommitted = {
-        type: `tx:committed`,
-        term: 1,
-        seq,
-        txId: `owner-${storageId}-${seq}`,
-        latestRowVersion: seq,
-        requiresFullReload: false,
-        changedRows: [{ key: row.id, value: row }],
-        deletedKeys: [],
-      }
-      subscriber?.({
-        v: 1,
-        dbName: `test-db`,
-        collectionId: storageId,
-        senderId: `owner`,
-        ts: Date.now(),
-        payload,
-      })
-    }
-    type Reply = {
-      resolve: () => void
-      reject: (error: unknown) => void
-    }
-    const replies = new Map<string, Reply>()
-    let ensures = 0
-    let cEnsures = 0
-    const groupOf = (options: LoadSubsetOptions) => {
-      const where = options.where as IR.Func | undefined
-      const value = where?.args[1] as IR.Value | undefined
-      return value?.value as `a` | `b` | `c` | undefined
-    }
-    const duringReads = history.trigger === `claim-lost-during-reads`
-    const firstReads = createDeferred()
-    let reads = 0
-    let claimLost = false
-    const adapter = {
-      loadSubset: async (
-        target: PersistedStorageTarget,
-      ): Promise<Array<{ key: string; value: VersionedRow }>> => {
-        if (duringReads && ++reads <= 2) {
-          await firstReads.promise
-          claimLost = true
-        }
-        return Array.from(
-          durable.get(recordedStorageId(target))!.values(),
-          (value) => ({ key: value.id, value: { ...value } }),
-        )
-      },
-      claimCacheGeneration: async () => ({
-        storageCollectionId: oldStorageId,
-        claimId: `reacquire-claim`,
-        expiresAtMs: Date.now() + 60_000,
-      }),
-      renewCacheGenerationClaim: async () =>
-        claimLost ? undefined : Date.now() + 60_000,
-      rotateCacheGeneration: async () => {
-        claimLost = false
-        return {
-          storageCollectionId: newStorageId,
-          claimId: `reacquire-claim-2`,
-          expiresAtMs: Date.now() + 60_000,
-        }
-      },
-      releaseCacheGenerationClaim: async () => {},
-      loadResumeSnapshot: () =>
-        Promise.resolve({
-          rows: [],
-          keySet: { status: `consistent` },
-          collectionMetadata: [],
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          resetEpoch: 0,
-        }),
-      applyCommittedTx: async () => {},
-      ensureIndex: async () => {},
-    } as unknown as PersistenceAdapter
-    let leader = false
-    const coordinator = {
-      getNodeId: () => `follower`,
-      subscribe: (
-        _collectionId: string,
-        onMessage: (message: ProtocolEnvelope<unknown>) => void,
-      ) => {
-        subscriber = onMessage
-        return () => {
-          subscriber = undefined
-        }
-      },
-      publish: () => {},
-      isLeader: () => leader,
-      ensureLeadership: async () => {},
-      requestEnsurePersistedIndex: async () => {},
-      // The owner commits the demand's row into the requesting generation
-      // and broadcasts it before it replies. In the new generation the
-      // driver releases the reply; a later refetch finds nothing new.
-      requestEnsureRemoteSubset: (
-        storageId: string,
-        options: LoadSubsetOptions,
-      ) => {
-        ensures++
-        const group = groupOf(options)
-        if (!group) return Promise.resolve()
-        if (storageId === oldStorageId) {
-          ownerCommits(oldStorageId, { id: `${group}-row`, group, v: 1 })
-          return Promise.resolve()
-        }
-        if (group === `c`) cEnsures++
-        if (replies.has(group) || (group === `c` && cEnsures > 1))
-          return Promise.resolve()
-        ownerCommits(newStorageId, { id: `${group}-row`, group, v: 2 })
-        // The new demand's ensure answers at once; the follower must still
-        // hold its rows until reacquisition ends.
-        if (group === `c`) return Promise.resolve()
-        return new Promise<void>((resolve, reject) => {
-          replies.set(group, { resolve, reject })
-        })
-      },
-      requestReleaseRemoteSubset: async () => {},
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyCommittedTx: (_collectionId: string, tx: TxCommitted) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.seq,
-        }),
-      pullSince: (storageId: string) =>
-        Promise.resolve({
-          type: `rpc:pullSince:res`,
-          rpcId: `reacquire-pull`,
-          ok: true,
-          latestTerm: 1,
-          latestSeq: seqs.get(storageId) ?? 0,
-          latestRowVersion: seqs.get(storageId) ?? 0,
-          requiresFullReload: true,
-          changedKeys: [],
-          deletedKeys: [],
-        }),
-    } as unknown as PersistedCollectionCoordinator
-    let sourceParams: SyncConfig<VersionedRow, string>[`sync`] extends (
-      params: infer P,
-    ) => unknown
-      ? P
-      : never
-    const source = createCollection(
-      persistedCollectionOptions<VersionedRow, string>({
-        id: `follower-reacquire-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        persistence: { adapter, coordinator },
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            // A ready source: only a ready Collection can carry the failed
-            // reacquisition as its failure reason.
-            params.markReady()
-            return {
-              loadSubset: () => Promise.resolve(),
-              restartAfterScopedRecovery: () => {},
-            }
-          },
-        },
-      }),
-    )
-    source.startSyncImmediate()
-    let newLoad: `pending` | `fulfilled` | `rejected` = `pending`
-    const observe = (): ReacquisitionObservation => ({
-      rows: {
-        a: source.get(`a-row`)?.v,
-        b: source.get(`b-row`)?.v,
-        c: source.get(`c-row`)?.v,
-      },
-      ...(history.newDemand ? { newLoad } : {}),
-      status:
-        source.status === `crashed`
-          ? `crashed`
-          : source.health.failureReason
-            ? `retrying`
-            : `healthy`,
-    })
-    const turn = () => new Promise((resolve) => setTimeout(resolve, 0))
-    const settle = async () => {
-      for (let i = 0; i < 8; i++) await turn()
-    }
-    const demand = (group: `a` | `b` | `c`): LoadSubsetOptions => ({
-      where: new IR.Func(`eq`, [
-        new IR.PropRef([`group`]),
-        new IR.Value(group),
-      ]),
-    })
-    const demands = { a: demand(`a`), b: demand(`b`), c: demand(`c`) }
-    const load = (group: `a` | `b` | `c`) =>
-      source._sync.loadSubset(demands[group])
-    try {
-      if (duringReads) {
-        // Both first reads are in flight when the claim is found lost.
-        void Promise.resolve(load(`a`)).catch(() => undefined)
-        void Promise.resolve(load(`b`)).catch(() => undefined)
-        await settle()
-        firstReads.resolve()
-      } else {
-        for (const group of [`a`, `b`] as const) await load(group)
-        await settle()
-        expect(observe().rows).toEqual({ a: 1, b: 1 })
-        void sourceParams!.metadata!.persistence!.startScopedRecovery!()
-      }
-      await vi.waitFor(() => expect(replies.size).toBe(2), { timeout: 2_000 })
-      await settle()
-      if (history.newDemand) {
-        void Promise.resolve(load(`c`)).then(
-          () => (newLoad = `fulfilled`),
-          () => (newLoad = `rejected`),
-        )
-      }
-      if (history.fails === `released`) {
-        // Releasing the same demand twice must be idempotent.
-        source._sync.unloadSubset(demands.b)
-        source._sync.unloadSubset(demands.b)
-      }
-      await settle()
-      // Checkpoint: both reacquisitions are in flight.
-      expect(observe()).toEqual(expectedReacquisition(history, 0))
-      if (history.supersededAsLeader) {
-        leader = true
-        await sourceParams!.metadata!.persistence!.startScopedRecovery!()
-        await settle()
-        leader = false
-        let outcome: `pending` | `fulfilled` | `rejected` = `pending`
-        void Promise.resolve(load(`c`)).then(
-          () => (outcome = `fulfilled`),
-          () => (outcome = `rejected`),
-        )
-        await settle()
-        // Checkpoint: the superseded reacquisition no longer holds notices.
-        // The node stays in scoped recovery with nothing reacquiring, so the
-        // owner's notice for c is handled by one refetch instead of waiting
-        // in the queue forever; the untrusted generation shows no row.
-        expect({ outcome, cEnsures, c: source.get(`c-row`)?.v }).toEqual({
-          outcome: `fulfilled`,
-          cEnsures: 2,
-          c: undefined,
-        })
-        for (const reply of replies.values()) reply.resolve()
-        return
-      }
-      for (const [index, group] of history.order.entries()) {
-        if (index === 1 && history.noticeBetween) {
-          ownerCommits(newStorageId, { id: `a-row`, group: `a`, v: 3 })
-          await settle()
-        }
-        if (history.fails === `released` && group === `b`) {
-          const aborted = new Error(`released`)
-          aborted.name = `AbortError`
-          replies.get(group)!.reject(aborted)
-        } else if (history.fails === group || history.fails === `both`)
-          replies.get(group)!.reject(new Error(`reacquire ${group} failed`))
-        else replies.get(group)!.resolve()
-        await settle()
-        // Checkpoint: after each settlement.
-        expect(observe()).toEqual(expectedReacquisition(history, index + 1))
-      }
-      // Two acquisitions and two reacquisitions, a new demand's ensure, plus
-      // one refresh per held notice when recovery stays; a refetch loop
-      // exceeds the bound.
-      expect(ensures).toBeLessThanOrEqual(16)
-    } finally {
-      await source.cleanup()
-      errors.mockRestore()
-      warnings.mockRestore()
-    }
-  }
-
-  const rotatedReacquisitionHistories: Array<RotatedReacquisitionHistory> = (
-    [
-      [`a`, `b`],
-      [`b`, `a`],
-    ] as const
-  ).flatMap((order) =>
-    [false, true].flatMap((noticeBetween) =>
-      ([`none`, `a`, `b`, `both`, `released`] as const).flatMap((fails) =>
-        [false, true].map((newDemand) => ({
-          order: [...order],
-          noticeBetween,
-          fails,
-          newDemand,
-        })),
-      ),
-    ),
-  )
-  // Known gap: see #2139. Recovery never ends today, so the histories in
-  // which it should end, or in which a new demand must wait for it, fail.
-  const reacquisitionGap = ({
-    fails,
-    newDemand,
-  }: RotatedReacquisitionHistory) =>
-    newDemand === true || fails === `none` || fails === `released`
-  it.each(
-    rotatedReacquisitionHistories.filter(
-      (history) => !reacquisitionGap(history),
-    ),
-  )(
-    `ends a follower's scoped recovery only after every reacquisition succeeds: order $order, notice between $noticeBetween, fails $fails, new demand $newDemand`,
-    assertRotatedReacquisition,
-    10_000,
-  )
-  it.fails.each(rotatedReacquisitionHistories.filter(reacquisitionGap))(
-    `ends a follower's scoped recovery only after every reacquisition succeeds: order $order, notice between $noticeBetween, fails $fails, new demand $newDemand`,
-    assertRotatedReacquisition,
-    10_000,
-  )
-  it(
-    `releases held notices when a second rotation supersedes reacquisition as leader`,
-    () =>
-      assertRotatedReacquisition({
-        order: [`a`, `b`],
-        noticeBetween: false,
-        fails: `none`,
-        supersededAsLeader: true,
-      }),
-    10_000,
-  )
-  // Two hydrations that both find the claim lost queue work while the
-  // follower reacquires. Their flushes must leave the held notices alone;
-  // otherwise each notice refreshes the scoped demand and the follower spins.
-  it(
-    `holds a rotated follower's notices when two reads find the claim lost: fails 'a'`,
-    () =>
-      assertRotatedReacquisition({
-        order: [`a`, `b`],
-        noticeBetween: false,
-        fails: `a`,
-        trigger: `claim-lost-during-reads`,
-      }),
-    10_000,
-  )
-  // Known gap: see #2139. Recovery never ends, so the rows stay hidden.
-  it.fails(
-    `holds a rotated follower's notices when two reads find the claim lost: fails 'none'`,
-    () =>
-      assertRotatedReacquisition({
-        order: [`a`, `b`],
-        noticeBetween: false,
-        fails: `none`,
-        trigger: `claim-lost-during-reads`,
-      }),
-    10_000,
-  )
-
-  // The same law holds when no demand is active as recovery starts: with
-  // nothing reacquired and no new generation, a later load must still not
-  // hydrate the untrusted rows.
-  it.each([`active demand`, `no active demand`] as const)(
-    `does not trust untrusted durable rows after a recovery without rotation: %s`,
-    async (activeAtRecovery) => {
-      const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
-      const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const durable: Array<FollowerRow> = [{ id: `stale`, group: `a` }]
-      let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-      let seq = 0
-      const notice = (collectionId: string, value: FollowerRow) => {
-        seq++
-        if (!durable.some((row) => row.id === value.id)) durable.push(value)
-        const payload: TxCommitted = {
-          type: `tx:committed`,
-          term: 1,
-          seq,
-          txId: `owner-tx-${seq}`,
-          latestRowVersion: seq,
-          requiresFullReload: false,
-          changedRows: [{ key: value.id, value }],
-          deletedKeys: [],
-        }
-        subscriber?.({
-          v: 1,
-          dbName: `test-db`,
-          collectionId,
-          senderId: `owner`,
-          ts: Date.now(),
-          payload,
-        })
-      }
-      let ensures = 0
-      const adapter = {
-        loadSubset: async () =>
-          durable.map((value) => ({ key: value.id, value })),
-        loadResumeSnapshot: () =>
-          Promise.resolve({
-            rows: [],
-            keySet: { status: `consistent` },
-            collectionMetadata: [],
-            latestTerm: 0,
-            latestSeq: 0,
-            latestRowVersion: 0,
-            resetEpoch: 0,
-          }),
-        applyCommittedTx: async () => {},
-        ensureIndex: async () => {},
-      } as unknown as PersistenceAdapter
-      const coordinator = {
-        getNodeId: () => `follower`,
-        subscribe: (
-          _collectionId: string,
-          onMessage: (message: ProtocolEnvelope<unknown>) => void,
-        ) => {
-          subscriber = onMessage
-          return () => {
-            subscriber = undefined
-          }
-        },
-        publish: () => {},
-        isLeader: () => false,
-        ensureLeadership: async () => {},
-        requestEnsurePersistedIndex: async () => {},
-        requestEnsureRemoteSubset: async (collectionId: string) => {
-          if (++ensures === 1)
-            notice(collectionId, { id: `remote`, group: `a` })
-        },
-        requestReleaseRemoteSubset: async () => {},
-        registerRemoteSubsetOwner: () => () => {},
-        requestApplyCommittedTx: (_collectionId: string, tx: TxCommitted) =>
-          Promise.resolve({
-            type: `rpc:applyCommittedTx:res`,
-            rpcId: tx.txId,
-            ok: true,
-            term: tx.term,
-            seq: tx.seq,
-            latestRowVersion: seq,
-          }),
-        pullSince: () =>
-          Promise.resolve({
-            type: `rpc:pullSince:res`,
-            rpcId: `unrotated-pull`,
-            ok: true,
-            latestTerm: 1,
-            latestSeq: seq,
-            latestRowVersion: seq,
-            requiresFullReload: false,
-            changedKeys: [],
-            deletedKeys: [],
-          }),
-      } as unknown as PersistedCollectionCoordinator
-      let sourceParams: SyncConfig<FollowerRow, string>[`sync`] extends (
-        params: infer P,
-      ) => unknown
-        ? P
-        : never
-      const source = createCollection(
-        persistedCollectionOptions<FollowerRow, string>({
-          id: `follower-unrotated-${Math.random().toString(36).slice(2)}`,
-          getKey: (row) => row.id,
-          persistence: { adapter, coordinator },
-          syncMode: `on-demand`,
-          sync: {
-            sync: (params) => {
-              sourceParams = params
-              return {
-                loadSubset: () => Promise.resolve(),
-                restartAfterScopedRecovery: () => {},
-              }
-            },
-          },
-        }),
-      )
-      source.startSyncImmediate()
-      const query = createLiveQueryCollection((q) =>
-        q.from({ row: source }).where(({ row }) => eq(row.group, `a`)),
-      )
-      try {
-        if (activeAtRecovery === `active demand`) {
-          await query.preload()
-          expect(Array.from(source.keys()).sort()).toEqual([`remote`, `stale`])
-        } else {
-          // Start the source without any demand.
-          void source.preload().catch(() => undefined)
-          await vi.waitFor(() => expect(sourceParams).toBeDefined())
-        }
-
-        // The source reports that the old durable rows are untrusted.
-        await sourceParams!.metadata!.persistence!.startScopedRecovery!()
-        await new Promise((resolve) => setTimeout(resolve, 50))
-        if (activeAtRecovery === `no active demand`) {
-          void query.preload().catch(() => undefined)
+        expect(keyReads).toBeGreaterThanOrEqual(2)
+        expect(outcomes.map((outcome) => outcome.status)).toEqual([
+          `fulfilled`,
+          `rejected`,
+          `fulfilled`,
+        ])
+        if (outcomes[1].status === `rejected`) {
+          expect(outcomes[1].reason).toBeInstanceOf(SyncTransactionAbortedError)
         }
-        notice(source.id, { id: `fresh`, group: `a` })
-        await new Promise((resolve) => setTimeout(resolve, 100))
-        expect(Array.from(source.keys())).not.toContain(`stale`)
+        expect(collection.status).toBe(`ready`)
+        expect(collection._lifecycle.getSyncError()).toBeUndefined()
+        expect(collection.get(`prefix`)).toBeUndefined()
+        expect(collection.get(`aborting`)).toBeUndefined()
+        expect(stripVirtualProps(collection.get(`independent`))).toEqual(
+          expected.committedRows.get(`independent`),
+        )
+        expect(adapter.rows).toEqual(expected.committedRows)
+        expect(
+          adapter.applyCommittedTxCalls.map(({ tx }) =>
+            tx.mutations.map(({ key }) => key),
+          ),
+        ).toEqual([[`independent`]])
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
       } finally {
-        await query.cleanup()
-        await source.cleanup()
-        errors.mockRestore()
-        warnings.mockRestore()
+        releaseHydration.resolve()
+        aborted.abort()
+        await cleanupPersistedOracle(
+          [
+            () => hydration?.catch(() => undefined),
+            () => abortedReceipt?.catch(() => undefined),
+            () => independentReceipt?.catch(() => undefined),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
       }
     },
   )
 
-  const followerRemoteDemandHistory = fc.record({
-    // Known gap: see #2139. The rotated placement is pinned above.
-    placement: fc.constantFrom<FollowerRemoteDemandHistory[`placement`]>(
-      `direct`,
-      `queued`,
-      `expired`,
-    ),
-    apply: fc.constantFrom<FollowerRemoteDemandHistory[`apply`]>(`ok`, `fails`),
-    consumer: fc.constantFrom<FollowerRemoteDemandHistory[`consumer`]>(
-      `live-query`,
-      `load`,
+  // Commit acceptance creates a source obligation. Successful subset hydration
+  // queued ahead of publication cannot revoke it. This finite grammar crosses
+  // one/two/three queued hydrations, unreserved/reserved commit turns,
+  // insert/update, and absent/present dependent successors. The two-read
+  // unreserved case
+  // reconstructs the report; one and three distinguish a misplaced threshold.
+  // Open transactions crossing hydration are excluded here and rejected below.
+  // This driver supplies adapter scheduling, not live Electric or OPFS delivery.
+  it.each(
+    ([`insert`, `update`] as const).flatMap((type) =>
+      [1, 2, 3].flatMap((hydrationCount) =>
+        [false, true].flatMap((reserveCommitTurn) =>
+          [false, true].map((hasSuccessor) => ({
+            type,
+            hydrationCount,
+            reserveCommitTurn,
+            hasSuccessor,
+          })),
+        ),
+      ),
     ),
-  })
-  fcTest.prop(
-    [followerRemoteDemandHistory],
-    oraclePropertyOptions(12, `persistence.follower-remote-demand`),
   )(
-    `checks generated follower remote-demand histories (random or replayed)`,
-    assertFollowerRemoteDemandHistory,
-  )
-
-  // The model has one one-shot refresh lease. The grammar crosses cleanup
-  // before and after source settlement. Whichever event wins releases the
-  // lease once. The raw release log retains multiplicity at both checkpoints.
-  it.each([false, true])(
-    `releases a scoped refresh once when settlement precedes cleanup: %s`,
-    async (settleBeforeCleanup) => {
-      const adapter = createRecordingAdapter()
-      const coordinator = createCoordinatorHarness()
-      const logicalId = `scoped-refresh-cleanup`
-      const oldStorageId = `scoped-refresh-old`
-      const newStorageId = `scoped-refresh-new`
-      const refreshEntered = createEventGate()
-      const releaseRefresh = createEventGate()
-      const releaseCalls: Array<LoadSubsetOptions> = []
-      let watchRefresh = false
-      let refreshOptions: LoadSubsetOptions | undefined
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: oldStorageId,
-        claimId: `scoped-refresh-claim`,
-        expiresAtMs: Date.now() + 60_000,
-      })
-      adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
-      adapter.rotateCacheGeneration = async () => ({
-        storageCollectionId: newStorageId,
-        claimId: `scoped-refresh-claim`,
-        expiresAtMs: Date.now() + 60_000,
-      })
-      adapter.releaseCacheGenerationClaim = async () => {}
-      coordinator.requestEnsureRemoteSubset = async (_id, options) => {
-        if (watchRefresh && options.refetch === true) {
-          refreshOptions = options
-          refreshEntered.resolve()
-          await releaseRefresh.promise
+    `publishes committed source $type after $hydrationCount queued hydrations (reserveCommitTurn=$reserveCommitTurn, successor=$hasSuccessor)`,
+    async ({ type, hydrationCount, reserveCommitTurn, hasSuccessor }) => {
+      // https://github.com/TanStack/db/issues/2036
+      const adapter = createRecordingAdapter([
+        { id: `shared`, title: `persisted`, detail: `retained baseline` },
+      ])
+      adapter.rowMetadata.set(`shared`, { owner: `persisted` })
+      const persistenceEntered = createEventGate()
+      const releasePersistence = createEventGate()
+      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+      let applyCalls = 0
+      adapter.applyCommittedTx = async (...args) => {
+        if (++applyCalls === 1) {
+          persistenceEntered.resolve()
+          await releasePersistence.promise
+        }
+        await applyCommittedTx(...args)
+        for (const mutation of args[1].mutations) {
+          if (mutation.type !== `delete` && mutation.key === `shared`) {
+            durableSourceTitles.push((mutation.value as Todo).title)
+          }
         }
       }
-      coordinator.requestReleaseRemoteSubset = async (_id, options) => {
-        releaseCalls.push(options)
+      const durableSourceTitles: Array<string> = []
+      const hydrationTitles: Array<string | undefined> = []
+      const loadSubset = adapter.loadSubset.bind(adapter)
+      adapter.loadSubset = async (...args) => {
+        hydrationTitles.push(collection.get(`shared`)?.title)
+        return loadSubset(...args)
       }
-      let source!: TodoSyncParams
+      let sourceParams!: TodoSyncParams
       const collection = createCollection(
         persistedCollectionOptions<Todo, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
+          id: `committed-source-${type}-queued-behind-hydration`,
           getKey: (row) => row.id,
+          syncMode: `on-demand`,
           sync: {
             sync: (params) => {
-              source = params
+              sourceParams = params
               params.markReady()
-              return {
-                restartAfterScopedRecovery: (cacheRotated) => cacheRotated,
-                loadSubset: async () => {},
-              }
+              return { loadSubset: () => true }
             },
           },
-          persistence: { adapter, coordinator },
+          persistence: { adapter },
         }),
       )
-      try {
-        collection.startSyncImmediate()
-        await atPersistedOracleCheckpoint(
-          vi.waitFor(() => expect(source).toBeDefined()),
-          `source sync entered`,
-        )
-        await collection._sync.loadSubset({ limit: 1 })
-        await source.metadata!.persistence!.startScopedRecovery!()
-        watchRefresh = true
-        coordinator.emit(
+      const options = Array.from({ length: hydrationCount }, (_, index) => ({
+        limit: index + 1,
+      }))
+      // Model complete source obligations independently of production queues.
+      // Hydration establishes the baseline first; source patches retain detail.
+      // Fresh inserts reset metadata, while updates keep baseline ownership.
+      // Row values retain the pre-existing quiescent wrapper semantics: source
+      // inserts are upserts, and partial mode retains omitted baseline fields.
+      // Metadata reset does not imply replacement of the complete row value.
+      const sourceTitles = hasSuccessor
+        ? [`first source value`, `second source value`]
+        : [`first source value`]
+      const expected = foldDurabilityLedger(
+        sourceTitles.flatMap((title): Array<DurabilityLedgerEvent> => [
+          { type: `begin`, transactionId: title },
           {
-            type: `tx:committed`,
-            term: 1,
-            seq: 1,
-            txId: `scoped-refresh-notice`,
-            latestRowVersion: 1,
-            requiresFullReload: false,
-            changedRows: [
-              { key: `fresh`, value: { id: `fresh`, title: `Fresh` } },
-            ],
-            deletedKeys: [],
+            type: `write`,
+            transactionId: title,
+            row: { id: `shared`, title, detail: `retained baseline` },
           },
-          `peer`,
-          newStorageId,
-        )
+          { type: `commit`, transactionId: title },
+        ]),
+      )
+      const receipts: Array<Promise<true | void>> = []
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `gate`, title: `holds apply mutex` },
+        })
+        const gateReceipt = Promise.resolve(sourceParams.commit())
+        void gateReceipt.catch(() => undefined)
+        receipts.push(gateReceipt)
         await atPersistedOracleCheckpoint(
-          refreshEntered.promise,
-          `scoped refresh acquisition entered`,
+          persistenceEntered.promise,
+          `predecessor persistence entered`,
         )
-        if (settleBeforeCleanup) {
-          releaseRefresh.resolve()
-          await atPersistedOracleCheckpoint(
-            vi.waitFor(() =>
-              expect(
-                releaseCalls.filter((options) => options === refreshOptions),
-              ).toHaveLength(1),
-            ),
-            `refresh settlement released its lease`,
-          )
+
+        // Reserve hydrations while the predecessor holds the mutex.
+        // None has started when the source transaction begins and commits.
+        for (const option of options) {
+          const hydration = Promise.resolve(collection._sync.loadSubset(option))
+          void hydration.catch(() => undefined)
+          receipts.push(hydration)
         }
-        const cleanup = collection.cleanup()
-        await atPersistedOracleCheckpoint(cleanup, `cleanup released refresh`)
-        expect(
-          releaseCalls.filter((options) => options === refreshOptions),
-        ).toHaveLength(1)
-        releaseRefresh.resolve()
         await flushAsyncWork()
-        expect(
-          releaseCalls.filter((options) => options === refreshOptions),
-        ).toHaveLength(1)
-      } finally {
-        releaseRefresh.resolve()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A cached read may start under a live claim, then return after a paused
-  // tab's claim expires while its renewal timer is still queued. The read's
-  // old rows have no publication authority at that cut. The model discards
-  // them, rotates privately, and completes the retained demand from a new
-  // source snapshot. This gate holds the adapter result across the expiry;
-  // public rows, durable destination, and demand settlement distinguish a
-  // post-read fence from a check made only before the read.
-  it.each([
-    { outcome: `old rows returned`, expires: true },
-    { outcome: `claim check rejected`, expires: true },
-    { outcome: `live claim I/O failure`, expires: false },
-  ] as const)(
-    `handles a held subset read when $outcome`,
-    async ({ outcome, expires }) => {
-      const adapter = createRecordingAdapter()
-      const readEntered = createEventGate()
-      const releaseRead = createEventGate()
-      let now = 1_000
-      let storageId = `read-expiry-old`
-      let sourceLoads = 0
-      const ioFailure = new Error(`subset read I/O failure`)
-      adapter.getCacheGenerationNow = () => now
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: storageId,
-        claimId: `read-expiry-claim`,
-        expiresAtMs: 11_000,
-      })
-      adapter.renewCacheGenerationClaim = async (id) =>
-        id === `read-expiry-old` && now >= 11_000 ? undefined : now + 10_000
-      adapter.rotateCacheGeneration = async () => {
-        return {
-          storageCollectionId: (storageId = `read-expiry-new`),
-          claimId: `read-expiry-claim`,
-          expiresAtMs: now + 10_000,
+        expect(adapter.loadSubsetCalls).toHaveLength(0)
+        sourceParams.begin()
+        if (reserveCommitTurn) {
+          sourceParams.metadata!.persistence!.reserveCommitTurn()
         }
-      }
-      adapter.releaseCacheGenerationClaim = async () => {}
-      adapter.loadSubset = async (id) => {
-        if (recordedStorageId(id) === `read-expiry-old`) {
-          readEntered.resolve()
-          await releaseRead.promise
-          if (outcome === `claim check rejected`) {
-            throw new InvalidPersistedCollectionConfigError(
-              `Persisted cache claim is no longer active for collection "${id}"`,
-            )
+        sourceParams.write({
+          type,
+          value: { id: `shared`, title: `first source value` },
+        })
+        sourceParams.metadata!.collection.set(`cursor`, `first`)
+        const firstReceipt = Promise.resolve(sourceParams.commit())
+        void firstReceipt.catch(() => undefined)
+        receipts.push(firstReceipt)
+
+        if (hasSuccessor) {
+          sourceParams.begin()
+          if (reserveCommitTurn) {
+            sourceParams.metadata!.persistence!.reserveCommitTurn()
           }
-          if (outcome === `live claim I/O failure`) throw ioFailure
-          return [
-            {
-              key: `stale`,
-              value: { id: `stale`, title: `Expired cached row` },
-            },
-          ]
+          expect(sourceParams.metadata!.collection.get(`cursor`)).toBe(`first`)
+          sourceParams.write({
+            type: `update`,
+            value: { id: `shared`, title: `second source value` },
+          })
+          sourceParams.metadata!.collection.set(`cursor`, `second`)
+          const secondReceipt = Promise.resolve(sourceParams.commit())
+          void secondReceipt.catch(() => undefined)
+          receipts.push(secondReceipt)
         }
-        return []
-      }
-      let source!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `read-expiry-publication`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async () => {
-                  expect(collection.get(`stale`)).toBeUndefined()
-                  sourceLoads++
-                  source.begin()
-                  source.write({
-                    type: `insert`,
-                    value: { id: `fresh`, title: `New source row` },
-                  })
-                  await whenSyncAccepted(source.commit())
-                },
-              }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      try {
-        await collection.stateWhenReady()
-        const demand = Promise.resolve(
-          collection._sync.loadSubset({ limit: 1 }),
-        )
-        void demand.catch(() => undefined)
-        await atPersistedOracleCheckpoint(readEntered.promise, `old cache read`)
-        if (expires) now = 11_001
-        releaseRead.resolve()
-        const [settlement] = await atPersistedOracleCheckpoint(
-          Promise.allSettled([demand]),
-          `held subset demand settlement`,
+        expect(collection.get(`shared`)).toBeUndefined()
+
+        releasePersistence.resolve()
+        // Observe every receipt before cleanup. allSettled preserves rejection
+        // identity alongside the wrong public/durable snapshot on main.
+        const outcomes = await atPersistedOracleCheckpoint(
+          Promise.allSettled(receipts),
+          `committed source receipts after queued hydrations`,
         )
-        if (!expires) {
-          expect(settlement).toEqual({ status: `rejected`, reason: ioFailure })
-          expect(storageId).toBe(`read-expiry-old`)
-          expect(sourceLoads).toBe(0)
-          expect(collection.get(`stale`)).toBeUndefined()
-          return
-        }
-        expect(settlement.status).toBe(`fulfilled`)
-        expect(collection.get(`stale`)).toBeUndefined()
-        expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
-        expect(storageId).toBe(`read-expiry-new`)
-        expect(sourceLoads).toBe(1)
-        expect(
-          adapter.applyCommittedTxCalls
-            .filter((call) =>
-              call.tx.mutations.some((mutation) => mutation.key === `fresh`),
-            )
-            .map((call) => call.collectionId),
-        ).toEqual([`read-expiry-new`])
+        expect({
+          outcomes,
+          hydrationTitles,
+          durableSourceTitles,
+          status: collection.status,
+          publicRow: stripVirtualProps(collection.get(`shared`)),
+          durableRow: adapter.rows.get(`shared`),
+          rowMetadata: adapter.rowMetadata.get(`shared`),
+          cursor: adapter.collectionMetadata.get(`cursor`),
+          durableKeys: adapter.applyCommittedTxCalls.map(({ tx }) =>
+            tx.mutations.map(({ key }) => key),
+          ),
+        }).toEqual({
+          outcomes: receipts.map(() => ({
+            status: `fulfilled`,
+            value: undefined,
+          })),
+          hydrationTitles: options.map((_, index) =>
+            index === 0 ? undefined : `persisted`,
+          ),
+          durableSourceTitles: expected.commitOrder,
+          status: `ready`,
+          publicRow: expected.committedRows.get(`shared`),
+          durableRow: expected.committedRows.get(`shared`),
+          rowMetadata: type === `insert` ? undefined : { owner: `persisted` },
+          cursor: hasSuccessor ? `second` : `first`,
+          durableKeys: [[`gate`], ...sourceTitles.map(() => [`shared`])],
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
       } finally {
-        releaseRead.resolve()
-        await collection.cleanup()
+        releasePersistence.resolve()
+        await cleanupPersistedOracle(
+          [
+            ...options.map(
+              (option) => () => collection._sync.unloadSubset(option),
+            ),
+            () => Promise.allSettled(receipts),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
       }
     },
   )
 
-  // Resume certification is another consumer of a persisted snapshot. A read
-  // may pass SQLite's claim check while live, then return after expiry. The
-  // independent rule gives neither its old answer nor its claim-check failure
-  // authority to certify the old key set: the run moves to private storage.
-  // A still-live claim with an unrelated I/O failure is terminal instead.
-  // The history holds only certification, optionally expires the claim, then
-  // compares settlement, evidence, storage route, and public status. Startup,
-  // hydration, and replay have separate held-read witnesses; none exercises
-  // this resume-certification boundary.
-  it.each([
-    { readOutcome: `old snapshot returned`, failure: `none`, expires: true },
-    { readOutcome: `claim check rejected`, failure: `claim`, expires: true },
-    { readOutcome: `live claim I/O failure`, failure: `io`, expires: false },
-  ] as const)(
-    `handles held resume certification when $readOutcome`,
-    async ({ failure, expires }) => {
-      const adapter = createRecordingAdapter()
-      const readEntered = createEventGate()
-      const releaseRead = createEventGate()
-      const oldStorageId = `certification-expiry-old`
-      const newStorageId = `certification-expiry-new`
-      let storageId = oldStorageId
-      let now = 1_000
-      let rotations = 0
-      let holdCertification = false
-      const ioFailure = new Error(`certification read I/O failure`)
-      adapter.getCacheGenerationNow = () => now
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: storageId,
-        claimId: `certification-expiry-claim`,
-        expiresAtMs: 11_000,
-      })
-      adapter.renewCacheGenerationClaim = async (id) =>
-        id === oldStorageId && now >= 11_000 ? undefined : now + 10_000
-      adapter.rotateCacheGeneration = async () => {
-        rotations++
-        storageId = newStorageId
-        return {
-          storageCollectionId: newStorageId,
-          claimId: `certification-expiry-claim`,
-          expiresAtMs: now + 10_000,
-        }
-      }
-      adapter.releaseCacheGenerationClaim = async () => {}
-      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-      adapter.loadResumeSnapshot = async (...args) => {
-        const snapshot = await loadResumeSnapshot(...args)
-        if (holdCertification && recordedStorageId(args[0]) === oldStorageId) {
-          readEntered.resolve()
-          await releaseRead.promise
-          if (failure === `claim`) {
-            throw new InvalidPersistedCollectionConfigError(
-              `Persisted cache claim is no longer active for collection "${oldStorageId}"`,
-            )
-          }
-          if (failure === `io`) throw ioFailure
-        }
-        return snapshot
-      }
-      let persistenceCapability:
-        SyncMetadataApi<string>[`persistence`] | undefined
-      const collection = createCollection(
+  // Law: a complete persisted value replaces the old value in every field,
+  // including field absence. This follows the durable snapshot contract and
+  // the chosen demand-scoped notice/reset contract above. The model at the top
+  // of this file selects keys using demand and seed authority, then takes the
+  // authored durable value whole. The legal grammar crosses complete demand,
+  // retired-demand peer notice, and retired-demand reset with field removal,
+  // addition, present-undefined transitions in a custom adapter, and scalar
+  // replacement. Field-only changes keep title unchanged to reject a
+  // comparator that watches title alone. The Collection and coordinator are
+  // the driver; whole public rows at the settled publication checkpoint are
+  // the observation. The old title-only checks could not see a retained field.
+  // The removal arm reconstructs that counterexample. Removing it would lose
+  // the stale-field witness; removing a route would lose its distinct admission
+  // path. Addition and scalar change are neighboring controls, not a claim
+  // about arbitrary nested values. Keys agree with row IDs and the fixture has
+  // no accepted source transaction; a mismatched key or source-owned ordinary
+  // row is outside this grammar and has a separate owner below.
+  // Built-in SQLite drops undefined object fields during encoding, so those
+  // two arms exercise the generic adapter boundary only; removal of a defined
+  // field is the receiving SQLite-representable case.
+  it.each(
+    (
+      [`complete demand`, `retired peer notice`, `retired reset`] as const
+    ).flatMap((route) =>
+      (
+        [
+          `remove`,
+          `remove with metadata`,
+          `add`,
+          `remove undefined`,
+          `add undefined`,
+          `scalar`,
+        ] as const
+      ).map((shape) => ({
+        route,
+        shape,
+      })),
+    ),
+  )(
+    `publishes exact durable row shape within $route ($shape)`,
+    async ({ route, shape }) => {
+      const ordinary: Todo =
+        shape === `add undefined`
+          ? { id: `ordinary`, title: `Old` }
+          : shape === `remove undefined`
+            ? { id: `ordinary`, title: `Old`, detail: undefined }
+            : { id: `ordinary`, title: `Old`, detail: `obsolete` }
+      const removed = { id: `removed`, title: `Old` }
+      const seed = { id: `seed`, title: `Hydrated`, detail: `source-owned` }
+      const unseen = { id: `unseen`, title: `Only in storage` }
+      const fresh: Todo =
+        shape === `remove` ||
+        shape === `remove with metadata` ||
+        shape === `remove undefined`
+          ? { id: ordinary.id, title: ordinary.title }
+          : shape === `add`
+            ? { ...ordinary, payload: { rank: 1 } }
+            : shape === `add undefined`
+              ? { ...ordinary, detail: undefined }
+              : { ...ordinary, title: `Fresh` }
+      const expectedFresh = structuredClone(fresh)
+      const before = new Map<string, Todo>([
+        [ordinary.id, structuredClone(ordinary)],
+        [removed.id, structuredClone(removed)],
+        [seed.id, structuredClone(seed)],
+      ])
+      const after = new Map<string, Todo>([
+        [fresh.id, fresh],
+        [unseen.id, unseen],
+        [seed.id, { id: seed.id, title: `Older durable seed` }],
+      ])
+      const adapter = createRecordingAdapter([ordinary, removed])
+      if (shape === `remove with metadata`)
+        adapter.rowMetadata.set(ordinary.id, { source: `durable` })
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `exact-shape-${route}-${shape}`
+      let source!: TodoSyncParams
+      const descriptor = collectionOptions(
         persistedCollectionOptions<Todo, string>({
-          id: `certification-expiry-public`,
+          id: collectionId,
           syncMode: `on-demand`,
           getKey: (row) => row.id,
           sync: {
             sync: (params) => {
-              persistenceCapability = params.metadata?.persistence
+              source = params
               params.markReady()
-              return { restartAfterScopedRecovery: () => {} }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      let certification: Promise<void> | undefined
-      try {
-        await collection.stateWhenReady()
-        expect(
-          persistenceCapability?.resumeSnapshot.getKeySetEvidence(),
-        ).toEqual({ status: `consistent` })
-        holdCertification = true
-        certification = persistenceCapability?.resumeSnapshot.certify()
-        if (!certification) throw new Error(`Missing resume certification`)
-        void certification.catch(() => undefined)
-        await atPersistedOracleCheckpoint(
-          readEntered.promise,
-          `held resume certification`,
-        )
-        if (expires) now = 11_001
-        releaseRead.resolve()
-        const outcome = await atPersistedOracleCheckpoint(
-          Promise.allSettled([certification]),
-          `held resume certification settlement`,
-        )
-        if (expires) {
-          expect(outcome[0].status).toBe(`fulfilled`)
-          expect(rotations).toBe(1)
-          expect(storageId).toBe(newStorageId)
-          expect(
-            persistenceCapability?.resumeSnapshot.getKeySetEvidence(),
-          ).toEqual({ status: `incompatible` })
-          expect(collection.status).not.toBe(`crashed`)
-        } else {
-          expect(outcome).toEqual([{ status: `rejected`, reason: ioFailure }])
-          expect(rotations).toBe(0)
-          expect(storageId).toBe(oldStorageId)
-          expect(collection.status).toBe(`crashed`)
-        }
-      } finally {
-        releaseRead.resolve()
-        await Promise.allSettled([certification])
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A peer notification may begin a full reload while the cache claim is
-  // valid, then hold its persisted read until that claim expires. The cached
-  // result loses publication authority at that cut. The independent rule is
-  // the same as for a direct subset read: discard the old result, rotate this
-  // run's cache, and reload its retained demand from the source. The adapter
-  // may return the old rows or reject at its second claim check. A still-live
-  // claim with an unrelated read failure is a control: it must remain terminal.
-  // A check only when the notification arrives misses both expiry histories.
-  // The held adapter read fixes the order; public rows and Collection status
-  // after release are the comparison cut.
-  it.each([
-    { readOutcome: `old rows returned`, failure: `none`, expires: true },
-    { readOutcome: `claim check rejected`, failure: `claim`, expires: true },
-    { readOutcome: `live claim I/O error`, failure: `io`, expires: false },
-  ])(
-    `handles a peer full reload when $readOutcome`,
-    async ({ failure, expires }) => {
-      const adapter = createRecordingAdapter()
-      const oldStorageId = `peer-reload-old`
-      const newStorageId = `peer-reload-new`
-      const coordinator = createFailStopCoordinatorHarness(oldStorageId)
-      const readEntered = createEventGate()
-      const releaseRead = createEventGate()
-      const readError = new Error(`Persisted peer reload I/O failed`)
-      let now = 1_000
-      let expiresAtMs = 11_000
-      let readCount = 0
-      let rotations = 0
-      adapter.claimCacheGeneration = async () => ({
-        storageCollectionId: oldStorageId,
-        claimId: `peer-reload-claim`,
-        expiresAtMs,
-      })
-      adapter.getCacheGenerationNow = () => now
-      adapter.renewCacheGenerationClaim = async () => {
-        if (now >= expiresAtMs) return undefined
-        expiresAtMs = now + 10_000
-        return expiresAtMs
-      }
-      adapter.rotateCacheGeneration = async () => {
-        rotations++
-        return {
-          storageCollectionId: newStorageId,
-          claimId: `peer-reload-claim`,
-          expiresAtMs: now + 10_000,
-        }
-      }
-      adapter.releaseCacheGenerationClaim = async () => {}
-      adapter.loadSubset = async (storageId) => {
-        if (recordedStorageId(storageId) !== oldStorageId) return []
-        if (++readCount === 1) {
-          return [{ key: `old`, value: { id: `old`, title: `Initial row` } }]
-        }
-        readEntered.resolve()
-        await releaseRead.promise
-        if (failure === `claim`) {
-          throw new InvalidPersistedCollectionConfigError(
-            `Persisted cache claim is no longer active for collection "${oldStorageId}"`,
-          )
-        }
-        if (failure === `io`) throw readError
-        return [{ key: `old`, value: { id: `old`, title: `Expired peer row` } }]
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `peer-reload-expiry`,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (source) => {
-              source.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: () => true,
-              }
+              return { loadSubset: () => true }
             },
           },
           persistence: { adapter, coordinator },
         }),
       )
+      const client = new DbClient()
+      client.hydrate({
+        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
+      })
+      const collection = client.collection(descriptor)
+      const firstDemand = { limit: 10 }
+      const publishedOrdinaryValues: Array<Todo> = []
+      const publishedChanges: Array<string> = []
+      const publishedSnapshots: Array<Map<string, Todo>> = []
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
       try {
         collection.startSyncImmediate()
         await collection.stateWhenReady()
-        await collection._sync.loadSubset({ limit: 1 })
-        expect(collection.get(`old`)?.title).toBe(`Initial row`)
+        await collection._sync.loadSubset(firstDemand)
+        expectExactSnapshot(publicRows(), before)
+        if (route !== `complete demand`)
+          collection._sync.unloadSubset(firstDemand)
+        // An initial-state subscription would itself acquire subset demand.
+        // Observe subsequent changes without changing this route's demand.
+        subscription = collection.subscribeChanges(
+          (batch) => {
+            publishedSnapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            publishedChanges.push(
+              ...batch.map((change) => `${change.type}:${change.key}`),
+            )
+            for (const change of batch) {
+              if (change.key === ordinary.id && change.type !== `delete`) {
+                publishedOrdinaryValues.push(
+                  structuredClone(stripVirtualProps(change.value)),
+                )
+              }
+            }
+          },
+          { includeInitialState: false },
+        )
+        const subsetReadsBeforeRevision = adapter.loadSubsetCalls.length
 
-        coordinator.emit({
-          type: `tx:committed`,
-          term: 1,
-          seq: 1,
-          txId: `peer-full-reload`,
-          latestRowVersion: 1,
-          requiresFullReload: true,
+        adapter.rows.clear()
+        for (const [key, row] of after) adapter.rows.set(key, row)
+        // The peer/reset signal and its subsequent durable read describe one
+        // coherent generation. Direct fixture row edits do not advance the
+        // recording adapter's transaction ledger, so supply that position here.
+        const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+        adapter.loadResumeSnapshot = async (...args) => ({
+          ...(await loadResumeSnapshot(...args)),
+          latestTerm: route === `retired peer notice` ? 1 : 0,
+          latestSeq: route === `retired peer notice` ? 1 : 0,
+          latestRowVersion: route === `retired peer notice` ? 1 : 0,
+          resetEpoch: route === `retired reset` ? 1 : 0,
         })
-        await atPersistedOracleCheckpoint(
-          readEntered.promise,
-          `peer reload read`,
+        const expected = expectedScopedSnapshot(
+          before,
+          after,
+          new Map([[seed.id, before.get(seed.id)!]]),
+          route === `complete demand`,
         )
-        if (expires) now = expiresAtMs + 1
-        releaseRead.resolve()
-        await flushAsyncWork()
-
-        if (failure === `io`) {
-          expect(collection.status).toBe(`crashed`)
-          expect(collection.get(`old`)?.title).toBe(`Initial row`)
-          expect(rotations).toBe(0)
-          await expect(collection._sync.loadSubset({})).rejects.toBe(readError)
-          return
+        const published = createEventGate()
+        const runInHydrationScope = adapter.runInHydrationScope?.bind(adapter)
+        adapter.runInHydrationScope = async (task) => {
+          const result = await (runInHydrationScope?.(task) ?? task(adapter))
+          published.resolve()
+          return result
+        }
+        if (route === `complete demand`) {
+          const completeDemand = {}
+          await collection._sync.loadSubset(completeDemand)
+          collection._sync.unloadSubset(completeDemand)
+        } else if (route === `retired peer notice`) {
+          coordinator.emit(
+            {
+              type: `tx:committed`,
+              term: 1,
+              seq: 1,
+              txId: `exact-shape`,
+              latestRowVersion: 1,
+              requiresFullReload: true,
+            },
+            undefined,
+            collectionId,
+          )
+          await atPersistedOracleCheckpoint(
+            published.promise,
+            `exact-shape peer notice published`,
+          )
+        } else {
+          coordinator.emit(
+            { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
+            undefined,
+            collectionId,
+          )
+          await atPersistedOracleCheckpoint(
+            published.promise,
+            `exact-shape reset published`,
+          )
         }
-        expect(collection.get(`old`)?.title).not.toBe(`Expired peer row`)
-        expect(collection.status).not.toBe(`crashed`)
-        await vi.waitFor(() => expect(rotations).toBe(1))
-        expect(collection.get(`old`)).toBeUndefined()
+        expectExactSnapshot(publicRows(), expected)
+        expect(publishedSnapshots).toHaveLength(1)
+        for (const snapshot of publishedSnapshots)
+          expectExactSnapshot(snapshot, expected)
+        if (shape === `remove with metadata`)
+          expect(source.metadata?.row.get(ordinary.id)).toStrictEqual({
+            source: `durable`,
+          })
+        expect(adapter.loadSubsetCalls).toHaveLength(
+          subsetReadsBeforeRevision + (route === `complete demand` ? 1 : 0),
+        )
+        expect(publishedOrdinaryValues.length).toBeGreaterThan(0)
+        for (const row of publishedOrdinaryValues)
+          expect(row).toStrictEqual(expectedFresh)
+        expect(publishedChanges).toContain(`delete:removed`)
+        expect(
+          publishedChanges.some((change) => change.endsWith(`:seed`)),
+        ).toBe(false)
+        if (route === `complete demand`)
+          expect(publishedChanges).toContain(`insert:unseen`)
+        else
+          expect(
+            publishedChanges.some((change) => change.endsWith(`:unseen`)),
+          ).toBe(false)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
       } finally {
-        releaseRead.resolve()
-        await collection.cleanup()
+        subscription?.unsubscribe()
+        if (route === `complete demand`)
+          collection._sync.unloadSubset(firstDemand)
+        await cleanupPersistedOracle(
+          [() => client.cleanup()],
+          hasPrimaryFailure,
+        )
       }
     },
   )
 
-  // A persisted row scan is an exposed read, even though it does not publish
-  // rows to the Collection. Two sync runs initially claim the same cache
-  // generation. The model keeps the warm peer's claim and rows intact when the
-  // other claim expires. A held old scan must not return those rows to its
-  // caller; it retries against that run's private generation instead. The
-  // adapter gate fixes expiry after the old read but before its result reaches
-  // the caller. Both scan results and the peer's later read are observations.
-  it(`retries a held persisted row scan after only its claim expires`, async () => {
-    const adapter = createRecordingAdapter()
-    const scanEntered = createEventGate()
-    const releaseScan = createEventGate()
-    const oldRow = { key: `old`, value: { id: `old`, title: `Warm peer row` } }
-    const freshRow = {
-      key: `fresh`,
-      value: { id: `fresh`, title: `Private generation row` },
-    }
-    const scanRoutes: Array<{ storageId: string; claimId?: string }> = []
-    let claims = 0
-    let expired = false
-    let rotations = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `scan-old-storage`,
-      claimId: ++claims === 1 ? `scan-warm-claim` : `scan-expiring-claim`,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async (_storageId, claimId) =>
-      expired && claimId === `scan-expiring-claim`
-        ? undefined
-        : Date.now() + 10_000
-    adapter.rotateCacheGeneration = async (
-      _collectionId,
-      claimId,
-      _resetMetadata,
-      expectedStorageId,
-    ) => {
-      expect(claimId).toBe(`scan-expiring-claim`)
-      expect(expectedStorageId).toBe(`scan-old-storage`)
-      rotations++
-      return {
-        storageCollectionId: `scan-private-storage`,
-        claimId: `scan-private-claim`,
-        expiresAtMs: Date.now() + 10_000,
+  // Law: a small peer delta must lead to the same demand-scoped public rows as
+  // the committed durable relation. The wire value is a partial source patch,
+  // so its omitted predicate and payload fields are not evidence of absence.
+  // A retired demand validates previously public keys but admits no new key.
+  // The model above chooses from authored full durable rows; the recording
+  // adapter applies the patch before the notice and is checked against that
+  // authored state. The driver then delivers the real targeted-notice entry
+  // point. A change callback establishes the publication checkpoint, and the
+  // comparison checks exact public keys and row fields. `stay` omits the
+  // predicate field, `enter` omits an existing payload field, and `leave`
+  // changes the predicate; each has a neighboring route with no active demand.
+  // These controlled notices do not prove native SQLite sender or host delivery.
+  it.each(
+    ([`active filter`, `retired demand`] as const).flatMap((route) =>
+      ([`stay`, `enter`, `leave`] as const).map((transition) => ({
+        route,
+        transition,
+      })),
+    ),
+  )(
+    `publishes the durable result of a targeted partial $transition with $route`,
+    async ({ route, transition }) => {
+      const old: Todo = {
+        id: `ordinary`,
+        title: transition === `enter` ? `Other` : `Keep`,
+        detail: `retained field`,
       }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    adapter.scanRows = async (storageId, _options, context) => {
-      scanRoutes.push({
-        storageId: recordedStorageId(storageId),
-        claimId: context?.cacheGenerationClaimId,
-      })
-      if (
-        recordedStorageId(storageId) === `scan-old-storage` &&
-        context?.cacheGenerationClaimId === `scan-expiring-claim`
-      ) {
-        scanEntered.resolve()
-        await releaseScan.promise
+      const patch: Partial<Todo> & Pick<Todo, `id`> =
+        transition === `stay`
+          ? { id: old.id, detail: `new detail` }
+          : { id: old.id, title: transition === `enter` ? `Keep` : `Other` }
+      const durable: Todo = {
+        ...old,
+        ...patch,
       }
-      return recordedStorageId(storageId) === `scan-private-storage`
-        ? [freshRow]
-        : [oldRow]
-    }
-
-    let warmSource!: TodoSyncParams
-    let expiringSource!: TodoSyncParams
-    const makePeer = (onStart: (source: TodoSyncParams) => void) =>
-      createCollection(
+      const unseen: Todo = { id: `unseen`, title: `Keep` }
+      const adapter = createRecordingAdapter([old])
+      const originalLoad = adapter.loadSubset.bind(adapter)
+      adapter.loadSubset = async (id, options, context) =>
+        (await originalLoad(id, options, context)).filter(
+          (row) => !options.where || row.value.title === `Keep`,
+        )
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `targeted-partial-${route}-${transition}`
+      const collection = createCollection(
         persistedCollectionOptions<Todo, string>({
-          id: `held-scan-peers`,
+          id: collectionId,
           syncMode: `on-demand`,
           getKey: (row) => row.id,
           sync: {
-            sync: (params) => {
-              onStart(params)
-              params.markReady()
-              return { restartAfterScopedRecovery: () => {} }
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
             },
           },
-          persistence: { adapter },
+          persistence: { adapter, coordinator },
         }),
       )
-    const warm = makePeer((source) => {
-      warmSource = source
-    })
-    const expiring = makePeer((source) => {
-      expiringSource = source
-    })
-    try {
-      warm.startSyncImmediate()
-      await warm.stateWhenReady()
-      expiring.startSyncImmediate()
-      await expiring.stateWhenReady()
-      expect(
-        await warmSource.metadata!.persistence!.scanPersistedRows(),
-      ).toEqual([oldRow])
-
-      const heldScan = expiringSource.metadata!.persistence!.scanPersistedRows()
-      await atPersistedOracleCheckpoint(scanEntered.promise, `old row scan`)
-      expired = true
-      releaseScan.resolve()
-      expect(
-        await atPersistedOracleCheckpoint(heldScan, `private row scan`),
-      ).toEqual([freshRow])
-      expect(rotations).toBe(1)
-      expect(scanRoutes).toContainEqual({
-        storageId: `scan-private-storage`,
-        claimId: `scan-private-claim`,
-      })
-      expect(
-        await warmSource.metadata!.persistence!.scanPersistedRows(),
-      ).toEqual([oldRow])
-      expect(warm.status).toBe(`ready`)
-    } finally {
-      releaseScan.resolve()
-      await expiring.cleanup()
-      await warm.cleanup()
-    }
-  })
-
-  // A coordinator replay may read a valid persisted cache generation, then
-  // return after this sync run's claim expires. Its deltas cannot publish
-  // under that expired claim. The independent model leaves the peer's head
-  // intact and rotates only this run's cache before any old row is visible.
-  // The held pull fixes the expiry cut; public rows and the private rotation
-  // are checked after the response rather than at request admission.
-  it(`discards a seq-gap replay returned after its cache claim expires`, async () => {
-    const adapter = createRecordingAdapter()
-    const id = `expired-seq-gap-replay`
-    const coordinator = createFailStopCoordinatorHarness(`replay-old-storage`)
-    const pullEntered = createEventGate()
-    const releasePull = createEventGate()
-    let expired = false
-    let storageId = `replay-old-storage`
-    let rotations = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `replay-claim`,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async () =>
-      expired ? undefined : Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      return {
-        storageCollectionId: (storageId = `replay-private-storage`),
-        claimId: `replay-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    coordinator.pullSince = async () => {
-      pullEntered.resolve()
-      await releasePull.promise
-      return {
-        type: `rpc:pullSince:res`,
-        rpcId: `expired-pull`,
-        ok: true,
-        latestTerm: 1,
-        latestSeq: 2,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedKeys: [`old`],
-        deletedKeys: [],
-        deltas: [
-          {
-            txId: `old-delta`,
-            latestRowVersion: 2,
-            changedRows: [
-              {
-                key: `old`,
-                value: { id: `old`, title: `Expired replay row` },
-              },
-            ],
-            deletedKeys: [],
-            rowMetadataMutations: [],
-            collectionMetadataMutations: [],
-          },
-        ],
-      }
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            params.markReady()
-            return {
-              loadSubset: async () => {},
-              restartAfterScopedRecovery: () => {},
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      await collection._sync.loadSubset({})
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `gap-trigger`,
-        latestRowVersion: 2,
-        requiresFullReload: false,
-        changedRows: [],
-        deletedKeys: [],
-      })
-      await atPersistedOracleCheckpoint(pullEntered.promise, `seq-gap pull`)
-      expired = true
-      releasePull.resolve()
-      await flushAsyncWork()
-      await flushAsyncWork()
-      expect(collection.get(`old`)).toBeUndefined()
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(rotations).toBe(1)),
-        `private replay recovery`,
-      )
-      expect(storageId).toBe(`replay-private-storage`)
-    } finally {
-      releasePull.resolve()
-      await collection.cleanup()
-    }
-  })
-
-  // A source commit that arrives before a paused tab's renewal timer runs
-  // must not publish or persist under the expired claim. The independent
-  // history expires the claim immediately before commit admission, then lets
-  // recovery advance to private empty storage. The rejected receipt and
-  // exact destination of the following commit are the observations.
-  it(`rejects an old source commit after cache claim expiry and permits a new one`, async () => {
-    const adapter = createRecordingAdapter()
-    const claimId = `expired-write-claim`
-    let storageId = `expired-write-old`
-    let active = true
-    let renewals = 0
-    let rotations = 0
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      return active ? Date.now() + 10_000 : undefined
-    }
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      active = true
-      return {
-        storageCollectionId: (storageId = `expired-write-new`),
-        claimId,
-        expiresAtMs: Date.now() + 10_000,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    let source!: TodoSyncParams
-    const sourceRestarted = createEventGate()
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `expired-source-write`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            // Both old commits have entered the wrapper before rotation.
-            return {
-              // An on-demand source serves the subsets that recovery
-              // reacquires in the new generation.
-              loadSubset: () => true,
-              restartAfterScopedRecovery: (cacheRotated) =>
-                cacheRotated.then(() => sourceRestarted.resolve()),
+      const demand =
+        route === `active filter`
+          ? {
+              where: new IR.Func(`eq`, [
+                new IR.PropRef([`title`]),
+                new IR.Value(`Keep`),
+              ]),
             }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await source.metadata!.persistence!.hydrateBaseline()
-      // Baseline hydration is still authorized; expiry starts at commit admission.
-      active = false
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `old`, title: `Expired claim` },
-      })
-      const oldReceipt = source.commit()
-      if (oldReceipt === true) throw new Error(`source receipt was not tracked`)
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `second-old`, title: `Queued expired claim` },
-      })
-      const secondOldReceipt = source.commit()
-      if (secondOldReceipt === true)
-        throw new Error(`second source receipt was not tracked`)
-      await expect(oldReceipt).rejects.toBeInstanceOf(
-        SyncTransactionAbortedError,
-      )
-      await expect(secondOldReceipt).rejects.toBeInstanceOf(
-        SyncTransactionAbortedError,
-      )
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(storageId).toBe(`expired-write-new`)),
-        `claim expiry recovery`,
-      )
-      await atPersistedOracleCheckpoint(
-        sourceRestarted.promise,
-        `replacement source restart`,
-      )
-      expect(rotations).toBe(1)
-      expect(renewals).toBeGreaterThan(0)
-      expect(collection.get(`old`)).toBeUndefined()
-      expect(collection.get(`second-old`)).toBeUndefined()
-      expect(
-        adapter.applyCommittedTxCalls.filter((call) =>
-          call.tx.mutations.some(
-            (mutation) =>
-              mutation.key === `old` || mutation.key === `second-old`,
+          : {}
+      const published = createEventGate()
+      const publishedSnapshots: Array<Map<string, Todo>> = []
+      const publishedOrdinaryValues: Array<Todo> = []
+      const publishedChanges: Array<string> = []
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        await collection._sync.loadSubset(demand)
+        const before = new Map(
+          Array.from(publicRows(), ([key, row]) => [key, structuredClone(row)]),
+        )
+        expectExactSnapshot(
+          before,
+          new Map(
+            route === `active filter` && transition === `enter`
+              ? []
+              : [[old.id, old]],
           ),
-        ),
-      ).toEqual([])
-      // Recovery succeeded: the Collection still accepts sync data.
-      expect(collection.status).toBe(`ready`)
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `new`, title: `New private generation` },
-      })
-      await whenSyncAccepted(source.commit())
-      expect(collection.get(`new`)).toMatchObject({ id: `new` })
-      expect(
-        adapter.applyCommittedTxCalls
-          .filter((call) =>
-            call.tx.mutations.some((mutation) => mutation.key === `new`),
-          )
-          .map((call) => call.collectionId),
-      ).toEqual([`expired-write-new`])
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // Claim expiry revokes durable source authority, but it does not settle a
-  // local optimistic transaction. The model keeps that row visible until its
-  // mutation function settles, clears the old source base, then accepts a
-  // fresh source commit in the new generation. This checkpoint also detects
-  // a recovery that waits for visibility of its truncate behind the mutation.
-  it(`recovers an expired cache claim beneath a persisting optimistic mutation`, async () => {
-    const adapter = createRecordingAdapter()
-    let storageId = `optimistic-expiry-old`
-    let expired = false
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `optimistic-expiry-claim`,
-      expiresAtMs: Date.now() + 10_000,
-    })
-    adapter.renewCacheGenerationClaim = async () =>
-      expired ? undefined : Date.now() + 10_000
-    adapter.rotateCacheGeneration = async () => {
-      expired = false
-      return {
-        storageCollectionId: (storageId = `optimistic-expiry-new`),
-        claimId: `optimistic-expiry-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const entered = createDeferred()
-    const release = createDeferred()
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `optimistic-expiry`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            // This controlled source delivers only explicit test writes.
-            return { restartAfterScopedRecovery: () => {} }
-          },
-        },
-        persistence: { adapter },
-        onInsert: async () => {
-          entered.resolve()
-          await release.promise
-        },
-      }),
-    )
-    let mutation: ReturnType<typeof collection.insert> | undefined
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      mutation = collection.insert({ id: `local`, title: `Pending` })
-      await entered.promise
-      expect(collection.get(`local`)).toMatchObject({ id: `local` })
-      expired = true
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `old`, title: `Expired source` },
-      })
-      const staleReceipt = source.commit()
-      if (staleReceipt === true)
-        throw new Error(`source receipt was not tracked`)
-      await expect(staleReceipt).rejects.toBeInstanceOf(
-        SyncTransactionAbortedError,
-      )
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(storageId).toBe(`optimistic-expiry-new`)),
-        `expired optimistic recovery`,
-      )
-      expect(collection.get(`local`)).toMatchObject({ id: `local` })
-      expect(collection.get(`old`)).toBeUndefined()
-      release.resolve()
-      await mutation.isPersisted.promise
-      source.begin()
-      source.write({
-        type: `insert`,
-        value: { id: `fresh`, title: `New source` },
-      })
-      await whenSyncAccepted(source.commit())
-      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
-      expect(
-        adapter.applyCommittedTxCalls
-          .filter((call) =>
-            call.tx.mutations.some((entry) => entry.key === `fresh`),
-          )
-          .map((call) => call.collectionId),
-      ).toEqual([`optimistic-expiry-new`])
-    } finally {
-      release.resolve()
-      await mutation?.isPersisted.promise.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-
-  // A warm run with an active demand renews its claim while timers run. If a
-  // long pause lets the claim expire, that timer must start scoped recovery
-  // and reacquire the active subset from the source. The held wall-clock
-  // interval is bounded; the source call log distinguishes a wakeup from a
-  // run that silently stays on the old cache.
-  it(`reloads an active subset when its renewal timer finds an expired claim`, async () => {
-    const adapter = createRecordingAdapter()
-    let storageId = `timer-old-storage`
-    let renewals = 0
-    let rotations = 0
-    let expired = false
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: storageId,
-      claimId: `timer-claim`,
-      expiresAtMs: Date.now() + 80,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      return expired ? undefined : Date.now() + 80
-    }
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      return {
-        storageCollectionId: (storageId = `timer-new-storage`),
-        claimId: `timer-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const sourceLoads: Array<{ refetch?: boolean }> = []
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `timer-claim-reload`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            params.markReady()
-            return {
-              // The first load has settled before the claim-expiry timer.
-              restartAfterScopedRecovery: () => {},
-              loadSubset: (options) => {
-                sourceLoads.push({ refetch: options.refetch })
-                return Promise.resolve()
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await collection._sync.loadSubset({ limit: 1 })
-      expect(sourceLoads).toEqual([{ refetch: undefined }])
-      expired = true
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(rotations).toBe(1)),
-        `expired timer recovery`,
-      )
-      expect(renewals).toBeGreaterThan(0)
-      await atPersistedOracleCheckpoint(
-        vi.waitFor(() => expect(sourceLoads).toHaveLength(2)),
-        `active subset reload`,
-      )
-      expect(sourceLoads[1]).toEqual({ refetch: true })
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // A live claim with more than one timer interval remaining needs no durable
-  // renewal write for each source commit or subset read. The adapter checks
-  // claim authority at its storage boundary, while the timer maintains an
-  // otherwise idle run. The independent clock and call ledger require zero
-  // foreground renewals far from expiry and one when less than a minute
-  // remains. The row receipts and subset loads still complete at both cuts.
-  it(`renews a live cache claim only near expiry during foreground work`, async () => {
-    const adapter = createRecordingAdapter()
-    let now = 1_000
-    let expiresAtMs = 301_000
-    let renewals = 0
-    let rotations = 0
-    adapter.getCacheGenerationNow = () => now
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `foreground-renewal-storage`,
-      claimId: `foreground-renewal-claim`,
-      expiresAtMs,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      if (now >= expiresAtMs) return undefined
-      return (expiresAtMs = now + 300_000)
-    }
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      return {
-        storageCollectionId: `foreground-renewal-new`,
-        claimId: `foreground-renewal-claim`,
-        expiresAtMs: (expiresAtMs = now + 300_000),
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `foreground-claim-renewal`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            return { restartAfterScopedRecovery: () => {} }
+        )
+        if (route === `retired demand`) collection._sync.unloadSubset(demand)
+        subscription = collection.subscribeChanges(
+          (batch) => {
+            publishedSnapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            publishedChanges.push(
+              ...batch.map((change) => `${change.type}:${change.key}`),
+            )
+            for (const change of batch) {
+              if (change.key === old.id && change.type !== `delete`)
+                publishedOrdinaryValues.push(
+                  structuredClone(stripVirtualProps(change.value)),
+                )
+            }
+            published.resolve()
           },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const commit = async (id: string) => {
-      source.begin()
-      source.write({ type: `insert`, value: { id, title: id } })
-      await whenSyncAccepted(source.commit())
-    }
-    try {
-      await collection.stateWhenReady()
-      const startupRenewals = renewals
-      for (let index = 0; index < 6; index++) {
-        await commit(`far-${index}`)
-        await collection._sync.loadSubset({ limit: index + 1 })
-      }
-      expect(renewals).toBe(startupRenewals)
-      expect(collection.get(`far-5`)).toMatchObject({ id: `far-5` })
-      expect(rotations).toBe(0)
-
-      now = 251_000
-      await commit(`near`)
-      expect(renewals).toBe(startupRenewals + 1)
-      expect(collection.get(`near`)).toMatchObject({ id: `near` })
-      await collection._sync.loadSubset({ limit: 7 })
-      expect(renewals).toBe(startupRenewals + 1)
-      expect(rotations).toBe(0)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // Skipping a far-from-expiry timer check must arm its successor. This
-  // virtual-clock history observes no durable renewal at the first minute,
-  // then one renewal when the same idle claim enters the one-minute window.
-  // It distinguishes a cheap timer wake from accidentally consuming the only
-  // renewal opportunity.
-  it(`reschedules a skipped cache-claim timer until renewal is due`, async () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(1_000)
-    const adapter = createRecordingAdapter()
-    let expiresAtMs = Date.now() + 180_000
-    let renewals = 0
-    let rotations = 0
-    adapter.getCacheGenerationNow = () => Date.now()
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `idle-renewal-storage`,
-      claimId: `idle-renewal-claim`,
-      expiresAtMs,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      if (Date.now() >= expiresAtMs) return undefined
-      return (expiresAtMs = Date.now() + 180_000)
-    }
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      return {
-        storageCollectionId: `idle-renewal-new`,
-        claimId: `idle-renewal-claim`,
-        expiresAtMs: (expiresAtMs = Date.now() + 180_000),
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `idle-claim-renewal`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { restartAfterScopedRecovery: () => {} }
+          { includeInitialState: false },
+        )
+        const mutations: PersistedTx[`mutations`] = [
+          { type: `update`, key: old.id, value: patch },
+          ...(route === `retired demand`
+            ? [{ type: `insert` as const, key: unseen.id, value: unseen }]
+            : []),
+        ]
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId },
+          {
+            txId: `targeted-partial`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations,
           },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      const startupRenewals = renewals
-      await vi.advanceTimersByTimeAsync(60_000)
-      expect(renewals).toBe(startupRenewals)
-      expect(collection.status).toBe(`ready`)
-      await vi.advanceTimersByTimeAsync(60_000)
-      expect(renewals).toBe(startupRenewals + 1)
-      expect(rotations).toBe(0)
-      expect(collection.status).toBe(`ready`)
-    } finally {
-      await collection.cleanup()
-      vi.useRealTimers()
-    }
-  })
-
-  // A timer's transient renewal failure does not prove that the claim has
-  // expired. The independent clock model keeps the old claim through the
-  // failed attempt, retries before expiry, and never publishes an error or
-  // rotates storage. The scheduled retry, status and storage route are checked
-  // after each virtual-clock cut; treating every rejection as terminal fails
-  // at the first cut.
-  it(`retries a transient cache-claim renewal error while the claim is live`, async () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(1_000)
-    const adapter = createRecordingAdapter()
-    let renewals = 0
-    let rotations = 0
-    let failNextRenewal = false
-    adapter.getCacheGenerationNow = () => Date.now()
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `timer-transient-old`,
-      claimId: `timer-transient-claim`,
-      expiresAtMs: Date.now() + 1_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      if (failNextRenewal) {
-        failNextRenewal = false
-        throw new Error(`transient SQLITE_BUSY`)
-      }
-      return Date.now() + 1_000
-    }
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      return {
-        storageCollectionId: `timer-transient-new`,
-        claimId: `timer-transient-claim`,
-        expiresAtMs: Date.now() + 1_000,
-      }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `timer-transient-renewal`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            params.markReady()
-            return { restartAfterScopedRecovery: () => {} }
+        )
+        const authoredDurable = new Map<string, Todo>([
+          [old.id, durable],
+          ...(route === `retired demand`
+            ? ([[unseen.id, unseen]] as Array<[string, Todo]>)
+            : []),
+        ])
+        expectExactSnapshot(adapter.rows, authoredDurable)
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `targeted-partial`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows: [
+              { key: old.id, value: patch },
+              ...(route === `retired demand`
+                ? [{ key: unseen.id, value: unseen }]
+                : []),
+            ],
+            deletedKeys: [],
           },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      failNextRenewal = true
-      await vi.advanceTimersByTimeAsync(500)
-      expect(collection.status).toBe(`ready`)
-      expect(rotations).toBe(0)
-      const countAfterFailure = renewals
-      await vi.advanceTimersByTimeAsync(250)
-      expect(renewals).toBeGreaterThan(countAfterFailure)
-      expect(collection.status).toBe(`ready`)
-      expect(rotations).toBe(0)
-    } finally {
-      await collection.cleanup()
-      vi.useRealTimers()
-    }
-  })
-
-  // Recovery can accept a new storage generation while its source restart is
-  // still held. A renewal timer consumed during that hold cannot renew: its
-  // own claim check joins the in-flight recovery. The independent clock model
-  // therefore starts the new timer after source restart, then renews before
-  // the replacement claim expires. No further demand drives this checkpoint.
-  it(`renews a replacement cache claim after a held source restart`, async () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(1_000)
-    const adapter = createRecordingAdapter()
-    const sourceHeld = createEventGate()
-    const releaseSource = createEventGate()
-    const sourceFinished = createEventGate()
-    let renewals = 0
-    let rotations = 0
-    adapter.getCacheGenerationNow = () => Date.now()
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: `held-source-old`,
-      claimId: `held-source-claim`,
-      expiresAtMs: 2_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => {
-      renewals++
-      return rotations === 0 && Date.now() >= 2_000
-        ? undefined
-        : Date.now() + 1_000
-    }
-    adapter.rotateCacheGeneration = async () => {
-      rotations++
-      return {
-        storageCollectionId: `held-source-new`,
-        claimId: `held-source-claim`,
-        expiresAtMs: Date.now() + 1_000,
+          undefined,
+          collectionId,
+        )
+        await atPersistedOracleCheckpoint(
+          published.promise,
+          `targeted partial notice published`,
+        )
+        await flushAsyncWork()
+        const expected = expectedTargetedSnapshot(
+          before,
+          authoredDurable,
+          route === `active filter` ? `Keep` : undefined,
+        )
+        expectExactSnapshot(publicRows(), expected)
+        expect(publishedSnapshots).toHaveLength(1)
+        for (const snapshot of publishedSnapshots)
+          expectExactSnapshot(snapshot, expected)
+        if (expected.has(old.id)) {
+          expect(publishedOrdinaryValues).toHaveLength(1)
+          expect(publishedOrdinaryValues[0]).toStrictEqual(durable)
+        } else {
+          expect(publishedChanges).toContain(`delete:${old.id}`)
+        }
+        if (route === `retired demand`)
+          expect(
+            publishedChanges.some((change) => change.endsWith(`:unseen`)),
+          ).toBe(false)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        subscription?.unsubscribe()
+        if (route === `active filter`) collection._sync.unloadSubset(demand)
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
       }
-    }
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `held-source-renewal`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            params.markReady()
-            return {
-              restartAfterScopedRecovery: (cacheRotated) =>
-                cacheRotated.then(async () => {
-                  sourceHeld.resolve()
-                  await releaseSource.promise
-                  sourceFinished.resolve()
-                }),
-              loadSubset: () => Promise.resolve(),
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await collection.stateWhenReady()
-      vi.setSystemTime(2_100)
-      await vi.advanceTimersByTimeAsync(500)
-      await sourceHeld.promise
-      expect(rotations).toBe(1)
-      await vi.advanceTimersByTimeAsync(500)
-      releaseSource.resolve()
-      await sourceFinished.promise
-      for (let turn = 0; turn < 20; turn++) await Promise.resolve()
-      const afterRecovery = renewals
-      await vi.advanceTimersByTimeAsync(260)
-      expect(renewals).toBeGreaterThan(afterRecovery)
-      expect(collection.status).toBe(`ready`)
-    } finally {
-      releaseSource.resolve()
-      await collection.cleanup()
-      vi.useRealTimers()
-    }
-  })
-
-  // A local cache clear supplies no source-readiness evidence. The model starts
-  // loading, accepts the scoped truncate, and remains loading until the source
-  // explicitly marks ready. This wrapper-path check observes status after the
-  // truncate commit, where the core default could otherwise publish readiness.
-  it(`keeps initial Collection loading through a scoped cache clear`, async () => {
-    const adapter = createRecordingAdapter()
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `scoped-clear-readiness`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await flushAsyncWork()
-      expect(collection.status).toBe(`loading`)
-      await source.metadata!.persistence!.startScopedRecovery!()
-      expect(collection.status).toBe(`loading`)
-      source.markReady()
-      await flushAsyncWork()
-      expect(collection.status).toBe(`ready`)
-    } finally {
-      await collection.cleanup()
-    }
-  })
+    },
+  )
 
-  // Core applies an accepted truncate even while a local optimistic handler
-  // persists. The source may continue after this accepted clear; a later subset
-  // still waits for its own applied rows. This held-handler cut tests the
-  // review's proposed acceptance/application cycle on the actual wrapper path.
-  it(`accepts a scoped cache clear while an optimistic handler is held`, async () => {
-    const adapter = createRecordingAdapter()
-    const entered = createDeferred()
-    const release = createDeferred()
-    let source!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `scoped-clear-held-handler`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
+  // The same targeted path must respect DbClient hydration authority. A seed
+  // key may also exist in older durable storage. Active complete and filtered
+  // demand, and retired demand, cannot let a peer delta replace that
+  // source-owned value. The filtered case makes the durable row leave the
+  // predicate while the hydrated seed still matches it. The ordinary row
+  // beside it proves the notice was processed, so a
+  // subject that simply drops all targeted messages cannot pass. The model is
+  // the authored durable snapshot with the protected seed overlaid; public
+  // rows and change keys are checked after the targeted commit publishes.
+  it.each(
+    ([`active demand`, `active filter`, `retired demand`] as const).flatMap(
+      (route) =>
+        ([`replacement`, `partial update`, `deletion`] as const).flatMap(
+          (mutation) =>
+            ([`set`, `delete`] as const).map((metadataAction) => ({
+              route,
+              mutation,
+              metadataAction,
+            })),
+        ),
+    ),
+  )(
+    `preserves a hydrated seed and metadata during a targeted $mutation with $route ($metadataAction)`,
+    async ({ route, mutation, metadataAction }) => {
+      const ordinary =
+        route === `active filter`
+          ? { id: `ordinary`, title: `Keep`, detail: `old` }
+          : { id: `ordinary`, title: `Old durable` }
+      const ordinaryPatch =
+        route === `active filter`
+          ? { id: ordinary.id, detail: `fresh` }
+          : { id: ordinary.id, title: `Fresh durable` }
+      const durableOrdinary = { ...ordinary, ...ordinaryPatch }
+      const seed = {
+        id: `seed`,
+        title: route === `active filter` ? `Keep` : `Hydrated seed`,
+        detail: `source-owned`,
+      }
+      const storedSeed = {
+        id: `seed`,
+        title: route === `active filter` ? `Keep` : `Older durable seed`,
+        detail: `older`,
+      }
+      const seedMutation: PersistedTx[`mutations`][number] =
+        mutation === `deletion`
+          ? { type: `delete`, key: seed.id, value: storedSeed }
+          : mutation === `partial update`
+            ? {
+                type: `update`,
+                key: seed.id,
+                value:
+                  route === `active filter`
+                    ? { id: seed.id, title: `Other` }
+                    : { id: seed.id, detail: `still older` },
+              }
+            : {
+                type: `update`,
+                key: seed.id,
+                value: {
+                  id: seed.id,
+                  title:
+                    route === `active filter` ? `Other` : `Still older durable`,
+                  detail: `older`,
+                },
+              }
+      const durableSeed: Todo | undefined =
+        mutation === `deletion`
+          ? undefined
+          : mutation === `partial update`
+            ? route === `active filter`
+              ? { ...storedSeed, title: `Other` }
+              : { ...storedSeed, detail: `still older` }
+            : {
+                ...storedSeed,
+                title:
+                  route === `active filter` ? `Other` : `Still older durable`,
+              }
+      const adapter = createRecordingAdapter([ordinary, storedSeed])
+      adapter.rowMetadata.set(seed.id, { owner: `older durable` })
+      if (route === `active filter`) {
+        const originalLoad = adapter.loadSubset.bind(adapter)
+        adapter.loadSubset = async (id, options, context) =>
+          (await originalLoad(id, options, context)).filter(
+            (row) => !options.where || row.value.title === `Keep`,
+          )
+      }
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `targeted-seed-${route}`
+      let sourceParams!: TodoSyncParams
+      const descriptor = collectionOptions(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
           },
-        },
-        persistence: { adapter },
-        onInsert: async () => {
-          entered.resolve()
-          await release.promise
-        },
-      }),
-    )
-    let mutation: ReturnType<typeof collection.insert> | undefined
-
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      mutation = collection.insert({ id: `local`, title: `Pending` })
-      await entered.promise
-      const recovery = observeSettlement(
-        source.metadata!.persistence!.startScopedRecovery!(),
+          persistence: { adapter, coordinator },
+        }),
       )
-      await flushAsyncWork()
-      expect(recovery.read()).toEqual({ status: `fulfilled` })
-      expect(collection.get(`local`)).toBeDefined()
-      release.resolve()
-      await mutation.isPersisted.promise
-    } finally {
-      release.resolve()
-      await mutation?.isPersisted.promise.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-
-  it(`fail-stops queued and later work when reset reload fails after truncation`, async () => {
-    const seed = { id: `seed`, title: `durable baseline` }
-    const adapter = createRecordingAdapter([seed])
-    const coordinator = createFailStopCoordinatorHarness(
-      `terminal-reset-reload-failure`,
-    )
-    const reloadEntered = createEventGate()
-    const reload = createEventGate()
-    const reloadError = new Error(`reset reload failed exactly`)
-    let sourceParams!: TodoSyncParams
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `terminal-reset-reload-failure`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sourceParams = params
-            params.markReady()
+      const client = new DbClient()
+      const seedMetadata = { owner: `hydrated source` }
+      client.hydrate({
+        collections: [
+          {
+            collectionId,
+            rows: [{ key: seed.id, value: seed, metadata: seedMetadata }],
           },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let queuedReceipt: Promise<void> | undefined
-    let hasPrimaryFailure = false
-
-    try {
-      await atPersistedOracleCheckpoint(
-        collection.stateWhenReady(),
-        `reset reload collection ready`,
-      )
-      expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
-      adapter.loadSubset = async () => {
-        reloadEntered.resolve()
-        await reload.promise
-        throw reloadError
-      }
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 1,
-      })
-      await atPersistedOracleCheckpoint(
-        reloadEntered.promise,
-        `reset reload entered after memory truncate`,
-      )
-      expect(collection.get(seed.id)).toBeUndefined()
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `queued`, title: `must reject with reset failure` },
-      })
-      queuedReceipt = Promise.resolve(sourceParams.commit()).then(
-        () => undefined,
-      )
-      void queuedReceipt.catch(() => undefined)
-      const queuedSettlement = observeSettlement(queuedReceipt)
-      expect(queuedSettlement.read()).toEqual({ status: `pending` })
-
-      reload.reject(reloadError)
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      sourceParams.begin()
-      sourceParams.write({
-        type: `insert`,
-        value: { id: `late`, title: `must not continue after reset failure` },
+        ],
       })
-      const lateOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(sourceParams.commit()).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `post-reset-reload-failure receipt`,
-      )
-      const queuedOutcome = queuedSettlement.read()
+      const collection = client.collection(descriptor)
+      const demand =
+        route === `active filter`
+          ? {
+              where: new IR.Func(`eq`, [
+                new IR.PropRef([`title`]),
+                new IR.Value(`Keep`),
+              ]),
+            }
+          : {}
+      const published = createEventGate()
+      const publishedKeys: Array<string> = []
+      const publishedOrdinaryValues: Array<Todo> = []
+      const publishedSnapshots: Array<Map<string, Todo>> = []
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
+      try {
+        collection.startSyncImmediate()
+        await collection.stateWhenReady()
+        await collection._sync.loadSubset(demand)
+        const before = new Map<string, Todo>([
+          [ordinary.id, ordinary],
+          [seed.id, seed],
+        ])
+        expectExactSnapshot(publicRows(), before)
+        expect(sourceParams.metadata?.row.get(seed.id)).toEqual(seedMetadata)
+        if (route === `retired demand`) collection._sync.unloadSubset(demand)
+        subscription = collection.subscribeChanges(
+          (batch) => {
+            publishedSnapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            publishedKeys.push(...batch.map((change) => String(change.key)))
+            for (const change of batch) {
+              if (change.key === ordinary.id && change.type !== `delete`)
+                publishedOrdinaryValues.push(
+                  structuredClone(stripVirtualProps(change.value)),
+                )
+            }
+            published.resolve()
+          },
+          { includeInitialState: false },
+        )
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId },
+          {
+            txId: `targeted-seed`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [
+              {
+                type: `update`,
+                key: ordinary.id,
+                value: ordinaryPatch,
+              },
+              seedMutation,
+            ],
+            rowMetadataMutations: [
+              metadataAction === `set`
+                ? {
+                    type: `set`,
+                    key: seed.id,
+                    value: { owner: `peer durable` },
+                  }
+                : { type: `delete`, key: seed.id },
+            ],
+          },
+        )
+        const authoredDurable = new Map<string, Todo>([
+          [ordinary.id, durableOrdinary],
+          ...(durableSeed
+            ? ([[seed.id, durableSeed]] as Array<[string, Todo]>)
+            : []),
+        ])
+        expectExactSnapshot(adapter.rows, authoredDurable)
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `targeted-seed`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows: [
+              { key: ordinary.id, value: ordinaryPatch },
+              ...(seedMutation.type === `delete`
+                ? []
+                : [{ key: seed.id, value: seedMutation.value }]),
+            ],
+            deletedKeys: seedMutation.type === `delete` ? [seed.id] : [],
+            rowMetadataMutations: [
+              metadataAction === `set`
+                ? {
+                    type: `set`,
+                    key: seed.id,
+                    value: { owner: `peer durable` },
+                  }
+                : { type: `delete`, key: seed.id },
+            ],
+          },
+          undefined,
+          collectionId,
+        )
+        await atPersistedOracleCheckpoint(
+          published.promise,
+          `targeted seed notice published`,
+        )
+        await flushAsyncWork()
+        const expected =
+          route === `active filter`
+            ? new Map([
+                ...expectedTargetedSnapshot(before, authoredDurable, `Keep`),
+                [seed.id, seed] as const,
+              ])
+            : expectedScopedSnapshot(
+                before,
+                authoredDurable,
+                new Map([[seed.id, seed]]),
+                route === `active demand`,
+              )
+        expectExactSnapshot(publicRows(), expected)
+        expect(sourceParams.metadata?.row.get(seed.id)).toEqual(seedMetadata)
+        expect(publishedSnapshots).toHaveLength(1)
+        for (const snapshot of publishedSnapshots)
+          expectExactSnapshot(snapshot, expected)
+        expect(publishedOrdinaryValues).toEqual([durableOrdinary])
+        expect(publishedKeys).toContain(ordinary.id)
+        expect(publishedKeys).not.toContain(seed.id)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        subscription?.unsubscribe()
+        if (route !== `retired demand`) collection._sync.unloadSubset(demand)
+        await cleanupPersistedOracle(
+          [() => client.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
 
-      expect({
-        queuedStatus: queuedOutcome.status,
-        queuedExact:
-          queuedOutcome.status === `rejected` &&
-          queuedOutcome.reason === reloadError,
-        lateStatus: lateOutcome.status,
-        lateExact:
-          lateOutcome.status === `rejected` &&
-          lateOutcome.reason === reloadError,
-        status: collection.status,
-        exactPublicError: collection._lifecycle.getSyncError() === reloadError,
-        visibleSeed: collection.get(seed.id),
-        durableSeed: adapter.rows.get(seed.id),
-        visibleQueued: collection.get(`queued`),
-        durableQueued: adapter.rows.get(`queued`),
-        visibleLate: collection.get(`late`),
-        durableLate: adapter.rows.get(`late`),
-        applyCalls: adapter.applyCommittedTxCalls.length,
-        publishCalls: coordinator.publishCalls.length,
-      }).toEqual({
-        queuedStatus: `rejected`,
-        queuedExact: true,
-        lateStatus: `rejected`,
-        lateExact: true,
-        status: `crashed`,
-        exactPublicError: true,
-        visibleSeed: undefined,
-        durableSeed: seed,
-        visibleQueued: undefined,
-        durableQueued: undefined,
-        visibleLate: undefined,
-        durableLate: undefined,
-        applyCalls: 0,
-        publishCalls: 0,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      reload.reject(reloadError)
-      warning.mockRestore()
-      await cleanupPersistedOracle(
+  // A source transaction can write the same key more than once. The durable
+  // store folds operations in order, but the targeted notice separates all
+  // changed rows from deleted keys. Delete -> update and update -> delete have
+  // identical wire arrays and opposite durable outcomes, so a receiver cannot
+  // reconstruct either result from that envelope alone. The independent case
+  // table authors the final durable relation; the recording adapter checks
+  // that each operation sequence reaches it before the notice is delivered.
+  // A same-key insert also shares the targeted changedRows shape with an
+  // update, yet replaces rather than merges the durable row. Both active
+  // complete and retired demand compare the public row at each callback and
+  // after the next task turn. Two updates are a neighboring control that
+  // retains the old field omitted by each patch.
+  it.each(
+    ([`active demand`, `retired demand`] as const).flatMap((route) =>
+      (
         [
-          () => collection.cleanup(),
-          () => queuedReceipt?.catch(() => undefined),
-        ],
-        hasPrimaryFailure,
+          `delete then update`,
+          `update then delete`,
+          `two updates`,
+          `insert replacement`,
+        ] as const
+      ).map((sequence) => ({ route, sequence })),
+    ),
+  )(
+    `follows durable same-key order for targeted $sequence with $route`,
+    async ({ route, sequence }) => {
+      const old = { id: `row`, title: `Old`, detail: `old detail` }
+      const fresh = { id: old.id, title: `Fresh` }
+      const detailPatch = { id: old.id, detail: `new detail` }
+      const titlePatch = { id: old.id, title: `Fresh` }
+      const mutations: PersistedTx[`mutations`] =
+        sequence === `delete then update`
+          ? [
+              { type: `delete`, key: old.id, value: old },
+              { type: `update`, key: old.id, value: fresh },
+            ]
+          : sequence === `update then delete`
+            ? [
+                { type: `update`, key: old.id, value: fresh },
+                { type: `delete`, key: old.id, value: old },
+              ]
+            : sequence === `insert replacement`
+              ? [{ type: `insert`, key: old.id, value: fresh }]
+              : [
+                  { type: `update`, key: old.id, value: detailPatch },
+                  { type: `update`, key: old.id, value: titlePatch },
+                ]
+      const authoredDurable = new Map<string, Todo>(
+        sequence === `update then delete`
+          ? []
+          : sequence === `delete then update` ||
+              sequence === `insert replacement`
+            ? [[old.id, fresh]]
+            : [[old.id, { ...old, ...detailPatch, ...titlePatch }]],
       )
-    }
-  })
-
-  it(`fences coordinator delivery after terminal failure while allowing release and cleanup`, async () => {
-    const harness = await createTerminalFailureHarness(
-      `durability`,
-      `terminal-coordinator-delivery-fence`,
-    )
-    const {
-      adapter,
-      collection,
-      coordinator,
-      initialLease,
-      terminalError,
-      upstreamLoads,
-      upstreamUnloads,
-    } = harness
-    const adapterLoadsBefore = adapter.loadSubsetCalls.length
-    const ensureCallsBefore = coordinator.remoteEnsureCalls.length
-    const releaseCallsBefore = coordinator.remoteReleaseCalls.length
-    const upstreamLoadsBefore = upstreamLoads.length
-    const applyCallsBefore = adapter.applyCommittedTxCalls.length
-    const publishCallsBefore = coordinator.publishCalls.length
-    adapter.loadSubset = (collectionId, options, context) => {
-      adapter.loadSubsetCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        options,
-        requiredIndexSignatures: context?.requiredIndexSignatures ?? [],
-      })
-      return Promise.resolve([
-        {
-          key: `coordinator-late`,
-          value: { id: `coordinator-late`, title: `must not arrive` },
-        },
-      ])
-    }
-    let cleanedUp = false
-    let hasPrimaryFailure = false
-
-    try {
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 1,
-        txId: `post-terminal-targeted`,
-        latestRowVersion: 1,
-        requiresFullReload: false,
-        changedRows: [
-          {
-            key: `targeted-late`,
-            value: { id: `targeted-late`, title: `must not arrive` },
+      const adapter = createRecordingAdapter([old])
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `targeted-order-${route}-${sequence}`
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
           },
-        ],
-        deletedKeys: [],
-      })
-      coordinator.emit({
-        type: `tx:committed`,
-        term: 1,
-        seq: 2,
-        txId: `post-terminal-full-reload`,
-        latestRowVersion: 2,
-        requiresFullReload: true,
-      })
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 2,
-      })
-      const remoteEnsureOutcome = await atPersistedOracleCheckpoint(
-        Promise.resolve(collection._sync.loadSubset({ limit: 9 })).then(
-          () => ({ status: `fulfilled` as const }),
-          (reason: unknown) => ({ status: `rejected` as const, reason }),
-        ),
-        `post-terminal remote ensure delivery`,
+          persistence: { adapter, coordinator },
+        }),
       )
-      await flushAsyncWork()
-      await flushAsyncWork()
-      await flushAsyncWork()
-
-      const beforeCleanup = {
-        targetedVisible: collection.get(`targeted-late`),
-        reloadVisible: collection.get(`coordinator-late`),
-        status: collection.status,
-        exactPublicError:
-          collection._lifecycle.getSyncError() === terminalError,
+      const demand = {}
+      const published = createEventGate()
+      const publishedSnapshots: Array<Map<string, Todo>> = []
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        await collection._sync.loadSubset(demand)
+        expectExactSnapshot(publicRows(), new Map([[old.id, old]]))
+        if (route === `retired demand`) collection._sync.unloadSubset(demand)
+        subscription = collection.subscribeChanges(
+          () => {
+            publishedSnapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            published.resolve()
+          },
+          { includeInitialState: false },
+        )
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId },
+          {
+            txId: `targeted-order`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations,
+          },
+        )
+        expectExactSnapshot(adapter.rows, authoredDurable)
+        const changedRows =
+          sequence === `two updates`
+            ? [
+                { key: old.id, value: detailPatch },
+                { key: old.id, value: titlePatch },
+              ]
+            : [{ key: old.id, value: fresh }]
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `targeted-order`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows,
+            deletedKeys:
+              sequence === `two updates` || sequence === `insert replacement`
+                ? []
+                : [old.id],
+          },
+          undefined,
+          collectionId,
+        )
+        await atPersistedOracleCheckpoint(
+          published.promise,
+          `targeted same-key notice published`,
+        )
+        await flushAsyncWork()
+        const expected = expectedScopedSnapshot(
+          new Map([[old.id, old]]),
+          authoredDurable,
+          new Map(),
+          route === `active demand`,
+        )
+        expectExactSnapshot(publicRows(), expected)
+        expect(publishedSnapshots).toHaveLength(1)
+        for (const snapshot of publishedSnapshots)
+          expectExactSnapshot(snapshot, expected)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        subscription?.unsubscribe()
+        if (route === `active demand`) collection._sync.unloadSubset(demand)
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
       }
+    },
+  )
 
-      collection._sync.unloadSubset(initialLease)
-      await flushAsyncWork()
-      await flushAsyncWork()
-      const unloadCount = upstreamUnloads.length
-      await collection.cleanup()
-      cleanedUp = true
-
-      expect({
-        remoteEnsureStatus: remoteEnsureOutcome.status,
-        remoteEnsureExact:
-          remoteEnsureOutcome.status === `rejected` &&
-          remoteEnsureOutcome.reason === terminalError,
-        adapterLoads: adapter.loadSubsetCalls.length,
-        ensureCalls: coordinator.remoteEnsureCalls.length,
-        releaseCalls: coordinator.remoteReleaseCalls.length,
-        releasedExact: coordinator.remoteReleaseCalls.at(-1) === initialLease,
-        upstreamLoads: upstreamLoads.length,
-        unloadCount,
-        unsubscribeCalls: coordinator.unsubscribeCalls,
-        applyCalls: adapter.applyCommittedTxCalls.length,
-        publishCalls: coordinator.publishCalls.length,
-        targetedVisible: beforeCleanup.targetedVisible,
-        reloadVisible: beforeCleanup.reloadVisible,
-        targetedDurable: adapter.rows.get(`targeted-late`),
-        reloadDurable: adapter.rows.get(`coordinator-late`),
-        status: beforeCleanup.status,
-        exactPublicError: beforeCleanup.exactPublicError,
-      }).toEqual({
-        remoteEnsureStatus: `rejected`,
-        remoteEnsureExact: true,
-        adapterLoads: adapterLoadsBefore,
-        ensureCalls: ensureCallsBefore,
-        releaseCalls: releaseCallsBefore + 1,
-        releasedExact: true,
-        upstreamLoads: upstreamLoadsBefore,
-        unloadCount: 0,
-        unsubscribeCalls: 1,
-        applyCalls: applyCallsBefore,
-        publishCalls: publishCallsBefore,
-        targetedVisible: undefined,
-        reloadVisible: undefined,
-        targetedDurable: undefined,
-        reloadDurable: undefined,
-        status: `crashed`,
-        exactPublicError: true,
-      })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      await cleanupPersistedOracle(
-        [() => (cleanedUp ? undefined : collection.cleanup())],
-        hasPrimaryFailure,
-      )
-    }
-  })
-
-  it(`keeps a hydrated resume baseline across narrow full reloads`, async () => {
+  type RetainedDemandOperation =
+    | { type: `acquire` | `release`; demand: `one` | `two` }
+    | { type: `truncate` }
+  // The generated prefix varies demand ownership and reset history. Its
+  // terminal suffix reaches a retained hydrated demand, fails a source write,
+  // then checks the exact error and absence of a new upstream acquisition.
+  // The pre-fix fast path returned true and incremented upstreamLoads here.
+  // This recording adapter does not establish browser/OPFS behavior.
+  const retainedDemandHistory = fc
+    .array(
+      fc.record({
+        type: fc.constantFrom(`acquire` as const, `release` as const),
+        demand: fc.constantFrom(`one` as const, `two` as const),
+      }),
+      { minLength: 1, maxLength: 20 },
+    )
+    .chain((operations) =>
+      fc
+        .array(fc.integer({ min: 0, max: operations.length }), {
+          maxLength: 4,
+        })
+        .map((truncatePositions): Array<RetainedDemandOperation> => {
+          const positions = new Set(truncatePositions)
+          return operations.flatMap((operation, index) =>
+            positions.has(index)
+              ? [{ type: `truncate` as const }, operation]
+              : [operation],
+          )
+        }),
+    )
+  const runRetainedDemandHistory = async (
+    history: ReadonlyArray<RetainedDemandOperation>,
+  ): Promise<void> => {
     const adapter = createRecordingAdapter([
-      { id: `1`, title: `Narrow` },
-      { id: `2`, title: `Baseline only` },
+      { id: `1`, title: `one` },
+      { id: `2`, title: `two` },
     ])
-    const loadSubset = adapter.loadSubset.bind(adapter)
+    const loadRows = adapter.loadSubset
     adapter.loadSubset = async (...args) => {
-      const rows = await loadSubset(...args)
-      return args[1].where ? rows.filter((row) => row.key === `1`) : rows
+      const rows = await loadRows(...args)
+      return rows.slice(0, args[1].limit)
     }
-    const coordinator = createCoordinatorHarness()
-    let hydrateBaseline: (() => Promise<void>) | undefined
-    let persistenceCapability:
-      NonNullable<SyncMetadataApi<string>[`persistence`]> | undefined
+    let truncateSource: (() => void) | undefined
+    let failSource: (() => true | Promise<void>) | undefined
+    let upstreamLoads = 0
     const collection = createCollection(
       persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
+        id: `hydrated-demand-history`,
+        getKey: (row) => row.id,
         syncMode: `on-demand`,
-        getKey: (item) => item.id,
         sync: {
-          sync: ({ markReady, metadata }) => {
-            const capability = metadata?.persistence
-            if (!capability) {
-              throw new Error(`Expected persisted sync capability`)
+          sync: ({ begin, write, truncate, commit, markReady }) => {
+            truncateSource = () => {
+              begin()
+              truncate()
+              commit()
+            }
+            failSource = () => {
+              begin()
+              write({
+                type: `insert`,
+                value: { id: `terminal-write`, title: `must not persist` },
+              })
+              return commit()
             }
-            persistenceCapability = capability
-            hydrateBaseline = capability.hydrateBaseline
             markReady()
-            return { loadSubset: () => true }
+            return {
+              loadSubset: () => {
+                upstreamLoads++
+                return true
+              },
+            }
           },
         },
-        persistence: { adapter, coordinator },
+        persistence: { adapter },
       }),
     )
-
     collection.startSyncImmediate()
-    await vi.waitFor(() => expect(hydrateBaseline).toBeTypeOf(`function`))
-    expect(persistenceCapability).toMatchObject({
-      protocol: `@tanstack/db/sync-persistence`,
-      version: 1,
-    })
-    expect(persistenceCapability?.scanPersistedRows).toBeTypeOf(`function`)
-    expect(persistenceCapability?.resumeSnapshot.certify).toBeTypeOf(`function`)
-    expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence).toBeTypeOf(
-      `function`,
-    )
-    expect(
-      persistenceCapability?.resumeSnapshot.expectCurrentCommit,
-    ).toBeTypeOf(`function`)
-    await hydrateBaseline!()
-    expect(collection.has(`2`)).toBe(true)
+    for (let attempt = 0; attempt < 20 && !truncateSource; attempt++) {
+      await flushAsyncWork()
+    }
+    expect(truncateSource).toBeTypeOf(`function`)
 
-    await collection._sync.loadSubset({
-      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(`1`)]),
-    })
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `full-reload`,
-      latestRowVersion: 1,
-      requiresFullReload: true,
+    const active: Record<`one` | `two`, Array<LoadSubsetOptions>> = {
+      one: [],
+      two: [],
+    }
+    const hydrated = new Set<`one` | `two`>()
+    const optionsFor = (demand: `one` | `two`): LoadSubsetOptions => ({
+      limit: demand === `one` ? 1 : 2,
     })
-    await flushAsyncWork()
-    await flushAsyncWork()
-
-    expect(collection.has(`2`)).toBe(true)
-    await collection.cleanup()
-  })
-
-  it.each(persistedKeySetEvidenceStatuses.map((status) => ({ status })))(
-    `keeps on-demand rows independent from $status baseline evidence`,
-    async ({ status }) => {
-      const adapter = createRecordingAdapter([
-        { id: `on-demand`, title: `On-demand row` },
-      ])
-      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-      adapter.loadResumeSnapshot = async (...args) => ({
-        ...(await loadResumeSnapshot(...args)),
-        rows: [
-          {
-            key: `baseline`,
-            value: { id: `baseline`, title: `Baseline row` },
-          },
-        ],
-        keySet: { status },
-      })
-      let hydrateBaseline: (() => Promise<void>) | undefined
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `${status}-baseline-and-on-demand`,
-          syncMode: `on-demand`,
-          getKey: (item) => item.id,
-          sync: {
-            sync: ({ markReady, metadata }) => {
-              const capability = metadata?.persistence
-              if (!capability) {
-                throw new Error(`Expected persisted sync capability`)
-              }
-              hydrateBaseline = capability.hydrateBaseline
-              markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
 
-      try {
-        collection.startSyncImmediate()
-        await vi.waitFor(() => expect(hydrateBaseline).toBeTypeOf(`function`))
-        await hydrateBaseline!()
-        await flushAsyncWork()
-        await flushAsyncWork()
+    try {
+      for (const operation of history) {
+        if (operation.type === `truncate`) {
+          truncateSource?.()
+          hydrated.clear()
+          continue
+        }
 
-        const baselineVisible = collection.has(`baseline`)
-        expect(collection.has(`on-demand`)).toBe(false)
-        await collection._sync.loadSubset({})
+        const demand = operation.demand
+        if (operation.type === `release`) {
+          const options = active[demand].pop()
+          if (!options) continue
+          collection._sync.unloadSubset(options)
+          if (active[demand].length === 0) hydrated.delete(demand)
+          continue
+        }
 
-        expectOnDemandEvidenceLaw({
-          status,
-          route: `loadSubset`,
-          baselineVisible,
-          onDemandVisible: collection.has(`on-demand`),
-        })
-      } finally {
-        await collection.cleanup()
+        const options = optionsFor(demand)
+        const result = collection._sync.loadSubset(options)
+        expect(result === true).toBe(hydrated.has(demand))
+        if (result !== true) await result
+        active[demand].push(options)
+        hydrated.add(demand)
       }
-    },
-  )
 
-  it.each(persistedKeySetEvidenceStatuses.map((status) => ({ status })))(
-    `keeps force reload rows independent from $status startup evidence`,
-    async ({ status }) => {
-      const adapter = createRecordingAdapter([
-        { id: `on-demand`, title: `On-demand row` },
-      ])
-      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-      adapter.loadResumeSnapshot = async (...args) => ({
-        ...(await loadResumeSnapshot(...args)),
-        keySet: { status },
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `${status}-local-only-force-reload`,
-          syncMode: `on-demand`,
-          getKey: (item) => item.id,
-          persistence: { adapter },
-        }),
+      // A terminal durability failure is absorbing even when a retained
+      // demand still has hydrated rows. No later acquisition owns a new
+      // upstream lease or receives synchronous readiness.
+      const retained = optionsFor(`one`)
+      const retainedResult = collection._sync.loadSubset(retained)
+      if (retainedResult !== true) await retainedResult
+      const adapterFailure = new Error(`retained demand durability failed`)
+      adapter.applyCommittedTx = () => Promise.reject(adapterFailure)
+      const failedReceipt = failSource?.()
+      if (!(failedReceipt instanceof Promise)) {
+        throw new Error(`expected a failing source receipt`)
+      }
+      const receiptOutcome = await failedReceipt.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
       )
+      const terminalError = collection._lifecycle.getSyncError()
+      expect(receiptOutcome).toEqual({
+        status: `rejected`,
+        reason: terminalError,
+      })
+      expect(terminalError).toMatchObject({
+        name: `PersistedCollectionDurabilityError`,
+        cause: adapterFailure,
+      })
 
+      const loadsBeforeRetry = upstreamLoads
+      let retryFailure: unknown
       try {
-        collection.startSyncImmediate()
-        await vi.waitFor(() =>
-          expect(adapter.loadResumeSnapshotCalls.length).toBeGreaterThan(0),
-        )
-        await collection.utils.forceReloadSubset!({})
-
-        expect(adapter.loadResumeSnapshotCalls[0]?.includeRows).toBe(false)
-        expectOnDemandEvidenceLaw({
-          status,
-          route: `forceReloadSubset`,
-          // This local-only route reads startup evidence but does not expose
-          // baseline hydration. Do not claim a baseline observation here.
-          baselineVisible: `not-observed`,
-          onDemandVisible: collection.has(`on-demand`),
-        })
-      } finally {
-        await collection.cleanup()
+        await collection._sync.loadSubset(optionsFor(`one`))
+      } catch (error) {
+        retryFailure = error
       }
-    },
-  )
-
-  it(`rejects an evidence-coupled on-demand hydration mutant`, () => {
-    expect(() =>
-      expectOnDemandEvidenceLaw({
-        status: `incompatible`,
-        route: `loadSubset`,
-        baselineVisible: false,
-        onDemandVisible: false,
-      }),
-    ).toThrow(`on-demand rows must not inherit baseline evidence rejection`)
-
-    expectOnDemandEvidenceLaw({
-      status: `incompatible`,
-      route: `loadSubset`,
-      baselineVisible: false,
-      onDemandVisible: true,
-    })
-  })
-
-  it(`keeps resume certification consistent after an owned no-op commit`, async () => {
-    const adapter = createRecordingAdapter()
-    let remoteBegin: (() => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    let persistenceCapability:
-      SyncMetadataApi<string>[`persistence`] | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `owned-no-op-generation`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ begin, commit, markReady, metadata }) => {
-            remoteBegin = begin
-            remoteCommit = commit
-            persistenceCapability = metadata?.persistence
-            markReady()
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() =>
-        expect(persistenceCapability).toMatchObject({
-          protocol: `@tanstack/db/sync-persistence`,
-          version: 1,
-        }),
-      )
+      expect({ retryFailure, upstreamLoads }).toEqual({
+        retryFailure: terminalError,
+        upstreamLoads: loadsBeforeRetry,
+      })
+    } finally {
+      await collection.cleanup()
+    }
+  }
 
-      remoteBegin?.()
-      persistenceCapability?.resumeSnapshot.expectCurrentCommit()
-      const applied = remoteCommit?.()
-      if (applied !== true) await applied
+  fcTest.prop([retainedDemandHistory], {
+    numRuns: oracleRuns(50),
+    seed: 186001,
+  })(
+    `matches the retained exact-demand model with a fixed seed`,
+    runRetainedDemandHistory,
+  )
+  fcTest.prop(
+    [retainedDemandHistory],
+    oraclePropertyOptions(50, `persistence.retained-demand`),
+  )(
+    `matches the retained exact-demand model with a random or replayed seed`,
+    runRetainedDemandHistory,
+  )
 
-      expect(adapter.applyCommittedTxCalls).toHaveLength(0)
-      await persistenceCapability?.resumeSnapshot.certify()
-      expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence()).toEqual(
-        { status: `consistent` },
-      )
-    } finally {
-      await collection.cleanup()
+  /**
+   * A follower has no local source. It routes demand to the elected owner,
+   * and the owner's commits reach it only as durable rows plus a commit
+   * notice. After a cache rotation the follower is in scoped recovery, where
+   * durable rows cannot replace source rows. Rotation gives the follower a
+   * fresh cache generation, and the follower asks the owner to reacquire
+   * every active demand into it. Once those reacquisitions settle, the new
+   * generation holds exactly the owner's rows for that demand, so durable
+   * rows are authoritative again. The law is therefore: while the
+   * reacquisitions are in flight, the follower holds the generation's commit
+   * notices; when they settle, scoped recovery ends for that generation and
+   * the held notices, and every later one, apply through the normal path.
+   * No sender is special: a peer's notice after recovery is an ordinary
+   * invalidation that rereads durable rows.
+   *
+   * The independent model is `expectedScopedSnapshot` with complete demand
+   * over the authored durable rows of the current generation. It knows
+   * nothing about notices or scoped recovery; the driver applies it only at
+   * checkpoints where the owner's evidence has arrived. The ensure log is a
+   * separate observation: one acquisition and one reacquisition after
+   * rotation, and no other ensure. A bounded leader that re-commits on every
+   * ensure makes the alternative design (answer every notice during scoped
+   * recovery with a refetch) loop, and the bound turns that loop into an
+   * assertion failure.
+   *
+   * The grammar crosses when the owner first commits the row (before or
+   * after the rotation) with a later broadcast for the same key: none, an
+   * owner update, or a peer notice that claims a different value. An owner
+   * update's durable read either succeeds or fails. Recovery has ended, so a
+   * failed read of it is a real failure: the follower becomes terminal and
+   * keeps the rows it showed, instead of silently ignoring the failure as if
+   * a new recovery had started during the read.
+   * The
+   * observations are the follower's rows when its first load settles, after
+   * the rotation's reacquisition, and after the later broadcast, plus the
+   * ensure log at quiescence. The coordinator is a controlled double of an
+   * elected owner; it does not prove the browser transport.
+   *
+   * Known gap (#2139): production does not end a rotated follower's scoped
+   * recovery, so this lane's cells are pinned as failing until it does.
+   */
+  type FollowerGenerationNoticeHistory = {
+    ownerCommit: `before-rotation` | `after-rotation`
+    later: `none` | `owner` | `peer`
+    // Applies only to a later owner update.
+    ownerRead: `ok` | `fails`
+    // Control: an owner notice's read is in flight when rotation starts, and
+    // then fails. Recovery owns that read, so its failure is ignored.
+    readFailsAsRotationStarts?: boolean
+    // How the owner's notices in the rotated generation reach the follower:
+    // in order, after a gap in the stream position (the follower's position
+    // restarts at zero when it rotates), or as an exact-ID reconciliation
+    // reload. Each must publish the same rows once recovery ends.
+    noticeShape?: `plain` | `gap` | `reconciliation`
+  }
+  const assertFollowerGenerationNoticeHistory = async ({
+    ownerCommit,
+    later,
+    ownerRead,
+    readFailsAsRotationStarts = false,
+    noticeShape = `plain`,
+  }: FollowerGenerationNoticeHistory): Promise<void> => {
+    const readFailure = new Error(`owner update read failed`)
+    let failNextRead = false
+    let holdNextRead:
+      { promise: Promise<void>; reject: (e: unknown) => void } | undefined
+    const oldStorageId = `follower-notice-old`
+    const newStorageId = `follower-notice-new`
+    const ownerId = `elected-owner`
+    const v1: Todo = { id: `remote`, title: `Owner row` }
+    const v2: Todo = { id: `remote`, title: `Owner update` }
+    const durable = new Map<string, Map<string, Todo>>([
+      [oldStorageId, new Map()],
+      [newStorageId, new Map()],
+    ])
+    let storageId = oldStorageId
+    // The owner's upstream row: present from the start, or only once the
+    // owner fetched it after the rotation began.
+    let upstream: Todo | undefined =
+      ownerCommit === `before-rotation` ? v1 : undefined
+    const ensures: Array<{ id: string; refetch: boolean }> = []
+    const subscribers = new Map<
+      string,
+      (message: ProtocolEnvelope<unknown>) => void
+    >()
+    const versions = new Map<string, number>()
+    // Enough commits for every legal history; a refetch loop exceeds it.
+    const commitBudget = 8
+    let commits = 0
+    const notify = (id: string, row: Todo, senderId: string) => {
+      // A gap skips one stream position in the rotated generation.
+      const skip =
+        noticeShape === `gap` && id === newStorageId && !versions.has(id)
+          ? 1
+          : 0
+      const version = (versions.get(id) ?? 0) + 1 + skip
+      versions.set(id, version)
+      const reconciliation =
+        noticeShape === `reconciliation` && id === newStorageId
+      subscribers.get(id)?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId: id,
+        senderId,
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 1,
+          seq: version,
+          txId: `${senderId}-${id}-${version}`,
+          latestRowVersion: version,
+          requiresFullReload: reconciliation,
+          ...(reconciliation ? { reconciliationReload: true } : {}),
+          changedRows: [{ key: row.id, value: { ...row } }],
+          deletedKeys: [],
+        } satisfies TxCommitted,
+      })
     }
-  })
-
-  // A no-write election reserves a new durable term but leaves the persisted
-  // rows, source cursor, row version, and reset epoch intact. The atomic
-  // snapshot still certifies the same baseline when on-demand Electric resumes.
-  // The recording adapter supplies only this term transition; the SQLite owner
-  // separately proves that term reservation leaves the row version unchanged.
-  it(`keeps resume evidence across a no-write durable term reservation`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
-    let durableGeneration = {
-      latestTerm: 1,
-      latestSeq: 1,
-      latestRowVersion: 1,
-      resetEpoch: 0,
+    const ownerCommits = (id: string, row: Todo) => {
+      if (commits++ >= commitBudget) return
+      durable.get(id)!.set(row.id, structuredClone(row))
+      notify(id, row, ownerId)
     }
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => ({
-      ...(await loadResumeSnapshot(...args)),
-      ...durableGeneration,
-    })
-    let persistenceCapability:
-      SyncMetadataApi<string>[`persistence`] | undefined
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `no-write-term-resume`,
-        syncMode: `on-demand`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady, metadata }) => {
-            persistenceCapability = metadata?.persistence
-            markReady()
-          },
-        },
-        persistence: { adapter },
+    const adapter: PersistenceAdapter = {
+      loadSubset: async (target) => {
+        const hold = holdNextRead
+        if (hold) {
+          holdNextRead = undefined
+          await hold.promise
+        }
+        if (failNextRead) {
+          failNextRead = false
+          throw readFailure
+        }
+        return Array.from(
+          durable.get(recordedStorageId(target))!.values(),
+          (value) => ({
+            key: value.id,
+            value: structuredClone(value),
+          }),
+        )
+      },
+      claimCacheGeneration: async () => ({
+        storageCollectionId: oldStorageId,
+        claimId: `follower-notice-claim`,
+        expiresAtMs: Date.now() + 60_000,
       }),
-    )
-
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() =>
-        expect(persistenceCapability).toMatchObject({
-          protocol: `@tanstack/db/sync-persistence`,
-          version: 1,
-        }),
-      )
-      await vi.waitFor(() =>
-        expect(
-          persistenceCapability?.resumeSnapshot.getKeySetEvidence(),
-        ).toEqual({ status: `consistent` }),
-      )
-
-      durableGeneration = {
-        latestTerm: 2,
+      renewCacheGenerationClaim: async () => Date.now() + 60_000,
+      rotateCacheGeneration: async () => {
+        storageId = newStorageId
+        if (ownerCommit === `after-rotation`) upstream = v1
+        return {
+          storageCollectionId: newStorageId,
+          claimId: `follower-notice-claim`,
+          expiresAtMs: Date.now() + 60_000,
+        }
+      },
+      releaseCacheGenerationClaim: async () => {},
+      loadResumeSnapshot: async () => ({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
         latestSeq: 0,
-        latestRowVersion: 1,
+        latestRowVersion: 0,
         resetEpoch: 0,
-      }
-      await persistenceCapability?.resumeSnapshot.certify()
-      expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence()).toEqual(
-        {
-          status: `consistent`,
-        },
-      )
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`invalidates resume evidence when storage advances outside the owned commit generation`, async () => {
-    const adapter = createRecordingAdapter()
-    let durableGeneration = {
-      latestTerm: 0,
-      latestSeq: 0,
-      latestRowVersion: 0,
-      resetEpoch: 0,
+      }),
+      applyCommittedTx: async () => {},
+      ensureIndex: async () => {},
     }
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => ({
-      ...(await loadResumeSnapshot(...args)),
-      ...durableGeneration,
-    })
-    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-    adapter.applyCommittedTx = async (collectionId, tx) => {
-      await applyCommittedTx(collectionId, tx)
-      durableGeneration = {
-        latestTerm: tx.term,
-        latestSeq: tx.seq,
-        latestRowVersion: Math.max(
-          durableGeneration.latestRowVersion + 1,
-          tx.rowVersion,
-        ),
-        resetEpoch: durableGeneration.resetEpoch,
-      }
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `follower-node`,
+      subscribe: (id, onMessage) => {
+        subscribers.set(id, onMessage)
+        return () => {
+          if (subscribers.get(id) === onMessage) subscribers.delete(id)
+        }
+      },
+      publish: () => {},
+      isLeader: () => false,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      // The elected owner loads its upstream and commits it into the
+      // requested generation before it replies, on every ensure.
+      requestEnsureRemoteSubset: async (id, options) => {
+        ensures.push({ id, refetch: options.refetch === true })
+        if (upstream) ownerCommits(id, upstream)
+      },
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+      requestApplyCommittedTx: (_id, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+      pullSince: () =>
+        Promise.resolve({
+          type: `rpc:pullSince:res`,
+          rpcId: `follower-notice-pull`,
+          ok: true,
+          latestTerm: 1,
+          latestSeq: 0,
+          latestRowVersion: 0,
+          requiresFullReload: false,
+          changedKeys: [],
+          deletedKeys: [],
+        }),
     }
-
-    let remoteBegin: (() => void) | undefined
-    let remoteCommit: (() => true | Promise<void>) | undefined
-    let remoteMetadata:
-      Parameters<SyncConfig<Todo, string>[`sync`]>[0][`metadata`] | undefined
-    let persistenceCapability:
-      SyncMetadataApi<string>[`persistence`] | undefined
+    let source!: TodoSyncParams
     const collection = createCollection(
       persistedCollectionOptions<Todo, string>({
-        id: `generation-fence`,
+        id: `follower-generation-notice`,
         syncMode: `on-demand`,
-        getKey: (item) => item.id,
+        getKey: (row) => row.id,
         sync: {
-          sync: ({ begin, commit, markReady, metadata }) => {
-            remoteBegin = begin
-            remoteCommit = commit
-            remoteMetadata = metadata
-            persistenceCapability = metadata?.persistence
-            markReady()
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return {
+              loadSubset: async () => {},
+              restartAfterScopedRecovery: async (cacheRotated) => {
+                await cacheRotated
+              },
+            }
           },
         },
-        persistence: { adapter },
+        persistence: { adapter, coordinator },
       }),
     )
-
+    const demand: LoadSubsetOptions = { limit: 10 }
+    const publicRows = () =>
+      new Map(
+        Array.from(collection.state, ([key, row]) => [
+          String(key),
+          stripVirtualProps(row) as Todo,
+        ]),
+      )
+    // A checkpoint after the follower has processed every delivered notice:
+    // the scan crosses the same apply mutex the notices use.
+    const settled = async (label: string) => {
+      await flushAsyncWork()
+      await atPersistedOracleCheckpoint(
+        source.metadata!.persistence!.scanPersistedRows(),
+        label,
+      )
+      await flushAsyncWork()
+    }
+    const expectOwnerEvidence = (previous: ReadonlyMap<string, Todo>) => {
+      const expected = expectedScopedSnapshot(
+        previous,
+        durable.get(storageId)!,
+        new Map(),
+        true,
+      )
+      expectExactSnapshot(publicRows(), expected)
+      return expected
+    }
+    let hasPrimaryFailure = false
     try {
       collection.startSyncImmediate()
-      await vi.waitFor(() =>
-        expect(persistenceCapability).toMatchObject({
-          protocol: `@tanstack/db/sync-persistence`,
-          version: 1,
-        }),
+      await collection.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(collection._sync.loadSubset(demand)),
+        `follower demand settled`,
       )
+      await settled(`first-ready notices processed`)
+      let visible = expectOwnerEvidence(new Map())
 
-      // This is not a supported writer path. It models storage advancing
-      // without the runtime observing the generation that now precedes its
-      // commit. The exact-generation fence must reject that uncertainty.
-      durableGeneration.latestRowVersion = 5
+      const persistence = source.metadata?.persistence
+      if (!persistence?.startScopedRecovery) {
+        throw new Error(`Expected scoped recovery capability`)
+      }
+      let rotation: Promise<void>
+      if (readFailsAsRotationStarts) {
+        let reject!: (error: unknown) => void
+        const promise = new Promise<void>((_resolve, rejectRead) => {
+          reject = rejectRead
+        })
+        void promise.catch(() => undefined)
+        holdNextRead = { promise, reject }
+        ownerCommits(oldStorageId, {
+          id: `remote`,
+          title: `Pre-rotation update`,
+        })
+        await flushAsyncWork()
+        rotation = persistence.startScopedRecovery()
+        reject(readFailure)
+      } else {
+        rotation = persistence.startScopedRecovery()
+      }
+      await atPersistedOracleCheckpoint(
+        rotation,
+        `follower cache rotation settled`,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() =>
+          expect(ensures.map(({ id }) => id)).toContain(newStorageId),
+        ),
+        `reacquisition reached the owner`,
+      )
+      await settled(`reacquisition notices processed`)
+      // Answering the owner's notice with another refetch would make the
+      // owner commit again, and the follower would refetch forever.
+      expect.soft(ensures).toHaveLength(2)
+      visible = expectOwnerEvidence(visible)
 
-      remoteBegin?.()
-      persistenceCapability?.resumeSnapshot.expectCurrentCommit()
-      remoteMetadata?.collection.set(`cursor`, `next`)
-      const applied = remoteCommit?.()
-      if (applied !== true) await applied
+      if (later === `owner`) {
+        upstream = v2
+        failNextRead = ownerRead === `fails`
+        ownerCommits(newStorageId, v2)
+        if (ownerRead === `fails`) {
+          // Not settled(): a terminal runtime rejects the checkpoint scan.
+          await flushAsyncWork()
+          await vi.waitFor(() => expect(collection.status).toBe(`crashed`))
+          expectExactSnapshot(publicRows(), visible)
+        } else {
+          await settled(`owner update processed`)
+          expectOwnerEvidence(visible)
+        }
+      } else if (later === `peer`) {
+        // A peer's notice after recovery is an ordinary invalidation: the
+        // follower rereads durable rows, which the peer did not change, so
+        // its rows stay as they were and it sends no other ensure.
+        notify(newStorageId, { id: `remote`, title: `Peer claim` }, `peer-node`)
+        await settled(`peer notice processed`)
+        expectOwnerEvidence(visible)
+      }
 
-      await persistenceCapability?.resumeSnapshot.certify()
-      expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence()).toEqual(
-        { status: `incompatible` },
-      )
+      expect(ensures).toEqual([
+        { id: oldStorageId, refetch: false },
+        { id: newStorageId, refetch: true },
+      ])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
     } finally {
-      await collection.cleanup()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
     }
-  })
+  }
 
-  it(`ignores late wrapped sync writes after cleanup`, async () => {
-    let lateWrite!: (message: { type: `insert`; value: Todo }) => void
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `late-write-after-cleanup`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ write, markReady }) => {
-            lateWrite = (message) => write(message)
-            markReady()
-          },
-        },
-        persistence: { adapter: createNoopAdapter() },
-      }),
-    )
+  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
+  // the owner's rows in the new generation never become visible.
+  it.fails.each([
+    { ownerCommit: `before-rotation`, later: `none` },
+    { ownerCommit: `after-rotation`, later: `none` },
+    { ownerCommit: `after-rotation`, later: `owner` },
+    { ownerCommit: `before-rotation`, later: `peer` },
+  ] as const)(
+    `publishes an elected owner's rows to a follower after rotation: commit $ownerCommit, later $later`,
+    (history) =>
+      assertFollowerGenerationNoticeHistory({ ...history, ownerRead: `ok` }),
+  )
 
-    await collection.preload()
-    await collection.cleanup()
+  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
+  // the owner's rows in the new generation never become visible.
+  it.fails.each(
+    ([`gap`, `reconciliation`] as const).flatMap((noticeShape) =>
+      ([`before-rotation`, `after-rotation`] as const).flatMap((ownerCommit) =>
+        ([`none`, `owner`] as const).map((later) => ({
+          ownerCommit,
+          later,
+          noticeShape,
+        })),
+      ),
+    ),
+  )(
+    `publishes an elected owner's rows after rotation when its notice is a $noticeShape: commit $ownerCommit, later $later`,
+    (history) =>
+      assertFollowerGenerationNoticeHistory({ ...history, ownerRead: `ok` }),
+  )
 
-    expect(() =>
-      lateWrite({
-        type: `insert`,
-        value: { id: `late`, title: `Late` },
-      }),
-    ).not.toThrow()
-    expect(collection.has(`late`)).toBe(false)
-  })
+  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
+  // the owner's rows in the new generation never become visible.
+  it.fails.each([
+    { ownerCommit: `before-rotation`, later: `owner` },
+    { ownerCommit: `after-rotation`, later: `owner` },
+  ] as const)(
+    `fails a follower when its elected owner's update cannot be read after rotation: commit $ownerCommit`,
+    (history) =>
+      assertFollowerGenerationNoticeHistory({ ...history, ownerRead: `fails` }),
+  )
 
-  it(`keeps retired sync controls inert after cleanup and restart`, async () => {
-    const adapter = createRecordingAdapter()
-    const runs: Array<TodoSyncParams> = []
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `retired-controls-after-restart`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: (params) => {
-            runs.push(params)
-            params.markReady()
-          },
-        },
-        persistence: { adapter },
+  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
+  // the owner's rows in the new generation never become visible.
+  it.fails(
+    `ignores a follower read failure when rotation starts while the read is in flight`,
+    () =>
+      assertFollowerGenerationNoticeHistory({
+        ownerCommit: `before-rotation`,
+        later: `none`,
+        ownerRead: `ok`,
+        readFailsAsRotationStarts: true,
       }),
-    )
-
-    try {
-      await collection.preload()
-      expect(runs).toHaveLength(1)
-      const retired = runs[0]!
+  )
 
-      await collection.cleanup()
-      const replacementReady = createEventGate()
-      const unsubscribe = collection.on(`status:ready`, () =>
-        replacementReady.resolve(),
-      )
-      collection.startSyncImmediate()
-      await atPersistedOracleCheckpoint(
-        replacementReady.promise,
-        `replacement controls ready`,
-      )
-      unsubscribe()
-      expect(runs).toHaveLength(2)
+  const followerGenerationNoticeHistory = fc.record({
+    ownerCommit: fc.constantFrom<
+      FollowerGenerationNoticeHistory[`ownerCommit`]
+    >(`before-rotation`, `after-rotation`),
+    later: fc.constantFrom<FollowerGenerationNoticeHistory[`later`]>(
+      `none`,
+      `owner`,
+      `peer`,
+    ),
+    ownerRead: fc.constantFrom<FollowerGenerationNoticeHistory[`ownerRead`]>(
+      `ok`,
+      `fails`,
+    ),
+  })
+  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
+  // the owner's rows in the new generation never become visible. Some
+  // generated histories pass today, so a random draw cannot be pinned as
+  // failing; this fixed seed pins the gap. The fix for #2139 adds the random
+  // and replayed campaign back.
+  it.fails(
+    `checks generated follower generation-notice histories (fixed)`,
+    () =>
+      fc.assert(
+        fc.asyncProperty(
+          followerGenerationNoticeHistory,
+          assertFollowerGenerationNoticeHistory,
+        ),
+        { seed: 2128, numRuns: oracleRuns(12) },
+      ),
+  )
 
-      retired.begin()
-      retired.write({
-        type: `insert`,
-        value: { id: `retired`, title: `must stay retired` },
-      })
-      const retiredReceipt = retired.commit()
-      if (retiredReceipt !== true) await retiredReceipt
+  const expectedFollowerRemoteDemand = (
+    history: FollowerRemoteDemandHistory,
+  ) => {
+    const applied = history.apply === `ok`
+    return {
+      // While the owner's commit has not applied here, nothing has settled.
+      whileApplyHeld: { settled: false, rows: undefined },
+      settled:
+        history.consumer === `live-query`
+          ? applied
+            ? { outcome: `fulfilled`, rows: [`remote`], status: `ready` }
+            : { outcome: `rejected`, rows: undefined, status: `crashed` }
+          : applied
+            ? {
+                outcome: `fulfilled`,
+                rows: [`remote`],
+                status: undefined,
+                releases: 0,
+              }
+            : {
+                outcome: `rejected`,
+                rows: undefined,
+                status: `crashed`,
+                releases: 1,
+              },
+    }
+  }
 
-      const replacement = runs[1]!
-      replacement.begin()
-      replacement.write({
-        type: `insert`,
-        value: { id: `replacement`, title: `new controls own this row` },
-      })
-      const replacementReceipt = replacement.commit()
-      if (replacementReceipt !== true) await replacementReceipt
+  const assertFollowerRemoteDemandHistory = async (
+    history: FollowerRemoteDemandHistory,
+  ) => {
+    const expected = expectedFollowerRemoteDemand(history)
+    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const tab = createFollowerTab(history)
+    const groupQuery = (group: string) =>
+      createLiveQueryCollection((q) =>
+        q.from({ row: tab.source }).where(({ row }) => eq(row.group, group)),
+      )
+    const query = groupQuery(`a`)
+    const other = groupQuery(`b`)
+    try {
+      // The consumer's observation: its outcome, and the demanded rows it
+      // sees when it settles.
+      const seen: {
+        outcome: `pending` | `fulfilled` | `rejected`
+        rows?: Array<string>
+      } = { outcome: `pending` }
+      const demandedRows = () =>
+        Array.from(tab.source.values())
+          .filter((row) => row.group === `a`)
+          .map((row) => row.id)
+          .sort()
+      let settled: Promise<unknown>
+      if (history.consumer === `live-query`) {
+        query.onFirstReady(() => {
+          seen.rows = query.toArray.map((row) => (row as FollowerRow).id).sort()
+        })
+        settled = query.preload().then(
+          () => (seen.outcome = `fulfilled`),
+          () => (seen.outcome = `rejected`),
+        )
+      } else {
+        settled = Promise.resolve(
+          tab.source._sync.loadSubset({
+            where: new IR.Func(`eq`, [
+              new IR.PropRef([`group`]),
+              new IR.Value(`a`),
+            ]),
+          }),
+        ).then(
+          () => {
+            seen.outcome = `fulfilled`
+            seen.rows = demandedRows()
+          },
+          () => (seen.outcome = `rejected`),
+        )
+      }
+      if (history.placement === `queued`) void other.preload().catch(() => {})
 
-      // A retained capability from the cleaned-up run must not truncate the
-      // new Collection, even when invoked after the replacement row applies.
-      await retired.metadata!.persistence!.startScopedRecovery!()
+      if (history.placement === `queued`) {
+        // The owner's broadcast arrives while this hydration holds the apply
+        // mutex, so it waits in the queue until the hydration ends.
+        await within(tab.otherHydrationStarted)
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        tab.releaseOtherHydration()
+      }
+      const applyStarted = await within(tab.applyReadStarted)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      // Checkpoint: the owner has replied, but its row has not applied here.
+      expect({
+        applyStarted,
+        settled: seen.outcome !== `pending`,
+        rows: seen.rows,
+      }).toEqual({ applyStarted: true, ...expected.whileApplyHeld })
 
+      tab.releaseApply()
+      await within(settled)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      // Checkpoint: the apply settled.
+      const releasesAtSettle = tab.releases()
       expect({
-        retiredPublic: collection.get(`retired`),
-        retiredDurable: adapter.rows.get(`retired`),
-        replacementPublic: stripVirtualProps(collection.get(`replacement`)),
-        replacementDurable: adapter.rows.get(`replacement`),
-        status: collection.status,
-        publicError: collection._lifecycle.getSyncError(),
+        outcome: seen.outcome,
+        rows: seen.rows,
+        ...(`releases` in expected.settled
+          ? { releases: releasesAtSettle }
+          : {}),
+        status:
+          expected.settled.status === undefined
+            ? undefined
+            : history.consumer === `live-query` &&
+                expected.settled.status === `ready`
+              ? query.status
+              : expected.settled.status === `crashed`
+                ? history.consumer === `live-query`
+                  ? `${query.status}/${tab.source.status}`
+                  : tab.source.status
+                : tab.source.status,
       }).toEqual({
-        retiredPublic: undefined,
-        retiredDurable: undefined,
-        replacementPublic: {
-          id: `replacement`,
-          title: `new controls own this row`,
-        },
-        replacementDurable: {
-          id: `replacement`,
-          title: `new controls own this row`,
-        },
-        status: `ready`,
-        publicError: undefined,
-      })
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  // Focused collection-reset refinement: metadata and rows must come from one
-  // hydration scope. The adapter makes an interleaved v2 write possible only
-  // outside that scope, so the public v1 metadata and row are the independent
-  // coherence checkpoint. This fixed history does not model arbitrary resets.
-  it(`rebases a managed reset from its claimed physical storage`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const physicalId = `managed-reset-physical`
-    const claimId = `managed-reset-claim`
-    const reads: Array<PersistedStorageTarget> = []
-    const load = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = (target, context) => {
-      reads.push(target)
-      return load(target, context)
-    }
-    adapter.claimCacheGeneration = async () => ({
-      storageCollectionId: physicalId,
-      claimId,
-      expiresAtMs: Date.now() + 60_000,
-    })
-    adapter.rotateCacheGeneration = async () => ({
-      storageCollectionId: physicalId,
-      claimId,
-      expiresAtMs: Date.now() + 60_000,
-    })
-    adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
-    adapter.releaseCacheGenerationClaim = async () => {}
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `managed-reset-logical`,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              restartAfterScopedRecovery: () => {},
-              loadSubset: async () => {},
-            }
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      const before = reads.length
-      coordinator.emit(
-        { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
-        `peer`,
-        physicalId,
-      )
-      await vi.waitFor(() => expect(reads.length).toBeGreaterThan(before))
-      expect(reads.slice(before)).toContainEqual({
-        kind: `managed`,
-        storageCollectionId: physicalId,
-        claimId,
-      })
-      expect(reads.slice(before)).not.toContainEqual({
-        kind: `eager`,
-        collectionId: `managed-reset-logical`,
+        outcome: expected.settled.outcome,
+        rows: expected.settled.rows,
+        ...(`releases` in expected.settled
+          ? { releases: expected.settled.releases }
+          : {}),
+        status:
+          expected.settled.status === `crashed` &&
+          history.consumer === `live-query`
+            ? `crashed/crashed`
+            : expected.settled.status,
       })
     } finally {
-      await collection.cleanup()
+      await query.cleanup()
+      await other.cleanup()
+      await tab.source.cleanup()
+      errors.mockRestore()
+      warnings.mockRestore()
     }
-  })
-
-  it(`keeps a collection-reset reload inside one hydration scope`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial row` }])
-    adapter.collectionMetadata.set(`snapshot`, `initial`)
-    const coordinator = createCoordinatorHarness()
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    let inHydrationScope = false
-    let interleaveArmed = false
-    let interleaveRan = false
+  }
 
-    const runInterleavedWrite = () => {
-      interleaveRan = true
-      adapter.collectionMetadata.set(`snapshot`, `v2`)
-      adapter.rows.set(`1`, { id: `1`, title: `v2 row` })
-    }
+  const followerRemoteDemandHistories: Array<FollowerRemoteDemandHistory> = (
+    [`direct`, `queued`, `rotated`, `expired`] as const
+  ).flatMap((placement) =>
+    ([`ok`, `fails`] as const).flatMap((apply) =>
+      ([`live-query`, `load`] as const).map((consumer) => ({
+        placement,
+        apply,
+        consumer,
+      })),
+    ),
+  )
+  it.each(
+    followerRemoteDemandHistories.filter(
+      ({ placement }) => placement !== `rotated`,
+    ),
+  )(
+    `settles a follower's remote demand with the owner's applied rows: $placement broadcast, apply $apply, $consumer`,
+    assertFollowerRemoteDemandHistory,
+  )
+  // Known gap: see #2139. A rotated follower stays in scoped recovery, so
+  // the owner's rows in the new generation never become visible.
+  it.fails.each(
+    followerRemoteDemandHistories.filter(
+      ({ placement }) => placement === `rotated`,
+    ),
+  )(
+    `settles a follower's remote demand with the owner's applied rows: $placement broadcast, apply $apply, $consumer`,
+    assertFollowerRemoteDemandHistory,
+  )
 
-    adapter.loadSubset = async (...args) => {
-      if (interleaveArmed && !inHydrationScope && !interleaveRan) {
-        runInterleavedWrite()
-      }
-      return loadSubset(...args)
-    }
-    adapter.runInHydrationScope = async (task) => {
-      inHydrationScope = true
-      try {
-        return await task(adapter)
-      } finally {
-        inHydrationScope = false
-        if (interleaveArmed && !interleaveRan) runInterleavedWrite()
-      }
+  // Scoped recovery means durable rows cannot replace source rows. Owner
+  // evidence is an exception only in a rotated generation, which holds
+  // nothing but the owner's writes. Without a managed generation the old
+  // durable cache stays in place, so the model predicts that an owner notice
+  // during that recovery republishes none of the untrusted durable rows.
+  /**
+   * After a cache rotation, a follower reacquires every active demand into
+   * the new generation through the owner. The owner commits each demand's
+   * rows into that generation and broadcasts them before it replies, so the
+   * follower holds those notices. Scoped recovery may end only once every
+   * reacquisition has succeeded: before that, the new generation is still
+   * incomplete and its durable rows have no authority. Starting scoped
+   * recovery withdraws the old generation's rows.
+   *
+   * The independent model knows each demand's row version per generation:
+   * the owner wrote version 1 into the old generation and writes version 2
+   * into the new one when it reacquires the demand. Until every
+   * reacquisition has settled, neither demand shows a row. If all succeed,
+   * both show the new generation's rows, including an owner update that
+   * arrived while the reacquisitions were settling. If any fails, the
+   * follower stays in scoped recovery, shows no row from the incomplete
+   * generation, and the source reports the failure as soon as that
+   * reacquisition settles. A reacquisition is a remote request, so the
+   * failure is the ready source's failure reason (`reportError()`: the source
+   * keeps syncing), never a crash; a crash is only for local storage or an
+   * internal invariant (glossary "crash"; maintainer decision for PR #2168).
+   *
+   * A demand that the caller releases or aborts while it reacquires no longer
+   * needs the new generation's rows: its aborted ensure is neither a failure
+   * nor a reported error, and the other demands decide the outcome. Releasing
+   * it twice changes nothing. A load that fails on its own still counts as a
+   * failure even though the failed load gives up its demand.
+   *
+   * A new demand loaded while the reacquisitions are in flight settles only
+   * once they all have: with the rows of the new generation if recovery
+   * ended, or rejected if it did not. Its own ensure answering early does not
+   * make its held rows visible.
+   *
+   * Only a recovery that rotated can end this way. A recovery that keeps the
+   * old generation, or one in which this node is the leader, leaves scoped
+   * recovery in place, and a newer rotation supersedes an older one's
+   * reacquisition.
+   *
+   * Known gap (#2139): production does not yet end scoped recovery after a
+   * rotation, so the histories in which recovery should end, or in which a
+   * new demand waits for it, are pinned as failing.
+   *
+   * Limits. A failed reacquisition is not retried; the follower stays in
+   * scoped recovery until a later recovery rotates again.
+   *
+   * The grammar crosses the order in which two demands' reacquisitions
+   * settle, whether the owner updates demand a's row (version 3) between
+   * the first and last settlement, which reacquisitions fail or are released,
+   * and whether a new demand loads during reacquisition. Separate cells start
+   * rotation from two reads that find the claim lost, supersede reacquisition
+   * by a rotation as leader, and recover without rotating. The driver
+   * observes the rows, the new load's outcome, and the source status after
+   * every settlement, plus the ensure count, which a refetch loop would
+   * exceed.
+   */
+  type RotatedReacquisitionHistory = {
+    order: [`a`, `b`] | [`b`, `a`]
+    noticeBetween: boolean
+    // Which reacquisitions fail. `released` means demand b is released
+    // while it reacquires, so its ensure aborts; that is not a failure.
+    fails: `none` | `a` | `b` | `both` | `released`
+    // A new demand, c, loads while the reacquisitions are in flight.
+    newDemand?: boolean
+    // While reacquisition is in flight, the node is elected leader and a
+    // second rotation supersedes the first; it then follows again, and a new
+    // demand c loads. With nothing reacquiring, the node stays in scoped
+    // recovery: held notices must still be handled, not queued forever.
+    supersededAsLeader?: boolean
+    // How rotation starts: the source asks for scoped recovery after both
+    // demands loaded, or both demands' first reads are in flight when the
+    // cache claim is found lost.
+    trigger?: `source` | `claim-lost-during-reads`
+  }
+  type VersionedRow = { id: string; group: string; v: number }
+  type ReacquisitionObservation = {
+    rows: Record<`a` | `b` | `c`, number | undefined>
+    // The new demand's load, when the history has one.
+    newLoad?: `pending` | `fulfilled` | `rejected`
+    // `retrying`: ready, with a failure reason.
+    status: `crashed` | `retrying` | `healthy`
+  }
+  const expectedReacquisition = (
+    history: RotatedReacquisitionHistory,
+    settled: number,
+  ): ReacquisitionObservation => {
+    const fails = (group: `a` | `b`) =>
+      history.fails === group || history.fails === `both`
+    const allSettled = settled === 2
+    const ended = allSettled && !fails(`a`) && !fails(`b`)
+    // A failed reacquisition is reported when it settles, and the next
+    // remote request that succeeds clears it (maintainer decision: a coarse
+    // clear). A released demand's aborted ensure is neither.
+    let failed = false
+    for (const group of history.order.slice(0, settled))
+      if (fails(group)) failed = true
+      else if (!(group === `b` && history.fails === `released`)) failed = false
+    return {
+      rows: ended
+        ? {
+            a: history.noticeBetween ? 3 : 2,
+            // A released demand's held notice still applies once recovery
+            // ends; the new generation's rows are trusted then.
+            b: 2,
+            c: history.newDemand ? 2 : undefined,
+          }
+        : { a: undefined, b: undefined, c: undefined },
+      ...(history.newDemand
+        ? {
+            newLoad: !allSettled
+              ? (`pending` as const)
+              : ended
+                ? (`fulfilled` as const)
+                : (`rejected` as const),
+          }
+        : {}),
+      status: failed ? `retrying` : `healthy`,
     }
+  }
 
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    await collection.preload()
-    adapter.collectionMetadata.set(`snapshot`, `v1`)
-    adapter.rows.set(`1`, { id: `1`, title: `v1 row` })
-    interleaveArmed = true
-
-    coordinator.emit({
-      type: `collection:reset`,
-      schemaVersion: 1,
-      resetEpoch: 1,
-    })
-
-    await vi.waitFor(() => expect(interleaveRan).toBe(true))
-    expect(collection._state.syncedCollectionMetadata.get(`snapshot`)).toBe(
-      `v1`,
-    )
-    expect(collection.get(`1`)?.title).toBe(`v1 row`)
-    await collection.cleanup()
+  // Each model predicts the observation from the authored history alone: the
+  // follower's settled outcome and rows, and the rotated generation's rows,
+  // load status, and error state after the given number of settlements.
+  declareOracle({
+    model: [expectedFollowerRemoteDemand, expectedReacquisition],
   })
 
-  // A remote commit queued during startup must run after the local hydration
-  // scope releases the shared driver. A reset racing an unscheduled startup
-  // baseline may publish before or after that baseline, but must own the final
-  // public snapshot and may never be overwritten by an older baseline.
-  it(`does not let an unscheduled startup baseline overwrite a newer collection reset`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `old` }])
-    const coordinator = createCoordinatorHarness()
-    const baselineEntered = createEventGate()
-    const releaseBaseline = createEventGate()
-    const resetReloadEntered = createEventGate()
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    let heldBaseline = false
-    adapter.loadResumeSnapshot = async (...args) => {
-      const snapshot = await loadResumeSnapshot(...args)
-      if (args[1]?.includeRows && !heldBaseline) {
-        heldBaseline = true
-        baselineEntered.resolve()
-        await releaseBaseline.promise
+  const assertRotatedReacquisition = async (
+    history: RotatedReacquisitionHistory,
+  ) => {
+    const errors = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const oldStorageId = `reacquire-old`
+    const newStorageId = `reacquire-new`
+    const durable = new Map<string, Map<string, VersionedRow>>([
+      [oldStorageId, new Map()],
+      [newStorageId, new Map()],
+    ])
+    let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+    const seqs = new Map<string, number>()
+    const ownerCommits = (storageId: string, row: VersionedRow) => {
+      const seq = (seqs.get(storageId) ?? 0) + 1
+      seqs.set(storageId, seq)
+      durable.get(storageId)!.set(row.id, row)
+      const payload: TxCommitted = {
+        type: `tx:committed`,
+        term: 1,
+        seq,
+        txId: `owner-${storageId}-${seq}`,
+        latestRowVersion: seq,
+        requiresFullReload: false,
+        changedRows: [{ key: row.id, value: row }],
+        deletedKeys: [],
       }
-      return snapshot
+      subscriber?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId: storageId,
+        senderId: `owner`,
+        ts: Date.now(),
+        payload,
+      })
     }
-    adapter.loadSubset = (...args) => {
-      resetReloadEntered.resolve()
-      return loadSubset(...args)
+    type Reply = {
+      resolve: () => void
+      reject: (error: unknown) => void
     }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: { sync: ({ markReady }) => markReady() },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    const preload = collection.preload()
-    void preload.catch(() => undefined)
-    const publishedTitles: Array<string | undefined> = []
-    const subscription = collection.subscribeChanges(
-      () => publishedTitles.push(collection.get(`1`)?.title),
-      { includeInitialState: false },
-    )
-
-    try {
-      await atPersistedOracleCheckpoint(
-        baselineEntered.promise,
-        `unscheduled baseline entered`,
-      )
-      adapter.rows.set(`1`, { id: `1`, title: `new` })
-      coordinator.emit({
-        type: `collection:reset`,
-        schemaVersion: 1,
-        resetEpoch: 1,
-      })
-      // Give a concurrent reset its event-loop turn. Serialization may instead
-      // hold it behind the baseline; both orders must converge without a
-      // public new -> old reversion.
-      await flushAsyncWork()
-      expect([undefined, `new`]).toContain(collection.get(`1`)?.title)
-      releaseBaseline.resolve()
-      await atPersistedOracleCheckpoint(preload, `startup after reset`)
-      await atPersistedOracleCheckpoint(
-        resetReloadEntered.promise,
-        `reset reload after startup`,
-      )
-      await vi.waitFor(() => expect(collection.get(`1`)?.title).toBe(`new`))
-      const firstNew = publishedTitles.indexOf(`new`)
-      expect(firstNew).toBeGreaterThanOrEqual(0)
-      expect(publishedTitles.slice(firstNew)).not.toContain(`old`)
-    } finally {
-      releaseBaseline.resolve()
-      await preload.catch(() => undefined)
-      subscription.unsubscribe()
-      await collection.cleanup()
+    const replies = new Map<string, Reply>()
+    let ensures = 0
+    let cEnsures = 0
+    const groupOf = (options: LoadSubsetOptions) => {
+      const where = options.where as IR.Func | undefined
+      const value = where?.args[1] as IR.Value | undefined
+      return value?.value as `a` | `b` | `c` | undefined
     }
-  })
-
-  it.each([`contiguous-reload`, `sequence-gap`] as const)(
-    `finishes queued %s after scheduled startup hydration releases its scope`,
-    async (route) => {
-      const adapter = createRecordingAdapter([{ id: `1`, title: `old` }])
-      const coordinator = createCoordinatorHarness()
-      const baselineEntered = createEventGate()
-      const releaseBaseline = createEventGate()
-      const nestedScopeRequested = createEventGate()
-      const queuedScopes: Array<() => void> = []
-      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-      let heldBaseline = false
-      let scopeActive = false
-
-      adapter.loadResumeSnapshot = async (...args) => {
-        const snapshot = await loadResumeSnapshot(...args)
-        if (args[1]?.includeRows && !heldBaseline) {
-          heldBaseline = true
-          baselineEntered.resolve()
-          await releaseBaseline.promise
+    const duringReads = history.trigger === `claim-lost-during-reads`
+    const firstReads = createDeferred()
+    let reads = 0
+    let claimLost = false
+    const adapter = {
+      loadSubset: async (
+        target: PersistedStorageTarget,
+      ): Promise<Array<{ key: string; value: VersionedRow }>> => {
+        if (duringReads && ++reads <= 2) {
+          await firstReads.promise
+          claimLost = true
         }
-        return snapshot
-      }
-
-      const scopedAdapter: RecordingAdapter = { ...adapter }
-      scopedAdapter.runInHydrationScope = (task) => task(scopedAdapter)
-      adapter.runInHydrationScope = (task) => {
-        if (scopeActive) {
-          nestedScopeRequested.resolve()
-          return new Promise((resolve, reject) => {
-            queuedScopes.push(() => {
-              void task(scopedAdapter).then(resolve, reject)
-            })
-          })
+        return Array.from(
+          durable.get(recordedStorageId(target))!.values(),
+          (value) => ({ key: value.id, value: { ...value } }),
+        )
+      },
+      claimCacheGeneration: async () => ({
+        storageCollectionId: oldStorageId,
+        claimId: `reacquire-claim`,
+        expiresAtMs: Date.now() + 60_000,
+      }),
+      renewCacheGenerationClaim: async () =>
+        claimLost ? undefined : Date.now() + 60_000,
+      rotateCacheGeneration: async () => {
+        claimLost = false
+        return {
+          storageCollectionId: newStorageId,
+          claimId: `reacquire-claim-2`,
+          expiresAtMs: Date.now() + 60_000,
         }
-        scopeActive = true
-        return Promise.resolve()
-          .then(() => task(scopedAdapter))
-          .finally(() => {
-            scopeActive = false
-            while (queuedScopes.length > 0) queuedScopes.shift()?.()
-          })
-      }
-
-      if (route === `sequence-gap`) {
-        coordinator.setPullSinceResponse({
-          type: `rpc:pullSince:res`,
-          rpcId: `review-gap`,
-          ok: true,
-          latestTerm: 1,
-          latestSeq: 2,
-          latestRowVersion: 2,
-          requiresFullReload: true,
-        })
-      }
-      const pullSince = coordinator.pullSince!.bind(coordinator)
-      let coordinatorEnteredDuringScope: boolean | undefined
-      coordinator.pullSince = (...args) => {
-        coordinatorEnteredDuringScope = scopeActive
-        return pullSince(...args)
-      }
-
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `sync-present`,
-          getKey: (item) => item.id,
-          sync: { sync: ({ markReady }) => markReady() },
-          persistence: { adapter, coordinator },
+      },
+      releaseCacheGenerationClaim: async () => {},
+      loadResumeSnapshot: () =>
+        Promise.resolve({
+          rows: [],
+          keySet: { status: `consistent` },
+          collectionMetadata: [],
+          latestTerm: 0,
+          latestSeq: 0,
+          latestRowVersion: 0,
+          resetEpoch: 0,
         }),
-      )
-      const preload = collection.preload()
-      void preload.catch(() => undefined)
-
-      try {
-        await atPersistedOracleCheckpoint(
-          baselineEntered.promise,
-          `${route} baseline entered`,
-        )
-        adapter.rows.set(`1`, { id: `1`, title: `new` })
-        const committed: TxCommitted =
-          route === `sequence-gap`
-            ? {
-                type: `tx:committed`,
-                term: 1,
-                seq: 2,
-                txId: `review-sequence-gap`,
-                latestRowVersion: 2,
-                requiresFullReload: false,
-                changedRows: [],
-                deletedKeys: [],
-              }
-            : {
-                type: `tx:committed`,
-                term: 1,
-                seq: 1,
-                txId: `review-contiguous-reload`,
-                latestRowVersion: 1,
-                requiresFullReload: true,
-              }
-        coordinator.emit(committed)
-        releaseBaseline.resolve()
-        const first = await atPersistedOracleCheckpoint(
-          Promise.race([
-            preload.then(() => `startup-settled` as const),
-            nestedScopeRequested.promise.then(() => `nested-scope` as const),
-          ]),
-          `${route} startup or nested scope`,
-        )
-        expect(first).toBe(`startup-settled`)
-        expect(collection.get(`1`)?.title).toBe(`new`)
-        if (route === `sequence-gap`) {
-          expect(coordinator.pullSinceCalls).toBe(1)
-          expect(coordinatorEnteredDuringScope).toBe(false)
+      applyCommittedTx: async () => {},
+      ensureIndex: async () => {},
+    } as unknown as PersistenceAdapter
+    let leader = false
+    const coordinator = {
+      getNodeId: () => `follower`,
+      subscribe: (
+        _collectionId: string,
+        onMessage: (message: ProtocolEnvelope<unknown>) => void,
+      ) => {
+        subscriber = onMessage
+        return () => {
+          subscriber = undefined
         }
-      } finally {
-        releaseBaseline.resolve()
-        while (queuedScopes.length > 0) queuedScopes.shift()?.()
-        await preload.catch(() => undefined)
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // Focused receipt-ownership refinements. A source receipt created by the
-  // hydration operation belongs to its waiter even if it rejects before the
-  // waiter snapshots; a receipt created after hydration work returns does not.
-  // The public load result and exact rejection identity distinguish those two
-  // boundaries without treating every pending source receipt as related.
-  it(`propagates an operation-owned receipt rejection that settles before the hydration waiter snapshots`, async () => {
-    const adapter = createRecordingAdapter()
-    const hydrateLoadEntered = createDeferred()
-    const allowHydrateLoad = createDeferred()
-    let gateHydrationLoad = true
-    adapter.loadSubset = async () => {
-      if (gateHydrationLoad) {
-        gateHydrationLoad = false
-        hydrateLoadEntered.resolve()
-        await allowHydrateLoad.promise
-      }
-      return []
-    }
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-settled-receipt-boundary`,
-        getKey: (item) => item.id,
+      },
+      publish: () => {},
+      isLeader: () => leader,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      // The owner commits the demand's row into the requesting generation
+      // and broadcasts it before it replies. In the new generation the
+      // driver releases the reply; a later refetch finds nothing new.
+      requestEnsureRemoteSubset: (
+        storageId: string,
+        options: LoadSubsetOptions,
+      ) => {
+        ensures++
+        const group = groupOf(options)
+        if (!group) return Promise.resolve()
+        if (storageId === oldStorageId) {
+          ownerCommits(oldStorageId, { id: `${group}-row`, group, v: 1 })
+          return Promise.resolve()
+        }
+        if (group === `c`) cEnsures++
+        if (replies.has(group) || (group === `c` && cEnsures > 1))
+          return Promise.resolve()
+        ownerCommits(newStorageId, { id: `${group}-row`, group, v: 2 })
+        // The new demand's ensure answers at once; the follower must still
+        // hold its rows until reacquisition ends.
+        if (group === `c`) return Promise.resolve()
+        return new Promise<void>((resolve, reject) => {
+          replies.set(group, { resolve, reject })
+        })
+      },
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+      requestApplyCommittedTx: (_collectionId: string, tx: TxCommitted) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.seq,
+        }),
+      pullSince: (storageId: string) =>
+        Promise.resolve({
+          type: `rpc:pullSince:res`,
+          rpcId: `reacquire-pull`,
+          ok: true,
+          latestTerm: 1,
+          latestSeq: seqs.get(storageId) ?? 0,
+          latestRowVersion: seqs.get(storageId) ?? 0,
+          requiresFullReload: true,
+          changedKeys: [],
+          deletedKeys: [],
+        }),
+    } as unknown as PersistedCollectionCoordinator
+    let sourceParams: SyncConfig<VersionedRow, string>[`sync`] extends (
+      params: infer P,
+    ) => unknown
+      ? P
+      : never
+    const source = createCollection(
+      persistedCollectionOptions<VersionedRow, string>({
+        id: `follower-reacquire-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        persistence: { adapter, coordinator },
         syncMode: `on-demand`,
         sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-            return { loadSubset: () => true }
+          sync: (params) => {
+            sourceParams = params
+            // A ready source: only a ready Collection can carry the failed
+            // reacquisition as its failure reason.
+            params.markReady()
+            return {
+              loadSubset: () => Promise.resolve(),
+              restartAfterScopedRecovery: () => {},
+            }
           },
         },
-        persistence: { adapter },
       }),
     )
-    let load: Promise<unknown> | undefined
-    let receipt: Promise<void> | undefined
-    const abortController = new AbortController()
-
+    source.startSyncImmediate()
+    let newLoad: `pending` | `fulfilled` | `rejected` = `pending`
+    const observe = (): ReacquisitionObservation => ({
+      rows: {
+        a: source.get(`a-row`)?.v,
+        b: source.get(`b-row`)?.v,
+        c: source.get(`c-row`)?.v,
+      },
+      ...(history.newDemand ? { newLoad } : {}),
+      status:
+        source.status === `crashed`
+          ? `crashed`
+          : source.health.failureReason
+            ? `retrying`
+            : `healthy`,
+    })
+    const turn = () => new Promise((resolve) => setTimeout(resolve, 0))
+    const settle = async () => {
+      for (let i = 0; i < 8; i++) await turn()
+    }
+    const demand = (group: `a` | `b` | `c`): LoadSubsetOptions => ({
+      where: new IR.Func(`eq`, [
+        new IR.PropRef([`group`]),
+        new IR.Value(group),
+      ]),
+    })
+    const demands = { a: demand(`a`), b: demand(`b`), c: demand(`c`) }
+    const load = (group: `a` | `b` | `c`) =>
+      source._sync.loadSubset(demands[group])
     try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-      await hydrateLoadEntered.promise
-
-      let keyReads = 0
-      const establishingRow = {
-        get id() {
-          keyReads++
-          if (keyReads === 2) abortController.abort()
-          return `establishing`
-        },
-        title: `Abort during buffered replay`,
+      if (duringReads) {
+        // Both first reads are in flight when the claim is found lost.
+        void Promise.resolve(load(`a`)).catch(() => undefined)
+        void Promise.resolve(load(`b`)).catch(() => undefined)
+        await settle()
+        firstReads.resolve()
+      } else {
+        for (const group of [`a`, `b`] as const) await load(group)
+        await settle()
+        expect(observe().rows).toEqual({ a: 1, b: 1 })
+        void sourceParams!.metadata!.persistence!.startScopedRecovery!()
       }
-      remoteBegin?.()
-      remoteWrite?.({ type: `insert`, value: establishingRow })
-      const applied = remoteCommit?.(abortController.signal)
-      if (!(applied instanceof Promise)) {
-        throw new Error(`expected a buffered establishing receipt`)
+      await vi.waitFor(() => expect(replies.size).toBe(2), { timeout: 2_000 })
+      await settle()
+      if (history.newDemand) {
+        void Promise.resolve(load(`c`)).then(
+          () => (newLoad = `fulfilled`),
+          () => (newLoad = `rejected`),
+        )
       }
-      receipt = applied
-      void receipt.catch(() => undefined)
-
-      allowHydrateLoad.resolve()
-      const [loadResult, receiptResult] = await Promise.allSettled([
-        load,
-        receipt,
-      ])
-
-      expect(keyReads).toBeGreaterThanOrEqual(2)
-      expect(abortController.signal.aborted).toBe(true)
-      expect(receiptResult.status).toBe(`rejected`)
-      expect(loadResult.status).toBe(`rejected`)
-      if (
-        loadResult.status === `rejected` &&
-        receiptResult.status === `rejected`
-      ) {
-        expect(loadResult.reason).toBe(receiptResult.reason)
+      if (history.fails === `released`) {
+        // Releasing the same demand twice must be idempotent.
+        source._sync.unloadSubset(demands.b)
+        source._sync.unloadSubset(demands.b)
       }
-    } finally {
-      abortController.abort()
-      allowHydrateLoad.resolve()
-      await receipt?.catch(() => undefined)
-      await load?.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not adopt an unrelated source receipt created after hydration work returns`, async () => {
-    const adapter = createRecordingAdapter()
-    const mutationEntered = createDeferred()
-    const releaseMutation = createDeferred()
-    const unrelatedStarted = createDeferred<{
-      abortController: AbortController
-      receipt: Promise<void>
-    }>()
-    const trace: Array<string> = []
-    let probeActive = false
-    let remoteBegin: (() => void) | undefined
-    let remoteWrite:
-      ((message: { type: `insert`; value: Todo }) => void) | undefined
-    let remoteCommit:
-      ((signal?: AbortSignal) => true | Promise<void>) | undefined
-
-    adapter.runInHydrationScope = async (task) => {
-      if (!probeActive) return task(adapter)
-      probeActive = false
-
-      const result = await task(adapter)
-      trace.push(`hydrate-task-returned`)
-
-      const abortController = new AbortController()
-      remoteBegin?.()
-      remoteWrite?.({
-        type: `insert`,
-        value: { id: `unrelated`, title: `Outside hydrate boundary` },
-      })
-      const receipt = remoteCommit?.(abortController.signal)
-      if (!(receipt instanceof Promise)) {
-        throw new Error(`expected a pending unrelated receipt`)
+      await settle()
+      // Checkpoint: both reacquisitions are in flight.
+      expect(observe()).toEqual(expectedReacquisition(history, 0))
+      if (history.supersededAsLeader) {
+        leader = true
+        await sourceParams!.metadata!.persistence!.startScopedRecovery!()
+        await settle()
+        leader = false
+        let outcome: `pending` | `fulfilled` | `rejected` = `pending`
+        void Promise.resolve(load(`c`)).then(
+          () => (outcome = `fulfilled`),
+          () => (outcome = `rejected`),
+        )
+        await settle()
+        // Checkpoint: the superseded reacquisition no longer holds notices.
+        // The node stays in scoped recovery with nothing reacquiring, so the
+        // owner's notice for c is handled by one refetch instead of waiting
+        // in the queue forever; the untrusted generation shows no row.
+        expect({ outcome, cEnsures, c: source.get(`c-row`)?.v }).toEqual({
+          outcome: `fulfilled`,
+          cEnsures: 2,
+          c: undefined,
+        })
+        for (const reply of replies.values()) reply.resolve()
+        return
+      }
+      for (const [index, group] of history.order.entries()) {
+        if (index === 1 && history.noticeBetween) {
+          ownerCommits(newStorageId, { id: `a-row`, group: `a`, v: 3 })
+          await settle()
+        }
+        if (history.fails === `released` && group === `b`) {
+          const aborted = new Error(`released`)
+          aborted.name = `AbortError`
+          replies.get(group)!.reject(aborted)
+        } else if (history.fails === group || history.fails === `both`)
+          replies.get(group)!.reject(new Error(`reacquire ${group} failed`))
+        else replies.get(group)!.resolve()
+        await settle()
+        // Checkpoint: after each settlement.
+        expect(observe()).toEqual(expectedReacquisition(history, index + 1))
       }
-      trace.push(`unrelated-receipt-created`)
-      unrelatedStarted.resolve({ abortController, receipt })
-      return result
+      // Two acquisitions and two reacquisitions, a new demand's ensure, plus
+      // one refresh per held notice when recovery stays; a refetch loop
+      // exceeds the bound.
+      expect(ensures).toBeLessThanOrEqual(16)
+    } finally {
+      await source.cleanup()
+      errors.mockRestore()
+      warnings.mockRestore()
     }
+  }
 
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-unrelated-receipt-boundary`,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            remoteBegin = begin
-            remoteWrite = write as (message: {
-              type: `insert`
-              value: Todo
-            }) => void
-            remoteCommit = commit
-            markReady()
-            return { loadSubset: () => true }
-          },
-        },
-        persistence: { adapter },
-        onInsert: async () => {
-          mutationEntered.resolve()
-          await releaseMutation.promise
-        },
+  const rotatedReacquisitionHistories: Array<RotatedReacquisitionHistory> = (
+    [
+      [`a`, `b`],
+      [`b`, `a`],
+    ] as const
+  ).flatMap((order) =>
+    [false, true].flatMap((noticeBetween) =>
+      ([`none`, `a`, `b`, `both`, `released`] as const).flatMap((fails) =>
+        [false, true].map((newDemand) => ({
+          order: [...order],
+          noticeBetween,
+          fails,
+          newDemand,
+        })),
+      ),
+    ),
+  )
+  // Known gap: see #2139. Recovery never ends today, so the histories in
+  // which it should end, or in which a new demand must wait for it, fail.
+  const reacquisitionGap = ({
+    fails,
+    newDemand,
+  }: RotatedReacquisitionHistory) =>
+    newDemand === true || fails === `none` || fails === `released`
+  it.each(
+    rotatedReacquisitionHistories.filter(
+      (history) => !reacquisitionGap(history),
+    ),
+  )(
+    `ends a follower's scoped recovery only after every reacquisition succeeds: order $order, notice between $noticeBetween, fails $fails, new demand $newDemand`,
+    assertRotatedReacquisition,
+    10_000,
+  )
+  it.fails.each(rotatedReacquisitionHistories.filter(reacquisitionGap))(
+    `ends a follower's scoped recovery only after every reacquisition succeeds: order $order, notice between $noticeBetween, fails $fails, new demand $newDemand`,
+    assertRotatedReacquisition,
+    10_000,
+  )
+  it(
+    `releases held notices when a second rotation supersedes reacquisition as leader`,
+    () =>
+      assertRotatedReacquisition({
+        order: [`a`, `b`],
+        noticeBetween: false,
+        fails: `none`,
+        supersededAsLeader: true,
+      }),
+    10_000,
+  )
+  // Two hydrations that both find the claim lost queue work while the
+  // follower reacquires. Their flushes must leave the held notices alone;
+  // otherwise each notice refreshes the scoped demand and the follower spins.
+  it(
+    `holds a rotated follower's notices when two reads find the claim lost: fails 'a'`,
+    () =>
+      assertRotatedReacquisition({
+        order: [`a`, `b`],
+        noticeBetween: false,
+        fails: `a`,
+        trigger: `claim-lost-during-reads`,
       }),
-    )
-    let mutation: ReturnType<typeof collection.insert> | undefined
-    let load: Promise<unknown> | undefined
-    let unrelated:
-      { abortController: AbortController; receipt: Promise<void> } | undefined
-
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      mutation = collection.insert({ id: `local`, title: `Persisting gate` })
-      await mutationEntered.promise
-
-      probeActive = true
-      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-      unrelated = await unrelatedStarted.promise
-      expect(trace).toEqual([
-        `hydrate-task-returned`,
-        `unrelated-receipt-created`,
-      ])
-
-      // Give the public load continuation the opportunity to snapshot receipts.
-      await flushAsyncWork()
-      unrelated.abortController.abort()
-
-      // The subset's own hydrated rows wait behind the persisting mutation,
-      // so the load settles once that mutation does. It must not also wait
-      // for the unrelated receipt.
-      releaseMutation.resolve()
-      await mutation.isPersisted.promise
-      await expect(load).resolves.toBeUndefined()
-      await unrelated.receipt.catch(() => undefined)
-    } finally {
-      unrelated?.abortController.abort()
-      releaseMutation.resolve()
-      await mutation?.isPersisted.promise.catch(() => undefined)
-      await load?.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
+    10_000,
+  )
+  // Known gap: see #2139. Recovery never ends, so the rows stay hidden.
+  it.fails(
+    `holds a rotated follower's notices when two reads find the claim lost: fails 'none'`,
+    () =>
+      assertRotatedReacquisition({
+        order: [`a`, `b`],
+        noticeBetween: false,
+        fails: `none`,
+        trigger: `claim-lost-during-reads`,
+      }),
+    10_000,
+  )
 
-  // Persisted indexes are optional query accelerators: the existing adapter
-  // failure law keeps rows and readiness available when an index cannot be
-  // stored. Spec construction belongs to that same best-effort boundary.
-  // These histories add real serialization rejection before adapter entry,
-  // both at bootstrap and at index:added, with a healthy sibling and supported
-  // native control. Rows use ordinary strings; no unsupported row write is
-  // admitted. At settled index work, compare readiness, rows, warnings, and the
-  // exact signatures that reached the adapter and coordinator.
-  it.sequential.each(
-    [`startup`, `runtime`].flatMap((phase) =>
-      [
-        `Instant`,
-        `PlainDate`,
-        `ZonedDateTime`,
-        `Duration`,
-        `missing-global`,
-        `missing-global-date`,
-      ].map((kind) => ({ phase, kind })),
+  const followerRemoteDemandHistory = fc.record({
+    // Known gap: see #2139. The rotated placement is pinned above.
+    placement: fc.constantFrom<FollowerRemoteDemandHistory[`placement`]>(
+      `direct`,
+      `queued`,
+      `expired`,
     ),
+    apply: fc.constantFrom<FollowerRemoteDemandHistory[`apply`]>(`ok`, `fails`),
+    consumer: fc.constantFrom<FollowerRemoteDemandHistory[`consumer`]>(
+      `live-query`,
+      `load`,
+    ),
+  })
+  fcTest.prop(
+    [followerRemoteDemandHistory],
+    oraclePropertyOptions(12, `persistence.follower-remote-demand`),
   )(
-    `keeps index serialization failure best-effort / $phase / $kind`,
-    async ({ phase, kind }) => {
-      const originalTemporal = Object.getOwnPropertyDescriptor(
-        globalThis,
-        `Temporal`,
-      )
-      Object.defineProperty(globalThis, `Temporal`, {
-        value: kind.startsWith(`missing-global`) ? undefined : Temporal,
-        configurable: true,
-        writable: true,
-      })
-      const value =
-        kind === `PlainDate` || kind === `missing-global-date`
-          ? Temporal.PlainDate.from(`2026-01-02`)
-          : kind === `ZonedDateTime`
-            ? Temporal.ZonedDateTime.from(`2026-01-02T00:00:00+00:00[UTC]`)
-            : kind === `Duration`
-              ? Temporal.Duration.from(`PT1H`)
-              : Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-      const accepted = kind === `Instant` || kind === `PlainDate`
-      const row = { id: `persisted`, title: `ordinary row` }
-      const adapter = createRecordingAdapter([row])
-      const coordinator = createCoordinatorHarness()
-      const remoteSignatures: Array<string> = []
-      coordinator.requestEnsurePersistedIndex = (_id, signature) => {
-        remoteSignatures.push(signature)
-        return Promise.resolve()
-      }
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `index-serialization-${phase}-${kind}`,
-          getKey: (item) => item.id,
-          defaultIndexType: BasicIndex,
-          sync: { sync: ({ markReady }) => markReady() },
-          persistence: { adapter, coordinator },
-        }),
-      )
-      let hasPrimaryFailure = false
-      try {
-        if (phase === `runtime`) await collection.preload()
-        const index = collection.createIndex((item) =>
-          coalesce(item.title, new IR.Value(value)),
-        )
-        const healthy = collection.createIndex((item) => item.id)
-        const metadata = collection.getIndexMetadata()
-        const signature = metadata.find(
-          (entry) => entry.indexId === index.id,
-        )!.signature
-        const healthySignature = metadata.find(
-          (entry) => entry.indexId === healthy.id,
-        )!.signature
-        if (phase === `startup`)
-          await expect(collection.preload()).resolves.toBeUndefined()
-        await flushAsyncWork()
-        expect(collection.status).toBe(`ready`)
-        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
-        const expectedSignatures = accepted
-          ? [signature, healthySignature]
-          : [healthySignature]
-        expect(adapter.ensureIndexCalls.map((call) => call.signature)).toEqual(
-          expectedSignatures,
-        )
-        expect(remoteSignatures).toEqual(expectedSignatures)
-        expect(warning.mock.calls).toHaveLength(accepted ? 0 : 2)
-        if (!accepted) {
-          expect(warning.mock.calls.map(([message]) => message)).toEqual([
-            `Failed to ensure persisted index in adapter:`,
-            `Failed to ensure persisted index through coordinator:`,
-          ])
-          for (const [, error] of warning.mock.calls) {
-            expect(error).toMatchObject({
-              name: `InvalidPersistedCollectionConfigError`,
-            })
-          }
-        }
-        // A following ordinary subset load is still usable after the skipped index.
-        await collection._sync.loadSubset({ limit: 1 })
-        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        await cleanupPersistedOracle(
-          [
-            () => warning.mockRestore(),
-            () => collection.cleanup(),
-            () => {
-              if (originalTemporal)
-                Object.defineProperty(globalThis, `Temporal`, originalTemporal)
-              else Reflect.deleteProperty(globalThis, `Temporal`)
-            },
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
+    `checks generated follower remote-demand histories (random or replayed)`,
+    assertFollowerRemoteDemandHistory,
   )
 
-  // Optional index failure isolation also applies after serializer admission.
-  // The model is a product of independent collaborator outcomes, not runtime
-  // control flow: local success alone authorizes a completion marker; either
-  // collaborator may fail without failing rows, readiness, or a healthy sibling.
-  // A held local promise supplies the intermediate observation: its coordinator
-  // request cannot claim completed work before that promise settles. Startup
-  // visits indexes serially; runtime additions may overlap, so only per-index
-  // causality and exact call multiplicity are promised, not global call order.
-  it.sequential.each(
-    [`startup`, `runtime`].flatMap((phase) =>
-      [`local`, `coordinator`, `both`].flatMap((boundary) =>
-        [`throw`, `held`].flatMap((settlement) =>
-          [false, true].map((fails) => ({
-            phase,
-            boundary,
-            settlement,
-            fails,
-          })),
-        ),
-      ),
-    ),
-  )(
-    `isolates optional index outcomes / $phase / $boundary / $settlement / fails $fails`,
-    async ({ phase, boundary, settlement, fails }) => {
-      const row = { id: `row`, title: `available` }
-      const adapter = createRecordingAdapter([row])
-      const coordinator = createCoordinatorHarness()
-      const entered = createDeferred()
-      const gate = createDeferred()
-      const failure = new Error(`optional index rejected`)
-      const localNames: Array<string> = []
-      const remote: Array<{ name: string; completed: boolean }> = []
-      const unhandled: Array<unknown> = []
-      const onUnhandled = (error: unknown) => unhandled.push(error)
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const settle = () => {
-        entered.resolve()
-        if (settlement === `held`)
-          return gate.promise.then(() => {
-            if (fails) throw failure
-          })
-        if (fails) throw failure
-        return Promise.resolve()
-      }
-      adapter.ensureIndex = (_id, _signature, spec) => {
-        const name = String(spec.metadata?.name)
-        localNames.push(name)
-        return name === `target` && boundary !== `coordinator`
-          ? settle()
-          : Promise.resolve()
-      }
-      coordinator.requestEnsurePersistedIndex = (
-        _id,
-        _signature,
-        spec,
-        completedAdapter,
-        completed,
-      ) => {
-        const name = String(spec.metadata?.name)
-        // The flag and adapter capability must agree, including failed locals.
-        expect(completedAdapter).toBe(completed ? adapter : undefined)
-        remote.push({ name, completed: completed === true })
-        return name === `target` && boundary !== `local`
-          ? settle()
-          : Promise.resolve()
-      }
+  it.each(persistedKeySetEvidenceStatuses.map((status) => ({ status })))(
+    `keeps on-demand rows independent from $status baseline evidence`,
+    async ({ status }) => {
+      const adapter = createRecordingAdapter([
+        { id: `on-demand`, title: `On-demand row` },
+      ])
+      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+      adapter.loadResumeSnapshot = async (...args) => ({
+        ...(await loadResumeSnapshot(...args)),
+        rows: [
+          {
+            key: `baseline`,
+            value: { id: `baseline`, title: `Baseline row` },
+          },
+        ],
+        keySet: { status },
+      })
+      let hydrateBaseline: (() => Promise<void>) | undefined
       const collection = createCollection(
         persistedCollectionOptions<Todo, string>({
-          id: `optional-index-${phase}-${boundary}-${settlement}-${fails}`,
+          id: `${status}-baseline-and-on-demand`,
+          syncMode: `on-demand`,
           getKey: (item) => item.id,
-          defaultIndexType: BasicIndex,
-          sync: { sync: ({ markReady }) => markReady() },
-          persistence: { adapter, coordinator },
+          sync: {
+            sync: ({ markReady, metadata }) => {
+              const capability = metadata?.persistence
+              if (!capability) {
+                throw new Error(`Expected persisted sync capability`)
+              }
+              hydrateBaseline = capability.hydrateBaseline
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
         }),
       )
-      let preload: Promise<void> | undefined
-      let hasPrimaryFailure = false
-      process.on(`unhandledRejection`, onUnhandled)
+
       try {
-        if (phase === `runtime`) await collection.preload()
-        collection.createIndex((item) => item.title, { name: `target` })
-        collection.createIndex((item) => item.id, { name: `healthy` })
-        if (phase === `startup`) {
-          preload = Promise.resolve(collection.preload())
-          void preload.catch(() => undefined)
-        }
-        await entered.promise
+        collection.startSyncImmediate()
+        await vi.waitFor(() => expect(hydrateBaseline).toBeTypeOf(`function`))
+        await hydrateBaseline!()
         await flushAsyncWork()
-        expect(collection.status).not.toBe(`crashed`)
-        if (phase === `runtime`) {
-          expect(collection.status).toBe(`ready`)
-          expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
-        }
-        if (settlement === `held`) {
-          expect(warning).not.toHaveBeenCalled()
-          if (boundary !== `coordinator`)
-            expect(remote.filter((entry) => entry.name === `target`)).toEqual(
-              [],
-            )
-        }
-        gate.resolve()
-        await preload
         await flushAsyncWork()
-        expect(collection.status).toBe(`ready`)
-        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
-        expect([...localNames].sort()).toEqual([`healthy`, `target`])
-        expect(
-          [...remote].sort((a, b) => a.name.localeCompare(b.name)),
-        ).toEqual([
-          { name: `healthy`, completed: true },
-          { name: `target`, completed: !(fails && boundary !== `coordinator`) },
-        ])
-        expect(warning.mock.calls).toEqual(
-          fails
-            ? [
-                ...(boundary !== `coordinator`
-                  ? [[`Failed to ensure persisted index in adapter:`, failure]]
-                  : []),
-                ...(boundary !== `local`
-                  ? [
-                      [
-                        `Failed to ensure persisted index through coordinator:`,
-                        failure,
-                      ],
-                    ]
-                  : []),
-              ]
-            : [],
-        )
-        for (const [, error] of warning.mock.calls) expect(error).toBe(failure)
-        expect(unhandled).toEqual([])
-        await collection._sync.loadSubset({ limit: 1 })
-        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
+
+        const baselineVisible = collection.has(`baseline`)
+        expect(collection.has(`on-demand`)).toBe(false)
+        await collection._sync.loadSubset({})
+
+        expectOnDemandEvidenceLaw({
+          status,
+          route: `loadSubset`,
+          baselineVisible,
+          onDemandVisible: collection.has(`on-demand`),
+        })
       } finally {
-        gate.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => preload?.catch(() => undefined),
-            // Drain held rejection delivery before this case releases its observer.
-            () => flushAsyncWork(),
-            () => warning.mockRestore(),
-            () => collection.cleanup(),
-            () => {
-              process.off(`unhandledRejection`, onUnhandled)
-            },
-          ],
-          hasPrimaryFailure,
-        )
+        await collection.cleanup()
       }
     },
   )
 
-  it(`only signals completed leader-local index work after local success`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const localFailure = new Error(`local index creation failed`)
-    const completedLocalMarkers: Array<boolean> = []
-    const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
-
-    adapter.ensureIndex = async (collectionId, signature) => {
-      adapter.ensureIndexCalls.push({
-        collectionId: recordedStorageId(collectionId),
-        signature,
+  it.each(persistedKeySetEvidenceStatuses.map((status) => ({ status })))(
+    `keeps force reload rows independent from $status startup evidence`,
+    async ({ status }) => {
+      const adapter = createRecordingAdapter([
+        { id: `on-demand`, title: `On-demand row` },
+      ])
+      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+      adapter.loadResumeSnapshot = async (...args) => ({
+        ...(await loadResumeSnapshot(...args)),
+        keySet: { status },
       })
-      throw localFailure
-    }
-    coordinator.requestEnsurePersistedIndex = async (
-      _collectionId,
-      _signature,
-      _spec,
-      completedLocalAdapter,
-      localEnsureCompleted,
-    ) => {
-      completedLocalMarkers.push(
-        completedLocalAdapter !== undefined && localEnsureCompleted === true,
-      )
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `failed-local-index-bootstrap`,
-        getKey: (item) => item.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    collection.createIndex((row) => row.title, { name: `startup-title` })
-
-    try {
-      await collection.preload()
-      expect(completedLocalMarkers).toEqual([false])
-    } finally {
-      await collection.cleanup()
-      warn.mockRestore()
-    }
-  })
-
-  it(`releases the hydration scope before invoking a coordinator that uses its own adapter`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinatorEntered = createDeferred()
-    const breakSchedulerCycle = createDeferred()
-    let hydrationScopeActive = false
-    let coordinatorEnteredDuringHydration: boolean | undefined
-
-    const publicEnsureIndex = adapter.ensureIndex.bind(adapter)
-    const scopedAdapter: PersistenceAdapter = {
-      ...adapter,
-      ensureIndex: publicEnsureIndex,
-    }
-    adapter.runInHydrationScope = async (task) => {
-      hydrationScopeActive = true
-      try {
-        return await task(scopedAdapter)
-      } finally {
-        hydrationScopeActive = false
-      }
-    }
-    adapter.ensureIndex = async (...args) => {
-      if (hydrationScopeActive) {
-        // A public core-adapter call queues behind the active hydrate. The
-        // hydrate cannot release until this coordinator call returns.
-        await breakSchedulerCycle.promise
-      }
-      await publicEnsureIndex(...args)
-    }
-
-    const coordinator = createCoordinatorHarness()
-    coordinator.requestEnsurePersistedIndex = async (
-      collectionId,
-      signature,
-      spec,
-    ) => {
-      coordinatorEnteredDuringHydration = hydrationScopeActive
-      coordinatorEntered.resolve()
-      // Deliberately ignore the optional scoped adapter, as existing public
-      // coordinator implementations are allowed to do.
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        spec,
-      )
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `custom-coordinator-hydration-scope`,
-        getKey: (item) => item.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    collection.createIndex((row) => row.title, {
-      name: `startup-title`,
-    })
-    const preload = Promise.resolve(collection.preload())
-    void preload.catch(() => undefined)
-
-    try {
-      await coordinatorEntered.promise
-      expect(coordinatorEnteredDuringHydration).toBe(false)
-    } finally {
-      breakSchedulerCycle.resolve()
-      await preload.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-
-  it(`releases crossed follower hydration scopes before leader index RPC work`, async () => {
-    const bothLocalIndexesEntered = createDeferred()
-    const bothCoordinatorRequestsEntered = createDeferred()
-    let localIndexEntries = 0
-    let coordinatorEntries = 0
-
-    const createTabAdapter = () => {
-      const adapter = createRecordingAdapter()
-      const breakSchedulerCycle = createDeferred()
-      let hydrationScopeActive = false
-      const remoteScopeObservations: Array<boolean> = []
-      const publicEnsureIndex = adapter.ensureIndex.bind(adapter)
-      const scopedAdapter: PersistenceAdapter = {
-        ...adapter,
-        ensureIndex: async (...args) => {
-          localIndexEntries++
-          if (localIndexEntries === 2) bothLocalIndexesEntered.resolve()
-          await bothLocalIndexesEntered.promise
-          await publicEnsureIndex(...args)
-        },
-      }
-      adapter.runInHydrationScope = async (task) => {
-        hydrationScopeActive = true
-        try {
-          return await task(scopedAdapter)
-        } finally {
-          hydrationScopeActive = false
-        }
-      }
-      adapter.ensureIndex = async (...args) => {
-        remoteScopeObservations.push(hydrationScopeActive)
-        coordinatorEntries++
-        if (coordinatorEntries === 2) bothCoordinatorRequestsEntered.resolve()
-        if (hydrationScopeActive) await breakSchedulerCycle.promise
-        await publicEnsureIndex(...args)
-      }
-      return {
-        adapter,
-        breakSchedulerCycle,
-        remoteScopeObservations,
-      }
-    }
-
-    const tab1 = createTabAdapter()
-    const tab2 = createTabAdapter()
-    const coordinator1 = createCoordinatorHarness()
-    const coordinator2 = createCoordinatorHarness()
-    coordinator1.isLeader = () => false
-    coordinator2.isLeader = () => false
-    coordinator1.requestEnsurePersistedIndex = (
-      collectionId,
-      signature,
-      spec,
-    ) =>
-      tab2.adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        spec,
-      )
-    coordinator2.requestEnsurePersistedIndex = (
-      collectionId,
-      signature,
-      spec,
-    ) =>
-      tab1.adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        spec,
-      )
-
-    const createFollowerCollection = (
-      id: string,
-      persistence: PersistedCollectionPersistence,
-    ) => {
       const collection = createCollection(
         persistedCollectionOptions<Todo, string>({
-          id,
+          id: `${status}-local-only-force-reload`,
+          syncMode: `on-demand`,
           getKey: (item) => item.id,
-          defaultIndexType: BasicIndex,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-            },
-          },
-          persistence,
+          persistence: { adapter },
         }),
       )
-      collection.createIndex((row) => row.title, { name: `${id}-title` })
-      return collection
-    }
-    const followerA = createFollowerCollection(`follower-a`, {
-      adapter: tab1.adapter,
-      coordinator: coordinator1,
-    })
-    const followerB = createFollowerCollection(`follower-b`, {
-      adapter: tab2.adapter,
-      coordinator: coordinator2,
-    })
-    const preloadA = Promise.resolve(followerA.preload())
-    const preloadB = Promise.resolve(followerB.preload())
-    void preloadA.catch(() => undefined)
-    void preloadB.catch(() => undefined)
 
-    try {
-      await bothCoordinatorRequestsEntered.promise
-      expect({
-        tab1: tab1.remoteScopeObservations,
-        tab2: tab2.remoteScopeObservations,
-      }).toEqual({ tab1: [false], tab2: [false] })
-    } finally {
-      tab1.breakSchedulerCycle.resolve()
-      tab2.breakSchedulerCycle.resolve()
-      await Promise.all([preloadA, preloadB]).catch(() => undefined)
-      await Promise.all([followerA.cleanup(), followerB.cleanup()])
-    }
+      try {
+        collection.startSyncImmediate()
+        await vi.waitFor(() =>
+          expect(adapter.loadResumeSnapshotCalls.length).toBeGreaterThan(0),
+        )
+        await collection.utils.forceReloadSubset!({})
+
+        expect(adapter.loadResumeSnapshotCalls[0]?.includeRows).toBe(false)
+        expectOnDemandEvidenceLaw({
+          status,
+          route: `forceReloadSubset`,
+          // This local-only route reads startup evidence but does not expose
+          // baseline hydration. Do not claim a baseline observation here.
+          baselineVisible: `not-observed`,
+          onDemandVisible: collection.has(`on-demand`),
+        })
+      } finally {
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`rejects an evidence-coupled on-demand hydration mutant`, () => {
+    expect(() =>
+      expectOnDemandEvidenceLaw({
+        status: `incompatible`,
+        route: `loadSubset`,
+        baselineVisible: false,
+        onDemandVisible: false,
+      }),
+    ).toThrow(`on-demand rows must not inherit baseline evidence rejection`)
+
+    expectOnDemandEvidenceLaw({
+      status: `incompatible`,
+      route: `loadSubset`,
+      baselineVisible: false,
+      onDemandVisible: true,
+    })
   })
 
   it(`keeps generated crossed-leadership index RPC histories outside local hydration scopes`, async () => {
@@ -30646,465 +4883,110 @@ describeUnlessOracleReplay(`persistedCollectionOptions`, () => {
               return { loadSubset: () => true }
             },
           },
-          persistence: { adapter },
-          onInsert: async () => {
-            if (!remoteBegin || !remoteWrite || !remoteCommit) {
-              throw new Error(`source sync is not ready`)
-            }
-            remoteBegin()
-            remoteWrite({
-              type: `update`,
-              value: { id: `source-row`, title: `Buffered during hydrate` },
-            })
-            const applied = remoteCommit()
-            if (applied === true) {
-              throw new Error(`source commit was not buffered during hydration`)
-            }
-            bufferedCommitReturned.resolve({ receipt: applied })
-            // The handler waits for acceptance; the row becomes visible when
-            // this mutation settles.
-            await whenSyncAccepted(applied)
-            accepted.resolve()
-            await releaseMutation.promise
-          },
-        }),
-      )
-
-      const preload = Promise.resolve(collection.preload())
-      void preload.catch(() => undefined)
-      let mutationPersisted: Promise<unknown> | undefined
-      let bufferedReceipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-
-      try {
-        await atPersistedOracleCheckpoint(
-          hydrateLoadEntered.promise,
-          `buffered causal replay hydration entered`,
-        )
-        await atPersistedOracleCheckpoint(
-          sourceReady.promise,
-          `buffered causal replay source ready`,
-        )
-
-        const mutation = collection.insert({ id: `local`, title: `Pending` })
-        mutationPersisted = mutation.isPersisted.promise
-        void mutationPersisted.catch(() => undefined)
-        const bufferedCommit = await atPersistedOracleCheckpoint(
-          bufferedCommitReturned.promise,
-          `buffered causal replay commit returned`,
-        )
-        bufferedReceipt = bufferedCommit.receipt
-        void bufferedReceipt.catch(() => undefined)
-
-        allowHydrateLoad.resolve()
-
-        await atPersistedOracleCheckpoint(
-          accepted.promise,
-          `source accepted before optimistic publication`,
-        )
-        expect(routing?.violations() ?? []).toEqual([])
-        const appliedState = observeSettlement(bufferedReceipt)
-        await flushAsyncWork()
-        expect(appliedState.read()).toEqual({ status: `pending` })
-        expect(adapter.rows.get(`source-row`)).toEqual({
-          id: `source-row`,
-          title: `Buffered during hydrate`,
-        })
-        expect(collection.get(`source-row`)).toBeUndefined()
-        releaseMutation.resolve()
-        // The replay is accepted and stored while the mutation persists; its
-        // receipt resolves when the mutation settles and the row publishes.
-        await expect(
-          atPersistedOracleCheckpoint(
-            mutationPersisted,
-            `buffered causal replay mutation persisted`,
-          ),
-        ).resolves.toBeDefined()
-        expect(replayState.persisted).toBe(true)
-        await expect(
-          atPersistedOracleCheckpoint(
-            bufferedReceipt,
-            `buffered causal replay source receipt`,
-          ),
-        ).resolves.toBeUndefined()
-        await expect(
-          atPersistedOracleCheckpoint(
-            preload,
-            `buffered causal replay preload settled`,
-          ),
-        ).resolves.toBeUndefined()
-        expect(stripVirtualProps(collection.get(`source-row`))).toEqual({
-          id: `source-row`,
-          title: `Buffered during hydrate`,
-        })
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        allowHydrateLoad.resolve()
-        releaseMutation.resolve()
-        await cleanupPersistedOracle(
-          [() => collection.cleanup()],
-          hasPrimaryFailure,
-        )
-      }
-    },
-  )
-
-  it(`releases the hydration scope before a gap coordinator uses its own adapter`, async () => {
-    const adapter = createRecordingAdapter()
-    const coordinator = createCoordinatorHarness()
-    const coordinatorEntered = createDeferred()
-    const breakSchedulerCycle = createDeferred()
-    let hydrationScopeActive = false
-    let coordinatorEnteredDuringHydration: boolean | undefined
-
-    const pullSince = async () => ({
-      latestRowVersion: 0,
-      requiresFullReload: false as const,
-      changedKeys: [],
-      deletedKeys: [],
-      deltas: [],
-    })
-    const publicAdapter = adapter as RecordingAdapter & {
-      pullSince: typeof pullSince
-    }
-    const scopedAdapter = {
-      ...adapter,
-      pullSince,
-    }
-    publicAdapter.pullSince = async () => {
-      if (hydrationScopeActive) await breakSchedulerCycle.promise
-      return pullSince()
-    }
-    adapter.runInHydrationScope = async (task) => {
-      hydrationScopeActive = true
-      try {
-        return await task(scopedAdapter)
-      } finally {
-        hydrationScopeActive = false
-      }
-    }
-    coordinator.pullSince = async (_collectionId, _fromRowVersion) => {
-      coordinatorEnteredDuringHydration = hydrationScopeActive
-      coordinatorEntered.resolve()
-      const result = await publicAdapter.pullSince()
-      return {
-        type: `rpc:pullSince:res`,
-        rpcId: `legacy-gap-coordinator`,
-        ok: true,
-        latestTerm: 1,
-        latestSeq: 2,
-        latestRowVersion: result.latestRowVersion,
-        requiresFullReload: result.requiresFullReload,
-        changedKeys: result.changedKeys,
-        deletedKeys: result.deletedKeys,
-        deltas: result.deltas,
-      }
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-    await collection.preload()
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 2,
-      txId: `tx-gap-legacy-coordinator`,
-      latestRowVersion: 2,
-      requiresFullReload: false,
-      changedRows: [],
-      deletedKeys: [],
-    })
-
-    try {
-      await coordinatorEntered.promise
-      expect(coordinatorEnteredDuringHydration).toBe(false)
-    } finally {
-      breakSchedulerCycle.resolve()
-      await flushAsyncWork()
-      await collection.cleanup()
-    }
-  })
-
-  // Focused invalidation-reload refinements. Whether recovery follows a
-  // sequence gap or a contiguous committed notification, metadata and rows
-  // must be read inside one hydration scope. The adapter schedules v2 only
-  // outside the scope; coherent public v1 state is the checkpoint.
-  it(`keeps sequence-gap recovery inside one hydration scope`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial row` }])
-    adapter.collectionMetadata.set(`snapshot`, `initial`)
-    const coordinator = createCoordinatorHarness()
-    coordinator.setPullSinceResponse({
-      type: `rpc:pullSince:res`,
-      rpcId: `pull-gap-scope`,
-      ok: true,
-      latestTerm: 1,
-      latestSeq: 1,
-      latestRowVersion: 1,
-      requiresFullReload: true,
-    })
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    let inHydrationScope = false
-    let interleaveArmed = false
-    let interleaveRan = false
-
-    const runInterleavedWrite = () => {
-      interleaveRan = true
-      adapter.collectionMetadata.set(`snapshot`, `v2`)
-      adapter.rows.set(`1`, { id: `1`, title: `v2 row` })
-    }
-
-    adapter.loadSubset = async (...args) => {
-      if (interleaveArmed && !inHydrationScope && !interleaveRan) {
-        runInterleavedWrite()
-      }
-      return loadSubset(...args)
-    }
-    adapter.runInHydrationScope = async (task) => {
-      inHydrationScope = true
-      try {
-        return await task(adapter)
-      } finally {
-        inHydrationScope = false
-        if (interleaveArmed && !interleaveRan) runInterleavedWrite()
-      }
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    await collection.preload()
-    adapter.collectionMetadata.set(`snapshot`, `v1`)
-    adapter.rows.set(`1`, { id: `1`, title: `v1 row` })
-    interleaveArmed = true
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 2,
-      txId: `tx-gap-scope`,
-      latestRowVersion: 2,
-      requiresFullReload: false,
-      changedRows: [],
-      deletedKeys: [],
-    })
-
-    await vi.waitFor(() => expect(interleaveRan).toBe(true))
-    expect(collection._state.syncedCollectionMetadata.get(`snapshot`)).toBe(
-      `v1`,
-    )
-    expect(collection.get(`1`)?.title).toBe(`v1 row`)
-    await collection.cleanup()
-  })
-
-  it(`keeps contiguous committed reload inside one hydration scope`, async () => {
-    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial row` }])
-    adapter.collectionMetadata.set(`snapshot`, `initial`)
-    const coordinator = createCoordinatorHarness()
-    const loadSubset = adapter.loadSubset.bind(adapter)
-    let inHydrationScope = false
-    let interleaveArmed = false
-    let interleaveRan = false
-
-    const runInterleavedWrite = () => {
-      interleaveRan = true
-      adapter.collectionMetadata.set(`snapshot`, `v2`)
-      adapter.rows.set(`1`, { id: `1`, title: `v2 row` })
-    }
-
-    adapter.loadSubset = async (...args) => {
-      if (interleaveArmed && !inHydrationScope && !interleaveRan) {
-        runInterleavedWrite()
-      }
-      return loadSubset(...args)
-    }
-    adapter.runInHydrationScope = async (task) => {
-      inHydrationScope = true
-      try {
-        return await task(adapter)
-      } finally {
-        inHydrationScope = false
-        if (interleaveArmed && !interleaveRan) runInterleavedWrite()
-      }
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present`,
-        getKey: (item) => item.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-          },
-        },
-        persistence: { adapter, coordinator },
-      }),
-    )
-
-    await collection.preload()
-    adapter.collectionMetadata.set(`snapshot`, `v1`)
-    adapter.rows.set(`1`, { id: `1`, title: `v1 row` })
-    interleaveArmed = true
-
-    coordinator.emit({
-      type: `tx:committed`,
-      term: 1,
-      seq: 1,
-      txId: `tx-contiguous-reload-scope`,
-      latestRowVersion: 1,
-      requiresFullReload: true,
-    })
-
-    await vi.waitFor(() => expect(interleaveRan).toBe(true))
-    expect(collection._state.syncedCollectionMetadata.get(`snapshot`)).toBe(
-      `v1`,
-    )
-    expect(collection.get(`1`)?.title).toBe(`v1 row`)
-    await collection.cleanup()
-  })
-
-  // Focused lifecycle-fencing witness: generation-zero startup is held across
-  // cleanup and rebound, then released while generation one is still loading.
-  // Zero ensure-index calls for the rebound signatures prove stale bootstrap
-  // and listener work did not cross the public lifecycle boundary.
-  it(`does not let stale startup install index work on a rebound lifecycle`, async () => {
-    const adapter = createRecordingAdapter()
-    const g0MetadataEntered = createDeferred()
-    const allowG0Metadata = createDeferred()
-    const g1MetadataEntered = createDeferred()
-    const allowG1Metadata = createDeferred()
-    let metadataCalls = 0
-    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-    adapter.loadResumeSnapshot = async (...args) => {
-      if (args[1]?.includeRows === false) {
-        metadataCalls++
-        if (metadataCalls === 1) {
-          g0MetadataEntered.resolve()
-          await allowG0Metadata.promise
-        } else if (metadataCalls === 2) {
-          g1MetadataEntered.resolve()
-          await allowG1Metadata.promise
-        }
-      }
-      return loadResumeSnapshot(...args)
-    }
-
-    const collection = createCollection(
-      persistedCollectionOptions<Todo, string>({
-        id: `sync-present-startup-index-generation`,
-        getKey: (item) => item.id,
-        defaultIndexType: BasicIndex,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
+          persistence: { adapter },
+          onInsert: async () => {
+            if (!remoteBegin || !remoteWrite || !remoteCommit) {
+              throw new Error(`source sync is not ready`)
+            }
+            remoteBegin()
+            remoteWrite({
+              type: `update`,
+              value: { id: `source-row`, title: `Buffered during hydrate` },
+            })
+            const applied = remoteCommit()
+            if (applied === true) {
+              throw new Error(`source commit was not buffered during hydration`)
+            }
+            bufferedCommitReturned.resolve({ receipt: applied })
+            // The handler waits for acceptance; the row becomes visible when
+            // this mutation settles.
+            await whenSyncAccepted(applied)
+            accepted.resolve()
+            await releaseMutation.promise
           },
-        },
-        persistence: { adapter },
-      }),
-    )
-    const stalePreload = Promise.resolve(collection.preload())
-    void stalePreload.catch(() => undefined)
-    let freshReady: Promise<unknown> | undefined
-
-    try {
-      await g0MetadataEntered.promise
-      await collection.cleanup()
-
-      const reboundIndex = collection.createIndex((row) => row.title, {
-        name: `rebound-bootstrap`,
-      })
-      const reboundSignature = collection
-        .getIndexMetadata()
-        .find((metadata) => metadata.indexId === reboundIndex.id)?.signature
-      expect(reboundSignature).toBeDefined()
-      freshReady = collection.stateWhenReady()
-
-      allowG0Metadata.resolve()
-      await g1MetadataEntered.promise
-
-      const staleBootstrapCalls = adapter.ensureIndexCalls.filter(
-        (call) => call.signature === reboundSignature,
-      )
-      const listenerIndex = collection.createIndex((row) => row.id, {
-        name: `rebound-listener`,
-      })
-      const listenerSignature = collection
-        .getIndexMetadata()
-        .find((metadata) => metadata.indexId === listenerIndex.id)?.signature
-      expect(listenerSignature).toBeDefined()
-      const staleListenerCalls = adapter.ensureIndexCalls.filter(
-        (call) => call.signature === listenerSignature,
+        }),
       )
 
-      expect({
-        staleBootstrapCalls: staleBootstrapCalls.length,
-        staleListenerCalls: staleListenerCalls.length,
-      }).toEqual({
-        staleBootstrapCalls: 0,
-        staleListenerCalls: 0,
-      })
-
-      allowG1Metadata.resolve()
-      await freshReady
-    } finally {
-      allowG0Metadata.resolve()
-      allowG1Metadata.resolve()
-      await stalePreload.catch(() => undefined)
-      await freshReady?.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-})
+      const preload = Promise.resolve(collection.preload())
+      void preload.catch(() => undefined)
+      let mutationPersisted: Promise<unknown> | undefined
+      let bufferedReceipt: Promise<void> | undefined
+      let hasPrimaryFailure = false
 
-describeUnlessOracleReplay(`persisted key and identifier helpers`, () => {
-  it(`encodes and decodes persisted storage keys without collisions`, () => {
-    expect(encodePersistedStorageKey(1)).toBe(`n:1`)
-    expect(encodePersistedStorageKey(`1`)).toBe(`s:1`)
-    expect(decodePersistedStorageKey(`n:1`)).toBe(1)
-    expect(decodePersistedStorageKey(`s:1`)).toBe(`1`)
-    expect(Object.is(decodePersistedStorageKey(`n:-0`), -0)).toBe(true)
-  })
+      try {
+        await atPersistedOracleCheckpoint(
+          hydrateLoadEntered.promise,
+          `buffered causal replay hydration entered`,
+        )
+        await atPersistedOracleCheckpoint(
+          sourceReady.promise,
+          `buffered causal replay source ready`,
+        )
 
-  it(`throws for invalid persisted key values and encodings`, () => {
-    expect(() => encodePersistedStorageKey(Number.POSITIVE_INFINITY)).toThrow(
-      InvalidPersistedStorageKeyError,
-    )
-    expect(() => decodePersistedStorageKey(`legacy-key`)).toThrow(
-      InvalidPersistedStorageKeyEncodingError,
-    )
-  })
+        const mutation = collection.insert({ id: `local`, title: `Pending` })
+        mutationPersisted = mutation.isPersisted.promise
+        void mutationPersisted.catch(() => undefined)
+        const bufferedCommit = await atPersistedOracleCheckpoint(
+          bufferedCommitReturned.promise,
+          `buffered causal replay commit returned`,
+        )
+        bufferedReceipt = bufferedCommit.receipt
+        void bufferedReceipt.catch(() => undefined)
 
-  it(`creates deterministic safe table names`, () => {
-    const first = createPersistedTableName(`todos`)
-    const second = createPersistedTableName(`todos`)
-    const tombstoneName = createPersistedTableName(`todos`, `t`)
+        allowHydrateLoad.resolve()
 
-    expect(first).toBe(second)
-    expect(first).toMatch(/^c_[a-z2-7]+_[0-9a-z]+$/)
-    expect(tombstoneName).toMatch(/^t_[a-z2-7]+_[0-9a-z]+$/)
-  })
+        await atPersistedOracleCheckpoint(
+          accepted.promise,
+          `source accepted before optimistic publication`,
+        )
+        expect(routing?.violations() ?? []).toEqual([])
+        const appliedState = observeSettlement(bufferedReceipt)
+        await flushAsyncWork()
+        expect(appliedState.read()).toEqual({ status: `pending` })
+        expect(adapter.rows.get(`source-row`)).toEqual({
+          id: `source-row`,
+          title: `Buffered during hydrate`,
+        })
+        expect(collection.get(`source-row`)).toBeUndefined()
+        releaseMutation.resolve()
+        // The replay is accepted and stored while the mutation persists; its
+        // receipt resolves when the mutation settles and the row publishes.
+        await expect(
+          atPersistedOracleCheckpoint(
+            mutationPersisted,
+            `buffered causal replay mutation persisted`,
+          ),
+        ).resolves.toBeDefined()
+        expect(replayState.persisted).toBe(true)
+        await expect(
+          atPersistedOracleCheckpoint(
+            bufferedReceipt,
+            `buffered causal replay source receipt`,
+          ),
+        ).resolves.toBeUndefined()
+        await expect(
+          atPersistedOracleCheckpoint(
+            preload,
+            `buffered causal replay preload settled`,
+          ),
+        ).resolves.toBeUndefined()
+        expect(stripVirtualProps(collection.get(`source-row`))).toEqual({
+          id: `source-row`,
+          title: `Buffered during hydrate`,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        allowHydrateLoad.resolve()
+        releaseMutation.resolve()
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
 })
 
 /**
@@ -31198,195 +5080,13 @@ function hydrationSourceSnapshot(
   }
 }
 
-// The public optional API admits all three paths. Keep the no-scope and
-// same-adapter histories when adding a distinguishable loan; their receipt and
-// replay laws do not depend on a scheduler being present.
-function configureHydrationScope(
-  adapter: PersistenceAdapter,
-  mode: (typeof hydrationScopeModes)[number],
-) {
-  if (mode === `distinct-adapter`) return installHydrationRoutingProbe(adapter)
-  if (mode === `same-adapter`)
-    adapter.runInHydrationScope = (task) => task(adapter)
-  return undefined
-}
-
-// This is a controlled ownership probe, not a scheduler model. Each invocation
-// lends a fresh adapter. A call records both its route and whether its loan is
-// still live. Forwarding wrong calls permits teardown while retaining the
-// reached routing violation. The browser receiver proves the actual cycle.
-function installHydrationRoutingProbe(adapter: PersistenceAdapter) {
-  const direct = adapter.applyCommittedTx.bind(adapter)
-  const calls: Array<{
-    route: `public` | `scoped`
-    scope: number | undefined
-    live: boolean
-    collectionId: string
-  }> = []
-  const active = new Set<number>()
-  let sequence = 0
-  adapter.applyCommittedTx = (collectionId, tx) => {
-    calls.push({
-      route: `public`,
-      scope: [...active].at(-1),
-      live: active.size === 0,
-      collectionId: recordedStorageId(collectionId),
-    })
-    return direct(collectionId, tx)
-  }
-  adapter.runInHydrationScope = async (task) => {
-    const scope = ++sequence
-    active.add(scope)
-    const scopedAdapter: PersistenceAdapter = {
-      ...adapter,
-      applyCommittedTx: (collectionId, tx) => {
-        calls.push({
-          route: `scoped`,
-          scope,
-          live: active.has(scope),
-          collectionId: recordedStorageId(collectionId),
-        })
-        return direct(collectionId, tx)
-      },
-    }
-    try {
-      return await task(scopedAdapter)
-    } finally {
-      active.delete(scope)
-    }
-  }
-  return { calls, violations: () => calls.filter((call) => !call.live) }
-}
-
-// Probe calibration uses an independently specified lifetime table. These are
-// adapter-callback histories, not claims that a shared SQLite scheduler permits
-// concurrent hydrates. Deliberately expired loans and public reentry must remain
-// observable even when another callback exits; successful calls still forward.
-describeUnlessAnyOracleReplay(`hydration routing probe calibration`, () => {
-  it.each([
-    { history: `nested`, exitFirst: 1 },
-    { history: `overlap, first exits first`, exitFirst: 0 },
-    { history: `overlap, second exits first`, exitFirst: 1 },
-  ])(
-    `tracks each callback lifetime: $history`,
-    async ({ history, exitFirst }) => {
-      const adapter = createRecordingAdapter()
-      const routing = installHydrationRoutingProbe(adapter)
-      const release = [createEventGate(), createEventGate()]
-      const loans: Array<PersistenceAdapter> = []
-      const first = adapter.runInHydrationScope!(async (loan) => {
-        loans[0] = loan
-        await release[0]!.promise
-      })
-      const parent = history === `nested` ? loans[0]! : adapter
-      const second = parent.runInHydrationScope!(async (loan) => {
-        loans[1] = loan
-        await release[1]!.promise
-      })
-      const scopes = [first, second]
-      const tx: PersistedTx = {
-        txId: `probe`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [],
-      }
-      const apply = (target: PersistenceAdapter) =>
-        target.applyCommittedTx({ kind: `eager`, collectionId: `probe` }, tx)
-      try {
-        await apply(loans[0]!)
-        await apply(loans[1]!)
-        release[exitFirst]!.resolve()
-        await scopes[exitFirst]
-        await apply(loans[exitFirst]!)
-        await apply(loans[1 - exitFirst]!)
-        await apply(adapter)
-        release[1 - exitFirst]!.resolve()
-        await scopes[1 - exitFirst]
-        await apply(loans[1 - exitFirst]!)
-        await apply(adapter)
-        expect(
-          routing.calls.map(({ route, live }) => ({ route, live })),
-        ).toEqual([
-          { route: `scoped`, live: true },
-          { route: `scoped`, live: true },
-          { route: `scoped`, live: false },
-          { route: `scoped`, live: true },
-          { route: `public`, live: false },
-          { route: `scoped`, live: false },
-          { route: `public`, live: true },
-        ])
-      } finally {
-        release.forEach((gate) => gate.resolve())
-        await Promise.all(scopes)
-      }
-    },
-  )
-
-  // The explicit adapter is sufficient for this call; only ordinary work needs
-  // a registered fallback. Collection construction registers that fallback.
-  it(`uses an explicit adapter without registration and rejects missing ordinary routing`, async () => {
-    const coordinator = new SingleProcessCoordinator()
-    const adapter = createRecordingAdapter()
-    const tx: PersistedTx = {
-      txId: `explicit`,
-      term: 1,
-      seq: 1,
-      rowVersion: 1,
-      mutations: [],
-    }
-    await expect(
-      coordinator.requestApplyCommittedTx(`explicit`, tx, adapter),
-    ).resolves.toBeDefined()
-    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-    await expect(
-      coordinator.requestApplyCommittedTx(`explicit`, tx),
-    ).rejects.toMatchObject({
-      name: `InvalidPersistedCollectionConfigError`,
-    })
-    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
-    coordinator.setAdapterForCollection(`explicit`, adapter)
-    await expect(
-      coordinator.requestApplyCommittedTx(`explicit`, tx),
-    ).resolves.toBeDefined()
-    expect(adapter.applyCommittedTxCalls).toHaveLength(2)
-  })
-
-  // The adapter contract requires call-local forwarding through wrappers. This
-  // positive/hostile pair reaches the real coordinator but lets the recorder
-  // finish bad calls, so losing the loan is a routing assertion, not a timeout.
-  it.each([true, false])(
-    `detects a wrapper that forwards its loan=%s`,
-    async (forward) => {
-      const adapter = createRecordingAdapter()
-      const routing = installHydrationRoutingProbe(adapter)
-      const inner = new SingleProcessCoordinator()
-      inner.setAdapterForCollection(`wrapper`, adapter)
-      const wrapper: PersistedCollectionCoordinator[`requestApplyCommittedTx`] =
-        (id, tx, scoped) =>
-          inner.requestApplyCommittedTx(id, tx, forward ? scoped : undefined)
-      await adapter.runInHydrationScope!(async (scoped) => {
-        await wrapper(
-          `wrapper`,
-          { txId: `nested`, term: 1, seq: 1, rowVersion: 1, mutations: [] },
-          scoped,
-        )
-      })
-      expect(routing.calls.map(({ route, live }) => ({ route, live }))).toEqual(
-        [{ route: forward ? `scoped` : `public`, live: forward }],
-      )
-      expect(routing.violations()).toHaveLength(forward ? 0 : 1)
-    },
-  )
-})
-
-function expectHydrationReceiptsPending(
-  receipts: Array<ReturnType<typeof observeSettlement>>,
-) {
-  expect(
-    receipts.map((receipt) => receipt.read()),
-    `each receipt must wait for its own durable/visible boundary`,
-  ).toEqual(receipts.map(() => ({ status: `pending` })))
+// Durable admission law: only transactions that are not aborted and carry at
+// least one edit reach the durable write path, in submission order. Aborted and
+// empty transactions never admit, so they are not counted or awaited as durable.
+function expectedDurableHydrationTransactions(
+  transactions: Array<HydrationSourceTransaction>,
+): Array<HydrationSourceTransaction> {
+  return transactions.filter((tx) => !tx.abort && tx.edits.length > 0)
 }
 
 // A routing reproduction must not contaminate a requested generated-property
@@ -31515,22 +5215,6 @@ describeUnlessAnyOracleReplay(`hydration source durability routing`, () => {
       ),
   )
 
-  it(`rejects an early individual receipt even while its sibling is pending`, async () => {
-    const pending = createDeferred()
-    const receipts = [
-      observeSettlement(Promise.resolve()),
-      observeSettlement(pending.promise),
-    ]
-    // A task boundary drains promise reactions; no elapsed duration is treated
-    // as progress evidence. The other receipt remains causally held by a gate.
-    await flushAsyncWork()
-    try {
-      expect(() => expectHydrationReceiptsPending(receipts)).toThrow()
-    } finally {
-      pending.resolve()
-    }
-  })
-
   it.each(cases)(
     `$phase scoped=$scoped baseline=$baselineCount $name`,
     async ({ phase, scoped, baselineCount, transactions, failAt }) => {
@@ -31558,9 +5242,8 @@ describeUnlessAnyOracleReplay(`hydration source durability routing`, () => {
         return args[1]?.includeRows === false ? result : held(result)
       }
       adapter.loadSubset = async (...args) => held(await load(...args))
-      const durableTransactions = modelTransactions.filter(
-        (tx) => !tx.abort && tx.edits.length > 0,
-      )
+      const durableTransactions =
+        expectedDurableHydrationTransactions(modelTransactions)
       const admissions = durableTransactions.map(() => createDeferred())
       const releases = durableTransactions.map(() => createDeferred())
       const store = adapter.applyCommittedTx.bind(adapter)
@@ -31960,128 +5643,30 @@ describeUnlessAnyOracleReplay(`hydration source durability routing`, () => {
       }
     },
   )
-  // Cleanup is a history action here, not only teardown. Queued source work
-  // has not entered storage when cleanup invalidates its sync run; releasing
-  // the old read cannot publish/store it in the replacement run. An already
-  // issued storage operation is outside this witness's no-write premise.
-  it.each(
-    [false, true].flatMap((scoped) =>
-      [`startup`, `subscription`].map((phase) => ({ scoped, phase })),
-    ),
+})
+
+// A follower's cache-generation notices: the check and its history grammar
+// live in persisted-support.ts, beside the law they state. The fixed and
+// random campaigns run the same property and budget.
+declareOracle({
+  check: [assertGenerationNoticeHistory],
+  grammar: [generationNoticeHistory],
+})
+
+describe(`persistedCollectionOptions`, () => {
+  fcTest.prop([generationNoticeHistory], {
+    seed: 2069,
+    numRuns: oracleRuns(24),
+  })(
+    `checks generated cache-generation notice histories (fixed)`,
+    assertGenerationNoticeHistory,
+  )
+
+  fcTest.prop(
+    [generationNoticeHistory],
+    oraclePropertyOptions(24, `persistence.generation-notice`),
   )(
-    `cleanup fences a queued source receipt and permits restart: $phase scoped=$scoped`,
-    async ({ scoped, phase }) => {
-      const adapter = createRecordingAdapter()
-      const entered = createDeferred()
-      const release = createDeferred()
-      let holdRead = phase === `startup`
-      const resume = adapter.loadResumeSnapshot.bind(adapter)
-      const load = adapter.loadSubset.bind(adapter)
-      const hold = async <T>(snapshot: T) => {
-        if (holdRead) {
-          holdRead = false
-          entered.resolve()
-          await release.promise
-        }
-        return snapshot
-      }
-      adapter.loadResumeSnapshot = async (...args) => {
-        const snapshot = await resume(...args)
-        return args[1]?.includeRows === false ? snapshot : hold(snapshot)
-      }
-      adapter.loadSubset = async (...args) => hold(await load(...args))
-      const probe = scoped ? installHydrationRoutingProbe(adapter) : undefined
-      let source!: TodoSyncParams
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: `scoped-cleanup-restart`,
-          getKey: (row) => row.id,
-          syncMode: phase === `subscription` ? `on-demand` : `eager`,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const ready = collection.stateWhenReady()
-      void ready.catch(() => undefined)
-      let subset: Promise<unknown> | undefined
-      let receipt: Promise<void> | undefined
-      let hasPrimaryFailure = false
-      try {
-        if (phase === `subscription`) {
-          await atPersistedOracleCheckpoint(ready, `cleanup initial readiness`)
-          holdRead = true
-          subset = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-          void subset.catch(() => undefined)
-        }
-        await atPersistedOracleCheckpoint(entered.promise, `cleanup held read`)
-        source.begin()
-        source.write({
-          type: `insert`,
-          value: { id: `obsolete`, title: `retired sync run` },
-        })
-        receipt = Promise.resolve(source.commit()).then(() => undefined)
-        const receiptState = observeSettlement(receipt)
-        const oldSource = source
-        const cleaning = collection.cleanup()
-        void cleaning.catch(() => undefined)
-        release.resolve()
-        await atPersistedOracleCheckpoint(
-          Promise.allSettled([cleaning, receipt, ready, subset]),
-          `cleanup invalidates buffered work`,
-        )
-        expect(receiptState.read().status).toBe(`rejected`)
-        expect(adapter.applyCommittedTxCalls).toEqual([])
-        expect(adapter.rows.size).toBe(0)
-        expect(collection.status).toBe(`cleaned-up`)
-        await atPersistedOracleCheckpoint(
-          collection.stateWhenReady(),
-          `replacement sync run ready`,
-        )
-        oldSource.begin()
-        oldSource.write({
-          type: `insert`,
-          value: { id: `obsolete`, title: `late callback` },
-        })
-        await oldSource.commit()
-        source.begin()
-        source.write({
-          type: `insert`,
-          value: { id: `fresh`, title: `replacement source` },
-        })
-        await atPersistedOracleCheckpoint(
-          Promise.resolve(source.commit()),
-          `replacement source durable`,
-        )
-        expect(collection.get(`obsolete`)).toBeUndefined()
-        expect(adapter.rows.has(`obsolete`)).toBe(false)
-        expect(stripVirtualProps(collection.get(`fresh`))).toEqual({
-          id: `fresh`,
-          title: `replacement source`,
-        })
-        expect(adapter.rows.get(`fresh`)).toEqual({
-          id: `fresh`,
-          title: `replacement source`,
-        })
-        expect(probe?.violations() ?? []).toEqual([])
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        release.resolve()
-        await cleanupPersistedOracle(
-          [
-            () => Promise.allSettled([ready, subset, receipt]),
-            () => collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    },
+    `checks generated cache-generation notice histories (random or replayed)`,
+    assertGenerationNoticeHistory,
   )
 })
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-readiness-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-readiness-oracle.test.ts
index c1021bcd90..0ce84fe894 100644
--- a/packages/db-sqlite-persistence-core/tests/persisted-readiness-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/persisted-readiness-oracle.test.ts
@@ -1,4 +1,4 @@
-import { createCollection, createLiveQueryCollection } from '@tanstack/db'
+import { createLiveQueryCollection } from '@tanstack/db'
 import {
   afterAll,
   afterEach,
@@ -8,10 +8,18 @@ import {
   it,
   vi,
 } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { createOracleReach } from '../../db/tests/oracle-reach'
-import { persistedCollectionOptions } from '../src/index.js'
-import type { PersistenceAdapter } from '../src/index.js'
-import type { SyncConfig } from '@tanstack/db'
+import {
+  DISK_ROW,
+  REMOTE_FAILURE,
+  REMOTE_REPORT,
+  REMOTE_ROW,
+  RESTORE_FAILURE,
+  TIMEOUT,
+  networkFirst,
+} from './persisted-readiness-support.js'
+import type { Call, Restore } from './persisted-readiness-support.js'
 
 /**
  * # When does a persisted Collection open from restored rows?
@@ -82,11 +90,10 @@ import type { SyncConfig } from '@tanstack/db'
  * The adapter is a controlled in-memory persistence adapter, not native
  * SQLite. Restarts, cross-tab coordination, and on-demand persistence are
  * outside this owner (on-demand rejects network-first configuration). Calls
- * that break the adapter contract are fixed examples below, not generated.
+ * that break the adapter contract, and the option and deadline examples, are
+ * fixed examples in persisted-readiness.test.ts, not generated.
  */
 
-type Row = { id: string; value: string }
-type Restore = `rows` | `empty` | `failed`
 type Remote = `ready` | `ready-report` | `ready-fail` | `fail`
 type Effects = `quiet` | `throwing`
 type Event =
@@ -95,8 +102,6 @@ type Event =
   | { kind: `give-up` }
   | { kind: `deadline` }
 
-// One adapter call. The calls of one event happen in the same tick.
-type Call = `ready` | `report` | `fail`
 const REMOTE_CALLS: Record<Remote, ReadonlyArray<Call>> = {
   ready: [`ready`],
   'ready-report': [`ready`, `report`],
@@ -105,12 +110,6 @@ const REMOTE_CALLS: Record<Remote, ReadonlyArray<Call>> = {
 }
 const GIVE_UP_CALLS: ReadonlyArray<Call> = [`report`, `fail`]
 
-const TIMEOUT = 100
-const DISK_ROW: Row = { id: `disk`, value: `restored` }
-const REMOTE_ROW: Row = { id: `remote`, value: `synced` }
-const RESTORE_FAILURE = `restore failed`
-const REMOTE_FAILURE = `remote gave up`
-const REMOTE_REPORT = `remote retrying`
 const READY_CALLBACK_FAILURE = `ready callback threw`
 const STATUS_LISTENER_FAILURE = `status listener threw`
 
@@ -272,85 +271,8 @@ const reachStates = [
 // Production driver
 // ---------------------------------------------------------------------------
 
-function deferred<T>() {
-  let resolve!: (value: T) => void
-  let reject!: (reason: unknown) => void
-  const promise = new Promise<T>((yes, no) => {
-    resolve = yes
-    reject = no
-  })
-  return { promise, resolve, reject }
-}
-
-// A persistence adapter whose restore read waits for the history to settle it.
-function controlledAdapter() {
-  const load = deferred<ReadonlyArray<Row>>()
-  void load.promise.catch(() => undefined)
-  const adapter: PersistenceAdapter = {
-    loadSubset: async () =>
-      (await load.promise).map((value) => ({ key: value.id, value })),
-    loadResumeSnapshot: async (_id, options) => {
-      const rows = options?.includeRows === false ? [] : await load.promise
-      return {
-        rows: rows.map((value) => ({ key: value.id, value })),
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }
-    },
-    applyCommittedTx: async () => {},
-    ensureIndex: async () => {},
-  }
-  return { adapter, load }
-}
-
-function networkFirst(id: string, initialRender = true) {
-  const fixture = controlledAdapter()
-  let remote: Parameters<SyncConfig<Row, string>[`sync`]>[0] | undefined
-  const collection = createCollection(
-    persistedCollectionOptions<Row, string>({
-      id,
-      getKey: (row) => row.id,
-      persistence: { adapter: fixture.adapter },
-      ...(initialRender
-        ? {
-            initialRender: {
-              strategy: `network-first` as const,
-              networkTimeoutMs: TIMEOUT,
-            },
-          }
-        : {}),
-      sync: {
-        sync: (params) => {
-          remote = params
-        },
-      },
-    }),
-  )
-  return {
-    collection,
-    restore: (outcome: Restore) =>
-      outcome === `failed`
-        ? fixture.load.reject(new Error(RESTORE_FAILURE))
-        : fixture.load.resolve(outcome === `rows` ? [DISK_ROW] : []),
-    // One adapter call, as the remote makes it.
-    call: (call: Call) => {
-      if (call === `ready`) {
-        remote!.begin()
-        remote!.write({ type: `insert`, value: REMOTE_ROW })
-        remote!.commit()
-        remote!.markReady()
-      } else if (call === `report`) {
-        remote!.reportError(new Error(REMOTE_REPORT))
-      } else {
-        remote!.fail(new Error(REMOTE_FAILURE))
-      }
-    },
-  }
-}
+// The controlled adapter and network-first Collection live in
+// persisted-readiness-support.ts, shared with the fixed examples.
 
 // Registers ready effects that throw: a first-ready callback and a status
 // listener. Both run after the status reads `ready`.
@@ -460,117 +382,6 @@ describe(`persisted readiness oracle`, () => {
       await source.collection.cleanup({ dependents: true })
     }
   })
-
-  // The wrapper delivers the adapter's calls after startup, so a contract
-  // violation cannot throw back at the adapter. It crashes the Collection
-  // with the violation as its cause, as a throwing sync function does.
-  it.each([
-    {
-      violation: `reportError() before markReady()`,
-      calls: [`report`] as const,
-      cause: /reportError/,
-    },
-  ])(`crashes on $violation`, async ({ violation, calls, cause }) => {
-    const source = networkFirst(`contract-violation ${violation}`, false)
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    try {
-      void source.collection.preload().catch(() => undefined)
-      source.restore(`empty`)
-      await vi.advanceTimersByTimeAsync(0)
-      calls.forEach(source.call)
-      await vi.advanceTimersByTimeAsync(0)
-      expect(source.collection.status).toBe(`crashed`)
-      expect(source.collection.health.error?.message).toMatch(cause)
-    } finally {
-      consoleError.mockRestore()
-      await source.collection.cleanup({ dependents: true })
-    }
-  })
-
-  // A run's markReady() after its fail() does nothing (core API decision
-  // F18/F6): the stopped Collection stays ready with its error.
-  it(`ignores markReady() after fail() on a ready Collection`, async () => {
-    const source = networkFirst(`mark-ready-after-fail`, false)
-    try {
-      void source.collection.preload().catch(() => undefined)
-      source.restore(`empty`)
-      await vi.advanceTimersByTimeAsync(0)
-      for (const call of [`ready`, `fail`, `ready`] as const) source.call(call)
-      await vi.advanceTimersByTimeAsync(0)
-      expect({
-        status: source.collection.status,
-        error: source.collection.health.error?.message,
-      }).toEqual({ status: `ready`, error: REMOTE_FAILURE })
-    } finally {
-      await source.collection.cleanup({ dependents: true })
-    }
-  })
-
-  it(`keeps a Collection without initialRender on the network boundary`, async () => {
-    const source = networkFirst(`no-initial-render`, false)
-    try {
-      void source.collection.preload().catch(() => undefined)
-      source.restore(`rows`)
-      await vi.advanceTimersByTimeAsync(TIMEOUT * 10)
-      expect(source.collection.status).toBe(`loading`)
-      source.call(`ready`)
-      await vi.advanceTimersByTimeAsync(0)
-      expect(source.collection.status).toBe(`ready`)
-    } finally {
-      await source.collection.cleanup({ dependents: true })
-    }
-  })
-
-  it(`defaults the network-first deadline to three seconds`, async () => {
-    const fixture = controlledAdapter()
-    const collection = createCollection(
-      persistedCollectionOptions<Row, string>({
-        id: `default-network-deadline`,
-        getKey: (row) => row.id,
-        persistence: { adapter: fixture.adapter },
-        initialRender: { strategy: `network-first` },
-        sync: { sync: () => {} },
-      }),
-    )
-    try {
-      void collection.preload().catch(() => undefined)
-      fixture.load.resolve([DISK_ROW])
-      await vi.advanceTimersByTimeAsync(2_999)
-      expect(collection.status).toBe(`loading`)
-      await vi.advanceTimersByTimeAsync(1)
-      expect(collection.status).toBe(`ready`)
-    } finally {
-      await collection.cleanup({ dependents: true })
-    }
-  })
-
-  it(`rejects network-first initial rendering for on-demand persistence`, () => {
-    const fixture = controlledAdapter()
-    expect(() =>
-      persistedCollectionOptions<Row, string>({
-        id: `local-on-demand`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        initialRender: { strategy: `network-first`, networkTimeoutMs: 100 },
-        persistence: { adapter: fixture.adapter },
-      }),
-    ).toThrow(/network-first.*eager/i)
-  })
-
-  it.each([-1, Number.NaN, Number.POSITIVE_INFINITY, 2_147_483_648])(
-    `rejects an invalid network timeout (%s)`,
-    (networkTimeoutMs) => {
-      const fixture = controlledAdapter()
-      expect(() =>
-        persistedCollectionOptions<Row, string>({
-          id: `invalid-network-deadline`,
-          getKey: (row) => row.id,
-          persistence: { adapter: fixture.adapter },
-          initialRender: { strategy: `network-first`, networkTimeoutMs },
-        }),
-      ).toThrow(/networkTimeoutMs/)
-    },
-  )
 })
 
 // Marks the declared states the history enters with its next event, as the
@@ -611,3 +422,5 @@ function describe_(events: ReadonlyArray<Event>): string {
     )
     .join(` > `)
 }
+
+declareOracle({ model: [expected], grammar: [histories] })
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-readiness-support.ts b/packages/db-sqlite-persistence-core/tests/persisted-readiness-support.ts
new file mode 100644
index 0000000000..15194a6827
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-readiness-support.ts
@@ -0,0 +1,100 @@
+import { createCollection } from '@tanstack/db'
+import { persistedCollectionOptions } from '../src/index.js'
+import type { PersistenceAdapter } from '../src/index.js'
+import type { SyncConfig } from '@tanstack/db'
+
+// The controlled persistence adapter and network-first Collection that the
+// persisted-readiness oracle drives, shared with its fixed examples in
+// persisted-readiness.test.ts. They compare nothing.
+
+export type Row = { id: string; value: string }
+export type Restore = `rows` | `empty` | `failed`
+// One adapter call. The calls of one event happen in the same tick.
+export type Call = `ready` | `report` | `fail`
+
+export const TIMEOUT = 100
+export const DISK_ROW: Row = { id: `disk`, value: `restored` }
+export const REMOTE_ROW: Row = { id: `remote`, value: `synced` }
+export const RESTORE_FAILURE = `restore failed`
+export const REMOTE_FAILURE = `remote gave up`
+export const REMOTE_REPORT = `remote retrying`
+
+export function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (reason: unknown) => void
+  const promise = new Promise<T>((yes, no) => {
+    resolve = yes
+    reject = no
+  })
+  return { promise, resolve, reject }
+}
+
+// A persistence adapter whose restore read waits for the history to settle it.
+export function controlledAdapter() {
+  const load = deferred<ReadonlyArray<Row>>()
+  void load.promise.catch(() => undefined)
+  const adapter: PersistenceAdapter = {
+    loadSubset: async () =>
+      (await load.promise).map((value) => ({ key: value.id, value })),
+    loadResumeSnapshot: async (_id, options) => {
+      const rows = options?.includeRows === false ? [] : await load.promise
+      return {
+        rows: rows.map((value) => ({ key: value.id, value })),
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }
+    },
+    applyCommittedTx: async () => {},
+    ensureIndex: async () => {},
+  }
+  return { adapter, load }
+}
+
+export function networkFirst(id: string, initialRender = true) {
+  const fixture = controlledAdapter()
+  let remote: Parameters<SyncConfig<Row, string>[`sync`]>[0] | undefined
+  const collection = createCollection(
+    persistedCollectionOptions<Row, string>({
+      id,
+      getKey: (row) => row.id,
+      persistence: { adapter: fixture.adapter },
+      ...(initialRender
+        ? {
+            initialRender: {
+              strategy: `network-first` as const,
+              networkTimeoutMs: TIMEOUT,
+            },
+          }
+        : {}),
+      sync: {
+        sync: (params) => {
+          remote = params
+        },
+      },
+    }),
+  )
+  return {
+    collection,
+    restore: (outcome: Restore) =>
+      outcome === `failed`
+        ? fixture.load.reject(new Error(RESTORE_FAILURE))
+        : fixture.load.resolve(outcome === `rows` ? [DISK_ROW] : []),
+    // One adapter call, as the remote makes it.
+    call: (call: Call) => {
+      if (call === `ready`) {
+        remote!.begin()
+        remote!.write({ type: `insert`, value: REMOTE_ROW })
+        remote!.commit()
+        remote!.markReady()
+      } else if (call === `report`) {
+        remote!.reportError(new Error(REMOTE_REPORT))
+      } else {
+        remote!.fail(new Error(REMOTE_FAILURE))
+      }
+    },
+  }
+}
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-readiness.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-readiness.test.ts
new file mode 100644
index 0000000000..00b0e3e8dd
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-readiness.test.ts
@@ -0,0 +1,136 @@
+// Fixed examples of the persisted-readiness contract: an adapter-contract
+// violation, markReady() after fail(), a Collection without initialRender, the
+// default deadline, and option validation, asserted against literal values. The
+// readiness law, its model, and its generated histories are owned by
+// persisted-readiness-oracle.test.ts.
+import { createCollection } from '@tanstack/db'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { persistedCollectionOptions } from '../src/index.js'
+import {
+  DISK_ROW,
+  REMOTE_FAILURE,
+  TIMEOUT,
+  controlledAdapter,
+  networkFirst,
+} from './persisted-readiness-support.js'
+import type { Row } from './persisted-readiness-support.js'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe(`persisted readiness examples`, () => {
+  // The wrapper delivers the adapter's calls after startup, so a contract
+  // violation cannot throw back at the adapter. It crashes the Collection
+  // with the violation as its cause, as a throwing sync function does.
+  it.each([
+    {
+      violation: `reportError() before markReady()`,
+      calls: [`report`] as const,
+      cause: /reportError/,
+    },
+  ])(`crashes on $violation`, async ({ violation, calls, cause }) => {
+    const source = networkFirst(`contract-violation ${violation}`, false)
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    try {
+      void source.collection.preload().catch(() => undefined)
+      source.restore(`empty`)
+      await vi.advanceTimersByTimeAsync(0)
+      calls.forEach(source.call)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(source.collection.status).toBe(`crashed`)
+      expect(source.collection.health.error?.message).toMatch(cause)
+    } finally {
+      consoleError.mockRestore()
+      await source.collection.cleanup({ dependents: true })
+    }
+  })
+
+  // A run's markReady() after its fail() does nothing (core API decision
+  // F18/F6): the stopped Collection stays ready with its error.
+  it(`ignores markReady() after fail() on a ready Collection`, async () => {
+    const source = networkFirst(`mark-ready-after-fail`, false)
+    try {
+      void source.collection.preload().catch(() => undefined)
+      source.restore(`empty`)
+      await vi.advanceTimersByTimeAsync(0)
+      for (const call of [`ready`, `fail`, `ready`] as const) source.call(call)
+      await vi.advanceTimersByTimeAsync(0)
+      expect({
+        status: source.collection.status,
+        error: source.collection.health.error?.message,
+      }).toEqual({ status: `ready`, error: REMOTE_FAILURE })
+    } finally {
+      await source.collection.cleanup({ dependents: true })
+    }
+  })
+
+  it(`keeps a Collection without initialRender on the network boundary`, async () => {
+    const source = networkFirst(`no-initial-render`, false)
+    try {
+      void source.collection.preload().catch(() => undefined)
+      source.restore(`rows`)
+      await vi.advanceTimersByTimeAsync(TIMEOUT * 10)
+      expect(source.collection.status).toBe(`loading`)
+      source.call(`ready`)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(source.collection.status).toBe(`ready`)
+    } finally {
+      await source.collection.cleanup({ dependents: true })
+    }
+  })
+
+  it(`defaults the network-first deadline to three seconds`, async () => {
+    const fixture = controlledAdapter()
+    const collection = createCollection(
+      persistedCollectionOptions<Row, string>({
+        id: `default-network-deadline`,
+        getKey: (row) => row.id,
+        persistence: { adapter: fixture.adapter },
+        initialRender: { strategy: `network-first` },
+        sync: { sync: () => {} },
+      }),
+    )
+    try {
+      void collection.preload().catch(() => undefined)
+      fixture.load.resolve([DISK_ROW])
+      await vi.advanceTimersByTimeAsync(2_999)
+      expect(collection.status).toBe(`loading`)
+      await vi.advanceTimersByTimeAsync(1)
+      expect(collection.status).toBe(`ready`)
+    } finally {
+      await collection.cleanup({ dependents: true })
+    }
+  })
+
+  it(`rejects network-first initial rendering for on-demand persistence`, () => {
+    const fixture = controlledAdapter()
+    expect(() =>
+      persistedCollectionOptions<Row, string>({
+        id: `local-on-demand`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        initialRender: { strategy: `network-first`, networkTimeoutMs: 100 },
+        persistence: { adapter: fixture.adapter },
+      }),
+    ).toThrow(/network-first.*eager/i)
+  })
+
+  it.each([-1, Number.NaN, Number.POSITIVE_INFINITY, 2_147_483_648])(
+    `rejects an invalid network timeout (%s)`,
+    (networkTimeoutMs) => {
+      const fixture = controlledAdapter()
+      expect(() =>
+        persistedCollectionOptions<Row, string>({
+          id: `invalid-network-deadline`,
+          getKey: (row) => row.id,
+          persistence: { adapter: fixture.adapter },
+          initialRender: { strategy: `network-first`, networkTimeoutMs },
+        }),
+      ).toThrow(/networkTimeoutMs/)
+    },
+  )
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-real-adapter-lifecycle.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-real-adapter-lifecycle.test.ts
index ce5531e686..70b8f1c98d 100644
--- a/packages/db-sqlite-persistence-core/tests/persisted-real-adapter-lifecycle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/persisted-real-adapter-lifecycle.test.ts
@@ -28,7 +28,7 @@ import {
   createSQLiteCorePersistenceAdapter,
   persistedCollectionOptions,
 } from '../src'
-import { SqliteCliDriver } from './sqlite-core-adapter-oracle.test'
+import { SqliteCliDriver } from './sqlite-core-adapter-support'
 import { cleanupTestActions } from './test-cleanup'
 import type { SyncConfig } from '@tanstack/db'
 import type { PersistenceAdapter, SQLiteDriver } from '../src'
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-reconciliation.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-reconciliation.test.ts
new file mode 100644
index 0000000000..b7c979ab63
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-reconciliation.test.ts
@@ -0,0 +1,1625 @@
+/**
+ * Ordinary regression tests for persisted source reconciliation, collection reset, and reload ordering with fixed scenarios. The oracle that owns these laws, including the reconciliation model, is persisted-oracle.test.ts; its generated and model-checked cases stay there.
+ */
+import { expect, it, vi } from 'vitest'
+import {
+  DbClient,
+  collectionOptions,
+  createCollection,
+  createLiveQueryCollection,
+} from '@tanstack/db'
+import {
+  IndeterminateCommitError,
+  PersistedCollectionDurabilityError,
+  persistedCollectionOptions,
+} from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createDeferred,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createRecordingAdapter,
+  expectExactSnapshot,
+  flushAsyncWork,
+  observeSettlement,
+  overrideBaselineRows,
+  stripVirtualProps,
+} from './persisted-support'
+import type { LoadSubsetOptions, SyncMetadataApi } from '@tanstack/db'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+// A logical subset owner can retire while a managed cache claim is being
+// renewed. The independent ownership law says only a retained demand may
+// establish a physical remote acquisition. Hold renewal after the wrapper's
+// admission check, then either retire or retain the request before releasing
+// the gate. Compare coordinator acquisition work when the load settles; the
+// retained neighbor proves this cut still permits one valid acquisition.
+it.each([false, true])(
+  `starts remote acquisition after claim renewal only when demand remains retained (retire=%s)`,
+  async (retire) => {
+    const adapter = createRecordingAdapter()
+    const renewalEntered = createEventGate()
+    const releaseRenewal = createEventGate()
+    let holdRenewal = false
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: `review-claim-storage`,
+      claimId: `review-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.renewCacheGenerationClaim = async () => {
+      if (holdRenewal) {
+        renewalEntered.resolve()
+        await releaseRenewal.promise
+      }
+      return Date.now() + 10_000
+    }
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: `review-rotated-storage`,
+      claimId: `review-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    })
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const coordinator = createFailStopCoordinatorHarness(`review-unload`)
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `review-unload`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            params.markReady()
+            return {
+              loadSubset: async () => {},
+              restartAfterScopedRecovery: () => {},
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const options: LoadSubsetOptions = { limit: 1 }
+    try {
+      await collection.stateWhenReady()
+      holdRenewal = true
+      const load = Promise.resolve(collection._sync.loadSubset(options))
+      await atPersistedOracleCheckpoint(
+        renewalEntered.promise,
+        `claim renewal entered`,
+      )
+      if (retire) collection._sync.unloadSubset(options)
+      releaseRenewal.resolve()
+      await atPersistedOracleCheckpoint(load, `late load settled`)
+      expect(coordinator.remoteEnsureCalls).toHaveLength(retire ? 0 : 1)
+    } finally {
+      releaseRenewal.resolve()
+      await collection.cleanup()
+    }
+  },
+)
+
+// A cache read can lose its claim at the post-read check. The reference
+// ownership law keeps the admitted demand through rotation and gives it one
+// replacement acquisition. Hold that acquisition to compare both its work
+// count and the caller's settlement before and after source completion.
+// The neighboring pre-read loss and peer-notice histories exercise different
+// rotation cuts; this one specifically reaches the post-read renewal cut.
+it(`does not request a rotated in-flight subset twice`, async () => {
+  const adapter = createRecordingAdapter()
+  const coordinator = createFailStopCoordinatorHarness(`review-duplicate`)
+  const ensureStarted = createEventGate()
+  const releaseEnsure = createEventGate()
+  coordinator.requestEnsureRemoteSubset = async (_id, options) => {
+    coordinator.remoteEnsureCalls.push(options)
+    ensureStarted.resolve()
+    await releaseEnsure.promise
+  }
+  let storageId = `review-duplicate-old`
+  let loseClaim = false
+  let loseAfterRead = false
+  const originalLoadSubset = adapter.loadSubset.bind(adapter)
+  adapter.loadSubset = async (...args) => {
+    const rows = await originalLoadSubset(...args)
+    if (loseAfterRead) {
+      loseAfterRead = false
+      loseClaim = true
+    }
+    return rows
+  }
+  adapter.claimCacheGeneration = async () => ({
+    storageCollectionId: storageId,
+    claimId: `review-duplicate-claim`,
+    expiresAtMs: Date.now() + 10_000,
+  })
+  adapter.renewCacheGenerationClaim = async () =>
+    loseClaim ? undefined : Date.now() + 10_000
+  adapter.rotateCacheGeneration = async () => {
+    loseClaim = false
+    storageId = `review-duplicate-new`
+    return {
+      storageCollectionId: storageId,
+      claimId: `review-duplicate-claim`,
+      expiresAtMs: Date.now() + 10_000,
+    }
+  }
+  adapter.releaseCacheGenerationClaim = async () => {}
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: `review-duplicate`,
+      syncMode: `on-demand`,
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: async () => {},
+            restartAfterScopedRecovery: () => {},
+          }
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  try {
+    await collection.stateWhenReady()
+    loseAfterRead = true
+    const load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+    await atPersistedOracleCheckpoint(
+      ensureStarted.promise,
+      `replacement acquisition`,
+    )
+    await flushAsyncWork()
+    expect(storageId).toBe(`review-duplicate-new`)
+    expect(coordinator.remoteEnsureCalls).toHaveLength(1)
+    let settled = false
+    void load.then(
+      () => {
+        settled = true
+      },
+      () => {
+        settled = true
+      },
+    )
+    await flushAsyncWork()
+    expect(settled).toBe(false)
+    releaseEnsure.resolve()
+    await atPersistedOracleCheckpoint(load, `replacement demand settlement`)
+    expect(coordinator.remoteEnsureCalls).toHaveLength(1)
+  } finally {
+    releaseEnsure.resolve()
+    await collection.cleanup()
+  }
+})
+
+// Reconciliation after a lost answer can arrive even when a peer already
+// published the original tx:committed. A duplicate proof must not turn an
+// unchanged durable snapshot into a second public change batch. This owner
+// checks the persisted wrapper and mounted dependent graph, not SQLite or a
+// browser transport. The notification's explicit flag reaches the equal-seq
+// branch that ordinary tx deduplication would skip. An orphan row-metadata
+// entry is not part of the loaded row snapshot; an unchanged-row shortcut
+// must still remove it, as an ordinary full replacement does. The held subset
+// read exposes the pending cut; the final comparison waits for the public
+// metadata cleanup and checks that neither Collection published a row event.
+it(`does not republish unchanged rows for a repeated reconciliation notice`, async () => {
+  const adapter = createRecordingAdapter([{ id: `crossing`, title: `settled` }])
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-reconciliation-repeat`
+  const reloadEntered = createDeferred()
+  const releaseReload = createDeferred()
+  let source!: TodoSyncParams
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          source = params
+          params.markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  const live = createLiveQueryCollection((q) => q.from({ row: collection }))
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
+    await atPersistedOracleCheckpoint(live.preload(), `live query ready`)
+    source.begin()
+    source.metadata?.row.set(`ghost`, { stale: true })
+    await atPersistedOracleCheckpoint(
+      Promise.resolve(source.commit()),
+      `orphan row metadata applied`,
+    )
+    expect(source.metadata?.row.get(`ghost`)).toEqual({ stale: true })
+    const sourceEvents: Array<string> = []
+    const liveEvents: Array<string> = []
+    const sourceSubscription = collection.subscribeChanges((changes) => {
+      sourceEvents.push(...changes.map(({ key }) => String(key)))
+    })
+    const liveSubscription = live.subscribeChanges((changes) => {
+      liveEvents.push(...changes.map(({ key }) => String(key)))
+    })
+    try {
+      const loadSubset = adapter.loadSubset
+      adapter.loadSubset = async (...args) => {
+        reloadEntered.resolve()
+        await releaseReload.promise
+        return loadSubset(...args)
+      }
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `crossing`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+          reconciliationReload: true,
+        },
+        `replacement`,
+        collectionId,
+      )
+      await atPersistedOracleCheckpoint(
+        reloadEntered.promise,
+        `reconciliation reload entered`,
+      )
+      await flushAsyncWork()
+      expect(source.metadata?.row.get(`ghost`)).toEqual({ stale: true })
+      expect({ sourceEvents, liveEvents }).toEqual({
+        sourceEvents: [],
+        liveEvents: [],
+      })
+      releaseReload.resolve()
+      await vi.waitFor(() =>
+        expect(source.metadata?.row.get(`ghost`)).toBeUndefined(),
+      )
+      await flushAsyncWork()
+      expect({
+        sourceEvents,
+        liveEvents,
+        sourceIds: [...collection.keys()].sort(),
+        liveIds: [...live.keys()].sort(),
+        orphanMetadata: source.metadata?.row.get(`ghost`),
+        status: collection.status,
+        liveStatus: live.status,
+      }).toEqual({
+        sourceEvents: [],
+        liveEvents: [],
+        sourceIds: [`crossing`],
+        liveIds: [`crossing`],
+        orphanMetadata: undefined,
+        status: `ready`,
+        liveStatus: `ready`,
+      })
+    } finally {
+      liveSubscription.unsubscribe()
+      sourceSubscription.unsubscribe()
+    }
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseReload.resolve()
+    await cleanupPersistedOracle(
+      [() => live.cleanup(), () => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// SQLite stores array holes as null and omits enumerable array properties
+// outside the indexed elements. A source Collection can still hold the
+// authored array shape before a reconciliation reload. The durable row below
+// is the independent reference; the public source and live-query rows must
+// publish it at this checkpoint, even when general change-event equality
+// considers the arrays equal. The held subset read keeps the authored shape
+// visible at the pending cut; the settled cut compares both public shapes.
+it.each([`sparse slot`, `extra array property`] as const)(
+  `publishes the durable array shape after a reconciliation reload: %s`,
+  async (shape) => {
+    const authoredValues: Array<string | null> =
+      shape === `sparse slot`
+        ? Array<string | null>(1)
+        : Object.assign([`kept`], { extra: `not durable` })
+    const durableValues: Array<string | null> =
+      shape === `sparse slot` ? [null] : [`kept`]
+    const adapter = createRecordingAdapter([
+      { id: `crossing`, title: `source`, values: authoredValues },
+    ])
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `source-array-shape-${shape}`
+    const reloadEntered = createDeferred()
+    const releaseReload = createDeferred()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        getKey: (row) => row.id,
+        sync: { sync: (params) => params.markReady() },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const live = createLiveQueryCollection((q) => q.from({ row: collection }))
+    let hasPrimaryFailure = false
+    const shapeOf = (values: Array<string | null> | undefined) => ({
+      indexedKeys: values
+        ? Object.keys(values).filter((key) => key === `0`)
+        : [],
+      firstValue: values?.[0],
+      hasExtra: values ? Object.hasOwn(values, `extra`) : false,
+    })
+    try {
+      await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
+      await atPersistedOracleCheckpoint(live.preload(), `live query ready`)
+      const loadSubset = adapter.loadSubset
+      adapter.loadSubset = async (...args) => {
+        reloadEntered.resolve()
+        await releaseReload.promise
+        return loadSubset(...args)
+      }
+      adapter.rows.set(`crossing`, {
+        id: `crossing`,
+        title: `source`,
+        values: durableValues,
+      })
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `crossing`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+          reconciliationReload: true,
+        },
+        `replacement`,
+        collectionId,
+      )
+      await atPersistedOracleCheckpoint(
+        reloadEntered.promise,
+        `durable array reload entered`,
+      )
+      await flushAsyncWork()
+      const expectedShape = shapeOf(durableValues)
+      const authoredShape = shapeOf(authoredValues)
+      expect({
+        source: shapeOf(collection.get(`crossing`)?.values),
+        live: shapeOf(live.get(`crossing`)?.values),
+        durable: shapeOf(adapter.rows.get(`crossing`)?.values),
+      }).toEqual({
+        source: authoredShape,
+        live: authoredShape,
+        durable: expectedShape,
+      })
+      releaseReload.resolve()
+      await vi.waitFor(() =>
+        expect({
+          source: shapeOf(collection.get(`crossing`)?.values),
+          live: shapeOf(live.get(`crossing`)?.values),
+        }).toEqual({ source: expectedShape, live: expectedShape }),
+      )
+      await flushAsyncWork()
+      expect({
+        source: shapeOf(collection.get(`crossing`)?.values),
+        live: shapeOf(live.get(`crossing`)?.values),
+        durable: shapeOf(adapter.rows.get(`crossing`)?.values),
+      }).toEqual({
+        source: expectedShape,
+        live: expectedShape,
+        durable: expectedShape,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseReload.resolve()
+      await cleanupPersistedOracle(
+        [() => live.cleanup(), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// A reconciliation reload compares the resulting public snapshot, not the raw
+// durable relation. A DbClient seed can be absent from storage or have an older
+// durable value while an ordinary row is unchanged. The independent model
+// overlays that seed on the durable relation, then expects zero new change
+// batches at the settled reload checkpoint. The ordinary row makes a delete-
+// then-reinsert shortcut observable even though final rows would match.
+it.each([`absent`, `older`] as const)(
+  `does not republish an unchanged row beside an %s hydrated seed`,
+  async (seedCache) => {
+    const ordinary = { id: `ordinary`, title: `Durable` }
+    const seed = { id: `seed`, title: `Hydrated` }
+    const olderSeed = { id: seed.id, title: `Older durable` }
+    const adapter = createRecordingAdapter([
+      ordinary,
+      ...(seedCache === `older` ? [olderSeed] : []),
+    ])
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `reconciliation-seed-${seedCache}`
+    let source!: TodoSyncParams
+    const descriptor = collectionOptions(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const client = new DbClient()
+    const seedMetadata = { owner: `hydrated` }
+    client.hydrate({
+      collections: [
+        {
+          collectionId,
+          rows: [{ key: seed.id, value: seed, metadata: seedMetadata }],
+        },
+      ],
+    })
+    const collection = client.collection(descriptor)
+    const demand = {}
+    let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
+    let hasPrimaryFailure = false
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      await collection._sync.loadSubset(demand)
+      const expected = new Map<string, Todo>([
+        [ordinary.id, ordinary],
+        [seed.id, seed],
+      ])
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      expectExactSnapshot(publicRows(), expected)
+      expect(source.metadata?.row.get(seed.id)).toEqual(seedMetadata)
+      const eventKeys: Array<string> = []
+      subscription = collection.subscribeChanges(
+        (changes) => {
+          eventKeys.push(...changes.map(({ key }) => String(key)))
+        },
+        { includeInitialState: false },
+      )
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId },
+        { txId: `repeat`, term: 1, seq: 1, rowVersion: 1, mutations: [] },
+      )
+      const reloadSettled = createEventGate()
+      adapter.runInHydrationScope = async (task) => {
+        const result = await task(adapter)
+        reloadSettled.resolve()
+        return result
+      }
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `repeat`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+          reconciliationReload: true,
+        },
+        undefined,
+        collectionId,
+      )
+      await atPersistedOracleCheckpoint(
+        reloadSettled.promise,
+        `seed reconciliation reload settled`,
+      )
+      await flushAsyncWork()
+      expectExactSnapshot(publicRows(), expected)
+      expect(source.metadata?.row.get(seed.id)).toEqual(seedMetadata)
+      expect(eventKeys).toEqual([])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      subscription?.unsubscribe()
+      collection._sync.unloadSubset(demand)
+      await cleanupPersistedOracle([() => client.cleanup()], hasPrimaryFailure)
+    }
+  },
+)
+
+// A real version gap can arrive after a baseline row was published while the
+// coordinator offers no pullSince capability. The independent durable ledger
+// has versions 1, 2, and 3; the passive Collection sees only version 3's notice.
+// The fallback must replace its rows in one public publication. Recording each
+// change callback catches a transient empty snapshot that a final-only
+// assertion would miss.
+it(`publishes a durable gap reload without an empty intermediate snapshot`, async () => {
+  const adapter = createRecordingAdapter()
+  const coordinator = createCoordinatorHarness()
+  coordinator.pullSince = undefined
+  const collectionId = `source-atomic-gap-fallback`
+  const durableWrite = (id: string, term: number, rowVersion: number) =>
+    adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        txId: id,
+        term,
+        seq: 1,
+        rowVersion,
+        mutations: [{ type: `insert`, key: id, value: { id, title: id } }],
+      },
+    )
+  await durableWrite(`old`, 1, 1)
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: { sync: (params) => params.markReady() },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  const exposed: Array<Array<string>> = []
+  let stopPublication = () => {}
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(collection.preload(), `baseline ready`)
+    expect([...collection.keys()]).toEqual([`old`])
+    const publication = collection.subscribeChanges(
+      () => exposed.push([...collection.keys()].sort()),
+      { includeInitialState: false },
+    )
+    stopPublication = () => publication.unsubscribe()
+    await durableWrite(`missed`, 2, 2)
+    await durableWrite(`received`, 3, 3)
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 3,
+        seq: 1,
+        txId: `received`,
+        latestRowVersion: 3,
+        requiresFullReload: false,
+        changedRows: [
+          { key: `received`, value: { id: `received`, title: `received` } },
+        ],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() =>
+      expect([...collection.keys()].sort()).toEqual([
+        `missed`,
+        `old`,
+        `received`,
+      ]),
+    )
+    expect(exposed.length).toBeGreaterThan(0)
+    const complete = [`missed`, `old`, `received`]
+    for (const rows of exposed) {
+      expect([[`old`], complete]).toContainEqual(rows)
+    }
+    expect(exposed.at(-1)).toEqual(complete)
+    expect(coordinator.pullSinceCalls).toBe(0)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    stopPublication()
+    await cleanupPersistedOracle(
+      [() => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// Row versions cross election terms even when an owner commits no rows.
+// The authored durable ledger has a missed term-1 row, an empty term-2
+// election, and a term-3 row. The passive Collection only receives the final
+// notification. Its public snapshot must contain both durable rows after that
+// notification settles; applying only the term-3 delta is a false green if the
+// oracle checks only the latest key. This controlled adapter supplies durable
+// writes and the coordinator supplies the lost-notice schedule.
+it(`recovers a missed commit across a no-write election`, async () => {
+  const adapter = createRecordingAdapter()
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-empty-election-gap`
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: { sync: (params) => params.markReady() },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
+    const durableWrite = async (
+      txId: string,
+      term: number,
+      rowVersion: number,
+    ) => {
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId,
+          term,
+          seq: 1,
+          rowVersion,
+          mutations: [
+            { type: `insert`, key: txId, value: { id: txId, title: txId } },
+          ],
+        },
+      )
+    }
+    await durableWrite(`missed`, 1, 1)
+    // The controlled ledger jumps over term 2 without simulating its election.
+    // The real SQLite/OPFS owner checks durable no-write term reservation.
+    await durableWrite(`received`, 3, 2)
+    expect([...collection.keys()]).toEqual([])
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 3,
+        seq: 1,
+        txId: `received`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [
+          { key: `received`, value: { id: `received`, title: `received` } },
+        ],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() =>
+      expect([...collection.keys()].sort()).toEqual([`missed`, `received`]),
+    )
+    expect(coordinator.pullSinceCalls).toBe(1)
+    expect([...adapter.rows.keys()].sort()).toEqual([`missed`, `received`])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupPersistedOracle(
+      [() => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// Metadata-only certification can observe a durable stream position without
+// loading its rows. That evidence must not make a later same-position notice
+// look publicly applied. The authored log again has two durable rows; the
+// Collection is empty at the certification cut, then receives the term-3
+// notice and must recover both rows at the settled public checkpoint.
+it(`recovers missed rows after position-only resume certification`, async () => {
+  const adapter = createRecordingAdapter()
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-position-only-certification-gap`
+  let persistenceCapability:
+    NonNullable<SyncMetadataApi<string>[`persistence`]> | undefined
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      syncMode: `on-demand`,
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady, metadata }) => {
+          persistenceCapability = metadata?.persistence ?? undefined
+          markReady()
+          return { loadSubset: () => true }
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  let hasPrimaryFailure = false
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(persistenceCapability).toBeDefined())
+    await atPersistedOracleCheckpoint(
+      Promise.resolve(collection._sync.loadSubset({})).then(() => undefined),
+      `empty subset loaded before position certification`,
+    )
+    const durableWrite = async (
+      txId: string,
+      term: number,
+      rowVersion: number,
+    ) =>
+      adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId,
+          term,
+          seq: 1,
+          rowVersion,
+          mutations: [
+            { type: `insert`, key: txId, value: { id: txId, title: txId } },
+          ],
+        },
+      )
+    await durableWrite(`missed`, 1, 1)
+    await durableWrite(`received`, 3, 2)
+    await atPersistedOracleCheckpoint(
+      persistenceCapability!.resumeSnapshot.certify(),
+      `position-only certification`,
+    )
+    expect([...collection.keys()]).toEqual([])
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 3,
+        seq: 1,
+        txId: `received`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [
+          { key: `received`, value: { id: `received`, title: `received` } },
+        ],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() =>
+      expect([...collection.keys()].sort()).toEqual([`missed`, `received`]),
+    )
+    expect(coordinator.pullSinceCalls).toBe(1)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupPersistedOracle(
+      [() => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// A schema reset starts a new row-version series. The independent ledger is
+// five published rows, a durable reset to an empty table at version 0, then a
+// new leader's first version-1 row. The controlled snapshot supplies the
+// reset epoch and position while the real wrapper handles the notification.
+// At the settled cut, the public Collection must contain only the new row.
+it(`accepts a lower row version after a collection reset`, async () => {
+  const initial = Array.from({ length: 5 }, (_, index) => ({
+    id: `old-${index + 1}`,
+    title: `old`,
+  }))
+  const adapter = createRecordingAdapter(initial)
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-reset-version-rebase`
+  let position = { term: 1, seq: 5, rowVersion: 5, resetEpoch: 0 }
+  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+  adapter.loadResumeSnapshot = async (...args) => ({
+    ...(await loadResumeSnapshot(...args)),
+    latestTerm: position.term,
+    latestSeq: position.seq,
+    latestRowVersion: position.rowVersion,
+    resetEpoch: position.resetEpoch,
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: { sync: (params) => params.markReady() },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(
+      collection.preload(),
+      `reset source ready`,
+    )
+    expect([...collection.keys()].sort()).toEqual(initial.map((row) => row.id))
+
+    const resetSettled = createEventGate()
+    adapter.runInHydrationScope = async (task) => {
+      const result = await task(adapter)
+      resetSettled.resolve()
+      return result
+    }
+
+    adapter.rows.clear()
+    position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
+    coordinator.emit(
+      { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
+      `replacement`,
+      collectionId,
+    )
+    await atPersistedOracleCheckpoint(
+      resetSettled.promise,
+      `reset reload and position read settled`,
+    )
+    expect([...collection.keys()]).toEqual([])
+
+    const newRow = { id: `new`, title: `after reset` }
+    adapter.rows.set(newRow.id, newRow)
+    position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 2,
+        seq: 1,
+        txId: `post-reset`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [{ key: newRow.id, value: newRow }],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() => expect([...collection.keys()]).toEqual([`new`]))
+    expect(collection.get(`new`)).toMatchObject(newRow)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupPersistedOracle(
+      [() => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// The reset envelope has an epoch, but tx:committed does not. This controlled
+// ledger keeps the same term after reset, then delivers a current notice, an
+// old-epoch notice, and another current notice. Their terms alone cannot
+// authorize row deltas. At each settled cut, the public Collection must equal
+// durable rows and never expose the old-epoch row. The load counter records
+// the conservative cost of checking each ambiguous notice against storage.
+it(`checks same-term post-reset notices against durable rows`, async () => {
+  const adapter = createRecordingAdapter([{ id: `old`, title: `old epoch` }])
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-reset-same-term`
+  let position = { term: 1, seq: 1, rowVersion: 1, resetEpoch: 0 }
+  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+  adapter.loadResumeSnapshot = async (...args) => ({
+    ...(await loadResumeSnapshot(...args)),
+    latestTerm: position.term,
+    latestSeq: position.seq,
+    latestRowVersion: position.rowVersion,
+    resetEpoch: position.resetEpoch,
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: { sync: (params) => params.markReady() },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(collection.preload(), `baseline ready`)
+    expect([...collection.keys()]).toEqual([`old`])
+    adapter.rows.clear()
+    position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
+    coordinator.emit(
+      { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() => expect([...collection.keys()]).toEqual([]))
+    const loadsAfterReset = adapter.loadSubsetCalls.length
+
+    const first = { id: `first`, title: `new epoch` }
+    adapter.rows.set(first.id, first)
+    position = { term: 1, seq: 1, rowVersion: 1, resetEpoch: 1 }
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `new-first`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [{ key: first.id, value: first }],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() => expect([...collection.keys()]).toEqual([`first`]))
+
+    const stale = { id: `stale`, title: `old epoch` }
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `old-delayed`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [{ key: stale.id, value: stale }],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await flushAsyncWork()
+    expect([...collection.keys()]).toEqual([`first`])
+    await vi.waitFor(() =>
+      expect(adapter.loadSubsetCalls).toHaveLength(loadsAfterReset + 2),
+    )
+
+    const second = { id: `second`, title: `new epoch` }
+    adapter.rows.set(second.id, second)
+    position = { term: 1, seq: 2, rowVersion: 2, resetEpoch: 1 }
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `new-second`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [{ key: second.id, value: second }],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() =>
+      expect([...collection.keys()].sort()).toEqual([`first`, `second`]),
+    )
+    expect(adapter.loadSubsetCalls).toHaveLength(loadsAfterReset + 3)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupPersistedOracle(
+      [() => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// A delayed pre-reset notification can have the same row version as a new
+// post-reset transaction. Term and sequence alone cannot certify its reset
+// epoch. Reread the durable snapshot for an old term even after a newer term
+// has appeared. Both notice orders must leave only post-reset rows public.
+it.each([`stale-first`, `fresh-first`] as const)(
+  `does not republish a delayed pre-reset row after collection reset / %s`,
+  async (order) => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `source-reset-stale-notice`
+    let position = { term: 0, seq: 0, rowVersion: 0, resetEpoch: 0 }
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => ({
+      ...(await loadResumeSnapshot(...args)),
+      latestTerm: position.term,
+      latestSeq: position.seq,
+      latestRowVersion: position.rowVersion,
+      resetEpoch: position.resetEpoch,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        getKey: (row) => row.id,
+        sync: { sync: (params) => params.markReady() },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let hasPrimaryFailure = false
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.preload(),
+        `stale source ready`,
+      )
+      const resetSettled = createEventGate()
+      const staleReloadSettled = createEventGate()
+      let scopeCount = 0
+      adapter.runInHydrationScope = async (task) => {
+        const result = await task(adapter)
+        scopeCount++
+        if (scopeCount === 1) resetSettled.resolve()
+        if (scopeCount === 2) staleReloadSettled.resolve()
+        return result
+      }
+      const stale = { id: `stale`, title: `before reset` }
+      adapter.rows.set(stale.id, stale)
+      position = { term: 1, seq: 2, rowVersion: 2, resetEpoch: 0 }
+      // The original notification is lost; only the durable ledger saw it.
+      adapter.rows.clear()
+      position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
+      coordinator.emit(
+        { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
+        `replacement`,
+        collectionId,
+      )
+      await atPersistedOracleCheckpoint(resetSettled.promise, `reset settled`)
+      expect([...collection.keys()]).toEqual([])
+
+      const fresh = { id: `fresh`, title: `after reset` }
+      const emitStale = () =>
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 2,
+            txId: `pre-reset`,
+            latestRowVersion: 2,
+            requiresFullReload: false,
+            changedRows: [{ key: stale.id, value: stale }],
+            deletedKeys: [],
+          },
+          `replacement`,
+          collectionId,
+        )
+      const emitFresh = () =>
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 2,
+            seq: 1,
+            txId: `post-reset`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows: [{ key: fresh.id, value: fresh }],
+            deletedKeys: [],
+          },
+          `replacement`,
+          collectionId,
+        )
+      if (order === `fresh-first`) {
+        adapter.rows.set(fresh.id, fresh)
+        position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
+        emitFresh()
+        await vi.waitFor(() =>
+          expect(collection.get(`fresh`)).toMatchObject(fresh),
+        )
+        emitStale()
+      } else {
+        emitStale()
+      }
+      await atPersistedOracleCheckpoint(
+        staleReloadSettled.promise,
+        `old-term reload settled`,
+      )
+      await flushAsyncWork()
+      if (order === `stale-first`) {
+        adapter.rows.set(fresh.id, fresh)
+        position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
+        emitFresh()
+        await vi.waitFor(() =>
+          expect(collection.get(`fresh`)).toMatchObject(fresh),
+        )
+      }
+      expect([...collection.keys()]).toEqual([`fresh`])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// A metadata-only read after a reset reload cannot certify rows that were
+// committed between the two reads. The controlled adapter holds that exact
+// boundary: the public snapshot is empty, then a new term commits row 1 before
+// the position-only read returns. When row 2 is announced, recovery must load
+// both rows rather than treating the observed position as public coverage.
+it(`recovers a row committed between reset reload and position observation`, async () => {
+  const adapter = createRecordingAdapter()
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-reset-position-race`
+  let position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 0 }
+  let holdResetPositionRead = false
+  const positionReadEntered = createEventGate()
+  const releasePositionRead = createEventGate()
+  const resetSettled = createEventGate()
+  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+  adapter.loadResumeSnapshot = async (...args) => {
+    if (holdResetPositionRead && args[1]?.includeRows === false) {
+      holdResetPositionRead = false
+      positionReadEntered.resolve()
+      await releasePositionRead.promise
+    }
+    return {
+      ...(await loadResumeSnapshot(...args)),
+      latestTerm: position.term,
+      latestSeq: position.seq,
+      latestRowVersion: position.rowVersion,
+      resetEpoch: position.resetEpoch,
+    }
+  }
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: { sync: (params) => params.markReady() },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(collection.preload(), `race source ready`)
+    adapter.runInHydrationScope = async (task) => {
+      const result = await task(adapter)
+      resetSettled.resolve()
+      return result
+    }
+    position = { term: 1, seq: 0, rowVersion: 0, resetEpoch: 1 }
+    holdResetPositionRead = true
+    coordinator.emit(
+      { type: `collection:reset`, schemaVersion: 2, resetEpoch: 1 },
+      `replacement`,
+      collectionId,
+    )
+    await atPersistedOracleCheckpoint(
+      positionReadEntered.promise,
+      `position read held after empty reload`,
+    )
+    expect([...collection.keys()]).toEqual([])
+
+    const missed = { id: `missed`, title: `committed during reset` }
+    adapter.rows.set(missed.id, missed)
+    position = { term: 2, seq: 1, rowVersion: 1, resetEpoch: 1 }
+    releasePositionRead.resolve()
+    await atPersistedOracleCheckpoint(resetSettled.promise, `reset settled`)
+    expect([...collection.keys()]).toEqual([])
+
+    const received = { id: `received`, title: `later commit` }
+    adapter.rows.set(received.id, received)
+    position = { term: 3, seq: 1, rowVersion: 2, resetEpoch: 1 }
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 3,
+        seq: 1,
+        txId: `received`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [{ key: received.id, value: received }],
+        deletedKeys: [],
+      },
+      `replacement`,
+      collectionId,
+    )
+    await vi.waitFor(() =>
+      expect([...collection.keys()].sort()).toEqual([`missed`, `received`]),
+    )
+    expect(coordinator.pullSinceCalls).toBe(1)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releasePositionRead.resolve()
+    await cleanupPersistedOracle(
+      [() => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// SQLite encodes a nested class value as a plain durable record. The
+// independent reference is the durable row's prototype category: after a
+// reconciliation reload settles, the public source row must have that shape.
+// An equal keyed class is a distinguishing wrong answer because ordinary
+// change-event equality accepts it as equal to a plain record. The held read
+// exposes the authored intermediate cut; this controlled adapter does not
+// itself establish the real SQLite serialization premise.
+it(`replaces an equal nested class with its durable plain record`, async () => {
+  class DetailBox {
+    constructor(public rank: number) {}
+  }
+  const adapter = createRecordingAdapter()
+  const coordinator = createCoordinatorHarness()
+  const collectionId = `source-nested-prototype-reload`
+  const reloadEntered = createDeferred()
+  const releaseReload = createDeferred()
+  let source!: TodoSyncParams
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          source = params
+          params.markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  const live = createLiveQueryCollection((q) => q.from({ row: collection }))
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
+    await atPersistedOracleCheckpoint(live.preload(), `live query ready`)
+    source.begin()
+    source.write({
+      type: `insert`,
+      value: { id: `crossing`, title: `source`, payload: new DetailBox(7) },
+    })
+    await atPersistedOracleCheckpoint(
+      Promise.resolve(source.commit()),
+      `authored source receipt`,
+    )
+    expect(collection.get(`crossing`)?.payload).toBeInstanceOf(DetailBox)
+    await vi.waitFor(() =>
+      expect(live.get(`crossing`)?.payload).toBeInstanceOf(DetailBox),
+    )
+    const loadSubset = adapter.loadSubset
+    adapter.loadSubset = async (...args) => {
+      reloadEntered.resolve()
+      await releaseReload.promise
+      return loadSubset(...args)
+    }
+    adapter.rows.set(`crossing`, {
+      id: `crossing`,
+      title: `source`,
+      payload: { rank: 7 },
+    })
+    coordinator.emit(
+      {
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `crossing`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+        reconciliationReload: true,
+      },
+      `replacement`,
+      collectionId,
+    )
+    await atPersistedOracleCheckpoint(
+      reloadEntered.promise,
+      `nested shape reload entered`,
+    )
+    expect(collection.get(`crossing`)?.payload).toBeInstanceOf(DetailBox)
+    expect(live.get(`crossing`)?.payload).toBeInstanceOf(DetailBox)
+    releaseReload.resolve()
+    await vi.waitFor(() => {
+      expect(Object.getPrototypeOf(collection.get(`crossing`)?.payload)).toBe(
+        Object.prototype,
+      )
+      expect(Object.getPrototypeOf(live.get(`crossing`)?.payload)).toBe(
+        Object.prototype,
+      )
+    })
+    expect(collection.get(`crossing`)?.payload).toEqual({ rank: 7 })
+    expect(live.get(`crossing`)?.payload).toEqual({ rank: 7 })
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseReload.resolve()
+    await cleanupPersistedOracle(
+      [() => live.cleanup(), () => collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// A source commit accepted while persisted restore is reading waits behind the
+// hydration baseline. Its queued applied receipt remains one obligation when
+// the coordinator answer is lost. The independent authored ledger is baseline
+// → crossing → later; no second source sync run or queue re-admission exists in
+// that model. The controlled adapter holds the baseline and then the exact-ID
+// decision so both pending checkpoints are observable.
+it(`reconciles a source receipt queued behind persisted hydration`, async () => {
+  const adapter = createRecordingAdapter([{ id: `shared`, title: `baseline` }])
+  const hydrationEntered = createEventGate()
+  const releaseHydration = createEventGate()
+  overrideBaselineRows(adapter, async () => {
+    hydrationEntered.resolve()
+    await releaseHydration.promise
+    return [
+      {
+        key: `shared`,
+        value: { id: `shared`, title: `baseline` },
+      },
+    ]
+  })
+  const coordinator = createCoordinatorHarness()
+  const reconcileEntered = createEventGate()
+  const releaseReconcile = createEventGate()
+  const uncertain = new IndeterminateCommitError({
+    collectionId: `queued-reconciliation`,
+    requestType: `rpc:applyCommittedTx:req`,
+    previousLeaderId: `retired`,
+    previousTerm: 1,
+    currentLeaderId: `replacement`,
+    currentTerm: 2,
+    cause: new Error(`lost answer`),
+  })
+  let first = true
+  coordinator.requestApplyCommittedTx = async (
+    collectionId,
+    tx,
+    scopedAdapter,
+  ) => {
+    if (first) {
+      first = false
+      expect(scopedAdapter).toBeDefined()
+      throw uncertain
+    }
+    await (scopedAdapter ?? adapter).applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      tx,
+    )
+    return {
+      type: `rpc:applyCommittedTx:res`,
+      rpcId: tx.txId,
+      ok: true,
+      term: tx.term,
+      seq: tx.seq,
+      latestRowVersion: tx.rowVersion,
+    }
+  }
+  coordinator.reconcileCommittedTx = async (
+    collectionId,
+    tx,
+    anchor,
+    scopedAdapter,
+  ) => {
+    expect(anchor).toEqual({ latestRowVersion: 0, resetEpoch: 0 })
+    expect(scopedAdapter).toBeDefined()
+    reconcileEntered.resolve()
+    await releaseReconcile.promise
+    const committed = { ...tx, term: 2, seq: 1, rowVersion: 1 }
+    await (scopedAdapter ?? adapter).applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      committed,
+    )
+    return {
+      type: `rpc:reconcileCommittedTx:res`,
+      rpcId: tx.txId,
+      ok: true,
+      alreadyApplied: false,
+      committed: { term: 2, seq: 1, rowVersion: 1 },
+    }
+  }
+  let source!: TodoSyncParams
+  let syncRuns = 0
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: `queued-reconciliation`,
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          source = params
+          syncRuns++
+          params.markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  const ready = collection.stateWhenReady()
+  let firstReceipt: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await atPersistedOracleCheckpoint(hydrationEntered.promise, `held baseline`)
+    source.begin()
+    source.write({
+      type: `update`,
+      value: { id: `shared`, title: `crossing` },
+    })
+    source.metadata?.collection.set(`probe:cursor`, `crossing`)
+    firstReceipt = Promise.resolve(source.commit()).then(() => undefined)
+    const settlement = observeSettlement(firstReceipt)
+    expect(settlement.read()).toEqual({ status: `pending` })
+    expect(adapter.applyCommittedTxCalls).toHaveLength(0)
+    releaseHydration.resolve()
+    await atPersistedOracleCheckpoint(
+      reconcileEntered.promise,
+      `queued reconciliation entered`,
+    )
+    expect(settlement.read()).toEqual({ status: `pending` })
+    expect(adapter.rows.get(`shared`)?.title).toBe(`baseline`)
+    releaseReconcile.resolve()
+    await atPersistedOracleCheckpoint(firstReceipt, `queued source receipt`)
+    await atPersistedOracleCheckpoint(ready, `persisted restore ready`)
+    expect({
+      receipt: settlement.read(),
+      status: collection.status,
+      syncRuns,
+      publicTitle: collection.get(`shared`)?.title,
+      durableTitle: adapter.rows.get(`shared`)?.title,
+      cursor: adapter.collectionMetadata.get(`probe:cursor`),
+      durableTxCount: adapter.applyCommittedTxCalls.length,
+    }).toEqual({
+      receipt: { status: `fulfilled` },
+      status: `ready`,
+      syncRuns: 1,
+      publicTitle: `crossing`,
+      durableTitle: `crossing`,
+      cursor: `crossing`,
+      durableTxCount: 1,
+    })
+    source.begin()
+    source.write({
+      type: `update`,
+      value: { id: `shared`, title: `later` },
+    })
+    source.metadata?.collection.set(`probe:cursor`, `later`)
+    await atPersistedOracleCheckpoint(
+      Promise.resolve(source.commit()),
+      `queued source suffix`,
+    )
+    expect({
+      status: collection.status,
+      syncRuns,
+      publicTitle: collection.get(`shared`)?.title,
+      durableTitle: adapter.rows.get(`shared`)?.title,
+      cursor: adapter.collectionMetadata.get(`probe:cursor`),
+      durableTxCount: adapter.applyCommittedTxCalls.length,
+    }).toEqual({
+      status: `ready`,
+      syncRuns: 1,
+      publicTitle: `later`,
+      durableTitle: `later`,
+      cursor: `later`,
+      durableTxCount: 2,
+    })
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseHydration.resolve()
+    releaseReconcile.resolve()
+    await cleanupPersistedOracle(
+      [
+        () => ready.catch(() => undefined),
+        () => firstReceipt?.catch(() => undefined),
+        () => collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// A missing exact-ID proof leaves the original uncertainty visible. A known
+// SQLite failure keeps its durability class and details, whether it arrived as
+// a remote response or a direct local throw. In all three histories the source
+// has no safe suffix: a later commit cannot advance durable rows or cursor.
+it.each([`unknown`, `remote-durability`, `local-durability`] as const)(
+  `fails the source run after %s reconciliation`,
+  async (failureMode) => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const uncertain = new IndeterminateCommitError({
+      collectionId: `failed-reconciliation`,
+      requestType: `rpc:applyCommittedTx:req`,
+      previousLeaderId: `retired`,
+      previousTerm: 1,
+      currentLeaderId: `replacement`,
+      currentTerm: 2,
+      cause: new Error(`lost answer`),
+    })
+    const localFailure = new PersistedCollectionDurabilityError(
+      `SQLite reconciliation failed`,
+      { code: `SQLITE_IOERR_FSYNC`, path: [`database`, `wal`] },
+    )
+    coordinator.requestApplyCommittedTx = async () => {
+      throw uncertain
+    }
+    coordinator.reconcileCommittedTx = async () => {
+      if (failureMode === `local-durability`) throw localFailure
+      if (failureMode === `remote-durability`) {
+        return {
+          type: `rpc:reconcileCommittedTx:res`,
+          rpcId: `known-failure`,
+          ok: false,
+          code: `PERSISTENCE_ERROR`,
+          error: `disk write failed`,
+          sourceCode: `SQLITE_IOERR_FSYNC`,
+          path: [`database`, `wal`],
+        }
+      }
+      return {
+        type: `rpc:reconcileCommittedTx:res`,
+        rpcId: `unknown`,
+        ok: false,
+        code: `UNDETERMINED`,
+        error: `newer write exists`,
+      }
+    }
+    let source!: TodoSyncParams
+    let syncRuns = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `failed-reconciliation`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            syncRuns++
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const live = createLiveQueryCollection((q) => q.from({ row: collection }))
+    const subscription = live.subscribeChanges(() => {})
+    let hasPrimaryFailure = false
+    try {
+      await atPersistedOracleCheckpoint(collection.preload(), `source ready`)
+      await atPersistedOracleCheckpoint(live.preload(), `live ready`)
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `crossing`, title: `source` },
+      })
+      source.metadata?.collection.set(`probe:cursor`, `crossing`)
+      let firstFailure: unknown
+      try {
+        await atPersistedOracleCheckpoint(
+          Promise.resolve(source.commit()),
+          `failed source receipt`,
+        )
+      } catch (error) {
+        firstFailure = error
+      }
+      if (failureMode === `unknown`) {
+        expect(firstFailure).toBe(uncertain)
+      } else if (failureMode === `local-durability`) {
+        expect(firstFailure).toBe(localFailure)
+      } else {
+        expect(firstFailure).toMatchObject({
+          name: `PersistedCollectionDurabilityError`,
+          code: `SQLITE_IOERR_FSYNC`,
+          path: [`database`, `wal`],
+        })
+      }
+      let suffixFailure: unknown
+      try {
+        source.begin()
+        source.write({ type: `insert`, value: { id: `later`, title: `later` } })
+        await Promise.resolve(source.commit())
+      } catch (error) {
+        suffixFailure = error
+      }
+      expect(suffixFailure).toBe(firstFailure)
+      expect({
+        sourceStatus: collection.status,
+        liveStatus: live.status,
+        syncRuns,
+        durableIds: [...adapter.rows.keys()],
+        durableCursor: adapter.collectionMetadata.get(`probe:cursor`),
+        durableTxCount: adapter.applyCommittedTxCalls.length,
+      }).toEqual({
+        sourceStatus: `crashed`,
+        liveStatus: `crashed`,
+        syncRuns: 1,
+        durableIds: [],
+        durableCursor: undefined,
+        durableTxCount: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      subscription.unsubscribe()
+      await cleanupPersistedOracle(
+        [() => live.cleanup(), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-reload-metadata.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-reload-metadata.test.ts
new file mode 100644
index 0000000000..c1b8964ea1
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-reload-metadata.test.ts
@@ -0,0 +1,3426 @@
+/**
+ * Ordinary regression tests for persisted full reloads and metadata: no-demand reloads, row metadata retention, exact snapshot comparison, and pullSince recovery, as fixed scenarios. The reload and metadata laws are owned by persisted-oracle.test.ts, which keeps its model-checked and generated cases.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  DbClient,
+  IR,
+  NoPendingSyncTransactionWriteError,
+  collectionOptions,
+  createCollection,
+  whenSyncAccepted,
+} from '@tanstack/db'
+import { persistedCollectionOptions } from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createRecordingAdapter,
+  expectExactSnapshot,
+  flushAsyncWork,
+  overrideBaselineRows,
+  stripVirtualProps,
+} from './persisted-support'
+import type { LoadSubsetOptions, SyncConfig } from '@tanstack/db'
+import type { CollectionReset, PersistedTx, TxCommitted } from '../src'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`keeps a bare truncate away from another owner's queued marker`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await applyCommittedTx(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `bare-truncate-owner-isolation`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let firstReceipt: Promise<void> | undefined
+    let queuedReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `bare truncate collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `first`, title: `must survive` },
+      })
+      firstReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void firstReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `bare truncate first owner persistence entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `queued`, title: `owns queued marker` },
+      })
+      queuedReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void queuedReceipt.catch(() => undefined)
+
+      let truncateError: unknown
+      try {
+        sourceParams.truncate()
+      } catch (error) {
+        truncateError = error
+      }
+      expect({
+        truncateErrorIsOwned:
+          truncateError instanceof NoPendingSyncTransactionWriteError,
+        firstVisible: stripVirtualProps(collection.get(`first`)),
+        queuedVisible: collection.has(`queued`),
+      }).toEqual({
+        truncateErrorIsOwned: true,
+        firstVisible: { id: `first`, title: `must survive` },
+        queuedVisible: false,
+      })
+
+      releaseFirstPersistence.resolve()
+      await atPersistedOracleCheckpoint(firstReceipt, `first owner persisted`)
+      await atPersistedOracleCheckpoint(queuedReceipt, `queued owner persisted`)
+      expect({
+        publicRows: Array.from(collection.values()).map(stripVirtualProps),
+        durableRows: Array.from(adapter.rows.values()),
+      }).toEqual({
+        publicRows: [
+          { id: `first`, title: `must survive` },
+          { id: `queued`, title: `owns queued marker` },
+        ],
+        durableRows: [
+          { id: `first`, title: `must survive` },
+          { id: `queued`, title: `owns queued marker` },
+        ],
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => firstReceipt?.catch(() => undefined),
+          () => queuedReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`marks the collection errored with the exact persisted startup hydration failure`, async () => {
+    const adapter = createRecordingAdapter()
+    const startupError = new Error(`startup hydration failed exactly`)
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = (...args) => {
+      if (args[1]?.includeRows === true) {
+        return Promise.reject(startupError)
+      }
+      return loadResumeSnapshot(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-mark-ready-on-startup-failure`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let hasPrimaryFailure = false
+    try {
+      await expect(collection.stateWhenReady()).rejects.toBe(startupError)
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(startupError)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      warning.mockRestore()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`reads staged metadata writes during hydration-queued transactions`, async () => {
+    const adapter = createRecordingAdapter([
+      {
+        id: `cached-1`,
+        title: `Cached row`,
+      },
+    ])
+    adapter.rowMetadata.set(`cached-1`, { source: `persisted` })
+    adapter.collectionMetadata.set(`startup:key`, { ready: true })
+
+    let resolveLoadSubset: (() => void) | undefined
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => {
+      if (args[1]?.includeRows === true) {
+        await new Promise<void>((resolve) => {
+          resolveLoadSubset = resolve
+        })
+      }
+      return loadResumeSnapshot(...args)
+    }
+
+    let remoteBegin: (() => void) | undefined
+    let remoteCommit: (() => void) | undefined
+    let remoteTruncate: (() => void) | undefined
+    let remoteMetadata:
+      Parameters<SyncConfig<Todo, string>[`sync`]>[0][`metadata`] | undefined
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-metadata-read`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, commit, truncate, markReady, metadata }) => {
+            remoteBegin = begin
+            remoteCommit = commit
+            remoteTruncate = truncate
+            remoteMetadata = metadata
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    const readyPromise = collection.stateWhenReady()
+    for (let attempt = 0; attempt < 20 && !resolveLoadSubset; attempt++) {
+      await flushAsyncWork()
+    }
+
+    expect(resolveLoadSubset).toBeDefined()
+    expect(remoteBegin).toBeDefined()
+    expect(remoteMetadata).toBeDefined()
+
+    remoteBegin?.()
+    remoteMetadata?.row.set(`cached-1`, { source: `staged` })
+    remoteMetadata?.collection.set(`runtime:key`, { persisted: true })
+
+    expect(remoteMetadata?.row.get(`cached-1`)).toEqual({ source: `staged` })
+    expect(remoteMetadata?.collection.get(`runtime:key`)).toEqual({
+      persisted: true,
+    })
+    expect(remoteMetadata?.collection.list()).toContainEqual({
+      key: `runtime:key`,
+      value: { persisted: true },
+    })
+
+    remoteTruncate?.()
+
+    expect(remoteMetadata?.row.get(`cached-1`)).toBeUndefined()
+    expect(remoteMetadata?.collection.get(`startup:key`)).toEqual({
+      ready: true,
+    })
+
+    remoteCommit?.()
+    resolveLoadSubset?.()
+    await readyPromise
+  })
+
+  it(`preserves metadata only for rows supplied by the owning hydration`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `hydrated`, title: `Persisted baseline` },
+    ])
+    adapter.rowMetadata.set(`hydrated`, { source: `persisted` })
+    adapter.rowMetadata.set(`new`, { source: `orphaned` })
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let durableMetadataMutations: Array<unknown> = []
+    adapter.applyCommittedTx = async (...args) => {
+      durableMetadataMutations = [...(args[1].rowMetadataMutations ?? [])]
+      await applyCommittedTx(...args)
+    }
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    overrideBaselineRows(adapter, async () => {
+      hydrationEntered.resolve()
+      await hydration.promise
+      return [
+        {
+          key: `hydrated`,
+          value: { id: `hydrated`, title: `Persisted baseline` },
+          metadata: { source: `persisted` },
+        },
+      ]
+    })
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydration-owned-metadata`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const ready = collection.stateWhenReady()
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `metadata hydration entered`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `hydrated`, title: `Source replacement` },
+      })
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `new`, title: `Genuinely new row` },
+      })
+
+      // Commit after hydration clears its runtime marker. The transaction's
+      // captured hydration ownership must still distinguish these two keys.
+      hydration.resolve()
+      await atPersistedOracleCheckpoint(ready, `metadata hydration ready`)
+      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      await atPersistedOracleCheckpoint(receipt, `metadata source receipt`)
+
+      expect({
+        publicHydrated: stripVirtualProps(collection.get(`hydrated`)),
+        publicNew: stripVirtualProps(collection.get(`new`)),
+        hydratedMetadata: adapter.rowMetadata.get(`hydrated`),
+        newMetadata: adapter.rowMetadata.get(`new`),
+        durableMetadataMutations,
+      }).toEqual({
+        publicHydrated: { id: `hydrated`, title: `Source replacement` },
+        publicNew: { id: `new`, title: `Genuinely new row` },
+        hydratedMetadata: { source: `persisted` },
+        newMetadata: undefined,
+        durableMetadataMutations: [{ type: `delete`, key: `new` }],
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => ready.catch(() => undefined),
+          () => receipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  // A source transaction may begin during hydration and commit after that
+  // same hydration finishes (the metadata-owner test above establishes this
+  // history). Commit acceptance must survive later queued hydration. Starting
+  // during hydration captures metadata ownership; it does not require replay
+  // inside that hydration. This grammar varies the captured key membership,
+  // commit-turn reservation, and the number of later hydrations. The first
+  // scope is held after its task finishes. Without a reserved commit turn, later
+  // reads run first. The adapter capability reserveCommitTurn holds those reads
+  // behind the sync transaction, as Electric does for an overlapping stream.
+  // All receipts settle before public/durable rows and metadata are compared.
+  it.each(
+    [false, true].flatMap((ownerSuppliesRow) =>
+      [false, true].flatMap((reserveCommitTurn) =>
+        [1, 2].map((laterHydrations) => ({
+          ownerSuppliesRow,
+          reserveCommitTurn,
+          laterHydrations,
+        })),
+      ),
+    ),
+  )(
+    `publishes a source begun during hydration after $laterHydrations later hydrations (ownerSuppliesRow=$ownerSuppliesRow, reserveCommitTurn=$reserveCommitTurn)`,
+    async ({ ownerSuppliesRow, reserveCommitTurn, laterHydrations }) => {
+      const baseline = { id: `shared`, title: `persisted`, detail: `baseline` }
+      const adapter = createRecordingAdapter([baseline])
+      adapter.rowMetadata.set(`shared`, { owner: `persisted` })
+      const loadEntered = createEventGate()
+      const releaseLoad = createEventGate()
+      const firstPublished = createEventGate()
+      const releaseScope = createEventGate()
+      const loadSubset = adapter.loadSubset.bind(adapter)
+      let loads = 0
+      adapter.loadSubset = async (...args) => {
+        if (++loads === 1) {
+          loadEntered.resolve()
+          await releaseLoad.promise
+          return ownerSuppliesRow ? loadSubset(...args) : []
+        }
+        return loadSubset(...args)
+      }
+      let sourcePersistenceLoads = 0
+      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+      adapter.applyCommittedTx = async (...args) => {
+        await applyCommittedTx(...args)
+        if (args[1].mutations.some(({ key }) => key === `shared`)) {
+          sourcePersistenceLoads = loads
+        }
+      }
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `source-begun-during-hydration`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const options = Array.from(
+        { length: laterHydrations + 1 },
+        (_, index) => ({
+          limit: index + 1,
+        }),
+      )
+      const receipts: Array<Promise<true | void>> = []
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        let scopes = 0
+        adapter.runInHydrationScope = async (task) => {
+          const first = ++scopes === 1
+          const result = await task(adapter)
+          if (first) {
+            firstPublished.resolve()
+            await releaseScope.promise
+          }
+          return result
+        }
+        const first = Promise.resolve(collection._sync.loadSubset(options[0]!))
+        void first.catch(() => undefined)
+        receipts.push(first)
+        await atPersistedOracleCheckpoint(
+          loadEntered.promise,
+          `owning hydration entered`,
+        )
+        sourceParams.begin()
+        if (reserveCommitTurn) {
+          sourceParams.metadata!.persistence!.reserveCommitTurn()
+        }
+        sourceParams.write({
+          type: `insert`,
+          value: { ...baseline, title: `source` },
+        })
+        releaseLoad.resolve()
+        await atPersistedOracleCheckpoint(
+          firstPublished.promise,
+          `owning hydration published`,
+        )
+        expect(collection.get(`shared`)?.title).toBe(
+          ownerSuppliesRow ? `persisted` : undefined,
+        )
+        for (const option of options.slice(1)) {
+          const load = Promise.resolve(collection._sync.loadSubset(option))
+          void load.catch(() => undefined)
+          receipts.push(load)
+        }
+        await flushAsyncWork()
+        expect(loads).toBe(1)
+        const committed = Promise.resolve(sourceParams.commit())
+        void committed.catch(() => undefined)
+        receipts.push(committed)
+        releaseScope.resolve()
+        const outcomes = await atPersistedOracleCheckpoint(
+          Promise.allSettled(receipts),
+          `source begun during hydration settled`,
+        )
+        // Accepted source writes follow the baseline; metadata survival belongs
+        // to the rows supplied by the original owning hydration, not later loads.
+        expect({
+          outcomes,
+          loads,
+          sourcePersistenceLoads,
+          status: collection.status,
+          publicRow: stripVirtualProps(collection.get(`shared`)),
+          durableRow: adapter.rows.get(`shared`),
+          metadata: adapter.rowMetadata.get(`shared`),
+        }).toEqual({
+          outcomes: receipts.map(() => ({
+            status: `fulfilled`,
+            value: undefined,
+          })),
+          loads: laterHydrations + 1,
+          sourcePersistenceLoads: reserveCommitTurn ? 1 : laterHydrations + 1,
+          status: `ready`,
+          publicRow: { ...baseline, title: `source` },
+          durableRow: { ...baseline, title: `source` },
+          metadata: ownerSuppliesRow ? { owner: `persisted` } : undefined,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        releaseLoad.resolve()
+        releaseScope.resolve()
+        await cleanupPersistedOracle(
+          [
+            ...options.map(
+              (option) => () => collection._sync.unloadSubset(option),
+            ),
+            () => Promise.allSettled(receipts),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // An on-demand Collection has no unconstrained persisted row demand before
+  // its first subset request. A coordinator notification changes durable
+  // authority but cannot manufacture that demand. The independent model has
+  // zero or one active demand: zero requests no new rows; one unconstrained
+  // demand requests the durable snapshot. A retired demand may leave its old
+  // public row visible, so a peer full-reload notice must validate that row
+  // immediately. The notice may not add unrelated durable rows. This history
+  // checks both full-reload cuts and the later demand's public Collection and
+  // adapter-call boundaries.
+  // The reset history below applies the same demand law at a new cache epoch.
+  it(`validates visible rows on a no-demand full reload without adding stored rows`, async () => {
+    const stored = { id: `stored`, title: `Durable row` }
+    const retained = { id: `retained`, title: `Still durable` }
+    const adapter = createRecordingAdapter([stored, retained])
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `zero-demand-full-reload`
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let hasPrimaryFailure = false
+    try {
+      await collection.stateWhenReady()
+      expect(collection.has(`stored`)).toBe(false)
+      expect(adapter.loadSubsetCalls).toHaveLength(0)
+      const metadataReadsBefore = adapter.loadCollectionMetadataCalls.length
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `zero-demand-reload`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        },
+        undefined,
+        collectionId,
+      )
+      await vi.waitFor(() =>
+        expect(adapter.loadCollectionMetadataCalls).toHaveLength(
+          metadataReadsBefore + 1,
+        ),
+      )
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(adapter.loadSubsetCalls).toHaveLength(0)
+      expect(collection.has(`stored`)).toBe(false)
+
+      const demand = {}
+      await collection._sync.loadSubset(demand)
+      expect(adapter.loadSubsetCalls).toHaveLength(1)
+      expect(stripVirtualProps(collection.get(`stored`))).toEqual(stored)
+      collection._sync.unloadSubset(demand)
+
+      // A peer removes the row after demand retirement. Its full-reload notice
+      // must retract the visible row without creating a new row demand.
+      adapter.rows.delete(`stored`)
+      const metadataReadsAfterRetirement =
+        adapter.loadCollectionMetadataCalls.length
+      const validationReads = adapter.loadResumeSnapshotCalls.length
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 2,
+          txId: `retired-demand-reload`,
+          latestRowVersion: 2,
+          requiresFullReload: true,
+        },
+        undefined,
+        collectionId,
+      )
+      await vi.waitFor(() => {
+        expect(adapter.loadResumeSnapshotCalls).toHaveLength(
+          validationReads + 1,
+        )
+        expect(collection.has(`stored`)).toBe(false)
+      })
+      expect(adapter.loadCollectionMetadataCalls).toHaveLength(
+        metadataReadsAfterRetirement,
+      )
+      expect(adapter.loadSubsetCalls).toHaveLength(1)
+      expect(collection.has(`stored`)).toBe(false)
+      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
+      const newDemand = {}
+      await collection._sync.loadSubset(newDemand)
+      expect(adapter.loadSubsetCalls).toHaveLength(2)
+      expect(adapter.loadResumeSnapshotCalls).toHaveLength(validationReads + 1)
+      expect(collection.has(`stored`)).toBe(false)
+      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
+      collection._sync.unloadSubset(newDemand)
+
+      // A bounded subset proves nothing about keys outside that subset.
+      const loadSubset = adapter.loadSubset.bind(adapter)
+      adapter.loadSubset = (id, options, context) =>
+        options.limit === 0
+          ? Promise.resolve([])
+          : loadSubset(id, options, context)
+      const emptyPage = { limit: 0 }
+      await collection._sync.loadSubset(emptyPage)
+      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
+      collection._sync.unloadSubset(emptyPage)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  // A reset changes the durable cache epoch, not the Collection's demand.
+  // The independent snapshot rule permits only keys already public when no
+  // subset is retained: validate them against the new durable state, and add
+  // no unrelated key. These controlled histories enter through the reset
+  // notification and compare the public snapshot after its hydration scope
+  // settles. They cover empty, changed, and deleted visible-key scopes, not
+  // native-host notification delivery.
+  it.each([`empty`, `updated`, `deleted`] as const)(
+    `keeps a no-demand reset scoped to previously visible rows (%s)`,
+    async (history) => {
+      const visible = { id: `visible`, title: `Old row` }
+      const unrelated = { id: `unrelated`, title: `Stored only` }
+      const adapter = createRecordingAdapter(
+        history === `empty` ? [unrelated] : [visible],
+      )
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `reset-visible-scope-${history}`
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      let hasPrimaryFailure = false
+      try {
+        collection.startSyncImmediate()
+        await atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `reset visible scope ready`,
+        )
+        if (history !== `empty`) {
+          const demand = {}
+          await collection._sync.loadSubset(demand)
+          collection._sync.unloadSubset(demand)
+        }
+        expect(collection.has(visible.id)).toBe(history !== `empty`)
+
+        if (history === `updated`) {
+          adapter.rows.set(visible.id, { ...visible, title: `New row` })
+        } else if (history === `deleted`) {
+          adapter.rows.delete(visible.id)
+        }
+        adapter.rows.set(unrelated.id, unrelated)
+
+        const resetSettled = createEventGate()
+        adapter.runInHydrationScope = async (task) => {
+          const result = await task(adapter)
+          resetSettled.resolve()
+          return result
+        }
+        const subsetReads = adapter.loadSubsetCalls.length
+        coordinator.emit(
+          { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
+          undefined,
+          collectionId,
+        )
+        await atPersistedOracleCheckpoint(
+          resetSettled.promise,
+          `reset visible scope published`,
+        )
+        expect({
+          publicRows: new Map(
+            Array.from(collection.values(), (row) => [
+              row.id,
+              stripVirtualProps(row),
+            ]),
+          ),
+          subsetReads: adapter.loadSubsetCalls.length,
+        }).toEqual({
+          publicRows: new Map(
+            history === `updated`
+              ? [[visible.id, { ...visible, title: `New row` }]]
+              : [],
+          ),
+          subsetReads,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // A DbClient-hydrated row is already public but has not been confirmed by
+  // the source. A complete persisted read can validate source-owned public
+  // rows, but an absent or older cache row cannot revoke the hydration seed.
+  // The independent model gives the seed precedence until a source change
+  // confirms its key. These histories cross an unconstrained demand, a
+  // no-demand peer notice, and a bounded empty-demand peer notice with absent,
+  // older, and equal durable rows. At the settled Collection checkpoint, the
+  // public row and change log must still equal the seed. The ordinary
+  // non-hydrated correction is checked above.
+  it.each(
+    (
+      [
+        `complete demand`,
+        `no-demand peer notice`,
+        `bounded peer notice`,
+      ] as const
+    ).flatMap((path) =>
+      ([`absent`, `older`, `equal`] as const).map((durable) => ({
+        path,
+        durable,
+      })),
+    ),
+  )(
+    `keeps a DbClient hydration seed across $path with $durable durable data`,
+    async ({ path, durable }) => {
+      const seed = { id: `seed`, title: `Hydrated row` }
+      const stored =
+        durable === `absent`
+          ? []
+          : [
+              {
+                id: `seed`,
+                title: durable === `equal` ? seed.title : `Old row`,
+              },
+            ]
+      const adapter = createRecordingAdapter(stored)
+      if (path === `bounded peer notice`) {
+        const loadSubset = adapter.loadSubset.bind(adapter)
+        adapter.loadSubset = async (...args) => {
+          const rows = await loadSubset(...args)
+          return args[1].limit === 0 ? [] : rows
+        }
+      }
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `hydrated-validation-${path}-${durable}`
+      const descriptor = collectionOptions(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const client = new DbClient()
+      client.hydrate({
+        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
+      })
+      const collection = client.collection(descriptor)
+      const changes: Array<string> = []
+      const subscription = collection.subscribeChanges((batch) => {
+        changes.push(...batch.map((change) => `${change.type}:${change.key}`))
+      })
+      let hasPrimaryFailure = false
+      const boundedDemand = { limit: 0 }
+      try {
+        await collection.stateWhenReady()
+        expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
+        if (path === `bounded peer notice`) {
+          await collection._sync.loadSubset(boundedDemand)
+          expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
+        }
+        if (path === `complete demand`) {
+          const demand = {}
+          await collection._sync.loadSubset(demand)
+          collection._sync.unloadSubset(demand)
+        } else {
+          const reads = adapter.loadResumeSnapshotCalls.length
+          const subsetReads = adapter.loadSubsetCalls.length
+          coordinator.emit(
+            {
+              type: `tx:committed`,
+              term: 1,
+              seq: 1,
+              txId: `hydrated-validation`,
+              latestRowVersion: 1,
+              requiresFullReload: true,
+            },
+            undefined,
+            collectionId,
+          )
+          await vi.waitFor(() => {
+            if (path === `bounded peer notice`)
+              expect(adapter.loadSubsetCalls).toHaveLength(subsetReads + 1)
+            else expect(adapter.loadResumeSnapshotCalls).toHaveLength(reads + 1)
+          })
+          await flushAsyncWork()
+          await flushAsyncWork()
+        }
+        expect({
+          publicRow: stripVirtualProps(collection.get(seed.id)),
+          changes,
+        }).toEqual({ publicRow: seed, changes: [] })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        if (path === `bounded peer notice`)
+          collection._sync.unloadSubset(boundedDemand)
+        subscription.unsubscribe()
+        await cleanupPersistedOracle(
+          [() => client.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Preserving the seed cannot make an active reload ignore other rows. The
+  // independent snapshot rule keeps the unconfirmed seed, replaces complete
+  // durable values, removes absent ordinary keys, and admits new requested
+  // keys. A second notice checks that the seed's protection survived the first
+  // publication. The row values are observed after each settled peer notice.
+  it(`preserves a hydration seed while replacing the rest of an active snapshot`, async () => {
+    const seed = { id: `seed`, title: `Hydrated` }
+    const old = { id: `ordinary`, title: `Old`, detail: `remove this field` }
+    const removed = { id: `removed`, title: `Removed` }
+    const adapter = createRecordingAdapter([old, removed])
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `mixed-hydration-replacement`
+    const descriptor = collectionOptions(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const client = new DbClient()
+    client.hydrate({
+      collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
+    })
+    const collection = client.collection(descriptor)
+    const demand = { limit: 10 }
+    let hasPrimaryFailure = false
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      await collection._sync.loadSubset(demand)
+      expect(collection._hasHydratedKey(seed.id)).toBe(true)
+      const fresh = { id: `ordinary`, title: `Fresh` }
+      const added = { id: `added`, title: `New` }
+      adapter.rows.set(fresh.id, fresh)
+      adapter.rows.delete(removed.id)
+      adapter.rows.set(added.id, added)
+      const firstReads =
+        adapter.loadSubsetCalls.length + adapter.loadResumeSnapshotCalls.length
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `mixed-first`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        },
+        undefined,
+        collectionId,
+      )
+      await vi.waitFor(() =>
+        expect(
+          adapter.loadSubsetCalls.length +
+            adapter.loadResumeSnapshotCalls.length,
+        ).toBe(firstReads + 1),
+      )
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect({
+        seed: stripVirtualProps(collection.get(seed.id)),
+        ordinary: stripVirtualProps(collection.get(old.id)),
+        removed: collection.has(removed.id),
+        added: stripVirtualProps(collection.get(added.id)),
+        seedProtected: collection._hasHydratedKey(seed.id),
+      }).toEqual({
+        seed,
+        ordinary: fresh,
+        removed: false,
+        added,
+        seedProtected: true,
+      })
+
+      adapter.rows.set(seed.id, { id: seed.id, title: `Stale cache` })
+      const secondReads =
+        adapter.loadSubsetCalls.length + adapter.loadResumeSnapshotCalls.length
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 2,
+          txId: `mixed-second`,
+          latestRowVersion: 2,
+          requiresFullReload: true,
+        },
+        undefined,
+        collectionId,
+      )
+      await vi.waitFor(() =>
+        expect(
+          adapter.loadSubsetCalls.length +
+            adapter.loadResumeSnapshotCalls.length,
+        ).toBe(secondReads + 1),
+      )
+      await flushAsyncWork()
+      await flushAsyncWork()
+      expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
+      expect(collection._hasHydratedKey(seed.id)).toBe(true)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      collection._sync.unloadSubset(demand)
+      await cleanupPersistedOracle([() => client.cleanup()], hasPrimaryFailure)
+    }
+  })
+
+  // A full-reload notice makes row metadata for absent public keys obsolete,
+  // even when no subset demand remains. The reference snapshot has zero orphan
+  // metadata keys; a public row's presence changes whether the wrapper reads
+  // a durable row snapshot, but not that judgment. The sync metadata API is
+  // the observable boundary at the settled notice checkpoint. A source
+  // metadata-only transaction establishes the orphan through the real path.
+  it.each([false, true])(
+    `clears orphan row metadata after a no-demand peer reload (public row=%s)`,
+    async (hasPublicRow) => {
+      const row = { id: `visible`, title: `Visible row` }
+      const adapter = createRecordingAdapter(hasPublicRow ? [row] : [])
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `zero-demand-orphan-${hasPublicRow}`
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (value) => value.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        if (hasPublicRow) {
+          const demand = {}
+          await collection._sync.loadSubset(demand)
+          collection._sync.unloadSubset(demand)
+        }
+        expect(collection.has(row.id)).toBe(hasPublicRow)
+        source.begin()
+        source.metadata?.row.set(`ghost`, { obsolete: true })
+        await whenSyncAccepted(source.commit())
+        expect(source.metadata?.row.get(`ghost`)).toEqual({ obsolete: true })
+        expect(collection.has(row.id)).toBe(hasPublicRow)
+        expect(adapter.rows.has(row.id)).toBe(hasPublicRow)
+        const metadataReads = adapter.loadCollectionMetadataCalls.length
+        const snapshotReads = adapter.loadResumeSnapshotCalls.length
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 2,
+            txId: `orphan-peer-reload`,
+            latestRowVersion: 2,
+            requiresFullReload: true,
+          },
+          undefined,
+          collectionId,
+        )
+        await vi.waitFor(() =>
+          expect(
+            adapter.loadCollectionMetadataCalls.length +
+              adapter.loadResumeSnapshotCalls.length,
+          ).toBe(metadataReads + snapshotReads + 1),
+        )
+        await flushAsyncWork()
+        await flushAsyncWork()
+        expect({
+          orphan: source.metadata?.row.get(`ghost`),
+          publicRow: stripVirtualProps(collection.get(row.id)),
+        }).toEqual({
+          orphan: undefined,
+          publicRow: hasPublicRow ? row : undefined,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // An equal durable value and row metadata require no public change batch.
+  // This controlled history reaches the real sync metadata controls, then
+  // retires its only demand before a peer notice. The Collection event log at
+  // the settled notice checkpoint distinguishes a no-op from a redundant
+  // update; core always supplies metadata controls to this adapter.
+  it(`does not republish an unchanged metadata-bearing row after demand retirement`, async () => {
+    const row = { id: `same`, title: `Unchanged` }
+    const adapter = createRecordingAdapter([row])
+    adapter.rowMetadata.set(row.id, { owner: `durable` })
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `metadata-noop-peer`
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        syncMode: `on-demand`,
+        getKey: (value) => value.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let hasPrimaryFailure = false
+    try {
+      await collection.stateWhenReady()
+      const demand = {}
+      await collection._sync.loadSubset(demand)
+      collection._sync.unloadSubset(demand)
+      expect(source.metadata?.row.get(row.id)).toEqual({ owner: `durable` })
+      const changes: Array<string> = []
+      const subscription = collection.subscribeChanges((batch) => {
+        changes.push(...batch.map((change) => `${change.type}:${change.key}`))
+      })
+      try {
+        const reads = adapter.loadResumeSnapshotCalls.length
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `same-metadata-peer`,
+            latestRowVersion: 1,
+            requiresFullReload: true,
+          },
+          undefined,
+          collectionId,
+        )
+        await vi.waitFor(() =>
+          expect(adapter.loadResumeSnapshotCalls).toHaveLength(reads + 1),
+        )
+        await flushAsyncWork()
+        await flushAsyncWork()
+        expect({
+          row: stripVirtualProps(collection.get(row.id)),
+          metadata: source.metadata?.row.get(row.id),
+          changes,
+        }).toEqual({ row, metadata: { owner: `durable` }, changes: [] })
+      } finally {
+        subscription.unsubscribe()
+      }
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  // A fresh acquisition of the same constrained demand must not keep a row
+  // that its settled storage result excludes. The peer notice arrives after
+  // demand retirement and must first correct the prior public rows without
+  // publishing unrelated durable rows.
+  // This controlled predicate has exactly one possible matching key.
+  it(`corrects retired rows on a peer notice before constrained reacquisition`, async () => {
+    const stored = { id: `stored`, title: `Durable row` }
+    const retained = { id: `retained`, title: `Old durable value` }
+    const adapter = createRecordingAdapter([stored, retained])
+    adapter.rowMetadata.set(`retained`, { source: `old` })
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    adapter.loadSubset = async (id, options, context) =>
+      (await loadSubset(id, options, context)).filter(
+        (row) => !options.where || row.key === `stored`,
+      )
+    const coordinator = createCoordinatorHarness()
+    const collectionId = `retired-constrained-demand`
+    let source!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: collectionId,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const demand = {
+      where: new IR.Func(`eq`, [
+        new IR.PropRef([`id`]),
+        new IR.Value(`stored`),
+      ]),
+    }
+    let hasPrimaryFailure = false
+    try {
+      await collection.stateWhenReady()
+      const originalDemand = {}
+      await collection._sync.loadSubset(originalDemand)
+      expect(stripVirtualProps(collection.get(`stored`))).toEqual(stored)
+      expect(stripVirtualProps(collection.get(`retained`))).toEqual(retained)
+      expect(source.metadata!.row.get(`retained`)).toEqual({ source: `old` })
+      collection._sync.unloadSubset(originalDemand)
+
+      adapter.rows.delete(`stored`)
+      adapter.rowMetadata.delete(`retained`)
+      adapter.rows.set(`retained`, {
+        id: `retained`,
+        title: `New durable value`,
+      })
+      adapter.rows.set(`unrequested`, {
+        id: `unrequested`,
+        title: `Not in the filtered demand`,
+      })
+      const metadataReads = adapter.loadCollectionMetadataCalls.length
+      const validationReads = adapter.loadResumeSnapshotCalls.length
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `constrained-peer-delete`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        },
+        undefined,
+        collectionId,
+      )
+      await vi.waitFor(() => {
+        expect(adapter.loadResumeSnapshotCalls).toHaveLength(
+          validationReads + 1,
+        )
+        expect(collection.has(`stored`)).toBe(false)
+      })
+      expect(adapter.loadCollectionMetadataCalls).toHaveLength(metadataReads)
+      expect(adapter.loadSubsetCalls).toHaveLength(1)
+      expect(collection.has(`stored`)).toBe(false)
+      expect(collection.get(`retained`)?.title).toBe(`New durable value`)
+      expect(source.metadata!.row.get(`retained`)).toBeUndefined()
+      expect(collection.has(`unrequested`)).toBe(false)
+      await collection._sync.loadSubset(demand)
+      expect(adapter.loadSubsetCalls).toHaveLength(2)
+      expect(adapter.loadResumeSnapshotCalls).toHaveLength(validationReads + 1)
+      expect(collection.has(`stored`)).toBe(false)
+      expect(collection.get(`retained`)?.title).toBe(`New durable value`)
+      expect(collection.has(`unrequested`)).toBe(false)
+      collection._sync.unloadSubset(demand)
+
+      await collection._sync.loadSubset(demand)
+      expect(adapter.loadResumeSnapshotCalls).toHaveLength(validationReads + 1)
+      collection._sync.unloadSubset(demand)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  // Active demands form a union, not a first-match or last-match choice. A
+  // targeted row can leave title=Keep while entering title=Other. Both
+  // constrained demands remain active. The two acquisition orders reject
+  // first-match and last-match shortcuts; a complete-demand shortcut cannot
+  // pass either case. The adapter branches on the authored demand identity
+  // only to supply controlled provider rows. The independent expectation is
+  // the durable row admitted by title=Other. The callback and next task-turn
+  // Collection snapshots must both contain the full row.
+  it.each([`Keep first`, `Other first`] as const)(
+    `keeps a targeted row requested by either active subset (%s)`,
+    async (route) => {
+      const old = { id: `ordinary`, title: `Keep`, detail: `retained` }
+      const patch = { id: old.id, title: `Other` }
+      const durable = { ...old, ...patch }
+      const keepDemand = {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`title`]),
+          new IR.Value(`Keep`),
+        ]),
+      }
+      const otherDemand = {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`title`]),
+          new IR.Value(`Other`),
+        ]),
+      }
+      const adapter = createRecordingAdapter([old])
+      const originalLoad = adapter.loadSubset.bind(adapter)
+      adapter.loadSubset = async (id, options, context) => {
+        const title =
+          options.where === keepDemand.where
+            ? `Keep`
+            : options.where === otherDemand.where
+              ? `Other`
+              : undefined
+        expect(title).toBeDefined()
+        return (await originalLoad(id, options, context)).filter(
+          (row) => row.value.title === title,
+        )
+      }
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `targeted-union-${route}`
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const demands =
+        route === `Keep first`
+          ? [keepDemand, otherDemand]
+          : [otherDemand, keepDemand]
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      const published = createEventGate()
+      const snapshots: Array<Map<string, Todo>> = []
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        for (const demand of demands) await collection._sync.loadSubset(demand)
+        expectExactSnapshot(publicRows(), new Map([[old.id, old]]))
+        subscription = collection.subscribeChanges(
+          () => {
+            snapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            published.resolve()
+          },
+          { includeInitialState: false },
+        )
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId },
+          {
+            txId: `targeted-union`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [{ type: `update`, key: old.id, value: patch }],
+          },
+        )
+        expectExactSnapshot(adapter.rows, new Map([[old.id, durable]]))
+        coordinator.emit(
+          {
+            type: `tx:committed`,
+            term: 1,
+            seq: 1,
+            txId: `targeted-union`,
+            latestRowVersion: 1,
+            requiresFullReload: false,
+            changedRows: [{ key: old.id, value: patch }],
+            deletedKeys: [],
+          },
+          undefined,
+          collectionId,
+        )
+        await atPersistedOracleCheckpoint(
+          published.promise,
+          `targeted union notice published`,
+        )
+        await flushAsyncWork()
+        const expected = new Map([[old.id, durable]])
+        expectExactSnapshot(publicRows(), expected)
+        expect(snapshots).toHaveLength(1)
+        for (const snapshot of snapshots)
+          expectExactSnapshot(snapshot, expected)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        subscription?.unsubscribe()
+        for (const demand of demands) collection._sync.unloadSubset(demand)
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // A filtered acquisition proves only its predicate. Retiring an earlier
+  // broad demand does not itself delete the rows it exposed. When a new
+  // title=Keep demand is active, its persisted read of B says nothing about
+  // previously public A outside that predicate. The independent model keeps
+  // A unless durable evidence changes or deletes it, and applies the complete
+  // durable B value. The same authored durable state and demands cross targeted
+  // full-reload, and reset peer notices; their public snapshots must agree after
+  // publication. Updated and deleted A reject a repair that merely preserves
+  // an obsolete out-of-filter row. A DbClient seed stays source-owned across
+  // every peer route, whether the durable snapshot lacks it or holds an older
+  // value. The reset route must preserve it without an empty publication.
+  it.each(
+    ([`targeted`, `full reload`, `reset`] as const).flatMap((notice) =>
+      ([`unchanged`, `updated`, `deleted`] as const).flatMap((outsideChange) =>
+        ([`absent`, `older`] as const).map((seedCache) => ({
+          notice,
+          outsideChange,
+          seedCache,
+        })),
+      ),
+    ),
+  )(
+    `validates a previously public $outsideChange row and an $seedCache seed after a $notice notice`,
+    async ({ notice, outsideChange, seedCache }) => {
+      const outside = { id: `outside`, title: `Other` }
+      const outsideUpdated = { ...outside, title: `Other now` }
+      const inside = { id: `inside`, title: `Keep`, detail: `old` }
+      const insideUpdated = { ...inside, detail: `new` }
+      const seed = { id: `seed`, title: `Keep`, detail: `source-owned` }
+      const storedSeed = { id: seed.id, title: `Other`, detail: `older` }
+      const adapter = createRecordingAdapter([
+        outside,
+        inside,
+        ...(seedCache === `older` ? [storedSeed] : []),
+      ])
+      const loadSubset = adapter.loadSubset.bind(adapter)
+      adapter.loadSubset = async (id, options, context) =>
+        (await loadSubset(id, options, context)).filter(
+          (row) => !options.where || row.value.title === `Keep`,
+        )
+      const coordinator = createCoordinatorHarness()
+      const collectionId = `mixed-demand-notice-${notice}-${outsideChange}-${seedCache}`
+      const descriptor = collectionOptions(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const client = new DbClient()
+      client.hydrate({
+        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
+      })
+      const collection = client.collection(descriptor)
+      const broadDemand = {}
+      const filteredDemand = {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`title`]),
+          new IR.Value(`Keep`),
+        ]),
+      }
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      const before = new Map<string, Todo>([
+        [outside.id, outside],
+        [inside.id, inside],
+        [seed.id, seed],
+      ])
+      const durableExpected = new Map<string, Todo>([
+        ...(outsideChange === `deleted`
+          ? []
+          : [
+              [
+                outside.id,
+                outsideChange === `updated` ? outsideUpdated : outside,
+              ] as [string, Todo],
+            ]),
+        [insideUpdated.id, insideUpdated],
+        ...(seedCache === `older`
+          ? ([[storedSeed.id, storedSeed]] as Array<[string, Todo]>)
+          : []),
+      ])
+      const expected = new Map([...durableExpected, [seed.id, seed] as const])
+      const published = createEventGate()
+      const snapshots: Array<Map<string, Todo>> = []
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
+      try {
+        collection.startSyncImmediate()
+        await collection.stateWhenReady()
+        await collection._sync.loadSubset(broadDemand)
+        expectExactSnapshot(publicRows(), before)
+        collection._sync.unloadSubset(broadDemand)
+        await collection._sync.loadSubset(filteredDemand)
+        expectExactSnapshot(publicRows(), before)
+        subscription = collection.subscribeChanges(
+          () => {
+            snapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            published.resolve()
+          },
+          { includeInitialState: false },
+        )
+        const mutations: PersistedTx[`mutations`] = [
+          {
+            type: `update`,
+            key: insideUpdated.id,
+            value: { id: insideUpdated.id, detail: `new` },
+          },
+          ...(outsideChange === `updated`
+            ? ([
+                {
+                  type: `update`,
+                  key: outside.id,
+                  value: { id: outside.id, title: outsideUpdated.title },
+                },
+              ] as PersistedTx[`mutations`])
+            : outsideChange === `deleted`
+              ? ([
+                  { type: `delete`, key: outside.id, value: outside },
+                ] as PersistedTx[`mutations`])
+              : []),
+        ]
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId },
+          {
+            txId: `mixed-demand-notice`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            truncate: notice === `reset`,
+            mutations:
+              notice === `reset`
+                ? Array.from(durableExpected, ([key, value]) => ({
+                    type: `insert` as const,
+                    key,
+                    value,
+                  }))
+                : mutations,
+          },
+        )
+        expectExactSnapshot(adapter.rows, durableExpected)
+        const envelope: TxCommitted | CollectionReset =
+          notice === `reset`
+            ? { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 }
+            : notice === `full reload`
+              ? {
+                  type: `tx:committed`,
+                  term: 1,
+                  seq: 1,
+                  txId: `mixed-demand-notice`,
+                  latestRowVersion: 1,
+                  requiresFullReload: true,
+                }
+              : {
+                  type: `tx:committed`,
+                  term: 1,
+                  seq: 1,
+                  txId: `mixed-demand-notice`,
+                  latestRowVersion: 1,
+                  requiresFullReload: false,
+                  changedRows: mutations
+                    .filter((mutation) => mutation.type !== `delete`)
+                    .map((mutation) => ({
+                      key: mutation.key,
+                      value: mutation.value,
+                    })),
+                  deletedKeys: outsideChange === `deleted` ? [outside.id] : [],
+                }
+        coordinator.emit(envelope, undefined, collectionId)
+        await atPersistedOracleCheckpoint(
+          published.promise,
+          `mixed-demand peer publication`,
+        )
+        await flushAsyncWork()
+        expect(snapshots).toHaveLength(1)
+        for (const snapshot of snapshots)
+          expectExactSnapshot(snapshot, expected)
+        expectExactSnapshot(publicRows(), expected)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        subscription?.unsubscribe()
+        collection._sync.unloadSubset(filteredDemand)
+        await cleanupPersistedOracle(
+          [() => client.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Hydration authority is temporary. A DbClient seed wins over durable data
+  // only until an accepted source transaction confirms that key. After its
+  // applied receipt, a later peer transaction has ordinary durable authority.
+  // The model is the source-confirmed row or absence followed by the peer's
+  // complete durable result. A source insert or update permits a later peer
+  // update or delete; a source delete permits a later peer insert. Targeted and full-reload
+  // notices use different production paths, but both must publish the same
+  // public result at their settled change callback and afterward. An ordinary
+  // sibling changes in every notice, so perpetual seed protection reaches the
+  // exact-row comparison rather than only timing out waiting for a callback.
+  // This is the neighboring witness to the protected-seed histories above: an
+  // implementation that protects every hydrated key forever fails here.
+  it.each(
+    ([`targeted`, `full reload`] as const).flatMap((notice) => [
+      { notice, confirmation: `update` as const, change: `update` as const },
+      { notice, confirmation: `update` as const, change: `delete` as const },
+      { notice, confirmation: `insert` as const, change: `update` as const },
+      { notice, confirmation: `insert` as const, change: `delete` as const },
+      { notice, confirmation: `delete` as const, change: `insert` as const },
+    ]),
+  )(
+    `ends hydration protection after source $confirmation before a $notice peer $change`,
+    async ({ notice, confirmation, change }) => {
+      const seed = { id: `seed`, title: `Hydrated`, detail: `seed field` }
+      const confirmed = { id: seed.id, title: `Source`, detail: `source field` }
+      const peer = { id: seed.id, title: `Peer`, detail: `peer field` }
+      const ordinary = { id: `ordinary`, title: `Old ordinary` }
+      const ordinaryPeer = { id: ordinary.id, title: `New ordinary` }
+      const adapter = createRecordingAdapter([ordinary])
+      const coordinator = createCoordinatorHarness()
+      coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
+        await adapter.applyCommittedTx({ kind: `eager`, collectionId }, tx)
+        return {
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }
+      }
+      const collectionId = `confirmed-seed-${confirmation}-${notice}-${change}`
+      let source!: TodoSyncParams
+      const descriptor = collectionOptions(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const client = new DbClient()
+      client.hydrate({
+        collections: [{ collectionId, rows: [{ key: seed.id, value: seed }] }],
+      })
+      const collection = client.collection(descriptor)
+      const demand = {}
+      const publicRows = () =>
+        new Map(
+          Array.from(collection.values(), (row) => [
+            row.id,
+            stripVirtualProps(row),
+          ]),
+        )
+      const published = createEventGate()
+      const snapshots: Array<Map<string, Todo>> = []
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let hasPrimaryFailure = false
+      try {
+        collection.startSyncImmediate()
+        await collection.stateWhenReady()
+        await collection._sync.loadSubset(demand)
+        expectExactSnapshot(
+          publicRows(),
+          new Map([
+            [seed.id, seed],
+            [ordinary.id, ordinary],
+          ]),
+        )
+
+        source.begin()
+        source.write(
+          confirmation === `delete`
+            ? { type: `delete`, key: seed.id }
+            : { type: confirmation, value: confirmed },
+        )
+        await source.commit()
+        const confirmedRows = new Map<string, Todo>([
+          ...(confirmation === `delete`
+            ? []
+            : ([[seed.id, confirmed]] as Array<[string, Todo]>)),
+          [ordinary.id, ordinary],
+        ])
+        expectExactSnapshot(publicRows(), confirmedRows)
+        expectExactSnapshot(adapter.rows, confirmedRows)
+
+        subscription = collection.subscribeChanges(
+          () => {
+            snapshots.push(
+              new Map(
+                Array.from(publicRows(), ([key, row]) => [
+                  key,
+                  structuredClone(row),
+                ]),
+              ),
+            )
+            published.resolve()
+          },
+          { includeInitialState: false },
+        )
+        const mutations: PersistedTx[`mutations`] = [
+          { type: `update`, key: ordinary.id, value: ordinaryPeer },
+          change === `delete`
+            ? { type: `delete`, key: seed.id, value: confirmed }
+            : { type: change, key: seed.id, value: peer },
+        ]
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId },
+          {
+            txId: `confirmed-seed-peer`,
+            term: 1,
+            seq: 2,
+            rowVersion: 2,
+            mutations,
+          },
+        )
+        const expected = new Map<string, Todo>(
+          change !== `delete`
+            ? [
+                [seed.id, peer],
+                [ordinary.id, ordinaryPeer],
+              ]
+            : [[ordinary.id, ordinaryPeer]],
+        )
+        expectExactSnapshot(adapter.rows, expected)
+        const envelope: TxCommitted =
+          notice === `full reload`
+            ? {
+                type: `tx:committed`,
+                term: 1,
+                seq: 2,
+                txId: `confirmed-seed-peer`,
+                latestRowVersion: 2,
+                requiresFullReload: true,
+              }
+            : {
+                type: `tx:committed`,
+                term: 1,
+                seq: 2,
+                txId: `confirmed-seed-peer`,
+                latestRowVersion: 2,
+                requiresFullReload: false,
+                changedRows:
+                  change !== `delete`
+                    ? [
+                        { key: seed.id, value: peer },
+                        { key: ordinary.id, value: ordinaryPeer },
+                      ]
+                    : [{ key: ordinary.id, value: ordinaryPeer }],
+                deletedKeys: change === `delete` ? [seed.id] : [],
+              }
+        coordinator.emit(envelope, undefined, collectionId)
+        await atPersistedOracleCheckpoint(
+          published.promise,
+          `confirmed seed peer publication`,
+        )
+        await flushAsyncWork()
+        expect(snapshots).toHaveLength(1)
+        for (const snapshot of snapshots)
+          expectExactSnapshot(snapshot, expected)
+        expectExactSnapshot(publicRows(), expected)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        subscription?.unsubscribe()
+        collection._sync.unloadSubset(demand)
+        await cleanupPersistedOracle(
+          [() => client.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Hostile output controls calibrate the same comparison used above and by
+  // the captured-read source history. A missing key, an obsolete defined
+  // field, and an obsolete own-undefined field must all be rejected. These
+  // controls do not substitute for the production RED witnesses above.
+  it(`rejects omitted keys and retained fields at the exact snapshot comparison`, () => {
+    const expected = new Map<string, Todo>([
+      [`shared`, { id: `shared`, title: `Current` }],
+      [`new`, { id: `new`, title: `New` }],
+    ])
+    expect(() =>
+      expectExactSnapshot(
+        new Map([[`shared`, { id: `shared`, title: `Current` }]]),
+        expected,
+      ),
+    ).toThrow()
+    for (const detail of [`obsolete`, undefined]) {
+      expect(() =>
+        expectExactSnapshot(
+          new Map<string, Todo>([
+            [`shared`, { id: `shared`, title: `Current`, detail }],
+            [`new`, { id: `new`, title: `New` }],
+          ]),
+          expected,
+        ),
+      ).toThrow()
+    }
+  })
+
+  // Persisted rows are a baseline for newer sync-adapter changes. The maintainer
+  // decision recorded in issue-2036-admission-follow-up.md gives accepted sync
+  // transactions precedence over that baseline. A persistence read cannot revoke
+  // acceptance. A later truncate replay can supersede earlier source writes.
+  //
+  // A distinct overlap holds a complete read after it has captured the old
+  // durable value. A source change submitted during that wait must prevail at
+  // settlement after its receipt; the runtime may defer acceptance until the
+  // held read ends.
+  // The model is the authored baseline followed by one source operation. It
+  // crosses same-key replacement/deletion and a new key absent from the read;
+  // no intermediate publication timing is assumed before its receipt settles.
+  it.each([`insert same`, `insert new`, `update`, `delete`] as const)(
+    `keeps a source %s after a captured complete read`,
+    async (operation) => {
+      const old = { id: `shared`, title: `Persisted` }
+      const fresh = {
+        id: operation === `insert new` ? `new` : `shared`,
+        title: `Source`,
+      }
+      const expectedRows = new Map<string, Todo>(
+        operation === `delete`
+          ? []
+          : operation === `insert new`
+            ? [
+                [old.id, structuredClone(old)],
+                [fresh.id, structuredClone(fresh)],
+              ]
+            : [[fresh.id, structuredClone(fresh)]],
+      )
+      const adapter = createRecordingAdapter([old])
+      const originalLoad = adapter.loadSubset.bind(adapter)
+      const readEntered = createEventGate()
+      const releaseRead = createEventGate()
+      adapter.loadSubset = async (...args) => {
+        const captured = (await originalLoad(...args)).map((row) => ({
+          ...row,
+          value: structuredClone(row.value),
+        }))
+        readEntered.resolve()
+        await releaseRead.promise
+        return captured
+      }
+      let source!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `captured-complete-read-${operation}`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const demand = {}
+      let pendingRead: Promise<unknown> | undefined
+      let receipt: Promise<unknown> | undefined
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        pendingRead = Promise.resolve(collection._sync.loadSubset(demand))
+        void pendingRead.catch(() => undefined)
+        await atPersistedOracleCheckpoint(
+          readEntered.promise,
+          `complete read captured durable baseline`,
+        )
+        source.begin()
+        source.write(
+          operation === `delete`
+            ? { type: `delete`, key: old.id }
+            : {
+                type: operation.startsWith(`insert`) ? `insert` : `update`,
+                value: fresh,
+              },
+        )
+        receipt = Promise.resolve(source.commit())
+        void receipt.catch(() => undefined)
+        await flushAsyncWork()
+        expect(collection.get(old.id)?.title).not.toBe(old.title)
+        releaseRead.resolve()
+        await atPersistedOracleCheckpoint(
+          Promise.all([pendingRead, receipt]),
+          `captured complete read and source receipt settled`,
+        )
+        expectExactSnapshot(
+          new Map(
+            Array.from(collection.values(), (row) => [
+              row.id,
+              stripVirtualProps(row),
+            ]),
+          ),
+          expectedRows,
+        )
+        expectExactSnapshot(adapter.rows, expectedRows)
+        expect(collection.status).toBe(`ready`)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        releaseRead.resolve()
+        collection._sync.unloadSubset(demand)
+        await cleanupPersistedOracle(
+          [
+            () => Promise.allSettled([pendingRead, receipt]),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // This bounded grammar crosses insert/update/delete with no truncate replay,
+  // replay before the change, and replay after it. Each history runs with the
+  // persistence read already finished and with accepted commits waiting behind
+  // that read. Both schedules must satisfy the same independent result below.
+  // Eager and on-demand Collections receive reset/full-reload notifications;
+  // on-demand Collections acquire bounded or complete subsets. A full reload
+  // with no demand validates already public rows without publishing unrelated
+  // stored rows. The controlled coordinator does not prove host delivery.
+  it.each(
+    (
+      [
+        { syncMode: `on-demand`, route: `subset` },
+        { syncMode: `on-demand`, route: `complete subset` },
+        { syncMode: `on-demand`, route: `collection-reset` },
+        { syncMode: `on-demand`, route: `full-reload` },
+        { syncMode: `eager`, route: `collection-reset` },
+        { syncMode: `eager`, route: `full-reload` },
+      ] as const
+    ).flatMap(({ syncMode, route }) =>
+      ([`insert`, `update`, `delete`] as const).flatMap((operation) =>
+        ([`none`, `before`, `after`] as const).flatMap((truncateReplay) =>
+          [false, true].map((commitBeforeRead) => ({
+            syncMode,
+            route,
+            operation,
+            truncateReplay,
+            commitBeforeRead,
+          })),
+        ),
+      ),
+    ),
+  )(
+    `preserves sync history over persisted reads ($syncMode, $route, $operation, truncate=$truncateReplay, queued=$commitBeforeRead)`,
+    async ({
+      syncMode,
+      route,
+      operation,
+      truncateReplay,
+      commitBeforeRead,
+    }) => {
+      const storedRow = { id: `shared`, title: `persisted`, detail: `old` }
+      const storedOnly = { id: `stored-only`, title: `removed by truncate` }
+      const gateRow = { id: `gate`, title: `earlier sync transaction` }
+      const networkRow = { id: `shared`, title: `network`, detail: `new` }
+      const replacementRow = { id: `replacement`, title: `truncate replay` }
+      const adapter = createRecordingAdapter([
+        { ...storedRow },
+        { ...storedOnly },
+      ])
+      adapter.rowMetadata.set(`shared`, { owner: `persisted` })
+      adapter.collectionMetadata.set(`cursor`, `persisted`)
+      const coordinator = createFailStopCoordinatorHarness(
+        `persisted-read-precedence`,
+      )
+      const persistenceEntered = createEventGate()
+      const releasePersistence = createEventGate()
+      const readApplied = createEventGate()
+      const trace: Array<string> = []
+      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+      adapter.applyCommittedTx = async (...args) => {
+        if (args[1].mutations.some(({ key }) => key === `gate`)) {
+          persistenceEntered.resolve()
+          await releasePersistence.promise
+        }
+        await applyCommittedTx(...args)
+        // Record durable completion, including a delete or truncate. A rejected
+        // adapter write must never appear as a completed source obligation.
+        if (args[1].truncate) trace.push(`replacement`)
+        else if (args[1].mutations.some(({ key }) => key === `shared`)) {
+          trace.push(`network`)
+        }
+      }
+      coordinator.requestApplyCommittedTx = async (id, tx) => {
+        await adapter.applyCommittedTx({ kind: `eager`, collectionId: id }, tx)
+        return {
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }
+      }
+      const loadSubset = adapter.loadSubset.bind(adapter)
+      const readRows: Array<Array<Record<string, unknown>>> = []
+      adapter.loadSubset = async (...args) => {
+        const rows = await loadSubset(...args)
+        readRows.push(rows.map(({ value }) => ({ ...value })))
+        trace.push(`persisted read`)
+        return rows
+      }
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `persisted-read-precedence`,
+          getKey: (row) => row.id,
+          syncMode,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const options = route === `complete subset` ? {} : { limit: 100 }
+      const sourceSteps =
+        truncateReplay === `none`
+          ? [`network`]
+          : truncateReplay === `before`
+            ? [`replacement`, `network`]
+            : [`network`, `replacement`]
+      const noDemandRead =
+        syncMode === `on-demand` &&
+        route !== `subset` &&
+        route !== `complete subset`
+
+      // Independent snapshot algebra: a later replacement discards everything
+      // before it. Otherwise the baseline survives only when there is no
+      // replacement, and the newer change decides the shared key. Complete row
+      // values and explicit metadata avoid the separate partial-update contract.
+      // Source steps are input history, never observations from production.
+      const expectedRows =
+        truncateReplay === `after`
+          ? [replacementRow]
+          : [
+              ...(truncateReplay === `before`
+                ? [replacementRow]
+                : [storedOnly, gateRow]),
+              ...(operation === `delete` ? [] : [networkRow]),
+            ]
+      const expectedPublicRows =
+        noDemandRead && truncateReplay === `none`
+          ? [gateRow, ...(operation === `delete` ? [] : [networkRow])]
+          : expectedRows
+      const expectedMetadata = new Map<string, unknown>([
+        ...(truncateReplay === `none`
+          ? []
+          : [[`replacement`, { owner: `replacement` }] as const]),
+        ...(truncateReplay !== `after` && operation !== `delete`
+          ? [[`shared`, { owner: `network` }] as const]
+          : []),
+      ])
+      const expectedCursor =
+        truncateReplay === `after` ? `replacement` : `network`
+      // Await applied receipts and the optional subset-load promise.
+      const pendingOperations: Array<Promise<true | void>> = []
+      const retainOperation = (receipt: true | void | Promise<true | void>) => {
+        const pending = Promise.resolve(receipt)
+        void pending.catch(() => undefined)
+        pendingOperations.push(pending)
+      }
+      let hasPrimaryFailure = false
+      try {
+        await atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `precedence collection ready`,
+        )
+        // Hold an earlier durable write so the real runtime queues its read and
+        // ordinary sync transactions. The scope callback witnesses publication,
+        // not just completion of the adapter's load promise.
+        adapter.runInHydrationScope = async (task) => {
+          const result = await task(adapter)
+          readApplied.resolve()
+          return result
+        }
+        sourceParams.begin()
+        sourceParams.write({ type: `insert`, value: { ...gateRow } })
+        retainOperation(sourceParams.commit())
+        await atPersistedOracleCheckpoint(
+          persistenceEntered.promise,
+          `precedence predecessor held`,
+        )
+        if (route === `subset` || route === `complete subset`) {
+          retainOperation(collection._sync.loadSubset(options))
+        } else if (route === `collection-reset`) {
+          coordinator.emit({
+            type: `collection:reset`,
+            schemaVersion: 1,
+            resetEpoch: 1,
+          })
+        } else {
+          coordinator.emit({
+            type: `tx:committed`,
+            term: 1,
+            seq: 2,
+            txId: `remote-reload`,
+            latestRowVersion: 2,
+            requiresFullReload: true,
+          })
+        }
+        await flushAsyncWork()
+        expect(readRows).toEqual([])
+        expect(collection.get(`shared`)?.title).toBe(
+          syncMode === `eager` ? `persisted` : undefined,
+        )
+        if (!commitBeforeRead) {
+          releasePersistence.resolve()
+          await atPersistedOracleCheckpoint(
+            readApplied.promise,
+            `persistence read published before commit`,
+          )
+        }
+        for (const step of sourceSteps) {
+          sourceParams.begin()
+          if (step === `replacement`) {
+            sourceParams.truncate()
+            sourceParams.write({ type: `insert`, value: { ...replacementRow } })
+            sourceParams.metadata!.row.set(`replacement`, {
+              owner: `replacement`,
+            })
+          } else if (operation === `delete`) {
+            sourceParams.write({ type: `delete`, key: `shared` })
+          } else {
+            sourceParams.write({ type: operation, value: { ...networkRow } })
+            sourceParams.metadata!.row.set(`shared`, { owner: `network` })
+          }
+          sourceParams.metadata!.collection.set(`cursor`, step)
+          retainOperation(sourceParams.commit())
+        }
+        releasePersistence.resolve()
+        const outcomes = await atPersistedOracleCheckpoint(
+          Promise.allSettled(pendingOperations),
+          `sync history applied and durable`,
+        )
+        // Compare after applied receipts and the subset load settle, before cleanup. Exact
+        // keys detect resurrected deletes and rows wrongly retained by truncate.
+        // Read contents and completion order prove that the older baseline ran
+        // first in both schedules. No intermediate-publication claim is made.
+        const metadataKeys = [`shared`, `stored-only`, `gate`, `replacement`]
+        expect({
+          outcomes,
+          trace,
+          readRows,
+          status: collection.status,
+          publicRows: new Map(
+            Array.from(collection.values(), (row) => [
+              row.id,
+              stripVirtualProps(row),
+            ]),
+          ),
+          durableRows: adapter.rows,
+          publicMetadata: metadataKeys.map((key) =>
+            sourceParams.metadata!.row.get(key),
+          ),
+          durableMetadata: metadataKeys.map((key) =>
+            adapter.rowMetadata.get(key),
+          ),
+          publicCursor: sourceParams.metadata!.collection.get(`cursor`),
+          durableCursor: adapter.collectionMetadata.get(`cursor`),
+        }).toEqual({
+          outcomes: pendingOperations.map(() => ({
+            status: `fulfilled`,
+            value: undefined,
+          })),
+          trace: [...(noDemandRead ? [] : [`persisted read`]), ...sourceSteps],
+          readRows: noDemandRead ? [] : [[storedRow, storedOnly, gateRow]],
+          status: `ready`,
+          publicRows: new Map(expectedPublicRows.map((row) => [row.id, row])),
+          durableRows: new Map(expectedRows.map((row) => [row.id, row])),
+          publicMetadata: metadataKeys.map((key) => expectedMetadata.get(key)),
+          durableMetadata: metadataKeys.map((key) => expectedMetadata.get(key)),
+          publicCursor: expectedCursor,
+          durableCursor: expectedCursor,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        releasePersistence.resolve()
+        await cleanupPersistedOracle(
+          [
+            ...(route === `subset` || route === `complete subset`
+              ? [() => collection._sync.unloadSubset(options)]
+              : []),
+            () => Promise.allSettled(pendingOperations),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`rejects a source transaction that crosses a hydration cycle`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstEntered = createEventGate()
+    const releaseFirst = createEventGate()
+    const secondEntered = createEventGate()
+    const releaseSecond = createEventGate()
+    let loads = 0
+    adapter.loadSubset = async () => {
+      loads++
+      if (loads === 1) {
+        firstEntered.resolve()
+        await releaseFirst.promise
+        return []
+      }
+      secondEntered.resolve()
+      await releaseSecond.promise
+      const value = { id: `shared`, title: `second hydration` }
+      adapter.rows.set(value.id, value)
+      adapter.rowMetadata.set(value.id, { owner: `second hydration` })
+      return [
+        {
+          key: value.id,
+          value,
+          metadata: adapter.rowMetadata.get(value.id),
+        },
+      ]
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `bounded-cross-hydration-source`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const firstOptions = { limit: 1 }
+    const secondOptions = { limit: 2 }
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      const first = Promise.resolve(collection._sync.loadSubset(firstOptions))
+      await firstEntered.promise
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `shared`, title: `source value` },
+      })
+      releaseFirst.resolve()
+      await first
+
+      const second = Promise.resolve(collection._sync.loadSubset(secondOptions))
+      await secondEntered.promise
+      expect(() => sourceParams.commit()).toThrow(
+        `cannot cross a hydration cycle`,
+      )
+      releaseSecond.resolve()
+      await second
+
+      expect({
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        durableRow: adapter.rows.get(`shared`),
+        durableMetadata: adapter.rowMetadata.get(`shared`),
+        status: collection.status,
+      }).toEqual({
+        publicRow: { id: `shared`, title: `second hydration` },
+        durableRow: { id: `shared`, title: `second hydration` },
+        durableMetadata: { owner: `second hydration` },
+        status: `ready`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirst.resolve()
+      releaseSecond.resolve()
+      collection._sync.unloadSubset(firstOptions)
+      collection._sync.unloadSubset(secondOptions)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects a source transaction begun before hydration and committed after it`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrationEntered = createEventGate()
+    const releaseHydration = createEventGate()
+    adapter.loadSubset = async () => {
+      hydrationEntered.resolve()
+      await releaseHydration.promise
+      const value = { id: `shared`, title: `hydrated value` }
+      adapter.rows.set(value.id, value)
+      adapter.rowMetadata.set(value.id, { owner: `hydration` })
+      return [
+        {
+          key: value.id,
+          value,
+          metadata: adapter.rowMetadata.get(value.id),
+        },
+      ]
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `bounded-hydration-bracketing-source`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const options = { limit: 1 }
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `shared`, title: `source value` },
+      })
+
+      const hydration = Promise.resolve(collection._sync.loadSubset(options))
+      await hydrationEntered.promise
+      releaseHydration.resolve()
+      await hydration
+
+      expect(() => sourceParams.commit()).toThrow(
+        `cannot cross a hydration cycle`,
+      )
+      expect({
+        publicRow: stripVirtualProps(collection.get(`shared`)),
+        durableRow: adapter.rows.get(`shared`),
+        durableMetadata: adapter.rowMetadata.get(`shared`),
+        status: collection.status,
+      }).toEqual({
+        publicRow: { id: `shared`, title: `hydrated value` },
+        durableRow: { id: `shared`, title: `hydrated value` },
+        durableMetadata: { owner: `hydration` },
+        status: `ready`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseHydration.resolve()
+      collection._sync.unloadSubset(options)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`preserves full-reload metadata only for rows supplied by that reload`, async () => {
+    const adapter = createRecordingAdapter()
+    adapter.rowMetadata.set(`hydrated`, { source: `persisted` })
+    adapter.rowMetadata.set(`new`, { source: `orphaned` })
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let durableMetadataMutations: Array<unknown> = []
+    adapter.applyCommittedTx = async (...args) => {
+      durableMetadataMutations = [...(args[1].rowMetadataMutations ?? [])]
+      await applyCommittedTx(...args)
+    }
+    const hydrationEntered = createEventGate()
+    const hydration = createEventGate()
+    let holdReload = false
+    adapter.loadSubset = async () => {
+      if (!holdReload) return []
+      hydrationEntered.resolve()
+      await hydration.promise
+      return [
+        {
+          key: `hydrated`,
+          value: { id: `hydrated`, title: `Persisted reload row` },
+          metadata: { source: `persisted` },
+        },
+      ]
+    }
+    const coordinator = createFailStopCoordinatorHarness(
+      `full-reload-hydration-owned-metadata`,
+    )
+    coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        tx,
+      )
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `full-reload-hydration-owned-metadata`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let receipt: Promise<void> | undefined
+    const demand = { limit: 1 }
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `full-reload metadata collection ready`,
+      )
+      await collection._sync.loadSubset(demand)
+      holdReload = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `full-reload-metadata`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        hydrationEntered.promise,
+        `full-reload metadata hydration entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `hydrated`, title: `Source replacement` },
+      })
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `new`, title: `Genuinely new row` },
+      })
+
+      // Commit only after the reload's runtime marker clears. Ownership must
+      // remain attached to the transaction rather than ambient runtime state.
+      hydration.resolve()
+      await vi.waitFor(() =>
+        expect(stripVirtualProps(collection.get(`hydrated`))).toEqual({
+          id: `hydrated`,
+          title: `Persisted reload row`,
+        }),
+      )
+      receipt = Promise.resolve(sourceParams.commit()).then(() => undefined)
+      await atPersistedOracleCheckpoint(
+        receipt,
+        `full-reload metadata source receipt`,
+      )
+
+      expect({
+        publicHydrated: stripVirtualProps(collection.get(`hydrated`)),
+        publicNew: stripVirtualProps(collection.get(`new`)),
+        hydratedMetadata: adapter.rowMetadata.get(`hydrated`),
+        newMetadata: adapter.rowMetadata.get(`new`),
+        durableMetadataMutations,
+      }).toEqual({
+        publicHydrated: { id: `hydrated`, title: `Source replacement` },
+        publicNew: { id: `new`, title: `Genuinely new row` },
+        hydratedMetadata: { source: `persisted` },
+        newMetadata: undefined,
+        durableMetadataMutations: [{ type: `delete`, key: `new` }],
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      hydration.resolve()
+      collection._sync.unloadSubset(demand)
+      await cleanupPersistedOracle(
+        [() => receipt?.catch(() => undefined), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`persists truncate transactions and preserves intended collection metadata`, async () => {
+    const adapter = createRecordingAdapter()
+
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => void) | undefined
+    let remoteTruncate: (() => void) | undefined
+    let remoteMetadata:
+      Parameters<SyncConfig<Todo, string>[`sync`]>[0][`metadata`] | undefined
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-truncate`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, truncate, markReady, metadata }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            remoteTruncate = truncate
+            remoteMetadata = metadata
+            markReady()
+            return {}
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    await collection.stateWhenReady()
+    await flushAsyncWork()
+
+    remoteBegin?.()
+    remoteWrite?.({
+      type: `insert`,
+      value: {
+        id: `pre-truncate`,
+        title: `Pre truncate`,
+      },
+    })
+    remoteMetadata?.collection.set(`electric:resume`, {
+      kind: `reset`,
+      updatedAt: 1,
+    })
+    remoteTruncate?.()
+    remoteWrite?.({
+      type: `insert`,
+      value: {
+        id: `post-truncate`,
+        title: `Post truncate`,
+      },
+    })
+    remoteCommit?.()
+    await flushAsyncWork()
+
+    expect(adapter.applyCommittedTxCalls.at(-1)?.tx.truncate).toBe(true)
+
+    const reloadedCollection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-truncate`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    await reloadedCollection.preload()
+    await flushAsyncWork()
+
+    expect(reloadedCollection.get(`pre-truncate`)).toBeUndefined()
+    expect(stripVirtualProps(reloadedCollection.get(`post-truncate`))).toEqual({
+      id: `post-truncate`,
+      title: `Post truncate`,
+    })
+    expect(
+      reloadedCollection._state.syncedCollectionMetadata.get(`electric:resume`),
+    ).toEqual({
+      kind: `reset`,
+      updatedAt: 1,
+    })
+  })
+
+  it(`fail-stops an OK seq-gap delta when its application receipt rejects`, async () => {
+    const id = `gap-targeted-receipt`
+    const receiptError = new Error(`gap targeted receipt failed exactly`)
+    const firstApplied = createEventGate()
+    const receiptEntered = createEventGate()
+    const terminal = createEventGate()
+    const fallbackReload = createEventGate()
+    const barrierApplied = createEventGate()
+    let loadCalls = 0
+    const adapter = createRecordingAdapter()
+    adapter.loadSubset = async () => {
+      loadCalls++
+      if (loadCalls > 1) fallbackReload.resolve()
+      return []
+    }
+    const coordinator = createFailStopCoordinatorHarness(id)
+    coordinator.pullSince = async () => ({
+      type: `rpc:pullSince:res`,
+      rpcId: `targeted-replay`,
+      ok: true,
+      latestTerm: 1,
+      latestSeq: 3,
+      latestRowVersion: 3,
+      requiresFullReload: false,
+      changedKeys: [`replayed`],
+      deletedKeys: [],
+      deltas: [
+        {
+          txId: `replayed-delta`,
+          latestRowVersion: 2,
+          changedRows: [
+            {
+              key: `replayed`,
+              value: { id: `replayed`, title: `targeted replay` },
+            },
+          ],
+          deletedKeys: [],
+          rowMetadataMutations: [],
+          collectionMetadataMutations: [],
+        },
+      ],
+    })
+    let rejectNextCommit = false
+    let observeNextCommit = false
+    let observeBarrierCommit = false
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: { sync: ({ markReady }) => markReady() },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (rejectNextCommit) {
+                rejectNextCommit = false
+                receiptEntered.resolve()
+                void Promise.resolve(actualReceipt).catch(() => undefined)
+                return Promise.reject(receiptError)
+              }
+              if (observeNextCommit) {
+                observeNextCommit = false
+                void Promise.resolve(actualReceipt).then(() =>
+                  firstApplied.resolve(),
+                )
+              }
+              if (observeBarrierCommit) {
+                observeBarrierCommit = false
+                void Promise.resolve(actualReceipt).then(() =>
+                  barrierApplied.resolve(),
+                )
+              }
+              return actualReceipt
+            },
+          }),
+      },
+    })
+    const unsubscribeError = collection.on(`status:crashed`, () => {
+      terminal.resolve()
+    })
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `targeted gap initial ready`,
+      )
+      observeNextCommit = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `first`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          { key: `first`, value: { id: `first`, title: `first committed` } },
+        ],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        firstApplied.promise,
+        `targeted gap first transaction applied`,
+      )
+
+      rejectNextCommit = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 3,
+        txId: `gap`,
+        latestRowVersion: 3,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        receiptEntered.promise,
+        `targeted replay receipt entered`,
+      )
+      const outcome = await atPersistedOracleCheckpoint(
+        Promise.race([
+          terminal.promise.then(() => ({ kind: `terminal` as const })),
+          fallbackReload.promise.then(() => ({ kind: `fallback` as const })),
+        ]),
+        `targeted terminal error or fallback reload`,
+      )
+      if (outcome.kind === `fallback`) {
+        observeBarrierCommit = true
+        coordinator.emit({
+          type: `tx:committed`,
+          term: 1,
+          seq: 4,
+          txId: `barrier`,
+          latestRowVersion: 4,
+          requiresFullReload: false,
+          changedRows: [],
+          deletedKeys: [],
+        })
+        await atPersistedOracleCheckpoint(
+          barrierApplied.promise,
+          `targeted fallback barrier`,
+        )
+      }
+
+      expect({
+        outcome: outcome.kind,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        loadCalls,
+      }).toEqual({
+        outcome: `terminal`,
+        status: `crashed`,
+        publicError: receiptError,
+        loadCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      unsubscribeError()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`fail-stops an OK seq-gap full reload when adapter loading rejects`, async () => {
+    const id = `gap-full-reload-load`
+    const loadError = new Error(`gap full reload load failed exactly`)
+    const firstApplied = createEventGate()
+    const failingLoadEntered = createEventGate()
+    const terminal = createEventGate()
+    const fallbackReload = createEventGate()
+    const barrierApplied = createEventGate()
+    let loadCalls = 0
+    const adapter = createRecordingAdapter()
+    adapter.loadSubset = async () => {
+      loadCalls++
+      if (loadCalls === 1) {
+        failingLoadEntered.resolve()
+        throw loadError
+      }
+      if (loadCalls === 2) fallbackReload.resolve()
+      return []
+    }
+    const coordinator = createFailStopCoordinatorHarness(id)
+    coordinator.pullSince = async () => ({
+      type: `rpc:pullSince:res`,
+      rpcId: `full-reload`,
+      ok: true,
+      latestTerm: 1,
+      latestSeq: 3,
+      latestRowVersion: 3,
+      requiresFullReload: true,
+    })
+    let observeNextCommit = false
+    let observeBarrierCommit = false
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: { sync: ({ markReady }) => markReady() },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (observeNextCommit) {
+                observeNextCommit = false
+                void Promise.resolve(actualReceipt).then(() =>
+                  firstApplied.resolve(),
+                )
+              }
+              if (observeBarrierCommit) {
+                observeBarrierCommit = false
+                void Promise.resolve(actualReceipt).then(() =>
+                  barrierApplied.resolve(),
+                )
+              }
+              return actualReceipt
+            },
+          }),
+      },
+    })
+    const unsubscribeError = collection.on(`status:crashed`, () => {
+      terminal.resolve()
+    })
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `full reload gap initial ready`,
+      )
+      observeNextCommit = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `first`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          { key: `first`, value: { id: `first`, title: `first committed` } },
+        ],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        firstApplied.promise,
+        `full reload gap first transaction applied`,
+      )
+
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 3,
+        txId: `gap`,
+        latestRowVersion: 3,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        failingLoadEntered.promise,
+        `full reload gap failing load entered`,
+      )
+      const outcome = await atPersistedOracleCheckpoint(
+        Promise.race([
+          terminal.promise.then(() => ({ kind: `terminal` as const })),
+          fallbackReload.promise.then(() => ({ kind: `fallback` as const })),
+        ]),
+        `full reload terminal error or second fallback reload`,
+      )
+      if (outcome.kind === `fallback`) {
+        observeBarrierCommit = true
+        coordinator.emit({
+          type: `tx:committed`,
+          term: 1,
+          seq: 4,
+          txId: `barrier`,
+          latestRowVersion: 4,
+          requiresFullReload: false,
+          changedRows: [],
+          deletedKeys: [],
+        })
+        await atPersistedOracleCheckpoint(
+          barrierApplied.promise,
+          `full reload fallback barrier`,
+        )
+      }
+
+      expect({
+        outcome: outcome.kind,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        loadCalls,
+      }).toEqual({
+        outcome: `terminal`,
+        status: `crashed`,
+        publicError: loadError,
+        loadCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      unsubscribeError()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`keeps seq-gap pull transport rejection on the fallback path`, async () => {
+    const id = `gap-transport-control`
+    const transportError = new Error(`gap pull transport failed exactly`)
+    const firstApplied = createEventGate()
+    const fallbackReload = createEventGate()
+    const barrierApplied = createEventGate()
+    let loadCalls = 0
+    const adapter = createRecordingAdapter()
+    adapter.loadSubset = async () => {
+      loadCalls++
+      if (loadCalls === 1) fallbackReload.resolve()
+      return []
+    }
+    const coordinator = createFailStopCoordinatorHarness(id)
+    coordinator.pullSince = async () => {
+      throw transportError
+    }
+    let observeNextCommit = false
+    let observeBarrierCommit = false
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: { sync: ({ markReady }) => markReady() },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (observeNextCommit) {
+                observeNextCommit = false
+                void Promise.resolve(actualReceipt).then(() =>
+                  firstApplied.resolve(),
+                )
+              }
+              if (observeBarrierCommit) {
+                observeBarrierCommit = false
+                void Promise.resolve(actualReceipt).then(() =>
+                  barrierApplied.resolve(),
+                )
+              }
+              return actualReceipt
+            },
+          }),
+      },
+    })
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `transport gap initial ready`,
+      )
+      observeNextCommit = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `first`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          { key: `first`, value: { id: `first`, title: `first committed` } },
+        ],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        firstApplied.promise,
+        `transport gap first transaction applied`,
+      )
+
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 3,
+        txId: `gap`,
+        latestRowVersion: 3,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        fallbackReload.promise,
+        `transport gap fallback reload`,
+      )
+      observeBarrierCommit = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 4,
+        txId: `barrier`,
+        latestRowVersion: 4,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        barrierApplied.promise,
+        `transport fallback barrier`,
+      )
+
+      expect(warning).toHaveBeenCalledWith(
+        `Failed pullSince recovery attempt:`,
+        transportError,
+      )
+      expect({
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        loadCalls,
+      }).toEqual({
+        status: `ready`,
+        publicError: undefined,
+        loadCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      warning.mockRestore()
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`uses pullSince recovery when tx sequence gaps are detected`, async () => {
+    const adapter = createRecordingAdapter([
+      {
+        id: `1`,
+        title: `Initial`,
+      },
+    ])
+    const coordinator = createCoordinatorHarness()
+    coordinator.setPullSinceResponse({
+      type: `rpc:pullSince:res`,
+      rpcId: `pull-1`,
+      ok: true,
+      latestTerm: 1,
+      latestSeq: 3,
+      latestRowVersion: 3,
+      requiresFullReload: false,
+      changedKeys: [`2`],
+      deletedKeys: [],
+    })
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    await collection.preload()
+
+    adapter.rows.set(`2`, {
+      id: `2`,
+      title: `Recovered`,
+    })
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-1`,
+      latestRowVersion: 1,
+      requiresFullReload: false,
+      changedRows: [{ key: `1`, value: { id: `1`, title: `Initial` } }],
+      deletedKeys: [],
+    })
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 3,
+      txId: `tx-3`,
+      latestRowVersion: 3,
+      requiresFullReload: false,
+      changedRows: [{ key: `2`, value: { id: `2`, title: `Recovered` } }],
+      deletedKeys: [],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(coordinator.pullSinceCalls).toBe(1)
+    expect(stripVirtualProps(collection.get(`2`))).toEqual({
+      id: `2`,
+      title: `Recovered`,
+    })
+  })
+
+  it(`removes deleted rows after tx:committed invalidation reload`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `Keep` },
+      { id: `2`, title: `Delete` },
+    ])
+    const coordinator = createCoordinatorHarness()
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+    expect(stripVirtualProps(collection.get(`2`))).toEqual({
+      id: `2`,
+      title: `Delete`,
+    })
+
+    adapter.rows.delete(`2`)
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-delete`,
+      latestRowVersion: 1,
+      requiresFullReload: false,
+      changedRows: [],
+      deletedKeys: [`2`],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(collection.get(`2`)).toBeUndefined()
+  })
+
+  it(`does not let a stale invalidation reload overwrite a restarted lifecycle`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial` }])
+    const coordinator = createCoordinatorHarness()
+    const originalLoadSubset = adapter.loadSubset.bind(adapter)
+    let loadCalls = 0
+    let releaseStaleReload!: () => void
+    const staleReloadGate = new Promise<void>((resolve) => {
+      releaseStaleReload = resolve
+    })
+    adapter.loadSubset = async (...args) => {
+      loadCalls++
+      if (loadCalls === 1) {
+        await staleReloadGate
+        return [
+          {
+            key: `1`,
+            value: { id: `1`, title: `Stale reload` },
+          },
+        ]
+      }
+      return originalLoadSubset(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-stale-reload`,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+    })
+    for (let attempt = 0; attempt < 20 && loadCalls < 1; attempt++) {
+      await flushAsyncWork()
+    }
+    expect(loadCalls).toBe(1)
+
+    await collection.cleanup()
+    adapter.rows.set(`1`, { id: `1`, title: `Restarted` })
+    collection.startSyncImmediate()
+    releaseStaleReload()
+    expect(collection.get(`1`)?.title).not.toBe(`Stale reload`)
+
+    for (
+      let attempt = 0;
+      attempt < 20 && collection.get(`1`)?.title !== `Restarted`;
+      attempt++
+    ) {
+      await flushAsyncWork()
+    }
+    expect(stripVirtualProps(collection.get(`1`))).toEqual({
+      id: `1`,
+      title: `Restarted`,
+    })
+    await collection.cleanup()
+  })
+
+  it(`does not let stale reload metadata start row loading after restart`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial` }])
+    const coordinator = createCoordinatorHarness()
+    const originalLoadCollectionMetadata =
+      adapter.loadCollectionMetadata!.bind(adapter)
+    const originalLoadSubset = adapter.loadSubset.bind(adapter)
+    let metadataCalls = 0
+    let subsetCalls = 0
+    let releaseStaleMetadata!: () => void
+    const staleMetadataGate = new Promise<void>((resolve) => {
+      releaseStaleMetadata = resolve
+    })
+    adapter.loadCollectionMetadata = async (...args) => {
+      metadataCalls++
+      if (metadataCalls === 1) await staleMetadataGate
+      return originalLoadCollectionMetadata(...args)
+    }
+    adapter.loadSubset = async (...args) => {
+      subsetCalls++
+      return originalLoadSubset(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+    expect(metadataCalls).toBe(0)
+    expect(subsetCalls).toBe(0)
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-stale-metadata`,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+    })
+    for (let attempt = 0; attempt < 20 && metadataCalls < 1; attempt++) {
+      await flushAsyncWork()
+    }
+    expect(metadataCalls).toBe(1)
+    expect(subsetCalls).toBe(0)
+
+    await collection.cleanup()
+    adapter.rows.set(`1`, { id: `1`, title: `Restarted` })
+    collection.startSyncImmediate()
+    releaseStaleMetadata()
+    for (
+      let attempt = 0;
+      attempt < 20 && collection.get(`1`)?.title !== `Restarted`;
+      attempt++
+    ) {
+      await flushAsyncWork()
+    }
+
+    expect(metadataCalls).toBe(1)
+    expect(subsetCalls).toBe(0)
+    expect(stripVirtualProps(collection.get(`1`))).toEqual({
+      id: `1`,
+      title: `Restarted`,
+    })
+    await collection.cleanup()
+  })
+
+  it.each(
+    [false, true].flatMap((sharedSubscription) =>
+      [false, true].map((identical) => ({ sharedSubscription, identical })),
+    ),
+  )(
+    `keeps sibling requests owned after one release: %j`,
+    async ({ sharedSubscription, identical }) => {
+      const adapter = createRecordingAdapter([
+        { id: `1`, title: `Page row` },
+        { id: `2`, title: `All-only row` },
+      ])
+      // This finite provider honors the only selection this law generates.
+      const loadRows = adapter.loadSubset
+      adapter.loadSubset = async (...args) => {
+        const rows = await loadRows(...args)
+        return rows.slice(0, args[1].limit)
+      }
+      const coordinator = createCoordinatorHarness()
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `sync-present`,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      collection.startSyncImmediate()
+      const subscription = collection.subscribeChanges(() => {})
+      const owner = sharedSubscription ? { subscription } : {}
+      const page: LoadSubsetOptions = {
+        ...owner,
+        ...(identical ? {} : { limit: 1 }),
+      }
+      const all: LoadSubsetOptions = { ...owner }
+      try {
+        await collection._sync.loadSubset(page)
+        expect([...collection.keys()]).toEqual(identical ? [`1`, `2`] : [`1`])
+        await collection._sync.loadSubset(all)
+        expect([...collection.keys()]).toEqual([`1`, `2`])
+        collection._sync.unloadSubset(page)
+        adapter.rows.set(`2`, { id: `2`, title: `After page release` })
+        const beforeReload = adapter.loadSubsetCalls.length
+        coordinator.emit({
+          type: `tx:committed`,
+          term: 1,
+          seq: 1,
+          txId: `sibling-update`,
+          latestRowVersion: 1,
+          requiresFullReload: true,
+        })
+        await flushAsyncWork()
+        await flushAsyncWork()
+        expect(
+          adapter.loadSubsetCalls
+            .slice(beforeReload)
+            .map(({ options }) => options.limit),
+        ).toEqual([undefined])
+        expect([...collection.values()].map(stripVirtualProps)).toEqual([
+          { id: `1`, title: `Page row` },
+          { id: `2`, title: `After page release` },
+        ])
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts
index 2cd6c8a7e5..f14ed02fba 100644
--- a/packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/persisted-reload-replacement-oracle.test.ts
@@ -1,5 +1,6 @@
 import { createCollection } from '@tanstack/db'
 import { afterAll, describe, expect, it, vi } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { createOracleReach } from '../../db/tests/oracle-reach'
 import { persistedCollectionOptions } from '../src/index.js'
 import type { PersistenceAdapter } from '../src/index.js'
@@ -303,3 +304,5 @@ describe(`persisted reload replacement oracle`, () => {
     }
   })
 })
+
+declareOracle({ model: [expected], grammar: [histories] })
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-reset-startup.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-reset-startup.test.ts
new file mode 100644
index 0000000000..41d85a2966
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-reset-startup.test.ts
@@ -0,0 +1,2212 @@
+/**
+ * Ordinary regression tests for persisted reset reload failure, resume evidence, startup baselines, and key encoding, as fixed scenarios. The reset and startup laws are owned by persisted-oracle.test.ts.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { BasicIndex, IR, coalesce, createCollection } from '@tanstack/db'
+import {
+  InvalidPersistedStorageKeyEncodingError,
+  InvalidPersistedStorageKeyError,
+  SingleProcessCoordinator,
+  createPersistedTableName,
+  decodePersistedStorageKey,
+  encodePersistedStorageKey,
+  persistedCollectionOptions,
+} from '../src'
+import { Temporal } from './temporal-value-oracle'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createDeferred,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createNoopAdapter,
+  createRecordingAdapter,
+  createTerminalFailureHarness,
+  flushAsyncWork,
+  installHydrationRoutingProbe,
+  observeSettlement,
+  recordedStorageId,
+  stripVirtualProps,
+} from './persisted-support'
+import type {
+  PersistedCollectionCoordinator,
+  PersistedCollectionPersistence,
+  PersistedStorageTarget,
+  PersistedTx,
+  PersistenceAdapter,
+  TxCommitted,
+} from '../src'
+import type { SyncConfig, SyncMetadataApi } from '@tanstack/db'
+import type {
+  RecordingAdapter,
+  Todo,
+  TodoSyncParams,
+} from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`fail-stops queued and later work when reset reload fails after truncation`, async () => {
+    const seed = { id: `seed`, title: `durable baseline` }
+    const adapter = createRecordingAdapter([seed])
+    const coordinator = createFailStopCoordinatorHarness(
+      `terminal-reset-reload-failure`,
+    )
+    const reloadEntered = createEventGate()
+    const reload = createEventGate()
+    const reloadError = new Error(`reset reload failed exactly`)
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-reset-reload-failure`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let queuedReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `reset reload collection ready`,
+      )
+      expect(stripVirtualProps(collection.get(seed.id))).toEqual(seed)
+      adapter.loadSubset = async () => {
+        reloadEntered.resolve()
+        await reload.promise
+        throw reloadError
+      }
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 1,
+      })
+      await atPersistedOracleCheckpoint(
+        reloadEntered.promise,
+        `reset reload entered after memory truncate`,
+      )
+      expect(collection.get(seed.id)).toBeUndefined()
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `queued`, title: `must reject with reset failure` },
+      })
+      queuedReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void queuedReceipt.catch(() => undefined)
+      const queuedSettlement = observeSettlement(queuedReceipt)
+      expect(queuedSettlement.read()).toEqual({ status: `pending` })
+
+      reload.reject(reloadError)
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `late`, title: `must not continue after reset failure` },
+      })
+      const lateOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(sourceParams.commit()).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `post-reset-reload-failure receipt`,
+      )
+      const queuedOutcome = queuedSettlement.read()
+
+      expect({
+        queuedStatus: queuedOutcome.status,
+        queuedExact:
+          queuedOutcome.status === `rejected` &&
+          queuedOutcome.reason === reloadError,
+        lateStatus: lateOutcome.status,
+        lateExact:
+          lateOutcome.status === `rejected` &&
+          lateOutcome.reason === reloadError,
+        status: collection.status,
+        exactPublicError: collection._lifecycle.getSyncError() === reloadError,
+        visibleSeed: collection.get(seed.id),
+        durableSeed: adapter.rows.get(seed.id),
+        visibleQueued: collection.get(`queued`),
+        durableQueued: adapter.rows.get(`queued`),
+        visibleLate: collection.get(`late`),
+        durableLate: adapter.rows.get(`late`),
+        applyCalls: adapter.applyCommittedTxCalls.length,
+        publishCalls: coordinator.publishCalls.length,
+      }).toEqual({
+        queuedStatus: `rejected`,
+        queuedExact: true,
+        lateStatus: `rejected`,
+        lateExact: true,
+        status: `crashed`,
+        exactPublicError: true,
+        visibleSeed: undefined,
+        durableSeed: seed,
+        visibleQueued: undefined,
+        durableQueued: undefined,
+        visibleLate: undefined,
+        durableLate: undefined,
+        applyCalls: 0,
+        publishCalls: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      reload.reject(reloadError)
+      warning.mockRestore()
+      await cleanupPersistedOracle(
+        [
+          () => collection.cleanup(),
+          () => queuedReceipt?.catch(() => undefined),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`fences coordinator delivery after terminal failure while allowing release and cleanup`, async () => {
+    const harness = await createTerminalFailureHarness(
+      `durability`,
+      `terminal-coordinator-delivery-fence`,
+    )
+    const {
+      adapter,
+      collection,
+      coordinator,
+      initialLease,
+      terminalError,
+      upstreamLoads,
+      upstreamUnloads,
+    } = harness
+    const adapterLoadsBefore = adapter.loadSubsetCalls.length
+    const ensureCallsBefore = coordinator.remoteEnsureCalls.length
+    const releaseCallsBefore = coordinator.remoteReleaseCalls.length
+    const upstreamLoadsBefore = upstreamLoads.length
+    const applyCallsBefore = adapter.applyCommittedTxCalls.length
+    const publishCallsBefore = coordinator.publishCalls.length
+    adapter.loadSubset = (collectionId, options, context) => {
+      adapter.loadSubsetCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        options,
+        requiredIndexSignatures: context?.requiredIndexSignatures ?? [],
+      })
+      return Promise.resolve([
+        {
+          key: `coordinator-late`,
+          value: { id: `coordinator-late`, title: `must not arrive` },
+        },
+      ])
+    }
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `post-terminal-targeted`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          {
+            key: `targeted-late`,
+            value: { id: `targeted-late`, title: `must not arrive` },
+          },
+        ],
+        deletedKeys: [],
+      })
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `post-terminal-full-reload`,
+        latestRowVersion: 2,
+        requiresFullReload: true,
+      })
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 2,
+      })
+      const remoteEnsureOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(collection._sync.loadSubset({ limit: 9 })).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `post-terminal remote ensure delivery`,
+      )
+      await flushAsyncWork()
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      const beforeCleanup = {
+        targetedVisible: collection.get(`targeted-late`),
+        reloadVisible: collection.get(`coordinator-late`),
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+      }
+
+      collection._sync.unloadSubset(initialLease)
+      await flushAsyncWork()
+      await flushAsyncWork()
+      const unloadCount = upstreamUnloads.length
+      await collection.cleanup()
+      cleanedUp = true
+
+      expect({
+        remoteEnsureStatus: remoteEnsureOutcome.status,
+        remoteEnsureExact:
+          remoteEnsureOutcome.status === `rejected` &&
+          remoteEnsureOutcome.reason === terminalError,
+        adapterLoads: adapter.loadSubsetCalls.length,
+        ensureCalls: coordinator.remoteEnsureCalls.length,
+        releaseCalls: coordinator.remoteReleaseCalls.length,
+        releasedExact: coordinator.remoteReleaseCalls.at(-1) === initialLease,
+        upstreamLoads: upstreamLoads.length,
+        unloadCount,
+        unsubscribeCalls: coordinator.unsubscribeCalls,
+        applyCalls: adapter.applyCommittedTxCalls.length,
+        publishCalls: coordinator.publishCalls.length,
+        targetedVisible: beforeCleanup.targetedVisible,
+        reloadVisible: beforeCleanup.reloadVisible,
+        targetedDurable: adapter.rows.get(`targeted-late`),
+        reloadDurable: adapter.rows.get(`coordinator-late`),
+        status: beforeCleanup.status,
+        exactPublicError: beforeCleanup.exactPublicError,
+      }).toEqual({
+        remoteEnsureStatus: `rejected`,
+        remoteEnsureExact: true,
+        adapterLoads: adapterLoadsBefore,
+        ensureCalls: ensureCallsBefore,
+        releaseCalls: releaseCallsBefore + 1,
+        releasedExact: true,
+        upstreamLoads: upstreamLoadsBefore,
+        unloadCount: 0,
+        unsubscribeCalls: 1,
+        applyCalls: applyCallsBefore,
+        publishCalls: publishCallsBefore,
+        targetedVisible: undefined,
+        reloadVisible: undefined,
+        targetedDurable: undefined,
+        reloadDurable: undefined,
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => (cleanedUp ? undefined : collection.cleanup())],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`keeps a hydrated resume baseline across narrow full reloads`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `1`, title: `Narrow` },
+      { id: `2`, title: `Baseline only` },
+    ])
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    adapter.loadSubset = async (...args) => {
+      const rows = await loadSubset(...args)
+      return args[1].where ? rows.filter((row) => row.key === `1`) : rows
+    }
+    const coordinator = createCoordinatorHarness()
+    let hydrateBaseline: (() => Promise<void>) | undefined
+    let persistenceCapability:
+      NonNullable<SyncMetadataApi<string>[`persistence`]> | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady, metadata }) => {
+            const capability = metadata?.persistence
+            if (!capability) {
+              throw new Error(`Expected persisted sync capability`)
+            }
+            persistenceCapability = capability
+            hydrateBaseline = capability.hydrateBaseline
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(hydrateBaseline).toBeTypeOf(`function`))
+    expect(persistenceCapability).toMatchObject({
+      protocol: `@tanstack/db/sync-persistence`,
+      version: 1,
+    })
+    expect(persistenceCapability?.scanPersistedRows).toBeTypeOf(`function`)
+    expect(persistenceCapability?.resumeSnapshot.certify).toBeTypeOf(`function`)
+    expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence).toBeTypeOf(
+      `function`,
+    )
+    expect(
+      persistenceCapability?.resumeSnapshot.expectCurrentCommit,
+    ).toBeTypeOf(`function`)
+    await hydrateBaseline!()
+    expect(collection.has(`2`)).toBe(true)
+
+    await collection._sync.loadSubset({
+      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(`1`)]),
+    })
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `full-reload`,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+    })
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(collection.has(`2`)).toBe(true)
+    await collection.cleanup()
+  })
+
+  it(`keeps resume certification consistent after an owned no-op commit`, async () => {
+    const adapter = createRecordingAdapter()
+    let remoteBegin: (() => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    let persistenceCapability:
+      SyncMetadataApi<string>[`persistence`] | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `owned-no-op-generation`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, commit, markReady, metadata }) => {
+            remoteBegin = begin
+            remoteCommit = commit
+            persistenceCapability = metadata?.persistence
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await vi.waitFor(() =>
+        expect(persistenceCapability).toMatchObject({
+          protocol: `@tanstack/db/sync-persistence`,
+          version: 1,
+        }),
+      )
+
+      remoteBegin?.()
+      persistenceCapability?.resumeSnapshot.expectCurrentCommit()
+      const applied = remoteCommit?.()
+      if (applied !== true) await applied
+
+      expect(adapter.applyCommittedTxCalls).toHaveLength(0)
+      await persistenceCapability?.resumeSnapshot.certify()
+      expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence()).toEqual(
+        { status: `consistent` },
+      )
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // A no-write election reserves a new durable term but leaves the persisted
+  // rows, source cursor, row version, and reset epoch intact. The atomic
+  // snapshot still certifies the same baseline when on-demand Electric resumes.
+  // The recording adapter supplies only this term transition; the SQLite owner
+  // separately proves that term reservation leaves the row version unchanged.
+  it(`keeps resume evidence across a no-write durable term reservation`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `cached` }])
+    let durableGeneration = {
+      latestTerm: 1,
+      latestSeq: 1,
+      latestRowVersion: 1,
+      resetEpoch: 0,
+    }
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => ({
+      ...(await loadResumeSnapshot(...args)),
+      ...durableGeneration,
+    })
+    let persistenceCapability:
+      SyncMetadataApi<string>[`persistence`] | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `no-write-term-resume`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady, metadata }) => {
+            persistenceCapability = metadata?.persistence
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await vi.waitFor(() =>
+        expect(persistenceCapability).toMatchObject({
+          protocol: `@tanstack/db/sync-persistence`,
+          version: 1,
+        }),
+      )
+      await vi.waitFor(() =>
+        expect(
+          persistenceCapability?.resumeSnapshot.getKeySetEvidence(),
+        ).toEqual({ status: `consistent` }),
+      )
+
+      durableGeneration = {
+        latestTerm: 2,
+        latestSeq: 0,
+        latestRowVersion: 1,
+        resetEpoch: 0,
+      }
+      await persistenceCapability?.resumeSnapshot.certify()
+      expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence()).toEqual(
+        {
+          status: `consistent`,
+        },
+      )
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`invalidates resume evidence when storage advances outside the owned commit generation`, async () => {
+    const adapter = createRecordingAdapter()
+    let durableGeneration = {
+      latestTerm: 0,
+      latestSeq: 0,
+      latestRowVersion: 0,
+      resetEpoch: 0,
+    }
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => ({
+      ...(await loadResumeSnapshot(...args)),
+      ...durableGeneration,
+    })
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    adapter.applyCommittedTx = async (collectionId, tx) => {
+      await applyCommittedTx(collectionId, tx)
+      durableGeneration = {
+        latestTerm: tx.term,
+        latestSeq: tx.seq,
+        latestRowVersion: Math.max(
+          durableGeneration.latestRowVersion + 1,
+          tx.rowVersion,
+        ),
+        resetEpoch: durableGeneration.resetEpoch,
+      }
+    }
+
+    let remoteBegin: (() => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    let remoteMetadata:
+      Parameters<SyncConfig<Todo, string>[`sync`]>[0][`metadata`] | undefined
+    let persistenceCapability:
+      SyncMetadataApi<string>[`persistence`] | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `generation-fence`,
+        syncMode: `on-demand`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, commit, markReady, metadata }) => {
+            remoteBegin = begin
+            remoteCommit = commit
+            remoteMetadata = metadata
+            persistenceCapability = metadata?.persistence
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await vi.waitFor(() =>
+        expect(persistenceCapability).toMatchObject({
+          protocol: `@tanstack/db/sync-persistence`,
+          version: 1,
+        }),
+      )
+
+      // This is not a supported writer path. It models storage advancing
+      // without the runtime observing the generation that now precedes its
+      // commit. The exact-generation fence must reject that uncertainty.
+      durableGeneration.latestRowVersion = 5
+
+      remoteBegin?.()
+      persistenceCapability?.resumeSnapshot.expectCurrentCommit()
+      remoteMetadata?.collection.set(`cursor`, `next`)
+      const applied = remoteCommit?.()
+      if (applied !== true) await applied
+
+      await persistenceCapability?.resumeSnapshot.certify()
+      expect(persistenceCapability?.resumeSnapshot.getKeySetEvidence()).toEqual(
+        { status: `incompatible` },
+      )
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`ignores late wrapped sync writes after cleanup`, async () => {
+    let lateWrite!: (message: { type: `insert`; value: Todo }) => void
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `late-write-after-cleanup`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ write, markReady }) => {
+            lateWrite = (message) => write(message)
+            markReady()
+          },
+        },
+        persistence: { adapter: createNoopAdapter() },
+      }),
+    )
+
+    await collection.preload()
+    await collection.cleanup()
+
+    expect(() =>
+      lateWrite({
+        type: `insert`,
+        value: { id: `late`, title: `Late` },
+      }),
+    ).not.toThrow()
+    expect(collection.has(`late`)).toBe(false)
+  })
+
+  it(`keeps retired sync controls inert after cleanup and restart`, async () => {
+    const adapter = createRecordingAdapter()
+    const runs: Array<TodoSyncParams> = []
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `retired-controls-after-restart`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: (params) => {
+            runs.push(params)
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      await collection.preload()
+      expect(runs).toHaveLength(1)
+      const retired = runs[0]!
+
+      await collection.cleanup()
+      const replacementReady = createEventGate()
+      const unsubscribe = collection.on(`status:ready`, () =>
+        replacementReady.resolve(),
+      )
+      collection.startSyncImmediate()
+      await atPersistedOracleCheckpoint(
+        replacementReady.promise,
+        `replacement controls ready`,
+      )
+      unsubscribe()
+      expect(runs).toHaveLength(2)
+
+      retired.begin()
+      retired.write({
+        type: `insert`,
+        value: { id: `retired`, title: `must stay retired` },
+      })
+      const retiredReceipt = retired.commit()
+      if (retiredReceipt !== true) await retiredReceipt
+
+      const replacement = runs[1]!
+      replacement.begin()
+      replacement.write({
+        type: `insert`,
+        value: { id: `replacement`, title: `new controls own this row` },
+      })
+      const replacementReceipt = replacement.commit()
+      if (replacementReceipt !== true) await replacementReceipt
+
+      // A retained capability from the cleaned-up run must not truncate the
+      // new Collection, even when invoked after the replacement row applies.
+      await retired.metadata!.persistence!.startScopedRecovery!()
+
+      expect({
+        retiredPublic: collection.get(`retired`),
+        retiredDurable: adapter.rows.get(`retired`),
+        replacementPublic: stripVirtualProps(collection.get(`replacement`)),
+        replacementDurable: adapter.rows.get(`replacement`),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        retiredPublic: undefined,
+        retiredDurable: undefined,
+        replacementPublic: {
+          id: `replacement`,
+          title: `new controls own this row`,
+        },
+        replacementDurable: {
+          id: `replacement`,
+          title: `new controls own this row`,
+        },
+        status: `ready`,
+        publicError: undefined,
+      })
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  // Focused collection-reset refinement: metadata and rows must come from one
+  // hydration scope. The adapter makes an interleaved v2 write possible only
+  // outside that scope, so the public v1 metadata and row are the independent
+  // coherence checkpoint. This fixed history does not model arbitrary resets.
+  it(`rebases a managed reset from its claimed physical storage`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const physicalId = `managed-reset-physical`
+    const claimId = `managed-reset-claim`
+    const reads: Array<PersistedStorageTarget> = []
+    const load = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = (target, context) => {
+      reads.push(target)
+      return load(target, context)
+    }
+    adapter.claimCacheGeneration = async () => ({
+      storageCollectionId: physicalId,
+      claimId,
+      expiresAtMs: Date.now() + 60_000,
+    })
+    adapter.rotateCacheGeneration = async () => ({
+      storageCollectionId: physicalId,
+      claimId,
+      expiresAtMs: Date.now() + 60_000,
+    })
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `managed-reset-logical`,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              restartAfterScopedRecovery: () => {},
+              loadSubset: async () => {},
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      const before = reads.length
+      coordinator.emit(
+        { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
+        `peer`,
+        physicalId,
+      )
+      await vi.waitFor(() => expect(reads.length).toBeGreaterThan(before))
+      expect(reads.slice(before)).toContainEqual({
+        kind: `managed`,
+        storageCollectionId: physicalId,
+        claimId,
+      })
+      expect(reads.slice(before)).not.toContainEqual({
+        kind: `eager`,
+        collectionId: `managed-reset-logical`,
+      })
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`keeps a collection-reset reload inside one hydration scope`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial row` }])
+    adapter.collectionMetadata.set(`snapshot`, `initial`)
+    const coordinator = createCoordinatorHarness()
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    let inHydrationScope = false
+    let interleaveArmed = false
+    let interleaveRan = false
+
+    const runInterleavedWrite = () => {
+      interleaveRan = true
+      adapter.collectionMetadata.set(`snapshot`, `v2`)
+      adapter.rows.set(`1`, { id: `1`, title: `v2 row` })
+    }
+
+    adapter.loadSubset = async (...args) => {
+      if (interleaveArmed && !inHydrationScope && !interleaveRan) {
+        runInterleavedWrite()
+      }
+      return loadSubset(...args)
+    }
+    adapter.runInHydrationScope = async (task) => {
+      inHydrationScope = true
+      try {
+        return await task(adapter)
+      } finally {
+        inHydrationScope = false
+        if (interleaveArmed && !interleaveRan) runInterleavedWrite()
+      }
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    await collection.preload()
+    adapter.collectionMetadata.set(`snapshot`, `v1`)
+    adapter.rows.set(`1`, { id: `1`, title: `v1 row` })
+    interleaveArmed = true
+
+    coordinator.emit({
+      type: `collection:reset`,
+      schemaVersion: 1,
+      resetEpoch: 1,
+    })
+
+    await vi.waitFor(() => expect(interleaveRan).toBe(true))
+    expect(collection._state.syncedCollectionMetadata.get(`snapshot`)).toBe(
+      `v1`,
+    )
+    expect(collection.get(`1`)?.title).toBe(`v1 row`)
+    await collection.cleanup()
+  })
+
+  // A remote commit queued during startup must run after the local hydration
+  // scope releases the shared driver. A reset racing an unscheduled startup
+  // baseline may publish before or after that baseline, but must own the final
+  // public snapshot and may never be overwritten by an older baseline.
+  it(`does not let an unscheduled startup baseline overwrite a newer collection reset`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `old` }])
+    const coordinator = createCoordinatorHarness()
+    const baselineEntered = createEventGate()
+    const releaseBaseline = createEventGate()
+    const resetReloadEntered = createEventGate()
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    let heldBaseline = false
+    adapter.loadResumeSnapshot = async (...args) => {
+      const snapshot = await loadResumeSnapshot(...args)
+      if (args[1]?.includeRows && !heldBaseline) {
+        heldBaseline = true
+        baselineEntered.resolve()
+        await releaseBaseline.promise
+      }
+      return snapshot
+    }
+    adapter.loadSubset = (...args) => {
+      resetReloadEntered.resolve()
+      return loadSubset(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: { sync: ({ markReady }) => markReady() },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const preload = collection.preload()
+    void preload.catch(() => undefined)
+    const publishedTitles: Array<string | undefined> = []
+    const subscription = collection.subscribeChanges(
+      () => publishedTitles.push(collection.get(`1`)?.title),
+      { includeInitialState: false },
+    )
+
+    try {
+      await atPersistedOracleCheckpoint(
+        baselineEntered.promise,
+        `unscheduled baseline entered`,
+      )
+      adapter.rows.set(`1`, { id: `1`, title: `new` })
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 1,
+      })
+      // Give a concurrent reset its event-loop turn. Serialization may instead
+      // hold it behind the baseline; both orders must converge without a
+      // public new -> old reversion.
+      await flushAsyncWork()
+      expect([undefined, `new`]).toContain(collection.get(`1`)?.title)
+      releaseBaseline.resolve()
+      await atPersistedOracleCheckpoint(preload, `startup after reset`)
+      await atPersistedOracleCheckpoint(
+        resetReloadEntered.promise,
+        `reset reload after startup`,
+      )
+      await vi.waitFor(() => expect(collection.get(`1`)?.title).toBe(`new`))
+      const firstNew = publishedTitles.indexOf(`new`)
+      expect(firstNew).toBeGreaterThanOrEqual(0)
+      expect(publishedTitles.slice(firstNew)).not.toContain(`old`)
+    } finally {
+      releaseBaseline.resolve()
+      await preload.catch(() => undefined)
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it.each([`contiguous-reload`, `sequence-gap`] as const)(
+    `finishes queued %s after scheduled startup hydration releases its scope`,
+    async (route) => {
+      const adapter = createRecordingAdapter([{ id: `1`, title: `old` }])
+      const coordinator = createCoordinatorHarness()
+      const baselineEntered = createEventGate()
+      const releaseBaseline = createEventGate()
+      const nestedScopeRequested = createEventGate()
+      const queuedScopes: Array<() => void> = []
+      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+      let heldBaseline = false
+      let scopeActive = false
+
+      adapter.loadResumeSnapshot = async (...args) => {
+        const snapshot = await loadResumeSnapshot(...args)
+        if (args[1]?.includeRows && !heldBaseline) {
+          heldBaseline = true
+          baselineEntered.resolve()
+          await releaseBaseline.promise
+        }
+        return snapshot
+      }
+
+      const scopedAdapter: RecordingAdapter = { ...adapter }
+      scopedAdapter.runInHydrationScope = (task) => task(scopedAdapter)
+      adapter.runInHydrationScope = (task) => {
+        if (scopeActive) {
+          nestedScopeRequested.resolve()
+          return new Promise((resolve, reject) => {
+            queuedScopes.push(() => {
+              void task(scopedAdapter).then(resolve, reject)
+            })
+          })
+        }
+        scopeActive = true
+        return Promise.resolve()
+          .then(() => task(scopedAdapter))
+          .finally(() => {
+            scopeActive = false
+            while (queuedScopes.length > 0) queuedScopes.shift()?.()
+          })
+      }
+
+      if (route === `sequence-gap`) {
+        coordinator.setPullSinceResponse({
+          type: `rpc:pullSince:res`,
+          rpcId: `review-gap`,
+          ok: true,
+          latestTerm: 1,
+          latestSeq: 2,
+          latestRowVersion: 2,
+          requiresFullReload: true,
+        })
+      }
+      const pullSince = coordinator.pullSince!.bind(coordinator)
+      let coordinatorEnteredDuringScope: boolean | undefined
+      coordinator.pullSince = (...args) => {
+        coordinatorEnteredDuringScope = scopeActive
+        return pullSince(...args)
+      }
+
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `sync-present`,
+          getKey: (item) => item.id,
+          sync: { sync: ({ markReady }) => markReady() },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      const preload = collection.preload()
+      void preload.catch(() => undefined)
+
+      try {
+        await atPersistedOracleCheckpoint(
+          baselineEntered.promise,
+          `${route} baseline entered`,
+        )
+        adapter.rows.set(`1`, { id: `1`, title: `new` })
+        const committed: TxCommitted =
+          route === `sequence-gap`
+            ? {
+                type: `tx:committed`,
+                term: 1,
+                seq: 2,
+                txId: `review-sequence-gap`,
+                latestRowVersion: 2,
+                requiresFullReload: false,
+                changedRows: [],
+                deletedKeys: [],
+              }
+            : {
+                type: `tx:committed`,
+                term: 1,
+                seq: 1,
+                txId: `review-contiguous-reload`,
+                latestRowVersion: 1,
+                requiresFullReload: true,
+              }
+        coordinator.emit(committed)
+        releaseBaseline.resolve()
+        const first = await atPersistedOracleCheckpoint(
+          Promise.race([
+            preload.then(() => `startup-settled` as const),
+            nestedScopeRequested.promise.then(() => `nested-scope` as const),
+          ]),
+          `${route} startup or nested scope`,
+        )
+        expect(first).toBe(`startup-settled`)
+        expect(collection.get(`1`)?.title).toBe(`new`)
+        if (route === `sequence-gap`) {
+          expect(coordinator.pullSinceCalls).toBe(1)
+          expect(coordinatorEnteredDuringScope).toBe(false)
+        }
+      } finally {
+        releaseBaseline.resolve()
+        while (queuedScopes.length > 0) queuedScopes.shift()?.()
+        await preload.catch(() => undefined)
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // Focused receipt-ownership refinements. A source receipt created by the
+  // hydration operation belongs to its waiter even if it rejects before the
+  // waiter snapshots; a receipt created after hydration work returns does not.
+  // The public load result and exact rejection identity distinguish those two
+  // boundaries without treating every pending source receipt as related.
+  it(`propagates an operation-owned receipt rejection that settles before the hydration waiter snapshots`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrateLoadEntered = createDeferred()
+    const allowHydrateLoad = createDeferred()
+    let gateHydrationLoad = true
+    adapter.loadSubset = async () => {
+      if (gateHydrationLoad) {
+        gateHydrationLoad = false
+        hydrateLoadEntered.resolve()
+        await allowHydrateLoad.promise
+      }
+      return []
+    }
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-settled-receipt-boundary`,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let load: Promise<unknown> | undefined
+    let receipt: Promise<void> | undefined
+    const abortController = new AbortController()
+
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+      await hydrateLoadEntered.promise
+
+      let keyReads = 0
+      const establishingRow = {
+        get id() {
+          keyReads++
+          if (keyReads === 2) abortController.abort()
+          return `establishing`
+        },
+        title: `Abort during buffered replay`,
+      }
+      remoteBegin?.()
+      remoteWrite?.({ type: `insert`, value: establishingRow })
+      const applied = remoteCommit?.(abortController.signal)
+      if (!(applied instanceof Promise)) {
+        throw new Error(`expected a buffered establishing receipt`)
+      }
+      receipt = applied
+      void receipt.catch(() => undefined)
+
+      allowHydrateLoad.resolve()
+      const [loadResult, receiptResult] = await Promise.allSettled([
+        load,
+        receipt,
+      ])
+
+      expect(keyReads).toBeGreaterThanOrEqual(2)
+      expect(abortController.signal.aborted).toBe(true)
+      expect(receiptResult.status).toBe(`rejected`)
+      expect(loadResult.status).toBe(`rejected`)
+      if (
+        loadResult.status === `rejected` &&
+        receiptResult.status === `rejected`
+      ) {
+        expect(loadResult.reason).toBe(receiptResult.reason)
+      }
+    } finally {
+      abortController.abort()
+      allowHydrateLoad.resolve()
+      await receipt?.catch(() => undefined)
+      await load?.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not adopt an unrelated source receipt created after hydration work returns`, async () => {
+    const adapter = createRecordingAdapter()
+    const mutationEntered = createDeferred()
+    const releaseMutation = createDeferred()
+    const unrelatedStarted = createDeferred<{
+      abortController: AbortController
+      receipt: Promise<void>
+    }>()
+    const trace: Array<string> = []
+    let probeActive = false
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+
+    adapter.runInHydrationScope = async (task) => {
+      if (!probeActive) return task(adapter)
+      probeActive = false
+
+      const result = await task(adapter)
+      trace.push(`hydrate-task-returned`)
+
+      const abortController = new AbortController()
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `unrelated`, title: `Outside hydrate boundary` },
+      })
+      const receipt = remoteCommit?.(abortController.signal)
+      if (!(receipt instanceof Promise)) {
+        throw new Error(`expected a pending unrelated receipt`)
+      }
+      trace.push(`unrelated-receipt-created`)
+      unrelatedStarted.resolve({ abortController, receipt })
+      return result
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-unrelated-receipt-boundary`,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+        onInsert: async () => {
+          mutationEntered.resolve()
+          await releaseMutation.promise
+        },
+      }),
+    )
+    let mutation: ReturnType<typeof collection.insert> | undefined
+    let load: Promise<unknown> | undefined
+    let unrelated:
+      { abortController: AbortController; receipt: Promise<void> } | undefined
+
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      mutation = collection.insert({ id: `local`, title: `Persisting gate` })
+      await mutationEntered.promise
+
+      probeActive = true
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+      unrelated = await unrelatedStarted.promise
+      expect(trace).toEqual([
+        `hydrate-task-returned`,
+        `unrelated-receipt-created`,
+      ])
+
+      // Give the public load continuation the opportunity to snapshot receipts.
+      await flushAsyncWork()
+      unrelated.abortController.abort()
+
+      // The subset's own hydrated rows wait behind the persisting mutation,
+      // so the load settles once that mutation does. It must not also wait
+      // for the unrelated receipt.
+      releaseMutation.resolve()
+      await mutation.isPersisted.promise
+      await expect(load).resolves.toBeUndefined()
+      await unrelated.receipt.catch(() => undefined)
+    } finally {
+      unrelated?.abortController.abort()
+      releaseMutation.resolve()
+      await mutation?.isPersisted.promise.catch(() => undefined)
+      await load?.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+
+  // Persisted indexes are optional query accelerators: the existing adapter
+  // failure law keeps rows and readiness available when an index cannot be
+  // stored. Spec construction belongs to that same best-effort boundary.
+  // These histories add real serialization rejection before adapter entry,
+  // both at bootstrap and at index:added, with a healthy sibling and supported
+  // native control. Rows use ordinary strings; no unsupported row write is
+  // admitted. At settled index work, compare readiness, rows, warnings, and the
+  // exact signatures that reached the adapter and coordinator.
+  it.sequential.each(
+    [`startup`, `runtime`].flatMap((phase) =>
+      [
+        `Instant`,
+        `PlainDate`,
+        `ZonedDateTime`,
+        `Duration`,
+        `missing-global`,
+        `missing-global-date`,
+      ].map((kind) => ({ phase, kind })),
+    ),
+  )(
+    `keeps index serialization failure best-effort / $phase / $kind`,
+    async ({ phase, kind }) => {
+      const originalTemporal = Object.getOwnPropertyDescriptor(
+        globalThis,
+        `Temporal`,
+      )
+      Object.defineProperty(globalThis, `Temporal`, {
+        value: kind.startsWith(`missing-global`) ? undefined : Temporal,
+        configurable: true,
+        writable: true,
+      })
+      const value =
+        kind === `PlainDate` || kind === `missing-global-date`
+          ? Temporal.PlainDate.from(`2026-01-02`)
+          : kind === `ZonedDateTime`
+            ? Temporal.ZonedDateTime.from(`2026-01-02T00:00:00+00:00[UTC]`)
+            : kind === `Duration`
+              ? Temporal.Duration.from(`PT1H`)
+              : Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+      const accepted = kind === `Instant` || kind === `PlainDate`
+      const row = { id: `persisted`, title: `ordinary row` }
+      const adapter = createRecordingAdapter([row])
+      const coordinator = createCoordinatorHarness()
+      const remoteSignatures: Array<string> = []
+      coordinator.requestEnsurePersistedIndex = (_id, signature) => {
+        remoteSignatures.push(signature)
+        return Promise.resolve()
+      }
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `index-serialization-${phase}-${kind}`,
+          getKey: (item) => item.id,
+          defaultIndexType: BasicIndex,
+          sync: { sync: ({ markReady }) => markReady() },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      let hasPrimaryFailure = false
+      try {
+        if (phase === `runtime`) await collection.preload()
+        const index = collection.createIndex((item) =>
+          coalesce(item.title, new IR.Value(value)),
+        )
+        const healthy = collection.createIndex((item) => item.id)
+        const metadata = collection.getIndexMetadata()
+        const signature = metadata.find(
+          (entry) => entry.indexId === index.id,
+        )!.signature
+        const healthySignature = metadata.find(
+          (entry) => entry.indexId === healthy.id,
+        )!.signature
+        if (phase === `startup`)
+          await expect(collection.preload()).resolves.toBeUndefined()
+        await flushAsyncWork()
+        expect(collection.status).toBe(`ready`)
+        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
+        const expectedSignatures = accepted
+          ? [signature, healthySignature]
+          : [healthySignature]
+        expect(adapter.ensureIndexCalls.map((call) => call.signature)).toEqual(
+          expectedSignatures,
+        )
+        expect(remoteSignatures).toEqual(expectedSignatures)
+        expect(warning.mock.calls).toHaveLength(accepted ? 0 : 2)
+        if (!accepted) {
+          expect(warning.mock.calls.map(([message]) => message)).toEqual([
+            `Failed to ensure persisted index in adapter:`,
+            `Failed to ensure persisted index through coordinator:`,
+          ])
+          for (const [, error] of warning.mock.calls) {
+            expect(error).toMatchObject({
+              name: `InvalidPersistedCollectionConfigError`,
+            })
+          }
+        }
+        // A following ordinary subset load is still usable after the skipped index.
+        await collection._sync.loadSubset({ limit: 1 })
+        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [
+            () => warning.mockRestore(),
+            () => collection.cleanup(),
+            () => {
+              if (originalTemporal)
+                Object.defineProperty(globalThis, `Temporal`, originalTemporal)
+              else Reflect.deleteProperty(globalThis, `Temporal`)
+            },
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Optional index failure isolation also applies after serializer admission.
+  // The model is a product of independent collaborator outcomes, not runtime
+  // control flow: local success alone authorizes a completion marker; either
+  // collaborator may fail without failing rows, readiness, or a healthy sibling.
+  // A held local promise supplies the intermediate observation: its coordinator
+  // request cannot claim completed work before that promise settles. Startup
+  // visits indexes serially; runtime additions may overlap, so only per-index
+  // causality and exact call multiplicity are promised, not global call order.
+  it.sequential.each(
+    [`startup`, `runtime`].flatMap((phase) =>
+      [`local`, `coordinator`, `both`].flatMap((boundary) =>
+        [`throw`, `held`].flatMap((settlement) =>
+          [false, true].map((fails) => ({
+            phase,
+            boundary,
+            settlement,
+            fails,
+          })),
+        ),
+      ),
+    ),
+  )(
+    `isolates optional index outcomes / $phase / $boundary / $settlement / fails $fails`,
+    async ({ phase, boundary, settlement, fails }) => {
+      const row = { id: `row`, title: `available` }
+      const adapter = createRecordingAdapter([row])
+      const coordinator = createCoordinatorHarness()
+      const entered = createDeferred()
+      const gate = createDeferred()
+      const failure = new Error(`optional index rejected`)
+      const localNames: Array<string> = []
+      const remote: Array<{ name: string; completed: boolean }> = []
+      const unhandled: Array<unknown> = []
+      const onUnhandled = (error: unknown) => unhandled.push(error)
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const settle = () => {
+        entered.resolve()
+        if (settlement === `held`)
+          return gate.promise.then(() => {
+            if (fails) throw failure
+          })
+        if (fails) throw failure
+        return Promise.resolve()
+      }
+      adapter.ensureIndex = (_id, _signature, spec) => {
+        const name = String(spec.metadata?.name)
+        localNames.push(name)
+        return name === `target` && boundary !== `coordinator`
+          ? settle()
+          : Promise.resolve()
+      }
+      coordinator.requestEnsurePersistedIndex = (
+        _id,
+        _signature,
+        spec,
+        completedAdapter,
+        completed,
+      ) => {
+        const name = String(spec.metadata?.name)
+        // The flag and adapter capability must agree, including failed locals.
+        expect(completedAdapter).toBe(completed ? adapter : undefined)
+        remote.push({ name, completed: completed === true })
+        return name === `target` && boundary !== `local`
+          ? settle()
+          : Promise.resolve()
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `optional-index-${phase}-${boundary}-${settlement}-${fails}`,
+          getKey: (item) => item.id,
+          defaultIndexType: BasicIndex,
+          sync: { sync: ({ markReady }) => markReady() },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      let preload: Promise<void> | undefined
+      let hasPrimaryFailure = false
+      process.on(`unhandledRejection`, onUnhandled)
+      try {
+        if (phase === `runtime`) await collection.preload()
+        collection.createIndex((item) => item.title, { name: `target` })
+        collection.createIndex((item) => item.id, { name: `healthy` })
+        if (phase === `startup`) {
+          preload = Promise.resolve(collection.preload())
+          void preload.catch(() => undefined)
+        }
+        await entered.promise
+        await flushAsyncWork()
+        expect(collection.status).not.toBe(`crashed`)
+        if (phase === `runtime`) {
+          expect(collection.status).toBe(`ready`)
+          expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
+        }
+        if (settlement === `held`) {
+          expect(warning).not.toHaveBeenCalled()
+          if (boundary !== `coordinator`)
+            expect(remote.filter((entry) => entry.name === `target`)).toEqual(
+              [],
+            )
+        }
+        gate.resolve()
+        await preload
+        await flushAsyncWork()
+        expect(collection.status).toBe(`ready`)
+        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
+        expect([...localNames].sort()).toEqual([`healthy`, `target`])
+        expect(
+          [...remote].sort((a, b) => a.name.localeCompare(b.name)),
+        ).toEqual([
+          { name: `healthy`, completed: true },
+          { name: `target`, completed: !(fails && boundary !== `coordinator`) },
+        ])
+        expect(warning.mock.calls).toEqual(
+          fails
+            ? [
+                ...(boundary !== `coordinator`
+                  ? [[`Failed to ensure persisted index in adapter:`, failure]]
+                  : []),
+                ...(boundary !== `local`
+                  ? [
+                      [
+                        `Failed to ensure persisted index through coordinator:`,
+                        failure,
+                      ],
+                    ]
+                  : []),
+              ]
+            : [],
+        )
+        for (const [, error] of warning.mock.calls) expect(error).toBe(failure)
+        expect(unhandled).toEqual([])
+        await collection._sync.loadSubset({ limit: 1 })
+        expect(stripVirtualProps(collection.get(row.id))).toEqual(row)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        gate.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => preload?.catch(() => undefined),
+            // Drain held rejection delivery before this case releases its observer.
+            () => flushAsyncWork(),
+            () => warning.mockRestore(),
+            () => collection.cleanup(),
+            () => {
+              process.off(`unhandledRejection`, onUnhandled)
+            },
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`only signals completed leader-local index work after local success`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const localFailure = new Error(`local index creation failed`)
+    const completedLocalMarkers: Array<boolean> = []
+    const warn = vi.spyOn(console, `warn`).mockImplementation(() => {})
+
+    adapter.ensureIndex = async (collectionId, signature) => {
+      adapter.ensureIndexCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        signature,
+      })
+      throw localFailure
+    }
+    coordinator.requestEnsurePersistedIndex = async (
+      _collectionId,
+      _signature,
+      _spec,
+      completedLocalAdapter,
+      localEnsureCompleted,
+    ) => {
+      completedLocalMarkers.push(
+        completedLocalAdapter !== undefined && localEnsureCompleted === true,
+      )
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `failed-local-index-bootstrap`,
+        getKey: (item) => item.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    collection.createIndex((row) => row.title, { name: `startup-title` })
+
+    try {
+      await collection.preload()
+      expect(completedLocalMarkers).toEqual([false])
+    } finally {
+      await collection.cleanup()
+      warn.mockRestore()
+    }
+  })
+
+  it(`releases the hydration scope before invoking a coordinator that uses its own adapter`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinatorEntered = createDeferred()
+    const breakSchedulerCycle = createDeferred()
+    let hydrationScopeActive = false
+    let coordinatorEnteredDuringHydration: boolean | undefined
+
+    const publicEnsureIndex = adapter.ensureIndex.bind(adapter)
+    const scopedAdapter: PersistenceAdapter = {
+      ...adapter,
+      ensureIndex: publicEnsureIndex,
+    }
+    adapter.runInHydrationScope = async (task) => {
+      hydrationScopeActive = true
+      try {
+        return await task(scopedAdapter)
+      } finally {
+        hydrationScopeActive = false
+      }
+    }
+    adapter.ensureIndex = async (...args) => {
+      if (hydrationScopeActive) {
+        // A public core-adapter call queues behind the active hydrate. The
+        // hydrate cannot release until this coordinator call returns.
+        await breakSchedulerCycle.promise
+      }
+      await publicEnsureIndex(...args)
+    }
+
+    const coordinator = createCoordinatorHarness()
+    coordinator.requestEnsurePersistedIndex = async (
+      collectionId,
+      signature,
+      spec,
+    ) => {
+      coordinatorEnteredDuringHydration = hydrationScopeActive
+      coordinatorEntered.resolve()
+      // Deliberately ignore the optional scoped adapter, as existing public
+      // coordinator implementations are allowed to do.
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        spec,
+      )
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `custom-coordinator-hydration-scope`,
+        getKey: (item) => item.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    collection.createIndex((row) => row.title, {
+      name: `startup-title`,
+    })
+    const preload = Promise.resolve(collection.preload())
+    void preload.catch(() => undefined)
+
+    try {
+      await coordinatorEntered.promise
+      expect(coordinatorEnteredDuringHydration).toBe(false)
+    } finally {
+      breakSchedulerCycle.resolve()
+      await preload.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+
+  it(`releases crossed follower hydration scopes before leader index RPC work`, async () => {
+    const bothLocalIndexesEntered = createDeferred()
+    const bothCoordinatorRequestsEntered = createDeferred()
+    let localIndexEntries = 0
+    let coordinatorEntries = 0
+
+    const createTabAdapter = () => {
+      const adapter = createRecordingAdapter()
+      const breakSchedulerCycle = createDeferred()
+      let hydrationScopeActive = false
+      const remoteScopeObservations: Array<boolean> = []
+      const publicEnsureIndex = adapter.ensureIndex.bind(adapter)
+      const scopedAdapter: PersistenceAdapter = {
+        ...adapter,
+        ensureIndex: async (...args) => {
+          localIndexEntries++
+          if (localIndexEntries === 2) bothLocalIndexesEntered.resolve()
+          await bothLocalIndexesEntered.promise
+          await publicEnsureIndex(...args)
+        },
+      }
+      adapter.runInHydrationScope = async (task) => {
+        hydrationScopeActive = true
+        try {
+          return await task(scopedAdapter)
+        } finally {
+          hydrationScopeActive = false
+        }
+      }
+      adapter.ensureIndex = async (...args) => {
+        remoteScopeObservations.push(hydrationScopeActive)
+        coordinatorEntries++
+        if (coordinatorEntries === 2) bothCoordinatorRequestsEntered.resolve()
+        if (hydrationScopeActive) await breakSchedulerCycle.promise
+        await publicEnsureIndex(...args)
+      }
+      return {
+        adapter,
+        breakSchedulerCycle,
+        remoteScopeObservations,
+      }
+    }
+
+    const tab1 = createTabAdapter()
+    const tab2 = createTabAdapter()
+    const coordinator1 = createCoordinatorHarness()
+    const coordinator2 = createCoordinatorHarness()
+    coordinator1.isLeader = () => false
+    coordinator2.isLeader = () => false
+    coordinator1.requestEnsurePersistedIndex = (
+      collectionId,
+      signature,
+      spec,
+    ) =>
+      tab2.adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        spec,
+      )
+    coordinator2.requestEnsurePersistedIndex = (
+      collectionId,
+      signature,
+      spec,
+    ) =>
+      tab1.adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        spec,
+      )
+
+    const createFollowerCollection = (
+      id: string,
+      persistence: PersistedCollectionPersistence,
+    ) => {
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          getKey: (item) => item.id,
+          defaultIndexType: BasicIndex,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+            },
+          },
+          persistence,
+        }),
+      )
+      collection.createIndex((row) => row.title, { name: `${id}-title` })
+      return collection
+    }
+    const followerA = createFollowerCollection(`follower-a`, {
+      adapter: tab1.adapter,
+      coordinator: coordinator1,
+    })
+    const followerB = createFollowerCollection(`follower-b`, {
+      adapter: tab2.adapter,
+      coordinator: coordinator2,
+    })
+    const preloadA = Promise.resolve(followerA.preload())
+    const preloadB = Promise.resolve(followerB.preload())
+    void preloadA.catch(() => undefined)
+    void preloadB.catch(() => undefined)
+
+    try {
+      await bothCoordinatorRequestsEntered.promise
+      expect({
+        tab1: tab1.remoteScopeObservations,
+        tab2: tab2.remoteScopeObservations,
+      }).toEqual({ tab1: [false], tab2: [false] })
+    } finally {
+      tab1.breakSchedulerCycle.resolve()
+      tab2.breakSchedulerCycle.resolve()
+      await Promise.all([preloadA, preloadB]).catch(() => undefined)
+      await Promise.all([followerA.cleanup(), followerB.cleanup()])
+    }
+  })
+
+  it(`releases the hydration scope before a gap coordinator uses its own adapter`, async () => {
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const coordinatorEntered = createDeferred()
+    const breakSchedulerCycle = createDeferred()
+    let hydrationScopeActive = false
+    let coordinatorEnteredDuringHydration: boolean | undefined
+
+    const pullSince = async () => ({
+      latestRowVersion: 0,
+      requiresFullReload: false as const,
+      changedKeys: [],
+      deletedKeys: [],
+      deltas: [],
+    })
+    const publicAdapter = adapter as RecordingAdapter & {
+      pullSince: typeof pullSince
+    }
+    const scopedAdapter = {
+      ...adapter,
+      pullSince,
+    }
+    publicAdapter.pullSince = async () => {
+      if (hydrationScopeActive) await breakSchedulerCycle.promise
+      return pullSince()
+    }
+    adapter.runInHydrationScope = async (task) => {
+      hydrationScopeActive = true
+      try {
+        return await task(scopedAdapter)
+      } finally {
+        hydrationScopeActive = false
+      }
+    }
+    coordinator.pullSince = async (_collectionId, _fromRowVersion) => {
+      coordinatorEnteredDuringHydration = hydrationScopeActive
+      coordinatorEntered.resolve()
+      const result = await publicAdapter.pullSince()
+      return {
+        type: `rpc:pullSince:res`,
+        rpcId: `legacy-gap-coordinator`,
+        ok: true,
+        latestTerm: 1,
+        latestSeq: 2,
+        latestRowVersion: result.latestRowVersion,
+        requiresFullReload: result.requiresFullReload,
+        changedKeys: result.changedKeys,
+        deletedKeys: result.deletedKeys,
+        deltas: result.deltas,
+      }
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    await collection.preload()
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 2,
+      txId: `tx-gap-legacy-coordinator`,
+      latestRowVersion: 2,
+      requiresFullReload: false,
+      changedRows: [],
+      deletedKeys: [],
+    })
+
+    try {
+      await coordinatorEntered.promise
+      expect(coordinatorEnteredDuringHydration).toBe(false)
+    } finally {
+      breakSchedulerCycle.resolve()
+      await flushAsyncWork()
+      await collection.cleanup()
+    }
+  })
+
+  // Focused invalidation-reload refinements. Whether recovery follows a
+  // sequence gap or a contiguous committed notification, metadata and rows
+  // must be read inside one hydration scope. The adapter schedules v2 only
+  // outside the scope; coherent public v1 state is the checkpoint.
+  it(`keeps sequence-gap recovery inside one hydration scope`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial row` }])
+    adapter.collectionMetadata.set(`snapshot`, `initial`)
+    const coordinator = createCoordinatorHarness()
+    coordinator.setPullSinceResponse({
+      type: `rpc:pullSince:res`,
+      rpcId: `pull-gap-scope`,
+      ok: true,
+      latestTerm: 1,
+      latestSeq: 1,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+    })
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    let inHydrationScope = false
+    let interleaveArmed = false
+    let interleaveRan = false
+
+    const runInterleavedWrite = () => {
+      interleaveRan = true
+      adapter.collectionMetadata.set(`snapshot`, `v2`)
+      adapter.rows.set(`1`, { id: `1`, title: `v2 row` })
+    }
+
+    adapter.loadSubset = async (...args) => {
+      if (interleaveArmed && !inHydrationScope && !interleaveRan) {
+        runInterleavedWrite()
+      }
+      return loadSubset(...args)
+    }
+    adapter.runInHydrationScope = async (task) => {
+      inHydrationScope = true
+      try {
+        return await task(adapter)
+      } finally {
+        inHydrationScope = false
+        if (interleaveArmed && !interleaveRan) runInterleavedWrite()
+      }
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    await collection.preload()
+    adapter.collectionMetadata.set(`snapshot`, `v1`)
+    adapter.rows.set(`1`, { id: `1`, title: `v1 row` })
+    interleaveArmed = true
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 2,
+      txId: `tx-gap-scope`,
+      latestRowVersion: 2,
+      requiresFullReload: false,
+      changedRows: [],
+      deletedKeys: [],
+    })
+
+    await vi.waitFor(() => expect(interleaveRan).toBe(true))
+    expect(collection._state.syncedCollectionMetadata.get(`snapshot`)).toBe(
+      `v1`,
+    )
+    expect(collection.get(`1`)?.title).toBe(`v1 row`)
+    await collection.cleanup()
+  })
+
+  it(`keeps contiguous committed reload inside one hydration scope`, async () => {
+    const adapter = createRecordingAdapter([{ id: `1`, title: `Initial row` }])
+    adapter.collectionMetadata.set(`snapshot`, `initial`)
+    const coordinator = createCoordinatorHarness()
+    const loadSubset = adapter.loadSubset.bind(adapter)
+    let inHydrationScope = false
+    let interleaveArmed = false
+    let interleaveRan = false
+
+    const runInterleavedWrite = () => {
+      interleaveRan = true
+      adapter.collectionMetadata.set(`snapshot`, `v2`)
+      adapter.rows.set(`1`, { id: `1`, title: `v2 row` })
+    }
+
+    adapter.loadSubset = async (...args) => {
+      if (interleaveArmed && !inHydrationScope && !interleaveRan) {
+        runInterleavedWrite()
+      }
+      return loadSubset(...args)
+    }
+    adapter.runInHydrationScope = async (task) => {
+      inHydrationScope = true
+      try {
+        return await task(adapter)
+      } finally {
+        inHydrationScope = false
+        if (interleaveArmed && !interleaveRan) runInterleavedWrite()
+      }
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    await collection.preload()
+    adapter.collectionMetadata.set(`snapshot`, `v1`)
+    adapter.rows.set(`1`, { id: `1`, title: `v1 row` })
+    interleaveArmed = true
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-contiguous-reload-scope`,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+    })
+
+    await vi.waitFor(() => expect(interleaveRan).toBe(true))
+    expect(collection._state.syncedCollectionMetadata.get(`snapshot`)).toBe(
+      `v1`,
+    )
+    expect(collection.get(`1`)?.title).toBe(`v1 row`)
+    await collection.cleanup()
+  })
+
+  // Focused lifecycle-fencing witness: generation-zero startup is held across
+  // cleanup and rebound, then released while generation one is still loading.
+  // Zero ensure-index calls for the rebound signatures prove stale bootstrap
+  // and listener work did not cross the public lifecycle boundary.
+  it(`does not let stale startup install index work on a rebound lifecycle`, async () => {
+    const adapter = createRecordingAdapter()
+    const g0MetadataEntered = createDeferred()
+    const allowG0Metadata = createDeferred()
+    const g1MetadataEntered = createDeferred()
+    const allowG1Metadata = createDeferred()
+    let metadataCalls = 0
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    adapter.loadResumeSnapshot = async (...args) => {
+      if (args[1]?.includeRows === false) {
+        metadataCalls++
+        if (metadataCalls === 1) {
+          g0MetadataEntered.resolve()
+          await allowG0Metadata.promise
+        } else if (metadataCalls === 2) {
+          g1MetadataEntered.resolve()
+          await allowG1Metadata.promise
+        }
+      }
+      return loadResumeSnapshot(...args)
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-startup-index-generation`,
+        getKey: (item) => item.id,
+        defaultIndexType: BasicIndex,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const stalePreload = Promise.resolve(collection.preload())
+    void stalePreload.catch(() => undefined)
+    let freshReady: Promise<unknown> | undefined
+
+    try {
+      await g0MetadataEntered.promise
+      await collection.cleanup()
+
+      const reboundIndex = collection.createIndex((row) => row.title, {
+        name: `rebound-bootstrap`,
+      })
+      const reboundSignature = collection
+        .getIndexMetadata()
+        .find((metadata) => metadata.indexId === reboundIndex.id)?.signature
+      expect(reboundSignature).toBeDefined()
+      freshReady = collection.stateWhenReady()
+
+      allowG0Metadata.resolve()
+      await g1MetadataEntered.promise
+
+      const staleBootstrapCalls = adapter.ensureIndexCalls.filter(
+        (call) => call.signature === reboundSignature,
+      )
+      const listenerIndex = collection.createIndex((row) => row.id, {
+        name: `rebound-listener`,
+      })
+      const listenerSignature = collection
+        .getIndexMetadata()
+        .find((metadata) => metadata.indexId === listenerIndex.id)?.signature
+      expect(listenerSignature).toBeDefined()
+      const staleListenerCalls = adapter.ensureIndexCalls.filter(
+        (call) => call.signature === listenerSignature,
+      )
+
+      expect({
+        staleBootstrapCalls: staleBootstrapCalls.length,
+        staleListenerCalls: staleListenerCalls.length,
+      }).toEqual({
+        staleBootstrapCalls: 0,
+        staleListenerCalls: 0,
+      })
+
+      allowG1Metadata.resolve()
+      await freshReady
+    } finally {
+      allowG0Metadata.resolve()
+      allowG1Metadata.resolve()
+      await stalePreload.catch(() => undefined)
+      await freshReady?.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+})
+
+describe(`persisted key and identifier helpers`, () => {
+  it(`encodes and decodes persisted storage keys without collisions`, () => {
+    expect(encodePersistedStorageKey(1)).toBe(`n:1`)
+    expect(encodePersistedStorageKey(`1`)).toBe(`s:1`)
+    expect(decodePersistedStorageKey(`n:1`)).toBe(1)
+    expect(decodePersistedStorageKey(`s:1`)).toBe(`1`)
+    expect(Object.is(decodePersistedStorageKey(`n:-0`), -0)).toBe(true)
+  })
+
+  it(`throws for invalid persisted key values and encodings`, () => {
+    expect(() => encodePersistedStorageKey(Number.POSITIVE_INFINITY)).toThrow(
+      InvalidPersistedStorageKeyError,
+    )
+    expect(() => decodePersistedStorageKey(`legacy-key`)).toThrow(
+      InvalidPersistedStorageKeyEncodingError,
+    )
+  })
+
+  it(`creates deterministic safe table names`, () => {
+    const first = createPersistedTableName(`todos`)
+    const second = createPersistedTableName(`todos`)
+    const tombstoneName = createPersistedTableName(`todos`, `t`)
+
+    expect(first).toBe(second)
+    expect(first).toMatch(/^c_[a-z2-7]+_[0-9a-z]+$/)
+    expect(tombstoneName).toMatch(/^t_[a-z2-7]+_[0-9a-z]+$/)
+  })
+})
+
+// Probe calibration uses an independently specified lifetime table. These are
+// adapter-callback histories, not claims that a shared SQLite scheduler permits
+// concurrent hydrates. Deliberately expired loans and public reentry must remain
+// observable even when another callback exits; successful calls still forward.
+describe(`hydration routing probe calibration`, () => {
+  it.each([
+    { history: `nested`, exitFirst: 1 },
+    { history: `overlap, first exits first`, exitFirst: 0 },
+    { history: `overlap, second exits first`, exitFirst: 1 },
+  ])(
+    `tracks each callback lifetime: $history`,
+    async ({ history, exitFirst }) => {
+      const adapter = createRecordingAdapter()
+      const routing = installHydrationRoutingProbe(adapter)
+      const release = [createEventGate(), createEventGate()]
+      const loans: Array<PersistenceAdapter> = []
+      const first = adapter.runInHydrationScope!(async (loan) => {
+        loans[0] = loan
+        await release[0]!.promise
+      })
+      const parent = history === `nested` ? loans[0]! : adapter
+      const second = parent.runInHydrationScope!(async (loan) => {
+        loans[1] = loan
+        await release[1]!.promise
+      })
+      const scopes = [first, second]
+      const tx: PersistedTx = {
+        txId: `probe`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [],
+      }
+      const apply = (target: PersistenceAdapter) =>
+        target.applyCommittedTx({ kind: `eager`, collectionId: `probe` }, tx)
+      try {
+        await apply(loans[0]!)
+        await apply(loans[1]!)
+        release[exitFirst]!.resolve()
+        await scopes[exitFirst]
+        await apply(loans[exitFirst]!)
+        await apply(loans[1 - exitFirst]!)
+        await apply(adapter)
+        release[1 - exitFirst]!.resolve()
+        await scopes[1 - exitFirst]
+        await apply(loans[1 - exitFirst]!)
+        await apply(adapter)
+        expect(
+          routing.calls.map(({ route, live }) => ({ route, live })),
+        ).toEqual([
+          { route: `scoped`, live: true },
+          { route: `scoped`, live: true },
+          { route: `scoped`, live: false },
+          { route: `scoped`, live: true },
+          { route: `public`, live: false },
+          { route: `scoped`, live: false },
+          { route: `public`, live: true },
+        ])
+      } finally {
+        release.forEach((gate) => gate.resolve())
+        await Promise.all(scopes)
+      }
+    },
+  )
+
+  // The explicit adapter is sufficient for this call; only ordinary work needs
+  // a registered fallback. Collection construction registers that fallback.
+  it(`uses an explicit adapter without registration and rejects missing ordinary routing`, async () => {
+    const coordinator = new SingleProcessCoordinator()
+    const adapter = createRecordingAdapter()
+    const tx: PersistedTx = {
+      txId: `explicit`,
+      term: 1,
+      seq: 1,
+      rowVersion: 1,
+      mutations: [],
+    }
+    await expect(
+      coordinator.requestApplyCommittedTx(`explicit`, tx, adapter),
+    ).resolves.toBeDefined()
+    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+    await expect(
+      coordinator.requestApplyCommittedTx(`explicit`, tx),
+    ).rejects.toMatchObject({
+      name: `InvalidPersistedCollectionConfigError`,
+    })
+    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+    coordinator.setAdapterForCollection(`explicit`, adapter)
+    await expect(
+      coordinator.requestApplyCommittedTx(`explicit`, tx),
+    ).resolves.toBeDefined()
+    expect(adapter.applyCommittedTxCalls).toHaveLength(2)
+  })
+
+  // The adapter contract requires call-local forwarding through wrappers. This
+  // positive/hostile pair reaches the real coordinator but lets the recorder
+  // finish bad calls, so losing the loan is a routing assertion, not a timeout.
+  it.each([true, false])(
+    `detects a wrapper that forwards its loan=%s`,
+    async (forward) => {
+      const adapter = createRecordingAdapter()
+      const routing = installHydrationRoutingProbe(adapter)
+      const inner = new SingleProcessCoordinator()
+      inner.setAdapterForCollection(`wrapper`, adapter)
+      const wrapper: PersistedCollectionCoordinator[`requestApplyCommittedTx`] =
+        (id, tx, scoped) =>
+          inner.requestApplyCommittedTx(id, tx, forward ? scoped : undefined)
+      await adapter.runInHydrationScope!(async (scoped) => {
+        await wrapper(
+          `wrapper`,
+          { txId: `nested`, term: 1, seq: 1, rowVersion: 1, mutations: [] },
+          scoped,
+        )
+      })
+      expect(routing.calls.map(({ route, live }) => ({ route, live }))).toEqual(
+        [{ route: forward ? `scoped` : `public`, live: forward }],
+      )
+      expect(routing.violations()).toHaveLength(forward ? 0 : 1)
+    },
+  )
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-source-receipts.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-source-receipts.test.ts
new file mode 100644
index 0000000000..4419cb988e
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-source-receipts.test.ts
@@ -0,0 +1,3199 @@
+/**
+ * Ordinary regression tests for persisted source receipts, terminal persistence failures, and hydration-buffer rejection, as fixed scenarios. The laws they exercise are owned by persisted-oracle.test.ts, which keeps the generated durability drivers and the reconciliation model.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '@tanstack/db'
+import {
+  IndeterminateCommitError,
+  PersistedCollectionDurabilityError,
+  SingleProcessCoordinator,
+  persistedCollectionOptions,
+} from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createRecordingAdapter,
+  createTerminalFailureHarness,
+  flushAsyncWork,
+  observeSettlement,
+  overrideBaselineRows,
+  recordedStorageId,
+  stripVirtualProps,
+} from './persisted-support'
+import type {
+  Collection,
+  PendingMutation,
+  SyncConfig,
+  SyncMetadataApi,
+} from '@tanstack/db'
+import type { PersistedTx } from '../src'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+// The design grammar's X-then-Y history joins two previously separate facts:
+// exact-ID reconciliation acknowledges X at version 1 after a same-key peer
+// write advances durable storage to version 2, and resume certification must
+// fail closed when the wrapper's owned generation is not the latest durable
+// generation. The controlled coordinator supplies the two durable writes and
+// the original-position response. The real persisted wrapper owns the source
+// receipt, public row, and resume-evidence checkpoint. SQLite separately owns
+// the atomic exact-ID proof; this test does not emulate its SQL decision.
+it(`keeps the original receipt position after a peer write and fails closed on resume evidence`, async () => {
+  const collectionId = `reconciled-peer-resume-generation`
+  const adapter = createRecordingAdapter()
+  const coordinator = createCoordinatorHarness()
+  const error = new IndeterminateCommitError({
+    collectionId,
+    requestType: `rpc:applyCommittedTx:req`,
+    previousLeaderId: `retired`,
+    previousTerm: 1,
+    currentLeaderId: `replacement`,
+    currentTerm: 2,
+    cause: new Error(`lost response`),
+  })
+  let source!: TodoSyncParams
+  let capability: SyncMetadataApi<string>[`persistence`] | undefined
+  let originalTx: PersistedTx | undefined
+  let syncRuns = 0
+
+  coordinator.requestApplyCommittedTx = async (id, tx) => {
+    originalTx = { ...tx, term: 1, seq: 1, rowVersion: 1 }
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: id },
+      originalTx,
+    )
+    const peerTx: PersistedTx = {
+      ...tx,
+      txId: `peer-after-original`,
+      term: 2,
+      seq: 1,
+      rowVersion: 2,
+      mutations: [
+        {
+          type: `update`,
+          key: `shared`,
+          value: { id: `shared`, title: `peer` },
+        },
+      ],
+      rowMetadataMutations: [],
+      collectionMetadataMutations: [
+        { type: `set`, key: `cursor`, value: `peer` },
+      ],
+    }
+    await adapter.applyCommittedTx({ kind: `eager`, collectionId: id }, peerTx)
+    throw error
+  }
+  coordinator.reconcileCommittedTx = (id, tx, anchor) => {
+    expect(id).toBe(collectionId)
+    expect(tx.txId).toBe(originalTx?.txId)
+    expect(anchor).toEqual({ latestRowVersion: 0, resetEpoch: 0 })
+    return Promise.resolve({
+      type: `rpc:reconcileCommittedTx:res`,
+      rpcId: `exact-after-peer`,
+      ok: true,
+      alreadyApplied: true,
+      committed: { term: 1, seq: 1, rowVersion: 1 },
+    })
+  }
+
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: collectionId,
+      syncMode: `on-demand`,
+      getKey: (item) => item.id,
+      sync: {
+        sync: (params) => {
+          source = params
+          capability = params.metadata?.persistence
+          syncRuns++
+          params.markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(capability).toBeDefined())
+    source.begin()
+    capability?.resumeSnapshot.expectCurrentCommit()
+    source.write({
+      type: `insert`,
+      value: { id: `shared`, title: `source` },
+    })
+    source.metadata?.collection.set(`cursor`, `source`)
+    await atPersistedOracleCheckpoint(
+      Promise.resolve(source.commit()),
+      `exact-ID source receipt after peer write`,
+    )
+
+    expect(syncRuns).toBe(1)
+    expect(adapter.applyCommittedTxCalls).toHaveLength(2)
+    expect(collection.get(`shared`)?.title).toBe(`source`)
+    expect(adapter.rows.get(`shared`)?.title).toBe(`peer`)
+    expect(adapter.collectionMetadata.get(`cursor`)).toBe(`peer`)
+
+    await capability?.resumeSnapshot.certify()
+    expect(adapter.loadResumeSnapshotCalls.at(-1)?.includeRows).toBe(false)
+    expect(capability?.resumeSnapshot.getKeySetEvidence()).toEqual({
+      status: `incompatible`,
+    })
+  } finally {
+    await collection.cleanup()
+  }
+})
+
+describe(`persistedCollectionOptions`, () => {
+  it(`does not apply or persist a wrapped sync transaction committed with an aborted signal`, async () => {
+    const adapter = createRecordingAdapter()
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-aborted-commit`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await collection.stateWhenReady()
+      const abortController = new AbortController()
+      abortController.abort()
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `aborted`, title: `Must not publish` },
+      })
+      await expect(
+        remoteCommit?.(abortController.signal),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      await flushAsyncWork()
+
+      expect(collection.get(`aborted`)).toBeUndefined()
+      expect(adapter.applyCommittedTxCalls).toHaveLength(0)
+      expect(collection._state.pendingSyncedTransactions).toHaveLength(0)
+
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `recovered`, title: `Later transaction` },
+      })
+      await remoteCommit?.()
+
+      expect(stripVirtualProps(collection.get(`recovered`))).toEqual({
+        id: `recovered`,
+        title: `Later transaction`,
+      })
+      expect(adapter.rows.get(`recovered`)).toEqual({
+        id: `recovered`,
+        title: `Later transaction`,
+      })
+      expect(collection._state.pendingSyncedTransactions).toHaveLength(0)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not deliver coordinator work accepted before lifecycle replacement into the new owner`, async () => {
+    const id = `queued-coordinator-lifecycle`
+    const adapter = createRecordingAdapter()
+    const oldReloadEntered = createEventGate()
+    const releaseOldReload = createEventGate()
+    const replacementHydrationEntered = createEventGate()
+    const releaseReplacementHydration = createEventGate()
+    let baselineCalls = 0
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 2) {
+        replacementHydrationEntered.resolve()
+        await releaseReplacementHydration.promise
+        return [
+          {
+            key: `replacement`,
+            value: { id: `replacement`, title: `new owner baseline` },
+          },
+        ]
+      }
+      return []
+    })
+    let subsetCalls = 0
+    adapter.loadSubset = async () => {
+      subsetCalls++
+      if (subsetCalls === 1) {
+        oldReloadEntered.resolve()
+        await releaseOldReload.promise
+      }
+      return []
+    }
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const replacementControlsReady = createEventGate()
+    let sourceRuns = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            sourceRuns++
+            if (sourceRuns === 2) replacementControlsReady.resolve()
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `queued coordinator initial owner ready`,
+      )
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `old-reload-gate`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+      })
+      await atPersistedOracleCheckpoint(
+        oldReloadEntered.promise,
+        `old coordinator reload entered`,
+      )
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `queued-before-restart`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [
+          {
+            key: `stale`,
+            value: { id: `stale`, title: `must stay with old owner` },
+          },
+        ],
+        deletedKeys: [],
+      })
+
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        replacementControlsReady.promise,
+        `replacement sync controls installed`,
+      )
+      releaseOldReload.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementHydrationEntered.promise,
+        `replacement hydration entered after queued coordinator work`,
+      )
+
+      expect({
+        sourceRuns,
+        baselineCalls,
+        subsetCalls,
+        staleVisible: collection.get(`stale`),
+        staleDurable: adapter.rows.get(`stale`),
+        replacementPublicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        sourceRuns: 2,
+        baselineCalls: 2,
+        subsetCalls: 1,
+        staleVisible: undefined,
+        staleDurable: undefined,
+        replacementPublicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseOldReload.resolve()
+      releaseReplacementHydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`discards a queued collection reset when its owner is cleaned up`, async () => {
+    const id = `queued-reset-lifecycle`
+    const adapter = createRecordingAdapter()
+    const oldReloadEntered = createEventGate()
+    const releaseOldReload = createEventGate()
+    let subsetCalls = 0
+    adapter.loadSubset = async () => {
+      subsetCalls++
+      if (subsetCalls === 1) {
+        oldReloadEntered.resolve()
+        await releaseOldReload.promise
+      }
+      return []
+    }
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `queued reset initial owner ready`,
+      )
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `old-reset-gate`,
+        latestRowVersion: 1,
+        requiresFullReload: true,
+      })
+      await atPersistedOracleCheckpoint(
+        oldReloadEntered.promise,
+        `old reload entered before queued reset`,
+      )
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 1,
+      })
+
+      await collection.cleanup()
+      cleanedUp = true
+      releaseOldReload.resolve()
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      expect({
+        subsetCalls,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        subsetCalls: 1,
+        status: `cleaned-up`,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseOldReload.resolve()
+      await cleanupPersistedOracle(
+        [() => (cleanedUp ? undefined : collection.cleanup())],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not apply a delayed seq-gap replay response into a restarted lifecycle`, async () => {
+    const id = `delayed-pull-since-lifecycle`
+    const adapter = createRecordingAdapter()
+    const pullEntered = createEventGate()
+    const releasePull = createEventGate()
+    const replacementHydrationEntered = createEventGate()
+    const releaseReplacementHydration = createEventGate()
+    let baselineCalls = 0
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 2) {
+        replacementHydrationEntered.resolve()
+        await releaseReplacementHydration.promise
+        return [
+          {
+            key: `replacement`,
+            value: { id: `replacement`, title: `new owner baseline` },
+          },
+        ]
+      }
+      return []
+    })
+    const coordinator = createFailStopCoordinatorHarness(id)
+    coordinator.pullSince = async () => {
+      pullEntered.resolve()
+      await releasePull.promise
+      return {
+        type: `rpc:pullSince:res`,
+        rpcId: `old-delayed-pull`,
+        ok: true,
+        latestTerm: 1,
+        latestSeq: 2,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedKeys: [`stale`],
+        deletedKeys: [],
+        deltas: [
+          {
+            txId: `old-delayed-delta`,
+            latestRowVersion: 2,
+            changedRows: [
+              {
+                key: `stale`,
+                value: { id: `stale`, title: `must stay with old owner` },
+              },
+            ],
+            deletedKeys: [],
+            rowMetadataMutations: [],
+            collectionMetadataMutations: [],
+          },
+        ],
+      }
+    }
+    const replacementControlsReady = createEventGate()
+    let sourceRuns = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            sourceRuns++
+            if (sourceRuns === 2) replacementControlsReady.resolve()
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `delayed pull initial owner ready`,
+      )
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 2,
+        txId: `gap-trigger`,
+        latestRowVersion: 2,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        pullEntered.promise,
+        `old pullSince entered`,
+      )
+
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        replacementControlsReady.promise,
+        `delayed pull replacement controls installed`,
+      )
+      releasePull.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementHydrationEntered.promise,
+        `replacement hydration entered after delayed pull replay`,
+      )
+
+      expect({
+        sourceRuns,
+        baselineCalls,
+        staleVisible: collection.get(`stale`),
+        staleDurable: adapter.rows.get(`stale`),
+        replacementPublicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        sourceRuns: 2,
+        baselineCalls: 2,
+        staleVisible: undefined,
+        staleDurable: undefined,
+        replacementPublicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releasePull.resolve()
+      releaseReplacementHydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not apply a later seq-gap replay delta through replacement controls`, async () => {
+    const id = `two-delta-replay-lifecycle`
+    const firstReceiptEntered = createEventGate()
+    const releaseFirstReceipt = createEventGate()
+    const replacementControlsInstalled = createEventGate()
+    const replacementHydrationEntered = createEventGate()
+    const releaseReplacementHydration = createEventGate()
+    let baselineCalls = 0
+    const adapter = createRecordingAdapter()
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 2) {
+        replacementHydrationEntered.resolve()
+        await releaseReplacementHydration.promise
+        return [
+          {
+            key: `replacement`,
+            value: { id: `replacement`, title: `B baseline` },
+          },
+        ]
+      }
+      return []
+    })
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const pullArguments: Array<{
+      collectionId: string
+      fromRowVersion: number
+    }> = []
+    coordinator.pullSince = async (collectionId, fromRowVersion) => {
+      pullArguments.push({ collectionId, fromRowVersion })
+      return {
+        type: `rpc:pullSince:res`,
+        rpcId: `two-delta-replay`,
+        ok: true,
+        latestTerm: 1,
+        latestSeq: 3,
+        latestRowVersion: 3,
+        requiresFullReload: false,
+        changedKeys: [`first`, `second`],
+        deletedKeys: [],
+        deltas: [
+          {
+            txId: `A-delta-1`,
+            latestRowVersion: 1,
+            changedRows: [
+              {
+                key: `first`,
+                value: { id: `first`, title: `A first delta` },
+              },
+            ],
+            deletedKeys: [],
+            rowMetadataMutations: [
+              { type: `set`, key: `first`, value: { owner: `A-first` } },
+            ],
+            collectionMetadataMutations: [
+              { type: `set`, key: `replay:first`, value: `A-first` },
+            ],
+          },
+          {
+            txId: `A-delta-2`,
+            latestRowVersion: 2,
+            changedRows: [
+              {
+                key: `second`,
+                value: { id: `second`, title: `A second delta` },
+              },
+            ],
+            deletedKeys: [],
+            rowMetadataMutations: [
+              { type: `set`, key: `second`, value: { owner: `A-second` } },
+            ],
+            collectionMetadataMutations: [
+              { type: `set`, key: `replay:second`, value: `A-second` },
+            ],
+          },
+        ],
+      }
+    }
+
+    let gateNextApplicationReceipt = false
+    let controlsRun = 0
+    const applicationReceipts: Array<{
+      controlsOwner: `A` | `B`
+      returnedReceipt: `actual` | `held`
+      rowMetadataKeys: Array<string>
+      collectionMetadataKeys: Array<string>
+    }> = []
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: { sync: ({ markReady }) => markReady() },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) => {
+          controlsRun++
+          const controlsOwner =
+            controlsRun === 1 ? (`A` as const) : (`B` as const)
+          if (controlsOwner === `B`) replacementControlsInstalled.resolve()
+          let rowMetadataKeys: Array<string> = []
+          let collectionMetadataKeys: Array<string> = []
+          return baseSync({
+            ...params,
+            begin: () => {
+              rowMetadataKeys = []
+              collectionMetadataKeys = []
+              return params.begin()
+            },
+            metadata: {
+              persistence: params.metadata!.persistence,
+              row: {
+                ...params.metadata!.row,
+                set: (key, value) => {
+                  rowMetadataKeys.push(String(key))
+                  params.metadata!.row.set(key, value)
+                },
+                delete: (key) => {
+                  rowMetadataKeys.push(String(key))
+                  params.metadata!.row.delete(key)
+                },
+              },
+              collection: {
+                ...params.metadata!.collection,
+                set: (key, value) => {
+                  collectionMetadataKeys.push(key)
+                  params.metadata!.collection.set(key, value)
+                },
+                delete: (key) => {
+                  collectionMetadataKeys.push(key)
+                  params.metadata!.collection.delete(key)
+                },
+              },
+            },
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (
+                !gateNextApplicationReceipt &&
+                applicationReceipts.length === 0
+              ) {
+                return actualReceipt
+              }
+              const trace = {
+                controlsOwner,
+                returnedReceipt: `actual` as `actual` | `held`,
+                rowMetadataKeys: [...rowMetadataKeys],
+                collectionMetadataKeys: [...collectionMetadataKeys],
+              }
+              applicationReceipts.push(trace)
+              if (gateNextApplicationReceipt) {
+                gateNextApplicationReceipt = false
+                trace.returnedReceipt = `held`
+                firstReceiptEntered.resolve()
+                void Promise.resolve(actualReceipt).catch(() => undefined)
+                return releaseFirstReceipt.promise
+              }
+              return actualReceipt
+            },
+          })
+        },
+      },
+    })
+    let replacementReady: Promise<unknown> | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `two-delta A lifecycle ready`,
+      )
+      applicationReceipts.length = 0
+      gateNextApplicationReceipt = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 3,
+        txId: `gap-trigger`,
+        latestRowVersion: 3,
+        requiresFullReload: false,
+        changedRows: [],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        firstReceiptEntered.promise,
+        `two-delta first A receipt held`,
+      )
+      expect(collection.get(`first`)?.title).toBe(`A first delta`)
+
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        replacementControlsInstalled.promise,
+        `two-delta B controls installed`,
+      )
+
+      releaseFirstReceipt.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementHydrationEntered.promise,
+        `two-delta B hydration held`,
+      )
+      await Promise.resolve()
+
+      const secondReceipts = applicationReceipts.filter(
+        (receipt) =>
+          receipt.rowMetadataKeys.includes(`second`) ||
+          receipt.collectionMetadataKeys.includes(`replay:second`),
+      )
+      expect({
+        controlsRun,
+        pullArguments,
+        secondReceipts,
+        secondRowMetadata: collection._state.syncedMetadata.get(`second`),
+        secondCollectionMetadata:
+          collection._state.syncedCollectionMetadata.get(`replay:second`),
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        controlsRun: 2,
+        pullArguments: [{ collectionId: id, fromRowVersion: 0 }],
+        secondReceipts: [],
+        secondRowMetadata: undefined,
+        secondCollectionMetadata: undefined,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstReceipt.resolve()
+      releaseReplacementHydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not confirm a delayed local coordinator response through a restarted owner`, async () => {
+    const id = `delayed-local-confirmation-lifecycle`
+    const adapter = createRecordingAdapter()
+    const replacementHydrationEntered = createEventGate()
+    const releaseReplacementHydration = createEventGate()
+    let baselineCalls = 0
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 2) {
+        replacementHydrationEntered.resolve()
+        await releaseReplacementHydration.promise
+        return [
+          {
+            key: `replacement`,
+            value: { id: `replacement`, title: `new owner baseline` },
+          },
+        ]
+      }
+      return []
+    })
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const requestEntered = createEventGate()
+    const releaseRequest = createEventGate()
+    coordinator.requestApplyLocalMutations = async (
+      _collectionId,
+      mutations,
+    ) => {
+      requestEntered.resolve()
+      await releaseRequest.promise
+      return {
+        type: `rpc:applyLocalMutations:res`,
+        rpcId: `old-delayed-local`,
+        ok: true,
+        term: 1,
+        seq: 1,
+        latestRowVersion: 1,
+        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
+      }
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const oldRow = { id: `old-local`, title: `must stay with old owner` }
+    let localTransaction: ReturnType<typeof collection.insert> | undefined
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `delayed local initial owner ready`,
+      )
+      localTransaction = collection.insert(oldRow)
+      await atPersistedOracleCheckpoint(
+        requestEntered.promise,
+        `old local coordinator request entered`,
+      )
+
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      releaseRequest.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementHydrationEntered.promise,
+        `replacement hydration entered after delayed local confirmation`,
+      )
+
+      expect({
+        baselineCalls,
+        staleVisible: collection.get(oldRow.id),
+        staleDurable: adapter.rows.get(oldRow.id),
+        replacementPublicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        baselineCalls: 2,
+        staleVisible: undefined,
+        staleDurable: undefined,
+        replacementPublicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseRequest.resolve()
+      releaseReplacementHydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => localTransaction?.isPersisted.promise.catch(() => undefined),
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not admit an old pending user hook through a restarted coordinator`, async () => {
+    const id = `pending-user-hook-lifecycle`
+    const adapter = createRecordingAdapter()
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const hookEntered = createEventGate()
+    const releaseHook = createEventGate()
+    let coordinatorRequests = 0
+    coordinator.requestApplyLocalMutations = async (
+      _collectionId,
+      mutations,
+    ) => {
+      coordinatorRequests++
+      return {
+        type: `rpc:applyLocalMutations:res`,
+        rpcId: `stale-user-hook-request`,
+        ok: true,
+        term: 1,
+        seq: 1,
+        latestRowVersion: 1,
+        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
+      }
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        onInsert: async () => {
+          hookEntered.resolve()
+          await releaseHook.promise
+          return {}
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let transaction: ReturnType<typeof collection.insert> | undefined
+    let transactionOutcome:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `pending user hook initial owner ready`,
+      )
+      transaction = collection.insert({
+        id: `old-hook`,
+        title: `must not enter replacement coordinator`,
+      })
+      transactionOutcome = transaction.isPersisted.promise.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        hookEntered.promise,
+        `old user hook entered before coordinator admission`,
+      )
+      expect(coordinatorRequests).toBe(0)
+
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      // Readiness counts the replacement's accepted startup rows, which the
+      // old hook's still-persisting transaction holds.
+      const replacementOutcome = await atPersistedOracleCheckpoint(
+        replacementReady,
+        `pending user hook replacement owner ready`,
+      )
+      releaseHook.resolve()
+      const outcome = await atPersistedOracleCheckpoint(
+        transactionOutcome,
+        `pending user hook transaction settled`,
+      )
+
+      expect({
+        replacementStatus: replacementOutcome.status,
+        transactionStatus: outcome.status,
+        coordinatorRequests,
+        durableOldRow: adapter.rows.get(`old-hook`),
+      }).toEqual({
+        replacementStatus: `fulfilled`,
+        transactionStatus: `rejected`,
+        coordinatorRequests: 0,
+        durableOldRow: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseHook.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => transactionOutcome,
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not let old loopback readiness complete a restarted hydration`, async () => {
+    const adapter = createRecordingAdapter()
+    const oldHydrationEntered = createEventGate()
+    const releaseOldHydration = createEventGate()
+    const replacementHydrationEntered = createEventGate()
+    const releaseReplacementHydration = createEventGate()
+    let baselineCalls = 0
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 1) {
+        oldHydrationEntered.resolve()
+        await releaseOldHydration.promise
+        return []
+      }
+      replacementHydrationEntered.resolve()
+      await releaseReplacementHydration.promise
+      return [
+        {
+          key: `replacement`,
+          value: { id: `replacement`, title: `new owner baseline` },
+        },
+      ]
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `loopback-late-readiness-lifecycle`,
+        getKey: (row) => row.id,
+        persistence: { adapter },
+      }),
+    )
+    const oldReady = collection.stateWhenReady().then(
+      () => ({ status: `fulfilled` as const }),
+      (reason: unknown) => ({ status: `rejected` as const, reason }),
+    )
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        oldHydrationEntered.promise,
+        `old loopback hydration entered`,
+      )
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+
+      releaseOldHydration.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementHydrationEntered.promise,
+        `replacement loopback hydration entered`,
+      )
+      await flushAsyncWork()
+
+      expect({
+        baselineCalls,
+        replacementIsReady: collection.isReady(),
+        replacementVisible: collection.get(`replacement`),
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        baselineCalls: 2,
+        replacementIsReady: false,
+        replacementVisible: undefined,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseOldHydration.resolve()
+      releaseReplacementHydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => oldReady,
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it.each([`fulfill`, `reject`] as const)(
+    `keeps retired loopback startup inert after cleanup: %s`,
+    async (outcome) => {
+      const adapter = createRecordingAdapter()
+      const hydrationEntered = createEventGate()
+      const hydrationGate = createEventGate()
+      const startupError = new Error(`retired loopback startup failed`)
+      const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
+        hydrationEntered.resolve()
+        await hydrationGate.promise
+        if (outcome === `reject`) throw startupError
+        return []
+      })
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `retired-loopback-startup-${outcome}`,
+          getKey: (row) => row.id,
+          persistence: { adapter },
+        }),
+      )
+      const readiness = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      const warnings = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const unhandled: Array<unknown> = []
+      const captureUnhandled = (error: unknown) => unhandled.push(error)
+      process.on(`unhandledRejection`, captureUnhandled)
+      const peer = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `retired-loopback-peer-${outcome}`,
+          getKey: (row) => row.id,
+          persistence: { adapter: createRecordingAdapter() },
+        }),
+      )
+      let hasPrimaryFailure = false
+
+      try {
+        await atPersistedOracleCheckpoint(
+          hydrationEntered.promise,
+          `retired loopback hydration entered`,
+        )
+        await collection.cleanup()
+        const retiredStatus = collection.status
+
+        hydrationGate.resolve()
+        await flushAsyncWork()
+        await flushAsyncWork()
+        const readinessOutcome = await readiness
+        await atPersistedOracleCheckpoint(
+          peer.stateWhenReady(),
+          `independent loopback peer ready`,
+        )
+
+        expect({
+          retiredStatus,
+          finalStatus: collection.status,
+          readinessStatus: readinessOutcome.status,
+          readinessErrorName:
+            readinessOutcome.status === `rejected` &&
+            readinessOutcome.reason instanceof Error
+              ? readinessOutcome.reason.name
+              : undefined,
+          publicError: collection._lifecycle.getSyncError(),
+          warnings: warnings.mock.calls,
+          unhandled,
+          peerStatus: peer.status,
+        }).toEqual({
+          retiredStatus: `cleaned-up`,
+          finalStatus: `cleaned-up`,
+          readinessStatus: `rejected`,
+          readinessErrorName: `AbortError`,
+          publicError: undefined,
+          warnings: [],
+          unhandled: [],
+          peerStatus: `ready`,
+        })
+
+        // This hostile control bypasses the sync-run-owned callback. It proves
+        // the status observation above would reject an unfenced late ready.
+        expect(() => collection._lifecycle.markReady()).toThrowError(
+          expect.objectContaining({ name: `CollectionStateError` }),
+        )
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        restoreBaselineRows()
+        hydrationGate.resolve()
+        process.off(`unhandledRejection`, captureUnhandled)
+        warnings.mockRestore()
+        await cleanupPersistedOracle(
+          [() => readiness, () => collection.cleanup(), () => peer.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`settles old source cleanup before hydrating a same-resource replacement`, async () => {
+    const id = `same-resource-cleanup-settlement`
+    const adapter = createRecordingAdapter()
+    adapter.rows.set(`retired`, {
+      id: `retired`,
+      title: `must not survive old cleanup`,
+    })
+    const cleanupGate = createEventGate()
+    let sourceCleanupSettled = false
+    const create = (withCleanup: boolean) =>
+      createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return withCleanup
+                ? {
+                    cleanup: () =>
+                      cleanupGate.promise.then(() => {
+                        adapter.rows.delete(`retired`)
+                        sourceCleanupSettled = true
+                      }),
+                  }
+                : undefined
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+    const oldCollection = create(true)
+    let replacement: ReturnType<typeof create> | undefined
+    let replacementReady: Promise<unknown> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        oldCollection.stateWhenReady(),
+        `old same-resource owner ready`,
+      )
+      expect(stripVirtualProps(oldCollection.get(`retired`))).toEqual({
+        id: `retired`,
+        title: `must not survive old cleanup`,
+      })
+
+      const replacementStarted = oldCollection.cleanup().then(() => {
+        replacement = create(false)
+        replacementReady = replacement.stateWhenReady()
+        return replacementReady
+      })
+      await flushAsyncWork()
+
+      expect(sourceCleanupSettled).toBe(false)
+      expect(replacement).toBeUndefined()
+
+      cleanupGate.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementStarted,
+        `same-resource replacement ready after cleanup`,
+      )
+
+      expect(sourceCleanupSettled).toBe(true)
+      expect(adapter.rows.has(`retired`)).toBe(false)
+      expect(replacement?.get(`retired`)).toBeUndefined()
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      cleanupGate.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => replacementReady,
+          () => oldCollection.cleanup(),
+          () => replacement?.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it.each([`fulfill`, `reject`] as const)(
+    `awaits cleanup returned after reentrant persisted source retirement: %s`,
+    async (outcome) => {
+      const adapter = createRecordingAdapter()
+      const sourceEntered = createEventGate()
+      const cleanupGate = createEventGate()
+      const sourceError = new Error(`reentrant source cleanup failed`)
+      let cleanupCalls = 0
+      let cleanupFromReentry: Promise<void> | undefined
+      let reenterCleanup = true
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `reentrant-persisted-source-cleanup-${outcome}`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ collection: publicCollection, markReady }) => {
+              if (!reenterCleanup) {
+                markReady()
+                return
+              }
+              reenterCleanup = false
+              cleanupFromReentry = publicCollection.cleanup()
+              sourceEntered.resolve()
+              return {
+                cleanup: () => {
+                  cleanupCalls++
+                  return cleanupGate.promise.then(() => {
+                    if (outcome === `reject`) throw sourceError
+                  })
+                },
+              }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      let cleanupSettled = false
+      let hasPrimaryFailure = false
+
+      try {
+        collection.startSyncImmediate()
+        await atPersistedOracleCheckpoint(
+          sourceEntered.promise,
+          `reentrant persisted source entered`,
+        )
+        if (!cleanupFromReentry) {
+          throw new Error(`reentrant cleanup was not captured`)
+        }
+        void cleanupFromReentry.then(
+          () => {
+            cleanupSettled = true
+          },
+          () => {
+            cleanupSettled = true
+          },
+        )
+        await flushAsyncWork()
+
+        expect({ cleanupCalls, cleanupSettled }).toEqual({
+          cleanupCalls: 1,
+          cleanupSettled: false,
+        })
+
+        cleanupGate.resolve()
+        if (outcome === `reject`) {
+          await expect(cleanupFromReentry).rejects.toMatchObject({
+            name: `SyncCleanupError`,
+            cause: sourceError,
+          })
+        } else {
+          await expect(cleanupFromReentry).resolves.toBeUndefined()
+        }
+        expect(collection.status).toBe(`cleaned-up`)
+        expect(cleanupCalls).toBe(1)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        cleanupGate.resolve()
+        await cleanupPersistedOracle(
+          [
+            () => cleanupFromReentry?.catch(() => undefined),
+            () => collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`does not register remote ownership returned by a retired source sync`, async () => {
+    const id = `reentrant-retired-remote-owner`
+    const adapter = createRecordingAdapter()
+    const coordinator = new SingleProcessCoordinator()
+    const sourceEntered = createEventGate()
+    let cleanupFromReentry: Promise<void> | undefined
+    let retiredSourceLoads = 0
+    const oldCollection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ collection: publicCollection }) => {
+            cleanupFromReentry = publicCollection.cleanup()
+            sourceEntered.resolve()
+            return {
+              loadSubset: () => {
+                retiredSourceLoads++
+                return true
+              },
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let replacement: Collection<Todo, string> | undefined
+    let replacementReady: Promise<unknown> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      oldCollection.startSyncImmediate()
+      await atPersistedOracleCheckpoint(
+        sourceEntered.promise,
+        `retired remote-owner source entered`,
+      )
+      if (!cleanupFromReentry) {
+        throw new Error(`reentrant cleanup was not captured`)
+      }
+      await atPersistedOracleCheckpoint(
+        cleanupFromReentry,
+        `retired remote-owner cleanup settled`,
+      )
+
+      replacement = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      replacementReady = replacement.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        replacementReady,
+        `same-id replacement ready after retired source entry`,
+      )
+
+      expect({
+        oldStatus: oldCollection.status,
+        replacementStatus: replacement.status,
+        retiredSourceLoads,
+      }).toEqual({
+        oldStatus: `cleaned-up`,
+        replacementStatus: `ready`,
+        retiredSourceLoads: 0,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [
+          () => cleanupFromReentry,
+          () => replacementReady,
+          () => oldCollection.cleanup(),
+          () => replacement?.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`settles every cleanup task after synchronous runtime teardown failures`, async () => {
+    const id = `synchronous-runtime-cleanup-failure`
+    const adapter = createRecordingAdapter()
+    const coordinator = new SingleProcessCoordinator()
+    const sourceCleanupGate = createEventGate()
+    const firstRuntimeError = new Error(`coordinator unsubscribe failed`)
+    const laterRuntimeError = new Error(`remote owner unsubscribe failed`)
+    const cleanupEvents: Array<string> = []
+    let subscriptionCount = 0
+    let ownerCount = 0
+    const subscribe = coordinator.subscribe.bind(coordinator)
+    coordinator.subscribe = () => {
+      const unsubscribe = subscribe()
+      const fail = subscriptionCount++ === 0
+      return () => {
+        unsubscribe()
+        cleanupEvents.push(`coordinator`)
+        if (fail) throw firstRuntimeError
+      }
+    }
+    const registerRemoteSubsetOwner =
+      coordinator.registerRemoteSubsetOwner.bind(coordinator)
+    coordinator.registerRemoteSubsetOwner = (collectionId, owner) => {
+      const unregister = registerRemoteSubsetOwner(collectionId, owner)
+      const fail = ownerCount++ === 0
+      return () => {
+        unregister()
+        cleanupEvents.push(`remote-owner`)
+        if (fail) throw laterRuntimeError
+      }
+    }
+    let sourceCleanupCalls = 0
+    const oldCollection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              cleanup: () => {
+                sourceCleanupCalls++
+                return sourceCleanupGate.promise
+              },
+              loadSubset: () => true,
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let replacement: Collection<Todo, string> | undefined
+    let replacementReady: Promise<unknown> | undefined
+    let cleanupSettled = false
+    let cleanupOutcome:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; error: unknown }
+        >
+      | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        oldCollection.stateWhenReady(),
+        `runtime-cleanup source ready`,
+      )
+      cleanupOutcome = oldCollection.cleanup().then(
+        () => ({ status: `fulfilled` as const }),
+        (error: unknown) => ({ status: `rejected` as const, error }),
+      )
+      void cleanupOutcome.then(() => {
+        cleanupSettled = true
+      })
+      await flushAsyncWork()
+
+      expect({ sourceCleanupCalls, cleanupSettled }).toEqual({
+        sourceCleanupCalls: 1,
+        cleanupSettled: false,
+      })
+
+      sourceCleanupGate.resolve()
+      const outcome = await atPersistedOracleCheckpoint(
+        cleanupOutcome,
+        `runtime cleanup tasks settled`,
+      )
+      expect(outcome.status).toBe(`rejected`)
+      if (outcome.status !== `rejected`) {
+        throw new Error(`expected runtime cleanup to reject`)
+      }
+      expect(outcome.error).toMatchObject({ name: `SyncCleanupError` })
+      const syncCleanupError = outcome.error as { cause?: unknown }
+      expect(syncCleanupError.cause).toBeInstanceOf(AggregateError)
+      const aggregate = syncCleanupError.cause as AggregateError
+      expect(aggregate.cause).toBe(firstRuntimeError)
+      expect(aggregate.errors).toEqual([firstRuntimeError, laterRuntimeError])
+      expect(cleanupEvents).toEqual([`coordinator`, `remote-owner`])
+
+      replacement = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+      replacementReady = replacement.stateWhenReady()
+      await atPersistedOracleCheckpoint(
+        replacementReady,
+        `replacement ready after failed runtime cleanup`,
+      )
+      expect(replacement.status).toBe(`ready`)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      sourceCleanupGate.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => cleanupOutcome,
+          () => replacementReady,
+          () => oldCollection.cleanup(),
+          () => replacement?.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`preserves source and runtime failures when persisted cleanup has both`, async () => {
+    const id = `source-and-runtime-cleanup-failures`
+    const adapter = createRecordingAdapter()
+    const coordinator = new SingleProcessCoordinator()
+    const sourceCleanupGate = createEventGate()
+    const sourceError = new Error(`source cleanup failed exactly`)
+    const runtimeError = new Error(`runtime cleanup failed exactly`)
+    let sourceCleanupCalls = 0
+    let runtimeCleanupCalls = 0
+    const subscribe = coordinator.subscribe.bind(coordinator)
+    coordinator.subscribe = () => {
+      const unsubscribe = subscribe()
+      return () => {
+        unsubscribe()
+        runtimeCleanupCalls++
+        throw runtimeError
+      }
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              cleanup: () => {
+                sourceCleanupCalls++
+                return sourceCleanupGate.promise
+              },
+            }
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let cleanupOutcome:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; error: unknown }
+        >
+      | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `dual-failure persisted collection ready`,
+      )
+      cleanupOutcome = collection.cleanup().then(
+        () => ({ status: `fulfilled` as const }),
+        (error: unknown) => ({ status: `rejected` as const, error }),
+      )
+      await flushAsyncWork()
+
+      expect({ sourceCleanupCalls, runtimeCleanupCalls }).toEqual({
+        sourceCleanupCalls: 1,
+        runtimeCleanupCalls: 1,
+      })
+
+      sourceCleanupGate.reject(sourceError)
+      const outcome = await atPersistedOracleCheckpoint(
+        cleanupOutcome,
+        `source and runtime cleanup failures settled`,
+      )
+      expect(outcome.status).toBe(`rejected`)
+      if (outcome.status !== `rejected`) {
+        throw new Error(`expected persisted cleanup to reject`)
+      }
+      expect(outcome.error).toMatchObject({ name: `SyncCleanupError` })
+      const syncCleanupError = outcome.error as { cause?: unknown }
+      expect(syncCleanupError.cause).toBeInstanceOf(AggregateError)
+      const aggregate = syncCleanupError.cause as AggregateError
+      expect(aggregate.cause).toBe(sourceError)
+      expect(aggregate.errors).toEqual([sourceError, runtimeError])
+      expect(collection.status).toBe(`cleaned-up`)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      sourceCleanupGate.resolve()
+      await cleanupPersistedOracle(
+        [() => cleanupOutcome, () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`marks a targeted invalidation commit-receipt rejection terminal`, async () => {
+    const id = `targeted-invalidation-receipt`
+    const adapter = createRecordingAdapter()
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const receiptEntered = createEventGate()
+    const rejectedReceipt = createEventGate()
+    const receiptError = new Error(
+      `targeted invalidation receipt failed exactly`,
+    )
+    let rejectNextCommit = false
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (!rejectNextCommit) return actualReceipt
+              rejectNextCommit = false
+              receiptEntered.resolve()
+              void Promise.resolve(actualReceipt).catch(() => undefined)
+              return rejectedReceipt.promise
+            },
+          }),
+      },
+    })
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `targeted receipt collection ready`,
+      )
+      rejectNextCommit = true
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `targeted-receipt-failure`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          {
+            key: `targeted`,
+            value: { id: `targeted`, title: `publication attempted` },
+          },
+        ],
+        deletedKeys: [],
+      })
+      await atPersistedOracleCheckpoint(
+        receiptEntered.promise,
+        `targeted invalidation receipt entered`,
+      )
+      rejectedReceipt.reject(receiptError)
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      expect({
+        status: collection.status,
+        exactPublicError: collection._lifecycle.getSyncError() === receiptError,
+      }).toEqual({
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectedReceipt.reject(receiptError)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`waits for a reset truncate receipt before reloading`, async () => {
+    const id = `reset-truncate-receipt`
+    const seed = { id: `seed`, title: `must survive a failed reset` }
+    const adapter = createRecordingAdapter([seed])
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const receiptEntered = createEventGate()
+    const rejectedReceipt = createEventGate()
+    const receiptError = new Error(`reset truncate receipt failed exactly`)
+    let rejectNextCommit = false
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (!rejectNextCommit) return actualReceipt
+              rejectNextCommit = false
+              receiptEntered.resolve()
+              void Promise.resolve(actualReceipt).catch(() => undefined)
+              return rejectedReceipt.promise
+            },
+          }),
+      },
+    })
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `reset receipt collection ready`,
+      )
+      const baselineLoadCount = adapter.loadSubsetCalls.length
+      rejectNextCommit = true
+      coordinator.emit({
+        type: `collection:reset`,
+        schemaVersion: 1,
+        resetEpoch: 1,
+      })
+      await atPersistedOracleCheckpoint(
+        receiptEntered.promise,
+        `reset truncate receipt entered`,
+      )
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      expect(adapter.loadSubsetCalls.length).toBe(baselineLoadCount)
+
+      rejectedReceipt.reject(receiptError)
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      expect({
+        status: collection.status,
+        exactPublicError: collection._lifecycle.getSyncError() === receiptError,
+      }).toEqual({
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectedReceipt.reject(receiptError)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`keeps local persistence pending through confirmation receipt settlement`, async () => {
+    const id = `local-confirmation-receipt`
+    const adapter = createRecordingAdapter()
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const receiptEntered = createEventGate()
+    const rejectedReceipt = createEventGate()
+    const receiptError = new Error(`local confirmation receipt failed exactly`)
+    let rejectNextCommit = false
+    coordinator.requestApplyLocalMutations = async (
+      _collectionId,
+      mutations,
+    ) => {
+      rejectNextCommit = true
+      return {
+        type: `rpc:applyLocalMutations:res`,
+        rpcId: `local-confirmation`,
+        ok: true,
+        term: 1,
+        seq: 1,
+        latestRowVersion: 1,
+        acceptedMutationIds: mutations.map((mutation) => mutation.mutationId),
+      }
+    }
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (!rejectNextCommit) return actualReceipt
+              rejectNextCommit = false
+              receiptEntered.resolve()
+              void Promise.resolve(actualReceipt).catch(() => undefined)
+              return rejectedReceipt.promise
+            },
+          }),
+      },
+    })
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `local confirmation receipt collection ready`,
+      )
+      const transaction = collection.insert({
+        id: `local`,
+        title: `durable before confirmation settles`,
+      })
+      const transactionOutcome = transaction.isPersisted.promise.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        receiptEntered.promise,
+        `local confirmation receipt entered`,
+      )
+      const pending = observeSettlement(
+        transactionOutcome.then(() => undefined),
+      )
+      await Promise.resolve()
+      expect(pending.read()).toEqual({ status: `pending` })
+
+      rejectedReceipt.reject(receiptError)
+      const outcome = await atPersistedOracleCheckpoint(
+        transactionOutcome,
+        `local confirmation transaction settled`,
+      )
+      await flushAsyncWork()
+
+      expect({
+        transactionStatus: outcome.status,
+        transactionExact:
+          outcome.status === `rejected` && outcome.reason === receiptError,
+        status: collection.status,
+        exactPublicError: collection._lifecycle.getSyncError() === receiptError,
+      }).toEqual({
+        transactionStatus: `rejected`,
+        transactionExact: true,
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectedReceipt.reject(receiptError)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not continue an old hydration into a replacement after its applied receipt settles`, async () => {
+    const id = `hydration-applied-receipt-lifecycle`
+    const adapter = createRecordingAdapter()
+    const receiptEntered = createEventGate()
+    const releaseReceipt = createEventGate()
+    let gateNextCommit = false
+    let baselineCalls = 0
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 1) {
+        gateNextCommit = true
+        return [
+          {
+            key: `old`,
+            value: { id: `old`, title: `old owner hydration` },
+          },
+        ]
+      }
+      return [
+        {
+          key: `replacement`,
+          value: { id: `replacement`, title: `new owner hydration` },
+        },
+      ]
+    })
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+        },
+      },
+      persistence: { adapter },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (!gateNextCommit) return actualReceipt
+              gateNextCommit = false
+              receiptEntered.resolve()
+              void Promise.resolve(actualReceipt).catch(() => undefined)
+              return releaseReceipt.promise
+            },
+          }),
+      },
+    })
+    const oldReady = collection.stateWhenReady().then(
+      () => ({ status: `fulfilled` as const }),
+      (reason: unknown) => ({ status: `rejected` as const, reason }),
+    )
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        receiptEntered.promise,
+        `old hydration applied receipt entered`,
+      )
+      expect(stripVirtualProps(collection.get(`old`))).toEqual({
+        id: `old`,
+        title: `old owner hydration`,
+      })
+
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      releaseReceipt.resolve()
+      const replacementOutcome = await atPersistedOracleCheckpoint(
+        replacementReady,
+        `replacement hydration after old applied receipt`,
+      )
+
+      expect({
+        replacementStatus: replacementOutcome.status,
+        baselineCalls,
+        oldVisible: collection.get(`old`),
+        replacementVisible: stripVirtualProps(collection.get(`replacement`)),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        replacementStatus: `fulfilled`,
+        baselineCalls: 2,
+        oldVisible: undefined,
+        replacementVisible: {
+          id: `replacement`,
+          title: `new owner hydration`,
+        },
+        status: `ready`,
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseReceipt.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => oldReady,
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not let an old post-receipt continuation flush replacement coordinator work`, async () => {
+    const id = `post-receipt-queue-lifecycle`
+    const adapter = createRecordingAdapter()
+    const coordinator = createFailStopCoordinatorHarness(id)
+    const receiptEntered = createEventGate()
+    const releaseReceipt = createEventGate()
+    const replacementSourceStarted = createEventGate()
+    const replacementHydrationEntered = createEventGate()
+    const releaseReplacementHydration = createEventGate()
+    let gateNextCommit = false
+    let baselineCalls = 0
+    let sourceRuns = 0
+    overrideBaselineRows(adapter, async () => {
+      baselineCalls++
+      if (baselineCalls === 1) {
+        gateNextCommit = true
+        return [
+          {
+            key: `old`,
+            value: { id: `old`, title: `old owner hydration` },
+          },
+        ]
+      }
+      replacementHydrationEntered.resolve()
+      await releaseReplacementHydration.promise
+      return [
+        {
+          key: `replacement`,
+          value: { id: `replacement`, title: `new owner hydration` },
+        },
+      ]
+    })
+    const baseOptions = persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          sourceRuns++
+          if (sourceRuns === 2) replacementSourceStarted.resolve()
+          markReady()
+        },
+      },
+      persistence: { adapter, coordinator },
+    })
+    const baseSync = baseOptions.sync.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        ...baseOptions.sync,
+        sync: (params) =>
+          baseSync({
+            ...params,
+            commit: (signal) => {
+              const actualReceipt = params.commit(signal)
+              if (!gateNextCommit) return actualReceipt
+              gateNextCommit = false
+              receiptEntered.resolve()
+              void Promise.resolve(actualReceipt).catch(() => undefined)
+              return releaseReceipt.promise
+            },
+          }),
+      },
+    })
+    const oldReady = collection.stateWhenReady().then(
+      () => ({ status: `fulfilled` as const }),
+      (reason: unknown) => ({ status: `rejected` as const, reason }),
+    )
+    let replacementReady:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        receiptEntered.promise,
+        `old post-receipt hydration entered`,
+      )
+      await collection.cleanup()
+      cleanedUp = true
+      collection.startSyncImmediate()
+      cleanedUp = false
+      replacementReady = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        replacementSourceStarted.promise,
+        `replacement source subscribed behind old receipt`,
+      )
+      coordinator.emit({
+        type: `tx:committed`,
+        term: 1,
+        seq: 1,
+        txId: `replacement-queued-work`,
+        latestRowVersion: 1,
+        requiresFullReload: false,
+        changedRows: [
+          {
+            key: `queued`,
+            value: {
+              id: `queued`,
+              title: `belongs after replacement hydrate`,
+            },
+          },
+        ],
+        deletedKeys: [],
+      })
+
+      releaseReceipt.resolve()
+      await atPersistedOracleCheckpoint(
+        replacementHydrationEntered.promise,
+        `replacement hydration entered after old receipt`,
+      )
+      await flushAsyncWork()
+
+      expect({
+        sourceRuns,
+        baselineCalls,
+        queuedVisible: collection.get(`queued`),
+      }).toEqual({
+        sourceRuns: 2,
+        baselineCalls: 2,
+        queuedVisible: undefined,
+      })
+
+      releaseReplacementHydration.resolve()
+      const replacementOutcome = await atPersistedOracleCheckpoint(
+        replacementReady,
+        `replacement hydration settled before coordinator work`,
+      )
+      await flushAsyncWork()
+      await flushAsyncWork()
+
+      expect({
+        replacementStatus: replacementOutcome.status,
+        oldVisible: collection.get(`old`),
+        replacementVisible: stripVirtualProps(collection.get(`replacement`)),
+        queuedVisible: stripVirtualProps(collection.get(`queued`)),
+        publicError: collection._lifecycle.getSyncError(),
+      }).toEqual({
+        replacementStatus: `fulfilled`,
+        oldVisible: undefined,
+        replacementVisible: {
+          id: `replacement`,
+          title: `new owner hydration`,
+        },
+        queuedVisible: {
+          id: `queued`,
+          title: `belongs after replacement hydrate`,
+        },
+        publicError: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseReceipt.resolve()
+      releaseReplacementHydration.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => oldReady,
+          () => replacementReady,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects new source transactions after a terminal persistence failure`, async () => {
+    const adapter = createRecordingAdapter()
+    const adapterError = Object.assign(
+      new Error(`terminal adapter write failed exactly`),
+      {
+        code: `SQLITE_FULL`,
+        path: `adapter.applyCommittedTx`,
+      },
+    )
+    const successfulApply = adapter.applyCommittedTx.bind(adapter)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (collectionId, tx) => {
+      applyCalls++
+      if (applyCalls === 1) throw adapterError
+      await successfulApply(collectionId, tx)
+    }
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-terminal-persistence-admission`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `terminal persistence admission collection ready`,
+      )
+      remoteBegin!()
+      remoteWrite!({
+        type: `insert`,
+        value: { id: `first`, title: `published before persistence` },
+      })
+      const firstOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(remoteCommit!()).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `first terminal persistence receipt`,
+      )
+      const terminalError =
+        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
+
+      expect({
+        receiptStatus: firstOutcome.status,
+        errorName:
+          terminalError instanceof Error ? terminalError.name : undefined,
+        cause: terminalError instanceof Error ? terminalError.cause : undefined,
+        publicErrorIsReceipt:
+          collection._lifecycle.getSyncError() === terminalError,
+        status: collection.status,
+        firstVisible: stripVirtualProps(collection.get(`first`)),
+        firstDurable: adapter.rows.get(`first`),
+        applyCalls,
+      }).toEqual({
+        receiptStatus: `rejected`,
+        errorName: `PersistedCollectionDurabilityError`,
+        cause: adapterError,
+        publicErrorIsReceipt: true,
+        status: `crashed`,
+        firstVisible: {
+          id: `first`,
+          title: `published before persistence`,
+        },
+        firstDurable: undefined,
+        applyCalls: 1,
+      })
+
+      remoteBegin!()
+      remoteWrite!({
+        type: `insert`,
+        value: { id: `late`, title: `must not be admitted` },
+      })
+      const lateOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(remoteCommit!()).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `late terminal persistence receipt`,
+      )
+
+      expect({
+        receiptStatus: lateOutcome.status,
+        exactReceipt:
+          lateOutcome.status === `rejected` &&
+          lateOutcome.reason === terminalError,
+        publicErrorIsTerminal:
+          collection._lifecycle.getSyncError() === terminalError,
+        status: collection.status,
+        lateVisible: collection.get(`late`),
+        lateDurable: adapter.rows.get(`late`),
+        applyCalls,
+      }).toEqual({
+        receiptStatus: `rejected`,
+        exactReceipt: true,
+        publicErrorIsTerminal: true,
+        status: `crashed`,
+        lateVisible: undefined,
+        lateDurable: undefined,
+        applyCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it.each([`hydration`, `durability`] as const)(
+    `fences metadata and truncate transactions after a terminal %s failure`,
+    async (failureKind) => {
+      const harness = await createTerminalFailureHarness(
+        failureKind,
+        `terminal-transaction-surface-${failureKind}`,
+      )
+      const {
+        adapter,
+        collection,
+        coordinator,
+        seed,
+        sourceParams,
+        terminalError,
+      } = harness
+      const applyCallsBefore = adapter.applyCommittedTxCalls.length
+      const publishCallsBefore = coordinator.publishCalls.length
+      const operations: Array<{ name: string; apply: () => void }> = [
+        {
+          name: `row metadata set`,
+          apply: () =>
+            sourceParams.metadata!.row.set(seed.id, `must-not-replace-row`),
+        },
+        {
+          name: `row metadata delete`,
+          apply: () => sourceParams.metadata!.row.delete(seed.id),
+        },
+        {
+          name: `collection metadata set`,
+          apply: () =>
+            sourceParams.metadata!.collection.set(
+              `resume`,
+              `must-not-replace-collection`,
+            ),
+        },
+        {
+          name: `collection metadata delete`,
+          apply: () => sourceParams.metadata!.collection.delete(`resume`),
+        },
+        {
+          name: `truncate`,
+          apply: () => sourceParams.truncate(),
+        },
+      ]
+      let hasPrimaryFailure = false
+
+      try {
+        for (const operation of operations) {
+          sourceParams.begin()
+          const operationOutcome = await Promise.resolve()
+            .then(operation.apply)
+            .then(
+              () => ({ status: `fulfilled` as const }),
+              (reason: unknown) => ({ status: `rejected` as const, reason }),
+            )
+          const receiptOutcome = await atPersistedOracleCheckpoint(
+            Promise.resolve(sourceParams.commit()).then(
+              () => ({ status: `fulfilled` as const }),
+              (reason: unknown) => ({ status: `rejected` as const, reason }),
+            ),
+            `${failureKind} ${operation.name} terminal receipt`,
+          )
+
+          expect({
+            operation: operationOutcome.status,
+            receipt: receiptOutcome.status,
+            exactReceipt:
+              receiptOutcome.status === `rejected` &&
+              receiptOutcome.reason === terminalError,
+            visibleSeed: stripVirtualProps(collection.get(seed.id)),
+            durableSeed: adapter.rows.get(seed.id),
+            rowMetadata: sourceParams.metadata!.row.get(seed.id),
+            collectionMetadata: sourceParams.metadata!.collection.get(`resume`),
+            applyCalls: adapter.applyCommittedTxCalls.length,
+            publishCalls: coordinator.publishCalls.length,
+            status: collection.status,
+            exactPublicError:
+              collection._lifecycle.getSyncError() === terminalError,
+          }).toEqual({
+            operation: `fulfilled`,
+            receipt: `rejected`,
+            exactReceipt: true,
+            visibleSeed: seed,
+            durableSeed: seed,
+            rowMetadata: `row-metadata-before-failure`,
+            collectionMetadata: `collection-metadata-before-failure`,
+            applyCalls: applyCallsBefore,
+            publishCalls: publishCallsBefore,
+            status: `crashed`,
+            exactPublicError: true,
+          })
+        }
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`fences reload, upstream hydration, and late readiness after terminal persistence failure`, async () => {
+    const harness = await createTerminalFailureHarness(
+      `durability`,
+      `terminal-persistence-reload-surfaces`,
+    )
+    const {
+      adapter,
+      collection,
+      coordinator,
+      sourceParams,
+      terminalError,
+      upstreamLoads,
+    } = harness
+    const late = { id: `late-reload`, title: `must not hydrate` }
+    const loadCallsBefore = adapter.loadSubsetCalls.length
+    const upstreamCallsBefore = upstreamLoads.length
+    const publishCallsBefore = coordinator.publishCalls.length
+    adapter.loadSubset = (collectionId, options, context) => {
+      adapter.loadSubsetCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        options,
+        requiredIndexSignatures: context?.requiredIndexSignatures ?? [],
+      })
+      return Promise.resolve([{ key: late.id, value: late }])
+    }
+    let hasPrimaryFailure = false
+
+    try {
+      const loadOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(collection._sync.loadSubset({ limit: 3 })).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `post-persistence terminal loadSubset`,
+      )
+      sourceParams.markReady()
+      await flushAsyncWork()
+
+      expect({
+        loadStatus: loadOutcome.status,
+        loadExact:
+          loadOutcome.status === `rejected` &&
+          loadOutcome.reason === terminalError,
+        adapterLoads: adapter.loadSubsetCalls.length,
+        upstreamLoads: upstreamLoads.length,
+        publishCalls: coordinator.publishCalls.length,
+        visibleLate: collection.get(late.id),
+        durableLate: adapter.rows.get(late.id),
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+      }).toEqual({
+        loadStatus: `rejected`,
+        loadExact: true,
+        adapterLoads: loadCallsBefore,
+        upstreamLoads: upstreamCallsBefore,
+        publishCalls: publishCallsBefore,
+        visibleLate: undefined,
+        durableLate: undefined,
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects an already-admitted sibling when the preceding persistence fails`, async () => {
+    const adapter = createRecordingAdapter()
+    const firstPersistenceEntered = createEventGate()
+    const firstPersistence = createEventGate()
+    const adapterError = new Error(`first pending persistence failed exactly`)
+    const coordinator = createFailStopCoordinatorHarness(
+      `terminal-pending-sibling`,
+    )
+    let applyCalls = 0
+    coordinator.requestApplyCommittedTx = async (_collectionId, tx) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        try {
+          await firstPersistence.promise
+        } catch (error) {
+          throw new PersistedCollectionDurabilityError(
+            `first pending persistence failed`,
+            { cause: error },
+          )
+        }
+      }
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-pending-sibling`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `pending sibling collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `a`, title: `first publishes before persistence` },
+      })
+      const firstReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `first persistence entered before sibling admission`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `b`, title: `must not publish or persist` },
+      })
+      const secondReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      const secondSettlement = observeSettlement(
+        secondReceipt.then(
+          () => undefined,
+          () => undefined,
+        ),
+      )
+      expect(secondSettlement.read()).toEqual({ status: `pending` })
+
+      firstPersistence.reject(adapterError)
+      const firstOutcome = await atPersistedOracleCheckpoint(
+        firstReceipt,
+        `first failed persistence receipt`,
+      )
+      const terminalError =
+        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
+      const secondOutcome = await atPersistedOracleCheckpoint(
+        secondReceipt,
+        `already-admitted sibling terminal receipt`,
+      )
+
+      expect({
+        firstStatus: firstOutcome.status,
+        terminalName:
+          terminalError instanceof Error ? terminalError.name : undefined,
+        terminalCause:
+          terminalError instanceof Error ? terminalError.cause : undefined,
+        secondStatus: secondOutcome.status,
+        secondExact:
+          secondOutcome.status === `rejected` &&
+          secondOutcome.reason === terminalError,
+        applyCalls,
+        firstVisible: stripVirtualProps(collection.get(`a`)),
+        firstDurable: adapter.rows.get(`a`),
+        secondVisible: collection.get(`b`),
+        secondDurable: adapter.rows.get(`b`),
+        publishCalls: coordinator.publishCalls.length,
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+      }).toEqual({
+        firstStatus: `rejected`,
+        terminalName: `PersistedCollectionDurabilityError`,
+        terminalCause: adapterError,
+        secondStatus: `rejected`,
+        secondExact: true,
+        applyCalls: 1,
+        firstVisible: {
+          id: `a`,
+          title: `first publishes before persistence`,
+        },
+        firstDurable: undefined,
+        secondVisible: undefined,
+        secondDurable: undefined,
+        publishCalls: 0,
+        status: `crashed`,
+        exactPublicError: true,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      firstPersistence.reject(adapterError)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`marks direct adapter failure terminal and fences later local mutations`, async () => {
+    const adapter = createRecordingAdapter()
+    const adapterError = Object.assign(
+      new Error(`local adapter failed exactly`),
+      {
+        code: `SQLITE_IOERR`,
+        path: `adapter.applyCommittedTx`,
+      },
+    )
+    const successfulApply = adapter.applyCommittedTx.bind(adapter)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) throw adapterError
+      await successfulApply(...args)
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-loopback-local-durability`,
+        getKey: (row) => row.id,
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `local durability collection ready`,
+      )
+      const firstTransaction = collection.insert({
+        id: `first-local`,
+        title: `must roll back`,
+      })
+      const firstOutcome = await atPersistedOracleCheckpoint(
+        firstTransaction.isPersisted.promise.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `first local durability failure`,
+      )
+      const terminalError =
+        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
+
+      const loadCallsBefore = adapter.loadSubsetCalls.length
+      adapter.loadSubset = (collectionId, options, context) => {
+        adapter.loadSubsetCalls.push({
+          collectionId: recordedStorageId(collectionId),
+          options,
+          requiredIndexSignatures: context?.requiredIndexSignatures ?? [],
+        })
+        return Promise.resolve([
+          {
+            key: `forced-late`,
+            value: { id: `forced-late`, title: `must not hydrate` },
+          },
+        ])
+      }
+      const forceOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(collection.utils.forceReloadSubset!({ limit: 4 })).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `force reload after local durability failure`,
+      )
+
+      const lateOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve()
+          .then(async () => {
+            const lateTransaction = collection.insert({
+              id: `late-local`,
+              title: `must not be admitted`,
+            })
+            await lateTransaction.isPersisted.promise
+          })
+          .then(
+            () => ({ status: `fulfilled` as const }),
+            (reason: unknown) => ({ status: `rejected` as const, reason }),
+          ),
+        `late local terminal receipt`,
+      )
+
+      expect({
+        firstStatus: firstOutcome.status,
+        errorName:
+          terminalError instanceof Error ? terminalError.name : undefined,
+        errorCause:
+          terminalError instanceof Error ? terminalError.cause : undefined,
+        errorCode:
+          terminalError instanceof Error
+            ? (terminalError as Error & { code?: unknown }).code
+            : undefined,
+        forceStatus: forceOutcome.status,
+        forceExact:
+          forceOutcome.status === `rejected` &&
+          forceOutcome.reason === terminalError,
+        loadCalls: adapter.loadSubsetCalls.length,
+        forceVisible: collection.get(`forced-late`),
+        lateStatus: lateOutcome.status,
+        lateErrorName:
+          lateOutcome.status === `rejected` &&
+          lateOutcome.reason instanceof Error
+            ? lateOutcome.reason.name
+            : undefined,
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+        applyCalls,
+        firstVisible: collection.get(`first-local`),
+        firstDurable: adapter.rows.get(`first-local`),
+        lateVisible: collection.get(`late-local`),
+        lateDurable: adapter.rows.get(`late-local`),
+      }).toEqual({
+        firstStatus: `rejected`,
+        errorName: `PersistedCollectionDurabilityError`,
+        errorCause: adapterError,
+        errorCode: `SQLITE_IOERR`,
+        forceStatus: `rejected`,
+        forceExact: true,
+        loadCalls: loadCallsBefore,
+        forceVisible: undefined,
+        lateStatus: `rejected`,
+        lateErrorName: `CollectionStateError`,
+        status: `crashed`,
+        exactPublicError: true,
+        applyCalls: 1,
+        firstVisible: undefined,
+        firstDurable: undefined,
+        lateVisible: undefined,
+        lateDurable: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`fences direct acceptMutations and local mutations after hydration failure`, async () => {
+    const adapter = createRecordingAdapter()
+    const hydrationError = new Error(`loopback hydration failed exactly`)
+    const restoreBaselineRows = overrideBaselineRows(adapter, () =>
+      Promise.reject(hydrationError),
+    )
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `terminal-loopback-hydration`,
+        getKey: (row) => row.id,
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await expect(
+        atPersistedOracleCheckpoint(
+          collection.stateWhenReady(),
+          `loopback hydration rejected`,
+        ),
+      ).rejects.toBe(hydrationError)
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(hydrationError)
+
+      restoreBaselineRows()
+      const now = new Date()
+      const directRow = { id: `direct`, title: `must not be accepted` }
+      const directMutation: PendingMutation<Todo, `insert`> = {
+        mutationId: `direct-after-hydration`,
+        original: {},
+        modified: directRow,
+        changes: directRow,
+        globalKey: `terminal-loopback-hydration:direct`,
+        key: directRow.id,
+        type: `insert`,
+        metadata: undefined,
+        syncMetadata: {},
+        optimistic: true,
+        createdAt: now,
+        updatedAt: now,
+        collection,
+      }
+      const directOutcome = await atPersistedOracleCheckpoint(
+        Promise.resolve(
+          collection.utils.acceptMutations({
+            mutations: [
+              directMutation as unknown as PendingMutation<
+                Record<string, unknown>
+              >,
+            ],
+          }),
+        ).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `direct acceptMutations after hydration failure`,
+      )
+      const localOutcome = await Promise.resolve()
+        .then(() =>
+          collection.insert({
+            id: `late-local-hydration`,
+            title: `must not be admitted`,
+          }),
+        )
+        .then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        )
+
+      expect({
+        directStatus: directOutcome.status,
+        directExact:
+          directOutcome.status === `rejected` &&
+          directOutcome.reason === hydrationError,
+        localStatus: localOutcome.status,
+        localErrorName:
+          localOutcome.status === `rejected` &&
+          localOutcome.reason instanceof Error
+            ? localOutcome.reason.name
+            : undefined,
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === hydrationError,
+        applyCalls: adapter.applyCommittedTxCalls.length,
+        directVisible: collection.get(directRow.id),
+        directDurable: adapter.rows.get(directRow.id),
+        localVisible: collection.get(`late-local-hydration`),
+        localDurable: adapter.rows.get(`late-local-hydration`),
+      }).toEqual({
+        directStatus: `rejected`,
+        directExact: true,
+        localStatus: `rejected`,
+        localErrorName: `CollectionStateError`,
+        status: `crashed`,
+        exactPublicError: true,
+        applyCalls: 0,
+        directVisible: undefined,
+        directDurable: undefined,
+        localVisible: undefined,
+        localDurable: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`replays a hydration-buffered write before its named durability rejection`, async () => {
+    const adapter = createRecordingAdapter()
+    let releaseHydration: (() => void) | undefined
+    adapter.loadResumeSnapshot = (_collectionId, options) => {
+      const snapshot = {
+        rows: [],
+        keySet: { status: `consistent` as const },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }
+      if (options?.includeRows === false) {
+        return Promise.resolve(snapshot)
+      }
+      return new Promise((resolve) => {
+        releaseHydration = () => resolve(snapshot)
+      })
+    }
+    const persistenceError = Object.assign(
+      new Error(`buffered persistence failed`),
+      {
+        code: `SQLITE_FULL`,
+        path: `todos.sqlite`,
+      },
+    )
+    let rejectPersistence: ((error: unknown) => void) | undefined
+    adapter.applyCommittedTx = () =>
+      new Promise<void>((_resolve, reject) => {
+        rejectPersistence = reject
+      })
+
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydration-buffered-persistence-error`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      void collection.stateWhenReady().catch(() => undefined)
+      await vi.waitFor(() => {
+        expect(releaseHydration).toBeTypeOf(`function`)
+        expect(remoteCommit).toBeTypeOf(`function`)
+      })
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `buffered`, title: `Published before failure` },
+      })
+      const receipt = Promise.resolve(remoteCommit?.())
+      let settled = false
+      void receipt.then(
+        () => {
+          settled = true
+        },
+        () => {
+          settled = true
+        },
+      )
+
+      expect(collection.get(`buffered`)).toBeUndefined()
+      expect(settled).toBe(false)
+      releaseHydration!()
+      await vi.waitFor(() => expect(rejectPersistence).toBeTypeOf(`function`))
+
+      expect(stripVirtualProps(collection.get(`buffered`))).toEqual({
+        id: `buffered`,
+        title: `Published before failure`,
+      })
+      expect(settled).toBe(false)
+
+      rejectPersistence!(persistenceError)
+      const rejection = await receipt.then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+
+      expect(rejection).not.toBe(persistenceError)
+      expect(rejection).toMatchObject({
+        name: `PersistedCollectionDurabilityError`,
+        code: `SQLITE_FULL`,
+        path: `todos.sqlite`,
+        cause: persistenceError,
+      })
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(rejection)
+    } finally {
+      releaseHydration?.()
+      rejectPersistence?.(persistenceError)
+      await collection.cleanup()
+      warning.mockRestore()
+    }
+  })
+
+  it(`preserves row metadata set before a metadata-less insert in the same sync transaction`, async () => {
+    const adapter = createRecordingAdapter()
+    const ownership = { queryCollection: { owners: [`gc:q1`] } }
+    const sync: SyncConfig<Todo, string> = {
+      sync: ({ begin, write, commit, markReady, metadata }) => {
+        begin()
+        metadata?.row.set(`remote-1`, ownership)
+        write({
+          type: `insert`,
+          value: {
+            id: `remote-1`,
+            title: `From remote`,
+          },
+        })
+        commit()
+        markReady()
+      },
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item: Todo) => item.id,
+        sync,
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    await collection.stateWhenReady()
+    await flushAsyncWork()
+
+    expect(adapter.rowMetadata.get(`remote-1`)).toEqual(ownership)
+    expect(collection._state.syncedMetadata.get(`remote-1`)).toEqual(ownership)
+  })
+
+  it(`resets stale row metadata for a metadata-less insert with no queued metadata`, async () => {
+    const adapter = createRecordingAdapter()
+    adapter.rowMetadata.set(`remote-1`, { stale: true })
+    const sync: SyncConfig<Todo, string> = {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({
+          type: `insert`,
+          value: {
+            id: `remote-1`,
+            title: `From remote`,
+          },
+        })
+        commit()
+        markReady()
+      },
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item: Todo) => item.id,
+        sync,
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    await collection.stateWhenReady()
+    await flushAsyncWork()
+
+    expect(adapter.rowMetadata.has(`remote-1`)).toBe(false)
+  })
+
+  it(`uses a stable generated collection id in sync-present mode when id is omitted`, async () => {
+    const adapter = createRecordingAdapter()
+    const options = persistedCollectionOptions<Todo, string>({
+      getKey: (item) => item.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+        },
+      },
+      persistence: {
+        adapter,
+      },
+    })
+
+    expect(options.id).toBeDefined()
+
+    const collection = createCollection(options)
+    await collection.preload()
+    await flushAsyncWork()
+
+    expect(collection.id).toBe(options.id)
+    expect(adapter.loadResumeSnapshotCalls[0]?.collectionId).toBe(collection.id)
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-startup.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-startup.test.ts
new file mode 100644
index 0000000000..2543ce9925
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-startup.test.ts
@@ -0,0 +1,1053 @@
+/**
+ * Ordinary tests for persistedCollectionOptions startup: descriptor and runtime ownership, startup metadata reload, and sync-config validation, as fixed scenarios. The startup and ownership laws they touch are owned by persisted-oracle.test.ts, which keeps its generated and model-checked cases.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BasicIndex,
+  DbClient,
+  collectionOptions,
+  createCollection,
+  createTransaction,
+} from '@tanstack/db'
+import {
+  IndeterminateCommitError,
+  InvalidPersistedCollectionConfigError,
+  InvalidSyncConfigError,
+  persistedCollectionOptions,
+} from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createEventGate,
+  createNoopAdapter,
+  createRecordingAdapter,
+  flushAsyncWork,
+  stripVirtualProps,
+} from './persisted-support'
+import type { PersistedSyncWrappedOptions } from '../src'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  // A descriptor's one-owner claim is consumed by a constructed Collection,
+  // not by a constructor attempt that failed before binding the runtime.
+  // The independent admission model has unclaimed and claimed states; this
+  // invalid-then-corrected history must remain unclaimed after the first
+  // throw. The checkpoint is the second createCollection call and its later
+  // durable write. A successful first construction is checked below.
+  it(`permits a corrected descriptor after construction fails before owner binding`, async () => {
+    const adapter = createRecordingAdapter()
+    const options = persistedCollectionOptions<Todo, string>({
+      id: `failed-construction-retry`,
+      getKey: (row) => row.id,
+      autoIndex: `eager`,
+      persistence: { adapter },
+    })
+    expect(() => createCollection(options)).toThrow(/autoIndex/)
+    options.defaultIndexType = BasicIndex
+    const collection = createCollection(options)
+    let unexpectedThird: typeof collection | undefined
+    let hasPrimaryFailure = false
+    try {
+      await collection.stateWhenReady()
+      expect(() => {
+        unexpectedThird = createCollection(options)
+      }).toThrow(InvalidPersistedCollectionConfigError)
+      const receipt = collection.insert({ id: `owned`, title: `Retried owner` })
+      await receipt.isPersisted.promise
+      expect(stripVirtualProps(collection.get(`owned`))).toEqual({
+        id: `owned`,
+        title: `Retried owner`,
+      })
+      expect(adapter.rows.get(`owned`)).toEqual({
+        id: `owned`,
+        title: `Retried owner`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => unexpectedThird?.cleanup(), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  // Law: only a successfully constructed Collection consumes an options
+  // descriptor. The same unclaimed -> claimed admission model applies if a
+  // synchronous collaborator fails after sync startup begins. The first
+  // attempt must expose that failure; after correction, the same descriptor
+  // must construct and persist normally. This tests the public constructor
+  // and durability receipt, rather than inspecting the private claim flag.
+  // Both local-only and wrapped-source startup bind through distinct paths.
+  // A subscription ledger checks that the failed attempt has no live listener,
+  // the corrected owner has one, and cleanup releases it.
+  it.each([`local-only`, `wrapped source`] as const)(
+    `permits a corrected %s descriptor after sync-start construction fails`,
+    async (mode) => {
+      const adapter = createRecordingAdapter()
+      const coordinator = createCoordinatorHarness()
+      coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
+        await adapter.applyCommittedTx({ kind: `eager`, collectionId }, tx)
+        return {
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }
+      }
+      const subscribe = coordinator.subscribe.bind(coordinator)
+      const fault = new Error(`coordinator subscription failed`)
+      let failSubscription = true
+      let activeSubscriptions = 0
+      coordinator.subscribe = (...args) => {
+        if (failSubscription) throw fault
+        const unsubscribe = subscribe(...args)
+        activeSubscriptions++
+        return () => {
+          activeSubscriptions--
+          unsubscribe()
+        }
+      }
+      const base = {
+        id: `failed-sync-start-construction-retry-${mode}`,
+        getKey: (row: Todo) => row.id,
+        startSync: true as const,
+        persistence: { adapter, coordinator },
+      }
+      let source!: TodoSyncParams
+      const construct =
+        mode === `wrapped source`
+          ? (() => {
+              const options = persistedCollectionOptions<Todo, string>({
+                ...base,
+                sync: {
+                  sync: (params) => {
+                    source = params
+                    params.markReady()
+                  },
+                },
+              })
+              return () => createCollection(options)
+            })()
+          : (() => {
+              const options = persistedCollectionOptions<Todo, string>(base)
+              return () => createCollection(options)
+            })()
+      expect(construct).toThrow(fault)
+      expect(activeSubscriptions).toBe(0)
+      failSubscription = false
+      const collection = construct()
+      let unexpectedThird: typeof collection | undefined
+      let hasPrimaryFailure = false
+      try {
+        await collection.stateWhenReady()
+        expect(activeSubscriptions).toBe(1)
+        if (mode === `wrapped source`) await flushAsyncWork()
+        expect(() => {
+          unexpectedThird = construct()
+        }).toThrow(InvalidPersistedCollectionConfigError)
+        const row = { id: `owned`, title: `Retried owner` }
+        if (mode === `wrapped source`) {
+          source.begin()
+          source.write({ type: `insert`, value: row })
+          await source.commit()
+        } else {
+          await collection.insert(row).isPersisted.promise
+        }
+        expect(stripVirtualProps(collection.get(`owned`))).toEqual({
+          id: `owned`,
+          title: `Retried owner`,
+        })
+        expect(adapter.rows.get(`owned`)).toEqual({
+          id: `owned`,
+          title: `Retried owner`,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [
+            () => unexpectedThird?.cleanup(),
+            () => collection.cleanup(),
+            () => {
+              expect(activeSubscriptions).toBe(0)
+            },
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // A persisted options descriptor owns one mutable runtime. The independent
+  // ownership rule is one Collection per descriptor, including a spread copy:
+  // copying fields cannot create a second runtime. The public creation boundary
+  // must reject the second Collection before it can redirect the first one's
+  // writes. Fresh descriptors remain legal and are covered elsewhere here and
+  // by DbClient materialization. The checkpoint is createCollection itself,
+  // then the first owner's durable receipt and public row after the rejection.
+  it.each([`same object`, `spread copy`] as const)(
+    `keeps one persisted options runtime bound to its first Collection (%s)`,
+    async (reuse) => {
+      const adapter = createRecordingAdapter()
+      const options = persistedCollectionOptions<Todo, string>({
+        id: `one-owner-${reuse}`,
+        getKey: (row) => row.id,
+        persistence: { adapter },
+      })
+      const first = createCollection(options)
+      let second: typeof first | undefined
+      let hasPrimaryFailure = false
+      try {
+        await first.stateWhenReady()
+        expect(() => {
+          second = createCollection(
+            reuse === `same object` ? options : { ...options },
+          )
+        }).toThrow(InvalidPersistedCollectionConfigError)
+
+        const receipt = first.insert({ id: `owned`, title: `First owner` })
+        await receipt.isPersisted.promise
+        expect(stripVirtualProps(first.get(`owned`))).toEqual({
+          id: `owned`,
+          title: `First owner`,
+        })
+        expect(adapter.rows.get(`owned`)).toEqual({
+          id: `owned`,
+          title: `First owner`,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => second?.cleanup(), () => first.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // The same ownership rule applies when an upstream sync source is wrapped.
+  // A source commit through the first Collection must remain public and durable
+  // after a second Collection is rejected at admission.
+  it.each([`same object`, `spread copy`] as const)(
+    `keeps a wrapped sync source bound to its first Collection (%s)`,
+    async (reuse) => {
+      const adapter = createRecordingAdapter()
+      let source!: TodoSyncParams
+      const options = persistedCollectionOptions<Todo, string>({
+        id: `one-source-owner-${reuse}`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      })
+      const first = createCollection(options)
+      let second: typeof first | undefined
+      let hasPrimaryFailure = false
+      try {
+        await first.stateWhenReady()
+        expect(() => {
+          second = createCollection(
+            reuse === `same object` ? options : { ...options },
+          )
+        }).toThrow(InvalidPersistedCollectionConfigError)
+
+        source.begin()
+        source.write({
+          type: `insert`,
+          value: { id: `owned`, title: `First source` },
+        })
+        await Promise.resolve(source.commit())
+        expect(stripVirtualProps(first.get(`owned`))).toEqual({
+          id: `owned`,
+          title: `First source`,
+        })
+        expect(adapter.rows.get(`owned`)).toEqual({
+          id: `owned`,
+          title: `First source`,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => second?.cleanup(), () => first.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Selecting only the public sync config bypasses the descriptor's claim.
+  // The runtime's fallback guard must reject that second Collection before
+  // changing the first owner's controls. This is a legal JavaScript copy of
+  // the exposed config, not a second independent persisted options runtime.
+  it.each([`local-only`, `sync-present`] as const)(
+    `preserves the first owner after a copied sync config is rejected (%s)`,
+    async (mode) => {
+      const adapter = createRecordingAdapter()
+      let source!: TodoSyncParams
+      const base = {
+        id: `selected-sync-${mode}`,
+        getKey: (row: Todo) => row.id,
+        persistence: { adapter },
+      }
+      const options =
+        mode === `sync-present`
+          ? persistedCollectionOptions<Todo, string>({
+              ...base,
+              sync: {
+                sync: (params) => {
+                  source = params
+                  params.markReady()
+                },
+              },
+            })
+          : persistedCollectionOptions<Todo, string>(base)
+      const first = createCollection(options)
+      const second = createCollection({
+        id: `unclaimed-${mode}`,
+        getKey: (row: Todo) => row.id,
+        sync: options.sync,
+        startSync: false,
+      })
+      let hasPrimaryFailure = false
+      try {
+        await first.stateWhenReady()
+        if (mode === `sync-present`) {
+          source.begin()
+          source.write({
+            type: `insert`,
+            value: { id: `owned`, title: `First source` },
+          })
+        }
+        expect(() => second.startSyncImmediate()).toThrow(
+          InvalidPersistedCollectionConfigError,
+        )
+
+        if (mode === `sync-present`) {
+          await Promise.resolve(source.commit())
+        } else {
+          await first.insert({ id: `owned`, title: `First owner` }).isPersisted
+            .promise
+        }
+        expect(first.has(`owned`)).toBe(true)
+        expect(second.has(`owned`)).toBe(false)
+        expect(adapter.rows.get(`owned`)?.id).toBe(`owned`)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => second.cleanup(), () => first.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  // Construction, rather than first sync startup, assigns the descriptor's
+  // Collection owner. A lazy wrapped source leaves a legal interval in which a
+  // second Collection can select only its public sync field and start first.
+  // The independent admission rule still gives the first constructed owner
+  // the runtime; the selected copy must fail before it installs controls.
+  it(`rejects a selected sync that starts before its lazy descriptor owner`, async () => {
+    const adapter = createRecordingAdapter()
+    let source!: TodoSyncParams
+    const options = persistedCollectionOptions<Todo, string>({
+      id: `lazy-selected-sync-owner`,
+      getKey: (row) => row.id,
+      startSync: false,
+      sync: {
+        sync: (params) => {
+          source = params
+          params.markReady()
+        },
+      },
+      persistence: { adapter },
+    })
+    const first = createCollection(options)
+    const selected = createCollection({
+      id: `lazy-selected-sync-copy`,
+      getKey: (row: Todo) => row.id,
+      sync: options.sync,
+      startSync: false,
+    })
+    let hasPrimaryFailure = false
+    try {
+      expect(() => selected.startSyncImmediate()).toThrow(
+        InvalidPersistedCollectionConfigError,
+      )
+      first.startSyncImmediate()
+      await first.stateWhenReady()
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `owned`, title: `Original owner` },
+      })
+      await Promise.resolve(source.commit())
+      expect(stripVirtualProps(first.get(`owned`))).toEqual({
+        id: `owned`,
+        title: `Original owner`,
+      })
+      expect(selected.has(`owned`)).toBe(false)
+      expect(adapter.rows.get(`owned`)).toEqual({
+        id: `owned`,
+        title: `Original owner`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => selected.cleanup(), () => first.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not reuse a persisted runtime after its Collection cleans up`, async () => {
+    const options = persistedCollectionOptions<Todo, string>({
+      id: `cleaned-up-owner`,
+      getKey: (row) => row.id,
+      persistence: { adapter: createRecordingAdapter() },
+    })
+    const first = createCollection(options)
+    await first.cleanup()
+    expect(() => createCollection(options)).toThrow(
+      InvalidPersistedCollectionConfigError,
+    )
+  })
+
+  // Cleanup ends a sync run, not the descriptor's permanent Collection claim.
+  // Selecting only the wrapped sync field omits the public claim hook, so this
+  // history checks the runtime guard after cleanup and the original owner's
+  // ability to restart. The two modes cross local and upstream source controls.
+  it.each([`local-only`, `sync-present`] as const)(
+    `rejects a copied sync owner after cleanup and permits the first owner to restart (%s)`,
+    async (mode) => {
+      const adapter = createRecordingAdapter()
+      let source!: TodoSyncParams
+      const base = {
+        id: `cleaned-selected-sync-${mode}`,
+        getKey: (row: Todo) => row.id,
+        persistence: { adapter },
+      }
+      const options =
+        mode === `sync-present`
+          ? persistedCollectionOptions<Todo, string>({
+              ...base,
+              sync: {
+                sync: (params) => {
+                  source = params
+                  params.markReady()
+                },
+              },
+            })
+          : persistedCollectionOptions<Todo, string>(base)
+      const first = createCollection(options)
+      const second = createCollection({
+        id: `post-cleanup-copy-${mode}`,
+        getKey: (row: Todo) => row.id,
+        sync: options.sync,
+        startSync: false,
+      })
+      let hasPrimaryFailure = false
+      try {
+        await first.stateWhenReady()
+        await first.cleanup()
+        expect(() => second.startSyncImmediate()).toThrow(
+          InvalidPersistedCollectionConfigError,
+        )
+
+        const replacementReady = createEventGate()
+        const unsubscribe = first.on(`status:ready`, () =>
+          replacementReady.resolve(),
+        )
+        try {
+          first.startSyncImmediate()
+          await atPersistedOracleCheckpoint(
+            replacementReady.promise,
+            `original persisted owner restarts`,
+          )
+        } finally {
+          unsubscribe()
+        }
+
+        if (mode === `sync-present`) {
+          source.begin()
+          source.write({
+            type: `insert`,
+            value: { id: `after-restart`, title: `First source` },
+          })
+          await Promise.resolve(source.commit())
+        } else {
+          await first.insert({ id: `after-restart`, title: `First owner` })
+            .isPersisted.promise
+        }
+        expect(first.has(`after-restart`)).toBe(true)
+        expect(second.has(`after-restart`)).toBe(false)
+        expect(adapter.rows.get(`after-restart`)?.id).toBe(`after-restart`)
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => second.cleanup(), () => first.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`materializes one independent persisted runtime for each DbClient`, async () => {
+    const adapter = createRecordingAdapter([{ id: `stored`, title: `Stored` }])
+    const descriptor = collectionOptions(
+      persistedCollectionOptions<Todo, string>({
+        id: `client-owned-persistence`,
+        getKey: (row) => row.id,
+        persistence: { adapter },
+      }),
+    )
+    const firstClient = new DbClient()
+    const secondClient = new DbClient()
+    let hasPrimaryFailure = false
+    try {
+      const first = firstClient.collection(descriptor)
+      const second = secondClient.collection(descriptor)
+      expect(first).not.toBe(second)
+      await Promise.all([first.stateWhenReady(), second.stateWhenReady()])
+      expect(stripVirtualProps(first.get(`stored`))).toEqual({
+        id: `stored`,
+        title: `Stored`,
+      })
+      expect(stripVirtualProps(second.get(`stored`))).toEqual({
+        id: `stored`,
+        title: `Stored`,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      await cleanupPersistedOracle(
+        [() => secondClient.cleanup(), () => firstClient.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`preserves exact reconciliation context for an indeterminate commit`, () => {
+    const cause = new Error(`response channel closed`)
+    const error = new IndeterminateCommitError({
+      collectionId: `todos`,
+      requestType: `rpc:applyCommittedTx:req`,
+      previousLeaderId: `leader-a`,
+      previousTerm: 4,
+      currentLeaderId: `leader-b`,
+      currentTerm: 5,
+      cause,
+    })
+
+    expect(error).toMatchObject({
+      name: `IndeterminateCommitError`,
+      code: `INDETERMINATE_COMMIT`,
+      collectionId: `todos`,
+      requestType: `rpc:applyCommittedTx:req`,
+      previousLeaderId: `leader-a`,
+      previousTerm: 4,
+      currentLeaderId: `leader-b`,
+      currentTerm: 5,
+      cause,
+    })
+    expect(error.message).toContain(
+      `rpc:applyCommittedTx:req crossed leadership from leader-a (term 4) to leader-b (term 5)`,
+    )
+  })
+
+  it(`provides a sync-absent loopback configuration with persisted utils`, async () => {
+    const adapter = createRecordingAdapter()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `persisted-loopback`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    const insertTx = collection.insert({
+      id: `1`,
+      title: `Phase 0`,
+    })
+
+    await insertTx.isPersisted.promise
+
+    expect(stripVirtualProps(collection.get(`1`))).toEqual({
+      id: `1`,
+      title: `Phase 0`,
+    })
+    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+    expect(adapter.applyCommittedTxCalls[0]?.tx.mutations[0]?.type).toBe(
+      `insert`,
+    )
+    expect(typeof collection.utils.acceptMutations).toBe(`function`)
+    expect(collection.utils.getLeadershipState?.().isLeader).toBe(true)
+  })
+
+  it(`hydrates a local-only baseline after a managed write advances startup evidence`, async () => {
+    const adapter = createRecordingAdapter([
+      { id: `baseline`, title: `Persisted before startup` },
+    ])
+    const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+    let releaseInitialSnapshot!: () => void
+    const initialSnapshotRelease = new Promise<void>((resolve) => {
+      releaseInitialSnapshot = resolve
+    })
+    let reportInitialSnapshot!: () => void
+    const initialSnapshotCaptured = new Promise<void>((resolve) => {
+      reportInitialSnapshot = resolve
+    })
+    let snapshotCalls = 0
+    adapter.loadResumeSnapshot = async (...args) => {
+      const snapshot = await loadResumeSnapshot(...args)
+      snapshotCalls++
+      if (snapshotCalls === 1) {
+        reportInitialSnapshot()
+        await initialSnapshotRelease
+      }
+      return snapshot
+    }
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `local-only-startup-write`,
+        startSync: false,
+        getKey: (item) => item.id,
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      collection.startSyncImmediate()
+      await initialSnapshotCaptured
+
+      const insert = collection.insert({
+        id: `concurrent`,
+        title: `Managed during startup`,
+      })
+      releaseInitialSnapshot()
+      await insert.isPersisted.promise
+      await collection.stateWhenReady()
+      await vi.waitFor(() => expect(snapshotCalls).toBeGreaterThanOrEqual(2))
+
+      expect(
+        Array.from(collection.values(), (row) => stripVirtualProps(row)).sort(
+          (left, right) => left.id.localeCompare(right.id),
+        ),
+      ).toEqual([
+        { id: `baseline`, title: `Persisted before startup` },
+        { id: `concurrent`, title: `Managed during startup` },
+      ])
+    } finally {
+      releaseInitialSnapshot()
+      await collection.cleanup()
+    }
+  })
+
+  it(`supports acceptMutations for manual transactions`, async () => {
+    const adapter = createRecordingAdapter()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `persisted-manual`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    const tx = createTransaction({
+      autoCommit: false,
+      mutationFn: async ({ transaction }) => {
+        await collection.utils.acceptMutations(transaction)
+      },
+    })
+
+    tx.mutate(() => {
+      collection.insert({
+        id: `manual-1`,
+        title: `Manual`,
+      })
+    })
+
+    await tx.commit()
+
+    expect(stripVirtualProps(collection.get(`manual-1`))).toEqual({
+      id: `manual-1`,
+      title: `Manual`,
+    })
+    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+  })
+
+  it(`loads collection metadata into collection state during startup`, async () => {
+    const adapter = createRecordingAdapter()
+    adapter.collectionMetadata.set(`electric:resume`, {
+      kind: `resume`,
+      offset: `10_0`,
+      handle: `handle-1`,
+      shapeId: `shape-1`,
+      updatedAt: 1,
+    })
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `persisted-startup-metadata`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    await collection.stateWhenReady()
+
+    expect(adapter.loadResumeSnapshotCalls[0]).toMatchObject({
+      collectionId: `persisted-startup-metadata`,
+      includeRows: false,
+    })
+    expect(
+      collection._state.syncedCollectionMetadata.get(`electric:resume`),
+    ).toEqual({
+      kind: `resume`,
+      offset: `10_0`,
+      handle: `handle-1`,
+      shapeId: `shape-1`,
+      updatedAt: 1,
+    })
+  })
+
+  it(`restores row and collection metadata after metadata-bearing full reload`, async () => {
+    const adapter = createRecordingAdapter([
+      {
+        id: `1`,
+        title: `Tracked`,
+      },
+    ])
+    adapter.rowMetadata.set(`1`, {
+      source: `initial`,
+    })
+    adapter.collectionMetadata.set(`electric:resume`, {
+      kind: `resume`,
+      offset: `10_0`,
+      handle: `handle-1`,
+      shapeId: `shape-1`,
+      updatedAt: 1,
+    })
+    const coordinator = createCoordinatorHarness()
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+
+    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
+      source: `initial`,
+    })
+    expect(
+      collection._state.syncedCollectionMetadata.get(`electric:resume`),
+    ).toEqual({
+      kind: `resume`,
+      offset: `10_0`,
+      handle: `handle-1`,
+      shapeId: `shape-1`,
+      updatedAt: 1,
+    })
+
+    adapter.rowMetadata.set(`1`, {
+      source: `reloaded`,
+    })
+    adapter.collectionMetadata.delete(`electric:resume`)
+    adapter.collectionMetadata.set(`queryCollection:gc:q1`, {
+      queryHash: `q1`,
+      mode: `until-revalidated`,
+    })
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-reload`,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
+      source: `reloaded`,
+    })
+    expect(
+      collection._state.syncedCollectionMetadata.has(`electric:resume`),
+    ).toBe(false)
+    expect(
+      collection._state.syncedCollectionMetadata.get(`queryCollection:gc:q1`),
+    ).toEqual({
+      queryHash: `q1`,
+      mode: `until-revalidated`,
+    })
+  })
+
+  it(`persists metadata-only wrapped sync transactions`, async () => {
+    const adapter = createRecordingAdapter()
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `persisted-metadata-only`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, commit, markReady, metadata }) => {
+            begin()
+            metadata?.collection.set(`runtime:key`, { persisted: true })
+            commit()
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+        },
+      }),
+    )
+
+    await collection.stateWhenReady()
+    await flushAsyncWork()
+
+    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+    expect(adapter.applyCommittedTxCalls[0]?.tx.mutations).toEqual([])
+    expect(adapter.collectionMetadata.get(`runtime:key`)).toEqual({
+      persisted: true,
+    })
+    expect(
+      collection._state.syncedCollectionMetadata.get(`runtime:key`),
+    ).toEqual({
+      persisted: true,
+    })
+  })
+
+  it(`replays metadata-only tx:committed deltas without full reload`, async () => {
+    const adapter = createRecordingAdapter([
+      {
+        id: `1`,
+        title: `Tracked`,
+      },
+    ])
+    adapter.rowMetadata.set(`1`, { source: `initial` })
+    const coordinator = createCoordinatorHarness()
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+    const loadSubsetCallsAfterPreload = adapter.loadSubsetCalls.length
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `tx-metadata-only`,
+      // The seeded row has no stream position; this is its first contiguous
+      // notification. A jump to version 2 would correctly require recovery.
+      latestRowVersion: 1,
+      requiresFullReload: false,
+      changedRows: [],
+      deletedKeys: [],
+      rowMetadataMutations: [
+        {
+          type: `set`,
+          key: `1`,
+          value: { source: `replayed` },
+        },
+      ],
+      collectionMetadataMutations: [
+        {
+          type: `set`,
+          key: `electric:resume`,
+          value: {
+            kind: `reset`,
+            updatedAt: 2,
+          },
+        },
+      ],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(adapter.loadSubsetCalls.length).toBe(loadSubsetCallsAfterPreload)
+    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
+      source: `replayed`,
+    })
+    expect(
+      collection._state.syncedCollectionMetadata.get(`electric:resume`),
+    ).toEqual({
+      kind: `reset`,
+      updatedAt: 2,
+    })
+  })
+
+  it(`uses pullSince replay deltas for metadata-bearing seq-gap recovery`, async () => {
+    const adapter = createRecordingAdapter([
+      {
+        id: `1`,
+        title: `Tracked`,
+      },
+    ])
+    adapter.rowMetadata.set(`1`, { source: `initial` })
+    const coordinator = createCoordinatorHarness()
+    coordinator.setPullSinceResponse({
+      type: `rpc:pullSince:res`,
+      rpcId: `pull-metadata`,
+      ok: true,
+      latestTerm: 1,
+      latestSeq: 3,
+      latestRowVersion: 3,
+      requiresFullReload: false,
+      changedKeys: [],
+      deletedKeys: [],
+      deltas: [
+        {
+          txId: `tx-gap-1`,
+          latestRowVersion: 2,
+          changedRows: [],
+          deletedKeys: [],
+          rowMetadataMutations: [
+            {
+              type: `set`,
+              key: `1`,
+              value: { source: `gap-replayed` },
+            },
+          ],
+          collectionMetadataMutations: [],
+        },
+        {
+          txId: `tx-gap-2`,
+          latestRowVersion: 3,
+          changedRows: [],
+          deletedKeys: [],
+          rowMetadataMutations: [],
+          collectionMetadataMutations: [
+            {
+              type: `set`,
+              key: `queryCollection:gc:q1`,
+              value: {
+                queryHash: `q1`,
+                mode: `until-revalidated`,
+              },
+            },
+          ],
+        },
+      ],
+    })
+
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+          },
+        },
+        persistence: {
+          adapter,
+          coordinator,
+        },
+      }),
+    )
+
+    await collection.preload()
+    await flushAsyncWork()
+    const loadSubsetCallsAfterPreload = adapter.loadSubsetCalls.length
+
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 3,
+      txId: `tx-gap-trigger`,
+      latestRowVersion: 3,
+      requiresFullReload: false,
+      changedRows: [],
+      deletedKeys: [],
+    })
+
+    await flushAsyncWork()
+    await flushAsyncWork()
+
+    expect(coordinator.pullSinceCalls).toBe(1)
+    expect(adapter.loadSubsetCalls.length).toBe(loadSubsetCallsAfterPreload)
+    expect(collection._state.syncedMetadata.get(`1`)).toEqual({
+      source: `gap-replayed`,
+    })
+    expect(
+      collection._state.syncedCollectionMetadata.get(`queryCollection:gc:q1`),
+    ).toEqual({
+      queryHash: `q1`,
+      mode: `until-revalidated`,
+    })
+  })
+
+  it(`throws InvalidSyncConfigError when sync key is present but null`, () => {
+    const invalidOptions = {
+      id: `invalid-sync-null`,
+      getKey: (item: Todo) => item.id,
+      sync: null,
+      persistence: {
+        adapter: createNoopAdapter(),
+      },
+    } as unknown as PersistedSyncWrappedOptions<Todo, string>
+
+    expect(() => persistedCollectionOptions(invalidOptions)).toThrow(
+      InvalidSyncConfigError,
+    )
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-subset.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-subset.test.ts
new file mode 100644
index 0000000000..5d89167586
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-subset.test.ts
@@ -0,0 +1,1147 @@
+/**
+ * Ordinary tests for persistedCollectionOptions single-process and remote subset wiring, transported subset validation, and coordinator configuration, as fixed scenarios. The subset demand and coordinator laws they touch are owned by persisted-oracle.test.ts, which keeps the generated retained-demand and follower cases.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { IR, createCollection } from '@tanstack/db'
+import {
+  InvalidPersistedCollectionCoordinatorError,
+  InvalidSyncConfigError,
+  SingleProcessCoordinator,
+  persistedCollectionOptions,
+  toTransportedLoadSubsetOptions,
+  validateRemoteSubsetOptions,
+} from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  createNoopAdapter,
+  createRecordingAdapter,
+  flushAsyncWork,
+  stripVirtualProps,
+} from './persisted-support'
+import type {
+  Collection,
+  LoadSubsetOptions,
+  Subscription,
+  SyncConfig,
+} from '@tanstack/db'
+import type {
+  PersistedCollectionCoordinator,
+  PersistedCollectionPersistence,
+  PersistedSyncWrappedOptions,
+  RemoteSubsetOwner,
+} from '../src'
+import type { Todo } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`throws InvalidSyncConfigError when sync key is present but invalid`, () => {
+    const invalidOptions = {
+      id: `invalid-sync-shape`,
+      getKey: (item: Todo) => item.id,
+      sync: {} as unknown as SyncConfig<Todo, string>,
+      persistence: {
+        adapter: createNoopAdapter(),
+      },
+    } as PersistedSyncWrappedOptions<Todo, string>
+
+    expect(() => persistedCollectionOptions(invalidOptions)).toThrow(
+      InvalidSyncConfigError,
+    )
+  })
+
+  it(`uses SingleProcessCoordinator when coordinator is omitted`, () => {
+    const options = persistedCollectionOptions<Todo, string>({
+      id: `default-coordinator`,
+      getKey: (item) => item.id,
+      persistence: {
+        adapter: createNoopAdapter(),
+      },
+    })
+
+    expect(options.persistence.coordinator).toBeInstanceOf(
+      SingleProcessCoordinator,
+    )
+  })
+
+  it(`coalesces duplicate single-process subset acknowledgements until owner work finishes`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-coalesced`)
+    let releaseLoad = (): void => {}
+    const loadGate = new Promise<void>((resolve) => {
+      releaseLoad = resolve
+    })
+    const owner = Object.assign(
+      vi.fn(() => loadGate),
+      { unloadSubset: vi.fn(), onError: vi.fn() },
+    )
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+    const options: LoadSubsetOptions = { limit: 1 }
+
+    try {
+      let firstSettled = false
+      let duplicateSettled = false
+      const first = coordinator
+        .requestEnsureRemoteSubset(`todos`, options)
+        .then(() => {
+          firstSettled = true
+        })
+      await Promise.resolve()
+      const duplicate = coordinator
+        .requestEnsureRemoteSubset(`todos`, options)
+        .then(() => {
+          duplicateSettled = true
+        })
+      await Promise.resolve()
+
+      expect({
+        ownerCalls: owner.mock.calls.length,
+        firstSettled,
+        duplicateSettled,
+      }).toEqual({
+        ownerCalls: 1,
+        firstSettled: false,
+        duplicateSettled: false,
+      })
+
+      releaseLoad()
+      await Promise.all([first, duplicate])
+    } finally {
+      releaseLoad()
+      unregisterOwner()
+    }
+  })
+
+  it(`preserves process-local subset lifecycle fields for owner load and unload`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-live-fields`)
+    const owner = Object.assign(vi.fn(), {
+      unloadSubset: vi.fn(),
+      onError: vi.fn(),
+    })
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+    const signal = new AbortController().signal
+    const subscription = {
+      on: () => () => {},
+    } as unknown as Subscription
+    const options: LoadSubsetOptions = { limit: 1, signal, subscription }
+
+    try {
+      await coordinator.requestEnsureRemoteSubset(`todos`, options)
+      expect(owner).toHaveBeenCalledTimes(1)
+      const delivered = owner.mock.calls[0]![0] as LoadSubsetOptions
+      expect(delivered).toMatchObject({ limit: 1 })
+      expect(delivered.signal).toBe(signal)
+      expect(delivered.subscription).toBe(subscription)
+
+      await coordinator.requestReleaseRemoteSubset(`todos`, options)
+      expect(owner.unloadSubset).toHaveBeenCalledTimes(1)
+      expect(owner.unloadSubset).toHaveBeenCalledWith(delivered)
+    } finally {
+      unregisterOwner()
+    }
+  })
+
+  it(`coalesces same-stack single-process subset reentry until owner work finishes`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-reentrant`)
+    let releaseLoad = (): void => {}
+    const loadGate = new Promise<void>((resolve) => {
+      releaseLoad = resolve
+    })
+    const options: LoadSubsetOptions = { limit: 1 }
+    let duplicate: Promise<void> | undefined
+    let didReenter = false
+    const owner = Object.assign(
+      vi.fn(() => {
+        if (!didReenter) {
+          didReenter = true
+          duplicate = coordinator.requestEnsureRemoteSubset(`todos`, options)
+        }
+        return loadGate
+      }),
+      { unloadSubset: vi.fn(), onError: vi.fn() },
+    )
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+
+    try {
+      let firstSettled = false
+      let duplicateSettled = false
+      const first = coordinator
+        .requestEnsureRemoteSubset(`todos`, options)
+        .then(() => {
+          firstSettled = true
+        })
+      await Promise.resolve()
+      const duplicateResult = duplicate!.then(() => {
+        duplicateSettled = true
+      })
+      await Promise.resolve()
+
+      expect({
+        ownerCalls: owner.mock.calls.length,
+        firstSettled,
+        duplicateSettled,
+      }).toEqual({
+        ownerCalls: 1,
+        firstSettled: false,
+        duplicateSettled: false,
+      })
+
+      releaseLoad()
+      await Promise.all([first, duplicateResult])
+    } finally {
+      releaseLoad()
+      unregisterOwner()
+    }
+  })
+
+  // Acquisition release gives the owner its cancellation opportunity before
+  // the source load settles. A load that needs unload to settle is legal;
+  // waiting for that load before calling unload deadlocks scoped recovery.
+  it(`unloads a pending single-process subset before waiting for its source load`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-release-order`)
+    let releaseLoad = (): void => {}
+    const loadGate = new Promise<void>((resolve) => {
+      releaseLoad = resolve
+    })
+    const events: Array<string> = []
+    const owner = Object.assign(
+      vi.fn(async () => {
+        events.push(`load-start`)
+        await loadGate
+        events.push(`load-finish`)
+      }),
+      {
+        unloadSubset: vi.fn(() => {
+          events.push(`unload`)
+        }),
+        onError: vi.fn(),
+      },
+    )
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+    const options: LoadSubsetOptions = { limit: 1 }
+
+    try {
+      const load = coordinator.requestEnsureRemoteSubset(`todos`, options)
+      await Promise.resolve()
+      let releaseSettled = false
+      const release = coordinator
+        .requestReleaseRemoteSubset(`todos`, options)
+        .then(() => {
+          releaseSettled = true
+        })
+      await atPersistedOracleCheckpoint(
+        release,
+        `release before source settlement`,
+      )
+
+      const beforeLoadRelease = { events: [...events], releaseSettled }
+      expect(beforeLoadRelease).toEqual({
+        events: [`load-start`, `unload`],
+        releaseSettled: true,
+      })
+
+      releaseLoad()
+      await Promise.all([load, release])
+      expect(events).toEqual([`load-start`, `unload`, `load-finish`])
+    } finally {
+      releaseLoad()
+      unregisterOwner()
+    }
+  })
+
+  it(`rejects unsupported single-process subset values before owner work`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-wire-domain`)
+    const owner = Object.assign(vi.fn(), {
+      unloadSubset: vi.fn(),
+      onError: vi.fn(),
+    })
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+
+    try {
+      await expect(
+        coordinator.requestEnsureRemoteSubset(`todos`, {
+          where: new IR.Func(`in`, [
+            new IR.PropRef([`todos`, `status`]),
+            new IR.Value([`kept`, () => {}]),
+          ]),
+        }),
+      ).rejects.toMatchObject({
+        name: `RemoteSubsetWireValueError`,
+        path: `options.where.args[1].value[1]`,
+      })
+      expect(owner).not.toHaveBeenCalled()
+    } finally {
+      unregisterOwner()
+    }
+  })
+
+  it(`rejects a sparse function argument at its exact expression path`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-wire-hole`)
+    const owner = Object.assign(vi.fn(), {
+      unloadSubset: vi.fn(),
+      onError: vi.fn(),
+    })
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+    const args = [new IR.PropRef([`todos`, `status`])]
+    args.length = 2
+
+    try {
+      await expect(
+        coordinator.requestEnsureRemoteSubset(`todos`, {
+          where: new IR.Func(`eq`, args),
+        }),
+      ).rejects.toMatchObject({
+        name: `RemoteSubsetWireValueError`,
+        path: `options.where.args[1]`,
+      })
+      expect(owner).not.toHaveBeenCalled()
+    } finally {
+      unregisterOwner()
+    }
+  })
+
+  it(`preserves an explicit source alias through remote subset projection`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-wire-alias`)
+    const owner = Object.assign(vi.fn(), {
+      unloadSubset: vi.fn(),
+      onError: vi.fn(),
+    })
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+    const options: LoadSubsetOptions = {
+      where: new IR.Func(`eq`, [
+        new IR.PropRef([`todos`, `status`], `todos`),
+        new IR.Value(`kept`),
+      ]),
+    }
+
+    try {
+      await coordinator.requestEnsureRemoteSubset(`todos`, options)
+      expect(owner).toHaveBeenCalledWith({
+        where: {
+          type: `func`,
+          name: `eq`,
+          args: [
+            { type: `ref`, path: [`todos`, `status`], sourceAlias: `todos` },
+            { type: `val`, value: `kept` },
+          ],
+        },
+      })
+    } finally {
+      await coordinator.requestReleaseRemoteSubset(`todos`, options)
+      unregisterOwner()
+    }
+  })
+
+  it(`rejects a remote subset source alias that disagrees with its path`, () => {
+    expect(() =>
+      toTransportedLoadSubsetOptions({
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`todos`, `status`], `other`),
+          new IR.Value(`kept`),
+        ]),
+      }),
+    ).toThrowError(/options\.where\.args\[0\]\.sourceAlias/)
+  })
+
+  // A projection is a detached snapshot at one call boundary. A later call on
+  // reused input must observe its current data, without changing the first
+  // snapshot. This distinguishes safe per-call reuse from a global identity cache.
+  it(`takes a fresh detached wire snapshot on each projection`, () => {
+    const literal = new IR.Value({ label: `before` })
+    const options = {
+      where: new IR.Func(`eq`, [new IR.PropRef([`value`]), literal]),
+    }
+    const first = toTransportedLoadSubsetOptions(options)
+    literal.value.label = `after`
+    const second = toTransportedLoadSubsetOptions(options)
+    expect(first.where).toMatchObject({
+      args: [{}, { value: { label: `before` } }],
+    })
+    expect(second.where).toMatchObject({
+      args: [{}, { value: { label: `after` } }],
+    })
+    expect(first).not.toBe(second)
+  })
+
+  // Read-only admission is a law about caller state, including builtin internal
+  // slots that Object.freeze cannot protect. Capture expectations before either
+  // traversal, and retain them when a later invalid field rejects the request.
+  // Fresh snapshots must preserve internal aliases but share no mutable payload
+  // with the caller or a later projection. These are two call-boundary histories,
+  // not a reference implementation of the encoder.
+  it.each([false, true])(
+    `preserves caller state and detached snapshots / rejected suffix %s`,
+    (rejectedSuffix) => {
+      const date = new Date(`2026-09-16T12:34:56.123Z`)
+      const buffer = new Uint8Array([7, 8]).buffer
+      const shared = { label: `before` }
+      const payload = {
+        date,
+        buffer,
+        view: new Uint8Array(buffer),
+        map: new Map([[shared, date]]),
+        set: new Set([shared]),
+        first: shared,
+        second: shared,
+      }
+      // Compare values and aliases explicitly. In jsdom, structuredClone can
+      // return a buffer from another realm, which Vitest's object comparison
+      // does not equate with this realm's otherwise identical ArrayBuffer.
+      // These observations preserve contents, order, multiplicity and identity
+      // relationships without requiring cross-realm object equality.
+      const observe = (value: typeof payload) => ({
+        keys: Reflect.ownKeys(value),
+        recordKeys: [
+          Reflect.ownKeys(value.first),
+          Reflect.ownKeys(value.second),
+        ],
+        date: value.date.getTime(),
+        bytes: Array.from(new Uint8Array(value.buffer)),
+        view: Array.from(value.view),
+        map: [...value.map].map(([key, entry]) => ({
+          label: key.label,
+          date: entry.getTime(),
+          keyIsFirst: key === value.first,
+          valueIsDate: entry === value.date,
+        })),
+        set: [...value.set].map((entry) => ({
+          label: entry.label,
+          isFirst: entry === value.first,
+        })),
+        first: value.first.label,
+        second: value.second.label,
+        sharedRecord: value.first === value.second,
+        sharedBuffer: value.view.buffer === value.buffer,
+      })
+      const before = {
+        keys: [`date`, `buffer`, `view`, `map`, `set`, `first`, `second`],
+        recordKeys: [[`label`], [`label`]],
+        date: Date.UTC(2026, 8, 16, 12, 34, 56, 123),
+        bytes: [7, 8],
+        view: [7, 8],
+        map: [
+          {
+            label: `before`,
+            date: Date.UTC(2026, 8, 16, 12, 34, 56, 123),
+            keyIsFirst: true,
+            valueIsDate: true,
+          },
+        ],
+        set: [{ label: `before`, isFirst: true }],
+        first: `before`,
+        second: `before`,
+        sharedRecord: true,
+        sharedBuffer: true,
+      }
+      // Calibrate the fixture before entering either production traversal.
+      expect(observe(payload)).toEqual(before)
+      const options = {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`payload`]),
+          new IR.Value(payload),
+        ]),
+        ...(rejectedSuffix ? { limit: -1 } : {}),
+      }
+      if (rejectedSuffix) {
+        for (const visit of [
+          validateRemoteSubsetOptions,
+          toTransportedLoadSubsetOptions,
+        ]) {
+          expect(() => visit(options)).toThrowError(
+            expect.objectContaining({
+              name: `RemoteSubsetWireValueError`,
+              path: `options.limit`,
+            }),
+          )
+          expect(observe(payload)).toEqual(before)
+        }
+        return
+      }
+      expect(validateRemoteSubsetOptions(options)).toBeUndefined()
+      expect(observe(payload)).toEqual(before)
+      const first = toTransportedLoadSubsetOptions(options)
+      expect(observe(payload)).toEqual(before)
+      date.setTime(1)
+      new Uint8Array(buffer)[0] = 9
+      shared.label = `after`
+      payload.map.clear()
+      payload.set.clear()
+      const after = {
+        ...before,
+        date: 1,
+        bytes: [9, 8],
+        view: [9, 8],
+        map: [],
+        set: [],
+        first: `after`,
+        second: `after`,
+      }
+      expect(observe(payload)).toEqual(after)
+      expect(validateRemoteSubsetOptions(options)).toBeUndefined()
+      expect(observe(payload)).toEqual(after)
+      const second = toTransportedLoadSubsetOptions(options)
+      expect(observe(payload)).toEqual(after)
+      for (const [snapshot, expected] of [
+        [first, before],
+        [second, after],
+      ] as const) {
+        if (snapshot.where?.type !== `func`)
+          throw new Error(`missing predicate`)
+        const literal = snapshot.where.args[1]
+        if (literal?.type !== `val`) throw new Error(`missing literal`)
+        const value = literal.value as typeof payload
+        expect(observe(value)).toEqual(expected)
+        expect(value.first).toBe(value.second)
+        expect(value.view.buffer).toBe(value.buffer)
+        for (const key of Object.keys(payload) as Array<keyof typeof payload>)
+          expect(value[key]).not.toBe(payload[key])
+      }
+    },
+  )
+
+  // Both modes enforce the complete request schema. Validation must only read
+  // the caller's frozen graph; projection still returns detached request data.
+  it.each([`lexical`, `locale`] as const)(
+    `validates frozen request fields without projecting or rewriting them / %s`,
+    (stringSort) => {
+      const reference = new IR.PropRef([`todos`, `title`], `todos`)
+      const literal = new IR.Value({ label: `unchanged` })
+      const where = new IR.Func(`eq`, [reference, literal])
+      const compareOptions = {
+        direction: `asc` as const,
+        nulls: `last` as const,
+        stringSort,
+        locale: `en`,
+        localeOptions: { sensitivity: `base` as const },
+      }
+      const clause = { expression: reference, compareOptions }
+      const options = {
+        where,
+        orderBy: [clause, clause],
+        cursor: { whereFrom: where, whereCurrent: where, lastKey: `last` },
+        limit: 0,
+        offset: Number.MAX_SAFE_INTEGER,
+        signal: new AbortController().signal,
+      }
+      for (const value of [
+        options,
+        where,
+        where.args,
+        reference,
+        reference.path,
+        literal,
+        literal.value,
+        options.orderBy,
+        clause,
+        compareOptions,
+        compareOptions.localeOptions,
+        options.cursor,
+      ])
+        Object.freeze(value)
+      expect(validateRemoteSubsetOptions(options)).toBeUndefined()
+      const result = toTransportedLoadSubsetOptions(options)
+      expect(result).toMatchObject({
+        limit: 0,
+        offset: Number.MAX_SAFE_INTEGER,
+      })
+      expect(result.where).not.toBe(where)
+      expect(result.cursor?.whereFrom).toBe(result.where)
+      expect(result.cursor?.whereCurrent).toBe(result.where)
+      expect(result.orderBy?.[0]).toBe(result.orderBy?.[1])
+      expect(result.orderBy?.[0]?.compareOptions).toEqual(
+        stringSort === `lexical`
+          ? { direction: `asc`, nulls: `last`, stringSort }
+          : compareOptions,
+      )
+      expect(options.cursor.whereFrom).toBe(where)
+      expect(options.orderBy[0]).toBe(clause)
+    },
+  )
+
+  it(`projects lexical comparison options without locale-only wire fields`, () => {
+    const projected = toTransportedLoadSubsetOptions({
+      orderBy: [
+        {
+          expression: new IR.PropRef([`todos`, `title`]),
+          compareOptions: {
+            direction: `asc`,
+            nulls: `last`,
+            stringSort: `lexical`,
+            locale: `en`,
+            localeOptions: { sensitivity: `base` },
+          },
+        },
+      ],
+    } as unknown as LoadSubsetOptions)
+
+    expect(projected.orderBy?.[0]?.compareOptions).toEqual({
+      direction: `asc`,
+      nulls: `last`,
+      stringSort: `lexical`,
+    })
+  })
+
+  it(`preserves locale comparison fields when the optional sort mode is omitted`, () => {
+    const projected = toTransportedLoadSubsetOptions({
+      orderBy: [
+        {
+          expression: new IR.PropRef([`todos`, `title`]),
+          compareOptions: {
+            direction: `asc`,
+            nulls: `last`,
+            locale: `en`,
+            localeOptions: { sensitivity: `base` },
+          },
+        },
+      ],
+    } as LoadSubsetOptions)
+
+    expect(projected.orderBy?.[0]?.compareOptions).toEqual({
+      direction: `asc`,
+      nulls: `last`,
+      locale: `en`,
+      localeOptions: { sensitivity: `base` },
+    })
+  })
+
+  it.each([
+    [`limit`, { limit: Number.NaN }, `options.limit`],
+    [`limit`, { limit: Number.POSITIVE_INFINITY }, `options.limit`],
+    [`limit`, { limit: -1 }, `options.limit`],
+    [`limit`, { limit: 0.5 }, `options.limit`],
+    [`limit`, { limit: Number.MAX_SAFE_INTEGER + 1 }, `options.limit`],
+    [`offset`, { offset: Number.NaN }, `options.offset`],
+    [`offset`, { offset: Number.NEGATIVE_INFINITY }, `options.offset`],
+    [`offset`, { offset: -1 }, `options.offset`],
+    [`offset`, { offset: 0.5 }, `options.offset`],
+    [`offset`, { offset: Number.MAX_SAFE_INTEGER + 1 }, `options.offset`],
+  ] as const)(
+    `rejects an invalid transported subset %s before owner work`,
+    (_field, options, path) => {
+      let error: unknown
+      try {
+        toTransportedLoadSubsetOptions(options)
+      } catch (caught) {
+        error = caught
+      }
+      expect(error).toMatchObject({
+        name: `RemoteSubsetWireValueError`,
+        path,
+      })
+    },
+  )
+
+  it(`preserves valid transported subset window boundaries`, () => {
+    expect(
+      toTransportedLoadSubsetOptions({
+        limit: 0,
+        offset: Number.MAX_SAFE_INTEGER,
+      }),
+    ).toEqual({ limit: 0, offset: Number.MAX_SAFE_INTEGER })
+  })
+
+  it(`transports an explicit source refetch without changing subset data`, () => {
+    expect(toTransportedLoadSubsetOptions({ limit: 1, refetch: true })).toEqual(
+      {
+        limit: 1,
+        refetch: true,
+      },
+    )
+    expect(() =>
+      toTransportedLoadSubsetOptions({ refetch: `true` } as never),
+    ).toThrow(`options.refetch`)
+  })
+
+  it(`reports and rethrows a single-process owner unload rejection`, async () => {
+    const coordinator = new SingleProcessCoordinator(`single-unload-error`)
+    const unloadError = new Error(`single-process owner unload failed`)
+    const ownerErrors: Array<unknown> = []
+    const owner = Object.assign(vi.fn(), {
+      unloadSubset: vi.fn(() =>
+        Promise.reject(unloadError),
+      ) as unknown as RemoteSubsetOwner[`unloadSubset`],
+      onError: (error: unknown) => ownerErrors.push(error),
+    })
+    const unregisterOwner = coordinator.registerRemoteSubsetOwner(
+      `todos`,
+      owner,
+    )
+    const options: LoadSubsetOptions = { limit: 1 }
+
+    try {
+      await coordinator.requestEnsureRemoteSubset(`todos`, options)
+      await expect(
+        coordinator.requestReleaseRemoteSubset(`todos`, options),
+      ).rejects.toBe(unloadError)
+      expect(ownerErrors).toEqual([unloadError])
+    } finally {
+      unregisterOwner()
+    }
+  })
+
+  // An adapter's unloadSubset that rejects broke its contract. Core reports a
+  // throwing unloadSubset uncaught and fails no load, replay, or caller
+  // (subscription.ts, releaseAcquisition); the wrapper forwards the call as
+  // core makes it, so a rejection surfaces uncaught once and changes neither
+  // the status nor the node, whether or not the sync adapter gave up first.
+  // The supplemental witness for the persisted sync-run oracle's
+  // `unload-reject` site.
+  it.each([false, true])(
+    `reports a single-process async unload rejection uncaught without changing the Collection (sync adapter gave up first: %s)`,
+    async (gaveUpFirst) => {
+      const unloadError = new Error(`remote owner unload failed`)
+      const gaveUp = new Error(`sync adapter gave up`)
+      let giveUp: ((error: unknown) => void) | undefined
+      let unloadThenCalls = 0
+      const rejectingThenable = {
+        then: (
+          _resolve: (value?: void) => void,
+          reject: (error: unknown) => void,
+        ) => {
+          unloadThenCalls++
+          queueMicrotask(() => reject(unloadError))
+        },
+      }
+      const sourceUnloadMock = vi.fn((options: LoadSubsetOptions) =>
+        options.limit === 1 ? rejectingThenable : undefined,
+      )
+      const sourceUnload = sourceUnloadMock as unknown as (
+        options: LoadSubsetOptions,
+      ) => void
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `owner-unload-error`,
+          getKey: (todo) => todo.id,
+          syncMode: `on-demand`,
+          sync: {
+            sync: ({ markReady, fail }) => {
+              markReady()
+              giveUp = fail
+              return {
+                loadSubset: () => true,
+                unloadSubset: sourceUnload,
+              }
+            },
+          },
+          persistence: {
+            adapter: createRecordingAdapter(),
+          },
+        }),
+      )
+      const failing: LoadSubsetOptions = { limit: 1 }
+      const sibling: LoadSubsetOptions = { limit: 2 }
+      const crash = vi.spyOn(collection._lifecycle, `crash`)
+      const unhandled: Array<unknown> = []
+      const captureUnhandled = (error: unknown) => unhandled.push(error)
+      process.on(`unhandledRejection`, captureUnhandled)
+      const uncaught: Array<unknown> = []
+      const queue = globalThis.queueMicrotask.bind(globalThis)
+      const microtasks = vi
+        .spyOn(globalThis, `queueMicrotask`)
+        .mockImplementation((task) =>
+          queue(() => {
+            try {
+              task()
+            } catch (error) {
+              uncaught.push(error)
+            }
+          }),
+        )
+
+      try {
+        collection.startSyncImmediate()
+        await collection._sync.loadSubset(failing)
+        await collection._sync.loadSubset(sibling)
+        if (gaveUpFirst) {
+          giveUp!(gaveUp)
+          await flushAsyncWork()
+          expect(collection.status).toBe(`ready`)
+          expect(collection.health.error?.cause).toBe(gaveUp)
+        }
+        collection._sync.unloadSubset(failing)
+        collection._sync.unloadSubset(sibling)
+        await flushAsyncWork()
+        await flushAsyncWork()
+
+        expect({
+          status: collection.status,
+          error: collection.health.error?.cause,
+          failureReason: collection.health.failureReason,
+          unloadThenCalls,
+          unloadOptions: sourceUnloadMock.mock.calls.map(
+            ([options]) => options,
+          ),
+          lifecycleErrors: crash.mock.calls.map(([error]) => error),
+          uncaught,
+          unhandled,
+        }).toEqual({
+          status: `ready`,
+          error: gaveUpFirst ? gaveUp : undefined,
+          failureReason: null,
+          unloadThenCalls: 1,
+          unloadOptions: [failing, sibling],
+          lifecycleErrors: [],
+          uncaught: [unloadError],
+          unhandled: [],
+        })
+
+        await flushAsyncWork()
+        expect(sourceUnloadMock).toHaveBeenCalledTimes(2)
+        expect(crash).not.toHaveBeenCalled()
+      } finally {
+        microtasks.mockRestore()
+        process.off(`unhandledRejection`, captureUnhandled)
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`surfaces duplicate remote-subset owner registration through the collection lifecycle`, async () => {
+    const coordinator = new SingleProcessCoordinator()
+    const unhandled: Array<unknown> = []
+    const sourceLoads: Array<string> = []
+    const onUnhandled = (error: unknown) => unhandled.push(error)
+    process.on(`unhandledRejection`, onUnhandled)
+    const create = (label: string) =>
+      createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `duplicate-owner-lifecycle`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {
+                loadSubset: () => {
+                  sourceLoads.push(label)
+                  return true
+                },
+                unloadSubset: () => {},
+              }
+            },
+          },
+          persistence: { adapter: createRecordingAdapter(), coordinator },
+        }),
+      )
+    const first = create(`first`)
+    let duplicate: ReturnType<typeof create> | undefined
+
+    try {
+      first.startSyncImmediate()
+      await first.stateWhenReady()
+      await vi.waitFor(() =>
+        expect(
+          (
+            coordinator as unknown as {
+              remoteSubsetOwners: Map<string, RemoteSubsetOwner>
+            }
+          ).remoteSubsetOwners.size,
+        ).toBe(1),
+      )
+      duplicate = create(`duplicate`)
+      duplicate.startSyncImmediate()
+      const readinessError = await duplicate.stateWhenReady().then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+      await flushAsyncWork()
+
+      expect(readinessError).toMatchObject({
+        name: `DuplicateRemoteSubsetOwnerError`,
+        collectionId: `duplicate-owner-lifecycle`,
+      })
+      expect(duplicate.status).toBe(`error`)
+      expect(sourceLoads).toEqual([])
+      expect(unhandled).toEqual([])
+    } finally {
+      process.off(`unhandledRejection`, onUnhandled)
+      await duplicate?.cleanup()
+      await first.cleanup()
+    }
+  })
+
+  it(`resolves persistence per collection and forwards schemaVersion`, () => {
+    const baseAdapter = createNoopAdapter()
+    const syncAdapter = createNoopAdapter()
+    const localAdapter = createNoopAdapter()
+    const resolverCalls: Array<{
+      collectionId: string
+      mode: `sync-present` | `sync-absent`
+      schemaVersion?: number
+    }> = []
+
+    const persistence: PersistedCollectionPersistence = {
+      adapter: baseAdapter,
+      resolvePersistenceForCollection: (options) => {
+        resolverCalls.push(options)
+        return {
+          adapter: options.mode === `sync-present` ? syncAdapter : localAdapter,
+        }
+      },
+    }
+
+    const syncOptions = persistedCollectionOptions<Todo, string>({
+      id: `sync-collection`,
+      getKey: (item) => item.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+        },
+      },
+      schemaVersion: 7,
+      persistence,
+    })
+    expect(syncOptions.persistence.adapter).toBe(syncAdapter)
+
+    const localOptions = persistedCollectionOptions<Todo, string>({
+      id: `local-collection`,
+      getKey: (item) => item.id,
+      schemaVersion: 3,
+      persistence,
+    })
+    expect(localOptions.persistence.adapter).toBe(localAdapter)
+
+    expect(resolverCalls).toEqual([
+      {
+        collectionId: `sync-collection`,
+        mode: `sync-present`,
+        schemaVersion: 7,
+      },
+      {
+        collectionId: `local-collection`,
+        mode: `sync-absent`,
+        schemaVersion: 3,
+      },
+    ])
+  })
+
+  it(`throws for invalid coordinator implementations`, () => {
+    const invalidCoordinator = {
+      getNodeId: () => `node-1`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => true,
+      ensureLeadership: async () => {},
+      // requestEnsurePersistedIndex is intentionally missing
+    } as unknown as PersistedCollectionCoordinator
+
+    expect(() =>
+      persistedCollectionOptions<Todo, string>({
+        id: `invalid-coordinator`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter: createNoopAdapter(),
+          coordinator: invalidCoordinator,
+        },
+      }),
+    ).toThrow(InvalidPersistedCollectionCoordinatorError)
+  })
+
+  // Every coordinator method the runtime calls is part of the contract, so a
+  // coordinator missing any one of them fails at configuration, naming it,
+  // rather than later inside message dispatch.
+  it.each([
+    `getNodeId`,
+    `subscribe`,
+    `publish`,
+    `isLeader`,
+    `ensureLeadership`,
+    `requestEnsureRemoteSubset`,
+    `requestReleaseRemoteSubset`,
+    `registerRemoteSubsetOwner`,
+    `requestEnsurePersistedIndex`,
+    `requestApplyCommittedTx`,
+  ] as const)(`rejects a coordinator without %s`, (method) => {
+    const complete: Record<string, unknown> = {
+      getNodeId: () => `node-1`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => true,
+      ensureLeadership: async () => {},
+      requestEnsureRemoteSubset: async () => {},
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestApplyCommittedTx: async () => ({ term: 1, seq: 1 }),
+    }
+    delete complete[method]
+
+    expect(() =>
+      persistedCollectionOptions<Todo, string>({
+        id: `coordinator-without-${method}`,
+        getKey: (item) => item.id,
+        persistence: {
+          adapter: createNoopAdapter(),
+          coordinator: complete as unknown as PersistedCollectionCoordinator,
+        },
+      }),
+    ).toThrow(
+      `Invalid persisted collection coordinator: missing required "${method}" method`,
+    )
+  })
+
+  it(`rejects an incomplete coordinator before starting a rich sync source`, async () => {
+    type SourceParams = Parameters<SyncConfig<Todo, string>[`sync`]>[0]
+
+    const adapter = createRecordingAdapter()
+    const applyCommittedTx = adapter.applyCommittedTx
+    let adapterApplies = 0
+    adapter.applyCommittedTx = (...args) => {
+      adapterApplies++
+      return applyCommittedTx(...args)
+    }
+    let sourceCalls = 0
+    let legacyCalls = 0
+    let sourceParams: SourceParams | undefined
+    let collectionConstructed = false
+    let visible = false
+    let configurationError: { name: string; message: string } | null = null
+    let collection: Collection<Todo, string> | undefined
+
+    const incompleteCoordinator = {
+      getNodeId: () => `incomplete-rich-sync`,
+      subscribe: () => () => {},
+      publish: () => {},
+      isLeader: () => false,
+      ensureLeadership: () => Promise.resolve(),
+      requestEnsurePersistedIndex: () => Promise.resolve(),
+      // Remote subset routing is complete so this fixture isolates the
+      // required committed-transaction method named by the assertion.
+      requestEnsureRemoteSubset: () => Promise.resolve(),
+      requestReleaseRemoteSubset: () => Promise.resolve(),
+      registerRemoteSubsetOwner: () => () => {},
+      requestApplyLocalMutations: () => {
+        legacyCalls++
+        return Promise.resolve({
+          type: `rpc:applyLocalMutations:res` as const,
+          rpcId: `legacy`,
+          ok: true as const,
+          term: 1,
+          seq: 1,
+          latestRowVersion: 1,
+          acceptedMutationIds: [],
+        })
+      },
+    } as unknown as PersistedCollectionCoordinator
+
+    try {
+      try {
+        const options = persistedCollectionOptions<Todo, string>({
+          id: `incomplete-rich-sync`,
+          getKey: (todo) => todo.id,
+          sync: {
+            sync: (params) => {
+              sourceCalls++
+              sourceParams = params
+              params.markReady()
+            },
+          },
+          persistence: { adapter, coordinator: incompleteCoordinator },
+        })
+        collection = createCollection(options)
+        collectionConstructed = true
+      } catch (error) {
+        const resolvedError =
+          error instanceof Error ? error : new Error(String(error))
+        configurationError = {
+          name: resolvedError.name,
+          message: resolvedError.message,
+        }
+      }
+
+      if (collection) {
+        collection.startSyncImmediate()
+        await vi.waitFor(() => expect(sourceParams).toBeDefined())
+        sourceParams!.begin()
+        sourceParams!.metadata?.collection.set(`resume`, { offset: 7 })
+        sourceParams!.truncate()
+        sourceParams!.write({
+          type: `insert`,
+          value: { id: `rich`, title: `Visible before rejection` },
+          metadata: { source: `remote` },
+        })
+        await Promise.resolve(sourceParams!.commit()).catch(() => undefined)
+        visible = collection.has(`rich`)
+      }
+    } finally {
+      await collection?.cleanup()
+    }
+
+    expect({
+      configurationError,
+      sourceCalls,
+      collectionConstructed,
+      visible,
+      adapterApplies,
+      legacyCalls,
+    }).toEqual({
+      configurationError: {
+        name: `InvalidPersistedCollectionCoordinatorError`,
+        message:
+          'Invalid persisted collection coordinator: missing required "requestApplyCommittedTx" method',
+      },
+      sourceCalls: 0,
+      collectionConstructed: false,
+      visible: false,
+      adapterApplies: 0,
+      legacyCalls: 0,
+    })
+  })
+
+  it(`preserves valid sync config in sync-present mode`, async () => {
+    const adapter = createRecordingAdapter()
+    const sync: SyncConfig<Todo, string> = {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({
+          type: `insert`,
+          value: {
+            id: `remote-1`,
+            title: `From remote`,
+          },
+        })
+        commit()
+        markReady()
+      },
+    }
+
+    const options = persistedCollectionOptions<Todo, string>({
+      id: `sync-present`,
+      getKey: (item: Todo) => item.id,
+      sync,
+      persistence: {
+        adapter,
+      },
+    })
+
+    const collection = createCollection(options)
+    await collection.stateWhenReady()
+    await flushAsyncWork()
+
+    expect(stripVirtualProps(collection.get(`remote-1`))).toEqual({
+      id: `remote-1`,
+      title: `From remote`,
+    })
+    expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+    expect(adapter.applyCommittedTxCalls[0]?.tx.mutations[0]?.type).toBe(
+      `update`,
+    )
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-support.ts b/packages/db-sqlite-persistence-core/tests/persisted-support.ts
new file mode 100644
index 0000000000..e3ed2e64de
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted-support.ts
@@ -0,0 +1,1622 @@
+import { describe, expect, it, vi } from 'vitest'
+import { fc } from '@fast-check/vitest'
+import { IR, createCollection } from '@tanstack/db'
+import {
+  PersistedCollectionDurabilityError,
+  SingleProcessCoordinator,
+  persistedCollectionOptions,
+} from '../src'
+import { oracleReplayTest } from '../../db/tests/oracle-config.js'
+import { cleanupTestActions } from './test-cleanup'
+import type { LoadSubsetOptions, SyncConfig } from '@tanstack/db'
+import type {
+  CollectionReset,
+  PersistedCollectionCoordinator,
+  PersistedStorageTarget,
+  PersistenceAdapter,
+  ProtocolEnvelope,
+  PullSinceResponse,
+  TxCommitted,
+} from '../src'
+
+export async function atPersistedOracleCheckpoint<T>(
+  promise: Promise<T>,
+  label: string,
+  timeout = 1000,
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () =>
+            reject(
+              new Error(`Persisted oracle checkpoint timed out: ${label}`),
+            ),
+          timeout,
+        )
+      }),
+    ])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+export async function cleanupPersistedOracle(
+  actions: Array<() => void | Promise<unknown>>,
+  hasPrimaryFailure: boolean,
+): Promise<void> {
+  await cleanupTestActions(
+    actions,
+    hasPrimaryFailure,
+    `Persisted oracle`,
+    (action, index) =>
+      atPersistedOracleCheckpoint(
+        Promise.resolve().then(action),
+        `cleanup stage ${index}`,
+        250,
+      ),
+  )
+}
+
+export type Todo = {
+  id: string
+  title: string
+  detail?: string
+  payload?: { rank: number }
+  values?: Array<string | null>
+}
+
+export type TodoSyncParams = Parameters<SyncConfig<Todo, string>[`sync`]>[0]
+
+export function expectExactSnapshot(
+  actual: ReadonlyMap<string, Todo>,
+  expected: ReadonlyMap<string, Todo>,
+): void {
+  expect(Array.from(actual.keys()).sort()).toEqual(
+    Array.from(expected.keys()).sort(),
+  )
+  for (const [key, row] of expected) expect(actual.get(key)).toStrictEqual(row)
+}
+
+export type RecordingAdapter = PersistenceAdapter & {
+  applyCommittedTxCalls: Array<{
+    collectionId: string
+    tx: {
+      term: number
+      seq: number
+      rowVersion: number
+      truncate?: boolean
+      mutations: Array<{
+        type: `insert` | `update` | `delete`
+        key: string | number
+      }>
+    }
+  }>
+  ensureIndexCalls: Array<{ collectionId: string; signature: string }>
+  markIndexRemovedCalls: Array<{ collectionId: string; signature: string }>
+  loadSubsetCalls: Array<{
+    collectionId: string
+    options: LoadSubsetOptions
+    requiredIndexSignatures: ReadonlyArray<string>
+  }>
+  loadCollectionMetadataCalls: Array<string>
+  loadResumeSnapshotCalls: Array<{
+    collectionId: string
+    includeRows: boolean | undefined
+    requiredIndexSignatures: ReadonlyArray<string>
+  }>
+  rows: Map<string, Todo>
+  rowMetadata: Map<string, unknown>
+  collectionMetadata: Map<string, unknown>
+}
+
+// This fixture records the addressed storage name; it does not decide whether
+// the target's managed claim is valid. The SQLite owner judges that boundary.
+export function recordedStorageId(target: PersistedStorageTarget): string {
+  return target.kind === `eager`
+    ? target.collectionId
+    : target.storageCollectionId
+}
+
+export function createRecordingAdapter(
+  initialRows: Array<Todo> = [],
+): RecordingAdapter {
+  const rows = new Map(initialRows.map((row) => [row.id, row]))
+  const rowMetadata = new Map<string, unknown>()
+
+  const adapter: RecordingAdapter = {
+    rows,
+    rowMetadata,
+    collectionMetadata: new Map(),
+    applyCommittedTxCalls: [],
+    ensureIndexCalls: [],
+    markIndexRemovedCalls: [],
+    loadSubsetCalls: [],
+    loadCollectionMetadataCalls: [],
+    loadResumeSnapshotCalls: [],
+    loadSubset: (collectionId, options, ctx) => {
+      adapter.loadSubsetCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        options,
+        requiredIndexSignatures: ctx?.requiredIndexSignatures ?? [],
+      })
+      return Promise.resolve(
+        Array.from(rows.values()).map((value) => ({
+          key: value.id,
+          value,
+          metadata: rowMetadata.get(value.id),
+        })),
+      )
+    },
+    loadResumeSnapshot: (collectionId, options) => {
+      adapter.loadResumeSnapshotCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        includeRows: options?.includeRows,
+        requiredIndexSignatures: options?.requiredIndexSignatures ?? [],
+      })
+      const latest = adapter.applyCommittedTxCalls.at(-1)?.tx
+      return Promise.resolve({
+        rows:
+          options?.includeRows === false
+            ? []
+            : Array.from(rows.values()).map((value) => ({
+                key: value.id,
+                value,
+                metadata: rowMetadata.get(value.id),
+              })),
+        keySet: { status: `consistent` },
+        collectionMetadata: Array.from(
+          adapter.collectionMetadata,
+          ([key, value]) => ({ key, value }),
+        ),
+        latestTerm: latest?.term ?? 0,
+        latestSeq: latest?.seq ?? 0,
+        latestRowVersion: latest?.rowVersion ?? 0,
+        resetEpoch: 0,
+      })
+    },
+    loadCollectionMetadata: (collectionId) => {
+      adapter.loadCollectionMetadataCalls.push(recordedStorageId(collectionId))
+      return Promise.resolve(
+        Array.from(adapter.collectionMetadata.entries()).map(
+          ([key, value]) => ({
+            key,
+            value,
+          }),
+        ),
+      )
+    },
+    scanRows: () =>
+      Promise.resolve(
+        Array.from(rows.values()).map((value) => ({
+          key: value.id,
+          value,
+          metadata: rowMetadata.get(value.id),
+        })),
+      ),
+    applyCommittedTx: (collectionId, tx) => {
+      adapter.applyCommittedTxCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        tx: {
+          term: tx.term,
+          seq: tx.seq,
+          rowVersion: tx.rowVersion,
+          truncate: tx.truncate,
+          mutations: tx.mutations.map((mutation) => ({
+            type: mutation.type,
+            key: mutation.key,
+          })),
+        },
+      })
+
+      if (tx.truncate) {
+        rows.clear()
+        rowMetadata.clear()
+      }
+
+      for (const mutation of tx.mutations) {
+        if (mutation.type === `delete`) {
+          rows.delete(mutation.key as string)
+          rowMetadata.delete(mutation.key as string)
+        } else if (mutation.type === `update`) {
+          rows.set(mutation.key as string, {
+            ...rows.get(mutation.key as string),
+            ...(mutation.value as Todo),
+          })
+          if (mutation.metadataChanged) {
+            rowMetadata.set(mutation.key as string, mutation.metadata)
+          }
+        } else {
+          rows.set(mutation.key as string, mutation.value as Todo)
+          if (mutation.metadataChanged) {
+            rowMetadata.set(mutation.key as string, mutation.metadata)
+          }
+        }
+      }
+      for (const rowMetadataMutation of tx.rowMetadataMutations ?? []) {
+        if (rowMetadataMutation.type === `delete`) {
+          rowMetadata.delete(rowMetadataMutation.key as string)
+        } else {
+          rowMetadata.set(
+            rowMetadataMutation.key as string,
+            rowMetadataMutation.value,
+          )
+        }
+      }
+      for (const metadataMutation of tx.collectionMetadataMutations ?? []) {
+        if (metadataMutation.type === `delete`) {
+          adapter.collectionMetadata.delete(metadataMutation.key)
+        } else {
+          adapter.collectionMetadata.set(
+            metadataMutation.key,
+            metadataMutation.value,
+          )
+        }
+      }
+      return Promise.resolve()
+    },
+    ensureIndex: (collectionId, signature) => {
+      adapter.ensureIndexCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        signature,
+      })
+      return Promise.resolve()
+    },
+    markIndexRemoved: (collectionId, signature) => {
+      adapter.markIndexRemovedCalls.push({
+        collectionId: recordedStorageId(collectionId),
+        signature,
+      })
+      return Promise.resolve()
+    },
+  }
+
+  return adapter
+}
+
+export function overrideBaselineRows(
+  adapter: RecordingAdapter,
+  loadRows: () =>
+    | Array<{ key: string; value: Todo; metadata?: unknown }>
+    | Promise<Array<{ key: string; value: Todo; metadata?: unknown }>>,
+): () => void {
+  const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+  adapter.loadResumeSnapshot = async (...args) => {
+    const snapshot = await loadResumeSnapshot(...args)
+    if (args[1]?.includeRows === false) return snapshot
+    return { ...snapshot, rows: await loadRows() }
+  }
+  return () => {
+    adapter.loadResumeSnapshot = loadResumeSnapshot
+  }
+}
+
+export type CoordinatorHarness = PersistedCollectionCoordinator & {
+  emit: (
+    payload: TxCommitted | CollectionReset,
+    senderId?: string,
+    collectionId?: string,
+  ) => void
+  pullSinceCalls: number
+  setPullSinceResponse: (response: PullSinceResponse) => void
+}
+
+export function createCoordinatorHarness(): CoordinatorHarness {
+  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined =
+    undefined
+  let pullSinceResponse: PullSinceResponse = {
+    type: `rpc:pullSince:res`,
+    rpcId: `pull-0`,
+    ok: true,
+    latestTerm: 1,
+    latestSeq: 0,
+    latestRowVersion: 0,
+    requiresFullReload: false,
+    changedKeys: [],
+    deletedKeys: [],
+  }
+
+  const harness: CoordinatorHarness = {
+    pullSinceCalls: 0,
+    getNodeId: () => `coordinator-node`,
+    subscribe: (_collectionId, onMessage) => {
+      subscriber = onMessage
+      return () => {
+        subscriber = undefined
+      }
+    },
+    publish: () => {},
+    isLeader: () => true,
+    ensureLeadership: async () => {},
+    requestEnsurePersistedIndex: async () => {},
+    requestEnsureRemoteSubset: async () => {},
+    // Remote subset ownership is outside this protocol-delivery harness.
+    requestReleaseRemoteSubset: async () => {},
+    registerRemoteSubsetOwner: () => () => {},
+    requestApplyCommittedTx: (_collectionId, tx) =>
+      Promise.resolve({
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }),
+    pullSince: () => {
+      harness.pullSinceCalls++
+      return Promise.resolve(pullSinceResponse)
+    },
+    emit: (
+      payload,
+      senderId = `remote-node`,
+      collectionId = `sync-present`,
+    ) => {
+      subscriber?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId,
+        senderId,
+        ts: Date.now(),
+        payload,
+      })
+    },
+    setPullSinceResponse: (response) => {
+      pullSinceResponse = response
+    },
+  }
+
+  return harness
+}
+
+export type FailStopCoordinatorHarness = PersistedCollectionCoordinator & {
+  emit: (payload: unknown, senderId?: string) => void
+  publishCalls: Array<ProtocolEnvelope<unknown>>
+  remoteEnsureCalls: Array<LoadSubsetOptions>
+  remoteReleaseCalls: Array<LoadSubsetOptions>
+  unsubscribeCalls: number
+}
+
+export function createFailStopCoordinatorHarness(
+  collectionId: string,
+): FailStopCoordinatorHarness {
+  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+  const harness: FailStopCoordinatorHarness = {
+    publishCalls: [],
+    remoteEnsureCalls: [],
+    remoteReleaseCalls: [],
+    unsubscribeCalls: 0,
+    getNodeId: () => `fail-stop-coordinator`,
+    subscribe: (_collectionId, onMessage) => {
+      subscriber = onMessage
+      return () => {
+        harness.unsubscribeCalls++
+        subscriber = undefined
+      }
+    },
+    publish: (_collectionId, message) => {
+      harness.publishCalls.push(message)
+    },
+    isLeader: () => true,
+    ensureLeadership: async () => {},
+    requestEnsurePersistedIndex: async () => {},
+    requestEnsureRemoteSubset: async (_collectionId, options) => {
+      harness.remoteEnsureCalls.push(options)
+    },
+    requestReleaseRemoteSubset: async (_collectionId, options) => {
+      harness.remoteReleaseCalls.push(options)
+    },
+    registerRemoteSubsetOwner: () => () => {},
+    requestApplyCommittedTx: (_collectionId, tx) =>
+      Promise.resolve({
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }),
+    emit: (payload, senderId = `remote-fail-stop-peer`) => {
+      subscriber?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId,
+        senderId,
+        ts: Date.now(),
+        payload,
+      })
+    },
+  }
+  return harness
+}
+
+export const stripVirtualProps = <T extends Record<string, any> | undefined>(
+  value: T,
+): T => {
+  if (!value || typeof value !== `object`) return value
+  const {
+    $hasPendingWrites: _hasPendingWrites,
+    $synced: _synced,
+    $origin: _origin,
+    $key: _key,
+    $collectionId: _collectionId,
+    ...rest
+  } = value as Record<string, unknown>
+  return rest as T
+}
+
+export async function flushAsyncWork(delayMs: number = 0): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, delayMs))
+}
+
+export function createDeferred<T = void>(): {
+  promise: Promise<T>
+  resolve: (value: T) => void
+} {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+export function createEventGate(): {
+  promise: Promise<void>
+  resolve: () => void
+  reject: (error: unknown) => void
+} {
+  let resolve!: () => void
+  let reject!: (error: unknown) => void
+  const promise = new Promise<void>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise
+    reject = rejectPromise
+  })
+  return { promise, resolve, reject }
+}
+
+export function observeSettlement(promise: Promise<void>): {
+  read: () =>
+    | { status: `pending` }
+    | { status: `fulfilled` }
+    | { status: `rejected`; reason: unknown }
+} {
+  let outcome:
+    | { status: `pending` }
+    | { status: `fulfilled` }
+    | { status: `rejected`; reason: unknown } = { status: `pending` }
+  void promise.then(
+    () => {
+      outcome = { status: `fulfilled` }
+    },
+    (reason: unknown) => {
+      outcome = { status: `rejected`, reason }
+    },
+  )
+  return { read: () => outcome }
+}
+
+export function expectHydrationReceiptsPending(
+  receipts: Array<ReturnType<typeof observeSettlement>>,
+) {
+  expect(
+    receipts.map((receipt) => receipt.read()),
+    `each receipt must wait for its own durable/visible boundary`,
+  ).toEqual(receipts.map(() => ({ status: `pending` })))
+}
+
+export function createNoopAdapter(): PersistenceAdapter {
+  return {
+    loadSubset: () => Promise.resolve([]),
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: () => Promise.resolve(),
+    ensureIndex: () => Promise.resolve(),
+  }
+}
+
+export async function createTerminalFailureHarness(
+  kind: `hydration` | `durability`,
+  id: string,
+) {
+  const seed = { id: `seed`, title: `stable before terminal failure` }
+  const adapter = createRecordingAdapter([seed])
+  adapter.rowMetadata.set(seed.id, `row-metadata-before-failure`)
+  adapter.collectionMetadata.set(`resume`, `collection-metadata-before-failure`)
+  const coordinator = createFailStopCoordinatorHarness(id)
+  const upstreamLoads: Array<LoadSubsetOptions> = []
+  const upstreamUnloads: Array<LoadSubsetOptions> = []
+  let sourceParams!: TodoSyncParams
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          sourceParams = params
+          params.markReady()
+          return {
+            loadSubset: (options) => {
+              upstreamLoads.push(options)
+              return true
+            },
+            unloadSubset: (options) => {
+              upstreamUnloads.push(options)
+            },
+          }
+        },
+      },
+      persistence: { adapter, coordinator },
+    }),
+  )
+  const initialLease: LoadSubsetOptions = { limit: 1 }
+  await atPersistedOracleCheckpoint(
+    collection.stateWhenReady(),
+    `${id} initially ready`,
+  )
+  await atPersistedOracleCheckpoint(
+    Promise.resolve(collection._sync.loadSubset(initialLease)),
+    `${id} initial lease hydrated`,
+  )
+  await flushAsyncWork()
+
+  let terminalError: unknown
+  if (kind === `hydration`) {
+    const hydrationError = new Error(`${id} terminal hydration failure`)
+    adapter.loadSubset = () => Promise.reject(hydrationError)
+    coordinator.emit({
+      type: `tx:committed`,
+      term: 1,
+      seq: 1,
+      txId: `${id}-failed-full-reload`,
+      latestRowVersion: 1,
+      requiresFullReload: true,
+      changedRows: [],
+      deletedKeys: [],
+    })
+    await vi.waitFor(() =>
+      expect(collection._lifecycle.getSyncError()).toBe(hydrationError),
+    )
+    terminalError = hydrationError
+  } else {
+    const adapterError = Object.assign(new Error(`${id} storage failure`), {
+      code: `SQLITE_FULL`,
+      path: `adapter.applyCommittedTx`,
+    })
+    coordinator.requestApplyCommittedTx = () =>
+      Promise.reject(
+        new PersistedCollectionDurabilityError(
+          `Failed to durably persist collection "${id}"`,
+          {
+            cause: adapterError,
+            code: adapterError.code,
+            path: adapterError.path,
+          },
+        ),
+      )
+    sourceParams.begin()
+    sourceParams.write({
+      type: `insert`,
+      value: { id: `first`, title: `published before terminal failure` },
+    })
+    const outcome = await atPersistedOracleCheckpoint(
+      Promise.resolve(sourceParams.commit()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      ),
+      `${id} durability failure settled`,
+    )
+    expect(outcome.status).toBe(`rejected`)
+    terminalError = outcome.status === `rejected` ? outcome.reason : undefined
+    expect(terminalError).toBeInstanceOf(PersistedCollectionDurabilityError)
+    expect(
+      terminalError instanceof Error ? terminalError.cause : undefined,
+    ).toBe(adapterError)
+  }
+
+  expect(collection.status).toBe(`crashed`)
+  expect(collection._lifecycle.getSyncError()).toBe(terminalError)
+
+  return {
+    adapter,
+    collection,
+    coordinator,
+    initialLease,
+    seed,
+    sourceParams,
+    terminalError,
+    upstreamLoads,
+    upstreamUnloads,
+  }
+}
+
+export const hydrationScopeModes = [
+  `none`,
+  `same-adapter`,
+  `distinct-adapter`,
+] as const
+
+export function expectPendingKeyMembershipWork(
+  actual: number,
+  pendingOwners: number,
+  partialWrites: number,
+): void {
+  expect(
+    actual,
+    `one key-membership lookup per pending owner and partial write`,
+  ).toBe(pendingOwners * partialWrites)
+}
+
+export async function runRejectedHydrationBufferWitness(
+  id: string,
+  rows: ReadonlyArray<Todo>,
+  options: {
+    commitAfterHydrationFailure?: boolean
+    scopeMode?: (typeof hydrationScopeModes)[number]
+  } = {},
+): Promise<void> {
+  const hydrationEntered = createEventGate()
+  const releaseHydration = createEventGate()
+  const hydrationRejected = createEventGate()
+  const hydrationError = new Error(`persisted hydration rejected exactly`)
+  const adapter = createRecordingAdapter()
+  const restoreBaselineRows = overrideBaselineRows(adapter, async () => {
+    hydrationEntered.resolve()
+    await releaseHydration.promise
+    hydrationRejected.resolve()
+    throw hydrationError
+  })
+
+  const routing = configureHydrationScope(adapter, options.scopeMode ?? `none`)
+  let remoteBegin: (() => void) | undefined
+  let remoteWrite:
+    ((message: { type: `insert`; value: Todo }) => void) | undefined
+  let remoteCommit: (() => true | Promise<void>) | undefined
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id,
+      getKey: (item) => item.id,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          remoteBegin = begin
+          remoteWrite = write as (message: {
+            type: `insert`
+            value: Todo
+          }) => void
+          remoteCommit = commit
+          markReady()
+        },
+      },
+      persistence: { adapter },
+    }),
+  )
+  let hasPrimaryFailure = false
+  let initialCollectionCleaned = false
+  const cleanupActions: Array<() => void | Promise<unknown>> = [
+    () => (initialCollectionCleaned ? undefined : collection.cleanup()),
+  ]
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+
+  try {
+    void collection.stateWhenReady().catch(() => undefined)
+    await atPersistedOracleCheckpoint(
+      hydrationEntered.promise,
+      `${id} hydration entered`,
+    )
+    expect(remoteBegin).toBeTypeOf(`function`)
+    expect(remoteWrite).toBeTypeOf(`function`)
+    expect(remoteCommit).toBeTypeOf(`function`)
+
+    const committers = rows.map((row) => {
+      remoteBegin!()
+      remoteWrite!({ type: `insert`, value: row })
+      return () => {
+        const receipt = remoteCommit!()
+        expect(receipt).toBeInstanceOf(Promise)
+        return observeSettlement(Promise.resolve(receipt).then(() => undefined))
+      }
+    })
+    let receipts = options.commitAfterHydrationFailure
+      ? []
+      : committers.map((commit) => commit())
+
+    releaseHydration.resolve()
+    await atPersistedOracleCheckpoint(
+      hydrationRejected.promise,
+      `${id} hydration rejected`,
+    )
+    await flushAsyncWork()
+
+    if (options.commitAfterHydrationFailure) {
+      receipts = committers.map((commit) => commit())
+      await flushAsyncWork()
+    }
+
+    const receiptOutcomes = receipts.map((receipt) => {
+      const outcome = receipt.read()
+      return outcome.status === `rejected`
+        ? {
+            status: outcome.status,
+            exactReason: outcome.reason === hydrationError,
+          }
+        : outcome
+    })
+    expect({
+      status: collection.status,
+      exactPublicError: collection._lifecycle.getSyncError() === hydrationError,
+      receiptOutcomes,
+      visibleRows: rows.filter((row) => collection.has(row.id)),
+      durableRows: rows.filter((row) => adapter.rows.has(row.id)),
+      durabilityCalls: adapter.applyCommittedTxCalls.length,
+    }).toEqual({
+      status: `crashed`,
+      exactPublicError: true,
+      receiptOutcomes: rows.map(() => ({
+        status: `rejected`,
+        exactReason: true,
+      })),
+      visibleRows: [],
+      durableRows: [],
+      durabilityCalls: 0,
+    })
+
+    await atPersistedOracleCheckpoint(
+      collection.cleanup(),
+      `${id} failed collection cleanup`,
+    )
+    expect(routing?.violations() ?? []).toEqual([])
+    initialCollectionCleaned = true
+    restoreBaselineRows()
+
+    const reopened = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (item) => item.id,
+        persistence: { adapter },
+      }),
+    )
+    cleanupActions.push(() => reopened.cleanup())
+    await atPersistedOracleCheckpoint(
+      reopened.stateWhenReady(),
+      `${id} reopened hydration`,
+    )
+    await flushAsyncWork()
+
+    expect({
+      visibleRows: rows.filter((row) => reopened.has(row.id)),
+      durableRows: rows.filter((row) => adapter.rows.has(row.id)),
+      rowMetadata: Array.from(adapter.rowMetadata.entries()),
+      collectionMetadata: Array.from(adapter.collectionMetadata.entries()),
+      durabilityCalls: adapter.applyCommittedTxCalls.length,
+    }).toEqual({
+      visibleRows: [],
+      durableRows: [],
+      rowMetadata: [],
+      collectionMetadata: [],
+      durabilityCalls: 0,
+    })
+
+    const freshRow = { id: `${id}:fresh`, title: `post-restart control` }
+    const freshTransaction = reopened.insert(freshRow)
+    await atPersistedOracleCheckpoint(
+      (async () => {
+        await freshTransaction.isPersisted.promise
+      })(),
+      `${id} fresh transaction persisted`,
+    )
+    await flushAsyncWork()
+
+    expect({
+      visibleFreshRow: stripVirtualProps(reopened.get(freshRow.id)),
+      durableFreshRow: adapter.rows.get(freshRow.id),
+      staleVisibleRows: rows.filter((row) => reopened.has(row.id)),
+      staleDurableRows: rows.filter((row) => adapter.rows.has(row.id)),
+      rowMetadata: Array.from(adapter.rowMetadata.entries()),
+      collectionMetadata: Array.from(adapter.collectionMetadata.entries()),
+      appliedKeys: adapter.applyCommittedTxCalls.flatMap(({ tx }) =>
+        tx.mutations.map((mutation) => mutation.key),
+      ),
+    }).toEqual({
+      visibleFreshRow: freshRow,
+      durableFreshRow: freshRow,
+      staleVisibleRows: [],
+      staleDurableRows: [],
+      rowMetadata: [],
+      collectionMetadata: [],
+      appliedKeys: [freshRow.id],
+    })
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseHydration.resolve()
+    warning.mockRestore()
+    await cleanupPersistedOracle(cleanupActions, hasPrimaryFailure)
+  }
+}
+
+// The core optimistic-history law drops a refused insert at settlement;
+// accepted source transactions remain authoritative. The independent
+// single-row source reference state starts empty. Each accepted source turn
+// changes only its named key.
+// Cross first-turn insert/delete with commitment before/after refusal, then
+// apply the opposite turn. Compare at mutation settlement and each receipt,
+// before a later source turn can hide a ghost.
+// A failed transaction contributes no lasting local attribution. A source
+// row that survives its rejection has remote public origin at publication,
+// whether the source turn was accepted before or after the rejection.
+export const refusalHistories = ([`before`, `after`] as const).flatMap(
+  (timing) =>
+    ([`delete`, `insert`] as const).map((firstWrite) => ({
+      timing,
+      firstWrite,
+    })),
+)
+
+// The public optional API admits all three paths. Keep the no-scope and
+// same-adapter histories when adding a distinguishable loan; their receipt and
+// replay laws do not depend on a scheduler being present.
+export function configureHydrationScope(
+  adapter: PersistenceAdapter,
+  mode: (typeof hydrationScopeModes)[number],
+) {
+  if (mode === `distinct-adapter`) return installHydrationRoutingProbe(adapter)
+  if (mode === `same-adapter`)
+    adapter.runInHydrationScope = (task) => task(adapter)
+  return undefined
+}
+
+// This is a controlled ownership probe, not a scheduler model. Each invocation
+// lends a fresh adapter. A call records both its route and whether its loan is
+// still live. Forwarding wrong calls permits teardown while retaining the
+// reached routing violation. The browser receiver proves the actual cycle.
+export function installHydrationRoutingProbe(adapter: PersistenceAdapter) {
+  const direct = adapter.applyCommittedTx.bind(adapter)
+  const calls: Array<{
+    route: `public` | `scoped`
+    scope: number | undefined
+    live: boolean
+    collectionId: string
+  }> = []
+  const active = new Set<number>()
+  let sequence = 0
+  adapter.applyCommittedTx = (collectionId, tx) => {
+    calls.push({
+      route: `public`,
+      scope: [...active].at(-1),
+      live: active.size === 0,
+      collectionId: recordedStorageId(collectionId),
+    })
+    return direct(collectionId, tx)
+  }
+  adapter.runInHydrationScope = async (task) => {
+    const scope = ++sequence
+    active.add(scope)
+    const scopedAdapter: PersistenceAdapter = {
+      ...adapter,
+      applyCommittedTx: (collectionId, tx) => {
+        calls.push({
+          route: `scoped`,
+          scope,
+          live: active.has(scope),
+          collectionId: recordedStorageId(collectionId),
+        })
+        return direct(collectionId, tx)
+      },
+    }
+    try {
+      return await task(scopedAdapter)
+    } finally {
+      active.delete(scope)
+    }
+  }
+  return { calls, violations: () => calls.filter((call) => !call.live) }
+}
+
+export const itUnlessAnyOracleReplay = oracleReplayTest(it)
+
+export function createLocalCoordinatorHarness() {
+  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+  return Object.assign(new SingleProcessCoordinator(), {
+    subscribe: (
+      _collectionId: string,
+      onMessage: (message: ProtocolEnvelope<unknown>) => void,
+    ) => {
+      subscriber = onMessage
+      return () => {
+        subscriber = undefined
+      }
+    },
+    emit: (payload: TxCommitted | CollectionReset) => {
+      subscriber?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId: `sync-present`,
+        senderId: `remote-node`,
+        ts: Date.now(),
+        payload,
+      })
+    },
+  })
+}
+
+/**
+ * A notification is scoped to the physical cache generation that received
+ * it. A peer may deliver an old-generation commit or reset while rotation holds the
+ * wrapper's apply mutex; processing begins only after the new generation
+ * binds. The model discards that old version at the generation boundary,
+ * then requires the next new-generation notice to request reacquisition of
+ * the active subset. The old generation may have a lower or higher row version than
+ * the new notice, so physical identity rather than version order decides
+ * authority. The history grammar varies an absent, commit, or reset old
+ * notice; row versions on both sides; and an absent or present new notice.
+ * No old notice and no new notice are work-count controls. This driver holds
+ * rotation, queues any old notice before the physical ID changes, and checks
+ * source requests after the old callback has crossed the apply mutex. A
+ * persisting optimistic mutation holds the new source snapshot's applied
+ * receipt. A constrained demand already pending at the coordinator must
+ * remain pending until that receipt publishes the source row. Until then,
+ * the refresh acquisition remains owned and the distinct notice-only row
+ * cannot become public during scoped recovery. The controlled coordinator
+ * supplies the receipt wait; the wrapper's settlement and publication are
+ * the observations at this boundary.
+ */
+export type GenerationNoticeHistory = {
+  retiredNotice: `none` | `commit` | `reset`
+  retiredRowVersion: 1 | 10
+  newRowVersion: 1 | 3
+  newNotice: boolean
+}
+
+export const assertGenerationNoticeHistory = async ({
+  retiredNotice,
+  retiredRowVersion,
+  newRowVersion,
+  newNotice,
+}: GenerationNoticeHistory): Promise<void> => {
+  const adapter = createRecordingAdapter([
+    { id: `retired`, title: `Retired cache row` },
+  ])
+  const coordinator = createCoordinatorHarness()
+  const logicalId = `queued-peer-rotation`
+  const oldStorageId = `queued-peer-old-storage`
+  const newStorageId = `queued-peer-new-storage`
+  const rotationEntered = createEventGate()
+  const releaseRotation = createEventGate()
+  const remoteEnsures: Array<string> = []
+  const remoteEnsureOptions: Array<{
+    id: string
+    options: LoadSubsetOptions
+  }> = []
+  const demandEnsureEntered = createEventGate()
+  const demandOptions: LoadSubsetOptions = {
+    limit: 2,
+    where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(`fresh`)]),
+  }
+  const sourceCommitReturned = createEventGate()
+  const mutationEntered = createEventGate()
+  const releaseMutation = createEventGate()
+  let refreshReceipt: Promise<void> | undefined
+  let refreshApplied = false
+  const releaseCalls: Array<{
+    id: string
+    options: LoadSubsetOptions
+    appliedAtRelease: boolean
+  }> = []
+  let freshRequestOptions: LoadSubsetOptions | undefined
+  let newNoticeDelivered = false
+  let freshWorkStarted = false
+  let wrongGenerationReads = 0
+  const originalLoadResumeSnapshot = adapter.loadResumeSnapshot
+  adapter.loadResumeSnapshot = async (id, context) => {
+    if (recordedStorageId(id) === logicalId) {
+      wrongGenerationReads++
+      throw new Error(`Retired reset must not read the logical cache ID`)
+    }
+    const snapshot = await originalLoadResumeSnapshot(id, context)
+    return {
+      ...snapshot,
+      latestTerm: recordedStorageId(id) === oldStorageId ? 1 : 0,
+      latestSeq: recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
+      latestRowVersion:
+        recordedStorageId(id) === oldStorageId ? retiredRowVersion : 0,
+    }
+  }
+  adapter.claimCacheGeneration = async () => ({
+    storageCollectionId: oldStorageId,
+    claimId: `queued-peer-claim`,
+    expiresAtMs: Date.now() + 60_000,
+  })
+  adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
+  adapter.rotateCacheGeneration = async () => {
+    rotationEntered.resolve()
+    await releaseRotation.promise
+    return {
+      storageCollectionId: newStorageId,
+      claimId: `queued-peer-claim`,
+      expiresAtMs: Date.now() + 60_000,
+    }
+  }
+  adapter.releaseCacheGenerationClaim = async () => {}
+  coordinator.requestEnsureRemoteSubset = async (id, options) => {
+    remoteEnsures.push(id)
+    remoteEnsureOptions.push({ id, options })
+    if (options === demandOptions) {
+      demandEnsureEntered.resolve()
+      await sourceCommitReturned.promise
+      await refreshReceipt
+      return
+    }
+    if (
+      newNoticeDelivered &&
+      !freshWorkStarted &&
+      options.refetch === true &&
+      options.limit === demandOptions.limit
+    ) {
+      freshWorkStarted = true
+      freshRequestOptions = options
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `fresh`, title: `Fresh source row` },
+      })
+      const receipt = source.commit()
+      if (receipt === true) throw new Error(`Source receipt was untracked`)
+      refreshReceipt = receipt
+      sourceCommitReturned.resolve()
+      await receipt
+      refreshApplied = true
+    }
+  }
+  coordinator.requestReleaseRemoteSubset = async (id, options) => {
+    releaseCalls.push({ id, options, appliedAtRelease: refreshApplied })
+  }
+
+  let source!: TodoSyncParams
+  const collection = createCollection(
+    persistedCollectionOptions<Todo, string>({
+      id: logicalId,
+      syncMode: `on-demand`,
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          source = params
+          params.markReady()
+          return {
+            restartAfterScopedRecovery: async (cacheRotated) => {
+              await cacheRotated
+            },
+            loadSubset: async () => {},
+            unloadSubset: async () => {},
+          }
+        },
+      },
+      persistence: { adapter, coordinator },
+      onInsert: async () => {
+        mutationEntered.resolve()
+        await releaseMutation.promise
+      },
+    }),
+  )
+  let mutation: ReturnType<typeof collection.insert> | undefined
+  let recovery: Promise<void> | undefined
+  let demand: Promise<void> | undefined
+  const publishedFreshTitles: Array<string | undefined> = []
+  const publication = collection.subscribeChanges(
+    (changes) => {
+      if (changes.some((change) => change.key === `fresh`)) {
+        publishedFreshTitles.push(collection.get(`fresh`)?.title)
+      }
+    },
+    { includeInitialState: false },
+  )
+  let hasPrimaryFailure = false
+  try {
+    collection.startSyncImmediate()
+    await collection.stateWhenReady()
+    await source.metadata!.persistence!.hydrateBaseline()
+    expect(collection.get(`retired`)?.title).toBe(`Retired cache row`)
+
+    const persistence = source.metadata?.persistence
+    if (!persistence?.startScopedRecovery) {
+      throw new Error(`Expected scoped recovery capability`)
+    }
+    recovery = persistence.startScopedRecovery()
+    void recovery.catch(() => undefined)
+    await atPersistedOracleCheckpoint(
+      rotationEntered.promise,
+      `old physical cache rotation entered`,
+    )
+    // A queued old notice belongs to the still-subscribed old physical ID.
+    if (retiredNotice !== `none`) {
+      coordinator.emit(
+        retiredNotice === `commit`
+          ? {
+              type: `tx:committed`,
+              term: 1,
+              seq: retiredRowVersion + 1,
+              txId: `retired-generation-peer-row`,
+              latestRowVersion: retiredRowVersion + 1,
+              requiresFullReload: false,
+              changedRows: [
+                {
+                  key: `retired`,
+                  value: { id: `retired`, title: `Old peer row` },
+                },
+              ],
+              deletedKeys: [],
+            }
+          : { type: `collection:reset`, schemaVersion: 1, resetEpoch: 1 },
+        `peer`,
+        oldStorageId,
+      )
+    }
+    releaseRotation.resolve()
+    await atPersistedOracleCheckpoint(recovery, `cache rotation settled`)
+    // This scan enters the same apply mutex behind the old notice. Its
+    // settlement is the checkpoint at which that notice can no longer
+    // change the new generation's row-version observation.
+    await persistence.scanPersistedRows()
+    expect(wrongGenerationReads).toBe(0)
+    expect(collection.status).toBe(`ready`)
+    expect(collection.get(`retired`)).toBeUndefined()
+    // Rotation reacquires this active subset once. The queued old notice
+    // must not add another source request against the replacement cache.
+    expect(remoteEnsures).toEqual([newStorageId])
+
+    if (newNotice) {
+      const pendingDemand = Promise.resolve(
+        collection._sync.loadSubset(demandOptions),
+      ).then(() => undefined)
+      demand = pendingDemand
+      void pendingDemand.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        demandEnsureEntered.promise,
+        `constrained demand entered source coordinator`,
+      )
+      expect(
+        remoteEnsureOptions.filter(({ options }) => options === demandOptions),
+      ).toEqual([{ id: newStorageId, options: demandOptions }])
+      const demandSettlement = observeSettlement(pendingDemand)
+      await flushAsyncWork()
+      expect(demandSettlement.read()).toEqual({ status: `pending` })
+      const ensuresBeforeNotice = remoteEnsures.length
+      mutation = collection.insert({ id: `local`, title: `Pending` })
+      await atPersistedOracleCheckpoint(
+        mutationEntered.promise,
+        `optimistic publication hold before new notice`,
+      )
+      newNoticeDelivered = true
+      coordinator.emit(
+        {
+          type: `tx:committed`,
+          term: 1,
+          seq: newRowVersion,
+          txId: `new-generation-peer-row`,
+          latestRowVersion: newRowVersion,
+          requiresFullReload: false,
+          changedRows: [
+            {
+              key: `fresh`,
+              value: { id: `fresh`, title: `Notice-only row` },
+            },
+          ],
+          deletedKeys: [],
+        },
+        `peer`,
+        newStorageId,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() =>
+          expect(remoteEnsures.length).toBeGreaterThan(ensuresBeforeNotice),
+        ),
+        `new-generation source reacquisition after an old notice`,
+      )
+      expect(remoteEnsures.at(-1)).toBe(newStorageId)
+      await atPersistedOracleCheckpoint(
+        sourceCommitReturned.promise,
+        `new-generation source receipt returned`,
+      )
+      expect(remoteEnsureOptions).toContainEqual({
+        id: newStorageId,
+        options: { ...demandOptions, refetch: true },
+      })
+      const applied = observeSettlement(refreshReceipt!)
+      await flushAsyncWork()
+      expect(freshRequestOptions).toBeDefined()
+      expect(applied.read()).toEqual({ status: `pending` })
+      expect(demandSettlement.read()).toEqual({ status: `pending` })
+      expect(refreshApplied).toBe(false)
+      expect(
+        releaseCalls.filter(({ options }) => options === freshRequestOptions),
+      ).toEqual([])
+      expect(collection.get(`retired`)).toBeUndefined()
+      expect(collection.get(`fresh`)).toBeUndefined()
+      expect(publishedFreshTitles).toEqual([])
+      releaseMutation.resolve()
+      await atPersistedOracleCheckpoint<unknown>(
+        mutation.isPersisted.promise,
+        `optimistic publication released`,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() => expect(refreshApplied).toBe(true)),
+        `fresh source snapshot applied`,
+      )
+      await atPersistedOracleCheckpoint(
+        vi.waitFor(() =>
+          expect(
+            releaseCalls.filter(
+              ({ options }) => options === freshRequestOptions,
+            ),
+          ).toHaveLength(1),
+        ),
+        `refresh acquisition released after application`,
+      )
+      expect(
+        releaseCalls.filter(({ options }) => options === freshRequestOptions),
+      ).toEqual([
+        {
+          id: newStorageId,
+          options: freshRequestOptions,
+          appliedAtRelease: true,
+        },
+      ])
+      expect(collection.get(`fresh`)).toMatchObject({
+        id: `fresh`,
+        title: `Fresh source row`,
+      })
+      await atPersistedOracleCheckpoint(
+        pendingDemand,
+        `constrained demand settled`,
+      )
+      expect(demandSettlement.read()).toEqual({ status: `fulfilled` })
+      expect(publishedFreshTitles).toEqual([`Fresh source row`])
+    } else {
+      await persistence.scanPersistedRows()
+      expect(remoteEnsures).toEqual([newStorageId])
+    }
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseRotation.resolve()
+    releaseMutation.resolve()
+    publication.unsubscribe()
+    await cleanupPersistedOracle(
+      [
+        () => recovery,
+        () => mutation?.isPersisted.promise.catch(() => undefined),
+        () => demand?.catch(() => undefined),
+        () => collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+}
+
+/**
+ * A follower routes demand it cannot serve to the elected owner. The owner
+ * loads the rows upstream, commits them durably, and broadcasts the commit
+ * before it answers the ensure request on the same channel. The follower
+ * applies that broadcast asynchronously, by reading durable rows under its
+ * apply mutex. Law 7 therefore owes: the follower's load settles only after
+ * the broadcasts that preceded the reply have applied here, and it rejects,
+ * with the runtime terminal, if applying them failed.
+ *
+ * The independent model knows only whether the owner's commit applies.
+ * While that apply is held, no consumer of the demand has settled. If it
+ * applies, the consumer settles successfully with the owner's row visible.
+ * If it fails, the consumer rejects without the row, and the source is in
+ * error. The model does not know how the follower queues commits.
+ *
+ * The grammar crosses where the owner's broadcast meets the follower with
+ * whether its apply succeeds. A direct broadcast applies at once. A queued
+ * broadcast arrives while another subset's hydration holds the apply mutex,
+ * so it waits in the queue. A rotated history loses the cache claim after
+ * the first hydration read, so the demand reacquires through the owner
+ * under a new generation. An expired history lets the follower's cache
+ * claim lapse while its ensure is in flight, so the owner's notice arrives
+ * while the claim is expired; renewal keeps the same generation. The read
+ * that applies the owner's row is the one
+ * whose durable snapshot contains it; the driver holds that read to observe
+ * the not-ready checkpoint, or fails it. The consumer is a live query
+ * over the demanded rows or the follower's load itself. Observations, while
+ * the apply is held and after it settles: whether the consumer settled, its
+ * outcome, the demanded rows it sees when it settles (the query's
+ * first-ready rows, or the source's rows at load settlement), and the
+ * query's and source's status. A load that rejects owes the release of the
+ * remote acquisition the owner granted it (LoadSubsetFn), so for the load
+ * consumer the model also counts the follower's release requests for the
+ * current cache generation when it settles. The coordinator
+ * is a controlled double of an elected owner that broadcasts before it
+ * replies, as the built-in coordinator does; the two-tab OPFS suite is the
+ * receiving witness for the browser transport.
+ *
+ * A separate cell lets the claim lapse after the owner's row applied, so
+ * the follower's renewal at the reply fails transiently. That is not claim
+ * loss: the load rejects as after a failed ensure, and the demand stays
+ * active and retries instead of releasing the owner's acquisition.
+ *
+ * Known gap (#2139): a rotated follower never ends scoped recovery, so the
+ * owner's row never becomes visible in the rotated placement. Its cells are
+ * pinned as failing, and the generated histories omit that placement. A
+ * rotation that starts while a load waits for the owner's commits is also
+ * outside this lane and tracked there.
+ */
+export type FollowerRemoteDemandHistory = {
+  placement: `direct` | `queued` | `rotated` | `expired`
+  apply: `ok` | `fails`
+  // A live query over the demand, or the follower's load itself.
+  consumer: `live-query` | `load`
+  // The owner's row applies, then the claim lapses before the reply and
+  // the follower's first renewal fails transiently.
+  renewal?: `fails-at-reply`
+}
+
+export type FollowerRow = { id: string; group: string }
+
+export function createFollowerTab(history: FollowerRemoteDemandHistory) {
+  const durable: Array<FollowerRow> = []
+  const applyRead = createDeferred()
+  const applyReadStarted = createDeferred()
+  const otherHydrationStarted = createDeferred()
+  const otherHydration = createDeferred()
+  let reads = 0
+  let storageId = `follower-demand-cache-1`
+  let loseClaim = false
+  const claim = () => ({
+    storageCollectionId: storageId,
+    claimId: `follower-demand-claim`,
+    expiresAtMs: Date.now() + 10_000,
+  })
+  const rotated = history.placement === `rotated`
+  const expiring = history.placement === `expired`
+  const renewalFailsAtReply = history.renewal === `fails-at-reply`
+  let failRenewal = false
+  let now = 1_000_000
+  const adapter: PersistenceAdapter = {
+    loadSubset: async () => {
+      const read = ++reads
+      const snapshot = durable.slice()
+      if (snapshot.some((row) => row.id === `remote`)) {
+        applyReadStarted.resolve()
+        await applyRead.promise
+        if (history.apply === `fails`) throw new Error(`apply read failed`)
+      } else if (history.placement === `queued` && read === 2) {
+        otherHydrationStarted.resolve()
+        await otherHydration.promise
+      }
+      if (rotated && read === 1) loseClaim = true
+      return snapshot.map((value) => ({ key: value.id, value }))
+    },
+    ...(expiring
+      ? {
+          getCacheGenerationNow: () => now,
+          claimCacheGeneration: async () => ({
+            storageCollectionId: storageId,
+            claimId: `follower-demand-claim`,
+            expiresAtMs: now + 10_000,
+          }),
+          // The claim is still held, so renewal keeps this generation.
+          renewCacheGenerationClaim: async () => now + 10_000,
+          rotateCacheGeneration: async () => {
+            throw new Error(`an expired history must not rotate`)
+          },
+          releaseCacheGenerationClaim: async () => {},
+        }
+      : {}),
+    ...(renewalFailsAtReply
+      ? {
+          getCacheGenerationNow: () => now,
+          claimCacheGeneration: async () => ({
+            storageCollectionId: storageId,
+            claimId: `follower-demand-claim`,
+            expiresAtMs: now + 10_000,
+          }),
+          // A transient storage error, not a lost claim.
+          renewCacheGenerationClaim: async () => {
+            if (failRenewal) {
+              failRenewal = false
+              throw new Error(`transient renewal failure`)
+            }
+            return now + 10_000
+          },
+          rotateCacheGeneration: async () => {
+            throw new Error(`a transient renewal failure must not rotate`)
+          },
+          releaseCacheGenerationClaim: async () => {},
+        }
+      : {}),
+    ...(rotated
+      ? {
+          claimCacheGeneration: async () => claim(),
+          renewCacheGenerationClaim: async () =>
+            loseClaim ? undefined : Date.now() + 10_000,
+          rotateCacheGeneration: async () => {
+            loseClaim = false
+            storageId = `follower-demand-cache-2`
+            return claim()
+          },
+          releaseCacheGenerationClaim: async () => {},
+        }
+      : {}),
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: async () => {},
+    ensureIndex: async () => {},
+  } as PersistenceAdapter
+  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+  let ensures = 0
+  let releases = 0
+  let resetPending = false
+  const coordinator: PersistedCollectionCoordinator = {
+    getNodeId: () => `follower`,
+    subscribe: (_collectionId, onMessage) => {
+      subscriber = onMessage
+      return () => {
+        subscriber = undefined
+      }
+    },
+    publish: () => {},
+    isLeader: () => false,
+    ensureLeadership: async () => {},
+    requestEnsurePersistedIndex: async () => {},
+    // The owner commits once, broadcasts, then replies; later ensures find
+    // nothing new.
+    requestEnsureRemoteSubset: async (collectionId) => {
+      if (++ensures > 1 && !resetPending) return
+      resetPending = false
+      if (history.placement === `queued`) await otherHydrationStarted.promise
+      // The follower's claim lapses before the owner's notice reaches it.
+      if (expiring) now += 20_000
+      const value = { id: `remote`, group: `a` }
+      durable.push(value)
+      const payload: TxCommitted = {
+        type: `tx:committed`,
+        term: 1,
+        seq: ensures,
+        txId: `owner-tx-${ensures}`,
+        latestRowVersion: ensures,
+        requiresFullReload: false,
+        changedRows: [{ key: value.id, value }],
+        deletedKeys: [],
+      }
+      subscriber?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId,
+        senderId: `owner`,
+        ts: Date.now(),
+        payload,
+      })
+      if (renewalFailsAtReply) {
+        // Let the owner's row apply here before the claim lapses.
+        for (let i = 0; i < 5; i++)
+          await new Promise((resolve) => setTimeout(resolve, 0))
+        now += 20_000
+        failRenewal = true
+      }
+    },
+    // Rotation legitimately releases the previous generation's
+    // acquisition, so only the current generation's releases count.
+    requestReleaseRemoteSubset: async (collectionId) => {
+      if (!rotated || collectionId === storageId) releases++
+    },
+    registerRemoteSubsetOwner: () => () => {},
+    requestApplyCommittedTx: (_collectionId, tx) =>
+      Promise.resolve({
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }),
+    pullSince: () =>
+      Promise.resolve({
+        type: `rpc:pullSince:res`,
+        rpcId: `follower-demand-pull`,
+        ok: true,
+        latestTerm: 1,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        requiresFullReload: false,
+        changedKeys: [],
+        deletedKeys: [],
+      }),
+  }
+  const source = createCollection(
+    persistedCollectionOptions<FollowerRow, string>({
+      id: `follower-demand-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      persistence: { adapter, coordinator },
+      syncMode: `on-demand`,
+      sync: {
+        sync: () => ({
+          loadSubset: () => Promise.resolve(),
+          restartAfterScopedRecovery: () => {},
+        }),
+      },
+    }),
+  )
+  source.startSyncImmediate()
+  return {
+    source,
+    applyReadStarted: applyReadStarted.promise,
+    otherHydrationStarted: otherHydrationStarted.promise,
+    releaseApply: () => applyRead.resolve(),
+    releaseOtherHydration: () => otherHydration.resolve(),
+    releases: () => releases,
+    ensures: () => ensures,
+    // The owner resets durable storage and announces it; it loads the
+    // demanded row again on the next ensure.
+    resetOwner: () => {
+      durable.length = 0
+      resetPending = true
+      subscriber?.({
+        v: 1,
+        dbName: `test-db`,
+        collectionId: source.id,
+        senderId: `owner`,
+        ts: Date.now(),
+        payload: {
+          type: `collection:reset`,
+          schemaVersion: 1,
+          resetEpoch: 1,
+        },
+      })
+    },
+  }
+}
+
+// Wait for a driver event, but turn a missing event into an observation
+// rather than a timeout.
+export const within = (promise: Promise<unknown>, ms = 200) =>
+  Promise.race([
+    promise.then(() => true),
+    new Promise<boolean>((resolve) => setTimeout(() => resolve(false), ms)),
+  ])
+
+// A path replay of one of these properties runs this suite. A replay of any
+// other property stands it aside.
+export const describeUnlessOracleReplay = oracleReplayTest(
+  describe,
+  `persistence.retained-demand`,
+  `persistence.generation-notice`,
+  `persistence.follower-remote-demand`,
+)
+
+export const describeUnlessAnyOracleReplay = oracleReplayTest(describe)
+
+export const generationNoticeHistory = fc.record({
+  retiredNotice: fc.constantFrom<GenerationNoticeHistory[`retiredNotice`]>(
+    `none`,
+    `commit`,
+    `reset`,
+  ),
+  retiredRowVersion: fc.constantFrom<
+    GenerationNoticeHistory[`retiredRowVersion`]
+  >(1, 10),
+  newRowVersion: fc.constantFrom<GenerationNoticeHistory[`newRowVersion`]>(
+    1,
+    3,
+  ),
+  newNotice: fc.boolean(),
+})
diff --git a/packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts
index 557afd123e..a18a60c62c 100644
--- a/packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/persisted-sync-problem-oracle.test.ts
@@ -1,5 +1,6 @@
 import { createCollection } from '@tanstack/db'
 import { afterAll, describe, expect, it, vi } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { createOracleReach } from '../../db/tests/oracle-reach'
 import { persistedCollectionOptions } from '../src/index.js'
 import type {
@@ -592,3 +593,5 @@ describe(`persisted sync problem oracle`, () => {
     }
   })
 })
+
+declareOracle({ model: [expected], grammar: [histories] })
diff --git a/packages/db-sqlite-persistence-core/tests/persisted.test.ts b/packages/db-sqlite-persistence-core/tests/persisted.test.ts
new file mode 100644
index 0000000000..f742fe44f7
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/persisted.test.ts
@@ -0,0 +1,1905 @@
+/**
+ * Ordinary tests for persistedCollectionOptions: option validation, startup metadata, coordinator and single-process subset wiring, and fixed wire-projection cases. The persisted-wrapper laws that these tests touch (durability, hydration, lifecycle) are owned by persisted-oracle.test.ts.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createCollection,
+  createLiveQueryCollection,
+  createTransaction,
+} from '@tanstack/db'
+import {
+  IndeterminateCommitError,
+  PersistedCollectionDurabilityError,
+  persistedCollectionOptions,
+} from '../src'
+import {
+  atPersistedOracleCheckpoint,
+  cleanupPersistedOracle,
+  createCoordinatorHarness,
+  createDeferred,
+  createEventGate,
+  createFailStopCoordinatorHarness,
+  createRecordingAdapter,
+  flushAsyncWork,
+  observeSettlement,
+  stripVirtualProps,
+} from './persisted-support'
+import type {
+  PersistedCollectionCoordinator,
+  PersistedTx,
+  ProtocolEnvelope,
+} from '../src'
+import type { Todo, TodoSyncParams } from './persisted-support'
+
+describe(`persistedCollectionOptions`, () => {
+  it(`does not publish or allocate a sequence for an empty external source transaction`, async () => {
+    const adapter = Object.assign(createRecordingAdapter(), {
+      getStreamPosition: () =>
+        Promise.resolve({
+          latestTerm: 1,
+          latestSeq: 10,
+          latestRowVersion: 10,
+        }),
+    })
+    let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+    const published: Array<ProtocolEnvelope<unknown>> = []
+    const coordinator: PersistedCollectionCoordinator = {
+      getNodeId: () => `empty-source-follower`,
+      subscribe: (_collectionId, onMessage) => {
+        subscriber = onMessage
+        return () => {
+          subscriber = undefined
+        }
+      },
+      publish: (_collectionId, message) => published.push(message),
+      isLeader: () => false,
+      ensureLeadership: async () => {},
+      requestEnsurePersistedIndex: async () => {},
+      requestEnsureRemoteSubset: async () => {},
+      requestReleaseRemoteSubset: async () => {},
+      registerRemoteSubsetOwner: () => () => {},
+      requestApplyCommittedTx: (_collectionId, tx) =>
+        Promise.resolve({
+          type: `rpc:applyCommittedTx:res`,
+          rpcId: tx.txId,
+          ok: true,
+          term: tx.term,
+          seq: tx.seq,
+          latestRowVersion: tx.rowVersion,
+        }),
+    }
+    let sourceBegin: (() => void) | undefined
+    let sourceCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `empty-source-sequence`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ begin, commit, markReady }) => {
+            sourceBegin = begin
+            sourceCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+
+    try {
+      await collection.stateWhenReady()
+      sourceBegin?.()
+      await sourceCommit?.()
+      await flushAsyncWork()
+
+      expect(published).toEqual([])
+
+      subscriber?.({
+        v: 1,
+        dbName: `empty-source-sequence`,
+        collectionId: `empty-source-sequence`,
+        senderId: `elected-owner`,
+        ts: Date.now(),
+        payload: {
+          type: `tx:committed`,
+          term: 1,
+          seq: 11,
+          txId: `first-real-coordinator-sequence`,
+          latestRowVersion: 11,
+          requiresFullReload: false,
+          changedRows: [
+            {
+              key: `kept`,
+              value: { id: `kept`, title: `First real write` },
+            },
+          ],
+          deletedKeys: [],
+        },
+      })
+      await flushAsyncWork()
+
+      expect(stripVirtualProps(collection.get(`kept`))).toEqual({
+        id: `kept`,
+        title: `First real write`,
+      })
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`persists a wrapped sync transaction when abort follows application`, async () => {
+    const adapter = createRecordingAdapter()
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-abort-after-application`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let releaseMutation!: () => void
+    const mutationGate = new Promise<void>((resolve) => {
+      releaseMutation = resolve
+    })
+    const transaction = createTransaction({
+      mutationFn: () => mutationGate,
+    })
+
+    try {
+      await collection.stateWhenReady()
+      transaction.mutate(() => {
+        collection.insert({ id: `local`, title: `Optimistic gate` })
+      })
+
+      const abortController = new AbortController()
+      let appliedPublications = 0
+      const subscription = collection.subscribeChanges((changes) => {
+        if (changes.some((change) => change.key === `remote`)) {
+          appliedPublications++
+          abortController.abort()
+        }
+      })
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `remote`, title: `Already visible` },
+      })
+      const receipt = remoteCommit?.(abortController.signal)
+      expect(receipt).toBeInstanceOf(Promise)
+
+      releaseMutation()
+      await transaction.isPersisted.promise
+      await receipt
+      subscription.unsubscribe()
+
+      expect(appliedPublications).toBe(1)
+      expect(abortController.signal.aborted).toBe(true)
+      expect(stripVirtualProps(collection.get(`remote`))).toEqual({
+        id: `remote`,
+        title: `Already visible`,
+      })
+      expect(adapter.applyCommittedTxCalls).toHaveLength(1)
+    } finally {
+      releaseMutation()
+      await transaction.isPersisted.promise.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+
+  // An accepted sync transaction always applies, in commit order. A later
+  // abort of its signal cannot remove it or the suffix that depends on it.
+  it(`applies an accepted predecessor and its suffix after the predecessor's signal aborts`, async () => {
+    const adapter = createRecordingAdapter()
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit:
+      ((signal?: AbortSignal) => true | Promise<void>) | undefined
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-abort-before-publication-suffix`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            remoteBegin = params.begin
+            remoteWrite = params.write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = params.commit
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const localPersistence = createEventGate()
+    const localTransaction = createTransaction({
+      mutationFn: () => localPersistence.promise,
+    })
+    const aborted = new AbortController()
+    let abortedReceipt: Promise<void> | undefined
+    let dependentReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      localTransaction.mutate(() => {
+        collection.insert({ id: `local`, title: `publication gate` })
+      })
+
+      remoteBegin?.()
+      sourceParams.metadata!.row.set(`shared`, { owner: `aborted` })
+      abortedReceipt = Promise.resolve(remoteCommit?.(aborted.signal)).then(
+        () => undefined,
+      )
+      void abortedReceipt.catch(() => undefined)
+
+      remoteBegin?.()
+      const stagedOwner = sourceParams.metadata!.row.get(`shared`)
+      remoteWrite?.({
+        type: `insert`,
+        value: {
+          id: `dependent`,
+          title:
+            (stagedOwner as { owner?: string } | undefined)?.owner ?? `missing`,
+        },
+      })
+      dependentReceipt = Promise.resolve(remoteCommit?.()).then(() => undefined)
+      void dependentReceipt.catch(() => undefined)
+
+      expect(stagedOwner).toEqual({ owner: `aborted` })
+      aborted.abort()
+      expect(collection.get(`dependent`)).toBeUndefined()
+      localPersistence.resolve()
+      await localTransaction.isPersisted.promise
+      const abortedOutcome = await atPersistedOracleCheckpoint(
+        abortedReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `accepted predecessor receipt settled`,
+      )
+      const dependentOutcome = await atPersistedOracleCheckpoint(
+        dependentReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `post-abort staged suffix settled`,
+      )
+      expect({
+        abortedStatus: abortedOutcome.status,
+        dependentStatus: dependentOutcome.status,
+        status: collection.status,
+        visibleDependent: stripVirtualProps(collection.get(`dependent`)),
+        durableDependent: adapter.rows.get(`dependent`),
+        durableMetadata: adapter.rowMetadata.get(`shared`),
+      }).toEqual({
+        abortedStatus: `fulfilled`,
+        dependentStatus: `fulfilled`,
+        status: `ready`,
+        visibleDependent: { id: `dependent`, title: `aborted` },
+        durableDependent: { id: `dependent`, title: `aborted` },
+        durableMetadata: { owner: `aborted` },
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      localPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => localTransaction.isPersisted.promise.catch(() => undefined),
+          () => abortedReceipt?.catch(() => undefined),
+          () => dependentReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects a wrapped sync receipt with a named terminal persistence error`, async () => {
+    const adapter = createRecordingAdapter()
+    const adapterError = Object.assign(
+      new Error(`adapter write failed exactly`),
+      {
+        code: `SQLITE_FULL`,
+        path: `adapter.applyCommittedTx`,
+      },
+    )
+    const persistenceEntered = createEventGate()
+    const persistence = createEventGate()
+    adapter.applyCommittedTx = async () => {
+      persistenceEntered.resolve()
+      await persistence.promise
+    }
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-persistence-error`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let hasPrimaryFailure = false
+
+    try {
+      await collection.stateWhenReady()
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `failed`, title: `Not durable` },
+      })
+      const receipt = Promise.resolve(remoteCommit?.()).then(() => undefined)
+      const settlement = observeSettlement(receipt)
+      await atPersistedOracleCheckpoint(
+        persistenceEntered.promise,
+        `terminal persistence entered`,
+      )
+      await flushAsyncWork()
+
+      expect({
+        receipt: settlement.read(),
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        visible: stripVirtualProps(collection.get(`failed`)),
+        durable: adapter.rows.get(`failed`),
+      }).toEqual({
+        receipt: { status: `pending` },
+        status: `ready`,
+        publicError: undefined,
+        visible: { id: `failed`, title: `Not durable` },
+        durable: undefined,
+      })
+
+      persistence.reject(adapterError)
+      const outcome = await receipt.then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+
+      const publicError = collection._lifecycle.getSyncError()
+      const receiptError =
+        outcome.status === `rejected` && outcome.reason instanceof Error
+          ? (outcome.reason as Error & {
+              code?: unknown
+              path?: unknown
+            })
+          : undefined
+      expect({
+        receiptStatus: outcome.status,
+        receiptErrorName: receiptError?.name,
+        receiptHasNamedPersistenceSemantics:
+          outcome.status === `rejected` &&
+          outcome.reason instanceof PersistedCollectionDurabilityError,
+        receiptCauseIsAdapterError: receiptError?.cause === adapterError,
+        receiptErrorCode: receiptError?.code,
+        receiptErrorPath: receiptError?.path,
+        publicErrorIsReceipt:
+          outcome.status === `rejected` && publicError === outcome.reason,
+        status: collection.status,
+        visible: stripVirtualProps(collection.get(`failed`)),
+        durable: adapter.rows.get(`failed`),
+      }).toEqual({
+        receiptStatus: `rejected`,
+        receiptErrorName: `PersistedCollectionDurabilityError`,
+        receiptHasNamedPersistenceSemantics: true,
+        receiptCauseIsAdapterError: true,
+        receiptErrorCode: `SQLITE_FULL`,
+        receiptErrorPath: `adapter.applyCommittedTx`,
+        publicErrorIsReceipt: true,
+        status: `crashed`,
+        visible: { id: `failed`, title: `Not durable` },
+        durable: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      persistence.reject(adapterError)
+      await cleanupPersistedOracle(
+        [() => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`publishes before persistence settles, then fails with the named durability error`, async () => {
+    const adapter = createRecordingAdapter()
+    const persistenceError = Object.assign(new Error(`persistence failed`), {
+      code: `SQLITE_IOERR_WRITE`,
+      path: `todos.sqlite-wal`,
+    })
+    let rejectPersistence: ((error: unknown) => void) | undefined
+    adapter.applyCommittedTx = () =>
+      new Promise<void>((_resolve, reject) => {
+        rejectPersistence = reject
+      })
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `sync-present-persistence-error-main`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+
+    try {
+      await collection.stateWhenReady()
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `failed`, title: `Not durable` },
+      })
+      const receipt = Promise.resolve(remoteCommit?.())
+      let settled = false
+      void receipt.then(
+        () => {
+          settled = true
+        },
+        () => {
+          settled = true
+        },
+      )
+
+      expect(stripVirtualProps(collection.get(`failed`))).toEqual({
+        id: `failed`,
+        title: `Not durable`,
+      })
+      expect(settled).toBe(false)
+      await vi.waitFor(() => expect(rejectPersistence).toBeTypeOf(`function`))
+
+      rejectPersistence!(persistenceError)
+      const rejection = await receipt.then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+
+      expect(rejection).not.toBe(persistenceError)
+      expect(rejection).toMatchObject({
+        name: `PersistedCollectionDurabilityError`,
+        code: `SQLITE_IOERR_WRITE`,
+        path: `todos.sqlite-wal`,
+        cause: persistenceError,
+      })
+      expect(adapter.rows.get(`failed`)).toBeUndefined()
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(rejection)
+    } finally {
+      rejectPersistence?.(persistenceError)
+      await collection.cleanup()
+    }
+  })
+
+  it(`preserves a coordinator persistence classification without converting it to conflict`, async () => {
+    const coordinator = createCoordinatorHarness()
+    const persistenceResponse = {
+      type: `rpc:applyCommittedTx:res` as const,
+      rpcId: `persistence-response`,
+      ok: false as const,
+      code: `PERSISTENCE_ERROR` as const,
+      error: `disk write failed`,
+      sourceCode: `SQLITE_IOERR_FSYNC`,
+      path: [`database`, `wal`] as const,
+    }
+    coordinator.requestApplyCommittedTx = () =>
+      Promise.resolve(persistenceResponse)
+    let remoteBegin: (() => void) | undefined
+    let remoteWrite:
+      ((message: { type: `insert`; value: Todo }) => void) | undefined
+    let remoteCommit: (() => true | Promise<void>) | undefined
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `coordinator-persistence-error`,
+        getKey: (item) => item.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            remoteBegin = begin
+            remoteWrite = write as (message: {
+              type: `insert`
+              value: Todo
+            }) => void
+            remoteCommit = commit
+            markReady()
+          },
+        },
+        persistence: { adapter: createRecordingAdapter(), coordinator },
+      }),
+    )
+
+    try {
+      await collection.stateWhenReady()
+      remoteBegin?.()
+      remoteWrite?.({
+        type: `insert`,
+        value: { id: `remote-failure`, title: `Published once` },
+      })
+      const rejection = await Promise.resolve(remoteCommit?.()).then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+
+      expect(rejection).toMatchObject({
+        name: `PersistedCollectionDurabilityError`,
+        code: `SQLITE_IOERR_FSYNC`,
+        path: [`database`, `wal`],
+        cause: persistenceResponse,
+      })
+      expect(String(rejection)).not.toContain(`CONFLICT`)
+      expect(collection.status).toBe(`crashed`)
+      expect(collection._lifecycle.getSyncError()).toBe(rejection)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it.each([`response`, `rejection`] as const)(
+    `installs terminal state before synchronously reporting an external coordinator persistence %s`,
+    async (failureMode) => {
+      const coordinator = createCoordinatorHarness()
+      const persistenceResponse = {
+        type: `rpc:applyCommittedTx:res` as const,
+        rpcId: `reentrant-${failureMode}`,
+        ok: false as const,
+        code: `PERSISTENCE_ERROR` as const,
+        error: `disk write failed`,
+        sourceCode: `SQLITE_IOERR_FSYNC`,
+        path: [`database`, `wal`] as const,
+      }
+      const rejectedError = new PersistedCollectionDurabilityError(
+        `coordinator persistence request rejected`,
+        {
+          cause: persistenceResponse,
+          code: persistenceResponse.sourceCode,
+          path: persistenceResponse.path,
+        },
+      )
+      const requestApplyCommittedTx = vi.fn(() =>
+        failureMode === `response`
+          ? Promise.resolve(persistenceResponse)
+          : Promise.reject(rejectedError),
+      )
+      coordinator.requestApplyCommittedTx = requestApplyCommittedTx
+      let sourceParams!: TodoSyncParams
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: `terminal-before-report-${failureMode}`,
+          getKey: (item) => item.id,
+          sync: {
+            sync: (params) => {
+              sourceParams = params
+              params.markReady()
+            },
+          },
+          persistence: { adapter: createRecordingAdapter(), coordinator },
+        }),
+      )
+      let reentrantKeyReads = 0
+      let reentrantReceipt:
+        | Promise<
+            { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+          >
+        | undefined
+      let hasPrimaryFailure = false
+
+      try {
+        await collection.stateWhenReady()
+        const originalCrash = collection._lifecycle.crash.bind(
+          collection._lifecycle,
+        )
+        vi.spyOn(collection._lifecycle, `crash`).mockImplementation((error) => {
+          sourceParams.begin()
+          sourceParams.write({
+            type: `insert`,
+            value: {
+              get id() {
+                reentrantKeyReads++
+                return `reentrant`
+              },
+              title: `must be fenced before error observation`,
+            },
+          })
+          reentrantReceipt = Promise.resolve(sourceParams.commit()).then(
+            () => ({ status: `fulfilled` as const }),
+            (reason: unknown) => ({ status: `rejected` as const, reason }),
+          )
+          originalCrash(error)
+        })
+
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `failed`, title: `must become terminal first` },
+        })
+        const primaryOutcome = await Promise.resolve(
+          sourceParams.commit(),
+        ).then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        )
+        const reentrantOutcome = await atPersistedOracleCheckpoint(
+          reentrantReceipt!,
+          `reentrant source receipt after coordinator ${failureMode}`,
+        )
+        const terminalError =
+          primaryOutcome.status === `rejected`
+            ? primaryOutcome.reason
+            : undefined
+
+        expect({
+          primaryStatus: primaryOutcome.status,
+          reentrantStatus: reentrantOutcome.status,
+          sameTerminal:
+            reentrantOutcome.status === `rejected` &&
+            reentrantOutcome.reason === terminalError,
+          reentrantKeyReads,
+          coordinatorCalls: requestApplyCommittedTx.mock.calls.length,
+          exactPublicError:
+            collection._lifecycle.getSyncError() === terminalError,
+        }).toEqual({
+          primaryStatus: `rejected`,
+          reentrantStatus: `rejected`,
+          sameTerminal: true,
+          reentrantKeyReads: 0,
+          coordinatorCalls: 1,
+          exactPublicError: true,
+        })
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        await cleanupPersistedOracle(
+          [() => reentrantReceipt, () => collection.cleanup()],
+          hasPrimaryFailure,
+        )
+      }
+    },
+  )
+
+  it(`keeps durability failure terminal when publication aborts the signal`, async () => {
+    const adapter = createRecordingAdapter()
+    const storageError = Object.assign(
+      new Error(`post-publication durability failed exactly`),
+      {
+        code: `SQLITE_IOERR`,
+        path: `adapter.applyCommittedTx`,
+      },
+    )
+    const persistenceEntered = createEventGate()
+    const releasePersistence = createEventGate()
+    adapter.applyCommittedTx = async () => {
+      persistenceEntered.resolve()
+      await releasePersistence.promise
+      throw storageError
+    }
+    let sourceParams!: TodoSyncParams
+    const abortController = new AbortController()
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `post-publication-abort-durability`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const publication = collection.subscribeChanges((changes) => {
+      if (changes.some((entry) => entry.key === `failed`)) {
+        abortController.abort()
+      }
+    })
+    let receipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `post-publication abort collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `failed`, title: `visible before durability` },
+      })
+      receipt = Promise.resolve(
+        sourceParams.commit(abortController.signal),
+      ).then(() => undefined)
+      void receipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        persistenceEntered.promise,
+        `post-publication abort persistence entered`,
+      )
+
+      expect({
+        signalAborted: abortController.signal.aborted,
+        visible: stripVirtualProps(collection.get(`failed`)),
+        status: collection.status,
+      }).toEqual({
+        signalAborted: true,
+        visible: { id: `failed`, title: `visible before durability` },
+        status: `ready`,
+      })
+
+      releasePersistence.resolve()
+      const outcome = await atPersistedOracleCheckpoint(
+        receipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `post-publication abort durability receipt`,
+      )
+      const terminalError =
+        outcome.status === `rejected` ? outcome.reason : undefined
+
+      expect({
+        receiptStatus: outcome.status,
+        namedDurability:
+          terminalError instanceof PersistedCollectionDurabilityError,
+        cause: terminalError instanceof Error ? terminalError.cause : undefined,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+        status: collection.status,
+        durable: adapter.rows.get(`failed`),
+      }).toEqual({
+        receiptStatus: `rejected`,
+        namedDurability: true,
+        cause: storageError,
+        exactPublicError: true,
+        status: `crashed`,
+        durable: undefined,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releasePersistence.resolve()
+      publication.unsubscribe()
+      await cleanupPersistedOracle(
+        [() => receipt?.catch(() => undefined), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`reserves FIFO admission before a publication callback commits a sibling`, async () => {
+    const adapter = createRecordingAdapter()
+    const successfulApply = adapter.applyCommittedTx.bind(adapter)
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    const firstStorageError = new Error(`reentrant first durability failed`)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+        throw firstStorageError
+      }
+      await successfulApply(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `reentrant-fifo-admission`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let siblingReceipt: Promise<void> | undefined
+    let publicationTriggers = 0
+    const subscription = collection.subscribeChanges((changes) => {
+      if (
+        publicationTriggers === 0 &&
+        changes.some((entry) => entry.key === `first`)
+      ) {
+        publicationTriggers++
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `sibling`, title: `must remain queued` },
+        })
+        siblingReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void siblingReceipt.catch(() => undefined)
+      }
+    })
+    let firstReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `reentrant FIFO collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `first`, title: `publishes before durability` },
+      })
+      firstReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void firstReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `reentrant first persistence entered`,
+      )
+      await Promise.resolve()
+
+      expect(siblingReceipt).toBeInstanceOf(Promise)
+      const firstSettlement = observeSettlement(firstReceipt)
+      const siblingSettlement = observeSettlement(siblingReceipt!)
+      await Promise.resolve()
+      expect({
+        publicationTriggers,
+        applyCalls,
+        firstReceipt: firstSettlement.read(),
+        siblingReceipt: siblingSettlement.read(),
+        visibleFirst: stripVirtualProps(collection.get(`first`)),
+        visibleSibling: collection.get(`sibling`),
+        durableFirst: adapter.rows.get(`first`),
+        durableSibling: adapter.rows.get(`sibling`),
+      }).toEqual({
+        publicationTriggers: 1,
+        applyCalls: 1,
+        firstReceipt: { status: `pending` },
+        siblingReceipt: { status: `pending` },
+        visibleFirst: { id: `first`, title: `publishes before durability` },
+        visibleSibling: undefined,
+        durableFirst: undefined,
+        durableSibling: undefined,
+      })
+
+      releaseFirstPersistence.resolve()
+      const firstOutcome = await atPersistedOracleCheckpoint(
+        firstReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `reentrant first receipt rejected`,
+      )
+      const siblingOutcome = await atPersistedOracleCheckpoint(
+        siblingReceipt!.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `reentrant sibling receipt rejected`,
+      )
+      const terminalError =
+        firstOutcome.status === `rejected` ? firstOutcome.reason : undefined
+      expect({
+        firstStatus: firstOutcome.status,
+        siblingStatus: siblingOutcome.status,
+        sameTerminal:
+          siblingOutcome.status === `rejected` &&
+          siblingOutcome.reason === terminalError,
+        status: collection.status,
+        publicErrorIsFirst:
+          collection._lifecycle.getSyncError() === terminalError,
+        visibleSibling: collection.get(`sibling`),
+        durableSibling: adapter.rows.get(`sibling`),
+        applyCalls,
+      }).toEqual({
+        firstStatus: `rejected`,
+        siblingStatus: `rejected`,
+        sameTerminal: true,
+        status: `crashed`,
+        publicErrorIsFirst: true,
+        visibleSibling: undefined,
+        durableSibling: undefined,
+        applyCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      subscription.unsubscribe()
+      await cleanupPersistedOracle(
+        [
+          () => firstReceipt?.catch(() => undefined),
+          () => siblingReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`keeps a reentrant sibling behind its hydration-drained parent outcome`, async () => {
+    const adapter = createRecordingAdapter()
+    const loadEntered = createEventGate()
+    const rejectLoad = createEventGate()
+    const subsetFailure = new Error(`request-local hydration failed`)
+    adapter.loadSubset = async () => {
+      loadEntered.resolve()
+      await rejectLoad.promise
+      throw subsetFailure
+    }
+    const persistenceEntered = createEventGate()
+    const releasePersistence = createEventGate()
+    const durabilityFailure = new Error(`hydration-drained durability failed`)
+    let applyCalls = 0
+    adapter.applyCommittedTx = async () => {
+      applyCalls++
+      persistenceEntered.resolve()
+      await releasePersistence.promise
+      throw durabilityFailure
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `hydration-drained-reentrant-fifo`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+            return { loadSubset: () => true }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let siblingReceipt: Promise<void> | undefined
+    const publication = collection.subscribeChanges((changes) => {
+      if (
+        siblingReceipt === undefined &&
+        changes.some((change) => change.key === `parent`)
+      ) {
+        sourceParams.begin()
+        sourceParams.write({
+          type: `insert`,
+          value: { id: `sibling`, title: `Must await parent outcome` },
+        })
+        siblingReceipt = Promise.resolve(sourceParams.commit()).then(
+          () => undefined,
+        )
+        void siblingReceipt.catch(() => undefined)
+      }
+    })
+    let load: Promise<void> | undefined
+    let parentReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `hydration-drained FIFO collection ready`,
+      )
+      load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+        () => undefined,
+      )
+      void load.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        loadEntered.promise,
+        `hydration-drained load entered`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `parent`, title: `Publishes during failure drain` },
+      })
+      parentReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void parentReceipt.catch(() => undefined)
+      rejectLoad.resolve()
+      await atPersistedOracleCheckpoint(
+        persistenceEntered.promise,
+        `hydration-drained parent persistence entered`,
+      )
+      await Promise.resolve()
+
+      expect(siblingReceipt).toBeInstanceOf(Promise)
+      const parentSettlement = observeSettlement(parentReceipt)
+      const siblingSettlement = observeSettlement(siblingReceipt!)
+      await Promise.resolve()
+      expect({
+        applyCalls,
+        parentReceipt: parentSettlement.read(),
+        siblingReceipt: siblingSettlement.read(),
+        publicParent: stripVirtualProps(collection.get(`parent`)),
+        publicSibling: collection.get(`sibling`),
+        durableSibling: adapter.rows.get(`sibling`),
+      }).toEqual({
+        applyCalls: 1,
+        parentReceipt: { status: `pending` },
+        siblingReceipt: { status: `pending` },
+        publicParent: { id: `parent`, title: `Publishes during failure drain` },
+        publicSibling: undefined,
+        durableSibling: undefined,
+      })
+
+      releasePersistence.resolve()
+      const parentOutcome = await atPersistedOracleCheckpoint(
+        parentReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `hydration-drained parent rejected`,
+      )
+      const siblingOutcome = await atPersistedOracleCheckpoint(
+        siblingReceipt!.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `hydration-drained sibling rejected`,
+      )
+      const loadOutcome = await atPersistedOracleCheckpoint(
+        load.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `hydration-drained load settled`,
+      )
+      const terminalError =
+        parentOutcome.status === `rejected` ? parentOutcome.reason : undefined
+
+      expect({
+        parentStatus: parentOutcome.status,
+        siblingStatus: siblingOutcome.status,
+        loadStatus: loadOutcome.status,
+        sameSibling:
+          siblingOutcome.status === `rejected` &&
+          siblingOutcome.reason === terminalError,
+        sameLoad:
+          loadOutcome.status === `rejected` &&
+          loadOutcome.reason === terminalError,
+        namedDurability:
+          terminalError instanceof PersistedCollectionDurabilityError,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        publicSibling: collection.get(`sibling`),
+        applyCalls,
+      }).toEqual({
+        parentStatus: `rejected`,
+        siblingStatus: `rejected`,
+        loadStatus: `rejected`,
+        sameSibling: true,
+        sameLoad: true,
+        namedDurability: true,
+        status: `crashed`,
+        publicError: terminalError,
+        publicSibling: undefined,
+        applyCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      rejectLoad.resolve()
+      releasePersistence.resolve()
+      publication.unsubscribe()
+      await cleanupPersistedOracle(
+        [
+          () => load?.catch(() => undefined),
+          () => parentReceipt?.catch(() => undefined),
+          () => siblingReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`rejects a queued suffix derived from an aborted staged metadata layer`, async () => {
+    const adapter = createRecordingAdapter()
+    const successfulApply = adapter.applyCommittedTx.bind(adapter)
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await successfulApply(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `aborted-staged-metadata-suffix`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const aborted = new AbortController()
+    let firstReceipt: Promise<void> | undefined
+    let abortedReceipt: Promise<void> | undefined
+    let dependentReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `aborted staged metadata collection ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `first`, title: `durability gate` },
+      })
+      firstReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void firstReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `first persistence entered before staged suffix`,
+      )
+
+      sourceParams.begin()
+      sourceParams.metadata!.row.set(`shared`, { owner: `aborted` })
+      abortedReceipt = Promise.resolve(
+        sourceParams.commit(aborted.signal),
+      ).then(() => undefined)
+      void abortedReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      const stagedOwner = sourceParams.metadata!.row.get(`shared`)
+      sourceParams.write({
+        type: `insert`,
+        value: {
+          id: `dependent`,
+          title:
+            (stagedOwner as { owner?: string } | undefined)?.owner ?? `missing`,
+        },
+      })
+      dependentReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void dependentReceipt.catch(() => undefined)
+
+      expect(stagedOwner).toEqual({ owner: `aborted` })
+      aborted.abort()
+      releaseFirstPersistence.resolve()
+      await atPersistedOracleCheckpoint(
+        firstReceipt,
+        `first durability gate settled`,
+      )
+      const abortedOutcome = await atPersistedOracleCheckpoint(
+        abortedReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `aborted staged receipt settled`,
+      )
+      const dependentOutcome = await atPersistedOracleCheckpoint(
+        dependentReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `dependent staged receipt settled`,
+      )
+      const terminalError =
+        abortedOutcome.status === `rejected` ? abortedOutcome.reason : undefined
+
+      expect({
+        abortedStatus: abortedOutcome.status,
+        abortedName:
+          terminalError instanceof Error ? terminalError.name : undefined,
+        dependentStatus: dependentOutcome.status,
+        dependentExact:
+          dependentOutcome.status === `rejected` &&
+          dependentOutcome.reason === terminalError,
+        status: collection.status,
+        exactPublicError:
+          collection._lifecycle.getSyncError() === terminalError,
+        visibleDependent: collection.get(`dependent`),
+        durableDependent: adapter.rows.get(`dependent`),
+        durableMetadata: adapter.rowMetadata.get(`shared`),
+        applyCalls,
+      }).toEqual({
+        abortedStatus: `rejected`,
+        abortedName: `AbortError`,
+        dependentStatus: `rejected`,
+        dependentExact: true,
+        status: `crashed`,
+        exactPublicError: true,
+        visibleDependent: undefined,
+        durableDependent: undefined,
+        durableMetadata: undefined,
+        applyCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => firstReceipt?.catch(() => undefined),
+          () => abortedReceipt?.catch(() => undefined),
+          () => dependentReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not fail-stop when an aborted staged collection metadata write was superseded`, async () => {
+    const adapter = createRecordingAdapter()
+    const successfulApply = adapter.applyCommittedTx.bind(adapter)
+    const firstPersistenceEntered = createEventGate()
+    const releaseFirstPersistence = createEventGate()
+    let applyCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      applyCalls++
+      if (applyCalls === 1) {
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await successfulApply(...args)
+    }
+    let sourceParams!: TodoSyncParams
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `superseded-staged-collection-metadata`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    const olderAbort = new AbortController()
+    let firstReceipt: Promise<void> | undefined
+    let olderReceipt: Promise<void> | undefined
+    let newerReceipt: Promise<void> | undefined
+    let dependentReceipt: Promise<void> | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `superseded collection metadata owner ready`,
+      )
+
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `first`, title: `durability gate` },
+      })
+      firstReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void firstReceipt.catch(() => undefined)
+      await atPersistedOracleCheckpoint(
+        firstPersistenceEntered.promise,
+        `first persistence entered before superseded metadata writes`,
+      )
+
+      sourceParams.begin()
+      sourceParams.metadata!.collection.set(`shared`, { owner: `older` })
+      olderReceipt = Promise.resolve(
+        sourceParams.commit(olderAbort.signal),
+      ).then(() => undefined)
+      void olderReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      sourceParams.metadata!.collection.set(`shared`, { owner: `newer` })
+      newerReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void newerReceipt.catch(() => undefined)
+
+      sourceParams.begin()
+      const stagedOwner = sourceParams
+        .metadata!.collection.list()
+        .find(({ key }) => key === `shared`)?.value
+      sourceParams.write({
+        type: `insert`,
+        value: {
+          id: `dependent`,
+          title:
+            (stagedOwner as { owner?: string } | undefined)?.owner ?? `missing`,
+        },
+      })
+      dependentReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => undefined,
+      )
+      void dependentReceipt.catch(() => undefined)
+
+      expect(stagedOwner).toEqual({ owner: `newer` })
+      olderAbort.abort()
+      releaseFirstPersistence.resolve()
+      await atPersistedOracleCheckpoint(
+        firstReceipt,
+        `superseded metadata durability gate settled`,
+      )
+      const olderOutcome = await atPersistedOracleCheckpoint(
+        olderReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `superseded older metadata receipt settled`,
+      )
+      const newerOutcome = await atPersistedOracleCheckpoint(
+        newerReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `newer metadata receipt settled`,
+      )
+      const dependentOutcome = await atPersistedOracleCheckpoint(
+        dependentReceipt.then(
+          () => ({ status: `fulfilled` as const }),
+          (reason: unknown) => ({ status: `rejected` as const, reason }),
+        ),
+        `newest-owner dependent receipt settled`,
+      )
+
+      expect({
+        olderStatus: olderOutcome.status,
+        newerStatus: newerOutcome.status,
+        dependentStatus: dependentOutcome.status,
+        status: collection.status,
+        publicError: collection._lifecycle.getSyncError(),
+        visibleDependent: stripVirtualProps(collection.get(`dependent`)),
+        durableDependent: adapter.rows.get(`dependent`),
+        durableMetadata: adapter.collectionMetadata.get(`shared`),
+        applyCalls,
+      }).toEqual({
+        olderStatus: `rejected`,
+        newerStatus: `fulfilled`,
+        dependentStatus: `fulfilled`,
+        status: `ready`,
+        publicError: undefined,
+        visibleDependent: { id: `dependent`, title: `newer` },
+        durableDependent: { id: `dependent`, title: `newer` },
+        durableMetadata: { owner: `newer` },
+        applyCalls: 3,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseFirstPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => firstReceipt?.catch(() => undefined),
+          () => olderReceipt?.catch(() => undefined),
+          () => newerReceipt?.catch(() => undefined),
+          () => dependentReceipt?.catch(() => undefined),
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not let an old external coordinator success affect a restarted lifecycle`, async () => {
+    const id = `external-lifecycle-success`
+    const adapter = createRecordingAdapter()
+    const oldPersistenceEntered = createEventGate()
+    const releaseOldPersistence = createEventGate()
+    const coordinator = createFailStopCoordinatorHarness(id)
+    let requestCalls = 0
+    coordinator.requestApplyCommittedTx = async (_collectionId, tx) => {
+      requestCalls++
+      oldPersistenceEntered.resolve()
+      await releaseOldPersistence.promise
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+    let sourceParams!: TodoSyncParams
+    const replacement = {
+      id: `replacement`,
+      title: `owned by restarted lifecycle`,
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    let oldSettlement:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let cleanedUp = false
+    let hasPrimaryFailure = false
+
+    try {
+      await atPersistedOracleCheckpoint(
+        collection.stateWhenReady(),
+        `${id} initial lifecycle ready`,
+      )
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `old`, title: `must remain owned by old lifecycle` },
+      })
+      oldSettlement = Promise.resolve(sourceParams.commit()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        oldPersistenceEntered.promise,
+        `${id} old persistence entered`,
+      )
+
+      await collection.cleanup()
+      cleanedUp = true
+      adapter.rows.set(replacement.id, replacement)
+      collection.startSyncImmediate()
+      cleanedUp = false
+      const replacementSettlement = collection.stateWhenReady().then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      releaseOldPersistence.resolve()
+
+      const oldOutcome = await atPersistedOracleCheckpoint(
+        oldSettlement,
+        `${id} old receipt settled`,
+      )
+      const replacementOutcome = await atPersistedOracleCheckpoint(
+        replacementSettlement,
+        `${id} replacement lifecycle settled`,
+      )
+      await flushAsyncWork()
+
+      expect({
+        oldReceiptStatus: oldOutcome.status,
+        replacementStatus: replacementOutcome.status,
+        replacementVisible: stripVirtualProps(collection.get(replacement.id)),
+        replacementPublicError: collection._lifecycle.getSyncError(),
+        staleBroadcasts: coordinator.publishCalls.length,
+        requestCalls,
+      }).toEqual({
+        oldReceiptStatus: `fulfilled`,
+        replacementStatus: `fulfilled`,
+        replacementVisible: replacement,
+        replacementPublicError: undefined,
+        staleBroadcasts: 0,
+        requestCalls: 1,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseOldPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => oldSettlement,
+          () => (cleanedUp ? undefined : collection.cleanup()),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+
+  it(`does not let an old external coordinator failure poison a restarted lifecycle`, async () => {
+    const id = `external-lifecycle-failure`
+    const adapter = createRecordingAdapter()
+    const oldPersistenceEntered = createEventGate()
+    const releaseOldPersistence = createEventGate()
+    const oldCoordinatorError = new PersistedCollectionDurabilityError(
+      `old lifecycle coordinator failure`,
+      { code: `SQLITE_IOERR_FSYNC`, path: [`database`, `wal`] },
+    )
+    const coordinator = createFailStopCoordinatorHarness(id)
+    let requestCalls = 0
+    coordinator.requestApplyCommittedTx = async (_collectionId, tx) => {
+      requestCalls++
+      if (requestCalls === 1) {
+        oldPersistenceEntered.resolve()
+        await releaseOldPersistence.promise
+        throw oldCoordinatorError
+      }
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+    let sourceParams!: TodoSyncParams
+    const replacement = {
+      id: `replacement`,
+      title: `owned by restarted lifecycle`,
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            sourceParams = params
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const startAndWaitForReady = async (label: string) => {
+      const ready = createEventGate()
+      const unsubscribe = collection.on(`status:ready`, () => ready.resolve())
+      collection.startSyncImmediate()
+      try {
+        await atPersistedOracleCheckpoint(ready.promise, label)
+      } finally {
+        unsubscribe()
+      }
+    }
+    let oldSettlement:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let replacementReceipt:
+      | Promise<
+          { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+        >
+      | undefined
+    let hasPrimaryFailure = false
+
+    try {
+      await startAndWaitForReady(`${id} initial lifecycle ready`)
+      sourceParams.begin()
+      sourceParams.write({
+        type: `insert`,
+        value: { id: `old`, title: `must remain owned by old lifecycle` },
+      })
+      oldSettlement = Promise.resolve(sourceParams.commit()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      await atPersistedOracleCheckpoint(
+        oldPersistenceEntered.promise,
+        `${id} old persistence entered`,
+      )
+
+      await collection.cleanup()
+      await startAndWaitForReady(
+        `${id} replacement lifecycle ready before old failure`,
+      )
+      sourceParams.begin()
+      sourceParams.write({ type: `insert`, value: replacement })
+      replacementReceipt = Promise.resolve(sourceParams.commit()).then(
+        () => ({ status: `fulfilled` as const }),
+        (reason: unknown) => ({ status: `rejected` as const, reason }),
+      )
+      releaseOldPersistence.resolve()
+
+      const oldOutcome = await atPersistedOracleCheckpoint(
+        oldSettlement,
+        `${id} old receipt settled`,
+      )
+      const replacementOutcome = await atPersistedOracleCheckpoint(
+        replacementReceipt,
+        `${id} replacement transaction settled`,
+      )
+      await flushAsyncWork()
+
+      expect({
+        oldReceiptStatus: oldOutcome.status,
+        replacementStatus: replacementOutcome.status,
+        replacementVisible: stripVirtualProps(collection.get(replacement.id)),
+        replacementPublicError: collection._lifecycle.getSyncError(),
+        broadcasts: coordinator.publishCalls.length,
+        requestCalls,
+      }).toEqual({
+        oldReceiptStatus: `rejected`,
+        replacementStatus: `fulfilled`,
+        replacementVisible: replacement,
+        replacementPublicError: undefined,
+        broadcasts: 0,
+        requestCalls: 2,
+      })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseOldPersistence.resolve()
+      await cleanupPersistedOracle(
+        [
+          () => oldSettlement,
+          () => replacementReceipt,
+          () => collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  })
+})
+
+// The immutable authored order is crossing→later. The model has no coordinator
+// route or runtime lifecycle: a durable exact-ID hit contributes crossing once;
+// otherwise a certified empty interval lets the replacement apply it once.
+function modelSourceReconciliation(committedBeforeClose: boolean) {
+  const before = committedBeforeClose ? [`crossing`] : []
+  return {
+    atUncertain: {
+      publicIds: [`crossing`],
+      durableIds: before,
+      cursor: committedBeforeClose ? `crossing` : null,
+    },
+    afterReconciliation: {
+      publicIds: [`crossing`],
+      liveIds: [`crossing`],
+      liveStatus: `ready`,
+      durableIds: [`crossing`],
+      cursor: `crossing`,
+      syncRuns: 1,
+      durableTxCount: 1,
+    },
+    afterSuffix: {
+      publicIds: [`crossing`, `later`],
+      liveIds: [`crossing`, `later`],
+      liveStatus: `ready`,
+      durableIds: [`crossing`, `later`],
+      cursor: `later`,
+      syncRuns: 1,
+      durableTxCount: 2,
+    },
+  }
+}
+
+// The controlled coordinator loses one source RPC answer after either storing
+// its transaction or storing nothing. It holds the exact-ID reconciliation so
+// the driver can compare the pending receipt and public/durable state at the
+// uncertainty cut. Browser/SQLite owns the atomic absence proof and actual
+// election; this driver checks the wrapped receipt and dependent query path.
+it.each([false, true])(
+  `reconciles a source receipt without ending its dependent live query when applied=%s`,
+  async (committedBeforeClose) => {
+    const expected = modelSourceReconciliation(committedBeforeClose)
+    const adapter = createRecordingAdapter()
+    const coordinator = createCoordinatorHarness()
+    const error = new IndeterminateCommitError({
+      collectionId: `source-restart`,
+      requestType: `rpc:applyCommittedTx:req`,
+      previousLeaderId: `retired`,
+      previousTerm: 1,
+      currentLeaderId: `replacement`,
+      currentTerm: 2,
+      cause: new Error(`lost response`),
+    })
+    let first = true
+    const reconciliationEntered = createDeferred()
+    const releaseReconciliation = createDeferred()
+    let durableFirstTx: PersistedTx | undefined
+    coordinator.requestApplyCommittedTx = async (collectionId, tx) => {
+      if (first) {
+        first = false
+        if (committedBeforeClose) {
+          await adapter.applyCommittedTx(
+            { kind: `eager`, collectionId: collectionId },
+            tx,
+          )
+          durableFirstTx = tx
+        }
+        throw error
+      }
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        tx,
+      )
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+    coordinator.reconcileCommittedTx = async (collectionId, tx, anchor) => {
+      expect(anchor.latestRowVersion).toBe(0)
+      reconciliationEntered.resolve()
+      await releaseReconciliation.promise
+      const alreadyApplied = durableFirstTx !== undefined
+      const committed = alreadyApplied
+        ? durableFirstTx!
+        : { ...tx, term: 2, seq: 1, rowVersion: 1 }
+      if (!alreadyApplied)
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          committed,
+        )
+      return {
+        type: `rpc:reconcileCommittedTx:res`,
+        rpcId: `controlled-reconciliation`,
+        ok: true,
+        alreadyApplied,
+        committed: {
+          term: committed.term,
+          seq: committed.seq,
+          rowVersion: committed.rowVersion,
+        },
+      }
+    }
+
+    let source!: TodoSyncParams
+    let syncRuns = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Todo, string>({
+        id: `source-restart`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            syncRuns++
+            params.markReady()
+          },
+        },
+        persistence: { adapter, coordinator },
+      }),
+    )
+    const live = createLiveQueryCollection((q) => q.from({ row: collection }))
+    const livePublishedKeys: Array<string> = []
+    const liveSubscription = live.subscribeChanges((changes) => {
+      livePublishedKeys.push(...changes.map(({ key }) => String(key)))
+    })
+    let hasPrimaryFailure = false
+    const observe = () => ({
+      publicIds: [...collection.keys()].sort(),
+      liveIds: [...live.keys()].sort(),
+      liveStatus: live.status,
+      durableIds: [...adapter.rows.keys()].sort(),
+      cursor: adapter.collectionMetadata.get(`probe:cursor`) ?? null,
+    })
+
+    try {
+      await atPersistedOracleCheckpoint(collection.preload(), `initial ready`)
+      await atPersistedOracleCheckpoint(
+        live.preload(),
+        `dependent live query ready`,
+      )
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `crossing`, title: `source` },
+      })
+      source.metadata?.collection.set(`probe:cursor`, `crossing`)
+      const firstReceipt = Promise.resolve(source.commit()).then(
+        () => undefined,
+      )
+      const firstSettlement = observeSettlement(firstReceipt)
+      await atPersistedOracleCheckpoint(
+        reconciliationEntered.promise,
+        `exact-ID reconciliation entered`,
+      )
+      expect(firstSettlement.read()).toEqual({ status: `pending` })
+      expect({
+        publicIds: [...collection.keys()].sort(),
+        durableIds: [...adapter.rows.keys()].sort(),
+        cursor: adapter.collectionMetadata.get(`probe:cursor`) ?? null,
+      }).toEqual(expected.atUncertain)
+      expect(live.status).toBe(`ready`)
+      releaseReconciliation.resolve()
+      await atPersistedOracleCheckpoint(
+        firstReceipt,
+        `reconciled source receipt`,
+      )
+
+      expect(firstSettlement.read()).toEqual({ status: `fulfilled` })
+      expect({ status: collection.status, syncRuns }).toEqual({
+        status: `ready`,
+        syncRuns: 1,
+      })
+      expect({
+        ...observe(),
+        syncRuns,
+        durableTxCount: adapter.applyCommittedTxCalls.length,
+      }).toEqual(expected.afterReconciliation)
+      expect(livePublishedKeys).toContain(`crossing`)
+
+      source.begin()
+      source.write({
+        type: `insert`,
+        value: { id: `later`, title: `source suffix` },
+      })
+      source.metadata?.collection.set(`probe:cursor`, `later`)
+      await atPersistedOracleCheckpoint(
+        Promise.resolve(source.commit()),
+        `later source receipt`,
+      )
+      expect({
+        ...observe(),
+        syncRuns,
+        durableTxCount: adapter.applyCommittedTxCalls.length,
+      }).toEqual(expected.afterSuffix)
+      expect(livePublishedKeys).toContain(`later`)
+    } catch (failure) {
+      hasPrimaryFailure = true
+      throw failure
+    } finally {
+      releaseReconciliation.resolve()
+      liveSubscription.unsubscribe()
+      await cleanupPersistedOracle(
+        [() => live.cleanup(), () => collection.cleanup()],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
diff --git a/packages/db-sqlite-persistence-core/tests/reload-class-oracle.ts b/packages/db-sqlite-persistence-core/tests/reload-class-oracle.ts
index 08c7488c66..fb7c7d9bcb 100644
--- a/packages/db-sqlite-persistence-core/tests/reload-class-oracle.ts
+++ b/packages/db-sqlite-persistence-core/tests/reload-class-oracle.ts
@@ -104,6 +104,7 @@
  */
 import fc from 'fast-check'
 import { createCollection, createLiveQueryCollection } from '@tanstack/db'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
   SQLiteCorePersistenceAdapter,
   createPersistedTableName,
@@ -1673,3 +1674,5 @@ export const fixedReloadHistories: ReadonlyArray<[string, ReloadHistory]> = [
     },
   ],
 ]
+
+declareOracle({ check: [reloadViolations], model: [expectedReload] })
diff --git a/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-oracle.test.ts
index 20c254e680..4d7162ded3 100644
--- a/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-oracle.test.ts
@@ -47,284 +47,10 @@
  */
 import { describe, expect, it } from 'vitest'
 import fc from 'fast-check'
-import {
-  SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY,
-  createSQLiteCorePersistenceAdapter,
-  forwardSQLiteDriverSharedLogicalScheduling,
-} from '../src'
-import type { SQLiteDriver } from '../src'
-
-type Deferred = {
-  promise: Promise<void>
-  resolve: () => void
-}
-
-function createDeferred(): Deferred {
-  let resolve!: () => void
-  const promise = new Promise<void>((settle) => {
-    resolve = settle
-  })
-  return { promise, resolve }
-}
-
-function fixtureQueryRows<T>(sql: string): ReadonlyArray<T> {
-  if (sql.includes(`FROM collection_registry`)) {
-    return [
-      {
-        table_name: `c_fixture`,
-        tombstone_table_name: `t_fixture`,
-        schema_version: 1,
-      } as T,
-    ]
-  }
-  return []
-}
-
-function isMetadataQuery(sql: string): boolean {
-  return sql.includes(`FROM collection_metadata`)
-}
-
-class FirstQueryGatedDriver implements SQLiteDriver {
-  readonly [SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY]: object
-  readonly admissions: Array<string> = []
-  readonly metadataAdmissions: Array<string> = []
-  readonly firstQueryEntered = createDeferred()
-  firstQueryAdmissionCount = 0
-  onQuery: (() => void) | undefined
-  private readonly firstQueryGate = createDeferred()
-  private holdFirstQuery = true
-
-  constructor(sharedLogicalSchedulingKey: object = {}) {
-    this[SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY] =
-      sharedLogicalSchedulingKey
-  }
-
-  exec(): Promise<void> {
-    this.admissions.push(`exec`)
-    return Promise.resolve()
-  }
-
-  async query<T>(sql: string): Promise<ReadonlyArray<T>> {
-    this.admissions.push(`query`)
-    if (isMetadataQuery(sql)) {
-      this.metadataAdmissions.push(`query`)
-      this.onQuery?.()
-    }
-    if (this.holdFirstQuery && isMetadataQuery(sql)) {
-      this.holdFirstQuery = false
-      this.firstQueryAdmissionCount = this.admissions.length
-      this.firstQueryEntered.resolve()
-      await this.firstQueryGate.promise
-    }
-    return fixtureQueryRows<T>(sql)
-  }
-
-  run(): Promise<void> {
-    this.admissions.push(`run`)
-    return Promise.resolve()
-  }
-
-  transaction<T>(
-    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
-  ): Promise<T> {
-    this.admissions.push(`transaction`)
-    return fn(this)
-  }
-
-  releaseFirstQuery(): void {
-    this.firstQueryGate.resolve()
-  }
-}
-
-class PromiseBrandedFirstQueryGatedDriver implements SQLiteDriver {
-  readonly admissions: Array<string> = []
-  readonly metadataAdmissions: Array<string> = []
-  readonly firstQueryEntered = createDeferred()
-  firstQueryAdmissionCount = 0
-  private readonly firstQueryGate = createDeferred()
-  private holdFirstQuery = true
-
-  constructor(private readonly schedulingKey: object = {}) {}
-
-  exec(): Promise<void> {
-    this.admissions.push(`exec`)
-    return this.brand(Promise.resolve())
-  }
-
-  query<T>(sql: string): Promise<ReadonlyArray<T>> {
-    this.admissions.push(`query`)
-    if (isMetadataQuery(sql)) this.metadataAdmissions.push(`query`)
-    const result = (async () => {
-      if (this.holdFirstQuery && isMetadataQuery(sql)) {
-        this.holdFirstQuery = false
-        this.firstQueryAdmissionCount = this.admissions.length
-        this.firstQueryEntered.resolve()
-        await this.firstQueryGate.promise
-      }
-      return fixtureQueryRows<T>(sql)
-    })()
-    return this.brand(result)
-  }
-
-  run(): Promise<void> {
-    this.admissions.push(`run`)
-    return this.brand(Promise.resolve())
-  }
-
-  transaction<T>(
-    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
-  ): Promise<T> {
-    this.admissions.push(`transaction`)
-    return this.brand(fn(this))
-  }
-
-  releaseFirstQuery(): void {
-    this.firstQueryGate.resolve()
-  }
-
-  private brand<T>(promise: Promise<T>): Promise<T> {
-    Object.defineProperty(
-      promise,
-      SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY,
-      { value: this.schedulingKey },
-    )
-    return promise
-  }
-}
-
-class UnbrandedPromiseLookupDriver implements SQLiteDriver {
-  schedulingKeyLookups = 0
-
-  exec(): Promise<void> {
-    return this.unbranded(Promise.resolve())
-  }
-
-  query<T>(sql: string): Promise<ReadonlyArray<T>> {
-    return this.unbranded(Promise.resolve(fixtureQueryRows<T>(sql)))
-  }
-
-  run(): Promise<void> {
-    return this.unbranded(Promise.resolve())
-  }
-
-  transaction<T>(
-    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
-  ): Promise<T> {
-    return this.unbranded(fn(this))
-  }
-
-  private unbranded<T>(promise: Promise<T>): Promise<T> {
-    Object.defineProperty(
-      promise,
-      SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY,
-      {
-        configurable: true,
-        get: () => {
-          this.schedulingKeyLookups++
-          return undefined
-        },
-      },
-    )
-    return promise
-  }
-}
-
-function createTransparentWrapper(driver: SQLiteDriver): SQLiteDriver {
-  return forwardSQLiteDriverSharedLogicalScheduling(driver, {
-    exec: (sql) => driver.exec(sql),
-    query: <T>(sql: string, params: ReadonlyArray<unknown> = []) =>
-      driver.query<T>(sql, params),
-    run: (sql, params = []) => driver.run(sql, params),
-    transaction: <T>(fn: (transactionDriver: SQLiteDriver) => Promise<T>) =>
-      driver.transaction(fn),
-    transactionWithDriver: <T>(
-      fn: (transactionDriver: SQLiteDriver) => Promise<T>,
-    ) =>
-      driver.transactionWithDriver
-        ? driver.transactionWithDriver(fn)
-        : driver.transaction(fn),
-  })
-}
+import { createSQLiteCorePersistenceAdapter } from '../src'
+import { PromiseBrandedFirstQueryGatedDriver } from './shared-logical-scheduling-support'
 
 describe(`shared logical scheduling`, () => {
-  it.each([
-    {
-      name: `direct driver`,
-      key: {},
-      wrap: (driver: SQLiteDriver) => driver,
-    },
-    {
-      name: `transparent delegating driver`,
-      key: {},
-      wrap: createTransparentWrapper,
-    },
-    {
-      name: `twice-transparent delegating driver`,
-      key: {},
-      wrap: (driver: SQLiteDriver) =>
-        createTransparentWrapper(createTransparentWrapper(driver)),
-    },
-    {
-      name: `function-valued key`,
-      key: () => undefined,
-      wrap: (driver: SQLiteDriver) => driver,
-    },
-  ])(
-    `shares a scheduler across two fresh adapters through a $name`,
-    async ({ key, wrap }) => {
-      const underlying = new FirstQueryGatedDriver(key)
-      const driver = wrap(underlying)
-      const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
-      const regularAdapter = createSQLiteCorePersistenceAdapter({ driver })
-
-      const hydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
-        await scoped.loadCollectionMetadata!({
-          kind: `eager`,
-          collectionId: `hydrate`,
-        })
-      })
-      await underlying.firstQueryEntered.promise
-
-      const regular = regularAdapter.loadCollectionMetadata!({
-        kind: `eager`,
-        collectionId: `regular`,
-      })
-
-      expect(underlying.admissions).toHaveLength(
-        underlying.firstQueryAdmissionCount,
-      )
-
-      underlying.releaseFirstQuery()
-      await Promise.all([hydrate, regular])
-      expect(underlying.metadataAdmissions).toEqual([`query`, `query`])
-    },
-  )
-
-  it(`adopts a late-discovered promise identity before admitting peer work`, async () => {
-    const driver = new PromiseBrandedFirstQueryGatedDriver()
-    const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
-    const regularAdapter = createSQLiteCorePersistenceAdapter({ driver })
-
-    const hydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
-      await scoped.loadCollectionMetadata!({
-        kind: `eager`,
-        collectionId: `hydrate`,
-      })
-    })
-    await driver.firstQueryEntered.promise
-
-    const regular = regularAdapter.loadCollectionMetadata!({
-      kind: `eager`,
-      collectionId: `regular`,
-    })
-
-    expect(driver.admissions).toHaveLength(driver.firstQueryAdmissionCount)
-
-    driver.releaseFirstQuery()
-    await Promise.all([hydrate, regular])
-    expect(driver.metadataAdmissions).toEqual([`query`, `query`])
-  })
-
   it(`keeps generated promise-discovered hydrate units non-preemptible`, async () => {
     await fc.assert(
       fc.asyncProperty(
@@ -371,294 +97,4 @@ describe(`shared logical scheduling`, () => {
       { seed: 1868, numRuns: 12, endOnFailure: true },
     )
   })
-
-  it(`counts a rejected hydrate as a completed K=1 lane unit`, async () => {
-    const driver = new FirstQueryGatedDriver()
-    const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
-    const regularAdapter = createSQLiteCorePersistenceAdapter({ driver })
-    const events: Array<string> = []
-
-    const initialRegular = regularAdapter.loadCollectionMetadata!({
-      kind: `eager`,
-      collectionId: `initial`,
-    })
-    await driver.firstQueryEntered.promise
-    driver.onQuery = () => events.push(`query`)
-
-    const failedHydrate = hydrateAdapter.runInHydrationScope!(() => {
-      events.push(`failed-hydrate`)
-      throw new Error(`expected hydrate failure`)
-    })
-    const failedHydrateExpectation = expect(failedHydrate).rejects.toThrow(
-      `expected hydrate failure`,
-    )
-    const regular = regularAdapter.loadCollectionMetadata!({
-      kind: `eager`,
-      collectionId: `regular`,
-    })
-    const nextHydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
-      events.push(`next-hydrate`)
-      await scoped.loadCollectionMetadata!({
-        kind: `eager`,
-        collectionId: `hydrate`,
-      })
-    })
-
-    driver.releaseFirstQuery()
-    await Promise.all([
-      initialRegular,
-      failedHydrateExpectation,
-      regular,
-      nextHydrate,
-    ])
-
-    expect(events).toEqual([`failed-hydrate`, `query`, `next-hydrate`, `query`])
-  })
-
-  describe(`queued-work barrier`, () => {
-    async function settlesNow(promise: Promise<void>): Promise<boolean> {
-      let settled = false
-      void promise.then(
-        () => {
-          settled = true
-        },
-        () => {
-          throw new Error(`the queued-work barrier rejected`)
-        },
-      )
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      return settled
-    }
-
-    it(`resolves at once when the scheduler is idle`, async () => {
-      const driver = new FirstQueryGatedDriver()
-      const adapter = createSQLiteCorePersistenceAdapter({ driver })
-      driver.releaseFirstQuery()
-      expect(
-        await settlesNow(adapter.runInRegularScope!.afterQueuedWork()),
-      ).toBe(true)
-    })
-
-    it(`waits for regular work queued or running before the call`, async () => {
-      const driver = new FirstQueryGatedDriver()
-      const adapter = createSQLiteCorePersistenceAdapter({ driver })
-      const regular = adapter.loadCollectionMetadata!({
-        kind: `eager`,
-        collectionId: `regular`,
-      })
-      await driver.firstQueryEntered.promise
-      const queuedRegular = adapter.loadCollectionMetadata!({
-        kind: `eager`,
-        collectionId: `queued-regular`,
-      })
-      const barrier = adapter.runInRegularScope!.afterQueuedWork()
-      expect(await settlesNow(barrier)).toBe(false)
-      driver.releaseFirstQuery()
-      await Promise.all([regular, queuedRegular])
-      expect(await settlesNow(barrier)).toBe(true)
-    })
-
-    it(`waits for a hydrate adopted through promise discovery`, async () => {
-      const driver = new PromiseBrandedFirstQueryGatedDriver()
-      const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
-      const barrierAdapter = createSQLiteCorePersistenceAdapter({ driver })
-      const hydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
-        await scoped.loadCollectionMetadata!({
-          kind: `eager`,
-          collectionId: `adopted`,
-        })
-      })
-      await driver.firstQueryEntered.promise
-      const barrier = barrierAdapter.runInRegularScope!.afterQueuedWork()
-      expect(await settlesNow(barrier)).toBe(false)
-      driver.releaseFirstQuery()
-      await hydrate
-      expect(await settlesNow(barrier)).toBe(true)
-    })
-
-    it.each([
-      [
-        `before promise discovery`,
-        () => new PromiseBrandedFirstQueryGatedDriver(),
-      ],
-      [`without scheduling support`, () => new UnbrandedPromiseLookupDriver()],
-    ] as const)(
-      `waits for an unscheduled hydrate that has issued no query, %s`,
-      async (_driverKind, createDriver) => {
-        const adapter = createSQLiteCorePersistenceAdapter({
-          driver: createDriver(),
-        })
-        const gate = createDeferred()
-        const hydrate = adapter.runInHydrationScope!(async (scoped) => {
-          await gate.promise
-          await scoped.getStreamPosition!({
-            kind: `eager`,
-            collectionId: `unscheduled`,
-          })
-        })
-        const barrier = adapter.runInRegularScope!.afterQueuedWork()
-        expect(await settlesNow(barrier)).toBe(false)
-        gate.resolve()
-        await hydrate
-        expect(await settlesNow(barrier)).toBe(true)
-      },
-    )
-
-    it(`keeps waiting for an unscheduled hydrate after another one fails`, async () => {
-      const adapter = createSQLiteCorePersistenceAdapter({
-        driver: new UnbrandedPromiseLookupDriver(),
-      })
-      const failGate = createDeferred()
-      const heldGate = createDeferred()
-      const failing = adapter.runInHydrationScope!(async () => {
-        await failGate.promise
-        throw new Error(`unscheduled hydrate failed`)
-      })
-      const failingSettled = failing.then(
-        () => undefined,
-        () => undefined,
-      )
-      const held = adapter.runInHydrationScope!(() => heldGate.promise)
-      const barrier = adapter.runInRegularScope!.afterQueuedWork()
-      failGate.resolve()
-      await failingSettled
-      // The failed hydrate has settled, but the held one has not.
-      expect(await settlesNow(barrier)).toBe(false)
-      heldGate.resolve()
-      await held
-      expect(await settlesNow(barrier)).toBe(true)
-    })
-
-    // A second wrapper over the same key discovers it only from a promise.
-    // Its unscheduled hydrate is adopted while the scheduler already runs
-    // the first wrapper's held regular read.
-    it.each([`succeeds`, `fails`] as const)(
-      `waits for a hydrate adopted while the scheduler is busy, when it %s`,
-      async (outcome) => {
-        const key = {}
-        const busyDriver = new PromiseBrandedFirstQueryGatedDriver(key)
-        const adoptedDriver = new PromiseBrandedFirstQueryGatedDriver(key)
-        const busyAdapter = createSQLiteCorePersistenceAdapter({
-          driver: busyDriver,
-        })
-        const adoptedAdapter = createSQLiteCorePersistenceAdapter({
-          driver: adoptedDriver,
-        })
-        // Discover the key through a non-metadata read, then queue a
-        // regular metadata read that holds the turn.
-        await busyAdapter.getStreamPosition!({
-          kind: `eager`,
-          collectionId: `discover`,
-        })
-        const busy = busyAdapter.loadCollectionMetadata!({
-          kind: `eager`,
-          collectionId: `busy`,
-        })
-        await busyDriver.firstQueryEntered.promise
-        const adopted = adoptedAdapter.runInHydrationScope!(async (scoped) => {
-          await scoped.loadCollectionMetadata!({
-            kind: `eager`,
-            collectionId: `adopted`,
-          })
-          if (outcome === `fails`) throw new Error(`adopted hydrate failed`)
-        })
-        const adoptedSettled = adopted.then(
-          () => undefined,
-          () => undefined,
-        )
-        await adoptedDriver.firstQueryEntered.promise
-        const barrier = busyAdapter.runInRegularScope!.afterQueuedWork()
-        busyDriver.releaseFirstQuery()
-        await busy
-        // The busy read is done; the adopted hydrate is still held.
-        expect(await settlesNow(barrier)).toBe(false)
-        adoptedDriver.releaseFirstQuery()
-        await adoptedSettled
-        expect(await settlesNow(barrier)).toBe(true)
-      },
-    )
-
-    it(`keeps waiting for other queued work after one queued operation fails`, async () => {
-      const driver = new FirstQueryGatedDriver()
-      const adapter = createSQLiteCorePersistenceAdapter({ driver })
-      const heldGate = createDeferred()
-      const running = adapter.loadCollectionMetadata!({
-        kind: `eager`,
-        collectionId: `running`,
-      })
-      await driver.firstQueryEntered.promise
-      const failing = adapter.runInHydrationScope!(() => {
-        throw new Error(`queued hydrate failed`)
-      })
-      const failingSettled = failing.then(
-        () => undefined,
-        () => undefined,
-      )
-      const held = adapter.runInRegularScope!(() => heldGate.promise)
-      const barrier = adapter.runInRegularScope!.afterQueuedWork()
-      driver.releaseFirstQuery()
-      await Promise.all([running, failingSettled])
-      // The failed hydrate has settled, but the held regular task has not.
-      expect(await settlesNow(barrier)).toBe(false)
-      heldGate.resolve()
-      await held
-      expect(await settlesNow(barrier)).toBe(true)
-    })
-
-    it(`waits for work queued before the call, not after it`, async () => {
-      const driver = new FirstQueryGatedDriver()
-      const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
-      const barrierAdapter = createSQLiteCorePersistenceAdapter({ driver })
-      const events: Array<string> = []
-      const laterGate = createDeferred()
-
-      const earlier = hydrateAdapter.runInHydrationScope!(async (scoped) => {
-        await scoped.loadCollectionMetadata!({
-          kind: `eager`,
-          collectionId: `earlier`,
-        })
-        events.push(`earlier-hydrate`)
-      })
-      await driver.firstQueryEntered.promise
-      const barrier = barrierAdapter
-        .runInRegularScope!.afterQueuedWork()
-        .then(() => {
-          events.push(`barrier`)
-        })
-      const later = hydrateAdapter.runInHydrationScope!(async () => {
-        await laterGate.promise
-        events.push(`later-hydrate`)
-      })
-      const laterRegular = barrierAdapter.runInRegularScope!(async () => {
-        await laterGate.promise
-        events.push(`later-regular`)
-      })
-
-      expect(await settlesNow(barrier)).toBe(false)
-      driver.releaseFirstQuery()
-      await earlier
-      // The barrier settles while the work queued after it is still held.
-      expect(await settlesNow(barrier)).toBe(true)
-      expect(events).toEqual([`earlier-hydrate`, `barrier`])
-      laterGate.resolve()
-      await Promise.all([later, laterRegular])
-      expect(events.slice(0, 2)).toEqual([`earlier-hydrate`, `barrier`])
-    })
-  })
-
-  it(`stops probing after the first returned promise lacks scheduling support`, async () => {
-    const driver = new UnbrandedPromiseLookupDriver()
-    const adapter = createSQLiteCorePersistenceAdapter({ driver })
-
-    await adapter.loadCollectionMetadata!({
-      kind: `eager`,
-      collectionId: `first`,
-    })
-    await adapter.loadCollectionMetadata!({
-      kind: `eager`,
-      collectionId: `second`,
-    })
-
-    expect(driver.schedulingKeyLookups).toBe(1)
-  })
 })
diff --git a/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-support.ts b/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-support.ts
new file mode 100644
index 0000000000..68a8aad3d6
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling-support.ts
@@ -0,0 +1,201 @@
+import {
+  SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY,
+  forwardSQLiteDriverSharedLogicalScheduling,
+} from '../src'
+import type { SQLiteDriver } from '../src'
+
+// Fixtures and fake drivers for the shared logical scheduling oracle and its
+// ordinary scenario tests. The oracle in `shared-logical-scheduling-oracle.test.ts`
+// owns the law.
+
+export type Deferred = {
+  promise: Promise<void>
+  resolve: () => void
+}
+
+export function createDeferred(): Deferred {
+  let resolve!: () => void
+  const promise = new Promise<void>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+export function fixtureQueryRows<T>(sql: string): ReadonlyArray<T> {
+  if (sql.includes(`FROM collection_registry`)) {
+    return [
+      {
+        table_name: `c_fixture`,
+        tombstone_table_name: `t_fixture`,
+        schema_version: 1,
+      } as T,
+    ]
+  }
+  return []
+}
+
+export function isMetadataQuery(sql: string): boolean {
+  return sql.includes(`FROM collection_metadata`)
+}
+
+export class FirstQueryGatedDriver implements SQLiteDriver {
+  readonly [SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY]: object
+  readonly admissions: Array<string> = []
+  readonly metadataAdmissions: Array<string> = []
+  readonly firstQueryEntered = createDeferred()
+  firstQueryAdmissionCount = 0
+  onQuery: (() => void) | undefined
+  private readonly firstQueryGate = createDeferred()
+  private holdFirstQuery = true
+
+  constructor(sharedLogicalSchedulingKey: object = {}) {
+    this[SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY] =
+      sharedLogicalSchedulingKey
+  }
+
+  exec(): Promise<void> {
+    this.admissions.push(`exec`)
+    return Promise.resolve()
+  }
+
+  async query<T>(sql: string): Promise<ReadonlyArray<T>> {
+    this.admissions.push(`query`)
+    if (isMetadataQuery(sql)) {
+      this.metadataAdmissions.push(`query`)
+      this.onQuery?.()
+    }
+    if (this.holdFirstQuery && isMetadataQuery(sql)) {
+      this.holdFirstQuery = false
+      this.firstQueryAdmissionCount = this.admissions.length
+      this.firstQueryEntered.resolve()
+      await this.firstQueryGate.promise
+    }
+    return fixtureQueryRows<T>(sql)
+  }
+
+  run(): Promise<void> {
+    this.admissions.push(`run`)
+    return Promise.resolve()
+  }
+
+  transaction<T>(
+    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
+  ): Promise<T> {
+    this.admissions.push(`transaction`)
+    return fn(this)
+  }
+
+  releaseFirstQuery(): void {
+    this.firstQueryGate.resolve()
+  }
+}
+
+export class PromiseBrandedFirstQueryGatedDriver implements SQLiteDriver {
+  readonly admissions: Array<string> = []
+  readonly metadataAdmissions: Array<string> = []
+  readonly firstQueryEntered = createDeferred()
+  firstQueryAdmissionCount = 0
+  private readonly firstQueryGate = createDeferred()
+  private holdFirstQuery = true
+
+  constructor(private readonly schedulingKey: object = {}) {}
+
+  exec(): Promise<void> {
+    this.admissions.push(`exec`)
+    return this.brand(Promise.resolve())
+  }
+
+  query<T>(sql: string): Promise<ReadonlyArray<T>> {
+    this.admissions.push(`query`)
+    if (isMetadataQuery(sql)) this.metadataAdmissions.push(`query`)
+    const result = (async () => {
+      if (this.holdFirstQuery && isMetadataQuery(sql)) {
+        this.holdFirstQuery = false
+        this.firstQueryAdmissionCount = this.admissions.length
+        this.firstQueryEntered.resolve()
+        await this.firstQueryGate.promise
+      }
+      return fixtureQueryRows<T>(sql)
+    })()
+    return this.brand(result)
+  }
+
+  run(): Promise<void> {
+    this.admissions.push(`run`)
+    return this.brand(Promise.resolve())
+  }
+
+  transaction<T>(
+    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
+  ): Promise<T> {
+    this.admissions.push(`transaction`)
+    return this.brand(fn(this))
+  }
+
+  releaseFirstQuery(): void {
+    this.firstQueryGate.resolve()
+  }
+
+  private brand<T>(promise: Promise<T>): Promise<T> {
+    Object.defineProperty(
+      promise,
+      SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY,
+      { value: this.schedulingKey },
+    )
+    return promise
+  }
+}
+
+export class UnbrandedPromiseLookupDriver implements SQLiteDriver {
+  schedulingKeyLookups = 0
+
+  exec(): Promise<void> {
+    return this.unbranded(Promise.resolve())
+  }
+
+  query<T>(sql: string): Promise<ReadonlyArray<T>> {
+    return this.unbranded(Promise.resolve(fixtureQueryRows<T>(sql)))
+  }
+
+  run(): Promise<void> {
+    return this.unbranded(Promise.resolve())
+  }
+
+  transaction<T>(
+    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
+  ): Promise<T> {
+    return this.unbranded(fn(this))
+  }
+
+  private unbranded<T>(promise: Promise<T>): Promise<T> {
+    Object.defineProperty(
+      promise,
+      SQLITE_DRIVER_SHARED_LOGICAL_SCHEDULING_KEY,
+      {
+        configurable: true,
+        get: () => {
+          this.schedulingKeyLookups++
+          return undefined
+        },
+      },
+    )
+    return promise
+  }
+}
+
+export function createTransparentWrapper(driver: SQLiteDriver): SQLiteDriver {
+  return forwardSQLiteDriverSharedLogicalScheduling(driver, {
+    exec: (sql) => driver.exec(sql),
+    query: <T>(sql: string, params: ReadonlyArray<unknown> = []) =>
+      driver.query<T>(sql, params),
+    run: (sql, params = []) => driver.run(sql, params),
+    transaction: <T>(fn: (transactionDriver: SQLiteDriver) => Promise<T>) =>
+      driver.transaction(fn),
+    transactionWithDriver: <T>(
+      fn: (transactionDriver: SQLiteDriver) => Promise<T>,
+    ) =>
+      driver.transactionWithDriver
+        ? driver.transactionWithDriver(fn)
+        : driver.transaction(fn),
+  })
+}
diff --git a/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling.test.ts b/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling.test.ts
new file mode 100644
index 0000000000..281b170a6b
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/shared-logical-scheduling.test.ts
@@ -0,0 +1,383 @@
+// Scenario checks for logical scheduling across SQLite core adapters: hydration
+// admission, wrapper identity, and the queued-work barrier. The generated
+// non-preemption property in `shared-logical-scheduling-oracle.test.ts` owns the law.
+import { describe, expect, it } from 'vitest'
+import { createSQLiteCorePersistenceAdapter } from '../src'
+import {
+  FirstQueryGatedDriver,
+  PromiseBrandedFirstQueryGatedDriver,
+  UnbrandedPromiseLookupDriver,
+  createDeferred,
+  createTransparentWrapper,
+} from './shared-logical-scheduling-support'
+import type { SQLiteDriver } from '../src'
+
+describe(`shared logical scheduling`, () => {
+  it.each([
+    {
+      name: `direct driver`,
+      key: {},
+      wrap: (driver: SQLiteDriver) => driver,
+    },
+    {
+      name: `transparent delegating driver`,
+      key: {},
+      wrap: createTransparentWrapper,
+    },
+    {
+      name: `twice-transparent delegating driver`,
+      key: {},
+      wrap: (driver: SQLiteDriver) =>
+        createTransparentWrapper(createTransparentWrapper(driver)),
+    },
+    {
+      name: `function-valued key`,
+      key: () => undefined,
+      wrap: (driver: SQLiteDriver) => driver,
+    },
+  ])(
+    `shares a scheduler across two fresh adapters through a $name`,
+    async ({ key, wrap }) => {
+      const underlying = new FirstQueryGatedDriver(key)
+      const driver = wrap(underlying)
+      const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
+      const regularAdapter = createSQLiteCorePersistenceAdapter({ driver })
+
+      const hydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
+        await scoped.loadCollectionMetadata!({
+          kind: `eager`,
+          collectionId: `hydrate`,
+        })
+      })
+      await underlying.firstQueryEntered.promise
+
+      const regular = regularAdapter.loadCollectionMetadata!({
+        kind: `eager`,
+        collectionId: `regular`,
+      })
+
+      expect(underlying.admissions).toHaveLength(
+        underlying.firstQueryAdmissionCount,
+      )
+
+      underlying.releaseFirstQuery()
+      await Promise.all([hydrate, regular])
+      expect(underlying.metadataAdmissions).toEqual([`query`, `query`])
+    },
+  )
+
+  it(`adopts a late-discovered promise identity before admitting peer work`, async () => {
+    const driver = new PromiseBrandedFirstQueryGatedDriver()
+    const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
+    const regularAdapter = createSQLiteCorePersistenceAdapter({ driver })
+
+    const hydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
+      await scoped.loadCollectionMetadata!({
+        kind: `eager`,
+        collectionId: `hydrate`,
+      })
+    })
+    await driver.firstQueryEntered.promise
+
+    const regular = regularAdapter.loadCollectionMetadata!({
+      kind: `eager`,
+      collectionId: `regular`,
+    })
+
+    expect(driver.admissions).toHaveLength(driver.firstQueryAdmissionCount)
+
+    driver.releaseFirstQuery()
+    await Promise.all([hydrate, regular])
+    expect(driver.metadataAdmissions).toEqual([`query`, `query`])
+  })
+
+  it(`counts a rejected hydrate as a completed K=1 lane unit`, async () => {
+    const driver = new FirstQueryGatedDriver()
+    const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
+    const regularAdapter = createSQLiteCorePersistenceAdapter({ driver })
+    const events: Array<string> = []
+
+    const initialRegular = regularAdapter.loadCollectionMetadata!({
+      kind: `eager`,
+      collectionId: `initial`,
+    })
+    await driver.firstQueryEntered.promise
+    driver.onQuery = () => events.push(`query`)
+
+    const failedHydrate = hydrateAdapter.runInHydrationScope!(() => {
+      events.push(`failed-hydrate`)
+      throw new Error(`expected hydrate failure`)
+    })
+    const failedHydrateExpectation = expect(failedHydrate).rejects.toThrow(
+      `expected hydrate failure`,
+    )
+    const regular = regularAdapter.loadCollectionMetadata!({
+      kind: `eager`,
+      collectionId: `regular`,
+    })
+    const nextHydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
+      events.push(`next-hydrate`)
+      await scoped.loadCollectionMetadata!({
+        kind: `eager`,
+        collectionId: `hydrate`,
+      })
+    })
+
+    driver.releaseFirstQuery()
+    await Promise.all([
+      initialRegular,
+      failedHydrateExpectation,
+      regular,
+      nextHydrate,
+    ])
+
+    expect(events).toEqual([`failed-hydrate`, `query`, `next-hydrate`, `query`])
+  })
+
+  describe(`queued-work barrier`, () => {
+    async function settlesNow(promise: Promise<void>): Promise<boolean> {
+      let settled = false
+      void promise.then(
+        () => {
+          settled = true
+        },
+        () => {
+          throw new Error(`the queued-work barrier rejected`)
+        },
+      )
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      return settled
+    }
+
+    it(`resolves at once when the scheduler is idle`, async () => {
+      const driver = new FirstQueryGatedDriver()
+      const adapter = createSQLiteCorePersistenceAdapter({ driver })
+      driver.releaseFirstQuery()
+      expect(
+        await settlesNow(adapter.runInRegularScope!.afterQueuedWork()),
+      ).toBe(true)
+    })
+
+    it(`waits for regular work queued or running before the call`, async () => {
+      const driver = new FirstQueryGatedDriver()
+      const adapter = createSQLiteCorePersistenceAdapter({ driver })
+      const regular = adapter.loadCollectionMetadata!({
+        kind: `eager`,
+        collectionId: `regular`,
+      })
+      await driver.firstQueryEntered.promise
+      const queuedRegular = adapter.loadCollectionMetadata!({
+        kind: `eager`,
+        collectionId: `queued-regular`,
+      })
+      const barrier = adapter.runInRegularScope!.afterQueuedWork()
+      expect(await settlesNow(barrier)).toBe(false)
+      driver.releaseFirstQuery()
+      await Promise.all([regular, queuedRegular])
+      expect(await settlesNow(barrier)).toBe(true)
+    })
+
+    it(`waits for a hydrate adopted through promise discovery`, async () => {
+      const driver = new PromiseBrandedFirstQueryGatedDriver()
+      const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
+      const barrierAdapter = createSQLiteCorePersistenceAdapter({ driver })
+      const hydrate = hydrateAdapter.runInHydrationScope!(async (scoped) => {
+        await scoped.loadCollectionMetadata!({
+          kind: `eager`,
+          collectionId: `adopted`,
+        })
+      })
+      await driver.firstQueryEntered.promise
+      const barrier = barrierAdapter.runInRegularScope!.afterQueuedWork()
+      expect(await settlesNow(barrier)).toBe(false)
+      driver.releaseFirstQuery()
+      await hydrate
+      expect(await settlesNow(barrier)).toBe(true)
+    })
+
+    it.each([
+      [
+        `before promise discovery`,
+        () => new PromiseBrandedFirstQueryGatedDriver(),
+      ],
+      [`without scheduling support`, () => new UnbrandedPromiseLookupDriver()],
+    ] as const)(
+      `waits for an unscheduled hydrate that has issued no query, %s`,
+      async (_driverKind, createDriver) => {
+        const adapter = createSQLiteCorePersistenceAdapter({
+          driver: createDriver(),
+        })
+        const gate = createDeferred()
+        const hydrate = adapter.runInHydrationScope!(async (scoped) => {
+          await gate.promise
+          await scoped.getStreamPosition!({
+            kind: `eager`,
+            collectionId: `unscheduled`,
+          })
+        })
+        const barrier = adapter.runInRegularScope!.afterQueuedWork()
+        expect(await settlesNow(barrier)).toBe(false)
+        gate.resolve()
+        await hydrate
+        expect(await settlesNow(barrier)).toBe(true)
+      },
+    )
+
+    it(`keeps waiting for an unscheduled hydrate after another one fails`, async () => {
+      const adapter = createSQLiteCorePersistenceAdapter({
+        driver: new UnbrandedPromiseLookupDriver(),
+      })
+      const failGate = createDeferred()
+      const heldGate = createDeferred()
+      const failing = adapter.runInHydrationScope!(async () => {
+        await failGate.promise
+        throw new Error(`unscheduled hydrate failed`)
+      })
+      const failingSettled = failing.then(
+        () => undefined,
+        () => undefined,
+      )
+      const held = adapter.runInHydrationScope!(() => heldGate.promise)
+      const barrier = adapter.runInRegularScope!.afterQueuedWork()
+      failGate.resolve()
+      await failingSettled
+      // The failed hydrate has settled, but the held one has not.
+      expect(await settlesNow(barrier)).toBe(false)
+      heldGate.resolve()
+      await held
+      expect(await settlesNow(barrier)).toBe(true)
+    })
+
+    // A second wrapper over the same key discovers it only from a promise.
+    // Its unscheduled hydrate is adopted while the scheduler already runs
+    // the first wrapper's held regular read.
+    it.each([`succeeds`, `fails`] as const)(
+      `waits for a hydrate adopted while the scheduler is busy, when it %s`,
+      async (outcome) => {
+        const key = {}
+        const busyDriver = new PromiseBrandedFirstQueryGatedDriver(key)
+        const adoptedDriver = new PromiseBrandedFirstQueryGatedDriver(key)
+        const busyAdapter = createSQLiteCorePersistenceAdapter({
+          driver: busyDriver,
+        })
+        const adoptedAdapter = createSQLiteCorePersistenceAdapter({
+          driver: adoptedDriver,
+        })
+        // Discover the key through a non-metadata read, then queue a
+        // regular metadata read that holds the turn.
+        await busyAdapter.getStreamPosition!({
+          kind: `eager`,
+          collectionId: `discover`,
+        })
+        const busy = busyAdapter.loadCollectionMetadata!({
+          kind: `eager`,
+          collectionId: `busy`,
+        })
+        await busyDriver.firstQueryEntered.promise
+        const adopted = adoptedAdapter.runInHydrationScope!(async (scoped) => {
+          await scoped.loadCollectionMetadata!({
+            kind: `eager`,
+            collectionId: `adopted`,
+          })
+          if (outcome === `fails`) throw new Error(`adopted hydrate failed`)
+        })
+        const adoptedSettled = adopted.then(
+          () => undefined,
+          () => undefined,
+        )
+        await adoptedDriver.firstQueryEntered.promise
+        const barrier = busyAdapter.runInRegularScope!.afterQueuedWork()
+        busyDriver.releaseFirstQuery()
+        await busy
+        // The busy read is done; the adopted hydrate is still held.
+        expect(await settlesNow(barrier)).toBe(false)
+        adoptedDriver.releaseFirstQuery()
+        await adoptedSettled
+        expect(await settlesNow(barrier)).toBe(true)
+      },
+    )
+
+    it(`keeps waiting for other queued work after one queued operation fails`, async () => {
+      const driver = new FirstQueryGatedDriver()
+      const adapter = createSQLiteCorePersistenceAdapter({ driver })
+      const heldGate = createDeferred()
+      const running = adapter.loadCollectionMetadata!({
+        kind: `eager`,
+        collectionId: `running`,
+      })
+      await driver.firstQueryEntered.promise
+      const failing = adapter.runInHydrationScope!(() => {
+        throw new Error(`queued hydrate failed`)
+      })
+      const failingSettled = failing.then(
+        () => undefined,
+        () => undefined,
+      )
+      const held = adapter.runInRegularScope!(() => heldGate.promise)
+      const barrier = adapter.runInRegularScope!.afterQueuedWork()
+      driver.releaseFirstQuery()
+      await Promise.all([running, failingSettled])
+      // The failed hydrate has settled, but the held regular task has not.
+      expect(await settlesNow(barrier)).toBe(false)
+      heldGate.resolve()
+      await held
+      expect(await settlesNow(barrier)).toBe(true)
+    })
+
+    it(`waits for work queued before the call, not after it`, async () => {
+      const driver = new FirstQueryGatedDriver()
+      const hydrateAdapter = createSQLiteCorePersistenceAdapter({ driver })
+      const barrierAdapter = createSQLiteCorePersistenceAdapter({ driver })
+      const events: Array<string> = []
+      const laterGate = createDeferred()
+
+      const earlier = hydrateAdapter.runInHydrationScope!(async (scoped) => {
+        await scoped.loadCollectionMetadata!({
+          kind: `eager`,
+          collectionId: `earlier`,
+        })
+        events.push(`earlier-hydrate`)
+      })
+      await driver.firstQueryEntered.promise
+      const barrier = barrierAdapter
+        .runInRegularScope!.afterQueuedWork()
+        .then(() => {
+          events.push(`barrier`)
+        })
+      const later = hydrateAdapter.runInHydrationScope!(async () => {
+        await laterGate.promise
+        events.push(`later-hydrate`)
+      })
+      const laterRegular = barrierAdapter.runInRegularScope!(async () => {
+        await laterGate.promise
+        events.push(`later-regular`)
+      })
+
+      expect(await settlesNow(barrier)).toBe(false)
+      driver.releaseFirstQuery()
+      await earlier
+      // The barrier settles while the work queued after it is still held.
+      expect(await settlesNow(barrier)).toBe(true)
+      expect(events).toEqual([`earlier-hydrate`, `barrier`])
+      laterGate.resolve()
+      await Promise.all([later, laterRegular])
+      expect(events.slice(0, 2)).toEqual([`earlier-hydrate`, `barrier`])
+    })
+  })
+
+  it(`stops probing after the first returned promise lacks scheduling support`, async () => {
+    const driver = new UnbrandedPromiseLookupDriver()
+    const adapter = createSQLiteCorePersistenceAdapter({ driver })
+
+    await adapter.loadCollectionMetadata!({
+      kind: `eager`,
+      collectionId: `first`,
+    })
+    await adapter.loadCollectionMetadata!({
+      kind: `eager`,
+      collectionId: `second`,
+    })
+
+    expect(driver.schedulingKeyLookups).toBe(1)
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-oracle.test.ts
index d6f4f480f8..713af85105 100644
--- a/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-oracle.test.ts
@@ -1,7 +1,6 @@
 // @vitest-environment node
-import { DatabaseSync } from 'node:sqlite'
 import { fc } from '@fast-check/vitest'
-import { expect, it, vi } from 'vitest'
+import { expect, it } from 'vitest'
 import { IR } from '@tanstack/db'
 import {
   oraclePropertyOptions,
@@ -10,8 +9,9 @@ import {
   oracleRuns,
   recordOracleReplay,
 } from '../../db/tests/oracle-config'
-import { SQLiteCorePersistenceAdapter, createPersistedTableName } from '../src'
-import type { SQLiteDriver } from '../src'
+import { SQLiteCorePersistenceAdapter } from '../src'
+import { CountingDriver } from './sqlite-boolean-arity-support'
+import type { Read } from './sqlite-boolean-arity-support'
 
 /**
  * # Boolean arity at the SQLite persistence boundary
@@ -107,7 +107,6 @@ type Row = {
   n: number
   x?: null
 }
-type Read = { sql: string; rawRows: number; parameters: number }
 type Failure = {
   law: 'public' | 'work' | 'compile' | 'candidate'
   checkpoint: 'loadSubset-return'
@@ -319,77 +318,6 @@ function toIR(model: Model): IR.BasicExpression {
   return new IR.Func(model.kind, model.children.map(toIR))
 }
 
-class CountingDriver implements SQLiteDriver {
-  readonly db = new DatabaseSync(':memory:')
-  reads: Array<Read> = []
-  private depth = 0
-  mutantUnaryValue: 'x' | 1 | undefined
-  mutantDropWhere = false
-  mutantPushUnsafeOr = false
-
-  exec(sql: string): Promise<void> {
-    this.db.exec(sql)
-    return Promise.resolve()
-  }
-  run(sql: string, params: ReadonlyArray<unknown> = []): Promise<void> {
-    this.db
-      .prepare(sql)
-      .run(...(params as Array<string | number | bigint | null>))
-    return Promise.resolve()
-  }
-  query<T>(
-    sql: string,
-    params: ReadonlyArray<unknown> = [],
-  ): Promise<ReadonlyArray<T>> {
-    const collectionRead = sql.startsWith(
-      'SELECT key, value, metadata, row_version FROM',
-    )
-    if (
-      collectionRead &&
-      this.mutantUnaryValue !== undefined &&
-      !sql.includes(' WHERE ')
-    ) {
-      sql += ' WHERE (?)'
-      params = [...params, this.mutantUnaryValue]
-    }
-    if (collectionRead && this.mutantDropWhere && sql.includes(' WHERE ')) {
-      sql = sql.slice(0, sql.indexOf(' WHERE '))
-      params = []
-    }
-    if (collectionRead && this.mutantPushUnsafeOr && !sql.includes(' WHERE ')) {
-      sql += ` WHERE LOWER(json_extract(value, '$.name')) LIKE LOWER(?)`
-      params = [...params, 'ä']
-    }
-    const rows = this.db
-      .prepare(sql)
-      .all(...(params as Array<string | number | bigint | null>)) as Array<T>
-    if (collectionRead)
-      this.reads.push({
-        sql,
-        rawRows: rows.length,
-        parameters: params.length,
-      })
-    return Promise.resolve(rows)
-  }
-  async transaction<T>(fn: (driver: SQLiteDriver) => Promise<T>): Promise<T> {
-    const depth = this.depth++
-    this.db.exec(depth === 0 ? 'BEGIN' : `SAVEPOINT nested_${depth}`)
-    try {
-      const result = await fn(this)
-      this.db.exec(depth === 0 ? 'COMMIT' : `RELEASE SAVEPOINT nested_${depth}`)
-      return result
-    } catch (error) {
-      this.db.exec(
-        depth === 0 ? 'ROLLBACK' : `ROLLBACK TO SAVEPOINT nested_${depth}`,
-      )
-      if (depth > 0) this.db.exec(`RELEASE SAVEPOINT nested_${depth}`)
-      throw error
-    } finally {
-      this.depth--
-    }
-  }
-}
-
 function matrix(): Array<Model> {
   const cases: Array<Model> = [
     op('and', atom('first')),
@@ -815,178 +743,3 @@ oracleReplayTest(it, booleanArityProperty)(
     if (cleanupFailed) throw cleanupError
   },
 )
-
-it('keeps large string-ID OR scopes selective at the SQLite boundary', async () => {
-  const driver = new CountingDriver()
-  const adapter = new SQLiteCorePersistenceAdapter({ driver })
-  const collectionId = 'string-id-scope'
-  const scopeRows = Array.from({ length: 20 }, (_, index) => ({
-    issueId: `issue-${index}`,
-    relatedIssueId:
-      ['related-\uD800', 'related-\u0000', 'related-😀'][index] ??
-      `related-${index}`,
-  }))
-  const ids = Array.from({ length: 50_582 }, (_, index) => `other-${index}`)
-  ids[5_001] = 'related-\uD800'
-  ids[25_291] = 'issue-1'
-  ids[35_001] = 'related-\u0000'
-  ids[45_001] = 'related-😀'
-  const allowed = new Set(ids)
-
-  try {
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        txId: 'seed-string-scope',
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: scopeRows.map((row) => ({
-          type: 'insert' as const,
-          key: row.issueId,
-          value: structuredClone(row),
-        })),
-      },
-    )
-    for (const field of ['issueId', 'relatedIssueId']) {
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        field,
-        {
-          expressionSql: [JSON.stringify(new IR.PropRef([field]))],
-        },
-      )
-    }
-
-    driver.reads = []
-    const rows = await adapter.loadSubset(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        where: new IR.Func('and', [
-          new IR.Func('or', [
-            new IR.Func('in', [new IR.PropRef(['issueId']), new IR.Value(ids)]),
-            new IR.Func('in', [
-              new IR.PropRef(['relatedIssueId']),
-              new IR.Value(ids),
-            ]),
-          ]),
-        ]),
-      },
-    )
-    const expected = scopeRows
-      .filter(
-        (row) => allowed.has(row.issueId) || allowed.has(row.relatedIssueId),
-      )
-      .map((row) => row.issueId)
-    expect(rows.map((row) => row.key).sort()).toEqual(expected.sort())
-    expect(driver.reads).toHaveLength(1)
-    expect(driver.reads[0]?.rawRows).toBe(expected.length)
-    expect(driver.reads[0]?.parameters).toBe(2)
-    const plan = driver.db
-      .prepare(`EXPLAIN QUERY PLAN ${driver.reads[0]!.sql}`)
-      .all(JSON.stringify(ids), JSON.stringify(ids)) as Array<{
-      detail: string
-    }>
-    const tableName = createPersistedTableName(collectionId, 'c')
-    expect(
-      plan.some(
-        ({ detail }) =>
-          detail.startsWith(`SCAN ${tableName}`) ||
-          detail.startsWith(`SCAN "${tableName}"`),
-      ),
-    ).toBe(false)
-    for (const field of ['issueId', 'relatedIssueId']) {
-      const index = driver.db
-        .prepare(
-          `SELECT index_name FROM persisted_index_registry WHERE collection_id = ? AND signature = ?`,
-        )
-        .get(collectionId, field) as { index_name: string }
-      expect(
-        plan.some(
-          ({ detail }) =>
-            detail.startsWith('SEARCH') && detail.includes(index.index_name),
-        ),
-      ).toBe(true)
-    }
-  } finally {
-    driver.db.close()
-  }
-})
-
-// Ordinary runtime membership transports its list through one JSON binding.
-// The independent work rule therefore permits zero SQL-literal quoting of list
-// values. Counting the quoting primitive detects discarded construction that
-// cannot be seen in the final SQL. The original compiler performs two quotes
-// per value; exact result and binding checks retain the receiving contract.
-// A sequential index-expression control proves the sensor still sees quoting
-// before the bound-path counter resets; changing the primitive cannot pass silently.
-it.sequential.each([0, 1, 32, 1_025])(
-  'avoids discarded literal quoting for bound string membership / %i',
-  async (size) => {
-    const driver = new CountingDriver()
-    const adapter = new SQLiteCorePersistenceAdapter({ driver })
-    const values = Array.from({ length: size }, (_, index) => `work-${index}`)
-    const control = 'quote-probe-control'
-    const observedValues = new Set([...values, control])
-    let quotedValues = 0
-    const replace = String.prototype.replace
-    const quoteProbe = vi
-      .spyOn(String.prototype, 'replace')
-      .mockImplementation(function (
-        this: string,
-        ...args: Parameters<typeof replace>
-      ) {
-        if (observedValues.has(String(this))) quotedValues++
-        return Reflect.apply(replace, this, args)
-      })
-    try {
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: 'string-membership-work' },
-        {
-          txId: 'seed',
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            { type: 'insert', key: 'match', value: { value: 'work-0' } },
-            { type: 'insert', key: 'other', value: { value: 'outside' } },
-          ],
-        },
-      )
-      // An index literal must reach the probe, even for an empty bound list.
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: 'string-membership-work' },
-        'quote-control',
-        {
-          expressionSql: [
-            JSON.stringify(
-              new IR.Func('coalesce', [
-                new IR.PropRef(['value']),
-                new IR.Value(control),
-              ]),
-            ),
-          ],
-        },
-      )
-      expect(quotedValues).toBeGreaterThan(0)
-      quotedValues = 0
-      driver.reads = []
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: 'string-membership-work' },
-        {
-          where: new IR.Func('in', [
-            new IR.PropRef(['value']),
-            new IR.Value(values),
-          ]),
-        },
-      )
-      expect(rows.map((row) => row.key)).toEqual(size === 0 ? [] : ['match'])
-      expect(driver.reads).toHaveLength(1)
-      expect(driver.reads[0]?.parameters).toBe(size === 0 ? 0 : 1)
-      expect(quotedValues).toBe(0)
-    } finally {
-      quoteProbe.mockRestore()
-      driver.db.close()
-    }
-  },
-)
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-support.ts b/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-support.ts
new file mode 100644
index 0000000000..bf49613acf
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity-support.ts
@@ -0,0 +1,78 @@
+import { DatabaseSync } from 'node:sqlite'
+import type { SQLiteDriver } from '../src'
+
+// Fixtures for the boolean-arity oracle and its ordinary scenario tests. The
+// oracle in `sqlite-boolean-arity-oracle.test.ts` owns the law.
+
+export type Read = { sql: string; rawRows: number; parameters: number }
+
+export class CountingDriver implements SQLiteDriver {
+  readonly db = new DatabaseSync(':memory:')
+  reads: Array<Read> = []
+  private depth = 0
+  mutantUnaryValue: 'x' | 1 | undefined
+  mutantDropWhere = false
+  mutantPushUnsafeOr = false
+
+  exec(sql: string): Promise<void> {
+    this.db.exec(sql)
+    return Promise.resolve()
+  }
+  run(sql: string, params: ReadonlyArray<unknown> = []): Promise<void> {
+    this.db
+      .prepare(sql)
+      .run(...(params as Array<string | number | bigint | null>))
+    return Promise.resolve()
+  }
+  query<T>(
+    sql: string,
+    params: ReadonlyArray<unknown> = [],
+  ): Promise<ReadonlyArray<T>> {
+    const collectionRead = sql.startsWith(
+      'SELECT key, value, metadata, row_version FROM',
+    )
+    if (
+      collectionRead &&
+      this.mutantUnaryValue !== undefined &&
+      !sql.includes(' WHERE ')
+    ) {
+      sql += ' WHERE (?)'
+      params = [...params, this.mutantUnaryValue]
+    }
+    if (collectionRead && this.mutantDropWhere && sql.includes(' WHERE ')) {
+      sql = sql.slice(0, sql.indexOf(' WHERE '))
+      params = []
+    }
+    if (collectionRead && this.mutantPushUnsafeOr && !sql.includes(' WHERE ')) {
+      sql += ` WHERE LOWER(json_extract(value, '$.name')) LIKE LOWER(?)`
+      params = [...params, 'ä']
+    }
+    const rows = this.db
+      .prepare(sql)
+      .all(...(params as Array<string | number | bigint | null>)) as Array<T>
+    if (collectionRead)
+      this.reads.push({
+        sql,
+        rawRows: rows.length,
+        parameters: params.length,
+      })
+    return Promise.resolve(rows)
+  }
+  async transaction<T>(fn: (driver: SQLiteDriver) => Promise<T>): Promise<T> {
+    const depth = this.depth++
+    this.db.exec(depth === 0 ? 'BEGIN' : `SAVEPOINT nested_${depth}`)
+    try {
+      const result = await fn(this)
+      this.db.exec(depth === 0 ? 'COMMIT' : `RELEASE SAVEPOINT nested_${depth}`)
+      return result
+    } catch (error) {
+      this.db.exec(
+        depth === 0 ? 'ROLLBACK' : `ROLLBACK TO SAVEPOINT nested_${depth}`,
+      )
+      if (depth > 0) this.db.exec(`RELEASE SAVEPOINT nested_${depth}`)
+      throw error
+    } finally {
+      this.depth--
+    }
+  }
+}
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity.test.ts
new file mode 100644
index 0000000000..395589a260
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-boolean-arity.test.ts
@@ -0,0 +1,185 @@
+// @vitest-environment node
+/**
+ * Scenario checks for SQLite boolean-arity reads: a large string-ID OR scope
+ * stays selective, and bound string membership avoids discarded quoting. The
+ * boolean-arity oracle in `sqlite-boolean-arity-oracle.test.ts` owns the law.
+ */
+import { expect, it, vi } from 'vitest'
+import { IR } from '@tanstack/db'
+import { SQLiteCorePersistenceAdapter, createPersistedTableName } from '../src'
+import { CountingDriver } from './sqlite-boolean-arity-support'
+
+it('keeps large string-ID OR scopes selective at the SQLite boundary', async () => {
+  const driver = new CountingDriver()
+  const adapter = new SQLiteCorePersistenceAdapter({ driver })
+  const collectionId = 'string-id-scope'
+  const scopeRows = Array.from({ length: 20 }, (_, index) => ({
+    issueId: `issue-${index}`,
+    relatedIssueId:
+      ['related-\uD800', 'related-\u0000', 'related-😀'][index] ??
+      `related-${index}`,
+  }))
+  const ids = Array.from({ length: 50_582 }, (_, index) => `other-${index}`)
+  ids[5_001] = 'related-\uD800'
+  ids[25_291] = 'issue-1'
+  ids[35_001] = 'related-\u0000'
+  ids[45_001] = 'related-😀'
+  const allowed = new Set(ids)
+
+  try {
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        txId: 'seed-string-scope',
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: scopeRows.map((row) => ({
+          type: 'insert' as const,
+          key: row.issueId,
+          value: structuredClone(row),
+        })),
+      },
+    )
+    for (const field of ['issueId', 'relatedIssueId']) {
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        field,
+        {
+          expressionSql: [JSON.stringify(new IR.PropRef([field]))],
+        },
+      )
+    }
+
+    driver.reads = []
+    const rows = await adapter.loadSubset(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        where: new IR.Func('and', [
+          new IR.Func('or', [
+            new IR.Func('in', [new IR.PropRef(['issueId']), new IR.Value(ids)]),
+            new IR.Func('in', [
+              new IR.PropRef(['relatedIssueId']),
+              new IR.Value(ids),
+            ]),
+          ]),
+        ]),
+      },
+    )
+    const expected = scopeRows
+      .filter(
+        (row) => allowed.has(row.issueId) || allowed.has(row.relatedIssueId),
+      )
+      .map((row) => row.issueId)
+    expect(rows.map((row) => row.key).sort()).toEqual(expected.sort())
+    expect(driver.reads).toHaveLength(1)
+    expect(driver.reads[0]?.rawRows).toBe(expected.length)
+    expect(driver.reads[0]?.parameters).toBe(2)
+    const plan = driver.db
+      .prepare(`EXPLAIN QUERY PLAN ${driver.reads[0]!.sql}`)
+      .all(JSON.stringify(ids), JSON.stringify(ids)) as Array<{
+      detail: string
+    }>
+    const tableName = createPersistedTableName(collectionId, 'c')
+    expect(
+      plan.some(
+        ({ detail }) =>
+          detail.startsWith(`SCAN ${tableName}`) ||
+          detail.startsWith(`SCAN "${tableName}"`),
+      ),
+    ).toBe(false)
+    for (const field of ['issueId', 'relatedIssueId']) {
+      const index = driver.db
+        .prepare(
+          `SELECT index_name FROM persisted_index_registry WHERE collection_id = ? AND signature = ?`,
+        )
+        .get(collectionId, field) as { index_name: string }
+      expect(
+        plan.some(
+          ({ detail }) =>
+            detail.startsWith('SEARCH') && detail.includes(index.index_name),
+        ),
+      ).toBe(true)
+    }
+  } finally {
+    driver.db.close()
+  }
+})
+
+// Ordinary runtime membership transports its list through one JSON binding.
+// The independent work rule therefore permits zero SQL-literal quoting of list
+// values. Counting the quoting primitive detects discarded construction that
+// cannot be seen in the final SQL. The original compiler performs two quotes
+// per value; exact result and binding checks retain the receiving contract.
+// A sequential index-expression control proves the sensor still sees quoting
+// before the bound-path counter resets; changing the primitive cannot pass silently.
+it.sequential.each([0, 1, 32, 1_025])(
+  'avoids discarded literal quoting for bound string membership / %i',
+  async (size) => {
+    const driver = new CountingDriver()
+    const adapter = new SQLiteCorePersistenceAdapter({ driver })
+    const values = Array.from({ length: size }, (_, index) => `work-${index}`)
+    const control = 'quote-probe-control'
+    const observedValues = new Set([...values, control])
+    let quotedValues = 0
+    const replace = String.prototype.replace
+    const quoteProbe = vi
+      .spyOn(String.prototype, 'replace')
+      .mockImplementation(function (
+        this: string,
+        ...args: Parameters<typeof replace>
+      ) {
+        if (observedValues.has(String(this))) quotedValues++
+        return Reflect.apply(replace, this, args)
+      })
+    try {
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: 'string-membership-work' },
+        {
+          txId: 'seed',
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            { type: 'insert', key: 'match', value: { value: 'work-0' } },
+            { type: 'insert', key: 'other', value: { value: 'outside' } },
+          ],
+        },
+      )
+      // An index literal must reach the probe, even for an empty bound list.
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: 'string-membership-work' },
+        'quote-control',
+        {
+          expressionSql: [
+            JSON.stringify(
+              new IR.Func('coalesce', [
+                new IR.PropRef(['value']),
+                new IR.Value(control),
+              ]),
+            ),
+          ],
+        },
+      )
+      expect(quotedValues).toBeGreaterThan(0)
+      quotedValues = 0
+      driver.reads = []
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: 'string-membership-work' },
+        {
+          where: new IR.Func('in', [
+            new IR.PropRef(['value']),
+            new IR.Value(values),
+          ]),
+        },
+      )
+      expect(rows.map((row) => row.key)).toEqual(size === 0 ? [] : ['match'])
+      expect(driver.reads).toHaveLength(1)
+      expect(driver.reads[0]?.parameters).toBe(size === 0 ? 0 : 1)
+      expect(quotedValues).toBe(0)
+    } finally {
+      quoteProbe.mockRestore()
+      driver.db.close()
+    }
+  },
+)
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-binding-support.ts b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-binding-support.ts
new file mode 100644
index 0000000000..485fde3f44
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-binding-support.ts
@@ -0,0 +1,519 @@
+/**
+ * Support for the SQLite subset binding-capacity oracle: the predicate
+ * specifications, the production driver with its binding cap, the observation,
+ * the independent model (expectedBindingRows), and the check (violation). The
+ * oracle file owns the law, its histories, and its registered tests. This
+ * module is ordinary: it registers no tests.
+ */
+import assert from 'node:assert/strict'
+import { DatabaseSync } from 'node:sqlite'
+import { inspect } from 'node:util'
+import { IR } from '@tanstack/db'
+import { SQLiteCorePersistenceAdapter } from '../src'
+import type { SQLiteDriver } from '../src'
+
+export const BINDING_CAP = 999
+export type Kind = 'string' | 'number' | 'boolean' | 'date' | 'bigint'
+export type Scalar = string | number | boolean | Date | bigint
+export type Clause = {
+  field: 'a' | 'b'
+  kind: 'in' | 'eq'
+  values: ReadonlyArray<Scalar>
+}
+export type Spec = {
+  label: string
+  valueKind: Kind
+  connective: 'and' | 'or'
+  clauses: ReadonlyArray<Clause>
+  nested?: boolean
+  ordered?: boolean
+  rows?: ReadonlyArray<Row>
+}
+export type Row = { key: string; value: { a: Scalar; b: Scalar } }
+export type Attempt = {
+  method: 'exec' | 'query' | 'run'
+  sql: string
+  bindings: number
+  error?: string
+}
+
+function target(kind: Kind): Scalar {
+  switch (kind) {
+    case 'string':
+      return 'target'
+    case 'number':
+      return 123_456
+    case 'boolean':
+      return true
+    case 'date':
+      return new Date('2026-01-01T00:00:00.000Z')
+    case 'bigint':
+      return 9_007_199_254_740_993n
+  }
+}
+function miss(kind: Kind, ordinal: number): Scalar {
+  switch (kind) {
+    case 'string':
+      return `miss-${ordinal}`
+    case 'number':
+      return ordinal
+    case 'boolean':
+      return false
+    case 'date':
+      return new Date(Date.UTC(2020, 0, 1 + ordinal))
+    case 'bigint':
+      return 9_007_199_254_751_000n + BigInt(ordinal)
+  }
+}
+function values(kind: Kind, length: number): Array<Scalar> {
+  const result = Array.from({ length }, (_, index) => miss(kind, index))
+  if (length) result[Math.floor(length / 2)] = target(kind)
+  return result
+}
+function same(left: Scalar, right: Scalar): boolean {
+  return left instanceof Date && right instanceof Date
+    ? left.getTime() === right.getTime()
+    : left === right
+}
+export function expectedBindingRows(
+  spec: Spec,
+  rows: ReadonlyArray<Row>,
+): Array<string> {
+  return rows
+    .filter((row) => {
+      const decisions = spec.clauses.map((clause) => {
+        const field = row.value[clause.field]
+        return clause.kind === 'eq'
+          ? same(field, clause.values[0]!)
+          : clause.values.some((candidate) => same(field, candidate))
+      })
+      if (spec.nested) return (decisions[0] || decisions[1]) && decisions[2]
+      return spec.connective === 'and'
+        ? decisions.every(Boolean)
+        : decisions.some(Boolean)
+    })
+    .sort((a, b) =>
+      spec.ordered
+        ? String(a.value.a).localeCompare(String(b.value.a))
+        : a.key.localeCompare(b.key),
+    )
+    .map((row) => row.key)
+}
+export function predicate(spec: Spec): IR.BasicExpression<boolean> {
+  const clauses = spec.clauses.map(
+    (clause) =>
+      new IR.Func(clause.kind, [
+        new IR.PropRef([clause.field]),
+        new IR.Value(
+          clause.kind === 'eq' ? clause.values[0] : [...clause.values],
+        ),
+      ]),
+  )
+  if (spec.nested)
+    return new IR.Func('and', [
+      new IR.Func('or', [clauses[0]!, clauses[1]!]),
+      clauses[2]!,
+    ])
+  return clauses.length === 1
+    ? clauses[0]!
+    : new IR.Func(spec.connective, clauses)
+}
+
+export function preparedDriver(
+  db: DatabaseSync,
+  attempts: Array<Attempt>,
+  withDriver = false,
+  cap = BINDING_CAP,
+  omitTransactionCap = false,
+  forceControlledCap = false,
+) {
+  let record = false
+  let nextSavepoint = 0
+  const nativeCap = (
+    db as DatabaseSync & { limits?: { variableNumber: number } }
+  ).limits?.variableNumber
+  const controlledCap = forceControlledCap || nativeCap === undefined
+  function checkCapacity(bindings: number): void {
+    if (controlledCap && bindings > cap)
+      throw new RangeError(
+        `host parameter limit exceeded: ${bindings} > ${cap}`,
+      )
+  }
+  const driver: SQLiteDriver & { startObservation: () => void } = {
+    maxBoundParameters: cap,
+    startObservation() {
+      record = true
+    },
+    exec(sql: string): Promise<void> {
+      const attempt: Attempt = { method: 'exec', sql, bindings: 0 }
+      if (record) attempts.push(attempt)
+      try {
+        db.exec(sql)
+        return Promise.resolve()
+      } catch (error) {
+        attempt.error = String(error)
+        return Promise.reject(error)
+      }
+    },
+    query<T>(
+      sql: string,
+      params: ReadonlyArray<unknown> = [],
+    ): Promise<ReadonlyArray<T>> {
+      const attempt: Attempt = { method: 'query', sql, bindings: params.length }
+      if (record) attempts.push(attempt)
+      try {
+        checkCapacity(params.length)
+        return Promise.resolve(
+          db
+            .prepare(sql)
+            .all(
+              ...(params as Array<null | number | bigint | string>),
+            ) as Array<T>,
+        )
+      } catch (error) {
+        attempt.error = String(error)
+        return Promise.reject(error)
+      }
+    },
+    run(sql: string, params: ReadonlyArray<unknown> = []): Promise<void> {
+      const attempt: Attempt = { method: 'run', sql, bindings: params.length }
+      if (record) attempts.push(attempt)
+      try {
+        checkCapacity(params.length)
+        db.prepare(sql).run(
+          ...(params as Array<null | number | bigint | string>),
+        )
+        return Promise.resolve()
+      } catch (error) {
+        attempt.error = String(error)
+        return Promise.reject(error)
+      }
+    },
+    async transaction<T>(
+      fn: (transactionDriver: SQLiteDriver) => Promise<T>,
+    ): Promise<T> {
+      const savepoint = `oracle_${++nextSavepoint}`
+      db.exec(`SAVEPOINT ${savepoint}`)
+      try {
+        const result = await fn(driver)
+        db.exec(`RELEASE ${savepoint}`)
+        return result
+      } catch (error) {
+        db.exec(`ROLLBACK TO ${savepoint}`)
+        db.exec(`RELEASE ${savepoint}`)
+        throw error
+      }
+    },
+  }
+  if (withDriver) {
+    driver.transactionWithDriver = omitTransactionCap
+      ? (fn) =>
+          driver.transaction(() =>
+            fn({
+              exec: driver.exec,
+              query: driver.query,
+              run: driver.run,
+              transaction: driver.transaction,
+            }),
+          )
+      : driver.transaction
+  }
+  return driver
+}
+
+export function limitedDatabase(cap = BINDING_CAP): DatabaseSync {
+  // Older Node versions ignore this option; preparedDriver then enforces the cap.
+  const options = { limits: { variableNumber: cap } }
+  const db = new DatabaseSync(
+    ':memory:',
+    options as unknown as NonNullable<
+      ConstructorParameters<typeof DatabaseSync>[1]
+    >,
+  )
+  const nativeCap = (
+    db as DatabaseSync & { limits?: { variableNumber: number } }
+  ).limits?.variableNumber
+  if (nativeCap !== undefined)
+    assert.equal(
+      nativeCap,
+      cap,
+      'SQLite did not apply the requested variable limit',
+    )
+  return db
+}
+
+export type Observation = {
+  expected: Array<string>
+  expectedValues: Array<{ key: string; value: Row['value'] }>
+  actual?: Array<string>
+  actualValues?: Array<{ key: string; value: Row['value'] }>
+  attempts: Array<Attempt>
+  error?: string
+  cleanupError?: string
+}
+export async function observe(
+  spec: Spec,
+  withDriver = false,
+  cap = BINDING_CAP,
+  omitTransactionCap = false,
+): Promise<Observation> {
+  const db = limitedDatabase(cap)
+  const attempts: Array<Attempt> = []
+  let observation: Observation | undefined
+  try {
+    const driver = preparedDriver(
+      db,
+      attempts,
+      withDriver,
+      cap,
+      omitTransactionCap,
+    )
+    const adapter = new SQLiteCorePersistenceAdapter({ driver })
+    const rows: Array<Row> = spec.rows
+      ? [...spec.rows]
+      : [
+          {
+            key: 'target',
+            value: { a: target(spec.valueKind), b: target(spec.valueKind) },
+          },
+          {
+            key: 'partial',
+            value: {
+              a: target(spec.valueKind),
+              b: miss(spec.valueKind, 10_000),
+            },
+          },
+          {
+            key: 'miss',
+            value: {
+              a: miss(spec.valueKind, 10_001),
+              b: miss(spec.valueKind, 10_002),
+            },
+          },
+        ]
+    const expected = expectedBindingRows(spec, rows)
+    const expectedValues = expected.map((key) => {
+      const row = rows.find((candidate) => candidate.key === key)!
+      return { key, value: row.value }
+    })
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: 'oracle-1993' },
+      {
+        txId: 'seed',
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: rows.map((row) => ({
+          type: 'insert' as const,
+          key: row.key,
+          value: row.value,
+        })),
+      },
+    )
+    driver.startObservation()
+    try {
+      const result = await adapter.loadSubset(
+        { kind: `eager`, collectionId: 'oracle-1993' },
+        {
+          where: predicate(spec),
+          ...(spec.ordered
+            ? {
+                orderBy: [
+                  {
+                    expression: new IR.PropRef(['a']),
+                    compareOptions: {
+                      direction: 'asc' as const,
+                      nulls: 'last' as const,
+                    },
+                  },
+                ],
+              }
+            : {}),
+        },
+      )
+      const actualValues = result.map((row) => ({
+        key: String(row.key),
+        value: row.value as Row['value'],
+      }))
+      if (!spec.ordered) actualValues.sort((a, b) => a.key.localeCompare(b.key))
+      observation = {
+        expected,
+        expectedValues,
+        actual: actualValues.map((row) => row.key),
+        actualValues,
+        attempts,
+      }
+    } catch (error) {
+      observation = { expected, expectedValues, attempts, error: String(error) }
+    }
+  } finally {
+    try {
+      db.close()
+    } catch (cleanupError) {
+      observation ??= {
+        expected: [],
+        expectedValues: [],
+        attempts,
+        error: 'setup failed',
+      }
+      observation.cleanupError = String(cleanupError)
+    }
+  }
+  return observation
+}
+
+export type Violation = {
+  kind: 'reach' | 'capacity' | 'error' | 'rows' | 'cleanup'
+  checkpoint: string
+  message: string
+}
+export function violation(
+  spec: Spec,
+  observation: Observation,
+  cap = BINDING_CAP,
+): Violation | undefined {
+  const predicateSelects = observation.attempts.filter(
+    (entry) =>
+      entry.method === 'query' &&
+      entry.sql.startsWith('SELECT key, value, metadata, row_version'),
+  )
+  if (predicateSelects.length !== 1)
+    return {
+      kind: 'reach',
+      checkpoint: 'driver-query',
+      message: `predicate SELECT reach=${predicateSelects.length}`,
+    }
+  const over = observation.attempts.filter((entry) => entry.bindings > cap)
+  if (over.length)
+    return {
+      kind: 'capacity',
+      checkpoint: over.some((entry) => predicateSelects.includes(entry))
+        ? 'predicate-select'
+        : 'other-statement',
+      message: `binding cap exceeded: ${over.map((entry) => entry.bindings)}; error=${observation.error ?? 'none'}`,
+    }
+  if (observation.error)
+    return {
+      kind: 'error',
+      checkpoint: 'loadSubset-settlement',
+      message: `loadSubset rejected ${observation.error}`,
+    }
+  try {
+    assert.deepEqual(observation.actual, observation.expected)
+    assert.deepEqual(observation.actualValues, observation.expectedValues)
+  } catch {
+    return {
+      kind: 'rows',
+      checkpoint: 'loadSubset-fulfillment',
+      message: `rows ${inspect(observation.actualValues)} != ${inspect(observation.expectedValues)}`,
+    }
+  }
+  if (observation.cleanupError)
+    return {
+      kind: 'cleanup',
+      checkpoint: 'cleanup',
+      message: `cleanup failed: ${observation.cleanupError}`,
+    }
+  return undefined
+}
+
+export function single(kind: Kind, count: number): Spec {
+  return {
+    label: `single-${kind}-${count}`,
+    valueKind: kind,
+    connective: 'or',
+    clauses: [{ field: 'a', kind: 'in', values: values(kind, count) }],
+  }
+}
+export function dual(
+  kind: Kind,
+  a: number,
+  b: number,
+  connective: 'and' | 'or',
+): Spec {
+  return {
+    label: `dual-${kind}-${a}-${b}-${connective}`,
+    valueKind: kind,
+    connective,
+    clauses: [
+      { field: 'a', kind: 'in', values: values(kind, a) },
+      { field: 'b', kind: 'in', values: values(kind, b) },
+    ],
+  }
+}
+export function mixed(kind: Kind, count: number): Spec {
+  return {
+    label: `mixed-${kind}-${count}+1`,
+    valueKind: kind,
+    connective: 'and',
+    clauses: [
+      { field: 'a', kind: 'in', values: values(kind, count) },
+      { field: 'b', kind: 'eq', values: [target(kind)] },
+    ],
+  }
+}
+export function nested(kind: Kind, a: number, b: number): Spec {
+  return {
+    label: `nested-${kind}-${a}-${b}+1`,
+    valueKind: kind,
+    connective: 'and',
+    nested: true,
+    clauses: [
+      { field: 'a', kind: 'in', values: values(kind, a) },
+      { field: 'b', kind: 'in', values: values(kind, b) },
+      { field: 'b', kind: 'eq', values: [target(kind)] },
+    ],
+  }
+}
+export function chunkBoundary(): Spec {
+  const list = Array.from({ length: 1200 }, (_, i) => `miss-${i}`)
+  list[100] = 'early'
+  list[1100] = 'late'
+  return {
+    label: 'two-hits-across-900',
+    valueKind: 'string',
+    connective: 'or',
+    ordered: true,
+    clauses: [{ field: 'a', kind: 'in', values: list }],
+    rows: [
+      { key: 'late', value: { a: 'late', b: 'none' } },
+      { key: 'miss', value: { a: 'other', b: 'none' } },
+      { key: 'early', value: { a: 'early', b: 'none' } },
+    ],
+  }
+}
+export function escapedStringCase(): Spec {
+  const escaped = `quote' newline\n snowman☃ null\u0000`
+  return {
+    label: `escaped-string-list`,
+    valueKind: `string`,
+    connective: `or`,
+    clauses: [{ field: `a`, kind: `in`, values: [escaped, `different`] }],
+    rows: [
+      { key: `target`, value: { a: escaped, b: `other` } },
+      { key: `miss`, value: { a: `another`, b: `other` } },
+    ],
+  }
+}
+export function bigintBoundary(value: bigint, label: string): Spec {
+  return {
+    label,
+    valueKind: 'bigint',
+    connective: 'or',
+    clauses: [{ field: 'a', kind: 'in', values: [value] }],
+    rows: [
+      { key: 'target', value: { a: value, b: value } },
+      { key: 'miss', value: { a: 0n, b: 0n } },
+    ],
+  }
+}
+export function legalSpec(spec: Spec): boolean {
+  return (
+    spec.clauses.length >= 1 &&
+    spec.clauses.length <= 3 &&
+    (!spec.nested || spec.clauses.length === 3) &&
+    spec.clauses.every(
+      (clause) => clause.kind === 'in' || clause.values.length === 1,
+    )
+  )
+}
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-binding-units.ts b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-binding-units.ts
new file mode 100644
index 0000000000..b095b01259
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-binding-units.ts
@@ -0,0 +1,182 @@
+/**
+ * Unit checks for SQLite subset binding capacity. They compare with literal
+ * expectations: the controlled driver rejects an over-cap statement, a cursor
+ * request issues two bounded SELECTs and returns its literal row, and index
+ * DDL keeps IN values as literals. The ordinary runner
+ * sqlite-core-adapter-cli-runtime.test.ts registers them in the binding-capacity
+ * describe block, so their names stay under that suite. They reach no model or
+ * check, so they are supplemental coverage here.
+ */
+import assert from 'node:assert/strict'
+import { IR } from '@tanstack/db'
+import { expect, it } from 'vitest'
+import { SQLiteCorePersistenceAdapter } from '../src'
+import {
+  BINDING_CAP,
+  limitedDatabase,
+  predicate,
+  preparedDriver,
+  single,
+} from './sqlite-core-adapter-binding-support'
+import type { Attempt } from './sqlite-core-adapter-binding-support'
+
+async function runIndexContext() {
+  const db = limitedDatabase()
+  const attempts: Array<Attempt> = []
+  try {
+    const driver = preparedDriver(db, attempts)
+    const adapter = new SQLiteCorePersistenceAdapter({ driver })
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: 'oracle-index' },
+      {
+        txId: 'seed',
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [
+          {
+            type: 'insert',
+            key: 'target',
+            value: { a: 'target', b: 'target' },
+          },
+        ],
+      },
+    )
+    driver.startObservation()
+    await adapter.ensureIndex(
+      { kind: `eager`, collectionId: 'oracle-index' },
+      'small-in-partial',
+      {
+        expressionSql: [JSON.stringify({ type: 'ref', path: ['a'] })],
+        whereSql: JSON.stringify({
+          type: 'func',
+          name: 'in',
+          args: [
+            { type: 'ref', path: ['b'] },
+            { type: 'val', value: ['target', 'other'] },
+          ],
+        }),
+      },
+    )
+    await adapter.ensureIndex(
+      { kind: `eager`, collectionId: 'oracle-index' },
+      'small-in-expression',
+      {
+        expressionSql: [
+          JSON.stringify({
+            type: 'func',
+            name: 'in',
+            args: [
+              { type: 'ref', path: ['a'] },
+              { type: 'val', value: ['target', 'other'] },
+            ],
+          }),
+        ],
+      },
+    )
+    const ddl = attempts.filter(
+      (entry) => entry.method === 'exec' && entry.sql.includes('CREATE INDEX'),
+    )
+    assert.equal(ddl.length, 2, 'both index-definition paths reached')
+    for (const entry of ddl) {
+      assert.ok(
+        !entry.sql.includes('json_each') && !entry.sql.includes('?'),
+        'index DDL must use literal values',
+      )
+      assert.ok(entry.sql.includes(`'target'`) && entry.sql.includes(`'other'`))
+    }
+  } finally {
+    db.close()
+  }
+}
+
+async function runCursorContext(): Promise<string | undefined> {
+  const db = limitedDatabase()
+  const attempts: Array<Attempt> = []
+  let error: string | undefined
+  let actual: Array<string> | undefined
+  try {
+    const driver = preparedDriver(db, attempts, true)
+    const adapter = new SQLiteCorePersistenceAdapter({ driver })
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: 'oracle-cursor' },
+      {
+        txId: 'seed',
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [
+          {
+            type: 'insert',
+            key: 'target',
+            value: { a: 'target', b: 'target' },
+          },
+        ],
+      },
+    )
+    driver.startObservation()
+    try {
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: 'oracle-cursor' },
+        {
+          where: predicate(single('string', 999)),
+          cursor: {
+            whereCurrent: new IR.Func('eq', [
+              new IR.PropRef(['a']),
+              new IR.Value('target'),
+            ]),
+            whereFrom: new IR.Func('eq', [
+              new IR.PropRef(['b']),
+              new IR.Value('target'),
+            ]),
+          },
+        },
+      )
+      actual = rows.map((row) => String(row.key))
+    } catch (cause) {
+      error = String(cause)
+    }
+  } finally {
+    db.close()
+  }
+  const reads = attempts.filter(
+    (entry) =>
+      entry.method === 'query' &&
+      entry.sql.startsWith('SELECT key, value, metadata, row_version'),
+  )
+  const counts = reads.map((entry) => entry.bindings)
+  const problem =
+    reads.length !== 2
+      ? `expected two cursor SELECTs, got ${reads.length}`
+      : counts.some((count) => count > BINDING_CAP)
+        ? `two cursor SELECTs bind=${counts}; error=${error ?? 'none'}`
+        : error
+          ? `cursor load rejected ${error}`
+          : actual?.join(',') !== 'target'
+            ? `cursor rows=${actual}`
+            : undefined
+  return problem
+}
+
+export function runSQLiteBindingCapacityUnitTests(): void {
+  it(`rejects over-cap bindings at the controlled driver boundary`, async () => {
+    const db = limitedDatabase(100)
+    try {
+      const driver = preparedDriver(db, [], false, 100, false, true)
+      const sql = `SELECT ${Array(101).fill('?').join(' + ')}`
+      await expect(driver.query(sql, Array(101).fill(1))).rejects.toThrow(
+        /host parameter limit exceeded: 101 > 100/,
+      )
+    } finally {
+      db.close()
+    }
+  })
+
+  it(`honors total capacity in each cursor SELECT`, async () => {
+    expect(await runCursorContext()).toBeUndefined()
+  })
+
+  it(`keeps IN values literal in both index-definition contexts`, async () => {
+    await runIndexContext()
+  })
+}
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-cli-runtime.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-cli-runtime.test.ts
index 210e0578ac..a8105ac0de 100644
--- a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-cli-runtime.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-cli-runtime.test.ts
@@ -1,13 +1,12 @@
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { expect, it } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { SQLiteCorePersistenceAdapter } from '../src'
-import {
-  SqliteCliDriver,
-  runSQLiteBindingCapacityOracleSuite,
-  runSQLiteCoreAdapterContractSuite,
-} from './sqlite-core-adapter-oracle.test'
+import { runSQLiteCoreAdapterContractSuite } from './sqlite-core-adapter-contract-suite'
+import { runSQLiteBindingCapacityOracleSuite } from './sqlite-core-adapter-oracle.test'
+import { runSQLiteBindingCapacityUnitTests } from './sqlite-core-adapter-binding-units'
+import { SqliteCliDriver } from './sqlite-core-adapter-support'
 
 // A managed physical storage ID must travel through the real sqlite3 CLI
 // driver, which passes SQL as a process argument. A NUL in that ID prevents
@@ -59,4 +58,9 @@ it(`persists a claimed on-demand row through sqlite3 CLI arguments`, async () =>
 })
 
 runSQLiteCoreAdapterContractSuite(`SQLiteCorePersistenceAdapter (sqlite3 CLI)`)
+// The unit tests register here, in the binding-capacity describe block that
+// the oracle's tests also use, so their full names are unchanged.
+describe(`SQLite subset binding-capacity oracle`, () => {
+  runSQLiteBindingCapacityUnitTests()
+})
 runSQLiteBindingCapacityOracleSuite()
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-contract-suite.ts b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-contract-suite.ts
new file mode 100644
index 0000000000..dc898a09b8
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-contract-suite.ts
@@ -0,0 +1,2575 @@
+/**
+ * The shared SQLite core adapter contract. Each host package runs it through
+ * its contract test file, and so does the sqlite3 CLI runtime test. The
+ * reset/resume lineage and reset calibration tests are owned by
+ * sqlite-core-adapter-oracle.test.ts; this suite registers them at their
+ * original position, so every consumer keeps the same test names and order.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import { IR, createCollection } from '@tanstack/db'
+import {
+  SQLiteCorePersistenceAdapter,
+  createPersistedTableName,
+  persistedCollectionOptions,
+} from '../src'
+import { harnessScope } from './contracts/harness-scope'
+import { runSQLiteResetResumeOracleTests } from './sqlite-core-adapter-oracle.test'
+import { createHarness } from './sqlite-core-adapter-support'
+import type { CommittedTxAnchor, PersistedTx, PersistenceAdapter } from '../src'
+import type { SyncConfig } from '@tanstack/db'
+import type {
+  SQLiteCoreAdapterHarnessFactory,
+  Todo,
+} from './sqlite-core-adapter-support'
+
+function holdAndRejectFirstSubsetLoad(
+  adapter: PersistenceAdapter,
+  failure: Error,
+): { entered: Promise<void>; release: () => void } {
+  let enter!: () => void
+  let release!: () => void
+  const entered = new Promise<void>((resolve) => {
+    enter = resolve
+  })
+  const held = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  let loadCalls = 0
+  const intercept =
+    (loadSubset: PersistenceAdapter[`loadSubset`]) =>
+    async (...args: Parameters<PersistenceAdapter[`loadSubset`]>) => {
+      loadCalls++
+      if (loadCalls === 1) {
+        enter()
+        await held
+        throw failure
+      }
+      return loadSubset(...args)
+    }
+
+  const runInHydrationScope = adapter.runInHydrationScope?.bind(adapter)
+  if (runInHydrationScope) {
+    adapter.runInHydrationScope = (task) =>
+      runInHydrationScope((scopedAdapter) =>
+        task({
+          ...scopedAdapter,
+          loadSubset: intercept(scopedAdapter.loadSubset),
+        }),
+      )
+  } else {
+    adapter.loadSubset = intercept(adapter.loadSubset.bind(adapter))
+  }
+
+  return { entered, release }
+}
+
+export function runSQLiteCoreAdapterContractSuite(
+  suiteName: string = `SQLiteCorePersistenceAdapter`,
+  harnessFactory: SQLiteCoreAdapterHarnessFactory = createHarness,
+): void {
+  const scope = harnessScope(harnessFactory)
+  const registerContractHarness = scope.create
+
+  describe(suiteName, () => {
+    afterEach(scope.cleanup)
+    /**
+     * A Web Lock successor may be cold: its observed term is zero even when
+     * earlier no-write owners existed. The durable leader_term ledger, rather
+     * than the caller's memory, is the independent lower bound for each new
+     * term. Reservation itself does not advance the row version or create an
+     * applied transaction. This driver exercises the real SQLite adapter and
+     * observes both returned positions and the durable table after each cut.
+     */
+    it(`reserves distinct durable terms across empty elections`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      if (!adapter.reserveLeadershipTerm) {
+        throw new Error(`SQLite adapter has no durable term reservation`)
+      }
+      const reserve = adapter.reserveLeadershipTerm.bind(adapter)
+      const collectionId = `cold-successor-terms`
+      const observeDurableTerm = async () =>
+        driver.query<{ latest_term: number }>(
+          `SELECT latest_term FROM leader_term WHERE collection_id = ?`,
+          [collectionId],
+        )
+      expect(
+        await reserve({ kind: `eager`, collectionId: collectionId }, 0),
+      ).toEqual({
+        latestTerm: 1,
+        latestSeq: 0,
+        latestRowVersion: 0,
+      })
+      expect(await observeDurableTerm()).toEqual([{ latest_term: 1 }])
+      expect(
+        await reserve({ kind: `eager`, collectionId: collectionId }, 0),
+      ).toEqual({
+        latestTerm: 2,
+        latestSeq: 0,
+        latestRowVersion: 0,
+      })
+      expect(await observeDurableTerm()).toEqual([{ latest_term: 2 }])
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `term-two-write`,
+          term: 2,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [],
+        },
+      )
+      expect(
+        await reserve({ kind: `eager`, collectionId: collectionId }, 0),
+      ).toEqual({
+        latestTerm: 3,
+        latestSeq: 0,
+        latestRowVersion: 1,
+      })
+      expect(await observeDurableTerm()).toEqual([{ latest_term: 3 }])
+      expect(
+        await reserve({ kind: `eager`, collectionId: collectionId }, 8),
+      ).toEqual({
+        latestTerm: 9,
+        latestSeq: 0,
+        latestRowVersion: 1,
+      })
+      expect(await observeDurableTerm()).toEqual([{ latest_term: 9 }])
+    })
+
+    /**
+     * Exact-ID reconciliation has one equality lookup under the writer lock.
+     * The query plan must seek by both collection and transaction ID; a plan
+     * that only seeks by collection grows with retained transaction count.
+     * A real SQLite plan is the work observation, independent of elapsed time.
+     */
+    it(`indexes exact transaction ID lookup within a collection`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: `plan-index`,
+      })
+      const plan = await driver.query<{ detail: string }>(
+        `EXPLAIN QUERY PLAN
+         SELECT term, seq, row_version FROM applied_tx
+         WHERE collection_id = ? AND tx_id = ? LIMIT 2`,
+        [`plan-index`, `target`],
+      )
+      expect(plan.map(({ detail }) => detail).join(` | `)).toMatch(
+        /idx_applied_tx_collection_tx_id.*collection_id=\?.*tx_id=\?/,
+      )
+    })
+
+    /**
+     * An unanswered source transaction may be acknowledged by its exact
+     * durable ID, or applied when no durable write followed its pre-send
+     * anchor. A different write, reset, or pruned ID cannot authorize late
+     * application: opaque source cursors and same-key values may be newer.
+     *
+     * The reference below comes from the authored durable history, not the
+     * adapter's SQL. Each scenario uses a real SQLite collection. The check
+     * observes the result, complete rows, cursor, row version, and exact log
+     * IDs after reconciliation; a successful duplicate write would fail the
+     * ledger and version comparison even if its final row matched. Each txId
+     * identifies one immutable source payload; reusing an ID for different
+     * content is outside this source-transaction grammar.
+     * The CLI harness starts a sqlite3 process for each SQL command, so these
+     * seven histories need more than Vitest's default timeout under parallel CI.
+     */
+    it(`reconciles only a certified source transaction against SQLite`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      if (!adapter.reconcileCommittedTx) {
+        throw new Error(`SQLite adapter has no reconciliation operation`)
+      }
+      const reconcile = adapter.reconcileCommittedTx.bind(adapter)
+      const anchor: CommittedTxAnchor = {
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }
+      const tx = (
+        txId: string,
+        term: number,
+        seq: number,
+        rowVersion: number,
+        title: string,
+      ): PersistedTx => ({
+        txId,
+        term,
+        seq,
+        rowVersion,
+        mutations: [
+          {
+            type: `insert`,
+            key: `same-key`,
+            value: {
+              id: `same-key`,
+              title,
+              createdAt: `2026-01-01T00:00:00.000Z`,
+              score: 1,
+            },
+          },
+        ],
+        collectionMetadataMutations: [
+          { type: `set`, key: `probe:cursor`, value: title },
+        ],
+      })
+      const observe = async (collectionId: string) => {
+        const snapshot = await adapter.loadResumeSnapshot({
+          kind: `eager`,
+          collectionId: collectionId,
+        })
+        const log = await driver.query<{ tx_id: string }>(
+          `SELECT tx_id FROM applied_tx WHERE collection_id = ? ORDER BY row_version`,
+          [collectionId],
+        )
+        return {
+          title: (snapshot.rows[0]?.value as Todo | undefined)?.title ?? null,
+          cursor:
+            (snapshot.collectionMetadata.find(
+              ({ key }) => key === `probe:cursor`,
+            )?.value as string | undefined) ?? null,
+          rowVersion: snapshot.latestRowVersion,
+          txIds: log.map(({ tx_id }) => tx_id),
+        }
+      }
+
+      const appliedId = `source-id-present`
+      const crossing = tx(`crossing`, 1, 1, 1, `crossing`)
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: appliedId },
+        crossing,
+      )
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: appliedId },
+        tx(`peer`, 1, 2, 2, `newer`),
+      )
+      expect(
+        await reconcile(
+          { kind: `eager`, collectionId: appliedId },
+          tx(`crossing`, 2, 1, 2, `crossing`),
+          anchor,
+        ),
+      ).toEqual({
+        kind: `already-applied`,
+        committed: { term: 1, seq: 1, rowVersion: 1 },
+        latestRowVersion: 2,
+      })
+      expect(await observe(appliedId)).toEqual({
+        title: `newer`,
+        cursor: `newer`,
+        rowVersion: 2,
+        txIds: [`crossing`, `peer`],
+      })
+
+      const absentId = `source-id-absent`
+      expect(
+        await reconcile(
+          { kind: `eager`, collectionId: absentId },
+          tx(`crossing`, 2, 1, 1, `crossing`),
+          anchor,
+        ),
+      ).toEqual({
+        kind: `applied-now`,
+        committed: { term: 2, seq: 1, rowVersion: 1 },
+        latestRowVersion: 1,
+      })
+      expect(await observe(absentId)).toEqual({
+        title: `crossing`,
+        cursor: `crossing`,
+        rowVersion: 1,
+        txIds: [`crossing`],
+      })
+
+      const intervenedId = `source-intervened`
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: intervenedId },
+        tx(`peer`, 2, 1, 1, `newer`),
+      )
+      expect(
+        await reconcile(
+          { kind: `eager`, collectionId: intervenedId },
+          tx(`crossing`, 2, 2, 2, `stale`),
+          anchor,
+        ),
+      ).toEqual({ kind: `unknown` })
+      expect(await observe(intervenedId)).toEqual({
+        title: `newer`,
+        cursor: `newer`,
+        rowVersion: 1,
+        txIds: [`peer`],
+      })
+
+      const prunedId = `source-pruned`
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: prunedId },
+        crossing,
+      )
+      await driver.run(`DELETE FROM applied_tx WHERE collection_id = ?`, [
+        prunedId,
+      ])
+      expect(
+        await reconcile(
+          { kind: `eager`, collectionId: prunedId },
+          tx(`crossing`, 2, 1, 2, `stale`),
+          anchor,
+        ),
+      ).toEqual({ kind: `unknown` })
+      expect(await observe(prunedId)).toEqual({
+        title: `crossing`,
+        cursor: `crossing`,
+        rowVersion: 1,
+        txIds: [],
+      })
+
+      const resetId = `source-reset`
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: resetId },
+        crossing,
+      )
+      const resetAdapter = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+        schemaMismatchPolicy: `sync-present-reset`,
+      })
+      await resetAdapter.loadSubset(
+        { kind: `eager`, collectionId: resetId },
+        {},
+      )
+      expect(
+        await resetAdapter.reconcileCommittedTx(
+          { kind: `eager`, collectionId: resetId },
+          tx(`crossing`, 2, 1, 1, `stale`),
+          anchor,
+        ),
+      ).toEqual({ kind: `unknown` })
+      const resetSnapshot = await resetAdapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: resetId,
+      })
+      expect({
+        ids: resetSnapshot.rows.map(({ key }) => key),
+        resetEpoch: resetSnapshot.resetEpoch,
+        rowVersion: resetSnapshot.latestRowVersion,
+      }).toEqual({ ids: [], resetEpoch: 1, rowVersion: 0 })
+
+      const staleId = `source-old-id`
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: staleId },
+        crossing,
+      )
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: staleId },
+        tx(`peer`, 1, 2, 2, `newer`),
+      )
+      expect(
+        await reconcile(
+          { kind: `eager`, collectionId: staleId },
+          tx(`crossing`, 2, 1, 3, `crossing`),
+          {
+            latestRowVersion: 1,
+            resetEpoch: 0,
+          },
+        ),
+      ).toEqual({ kind: `unknown` })
+      expect(await observe(staleId)).toEqual({
+        title: `newer`,
+        cursor: `newer`,
+        rowVersion: 2,
+        txIds: [`crossing`, `peer`],
+      })
+
+      const malformedId = `source-missing-anchor`
+      await expect(async () =>
+        reconcile(
+          { kind: `eager`, collectionId: malformedId },
+          tx(`crossing`, 2, 1, 1, `unsafe`),
+          undefined as unknown as CommittedTxAnchor,
+        ),
+      ).rejects.toThrow(/valid durable anchor/)
+      expect(await observe(malformedId)).toEqual({
+        title: null,
+        cursor: null,
+        rowVersion: 0,
+        txIds: [],
+      })
+    }, 30_000)
+
+    /**
+     * A cache claim belongs to one physical generation. The reference history
+     * keeps the old claim live after rotation, rejects each live claim on the
+     * other physical generation, then expires the old one while the new
+     * generation remains live. Exact-ID reconciliation and term reservation
+     * may use the old generation before expiry; afterward neither operation
+     * may advance its durable log. The new claim remains independently usable.
+     * This driver observes the returned result and both durable ledgers at
+     * each cut, so checking only a rejected promise cannot mask a late write.
+     */
+    it(`fences reconciliation and term reservation when a cache claim expires`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      if (
+        !adapter.claimCacheGeneration ||
+        !adapter.rotateCacheGeneration ||
+        !adapter.reconcileCommittedTx ||
+        !adapter.reserveLeadershipTerm
+      ) {
+        throw new Error(`SQLite adapter lacks managed cache operations`)
+      }
+      const logicalId = `claim-reconciliation`
+      const oldClaim = await adapter.claimCacheGeneration(logicalId)
+      const oldId = oldClaim.storageCollectionId
+      const rotatingClaim = await adapter.claimCacheGeneration(logicalId)
+      const newClaim = await adapter.rotateCacheGeneration(
+        logicalId,
+        rotatingClaim.claimId,
+        undefined,
+        oldId,
+      )
+      const newId = newClaim.storageCollectionId
+      expect(newId).not.toBe(oldId)
+      const candidate = (claimId: string, txId: string): PersistedTx => ({
+        txId,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        cacheGenerationClaimId: claimId,
+        mutations: [],
+      })
+      const anchor: CommittedTxAnchor = {
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }
+      const observeLedger = async (collectionId: string) => ({
+        terms: await driver.query<{ latest_term: number }>(
+          `SELECT latest_term FROM leader_term WHERE collection_id = ?`,
+          [collectionId],
+        ),
+        transactions: await driver.query<{ tx_id: string }>(
+          `SELECT tx_id FROM applied_tx WHERE collection_id = ?`,
+          [collectionId],
+        ),
+      })
+
+      // Both claims are live here. Existence and expiry alone do not confer
+      // authority over the other physical generation.
+      for (const [targetId, wrongClaimId] of [
+        [oldId, newClaim.claimId],
+        [newId, oldClaim.claimId],
+      ] as const) {
+        await expect(
+          adapter.reserveLeadershipTerm(
+            {
+              kind: `managed`,
+              storageCollectionId: targetId,
+              claimId: wrongClaimId,
+            },
+            0,
+            {
+              cacheGenerationClaimId: wrongClaimId,
+            },
+          ),
+        ).rejects.toThrow(/cache claim is no longer active/)
+        await expect(
+          adapter.reconcileCommittedTx(
+            {
+              kind: `managed`,
+              storageCollectionId: targetId,
+              claimId: wrongClaimId,
+            },
+            candidate(wrongClaimId, `wrong-generation`),
+            anchor,
+          ),
+        ).rejects.toThrow(/cache claim is no longer active/)
+        expect(await observeLedger(targetId)).toEqual({
+          terms: [],
+          transactions: [],
+        })
+      }
+
+      expect(
+        await adapter.reserveLeadershipTerm(
+          {
+            kind: `managed`,
+            storageCollectionId: oldId,
+            claimId: oldClaim.claimId,
+          },
+          0,
+          {
+            cacheGenerationClaimId: oldClaim.claimId,
+          },
+        ),
+      ).toMatchObject({ latestTerm: 1, latestRowVersion: 0 })
+      expect(
+        await adapter.reconcileCommittedTx(
+          {
+            kind: `managed`,
+            storageCollectionId: oldId,
+            claimId: oldClaim.claimId,
+          },
+          candidate(oldClaim.claimId, `old-commit`),
+          anchor,
+        ),
+      ).toMatchObject({ kind: `applied-now` })
+      expect(await observeLedger(oldId)).toEqual({
+        terms: [{ latest_term: 1 }],
+        transactions: [{ tx_id: `old-commit` }],
+      })
+
+      await driver.run(
+        `UPDATE cache_generation_claim SET expires_at_ms = 0 WHERE claim_id = ?`,
+        [oldClaim.claimId],
+      )
+      await expect(
+        adapter.reconcileCommittedTx(
+          {
+            kind: `managed`,
+            storageCollectionId: oldId,
+            claimId: oldClaim.claimId,
+          },
+          candidate(oldClaim.claimId, `late-commit`),
+          { latestRowVersion: 1, resetEpoch: 0 },
+        ),
+      ).rejects.toThrow(/cache claim is no longer active/)
+      await expect(
+        adapter.reserveLeadershipTerm(
+          {
+            kind: `managed`,
+            storageCollectionId: oldId,
+            claimId: oldClaim.claimId,
+          },
+          1,
+          {
+            cacheGenerationClaimId: oldClaim.claimId,
+          },
+        ),
+      ).rejects.toThrow(/cache claim is no longer active/)
+      expect(await observeLedger(oldId)).toEqual({
+        terms: [{ latest_term: 1 }],
+        transactions: [{ tx_id: `old-commit` }],
+      })
+
+      expect(
+        await adapter.reserveLeadershipTerm(
+          {
+            kind: `managed`,
+            storageCollectionId: newId,
+            claimId: newClaim.claimId,
+          },
+          0,
+          {
+            cacheGenerationClaimId: newClaim.claimId,
+          },
+        ),
+      ).toMatchObject({ latestTerm: 1, latestRowVersion: 0 })
+      expect(
+        await adapter.reconcileCommittedTx(
+          {
+            kind: `managed`,
+            storageCollectionId: newId,
+            claimId: newClaim.claimId,
+          },
+          candidate(newClaim.claimId, `new-commit`),
+          anchor,
+        ),
+      ).toMatchObject({ kind: `applied-now` })
+      expect(await observeLedger(newId)).toEqual({
+        terms: [{ latest_term: 1 }],
+        transactions: [{ tx_id: `new-commit` }],
+      })
+    })
+
+    it(`applies transactions idempotently with row versions and tombstones`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const collectionId = `todos`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `tx-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Initial`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 10,
+              },
+            },
+          ],
+        },
+      )
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `tx-1-replay`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Initial`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 10,
+              },
+            },
+          ],
+        },
+      )
+
+      const txRows = await driver.query<{ count: number }>(
+        `SELECT COUNT(*) AS count
+       FROM applied_tx
+       WHERE collection_id = ?`,
+        [collectionId],
+      )
+      expect(txRows[0]?.count).toBe(1)
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `tx-2`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            {
+              type: `update`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Updated`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 11,
+              },
+            },
+          ],
+        },
+      )
+
+      const updated = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(`1`)]),
+        },
+      )
+      expect(updated).toEqual([
+        {
+          key: `1`,
+          value: {
+            id: `1`,
+            title: `Updated`,
+            createdAt: `2026-01-01T00:00:00.000Z`,
+            score: 11,
+          },
+        },
+      ])
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `tx-3`,
+          term: 1,
+          seq: 3,
+          rowVersion: 3,
+          mutations: [
+            {
+              type: `delete`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Updated`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 11,
+              },
+            },
+          ],
+        },
+      )
+
+      const remainingRows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(remainingRows).toEqual([])
+
+      const tombstoneTable = createPersistedTableName(collectionId, `t`)
+      const tombstoneRows = await driver.query<{
+        key: string
+        row_version: number
+      }>(`SELECT key, row_version FROM "${tombstoneTable}"`)
+      expect(tombstoneRows).toHaveLength(1)
+      expect(tombstoneRows[0]?.row_version).toBe(3)
+    })
+
+    it(`reconstructs a seeded baseline before releasing a partial source update after subset failure`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `partial-source-after-subset-failure`
+      const baseline: Todo = {
+        id: `1`,
+        title: `Persisted baseline`,
+        createdAt: `2026-01-01T00:00:00.000Z`,
+        score: 10,
+      }
+      const expected: Todo = { ...baseline, title: `Source update` }
+      const cacheClaim = await adapter.claimCacheGeneration?.(collectionId)
+      if (!cacheClaim) throw new Error(`Expected managed cache claim`)
+      expect(cacheClaim.storageCollectionId).not.toBe(collectionId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: cacheClaim.storageCollectionId,
+          claimId: cacheClaim.claimId,
+        },
+        {
+          txId: `seed-partial-source-baseline`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: cacheClaim.claimId,
+          mutations: [{ type: `insert`, key: baseline.id, value: baseline }],
+        },
+      )
+
+      const subsetFailure = new Error(`controlled incremental subset failure`)
+      const subsetLoad = holdAndRejectFirstSubsetLoad(adapter, subsetFailure)
+
+      let source!: Parameters<SyncConfig<Todo, string>[`sync`]>[0]
+      const collection = createCollection(
+        persistedCollectionOptions<Todo, string>({
+          id: collectionId,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          sync: {
+            rowUpdateMode: `partial`,
+            sync: (params) => {
+              source = params
+              params.markReady()
+              return { loadSubset: () => true }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const project = (row: Todo | undefined) =>
+        row && {
+          id: row.id,
+          title: row.title,
+          createdAt: row.createdAt,
+          score: row.score,
+        }
+
+      let load: Promise<void> | undefined
+      let receipt: Promise<void> | undefined
+      try {
+        await collection.stateWhenReady()
+        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+          () => undefined,
+        )
+        void load.catch(() => undefined)
+        await subsetLoad.entered
+
+        source.begin()
+        source.write({
+          type: `update`,
+          value: { id: baseline.id, title: expected.title } as Todo,
+        })
+        receipt = Promise.resolve(source.commit()).then(() => undefined)
+        let receiptStatus: `pending` | `fulfilled` | `rejected` = `pending`
+        void receipt.then(
+          () => {
+            receiptStatus = `fulfilled`
+          },
+          () => {
+            receiptStatus = `rejected`
+          },
+        )
+        expect(receiptStatus).toBe(`pending`)
+
+        subsetLoad.release()
+        await expect(load).rejects.toBe(subsetFailure)
+        await receipt
+        const durableBeforeRetry = await adapter.loadSubset(
+          {
+            kind: `managed`,
+            storageCollectionId: cacheClaim.storageCollectionId,
+            claimId: cacheClaim.claimId,
+          },
+          {},
+          { cacheGenerationClaimId: cacheClaim.claimId },
+        )
+        expect({
+          receiptStatus,
+          status: collection.status,
+          publicError: collection._lifecycle.getSyncError(),
+          publicBeforeRetry: project(collection.get(baseline.id)),
+          durableBeforeRetry: durableBeforeRetry.map(({ value }) => value),
+        }).toEqual({
+          receiptStatus: `fulfilled`,
+          status: `ready`,
+          publicError: undefined,
+          publicBeforeRetry: expected,
+          durableBeforeRetry: [expected],
+        })
+        expect(
+          await adapter.loadSubset(
+            { kind: `eager`, collectionId: collectionId },
+            {},
+          ),
+        ).toEqual([])
+
+        await collection._sync.loadSubset({ limit: 1 })
+        expect({
+          publicAfterRetry: project(collection.get(baseline.id)),
+          status: collection.status,
+          publicError: collection._lifecycle.getSyncError(),
+        }).toEqual({
+          publicAfterRetry: expected,
+          status: `ready`,
+          publicError: undefined,
+        })
+      } finally {
+        subsetLoad.release()
+        await load?.catch(() => undefined)
+        await receipt?.catch(() => undefined)
+        await collection.cleanup()
+        await adapter.releaseCacheGenerationClaim?.(cacheClaim.claimId)
+      }
+    })
+
+    it.each([`delete`, `insert`] as const)(
+      `settles a buffered complete %s across subset failure and retry`,
+      async (operation) => {
+        const { adapter } = registerContractHarness()
+        const collectionId = `complete-${operation}-after-subset-failure`
+        const row: Todo = {
+          id: `1`,
+          title: `${operation} row`,
+          createdAt: `2026-01-02T00:00:00.000Z`,
+          score: 11,
+        }
+        const cacheClaim = await adapter.claimCacheGeneration?.(collectionId)
+        if (!cacheClaim) throw new Error(`Expected managed cache claim`)
+        expect(cacheClaim.storageCollectionId).not.toBe(collectionId)
+        if (operation === `delete`) {
+          await adapter.applyCommittedTx(
+            {
+              kind: `managed`,
+              storageCollectionId: cacheClaim.storageCollectionId,
+              claimId: cacheClaim.claimId,
+            },
+            {
+              txId: `seed-delete-baseline`,
+              term: 1,
+              seq: 1,
+              rowVersion: 1,
+              cacheGenerationClaimId: cacheClaim.claimId,
+              mutations: [{ type: `insert`, key: row.id, value: row }],
+            },
+          )
+        }
+
+        const subsetFailure = new Error(
+          `controlled ${operation} subset failure`,
+        )
+        const subsetLoad = holdAndRejectFirstSubsetLoad(adapter, subsetFailure)
+
+        let source!: Parameters<SyncConfig<Todo, string>[`sync`]>[0]
+        const collection = createCollection(
+          persistedCollectionOptions<Todo, string>({
+            id: collectionId,
+            getKey: (value) => value.id,
+            syncMode: `on-demand`,
+            sync: {
+              rowUpdateMode: `partial`,
+              sync: (params) => {
+                source = params
+                params.markReady()
+                return { loadSubset: () => true }
+              },
+            },
+            persistence: { adapter },
+          }),
+        )
+
+        let load: Promise<void> | undefined
+        let receipt: Promise<void> | undefined
+        try {
+          await collection.stateWhenReady()
+          load = Promise.resolve(
+            collection._sync.loadSubset({ limit: 1 }),
+          ).then(() => undefined)
+          void load.catch(() => undefined)
+          await subsetLoad.entered
+
+          source.begin()
+          source.write(
+            operation === `delete`
+              ? { type: `delete`, key: row.id }
+              : { type: `insert`, value: row },
+          )
+          receipt = Promise.resolve(source.commit()).then(() => undefined)
+          let receiptStatus: `pending` | `fulfilled` | `rejected` = `pending`
+          void receipt.then(
+            () => {
+              receiptStatus = `fulfilled`
+            },
+            () => {
+              receiptStatus = `rejected`
+            },
+          )
+          expect(receiptStatus).toBe(`pending`)
+
+          subsetLoad.release()
+          await expect(load).rejects.toBe(subsetFailure)
+          await receipt
+          const expectedRows = operation === `delete` ? [] : [row]
+          expect({
+            receiptStatus,
+            publicRows: [...collection.values()].map((value) => ({
+              id: value.id,
+              title: value.title,
+              createdAt: value.createdAt,
+              score: value.score,
+            })),
+            durableRows: (
+              await adapter.loadSubset(
+                {
+                  kind: `managed`,
+                  storageCollectionId: cacheClaim.storageCollectionId,
+                  claimId: cacheClaim.claimId,
+                },
+                {},
+                {
+                  cacheGenerationClaimId: cacheClaim.claimId,
+                },
+              )
+            ).map(({ value }) => value),
+            status: collection.status,
+            publicError: collection._lifecycle.getSyncError(),
+          }).toEqual({
+            receiptStatus: `fulfilled`,
+            publicRows: expectedRows,
+            durableRows: expectedRows,
+            status: `ready`,
+            publicError: undefined,
+          })
+          expect(
+            await adapter.loadSubset(
+              { kind: `eager`, collectionId: collectionId },
+              {},
+            ),
+          ).toEqual([])
+
+          await collection._sync.loadSubset({ limit: 1 })
+          expect({
+            publicRows: [...collection.values()].map((value) => ({
+              id: value.id,
+              title: value.title,
+              createdAt: value.createdAt,
+              score: value.score,
+            })),
+            status: collection.status,
+            publicError: collection._lifecycle.getSyncError(),
+          }).toEqual({
+            publicRows: expectedRows,
+            status: `ready`,
+            publicError: undefined,
+          })
+        } finally {
+          subsetLoad.release()
+          await load?.catch(() => undefined)
+          await receipt?.catch(() => undefined)
+          await collection.cleanup()
+          await adapter.releaseCacheGenerationClaim?.(cacheClaim.claimId)
+        }
+      },
+    )
+
+    it(`rolls back partially applied mutations when transaction fails`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const collectionId = `atomicity`
+
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `atomicity-1`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [
+              {
+                type: `insert`,
+                key: `1`,
+                value: {
+                  id: `1`,
+                  title: `First`,
+                  createdAt: `2026-01-01T00:00:00.000Z`,
+                  score: 1,
+                },
+              },
+              {
+                type: `insert`,
+                key: `2`,
+                value: {
+                  id: `2`,
+                  title: `Second`,
+                  createdAt: `2026-01-01T00:00:00.000Z`,
+                  score: 2,
+                  // Trigger serialization failure after the first mutation executes.
+                  unsafeDate: new Date(Number.NaN),
+                } as unknown as Todo,
+              },
+            ],
+          },
+        ),
+      ).rejects.toThrow()
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(rows).toEqual([])
+
+      const txRows = await driver.query<{ count: number }>(
+        `SELECT COUNT(*) AS count
+       FROM applied_tx
+       WHERE collection_id = ?`,
+        [collectionId],
+      )
+      expect(txRows[0]?.count).toBe(0)
+    })
+
+    it(`persists row metadata and collection metadata atomically`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const collectionId = `metadata-roundtrip`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `metadata-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Tracked`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+              metadata: {
+                queryCollection: {
+                  owners: {
+                    q1: true,
+                  },
+                },
+              },
+              metadataChanged: true,
+            },
+          ],
+          collectionMetadataMutations: [
+            {
+              type: `set`,
+              key: `electric:resume`,
+              value: {
+                kind: `resume`,
+                offset: `10_0`,
+                handle: `handle-1`,
+                shapeId: `shape-1`,
+                updatedAt: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(rows).toEqual([
+        {
+          key: `1`,
+          value: {
+            id: `1`,
+            title: `Tracked`,
+            createdAt: `2026-01-01T00:00:00.000Z`,
+            score: 1,
+          },
+          metadata: {
+            queryCollection: {
+              owners: {
+                q1: true,
+              },
+            },
+          },
+        },
+      ])
+
+      const collectionMetadata = await adapter.loadCollectionMetadata?.({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(collectionMetadata).toEqual([
+        {
+          key: `electric:resume`,
+          value: {
+            kind: `resume`,
+            offset: `10_0`,
+            handle: `handle-1`,
+            shapeId: `shape-1`,
+            updatedAt: 1,
+          },
+        },
+      ])
+
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `metadata-2`,
+            term: 1,
+            seq: 2,
+            rowVersion: 2,
+            mutations: [
+              {
+                type: `insert`,
+                key: `2`,
+                value: {
+                  id: `2`,
+                  title: `Bad`,
+                  createdAt: `2026-01-01T00:00:00.000Z`,
+                  score: 2,
+                },
+              },
+            ],
+            collectionMetadataMutations: [
+              {
+                type: `set`,
+                key: `broken`,
+                value: {
+                  invalid: new Date(Number.NaN),
+                },
+              },
+            ],
+          },
+        ),
+      ).rejects.toThrow()
+
+      const rowsAfterFailure = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(rowsAfterFailure).toEqual(rows)
+
+      const metadataRows = await driver.query<{ key: string }>(
+        `SELECT key
+         FROM collection_metadata
+         WHERE collection_id = ?`,
+        [collectionId],
+      )
+      expect(metadataRows).toEqual([{ key: `electric:resume` }])
+    })
+
+    it(`persists truncate transactions while preserving explicit collection metadata`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `truncate-metadata-roundtrip`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Before truncate`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+              metadata: {
+                owner: `before`,
+              },
+              metadataChanged: true,
+            },
+          ],
+          collectionMetadataMutations: [
+            {
+              type: `set`,
+              key: `electric:resume`,
+              value: {
+                kind: `resume`,
+                offset: `10_0`,
+                handle: `handle-1`,
+                shapeId: `shape-1`,
+                updatedAt: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `truncate-2`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `After truncate`,
+                createdAt: `2026-01-02T00:00:00.000Z`,
+                score: 2,
+              },
+              metadata: {
+                owner: `after`,
+              },
+              metadataChanged: true,
+            },
+          ],
+          collectionMetadataMutations: [
+            {
+              type: `set`,
+              key: `electric:resume`,
+              value: {
+                kind: `reset`,
+                updatedAt: 2,
+              },
+            },
+          ],
+        },
+      )
+
+      expect(
+        await adapter.loadSubset(
+          { kind: `eager`, collectionId: collectionId },
+          {},
+        ),
+      ).toEqual([
+        {
+          key: `2`,
+          value: {
+            id: `2`,
+            title: `After truncate`,
+            createdAt: `2026-01-02T00:00:00.000Z`,
+            score: 2,
+          },
+          metadata: {
+            owner: `after`,
+          },
+        },
+      ])
+
+      expect(
+        await adapter.loadCollectionMetadata?.({
+          kind: `eager`,
+          collectionId: collectionId,
+        }),
+      ).toEqual([
+        {
+          key: `electric:resume`,
+          value: {
+            kind: `reset`,
+            updatedAt: 2,
+          },
+        },
+      ])
+    })
+
+    it(`supports pushdown operators with correctness-preserving fallback`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `todos`
+
+      const rows: Array<Todo> = [
+        {
+          id: `1`,
+          title: `Task Alpha`,
+          createdAt: `2026-01-01T00:00:00.000Z`,
+          score: 10,
+        },
+        {
+          id: `2`,
+          title: `Task Beta`,
+          createdAt: `2026-01-02T00:00:00.000Z`,
+          score: 20,
+        },
+        {
+          id: `3`,
+          title: `Other`,
+          createdAt: `2026-01-03T00:00:00.000Z`,
+          score: 15,
+        },
+        {
+          id: `4`,
+          title: `Task Gamma`,
+          createdAt: `2026-01-04T00:00:00.000Z`,
+          score: 25,
+        },
+      ]
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: rows.map((row) => ({
+            type: `insert` as const,
+            key: row.id,
+            value: row,
+          })),
+        },
+      )
+
+      const filtered = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`and`, [
+            new IR.Func(`or`, [
+              new IR.Func(`like`, [
+                new IR.PropRef([`title`]),
+                new IR.Value(`%Task%`),
+              ]),
+              new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`3`])]),
+            ]),
+            new IR.Func(`eq`, [
+              new IR.Func(`date`, [new IR.PropRef([`createdAt`])]),
+              new IR.Value(`2026-01-02`),
+            ]),
+          ]),
+          orderBy: [
+            {
+              expression: new IR.PropRef([`score`]),
+              compareOptions: {
+                direction: `desc`,
+                nulls: `last`,
+              },
+            },
+          ],
+        },
+      )
+
+      expect(filtered).toEqual([
+        {
+          key: `2`,
+          value: {
+            id: `2`,
+            title: `Task Beta`,
+            createdAt: `2026-01-02T00:00:00.000Z`,
+            score: 20,
+          },
+        },
+      ])
+
+      const withInEmpty = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`in`, [
+            new IR.PropRef([`id`]),
+            new IR.Value([] as Array<string>),
+          ]),
+        },
+      )
+      expect(withInEmpty).toEqual([])
+    })
+
+    // At loadSubset completion, persisted fallback ordering must use the exact
+    // custom comparator, then direction and public-key tie order. A lexical
+    // fallback fails every cell below.
+    it.each([
+      {
+        case: `ascending`,
+        direction: `asc` as const,
+        compare: (left: string, right: string) => right.localeCompare(left),
+        expected: [`zeta`, `middle`, `alpha`],
+      },
+      {
+        case: `descending`,
+        direction: `desc` as const,
+        compare: (left: string, right: string) => right.localeCompare(left),
+        expected: [`alpha`, `middle`, `zeta`],
+      },
+      {
+        case: `comparator-equal key order`,
+        direction: `asc` as const,
+        compare: () => 0,
+        expected: [`zeta`, `alpha`, `middle`],
+      },
+    ])(
+      `applies custom string collation during persisted subset ordering ($case)`,
+      async ({ case: caseName, direction, compare, expected }) => {
+        const { adapter } = registerContractHarness()
+        const collectionId = `custom-collation-order-${caseName}`
+
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `seed-custom-collation`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [`zeta`, `alpha`, `middle`].map((title, index) => ({
+              type: `insert` as const,
+              key: String(index),
+              value: { id: String(index), title, createdAt: ``, score: index },
+            })),
+          },
+        )
+
+        const rows = await adapter.loadSubset(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            orderBy: [
+              {
+                expression: new IR.PropRef([`title`]),
+                compareOptions: {
+                  direction,
+                  nulls: `last`,
+                  stringSort: `custom`,
+                  compare,
+                },
+              },
+            ],
+          },
+        )
+
+        expect(rows.map(({ value }) => value.title)).toEqual(expected)
+      },
+    )
+
+    it(`supports datetime/strftime predicate compilation for ISO date fields`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `date-pushdown`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-date`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Start`,
+                createdAt: `2026-01-02T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `Other`,
+                createdAt: `2026-01-03T00:00:00.000Z`,
+                score: 2,
+              },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`and`, [
+            new IR.Func(`eq`, [
+              new IR.Func(`strftime`, [
+                new IR.Value(`%Y-%m-%d`),
+                new IR.Func(`datetime`, [new IR.PropRef([`createdAt`])]),
+              ]),
+              new IR.Value(`2026-01-02`),
+            ]),
+            new IR.Func(`eq`, [
+              new IR.Func(`date`, [new IR.PropRef([`createdAt`])]),
+              new IR.Value(`2026-01-02`),
+            ]),
+          ]),
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`1`])
+    })
+
+    it(`persists bigint/date values and evaluates typed predicates`, async () => {
+      const { adapter } = registerContractHarness()
+      const typedAdapter = adapter as unknown as PersistenceAdapter
+      const collectionId = `typed-values`
+      const firstBigInt = BigInt(`9007199254740992`)
+      const secondBigInt = BigInt(`9007199254740997`)
+
+      await typedAdapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-typed-values`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Alpha`,
+                createdAt: new Date(`2026-01-02T00:00:00.000Z`),
+                largeViewCount: firstBigInt,
+              },
+            },
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `Beta`,
+                createdAt: new Date(`2026-01-03T00:00:00.000Z`),
+                largeViewCount: secondBigInt,
+              },
+            },
+          ],
+        },
+      )
+
+      const bigintRows = await typedAdapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`gt`, [
+            new IR.PropRef([`largeViewCount`]),
+            new IR.Value(BigInt(`9007199254740993`)),
+          ]),
+        },
+      )
+      expect(bigintRows.map((row) => row.key)).toEqual([`2`])
+
+      const dateRows = await typedAdapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`gt`, [
+            new IR.PropRef([`createdAt`]),
+            new IR.Value(new Date(`2026-01-02T12:00:00.000Z`)),
+          ]),
+        },
+      )
+      expect(dateRows.map((row) => row.key)).toEqual([`2`])
+
+      const restoredRows = await typedAdapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [
+            new IR.Func(`date`, [new IR.PropRef([`createdAt`])]),
+            new IR.Value(`2026-01-02`),
+          ]),
+        },
+      )
+      const firstRow = restoredRows[0]?.value
+      expect(firstRow?.createdAt).toBeInstanceOf(Date)
+      expect(firstRow?.largeViewCount).toBe(firstBigInt)
+    })
+
+    it(`handles cursor whereCurrent/whereFrom requests`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `todos`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-cursor`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `a`,
+              value: {
+                id: `a`,
+                title: `A`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 10,
+              },
+            },
+            {
+              type: `insert`,
+              key: `b`,
+              value: {
+                id: `b`,
+                title: `B`,
+                createdAt: `2026-01-02T00:00:00.000Z`,
+                score: 10,
+              },
+            },
+            {
+              type: `insert`,
+              key: `c`,
+              value: {
+                id: `c`,
+                title: `C`,
+                createdAt: `2026-01-03T00:00:00.000Z`,
+                score: 12,
+              },
+            },
+            {
+              type: `insert`,
+              key: `d`,
+              value: {
+                id: `d`,
+                title: `D`,
+                createdAt: `2026-01-04T00:00:00.000Z`,
+                score: 13,
+              },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          orderBy: [
+            {
+              expression: new IR.PropRef([`score`]),
+              compareOptions: {
+                direction: `asc`,
+                nulls: `last`,
+              },
+            },
+          ],
+          limit: 1,
+          cursor: {
+            whereCurrent: new IR.Func(`eq`, [
+              new IR.PropRef([`score`]),
+              new IR.Value(10),
+            ]),
+            whereFrom: new IR.Func(`gt`, [
+              new IR.PropRef([`score`]),
+              new IR.Value(10),
+            ]),
+          },
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`a`, `b`, `c`])
+    })
+
+    it(`ensures and removes persisted indexes with registry tracking`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const collectionId = `todos`
+      const signature = `idx-title`
+
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        {
+          expressionSql: [`json_extract(value, '$.title')`],
+        },
+      )
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        {
+          expressionSql: [`json_extract(value, '$.title')`],
+        },
+      )
+
+      const registryRows = await driver.query<{
+        removed: number
+        index_name: string
+      }>(
+        `SELECT removed, index_name
+       FROM persisted_index_registry
+       WHERE collection_id = ? AND signature = ?`,
+        [collectionId, signature],
+      )
+      expect(registryRows).toHaveLength(1)
+      expect(registryRows[0]?.removed).toBe(0)
+
+      const createdIndexName = registryRows[0]?.index_name
+      const sqliteMasterBefore = await driver.query<{ name: string }>(
+        `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
+        [createdIndexName],
+      )
+      expect(sqliteMasterBefore).toHaveLength(1)
+
+      if (!adapter.markIndexRemoved) {
+        throw new Error(
+          `Adapter must implement markIndexRemoved for this contract suite`,
+        )
+      }
+      await adapter.markIndexRemoved(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+      )
+
+      const registryRowsAfter = await driver.query<{ removed: number }>(
+        `SELECT removed
+       FROM persisted_index_registry
+       WHERE collection_id = ? AND signature = ?`,
+        [collectionId, signature],
+      )
+      expect(registryRowsAfter[0]?.removed).toBe(1)
+
+      const sqliteMasterAfter = await driver.query<{ name: string }>(
+        `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
+        [createdIndexName],
+      )
+      expect(sqliteMasterAfter).toHaveLength(0)
+    })
+
+    it(`rebuilds a physical index when the normalized spec changes`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const collectionId = `todos`
+      const signature = `idx-upgraded-expression`
+
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        {
+          expressionSql: [`json_extract(value, '$.title')`],
+        },
+      )
+
+      const registryRows = await driver.query<{ index_name: string }>(
+        `SELECT index_name
+         FROM persisted_index_registry
+         WHERE collection_id = ? AND signature = ?`,
+        [collectionId, signature],
+      )
+      const indexName = registryRows[0]?.index_name
+      expect(indexName).toBeTruthy()
+
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        {
+          expressionSql: [`json_extract(value, '$.score')`],
+        },
+      )
+
+      const sqliteMasterRows = await driver.query<{ sql: string }>(
+        `SELECT sql
+         FROM sqlite_master
+         WHERE type = 'index' AND name = ?`,
+        [indexName],
+      )
+      expect(sqliteMasterRows).toHaveLength(1)
+      expect(sqliteMasterRows[0]?.sql).toContain(
+        `json_extract(value, '$.score')`,
+      )
+      expect(sqliteMasterRows[0]?.sql).not.toContain(
+        `json_extract(value, '$.title')`,
+      )
+    })
+
+    it(`enforces schema mismatch policies`, async () => {
+      const baseHarness = registerContractHarness({
+        schemaVersion: 1,
+        schemaMismatchPolicy: `reset`,
+      })
+      const collectionId = `todos`
+      await baseHarness.adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-schema`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Before mismatch`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      const strictAdapter = new SQLiteCorePersistenceAdapter({
+        driver: baseHarness.driver,
+        schemaVersion: 2,
+        schemaMismatchPolicy: `sync-absent-error`,
+      })
+      await expect(
+        strictAdapter.loadSubset(
+          { kind: `eager`, collectionId: collectionId },
+          {},
+        ),
+      ).rejects.toThrow(/Schema version mismatch/)
+
+      const resetAdapter = new SQLiteCorePersistenceAdapter({
+        driver: baseHarness.driver,
+        schemaVersion: 2,
+        schemaMismatchPolicy: `sync-present-reset`,
+      })
+      const resetRows = await resetAdapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(resetRows).toEqual([])
+    })
+
+    runSQLiteResetResumeOracleTests(harnessFactory)
+
+    it(`returns pullSince deltas and requiresFullReload when threshold is exceeded`, async () => {
+      const { adapter } = registerContractHarness({
+        pullSinceReloadThreshold: 1,
+      })
+      const collectionId = `todos`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-pull`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `One`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `Two`,
+                createdAt: `2026-01-02T00:00:00.000Z`,
+                score: 2,
+              },
+            },
+          ],
+        },
+      )
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-pull-2`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            {
+              type: `delete`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `One`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      const delta = await adapter.pullSince({ kind: `eager`, collectionId }, 1)
+      if (delta.requiresFullReload) {
+        throw new Error(`Expected key-level delta, received full reload`)
+      }
+      expect(delta.changedKeys).toEqual([])
+      expect(delta.deletedKeys).toEqual([`1`])
+      expect(delta.deltas).toEqual([
+        {
+          txId: `seed-pull-2`,
+          latestRowVersion: 2,
+          changedRows: [],
+          deletedKeys: [`1`],
+          rowMetadataMutations: [],
+          collectionMetadataMutations: [],
+        },
+      ])
+
+      const fullReload = await adapter.pullSince(
+        { kind: `eager`, collectionId },
+        0,
+      )
+      expect(fullReload.requiresFullReload).toBe(true)
+    })
+
+    it(`scans persisted rows with metadata and replays metadata-only deltas`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `scan-and-replay`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `scan-seed-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Tracked`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+              metadata: {
+                queryCollection: {
+                  owners: {
+                    q1: true,
+                  },
+                },
+              },
+              metadataChanged: true,
+            },
+          ],
+        },
+      )
+
+      const scannedRows = await adapter.scanRows?.(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          metadataOnly: true,
+        },
+      )
+      expect(scannedRows).toEqual([
+        {
+          key: `1`,
+          value: {
+            id: `1`,
+            title: `Tracked`,
+            createdAt: `2026-01-01T00:00:00.000Z`,
+            score: 1,
+          },
+          metadata: {
+            queryCollection: {
+              owners: {
+                q1: true,
+              },
+            },
+          },
+        },
+      ])
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `scan-seed-2`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [],
+          rowMetadataMutations: [
+            {
+              type: `set`,
+              key: `1`,
+              value: {
+                queryCollection: {
+                  owners: {
+                    q2: true,
+                  },
+                },
+              },
+            },
+          ],
+          collectionMetadataMutations: [
+            {
+              type: `set`,
+              key: `electric:resume`,
+              value: {
+                kind: `reset`,
+                updatedAt: 2,
+              },
+            },
+          ],
+        },
+      )
+
+      const replayDelta = await adapter.pullSince(
+        { kind: `eager`, collectionId },
+        1,
+      )
+      if (replayDelta.requiresFullReload) {
+        throw new Error(`Expected replay delta, received full reload`)
+      }
+
+      expect(replayDelta.deltas).toEqual([
+        {
+          txId: `scan-seed-2`,
+          latestRowVersion: 2,
+          changedRows: [],
+          deletedKeys: [],
+          rowMetadataMutations: [
+            {
+              type: `set`,
+              key: `1`,
+              value: {
+                queryCollection: {
+                  owners: {
+                    q2: true,
+                  },
+                },
+              },
+            },
+          ],
+          collectionMetadataMutations: [
+            {
+              type: `set`,
+              key: `electric:resume`,
+              value: {
+                kind: `reset`,
+                updatedAt: 2,
+              },
+            },
+          ],
+        },
+      ])
+    })
+
+    it(`keeps numeric and string keys distinct in storage`, async () => {
+      const { driver } = registerContractHarness()
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver,
+      })
+      const collectionId = `mixed-keys`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `mixed-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: 1,
+              value: {
+                id: 1,
+                title: `Numeric`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `String`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 2,
+              },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(rows).toHaveLength(2)
+      expect(rows.some((row) => row.key === 1)).toBe(true)
+      expect(rows.some((row) => row.key === `1`)).toBe(true)
+    })
+
+    it(`stores hostile collection ids safely via deterministic table mapping`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const hostileCollectionId = `todos"; DROP TABLE applied_tx; --`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: hostileCollectionId },
+        {
+          txId: `hostile-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `safe`,
+              value: {
+                id: `safe`,
+                title: `Safe`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      const registryRows = await driver.query<{ table_name: string }>(
+        `SELECT table_name
+       FROM collection_registry
+       WHERE collection_id = ?`,
+        [hostileCollectionId],
+      )
+      expect(registryRows).toHaveLength(1)
+      expect(registryRows[0]?.table_name).toMatch(/^c_[a-z2-7]+_[0-9a-z]+$/)
+
+      const loadedRows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: hostileCollectionId },
+        {},
+      )
+      expect(loadedRows).toHaveLength(1)
+      expect(loadedRows[0]?.key).toBe(`safe`)
+    })
+
+    it(`deduplicates concurrent ensureCollectionReady calls for the same collection`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `concurrent-startup`
+
+      const [rowsA, rowsB] = await Promise.all([
+        adapter.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
+        adapter.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
+      ])
+
+      expect(rowsA).toEqual([])
+      expect(rowsB).toEqual([])
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `concurrent-startup-seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Seeded`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      const loadedRows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      expect(loadedRows).toHaveLength(1)
+      expect(loadedRows[0]?.key).toBe(`1`)
+    })
+
+    it(`prunes applied_tx rows by sequence threshold`, async () => {
+      const { adapter, driver } = registerContractHarness({
+        appliedTxPruneMaxRows: 2,
+      })
+      const collectionId = `pruning`
+
+      for (let seq = 1; seq <= 4; seq++) {
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `prune-${seq}`,
+            term: 1,
+            seq,
+            rowVersion: seq,
+            mutations: [
+              {
+                type: `insert`,
+                key: `k-${seq}`,
+                value: {
+                  id: `k-${seq}`,
+                  title: `Row ${seq}`,
+                  createdAt: `2026-01-01T00:00:00.000Z`,
+                  score: seq,
+                },
+              },
+            ],
+          },
+        )
+      }
+
+      const appliedRows = await driver.query<{ seq: number }>(
+        `SELECT seq
+       FROM applied_tx
+       WHERE collection_id = ?
+       ORDER BY seq ASC`,
+        [collectionId],
+      )
+      expect(appliedRows.map((row) => row.seq)).toEqual([3, 4])
+    })
+
+    it(`prunes applied_tx rows by age threshold when configured`, async () => {
+      const { adapter, driver } = registerContractHarness({
+        appliedTxPruneMaxAgeSeconds: 1,
+      })
+      const collectionId = `pruning-by-age`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `age-1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `old`,
+              value: {
+                id: `old`,
+                title: `Old`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+              },
+            },
+          ],
+        },
+      )
+
+      await driver.run(
+        `UPDATE applied_tx
+       SET applied_at = 0
+       WHERE collection_id = ? AND seq = 1`,
+        [collectionId],
+      )
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `age-2`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            {
+              type: `insert`,
+              key: `new`,
+              value: {
+                id: `new`,
+                title: `New`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 2,
+              },
+            },
+          ],
+        },
+      )
+
+      const appliedRows = await driver.query<{ seq: number }>(
+        `SELECT seq
+       FROM applied_tx
+       WHERE collection_id = ?
+       ORDER BY seq ASC`,
+        [collectionId],
+      )
+      expect(appliedRows.map((row) => row.seq)).toEqual([2])
+    })
+
+    it(`supports large IN lists within the driver's binding cap`, async () => {
+      const { adapter } = registerContractHarness()
+      const collectionId = `large-in`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-large-in`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `Two`,
+                createdAt: `2026-01-02T00:00:00.000Z`,
+                score: 2,
+              },
+            },
+            {
+              type: `insert`,
+              key: `4`,
+              value: {
+                id: `4`,
+                title: `Four`,
+                createdAt: `2026-01-04T00:00:00.000Z`,
+                score: 4,
+              },
+            },
+          ],
+        },
+      )
+
+      const largeIds = Array.from(
+        { length: 1200 },
+        (_value, index) => `miss-${index}`,
+      )
+      largeIds[100] = `2`
+      largeIds[1100] = `4`
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`in`, [
+            new IR.PropRef([`id`]),
+            new IR.Value(largeIds),
+          ]),
+          orderBy: [
+            {
+              expression: new IR.PropRef([`id`]),
+              compareOptions: {
+                direction: `asc`,
+                nulls: `last`,
+              },
+            },
+          ],
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`2`, `4`])
+    })
+
+    it(`falls back to in-memory filtering when SQL json path pushdown is unsupported`, async () => {
+      const { driver } = registerContractHarness()
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver,
+      })
+      const collectionId = `fallback-where`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-fallback`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Keep`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+                [`meta-field`]: `alpha`,
+              },
+            },
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `Drop`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 2,
+                [`meta-field`]: `beta`,
+              },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`meta-field`]),
+            new IR.Value(`alpha`),
+          ]),
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`1`])
+    })
+
+    it(`supports alias-qualified refs during in-memory fallback filtering`, async () => {
+      const { driver } = registerContractHarness()
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver,
+      })
+      const collectionId = `fallback-alias-qualified-ref`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-alias-fallback`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `1`,
+              value: {
+                id: `1`,
+                title: `Keep`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 1,
+                [`meta-field`]: `alpha`,
+              },
+            },
+            {
+              type: `insert`,
+              key: `2`,
+              value: {
+                id: `2`,
+                title: `Drop`,
+                createdAt: `2026-01-01T00:00:00.000Z`,
+                score: 2,
+                [`meta-field`]: `beta`,
+              },
+            },
+          ],
+        },
+      )
+
+      // `meta-field` makes SQL pushdown unsupported, so filter correctness comes
+      // from the in-memory evaluator. The explicit source alias is the only
+      // signal that the leading `todos` segment is qualification.
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`todos`, `meta-field`], `todos`),
+            new IR.Value(`alpha`),
+          ]),
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`1`])
+    })
+
+    it(`does not guess that a legacy fallback path is an alias`, async () => {
+      const { driver } = registerContractHarness()
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      const collectionId = `fallback-legacy-nested-ref`
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-legacy-nested-fallback`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `nested-match`,
+              value: {
+                profile: { [`meta-field`]: `alpha` },
+                [`meta-field`]: `flat-other`,
+              },
+            },
+            {
+              type: `insert`,
+              key: `flat-only`,
+              value: { [`meta-field`]: `alpha` },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`profile`, `meta-field`]),
+            new IR.Value(`alpha`),
+          ]),
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`nested-match`])
+    })
+
+    it(`compiles serialized expression index specs used by phase-2 metadata`, async () => {
+      const { adapter, driver } = registerContractHarness()
+      const collectionId = `serialized-index`
+      const signature = `serialized-title`
+
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        {
+          expressionSql: [
+            JSON.stringify({
+              type: `ref`,
+              path: [`title`],
+            }),
+          ],
+        },
+      )
+
+      const registryRows = await driver.query<{ index_name: string }>(
+        `SELECT index_name
+       FROM persisted_index_registry
+       WHERE collection_id = ? AND signature = ?`,
+        [collectionId, signature],
+      )
+      const indexName = registryRows[0]?.index_name
+      expect(indexName).toBeTruthy()
+
+      const sqliteMasterRows = await driver.query<{ sql: string }>(
+        `SELECT sql
+       FROM sqlite_master
+       WHERE type = 'index' AND name = ?`,
+        [indexName],
+      )
+      expect(sqliteMasterRows).toHaveLength(1)
+      expect(sqliteMasterRows[0]?.sql).toContain(
+        `json_extract(value, '$.title')`,
+      )
+    })
+
+    it(`rejects unsafe raw SQL fragments in index specs`, async () => {
+      const { adapter } = registerContractHarness()
+
+      await expect(
+        adapter.ensureIndex(
+          { kind: `eager`, collectionId: `unsafe-index` },
+          `unsafe`,
+          {
+            expressionSql: [
+              `json_extract(value, '$.title'); DROP TABLE applied_tx`,
+            ],
+          },
+        ),
+      ).rejects.toThrow(/Invalid persisted index SQL fragment/)
+    })
+  })
+}
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-oracle.test.ts
index 6595df4a91..54baa27672 100644
--- a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-oracle.test.ts
@@ -1,235 +1,58 @@
+/**
+ * Oracle owner for two SQLite core adapter laws. The shared contract suite
+ * (sqlite-core-adapter-contract-suite.ts) registers these tests in every host
+ * package and in the sqlite3 CLI runtime test.
+ *
+ * - Reset/resume baseline lineage: a schema reset clears collection metadata
+ *   together with the persisted baseline it belongs to, while same-schema
+ *   reopen and raw row loss keep both. The model is a two-generation lineage
+ *   relation (expectedResetResumeMetadata), and the check compares each
+ *   observed checkpoint with it (expectResetResumeLaw).
+ * - Subset binding capacity: a loadSubset predicate returns exactly its
+ *   matching rows without a statement above the connection's binding cap. The
+ *   model computes each row's result from the declared clauses
+ *   (expectedBindingRows), and the check compares the observed rows and
+ *   statement bindings with it (violation).
+ */
 import assert from 'node:assert/strict'
-import { AsyncLocalStorage } from 'node:async_hooks'
-import { DatabaseSync } from 'node:sqlite'
-import { execFile } from 'node:child_process'
-import { copyFileSync, existsSync, mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect, promisify } from 'node:util'
+import { existsSync } from 'node:fs'
 import { fc } from '@fast-check/vitest'
-import { afterEach, describe, expect, it } from 'vitest'
-import { IR, createCollection } from '@tanstack/db'
+import { describe, expect, it } from 'vitest'
+import { SQLiteCorePersistenceAdapter, createPersistedTableName } from '../src'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
   recordOracleReplay,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
-  SQLiteCorePersistenceAdapter,
-  createPersistedTableName,
-  persistedCollectionOptions,
-} from '../src'
-import { harnessScope } from './contracts/harness-scope'
+  bigintBoundary,
+  chunkBoundary,
+  dual,
+  escapedStringCase,
+  expectedBindingRows,
+  legalSpec,
+  mixed,
+  nested,
+  observe,
+  single,
+  violation,
+} from './sqlite-core-adapter-binding-support'
 import type {
-  CommittedTxAnchor,
-  PersistedStorageTarget,
-  PersistedTx,
-  PersistenceAdapter,
-  SQLiteDriver,
-  SQLitePullSinceResult,
-} from '../src'
-import type { SyncConfig } from '@tanstack/db'
-
-type Todo = {
-  id: string
-  title: string
-  createdAt: string
-  score: number
-}
-
-const execFileAsync = promisify(execFile)
-
-function toSqlLiteral(value: unknown): string {
-  if (value === null || value === undefined) {
-    return `NULL`
-  }
-
-  if (typeof value === `number`) {
-    return Number.isFinite(value) ? String(value) : `NULL`
-  }
-
-  if (typeof value === `boolean`) {
-    return value ? `1` : `0`
-  }
-
-  if (typeof value === `bigint`) {
-    return value.toString()
-  }
-
-  const textValue = typeof value === `string` ? value : String(value)
-  return `'${textValue.replace(/'/g, `''`)}'`
-}
-
-function interpolateSql(sql: string, params: ReadonlyArray<unknown>): string {
-  let parameterIndex = 0
-  const renderedSql = sql.replace(/\?/g, () => {
-    const currentParam = params[parameterIndex]
-    parameterIndex++
-    return toSqlLiteral(currentParam)
-  })
-
-  if (parameterIndex !== params.length) {
-    throw new Error(
-      `SQL interpolation mismatch: used ${parameterIndex} params, received ${params.length}`,
-    )
-  }
-
-  return renderedSql
-}
-
-export class SqliteCliDriver implements SQLiteDriver {
-  private readonly transactionDbPath = new AsyncLocalStorage<string>()
-  private queue: Promise<void> = Promise.resolve()
-
-  constructor(private readonly dbPath: string) {}
-
-  async exec(sql: string): Promise<void> {
-    const activeDbPath = this.transactionDbPath.getStore()
-    if (activeDbPath) {
-      await execFileAsync(`sqlite3`, [activeDbPath, sql])
-      return
-    }
-
-    await this.enqueue(async () => {
-      await execFileAsync(`sqlite3`, [this.dbPath, sql])
-    })
-  }
-
-  async query<T>(
-    sql: string,
-    params?: ReadonlyArray<unknown>,
-  ): Promise<ReadonlyArray<T>> {
-    const activeDbPath = this.transactionDbPath.getStore()
-    const renderedSql = interpolateSql(sql, params ?? [])
-    const queryActiveDbPath = activeDbPath ?? this.dbPath
-
-    const runQuery = async () => {
-      const { stdout } = await execFileAsync(`sqlite3`, [
-        `-json`,
-        queryActiveDbPath,
-        ...(renderedSql.trimStart().startsWith(`EXPLAIN QUERY PLAN`)
-          ? [`.explain off`]
-          : []),
-        renderedSql,
-      ])
-      const trimmedOutput = stdout.trim()
-      if (!trimmedOutput) {
-        return []
-      }
-      return JSON.parse(trimmedOutput) as Array<T>
-    }
-
-    if (activeDbPath) {
-      return runQuery()
-    }
-
-    return this.enqueue(async () => runQuery())
-  }
-
-  async run(sql: string, params?: ReadonlyArray<unknown>): Promise<void> {
-    const activeDbPath = this.transactionDbPath.getStore()
-    const renderedSql = interpolateSql(sql, params ?? [])
-    const runActiveDbPath = activeDbPath ?? this.dbPath
-
-    if (activeDbPath) {
-      await execFileAsync(`sqlite3`, [runActiveDbPath, renderedSql])
-      return
-    }
-
-    await this.enqueue(async () => {
-      await execFileAsync(`sqlite3`, [runActiveDbPath, renderedSql])
-    })
-  }
-
-  async transaction<T>(
-    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
-  ): Promise<T> {
-    if (fn.length === 0) {
-      throw new Error(
-        `SQLiteDriver.transaction callback must accept the transaction driver argument`,
-      )
-    }
-
-    const activeDbPath = this.transactionDbPath.getStore()
-    if (activeDbPath) {
-      return fn(this)
-    }
-
-    return this.enqueue(async () => {
-      const txDirectory = mkdtempSync(join(tmpdir(), `db-sqlite-core-tx-`))
-      const txDbPath = join(txDirectory, `state.sqlite`)
-
-      if (existsSync(this.dbPath)) {
-        copyFileSync(this.dbPath, txDbPath)
-      }
-
-      try {
-        const txResult = await this.transactionDbPath.run(txDbPath, async () =>
-          fn(this),
-        )
-
-        if (existsSync(txDbPath)) {
-          copyFileSync(txDbPath, this.dbPath)
-        }
-        return txResult
-      } finally {
-        rmSync(txDirectory, { recursive: true, force: true })
-      }
-    })
-  }
-
-  private enqueue<T>(operation: () => Promise<T>): Promise<T> {
-    const queuedOperation = this.queue.then(operation, operation)
-    this.queue = queuedOperation.then(
-      () => undefined,
-      () => undefined,
-    )
-    return queuedOperation
-  }
-}
-
-type AdapterHarness = {
-  adapter: SQLiteCorePersistenceAdapter
-  driver: SqliteCliDriver
-  dbPath: string
-  cleanup: () => void | Promise<void>
-}
-
-export type SQLiteCoreAdapterContractHarness = {
-  adapter: PersistenceAdapter & {
-    pullSince: (
-      target: PersistedStorageTarget,
-      fromRowVersion: number,
-    ) => Promise<SQLitePullSinceResult<string | number>>
-  }
-  driver: SQLiteDriver
-  cleanup: () => void | Promise<void>
-}
-
-function createHarness(
-  options?: Omit<
-    ConstructorParameters<typeof SQLiteCorePersistenceAdapter>[0],
-    `driver`
-  >,
-): AdapterHarness {
-  const tempDirectory = mkdtempSync(join(tmpdir(), `db-sqlite-core-`))
-  const dbPath = join(tempDirectory, `state.sqlite`)
-  const driver = new SqliteCliDriver(dbPath)
-  const adapter = new SQLiteCorePersistenceAdapter({
-    driver,
-    ...options,
-  })
+  Kind,
+  Spec,
+  Violation,
+} from './sqlite-core-adapter-binding-support'
+import type {
+  SQLiteCoreAdapterHarnessFactory,
+  Todo,
+} from './sqlite-core-adapter-support'
 
-  return {
-    adapter,
-    driver,
-    dbPath,
-    cleanup: () => {
-      rmSync(tempDirectory, { recursive: true, force: true })
-    },
-  }
-}
+declareOracle({
+  check: [expectResetResumeLaw, violation],
+  model: [expectedResetResumeMetadata, expectedBindingRows],
+})
 
 type ResetResumeHistory = {
   fromSchemaVersion: number
@@ -667,2831 +490,277 @@ async function observeResetResumeHistory(
   return observation
 }
 
-export type SQLiteCoreAdapterHarnessFactory = (
-  options?: Omit<
-    ConstructorParameters<typeof SQLiteCorePersistenceAdapter>[0],
-    `driver`
-  >,
-) => SQLiteCoreAdapterContractHarness
-
-function holdAndRejectFirstSubsetLoad(
-  adapter: PersistenceAdapter,
-  failure: Error,
-): { entered: Promise<void>; release: () => void } {
-  let enter!: () => void
-  let release!: () => void
-  const entered = new Promise<void>((resolve) => {
-    enter = resolve
-  })
-  const held = new Promise<void>((resolve) => {
-    release = resolve
-  })
-  let loadCalls = 0
-  const intercept =
-    (loadSubset: PersistenceAdapter[`loadSubset`]) =>
-    async (...args: Parameters<PersistenceAdapter[`loadSubset`]>) => {
-      loadCalls++
-      if (loadCalls === 1) {
-        enter()
-        await held
-        throw failure
-      }
-      return loadSubset(...args)
-    }
-
-  const runInHydrationScope = adapter.runInHydrationScope?.bind(adapter)
-  if (runInHydrationScope) {
-    adapter.runInHydrationScope = (task) =>
-      runInHydrationScope((scopedAdapter) =>
-        task({
-          ...scopedAdapter,
-          loadSubset: intercept(scopedAdapter.loadSubset),
-        }),
-      )
-  } else {
-    adapter.loadSubset = intercept(adapter.loadSubset.bind(adapter))
-  }
-
-  return { entered, release }
-}
-
-export function runSQLiteCoreAdapterContractSuite(
-  suiteName: string = `SQLiteCorePersistenceAdapter`,
-  harnessFactory: SQLiteCoreAdapterHarnessFactory = createHarness,
+/**
+ * Reset/resume lineage registration. It takes the harness factory of the
+ * contract suite that calls it, so the tests run against the same adapters.
+ */
+export function runSQLiteResetResumeOracleTests(
+  harnessFactory: SQLiteCoreAdapterHarnessFactory,
 ): void {
-  const scope = harnessScope(harnessFactory)
-  const registerContractHarness = scope.create
-
-  describe(suiteName, () => {
-    afterEach(scope.cleanup)
-    /**
-     * A Web Lock successor may be cold: its observed term is zero even when
-     * earlier no-write owners existed. The durable leader_term ledger, rather
-     * than the caller's memory, is the independent lower bound for each new
-     * term. Reservation itself does not advance the row version or create an
-     * applied transaction. This driver exercises the real SQLite adapter and
-     * observes both returned positions and the durable table after each cut.
-     */
-    it(`reserves distinct durable terms across empty elections`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      if (!adapter.reserveLeadershipTerm) {
-        throw new Error(`SQLite adapter has no durable term reservation`)
-      }
-      const reserve = adapter.reserveLeadershipTerm.bind(adapter)
-      const collectionId = `cold-successor-terms`
-      const observeDurableTerm = async () =>
-        driver.query<{ latest_term: number }>(
-          `SELECT latest_term FROM leader_term WHERE collection_id = ?`,
-          [collectionId],
+  /**
+   * Reset/resume oracle card
+   *
+   * Law and source: a destructive schema reset creates a new persisted
+   * baseline and clears every collection-metadata record in that reset
+   * transaction. Same-schema adapter reopens preserve metadata, including
+   * for a genuinely empty baseline. The production reset policy above and the
+   * independently reproduced history in
+   * https://github.com/TanStack/db/issues/1589 establish this narrow law.
+   *
+   * Domain and legal histories: zero-to-four committed rows; absent, reset,
+   * or non-initial resume metadata; same-schema adapter reopen, vN -> vN+1
+   * sync-present-reset, a partial restore after reset, or out-of-band row
+   * loss; adapter reopens on either side; unrelated metadata.
+   *
+   * Reference: a two-generation lineage relation. Same-schema reopen and raw
+   * external loss keep the core generation/metadata record; schema reset
+   * replaces the generation and starts with no metadata. This model does not
+   * inspect the adapter's SQL branches or infer compatibility from row
+   * cardinality.
+   *
+   * Production path and checkpoint: SQLiteCorePersistenceAdapter commits a
+   * real SQLite baseline, then a new adapter instance reaches
+   * ensureCollectionReady/handleSchemaMismatch. At the
+   * after-persistence-transition-reopen checkpoint we inspect registry
+   * version, reset epoch/generation, complete durable rows, tombstones,
+   * applied transactions, and collection metadata.
+   *
+   * Observed result and known omissions: exact settled rows, exact metadata
+   * keys, and whether the durable Electric state is absent/reset/resume. The
+   * external-loss lane proves the generic adapter leaves metadata reachable;
+   * only the persisted+Electric suite judges whether that cursor is safe to
+   * consume. The injected loss is not a claim that arbitrary SQL is a
+   * supported public API. Partial resumed updates and SDK framing retain
+   * their executable owners in the Electric recovery and framing suites.
+   *
+   * Trust: reset_epoch and schema_version prove reach; retained metadata
+   * after reset is the whole-path fault control, while compatible and
+   * external-loss histories calibrate preservation. Every generated database
+   * is removed after evidence capture. The failure reports first and reduced
+   * histories plus a verified fast-check seed/path replay.
+   */
+  oracleReplayTest(it, `sqlite-resume.baseline-lineage`)(
+    `resets collection metadata with its persisted baseline across generated adapter reopen histories`,
+    async () => {
+      const historyArbitrary = fc
+        .constantFrom<ResetResumeHistory[`transition`]>(
+          `compatible-reopen`,
+          `schema-reset`,
+          `partial-restore`,
+          `external-row-loss`,
         )
-      expect(
-        await reserve({ kind: `eager`, collectionId: collectionId }, 0),
-      ).toEqual({
-        latestTerm: 1,
-        latestSeq: 0,
-        latestRowVersion: 0,
-      })
-      expect(await observeDurableTerm()).toEqual([{ latest_term: 1 }])
-      expect(
-        await reserve({ kind: `eager`, collectionId: collectionId }, 0),
-      ).toEqual({
-        latestTerm: 2,
-        latestSeq: 0,
-        latestRowVersion: 0,
-      })
-      expect(await observeDurableTerm()).toEqual([{ latest_term: 2 }])
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `term-two-write`,
-          term: 2,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [],
-        },
-      )
-      expect(
-        await reserve({ kind: `eager`, collectionId: collectionId }, 0),
-      ).toEqual({
-        latestTerm: 3,
-        latestSeq: 0,
-        latestRowVersion: 1,
-      })
-      expect(await observeDurableTerm()).toEqual([{ latest_term: 3 }])
-      expect(
-        await reserve({ kind: `eager`, collectionId: collectionId }, 8),
-      ).toEqual({
-        latestTerm: 9,
-        latestSeq: 0,
-        latestRowVersion: 1,
-      })
-      expect(await observeDurableTerm()).toEqual([{ latest_term: 9 }])
-    })
-
-    /**
-     * Exact-ID reconciliation has one equality lookup under the writer lock.
-     * The query plan must seek by both collection and transaction ID; a plan
-     * that only seeks by collection grows with retained transaction count.
-     * A real SQLite plan is the work observation, independent of elapsed time.
-     */
-    it(`indexes exact transaction ID lookup within a collection`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: `plan-index`,
-      })
-      const plan = await driver.query<{ detail: string }>(
-        `EXPLAIN QUERY PLAN
-         SELECT term, seq, row_version FROM applied_tx
-         WHERE collection_id = ? AND tx_id = ? LIMIT 2`,
-        [`plan-index`, `target`],
-      )
-      expect(plan.map(({ detail }) => detail).join(` | `)).toMatch(
-        /idx_applied_tx_collection_tx_id.*collection_id=\?.*tx_id=\?/,
-      )
-    })
-
-    /**
-     * An unanswered source transaction may be acknowledged by its exact
-     * durable ID, or applied when no durable write followed its pre-send
-     * anchor. A different write, reset, or pruned ID cannot authorize late
-     * application: opaque source cursors and same-key values may be newer.
-     *
-     * The reference below comes from the authored durable history, not the
-     * adapter's SQL. Each scenario uses a real SQLite collection. The check
-     * observes the result, complete rows, cursor, row version, and exact log
-     * IDs after reconciliation; a successful duplicate write would fail the
-     * ledger and version comparison even if its final row matched. Each txId
-     * identifies one immutable source payload; reusing an ID for different
-     * content is outside this source-transaction grammar.
-     * The CLI harness starts a sqlite3 process for each SQL command, so these
-     * seven histories need more than Vitest's default timeout under parallel CI.
-     */
-    it(`reconciles only a certified source transaction against SQLite`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      if (!adapter.reconcileCommittedTx) {
-        throw new Error(`SQLite adapter has no reconciliation operation`)
-      }
-      const reconcile = adapter.reconcileCommittedTx.bind(adapter)
-      const anchor: CommittedTxAnchor = {
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }
-      const tx = (
-        txId: string,
-        term: number,
-        seq: number,
-        rowVersion: number,
-        title: string,
-      ): PersistedTx => ({
-        txId,
-        term,
-        seq,
-        rowVersion,
-        mutations: [
-          {
-            type: `insert`,
-            key: `same-key`,
-            value: {
-              id: `same-key`,
-              title,
-              createdAt: `2026-01-01T00:00:00.000Z`,
-              score: 1,
-            },
-          },
-        ],
-        collectionMetadataMutations: [
-          { type: `set`, key: `probe:cursor`, value: title },
-        ],
-      })
-      const observe = async (collectionId: string) => {
-        const snapshot = await adapter.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: collectionId,
-        })
-        const log = await driver.query<{ tx_id: string }>(
-          `SELECT tx_id FROM applied_tx WHERE collection_id = ? ORDER BY row_version`,
-          [collectionId],
+        .chain((transition) =>
+          fc.record<ResetResumeHistory>({
+            fromSchemaVersion: fc.integer({ min: 1, max: 4 }),
+            rows: fc
+              .uniqueArray(fc.integer({ min: 0, max: 20 }), {
+                minLength:
+                  transition === `partial-restore`
+                    ? 2
+                    : transition === `external-row-loss`
+                      ? 1
+                      : 0,
+                maxLength: 4,
+              })
+              .map((ids) =>
+                ids
+                  .sort((left, right) => left - right)
+                  .map((id) => ({
+                    id: String(id),
+                    title: `row-${id}`,
+                    createdAt: `2026-01-01T00:00:00.000Z`,
+                    score: id,
+                  })),
+              ),
+            resumeKind: fc.constantFrom(`none`, `reset`, `resume`),
+            transition: fc.constant(transition),
+            reopensBeforeTransition: fc.integer({ min: 0, max: 2 }),
+            reopensAfterTransition: fc.integer({ min: 0, max: 2 }),
+            unrelatedMetadataKeys: fc.uniqueArray(
+              fc.constantFrom(`gc`, `provider`, `custom`),
+              { maxLength: 3 },
+            ),
+          }),
         )
-        return {
-          title: (snapshot.rows[0]?.value as Todo | undefined)?.title ?? null,
-          cursor:
-            (snapshot.collectionMetadata.find(
-              ({ key }) => key === `probe:cursor`,
-            )?.value as string | undefined) ?? null,
-          rowVersion: snapshot.latestRowVersion,
-          txIds: log.map(({ tx_id }) => tx_id),
-        }
-      }
-
-      const appliedId = `source-id-present`
-      const crossing = tx(`crossing`, 1, 1, 1, `crossing`)
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: appliedId },
-        crossing,
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: appliedId },
-        tx(`peer`, 1, 2, 2, `newer`),
-      )
-      expect(
-        await reconcile(
-          { kind: `eager`, collectionId: appliedId },
-          tx(`crossing`, 2, 1, 2, `crossing`),
-          anchor,
-        ),
-      ).toEqual({
-        kind: `already-applied`,
-        committed: { term: 1, seq: 1, rowVersion: 1 },
-        latestRowVersion: 2,
-      })
-      expect(await observe(appliedId)).toEqual({
-        title: `newer`,
-        cursor: `newer`,
-        rowVersion: 2,
-        txIds: [`crossing`, `peer`],
-      })
-
-      const absentId = `source-id-absent`
-      expect(
-        await reconcile(
-          { kind: `eager`, collectionId: absentId },
-          tx(`crossing`, 2, 1, 1, `crossing`),
-          anchor,
-        ),
-      ).toEqual({
-        kind: `applied-now`,
-        committed: { term: 2, seq: 1, rowVersion: 1 },
-        latestRowVersion: 1,
-      })
-      expect(await observe(absentId)).toEqual({
-        title: `crossing`,
-        cursor: `crossing`,
-        rowVersion: 1,
-        txIds: [`crossing`],
-      })
-
-      const intervenedId = `source-intervened`
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: intervenedId },
-        tx(`peer`, 2, 1, 1, `newer`),
-      )
-      expect(
-        await reconcile(
-          { kind: `eager`, collectionId: intervenedId },
-          tx(`crossing`, 2, 2, 2, `stale`),
-          anchor,
-        ),
-      ).toEqual({ kind: `unknown` })
-      expect(await observe(intervenedId)).toEqual({
-        title: `newer`,
-        cursor: `newer`,
-        rowVersion: 1,
-        txIds: [`peer`],
-      })
-
-      const prunedId = `source-pruned`
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: prunedId },
-        crossing,
-      )
-      await driver.run(`DELETE FROM applied_tx WHERE collection_id = ?`, [
-        prunedId,
-      ])
-      expect(
-        await reconcile(
-          { kind: `eager`, collectionId: prunedId },
-          tx(`crossing`, 2, 1, 2, `stale`),
-          anchor,
-        ),
-      ).toEqual({ kind: `unknown` })
-      expect(await observe(prunedId)).toEqual({
-        title: `crossing`,
-        cursor: `crossing`,
-        rowVersion: 1,
-        txIds: [],
-      })
 
-      const resetId = `source-reset`
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: resetId },
-        crossing,
-      )
-      const resetAdapter = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-        schemaMismatchPolicy: `sync-present-reset`,
-      })
-      await resetAdapter.loadSubset(
-        { kind: `eager`, collectionId: resetId },
-        {},
+      // A seed-only shared run reseeds this campaign. Ordinary runs keep the
+      // fixed seed 1659, and a path replay runs once from its recorded path.
+      const parameters = oraclePropertyOptions(
+        24,
+        `sqlite-resume.baseline-lineage`,
       )
-      expect(
-        await resetAdapter.reconcileCommittedTx(
-          { kind: `eager`, collectionId: resetId },
-          tx(`crossing`, 2, 1, 1, `stale`),
-          anchor,
-        ),
-      ).toEqual({ kind: `unknown` })
-      const resetSnapshot = await resetAdapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: resetId,
-      })
-      expect({
-        ids: resetSnapshot.rows.map(({ key }) => key),
-        resetEpoch: resetSnapshot.resetEpoch,
-        rowVersion: resetSnapshot.latestRowVersion,
-      }).toEqual({ ids: [], resetEpoch: 1, rowVersion: 0 })
 
-      const staleId = `source-old-id`
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: staleId },
-        crossing,
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: staleId },
-        tx(`peer`, 1, 2, 2, `newer`),
-      )
-      expect(
-        await reconcile(
-          { kind: `eager`, collectionId: staleId },
-          tx(`crossing`, 2, 1, 3, `crossing`),
-          {
-            latestRowVersion: 1,
-            resetEpoch: 0,
-          },
-        ),
-      ).toEqual({ kind: `unknown` })
-      expect(await observe(staleId)).toEqual({
-        title: `newer`,
-        cursor: `newer`,
-        rowVersion: 2,
-        txIds: [`crossing`, `peer`],
+      let originalFailure: ResetResumeOracleViolation | undefined
+      const property = fc.asyncProperty(historyArbitrary, async (history) => {
+        try {
+          await observeResetResumeHistory(history, harnessFactory)
+        } catch (error) {
+          if (
+            originalFailure === undefined &&
+            error instanceof ResetResumeOracleViolation
+          ) {
+            originalFailure = error
+          }
+          throw error
+        }
       })
-
-      const malformedId = `source-missing-anchor`
-      await expect(async () =>
-        reconcile(
-          { kind: `eager`, collectionId: malformedId },
-          tx(`crossing`, 2, 1, 1, `unsafe`),
-          undefined as unknown as CommittedTxAnchor,
-        ),
-      ).rejects.toThrow(/valid durable anchor/)
-      expect(await observe(malformedId)).toEqual({
-        title: null,
-        cursor: null,
-        rowVersion: 0,
-        txIds: [],
+      const failure = await fc.check(property, {
+        ...parameters,
+        seed: parameters.seed ?? 1659,
+        ...(parameters.path === undefined ? {} : { endOnFailure: true }),
       })
-    }, 30_000)
-
-    /**
-     * A cache claim belongs to one physical generation. The reference history
-     * keeps the old claim live after rotation, rejects each live claim on the
-     * other physical generation, then expires the old one while the new
-     * generation remains live. Exact-ID reconciliation and term reservation
-     * may use the old generation before expiry; afterward neither operation
-     * may advance its durable log. The new claim remains independently usable.
-     * This driver observes the returned result and both durable ledgers at
-     * each cut, so checking only a rejected promise cannot mask a late write.
-     */
-    it(`fences reconciliation and term reservation when a cache claim expires`, async () => {
-      const { adapter, driver } = registerContractHarness()
+      if (!failure.failed) return
       if (
-        !adapter.claimCacheGeneration ||
-        !adapter.rotateCacheGeneration ||
-        !adapter.reconcileCommittedTx ||
-        !adapter.reserveLeadershipTerm
+        !(failure.errorInstance instanceof ResetResumeOracleViolation) ||
+        originalFailure === undefined ||
+        failure.counterexamplePath === null
       ) {
-        throw new Error(`SQLite adapter lacks managed cache operations`)
+        throw failure.errorInstance
       }
-      const logicalId = `claim-reconciliation`
-      const oldClaim = await adapter.claimCacheGeneration(logicalId)
-      const oldId = oldClaim.storageCollectionId
-      const rotatingClaim = await adapter.claimCacheGeneration(logicalId)
-      const newClaim = await adapter.rotateCacheGeneration(
-        logicalId,
-        rotatingClaim.claimId,
-        undefined,
-        oldId,
-      )
-      const newId = newClaim.storageCollectionId
-      expect(newId).not.toBe(oldId)
-      const candidate = (claimId: string, txId: string): PersistedTx => ({
-        txId,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        cacheGenerationClaimId: claimId,
-        mutations: [],
-      })
-      const anchor: CommittedTxAnchor = {
-        latestRowVersion: 0,
-        resetEpoch: 0,
+      if (!hasSameResetResumeFailure(originalFailure, failure.errorInstance)) {
+        throw new Error(
+          `Shrinking changed the reset/resume law or observation checkpoint`,
+        )
       }
-      const observeLedger = async (collectionId: string) => ({
-        terms: await driver.query<{ latest_term: number }>(
-          `SELECT latest_term FROM leader_term WHERE collection_id = ?`,
-          [collectionId],
-        ),
-        transactions: await driver.query<{ tx_id: string }>(
-          `SELECT tx_id FROM applied_tx WHERE collection_id = ?`,
-          [collectionId],
-        ),
-      })
 
-      // Both claims are live here. Existence and expiry alone do not confer
-      // authority over the other physical generation.
-      for (const [targetId, wrongClaimId] of [
-        [oldId, newClaim.claimId],
-        [newId, oldClaim.claimId],
-      ] as const) {
-        await expect(
-          adapter.reserveLeadershipTerm(
-            {
-              kind: `managed`,
-              storageCollectionId: targetId,
-              claimId: wrongClaimId,
-            },
-            0,
-            {
-              cacheGenerationClaimId: wrongClaimId,
-            },
-          ),
-        ).rejects.toThrow(/cache claim is no longer active/)
-        await expect(
-          adapter.reconcileCommittedTx(
-            {
-              kind: `managed`,
-              storageCollectionId: targetId,
-              claimId: wrongClaimId,
-            },
-            candidate(wrongClaimId, `wrong-generation`),
-            anchor,
-          ),
-        ).rejects.toThrow(/cache claim is no longer active/)
-        expect(await observeLedger(targetId)).toEqual({
-          terms: [],
-          transactions: [],
-        })
+      const replay = await fc.check(
+        fc.asyncProperty(historyArbitrary, async (history) => {
+          await observeResetResumeHistory(history, harnessFactory)
+        }),
+        {
+          seed: failure.seed,
+          path: failure.counterexamplePath,
+          endOnFailure: true,
+        },
+      )
+      if (
+        !replay.failed ||
+        !(replay.errorInstance instanceof ResetResumeOracleViolation) ||
+        JSON.stringify(replay.counterexample) !==
+          JSON.stringify(failure.counterexample) ||
+        !hasSameResetResumeFailure(failure.errorInstance, replay.errorInstance)
+      ) {
+        throw new Error(
+          `Reset/resume oracle replay did not reproduce the intended violation`,
+        )
       }
 
-      expect(
-        await adapter.reserveLeadershipTerm(
-          {
-            kind: `managed`,
-            storageCollectionId: oldId,
-            claimId: oldClaim.claimId,
-          },
-          0,
-          {
-            cacheGenerationClaimId: oldClaim.claimId,
-          },
-        ),
-      ).toMatchObject({ latestTerm: 1, latestRowVersion: 0 })
-      expect(
-        await adapter.reconcileCommittedTx(
-          {
-            kind: `managed`,
-            storageCollectionId: oldId,
-            claimId: oldClaim.claimId,
-          },
-          candidate(oldClaim.claimId, `old-commit`),
-          anchor,
-        ),
-      ).toMatchObject({ kind: `applied-now` })
-      expect(await observeLedger(oldId)).toEqual({
-        terms: [{ latest_term: 1 }],
-        transactions: [{ tx_id: `old-commit` }],
-      })
-
-      await driver.run(
-        `UPDATE cache_generation_claim SET expires_at_ms = 0 WHERE claim_id = ?`,
-        [oldClaim.claimId],
+      const reducedFailure = failure.errorInstance
+      throw new Error(
+        `Reset/resume baseline-lineage violation. ` +
+          `seed=${failure.seed} path=${failure.counterexamplePath} ` +
+          `law=${reducedFailure.law} ` +
+          `discriminant=${reducedFailure.discriminant} ` +
+          `checkpoint=${reducedFailure.observation.checkpoint} ` +
+          `originalTrace=${JSON.stringify(originalFailure.history)} ` +
+          `reducedTrace=${JSON.stringify(reducedFailure.history)} ` +
+          `expected=${JSON.stringify(reducedFailure.expected)} ` +
+          `actual=${JSON.stringify(reducedFailure.actual)} ` +
+          `observation=${JSON.stringify(reducedFailure.observation)} ` +
+          `replay=verified ` +
+          `cleanup=${reducedFailure.cleanupEvidence}`,
+        { cause: reducedFailure },
       )
-      await expect(
-        adapter.reconcileCommittedTx(
-          {
-            kind: `managed`,
-            storageCollectionId: oldId,
-            claimId: oldClaim.claimId,
-          },
-          candidate(oldClaim.claimId, `late-commit`),
-          { latestRowVersion: 1, resetEpoch: 0 },
-        ),
-      ).rejects.toThrow(/cache claim is no longer active/)
-      await expect(
-        adapter.reserveLeadershipTerm(
-          {
-            kind: `managed`,
-            storageCollectionId: oldId,
-            claimId: oldClaim.claimId,
-          },
-          1,
-          {
-            cacheGenerationClaimId: oldClaim.claimId,
-          },
-        ),
-      ).rejects.toThrow(/cache claim is no longer active/)
-      expect(await observeLedger(oldId)).toEqual({
-        terms: [{ latest_term: 1 }],
-        transactions: [{ tx_id: `old-commit` }],
-      })
+    },
+    120_000,
+  )
 
-      expect(
-        await adapter.reserveLeadershipTerm(
-          {
-            kind: `managed`,
-            storageCollectionId: newId,
-            claimId: newClaim.claimId,
-          },
-          0,
+  it(`leaves externally inconsistent metadata reachable for consumer validation`, async () => {
+    const observation = await observeResetResumeHistory(
+      {
+        fromSchemaVersion: 1,
+        rows: [
           {
-            cacheGenerationClaimId: newClaim.claimId,
+            id: `1`,
+            title: `lost externally`,
+            createdAt: `2026-01-01T00:00:00.000Z`,
+            score: 1,
           },
-        ),
-      ).toMatchObject({ latestTerm: 1, latestRowVersion: 0 })
-      expect(
-        await adapter.reconcileCommittedTx(
           {
-            kind: `managed`,
-            storageCollectionId: newId,
-            claimId: newClaim.claimId,
+            id: `2`,
+            title: `survives`,
+            createdAt: `2026-01-01T00:00:00.000Z`,
+            score: 2,
           },
-          candidate(newClaim.claimId, `new-commit`),
-          anchor,
-        ),
-      ).toMatchObject({ kind: `applied-now` })
-      expect(await observeLedger(newId)).toEqual({
-        terms: [{ latest_term: 1 }],
-        transactions: [{ tx_id: `new-commit` }],
-      })
-    })
-
-    it(`applies transactions idempotently with row versions and tombstones`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const collectionId = `todos`
+        ],
+        resumeKind: `resume`,
+        transition: `external-row-loss`,
+        reopensBeforeTransition: 1,
+        reopensAfterTransition: 1,
+        unrelatedMetadataKeys: [`provider`],
+      },
+      harnessFactory,
+    )
 
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
+    expect(observation.metadataKeys).toEqual([
+      `electric:resume`,
+      `oracle:provider`,
+    ])
+    expect(resumeKindOf(observation.resumeState)).toBe(`resume`)
+  }, 30_000)
+
+  it(`requires complete metadata reset while preserving non-reset metadata`, () => {
+    const compatibleEmpty: ResetResumeHistory = {
+      fromSchemaVersion: 1,
+      rows: [],
+      resumeKind: `resume`,
+      transition: `compatible-reopen`,
+      reopensBeforeTransition: 0,
+      reopensAfterTransition: 1,
+      unrelatedMetadataKeys: [`provider`],
+    }
+    const observation: ResetResumeObservation = {
+      checkpoint: `after-persistence-transition-reopen`,
+      resetEpoch: 0,
+      schemaVersion: 1,
+      durableRows: [],
+      tombstones: [],
+      appliedTransactions: [],
+      latestRowVersion: 1,
+      metadataKeys: [`electric:resume`, `oracle:provider`],
+      resumeState: { kind: `resume`, offset: `10_0` },
+    }
+    expect(() =>
+      expectResetResumeLaw(compatibleEmpty, observation),
+    ).not.toThrow()
+    expect(() =>
+      expectResetResumeLaw(
+        { ...compatibleEmpty, transition: `external-row-loss` },
+        observation,
+      ),
+    ).not.toThrow()
+    expect(() =>
+      expectResetResumeLaw(
+        { ...compatibleEmpty, transition: `schema-reset` },
+        { ...observation, resetEpoch: 1, schemaVersion: 2 },
+      ),
+    ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
+    expect(() =>
+      expectResetResumeLaw(
+        { ...compatibleEmpty, transition: `schema-reset` },
         {
-          txId: `tx-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Initial`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 10,
-              },
-            },
-          ],
+          ...observation,
+          resetEpoch: 1,
+          schemaVersion: 2,
+          metadataKeys: [`oracle:provider`],
+          resumeState: undefined,
         },
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
+      ),
+    ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
+    expect(() =>
+      expectResetResumeLaw(
+        { ...compatibleEmpty, transition: `schema-reset` },
         {
-          txId: `tx-1-replay`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Initial`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 10,
-              },
-            },
-          ],
+          ...observation,
+          resetEpoch: 1,
+          schemaVersion: 2,
+          metadataKeys: [],
+          resumeState: undefined,
         },
-      )
-
-      const txRows = await driver.query<{ count: number }>(
-        `SELECT COUNT(*) AS count
-       FROM applied_tx
-       WHERE collection_id = ?`,
-        [collectionId],
-      )
-      expect(txRows[0]?.count).toBe(1)
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `tx-2`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            {
-              type: `update`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Updated`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 11,
-              },
-            },
-          ],
-        },
-      )
-
-      const updated = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(`1`)]),
-        },
-      )
-      expect(updated).toEqual([
-        {
-          key: `1`,
-          value: {
-            id: `1`,
-            title: `Updated`,
-            createdAt: `2026-01-01T00:00:00.000Z`,
-            score: 11,
-          },
-        },
-      ])
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `tx-3`,
-          term: 1,
-          seq: 3,
-          rowVersion: 3,
-          mutations: [
-            {
-              type: `delete`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Updated`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 11,
-              },
-            },
-          ],
-        },
-      )
-
-      const remainingRows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(remainingRows).toEqual([])
-
-      const tombstoneTable = createPersistedTableName(collectionId, `t`)
-      const tombstoneRows = await driver.query<{
-        key: string
-        row_version: number
-      }>(`SELECT key, row_version FROM "${tombstoneTable}"`)
-      expect(tombstoneRows).toHaveLength(1)
-      expect(tombstoneRows[0]?.row_version).toBe(3)
-    })
-
-    it(`reconstructs a seeded baseline before releasing a partial source update after subset failure`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `partial-source-after-subset-failure`
-      const baseline: Todo = {
-        id: `1`,
-        title: `Persisted baseline`,
-        createdAt: `2026-01-01T00:00:00.000Z`,
-        score: 10,
-      }
-      const expected: Todo = { ...baseline, title: `Source update` }
-      const cacheClaim = await adapter.claimCacheGeneration?.(collectionId)
-      if (!cacheClaim) throw new Error(`Expected managed cache claim`)
-      expect(cacheClaim.storageCollectionId).not.toBe(collectionId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: cacheClaim.storageCollectionId,
-          claimId: cacheClaim.claimId,
-        },
-        {
-          txId: `seed-partial-source-baseline`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: cacheClaim.claimId,
-          mutations: [{ type: `insert`, key: baseline.id, value: baseline }],
-        },
-      )
-
-      const subsetFailure = new Error(`controlled incremental subset failure`)
-      const subsetLoad = holdAndRejectFirstSubsetLoad(adapter, subsetFailure)
-
-      let source!: Parameters<SyncConfig<Todo, string>[`sync`]>[0]
-      const collection = createCollection(
-        persistedCollectionOptions<Todo, string>({
-          id: collectionId,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          sync: {
-            rowUpdateMode: `partial`,
-            sync: (params) => {
-              source = params
-              params.markReady()
-              return { loadSubset: () => true }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const project = (row: Todo | undefined) =>
-        row && {
-          id: row.id,
-          title: row.title,
-          createdAt: row.createdAt,
-          score: row.score,
-        }
-
-      let load: Promise<void> | undefined
-      let receipt: Promise<void> | undefined
-      try {
-        await collection.stateWhenReady()
-        load = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-          () => undefined,
-        )
-        void load.catch(() => undefined)
-        await subsetLoad.entered
-
-        source.begin()
-        source.write({
-          type: `update`,
-          value: { id: baseline.id, title: expected.title } as Todo,
-        })
-        receipt = Promise.resolve(source.commit()).then(() => undefined)
-        let receiptStatus: `pending` | `fulfilled` | `rejected` = `pending`
-        void receipt.then(
-          () => {
-            receiptStatus = `fulfilled`
-          },
-          () => {
-            receiptStatus = `rejected`
-          },
-        )
-        expect(receiptStatus).toBe(`pending`)
-
-        subsetLoad.release()
-        await expect(load).rejects.toBe(subsetFailure)
-        await receipt
-        const durableBeforeRetry = await adapter.loadSubset(
-          {
-            kind: `managed`,
-            storageCollectionId: cacheClaim.storageCollectionId,
-            claimId: cacheClaim.claimId,
-          },
-          {},
-          { cacheGenerationClaimId: cacheClaim.claimId },
-        )
-        expect({
-          receiptStatus,
-          status: collection.status,
-          publicError: collection._lifecycle.getSyncError(),
-          publicBeforeRetry: project(collection.get(baseline.id)),
-          durableBeforeRetry: durableBeforeRetry.map(({ value }) => value),
-        }).toEqual({
-          receiptStatus: `fulfilled`,
-          status: `ready`,
-          publicError: undefined,
-          publicBeforeRetry: expected,
-          durableBeforeRetry: [expected],
-        })
-        expect(
-          await adapter.loadSubset(
-            { kind: `eager`, collectionId: collectionId },
-            {},
-          ),
-        ).toEqual([])
-
-        await collection._sync.loadSubset({ limit: 1 })
-        expect({
-          publicAfterRetry: project(collection.get(baseline.id)),
-          status: collection.status,
-          publicError: collection._lifecycle.getSyncError(),
-        }).toEqual({
-          publicAfterRetry: expected,
-          status: `ready`,
-          publicError: undefined,
-        })
-      } finally {
-        subsetLoad.release()
-        await load?.catch(() => undefined)
-        await receipt?.catch(() => undefined)
-        await collection.cleanup()
-        await adapter.releaseCacheGenerationClaim?.(cacheClaim.claimId)
-      }
-    })
-
-    it.each([`delete`, `insert`] as const)(
-      `settles a buffered complete %s across subset failure and retry`,
-      async (operation) => {
-        const { adapter } = registerContractHarness()
-        const collectionId = `complete-${operation}-after-subset-failure`
-        const row: Todo = {
-          id: `1`,
-          title: `${operation} row`,
-          createdAt: `2026-01-02T00:00:00.000Z`,
-          score: 11,
-        }
-        const cacheClaim = await adapter.claimCacheGeneration?.(collectionId)
-        if (!cacheClaim) throw new Error(`Expected managed cache claim`)
-        expect(cacheClaim.storageCollectionId).not.toBe(collectionId)
-        if (operation === `delete`) {
-          await adapter.applyCommittedTx(
-            {
-              kind: `managed`,
-              storageCollectionId: cacheClaim.storageCollectionId,
-              claimId: cacheClaim.claimId,
-            },
-            {
-              txId: `seed-delete-baseline`,
-              term: 1,
-              seq: 1,
-              rowVersion: 1,
-              cacheGenerationClaimId: cacheClaim.claimId,
-              mutations: [{ type: `insert`, key: row.id, value: row }],
-            },
-          )
-        }
-
-        const subsetFailure = new Error(
-          `controlled ${operation} subset failure`,
-        )
-        const subsetLoad = holdAndRejectFirstSubsetLoad(adapter, subsetFailure)
-
-        let source!: Parameters<SyncConfig<Todo, string>[`sync`]>[0]
-        const collection = createCollection(
-          persistedCollectionOptions<Todo, string>({
-            id: collectionId,
-            getKey: (value) => value.id,
-            syncMode: `on-demand`,
-            sync: {
-              rowUpdateMode: `partial`,
-              sync: (params) => {
-                source = params
-                params.markReady()
-                return { loadSubset: () => true }
-              },
-            },
-            persistence: { adapter },
-          }),
-        )
-
-        let load: Promise<void> | undefined
-        let receipt: Promise<void> | undefined
-        try {
-          await collection.stateWhenReady()
-          load = Promise.resolve(
-            collection._sync.loadSubset({ limit: 1 }),
-          ).then(() => undefined)
-          void load.catch(() => undefined)
-          await subsetLoad.entered
-
-          source.begin()
-          source.write(
-            operation === `delete`
-              ? { type: `delete`, key: row.id }
-              : { type: `insert`, value: row },
-          )
-          receipt = Promise.resolve(source.commit()).then(() => undefined)
-          let receiptStatus: `pending` | `fulfilled` | `rejected` = `pending`
-          void receipt.then(
-            () => {
-              receiptStatus = `fulfilled`
-            },
-            () => {
-              receiptStatus = `rejected`
-            },
-          )
-          expect(receiptStatus).toBe(`pending`)
-
-          subsetLoad.release()
-          await expect(load).rejects.toBe(subsetFailure)
-          await receipt
-          const expectedRows = operation === `delete` ? [] : [row]
-          expect({
-            receiptStatus,
-            publicRows: [...collection.values()].map((value) => ({
-              id: value.id,
-              title: value.title,
-              createdAt: value.createdAt,
-              score: value.score,
-            })),
-            durableRows: (
-              await adapter.loadSubset(
-                {
-                  kind: `managed`,
-                  storageCollectionId: cacheClaim.storageCollectionId,
-                  claimId: cacheClaim.claimId,
-                },
-                {},
-                {
-                  cacheGenerationClaimId: cacheClaim.claimId,
-                },
-              )
-            ).map(({ value }) => value),
-            status: collection.status,
-            publicError: collection._lifecycle.getSyncError(),
-          }).toEqual({
-            receiptStatus: `fulfilled`,
-            publicRows: expectedRows,
-            durableRows: expectedRows,
-            status: `ready`,
-            publicError: undefined,
-          })
-          expect(
-            await adapter.loadSubset(
-              { kind: `eager`, collectionId: collectionId },
-              {},
-            ),
-          ).toEqual([])
-
-          await collection._sync.loadSubset({ limit: 1 })
-          expect({
-            publicRows: [...collection.values()].map((value) => ({
-              id: value.id,
-              title: value.title,
-              createdAt: value.createdAt,
-              score: value.score,
-            })),
-            status: collection.status,
-            publicError: collection._lifecycle.getSyncError(),
-          }).toEqual({
-            publicRows: expectedRows,
-            status: `ready`,
-            publicError: undefined,
-          })
-        } finally {
-          subsetLoad.release()
-          await load?.catch(() => undefined)
-          await receipt?.catch(() => undefined)
-          await collection.cleanup()
-          await adapter.releaseCacheGenerationClaim?.(cacheClaim.claimId)
-        }
-      },
-    )
-
-    it(`rolls back partially applied mutations when transaction fails`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const collectionId = `atomicity`
-
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `atomicity-1`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [
-              {
-                type: `insert`,
-                key: `1`,
-                value: {
-                  id: `1`,
-                  title: `First`,
-                  createdAt: `2026-01-01T00:00:00.000Z`,
-                  score: 1,
-                },
-              },
-              {
-                type: `insert`,
-                key: `2`,
-                value: {
-                  id: `2`,
-                  title: `Second`,
-                  createdAt: `2026-01-01T00:00:00.000Z`,
-                  score: 2,
-                  // Trigger serialization failure after the first mutation executes.
-                  unsafeDate: new Date(Number.NaN),
-                } as unknown as Todo,
-              },
-            ],
-          },
-        ),
-      ).rejects.toThrow()
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(rows).toEqual([])
-
-      const txRows = await driver.query<{ count: number }>(
-        `SELECT COUNT(*) AS count
-       FROM applied_tx
-       WHERE collection_id = ?`,
-        [collectionId],
-      )
-      expect(txRows[0]?.count).toBe(0)
-    })
-
-    it(`persists row metadata and collection metadata atomically`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const collectionId = `metadata-roundtrip`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `metadata-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Tracked`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-              metadata: {
-                queryCollection: {
-                  owners: {
-                    q1: true,
-                  },
-                },
-              },
-              metadataChanged: true,
-            },
-          ],
-          collectionMetadataMutations: [
-            {
-              type: `set`,
-              key: `electric:resume`,
-              value: {
-                kind: `resume`,
-                offset: `10_0`,
-                handle: `handle-1`,
-                shapeId: `shape-1`,
-                updatedAt: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(rows).toEqual([
-        {
-          key: `1`,
-          value: {
-            id: `1`,
-            title: `Tracked`,
-            createdAt: `2026-01-01T00:00:00.000Z`,
-            score: 1,
-          },
-          metadata: {
-            queryCollection: {
-              owners: {
-                q1: true,
-              },
-            },
-          },
-        },
-      ])
-
-      const collectionMetadata = await adapter.loadCollectionMetadata?.({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(collectionMetadata).toEqual([
-        {
-          key: `electric:resume`,
-          value: {
-            kind: `resume`,
-            offset: `10_0`,
-            handle: `handle-1`,
-            shapeId: `shape-1`,
-            updatedAt: 1,
-          },
-        },
-      ])
-
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `metadata-2`,
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            mutations: [
-              {
-                type: `insert`,
-                key: `2`,
-                value: {
-                  id: `2`,
-                  title: `Bad`,
-                  createdAt: `2026-01-01T00:00:00.000Z`,
-                  score: 2,
-                },
-              },
-            ],
-            collectionMetadataMutations: [
-              {
-                type: `set`,
-                key: `broken`,
-                value: {
-                  invalid: new Date(Number.NaN),
-                },
-              },
-            ],
-          },
-        ),
-      ).rejects.toThrow()
-
-      const rowsAfterFailure = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(rowsAfterFailure).toEqual(rows)
-
-      const metadataRows = await driver.query<{ key: string }>(
-        `SELECT key
-         FROM collection_metadata
-         WHERE collection_id = ?`,
-        [collectionId],
-      )
-      expect(metadataRows).toEqual([{ key: `electric:resume` }])
-    })
-
-    it(`persists truncate transactions while preserving explicit collection metadata`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `truncate-metadata-roundtrip`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Before truncate`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-              metadata: {
-                owner: `before`,
-              },
-              metadataChanged: true,
-            },
-          ],
-          collectionMetadataMutations: [
-            {
-              type: `set`,
-              key: `electric:resume`,
-              value: {
-                kind: `resume`,
-                offset: `10_0`,
-                handle: `handle-1`,
-                shapeId: `shape-1`,
-                updatedAt: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `truncate-2`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          truncate: true,
-          mutations: [
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `After truncate`,
-                createdAt: `2026-01-02T00:00:00.000Z`,
-                score: 2,
-              },
-              metadata: {
-                owner: `after`,
-              },
-              metadataChanged: true,
-            },
-          ],
-          collectionMetadataMutations: [
-            {
-              type: `set`,
-              key: `electric:resume`,
-              value: {
-                kind: `reset`,
-                updatedAt: 2,
-              },
-            },
-          ],
-        },
-      )
-
-      expect(
-        await adapter.loadSubset(
-          { kind: `eager`, collectionId: collectionId },
-          {},
-        ),
-      ).toEqual([
-        {
-          key: `2`,
-          value: {
-            id: `2`,
-            title: `After truncate`,
-            createdAt: `2026-01-02T00:00:00.000Z`,
-            score: 2,
-          },
-          metadata: {
-            owner: `after`,
-          },
-        },
-      ])
-
-      expect(
-        await adapter.loadCollectionMetadata?.({
-          kind: `eager`,
-          collectionId: collectionId,
-        }),
-      ).toEqual([
-        {
-          key: `electric:resume`,
-          value: {
-            kind: `reset`,
-            updatedAt: 2,
-          },
-        },
-      ])
-    })
-
-    it(`supports pushdown operators with correctness-preserving fallback`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `todos`
-
-      const rows: Array<Todo> = [
-        {
-          id: `1`,
-          title: `Task Alpha`,
-          createdAt: `2026-01-01T00:00:00.000Z`,
-          score: 10,
-        },
-        {
-          id: `2`,
-          title: `Task Beta`,
-          createdAt: `2026-01-02T00:00:00.000Z`,
-          score: 20,
-        },
-        {
-          id: `3`,
-          title: `Other`,
-          createdAt: `2026-01-03T00:00:00.000Z`,
-          score: 15,
-        },
-        {
-          id: `4`,
-          title: `Task Gamma`,
-          createdAt: `2026-01-04T00:00:00.000Z`,
-          score: 25,
-        },
-      ]
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: rows.map((row) => ({
-            type: `insert` as const,
-            key: row.id,
-            value: row,
-          })),
-        },
-      )
-
-      const filtered = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`and`, [
-            new IR.Func(`or`, [
-              new IR.Func(`like`, [
-                new IR.PropRef([`title`]),
-                new IR.Value(`%Task%`),
-              ]),
-              new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`3`])]),
-            ]),
-            new IR.Func(`eq`, [
-              new IR.Func(`date`, [new IR.PropRef([`createdAt`])]),
-              new IR.Value(`2026-01-02`),
-            ]),
-          ]),
-          orderBy: [
-            {
-              expression: new IR.PropRef([`score`]),
-              compareOptions: {
-                direction: `desc`,
-                nulls: `last`,
-              },
-            },
-          ],
-        },
-      )
-
-      expect(filtered).toEqual([
-        {
-          key: `2`,
-          value: {
-            id: `2`,
-            title: `Task Beta`,
-            createdAt: `2026-01-02T00:00:00.000Z`,
-            score: 20,
-          },
-        },
-      ])
-
-      const withInEmpty = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`in`, [
-            new IR.PropRef([`id`]),
-            new IR.Value([] as Array<string>),
-          ]),
-        },
-      )
-      expect(withInEmpty).toEqual([])
-    })
-
-    // At loadSubset completion, persisted fallback ordering must use the exact
-    // custom comparator, then direction and public-key tie order. A lexical
-    // fallback fails every cell below.
-    it.each([
-      {
-        case: `ascending`,
-        direction: `asc` as const,
-        compare: (left: string, right: string) => right.localeCompare(left),
-        expected: [`zeta`, `middle`, `alpha`],
-      },
-      {
-        case: `descending`,
-        direction: `desc` as const,
-        compare: (left: string, right: string) => right.localeCompare(left),
-        expected: [`alpha`, `middle`, `zeta`],
-      },
-      {
-        case: `comparator-equal key order`,
-        direction: `asc` as const,
-        compare: () => 0,
-        expected: [`zeta`, `alpha`, `middle`],
-      },
-    ])(
-      `applies custom string collation during persisted subset ordering ($case)`,
-      async ({ case: caseName, direction, compare, expected }) => {
-        const { adapter } = registerContractHarness()
-        const collectionId = `custom-collation-order-${caseName}`
-
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `seed-custom-collation`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [`zeta`, `alpha`, `middle`].map((title, index) => ({
-              type: `insert` as const,
-              key: String(index),
-              value: { id: String(index), title, createdAt: ``, score: index },
-            })),
-          },
-        )
-
-        const rows = await adapter.loadSubset(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            orderBy: [
-              {
-                expression: new IR.PropRef([`title`]),
-                compareOptions: {
-                  direction,
-                  nulls: `last`,
-                  stringSort: `custom`,
-                  compare,
-                },
-              },
-            ],
-          },
-        )
-
-        expect(rows.map(({ value }) => value.title)).toEqual(expected)
-      },
-    )
-
-    it(`supports datetime/strftime predicate compilation for ISO date fields`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `date-pushdown`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-date`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Start`,
-                createdAt: `2026-01-02T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `Other`,
-                createdAt: `2026-01-03T00:00:00.000Z`,
-                score: 2,
-              },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`and`, [
-            new IR.Func(`eq`, [
-              new IR.Func(`strftime`, [
-                new IR.Value(`%Y-%m-%d`),
-                new IR.Func(`datetime`, [new IR.PropRef([`createdAt`])]),
-              ]),
-              new IR.Value(`2026-01-02`),
-            ]),
-            new IR.Func(`eq`, [
-              new IR.Func(`date`, [new IR.PropRef([`createdAt`])]),
-              new IR.Value(`2026-01-02`),
-            ]),
-          ]),
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`1`])
-    })
-
-    it(`persists bigint/date values and evaluates typed predicates`, async () => {
-      const { adapter } = registerContractHarness()
-      const typedAdapter = adapter as unknown as PersistenceAdapter
-      const collectionId = `typed-values`
-      const firstBigInt = BigInt(`9007199254740992`)
-      const secondBigInt = BigInt(`9007199254740997`)
-
-      await typedAdapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-typed-values`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Alpha`,
-                createdAt: new Date(`2026-01-02T00:00:00.000Z`),
-                largeViewCount: firstBigInt,
-              },
-            },
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `Beta`,
-                createdAt: new Date(`2026-01-03T00:00:00.000Z`),
-                largeViewCount: secondBigInt,
-              },
-            },
-          ],
-        },
-      )
-
-      const bigintRows = await typedAdapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`gt`, [
-            new IR.PropRef([`largeViewCount`]),
-            new IR.Value(BigInt(`9007199254740993`)),
-          ]),
-        },
-      )
-      expect(bigintRows.map((row) => row.key)).toEqual([`2`])
-
-      const dateRows = await typedAdapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`gt`, [
-            new IR.PropRef([`createdAt`]),
-            new IR.Value(new Date(`2026-01-02T12:00:00.000Z`)),
-          ]),
-        },
-      )
-      expect(dateRows.map((row) => row.key)).toEqual([`2`])
-
-      const restoredRows = await typedAdapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [
-            new IR.Func(`date`, [new IR.PropRef([`createdAt`])]),
-            new IR.Value(`2026-01-02`),
-          ]),
-        },
-      )
-      const firstRow = restoredRows[0]?.value
-      expect(firstRow?.createdAt).toBeInstanceOf(Date)
-      expect(firstRow?.largeViewCount).toBe(firstBigInt)
-    })
-
-    it(`handles cursor whereCurrent/whereFrom requests`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `todos`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-cursor`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `a`,
-              value: {
-                id: `a`,
-                title: `A`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 10,
-              },
-            },
-            {
-              type: `insert`,
-              key: `b`,
-              value: {
-                id: `b`,
-                title: `B`,
-                createdAt: `2026-01-02T00:00:00.000Z`,
-                score: 10,
-              },
-            },
-            {
-              type: `insert`,
-              key: `c`,
-              value: {
-                id: `c`,
-                title: `C`,
-                createdAt: `2026-01-03T00:00:00.000Z`,
-                score: 12,
-              },
-            },
-            {
-              type: `insert`,
-              key: `d`,
-              value: {
-                id: `d`,
-                title: `D`,
-                createdAt: `2026-01-04T00:00:00.000Z`,
-                score: 13,
-              },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          orderBy: [
-            {
-              expression: new IR.PropRef([`score`]),
-              compareOptions: {
-                direction: `asc`,
-                nulls: `last`,
-              },
-            },
-          ],
-          limit: 1,
-          cursor: {
-            whereCurrent: new IR.Func(`eq`, [
-              new IR.PropRef([`score`]),
-              new IR.Value(10),
-            ]),
-            whereFrom: new IR.Func(`gt`, [
-              new IR.PropRef([`score`]),
-              new IR.Value(10),
-            ]),
-          },
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`a`, `b`, `c`])
-    })
-
-    it(`ensures and removes persisted indexes with registry tracking`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const collectionId = `todos`
-      const signature = `idx-title`
-
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        {
-          expressionSql: [`json_extract(value, '$.title')`],
-        },
-      )
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        {
-          expressionSql: [`json_extract(value, '$.title')`],
-        },
-      )
-
-      const registryRows = await driver.query<{
-        removed: number
-        index_name: string
-      }>(
-        `SELECT removed, index_name
-       FROM persisted_index_registry
-       WHERE collection_id = ? AND signature = ?`,
-        [collectionId, signature],
-      )
-      expect(registryRows).toHaveLength(1)
-      expect(registryRows[0]?.removed).toBe(0)
-
-      const createdIndexName = registryRows[0]?.index_name
-      const sqliteMasterBefore = await driver.query<{ name: string }>(
-        `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
-        [createdIndexName],
-      )
-      expect(sqliteMasterBefore).toHaveLength(1)
-
-      if (!adapter.markIndexRemoved) {
-        throw new Error(
-          `Adapter must implement markIndexRemoved for this contract suite`,
-        )
-      }
-      await adapter.markIndexRemoved(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-      )
-
-      const registryRowsAfter = await driver.query<{ removed: number }>(
-        `SELECT removed
-       FROM persisted_index_registry
-       WHERE collection_id = ? AND signature = ?`,
-        [collectionId, signature],
-      )
-      expect(registryRowsAfter[0]?.removed).toBe(1)
-
-      const sqliteMasterAfter = await driver.query<{ name: string }>(
-        `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
-        [createdIndexName],
-      )
-      expect(sqliteMasterAfter).toHaveLength(0)
-    })
-
-    it(`rebuilds a physical index when the normalized spec changes`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const collectionId = `todos`
-      const signature = `idx-upgraded-expression`
-
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        {
-          expressionSql: [`json_extract(value, '$.title')`],
-        },
-      )
-
-      const registryRows = await driver.query<{ index_name: string }>(
-        `SELECT index_name
-         FROM persisted_index_registry
-         WHERE collection_id = ? AND signature = ?`,
-        [collectionId, signature],
-      )
-      const indexName = registryRows[0]?.index_name
-      expect(indexName).toBeTruthy()
-
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        {
-          expressionSql: [`json_extract(value, '$.score')`],
-        },
-      )
-
-      const sqliteMasterRows = await driver.query<{ sql: string }>(
-        `SELECT sql
-         FROM sqlite_master
-         WHERE type = 'index' AND name = ?`,
-        [indexName],
-      )
-      expect(sqliteMasterRows).toHaveLength(1)
-      expect(sqliteMasterRows[0]?.sql).toContain(
-        `json_extract(value, '$.score')`,
-      )
-      expect(sqliteMasterRows[0]?.sql).not.toContain(
-        `json_extract(value, '$.title')`,
-      )
-    })
-
-    it(`enforces schema mismatch policies`, async () => {
-      const baseHarness = registerContractHarness({
-        schemaVersion: 1,
-        schemaMismatchPolicy: `reset`,
-      })
-      const collectionId = `todos`
-      await baseHarness.adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-schema`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Before mismatch`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      const strictAdapter = new SQLiteCorePersistenceAdapter({
-        driver: baseHarness.driver,
-        schemaVersion: 2,
-        schemaMismatchPolicy: `sync-absent-error`,
-      })
-      await expect(
-        strictAdapter.loadSubset(
-          { kind: `eager`, collectionId: collectionId },
-          {},
-        ),
-      ).rejects.toThrow(/Schema version mismatch/)
-
-      const resetAdapter = new SQLiteCorePersistenceAdapter({
-        driver: baseHarness.driver,
-        schemaVersion: 2,
-        schemaMismatchPolicy: `sync-present-reset`,
-      })
-      const resetRows = await resetAdapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(resetRows).toEqual([])
-    })
-
-    /**
-     * Reset/resume oracle card
-     *
-     * Law and source: a destructive schema reset creates a new persisted
-     * baseline and clears every collection-metadata record in that reset
-     * transaction. Same-schema adapter reopens preserve metadata, including
-     * for a genuinely empty baseline. The production reset policy above and the
-     * independently reproduced history in
-     * https://github.com/TanStack/db/issues/1589 establish this narrow law.
-     *
-     * Domain and legal histories: zero-to-four committed rows; absent, reset,
-     * or non-initial resume metadata; same-schema adapter reopen, vN -> vN+1
-     * sync-present-reset, a partial restore after reset, or out-of-band row
-     * loss; adapter reopens on either side; unrelated metadata.
-     *
-     * Reference: a two-generation lineage relation. Same-schema reopen and raw
-     * external loss keep the core generation/metadata record; schema reset
-     * replaces the generation and starts with no metadata. This model does not
-     * inspect the adapter's SQL branches or infer compatibility from row
-     * cardinality.
-     *
-     * Production path and checkpoint: SQLiteCorePersistenceAdapter commits a
-     * real SQLite baseline, then a new adapter instance reaches
-     * ensureCollectionReady/handleSchemaMismatch. At the
-     * after-persistence-transition-reopen checkpoint we inspect registry
-     * version, reset epoch/generation, complete durable rows, tombstones,
-     * applied transactions, and collection metadata.
-     *
-     * Observed result and known omissions: exact settled rows, exact metadata
-     * keys, and whether the durable Electric state is absent/reset/resume. The
-     * external-loss lane proves the generic adapter leaves metadata reachable;
-     * only the persisted+Electric suite judges whether that cursor is safe to
-     * consume. The injected loss is not a claim that arbitrary SQL is a
-     * supported public API. Partial resumed updates and SDK framing retain
-     * their executable owners in the Electric recovery and framing suites.
-     *
-     * Trust: reset_epoch and schema_version prove reach; retained metadata
-     * after reset is the whole-path fault control, while compatible and
-     * external-loss histories calibrate preservation. Every generated database
-     * is removed after evidence capture. The failure reports first and reduced
-     * histories plus a verified fast-check seed/path replay.
-     */
-    oracleReplayTest(it, `sqlite-resume.baseline-lineage`)(
-      `resets collection metadata with its persisted baseline across generated adapter reopen histories`,
-      async () => {
-        const historyArbitrary = fc
-          .constantFrom<ResetResumeHistory[`transition`]>(
-            `compatible-reopen`,
-            `schema-reset`,
-            `partial-restore`,
-            `external-row-loss`,
-          )
-          .chain((transition) =>
-            fc.record<ResetResumeHistory>({
-              fromSchemaVersion: fc.integer({ min: 1, max: 4 }),
-              rows: fc
-                .uniqueArray(fc.integer({ min: 0, max: 20 }), {
-                  minLength:
-                    transition === `partial-restore`
-                      ? 2
-                      : transition === `external-row-loss`
-                        ? 1
-                        : 0,
-                  maxLength: 4,
-                })
-                .map((ids) =>
-                  ids
-                    .sort((left, right) => left - right)
-                    .map((id) => ({
-                      id: String(id),
-                      title: `row-${id}`,
-                      createdAt: `2026-01-01T00:00:00.000Z`,
-                      score: id,
-                    })),
-                ),
-              resumeKind: fc.constantFrom(`none`, `reset`, `resume`),
-              transition: fc.constant(transition),
-              reopensBeforeTransition: fc.integer({ min: 0, max: 2 }),
-              reopensAfterTransition: fc.integer({ min: 0, max: 2 }),
-              unrelatedMetadataKeys: fc.uniqueArray(
-                fc.constantFrom(`gc`, `provider`, `custom`),
-                { maxLength: 3 },
-              ),
-            }),
-          )
-
-        // A seed-only shared run reseeds this campaign. Ordinary runs keep the
-        // fixed seed 1659, and a path replay runs once from its recorded path.
-        const parameters = oraclePropertyOptions(
-          24,
-          `sqlite-resume.baseline-lineage`,
-        )
-
-        let originalFailure: ResetResumeOracleViolation | undefined
-        const property = fc.asyncProperty(historyArbitrary, async (history) => {
-          try {
-            await observeResetResumeHistory(history, harnessFactory)
-          } catch (error) {
-            if (
-              originalFailure === undefined &&
-              error instanceof ResetResumeOracleViolation
-            ) {
-              originalFailure = error
-            }
-            throw error
-          }
-        })
-        const failure = await fc.check(property, {
-          ...parameters,
-          seed: parameters.seed ?? 1659,
-          ...(parameters.path === undefined ? {} : { endOnFailure: true }),
-        })
-        if (!failure.failed) return
-        if (
-          !(failure.errorInstance instanceof ResetResumeOracleViolation) ||
-          originalFailure === undefined ||
-          failure.counterexamplePath === null
-        ) {
-          throw failure.errorInstance
-        }
-        if (
-          !hasSameResetResumeFailure(originalFailure, failure.errorInstance)
-        ) {
-          throw new Error(
-            `Shrinking changed the reset/resume law or observation checkpoint`,
-          )
-        }
-
-        const replay = await fc.check(
-          fc.asyncProperty(historyArbitrary, async (history) => {
-            await observeResetResumeHistory(history, harnessFactory)
-          }),
-          {
-            seed: failure.seed,
-            path: failure.counterexamplePath,
-            endOnFailure: true,
-          },
-        )
-        if (
-          !replay.failed ||
-          !(replay.errorInstance instanceof ResetResumeOracleViolation) ||
-          JSON.stringify(replay.counterexample) !==
-            JSON.stringify(failure.counterexample) ||
-          !hasSameResetResumeFailure(
-            failure.errorInstance,
-            replay.errorInstance,
-          )
-        ) {
-          throw new Error(
-            `Reset/resume oracle replay did not reproduce the intended violation`,
-          )
-        }
-
-        const reducedFailure = failure.errorInstance
-        throw new Error(
-          `Reset/resume baseline-lineage violation. ` +
-            `seed=${failure.seed} path=${failure.counterexamplePath} ` +
-            `law=${reducedFailure.law} ` +
-            `discriminant=${reducedFailure.discriminant} ` +
-            `checkpoint=${reducedFailure.observation.checkpoint} ` +
-            `originalTrace=${JSON.stringify(originalFailure.history)} ` +
-            `reducedTrace=${JSON.stringify(reducedFailure.history)} ` +
-            `expected=${JSON.stringify(reducedFailure.expected)} ` +
-            `actual=${JSON.stringify(reducedFailure.actual)} ` +
-            `observation=${JSON.stringify(reducedFailure.observation)} ` +
-            `replay=verified ` +
-            `cleanup=${reducedFailure.cleanupEvidence}`,
-          { cause: reducedFailure },
-        )
-      },
-      120_000,
-    )
-
-    it(`leaves externally inconsistent metadata reachable for consumer validation`, async () => {
-      const observation = await observeResetResumeHistory(
-        {
-          fromSchemaVersion: 1,
-          rows: [
-            {
-              id: `1`,
-              title: `lost externally`,
-              createdAt: `2026-01-01T00:00:00.000Z`,
-              score: 1,
-            },
-            {
-              id: `2`,
-              title: `survives`,
-              createdAt: `2026-01-01T00:00:00.000Z`,
-              score: 2,
-            },
-          ],
-          resumeKind: `resume`,
-          transition: `external-row-loss`,
-          reopensBeforeTransition: 1,
-          reopensAfterTransition: 1,
-          unrelatedMetadataKeys: [`provider`],
-        },
-        harnessFactory,
-      )
-
-      expect(observation.metadataKeys).toEqual([
-        `electric:resume`,
-        `oracle:provider`,
-      ])
-      expect(resumeKindOf(observation.resumeState)).toBe(`resume`)
-    }, 30_000)
-
-    it(`requires complete metadata reset while preserving non-reset metadata`, () => {
-      const compatibleEmpty: ResetResumeHistory = {
-        fromSchemaVersion: 1,
-        rows: [],
-        resumeKind: `resume`,
-        transition: `compatible-reopen`,
-        reopensBeforeTransition: 0,
-        reopensAfterTransition: 1,
-        unrelatedMetadataKeys: [`provider`],
-      }
-      const observation: ResetResumeObservation = {
-        checkpoint: `after-persistence-transition-reopen`,
-        resetEpoch: 0,
-        schemaVersion: 1,
-        durableRows: [],
-        tombstones: [],
-        appliedTransactions: [],
-        latestRowVersion: 1,
-        metadataKeys: [`electric:resume`, `oracle:provider`],
-        resumeState: { kind: `resume`, offset: `10_0` },
-      }
-      expect(() =>
-        expectResetResumeLaw(compatibleEmpty, observation),
-      ).not.toThrow()
-      expect(() =>
-        expectResetResumeLaw(
-          { ...compatibleEmpty, transition: `external-row-loss` },
-          observation,
-        ),
-      ).not.toThrow()
-      expect(() =>
-        expectResetResumeLaw(
-          { ...compatibleEmpty, transition: `schema-reset` },
-          { ...observation, resetEpoch: 1, schemaVersion: 2 },
-        ),
-      ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
-      expect(() =>
-        expectResetResumeLaw(
-          { ...compatibleEmpty, transition: `schema-reset` },
-          {
-            ...observation,
-            resetEpoch: 1,
-            schemaVersion: 2,
-            metadataKeys: [`oracle:provider`],
-            resumeState: undefined,
-          },
-        ),
-      ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
-      expect(() =>
-        expectResetResumeLaw(
-          { ...compatibleEmpty, transition: `schema-reset` },
-          {
-            ...observation,
-            resetEpoch: 1,
-            schemaVersion: 2,
-            metadataKeys: [],
-            resumeState: undefined,
-          },
-        ),
-      ).not.toThrow()
-    })
-
-    it(`returns pullSince deltas and requiresFullReload when threshold is exceeded`, async () => {
-      const { adapter } = registerContractHarness({
-        pullSinceReloadThreshold: 1,
-      })
-      const collectionId = `todos`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-pull`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `One`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `Two`,
-                createdAt: `2026-01-02T00:00:00.000Z`,
-                score: 2,
-              },
-            },
-          ],
-        },
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-pull-2`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            {
-              type: `delete`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `One`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      const delta = await adapter.pullSince({ kind: `eager`, collectionId }, 1)
-      if (delta.requiresFullReload) {
-        throw new Error(`Expected key-level delta, received full reload`)
-      }
-      expect(delta.changedKeys).toEqual([])
-      expect(delta.deletedKeys).toEqual([`1`])
-      expect(delta.deltas).toEqual([
-        {
-          txId: `seed-pull-2`,
-          latestRowVersion: 2,
-          changedRows: [],
-          deletedKeys: [`1`],
-          rowMetadataMutations: [],
-          collectionMetadataMutations: [],
-        },
-      ])
-
-      const fullReload = await adapter.pullSince(
-        { kind: `eager`, collectionId },
-        0,
-      )
-      expect(fullReload.requiresFullReload).toBe(true)
-    })
-
-    it(`scans persisted rows with metadata and replays metadata-only deltas`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `scan-and-replay`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `scan-seed-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Tracked`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-              metadata: {
-                queryCollection: {
-                  owners: {
-                    q1: true,
-                  },
-                },
-              },
-              metadataChanged: true,
-            },
-          ],
-        },
-      )
-
-      const scannedRows = await adapter.scanRows?.(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          metadataOnly: true,
-        },
-      )
-      expect(scannedRows).toEqual([
-        {
-          key: `1`,
-          value: {
-            id: `1`,
-            title: `Tracked`,
-            createdAt: `2026-01-01T00:00:00.000Z`,
-            score: 1,
-          },
-          metadata: {
-            queryCollection: {
-              owners: {
-                q1: true,
-              },
-            },
-          },
-        },
-      ])
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `scan-seed-2`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [],
-          rowMetadataMutations: [
-            {
-              type: `set`,
-              key: `1`,
-              value: {
-                queryCollection: {
-                  owners: {
-                    q2: true,
-                  },
-                },
-              },
-            },
-          ],
-          collectionMetadataMutations: [
-            {
-              type: `set`,
-              key: `electric:resume`,
-              value: {
-                kind: `reset`,
-                updatedAt: 2,
-              },
-            },
-          ],
-        },
-      )
-
-      const replayDelta = await adapter.pullSince(
-        { kind: `eager`, collectionId },
-        1,
-      )
-      if (replayDelta.requiresFullReload) {
-        throw new Error(`Expected replay delta, received full reload`)
-      }
-
-      expect(replayDelta.deltas).toEqual([
-        {
-          txId: `scan-seed-2`,
-          latestRowVersion: 2,
-          changedRows: [],
-          deletedKeys: [],
-          rowMetadataMutations: [
-            {
-              type: `set`,
-              key: `1`,
-              value: {
-                queryCollection: {
-                  owners: {
-                    q2: true,
-                  },
-                },
-              },
-            },
-          ],
-          collectionMetadataMutations: [
-            {
-              type: `set`,
-              key: `electric:resume`,
-              value: {
-                kind: `reset`,
-                updatedAt: 2,
-              },
-            },
-          ],
-        },
-      ])
-    })
-
-    it(`keeps numeric and string keys distinct in storage`, async () => {
-      const { driver } = registerContractHarness()
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver,
-      })
-      const collectionId = `mixed-keys`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `mixed-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: 1,
-              value: {
-                id: 1,
-                title: `Numeric`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `String`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 2,
-              },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(rows).toHaveLength(2)
-      expect(rows.some((row) => row.key === 1)).toBe(true)
-      expect(rows.some((row) => row.key === `1`)).toBe(true)
-    })
-
-    it(`stores hostile collection ids safely via deterministic table mapping`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const hostileCollectionId = `todos"; DROP TABLE applied_tx; --`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: hostileCollectionId },
-        {
-          txId: `hostile-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `safe`,
-              value: {
-                id: `safe`,
-                title: `Safe`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      const registryRows = await driver.query<{ table_name: string }>(
-        `SELECT table_name
-       FROM collection_registry
-       WHERE collection_id = ?`,
-        [hostileCollectionId],
-      )
-      expect(registryRows).toHaveLength(1)
-      expect(registryRows[0]?.table_name).toMatch(/^c_[a-z2-7]+_[0-9a-z]+$/)
-
-      const loadedRows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: hostileCollectionId },
-        {},
-      )
-      expect(loadedRows).toHaveLength(1)
-      expect(loadedRows[0]?.key).toBe(`safe`)
-    })
-
-    it(`deduplicates concurrent ensureCollectionReady calls for the same collection`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `concurrent-startup`
-
-      const [rowsA, rowsB] = await Promise.all([
-        adapter.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
-        adapter.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
-      ])
-
-      expect(rowsA).toEqual([])
-      expect(rowsB).toEqual([])
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `concurrent-startup-seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Seeded`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      const loadedRows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      expect(loadedRows).toHaveLength(1)
-      expect(loadedRows[0]?.key).toBe(`1`)
-    })
-
-    it(`prunes applied_tx rows by sequence threshold`, async () => {
-      const { adapter, driver } = registerContractHarness({
-        appliedTxPruneMaxRows: 2,
-      })
-      const collectionId = `pruning`
-
-      for (let seq = 1; seq <= 4; seq++) {
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `prune-${seq}`,
-            term: 1,
-            seq,
-            rowVersion: seq,
-            mutations: [
-              {
-                type: `insert`,
-                key: `k-${seq}`,
-                value: {
-                  id: `k-${seq}`,
-                  title: `Row ${seq}`,
-                  createdAt: `2026-01-01T00:00:00.000Z`,
-                  score: seq,
-                },
-              },
-            ],
-          },
-        )
-      }
-
-      const appliedRows = await driver.query<{ seq: number }>(
-        `SELECT seq
-       FROM applied_tx
-       WHERE collection_id = ?
-       ORDER BY seq ASC`,
-        [collectionId],
-      )
-      expect(appliedRows.map((row) => row.seq)).toEqual([3, 4])
-    })
-
-    it(`prunes applied_tx rows by age threshold when configured`, async () => {
-      const { adapter, driver } = registerContractHarness({
-        appliedTxPruneMaxAgeSeconds: 1,
-      })
-      const collectionId = `pruning-by-age`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `age-1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `old`,
-              value: {
-                id: `old`,
-                title: `Old`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-              },
-            },
-          ],
-        },
-      )
-
-      await driver.run(
-        `UPDATE applied_tx
-       SET applied_at = 0
-       WHERE collection_id = ? AND seq = 1`,
-        [collectionId],
-      )
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `age-2`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            {
-              type: `insert`,
-              key: `new`,
-              value: {
-                id: `new`,
-                title: `New`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 2,
-              },
-            },
-          ],
-        },
-      )
-
-      const appliedRows = await driver.query<{ seq: number }>(
-        `SELECT seq
-       FROM applied_tx
-       WHERE collection_id = ?
-       ORDER BY seq ASC`,
-        [collectionId],
-      )
-      expect(appliedRows.map((row) => row.seq)).toEqual([2])
-    })
-
-    it(`supports large IN lists within the driver's binding cap`, async () => {
-      const { adapter } = registerContractHarness()
-      const collectionId = `large-in`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-large-in`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `Two`,
-                createdAt: `2026-01-02T00:00:00.000Z`,
-                score: 2,
-              },
-            },
-            {
-              type: `insert`,
-              key: `4`,
-              value: {
-                id: `4`,
-                title: `Four`,
-                createdAt: `2026-01-04T00:00:00.000Z`,
-                score: 4,
-              },
-            },
-          ],
-        },
-      )
-
-      const largeIds = Array.from(
-        { length: 1200 },
-        (_value, index) => `miss-${index}`,
-      )
-      largeIds[100] = `2`
-      largeIds[1100] = `4`
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`in`, [
-            new IR.PropRef([`id`]),
-            new IR.Value(largeIds),
-          ]),
-          orderBy: [
-            {
-              expression: new IR.PropRef([`id`]),
-              compareOptions: {
-                direction: `asc`,
-                nulls: `last`,
-              },
-            },
-          ],
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`2`, `4`])
-    })
-
-    it(`falls back to in-memory filtering when SQL json path pushdown is unsupported`, async () => {
-      const { driver } = registerContractHarness()
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver,
-      })
-      const collectionId = `fallback-where`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-fallback`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Keep`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-                [`meta-field`]: `alpha`,
-              },
-            },
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `Drop`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 2,
-                [`meta-field`]: `beta`,
-              },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`meta-field`]),
-            new IR.Value(`alpha`),
-          ]),
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`1`])
-    })
-
-    it(`supports alias-qualified refs during in-memory fallback filtering`, async () => {
-      const { driver } = registerContractHarness()
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver,
-      })
-      const collectionId = `fallback-alias-qualified-ref`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-alias-fallback`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `1`,
-              value: {
-                id: `1`,
-                title: `Keep`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 1,
-                [`meta-field`]: `alpha`,
-              },
-            },
-            {
-              type: `insert`,
-              key: `2`,
-              value: {
-                id: `2`,
-                title: `Drop`,
-                createdAt: `2026-01-01T00:00:00.000Z`,
-                score: 2,
-                [`meta-field`]: `beta`,
-              },
-            },
-          ],
-        },
-      )
-
-      // `meta-field` makes SQL pushdown unsupported, so filter correctness comes
-      // from the in-memory evaluator. The explicit source alias is the only
-      // signal that the leading `todos` segment is qualification.
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`todos`, `meta-field`], `todos`),
-            new IR.Value(`alpha`),
-          ]),
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`1`])
-    })
-
-    it(`does not guess that a legacy fallback path is an alias`, async () => {
-      const { driver } = registerContractHarness()
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      const collectionId = `fallback-legacy-nested-ref`
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-legacy-nested-fallback`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `nested-match`,
-              value: {
-                profile: { [`meta-field`]: `alpha` },
-                [`meta-field`]: `flat-other`,
-              },
-            },
-            {
-              type: `insert`,
-              key: `flat-only`,
-              value: { [`meta-field`]: `alpha` },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`profile`, `meta-field`]),
-            new IR.Value(`alpha`),
-          ]),
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`nested-match`])
-    })
-
-    it(`compiles serialized expression index specs used by phase-2 metadata`, async () => {
-      const { adapter, driver } = registerContractHarness()
-      const collectionId = `serialized-index`
-      const signature = `serialized-title`
-
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        {
-          expressionSql: [
-            JSON.stringify({
-              type: `ref`,
-              path: [`title`],
-            }),
-          ],
-        },
-      )
-
-      const registryRows = await driver.query<{ index_name: string }>(
-        `SELECT index_name
-       FROM persisted_index_registry
-       WHERE collection_id = ? AND signature = ?`,
-        [collectionId, signature],
-      )
-      const indexName = registryRows[0]?.index_name
-      expect(indexName).toBeTruthy()
-
-      const sqliteMasterRows = await driver.query<{ sql: string }>(
-        `SELECT sql
-       FROM sqlite_master
-       WHERE type = 'index' AND name = ?`,
-        [indexName],
-      )
-      expect(sqliteMasterRows).toHaveLength(1)
-      expect(sqliteMasterRows[0]?.sql).toContain(
-        `json_extract(value, '$.title')`,
-      )
-    })
-
-    it(`rejects unsafe raw SQL fragments in index specs`, async () => {
-      const { adapter } = registerContractHarness()
-
-      await expect(
-        adapter.ensureIndex(
-          { kind: `eager`, collectionId: `unsafe-index` },
-          `unsafe`,
-          {
-            expressionSql: [
-              `json_extract(value, '$.title'); DROP TABLE applied_tx`,
-            ],
-          },
-        ),
-      ).rejects.toThrow(/Invalid persisted index SQL fragment/)
-    })
-  })
-}
+      ),
+    ).not.toThrow()
+  })
+}
 
 /**
  * # Can a SQLite subset predicate exceed the connection's binding capacity?
@@ -3548,513 +817,8 @@ export function runSQLiteCoreAdapterContractSuite(
  * recorded random-campaign history. The normal package test runs fixed and
  * random campaigns.
  */
-const BINDING_CAP = 999
 const BINDING_FIXED_SEED = 1_993_999
 const BINDING_RUNS = 12
-type Kind = 'string' | 'number' | 'boolean' | 'date' | 'bigint'
-type Scalar = string | number | boolean | Date | bigint
-type Clause = {
-  field: 'a' | 'b'
-  kind: 'in' | 'eq'
-  values: ReadonlyArray<Scalar>
-}
-type Spec = {
-  label: string
-  valueKind: Kind
-  connective: 'and' | 'or'
-  clauses: ReadonlyArray<Clause>
-  nested?: boolean
-  ordered?: boolean
-  rows?: ReadonlyArray<Row>
-}
-type Row = { key: string; value: { a: Scalar; b: Scalar } }
-type Attempt = {
-  method: 'exec' | 'query' | 'run'
-  sql: string
-  bindings: number
-  error?: string
-}
-
-function target(kind: Kind): Scalar {
-  switch (kind) {
-    case 'string':
-      return 'target'
-    case 'number':
-      return 123_456
-    case 'boolean':
-      return true
-    case 'date':
-      return new Date('2026-01-01T00:00:00.000Z')
-    case 'bigint':
-      return 9_007_199_254_740_993n
-  }
-}
-function miss(kind: Kind, ordinal: number): Scalar {
-  switch (kind) {
-    case 'string':
-      return `miss-${ordinal}`
-    case 'number':
-      return ordinal
-    case 'boolean':
-      return false
-    case 'date':
-      return new Date(Date.UTC(2020, 0, 1 + ordinal))
-    case 'bigint':
-      return 9_007_199_254_751_000n + BigInt(ordinal)
-  }
-}
-function values(kind: Kind, length: number): Array<Scalar> {
-  const result = Array.from({ length }, (_, index) => miss(kind, index))
-  if (length) result[Math.floor(length / 2)] = target(kind)
-  return result
-}
-function same(left: Scalar, right: Scalar): boolean {
-  return left instanceof Date && right instanceof Date
-    ? left.getTime() === right.getTime()
-    : left === right
-}
-function expectedBindingRows(
-  spec: Spec,
-  rows: ReadonlyArray<Row>,
-): Array<string> {
-  return rows
-    .filter((row) => {
-      const decisions = spec.clauses.map((clause) => {
-        const field = row.value[clause.field]
-        return clause.kind === 'eq'
-          ? same(field, clause.values[0]!)
-          : clause.values.some((candidate) => same(field, candidate))
-      })
-      if (spec.nested) return (decisions[0] || decisions[1]) && decisions[2]
-      return spec.connective === 'and'
-        ? decisions.every(Boolean)
-        : decisions.some(Boolean)
-    })
-    .sort((a, b) =>
-      spec.ordered
-        ? String(a.value.a).localeCompare(String(b.value.a))
-        : a.key.localeCompare(b.key),
-    )
-    .map((row) => row.key)
-}
-function predicate(spec: Spec): IR.BasicExpression<boolean> {
-  const clauses = spec.clauses.map(
-    (clause) =>
-      new IR.Func(clause.kind, [
-        new IR.PropRef([clause.field]),
-        new IR.Value(
-          clause.kind === 'eq' ? clause.values[0] : [...clause.values],
-        ),
-      ]),
-  )
-  if (spec.nested)
-    return new IR.Func('and', [
-      new IR.Func('or', [clauses[0]!, clauses[1]!]),
-      clauses[2]!,
-    ])
-  return clauses.length === 1
-    ? clauses[0]!
-    : new IR.Func(spec.connective, clauses)
-}
-
-function preparedDriver(
-  db: DatabaseSync,
-  attempts: Array<Attempt>,
-  withDriver = false,
-  cap = BINDING_CAP,
-  omitTransactionCap = false,
-  forceControlledCap = false,
-) {
-  let record = false
-  let nextSavepoint = 0
-  const nativeCap = (
-    db as DatabaseSync & { limits?: { variableNumber: number } }
-  ).limits?.variableNumber
-  const controlledCap = forceControlledCap || nativeCap === undefined
-  function checkCapacity(bindings: number): void {
-    if (controlledCap && bindings > cap)
-      throw new RangeError(
-        `host parameter limit exceeded: ${bindings} > ${cap}`,
-      )
-  }
-  const driver: SQLiteDriver & { startObservation: () => void } = {
-    maxBoundParameters: cap,
-    startObservation() {
-      record = true
-    },
-    exec(sql: string): Promise<void> {
-      const attempt: Attempt = { method: 'exec', sql, bindings: 0 }
-      if (record) attempts.push(attempt)
-      try {
-        db.exec(sql)
-        return Promise.resolve()
-      } catch (error) {
-        attempt.error = String(error)
-        return Promise.reject(error)
-      }
-    },
-    query<T>(
-      sql: string,
-      params: ReadonlyArray<unknown> = [],
-    ): Promise<ReadonlyArray<T>> {
-      const attempt: Attempt = { method: 'query', sql, bindings: params.length }
-      if (record) attempts.push(attempt)
-      try {
-        checkCapacity(params.length)
-        return Promise.resolve(
-          db
-            .prepare(sql)
-            .all(
-              ...(params as Array<null | number | bigint | string>),
-            ) as Array<T>,
-        )
-      } catch (error) {
-        attempt.error = String(error)
-        return Promise.reject(error)
-      }
-    },
-    run(sql: string, params: ReadonlyArray<unknown> = []): Promise<void> {
-      const attempt: Attempt = { method: 'run', sql, bindings: params.length }
-      if (record) attempts.push(attempt)
-      try {
-        checkCapacity(params.length)
-        db.prepare(sql).run(
-          ...(params as Array<null | number | bigint | string>),
-        )
-        return Promise.resolve()
-      } catch (error) {
-        attempt.error = String(error)
-        return Promise.reject(error)
-      }
-    },
-    async transaction<T>(
-      fn: (transactionDriver: SQLiteDriver) => Promise<T>,
-    ): Promise<T> {
-      const savepoint = `oracle_${++nextSavepoint}`
-      db.exec(`SAVEPOINT ${savepoint}`)
-      try {
-        const result = await fn(driver)
-        db.exec(`RELEASE ${savepoint}`)
-        return result
-      } catch (error) {
-        db.exec(`ROLLBACK TO ${savepoint}`)
-        db.exec(`RELEASE ${savepoint}`)
-        throw error
-      }
-    },
-  }
-  if (withDriver) {
-    driver.transactionWithDriver = omitTransactionCap
-      ? (fn) =>
-          driver.transaction(() =>
-            fn({
-              exec: driver.exec,
-              query: driver.query,
-              run: driver.run,
-              transaction: driver.transaction,
-            }),
-          )
-      : driver.transaction
-  }
-  return driver
-}
-
-function limitedDatabase(cap = BINDING_CAP): DatabaseSync {
-  // Older Node versions ignore this option; preparedDriver then enforces the cap.
-  const options = { limits: { variableNumber: cap } }
-  const db = new DatabaseSync(
-    ':memory:',
-    options as unknown as NonNullable<
-      ConstructorParameters<typeof DatabaseSync>[1]
-    >,
-  )
-  const nativeCap = (
-    db as DatabaseSync & { limits?: { variableNumber: number } }
-  ).limits?.variableNumber
-  if (nativeCap !== undefined)
-    assert.equal(
-      nativeCap,
-      cap,
-      'SQLite did not apply the requested variable limit',
-    )
-  return db
-}
-
-type Observation = {
-  expected: Array<string>
-  expectedValues: Array<{ key: string; value: Row['value'] }>
-  actual?: Array<string>
-  actualValues?: Array<{ key: string; value: Row['value'] }>
-  attempts: Array<Attempt>
-  error?: string
-  cleanupError?: string
-}
-async function observe(
-  spec: Spec,
-  withDriver = false,
-  cap = BINDING_CAP,
-  omitTransactionCap = false,
-): Promise<Observation> {
-  const db = limitedDatabase(cap)
-  const attempts: Array<Attempt> = []
-  let observation: Observation | undefined
-  try {
-    const driver = preparedDriver(
-      db,
-      attempts,
-      withDriver,
-      cap,
-      omitTransactionCap,
-    )
-    const adapter = new SQLiteCorePersistenceAdapter({ driver })
-    const rows: Array<Row> = spec.rows
-      ? [...spec.rows]
-      : [
-          {
-            key: 'target',
-            value: { a: target(spec.valueKind), b: target(spec.valueKind) },
-          },
-          {
-            key: 'partial',
-            value: {
-              a: target(spec.valueKind),
-              b: miss(spec.valueKind, 10_000),
-            },
-          },
-          {
-            key: 'miss',
-            value: {
-              a: miss(spec.valueKind, 10_001),
-              b: miss(spec.valueKind, 10_002),
-            },
-          },
-        ]
-    const expected = expectedBindingRows(spec, rows)
-    const expectedValues = expected.map((key) => {
-      const row = rows.find((candidate) => candidate.key === key)!
-      return { key, value: row.value }
-    })
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: 'oracle-1993' },
-      {
-        txId: 'seed',
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: rows.map((row) => ({
-          type: 'insert' as const,
-          key: row.key,
-          value: row.value,
-        })),
-      },
-    )
-    driver.startObservation()
-    try {
-      const result = await adapter.loadSubset(
-        { kind: `eager`, collectionId: 'oracle-1993' },
-        {
-          where: predicate(spec),
-          ...(spec.ordered
-            ? {
-                orderBy: [
-                  {
-                    expression: new IR.PropRef(['a']),
-                    compareOptions: {
-                      direction: 'asc' as const,
-                      nulls: 'last' as const,
-                    },
-                  },
-                ],
-              }
-            : {}),
-        },
-      )
-      const actualValues = result.map((row) => ({
-        key: String(row.key),
-        value: row.value as Row['value'],
-      }))
-      if (!spec.ordered) actualValues.sort((a, b) => a.key.localeCompare(b.key))
-      observation = {
-        expected,
-        expectedValues,
-        actual: actualValues.map((row) => row.key),
-        actualValues,
-        attempts,
-      }
-    } catch (error) {
-      observation = { expected, expectedValues, attempts, error: String(error) }
-    }
-  } finally {
-    try {
-      db.close()
-    } catch (cleanupError) {
-      observation ??= {
-        expected: [],
-        expectedValues: [],
-        attempts,
-        error: 'setup failed',
-      }
-      observation.cleanupError = String(cleanupError)
-    }
-  }
-  return observation
-}
-
-type Violation = {
-  kind: 'reach' | 'capacity' | 'error' | 'rows' | 'cleanup'
-  checkpoint: string
-  message: string
-}
-function violation(
-  spec: Spec,
-  observation: Observation,
-  cap = BINDING_CAP,
-): Violation | undefined {
-  const predicateSelects = observation.attempts.filter(
-    (entry) =>
-      entry.method === 'query' &&
-      entry.sql.startsWith('SELECT key, value, metadata, row_version'),
-  )
-  if (predicateSelects.length !== 1)
-    return {
-      kind: 'reach',
-      checkpoint: 'driver-query',
-      message: `predicate SELECT reach=${predicateSelects.length}`,
-    }
-  const over = observation.attempts.filter((entry) => entry.bindings > cap)
-  if (over.length)
-    return {
-      kind: 'capacity',
-      checkpoint: over.some((entry) => predicateSelects.includes(entry))
-        ? 'predicate-select'
-        : 'other-statement',
-      message: `binding cap exceeded: ${over.map((entry) => entry.bindings)}; error=${observation.error ?? 'none'}`,
-    }
-  if (observation.error)
-    return {
-      kind: 'error',
-      checkpoint: 'loadSubset-settlement',
-      message: `loadSubset rejected ${observation.error}`,
-    }
-  try {
-    assert.deepEqual(observation.actual, observation.expected)
-    assert.deepEqual(observation.actualValues, observation.expectedValues)
-  } catch {
-    return {
-      kind: 'rows',
-      checkpoint: 'loadSubset-fulfillment',
-      message: `rows ${inspect(observation.actualValues)} != ${inspect(observation.expectedValues)}`,
-    }
-  }
-  if (observation.cleanupError)
-    return {
-      kind: 'cleanup',
-      checkpoint: 'cleanup',
-      message: `cleanup failed: ${observation.cleanupError}`,
-    }
-  return undefined
-}
-
-function single(kind: Kind, count: number): Spec {
-  return {
-    label: `single-${kind}-${count}`,
-    valueKind: kind,
-    connective: 'or',
-    clauses: [{ field: 'a', kind: 'in', values: values(kind, count) }],
-  }
-}
-function dual(
-  kind: Kind,
-  a: number,
-  b: number,
-  connective: 'and' | 'or',
-): Spec {
-  return {
-    label: `dual-${kind}-${a}-${b}-${connective}`,
-    valueKind: kind,
-    connective,
-    clauses: [
-      { field: 'a', kind: 'in', values: values(kind, a) },
-      { field: 'b', kind: 'in', values: values(kind, b) },
-    ],
-  }
-}
-function mixed(kind: Kind, count: number): Spec {
-  return {
-    label: `mixed-${kind}-${count}+1`,
-    valueKind: kind,
-    connective: 'and',
-    clauses: [
-      { field: 'a', kind: 'in', values: values(kind, count) },
-      { field: 'b', kind: 'eq', values: [target(kind)] },
-    ],
-  }
-}
-function nested(kind: Kind, a: number, b: number): Spec {
-  return {
-    label: `nested-${kind}-${a}-${b}+1`,
-    valueKind: kind,
-    connective: 'and',
-    nested: true,
-    clauses: [
-      { field: 'a', kind: 'in', values: values(kind, a) },
-      { field: 'b', kind: 'in', values: values(kind, b) },
-      { field: 'b', kind: 'eq', values: [target(kind)] },
-    ],
-  }
-}
-function chunkBoundary(): Spec {
-  const list = Array.from({ length: 1200 }, (_, i) => `miss-${i}`)
-  list[100] = 'early'
-  list[1100] = 'late'
-  return {
-    label: 'two-hits-across-900',
-    valueKind: 'string',
-    connective: 'or',
-    ordered: true,
-    clauses: [{ field: 'a', kind: 'in', values: list }],
-    rows: [
-      { key: 'late', value: { a: 'late', b: 'none' } },
-      { key: 'miss', value: { a: 'other', b: 'none' } },
-      { key: 'early', value: { a: 'early', b: 'none' } },
-    ],
-  }
-}
-function escapedStringCase(): Spec {
-  const escaped = `quote' newline\n snowman☃ null\u0000`
-  return {
-    label: `escaped-string-list`,
-    valueKind: `string`,
-    connective: `or`,
-    clauses: [{ field: `a`, kind: `in`, values: [escaped, `different`] }],
-    rows: [
-      { key: `target`, value: { a: escaped, b: `other` } },
-      { key: `miss`, value: { a: `another`, b: `other` } },
-    ],
-  }
-}
-function bigintBoundary(value: bigint, label: string): Spec {
-  return {
-    label,
-    valueKind: 'bigint',
-    connective: 'or',
-    clauses: [{ field: 'a', kind: 'in', values: [value] }],
-    rows: [
-      { key: 'target', value: { a: value, b: value } },
-      { key: 'miss', value: { a: 0n, b: 0n } },
-    ],
-  }
-}
-function legalSpec(spec: Spec): boolean {
-  return (
-    spec.clauses.length >= 1 &&
-    spec.clauses.length <= 3 &&
-    (!spec.nested || spec.clauses.length === 3) &&
-    spec.clauses.every(
-      (clause) => clause.kind === 'in' || clause.values.length === 1,
-    )
-  )
-}
 
 const fixed: Array<Spec> = [
   single('string', 0),
@@ -4128,165 +892,11 @@ const generated = fc.oneof(
     .map(([kind, a, b]) => nested(kind, a, b)),
 )
 
-async function runIndexContext() {
-  const db = limitedDatabase()
-  const attempts: Array<Attempt> = []
-  try {
-    const driver = preparedDriver(db, attempts)
-    const adapter = new SQLiteCorePersistenceAdapter({ driver })
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: 'oracle-index' },
-      {
-        txId: 'seed',
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [
-          {
-            type: 'insert',
-            key: 'target',
-            value: { a: 'target', b: 'target' },
-          },
-        ],
-      },
-    )
-    driver.startObservation()
-    await adapter.ensureIndex(
-      { kind: `eager`, collectionId: 'oracle-index' },
-      'small-in-partial',
-      {
-        expressionSql: [JSON.stringify({ type: 'ref', path: ['a'] })],
-        whereSql: JSON.stringify({
-          type: 'func',
-          name: 'in',
-          args: [
-            { type: 'ref', path: ['b'] },
-            { type: 'val', value: ['target', 'other'] },
-          ],
-        }),
-      },
-    )
-    await adapter.ensureIndex(
-      { kind: `eager`, collectionId: 'oracle-index' },
-      'small-in-expression',
-      {
-        expressionSql: [
-          JSON.stringify({
-            type: 'func',
-            name: 'in',
-            args: [
-              { type: 'ref', path: ['a'] },
-              { type: 'val', value: ['target', 'other'] },
-            ],
-          }),
-        ],
-      },
-    )
-    const ddl = attempts.filter(
-      (entry) => entry.method === 'exec' && entry.sql.includes('CREATE INDEX'),
-    )
-    assert.equal(ddl.length, 2, 'both index-definition paths reached')
-    for (const entry of ddl) {
-      assert.ok(
-        !entry.sql.includes('json_each') && !entry.sql.includes('?'),
-        'index DDL must use literal values',
-      )
-      assert.ok(entry.sql.includes(`'target'`) && entry.sql.includes(`'other'`))
-    }
-  } finally {
-    db.close()
-  }
-}
-
-async function runCursorContext(): Promise<string | undefined> {
-  const db = limitedDatabase()
-  const attempts: Array<Attempt> = []
-  let error: string | undefined
-  let actual: Array<string> | undefined
-  try {
-    const driver = preparedDriver(db, attempts, true)
-    const adapter = new SQLiteCorePersistenceAdapter({ driver })
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: 'oracle-cursor' },
-      {
-        txId: 'seed',
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [
-          {
-            type: 'insert',
-            key: 'target',
-            value: { a: 'target', b: 'target' },
-          },
-        ],
-      },
-    )
-    driver.startObservation()
-    try {
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: 'oracle-cursor' },
-        {
-          where: predicate(single('string', 999)),
-          cursor: {
-            whereCurrent: new IR.Func('eq', [
-              new IR.PropRef(['a']),
-              new IR.Value('target'),
-            ]),
-            whereFrom: new IR.Func('eq', [
-              new IR.PropRef(['b']),
-              new IR.Value('target'),
-            ]),
-          },
-        },
-      )
-      actual = rows.map((row) => String(row.key))
-    } catch (cause) {
-      error = String(cause)
-    }
-  } finally {
-    db.close()
-  }
-  const reads = attempts.filter(
-    (entry) =>
-      entry.method === 'query' &&
-      entry.sql.startsWith('SELECT key, value, metadata, row_version'),
-  )
-  const counts = reads.map((entry) => entry.bindings)
-  const problem =
-    reads.length !== 2
-      ? `expected two cursor SELECTs, got ${reads.length}`
-      : counts.some((count) => count > BINDING_CAP)
-        ? `two cursor SELECTs bind=${counts}; error=${error ?? 'none'}`
-        : error
-          ? `cursor load rejected ${error}`
-          : actual?.join(',') !== 'target'
-            ? `cursor rows=${actual}`
-            : undefined
-  return problem
-}
-
 const BINDING_PROPERTY = `sqlite-persistence.binding-capacity`
 const bindingFixedIt = oracleReplayTest(it)
 
 export function runSQLiteBindingCapacityOracleSuite(): void {
   describe(`SQLite subset binding-capacity oracle`, () => {
-    bindingFixedIt(
-      `rejects over-cap bindings at the controlled driver boundary`,
-      async () => {
-        const db = limitedDatabase(100)
-        try {
-          const driver = preparedDriver(db, [], false, 100, false, true)
-          const sql = `SELECT ${Array(101).fill('?').join(' + ')}`
-          await expect(driver.query(sql, Array(101).fill(1))).rejects.toThrow(
-            /host parameter limit exceeded: 101 > 100/,
-          )
-        } finally {
-          db.close()
-        }
-      },
-    )
-
     bindingFixedIt(
       `returns exact rows at single-list, statement-total, and typed boundaries`,
       async () => {
@@ -4349,10 +959,6 @@ export function runSQLiteBindingCapacityOracleSuite(): void {
       },
     )
 
-    bindingFixedIt(`honors total capacity in each cursor SELECT`, async () => {
-      expect(await runCursorContext()).toBeUndefined()
-    })
-
     bindingFixedIt(
       `never submits an over-capacity statement with many scalar predicates`,
       async () => {
@@ -4376,13 +982,6 @@ export function runSQLiteBindingCapacityOracleSuite(): void {
       },
     )
 
-    bindingFixedIt(
-      `keeps IN values literal in both index-definition contexts`,
-      async () => {
-        await runIndexContext()
-      },
-    )
-
     async function campaign(
       label: string,
       parameters: { numRuns: number; seed?: number; path?: string },
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-support.ts b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-support.ts
new file mode 100644
index 0000000000..722811097f
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-core-adapter-support.ts
@@ -0,0 +1,225 @@
+/**
+ * Harness support for the SQLite core adapter tests. It holds the sqlite3 CLI
+ * driver and the adapter harness that the shared contract suite and the oracle
+ * file both construct. It is an ordinary module: it registers no tests.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { execFile } from 'node:child_process'
+import { copyFileSync, existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { SQLiteCorePersistenceAdapter } from '../src'
+import type {
+  PersistedStorageTarget,
+  PersistenceAdapter,
+  SQLiteDriver,
+  SQLitePullSinceResult,
+} from '../src'
+
+export type Todo = {
+  id: string
+  title: string
+  createdAt: string
+  score: number
+}
+
+const execFileAsync = promisify(execFile)
+
+function toSqlLiteral(value: unknown): string {
+  if (value === null || value === undefined) {
+    return `NULL`
+  }
+
+  if (typeof value === `number`) {
+    return Number.isFinite(value) ? String(value) : `NULL`
+  }
+
+  if (typeof value === `boolean`) {
+    return value ? `1` : `0`
+  }
+
+  if (typeof value === `bigint`) {
+    return value.toString()
+  }
+
+  const textValue = typeof value === `string` ? value : String(value)
+  return `'${textValue.replace(/'/g, `''`)}'`
+}
+
+function interpolateSql(sql: string, params: ReadonlyArray<unknown>): string {
+  let parameterIndex = 0
+  const renderedSql = sql.replace(/\?/g, () => {
+    const currentParam = params[parameterIndex]
+    parameterIndex++
+    return toSqlLiteral(currentParam)
+  })
+
+  if (parameterIndex !== params.length) {
+    throw new Error(
+      `SQL interpolation mismatch: used ${parameterIndex} params, received ${params.length}`,
+    )
+  }
+
+  return renderedSql
+}
+
+export class SqliteCliDriver implements SQLiteDriver {
+  private readonly transactionDbPath = new AsyncLocalStorage<string>()
+  private queue: Promise<void> = Promise.resolve()
+
+  constructor(private readonly dbPath: string) {}
+
+  async exec(sql: string): Promise<void> {
+    const activeDbPath = this.transactionDbPath.getStore()
+    if (activeDbPath) {
+      await execFileAsync(`sqlite3`, [activeDbPath, sql])
+      return
+    }
+
+    await this.enqueue(async () => {
+      await execFileAsync(`sqlite3`, [this.dbPath, sql])
+    })
+  }
+
+  async query<T>(
+    sql: string,
+    params?: ReadonlyArray<unknown>,
+  ): Promise<ReadonlyArray<T>> {
+    const activeDbPath = this.transactionDbPath.getStore()
+    const renderedSql = interpolateSql(sql, params ?? [])
+    const queryActiveDbPath = activeDbPath ?? this.dbPath
+
+    const runQuery = async () => {
+      const { stdout } = await execFileAsync(`sqlite3`, [
+        `-json`,
+        queryActiveDbPath,
+        ...(renderedSql.trimStart().startsWith(`EXPLAIN QUERY PLAN`)
+          ? [`.explain off`]
+          : []),
+        renderedSql,
+      ])
+      const trimmedOutput = stdout.trim()
+      if (!trimmedOutput) {
+        return []
+      }
+      return JSON.parse(trimmedOutput) as Array<T>
+    }
+
+    if (activeDbPath) {
+      return runQuery()
+    }
+
+    return this.enqueue(async () => runQuery())
+  }
+
+  async run(sql: string, params?: ReadonlyArray<unknown>): Promise<void> {
+    const activeDbPath = this.transactionDbPath.getStore()
+    const renderedSql = interpolateSql(sql, params ?? [])
+    const runActiveDbPath = activeDbPath ?? this.dbPath
+
+    if (activeDbPath) {
+      await execFileAsync(`sqlite3`, [runActiveDbPath, renderedSql])
+      return
+    }
+
+    await this.enqueue(async () => {
+      await execFileAsync(`sqlite3`, [runActiveDbPath, renderedSql])
+    })
+  }
+
+  async transaction<T>(
+    fn: (transactionDriver: SQLiteDriver) => Promise<T>,
+  ): Promise<T> {
+    if (fn.length === 0) {
+      throw new Error(
+        `SQLiteDriver.transaction callback must accept the transaction driver argument`,
+      )
+    }
+
+    const activeDbPath = this.transactionDbPath.getStore()
+    if (activeDbPath) {
+      return fn(this)
+    }
+
+    return this.enqueue(async () => {
+      const txDirectory = mkdtempSync(join(tmpdir(), `db-sqlite-core-tx-`))
+      const txDbPath = join(txDirectory, `state.sqlite`)
+
+      if (existsSync(this.dbPath)) {
+        copyFileSync(this.dbPath, txDbPath)
+      }
+
+      try {
+        const txResult = await this.transactionDbPath.run(txDbPath, async () =>
+          fn(this),
+        )
+
+        if (existsSync(txDbPath)) {
+          copyFileSync(txDbPath, this.dbPath)
+        }
+        return txResult
+      } finally {
+        rmSync(txDirectory, { recursive: true, force: true })
+      }
+    })
+  }
+
+  private enqueue<T>(operation: () => Promise<T>): Promise<T> {
+    const queuedOperation = this.queue.then(operation, operation)
+    this.queue = queuedOperation.then(
+      () => undefined,
+      () => undefined,
+    )
+    return queuedOperation
+  }
+}
+
+type AdapterHarness = {
+  adapter: SQLiteCorePersistenceAdapter
+  driver: SqliteCliDriver
+  dbPath: string
+  cleanup: () => void | Promise<void>
+}
+
+export type SQLiteCoreAdapterContractHarness = {
+  adapter: PersistenceAdapter & {
+    pullSince: (
+      target: PersistedStorageTarget,
+      fromRowVersion: number,
+    ) => Promise<SQLitePullSinceResult<string | number>>
+  }
+  driver: SQLiteDriver
+  cleanup: () => void | Promise<void>
+}
+
+export function createHarness(
+  options?: Omit<
+    ConstructorParameters<typeof SQLiteCorePersistenceAdapter>[0],
+    `driver`
+  >,
+): AdapterHarness {
+  const tempDirectory = mkdtempSync(join(tmpdir(), `db-sqlite-core-`))
+  const dbPath = join(tempDirectory, `state.sqlite`)
+  const driver = new SqliteCliDriver(dbPath)
+  const adapter = new SQLiteCorePersistenceAdapter({
+    driver,
+    ...options,
+  })
+
+  return {
+    adapter,
+    driver,
+    dbPath,
+    cleanup: () => {
+      rmSync(tempDirectory, { recursive: true, force: true })
+    },
+  }
+}
+
+export type SQLiteCoreAdapterHarnessFactory = (
+  options?: Omit<
+    ConstructorParameters<typeof SQLiteCorePersistenceAdapter>[0],
+    `driver`
+  >,
+) => SQLiteCoreAdapterContractHarness
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-oracle.test.ts
index 8605d3b5f4..70b2c4dfc8 100644
--- a/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-oracle.test.ts
@@ -1,8 +1,9 @@
 import { DatabaseSync } from 'node:sqlite'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { describe, expect, it, vi } from 'vitest'
-import { BasicIndex, createCollection, whenSyncAccepted } from '@tanstack/db'
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '@tanstack/db'
 import { oraclePropertyOptions, oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import {
   SQLiteCorePersistenceAdapter,
   createPersistedTableName,
@@ -10,1333 +11,164 @@ import {
   persistedCollectionOptions,
 } from '../src'
 import { runOrdinaryTransactionWorkOracle } from './ordinary-transaction-work-oracle'
+import {
+  closeDatabasePreservingPrimary,
+  createDriver,
+  deferred,
+  expectStartupRows,
+  reachCheckpoint,
+} from './sqlite-resume-snapshot-support'
 import type { SQLiteDriver } from '../src'
-import type { Collection, SyncConfig } from '@tanstack/db'
-
-type CachedSchemaState = {
-  schemaVersion: number
-  resetEpoch: number
-  rows: Array<{ key: string | number; value: Record<string, unknown> }>
-  metadata: Array<{ key: string; value: unknown }>
-  appliedTransactions: Array<{
-    term: number
-    seq: number
-    txId: string
-    rowVersion: number
-  }>
-  keyEvidence: {
-    available: number
-    incompatible: number
-    expectedKeys: Array<string>
-  }
-}
-
-function toBinding(value: unknown): string | number | bigint | null {
-  if (value === null || value === undefined) return null
-  if (typeof value === `boolean`) return value ? 1 : 0
-  if (
-    typeof value === `string` ||
-    typeof value === `number` ||
-    typeof value === `bigint`
-  ) {
-    return value
-  }
-  return String(value)
-}
-
-/** In-memory SQLite driver with optional statement observation and write failure. */
-function createDriver(
-  database: DatabaseSync,
-  failTransactionRun?: (sql: string) => boolean,
-  observeQuery?: (sql: string) => void,
-  observeRun?: (sql: string, params: ReadonlyArray<unknown>) => void,
-): SQLiteDriver {
-  const driver: SQLiteDriver = {
-    exec: (sql) => {
-      database.exec(sql)
-      return Promise.resolve()
-    },
-    query: (sql, params = []) => {
-      observeQuery?.(sql)
-      return Promise.resolve(
-        database
-          .prepare(sql)
-          .all(...params.map(toBinding))
-          .map((row) => ({ ...row })) as Array<never>,
-      )
-    },
-    run: (sql, params = []) => {
-      observeRun?.(sql, params)
-      database.prepare(sql).run(...params.map(toBinding))
-      return Promise.resolve()
-    },
-    transaction: async (transaction) => {
-      database.exec(`BEGIN IMMEDIATE`)
-      try {
-        const transactionDriver: SQLiteDriver = {
-          ...driver,
-          run: (sql, params) =>
-            failTransactionRun?.(sql)
-              ? Promise.reject(new Error(`injected transaction failure`))
-              : driver.run(sql, params),
-        }
-        const result = await transaction(transactionDriver)
-        database.exec(`COMMIT`)
-        return result
-      } catch (error) {
-        database.exec(`ROLLBACK`)
-        throw error
-      }
-    },
-  }
-  return driver
-}
-
-function deferred() {
-  let resolve!: () => void
-  const promise = new Promise<void>((complete) => {
-    resolve = complete
-  })
-  return { promise, resolve }
-}
-
-async function reachCheckpoint(
-  promise: Promise<void>,
-  checkpoint: string,
-  timeoutMs = 1_000,
-): Promise<void> {
-  let timer: ReturnType<typeof setTimeout> | undefined
-  try {
-    await Promise.race([
-      promise,
-      new Promise<never>((_, reject) => {
-        timer = setTimeout(
-          () => reject(new Error(`Did not reach checkpoint: ${checkpoint}`)),
-          timeoutMs,
-        )
-      }),
-    ])
-  } finally {
-    if (timer !== undefined) clearTimeout(timer)
-  }
-}
-
-function closeDatabasePreservingPrimary(
-  database: DatabaseSync,
-  primaryFailure: unknown,
-  secondaryFailures: ReadonlyArray<unknown> = [],
-): never | void {
-  let cleanupFailure: unknown
-  try {
-    database.close()
-  } catch (error) {
-    cleanupFailure = error
-  }
-
-  if (primaryFailure !== undefined) {
-    const failure =
-      primaryFailure instanceof Error
-        ? primaryFailure
-        : new Error(`SQLite resume snapshot failed`, { cause: primaryFailure })
-    const cleanupFailures = [
-      ...secondaryFailures,
-      ...(cleanupFailure !== undefined ? [cleanupFailure] : []),
-    ]
-    if (cleanupFailures.length > 0) {
-      Object.defineProperty(failure, `cleanupFailures`, {
-        value: cleanupFailures,
-        enumerable: true,
-      })
-    }
-    throw failure
-  }
-  if (secondaryFailures.length === 0 && cleanupFailure !== undefined) {
-    throw cleanupFailure
-  }
-  if (secondaryFailures.length > 0) {
-    throw new AggregateError(
-      [
-        ...secondaryFailures,
-        ...(cleanupFailure !== undefined ? [cleanupFailure] : []),
-      ],
-      `SQLite resume snapshot cleanup failed`,
-    )
-  }
-}
-
-async function observeCachedSchemaState(
-  adapter: SQLiteCorePersistenceAdapter,
-  driver: SQLiteDriver,
-  collectionId: string,
-): Promise<CachedSchemaState> {
-  const snapshot = await adapter.loadResumeSnapshot({
-    kind: `eager`,
-    collectionId: collectionId,
-  })
-  const registryRows = await driver.query<{ schema_version: number }>(
-    `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
-    [collectionId],
-  )
-  const versionRows = await driver.query<{
-    key_set_evidence_available: number
-    key_set_evidence_incompatible: number
-  }>(
-    `SELECT key_set_evidence_available, key_set_evidence_incompatible
-     FROM collection_version
-     WHERE collection_id = ?`,
-    [collectionId],
-  )
-  const expectedKeys = await driver.query<{ key: string }>(
-    `SELECT key
-     FROM collection_expected_keys
-     WHERE collection_id = ?
-     ORDER BY key`,
-    [collectionId],
-  )
-  const appliedTransactions = await driver.query<{
-    term: number
-    seq: number
-    tx_id: string
-    row_version: number
-  }>(
-    `SELECT term, seq, tx_id, row_version
-     FROM applied_tx
-     WHERE collection_id = ?
-     ORDER BY term, seq`,
-    [collectionId],
-  )
-
-  return {
-    schemaVersion: registryRows[0]?.schema_version ?? -1,
-    resetEpoch: snapshot.resetEpoch,
-    rows: snapshot.rows
-      .map(({ key, value }) => ({ key, value }))
-      .sort((left, right) => String(left.key).localeCompare(String(right.key))),
-    metadata: snapshot.collectionMetadata.sort((left, right) =>
-      left.key.localeCompare(right.key),
-    ),
-    appliedTransactions: appliedTransactions.map(
-      ({ term, seq, tx_id, row_version }) => ({
-        term,
-        seq,
-        txId: tx_id,
-        rowVersion: row_version,
-      }),
-    ),
-    keyEvidence: {
-      available: versionRows[0]?.key_set_evidence_available ?? -1,
-      incompatible: versionRows[0]?.key_set_evidence_incompatible ?? -1,
-      expectedKeys: expectedKeys.map(({ key }) => key),
-    },
-  }
-}
+import type { Collection } from '@tanstack/db'
 
-/**
- * # Which generation does a SQLite resume snapshot certify?
- *
- * `loadResumeSnapshot` must return rows, collection metadata, applied position,
- * reset epoch, and key-set evidence from one atomic persisted generation. Raw
- * key loss makes that evidence incompatible until a full replacement establishes
- * a new baseline; concurrent schema migration may advance but never downgrade or
- * repeat the observed generation. These laws refine the shared persistence and
- * schema-mismatch contracts exercised by sqlite-core-adapter-oracle.test.ts.
- * A managed cache claim must still be live inside the read transaction before
- * any generation-specific durable access. A claim expires at its expiry time;
- * a later-acquired live peer claim does not inherit the earlier claim's expiry.
- *
- * `CachedSchemaState` is the independent projection: complete rows and metadata,
- * transaction position, schema/reset lineage, and expected keys. The history
- * grammar crosses external row loss, full replacement, two legacy-schema
- * adapters, stale reads, newer-schema observation, and a cached writer racing a
- * reset. Expected membership and lineage come from the declared transition, not
- * from the adapter's SQL or internal branch structure.
- *
- * The production driver runs two real `SQLiteCorePersistenceAdapter` instances
- * over one node:sqlite database and holds the exact transaction or snapshot
- * boundary needed for each interleaving. At the settled snapshot checkpoint it
- * compares the entire projected schema state; the held boundary and reset epoch
- * are reach witnesses, while compatible reopen and recertifying truncate cases
- * prevent an oracle that merely rejects every resume.
- * A separate generated startup lane holds the runtime between its metadata and
- * hydration snapshots, then crosses no write, a managed public insert, and a
- * hostile raw deletion over one-to-three baseline rows. Its independent model
- * preserves every managed row but fails closed for unsupported raw loss.
- * The focused work law first executes one controlled expected-key table read to
- * prove its SQL observer can detect the forbidden membership work, then resets
- * the counters before measuring the public position and snapshot operations.
- * A second value-and-work law applies a 205-row full replacement through
- * `applyCommittedTx`. It compares exact durable rows, row metadata, key evidence,
- * resume metadata, and applied position after return while bounding driver
- * query/run calls. A later-batch fault must roll the whole replacement back.
- * Duplicate-key and delete histories retain their ordered sequential meaning.
- *
- * Known omissions: this narrow fixture supplies the same-connection
- * concurrency seam that the serialized copy-on-commit CLI harness cannot. It
- * uses a controlled clock and one shared real SQLite connection for claim races.
- * It does not claim native host execution or judge whether a consumer such as
- * Electric may use the certified cursor; those remain separate driver-contract
- * and Electric recovery owners. The work bound is a driver-call measure in
- * node:sqlite, not an elapsed-time or browser OPFS latency guarantee.
- */
 describe(`SQLite resume snapshots`, () => {
-  // Claim expiry is a real SQLite boundary, while source-session restart is a
-  // wrapper obligation. This receiving history joins them: after an expired
-  // claim, a custom on-demand source without a provider hook is reentered.
-  // The old callback cannot publish or durably write into the new physical
-  // cache. Public rows and a claimed SQLite read are checked after demand.
-  it(`restarts a custom source after a real SQLite cache claim expires`, async () => {
-    type Row = { id: string; title: string }
-    const database = new DatabaseSync(`:memory:`)
-    const logicalId = `custom-expired-cache`
-    let now = 1_000
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver: createDriver(database),
-      cacheGenerationClaimTtlMs: 300_000,
-      now: () => now,
-    })
-    const sessions: Array<Parameters<SyncConfig<Row, string>[`sync`]>[0]> = []
-    let cleanups = 0
-    const collection = createCollection(
-      persistedCollectionOptions<Row, string>({
-        id: logicalId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            const session = sessions.push(params)
-            params.markReady()
-            return {
-              cleanup: () => {
-                cleanups++
-              },
-              loadSubset: async () => {
-                params.begin()
-                params.write({
-                  type: `update`,
-                  value: { id: `row-${session}`, title: `Session ${session}` },
-                })
-                await whenSyncAccepted(params.commit())
-              },
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    let primaryFailure: unknown
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await collection._sync.loadSubset({ limit: 1 })
-      expect(collection.get(`row-1`)).toMatchObject({ id: `row-1` })
-      const oldClaim = database
-        .prepare(
-          `SELECT claim_id, physical_id FROM cache_generation_claim
-           WHERE logical_id = ? AND expires_at_ms > ?`,
-        )
-        .get(logicalId, now) as { claim_id: string; physical_id: string }
-
-      now += 300_001
-      await collection._sync.loadSubset({ limit: 2 })
-      expect(sessions).toHaveLength(2)
-      expect(cleanups).toBe(1)
-      expect(collection.get(`row-1`)).toBeUndefined()
-      expect(collection.get(`row-2`)).toMatchObject({ id: `row-2` })
-      const newClaim = database
-        .prepare(
-          `SELECT claim_id, physical_id FROM cache_generation_claim
-           WHERE logical_id = ? AND expires_at_ms > ?`,
-        )
-        .get(logicalId, now) as { claim_id: string; physical_id: string }
-      expect(newClaim.physical_id).not.toBe(oldClaim.physical_id)
-
-      sessions[0]!.begin()
-      sessions[0]!.write({
-        type: `update`,
-        value: { id: `late-old`, title: `Retired session` },
-      })
-      await sessions[0]!.commit()
-      expect(collection.get(`late-old`)).toBeUndefined()
-      const durable = await adapter.loadSubset(
-        {
-          kind: `managed`,
-          storageCollectionId: newClaim.physical_id,
-          claimId: newClaim.claim_id,
-        },
-        {},
-        { cacheGenerationClaimId: newClaim.claim_id },
-      )
-      expect(durable.map(({ key }) => key).sort()).toEqual([`row-2`])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      await collection.cleanup()
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // A storage target states whether the caller owns an eager Collection or a
-  // claimed cache generation. The independent rule is simple: collection of a
-  // generation ends that claim's authority, so its target cannot read or write
-  // even after SQLite removes the catalog row that identified the physical ID.
-  // The same string may still name an eager Collection when the caller chooses
-  // that target explicitly. This fixed history drives real SQLite through
-  // claim, write, rotation, collection, and late adapter operations. At
-  // each rejected-operation checkpoint, no old table or registry may reappear.
-  it(`keeps a collected managed target from becoming eager storage`, async () => {
+  // Retired storage is reachable from live cache claims; the current head is
+  // always reachable even after its last claim expires. The independent model
+  // treats release as removal and expiry as a half-open time cut. A collection
+  // operation is the GC checkpoint: wall-clock passage alone does no SQLite
+  // work. The bounded grammar makes three generations, varies zero/two rows,
+  // and independently releases, expires, or renews claims on both retired
+  // generations. Cuts immediately before and at each renewed expiry enforce
+  // half-open claim lifetimes. It excludes concurrent writes and a fourth
+  // rotation. The comparison checks exact retained row, tombstone, resume,
+  // and key contents; physical tables and native indexes; every
+  // generation-scoped catalog; and surviving claim identities.
+  type RetiredStorageHistory = {
+    oldClaim: `release` | `expire` | `renew`
+    middleClaim: `release` | `expire` | `renew`
+    rowCount: 0 | 2
+    checkAtMs: 1_170 | 1_190 | 1_209 | 1_210 | 1_229 | 1_230
+  }
+  const expectedRetainedGenerations = (
+    history: RetiredStorageHistory,
+  ): ReadonlyArray<number> => [
+    ...(history.oldClaim === `renew` && history.checkAtMs < 1_210 ? [0] : []),
+    ...(history.middleClaim === `renew` && history.checkAtMs < 1_230
+      ? [1]
+      : []),
+    2,
+  ]
+  const assertRetiredStorageHistory = async (
+    history: RetiredStorageHistory,
+  ): Promise<void> => {
     const database = new DatabaseSync(`:memory:`)
     let primaryFailure: unknown
+    let now = 1_000
     try {
       const adapter = new SQLiteCorePersistenceAdapter({
         driver: createDriver(database),
+        cacheGenerationClaimTtlMs: 100,
+        now: () => now,
       })
-      const claim = await adapter.claimCacheGeneration(
-        `target-after-collection`,
-      )
-      const managed = {
-        kind: `managed` as const,
-        storageCollectionId: claim.storageCollectionId,
-        claimId: claim.claimId,
-      }
-      const oldTable = createPersistedTableName(claim.storageCollectionId, `c`)
-      const oldTombstones = createPersistedTableName(
-        claim.storageCollectionId,
-        `t`,
-      )
-      const footprint = () => {
-        const catalog = [
-          `collection_registry`,
-          `persisted_index_registry`,
-          `applied_tx`,
-          `collection_version`,
-          `collection_expected_keys`,
-          `collection_metadata`,
-          `leader_term`,
-          `collection_reset_epoch`,
-        ]
-        return {
-          tables: database
-            .prepare(
-              `SELECT name FROM sqlite_master WHERE name IN (?, ?) ORDER BY name`,
-            )
-            .all(oldTable, oldTombstones),
-          catalog: catalog.map((table) => ({
-            table,
-            count: (
-              database
-                .prepare(
-                  `SELECT COUNT(*) AS count FROM ${table} WHERE collection_id = ?`,
-                )
-                .get(claim.storageCollectionId) as { count: number }
-            ).count,
-          })),
-          generations: database
-            .prepare(`SELECT * FROM cache_generation WHERE physical_id = ?`)
-            .all(claim.storageCollectionId),
-          claims: database
-            .prepare(
-              `SELECT * FROM cache_generation_claim WHERE physical_id = ?`,
-            )
-            .all(claim.storageCollectionId),
-        }
-      }
-      await adapter.applyCommittedTx(managed, {
-        txId: `seed`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [{ type: `insert`, key: `seed`, value: { id: `seed` } }],
-      })
-      expect((await adapter.loadResumeSnapshot(managed)).rows).toMatchObject([
-        { key: `seed`, value: { id: `seed` } },
-      ])
-      await adapter.rotateCacheGeneration(
-        `target-after-collection`,
-        claim.claimId,
-      )
-
-      const collectedFootprint = footprint()
-      expect(collectedFootprint.tables).toEqual([])
-      expect(collectedFootprint.catalog.every(({ count }) => count === 0)).toBe(
-        true,
-      )
-      expect(collectedFootprint.generations).toEqual([])
-      expect(collectedFootprint.claims).toEqual([])
-      // A JavaScript caller can still pass an old bare ID. It must not be
-      // silently promoted to an eager target after the catalog row is gone.
-      await expect(
-        adapter.loadResumeSnapshot(claim.storageCollectionId as never),
-      ).rejects.toThrow(`explicit eager or managed storage target`)
-      await expect(
-        adapter.applyCommittedTx(claim.storageCollectionId as never, {
-          txId: `bare-late`,
-          term: 2,
-          seq: 1,
-          rowVersion: 2,
-          mutations: [{ type: `insert`, key: `bare`, value: { id: `bare` } }],
-        }),
-      ).rejects.toThrow(`explicit eager or managed storage target`)
-      await expect(
-        adapter.loadResumeSnapshot(`ordinary-bare-id` as never),
-      ).rejects.toThrow(`explicit eager or managed storage target`)
-      await expect(
-        adapter.applyCommittedTx(`ordinary-bare-id` as never, {
-          txId: `ordinary-bare`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [],
-        }),
-      ).rejects.toThrow(`explicit eager or managed storage target`)
-      await expect(
-        adapter.loadResumeSnapshot({
-          kind: `managed`,
-          storageCollectionId: claim.storageCollectionId,
-        } as never),
-      ).rejects.toThrow(
-        `requires a storageCollectionId and persisted cache claim`,
-      )
-      await expect(
-        adapter.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: claim.storageCollectionId,
-          claimId: claim.claimId,
-        } as never),
-      ).rejects.toThrow(`cannot carry a persisted cache claim`)
-      const lateTx = {
-        txId: `late`,
-        term: 2,
-        seq: 1,
-        rowVersion: 2,
-        mutations: [
-          { type: `insert` as const, key: `late`, value: { id: `late` } },
-        ],
-      }
-      const lateOperations: Array<() => Promise<unknown>> = [
-        () => adapter.loadSubset(managed, {}),
-        () => adapter.loadResumeSnapshot(managed),
-        () => adapter.loadCollectionMetadata(managed),
-        () => adapter.scanRows(managed),
-        () => adapter.getStreamPosition(managed),
-        () => adapter.pullSince(managed, 0),
-        () => adapter.applyCommittedTx(managed, lateTx),
-        () =>
-          adapter.reconcileCommittedTx(managed, lateTx, {
-            latestRowVersion: 1,
-            resetEpoch: 0,
-          }),
-        () =>
-          adapter.ensureIndex(managed, `late-index`, {
-            expressionSql: [`json_extract(value, '$.id')`],
-          }),
-        () => adapter.markIndexRemoved(managed, `late-index`),
-        () => adapter.reserveLeadershipTerm(managed, 1),
-      ]
-      for (const operation of lateOperations) {
-        await expect(operation()).rejects.toThrow(`no longer active`)
-        expect(footprint()).toEqual(collectedFootprint)
-      }
-      const reopened = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
-      })
-      await expect(reopened.loadResumeSnapshot(managed)).rejects.toThrow(
-        `no longer active`,
-      )
-      await expect(reopened.applyCommittedTx(managed, lateTx)).rejects.toThrow(
-        `no longer active`,
-      )
-
-      // Explicit eager reuse is a different legal operation with the same
-      // bytes. The managed target's rejection must not reserve every prefix.
-      const eager = {
-        kind: `eager` as const,
-        collectionId: claim.storageCollectionId,
-      }
-      await reopened.applyCommittedTx(eager, {
-        txId: `eager`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [{ type: `insert`, key: `eager`, value: { id: `eager` } }],
-      })
-      expect(
-        (await reopened.loadResumeSnapshot(eager)).rows.map(({ key }) => key),
-      ).toEqual([`eager`])
-      await expect(reopened.loadResumeSnapshot(managed)).rejects.toThrow(
-        `no longer active`,
-      )
-      await expect(reopened.applyCommittedTx(managed, lateTx)).rejects.toThrow(
-        `no longer active`,
-      )
-      expect(
-        (await reopened.loadResumeSnapshot(eager)).rows.map(({ key }) => key),
-      ).toEqual([`eager`])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // A physical cache ID is a catalog entry, not a string prefix. Public
-  // Collection IDs are arbitrary nonempty strings, including one that starts
-  // with the internal physical-ID prefix. An eager Collection never claims a
-  // managed generation; its ordinary durable row must still be readable.
-  it.each([
-    {
-      label: `CLI-safe prefix`,
-      collectionId: `tanstack-db-cache:user-eager-collection`,
-    },
-    {
-      label: `older NUL prefix`,
-      collectionId: `\u0000tanstack-db-cache:user-eager-collection`,
-    },
-  ])(
-    `keeps an eager Collection ID with the $label usable`,
-    async ({ collectionId }) => {
-      const database = new DatabaseSync(`:memory:`)
-      let primaryFailure: unknown
-      try {
-        const adapter = new SQLiteCorePersistenceAdapter({
-          driver: createDriver(database),
-        })
-        const row = { id: `row`, title: `Eager row` }
+      const logicalId = `bounded-retired-storage`
+      const first = await adapter.claimCacheGeneration(logicalId)
+      now = 1_020
+      const oldPeer = await adapter.claimCacheGeneration(logicalId)
+      const generations = [first]
+      const seedStorage = async (
+        generation: number,
+        claim: typeof first,
+      ): Promise<string> => {
+        const rows = Array.from({ length: history.rowCount }, (_, index) => ({
+          id: `g${generation}-row-${index}`,
+        }))
         await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `eager-source`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [{ type: `insert`, key: row.id, value: row }],
-          },
-        )
-        expect(
-          (
-            await adapter.loadResumeSnapshot({
-              kind: `eager`,
-              collectionId: collectionId,
-            })
-          ).rows.map(({ value }) => value),
-        ).toEqual([row])
-        const collection = createCollection(
-          persistedCollectionOptions<typeof row, string>({
-            id: collectionId,
-            syncMode: `eager`,
-            getKey: (value) => value.id,
-            persistence: { adapter },
-          }),
-        )
-        try {
-          await collection.preload()
-          expect(collection.get(row.id)).toMatchObject(row)
-        } finally {
-          await collection.cleanup()
-        }
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        closeDatabasePreservingPrimary(database, primaryFailure)
-      }
-    },
-  )
-
-  // A persisted cache generation has one distinct storage ID. Advancing the
-  // current generation preserves an existing run's source-backed storage while a recovering run
-  // starts with empty, uncertified storage. The model has disjoint row maps
-  // and one head pointer. A stale claim can branch privately without moving
-  // that pointer; only the run claiming the head may advance it.
-  // This driver checks both snapshots after the atomic rotation and rejects a
-  // late write admitted under the claim that moved away from the old map.
-  it(`rotates an on-demand cache into empty uncertified storage`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
-      })
-      const collectionId = `on-demand-cache-generation`
-      const oldRow = { id: `old`, title: `Old source row` }
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: oldRow.id, value: oldRow }],
-        },
-      )
-
-      const claim = await adapter.claimCacheGeneration(collectionId)
-      expect(claim.storageCollectionId).not.toBe(collectionId)
-      const warmClaim = await adapter.claimCacheGeneration(collectionId)
-      expect(warmClaim.storageCollectionId).toBe(claim.storageCollectionId)
-      const readClaimed = (storageId: string, claimId: string) =>
-        adapter.loadResumeSnapshot(
-          { kind: `managed`, storageCollectionId: storageId, claimId: claimId },
           {
-            cacheGenerationClaimId: claimId,
+            kind: `managed`,
+            storageCollectionId: claim.storageCollectionId,
+            claimId: claim.claimId,
           },
-        )
-      expect(
-        (await readClaimed(claim.storageCollectionId, claim.claimId)).rows,
-      ).toEqual([])
-      const resetMarker = { kind: `reset`, updatedAt: 1 }
-      const rotated = await adapter.rotateCacheGeneration(
-        collectionId,
-        claim.claimId,
-        { key: `electric:resume`, value: resetMarker },
-      )
-      expect(rotated.storageCollectionId).not.toBe(claim.storageCollectionId)
-
-      const oldSnapshot = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      const initialSnapshot = await readClaimed(
-        claim.storageCollectionId,
-        warmClaim.claimId,
-      )
-      const newSnapshot = await readClaimed(
-        rotated.storageCollectionId,
-        rotated.claimId,
-      )
-      const nextClaim = await adapter.claimCacheGeneration(collectionId)
-      expect(oldSnapshot.rows.map(({ value }) => value)).toEqual([oldRow])
-      expect(initialSnapshot.rows).toEqual([])
-      expect(newSnapshot.rows).toEqual([])
-      expect(newSnapshot.keySet).toEqual({ status: `incompatible` })
-      expect(newSnapshot.collectionMetadata).toEqual([
-        { key: `electric:resume`, value: resetMarker },
-      ])
-      await expect(
-        adapter.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: rotated.storageCollectionId,
-        }),
-      ).rejects.toThrow(`Persisted cache claim is required`)
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: rotated.storageCollectionId },
           {
-            txId: `unclaimed-write`,
-            term: 1,
+            txId: `g${generation}-seed`,
+            term: generation + 1,
             seq: 1,
             rowVersion: 1,
+            cacheGenerationClaimId: claim.claimId,
+            truncate: true,
             mutations: [
-              { type: `insert`, key: `unclaimed`, value: { id: `unclaimed` } },
+              ...rows.map((row) => ({
+                type: `insert` as const,
+                key: row.id,
+                value: row,
+              })),
+              {
+                type: `delete` as const,
+                key: `g${generation}-gone`,
+                value: { id: `g${generation}-gone` },
+              },
+            ],
+            collectionMetadataMutations: [
+              { type: `set`, key: `resume`, value: `g${generation}-cursor` },
             ],
           },
-        ),
-      ).rejects.toThrow(`Persisted cache claim is required`)
-      expect(nextClaim.storageCollectionId).toBe(rotated.storageCollectionId)
-
-      // An existing run keeps its old generation. Its source-backed writes
-      // remain separate from the recovering run's new uncertified cache.
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: warmClaim.storageCollectionId,
-          claimId: warmClaim.claimId,
-        },
-        {
-          txId: `warm-source-write`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: warmClaim.claimId,
-          mutations: [
-            {
-              type: `insert`,
-              key: `warm`,
-              value: { id: `warm`, title: `Still source backed` },
-            },
-          ],
-        },
-      )
-      expect(
-        (await readClaimed(rotated.storageCollectionId, rotated.claimId)).rows,
-      ).toEqual([])
-
-      // A writer from the previous library version knows only the public
-      // Collection ID. It may still change that legacy cache, but it cannot
-      // change either new-format generation or add rows to the current one.
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `legacy-late-write`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            {
-              type: `insert`,
-              key: `legacy-late`,
-              value: { id: `legacy-late`, title: `Legacy writer` },
-            },
-          ],
-        },
-      )
-      expect(
-        (await readClaimed(rotated.storageCollectionId, rotated.claimId)).rows,
-      ).toEqual([])
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: rotated.storageCollectionId },
-          {
-            txId: `unclaimed-new-write`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [
-              {
-                type: `insert`,
-                key: `unclaimed`,
-                value: { id: `unclaimed`, title: `No claim` },
-              },
-            ],
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim is required`)
-      const freshRow = { id: `fresh`, title: `Demanded source row` }
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: rotated.storageCollectionId,
-          claimId: claim.claimId,
-        },
-        {
-          txId: `fresh-subset-write`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: claim.claimId,
-          mutations: [{ type: `insert`, key: freshRow.id, value: freshRow }],
-        },
-      )
-      const partialSnapshot = await readClaimed(
-        rotated.storageCollectionId,
-        rotated.claimId,
-      )
-      expect(partialSnapshot.rows.map(({ value }) => value)).toEqual([freshRow])
-      expect(partialSnapshot.keySet).toEqual({ status: `incompatible` })
-
-      await expect(
-        adapter.applyCommittedTx(
+        )
+        const signature = `g${generation}-index`
+        await adapter.ensureIndex(
           {
             kind: `managed`,
             storageCollectionId: claim.storageCollectionId,
             claimId: claim.claimId,
           },
-          {
-            txId: `late-old-write`,
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            cacheGenerationClaimId: claim.claimId,
-            mutations: [
-              {
-                type: `insert`,
-                key: `late`,
-                value: {
-                  id: `late`,
-                  title: `Must stay outside new generation`,
-                },
-              },
-            ],
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-
-      // A complete replacement can certify the new head for later runs.
-      // A warm run still claiming the old generation may itself lose source
-      // authority, but that loss says nothing about the certified head. Its
-      // replacement must stay private to that run instead of retiring the
-      // other run's valid cache.
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: rotated.storageCollectionId,
-          claimId: claim.claimId,
-        },
-        {
-          txId: `certify-new-head`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          cacheGenerationClaimId: claim.claimId,
-          truncate: true,
-          mutations: [{ type: `insert`, key: freshRow.id, value: freshRow }],
-        },
-      )
-      expect(
-        (await readClaimed(rotated.storageCollectionId, rotated.claimId))
-          .keySet,
-      ).toEqual({ status: `consistent` })
-      const secondRecovery = await adapter.rotateCacheGeneration(
-        collectionId,
-        warmClaim.claimId,
-        { key: `electric:resume`, value: { kind: `reset`, updatedAt: 2 } },
-      )
-      expect(secondRecovery.storageCollectionId).not.toBe(
-        rotated.storageCollectionId,
-      )
-      expect(
-        (
-          await readClaimed(rotated.storageCollectionId, rotated.claimId)
-        ).rows.map(({ value }) => value),
-      ).toEqual([freshRow])
-      expect(
-        (
-          await readClaimed(
-            secondRecovery.storageCollectionId,
-            secondRecovery.claimId,
+          signature,
+          { expressionSql: [`row_version`] },
+          { cacheGenerationClaimId: claim.claimId },
+        )
+        const index = database
+          .prepare(
+            `SELECT index_name FROM persisted_index_registry
+             WHERE collection_id = ? AND signature = ?`,
           )
-        ).rows,
-      ).toEqual([])
-      const latestClaim = await adapter.claimCacheGeneration(collectionId)
-      expect(latestClaim.storageCollectionId).toBe(rotated.storageCollectionId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: secondRecovery.storageCollectionId,
-          claimId: warmClaim.claimId,
-        },
-        {
-          txId: `private-source-write`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: warmClaim.claimId,
-          mutations: [
-            {
-              type: `insert`,
-              key: `private`,
-              value: { id: `private`, title: `Private source row` },
-            },
-          ],
-        },
-      )
-      expect(
-        (
-          await readClaimed(rotated.storageCollectionId, latestClaim.claimId)
-        ).rows.map(({ value }) => value),
-      ).toEqual([freshRow])
-
-      // A later rotation by the actual head owner allocates past the private
-      // branch, then becomes the head seen by future runs.
-      const thirdRecovery = await adapter.rotateCacheGeneration(
-        collectionId,
-        claim.claimId,
-        { key: `electric:resume`, value: { kind: `reset`, updatedAt: 3 } },
-      )
-      expect(thirdRecovery.storageCollectionId).not.toBe(
-        secondRecovery.storageCollectionId,
-      )
-      const finalClaim = await adapter.claimCacheGeneration(collectionId)
-      expect(finalClaim.storageCollectionId).toBe(
-        thirdRecovery.storageCollectionId,
-      )
-      expect(
-        database
+          .get(claim.storageCollectionId, signature) as { index_name: string }
+        return index.index_name
+      }
+      const indexes = [await seedStorage(0, first)]
+      const seededContents: Array<{
+        rows: Array<Record<string, unknown>>
+        tombstones: Array<Record<string, unknown>>
+        metadata: Array<Record<string, unknown>>
+        expectedKeys: Array<Record<string, unknown>>
+      }> = []
+      const captureContents = (physicalId: string) => ({
+        rows: database
           .prepare(
-            `SELECT generation, retired FROM cache_generation
-             WHERE logical_id = ? ORDER BY generation`,
+            `SELECT key, value, metadata, row_version FROM "${createPersistedTableName(physicalId, `c`)}" ORDER BY key`,
           )
-          .all(collectionId),
-      ).toMatchObject([
-        // The old generation was collected when its final claim rotated.
-        { generation: 1, retired: 1 },
-        { generation: 2, retired: 1 },
-        { generation: 3, retired: 0 },
-      ])
-      await adapter.releaseCacheGenerationClaim(finalClaim.claimId)
-      await adapter.releaseCacheGenerationClaim(latestClaim.claimId)
-      await adapter.releaseCacheGenerationClaim(nextClaim.claimId)
-      await adapter.releaseCacheGenerationClaim(warmClaim.claimId)
-      await adapter.releaseCacheGenerationClaim(claim.claimId)
-      // The current head remains available for new runs after all claims
-      // release. A later checkpoint tests retirement of the old row table.
-      const currentAfterCleanup =
-        await adapter.claimCacheGeneration(collectionId)
-      expect(currentAfterCleanup.storageCollectionId).toBe(
-        thirdRecovery.storageCollectionId,
-      )
-      await adapter.releaseCacheGenerationClaim(currentAfterCleanup.claimId)
-      // Releasing a claim removes durable read authority too. The caller
-      // supplies the claim it used at admission, and SQLite checks it inside
-      // the read transaction before returning even an empty snapshot.
-      await expect(
-        adapter.loadResumeSnapshot(
-          {
-            kind: `managed`,
-            storageCollectionId: thirdRecovery.storageCollectionId,
-            claimId: claim.claimId,
-          },
-          {
-            cacheGenerationClaimId: claim.claimId,
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await expect(
-        adapter.loadSubset(
-          {
-            kind: `managed`,
-            storageCollectionId: thirdRecovery.storageCollectionId,
-            claimId: claim.claimId,
-          },
-          {},
-          {
-            cacheGenerationClaimId: claim.claimId,
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await expect(
-        adapter.scanRows(
-          {
-            kind: `managed`,
-            storageCollectionId: thirdRecovery.storageCollectionId,
-            claimId: claim.claimId,
-          },
-          undefined,
-          {
-            cacheGenerationClaimId: claim.claimId,
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await expect(
-        adapter.loadCollectionMetadata(
-          {
-            kind: `managed`,
-            storageCollectionId: thirdRecovery.storageCollectionId,
-            claimId: claim.claimId,
-          },
-          {
-            cacheGenerationClaimId: claim.claimId,
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // Claim revocation may race a durable read after its preliminary check.
-  // A held registration lookup puts the revocation between that check and
-  // the read transaction. The independent law permits no row or metadata to
-  // return after revocation; the in-transaction check is the comparison cut.
-  it(`rejects a cache read when its claim is revoked before the read transaction`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    const driver = createDriver(database)
-    const registrationEntered = deferred()
-    const releaseRegistration = deferred()
-    let holdRegistration = false
-    const gatedDriver: SQLiteDriver = {
-      ...driver,
-      query: async (sql, params) => {
-        if (holdRegistration && sql.includes(`FROM collection_registry`)) {
-          holdRegistration = false
-          registrationEntered.resolve()
-          await releaseRegistration.promise
-        }
-        return driver.query(sql, params)
-      },
-    }
-    const writer = new SQLiteCorePersistenceAdapter({ driver })
-    const reader = new SQLiteCorePersistenceAdapter({ driver: gatedDriver })
-    let read: ReturnType<typeof reader.loadResumeSnapshot> | undefined
-    let primaryFailure: unknown
-    try {
-      const claim = await writer.claimCacheGeneration(`revoked-cache-read`)
-      await writer.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: claim.storageCollectionId,
-          claimId: claim.claimId,
-        },
-        {
-          txId: `seed-row`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: claim.claimId,
-          mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
-        },
-      )
-      holdRegistration = true
-      read = reader.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: claim.storageCollectionId,
-          claimId: claim.claimId,
-        },
-        {
-          cacheGenerationClaimId: claim.claimId,
-        },
-      )
-      void read.catch(() => undefined)
-      await reachCheckpoint(registrationEntered.promise, `registration lookup`)
-      await writer.releaseCacheGenerationClaim(claim.claimId)
-      releaseRegistration.resolve()
-      await expect(read).rejects.toThrow(`Persisted cache claim`)
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseRegistration.resolve()
-      await Promise.allSettled([read])
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // A retired generation is a cache, not an archive. Its last claim is the
-  // only remaining reason to retain its rows. The model has two independent
-  // row maps: releasing the final old claim empties only the retired map,
-  // while the current generation keeps its source rows and stays claimable.
-  // The real SQLite row counts are the comparison checkpoint; a public
-  // Collection snapshot alone would miss an unbounded durable leak.
-  it(`reclaims retired cache rows after their last claim releases`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
+          .all() as Array<Record<string, unknown>>,
+        tombstones: database
+          .prepare(
+            `SELECT key, value, row_version, deleted_at FROM "${createPersistedTableName(physicalId, `t`)}" ORDER BY key`,
+          )
+          .all() as Array<Record<string, unknown>>,
+        metadata: database
+          .prepare(
+            `SELECT key, value FROM collection_metadata WHERE collection_id = ? ORDER BY key`,
+          )
+          .all(physicalId) as Array<Record<string, unknown>>,
+        expectedKeys: database
+          .prepare(
+            `SELECT key FROM collection_expected_keys WHERE collection_id = ? ORDER BY key`,
+          )
+          .all(physicalId) as Array<Record<string, unknown>>,
       })
-      const logicalId = `retired-cache-collection`
-      const first = await adapter.claimCacheGeneration(logicalId)
-      const warm = await adapter.claimCacheGeneration(logicalId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: first.storageCollectionId,
-          claimId: first.claimId,
-        },
-        {
-          txId: `old-row`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: first.claimId,
-          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
-        },
-      )
-      const current = await adapter.rotateCacheGeneration(
+      seededContents.push(captureContents(first.storageCollectionId))
+      now = 1_040
+      const middle = await adapter.rotateCacheGeneration(
         logicalId,
         first.claimId,
       )
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: current.storageCollectionId,
-          claimId: current.claimId,
-        },
-        {
-          txId: `current-row`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: current.claimId,
-          mutations: [
-            { type: `insert`, key: `current`, value: { id: `current` } },
-          ],
-        },
+      generations.push(middle)
+      now = 1_060
+      const middlePeer = await adapter.claimCacheGeneration(logicalId)
+      indexes.push(await seedStorage(1, middle))
+      seededContents.push(captureContents(middle.storageCollectionId))
+      now = 1_080
+      const current = await adapter.rotateCacheGeneration(
+        logicalId,
+        middle.claimId,
       )
-      const oldTable = createPersistedTableName(first.storageCollectionId, `c`)
-      const countOld = () =>
-        (
-          database
-            .prepare(`SELECT COUNT(*) AS count FROM "${oldTable}"`)
-            .get() as {
-            count: number
-          }
-        ).count
-      expect(countOld()).toBe(1)
-      await adapter.releaseCacheGenerationClaim(warm.claimId)
-      expect(
-        database
-          .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
-          .get(oldTable),
-      ).toBeUndefined()
-      expect(
-        (
-          await adapter.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: current.storageCollectionId,
-              claimId: current.claimId,
-            },
-            {
-              cacheGenerationClaimId: current.claimId,
-            },
-          )
-        ).rows.map(({ key }) => key),
-      ).toEqual([`current`])
-      const next = await adapter.claimCacheGeneration(logicalId)
-      expect(next.storageCollectionId).toBe(current.storageCollectionId)
-      await adapter.releaseCacheGenerationClaim(next.claimId)
-      await adapter.releaseCacheGenerationClaim(current.claimId)
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // Retired storage is reachable from live cache claims; the current head is
-  // always reachable even after its last claim expires. The independent model
-  // treats release as removal and expiry as a half-open time cut. A collection
-  // operation is the GC checkpoint: wall-clock passage alone does no SQLite
-  // work. The bounded grammar makes three generations, varies zero/two rows,
-  // and independently releases, expires, or renews claims on both retired
-  // generations. Cuts immediately before and at each renewed expiry enforce
-  // half-open claim lifetimes. It excludes concurrent writes and a fourth
-  // rotation. The comparison checks exact retained row, tombstone, resume,
-  // and key contents; physical tables and native indexes; every
-  // generation-scoped catalog; and surviving claim identities.
-  type RetiredStorageHistory = {
-    oldClaim: `release` | `expire` | `renew`
-    middleClaim: `release` | `expire` | `renew`
-    rowCount: 0 | 2
-    checkAtMs: 1_170 | 1_190 | 1_209 | 1_210 | 1_229 | 1_230
-  }
-  const expectedRetainedGenerations = (
-    history: RetiredStorageHistory,
-  ): ReadonlyArray<number> => [
-    ...(history.oldClaim === `renew` && history.checkAtMs < 1_210 ? [0] : []),
-    ...(history.middleClaim === `renew` && history.checkAtMs < 1_230
-      ? [1]
-      : []),
-    2,
-  ]
-  const assertRetiredStorageHistory = async (
-    history: RetiredStorageHistory,
-  ): Promise<void> => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = 1_000
-    try {
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
-        cacheGenerationClaimTtlMs: 100,
-        now: () => now,
-      })
-      const logicalId = `bounded-retired-storage`
-      const first = await adapter.claimCacheGeneration(logicalId)
-      now = 1_020
-      const oldPeer = await adapter.claimCacheGeneration(logicalId)
-      const generations = [first]
-      const seedStorage = async (
-        generation: number,
-        claim: typeof first,
-      ): Promise<string> => {
-        const rows = Array.from({ length: history.rowCount }, (_, index) => ({
-          id: `g${generation}-row-${index}`,
-        }))
-        await adapter.applyCommittedTx(
-          {
-            kind: `managed`,
-            storageCollectionId: claim.storageCollectionId,
-            claimId: claim.claimId,
-          },
-          {
-            txId: `g${generation}-seed`,
-            term: generation + 1,
-            seq: 1,
-            rowVersion: 1,
-            cacheGenerationClaimId: claim.claimId,
-            truncate: true,
-            mutations: [
-              ...rows.map((row) => ({
-                type: `insert` as const,
-                key: row.id,
-                value: row,
-              })),
-              {
-                type: `delete` as const,
-                key: `g${generation}-gone`,
-                value: { id: `g${generation}-gone` },
-              },
-            ],
-            collectionMetadataMutations: [
-              { type: `set`, key: `resume`, value: `g${generation}-cursor` },
-            ],
-          },
-        )
-        const signature = `g${generation}-index`
-        await adapter.ensureIndex(
-          {
-            kind: `managed`,
-            storageCollectionId: claim.storageCollectionId,
-            claimId: claim.claimId,
-          },
-          signature,
-          { expressionSql: [`row_version`] },
-          { cacheGenerationClaimId: claim.claimId },
-        )
-        const index = database
-          .prepare(
-            `SELECT index_name FROM persisted_index_registry
-             WHERE collection_id = ? AND signature = ?`,
-          )
-          .get(claim.storageCollectionId, signature) as { index_name: string }
-        return index.index_name
-      }
-      const indexes = [await seedStorage(0, first)]
-      const seededContents: Array<{
-        rows: Array<Record<string, unknown>>
-        tombstones: Array<Record<string, unknown>>
-        metadata: Array<Record<string, unknown>>
-        expectedKeys: Array<Record<string, unknown>>
-      }> = []
-      const captureContents = (physicalId: string) => ({
-        rows: database
-          .prepare(
-            `SELECT key, value, metadata, row_version FROM "${createPersistedTableName(physicalId, `c`)}" ORDER BY key`,
-          )
-          .all() as Array<Record<string, unknown>>,
-        tombstones: database
-          .prepare(
-            `SELECT key, value, row_version, deleted_at FROM "${createPersistedTableName(physicalId, `t`)}" ORDER BY key`,
-          )
-          .all() as Array<Record<string, unknown>>,
-        metadata: database
-          .prepare(
-            `SELECT key, value FROM collection_metadata WHERE collection_id = ? ORDER BY key`,
-          )
-          .all(physicalId) as Array<Record<string, unknown>>,
-        expectedKeys: database
-          .prepare(
-            `SELECT key FROM collection_expected_keys WHERE collection_id = ? ORDER BY key`,
-          )
-          .all(physicalId) as Array<Record<string, unknown>>,
-      })
-      seededContents.push(captureContents(first.storageCollectionId))
-      now = 1_040
-      const middle = await adapter.rotateCacheGeneration(
-        logicalId,
-        first.claimId,
-      )
-      generations.push(middle)
-      now = 1_060
-      const middlePeer = await adapter.claimCacheGeneration(logicalId)
-      indexes.push(await seedStorage(1, middle))
-      seededContents.push(captureContents(middle.storageCollectionId))
-      now = 1_080
-      const current = await adapter.rotateCacheGeneration(
-        logicalId,
-        middle.claimId,
-      )
-      generations.push(current)
-      indexes.push(await seedStorage(2, current))
-      seededContents.push(captureContents(current.storageCollectionId))
+      generations.push(current)
+      indexes.push(await seedStorage(2, current))
+      seededContents.push(captureContents(current.storageCollectionId))
 
       now = 1_110
       if (history.oldClaim === `release`) {
@@ -1526,3888 +358,472 @@ describe(`SQLite resume snapshots`, () => {
     assertRetiredStorageHistory,
   )
 
-  // Schema registration can pause while another adapter collects the retired
-  // generation. A late registration may finish only by rejecting and removing
-  // its own empty table and metadata; it must not resurrect SQLite storage
-  // after the last claim has gone away. Two real-adapter boundaries hold it:
-  // - Incomplete setup (a key-evidence trigger is missing) runs setup DDL,
-  //   so the gate holds the first CREATE TABLE, which would recreate the
-  //   collected table.
-  // - Complete setup skips DDL, so the gate holds just after the registry
-  //   read, whose setup check then goes stale.
-  // Both gates are before the final read result.
-  it.each([
-    { setup: `incomplete`, gate: `DDL` },
-    { setup: `complete`, gate: `registry read` },
-  ] as const)(
-    `does not resurrect a collected table after held registration resumes ($setup setup, held at $gate)`,
-    async ({ setup }) => {
-      const database = new DatabaseSync(`:memory:`)
-      let primaryFailure: unknown
-      const driver = createDriver(database)
-      const createEntered = deferred()
-      const releaseCreate = deferred()
-      let holdCreate = false
-      let oldTable = ``
-      const hold = async () => {
-        holdCreate = false
-        createEntered.resolve()
-        await releaseCreate.promise
-      }
-      const gatedDriver: SQLiteDriver = {
-        ...driver,
-        exec: async (sql) => {
-          if (
-            setup === `incomplete` &&
-            holdCreate &&
-            sql.includes(`CREATE TABLE IF NOT EXISTS`) &&
-            sql.includes(oldTable)
-          ) {
-            await hold()
-          }
-          return driver.exec(sql)
-        },
-        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
-          const rows = await driver.query<T>(sql, params)
-          if (
-            setup === `complete` &&
-            holdCreate &&
-            sql.includes(`FROM collection_registry`)
-          ) {
-            await hold()
-          }
-          return rows
-        },
-      }
-      const writer = new SQLiteCorePersistenceAdapter({ driver })
-      const reader = new SQLiteCorePersistenceAdapter({ driver: gatedDriver })
-      let read: ReturnType<typeof reader.loadResumeSnapshot> | undefined
-      try {
-        const logicalId = `held-registration-collection`
-        const rotating = await writer.claimCacheGeneration(logicalId)
-        const warm = await writer.claimCacheGeneration(logicalId)
-        oldTable = createPersistedTableName(rotating.storageCollectionId, `c`)
-        await writer.applyCommittedTx(
-          {
-            kind: `managed`,
-            storageCollectionId: rotating.storageCollectionId,
-            claimId: rotating.claimId,
-          },
-          {
-            txId: `old`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            cacheGenerationClaimId: rotating.claimId,
-            mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
-          },
-        )
-        await writer.rotateCacheGeneration(logicalId, rotating.claimId)
-        if (setup === `incomplete`) {
-          database.exec(`DROP TRIGGER "${oldTable}_key_evidence_update"`)
-        }
-        holdCreate = true
-        read = reader.loadResumeSnapshot(
-          {
-            kind: `managed`,
-            storageCollectionId: rotating.storageCollectionId,
-            claimId: warm.claimId,
-          },
-          {
-            cacheGenerationClaimId: warm.claimId,
-          },
-        )
-        void read.catch(() => undefined)
-        await reachCheckpoint(createEntered.promise, `held registration`)
-        await writer.releaseCacheGenerationClaim(warm.claimId)
-        releaseCreate.resolve()
-        await expect(read).rejects.toThrow(`collected before registration`)
-        expect(
-          database
-            .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
-            .get(oldTable),
-        ).toBeUndefined()
-        expect(
-          database
-            .prepare(
-              `SELECT collection_id FROM collection_version WHERE collection_id = ?`,
-            )
-            .get(rotating.storageCollectionId),
-        ).toBeUndefined()
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        releaseCreate.resolve()
-        await Promise.allSettled([read])
-        closeDatabasePreservingPrimary(database, primaryFailure)
-      }
-    },
-  )
-
-  // Claim validation can finish before schema registration even begins. If
-  // the last claim releases in that interval, a second catalog lookup finds
-  // no generation row. The request still carries managed-cache identity; it
-  // must remove any table it creates before rejecting the later read.
-  it(`does not lose managed identity before a held registration lookup`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    const driver = createDriver(database)
-    const lookupEntered = deferred()
-    const releaseLookup = deferred()
-    let holdLookup = false
-    const gatedDriver: SQLiteDriver = {
-      ...driver,
-      query: async (sql, params) => {
-        if (
-          holdLookup &&
-          sql.includes(
-            `SELECT physical_id FROM cache_generation WHERE physical_id = ?`,
-          )
-        ) {
-          holdLookup = false
-          lookupEntered.resolve()
-          await releaseLookup.promise
-        }
-        return driver.query(sql, params)
-      },
-    }
-    const writer = new SQLiteCorePersistenceAdapter({ driver })
-    const reader = new SQLiteCorePersistenceAdapter({ driver: gatedDriver })
-    let read: ReturnType<typeof reader.loadResumeSnapshot> | undefined
-    try {
-      const logicalId = `held-managed-catalog-lookup`
-      const rotating = await writer.claimCacheGeneration(logicalId)
-      const warm = await writer.claimCacheGeneration(logicalId)
-      await writer.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: rotating.storageCollectionId,
-          claimId: rotating.claimId,
-        },
-        {
-          txId: `old`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: rotating.claimId,
-          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
-        },
-      )
-      await writer.rotateCacheGeneration(logicalId, rotating.claimId)
-      const oldTable = createPersistedTableName(
-        rotating.storageCollectionId,
-        `c`,
-      )
-      holdLookup = true
-      read = reader.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: rotating.storageCollectionId,
-          claimId: warm.claimId,
-        },
-        {
-          cacheGenerationClaimId: warm.claimId,
-        },
-      )
-      void read.catch(() => undefined)
-      await reachCheckpoint(lookupEntered.promise, `managed catalog lookup`)
-      await writer.releaseCacheGenerationClaim(warm.claimId)
-      releaseLookup.resolve()
-      await expect(read).rejects.toThrow()
-      expect(
-        database
-          .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
-          .get(oldTable),
-      ).toBeUndefined()
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseLookup.resolve()
-      await Promise.allSettled([read])
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
+  // A resume snapshot may pass its preliminary claim check and then wait to
+  // enter SQLite's read transaction. The independent claim rule compares the
+  // transaction's clock cut with that claim's expiry: a live claim reads its
+  // requested rows and metadata; an expired claim rejects without a snapshot.
+  // A later-acquired peer claim remains live in both histories and must keep
+  // the same durable rows and metadata. The grammar varies zero-to-three rows
+  // to distinguish empty from partial snapshots, and row inclusion to expose
+  // unwanted row reads. Peer acquisition time varies an independent expiry;
+  // the peer stays live throughout this bounded grammar. The read clock cut
+  // distinguishes live, exactly expired, and later reads for the first claim.
+  // Both claims address one physical ID. A peer acquired after the read, or
+  // expired before its own read, is not a legal history here. The six fixed
+  // histories reconstruct both row-inclusion options at exact expiry.
+  // Holding the real transaction before its claim query makes the second
+  // check, rather than the wrapper's later publication guard, the checkpoint.
+  type ManagedClaimReadHistory = {
+    elapsedMs: number
+    includeRows: boolean
+    peerDelayMs: number
+    rowCount: number
+  }
+  const assertManagedClaimReadHistory = async ({
+    elapsedMs,
+    includeRows,
+    peerDelayMs,
+    rowCount,
+  }: ManagedClaimReadHistory): Promise<void> => {
+    // The independent model uses half-open claim intervals. The peer's
+    // interval starts later, so the first claim may expire while it stays live.
+    const startAtMs = 1_000
+    const claimTtlMs = 100
+    const firstExpiresAtMs = startAtMs + claimTtlMs
+    const peerClaimsAtMs = startAtMs + peerDelayMs
+    const peerExpiresAtMs = peerClaimsAtMs + claimTtlMs
+    const readAtMs = firstExpiresAtMs + elapsedMs
+    const firstClaimCanRead = readAtMs < firstExpiresAtMs
+    expect(peerClaimsAtMs).toBeLessThan(firstExpiresAtMs)
+    expect(readAtMs).toBeGreaterThanOrEqual(peerClaimsAtMs)
+    expect(readAtMs).toBeLessThan(peerExpiresAtMs)
+    const rows = Array.from({ length: rowCount }, (_, index) => ({
+      id: `retained-${index}`,
+      title: `Warm peer row ${index}`,
+    }))
+    const expectedFirstRows = includeRows ? rows : []
 
-  // A claim moved to a new physical generation no longer authorizes schema
-  // reset in the old one. The other run's live claim retains its old rows and
-  // metadata even when the stale run entered registration while its claim was
-  // valid. This authored two-run history pauses the real adapter's registry
-  // lookup, moves only one claim, then compares the remaining run's durable
-  // schema, row, transaction ID, and reset epoch after the stale read rejects.
-  it(`preserves a warm generation when a stale registration would reset its schema`, async () => {
     const database = new DatabaseSync(`:memory:`)
     let primaryFailure: unknown
-    const driver = createDriver(database)
-    const registrationEntered = deferred()
-    const releaseRegistration = deferred()
-    let holdRegistration = false
-    const gatedDriver: SQLiteDriver = {
-      ...driver,
-      query: async (sql, params) => {
-        if (
-          holdRegistration &&
-          sql.includes(`SELECT table_name,`) &&
-          sql.includes(`FROM collection_registry`)
-        ) {
-          holdRegistration = false
-          registrationEntered.resolve()
-          await releaseRegistration.promise
-        }
-        return driver.query(sql, params)
-      },
-    }
-    const writer = new SQLiteCorePersistenceAdapter({
-      driver,
-      schemaVersion: 1,
-    })
-    const staleReader = new SQLiteCorePersistenceAdapter({
-      driver: gatedDriver,
-      schemaVersion: 2,
-      schemaMismatchPolicy: `sync-present-reset`,
-    })
-    let read: ReturnType<typeof staleReader.loadResumeSnapshot> | undefined
-    try {
-      const logicalId = `stale-schema-reset`
-      const moving = await writer.claimCacheGeneration(logicalId)
-      const warm = await writer.claimCacheGeneration(logicalId)
-      const oldId = moving.storageCollectionId
-      const oldTable = createPersistedTableName(oldId, `c`)
-      await writer.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: oldId,
-          claimId: moving.claimId,
-        },
-        {
-          txId: `warm-row`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: moving.claimId,
-          mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
-        },
-      )
-
-      holdRegistration = true
-      read = staleReader.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: oldId,
-          claimId: moving.claimId,
-        },
-        {
-          cacheGenerationClaimId: moving.claimId,
-        },
-      )
-      void read.catch(() => undefined)
-      await reachCheckpoint(
-        registrationEntered.promise,
-        `stale registry lookup`,
-      )
-      const current = await writer.rotateCacheGeneration(
-        logicalId,
-        moving.claimId,
-      )
-      expect(current.storageCollectionId).not.toBe(oldId)
-      releaseRegistration.resolve()
-      await expect(read).rejects.toThrow(`Persisted cache claim`)
-
-      expect(
-        database
-          .prepare(
-            `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
-          )
-          .get(oldId),
-      ).toEqual({ schema_version: 1 })
-      expect(database.prepare(`SELECT key FROM "${oldTable}"`).all()).toEqual([
-        { key: encodePersistedStorageKey(`row`) },
-      ])
-      expect(
-        database
-          .prepare(`SELECT tx_id FROM applied_tx WHERE collection_id = ?`)
-          .all(oldId),
-      ).toEqual([{ tx_id: `warm-row` }])
-      expect(
-        database
-          .prepare(
-            `SELECT reset_epoch FROM collection_reset_epoch WHERE collection_id = ?`,
-          )
-          .get(oldId),
-      ).toEqual({ reset_epoch: 0 })
-      expect(
-        (
-          await writer.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: oldId,
-              claimId: warm.claimId,
-            },
-            {
-              cacheGenerationClaimId: warm.claimId,
-            },
-          )
-        ).rows.map(({ key }) => key),
-      ).toEqual([`row`])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseRegistration.resolve()
-      await Promise.allSettled([read])
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // A fresh rotated generation can contain resume metadata before its first
-  // table registration. If one claim moves during that first lookup, the
-  // former claimant cannot choose the old generation's schema. Otherwise the
-  // remaining run's next read treats the unauthorized schema as a mismatch
-  // and deletes its resume metadata. The model retains that metadata through
-  // the stale rejection and the warm run's subsequent read.
-  it(`preserves a warm generation's resume metadata across stale first registration`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    const driver = createDriver(database)
-    const registrationEntered = deferred()
-    const releaseRegistration = deferred()
-    let holdRegistration = false
-    const gatedDriver: SQLiteDriver = {
-      ...driver,
-      query: async (sql, params) => {
-        if (
-          holdRegistration &&
-          sql.includes(`SELECT table_name,`) &&
-          sql.includes(`FROM collection_registry`)
-        ) {
-          holdRegistration = false
-          registrationEntered.resolve()
-          await releaseRegistration.promise
-        }
-        return driver.query(sql, params)
-      },
-    }
-    const writer = new SQLiteCorePersistenceAdapter({
-      driver,
-      schemaVersion: 1,
-    })
-    const staleReader = new SQLiteCorePersistenceAdapter({
-      driver: gatedDriver,
-      schemaVersion: 2,
-      schemaMismatchPolicy: `sync-present-reset`,
-    })
-    let read: ReturnType<typeof staleReader.loadResumeSnapshot> | undefined
-    try {
-      const logicalId = `stale-first-registration`
-      const first = await writer.claimCacheGeneration(logicalId)
-      const moving = await writer.rotateCacheGeneration(
-        logicalId,
-        first.claimId,
-        { key: `resume`, value: `must-survive` },
-      )
-      const warm = await writer.claimCacheGeneration(logicalId)
-      const oldId = moving.storageCollectionId
-
-      holdRegistration = true
-      read = staleReader.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: oldId,
-          claimId: moving.claimId,
-        },
-        {
-          cacheGenerationClaimId: moving.claimId,
-        },
-      )
-      void read.catch(() => undefined)
-      await reachCheckpoint(
-        registrationEntered.promise,
-        `first registry lookup`,
-      )
-      const current = await writer.rotateCacheGeneration(
-        logicalId,
-        moving.claimId,
-      )
-      expect(current.storageCollectionId).not.toBe(oldId)
-      releaseRegistration.resolve()
-      await expect(read).rejects.toThrow(`Persisted cache claim`)
-
-      expect(
-        database
-          .prepare(
-            `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
-          )
-          .get(oldId),
-      ).toBeUndefined()
-      expect(
-        (
-          await writer.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: oldId,
-              claimId: warm.claimId,
-            },
-            {
-              cacheGenerationClaimId: warm.claimId,
-            },
-          )
-        ).collectionMetadata,
-      ).toEqual([{ key: `resume`, value: `must-survive` }])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseRegistration.resolve()
-      await Promise.allSettled([read])
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // A paused run cannot keep retired bytes forever. In the model, a claim is
-  // usable only before its expiry cut; a new run collects an expired retired
-  // generation without touching the current head. The old run may then make
-  // a private empty generation for fresh demanded source snapshots, but it
-  // cannot reclaim the expired rows or retire the head used by another run.
-  it(`expires a paused claim and recovers privately without displacing the current cache`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = 1_000
-    try {
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
-        cacheGenerationClaimTtlMs: 100,
-        now: () => now,
-      })
-      const logicalId = `expired-cache-claim`
-      const old = await adapter.claimCacheGeneration(logicalId)
-      const paused = await adapter.claimCacheGeneration(logicalId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: old.storageCollectionId,
-          claimId: old.claimId,
-        },
-        {
-          txId: `old`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: old.claimId,
-          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
-        },
-      )
-      const head = await adapter.rotateCacheGeneration(logicalId, old.claimId)
-      const headTable = createPersistedTableName(head.storageCollectionId, `c`)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: head.storageCollectionId,
-          claimId: head.claimId,
-        },
-        {
-          txId: `head`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: head.claimId,
-          mutations: [{ type: `insert`, key: `head`, value: { id: `head` } }],
-        },
-      )
-      now = 1_090
-      expect(
-        await adapter.renewCacheGenerationClaim(
-          head.storageCollectionId,
-          head.claimId,
-        ),
-      ).toBe(1_190)
-      now = 1_110
-      const next = await adapter.claimCacheGeneration(logicalId)
-      expect(next.storageCollectionId).toBe(head.storageCollectionId)
-      await expect(
-        adapter.loadResumeSnapshot(
-          {
-            kind: `managed`,
-            storageCollectionId: old.storageCollectionId,
-            claimId: paused.claimId,
-          },
-          {
-            cacheGenerationClaimId: paused.claimId,
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      const oldTable = createPersistedTableName(old.storageCollectionId, `c`)
-      expect(
-        database
-          .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
-          .get(oldTable),
-      ).toBeUndefined()
-      const privateRecovery = await adapter.rotateCacheGeneration(
-        logicalId,
-        paused.claimId,
-      )
-      expect(privateRecovery.storageCollectionId).not.toBe(
-        head.storageCollectionId,
-      )
-      expect(
-        (await adapter.claimCacheGeneration(logicalId)).storageCollectionId,
-      ).toBe(head.storageCollectionId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: privateRecovery.storageCollectionId,
-          claimId: privateRecovery.claimId,
-        },
-        {
-          txId: `fresh-subset`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: privateRecovery.claimId,
-          mutations: [{ type: `insert`, key: `fresh`, value: { id: `fresh` } }],
-        },
-      )
-      expect(
-        (
-          database
-            .prepare(`SELECT COUNT(*) AS count FROM "${headTable}"`)
-            .get() as {
-            count: number
+    let now = startAtMs
+    const baseDriver = createDriver(database)
+    const transactionEntered = deferred()
+    const releaseTransaction = deferred()
+    let holdTransaction = false
+    let observeHeldRead = false
+    let metadataReads = 0
+    let rowReads = 0
+    const heldStatements: Array<{
+      type: `query` | `run` | `exec`
+      sql: string
+      params?: ReadonlyArray<unknown>
+    }> = []
+    let rowTable = ``
+    let observedStorageId = ``
+    const driver: SQLiteDriver = {
+      ...baseDriver,
+      transaction: (operation) =>
+        baseDriver.transaction(async (transactionDriver) => {
+          if (holdTransaction) {
+            holdTransaction = false
+            transactionEntered.resolve()
+            await releaseTransaction.promise
           }
-        ).count,
-      ).toBe(1)
-      expect(
-        (
-          await adapter.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: privateRecovery.storageCollectionId,
-              claimId: privateRecovery.claimId,
-            },
-            { cacheGenerationClaimId: privateRecovery.claimId },
-          )
-        ).rows.map(({ key }) => key),
-      ).toEqual([`fresh`])
-      await adapter.releaseCacheGenerationClaim(privateRecovery.claimId)
-      const advanced = await adapter.rotateCacheGeneration(
-        logicalId,
-        head.claimId,
-        undefined,
-        head.storageCollectionId,
-      )
-      expect(
-        database
-          .prepare(
-            `SELECT generation FROM cache_generation WHERE physical_id = ?`,
-          )
-          .get(advanced.storageCollectionId),
-      ).toMatchObject({ generation: 3 })
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // Expiry revokes this run's authority, not another run's ability to claim
-  // the current cache. Recovery must use private empty storage even when the
-  // expired claim remembered the current storage ID.
-  it(`keeps the current cache claimable when its expired claimant recovers`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = 1_000
-    try {
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
-        cacheGenerationClaimTtlMs: 100,
-        now: () => now,
-      })
-      const logicalId = `expired-head-recovery`
-      const old = await adapter.claimCacheGeneration(logicalId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: old.storageCollectionId,
-          claimId: old.claimId,
-        },
-        {
-          txId: `old`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: old.claimId,
-          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
-        },
-      )
-      now = 1_101
-      expect(
-        await adapter.renewCacheGenerationClaim(
-          old.storageCollectionId,
-          old.claimId,
-        ),
-      ).toBeUndefined()
-      const repaired = await adapter.rotateCacheGeneration(
-        logicalId,
-        old.claimId,
-        undefined,
-        old.storageCollectionId,
-      )
-      const next = await adapter.claimCacheGeneration(logicalId)
-      expect(next.storageCollectionId).toBe(old.storageCollectionId)
-      expect(repaired.storageCollectionId).not.toBe(old.storageCollectionId)
-      expect(
-        (
-          await adapter.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: next.storageCollectionId,
-              claimId: next.claimId,
-            },
-            {
-              cacheGenerationClaimId: next.claimId,
-            },
-          )
-        ).rows.map(({ key }) => key),
-      ).toEqual([`old`])
-      await expect(
-        adapter.loadResumeSnapshot(
-          {
-            kind: `managed`,
-            storageCollectionId: old.storageCollectionId,
-            claimId: old.claimId,
-          },
-          {
-            cacheGenerationClaimId: old.claimId,
-          },
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await adapter.releaseCacheGenerationClaim(next.claimId)
-      await adapter.releaseCacheGenerationClaim(repaired.claimId)
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // Scoped recovery may start rotation while this run still owns the current
-  // cache, then its claim may expire before SQLite decides ownership.
-  // The independent rule uses authority at the rotation transaction: the
-  // recovering run gets private empty storage, while a live peer and future
-  // claimants retain the original head. This history holds the real adapter's
-  // rotation before its transaction, then crosses expiry. After a fresh subset
-  // load settles, public rows and both claimed SQLite snapshots must match
-  // those two independent storage routes. An empty source subset cannot make
-  // the recovering run's old cached row authoritative again. The
-  // controlled source supplies the recovery decision; provider classification
-  // of malformed metadata is a separate receiving obligation.
-  it(`keeps a warm peer's cache when scoped recovery crosses claim expiry`, async () => {
-    type Row = { id: string; title: string }
-    const database = new DatabaseSync(`:memory:`)
-    const logicalId = `resume-loss-then-expiry`
-    let now = Date.now()
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver: createDriver(database),
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => now,
-    })
-    const rotationEntered = deferred()
-    const releaseRotation = deferred()
-    const rotate = adapter.rotateCacheGeneration.bind(adapter)
-    adapter.rotateCacheGeneration = async (...args) => {
-      rotationEntered.resolve()
-      await releaseRotation.promise
-      return rotate(...args)
-    }
-    const oldRow: Row = { id: `old`, title: `Warm cached row` }
-    const freshRow: Row = { id: `fresh`, title: `Fresh source row` }
-    const warmResume = {
-      kind: `resume`,
-      requiresTagState: false,
-      offset: `10_0`,
-      handle: `warm-handle`,
-      shapeId: `warm-shape`,
-      updatedAt: 1,
-    }
-    const resetMarker = { kind: `reset`, updatedAt: 2 }
-    let recoveringSource: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-    let freshDemand = false
-    const recoveringStarted = deferred()
-    const warmStarted = deferred()
-    const createPeer = (recovering: boolean) =>
-      createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (source) => {
-              if (recovering) recoveringSource = source
-              source.markReady()
-              if (recovering) recoveringStarted.resolve()
-              else warmStarted.resolve()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async () => {
-                  if (recovering && freshDemand) {
-                    source.begin()
-                    source.write({ type: `insert`, value: freshRow })
-                    await source.commit()
-                  }
-                },
+          return operation({
+            ...transactionDriver,
+            query: (sql, params) => {
+              if (observeHeldRead) {
+                heldStatements.push({ type: `query`, sql, params })
+                if (sql.includes(`FROM collection_metadata`)) metadataReads++
+                if (sql.includes(rowTable)) rowReads++
               }
+              return transactionDriver.query(sql, params)
             },
-          },
-          persistence: { adapter },
-        }),
-      )
-    let recovering: Collection<Row, string> | undefined
-    let warm: Collection<Row, string> | undefined
-    let recovery: Promise<void> | undefined
-    let laterClaimId: string | undefined
-    let primaryFailure: unknown
-    try {
-      const seed = await adapter.claimCacheGeneration(logicalId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: seed.storageCollectionId,
-          claimId: seed.claimId,
-        },
-        {
-          txId: `old-source-row`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: seed.claimId,
-          mutations: [{ type: `insert`, key: oldRow.id, value: oldRow }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `electric:resume`, value: warmResume },
-          ],
-        },
-      )
-      await adapter.releaseCacheGenerationClaim(seed.claimId)
-
-      recovering = createPeer(true)
-      recovering.startSyncImmediate()
-      await reachCheckpoint(
-        recoveringStarted.promise,
-        `recovering source start`,
-      )
-      const initialClaim = database
-        .prepare(
-          `SELECT claim_id, physical_id, expires_at_ms
-           FROM cache_generation_claim WHERE logical_id = ?`,
-        )
-        .get(logicalId) as {
-        claim_id: string
-        physical_id: string
-        expires_at_ms: number
-      }
-      warm = createPeer(false)
-      warm.startSyncImmediate()
-      await reachCheckpoint(warmStarted.promise, `warm source start`)
-      await warm._sync.loadSubset({})
-      expect(warm.get(oldRow.id)).toMatchObject(oldRow)
-      const warmClaim = database
-        .prepare(
-          `SELECT claim_id, physical_id FROM cache_generation_claim
-           WHERE logical_id = ? AND claim_id <> ?`,
-        )
-        .get(logicalId, initialClaim.claim_id) as {
-        claim_id: string
-        physical_id: string
-      }
-      expect(warmClaim.physical_id).toBe(initialClaim.physical_id)
-
-      now += 9_000
-      const warmExpiresAt = await adapter.renewCacheGenerationClaim(
-        warmClaim.physical_id,
-        warmClaim.claim_id,
-      )
-      expect(warmExpiresAt).toBeGreaterThan(initialClaim.expires_at_ms)
-      recovery = recoveringSource!.metadata!.persistence!.startScopedRecovery!({
-        key: `electric:resume`,
-        value: resetMarker,
-      })
-      void recovery.catch(() => undefined)
-      await reachCheckpoint(rotationEntered.promise, `held cache rotation`)
-      now += 2_000
-      expect(now).toBeGreaterThan(initialClaim.expires_at_ms)
-      expect(now).toBeLessThan(warmExpiresAt!)
-      releaseRotation.resolve()
-      await reachCheckpoint(recovery, `private scoped recovery`)
-
-      const recoveringClaim = database
-        .prepare(
-          `SELECT physical_id FROM cache_generation_claim WHERE claim_id = ?`,
-        )
-        .get(initialClaim.claim_id) as { physical_id: string }
-      const head = database
-        .prepare(
-          `SELECT physical_id FROM cache_generation
-           WHERE logical_id = ? AND retired = 0`,
-        )
-        .get(logicalId) as { physical_id: string }
-      expect(recoveringClaim.physical_id).not.toBe(initialClaim.physical_id)
-      expect(head.physical_id).toBe(initialClaim.physical_id)
-
-      await recovering._sync.loadSubset({})
-      expect(Array.from(recovering.values())).toEqual([])
-      expect(
-        (
-          await adapter.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: recoveringClaim.physical_id,
-              claimId: initialClaim.claim_id,
-            },
-            {
-              cacheGenerationClaimId: initialClaim.claim_id,
-            },
-          )
-        ).rows,
-      ).toEqual([])
-
-      freshDemand = true
-      await recovering._sync.loadSubset({})
-      const laterClaim = await adapter.claimCacheGeneration(logicalId)
-      laterClaimId = laterClaim.claimId
-      expect(laterClaim.storageCollectionId).toBe(initialClaim.physical_id)
-      expect(Array.from(recovering.values(), ({ id }) => id)).toEqual([
-        freshRow.id,
-      ])
-      expect(Array.from(warm.values(), ({ id }) => id)).toEqual([oldRow.id])
-      const privateSnapshot = await adapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: recoveringClaim.physical_id,
-          claimId: initialClaim.claim_id,
-        },
-        { cacheGenerationClaimId: initialClaim.claim_id },
-      )
-      const warmSnapshot = await adapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: warmClaim.physical_id,
-          claimId: warmClaim.claim_id,
-        },
-        { cacheGenerationClaimId: warmClaim.claim_id },
-      )
-      expect(privateSnapshot.rows.map(({ key }) => key)).toEqual([freshRow.id])
-      expect(privateSnapshot.collectionMetadata).toEqual([
-        { key: `electric:resume`, value: resetMarker },
-      ])
-      expect(warmSnapshot.rows.map(({ key }) => key)).toEqual([oldRow.id])
-      expect(warmSnapshot.collectionMetadata).toEqual([
-        { key: `electric:resume`, value: warmResume },
-      ])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseRotation.resolve()
-      const cleanupFailures: Array<unknown> = []
-      const cleanupTimeoutMs = primaryFailure === undefined ? 1_000 : 200
-      if (recovery) {
-        try {
-          await reachCheckpoint(recovery, `recovery cleanup`, cleanupTimeoutMs)
-        } catch (error) {
-          cleanupFailures.push(error)
-        }
-      }
-      for (const release of [
-        () => recovering?.cleanup(),
-        () => warm?.cleanup(),
-        () =>
-          laterClaimId
-            ? adapter.releaseCacheGenerationClaim(laterClaimId)
-            : undefined,
-      ]) {
-        try {
-          const settling = release()
-          if (settling) {
-            await reachCheckpoint(settling, `peer cleanup`, cleanupTimeoutMs)
-          }
-        } catch (error) {
-          cleanupFailures.push(error)
-        }
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure, cleanupFailures)
-    }
-  })
-
-  // A peer's live claim does not extend an expired run's authority. The model
-  // grants each run its own expiring claim even when both share one generation.
-  // Stream-position, replay, and index work must use the initiating claim at
-  // the SQLite transaction cut. The warm peer must still be able to use the
-  // same generation, so rejecting every operation is not a valid repair.
-  it(`rejects coordinator work from an expired claimant while its peer remains live`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = 1_000
-    try {
-      const adapter = new SQLiteCorePersistenceAdapter({
-        driver: createDriver(database),
-        cacheGenerationClaimTtlMs: 100,
-        now: () => now,
-      })
-      const claim = await adapter.claimCacheGeneration(`coordinator-claim`)
-      const id = claim.storageCollectionId
-      const claimCtx = { cacheGenerationClaimId: claim.claimId }
-      const claimTarget = {
-        kind: `managed` as const,
-        storageCollectionId: id,
-        claimId: claim.claimId,
-      }
-      await adapter.applyCommittedTx(
-        { kind: `managed`, storageCollectionId: id, claimId: claim.claimId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: claim.claimId,
-          mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
-        },
-      )
-      await adapter.ensureIndex(
-        claimTarget,
-        `existing`,
-        { expressionSql: [`json_extract(value, '$.id')`] },
-        claimCtx,
-      )
-      now = 1_050
-      const peer = await adapter.claimCacheGeneration(`coordinator-claim`)
-      const peerCtx = { cacheGenerationClaimId: peer.claimId }
-      const peerTarget = {
-        kind: `managed` as const,
-        storageCollectionId: id,
-        claimId: peer.claimId,
-      }
-      now = 1_101
-      expect(adapter.getCacheGenerationNow()).toBe(now)
-      await expect(
-        adapter.getStreamPosition(claimTarget, claimCtx),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await expect(adapter.pullSince(claimTarget, 0, claimCtx)).rejects.toThrow(
-        `Persisted cache claim`,
-      )
-      await expect(
-        adapter.ensureIndex(
-          claimTarget,
-          `late`,
-          { expressionSql: [`json_extract(value, '$.id')`] },
-          claimCtx,
-        ),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await expect(
-        adapter.markIndexRemoved(claimTarget, `existing`, claimCtx),
-      ).rejects.toThrow(`Persisted cache claim`)
-      await expect(
-        adapter.getStreamPosition({ kind: `eager`, collectionId: id }),
-      ).rejects.toThrow(`Persisted cache claim`)
-
-      expect(
-        await adapter.getStreamPosition(peerTarget, peerCtx),
-      ).toMatchObject({
-        latestTerm: 1,
-        latestSeq: 1,
-      })
-      expect(await adapter.pullSince(peerTarget, 0, peerCtx)).toMatchObject({
-        changedKeys: [`row`],
-      })
-      await adapter.ensureIndex(
-        peerTarget,
-        `peer`,
-        { expressionSql: [`json_extract(value, '$.id')`] },
-        peerCtx,
-      )
-      await adapter.markIndexRemoved(peerTarget, `peer`, peerCtx)
-      expect(
-        database
-          .prepare(
-            `SELECT signature, removed FROM persisted_index_registry
-             WHERE collection_id = ? ORDER BY signature`,
-          )
-          .all(id),
-      ).toEqual([
-        { signature: `existing`, removed: 0 },
-        { signature: `peer`, removed: 1 },
-      ])
-      await adapter.releaseCacheGenerationClaim(peer.claimId)
-      await expect(
-        adapter.getStreamPosition(peerTarget, peerCtx),
-      ).rejects.toThrow(`Persisted cache claim`)
-      const next = await adapter.claimCacheGeneration(`coordinator-claim`)
-      expect(next.storageCollectionId).toBe(id)
-      expect(
-        await adapter.getStreamPosition(
-          { kind: `managed`, storageCollectionId: id, claimId: next.claimId },
-          {
-            cacheGenerationClaimId: next.claimId,
-          },
-        ),
-      ).toMatchObject({ latestRowVersion: 1 })
-      await adapter.releaseCacheGenerationClaim(next.claimId)
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // Index events are a public route to durable work. Two Collection instances
-  // start on one persisted cache generation with the same index. When the
-  // first run's claim expires, removing its public index cannot remove the
-  // physical index still owned by the warm run. Removing the warm run's index
-  // afterward must succeed, so the boundary is the initiating claim rather
-  // than a blanket ban on index changes to a retired generation.
-  it(`keeps a warm peer's SQLite index after an expired Collection removes its index`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = Date.now()
-    const logicalId = `peer-index-after-expiry`
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver: createDriver(database),
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => now,
-    })
-    const createIndexedCollection = () => {
-      const sourceStarted = deferred()
-      const collection = createCollection(
-        persistedCollectionOptions<{ id: string; title: string }, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          defaultIndexType: BasicIndex,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              sourceStarted.resolve()
-              return { restartAfterScopedRecovery: () => {} }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      const index = collection.createIndex((row) => row.title, {
-        name: `shared-title`,
-      })
-      const signature = collection
-        .getIndexMetadata()
-        .find((metadata) => metadata.indexId === index.id)?.signature
-      if (!signature) throw new Error(`Missing index signature`)
-      collection.startSyncImmediate()
-      return { collection, index, signature, sourceStarted }
-    }
-    let first: ReturnType<typeof createIndexedCollection> | undefined
-    let peer: ReturnType<typeof createIndexedCollection> | undefined
-    try {
-      first = createIndexedCollection()
-      await reachCheckpoint(first.sourceStarted.promise, `first indexed source`)
-      const originalClaim = database
-        .prepare(
-          `SELECT claim_id, physical_id, expires_at_ms
-           FROM cache_generation_claim WHERE logical_id = ?`,
-        )
-        .get(logicalId) as {
-        claim_id: string
-        physical_id: string
-        expires_at_ms: number
-      }
-
-      now += 5_000
-      peer = createIndexedCollection()
-      await reachCheckpoint(peer.sourceStarted.promise, `peer indexed source`)
-      expect(peer.signature).toBe(first.signature)
-      const peerClaim = database
-        .prepare(
-          `SELECT claim_id, physical_id, expires_at_ms
-           FROM cache_generation_claim
-           WHERE logical_id = ? AND claim_id <> ?`,
-        )
-        .get(logicalId, originalClaim.claim_id) as {
-        claim_id: string
-        physical_id: string
-        expires_at_ms: number
-      }
-      expect(peerClaim.physical_id).toBe(originalClaim.physical_id)
-      const indexState = () =>
-        database
-          .prepare(
-            `SELECT removed FROM persisted_index_registry
-             WHERE collection_id = ? AND signature = ?`,
-          )
-          .get(originalClaim.physical_id, first!.signature) as
-          { removed: number } | undefined
-      expect(indexState()).toEqual({ removed: 0 })
-
-      now += 6_000
-      expect(now).toBeGreaterThan(originalClaim.expires_at_ms)
-      expect(now).toBeLessThan(peerClaim.expires_at_ms)
-      first.collection.removeIndex(first.index)
-      await vi.waitFor(() => {
-        const moved = database
-          .prepare(
-            `SELECT physical_id FROM cache_generation_claim
-             WHERE logical_id = ? AND claim_id <> ?`,
-          )
-          .get(logicalId, peerClaim.claim_id) as
-          { physical_id: string } | undefined
-        expect(moved?.physical_id).toBeDefined()
-        expect(moved?.physical_id).not.toBe(originalClaim.physical_id)
-      })
-      expect(indexState()).toEqual({ removed: 0 })
-
-      peer.collection.removeIndex(peer.index)
-      await vi.waitFor(() => expect(indexState()).toEqual({ removed: 1 }))
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      try {
-        await first?.collection.cleanup()
-        await peer?.collection.cleanup()
-      } catch (error) {
-        primaryFailure ??= error
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // The Collection's current index declaration is the independent authority
-  // for the final physical index. A cache rotation may ask SQLite to create an
-  // index, then the Collection may remove that declaration before DDL enters
-  // SQLite. The removal may finish first, and a re-add may occur while the
-  // reconciliation removal is held. These are real-SQLite receiving cuts for
-  // the controlled reverse-order histories in persisted-oracle.test.ts. The
-  // public declaration and SQLite's registry plus sqlite_master are compared
-  // after recovery. Holds control call order, not SQLite's DDL implementation.
-  for (const readdDuringReconciliation of [false, true]) {
-    it(
-      readdDuringReconciliation
-        ? `restores a SQLite index re-added during late-ensure reconciliation`
-        : `removes a late SQLite index after its Collection declaration is removed`,
-      async () => {
-        const database = new DatabaseSync(`:memory:`)
-        let primaryFailure: unknown
-        const logicalId = `late-native-index-removal`
-        const baseDriver = createDriver(database)
-        let transactionTail = Promise.resolve()
-        // One DatabaseSync handle cannot run nested transactions. The host's
-        // transaction queue preserves the deliberate order of these real DDL
-        // operations without introducing a fixture-only SQLite failure.
-        const driver: SQLiteDriver = {
-          ...baseDriver,
-          transaction: async (work) => {
-            const previous = transactionTail
-            let release!: () => void
-            transactionTail = new Promise<void>((resolve) => {
-              release = resolve
-            })
-            await previous
-            try {
-              return await baseDriver.transaction(work)
-            } finally {
-              release()
-            }
-          },
-        }
-        const nativeAdapter = new SQLiteCorePersistenceAdapter({
-          driver,
-        })
-        const ensureEntered = deferred()
-        const releaseEnsure = deferred()
-        const removalSettled = deferred()
-        const secondRemovalEntered = deferred()
-        const releaseSecondRemoval = deferred()
-        const readdEnsureSettled = deferred()
-        let initialStorageId = ``
-        let heldEnsure = false
-        let rotatedRemovals = 0
-        let rotatedEnsures = 0
-        const adapter = new Proxy(nativeAdapter, {
-          get(target, property) {
-            if (property === `ensureIndex`) {
-              return async (...args: Parameters<typeof target.ensureIndex>) => {
-                const storage = args[0]
-                let rotatedEnsureNumber = 0
-                if (
-                  storage.kind === `managed` &&
-                  initialStorageId !== `` &&
-                  storage.storageCollectionId !== initialStorageId
-                ) {
-                  rotatedEnsureNumber = ++rotatedEnsures
-                  if (!heldEnsure) {
-                    heldEnsure = true
-                    ensureEntered.resolve()
-                    await releaseEnsure.promise
-                  }
-                }
-                await target.ensureIndex(...args)
-                if (rotatedEnsureNumber === 2) readdEnsureSettled.resolve()
-              }
-            }
-            if (property === `markIndexRemoved`) {
-              return async (
-                ...args: Parameters<typeof target.markIndexRemoved>
-              ) => {
-                const storage = args[0]
-                if (
-                  storage.kind === `managed` &&
-                  storage.storageCollectionId !== initialStorageId &&
-                  ++rotatedRemovals === 2 &&
-                  readdDuringReconciliation
-                ) {
-                  secondRemovalEntered.resolve()
-                  await releaseSecondRemoval.promise
-                }
-                await target.markIndexRemoved(...args)
-                removalSettled.resolve()
-              }
-            }
-            const value: unknown = Reflect.get(target, property, target)
-            return typeof value === `function` ? value.bind(target) : value
-          },
-        })
-        let recover!: () => Promise<void>
-        let collection:
-          Collection<{ id: string; title: string }, string> | undefined
-        let recovery: Promise<void> | undefined
-        try {
-          collection = createCollection(
-            persistedCollectionOptions<{ id: string; title: string }, string>({
-              id: logicalId,
-              syncMode: `on-demand`,
-              getKey: (row) => row.id,
-              defaultIndexType: BasicIndex,
-              sync: {
-                sync: (params) => {
-                  recover = params.metadata!.persistence!.startScopedRecovery!
-                  params.markReady()
-                  return { restartAfterScopedRecovery: (gate) => gate }
-                },
-              },
-              persistence: { adapter },
-            }),
-          )
-          const index = collection.createIndex((row) => row.title)
-          const signature = collection
-            .getIndexMetadata()
-            .find((metadata) => metadata.indexId === index.id)?.signature
-          if (!signature) throw new Error(`Missing index signature`)
-          await collection.stateWhenReady()
-          const originalClaim = database
-            .prepare(
-              `SELECT physical_id FROM cache_generation_claim WHERE logical_id = ?`,
-            )
-            .get(logicalId) as { physical_id: string }
-          initialStorageId = originalClaim.physical_id
-          recovery = recover()
-          await reachCheckpoint(
-            ensureEntered.promise,
-            `rotated SQLite index ensure`,
-          )
-          expect(collection.removeIndex(index)).toBe(true)
-          expect(collection.getIndexMetadata()).toEqual([])
-          await reachCheckpoint(
-            removalSettled.promise,
-            `SQLite index removal before late ensure`,
-          )
-          releaseEnsure.resolve()
-          if (readdDuringReconciliation) {
-            await reachCheckpoint(
-              secondRemovalEntered.promise,
-              `SQLite reconciliation removal before index re-add`,
-            )
-            const current = collection.createIndex((row) => row.title)
-            expect(
-              collection
-                .getIndexMetadata()
-                .find((metadata) => metadata.indexId === current.id)?.signature,
-            ).toBe(signature)
-            await reachCheckpoint(
-              readdEnsureSettled.promise,
-              `SQLite re-add before reconciliation removal`,
-            )
-            releaseSecondRemoval.resolve()
-          }
-          await reachCheckpoint(recovery, `index reconciliation after rotation`)
-          const currentClaim = database
-            .prepare(
-              `SELECT physical_id FROM cache_generation_claim WHERE logical_id = ?`,
-            )
-            .get(logicalId) as { physical_id: string }
-          expect(currentClaim.physical_id).not.toBe(initialStorageId)
-          const currentIndex = database
-            .prepare(
-              `SELECT index_name, removed FROM persisted_index_registry
-               WHERE collection_id = ? AND signature = ?`,
-            )
-            .get(currentClaim.physical_id, signature) as
-            { index_name: string; removed: number } | undefined
-          if (!currentIndex) throw new Error(`Missing rotated SQLite index row`)
-          expect(currentIndex.removed).toBe(readdDuringReconciliation ? 0 : 1)
-          expect(
-            database
-              .prepare(
-                `SELECT name, tbl_name FROM sqlite_master
-                 WHERE type = 'index' AND name = ?`,
-              )
-              .all(currentIndex.index_name),
-          ).toEqual(
-            readdDuringReconciliation
-              ? [
-                  {
-                    name: currentIndex.index_name,
-                    tbl_name: createPersistedTableName(
-                      currentClaim.physical_id,
-                      `c`,
-                    ),
-                  },
-                ]
-              : [],
-          )
-          expect(collection.getIndexMetadata()).toHaveLength(
-            readdDuringReconciliation ? 1 : 0,
-          )
-        } catch (error) {
-          primaryFailure = error
-          throw error
-        } finally {
-          releaseEnsure.resolve()
-          releaseSecondRemoval.resolve()
-          const secondaryFailures: Array<unknown> = []
-          if (recovery) {
-            try {
-              await reachCheckpoint(recovery, `recovery during cleanup`, 5_000)
-            } catch (error) {
-              if (error !== primaryFailure) secondaryFailures.push(error)
-            }
-          }
-          try {
-            await collection?.cleanup()
-          } catch (error) {
-            secondaryFailures.push(error)
-          }
-          closeDatabasePreservingPrimary(
-            database,
-            primaryFailure,
-            secondaryFailures,
-          )
-        }
-      },
-    )
-  }
-
-  // A resume snapshot may pass its preliminary claim check and then wait to
-  // enter SQLite's read transaction. The independent claim rule compares the
-  // transaction's clock cut with that claim's expiry: a live claim reads its
-  // requested rows and metadata; an expired claim rejects without a snapshot.
-  // A later-acquired peer claim remains live in both histories and must keep
-  // the same durable rows and metadata. The grammar varies zero-to-three rows
-  // to distinguish empty from partial snapshots, and row inclusion to expose
-  // unwanted row reads. Peer acquisition time varies an independent expiry;
-  // the peer stays live throughout this bounded grammar. The read clock cut
-  // distinguishes live, exactly expired, and later reads for the first claim.
-  // Both claims address one physical ID. A peer acquired after the read, or
-  // expired before its own read, is not a legal history here. The six fixed
-  // histories reconstruct both row-inclusion options at exact expiry.
-  // Holding the real transaction before its claim query makes the second
-  // check, rather than the wrapper's later publication guard, the checkpoint.
-  type ManagedClaimReadHistory = {
-    elapsedMs: number
-    includeRows: boolean
-    peerDelayMs: number
-    rowCount: number
-  }
-  const assertManagedClaimReadHistory = async ({
-    elapsedMs,
-    includeRows,
-    peerDelayMs,
-    rowCount,
-  }: ManagedClaimReadHistory): Promise<void> => {
-    // The independent model uses half-open claim intervals. The peer's
-    // interval starts later, so the first claim may expire while it stays live.
-    const startAtMs = 1_000
-    const claimTtlMs = 100
-    const firstExpiresAtMs = startAtMs + claimTtlMs
-    const peerClaimsAtMs = startAtMs + peerDelayMs
-    const peerExpiresAtMs = peerClaimsAtMs + claimTtlMs
-    const readAtMs = firstExpiresAtMs + elapsedMs
-    const firstClaimCanRead = readAtMs < firstExpiresAtMs
-    expect(peerClaimsAtMs).toBeLessThan(firstExpiresAtMs)
-    expect(readAtMs).toBeGreaterThanOrEqual(peerClaimsAtMs)
-    expect(readAtMs).toBeLessThan(peerExpiresAtMs)
-    const rows = Array.from({ length: rowCount }, (_, index) => ({
-      id: `retained-${index}`,
-      title: `Warm peer row ${index}`,
-    }))
-    const expectedFirstRows = includeRows ? rows : []
-
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = startAtMs
-    const baseDriver = createDriver(database)
-    const transactionEntered = deferred()
-    const releaseTransaction = deferred()
-    let holdTransaction = false
-    let observeHeldRead = false
-    let metadataReads = 0
-    let rowReads = 0
-    const heldStatements: Array<{
-      type: `query` | `run` | `exec`
-      sql: string
-      params?: ReadonlyArray<unknown>
-    }> = []
-    let rowTable = ``
-    let observedStorageId = ``
-    const driver: SQLiteDriver = {
-      ...baseDriver,
-      transaction: (operation) =>
-        baseDriver.transaction(async (transactionDriver) => {
-          if (holdTransaction) {
-            holdTransaction = false
-            transactionEntered.resolve()
-            await releaseTransaction.promise
-          }
-          return operation({
-            ...transactionDriver,
-            query: (sql, params) => {
-              if (observeHeldRead) {
-                heldStatements.push({ type: `query`, sql, params })
-                if (sql.includes(`FROM collection_metadata`)) metadataReads++
-                if (sql.includes(rowTable)) rowReads++
-              }
-              return transactionDriver.query(sql, params)
-            },
-            run: (sql, params) => {
-              if (observeHeldRead) {
-                heldStatements.push({ type: `run`, sql, params })
-              }
-              return transactionDriver.run(sql, params)
+            run: (sql, params) => {
+              if (observeHeldRead) {
+                heldStatements.push({ type: `run`, sql, params })
+              }
+              return transactionDriver.run(sql, params)
             },
             exec: (sql) => {
               if (observeHeldRead) heldStatements.push({ type: `exec`, sql })
               return transactionDriver.exec(sql)
-            },
-          })
-        }),
-    }
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver,
-      cacheGenerationClaimTtlMs: claimTtlMs,
-      now: () => now,
-    })
-    let read: ReturnType<typeof adapter.loadResumeSnapshot> | undefined
-    try {
-      const logicalId = `held-resume-second-check`
-      const first = await adapter.claimCacheGeneration(logicalId)
-      const storageId = first.storageCollectionId
-      observedStorageId = storageId
-      // The model does not use the adapter's returned expiry to decide whether
-      // this read is legal.
-      expect(first.expiresAtMs).toBe(firstExpiresAtMs)
-      rowTable = createPersistedTableName(storageId, `c`)
-      const resume = { offset: `warm-peer-offset` }
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: storageId,
-          claimId: first.claimId,
-        },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: first.claimId,
-          mutations: rows.map((row) => ({
-            type: `insert` as const,
-            key: row.id,
-            value: row,
-          })),
-          collectionMetadataMutations: [
-            { type: `set`, key: `resume`, value: resume },
-          ],
-        },
-      )
-      now = peerClaimsAtMs
-      const warm = await adapter.claimCacheGeneration(logicalId)
-      expect(warm.storageCollectionId).toBe(storageId)
-      expect(warm.claimId).not.toBe(first.claimId)
-      expect(warm.expiresAtMs).toBe(peerExpiresAtMs)
-
-      holdTransaction = true
-      observeHeldRead = true
-      read = adapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: storageId,
-          claimId: first.claimId,
-        },
-        {
-          includeRows,
-          cacheGenerationClaimId: first.claimId,
-        },
-      )
-      void read.catch(() => undefined)
-      await reachCheckpoint(
-        transactionEntered.promise,
-        `resume transaction before its claim check`,
-      )
-      now = readAtMs
-      releaseTransaction.resolve()
-      const generationStatements = () =>
-        heldStatements.filter(
-          ({ sql, params }) =>
-            sql.includes(rowTable) ||
-            sql.includes(observedStorageId) ||
-            params?.includes(observedStorageId),
-        )
-      if (!firstClaimCanRead) {
-        await expect(read).rejects.toThrow(
-          `Persisted cache claim is no longer active`,
-        )
-        expect(generationStatements()).toHaveLength(1)
-        expect(generationStatements()[0]).toMatchObject({ type: `query` })
-        expect(generationStatements()[0]?.sql).toContain(
-          `cache_generation_claim`,
-        )
-        expect(metadataReads).toBe(0)
-        expect(rowReads).toBe(0)
-      } else {
-        const snapshot = await read
-        expect(generationStatements()[0]).toMatchObject({ type: `query` })
-        expect(generationStatements()[0]?.sql).toContain(
-          `cache_generation_claim`,
-        )
-        expect(snapshot.rows.map(({ value }) => value)).toEqual(
-          expectedFirstRows,
-        )
-        expect(snapshot.collectionMetadata).toEqual([
-          { key: `resume`, value: resume },
-        ])
-        expect(metadataReads).toBeGreaterThan(0)
-        if (includeRows) {
-          expect(rowReads).toBeGreaterThan(0)
-        } else {
-          expect(rowReads).toBe(0)
-        }
-      }
-      observeHeldRead = false
-      const peerSnapshot = await adapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: storageId,
-          claimId: warm.claimId,
-        },
-        {
-          cacheGenerationClaimId: warm.claimId,
-        },
-      )
-      expect(peerSnapshot.rows.map(({ value }) => value)).toEqual(rows)
-      expect(peerSnapshot.collectionMetadata).toEqual([
-        { key: `resume`, value: resume },
-      ])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseTransaction.resolve()
-      await Promise.allSettled([read])
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  }
-
-  it.each([
-    { clockCut: `before expiry`, elapsedMs: -1, includeRows: false },
-    { clockCut: `before expiry`, elapsedMs: -1, includeRows: true },
-    { clockCut: `at expiry`, elapsedMs: 0, includeRows: false },
-    { clockCut: `at expiry`, elapsedMs: 0, includeRows: true },
-    { clockCut: `after expiry`, elapsedMs: 1, includeRows: false },
-    { clockCut: `after expiry`, elapsedMs: 1, includeRows: true },
-  ])(
-    `checks a cache claim $clockCut inside a resume transaction with includeRows=$includeRows`,
-    ({ elapsedMs, includeRows }) =>
-      assertManagedClaimReadHistory({
-        elapsedMs,
-        includeRows,
-        peerDelayMs: 50,
-        rowCount: 1,
-      }),
-  )
-
-  const managedClaimReadHistory = fc.record({
-    elapsedMs: fc.constantFrom(-9, -1, 0, 1, 9),
-    includeRows: fc.boolean(),
-    peerDelayMs: fc.integer({ min: 10, max: 80 }),
-    rowCount: fc.integer({ min: 0, max: 3 }),
-  })
-  fcTest.prop([managedClaimReadHistory], {
-    seed: 2056,
-    numRuns: oracleRuns(30),
-  })(
-    `checks generated managed-claim read histories (fixed)`,
-    assertManagedClaimReadHistory,
-  )
-  fcTest.prop(
-    [managedClaimReadHistory],
-    oraclePropertyOptions(30, `sqlite-resume.managed-claim-read`),
-  )(
-    `checks generated managed-claim read histories (random or replayed)`,
-    assertManagedClaimReadHistory,
-  )
-
-  // Startup metadata belongs to the cache claim that admitted its SQLite
-  // snapshot. If that claim expires while the snapshot is in flight, the
-  // returned metadata cannot authorize the source run. This driver holds the
-  // real SQLite metadata query after its transaction-time claim check, moves
-  // the adapter clock past expiry, then releases the query. The source must
-  // start under fresh cache authority without observing the old resume value.
-  it(`does not publish startup metadata read under an expired cache claim`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = Date.now()
-    const baseDriver = createDriver(database)
-    const metadataReadEntered = deferred()
-    const releaseMetadataRead = deferred()
-    let holdMetadataRead = false
-    const driver: SQLiteDriver = {
-      ...baseDriver,
-      transaction: (transaction) =>
-        baseDriver.transaction((transactionDriver) =>
-          transaction({
-            ...transactionDriver,
-            query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
-              const rows = await transactionDriver.query<T>(sql, params)
-              if (
-                holdMetadataRead &&
-                sql.includes(`FROM collection_metadata`)
-              ) {
-                holdMetadataRead = false
-                metadataReadEntered.resolve()
-                await releaseMetadataRead.promise
-              }
-              return rows
-            },
-          }),
-        ),
-    }
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver,
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => now,
-    })
-    const logicalId = `expired-startup-metadata`
-    let collection: Collection<{ id: string }, string> | undefined
-    try {
-      const seed = await adapter.claimCacheGeneration(logicalId)
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: seed.storageCollectionId,
-          claimId: seed.claimId,
-        },
-        {
-          txId: `seed-resume`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: seed.claimId,
-          mutations: [],
-          collectionMetadataMutations: [
-            { type: `set`, key: `resume`, value: `old-resume` },
-          ],
-        },
-      )
-      expect(
-        (
-          await adapter.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: seed.storageCollectionId,
-              claimId: seed.claimId,
-            },
-            {
-              includeRows: false,
-              cacheGenerationClaimId: seed.claimId,
-            },
-          )
-        ).collectionMetadata,
-      ).toContainEqual({ key: `resume`, value: `old-resume` })
-      await adapter.releaseCacheGenerationClaim(seed.claimId)
-
-      const sourceResumeValues: Array<unknown> = []
-      const sourceStarted = deferred()
-      collection = createCollection(
-        persistedCollectionOptions<{ id: string }, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (source) => {
-              sourceResumeValues.push(source.metadata?.collection.get(`resume`))
-              source.markReady()
-              sourceStarted.resolve()
-              return { restartAfterScopedRecovery: () => {} }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      holdMetadataRead = true
-      collection.startSyncImmediate()
-      await reachCheckpoint(
-        metadataReadEntered.promise,
-        `managed startup metadata snapshot`,
-      )
-      expect(sourceResumeValues).toEqual([])
-      now += 11_000
-      releaseMetadataRead.resolve()
-      await reachCheckpoint(
-        sourceStarted.promise,
-        `source startup after expired metadata read`,
-      )
-      await vi.waitFor(() => expect(collection?.status).toBe(`ready`))
-      expect(sourceResumeValues).toEqual([undefined])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseMetadataRead.resolve()
-      try {
-        await collection?.cleanup()
-      } catch (error) {
-        primaryFailure ??= error
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // The SQLite claim rule and the wrapper recovery rule meet at startup.
-  // One run pauses before dispatching its real SQLite resume read; a later peer claims the
-  // same physical generation and remains live when the first claim expires.
-  // The model has two independent authorities: the peer may keep the old row
-  // and cursor, while the expired run must bind private storage and settle a
-  // demand only from a fresh source row. The held read entry is outside a
-  // write transaction so the peer can make its legal later claim. The real
-  // SQLite adapter then supplies the rejection; the separate transaction
-  // oracle owns its later in-transaction claim check.
-  // This receiving history does not model arbitrary browser scheduling.
-  it(`composes SQLite startup claim rejection with private subset recovery`, async () => {
-    type Row = { id: string; title: string }
-    const database = new DatabaseSync(`:memory:`)
-    const baseDriver = createDriver(database)
-    const readEntered = deferred()
-    const releaseRead = deferred()
-    let holdRead = false
-    let now = 1_000
-    // Keep the real renewal timer outside this controlled-clock history.
-    // Only the test's virtual time jump may expire the held claim.
-    const claimTtlMs = 1_000_000
-    const firstAdapter = new SQLiteCorePersistenceAdapter({
-      driver: baseDriver,
-      cacheGenerationClaimTtlMs: claimTtlMs,
-      now: () => now,
-    })
-    const sqliteReadRejections: Array<string> = []
-    const realHydrationScope =
-      firstAdapter.runInHydrationScope.bind(firstAdapter)
-    firstAdapter.runInHydrationScope = (task) =>
-      realHydrationScope((hydrationAdapter) =>
-        task({
-          ...hydrationAdapter,
-          loadResumeSnapshot: async (...args) => {
-            if (holdRead) {
-              holdRead = false
-              readEntered.resolve()
-              await releaseRead.promise
-            }
-            try {
-              return await hydrationAdapter.loadResumeSnapshot(...args)
-            } catch (error) {
-              sqliteReadRejections.push(String(error))
-              throw error
-            }
-          },
-        }),
-      )
-    const peerAdapter = new SQLiteCorePersistenceAdapter({
-      driver: baseDriver,
-      cacheGenerationClaimTtlMs: claimTtlMs,
-      now: () => now,
-    })
-    const logicalId = `composed-startup-claim-rejection`
-    const old: Row = { id: `old`, title: `Peer row` }
-    const fresh: Row = { id: `fresh`, title: `New source row` }
-    let expired: Collection<Row, string> | undefined
-    let peer: Collection<Row, string> | undefined
-    let seedClaimId: string | undefined
-    let firstSource: Parameters<SyncConfig<Row, string>[`sync`]>[0] | undefined
-    const firstSourceStarted = deferred()
-    const sourceLoads: Array<boolean | undefined> = []
-    let primaryFailure: unknown
-    try {
-      const seed = await peerAdapter.claimCacheGeneration(logicalId)
-      seedClaimId = seed.claimId
-      await peerAdapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: seed.storageCollectionId,
-          claimId: seed.claimId,
-        },
-        {
-          txId: `seed-old`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: seed.claimId,
-          mutations: [{ type: `insert`, key: old.id, value: old }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `resume`, value: `old-cursor` },
-          ],
-        },
-      )
-      await peerAdapter.releaseCacheGenerationClaim(seed.claimId)
-      seedClaimId = undefined
-
-      expired = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              firstSource = params
-              expect(params.metadata?.collection.get(`resume`)).toBeUndefined()
-              params.markReady()
-              firstSourceStarted.resolve()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async (options) => {
-                  sourceLoads.push(options.refetch)
-                  params.begin()
-                  params.write({ type: `insert`, value: fresh })
-                  await whenSyncAccepted(params.commit())
-                },
-              }
-            },
-          },
-          persistence: { adapter: firstAdapter },
-        }),
-      )
-      holdRead = true
-      expired.startSyncImmediate()
-      await reachCheckpoint(readEntered.promise, `first SQLite claim read`)
-      expect(firstSource).toBeUndefined()
-
-      now = 501_000
-      peer = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: logicalId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              params.markReady()
-              return {
-                restartAfterScopedRecovery: () => {},
-                loadSubset: async () => {},
-              }
-            },
-          },
-          persistence: { adapter: peerAdapter },
-        }),
-      )
-      peer.startSyncImmediate()
-      await peer.stateWhenReady()
-      await peer._sync.loadSubset({ limit: 1 })
-      expect(peer.get(old.id)).toMatchObject(old)
-
-      now = 1_001_001
-      releaseRead.resolve()
-      await reachCheckpoint(
-        firstSourceStarted.promise,
-        `source after claim loss`,
-      )
-      await expired.stateWhenReady()
-      const headAfterStartup = database
-        .prepare(
-          `SELECT physical_id FROM cache_generation
-           WHERE logical_id = ? AND retired = 0`,
-        )
-        .get(logicalId) as { physical_id: string }
-      expect(headAfterStartup.physical_id).toBe(seed.storageCollectionId)
-      expect(sqliteReadRejections).toHaveLength(1)
-      expect(sqliteReadRejections[0]).toContain(
-        `Persisted cache claim is no longer active`,
-      )
-      expect(expired.get(old.id)).toBeUndefined()
-      await expired._sync.loadSubset({ limit: 1 })
-      // This is the first demand against empty private storage, so it is an
-      // ordinary source load. The fresh row and private durable destination,
-      // not a refetch flag, establish the recovery obligation.
-      expect(sourceLoads).toEqual([undefined])
-      expect(expired.get(old.id)).toBeUndefined()
-      expect(expired.get(fresh.id)).toMatchObject(fresh)
-      expect(peer.get(old.id)).toMatchObject(old)
-      expect(peer.get(fresh.id)).toBeUndefined()
-
-      const head = database
-        .prepare(
-          `SELECT physical_id FROM cache_generation
-           WHERE logical_id = ? AND retired = 0`,
-        )
-        .get(logicalId) as { physical_id: string }
-      expect(head.physical_id).toBe(seed.storageCollectionId)
-      const claims = database
-        .prepare(
-          `SELECT physical_id, claim_id FROM cache_generation_claim
-           WHERE logical_id = ? ORDER BY physical_id`,
-        )
-        .all(logicalId) as Array<{ physical_id: string; claim_id: string }>
-      const peerClaim = claims.find(
-        ({ physical_id }) => physical_id === seed.storageCollectionId,
-      )
-      const privateClaim = claims.find(
-        ({ physical_id }) => physical_id !== seed.storageCollectionId,
-      )
-      expect(peerClaim).toBeDefined()
-      expect(privateClaim).toBeDefined()
-      expect(
-        await peerAdapter.loadResumeSnapshot(
-          {
-            kind: `managed`,
-            storageCollectionId: seed.storageCollectionId,
-            claimId: peerClaim!.claim_id,
-          },
-          {
-            cacheGenerationClaimId: peerClaim!.claim_id,
-          },
-        ),
-      ).toMatchObject({
-        rows: [{ key: old.id, value: old }],
-        collectionMetadata: [{ key: `resume`, value: `old-cursor` }],
-      })
-      expect(
-        (
-          await firstAdapter.loadResumeSnapshot(
-            {
-              kind: `managed`,
-              storageCollectionId: privateClaim!.physical_id,
-              claimId: privateClaim!.claim_id,
-            },
-            {
-              cacheGenerationClaimId: privateClaim!.claim_id,
-            },
-          )
-        ).rows.map(({ value }) => value),
-      ).toEqual([fresh])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      releaseRead.resolve()
-      const cleanupFailures: Array<unknown> = []
-      for (const cleanup of [
-        () => expired?.cleanup(),
-        () => peer?.cleanup(),
-        () =>
-          seedClaimId
-            ? peerAdapter.releaseCacheGenerationClaim(seedClaimId)
-            : undefined,
-      ]) {
-        try {
-          await cleanup()
-        } catch (error) {
-          cleanupFailures.push(error)
-        }
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure, cleanupFailures)
-    }
-  })
-
-  // The adapter-level expiry law must reach the real persisted wrapper. A
-  // source commit after a long pause is admitted before any timer callback;
-  // it must reject without publishing under the expired claim. The same sync
-  // run then writes a fresh source result into new storage. This receiving
-  // witness checks SQLite rows as well as the public Collection snapshot.
-  it(`reloads source writes into a new SQLite generation after claim expiry`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let now = Date.now()
-    const logicalId = `expired-sqlite-source`
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver: createDriver(database),
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => now,
-    })
-    let source!: Parameters<SyncConfig<{ id: string }, string>[`sync`]>[0]
-    const collection = createCollection(
-      persistedCollectionOptions<{ id: string }, string>({
-        id: logicalId,
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            source = params
-            params.markReady()
-            // This controlled source has no delayed provider callbacks.
-            return {
-              // An on-demand source serves the subsets that recovery
-              // reacquires in the new generation.
-              loadSubset: () => true,
-              restartAfterScopedRecovery: () => {},
-            }
-          },
-        },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await collection.stateWhenReady()
-      await source.metadata!.persistence!.hydrateBaseline()
-      const oldHead = database
-        .prepare(
-          `SELECT physical_id FROM cache_generation
-           WHERE logical_id = ? AND retired = 0`,
-        )
-        .get(logicalId) as { physical_id: string }
-      now += 11_000
-      source.begin()
-      source.write({ type: `insert`, value: { id: `expired` } })
-      const oldReceipt = source.commit()
-      if (oldReceipt === true) throw new Error(`source receipt was not tracked`)
-      await expect(oldReceipt).rejects.toThrow()
-      await vi.waitFor(() => {
-        const claim = database
-          .prepare(
-            `SELECT physical_id FROM cache_generation_claim
-             WHERE logical_id = ?`,
-          )
-          .get(logicalId) as { physical_id: string } | undefined
-        expect(claim?.physical_id).toBeDefined()
-        expect(claim?.physical_id).not.toBe(oldHead.physical_id)
-      })
-      expect(
-        database
-          .prepare(
-            `SELECT physical_id FROM cache_generation
-             WHERE logical_id = ? AND retired = 0`,
-          )
-          .get(logicalId),
-      ).toMatchObject(oldHead)
-      await collection._sync.loadSubset({ limit: 0 })
-      expect(collection.get(`expired`)).toBeUndefined()
-      source.begin()
-      source.write({ type: `insert`, value: { id: `fresh` } })
-      await whenSyncAccepted(source.commit())
-      // Recovery succeeded: the Collection still accepts sync data.
-      expect(collection.status).toBe(`ready`)
-      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
-      const claims = database
-        .prepare(
-          `SELECT physical_id, claim_id FROM cache_generation_claim
-           WHERE logical_id = ?`,
-        )
-        .all(logicalId) as Array<{ physical_id: string; claim_id: string }>
-      expect(claims).toHaveLength(1)
-      expect(
-        (
-          await adapter.scanRows(
-            {
-              kind: `managed`,
-              storageCollectionId: claims[0]!.physical_id,
-              claimId: claims[0]!.claim_id,
-            },
-            undefined,
-            {
-              cacheGenerationClaimId: claims[0]!.claim_id,
-            },
-          )
-        ).map(({ key }) => key),
-      ).toEqual([`fresh`])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      try {
-        await collection.cleanup()
-      } catch (error) {
-        primaryFailure ??= error
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  // A recovering on-demand sync run must advance the current persisted cache
-  // generation before it accepts further source commits. The old generation
-  // remains available to an existing claim, but no new run may inherit its
-  // stale row. The independent expectation is two disjoint durable row maps:
-  // old={stale}, current={fresh}, with the current key set uncertified. This
-  // production driver enters through the persisted wrapper capability, then
-  // checks SQLite snapshots after recovery and one source sync transaction.
-  // The reset marker belongs to the new generation: without it, a later run
-  // could mistake the partial cache for a resumable baseline.
-  it(`moves scoped recovery to a new persisted cache generation`, async () => {
-    type Row = { id: string; title: string }
-    const database = new DatabaseSync(`:memory:`)
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver: createDriver(database),
-    })
-    let collection: Collection<Row, string> | undefined
-    let seedClaimId: string | undefined
-    let currentClaimId: string | undefined
-    let primaryFailure: unknown
-    try {
-      const collectionId = `scoped-generation-boundary`
-      const staleRow: Row = { id: `stale`, title: `Old cached row` }
-      const seedClaim = await adapter.claimCacheGeneration(collectionId)
-      seedClaimId = seedClaim.claimId
-      await adapter.applyCommittedTx(
-        {
-          kind: `managed`,
-          storageCollectionId: seedClaim.storageCollectionId,
-          claimId: seedClaim.claimId,
-        },
-        {
-          txId: `seed-stale-row`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          cacheGenerationClaimId: seedClaim.claimId,
-          mutations: [{ type: `insert`, key: staleRow.id, value: staleRow }],
-        },
-      )
-
-      let source: Parameters<SyncConfig<Row, string>[`sync`]>[0] | undefined
-      const sourceReady = deferred()
-      collection = createCollection(
-        persistedCollectionOptions<Row, string>({
-          id: collectionId,
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          sync: {
-            sync: (params) => {
-              source = params
-              params.markReady()
-              sourceReady.resolve()
-              return {
-                loadSubset: async () => {},
-                restartAfterScopedRecovery: () => {},
-              }
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      collection.startSyncImmediate()
-      await reachCheckpoint(sourceReady.promise, `on-demand source start`)
-      const capability = source?.metadata?.persistence
-      expect(capability?.startScopedRecovery).toBeTypeOf(`function`)
-      const resetMarker = { kind: `reset`, updatedAt: 3 }
-      await capability!.startScopedRecovery!({
-        key: `electric:resume`,
-        value: resetMarker,
-      })
-
-      const currentClaim = await adapter.claimCacheGeneration(collectionId)
-      currentClaimId = currentClaim.claimId
-      expect(currentClaim.storageCollectionId).not.toBe(
-        seedClaim.storageCollectionId,
-      )
-      const freshRow: Row = { id: `fresh`, title: `Demanded source row` }
-      source!.begin()
-      source!.write({ type: `insert`, value: freshRow })
-      await whenSyncAccepted(source!.commit())
-
-      const oldSnapshot = await adapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: seedClaim.storageCollectionId,
-          claimId: seedClaim.claimId,
-        },
-        { cacheGenerationClaimId: seedClaim.claimId },
-      )
-      const currentSnapshot = await adapter.loadResumeSnapshot(
-        {
-          kind: `managed`,
-          storageCollectionId: currentClaim.storageCollectionId,
-          claimId: currentClaim.claimId,
-        },
-        { cacheGenerationClaimId: currentClaim.claimId },
-      )
-      expect(oldSnapshot.rows.map(({ value }) => value)).toEqual([staleRow])
-      expect(currentSnapshot.rows.map(({ value }) => value)).toEqual([freshRow])
-      expect(currentSnapshot.keySet).toEqual({ status: `incompatible` })
-      expect(currentSnapshot.collectionMetadata).toContainEqual({
-        key: `electric:resume`,
-        value: resetMarker,
-      })
-      expect(collection.get(`stale`)).toBeUndefined()
-      expect(collection.get(`fresh`)).toMatchObject(freshRow)
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      const cleanupFailures: Array<unknown> = []
-      try {
-        await collection?.cleanup()
-      } catch (error) {
-        cleanupFailures.push(error)
-      }
-      try {
-        if (currentClaimId !== undefined) {
-          await adapter.releaseCacheGenerationClaim(currentClaimId)
-        }
-        if (seedClaimId !== undefined) {
-          await adapter.releaseCacheGenerationClaim(seedClaimId)
-        }
-      } catch (error) {
-        cleanupFailures.push(error)
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure, cleanupFailures)
-    }
-  })
-
-  const startupHistoryArbitrary = fc.record({
-    baselineSize: fc.integer({ min: 1, max: 3 }),
-    transition: fc.constantFrom(
-      `none` as const,
-      `managed-insert` as const,
-      `raw-delete` as const,
-    ),
-  })
-
-  type StartupRow = { id: string; title: string }
-  const expectStartupRows = (
-    actual: Array<StartupRow>,
-    expected: Array<StartupRow>,
-  ) => expect(actual).toEqual(expected)
-
-  const assertStartupHistory = async (history: {
-    baselineSize: number
-    transition: `none` | `managed-insert` | `raw-delete`
-  }) => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    let releaseInitialSnapshot = () => {}
-    let collection:
-      Collection<{ id: string; title: string }, string> | undefined
-    try {
-      const driver = createDriver(database)
-      const collectionId = `generated-local-startup`
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      const baselineRows = Array.from(
-        { length: history.baselineSize },
-        (_, index) => ({
-          id: `baseline-${index}`,
-          title: `baseline-${index}`,
-        }),
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          truncate: true,
-          mutations: baselineRows.map((row) => ({
-            type: `insert` as const,
-            key: row.id,
-            value: row,
-          })),
-        },
-      )
-
-      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
-      const reachedInitialSnapshot = deferred()
-      const reachedHydrationSnapshot = deferred()
-      const initialSnapshotRelease = deferred()
-      releaseInitialSnapshot = initialSnapshotRelease.resolve
-      let snapshotCalls = 0
-      const runInHydrationScope = adapter.runInHydrationScope.bind(adapter)
-      adapter.runInHydrationScope = (task) =>
-        runInHydrationScope((scopedAdapter) =>
-          task({
-            ...scopedAdapter,
-            loadResumeSnapshot: async (...args) => {
-              const snapshot = await scopedAdapter.loadResumeSnapshot(...args)
-              snapshotCalls++
-              if (snapshotCalls === 1) {
-                reachedInitialSnapshot.resolve()
-                await initialSnapshotRelease.promise
-              } else if (snapshotCalls === 2) {
-                reachedHydrationSnapshot.resolve()
-              }
-              return snapshot
-            },
-          }),
-        )
-
-      collection = createCollection(
-        persistedCollectionOptions<{ id: string; title: string }, string>({
-          id: collectionId,
-          startSync: false,
-          getKey: (row) => row.id,
-          persistence: { adapter },
-        }),
-      )
-      collection.startSyncImmediate()
-      await reachCheckpoint(
-        reachedInitialSnapshot.promise,
-        `generated local startup metadata snapshot`,
-      )
-
-      const managedRow = {
-        id: `managed`,
-        title: `managed-during-startup`,
-      }
-      let managedPersistence: Promise<unknown> | undefined
-      let managedPersistenceSettled = false
-      if (history.transition === `managed-insert`) {
-        managedPersistence = collection.insert(managedRow).isPersisted.promise
-        void managedPersistence.then(
-          () => {
-            managedPersistenceSettled = true
-          },
-          () => {
-            managedPersistenceSettled = true
-          },
-        )
-        for (let attempt = 0; attempt < 20; attempt++) {
-          await Promise.resolve()
-        }
-        expect(managedPersistenceSettled).toBe(false)
-      } else if (history.transition === `raw-delete`) {
-        const tableName = createPersistedTableName(collectionId, `c`)
-        await driver.run(`DELETE FROM "${tableName}" WHERE key = ?`, [
-          encodePersistedStorageKey(baselineRows[0]!.id),
-        ])
-      }
-
-      releaseInitialSnapshot()
-      await managedPersistence
-      await collection.stateWhenReady()
-      await reachCheckpoint(
-        reachedHydrationSnapshot.promise,
-        `generated local startup hydration snapshot`,
-      )
-      const visibleRows = Array.from(collection.values(), ({ id, title }) => ({
-        id,
-        title,
-      })).sort((left, right) => left.id.localeCompare(right.id))
-      const expectedRows =
-        history.transition === `raw-delete`
-          ? []
-          : [
-              ...baselineRows,
-              ...(history.transition === `managed-insert` ? [managedRow] : []),
-            ].sort((left, right) => left.id.localeCompare(right.id))
-
-      expectStartupRows(visibleRows, expectedRows)
-      if (history.transition === `managed-insert`) {
-        const durableRows = (
-          await loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionId,
-          })
-        ).rows
-          .map(({ value }) => value)
-          .sort((left, right) =>
-            String(left.id).localeCompare(String(right.id)),
-          )
-        expect(durableRows).toEqual(expectedRows)
-      }
-      if (history.transition === `raw-delete`) {
-        expect(
-          (
-            await loadResumeSnapshot({
-              kind: `eager`,
-              collectionId: collectionId,
-            })
-          ).keySet,
-        ).toEqual({
-          status: `incompatible`,
-        })
-      }
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      releaseInitialSnapshot()
-      try {
-        await collection?.cleanup()
-      } catch (cleanupError) {
-        if (primaryFailure === undefined) primaryFailure = cleanupError
-      }
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  }
-
-  it(`rejects a startup answer that suppresses the older baseline after a managed generation advance`, () => {
-    const baseline = { id: `baseline-0`, title: `baseline-0` }
-    const managed = { id: `managed`, title: `managed-during-startup` }
-    expect(() => expectStartupRows([managed], [baseline, managed])).toThrow()
-  })
-
-  it(`fixed startup corpus reaches every baseline size and transition`, () => {
-    const histories = fc.sample(startupHistoryArbitrary, {
-      seed: 1659,
-      numRuns: 12,
-    })
-    expect(new Set(histories.map(({ baselineSize }) => baselineSize))).toEqual(
-      new Set([1, 2, 3]),
-    )
-    expect(new Set(histories.map(({ transition }) => transition))).toEqual(
-      new Set([`none`, `managed-insert`, `raw-delete`]),
-    )
-  })
-
-  fcTest.prop([startupHistoryArbitrary], {
-    seed: 1659,
-    numRuns: oracleRuns(12),
-  })(
-    `preserves local-only startup histories across managed generation advancement (fixed)`,
-    assertStartupHistory,
-  )
-
-  fcTest.prop(
-    [startupHistoryArbitrary],
-    oraclePropertyOptions(12, `sqlite-resume.startup-generation`),
-  )(
-    `preserves local-only startup histories across managed generation advancement (random or replayed)`,
-    assertStartupHistory,
-  )
-
-  it(`reads key-set evidence without rescanning key membership`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const collectionId = `evidence-work`
-      const tableName = createPersistedTableName(collectionId, `c`)
-      let keyEvidenceReads = 0
-      let keyMembershipScans = 0
-      const driver = createDriver(database, undefined, (sql) => {
-        // A schema probe names these tables but reads neither.
-        if (sql.includes(`sqlite_master`)) return
-        if (sql.includes(`key_set_evidence_available`)) keyEvidenceReads += 1
-        if (sql.includes(`collection_expected_keys`)) {
-          keyMembershipScans += 1
-        }
-      })
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            { type: `insert`, key: 1, value: { id: 1, name: `one` } },
-          ],
-        },
-      )
-
-      const observeWork = () => ({ keyEvidenceReads, keyMembershipScans })
-      const resetWork = () => {
-        keyEvidenceReads = 0
-        keyMembershipScans = 0
-      }
-
-      await driver.query(
-        `SELECT key FROM collection_expected_keys
-         WHERE collection_id = ?
-         LIMIT 0`,
-        [collectionId],
-      )
-      expect(observeWork().keyMembershipScans).toBe(1)
-
-      resetWork()
-      const position = await adapter.getStreamPosition({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      const leadershipClaim = observeWork()
-
-      resetWork()
-      const consistent = await adapter.loadResumeSnapshot(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          includeRows: false,
-        },
-      )
-      const consistentSnapshot = observeWork()
-
-      await driver.run(`DELETE FROM "${tableName}"`)
-      resetWork()
-      const incompatible = await adapter.loadResumeSnapshot(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          includeRows: false,
-        },
-      )
-      const incompatibleSnapshot = observeWork()
-
-      expect({
-        position,
-        leadershipClaim,
-        consistentKeySet: consistent.keySet,
-        consistentSnapshot,
-        incompatibleKeySet: incompatible.keySet,
-        incompatibleSnapshot,
-      }).toEqual({
-        position: {
-          latestTerm: 1,
-          latestSeq: 1,
-          latestRowVersion: 1,
-        },
-        leadershipClaim: {
-          keyEvidenceReads: 0,
-          keyMembershipScans: 0,
-        },
-        consistentKeySet: { status: `consistent` },
-        consistentSnapshot: {
-          keyEvidenceReads: 1,
-          keyMembershipScans: 0,
-        },
-        incompatibleKeySet: { status: `incompatible` },
-        incompatibleSnapshot: {
-          keyEvidenceReads: 1,
-          keyMembershipScans: 0,
-        },
-      })
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`does not amplify legacy writes while key-set evidence is unavailable`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const collectionId = `legacy-write-'work`
-      const tableName = createPersistedTableName(collectionId, `c`)
-      const driver = createDriver(database)
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-
-      await adapter.loadResumeSnapshot(
-        { kind: `eager`, collectionId: collectionId },
-        { includeRows: false },
-      )
-      await driver.run(
-        `UPDATE collection_version
-         SET key_set_evidence_available = 0,
-             key_set_evidence_incompatible = 0
-         WHERE collection_id = ?`,
-        [collectionId],
-      )
-      const before = await driver.query<{ count: number }>(
-        `SELECT total_changes() AS count`,
-      )
-
-      await driver.run(
-        `INSERT INTO "${tableName}" (key, value, metadata, row_version)
-         VALUES (?, ?, NULL, 1)`,
-        [encodePersistedStorageKey(`legacy`), `{}`],
-      )
-
-      const after = await driver.query<{ count: number }>(
-        `SELECT total_changes() AS count`,
-      )
-      const version = await driver.query<{
-        key_set_evidence_incompatible: number
-      }>(
-        `SELECT key_set_evidence_incompatible
-         FROM collection_version
-         WHERE collection_id = ?`,
-        [collectionId],
-      )
-      expect((after[0]?.count ?? 0) - (before[0]?.count ?? 0)).toBe(1)
-      expect(version).toEqual([{ key_set_evidence_incompatible: 0 }])
-
-      const beforeKeyUpdate = await driver.query<{ count: number }>(
-        `SELECT total_changes() AS count`,
-      )
-      await driver.run(`UPDATE "${tableName}" SET key = ? WHERE key = ?`, [
-        encodePersistedStorageKey(`legacy-renamed`),
-        encodePersistedStorageKey(`legacy`),
-      ])
-      const afterKeyUpdate = await driver.query<{ count: number }>(
-        `SELECT total_changes() AS count`,
-      )
-      expect(
-        (afterKeyUpdate[0]?.count ?? 0) - (beforeKeyUpdate[0]?.count ?? 0),
-      ).toBe(1)
-
-      const triggerDefinitions = await driver.query<{ sql: string }>(
-        `SELECT sql
-         FROM sqlite_schema
-         WHERE type = 'trigger' AND tbl_name = ?`,
-        [tableName],
-      )
-      expect(triggerDefinitions).toHaveLength(3)
-      expect(triggerDefinitions.map(({ sql }) => sql).join(`\n`)).not.toContain(
-        `collection_registry`,
-      )
-      expect(
-        (
-          await adapter.loadResumeSnapshot(
-            { kind: `eager`, collectionId: collectionId },
-            { includeRows: false },
-          )
-        ).keySet,
-      ).toEqual({ status: `unknown` })
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`keeps raw key loss sticky until a full replacement recertifies the baseline`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const collectionId = `resume-ledger`
-      const tableName = createPersistedTableName(collectionId, `c`)
-      let rejectCollectionInsert = false
-      const driver = createDriver(
-        database,
-        (sql) =>
-          rejectCollectionInsert && sql.includes(`INSERT INTO "${tableName}"`),
-      )
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            { type: `insert`, key: 1, value: { id: 1, name: `one` } },
-            { type: `insert`, key: 2, value: { id: 2, name: `two` } },
-          ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `10_0` },
-          ],
-        },
-      )
-
-      const initial = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(initial.keySet).toEqual({ status: `consistent` })
-      expect(initial.rows.map(({ key }) => key)).toEqual([1, 2])
-      expect(initial.collectionMetadata).toEqual([
-        { key: `cursor`, value: `10_0` },
-      ])
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `normal-update`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            { type: `update`, key: 1, value: { id: 1, name: `updated-one` } },
-          ],
-        },
-      )
-      const updated = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(updated.rows.find(({ key }) => key === 1)?.value).toEqual({
-        id: 1,
-        name: `updated-one`,
-      })
-      expect(updated.keySet).toEqual({ status: `consistent` })
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `normal-delete`,
-          term: 1,
-          seq: 3,
-          rowVersion: 3,
-          mutations: [
-            { type: `delete`, key: 2, value: { id: 2, name: `two` } },
-          ],
-        },
-      )
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `normal-delete`,
-          term: 1,
-          seq: 3,
-          rowVersion: 3,
-          mutations: [
-            { type: `delete`, key: 2, value: { id: 2, name: `two` } },
-          ],
-        },
-      )
-      const deleted = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(deleted.rows.map(({ key }) => key)).toEqual([1])
-      expect(deleted.keySet).toEqual({ status: `consistent` })
-
-      rejectCollectionInsert = true
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `rolled-back-insert`,
-            term: 1,
-            seq: 4,
-            rowVersion: 4,
-            mutations: [{ type: `insert`, key: 3, value: { id: 3 } }],
-          },
-        ),
-      ).rejects.toThrow(`injected transaction failure`)
-      rejectCollectionInsert = false
-      const rolledBack = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(rolledBack.rows.map(({ key }) => key)).toEqual([1])
-      expect(rolledBack.keySet).toEqual({ status: `consistent` })
-      expect(
-        await driver.query<{ count: number }>(
-          `SELECT COUNT(*) AS count FROM collection_expected_keys WHERE collection_id = ?`,
-          [collectionId],
-        ),
-      ).toEqual([{ count: 1 }])
-      expect(
-        await driver.query<{ count: number }>(
-          `SELECT COUNT(*) AS count FROM applied_tx WHERE collection_id = ? AND tx_id = ?`,
-          [collectionId, `normal-delete`],
-        ),
-      ).toEqual([{ count: 1 }])
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `restore-second-row`,
-          term: 1,
-          seq: 5,
-          rowVersion: 5,
-          mutations: [
-            { type: `insert`, key: 2, value: { id: 2, name: `two` } },
-          ],
-        },
-      )
-
-      await driver.run(`DELETE FROM "${tableName}" WHERE key = ?`, [
-        database
-          .prepare(`SELECT key FROM "${tableName}" ORDER BY key LIMIT 1`)
-          .get()!.key,
-      ])
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `metadata-after-loss`,
-          term: 1,
-          seq: 6,
-          rowVersion: 6,
-          mutations: [],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `11_0` },
-          ],
-        },
-      )
-      expect(
-        (
-          await adapter.loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionId,
-          })
-        ).keySet,
-      ).toEqual({
-        status: `incompatible`,
-      })
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `full-replacement`,
-          term: 1,
-          seq: 7,
-          rowVersion: 7,
-          truncate: true,
-          mutations: [
-            { type: `insert`, key: 1, value: { id: 1, name: `one` } },
-            { type: `insert`, key: 2, value: { id: 2, name: `two` } },
-          ],
-        },
-      )
-      expect(
-        (
-          await adapter.loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionId,
-          })
-        ).keySet,
-      ).toEqual({
-        status: `consistent`,
-      })
-
-      await driver.run(
-        `UPDATE "${tableName}" SET key = key || '-replacement' WHERE rowid = (SELECT MIN(rowid) FROM "${tableName}")`,
-      )
-      const substituted = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(substituted.rows).toHaveLength(2)
-      expect(substituted.keySet).toEqual({ status: `incompatible` })
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`writes a cold replacement with exact values and bounded database calls`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      let databaseCalls = 0
-      let maxReplacementBoundParameters = 0
-      const driver = createDriver(
-        database,
-        undefined,
-        () => databaseCalls++,
-        (_sql, params) => {
-          databaseCalls++
-          maxReplacementBoundParameters = Math.max(
-            maxReplacementBoundParameters,
-            params.length,
-          )
-        },
-      )
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      const collectionId = `cold-replacement-work`
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `previous-generation`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            { type: `insert`, key: `old`, value: { id: `old`, title: `old` } },
-          ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `electric:resume`, value: { offset: `old` } },
-          ],
-        },
-      )
-
-      const rows = Array.from({ length: 205 }, (_, index) => {
-        const id = `row-${String(index).padStart(3, `0`)}`
-        return { id, title: `Title ${index}` }
-      })
-      databaseCalls = 0
-      maxReplacementBoundParameters = 0
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `cold-replacement`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          truncate: true,
-          mutations: rows.map((row) => ({
-            type: `update` as const,
-            key: row.id,
-            value: row,
-            metadataChanged: true,
-            metadata: { source: `row-write` },
-          })),
-          rowMetadataMutations: [
-            ...rows
-              .filter((_, index) => index % 2 === 0)
-              .map((row) => ({
-                type: `set` as const,
-                key: row.id,
-                value: { source: `electric`, operation: `insert` },
-              })),
-            { type: `delete`, key: rows[0]!.id },
-            { type: `set`, key: `absent`, value: { ignored: true } },
-          ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `electric:resume`, value: { offset: `2_0` } },
-          ],
-        },
-      )
-      const replacementCalls = databaseCalls
-
-      const snapshot = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      const expectedRows = rows.map((row, index) => ({
-        key: row.id,
-        value: row,
-        metadata:
-          index === 0
-            ? undefined
-            : index % 2 === 0
-              ? { source: `electric`, operation: `insert` }
-              : { source: `row-write` },
-      }))
-      const byKey = (
-        left: { key: string | number },
-        right: { key: string | number },
-      ) => String(left.key).localeCompare(String(right.key))
-      // A durable snapshot has no row-order contract. Challenge the comparison
-      // with a valid alternate scan order while retaining every row and value.
-      const rowsInAlternateScanOrder = [...snapshot.rows].reverse()
-      expect(rowsInAlternateScanOrder.sort(byKey)).toEqual(
-        expectedRows.sort(byKey),
-      )
-      expect(snapshot.collectionMetadata).toEqual([
-        { key: `electric:resume`, value: { offset: `2_0` } },
-      ])
-      expect(snapshot.keySet).toEqual({ status: `consistent` })
-      expect(snapshot.latestTerm).toBe(1)
-      expect(snapshot.latestSeq).toBe(2)
-      expect(snapshot.latestRowVersion).toBe(2)
-      expect(
-        await driver.query<{ key: string }>(
-          `SELECT key FROM collection_expected_keys WHERE collection_id = ? ORDER BY key`,
-          [collectionId],
-        ),
-      ).toEqual(rows.map((row) => ({ key: encodePersistedStorageKey(row.id) })))
-      expect(
-        await driver.query<{ tx_id: string }>(
-          `SELECT tx_id FROM applied_tx WHERE collection_id = ? ORDER BY seq`,
-          [collectionId],
-        ),
-      ).toEqual([
-        { tx_id: `previous-generation` },
-        { tx_id: `cold-replacement` },
-      ])
-      // The host-dependent cost is a database call, not the in-process timing.
-      expect(replacementCalls).toBeLessThanOrEqual(40)
-      expect(maxReplacementBoundParameters).toBe(500)
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`rolls back every cold replacement chunk when a later chunk fails`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const collectionId = `cold-replacement-rollback`
-      const tableName = createPersistedTableName(collectionId, `c`)
-      let bulkRowInserts = 0
-      let injectFailure = false
-      const driver = createDriver(database, (sql) => {
-        if (
-          !injectFailure ||
-          !sql.includes(`INSERT INTO "${tableName}"`) ||
-          !sql.includes(`), (`)
-        ) {
-          return false
-        }
-        bulkRowInserts++
-        return bulkRowInserts === 2
-      })
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `old`,
-              value: { id: `old` },
-              metadataChanged: true,
-              metadata: { source: `previous-generation` },
-            },
-          ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `electric:resume`, value: { offset: `old` } },
-          ],
-        },
-      )
-      const before = await observeCachedSchemaState(
-        adapter,
-        driver,
-        collectionId,
-      )
-      const beforeSnapshot = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      injectFailure = true
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `failed-replacement`,
-            term: 1,
-            seq: 2,
-            rowVersion: 2,
-            truncate: true,
-            mutations: Array.from({ length: 205 }, (_, index) => ({
-              type: `update` as const,
-              key: `row-${index}`,
-              value: { id: `row-${index}` },
-            })),
-            collectionMetadataMutations: [
-              { type: `set`, key: `electric:resume`, value: { offset: `2_0` } },
-            ],
-          },
-        ),
-      ).rejects.toThrow(`injected transaction failure`)
-      injectFailure = false
-      expect(bulkRowInserts).toBe(2)
-      expect(
-        await observeCachedSchemaState(adapter, driver, collectionId),
-      ).toEqual(before)
-      expect(
-        await adapter.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: collectionId,
-        }),
-      ).toEqual(beforeSnapshot)
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`keeps ordered duplicate and delete histories on the sequential path`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const adapter = new SQLiteCorePersistenceAdapter({ driver })
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: `duplicate-replacement` },
-        {
-          txId: `duplicate`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          truncate: true,
-          mutations: [
-            { type: `insert`, key: `same`, value: { id: `same`, first: true } },
-            { type: `update`, key: `same`, value: { last: true } },
-          ],
-        },
-      )
-      const duplicate = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: `duplicate-replacement`,
-      })
-      expect(duplicate.rows).toEqual([
-        {
-          key: `same`,
-          value: { id: `same`, first: true, last: true },
-          metadata: undefined,
-        },
-      ])
-      expect(duplicate.keySet).toEqual({ status: `consistent` })
-
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: `delete-replacement` },
-        {
-          txId: `delete`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          truncate: true,
-          mutations: [
-            { type: `insert`, key: `removed`, value: { id: `removed` } },
-            { type: `delete`, key: `removed`, value: { id: `removed` } },
-            { type: `insert`, key: `kept`, value: { id: `kept` } },
-          ],
-        },
-      )
-      const deleted = await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: `delete-replacement`,
-      })
-      expect(deleted.rows).toEqual([
-        { key: `kept`, value: { id: `kept` }, metadata: undefined },
-      ])
-      expect(deleted.keySet).toEqual({ status: `consistent` })
-      const tombstoneTable = createPersistedTableName(`delete-replacement`, `t`)
-      expect(
-        await driver.query<{ key: string }>(
-          `SELECT key FROM "${tombstoneTable}" ORDER BY key`,
-        ),
-      ).toEqual([{ key: encodePersistedStorageKey(`removed`) }])
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`migrates concurrent legacy schemas and stays unknown until truncate`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let releasePending = () => {}
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const collectionId = `legacy-ledger`
-      const tableName = createPersistedTableName(collectionId, `c`)
-      const tombstoneTableName = createPersistedTableName(collectionId, `t`)
-      await driver.exec(
-        `CREATE TABLE collection_registry (
-           collection_id TEXT PRIMARY KEY,
-           table_name TEXT NOT NULL UNIQUE,
-           tombstone_table_name TEXT NOT NULL UNIQUE,
-           schema_version INTEGER NOT NULL,
-           updated_at INTEGER NOT NULL
-         )`,
-      )
-      await driver.run(
-        `INSERT INTO collection_registry
-           (collection_id, table_name, tombstone_table_name, schema_version, updated_at)
-         VALUES (?, ?, ?, 1, 0)`,
-        [collectionId, tableName, tombstoneTableName],
-      )
-      await driver.exec(
-        `CREATE TABLE "${tableName}" (
-           key TEXT PRIMARY KEY,
-           value TEXT NOT NULL,
-           metadata TEXT,
-           row_version INTEGER NOT NULL
-         )`,
-      )
-      await driver.exec(
-        `CREATE TABLE "${tombstoneTableName}" (
-           key TEXT PRIMARY KEY,
-           value TEXT,
-           row_version INTEGER NOT NULL,
-           deleted_at TEXT NOT NULL
-         )`,
-      )
-      await driver.run(
-        `INSERT INTO "${tableName}" (key, value, metadata, row_version)
-         VALUES (?, ?, ?, 0)`,
-        [
-          encodePersistedStorageKey(`legacy-row`),
-          JSON.stringify({ id: `legacy-row`, n: 0 }),
-          JSON.stringify({ source: `legacy` }),
-        ],
-      )
-      await driver.exec(
-        `CREATE TABLE collection_version (
-           collection_id TEXT PRIMARY KEY,
-           latest_row_version INTEGER NOT NULL
-         )`,
-      )
-      await driver.run(
-        `INSERT INTO collection_version (collection_id, latest_row_version)
-         VALUES (?, 0)`,
-        [collectionId],
-      )
-
-      const bothSawLegacyColumns = deferred()
-      let legacyColumnReaders = 0
-      const migrationRelease = deferred()
-      releasePending = migrationRelease.resolve
-      const createMigrationDriver = (): SQLiteDriver => ({
-        ...driver,
-        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
-          const rows = await driver.query<T>(sql, params)
-          if (sql.includes(`PRAGMA table_info(collection_version)`)) {
-            legacyColumnReaders++
-            if (legacyColumnReaders === 2) bothSawLegacyColumns.resolve()
-            await migrationRelease.promise
-          }
-          return rows
-        },
-      })
-      const migrated = new SQLiteCorePersistenceAdapter({
-        driver: createMigrationDriver(),
-      })
-      const concurrentMigrated = new SQLiteCorePersistenceAdapter({
-        driver: createMigrationDriver(),
-      })
-      const initialize = (adapter: SQLiteCorePersistenceAdapter) =>
-        (
-          adapter as unknown as { ensureInitialized: () => Promise<void> }
-        ).ensureInitialized()
-      const migrations = Promise.all([
-        initialize(migrated),
-        initialize(concurrentMigrated),
-      ])
-      await reachCheckpoint(
-        bothSawLegacyColumns.promise,
-        `both adapters observed the legacy collection_version schema`,
-      )
-      migrationRelease.resolve()
-      await migrations
-      const migratedColumns = await driver.query<{ name: string }>(
-        `PRAGMA table_info(collection_version)`,
-      )
-      expect(migratedColumns.map(({ name }) => name)).toEqual(
-        expect.arrayContaining([
-          `key_set_evidence_available`,
-          `key_set_evidence_incompatible`,
-        ]),
-      )
-
-      const migratedLegacySnapshot = await migrated.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(migratedLegacySnapshot.keySet).toEqual({ status: `unknown` })
-      expect(migratedLegacySnapshot.rows).toEqual([
-        {
-          key: `legacy-row`,
-          value: { id: `legacy-row`, n: 0 },
-          metadata: { source: `legacy` },
-        },
-      ])
-      await migrated.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `legacy-insert`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1, n: 1 } }],
-        },
-      )
-      expect(
-        (
-          await migrated.loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionId,
-          })
-        ).keySet,
-      ).toEqual({
-        status: `unknown`,
-      })
-
-      await migrated.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `legacy-replacement`,
-          term: 1,
-          seq: 2,
-          rowVersion: 2,
-          truncate: true,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1, n: 2 } }],
-        },
-      )
-      expect(
-        (
-          await migrated.loadResumeSnapshot({
-            kind: `eager`,
-            collectionId: collectionId,
-          })
-        ).keySet,
-      ).toEqual({
-        status: `consistent`,
-      })
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      releasePending()
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`does not repeat a schema reset observed through a stale adapter read`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let releasePending = () => {}
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const collectionId = `concurrent-schema-reset`
-      const original = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await original.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `old` },
-          ],
-        },
-      )
-
-      const staleRead = deferred()
-      const releaseStaleRead = deferred()
-      releasePending = releaseStaleRead.resolve
-      let intercepted = false
-      const gatedDriver: SQLiteDriver = {
-        ...driver,
-        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
-          const rows = await driver.query<T>(sql, params)
-          if (!intercepted && sql.includes(`FROM collection_registry`)) {
-            intercepted = true
-            staleRead.resolve()
-            await releaseStaleRead.promise
-          }
-          return rows
-        },
-      }
-      const staleAdapter = new SQLiteCorePersistenceAdapter({
-        driver: gatedDriver,
-        schemaVersion: 2,
-      })
-      const staleLoad = staleAdapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await reachCheckpoint(
-        staleRead.promise,
-        `stale schema-v1 registry read before competing reset`,
-      )
-
-      const winner = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-      })
-      await winner.loadSubset({ kind: `eager`, collectionId: collectionId }, {})
-      await winner.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `recovery-write`,
-          term: 2,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `new` },
-          ],
-        },
-      )
-
-      releaseStaleRead.resolve()
-      await staleLoad
-      const snapshot = await winner.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(snapshot.resetEpoch).toBe(1)
-      expect(snapshot.rows.map(({ key }) => key)).toEqual([2])
-      expect(snapshot.collectionMetadata).toEqual([
-        { key: `cursor`, value: `new` },
-      ])
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      releasePending()
-      closeDatabasePreservingPrimary(database, primaryFailure)
+            },
+          })
+        }),
     }
-  })
-
-  it(`refuses to downgrade a newer schema observed after a stale read`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let releasePending = () => {}
-    let primaryFailure: unknown
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver,
+      cacheGenerationClaimTtlMs: claimTtlMs,
+      now: () => now,
+    })
+    let read: ReturnType<typeof adapter.loadResumeSnapshot> | undefined
     try {
-      const driver = createDriver(database)
-      const collectionId = `divergent-schema-reset`
-      const original = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await original.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
+      const logicalId = `held-resume-second-check`
+      const first = await adapter.claimCacheGeneration(logicalId)
+      const storageId = first.storageCollectionId
+      observedStorageId = storageId
+      // The model does not use the adapter's returned expiry to decide whether
+      // this read is legal.
+      expect(first.expiresAtMs).toBe(firstExpiresAtMs)
+      rowTable = createPersistedTableName(storageId, `c`)
+      const resume = { offset: `warm-peer-offset` }
+      await adapter.applyCommittedTx(
         {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
-        },
-      )
-
-      const staleRead = deferred()
-      const releaseStaleRead = deferred()
-      releasePending = releaseStaleRead.resolve
-      let intercepted = false
-      const staleDriver: SQLiteDriver = {
-        ...driver,
-        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
-          const rows = await driver.query<T>(sql, params)
-          if (!intercepted && sql.includes(`FROM collection_registry`)) {
-            intercepted = true
-            staleRead.resolve()
-            await releaseStaleRead.promise
-          }
-          return rows
+          kind: `managed`,
+          storageCollectionId: storageId,
+          claimId: first.claimId,
         },
-      }
-      const staleV2 = new SQLiteCorePersistenceAdapter({
-        driver: staleDriver,
-        schemaVersion: 2,
-      })
-      const staleLoad = staleV2.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await reachCheckpoint(
-        staleRead.promise,
-        `stale schema-v1 registry read before schema-v3 reset`,
-      )
-
-      const winnerV3 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 3,
-      })
-      await winnerV3.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await winnerV3.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
         {
-          txId: `winner-write`,
-          term: 3,
+          txId: `seed`,
+          term: 1,
           seq: 1,
           rowVersion: 1,
-          mutations: [{ type: `insert`, key: 3, value: { id: 3 } }],
+          cacheGenerationClaimId: first.claimId,
+          mutations: rows.map((row) => ({
+            type: `insert` as const,
+            key: row.id,
+            value: row,
+          })),
           collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `v3` },
+            { type: `set`, key: `resume`, value: resume },
           ],
         },
       )
+      now = peerClaimsAtMs
+      const warm = await adapter.claimCacheGeneration(logicalId)
+      expect(warm.storageCollectionId).toBe(storageId)
+      expect(warm.claimId).not.toBe(first.claimId)
+      expect(warm.expiresAtMs).toBe(peerExpiresAtMs)
 
-      releaseStaleRead.resolve()
-      await expect(staleLoad).rejects.toThrow(
-        `Schema version changed concurrently`,
-      )
-      const snapshot = await winnerV3.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(snapshot.resetEpoch).toBe(1)
-      expect(snapshot.rows.map(({ key }) => key)).toEqual([3])
-      expect(snapshot.collectionMetadata).toEqual([
-        { key: `cursor`, value: `v3` },
-      ])
-      expect(
-        await driver.query<{ schema_version: number }>(
-          `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
-          [collectionId],
-        ),
-      ).toEqual([{ schema_version: 3 }])
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      releasePending()
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`rejects a committed transaction from a cached adapter after another adapter resets the schema`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const collectionId = `cached-schema-write`
-      const staleV1 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await staleV1.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
+      holdTransaction = true
+      observeHeldRead = true
+      read = adapter.loadResumeSnapshot(
         {
-          txId: `seed-v1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `v1` },
-          ],
+          kind: `managed`,
+          storageCollectionId: storageId,
+          claimId: first.claimId,
         },
-      )
-
-      const currentV2 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-      })
-      await currentV2.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await currentV2.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
         {
-          txId: `seed-v2`,
-          term: 2,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `v2` },
-          ],
+          includeRows,
+          cacheGenerationClaimId: first.claimId,
         },
       )
-      const before = await observeCachedSchemaState(
-        currentV2,
-        driver,
-        collectionId,
+      void read.catch(() => undefined)
+      await reachCheckpoint(
+        transactionEntered.promise,
+        `resume transaction before its claim check`,
       )
-
-      let lateWriteError: unknown
-      try {
-        await staleV1.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `late-v1`,
-            term: 3,
-            seq: 1,
-            rowVersion: 2,
-            truncate: true,
-            mutations: [{ type: `insert`, key: 3, value: { id: 3 } }],
-            collectionMetadataMutations: [
-              { type: `set`, key: `cursor`, value: `late-v1` },
-              { type: `set`, key: `late`, value: true },
-            ],
-          },
+      now = readAtMs
+      releaseTransaction.resolve()
+      const generationStatements = () =>
+        heldStatements.filter(
+          ({ sql, params }) =>
+            sql.includes(rowTable) ||
+            sql.includes(observedStorageId) ||
+            params?.includes(observedStorageId),
+        )
+      if (!firstClaimCanRead) {
+        await expect(read).rejects.toThrow(
+          `Persisted cache claim is no longer active`,
+        )
+        expect(generationStatements()).toHaveLength(1)
+        expect(generationStatements()[0]).toMatchObject({ type: `query` })
+        expect(generationStatements()[0]?.sql).toContain(
+          `cache_generation_claim`,
+        )
+        expect(metadataReads).toBe(0)
+        expect(rowReads).toBe(0)
+      } else {
+        const snapshot = await read
+        expect(generationStatements()[0]).toMatchObject({ type: `query` })
+        expect(generationStatements()[0]?.sql).toContain(
+          `cache_generation_claim`,
+        )
+        expect(snapshot.rows.map(({ value }) => value)).toEqual(
+          expectedFirstRows,
         )
-      } catch (error) {
-        lateWriteError = error
+        expect(snapshot.collectionMetadata).toEqual([
+          { key: `resume`, value: resume },
+        ])
+        expect(metadataReads).toBeGreaterThan(0)
+        if (includeRows) {
+          expect(rowReads).toBeGreaterThan(0)
+        } else {
+          expect(rowReads).toBe(0)
+        }
       }
-      const after = await observeCachedSchemaState(
-        currentV2,
-        driver,
-        collectionId,
-      )
-
-      expect(
-        {
-          error:
-            lateWriteError instanceof Error
-              ? { name: lateWriteError.name, message: lateWriteError.message }
-              : lateWriteError,
-          before,
-          after,
-        },
-        `a cached adapter must reject at its transaction boundary without changing any durable state`,
-      ).toEqual({
-        error: {
-          name: `InvalidPersistedCollectionConfigError`,
-          message:
-            `Schema version mismatch for collection "cached-schema-write": ` +
-            `found 2, expected 1. Refusing to apply a committed transaction through a stale cached adapter.`,
-        },
-        before,
-        after: before,
-      })
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`rejects a resume snapshot from a cached adapter after another adapter resets the schema`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const collectionId = `cached-schema-snapshot`
-      const staleV1 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await staleV1.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
+      observeHeldRead = false
+      const peerSnapshot = await adapter.loadResumeSnapshot(
         {
-          txId: `seed-v1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
+          kind: `managed`,
+          storageCollectionId: storageId,
+          claimId: warm.claimId,
         },
-      )
-      await staleV1.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-
-      const currentV2 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-      })
-      await currentV2.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await currentV2.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
         {
-          txId: `seed-v2`,
-          term: 2,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `v2` },
-          ],
+          cacheGenerationClaimId: warm.claimId,
         },
       )
-
-      await expect(
-        staleV1.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: collectionId,
-        }),
-      ).rejects.toThrow(`Schema version mismatch`)
-      expect(
-        await currentV2.loadResumeSnapshot({
-          kind: `eager`,
-          collectionId: collectionId,
-        }),
-      ).toMatchObject({
-        rows: [{ key: 2, value: { id: 2 } }],
-        collectionMetadata: [{ key: `cursor`, value: `v2` }],
-      })
+      expect(peerSnapshot.rows.map(({ value }) => value)).toEqual(rows)
+      expect(peerSnapshot.collectionMetadata).toEqual([
+        { key: `resume`, value: resume },
+      ])
     } catch (error) {
       primaryFailure = error
+      throw error
     } finally {
+      releaseTransaction.resolve()
+      await Promise.allSettled([read])
       closeDatabasePreservingPrimary(database, primaryFailure)
     }
-  })
+  }
 
-  it(`rejects cached row readers after another adapter resets the schema`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const collectionId = `cached-schema-row-readers`
-      const staleV1 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await staleV1.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-v1`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
-        },
-      )
-      await staleV1.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
+  it.each([
+    { clockCut: `before expiry`, elapsedMs: -1, includeRows: false },
+    { clockCut: `before expiry`, elapsedMs: -1, includeRows: true },
+    { clockCut: `at expiry`, elapsedMs: 0, includeRows: false },
+    { clockCut: `at expiry`, elapsedMs: 0, includeRows: true },
+    { clockCut: `after expiry`, elapsedMs: 1, includeRows: false },
+    { clockCut: `after expiry`, elapsedMs: 1, includeRows: true },
+  ])(
+    `checks a cache claim $clockCut inside a resume transaction with includeRows=$includeRows`,
+    ({ elapsedMs, includeRows }) =>
+      assertManagedClaimReadHistory({
+        elapsedMs,
+        includeRows,
+        peerDelayMs: 50,
+        rowCount: 1,
+      }),
+  )
 
-      const currentV2 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-      })
-      await currentV2.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await currentV2.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-v2`,
-          term: 2,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
-        },
-      )
+  const managedClaimReadHistory = fc.record({
+    elapsedMs: fc.constantFrom(-9, -1, 0, 1, 9),
+    includeRows: fc.boolean(),
+    peerDelayMs: fc.integer({ min: 10, max: 80 }),
+    rowCount: fc.integer({ min: 0, max: 3 }),
+  })
+  fcTest.prop([managedClaimReadHistory], {
+    seed: 2056,
+    numRuns: oracleRuns(30),
+  })(
+    `checks generated managed-claim read histories (fixed)`,
+    assertManagedClaimReadHistory,
+  )
+  fcTest.prop(
+    [managedClaimReadHistory],
+    oraclePropertyOptions(30, `sqlite-resume.managed-claim-read`),
+  )(
+    `checks generated managed-claim read histories (random or replayed)`,
+    assertManagedClaimReadHistory,
+  )
 
-      const staleReads = await Promise.allSettled([
-        staleV1.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
-        staleV1.scanRows({ kind: `eager`, collectionId: collectionId }),
-        staleV1.pullSince({ kind: `eager`, collectionId: collectionId }, 0),
-      ])
-      expect(staleReads.map(({ status }) => status)).toEqual([
-        `rejected`,
-        `rejected`,
-        `rejected`,
-      ])
-      expect(
-        await currentV2.loadSubset(
-          { kind: `eager`, collectionId: collectionId },
-          {},
-        ),
-      ).toMatchObject([{ key: 2, value: { id: 2 } }])
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
+  const startupHistoryArbitrary = fc.record({
+    baselineSize: fc.integer({ min: 1, max: 3 }),
+    transition: fc.constantFrom(
+      `none` as const,
+      `managed-insert` as const,
+      `raw-delete` as const,
+    ),
   })
 
-  it(`rejects cached collection-metadata reads after another adapter resets the schema`, async () => {
+  const assertStartupHistory = async (history: {
+    baselineSize: number
+    transition: `none` | `managed-insert` | `raw-delete`
+  }) => {
     const database = new DatabaseSync(`:memory:`)
     let primaryFailure: unknown
+    let releaseInitialSnapshot = () => {}
+    let collection:
+      Collection<{ id: string; title: string }, string> | undefined
     try {
       const driver = createDriver(database)
-      const collectionId = `cached-schema-metadata-reader`
-      const staleV1 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await staleV1.applyCommittedTx(
+      const collectionId = `generated-local-startup`
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      const baselineRows = Array.from(
+        { length: history.baselineSize },
+        (_, index) => ({
+          id: `baseline-${index}`,
+          title: `baseline-${index}`,
+        }),
+      )
+      await adapter.applyCommittedTx(
         { kind: `eager`, collectionId: collectionId },
         {
-          txId: `seed-v1`,
+          txId: `seed`,
           term: 1,
           seq: 1,
           rowVersion: 1,
-          mutations: [],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `v1` },
-          ],
+          truncate: true,
+          mutations: baselineRows.map((row) => ({
+            type: `insert` as const,
+            key: row.id,
+            value: row,
+          })),
         },
       )
-      await staleV1.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
 
-      const currentV2 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-      })
-      await currentV2.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await currentV2.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-v2`,
-          term: 2,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [],
-          collectionMetadataMutations: [
-            { type: `set`, key: `cursor`, value: `v2` },
-          ],
-        },
-      )
+      const loadResumeSnapshot = adapter.loadResumeSnapshot.bind(adapter)
+      const reachedInitialSnapshot = deferred()
+      const reachedHydrationSnapshot = deferred()
+      const initialSnapshotRelease = deferred()
+      releaseInitialSnapshot = initialSnapshotRelease.resolve
+      let snapshotCalls = 0
+      const runInHydrationScope = adapter.runInHydrationScope.bind(adapter)
+      adapter.runInHydrationScope = (task) =>
+        runInHydrationScope((scopedAdapter) =>
+          task({
+            ...scopedAdapter,
+            loadResumeSnapshot: async (...args) => {
+              const snapshot = await scopedAdapter.loadResumeSnapshot(...args)
+              snapshotCalls++
+              if (snapshotCalls === 1) {
+                reachedInitialSnapshot.resolve()
+                await initialSnapshotRelease.promise
+              } else if (snapshotCalls === 2) {
+                reachedHydrationSnapshot.resolve()
+              }
+              return snapshot
+            },
+          }),
+        )
 
-      await expect(
-        staleV1.loadCollectionMetadata({
-          kind: `eager`,
-          collectionId: collectionId,
-        }),
-      ).rejects.toThrow(`Schema version mismatch`)
-      expect(
-        await currentV2.loadCollectionMetadata({
-          kind: `eager`,
-          collectionId: collectionId,
+      collection = createCollection(
+        persistedCollectionOptions<{ id: string; title: string }, string>({
+          id: collectionId,
+          startSync: false,
+          getKey: (row) => row.id,
+          persistence: { adapter },
         }),
-      ).toEqual([{ key: `cursor`, value: `v2` }])
-    } catch (error) {
-      primaryFailure = error
-    } finally {
-      closeDatabasePreservingPrimary(database, primaryFailure)
-    }
-  })
-
-  it(`rejects cached index lifecycle writes after another adapter resets the schema`, async () => {
-    const database = new DatabaseSync(`:memory:`)
-    let primaryFailure: unknown
-    try {
-      const driver = createDriver(database)
-      const collectionId = `cached-schema-index-writers`
-      const staleV1 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 1,
-      })
-      await staleV1.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
       )
-
-      const currentV2 = new SQLiteCorePersistenceAdapter({
-        driver,
-        schemaVersion: 2,
-      })
-      await currentV2.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {},
-      )
-      await currentV2.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        `v2-index`,
-        {
-          expressionSql: [`json_extract(value, '$.id')`],
-        },
+      collection.startSyncImmediate()
+      await reachCheckpoint(
+        reachedInitialSnapshot.promise,
+        `generated local startup metadata snapshot`,
       )
 
-      const staleWrites = await Promise.allSettled([
-        staleV1.ensureIndex(
-          { kind: `eager`, collectionId: collectionId },
-          `stale-v1-index`,
-          {
-            expressionSql: [`json_extract(value, '$.legacy')`],
+      const managedRow = {
+        id: `managed`,
+        title: `managed-during-startup`,
+      }
+      let managedPersistence: Promise<unknown> | undefined
+      let managedPersistenceSettled = false
+      if (history.transition === `managed-insert`) {
+        managedPersistence = collection.insert(managedRow).isPersisted.promise
+        void managedPersistence.then(
+          () => {
+            managedPersistenceSettled = true
           },
-        ),
-        staleV1.markIndexRemoved(
-          { kind: `eager`, collectionId: collectionId },
-          `v2-index`,
-        ),
-      ])
-      expect(staleWrites.map(({ status }) => status)).toEqual([
-        `rejected`,
-        `rejected`,
-      ])
+          () => {
+            managedPersistenceSettled = true
+          },
+        )
+        for (let attempt = 0; attempt < 20; attempt++) {
+          await Promise.resolve()
+        }
+        expect(managedPersistenceSettled).toBe(false)
+      } else if (history.transition === `raw-delete`) {
+        const tableName = createPersistedTableName(collectionId, `c`)
+        await driver.run(`DELETE FROM "${tableName}" WHERE key = ?`, [
+          encodePersistedStorageKey(baselineRows[0]!.id),
+        ])
+      }
 
-      const currentIndexes = await driver.query<{
-        signature: string
-        removed: number
-      }>(
-        `SELECT signature, removed
-         FROM persisted_index_registry
-         WHERE collection_id = ?
-         ORDER BY signature`,
-        [collectionId],
+      releaseInitialSnapshot()
+      await managedPersistence
+      await collection.stateWhenReady()
+      await reachCheckpoint(
+        reachedHydrationSnapshot.promise,
+        `generated local startup hydration snapshot`,
       )
-      expect(currentIndexes).toEqual([{ signature: `v2-index`, removed: 0 }])
+      const visibleRows = Array.from(collection.values(), ({ id, title }) => ({
+        id,
+        title,
+      })).sort((left, right) => left.id.localeCompare(right.id))
+      const expectedRows =
+        history.transition === `raw-delete`
+          ? []
+          : [
+              ...baselineRows,
+              ...(history.transition === `managed-insert` ? [managedRow] : []),
+            ].sort((left, right) => left.id.localeCompare(right.id))
+
+      expectStartupRows(visibleRows, expectedRows)
+      if (history.transition === `managed-insert`) {
+        const durableRows = (
+          await loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionId,
+          })
+        ).rows
+          .map(({ value }) => value)
+          .sort((left, right) =>
+            String(left.id).localeCompare(String(right.id)),
+          )
+        expect(durableRows).toEqual(expectedRows)
+      }
+      if (history.transition === `raw-delete`) {
+        expect(
+          (
+            await loadResumeSnapshot({
+              kind: `eager`,
+              collectionId: collectionId,
+            })
+          ).keySet,
+        ).toEqual({
+          status: `incompatible`,
+        })
+      }
     } catch (error) {
       primaryFailure = error
     } finally {
+      releaseInitialSnapshot()
+      try {
+        await collection?.cleanup()
+      } catch (cleanupError) {
+        if (primaryFailure === undefined) primaryFailure = cleanupError
+      }
       closeDatabasePreservingPrimary(database, primaryFailure)
     }
+  }
+
+  it(`fixed startup corpus reaches every baseline size and transition`, () => {
+    const histories = fc.sample(startupHistoryArbitrary, {
+      seed: 1659,
+      numRuns: 12,
+    })
+    expect(new Set(histories.map(({ baselineSize }) => baselineSize))).toEqual(
+      new Set([1, 2, 3]),
+    )
+    expect(new Set(histories.map(({ transition }) => transition))).toEqual(
+      new Set([`none`, `managed-insert`, `raw-delete`]),
+    )
+  })
+
+  // The retired-storage and managed-claim checks compare production with independent
+  // models of retained generations and claim intervals. The fixed and generated
+  // cases share those checks. The startup grammar is the generator whose coverage
+  // the fixed startup corpus calibrates.
+  declareOracle({
+    check: [assertRetiredStorageHistory, assertManagedClaimReadHistory],
+    model: [expectedRetainedGenerations],
+    grammar: [startupHistoryArbitrary],
   })
+
+  fcTest.prop([startupHistoryArbitrary], {
+    seed: 1659,
+    numRuns: oracleRuns(12),
+  })(
+    `preserves local-only startup histories across managed generation advancement (fixed)`,
+    assertStartupHistory,
+  )
+
+  fcTest.prop(
+    [startupHistoryArbitrary],
+    oraclePropertyOptions(12, `sqlite-resume.startup-generation`),
+  )(
+    `preserves local-only startup histories across managed generation advancement (random or replayed)`,
+    assertStartupHistory,
+  )
 })
 
 // The ordinary committed-transaction work law extends this SQLite owner.
@@ -5419,129 +835,3 @@ runOrdinaryTransactionWorkOracle()
 // registry/physical indexes gone. Another collection must survive. Re-seeding
 // then preserves the marker record, and a same-schema reopen must retain it.
 // This reset/re-seed history does not claim lossless old-byte migration.
-it(`resets ambiguous legacy values and obsolete indexes before reading a new schema`, async () => {
-  const database = new DatabaseSync(`:memory:`)
-  let primaryFailure: unknown
-  try {
-    const driver = createDriver(database)
-    const collectionId = `legacy-marker-reset`
-    const table = createPersistedTableName(collectionId, `c`)
-    const old = new SQLiteCorePersistenceAdapter({ driver, schemaVersion: 1 })
-    for (const id of [collectionId, `unrelated-cache`]) {
-      await old.applyCommittedTx(
-        { kind: `eager`, collectionId: id },
-        {
-          txId: `seed`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            { type: `insert`, key: `old`, value: { id: `old`, stamp: 1 } },
-          ],
-        },
-      )
-      for (const signature of [
-        `old-native-signature`,
-        `current-native-signature`,
-      ]) {
-        await old.ensureIndex({ kind: `eager`, collectionId: id }, signature, {
-          expressionSql: [`row_version`],
-        })
-      }
-    }
-    const marker = {
-      __tanstack_db_persisted_type__: `string`,
-      value: `ordinary`,
-    }
-    database
-      .prepare(`UPDATE "${table}" SET value = ?`)
-      .run(JSON.stringify({ id: `old`, marker }))
-    const indexes = database
-      .prepare(
-        `SELECT index_name FROM persisted_index_registry WHERE collection_id = ?`,
-      )
-      .all(collectionId) as Array<{ index_name: string }>
-    expect(indexes).toHaveLength(2)
-    const next = new SQLiteCorePersistenceAdapter({
-      driver,
-      schemaVersion: 2,
-      schemaMismatchPolicy: `reset`,
-    })
-    expect(
-      await next.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
-    ).toEqual([])
-    expect(
-      database
-        .prepare(
-          `SELECT * FROM persisted_index_registry WHERE collection_id = ?`,
-        )
-        .all(collectionId),
-    ).toEqual([])
-    for (const { index_name } of indexes) {
-      expect(
-        database
-          .prepare(
-            `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
-          )
-          .all(index_name),
-      ).toEqual([])
-    }
-    expect(
-      database
-        .prepare(
-          `SELECT * FROM persisted_index_registry WHERE collection_id = ?`,
-        )
-        .all(`unrelated-cache`),
-    ).toHaveLength(2)
-    expect(
-      (
-        await old.loadSubset(
-          { kind: `eager`, collectionId: `unrelated-cache` },
-          {},
-        )
-      ).map(({ key }) => key),
-    ).toEqual([`old`])
-    await next.applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        txId: `reseed`,
-        term: 2,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [
-          { type: `insert`, key: `new`, value: { id: `new`, marker } },
-        ],
-      },
-    )
-    await next.ensureIndex(
-      { kind: `eager`, collectionId: collectionId },
-      `replacement`,
-      {
-        expressionSql: [`row_version`],
-      },
-    )
-    const reopened = new SQLiteCorePersistenceAdapter({
-      driver,
-      schemaVersion: 2,
-    })
-    expect(
-      (
-        await reopened.loadSubset(
-          { kind: `eager`, collectionId: collectionId },
-          {},
-        )
-      ).map(({ value }) => value),
-    ).toEqual([{ id: `new`, marker }])
-    expect(
-      database
-        .prepare(
-          `SELECT signature FROM persisted_index_registry WHERE collection_id = ?`,
-        )
-        .all(collectionId),
-    ).toEqual([{ signature: `replacement` }])
-  } catch (error) {
-    primaryFailure = error
-  } finally {
-    closeDatabasePreservingPrimary(database, primaryFailure)
-  }
-})
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-support.ts b/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-support.ts
new file mode 100644
index 0000000000..098a8edada
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot-support.ts
@@ -0,0 +1,277 @@
+// Shared fixtures and helpers for the SQLite resume-snapshot tests. The laws and
+// models they serve are in sqlite-resume-snapshot-oracle.test.ts.
+import { expect } from 'vitest'
+import type { DatabaseSync } from 'node:sqlite'
+import type { SQLiteCorePersistenceAdapter, SQLiteDriver } from '../src'
+
+export type CachedSchemaState = {
+  schemaVersion: number
+  resetEpoch: number
+  rows: Array<{ key: string | number; value: Record<string, unknown> }>
+  metadata: Array<{ key: string; value: unknown }>
+  appliedTransactions: Array<{
+    term: number
+    seq: number
+    txId: string
+    rowVersion: number
+  }>
+  keyEvidence: {
+    available: number
+    incompatible: number
+    expectedKeys: Array<string>
+  }
+}
+
+export function toBinding(value: unknown): string | number | bigint | null {
+  if (value === null || value === undefined) return null
+  if (typeof value === `boolean`) return value ? 1 : 0
+  if (
+    typeof value === `string` ||
+    typeof value === `number` ||
+    typeof value === `bigint`
+  ) {
+    return value
+  }
+  return String(value)
+}
+
+/** In-memory SQLite driver with optional statement observation and write failure. */
+export function createDriver(
+  database: DatabaseSync,
+  failTransactionRun?: (sql: string) => boolean,
+  observeQuery?: (sql: string) => void,
+  observeRun?: (sql: string, params: ReadonlyArray<unknown>) => void,
+): SQLiteDriver {
+  const driver: SQLiteDriver = {
+    exec: (sql) => {
+      database.exec(sql)
+      return Promise.resolve()
+    },
+    query: (sql, params = []) => {
+      observeQuery?.(sql)
+      return Promise.resolve(
+        database
+          .prepare(sql)
+          .all(...params.map(toBinding))
+          .map((row) => ({ ...row })) as Array<never>,
+      )
+    },
+    run: (sql, params = []) => {
+      observeRun?.(sql, params)
+      database.prepare(sql).run(...params.map(toBinding))
+      return Promise.resolve()
+    },
+    transaction: async (transaction) => {
+      database.exec(`BEGIN IMMEDIATE`)
+      try {
+        const transactionDriver: SQLiteDriver = {
+          ...driver,
+          run: (sql, params) =>
+            failTransactionRun?.(sql)
+              ? Promise.reject(new Error(`injected transaction failure`))
+              : driver.run(sql, params),
+        }
+        const result = await transaction(transactionDriver)
+        database.exec(`COMMIT`)
+        return result
+      } catch (error) {
+        database.exec(`ROLLBACK`)
+        throw error
+      }
+    },
+  }
+  return driver
+}
+
+export function deferred() {
+  let resolve!: () => void
+  const promise = new Promise<void>((complete) => {
+    resolve = complete
+  })
+  return { promise, resolve }
+}
+
+export async function reachCheckpoint(
+  promise: Promise<void>,
+  checkpoint: string,
+  timeoutMs = 1_000,
+): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    await Promise.race([
+      promise,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(`Did not reach checkpoint: ${checkpoint}`)),
+          timeoutMs,
+        )
+      }),
+    ])
+  } finally {
+    if (timer !== undefined) clearTimeout(timer)
+  }
+}
+
+export function closeDatabasePreservingPrimary(
+  database: DatabaseSync,
+  primaryFailure: unknown,
+  secondaryFailures: ReadonlyArray<unknown> = [],
+): never | void {
+  let cleanupFailure: unknown
+  try {
+    database.close()
+  } catch (error) {
+    cleanupFailure = error
+  }
+
+  if (primaryFailure !== undefined) {
+    const failure =
+      primaryFailure instanceof Error
+        ? primaryFailure
+        : new Error(`SQLite resume snapshot failed`, { cause: primaryFailure })
+    const cleanupFailures = [
+      ...secondaryFailures,
+      ...(cleanupFailure !== undefined ? [cleanupFailure] : []),
+    ]
+    if (cleanupFailures.length > 0) {
+      Object.defineProperty(failure, `cleanupFailures`, {
+        value: cleanupFailures,
+        enumerable: true,
+      })
+    }
+    throw failure
+  }
+  if (secondaryFailures.length === 0 && cleanupFailure !== undefined) {
+    throw cleanupFailure
+  }
+  if (secondaryFailures.length > 0) {
+    throw new AggregateError(
+      [
+        ...secondaryFailures,
+        ...(cleanupFailure !== undefined ? [cleanupFailure] : []),
+      ],
+      `SQLite resume snapshot cleanup failed`,
+    )
+  }
+}
+
+export async function observeCachedSchemaState(
+  adapter: SQLiteCorePersistenceAdapter,
+  driver: SQLiteDriver,
+  collectionId: string,
+): Promise<CachedSchemaState> {
+  const snapshot = await adapter.loadResumeSnapshot({
+    kind: `eager`,
+    collectionId: collectionId,
+  })
+  const registryRows = await driver.query<{ schema_version: number }>(
+    `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
+    [collectionId],
+  )
+  const versionRows = await driver.query<{
+    key_set_evidence_available: number
+    key_set_evidence_incompatible: number
+  }>(
+    `SELECT key_set_evidence_available, key_set_evidence_incompatible
+     FROM collection_version
+     WHERE collection_id = ?`,
+    [collectionId],
+  )
+  const expectedKeys = await driver.query<{ key: string }>(
+    `SELECT key
+     FROM collection_expected_keys
+     WHERE collection_id = ?
+     ORDER BY key`,
+    [collectionId],
+  )
+  const appliedTransactions = await driver.query<{
+    term: number
+    seq: number
+    tx_id: string
+    row_version: number
+  }>(
+    `SELECT term, seq, tx_id, row_version
+     FROM applied_tx
+     WHERE collection_id = ?
+     ORDER BY term, seq`,
+    [collectionId],
+  )
+
+  return {
+    schemaVersion: registryRows[0]?.schema_version ?? -1,
+    resetEpoch: snapshot.resetEpoch,
+    rows: snapshot.rows
+      .map(({ key, value }) => ({ key, value }))
+      .sort((left, right) => String(left.key).localeCompare(String(right.key))),
+    metadata: snapshot.collectionMetadata.sort((left, right) =>
+      left.key.localeCompare(right.key),
+    ),
+    appliedTransactions: appliedTransactions.map(
+      ({ term, seq, tx_id, row_version }) => ({
+        term,
+        seq,
+        txId: tx_id,
+        rowVersion: row_version,
+      }),
+    ),
+    keyEvidence: {
+      available: versionRows[0]?.key_set_evidence_available ?? -1,
+      incompatible: versionRows[0]?.key_set_evidence_incompatible ?? -1,
+      expectedKeys: expectedKeys.map(({ key }) => key),
+    },
+  }
+}
+
+/**
+ * # Which generation does a SQLite resume snapshot certify?
+ *
+ * `loadResumeSnapshot` must return rows, collection metadata, applied position,
+ * reset epoch, and key-set evidence from one atomic persisted generation. Raw
+ * key loss makes that evidence incompatible until a full replacement establishes
+ * a new baseline; concurrent schema migration may advance but never downgrade or
+ * repeat the observed generation. These laws refine the shared persistence and
+ * schema-mismatch contracts exercised by sqlite-core-adapter-oracle.test.ts.
+ * A managed cache claim must still be live inside the read transaction before
+ * any generation-specific durable access. A claim expires at its expiry time;
+ * a later-acquired live peer claim does not inherit the earlier claim's expiry.
+ *
+ * `CachedSchemaState` is the independent projection: complete rows and metadata,
+ * transaction position, schema/reset lineage, and expected keys. The history
+ * grammar crosses external row loss, full replacement, two legacy-schema
+ * adapters, stale reads, newer-schema observation, and a cached writer racing a
+ * reset. Expected membership and lineage come from the declared transition, not
+ * from the adapter's SQL or internal branch structure.
+ *
+ * The production driver runs two real `SQLiteCorePersistenceAdapter` instances
+ * over one node:sqlite database and holds the exact transaction or snapshot
+ * boundary needed for each interleaving. At the settled snapshot checkpoint it
+ * compares the entire projected schema state; the held boundary and reset epoch
+ * are reach witnesses, while compatible reopen and recertifying truncate cases
+ * prevent an oracle that merely rejects every resume.
+ * A separate generated startup lane holds the runtime between its metadata and
+ * hydration snapshots, then crosses no write, a managed public insert, and a
+ * hostile raw deletion over one-to-three baseline rows. Its independent model
+ * preserves every managed row but fails closed for unsupported raw loss.
+ * The focused work law first executes one controlled expected-key table read to
+ * prove its SQL observer can detect the forbidden membership work, then resets
+ * the counters before measuring the public position and snapshot operations.
+ * A second value-and-work law applies a 205-row full replacement through
+ * `applyCommittedTx`. It compares exact durable rows, row metadata, key evidence,
+ * resume metadata, and applied position after return while bounding driver
+ * query/run calls. A later-batch fault must roll the whole replacement back.
+ * Duplicate-key and delete histories retain their ordered sequential meaning.
+ *
+ * Known omissions: this narrow fixture supplies the same-connection
+ * concurrency seam that the serialized copy-on-commit CLI harness cannot. It
+ * uses a controlled clock and one shared real SQLite connection for claim races.
+ * It does not claim native host execution or judge whether a consumer such as
+ * Electric may use the certified cursor; those remain separate driver-contract
+ * and Electric recovery owners. The work bound is a driver-call measure in
+ * node:sqlite, not an elapsed-time or browser OPFS latency guarantee.
+ */
+
+export type StartupRow = { id: string; title: string }
+export const expectStartupRows = (
+  actual: Array<StartupRow>,
+  expected: Array<StartupRow>,
+) => expect(actual).toEqual(expected)
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot.test.ts
new file mode 100644
index 0000000000..360e0d0d18
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-resume-snapshot.test.ts
@@ -0,0 +1,4481 @@
+// Ordinary tests for the SQLite resume-snapshot oracle: fixed scenarios whose
+// expectations are written out. The law owner is sqlite-resume-snapshot-oracle.test.ts.
+import { DatabaseSync } from 'node:sqlite'
+import { describe, expect, it, vi } from 'vitest'
+import { BasicIndex, createCollection, whenSyncAccepted } from '@tanstack/db'
+import {
+  SQLiteCorePersistenceAdapter,
+  createPersistedTableName,
+  encodePersistedStorageKey,
+  persistedCollectionOptions,
+} from '../src'
+import {
+  closeDatabasePreservingPrimary,
+  createDriver,
+  deferred,
+  expectStartupRows,
+  observeCachedSchemaState,
+  reachCheckpoint,
+} from './sqlite-resume-snapshot-support'
+import type { SQLiteDriver } from '../src'
+import type { Collection, SyncConfig } from '@tanstack/db'
+
+describe(`SQLite resume snapshots`, () => {
+  // Claim expiry is a real SQLite boundary, while source-session restart is a
+  // wrapper obligation. This receiving history joins them: after an expired
+  // claim, a custom on-demand source without a provider hook is reentered.
+  // The old callback cannot publish or durably write into the new physical
+  // cache. Public rows and a claimed SQLite read are checked after demand.
+  it(`restarts a custom source after a real SQLite cache claim expires`, async () => {
+    type Row = { id: string; title: string }
+    const database = new DatabaseSync(`:memory:`)
+    const logicalId = `custom-expired-cache`
+    let now = 1_000
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver: createDriver(database),
+      cacheGenerationClaimTtlMs: 300_000,
+      now: () => now,
+    })
+    const sessions: Array<Parameters<SyncConfig<Row, string>[`sync`]>[0]> = []
+    let cleanups = 0
+    const collection = createCollection(
+      persistedCollectionOptions<Row, string>({
+        id: logicalId,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            const session = sessions.push(params)
+            params.markReady()
+            return {
+              cleanup: () => {
+                cleanups++
+              },
+              loadSubset: async () => {
+                params.begin()
+                params.write({
+                  type: `update`,
+                  value: { id: `row-${session}`, title: `Session ${session}` },
+                })
+                await whenSyncAccepted(params.commit())
+              },
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    let primaryFailure: unknown
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      await collection._sync.loadSubset({ limit: 1 })
+      expect(collection.get(`row-1`)).toMatchObject({ id: `row-1` })
+      const oldClaim = database
+        .prepare(
+          `SELECT claim_id, physical_id FROM cache_generation_claim
+           WHERE logical_id = ? AND expires_at_ms > ?`,
+        )
+        .get(logicalId, now) as { claim_id: string; physical_id: string }
+
+      now += 300_001
+      await collection._sync.loadSubset({ limit: 2 })
+      expect(sessions).toHaveLength(2)
+      expect(cleanups).toBe(1)
+      expect(collection.get(`row-1`)).toBeUndefined()
+      expect(collection.get(`row-2`)).toMatchObject({ id: `row-2` })
+      const newClaim = database
+        .prepare(
+          `SELECT claim_id, physical_id FROM cache_generation_claim
+           WHERE logical_id = ? AND expires_at_ms > ?`,
+        )
+        .get(logicalId, now) as { claim_id: string; physical_id: string }
+      expect(newClaim.physical_id).not.toBe(oldClaim.physical_id)
+
+      sessions[0]!.begin()
+      sessions[0]!.write({
+        type: `update`,
+        value: { id: `late-old`, title: `Retired session` },
+      })
+      await sessions[0]!.commit()
+      expect(collection.get(`late-old`)).toBeUndefined()
+      const durable = await adapter.loadSubset(
+        {
+          kind: `managed`,
+          storageCollectionId: newClaim.physical_id,
+          claimId: newClaim.claim_id,
+        },
+        {},
+        { cacheGenerationClaimId: newClaim.claim_id },
+      )
+      expect(durable.map(({ key }) => key).sort()).toEqual([`row-2`])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      await collection.cleanup()
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A storage target states whether the caller owns an eager Collection or a
+  // claimed cache generation. The independent rule is simple: collection of a
+  // generation ends that claim's authority, so its target cannot read or write
+  // even after SQLite removes the catalog row that identified the physical ID.
+  // The same string may still name an eager Collection when the caller chooses
+  // that target explicitly. This fixed history drives real SQLite through
+  // claim, write, rotation, collection, and late adapter operations. At
+  // each rejected-operation checkpoint, no old table or registry may reappear.
+  it(`keeps a collected managed target from becoming eager storage`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+      })
+      const claim = await adapter.claimCacheGeneration(
+        `target-after-collection`,
+      )
+      const managed = {
+        kind: `managed` as const,
+        storageCollectionId: claim.storageCollectionId,
+        claimId: claim.claimId,
+      }
+      const oldTable = createPersistedTableName(claim.storageCollectionId, `c`)
+      const oldTombstones = createPersistedTableName(
+        claim.storageCollectionId,
+        `t`,
+      )
+      const footprint = () => {
+        const catalog = [
+          `collection_registry`,
+          `persisted_index_registry`,
+          `applied_tx`,
+          `collection_version`,
+          `collection_expected_keys`,
+          `collection_metadata`,
+          `leader_term`,
+          `collection_reset_epoch`,
+        ]
+        return {
+          tables: database
+            .prepare(
+              `SELECT name FROM sqlite_master WHERE name IN (?, ?) ORDER BY name`,
+            )
+            .all(oldTable, oldTombstones),
+          catalog: catalog.map((table) => ({
+            table,
+            count: (
+              database
+                .prepare(
+                  `SELECT COUNT(*) AS count FROM ${table} WHERE collection_id = ?`,
+                )
+                .get(claim.storageCollectionId) as { count: number }
+            ).count,
+          })),
+          generations: database
+            .prepare(`SELECT * FROM cache_generation WHERE physical_id = ?`)
+            .all(claim.storageCollectionId),
+          claims: database
+            .prepare(
+              `SELECT * FROM cache_generation_claim WHERE physical_id = ?`,
+            )
+            .all(claim.storageCollectionId),
+        }
+      }
+      await adapter.applyCommittedTx(managed, {
+        txId: `seed`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [{ type: `insert`, key: `seed`, value: { id: `seed` } }],
+      })
+      expect((await adapter.loadResumeSnapshot(managed)).rows).toMatchObject([
+        { key: `seed`, value: { id: `seed` } },
+      ])
+      await adapter.rotateCacheGeneration(
+        `target-after-collection`,
+        claim.claimId,
+      )
+
+      const collectedFootprint = footprint()
+      expect(collectedFootprint.tables).toEqual([])
+      expect(collectedFootprint.catalog.every(({ count }) => count === 0)).toBe(
+        true,
+      )
+      expect(collectedFootprint.generations).toEqual([])
+      expect(collectedFootprint.claims).toEqual([])
+      // A JavaScript caller can still pass an old bare ID. It must not be
+      // silently promoted to an eager target after the catalog row is gone.
+      await expect(
+        adapter.loadResumeSnapshot(claim.storageCollectionId as never),
+      ).rejects.toThrow(`explicit eager or managed storage target`)
+      await expect(
+        adapter.applyCommittedTx(claim.storageCollectionId as never, {
+          txId: `bare-late`,
+          term: 2,
+          seq: 1,
+          rowVersion: 2,
+          mutations: [{ type: `insert`, key: `bare`, value: { id: `bare` } }],
+        }),
+      ).rejects.toThrow(`explicit eager or managed storage target`)
+      await expect(
+        adapter.loadResumeSnapshot(`ordinary-bare-id` as never),
+      ).rejects.toThrow(`explicit eager or managed storage target`)
+      await expect(
+        adapter.applyCommittedTx(`ordinary-bare-id` as never, {
+          txId: `ordinary-bare`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [],
+        }),
+      ).rejects.toThrow(`explicit eager or managed storage target`)
+      await expect(
+        adapter.loadResumeSnapshot({
+          kind: `managed`,
+          storageCollectionId: claim.storageCollectionId,
+        } as never),
+      ).rejects.toThrow(
+        `requires a storageCollectionId and persisted cache claim`,
+      )
+      await expect(
+        adapter.loadResumeSnapshot({
+          kind: `eager`,
+          collectionId: claim.storageCollectionId,
+          claimId: claim.claimId,
+        } as never),
+      ).rejects.toThrow(`cannot carry a persisted cache claim`)
+      const lateTx = {
+        txId: `late`,
+        term: 2,
+        seq: 1,
+        rowVersion: 2,
+        mutations: [
+          { type: `insert` as const, key: `late`, value: { id: `late` } },
+        ],
+      }
+      const lateOperations: Array<() => Promise<unknown>> = [
+        () => adapter.loadSubset(managed, {}),
+        () => adapter.loadResumeSnapshot(managed),
+        () => adapter.loadCollectionMetadata(managed),
+        () => adapter.scanRows(managed),
+        () => adapter.getStreamPosition(managed),
+        () => adapter.pullSince(managed, 0),
+        () => adapter.applyCommittedTx(managed, lateTx),
+        () =>
+          adapter.reconcileCommittedTx(managed, lateTx, {
+            latestRowVersion: 1,
+            resetEpoch: 0,
+          }),
+        () =>
+          adapter.ensureIndex(managed, `late-index`, {
+            expressionSql: [`json_extract(value, '$.id')`],
+          }),
+        () => adapter.markIndexRemoved(managed, `late-index`),
+        () => adapter.reserveLeadershipTerm(managed, 1),
+      ]
+      for (const operation of lateOperations) {
+        await expect(operation()).rejects.toThrow(`no longer active`)
+        expect(footprint()).toEqual(collectedFootprint)
+      }
+      const reopened = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+      })
+      await expect(reopened.loadResumeSnapshot(managed)).rejects.toThrow(
+        `no longer active`,
+      )
+      await expect(reopened.applyCommittedTx(managed, lateTx)).rejects.toThrow(
+        `no longer active`,
+      )
+
+      // Explicit eager reuse is a different legal operation with the same
+      // bytes. The managed target's rejection must not reserve every prefix.
+      const eager = {
+        kind: `eager` as const,
+        collectionId: claim.storageCollectionId,
+      }
+      await reopened.applyCommittedTx(eager, {
+        txId: `eager`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [{ type: `insert`, key: `eager`, value: { id: `eager` } }],
+      })
+      expect(
+        (await reopened.loadResumeSnapshot(eager)).rows.map(({ key }) => key),
+      ).toEqual([`eager`])
+      await expect(reopened.loadResumeSnapshot(managed)).rejects.toThrow(
+        `no longer active`,
+      )
+      await expect(reopened.applyCommittedTx(managed, lateTx)).rejects.toThrow(
+        `no longer active`,
+      )
+      expect(
+        (await reopened.loadResumeSnapshot(eager)).rows.map(({ key }) => key),
+      ).toEqual([`eager`])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A physical cache ID is a catalog entry, not a string prefix. Public
+  // Collection IDs are arbitrary nonempty strings, including one that starts
+  // with the internal physical-ID prefix. An eager Collection never claims a
+  // managed generation; its ordinary durable row must still be readable.
+  it.each([
+    {
+      label: `CLI-safe prefix`,
+      collectionId: `tanstack-db-cache:user-eager-collection`,
+    },
+    {
+      label: `older NUL prefix`,
+      collectionId: `\u0000tanstack-db-cache:user-eager-collection`,
+    },
+  ])(
+    `keeps an eager Collection ID with the $label usable`,
+    async ({ collectionId }) => {
+      const database = new DatabaseSync(`:memory:`)
+      let primaryFailure: unknown
+      try {
+        const adapter = new SQLiteCorePersistenceAdapter({
+          driver: createDriver(database),
+        })
+        const row = { id: `row`, title: `Eager row` }
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `eager-source`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [{ type: `insert`, key: row.id, value: row }],
+          },
+        )
+        expect(
+          (
+            await adapter.loadResumeSnapshot({
+              kind: `eager`,
+              collectionId: collectionId,
+            })
+          ).rows.map(({ value }) => value),
+        ).toEqual([row])
+        const collection = createCollection(
+          persistedCollectionOptions<typeof row, string>({
+            id: collectionId,
+            syncMode: `eager`,
+            getKey: (value) => value.id,
+            persistence: { adapter },
+          }),
+        )
+        try {
+          await collection.preload()
+          expect(collection.get(row.id)).toMatchObject(row)
+        } finally {
+          await collection.cleanup()
+        }
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        closeDatabasePreservingPrimary(database, primaryFailure)
+      }
+    },
+  )
+
+  // A persisted cache generation has one distinct storage ID. Advancing the
+  // current generation preserves an existing run's source-backed storage while a recovering run
+  // starts with empty, uncertified storage. The model has disjoint row maps
+  // and one head pointer. A stale claim can branch privately without moving
+  // that pointer; only the run claiming the head may advance it.
+  // This driver checks both snapshots after the atomic rotation and rejects a
+  // late write admitted under the claim that moved away from the old map.
+  it(`rotates an on-demand cache into empty uncertified storage`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+      })
+      const collectionId = `on-demand-cache-generation`
+      const oldRow = { id: `old`, title: `Old source row` }
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: oldRow.id, value: oldRow }],
+        },
+      )
+
+      const claim = await adapter.claimCacheGeneration(collectionId)
+      expect(claim.storageCollectionId).not.toBe(collectionId)
+      const warmClaim = await adapter.claimCacheGeneration(collectionId)
+      expect(warmClaim.storageCollectionId).toBe(claim.storageCollectionId)
+      const readClaimed = (storageId: string, claimId: string) =>
+        adapter.loadResumeSnapshot(
+          { kind: `managed`, storageCollectionId: storageId, claimId: claimId },
+          {
+            cacheGenerationClaimId: claimId,
+          },
+        )
+      expect(
+        (await readClaimed(claim.storageCollectionId, claim.claimId)).rows,
+      ).toEqual([])
+      const resetMarker = { kind: `reset`, updatedAt: 1 }
+      const rotated = await adapter.rotateCacheGeneration(
+        collectionId,
+        claim.claimId,
+        { key: `electric:resume`, value: resetMarker },
+      )
+      expect(rotated.storageCollectionId).not.toBe(claim.storageCollectionId)
+
+      const oldSnapshot = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      const initialSnapshot = await readClaimed(
+        claim.storageCollectionId,
+        warmClaim.claimId,
+      )
+      const newSnapshot = await readClaimed(
+        rotated.storageCollectionId,
+        rotated.claimId,
+      )
+      const nextClaim = await adapter.claimCacheGeneration(collectionId)
+      expect(oldSnapshot.rows.map(({ value }) => value)).toEqual([oldRow])
+      expect(initialSnapshot.rows).toEqual([])
+      expect(newSnapshot.rows).toEqual([])
+      expect(newSnapshot.keySet).toEqual({ status: `incompatible` })
+      expect(newSnapshot.collectionMetadata).toEqual([
+        { key: `electric:resume`, value: resetMarker },
+      ])
+      await expect(
+        adapter.loadResumeSnapshot({
+          kind: `eager`,
+          collectionId: rotated.storageCollectionId,
+        }),
+      ).rejects.toThrow(`Persisted cache claim is required`)
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: rotated.storageCollectionId },
+          {
+            txId: `unclaimed-write`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [
+              { type: `insert`, key: `unclaimed`, value: { id: `unclaimed` } },
+            ],
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim is required`)
+      expect(nextClaim.storageCollectionId).toBe(rotated.storageCollectionId)
+
+      // An existing run keeps its old generation. Its source-backed writes
+      // remain separate from the recovering run's new uncertified cache.
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: warmClaim.storageCollectionId,
+          claimId: warmClaim.claimId,
+        },
+        {
+          txId: `warm-source-write`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: warmClaim.claimId,
+          mutations: [
+            {
+              type: `insert`,
+              key: `warm`,
+              value: { id: `warm`, title: `Still source backed` },
+            },
+          ],
+        },
+      )
+      expect(
+        (await readClaimed(rotated.storageCollectionId, rotated.claimId)).rows,
+      ).toEqual([])
+
+      // A writer from the previous library version knows only the public
+      // Collection ID. It may still change that legacy cache, but it cannot
+      // change either new-format generation or add rows to the current one.
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `legacy-late-write`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            {
+              type: `insert`,
+              key: `legacy-late`,
+              value: { id: `legacy-late`, title: `Legacy writer` },
+            },
+          ],
+        },
+      )
+      expect(
+        (await readClaimed(rotated.storageCollectionId, rotated.claimId)).rows,
+      ).toEqual([])
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: rotated.storageCollectionId },
+          {
+            txId: `unclaimed-new-write`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [
+              {
+                type: `insert`,
+                key: `unclaimed`,
+                value: { id: `unclaimed`, title: `No claim` },
+              },
+            ],
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim is required`)
+      const freshRow = { id: `fresh`, title: `Demanded source row` }
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: rotated.storageCollectionId,
+          claimId: claim.claimId,
+        },
+        {
+          txId: `fresh-subset-write`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: claim.claimId,
+          mutations: [{ type: `insert`, key: freshRow.id, value: freshRow }],
+        },
+      )
+      const partialSnapshot = await readClaimed(
+        rotated.storageCollectionId,
+        rotated.claimId,
+      )
+      expect(partialSnapshot.rows.map(({ value }) => value)).toEqual([freshRow])
+      expect(partialSnapshot.keySet).toEqual({ status: `incompatible` })
+
+      await expect(
+        adapter.applyCommittedTx(
+          {
+            kind: `managed`,
+            storageCollectionId: claim.storageCollectionId,
+            claimId: claim.claimId,
+          },
+          {
+            txId: `late-old-write`,
+            term: 1,
+            seq: 2,
+            rowVersion: 2,
+            cacheGenerationClaimId: claim.claimId,
+            mutations: [
+              {
+                type: `insert`,
+                key: `late`,
+                value: {
+                  id: `late`,
+                  title: `Must stay outside new generation`,
+                },
+              },
+            ],
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+
+      // A complete replacement can certify the new head for later runs.
+      // A warm run still claiming the old generation may itself lose source
+      // authority, but that loss says nothing about the certified head. Its
+      // replacement must stay private to that run instead of retiring the
+      // other run's valid cache.
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: rotated.storageCollectionId,
+          claimId: claim.claimId,
+        },
+        {
+          txId: `certify-new-head`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          cacheGenerationClaimId: claim.claimId,
+          truncate: true,
+          mutations: [{ type: `insert`, key: freshRow.id, value: freshRow }],
+        },
+      )
+      expect(
+        (await readClaimed(rotated.storageCollectionId, rotated.claimId))
+          .keySet,
+      ).toEqual({ status: `consistent` })
+      const secondRecovery = await adapter.rotateCacheGeneration(
+        collectionId,
+        warmClaim.claimId,
+        { key: `electric:resume`, value: { kind: `reset`, updatedAt: 2 } },
+      )
+      expect(secondRecovery.storageCollectionId).not.toBe(
+        rotated.storageCollectionId,
+      )
+      expect(
+        (
+          await readClaimed(rotated.storageCollectionId, rotated.claimId)
+        ).rows.map(({ value }) => value),
+      ).toEqual([freshRow])
+      expect(
+        (
+          await readClaimed(
+            secondRecovery.storageCollectionId,
+            secondRecovery.claimId,
+          )
+        ).rows,
+      ).toEqual([])
+      const latestClaim = await adapter.claimCacheGeneration(collectionId)
+      expect(latestClaim.storageCollectionId).toBe(rotated.storageCollectionId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: secondRecovery.storageCollectionId,
+          claimId: warmClaim.claimId,
+        },
+        {
+          txId: `private-source-write`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: warmClaim.claimId,
+          mutations: [
+            {
+              type: `insert`,
+              key: `private`,
+              value: { id: `private`, title: `Private source row` },
+            },
+          ],
+        },
+      )
+      expect(
+        (
+          await readClaimed(rotated.storageCollectionId, latestClaim.claimId)
+        ).rows.map(({ value }) => value),
+      ).toEqual([freshRow])
+
+      // A later rotation by the actual head owner allocates past the private
+      // branch, then becomes the head seen by future runs.
+      const thirdRecovery = await adapter.rotateCacheGeneration(
+        collectionId,
+        claim.claimId,
+        { key: `electric:resume`, value: { kind: `reset`, updatedAt: 3 } },
+      )
+      expect(thirdRecovery.storageCollectionId).not.toBe(
+        secondRecovery.storageCollectionId,
+      )
+      const finalClaim = await adapter.claimCacheGeneration(collectionId)
+      expect(finalClaim.storageCollectionId).toBe(
+        thirdRecovery.storageCollectionId,
+      )
+      expect(
+        database
+          .prepare(
+            `SELECT generation, retired FROM cache_generation
+             WHERE logical_id = ? ORDER BY generation`,
+          )
+          .all(collectionId),
+      ).toMatchObject([
+        // The old generation was collected when its final claim rotated.
+        { generation: 1, retired: 1 },
+        { generation: 2, retired: 1 },
+        { generation: 3, retired: 0 },
+      ])
+      await adapter.releaseCacheGenerationClaim(finalClaim.claimId)
+      await adapter.releaseCacheGenerationClaim(latestClaim.claimId)
+      await adapter.releaseCacheGenerationClaim(nextClaim.claimId)
+      await adapter.releaseCacheGenerationClaim(warmClaim.claimId)
+      await adapter.releaseCacheGenerationClaim(claim.claimId)
+      // The current head remains available for new runs after all claims
+      // release. A later checkpoint tests retirement of the old row table.
+      const currentAfterCleanup =
+        await adapter.claimCacheGeneration(collectionId)
+      expect(currentAfterCleanup.storageCollectionId).toBe(
+        thirdRecovery.storageCollectionId,
+      )
+      await adapter.releaseCacheGenerationClaim(currentAfterCleanup.claimId)
+      // Releasing a claim removes durable read authority too. The caller
+      // supplies the claim it used at admission, and SQLite checks it inside
+      // the read transaction before returning even an empty snapshot.
+      await expect(
+        adapter.loadResumeSnapshot(
+          {
+            kind: `managed`,
+            storageCollectionId: thirdRecovery.storageCollectionId,
+            claimId: claim.claimId,
+          },
+          {
+            cacheGenerationClaimId: claim.claimId,
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await expect(
+        adapter.loadSubset(
+          {
+            kind: `managed`,
+            storageCollectionId: thirdRecovery.storageCollectionId,
+            claimId: claim.claimId,
+          },
+          {},
+          {
+            cacheGenerationClaimId: claim.claimId,
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await expect(
+        adapter.scanRows(
+          {
+            kind: `managed`,
+            storageCollectionId: thirdRecovery.storageCollectionId,
+            claimId: claim.claimId,
+          },
+          undefined,
+          {
+            cacheGenerationClaimId: claim.claimId,
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await expect(
+        adapter.loadCollectionMetadata(
+          {
+            kind: `managed`,
+            storageCollectionId: thirdRecovery.storageCollectionId,
+            claimId: claim.claimId,
+          },
+          {
+            cacheGenerationClaimId: claim.claimId,
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // Claim revocation may race a durable read after its preliminary check.
+  // A held registration lookup puts the revocation between that check and
+  // the read transaction. The independent law permits no row or metadata to
+  // return after revocation; the in-transaction check is the comparison cut.
+  it(`rejects a cache read when its claim is revoked before the read transaction`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    const driver = createDriver(database)
+    const registrationEntered = deferred()
+    const releaseRegistration = deferred()
+    let holdRegistration = false
+    const gatedDriver: SQLiteDriver = {
+      ...driver,
+      query: async (sql, params) => {
+        if (holdRegistration && sql.includes(`FROM collection_registry`)) {
+          holdRegistration = false
+          registrationEntered.resolve()
+          await releaseRegistration.promise
+        }
+        return driver.query(sql, params)
+      },
+    }
+    const writer = new SQLiteCorePersistenceAdapter({ driver })
+    const reader = new SQLiteCorePersistenceAdapter({ driver: gatedDriver })
+    let read: ReturnType<typeof reader.loadResumeSnapshot> | undefined
+    let primaryFailure: unknown
+    try {
+      const claim = await writer.claimCacheGeneration(`revoked-cache-read`)
+      await writer.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: claim.storageCollectionId,
+          claimId: claim.claimId,
+        },
+        {
+          txId: `seed-row`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: claim.claimId,
+          mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
+        },
+      )
+      holdRegistration = true
+      read = reader.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: claim.storageCollectionId,
+          claimId: claim.claimId,
+        },
+        {
+          cacheGenerationClaimId: claim.claimId,
+        },
+      )
+      void read.catch(() => undefined)
+      await reachCheckpoint(registrationEntered.promise, `registration lookup`)
+      await writer.releaseCacheGenerationClaim(claim.claimId)
+      releaseRegistration.resolve()
+      await expect(read).rejects.toThrow(`Persisted cache claim`)
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseRegistration.resolve()
+      await Promise.allSettled([read])
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A retired generation is a cache, not an archive. Its last claim is the
+  // only remaining reason to retain its rows. The model has two independent
+  // row maps: releasing the final old claim empties only the retired map,
+  // while the current generation keeps its source rows and stays claimable.
+  // The real SQLite row counts are the comparison checkpoint; a public
+  // Collection snapshot alone would miss an unbounded durable leak.
+  it(`reclaims retired cache rows after their last claim releases`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+      })
+      const logicalId = `retired-cache-collection`
+      const first = await adapter.claimCacheGeneration(logicalId)
+      const warm = await adapter.claimCacheGeneration(logicalId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: first.storageCollectionId,
+          claimId: first.claimId,
+        },
+        {
+          txId: `old-row`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: first.claimId,
+          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
+        },
+      )
+      const current = await adapter.rotateCacheGeneration(
+        logicalId,
+        first.claimId,
+      )
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: current.storageCollectionId,
+          claimId: current.claimId,
+        },
+        {
+          txId: `current-row`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: current.claimId,
+          mutations: [
+            { type: `insert`, key: `current`, value: { id: `current` } },
+          ],
+        },
+      )
+      const oldTable = createPersistedTableName(first.storageCollectionId, `c`)
+      const countOld = () =>
+        (
+          database
+            .prepare(`SELECT COUNT(*) AS count FROM "${oldTable}"`)
+            .get() as {
+            count: number
+          }
+        ).count
+      expect(countOld()).toBe(1)
+      await adapter.releaseCacheGenerationClaim(warm.claimId)
+      expect(
+        database
+          .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
+          .get(oldTable),
+      ).toBeUndefined()
+      expect(
+        (
+          await adapter.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: current.storageCollectionId,
+              claimId: current.claimId,
+            },
+            {
+              cacheGenerationClaimId: current.claimId,
+            },
+          )
+        ).rows.map(({ key }) => key),
+      ).toEqual([`current`])
+      const next = await adapter.claimCacheGeneration(logicalId)
+      expect(next.storageCollectionId).toBe(current.storageCollectionId)
+      await adapter.releaseCacheGenerationClaim(next.claimId)
+      await adapter.releaseCacheGenerationClaim(current.claimId)
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // Schema registration can pause while another adapter collects the retired
+  // generation. A late registration may finish only by rejecting and removing
+  // its own empty table and metadata; it must not resurrect SQLite storage
+  // after the last claim has gone away. Two real-adapter boundaries hold it:
+  // - Incomplete setup (a key-evidence trigger is missing) runs setup DDL,
+  //   so the gate holds the first CREATE TABLE, which would recreate the
+  //   collected table.
+  // - Complete setup skips DDL, so the gate holds just after the registry
+  //   read, whose setup check then goes stale.
+  // Both gates are before the final read result.
+  it.each([
+    { setup: `incomplete`, gate: `DDL` },
+    { setup: `complete`, gate: `registry read` },
+  ] as const)(
+    `does not resurrect a collected table after held registration resumes ($setup setup, held at $gate)`,
+    async ({ setup }) => {
+      const database = new DatabaseSync(`:memory:`)
+      let primaryFailure: unknown
+      const driver = createDriver(database)
+      const createEntered = deferred()
+      const releaseCreate = deferred()
+      let holdCreate = false
+      let oldTable = ``
+      const hold = async () => {
+        holdCreate = false
+        createEntered.resolve()
+        await releaseCreate.promise
+      }
+      const gatedDriver: SQLiteDriver = {
+        ...driver,
+        exec: async (sql) => {
+          if (
+            setup === `incomplete` &&
+            holdCreate &&
+            sql.includes(`CREATE TABLE IF NOT EXISTS`) &&
+            sql.includes(oldTable)
+          ) {
+            await hold()
+          }
+          return driver.exec(sql)
+        },
+        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
+          const rows = await driver.query<T>(sql, params)
+          if (
+            setup === `complete` &&
+            holdCreate &&
+            sql.includes(`FROM collection_registry`)
+          ) {
+            await hold()
+          }
+          return rows
+        },
+      }
+      const writer = new SQLiteCorePersistenceAdapter({ driver })
+      const reader = new SQLiteCorePersistenceAdapter({ driver: gatedDriver })
+      let read: ReturnType<typeof reader.loadResumeSnapshot> | undefined
+      try {
+        const logicalId = `held-registration-collection`
+        const rotating = await writer.claimCacheGeneration(logicalId)
+        const warm = await writer.claimCacheGeneration(logicalId)
+        oldTable = createPersistedTableName(rotating.storageCollectionId, `c`)
+        await writer.applyCommittedTx(
+          {
+            kind: `managed`,
+            storageCollectionId: rotating.storageCollectionId,
+            claimId: rotating.claimId,
+          },
+          {
+            txId: `old`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            cacheGenerationClaimId: rotating.claimId,
+            mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
+          },
+        )
+        await writer.rotateCacheGeneration(logicalId, rotating.claimId)
+        if (setup === `incomplete`) {
+          database.exec(`DROP TRIGGER "${oldTable}_key_evidence_update"`)
+        }
+        holdCreate = true
+        read = reader.loadResumeSnapshot(
+          {
+            kind: `managed`,
+            storageCollectionId: rotating.storageCollectionId,
+            claimId: warm.claimId,
+          },
+          {
+            cacheGenerationClaimId: warm.claimId,
+          },
+        )
+        void read.catch(() => undefined)
+        await reachCheckpoint(createEntered.promise, `held registration`)
+        await writer.releaseCacheGenerationClaim(warm.claimId)
+        releaseCreate.resolve()
+        await expect(read).rejects.toThrow(`collected before registration`)
+        expect(
+          database
+            .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
+            .get(oldTable),
+        ).toBeUndefined()
+        expect(
+          database
+            .prepare(
+              `SELECT collection_id FROM collection_version WHERE collection_id = ?`,
+            )
+            .get(rotating.storageCollectionId),
+        ).toBeUndefined()
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        releaseCreate.resolve()
+        await Promise.allSettled([read])
+        closeDatabasePreservingPrimary(database, primaryFailure)
+      }
+    },
+  )
+
+  // Claim validation can finish before schema registration even begins. If
+  // the last claim releases in that interval, a second catalog lookup finds
+  // no generation row. The request still carries managed-cache identity; it
+  // must remove any table it creates before rejecting the later read.
+  it(`does not lose managed identity before a held registration lookup`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    const driver = createDriver(database)
+    const lookupEntered = deferred()
+    const releaseLookup = deferred()
+    let holdLookup = false
+    const gatedDriver: SQLiteDriver = {
+      ...driver,
+      query: async (sql, params) => {
+        if (
+          holdLookup &&
+          sql.includes(
+            `SELECT physical_id FROM cache_generation WHERE physical_id = ?`,
+          )
+        ) {
+          holdLookup = false
+          lookupEntered.resolve()
+          await releaseLookup.promise
+        }
+        return driver.query(sql, params)
+      },
+    }
+    const writer = new SQLiteCorePersistenceAdapter({ driver })
+    const reader = new SQLiteCorePersistenceAdapter({ driver: gatedDriver })
+    let read: ReturnType<typeof reader.loadResumeSnapshot> | undefined
+    try {
+      const logicalId = `held-managed-catalog-lookup`
+      const rotating = await writer.claimCacheGeneration(logicalId)
+      const warm = await writer.claimCacheGeneration(logicalId)
+      await writer.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: rotating.storageCollectionId,
+          claimId: rotating.claimId,
+        },
+        {
+          txId: `old`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: rotating.claimId,
+          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
+        },
+      )
+      await writer.rotateCacheGeneration(logicalId, rotating.claimId)
+      const oldTable = createPersistedTableName(
+        rotating.storageCollectionId,
+        `c`,
+      )
+      holdLookup = true
+      read = reader.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: rotating.storageCollectionId,
+          claimId: warm.claimId,
+        },
+        {
+          cacheGenerationClaimId: warm.claimId,
+        },
+      )
+      void read.catch(() => undefined)
+      await reachCheckpoint(lookupEntered.promise, `managed catalog lookup`)
+      await writer.releaseCacheGenerationClaim(warm.claimId)
+      releaseLookup.resolve()
+      await expect(read).rejects.toThrow()
+      expect(
+        database
+          .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
+          .get(oldTable),
+      ).toBeUndefined()
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseLookup.resolve()
+      await Promise.allSettled([read])
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A claim moved to a new physical generation no longer authorizes schema
+  // reset in the old one. The other run's live claim retains its old rows and
+  // metadata even when the stale run entered registration while its claim was
+  // valid. This authored two-run history pauses the real adapter's registry
+  // lookup, moves only one claim, then compares the remaining run's durable
+  // schema, row, transaction ID, and reset epoch after the stale read rejects.
+  it(`preserves a warm generation when a stale registration would reset its schema`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    const driver = createDriver(database)
+    const registrationEntered = deferred()
+    const releaseRegistration = deferred()
+    let holdRegistration = false
+    const gatedDriver: SQLiteDriver = {
+      ...driver,
+      query: async (sql, params) => {
+        if (
+          holdRegistration &&
+          sql.includes(`SELECT table_name,`) &&
+          sql.includes(`FROM collection_registry`)
+        ) {
+          holdRegistration = false
+          registrationEntered.resolve()
+          await releaseRegistration.promise
+        }
+        return driver.query(sql, params)
+      },
+    }
+    const writer = new SQLiteCorePersistenceAdapter({
+      driver,
+      schemaVersion: 1,
+    })
+    const staleReader = new SQLiteCorePersistenceAdapter({
+      driver: gatedDriver,
+      schemaVersion: 2,
+      schemaMismatchPolicy: `sync-present-reset`,
+    })
+    let read: ReturnType<typeof staleReader.loadResumeSnapshot> | undefined
+    try {
+      const logicalId = `stale-schema-reset`
+      const moving = await writer.claimCacheGeneration(logicalId)
+      const warm = await writer.claimCacheGeneration(logicalId)
+      const oldId = moving.storageCollectionId
+      const oldTable = createPersistedTableName(oldId, `c`)
+      await writer.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: oldId,
+          claimId: moving.claimId,
+        },
+        {
+          txId: `warm-row`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: moving.claimId,
+          mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
+        },
+      )
+
+      holdRegistration = true
+      read = staleReader.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: oldId,
+          claimId: moving.claimId,
+        },
+        {
+          cacheGenerationClaimId: moving.claimId,
+        },
+      )
+      void read.catch(() => undefined)
+      await reachCheckpoint(
+        registrationEntered.promise,
+        `stale registry lookup`,
+      )
+      const current = await writer.rotateCacheGeneration(
+        logicalId,
+        moving.claimId,
+      )
+      expect(current.storageCollectionId).not.toBe(oldId)
+      releaseRegistration.resolve()
+      await expect(read).rejects.toThrow(`Persisted cache claim`)
+
+      expect(
+        database
+          .prepare(
+            `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
+          )
+          .get(oldId),
+      ).toEqual({ schema_version: 1 })
+      expect(database.prepare(`SELECT key FROM "${oldTable}"`).all()).toEqual([
+        { key: encodePersistedStorageKey(`row`) },
+      ])
+      expect(
+        database
+          .prepare(`SELECT tx_id FROM applied_tx WHERE collection_id = ?`)
+          .all(oldId),
+      ).toEqual([{ tx_id: `warm-row` }])
+      expect(
+        database
+          .prepare(
+            `SELECT reset_epoch FROM collection_reset_epoch WHERE collection_id = ?`,
+          )
+          .get(oldId),
+      ).toEqual({ reset_epoch: 0 })
+      expect(
+        (
+          await writer.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: oldId,
+              claimId: warm.claimId,
+            },
+            {
+              cacheGenerationClaimId: warm.claimId,
+            },
+          )
+        ).rows.map(({ key }) => key),
+      ).toEqual([`row`])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseRegistration.resolve()
+      await Promise.allSettled([read])
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A fresh rotated generation can contain resume metadata before its first
+  // table registration. If one claim moves during that first lookup, the
+  // former claimant cannot choose the old generation's schema. Otherwise the
+  // remaining run's next read treats the unauthorized schema as a mismatch
+  // and deletes its resume metadata. The model retains that metadata through
+  // the stale rejection and the warm run's subsequent read.
+  it(`preserves a warm generation's resume metadata across stale first registration`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    const driver = createDriver(database)
+    const registrationEntered = deferred()
+    const releaseRegistration = deferred()
+    let holdRegistration = false
+    const gatedDriver: SQLiteDriver = {
+      ...driver,
+      query: async (sql, params) => {
+        if (
+          holdRegistration &&
+          sql.includes(`SELECT table_name,`) &&
+          sql.includes(`FROM collection_registry`)
+        ) {
+          holdRegistration = false
+          registrationEntered.resolve()
+          await releaseRegistration.promise
+        }
+        return driver.query(sql, params)
+      },
+    }
+    const writer = new SQLiteCorePersistenceAdapter({
+      driver,
+      schemaVersion: 1,
+    })
+    const staleReader = new SQLiteCorePersistenceAdapter({
+      driver: gatedDriver,
+      schemaVersion: 2,
+      schemaMismatchPolicy: `sync-present-reset`,
+    })
+    let read: ReturnType<typeof staleReader.loadResumeSnapshot> | undefined
+    try {
+      const logicalId = `stale-first-registration`
+      const first = await writer.claimCacheGeneration(logicalId)
+      const moving = await writer.rotateCacheGeneration(
+        logicalId,
+        first.claimId,
+        { key: `resume`, value: `must-survive` },
+      )
+      const warm = await writer.claimCacheGeneration(logicalId)
+      const oldId = moving.storageCollectionId
+
+      holdRegistration = true
+      read = staleReader.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: oldId,
+          claimId: moving.claimId,
+        },
+        {
+          cacheGenerationClaimId: moving.claimId,
+        },
+      )
+      void read.catch(() => undefined)
+      await reachCheckpoint(
+        registrationEntered.promise,
+        `first registry lookup`,
+      )
+      const current = await writer.rotateCacheGeneration(
+        logicalId,
+        moving.claimId,
+      )
+      expect(current.storageCollectionId).not.toBe(oldId)
+      releaseRegistration.resolve()
+      await expect(read).rejects.toThrow(`Persisted cache claim`)
+
+      expect(
+        database
+          .prepare(
+            `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
+          )
+          .get(oldId),
+      ).toBeUndefined()
+      expect(
+        (
+          await writer.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: oldId,
+              claimId: warm.claimId,
+            },
+            {
+              cacheGenerationClaimId: warm.claimId,
+            },
+          )
+        ).collectionMetadata,
+      ).toEqual([{ key: `resume`, value: `must-survive` }])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseRegistration.resolve()
+      await Promise.allSettled([read])
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A paused run cannot keep retired bytes forever. In the model, a claim is
+  // usable only before its expiry cut; a new run collects an expired retired
+  // generation without touching the current head. The old run may then make
+  // a private empty generation for fresh demanded source snapshots, but it
+  // cannot reclaim the expired rows or retire the head used by another run.
+  it(`expires a paused claim and recovers privately without displacing the current cache`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    let now = 1_000
+    try {
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+        cacheGenerationClaimTtlMs: 100,
+        now: () => now,
+      })
+      const logicalId = `expired-cache-claim`
+      const old = await adapter.claimCacheGeneration(logicalId)
+      const paused = await adapter.claimCacheGeneration(logicalId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: old.storageCollectionId,
+          claimId: old.claimId,
+        },
+        {
+          txId: `old`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: old.claimId,
+          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
+        },
+      )
+      const head = await adapter.rotateCacheGeneration(logicalId, old.claimId)
+      const headTable = createPersistedTableName(head.storageCollectionId, `c`)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: head.storageCollectionId,
+          claimId: head.claimId,
+        },
+        {
+          txId: `head`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: head.claimId,
+          mutations: [{ type: `insert`, key: `head`, value: { id: `head` } }],
+        },
+      )
+      now = 1_090
+      expect(
+        await adapter.renewCacheGenerationClaim(
+          head.storageCollectionId,
+          head.claimId,
+        ),
+      ).toBe(1_190)
+      now = 1_110
+      const next = await adapter.claimCacheGeneration(logicalId)
+      expect(next.storageCollectionId).toBe(head.storageCollectionId)
+      await expect(
+        adapter.loadResumeSnapshot(
+          {
+            kind: `managed`,
+            storageCollectionId: old.storageCollectionId,
+            claimId: paused.claimId,
+          },
+          {
+            cacheGenerationClaimId: paused.claimId,
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      const oldTable = createPersistedTableName(old.storageCollectionId, `c`)
+      expect(
+        database
+          .prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
+          .get(oldTable),
+      ).toBeUndefined()
+      const privateRecovery = await adapter.rotateCacheGeneration(
+        logicalId,
+        paused.claimId,
+      )
+      expect(privateRecovery.storageCollectionId).not.toBe(
+        head.storageCollectionId,
+      )
+      expect(
+        (await adapter.claimCacheGeneration(logicalId)).storageCollectionId,
+      ).toBe(head.storageCollectionId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: privateRecovery.storageCollectionId,
+          claimId: privateRecovery.claimId,
+        },
+        {
+          txId: `fresh-subset`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: privateRecovery.claimId,
+          mutations: [{ type: `insert`, key: `fresh`, value: { id: `fresh` } }],
+        },
+      )
+      expect(
+        (
+          database
+            .prepare(`SELECT COUNT(*) AS count FROM "${headTable}"`)
+            .get() as {
+            count: number
+          }
+        ).count,
+      ).toBe(1)
+      expect(
+        (
+          await adapter.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: privateRecovery.storageCollectionId,
+              claimId: privateRecovery.claimId,
+            },
+            { cacheGenerationClaimId: privateRecovery.claimId },
+          )
+        ).rows.map(({ key }) => key),
+      ).toEqual([`fresh`])
+      await adapter.releaseCacheGenerationClaim(privateRecovery.claimId)
+      const advanced = await adapter.rotateCacheGeneration(
+        logicalId,
+        head.claimId,
+        undefined,
+        head.storageCollectionId,
+      )
+      expect(
+        database
+          .prepare(
+            `SELECT generation FROM cache_generation WHERE physical_id = ?`,
+          )
+          .get(advanced.storageCollectionId),
+      ).toMatchObject({ generation: 3 })
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // Expiry revokes this run's authority, not another run's ability to claim
+  // the current cache. Recovery must use private empty storage even when the
+  // expired claim remembered the current storage ID.
+  it(`keeps the current cache claimable when its expired claimant recovers`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    let now = 1_000
+    try {
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+        cacheGenerationClaimTtlMs: 100,
+        now: () => now,
+      })
+      const logicalId = `expired-head-recovery`
+      const old = await adapter.claimCacheGeneration(logicalId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: old.storageCollectionId,
+          claimId: old.claimId,
+        },
+        {
+          txId: `old`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: old.claimId,
+          mutations: [{ type: `insert`, key: `old`, value: { id: `old` } }],
+        },
+      )
+      now = 1_101
+      expect(
+        await adapter.renewCacheGenerationClaim(
+          old.storageCollectionId,
+          old.claimId,
+        ),
+      ).toBeUndefined()
+      const repaired = await adapter.rotateCacheGeneration(
+        logicalId,
+        old.claimId,
+        undefined,
+        old.storageCollectionId,
+      )
+      const next = await adapter.claimCacheGeneration(logicalId)
+      expect(next.storageCollectionId).toBe(old.storageCollectionId)
+      expect(repaired.storageCollectionId).not.toBe(old.storageCollectionId)
+      expect(
+        (
+          await adapter.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: next.storageCollectionId,
+              claimId: next.claimId,
+            },
+            {
+              cacheGenerationClaimId: next.claimId,
+            },
+          )
+        ).rows.map(({ key }) => key),
+      ).toEqual([`old`])
+      await expect(
+        adapter.loadResumeSnapshot(
+          {
+            kind: `managed`,
+            storageCollectionId: old.storageCollectionId,
+            claimId: old.claimId,
+          },
+          {
+            cacheGenerationClaimId: old.claimId,
+          },
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await adapter.releaseCacheGenerationClaim(next.claimId)
+      await adapter.releaseCacheGenerationClaim(repaired.claimId)
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // Scoped recovery may start rotation while this run still owns the current
+  // cache, then its claim may expire before SQLite decides ownership.
+  // The independent rule uses authority at the rotation transaction: the
+  // recovering run gets private empty storage, while a live peer and future
+  // claimants retain the original head. This history holds the real adapter's
+  // rotation before its transaction, then crosses expiry. After a fresh subset
+  // load settles, public rows and both claimed SQLite snapshots must match
+  // those two independent storage routes. An empty source subset cannot make
+  // the recovering run's old cached row authoritative again. The
+  // controlled source supplies the recovery decision; provider classification
+  // of malformed metadata is a separate receiving obligation.
+  it(`keeps a warm peer's cache when scoped recovery crosses claim expiry`, async () => {
+    type Row = { id: string; title: string }
+    const database = new DatabaseSync(`:memory:`)
+    const logicalId = `resume-loss-then-expiry`
+    let now = Date.now()
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver: createDriver(database),
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => now,
+    })
+    const rotationEntered = deferred()
+    const releaseRotation = deferred()
+    const rotate = adapter.rotateCacheGeneration.bind(adapter)
+    adapter.rotateCacheGeneration = async (...args) => {
+      rotationEntered.resolve()
+      await releaseRotation.promise
+      return rotate(...args)
+    }
+    const oldRow: Row = { id: `old`, title: `Warm cached row` }
+    const freshRow: Row = { id: `fresh`, title: `Fresh source row` }
+    const warmResume = {
+      kind: `resume`,
+      requiresTagState: false,
+      offset: `10_0`,
+      handle: `warm-handle`,
+      shapeId: `warm-shape`,
+      updatedAt: 1,
+    }
+    const resetMarker = { kind: `reset`, updatedAt: 2 }
+    let recoveringSource: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+    let freshDemand = false
+    const recoveringStarted = deferred()
+    const warmStarted = deferred()
+    const createPeer = (recovering: boolean) =>
+      createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (source) => {
+              if (recovering) recoveringSource = source
+              source.markReady()
+              if (recovering) recoveringStarted.resolve()
+              else warmStarted.resolve()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async () => {
+                  if (recovering && freshDemand) {
+                    source.begin()
+                    source.write({ type: `insert`, value: freshRow })
+                    await source.commit()
+                  }
+                },
+              }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+    let recovering: Collection<Row, string> | undefined
+    let warm: Collection<Row, string> | undefined
+    let recovery: Promise<void> | undefined
+    let laterClaimId: string | undefined
+    let primaryFailure: unknown
+    try {
+      const seed = await adapter.claimCacheGeneration(logicalId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: seed.storageCollectionId,
+          claimId: seed.claimId,
+        },
+        {
+          txId: `old-source-row`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: seed.claimId,
+          mutations: [{ type: `insert`, key: oldRow.id, value: oldRow }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `electric:resume`, value: warmResume },
+          ],
+        },
+      )
+      await adapter.releaseCacheGenerationClaim(seed.claimId)
+
+      recovering = createPeer(true)
+      recovering.startSyncImmediate()
+      await reachCheckpoint(
+        recoveringStarted.promise,
+        `recovering source start`,
+      )
+      const initialClaim = database
+        .prepare(
+          `SELECT claim_id, physical_id, expires_at_ms
+           FROM cache_generation_claim WHERE logical_id = ?`,
+        )
+        .get(logicalId) as {
+        claim_id: string
+        physical_id: string
+        expires_at_ms: number
+      }
+      warm = createPeer(false)
+      warm.startSyncImmediate()
+      await reachCheckpoint(warmStarted.promise, `warm source start`)
+      await warm._sync.loadSubset({})
+      expect(warm.get(oldRow.id)).toMatchObject(oldRow)
+      const warmClaim = database
+        .prepare(
+          `SELECT claim_id, physical_id FROM cache_generation_claim
+           WHERE logical_id = ? AND claim_id <> ?`,
+        )
+        .get(logicalId, initialClaim.claim_id) as {
+        claim_id: string
+        physical_id: string
+      }
+      expect(warmClaim.physical_id).toBe(initialClaim.physical_id)
+
+      now += 9_000
+      const warmExpiresAt = await adapter.renewCacheGenerationClaim(
+        warmClaim.physical_id,
+        warmClaim.claim_id,
+      )
+      expect(warmExpiresAt).toBeGreaterThan(initialClaim.expires_at_ms)
+      recovery = recoveringSource!.metadata!.persistence!.startScopedRecovery!({
+        key: `electric:resume`,
+        value: resetMarker,
+      })
+      void recovery.catch(() => undefined)
+      await reachCheckpoint(rotationEntered.promise, `held cache rotation`)
+      now += 2_000
+      expect(now).toBeGreaterThan(initialClaim.expires_at_ms)
+      expect(now).toBeLessThan(warmExpiresAt!)
+      releaseRotation.resolve()
+      await reachCheckpoint(recovery, `private scoped recovery`)
+
+      const recoveringClaim = database
+        .prepare(
+          `SELECT physical_id FROM cache_generation_claim WHERE claim_id = ?`,
+        )
+        .get(initialClaim.claim_id) as { physical_id: string }
+      const head = database
+        .prepare(
+          `SELECT physical_id FROM cache_generation
+           WHERE logical_id = ? AND retired = 0`,
+        )
+        .get(logicalId) as { physical_id: string }
+      expect(recoveringClaim.physical_id).not.toBe(initialClaim.physical_id)
+      expect(head.physical_id).toBe(initialClaim.physical_id)
+
+      await recovering._sync.loadSubset({})
+      expect(Array.from(recovering.values())).toEqual([])
+      expect(
+        (
+          await adapter.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: recoveringClaim.physical_id,
+              claimId: initialClaim.claim_id,
+            },
+            {
+              cacheGenerationClaimId: initialClaim.claim_id,
+            },
+          )
+        ).rows,
+      ).toEqual([])
+
+      freshDemand = true
+      await recovering._sync.loadSubset({})
+      const laterClaim = await adapter.claimCacheGeneration(logicalId)
+      laterClaimId = laterClaim.claimId
+      expect(laterClaim.storageCollectionId).toBe(initialClaim.physical_id)
+      expect(Array.from(recovering.values(), ({ id }) => id)).toEqual([
+        freshRow.id,
+      ])
+      expect(Array.from(warm.values(), ({ id }) => id)).toEqual([oldRow.id])
+      const privateSnapshot = await adapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: recoveringClaim.physical_id,
+          claimId: initialClaim.claim_id,
+        },
+        { cacheGenerationClaimId: initialClaim.claim_id },
+      )
+      const warmSnapshot = await adapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: warmClaim.physical_id,
+          claimId: warmClaim.claim_id,
+        },
+        { cacheGenerationClaimId: warmClaim.claim_id },
+      )
+      expect(privateSnapshot.rows.map(({ key }) => key)).toEqual([freshRow.id])
+      expect(privateSnapshot.collectionMetadata).toEqual([
+        { key: `electric:resume`, value: resetMarker },
+      ])
+      expect(warmSnapshot.rows.map(({ key }) => key)).toEqual([oldRow.id])
+      expect(warmSnapshot.collectionMetadata).toEqual([
+        { key: `electric:resume`, value: warmResume },
+      ])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseRotation.resolve()
+      const cleanupFailures: Array<unknown> = []
+      const cleanupTimeoutMs = primaryFailure === undefined ? 1_000 : 200
+      if (recovery) {
+        try {
+          await reachCheckpoint(recovery, `recovery cleanup`, cleanupTimeoutMs)
+        } catch (error) {
+          cleanupFailures.push(error)
+        }
+      }
+      for (const release of [
+        () => recovering?.cleanup(),
+        () => warm?.cleanup(),
+        () =>
+          laterClaimId
+            ? adapter.releaseCacheGenerationClaim(laterClaimId)
+            : undefined,
+      ]) {
+        try {
+          const settling = release()
+          if (settling) {
+            await reachCheckpoint(settling, `peer cleanup`, cleanupTimeoutMs)
+          }
+        } catch (error) {
+          cleanupFailures.push(error)
+        }
+      }
+      closeDatabasePreservingPrimary(database, primaryFailure, cleanupFailures)
+    }
+  })
+
+  // A peer's live claim does not extend an expired run's authority. The model
+  // grants each run its own expiring claim even when both share one generation.
+  // Stream-position, replay, and index work must use the initiating claim at
+  // the SQLite transaction cut. The warm peer must still be able to use the
+  // same generation, so rejecting every operation is not a valid repair.
+  it(`rejects coordinator work from an expired claimant while its peer remains live`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    let now = 1_000
+    try {
+      const adapter = new SQLiteCorePersistenceAdapter({
+        driver: createDriver(database),
+        cacheGenerationClaimTtlMs: 100,
+        now: () => now,
+      })
+      const claim = await adapter.claimCacheGeneration(`coordinator-claim`)
+      const id = claim.storageCollectionId
+      const claimCtx = { cacheGenerationClaimId: claim.claimId }
+      const claimTarget = {
+        kind: `managed` as const,
+        storageCollectionId: id,
+        claimId: claim.claimId,
+      }
+      await adapter.applyCommittedTx(
+        { kind: `managed`, storageCollectionId: id, claimId: claim.claimId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: claim.claimId,
+          mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
+        },
+      )
+      await adapter.ensureIndex(
+        claimTarget,
+        `existing`,
+        { expressionSql: [`json_extract(value, '$.id')`] },
+        claimCtx,
+      )
+      now = 1_050
+      const peer = await adapter.claimCacheGeneration(`coordinator-claim`)
+      const peerCtx = { cacheGenerationClaimId: peer.claimId }
+      const peerTarget = {
+        kind: `managed` as const,
+        storageCollectionId: id,
+        claimId: peer.claimId,
+      }
+      now = 1_101
+      expect(adapter.getCacheGenerationNow()).toBe(now)
+      await expect(
+        adapter.getStreamPosition(claimTarget, claimCtx),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await expect(adapter.pullSince(claimTarget, 0, claimCtx)).rejects.toThrow(
+        `Persisted cache claim`,
+      )
+      await expect(
+        adapter.ensureIndex(
+          claimTarget,
+          `late`,
+          { expressionSql: [`json_extract(value, '$.id')`] },
+          claimCtx,
+        ),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await expect(
+        adapter.markIndexRemoved(claimTarget, `existing`, claimCtx),
+      ).rejects.toThrow(`Persisted cache claim`)
+      await expect(
+        adapter.getStreamPosition({ kind: `eager`, collectionId: id }),
+      ).rejects.toThrow(`Persisted cache claim`)
+
+      expect(
+        await adapter.getStreamPosition(peerTarget, peerCtx),
+      ).toMatchObject({
+        latestTerm: 1,
+        latestSeq: 1,
+      })
+      expect(await adapter.pullSince(peerTarget, 0, peerCtx)).toMatchObject({
+        changedKeys: [`row`],
+      })
+      await adapter.ensureIndex(
+        peerTarget,
+        `peer`,
+        { expressionSql: [`json_extract(value, '$.id')`] },
+        peerCtx,
+      )
+      await adapter.markIndexRemoved(peerTarget, `peer`, peerCtx)
+      expect(
+        database
+          .prepare(
+            `SELECT signature, removed FROM persisted_index_registry
+             WHERE collection_id = ? ORDER BY signature`,
+          )
+          .all(id),
+      ).toEqual([
+        { signature: `existing`, removed: 0 },
+        { signature: `peer`, removed: 1 },
+      ])
+      await adapter.releaseCacheGenerationClaim(peer.claimId)
+      await expect(
+        adapter.getStreamPosition(peerTarget, peerCtx),
+      ).rejects.toThrow(`Persisted cache claim`)
+      const next = await adapter.claimCacheGeneration(`coordinator-claim`)
+      expect(next.storageCollectionId).toBe(id)
+      expect(
+        await adapter.getStreamPosition(
+          { kind: `managed`, storageCollectionId: id, claimId: next.claimId },
+          {
+            cacheGenerationClaimId: next.claimId,
+          },
+        ),
+      ).toMatchObject({ latestRowVersion: 1 })
+      await adapter.releaseCacheGenerationClaim(next.claimId)
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // Index events are a public route to durable work. Two Collection instances
+  // start on one persisted cache generation with the same index. When the
+  // first run's claim expires, removing its public index cannot remove the
+  // physical index still owned by the warm run. Removing the warm run's index
+  // afterward must succeed, so the boundary is the initiating claim rather
+  // than a blanket ban on index changes to a retired generation.
+  it(`keeps a warm peer's SQLite index after an expired Collection removes its index`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    let now = Date.now()
+    const logicalId = `peer-index-after-expiry`
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver: createDriver(database),
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => now,
+    })
+    const createIndexedCollection = () => {
+      const sourceStarted = deferred()
+      const collection = createCollection(
+        persistedCollectionOptions<{ id: string; title: string }, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          defaultIndexType: BasicIndex,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              sourceStarted.resolve()
+              return { restartAfterScopedRecovery: () => {} }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      const index = collection.createIndex((row) => row.title, {
+        name: `shared-title`,
+      })
+      const signature = collection
+        .getIndexMetadata()
+        .find((metadata) => metadata.indexId === index.id)?.signature
+      if (!signature) throw new Error(`Missing index signature`)
+      collection.startSyncImmediate()
+      return { collection, index, signature, sourceStarted }
+    }
+    let first: ReturnType<typeof createIndexedCollection> | undefined
+    let peer: ReturnType<typeof createIndexedCollection> | undefined
+    try {
+      first = createIndexedCollection()
+      await reachCheckpoint(first.sourceStarted.promise, `first indexed source`)
+      const originalClaim = database
+        .prepare(
+          `SELECT claim_id, physical_id, expires_at_ms
+           FROM cache_generation_claim WHERE logical_id = ?`,
+        )
+        .get(logicalId) as {
+        claim_id: string
+        physical_id: string
+        expires_at_ms: number
+      }
+
+      now += 5_000
+      peer = createIndexedCollection()
+      await reachCheckpoint(peer.sourceStarted.promise, `peer indexed source`)
+      expect(peer.signature).toBe(first.signature)
+      const peerClaim = database
+        .prepare(
+          `SELECT claim_id, physical_id, expires_at_ms
+           FROM cache_generation_claim
+           WHERE logical_id = ? AND claim_id <> ?`,
+        )
+        .get(logicalId, originalClaim.claim_id) as {
+        claim_id: string
+        physical_id: string
+        expires_at_ms: number
+      }
+      expect(peerClaim.physical_id).toBe(originalClaim.physical_id)
+      const indexState = () =>
+        database
+          .prepare(
+            `SELECT removed FROM persisted_index_registry
+             WHERE collection_id = ? AND signature = ?`,
+          )
+          .get(originalClaim.physical_id, first!.signature) as
+          { removed: number } | undefined
+      expect(indexState()).toEqual({ removed: 0 })
+
+      now += 6_000
+      expect(now).toBeGreaterThan(originalClaim.expires_at_ms)
+      expect(now).toBeLessThan(peerClaim.expires_at_ms)
+      first.collection.removeIndex(first.index)
+      await vi.waitFor(() => {
+        const moved = database
+          .prepare(
+            `SELECT physical_id FROM cache_generation_claim
+             WHERE logical_id = ? AND claim_id <> ?`,
+          )
+          .get(logicalId, peerClaim.claim_id) as
+          { physical_id: string } | undefined
+        expect(moved?.physical_id).toBeDefined()
+        expect(moved?.physical_id).not.toBe(originalClaim.physical_id)
+      })
+      expect(indexState()).toEqual({ removed: 0 })
+
+      peer.collection.removeIndex(peer.index)
+      await vi.waitFor(() => expect(indexState()).toEqual({ removed: 1 }))
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      try {
+        await first?.collection.cleanup()
+        await peer?.collection.cleanup()
+      } catch (error) {
+        primaryFailure ??= error
+      }
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // The Collection's current index declaration is the independent authority
+  // for the final physical index. A cache rotation may ask SQLite to create an
+  // index, then the Collection may remove that declaration before DDL enters
+  // SQLite. The removal may finish first, and a re-add may occur while the
+  // reconciliation removal is held. These are real-SQLite receiving cuts for
+  // the controlled reverse-order histories in persisted-oracle.test.ts. The
+  // public declaration and SQLite's registry plus sqlite_master are compared
+  // after recovery. Holds control call order, not SQLite's DDL implementation.
+  for (const readdDuringReconciliation of [false, true]) {
+    it(
+      readdDuringReconciliation
+        ? `restores a SQLite index re-added during late-ensure reconciliation`
+        : `removes a late SQLite index after its Collection declaration is removed`,
+      async () => {
+        const database = new DatabaseSync(`:memory:`)
+        let primaryFailure: unknown
+        const logicalId = `late-native-index-removal`
+        const baseDriver = createDriver(database)
+        let transactionTail = Promise.resolve()
+        // One DatabaseSync handle cannot run nested transactions. The host's
+        // transaction queue preserves the deliberate order of these real DDL
+        // operations without introducing a fixture-only SQLite failure.
+        const driver: SQLiteDriver = {
+          ...baseDriver,
+          transaction: async (work) => {
+            const previous = transactionTail
+            let release!: () => void
+            transactionTail = new Promise<void>((resolve) => {
+              release = resolve
+            })
+            await previous
+            try {
+              return await baseDriver.transaction(work)
+            } finally {
+              release()
+            }
+          },
+        }
+        const nativeAdapter = new SQLiteCorePersistenceAdapter({
+          driver,
+        })
+        const ensureEntered = deferred()
+        const releaseEnsure = deferred()
+        const removalSettled = deferred()
+        const secondRemovalEntered = deferred()
+        const releaseSecondRemoval = deferred()
+        const readdEnsureSettled = deferred()
+        let initialStorageId = ``
+        let heldEnsure = false
+        let rotatedRemovals = 0
+        let rotatedEnsures = 0
+        const adapter = new Proxy(nativeAdapter, {
+          get(target, property) {
+            if (property === `ensureIndex`) {
+              return async (...args: Parameters<typeof target.ensureIndex>) => {
+                const storage = args[0]
+                let rotatedEnsureNumber = 0
+                if (
+                  storage.kind === `managed` &&
+                  initialStorageId !== `` &&
+                  storage.storageCollectionId !== initialStorageId
+                ) {
+                  rotatedEnsureNumber = ++rotatedEnsures
+                  if (!heldEnsure) {
+                    heldEnsure = true
+                    ensureEntered.resolve()
+                    await releaseEnsure.promise
+                  }
+                }
+                await target.ensureIndex(...args)
+                if (rotatedEnsureNumber === 2) readdEnsureSettled.resolve()
+              }
+            }
+            if (property === `markIndexRemoved`) {
+              return async (
+                ...args: Parameters<typeof target.markIndexRemoved>
+              ) => {
+                const storage = args[0]
+                if (
+                  storage.kind === `managed` &&
+                  storage.storageCollectionId !== initialStorageId &&
+                  ++rotatedRemovals === 2 &&
+                  readdDuringReconciliation
+                ) {
+                  secondRemovalEntered.resolve()
+                  await releaseSecondRemoval.promise
+                }
+                await target.markIndexRemoved(...args)
+                removalSettled.resolve()
+              }
+            }
+            const value: unknown = Reflect.get(target, property, target)
+            return typeof value === `function` ? value.bind(target) : value
+          },
+        })
+        let recover!: () => Promise<void>
+        let collection:
+          Collection<{ id: string; title: string }, string> | undefined
+        let recovery: Promise<void> | undefined
+        try {
+          collection = createCollection(
+            persistedCollectionOptions<{ id: string; title: string }, string>({
+              id: logicalId,
+              syncMode: `on-demand`,
+              getKey: (row) => row.id,
+              defaultIndexType: BasicIndex,
+              sync: {
+                sync: (params) => {
+                  recover = params.metadata!.persistence!.startScopedRecovery!
+                  params.markReady()
+                  return { restartAfterScopedRecovery: (gate) => gate }
+                },
+              },
+              persistence: { adapter },
+            }),
+          )
+          const index = collection.createIndex((row) => row.title)
+          const signature = collection
+            .getIndexMetadata()
+            .find((metadata) => metadata.indexId === index.id)?.signature
+          if (!signature) throw new Error(`Missing index signature`)
+          await collection.stateWhenReady()
+          const originalClaim = database
+            .prepare(
+              `SELECT physical_id FROM cache_generation_claim WHERE logical_id = ?`,
+            )
+            .get(logicalId) as { physical_id: string }
+          initialStorageId = originalClaim.physical_id
+          recovery = recover()
+          await reachCheckpoint(
+            ensureEntered.promise,
+            `rotated SQLite index ensure`,
+          )
+          expect(collection.removeIndex(index)).toBe(true)
+          expect(collection.getIndexMetadata()).toEqual([])
+          await reachCheckpoint(
+            removalSettled.promise,
+            `SQLite index removal before late ensure`,
+          )
+          releaseEnsure.resolve()
+          if (readdDuringReconciliation) {
+            await reachCheckpoint(
+              secondRemovalEntered.promise,
+              `SQLite reconciliation removal before index re-add`,
+            )
+            const current = collection.createIndex((row) => row.title)
+            expect(
+              collection
+                .getIndexMetadata()
+                .find((metadata) => metadata.indexId === current.id)?.signature,
+            ).toBe(signature)
+            await reachCheckpoint(
+              readdEnsureSettled.promise,
+              `SQLite re-add before reconciliation removal`,
+            )
+            releaseSecondRemoval.resolve()
+          }
+          await reachCheckpoint(recovery, `index reconciliation after rotation`)
+          const currentClaim = database
+            .prepare(
+              `SELECT physical_id FROM cache_generation_claim WHERE logical_id = ?`,
+            )
+            .get(logicalId) as { physical_id: string }
+          expect(currentClaim.physical_id).not.toBe(initialStorageId)
+          const currentIndex = database
+            .prepare(
+              `SELECT index_name, removed FROM persisted_index_registry
+               WHERE collection_id = ? AND signature = ?`,
+            )
+            .get(currentClaim.physical_id, signature) as
+            { index_name: string; removed: number } | undefined
+          if (!currentIndex) throw new Error(`Missing rotated SQLite index row`)
+          expect(currentIndex.removed).toBe(readdDuringReconciliation ? 0 : 1)
+          expect(
+            database
+              .prepare(
+                `SELECT name, tbl_name FROM sqlite_master
+                 WHERE type = 'index' AND name = ?`,
+              )
+              .all(currentIndex.index_name),
+          ).toEqual(
+            readdDuringReconciliation
+              ? [
+                  {
+                    name: currentIndex.index_name,
+                    tbl_name: createPersistedTableName(
+                      currentClaim.physical_id,
+                      `c`,
+                    ),
+                  },
+                ]
+              : [],
+          )
+          expect(collection.getIndexMetadata()).toHaveLength(
+            readdDuringReconciliation ? 1 : 0,
+          )
+        } catch (error) {
+          primaryFailure = error
+          throw error
+        } finally {
+          releaseEnsure.resolve()
+          releaseSecondRemoval.resolve()
+          const secondaryFailures: Array<unknown> = []
+          if (recovery) {
+            try {
+              await reachCheckpoint(recovery, `recovery during cleanup`, 5_000)
+            } catch (error) {
+              if (error !== primaryFailure) secondaryFailures.push(error)
+            }
+          }
+          try {
+            await collection?.cleanup()
+          } catch (error) {
+            secondaryFailures.push(error)
+          }
+          closeDatabasePreservingPrimary(
+            database,
+            primaryFailure,
+            secondaryFailures,
+          )
+        }
+      },
+    )
+  }
+
+  // Startup metadata belongs to the cache claim that admitted its SQLite
+  // snapshot. If that claim expires while the snapshot is in flight, the
+  // returned metadata cannot authorize the source run. This driver holds the
+  // real SQLite metadata query after its transaction-time claim check, moves
+  // the adapter clock past expiry, then releases the query. The source must
+  // start under fresh cache authority without observing the old resume value.
+  it(`does not publish startup metadata read under an expired cache claim`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    let now = Date.now()
+    const baseDriver = createDriver(database)
+    const metadataReadEntered = deferred()
+    const releaseMetadataRead = deferred()
+    let holdMetadataRead = false
+    const driver: SQLiteDriver = {
+      ...baseDriver,
+      transaction: (transaction) =>
+        baseDriver.transaction((transactionDriver) =>
+          transaction({
+            ...transactionDriver,
+            query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
+              const rows = await transactionDriver.query<T>(sql, params)
+              if (
+                holdMetadataRead &&
+                sql.includes(`FROM collection_metadata`)
+              ) {
+                holdMetadataRead = false
+                metadataReadEntered.resolve()
+                await releaseMetadataRead.promise
+              }
+              return rows
+            },
+          }),
+        ),
+    }
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver,
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => now,
+    })
+    const logicalId = `expired-startup-metadata`
+    let collection: Collection<{ id: string }, string> | undefined
+    try {
+      const seed = await adapter.claimCacheGeneration(logicalId)
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: seed.storageCollectionId,
+          claimId: seed.claimId,
+        },
+        {
+          txId: `seed-resume`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: seed.claimId,
+          mutations: [],
+          collectionMetadataMutations: [
+            { type: `set`, key: `resume`, value: `old-resume` },
+          ],
+        },
+      )
+      expect(
+        (
+          await adapter.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: seed.storageCollectionId,
+              claimId: seed.claimId,
+            },
+            {
+              includeRows: false,
+              cacheGenerationClaimId: seed.claimId,
+            },
+          )
+        ).collectionMetadata,
+      ).toContainEqual({ key: `resume`, value: `old-resume` })
+      await adapter.releaseCacheGenerationClaim(seed.claimId)
+
+      const sourceResumeValues: Array<unknown> = []
+      const sourceStarted = deferred()
+      collection = createCollection(
+        persistedCollectionOptions<{ id: string }, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (source) => {
+              sourceResumeValues.push(source.metadata?.collection.get(`resume`))
+              source.markReady()
+              sourceStarted.resolve()
+              return { restartAfterScopedRecovery: () => {} }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      holdMetadataRead = true
+      collection.startSyncImmediate()
+      await reachCheckpoint(
+        metadataReadEntered.promise,
+        `managed startup metadata snapshot`,
+      )
+      expect(sourceResumeValues).toEqual([])
+      now += 11_000
+      releaseMetadataRead.resolve()
+      await reachCheckpoint(
+        sourceStarted.promise,
+        `source startup after expired metadata read`,
+      )
+      await vi.waitFor(() => expect(collection?.status).toBe(`ready`))
+      expect(sourceResumeValues).toEqual([undefined])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseMetadataRead.resolve()
+      try {
+        await collection?.cleanup()
+      } catch (error) {
+        primaryFailure ??= error
+      }
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // The SQLite claim rule and the wrapper recovery rule meet at startup.
+  // One run pauses before dispatching its real SQLite resume read; a later peer claims the
+  // same physical generation and remains live when the first claim expires.
+  // The model has two independent authorities: the peer may keep the old row
+  // and cursor, while the expired run must bind private storage and settle a
+  // demand only from a fresh source row. The held read entry is outside a
+  // write transaction so the peer can make its legal later claim. The real
+  // SQLite adapter then supplies the rejection; the separate transaction
+  // oracle owns its later in-transaction claim check.
+  // This receiving history does not model arbitrary browser scheduling.
+  it(`composes SQLite startup claim rejection with private subset recovery`, async () => {
+    type Row = { id: string; title: string }
+    const database = new DatabaseSync(`:memory:`)
+    const baseDriver = createDriver(database)
+    const readEntered = deferred()
+    const releaseRead = deferred()
+    let holdRead = false
+    let now = 1_000
+    // Keep the real renewal timer outside this controlled-clock history.
+    // Only the test's virtual time jump may expire the held claim.
+    const claimTtlMs = 1_000_000
+    const firstAdapter = new SQLiteCorePersistenceAdapter({
+      driver: baseDriver,
+      cacheGenerationClaimTtlMs: claimTtlMs,
+      now: () => now,
+    })
+    const sqliteReadRejections: Array<string> = []
+    const realHydrationScope =
+      firstAdapter.runInHydrationScope.bind(firstAdapter)
+    firstAdapter.runInHydrationScope = (task) =>
+      realHydrationScope((hydrationAdapter) =>
+        task({
+          ...hydrationAdapter,
+          loadResumeSnapshot: async (...args) => {
+            if (holdRead) {
+              holdRead = false
+              readEntered.resolve()
+              await releaseRead.promise
+            }
+            try {
+              return await hydrationAdapter.loadResumeSnapshot(...args)
+            } catch (error) {
+              sqliteReadRejections.push(String(error))
+              throw error
+            }
+          },
+        }),
+      )
+    const peerAdapter = new SQLiteCorePersistenceAdapter({
+      driver: baseDriver,
+      cacheGenerationClaimTtlMs: claimTtlMs,
+      now: () => now,
+    })
+    const logicalId = `composed-startup-claim-rejection`
+    const old: Row = { id: `old`, title: `Peer row` }
+    const fresh: Row = { id: `fresh`, title: `New source row` }
+    let expired: Collection<Row, string> | undefined
+    let peer: Collection<Row, string> | undefined
+    let seedClaimId: string | undefined
+    let firstSource: Parameters<SyncConfig<Row, string>[`sync`]>[0] | undefined
+    const firstSourceStarted = deferred()
+    const sourceLoads: Array<boolean | undefined> = []
+    let primaryFailure: unknown
+    try {
+      const seed = await peerAdapter.claimCacheGeneration(logicalId)
+      seedClaimId = seed.claimId
+      await peerAdapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: seed.storageCollectionId,
+          claimId: seed.claimId,
+        },
+        {
+          txId: `seed-old`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: seed.claimId,
+          mutations: [{ type: `insert`, key: old.id, value: old }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `resume`, value: `old-cursor` },
+          ],
+        },
+      )
+      await peerAdapter.releaseCacheGenerationClaim(seed.claimId)
+      seedClaimId = undefined
+
+      expired = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              firstSource = params
+              expect(params.metadata?.collection.get(`resume`)).toBeUndefined()
+              params.markReady()
+              firstSourceStarted.resolve()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async (options) => {
+                  sourceLoads.push(options.refetch)
+                  params.begin()
+                  params.write({ type: `insert`, value: fresh })
+                  await whenSyncAccepted(params.commit())
+                },
+              }
+            },
+          },
+          persistence: { adapter: firstAdapter },
+        }),
+      )
+      holdRead = true
+      expired.startSyncImmediate()
+      await reachCheckpoint(readEntered.promise, `first SQLite claim read`)
+      expect(firstSource).toBeUndefined()
+
+      now = 501_000
+      peer = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: logicalId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              params.markReady()
+              return {
+                restartAfterScopedRecovery: () => {},
+                loadSubset: async () => {},
+              }
+            },
+          },
+          persistence: { adapter: peerAdapter },
+        }),
+      )
+      peer.startSyncImmediate()
+      await peer.stateWhenReady()
+      await peer._sync.loadSubset({ limit: 1 })
+      expect(peer.get(old.id)).toMatchObject(old)
+
+      now = 1_001_001
+      releaseRead.resolve()
+      await reachCheckpoint(
+        firstSourceStarted.promise,
+        `source after claim loss`,
+      )
+      await expired.stateWhenReady()
+      const headAfterStartup = database
+        .prepare(
+          `SELECT physical_id FROM cache_generation
+           WHERE logical_id = ? AND retired = 0`,
+        )
+        .get(logicalId) as { physical_id: string }
+      expect(headAfterStartup.physical_id).toBe(seed.storageCollectionId)
+      expect(sqliteReadRejections).toHaveLength(1)
+      expect(sqliteReadRejections[0]).toContain(
+        `Persisted cache claim is no longer active`,
+      )
+      expect(expired.get(old.id)).toBeUndefined()
+      await expired._sync.loadSubset({ limit: 1 })
+      // This is the first demand against empty private storage, so it is an
+      // ordinary source load. The fresh row and private durable destination,
+      // not a refetch flag, establish the recovery obligation.
+      expect(sourceLoads).toEqual([undefined])
+      expect(expired.get(old.id)).toBeUndefined()
+      expect(expired.get(fresh.id)).toMatchObject(fresh)
+      expect(peer.get(old.id)).toMatchObject(old)
+      expect(peer.get(fresh.id)).toBeUndefined()
+
+      const head = database
+        .prepare(
+          `SELECT physical_id FROM cache_generation
+           WHERE logical_id = ? AND retired = 0`,
+        )
+        .get(logicalId) as { physical_id: string }
+      expect(head.physical_id).toBe(seed.storageCollectionId)
+      const claims = database
+        .prepare(
+          `SELECT physical_id, claim_id FROM cache_generation_claim
+           WHERE logical_id = ? ORDER BY physical_id`,
+        )
+        .all(logicalId) as Array<{ physical_id: string; claim_id: string }>
+      const peerClaim = claims.find(
+        ({ physical_id }) => physical_id === seed.storageCollectionId,
+      )
+      const privateClaim = claims.find(
+        ({ physical_id }) => physical_id !== seed.storageCollectionId,
+      )
+      expect(peerClaim).toBeDefined()
+      expect(privateClaim).toBeDefined()
+      expect(
+        await peerAdapter.loadResumeSnapshot(
+          {
+            kind: `managed`,
+            storageCollectionId: seed.storageCollectionId,
+            claimId: peerClaim!.claim_id,
+          },
+          {
+            cacheGenerationClaimId: peerClaim!.claim_id,
+          },
+        ),
+      ).toMatchObject({
+        rows: [{ key: old.id, value: old }],
+        collectionMetadata: [{ key: `resume`, value: `old-cursor` }],
+      })
+      expect(
+        (
+          await firstAdapter.loadResumeSnapshot(
+            {
+              kind: `managed`,
+              storageCollectionId: privateClaim!.physical_id,
+              claimId: privateClaim!.claim_id,
+            },
+            {
+              cacheGenerationClaimId: privateClaim!.claim_id,
+            },
+          )
+        ).rows.map(({ value }) => value),
+      ).toEqual([fresh])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      releaseRead.resolve()
+      const cleanupFailures: Array<unknown> = []
+      for (const cleanup of [
+        () => expired?.cleanup(),
+        () => peer?.cleanup(),
+        () =>
+          seedClaimId
+            ? peerAdapter.releaseCacheGenerationClaim(seedClaimId)
+            : undefined,
+      ]) {
+        try {
+          await cleanup()
+        } catch (error) {
+          cleanupFailures.push(error)
+        }
+      }
+      closeDatabasePreservingPrimary(database, primaryFailure, cleanupFailures)
+    }
+  })
+
+  // The adapter-level expiry law must reach the real persisted wrapper. A
+  // source commit after a long pause is admitted before any timer callback;
+  // it must reject without publishing under the expired claim. The same sync
+  // run then writes a fresh source result into new storage. This receiving
+  // witness checks SQLite rows as well as the public Collection snapshot.
+  it(`reloads source writes into a new SQLite generation after claim expiry`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    let now = Date.now()
+    const logicalId = `expired-sqlite-source`
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver: createDriver(database),
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => now,
+    })
+    let source!: Parameters<SyncConfig<{ id: string }, string>[`sync`]>[0]
+    const collection = createCollection(
+      persistedCollectionOptions<{ id: string }, string>({
+        id: logicalId,
+        syncMode: `on-demand`,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            source = params
+            params.markReady()
+            // This controlled source has no delayed provider callbacks.
+            return {
+              // An on-demand source serves the subsets that recovery
+              // reacquires in the new generation.
+              loadSubset: () => true,
+              restartAfterScopedRecovery: () => {},
+            }
+          },
+        },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      collection.startSyncImmediate()
+      await collection.stateWhenReady()
+      await source.metadata!.persistence!.hydrateBaseline()
+      const oldHead = database
+        .prepare(
+          `SELECT physical_id FROM cache_generation
+           WHERE logical_id = ? AND retired = 0`,
+        )
+        .get(logicalId) as { physical_id: string }
+      now += 11_000
+      source.begin()
+      source.write({ type: `insert`, value: { id: `expired` } })
+      const oldReceipt = source.commit()
+      if (oldReceipt === true) throw new Error(`source receipt was not tracked`)
+      await expect(oldReceipt).rejects.toThrow()
+      await vi.waitFor(() => {
+        const claim = database
+          .prepare(
+            `SELECT physical_id FROM cache_generation_claim
+             WHERE logical_id = ?`,
+          )
+          .get(logicalId) as { physical_id: string } | undefined
+        expect(claim?.physical_id).toBeDefined()
+        expect(claim?.physical_id).not.toBe(oldHead.physical_id)
+      })
+      expect(
+        database
+          .prepare(
+            `SELECT physical_id FROM cache_generation
+             WHERE logical_id = ? AND retired = 0`,
+          )
+          .get(logicalId),
+      ).toMatchObject(oldHead)
+      await collection._sync.loadSubset({ limit: 0 })
+      expect(collection.get(`expired`)).toBeUndefined()
+      source.begin()
+      source.write({ type: `insert`, value: { id: `fresh` } })
+      await whenSyncAccepted(source.commit())
+      // Recovery succeeded: the Collection still accepts sync data.
+      expect(collection.status).toBe(`ready`)
+      expect(collection.get(`fresh`)).toMatchObject({ id: `fresh` })
+      const claims = database
+        .prepare(
+          `SELECT physical_id, claim_id FROM cache_generation_claim
+           WHERE logical_id = ?`,
+        )
+        .all(logicalId) as Array<{ physical_id: string; claim_id: string }>
+      expect(claims).toHaveLength(1)
+      expect(
+        (
+          await adapter.scanRows(
+            {
+              kind: `managed`,
+              storageCollectionId: claims[0]!.physical_id,
+              claimId: claims[0]!.claim_id,
+            },
+            undefined,
+            {
+              cacheGenerationClaimId: claims[0]!.claim_id,
+            },
+          )
+        ).map(({ key }) => key),
+      ).toEqual([`fresh`])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      try {
+        await collection.cleanup()
+      } catch (error) {
+        primaryFailure ??= error
+      }
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  // A recovering on-demand sync run must advance the current persisted cache
+  // generation before it accepts further source commits. The old generation
+  // remains available to an existing claim, but no new run may inherit its
+  // stale row. The independent expectation is two disjoint durable row maps:
+  // old={stale}, current={fresh}, with the current key set uncertified. This
+  // production driver enters through the persisted wrapper capability, then
+  // checks SQLite snapshots after recovery and one source sync transaction.
+  // The reset marker belongs to the new generation: without it, a later run
+  // could mistake the partial cache for a resumable baseline.
+  it(`moves scoped recovery to a new persisted cache generation`, async () => {
+    type Row = { id: string; title: string }
+    const database = new DatabaseSync(`:memory:`)
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver: createDriver(database),
+    })
+    let collection: Collection<Row, string> | undefined
+    let seedClaimId: string | undefined
+    let currentClaimId: string | undefined
+    let primaryFailure: unknown
+    try {
+      const collectionId = `scoped-generation-boundary`
+      const staleRow: Row = { id: `stale`, title: `Old cached row` }
+      const seedClaim = await adapter.claimCacheGeneration(collectionId)
+      seedClaimId = seedClaim.claimId
+      await adapter.applyCommittedTx(
+        {
+          kind: `managed`,
+          storageCollectionId: seedClaim.storageCollectionId,
+          claimId: seedClaim.claimId,
+        },
+        {
+          txId: `seed-stale-row`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          cacheGenerationClaimId: seedClaim.claimId,
+          mutations: [{ type: `insert`, key: staleRow.id, value: staleRow }],
+        },
+      )
+
+      let source: Parameters<SyncConfig<Row, string>[`sync`]>[0] | undefined
+      const sourceReady = deferred()
+      collection = createCollection(
+        persistedCollectionOptions<Row, string>({
+          id: collectionId,
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          sync: {
+            sync: (params) => {
+              source = params
+              params.markReady()
+              sourceReady.resolve()
+              return {
+                loadSubset: async () => {},
+                restartAfterScopedRecovery: () => {},
+              }
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      collection.startSyncImmediate()
+      await reachCheckpoint(sourceReady.promise, `on-demand source start`)
+      const capability = source?.metadata?.persistence
+      expect(capability?.startScopedRecovery).toBeTypeOf(`function`)
+      const resetMarker = { kind: `reset`, updatedAt: 3 }
+      await capability!.startScopedRecovery!({
+        key: `electric:resume`,
+        value: resetMarker,
+      })
+
+      const currentClaim = await adapter.claimCacheGeneration(collectionId)
+      currentClaimId = currentClaim.claimId
+      expect(currentClaim.storageCollectionId).not.toBe(
+        seedClaim.storageCollectionId,
+      )
+      const freshRow: Row = { id: `fresh`, title: `Demanded source row` }
+      source!.begin()
+      source!.write({ type: `insert`, value: freshRow })
+      await whenSyncAccepted(source!.commit())
+
+      const oldSnapshot = await adapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: seedClaim.storageCollectionId,
+          claimId: seedClaim.claimId,
+        },
+        { cacheGenerationClaimId: seedClaim.claimId },
+      )
+      const currentSnapshot = await adapter.loadResumeSnapshot(
+        {
+          kind: `managed`,
+          storageCollectionId: currentClaim.storageCollectionId,
+          claimId: currentClaim.claimId,
+        },
+        { cacheGenerationClaimId: currentClaim.claimId },
+      )
+      expect(oldSnapshot.rows.map(({ value }) => value)).toEqual([staleRow])
+      expect(currentSnapshot.rows.map(({ value }) => value)).toEqual([freshRow])
+      expect(currentSnapshot.keySet).toEqual({ status: `incompatible` })
+      expect(currentSnapshot.collectionMetadata).toContainEqual({
+        key: `electric:resume`,
+        value: resetMarker,
+      })
+      expect(collection.get(`stale`)).toBeUndefined()
+      expect(collection.get(`fresh`)).toMatchObject(freshRow)
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      const cleanupFailures: Array<unknown> = []
+      try {
+        await collection?.cleanup()
+      } catch (error) {
+        cleanupFailures.push(error)
+      }
+      try {
+        if (currentClaimId !== undefined) {
+          await adapter.releaseCacheGenerationClaim(currentClaimId)
+        }
+        if (seedClaimId !== undefined) {
+          await adapter.releaseCacheGenerationClaim(seedClaimId)
+        }
+      } catch (error) {
+        cleanupFailures.push(error)
+      }
+      closeDatabasePreservingPrimary(database, primaryFailure, cleanupFailures)
+    }
+  })
+
+  it(`rejects a startup answer that suppresses the older baseline after a managed generation advance`, () => {
+    const baseline = { id: `baseline-0`, title: `baseline-0` }
+    const managed = { id: `managed`, title: `managed-during-startup` }
+    expect(() => expectStartupRows([managed], [baseline, managed])).toThrow()
+  })
+
+  it(`reads key-set evidence without rescanning key membership`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const collectionId = `evidence-work`
+      const tableName = createPersistedTableName(collectionId, `c`)
+      let keyEvidenceReads = 0
+      let keyMembershipScans = 0
+      const driver = createDriver(database, undefined, (sql) => {
+        // A schema probe names these tables but reads neither.
+        if (sql.includes(`sqlite_master`)) return
+        if (sql.includes(`key_set_evidence_available`)) keyEvidenceReads += 1
+        if (sql.includes(`collection_expected_keys`)) {
+          keyMembershipScans += 1
+        }
+      })
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            { type: `insert`, key: 1, value: { id: 1, name: `one` } },
+          ],
+        },
+      )
+
+      const observeWork = () => ({ keyEvidenceReads, keyMembershipScans })
+      const resetWork = () => {
+        keyEvidenceReads = 0
+        keyMembershipScans = 0
+      }
+
+      await driver.query(
+        `SELECT key FROM collection_expected_keys
+         WHERE collection_id = ?
+         LIMIT 0`,
+        [collectionId],
+      )
+      expect(observeWork().keyMembershipScans).toBe(1)
+
+      resetWork()
+      const position = await adapter.getStreamPosition({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      const leadershipClaim = observeWork()
+
+      resetWork()
+      const consistent = await adapter.loadResumeSnapshot(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          includeRows: false,
+        },
+      )
+      const consistentSnapshot = observeWork()
+
+      await driver.run(`DELETE FROM "${tableName}"`)
+      resetWork()
+      const incompatible = await adapter.loadResumeSnapshot(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          includeRows: false,
+        },
+      )
+      const incompatibleSnapshot = observeWork()
+
+      expect({
+        position,
+        leadershipClaim,
+        consistentKeySet: consistent.keySet,
+        consistentSnapshot,
+        incompatibleKeySet: incompatible.keySet,
+        incompatibleSnapshot,
+      }).toEqual({
+        position: {
+          latestTerm: 1,
+          latestSeq: 1,
+          latestRowVersion: 1,
+        },
+        leadershipClaim: {
+          keyEvidenceReads: 0,
+          keyMembershipScans: 0,
+        },
+        consistentKeySet: { status: `consistent` },
+        consistentSnapshot: {
+          keyEvidenceReads: 1,
+          keyMembershipScans: 0,
+        },
+        incompatibleKeySet: { status: `incompatible` },
+        incompatibleSnapshot: {
+          keyEvidenceReads: 1,
+          keyMembershipScans: 0,
+        },
+      })
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`does not amplify legacy writes while key-set evidence is unavailable`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const collectionId = `legacy-write-'work`
+      const tableName = createPersistedTableName(collectionId, `c`)
+      const driver = createDriver(database)
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+
+      await adapter.loadResumeSnapshot(
+        { kind: `eager`, collectionId: collectionId },
+        { includeRows: false },
+      )
+      await driver.run(
+        `UPDATE collection_version
+         SET key_set_evidence_available = 0,
+             key_set_evidence_incompatible = 0
+         WHERE collection_id = ?`,
+        [collectionId],
+      )
+      const before = await driver.query<{ count: number }>(
+        `SELECT total_changes() AS count`,
+      )
+
+      await driver.run(
+        `INSERT INTO "${tableName}" (key, value, metadata, row_version)
+         VALUES (?, ?, NULL, 1)`,
+        [encodePersistedStorageKey(`legacy`), `{}`],
+      )
+
+      const after = await driver.query<{ count: number }>(
+        `SELECT total_changes() AS count`,
+      )
+      const version = await driver.query<{
+        key_set_evidence_incompatible: number
+      }>(
+        `SELECT key_set_evidence_incompatible
+         FROM collection_version
+         WHERE collection_id = ?`,
+        [collectionId],
+      )
+      expect((after[0]?.count ?? 0) - (before[0]?.count ?? 0)).toBe(1)
+      expect(version).toEqual([{ key_set_evidence_incompatible: 0 }])
+
+      const beforeKeyUpdate = await driver.query<{ count: number }>(
+        `SELECT total_changes() AS count`,
+      )
+      await driver.run(`UPDATE "${tableName}" SET key = ? WHERE key = ?`, [
+        encodePersistedStorageKey(`legacy-renamed`),
+        encodePersistedStorageKey(`legacy`),
+      ])
+      const afterKeyUpdate = await driver.query<{ count: number }>(
+        `SELECT total_changes() AS count`,
+      )
+      expect(
+        (afterKeyUpdate[0]?.count ?? 0) - (beforeKeyUpdate[0]?.count ?? 0),
+      ).toBe(1)
+
+      const triggerDefinitions = await driver.query<{ sql: string }>(
+        `SELECT sql
+         FROM sqlite_schema
+         WHERE type = 'trigger' AND tbl_name = ?`,
+        [tableName],
+      )
+      expect(triggerDefinitions).toHaveLength(3)
+      expect(triggerDefinitions.map(({ sql }) => sql).join(`\n`)).not.toContain(
+        `collection_registry`,
+      )
+      expect(
+        (
+          await adapter.loadResumeSnapshot(
+            { kind: `eager`, collectionId: collectionId },
+            { includeRows: false },
+          )
+        ).keySet,
+      ).toEqual({ status: `unknown` })
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`keeps raw key loss sticky until a full replacement recertifies the baseline`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const collectionId = `resume-ledger`
+      const tableName = createPersistedTableName(collectionId, `c`)
+      let rejectCollectionInsert = false
+      const driver = createDriver(
+        database,
+        (sql) =>
+          rejectCollectionInsert && sql.includes(`INSERT INTO "${tableName}"`),
+      )
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            { type: `insert`, key: 1, value: { id: 1, name: `one` } },
+            { type: `insert`, key: 2, value: { id: 2, name: `two` } },
+          ],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `10_0` },
+          ],
+        },
+      )
+
+      const initial = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(initial.keySet).toEqual({ status: `consistent` })
+      expect(initial.rows.map(({ key }) => key)).toEqual([1, 2])
+      expect(initial.collectionMetadata).toEqual([
+        { key: `cursor`, value: `10_0` },
+      ])
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `normal-update`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            { type: `update`, key: 1, value: { id: 1, name: `updated-one` } },
+          ],
+        },
+      )
+      const updated = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(updated.rows.find(({ key }) => key === 1)?.value).toEqual({
+        id: 1,
+        name: `updated-one`,
+      })
+      expect(updated.keySet).toEqual({ status: `consistent` })
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `normal-delete`,
+          term: 1,
+          seq: 3,
+          rowVersion: 3,
+          mutations: [
+            { type: `delete`, key: 2, value: { id: 2, name: `two` } },
+          ],
+        },
+      )
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `normal-delete`,
+          term: 1,
+          seq: 3,
+          rowVersion: 3,
+          mutations: [
+            { type: `delete`, key: 2, value: { id: 2, name: `two` } },
+          ],
+        },
+      )
+      const deleted = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(deleted.rows.map(({ key }) => key)).toEqual([1])
+      expect(deleted.keySet).toEqual({ status: `consistent` })
+
+      rejectCollectionInsert = true
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `rolled-back-insert`,
+            term: 1,
+            seq: 4,
+            rowVersion: 4,
+            mutations: [{ type: `insert`, key: 3, value: { id: 3 } }],
+          },
+        ),
+      ).rejects.toThrow(`injected transaction failure`)
+      rejectCollectionInsert = false
+      const rolledBack = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(rolledBack.rows.map(({ key }) => key)).toEqual([1])
+      expect(rolledBack.keySet).toEqual({ status: `consistent` })
+      expect(
+        await driver.query<{ count: number }>(
+          `SELECT COUNT(*) AS count FROM collection_expected_keys WHERE collection_id = ?`,
+          [collectionId],
+        ),
+      ).toEqual([{ count: 1 }])
+      expect(
+        await driver.query<{ count: number }>(
+          `SELECT COUNT(*) AS count FROM applied_tx WHERE collection_id = ? AND tx_id = ?`,
+          [collectionId, `normal-delete`],
+        ),
+      ).toEqual([{ count: 1 }])
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `restore-second-row`,
+          term: 1,
+          seq: 5,
+          rowVersion: 5,
+          mutations: [
+            { type: `insert`, key: 2, value: { id: 2, name: `two` } },
+          ],
+        },
+      )
+
+      await driver.run(`DELETE FROM "${tableName}" WHERE key = ?`, [
+        database
+          .prepare(`SELECT key FROM "${tableName}" ORDER BY key LIMIT 1`)
+          .get()!.key,
+      ])
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `metadata-after-loss`,
+          term: 1,
+          seq: 6,
+          rowVersion: 6,
+          mutations: [],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `11_0` },
+          ],
+        },
+      )
+      expect(
+        (
+          await adapter.loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionId,
+          })
+        ).keySet,
+      ).toEqual({
+        status: `incompatible`,
+      })
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `full-replacement`,
+          term: 1,
+          seq: 7,
+          rowVersion: 7,
+          truncate: true,
+          mutations: [
+            { type: `insert`, key: 1, value: { id: 1, name: `one` } },
+            { type: `insert`, key: 2, value: { id: 2, name: `two` } },
+          ],
+        },
+      )
+      expect(
+        (
+          await adapter.loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionId,
+          })
+        ).keySet,
+      ).toEqual({
+        status: `consistent`,
+      })
+
+      await driver.run(
+        `UPDATE "${tableName}" SET key = key || '-replacement' WHERE rowid = (SELECT MIN(rowid) FROM "${tableName}")`,
+      )
+      const substituted = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(substituted.rows).toHaveLength(2)
+      expect(substituted.keySet).toEqual({ status: `incompatible` })
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`writes a cold replacement with exact values and bounded database calls`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      let databaseCalls = 0
+      let maxReplacementBoundParameters = 0
+      const driver = createDriver(
+        database,
+        undefined,
+        () => databaseCalls++,
+        (_sql, params) => {
+          databaseCalls++
+          maxReplacementBoundParameters = Math.max(
+            maxReplacementBoundParameters,
+            params.length,
+          )
+        },
+      )
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      const collectionId = `cold-replacement-work`
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `previous-generation`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            { type: `insert`, key: `old`, value: { id: `old`, title: `old` } },
+          ],
+          collectionMetadataMutations: [
+            { type: `set`, key: `electric:resume`, value: { offset: `old` } },
+          ],
+        },
+      )
+
+      const rows = Array.from({ length: 205 }, (_, index) => {
+        const id = `row-${String(index).padStart(3, `0`)}`
+        return { id, title: `Title ${index}` }
+      })
+      databaseCalls = 0
+      maxReplacementBoundParameters = 0
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `cold-replacement`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: rows.map((row) => ({
+            type: `update` as const,
+            key: row.id,
+            value: row,
+            metadataChanged: true,
+            metadata: { source: `row-write` },
+          })),
+          rowMetadataMutations: [
+            ...rows
+              .filter((_, index) => index % 2 === 0)
+              .map((row) => ({
+                type: `set` as const,
+                key: row.id,
+                value: { source: `electric`, operation: `insert` },
+              })),
+            { type: `delete`, key: rows[0]!.id },
+            { type: `set`, key: `absent`, value: { ignored: true } },
+          ],
+          collectionMetadataMutations: [
+            { type: `set`, key: `electric:resume`, value: { offset: `2_0` } },
+          ],
+        },
+      )
+      const replacementCalls = databaseCalls
+
+      const snapshot = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      const expectedRows = rows.map((row, index) => ({
+        key: row.id,
+        value: row,
+        metadata:
+          index === 0
+            ? undefined
+            : index % 2 === 0
+              ? { source: `electric`, operation: `insert` }
+              : { source: `row-write` },
+      }))
+      const byKey = (
+        left: { key: string | number },
+        right: { key: string | number },
+      ) => String(left.key).localeCompare(String(right.key))
+      // A durable snapshot has no row-order contract. Challenge the comparison
+      // with a valid alternate scan order while retaining every row and value.
+      const rowsInAlternateScanOrder = [...snapshot.rows].reverse()
+      expect(rowsInAlternateScanOrder.sort(byKey)).toEqual(
+        expectedRows.sort(byKey),
+      )
+      expect(snapshot.collectionMetadata).toEqual([
+        { key: `electric:resume`, value: { offset: `2_0` } },
+      ])
+      expect(snapshot.keySet).toEqual({ status: `consistent` })
+      expect(snapshot.latestTerm).toBe(1)
+      expect(snapshot.latestSeq).toBe(2)
+      expect(snapshot.latestRowVersion).toBe(2)
+      expect(
+        await driver.query<{ key: string }>(
+          `SELECT key FROM collection_expected_keys WHERE collection_id = ? ORDER BY key`,
+          [collectionId],
+        ),
+      ).toEqual(rows.map((row) => ({ key: encodePersistedStorageKey(row.id) })))
+      expect(
+        await driver.query<{ tx_id: string }>(
+          `SELECT tx_id FROM applied_tx WHERE collection_id = ? ORDER BY seq`,
+          [collectionId],
+        ),
+      ).toEqual([
+        { tx_id: `previous-generation` },
+        { tx_id: `cold-replacement` },
+      ])
+      // The host-dependent cost is a database call, not the in-process timing.
+      expect(replacementCalls).toBeLessThanOrEqual(40)
+      expect(maxReplacementBoundParameters).toBe(500)
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`rolls back every cold replacement chunk when a later chunk fails`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const collectionId = `cold-replacement-rollback`
+      const tableName = createPersistedTableName(collectionId, `c`)
+      let bulkRowInserts = 0
+      let injectFailure = false
+      const driver = createDriver(database, (sql) => {
+        if (
+          !injectFailure ||
+          !sql.includes(`INSERT INTO "${tableName}"`) ||
+          !sql.includes(`), (`)
+        ) {
+          return false
+        }
+        bulkRowInserts++
+        return bulkRowInserts === 2
+      })
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `old`,
+              value: { id: `old` },
+              metadataChanged: true,
+              metadata: { source: `previous-generation` },
+            },
+          ],
+          collectionMetadataMutations: [
+            { type: `set`, key: `electric:resume`, value: { offset: `old` } },
+          ],
+        },
+      )
+      const before = await observeCachedSchemaState(
+        adapter,
+        driver,
+        collectionId,
+      )
+      const beforeSnapshot = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      injectFailure = true
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `failed-replacement`,
+            term: 1,
+            seq: 2,
+            rowVersion: 2,
+            truncate: true,
+            mutations: Array.from({ length: 205 }, (_, index) => ({
+              type: `update` as const,
+              key: `row-${index}`,
+              value: { id: `row-${index}` },
+            })),
+            collectionMetadataMutations: [
+              { type: `set`, key: `electric:resume`, value: { offset: `2_0` } },
+            ],
+          },
+        ),
+      ).rejects.toThrow(`injected transaction failure`)
+      injectFailure = false
+      expect(bulkRowInserts).toBe(2)
+      expect(
+        await observeCachedSchemaState(adapter, driver, collectionId),
+      ).toEqual(before)
+      expect(
+        await adapter.loadResumeSnapshot({
+          kind: `eager`,
+          collectionId: collectionId,
+        }),
+      ).toEqual(beforeSnapshot)
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`keeps ordered duplicate and delete histories on the sequential path`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const adapter = new SQLiteCorePersistenceAdapter({ driver })
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: `duplicate-replacement` },
+        {
+          txId: `duplicate`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          truncate: true,
+          mutations: [
+            { type: `insert`, key: `same`, value: { id: `same`, first: true } },
+            { type: `update`, key: `same`, value: { last: true } },
+          ],
+        },
+      )
+      const duplicate = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: `duplicate-replacement`,
+      })
+      expect(duplicate.rows).toEqual([
+        {
+          key: `same`,
+          value: { id: `same`, first: true, last: true },
+          metadata: undefined,
+        },
+      ])
+      expect(duplicate.keySet).toEqual({ status: `consistent` })
+
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: `delete-replacement` },
+        {
+          txId: `delete`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          truncate: true,
+          mutations: [
+            { type: `insert`, key: `removed`, value: { id: `removed` } },
+            { type: `delete`, key: `removed`, value: { id: `removed` } },
+            { type: `insert`, key: `kept`, value: { id: `kept` } },
+          ],
+        },
+      )
+      const deleted = await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: `delete-replacement`,
+      })
+      expect(deleted.rows).toEqual([
+        { key: `kept`, value: { id: `kept` }, metadata: undefined },
+      ])
+      expect(deleted.keySet).toEqual({ status: `consistent` })
+      const tombstoneTable = createPersistedTableName(`delete-replacement`, `t`)
+      expect(
+        await driver.query<{ key: string }>(
+          `SELECT key FROM "${tombstoneTable}" ORDER BY key`,
+        ),
+      ).toEqual([{ key: encodePersistedStorageKey(`removed`) }])
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`migrates concurrent legacy schemas and stays unknown until truncate`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let releasePending = () => {}
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `legacy-ledger`
+      const tableName = createPersistedTableName(collectionId, `c`)
+      const tombstoneTableName = createPersistedTableName(collectionId, `t`)
+      await driver.exec(
+        `CREATE TABLE collection_registry (
+           collection_id TEXT PRIMARY KEY,
+           table_name TEXT NOT NULL UNIQUE,
+           tombstone_table_name TEXT NOT NULL UNIQUE,
+           schema_version INTEGER NOT NULL,
+           updated_at INTEGER NOT NULL
+         )`,
+      )
+      await driver.run(
+        `INSERT INTO collection_registry
+           (collection_id, table_name, tombstone_table_name, schema_version, updated_at)
+         VALUES (?, ?, ?, 1, 0)`,
+        [collectionId, tableName, tombstoneTableName],
+      )
+      await driver.exec(
+        `CREATE TABLE "${tableName}" (
+           key TEXT PRIMARY KEY,
+           value TEXT NOT NULL,
+           metadata TEXT,
+           row_version INTEGER NOT NULL
+         )`,
+      )
+      await driver.exec(
+        `CREATE TABLE "${tombstoneTableName}" (
+           key TEXT PRIMARY KEY,
+           value TEXT,
+           row_version INTEGER NOT NULL,
+           deleted_at TEXT NOT NULL
+         )`,
+      )
+      await driver.run(
+        `INSERT INTO "${tableName}" (key, value, metadata, row_version)
+         VALUES (?, ?, ?, 0)`,
+        [
+          encodePersistedStorageKey(`legacy-row`),
+          JSON.stringify({ id: `legacy-row`, n: 0 }),
+          JSON.stringify({ source: `legacy` }),
+        ],
+      )
+      await driver.exec(
+        `CREATE TABLE collection_version (
+           collection_id TEXT PRIMARY KEY,
+           latest_row_version INTEGER NOT NULL
+         )`,
+      )
+      await driver.run(
+        `INSERT INTO collection_version (collection_id, latest_row_version)
+         VALUES (?, 0)`,
+        [collectionId],
+      )
+
+      const bothSawLegacyColumns = deferred()
+      let legacyColumnReaders = 0
+      const migrationRelease = deferred()
+      releasePending = migrationRelease.resolve
+      const createMigrationDriver = (): SQLiteDriver => ({
+        ...driver,
+        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
+          const rows = await driver.query<T>(sql, params)
+          if (sql.includes(`PRAGMA table_info(collection_version)`)) {
+            legacyColumnReaders++
+            if (legacyColumnReaders === 2) bothSawLegacyColumns.resolve()
+            await migrationRelease.promise
+          }
+          return rows
+        },
+      })
+      const migrated = new SQLiteCorePersistenceAdapter({
+        driver: createMigrationDriver(),
+      })
+      const concurrentMigrated = new SQLiteCorePersistenceAdapter({
+        driver: createMigrationDriver(),
+      })
+      const initialize = (adapter: SQLiteCorePersistenceAdapter) =>
+        (
+          adapter as unknown as { ensureInitialized: () => Promise<void> }
+        ).ensureInitialized()
+      const migrations = Promise.all([
+        initialize(migrated),
+        initialize(concurrentMigrated),
+      ])
+      await reachCheckpoint(
+        bothSawLegacyColumns.promise,
+        `both adapters observed the legacy collection_version schema`,
+      )
+      migrationRelease.resolve()
+      await migrations
+      const migratedColumns = await driver.query<{ name: string }>(
+        `PRAGMA table_info(collection_version)`,
+      )
+      expect(migratedColumns.map(({ name }) => name)).toEqual(
+        expect.arrayContaining([
+          `key_set_evidence_available`,
+          `key_set_evidence_incompatible`,
+        ]),
+      )
+
+      const migratedLegacySnapshot = await migrated.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(migratedLegacySnapshot.keySet).toEqual({ status: `unknown` })
+      expect(migratedLegacySnapshot.rows).toEqual([
+        {
+          key: `legacy-row`,
+          value: { id: `legacy-row`, n: 0 },
+          metadata: { source: `legacy` },
+        },
+      ])
+      await migrated.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `legacy-insert`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1, n: 1 } }],
+        },
+      )
+      expect(
+        (
+          await migrated.loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionId,
+          })
+        ).keySet,
+      ).toEqual({
+        status: `unknown`,
+      })
+
+      await migrated.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `legacy-replacement`,
+          term: 1,
+          seq: 2,
+          rowVersion: 2,
+          truncate: true,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1, n: 2 } }],
+        },
+      )
+      expect(
+        (
+          await migrated.loadResumeSnapshot({
+            kind: `eager`,
+            collectionId: collectionId,
+          })
+        ).keySet,
+      ).toEqual({
+        status: `consistent`,
+      })
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      releasePending()
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`does not repeat a schema reset observed through a stale adapter read`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let releasePending = () => {}
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `concurrent-schema-reset`
+      const original = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await original.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `old` },
+          ],
+        },
+      )
+
+      const staleRead = deferred()
+      const releaseStaleRead = deferred()
+      releasePending = releaseStaleRead.resolve
+      let intercepted = false
+      const gatedDriver: SQLiteDriver = {
+        ...driver,
+        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
+          const rows = await driver.query<T>(sql, params)
+          if (!intercepted && sql.includes(`FROM collection_registry`)) {
+            intercepted = true
+            staleRead.resolve()
+            await releaseStaleRead.promise
+          }
+          return rows
+        },
+      }
+      const staleAdapter = new SQLiteCorePersistenceAdapter({
+        driver: gatedDriver,
+        schemaVersion: 2,
+      })
+      const staleLoad = staleAdapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await reachCheckpoint(
+        staleRead.promise,
+        `stale schema-v1 registry read before competing reset`,
+      )
+
+      const winner = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+      })
+      await winner.loadSubset({ kind: `eager`, collectionId: collectionId }, {})
+      await winner.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `recovery-write`,
+          term: 2,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `new` },
+          ],
+        },
+      )
+
+      releaseStaleRead.resolve()
+      await staleLoad
+      const snapshot = await winner.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(snapshot.resetEpoch).toBe(1)
+      expect(snapshot.rows.map(({ key }) => key)).toEqual([2])
+      expect(snapshot.collectionMetadata).toEqual([
+        { key: `cursor`, value: `new` },
+      ])
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      releasePending()
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`refuses to downgrade a newer schema observed after a stale read`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let releasePending = () => {}
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `divergent-schema-reset`
+      const original = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await original.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
+        },
+      )
+
+      const staleRead = deferred()
+      const releaseStaleRead = deferred()
+      releasePending = releaseStaleRead.resolve
+      let intercepted = false
+      const staleDriver: SQLiteDriver = {
+        ...driver,
+        query: async <T>(sql: string, params?: ReadonlyArray<unknown>) => {
+          const rows = await driver.query<T>(sql, params)
+          if (!intercepted && sql.includes(`FROM collection_registry`)) {
+            intercepted = true
+            staleRead.resolve()
+            await releaseStaleRead.promise
+          }
+          return rows
+        },
+      }
+      const staleV2 = new SQLiteCorePersistenceAdapter({
+        driver: staleDriver,
+        schemaVersion: 2,
+      })
+      const staleLoad = staleV2.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await reachCheckpoint(
+        staleRead.promise,
+        `stale schema-v1 registry read before schema-v3 reset`,
+      )
+
+      const winnerV3 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 3,
+      })
+      await winnerV3.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await winnerV3.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `winner-write`,
+          term: 3,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 3, value: { id: 3 } }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `v3` },
+          ],
+        },
+      )
+
+      releaseStaleRead.resolve()
+      await expect(staleLoad).rejects.toThrow(
+        `Schema version changed concurrently`,
+      )
+      const snapshot = await winnerV3.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(snapshot.resetEpoch).toBe(1)
+      expect(snapshot.rows.map(({ key }) => key)).toEqual([3])
+      expect(snapshot.collectionMetadata).toEqual([
+        { key: `cursor`, value: `v3` },
+      ])
+      expect(
+        await driver.query<{ schema_version: number }>(
+          `SELECT schema_version FROM collection_registry WHERE collection_id = ?`,
+          [collectionId],
+        ),
+      ).toEqual([{ schema_version: 3 }])
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      releasePending()
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`rejects a committed transaction from a cached adapter after another adapter resets the schema`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `cached-schema-write`
+      const staleV1 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await staleV1.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `v1` },
+          ],
+        },
+      )
+
+      const currentV2 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+      })
+      await currentV2.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await currentV2.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v2`,
+          term: 2,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `v2` },
+          ],
+        },
+      )
+      const before = await observeCachedSchemaState(
+        currentV2,
+        driver,
+        collectionId,
+      )
+
+      let lateWriteError: unknown
+      try {
+        await staleV1.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `late-v1`,
+            term: 3,
+            seq: 1,
+            rowVersion: 2,
+            truncate: true,
+            mutations: [{ type: `insert`, key: 3, value: { id: 3 } }],
+            collectionMetadataMutations: [
+              { type: `set`, key: `cursor`, value: `late-v1` },
+              { type: `set`, key: `late`, value: true },
+            ],
+          },
+        )
+      } catch (error) {
+        lateWriteError = error
+      }
+      const after = await observeCachedSchemaState(
+        currentV2,
+        driver,
+        collectionId,
+      )
+
+      expect(
+        {
+          error:
+            lateWriteError instanceof Error
+              ? { name: lateWriteError.name, message: lateWriteError.message }
+              : lateWriteError,
+          before,
+          after,
+        },
+        `a cached adapter must reject at its transaction boundary without changing any durable state`,
+      ).toEqual({
+        error: {
+          name: `InvalidPersistedCollectionConfigError`,
+          message:
+            `Schema version mismatch for collection "cached-schema-write": ` +
+            `found 2, expected 1. Refusing to apply a committed transaction through a stale cached adapter.`,
+        },
+        before,
+        after: before,
+      })
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`rejects a resume snapshot from a cached adapter after another adapter resets the schema`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `cached-schema-snapshot`
+      const staleV1 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await staleV1.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
+        },
+      )
+      await staleV1.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+
+      const currentV2 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+      })
+      await currentV2.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await currentV2.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v2`,
+          term: 2,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `v2` },
+          ],
+        },
+      )
+
+      await expect(
+        staleV1.loadResumeSnapshot({
+          kind: `eager`,
+          collectionId: collectionId,
+        }),
+      ).rejects.toThrow(`Schema version mismatch`)
+      expect(
+        await currentV2.loadResumeSnapshot({
+          kind: `eager`,
+          collectionId: collectionId,
+        }),
+      ).toMatchObject({
+        rows: [{ key: 2, value: { id: 2 } }],
+        collectionMetadata: [{ key: `cursor`, value: `v2` }],
+      })
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`rejects cached row readers after another adapter resets the schema`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `cached-schema-row-readers`
+      const staleV1 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await staleV1.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 1, value: { id: 1 } }],
+        },
+      )
+      await staleV1.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+
+      const currentV2 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+      })
+      await currentV2.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await currentV2.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v2`,
+          term: 2,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [{ type: `insert`, key: 2, value: { id: 2 } }],
+        },
+      )
+
+      const staleReads = await Promise.allSettled([
+        staleV1.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
+        staleV1.scanRows({ kind: `eager`, collectionId: collectionId }),
+        staleV1.pullSince({ kind: `eager`, collectionId: collectionId }, 0),
+      ])
+      expect(staleReads.map(({ status }) => status)).toEqual([
+        `rejected`,
+        `rejected`,
+        `rejected`,
+      ])
+      expect(
+        await currentV2.loadSubset(
+          { kind: `eager`, collectionId: collectionId },
+          {},
+        ),
+      ).toMatchObject([{ key: 2, value: { id: 2 } }])
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`rejects cached collection-metadata reads after another adapter resets the schema`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `cached-schema-metadata-reader`
+      const staleV1 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await staleV1.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v1`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `v1` },
+          ],
+        },
+      )
+      await staleV1.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+
+      const currentV2 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+      })
+      await currentV2.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await currentV2.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-v2`,
+          term: 2,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [],
+          collectionMetadataMutations: [
+            { type: `set`, key: `cursor`, value: `v2` },
+          ],
+        },
+      )
+
+      await expect(
+        staleV1.loadCollectionMetadata({
+          kind: `eager`,
+          collectionId: collectionId,
+        }),
+      ).rejects.toThrow(`Schema version mismatch`)
+      expect(
+        await currentV2.loadCollectionMetadata({
+          kind: `eager`,
+          collectionId: collectionId,
+        }),
+      ).toEqual([{ key: `cursor`, value: `v2` }])
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+
+  it(`rejects cached index lifecycle writes after another adapter resets the schema`, async () => {
+    const database = new DatabaseSync(`:memory:`)
+    let primaryFailure: unknown
+    try {
+      const driver = createDriver(database)
+      const collectionId = `cached-schema-index-writers`
+      const staleV1 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 1,
+      })
+      await staleV1.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+
+      const currentV2 = new SQLiteCorePersistenceAdapter({
+        driver,
+        schemaVersion: 2,
+      })
+      await currentV2.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {},
+      )
+      await currentV2.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        `v2-index`,
+        {
+          expressionSql: [`json_extract(value, '$.id')`],
+        },
+      )
+
+      const staleWrites = await Promise.allSettled([
+        staleV1.ensureIndex(
+          { kind: `eager`, collectionId: collectionId },
+          `stale-v1-index`,
+          {
+            expressionSql: [`json_extract(value, '$.legacy')`],
+          },
+        ),
+        staleV1.markIndexRemoved(
+          { kind: `eager`, collectionId: collectionId },
+          `v2-index`,
+        ),
+      ])
+      expect(staleWrites.map(({ status }) => status)).toEqual([
+        `rejected`,
+        `rejected`,
+      ])
+
+      const currentIndexes = await driver.query<{
+        signature: string
+        removed: number
+      }>(
+        `SELECT signature, removed
+         FROM persisted_index_registry
+         WHERE collection_id = ?
+         ORDER BY signature`,
+        [collectionId],
+      )
+      expect(currentIndexes).toEqual([{ signature: `v2-index`, removed: 0 }])
+    } catch (error) {
+      primaryFailure = error
+    } finally {
+      closeDatabasePreservingPrimary(database, primaryFailure)
+    }
+  })
+})
+
+it(`resets ambiguous legacy values and obsolete indexes before reading a new schema`, async () => {
+  const database = new DatabaseSync(`:memory:`)
+  let primaryFailure: unknown
+  try {
+    const driver = createDriver(database)
+    const collectionId = `legacy-marker-reset`
+    const table = createPersistedTableName(collectionId, `c`)
+    const old = new SQLiteCorePersistenceAdapter({ driver, schemaVersion: 1 })
+    for (const id of [collectionId, `unrelated-cache`]) {
+      await old.applyCommittedTx(
+        { kind: `eager`, collectionId: id },
+        {
+          txId: `seed`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            { type: `insert`, key: `old`, value: { id: `old`, stamp: 1 } },
+          ],
+        },
+      )
+      for (const signature of [
+        `old-native-signature`,
+        `current-native-signature`,
+      ]) {
+        await old.ensureIndex({ kind: `eager`, collectionId: id }, signature, {
+          expressionSql: [`row_version`],
+        })
+      }
+    }
+    const marker = {
+      __tanstack_db_persisted_type__: `string`,
+      value: `ordinary`,
+    }
+    database
+      .prepare(`UPDATE "${table}" SET value = ?`)
+      .run(JSON.stringify({ id: `old`, marker }))
+    const indexes = database
+      .prepare(
+        `SELECT index_name FROM persisted_index_registry WHERE collection_id = ?`,
+      )
+      .all(collectionId) as Array<{ index_name: string }>
+    expect(indexes).toHaveLength(2)
+    const next = new SQLiteCorePersistenceAdapter({
+      driver,
+      schemaVersion: 2,
+      schemaMismatchPolicy: `reset`,
+    })
+    expect(
+      await next.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
+    ).toEqual([])
+    expect(
+      database
+        .prepare(
+          `SELECT * FROM persisted_index_registry WHERE collection_id = ?`,
+        )
+        .all(collectionId),
+    ).toEqual([])
+    for (const { index_name } of indexes) {
+      expect(
+        database
+          .prepare(
+            `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
+          )
+          .all(index_name),
+      ).toEqual([])
+    }
+    expect(
+      database
+        .prepare(
+          `SELECT * FROM persisted_index_registry WHERE collection_id = ?`,
+        )
+        .all(`unrelated-cache`),
+    ).toHaveLength(2)
+    expect(
+      (
+        await old.loadSubset(
+          { kind: `eager`, collectionId: `unrelated-cache` },
+          {},
+        )
+      ).map(({ key }) => key),
+    ).toEqual([`old`])
+    await next.applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        txId: `reseed`,
+        term: 2,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [
+          { type: `insert`, key: `new`, value: { id: `new`, marker } },
+        ],
+      },
+    )
+    await next.ensureIndex(
+      { kind: `eager`, collectionId: collectionId },
+      `replacement`,
+      {
+        expressionSql: [`row_version`],
+      },
+    )
+    const reopened = new SQLiteCorePersistenceAdapter({
+      driver,
+      schemaVersion: 2,
+    })
+    expect(
+      (
+        await reopened.loadSubset(
+          { kind: `eager`, collectionId: collectionId },
+          {},
+        )
+      ).map(({ value }) => value),
+    ).toEqual([{ id: `new`, marker }])
+    expect(
+      database
+        .prepare(
+          `SELECT signature FROM persisted_index_registry WHERE collection_id = ?`,
+        )
+        .all(collectionId),
+    ).toEqual([{ signature: `replacement` }])
+  } catch (error) {
+    primaryFailure = error
+  } finally {
+    closeDatabasePreservingPrimary(database, primaryFailure)
+  }
+})
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-oracle.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-oracle.test.ts
index d7ebf93b30..f26c8ee37f 100644
--- a/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-oracle.test.ts
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-oracle.test.ts
@@ -42,29 +42,23 @@
  * separately. The review record documents ORC outcomes and exact run receipts:
  * docs/contributing/oracle-reviews/issue-2034-temporal-persistence.md.
  */
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { DatabaseSync } from 'node:sqlite'
 import { IR } from '@tanstack/db'
 import { Temporal } from 'temporal-polyfill'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { SQLiteCorePersistenceAdapter } from '../src'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
   temporalFamilies,
   temporalQueryCases,
   temporalValue,
 } from './temporal-value-oracle'
-import { harnessScope } from './contracts/harness-scope'
-import type { PersistedTx, SQLiteDriver } from '../src'
-import type { SQLInputValue } from 'node:sqlite'
+import { check, collectionId, scope } from './sqlite-temporal-value-support'
+import type { PersistedTx } from '../src'
 
 type Kind = `Date` | `ISO string` | `Instant` | `PlainDate`
 type Ordinal = 0 | 1
 type History = `insert` | `update`
 const kinds: Array<Kind> = [`Date`, `ISO string`, `Instant`, `PlainDate`]
 const histories: Array<History> = [`insert`, `update`]
-const collectionId = `typed-values`
 const keys = [`z-early`, `a-late`] as const
 
 function textFor(kind: Kind, ordinal: Ordinal): string {
@@ -93,103 +87,6 @@ function expectedValue(kind: Kind, ordinal: Ordinal): unknown {
   return kind === `ISO string` ? text : { kind, text }
 }
 
-// Explicit native-type observations catch same-class objects whose enumerable
-// fields are empty. Deep equality alone can miss a changed Temporal value.
-function observe(value: unknown): unknown {
-  if (value instanceof Date) return { kind: `Date`, text: value.toISOString() }
-  if (value instanceof Temporal.Instant) {
-    return { kind: `Instant`, text: value.toString() }
-  }
-  if (value instanceof Temporal.PlainDate) {
-    return { kind: `PlainDate`, text: value.toString() }
-  }
-  if (Array.isArray(value)) return value.map(observe)
-  if (value !== null && typeof value === `object`) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [key, observe(entry)]),
-    )
-  }
-  return value
-}
-
-function check(
-  actual: unknown,
-  expected: unknown,
-  checkpoint: string,
-  assertion: typeof expect.soft = expect,
-): void {
-  assertion(observe(actual), checkpoint).toStrictEqual(expected)
-}
-
-function binding(value: unknown): SQLInputValue {
-  if (value === undefined || value === null) return null
-  if (typeof value === `boolean`) return value ? 1 : 0
-  if (
-    typeof value === `string` ||
-    typeof value === `number` ||
-    typeof value === `bigint`
-  )
-    return value
-  throw new Error(`Unexpected SQLite binding: ${String(value)}`)
-}
-
-function createDriver(database: DatabaseSync): SQLiteDriver {
-  const driver: SQLiteDriver = {
-    exec: (sql) => {
-      database.exec(sql)
-      return Promise.resolve()
-    },
-    query: <T>(sql: string, params: ReadonlyArray<unknown> = []) =>
-      Promise.resolve(
-        database.prepare(sql).all(...params.map(binding)) as Array<T>,
-      ),
-    run: (sql, params = []) => {
-      database.prepare(sql).run(...params.map(binding))
-      return Promise.resolve()
-    },
-    transaction: async (task) => {
-      database.exec(`BEGIN IMMEDIATE`)
-      try {
-        const result = await task(driver)
-        database.exec(`COMMIT`)
-        return result
-      } catch (error) {
-        database.exec(`ROLLBACK`)
-        throw error
-      }
-    },
-  }
-  return driver
-}
-
-const scope = harnessScope(() => {
-  const directory = mkdtempSync(join(tmpdir(), `db-temporal-oracle-`))
-  let database: DatabaseSync | undefined
-  function close(): void {
-    database?.close()
-    database = undefined
-  }
-  return {
-    open() {
-      close()
-      database = new DatabaseSync(join(directory, `state.sqlite`))
-      return {
-        database,
-        adapter: new SQLiteCorePersistenceAdapter({
-          driver: createDriver(database),
-        }),
-      }
-    },
-    cleanup() {
-      try {
-        close()
-      } finally {
-        rmSync(directory, { recursive: true, force: true })
-      }
-    },
-  }
-})
-
 beforeEach(() => vi.stubGlobal(`Temporal`, Temporal))
 afterEach(() => vi.unstubAllGlobals())
 afterEach(scope.cleanup)
@@ -254,6 +151,8 @@ const cases = kinds.flatMap((kind) =>
   ),
 )
 
+declareOracle({ grammar: [cases], model: [expectedValue, expectedRows] })
+
 describe(`SQLite typed-value preservation after reopen`, () => {
   it.each(cases)(
     `$kind / $history / indexed=$indexed`,
@@ -558,203 +457,4 @@ describe(`native Temporal query refinement`, () => {
       )
     }
   })
-
-  it(`preserves marker-shaped records and rejects missing or unsupported constructors atomically`, async () => {
-    const { adapter } = scope.create().open()
-    const marker = {
-      __tanstack_db_persisted_type__: `Temporal.Instant`,
-      value: `2026-01-02T00:00:00Z`,
-      order: `unused`,
-    }
-    const tx: PersistedTx = {
-      txId: `record`,
-      term: 1,
-      seq: 1,
-      rowVersion: 1,
-      mutations: [
-        {
-          type: `insert`,
-          key: `record`,
-          value: { marker, stamp: Temporal.Instant.from(marker.value) },
-        },
-      ],
-    }
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      tx,
-    )
-    const before = await adapter.loadResumeSnapshot({
-      kind: `eager`,
-      collectionId: collectionId,
-    })
-    expect(before.rows[0]?.value.marker).toEqual(marker)
-    const nested = await adapter.loadSubset(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        where: new IR.Func(`eq`, [
-          new IR.PropRef([`marker`, `value`]),
-          new IR.Value(marker.value),
-        ]),
-      },
-    )
-    expect(
-      nested.map((row) => row.key),
-      `escaped record query`,
-    ).toEqual([`record`])
-    vi.stubGlobal(`Temporal`, undefined)
-    await expect(
-      adapter.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
-    ).rejects.toThrow(/Temporal/)
-    await expect(
-      adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          ...tx,
-          txId: `missing`,
-          seq: 2,
-          rowVersion: 2,
-        },
-      ),
-    ).rejects.toThrow(/Temporal/)
-    vi.stubGlobal(`Temporal`, Temporal)
-    await expect(
-      adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          ...tx,
-          txId: `unsupported`,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            {
-              type: `insert`,
-              key: `unsupported`,
-              value: { stamp: Temporal.Duration.from(`P1D`) },
-            },
-          ],
-        },
-      ),
-    ).rejects.toThrow(/Temporal/)
-    await expect(
-      adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          ...tx,
-          txId: `invalid-brand`,
-          seq: 2,
-          rowVersion: 2,
-          mutations: [
-            {
-              type: `insert`,
-              key: `fake`,
-              value: {
-                stamp: Object.create(Temporal.Instant.prototype) as unknown,
-              },
-            },
-          ],
-        },
-      ),
-    ).rejects.toThrow(/Invalid Temporal/)
-    check(
-      await adapter.loadResumeSnapshot({
-        kind: `eager`,
-        collectionId: collectionId,
-      }),
-      observe(before),
-      `rollback`,
-    )
-  })
 })
-
-// Equality is a pair relation: separate IN sets for order and identity can
-// accidentally combine matches from different ordinary string literals.
-it(`keeps native IN membership distinct from lookalike string keys`, async () => {
-  const { adapter } = scope.create().open()
-  const orderText = `10000000000000000000000`
-  const identityText = `Temporal.Instant:1970-01-01T00:00:00Z`
-  const values = [
-    Temporal.Instant.from(`1970-01-01T00:00:00Z`),
-    orderText,
-    identityText,
-  ]
-  await adapter.applyCommittedTx(
-    { kind: `eager`, collectionId: collectionId },
-    {
-      txId: `mixed`,
-      term: 1,
-      seq: 1,
-      rowVersion: 1,
-      mutations: values.map((stamp, i) => ({
-        type: `insert`,
-        key: `row-${i}`,
-        value: { stamp },
-      })),
-    },
-  )
-  const predicate = new IR.Func<boolean>(`in`, [
-    new IR.PropRef([`stamp`]),
-    new IR.Value([orderText, identityText]),
-  ])
-  expect(
-    (
-      await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        { where: predicate },
-      )
-    )
-      .map((row) => row.key)
-      .sort(),
-  ).toEqual([`row-1`, `row-2`])
-  expect(
-    (
-      await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`not`, [predicate]),
-        },
-      )
-    ).map((row) => row.key),
-  ).toEqual([`row-0`])
-})
-
-// Native literals need at most one brand-validated encoding per occurrence. The number
-// of occurrences supplies the work budget; no codec helper computes it. Empty
-// tables isolate compilation from revival. Positive counts also calibrate the
-// sensor. The existing rank/text and index owners check resulting query semantics.
-it.sequential.each([`Instant`, `PlainDate`] as const)(
-  `encodes each native query literal at most once / %s`,
-  async (kind) => {
-    const { adapter } = scope.create().open()
-    const constructor = Temporal[kind]
-    const value =
-      kind === `Instant`
-        ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-        : Temporal.PlainDate.from(`2026-01-02[u-ca=japanese]`)
-    const parse = vi.spyOn(constructor, `from`)
-    try {
-      for (const size of [1, 3, 1_025]) {
-        for (const operation of size === 1 ? [`eq`, `in`] : [`in`]) {
-          parse.mockClear()
-          const rows = await adapter.loadSubset(
-            { kind: `eager`, collectionId: `literal-work` },
-            {
-              where: new IR.Func(operation, [
-                new IR.PropRef([`stamp`]),
-                new IR.Value(
-                  operation === `eq`
-                    ? value
-                    : Array.from({ length: size }, () => value),
-                ),
-              ]),
-            },
-          )
-          expect(rows).toEqual([])
-          expect(parse.mock.calls.length).toBeGreaterThan(0)
-          expect(parse.mock.calls.length).toBeLessThanOrEqual(size)
-        }
-      }
-    } finally {
-      parse.mockRestore()
-    }
-  },
-)
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-support.ts b/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-support.ts
new file mode 100644
index 0000000000..7998980b1c
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value-support.ts
@@ -0,0 +1,112 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { Temporal } from 'temporal-polyfill'
+import { expect } from 'vitest'
+import { SQLiteCorePersistenceAdapter } from '../src'
+import { harnessScope } from './contracts/harness-scope'
+import type { SQLInputValue } from 'node:sqlite'
+import type { SQLiteDriver } from '../src'
+
+// Fixtures for the SQLite typed-value oracle and its ordinary scenario tests. The
+// oracle in `sqlite-temporal-value-oracle.test.ts` owns the typed-value law.
+
+export const collectionId = `typed-values`
+
+// Explicit native-type observations catch same-class objects whose enumerable
+// fields are empty. Deep equality alone can miss a changed Temporal value.
+export function observe(value: unknown): unknown {
+  if (value instanceof Date) return { kind: `Date`, text: value.toISOString() }
+  if (value instanceof Temporal.Instant) {
+    return { kind: `Instant`, text: value.toString() }
+  }
+  if (value instanceof Temporal.PlainDate) {
+    return { kind: `PlainDate`, text: value.toString() }
+  }
+  if (Array.isArray(value)) return value.map(observe)
+  if (value !== null && typeof value === `object`) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, observe(entry)]),
+    )
+  }
+  return value
+}
+
+export function check(
+  actual: unknown,
+  expected: unknown,
+  checkpoint: string,
+  assertion: typeof expect.soft = expect,
+): void {
+  assertion(observe(actual), checkpoint).toStrictEqual(expected)
+}
+
+export function binding(value: unknown): SQLInputValue {
+  if (value === undefined || value === null) return null
+  if (typeof value === `boolean`) return value ? 1 : 0
+  if (
+    typeof value === `string` ||
+    typeof value === `number` ||
+    typeof value === `bigint`
+  )
+    return value
+  throw new Error(`Unexpected SQLite binding: ${String(value)}`)
+}
+
+export function createDriver(database: DatabaseSync): SQLiteDriver {
+  const driver: SQLiteDriver = {
+    exec: (sql) => {
+      database.exec(sql)
+      return Promise.resolve()
+    },
+    query: <T>(sql: string, params: ReadonlyArray<unknown> = []) =>
+      Promise.resolve(
+        database.prepare(sql).all(...params.map(binding)) as Array<T>,
+      ),
+    run: (sql, params = []) => {
+      database.prepare(sql).run(...params.map(binding))
+      return Promise.resolve()
+    },
+    transaction: async (task) => {
+      database.exec(`BEGIN IMMEDIATE`)
+      try {
+        const result = await task(driver)
+        database.exec(`COMMIT`)
+        return result
+      } catch (error) {
+        database.exec(`ROLLBACK`)
+        throw error
+      }
+    },
+  }
+  return driver
+}
+
+export const scope = harnessScope(() => {
+  const directory = mkdtempSync(join(tmpdir(), `db-temporal-oracle-`))
+  let database: DatabaseSync | undefined
+  function close(): void {
+    database?.close()
+    database = undefined
+  }
+  return {
+    open() {
+      close()
+      database = new DatabaseSync(join(directory, `state.sqlite`))
+      return {
+        database,
+        adapter: new SQLiteCorePersistenceAdapter({
+          driver: createDriver(database),
+        }),
+      }
+    },
+    cleanup() {
+      try {
+        close()
+      } finally {
+        rmSync(directory, { recursive: true, force: true })
+      }
+    },
+  }
+})
diff --git a/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value.test.ts b/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value.test.ts
new file mode 100644
index 0000000000..f9c2e0c287
--- /dev/null
+++ b/packages/db-sqlite-persistence-core/tests/sqlite-temporal-value.test.ts
@@ -0,0 +1,222 @@
+// @vitest-environment node
+/**
+ * Scenario checks for native Temporal values in the SQLite core adapter: IN
+ * membership against lookalike string keys, and the native literal encoding
+ * budget. `sqlite-temporal-value-oracle.test.ts` owns the typed-value law and its
+ * grammar; these tests pin single cases with hand-written expectations.
+ */
+import { IR } from '@tanstack/db'
+import { Temporal } from 'temporal-polyfill'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  check,
+  collectionId,
+  observe,
+  scope,
+} from './sqlite-temporal-value-support'
+import type { PersistedTx } from '../src'
+
+beforeEach(() => vi.stubGlobal(`Temporal`, Temporal))
+afterEach(() => vi.unstubAllGlobals())
+afterEach(scope.cleanup)
+
+// Equality is a pair relation: separate IN sets for order and identity can
+// accidentally combine matches from different ordinary string literals.
+it(`keeps native IN membership distinct from lookalike string keys`, async () => {
+  const { adapter } = scope.create().open()
+  const orderText = `10000000000000000000000`
+  const identityText = `Temporal.Instant:1970-01-01T00:00:00Z`
+  const values = [
+    Temporal.Instant.from(`1970-01-01T00:00:00Z`),
+    orderText,
+    identityText,
+  ]
+  await adapter.applyCommittedTx(
+    { kind: `eager`, collectionId: collectionId },
+    {
+      txId: `mixed`,
+      term: 1,
+      seq: 1,
+      rowVersion: 1,
+      mutations: values.map((stamp, i) => ({
+        type: `insert`,
+        key: `row-${i}`,
+        value: { stamp },
+      })),
+    },
+  )
+  const predicate = new IR.Func<boolean>(`in`, [
+    new IR.PropRef([`stamp`]),
+    new IR.Value([orderText, identityText]),
+  ])
+  expect(
+    (
+      await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        { where: predicate },
+      )
+    )
+      .map((row) => row.key)
+      .sort(),
+  ).toEqual([`row-1`, `row-2`])
+  expect(
+    (
+      await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`not`, [predicate]),
+        },
+      )
+    ).map((row) => row.key),
+  ).toEqual([`row-0`])
+})
+
+// Native literals need at most one brand-validated encoding per occurrence. The number
+// of occurrences supplies the work budget; no codec helper computes it. Empty
+// tables isolate compilation from revival. Positive counts also calibrate the
+// sensor. The existing rank/text and index owners check resulting query semantics.
+it.sequential.each([`Instant`, `PlainDate`] as const)(
+  `encodes each native query literal at most once / %s`,
+  async (kind) => {
+    const { adapter } = scope.create().open()
+    const constructor = Temporal[kind]
+    const value =
+      kind === `Instant`
+        ? Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+        : Temporal.PlainDate.from(`2026-01-02[u-ca=japanese]`)
+    const parse = vi.spyOn(constructor, `from`)
+    try {
+      for (const size of [1, 3, 1_025]) {
+        for (const operation of size === 1 ? [`eq`, `in`] : [`in`]) {
+          parse.mockClear()
+          const rows = await adapter.loadSubset(
+            { kind: `eager`, collectionId: `literal-work` },
+            {
+              where: new IR.Func(operation, [
+                new IR.PropRef([`stamp`]),
+                new IR.Value(
+                  operation === `eq`
+                    ? value
+                    : Array.from({ length: size }, () => value),
+                ),
+              ]),
+            },
+          )
+          expect(rows).toEqual([])
+          expect(parse.mock.calls.length).toBeGreaterThan(0)
+          expect(parse.mock.calls.length).toBeLessThanOrEqual(size)
+        }
+      }
+    } finally {
+      parse.mockRestore()
+    }
+  },
+)
+
+describe(`native Temporal query refinement`, () => {
+  it(`preserves marker-shaped records and rejects missing or unsupported constructors atomically`, async () => {
+    const { adapter } = scope.create().open()
+    const marker = {
+      __tanstack_db_persisted_type__: `Temporal.Instant`,
+      value: `2026-01-02T00:00:00Z`,
+      order: `unused`,
+    }
+    const tx: PersistedTx = {
+      txId: `record`,
+      term: 1,
+      seq: 1,
+      rowVersion: 1,
+      mutations: [
+        {
+          type: `insert`,
+          key: `record`,
+          value: { marker, stamp: Temporal.Instant.from(marker.value) },
+        },
+      ],
+    }
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      tx,
+    )
+    const before = await adapter.loadResumeSnapshot({
+      kind: `eager`,
+      collectionId: collectionId,
+    })
+    expect(before.rows[0]?.value.marker).toEqual(marker)
+    const nested = await adapter.loadSubset(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        where: new IR.Func(`eq`, [
+          new IR.PropRef([`marker`, `value`]),
+          new IR.Value(marker.value),
+        ]),
+      },
+    )
+    expect(
+      nested.map((row) => row.key),
+      `escaped record query`,
+    ).toEqual([`record`])
+    vi.stubGlobal(`Temporal`, undefined)
+    await expect(
+      adapter.loadSubset({ kind: `eager`, collectionId: collectionId }, {}),
+    ).rejects.toThrow(/Temporal/)
+    await expect(
+      adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          ...tx,
+          txId: `missing`,
+          seq: 2,
+          rowVersion: 2,
+        },
+      ),
+    ).rejects.toThrow(/Temporal/)
+    vi.stubGlobal(`Temporal`, Temporal)
+    await expect(
+      adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          ...tx,
+          txId: `unsupported`,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            {
+              type: `insert`,
+              key: `unsupported`,
+              value: { stamp: Temporal.Duration.from(`P1D`) },
+            },
+          ],
+        },
+      ),
+    ).rejects.toThrow(/Temporal/)
+    await expect(
+      adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          ...tx,
+          txId: `invalid-brand`,
+          seq: 2,
+          rowVersion: 2,
+          mutations: [
+            {
+              type: `insert`,
+              key: `fake`,
+              value: {
+                stamp: Object.create(Temporal.Instant.prototype) as unknown,
+              },
+            },
+          ],
+        },
+      ),
+    ).rejects.toThrow(/Invalid Temporal/)
+    check(
+      await adapter.loadResumeSnapshot({
+        kind: `eager`,
+        collectionId: collectionId,
+      }),
+      observe(before),
+      `rollback`,
+    )
+  })
+})
diff --git a/packages/db-sqlite-persistence-core/tests/temporal-value-oracle.ts b/packages/db-sqlite-persistence-core/tests/temporal-value-oracle.ts
index 03f16a2765..b048d9abdb 100644
--- a/packages/db-sqlite-persistence-core/tests/temporal-value-oracle.ts
+++ b/packages/db-sqlite-persistence-core/tests/temporal-value-oracle.ts
@@ -8,6 +8,7 @@
  */
 import { Temporal } from 'temporal-polyfill'
 import { IR } from '@tanstack/db'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 export { Temporal }
 
@@ -180,3 +181,5 @@ export function temporalQueryCases(family: TemporalFamily) {
     },
   ]
 }
+
+declareOracle({ model: [temporalQueryCases] })
diff --git a/packages/db/e2e/indexed-db/browser-evidence-oracle.ts b/packages/db/e2e/indexed-db/browser-evidence-oracle.ts
index 7a3543805b..dc58a4cebb 100644
--- a/packages/db/e2e/indexed-db/browser-evidence-oracle.ts
+++ b/packages/db/e2e/indexed-db/browser-evidence-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../../tests/oracle-declaration.js'
 import { OracleMismatch } from '../../tests/indexed-db/cross-tab-oracle'
 import type { BrowserEvidence } from './browser'
 
@@ -21,3 +22,5 @@ export function retainedDocument(
     )
   return retained
 }
+
+declareOracle({ check: [retainedDocument] })
diff --git a/packages/db/e2e/indexed-db/coverage-cleanup.ts b/packages/db/e2e/indexed-db/coverage-cleanup.ts
new file mode 100644
index 0000000000..9ae8b1ed50
--- /dev/null
+++ b/packages/db/e2e/indexed-db/coverage-cleanup.ts
@@ -0,0 +1,32 @@
+// Shared by the value and native receiving specs: the cleanup wrapper that
+// closes each page's coverage evidence without replacing the primary failure.
+import type { Page } from '@playwright/test'
+
+// Cleanup cannot replace a value/readiness mismatch or silently pass on its
+// own failure. Browser contexts own page closure after this helper completes.
+export async function withCoverage(
+  pages: Array<Page>,
+  run: () => Promise<void>,
+) {
+  let primary: unknown
+  let failed = false
+  try {
+    await run()
+  } catch (error) {
+    primary = error
+    failed = true
+  }
+  const results = await Promise.allSettled(
+    pages.map((page) => page.evaluate(() => window.coverage.cleanup())),
+  )
+  const errors = results.flatMap((result) =>
+    result.status === 'rejected' ? [result.reason as unknown] : [],
+  )
+  if (errors.length)
+    throw new AggregateError(
+      failed ? [primary, ...errors] : errors,
+      'Native oracle cleanup failed',
+      { cause: failed ? primary : errors[0] },
+    )
+  if (failed) throw primary
+}
diff --git a/packages/db/e2e/indexed-db/cross-tab-oracle.spec.ts b/packages/db/e2e/indexed-db/cross-tab-oracle.spec.ts
index 5b82d33230..dbd38365cd 100644
--- a/packages/db/e2e/indexed-db/cross-tab-oracle.spec.ts
+++ b/packages/db/e2e/indexed-db/cross-tab-oracle.spec.ts
@@ -28,102 +28,17 @@ import {
   oracleRuns,
 } from '../../tests/oracle-config'
 import { retainedDocument } from './browser-evidence-oracle'
-import type { BrowserContext, Page } from '@playwright/test'
+import {
+  awaitRestore,
+  closePages,
+  observe,
+  open,
+  withPages,
+} from './cross-tab-support'
+import type { BrowserContext } from '@playwright/test'
 import type { BrowserEvidence } from './browser'
 import type { Change, OracleRow } from '../../tests/indexed-db/cross-tab-oracle'
 
-async function open(
-  context: BrowserContext,
-  database: string,
-  tab: string,
-  split = false,
-  options = '',
-) {
-  const page = await context.newPage()
-  await page.goto(
-    `/e2e/indexed-db/browser.html?database=${database}&tab=${tab}&fault=${split ? 'split' : 'none'}${options}`,
-  )
-  await installed(page)
-  if (!options.includes('hold=startup'))
-    await page.evaluate(() => window.crossTab!.ready())
-  return page
-}
-async function installed(page: Page) {
-  await page.waitForFunction(
-    () => window.crossTab !== undefined || window.crossTabFailure !== undefined,
-  )
-  const failure = await page.evaluate(() => window.crossTabFailure)
-  if (failure) throw new Error(failure)
-}
-async function awaitRestore(page: Page) {
-  await installed(page)
-  await page.evaluate(() => window.crossTab!.ready())
-}
-const observe = (page: Page) => page.evaluate(() => window.crossTab!.observe())
-
-async function closePages(context: BrowserContext) {
-  const failures: Array<unknown> = []
-  for (const page of context.pages()) {
-    for (const action of [
-      () => page.evaluate(() => window.crossTab?.flushEvidence()),
-      () => page.evaluate(() => window.crossTab?.cleanup()),
-      () => page.evaluate(() => window.crossTab?.flushEvidence()),
-      () => page.close(),
-    ]) {
-      try {
-        await action()
-      } catch (error) {
-        failures.push(error)
-      }
-    }
-  }
-  return failures
-}
-
-async function withPages(
-  context: BrowserContext,
-  run: (events: Array<BrowserEvidence>, database: string) => Promise<void>,
-) {
-  const events: Array<BrowserEvidence> = []
-  const errors: Array<string> = []
-  await context.exposeBinding(
-    'retainOracleEvent',
-    (_source, event: BrowserEvidence) => {
-      events.push(event)
-    },
-  )
-  context.on('page', (page) =>
-    page.on('pageerror', (error) => errors.push(String(error))),
-  )
-  let primary: unknown
-  try {
-    await run(events, `oracle-${crypto.randomUUID()}`)
-  } catch (error) {
-    primary = error
-  }
-  const cleanup = await closePages(context)
-  await test.info().attach('native-evidence', {
-    body: JSON.stringify({
-      engine: test.info().project.name,
-      browserVersion: context.browser()!.version(),
-      events,
-      errors,
-      primary: String(primary ?? ''),
-      cleanup: cleanup.map(String),
-    }),
-    contentType: 'application/json',
-  })
-  if (primary !== undefined) {
-    if (cleanup.length)
-      throw new AggregateError(cleanup, 'Native oracle and cleanup failed', {
-        cause: primary,
-      })
-    throw primary
-  }
-  expect(errors, 'unexpected page errors').toEqual([])
-  expect(cleanup, 'cleanup failures').toEqual([])
-}
-
 async function overlap(
   context: BrowserContext,
   events: Array<BrowserEvidence>,
@@ -833,25 +748,6 @@ test('native reload readiness waits for its establishing storage read', async ({
   })
 })
 
-test('cleanup retains a primary mismatch and closes every page after an injected cleanup failure', async ({
-  context,
-}) => {
-  const primary = new OracleMismatch(
-    'calibration',
-    'before cleanup',
-    'expected',
-    'wrong',
-  )
-  await expect(
-    withPages(context, async (_events, database) => {
-      await open(context, database, 'first', false, '&cleanupFailure=1')
-      await open(context, database, 'second')
-      throw primary
-    }),
-  ).rejects.toMatchObject({ cause: primary })
-  expect(context.pages()).toHaveLength(0)
-})
-
 // Native administrative deletion witness. Hold only the old success callback;
 // its late delivery grants no authority over a recreated Collection.
 test('late administrative deletion receipt preserves a recreated database snapshot', async ({
@@ -1103,47 +999,6 @@ for (const reason of ['explicit', 'upgrade', 'delete'] as const)
         })
       })
 
-// fake-indexeddb cannot provide this witness: its deletion queue treats a
-// close-pending connection as closed. Real engines must wait for BOTH native
-// transaction completion and the unmanaged connection, in either release order.
-for (const transactionFirst of [false, true])
-  test(`native deletion waits for both obligations, transaction first ${transactionFirst}`, async ({
-    context,
-  }) => {
-    await withPages(context, async (_events, database) => {
-      const a = await open(context, database, 'owner')
-      const b = await open(context, database, 'administrator')
-      await a.evaluate(() => window.crossTab!.openBlocker())
-      await a.evaluate(() => window.crossTab!.holdStorage())
-      await b.evaluate(() => window.crossTab!.startSchema('delete'))
-      await a.waitForFunction(
-        () => window.crossTab!.observe().versionChanges === 1,
-      )
-      expect((await observe(a)).status).toBe('crashed')
-      if (transactionFirst) {
-        await a.evaluate(() => window.crossTab!.releaseBarrier())
-        expect((await observe(a)).writes.at(-1)).toBe('complete')
-        expect((await observe(b)).schema.status).toBe('pending')
-        await a.evaluate(() => window.crossTab!.closeBlocker())
-      } else {
-        await a.evaluate(() => window.crossTab!.closeBlocker())
-        await b.evaluate(
-          () =>
-            new Promise<void>((resolve) =>
-              requestAnimationFrame(() => resolve()),
-            ),
-        )
-        expect((await observe(a)).writes.at(-1)).toBe('pending')
-        expect((await observe(b)).schema.status).toBe('pending')
-        await a.evaluate(() => window.crossTab!.releaseBarrier())
-      }
-      await b.waitForFunction(
-        () => window.crossTab!.observe().schema.status === 'complete',
-      )
-      expect((await observe(a)).status).toBe('crashed')
-    })
-  })
-
 // Chromium DevTools supplies actual abnormal closure, including native aborts;
 // no synthetic close event or test-triggered transaction.abort supplies it.
 // Site-data clearing also deletes storage, so retained public rows and empty
diff --git a/packages/db/e2e/indexed-db/cross-tab-support.ts b/packages/db/e2e/indexed-db/cross-tab-support.ts
new file mode 100644
index 0000000000..592967d602
--- /dev/null
+++ b/packages/db/e2e/indexed-db/cross-tab-support.ts
@@ -0,0 +1,99 @@
+// Shared by the cross-tab native oracle spec and cross-tab.spec.ts: the page
+// open, observation, cleanup, and evidence wrapper that every native cross-tab
+// scenario uses. The laws they serve are stated in cross-tab-oracle.spec.ts.
+import { expect, test } from '@playwright/test'
+import type { BrowserContext, Page } from '@playwright/test'
+import type { BrowserEvidence } from './browser'
+
+export async function open(
+  context: BrowserContext,
+  database: string,
+  tab: string,
+  split = false,
+  options = '',
+) {
+  const page = await context.newPage()
+  await page.goto(
+    `/e2e/indexed-db/browser.html?database=${database}&tab=${tab}&fault=${split ? 'split' : 'none'}${options}`,
+  )
+  await installed(page)
+  if (!options.includes('hold=startup'))
+    await page.evaluate(() => window.crossTab!.ready())
+  return page
+}
+export async function installed(page: Page) {
+  await page.waitForFunction(
+    () => window.crossTab !== undefined || window.crossTabFailure !== undefined,
+  )
+  const failure = await page.evaluate(() => window.crossTabFailure)
+  if (failure) throw new Error(failure)
+}
+export async function awaitRestore(page: Page) {
+  await installed(page)
+  await page.evaluate(() => window.crossTab!.ready())
+}
+export const observe = (page: Page) =>
+  page.evaluate(() => window.crossTab!.observe())
+
+export async function closePages(context: BrowserContext) {
+  const failures: Array<unknown> = []
+  for (const page of context.pages()) {
+    for (const action of [
+      () => page.evaluate(() => window.crossTab?.flushEvidence()),
+      () => page.evaluate(() => window.crossTab?.cleanup()),
+      () => page.evaluate(() => window.crossTab?.flushEvidence()),
+      () => page.close(),
+    ]) {
+      try {
+        await action()
+      } catch (error) {
+        failures.push(error)
+      }
+    }
+  }
+  return failures
+}
+
+export async function withPages(
+  context: BrowserContext,
+  run: (events: Array<BrowserEvidence>, database: string) => Promise<void>,
+) {
+  const events: Array<BrowserEvidence> = []
+  const errors: Array<string> = []
+  await context.exposeBinding(
+    'retainOracleEvent',
+    (_source, event: BrowserEvidence) => {
+      events.push(event)
+    },
+  )
+  context.on('page', (page) =>
+    page.on('pageerror', (error) => errors.push(String(error))),
+  )
+  let primary: unknown
+  try {
+    await run(events, `oracle-${crypto.randomUUID()}`)
+  } catch (error) {
+    primary = error
+  }
+  const cleanup = await closePages(context)
+  await test.info().attach('native-evidence', {
+    body: JSON.stringify({
+      engine: test.info().project.name,
+      browserVersion: context.browser()!.version(),
+      events,
+      errors,
+      primary: String(primary ?? ''),
+      cleanup: cleanup.map(String),
+    }),
+    contentType: 'application/json',
+  })
+  if (primary !== undefined) {
+    if (cleanup.length)
+      throw new AggregateError(cleanup, 'Native oracle and cleanup failed', {
+        cause: primary,
+      })
+    throw primary
+  }
+  expect(errors, 'unexpected page errors').toEqual([])
+  expect(cleanup, 'cleanup failures').toEqual([])
+}
diff --git a/packages/db/e2e/indexed-db/cross-tab.spec.ts b/packages/db/e2e/indexed-db/cross-tab.spec.ts
new file mode 100644
index 0000000000..34a584dee0
--- /dev/null
+++ b/packages/db/e2e/indexed-db/cross-tab.spec.ts
@@ -0,0 +1,67 @@
+// Ordinary native cross-tab scenarios. cross-tab-oracle.spec.ts owns the
+// browser-side history and publication laws; these two tests compare with
+// literal observations, and one is a harness self-test of the primary-mismatch
+// cleanup. Their helpers are in cross-tab-support.ts.
+import { expect, test } from '@playwright/test'
+import { OracleMismatch } from '../../tests/indexed-db/cross-tab-oracle'
+import { observe, open, withPages } from './cross-tab-support'
+
+test('cleanup retains a primary mismatch and closes every page after an injected cleanup failure', async ({
+  context,
+}) => {
+  const primary = new OracleMismatch(
+    'calibration',
+    'before cleanup',
+    'expected',
+    'wrong',
+  )
+  await expect(
+    withPages(context, async (_events, database) => {
+      await open(context, database, 'first', false, '&cleanupFailure=1')
+      await open(context, database, 'second')
+      throw primary
+    }),
+  ).rejects.toMatchObject({ cause: primary })
+  expect(context.pages()).toHaveLength(0)
+})
+
+// fake-indexeddb cannot provide this witness: its deletion queue treats a
+// close-pending connection as closed. Real engines must wait for BOTH native
+// transaction completion and the unmanaged connection, in either release order.
+for (const transactionFirst of [false, true])
+  test(`native deletion waits for both obligations, transaction first ${transactionFirst}`, async ({
+    context,
+  }) => {
+    await withPages(context, async (_events, database) => {
+      const a = await open(context, database, 'owner')
+      const b = await open(context, database, 'administrator')
+      await a.evaluate(() => window.crossTab!.openBlocker())
+      await a.evaluate(() => window.crossTab!.holdStorage())
+      await b.evaluate(() => window.crossTab!.startSchema('delete'))
+      await a.waitForFunction(
+        () => window.crossTab!.observe().versionChanges === 1,
+      )
+      expect((await observe(a)).status).toBe('crashed')
+      if (transactionFirst) {
+        await a.evaluate(() => window.crossTab!.releaseBarrier())
+        expect((await observe(a)).writes.at(-1)).toBe('complete')
+        expect((await observe(b)).schema.status).toBe('pending')
+        await a.evaluate(() => window.crossTab!.closeBlocker())
+      } else {
+        await a.evaluate(() => window.crossTab!.closeBlocker())
+        await b.evaluate(
+          () =>
+            new Promise<void>((resolve) =>
+              requestAnimationFrame(() => resolve()),
+            ),
+        )
+        expect((await observe(a)).writes.at(-1)).toBe('pending')
+        expect((await observe(b)).schema.status).toBe('pending')
+        await a.evaluate(() => window.crossTab!.releaseBarrier())
+      }
+      await b.waitForFunction(
+        () => window.crossTab!.observe().schema.status === 'complete',
+      )
+      expect((await observe(a)).status).toBe('crashed')
+    })
+  })
diff --git a/packages/db/e2e/indexed-db/host-driver.ts b/packages/db/e2e/indexed-db/host-driver.ts
index 45424e9dd5..24ee0c72ad 100644
--- a/packages/db/e2e/indexed-db/host-driver.ts
+++ b/packages/db/e2e/indexed-db/host-driver.ts
@@ -1,5 +1,5 @@
 /** Shared production driver for real pages and dedicated workers. Expected
- * rows stay in host-oracle.spec.ts. Native events and storage supply all premises.
+ * rows stay in host.spec.ts. Native events and storage supply all premises.
  */
 import {
   createCollection,
diff --git a/packages/db/e2e/indexed-db/host-oracle.spec.ts b/packages/db/e2e/indexed-db/host.spec.ts
similarity index 96%
rename from packages/db/e2e/indexed-db/host-oracle.spec.ts
rename to packages/db/e2e/indexed-db/host.spec.ts
index 96aca250ec..df0559e217 100644
--- a/packages/db/e2e/indexed-db/host-oracle.spec.ts
+++ b/packages/db/e2e/indexed-db/host.spec.ts
@@ -1,6 +1,7 @@
 /** Host receiving laws: page/worker writes converge; changing a legal store
- * name preserves replacement/clear isolation. The independent model is an
- * authored list per store, with replacement and emptying as ordinary list laws.
+ * name preserves replacement/clear isolation. This file declares no check or
+ * model: its checkpoints compare with an authored list per store, written as
+ * literal states after each step, so these scenarios are not an oracle.
  * At each settled delivery cut compare public rows, export and raw storage in
  * both hosts. Two typed keys in one insertion also receive the core payload law.
  * Dedicated workers are live throughout; suspension/service workers are outside
diff --git a/packages/db/e2e/indexed-db/value-oracle.spec.ts b/packages/db/e2e/indexed-db/value-oracle.spec.ts
index 9308ba153e..2668dd33a6 100644
--- a/packages/db/e2e/indexed-db/value-oracle.spec.ts
+++ b/packages/db/e2e/indexed-db/value-oracle.spec.ts
@@ -10,35 +10,10 @@ import {
   expectedValueRows,
   valueKinds,
 } from '../../tests/indexed-db/structured-clone-oracle'
+import { declareOracle } from '../../tests/oracle-declaration'
 import { test } from './browser-test'
 import type {} from './coverage-browser'
-import type { Page } from '@playwright/test'
-
-// Cleanup cannot replace a value/readiness mismatch or silently pass on its
-// own failure. Browser contexts own page closure after this helper completes.
-async function withCoverage(pages: Array<Page>, run: () => Promise<void>) {
-  let primary: unknown
-  let failed = false
-  try {
-    await run()
-  } catch (error) {
-    primary = error
-    failed = true
-  }
-  const results = await Promise.allSettled(
-    pages.map((page) => page.evaluate(() => window.coverage.cleanup())),
-  )
-  const errors = results.flatMap((result) =>
-    result.status === 'rejected' ? [result.reason as unknown] : [],
-  )
-  if (errors.length)
-    throw new AggregateError(
-      failed ? [primary, ...errors] : errors,
-      'Native oracle cleanup failed',
-      { cause: failed ? primary : errors[0] },
-    )
-  if (failed) throw primary
-}
+import { withCoverage } from './coverage-cleanup'
 
 for (const kind of valueKinds) {
   test(`preserves supported ${kind} values or reports native rejection`, async ({
@@ -167,10 +142,21 @@ for (const kind of valueKinds) {
   })
 }
 
+// First-open model: a shared database name gives every writer's Collection all
+// rows; separate names give each writer only its own row.
+function expectedFirstOpenRows<T>(
+  rows: Array<T>,
+  shared: boolean,
+): Array<Array<T>> {
+  return rows.map((row) => (shared ? rows : [row]))
+}
+
+declareOracle({ model: [expectedFirstOpenRows] })
+
 // Same/independent names distinguish queue sharing from accidental global
 // ownership. Prototype and Unicode store names also receive native creation,
 // dictionary lookup, broadcast and restore; the wider renaming grammar stays
-// in compatibility-oracle.test.ts.
+// in compatibility.test.ts.
 for (const shared of [true, false]) {
   for (const store of ['__proto__', '雪/é']) {
     test(`initializes concurrent native opens with shared ${shared} and store ${store}`, async ({
@@ -213,7 +199,7 @@ for (const shared of [true, false]) {
           ['complete'],
         ])
         const rows = [0, 1, 2].map((id) => ({ id, name: `writer-${id}` }))
-        const expected = rows.map((row) => (shared ? rows : [row]))
+        const expected = expectedFirstOpenRows(rows, shared)
         await expect
           .poll(() => page.evaluate(() => window.initialization.rows()))
           .toEqual(expected)
@@ -229,40 +215,3 @@ for (const shared of [true, false]) {
     })
   }
 }
-
-// A same-origin iframe supplies actual foreign native constructors in each
-// engine. Authored bytes and graph identity judge callback-return capture,
-// settled public rows, native storage and export without constructor-source
-// inspection in the expected result. Both property orders reach buffer copying.
-for (const kind of ['u8', 'view'] as const) {
-  for (const viewFirst of [false, true]) {
-    test(`captures foreign ${kind} aliases with viewFirst=${viewFirst}`, async ({
-      page,
-    }) => {
-      await withCoverage([page], async () => {
-        await page.goto('/e2e/indexed-db/coverage.html')
-        await page.waitForFunction(() => Boolean(window.coverage))
-        const result = await page.evaluate(
-          async ({ name, first, viewKind }) => {
-            window.valuePeer = await window.coverage.valuePeer(name)
-            return window.valuePeer.captureRealm(first, viewKind)
-          },
-          {
-            name: `realm-${crypto.randomUUID()}`,
-            first: viewFirst,
-            viewKind: kind,
-          },
-        )
-        expect(result).toEqual(
-          Array.from({ length: 4 }, () => ({
-            bytes: [0, 1, 2, 3, 4, 5, 6, 7],
-            offset: 2,
-            length: 3,
-            alias: true,
-            detached: true,
-          })),
-        )
-      })
-    })
-  }
-}
diff --git a/packages/db/e2e/indexed-db/value.spec.ts b/packages/db/e2e/indexed-db/value.spec.ts
new file mode 100644
index 0000000000..88176be707
--- /dev/null
+++ b/packages/db/e2e/indexed-db/value.spec.ts
@@ -0,0 +1,44 @@
+// Ordinary native value scenarios. value-oracle.spec.ts owns the structured-clone
+// value laws and their models; this foreign-realm witness compares with literal
+// bytes and offsets, so it is supplemental coverage.
+import { expect } from '@playwright/test'
+import { test } from './browser-test'
+import { withCoverage } from './coverage-cleanup'
+import type {} from './coverage-browser'
+
+// A same-origin iframe supplies actual foreign native constructors in each
+// engine. Authored bytes and graph identity judge callback-return capture,
+// settled public rows, native storage and export without constructor-source
+// inspection in the expected result. Both property orders reach buffer copying.
+for (const kind of ['u8', 'view'] as const) {
+  for (const viewFirst of [false, true]) {
+    test(`captures foreign ${kind} aliases with viewFirst=${viewFirst}`, async ({
+      page,
+    }) => {
+      await withCoverage([page], async () => {
+        await page.goto('/e2e/indexed-db/coverage.html')
+        await page.waitForFunction(() => Boolean(window.coverage))
+        const result = await page.evaluate(
+          async ({ name, first, viewKind }) => {
+            window.valuePeer = await window.coverage.valuePeer(name)
+            return window.valuePeer.captureRealm(first, viewKind)
+          },
+          {
+            name: `realm-${crypto.randomUUID()}`,
+            first: viewFirst,
+            viewKind: kind,
+          },
+        )
+        expect(result).toEqual(
+          Array.from({ length: 4 }, () => ({
+            bytes: [0, 1, 2, 3, 4, 5, 6, 7],
+            offset: 2,
+            length: 3,
+            alias: true,
+            detached: true,
+          })),
+        )
+      })
+    })
+  }
+}
diff --git a/packages/db/package.json b/packages/db/package.json
index 4b57b6b7ab..598819c214 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -23,7 +23,7 @@
     "test": "vitest --run",
     "test:dist": "vitest run --config vitest.dist.config.ts",
     "test:facade-retention": "node --expose-gc --import tsx tests/facade-retention.probe.ts",
-    "test:oracles": "vitest --run --coverage.enabled=false tests/reverse-index-oracle.property.test.ts tests/query/compiler/in-evaluator-oracle.property.test.ts tests/cleanup-queue-oracle.property.test.ts tests/comparison-oracle.property.test.ts tests/duration-query-equality-oracle.test.ts tests/temporal-index-order-oracle.test.ts tests/cursor-oracle.property.test.ts tests/index-update-oracle.property.test.ts tests/utils-oracle.property.test.ts tests/change-event-history-oracle.test.ts tests/index-suggestion-oracle.test.ts tests/btree-map-oracle.test.ts tests/paced-mutations-oracle.test.ts tests/db-client-hydration-authority-oracle.test.ts tests/local-storage-order-oracle.test.ts tests/local-storage-peer-oracle.test.ts tests/local-storage-value-fidelity-oracle.property.test.ts tests/collection-mutation-startup-oracle.test.ts tests/collection-cleanup-restart-oracle.test.ts tests/collection-gc-transaction-oracle.property.test.ts tests/collection-gc-retention-oracle.property.test.ts tests/collection-gc-mutation-oracle.property.test.ts tests/effect-disposal-oracle.test.ts tests/optimistic-transaction-oracle.property.test.ts tests/transaction-ownership-oracle.property.test.ts tests/optimistic-settlement-boundaries-oracle.test.ts tests/optimistic-history-publication-oracle.test.ts tests/optimistic-history-outcomes-oracle.test.ts tests/collection-metadata-publication-oracle.property.test.ts tests/collection-index-value-oracle.test.ts tests/collection-state-retention-oracle.property.test.ts tests/collection-subscription-lifecycle-history-oracle.property.test.ts tests/collection-subscription-lifecycle-oracle.test.ts tests/collection-subscription-reentrancy-oracle.test.ts tests/collection-subscription-lifecycle-publication-oracle.property.test.ts tests/collection-subscription-replay-oracle.property.test.ts tests/d2-source-reconciliation-oracle.property.test.ts tests/live-query-observer-history-oracle.property.test.ts tests/live-query-observer-hydration-oracle.property.test.ts tests/live-query-observer-snapshot-oracle.property.test.ts tests/query/cold-join-reconciliation-oracle.test.ts tests/query/identity-output-shape-oracle.test.ts tests/query/optimizer-semantics-oracle.test.ts tests/query/index-path-collision-oracle.test.ts tests/query/custom-index-order-selection-oracle.test.ts tests/query/mixed-index-order-oracle.test.ts tests/query/includes-collection-oracle.property.test.ts tests/query/includes-functional-projection-oracle.test.ts tests/query/includes-functional-input-boundary.test.ts tests/query/includes-context-transport-oracle.test.ts tests/query/includes-cross-formulation-oracle.property.test.ts tests/query/includes-optimistic-oracle.property.test.ts tests/query/includes-oracle.property.test.ts tests/query/includes-alias-shadowing-oracle.test.ts tests/query/includes-outer-join-route-work-oracle.test.ts tests/query/includes-publication-oracle.test.ts tests/query/includes-query-shape-oracle.test.ts tests/query/subquery-user-value-oracle.test.ts tests/query/includes-temporal-oracle.test.ts tests/query/includes-work-counter-oracle.test.ts tests/query/load-subset-oracle.property.test.ts tests/query/load-subset-replay-refinement-oracle.test.ts tests/query/load-subset-source-readiness-refinement-oracle.test.ts tests/query/load-subset-transaction-refinement-oracle.test.ts tests/query/ordered-source-loader-state-oracle.test.ts tests/query/ordered-demand-retirement.test.ts tests/query/ordered-default-work.test.ts tests/query/ordered-lifecycle-oracle.property.test.ts tests/query/ordered-work-oracle.property.test.ts tests/query/pagination-oracle.property.test.ts tests/query/includes-space-oracle.test.ts tests/query/virtual-row-fields-oracle.test.ts tests/query/where-predicate-publication-oracle.property.test.ts tests/query/join-result-key-oracle.property.test.ts tests/query/pooled-live-query-oracle.property.test.ts tests/live-query-deferred-acquisition-oracle.test.ts tests/flat-change-tracking-oracle.property.test.ts tests/truncate-readiness-oracle.test.ts tests/proxy-detachment-contract-oracle.test.ts tests/production-error-messages-oracle.test.ts tests/query/bucket-facade-rollback-oracle.property.test.ts tests/query/aggregate-select-oracle.property.test.ts tests/query/load-subset-joint-replay-oracle.property.test.ts",
+    "test:oracles": "vitest --run --coverage.enabled=false tests/reverse-index-oracle.property.test.ts tests/query/compiler/in-evaluator-oracle.property.test.ts tests/cleanup-queue-oracle.property.test.ts tests/comparison-oracle.property.test.ts tests/duration-query-equality-oracle.test.ts tests/cursor-oracle.property.test.ts tests/index-update-oracle.property.test.ts tests/utils-oracle.property.test.ts tests/change-event-history-oracle.test.ts tests/index-suggestion-oracle.test.ts tests/btree-map-oracle.test.ts tests/paced-mutations-oracle.test.ts tests/db-client-hydration-authority-oracle.test.ts tests/local-storage-order-oracle.test.ts tests/local-storage-value-fidelity-oracle.property.test.ts tests/collection-cleanup-restart-oracle.test.ts tests/collection-gc-transaction-oracle.property.test.ts tests/collection-gc-retention-oracle.property.test.ts tests/collection-gc-mutation-oracle.property.test.ts tests/effect-disposal-oracle.test.ts tests/optimistic-transaction-oracle.property.test.ts tests/transaction-ownership-oracle.property.test.ts tests/optimistic-settlement-boundaries-oracle.test.ts tests/optimistic-history-publication-oracle.test.ts tests/optimistic-history-outcomes-oracle.test.ts tests/collection-metadata-publication-oracle.property.test.ts tests/collection-index-value-oracle.test.ts tests/collection-state-retention-oracle.property.test.ts tests/collection-subscription-lifecycle-history-oracle.property.test.ts tests/collection-subscription-lifecycle-oracle.test.ts tests/collection-subscription-reentrancy-oracle.test.ts tests/collection-subscription-lifecycle-publication-oracle.property.test.ts tests/collection-subscription-replay-oracle.property.test.ts tests/d2-source-reconciliation-oracle.property.test.ts tests/live-query-observer-history-oracle.property.test.ts tests/live-query-observer-hydration-oracle.property.test.ts tests/live-query-observer-snapshot-oracle.property.test.ts tests/query/cold-join-reconciliation-oracle.test.ts tests/query/identity-output-shape-oracle.test.ts tests/query/optimizer-semantics-oracle.test.ts tests/query/index-path-collision-oracle.test.ts tests/query/custom-index-order-selection-oracle.test.ts tests/query/mixed-index-order-oracle.test.ts tests/query/includes-collection-oracle.property.test.ts tests/query/includes-functional-projection-oracle.test.ts tests/query/includes-functional-input-boundary.test.ts tests/query/includes-context-transport-oracle.test.ts tests/query/includes-cross-formulation-oracle.property.test.ts tests/query/includes-optimistic-oracle.property.test.ts tests/query/includes-oracle.property.test.ts tests/query/includes-alias-shadowing-oracle.test.ts tests/query/includes-outer-join-route-work-oracle.test.ts tests/query/includes-publication-oracle.test.ts tests/query/includes-query-shape-oracle.test.ts tests/query/subquery-user-value-oracle.test.ts tests/query/includes-temporal-oracle.test.ts tests/query/includes-work-counter-oracle.test.ts tests/query/load-subset-oracle.property.test.ts tests/query/load-subset-replay-refinement-oracle.test.ts tests/query/load-subset-source-readiness-refinement-oracle.test.ts tests/query/load-subset-transaction-refinement-oracle.test.ts tests/query/ordered-source-loader-state-oracle.test.ts tests/query/ordered-demand-retirement.test.ts tests/query/ordered-default-work.test.ts tests/query/ordered-lifecycle-oracle.property.test.ts tests/query/ordered-work-oracle.property.test.ts tests/query/pagination-oracle.property.test.ts tests/query/includes-space-oracle.test.ts tests/query/virtual-row-fields-oracle.test.ts tests/query/where-predicate-publication-oracle.property.test.ts tests/query/join-result-key-oracle.property.test.ts tests/query/pooled-live-query-oracle.property.test.ts tests/live-query-deferred-acquisition-oracle.test.ts tests/flat-change-tracking-oracle.property.test.ts tests/truncate-readiness-oracle.test.ts tests/proxy-detachment-contract-oracle.test.ts tests/production-error-messages-oracle.test.ts tests/query/bucket-facade-rollback-oracle.property.test.ts tests/query/aggregate-select-oracle.property.test.ts tests/query/load-subset-joint-replay-oracle.property.test.ts",
     "bench:nested-includes": "vitest bench tests/query/includes-performance.bench.ts --run",
     "test:indexed-db:package": "pnpm --filter @tanstack/db... build && vitest run --config vitest.indexed-db.package.config.ts",
     "test:collection-gc:browser": "playwright test --config playwright.collection-gc.config.ts",
diff --git a/packages/db/playwright.indexed-db.config.ts b/packages/db/playwright.indexed-db.config.ts
index e615dae10c..4176d1e45d 100644
--- a/packages/db/playwright.indexed-db.config.ts
+++ b/packages/db/playwright.indexed-db.config.ts
@@ -23,7 +23,7 @@ export default defineConfig({
     })),
     {
       name: 'webkit-persistent',
-      testMatch: '**/value-oracle.spec.ts',
+      testMatch: ['**/value-oracle.spec.ts', '**/value.spec.ts'],
       use: { browserName: 'webkit' },
     },
   ],
diff --git a/packages/db/tests/SortedMap-oracle.test.ts b/packages/db/tests/SortedMap-oracle.test.ts
index c9914b0f7a..fd1acf5387 100644
--- a/packages/db/tests/SortedMap-oracle.test.ts
+++ b/packages/db/tests/SortedMap-oracle.test.ts
@@ -3,6 +3,9 @@ import fc from 'fast-check'
 import { SortedMap } from '../src/SortedMap'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config'
 import { createOracleReach } from './oracle-reach'
+import { declareOracle } from './oracle-declaration'
+import { expectMap, expectView, modelOrder } from './sorted-map-support'
+import type { ModelKey, Row } from './sorted-map-support'
 
 /**
  * SortedMap is the ordered map behind Collection state: synced rows, ordered
@@ -51,14 +54,6 @@ import { createOracleReach } from './oracle-reach'
  * inconsistent views of the same state, and work that grows with the map.
  */
 
-type Order = `key` | `ascending` | `descending`
-
-// Production stores row objects so the driver can change one in place. The
-// model stores each row's rank as a number and never shares an object.
-type Row = { rank: number }
-
-type ModelKey = number
-
 // A burst writes more keys than one small batch holds, in an order derived
 // from its seed value, so ordered restoration has many pending keys to place.
 function burstEntries(seed: number): Array<[number, number]> {
@@ -68,87 +63,12 @@ function burstEntries(seed: number): Array<[number, number]> {
   return keys.map((key) => [key, ((key * 7) % 5) - 2])
 }
 
-const probeKeys: Array<ModelKey> = [
-  -3,
-  -2,
-  -1,
-  0,
-  1,
-  2,
-  3,
-  Number.NaN,
-  10,
-  26,
-  50,
-]
-
-// The generated keys are numbers, which key order sorts ascending with `NaN`
-// after every other number.
-const compareModelKeys = (a: ModelKey, b: ModelKey) =>
-  Number.isNaN(a) || Number.isNaN(b)
-    ? Number(Number.isNaN(a)) - Number(Number.isNaN(b))
-    : a - b
-
-function modelOrder(model: Map<ModelKey, number>, order: Order) {
-  return [...model].sort(
-    ([ka, va], [kb, vb]) =>
-      (order === `key` ? 0 : order === `ascending` ? va - vb : vb - va) ||
-      compareModelKeys(ka, kb),
-  )
-}
-
 // The work law's bound for restoring k deferred keys among n others.
 function restoreBound(k: number, n: number): number {
   if (k === 0) return 0
   return k * (Math.ceil(Math.log2(k)) + Math.ceil(Math.log2(n + 1)) + 2)
 }
 
-const byKey = (entries: Array<[ModelKey, number]>) =>
-  [...entries].sort(([a], [b]) => compareModelKeys(a, b))
-
-// Compare one observed view with the model. Without the order promise, the
-// view must still hold each key once with its current value.
-function expectView(
-  actual: Array<[ModelKey, number]>,
-  expected: Array<[ModelKey, number]>,
-  orderPromised: boolean,
-) {
-  if (orderPromised) expect(actual).toEqual(expected)
-  else expect(byKey(actual)).toEqual(byKey(expected))
-}
-
-function expectMap(
-  actual: SortedMap<number, Row>,
-  model: Map<ModelKey, number>,
-  order: Order,
-  orderPromised = true,
-) {
-  // Recompute from a plain Map; do not copy SortedMap's binary insertion logic.
-  const expected = modelOrder(model, order)
-  const ranks = (entries: Iterable<[number, Row]>) =>
-    // A stale slot reads no row; keep it visible to the comparison.
-    [...entries].map(([key, row]): [ModelKey, number] => [
-      key,
-      (row as Row | undefined)?.rank as number,
-    ])
-  expect(actual.size).toBe(model.size)
-  expectView(ranks(actual), expected, orderPromised)
-  expectView(ranks(actual.entries()), expected, orderPromised)
-  const values = [...actual.values()]
-  expectView(
-    [...actual.keys()].map((key, index) => [
-      key,
-      (values[index] as Row | undefined)?.rank as number,
-    ]),
-    expected,
-    orderPromised,
-  )
-  for (const key of probeKeys) {
-    expect(actual.has(key)).toBe(model.has(key))
-    expect(actual.get(key)?.rank).toBe(model.get(key))
-  }
-}
-
 type Action = {
   kind: `set` | `delete` | `clear` | `burst` | `prune` | `mutate`
   key: ModelKey
@@ -214,6 +134,8 @@ const fixedHistories: Array<Array<Action>> = [
   ],
 ]
 
+declareOracle({ check: [expectMap], model: [modelOrder, restoreBound] })
+
 describe.each([`key`, `ascending`, `descending`] as const)(
   `SortedMap %s history`,
   (order) => {
@@ -430,60 +352,3 @@ describe.each([`key`, `ascending`, `descending`] as const)(
     )
   },
 )
-
-it(`rejects wrong default ordering, missing tied entries, stale overwrites, and lost keys`, () => {
-  const byValue = new SortedMap<number, Row>((a, b) => a.rank - b.rank)
-  byValue.set(1, { rank: 3 }).set(-1, { rank: 4 })
-  expect(() =>
-    expectMap(
-      byValue,
-      new Map([
-        [1, 3],
-        [-1, 4],
-      ]),
-      `key`,
-    ),
-  ).toThrow()
-  const missingTie = new SortedMap<number, Row>((a, b) => a.rank - b.rank)
-  missingTie.set(1, { rank: 3 })
-  expect(() =>
-    expectMap(
-      missingTie,
-      new Map([
-        [1, 3],
-        [-1, 3],
-      ]),
-      `ascending`,
-    ),
-  ).toThrow()
-  const stale = new SortedMap<number, Row>()
-  stale.set(1, { rank: 3 })
-  expect(() => expectMap(stale, new Map([[1, 2]]), `key`)).toThrow()
-  // Without the order promise, a view may reorder keys but must hold each
-  // key once with its current value.
-  const expected: Array<[ModelKey, number]> = [
-    [1, 3],
-    [2, 3],
-  ]
-  expect(() =>
-    expectView(
-      [
-        [2, 3],
-        [1, 3],
-      ],
-      expected,
-      false,
-    ),
-  ).not.toThrow()
-  expect(() =>
-    expectView(
-      [
-        [1, 3],
-        [1, 3],
-      ],
-      expected,
-      false,
-    ),
-  ).toThrow()
-  expect(() => expectView([[1, 3]], expected, false)).toThrow()
-})
diff --git a/packages/db/tests/SortedMap.test.ts b/packages/db/tests/SortedMap.test.ts
index cfaae78782..0f434c0ab1 100644
--- a/packages/db/tests/SortedMap.test.ts
+++ b/packages/db/tests/SortedMap.test.ts
@@ -1,8 +1,17 @@
+/**
+ * Unit tests for SortedMap: ordering edge cases, bulk-sync movement bounds, and
+ * key iteration details that pin hand-written results. The law that every
+ * ordering observation must refine a full recomputation is owned by
+ * SortedMap-oracle.test.ts.
+ */
+
 import { describe, expect, it, vi } from 'vitest'
 import { SortedMap } from '../src/SortedMap'
 import { createCollection } from '../src/collection/index.js'
 import { createTransaction } from '../src/transactions.js'
+import { expectMap, expectView } from './sorted-map-support'
 import type { SyncConfig } from '../src/types.js'
+import type { ModelKey, Row } from './sorted-map-support'
 
 // Supplemental examples for SortedMap. The generated law lives in
 // SortedMap-oracle.test.ts; these pin scale, scan reuse, and public
@@ -31,22 +40,6 @@ async function countDisplacedSlots(
   return displaced
 }
 
-type Order = `key` | `ascending` | `descending`
-
-function expectMap(
-  actual: SortedMap<number, number>,
-  model: Map<number, number>,
-  order: Order,
-) {
-  const expected = [...model].sort(
-    ([ka, va], [kb, vb]) =>
-      (order === `key` ? 0 : order === `ascending` ? va - vb : vb - va) ||
-      ka - kb,
-  )
-  expect([...actual]).toEqual(expected)
-  expect(actual.size).toBe(model.size)
-}
-
 describe(`SortedMap`, () => {
   it(`keeps ordered-key movement bounded during descending bulk inserts`, async () => {
     // This work counter records the array elements displaced by splice. The
@@ -514,3 +507,60 @@ describe(`SortedMap`, () => {
     expect(Array.from(map.entries())).toEqual([])
   })
 })
+
+it(`rejects wrong default ordering, missing tied entries, stale overwrites, and lost keys`, () => {
+  const byValue = new SortedMap<number, Row>((a, b) => a.rank - b.rank)
+  byValue.set(1, { rank: 3 }).set(-1, { rank: 4 })
+  expect(() =>
+    expectMap(
+      byValue,
+      new Map([
+        [1, 3],
+        [-1, 4],
+      ]),
+      `key`,
+    ),
+  ).toThrow()
+  const missingTie = new SortedMap<number, Row>((a, b) => a.rank - b.rank)
+  missingTie.set(1, { rank: 3 })
+  expect(() =>
+    expectMap(
+      missingTie,
+      new Map([
+        [1, 3],
+        [-1, 3],
+      ]),
+      `ascending`,
+    ),
+  ).toThrow()
+  const stale = new SortedMap<number, Row>()
+  stale.set(1, { rank: 3 })
+  expect(() => expectMap(stale, new Map([[1, 2]]), `key`)).toThrow()
+  // Without the order promise, a view may reorder keys but must hold each
+  // key once with its current value.
+  const expected: Array<[ModelKey, number]> = [
+    [1, 3],
+    [2, 3],
+  ]
+  expect(() =>
+    expectView(
+      [
+        [2, 3],
+        [1, 3],
+      ],
+      expected,
+      false,
+    ),
+  ).not.toThrow()
+  expect(() =>
+    expectView(
+      [
+        [1, 3],
+        [1, 3],
+      ],
+      expected,
+      false,
+    ),
+  ).toThrow()
+  expect(() => expectView([[1, 3]], expected, false)).toThrow()
+})
diff --git a/packages/db/tests/btree-map-oracle.test.ts b/packages/db/tests/btree-map-oracle.test.ts
index 80a78cb6f5..fa9a81435a 100644
--- a/packages/db/tests/btree-map-oracle.test.ts
+++ b/packages/db/tests/btree-map-oracle.test.ts
@@ -6,6 +6,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 
 /**
  * # When does the B+ tree behave like a sorted Map?
@@ -280,6 +281,8 @@ function expectRefinement(
   expectPair(tree.nextLowerPair(undefined), sorted[sorted.length - 1], model)
 }
 
+declareOracle({ check: [expectRefinement], model: [stepModel] })
+
 describe(`BTree Map oracle`, () => {
   // The 120,000-operation corpus takes about nine seconds with CI coverage.
   // This fixed lane is a stable depth campaign, not random discovery. Keep
diff --git a/packages/db/tests/change-event-history-fixture.ts b/packages/db/tests/change-event-history-fixture.ts
new file mode 100644
index 0000000000..a45ace2bde
--- /dev/null
+++ b/packages/db/tests/change-event-history-fixture.ts
@@ -0,0 +1,99 @@
+// Shared history grammar for the change-event history oracle and its
+// ordinary grammar-coverage test. The oracle owns the mirror law; this module
+// only enumerates the legal histories that the law runs.
+
+export interface TestItem extends Record<string, unknown> {
+  id: number
+  name: string
+  fileId: `f1` | `f2`
+}
+
+export type OpKind = `insert` | `update` | `delete`
+
+export type Key = 1 | 2 | 3 | 4
+
+export const fileIdForKey = (key: number): TestItem[`fileId`] =>
+  key % 2 === 1 ? `f1` : `f2`
+
+export interface Op {
+  kind: OpKind
+  key: Key
+  step: number
+}
+
+/**
+ * Every sequence the keyed-presence model permits up to `maxLength`.
+ */
+export function generateSequences(
+  maxLength: number,
+  keys: ReadonlyArray<Key>,
+  sequence: ReadonlyArray<Op> = [],
+  present: ReadonlySet<Key> = new Set(),
+): Array<Array<Op>> {
+  return keys.flatMap((key) => {
+    const kinds: ReadonlyArray<OpKind> = present.has(key)
+      ? [`update`, `delete`]
+      : [`insert`]
+    return kinds.flatMap((kind) => {
+      const next = [...sequence, { kind, key, step: sequence.length + 1 }]
+      const nextPresent = new Set(present)
+      if (kind === `delete`) nextPresent.delete(key)
+      else nextPresent.add(key)
+      const rest =
+        next.length < maxLength
+          ? generateSequences(maxLength, keys, next, nextPresent)
+          : []
+      return [next, ...rest]
+    })
+  })
+}
+
+export const describeSequence = (sequence: ReadonlyArray<Op>): string =>
+  sequence.map((op) => `${op.kind}(${op.key},${op.step})`).join(` -> `)
+export function mirrorRows(
+  mirror: ReadonlyMap<number, TestItem>,
+): Array<readonly [number, TestItem]> {
+  return [...mirror]
+    .map(
+      ([key, row]) =>
+        [key, { id: row.id, name: row.name, fileId: row.fileId }] as const,
+    )
+    .sort(([left], [right]) => left - right)
+}
+
+export const replacement: ReadonlyArray<Op> = [
+  { kind: `delete`, key: 1, step: 1 },
+  { kind: `delete`, key: 2, step: 2 },
+  { kind: `insert`, key: 1, step: 3 },
+  { kind: `insert`, key: 2, step: 4 },
+]
+export const oneKeyCases = generateSequences(4, [1]).flatMap(
+  (sequence, index) =>
+    ([`batched`, `sequential`] as const).map((mode) => ({
+      mode,
+      sequence,
+      initialKeys: [] as ReadonlyArray<Key>,
+      label: describeSequence(sequence),
+      id: `one-key-${mode}-${index}`,
+    })),
+)
+export const initialPresence: ReadonlyArray<ReadonlyArray<Key>> = [
+  [],
+  [1],
+  [2],
+  [1, 2],
+]
+export const twoKeyCases = initialPresence.flatMap(
+  (initialKeys, initialIndex) =>
+    generateSequences(3, [1, 2], [], new Set(initialKeys)).flatMap(
+      (sequence, index) =>
+        ([`batched`, `sequential`] as const).map((mode) => ({
+          mode,
+          sequence,
+          initialKeys,
+          label: describeSequence(sequence),
+          id: `two-key-${initialIndex}-${mode}-${index}`,
+        })),
+    ),
+)
+export const cases = [...oneKeyCases, ...twoKeyCases]
diff --git a/packages/db/tests/change-event-history-oracle.test.ts b/packages/db/tests/change-event-history-oracle.test.ts
index 6ca04ced01..da1445116a 100644
--- a/packages/db/tests/change-event-history-oracle.test.ts
+++ b/packages/db/tests/change-event-history-oracle.test.ts
@@ -11,7 +11,21 @@ import {
 import { localOnlyCollectionOptions } from '../src/local-only'
 import { PropRef } from '../src/query/ir'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config'
+import { declareOracle } from './oracle-declaration'
 import { captureCreatedTransactions } from './utils'
+import {
+  cases,
+  describeSequence,
+  fileIdForKey,
+  mirrorRows,
+  replacement,
+} from './change-event-history-fixture.js'
+import type {
+  Key,
+  Op,
+  OpKind,
+  TestItem,
+} from './change-event-history-fixture.js'
 import type { LocalOnlyCollectionUtils } from '../src/local-only'
 import type { Collection } from '../src/index'
 import type { BaseIndex } from '../src/indexes/base-index'
@@ -73,14 +87,6 @@ import type { ChangeMessage, SyncConfig } from '../src/types'
  * cancellation histories.
  */
 
-interface TestItem extends Record<string, unknown> {
-  id: number
-  name: string
-  fileId: `f1` | `f2`
-}
-
-type OpKind = `insert` | `update` | `delete`
-type Key = 1 | 2 | 3 | 4
 type IndexType = typeof BasicIndex | typeof BTreeIndex
 type SyncActions = Parameters<SyncConfig<TestItem, number>[`sync`]>[0]
 
@@ -90,15 +96,6 @@ type EventProjection = {
   previousValue?: TestItem
 }
 
-const fileIdForKey = (key: number): TestItem[`fileId`] =>
-  key % 2 === 1 ? `f1` : `f2`
-
-interface Op {
-  kind: OpKind
-  key: Key
-  step: number
-}
-
 type GeneratedHistory = {
   initialKeys: ReadonlyArray<Key>
   sequence: ReadonlyArray<Op>
@@ -129,36 +126,6 @@ function opsFromPresence(
   })
 }
 
-/**
- * Every sequence the keyed-presence model permits up to `maxLength`.
- */
-function generateSequences(
-  maxLength: number,
-  keys: ReadonlyArray<Key>,
-  sequence: ReadonlyArray<Op> = [],
-  present: ReadonlySet<Key> = new Set(),
-): Array<Array<Op>> {
-  return keys.flatMap((key) => {
-    const kinds: ReadonlyArray<OpKind> = present.has(key)
-      ? [`update`, `delete`]
-      : [`insert`]
-    return kinds.flatMap((kind) => {
-      const next = [...sequence, { kind, key, step: sequence.length + 1 }]
-      const nextPresent = new Set(present)
-      if (kind === `delete`) nextPresent.delete(key)
-      else nextPresent.add(key)
-      const rest =
-        next.length < maxLength
-          ? generateSequences(maxLength, keys, next, nextPresent)
-          : []
-      return [next, ...rest]
-    })
-  })
-}
-
-const describeSequence = (sequence: ReadonlyArray<Op>): string =>
-  sequence.map((op) => `${op.kind}(${op.key},${op.step})`).join(` -> `)
-
 function applyModelOp(rows: Map<number, TestItem>, op: Op): void {
   if (op.kind === `delete`) rows.delete(op.key)
   else
@@ -273,17 +240,6 @@ function publicRows(
     .sort(([left], [right]) => left - right)
 }
 
-function mirrorRows(
-  mirror: ReadonlyMap<number, TestItem>,
-): Array<readonly [number, TestItem]> {
-  return [...mirror]
-    .map(
-      ([key, row]) =>
-        [key, { id: row.id, name: row.name, fileId: row.fileId }] as const,
-    )
-    .sort(([left], [right]) => left - right)
-}
-
 function assertFinalAgreement(
   collection: Collection<TestItem, number, LocalOnlyCollectionUtils>,
   mirror: ReadonlyMap<number, TestItem>,
@@ -600,6 +556,43 @@ async function verifyGeneratedHistory({
   )
 }
 
+interface DurationRow extends Record<string, unknown> {
+  id: number
+  duration: Temporal.Duration
+}
+
+// The model's expected field values, and the public observations that must
+// agree with them. Two Durations with the same display text but different
+// intrinsic fields must reach the row, the change message, and the mirror.
+function expectDurationFieldPublication(
+  expected: ReadonlyMap<number, DurationRow>,
+  state: ReadonlyMap<number, DurationRow>,
+  received: ReadonlyArray<ChangeMessage<DurationRow, number>>,
+  mirror: ReadonlyMap<number, DurationRow>,
+): void {
+  const expectedFields = [0, 1000]
+  const fields = (row: DurationRow | undefined) => [
+    row?.duration.seconds,
+    row?.duration.milliseconds,
+  ]
+  expect(fields(expected.get(1))).toEqual(expectedFields)
+  expect(fields(state.get(1))).toEqual(expectedFields)
+  expect(received.map((message) => message.type)).toEqual([`update`])
+  expect(fields(received[0]?.previousValue)).toEqual([1, 0])
+  expect(fields(received[0]?.value)).toEqual(expectedFields)
+  expect(fields(mirror.get(1))).toEqual(expectedFields)
+}
+
+declareOracle({
+  check: [
+    assertFinalAgreement,
+    assertIndexAgreement,
+    runHistory,
+    expectDurationFieldPublication,
+  ],
+  model: [applyModelOp, expectedRowsAfter, expectedEventTrace],
+})
+
 describe(`change-event history oracle`, () => {
   // Published #1519 keeps equivalent Duration forms distinct for query `eq`.
   // Under #1901's change-message reconstruction law, a source replacement
@@ -611,10 +604,6 @@ describe(`change-event history oracle`, () => {
   // This witness covers ordinary same-realm Durations, not altered objects or
   // a requirement to suppress events for a separately allocated equal copy.
   it(`publishes a Duration field change to the Collection and change-message consumer`, async () => {
-    interface DurationRow extends Record<string, unknown> {
-      id: number
-      duration: Temporal.Duration
-    }
     let sync!: Parameters<SyncConfig<DurationRow, number>[`sync`]>[0]
     const collection = createCollection<DurationRow, number>({
       id: `duration-field-change-history`,
@@ -665,17 +654,12 @@ describe(`change-event history oracle`, () => {
           sync.write({ type: `update`, value: second })
           expect(sync.commit()).toBe(true)
 
-          const expectedFields = [0, 1000]
-          const fields = (row: DurationRow | undefined) => [
-            row?.duration.seconds,
-            row?.duration.milliseconds,
-          ]
-          expect(fields(expected.get(1))).toEqual(expectedFields)
-          expect(fields(collection.state.get(1))).toEqual(expectedFields)
-          expect(received.map((message) => message.type)).toEqual([`update`])
-          expect(fields(received[0]?.previousValue)).toEqual([1, 0])
-          expect(fields(received[0]?.value)).toEqual(expectedFields)
-          expect(fields(mirror.get(1))).toEqual(expectedFields)
+          expectDurationFieldPublication(
+            expected,
+            collection.state,
+            received,
+            mirror,
+          )
         } finally {
           subscription.unsubscribe()
         }
@@ -779,40 +763,6 @@ describe(`change-event history oracle`, () => {
     [`BasicIndex`, BasicIndex],
     [`BTreeIndex`, BTreeIndex],
   ]
-  const replacement: ReadonlyArray<Op> = [
-    { kind: `delete`, key: 1, step: 1 },
-    { kind: `delete`, key: 2, step: 2 },
-    { kind: `insert`, key: 1, step: 3 },
-    { kind: `insert`, key: 2, step: 4 },
-  ]
-  const oneKeyCases = generateSequences(4, [1]).flatMap((sequence, index) =>
-    ([`batched`, `sequential`] as const).map((mode) => ({
-      mode,
-      sequence,
-      initialKeys: [] as ReadonlyArray<Key>,
-      label: describeSequence(sequence),
-      id: `one-key-${mode}-${index}`,
-    })),
-  )
-  const initialPresence: ReadonlyArray<ReadonlyArray<Key>> = [
-    [],
-    [1],
-    [2],
-    [1, 2],
-  ]
-  const twoKeyCases = initialPresence.flatMap((initialKeys, initialIndex) =>
-    generateSequences(3, [1, 2], [], new Set(initialKeys)).flatMap(
-      (sequence, index) =>
-        ([`batched`, `sequential`] as const).map((mode) => ({
-          mode,
-          sequence,
-          initialKeys,
-          label: describeSequence(sequence),
-          id: `two-key-${initialIndex}-${mode}-${index}`,
-        })),
-    ),
-  )
-  const cases = [...oneKeyCases, ...twoKeyCases]
 
   const generatedHistory = fc
     .record({
@@ -853,39 +803,6 @@ describe(`change-event history oracle`, () => {
       return { initialKeys: [1, 2], sequence: [...replacement, ...tail], mode }
     })
 
-  it(`reaches reinsertion and rejects missing or extra mirrored rows`, () => {
-    const witness: Array<Op> = [
-      { kind: `insert`, key: 1, step: 1 },
-      { kind: `delete`, key: 1, step: 2 },
-      { kind: `insert`, key: 1, step: 3 },
-    ]
-    expect(generateSequences(4, [1])).toContainEqual(witness)
-    expect(oneKeyCases).toHaveLength(22)
-    expect(twoKeyCases).toHaveLength(344)
-    expect(generateSequences(3, [1, 2], [], new Set<Key>([1]))).toContainEqual([
-      { kind: `update`, key: 1, step: 1 },
-      { kind: `insert`, key: 2, step: 2 },
-      { kind: `delete`, key: 1, step: 3 },
-    ])
-    expect(
-      generateSequences(3, [1, 2], [], new Set<Key>([1])),
-    ).not.toContainEqual([{ kind: `insert`, key: 1, step: 1 }])
-    expect(new Set(cases.map(({ id }) => id)).size).toBe(cases.length)
-    const expected = [[1, { id: 1, name: `v3`, fileId: `f1` }]]
-    expect(mirrorRows(new Map())).not.toEqual(expected)
-    expect(
-      mirrorRows(new Map([[1, { id: 1, name: `wrong`, fileId: `f1` }]])),
-    ).not.toEqual(expected)
-    expect(
-      mirrorRows(
-        new Map([
-          [1, { id: 1, name: `v3`, fileId: `f1` }],
-          [2, { id: 2, name: `ghost`, fileId: `f2` }],
-        ]),
-      ),
-    ).not.toEqual(expected)
-  })
-
   it(`rejects a deferred message with the right name but wrong row fields`, () => {
     const sequence: Array<Op> = [
       { kind: `insert`, key: 1, step: 1 },
diff --git a/packages/db/tests/change-event-history.test.ts b/packages/db/tests/change-event-history.test.ts
new file mode 100644
index 0000000000..876b3d12c9
--- /dev/null
+++ b/packages/db/tests/change-event-history.test.ts
@@ -0,0 +1,50 @@
+/**
+ * Ordinary grammar and checker-projection tests for the change-event history
+ * oracle. The mirror law is owned by change-event-history-oracle.test.ts,
+ * which runs the generated histories through its check.
+ */
+
+import { describe, expect, it } from 'vitest'
+import {
+  cases,
+  generateSequences,
+  mirrorRows,
+  oneKeyCases,
+  twoKeyCases,
+} from './change-event-history-fixture.js'
+import type { Key, Op } from './change-event-history-fixture.js'
+
+describe(`change-event history oracle`, () => {
+  it(`reaches reinsertion and rejects missing or extra mirrored rows`, () => {
+    const witness: Array<Op> = [
+      { kind: `insert`, key: 1, step: 1 },
+      { kind: `delete`, key: 1, step: 2 },
+      { kind: `insert`, key: 1, step: 3 },
+    ]
+    expect(generateSequences(4, [1])).toContainEqual(witness)
+    expect(oneKeyCases).toHaveLength(22)
+    expect(twoKeyCases).toHaveLength(344)
+    expect(generateSequences(3, [1, 2], [], new Set<Key>([1]))).toContainEqual([
+      { kind: `update`, key: 1, step: 1 },
+      { kind: `insert`, key: 2, step: 2 },
+      { kind: `delete`, key: 1, step: 3 },
+    ])
+    expect(
+      generateSequences(3, [1, 2], [], new Set<Key>([1])),
+    ).not.toContainEqual([{ kind: `insert`, key: 1, step: 1 }])
+    expect(new Set(cases.map(({ id }) => id)).size).toBe(cases.length)
+    const expected = [[1, { id: 1, name: `v3`, fileId: `f1` }]]
+    expect(mirrorRows(new Map())).not.toEqual(expected)
+    expect(
+      mirrorRows(new Map([[1, { id: 1, name: `wrong`, fileId: `f1` }]])),
+    ).not.toEqual(expected)
+    expect(
+      mirrorRows(
+        new Map([
+          [1, { id: 1, name: `v3`, fileId: `f1` }],
+          [2, { id: 2, name: `ghost`, fileId: `f2` }],
+        ]),
+      ),
+    ).not.toEqual(expected)
+  })
+})
diff --git a/packages/db/tests/cleanup-queue-oracle.property.test.ts b/packages/db/tests/cleanup-queue-oracle.property.test.ts
index 690e98d463..834280bf1d 100644
--- a/packages/db/tests/cleanup-queue-oracle.property.test.ts
+++ b/packages/db/tests/cleanup-queue-oracle.property.test.ts
@@ -2,6 +2,7 @@ import fc from 'fast-check'
 import { expect, it, vi } from 'vitest'
 import { CleanupQueue } from '../src/collection/cleanup-queue'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config'
+import { declareOracle } from './oracle-declaration'
 import { resetCleanupQueue } from './utils'
 
 /**
@@ -102,6 +103,29 @@ function stepModel(model: Model, id: number, action: Action): Model {
 // Callbacks in this model do not schedule or cancel other callbacks. Reentrant
 // callbacks need a separate contract. They must not inherit current Map-loop
 // behavior by accident.
+// The check: deliveries and reported task errors match the model at this cut.
+// Deliveries compare as a set, by id, so their publication order is not judged.
+function expectQueueState(
+  actual: ReadonlyArray<Delivery>,
+  model: Model,
+  errorCalls: ReadonlyArray<ReadonlyArray<unknown>>,
+): void {
+  const canonical = (rows: ReadonlyArray<Delivery>) =>
+    [...rows].sort((a, b) => a.id - b.id)
+  expect(canonical(actual)).toEqual(canonical(model.deliveries))
+  expect(
+    errorCalls
+      .map(([label, error]) => {
+        expect(label).toBe(`Error in CleanupQueue task:`)
+        expect(error).toBeInstanceOf(Error)
+        return (error as Error).message
+      })
+      .sort(),
+  ).toEqual([...model.errors].sort())
+}
+
+declareOracle({ check: [expectQueueState], model: [stepModel] })
+
 async function runHistory(actions: Array<Action>, fault: Fault = `none`) {
   vi.useFakeTimers()
   vi.setSystemTime(0)
@@ -119,20 +143,7 @@ async function runHistory(actions: Array<Action>, fault: Fault = `none`) {
     deliveries: [],
     errors: [],
   }
-  const canonical = (rows: Array<Delivery>) =>
-    [...rows].sort((a, b) => a.id - b.id)
-  const check = () => {
-    expect(canonical(actual)).toEqual(canonical(model.deliveries))
-    expect(
-      errors.mock.calls
-        .map(([label, error]) => {
-          expect(label).toBe(`Error in CleanupQueue task:`)
-          expect(error).toBeInstanceOf(Error)
-          return (error as Error).message
-        })
-        .sort(),
-    ).toEqual([...model.errors].sort())
-  }
+  const check = () => expectQueueState(actual, model, errors.mock.calls)
   const advance = async (elapsed: number) => {
     await Promise.resolve() // Admit the whole synchronous registration batch.
     expect(vi.getTimerCount()).toBeLessThanOrEqual(1)
diff --git a/packages/db/tests/collection-cleanup-restart-oracle.test.ts b/packages/db/tests/collection-cleanup-restart-oracle.test.ts
index 171321b610..9dfd145f60 100644
--- a/packages/db/tests/collection-cleanup-restart-oracle.test.ts
+++ b/packages/db/tests/collection-cleanup-restart-oracle.test.ts
@@ -5,14 +5,21 @@ import {
   createEffect,
   createLiveQueryCollection,
   eq,
-  withCollectionSyncConfigCleanup,
 } from '../src'
 import { createDeferred } from '../src/deferred'
 import { Query } from '../src/query/builder/index.js'
 import { createPooledLiveQuery } from '../src/query/pooled-live-query.js'
+import { declareOracle } from './oracle-declaration.js'
 import { createOracleReach } from './oracle-reach.js'
 import { flushPromises } from './utils'
-import type { CollectionDependent, SyncConfig } from '../src/types'
+import {
+  cleanupError,
+  completedBoundaryScenarios,
+  reentryScenarios,
+  withOracleCleanup,
+} from './collection-cleanup-restart-support.js'
+import type { CollectionDependent } from '../src/types'
+import type { Row } from './collection-cleanup-restart-support.js'
 
 /**
  * # When does cleanup become observable?
@@ -90,12 +97,6 @@ import type { CollectionDependent, SyncConfig } from '../src/types'
  * shutdown, persistence-wrapper behavior, or general row-publication laws.
  */
 
-type Row = { id: number; rank: number }
-const cleanupError = {
-  name: `CollectionStateError`,
-  message: expect.stringContaining(`after cleanup() completes`),
-}
-
 type CleanupBoundary =
   `cleanup-start` | `terminal-publication` | `cleanup-settlement`
 type CleanupBoundaryObservation<TStatus extends string> = {
@@ -152,26 +153,6 @@ function observeDependent(active: boolean): `active` | `terminal` {
   return active ? `active` : `terminal`
 }
 
-const reentryScenarios = ([`abort`, `release`] as const).flatMap((boundary) =>
-  [false, true].flatMap((nestedCleanup) =>
-    [1, 2].map((attempts) => ({
-      id: `${boundary}:${nestedCleanup ? `nested` : `plain`}:${attempts}`,
-      boundary,
-      nestedCleanup,
-      attempts,
-    })),
-  ),
-)
-
-const completedBoundaryScenarios = ([`event`, `await`] as const).flatMap(
-  (boundary) =>
-    [false, true].map((liveQuery) => ({
-      id: `${boundary}:${liveQuery ? `live-query` : `source`}`,
-      boundary,
-      liveQuery,
-    })),
-)
-
 function expectExactCaseIds(
   actual: ReadonlyArray<{ id: string }>,
   expected: ReadonlyArray<string>,
@@ -181,62 +162,6 @@ function expectExactCaseIds(
   expect(new Set(ids).size).toBe(ids.length)
 }
 
-async function withOracleCleanup<T>(
-  body: () => T | Promise<T>,
-  cleanups: Array<() => void | Promise<unknown>>,
-): Promise<T> {
-  let value: T | undefined
-  const failures: Array<unknown> = []
-  try {
-    value = await body()
-  } catch (error) {
-    failures.push(error)
-  }
-  for (const cleanup of cleanups) {
-    try {
-      await cleanup()
-    } catch (error) {
-      failures.push(error)
-    }
-  }
-  if (failures.length === 1) throw failures[0]
-  if (failures.length > 1) {
-    throw new AggregateError(failures, `Cleanup oracle and teardown failed`, {
-      cause: failures[0],
-    })
-  }
-  return value as T
-}
-
-describe(`Collection cleanup oracle calibration`, () => {
-  it(`retains a primary mismatch and every teardown failure`, async () => {
-    const primary = new Error(`oracle mismatch`)
-    const firstCleanup = new Error(`first cleanup failed`)
-    const secondCleanup = new Error(`second cleanup failed`)
-    const attempts: Array<string> = []
-
-    const failure = await withOracleCleanup(() => {
-      throw primary
-    }, [
-      () => {
-        attempts.push(`first`)
-        throw firstCleanup
-      },
-      () => {
-        attempts.push(`second`)
-        return Promise.reject(secondCleanup)
-      },
-    ]).catch((error: unknown) => error)
-
-    expect(attempts).toEqual([`first`, `second`])
-    expect(failure).toBeInstanceOf(AggregateError)
-    expect(failure).toMatchObject({
-      cause: primary,
-      errors: [primary, firstCleanup, secondCleanup],
-    })
-  })
-})
-
 /**
  * ## Cleanup with failing dependents
  *
@@ -365,6 +290,16 @@ function expectedDependentCleanup(
   }
 }
 
+// Declared after the dependents grammar, whose cells are a const.
+declareOracle({
+  model: [expectedCleanupBoundary, expectedDependentCleanup],
+  grammar: [
+    reentryScenarios,
+    completedBoundaryScenarios,
+    dependentCleanupCells,
+  ],
+})
+
 const dependentCleanupReachStates = [
   `dependent-end-threw`,
   `dependent-failed-while-adapter-held`,
@@ -621,242 +556,6 @@ describe(`Collection cleanup with failing dependents oracle`, () => {
 })
 
 describe(`Collection cleanup admission oracle`, () => {
-  it(`refuses cleanup while a live query or Effect reads it, and ends dependents first on request`, async () => {
-    let starts = 0
-    let ops!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: (params) => {
-          ops = params
-          starts++
-          params.begin()
-          params.write({ type: `insert`, value: { id: starts, rank: starts } })
-          params.commit()
-          params.markReady()
-        },
-      },
-    })
-    const inner = createLiveQueryCollection((q) => q.from({ row: source }))
-    const outer = createLiveQueryCollection((q) => q.from({ row: inner }))
-    const effect = createEffect({
-      query: (q) => q.from({ row: source }),
-      onBatch: () => {},
-    })
-    const received: Array<number> = []
-    const direct = source.subscribeChanges((changes) => {
-      for (const change of changes) received.push(change.key)
-    })
-    try {
-      await outer.preload()
-      // Model: three readers of the source, one of each kind; the outer query
-      // reads the inner one, not the source.
-      expect(source.subscribers.map(({ kind }) => kind).sort()).toEqual([
-        `effect`,
-        `live-query`,
-        `subscription`,
-      ])
-      expect(
-        source.subscribers.find(({ kind }) => kind === `live-query`)
-          ?.collection,
-      ).toBe(inner)
-      expect(inner.subscribers.map(({ collection }) => collection)).toEqual([
-        outer,
-      ])
-
-      // A plain cleanup refuses and changes nothing.
-      await expect(source.cleanup()).rejects.toThrow(/dependent/)
-      expect([source.status, inner.status, outer.status]).toEqual([
-        `ready`,
-        `ready`,
-        `ready`,
-      ])
-      expect(effect.disposed).toBe(false)
-
-      // With its dependents, cleanup ends the query chain and the Effect
-      // first. The direct subscription survives into the next sync run.
-      await source.cleanup({ dependents: true })
-      expect([source.status, inner.status, outer.status]).toEqual([
-        `cleaned-up`,
-        `cleaned-up`,
-        `cleaned-up`,
-      ])
-      expect(effect.disposed).toBe(true)
-      expect(source.subscribers.map(({ kind }) => kind)).toEqual([
-        `subscription`,
-      ])
-      received.length = 0
-      source.startSyncImmediate()
-      expect(starts).toBe(2)
-      ops.begin()
-      ops.write({ type: `insert`, value: { id: 9, rank: 9 } })
-      ops.commit()
-      expect(received).toContain(9)
-      // Only direct subscriptions and an idle live query remain. Nothing
-      // reads the idle query, so a plain cleanup is admitted; the idle query
-      // ends at cleanup start, as a query under internal teardown does.
-      const idle = createLiveQueryCollection((q) => q.from({ row: source }))
-      await idle.preload()
-      expect(
-        source.subscribers.find(({ collection }) => collection === idle)
-          ?.active,
-      ).toBe(false)
-      await source.cleanup()
-      expect(source.status).toBe(`cleaned-up`)
-      expect(idle.status).toBe(`crashed`)
-    } finally {
-      direct.unsubscribe()
-      await outer.cleanup({ dependents: true })
-      await effect.dispose()
-      await source.cleanup({ dependents: true })
-    }
-  })
-
-  // Logical demand is distinct from a request to start a sync run. Cleanup
-  // rejects the latter, including resumption, while a deferred subscription
-  // may retain demand without starting even a live-query Collection's run.
-  // Idle and cleaned-up sources distinguish this law from checking only ready
-  // Collections. The callback is the synchronous cleanup-start observation cut.
-  it.each(
-    ([`plain`, `live-query`] as const).flatMap((kind) =>
-      ([`idle`, `ready`, `cleaned-up`] as const).map((priorStatus) => ({
-        kind,
-        priorStatus,
-      })),
-    ),
-  )(
-    `retains deferred demand during $priorStatus $kind cleanup`,
-    async ({ kind, priorStatus }) => {
-      let starts = 0
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({ markReady }) => {
-            starts++
-            markReady()
-          },
-        },
-      })
-      const live = createLiveQueryCollection({
-        query: (q) => q.from({ row: source }),
-        gcTime: 0,
-      })
-      const collection = kind === `plain` ? source : live
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let reached = false
-      if (priorStatus === `ready`) {
-        source.startSyncImmediate()
-        collection.startSyncImmediate()
-      } else if (priorStatus === `cleaned-up`) {
-        await collection.cleanup()
-      }
-      const before = starts
-      const stop = collection._onCleanupStart(() => {
-        reached = true
-        expect(() => collection.subscribeChanges(() => {})).toThrow(
-          expect.objectContaining(cleanupError),
-        )
-        subscription = collection.subscribeChanges(() => {}, {
-          deferAcquisition: true,
-          includeInitialState: true,
-        })
-        expect(subscription.isDeferringAcquisition()).toBe(true)
-        expect(() => subscription!.resumeDeferredAcquisition()).toThrow(
-          expect.objectContaining(cleanupError),
-        )
-        expect(collection.subscriberCount).toBe(0)
-        expect(starts).toBe(before)
-      })
-      await withOracleCleanup(async () => {
-        await collection.cleanup()
-        expect(reached).toBe(true)
-        expect(subscription).toBeDefined()
-        expect(starts).toBe(before)
-        stop()
-        subscription!.resumeDeferredAcquisition()
-        for (let turn = 0; turn < 10; turn++) await Promise.resolve()
-        expect(collection.status).toBe(`ready`)
-        expect(collection.subscriberCount).toBe(1)
-      }, [
-        stop,
-        () => subscription?.unsubscribe(),
-        () => live.cleanup(),
-        () => source.cleanup(),
-      ])
-    },
-  )
-
-  // Promise ownership changes only when a replacement run actually starts.
-  // A validation failure or a still-deferred start cannot create a second
-  // retirement. Successful admission is the neighboring case: its new run
-  // must have a distinct cleanup promise even before the old one settles.
-  it.each([
-    `none`,
-    `deferred-start`,
-    `listener-failure`,
-    `subscribe`,
-    `resume`,
-    `preload`,
-  ] as const)(
-    `preserves retirement identity through %s admission`,
-    async (admission) => {
-      let starts = 0
-      let cleanups = 0
-      const collection = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({ markReady }) => {
-            starts++
-            markReady()
-            return () => {
-              cleanups++
-            }
-          },
-        },
-      })
-      collection.startSyncImmediate()
-      const first = collection.cleanup()
-      const failure = new Error(`demand failed before replacement startup`)
-      let stop = () => {}
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let preload: Promise<void> | undefined
-      await withOracleCleanup(async () => {
-        if (admission === `listener-failure`) {
-          stop = collection[`_changes`].onFirstSubscriberOrPreload(() => {
-            throw failure
-          })
-          expect(() => collection.subscribeChanges(() => {})).toThrow(failure)
-        } else if (admission === `deferred-start`) {
-          collection._deferSyncStart()
-          collection.startSyncImmediate()
-        } else if (admission === `subscribe`) {
-          subscription = collection.subscribeChanges(() => {})
-        } else if (admission === `resume`) {
-          subscription = collection.subscribeChanges(() => {}, {
-            deferAcquisition: true,
-          })
-          subscription.resumeDeferredAcquisition()
-        } else if (admission === `preload`) preload = collection.preload()
-        const replacement = [`subscribe`, `resume`, `preload`].includes(
-          admission,
-        )
-        const second = collection.cleanup()
-        expect(second === first).toBe(!replacement)
-        expect(starts).toBe(replacement ? 2 : 1)
-        expect(cleanups).toBe(starts)
-        await Promise.all([first, second, preload])
-      }, [
-        () => stop(),
-        () => subscription?.unsubscribe(),
-        () => collection.cleanup(),
-      ])
-    },
-  )
-
   // These paths share the three-cut model above. The held adapter promise
   // reaches cleanup start without confusing the retained public status with
   // permission to start another sync run. No automatic retry is requested.
@@ -999,47 +698,6 @@ describe(`Collection cleanup admission oracle`, () => {
     ])
   })
 
-  it(`awaits a structural thenable returned from contextual-void cleanup`, async () => {
-    const cleanupGate = createDeferred<void>()
-    let cleanupCalls = 0
-    const thenable = {
-      then: cleanupGate.promise.then.bind(cleanupGate.promise),
-    }
-    const cleanup: () => void = () => {
-      cleanupCalls++
-      return thenable
-    }
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return cleanup
-        },
-      },
-    })
-
-    await withOracleCleanup(async () => {
-      await collection.preload()
-      let settled = false
-      const retirement = collection.cleanup().then(() => {
-        settled = true
-      })
-
-      expect(cleanupCalls).toBe(1)
-      expect(collection.status).toBe(`ready`)
-      expect(() => collection.startSyncImmediate()).toThrowError(
-        expect.objectContaining(cleanupError),
-      )
-      await Promise.resolve()
-      expect(settled).toBe(false)
-
-      cleanupGate.resolve()
-      await retirement
-      expect(collection.status).toBe(`cleaned-up`)
-    }, [() => cleanupGate.resolve(), () => collection.cleanup()])
-  })
-
   it(`waits for source cleanup before publishing the restart boundary`, async () => {
     const cleanupGate = createDeferred<void>()
     let starts = 0
@@ -1269,51 +927,6 @@ describe(`Collection cleanup admission oracle`, () => {
     }
   })
 
-  it(`crashes a live query once when internal teardown retires a source it reads under two aliases`, async () => {
-    const cleanupGate = createDeferred<void>()
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: 1, rank: 1 } })
-          commit()
-          markReady()
-          return { cleanup: () => cleanupGate.promise }
-        },
-      },
-    })
-    source.createIndex((row) => row.id, { indexType: BasicIndex })
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ left: source })
-        .join(
-          { right: source },
-          ({ left, right }) => eq(left.id, right.id),
-          `inner`,
-        ),
-    )
-    const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
-
-    try {
-      await live.preload()
-
-      // Internal teardown that bypasses admission crashes the query once.
-      const cleanup = source._lifecycle.cleanup()
-
-      expect(live.status).toBe(`crashed`)
-      expect(reports).toHaveBeenCalledTimes(1)
-
-      cleanupGate.resolve()
-      await cleanup
-    } finally {
-      cleanupGate.resolve()
-      reports.mockRestore()
-      await live.cleanup()
-      await source.cleanup()
-    }
-  })
-
   it(`disposes a dependent Effect when cleanup starts before terminal settlement`, async () => {
     const cleanupGate = createDeferred<void>()
     const handlerGate = createDeferred<void>()
@@ -1407,204 +1020,40 @@ describe(`Collection cleanup admission oracle`, () => {
     }
   })
 
-  it(`continues teardown when a cleanup-start observer throws`, async () => {
-    const cleanupGate = createDeferred<void>()
-    const observerError = new Error(`cleanup-start observer failed exactly`)
-    let starts = 0
-    let adapterCleanupStarted = 0
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          starts++
-          markReady()
-          return {
-            cleanup: () => {
-              adapterCleanupStarted++
-              return cleanupGate.promise
-            },
-          }
-        },
-      },
-    })
-    const off = source._onCleanupStart(() => {
-      throw observerError
-    })
-
-    try {
-      await source.preload()
-      const cleanupOutcome = source.cleanup().then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-
-      expect(adapterCleanupStarted).toBe(1)
-      expect(source.status).toBe(`ready`)
-
-      cleanupGate.resolve()
-      expect(await cleanupOutcome).toBe(observerError)
-      expect(source.status).toBe(`cleaned-up`)
-
-      off()
-      source.startSyncImmediate()
-      expect(starts).toBe(2)
-      expect(source.status).toBe(`ready`)
-    } finally {
-      off()
-      cleanupGate.resolve()
-      await source.cleanup().catch(() => undefined)
-    }
-  })
+  const lateEffectCases = ([`loading`, `ready`, `error`] as const).flatMap(
+    (priorStatus) =>
+      ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
+        ([`first`, `second`] as const).map((cleaningPosition) => ({
+          priorStatus,
+          syncMode,
+          cleaningPosition,
+        })),
+      ),
+  )
 
-  it(`keeps adapter cleanup failure primary when cleanup-start observer also fails`, async () => {
-    const cleanupGate = createDeferred<void>()
-    const observerError = new Error(`cleanup-start observer failed exactly`)
-    const adapterError = new Error(`adapter cleanup failed exactly`)
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            cleanup: () =>
-              cleanupGate.promise.then(() => {
-                throw adapterError
-              }),
-          }
-        },
-      },
-    })
-    const off = source._onCleanupStart(() => {
-      throw observerError
-    })
-
-    try {
-      await source.preload()
-      const cleanup = source.cleanup()
-
-      expect(source.status).toBe(`ready`)
-      cleanupGate.resolve()
-      const failure = await cleanup.catch((error: unknown) => error)
-
-      expect(failure).toBeInstanceOf(AggregateError)
-      const aggregate = failure as AggregateError
-      expect(aggregate.cause).toMatchObject({
-        name: `SyncCleanupError`,
-        cause: adapterError,
-      })
-      expect(aggregate.errors).toEqual([aggregate.cause, observerError])
-      expect(source.status).toBe(`cleaned-up`)
-    } finally {
-      off()
-      cleanupGate.resolve()
-      await source.cleanup().catch(() => undefined)
-    }
-  })
-
-  it(`retains every cleanup-start observer failure after adapter cleanup rejects`, async () => {
-    const cleanupGate = createDeferred<void>()
-    const firstObserverError = new Error(
-      `first cleanup-start observer failed exactly`,
-    )
-    const secondObserverError = new Error(
-      `second cleanup-start observer failed exactly`,
-    )
-    const adapterError = new Error(`adapter cleanup failed exactly`)
-    const observerCalls: Array<string> = []
-    let starts = 0
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          starts++
-          markReady()
-          return {
-            cleanup: () =>
-              cleanupGate.promise.then(() => {
-                throw adapterError
-              }),
-          }
-        },
-      },
-    })
-    const offFirst = source._onCleanupStart(() => {
-      observerCalls.push(`first`)
-      throw firstObserverError
-    })
-    const offSecond = source._onCleanupStart(() => {
-      observerCalls.push(`second`)
-      throw secondObserverError
-    })
-
-    try {
-      await source.preload()
-      const cleanup = source.cleanup()
-
-      expect(observerCalls).toEqual([`first`, `second`])
-      expect(source.status).toBe(`ready`)
-      cleanupGate.resolve()
-      const failure = await cleanup.catch((error: unknown) => error)
-
-      expect(failure).toBeInstanceOf(AggregateError)
-      const aggregate = failure as AggregateError
-      expect(aggregate.cause).toMatchObject({
-        name: `SyncCleanupError`,
-        cause: adapterError,
-      })
-      expect(aggregate.errors).toEqual([
-        aggregate.cause,
-        firstObserverError,
-        secondObserverError,
-      ])
-      expect(source.status).toBe(`cleaned-up`)
-
-      offFirst()
-      offSecond()
-      source.startSyncImmediate()
-      expect(starts).toBe(2)
-      expect(source.status).toBe(`ready`)
-    } finally {
-      offFirst()
-      offSecond()
-      cleanupGate.resolve()
-      await source.cleanup().catch(() => undefined)
-    }
-  })
-
-  const lateEffectCases = ([`loading`, `ready`, `error`] as const).flatMap(
-    (priorStatus) =>
-      ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
-        ([`first`, `second`] as const).map((cleaningPosition) => ({
-          priorStatus,
-          syncMode,
-          cleaningPosition,
-        })),
-      ),
-  )
-
-  // Effects must retire at cleanup start, including when construction reaches
-  // a source whose adapter cleanup is already pending. The same boundary model
-  // requires a terminal dependent without partial subscription ownership.
-  it.each(lateEffectCases)(
-    `releases a late Effect during $priorStatus $syncMode cleanup of its $cleaningPosition source`,
-    async ({ priorStatus, syncMode, cleaningPosition }) => {
-      const cleanupGate = createDeferred<void>()
-      let starts = 0
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        syncMode,
-        sync: {
-          sync: ({ markReady, fail }) => {
-            starts++
-            if (priorStatus === `ready` || starts > 1) markReady()
-            if (priorStatus === `error` && starts === 1) {
-              fail(new Error(`initial source error`))
-            }
-            return {
-              cleanup: () => cleanupGate.promise,
-              loadSubset: () => true,
-            }
-          },
+  // Effects must retire at cleanup start, including when construction reaches
+  // a source whose adapter cleanup is already pending. The same boundary model
+  // requires a terminal dependent without partial subscription ownership.
+  it.each(lateEffectCases)(
+    `releases a late Effect during $priorStatus $syncMode cleanup of its $cleaningPosition source`,
+    async ({ priorStatus, syncMode, cleaningPosition }) => {
+      const cleanupGate = createDeferred<void>()
+      let starts = 0
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        syncMode,
+        sync: {
+          sync: ({ markReady, fail }) => {
+            starts++
+            if (priorStatus === `ready` || starts > 1) markReady()
+            if (priorStatus === `error` && starts === 1) {
+              fail(new Error(`initial source error`))
+            }
+            return {
+              cleanup: () => cleanupGate.promise,
+              loadSubset: () => true,
+            }
+          },
         },
       })
       const healthySource = createCollection<Row, number>({
@@ -1687,789 +1136,4 @@ describe(`Collection cleanup admission oracle`, () => {
       expect(activeCleanupStartObservers).toBe(0)
     },
   )
-
-  it.each([`first`, `second`] as const)(
-    `does not acquire live-query source subscriptions during active cleanup: %s source`,
-    async (cleaningPosition) => {
-      const cleanupGate = createDeferred<void>()
-      const cleaningSource = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return { cleanup: () => cleanupGate.promise }
-          },
-        },
-      })
-      const healthySource = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        sync: { sync: ({ markReady }) => markReady() },
-      })
-      cleaningSource.createIndex((row) => row.id, { indexType: BasicIndex })
-      healthySource.createIndex((row) => row.id, { indexType: BasicIndex })
-      let live: ReturnType<typeof createLiveQueryCollection> | undefined
-      const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
-
-      try {
-        await cleaningSource.preload()
-        const cleaning = cleaningSource.cleanup()
-        expect(cleaningSource.status).toBe(`ready`)
-
-        const firstSource =
-          cleaningPosition === `first` ? cleaningSource : healthySource
-        const secondSource =
-          cleaningPosition === `second` ? cleaningSource : healthySource
-        live = createLiveQueryCollection((q) =>
-          q
-            .from({ first: firstSource })
-            .join(
-              { second: secondSource },
-              ({ first, second }) => eq(first.id, second.id),
-              `inner`,
-            ),
-        )
-        const message =
-          `Source collection '${cleaningSource.id}' was manually cleaned up while live query '${live.id}' depends on it. ` +
-          `Live queries prevent automatic GC, so this was likely a manual cleanup() call.`
-
-        await expect(live.preload()).rejects.toThrow(message)
-
-        expect(live.status).toBe(`crashed`)
-        expect({
-          cleaning: cleaningSource.subscriberCount,
-          healthy: healthySource.subscriberCount,
-        }).toEqual({ cleaning: 0, healthy: 0 })
-        expect(reports.mock.calls).toEqual([[`[Live Query Error] ${message}`]])
-
-        cleanupGate.resolve()
-        await cleaning
-      } finally {
-        cleanupGate.resolve()
-        reports.mockRestore()
-        await live?.cleanup()
-        await cleaningSource.cleanup()
-        await healthySource.cleanup()
-      }
-    },
-  )
-
-  it(`does not retain a late cleanup-start observer that throws`, async () => {
-    const cleanupGate = createDeferred<void>()
-    const observerError = new Error(
-      `late cleanup-start observer failed exactly`,
-    )
-    let observerCalls = 0
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return { cleanup: () => cleanupGate.promise }
-        },
-      },
-    })
-
-    try {
-      await source.preload()
-      const firstCleanup = source.cleanup()
-
-      expect(() =>
-        source._onCleanupStart(() => {
-          observerCalls++
-          throw observerError
-        }),
-      ).toThrow(observerError)
-
-      cleanupGate.resolve()
-      await firstCleanup
-      source.startSyncImmediate()
-      await expect(source.cleanup()).resolves.toBeUndefined()
-      expect(observerCalls).toBe(1)
-    } finally {
-      cleanupGate.resolve()
-      await source.cleanup().catch(() => undefined)
-    }
-  })
-
-  it(`notifies one observer once per cleanup boundary until it unsubscribes`, async () => {
-    let starts = 0
-    let observerCalls = 0
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          starts++
-          markReady()
-        },
-      },
-    })
-    const off = source._onCleanupStart(() => {
-      observerCalls++
-    })
-
-    try {
-      await source.preload()
-      const firstCleanup = source.cleanup()
-      expect(observerCalls).toBe(1)
-      await firstCleanup
-
-      source.startSyncImmediate()
-      const secondCleanup = source.cleanup()
-      expect(observerCalls).toBe(2)
-      await secondCleanup
-
-      off()
-      source.startSyncImmediate()
-      await source.cleanup()
-      expect({ starts, observerCalls }).toEqual({ starts: 3, observerCalls: 2 })
-    } finally {
-      off()
-      await source.cleanup()
-    }
-  })
-
-  it(`does not revive a cleaned-up live query when its source restarts`, async () => {
-    let starts = 0
-    const source = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          starts++
-          begin()
-          write({ type: `insert`, value: { id: 1, rank: starts } })
-          commit()
-          markReady()
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) => q.from({ row: source }))
-    const publications: Array<unknown> = []
-    const subscription = live.subscribeChanges((changes) => {
-      publications.push(changes)
-    })
-    const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
-
-    try {
-      await live.preload()
-      expect(live.get(1)?.rank).toBe(1)
-      publications.length = 0
-
-      // Cleanup refuses while the live query reads the source; with its
-      // dependents it cleans the live query up first.
-      await expect(source.cleanup()).rejects.toThrow(/dependent/)
-      await source.cleanup({ dependents: true })
-      expect(live.status).toBe(`cleaned-up`)
-
-      // Restarting the source does not revive the cleaned-up live query,
-      // and its surviving subscriber receives nothing from the new run.
-      source.startSyncImmediate()
-      expect(source.status).toBe(`ready`)
-      expect(starts).toBe(2)
-      expect(live.status).toBe(`cleaned-up`)
-      expect(publications).toEqual([])
-      expect(reports).not.toHaveBeenCalled()
-    } finally {
-      subscription.unsubscribe()
-      reports.mockRestore()
-      await live.cleanup()
-      await source.cleanup()
-    }
-  })
-
-  it.each([`eager`, `on-demand`] as const)(
-    `restarts a %s source that failed after ready, and its live query, through their own restarts`,
-    async (syncMode) => {
-      let sourceSync!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
-      let starts = 0
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        syncMode,
-        sync: {
-          sync: (methods) => {
-            sourceSync = methods
-            starts++
-            const writeRow = () => {
-              methods.begin()
-              methods.write({ type: `insert`, value: { id: 1, rank: starts } })
-              methods.commit()
-            }
-            if (syncMode === `eager`) writeRow()
-            methods.markReady()
-            if (syncMode === `on-demand`) {
-              return {
-                loadSubset: () => {
-                  writeRow()
-                  return true
-                },
-                unloadSubset: () => {},
-              }
-            }
-            return undefined
-          },
-        },
-      })
-      const live = createLiveQueryCollection((q) => q.from({ row: source }))
-      const observedRanks: Array<number | undefined> = []
-      const subscription = live.subscribeChanges(() => {
-        observedRanks.push(live.get(1)?.rank)
-      })
-      const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
-
-      try {
-        await live.preload()
-        expect(live.get(1)?.rank).toBe(1)
-
-        // After the first ready a source's fail() stops its sync: the
-        // status and rows stay, and the live query's health tree reports it.
-        sourceSync.fail(new Error(`source sync failed`))
-        expect(source.status).toBe(`ready`)
-        expect(source.health.error).toMatchObject({
-          message: `source sync failed`,
-        })
-        expect(live.status).toBe(`ready`)
-        expect(live.get(1)?.rank).toBe(1)
-        expect(live.health.sources[0]?.error).toBeTruthy()
-
-        // Only a new sync run clears the error.
-        await live.cleanup()
-        await source.cleanup()
-        await live.preload()
-        expect(source.health.hasErrors).toBe(false)
-        expect(live.health.hasErrors).toBe(false)
-
-        expect(starts).toBe(2)
-        expect(source.status).toBe(`ready`)
-        expect(live.status).toBe(`ready`)
-        expect(live.get(1)?.rank).toBe(2)
-
-        observedRanks.length = 0
-        sourceSync.begin()
-        sourceSync.write({ type: `update`, value: { id: 1, rank: 3 } })
-        sourceSync.commit()
-        expect(live.get(1)?.rank).toBe(3)
-        expect(observedRanks).toEqual([3])
-      } finally {
-        subscription.unsubscribe()
-        reports.mockRestore()
-        await live.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-
-  it(`treats an incidental contextual-void return as synchronous cleanup`, async () => {
-    let starts = 0
-    const released: Array<number> = []
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          starts++
-          markReady()
-          return () => released.push(starts)
-        },
-      },
-    })
-
-    try {
-      await collection.preload()
-
-      const cleanup = collection.cleanup()
-
-      expect(released).toEqual([1])
-      expect(collection.status).toBe(`cleaned-up`)
-      collection.startSyncImmediate()
-      expect(starts).toBe(2)
-      await cleanup
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`shares one retirement promise when cleanup finishes synchronously`, async () => {
-    let adapterCleanups = 0
-    let localCleanups = 0
-    const sync = withCollectionSyncConfigCleanup(
-      {
-        sync: ({ markReady }) => {
-          markReady()
-          return () => {
-            adapterCleanups++
-          }
-        },
-      } satisfies SyncConfig<Row, number>,
-      () => {
-        localCleanups++
-      },
-    )
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync,
-    })
-
-    try {
-      await collection.preload()
-      const first = collection.cleanup()
-      const concurrent = collection.cleanup()
-
-      expect({
-        samePromise: concurrent === first,
-        adapterCleanups,
-        localCleanups,
-      }).toEqual({
-        samePromise: true,
-        adapterCleanups: 1,
-        localCleanups: 1,
-      })
-      await first
-      expect(collection.status).toBe(`cleaned-up`)
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`lets a terminal listener clean a replacement sync run separately`, async () => {
-    let starts = 0
-    let adapterCleanups = 0
-    let armed = false
-    let replacementCleanup: Promise<void> | undefined
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          starts++
-          markReady()
-          return () => {
-            adapterCleanups++
-          }
-        },
-      },
-    })
-    const off = collection.on(`status:change`, ({ status }) => {
-      if (armed && status === `cleaned-up`) {
-        armed = false
-        collection.startSyncImmediate()
-        replacementCleanup = collection.cleanup()
-      }
-    })
-
-    try {
-      await collection.preload()
-      armed = true
-      const firstCleanup = collection.cleanup()
-
-      expect(replacementCleanup).toBeDefined()
-      expect(replacementCleanup).not.toBe(firstCleanup)
-      await Promise.all([firstCleanup, replacementCleanup!])
-      expect(starts).toBe(2)
-      expect(adapterCleanups).toBe(2)
-      expect(collection.status).toBe(`cleaned-up`)
-    } finally {
-      armed = false
-      off()
-      await collection.cleanup()
-    }
-  })
-
-  it(`awaits a runtime Promise from cleanup typed to return void`, async () => {
-    const cleanupGate = createDeferred<void>()
-    let cleanupCalls = 0
-    const cleanup: () => void = () => {
-      cleanupCalls++
-      return cleanupGate.promise
-    }
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return cleanup
-        },
-      },
-    })
-
-    try {
-      await collection.preload()
-
-      const retirement = collection.cleanup()
-
-      expect(cleanupCalls).toBe(1)
-      expect(collection.status).toBe(`ready`)
-      expect(() => collection.startSyncImmediate()).toThrowError(
-        expect.objectContaining(cleanupError),
-      )
-
-      cleanupGate.resolve()
-      await retirement
-      expect(collection.status).toBe(`cleaned-up`)
-    } finally {
-      cleanupGate.resolve()
-      await collection.cleanup()
-    }
-  })
-
-  it(`finishes teardown once and rejects every waiter when source cleanup rejects`, async () => {
-    const cleanupGate = createDeferred<void>()
-    const sourceError = new Error(`source cleanup failed exactly`)
-    let starts = 0
-    let cleanups = 0
-    const statuses: Array<string> = []
-    const settlementOrder: Array<string> = []
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          starts++
-          markReady()
-          return {
-            cleanup: () => {
-              cleanups++
-              return cleanups === 1
-                ? cleanupGate.promise.then(() => {
-                    settlementOrder.push(`adapter-cleanup-rejected`)
-                    throw sourceError
-                  })
-                : undefined
-            },
-          }
-        },
-      },
-    })
-    const off = collection.on(`status:change`, ({ status }) => {
-      statuses.push(status)
-      if (status === `cleaned-up`) {
-        settlementOrder.push(`cleaned-up-event`)
-      }
-    })
-
-    try {
-      await collection.preload()
-      statuses.length = 0
-      const firstCleanup = collection.cleanup()
-      const concurrentCleanup = collection.cleanup()
-      void firstCleanup.catch(() => {
-        settlementOrder.push(`public-cleanup-rejection-continuation`)
-      })
-      const firstOutcome = firstCleanup.catch((error: unknown) => error)
-      const concurrentOutcome = concurrentCleanup.catch(
-        (error: unknown) => error,
-      )
-
-      expect(collection.status).toBe(`ready`)
-      expect(cleanups).toBe(1)
-      expect(concurrentCleanup).toBe(firstCleanup)
-      cleanupGate.resolve()
-
-      const [firstError, concurrentError] = await Promise.all([
-        firstOutcome,
-        concurrentOutcome,
-      ])
-      expect(concurrentError).toBe(firstError)
-      expect(firstError).toMatchObject({
-        name: `SyncCleanupError`,
-        cause: sourceError,
-      })
-      expect(collection.status).toBe(`cleaned-up`)
-      expect(statuses).toEqual([`cleaned-up`])
-      expect(settlementOrder).toEqual([
-        `adapter-cleanup-rejected`,
-        `cleaned-up-event`,
-        `public-cleanup-rejection-continuation`,
-      ])
-      expect(cleanups).toBe(1)
-
-      // Rejection ends the old sync run. A later run is allowed, and a
-      // repeated cleanup does not retry the failed callback from that run.
-      await expect(collection.cleanup()).resolves.toBeUndefined()
-      expect(cleanups).toBe(1)
-      collection.startSyncImmediate()
-      expect(starts).toBe(2)
-      expect(collection.status).toBe(`ready`)
-    } finally {
-      cleanupGate.resolve()
-      off()
-      await collection.cleanup()
-    }
-  })
-
-  it.each([`throw`, `reject`] as const)(
-    `keeps adapter cleanup failure primary when local teardown also fails: %s`,
-    async (outcome) => {
-      const cleanupGate = createDeferred<void>()
-      const adapterFailure = new Error(`adapter cleanup failed exactly`)
-      const localFailure = new Error(`local teardown failed exactly`)
-      const sync = withCollectionSyncConfigCleanup(
-        {
-          sync: ({ markReady }) => {
-            markReady()
-            return () => {
-              if (outcome === `throw`) throw adapterFailure
-              return cleanupGate.promise.then(() => {
-                throw adapterFailure
-              })
-            }
-          },
-        } satisfies SyncConfig<Row, number>,
-        () => {
-          throw localFailure
-        },
-      )
-      const collection = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        sync,
-      })
-
-      try {
-        await collection.preload()
-        const cleanup = collection.cleanup()
-        cleanupGate.resolve()
-        const failure = await cleanup.catch((error: unknown) => error)
-
-        expect(failure).toBeInstanceOf(AggregateError)
-        const aggregate = failure as AggregateError
-        expect(aggregate.cause).toMatchObject({
-          name: `SyncCleanupError`,
-          cause: adapterFailure,
-        })
-        expect(aggregate.errors).toEqual([aggregate.cause, localFailure])
-        expect(collection.status).toBe(`cleaned-up`)
-      } finally {
-        cleanupGate.resolve()
-        await collection.cleanup().catch(() => undefined)
-      }
-    },
-  )
-
-  it.each(reentryScenarios)(
-    `rejects restart without creating replacement ownership: %j`,
-    async ({ boundary, nestedCleanup, attempts }) => {
-      let ops!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
-      let loads = 0
-      let releases = 0
-      let armed = false
-      const errors: Array<unknown> = []
-      const cleanups: Array<Promise<void>> = []
-      const reenter = () => {
-        if (!armed) return
-        armed = false
-        for (let i = 0; i < attempts; i++) {
-          if (nestedCleanup) cleanups.push(live.cleanup())
-          try {
-            live.startSyncImmediate()
-            errors.push(undefined)
-          } catch (error) {
-            errors.push(error)
-          }
-        }
-      }
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (methods) => {
-            ops = methods
-            methods.begin()
-            methods.write({ type: `insert`, value: { id: 1, rank: 1 } })
-            methods.commit()
-            methods.markReady()
-            return {
-              loadSubset: ({ signal }) => {
-                loads++
-                signal?.addEventListener(`abort`, () => {
-                  if (boundary === `abort`) reenter()
-                })
-                return true
-              },
-              unloadSubset: () => {
-                releases++
-                if (boundary === `release`) reenter()
-              },
-            }
-          },
-        },
-      })
-      const live = createLiveQueryCollection((q) => q.from({ row: source }))
-      try {
-        await live.preload()
-        armed = true
-        await live.cleanup()
-        await Promise.all(cleanups)
-        expect(armed).toBe(false)
-        expect(errors).toHaveLength(attempts)
-        for (const error of errors) expect(error).toMatchObject(cleanupError)
-        expect(loads).toBe(1)
-        expect(releases).toBe(1)
-        expect(source.subscriberCount).toBe(0)
-        expect(live.status).toBe(`cleaned-up`)
-
-        // The rejected calls must not poison a later, ordinary restart.
-        await live.preload()
-        expect(loads).toBe(2)
-        expect(source.subscriberCount).toBe(1)
-        ops.begin()
-        ops.write({ type: `update`, value: { id: 1, rank: 2 } })
-        ops.commit()
-        expect(live.status).toBe(`ready`)
-        expect(live.get(1)?.rank).toBe(2)
-      } finally {
-        armed = false
-        await live.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-
-  it.each([`start`, `preload`] as const)(
-    `rejects %s from adapter cleanup but allows another collection to start`,
-    async (method) => {
-      let starts = 0
-      let armed = false
-      let observed: Promise<unknown> | undefined
-      const peer = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        sync: { sync: ({ markReady }) => markReady() },
-      })
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            starts++
-            begin()
-            write({ type: `insert`, value: { id: 1, rank: starts } })
-            commit()
-            markReady()
-            return () => {
-              if (!armed) return
-              armed = false
-              void source.cleanup()
-              try {
-                const result =
-                  method === `start`
-                    ? source.startSyncImmediate()
-                    : source.preload()
-                observed = Promise.resolve(result).then(
-                  () => undefined,
-                  (error: unknown) => error,
-                )
-              } catch (error) {
-                observed = Promise.resolve(error)
-              }
-              peer.startSyncImmediate()
-            }
-          },
-        },
-      })
-      try {
-        await source.preload()
-        armed = true
-        await source.cleanup()
-        expect(await observed).toMatchObject(cleanupError)
-        expect(starts).toBe(1)
-        expect(peer.status).toBe(`ready`)
-        await source.preload()
-        expect(starts).toBe(2)
-        expect(source.get(1)?.rank).toBe(2)
-      } finally {
-        armed = false
-        await source.cleanup()
-        await peer.cleanup()
-      }
-    },
-  )
-
-  it.each(completedBoundaryScenarios)(
-    `admits restart at the completed cleanup boundary: %j`,
-    async ({ boundary, liveQuery }) => {
-      let starts = 0
-      let armed = false
-      let ops!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: (methods) => {
-            ops = methods
-            const { begin, write, commit, markReady } = methods
-            starts++
-            begin()
-            write({ type: `insert`, value: { id: 1, rank: starts } })
-            commit()
-            markReady()
-          },
-        },
-      })
-      const collection = liveQuery
-        ? createLiveQueryCollection((q) => q.from({ row: source }))
-        : source
-      const off = collection.on(`status:change`, ({ status }) => {
-        if (armed && boundary === `event` && status === `cleaned-up`) {
-          armed = false
-          collection.startSyncImmediate()
-        }
-      })
-      try {
-        await collection.preload()
-        armed = true
-        await collection.cleanup()
-        if (boundary === `await`) collection.startSyncImmediate()
-        expect(starts).toBe(liveQuery ? 1 : 2)
-        expect(collection.status).toBe(`ready`)
-        expect(collection.get(1)?.rank).toBe(liveQuery ? 1 : 2)
-        ops.begin()
-        ops.write({ type: `update`, value: { id: 1, rank: 3 } })
-        ops.commit()
-        expect(collection.get(1)?.rank).toBe(3)
-      } finally {
-        armed = false
-        off()
-        if (liveQuery) await collection.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-
-  it(`ends a pending subset load with one end transition at cleanup`, async () => {
-    const collection = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return { loadSubset: () => new Promise<void>(() => {}) }
-        },
-      },
-    })
-    const transitions: Array<{
-      isLoadingSubset: boolean
-      previousIsLoadingSubset: boolean
-      loadingSubsetTransition: string
-    }> = []
-    collection.on(`loadingSubset:change`, (event) => {
-      transitions.push({
-        isLoadingSubset: event.isLoadingSubset,
-        previousIsLoadingSubset: event.previousIsLoadingSubset,
-        loadingSubsetTransition: event.loadingSubsetTransition,
-      })
-    })
-
-    void collection._sync.loadSubset({})
-    await Promise.resolve()
-    expect(collection.isLoadingSubset).toBe(true)
-
-    await collection.cleanup()
-
-    expect(transitions).toEqual([
-      {
-        isLoadingSubset: true,
-        previousIsLoadingSubset: false,
-        loadingSubsetTransition: `start`,
-      },
-      {
-        isLoadingSubset: false,
-        previousIsLoadingSubset: true,
-        loadingSubsetTransition: `end`,
-      },
-    ])
-    expect(collection.isLoadingSubset).toBe(false)
-  })
 })
diff --git a/packages/db/tests/collection-cleanup-restart-support.ts b/packages/db/tests/collection-cleanup-restart-support.ts
new file mode 100644
index 0000000000..69a44ccead
--- /dev/null
+++ b/packages/db/tests/collection-cleanup-restart-support.ts
@@ -0,0 +1,53 @@
+// Shared helpers for the oracle file and the ordinary tests moved from it.
+import { expect } from 'vitest'
+
+export type Row = { id: number; rank: number }
+export const cleanupError = {
+  name: `CollectionStateError`,
+  message: expect.stringContaining(`after cleanup() completes`),
+}
+export const reentryScenarios = ([`abort`, `release`] as const).flatMap(
+  (boundary) =>
+    [false, true].flatMap((nestedCleanup) =>
+      [1, 2].map((attempts) => ({
+        id: `${boundary}:${nestedCleanup ? `nested` : `plain`}:${attempts}`,
+        boundary,
+        nestedCleanup,
+        attempts,
+      })),
+    ),
+)
+export const completedBoundaryScenarios = ([`event`, `await`] as const).flatMap(
+  (boundary) =>
+    [false, true].map((liveQuery) => ({
+      id: `${boundary}:${liveQuery ? `live-query` : `source`}`,
+      boundary,
+      liveQuery,
+    })),
+)
+export async function withOracleCleanup<T>(
+  body: () => T | Promise<T>,
+  cleanups: Array<() => void | Promise<unknown>>,
+): Promise<T> {
+  let value: T | undefined
+  const failures: Array<unknown> = []
+  try {
+    value = await body()
+  } catch (error) {
+    failures.push(error)
+  }
+  for (const cleanup of cleanups) {
+    try {
+      await cleanup()
+    } catch (error) {
+      failures.push(error)
+    }
+  }
+  if (failures.length === 1) throw failures[0]
+  if (failures.length > 1) {
+    throw new AggregateError(failures, `Cleanup oracle and teardown failed`, {
+      cause: failures[0],
+    })
+  }
+  return value as T
+}
diff --git a/packages/db/tests/collection-cleanup-restart.test.ts b/packages/db/tests/collection-cleanup-restart.test.ts
new file mode 100644
index 0000000000..5089be8ad1
--- /dev/null
+++ b/packages/db/tests/collection-cleanup-restart.test.ts
@@ -0,0 +1,1322 @@
+// Ordinary tests moved out of collection-cleanup-restart-oracle.test.ts. They
+// keep literal expectations for cleanup, restart, and observer behavior; the
+// three-cut laws and the grammar calibration stay in the oracle file.
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BasicIndex,
+  createCollection,
+  createEffect,
+  createLiveQueryCollection,
+  eq,
+  withCollectionSyncConfigCleanup,
+} from '../src'
+import { createDeferred } from '../src/deferred'
+import {
+  cleanupError,
+  completedBoundaryScenarios,
+  reentryScenarios,
+  withOracleCleanup,
+} from './collection-cleanup-restart-support.js'
+import type { SyncConfig } from '../src/types'
+import type { Row } from './collection-cleanup-restart-support.js'
+
+describe(`Collection cleanup oracle calibration`, () => {
+  it(`retains a primary mismatch and every teardown failure`, async () => {
+    const primary = new Error(`oracle mismatch`)
+    const firstCleanup = new Error(`first cleanup failed`)
+    const secondCleanup = new Error(`second cleanup failed`)
+    const attempts: Array<string> = []
+
+    const failure = await withOracleCleanup(() => {
+      throw primary
+    }, [
+      () => {
+        attempts.push(`first`)
+        throw firstCleanup
+      },
+      () => {
+        attempts.push(`second`)
+        return Promise.reject(secondCleanup)
+      },
+    ]).catch((error: unknown) => error)
+
+    expect(attempts).toEqual([`first`, `second`])
+    expect(failure).toBeInstanceOf(AggregateError)
+    expect(failure).toMatchObject({
+      cause: primary,
+      errors: [primary, firstCleanup, secondCleanup],
+    })
+  })
+})
+
+describe(`Collection cleanup admission oracle`, () => {
+  it(`refuses cleanup while a live query or Effect reads it, and ends dependents first on request`, async () => {
+    let starts = 0
+    let ops!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: (params) => {
+          ops = params
+          starts++
+          params.begin()
+          params.write({ type: `insert`, value: { id: starts, rank: starts } })
+          params.commit()
+          params.markReady()
+        },
+      },
+    })
+    const inner = createLiveQueryCollection((q) => q.from({ row: source }))
+    const outer = createLiveQueryCollection((q) => q.from({ row: inner }))
+    const effect = createEffect({
+      query: (q) => q.from({ row: source }),
+      onBatch: () => {},
+    })
+    const received: Array<number> = []
+    const direct = source.subscribeChanges((changes) => {
+      for (const change of changes) received.push(change.key)
+    })
+    try {
+      await outer.preload()
+      // Model: three readers of the source, one of each kind; the outer query
+      // reads the inner one, not the source.
+      expect(source.subscribers.map(({ kind }) => kind).sort()).toEqual([
+        `effect`,
+        `live-query`,
+        `subscription`,
+      ])
+      expect(
+        source.subscribers.find(({ kind }) => kind === `live-query`)
+          ?.collection,
+      ).toBe(inner)
+      expect(inner.subscribers.map(({ collection }) => collection)).toEqual([
+        outer,
+      ])
+
+      // A plain cleanup refuses and changes nothing.
+      await expect(source.cleanup()).rejects.toThrow(/dependent/)
+      expect([source.status, inner.status, outer.status]).toEqual([
+        `ready`,
+        `ready`,
+        `ready`,
+      ])
+      expect(effect.disposed).toBe(false)
+
+      // With its dependents, cleanup ends the query chain and the Effect
+      // first. The direct subscription survives into the next sync run.
+      await source.cleanup({ dependents: true })
+      expect([source.status, inner.status, outer.status]).toEqual([
+        `cleaned-up`,
+        `cleaned-up`,
+        `cleaned-up`,
+      ])
+      expect(effect.disposed).toBe(true)
+      expect(source.subscribers.map(({ kind }) => kind)).toEqual([
+        `subscription`,
+      ])
+      received.length = 0
+      source.startSyncImmediate()
+      expect(starts).toBe(2)
+      ops.begin()
+      ops.write({ type: `insert`, value: { id: 9, rank: 9 } })
+      ops.commit()
+      expect(received).toContain(9)
+      // Only direct subscriptions and an idle live query remain. Nothing
+      // reads the idle query, so a plain cleanup is admitted; the idle query
+      // ends at cleanup start, as a query under internal teardown does.
+      const idle = createLiveQueryCollection((q) => q.from({ row: source }))
+      await idle.preload()
+      expect(
+        source.subscribers.find(({ collection }) => collection === idle)
+          ?.active,
+      ).toBe(false)
+      await source.cleanup()
+      expect(source.status).toBe(`cleaned-up`)
+      expect(idle.status).toBe(`crashed`)
+    } finally {
+      direct.unsubscribe()
+      await outer.cleanup({ dependents: true })
+      await effect.dispose()
+      await source.cleanup({ dependents: true })
+    }
+  })
+
+  // Logical demand is distinct from a request to start a sync run. Cleanup
+  // rejects the latter, including resumption, while a deferred subscription
+  // may retain demand without starting even a live-query Collection's run.
+  // Idle and cleaned-up sources distinguish this law from checking only ready
+  // Collections. The callback is the synchronous cleanup-start observation cut.
+  it.each(
+    ([`plain`, `live-query`] as const).flatMap((kind) =>
+      ([`idle`, `ready`, `cleaned-up`] as const).map((priorStatus) => ({
+        kind,
+        priorStatus,
+      })),
+    ),
+  )(
+    `retains deferred demand during $priorStatus $kind cleanup`,
+    async ({ kind, priorStatus }) => {
+      let starts = 0
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({ markReady }) => {
+            starts++
+            markReady()
+          },
+        },
+      })
+      const live = createLiveQueryCollection({
+        query: (q) => q.from({ row: source }),
+        gcTime: 0,
+      })
+      const collection = kind === `plain` ? source : live
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let reached = false
+      if (priorStatus === `ready`) {
+        source.startSyncImmediate()
+        collection.startSyncImmediate()
+      } else if (priorStatus === `cleaned-up`) {
+        await collection.cleanup()
+      }
+      const before = starts
+      const stop = collection._onCleanupStart(() => {
+        reached = true
+        expect(() => collection.subscribeChanges(() => {})).toThrow(
+          expect.objectContaining(cleanupError),
+        )
+        subscription = collection.subscribeChanges(() => {}, {
+          deferAcquisition: true,
+          includeInitialState: true,
+        })
+        expect(subscription.isDeferringAcquisition()).toBe(true)
+        expect(() => subscription!.resumeDeferredAcquisition()).toThrow(
+          expect.objectContaining(cleanupError),
+        )
+        expect(collection.subscriberCount).toBe(0)
+        expect(starts).toBe(before)
+      })
+      await withOracleCleanup(async () => {
+        await collection.cleanup()
+        expect(reached).toBe(true)
+        expect(subscription).toBeDefined()
+        expect(starts).toBe(before)
+        stop()
+        subscription!.resumeDeferredAcquisition()
+        for (let turn = 0; turn < 10; turn++) await Promise.resolve()
+        expect(collection.status).toBe(`ready`)
+        expect(collection.subscriberCount).toBe(1)
+      }, [
+        stop,
+        () => subscription?.unsubscribe(),
+        () => live.cleanup(),
+        () => source.cleanup(),
+      ])
+    },
+  )
+
+  // Promise ownership changes only when a replacement run actually starts.
+  // A validation failure or a still-deferred start cannot create a second
+  // retirement. Successful admission is the neighboring case: its new run
+  // must have a distinct cleanup promise even before the old one settles.
+  it.each([
+    `none`,
+    `deferred-start`,
+    `listener-failure`,
+    `subscribe`,
+    `resume`,
+    `preload`,
+  ] as const)(
+    `preserves retirement identity through %s admission`,
+    async (admission) => {
+      let starts = 0
+      let cleanups = 0
+      const collection = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({ markReady }) => {
+            starts++
+            markReady()
+            return () => {
+              cleanups++
+            }
+          },
+        },
+      })
+      collection.startSyncImmediate()
+      const first = collection.cleanup()
+      const failure = new Error(`demand failed before replacement startup`)
+      let stop = () => {}
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let preload: Promise<void> | undefined
+      await withOracleCleanup(async () => {
+        if (admission === `listener-failure`) {
+          stop = collection[`_changes`].onFirstSubscriberOrPreload(() => {
+            throw failure
+          })
+          expect(() => collection.subscribeChanges(() => {})).toThrow(failure)
+        } else if (admission === `deferred-start`) {
+          collection._deferSyncStart()
+          collection.startSyncImmediate()
+        } else if (admission === `subscribe`) {
+          subscription = collection.subscribeChanges(() => {})
+        } else if (admission === `resume`) {
+          subscription = collection.subscribeChanges(() => {}, {
+            deferAcquisition: true,
+          })
+          subscription.resumeDeferredAcquisition()
+        } else if (admission === `preload`) preload = collection.preload()
+        const replacement = [`subscribe`, `resume`, `preload`].includes(
+          admission,
+        )
+        const second = collection.cleanup()
+        expect(second === first).toBe(!replacement)
+        expect(starts).toBe(replacement ? 2 : 1)
+        expect(cleanups).toBe(starts)
+        await Promise.all([first, second, preload])
+      }, [
+        () => stop(),
+        () => subscription?.unsubscribe(),
+        () => collection.cleanup(),
+      ])
+    },
+  )
+  it(`awaits a structural thenable returned from contextual-void cleanup`, async () => {
+    const cleanupGate = createDeferred<void>()
+    let cleanupCalls = 0
+    const thenable = {
+      then: cleanupGate.promise.then.bind(cleanupGate.promise),
+    }
+    const cleanup: () => void = () => {
+      cleanupCalls++
+      return thenable
+    }
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return cleanup
+        },
+      },
+    })
+
+    await withOracleCleanup(async () => {
+      await collection.preload()
+      let settled = false
+      const retirement = collection.cleanup().then(() => {
+        settled = true
+      })
+
+      expect(cleanupCalls).toBe(1)
+      expect(collection.status).toBe(`ready`)
+      expect(() => collection.startSyncImmediate()).toThrowError(
+        expect.objectContaining(cleanupError),
+      )
+      await Promise.resolve()
+      expect(settled).toBe(false)
+
+      cleanupGate.resolve()
+      await retirement
+      expect(collection.status).toBe(`cleaned-up`)
+    }, [() => cleanupGate.resolve(), () => collection.cleanup()])
+  })
+
+  it(`crashes a live query once when internal teardown retires a source it reads under two aliases`, async () => {
+    const cleanupGate = createDeferred<void>()
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: 1, rank: 1 } })
+          commit()
+          markReady()
+          return { cleanup: () => cleanupGate.promise }
+        },
+      },
+    })
+    source.createIndex((row) => row.id, { indexType: BasicIndex })
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ left: source })
+        .join(
+          { right: source },
+          ({ left, right }) => eq(left.id, right.id),
+          `inner`,
+        ),
+    )
+    const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
+
+    try {
+      await live.preload()
+
+      // Internal teardown that bypasses admission crashes the query once.
+      const cleanup = source._lifecycle.cleanup()
+
+      expect(live.status).toBe(`crashed`)
+      expect(reports).toHaveBeenCalledTimes(1)
+
+      cleanupGate.resolve()
+      await cleanup
+    } finally {
+      cleanupGate.resolve()
+      reports.mockRestore()
+      await live.cleanup()
+      await source.cleanup()
+    }
+  })
+
+  it(`continues teardown when a cleanup-start observer throws`, async () => {
+    const cleanupGate = createDeferred<void>()
+    const observerError = new Error(`cleanup-start observer failed exactly`)
+    let starts = 0
+    let adapterCleanupStarted = 0
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          starts++
+          markReady()
+          return {
+            cleanup: () => {
+              adapterCleanupStarted++
+              return cleanupGate.promise
+            },
+          }
+        },
+      },
+    })
+    const off = source._onCleanupStart(() => {
+      throw observerError
+    })
+
+    try {
+      await source.preload()
+      const cleanupOutcome = source.cleanup().then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+
+      expect(adapterCleanupStarted).toBe(1)
+      expect(source.status).toBe(`ready`)
+
+      cleanupGate.resolve()
+      expect(await cleanupOutcome).toBe(observerError)
+      expect(source.status).toBe(`cleaned-up`)
+
+      off()
+      source.startSyncImmediate()
+      expect(starts).toBe(2)
+      expect(source.status).toBe(`ready`)
+    } finally {
+      off()
+      cleanupGate.resolve()
+      await source.cleanup().catch(() => undefined)
+    }
+  })
+
+  it(`keeps adapter cleanup failure primary when cleanup-start observer also fails`, async () => {
+    const cleanupGate = createDeferred<void>()
+    const observerError = new Error(`cleanup-start observer failed exactly`)
+    const adapterError = new Error(`adapter cleanup failed exactly`)
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            cleanup: () =>
+              cleanupGate.promise.then(() => {
+                throw adapterError
+              }),
+          }
+        },
+      },
+    })
+    const off = source._onCleanupStart(() => {
+      throw observerError
+    })
+
+    try {
+      await source.preload()
+      const cleanup = source.cleanup()
+
+      expect(source.status).toBe(`ready`)
+      cleanupGate.resolve()
+      const failure = await cleanup.catch((error: unknown) => error)
+
+      expect(failure).toBeInstanceOf(AggregateError)
+      const aggregate = failure as AggregateError
+      expect(aggregate.cause).toMatchObject({
+        name: `SyncCleanupError`,
+        cause: adapterError,
+      })
+      expect(aggregate.errors).toEqual([aggregate.cause, observerError])
+      expect(source.status).toBe(`cleaned-up`)
+    } finally {
+      off()
+      cleanupGate.resolve()
+      await source.cleanup().catch(() => undefined)
+    }
+  })
+
+  it(`retains every cleanup-start observer failure after adapter cleanup rejects`, async () => {
+    const cleanupGate = createDeferred<void>()
+    const firstObserverError = new Error(
+      `first cleanup-start observer failed exactly`,
+    )
+    const secondObserverError = new Error(
+      `second cleanup-start observer failed exactly`,
+    )
+    const adapterError = new Error(`adapter cleanup failed exactly`)
+    const observerCalls: Array<string> = []
+    let starts = 0
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          starts++
+          markReady()
+          return {
+            cleanup: () =>
+              cleanupGate.promise.then(() => {
+                throw adapterError
+              }),
+          }
+        },
+      },
+    })
+    const offFirst = source._onCleanupStart(() => {
+      observerCalls.push(`first`)
+      throw firstObserverError
+    })
+    const offSecond = source._onCleanupStart(() => {
+      observerCalls.push(`second`)
+      throw secondObserverError
+    })
+
+    try {
+      await source.preload()
+      const cleanup = source.cleanup()
+
+      expect(observerCalls).toEqual([`first`, `second`])
+      expect(source.status).toBe(`ready`)
+      cleanupGate.resolve()
+      const failure = await cleanup.catch((error: unknown) => error)
+
+      expect(failure).toBeInstanceOf(AggregateError)
+      const aggregate = failure as AggregateError
+      expect(aggregate.cause).toMatchObject({
+        name: `SyncCleanupError`,
+        cause: adapterError,
+      })
+      expect(aggregate.errors).toEqual([
+        aggregate.cause,
+        firstObserverError,
+        secondObserverError,
+      ])
+      expect(source.status).toBe(`cleaned-up`)
+
+      offFirst()
+      offSecond()
+      source.startSyncImmediate()
+      expect(starts).toBe(2)
+      expect(source.status).toBe(`ready`)
+    } finally {
+      offFirst()
+      offSecond()
+      cleanupGate.resolve()
+      await source.cleanup().catch(() => undefined)
+    }
+  })
+
+  it.each([`first`, `second`] as const)(
+    `does not acquire live-query source subscriptions during active cleanup: %s source`,
+    async (cleaningPosition) => {
+      const cleanupGate = createDeferred<void>()
+      const cleaningSource = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return { cleanup: () => cleanupGate.promise }
+          },
+        },
+      })
+      const healthySource = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        sync: { sync: ({ markReady }) => markReady() },
+      })
+      cleaningSource.createIndex((row) => row.id, { indexType: BasicIndex })
+      healthySource.createIndex((row) => row.id, { indexType: BasicIndex })
+      let live: ReturnType<typeof createLiveQueryCollection> | undefined
+      const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
+
+      try {
+        await cleaningSource.preload()
+        const cleaning = cleaningSource.cleanup()
+        expect(cleaningSource.status).toBe(`ready`)
+
+        const firstSource =
+          cleaningPosition === `first` ? cleaningSource : healthySource
+        const secondSource =
+          cleaningPosition === `second` ? cleaningSource : healthySource
+        live = createLiveQueryCollection((q) =>
+          q
+            .from({ first: firstSource })
+            .join(
+              { second: secondSource },
+              ({ first, second }) => eq(first.id, second.id),
+              `inner`,
+            ),
+        )
+        const message =
+          `Source collection '${cleaningSource.id}' was manually cleaned up while live query '${live.id}' depends on it. ` +
+          `Live queries prevent automatic GC, so this was likely a manual cleanup() call.`
+
+        await expect(live.preload()).rejects.toThrow(message)
+
+        expect(live.status).toBe(`crashed`)
+        expect({
+          cleaning: cleaningSource.subscriberCount,
+          healthy: healthySource.subscriberCount,
+        }).toEqual({ cleaning: 0, healthy: 0 })
+        expect(reports.mock.calls).toEqual([[`[Live Query Error] ${message}`]])
+
+        cleanupGate.resolve()
+        await cleaning
+      } finally {
+        cleanupGate.resolve()
+        reports.mockRestore()
+        await live?.cleanup()
+        await cleaningSource.cleanup()
+        await healthySource.cleanup()
+      }
+    },
+  )
+
+  it(`does not retain a late cleanup-start observer that throws`, async () => {
+    const cleanupGate = createDeferred<void>()
+    const observerError = new Error(
+      `late cleanup-start observer failed exactly`,
+    )
+    let observerCalls = 0
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return { cleanup: () => cleanupGate.promise }
+        },
+      },
+    })
+
+    try {
+      await source.preload()
+      const firstCleanup = source.cleanup()
+
+      expect(() =>
+        source._onCleanupStart(() => {
+          observerCalls++
+          throw observerError
+        }),
+      ).toThrow(observerError)
+
+      cleanupGate.resolve()
+      await firstCleanup
+      source.startSyncImmediate()
+      await expect(source.cleanup()).resolves.toBeUndefined()
+      expect(observerCalls).toBe(1)
+    } finally {
+      cleanupGate.resolve()
+      await source.cleanup().catch(() => undefined)
+    }
+  })
+
+  it(`notifies one observer once per cleanup boundary until it unsubscribes`, async () => {
+    let starts = 0
+    let observerCalls = 0
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          starts++
+          markReady()
+        },
+      },
+    })
+    const off = source._onCleanupStart(() => {
+      observerCalls++
+    })
+
+    try {
+      await source.preload()
+      const firstCleanup = source.cleanup()
+      expect(observerCalls).toBe(1)
+      await firstCleanup
+
+      source.startSyncImmediate()
+      const secondCleanup = source.cleanup()
+      expect(observerCalls).toBe(2)
+      await secondCleanup
+
+      off()
+      source.startSyncImmediate()
+      await source.cleanup()
+      expect({ starts, observerCalls }).toEqual({ starts: 3, observerCalls: 2 })
+    } finally {
+      off()
+      await source.cleanup()
+    }
+  })
+
+  it(`does not revive a cleaned-up live query when its source restarts`, async () => {
+    let starts = 0
+    const source = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          starts++
+          begin()
+          write({ type: `insert`, value: { id: 1, rank: starts } })
+          commit()
+          markReady()
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) => q.from({ row: source }))
+    const publications: Array<unknown> = []
+    const subscription = live.subscribeChanges((changes) => {
+      publications.push(changes)
+    })
+    const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
+
+    try {
+      await live.preload()
+      expect(live.get(1)?.rank).toBe(1)
+      publications.length = 0
+
+      // Cleanup refuses while the live query reads the source; with its
+      // dependents it cleans the live query up first.
+      await expect(source.cleanup()).rejects.toThrow(/dependent/)
+      await source.cleanup({ dependents: true })
+      expect(live.status).toBe(`cleaned-up`)
+
+      // Restarting the source does not revive the cleaned-up live query,
+      // and its surviving subscriber receives nothing from the new run.
+      source.startSyncImmediate()
+      expect(source.status).toBe(`ready`)
+      expect(starts).toBe(2)
+      expect(live.status).toBe(`cleaned-up`)
+      expect(publications).toEqual([])
+      expect(reports).not.toHaveBeenCalled()
+    } finally {
+      subscription.unsubscribe()
+      reports.mockRestore()
+      await live.cleanup()
+      await source.cleanup()
+    }
+  })
+
+  it.each([`eager`, `on-demand`] as const)(
+    `restarts a %s source that failed after ready, and its live query, through their own restarts`,
+    async (syncMode) => {
+      let sourceSync!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
+      let starts = 0
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        syncMode,
+        sync: {
+          sync: (methods) => {
+            sourceSync = methods
+            starts++
+            const writeRow = () => {
+              methods.begin()
+              methods.write({ type: `insert`, value: { id: 1, rank: starts } })
+              methods.commit()
+            }
+            if (syncMode === `eager`) writeRow()
+            methods.markReady()
+            if (syncMode === `on-demand`) {
+              return {
+                loadSubset: () => {
+                  writeRow()
+                  return true
+                },
+                unloadSubset: () => {},
+              }
+            }
+            return undefined
+          },
+        },
+      })
+      const live = createLiveQueryCollection((q) => q.from({ row: source }))
+      const observedRanks: Array<number | undefined> = []
+      const subscription = live.subscribeChanges(() => {
+        observedRanks.push(live.get(1)?.rank)
+      })
+      const reports = vi.spyOn(console, `error`).mockImplementation(() => {})
+
+      try {
+        await live.preload()
+        expect(live.get(1)?.rank).toBe(1)
+
+        // After the first ready a source's fail() stops its sync: the
+        // status and rows stay, and the live query's health tree reports it.
+        sourceSync.fail(new Error(`source sync failed`))
+        expect(source.status).toBe(`ready`)
+        expect(source.health.error).toMatchObject({
+          message: `source sync failed`,
+        })
+        expect(live.status).toBe(`ready`)
+        expect(live.get(1)?.rank).toBe(1)
+        expect(live.health.sources[0]?.error).toBeTruthy()
+
+        // Only a new sync run clears the error.
+        await live.cleanup()
+        await source.cleanup()
+        await live.preload()
+        expect(source.health.hasErrors).toBe(false)
+        expect(live.health.hasErrors).toBe(false)
+
+        expect(starts).toBe(2)
+        expect(source.status).toBe(`ready`)
+        expect(live.status).toBe(`ready`)
+        expect(live.get(1)?.rank).toBe(2)
+
+        observedRanks.length = 0
+        sourceSync.begin()
+        sourceSync.write({ type: `update`, value: { id: 1, rank: 3 } })
+        sourceSync.commit()
+        expect(live.get(1)?.rank).toBe(3)
+        expect(observedRanks).toEqual([3])
+      } finally {
+        subscription.unsubscribe()
+        reports.mockRestore()
+        await live.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+
+  it(`treats an incidental contextual-void return as synchronous cleanup`, async () => {
+    let starts = 0
+    const released: Array<number> = []
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          starts++
+          markReady()
+          return () => released.push(starts)
+        },
+      },
+    })
+
+    try {
+      await collection.preload()
+
+      const cleanup = collection.cleanup()
+
+      expect(released).toEqual([1])
+      expect(collection.status).toBe(`cleaned-up`)
+      collection.startSyncImmediate()
+      expect(starts).toBe(2)
+      await cleanup
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`shares one retirement promise when cleanup finishes synchronously`, async () => {
+    let adapterCleanups = 0
+    let localCleanups = 0
+    const sync = withCollectionSyncConfigCleanup(
+      {
+        sync: ({ markReady }) => {
+          markReady()
+          return () => {
+            adapterCleanups++
+          }
+        },
+      } satisfies SyncConfig<Row, number>,
+      () => {
+        localCleanups++
+      },
+    )
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync,
+    })
+
+    try {
+      await collection.preload()
+      const first = collection.cleanup()
+      const concurrent = collection.cleanup()
+
+      expect({
+        samePromise: concurrent === first,
+        adapterCleanups,
+        localCleanups,
+      }).toEqual({
+        samePromise: true,
+        adapterCleanups: 1,
+        localCleanups: 1,
+      })
+      await first
+      expect(collection.status).toBe(`cleaned-up`)
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`lets a terminal listener clean a replacement sync run separately`, async () => {
+    let starts = 0
+    let adapterCleanups = 0
+    let armed = false
+    let replacementCleanup: Promise<void> | undefined
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          starts++
+          markReady()
+          return () => {
+            adapterCleanups++
+          }
+        },
+      },
+    })
+    const off = collection.on(`status:change`, ({ status }) => {
+      if (armed && status === `cleaned-up`) {
+        armed = false
+        collection.startSyncImmediate()
+        replacementCleanup = collection.cleanup()
+      }
+    })
+
+    try {
+      await collection.preload()
+      armed = true
+      const firstCleanup = collection.cleanup()
+
+      expect(replacementCleanup).toBeDefined()
+      expect(replacementCleanup).not.toBe(firstCleanup)
+      await Promise.all([firstCleanup, replacementCleanup!])
+      expect(starts).toBe(2)
+      expect(adapterCleanups).toBe(2)
+      expect(collection.status).toBe(`cleaned-up`)
+    } finally {
+      armed = false
+      off()
+      await collection.cleanup()
+    }
+  })
+
+  it(`awaits a runtime Promise from cleanup typed to return void`, async () => {
+    const cleanupGate = createDeferred<void>()
+    let cleanupCalls = 0
+    const cleanup: () => void = () => {
+      cleanupCalls++
+      return cleanupGate.promise
+    }
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return cleanup
+        },
+      },
+    })
+
+    try {
+      await collection.preload()
+
+      const retirement = collection.cleanup()
+
+      expect(cleanupCalls).toBe(1)
+      expect(collection.status).toBe(`ready`)
+      expect(() => collection.startSyncImmediate()).toThrowError(
+        expect.objectContaining(cleanupError),
+      )
+
+      cleanupGate.resolve()
+      await retirement
+      expect(collection.status).toBe(`cleaned-up`)
+    } finally {
+      cleanupGate.resolve()
+      await collection.cleanup()
+    }
+  })
+
+  it(`finishes teardown once and rejects every waiter when source cleanup rejects`, async () => {
+    const cleanupGate = createDeferred<void>()
+    const sourceError = new Error(`source cleanup failed exactly`)
+    let starts = 0
+    let cleanups = 0
+    const statuses: Array<string> = []
+    const settlementOrder: Array<string> = []
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          starts++
+          markReady()
+          return {
+            cleanup: () => {
+              cleanups++
+              return cleanups === 1
+                ? cleanupGate.promise.then(() => {
+                    settlementOrder.push(`adapter-cleanup-rejected`)
+                    throw sourceError
+                  })
+                : undefined
+            },
+          }
+        },
+      },
+    })
+    const off = collection.on(`status:change`, ({ status }) => {
+      statuses.push(status)
+      if (status === `cleaned-up`) {
+        settlementOrder.push(`cleaned-up-event`)
+      }
+    })
+
+    try {
+      await collection.preload()
+      statuses.length = 0
+      const firstCleanup = collection.cleanup()
+      const concurrentCleanup = collection.cleanup()
+      void firstCleanup.catch(() => {
+        settlementOrder.push(`public-cleanup-rejection-continuation`)
+      })
+      const firstOutcome = firstCleanup.catch((error: unknown) => error)
+      const concurrentOutcome = concurrentCleanup.catch(
+        (error: unknown) => error,
+      )
+
+      expect(collection.status).toBe(`ready`)
+      expect(cleanups).toBe(1)
+      expect(concurrentCleanup).toBe(firstCleanup)
+      cleanupGate.resolve()
+
+      const [firstError, concurrentError] = await Promise.all([
+        firstOutcome,
+        concurrentOutcome,
+      ])
+      expect(concurrentError).toBe(firstError)
+      expect(firstError).toMatchObject({
+        name: `SyncCleanupError`,
+        cause: sourceError,
+      })
+      expect(collection.status).toBe(`cleaned-up`)
+      expect(statuses).toEqual([`cleaned-up`])
+      expect(settlementOrder).toEqual([
+        `adapter-cleanup-rejected`,
+        `cleaned-up-event`,
+        `public-cleanup-rejection-continuation`,
+      ])
+      expect(cleanups).toBe(1)
+
+      // Rejection ends the old sync run. A later run is allowed, and a
+      // repeated cleanup does not retry the failed callback from that run.
+      await expect(collection.cleanup()).resolves.toBeUndefined()
+      expect(cleanups).toBe(1)
+      collection.startSyncImmediate()
+      expect(starts).toBe(2)
+      expect(collection.status).toBe(`ready`)
+    } finally {
+      cleanupGate.resolve()
+      off()
+      await collection.cleanup()
+    }
+  })
+
+  it.each([`throw`, `reject`] as const)(
+    `keeps adapter cleanup failure primary when local teardown also fails: %s`,
+    async (outcome) => {
+      const cleanupGate = createDeferred<void>()
+      const adapterFailure = new Error(`adapter cleanup failed exactly`)
+      const localFailure = new Error(`local teardown failed exactly`)
+      const sync = withCollectionSyncConfigCleanup(
+        {
+          sync: ({ markReady }) => {
+            markReady()
+            return () => {
+              if (outcome === `throw`) throw adapterFailure
+              return cleanupGate.promise.then(() => {
+                throw adapterFailure
+              })
+            }
+          },
+        } satisfies SyncConfig<Row, number>,
+        () => {
+          throw localFailure
+        },
+      )
+      const collection = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        sync,
+      })
+
+      try {
+        await collection.preload()
+        const cleanup = collection.cleanup()
+        cleanupGate.resolve()
+        const failure = await cleanup.catch((error: unknown) => error)
+
+        expect(failure).toBeInstanceOf(AggregateError)
+        const aggregate = failure as AggregateError
+        expect(aggregate.cause).toMatchObject({
+          name: `SyncCleanupError`,
+          cause: adapterFailure,
+        })
+        expect(aggregate.errors).toEqual([aggregate.cause, localFailure])
+        expect(collection.status).toBe(`cleaned-up`)
+      } finally {
+        cleanupGate.resolve()
+        await collection.cleanup().catch(() => undefined)
+      }
+    },
+  )
+
+  it.each(reentryScenarios)(
+    `rejects restart without creating replacement ownership: %j`,
+    async ({ boundary, nestedCleanup, attempts }) => {
+      let ops!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
+      let loads = 0
+      let releases = 0
+      let armed = false
+      const errors: Array<unknown> = []
+      const cleanups: Array<Promise<void>> = []
+      const reenter = () => {
+        if (!armed) return
+        armed = false
+        for (let i = 0; i < attempts; i++) {
+          if (nestedCleanup) cleanups.push(live.cleanup())
+          try {
+            live.startSyncImmediate()
+            errors.push(undefined)
+          } catch (error) {
+            errors.push(error)
+          }
+        }
+      }
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (methods) => {
+            ops = methods
+            methods.begin()
+            methods.write({ type: `insert`, value: { id: 1, rank: 1 } })
+            methods.commit()
+            methods.markReady()
+            return {
+              loadSubset: ({ signal }) => {
+                loads++
+                signal?.addEventListener(`abort`, () => {
+                  if (boundary === `abort`) reenter()
+                })
+                return true
+              },
+              unloadSubset: () => {
+                releases++
+                if (boundary === `release`) reenter()
+              },
+            }
+          },
+        },
+      })
+      const live = createLiveQueryCollection((q) => q.from({ row: source }))
+      try {
+        await live.preload()
+        armed = true
+        await live.cleanup()
+        await Promise.all(cleanups)
+        expect(armed).toBe(false)
+        expect(errors).toHaveLength(attempts)
+        for (const error of errors) expect(error).toMatchObject(cleanupError)
+        expect(loads).toBe(1)
+        expect(releases).toBe(1)
+        expect(source.subscriberCount).toBe(0)
+        expect(live.status).toBe(`cleaned-up`)
+
+        // The rejected calls must not poison a later, ordinary restart.
+        await live.preload()
+        expect(loads).toBe(2)
+        expect(source.subscriberCount).toBe(1)
+        ops.begin()
+        ops.write({ type: `update`, value: { id: 1, rank: 2 } })
+        ops.commit()
+        expect(live.status).toBe(`ready`)
+        expect(live.get(1)?.rank).toBe(2)
+      } finally {
+        armed = false
+        await live.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+
+  it.each([`start`, `preload`] as const)(
+    `rejects %s from adapter cleanup but allows another collection to start`,
+    async (method) => {
+      let starts = 0
+      let armed = false
+      let observed: Promise<unknown> | undefined
+      const peer = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        sync: { sync: ({ markReady }) => markReady() },
+      })
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            starts++
+            begin()
+            write({ type: `insert`, value: { id: 1, rank: starts } })
+            commit()
+            markReady()
+            return () => {
+              if (!armed) return
+              armed = false
+              void source.cleanup()
+              try {
+                const result =
+                  method === `start`
+                    ? source.startSyncImmediate()
+                    : source.preload()
+                observed = Promise.resolve(result).then(
+                  () => undefined,
+                  (error: unknown) => error,
+                )
+              } catch (error) {
+                observed = Promise.resolve(error)
+              }
+              peer.startSyncImmediate()
+            }
+          },
+        },
+      })
+      try {
+        await source.preload()
+        armed = true
+        await source.cleanup()
+        expect(await observed).toMatchObject(cleanupError)
+        expect(starts).toBe(1)
+        expect(peer.status).toBe(`ready`)
+        await source.preload()
+        expect(starts).toBe(2)
+        expect(source.get(1)?.rank).toBe(2)
+      } finally {
+        armed = false
+        await source.cleanup()
+        await peer.cleanup()
+      }
+    },
+  )
+
+  it.each(completedBoundaryScenarios)(
+    `admits restart at the completed cleanup boundary: %j`,
+    async ({ boundary, liveQuery }) => {
+      let starts = 0
+      let armed = false
+      let ops!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: (methods) => {
+            ops = methods
+            const { begin, write, commit, markReady } = methods
+            starts++
+            begin()
+            write({ type: `insert`, value: { id: 1, rank: starts } })
+            commit()
+            markReady()
+          },
+        },
+      })
+      const collection = liveQuery
+        ? createLiveQueryCollection((q) => q.from({ row: source }))
+        : source
+      const off = collection.on(`status:change`, ({ status }) => {
+        if (armed && boundary === `event` && status === `cleaned-up`) {
+          armed = false
+          collection.startSyncImmediate()
+        }
+      })
+      try {
+        await collection.preload()
+        armed = true
+        await collection.cleanup()
+        if (boundary === `await`) collection.startSyncImmediate()
+        expect(starts).toBe(liveQuery ? 1 : 2)
+        expect(collection.status).toBe(`ready`)
+        expect(collection.get(1)?.rank).toBe(liveQuery ? 1 : 2)
+        ops.begin()
+        ops.write({ type: `update`, value: { id: 1, rank: 3 } })
+        ops.commit()
+        expect(collection.get(1)?.rank).toBe(3)
+      } finally {
+        armed = false
+        off()
+        if (liveQuery) await collection.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+
+  it(`ends a pending subset load with one end transition at cleanup`, async () => {
+    const collection = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return { loadSubset: () => new Promise<void>(() => {}) }
+        },
+      },
+    })
+    const transitions: Array<{
+      isLoadingSubset: boolean
+      previousIsLoadingSubset: boolean
+      loadingSubsetTransition: string
+    }> = []
+    collection.on(`loadingSubset:change`, (event) => {
+      transitions.push({
+        isLoadingSubset: event.isLoadingSubset,
+        previousIsLoadingSubset: event.previousIsLoadingSubset,
+        loadingSubsetTransition: event.loadingSubsetTransition,
+      })
+    })
+
+    void collection._sync.loadSubset({})
+    await Promise.resolve()
+    expect(collection.isLoadingSubset).toBe(true)
+
+    await collection.cleanup()
+
+    expect(transitions).toEqual([
+      {
+        isLoadingSubset: true,
+        previousIsLoadingSubset: false,
+        loadingSubsetTransition: `start`,
+      },
+      {
+        isLoadingSubset: false,
+        previousIsLoadingSubset: true,
+        loadingSubsetTransition: `end`,
+      },
+    ])
+    expect(collection.isLoadingSubset).toBe(false)
+  })
+})
diff --git a/packages/db/tests/collection-gc-retention-oracle.property.test.ts b/packages/db/tests/collection-gc-retention-oracle.property.test.ts
index 8435d4de3a..d227564d55 100644
--- a/packages/db/tests/collection-gc-retention-oracle.property.test.ts
+++ b/packages/db/tests/collection-gc-retention-oracle.property.test.ts
@@ -998,29 +998,3 @@ it.skipIf(oracleReplayRequested()).each(boundaryExamples)(
   `reconstructs $name`,
   async ({ history }) => runBoundaryHistory(history),
 )
-
-// Calibrate failure fidelity separately from the product law: every release
-// runs, and secondary teardown errors retain the original checkpoint as cause.
-it.skipIf(oracleReplayRequested())(
-  `preserves the mismatch when cleanup fails`,
-  async () => {
-    const primary = new Error(`retention checkpoint mismatch`)
-    const secondary = new Error(`adapter cleanup failed`)
-    const released: Array<number> = []
-    const result = await withOracleCleanup(() => {
-      throw primary
-    }, [
-      () => {
-        released.push(1)
-        throw secondary
-      },
-      () => {
-        released.push(2)
-      },
-    ]).catch((error: unknown) => error)
-    expect(result).toBeInstanceOf(AggregateError)
-    expect((result as AggregateError).cause).toBe(primary)
-    expect((result as AggregateError).errors).toEqual([primary, secondary])
-    expect(released).toEqual([1, 2])
-  },
-)
diff --git a/packages/db/tests/collection-gc-retention-oracle.ts b/packages/db/tests/collection-gc-retention-oracle.ts
index 3a21c86db7..77f6e75290 100644
--- a/packages/db/tests/collection-gc-retention-oracle.ts
+++ b/packages/db/tests/collection-gc-retention-oracle.ts
@@ -1,3 +1,5 @@
+import { declareOracle } from './oracle-declaration.js'
+
 /**
  * A Collection may retire only after every subscriber, preload and persisting
  * transaction has released it for gcTime. A startup without subscribers, or a
@@ -262,3 +264,10 @@ export function checkGcObservation(
       `visible keys expected [${[...expected].join()}], got [${actual.visibleKeys.join()}]`,
     )
 }
+
+// The model is the reducer and its derived deadline. The check compares the
+// public observation at one cut with that model's prediction for the cut.
+declareOracle({
+  check: [checkGcObservation],
+  model: [createGcModel, stepGcModel, gcDeadline],
+})
diff --git a/packages/db/tests/collection-gc-retention.test.ts b/packages/db/tests/collection-gc-retention.test.ts
new file mode 100644
index 0000000000..a91f0f2b38
--- /dev/null
+++ b/packages/db/tests/collection-gc-retention.test.ts
@@ -0,0 +1,32 @@
+// Harness failure-path checks for the GC retention oracle's cleanup wrapper:
+// every release runs, and the checkpoint error stays the cause. The retention
+// law itself belongs to collection-gc-retention-oracle.property.test.ts.
+import { expect, it } from 'vitest'
+import { oracleReplayRequested } from './oracle-config.js'
+import { withOracleCleanup } from './utils.js'
+
+// Calibrate failure fidelity separately from the product law: every release
+// runs, and secondary teardown errors retain the original checkpoint as cause.
+it.skipIf(oracleReplayRequested())(
+  `preserves the mismatch when cleanup fails`,
+  async () => {
+    const primary = new Error(`retention checkpoint mismatch`)
+    const secondary = new Error(`adapter cleanup failed`)
+    const released: Array<number> = []
+    const result = await withOracleCleanup(() => {
+      throw primary
+    }, [
+      () => {
+        released.push(1)
+        throw secondary
+      },
+      () => {
+        released.push(2)
+      },
+    ]).catch((error: unknown) => error)
+    expect(result).toBeInstanceOf(AggregateError)
+    expect((result as AggregateError).cause).toBe(primary)
+    expect((result as AggregateError).errors).toEqual([primary, secondary])
+    expect(released).toEqual([1, 2])
+  },
+)
diff --git a/packages/db/tests/collection-index-value-fixture.ts b/packages/db/tests/collection-index-value-fixture.ts
new file mode 100644
index 0000000000..2657f4b008
--- /dev/null
+++ b/packages/db/tests/collection-index-value-fixture.ts
@@ -0,0 +1,17 @@
+import { BasicIndex, createCollection } from '../src'
+import type { Collection } from '../src'
+
+// Source collections for index-metadata tests. Each test file that uses them
+// cleans them up in its own afterEach, so every collection ends with its test.
+type Row = { id: string; stamp: unknown }
+export const collections: Array<Collection<Row, string>> = []
+
+export function createSource() {
+  const result = createCollection({
+    getKey: (row: Row) => row.id,
+    sync: { sync: ({ markReady }) => markReady() },
+    defaultIndexType: BasicIndex,
+  })
+  collections.push(result)
+  return result
+}
diff --git a/packages/db/tests/collection-index-value-oracle.test.ts b/packages/db/tests/collection-index-value-oracle.test.ts
index 7657ab1659..5653916fc3 100644
--- a/packages/db/tests/collection-index-value-oracle.test.ts
+++ b/packages/db/tests/collection-index-value-oracle.test.ts
@@ -17,27 +17,34 @@
  */
 import { afterEach, expect, it } from 'vitest'
 import { Temporal } from 'temporal-polyfill'
-import { BasicIndex, IR, coalesce, createCollection } from '../src'
-import type { Collection } from '../src'
+import { IR, coalesce } from '../src'
+import { collections, createSource } from './collection-index-value-fixture.js'
+import { declareOracle } from './oracle-declaration.js'
 
-type Row = { id: string; stamp: unknown }
-const collections: Array<Collection<Row, string>> = []
 afterEach(async () => {
   await Promise.all(
     collections.splice(0).map((collection) => collection.cleanup()),
   )
 })
 
-function createSource() {
-  const result = createCollection({
-    getKey: (row: Row) => row.id,
-    sync: { sync: ({ markReady }) => markReady() },
-    defaultIndexType: BasicIndex,
-  })
-  collections.push(result)
-  return result
+// The model: two literals are one equivalence class exactly when their group
+// labels match. Index signatures must agree with that class relation.
+function expectSignatureClasses(
+  fixtures: ReadonlyArray<{ group: string; value: unknown }>,
+  metadata: ReadonlyArray<{ signature: string }>,
+): void {
+  expect(metadata).toHaveLength(fixtures.length)
+  for (let left = 0; left < fixtures.length; left++) {
+    for (let right = 0; right < fixtures.length; right++) {
+      expect(metadata[left]!.signature === metadata[right]!.signature).toBe(
+        fixtures[left]!.group === fixtures[right]!.group,
+      )
+    }
+  }
 }
 
+declareOracle({ check: [expectSignatureClasses] })
+
 it(`distinguishes native literals from ordinary tags in index signatures`, () => {
   const instant = Temporal.Instant.from(`2026-01-02T00:00:00Z`)
   const date = Temporal.PlainDate.from(`2026-01-02`)
@@ -67,44 +74,5 @@ it(`distinguishes native literals from ordinary tags in index signatures`, () =>
     source.createIndex((row) =>
       coalesce(row.stamp, new IR.Value(fixture.value)),
     )
-  const metadata = source.getIndexMetadata()
-  expect(metadata).toHaveLength(fixtures.length)
-  for (let left = 0; left < fixtures.length; left++) {
-    for (let right = 0; right < fixtures.length; right++) {
-      expect(metadata[left]!.signature === metadata[right]!.signature).toBe(
-        fixtures[left]!.group === fixtures[right]!.group,
-      )
-    }
-  }
-})
-
-it.each([`plain`, `null`] as const)(
-  `isolates ordinary own-tag metadata records / %s`,
-  (prototype) => {
-    const value = {
-      payload: { label: `original` },
-      [Symbol.toStringTag]: `Temporal.Instant`,
-    }
-    if (prototype === `null`) Object.setPrototypeOf(value, null)
-    const source = createSource()
-    source.createIndex((row) => coalesce(row.stamp, new IR.Value(value)))
-    const snapshot = source.getIndexMetadata()[0]!
-    const literal = (snapshot.expression as IR.Func).args[1] as IR.Value<
-      typeof value
-    >
-    literal.value.payload.label = `changed`
-    const next = (source.getIndexMetadata()[0]!.expression as IR.Func)
-      .args[1] as IR.Value
-    expect(next.value).toEqual({ payload: { label: `original` } })
-  },
-)
-
-it(`retains immutable native literals in metadata snapshots`, () => {
-  const source = createSource()
-  const value = Temporal.Instant.from(`2026-01-02T00:00:00.000000001Z`)
-  source.createIndex((row) => coalesce(row.stamp, new IR.Value(value)))
-  const literal = (source.getIndexMetadata()[0]!.expression as IR.Func)
-    .args[1] as IR.Value
-  expect(literal.value).toBeInstanceOf(Temporal.Instant)
-  expect(String(literal.value)).toBe(`2026-01-02T00:00:00.000000001Z`)
+  expectSignatureClasses(fixtures, source.getIndexMetadata())
 })
diff --git a/packages/db/tests/collection-index-value.test.ts b/packages/db/tests/collection-index-value.test.ts
new file mode 100644
index 0000000000..41a1ca65ac
--- /dev/null
+++ b/packages/db/tests/collection-index-value.test.ts
@@ -0,0 +1,46 @@
+/**
+ * Ordinary regression tests for index metadata snapshots: mutable records in a
+ * returned metadata literal stay isolated, and native literals keep their type.
+ * The signature law is owned by collection-index-value-oracle.test.ts.
+ */
+import { afterEach, expect, it } from 'vitest'
+import { Temporal } from 'temporal-polyfill'
+import { IR, coalesce } from '../src'
+import { collections, createSource } from './collection-index-value-fixture.js'
+
+afterEach(async () => {
+  await Promise.all(
+    collections.splice(0).map((collection) => collection.cleanup()),
+  )
+})
+
+it.each([`plain`, `null`] as const)(
+  `isolates ordinary own-tag metadata records / %s`,
+  (prototype) => {
+    const value = {
+      payload: { label: `original` },
+      [Symbol.toStringTag]: `Temporal.Instant`,
+    }
+    if (prototype === `null`) Object.setPrototypeOf(value, null)
+    const source = createSource()
+    source.createIndex((row) => coalesce(row.stamp, new IR.Value(value)))
+    const snapshot = source.getIndexMetadata()[0]!
+    const literal = (snapshot.expression as IR.Func).args[1] as IR.Value<
+      typeof value
+    >
+    literal.value.payload.label = `changed`
+    const next = (source.getIndexMetadata()[0]!.expression as IR.Func)
+      .args[1] as IR.Value
+    expect(next.value).toEqual({ payload: { label: `original` } })
+  },
+)
+
+it(`retains immutable native literals in metadata snapshots`, () => {
+  const source = createSource()
+  const value = Temporal.Instant.from(`2026-01-02T00:00:00.000000001Z`)
+  source.createIndex((row) => coalesce(row.stamp, new IR.Value(value)))
+  const literal = (source.getIndexMetadata()[0]!.expression as IR.Func)
+    .args[1] as IR.Value
+  expect(literal.value).toBeInstanceOf(Temporal.Instant)
+  expect(String(literal.value)).toBe(`2026-01-02T00:00:00.000000001Z`)
+})
diff --git a/packages/db/tests/collection-metadata-publication-oracle.property.test.ts b/packages/db/tests/collection-metadata-publication-oracle.property.test.ts
index 9d23d955d3..5f843de378 100644
--- a/packages/db/tests/collection-metadata-publication-oracle.property.test.ts
+++ b/packages/db/tests/collection-metadata-publication-oracle.property.test.ts
@@ -11,7 +11,9 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import { withHistoryCleanup } from './optimistic-history-oracle.js'
+import { metadataWorlds } from './metadata-publication-worlds.js'
 import type { Collection } from '../src/collection/index.js'
 import type { ChangeMessage, SyncConfig } from '../src/types.js'
 
@@ -50,13 +52,6 @@ type MetadataWrite = { key: number } & MetadataOperation
 type MetadataDriver = (value: unknown) => unknown
 const unchangedMetadata: MetadataDriver = (value) => value
 
-// This grammar contains structured values only. Clone the whole scenario, not
-// each write: aliases within one world stay intact, but cannot rewrite the
-// other world's authority or the original replay input.
-function metadataWorlds<T>(scenario: T): { model: T; driver: T } {
-  return { model: structuredClone(scenario), driver: structuredClone(scenario) }
-}
-
 type PublicationRound = {
   key: number
   delta: number
@@ -576,26 +571,6 @@ async function expectMetadataCancellationOwnership(
   )
 }
 
-it(`keeps metadata aliases within each independent input world`, () => {
-  const value = { nested: 1 }
-  const input = {
-    first: value,
-    second: value,
-    absentValue: undefined,
-    nan: NaN,
-  }
-  const worlds = metadataWorlds(input)
-  for (const world of [worlds.model, worlds.driver]) {
-    expect(world.first).toBe(world.second)
-    expect(world.first).not.toBe(value)
-    expect(world).toEqual(input)
-  }
-  expect(worlds.model.first).not.toBe(worlds.driver.first)
-  worlds.driver.first.nested = 2
-  expect(worlds.model.first.nested).toBe(1)
-  expect(value.nested).toBe(1)
-})
-
 const mutateDriverMetadata: MetadataDriver = (value) => {
   if (typeof value === `object` && value !== null && `nested` in value) {
     value.nested = `corrupted by driver`
@@ -817,6 +792,8 @@ const runCancellationHistory = ({
     initialMetadata,
   )
 
+declareOracle({ check: [applyRound, expectMetadataCancellationOwnership] })
+
 describe(`generated metadata publication histories`, () => {
   if (!oracleReplayRequested()) {
     fcTest.prop([publicationHistoryArbitrary], {
diff --git a/packages/db/tests/collection-metadata-publication.test.ts b/packages/db/tests/collection-metadata-publication.test.ts
new file mode 100644
index 0000000000..e4d3134eed
--- /dev/null
+++ b/packages/db/tests/collection-metadata-publication.test.ts
@@ -0,0 +1,28 @@
+/**
+ * Ordinary tests for the metadata world fixture: a scenario is cloned once per
+ * world, so aliases stay within a world and the replay input stays untouched.
+ * The publication law is owned by
+ * collection-metadata-publication-oracle.property.test.ts.
+ */
+import { expect, it } from 'vitest'
+import { metadataWorlds } from './metadata-publication-worlds.js'
+
+it(`keeps metadata aliases within each independent input world`, () => {
+  const value = { nested: 1 }
+  const input = {
+    first: value,
+    second: value,
+    absentValue: undefined,
+    nan: NaN,
+  }
+  const worlds = metadataWorlds(input)
+  for (const world of [worlds.model, worlds.driver]) {
+    expect(world.first).toBe(world.second)
+    expect(world.first).not.toBe(value)
+    expect(world).toEqual(input)
+  }
+  expect(worlds.model.first).not.toBe(worlds.driver.first)
+  worlds.driver.first.nested = 2
+  expect(worlds.model.first.nested).toBe(1)
+  expect(value.nested).toBe(1)
+})
diff --git a/packages/db/tests/collection-mutation-startup-oracle.test.ts b/packages/db/tests/collection-mutation-startup.test.ts
similarity index 100%
rename from packages/db/tests/collection-mutation-startup-oracle.test.ts
rename to packages/db/tests/collection-mutation-startup.test.ts
diff --git a/packages/db/tests/collection-row-metadata-composition-oracle.test.ts b/packages/db/tests/collection-row-metadata-composition-oracle.test.ts
index ff566c5791..33b9b85f69 100644
--- a/packages/db/tests/collection-row-metadata-composition-oracle.test.ts
+++ b/packages/db/tests/collection-row-metadata-composition-oracle.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
 import { DbClient, collectionOptions } from '../src/client.js'
+import { declareOracle } from './oracle-declaration.js'
 import type { SyncConfig } from '../src/types.js'
 
 /**
@@ -298,6 +299,44 @@ const describeWrite = (write: Write) =>
  *   open, so the Collection rebuilds this transaction's automatic metadata
  *   writes before it commits.
  */
+// The model predicts a lane's row metadata. A write before the history (the
+// earlier write) applies first when it names the same key, and the history
+// then folds over that result.
+function expectedLaneMetadata(
+  start: Start,
+  sequence: ReadonlyArray<Write>,
+  earlier: EarlierWrite | undefined,
+): unknown {
+  return earlier?.key === 1
+    ? foldMetadata(expectedMetadata(start, [asWrite(earlier)]), sequence)
+    : expectedMetadata(start, sequence)
+}
+
+// The observed metadata must equal the model's value, compared as JSON. A
+// mismatch is recorded with its history label instead of failing at once.
+function compareObservedMetadata(
+  mismatches: Array<string>,
+  label: string,
+  actual: unknown,
+  expected: unknown,
+): void {
+  if (JSON.stringify(actual) !== JSON.stringify(expected))
+    mismatches.push(
+      `${label} read ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
+    )
+}
+
+declareOracle({
+  check: [compareObservedMetadata],
+  model: [
+    expectedMetadata,
+    foldMetadata,
+    expectedLaneMetadata,
+    expectedNestedMetadata,
+  ],
+  grammar: [histories, rebuiltHistories, nestedHistories],
+})
+
 async function observeMetadata(
   lane: Lane,
   start: Start,
@@ -621,11 +660,12 @@ describe(`row metadata composition oracle`, () => {
           mismatches.push(`${label} threw ${String(error)}`)
           continue
         }
-        const expected = expectedNestedMetadata(history)
-        if (JSON.stringify(actual) !== JSON.stringify(expected))
-          mismatches.push(
-            `${label} read ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
-          )
+        compareObservedMetadata(
+          mismatches,
+          label,
+          actual,
+          expectedNestedMetadata(history),
+        )
       }
       expect(mismatches).toEqual([])
     },
@@ -655,17 +695,12 @@ describe(`row metadata composition oracle`, () => {
           mismatches.push(`${label} threw ${String(error)}`)
           continue
         }
-        const expected =
-          earlier?.key === 1
-            ? foldMetadata(
-                expectedMetadata(start, [asWrite(earlier)]),
-                sequence,
-              )
-            : expectedMetadata(start, sequence)
-        if (JSON.stringify(actual) !== JSON.stringify(expected))
-          mismatches.push(
-            `${label} read ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
-          )
+        compareObservedMetadata(
+          mismatches,
+          label,
+          actual,
+          expectedLaneMetadata(start, sequence, earlier),
+        )
       }
       expect(mismatches).toEqual([])
     },
diff --git a/packages/db/tests/collection-state-retention-fixture.ts b/packages/db/tests/collection-state-retention-fixture.ts
new file mode 100644
index 0000000000..5c5e27d04b
--- /dev/null
+++ b/packages/db/tests/collection-state-retention-fixture.ts
@@ -0,0 +1,8 @@
+import type { SyncConfig } from '../src/types.js'
+
+export type RetainedRow = {
+  id: number
+  value: number
+}
+
+export type SyncActions = Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
diff --git a/packages/db/tests/collection-state-retention-oracle.property.test.ts b/packages/db/tests/collection-state-retention-oracle.property.test.ts
index 267a1a5be8..64f764319a 100644
--- a/packages/db/tests/collection-state-retention-oracle.property.test.ts
+++ b/packages/db/tests/collection-state-retention-oracle.property.test.ts
@@ -1,26 +1,20 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
-import {
-  DuplicateKeySyncError,
-  SyncQueueInvariantError,
-  SyncTransactionAlreadyCommittedWriteError,
-} from '../src/errors.js'
-import { BTreeIndex } from '../src/indexes/btree-index.js'
-import { createDeferred } from '../src/deferred.js'
-import { createTransaction } from '../src/transactions.js'
-import { whenSyncAccepted } from '../src/sync-receipt.js'
+import { DuplicateKeySyncError } from '../src/errors.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import {
   historyRow,
   optimisticHistory,
-  optimisticStep,
   runOptimisticHistory,
 } from './optimistic-history-oracle.js'
+import type {
+  RetainedRow,
+  SyncActions,
+} from './collection-state-retention-fixture.js'
 import type { OptimisticStep } from './optimistic-history-oracle.js'
-import type { CollectionChangesManager } from '../src/collection/changes.js'
 import type { Collection } from '../src/collection/index.js'
-import type { SyncConfig, TransactionState } from '../src/types.js'
 
 /**
  * Retained collection state is the last accepted source snapshot plus local
@@ -40,13 +34,6 @@ import type { SyncConfig, TransactionState } from '../src/types.js'
  * appears and the commit returns `true`.
  */
 
-type RetainedRow = {
-  id: number
-  value: number
-}
-
-type SyncActions = Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
-
 type RetentionAction =
   | { type: `insert`; row: RetainedRow }
   | { type: `update`; row: RetainedRow }
@@ -220,6 +207,8 @@ function expectRetainedState(
   ).toEqual(expectedRows)
 }
 
+declareOracle({ check: [expectRetainedState] })
+
 async function runRetentionHistory(
   actions: ReadonlyArray<RetentionAction>,
 ): Promise<void> {
@@ -321,1713 +310,128 @@ async function runRetentionHistory(
           // The new run's transaction is open here, so a stale write that
           // reached it would apply with the new run's commit.
           writeFromEndedRun(oldSync)
-          expect(restartedSync.commit()).toBe(true)
-        }
-        const triggerRows = new Map(model)
-        triggerRows.set(expectedTriggerRow.id, expectedTriggerRow)
-        expect(batches).toEqual([
-          {
-            changes: [
-              {
-                type: triggerType,
-                key: expectedTriggerRow.id,
-                row: expectedTriggerRow,
-                previousRow: model.get(expectedTriggerRow.id),
-              },
-            ],
-            rows: [...triggerRows.values()].sort(
-              (left, right) => left.id - right.id,
-            ),
-          },
-          {
-            // This subscriber observed the trigger, but did not request the
-            // earlier initial state. Restart retracts its known old-sync-run row.
-            changes: [
-              {
-                type: `delete`,
-                key: expectedTriggerRow.id,
-                row: expectedTriggerRow,
-                previousRow: undefined,
-              },
-            ],
-            rows: [],
-          },
-          {
-            changes: [
-              {
-                type: `insert`,
-                key: expectedRestartedRow.id,
-                row: expectedRestartedRow,
-                previousRow: undefined,
-              },
-            ],
-            rows: [expectedRestartedRow],
-          },
-        ])
-        subscription.unsubscribe()
-
-        await cleanup
-        model.clear()
-        model.set(expectedRestartedRow.id, expectedRestartedRow)
-      } else {
-        applyAction(action, model, harness.sync)
-      }
-      expectRetainedState(collection, model)
-    }
-  } catch (error) {
-    primaryFailure = error
-    failed = true
-  } finally {
-    try {
-      await collection.cleanup()
-    } catch (error) {
-      cleanupFailure = error
-      cleanupFailed = true
-    }
-  }
-  if (cleanupFailed) {
-    if (failed)
-      throw new AggregateError(
-        [cleanupFailure],
-        `Retention history and cleanup both failed`,
-        { cause: primaryFailure },
-      )
-    throw cleanupFailure
-  }
-  if (failed) throw primaryFailure
-}
-
-it(`retains only keys in the authoritative synced state`, async () => {
-  await runRetentionHistory([
-    { type: `insert`, row: { id: 1, value: 1 } },
-    { type: `insert`, row: { id: 2, value: 2 } },
-    { type: `delete`, key: 1 },
-    { type: `update`, row: { id: 1, value: -1 } },
-    { type: `replace`, rows: [{ id: 3, value: 0 }] },
-    { type: `delete`, key: 3 },
-  ])
-})
-
-it(`retains a missing row introduced by a sync update`, async () => {
-  await runRetentionHistory([{ type: `update`, row: { id: 1, value: 1 } }])
-})
-
-it.each(
-  ([`insert`, `update`] as const).flatMap((triggerType) =>
-    ([`insideListener`, `afterOldReturn`] as const).map(
-      (commitPhase) => [triggerType, commitPhase] as const,
-    ),
-  ),
-)(
-  `retains an old-sync-run %s and a restarted row committed %s`,
-  async (triggerType, commitPhase) => {
-    await runRetentionHistory([
-      ...(triggerType === `update`
-        ? ([{ type: `insert`, row: { id: 1, value: 1 } }] as const)
-        : []),
-      {
-        type: `reentrantRestart`,
-        row: { id: 1, value: 1 },
-        commitPhase,
-      },
-    ])
-  },
-)
-
-it(`releases retained keys after long unique-key churn`, async () => {
-  const keyCount = 1_000
-  const actions: Array<RetentionAction> = []
-  for (let key = 0; key < keyCount; key++) {
-    actions.push({ type: `insert`, row: { id: key, value: key } })
-    actions.push({ type: `delete`, key })
-  }
-
-  await runRetentionHistory(actions)
-})
-
-it(`starts a new sync run without retained publication state`, async () => {
-  let sync!: SyncActions
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-  const events: Array<{ type: string; key: string | number }> = []
-  let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
-
-  try {
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-    expect(sync.commit()).toBe(true)
-
-    subscription = collection.subscribeChanges(
-      (changes) => {
-        events.push(
-          ...changes.map((change) => ({
-            type: change.type,
-            key: change.key,
-          })),
-        )
-      },
-      { includeInitialState: false },
-    )
-
-    sync.begin()
-    sync.write({ type: `update`, value: { id: 1, value: 2 } })
-    // Stand in for an accepted transaction held behind a mutation; only
-    // accepted transactions publish in a drain.
-    collection._state.pendingSyncedTransactions.at(-1)!.committed = true
-    collection._state.capturePreSyncVisibleState()
-    expect(collection._state.preSyncVisibleState.size).toBe(1)
-    expect(collection._state.recentlySyncedKeys).toEqual(new Set([1]))
-
-    const cleanup = collection.cleanup()
-    const retainedAfterCleanup = {
-      visibleRows: collection._state.preSyncVisibleState.size,
-      virtualRows: collection._state.preSyncVirtualState.size,
-      recentKeys: collection._state.recentlySyncedKeys.size,
-    }
-    await cleanup
-
-    events.length = 0
-    collection.startSyncImmediate()
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 3 } })
-    expect(sync.commit()).toBe(true)
-
-    expect({ retainedAfterCleanup, events }).toEqual({
-      retainedAfterCleanup: { visibleRows: 0, virtualRows: 0, recentKeys: 0 },
-      events: [{ type: `insert`, key: 1 }],
-    })
-  } finally {
-    subscription?.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
-it(`keeps a restarted sync run's publication state after the old listener returns`, async () => {
-  let sync!: SyncActions
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-  let cleanup: Promise<void> | undefined
-  let restarted = false
-  const subscription = collection.subscribeChanges(
-    () => {
-      if (restarted) return
-      restarted = true
-      cleanup = collection.cleanup()
-      collection.startSyncImmediate()
-      collection._state.preSyncVisibleState.set(2, { id: 2, value: 2 })
-      collection._state.recentlySyncedKeys.add(2)
-    },
-    { includeInitialState: false },
-  )
-
-  try {
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-    expect(sync.commit()).toBe(true)
-
-    expect(restarted).toBe(true)
-    expect(collection._state.preSyncVisibleState).toEqual(
-      new Map([[2, { id: 2, value: 2 }]]),
-    )
-    expect(collection._state.recentlySyncedKeys).toEqual(new Set([2]))
-    expect(collection._state.hasReceivedFirstCommit).toBe(false)
-
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 3, value: 3 } })
-    expect(sync.commit()).toBe(true)
-    expect(collection._state.preSyncVisibleState.size).toBe(0)
-    expect(collection._state.preSyncVirtualState.size).toBe(0)
-    expect(collection._state.hasReceivedFirstCommit).toBe(true)
-    await Promise.resolve()
-    expect(collection._state.recentlySyncedKeys.size).toBe(0)
-    await cleanup
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
-it(`does not let an old publication microtask clear restarted sync state`, async () => {
-  let sync!: SyncActions
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-
-  try {
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-    expect(sync.commit()).toBe(true)
-
-    const cleanup = collection.cleanup()
-    collection.startSyncImmediate()
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 2, value: 2 } })
-    // Stand in for an accepted transaction held behind a mutation.
-    collection._state.pendingSyncedTransactions.at(-1)!.committed = true
-    collection._state.capturePreSyncVisibleState()
-    expect(collection._state.recentlySyncedKeys).toEqual(new Set([2]))
-
-    await Promise.resolve()
-
-    expect(collection._state.recentlySyncedKeys).toEqual(new Set([2]))
-
-    collection._state.pendingSyncedTransactions.at(-1)!.committed = false
-    expect(sync.commit()).toBe(true)
-    expect(collection._state.hasReceivedFirstCommit).toBe(true)
-    await Promise.resolve()
-    expect(collection._state.preSyncVisibleState.size).toBe(0)
-    expect(collection._state.preSyncVirtualState.size).toBe(0)
-    expect(collection._state.recentlySyncedKeys.size).toBe(0)
-    await cleanup
-  } finally {
-    await collection.cleanup()
-  }
-})
-
-it(`publishes a virtual-state update when a restarted optimistic row is confirmed`, async () => {
-  let sync!: SyncActions
-  let syncRunCount = 0
-  let releaseMutation!: () => void
-  const mutationHold = new Promise<void>((resolve) => {
-    releaseMutation = resolve
-  })
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        syncRunCount++
-        if (syncRunCount === 1) actions.markReady()
-      },
-    },
-  })
-  type ObservedRow = RetainedRow & {
-    $collectionId: string
-    $key: number
-    $origin: `local` | `remote`
-    $hasPendingWrites: boolean
-    $synced: boolean
-  }
-  type ObservedChange = {
-    type: string
-    key: string | number
-    value: ObservedRow
-    previousValue?: ObservedRow
-  }
-  const snapshotRow = (row: ObservedRow): ObservedRow => ({
-    id: row.id,
-    value: row.value,
-    $collectionId: row.$collectionId,
-    $key: row.$key,
-    $origin: row.$origin,
-    $hasPendingWrites: row.$hasPendingWrites,
-    $synced: row.$synced,
-  })
-  const publications: Array<{
-    changes: Array<ObservedChange>
-    rows: Array<ObservedRow>
-  }> = []
-  const restartStatuses: Array<string> = []
-  const settlementTimeline: Array<`publication` | `receipt`> = []
-  let restarted = false
-  let readMutationState: (() => TransactionState) | undefined
-  let rollbackMutation: (() => void) | undefined
-  let mutationCommit: Promise<unknown> | undefined
-  let syncReceipt: ReturnType<SyncActions[`commit`]> | undefined
-  const subscription = collection.subscribeChanges(
-    (changes) => {
-      publications.push({
-        changes: changes.map(({ type, key, value, previousValue }) => ({
-          type,
-          key,
-          value: snapshotRow(value),
-          ...(previousValue === undefined
-            ? {}
-            : { previousValue: snapshotRow(previousValue) }),
-        })),
-        rows: [...collection.state.values()].map(snapshotRow),
-      })
-      if (changes.some(({ type, key }) => type === `update` && key === 2)) {
-        queueMicrotask(() => settlementTimeline.push(`publication`))
-      }
-      if (restarted || !changes.some(({ key }) => key === 1)) return
-
-      restarted = true
-      restartStatuses.push(collection.status)
-      void collection.cleanup()
-      restartStatuses.push(collection.status)
-      collection.startSyncImmediate()
-      restartStatuses.push(collection.status)
-      sync.markReady()
-      restartStatuses.push(collection.status)
-
-      const transaction = createTransaction({
-        autoCommit: false,
-        mutationFn: () => mutationHold,
-      })
-      readMutationState = () => transaction.state
-      rollbackMutation = () => transaction.rollback()
-      void transaction.isPersisted.promise.catch(() => undefined)
-      transaction.mutate(() => collection.insert({ id: 2, value: 2 }))
-      mutationCommit = transaction.commit()
-
-      sync.begin()
-      sync.write({ type: `insert`, value: { id: 2, value: 2 } })
-      syncReceipt = sync.commit()
-    },
-    { includeInitialState: false },
-  )
-
-  try {
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-    expect(sync.commit()).toBe(true)
-
-    const remoteRow = (id: number): ObservedRow => ({
-      id,
-      value: id,
-      $collectionId: collection.id,
-      $key: id,
-      $origin: `remote`,
-      $hasPendingWrites: false,
-      $synced: true,
-    })
-    const localRow = (id: number): ObservedRow => ({
-      id,
-      value: id,
-      $collectionId: collection.id,
-      $key: id,
-      $origin: `local`,
-      $hasPendingWrites: true,
-      $synced: false,
-    })
-    const expectedPublications = [
-      {
-        changes: [{ type: `insert`, key: 1, value: remoteRow(1) }],
-        rows: [remoteRow(1)],
-      },
-      { changes: [{ type: `delete`, key: 1, value: remoteRow(1) }], rows: [] },
-      {
-        changes: [{ type: `insert`, key: 2, value: localRow(2) }],
-        rows: [localRow(2)],
-      },
-      {
-        changes: [
-          {
-            type: `update`,
-            key: 2,
-            value: remoteRow(2),
-            previousValue: localRow(2),
-          },
-        ],
-        rows: [remoteRow(2)],
-      },
-    ]
-    expect(publications).toEqual(expectedPublications.slice(0, 3))
-    expect([...collection.state.keys()]).toEqual([2])
-    expect(restartStatuses).toEqual([`ready`, `cleaned-up`, `loading`, `ready`])
-    expect(collection.status).toBe(`ready`)
-
-    // The restarted sync run's commit is accepted at once and parked behind
-    // the persisting mutation; the rollback publishes it.
-    expect(syncReceipt).not.toBe(true)
-    expect(collection._state.pendingSyncedTransactions.at(-1)?.committed).toBe(
-      true,
-    )
-    expect(rollbackMutation).toBeDefined()
-    await Promise.resolve()
-    expect(settlementTimeline).toEqual([])
-
-    rollbackMutation?.()
-    expect(publications).toEqual(expectedPublications)
-    await Promise.resolve()
-    expect(settlementTimeline).toEqual([`publication`])
-    expect(publications).toEqual(expectedPublications)
-    expect([...collection.state.values()].map(snapshotRow)).toEqual([
-      remoteRow(2),
-    ])
-
-    releaseMutation()
-    await mutationCommit
-    expect(readMutationState?.()).toBe(`failed`)
-    expect(publications).toEqual(expectedPublications)
-    expect([...collection.state.values()].map(snapshotRow)).toEqual([
-      remoteRow(2),
-    ])
-  } finally {
-    releaseMutation()
-    await mutationCommit
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
-type LivePreviousRow = {
-  id: number
-  value: number | null | undefined
-}
-
-function observeValuePublications(
-  collection: Collection<LivePreviousRow, number>,
-  includeInitialState = false,
-) {
-  const publications: Array<
-    Array<{
-      type: string
-      key: string | number
-      value: LivePreviousRow[`value`]
-      previousValue: LivePreviousRow[`value`]
-    }>
-  > = []
-  const subscription = collection.subscribeChanges(
-    (changes) =>
-      publications.push(
-        changes.map((change) => ({
-          type: change.type,
-          key: change.key,
-          value: change.value.value,
-          previousValue: change.previousValue?.value,
-        })),
-      ),
-    { includeInitialState },
-  )
-  return { publications, subscription }
-}
-
-async function runImmutablePreviousValuePublication(
-  initial: LivePreviousRow[`value`],
-  updates: ReadonlyArray<LivePreviousRow[`value`]>,
-) {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  let liveValue = initial
-  let writes = 0
-  const liveRow = {
-    id: 1,
-    get value() {
-      return liveValue
-    },
-  }
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: liveRow })
-        actions.write({ type: `insert`, value: { id: 2, value: 10 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const { publications, subscription } = observeValuePublications(collection)
-  try {
-    sync.begin()
-    let previousValue = initial
-    for (const value of updates) {
-      liveValue = value
-      sync.write({
-        type: `update`,
-        value: liveRow,
-        previousValue: { id: 1, value: previousValue },
-      })
-      writes++
-      previousValue = value
-    }
-    sync.write({
-      type: `update`,
-      value: { id: 2, value: 11 },
-      previousValue: { id: 2, value: 10 },
-    })
-    writes++
-    expect(sync.commit(), `live-value sync commit reached`).toBe(true)
-    expect(writes, `all live-value writes reached`).toBe(updates.length + 1)
-    expect(publications).toStrictEqual([
-      [
-        {
-          type: `update`,
-          key: 1,
-          value: updates.at(-1),
-          previousValue: initial,
-        },
-        {
-          type: `update`,
-          key: 2,
-          value: 11,
-          previousValue: 10,
-        },
-      ],
-    ])
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
-}
-
-// Replay of a review probe. A transaction begun inside an open one commits
-// and applies first; replay then invalidates the open transaction's insert.
-// The accepted transaction's receipt resolves, and the open one's commit
-// rejects with DuplicateKeySyncError.
-it(`rejects an open transaction that a later nested commit invalidates`, async () => {
-  let sync!: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-    sync.begin()
-    sync.write({ type: `update`, value: { id: 1, value: 2 } })
-    expect(sync.commit()).toBe(true)
-    const rejected = sync.commit()
-    expect(rejected).toBeInstanceOf(Promise)
-    await expect(rejected).rejects.toBeInstanceOf(DuplicateKeySyncError)
-    // Core never accepted the transaction, so its acceptance moment rejects too.
-    await expect(
-      Promise.resolve(whenSyncAccepted(rejected)),
-    ).rejects.toBeInstanceOf(DuplicateKeySyncError)
-    expect(collection.get(1)?.value).toBe(2)
-    expect(collection._state.pendingSyncedTransactions).toHaveLength(0)
-  } finally {
-    await collection.cleanup()
-  }
-})
-
-// After a replay invalidates the open transaction, its later writes must not
-// change what a newer transaction sees. Each write below would leak into the
-// projection: an insert of key 9 would make the newer insert of key 9 a
-// duplicate, and a delete of key 1 would let the newer insert of key 1 pass.
-// The newer transaction sees only the accepted row 1, as if the invalidated
-// transaction wrote nothing after its invalidation.
-it.each([
-  {
-    late: { type: `insert`, value: { id: 9, value: 1 } },
-    newer: { id: 9, value: 3 },
-    duplicate: false,
-  },
-  {
-    late: { type: `delete`, key: 1 },
-    newer: { id: 1, value: 3 },
-    duplicate: true,
-  },
-] as const)(
-  `ignores writes to an invalidated transaction: late $late.type`,
-  async ({ late, newer, duplicate }) => {
-    let sync!: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
-    const collection = createCollection<RetainedRow, number>({
-      getKey: (row) => row.id,
-      startSync: true,
-      sync: {
-        sync: (actions) => {
-          sync = actions
-          actions.markReady()
-        },
-      },
-    })
-    try {
-      await collection.stateWhenReady()
-      sync.begin()
-      sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-      sync.begin()
-      sync.write({ type: `update`, value: { id: 1, value: 2 } })
-      expect(sync.commit()).toBe(true)
-      // The premise: the replay has already invalidated the open transaction.
-      expect(
-        collection._state.pendingSyncedTransactions.at(-1)?.invalidationError,
-      ).toBeInstanceOf(DuplicateKeySyncError)
-      sync.write(late)
-      sync.begin()
-      const write = () => sync.write({ type: `insert`, value: newer })
-      if (duplicate) expect(write).toThrow(DuplicateKeySyncError)
-      else write()
-      expect(sync.commit()).toBe(true)
-      await expect(sync.commit()).rejects.toBeInstanceOf(DuplicateKeySyncError)
-      expect(
-        [...collection.state.values()].map(({ id, value }) => [id, value]),
-      ).toEqual(
-        duplicate
-          ? [[1, 2]]
-          : [
-              [1, 2],
-              [newer.id, newer.value],
-            ],
-      )
-    } finally {
-      await collection.cleanup()
-    }
-  },
-)
-
-// No public path can make a committed queued transaction invalid on replay:
-// only the open last transaction can be canceled. A replay that finds one is
-// an invariant failure, not a recoverable rejection.
-it(`throws an invariant error when replay finds an invalid committed transaction`, async () => {
-  // Current callers cannot create this queue state. Exercise the internal
-  // recovery boundary so a future refresh caller cannot strand its receipt.
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({ type: `insert`, value: { id: 1, value: 0 } })
-        commit()
-        markReady()
-      },
-    },
-  })
-  const applied = createDeferred<void>()
-  void applied.promise.catch(() => undefined)
-  const pending = {
-    committed: true,
-    applicationStarted: false,
-    layoutChanged: false,
-    operations: [
-      {
-        type: `insert` as const,
-        originalSyncType: `insert` as const,
-        key: 1,
-        value: { id: 1, value: 2 },
-      },
-    ],
-    rowMetadataWrites: new Map(),
-    explicitRowMetadataWrites: new Map(),
-    collectionMetadataWrites: new Map(),
-    applied,
-  }
-  const validApplied = createDeferred<void>()
-  void validApplied.promise.catch(() => undefined)
-  const valid = {
-    ...pending,
-    operations: [
-      {
-        ...pending.operations[0]!,
-        key: 2,
-        value: { id: 2, value: 2 },
-      },
-    ],
-    applied: validApplied,
-  }
-
-  let primaryFailure: unknown
-  let hasPrimaryFailure = false
-  try {
-    await collection.stateWhenReady()
-    collection._state.pendingSyncedTransactions.push(valid, pending)
-    expect(() => collection._state.refreshPendingSyncedProjection()).toThrow(
-      SyncQueueInvariantError,
-    )
-    expect(collection.get(1)?.value).toBe(0)
-  } catch (error) {
-    primaryFailure = error
-    hasPrimaryFailure = true
-  }
-
-  const cleanupFailures: Array<unknown> = []
-  try {
-    for (const transaction of [pending, valid]) {
-      const index =
-        collection._state.pendingSyncedTransactions.indexOf(transaction)
-      if (index !== -1)
-        collection._state.pendingSyncedTransactions.splice(index, 1)
-    }
-    if (applied.isPending()) applied.resolve()
-    if (validApplied.isPending()) validApplied.resolve()
-    collection._state.refreshPendingSyncedProjection()
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  try {
-    await collection.cleanup()
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  if (hasPrimaryFailure && cleanupFailures.length > 0) {
-    throw new AggregateError(
-      [primaryFailure, ...cleanupFailures],
-      `Projection refresh and cleanup both failed`,
-      { cause: primaryFailure },
-    )
-  }
-  if (hasPrimaryFailure) throw primaryFailure
-  if (cleanupFailures.length > 0)
-    throw new AggregateError(
-      cleanupFailures,
-      `Projection refresh cleanup failed`,
-    )
-})
-
-it.each([
-  { initial: 0, updates: [1] },
-  { initial: 0, updates: [1, 2] },
-  { initial: null, updates: [1] },
-  { initial: undefined, updates: [1] },
-] satisfies Array<{
-  initial: LivePreviousRow[`value`]
-  updates: Array<LivePreviousRow[`value`]>
-}>)(
-  `publishes a live value from immutable previous state: %j`,
-  async ({ initial, updates }) => {
-    await runImmutablePreviousValuePublication(initial, updates)
-  },
-)
-
-it(`keeps the first queued before-image when metadata reserves the key`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  let liveValue: LivePreviousRow[`value`] = 0
-  const liveRow = {
-    id: 1,
-    get value() {
-      return liveValue
-    },
-  }
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: liveRow })
-        actions.write({ type: `insert`, value: { id: 2, value: 0 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  let release!: () => void
-  const hold = new Promise<void>((resolve) => {
-    release = resolve
-  })
-  const blocker = createTransaction<LivePreviousRow>({
-    autoCommit: false,
-    mutationFn: () => hold,
-  })
-  await collection.stateWhenReady()
-  const { publications, subscription } = observeValuePublications(collection)
-  const receipts: Array<Promise<void>> = []
-  let blockerCommit: Promise<unknown> | undefined
-
-  const commitQueuedSync = () => {
-    expect(sync.commit(), `persisting work queues sync`).not.toBe(true)
-    expect(
-      collection._state.pendingSyncedTransactions.at(-1)?.committed,
-      `persisting work queues sync`,
-    ).toBe(true)
-  }
-
-  try {
-    blocker.mutate(() =>
-      collection.update(2, (draft) => {
-        draft.value = 20
-      }),
-    )
-    publications.length = 0
-    blockerCommit = blocker.commit()
-    await Promise.resolve()
-
-    sync.begin()
-    sync.metadata!.row.set(1, { phase: `metadata-first` })
-    commitQueuedSync()
-
-    liveValue = 1
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: liveRow,
-      previousValue: { id: 1, value: 0 },
-    })
-    commitQueuedSync()
-
-    liveValue = 2
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: liveRow,
-      previousValue: { id: 1, value: 1 },
-    })
-    commitQueuedSync()
-
-    release()
-    await blockerCommit
-    await Promise.all(receipts)
-
-    expect(
-      publications.flat().filter(({ key }) => key === 1),
-      `the queued drain publishes one complete key transition`,
-    ).toStrictEqual([{ type: `update`, key: 1, value: 2, previousValue: 0 }])
-    expect(collection._state.syncedMetadata.get(1)).toStrictEqual({
-      phase: `metadata-first`,
-    })
-  } finally {
-    release()
-    if (blocker.state === `pending` || blocker.state === `persisting`)
-      blocker.rollback()
-    await blockerCommit?.catch(() => undefined)
-    subscription.unsubscribe()
-    await collection.cleanup()
-    await Promise.allSettled(receipts)
-  }
-})
-
-type ParkedSyncHarness = {
-  collection: Collection<RetainedRow, number>
-  sync: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
-  releasePersistence: () => Promise<void>
-}
-
-async function withParkedSync(
-  initialRows: ReadonlyArray<RetainedRow>,
-  run: (harness: ParkedSyncHarness) => Promise<void>,
-  rowUpdateMode: `partial` | `full` = `full`,
-): Promise<void> {
-  let sync!: ParkedSyncHarness[`sync`]
-  let release!: () => void
-  const persistence = new Promise<void>((resolve) => {
-    release = resolve
-  })
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        for (const row of initialRows)
-          actions.write({ type: `insert`, value: row })
-        actions.write({ type: `insert`, value: { id: 2, value: 0 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const blocker = createTransaction<RetainedRow>({
-    autoCommit: false,
-    mutationFn: () => persistence,
-  })
-  let blockerCommit: Promise<unknown> | undefined
-  let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
-  const publicRows = () =>
-    [...collection.state]
-      .map(([key, row]) => [key, row.value] as const)
-      .sort(([left], [right]) => left - right)
-  const mirror = new Map<number, number>(
-    initialRows.map(({ id, value }) => [id, value]),
-  )
-  mirror.set(2, 0)
-  const publications: Array<{
-    publicRows: Array<readonly [number, number]>
-    mirrorRows: Array<[number, number]>
-  }> = []
-  const mirrorRows = () => [...mirror].sort(([left], [right]) => left - right)
-  let primaryFailure: unknown
-  let hasPrimaryFailure = false
-
-  try {
-    await collection.stateWhenReady()
-    expect(publicRows()).toEqual(mirrorRows())
-    subscription = collection.subscribeChanges(
-      (changes) => {
-        for (const change of changes) {
-          if (change.type === `delete`) mirror.delete(change.key)
-          else mirror.set(change.key, change.value.value)
-        }
-        publications.push({
-          publicRows: publicRows(),
-          mirrorRows: mirrorRows(),
-        })
-      },
-      { includeInitialState: false },
-    )
-    blocker.mutate(() =>
-      collection.update(2, (draft) => {
-        draft.value = 1
-      }),
-    )
-    blockerCommit = blocker.commit()
-    await Promise.resolve()
-    expect(blocker.state).toBe(`persisting`)
-    await run({
-      collection,
-      sync,
-      releasePersistence: async () => {
-        release()
-        await blockerCommit
-      },
-    })
-    for (const publication of publications) {
-      expect(publication.mirrorRows).toEqual(publication.publicRows)
-    }
-    expect(mirrorRows()).toEqual(publicRows())
-  } catch (error) {
-    primaryFailure = error
-    hasPrimaryFailure = true
-  }
-
-  const cleanupFailures: Array<unknown> = []
-  try {
-    release()
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  try {
-    if (blocker.state === `pending` || blocker.state === `persisting`)
-      blocker.rollback()
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  try {
-    await blockerCommit?.catch(() => undefined)
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  try {
-    subscription?.unsubscribe()
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  try {
-    await collection.cleanup()
-  } catch (error) {
-    cleanupFailures.push(error)
-  }
-  if (hasPrimaryFailure && cleanupFailures.length > 0) {
-    throw new AggregateError(
-      [primaryFailure, ...cleanupFailures],
-      `Queued sync oracle and cleanup both failed`,
-      { cause: primaryFailure },
-    )
-  }
-  if (hasPrimaryFailure) throw primaryFailure
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(cleanupFailures, `Queued sync cleanup failed`, {
-      cause: cleanupFailures[0],
-    })
-  }
-}
-
-it(`keeps queued snapshot admission work linear in the row count`, async () => {
-  let sync!: ParkedSyncHarness[`sync`]
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    const pending = collection._state.pendingSyncedTransactions.at(-1)
-    if (!pending) throw new Error(`missing active sync transaction`)
-
-    let inspectedOperations = 0
-    const operations = pending.operations
-    pending.operations = new Proxy(operations, {
-      get(target, property, receiver) {
-        if (property !== Symbol.iterator)
-          return Reflect.get(target, property, receiver)
-        return function* () {
-          for (const operation of target) {
-            inspectedOperations++
-            yield operation
-          }
-        }
-      },
-    })
-
-    const rowCount = 64
-    for (let id = 0; id < rowCount; id++) {
-      sync.write({ type: `insert`, value: { id, value: id } })
-    }
-    const receipt = sync.commit()
-    if (receipt !== true) await receipt
-
-    // Application and publication each make one linear pass. Admission must
-    // not add a triangular scan over the rows already staged in this batch.
-    expect(inspectedOperations).toBeLessThanOrEqual(rowCount * 2)
-  } finally {
-    await collection.cleanup()
-  }
-})
-
-// A committed source batch that waits for persistence is closed to writes.
-// Without the check, a late write would join the queued batch.
-it(`rejects a write to a committed batch that waits for persistence`, async () => {
-  await withParkedSync(
-    [{ id: 1, value: 0 }],
-    async ({ collection, sync, releasePersistence }) => {
-      sync.begin()
-      sync.write({ type: `update`, value: { id: 1, value: 1 } })
-      const receipt = sync.commit()
-      expect(
-        collection._state.pendingSyncedTransactions.at(-1)?.committed,
-      ).toBe(true)
-
-      expect(() =>
-        sync.write({ type: `update`, value: { id: 1, value: 2 } }),
-      ).toThrow(SyncTransactionAlreadyCommittedWriteError)
-
-      await releasePersistence()
-      await receipt
-      expect(collection.get(1)?.value).toBe(1)
-    },
-  )
-})
-
-it.each([
-  { label: `no source row`, base: `absent` },
-  { label: `a same-transaction delete`, base: `deleted` },
-  { label: `a same-transaction truncate`, base: `truncated` },
-] as const)(
-  `keeps an independent partial upsert after $label`,
-  async ({ base }) => {
-    await withParkedSync(
-      base === `absent` ? [] : [{ id: 1, value: 0 }],
-      async ({ collection, sync, releasePersistence }) => {
-        sync.begin()
-        if (base === `deleted`) sync.write({ type: `delete`, key: 1 })
-        if (base === `truncated`) sync.truncate()
-        sync.write({ type: `update`, value: { id: 1, value: 2 } })
-        const receipt = sync.commit()
-        await releasePersistence()
-        if (receipt !== true) await receipt
-        expect(collection._state.syncedData.get(1)).toEqual({ id: 1, value: 2 })
-        expect(collection.get(1)?.value).toBe(2)
-      },
-      `partial`,
-    )
-  },
-)
-
-it(`applies a partial update after an insert in the same sync transaction`, async () => {
-  await withParkedSync(
-    [],
-    async ({ collection, sync, releasePersistence }) => {
-      sync.begin()
-      sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-      sync.write({ type: `update`, value: { id: 1, value: 2 } })
-      const receipt = sync.commit()
-      expect(
-        collection._state.pendingSyncedTransactions.at(-1)?.committed,
-      ).toBe(true)
-      await releasePersistence()
-      await receipt
-      expect(collection._state.syncedData.get(1)).toEqual({ id: 1, value: 2 })
-      expect(collection.get(1)?.value).toBe(2)
-    },
-    `partial`,
-  )
-})
-
-it.each([
-  { label: `an earlier queued insert`, predecessor: `earlier` },
-  { label: `an insert in the same transaction`, predecessor: `same` },
-] as const)(
-  `rejects a duplicate insert after $label`,
-  async ({ predecessor }) => {
-    // The source Map contains the first queued insert before the second write is
-    // admitted. The duplicate-key law is independent of whether the first row
-    // has already crossed the public publication boundary.
-    await withParkedSync(
-      [],
-      async ({ collection, sync, releasePersistence }) => {
-        sync.begin()
-        sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-        let firstReceipt: true | Promise<void> | undefined
-        if (predecessor === `earlier`) {
-          firstReceipt = sync.commit()
-          expect(
-            collection._state.pendingSyncedTransactions.at(-1)?.committed,
-          ).toBe(true)
-          sync.begin()
-        }
-        expect(() =>
-          sync.write({ type: `insert`, value: { id: 1, value: 2 } }),
-        ).toThrow(DuplicateKeySyncError)
-        firstReceipt ??= sync.commit()
-
-        await releasePersistence()
-        if (firstReceipt !== true) await firstReceipt
-        expect(collection._state.syncedData.get(1)).toEqual({ id: 1, value: 1 })
-      },
-    )
-  },
-)
-
-it(`snapshots a buffered delete before its row object is reused`, async () => {
-  const reusedRow: LivePreviousRow = { id: 1, value: 0 }
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      sync: (actions) => {
-        actions.begin()
-        actions.write({ type: `insert`, value: reusedRow })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const publications: Array<
-    Array<{
-      type: string
-      value: LivePreviousRow[`value`]
-      previousValue: LivePreviousRow[`value`]
-      previousSynced: boolean | undefined
-      previousOrigin: string | undefined
-    }>
-  > = []
-  const subscription = collection.subscribeChanges(
-    (changes) =>
-      publications.push(
-        changes.map((change) => {
-          const previous = change.previousValue as
-            | (LivePreviousRow & { $synced: boolean; $origin: string })
-            | undefined
-          return {
-            type: change.type,
-            value: change.value.value,
-            previousValue: previous?.value,
-            previousSynced: previous?.$synced,
-            previousOrigin: previous?.$origin,
-          }
-        }),
-      ),
-    { includeInitialState: true },
-  )
-  const changes = (
-    collection as unknown as {
-      _changes: CollectionChangesManager<LivePreviousRow, number>
-    }
-  )._changes
-
-  try {
-    await collection.stateWhenReady()
-    publications.length = 0
-    changes.shouldBatchEvents = true
-    changes.emitEvents([{ type: `delete`, key: 1, value: reusedRow }])
-    expect(publications, `delete remains buffered`).toStrictEqual([])
-
-    reusedRow.value = 1
-    collection._state.optimisticUpserts.set(1, reusedRow)
-    changes.emitEvents(
-      [{ type: `insert`, key: 1, value: { ...reusedRow } }],
-      true,
-    )
-    expect(publications).toStrictEqual([
-      [
-        {
-          type: `update`,
-          value: 1,
-          previousValue: 0,
-          previousSynced: true,
-          previousOrigin: `remote`,
-        },
-      ],
-    ])
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
-it(`uses the preserved visible row when rollback releases a queued sync`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  let rejectPersistence!: (error: Error) => void
-  const persistenceGate = new Promise<void>((_resolve, reject) => {
-    rejectPersistence = reject
-  })
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const transaction = createTransaction<LivePreviousRow>({
-    autoCommit: false,
-    mutationFn: () => persistenceGate,
-  })
-  const publications = observeValuePublications(collection)
-
-  try {
-    await collection.stateWhenReady()
-    const index = collection.createIndex((row) => row.value, {
-      indexType: BTreeIndex,
-    })
-    transaction.mutate(() =>
-      collection.update(1, (draft) => {
-        draft.value = 1
-      }),
-    )
-    publications.publications.length = 0
-    const commit = transaction.commit()
-    await Promise.resolve()
-
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 2 },
-      previousValue: { id: 1, value: 0 },
-    })
-    const receipt = sync.commit()
-    expect(receipt).not.toBe(true)
-    expect(collection._state.pendingSyncedTransactions.at(-1)?.committed).toBe(
-      true,
-    )
-
-    const failure = new Error(`queued mutation failed`)
-    rejectPersistence(failure)
-    await expect(commit).rejects.toBe(failure)
-    if (receipt !== true) await receipt
-
-    expect(collection.get(1)?.value).toBe(2)
-    expect(publications.publications).toStrictEqual([
-      [{ type: `update`, key: 1, value: 2, previousValue: 1 }],
-    ])
-    expect(index.lookup(`eq`, 0)).toEqual(new Set())
-    expect(index.lookup(`eq`, 1)).toEqual(new Set())
-    expect(index.lookup(`eq`, 2)).toEqual(new Set([1]))
-  } finally {
-    publications.subscription.unsubscribe()
-    if (transaction.state === `pending` || transaction.state === `persisting`)
-      transaction.rollback()
-    await collection.cleanup()
-  }
-})
-
-it(`publishes a provider update for an unseen key as an insert`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-  const publications = observeValuePublications(collection, true)
-
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 1 },
-      previousValue: { id: 1, value: 0 },
-    })
-    expect(sync.commit()).toBe(true)
-    expect(publications.publications).toStrictEqual([
-      [],
-      [{ type: `insert`, key: 1, value: 1, previousValue: undefined }],
-    ])
-  } finally {
-    publications.subscription.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
-it(`suppresses a replacement-object redelivery with a stale before-image`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: { id: 1, value: 1 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const publications = observeValuePublications(collection)
+          expect(restartedSync.commit()).toBe(true)
+        }
+        const triggerRows = new Map(model)
+        triggerRows.set(expectedTriggerRow.id, expectedTriggerRow)
+        expect(batches).toEqual([
+          {
+            changes: [
+              {
+                type: triggerType,
+                key: expectedTriggerRow.id,
+                row: expectedTriggerRow,
+                previousRow: model.get(expectedTriggerRow.id),
+              },
+            ],
+            rows: [...triggerRows.values()].sort(
+              (left, right) => left.id - right.id,
+            ),
+          },
+          {
+            // This subscriber observed the trigger, but did not request the
+            // earlier initial state. Restart retracts its known old-sync-run row.
+            changes: [
+              {
+                type: `delete`,
+                key: expectedTriggerRow.id,
+                row: expectedTriggerRow,
+                previousRow: undefined,
+              },
+            ],
+            rows: [],
+          },
+          {
+            changes: [
+              {
+                type: `insert`,
+                key: expectedRestartedRow.id,
+                row: expectedRestartedRow,
+                previousRow: undefined,
+              },
+            ],
+            rows: [expectedRestartedRow],
+          },
+        ])
+        subscription.unsubscribe()
 
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 1 },
-      previousValue: { id: 1, value: 0 },
-    })
-    expect(sync.commit()).toBe(true)
-    expect(publications.publications).toStrictEqual([])
+        await cleanup
+        model.clear()
+        model.set(expectedRestartedRow.id, expectedRestartedRow)
+      } else {
+        applyAction(action, model, harness.sync)
+      }
+      expectRetainedState(collection, model)
+    }
+  } catch (error) {
+    primaryFailure = error
+    failed = true
   } finally {
-    publications.subscription.unsubscribe()
-    await collection.cleanup()
+    try {
+      await collection.cleanup()
+    } catch (error) {
+      cleanupFailure = error
+      cleanupFailed = true
+    }
   }
-})
-
-it(`suppresses a replacement object's partial before-image without index drift`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: { id: 1, value: 1 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const publications = observeValuePublications(collection)
-
-  try {
-    await collection.stateWhenReady()
-    const index = collection.createIndex((row) => row.value, {
-      indexType: BTreeIndex,
-    })
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 1 },
-      previousValue: { id: 1 } as LivePreviousRow,
-    })
-    expect(sync.commit()).toBe(true)
-
-    expect(
-      {
-        publications: publications.publications,
-        indexed: index.lookup(`eq`, 1),
-        rangeDomains: (
-          index as unknown as {
-            rangeValueDomains: Map<string, number>
-          }
-        ).rangeValueDomains,
-      },
-      `partial before-image observation`,
-    ).toStrictEqual({
-      publications: [],
-      indexed: new Set([1]),
-      rangeDomains: new Map([[`number`, 1]]),
-    })
-  } finally {
-    publications.subscription.unsubscribe()
-    await collection.cleanup()
+  if (cleanupFailed) {
+    if (failed)
+      throw new AggregateError(
+        [cleanupFailure],
+        `Retention history and cleanup both failed`,
+        { cause: primaryFailure },
+      )
+    throw cleanupFailure
   }
-})
+  if (failed) throw primaryFailure
+}
 
-it(`retains the pre-batch value when a later update supplies an intermediate snapshot`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const { publications, subscription } = observeValuePublications(collection)
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.write({ type: `update`, value: { id: 1, value: 1 } })
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 2 },
-      previousValue: { id: 1, value: 1 },
-    })
-    expect(sync.commit(), `repeated update batch applies`).toBe(true)
-    expect(publications).toStrictEqual([
-      [{ type: `update`, key: 1, value: 2, previousValue: 0 }],
-    ])
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
+it(`retains only keys in the authoritative synced state`, async () => {
+  await runRetentionHistory([
+    { type: `insert`, row: { id: 1, value: 1 } },
+    { type: `insert`, row: { id: 2, value: 2 } },
+    { type: `delete`, key: 1 },
+    { type: `update`, row: { id: 1, value: -1 } },
+    { type: `replace`, rows: [{ id: 3, value: 0 }] },
+    { type: `delete`, key: 3 },
+  ])
 })
 
-it(`publishes an insert when only its following update supplies a previous value`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-  })
-  const { publications, subscription } = observeValuePublications(collection)
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 2 },
-      previousValue: { id: 1, value: 1 },
-    })
-    expect(sync.commit(), `insert then update batch applies`).toBe(true)
-    expect(publications).toStrictEqual([
-      [{ type: `insert`, key: 1, value: 2, previousValue: undefined }],
-    ])
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
+it(`retains a missing row introduced by a sync update`, async () => {
+  await runRetentionHistory([{ type: `update`, row: { id: 1, value: 1 } }])
 })
 
-it(`publishes a truncate rebuild as an insert despite an update snapshot`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
-        actions.commit()
-        actions.markReady()
+it.each(
+  ([`insert`, `update`] as const).flatMap((triggerType) =>
+    ([`insideListener`, `afterOldReturn`] as const).map(
+      (commitPhase) => [triggerType, commitPhase] as const,
+    ),
+  ),
+)(
+  `retains an old-sync-run %s and a restarted row committed %s`,
+  async (triggerType, commitPhase) => {
+    await runRetentionHistory([
+      ...(triggerType === `update`
+        ? ([{ type: `insert`, row: { id: 1, value: 1 } }] as const)
+        : []),
+      {
+        type: `reentrantRestart`,
+        row: { id: 1, value: 1 },
+        commitPhase,
       },
-    },
-  })
-  const { publications, subscription } = observeValuePublications(collection)
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.truncate()
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 1 },
-      previousValue: { id: 1, value: 0 },
-    })
-    expect(sync.commit(), `truncate rebuild applies`).toBe(true)
-    expect(publications).toStrictEqual([
-      [
-        { type: `delete`, key: 1, value: 0, previousValue: undefined },
-        { type: `insert`, key: 1, value: 1, previousValue: undefined },
-      ],
     ])
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
-it(`does not publish an authoritative update hidden by an optimistic overlay`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  let release!: () => void
-  const hold = new Promise<void>((resolve) => {
-    release = resolve
-  })
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        actions.begin()
-        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  const transaction = createTransaction<LivePreviousRow>({
-    autoCommit: false,
-    mutationFn: () => hold,
-  })
-  let commit: Promise<unknown> | undefined
-  const { publications, subscription } = observeValuePublications(collection)
-  try {
-    await collection.stateWhenReady()
-    transaction.mutate(() =>
-      collection.update(1, (draft) => {
-        draft.value = 100
-      }),
-    )
-    publications.length = 0
-    commit = transaction.commit()
-    await Promise.resolve()
-
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: { id: 1, value: 1 },
-      previousValue: { id: 1, value: 0 },
-    })
-    expect(sync.commit(), `hidden authoritative update is held`).not.toBe(true)
-    expect(collection.get(1)?.value, `optimistic overlay remains visible`).toBe(
-      100,
-    )
-    expect(publications, `hidden update is not published`).toStrictEqual([])
-  } finally {
-    subscription.unsubscribe()
-    release()
-    await commit
-    await collection.cleanup()
-  }
-})
+  },
+)
 
-it(`does not carry previous-value state across a failed sync run`, async () => {
-  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
-  let syncRunCount = 0
-  let liveValue: LivePreviousRow[`value`] = 0
-  const failure = new Error(`live value read failed`)
-  const liveRow = {
-    id: 1,
-    get value() {
-      return liveValue
-    },
+it(`releases retained keys after long unique-key churn`, async () => {
+  const keyCount = 1_000
+  const actions: Array<RetentionAction> = []
+  for (let key = 0; key < keyCount; key++) {
+    actions.push({ type: `insert`, row: { id: key, value: key } })
+    actions.push({ type: `delete`, key })
   }
-  const collection = createCollection<LivePreviousRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      rowUpdateMode: `full`,
-      sync: (actions) => {
-        sync = actions
-        syncRunCount++
-        actions.begin()
-        if (syncRunCount === 1) {
-          actions.write({ type: `insert`, value: liveRow })
-          actions.write({ type: `insert`, value: { id: 2, value: 0 } })
-        } else {
-          actions.write({ type: `insert`, value: { id: 1, value: 10 } })
-        }
-        actions.commit()
-        actions.markReady()
-      },
-    },
-  })
-  let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
-  try {
-    liveValue = 1
-    sync.begin()
-    sync.write({
-      type: `update`,
-      value: liveRow,
-      previousValue: { id: 1, value: 0 },
-    })
-    sync.write({
-      type: `update`,
-      value: {
-        id: 2,
-        get value(): number {
-          throw failure
-        },
-      },
-      previousValue: { id: 2, value: 0 },
-    })
-    let thrown: unknown
-    try {
-      sync.commit()
-    } catch (error) {
-      thrown = error
-    }
-    expect(thrown, `the poisoned batch reached value comparison`).toBe(failure)
-
-    const optimisticFailure = new Error(`optimistic mutation failed`)
-    const optimistic = createTransaction<LivePreviousRow>({
-      autoCommit: false,
-      mutationFn: () => {
-        throw optimisticFailure
-      },
-    })
-    const persistence = optimistic.isPersisted.promise.catch((error) => error)
-    optimistic.mutate(() => collection.insert({ id: 3, value: 30 }))
-    expect(collection.has(3), `failed-sync optimistic overlay appears`).toBe(
-      true,
-    )
-    await expect(optimistic.commit()).rejects.toBe(optimisticFailure)
-    expect(await persistence, `failed optimistic receipt`).toBe(
-      optimisticFailure,
-    )
-    expect(
-      collection.has(3),
-      `failed-sync optimistic overlay rolls back before restart`,
-    ).toBe(false)
 
-    await collection.cleanup()
-    collection.startSyncImmediate()
-    expect(syncRunCount, `replacement sync run started`).toBe(2)
-    const observation = observeValuePublications(collection)
-    subscription = observation.subscription
-    sync.begin()
-    sync.write({ type: `update`, value: { id: 1, value: 11 } })
-    expect(sync.commit(), `clean replacement batch applies`).toBe(true)
-    expect(observation.publications).toStrictEqual([
-      [{ type: `update`, key: 1, value: 11, previousValue: 10 }],
-    ])
-  } finally {
-    subscription?.unsubscribe()
-    await collection.cleanup()
-  }
+  await runRetentionHistory(actions)
 })
 
 const retentionHistory = fc.array(retentionActionArbitrary, {
@@ -2267,21 +671,6 @@ it(`shows the newer of two held completed rows on one key`, async () => {
     ],
   )
 })
-it(`generates open, committed, and aborted sync transactions`, () => {
-  const commands = fc.sample(optimisticStep, { seed: 86104, numRuns: 200 })
-  expect(commands.some((step) => step.type === `open`)).toBe(true)
-  expect(commands.some((step) => step.type === `close` && step.commit)).toBe(
-    true,
-  )
-  expect(commands.some((step) => step.type === `close` && !step.commit)).toBe(
-    true,
-  )
-})
-
-it(`generates direct delete actions`, () => {
-  const commands = fc.sample(optimisticStep, { seed: 86104, numRuns: 100 })
-  expect(commands.some((step) => step.type === `delete`)).toBe(true)
-})
 
 // Replay of a random-campaign counterexample. A confirmed delete must clear the
 // key's local attribution, so a later source reinsert is remote.
@@ -2430,22 +819,6 @@ it.each([false, true])(
   },
 )
 
-it(`generates source batches inside insert, update, and delete handlers`, () => {
-  const histories = fc.sample(optimisticHistory, { seed: 86103, numRuns: 100 })
-  const inHandler = histories.flatMap(({ steps }) =>
-    steps.flatMap((step) =>
-      (step.type === `edit` || step.type === `delete`) && step.inHandler
-        ? [{ type: step.type, batch: step.inHandler }]
-        : [],
-    ),
-  )
-  expect(inHandler.some((entry) => entry.type === `edit`)).toBe(true)
-  expect(inHandler.some((entry) => entry.type === `delete`)).toBe(true)
-  expect(inHandler.some((entry) => entry.batch.awaitReceipt)).toBe(true)
-  expect(inHandler.some((entry) => !entry.batch.awaitReceipt)).toBe(true)
-  expect(inHandler.some((entry) => entry.batch.rows.length > 0)).toBe(true)
-})
-
 // A handler that confirms its own request through sync, before it returns,
 // optionally awaiting the commit receipt. The batch waits for settlement and
 // publishes together with the drop of the request's optimistic state.
@@ -2652,46 +1025,6 @@ it.each(
   },
 )
 
-it(`drops a completed direct insert whose handler wrote no sync row`, async () => {
-  // Law: settlement drops the optimistic state. An open truncate does not
-  // touch the inserted key, so nothing holds the completed row.
-  let sync!: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
-  const events: Array<string> = []
-  const collection = createCollection<RetainedRow, number>({
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-      },
-    },
-    onInsert: () => Promise.resolve(),
-  })
-  const subscription = collection.subscribeChanges(
-    (changes) => {
-      for (const change of changes) events.push(`${change.type}:${change.key}`)
-    },
-    { includeInitialState: false },
-  )
-  try {
-    await collection.stateWhenReady()
-    sync.begin()
-    sync.truncate()
-    await collection.insert({ id: 1, value: 1 }).isPersisted.promise
-    expect(sync.commit()).toBe(true)
-    await collection.insert({ id: 2, value: 2 }).isPersisted.promise
-
-    expect(events).toEqual([`insert:1`, `delete:1`, `insert:2`, `delete:2`])
-    expect([...collection.state.keys()]).toEqual([])
-    expect([...collection._state.syncedData.keys()]).toEqual([])
-    expect([...collection._state.heldOptimisticRows.keys()]).toEqual([])
-  } finally {
-    subscription.unsubscribe()
-    await collection.cleanup()
-  }
-})
-
 it.each([true, false])(
   `replays an insert and its update across settlement, accepted=%s`,
   async (success) => {
diff --git a/packages/db/tests/collection-state-retention.test.ts b/packages/db/tests/collection-state-retention.test.ts
new file mode 100644
index 0000000000..8a6b7a993c
--- /dev/null
+++ b/packages/db/tests/collection-state-retention.test.ts
@@ -0,0 +1,1688 @@
+/**
+ * Ordinary regression tests for retained collection state: sync-run
+ * restarts, publication state, queued transactions, and live previous values.
+ * The law of retained state is owned by
+ * collection-state-retention-oracle.property.test.ts, which runs the
+ * generated and replayed histories against its model.
+ */
+
+import { fc } from '@fast-check/vitest'
+import { expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import {
+  DuplicateKeySyncError,
+  SyncQueueInvariantError,
+  SyncTransactionAlreadyCommittedWriteError,
+} from '../src/errors.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { createDeferred } from '../src/deferred.js'
+import { createTransaction } from '../src/transactions.js'
+import { whenSyncAccepted } from '../src/sync-receipt.js'
+import {
+  optimisticHistory,
+  optimisticStep,
+} from './optimistic-history-oracle.js'
+import type {
+  RetainedRow,
+  SyncActions,
+} from './collection-state-retention-fixture.js'
+import type { CollectionChangesManager } from '../src/collection/changes.js'
+import type { Collection } from '../src/collection/index.js'
+import type { SyncConfig, TransactionState } from '../src/types.js'
+
+it(`starts a new sync run without retained publication state`, async () => {
+  let sync!: SyncActions
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+  const events: Array<{ type: string; key: string | number }> = []
+  let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
+
+  try {
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+    expect(sync.commit()).toBe(true)
+
+    subscription = collection.subscribeChanges(
+      (changes) => {
+        events.push(
+          ...changes.map((change) => ({
+            type: change.type,
+            key: change.key,
+          })),
+        )
+      },
+      { includeInitialState: false },
+    )
+
+    sync.begin()
+    sync.write({ type: `update`, value: { id: 1, value: 2 } })
+    // Stand in for an accepted transaction held behind a mutation; only
+    // accepted transactions publish in a drain.
+    collection._state.pendingSyncedTransactions.at(-1)!.committed = true
+    collection._state.capturePreSyncVisibleState()
+    expect(collection._state.preSyncVisibleState.size).toBe(1)
+    expect(collection._state.recentlySyncedKeys).toEqual(new Set([1]))
+
+    const cleanup = collection.cleanup()
+    const retainedAfterCleanup = {
+      visibleRows: collection._state.preSyncVisibleState.size,
+      virtualRows: collection._state.preSyncVirtualState.size,
+      recentKeys: collection._state.recentlySyncedKeys.size,
+    }
+    await cleanup
+
+    events.length = 0
+    collection.startSyncImmediate()
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 3 } })
+    expect(sync.commit()).toBe(true)
+
+    expect({ retainedAfterCleanup, events }).toEqual({
+      retainedAfterCleanup: { visibleRows: 0, virtualRows: 0, recentKeys: 0 },
+      events: [{ type: `insert`, key: 1 }],
+    })
+  } finally {
+    subscription?.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`keeps a restarted sync run's publication state after the old listener returns`, async () => {
+  let sync!: SyncActions
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+  let cleanup: Promise<void> | undefined
+  let restarted = false
+  const subscription = collection.subscribeChanges(
+    () => {
+      if (restarted) return
+      restarted = true
+      cleanup = collection.cleanup()
+      collection.startSyncImmediate()
+      collection._state.preSyncVisibleState.set(2, { id: 2, value: 2 })
+      collection._state.recentlySyncedKeys.add(2)
+    },
+    { includeInitialState: false },
+  )
+
+  try {
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+    expect(sync.commit()).toBe(true)
+
+    expect(restarted).toBe(true)
+    expect(collection._state.preSyncVisibleState).toEqual(
+      new Map([[2, { id: 2, value: 2 }]]),
+    )
+    expect(collection._state.recentlySyncedKeys).toEqual(new Set([2]))
+    expect(collection._state.hasReceivedFirstCommit).toBe(false)
+
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 3, value: 3 } })
+    expect(sync.commit()).toBe(true)
+    expect(collection._state.preSyncVisibleState.size).toBe(0)
+    expect(collection._state.preSyncVirtualState.size).toBe(0)
+    expect(collection._state.hasReceivedFirstCommit).toBe(true)
+    await Promise.resolve()
+    expect(collection._state.recentlySyncedKeys.size).toBe(0)
+    await cleanup
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`does not let an old publication microtask clear restarted sync state`, async () => {
+  let sync!: SyncActions
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+
+  try {
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+    expect(sync.commit()).toBe(true)
+
+    const cleanup = collection.cleanup()
+    collection.startSyncImmediate()
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 2, value: 2 } })
+    // Stand in for an accepted transaction held behind a mutation.
+    collection._state.pendingSyncedTransactions.at(-1)!.committed = true
+    collection._state.capturePreSyncVisibleState()
+    expect(collection._state.recentlySyncedKeys).toEqual(new Set([2]))
+
+    await Promise.resolve()
+
+    expect(collection._state.recentlySyncedKeys).toEqual(new Set([2]))
+
+    collection._state.pendingSyncedTransactions.at(-1)!.committed = false
+    expect(sync.commit()).toBe(true)
+    expect(collection._state.hasReceivedFirstCommit).toBe(true)
+    await Promise.resolve()
+    expect(collection._state.preSyncVisibleState.size).toBe(0)
+    expect(collection._state.preSyncVirtualState.size).toBe(0)
+    expect(collection._state.recentlySyncedKeys.size).toBe(0)
+    await cleanup
+  } finally {
+    await collection.cleanup()
+  }
+})
+
+it(`publishes a virtual-state update when a restarted optimistic row is confirmed`, async () => {
+  let sync!: SyncActions
+  let syncRunCount = 0
+  let releaseMutation!: () => void
+  const mutationHold = new Promise<void>((resolve) => {
+    releaseMutation = resolve
+  })
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        syncRunCount++
+        if (syncRunCount === 1) actions.markReady()
+      },
+    },
+  })
+  type ObservedRow = RetainedRow & {
+    $collectionId: string
+    $key: number
+    $origin: `local` | `remote`
+    $hasPendingWrites: boolean
+    $synced: boolean
+  }
+  type ObservedChange = {
+    type: string
+    key: string | number
+    value: ObservedRow
+    previousValue?: ObservedRow
+  }
+  const snapshotRow = (row: ObservedRow): ObservedRow => ({
+    id: row.id,
+    value: row.value,
+    $collectionId: row.$collectionId,
+    $key: row.$key,
+    $origin: row.$origin,
+    $hasPendingWrites: row.$hasPendingWrites,
+    $synced: row.$synced,
+  })
+  const publications: Array<{
+    changes: Array<ObservedChange>
+    rows: Array<ObservedRow>
+  }> = []
+  const restartStatuses: Array<string> = []
+  const settlementTimeline: Array<`publication` | `receipt`> = []
+  let restarted = false
+  let readMutationState: (() => TransactionState) | undefined
+  let rollbackMutation: (() => void) | undefined
+  let mutationCommit: Promise<unknown> | undefined
+  let syncReceipt: ReturnType<SyncActions[`commit`]> | undefined
+  const subscription = collection.subscribeChanges(
+    (changes) => {
+      publications.push({
+        changes: changes.map(({ type, key, value, previousValue }) => ({
+          type,
+          key,
+          value: snapshotRow(value),
+          ...(previousValue === undefined
+            ? {}
+            : { previousValue: snapshotRow(previousValue) }),
+        })),
+        rows: [...collection.state.values()].map(snapshotRow),
+      })
+      if (changes.some(({ type, key }) => type === `update` && key === 2)) {
+        queueMicrotask(() => settlementTimeline.push(`publication`))
+      }
+      if (restarted || !changes.some(({ key }) => key === 1)) return
+
+      restarted = true
+      restartStatuses.push(collection.status)
+      void collection.cleanup()
+      restartStatuses.push(collection.status)
+      collection.startSyncImmediate()
+      restartStatuses.push(collection.status)
+      sync.markReady()
+      restartStatuses.push(collection.status)
+
+      const transaction = createTransaction({
+        autoCommit: false,
+        mutationFn: () => mutationHold,
+      })
+      readMutationState = () => transaction.state
+      rollbackMutation = () => transaction.rollback()
+      void transaction.isPersisted.promise.catch(() => undefined)
+      transaction.mutate(() => collection.insert({ id: 2, value: 2 }))
+      mutationCommit = transaction.commit()
+
+      sync.begin()
+      sync.write({ type: `insert`, value: { id: 2, value: 2 } })
+      syncReceipt = sync.commit()
+    },
+    { includeInitialState: false },
+  )
+
+  try {
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+    expect(sync.commit()).toBe(true)
+
+    const remoteRow = (id: number): ObservedRow => ({
+      id,
+      value: id,
+      $collectionId: collection.id,
+      $key: id,
+      $origin: `remote`,
+      $hasPendingWrites: false,
+      $synced: true,
+    })
+    const localRow = (id: number): ObservedRow => ({
+      id,
+      value: id,
+      $collectionId: collection.id,
+      $key: id,
+      $origin: `local`,
+      $hasPendingWrites: true,
+      $synced: false,
+    })
+    const expectedPublications = [
+      {
+        changes: [{ type: `insert`, key: 1, value: remoteRow(1) }],
+        rows: [remoteRow(1)],
+      },
+      { changes: [{ type: `delete`, key: 1, value: remoteRow(1) }], rows: [] },
+      {
+        changes: [{ type: `insert`, key: 2, value: localRow(2) }],
+        rows: [localRow(2)],
+      },
+      {
+        changes: [
+          {
+            type: `update`,
+            key: 2,
+            value: remoteRow(2),
+            previousValue: localRow(2),
+          },
+        ],
+        rows: [remoteRow(2)],
+      },
+    ]
+    expect(publications).toEqual(expectedPublications.slice(0, 3))
+    expect([...collection.state.keys()]).toEqual([2])
+    expect(restartStatuses).toEqual([`ready`, `cleaned-up`, `loading`, `ready`])
+    expect(collection.status).toBe(`ready`)
+
+    // The restarted sync run's commit is accepted at once and parked behind
+    // the persisting mutation; the rollback publishes it.
+    expect(syncReceipt).not.toBe(true)
+    expect(collection._state.pendingSyncedTransactions.at(-1)?.committed).toBe(
+      true,
+    )
+    expect(rollbackMutation).toBeDefined()
+    await Promise.resolve()
+    expect(settlementTimeline).toEqual([])
+
+    rollbackMutation?.()
+    expect(publications).toEqual(expectedPublications)
+    await Promise.resolve()
+    expect(settlementTimeline).toEqual([`publication`])
+    expect(publications).toEqual(expectedPublications)
+    expect([...collection.state.values()].map(snapshotRow)).toEqual([
+      remoteRow(2),
+    ])
+
+    releaseMutation()
+    await mutationCommit
+    expect(readMutationState?.()).toBe(`failed`)
+    expect(publications).toEqual(expectedPublications)
+    expect([...collection.state.values()].map(snapshotRow)).toEqual([
+      remoteRow(2),
+    ])
+  } finally {
+    releaseMutation()
+    await mutationCommit
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+type LivePreviousRow = {
+  id: number
+  value: number | null | undefined
+}
+
+function observeValuePublications(
+  collection: Collection<LivePreviousRow, number>,
+  includeInitialState = false,
+) {
+  const publications: Array<
+    Array<{
+      type: string
+      key: string | number
+      value: LivePreviousRow[`value`]
+      previousValue: LivePreviousRow[`value`]
+    }>
+  > = []
+  const subscription = collection.subscribeChanges(
+    (changes) =>
+      publications.push(
+        changes.map((change) => ({
+          type: change.type,
+          key: change.key,
+          value: change.value.value,
+          previousValue: change.previousValue?.value,
+        })),
+      ),
+    { includeInitialState },
+  )
+  return { publications, subscription }
+}
+
+async function runImmutablePreviousValuePublication(
+  initial: LivePreviousRow[`value`],
+  updates: ReadonlyArray<LivePreviousRow[`value`]>,
+) {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  let liveValue = initial
+  let writes = 0
+  const liveRow = {
+    id: 1,
+    get value() {
+      return liveValue
+    },
+  }
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: liveRow })
+        actions.write({ type: `insert`, value: { id: 2, value: 10 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const { publications, subscription } = observeValuePublications(collection)
+  try {
+    sync.begin()
+    let previousValue = initial
+    for (const value of updates) {
+      liveValue = value
+      sync.write({
+        type: `update`,
+        value: liveRow,
+        previousValue: { id: 1, value: previousValue },
+      })
+      writes++
+      previousValue = value
+    }
+    sync.write({
+      type: `update`,
+      value: { id: 2, value: 11 },
+      previousValue: { id: 2, value: 10 },
+    })
+    writes++
+    expect(sync.commit(), `live-value sync commit reached`).toBe(true)
+    expect(writes, `all live-value writes reached`).toBe(updates.length + 1)
+    expect(publications).toStrictEqual([
+      [
+        {
+          type: `update`,
+          key: 1,
+          value: updates.at(-1),
+          previousValue: initial,
+        },
+        {
+          type: `update`,
+          key: 2,
+          value: 11,
+          previousValue: 10,
+        },
+      ],
+    ])
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+}
+
+// Replay of a review probe. A transaction begun inside an open one commits
+// and applies first; replay then invalidates the open transaction's insert.
+// The accepted transaction's receipt resolves, and the open one's commit
+// rejects with DuplicateKeySyncError.
+it(`rejects an open transaction that a later nested commit invalidates`, async () => {
+  let sync!: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+    sync.begin()
+    sync.write({ type: `update`, value: { id: 1, value: 2 } })
+    expect(sync.commit()).toBe(true)
+    const rejected = sync.commit()
+    expect(rejected).toBeInstanceOf(Promise)
+    await expect(rejected).rejects.toBeInstanceOf(DuplicateKeySyncError)
+    // Core never accepted the transaction, so its acceptance moment rejects too.
+    await expect(
+      Promise.resolve(whenSyncAccepted(rejected)),
+    ).rejects.toBeInstanceOf(DuplicateKeySyncError)
+    expect(collection.get(1)?.value).toBe(2)
+    expect(collection._state.pendingSyncedTransactions).toHaveLength(0)
+  } finally {
+    await collection.cleanup()
+  }
+})
+
+// After a replay invalidates the open transaction, its later writes must not
+// change what a newer transaction sees. Each write below would leak into the
+// projection: an insert of key 9 would make the newer insert of key 9 a
+// duplicate, and a delete of key 1 would let the newer insert of key 1 pass.
+// The newer transaction sees only the accepted row 1, as if the invalidated
+// transaction wrote nothing after its invalidation.
+it.each([
+  {
+    late: { type: `insert`, value: { id: 9, value: 1 } },
+    newer: { id: 9, value: 3 },
+    duplicate: false,
+  },
+  {
+    late: { type: `delete`, key: 1 },
+    newer: { id: 1, value: 3 },
+    duplicate: true,
+  },
+] as const)(
+  `ignores writes to an invalidated transaction: late $late.type`,
+  async ({ late, newer, duplicate }) => {
+    let sync!: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
+    const collection = createCollection<RetainedRow, number>({
+      getKey: (row) => row.id,
+      startSync: true,
+      sync: {
+        sync: (actions) => {
+          sync = actions
+          actions.markReady()
+        },
+      },
+    })
+    try {
+      await collection.stateWhenReady()
+      sync.begin()
+      sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+      sync.begin()
+      sync.write({ type: `update`, value: { id: 1, value: 2 } })
+      expect(sync.commit()).toBe(true)
+      // The premise: the replay has already invalidated the open transaction.
+      expect(
+        collection._state.pendingSyncedTransactions.at(-1)?.invalidationError,
+      ).toBeInstanceOf(DuplicateKeySyncError)
+      sync.write(late)
+      sync.begin()
+      const write = () => sync.write({ type: `insert`, value: newer })
+      if (duplicate) expect(write).toThrow(DuplicateKeySyncError)
+      else write()
+      expect(sync.commit()).toBe(true)
+      await expect(sync.commit()).rejects.toBeInstanceOf(DuplicateKeySyncError)
+      expect(
+        [...collection.state.values()].map(({ id, value }) => [id, value]),
+      ).toEqual(
+        duplicate
+          ? [[1, 2]]
+          : [
+              [1, 2],
+              [newer.id, newer.value],
+            ],
+      )
+    } finally {
+      await collection.cleanup()
+    }
+  },
+)
+
+// No public path can make a committed queued transaction invalid on replay:
+// only the open last transaction can be canceled. A replay that finds one is
+// an invariant failure, not a recoverable rejection.
+it(`throws an invariant error when replay finds an invalid committed transaction`, async () => {
+  // Current callers cannot create this queue state. Exercise the internal
+  // recovery boundary so a future refresh caller cannot strand its receipt.
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({ type: `insert`, value: { id: 1, value: 0 } })
+        commit()
+        markReady()
+      },
+    },
+  })
+  const applied = createDeferred<void>()
+  void applied.promise.catch(() => undefined)
+  const pending = {
+    committed: true,
+    applicationStarted: false,
+    layoutChanged: false,
+    operations: [
+      {
+        type: `insert` as const,
+        originalSyncType: `insert` as const,
+        key: 1,
+        value: { id: 1, value: 2 },
+      },
+    ],
+    rowMetadataWrites: new Map(),
+    explicitRowMetadataWrites: new Map(),
+    collectionMetadataWrites: new Map(),
+    applied,
+  }
+  const validApplied = createDeferred<void>()
+  void validApplied.promise.catch(() => undefined)
+  const valid = {
+    ...pending,
+    operations: [
+      {
+        ...pending.operations[0]!,
+        key: 2,
+        value: { id: 2, value: 2 },
+      },
+    ],
+    applied: validApplied,
+  }
+
+  let primaryFailure: unknown
+  let hasPrimaryFailure = false
+  try {
+    await collection.stateWhenReady()
+    collection._state.pendingSyncedTransactions.push(valid, pending)
+    expect(() => collection._state.refreshPendingSyncedProjection()).toThrow(
+      SyncQueueInvariantError,
+    )
+    expect(collection.get(1)?.value).toBe(0)
+  } catch (error) {
+    primaryFailure = error
+    hasPrimaryFailure = true
+  }
+
+  const cleanupFailures: Array<unknown> = []
+  try {
+    for (const transaction of [pending, valid]) {
+      const index =
+        collection._state.pendingSyncedTransactions.indexOf(transaction)
+      if (index !== -1)
+        collection._state.pendingSyncedTransactions.splice(index, 1)
+    }
+    if (applied.isPending()) applied.resolve()
+    if (validApplied.isPending()) validApplied.resolve()
+    collection._state.refreshPendingSyncedProjection()
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  try {
+    await collection.cleanup()
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  if (hasPrimaryFailure && cleanupFailures.length > 0) {
+    throw new AggregateError(
+      [primaryFailure, ...cleanupFailures],
+      `Projection refresh and cleanup both failed`,
+      { cause: primaryFailure },
+    )
+  }
+  if (hasPrimaryFailure) throw primaryFailure
+  if (cleanupFailures.length > 0)
+    throw new AggregateError(
+      cleanupFailures,
+      `Projection refresh cleanup failed`,
+    )
+})
+
+it.each([
+  { initial: 0, updates: [1] },
+  { initial: 0, updates: [1, 2] },
+  { initial: null, updates: [1] },
+  { initial: undefined, updates: [1] },
+] satisfies Array<{
+  initial: LivePreviousRow[`value`]
+  updates: Array<LivePreviousRow[`value`]>
+}>)(
+  `publishes a live value from immutable previous state: %j`,
+  async ({ initial, updates }) => {
+    await runImmutablePreviousValuePublication(initial, updates)
+  },
+)
+
+it(`keeps the first queued before-image when metadata reserves the key`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  let liveValue: LivePreviousRow[`value`] = 0
+  const liveRow = {
+    id: 1,
+    get value() {
+      return liveValue
+    },
+  }
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: liveRow })
+        actions.write({ type: `insert`, value: { id: 2, value: 0 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  let release!: () => void
+  const hold = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  const blocker = createTransaction<LivePreviousRow>({
+    autoCommit: false,
+    mutationFn: () => hold,
+  })
+  await collection.stateWhenReady()
+  const { publications, subscription } = observeValuePublications(collection)
+  const receipts: Array<Promise<void>> = []
+  let blockerCommit: Promise<unknown> | undefined
+
+  const commitQueuedSync = () => {
+    expect(sync.commit(), `persisting work queues sync`).not.toBe(true)
+    expect(
+      collection._state.pendingSyncedTransactions.at(-1)?.committed,
+      `persisting work queues sync`,
+    ).toBe(true)
+  }
+
+  try {
+    blocker.mutate(() =>
+      collection.update(2, (draft) => {
+        draft.value = 20
+      }),
+    )
+    publications.length = 0
+    blockerCommit = blocker.commit()
+    await Promise.resolve()
+
+    sync.begin()
+    sync.metadata!.row.set(1, { phase: `metadata-first` })
+    commitQueuedSync()
+
+    liveValue = 1
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: liveRow,
+      previousValue: { id: 1, value: 0 },
+    })
+    commitQueuedSync()
+
+    liveValue = 2
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: liveRow,
+      previousValue: { id: 1, value: 1 },
+    })
+    commitQueuedSync()
+
+    release()
+    await blockerCommit
+    await Promise.all(receipts)
+
+    expect(
+      publications.flat().filter(({ key }) => key === 1),
+      `the queued drain publishes one complete key transition`,
+    ).toStrictEqual([{ type: `update`, key: 1, value: 2, previousValue: 0 }])
+    expect(collection._state.syncedMetadata.get(1)).toStrictEqual({
+      phase: `metadata-first`,
+    })
+  } finally {
+    release()
+    if (blocker.state === `pending` || blocker.state === `persisting`)
+      blocker.rollback()
+    await blockerCommit?.catch(() => undefined)
+    subscription.unsubscribe()
+    await collection.cleanup()
+    await Promise.allSettled(receipts)
+  }
+})
+
+type ParkedSyncHarness = {
+  collection: Collection<RetainedRow, number>
+  sync: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
+  releasePersistence: () => Promise<void>
+}
+
+async function withParkedSync(
+  initialRows: ReadonlyArray<RetainedRow>,
+  run: (harness: ParkedSyncHarness) => Promise<void>,
+  rowUpdateMode: `partial` | `full` = `full`,
+): Promise<void> {
+  let sync!: ParkedSyncHarness[`sync`]
+  let release!: () => void
+  const persistence = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        for (const row of initialRows)
+          actions.write({ type: `insert`, value: row })
+        actions.write({ type: `insert`, value: { id: 2, value: 0 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const blocker = createTransaction<RetainedRow>({
+    autoCommit: false,
+    mutationFn: () => persistence,
+  })
+  let blockerCommit: Promise<unknown> | undefined
+  let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
+  const publicRows = () =>
+    [...collection.state]
+      .map(([key, row]) => [key, row.value] as const)
+      .sort(([left], [right]) => left - right)
+  const mirror = new Map<number, number>(
+    initialRows.map(({ id, value }) => [id, value]),
+  )
+  mirror.set(2, 0)
+  const publications: Array<{
+    publicRows: Array<readonly [number, number]>
+    mirrorRows: Array<[number, number]>
+  }> = []
+  const mirrorRows = () => [...mirror].sort(([left], [right]) => left - right)
+  let primaryFailure: unknown
+  let hasPrimaryFailure = false
+
+  try {
+    await collection.stateWhenReady()
+    expect(publicRows()).toEqual(mirrorRows())
+    subscription = collection.subscribeChanges(
+      (changes) => {
+        for (const change of changes) {
+          if (change.type === `delete`) mirror.delete(change.key)
+          else mirror.set(change.key, change.value.value)
+        }
+        publications.push({
+          publicRows: publicRows(),
+          mirrorRows: mirrorRows(),
+        })
+      },
+      { includeInitialState: false },
+    )
+    blocker.mutate(() =>
+      collection.update(2, (draft) => {
+        draft.value = 1
+      }),
+    )
+    blockerCommit = blocker.commit()
+    await Promise.resolve()
+    expect(blocker.state).toBe(`persisting`)
+    await run({
+      collection,
+      sync,
+      releasePersistence: async () => {
+        release()
+        await blockerCommit
+      },
+    })
+    for (const publication of publications) {
+      expect(publication.mirrorRows).toEqual(publication.publicRows)
+    }
+    expect(mirrorRows()).toEqual(publicRows())
+  } catch (error) {
+    primaryFailure = error
+    hasPrimaryFailure = true
+  }
+
+  const cleanupFailures: Array<unknown> = []
+  try {
+    release()
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  try {
+    if (blocker.state === `pending` || blocker.state === `persisting`)
+      blocker.rollback()
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  try {
+    await blockerCommit?.catch(() => undefined)
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  try {
+    subscription?.unsubscribe()
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  try {
+    await collection.cleanup()
+  } catch (error) {
+    cleanupFailures.push(error)
+  }
+  if (hasPrimaryFailure && cleanupFailures.length > 0) {
+    throw new AggregateError(
+      [primaryFailure, ...cleanupFailures],
+      `Queued sync oracle and cleanup both failed`,
+      { cause: primaryFailure },
+    )
+  }
+  if (hasPrimaryFailure) throw primaryFailure
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(cleanupFailures, `Queued sync cleanup failed`, {
+      cause: cleanupFailures[0],
+    })
+  }
+}
+
+it(`keeps queued snapshot admission work linear in the row count`, async () => {
+  let sync!: ParkedSyncHarness[`sync`]
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    const pending = collection._state.pendingSyncedTransactions.at(-1)
+    if (!pending) throw new Error(`missing active sync transaction`)
+
+    let inspectedOperations = 0
+    const operations = pending.operations
+    pending.operations = new Proxy(operations, {
+      get(target, property, receiver) {
+        if (property !== Symbol.iterator)
+          return Reflect.get(target, property, receiver)
+        return function* () {
+          for (const operation of target) {
+            inspectedOperations++
+            yield operation
+          }
+        }
+      },
+    })
+
+    const rowCount = 64
+    for (let id = 0; id < rowCount; id++) {
+      sync.write({ type: `insert`, value: { id, value: id } })
+    }
+    const receipt = sync.commit()
+    if (receipt !== true) await receipt
+
+    // Application and publication each make one linear pass. Admission must
+    // not add a triangular scan over the rows already staged in this batch.
+    expect(inspectedOperations).toBeLessThanOrEqual(rowCount * 2)
+  } finally {
+    await collection.cleanup()
+  }
+})
+
+// A committed source batch that waits for persistence is closed to writes.
+// Without the check, a late write would join the queued batch.
+it(`rejects a write to a committed batch that waits for persistence`, async () => {
+  await withParkedSync(
+    [{ id: 1, value: 0 }],
+    async ({ collection, sync, releasePersistence }) => {
+      sync.begin()
+      sync.write({ type: `update`, value: { id: 1, value: 1 } })
+      const receipt = sync.commit()
+      expect(
+        collection._state.pendingSyncedTransactions.at(-1)?.committed,
+      ).toBe(true)
+
+      expect(() =>
+        sync.write({ type: `update`, value: { id: 1, value: 2 } }),
+      ).toThrow(SyncTransactionAlreadyCommittedWriteError)
+
+      await releasePersistence()
+      await receipt
+      expect(collection.get(1)?.value).toBe(1)
+    },
+  )
+})
+
+it.each([
+  { label: `no source row`, base: `absent` },
+  { label: `a same-transaction delete`, base: `deleted` },
+  { label: `a same-transaction truncate`, base: `truncated` },
+] as const)(
+  `keeps an independent partial upsert after $label`,
+  async ({ base }) => {
+    await withParkedSync(
+      base === `absent` ? [] : [{ id: 1, value: 0 }],
+      async ({ collection, sync, releasePersistence }) => {
+        sync.begin()
+        if (base === `deleted`) sync.write({ type: `delete`, key: 1 })
+        if (base === `truncated`) sync.truncate()
+        sync.write({ type: `update`, value: { id: 1, value: 2 } })
+        const receipt = sync.commit()
+        await releasePersistence()
+        if (receipt !== true) await receipt
+        expect(collection._state.syncedData.get(1)).toEqual({ id: 1, value: 2 })
+        expect(collection.get(1)?.value).toBe(2)
+      },
+      `partial`,
+    )
+  },
+)
+
+it(`applies a partial update after an insert in the same sync transaction`, async () => {
+  await withParkedSync(
+    [],
+    async ({ collection, sync, releasePersistence }) => {
+      sync.begin()
+      sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+      sync.write({ type: `update`, value: { id: 1, value: 2 } })
+      const receipt = sync.commit()
+      expect(
+        collection._state.pendingSyncedTransactions.at(-1)?.committed,
+      ).toBe(true)
+      await releasePersistence()
+      await receipt
+      expect(collection._state.syncedData.get(1)).toEqual({ id: 1, value: 2 })
+      expect(collection.get(1)?.value).toBe(2)
+    },
+    `partial`,
+  )
+})
+
+it.each([
+  { label: `an earlier queued insert`, predecessor: `earlier` },
+  { label: `an insert in the same transaction`, predecessor: `same` },
+] as const)(
+  `rejects a duplicate insert after $label`,
+  async ({ predecessor }) => {
+    // The source Map contains the first queued insert before the second write is
+    // admitted. The duplicate-key law is independent of whether the first row
+    // has already crossed the public publication boundary.
+    await withParkedSync(
+      [],
+      async ({ collection, sync, releasePersistence }) => {
+        sync.begin()
+        sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+        let firstReceipt: true | Promise<void> | undefined
+        if (predecessor === `earlier`) {
+          firstReceipt = sync.commit()
+          expect(
+            collection._state.pendingSyncedTransactions.at(-1)?.committed,
+          ).toBe(true)
+          sync.begin()
+        }
+        expect(() =>
+          sync.write({ type: `insert`, value: { id: 1, value: 2 } }),
+        ).toThrow(DuplicateKeySyncError)
+        firstReceipt ??= sync.commit()
+
+        await releasePersistence()
+        if (firstReceipt !== true) await firstReceipt
+        expect(collection._state.syncedData.get(1)).toEqual({ id: 1, value: 1 })
+      },
+    )
+  },
+)
+
+it(`snapshots a buffered delete before its row object is reused`, async () => {
+  const reusedRow: LivePreviousRow = { id: 1, value: 0 }
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      sync: (actions) => {
+        actions.begin()
+        actions.write({ type: `insert`, value: reusedRow })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const publications: Array<
+    Array<{
+      type: string
+      value: LivePreviousRow[`value`]
+      previousValue: LivePreviousRow[`value`]
+      previousSynced: boolean | undefined
+      previousOrigin: string | undefined
+    }>
+  > = []
+  const subscription = collection.subscribeChanges(
+    (changes) =>
+      publications.push(
+        changes.map((change) => {
+          const previous = change.previousValue as
+            | (LivePreviousRow & { $synced: boolean; $origin: string })
+            | undefined
+          return {
+            type: change.type,
+            value: change.value.value,
+            previousValue: previous?.value,
+            previousSynced: previous?.$synced,
+            previousOrigin: previous?.$origin,
+          }
+        }),
+      ),
+    { includeInitialState: true },
+  )
+  const changes = (
+    collection as unknown as {
+      _changes: CollectionChangesManager<LivePreviousRow, number>
+    }
+  )._changes
+
+  try {
+    await collection.stateWhenReady()
+    publications.length = 0
+    changes.shouldBatchEvents = true
+    changes.emitEvents([{ type: `delete`, key: 1, value: reusedRow }])
+    expect(publications, `delete remains buffered`).toStrictEqual([])
+
+    reusedRow.value = 1
+    collection._state.optimisticUpserts.set(1, reusedRow)
+    changes.emitEvents(
+      [{ type: `insert`, key: 1, value: { ...reusedRow } }],
+      true,
+    )
+    expect(publications).toStrictEqual([
+      [
+        {
+          type: `update`,
+          value: 1,
+          previousValue: 0,
+          previousSynced: true,
+          previousOrigin: `remote`,
+        },
+      ],
+    ])
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`uses the preserved visible row when rollback releases a queued sync`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  let rejectPersistence!: (error: Error) => void
+  const persistenceGate = new Promise<void>((_resolve, reject) => {
+    rejectPersistence = reject
+  })
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const transaction = createTransaction<LivePreviousRow>({
+    autoCommit: false,
+    mutationFn: () => persistenceGate,
+  })
+  const publications = observeValuePublications(collection)
+
+  try {
+    await collection.stateWhenReady()
+    const index = collection.createIndex((row) => row.value, {
+      indexType: BTreeIndex,
+    })
+    transaction.mutate(() =>
+      collection.update(1, (draft) => {
+        draft.value = 1
+      }),
+    )
+    publications.publications.length = 0
+    const commit = transaction.commit()
+    await Promise.resolve()
+
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 2 },
+      previousValue: { id: 1, value: 0 },
+    })
+    const receipt = sync.commit()
+    expect(receipt).not.toBe(true)
+    expect(collection._state.pendingSyncedTransactions.at(-1)?.committed).toBe(
+      true,
+    )
+
+    const failure = new Error(`queued mutation failed`)
+    rejectPersistence(failure)
+    await expect(commit).rejects.toBe(failure)
+    if (receipt !== true) await receipt
+
+    expect(collection.get(1)?.value).toBe(2)
+    expect(publications.publications).toStrictEqual([
+      [{ type: `update`, key: 1, value: 2, previousValue: 1 }],
+    ])
+    expect(index.lookup(`eq`, 0)).toEqual(new Set())
+    expect(index.lookup(`eq`, 1)).toEqual(new Set())
+    expect(index.lookup(`eq`, 2)).toEqual(new Set([1]))
+  } finally {
+    publications.subscription.unsubscribe()
+    if (transaction.state === `pending` || transaction.state === `persisting`)
+      transaction.rollback()
+    await collection.cleanup()
+  }
+})
+
+it(`publishes a provider update for an unseen key as an insert`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+  const publications = observeValuePublications(collection, true)
+
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 1 },
+      previousValue: { id: 1, value: 0 },
+    })
+    expect(sync.commit()).toBe(true)
+    expect(publications.publications).toStrictEqual([
+      [],
+      [{ type: `insert`, key: 1, value: 1, previousValue: undefined }],
+    ])
+  } finally {
+    publications.subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`suppresses a replacement-object redelivery with a stale before-image`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: { id: 1, value: 1 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const publications = observeValuePublications(collection)
+
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 1 },
+      previousValue: { id: 1, value: 0 },
+    })
+    expect(sync.commit()).toBe(true)
+    expect(publications.publications).toStrictEqual([])
+  } finally {
+    publications.subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`suppresses a replacement object's partial before-image without index drift`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: { id: 1, value: 1 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const publications = observeValuePublications(collection)
+
+  try {
+    await collection.stateWhenReady()
+    const index = collection.createIndex((row) => row.value, {
+      indexType: BTreeIndex,
+    })
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 1 },
+      previousValue: { id: 1 } as LivePreviousRow,
+    })
+    expect(sync.commit()).toBe(true)
+
+    expect(
+      {
+        publications: publications.publications,
+        indexed: index.lookup(`eq`, 1),
+        rangeDomains: (
+          index as unknown as {
+            rangeValueDomains: Map<string, number>
+          }
+        ).rangeValueDomains,
+      },
+      `partial before-image observation`,
+    ).toStrictEqual({
+      publications: [],
+      indexed: new Set([1]),
+      rangeDomains: new Map([[`number`, 1]]),
+    })
+  } finally {
+    publications.subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`retains the pre-batch value when a later update supplies an intermediate snapshot`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const { publications, subscription } = observeValuePublications(collection)
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.write({ type: `update`, value: { id: 1, value: 1 } })
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 2 },
+      previousValue: { id: 1, value: 1 },
+    })
+    expect(sync.commit(), `repeated update batch applies`).toBe(true)
+    expect(publications).toStrictEqual([
+      [{ type: `update`, key: 1, value: 2, previousValue: 0 }],
+    ])
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`publishes an insert when only its following update supplies a previous value`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+  })
+  const { publications, subscription } = observeValuePublications(collection)
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.write({ type: `insert`, value: { id: 1, value: 1 } })
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 2 },
+      previousValue: { id: 1, value: 1 },
+    })
+    expect(sync.commit(), `insert then update batch applies`).toBe(true)
+    expect(publications).toStrictEqual([
+      [{ type: `insert`, key: 1, value: 2, previousValue: undefined }],
+    ])
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`publishes a truncate rebuild as an insert despite an update snapshot`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const { publications, subscription } = observeValuePublications(collection)
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.truncate()
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 1 },
+      previousValue: { id: 1, value: 0 },
+    })
+    expect(sync.commit(), `truncate rebuild applies`).toBe(true)
+    expect(publications).toStrictEqual([
+      [
+        { type: `delete`, key: 1, value: 0, previousValue: undefined },
+        { type: `insert`, key: 1, value: 1, previousValue: undefined },
+      ],
+    ])
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`does not publish an authoritative update hidden by an optimistic overlay`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  let release!: () => void
+  const hold = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        actions.begin()
+        actions.write({ type: `insert`, value: { id: 1, value: 0 } })
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  const transaction = createTransaction<LivePreviousRow>({
+    autoCommit: false,
+    mutationFn: () => hold,
+  })
+  let commit: Promise<unknown> | undefined
+  const { publications, subscription } = observeValuePublications(collection)
+  try {
+    await collection.stateWhenReady()
+    transaction.mutate(() =>
+      collection.update(1, (draft) => {
+        draft.value = 100
+      }),
+    )
+    publications.length = 0
+    commit = transaction.commit()
+    await Promise.resolve()
+
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: { id: 1, value: 1 },
+      previousValue: { id: 1, value: 0 },
+    })
+    expect(sync.commit(), `hidden authoritative update is held`).not.toBe(true)
+    expect(collection.get(1)?.value, `optimistic overlay remains visible`).toBe(
+      100,
+    )
+    expect(publications, `hidden update is not published`).toStrictEqual([])
+  } finally {
+    subscription.unsubscribe()
+    release()
+    await commit
+    await collection.cleanup()
+  }
+})
+
+it(`does not carry previous-value state across a failed sync run`, async () => {
+  let sync!: Parameters<SyncConfig<LivePreviousRow, number>[`sync`]>[0]
+  let syncRunCount = 0
+  let liveValue: LivePreviousRow[`value`] = 0
+  const failure = new Error(`live value read failed`)
+  const liveRow = {
+    id: 1,
+    get value() {
+      return liveValue
+    },
+  }
+  const collection = createCollection<LivePreviousRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      rowUpdateMode: `full`,
+      sync: (actions) => {
+        sync = actions
+        syncRunCount++
+        actions.begin()
+        if (syncRunCount === 1) {
+          actions.write({ type: `insert`, value: liveRow })
+          actions.write({ type: `insert`, value: { id: 2, value: 0 } })
+        } else {
+          actions.write({ type: `insert`, value: { id: 1, value: 10 } })
+        }
+        actions.commit()
+        actions.markReady()
+      },
+    },
+  })
+  let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
+  try {
+    liveValue = 1
+    sync.begin()
+    sync.write({
+      type: `update`,
+      value: liveRow,
+      previousValue: { id: 1, value: 0 },
+    })
+    sync.write({
+      type: `update`,
+      value: {
+        id: 2,
+        get value(): number {
+          throw failure
+        },
+      },
+      previousValue: { id: 2, value: 0 },
+    })
+    let thrown: unknown
+    try {
+      sync.commit()
+    } catch (error) {
+      thrown = error
+    }
+    expect(thrown, `the poisoned batch reached value comparison`).toBe(failure)
+
+    const optimisticFailure = new Error(`optimistic mutation failed`)
+    const optimistic = createTransaction<LivePreviousRow>({
+      autoCommit: false,
+      mutationFn: () => {
+        throw optimisticFailure
+      },
+    })
+    const persistence = optimistic.isPersisted.promise.catch((error) => error)
+    optimistic.mutate(() => collection.insert({ id: 3, value: 30 }))
+    expect(collection.has(3), `failed-sync optimistic overlay appears`).toBe(
+      true,
+    )
+    await expect(optimistic.commit()).rejects.toBe(optimisticFailure)
+    expect(await persistence, `failed optimistic receipt`).toBe(
+      optimisticFailure,
+    )
+    expect(
+      collection.has(3),
+      `failed-sync optimistic overlay rolls back before restart`,
+    ).toBe(false)
+
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    expect(syncRunCount, `replacement sync run started`).toBe(2)
+    const observation = observeValuePublications(collection)
+    subscription = observation.subscription
+    sync.begin()
+    sync.write({ type: `update`, value: { id: 1, value: 11 } })
+    expect(sync.commit(), `clean replacement batch applies`).toBe(true)
+    expect(observation.publications).toStrictEqual([
+      [{ type: `update`, key: 1, value: 11, previousValue: 10 }],
+    ])
+  } finally {
+    subscription?.unsubscribe()
+    await collection.cleanup()
+  }
+})
+
+it(`generates open, committed, and aborted sync transactions`, () => {
+  const commands = fc.sample(optimisticStep, { seed: 86104, numRuns: 200 })
+  expect(commands.some((step) => step.type === `open`)).toBe(true)
+  expect(commands.some((step) => step.type === `close` && step.commit)).toBe(
+    true,
+  )
+  expect(commands.some((step) => step.type === `close` && !step.commit)).toBe(
+    true,
+  )
+})
+
+it(`generates direct delete actions`, () => {
+  const commands = fc.sample(optimisticStep, { seed: 86104, numRuns: 100 })
+  expect(commands.some((step) => step.type === `delete`)).toBe(true)
+})
+
+it(`generates source batches inside insert, update, and delete handlers`, () => {
+  const histories = fc.sample(optimisticHistory, { seed: 86103, numRuns: 100 })
+  const inHandler = histories.flatMap(({ steps }) =>
+    steps.flatMap((step) =>
+      (step.type === `edit` || step.type === `delete`) && step.inHandler
+        ? [{ type: step.type, batch: step.inHandler }]
+        : [],
+    ),
+  )
+  expect(inHandler.some((entry) => entry.type === `edit`)).toBe(true)
+  expect(inHandler.some((entry) => entry.type === `delete`)).toBe(true)
+  expect(inHandler.some((entry) => entry.batch.awaitReceipt)).toBe(true)
+  expect(inHandler.some((entry) => !entry.batch.awaitReceipt)).toBe(true)
+  expect(inHandler.some((entry) => entry.batch.rows.length > 0)).toBe(true)
+})
+
+it(`drops a completed direct insert whose handler wrote no sync row`, async () => {
+  // Law: settlement drops the optimistic state. An open truncate does not
+  // touch the inserted key, so nothing holds the completed row.
+  let sync!: Parameters<SyncConfig<RetainedRow, number>[`sync`]>[0]
+  const events: Array<string> = []
+  const collection = createCollection<RetainedRow, number>({
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+      },
+    },
+    onInsert: () => Promise.resolve(),
+  })
+  const subscription = collection.subscribeChanges(
+    (changes) => {
+      for (const change of changes) events.push(`${change.type}:${change.key}`)
+    },
+    { includeInitialState: false },
+  )
+  try {
+    await collection.stateWhenReady()
+    sync.begin()
+    sync.truncate()
+    await collection.insert({ id: 1, value: 1 }).isPersisted.promise
+    expect(sync.commit()).toBe(true)
+    await collection.insert({ id: 2, value: 2 }).isPersisted.promise
+
+    expect(events).toEqual([`insert:1`, `delete:1`, `insert:2`, `delete:2`])
+    expect([...collection.state.keys()]).toEqual([])
+    expect([...collection._state.syncedData.keys()]).toEqual([])
+    expect([...collection._state.heldOptimisticRows.keys()]).toEqual([])
+  } finally {
+    subscription.unsubscribe()
+    await collection.cleanup()
+  }
+})
diff --git a/packages/db/tests/collection-subscription-lifecycle-cell-support.ts b/packages/db/tests/collection-subscription-lifecycle-cell-support.ts
new file mode 100644
index 0000000000..f383168b58
--- /dev/null
+++ b/packages/db/tests/collection-subscription-lifecycle-cell-support.ts
@@ -0,0 +1,315 @@
+import { declareOracle } from './oracle-declaration.js'
+
+/**
+ * Acquisition-boundary cells and scenario grammar for the demand lifecycle
+ * oracle. The explicit cell table names every legal phase/entry pair and gives
+ * a reason for every excluded pair. The scenario tables enumerate the start,
+ * failure-delivery, release, and restart cases that the drivers run.
+ *
+ * This module holds shared definitions only. The law is owned by
+ * collection-subscription-lifecycle-oracle.test.ts. The cell witnesses and
+ * their coverage audit live in collection-subscription-lifecycle-cells.test.ts.
+ */
+
+export type StartOutcome = `return` | `throw` | `resolve` | `reject`
+export type StartReentry =
+  | `none`
+  | `abort-self`
+  | `truncate`
+  | `release-self`
+  | `release-peer`
+  | `unsubscribe`
+  | `cleanup`
+export type RestartReentry =
+  `none` | `release-self` | `release-peer` | `unsubscribe` | `cleanup`
+
+export const acquisitionPhases = [
+  `deferred`,
+  `starting`,
+  `on-demand`,
+  `eager`,
+  `retiring`,
+  `unavailable`,
+] as const
+export const acquisitionEntries = [
+  `request`,
+  `resume`,
+  `markReady`,
+  `fail`,
+  `syncReturn`,
+] as const
+export type AcquisitionPhase = (typeof acquisitionPhases)[number]
+export type AcquisitionEntry = (typeof acquisitionEntries)[number]
+export type AcquisitionCell = `${AcquisitionPhase}:${AcquisitionEntry}`
+
+export type AcquisitionCellDefinition =
+  { kind: `covered` } | { kind: `excluded`; reason: string }
+
+export const acquisitionCellDefinitions = {
+  'deferred:request': { kind: `covered` },
+  'deferred:resume': { kind: `covered` },
+  'deferred:markReady': {
+    kind: `excluded`,
+    reason: `the sync callback has not started and cannot mark ready`,
+  },
+  'deferred:fail': {
+    kind: `excluded`,
+    reason: `the sync callback has not started and cannot mark error`,
+  },
+  'deferred:syncReturn': {
+    kind: `excluded`,
+    reason: `the deferred sync callback has no result to return`,
+  },
+  'starting:request': { kind: `covered` },
+  'starting:resume': {
+    kind: `excluded`,
+    reason: `resuming the deferred gate enters this phase only once`,
+  },
+  'starting:markReady': { kind: `covered` },
+  'starting:fail': { kind: `covered` },
+  'starting:syncReturn': { kind: `covered` },
+  'on-demand:request': { kind: `covered` },
+  'on-demand:resume': {
+    kind: `excluded`,
+    reason: `an installed loader is no longer behind the deferred gate`,
+  },
+  'on-demand:markReady': { kind: `covered` },
+  'on-demand:fail': { kind: `covered` },
+  'on-demand:syncReturn': {
+    kind: `excluded`,
+    reason: `the sync callback already returned the installed loader`,
+  },
+  'eager:request': { kind: `covered` },
+  'eager:resume': {
+    kind: `excluded`,
+    reason: `eager sync is not a deferred subset acquisition`,
+  },
+  'eager:markReady': {
+    kind: `excluded`,
+    reason: `eager readiness does not install a subset loader`,
+  },
+  'eager:fail': {
+    kind: `excluded`,
+    reason: `eager errors do not change subset acquisition availability`,
+  },
+  'eager:syncReturn': {
+    kind: `excluded`,
+    reason: `eager sync results own no subset loader contract`,
+  },
+  'retiring:request': { kind: `covered` },
+  'retiring:resume': {
+    kind: `excluded`,
+    reason: `retirement is outside the deferred-start gate`,
+  },
+  'retiring:markReady': {
+    kind: `excluded`,
+    reason: `callbacks from a retiring sync run cannot restore availability`,
+  },
+  'retiring:fail': {
+    kind: `excluded`,
+    reason: `callbacks from a retiring sync run are obsolete`,
+  },
+  'retiring:syncReturn': {
+    kind: `excluded`,
+    reason: `obsolete returned resources use the resource-installation axis`,
+  },
+  'unavailable:request': { kind: `covered` },
+  'unavailable:resume': {
+    kind: `excluded`,
+    reason: `an initial error is final for its sync attempt; only a restart recovers`,
+  },
+  'unavailable:markReady': {
+    kind: `excluded`,
+    reason: `markReady after fail in one sync attempt is a contract violation and throws`,
+  },
+  'unavailable:fail': {
+    kind: `excluded`,
+    reason: `a repeated error leaves acquisition unavailable`,
+  },
+  'unavailable:syncReturn': {
+    kind: `excluded`,
+    reason: `handler-less return is the transition into unavailable`,
+  },
+} satisfies Record<AcquisitionCell, AcquisitionCellDefinition>
+
+/**
+ * The cell table is the grammar of acquisition coverage. Its calibration test
+ * in the oracle file reaches it through the cell sets derived below.
+ */
+declareOracle({ grammar: [acquisitionCellDefinitions] })
+
+export const legalAcquisitionCells = new Set<AcquisitionCell>(
+  Object.entries(acquisitionCellDefinitions)
+    .filter(([, definition]) => definition.kind === `covered`)
+    .map(([cell]) => cell as AcquisitionCell),
+)
+export const excludedAcquisitionCells = new Map<AcquisitionCell, string>(
+  Object.entries(acquisitionCellDefinitions).flatMap(([cell, definition]) =>
+    definition.kind === `excluded`
+      ? [[cell as AcquisitionCell, definition.reason]]
+      : [],
+  ),
+)
+
+/**
+ * Model-only lifecycle projection spanning attempts and accepted acquisitions:
+ * `none` has no accepted work; `starting` is a tentative acquisition attempt;
+ * `active` has an accepted physical acquisition and its acquisition lease;
+ * `obsolete` has retired acquisition ownership; `failed-release` has attempted
+ * acquisition release and must not retry it.
+ */
+export const acquisitionLifecycleStates = [
+  `none`,
+  `starting`,
+  `active`,
+  `obsolete`,
+  `failed-release`,
+] as const
+export const acquisitionInteractionCauses = [
+  `release`,
+  `abort`,
+  `truncate`,
+  `cleanup`,
+  `unsubscribe`,
+] as const
+export type AcquisitionLifecycleState =
+  (typeof acquisitionLifecycleStates)[number]
+export type AcquisitionInteractionCause =
+  (typeof acquisitionInteractionCauses)[number]
+export type AcquisitionInteractionCell =
+  `${AcquisitionLifecycleState}:${AcquisitionInteractionCause}`
+// `retire` projects the end of ownership, not necessarily acquisition release.
+// A synchronous throw is a rejection (maintainer decision): the attempt is
+// accepted and its transport fails.
+// Cleanup invalidation cancels a returned tentative acquisition before activation
+// without retaining its lease. An accepted acquisition instead releases its lease.
+// Logical demand can survive this boundary, as it does during truncate replay.
+// An `active` interaction ends accepted ownership through acquisition release
+// or enclosing sync-run cleanup.
+export type AcquisitionInteraction =
+  | `no-acquisition`
+  | `abort-only`
+  | `retire`
+  | `no-repeat-on-truncate`
+  | `no-repeat-on-cleanup`
+  | `no-repeat-on-unsubscribe`
+export type AcquisitionInteractionCellDefinition =
+  | { kind: `covered`; interaction: AcquisitionInteraction }
+  | { kind: `excluded`; reason: string }
+
+export const acquisitionInteractionCellDefinitions = {
+  'none:release': {
+    kind: `covered`,
+    interaction: `no-acquisition`,
+  },
+  'none:abort': {
+    kind: `covered`,
+    interaction: `no-acquisition`,
+  },
+  'none:truncate': {
+    kind: `covered`,
+    interaction: `no-acquisition`,
+  },
+  'none:cleanup': {
+    kind: `covered`,
+    interaction: `no-acquisition`,
+  },
+  'none:unsubscribe': {
+    kind: `covered`,
+    interaction: `no-acquisition`,
+  },
+  'starting:release': { kind: `covered`, interaction: `retire` },
+  'starting:abort': { kind: `covered`, interaction: `abort-only` },
+  'starting:truncate': { kind: `covered`, interaction: `retire` },
+  'starting:cleanup': { kind: `covered`, interaction: `retire` },
+  'starting:unsubscribe': { kind: `covered`, interaction: `retire` },
+  'active:release': { kind: `covered`, interaction: `retire` },
+  'active:abort': {
+    kind: `covered`,
+    interaction: `abort-only`,
+  },
+  'active:truncate': { kind: `covered`, interaction: `retire` },
+  'active:cleanup': { kind: `covered`, interaction: `retire` },
+  'active:unsubscribe': { kind: `covered`, interaction: `retire` },
+  'obsolete:release': {
+    kind: `excluded`,
+    reason: `the replacement owns later release; obsolete work was retired once`,
+  },
+  'obsolete:abort': {
+    kind: `excluded`,
+    reason: `obsolete work was already signaled and retired`,
+  },
+  'obsolete:truncate': {
+    kind: `excluded`,
+    reason: `another truncate retires the current replacement, not already-obsolete work`,
+  },
+  'obsolete:cleanup': {
+    kind: `excluded`,
+    reason: `sync-run cleanup retires the current sync run; obsolete work was retired once`,
+  },
+  'obsolete:unsubscribe': {
+    kind: `excluded`,
+    reason: `unsubscribe retires current ownership; obsolete work was retired once`,
+  },
+  'failed-release:release': {
+    kind: `excluded`,
+    reason: `logical release already happened; the acquisition attempt is final`,
+  },
+  'failed-release:abort': {
+    kind: `excluded`,
+    reason: `the failed physical release is already aborted`,
+  },
+  'failed-release:truncate': {
+    kind: `covered`,
+    interaction: `no-repeat-on-truncate`,
+  },
+  'failed-release:cleanup': {
+    kind: `covered`,
+    interaction: `no-repeat-on-cleanup`,
+  },
+  'failed-release:unsubscribe': {
+    kind: `covered`,
+    interaction: `no-repeat-on-unsubscribe`,
+  },
+} satisfies Record<
+  AcquisitionInteractionCell,
+  AcquisitionInteractionCellDefinition
+>
+
+export const startOutcomes = [`return`, `throw`, `resolve`, `reject`] as const
+export const startReentries = [
+  `none`,
+  `abort-self`,
+  `truncate`,
+  `release-self`,
+  `release-peer`,
+  `unsubscribe`,
+  `cleanup`,
+] as const
+
+export type StartScenario = {
+  outcome: StartOutcome
+  reentry: StartReentry
+}
+
+export const startScenarios: ReadonlyArray<StartScenario> =
+  startOutcomes.flatMap((outcome) =>
+    startReentries.map((reentry) => ({ outcome, reentry })),
+  )
+
+export const failureScenarios = ([`throw`, `reject`] as const).flatMap(
+  (outcome) => startReentries.map((reentry) => ({ outcome, reentry })),
+)
+
+export const releaseScenarios = ([`return`, `throw`] as const).flatMap(
+  (outcome) =>
+    ([`none`, `reacquire-self`, `release-peer`, `unsubscribe`] as const).map(
+      (reentry) => ({ outcome, reentry }),
+    ),
+)
+
+export const restartScenarios = startOutcomes.flatMap((outcome) =>
+  (
+    [`none`, `release-self`, `release-peer`, `unsubscribe`, `cleanup`] as const
+  ).map((reentry: RestartReentry) => ({ outcome, reentry })),
+)
diff --git a/packages/db/tests/collection-subscription-lifecycle-cells.test.ts b/packages/db/tests/collection-subscription-lifecycle-cells.test.ts
new file mode 100644
index 0000000000..34e5205193
--- /dev/null
+++ b/packages/db/tests/collection-subscription-lifecycle-cells.test.ts
@@ -0,0 +1,2021 @@
+import { afterAll, describe, expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { Func, PropRef, Value } from '../src/query/ir.js'
+import {
+  captureMicrotaskErrors,
+  createOnDemandCollection,
+  flushPromises,
+} from './utils.js'
+import { oracleReplayRequested } from './oracle-config.js'
+import {
+  acquisitionInteractionCellDefinitions,
+  failureScenarios,
+  legalAcquisitionCells,
+  releaseScenarios,
+  restartScenarios,
+  startScenarios,
+} from './collection-subscription-lifecycle-cell-support.js'
+import type {
+  AcquisitionCell,
+  AcquisitionInteraction,
+  AcquisitionInteractionCell,
+  StartReentry,
+} from './collection-subscription-lifecycle-cell-support.js'
+import type { CollectionSubscription } from '../src/collection/subscription.js'
+import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
+
+/**
+ * Cell witnesses for the subscription acquisition boundary matrix. Each
+ * acquisition case declares the cells it may reach, and the scenario drivers
+ * record the cells, interactions, sync-run boundaries, and failure-delivery
+ * suffixes that they observe. The coverage audit in afterAll fails if a legal
+ * cell was never observed.
+ *
+ * The law, the cell definitions, and the scenario grammar are owned by
+ * collection-subscription-lifecycle-oracle.test.ts and its support module.
+ * Undeclared reach is a failure. Every observer and audit state is local to
+ * this module, so the witnesses and the audit must run in the same file.
+ */
+
+const observedAcquisitionCells = new Set<AcquisitionCell>()
+
+function acquisitionCase(
+  cells: ReadonlyArray<AcquisitionCell>,
+  name: string,
+  run: (reach: (cell: AcquisitionCell) => void) => void | Promise<void>,
+): void {
+  const declaredCells = new Set(cells)
+  it(name, () =>
+    run((cell) => {
+      if (!declaredCells.has(cell)) {
+        throw new Error(`${name} reached undeclared acquisition cell ${cell}`)
+      }
+      observedAcquisitionCells.add(cell)
+    }),
+  )
+}
+
+const requiredAcquisitionInteractions = new Map<
+  AcquisitionInteractionCell,
+  AcquisitionInteraction
+>(
+  Object.entries(acquisitionInteractionCellDefinitions).flatMap(
+    ([cell, definition]) =>
+      definition.kind === `covered`
+        ? [[cell as AcquisitionInteractionCell, definition.interaction]]
+        : [],
+  ),
+)
+const observedAcquisitionInteractions = new Map<
+  AcquisitionInteractionCell,
+  AcquisitionInteraction
+>()
+
+function observeAcquisitionInteraction(
+  cell: AcquisitionInteractionCell,
+  interaction: AcquisitionInteraction,
+): void {
+  observedAcquisitionInteractions.set(cell, interaction)
+}
+
+const requiredSyncRunBoundaries = new Set([
+  `active-cleanup`,
+  `restart-installed`,
+  `cleanup-callback-reentry`,
+  `obsolete-resource-return`,
+] as const)
+type SyncRunBoundary =
+  typeof requiredSyncRunBoundaries extends Set<infer T> ? T : never
+const observedSyncRunBoundaries = new Set<SyncRunBoundary>()
+
+function observeSyncRunBoundary(boundary: SyncRunBoundary): void {
+  observedSyncRunBoundaries.add(boundary)
+}
+
+type FailureDeliverySuffix = `${`throw` | `reject`}:${StartReentry}`
+const requiredFailureDeliverySuffixes = new Set<FailureDeliverySuffix>(
+  failureScenarios.map(
+    ({ outcome, reentry }) => `${outcome}:${reentry}` as const,
+  ),
+)
+const observedFailureDeliverySuffixes = new Set<FailureDeliverySuffix>()
+
+describe(`CollectionSubscription demand lifecycle oracle`, () => {
+  afterAll(() => {
+    // A direct property replay may select only that test by name.
+    if (oracleReplayRequested()) return
+    expect(observedAcquisitionCells).toEqual(legalAcquisitionCells)
+    expect(observedAcquisitionInteractions).toEqual(
+      requiredAcquisitionInteractions,
+    )
+    expect(observedSyncRunBoundaries).toEqual(requiredSyncRunBoundaries)
+    expect(observedFailureDeliverySuffixes).toEqual(
+      requiredFailureDeliverySuffixes,
+    )
+  })
+
+  it.each(startScenarios)(
+    `keeps logical and physical ownership aligned for $outcome × $reentry`,
+    async ({ outcome, reentry }) => {
+      const targetWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`target`),
+      ])
+      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
+      const failure = new Error(`target load failed`)
+      const pending = createDeferred<void>()
+      // A reentrant release can make the subscription stop observing the
+      // adapter Promise. Keep the test process deterministic while separately
+      // asserting the subscription's public error trace below.
+      void pending.promise.catch(() => {})
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const errors: Array<unknown> = []
+      const statuses: Array<string> = []
+      const controller = new AbortController()
+      let didReenter = false
+      let statusAtTruncate: string | undefined
+      let truncate!: () => void
+      let runReentry = () => {}
+
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `demand-start-${outcome}-${reentry}`,
+        sync: {
+          sync: (operations) => {
+            const { markReady } = operations
+            truncate = () => {
+              operations.begin()
+              operations.truncate()
+              operations.commit()
+            }
+            markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                if (options.where === peerWhere) return true
+                if (didReenter) return true
+                didReenter = true
+                runReentry()
+                if (outcome === `throw`) throw failure
+                if (outcome === `return`) return true
+                return pending.promise
+              },
+              unloadSubset: (options) => unloads.push(options),
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+      subscription.on(`status:change`, ({ status }) => statuses.push(status))
+
+      if (reentry === `release-peer`) {
+        subscription.requestSnapshot({ where: peerWhere })
+      }
+      runReentry = () => {
+        if (reentry === `abort-self`) {
+          controller.abort()
+        } else if (reentry === `truncate`) {
+          truncate()
+          statusAtTruncate = subscription.status
+        } else if (reentry === `release-self`) {
+          subscription.releaseSnapshot(targetWhere)
+        } else if (reentry === `release-peer`) {
+          subscription.releaseSnapshot(peerWhere)
+        } else if (reentry === `unsubscribe`) {
+          subscription.unsubscribe()
+        } else if (reentry === `cleanup`) {
+          void collection.cleanup()
+        }
+      }
+
+      let thrown: unknown
+      try {
+        subscription.requestSnapshot({
+          where: targetWhere,
+          signal: controller.signal,
+        })
+      } catch (error) {
+        thrown = error
+      }
+
+      if (reentry === `truncate`) {
+        // The old acquisition is obsolete, but the queued replacement still
+        // owns a loading interval until its setup and work finish.
+        expect(statusAtTruncate).toBe(`loadingSubset`)
+        expect(subscription.status).toBe(`loadingSubset`)
+        expect(loads).toHaveLength(1)
+      }
+      const targetLoad = loads.find(({ where }) => where === targetWhere)!
+      const peerLoad = loads.find(({ where }) => where === peerWhere)
+      const targetWasReleased =
+        reentry === `release-self` ||
+        reentry === `truncate` ||
+        reentry === `unsubscribe` ||
+        reentry === `cleanup`
+      // A synchronous throw is a rejection (maintainer decision): it starts
+      // the acquisition, as a rejected Promise does.
+      const targetStarted = reentry !== `cleanup`
+
+      if (outcome === `resolve`) pending.resolve()
+      if (outcome === `reject`) pending.reject(failure)
+      await flushPromises()
+
+      const interaction =
+        reentry === `abort-self`
+          ? `starting:abort`
+          : reentry === `truncate`
+            ? `starting:truncate`
+            : reentry === `release-self`
+              ? `starting:release`
+              : reentry === `release-peer`
+                ? `active:release`
+                : reentry === `unsubscribe`
+                  ? `starting:unsubscribe`
+                  : reentry === `cleanup`
+                    ? `starting:cleanup`
+                    : undefined
+      if (interaction) {
+        observeAcquisitionInteraction(
+          interaction,
+          reentry === `abort-self` ? `abort-only` : `retire`,
+        )
+      }
+
+      expect(thrown).toBeUndefined()
+      expect(targetLoad.signal?.aborted).toBe(
+        targetWasReleased || reentry === `abort-self`,
+      )
+      expect(unloads.filter((options) => options === targetLoad)).toHaveLength(
+        Number(targetStarted && targetWasReleased),
+      )
+      expect(unloads.filter((options) => options === peerLoad)).toHaveLength(
+        Number(reentry === `release-peer`),
+      )
+      expect(errors).toEqual(
+        (outcome === `throw` || outcome === `reject`) &&
+          !targetWasReleased &&
+          reentry !== `abort-self`
+          ? [failure]
+          : [],
+      )
+      expect(statuses).toEqual(
+        reentry === `truncate` || (outcome !== `return` && !targetWasReleased)
+          ? [`loadingSubset`, `ready`]
+          : [],
+      )
+      if (reentry === `truncate`) {
+        // Every start retains logical demand, also one that throws: its
+        // first transport rejects, and the replay acquires it again.
+        expect(loads).toHaveLength(2)
+        expect(loads[1]).not.toBe(targetLoad)
+        expect(loads[1]?.where).toBe(targetWhere)
+        expect(loads[1]?.signal?.aborted).toBe(false)
+      }
+
+      subscription.unsubscribe()
+      await collection.cleanup()
+    },
+  )
+
+  it.each(failureScenarios)(
+    `keeps a $outcome failure primary during $reentry error delivery`,
+    async ({ outcome, reentry }) => {
+      const targetWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`target`),
+      ])
+      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
+      const failure = new Error(`target load failed`)
+      const pending = createDeferred<void>()
+      const loads: Array<LoadSubsetOptions> = []
+      const attempts: Array<{
+        syncRunGeneration: number
+        options: LoadSubsetOptions
+        result: `peer-return` | `throw` | `pending` | `replay-return`
+      }> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const sourceCleanupSyncRuns: Array<number> = []
+      const errors: Array<unknown> = []
+      const statuses: Array<string> = []
+      const controller = new AbortController()
+      let truncateCount = 0
+      let truncate = () => {}
+      let targetLoadCount = 0
+
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `demand-failure-${outcome}-${reentry}`,
+        sync: {
+          sync: (operations) => {
+            truncate = () => {
+              truncateCount++
+              operations.begin()
+              operations.truncate()
+              operations.commit()
+            }
+            const { markReady } = operations
+            markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                if (options.where === peerWhere) {
+                  attempts.push({
+                    syncRunGeneration: 0,
+                    options,
+                    result: `peer-return`,
+                  })
+                  return true
+                }
+                targetLoadCount++
+                if (targetLoadCount > 1) {
+                  attempts.push({
+                    syncRunGeneration: 0,
+                    options,
+                    result: `replay-return`,
+                  })
+                  return true
+                }
+                if (outcome === `throw`) {
+                  attempts.push({
+                    syncRunGeneration: 0,
+                    options,
+                    result: `throw`,
+                  })
+                  throw failure
+                }
+                attempts.push({
+                  syncRunGeneration: 0,
+                  options,
+                  result: `pending`,
+                })
+                return pending.promise
+              },
+              unloadSubset: (options) => unloads.push(options),
+              cleanup: () => {
+                sourceCleanupSyncRuns.push(0)
+              },
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      subscription.on(`status:change`, ({ status }) => statuses.push(status))
+      subscription.on(`loadSubset:error`, ({ error }) => {
+        errors.push(error)
+        if (reentry === `abort-self`) {
+          controller.abort()
+        } else if (reentry === `truncate`) {
+          truncate()
+        } else if (reentry === `release-self`) {
+          subscription.releaseSnapshot(targetWhere)
+        } else if (reentry === `release-peer`) {
+          subscription.releaseSnapshot(peerWhere)
+        } else if (reentry === `unsubscribe`) {
+          subscription.unsubscribe()
+        } else if (reentry === `cleanup`) {
+          void collection.cleanup()
+        }
+      })
+
+      subscription.requestSnapshot({ where: peerWhere })
+      let thrown: unknown
+      try {
+        subscription.requestSnapshot({
+          where: targetWhere,
+          signal: controller.signal,
+        })
+      } catch (error) {
+        thrown = error
+      }
+      if (outcome === `reject`) {
+        pending.reject(failure)
+      }
+      await flushPromises()
+
+      const targetLoad = loads.find(({ where }) => where === targetWhere)!
+      const peerLoad = loads.find(({ where }) => where === peerWhere)!
+      const targetAttempts = attempts.filter(
+        ({ options }) => options.where === targetWhere,
+      )
+      const peerAttempts = attempts.filter(
+        ({ options }) => options.where === peerWhere,
+      )
+      const tearsDownTarget =
+        reentry === `release-self` || reentry === `unsubscribe`
+
+      // A synchronous throw is a rejection (maintainer decision): the start
+      // does not throw, and the failure is delivered as a rejection's is.
+      expect.soft(thrown).toBeUndefined()
+      expect.soft(errors).toEqual([failure])
+      expect.soft(subscription.lastError).toBe(failure)
+      expect.soft(targetAttempts[0]?.options).toBe(targetLoad)
+      expect.soft(targetAttempts[0]?.syncRunGeneration).toBe(0)
+      expect
+        .soft(targetAttempts[0]?.result)
+        .toBe(outcome === `throw` ? `throw` : `pending`)
+      expect.soft(controller.signal.aborted).toBe(reentry === `abort-self`)
+      expect.soft(truncateCount).toBe(Number(reentry === `truncate`))
+      expect
+        .soft(unloads.filter((options) => options === targetLoad))
+        .toHaveLength(Number(tearsDownTarget || reentry === `truncate`))
+      expect
+        .soft(unloads.filter((options) => options === peerLoad))
+        .toHaveLength(
+          Number(
+            reentry === `release-peer` ||
+              reentry === `unsubscribe` ||
+              reentry === `truncate`,
+          ),
+        )
+      expect
+        .soft(statuses)
+        .toEqual(
+          reentry === `truncate`
+            ? [`loadingSubset`, `ready`]
+            : reentry === `unsubscribe`
+              ? [`loadingSubset`]
+              : [`loadingSubset`, `ready`],
+        )
+      if (reentry === `abort-self`) {
+        expect.soft(targetLoad.signal?.aborted).toBe(true)
+        expect.soft(targetAttempts).toHaveLength(1)
+        expect.soft(peerAttempts).toHaveLength(1)
+      }
+      const replacement = targetAttempts[1]?.options
+      const peerReplacement = peerAttempts[1]?.options
+      if (reentry === `truncate`) {
+        expect.soft(targetLoad.signal?.aborted).toBe(true)
+        // Error delivery may request replay: a failed start still owns its
+        // logical demand, also one that threw.
+        expect.soft(targetAttempts).toHaveLength(2)
+        expect.soft(replacement).not.toBe(targetLoad)
+        expect.soft(replacement?.where).toBe(targetWhere)
+        expect.soft(targetAttempts[1]?.syncRunGeneration).toBe(0)
+        expect.soft(targetAttempts[1]?.result).toBe(`replay-return`)
+        expect.soft(peerLoad.signal?.aborted).toBe(true)
+        expect.soft(peerAttempts).toHaveLength(2)
+        expect.soft(peerReplacement).not.toBe(peerLoad)
+        expect.soft(peerReplacement?.where).toBe(peerWhere)
+        expect.soft(peerAttempts[1]?.syncRunGeneration).toBe(0)
+        expect.soft(peerAttempts[1]?.result).toBe(`peer-return`)
+        expect.soft(unloads).toHaveLength(2)
+      }
+      if (reentry === `cleanup`) {
+        expect.soft(collection.status).toBe(`cleaned-up`)
+        expect.soft(peerLoad.signal?.aborted).toBe(true)
+        expect.soft(targetLoad.signal?.aborted).toBe(true)
+        expect.soft(subscription.status).toBe(`ready`)
+      }
+
+      subscription.unsubscribe()
+      const replays = reentry === `truncate`
+      expect.soft(targetAttempts).toHaveLength(replays ? 2 : 1)
+      expect.soft(peerAttempts).toHaveLength(replays ? 2 : 1)
+      expect
+        .soft(unloads.filter((options) => options === targetLoad))
+        .toHaveLength(Number(reentry !== `cleanup`))
+      expect
+        .soft(unloads.filter((options) => options === peerLoad))
+        .toHaveLength(Number(reentry !== `cleanup`))
+      if (replacement) {
+        expect
+          .soft(unloads.filter((options) => options === replacement))
+          .toHaveLength(Number(replays))
+        expect.soft(replacement.signal?.aborted).toBe(true)
+      }
+      if (peerReplacement) {
+        expect
+          .soft(unloads.filter((options) => options === peerReplacement))
+          .toHaveLength(Number(replays))
+        expect.soft(peerReplacement.signal?.aborted).toBe(true)
+      }
+      const expectedUnloads = reentry === `cleanup` ? 0 : 2 * (replays ? 2 : 1)
+      expect.soft(unloads).toHaveLength(expectedUnloads)
+      expect.soft(peerLoad.signal?.aborted).toBe(true)
+      expect.soft(targetLoad.signal?.aborted).toBe(true)
+      const terminalAttempts = [...attempts]
+      const terminalUnloads = [...unloads]
+      const terminalStatuses = [...statuses]
+      await collection.cleanup()
+      expect.soft(sourceCleanupSyncRuns).toEqual([0])
+      expect.soft(collection.status).toBe(`cleaned-up`)
+      expect.soft(errors).toEqual([failure])
+      expect.soft(subscription.lastError).toBe(failure)
+      expect.soft(attempts).toEqual(terminalAttempts)
+      expect.soft(unloads).toEqual(terminalUnloads)
+      expect.soft(statuses).toEqual(terminalStatuses)
+      observedFailureDeliverySuffixes.add(`${outcome}:${reentry}`)
+    },
+  )
+
+  it.each(releaseScenarios)(
+    `retires logical ownership once for unload $outcome × $reentry`,
+    async ({ outcome, reentry }) => {
+      const targetWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`target`),
+      ])
+      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
+      const releaseFailure = new Error(`target release failed`)
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const errors: Array<unknown> = []
+      const uncaught = captureMicrotaskErrors()
+      let allowRelease = outcome === `return`
+      let runReentry = () => {}
+
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `demand-release-${outcome}-${reentry}`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: (options) => {
+                unloads.push(options)
+                if (options === loads[1]) {
+                  runReentry()
+                  if (!allowRelease) throw releaseFailure
+                }
+              },
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+      subscription.requestSnapshot({ where: peerWhere })
+      subscription.requestSnapshot({ where: targetWhere })
+      const peerLoad = loads[0]!
+      const oldTargetLoad = loads[1]!
+      runReentry = () => {
+        runReentry = () => {}
+        if (reentry === `reacquire-self`) {
+          subscription.requestSnapshot({ where: targetWhere })
+        } else if (reentry === `release-peer`) {
+          subscription.releaseSnapshot(peerWhere)
+        } else if (reentry === `unsubscribe`) {
+          subscription.unsubscribe()
+        }
+      }
+
+      let thrown: unknown
+      try {
+        subscription.releaseSnapshot(targetWhere)
+      } catch (error) {
+        thrown = error
+      }
+      observeAcquisitionInteraction(`active:release`, `retire`)
+      if (reentry === `unsubscribe`) {
+        observeAcquisitionInteraction(`active:unsubscribe`, `retire`)
+      }
+
+      // The release law: the caller never sees the adapter's release error.
+      expect(thrown).toBe(undefined)
+      await Promise.resolve()
+      expect(uncaught.errors).toEqual(
+        outcome === `throw` ? [releaseFailure] : [],
+      )
+      expect(oldTargetLoad.signal?.aborted).toBe(true)
+      expect(
+        unloads.filter((options) => options === oldTargetLoad),
+      ).toHaveLength(1)
+      expect(unloads.filter((options) => options === peerLoad)).toHaveLength(
+        Number(reentry === `release-peer` || reentry === `unsubscribe`),
+      )
+      // A release error is not a load error.
+      expect(errors).toEqual([])
+      expect(subscription.lastError).toBe(undefined)
+
+      allowRelease = true
+      subscription.unsubscribe()
+      expect(
+        unloads.filter((options) => options === oldTargetLoad),
+      ).toHaveLength(1)
+      const replacement = loads[2]
+      expect(
+        replacement === undefined
+          ? []
+          : unloads.filter((options) => options === replacement),
+      ).toHaveLength(Number(reentry === `reacquire-self`))
+      expect(unloads.filter((options) => options === peerLoad)).toHaveLength(1)
+      if (outcome === `throw` && reentry === `unsubscribe`) {
+        observeAcquisitionInteraction(
+          `failed-release:unsubscribe`,
+          `no-repeat-on-unsubscribe`,
+        )
+      }
+      await collection.cleanup()
+      await Promise.resolve()
+      // Reported once: neither teardown repeats the attempted release.
+      expect(uncaught.errors).toEqual(
+        outcome === `throw` ? [releaseFailure] : [],
+      )
+      uncaught.restore()
+    },
+  )
+
+  it.each(restartScenarios)(
+    `keeps restart ownership aligned for $outcome × $reentry`,
+    async ({ outcome, reentry }) => {
+      type DemandName = `target` | `peer`
+      const targetWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`target`),
+      ])
+      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
+      const demandForWhere = new Map<unknown, DemandName>([
+        [targetWhere, `target`],
+        [peerWhere, `peer`],
+      ])
+      const failure = new Error(`restart acquisition failed`)
+      const pending = createDeferred<void>()
+      void pending.promise.catch(() => {})
+      const loads: Array<{
+        syncRunGeneration: number
+        demand: DemandName
+      }> = []
+      const unloads: Array<{
+        syncRunGeneration: number
+        demand: DemandName
+      }> = []
+      const sourceCleanups: Array<number> = []
+      const errors: Array<unknown> = []
+      let nextSyncRunGeneration = -1
+      let ranReentry = false
+
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `restart-${outcome}-${reentry}`,
+        sync: {
+          sync: ({ markReady }) => {
+            const syncRunGeneration = ++nextSyncRunGeneration
+            markReady()
+            return {
+              loadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown restart demand`)
+                loads.push({ syncRunGeneration, demand })
+                if (syncRunGeneration === 0 || demand === `peer`) return true
+                if (!ranReentry) {
+                  ranReentry = true
+                  if (reentry === `release-self`) {
+                    subscription.releaseSnapshot(targetWhere)
+                  } else if (reentry === `release-peer`) {
+                    subscription.releaseSnapshot(peerWhere)
+                  } else if (reentry === `unsubscribe`) {
+                    subscription.unsubscribe()
+                  } else if (reentry === `cleanup`) {
+                    void collection.cleanup()
+                  }
+                }
+                if (outcome === `throw`) throw failure
+                if (outcome === `return`) return true
+                return pending.promise
+              },
+              unloadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown restart demand`)
+                unloads.push({ syncRunGeneration, demand })
+              },
+              cleanup: () => {
+                sourceCleanups.push(syncRunGeneration)
+              },
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+      subscription.requestSnapshot({ where: targetWhere })
+      subscription.requestSnapshot({ where: peerWhere })
+
+      await collection.cleanup()
+      expect(sourceCleanups).toEqual([0])
+      observeAcquisitionInteraction(`active:cleanup`, `retire`)
+      collection.startSyncImmediate()
+      observeSyncRunBoundary(`restart-installed`)
+      await flushPromises()
+      if (outcome === `resolve`) pending.resolve()
+      if (outcome === `reject`) pending.reject(failure)
+      await flushPromises()
+
+      // A synchronous throw is a rejection: it establishes the acquisition.
+      const targetEstablished = reentry !== `cleanup`
+      const targetSurvives = reentry === `none` || reentry === `release-peer`
+      const peerStarts =
+        reentry !== `release-peer` &&
+        reentry !== `unsubscribe` &&
+        reentry !== `cleanup`
+      expect(loads).toEqual([
+        { syncRunGeneration: 0, demand: `target` },
+        { syncRunGeneration: 0, demand: `peer` },
+        { syncRunGeneration: 1, demand: `target` },
+        ...(peerStarts
+          ? [{ syncRunGeneration: 1, demand: `peer` as const }]
+          : []),
+      ])
+      expect(errors).toEqual(
+        (outcome === `throw` || outcome === `reject`) && targetSurvives
+          ? [failure]
+          : [],
+      )
+
+      if (reentry !== `unsubscribe`) subscription.unsubscribe()
+      expect(unloads).toEqual([
+        ...(targetEstablished && !targetSurvives
+          ? [{ syncRunGeneration: 1, demand: `target` as const }]
+          : []),
+        ...(targetEstablished && targetSurvives
+          ? [{ syncRunGeneration: 1, demand: `target` as const }]
+          : []),
+        ...(peerStarts
+          ? [{ syncRunGeneration: 1, demand: `peer` as const }]
+          : []),
+      ])
+      await collection.cleanup()
+      expect(sourceCleanups).toEqual([0, 1])
+    },
+  )
+
+  acquisitionCase(
+    [`starting:request`],
+    `includes demand created by the synchronous restart status callback`,
+    async (reach) => {
+      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+      const demandForWhere = new Map<unknown, `old` | `new`>([
+        [oldWhere, `old`],
+        [newWhere, `new`],
+      ])
+      const loads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const unloads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      let nextSyncRunGeneration = -1
+      let requestOnRestart = false
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `restart-status-reentry`,
+        sync: {
+          sync: ({ markReady }) => {
+            const syncRunGeneration = ++nextSyncRunGeneration
+            markReady()
+            return {
+              loadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown restart demand`)
+                loads.push({ syncRunGeneration, demand })
+                return true
+              },
+              unloadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown restart demand`)
+                unloads.push({ syncRunGeneration, demand })
+              },
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      subscription.on(`status:change`, ({ status }) => {
+        if (!requestOnRestart || status !== `loadingSubset`) return
+        requestOnRestart = false
+        subscription.requestSnapshot({ where: newWhere })
+        reach(`starting:request`)
+      })
+      subscription.requestSnapshot({ where: oldWhere })
+
+      await collection.cleanup()
+      requestOnRestart = true
+      collection.startSyncImmediate()
+      await flushPromises()
+
+      expect(loads).toEqual([
+        { syncRunGeneration: 0, demand: `old` },
+        { syncRunGeneration: 1, demand: `old` },
+        { syncRunGeneration: 1, demand: `new` },
+      ])
+      expect(subscription.status).toBe(`ready`)
+
+      subscription.unsubscribe()
+      expect(unloads).toEqual([
+        { syncRunGeneration: 1, demand: `old` },
+        { syncRunGeneration: 1, demand: `new` },
+      ])
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`starting:markReady`],
+    `does not settle demand reentered before the restart loader is installed`,
+    async (reach) => {
+      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+      const demandForWhere = new Map<unknown, `old` | `new`>([
+        [oldWhere, `old`],
+        [newWhere, `new`],
+      ])
+      const loads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const unloads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const observed: Array<unknown> = []
+      let nextSyncRunGeneration = -1
+      let requestOnReady = false
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `restart-ready-reentry`,
+        sync: {
+          sync: ({ markReady }) => {
+            const syncRunGeneration = ++nextSyncRunGeneration
+            markReady()
+            return {
+              loadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown ready demand`)
+                loads.push({ syncRunGeneration, demand })
+                return true
+              },
+              unloadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown ready unload`)
+                unloads.push({ syncRunGeneration, demand })
+              },
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      const removeReadyListener = collection.on(`status:ready`, () => {
+        if (!requestOnReady) return
+        requestOnReady = false
+        subscription.requestSnapshot({
+          where: newWhere,
+          onLoadSubsetResult: (result) => observed.push(result),
+        })
+        reach(`starting:markReady`)
+      })
+      subscription.requestSnapshot({ where: oldWhere })
+
+      await collection.cleanup()
+      requestOnReady = true
+      collection.startSyncImmediate()
+      await flushPromises()
+
+      expect(loads).toEqual([
+        { syncRunGeneration: 0, demand: `old` },
+        { syncRunGeneration: 1, demand: `old` },
+        { syncRunGeneration: 1, demand: `new` },
+      ])
+      expect(observed).toEqual([expect.any(Promise)])
+      expect(subscription.status).toBe(`ready`)
+
+      removeReadyListener()
+      subscription.unsubscribe()
+      expect(unloads).toEqual([
+        { syncRunGeneration: 1, demand: `old` },
+        { syncRunGeneration: 1, demand: `new` },
+      ])
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`unavailable:request`],
+    `does not settle demand reentered before a failed restart installs a loader`,
+    async (reach) => {
+      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+      const syncFailure = new Error(`replacement sync failed`)
+      const demandForWhere = new Map<unknown, `old` | `new`>([
+        [oldWhere, `old`],
+        [newWhere, `new`],
+      ])
+      const loads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const unloads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const observed: Array<unknown> = []
+      let nextSyncRunGeneration = -1
+      let requestOnError = false
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `restart-error-reentry`,
+        sync: {
+          sync: ({ markReady }) => {
+            const syncRunGeneration = ++nextSyncRunGeneration
+            if (syncRunGeneration === 1) throw syncFailure
+            markReady()
+            return {
+              loadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown error demand`)
+                loads.push({ syncRunGeneration, demand })
+                return true
+              },
+              unloadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown error unload`)
+                unloads.push({ syncRunGeneration, demand })
+              },
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      const removeErrorListener = collection.on(`status:crashed`, () => {
+        if (!requestOnError) return
+        requestOnError = false
+        subscription.requestSnapshot({
+          where: newWhere,
+          onLoadSubsetResult: (result) => observed.push(result),
+        })
+        reach(`unavailable:request`)
+      })
+      subscription.requestSnapshot({ where: oldWhere })
+
+      await collection.cleanup()
+      requestOnError = true
+      expect(() => collection.startSyncImmediate()).toThrow(syncFailure)
+      expect(observed).toEqual([expect.any(Promise)])
+      expect(collection.status).toBe(`crashed`)
+      expect(loads).toEqual([{ syncRunGeneration: 0, demand: `old` }])
+
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      await flushPromises()
+      expect(loads).toEqual([
+        { syncRunGeneration: 0, demand: `old` },
+        { syncRunGeneration: 2, demand: `old` },
+        { syncRunGeneration: 2, demand: `new` },
+      ])
+      expect(subscription.status).toBe(`ready`)
+
+      removeErrorListener()
+      subscription.unsubscribe()
+      expect(unloads).toEqual([
+        { syncRunGeneration: 2, demand: `old` },
+        { syncRunGeneration: 2, demand: `new` },
+      ])
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`retiring:request`],
+    `does not acquire through a retiring adapter cleanup callback`,
+    async (reach) => {
+      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+      const demandForWhere = new Map<unknown, `old` | `new`>([
+        [oldWhere, `old`],
+        [newWhere, `new`],
+      ])
+      const loads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const unloads: Array<{
+        syncRunGeneration: number
+        demand: `old` | `new`
+      }> = []
+      const observed: Array<unknown> = []
+      let nextSyncRunGeneration = -1
+      let requestDuringCleanup = false
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `adapter-cleanup-reentry`,
+        sync: {
+          sync: ({ markReady }) => {
+            const syncRunGeneration = ++nextSyncRunGeneration
+            markReady()
+            return {
+              loadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown cleanup demand`)
+                loads.push({ syncRunGeneration, demand })
+                return true
+              },
+              unloadSubset: (options) => {
+                const demand = demandForWhere.get(options.where)
+                if (!demand) throw new Error(`unknown cleanup unload`)
+                unloads.push({ syncRunGeneration, demand })
+              },
+              cleanup: () => {
+                if (!requestDuringCleanup) return
+                requestDuringCleanup = false
+                subscription.requestSnapshot({
+                  where: newWhere,
+                  onLoadSubsetResult: (result) => observed.push(result),
+                })
+                reach(`retiring:request`)
+                observeSyncRunBoundary(`cleanup-callback-reentry`)
+              },
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      subscription.requestSnapshot({ where: oldWhere })
+
+      requestDuringCleanup = true
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      await flushPromises()
+
+      expect(loads).toEqual([
+        { syncRunGeneration: 0, demand: `old` },
+        { syncRunGeneration: 1, demand: `old` },
+        { syncRunGeneration: 1, demand: `new` },
+      ])
+      expect(observed).toEqual([expect.any(Promise)])
+
+      subscription.unsubscribe()
+      expect(unloads).toEqual([
+        { syncRunGeneration: 1, demand: `old` },
+        { syncRunGeneration: 1, demand: `new` },
+      ])
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`eager:request`],
+    `does not release a physical subset acquisition in eager mode`,
+    async (reach) => {
+      let loads = 0
+      let unloads = 0
+      const collection = createCollection<{ id: string }>({
+        id: `eager-subset-ownership`,
+        getKey: ({ id }) => id,
+        syncMode: `eager`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                return true
+              },
+              unloadSubset: () => {
+                unloads++
+              },
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+
+      subscription.requestSnapshot()
+      reach(`eager:request`)
+      subscription.unsubscribe()
+      observeAcquisitionInteraction(`none:unsubscribe`, `no-acquisition`)
+
+      expect(loads).toBe(0)
+      expect(unloads).toBe(0)
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`on-demand:request`],
+    `does not release a subset request aborted before adapter acquisition`,
+    async (reach) => {
+      const controller = new AbortController()
+      controller.abort()
+      let loads = 0
+      let unloads = 0
+      const errors: Array<unknown> = []
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `pre-aborted-subset-ownership`,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                return true
+              },
+              unloadSubset: () => {
+                unloads++
+              },
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+
+      subscription.requestSnapshot({ signal: controller.signal })
+      await flushPromises()
+      reach(`on-demand:request`)
+      subscription.unsubscribe()
+      observeAcquisitionInteraction(`none:unsubscribe`, `no-acquisition`)
+
+      expect(loads).toBe(0)
+      expect(unloads).toBe(0)
+      expect(errors).toEqual([])
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`on-demand:request`, `on-demand:markReady`],
+    `acquires before and after ready once the on-demand loader is installed`,
+    async (reach) => {
+      const beforeReady = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`before`),
+      ])
+      const afterReady = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`after`),
+      ])
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      let markReady!: () => void
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `installed-loader-before-ready`,
+        startSync: false,
+        sync: {
+          sync: (operations) => {
+            markReady = operations.markReady
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: (options) => unloads.push(options),
+            }
+          },
+        },
+      })
+      collection.startSyncImmediate()
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      const removeReadyListener = collection.on(`status:ready`, () => {
+        subscription.requestSnapshot({ where: afterReady })
+        reach(`on-demand:markReady`)
+      })
+
+      subscription.requestSnapshot({ where: beforeReady })
+      reach(`on-demand:request`)
+      expect(collection.status).toBe(`loading`)
+      expect(loads.map(({ where }) => where)).toEqual([beforeReady])
+
+      markReady()
+      await flushPromises()
+      expect(loads.map(({ where }) => where)).toEqual([beforeReady, afterReady])
+
+      removeReadyListener()
+      subscription.unsubscribe()
+      expect(unloads).toEqual(loads)
+      await collection.cleanup()
+    },
+  )
+
+  // Demand created while acquisition is deferred stays logical until an
+  // explicit resumption. That resumption also releases any render start gate;
+  // retirement before it returns no acquisition lease. The phase named
+  // `deferred` here is deferred acquisition, not an already resumed owner
+  // whose provider work is still blocked by an unrelated render.
+  acquisitionCase(
+    [`deferred:request`, `deferred:resume`],
+    `owns deferred-start acquisition only when it reaches the adapter`,
+    async (reach) => {
+      for (const action of [`resume`, `release-before-resume`] as const) {
+        const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+        const loads: Array<LoadSubsetOptions> = []
+        const unloads: Array<LoadSubsetOptions> = []
+        const collection = createOnDemandCollection<{ id: string }>({
+          id: `deferred-start-${action}`,
+          startSync: false,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+              return {
+                loadSubset: (options) => {
+                  loads.push(options)
+                  return true
+                },
+                unloadSubset: (options) => unloads.push(options),
+              }
+            },
+          },
+        })
+        expect(collection._deferSyncStart()).toBe(true)
+        const subscription = collection.subscribeChanges(() => {}, {
+          includeInitialState: false,
+          deferAcquisition: true,
+        })
+        subscription.requestSnapshot({ where })
+        reach(`deferred:request`)
+        expect(loads).toEqual([])
+
+        if (action === `release-before-resume`) {
+          subscription.releaseSnapshot(where)
+        }
+        subscription.resumeDeferredAcquisition()
+        await flushPromises()
+        if (action === `resume`) reach(`deferred:resume`)
+
+        expect(loads).toHaveLength(action === `resume` ? 1 : 0)
+        subscription.unsubscribe()
+        expect(unloads).toHaveLength(action === `resume` ? 1 : 0)
+        if (action === `resume`) expect(unloads).toEqual(loads)
+        await collection.cleanup()
+      }
+    },
+  )
+
+  acquisitionCase(
+    [`starting:syncReturn`],
+    `does not settle ready-callback demand when on-demand sync returns no loader`,
+    async (reach) => {
+      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+      const loads: Array<LoadSubsetOptions> = []
+      const observed: Array<unknown> = []
+      type ResultOutcome =
+        | { status: `pending` }
+        | { status: `fulfilled`; value: unknown }
+        | { status: `rejected`; error: unknown }
+      const outcomes: Array<{ outcome: ResultOutcome }> = []
+      let nextSyncRunGeneration = 0
+      let requestOnReady = false
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `ready-before-invalid-on-demand-return`,
+        sync: {
+          sync: ({ markReady }) => {
+            const syncRunGeneration = nextSyncRunGeneration++
+            markReady()
+            if (syncRunGeneration === 1) return
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      const removeReadyListener = collection.on(`status:ready`, () => {
+        if (!requestOnReady) return
+        requestOnReady = false
+        subscription.requestSnapshot({
+          where: newWhere,
+          onLoadSubsetResult: (result) => {
+            observed.push(result)
+            const entry: { outcome: ResultOutcome } = {
+              outcome: { status: `pending` },
+            }
+            outcomes.push(entry)
+            if (result instanceof Promise) {
+              void result.then(
+                (value) => {
+                  entry.outcome = { status: `fulfilled`, value }
+                },
+                (error: unknown) => {
+                  entry.outcome = { status: `rejected`, error }
+                },
+              )
+            } else {
+              entry.outcome = { status: `fulfilled`, value: result }
+            }
+          },
+        })
+      })
+      let failed = false
+      let primaryError: unknown
+      try {
+        subscription.requestSnapshot({ where: oldWhere })
+
+        await collection.cleanup()
+        requestOnReady = true
+        expect(() => collection.startSyncImmediate()).toThrow(
+          /did not return a loadSubset handler/,
+        )
+        reach(`starting:syncReturn`)
+
+        expect(observed).toEqual([expect.any(Promise)])
+        expect(collection.status).toBe(`crashed`)
+        expect(loads.map(({ where }) => where)).toEqual([oldWhere])
+        await flushPromises()
+        expect(outcomes).toHaveLength(1)
+        const beforeUnsubscribe = outcomes[0]!.outcome
+        expect(beforeUnsubscribe.status).not.toBe(`fulfilled`)
+        expect(loads.map(({ where }) => where)).toEqual([oldWhere])
+
+        removeReadyListener()
+        subscription.unsubscribe()
+        await flushPromises()
+        const afterUnsubscribe = outcomes[0]!.outcome
+        if (beforeUnsubscribe.status === `pending`) {
+          expect(afterUnsubscribe.status).toBe(`rejected`)
+          if (afterUnsubscribe.status !== `rejected`) {
+            throw new Error(`Unsubscribed startup waiter did not reject`)
+          }
+          expect(afterUnsubscribe.error).toMatchObject({ name: `AbortError` })
+        } else {
+          // Invalid startup may already have rejected. Do not impose an
+          // earlier rejection time or replace its observed error identity.
+          expect(afterUnsubscribe).toBe(beforeUnsubscribe)
+        }
+        expect(observed).toHaveLength(1)
+        expect(outcomes).toHaveLength(1)
+        expect(collection.subscriberCount).toBe(0)
+        expect(loads.map(({ where }) => where)).toEqual([oldWhere])
+      } catch (error) {
+        failed = true
+        primaryError = error
+      }
+      const cleanupErrors: Array<unknown> = []
+      for (const cleanup of [
+        removeReadyListener,
+        () => subscription.unsubscribe(),
+        () => collection.cleanup(),
+      ]) {
+        try {
+          await cleanup()
+        } catch (error) {
+          cleanupErrors.push(error)
+        }
+      }
+      if (cleanupErrors.length) {
+        if (failed) {
+          throw new AggregateError(
+            [primaryError, ...cleanupErrors],
+            `No-loader observation and cleanup failed`,
+            { cause: primaryError },
+          )
+        }
+        if (cleanupErrors.length === 1) throw cleanupErrors[0]
+        throw new AggregateError(cleanupErrors, `No-loader cleanup failed`)
+      }
+      if (failed) throw primaryError
+    },
+  )
+
+  acquisitionCase(
+    [`starting:fail`],
+    `keeps demand requested during initial error unacquired until a restart`,
+    async (reach) => {
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+      const loads: Array<LoadSubsetOptions> = []
+      const observed: Array<unknown> = []
+      let syncRunCount = 0
+      let recover!: () => void
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `sync-entry-error-ready-recovery`,
+        startSync: false,
+        sync: {
+          sync: ({ fail, markReady }) => {
+            if (syncRunCount++ !== 1) {
+              markReady()
+              return {
+                loadSubset: (options) => {
+                  loads.push(options)
+                  return true
+                },
+                unloadSubset: () => {},
+              }
+            }
+            recover = markReady
+            fail(new Error(`initial sync failed`))
+            reach(`starting:fail`)
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        () => {},
+        {
+          includeInitialState: false,
+        },
+      )
+      await collection.cleanup()
+      const removeErrorListener = collection.on(`status:error`, () => {
+        subscription.requestSnapshot({
+          where,
+          onLoadSubsetResult: (result) => observed.push(result),
+        })
+      })
+
+      collection.startSyncImmediate()
+      await flushPromises()
+      expect.soft(collection.status).toBe(`error`)
+      expect.soft(loads).toEqual([])
+      expect.soft(observed).toEqual([expect.any(Promise)])
+
+      // The initial error is final for this attempt: its markReady() does
+      // nothing (maintainer decision).
+      expect(() => recover()).not.toThrow()
+      await flushPromises()
+      expect(collection.status).toBe(`error`)
+      expect(loads).toEqual([])
+
+      // A restart begins a new attempt, which acquires the surviving demand.
+      removeErrorListener()
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      await flushPromises()
+      expect(collection.status).toBe(`ready`)
+      expect(loads.map(({ where: loadedWhere }) => loadedWhere)).toEqual([
+        where,
+      ])
+
+      subscription.unsubscribe()
+      await collection.cleanup()
+    },
+  )
+
+  acquisitionCase(
+    [`on-demand:fail`],
+    `keeps demand from an installed loader's initial error unacquired until a restart`,
+    async (reach) => {
+      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+      const loads: Array<LoadSubsetOptions> = []
+      let fail!: (error: unknown) => void
+      let markReady!: () => void
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `installed-loader-initial-error`,
+        startSync: false,
+        sync: {
+          sync: (operations) => {
+            fail = operations.fail
+            markReady = operations.markReady
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      collection.startSyncImmediate()
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      subscription.requestSnapshot({ where: oldWhere })
+      const removeErrorListener = collection.on(`status:error`, () => {
+        subscription.requestSnapshot({ where: newWhere })
+        reach(`on-demand:fail`)
+      })
+
+      fail(new Error(`initial sync failed`))
+
+      await flushPromises()
+      expect.soft(collection.status).toBe(`error`)
+      expect.soft(loads.map(({ where }) => where)).toEqual([oldWhere])
+
+      expect(() => markReady()).not.toThrow()
+      expect(collection.status).toBe(`error`)
+
+      // A restart begins a new attempt, which acquires the surviving demand.
+      removeErrorListener()
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      markReady()
+      await flushPromises()
+      // The first attempt acquired `old` before its error. The new attempt
+      // acquires both surviving demands; `new` was never acquired before.
+      expect(loads.map(({ where }) => where)).toEqual([
+        oldWhere,
+        oldWhere,
+        newWhere,
+      ])
+
+      subscription.unsubscribe()
+      await collection.cleanup()
+    },
+  )
+
+  it(`directly releases eager demand without a physical acquisition`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    let loads = 0
+    let unloads = 0
+    const collection = createCollection<{ id: string }>({
+      id: `eager-direct-release`,
+      getKey: ({ id }) => id,
+      syncMode: `eager`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              return true
+            },
+            unloadSubset: () => {
+              unloads++
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    subscription.requestSnapshot({ where })
+    subscription.releaseSnapshot(where)
+    observeAcquisitionInteraction(`none:release`, `no-acquisition`)
+
+    expect(loads).toBe(0)
+    expect(unloads).toBe(0)
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`truncates eager demand without creating or releasing a physical acquisition`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createCollection<{ id: string }>({
+      id: `eager-truncate-without-acquisition`,
+      getKey: ({ id }) => id,
+      syncMode: `eager`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot({ where })
+
+    begin()
+    truncate()
+    commit()
+    await flushPromises()
+    observeAcquisitionInteraction(`none:truncate`, `no-acquisition`)
+
+    expect.soft(loads).toEqual([])
+    expect.soft(unloads).toEqual([])
+
+    subscription.unsubscribe()
+    expect(unloads).toEqual([])
+    await collection.cleanup()
+  })
+
+  it(`directly releases pre-aborted demand without a physical acquisition`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const controller = new AbortController()
+    controller.abort()
+    let loads = 0
+    let unloads = 0
+    const errors: Array<unknown> = []
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `pre-aborted-direct-release`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              return true
+            },
+            unloadSubset: () => {
+              unloads++
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+
+    subscription.requestSnapshot({
+      where,
+      signal: controller.signal,
+    })
+    await flushPromises()
+    subscription.releaseSnapshot(where)
+    observeAcquisitionInteraction(`none:release`, `no-acquisition`)
+
+    expect(loads).toBe(0)
+    expect(unloads).toBe(0)
+    expect(errors).toEqual([])
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`aborts detached demand without creating a physical acquisition`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const controller = new AbortController()
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `detached-abort-without-acquisition`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    await collection.cleanup()
+    subscription.requestSnapshot({ where, signal: controller.signal })
+    controller.abort()
+    await flushPromises()
+    observeAcquisitionInteraction(`none:abort`, `no-acquisition`)
+
+    expect(loads).toEqual([])
+    expect(unloads).toEqual([])
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`keeps an aborted active acquisition until its owner retires`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const controller = new AbortController()
+    const pending = createDeferred<void>()
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `active-abort-before-release`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return pending.promise
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    subscription.requestSnapshot({ where, signal: controller.signal })
+    const acquisition = loads[0]!
+    controller.abort()
+    await flushPromises()
+    observeAcquisitionInteraction(`active:abort`, `abort-only`)
+
+    expect(loads).toEqual([acquisition])
+    expect(acquisition.signal?.aborted).toBe(true)
+    expect(unloads).toEqual([])
+
+    pending.resolve()
+    await flushPromises()
+    subscription.unsubscribe()
+    expect(unloads).toEqual([acquisition])
+    await collection.cleanup()
+  })
+
+  it.each([`cleanup`, `release`, `unsubscribe`, `resume`] as const)(
+    `settles queued demand according to whether it starts: %s`,
+    async (action) => {
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+      const observed: Array<true | Promise<void>> = []
+      let loads = 0
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `deferred-start-cleanup-before-resume`,
+        startSync: false,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                return true
+              },
+            }
+          },
+        },
+      })
+      expect(collection._deferSyncStart()).toBe(true)
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+        deferAcquisition: true,
+      })
+      subscription.requestSnapshot({
+        where,
+        onLoadSubsetResult: (result) => observed.push(result),
+      })
+
+      if (action === `cleanup`) await collection.cleanup()
+      else if (action === `release`) subscription.releaseSnapshot(where)
+      else if (action === `unsubscribe`) subscription.unsubscribe()
+      else subscription.resumeDeferredAcquisition()
+      await flushPromises()
+      if (action === `cleanup`) {
+        observeAcquisitionInteraction(`none:cleanup`, `no-acquisition`)
+      }
+
+      expect(loads).toBe(action === `resume` ? 1 : 0)
+      expect(observed).toHaveLength(1)
+      const deferredResult = observed[0]
+      expect(deferredResult).toBeInstanceOf(Promise)
+      if (!(deferredResult instanceof Promise)) {
+        throw new Error(`deferred acquisition did not return a promise`)
+      }
+      if (action === `resume`)
+        await expect(deferredResult).resolves.toBeUndefined()
+      else
+        await expect(deferredResult).rejects.toMatchObject({
+          name: `AbortError`,
+        })
+
+      subscription.unsubscribe()
+      await collection.cleanup()
+    },
+  )
+
+  it(`retires resources returned after ready-callback cleanup invalidates sync`, async () => {
+    const cleanupSyncRuns: Array<number> = []
+    let nextSyncRunGeneration = 0
+    let cleanOnReady = false
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `obsolete-sync-return`,
+      sync: {
+        sync: ({ markReady }) => {
+          const syncRunGeneration = nextSyncRunGeneration++
+          markReady()
+          return {
+            loadSubset: () => true,
+            unloadSubset: () => {},
+            cleanup: () => {
+              cleanupSyncRuns.push(syncRunGeneration)
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    const removeReadyListener = collection.on(`status:ready`, () => {
+      if (!cleanOnReady) return
+      cleanOnReady = false
+      void collection.cleanup()
+    })
+
+    await collection.cleanup()
+    cleanOnReady = true
+    collection.startSyncImmediate()
+    observeSyncRunBoundary(`obsolete-resource-return`)
+
+    expect(collection.status).toBe(`cleaned-up`)
+    expect(cleanupSyncRuns).toEqual([0, 1])
+
+    removeReadyListener()
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`retires failed acquisition release with its sync run cleanup`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const releaseFailure = new Error(`release failed`)
+    const uncaught = captureMicrotaskErrors()
+    let unloads = 0
+    let sourceCleanups = 0
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `cleanup-failed-release`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: () => true,
+            unloadSubset: () => {
+              unloads++
+              if (unloads === 1) throw releaseFailure
+            },
+            cleanup: () => {
+              sourceCleanups++
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot({ where })
+    expect(() => subscription.releaseSnapshot(where)).not.toThrow()
+    await Promise.resolve()
+    expect(uncaught.errors).toEqual([releaseFailure])
+
+    await collection.cleanup()
+    expect(unloads).toBe(1)
+    expect(sourceCleanups).toBe(1)
+    observeSyncRunBoundary(`active-cleanup`)
+
+    await collection.cleanup()
+    expect(unloads).toBe(1)
+    expect(sourceCleanups).toBe(1)
+    observeAcquisitionInteraction(
+      `failed-release:cleanup`,
+      `no-repeat-on-cleanup`,
+    )
+    subscription.unsubscribe()
+    await Promise.resolve()
+    expect(uncaught.errors).toEqual([releaseFailure])
+    uncaught.restore()
+  })
+
+  it(`keeps failed releases out of truncate replay`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const releaseFailure = new Error(`release failed`)
+    const uncaught = captureMicrotaskErrors()
+    let unloads = 0
+    let operations!: Parameters<SyncConfig<{ id: string }, string>[`sync`]>[0]
+    const collection = createCollection<{ id: string }, string>({
+      id: `truncate-failed-release`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (nextOperations) => {
+          operations = nextOperations
+          operations.markReady()
+          return {
+            loadSubset: () => true,
+            unloadSubset: () => {
+              unloads++
+              if (unloads === 1) throw releaseFailure
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot({ where })
+    expect(() => subscription.releaseSnapshot(where)).not.toThrow()
+
+    operations.begin()
+    operations.truncate()
+    const receipt = operations.commit()
+    if (receipt !== true) await receipt
+    expect(unloads).toBe(1)
+
+    subscription.unsubscribe()
+    expect(unloads).toBe(1)
+    observeAcquisitionInteraction(
+      `failed-release:truncate`,
+      `no-repeat-on-truncate`,
+    )
+    await collection.cleanup()
+    await Promise.resolve()
+    expect(uncaught.errors).toEqual([releaseFailure])
+    uncaught.restore()
+  })
+
+  it(`enters loading status when a truncate queues replay work`, async () => {
+    const replay = createDeferred<void>()
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `queued-replay-status`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return loads.length === 1 ? true : replay.promise
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot({ where })
+    const original = loads[0]!
+
+    begin()
+    truncate()
+    commit()
+    observeAcquisitionInteraction(`active:truncate`, `retire`)
+
+    expect(loads).toHaveLength(1)
+    expect(subscription.status).toBe(`loadingSubset`)
+
+    await flushPromises()
+    const replacement = loads[1]!
+    expect(loads).toHaveLength(2)
+    expect(original.signal?.aborted).toBe(true)
+    expect(unloads).toEqual([original])
+    expect(replacement).not.toBe(original)
+    expect(replacement.where).toBe(where)
+    expect(replacement.signal?.aborted).toBe(false)
+    replay.resolve()
+    await flushPromises()
+    expect(subscription.status).toBe(`ready`)
+
+    subscription.unsubscribe()
+    expect(unloads).toEqual([original, replacement])
+    await collection.cleanup()
+  })
+})
diff --git a/packages/db/tests/collection-subscription-lifecycle-grammar-oracle.ts b/packages/db/tests/collection-subscription-lifecycle-grammar-oracle.ts
index e3c8bb178f..9fe42773fa 100644
--- a/packages/db/tests/collection-subscription-lifecycle-grammar-oracle.ts
+++ b/packages/db/tests/collection-subscription-lifecycle-grammar-oracle.ts
@@ -1,4 +1,5 @@
 import { fc } from '@fast-check/vitest'
+import { declareOracle } from './oracle-declaration.js'
 
 /**
  * # Which subscription histories are legal?
@@ -1443,3 +1444,16 @@ export function expectedStartHandoff(history: StartHandoffHistory) {
     starts: 1,
   } as const
 }
+
+declareOracle({
+  model: [
+    createLifecycleModel,
+    reduceLifecycle,
+    expectedCleanedRestartDemand,
+    expectedParkedReloadDemand,
+    expectedDeferralBatches,
+    expectedStartHandoff,
+    modelSubscriberStartCleanup,
+  ],
+  grammar: [parkedReloadDemandCases],
+})
diff --git a/packages/db/tests/collection-subscription-lifecycle-oracle.test.ts b/packages/db/tests/collection-subscription-lifecycle-oracle.test.ts
index 9a30e82fab..732f772612 100644
--- a/packages/db/tests/collection-subscription-lifecycle-oracle.test.ts
+++ b/packages/db/tests/collection-subscription-lifecycle-oracle.test.ts
@@ -1,5 +1,5 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { afterAll, describe, expect, it } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
 import { createDeferred } from '../src/deferred.js'
 import { BTreeIndex } from '../src/indexes/btree-index.js'
@@ -13,17 +13,36 @@ import {
 import {
   oraclePropertyOptions,
   oracleRandomParameters,
-  oracleReplayRequested,
   oracleReplayTest,
   readOracleRunConfig,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import {
   modelSubscriberResumeRetirement,
   modelSubscriberStartCleanup,
   subscriberResumeRetirementHistories,
   subscriberStartCleanupHistories,
 } from './collection-subscription-lifecycle-grammar-oracle.js'
-import type { CollectionSubscription } from '../src/collection/subscription.js'
+import {
+  acquisitionCellDefinitions,
+  acquisitionEntries,
+  acquisitionInteractionCauses,
+  acquisitionInteractionCellDefinitions,
+  acquisitionLifecycleStates,
+  acquisitionPhases,
+  excludedAcquisitionCells,
+  failureScenarios,
+  legalAcquisitionCells,
+  releaseScenarios,
+  restartScenarios,
+  startOutcomes,
+  startReentries,
+  startScenarios,
+} from './collection-subscription-lifecycle-cell-support.js'
+import type {
+  AcquisitionCell,
+  AcquisitionInteractionCell,
+} from './collection-subscription-lifecycle-cell-support.js'
 import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
 
 /**
@@ -35,9 +54,12 @@ import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
  * drivers then add sync return/throw/resolve/reject, abort, release, peer loss,
  * unsubscribe, cleanup, restart, and reentry in controlled orders.
  *
- * Each case declares the cells it may reach; undeclared reach is a failure and
- * the final audit fails if a legal cell was never observed. Counts, signals,
- * errors, readiness, owners, and rows are checked separately.
+ * The cell witnesses live in collection-subscription-lifecycle-cells.test.ts.
+ * Each case there declares the cells it may reach, and the coverage audit in
+ * that file fails if a legal cell was never observed. This file keeps the
+ * grammar calibrations, the model checks, and the generated properties that
+ * run the scenario drivers. Counts, signals, errors, readiness, owners, and
+ * rows are checked separately.
  *
  * Release law: an `unloadSubset` that throws is an adapter bug. The
  * subscription attempts each physical release once and reports its error
@@ -49,360 +71,6 @@ import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
  * second copy of their transition implementation.
  */
 
-type StartOutcome = `return` | `throw` | `resolve` | `reject`
-type StartReentry =
-  | `none`
-  | `abort-self`
-  | `truncate`
-  | `release-self`
-  | `release-peer`
-  | `unsubscribe`
-  | `cleanup`
-type RestartReentry =
-  `none` | `release-self` | `release-peer` | `unsubscribe` | `cleanup`
-
-const acquisitionPhases = [
-  `deferred`,
-  `starting`,
-  `on-demand`,
-  `eager`,
-  `retiring`,
-  `unavailable`,
-] as const
-const acquisitionEntries = [
-  `request`,
-  `resume`,
-  `markReady`,
-  `fail`,
-  `syncReturn`,
-] as const
-type AcquisitionPhase = (typeof acquisitionPhases)[number]
-type AcquisitionEntry = (typeof acquisitionEntries)[number]
-type AcquisitionCell = `${AcquisitionPhase}:${AcquisitionEntry}`
-
-type AcquisitionCellDefinition =
-  { kind: `covered` } | { kind: `excluded`; reason: string }
-
-const acquisitionCellDefinitions = {
-  'deferred:request': { kind: `covered` },
-  'deferred:resume': { kind: `covered` },
-  'deferred:markReady': {
-    kind: `excluded`,
-    reason: `the sync callback has not started and cannot mark ready`,
-  },
-  'deferred:fail': {
-    kind: `excluded`,
-    reason: `the sync callback has not started and cannot mark error`,
-  },
-  'deferred:syncReturn': {
-    kind: `excluded`,
-    reason: `the deferred sync callback has no result to return`,
-  },
-  'starting:request': { kind: `covered` },
-  'starting:resume': {
-    kind: `excluded`,
-    reason: `resuming the deferred gate enters this phase only once`,
-  },
-  'starting:markReady': { kind: `covered` },
-  'starting:fail': { kind: `covered` },
-  'starting:syncReturn': { kind: `covered` },
-  'on-demand:request': { kind: `covered` },
-  'on-demand:resume': {
-    kind: `excluded`,
-    reason: `an installed loader is no longer behind the deferred gate`,
-  },
-  'on-demand:markReady': { kind: `covered` },
-  'on-demand:fail': { kind: `covered` },
-  'on-demand:syncReturn': {
-    kind: `excluded`,
-    reason: `the sync callback already returned the installed loader`,
-  },
-  'eager:request': { kind: `covered` },
-  'eager:resume': {
-    kind: `excluded`,
-    reason: `eager sync is not a deferred subset acquisition`,
-  },
-  'eager:markReady': {
-    kind: `excluded`,
-    reason: `eager readiness does not install a subset loader`,
-  },
-  'eager:fail': {
-    kind: `excluded`,
-    reason: `eager errors do not change subset acquisition availability`,
-  },
-  'eager:syncReturn': {
-    kind: `excluded`,
-    reason: `eager sync results own no subset loader contract`,
-  },
-  'retiring:request': { kind: `covered` },
-  'retiring:resume': {
-    kind: `excluded`,
-    reason: `retirement is outside the deferred-start gate`,
-  },
-  'retiring:markReady': {
-    kind: `excluded`,
-    reason: `callbacks from a retiring sync run cannot restore availability`,
-  },
-  'retiring:fail': {
-    kind: `excluded`,
-    reason: `callbacks from a retiring sync run are obsolete`,
-  },
-  'retiring:syncReturn': {
-    kind: `excluded`,
-    reason: `obsolete returned resources use the resource-installation axis`,
-  },
-  'unavailable:request': { kind: `covered` },
-  'unavailable:resume': {
-    kind: `excluded`,
-    reason: `an initial error is final for its sync attempt; only a restart recovers`,
-  },
-  'unavailable:markReady': {
-    kind: `excluded`,
-    reason: `markReady after fail in one sync attempt is a contract violation and throws`,
-  },
-  'unavailable:fail': {
-    kind: `excluded`,
-    reason: `a repeated error leaves acquisition unavailable`,
-  },
-  'unavailable:syncReturn': {
-    kind: `excluded`,
-    reason: `handler-less return is the transition into unavailable`,
-  },
-} satisfies Record<AcquisitionCell, AcquisitionCellDefinition>
-
-const legalAcquisitionCells = new Set<AcquisitionCell>(
-  Object.entries(acquisitionCellDefinitions)
-    .filter(([, definition]) => definition.kind === `covered`)
-    .map(([cell]) => cell as AcquisitionCell),
-)
-const excludedAcquisitionCells = new Map<AcquisitionCell, string>(
-  Object.entries(acquisitionCellDefinitions).flatMap(([cell, definition]) =>
-    definition.kind === `excluded`
-      ? [[cell as AcquisitionCell, definition.reason]]
-      : [],
-  ),
-)
-const observedAcquisitionCells = new Set<AcquisitionCell>()
-
-function acquisitionCase(
-  cells: ReadonlyArray<AcquisitionCell>,
-  name: string,
-  run: (reach: (cell: AcquisitionCell) => void) => void | Promise<void>,
-): void {
-  const declaredCells = new Set(cells)
-  it(name, () =>
-    run((cell) => {
-      if (!declaredCells.has(cell)) {
-        throw new Error(`${name} reached undeclared acquisition cell ${cell}`)
-      }
-      observedAcquisitionCells.add(cell)
-    }),
-  )
-}
-
-/**
- * Model-only lifecycle projection spanning attempts and accepted acquisitions:
- * `none` has no accepted work; `starting` is a tentative acquisition attempt;
- * `active` has an accepted physical acquisition and its acquisition lease;
- * `obsolete` has retired acquisition ownership; `failed-release` has attempted
- * acquisition release and must not retry it.
- */
-const acquisitionLifecycleStates = [
-  `none`,
-  `starting`,
-  `active`,
-  `obsolete`,
-  `failed-release`,
-] as const
-const acquisitionInteractionCauses = [
-  `release`,
-  `abort`,
-  `truncate`,
-  `cleanup`,
-  `unsubscribe`,
-] as const
-type AcquisitionLifecycleState = (typeof acquisitionLifecycleStates)[number]
-type AcquisitionInteractionCause = (typeof acquisitionInteractionCauses)[number]
-type AcquisitionInteractionCell =
-  `${AcquisitionLifecycleState}:${AcquisitionInteractionCause}`
-// `retire` projects the end of ownership, not necessarily acquisition release.
-// A synchronous throw is a rejection (maintainer decision): the attempt is
-// accepted and its transport fails.
-// Cleanup invalidation cancels a returned tentative acquisition before activation
-// without retaining its lease. An accepted acquisition instead releases its lease.
-// Logical demand can survive this boundary, as it does during truncate replay.
-// An `active` interaction ends accepted ownership through acquisition release
-// or enclosing sync-run cleanup.
-type AcquisitionInteraction =
-  | `no-acquisition`
-  | `abort-only`
-  | `retire`
-  | `no-repeat-on-truncate`
-  | `no-repeat-on-cleanup`
-  | `no-repeat-on-unsubscribe`
-type AcquisitionInteractionCellDefinition =
-  | { kind: `covered`; interaction: AcquisitionInteraction }
-  | { kind: `excluded`; reason: string }
-
-const acquisitionInteractionCellDefinitions = {
-  'none:release': {
-    kind: `covered`,
-    interaction: `no-acquisition`,
-  },
-  'none:abort': {
-    kind: `covered`,
-    interaction: `no-acquisition`,
-  },
-  'none:truncate': {
-    kind: `covered`,
-    interaction: `no-acquisition`,
-  },
-  'none:cleanup': {
-    kind: `covered`,
-    interaction: `no-acquisition`,
-  },
-  'none:unsubscribe': {
-    kind: `covered`,
-    interaction: `no-acquisition`,
-  },
-  'starting:release': { kind: `covered`, interaction: `retire` },
-  'starting:abort': { kind: `covered`, interaction: `abort-only` },
-  'starting:truncate': { kind: `covered`, interaction: `retire` },
-  'starting:cleanup': { kind: `covered`, interaction: `retire` },
-  'starting:unsubscribe': { kind: `covered`, interaction: `retire` },
-  'active:release': { kind: `covered`, interaction: `retire` },
-  'active:abort': {
-    kind: `covered`,
-    interaction: `abort-only`,
-  },
-  'active:truncate': { kind: `covered`, interaction: `retire` },
-  'active:cleanup': { kind: `covered`, interaction: `retire` },
-  'active:unsubscribe': { kind: `covered`, interaction: `retire` },
-  'obsolete:release': {
-    kind: `excluded`,
-    reason: `the replacement owns later release; obsolete work was retired once`,
-  },
-  'obsolete:abort': {
-    kind: `excluded`,
-    reason: `obsolete work was already signaled and retired`,
-  },
-  'obsolete:truncate': {
-    kind: `excluded`,
-    reason: `another truncate retires the current replacement, not already-obsolete work`,
-  },
-  'obsolete:cleanup': {
-    kind: `excluded`,
-    reason: `sync-run cleanup retires the current sync run; obsolete work was retired once`,
-  },
-  'obsolete:unsubscribe': {
-    kind: `excluded`,
-    reason: `unsubscribe retires current ownership; obsolete work was retired once`,
-  },
-  'failed-release:release': {
-    kind: `excluded`,
-    reason: `logical release already happened; the acquisition attempt is final`,
-  },
-  'failed-release:abort': {
-    kind: `excluded`,
-    reason: `the failed physical release is already aborted`,
-  },
-  'failed-release:truncate': {
-    kind: `covered`,
-    interaction: `no-repeat-on-truncate`,
-  },
-  'failed-release:cleanup': {
-    kind: `covered`,
-    interaction: `no-repeat-on-cleanup`,
-  },
-  'failed-release:unsubscribe': {
-    kind: `covered`,
-    interaction: `no-repeat-on-unsubscribe`,
-  },
-} satisfies Record<
-  AcquisitionInteractionCell,
-  AcquisitionInteractionCellDefinition
->
-
-const requiredAcquisitionInteractions = new Map<
-  AcquisitionInteractionCell,
-  AcquisitionInteraction
->(
-  Object.entries(acquisitionInteractionCellDefinitions).flatMap(
-    ([cell, definition]) =>
-      definition.kind === `covered`
-        ? [[cell as AcquisitionInteractionCell, definition.interaction]]
-        : [],
-  ),
-)
-const observedAcquisitionInteractions = new Map<
-  AcquisitionInteractionCell,
-  AcquisitionInteraction
->()
-
-function observeAcquisitionInteraction(
-  cell: AcquisitionInteractionCell,
-  interaction: AcquisitionInteraction,
-): void {
-  observedAcquisitionInteractions.set(cell, interaction)
-}
-
-const requiredSyncRunBoundaries = new Set([
-  `active-cleanup`,
-  `restart-installed`,
-  `cleanup-callback-reentry`,
-  `obsolete-resource-return`,
-] as const)
-type SyncRunBoundary =
-  typeof requiredSyncRunBoundaries extends Set<infer T> ? T : never
-const observedSyncRunBoundaries = new Set<SyncRunBoundary>()
-
-function observeSyncRunBoundary(boundary: SyncRunBoundary): void {
-  observedSyncRunBoundaries.add(boundary)
-}
-
-const startOutcomes = [`return`, `throw`, `resolve`, `reject`] as const
-const startReentries = [
-  `none`,
-  `abort-self`,
-  `truncate`,
-  `release-self`,
-  `release-peer`,
-  `unsubscribe`,
-  `cleanup`,
-] as const
-
-type StartScenario = {
-  outcome: StartOutcome
-  reentry: StartReentry
-}
-
-const startScenarios: ReadonlyArray<StartScenario> = startOutcomes.flatMap(
-  (outcome) => startReentries.map((reentry) => ({ outcome, reentry })),
-)
-
-const failureScenarios = ([`throw`, `reject`] as const).flatMap((outcome) =>
-  startReentries.map((reentry) => ({ outcome, reentry })),
-)
-type FailureDeliverySuffix = `${`throw` | `reject`}:${StartReentry}`
-const requiredFailureDeliverySuffixes = new Set<FailureDeliverySuffix>(
-  failureScenarios.map(
-    ({ outcome, reentry }) => `${outcome}:${reentry}` as const,
-  ),
-)
-const observedFailureDeliverySuffixes = new Set<FailureDeliverySuffix>()
-
-const releaseScenarios = ([`return`, `throw`] as const).flatMap((outcome) =>
-  ([`none`, `reacquire-self`, `release-peer`, `unsubscribe`] as const).map(
-    (reentry) => ({ outcome, reentry }),
-  ),
-)
-
-const restartScenarios = startOutcomes.flatMap((outcome) =>
-  (
-    [`none`, `release-self`, `release-peer`, `unsubscribe`, `cleanup`] as const
-  ).map((reentry: RestartReentry) => ({ outcome, reentry })),
-)
-
 const threeGenerationScenarios = ([`resolve`, `reject`] as const).flatMap(
   (obsoleteOutcome) =>
     ([`resolve`, `reject`] as const).flatMap((currentOutcome) =>
@@ -980,6 +648,134 @@ async function runAsyncRestartScenario(
   return reached
 }
 
+/**
+ * Startup retirement model: a nested restart succeeds only when no cleanup
+ * started during the sync entry. A `ready` or `ready-effect-throw` entry also
+ * returns the obsolete sync run's cleanup resource.
+ */
+function startupRetirementModel(
+  entry: `loading` | `ready` | `adapter-throw` | `ready-effect-throw`,
+  restart: boolean,
+): {
+  cleanupStartedDuringSyncEntry: boolean
+  restartSucceeded: boolean
+  returnsObsoleteCleanup: boolean
+} {
+  const cleanupStartedDuringSyncEntry = entry !== `loading`
+  const restartSucceeded = restart && !cleanupStartedDuringSyncEntry
+  const returnsObsoleteCleanup =
+    entry === `ready` || entry === `ready-effect-throw`
+  return {
+    cleanupStartedDuringSyncEntry,
+    restartSucceeded,
+    returnsObsoleteCleanup,
+  }
+}
+
+/**
+ * Unavailable-wait model: only a release or unsubscribe during recovery retires
+ * the physical acquisition that recovery started. A cleanup ends the wait
+ * without ending the surviving demand, so the adapter sees one load when the
+ * wait began before recovery and two when recovery had already loaded it.
+ */
+function expectedUnloadsAfterUnavailableWait(
+  phase: `before` | `during`,
+  outcome:
+    | `return`
+    | `throw`
+    | `resolve`
+    | `reject`
+    | `release`
+    | `unsubscribe`
+    | `cleanup`
+    | `abort`,
+  loads: ReadonlyArray<LoadSubsetOptions>,
+): ReadonlyArray<LoadSubsetOptions> {
+  return phase === `during` &&
+    (outcome === `release` || outcome === `unsubscribe`)
+    ? loads
+    : []
+}
+
+/** Unavailable-wait model: the number of adapter loads after a cleanup ends the wait. */
+function expectedLoadsAfterCleanupEndsWait(phase: `before` | `during`): number {
+  return phase === `before` ? 1 : 2
+}
+
+/**
+ * Queued-cancel model: cleanup leaves the collection cleaned up, while release
+ * and unsubscribe leave the collection ready.
+ */
+function expectedStatusAfterQueuedCancel(
+  action: `cleanup` | `release` | `unsubscribe`,
+): `cleaned-up` | `ready` {
+  return action === `cleanup` ? `cleaned-up` : `ready`
+}
+
+/**
+ * Release-error model: a physical release that throws is reported once,
+ * uncaught, and never reaches the caller or the load error listener.
+ */
+function expectedUncaughtReleaseErrors(
+  outcome: `return` | `throw`,
+  failure: Error,
+): Array<unknown> {
+  return outcome === `throw` ? [failure] : []
+}
+
+/**
+ * Reentry model: only an adapter reentry unsubscribes before the outer release
+ * returns. A release error reaches no error listener, so that path cannot
+ * unsubscribe.
+ */
+function expectedSubscriberCountAfterRelease(
+  reentry: `adapter` | `error-listener`,
+): number {
+  return reentry === `adapter` ? 0 : 1
+}
+
+/**
+ * Three-generation model: the current sync run decides the published row and
+ * the delivered error. The obsolete run's settlement never publishes.
+ */
+function expectedThreeGenerationSettlement(
+  currentOutcome: `resolve` | `reject`,
+  currentFailure: Error,
+): {
+  version: number
+  errors: Array<unknown>
+  lastError: unknown
+} {
+  return {
+    version: currentOutcome === `resolve` ? 3 : 1,
+    errors: currentOutcome === `reject` ? [currentFailure] : [],
+    lastError: currentOutcome === `reject` ? currentFailure : undefined,
+  }
+}
+
+declareOracle({
+  check: [runAsyncRestartScenario],
+  model: [
+    modelSubscriberResumeRetirement,
+    startupRetirementModel,
+    expectedUnloadsAfterUnavailableWait,
+    expectedLoadsAfterCleanupEndsWait,
+    expectedStatusAfterQueuedCancel,
+    expectedUncaughtReleaseErrors,
+    expectedSubscriberCountAfterRelease,
+    expectedThreeGenerationSettlement,
+  ],
+  grammar: [
+    acquisitionCellDefinitions,
+    acquisitionInteractionCellDefinitions,
+    startScenarios,
+    failureScenarios,
+    releaseScenarios,
+    restartScenarios,
+    asyncRestartScenarioArbitrary,
+  ],
+})
+
 /**
  * Exhaust the synchronous adapter-start boundary before adding more runtime
  * special cases. Logical demand is visible during this callback, but a
@@ -1060,66 +856,39 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
     )
   })
 
-  afterAll(() => {
-    // A direct property replay may select only that test by name.
-    if (oracleReplayRequested()) return
-    expect(observedAcquisitionCells).toEqual(legalAcquisitionCells)
-    expect(observedAcquisitionInteractions).toEqual(
-      requiredAcquisitionInteractions,
-    )
-    expect(observedSyncRunBoundaries).toEqual(requiredSyncRunBoundaries)
-    expect(observedFailureDeliverySuffixes).toEqual(
-      requiredFailureDeliverySuffixes,
-    )
-  })
-
-  it.each(startScenarios)(
-    `keeps logical and physical ownership aligned for $outcome × $reentry`,
-    async ({ outcome, reentry }) => {
-      const targetWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`target`),
-      ])
-      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
-      const failure = new Error(`target load failed`)
-      const pending = createDeferred<void>()
-      // A reentrant release can make the subscription stop observing the
-      // adapter Promise. Keep the test process deterministic while separately
-      // asserting the subscription's public error trace below.
-      void pending.promise.catch(() => {})
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const errors: Array<unknown> = []
-      const statuses: Array<string> = []
-      const controller = new AbortController()
-      let didReenter = false
-      let statusAtTruncate: string | undefined
-      let truncate!: () => void
-      let runReentry = () => {}
-
+  it.each(
+    ([false, true] as const).flatMap((restart) =>
+      (
+        [`loading`, `ready`, `adapter-throw`, `ready-effect-throw`] as const
+      ).map((entry) => ({ restart, entry })),
+    ),
+  )(
+    `retires startup at $entry with nested restart=$restart`,
+    async ({ entry, restart }) => {
+      const failure = new Error(`obsolete startup failed`)
+      const cleanups: Array<number> = []
+      const loads: Array<number> = []
+      const unloads: Array<number> = []
+      let syncRunGeneration = -1
+      let retire = false
+      let nestedRestartError: unknown
       const collection = createOnDemandCollection<{ id: string }>({
-        id: `demand-start-${outcome}-${reentry}`,
         sync: {
-          sync: (operations) => {
-            const { markReady } = operations
-            truncate = () => {
-              operations.begin()
-              operations.truncate()
-              operations.commit()
-            }
+          sync: ({ markReady }) => {
+            const ownSyncRunGeneration = ++syncRunGeneration
             markReady()
+            if (ownSyncRunGeneration === 1 && entry === `adapter-throw`) {
+              throw failure
+            }
             return {
-              loadSubset: (options) => {
-                loads.push(options)
-                if (options.where === peerWhere) return true
-                if (didReenter) return true
-                didReenter = true
-                runReentry()
-                if (outcome === `throw`) throw failure
-                if (outcome === `return`) return true
-                return pending.promise
+              loadSubset: () => {
+                loads.push(ownSyncRunGeneration)
+                return true
+              },
+              unloadSubset: () => unloads.push(ownSyncRunGeneration),
+              cleanup: () => {
+                cleanups.push(ownSyncRunGeneration)
               },
-              unloadSubset: (options) => unloads.push(options),
             }
           },
         },
@@ -1127,1941 +896,74 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
       const subscription = collection.subscribeChanges(() => {}, {
         includeInitialState: false,
       })
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      subscription.on(`status:change`, ({ status }) => statuses.push(status))
-
-      if (reentry === `release-peer`) {
-        subscription.requestSnapshot({ where: peerWhere })
-      }
-      runReentry = () => {
-        if (reentry === `abort-self`) {
-          controller.abort()
-        } else if (reentry === `truncate`) {
-          truncate()
-          statusAtTruncate = subscription.status
-        } else if (reentry === `release-self`) {
-          subscription.releaseSnapshot(targetWhere)
-        } else if (reentry === `release-peer`) {
-          subscription.releaseSnapshot(peerWhere)
-        } else if (reentry === `unsubscribe`) {
-          subscription.unsubscribe()
-        } else if (reentry === `cleanup`) {
+      let removeListener = () => {}
+      try {
+        await collection.cleanup()
+        const retireSyncRun = () => {
+          if (!retire) return
+          retire = false
           void collection.cleanup()
+          if (restart) {
+            try {
+              collection.startSyncImmediate()
+            } catch (error) {
+              nestedRestartError = error
+            }
+          }
+          if (entry === `ready-effect-throw`) throw failure
         }
-      }
-
-      let thrown: unknown
-      try {
-        subscription.requestSnapshot({
-          where: targetWhere,
-          signal: controller.signal,
-        })
-      } catch (error) {
-        thrown = error
-      }
-
-      if (reentry === `truncate`) {
-        // The old acquisition is obsolete, but the queued replacement still
-        // owns a loading interval until its setup and work finish.
-        expect(statusAtTruncate).toBe(`loadingSubset`)
-        expect(subscription.status).toBe(`loadingSubset`)
-        expect(loads).toHaveLength(1)
-      }
-      const targetLoad = loads.find(({ where }) => where === targetWhere)!
-      const peerLoad = loads.find(({ where }) => where === peerWhere)
-      const targetWasReleased =
-        reentry === `release-self` ||
-        reentry === `truncate` ||
-        reentry === `unsubscribe` ||
-        reentry === `cleanup`
-      // A synchronous throw is a rejection (maintainer decision): it starts
-      // the acquisition, as a rejected Promise does.
-      const targetStarted = reentry !== `cleanup`
-
-      if (outcome === `resolve`) pending.resolve()
-      if (outcome === `reject`) pending.reject(failure)
-      await flushPromises()
+        removeListener =
+          entry === `ready-effect-throw`
+            ? collection.onFirstReady(retireSyncRun)
+            : collection.on(
+                entry === `loading` ? `status:loading` : `status:ready`,
+                retireSyncRun,
+              )
+        retire = true
+        if (entry === `adapter-throw` || entry === `ready-effect-throw`) {
+          expect(() => collection.startSyncImmediate()).toThrow(failure)
+        } else {
+          collection.startSyncImmediate()
+        }
+        await flushPromises()
 
-      const interaction =
-        reentry === `abort-self`
-          ? `starting:abort`
-          : reentry === `truncate`
-            ? `starting:truncate`
-            : reentry === `release-self`
-              ? `starting:release`
-              : reentry === `release-peer`
-                ? `active:release`
-                : reentry === `unsubscribe`
-                  ? `starting:unsubscribe`
-                  : reentry === `cleanup`
-                    ? `starting:cleanup`
-                    : undefined
-      if (interaction) {
-        observeAcquisitionInteraction(
-          interaction,
-          reentry === `abort-self` ? `abort-only` : `retire`,
+        const {
+          cleanupStartedDuringSyncEntry,
+          restartSucceeded,
+          returnsObsoleteCleanup,
+        } = startupRetirementModel(entry, restart)
+        if (restart && cleanupStartedDuringSyncEntry) {
+          expect(nestedRestartError).toMatchObject({
+            name: `CollectionStateError`,
+            message: expect.stringContaining(`after cleanup() completes`),
+          })
+        } else {
+          expect(nestedRestartError).toBeUndefined()
+        }
+        expect(collection.status).toBe(
+          restartSucceeded ? `ready` : `cleaned-up`,
+        )
+        expect(cleanups).toEqual(returnsObsoleteCleanup ? [0, 1] : [0])
+        expect(syncRunGeneration).toBe(
+          entry === `loading` ? (restart ? 1 : 0) : 1,
         )
-      }
 
-      expect(thrown).toBeUndefined()
-      expect(targetLoad.signal?.aborted).toBe(
-        targetWasReleased || reentry === `abort-self`,
-      )
-      expect(unloads.filter((options) => options === targetLoad)).toHaveLength(
-        Number(targetStarted && targetWasReleased),
-      )
-      expect(unloads.filter((options) => options === peerLoad)).toHaveLength(
-        Number(reentry === `release-peer`),
-      )
-      expect(errors).toEqual(
-        (outcome === `throw` || outcome === `reject`) &&
-          !targetWasReleased &&
-          reentry !== `abort-self`
-          ? [failure]
-          : [],
-      )
-      expect(statuses).toEqual(
-        reentry === `truncate` || (outcome !== `return` && !targetWasReleased)
-          ? [`loadingSubset`, `ready`]
-          : [],
-      )
-      if (reentry === `truncate`) {
-        // Every start retains logical demand, also one that throws: its
-        // first transport rejects, and the replay acquires it again.
-        expect(loads).toHaveLength(2)
-        expect(loads[1]).not.toBe(targetLoad)
-        expect(loads[1]?.where).toBe(targetWhere)
-        expect(loads[1]?.signal?.aborted).toBe(false)
+        if (restartSucceeded) {
+          subscription.requestSnapshot({
+            where: new Func(`eq`, [new PropRef([`id`]), new Value(`row`)]),
+          })
+          expect(loads).toEqual([syncRunGeneration])
+          subscription.unsubscribe()
+          expect(unloads).toEqual([syncRunGeneration])
+        } else {
+          expect(loads).toEqual([])
+          expect(unloads).toEqual([])
+        }
+      } finally {
+        removeListener()
+        subscription.unsubscribe()
+        await collection.cleanup()
       }
-
-      subscription.unsubscribe()
-      await collection.cleanup()
-    },
-  )
-
-  it.each(failureScenarios)(
-    `keeps a $outcome failure primary during $reentry error delivery`,
-    async ({ outcome, reentry }) => {
-      const targetWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`target`),
-      ])
-      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
-      const failure = new Error(`target load failed`)
-      const pending = createDeferred<void>()
-      const loads: Array<LoadSubsetOptions> = []
-      const attempts: Array<{
-        syncRunGeneration: number
-        options: LoadSubsetOptions
-        result: `peer-return` | `throw` | `pending` | `replay-return`
-      }> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const sourceCleanupSyncRuns: Array<number> = []
-      const errors: Array<unknown> = []
-      const statuses: Array<string> = []
-      const controller = new AbortController()
-      let truncateCount = 0
-      let truncate = () => {}
-      let targetLoadCount = 0
-
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `demand-failure-${outcome}-${reentry}`,
-        sync: {
-          sync: (operations) => {
-            truncate = () => {
-              truncateCount++
-              operations.begin()
-              operations.truncate()
-              operations.commit()
-            }
-            const { markReady } = operations
-            markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                if (options.where === peerWhere) {
-                  attempts.push({
-                    syncRunGeneration: 0,
-                    options,
-                    result: `peer-return`,
-                  })
-                  return true
-                }
-                targetLoadCount++
-                if (targetLoadCount > 1) {
-                  attempts.push({
-                    syncRunGeneration: 0,
-                    options,
-                    result: `replay-return`,
-                  })
-                  return true
-                }
-                if (outcome === `throw`) {
-                  attempts.push({
-                    syncRunGeneration: 0,
-                    options,
-                    result: `throw`,
-                  })
-                  throw failure
-                }
-                attempts.push({
-                  syncRunGeneration: 0,
-                  options,
-                  result: `pending`,
-                })
-                return pending.promise
-              },
-              unloadSubset: (options) => unloads.push(options),
-              cleanup: () => {
-                sourceCleanupSyncRuns.push(0)
-              },
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      subscription.on(`status:change`, ({ status }) => statuses.push(status))
-      subscription.on(`loadSubset:error`, ({ error }) => {
-        errors.push(error)
-        if (reentry === `abort-self`) {
-          controller.abort()
-        } else if (reentry === `truncate`) {
-          truncate()
-        } else if (reentry === `release-self`) {
-          subscription.releaseSnapshot(targetWhere)
-        } else if (reentry === `release-peer`) {
-          subscription.releaseSnapshot(peerWhere)
-        } else if (reentry === `unsubscribe`) {
-          subscription.unsubscribe()
-        } else if (reentry === `cleanup`) {
-          void collection.cleanup()
-        }
-      })
-
-      subscription.requestSnapshot({ where: peerWhere })
-      let thrown: unknown
-      try {
-        subscription.requestSnapshot({
-          where: targetWhere,
-          signal: controller.signal,
-        })
-      } catch (error) {
-        thrown = error
-      }
-      if (outcome === `reject`) {
-        pending.reject(failure)
-      }
-      await flushPromises()
-
-      const targetLoad = loads.find(({ where }) => where === targetWhere)!
-      const peerLoad = loads.find(({ where }) => where === peerWhere)!
-      const targetAttempts = attempts.filter(
-        ({ options }) => options.where === targetWhere,
-      )
-      const peerAttempts = attempts.filter(
-        ({ options }) => options.where === peerWhere,
-      )
-      const tearsDownTarget =
-        reentry === `release-self` || reentry === `unsubscribe`
-
-      // A synchronous throw is a rejection (maintainer decision): the start
-      // does not throw, and the failure is delivered as a rejection's is.
-      expect.soft(thrown).toBeUndefined()
-      expect.soft(errors).toEqual([failure])
-      expect.soft(subscription.lastError).toBe(failure)
-      expect.soft(targetAttempts[0]?.options).toBe(targetLoad)
-      expect.soft(targetAttempts[0]?.syncRunGeneration).toBe(0)
-      expect
-        .soft(targetAttempts[0]?.result)
-        .toBe(outcome === `throw` ? `throw` : `pending`)
-      expect.soft(controller.signal.aborted).toBe(reentry === `abort-self`)
-      expect.soft(truncateCount).toBe(Number(reentry === `truncate`))
-      expect
-        .soft(unloads.filter((options) => options === targetLoad))
-        .toHaveLength(Number(tearsDownTarget || reentry === `truncate`))
-      expect
-        .soft(unloads.filter((options) => options === peerLoad))
-        .toHaveLength(
-          Number(
-            reentry === `release-peer` ||
-              reentry === `unsubscribe` ||
-              reentry === `truncate`,
-          ),
-        )
-      expect
-        .soft(statuses)
-        .toEqual(
-          reentry === `truncate`
-            ? [`loadingSubset`, `ready`]
-            : reentry === `unsubscribe`
-              ? [`loadingSubset`]
-              : [`loadingSubset`, `ready`],
-        )
-      if (reentry === `abort-self`) {
-        expect.soft(targetLoad.signal?.aborted).toBe(true)
-        expect.soft(targetAttempts).toHaveLength(1)
-        expect.soft(peerAttempts).toHaveLength(1)
-      }
-      const replacement = targetAttempts[1]?.options
-      const peerReplacement = peerAttempts[1]?.options
-      if (reentry === `truncate`) {
-        expect.soft(targetLoad.signal?.aborted).toBe(true)
-        // Error delivery may request replay: a failed start still owns its
-        // logical demand, also one that threw.
-        expect.soft(targetAttempts).toHaveLength(2)
-        expect.soft(replacement).not.toBe(targetLoad)
-        expect.soft(replacement?.where).toBe(targetWhere)
-        expect.soft(targetAttempts[1]?.syncRunGeneration).toBe(0)
-        expect.soft(targetAttempts[1]?.result).toBe(`replay-return`)
-        expect.soft(peerLoad.signal?.aborted).toBe(true)
-        expect.soft(peerAttempts).toHaveLength(2)
-        expect.soft(peerReplacement).not.toBe(peerLoad)
-        expect.soft(peerReplacement?.where).toBe(peerWhere)
-        expect.soft(peerAttempts[1]?.syncRunGeneration).toBe(0)
-        expect.soft(peerAttempts[1]?.result).toBe(`peer-return`)
-        expect.soft(unloads).toHaveLength(2)
-      }
-      if (reentry === `cleanup`) {
-        expect.soft(collection.status).toBe(`cleaned-up`)
-        expect.soft(peerLoad.signal?.aborted).toBe(true)
-        expect.soft(targetLoad.signal?.aborted).toBe(true)
-        expect.soft(subscription.status).toBe(`ready`)
-      }
-
-      subscription.unsubscribe()
-      const replays = reentry === `truncate`
-      expect.soft(targetAttempts).toHaveLength(replays ? 2 : 1)
-      expect.soft(peerAttempts).toHaveLength(replays ? 2 : 1)
-      expect
-        .soft(unloads.filter((options) => options === targetLoad))
-        .toHaveLength(Number(reentry !== `cleanup`))
-      expect
-        .soft(unloads.filter((options) => options === peerLoad))
-        .toHaveLength(Number(reentry !== `cleanup`))
-      if (replacement) {
-        expect
-          .soft(unloads.filter((options) => options === replacement))
-          .toHaveLength(Number(replays))
-        expect.soft(replacement.signal?.aborted).toBe(true)
-      }
-      if (peerReplacement) {
-        expect
-          .soft(unloads.filter((options) => options === peerReplacement))
-          .toHaveLength(Number(replays))
-        expect.soft(peerReplacement.signal?.aborted).toBe(true)
-      }
-      const expectedUnloads = reentry === `cleanup` ? 0 : 2 * (replays ? 2 : 1)
-      expect.soft(unloads).toHaveLength(expectedUnloads)
-      expect.soft(peerLoad.signal?.aborted).toBe(true)
-      expect.soft(targetLoad.signal?.aborted).toBe(true)
-      const terminalAttempts = [...attempts]
-      const terminalUnloads = [...unloads]
-      const terminalStatuses = [...statuses]
-      await collection.cleanup()
-      expect.soft(sourceCleanupSyncRuns).toEqual([0])
-      expect.soft(collection.status).toBe(`cleaned-up`)
-      expect.soft(errors).toEqual([failure])
-      expect.soft(subscription.lastError).toBe(failure)
-      expect.soft(attempts).toEqual(terminalAttempts)
-      expect.soft(unloads).toEqual(terminalUnloads)
-      expect.soft(statuses).toEqual(terminalStatuses)
-      observedFailureDeliverySuffixes.add(`${outcome}:${reentry}`)
-    },
-  )
-
-  it.each(releaseScenarios)(
-    `retires logical ownership once for unload $outcome × $reentry`,
-    async ({ outcome, reentry }) => {
-      const targetWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`target`),
-      ])
-      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
-      const releaseFailure = new Error(`target release failed`)
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const errors: Array<unknown> = []
-      const uncaught = captureMicrotaskErrors()
-      let allowRelease = outcome === `return`
-      let runReentry = () => {}
-
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `demand-release-${outcome}-${reentry}`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: (options) => {
-                unloads.push(options)
-                if (options === loads[1]) {
-                  runReentry()
-                  if (!allowRelease) throw releaseFailure
-                }
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      subscription.requestSnapshot({ where: peerWhere })
-      subscription.requestSnapshot({ where: targetWhere })
-      const peerLoad = loads[0]!
-      const oldTargetLoad = loads[1]!
-      runReentry = () => {
-        runReentry = () => {}
-        if (reentry === `reacquire-self`) {
-          subscription.requestSnapshot({ where: targetWhere })
-        } else if (reentry === `release-peer`) {
-          subscription.releaseSnapshot(peerWhere)
-        } else if (reentry === `unsubscribe`) {
-          subscription.unsubscribe()
-        }
-      }
-
-      let thrown: unknown
-      try {
-        subscription.releaseSnapshot(targetWhere)
-      } catch (error) {
-        thrown = error
-      }
-      observeAcquisitionInteraction(`active:release`, `retire`)
-      if (reentry === `unsubscribe`) {
-        observeAcquisitionInteraction(`active:unsubscribe`, `retire`)
-      }
-
-      // The release law: the caller never sees the adapter's release error.
-      expect(thrown).toBe(undefined)
-      await Promise.resolve()
-      expect(uncaught.errors).toEqual(
-        outcome === `throw` ? [releaseFailure] : [],
-      )
-      expect(oldTargetLoad.signal?.aborted).toBe(true)
-      expect(
-        unloads.filter((options) => options === oldTargetLoad),
-      ).toHaveLength(1)
-      expect(unloads.filter((options) => options === peerLoad)).toHaveLength(
-        Number(reentry === `release-peer` || reentry === `unsubscribe`),
-      )
-      // A release error is not a load error.
-      expect(errors).toEqual([])
-      expect(subscription.lastError).toBe(undefined)
-
-      allowRelease = true
-      subscription.unsubscribe()
-      expect(
-        unloads.filter((options) => options === oldTargetLoad),
-      ).toHaveLength(1)
-      const replacement = loads[2]
-      expect(
-        replacement === undefined
-          ? []
-          : unloads.filter((options) => options === replacement),
-      ).toHaveLength(Number(reentry === `reacquire-self`))
-      expect(unloads.filter((options) => options === peerLoad)).toHaveLength(1)
-      if (outcome === `throw` && reentry === `unsubscribe`) {
-        observeAcquisitionInteraction(
-          `failed-release:unsubscribe`,
-          `no-repeat-on-unsubscribe`,
-        )
-      }
-      await collection.cleanup()
-      await Promise.resolve()
-      // Reported once: neither teardown repeats the attempted release.
-      expect(uncaught.errors).toEqual(
-        outcome === `throw` ? [releaseFailure] : [],
-      )
-      uncaught.restore()
-    },
-  )
-
-  it.each([`resolve`, `reject`] as const)(
-    `retires a pending replay on cleanup before an obsolete %s`,
-    async (outcome) => {
-      type Row = { id: string; version: number }
-      const replay = createDeferred<void>()
-      const replayFailure = new Error(`obsolete replay failed`)
-      let begin!: () => void
-      let write!: (message: { type: `insert`; value: Row }) => void
-      let commit!: () => void
-      let truncate!: () => void
-      let syncRunCount = 0
-      let loadCount = 0
-      const visible = new Map<string | number, Row>()
-      const errors: Array<unknown> = []
-      const statuses: Array<string> = []
-
-      const collection = createOnDemandCollection<Row>({
-        id: `cleanup-pending-replay-${outcome}`,
-        sync: {
-          sync: (operations) => {
-            syncRunCount++
-            begin = operations.begin
-            write = operations.write
-            commit = operations.commit
-            truncate = operations.truncate
-            if (syncRunCount > 1) {
-              begin()
-              write({ type: `insert`, value: { id: `row`, version: 3 } })
-              commit()
-            }
-            operations.markReady()
-            return {
-              loadSubset: () => {
-                loadCount++
-                begin()
-                write({
-                  type: `insert`,
-                  value: { id: `row`, version: loadCount },
-                })
-                commit()
-                return loadCount === 1 || syncRunCount > 1
-                  ? true
-                  : replay.promise
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            if (change.type === `delete`) visible.delete(change.key)
-            else {
-              visible.set(change.key, {
-                id: change.value.id,
-                version: change.value.version,
-              })
-            }
-          }
-        },
-        { includeInitialState: false },
-      )
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      subscription.on(`status:change`, ({ status }) => statuses.push(status))
-
-      subscription.requestSnapshot()
-      expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(subscription.status).toBe(`loadingSubset`)
-
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      expect(syncRunCount).toBe(2)
-      expect([...visible.values()]).toEqual([{ id: `row`, version: 3 }])
-      expect(subscription.status).toBe(`loadingSubset`)
-      await flushPromises()
-      expect(subscription.status).toBe(`ready`)
-
-      if (outcome === `resolve`) replay.resolve()
-      else replay.reject(replayFailure)
-      await flushPromises()
-
-      expect([...visible.values()]).toEqual([{ id: `row`, version: 3 }])
-      expect(errors).toEqual([])
-      expect(subscription.lastError).toBeUndefined()
-      expect(statuses.at(-1)).toBe(`ready`)
-
-      subscription.unsubscribe()
-      await collection.cleanup()
-    },
-  )
-
-  it(`reacquires surviving on-demand demand after collection restart`, async () => {
-    type Row = { id: string; version: number }
-    let begin!: () => void
-    let write!: (message: { type: `insert`; value: Row }) => void
-    let commit!: () => void
-    let nextSyncRunGeneration = 0
-    let loadCount = 0
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const visible = new Map<string | number, Row>()
-    const collection = createOnDemandCollection<Row>({
-      id: `restart-surviving-demand`,
-      sync: {
-        sync: (operations) => {
-          nextSyncRunGeneration++
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              loadCount++
-              begin()
-              write({
-                type: `insert`,
-                value: { id: `row`, version: loadCount },
-              })
-              commit()
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        for (const change of changes) {
-          if (change.type === `delete`) visible.delete(change.key)
-          else {
-            visible.set(change.key, {
-              id: change.value.id,
-              version: change.value.version,
-            })
-          }
-        }
-      },
-      { includeInitialState: false },
-    )
-    subscription.requestSnapshot()
-    expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
-
-    await collection.cleanup()
-    collection.startSyncImmediate()
-    expect(subscription.status).toBe(`loadingSubset`)
-    expect(loads).toHaveLength(1)
-    await flushPromises()
-
-    expect(nextSyncRunGeneration).toBe(2)
-    expect(loads).toHaveLength(2)
-    expect(unloads).toEqual([])
-    expect([...visible.values()]).toEqual([{ id: `row`, version: 2 }])
-    expect(subscription.status).toBe(`ready`)
-
-    subscription.unsubscribe()
-    expect(unloads).toEqual([loads[1]])
-    await collection.cleanup()
-  })
-
-  it(`reacquires demand requested while the collection is cleaned up`, async () => {
-    const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-    const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-    let nextSyncRunGeneration = 0
-    const loads: Array<{
-      syncRunGeneration: number
-      options: LoadSubsetOptions
-    }> = []
-    const unloads: Array<{
-      syncRunGeneration: number
-      options: LoadSubsetOptions
-    }> = []
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `request-while-cleaned-up`,
-      sync: {
-        sync: ({ markReady }) => {
-          const syncRunGeneration = nextSyncRunGeneration++
-          markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push({ syncRunGeneration, options })
-              return true
-            },
-            unloadSubset: (options) =>
-              unloads.push({ syncRunGeneration, options }),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot({ where: oldWhere })
-
-    await collection.cleanup()
-    subscription.requestSnapshot({ where: newWhere })
-    collection.startSyncImmediate()
-    await flushPromises()
-
-    expect(loads.map(({ syncRunGeneration }) => syncRunGeneration)).toEqual([
-      0, 1, 1,
-    ])
-    expect(loads.slice(1).map(({ options }) => options.where)).toEqual([
-      oldWhere,
-      newWhere,
-    ])
-
-    subscription.unsubscribe()
-    expect(unloads.map(({ syncRunGeneration }) => syncRunGeneration)).toEqual([
-      1, 1,
-    ])
-    expect(unloads.map(({ options }) => options.where)).toEqual([
-      oldWhere,
-      newWhere,
-    ])
-    await collection.cleanup()
-  })
-
-  it(`does not report a detached demand as physically settled`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const observed: Array<unknown> = []
-    let loads = 0
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `detached-demand-settlement`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              return true
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    await collection.cleanup()
-    subscription.requestSnapshot({
-      where,
-      onLoadSubsetResult: (result) => observed.push(result),
-    })
-
-    expect(loads).toBe(0)
-    expect(observed).toEqual([expect.any(Promise)])
-
-    collection.startSyncImmediate()
-    await flushPromises()
-    expect(loads).toBe(1)
-    expect(observed).toEqual([expect.any(Promise)])
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  acquisitionCase(
-    [`starting:request`],
-    `includes demand created by the synchronous restart status callback`,
-    async (reach) => {
-      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-      const demandForWhere = new Map<unknown, `old` | `new`>([
-        [oldWhere, `old`],
-        [newWhere, `new`],
-      ])
-      const loads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const unloads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      let nextSyncRunGeneration = -1
-      let requestOnRestart = false
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `restart-status-reentry`,
-        sync: {
-          sync: ({ markReady }) => {
-            const syncRunGeneration = ++nextSyncRunGeneration
-            markReady()
-            return {
-              loadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown restart demand`)
-                loads.push({ syncRunGeneration, demand })
-                return true
-              },
-              unloadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown restart demand`)
-                unloads.push({ syncRunGeneration, demand })
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      subscription.on(`status:change`, ({ status }) => {
-        if (!requestOnRestart || status !== `loadingSubset`) return
-        requestOnRestart = false
-        subscription.requestSnapshot({ where: newWhere })
-        reach(`starting:request`)
-      })
-      subscription.requestSnapshot({ where: oldWhere })
-
-      await collection.cleanup()
-      requestOnRestart = true
-      collection.startSyncImmediate()
-      await flushPromises()
-
-      expect(loads).toEqual([
-        { syncRunGeneration: 0, demand: `old` },
-        { syncRunGeneration: 1, demand: `old` },
-        { syncRunGeneration: 1, demand: `new` },
-      ])
-      expect(subscription.status).toBe(`ready`)
-
-      subscription.unsubscribe()
-      expect(unloads).toEqual([
-        { syncRunGeneration: 1, demand: `old` },
-        { syncRunGeneration: 1, demand: `new` },
-      ])
-      await collection.cleanup()
-    },
-  )
-
-  acquisitionCase(
-    [`starting:markReady`],
-    `does not settle demand reentered before the restart loader is installed`,
-    async (reach) => {
-      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-      const demandForWhere = new Map<unknown, `old` | `new`>([
-        [oldWhere, `old`],
-        [newWhere, `new`],
-      ])
-      const loads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const unloads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const observed: Array<unknown> = []
-      let nextSyncRunGeneration = -1
-      let requestOnReady = false
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `restart-ready-reentry`,
-        sync: {
-          sync: ({ markReady }) => {
-            const syncRunGeneration = ++nextSyncRunGeneration
-            markReady()
-            return {
-              loadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown ready demand`)
-                loads.push({ syncRunGeneration, demand })
-                return true
-              },
-              unloadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown ready unload`)
-                unloads.push({ syncRunGeneration, demand })
-              },
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      const removeReadyListener = collection.on(`status:ready`, () => {
-        if (!requestOnReady) return
-        requestOnReady = false
-        subscription.requestSnapshot({
-          where: newWhere,
-          onLoadSubsetResult: (result) => observed.push(result),
-        })
-        reach(`starting:markReady`)
-      })
-      subscription.requestSnapshot({ where: oldWhere })
-
-      await collection.cleanup()
-      requestOnReady = true
-      collection.startSyncImmediate()
-      await flushPromises()
-
-      expect(loads).toEqual([
-        { syncRunGeneration: 0, demand: `old` },
-        { syncRunGeneration: 1, demand: `old` },
-        { syncRunGeneration: 1, demand: `new` },
-      ])
-      expect(observed).toEqual([expect.any(Promise)])
-      expect(subscription.status).toBe(`ready`)
-
-      removeReadyListener()
-      subscription.unsubscribe()
-      expect(unloads).toEqual([
-        { syncRunGeneration: 1, demand: `old` },
-        { syncRunGeneration: 1, demand: `new` },
-      ])
-      await collection.cleanup()
-    },
-  )
-
-  acquisitionCase(
-    [`unavailable:request`],
-    `does not settle demand reentered before a failed restart installs a loader`,
-    async (reach) => {
-      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-      const syncFailure = new Error(`replacement sync failed`)
-      const demandForWhere = new Map<unknown, `old` | `new`>([
-        [oldWhere, `old`],
-        [newWhere, `new`],
-      ])
-      const loads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const unloads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const observed: Array<unknown> = []
-      let nextSyncRunGeneration = -1
-      let requestOnError = false
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `restart-error-reentry`,
-        sync: {
-          sync: ({ markReady }) => {
-            const syncRunGeneration = ++nextSyncRunGeneration
-            if (syncRunGeneration === 1) throw syncFailure
-            markReady()
-            return {
-              loadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown error demand`)
-                loads.push({ syncRunGeneration, demand })
-                return true
-              },
-              unloadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown error unload`)
-                unloads.push({ syncRunGeneration, demand })
-              },
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      const removeErrorListener = collection.on(`status:crashed`, () => {
-        if (!requestOnError) return
-        requestOnError = false
-        subscription.requestSnapshot({
-          where: newWhere,
-          onLoadSubsetResult: (result) => observed.push(result),
-        })
-        reach(`unavailable:request`)
-      })
-      subscription.requestSnapshot({ where: oldWhere })
-
-      await collection.cleanup()
-      requestOnError = true
-      expect(() => collection.startSyncImmediate()).toThrow(syncFailure)
-      expect(observed).toEqual([expect.any(Promise)])
-      expect(collection.status).toBe(`crashed`)
-      expect(loads).toEqual([{ syncRunGeneration: 0, demand: `old` }])
-
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await flushPromises()
-      expect(loads).toEqual([
-        { syncRunGeneration: 0, demand: `old` },
-        { syncRunGeneration: 2, demand: `old` },
-        { syncRunGeneration: 2, demand: `new` },
-      ])
-      expect(subscription.status).toBe(`ready`)
-
-      removeErrorListener()
-      subscription.unsubscribe()
-      expect(unloads).toEqual([
-        { syncRunGeneration: 2, demand: `old` },
-        { syncRunGeneration: 2, demand: `new` },
-      ])
-      await collection.cleanup()
-    },
-  )
-
-  acquisitionCase(
-    [`retiring:request`],
-    `does not acquire through a retiring adapter cleanup callback`,
-    async (reach) => {
-      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-      const demandForWhere = new Map<unknown, `old` | `new`>([
-        [oldWhere, `old`],
-        [newWhere, `new`],
-      ])
-      const loads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const unloads: Array<{
-        syncRunGeneration: number
-        demand: `old` | `new`
-      }> = []
-      const observed: Array<unknown> = []
-      let nextSyncRunGeneration = -1
-      let requestDuringCleanup = false
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `adapter-cleanup-reentry`,
-        sync: {
-          sync: ({ markReady }) => {
-            const syncRunGeneration = ++nextSyncRunGeneration
-            markReady()
-            return {
-              loadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown cleanup demand`)
-                loads.push({ syncRunGeneration, demand })
-                return true
-              },
-              unloadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown cleanup unload`)
-                unloads.push({ syncRunGeneration, demand })
-              },
-              cleanup: () => {
-                if (!requestDuringCleanup) return
-                requestDuringCleanup = false
-                subscription.requestSnapshot({
-                  where: newWhere,
-                  onLoadSubsetResult: (result) => observed.push(result),
-                })
-                reach(`retiring:request`)
-                observeSyncRunBoundary(`cleanup-callback-reentry`)
-              },
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      subscription.requestSnapshot({ where: oldWhere })
-
-      requestDuringCleanup = true
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await flushPromises()
-
-      expect(loads).toEqual([
-        { syncRunGeneration: 0, demand: `old` },
-        { syncRunGeneration: 1, demand: `old` },
-        { syncRunGeneration: 1, demand: `new` },
-      ])
-      expect(observed).toEqual([expect.any(Promise)])
-
-      subscription.unsubscribe()
-      expect(unloads).toEqual([
-        { syncRunGeneration: 1, demand: `old` },
-        { syncRunGeneration: 1, demand: `new` },
-      ])
-      await collection.cleanup()
-    },
-  )
-
-  acquisitionCase(
-    [`eager:request`],
-    `does not release a physical subset acquisition in eager mode`,
-    async (reach) => {
-      let loads = 0
-      let unloads = 0
-      const collection = createCollection<{ id: string }>({
-        id: `eager-subset-ownership`,
-        getKey: ({ id }) => id,
-        syncMode: `eager`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                return true
-              },
-              unloadSubset: () => {
-                unloads++
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-
-      subscription.requestSnapshot()
-      reach(`eager:request`)
-      subscription.unsubscribe()
-      observeAcquisitionInteraction(`none:unsubscribe`, `no-acquisition`)
-
-      expect(loads).toBe(0)
-      expect(unloads).toBe(0)
-      await collection.cleanup()
-    },
-  )
-
-  it(`directly releases eager demand without a physical acquisition`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    let loads = 0
-    let unloads = 0
-    const collection = createCollection<{ id: string }>({
-      id: `eager-direct-release`,
-      getKey: ({ id }) => id,
-      syncMode: `eager`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              return true
-            },
-            unloadSubset: () => {
-              unloads++
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    subscription.requestSnapshot({ where })
-    subscription.releaseSnapshot(where)
-    observeAcquisitionInteraction(`none:release`, `no-acquisition`)
-
-    expect(loads).toBe(0)
-    expect(unloads).toBe(0)
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it(`truncates eager demand without creating or releasing a physical acquisition`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createCollection<{ id: string }>({
-      id: `eager-truncate-without-acquisition`,
-      getKey: ({ id }) => id,
-      syncMode: `eager`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot({ where })
-
-    begin()
-    truncate()
-    commit()
-    await flushPromises()
-    observeAcquisitionInteraction(`none:truncate`, `no-acquisition`)
-
-    expect.soft(loads).toEqual([])
-    expect.soft(unloads).toEqual([])
-
-    subscription.unsubscribe()
-    expect(unloads).toEqual([])
-    await collection.cleanup()
-  })
-
-  acquisitionCase(
-    [`on-demand:request`],
-    `does not release a subset request aborted before adapter acquisition`,
-    async (reach) => {
-      const controller = new AbortController()
-      controller.abort()
-      let loads = 0
-      let unloads = 0
-      const errors: Array<unknown> = []
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `pre-aborted-subset-ownership`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                return true
-              },
-              unloadSubset: () => {
-                unloads++
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-
-      subscription.requestSnapshot({ signal: controller.signal })
-      await flushPromises()
-      reach(`on-demand:request`)
-      subscription.unsubscribe()
-      observeAcquisitionInteraction(`none:unsubscribe`, `no-acquisition`)
-
-      expect(loads).toBe(0)
-      expect(unloads).toBe(0)
-      expect(errors).toEqual([])
-      await collection.cleanup()
-    },
-  )
-
-  it(`directly releases pre-aborted demand without a physical acquisition`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const controller = new AbortController()
-    controller.abort()
-    let loads = 0
-    let unloads = 0
-    const errors: Array<unknown> = []
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `pre-aborted-direct-release`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              return true
-            },
-            unloadSubset: () => {
-              unloads++
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-
-    subscription.requestSnapshot({
-      where,
-      signal: controller.signal,
-    })
-    await flushPromises()
-    subscription.releaseSnapshot(where)
-    observeAcquisitionInteraction(`none:release`, `no-acquisition`)
-
-    expect(loads).toBe(0)
-    expect(unloads).toBe(0)
-    expect(errors).toEqual([])
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it.each([false, true])(
-    `ignores a pre-aborted snapshot without changing an existing demand: %s`,
-    async (existingDemand) => {
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      let publications = 0
-      let results = 0
-      const collection = createOnDemandCollection<{ id: string }>({
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            begin()
-            write({ type: `insert`, value: { id: `row` } })
-            commit()
-            markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: (options) => unloads.push(options),
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => publications++, {
-        includeInitialState: false,
-      })
-      try {
-        if (existingDemand) subscription.requestSnapshot({ where })
-        const previousPublications = publications
-        const previousLoads = [...loads]
-        const controller = new AbortController()
-        controller.abort()
-
-        expect(
-          subscription.requestSnapshot({
-            where,
-            signal: controller.signal,
-            onLoadSubsetResult: () => results++,
-          }),
-        ).toBe(false)
-        await flushPromises()
-        expect(publications).toBe(previousPublications)
-        expect(results).toBe(0)
-        expect(loads).toEqual(previousLoads)
-        expect(unloads).toEqual([])
-        if (existingDemand) expect(loads[0]!.signal?.aborted).toBe(false)
-
-        subscription.releaseSnapshot(where)
-        expect(unloads).toEqual(previousLoads)
-        subscription.unsubscribe()
-        expect(unloads).toEqual(previousLoads)
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`aborts detached demand without creating a physical acquisition`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const controller = new AbortController()
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `detached-abort-without-acquisition`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    await collection.cleanup()
-    subscription.requestSnapshot({ where, signal: controller.signal })
-    controller.abort()
-    await flushPromises()
-    observeAcquisitionInteraction(`none:abort`, `no-acquisition`)
-
-    expect(loads).toEqual([])
-    expect(unloads).toEqual([])
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it(`keeps an aborted active acquisition until its owner retires`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const controller = new AbortController()
-    const pending = createDeferred<void>()
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `active-abort-before-release`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return pending.promise
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    subscription.requestSnapshot({ where, signal: controller.signal })
-    const acquisition = loads[0]!
-    controller.abort()
-    await flushPromises()
-    observeAcquisitionInteraction(`active:abort`, `abort-only`)
-
-    expect(loads).toEqual([acquisition])
-    expect(acquisition.signal?.aborted).toBe(true)
-    expect(unloads).toEqual([])
-
-    pending.resolve()
-    await flushPromises()
-    subscription.unsubscribe()
-    expect(unloads).toEqual([acquisition])
-    await collection.cleanup()
-  })
-
-  acquisitionCase(
-    [`on-demand:request`, `on-demand:markReady`],
-    `acquires before and after ready once the on-demand loader is installed`,
-    async (reach) => {
-      const beforeReady = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`before`),
-      ])
-      const afterReady = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`after`),
-      ])
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      let markReady!: () => void
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `installed-loader-before-ready`,
-        startSync: false,
-        sync: {
-          sync: (operations) => {
-            markReady = operations.markReady
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: (options) => unloads.push(options),
-            }
-          },
-        },
-      })
-      collection.startSyncImmediate()
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      const removeReadyListener = collection.on(`status:ready`, () => {
-        subscription.requestSnapshot({ where: afterReady })
-        reach(`on-demand:markReady`)
-      })
-
-      subscription.requestSnapshot({ where: beforeReady })
-      reach(`on-demand:request`)
-      expect(collection.status).toBe(`loading`)
-      expect(loads.map(({ where }) => where)).toEqual([beforeReady])
-
-      markReady()
-      await flushPromises()
-      expect(loads.map(({ where }) => where)).toEqual([beforeReady, afterReady])
-
-      removeReadyListener()
-      subscription.unsubscribe()
-      expect(unloads).toEqual(loads)
-      await collection.cleanup()
-    },
-  )
-
-  // Demand created while acquisition is deferred stays logical until an
-  // explicit resumption. That resumption also releases any render start gate;
-  // retirement before it returns no acquisition lease. The phase named
-  // `deferred` here is deferred acquisition, not an already resumed owner
-  // whose provider work is still blocked by an unrelated render.
-  acquisitionCase(
-    [`deferred:request`, `deferred:resume`],
-    `owns deferred-start acquisition only when it reaches the adapter`,
-    async (reach) => {
-      for (const action of [`resume`, `release-before-resume`] as const) {
-        const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-        const loads: Array<LoadSubsetOptions> = []
-        const unloads: Array<LoadSubsetOptions> = []
-        const collection = createOnDemandCollection<{ id: string }>({
-          id: `deferred-start-${action}`,
-          startSync: false,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-              return {
-                loadSubset: (options) => {
-                  loads.push(options)
-                  return true
-                },
-                unloadSubset: (options) => unloads.push(options),
-              }
-            },
-          },
-        })
-        expect(collection._deferSyncStart()).toBe(true)
-        const subscription = collection.subscribeChanges(() => {}, {
-          includeInitialState: false,
-          deferAcquisition: true,
-        })
-        subscription.requestSnapshot({ where })
-        reach(`deferred:request`)
-        expect(loads).toEqual([])
-
-        if (action === `release-before-resume`) {
-          subscription.releaseSnapshot(where)
-        }
-        subscription.resumeDeferredAcquisition()
-        await flushPromises()
-        if (action === `resume`) reach(`deferred:resume`)
-
-        expect(loads).toHaveLength(action === `resume` ? 1 : 0)
-        subscription.unsubscribe()
-        expect(unloads).toHaveLength(action === `resume` ? 1 : 0)
-        if (action === `resume`) expect(unloads).toEqual(loads)
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it.each([`cleanup`, `release`, `unsubscribe`, `resume`] as const)(
-    `settles queued demand according to whether it starts: %s`,
-    async (action) => {
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-      const observed: Array<true | Promise<void>> = []
-      let loads = 0
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `deferred-start-cleanup-before-resume`,
-        startSync: false,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                return true
-              },
-            }
-          },
-        },
-      })
-      expect(collection._deferSyncStart()).toBe(true)
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-        deferAcquisition: true,
-      })
-      subscription.requestSnapshot({
-        where,
-        onLoadSubsetResult: (result) => observed.push(result),
-      })
-
-      if (action === `cleanup`) await collection.cleanup()
-      else if (action === `release`) subscription.releaseSnapshot(where)
-      else if (action === `unsubscribe`) subscription.unsubscribe()
-      else subscription.resumeDeferredAcquisition()
-      await flushPromises()
-      if (action === `cleanup`) {
-        observeAcquisitionInteraction(`none:cleanup`, `no-acquisition`)
-      }
-
-      expect(loads).toBe(action === `resume` ? 1 : 0)
-      expect(observed).toHaveLength(1)
-      const deferredResult = observed[0]
-      expect(deferredResult).toBeInstanceOf(Promise)
-      if (!(deferredResult instanceof Promise)) {
-        throw new Error(`deferred acquisition did not return a promise`)
-      }
-      if (action === `resume`)
-        await expect(deferredResult).resolves.toBeUndefined()
-      else
-        await expect(deferredResult).rejects.toMatchObject({
-          name: `AbortError`,
-        })
-
-      subscription.unsubscribe()
-      await collection.cleanup()
-    },
-  )
-
-  acquisitionCase(
-    [`starting:syncReturn`],
-    `does not settle ready-callback demand when on-demand sync returns no loader`,
-    async (reach) => {
-      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-      const loads: Array<LoadSubsetOptions> = []
-      const observed: Array<unknown> = []
-      type ResultOutcome =
-        | { status: `pending` }
-        | { status: `fulfilled`; value: unknown }
-        | { status: `rejected`; error: unknown }
-      const outcomes: Array<{ outcome: ResultOutcome }> = []
-      let nextSyncRunGeneration = 0
-      let requestOnReady = false
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `ready-before-invalid-on-demand-return`,
-        sync: {
-          sync: ({ markReady }) => {
-            const syncRunGeneration = nextSyncRunGeneration++
-            markReady()
-            if (syncRunGeneration === 1) return
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      const removeReadyListener = collection.on(`status:ready`, () => {
-        if (!requestOnReady) return
-        requestOnReady = false
-        subscription.requestSnapshot({
-          where: newWhere,
-          onLoadSubsetResult: (result) => {
-            observed.push(result)
-            const entry: { outcome: ResultOutcome } = {
-              outcome: { status: `pending` },
-            }
-            outcomes.push(entry)
-            if (result instanceof Promise) {
-              void result.then(
-                (value) => {
-                  entry.outcome = { status: `fulfilled`, value }
-                },
-                (error: unknown) => {
-                  entry.outcome = { status: `rejected`, error }
-                },
-              )
-            } else {
-              entry.outcome = { status: `fulfilled`, value: result }
-            }
-          },
-        })
-      })
-      let failed = false
-      let primaryError: unknown
-      try {
-        subscription.requestSnapshot({ where: oldWhere })
-
-        await collection.cleanup()
-        requestOnReady = true
-        expect(() => collection.startSyncImmediate()).toThrow(
-          /did not return a loadSubset handler/,
-        )
-        reach(`starting:syncReturn`)
-
-        expect(observed).toEqual([expect.any(Promise)])
-        expect(collection.status).toBe(`crashed`)
-        expect(loads.map(({ where }) => where)).toEqual([oldWhere])
-        await flushPromises()
-        expect(outcomes).toHaveLength(1)
-        const beforeUnsubscribe = outcomes[0]!.outcome
-        expect(beforeUnsubscribe.status).not.toBe(`fulfilled`)
-        expect(loads.map(({ where }) => where)).toEqual([oldWhere])
-
-        removeReadyListener()
-        subscription.unsubscribe()
-        await flushPromises()
-        const afterUnsubscribe = outcomes[0]!.outcome
-        if (beforeUnsubscribe.status === `pending`) {
-          expect(afterUnsubscribe.status).toBe(`rejected`)
-          if (afterUnsubscribe.status !== `rejected`) {
-            throw new Error(`Unsubscribed startup waiter did not reject`)
-          }
-          expect(afterUnsubscribe.error).toMatchObject({ name: `AbortError` })
-        } else {
-          // Invalid startup may already have rejected. Do not impose an
-          // earlier rejection time or replace its observed error identity.
-          expect(afterUnsubscribe).toBe(beforeUnsubscribe)
-        }
-        expect(observed).toHaveLength(1)
-        expect(outcomes).toHaveLength(1)
-        expect(collection.subscriberCount).toBe(0)
-        expect(loads.map(({ where }) => where)).toEqual([oldWhere])
-      } catch (error) {
-        failed = true
-        primaryError = error
-      }
-      const cleanupErrors: Array<unknown> = []
-      for (const cleanup of [
-        removeReadyListener,
-        () => subscription.unsubscribe(),
-        () => collection.cleanup(),
-      ]) {
-        try {
-          await cleanup()
-        } catch (error) {
-          cleanupErrors.push(error)
-        }
-      }
-      if (cleanupErrors.length) {
-        if (failed) {
-          throw new AggregateError(
-            [primaryError, ...cleanupErrors],
-            `No-loader observation and cleanup failed`,
-            { cause: primaryError },
-          )
-        }
-        if (cleanupErrors.length === 1) throw cleanupErrors[0]
-        throw new AggregateError(cleanupErrors, `No-loader cleanup failed`)
-      }
-      if (failed) throw primaryError
-    },
-  )
-
-  it(`retires resources returned after ready-callback cleanup invalidates sync`, async () => {
-    const cleanupSyncRuns: Array<number> = []
-    let nextSyncRunGeneration = 0
-    let cleanOnReady = false
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `obsolete-sync-return`,
-      sync: {
-        sync: ({ markReady }) => {
-          const syncRunGeneration = nextSyncRunGeneration++
-          markReady()
-          return {
-            loadSubset: () => true,
-            unloadSubset: () => {},
-            cleanup: () => {
-              cleanupSyncRuns.push(syncRunGeneration)
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    const removeReadyListener = collection.on(`status:ready`, () => {
-      if (!cleanOnReady) return
-      cleanOnReady = false
-      void collection.cleanup()
-    })
-
-    await collection.cleanup()
-    cleanOnReady = true
-    collection.startSyncImmediate()
-    observeSyncRunBoundary(`obsolete-resource-return`)
-
-    expect(collection.status).toBe(`cleaned-up`)
-    expect(cleanupSyncRuns).toEqual([0, 1])
-
-    removeReadyListener()
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it.each(
-    ([false, true] as const).flatMap((restart) =>
-      (
-        [`loading`, `ready`, `adapter-throw`, `ready-effect-throw`] as const
-      ).map((entry) => ({ restart, entry })),
-    ),
-  )(
-    `retires startup at $entry with nested restart=$restart`,
-    async ({ entry, restart }) => {
-      const failure = new Error(`obsolete startup failed`)
-      const cleanups: Array<number> = []
-      const loads: Array<number> = []
-      const unloads: Array<number> = []
-      let syncRunGeneration = -1
-      let retire = false
-      let nestedRestartError: unknown
-      const collection = createOnDemandCollection<{ id: string }>({
-        sync: {
-          sync: ({ markReady }) => {
-            const ownSyncRunGeneration = ++syncRunGeneration
-            markReady()
-            if (ownSyncRunGeneration === 1 && entry === `adapter-throw`) {
-              throw failure
-            }
-            return {
-              loadSubset: () => {
-                loads.push(ownSyncRunGeneration)
-                return true
-              },
-              unloadSubset: () => unloads.push(ownSyncRunGeneration),
-              cleanup: () => {
-                cleanups.push(ownSyncRunGeneration)
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      let removeListener = () => {}
-      try {
-        await collection.cleanup()
-        const retireSyncRun = () => {
-          if (!retire) return
-          retire = false
-          void collection.cleanup()
-          if (restart) {
-            try {
-              collection.startSyncImmediate()
-            } catch (error) {
-              nestedRestartError = error
-            }
-          }
-          if (entry === `ready-effect-throw`) throw failure
-        }
-        removeListener =
-          entry === `ready-effect-throw`
-            ? collection.onFirstReady(retireSyncRun)
-            : collection.on(
-                entry === `loading` ? `status:loading` : `status:ready`,
-                retireSyncRun,
-              )
-        retire = true
-        if (entry === `adapter-throw` || entry === `ready-effect-throw`) {
-          expect(() => collection.startSyncImmediate()).toThrow(failure)
-        } else {
-          collection.startSyncImmediate()
-        }
-        await flushPromises()
-
-        const cleanupStartedDuringSyncEntry = entry !== `loading`
-        const restartSucceeded = restart && !cleanupStartedDuringSyncEntry
-        if (restart && cleanupStartedDuringSyncEntry) {
-          expect(nestedRestartError).toMatchObject({
-            name: `CollectionStateError`,
-            message: expect.stringContaining(`after cleanup() completes`),
-          })
-        } else {
-          expect(nestedRestartError).toBeUndefined()
-        }
-        expect(collection.status).toBe(
-          restartSucceeded ? `ready` : `cleaned-up`,
-        )
-        const returnsObsoleteCleanup =
-          entry === `ready` || entry === `ready-effect-throw`
-        expect(cleanups).toEqual(returnsObsoleteCleanup ? [0, 1] : [0])
-        expect(syncRunGeneration).toBe(
-          entry === `loading` ? (restart ? 1 : 0) : 1,
-        )
-
-        if (restartSucceeded) {
-          subscription.requestSnapshot({
-            where: new Func(`eq`, [new PropRef([`id`]), new Value(`row`)]),
-          })
-          expect(loads).toEqual([syncRunGeneration])
-          subscription.unsubscribe()
-          expect(unloads).toEqual([syncRunGeneration])
-        } else {
-          expect(loads).toEqual([])
-          expect(unloads).toEqual([])
-        }
-      } finally {
-        removeListener()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  acquisitionCase(
-    [`starting:fail`],
-    `keeps demand requested during initial error unacquired until a restart`,
-    async (reach) => {
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-      const loads: Array<LoadSubsetOptions> = []
-      const observed: Array<unknown> = []
-      let syncRunCount = 0
-      let recover!: () => void
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `sync-entry-error-ready-recovery`,
-        startSync: false,
-        sync: {
-          sync: ({ fail, markReady }) => {
-            if (syncRunCount++ !== 1) {
-              markReady()
-              return {
-                loadSubset: (options) => {
-                  loads.push(options)
-                  return true
-                },
-                unloadSubset: () => {},
-              }
-            }
-            recover = markReady
-            fail(new Error(`initial sync failed`))
-            reach(`starting:fail`)
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      await collection.cleanup()
-      const removeErrorListener = collection.on(`status:error`, () => {
-        subscription.requestSnapshot({
-          where,
-          onLoadSubsetResult: (result) => observed.push(result),
-        })
-      })
-
-      collection.startSyncImmediate()
-      await flushPromises()
-      expect.soft(collection.status).toBe(`error`)
-      expect.soft(loads).toEqual([])
-      expect.soft(observed).toEqual([expect.any(Promise)])
-
-      // The initial error is final for this attempt: its markReady() does
-      // nothing (maintainer decision).
-      expect(() => recover()).not.toThrow()
-      await flushPromises()
-      expect(collection.status).toBe(`error`)
-      expect(loads).toEqual([])
-
-      // A restart begins a new attempt, which acquires the surviving demand.
-      removeErrorListener()
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await flushPromises()
-      expect(collection.status).toBe(`ready`)
-      expect(loads.map(({ where: loadedWhere }) => loadedWhere)).toEqual([
-        where,
-      ])
-
-      subscription.unsubscribe()
-      await collection.cleanup()
     },
   )
 
@@ -3220,10 +1122,7 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
             expect.objectContaining({ name: `AbortError` }),
           ])
           expect(unloads).toEqual(
-            phase === `during` &&
-              (outcome === `release` || outcome === `unsubscribe`)
-              ? loads
-              : [],
+            expectedUnloadsAfterUnavailableWait(phase, outcome, loads),
           )
           if (phase === `before` && outcome !== `cleanup`) {
             recover()
@@ -3235,7 +1134,7 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
             collection.startSyncImmediate()
             operations.markReady()
             await flushPromises()
-            expect(loads).toHaveLength(phase === `before` ? 1 : 2)
+            expect(loads).toHaveLength(expectedLoadsAfterCleanupEndsWait(phase))
           }
           // Non-cooperative late settlement cannot rewrite the observed outcome.
           transport.resolve()
@@ -3253,155 +1152,6 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
     },
   )
 
-  it(`keeps an installed loader unavailable after its initial error`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const loads: Array<LoadSubsetOptions> = []
-    let fail!: (error: unknown) => void
-    let markReady!: () => void
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `installed-loader-error-ready-recovery`,
-      startSync: false,
-      sync: {
-        sync: (operations) => {
-          fail = operations.fail
-          markReady = operations.markReady
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    collection.startSyncImmediate()
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    fail(new Error(`initial sync failed`))
-    // The initial error is final for this attempt: its markReady() does
-    // nothing (maintainer decision).
-    expect(() => markReady()).not.toThrow()
-    subscription.requestSnapshot({ where })
-    await flushPromises()
-
-    expect(collection.status).toBe(`error`)
-    expect(loads).toEqual([])
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it(`releases unavailable demand without creating a physical acquisition`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    let fail!: (error: unknown) => void
-    let markReady!: () => void
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `release-unavailable-demand`,
-      startSync: false,
-      sync: {
-        sync: (operations) => {
-          fail = operations.fail
-          markReady = operations.markReady
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    collection.startSyncImmediate()
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    fail(new Error(`initial sync failed`))
-    subscription.requestSnapshot({ where })
-    subscription.releaseSnapshot(where)
-    // A restart is the only recovery; the released demand stays released.
-    await collection.cleanup()
-    collection.startSyncImmediate()
-    markReady()
-    await flushPromises()
-
-    expect(loads).toHaveLength(0)
-    expect(unloads).toHaveLength(0)
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  acquisitionCase(
-    [`on-demand:fail`],
-    `keeps demand from an installed loader's initial error unacquired until a restart`,
-    async (reach) => {
-      const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
-      const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
-      const loads: Array<LoadSubsetOptions> = []
-      let fail!: (error: unknown) => void
-      let markReady!: () => void
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `installed-loader-initial-error`,
-        startSync: false,
-        sync: {
-          sync: (operations) => {
-            fail = operations.fail
-            markReady = operations.markReady
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      collection.startSyncImmediate()
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      subscription.requestSnapshot({ where: oldWhere })
-      const removeErrorListener = collection.on(`status:error`, () => {
-        subscription.requestSnapshot({ where: newWhere })
-        reach(`on-demand:fail`)
-      })
-
-      fail(new Error(`initial sync failed`))
-
-      await flushPromises()
-      expect.soft(collection.status).toBe(`error`)
-      expect.soft(loads.map(({ where }) => where)).toEqual([oldWhere])
-
-      expect(() => markReady()).not.toThrow()
-      expect(collection.status).toBe(`error`)
-
-      // A restart begins a new attempt, which acquires the surviving demand.
-      removeErrorListener()
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      markReady()
-      await flushPromises()
-      // The first attempt acquired `old` before its error. The new attempt
-      // acquires both surviving demands; `new` was never acquired before.
-      expect(loads.map(({ where }) => where)).toEqual([
-        oldWhere,
-        oldWhere,
-        newWhere,
-      ])
-
-      subscription.unsubscribe()
-      await collection.cleanup()
-    },
-  )
-
   it.each(
     ([`loading`, `ready`] as const).flatMap((phase) =>
       ([`cleanup`, `release`, `unsubscribe`] as const).map((action) => ({
@@ -3418,351 +1168,56 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
       let cancelOnEntry = false
       const observed: Array<true | Promise<void>> = []
       const collection = createOnDemandCollection<{ id: string }>({
-        id: `deferred-resume-cleanup`,
-        startSync: false,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: (options) => unloads.push(options),
-            }
-          },
-        },
-      })
-      expect(collection._deferSyncStart()).toBe(true)
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-        deferAcquisition: true,
-      })
-      const removeReadyListener = collection.on(`status:${phase}`, () => {
-        if (!cancelOnEntry) return
-        cancelOnEntry = false
-        if (action === `cleanup`) void collection.cleanup()
-        else if (action === `release`) subscription.releaseSnapshot(where)
-        else subscription.unsubscribe()
-      })
-      subscription.requestSnapshot({
-        where,
-        onLoadSubsetResult: (result) => observed.push(result),
-      })
-
-      try {
-        cancelOnEntry = true
-        subscription.resumeDeferredAcquisition()
-        await flushPromises()
-
-        expect(collection.status).toBe(
-          action === `cleanup` ? `cleaned-up` : `ready`,
-        )
-        expect(loads).toHaveLength(0)
-        expect(unloads).toHaveLength(0)
-        expect(observed).toHaveLength(1)
-        await expect(observed[0]).rejects.toMatchObject({ name: `AbortError` })
-      } finally {
-        removeReadyListener()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // The grammar's independent judgment treats cleanup as retiring this start,
-  // not permission to retry it. This driver crosses no render gate, a held
-  // gate with no request, and a held requested start with both source modes.
-  // It records the complete public status trace at subscribeChanges return
-  // and cleanup settlement. A later ordinary reader is fresh restart demand.
-  it.each(
-    subscriberStartCleanupHistories.flatMap((history) =>
-      ([`none`, `unrequested`, `requested`] as const).flatMap((gate) =>
-        ([`eager`, `on-demand`] as const).map((syncMode) => ({
-          ...history,
-          gate,
-          syncMode,
-        })),
-      ),
-    ),
-  )(
-    `ordinary admission preserves $cleanupAt cleanup (pending=$cleanupPending, $gate start, $syncMode)`,
-    async (history) => {
-      const expected = modelSubscriberStartCleanup(history)
-      const pendingCleanup = createDeferred<void>()
-      let starts = 0
-      let cleanups = 0
-      let cleanupRequested = false
-      let cleanup: Promise<void> | undefined
-      const statuses: Array<string> = []
-      const collection = createCollection({
-        id: `ordinary-admission-cleanup`,
-        startSync: false,
-        syncMode: history.syncMode,
-        getKey: (row: { id: string }) => row.id,
-        sync: {
-          sync: ({ markReady }) => {
-            starts++
-            markReady()
-            return {
-              loadSubset: () => true,
-              cleanup: () => {
-                cleanups++
-                return history.cleanupPending
-                  ? pendingCleanup.promise
-                  : undefined
-              },
-            }
-          },
-        },
-      })
-      if (history.gate !== `none`) {
-        expect(collection._deferSyncStart()).toBe(true)
-        if (history.gate === `requested`) collection.startSyncImmediate()
-      }
-      const removeStatusListener = collection.on(
-        `status:change`,
-        ({ status }) => {
-          statuses.push(status)
-          if (!cleanupRequested && status === history.cleanupAt) {
-            cleanupRequested = true
-            cleanup = collection.cleanup()
-          }
-        },
-      )
-      let subscription:
-        ReturnType<typeof collection.subscribeChanges> | undefined
-      let peer: ReturnType<typeof collection.subscribeChanges> | undefined
-      try {
-        subscription = collection.subscribeChanges(() => {}, {
-          includeInitialState: false,
-        })
-        expect(starts, `adapter entries at admission return`).toBe(
-          expected.starts,
-        )
-        expect(cleanups).toBe(expected.cleanups)
-        expect(collection.status).toBe(expected.statusOnReturn)
-        expect(statuses).toEqual(expected.statusesOnReturn)
-
-        pendingCleanup.resolve()
-        await cleanup
-        expect(starts, `cleanup settlement must not restart`).toBe(
-          expected.starts,
-        )
-        expect(collection.status).toBe(expected.statusAfterCleanup)
-        expect(statuses).toEqual(expected.statusesAfterCleanup)
-
-        removeStatusListener()
-        peer = collection.subscribeChanges(() => {}, {
-          includeInitialState: false,
-        })
-        expect(starts, `later demand may restart a retired run`).toBe(
-          expected.starts + (history.cleanupAt === `none` ? 0 : 1),
-        )
-        expect(collection.status).toBe(`ready`)
-      } finally {
-        removeStatusListener()
-        pendingCleanup.resolve()
-        await cleanup
-        peer?.unsubscribe()
-        subscription?.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // The callback can release this owner before resumption commits, or from
-  // its acquiring notification. Both cuts must leave balanced public counts
-  // and no later acquisition. The no-retirement neighbor must acquire normally.
-  it.each(
-    subscriberResumeRetirementHistories.flatMap((history) =>
-      ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
-        [false, true].map((renderGate) => ({
-          ...history,
-          syncMode,
-          renderGate,
-        })),
-      ),
-    ),
-  )(
-    `balances resume at $retireAt (cleanup=$cleanup, $syncMode, gate=$renderGate)`,
-    async (history) => {
-      const expected = modelSubscriberResumeRetirement(history)
-      let starts = 0
-      let loads = 0
-      const counts: Array<number> = []
-      const collection = createCollection<{ id: string }>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        syncMode: history.syncMode,
+        id: `deferred-resume-cleanup`,
+        startSync: false,
         sync: {
           sync: ({ markReady }) => {
-            starts++
             markReady()
             return {
-              loadSubset: () => {
-                loads++
+              loadSubset: (options) => {
+                loads.push(options)
                 return true
               },
+              unloadSubset: (options) => unloads.push(options),
             }
           },
         },
       })
-      if (history.renderGate) collection._deferSyncStart()
+      expect(collection._deferSyncStart()).toBe(true)
       const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
         deferAcquisition: true,
-        includeInitialState: true,
       })
-      let cleanup: Promise<void> | undefined
-      let retired = false
-      const retire = () => {
-        if (retired) return
-        retired = true
-        subscription.unsubscribe()
-        if (history.cleanup) cleanup = collection.cleanup()
-      }
-      const offStatus = collection.on(`status:change`, ({ status }) => {
-        if (status === history.retireAt) retire()
+      const removeReadyListener = collection.on(`status:${phase}`, () => {
+        if (!cancelOnEntry) return
+        cancelOnEntry = false
+        if (action === `cleanup`) void collection.cleanup()
+        else if (action === `release`) subscription.releaseSnapshot(where)
+        else subscription.unsubscribe()
       })
-      const offCounts = collection.on(
-        `subscribers:change`,
-        ({ subscriberCount }) => {
-          counts.push(subscriberCount)
-          if (history.retireAt === `subscribers` && subscriberCount === 1)
-            retire()
-        },
-      )
+      subscription.requestSnapshot({
+        where,
+        onLoadSubsetResult: (result) => observed.push(result),
+      })
+
       try {
+        cancelOnEntry = true
         subscription.resumeDeferredAcquisition()
-        expect(starts).toBe(expected.starts)
-        expect(collection.subscriberCount).toBe(expected.acquiring)
-        expect(counts).toEqual(expected.counts)
-        expect(collection._hasSubscriberOrPreload()).toBe(
-          expected.subscriberOrPreload,
-        )
-        await cleanup
         await flushPromises()
-        expect(collection.subscriberCount).toBe(expected.acquiring)
-        expect(loads).toBe(
-          history.syncMode === `on-demand` && history.retireAt === `none`
-            ? 1
-            : 0,
-        )
-        offStatus()
-        offCounts()
-        subscription.unsubscribe()
-        expect(collection.subscriberCount).toBe(0)
+
+        expect(collection.status).toBe(expectedStatusAfterQueuedCancel(action))
+        expect(loads).toHaveLength(0)
+        expect(unloads).toHaveLength(0)
+        expect(observed).toHaveLength(1)
+        await expect(observed[0]).rejects.toMatchObject({ name: `AbortError` })
       } finally {
-        offStatus()
-        offCounts()
+        removeReadyListener()
         subscription.unsubscribe()
         await collection.cleanup()
       }
     },
   )
 
-  it(`keeps an eager subscription ready after collection restart`, async () => {
-    const collection = createCollection<{ id: string }>({
-      id: `eager-subscription-restart`,
-      getKey: ({ id }) => id,
-      syncMode: `eager`,
-      sync: { sync: ({ markReady }) => markReady() },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot()
-
-    await collection.cleanup()
-    collection.startSyncImmediate()
-    await flushPromises()
-
-    expect(collection.status).toBe(`ready`)
-    expect(subscription.status).toBe(`ready`)
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it(`retires restart loading when the replacement sync fails`, async () => {
-    const syncFailure = new Error(`replacement sync failed`)
-    let nextSyncRunGeneration = 0
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `failed-sync-restart`,
-      sync: {
-        sync: ({ markReady }) => {
-          if (nextSyncRunGeneration++ > 0) throw syncFailure
-          markReady()
-          return { loadSubset: () => true }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot()
-
-    await collection.cleanup()
-    expect(() => collection.startSyncImmediate()).toThrow(syncFailure)
-    await flushPromises()
-
-    expect(collection.status).toBe(`crashed`)
-    expect(subscription.status).toBe(`ready`)
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it(`retires failed acquisition release with its sync run cleanup`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const releaseFailure = new Error(`release failed`)
-    const uncaught = captureMicrotaskErrors()
-    let unloads = 0
-    let sourceCleanups = 0
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `cleanup-failed-release`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: () => true,
-            unloadSubset: () => {
-              unloads++
-              if (unloads === 1) throw releaseFailure
-            },
-            cleanup: () => {
-              sourceCleanups++
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot({ where })
-    expect(() => subscription.releaseSnapshot(where)).not.toThrow()
-    await Promise.resolve()
-    expect(uncaught.errors).toEqual([releaseFailure])
-
-    await collection.cleanup()
-    expect(unloads).toBe(1)
-    expect(sourceCleanups).toBe(1)
-    observeSyncRunBoundary(`active-cleanup`)
-
-    await collection.cleanup()
-    expect(unloads).toBe(1)
-    expect(sourceCleanups).toBe(1)
-    observeAcquisitionInteraction(
-      `failed-release:cleanup`,
-      `no-repeat-on-cleanup`,
-    )
-    subscription.unsubscribe()
-    await Promise.resolve()
-    expect(uncaught.errors).toEqual([releaseFailure])
-    uncaught.restore()
-  })
-
   it.each(
     ([`return`, `throw`] as const).flatMap((outcome) =>
       [false, true].map((releaseSelf) => ({ outcome, releaseSelf })),
@@ -3824,466 +1279,110 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
         expect(subscription.status).toBe(`ready`)
         // The release error is reported uncaught, not as a load error.
         expect(errors).toEqual([])
-        expect(uncaught.errors).toEqual(outcome === `throw` ? [failure] : [])
-
-        releaseOwner()
-        expect(unloads).toHaveLength(1)
-        subscription.unsubscribe()
-        expect(unloads).toHaveLength(1)
-        for (const options of unloads) expect(options).toBe(loads[0])
-        expect(loads).toHaveLength(1)
-        await Promise.resolve()
-        expect(uncaught.errors).toEqual(outcome === `throw` ? [failure] : [])
-      } finally {
-        uncaught.restore()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it.each(
-    ([`adapter`, `error-listener`] as const).flatMap((reentry) =>
-      [1, 2].map((failures) => ({ reentry, failures })),
-    ),
-  )(
-    `attempts release once across $reentry reentry with $failures configured failures`,
-    async ({ reentry, failures }) => {
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-      const failure = new Error(`physical release failed`)
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const errors: Array<unknown> = []
-      const nestedFailures: Array<unknown> = []
-      const uncaught = captureMicrotaskErrors()
-      let releaseOwner = () => {}
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `release-reentry-${reentry}-${failures}`,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: (options) => {
-                unloads.push(options)
-                if (unloads.length === 1 && reentry === `adapter`) {
-                  releaseOwner()
-                }
-                if (unloads.length <= failures) throw failure
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      releaseOwner = () => {
-        try {
-          subscription.unsubscribe()
-        } catch (error) {
-          nestedFailures.push(error)
-        }
-      }
-      subscription.on(`loadSubset:error`, ({ error }) => {
-        errors.push(error)
-        if (errors.length === 1 && reentry === `error-listener`) releaseOwner()
-      })
-      try {
-        subscription.requestSnapshot({ where })
-        let releaseError: unknown
-        try {
-          subscription.releaseSnapshot(where)
-        } catch (error) {
-          releaseError = error
-        }
-        expect(releaseError).toBe(undefined)
-        // Adapter reentry sees a retired acquisition, including after throw.
-        // A release error reaches no error listener, so that listener cannot
-        // reenter teardown.
-        expect(unloads).toHaveLength(1)
-        // Only the adapter path reentered and unsubscribed.
-        expect(collection.subscriberCount).toBe(reentry === `adapter` ? 0 : 1)
-        expect(errors).toEqual([])
-        expect(nestedFailures).toEqual([])
-        expect(() => subscription.unsubscribe()).not.toThrow()
-        expect(unloads).toHaveLength(1)
-        subscription.unsubscribe()
-        expect(unloads).toHaveLength(1)
-        expect(loads).toHaveLength(1)
-        for (const options of unloads) expect(options).toBe(loads[0])
-        await Promise.resolve()
-        // One attempt, one report, whatever the adapter would throw later.
-        expect(uncaught.errors).toEqual([failure])
-      } finally {
-        uncaught.restore()
-        await collection.cleanup()
-        subscription.unsubscribe()
-      }
-    },
-  )
-
-  it(`keeps failed releases out of truncate replay`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    const releaseFailure = new Error(`release failed`)
-    const uncaught = captureMicrotaskErrors()
-    let unloads = 0
-    let operations!: Parameters<SyncConfig<{ id: string }, string>[`sync`]>[0]
-    const collection = createCollection<{ id: string }, string>({
-      id: `truncate-failed-release`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (nextOperations) => {
-          operations = nextOperations
-          operations.markReady()
-          return {
-            loadSubset: () => true,
-            unloadSubset: () => {
-              unloads++
-              if (unloads === 1) throw releaseFailure
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot({ where })
-    expect(() => subscription.releaseSnapshot(where)).not.toThrow()
-
-    operations.begin()
-    operations.truncate()
-    const receipt = operations.commit()
-    if (receipt !== true) await receipt
-    expect(unloads).toBe(1)
-
-    subscription.unsubscribe()
-    expect(unloads).toBe(1)
-    observeAcquisitionInteraction(
-      `failed-release:truncate`,
-      `no-repeat-on-truncate`,
-    )
-    await collection.cleanup()
-    await Promise.resolve()
-    expect(uncaught.errors).toEqual([releaseFailure])
-    uncaught.restore()
-  })
-
-  it(`does not repeat failed cleanup through a replacement sync run`, async () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    let nextSyncRunGeneration = 0
-    const unloadSyncRunGenerations: Array<number> = []
-    const releaseFailure = new Error(`old sync run release failed`)
-    const uncaught = captureMicrotaskErrors()
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `cleanup-debt-sync-run`,
-      sync: {
-        sync: ({ markReady }) => {
-          const syncRunGeneration = nextSyncRunGeneration++
-          markReady()
-          return {
-            loadSubset: () => true,
-            unloadSubset: () => {
-              unloadSyncRunGenerations.push(syncRunGeneration)
-              if (syncRunGeneration === 0) throw releaseFailure
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot({ where })
-    expect(() => subscription.releaseSnapshot(where)).not.toThrow()
-
-    await collection.cleanup()
-    collection.startSyncImmediate()
-    await flushPromises()
-    subscription.unsubscribe()
-
-    expect(unloadSyncRunGenerations).toEqual([0])
-    await collection.cleanup()
-    expect(uncaught.errors).toEqual([releaseFailure])
-    uncaught.restore()
-  })
-
-  it.each(restartScenarios)(
-    `keeps restart ownership aligned for $outcome × $reentry`,
-    async ({ outcome, reentry }) => {
-      type DemandName = `target` | `peer`
-      const targetWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`target`),
-      ])
-      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`peer`)])
-      const demandForWhere = new Map<unknown, DemandName>([
-        [targetWhere, `target`],
-        [peerWhere, `peer`],
-      ])
-      const failure = new Error(`restart acquisition failed`)
-      const pending = createDeferred<void>()
-      void pending.promise.catch(() => {})
-      const loads: Array<{
-        syncRunGeneration: number
-        demand: DemandName
-      }> = []
-      const unloads: Array<{
-        syncRunGeneration: number
-        demand: DemandName
-      }> = []
-      const sourceCleanups: Array<number> = []
-      const errors: Array<unknown> = []
-      let nextSyncRunGeneration = -1
-      let ranReentry = false
-
-      const collection = createOnDemandCollection<{ id: string }>({
-        id: `restart-${outcome}-${reentry}`,
-        sync: {
-          sync: ({ markReady }) => {
-            const syncRunGeneration = ++nextSyncRunGeneration
-            markReady()
-            return {
-              loadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown restart demand`)
-                loads.push({ syncRunGeneration, demand })
-                if (syncRunGeneration === 0 || demand === `peer`) return true
-                if (!ranReentry) {
-                  ranReentry = true
-                  if (reentry === `release-self`) {
-                    subscription.releaseSnapshot(targetWhere)
-                  } else if (reentry === `release-peer`) {
-                    subscription.releaseSnapshot(peerWhere)
-                  } else if (reentry === `unsubscribe`) {
-                    subscription.unsubscribe()
-                  } else if (reentry === `cleanup`) {
-                    void collection.cleanup()
-                  }
-                }
-                if (outcome === `throw`) throw failure
-                if (outcome === `return`) return true
-                return pending.promise
-              },
-              unloadSubset: (options) => {
-                const demand = demandForWhere.get(options.where)
-                if (!demand) throw new Error(`unknown restart demand`)
-                unloads.push({ syncRunGeneration, demand })
-              },
-              cleanup: () => {
-                sourceCleanups.push(syncRunGeneration)
-              },
-            }
-          },
-        },
-      })
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        () => {},
-        {
-          includeInitialState: false,
-        },
-      )
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      subscription.requestSnapshot({ where: targetWhere })
-      subscription.requestSnapshot({ where: peerWhere })
-
-      await collection.cleanup()
-      expect(sourceCleanups).toEqual([0])
-      observeAcquisitionInteraction(`active:cleanup`, `retire`)
-      collection.startSyncImmediate()
-      observeSyncRunBoundary(`restart-installed`)
-      await flushPromises()
-      if (outcome === `resolve`) pending.resolve()
-      if (outcome === `reject`) pending.reject(failure)
-      await flushPromises()
-
-      // A synchronous throw is a rejection: it establishes the acquisition.
-      const targetEstablished = reentry !== `cleanup`
-      const targetSurvives = reentry === `none` || reentry === `release-peer`
-      const peerStarts =
-        reentry !== `release-peer` &&
-        reentry !== `unsubscribe` &&
-        reentry !== `cleanup`
-      expect(loads).toEqual([
-        { syncRunGeneration: 0, demand: `target` },
-        { syncRunGeneration: 0, demand: `peer` },
-        { syncRunGeneration: 1, demand: `target` },
-        ...(peerStarts
-          ? [{ syncRunGeneration: 1, demand: `peer` as const }]
-          : []),
-      ])
-      expect(errors).toEqual(
-        (outcome === `throw` || outcome === `reject`) && targetSurvives
-          ? [failure]
-          : [],
-      )
+        expect(uncaught.errors).toEqual(
+          expectedUncaughtReleaseErrors(outcome, failure),
+        )
 
-      if (reentry !== `unsubscribe`) subscription.unsubscribe()
-      expect(unloads).toEqual([
-        ...(targetEstablished && !targetSurvives
-          ? [{ syncRunGeneration: 1, demand: `target` as const }]
-          : []),
-        ...(targetEstablished && targetSurvives
-          ? [{ syncRunGeneration: 1, demand: `target` as const }]
-          : []),
-        ...(peerStarts
-          ? [{ syncRunGeneration: 1, demand: `peer` as const }]
-          : []),
-      ])
-      await collection.cleanup()
-      expect(sourceCleanups).toEqual([0, 1])
+        releaseOwner()
+        expect(unloads).toHaveLength(1)
+        subscription.unsubscribe()
+        expect(unloads).toHaveLength(1)
+        for (const options of unloads) expect(options).toBe(loads[0])
+        expect(loads).toHaveLength(1)
+        await Promise.resolve()
+        expect(uncaught.errors).toEqual(
+          expectedUncaughtReleaseErrors(outcome, failure),
+        )
+      } finally {
+        uncaught.restore()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
     },
   )
 
   it.each(
-    ([`initial`, `replay`] as const).flatMap((origin) =>
-      ([`resolve`, `reject`] as const).flatMap((oldOutcome) =>
-        ([`old-first`, `current-first`] as const).map((order) => ({
-          origin,
-          oldOutcome,
-          order,
-        })),
-      ),
+    ([`adapter`, `error-listener`] as const).flatMap((reentry) =>
+      [1, 2].map((failures) => ({ reentry, failures })),
     ),
   )(
-    `does not wait for aborted $origin work before publishing or readiness, $oldOutcome, $order`,
-    async ({ origin, oldOutcome, order }) => {
-      type Row = { id: string; version: number }
-      const where = {
-        a: new Func(`eq`, [new PropRef([`id`]), new Value(`a`)]),
-        b: new Func(`eq`, [new PropRef([`id`]), new Value(`b`)]),
-      }
-      const loads: Array<{
-        options: LoadSubsetOptions
-        deferred: ReturnType<typeof createDeferred<void>>
-      }> = []
+    `attempts release once across $reentry reentry with $failures configured failures`,
+    async ({ reentry, failures }) => {
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+      const failure = new Error(`physical release failed`)
+      const loads: Array<LoadSubsetOptions> = []
       const unloads: Array<LoadSubsetOptions> = []
       const errors: Array<unknown> = []
-      const visible = new Map<string | number, Row>()
-      let emptyBatches = 0
-      let replacementChanges = 0
-      let operations!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-      const collection = createCollection<Row, string>({
-        id: `publication-readiness-boundary`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
+      const nestedFailures: Array<unknown> = []
+      const uncaught = captureMicrotaskErrors()
+      let releaseOwner = () => {}
+      const collection = createOnDemandCollection<{ id: string }>({
+        id: `release-reentry-${reentry}-${failures}`,
         sync: {
-          sync: (nextOperations) => {
-            operations = nextOperations
-            operations.markReady()
+          sync: ({ markReady }) => {
+            markReady()
             return {
               loadSubset: (options) => {
-                const deferred = createDeferred<void>()
-                void deferred.promise.catch(() => {})
-                loads.push({ options, deferred })
-                return deferred.promise
+                loads.push(options)
+                return true
               },
               unloadSubset: (options) => {
                 unloads.push(options)
+                if (unloads.length === 1 && reentry === `adapter`) {
+                  releaseOwner()
+                }
+                if (unloads.length <= failures) throw failure
               },
             }
           },
         },
       })
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          if (changes.length === 0) emptyBatches++
-          for (const change of changes) {
-            if (change.type === `delete`) visible.delete(change.key)
-            else {
-              visible.set(change.key, {
-                id: change.value.id,
-                version: change.value.version,
-              })
-              if (change.value.id === `b` && change.value.version === 2)
-                replacementChanges++
-            }
-          }
-        },
-        { includeInitialState: false },
-      )
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      const write = async (id: string, version: number) => {
-        operations.begin()
-        operations.write({
-          type: collection.has(id) ? `update` : `insert`,
-          value: { id, version },
-        })
-        const receipt = operations.commit()
-        if (receipt !== true) await receipt
-      }
-      const truncate = async () => {
-        operations.begin()
-        operations.truncate()
-        const receipt = operations.commit()
-        if (receipt !== true) await receipt
-        await flushPromises()
-      }
-      const settle = async (
-        attempt: (typeof loads)[number],
-        outcome: `resolve` | `reject`,
-        id = `b`,
-      ) => {
-        // The source settles an aborted load late but suppresses its writes.
-        // An abort ended that load (maintainer decision): its late settlement
-        // installs nothing and holds neither readiness nor publication.
-        if (outcome === `resolve`) {
-          if (!attempt.options.signal?.aborted) await write(id, 2)
-          attempt.deferred.resolve()
-        } else attempt.deferred.reject(new Error(`obsolete source failed`))
-        await flushPromises()
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      releaseOwner = () => {
+        try {
+          subscription.unsubscribe()
+        } catch (error) {
+          nestedFailures.push(error)
+        }
       }
+      subscription.on(`loadSubset:error`, ({ error }) => {
+        errors.push(error)
+        if (errors.length === 1 && reentry === `error-listener`) releaseOwner()
+      })
       try {
-        subscription.requestSnapshot({ where: where.b })
-        await write(`b`, 0)
-        if (origin === `replay`) {
-          loads[0]!.deferred.resolve()
-          await flushPromises()
-          await truncate()
-        }
-        const old = loads.at(-1)!
-        await truncate()
-        const current = loads.at(-1)!
-        expect(old.options.signal?.aborted).toBe(true)
-        expect([...visible.values()]).toEqual([{ id: `b`, version: 0 }])
-        if (order === `old-first`) {
-          await settle(old, oldOutcome)
-          expect(subscription.status).toBe(`loadingSubset`)
-          expect([...visible.values()]).toEqual([{ id: `b`, version: 0 }])
+        subscription.requestSnapshot({ where })
+        let releaseError: unknown
+        try {
+          subscription.releaseSnapshot(where)
+        } catch (error) {
+          releaseError = error
         }
-        await settle(current, `resolve`)
-        expect([...visible.values()]).toEqual([{ id: `b`, version: 2 }])
-        expect(subscription.status).toBe(`ready`)
-        const emptyBeforeRequest = emptyBatches
-        subscription.requestSnapshot({ where: where.a })
-        expect(emptyBatches - emptyBeforeRequest).toBe(1)
-        await settle(loads.at(-1)!, `resolve`, `a`)
-        expect([...visible.values()]).toEqual([
-          { id: `b`, version: 2 },
-          { id: `a`, version: 2 },
-        ])
-        if (order === `current-first`) await settle(old, oldOutcome)
-        expect([...visible.values()]).toEqual([
-          { id: `b`, version: 2 },
-          { id: `a`, version: 2 },
-        ])
-        expect(subscription.status).toBe(`ready`)
+        expect(releaseError).toBe(undefined)
+        // Adapter reentry sees a retired acquisition, including after throw.
+        // A release error reaches no error listener, so that listener cannot
+        // reenter teardown.
+        expect(unloads).toHaveLength(1)
+        // Only the adapter path reentered and unsubscribed.
+        expect(collection.subscriberCount).toBe(
+          expectedSubscriberCountAfterRelease(reentry),
+        )
         expect(errors).toEqual([])
-        expect(replacementChanges).toBe(1)
+        expect(nestedFailures).toEqual([])
+        expect(() => subscription.unsubscribe()).not.toThrow()
+        expect(unloads).toHaveLength(1)
         subscription.unsubscribe()
-        expect(unloads).toHaveLength(loads.length)
-        for (const { options } of loads)
-          expect(unloads.filter((value) => value === options)).toHaveLength(1)
+        expect(unloads).toHaveLength(1)
+        expect(loads).toHaveLength(1)
+        for (const options of unloads) expect(options).toBe(loads[0])
+        await Promise.resolve()
+        // One attempt, one report, whatever the adapter would throw later.
+        expect(uncaught.errors).toEqual([failure])
       } finally {
-        for (const { deferred } of loads) deferred.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
+        uncaught.restore()
         await collection.cleanup()
+        subscription.unsubscribe()
       }
     },
   )
@@ -4316,274 +1415,33 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
                   operations.begin()
                   operations.write({
                     type: `insert`,
-                    value: { id: `row`, version: 1 },
-                  })
-                  operations.commit(options.signal)
-                  return true
-                }
-                const gate = ownSyncRunGeneration === 1 ? obsolete : current
-                const outcome =
-                  ownSyncRunGeneration === 1 ? obsoleteOutcome : currentOutcome
-                const failure =
-                  ownSyncRunGeneration === 1 ? obsoleteFailure : currentFailure
-                return gate.promise.then(() => {
-                  if (outcome === `reject`) throw failure
-                  operations.begin()
-                  operations.write({
-                    type: `insert`,
-                    value: {
-                      id: `row`,
-                      version: ownSyncRunGeneration + 1,
-                    },
-                  })
-                  const receipt = operations.commit(options.signal)
-                  if (receipt !== true) return receipt
-                  return undefined
-                })
-              },
-              unloadSubset: () =>
-                unloadSyncRunGenerations.push(ownSyncRunGeneration),
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            if (change.type === `delete`) visible.delete(change.key)
-            else {
-              visible.set(change.key, {
-                id: change.value.id,
-                version: change.value.version,
-              })
-            }
-          }
-        },
-        { includeInitialState: false },
-      )
-      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      subscription.requestSnapshot()
-      expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
-
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await flushPromises()
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await flushPromises()
-      expect(subscription.status).toBe(`loadingSubset`)
-
-      const settleObsolete = () =>
-        obsoleteOutcome === `resolve`
-          ? obsolete.resolve()
-          : obsolete.reject(obsoleteFailure)
-      const settleCurrent = () =>
-        currentOutcome === `resolve`
-          ? current.resolve()
-          : current.reject(currentFailure)
-      if (settlementOrder === `obsolete-first`) {
-        settleObsolete()
-        await flushPromises()
-        expect(subscription.status).toBe(`loadingSubset`)
-        settleCurrent()
-      } else {
-        settleCurrent()
-        await flushPromises()
-        settleObsolete()
-      }
-      await flushPromises()
-
-      expect([...visible.values()]).toEqual([
-        currentOutcome === `resolve`
-          ? { id: `row`, version: 3 }
-          : { id: `row`, version: 1 },
-      ])
-      expect(errors).toEqual(
-        currentOutcome === `reject` ? [currentFailure] : [],
-      )
-      expect(subscription.lastError).toBe(
-        currentOutcome === `reject` ? currentFailure : undefined,
-      )
-      expect(subscription.status).toBe(`ready`)
-
-      subscription.unsubscribe()
-      expect(unloadSyncRunGenerations).toEqual([2])
-      await collection.cleanup()
-    },
-  )
-
-  // An abort ends the load (maintainer decision): an owner whose replay load
-  // was aborted owes the replay nothing, so the replay publishes what the
-  // source holds, as one whose last owner retired does. The rows the adapter
-  // wrote before the abort applied as ordinary writes.
-  it(`publishes the source rows when an external abort ends the replay's only load`, async () => {
-    type Row = { id: string; value: string }
-    const abort = new AbortController()
-    const replay = createDeferred<void>()
-    let begin!: () => void
-    let write!: (message: { type: `insert`; value: Row }) => void
-    let commit!: () => void
-    let truncate!: () => void
-    let loadCount = 0
-    const visible = new Map<string | number, Row>()
-    const collection = createOnDemandCollection<Row>({
-      id: `externally-aborted-replay`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              loadCount++
-              begin()
-              write({
-                type: `insert`,
-                value: {
-                  id: `row`,
-                  value: loadCount === 1 ? `old` : `partial`,
-                },
-              })
-              commit()
-              return loadCount === 1 ? true : replay.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        for (const change of changes) {
-          if (change.type === `delete`) visible.delete(change.key)
-          else {
-            visible.set(change.key, {
-              id: change.value.id,
-              value: change.value.value,
-            })
-          }
-        }
-      },
-      { includeInitialState: false },
-    )
-
-    subscription.requestSnapshot({ signal: abort.signal })
-    expect([...visible.values()]).toEqual([{ id: `row`, value: `old` }])
-    begin()
-    truncate()
-    commit()
-    await flushPromises()
-    abort.abort()
-    replay.reject(new DOMException(`aborted`, `AbortError`))
-    await flushPromises()
-
-    expect([...visible.values()]).toEqual([{ id: `row`, value: `partial` }])
-    expect(subscription.status).toBe(`ready`)
-
-    subscription.unsubscribe()
-    await collection.cleanup()
-  })
-
-  it(`enters loading status when a truncate queues replay work`, async () => {
-    const replay = createDeferred<void>()
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createOnDemandCollection<{ id: string }>({
-      id: `queued-replay-status`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return loads.length === 1 ? true : replay.promise
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    subscription.requestSnapshot({ where })
-    const original = loads[0]!
-
-    begin()
-    truncate()
-    commit()
-    observeAcquisitionInteraction(`active:truncate`, `retire`)
-
-    expect(loads).toHaveLength(1)
-    expect(subscription.status).toBe(`loadingSubset`)
-
-    await flushPromises()
-    const replacement = loads[1]!
-    expect(loads).toHaveLength(2)
-    expect(original.signal?.aborted).toBe(true)
-    expect(unloads).toEqual([original])
-    expect(replacement).not.toBe(original)
-    expect(replacement.where).toBe(where)
-    expect(replacement.signal?.aborted).toBe(false)
-    replay.resolve()
-    await flushPromises()
-    expect(subscription.status).toBe(`ready`)
-
-    subscription.unsubscribe()
-    expect(unloads).toEqual([original, replacement])
-    await collection.cleanup()
-  })
-
-  it.each(startOutcomes)(
-    `retires replay setup when its adapter cleans up before %s`,
-    async (outcome) => {
-      type Row = { id: string; version: number }
-      const pending = createDeferred<void>()
-      void pending.promise.catch(() => {})
-      const failure = new Error(`obsolete replay failed`)
-      let begin!: () => void
-      let write!: (message: { type: `insert`; value: Row }) => void
-      let commit!: () => void
-      let truncate!: () => void
-      let loadCount = 0
-      const visible = new Map<string | number, Row>()
-      const errors: Array<unknown> = []
-      const statuses: Array<string> = []
-
-      const collection = createOnDemandCollection<Row>({
-        id: `reentrant-cleanup-${outcome}`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            write = operations.write
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: () => {
-                loadCount++
-                begin()
-                write({
-                  type: `insert`,
-                  value: { id: `row`, version: loadCount },
+                    value: { id: `row`, version: 1 },
+                  })
+                  operations.commit(options.signal)
+                  return true
+                }
+                const gate = ownSyncRunGeneration === 1 ? obsolete : current
+                const outcome =
+                  ownSyncRunGeneration === 1 ? obsoleteOutcome : currentOutcome
+                const failure =
+                  ownSyncRunGeneration === 1 ? obsoleteFailure : currentFailure
+                return gate.promise.then(() => {
+                  if (outcome === `reject`) throw failure
+                  operations.begin()
+                  operations.write({
+                    type: `insert`,
+                    value: {
+                      id: `row`,
+                      version: ownSyncRunGeneration + 1,
+                    },
+                  })
+                  const receipt = operations.commit(options.signal)
+                  if (receipt !== true) return receipt
+                  return undefined
                 })
-                commit()
-                if (loadCount === 1) return true
-                void collection.cleanup()
-                if (outcome === `throw`) throw failure
-                if (outcome === `return`) return true
-                return pending.promise
               },
-              unloadSubset: () => {},
+              unloadSubset: () =>
+                unloadSyncRunGenerations.push(ownSyncRunGeneration),
             }
           },
         },
@@ -4603,25 +1461,50 @@ describe(`CollectionSubscription demand lifecycle oracle`, () => {
         { includeInitialState: false },
       )
       subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
-      subscription.on(`status:change`, ({ status }) => statuses.push(status))
       subscription.requestSnapshot()
+      expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
 
-      begin()
-      truncate()
-      commit()
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      await flushPromises()
+      await collection.cleanup()
+      collection.startSyncImmediate()
       await flushPromises()
-      if (outcome === `resolve`) pending.resolve()
-      if (outcome === `reject`) pending.reject(failure)
+      expect(subscription.status).toBe(`loadingSubset`)
+
+      const settleObsolete = () =>
+        obsoleteOutcome === `resolve`
+          ? obsolete.resolve()
+          : obsolete.reject(obsoleteFailure)
+      const settleCurrent = () =>
+        currentOutcome === `resolve`
+          ? current.resolve()
+          : current.reject(currentFailure)
+      if (settlementOrder === `obsolete-first`) {
+        settleObsolete()
+        await flushPromises()
+        expect(subscription.status).toBe(`loadingSubset`)
+        settleCurrent()
+      } else {
+        settleCurrent()
+        await flushPromises()
+        settleObsolete()
+      }
       await flushPromises()
 
-      expect(collection.status).toBe(`cleaned-up`)
-      expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
-      expect(errors).toEqual([])
-      expect(subscription.lastError).toBeUndefined()
+      const settled = expectedThreeGenerationSettlement(
+        currentOutcome,
+        currentFailure,
+      )
+      expect([...visible.values()]).toEqual([
+        { id: `row`, version: settled.version },
+      ])
+      expect(errors).toEqual(settled.errors)
+      expect(subscription.lastError).toBe(settled.lastError)
       expect(subscription.status).toBe(`ready`)
-      expect(statuses.at(-1)).not.toBe(`loadingSubset`)
 
       subscription.unsubscribe()
+      expect(unloadSyncRunGenerations).toEqual([2])
       await collection.cleanup()
     },
   )
@@ -4781,33 +1664,194 @@ describe(`resumption notification error and surviving demand`, () => {
       )
     })
   }
-})
+  // The grammar's independent judgment treats cleanup as retiring this start,
+  // not permission to retry it. This driver crosses no render gate, a held
+  // gate with no request, and a held requested start with both source modes.
+  // It records the complete public status trace at subscribeChanges return
+  // and cleanup settlement. A later ordinary reader is fresh restart demand.
+  it.each(
+    subscriberStartCleanupHistories.flatMap((history) =>
+      ([`none`, `unrequested`, `requested`] as const).flatMap((gate) =>
+        ([`eager`, `on-demand`] as const).map((syncMode) => ({
+          ...history,
+          gate,
+          syncMode,
+        })),
+      ),
+    ),
+  )(
+    `ordinary admission preserves $cleanupAt cleanup (pending=$cleanupPending, $gate start, $syncMode)`,
+    async (history) => {
+      const expected = modelSubscriberStartCleanup(history)
+      const pendingCleanup = createDeferred<void>()
+      let starts = 0
+      let cleanups = 0
+      let cleanupRequested = false
+      let cleanup: Promise<void> | undefined
+      const statuses: Array<string> = []
+      const collection = createCollection({
+        id: `ordinary-admission-cleanup`,
+        startSync: false,
+        syncMode: history.syncMode,
+        getKey: (row: { id: string }) => row.id,
+        sync: {
+          sync: ({ markReady }) => {
+            starts++
+            markReady()
+            return {
+              loadSubset: () => true,
+              cleanup: () => {
+                cleanups++
+                return history.cleanupPending
+                  ? pendingCleanup.promise
+                  : undefined
+              },
+            }
+          },
+        },
+      })
+      if (history.gate !== `none`) {
+        expect(collection._deferSyncStart()).toBe(true)
+        if (history.gate === `requested`) collection.startSyncImmediate()
+      }
+      const removeStatusListener = collection.on(
+        `status:change`,
+        ({ status }) => {
+          statuses.push(status)
+          if (!cleanupRequested && status === history.cleanupAt) {
+            cleanupRequested = true
+            cleanup = collection.cleanup()
+          }
+        },
+      )
+      let subscription:
+        ReturnType<typeof collection.subscribeChanges> | undefined
+      let peer: ReturnType<typeof collection.subscribeChanges> | undefined
+      try {
+        subscription = collection.subscribeChanges(() => {}, {
+          includeInitialState: false,
+        })
+        expect(starts, `adapter entries at admission return`).toBe(
+          expected.starts,
+        )
+        expect(cleanups).toBe(expected.cleanups)
+        expect(collection.status).toBe(expected.statusOnReturn)
+        expect(statuses).toEqual(expected.statusesOnReturn)
 
-// During ordinary admission, the new owner exists before subscribeChanges
-// returns its handle. Cleanup in the acquiring-count callback must retain that
-// demand even though the subscription has not joined the publication channel.
-// The token judgment is one surviving owner, independent of production's list.
-it(`retains admitted demand during subscriber-change cleanup`, async () => {
-  const source = createCollection<{ id: string }>({
-    getKey: (row) => row.id,
-    gcTime: 0,
-    sync: { sync: ({ markReady }) => markReady() },
-  })
-  let cleanup: Promise<void> | undefined
-  let observed: boolean | undefined
-  const off = source.on(`subscribers:change`, ({ subscriberCount }) => {
-    if (subscriberCount !== 1) return
-    cleanup = source.cleanup()
-    observed = source._hasSubscriberOrPreload()
-  })
-  const subscription = source.subscribeChanges(() => {})
-  try {
-    expect(observed).toBe(true)
-    expect(source.subscriberCount).toBe(1)
-    await cleanup
-  } finally {
-    off()
-    subscription.unsubscribe()
-    await source.cleanup()
-  }
+        pendingCleanup.resolve()
+        await cleanup
+        expect(starts, `cleanup settlement must not restart`).toBe(
+          expected.starts,
+        )
+        expect(collection.status).toBe(expected.statusAfterCleanup)
+        expect(statuses).toEqual(expected.statusesAfterCleanup)
+
+        removeStatusListener()
+        peer = collection.subscribeChanges(() => {}, {
+          includeInitialState: false,
+        })
+        expect(starts, `later demand may restart a retired run`).toBe(
+          expected.starts + (history.cleanupAt === `none` ? 0 : 1),
+        )
+        expect(collection.status).toBe(`ready`)
+      } finally {
+        removeStatusListener()
+        pendingCleanup.resolve()
+        await cleanup
+        peer?.unsubscribe()
+        subscription?.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // The callback can release this owner before resumption commits, or from
+  // its acquiring notification. Both cuts must leave balanced public counts
+  // and no later acquisition. The no-retirement neighbor must acquire normally.
+  it.each(
+    subscriberResumeRetirementHistories.flatMap((history) =>
+      ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
+        [false, true].map((renderGate) => ({
+          ...history,
+          syncMode,
+          renderGate,
+        })),
+      ),
+    ),
+  )(
+    `balances resume at $retireAt (cleanup=$cleanup, $syncMode, gate=$renderGate)`,
+    async (history) => {
+      const expected = modelSubscriberResumeRetirement(history)
+      let starts = 0
+      let loads = 0
+      const counts: Array<number> = []
+      const collection = createCollection<{ id: string }>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        syncMode: history.syncMode,
+        sync: {
+          sync: ({ markReady }) => {
+            starts++
+            markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                return true
+              },
+            }
+          },
+        },
+      })
+      if (history.renderGate) collection._deferSyncStart()
+      const subscription = collection.subscribeChanges(() => {}, {
+        deferAcquisition: true,
+        includeInitialState: true,
+      })
+      let cleanup: Promise<void> | undefined
+      let retired = false
+      const retire = () => {
+        if (retired) return
+        retired = true
+        subscription.unsubscribe()
+        if (history.cleanup) cleanup = collection.cleanup()
+      }
+      const offStatus = collection.on(`status:change`, ({ status }) => {
+        if (status === history.retireAt) retire()
+      })
+      const offCounts = collection.on(
+        `subscribers:change`,
+        ({ subscriberCount }) => {
+          counts.push(subscriberCount)
+          if (history.retireAt === `subscribers` && subscriberCount === 1)
+            retire()
+        },
+      )
+      try {
+        subscription.resumeDeferredAcquisition()
+        expect(starts).toBe(expected.starts)
+        expect(collection.subscriberCount).toBe(expected.acquiring)
+        expect(counts).toEqual(expected.counts)
+        expect(collection._hasSubscriberOrPreload()).toBe(
+          expected.subscriberOrPreload,
+        )
+        await cleanup
+        await flushPromises()
+        expect(collection.subscriberCount).toBe(expected.acquiring)
+        expect(loads).toBe(
+          history.syncMode === `on-demand` && history.retireAt === `none`
+            ? 1
+            : 0,
+        )
+        offStatus()
+        offCounts()
+        subscription.unsubscribe()
+        expect(collection.subscriberCount).toBe(0)
+      } finally {
+        offStatus()
+        offCounts()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
 })
diff --git a/packages/db/tests/collection-subscription-lifecycle-publication-oracle.property.test.ts b/packages/db/tests/collection-subscription-lifecycle-publication-oracle.property.test.ts
index f1f6ffbd2d..882042c34f 100644
--- a/packages/db/tests/collection-subscription-lifecycle-publication-oracle.property.test.ts
+++ b/packages/db/tests/collection-subscription-lifecycle-publication-oracle.property.test.ts
@@ -14,8 +14,22 @@ import {
   reduceLifecycle,
 } from './collection-subscription-lifecycle-grammar-oracle.js'
 import { oracleRandomParameters, readOracleRunConfig } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import { flushPromises } from './utils.js'
-import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
+import {
+  assertTerminalPublication,
+  clonePublicationBatches,
+  cloneRow,
+  normalizePublicationOrder,
+} from './collection-subscription-lifecycle-publication-support'
+import type {
+  PublicationChange,
+  PublicationPhase,
+  Row,
+  RowKey,
+  SyncOperations,
+  TerminalPublicationSnapshot,
+} from './collection-subscription-lifecycle-publication-support'
 import type {
   DeferralLifecycleCommand,
   DemandName,
@@ -80,25 +94,18 @@ import type {
  * still exercises their real dependency edge.
  */
 
-type RowKey = DemandName | `c` | `d`
-type Row = { id: RowKey; value: number }
-type PublicationChange = {
-  type: `insert` | `update` | `delete`
-  key: RowKey
-  value: Row
-  previousValue?: Row
-}
 type SourceMutation = {
   type: `source`
   key: RowKey
   action: `upsert` | `delete`
   value: number
 }
+
 type PublicationCommand =
   | Exclude<LifecycleCommand, { type: `truncate` }>
   | { type: `truncate`; replacement?: Row }
   | SourceMutation
-type SyncOperations = Parameters<SyncConfig<Row, RowKey>[`sync`]>[0]
+
 type RuntimeAttempt = {
   id: number
   ownerId: number
@@ -110,6 +117,7 @@ type RuntimeAttempt = {
   settled: boolean
   current: boolean
 }
+
 type RuntimeOwner = {
   id: number
   demand: DemandName
@@ -117,6 +125,7 @@ type RuntimeOwner = {
   aborted: boolean
   attemptId?: number
 }
+
 type Replacement = {
   syncRunGeneration: number
   replayGeneration: number
@@ -127,6 +136,7 @@ type Replacement = {
   // failure cannot stop a successful replacement.
   everFailed: boolean
 }
+
 type PublicationModel = {
   source: Map<RowKey, Row>
   visible: Map<RowKey, Row>
@@ -136,9 +146,9 @@ type PublicationModel = {
   batches: Array<Array<PublicationChange>>
   sentKeys: Set<RowKey>
 }
-type PublicationPhase =
-  `public` | `private-pending` | `private-settling` | `private-failed`
+
 type SourceEffect = `insert` | `update` | `delete`
+
 type PublicationObservation = {
   index: number
   command: PublicationCommand[`type`]
@@ -152,6 +162,7 @@ type PublicationObservation = {
   syncRuns: number
   collectionStatus: string
 }
+
 type PublicationMismatch = {
   history: string
   commandIndex: number
@@ -159,6 +170,7 @@ type PublicationMismatch = {
   expected: Array<Array<PublicationChange>>
   observed: Array<Array<PublicationChange>>
 }
+
 type PublicationRunOptions = {
   withoutLoader?: boolean
   continueAfterMismatch?: boolean
@@ -172,29 +184,6 @@ type PublicationRunOptions = {
   }
 }
 
-type TerminalPublicationSnapshot = {
-  batches: Array<Array<PublicationChange>>
-  visible: Array<Row>
-  statusEvents: Array<{ previousStatus: string; status: string }>
-  errors: Array<unknown>
-  status: string
-  subscriberCount: number
-  attempts: number
-  unloads: Array<number>
-  syncRuns: number
-}
-
-function assertTerminalPublication(
-  actual: TerminalPublicationSnapshot,
-  retired: TerminalPublicationSnapshot,
-): void {
-  expect(actual).toEqual(retired)
-  expect(actual.subscriberCount).toBe(0)
-  actual.errors.forEach((error, index) =>
-    expect(error).toBe(retired.errors[index]),
-  )
-}
-
 function recordSourceWrite(publication: PublicationModel, row: Row): void {
   // This driver requests raw future changes (includeInitialState: false).
   // After retiring private work, an unseen source row can still be updated.
@@ -225,34 +214,6 @@ const mapsEqual = (
   left.size === right.size &&
   [...left].every(([id, row]) => right.get(id)?.value === row.value)
 
-function cloneRow(row: Row): Row {
-  return { id: row.id, value: row.value }
-}
-
-function clonePublicationBatches(
-  batches: ReadonlyArray<ReadonlyArray<PublicationChange>>,
-): Array<Array<PublicationChange>> {
-  return batches.map((batch) =>
-    batch.map((change) => ({
-      ...change,
-      value: cloneRow(change.value),
-      ...(change.previousValue
-        ? { previousValue: cloneRow(change.previousValue) }
-        : {}),
-    })),
-  )
-}
-
-function normalizePublicationOrder(
-  batches: ReadonlyArray<ReadonlyArray<PublicationChange>>,
-): Array<Array<PublicationChange>> {
-  // Distinct keys have no canonical delivery order within one callback.
-  // Keep callback boundaries and stable order among changes to the same key.
-  return clonePublicationBatches(batches).map((batch) =>
-    batch.sort((left, right) => left.key.localeCompare(right.key)),
-  )
-}
-
 function publicationPhase(
   publication: PublicationModel,
   lifecycle: LifecycleModel,
@@ -1089,8 +1050,11 @@ async function runPublicationHistory(
 }
 
 type ProductSettlement = `none` | `resolve` | `reject`
+
 type ProductSuffix = `release` | `cleanup` | `restart` | `unsubscribe`
+
 type PriorIndependentRow = `absent` | `present`
+
 type PublicationProductCase = {
   name: string
   phase: PublicationPhase
@@ -1203,14 +1167,18 @@ const publicationPhases = [
   `private-settling`,
   `private-failed`,
 ] as const
+
 const sourceEffects = [`insert`, `update`, `delete`] as const
+
 const productSettlements = [`none`, `resolve`, `reject`] as const
+
 const productSuffixes = [
   `release`,
   `cleanup`,
   `restart`,
   `unsubscribe`,
 ] as const
+
 const priorIndependentRows = [`absent`, `present`] as const
 
 const publicationProductCases = publicationPhases.flatMap((phase) =>
@@ -1237,6 +1205,7 @@ const successfulReplacementCases = publicationProductCases.filter(
     sourceEffect !== `delete` &&
     settlement === `resolve`,
 )
+
 const replacementOrderingCases = publicationProductCases.filter(
   ({ phase, sourceEffect, settlement, suffix, priorIndependentRow }) =>
     (phase === `private-pending` || phase === `private-settling`) &&
@@ -1245,6 +1214,7 @@ const replacementOrderingCases = publicationProductCases.filter(
     suffix !== `release` &&
     priorIndependentRow === `present`,
 )
+
 const replacementRetirementCases = publicationProductCases.filter(
   (scenario) =>
     scenario.phase !== `public` &&
@@ -1252,12 +1222,14 @@ const replacementRetirementCases = publicationProductCases.filter(
     !successfulReplacementCases.includes(scenario) &&
     !replacementOrderingCases.includes(scenario),
 )
+
 const publicationControlCases = publicationProductCases.filter(
   (scenario) =>
     !successfulReplacementCases.includes(scenario) &&
     !replacementOrderingCases.includes(scenario) &&
     !replacementRetirementCases.includes(scenario),
 )
+
 // Keep each semantic cell intact while giving the aggregate campaign several
 // scheduler cuts. One 204-history test can exceed Vitest's per-test deadline
 // when the full oracle portfolio runs concurrently, even though no history is
@@ -1448,6 +1420,56 @@ async function runDeferralCleanupHistory(
     })
 }
 
+// The selection model: each local choice selects only the keys not yet
+// selected, and records the batch that a callback consumer should observe.
+// Both snapshot methods make the same choices, so `first` only changes the
+// rows of the first full or explicit snapshot.
+function expectedSelection(
+  first: `full` | `explicit` | `one` | `none`,
+  snapshotRows: ReadonlyArray<{ id: string; value: number }>,
+): {
+  batches: Array<Array<string>>
+  selected: Set<string>
+} {
+  const selected = new Set<string>()
+  const expectedBatches: Array<Array<string>> = []
+  const firstRows =
+    first === `one`
+      ? snapshotRows.filter(({ id }) => id === `one`)
+      : first === `none`
+        ? []
+        : snapshotRows
+  const choose = (rows: ReadonlyArray<{ id: string; value: number }>) => {
+    const batch = rows
+      .filter(({ id }) => !selected.has(id))
+      .map(({ id }) => `insert:${id}`)
+    for (const row of rows) selected.add(row.id)
+    if (batch.length > 0) expectedBatches.push(batch)
+  }
+  choose(firstRows)
+  const orderedChoice = snapshotRows.find(({ id }) => !selected.has(id))
+  choose(orderedChoice ? [orderedChoice] : [])
+  const nextOrderedChoice = snapshotRows.find(({ id }) => !selected.has(id))
+  choose(nextOrderedChoice ? [nextOrderedChoice] : [])
+  return { batches: expectedBatches, selected }
+}
+
+// The publication check compares each command's batches, visible rows, status,
+// and unloads with the model. The model predicts the publication step by
+// step, and the selection model predicts which keys local snapshots select.
+declareOracle({
+  check: [runPublicationHistory, runPublicationProduct],
+  model: [
+    projectPublication,
+    publicationDiff,
+    publishIfChanged,
+    recordSourceWrite,
+    finishReplacement,
+    expectedSelection,
+  ],
+  grammar: [deferralCleanupHistories, publicationProductCases],
+})
+
 describe(`CollectionSubscription lifecycle publication oracle`, () => {
   // A local snapshot selects source rows for this subscriber. Selection and
   // publication are distinct: replay can hold a selection privately, while
@@ -1482,32 +1504,15 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
     first: FirstSnapshot
     reenter: boolean
   }>
-
   it.each(selectionCases)(
     `selects each local key once across $first then ordered, includeInitialState=$includeInitialState, reenter=$reenter`,
     async ({ includeInitialState, first, reenter }) => {
-      // The model's selected set is an abstraction of local choices by both
-      // methods; visible is the independent callback consumer's row set.
-      const selected = new Set<string>()
-      const expectedBatches: Array<Array<string>> = []
-      const firstRows =
-        first === `one`
-          ? snapshotRows.filter(({ id }) => id === `one`)
-          : first === `none`
-            ? []
-            : snapshotRows
-      const choose = (rows: ReadonlyArray<SnapshotRow>) => {
-        const batch = rows
-          .filter(({ id }) => !selected.has(id))
-          .map(({ id }) => `insert:${id}`)
-        for (const row of rows) selected.add(row.id)
-        if (batch.length > 0) expectedBatches.push(batch)
-      }
-      choose(firstRows)
-      const orderedChoice = snapshotRows.find(({ id }) => !selected.has(id))
-      choose(orderedChoice ? [orderedChoice] : [])
-      const nextOrderedChoice = snapshotRows.find(({ id }) => !selected.has(id))
-      choose(nextOrderedChoice ? [nextOrderedChoice] : [])
+      // Local selections are modeled by expectedSelection; visible is the
+      // independent callback consumer's row set.
+      const { batches: expectedBatches, selected } = expectedSelection(
+        first,
+        snapshotRows,
+      )
 
       const observedBatches: Array<Array<string>> = []
       const visible = new Set<string>()
@@ -1607,695 +1612,18 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       }
     },
   )
-
-  it(`reselects a key only after its deletion and next publication`, async () => {
-    let operations!: Parameters<SyncConfig<SnapshotRow, string>[`sync`]>[0]
-    const loads: Array<{ cursor?: { lastKey?: string | number } }> = []
-    const collection = createCollection<SnapshotRow, string>({
-      id: `snapshot-selection-after-delete`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (sync) => {
-          operations = sync
-          sync.begin()
-          sync.write({ type: `insert`, value: { id: `one`, value: 1 } })
-          sync.write({ type: `insert`, value: { id: `two`, value: 2 } })
-          sync.commit()
-          sync.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const index = collection.createIndex((row) => row.value, {
-      indexType: BTreeIndex,
-    })
-    const orderBy = valueOrderBy()
-    const batches: Array<Array<string>> = []
-    const visible = new Set<string>()
-    const invalidChanges: Array<string> = []
-    const subscription = collection.subscribeChanges((changes) => {
-      const batch: Array<string> = []
-      for (const change of changes) {
-        batch.push(`${change.type}:${change.key}`)
-        if (change.type === `insert`) {
-          if (visible.has(String(change.key)))
-            invalidChanges.push(`duplicate insert:${change.key}`)
-          visible.add(String(change.key))
-        } else if (change.type === `delete`) {
-          if (!visible.delete(String(change.key)))
-            invalidChanges.push(`delete absent:${change.key}`)
-        }
-      }
-      if (batch.length > 0) batches.push(batch)
-    })
-    subscription.setOrderByIndex(index)
-    try {
-      subscription.requestSnapshot({
-        where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
-      })
-      operations.begin()
-      operations.write({ type: `delete`, key: `one` })
-      await operations.commit()
-      operations.begin()
-      operations.write({ type: `insert`, value: { id: `one`, value: 1 } })
-      await operations.commit()
-      subscription.requestLimitedSnapshot({
-        orderBy,
-        limit: 1,
-        minValues: [1],
-      })
-
-      // The independent fold is select(one), remove(one), publish(one), then
-      // select the first remaining ranked row. A permanent reservation loses
-      // the source reinsert; a missing reservation repeats it in the window.
-      expect(batches).toEqual([
-        [`insert:one`],
-        [`delete:one`],
-        [`insert:one`],
-        [`insert:two`],
-      ])
-      expect(invalidChanges).toEqual([])
-      expect([...visible].sort()).toEqual([`one`, `two`])
-      expect(loads.at(-1)).toMatchObject({ offset: 0 })
-      expect(loads.at(-1)?.cursor?.lastKey).toBeUndefined()
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  // A subscriber's callback has already published each inserted key, whether
-  // it filters source changes or passes them through. The model keeps source
-  // rows in a plain Map and public keys in a Set. Source deletes remove public
-  // keys; source inserts add them. An ordered snapshot may choose only an
-  // absent public key. These legal histories cross callback insertion,
-  // deletion, reinsert, and local selection in every filtering mode and ordered
-  // index path. Each callback is an observation cut. Retained-key count checks
-  // the long-lived tracking cost after deletion separately.
-  const callbackSelectionHistories = [
-    {
-      name: `new-insert`,
-      actions: [{ type: `insert`, row: { id: `two`, value: 2 } }],
-    },
-    {
-      name: `delete-reinsert`,
-      actions: [
-        { type: `delete`, id: `one` },
-        { type: `insert`, row: { id: `one`, value: 1 } },
-        { type: `insert`, row: { id: `two`, value: 2 } },
-      ],
-    },
-  ] as const
-  it.each(
-    ([`filtered`, `full`, `skip`] as const).flatMap((mode) =>
-      ([false, true] as const).flatMap((withCursor) =>
-        callbackSelectionHistories.map((history) => ({
-          mode,
-          withCursor,
-          history,
-        })),
-      ),
-    ),
-  )(
-    `does not reselect callback rows after $history.name: $mode, cursor=$withCursor`,
-    async ({ mode, withCursor, history }) => {
-      let operations!: Parameters<SyncConfig<SnapshotRow, string>[`sync`]>[0]
-      const collection = createCollection<SnapshotRow, string>({
-        id: `snapshot-callback-selection-${mode}-${withCursor}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.begin()
-            sync.write({ type: `insert`, value: { id: `one`, value: 1 } })
-            sync.commit()
-            sync.markReady()
-            return { loadSubset: () => true, unloadSubset: () => {} }
-          },
-        },
-      })
-      const index = collection.createIndex((row) => row.value, {
-        indexType: BTreeIndex,
-      })
-      const orderBy = valueOrderBy()
-      const batches: Array<Array<string>> = []
-      const visible = new Set<string>()
-      const invalidChanges: Array<string> = []
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          const batch = changes.map(({ type, key }) => `${type}:${key}`)
-          for (const change of changes) {
-            if (change.type === `insert`) {
-              if (visible.has(String(change.key)))
-                invalidChanges.push(`duplicate insert:${change.key}`)
-              visible.add(String(change.key))
-            } else if (change.type === `delete`) {
-              if (!visible.delete(String(change.key)))
-                invalidChanges.push(`delete absent:${change.key}`)
-            }
-          }
-          if (batch.length > 0) batches.push(batch)
-        },
-        { includeInitialState: mode === `skip` ? false : undefined },
-      )
-      subscription.setOrderByIndex(index)
-      try {
-        if (mode === `full`) subscription.requestSnapshot()
-        else
-          subscription.requestSnapshot({
-            where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
-          })
-        // The first snapshot selects the sole source row. From here the model
-        // folds source actions without reading subscription tracking state.
-        const expectedSource = new Map<string, SnapshotRow>([
-          [`one`, { id: `one`, value: 1 }],
-        ])
-        const expectedVisible = new Set(expectedSource.keys())
-        const expectedBatches = [[`insert:one`]]
-        expect(batches).toEqual(expectedBatches)
-        let retainedAfterDelete: number | undefined
-        for (const action of history.actions) {
-          operations.begin()
-          if (action.type === `delete`) {
-            expectedSource.delete(action.id)
-            expectedVisible.delete(action.id)
-            expectedBatches.push([`delete:${action.id}`])
-            operations.write({ type: `delete`, key: action.id })
-          } else {
-            expectedSource.set(action.row.id, action.row)
-            expectedVisible.add(action.row.id)
-            expectedBatches.push([`insert:${action.row.id}`])
-            operations.write({ type: `insert`, value: action.row })
-          }
-          await operations.commit()
-          expect(batches).toEqual(expectedBatches)
-          if (action.type === `delete`) {
-            retainedAfterDelete = (
-              subscription as unknown as { sentKeys: ReadonlySet<string> }
-            ).sentKeys.size
-          }
-        }
-        const nextOrdered = [...expectedSource.values()]
-          .sort((left, right) => left.value - right.value)
-          .find(({ id }) => !expectedVisible.has(id))
-        if (nextOrdered) {
-          expectedVisible.add(nextOrdered.id)
-          expectedBatches.push([`insert:${nextOrdered.id}`])
-        }
-        subscription.requestLimitedSnapshot({
-          orderBy,
-          limit: 1,
-          ...(withCursor ? { minValues: [1] } : {}),
-        })
-
-        expect.soft(batches).toEqual(expectedBatches)
-        expect.soft(invalidChanges).toEqual([])
-        expect([...visible].sort()).toEqual([...expectedVisible].sort())
-        if (retainedAfterDelete !== undefined)
-          expect.soft(retainedAfterDelete).toBe(0)
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // Selected keys and provider coverage answer different questions. A key
-  // delivered by a callback must not be selected again, but it does not prove
-  // that every lower-ranked provider row was fetched. These two legal histories
-  // challenge both directions: a sparse callback leaves a lower rank unseen,
-  // and an ordered callback may reenter before its outer request acquires a
-  // provider page. The plain remote array is the independent source model; the
-  // controlled adapter honors a key cursor when supplied and otherwise
-  // returns exactly the requested offset page. After a bounded sequence of
-  // requests, every remote key must be public once.
-  it.each(
-    ([undefined, false] as const).flatMap((includeInitialState) =>
-      ([`sparse-callback`, `ordered-reentry`] as const).flatMap((history) =>
-        ([false, true] as const).map((withCursor) => ({
-          includeInitialState,
-          history,
-          withCursor,
-        })),
-      ),
-    ),
-  )(
-    `loads unseen ordered rows after $history, includeInitialState=$includeInitialState, cursor=$withCursor`,
-    async ({ includeInitialState, history, withCursor }) => {
-      type ProviderRow = { id: string; value: number }
-      const remote: Array<ProviderRow> = [
-        { id: `one`, value: 1 },
-        { id: `two`, value: 2 },
-        { id: `three`, value: 3 },
-      ]
-      const initial =
-        history === `ordered-reentry` ? remote.slice(0, 2) : remote.slice(0, 1)
-      let operations!: Parameters<SyncConfig<ProviderRow, string>[`sync`]>[0]
-      const requests: Array<LoadSubsetOptions> = []
-      const collection = createCollection<ProviderRow, string>({
-        id: `snapshot-selection-provider-${history}-${includeInitialState}-${withCursor}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.begin()
-            for (const value of initial) sync.write({ type: `insert`, value })
-            sync.commit()
-            sync.markReady()
-            return {
-              loadSubset: (options) => {
-                requests.push(options)
-                if (options.orderBy) {
-                  const cursorKey = options.cursor?.lastKey
-                  const start =
-                    cursorKey === undefined
-                      ? (options.offset ?? 0)
-                      : remote.findIndex(({ id }) => id === cursorKey) + 1
-                  const page = remote.slice(
-                    start,
-                    options.limit === undefined
-                      ? undefined
-                      : start + options.limit,
-                  )
-                  const missing = page.filter(({ id }) => !collection.has(id))
-                  if (missing.length > 0) {
-                    operations.begin()
-                    for (const value of missing)
-                      operations.write({ type: `insert`, value })
-                    operations.commit()
-                  }
-                }
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const index = collection.createIndex((row) => row.value, {
-        indexType: BTreeIndex,
-      })
-      const orderBy = valueOrderBy()
-      const visible = new Map<string, ProviderRow>()
-      const violations: Array<string> = []
-      let reentered = false
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            if (change.type === `delete`) {
-              if (!visible.delete(String(change.key)))
-                violations.push(`delete absent:${change.key}`)
-            } else {
-              if (change.type === `insert` && visible.has(String(change.key)))
-                violations.push(`duplicate insert:${change.key}`)
-              visible.set(String(change.key), change.value)
-            }
-          }
-          if (
-            history === `ordered-reentry` &&
-            !reentered &&
-            changes.some(({ type, key }) => type === `insert` && key === `one`)
-          ) {
-            reentered = true
-            subscription.requestLimitedSnapshot({
-              orderBy,
-              limit: 1,
-              ...(withCursor ? { minValues: [0] } : {}),
-            })
-          }
-        },
-        { includeInitialState },
-      )
-      subscription.setOrderByIndex(index)
-      try {
-        if (history === `sparse-callback`) {
-          subscription.requestSnapshot({
-            where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
-          })
-          operations.begin()
-          operations.write({ type: `insert`, value: remote[2]! })
-          await operations.commit()
-        }
-        for (const expectedRow of remote) {
-          subscription.requestLimitedSnapshot({
-            orderBy,
-            limit: 1,
-            ...(withCursor ? { minValues: [0] } : {}),
-          })
-          expect(visible.has(expectedRow.id)).toBe(true)
-        }
-        await flushPromises()
-
-        const orderedRequests = requests.filter(
-          ({ orderBy: requestedOrder }) => requestedOrder !== undefined,
-        )
-        expect(orderedRequests.length).toBeGreaterThan(0)
-        expect(
-          orderedRequests.every(({ limit }) =>
-            withCursor ? limit === undefined : limit !== undefined,
-          ),
-        ).toBe(true)
-        expect(violations).toEqual([])
-        expect([...visible.keys()].sort()).toEqual(
-          remote.map(({ id }) => id).sort(),
-        )
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A cursor expression alone does not move an offset-only provider. Here the
-  // cursor value is just before the last remote row, while the Collection has
-  // only the first row. The plain remote array defines the expected target.
-  // An adapter that ignores cursor expressions returns an offset page, so a
-  // finite prefix based only on local selections cannot guarantee progress.
-  it.each(
-    ([undefined, false] as const).flatMap((includeInitialState) =>
-      [3, 7].map((rowCount) => ({ includeInitialState, rowCount })),
-    ),
-  )(
-    `loads a high cursor boundary through an offset provider, includeInitialState=$includeInitialState, rows=$rowCount`,
-    async ({ includeInitialState, rowCount }) => {
-      type ProviderRow = { id: number; value: number }
-      const remote = Array.from({ length: rowCount }, (_, index) => ({
-        id: index + 1,
-        value: index + 1,
-      }))
-      let operations!: Parameters<SyncConfig<ProviderRow, number>[`sync`]>[0]
-      const requests: Array<{ offset?: number; limit?: number }> = []
-      const collection = createCollection<ProviderRow, number>({
-        id: `snapshot-high-cursor-offset-${includeInitialState}-${rowCount}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.begin()
-            sync.write({ type: `insert`, value: remote[0]! })
-            sync.commit()
-            sync.markReady()
-            return {
-              loadSubset: (options) => {
-                requests.push(options)
-                const start = options.offset ?? 0
-                const page = remote.slice(
-                  start,
-                  start + (options.limit ?? remote.length),
-                )
-                const missing = page.filter(({ id }) => !collection.has(id))
-                if (missing.length > 0) {
-                  operations.begin()
-                  for (const value of missing)
-                    operations.write({ type: `insert`, value })
-                  operations.commit()
-                }
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const index = collection.createIndex((row) => row.value, {
-        indexType: BTreeIndex,
-      })
-      const visible = new Set<number>()
-      const violations: Array<string> = []
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            if (change.type === `delete`) visible.delete(change.key)
-            else {
-              if (change.type === `insert` && visible.has(change.key))
-                violations.push(`duplicate insert:${change.key}`)
-              visible.add(change.key)
-            }
-          }
-        },
-        { includeInitialState },
-      )
-      subscription.setOrderByIndex(index)
-      try {
-        subscription.requestLimitedSnapshot({
-          orderBy: valueOrderBy(),
-          limit: 1,
-          minValues: [rowCount - 1],
-        })
-        await flushPromises()
-
-        expect(requests).toHaveLength(1)
-        expect(requests[0]).toMatchObject({ offset: 0 })
-        expect(requests[0]?.limit).toBeUndefined()
-        expect(visible.has(remote.at(-1)!.id)).toBe(true)
-        expect(violations).toEqual([])
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A provider page is ranked in authoritative source state, while the local
-  // Collection is an optimistic projection of it. A pending delete or update
-  // can hide a source row without reserving its key for this subscriber. The
-  // plain remote array and the pending local changes define the next visible
-  // rank independently of the subscription's request arithmetic. At request
-  // submission, its provider page must reach that rank. A source commit may
-  // remain queued behind the optimistic transaction, so this cut judges the
-  // request rather than claiming that the page is already public.
-  it.each(
-    ([`delete`, `update-out-of-filter`] as const).flatMap((mutation) =>
-      [1, 2].map((hiddenCount) => ({ mutation, hiddenCount })),
-    ),
-  )(
-    `loads past $hiddenCount pending optimistic $mutation row(s)`,
-    async ({ mutation, hiddenCount }) => {
-      type ProviderRow = { id: number; value: number; status: string }
-      const remote = [1, 2, 3].map((id) => ({
-        id,
-        value: id,
-        status: `visible`,
-      }))
-      const heldMutation = createDeferred<void>()
-      const delivered = new Set<number>()
-      const requests: Array<LoadSubsetOptions> = []
-      let operations!: Parameters<SyncConfig<ProviderRow, number>[`sync`]>[0]
-      const collection = createCollection<ProviderRow, number>({
-        id: `snapshot-optimistic-prefix-${mutation}-${hiddenCount}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        onDelete: async () => heldMutation.promise,
-        onUpdate: async () => heldMutation.promise,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.markReady()
-            return {
-              loadSubset: (options) => {
-                requests.push(options)
-                const start = options.offset ?? 0
-                const page = remote.slice(
-                  start,
-                  options.limit === undefined
-                    ? undefined
-                    : start + options.limit,
-                )
-                const fresh = page.filter(({ id }) => !delivered.has(id))
-                if (fresh.length > 0) {
-                  operations.begin()
-                  for (const row of fresh) {
-                    delivered.add(row.id)
-                    operations.write({ type: `insert`, value: row })
-                  }
-                  return operations.commit(options.signal)
-                }
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const index = collection.createIndex((row) => row.value, {
-        indexType: BTreeIndex,
-      })
-      const visible = new Set<number>()
-      const invalidChanges: Array<string> = []
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            if (change.type === `delete`) {
-              if (!visible.delete(change.key))
-                invalidChanges.push(`delete absent:${change.key}`)
-            } else {
-              if (change.type === `insert` && visible.has(change.key))
-                invalidChanges.push(`duplicate insert:${change.key}`)
-              visible.add(change.key)
-            }
-          }
-        },
-        mutation === `update-out-of-filter`
-          ? {
-              whereExpression: new Func(`eq`, [
-                new PropRef([`status`]),
-                new Value(`visible`),
-              ]),
-            }
-          : undefined,
-      )
-      subscription.setOrderByIndex(index)
-      try {
-        subscription.requestLimitedSnapshot({
-          orderBy: valueOrderBy(),
-          limit: hiddenCount,
-        })
-        expect([...visible].sort()).toEqual(
-          remote.slice(0, hiddenCount).map(({ id }) => id),
-        )
-        for (const { id } of remote.slice(0, hiddenCount)) {
-          if (mutation === `delete`) collection.delete(id)
-          else
-            collection.update(id, (draft) => {
-              draft.status = `hidden`
-            })
-        }
-        expect(visible.size).toBe(0)
-        expect(collection._optimisticOverlaySize()).toBe(hiddenCount)
-
-        subscription.requestLimitedSnapshot({
-          orderBy: valueOrderBy(),
-          limit: 1,
-        })
-        const nextRequest = requests.at(-1)!
-        const start = nextRequest.offset ?? 0
-        const requested = remote.slice(
-          start,
-          nextRequest.limit === undefined
-            ? undefined
-            : start + nextRequest.limit,
-        )
-        expect(invalidChanges).toEqual([])
-        expect(requests).toHaveLength(2)
-        expect(requested.map(({ id }) => id)).toContain(remote[hiddenCount]!.id)
-      } finally {
-        heldMutation.resolve()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A callback insertion is public before user code runs. If that code asks
-  // for the next local ordered row, the callback key is excluded and another
-  // eligible key still advances selection. This crosses the positive and
-  // negative halves of the law at the callback observation cut.
-  it.each([undefined, false] as const)(
-    `selects an unseen row during a source callback, includeInitialState=%s`,
-    async (includeInitialState) => {
-      type SelectionRow = { id: string; value: number }
-      let operations!: Parameters<SyncConfig<SelectionRow, string>[`sync`]>[0]
-      const collection = createCollection<SelectionRow, string>({
-        id: `snapshot-source-callback-reentry-${includeInitialState}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.begin()
-            sync.write({ type: `insert`, value: { id: `one`, value: 1 } })
-            sync.write({ type: `insert`, value: { id: `three`, value: 3 } })
-            sync.commit()
-            sync.markReady()
-            return { loadSubset: () => true, unloadSubset: () => {} }
-          },
-        },
-      })
-      const index = collection.createIndex((row) => row.value, {
-        indexType: BTreeIndex,
-      })
-      const orderBy = valueOrderBy()
-      const batches: Array<Array<string>> = []
-      const visible = new Set<string>()
-      const violations: Array<string> = []
-      let reentered = false
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          if (changes.length > 0)
-            batches.push(changes.map(({ type, key }) => `${type}:${key}`))
-          for (const change of changes) {
-            if (change.type === `insert`) {
-              if (visible.has(String(change.key)))
-                violations.push(`duplicate insert:${change.key}`)
-              visible.add(String(change.key))
-            } else if (change.type === `delete`) {
-              visible.delete(String(change.key))
-            }
-          }
-          if (
-            !reentered &&
-            changes.some(({ type, key }) => type === `insert` && key === `two`)
-          ) {
-            reentered = true
-            subscription.requestLimitedSnapshot({
-              orderBy,
-              limit: 1,
-              minValues: [1],
-            })
-          }
-        },
-        { includeInitialState },
-      )
-      subscription.setOrderByIndex(index)
-      try {
-        subscription.requestSnapshot({
-          where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
-        })
-        operations.begin()
-        operations.write({ type: `insert`, value: { id: `two`, value: 2 } })
-        await operations.commit()
-
-        // The independent fold is: select one, publish source two, then choose
-        // the lowest ordered source row absent from {one, two}, namely three.
-        expect(reentered).toBe(true)
-        expect(batches).toEqual([
-          [`insert:one`],
-          [`insert:two`],
-          [`insert:three`],
-        ])
-        expect(violations).toEqual([])
-        expect([...visible].sort()).toEqual([`one`, `three`, `two`])
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
   it(`reconstructs every bounded deferral cleanup history`, () => {
     expect(deferralCleanupHistories).toHaveLength(32)
     expect(new Set(deferralCleanupHistories.map(({ name }) => name)).size).toBe(
       32,
     )
   })
-
   it.each(deferralCleanupHistories)(
     `publishes independent batches after deferral cleanup: $name`,
     async ({ commands }) => {
       await runDeferralCleanupHistory(commands)
     },
   )
-
   it.each(
     ([`initial`, `replay`, `restart`] as const).flatMap((phase) =>
       [1, 2].flatMap((demandCount) =>
@@ -2338,118 +1666,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       )
     },
   )
-
-  it.each([`row`, `status`, `error`, `acquisition`] as const)(
-    `rejects a terminal %s observation with an unchanged-retired neighbor`,
-    (fault) => {
-      const retired: TerminalPublicationSnapshot = {
-        batches: [],
-        visible: [{ id: `c`, value: 42 }],
-        statusEvents: [],
-        errors: [],
-        status: `ready`,
-        subscriberCount: 0,
-        attempts: 2,
-        unloads: [0, 1],
-        syncRuns: 1,
-      }
-      const actual: TerminalPublicationSnapshot = {
-        ...retired,
-        batches: [],
-        visible: retired.visible.map(cloneRow),
-        statusEvents: [],
-        errors: [],
-        unloads: [...retired.unloads],
-      }
-      assertTerminalPublication(actual, retired)
-      if (fault === `row`)
-        actual.batches.push([
-          { type: `insert`, key: `a`, value: { id: `a`, value: 9 } },
-        ])
-      if (fault === `status`)
-        actual.statusEvents.push({
-          previousStatus: `ready`,
-          status: `loadingSubset`,
-        })
-      if (fault === `error`) actual.errors.push(new Error(`late transport`))
-      if (fault === `acquisition`) actual.attempts++
-      expect(() => assertTerminalPublication(actual, retired)).toThrowError(
-        /expected/,
-      )
-    },
-  )
-
-  it.each(
-    ([undefined, false] as const).flatMap((includeInitialState) =>
-      ([`update`, `delete`, `truncate`] as const).map((operation) => ({
-        includeInitialState,
-        operation,
-      })),
-    ),
-  )(
-    `distinguishes unseen-row $operation with includeInitialState=$includeInitialState`,
-    async ({ includeInitialState, operation }) => {
-      let operations!: SyncOperations
-      const collection = createCollection<Row, RowKey>({
-        getKey: ({ id }) => id,
-        startSync: true,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.begin()
-            sync.write({ type: `insert`, value: { id: `d`, value: 0 } })
-            sync.commit()
-            sync.markReady()
-          },
-        },
-      })
-      const changes: Array<PublicationChange> = []
-      const subscription = collection.subscribeChanges(
-        (batch) => {
-          for (const change of batch) {
-            changes.push({
-              type: change.type,
-              key: change.value.id,
-              value: cloneRow(change.value),
-              ...(change.previousValue
-                ? { previousValue: cloneRow(change.previousValue) }
-                : {}),
-            })
-          }
-        },
-        { includeInitialState },
-      )
-      try {
-        expect(changes).toEqual([])
-        operations.begin()
-        if (operation === `truncate`) operations.truncate()
-        else if (operation === `delete`)
-          operations.write({ type: `delete`, key: `d` })
-        else operations.write({ type: `update`, value: { id: `d`, value: 4 } })
-        await operations.commit()
-        expect(changes).toEqual(
-          operation === `update`
-            ? [
-                {
-                  type: includeInitialState === false ? `update` : `insert`,
-                  key: `d`,
-                  value: { id: `d`, value: 4 },
-                  ...(includeInitialState === false
-                    ? { previousValue: { id: `d`, value: 0 } }
-                    : {}),
-                },
-              ]
-            : includeInitialState === false
-              ? [{ type: `delete`, key: `d`, value: { id: `d`, value: 0 } }]
-              : [],
-        )
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
   it(`keeps raw source updates after retiring the final replay owner`, async () => {
     await runPublicationHistory([
       { type: `cleanup` },
@@ -2466,7 +1682,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `unsubscribe` },
     ])
   })
-
   it(`keeps raw truncate deletes after retiring the final replay owner`, async () => {
     await runPublicationHistory([
       {
@@ -2492,7 +1707,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `truncate` },
     ])
   })
-
   it(`records requested snapshot rows before a canceled reset`, async () => {
     await runPublicationHistory([
       { type: `request`, demand: `b` },
@@ -2510,7 +1724,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `release`, demand: `b` },
     ])
   })
-
   it(`does not invent a publication for an unchanged private row`, async () => {
     await runPublicationHistory([
       { type: `request`, demand: `a` },
@@ -2522,7 +1735,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `unsubscribe` },
     ])
   })
-
   it.each(
     ([`none`, `retained`, `refreshed`, `new`] as const).flatMap((baseline) =>
       ([`delete`, `empty`, `same`, `other`] as const).map((reset) => ({
@@ -2559,7 +1771,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       ])
     },
   )
-
   it(`reconciles a repeated reset after the last replay owner aborts`, async () => {
     await runPublicationHistory([
       { type: `source`, key: `a`, action: `upsert`, value: 0 },
@@ -2577,7 +1788,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `cleanup` },
     ])
   })
-
   it(`keeps independent source rows when a replay settles after redundant restart calls`, async () => {
     await runPublicationHistory([
       { type: `source`, key: `a`, action: `upsert`, value: 0 },
@@ -2612,68 +1822,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `cleanup` },
     ])
   })
-
-  it.each([
-    `none`,
-    `missing`,
-    `duplicate`,
-    `value`,
-    `previous-value`,
-    `split`,
-    `merge`,
-    `same-key-order`,
-  ] as const)(
-    `normalizes only independent change order with corruption: %s`,
-    (corruption) => {
-      const baseline: Array<Array<PublicationChange>> = [
-        [
-          {
-            type: `update`,
-            key: `a`,
-            value: { id: `a`, value: 1 },
-            previousValue: { id: `a`, value: 0 },
-          },
-          { type: `delete`, key: `b`, value: { id: `b`, value: 0 } },
-          { type: `insert`, key: `c`, value: { id: `c`, value: 1 } },
-        ],
-        [
-          {
-            type: `update`,
-            key: `a`,
-            value: { id: `a`, value: 2 },
-            previousValue: { id: `a`, value: 1 },
-          },
-          { type: `delete`, key: `a`, value: { id: `a`, value: 2 } },
-        ],
-      ]
-      const permutations = [
-        [0, 1, 2],
-        [0, 2, 1],
-        [1, 0, 2],
-        [1, 2, 0],
-        [2, 0, 1],
-        [2, 1, 0],
-      ]
-      for (const permutation of permutations) {
-        const candidate = clonePublicationBatches(baseline)
-        const changes = candidate[0]!
-        if (corruption === `value`) changes[0]!.value.value++
-        if (corruption === `previous-value`) changes[0]!.previousValue!.value++
-        candidate[0] = permutation.map((index) => changes[index]!)
-        if (corruption === `missing`) candidate[0].pop()
-        if (corruption === `duplicate`) candidate[0].push(changes[0]!)
-        if (corruption === `split`)
-          candidate.splice(1, 0, candidate[0].splice(1))
-        if (corruption === `merge`) candidate.splice(0, 2, candidate.flat())
-        if (corruption === `same-key-order`) candidate[1]!.reverse()
-        const actual = normalizePublicationOrder(candidate)
-        const expected = normalizePublicationOrder(baseline)
-        if (corruption === `none`) expect(actual).toEqual(expected)
-        else expect(actual).not.toEqual(expected)
-      }
-    },
-  )
-
   it(`defines all 288 unique row-publication lifecycle cells`, () => {
     expect(publicationProductCases).toHaveLength(288)
     expect(new Set(publicationProductCases.map(({ name }) => name)).size).toBe(
@@ -2684,38 +1832,32 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
     expect(replacementRetirementCases).toHaveLength(46)
     expect(publicationControlCases).toHaveLength(204)
   })
-
   it.each(publicationControlSlices)(
     `matches row publications for lifecycle control cells $name`,
     async ({ scenarios }) => {
       expectNoPublicationMismatches(await runPublicationProduct(scenarios))
     },
   )
-
   it(`preserves independent source work when a successful replay publishes`, async () => {
     expectNoPublicationMismatches(
       await runPublicationProduct(successfulReplacementCases),
     )
   })
-
   it(`publishes complete replacement batches regardless of independent key order`, async () => {
     expectNoPublicationMismatches(
       await runPublicationProduct(replacementOrderingCases),
     )
   })
-
   it(`retires incomplete or failed replacement without changing independent public rows`, async () => {
     expectNoPublicationMismatches(
       await runPublicationProduct(replacementRetirementCases),
     )
   })
-
   it(`maps every canonical green lifecycle history to public rows`, async () => {
     for (const history of greenLifecycleHistories) {
       await runPublicationHistory(history)
     }
   })
-
   it(`suppresses canceled source writes when a released acquisition settles`, async () => {
     await runPublicationHistory(
       [
@@ -2737,7 +1879,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`publishes an authoritative truncate after the final demand is released`, async () => {
     await runPublicationHistory([
       { type: `request`, demand: `b` },
@@ -2753,7 +1894,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `unsubscribe` },
     ])
   })
-
   it(`publishes independent source changes with a successful replay`, async () => {
     await runPublicationHistory(
       [
@@ -2782,7 +1922,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`does not republish a row already delivered by a live change`, async () => {
     await runPublicationHistory(
       [
@@ -2799,7 +1938,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`suppresses canceled source writes when an aborted acquisition settles`, async () => {
     await runPublicationHistory(
       [
@@ -2820,7 +1958,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`keeps later source changes private after a failed replay`, async () => {
     await runPublicationHistory([
       { type: `request`, demand: `a` },
@@ -2842,7 +1979,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `source`, key: `b`, action: `upsert`, value: 51 },
     ])
   })
-
   // Releasing the final owner retires a replay that has not failed; it
   // publishes the rows it holds, so none of these rows stays stale.
   it.each([
@@ -2967,7 +2103,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       await runPublicationHistory(history)
     },
   )
-
   // Law 9: a failed replay stays private until an authoritative replay
   // succeeds, even after its failed owner is released and nothing remains.
   it(`keeps a failed replay private when its final owner releases`, async () => {
@@ -2993,7 +2128,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `release`, demand: `a` },
     ])
   })
-
   it(`retires failed private replacement rows when its final owner releases`, async () => {
     await runPublicationHistory(
       [
@@ -3024,7 +2158,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`does not delete an independent public row when releasing a restarted demand`, async () => {
     await runPublicationHistory(
       [
@@ -3039,7 +2172,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`keeps a restarted snapshot private while canceled replay work settles`, async () => {
     // Seed 2018803696, path 65:10:2:10:13:12:12:0:0:0. A canceled-only
     // truncate does not discharge the earlier replay's publication wait.
@@ -3073,7 +2205,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it(`matches retained rows across an empty restart and canceled-only truncates`, async () => {
     // Seed 2018803696, path 65:29:0:0:0 exposed the model's missing retained-row
     // deletion: an authoritative empty reset is not limited to resident rows.
@@ -3111,7 +2242,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { continueAfterMismatch: true },
     )
   })
-
   it.each(
     [false, true].flatMap((restart) =>
       [false, true].map((canceledOwner) => ({ restart, canceledOwner })),
@@ -3146,7 +2276,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       ])
     },
   )
-
   it.each(
     [false, true].flatMap((canceledOwner) =>
       (
@@ -3177,7 +2306,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       ])
     },
   )
-
   it.each([
     undefined,
     { id: `a`, value: 0 },
@@ -3199,7 +2327,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       )
     },
   )
-
   it(`resets retained rows after no-op cleanup and release commands`, async () => {
     // Seed 1657005, path 164:18 after removing the visible-row request omission.
     await runPublicationHistory([
@@ -3223,7 +2350,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `unsubscribe` },
     ])
   })
-
   it(`resets retained rows after the last replay owner retires`, async () => {
     // Seed 333468655, path 59:13:0:0:0.
     await runPublicationHistory([
@@ -3246,7 +2372,6 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `unsubscribe` },
     ])
   })
-
   it(`does not restore source rows when the final replay owner retires`, async () => {
     // Seed 1337491191, path 591:20:1:8:8:8:7:7.
     await runPublicationHistory([
@@ -3262,10 +2387,8 @@ describe(`CollectionSubscription lifecycle publication oracle`, () => {
       { type: `unsubscribe` },
     ])
   })
-
   const { multiplier, ...replay } = readOracleRunConfig()
   const runs = 60 * multiplier
-
   fcTest.prop([publicationCommandHistoryArbitrary], {
     numRuns: runs,
     seed: 1_657_005,
diff --git a/packages/db/tests/collection-subscription-lifecycle-publication-support.ts b/packages/db/tests/collection-subscription-lifecycle-publication-support.ts
new file mode 100644
index 0000000000..59950ed7b7
--- /dev/null
+++ b/packages/db/tests/collection-subscription-lifecycle-publication-support.ts
@@ -0,0 +1,76 @@
+/**
+ * Helpers shared by the row-publication oracle and its ordinary publication
+ * tests: the publication types, batch cloning and order normalization, and the
+ * terminal-snapshot assertion. The law lives in
+ * collection-subscription-lifecycle-publication-oracle.property.test.ts.
+ */
+import { expect } from 'vitest'
+import type { SyncConfig } from '../src/types.js'
+import type { DemandName } from './collection-subscription-lifecycle-grammar-oracle.js'
+
+export type RowKey = DemandName | `c` | `d`
+
+export type Row = { id: RowKey; value: number }
+
+export type PublicationChange = {
+  type: `insert` | `update` | `delete`
+  key: RowKey
+  value: Row
+  previousValue?: Row
+}
+
+export type PublicationPhase =
+  `public` | `private-pending` | `private-settling` | `private-failed`
+
+export function cloneRow(row: Row): Row {
+  return { id: row.id, value: row.value }
+}
+
+export function clonePublicationBatches(
+  batches: ReadonlyArray<ReadonlyArray<PublicationChange>>,
+): Array<Array<PublicationChange>> {
+  return batches.map((batch) =>
+    batch.map((change) => ({
+      ...change,
+      value: cloneRow(change.value),
+      ...(change.previousValue
+        ? { previousValue: cloneRow(change.previousValue) }
+        : {}),
+    })),
+  )
+}
+
+export function normalizePublicationOrder(
+  batches: ReadonlyArray<ReadonlyArray<PublicationChange>>,
+): Array<Array<PublicationChange>> {
+  // Distinct keys have no canonical delivery order within one callback.
+  // Keep callback boundaries and stable order among changes to the same key.
+  return clonePublicationBatches(batches).map((batch) =>
+    batch.sort((left, right) => left.key.localeCompare(right.key)),
+  )
+}
+
+export type SyncOperations = Parameters<SyncConfig<Row, RowKey>[`sync`]>[0]
+
+export type TerminalPublicationSnapshot = {
+  batches: Array<Array<PublicationChange>>
+  visible: Array<Row>
+  statusEvents: Array<{ previousStatus: string; status: string }>
+  errors: Array<unknown>
+  status: string
+  subscriberCount: number
+  attempts: number
+  unloads: Array<number>
+  syncRuns: number
+}
+
+export function assertTerminalPublication(
+  actual: TerminalPublicationSnapshot,
+  retired: TerminalPublicationSnapshot,
+): void {
+  expect(actual).toEqual(retired)
+  expect(actual.subscriberCount).toBe(0)
+  actual.errors.forEach((error, index) =>
+    expect(error).toBe(retired.errors[index]),
+  )
+}
diff --git a/packages/db/tests/collection-subscription-lifecycle-publication.test.ts b/packages/db/tests/collection-subscription-lifecycle-publication.test.ts
new file mode 100644
index 0000000000..289b1b5de7
--- /dev/null
+++ b/packages/db/tests/collection-subscription-lifecycle-publication.test.ts
@@ -0,0 +1,868 @@
+/**
+ * Ordinary publication tests: literal batch, reselection, and normalization
+ * cases. The row-publication law lives in
+ * collection-subscription-lifecycle-publication-oracle.property.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { Func, PropRef, Value } from '../src/query/ir.js'
+import { valueOrderBy } from './collection-subscription-ordered-fixture.js'
+import { flushPromises } from './utils.js'
+import {
+  assertTerminalPublication,
+  clonePublicationBatches,
+  cloneRow,
+  normalizePublicationOrder,
+} from './collection-subscription-lifecycle-publication-support'
+import type {
+  PublicationChange,
+  Row,
+  RowKey,
+  SyncOperations,
+  TerminalPublicationSnapshot,
+} from './collection-subscription-lifecycle-publication-support'
+import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
+
+describe(`CollectionSubscription lifecycle publication oracle`, () => {
+  type SnapshotRow = { id: string; value: number }
+  it(`reselects a key only after its deletion and next publication`, async () => {
+    let operations!: Parameters<SyncConfig<SnapshotRow, string>[`sync`]>[0]
+    const loads: Array<{ cursor?: { lastKey?: string | number } }> = []
+    const collection = createCollection<SnapshotRow, string>({
+      id: `snapshot-selection-after-delete`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (sync) => {
+          operations = sync
+          sync.begin()
+          sync.write({ type: `insert`, value: { id: `one`, value: 1 } })
+          sync.write({ type: `insert`, value: { id: `two`, value: 2 } })
+          sync.commit()
+          sync.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const index = collection.createIndex((row) => row.value, {
+      indexType: BTreeIndex,
+    })
+    const orderBy = valueOrderBy()
+    const batches: Array<Array<string>> = []
+    const visible = new Set<string>()
+    const invalidChanges: Array<string> = []
+    const subscription = collection.subscribeChanges((changes) => {
+      const batch: Array<string> = []
+      for (const change of changes) {
+        batch.push(`${change.type}:${change.key}`)
+        if (change.type === `insert`) {
+          if (visible.has(String(change.key)))
+            invalidChanges.push(`duplicate insert:${change.key}`)
+          visible.add(String(change.key))
+        } else if (change.type === `delete`) {
+          if (!visible.delete(String(change.key)))
+            invalidChanges.push(`delete absent:${change.key}`)
+        }
+      }
+      if (batch.length > 0) batches.push(batch)
+    })
+    subscription.setOrderByIndex(index)
+    try {
+      subscription.requestSnapshot({
+        where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
+      })
+      operations.begin()
+      operations.write({ type: `delete`, key: `one` })
+      await operations.commit()
+      operations.begin()
+      operations.write({ type: `insert`, value: { id: `one`, value: 1 } })
+      await operations.commit()
+      subscription.requestLimitedSnapshot({
+        orderBy,
+        limit: 1,
+        minValues: [1],
+      })
+
+      // The independent fold is select(one), remove(one), publish(one), then
+      // select the first remaining ranked row. A permanent reservation loses
+      // the source reinsert; a missing reservation repeats it in the window.
+      expect(batches).toEqual([
+        [`insert:one`],
+        [`delete:one`],
+        [`insert:one`],
+        [`insert:two`],
+      ])
+      expect(invalidChanges).toEqual([])
+      expect([...visible].sort()).toEqual([`one`, `two`])
+      expect(loads.at(-1)).toMatchObject({ offset: 0 })
+      expect(loads.at(-1)?.cursor?.lastKey).toBeUndefined()
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+  // A subscriber's callback has already published each inserted key, whether
+  // it filters source changes or passes them through. The model keeps source
+  // rows in a plain Map and public keys in a Set. Source deletes remove public
+  // keys; source inserts add them. An ordered snapshot may choose only an
+  // absent public key. These legal histories cross callback insertion,
+  // deletion, reinsert, and local selection in every filtering mode and ordered
+  // index path. Each callback is an observation cut. Retained-key count checks
+  // the long-lived tracking cost after deletion separately.
+  const callbackSelectionHistories = [
+    {
+      name: `new-insert`,
+      actions: [{ type: `insert`, row: { id: `two`, value: 2 } }],
+    },
+    {
+      name: `delete-reinsert`,
+      actions: [
+        { type: `delete`, id: `one` },
+        { type: `insert`, row: { id: `one`, value: 1 } },
+        { type: `insert`, row: { id: `two`, value: 2 } },
+      ],
+    },
+  ] as const
+  it.each(
+    ([`filtered`, `full`, `skip`] as const).flatMap((mode) =>
+      ([false, true] as const).flatMap((withCursor) =>
+        callbackSelectionHistories.map((history) => ({
+          mode,
+          withCursor,
+          history,
+        })),
+      ),
+    ),
+  )(
+    `does not reselect callback rows after $history.name: $mode, cursor=$withCursor`,
+    async ({ mode, withCursor, history }) => {
+      let operations!: Parameters<SyncConfig<SnapshotRow, string>[`sync`]>[0]
+      const collection = createCollection<SnapshotRow, string>({
+        id: `snapshot-callback-selection-${mode}-${withCursor}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.begin()
+            sync.write({ type: `insert`, value: { id: `one`, value: 1 } })
+            sync.commit()
+            sync.markReady()
+            return { loadSubset: () => true, unloadSubset: () => {} }
+          },
+        },
+      })
+      const index = collection.createIndex((row) => row.value, {
+        indexType: BTreeIndex,
+      })
+      const orderBy = valueOrderBy()
+      const batches: Array<Array<string>> = []
+      const visible = new Set<string>()
+      const invalidChanges: Array<string> = []
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          const batch = changes.map(({ type, key }) => `${type}:${key}`)
+          for (const change of changes) {
+            if (change.type === `insert`) {
+              if (visible.has(String(change.key)))
+                invalidChanges.push(`duplicate insert:${change.key}`)
+              visible.add(String(change.key))
+            } else if (change.type === `delete`) {
+              if (!visible.delete(String(change.key)))
+                invalidChanges.push(`delete absent:${change.key}`)
+            }
+          }
+          if (batch.length > 0) batches.push(batch)
+        },
+        { includeInitialState: mode === `skip` ? false : undefined },
+      )
+      subscription.setOrderByIndex(index)
+      try {
+        if (mode === `full`) subscription.requestSnapshot()
+        else
+          subscription.requestSnapshot({
+            where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
+          })
+        // The first snapshot selects the sole source row. From here the model
+        // folds source actions without reading subscription tracking state.
+        const expectedSource = new Map<string, SnapshotRow>([
+          [`one`, { id: `one`, value: 1 }],
+        ])
+        const expectedVisible = new Set(expectedSource.keys())
+        const expectedBatches = [[`insert:one`]]
+        expect(batches).toEqual(expectedBatches)
+        let retainedAfterDelete: number | undefined
+        for (const action of history.actions) {
+          operations.begin()
+          if (action.type === `delete`) {
+            expectedSource.delete(action.id)
+            expectedVisible.delete(action.id)
+            expectedBatches.push([`delete:${action.id}`])
+            operations.write({ type: `delete`, key: action.id })
+          } else {
+            expectedSource.set(action.row.id, action.row)
+            expectedVisible.add(action.row.id)
+            expectedBatches.push([`insert:${action.row.id}`])
+            operations.write({ type: `insert`, value: action.row })
+          }
+          await operations.commit()
+          expect(batches).toEqual(expectedBatches)
+          if (action.type === `delete`) {
+            retainedAfterDelete = (
+              subscription as unknown as { sentKeys: ReadonlySet<string> }
+            ).sentKeys.size
+          }
+        }
+        const nextOrdered = [...expectedSource.values()]
+          .sort((left, right) => left.value - right.value)
+          .find(({ id }) => !expectedVisible.has(id))
+        if (nextOrdered) {
+          expectedVisible.add(nextOrdered.id)
+          expectedBatches.push([`insert:${nextOrdered.id}`])
+        }
+        subscription.requestLimitedSnapshot({
+          orderBy,
+          limit: 1,
+          ...(withCursor ? { minValues: [1] } : {}),
+        })
+
+        expect.soft(batches).toEqual(expectedBatches)
+        expect.soft(invalidChanges).toEqual([])
+        expect([...visible].sort()).toEqual([...expectedVisible].sort())
+        if (retainedAfterDelete !== undefined)
+          expect.soft(retainedAfterDelete).toBe(0)
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+  // Selected keys and provider coverage answer different questions. A key
+  // delivered by a callback must not be selected again, but it does not prove
+  // that every lower-ranked provider row was fetched. These two legal histories
+  // challenge both directions: a sparse callback leaves a lower rank unseen,
+  // and an ordered callback may reenter before its outer request acquires a
+  // provider page. The plain remote array is the independent source model; the
+  // controlled adapter honors a key cursor when supplied and otherwise
+  // returns exactly the requested offset page. After a bounded sequence of
+  // requests, every remote key must be public once.
+  it.each(
+    ([undefined, false] as const).flatMap((includeInitialState) =>
+      ([`sparse-callback`, `ordered-reentry`] as const).flatMap((history) =>
+        ([false, true] as const).map((withCursor) => ({
+          includeInitialState,
+          history,
+          withCursor,
+        })),
+      ),
+    ),
+  )(
+    `loads unseen ordered rows after $history, includeInitialState=$includeInitialState, cursor=$withCursor`,
+    async ({ includeInitialState, history, withCursor }) => {
+      type ProviderRow = { id: string; value: number }
+      const remote: Array<ProviderRow> = [
+        { id: `one`, value: 1 },
+        { id: `two`, value: 2 },
+        { id: `three`, value: 3 },
+      ]
+      const initial =
+        history === `ordered-reentry` ? remote.slice(0, 2) : remote.slice(0, 1)
+      let operations!: Parameters<SyncConfig<ProviderRow, string>[`sync`]>[0]
+      const requests: Array<LoadSubsetOptions> = []
+      const collection = createCollection<ProviderRow, string>({
+        id: `snapshot-selection-provider-${history}-${includeInitialState}-${withCursor}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.begin()
+            for (const value of initial) sync.write({ type: `insert`, value })
+            sync.commit()
+            sync.markReady()
+            return {
+              loadSubset: (options) => {
+                requests.push(options)
+                if (options.orderBy) {
+                  const cursorKey = options.cursor?.lastKey
+                  const start =
+                    cursorKey === undefined
+                      ? (options.offset ?? 0)
+                      : remote.findIndex(({ id }) => id === cursorKey) + 1
+                  const page = remote.slice(
+                    start,
+                    options.limit === undefined
+                      ? undefined
+                      : start + options.limit,
+                  )
+                  const missing = page.filter(({ id }) => !collection.has(id))
+                  if (missing.length > 0) {
+                    operations.begin()
+                    for (const value of missing)
+                      operations.write({ type: `insert`, value })
+                    operations.commit()
+                  }
+                }
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const index = collection.createIndex((row) => row.value, {
+        indexType: BTreeIndex,
+      })
+      const orderBy = valueOrderBy()
+      const visible = new Map<string, ProviderRow>()
+      const violations: Array<string> = []
+      let reentered = false
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            if (change.type === `delete`) {
+              if (!visible.delete(String(change.key)))
+                violations.push(`delete absent:${change.key}`)
+            } else {
+              if (change.type === `insert` && visible.has(String(change.key)))
+                violations.push(`duplicate insert:${change.key}`)
+              visible.set(String(change.key), change.value)
+            }
+          }
+          if (
+            history === `ordered-reentry` &&
+            !reentered &&
+            changes.some(({ type, key }) => type === `insert` && key === `one`)
+          ) {
+            reentered = true
+            subscription.requestLimitedSnapshot({
+              orderBy,
+              limit: 1,
+              ...(withCursor ? { minValues: [0] } : {}),
+            })
+          }
+        },
+        { includeInitialState },
+      )
+      subscription.setOrderByIndex(index)
+      try {
+        if (history === `sparse-callback`) {
+          subscription.requestSnapshot({
+            where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
+          })
+          operations.begin()
+          operations.write({ type: `insert`, value: remote[2]! })
+          await operations.commit()
+        }
+        for (const expectedRow of remote) {
+          subscription.requestLimitedSnapshot({
+            orderBy,
+            limit: 1,
+            ...(withCursor ? { minValues: [0] } : {}),
+          })
+          expect(visible.has(expectedRow.id)).toBe(true)
+        }
+        await flushPromises()
+
+        const orderedRequests = requests.filter(
+          ({ orderBy: requestedOrder }) => requestedOrder !== undefined,
+        )
+        expect(orderedRequests.length).toBeGreaterThan(0)
+        expect(
+          orderedRequests.every(({ limit }) =>
+            withCursor ? limit === undefined : limit !== undefined,
+          ),
+        ).toBe(true)
+        expect(violations).toEqual([])
+        expect([...visible.keys()].sort()).toEqual(
+          remote.map(({ id }) => id).sort(),
+        )
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+  // A cursor expression alone does not move an offset-only provider. Here the
+  // cursor value is just before the last remote row, while the Collection has
+  // only the first row. The plain remote array defines the expected target.
+  // An adapter that ignores cursor expressions returns an offset page, so a
+  // finite prefix based only on local selections cannot guarantee progress.
+  it.each(
+    ([undefined, false] as const).flatMap((includeInitialState) =>
+      [3, 7].map((rowCount) => ({ includeInitialState, rowCount })),
+    ),
+  )(
+    `loads a high cursor boundary through an offset provider, includeInitialState=$includeInitialState, rows=$rowCount`,
+    async ({ includeInitialState, rowCount }) => {
+      type ProviderRow = { id: number; value: number }
+      const remote = Array.from({ length: rowCount }, (_, index) => ({
+        id: index + 1,
+        value: index + 1,
+      }))
+      let operations!: Parameters<SyncConfig<ProviderRow, number>[`sync`]>[0]
+      const requests: Array<{ offset?: number; limit?: number }> = []
+      const collection = createCollection<ProviderRow, number>({
+        id: `snapshot-high-cursor-offset-${includeInitialState}-${rowCount}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.begin()
+            sync.write({ type: `insert`, value: remote[0]! })
+            sync.commit()
+            sync.markReady()
+            return {
+              loadSubset: (options) => {
+                requests.push(options)
+                const start = options.offset ?? 0
+                const page = remote.slice(
+                  start,
+                  start + (options.limit ?? remote.length),
+                )
+                const missing = page.filter(({ id }) => !collection.has(id))
+                if (missing.length > 0) {
+                  operations.begin()
+                  for (const value of missing)
+                    operations.write({ type: `insert`, value })
+                  operations.commit()
+                }
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const index = collection.createIndex((row) => row.value, {
+        indexType: BTreeIndex,
+      })
+      const visible = new Set<number>()
+      const violations: Array<string> = []
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            if (change.type === `delete`) visible.delete(change.key)
+            else {
+              if (change.type === `insert` && visible.has(change.key))
+                violations.push(`duplicate insert:${change.key}`)
+              visible.add(change.key)
+            }
+          }
+        },
+        { includeInitialState },
+      )
+      subscription.setOrderByIndex(index)
+      try {
+        subscription.requestLimitedSnapshot({
+          orderBy: valueOrderBy(),
+          limit: 1,
+          minValues: [rowCount - 1],
+        })
+        await flushPromises()
+
+        expect(requests).toHaveLength(1)
+        expect(requests[0]).toMatchObject({ offset: 0 })
+        expect(requests[0]?.limit).toBeUndefined()
+        expect(visible.has(remote.at(-1)!.id)).toBe(true)
+        expect(violations).toEqual([])
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+  // A provider page is ranked in authoritative source state, while the local
+  // Collection is an optimistic projection of it. A pending delete or update
+  // can hide a source row without reserving its key for this subscriber. The
+  // plain remote array and the pending local changes define the next visible
+  // rank independently of the subscription's request arithmetic. At request
+  // submission, its provider page must reach that rank. A source commit may
+  // remain queued behind the optimistic transaction, so this cut judges the
+  // request rather than claiming that the page is already public.
+  it.each(
+    ([`delete`, `update-out-of-filter`] as const).flatMap((mutation) =>
+      [1, 2].map((hiddenCount) => ({ mutation, hiddenCount })),
+    ),
+  )(
+    `loads past $hiddenCount pending optimistic $mutation row(s)`,
+    async ({ mutation, hiddenCount }) => {
+      type ProviderRow = { id: number; value: number; status: string }
+      const remote = [1, 2, 3].map((id) => ({
+        id,
+        value: id,
+        status: `visible`,
+      }))
+      const heldMutation = createDeferred<void>()
+      const delivered = new Set<number>()
+      const requests: Array<LoadSubsetOptions> = []
+      let operations!: Parameters<SyncConfig<ProviderRow, number>[`sync`]>[0]
+      const collection = createCollection<ProviderRow, number>({
+        id: `snapshot-optimistic-prefix-${mutation}-${hiddenCount}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        onDelete: async () => heldMutation.promise,
+        onUpdate: async () => heldMutation.promise,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.markReady()
+            return {
+              loadSubset: (options) => {
+                requests.push(options)
+                const start = options.offset ?? 0
+                const page = remote.slice(
+                  start,
+                  options.limit === undefined
+                    ? undefined
+                    : start + options.limit,
+                )
+                const fresh = page.filter(({ id }) => !delivered.has(id))
+                if (fresh.length > 0) {
+                  operations.begin()
+                  for (const row of fresh) {
+                    delivered.add(row.id)
+                    operations.write({ type: `insert`, value: row })
+                  }
+                  return operations.commit(options.signal)
+                }
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const index = collection.createIndex((row) => row.value, {
+        indexType: BTreeIndex,
+      })
+      const visible = new Set<number>()
+      const invalidChanges: Array<string> = []
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            if (change.type === `delete`) {
+              if (!visible.delete(change.key))
+                invalidChanges.push(`delete absent:${change.key}`)
+            } else {
+              if (change.type === `insert` && visible.has(change.key))
+                invalidChanges.push(`duplicate insert:${change.key}`)
+              visible.add(change.key)
+            }
+          }
+        },
+        mutation === `update-out-of-filter`
+          ? {
+              whereExpression: new Func(`eq`, [
+                new PropRef([`status`]),
+                new Value(`visible`),
+              ]),
+            }
+          : undefined,
+      )
+      subscription.setOrderByIndex(index)
+      try {
+        subscription.requestLimitedSnapshot({
+          orderBy: valueOrderBy(),
+          limit: hiddenCount,
+        })
+        expect([...visible].sort()).toEqual(
+          remote.slice(0, hiddenCount).map(({ id }) => id),
+        )
+        for (const { id } of remote.slice(0, hiddenCount)) {
+          if (mutation === `delete`) collection.delete(id)
+          else
+            collection.update(id, (draft) => {
+              draft.status = `hidden`
+            })
+        }
+        expect(visible.size).toBe(0)
+        expect(collection._optimisticOverlaySize()).toBe(hiddenCount)
+
+        subscription.requestLimitedSnapshot({
+          orderBy: valueOrderBy(),
+          limit: 1,
+        })
+        const nextRequest = requests.at(-1)!
+        const start = nextRequest.offset ?? 0
+        const requested = remote.slice(
+          start,
+          nextRequest.limit === undefined
+            ? undefined
+            : start + nextRequest.limit,
+        )
+        expect(invalidChanges).toEqual([])
+        expect(requests).toHaveLength(2)
+        expect(requested.map(({ id }) => id)).toContain(remote[hiddenCount]!.id)
+      } finally {
+        heldMutation.resolve()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+  // A callback insertion is public before user code runs. If that code asks
+  // for the next local ordered row, the callback key is excluded and another
+  // eligible key still advances selection. This crosses the positive and
+  // negative halves of the law at the callback observation cut.
+  it.each([undefined, false] as const)(
+    `selects an unseen row during a source callback, includeInitialState=%s`,
+    async (includeInitialState) => {
+      type SelectionRow = { id: string; value: number }
+      let operations!: Parameters<SyncConfig<SelectionRow, string>[`sync`]>[0]
+      const collection = createCollection<SelectionRow, string>({
+        id: `snapshot-source-callback-reentry-${includeInitialState}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.begin()
+            sync.write({ type: `insert`, value: { id: `one`, value: 1 } })
+            sync.write({ type: `insert`, value: { id: `three`, value: 3 } })
+            sync.commit()
+            sync.markReady()
+            return { loadSubset: () => true, unloadSubset: () => {} }
+          },
+        },
+      })
+      const index = collection.createIndex((row) => row.value, {
+        indexType: BTreeIndex,
+      })
+      const orderBy = valueOrderBy()
+      const batches: Array<Array<string>> = []
+      const visible = new Set<string>()
+      const violations: Array<string> = []
+      let reentered = false
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          if (changes.length > 0)
+            batches.push(changes.map(({ type, key }) => `${type}:${key}`))
+          for (const change of changes) {
+            if (change.type === `insert`) {
+              if (visible.has(String(change.key)))
+                violations.push(`duplicate insert:${change.key}`)
+              visible.add(String(change.key))
+            } else if (change.type === `delete`) {
+              visible.delete(String(change.key))
+            }
+          }
+          if (
+            !reentered &&
+            changes.some(({ type, key }) => type === `insert` && key === `two`)
+          ) {
+            reentered = true
+            subscription.requestLimitedSnapshot({
+              orderBy,
+              limit: 1,
+              minValues: [1],
+            })
+          }
+        },
+        { includeInitialState },
+      )
+      subscription.setOrderByIndex(index)
+      try {
+        subscription.requestSnapshot({
+          where: new Func(`eq`, [new PropRef([`id`]), new Value(`one`)]),
+        })
+        operations.begin()
+        operations.write({ type: `insert`, value: { id: `two`, value: 2 } })
+        await operations.commit()
+
+        // The independent fold is: select one, publish source two, then choose
+        // the lowest ordered source row absent from {one, two}, namely three.
+        expect(reentered).toBe(true)
+        expect(batches).toEqual([
+          [`insert:one`],
+          [`insert:two`],
+          [`insert:three`],
+        ])
+        expect(violations).toEqual([])
+        expect([...visible].sort()).toEqual([`one`, `three`, `two`])
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+  it.each([`row`, `status`, `error`, `acquisition`] as const)(
+    `rejects a terminal %s observation with an unchanged-retired neighbor`,
+    (fault) => {
+      const retired: TerminalPublicationSnapshot = {
+        batches: [],
+        visible: [{ id: `c`, value: 42 }],
+        statusEvents: [],
+        errors: [],
+        status: `ready`,
+        subscriberCount: 0,
+        attempts: 2,
+        unloads: [0, 1],
+        syncRuns: 1,
+      }
+      const actual: TerminalPublicationSnapshot = {
+        ...retired,
+        batches: [],
+        visible: retired.visible.map(cloneRow),
+        statusEvents: [],
+        errors: [],
+        unloads: [...retired.unloads],
+      }
+      assertTerminalPublication(actual, retired)
+      if (fault === `row`)
+        actual.batches.push([
+          { type: `insert`, key: `a`, value: { id: `a`, value: 9 } },
+        ])
+      if (fault === `status`)
+        actual.statusEvents.push({
+          previousStatus: `ready`,
+          status: `loadingSubset`,
+        })
+      if (fault === `error`) actual.errors.push(new Error(`late transport`))
+      if (fault === `acquisition`) actual.attempts++
+      expect(() => assertTerminalPublication(actual, retired)).toThrowError(
+        /expected/,
+      )
+    },
+  )
+  it.each(
+    ([undefined, false] as const).flatMap((includeInitialState) =>
+      ([`update`, `delete`, `truncate`] as const).map((operation) => ({
+        includeInitialState,
+        operation,
+      })),
+    ),
+  )(
+    `distinguishes unseen-row $operation with includeInitialState=$includeInitialState`,
+    async ({ includeInitialState, operation }) => {
+      let operations!: SyncOperations
+      const collection = createCollection<Row, RowKey>({
+        getKey: ({ id }) => id,
+        startSync: true,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.begin()
+            sync.write({ type: `insert`, value: { id: `d`, value: 0 } })
+            sync.commit()
+            sync.markReady()
+          },
+        },
+      })
+      const changes: Array<PublicationChange> = []
+      const subscription = collection.subscribeChanges(
+        (batch) => {
+          for (const change of batch) {
+            changes.push({
+              type: change.type,
+              key: change.value.id,
+              value: cloneRow(change.value),
+              ...(change.previousValue
+                ? { previousValue: cloneRow(change.previousValue) }
+                : {}),
+            })
+          }
+        },
+        { includeInitialState },
+      )
+      try {
+        expect(changes).toEqual([])
+        operations.begin()
+        if (operation === `truncate`) operations.truncate()
+        else if (operation === `delete`)
+          operations.write({ type: `delete`, key: `d` })
+        else operations.write({ type: `update`, value: { id: `d`, value: 4 } })
+        await operations.commit()
+        expect(changes).toEqual(
+          operation === `update`
+            ? [
+                {
+                  type: includeInitialState === false ? `update` : `insert`,
+                  key: `d`,
+                  value: { id: `d`, value: 4 },
+                  ...(includeInitialState === false
+                    ? { previousValue: { id: `d`, value: 0 } }
+                    : {}),
+                },
+              ]
+            : includeInitialState === false
+              ? [{ type: `delete`, key: `d`, value: { id: `d`, value: 0 } }]
+              : [],
+        )
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each([
+    `none`,
+    `missing`,
+    `duplicate`,
+    `value`,
+    `previous-value`,
+    `split`,
+    `merge`,
+    `same-key-order`,
+  ] as const)(
+    `normalizes only independent change order with corruption: %s`,
+    (corruption) => {
+      const baseline: Array<Array<PublicationChange>> = [
+        [
+          {
+            type: `update`,
+            key: `a`,
+            value: { id: `a`, value: 1 },
+            previousValue: { id: `a`, value: 0 },
+          },
+          { type: `delete`, key: `b`, value: { id: `b`, value: 0 } },
+          { type: `insert`, key: `c`, value: { id: `c`, value: 1 } },
+        ],
+        [
+          {
+            type: `update`,
+            key: `a`,
+            value: { id: `a`, value: 2 },
+            previousValue: { id: `a`, value: 1 },
+          },
+          { type: `delete`, key: `a`, value: { id: `a`, value: 2 } },
+        ],
+      ]
+      const permutations = [
+        [0, 1, 2],
+        [0, 2, 1],
+        [1, 0, 2],
+        [1, 2, 0],
+        [2, 0, 1],
+        [2, 1, 0],
+      ]
+      for (const permutation of permutations) {
+        const candidate = clonePublicationBatches(baseline)
+        const changes = candidate[0]!
+        if (corruption === `value`) changes[0]!.value.value++
+        if (corruption === `previous-value`) changes[0]!.previousValue!.value++
+        candidate[0] = permutation.map((index) => changes[index]!)
+        if (corruption === `missing`) candidate[0].pop()
+        if (corruption === `duplicate`) candidate[0].push(changes[0]!)
+        if (corruption === `split`)
+          candidate.splice(1, 0, candidate[0].splice(1))
+        if (corruption === `merge`) candidate.splice(0, 2, candidate.flat())
+        if (corruption === `same-key-order`) candidate[1]!.reverse()
+        const actual = normalizePublicationOrder(candidate)
+        const expected = normalizePublicationOrder(baseline)
+        if (corruption === `none`) expect(actual).toEqual(expected)
+        else expect(actual).not.toEqual(expected)
+      }
+    },
+  )
+})
diff --git a/packages/db/tests/collection-subscription-lifecycle.test.ts b/packages/db/tests/collection-subscription-lifecycle.test.ts
new file mode 100644
index 0000000000..2cc999f505
--- /dev/null
+++ b/packages/db/tests/collection-subscription-lifecycle.test.ts
@@ -0,0 +1,854 @@
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { Func, PropRef, Value } from '../src/query/ir.js'
+import {
+  captureMicrotaskErrors,
+  createOnDemandCollection,
+  flushPromises,
+} from './utils.js'
+import { startOutcomes } from './collection-subscription-lifecycle-cell-support.js'
+import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
+
+/**
+ * Pinned unit tests for CollectionSubscription demand lifecycle: concrete
+ * acquisition, release, restart, and replay examples whose expectations are
+ * written by hand. The law, its model, and the generated scenario checks are
+ * owned by collection-subscription-lifecycle-oracle.test.ts.
+ */
+
+describe(`CollectionSubscription demand lifecycle oracle`, () => {
+  it.each([`resolve`, `reject`] as const)(
+    `retires a pending replay on cleanup before an obsolete %s`,
+    async (outcome) => {
+      type Row = { id: string; version: number }
+      const replay = createDeferred<void>()
+      const replayFailure = new Error(`obsolete replay failed`)
+      let begin!: () => void
+      let write!: (message: { type: `insert`; value: Row }) => void
+      let commit!: () => void
+      let truncate!: () => void
+      let syncRunCount = 0
+      let loadCount = 0
+      const visible = new Map<string | number, Row>()
+      const errors: Array<unknown> = []
+      const statuses: Array<string> = []
+
+      const collection = createOnDemandCollection<Row>({
+        id: `cleanup-pending-replay-${outcome}`,
+        sync: {
+          sync: (operations) => {
+            syncRunCount++
+            begin = operations.begin
+            write = operations.write
+            commit = operations.commit
+            truncate = operations.truncate
+            if (syncRunCount > 1) {
+              begin()
+              write({ type: `insert`, value: { id: `row`, version: 3 } })
+              commit()
+            }
+            operations.markReady()
+            return {
+              loadSubset: () => {
+                loadCount++
+                begin()
+                write({
+                  type: `insert`,
+                  value: { id: `row`, version: loadCount },
+                })
+                commit()
+                return loadCount === 1 || syncRunCount > 1
+                  ? true
+                  : replay.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            if (change.type === `delete`) visible.delete(change.key)
+            else {
+              visible.set(change.key, {
+                id: change.value.id,
+                version: change.value.version,
+              })
+            }
+          }
+        },
+        { includeInitialState: false },
+      )
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+      subscription.on(`status:change`, ({ status }) => statuses.push(status))
+
+      subscription.requestSnapshot()
+      expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(subscription.status).toBe(`loadingSubset`)
+
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      expect(syncRunCount).toBe(2)
+      expect([...visible.values()]).toEqual([{ id: `row`, version: 3 }])
+      expect(subscription.status).toBe(`loadingSubset`)
+      await flushPromises()
+      expect(subscription.status).toBe(`ready`)
+
+      if (outcome === `resolve`) replay.resolve()
+      else replay.reject(replayFailure)
+      await flushPromises()
+
+      expect([...visible.values()]).toEqual([{ id: `row`, version: 3 }])
+      expect(errors).toEqual([])
+      expect(subscription.lastError).toBeUndefined()
+      expect(statuses.at(-1)).toBe(`ready`)
+
+      subscription.unsubscribe()
+      await collection.cleanup()
+    },
+  )
+
+  it(`reacquires surviving on-demand demand after collection restart`, async () => {
+    type Row = { id: string; version: number }
+    let begin!: () => void
+    let write!: (message: { type: `insert`; value: Row }) => void
+    let commit!: () => void
+    let nextSyncRunGeneration = 0
+    let loadCount = 0
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const visible = new Map<string | number, Row>()
+    const collection = createOnDemandCollection<Row>({
+      id: `restart-surviving-demand`,
+      sync: {
+        sync: (operations) => {
+          nextSyncRunGeneration++
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              loadCount++
+              begin()
+              write({
+                type: `insert`,
+                value: { id: `row`, version: loadCount },
+              })
+              commit()
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        for (const change of changes) {
+          if (change.type === `delete`) visible.delete(change.key)
+          else {
+            visible.set(change.key, {
+              id: change.value.id,
+              version: change.value.version,
+            })
+          }
+        }
+      },
+      { includeInitialState: false },
+    )
+    subscription.requestSnapshot()
+    expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
+
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    expect(subscription.status).toBe(`loadingSubset`)
+    expect(loads).toHaveLength(1)
+    await flushPromises()
+
+    expect(nextSyncRunGeneration).toBe(2)
+    expect(loads).toHaveLength(2)
+    expect(unloads).toEqual([])
+    expect([...visible.values()]).toEqual([{ id: `row`, version: 2 }])
+    expect(subscription.status).toBe(`ready`)
+
+    subscription.unsubscribe()
+    expect(unloads).toEqual([loads[1]])
+    await collection.cleanup()
+  })
+
+  it(`reacquires demand requested while the collection is cleaned up`, async () => {
+    const oldWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`old`)])
+    const newWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`new`)])
+    let nextSyncRunGeneration = 0
+    const loads: Array<{
+      syncRunGeneration: number
+      options: LoadSubsetOptions
+    }> = []
+    const unloads: Array<{
+      syncRunGeneration: number
+      options: LoadSubsetOptions
+    }> = []
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `request-while-cleaned-up`,
+      sync: {
+        sync: ({ markReady }) => {
+          const syncRunGeneration = nextSyncRunGeneration++
+          markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push({ syncRunGeneration, options })
+              return true
+            },
+            unloadSubset: (options) =>
+              unloads.push({ syncRunGeneration, options }),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot({ where: oldWhere })
+
+    await collection.cleanup()
+    subscription.requestSnapshot({ where: newWhere })
+    collection.startSyncImmediate()
+    await flushPromises()
+
+    expect(loads.map(({ syncRunGeneration }) => syncRunGeneration)).toEqual([
+      0, 1, 1,
+    ])
+    expect(loads.slice(1).map(({ options }) => options.where)).toEqual([
+      oldWhere,
+      newWhere,
+    ])
+
+    subscription.unsubscribe()
+    expect(unloads.map(({ syncRunGeneration }) => syncRunGeneration)).toEqual([
+      1, 1,
+    ])
+    expect(unloads.map(({ options }) => options.where)).toEqual([
+      oldWhere,
+      newWhere,
+    ])
+    await collection.cleanup()
+  })
+
+  it(`does not report a detached demand as physically settled`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const observed: Array<unknown> = []
+    let loads = 0
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `detached-demand-settlement`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              return true
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    await collection.cleanup()
+    subscription.requestSnapshot({
+      where,
+      onLoadSubsetResult: (result) => observed.push(result),
+    })
+
+    expect(loads).toBe(0)
+    expect(observed).toEqual([expect.any(Promise)])
+
+    collection.startSyncImmediate()
+    await flushPromises()
+    expect(loads).toBe(1)
+    expect(observed).toEqual([expect.any(Promise)])
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it.each([false, true])(
+    `ignores a pre-aborted snapshot without changing an existing demand: %s`,
+    async (existingDemand) => {
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      let publications = 0
+      let results = 0
+      const collection = createOnDemandCollection<{ id: string }>({
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            begin()
+            write({ type: `insert`, value: { id: `row` } })
+            commit()
+            markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: (options) => unloads.push(options),
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => publications++, {
+        includeInitialState: false,
+      })
+      try {
+        if (existingDemand) subscription.requestSnapshot({ where })
+        const previousPublications = publications
+        const previousLoads = [...loads]
+        const controller = new AbortController()
+        controller.abort()
+
+        expect(
+          subscription.requestSnapshot({
+            where,
+            signal: controller.signal,
+            onLoadSubsetResult: () => results++,
+          }),
+        ).toBe(false)
+        await flushPromises()
+        expect(publications).toBe(previousPublications)
+        expect(results).toBe(0)
+        expect(loads).toEqual(previousLoads)
+        expect(unloads).toEqual([])
+        if (existingDemand) expect(loads[0]!.signal?.aborted).toBe(false)
+
+        subscription.releaseSnapshot(where)
+        expect(unloads).toEqual(previousLoads)
+        subscription.unsubscribe()
+        expect(unloads).toEqual(previousLoads)
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`keeps an installed loader unavailable after its initial error`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const loads: Array<LoadSubsetOptions> = []
+    let fail!: (error: unknown) => void
+    let markReady!: () => void
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `installed-loader-error-ready-recovery`,
+      startSync: false,
+      sync: {
+        sync: (operations) => {
+          fail = operations.fail
+          markReady = operations.markReady
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    collection.startSyncImmediate()
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    fail(new Error(`initial sync failed`))
+    // The initial error is final for this attempt: its markReady() does
+    // nothing (maintainer decision).
+    expect(() => markReady()).not.toThrow()
+    subscription.requestSnapshot({ where })
+    await flushPromises()
+
+    expect(collection.status).toBe(`error`)
+    expect(loads).toEqual([])
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`releases unavailable demand without creating a physical acquisition`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    let fail!: (error: unknown) => void
+    let markReady!: () => void
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `release-unavailable-demand`,
+      startSync: false,
+      sync: {
+        sync: (operations) => {
+          fail = operations.fail
+          markReady = operations.markReady
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    collection.startSyncImmediate()
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    fail(new Error(`initial sync failed`))
+    subscription.requestSnapshot({ where })
+    subscription.releaseSnapshot(where)
+    // A restart is the only recovery; the released demand stays released.
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    markReady()
+    await flushPromises()
+
+    expect(loads).toHaveLength(0)
+    expect(unloads).toHaveLength(0)
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`keeps an eager subscription ready after collection restart`, async () => {
+    const collection = createCollection<{ id: string }>({
+      id: `eager-subscription-restart`,
+      getKey: ({ id }) => id,
+      syncMode: `eager`,
+      sync: { sync: ({ markReady }) => markReady() },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot()
+
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    await flushPromises()
+
+    expect(collection.status).toBe(`ready`)
+    expect(subscription.status).toBe(`ready`)
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`retires restart loading when the replacement sync fails`, async () => {
+    const syncFailure = new Error(`replacement sync failed`)
+    let nextSyncRunGeneration = 0
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `failed-sync-restart`,
+      sync: {
+        sync: ({ markReady }) => {
+          if (nextSyncRunGeneration++ > 0) throw syncFailure
+          markReady()
+          return { loadSubset: () => true }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot()
+
+    await collection.cleanup()
+    expect(() => collection.startSyncImmediate()).toThrow(syncFailure)
+    await flushPromises()
+
+    expect(collection.status).toBe(`crashed`)
+    expect(subscription.status).toBe(`ready`)
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it(`does not repeat failed cleanup through a replacement sync run`, async () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+    let nextSyncRunGeneration = 0
+    const unloadSyncRunGenerations: Array<number> = []
+    const releaseFailure = new Error(`old sync run release failed`)
+    const uncaught = captureMicrotaskErrors()
+    const collection = createOnDemandCollection<{ id: string }>({
+      id: `cleanup-debt-sync-run`,
+      sync: {
+        sync: ({ markReady }) => {
+          const syncRunGeneration = nextSyncRunGeneration++
+          markReady()
+          return {
+            loadSubset: () => true,
+            unloadSubset: () => {
+              unloadSyncRunGenerations.push(syncRunGeneration)
+              if (syncRunGeneration === 0) throw releaseFailure
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    subscription.requestSnapshot({ where })
+    expect(() => subscription.releaseSnapshot(where)).not.toThrow()
+
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    await flushPromises()
+    subscription.unsubscribe()
+
+    expect(unloadSyncRunGenerations).toEqual([0])
+    await collection.cleanup()
+    expect(uncaught.errors).toEqual([releaseFailure])
+    uncaught.restore()
+  })
+
+  // An abort ends the load (maintainer decision): an owner whose replay load
+  // was aborted owes the replay nothing, so the replay publishes what the
+  // source holds, as one whose last owner retired does. The rows the adapter
+  // wrote before the abort applied as ordinary writes.
+  it(`publishes the source rows when an external abort ends the replay's only load`, async () => {
+    type Row = { id: string; value: string }
+    const abort = new AbortController()
+    const replay = createDeferred<void>()
+    let begin!: () => void
+    let write!: (message: { type: `insert`; value: Row }) => void
+    let commit!: () => void
+    let truncate!: () => void
+    let loadCount = 0
+    const visible = new Map<string | number, Row>()
+    const collection = createOnDemandCollection<Row>({
+      id: `externally-aborted-replay`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              loadCount++
+              begin()
+              write({
+                type: `insert`,
+                value: {
+                  id: `row`,
+                  value: loadCount === 1 ? `old` : `partial`,
+                },
+              })
+              commit()
+              return loadCount === 1 ? true : replay.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        for (const change of changes) {
+          if (change.type === `delete`) visible.delete(change.key)
+          else {
+            visible.set(change.key, {
+              id: change.value.id,
+              value: change.value.value,
+            })
+          }
+        }
+      },
+      { includeInitialState: false },
+    )
+
+    subscription.requestSnapshot({ signal: abort.signal })
+    expect([...visible.values()]).toEqual([{ id: `row`, value: `old` }])
+    begin()
+    truncate()
+    commit()
+    await flushPromises()
+    abort.abort()
+    replay.reject(new DOMException(`aborted`, `AbortError`))
+    await flushPromises()
+
+    expect([...visible.values()]).toEqual([{ id: `row`, value: `partial` }])
+    expect(subscription.status).toBe(`ready`)
+
+    subscription.unsubscribe()
+    await collection.cleanup()
+  })
+
+  it.each(startOutcomes)(
+    `retires replay setup when its adapter cleans up before %s`,
+    async (outcome) => {
+      type Row = { id: string; version: number }
+      const pending = createDeferred<void>()
+      void pending.promise.catch(() => {})
+      const failure = new Error(`obsolete replay failed`)
+      let begin!: () => void
+      let write!: (message: { type: `insert`; value: Row }) => void
+      let commit!: () => void
+      let truncate!: () => void
+      let loadCount = 0
+      const visible = new Map<string | number, Row>()
+      const errors: Array<unknown> = []
+      const statuses: Array<string> = []
+
+      const collection = createOnDemandCollection<Row>({
+        id: `reentrant-cleanup-${outcome}`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            write = operations.write
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: () => {
+                loadCount++
+                begin()
+                write({
+                  type: `insert`,
+                  value: { id: `row`, version: loadCount },
+                })
+                commit()
+                if (loadCount === 1) return true
+                void collection.cleanup()
+                if (outcome === `throw`) throw failure
+                if (outcome === `return`) return true
+                return pending.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            if (change.type === `delete`) visible.delete(change.key)
+            else {
+              visible.set(change.key, {
+                id: change.value.id,
+                version: change.value.version,
+              })
+            }
+          }
+        },
+        { includeInitialState: false },
+      )
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+      subscription.on(`status:change`, ({ status }) => statuses.push(status))
+      subscription.requestSnapshot()
+
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      if (outcome === `resolve`) pending.resolve()
+      if (outcome === `reject`) pending.reject(failure)
+      await flushPromises()
+
+      expect(collection.status).toBe(`cleaned-up`)
+      expect([...visible.values()]).toEqual([{ id: `row`, version: 1 }])
+      expect(errors).toEqual([])
+      expect(subscription.lastError).toBeUndefined()
+      expect(subscription.status).toBe(`ready`)
+      expect(statuses.at(-1)).not.toBe(`loadingSubset`)
+
+      subscription.unsubscribe()
+      await collection.cleanup()
+    },
+  )
+
+  it.each(
+    ([`initial`, `replay`] as const).flatMap((origin) =>
+      ([`resolve`, `reject`] as const).flatMap((oldOutcome) =>
+        ([`old-first`, `current-first`] as const).map((order) => ({
+          origin,
+          oldOutcome,
+          order,
+        })),
+      ),
+    ),
+  )(
+    `does not wait for aborted $origin work before publishing or readiness, $oldOutcome, $order`,
+    async ({ origin, oldOutcome, order }) => {
+      type Row = { id: string; version: number }
+      const where = {
+        a: new Func(`eq`, [new PropRef([`id`]), new Value(`a`)]),
+        b: new Func(`eq`, [new PropRef([`id`]), new Value(`b`)]),
+      }
+      const loads: Array<{
+        options: LoadSubsetOptions
+        deferred: ReturnType<typeof createDeferred<void>>
+      }> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const errors: Array<unknown> = []
+      const visible = new Map<string | number, Row>()
+      let emptyBatches = 0
+      let replacementChanges = 0
+      let operations!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+      const collection = createCollection<Row, string>({
+        id: `publication-readiness-boundary`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (nextOperations) => {
+            operations = nextOperations
+            operations.markReady()
+            return {
+              loadSubset: (options) => {
+                const deferred = createDeferred<void>()
+                void deferred.promise.catch(() => {})
+                loads.push({ options, deferred })
+                return deferred.promise
+              },
+              unloadSubset: (options) => {
+                unloads.push(options)
+              },
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          if (changes.length === 0) emptyBatches++
+          for (const change of changes) {
+            if (change.type === `delete`) visible.delete(change.key)
+            else {
+              visible.set(change.key, {
+                id: change.value.id,
+                version: change.value.version,
+              })
+              if (change.value.id === `b` && change.value.version === 2)
+                replacementChanges++
+            }
+          }
+        },
+        { includeInitialState: false },
+      )
+      subscription.on(`loadSubset:error`, ({ error }) => errors.push(error))
+      const write = async (id: string, version: number) => {
+        operations.begin()
+        operations.write({
+          type: collection.has(id) ? `update` : `insert`,
+          value: { id, version },
+        })
+        const receipt = operations.commit()
+        if (receipt !== true) await receipt
+      }
+      const truncate = async () => {
+        operations.begin()
+        operations.truncate()
+        const receipt = operations.commit()
+        if (receipt !== true) await receipt
+        await flushPromises()
+      }
+      const settle = async (
+        attempt: (typeof loads)[number],
+        outcome: `resolve` | `reject`,
+        id = `b`,
+      ) => {
+        // The source settles an aborted load late but suppresses its writes.
+        // An abort ended that load (maintainer decision): its late settlement
+        // installs nothing and holds neither readiness nor publication.
+        if (outcome === `resolve`) {
+          if (!attempt.options.signal?.aborted) await write(id, 2)
+          attempt.deferred.resolve()
+        } else attempt.deferred.reject(new Error(`obsolete source failed`))
+        await flushPromises()
+      }
+      try {
+        subscription.requestSnapshot({ where: where.b })
+        await write(`b`, 0)
+        if (origin === `replay`) {
+          loads[0]!.deferred.resolve()
+          await flushPromises()
+          await truncate()
+        }
+        const old = loads.at(-1)!
+        await truncate()
+        const current = loads.at(-1)!
+        expect(old.options.signal?.aborted).toBe(true)
+        expect([...visible.values()]).toEqual([{ id: `b`, version: 0 }])
+        if (order === `old-first`) {
+          await settle(old, oldOutcome)
+          expect(subscription.status).toBe(`loadingSubset`)
+          expect([...visible.values()]).toEqual([{ id: `b`, version: 0 }])
+        }
+        await settle(current, `resolve`)
+        expect([...visible.values()]).toEqual([{ id: `b`, version: 2 }])
+        expect(subscription.status).toBe(`ready`)
+        const emptyBeforeRequest = emptyBatches
+        subscription.requestSnapshot({ where: where.a })
+        expect(emptyBatches - emptyBeforeRequest).toBe(1)
+        await settle(loads.at(-1)!, `resolve`, `a`)
+        expect([...visible.values()]).toEqual([
+          { id: `b`, version: 2 },
+          { id: `a`, version: 2 },
+        ])
+        if (order === `current-first`) await settle(old, oldOutcome)
+        expect([...visible.values()]).toEqual([
+          { id: `b`, version: 2 },
+          { id: `a`, version: 2 },
+        ])
+        expect(subscription.status).toBe(`ready`)
+        expect(errors).toEqual([])
+        expect(replacementChanges).toBe(1)
+        subscription.unsubscribe()
+        expect(unloads).toHaveLength(loads.length)
+        for (const { options } of loads)
+          expect(unloads.filter((value) => value === options)).toHaveLength(1)
+      } finally {
+        for (const { deferred } of loads) deferred.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+})
+
+// During ordinary admission, the new owner exists before subscribeChanges
+// returns its handle. Cleanup in the acquiring-count callback must retain that
+// demand even though the subscription has not joined the publication channel.
+// The token judgment is one surviving owner, independent of production's list.
+it(`retains admitted demand during subscriber-change cleanup`, async () => {
+  const source = createCollection<{ id: string }>({
+    getKey: (row) => row.id,
+    gcTime: 0,
+    sync: { sync: ({ markReady }) => markReady() },
+  })
+  let cleanup: Promise<void> | undefined
+  let observed: boolean | undefined
+  const off = source.on(`subscribers:change`, ({ subscriberCount }) => {
+    if (subscriberCount !== 1) return
+    cleanup = source.cleanup()
+    observed = source._hasSubscriberOrPreload()
+  })
+  const subscription = source.subscribeChanges(() => {})
+  try {
+    expect(observed).toBe(true)
+    expect(source.subscriberCount).toBe(1)
+    await cleanup
+  } finally {
+    off()
+    subscription.unsubscribe()
+    await source.cleanup()
+  }
+})
diff --git a/packages/db/tests/collection-subscription-reentrancy-fixture.ts b/packages/db/tests/collection-subscription-reentrancy-fixture.ts
new file mode 100644
index 0000000000..e7696453c3
--- /dev/null
+++ b/packages/db/tests/collection-subscription-reentrancy-fixture.ts
@@ -0,0 +1,5 @@
+import { Func, PropRef, Value } from '../src/query/ir.js'
+
+/** The equality predicate on `id` that the reentry histories request. */
+export const where = () =>
+  new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
diff --git a/packages/db/tests/collection-subscription-reentrancy-oracle.test.ts b/packages/db/tests/collection-subscription-reentrancy-oracle.test.ts
index 1b01c39e1f..f82dcb4315 100644
--- a/packages/db/tests/collection-subscription-reentrancy-oracle.test.ts
+++ b/packages/db/tests/collection-subscription-reentrancy-oracle.test.ts
@@ -2,8 +2,10 @@ import { describe, expect, it, vi } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
 import { createDeferred } from '../src/deferred.js'
 import { Func, PropRef, Value } from '../src/query/ir.js'
+import { where } from './collection-subscription-reentrancy-fixture.js'
 import { reentrantSnapshotHistories } from './collection-subscription-lifecycle-grammar-oracle.js'
-import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
+import { declareOracle } from './oracle-declaration.js'
+import type { LoadSubsetOptions } from '../src/types.js'
 
 /**
  * # Which snapshot work survives callback reentry?
@@ -22,7 +24,38 @@ import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
  * separate primary owners in the lifecycle and replay oracles.
  */
 
-const where = () => new Func(`eq`, [new PropRef([`id`]), new Value(`row`)])
+// The ownership law fixes what a direct snapshot publishes and releases when
+// its callback retires the demand. The phase decides whether the callback
+// runs before the result hook, and whether the optimized read is reached.
+function expectSnapshotReentryOutcome(observed: {
+  phase: string
+  reentries: number
+  resultHooks: number
+  accepted: boolean
+  publications: ReadonlyArray<ReadonlyArray<string>>
+  loads: ReadonlyArray<LoadSubsetOptions>
+  unloads: ReadonlyArray<LoadSubsetOptions>
+  reads: unknown
+}): void {
+  const { phase, reentries, resultHooks, accepted, publications } = observed
+  const { loads, unloads, reads } = observed
+  expect(reentries).toBe(1)
+  expect(resultHooks).toBe(phase === `loadSubset` ? 0 : 1)
+  expect(accepted).toBe(false)
+  expect(publications).toEqual([])
+  expect(loads).toHaveLength(1)
+  expect(unloads).toEqual(loads)
+  expect(loads[0]?.signal?.aborted).toBe(true)
+  expect(reads).toHaveBeenCalledTimes(
+    phase === `loadSubset` ||
+      phase === `onLoadSubsetResult` ||
+      phase === `statusLoadingSubset`
+      ? 0
+      : 1,
+  )
+}
+
+declareOracle({ check: [expectSnapshotReentryOutcome] })
 
 describe(`Collection subscription callback reentry oracle`, () => {
   it.each(reentrantSnapshotHistories)(
@@ -115,20 +148,16 @@ describe(`Collection subscription callback reentry oracle`, () => {
             : {}),
         })
 
-        expect(reentries).toBe(1)
-        expect(resultHooks).toBe(phase === `loadSubset` ? 0 : 1)
-        expect(accepted).toBe(false)
-        expect(publications).toEqual([])
-        expect(loads).toHaveLength(1)
-        expect(unloads).toEqual(loads)
-        expect(loads[0]?.signal?.aborted).toBe(true)
-        expect(reads).toHaveBeenCalledTimes(
-          phase === `loadSubset` ||
-            phase === `onLoadSubsetResult` ||
-            phase === `statusLoadingSubset`
-            ? 0
-            : 1,
-        )
+        expectSnapshotReentryOutcome({
+          phase,
+          reentries,
+          resultHooks,
+          accepted,
+          publications,
+          loads,
+          unloads,
+          reads,
+        })
       } finally {
         transport.resolve()
         reads.mockRestore()
@@ -137,485 +166,4 @@ describe(`Collection subscription callback reentry oracle`, () => {
       }
     },
   )
-
-  it(`releases a request by its predicate when the subscription adds a predicate`, async () => {
-    const requestedWhere = where()
-    const subscriptionWhere = new Func(`eq`, [
-      new PropRef([`id`]),
-      new Value(`row`),
-    ])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createCollection<{ id: string }>({
-      id: `combined-predicate-release`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-      whereExpression: subscriptionWhere,
-    })
-
-    try {
-      subscription.requestSnapshot({ where: requestedWhere })
-      expect(loads).toHaveLength(1)
-      expect(loads[0]?.where).not.toBe(requestedWhere)
-      subscription.releaseSnapshot(requestedWhere)
-      expect(unloads).toEqual(loads)
-      expect(loads[0]?.signal?.aborted).toBe(true)
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`retires a combined-predicate request when its loader releases the original predicate`, async () => {
-    const requestedWhere = where()
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const publications: Array<ReadonlyArray<string>> = []
-    let resultHooks = 0
-    const collection = createCollection<{ id: string }>({
-      id: `combined-predicate-loader-release`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          operations.begin()
-          operations.write({ type: `insert`, value: { id: `row` } })
-          operations.commit()
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              subscription.releaseSnapshot(requestedWhere)
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(
-      (changes) => publications.push(changes.map(({ value }) => value.id)),
-      { includeInitialState: false, whereExpression: where() },
-    )
-
-    try {
-      const accepted = subscription.requestSnapshot({
-        where: requestedWhere,
-        onLoadSubsetResult: () => resultHooks++,
-      })
-      expect(loads).toHaveLength(1)
-      expect(loads[0]?.where).not.toBe(requestedWhere)
-      expect(unloads).toEqual(loads)
-      expect(loads[0]?.signal?.aborted).toBe(true)
-      expect(resultHooks).toBe(0)
-      expect(accepted).toBe(false)
-      expect(publications).toEqual([])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`removes the request abort listener after acquisition release`, async () => {
-    const requestedWhere = where()
-    const request = new AbortController()
-    const additions = vi.spyOn(request.signal, `addEventListener`)
-    const removals = vi.spyOn(request.signal, `removeEventListener`)
-    const collection = createCollection<{ id: string }>({
-      id: `released-abort-forwarding`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return { loadSubset: () => true }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({
-        where: requestedWhere,
-        signal: request.signal,
-      })
-      subscription.releaseSnapshot(requestedWhere)
-      const forwarded = additions.mock.calls.filter(
-        ([type]) => type === `abort`,
-      )
-      expect(forwarded).toHaveLength(1)
-      expect(removals.mock.calls).toContainEqual([`abort`, forwarded[0]?.[1]])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-      additions.mockRestore()
-      removals.mockRestore()
-    }
-  })
-
-  it(`does not start delegated replay after status reentry retires its only demand`, async () => {
-    const requestedWhere = where()
-    const delegate: Array<`start` | `succeed`> = []
-    let statusReentries = 0
-    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
-    const collection = createCollection<{ id: string }>({
-      id: `reentrant-replay-status-release`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (next) => {
-          operations = next
-          next.markReady()
-          return { loadSubset: () => true }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-      truncateReplayPublication: {
-        start: () => delegate.push(`start`),
-        succeed: () => delegate.push(`succeed`),
-      },
-    })
-
-    try {
-      subscription.requestSnapshot({ where: requestedWhere })
-      subscription.on(`status:loadingSubset`, () => {
-        statusReentries++
-        subscription.releaseSnapshot(requestedWhere)
-      })
-      operations.begin()
-      operations.truncate()
-      operations.commit()
-      expect(statusReentries).toBe(1)
-      expect(delegate).toEqual([`succeed`])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`keeps an acquisition until the current replay setup reaches it`, async () => {
-    const requestedWhere = where()
-    const unloads: Array<LoadSubsetOptions> = []
-    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
-    const collection = createCollection<{ id: string }>({
-      id: `obsolete-replay-setup`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (next) => {
-          operations = next
-          next.markReady()
-          return {
-            loadSubset: () => true,
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({ where: requestedWhere })
-      operations.begin()
-      operations.truncate()
-      operations.commit()
-      const beforeCurrentSetup = new Promise<number>((resolve) => {
-        queueMicrotask(() => resolve(unloads.length))
-      })
-      operations.begin()
-      operations.truncate()
-      operations.commit()
-      expect(await beforeCurrentSetup).toBe(0)
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`stops an obsolete replay setup when its loader starts a newer replay`, async () => {
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`first`)])
-    const secondWhere = new Func(`eq`, [
-      new PropRef([`id`]),
-      new Value(`second`),
-    ])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
-    let startedNestedReplay = false
-    const collection = createCollection<{ id: string }>({
-      id: `loader-starts-new-replay`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (next) => {
-          operations = next
-          next.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              if (loads.length === 3) {
-                startedNestedReplay = true
-                operations.begin()
-                operations.truncate()
-                operations.commit()
-              }
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      subscription.requestSnapshot({ where: secondWhere })
-      expect(loads.map(({ where: predicate }) => predicate)).toEqual([
-        firstWhere,
-        secondWhere,
-      ])
-      operations.begin()
-      operations.truncate()
-      operations.commit()
-      const beforeNestedSetup = new Promise<number>((resolve) => {
-        queueMicrotask(() =>
-          resolve(
-            unloads.filter(({ where: predicate }) => predicate === secondWhere)
-              .length,
-          ),
-        )
-      })
-      expect(await beforeNestedSetup).toBe(0)
-      expect(startedNestedReplay).toBe(true)
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`keeps detached demand loading when an obsolete acquisition settles before restart setup`, async () => {
-    const requestedWhere = where()
-    const oldLoad = createDeferred<void>()
-    const newLoad = createDeferred<void>()
-    let syncRuns = 0
-    const collection = createCollection<{ id: string }>({
-      id: `obsolete-settlement-before-restart-setup`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ markReady }) => {
-          const run = syncRuns++
-          markReady()
-          return {
-            loadSubset: () => (run === 0 ? oldLoad.promise : newLoad.promise),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({ where: requestedWhere })
-      expect(subscription.status).toBe(`loadingSubset`)
-      await collection.cleanup()
-      oldLoad.resolve()
-      const beforeSetup = new Promise<string>((resolve) => {
-        queueMicrotask(() => resolve(subscription.status))
-      })
-      collection.startSyncImmediate()
-      expect(await beforeSetup).toBe(`loadingSubset`)
-    } finally {
-      oldLoad.resolve()
-      newLoad.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not retain a released replay rejection while a peer remains pending`, async () => {
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`first`)])
-    const secondWhere = new Func(`eq`, [
-      new PropRef([`id`]),
-      new Value(`second`),
-    ])
-    const released = createDeferred<void>()
-    const peer = createDeferred<void>()
-    const failure = new Error(`released acquisition failed`)
-    let loads = 0
-    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
-    const collection = createCollection<{ id: string }>({
-      id: `released-replay-rejection-retention`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (next) => {
-          operations = next
-          next.markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              if (loads <= 2) return true
-              return loads === 3 ? released.promise : peer.promise
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      subscription.requestSnapshot({ where: secondWhere })
-      operations.begin()
-      operations.truncate()
-      operations.commit()
-      await Promise.resolve()
-      expect(loads).toBe(4)
-      subscription.releaseSnapshot(firstWhere)
-      released.reject(failure)
-      await Promise.resolve()
-      await Promise.resolve()
-
-      // Only the retention boundary needs a white-box observation. The
-      // public failure and publication checks live in the replay oracle.
-      const replayState = subscription as unknown as {
-        truncateReplayState?: { failures: Map<unknown, Error> }
-      }
-      expect([...replayState.truncateReplayState!.failures.values()]).toEqual(
-        [],
-      )
-      expect(subscription.lastError).toBeUndefined()
-      expect(subscription.status).toBe(`loadingSubset`)
-    } finally {
-      released.resolve()
-      peer.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not publish when adapter cleanup invalidates a starting acquisition`, async () => {
-    const requestedWhere = where()
-    const publications: Array<ReadonlyArray<string>> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    let cleanup: Promise<void> | undefined
-    let enteredLoader = false
-    const collection = createCollection<{ id: string }>({
-      id: `cleanup-during-starting-acquisition`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          operations.begin()
-          operations.write({ type: `insert`, value: { id: `row` } })
-          operations.commit()
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              enteredLoader = true
-              cleanup = collection.cleanup()
-              return true
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(
-      (changes) => publications.push(changes.map(({ value }) => value.id)),
-      { includeInitialState: false },
-    )
-
-    try {
-      const accepted = subscription.requestSnapshot({ where: requestedWhere })
-      expect(enteredLoader).toBe(true)
-      expect(accepted).toBe(false)
-      expect(publications).toEqual([])
-      expect(unloads).toEqual([])
-      await cleanup
-      expect(collection.status).toBe(`cleaned-up`)
-    } finally {
-      subscription.unsubscribe()
-      await cleanup
-    }
-  })
-
-  it(`does not acquire detached demand after cleanup reenters its restart status`, async () => {
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`first`)])
-    const secondWhere = new Func(`eq`, [
-      new PropRef([`id`]),
-      new Value(`second`),
-    ])
-    let loads = 0
-    let cleanup: Promise<void> | undefined
-    const collection = createCollection<{ id: string }>({
-      id: `cleanup-during-detached-restart`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              return true
-            },
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      subscription.requestSnapshot({ where: secondWhere })
-      expect(loads).toBe(2)
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      subscription.on(`status:loadingSubset`, () => {
-        cleanup = collection.cleanup()
-      })
-      subscription.releaseSnapshot(firstWhere)
-      expect(subscription.status).toBe(`ready`)
-      await Promise.resolve()
-      expect(cleanup).toBeDefined()
-      await cleanup
-      expect(loads).toBe(2)
-      expect(collection.status).toBe(`cleaned-up`)
-    } finally {
-      subscription.unsubscribe()
-      await cleanup
-      await collection.cleanup()
-    }
-  })
 })
diff --git a/packages/db/tests/collection-subscription-reentrancy.test.ts b/packages/db/tests/collection-subscription-reentrancy.test.ts
new file mode 100644
index 0000000000..f5c755af50
--- /dev/null
+++ b/packages/db/tests/collection-subscription-reentrancy.test.ts
@@ -0,0 +1,494 @@
+/**
+ * Ordinary reentry regressions for Collection subscriptions. The callback-reentry
+ * law is owned by collection-subscription-reentrancy-oracle.test.ts, which
+ * runs the reentrant histories through its check.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { Func, PropRef, Value } from '../src/query/ir.js'
+import { where } from './collection-subscription-reentrancy-fixture.js'
+import type { LoadSubsetOptions, SyncConfig } from '../src/types.js'
+
+describe(`Collection subscription callback reentry oracle`, () => {
+  it(`releases a request by its predicate when the subscription adds a predicate`, async () => {
+    const requestedWhere = where()
+    const subscriptionWhere = new Func(`eq`, [
+      new PropRef([`id`]),
+      new Value(`row`),
+    ])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createCollection<{ id: string }>({
+      id: `combined-predicate-release`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+      whereExpression: subscriptionWhere,
+    })
+
+    try {
+      subscription.requestSnapshot({ where: requestedWhere })
+      expect(loads).toHaveLength(1)
+      expect(loads[0]?.where).not.toBe(requestedWhere)
+      subscription.releaseSnapshot(requestedWhere)
+      expect(unloads).toEqual(loads)
+      expect(loads[0]?.signal?.aborted).toBe(true)
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`retires a combined-predicate request when its loader releases the original predicate`, async () => {
+    const requestedWhere = where()
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const publications: Array<ReadonlyArray<string>> = []
+    let resultHooks = 0
+    const collection = createCollection<{ id: string }>({
+      id: `combined-predicate-loader-release`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          operations.begin()
+          operations.write({ type: `insert`, value: { id: `row` } })
+          operations.commit()
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              subscription.releaseSnapshot(requestedWhere)
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(
+      (changes) => publications.push(changes.map(({ value }) => value.id)),
+      { includeInitialState: false, whereExpression: where() },
+    )
+
+    try {
+      const accepted = subscription.requestSnapshot({
+        where: requestedWhere,
+        onLoadSubsetResult: () => resultHooks++,
+      })
+      expect(loads).toHaveLength(1)
+      expect(loads[0]?.where).not.toBe(requestedWhere)
+      expect(unloads).toEqual(loads)
+      expect(loads[0]?.signal?.aborted).toBe(true)
+      expect(resultHooks).toBe(0)
+      expect(accepted).toBe(false)
+      expect(publications).toEqual([])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`removes the request abort listener after acquisition release`, async () => {
+    const requestedWhere = where()
+    const request = new AbortController()
+    const additions = vi.spyOn(request.signal, `addEventListener`)
+    const removals = vi.spyOn(request.signal, `removeEventListener`)
+    const collection = createCollection<{ id: string }>({
+      id: `released-abort-forwarding`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return { loadSubset: () => true }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({
+        where: requestedWhere,
+        signal: request.signal,
+      })
+      subscription.releaseSnapshot(requestedWhere)
+      const forwarded = additions.mock.calls.filter(
+        ([type]) => type === `abort`,
+      )
+      expect(forwarded).toHaveLength(1)
+      expect(removals.mock.calls).toContainEqual([`abort`, forwarded[0]?.[1]])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+      additions.mockRestore()
+      removals.mockRestore()
+    }
+  })
+
+  it(`does not start delegated replay after status reentry retires its only demand`, async () => {
+    const requestedWhere = where()
+    const delegate: Array<`start` | `succeed`> = []
+    let statusReentries = 0
+    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
+    const collection = createCollection<{ id: string }>({
+      id: `reentrant-replay-status-release`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (next) => {
+          operations = next
+          next.markReady()
+          return { loadSubset: () => true }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+      truncateReplayPublication: {
+        start: () => delegate.push(`start`),
+        succeed: () => delegate.push(`succeed`),
+      },
+    })
+
+    try {
+      subscription.requestSnapshot({ where: requestedWhere })
+      subscription.on(`status:loadingSubset`, () => {
+        statusReentries++
+        subscription.releaseSnapshot(requestedWhere)
+      })
+      operations.begin()
+      operations.truncate()
+      operations.commit()
+      expect(statusReentries).toBe(1)
+      expect(delegate).toEqual([`succeed`])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`keeps an acquisition until the current replay setup reaches it`, async () => {
+    const requestedWhere = where()
+    const unloads: Array<LoadSubsetOptions> = []
+    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
+    const collection = createCollection<{ id: string }>({
+      id: `obsolete-replay-setup`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (next) => {
+          operations = next
+          next.markReady()
+          return {
+            loadSubset: () => true,
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({ where: requestedWhere })
+      operations.begin()
+      operations.truncate()
+      operations.commit()
+      const beforeCurrentSetup = new Promise<number>((resolve) => {
+        queueMicrotask(() => resolve(unloads.length))
+      })
+      operations.begin()
+      operations.truncate()
+      operations.commit()
+      expect(await beforeCurrentSetup).toBe(0)
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`stops an obsolete replay setup when its loader starts a newer replay`, async () => {
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`first`)])
+    const secondWhere = new Func(`eq`, [
+      new PropRef([`id`]),
+      new Value(`second`),
+    ])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
+    let startedNestedReplay = false
+    const collection = createCollection<{ id: string }>({
+      id: `loader-starts-new-replay`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (next) => {
+          operations = next
+          next.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              if (loads.length === 3) {
+                startedNestedReplay = true
+                operations.begin()
+                operations.truncate()
+                operations.commit()
+              }
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      subscription.requestSnapshot({ where: secondWhere })
+      expect(loads.map(({ where: predicate }) => predicate)).toEqual([
+        firstWhere,
+        secondWhere,
+      ])
+      operations.begin()
+      operations.truncate()
+      operations.commit()
+      const beforeNestedSetup = new Promise<number>((resolve) => {
+        queueMicrotask(() =>
+          resolve(
+            unloads.filter(({ where: predicate }) => predicate === secondWhere)
+              .length,
+          ),
+        )
+      })
+      expect(await beforeNestedSetup).toBe(0)
+      expect(startedNestedReplay).toBe(true)
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`keeps detached demand loading when an obsolete acquisition settles before restart setup`, async () => {
+    const requestedWhere = where()
+    const oldLoad = createDeferred<void>()
+    const newLoad = createDeferred<void>()
+    let syncRuns = 0
+    const collection = createCollection<{ id: string }>({
+      id: `obsolete-settlement-before-restart-setup`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ markReady }) => {
+          const run = syncRuns++
+          markReady()
+          return {
+            loadSubset: () => (run === 0 ? oldLoad.promise : newLoad.promise),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({ where: requestedWhere })
+      expect(subscription.status).toBe(`loadingSubset`)
+      await collection.cleanup()
+      oldLoad.resolve()
+      const beforeSetup = new Promise<string>((resolve) => {
+        queueMicrotask(() => resolve(subscription.status))
+      })
+      collection.startSyncImmediate()
+      expect(await beforeSetup).toBe(`loadingSubset`)
+    } finally {
+      oldLoad.resolve()
+      newLoad.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not retain a released replay rejection while a peer remains pending`, async () => {
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`first`)])
+    const secondWhere = new Func(`eq`, [
+      new PropRef([`id`]),
+      new Value(`second`),
+    ])
+    const released = createDeferred<void>()
+    const peer = createDeferred<void>()
+    const failure = new Error(`released acquisition failed`)
+    let loads = 0
+    let operations!: Parameters<SyncConfig<{ id: string }>[`sync`]>[0]
+    const collection = createCollection<{ id: string }>({
+      id: `released-replay-rejection-retention`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (next) => {
+          operations = next
+          next.markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              if (loads <= 2) return true
+              return loads === 3 ? released.promise : peer.promise
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      subscription.requestSnapshot({ where: secondWhere })
+      operations.begin()
+      operations.truncate()
+      operations.commit()
+      await Promise.resolve()
+      expect(loads).toBe(4)
+      subscription.releaseSnapshot(firstWhere)
+      released.reject(failure)
+      await Promise.resolve()
+      await Promise.resolve()
+
+      // Only the retention boundary needs a white-box observation. The
+      // public failure and publication checks live in the replay oracle.
+      const replayState = subscription as unknown as {
+        truncateReplayState?: { failures: Map<unknown, Error> }
+      }
+      expect([...replayState.truncateReplayState!.failures.values()]).toEqual(
+        [],
+      )
+      expect(subscription.lastError).toBeUndefined()
+      expect(subscription.status).toBe(`loadingSubset`)
+    } finally {
+      released.resolve()
+      peer.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not publish when adapter cleanup invalidates a starting acquisition`, async () => {
+    const requestedWhere = where()
+    const publications: Array<ReadonlyArray<string>> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    let cleanup: Promise<void> | undefined
+    let enteredLoader = false
+    const collection = createCollection<{ id: string }>({
+      id: `cleanup-during-starting-acquisition`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          operations.begin()
+          operations.write({ type: `insert`, value: { id: `row` } })
+          operations.commit()
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              enteredLoader = true
+              cleanup = collection.cleanup()
+              return true
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(
+      (changes) => publications.push(changes.map(({ value }) => value.id)),
+      { includeInitialState: false },
+    )
+
+    try {
+      const accepted = subscription.requestSnapshot({ where: requestedWhere })
+      expect(enteredLoader).toBe(true)
+      expect(accepted).toBe(false)
+      expect(publications).toEqual([])
+      expect(unloads).toEqual([])
+      await cleanup
+      expect(collection.status).toBe(`cleaned-up`)
+    } finally {
+      subscription.unsubscribe()
+      await cleanup
+    }
+  })
+
+  it(`does not acquire detached demand after cleanup reenters its restart status`, async () => {
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`first`)])
+    const secondWhere = new Func(`eq`, [
+      new PropRef([`id`]),
+      new Value(`second`),
+    ])
+    let loads = 0
+    let cleanup: Promise<void> | undefined
+    const collection = createCollection<{ id: string }>({
+      id: `cleanup-during-detached-restart`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              return true
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      subscription.requestSnapshot({ where: secondWhere })
+      expect(loads).toBe(2)
+      await collection.cleanup()
+      collection.startSyncImmediate()
+      subscription.on(`status:loadingSubset`, () => {
+        cleanup = collection.cleanup()
+      })
+      subscription.releaseSnapshot(firstWhere)
+      expect(subscription.status).toBe(`ready`)
+      await Promise.resolve()
+      expect(cleanup).toBeDefined()
+      await cleanup
+      expect(loads).toBe(2)
+      expect(collection.status).toBe(`cleaned-up`)
+    } finally {
+      subscription.unsubscribe()
+      await cleanup
+      await collection.cleanup()
+    }
+  })
+})
diff --git a/packages/db/tests/collection-subscription-replay-oracle.property.test.ts b/packages/db/tests/collection-subscription-replay-oracle.property.test.ts
index c94f5f9942..5c2c24ce2f 100644
--- a/packages/db/tests/collection-subscription-replay-oracle.property.test.ts
+++ b/packages/db/tests/collection-subscription-replay-oracle.property.test.ts
@@ -1,21 +1,29 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
 import { createDeferred } from '../src/deferred.js'
 import { BTreeIndex } from '../src/indexes/btree-index.js'
-import { ReverseIndex } from '../src/indexes/reverse-index.js'
 import { Func, PropRef, Value } from '../src/query/ir.js'
 import { DeduplicatedLoadSubset } from '../src/query/subset-dedupe.js'
 import { createTransaction } from '../src/transactions.js'
 import { valueOrderBy } from './collection-subscription-ordered-fixture.js'
 import { oracleRandomParameters, readOracleRunConfig } from './oracle-config.js'
-import { captureMicrotaskErrors, flushPromises } from './utils.js'
+import { declareOracle } from './oracle-declaration.js'
+import { flushPromises } from './utils.js'
+import {
+  expectSameSubsetRequest,
+  recordPublishedChanges,
+  sortedChanges,
+  sortedRows,
+} from './collection-subscription-replay-support.js'
+import type {
+  ReplayChange,
+  ReplayRow,
+} from './collection-subscription-replay-support.js'
 import type { Collection } from '../src/collection/index.js'
-import type { CollectionSubscription } from '../src/collection/subscription.js'
 import type {
   ChangeMessageOrDeleteKeyMessage,
   LoadSubsetOptions,
-  SyncConfig,
 } from '../src/types.js'
 import type { Scheduler } from 'fast-check'
 
@@ -52,11 +60,6 @@ import type { Scheduler } from 'fast-check'
  * oracle.
  */
 
-type ReplayRow = {
-  id: `one` | `two`
-  value: number
-}
-
 type ReplayDemandId = ReplayRow[`id`]
 
 type ReplayLoad = {
@@ -86,13 +89,6 @@ type SourceWrite = {
   rows: ReadonlyArray<ReplayRow>
 }
 
-type ReplayChange = {
-  type: `insert` | `update` | `delete`
-  key: string | number
-  value: ReplayRow
-  previousValue?: ReplayRow
-}
-
 type ReplayScenario = {
   initialRows: ReadonlyArray<ReplayRow>
   demandIds: ReadonlyArray<ReplayDemandId>
@@ -311,14 +307,6 @@ function rowsById(
   return new Map(rows.map((row) => [row.id, { ...row }]))
 }
 
-function sortedRows(
-  rows: ReadonlyMap<string | number, ReplayRow>,
-): Array<ReplayRow> {
-  return [...rows.values()].sort((left, right) =>
-    left.id.localeCompare(right.id),
-  )
-}
-
 function publicationDiff(
   baseline: ReadonlyMap<string | number, ReplayRow>,
   finalRows: ReadonlyMap<string | number, ReplayRow>,
@@ -349,49 +337,6 @@ function publicationDiff(
   return changes
 }
 
-function sortedChanges(
-  changes: ReadonlyArray<ReplayChange>,
-): Array<ReplayChange> {
-  return [...changes].sort((left, right) =>
-    String(left.key).localeCompare(String(right.key)),
-  )
-}
-
-function recordPublishedChanges(
-  visible: Map<string | number, ReplayRow>,
-  changes: ReadonlyArray<ReplayChange>,
-): Array<ReplayChange> {
-  const recorded = changes.map((change) => ({
-    type: change.type,
-    key: change.key,
-    value: { id: change.value.id, value: change.value.value },
-    ...(change.previousValue === undefined
-      ? {}
-      : {
-          previousValue: {
-            id: change.previousValue.id,
-            value: change.previousValue.value,
-          },
-        }),
-  }))
-  for (const change of recorded) {
-    if (change.type === `delete`) visible.delete(change.key)
-    else visible.set(change.key, { ...change.value })
-  }
-  return recorded
-}
-
-function expectSameSubsetRequest(
-  actual: LoadSubsetOptions,
-  expected: LoadSubsetOptions,
-): void {
-  expect(actual.where).toBe(expected.where)
-  expect(actual.orderBy).toBe(expected.orderBy)
-  expect(actual.limit).toBe(expected.limit)
-  expect(actual.cursor).toEqual(expected.cursor)
-  expect(actual.offset).toBe(expected.offset)
-}
-
 async function runReplayScenario(scenario: ReplayScenario): Promise<void> {
   let begin!: () => void
   let write!: (
@@ -1542,121 +1487,49 @@ async function runOptimisticReplayScenario(
 const { multiplier, ...replayConfig } = readOracleRunConfig()
 const generatedRuns = 30 * multiplier
 
-describe(`CollectionSubscription replay oracle`, () => {
-  it.each([`resolve`, `reject`] as const)(
-    `starts a replacement that lets canceled replay %s`,
-    async (outcome) => {
-      const oldReplay = createDeferred<void>()
-      const newReplay = createDeferred<void>()
-      const aborted = new DOMException(`superseded`, `AbortError`)
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const events: Array<string> = []
-      let operations!: Parameters<SyncConfig<ReplayRow>[`sync`]>[0]
-      const collection = createCollection<ReplayRow>({
-        id: `replacement-start-dependency-${outcome}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (sync) => {
-            operations = sync
-            sync.markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                events.push(`load:${loads.length}`)
-                if (loads.length === 1) {
-                  sync.begin()
-                  sync.write({ type: `insert`, value: { id: `one`, value: 0 } })
-                  sync.commit()
-                  return true
-                }
-                if (loads.length === 2) return oldReplay.promise
-                // This provider has stopped old request-scoped writes on abort.
-                // Its shared refresh protocol completes the old waiter only
-                // when a replacement acquisition registers. Completion does
-                // not require new result publication or a callback from core.
-                expect(loads[1]?.signal?.aborted).toBe(true)
-                if (outcome === `resolve`) oldReplay.resolve()
-                else oldReplay.reject(aborted)
-                events.push(`old:settled`)
-                return newReplay.promise
-              },
-              unloadSubset: (options) => {
-                unloads.push(options)
-              },
-            }
-          },
-        },
-      })
-      const visible = new Map<string | number, ReplayRow>()
-      const subscription = collection.subscribeChanges((changes) => {
-        for (const change of changes) {
-          if (change.type === `delete`) visible.delete(change.key)
-          else {
-            const { id, value } = change.value
-            visible.set(change.key, { id, value })
-          }
-        }
-      })
-      const truncate = () => {
-        operations.begin()
-        operations.truncate()
-        operations.commit()
-      }
-      try {
-        subscription.requestSnapshot({ optimizedOnly: false })
-        expect([...visible.values()]).toEqual([{ id: `one`, value: 0 }])
-        truncate()
-        const completion = subscription.pendingTruncateReplacement
-        expect(completion).toBeDefined()
-        let completed = false
-        const completionErrors: Array<unknown> = []
-        void completion?.then(
-          () => {
-            completed = true
-          },
-          (error: unknown) => completionErrors.push(error),
-        )
-        await flushPromises()
-        expect(loads).toHaveLength(2)
-        expect(oldReplay.isPending()).toBe(true)
-        expect([...visible.values()]).toEqual([{ id: `one`, value: 0 }])
-
-        truncate()
-        await flushPromises()
-        expect(events).toEqual([`load:1`, `load:2`, `load:3`, `old:settled`])
-        expect(oldReplay.isPending()).toBe(false)
-        expect([...visible.values()]).toEqual([{ id: `one`, value: 0 }])
-        expect(subscription.status).toBe(`loadingSubset`)
-        expect(subscription.lastError).toBeUndefined()
-        expect(completed).toBe(false)
-        expect(completionErrors).toEqual([])
+/**
+ * The filtered-replay model. Replay replaces every source row that the callback
+ * mirror does not show, as one insert batch, and the next ordered row is the
+ * first value of at least 1 that replay did not select privately.
+ */
+function predictFilteredReplay(
+  rows: ReadonlyArray<{ id: string; value: number }>,
+  initialPublicRows: ReadonlyMap<string, { id: string; value: number }>,
+  privatelySelected: ReadonlySet<string>,
+): {
+  nextOrdered: { id: string; value: number } | undefined
+  replacement: Array<string>
+} {
+  const nextOrdered = rows
+    .filter(({ value }) => value >= 1)
+    .sort((left, right) => left.value - right.value)
+    .find(({ id }) => !privatelySelected.has(id))
+  const replacement = rows
+    .filter(({ id }) => !initialPublicRows.has(id))
+    .map(({ id }) => `insert:${id}`)
+  return { nextOrdered, replacement }
+}
 
-        operations.begin()
-        operations.write({ type: `insert`, value: { id: `one`, value: 2 } })
-        await operations.commit()
-        newReplay.resolve()
-        await flushPromises()
-        expect([...visible.values()]).toEqual([{ id: `one`, value: 2 }])
-        expect(subscription.status).toBe(`ready`)
-        expect(subscription.lastError).toBeUndefined()
-        expect(completed).toBe(true)
-        expect(completionErrors).toEqual([])
-      } finally {
-        oldReplay.resolve()
-        newReplay.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-      expect(unloads).toHaveLength(loads.length)
-      for (const load of loads) {
-        expect(unloads.filter((unload) => unload === load)).toHaveLength(1)
-      }
-    },
-  )
+declareOracle({
+  check: [
+    runReplayScenario,
+    runSequentialReplayScenario,
+    runCleanupRestartScenario,
+    expectScheduledReplaySettlementIsGenerationSafe,
+    runSharedSubscriptionScenario,
+    runOptimisticReplayScenario,
+  ],
+  model: [publicationDiff, predictFilteredReplay],
+  grammar: [
+    replayScenarioArbitrary,
+    sequentialReplayScenarioArbitrary,
+    cleanupRestartScenarioArbitrary,
+    sharedSubscriptionScenarioArbitrary,
+    optimisticReplayScenarioArbitrary,
+  ],
+})
 
+describe(`CollectionSubscription replay oracle`, () => {
   it(`generates shared, failed, stale, released, and post-replay histories`, () => {
     const scenarios = fc.sample(replayScenarioArbitrary, {
       seed: 1755,
@@ -1699,20 +1572,40 @@ describe(`CollectionSubscription replay oracle`, () => {
     ).toBe(true)
   })
 
-  it(`aborts an in-flight initial acquisition before its replay replaces it`, async () => {
+  // A snapshot chosen while a direct truncate replay is pending enters the
+  // private replacement, not the callback mirror. Its key still excludes that
+  // row from the next ordered local selection. An earlier subscriber's callback
+  // is a legal reentry cut: it can read the source replacement before this
+  // subscriber receives the same source transaction.
+  it(`continues after a privately selected filtered snapshot during callback reentry`, async () => {
+    type Row = { id: string; value: number }
+    const rows: Array<Row> = [
+      { id: `one`, value: 1 },
+      { id: `two`, value: 2 },
+      { id: `three`, value: 3 },
+    ]
+    // The model separates a callback-visible row from rows selected locally
+    // during replay. Neither all source rows nor the callback mirror determines
+    // the next choice; only the filtered snapshot selected `one` here.
+    const privatelySelected = new Set(
+      rows.filter(({ id }) => id === `one`).map(({ id }) => id),
+    )
+    const initialPublicRows = new Map<string, Row>([[`one`, rows[0]!]])
+    const { nextOrdered, replacement: expectedReplacement } =
+      predictFilteredReplay(rows, initialPublicRows, privatelySelected)
+    const publicRows = new Map<string, Row>()
+
     let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
+    let write!: (message: { type: `insert`; value: Row }) => void
     let commit!: () => void
     let truncate!: () => void
-    const loads: Array<{
-      options: LoadSubsetOptions
-      deferred: ReturnType<typeof createDeferred<void>>
-    }> = []
-    const collection = createCollection<ReplayRow>({
-      id: `initial-acquisition-replay`,
-      getKey: (row) => row.id,
+    const heldReplay = createDeferred<void>()
+    const loadOptions: Array<LoadSubsetOptions> = []
+    let holdReplayRequest = false
+    let heldRequestCount = 0
+    const collection = createCollection<Row>({
+      id: `ordered-replay-mixed-snapshot-reentry`,
+      getKey: ({ id }) => id,
       syncMode: `on-demand`,
       sync: {
         sync: (params) => {
@@ -1720,3349 +1613,436 @@ describe(`CollectionSubscription replay oracle`, () => {
           write = params.write
           commit = params.commit
           truncate = params.truncate
+          begin()
+          for (const value of rows) write({ type: `insert`, value })
+          commit()
           params.markReady()
           return {
             loadSubset: (options) => {
-              const deferred = createDeferred<void>()
-              loads.push({ options, deferred })
-              return deferred.promise
+              loadOptions.push(options)
+              if (
+                holdReplayRequest &&
+                options.orderBy !== undefined &&
+                options.offset === 0 &&
+                options.cursor === undefined
+              ) {
+                holdReplayRequest = false
+                heldRequestCount++
+                return heldReplay.promise
+              }
+              return true
             },
             unloadSubset: () => {},
           }
         },
       },
     })
-    const visible = new Map<string | number, ReplayRow>()
-    const subscription = collection.subscribeChanges((changes) => {
+    const index = collection.createIndex((row) => row.value, {
+      indexType: BTreeIndex,
+    })
+    const orderBy = valueOrderBy()
+    const whereOne = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const batches: Array<Array<string>> = []
+    const invalidChanges: Array<string> = []
+    let armed = false
+    let reentered = false
+    const trigger = collection.subscribeChanges(
+      (changes) => {
+        if (!armed || !changes.some(({ type }) => type === `insert`)) return
+        armed = false
+        reentered = true
+        target.requestSnapshot({ where: whereOne })
+        target.requestLimitedSnapshot({ orderBy, limit: 1 })
+      },
+      { includeInitialState: false },
+    )
+    const target = collection.subscribeChanges((changes) => {
+      if (changes.length === 0) return
+      const batch: Array<string> = []
       for (const change of changes) {
-        if (change.type === `delete`) visible.delete(change.key)
-        else {
-          visible.set(change.key, {
-            id: change.value.id,
-            value: change.value.value,
-          })
+        batch.push(`${change.type}:${change.key}`)
+        if (change.type === `insert`) {
+          if (publicRows.has(String(change.key)))
+            invalidChanges.push(`duplicate insert:${change.key}`)
+          publicRows.set(String(change.key), change.value)
+        } else if (change.type === `delete`) {
+          publicRows.delete(String(change.key))
+        } else {
+          publicRows.set(String(change.key), change.value)
         }
       }
+      batches.push(batch)
     })
-
+    target.setOrderByIndex(index)
     try {
-      subscription.requestSnapshot({ optimizedOnly: false })
+      target.requestLimitedSnapshot({ orderBy, limit: 1 })
+      expect(batches).toEqual([[`insert:one`]])
+      batches.length = 0
+
+      target.requestSnapshot({
+        where: new Func(`eq`, [new PropRef([`id`]), new Value(`missing`)]),
+      })
+      holdReplayRequest = true
       begin()
       truncate()
       commit()
       await flushPromises()
-      expect(loads[0]?.options.signal?.aborted).toBe(true)
+      expect(heldRequestCount).toBe(1)
 
+      armed = true
       begin()
-      write({ type: `insert`, value: { id: `two`, value: 2 } })
+      for (const value of rows) write({ type: `insert`, value })
       commit()
-      loads[1]?.deferred.resolve()
       await flushPromises()
 
-      if (!loads[0]?.options.signal?.aborted) {
-        begin()
-        write({ type: `insert`, value: { id: `one`, value: 1 } })
-        commit()
-      }
-      loads[0]?.deferred.resolve()
+      expect(reentered).toBe(true)
+      expect(batches).toEqual([])
+      expect(loadOptions.at(-1)).toMatchObject({ offset: 0 })
+      expect(loadOptions.at(-1)?.limit).toBeGreaterThanOrEqual(
+        1 + privatelySelected.size + Number(nextOrdered !== undefined),
+      )
+      expect(loadOptions.at(-1)?.cursor?.lastKey).toBeUndefined()
+      heldReplay.resolve()
       await flushPromises()
-
-      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
-      expect(subscription.status).toBe(`ready`)
+      expect(batches.map((batch) => [...batch].sort())).toEqual([
+        expectedReplacement.sort(),
+      ])
+      expect(invalidChanges).toEqual([])
+      expect([...publicRows.keys()].sort()).toEqual(
+        rows.map(({ id }) => id).sort(),
+      )
     } finally {
-      subscription.unsubscribe()
+      heldReplay.resolve()
+      trigger.unsubscribe()
+      target.unsubscribe()
       await collection.cleanup()
     }
   })
 
-  it(`keeps the published replacement after a reentrant replay fails`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    let loadCount = 0
-    const replayLoads: Array<ReturnType<typeof createDeferred<void>>> = []
-    const collection = createCollection<ReplayRow>({
-      id: `reentrant-replay`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          begin = params.begin
-          write = params.write
-          commit = params.commit
-          truncate = params.truncate
-          params.markReady()
-          return {
-            loadSubset: () => {
-              loadCount++
-              if (loadCount === 1) {
-                begin()
-                write({ type: `insert`, value: { id: `one`, value: 1 } })
-                commit()
-                return true
-              }
-
-              const deferred = createDeferred<void>()
-              replayLoads.push(deferred)
-              return deferred.promise
+  it(`keeps private row tracking through consecutive failed replays`, async () => {
+    await runReplayScenario({
+      initialRows: [
+        { id: `one`, value: -2 },
+        { id: `two`, value: 0 },
+      ],
+      demandIds: [`two`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `two`,
+              rows: [],
+              outcome: `reject`,
+              writeBeforeSettlement: true,
             },
-            unloadSubset: () => {},
-          }
+          ],
         },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    let startedNestedReplay = false
-    const subscription = collection.subscribeChanges((changes) => {
-      for (const change of changes) {
-        if (change.type === `delete`) visible.delete(change.key)
-        else {
-          visible.set(change.key, {
-            id: change.value.id,
-            value: change.value.value,
-          })
-        }
-      }
-
-      if (!startedNestedReplay && visible.get(`one`)?.value === 2) {
-        startedNestedReplay = true
-        begin()
-        truncate()
-        commit()
-      }
+        {
+          loads: [
+            {
+              demandId: `two`,
+              rows: [],
+              outcome: `reject`,
+              writeBeforeSettlement: true,
+            },
+          ],
+        },
+        {
+          loads: [
+            {
+              demandId: `two`,
+              rows: [{ id: `two`, value: -2 }],
+              outcome: `resolve`,
+              writeBeforeSettlement: true,
+            },
+          ],
+        },
+      ],
+      settlementOrder: [0, 2, 1],
+      settlementPhases: [0, 1, 2],
+      afterSettlement: [],
     })
+  })
 
-    try {
-      subscription.requestSnapshot({ optimizedOnly: false })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      begin()
-      write({ type: `insert`, value: { id: `one`, value: 2 } })
-      commit()
-      replayLoads[0]?.resolve()
-      await flushPromises()
-      expect(startedNestedReplay).toBe(true)
-
-      replayLoads[1]?.reject(new Error(`nested replay failed`))
-      await flushPromises()
-      begin()
-      write({ type: `insert`, value: { id: `one`, value: 1 } })
-      commit()
-
-      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`ignores an aborted released demand while publishing the remaining replay`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replays: Array<{
-      options: { signal?: AbortSignal }
-      deferred: ReturnType<typeof createDeferred<void>>
-    }> = []
-    let loadCount = 0
-    const collection = createCollection<ReplayRow>({
-      id: `released-demand-replay`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          begin = params.begin
-          write = params.write
-          commit = params.commit
-          truncate = params.truncate
-          params.markReady()
-          return {
-            loadSubset: (options) => {
-              loadCount++
-              if (loadCount === 1) {
-                begin()
-                write({ type: `insert`, value: { id: `one`, value: 0 } })
-                write({ type: `insert`, value: { id: `two`, value: 0 } })
-                commit()
-                return true
-              }
-              if (loadCount === 2) return true
-
-              const deferred = createDeferred<void>()
-              replays.push({ options, deferred })
-              return deferred.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    const subscription = collection.subscribeChanges((changes) => {
-      for (const change of changes) {
-        if (change.type === `delete`) visible.delete(change.key)
-        else {
-          visible.set(change.key, {
-            id: change.value.id,
-            value: change.value.value,
-          })
-        }
-      }
-    })
-    const demandOne = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const demandTwo = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-
-    try {
-      subscription.requestSnapshot({ where: demandOne })
-      subscription.requestSnapshot({ where: demandTwo })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      subscription.releaseSnapshot(demandOne)
-      expect(replays[0]?.options.signal?.aborted).toBe(true)
-      begin()
-      write({ type: `insert`, value: { id: `two`, value: 2 } })
-      commit()
-      replays[1]?.deferred.resolve()
-      await flushPromises()
-
-      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
-      expect(subscription.status).toBe(`ready`)
-      expect(subscription.lastError).toBeUndefined()
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  const orderedReplayCases = ([`asc`, `desc`] as const).flatMap((direction) => [
-    ...([`return`, `resolve`] as const).flatMap((delivery) =>
-      ([`same`, `changed`] as const).map((identity) => ({
-        name: `${direction} ${delivery} with ${identity} keys`,
-        direction,
-        delivery,
-        identity,
-      })),
-    ),
-    ...([`throw`, `reject`] as const).map((delivery) => ({
-      name: `${direction} ${delivery}`,
-      direction,
-      delivery,
-      identity: `none` as const,
-    })),
-  ])
-
-  it.each(orderedReplayCases)(
-    `requests a safe ordered provider prefix after replay: $name`,
-    async ({ direction, delivery, identity }) => {
-      type OrderedReplayRow = {
-        id: `one` | `two` | `three` | `four`
-        value: number
-      }
-      let begin!: () => void
-      let write!: (
-        message: ChangeMessageOrDeleteKeyMessage<OrderedReplayRow, string>,
-      ) => void
-      let commit!: () => void
-      let truncate!: () => void
-      let loadCount = 0
-      const loadOptions: Array<LoadSubsetOptions> = []
-      const replayLoads: Array<ReturnType<typeof createDeferred<void>>> = []
-      const replayRows: ReadonlyArray<OrderedReplayRow> =
-        identity === `same`
-          ? [
-              { id: `one`, value: 1 },
-              { id: `two`, value: 2 },
-            ]
-          : [
-              { id: `three`, value: 1 },
-              { id: `four`, value: 2 },
-            ]
-      let replayRowsInstalled = false
-      const installReplayRows = () => {
-        if (replayRowsInstalled || identity === `none`) return
-        replayRowsInstalled = true
-        begin()
-        for (const row of replayRows) {
-          write({ type: `insert`, value: row })
-        }
-        commit()
-      }
-      const collection = createCollection<OrderedReplayRow>({
-        id: `ordered-replay-${direction}-${delivery}-${identity}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (params) => {
-            begin = params.begin
-            write = params.write
-            commit = params.commit
-            truncate = params.truncate
-            begin()
-            write({ type: `insert`, value: { id: `one`, value: 1 } })
-            write({ type: `insert`, value: { id: `two`, value: 2 } })
-            commit()
-            params.markReady()
-            return {
-              loadSubset: (options) => {
-                loadCount++
-                loadOptions.push(options)
-                if (loadCount <= 2) return true
-                if (loadCount > 4) return true
-
-                if (delivery === `return`) {
-                  installReplayRows()
-                  return true
-                }
-                if (delivery === `throw`) {
-                  if (loadCount === 3) {
-                    throw new Error(`ordered replay failed`)
-                  }
-                  return true
-                }
-
-                const deferred = createDeferred<void>()
-                replayLoads.push(deferred)
-                return deferred.promise
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const index = collection.createIndex((row) => row.value, {
-        indexType: BTreeIndex,
-      })
-      const orderedIndex =
-        direction === `asc` ? index : new ReverseIndex(index, true)
-      const orderBy = valueOrderBy(direction)
-      const batches: Array<Array<OrderedReplayRow[`id`]>> = []
-      const subscription = collection.subscribeChanges((changes) => {
-        batches.push(changes.map(({ value }) => value.id))
-      })
-      subscription.setOrderByIndex(orderedIndex)
-
-      const initialIds =
-        direction === `asc`
-          ? ([`one`, `two`] as const)
-          : ([`two`, `one`] as const)
-      const replacementIds =
-        direction === `asc`
-          ? ([`three`, `four`] as const)
-          : ([`four`, `three`] as const)
-      const succeeds = delivery === `return` || delivery === `resolve`
-      const expectedIds = identity === `changed` ? replacementIds : initialIds
-
-      try {
-        subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
-        expect(batches).toEqual([[initialIds[0]]])
-        subscription.requestLimitedSnapshot({
-          orderBy,
-          limit: 1,
-          minValues: [direction === `asc` ? 1 : 2],
-        })
-        expect(loadOptions[1]).toMatchObject({ offset: 0 })
-        expect(loadOptions[1]?.limit).toBeUndefined()
-        expect(loadOptions[1]?.cursor?.lastKey).toBeUndefined()
-
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-        expectSameSubsetRequest(loadOptions[2]!, loadOptions[0]!)
-        expectSameSubsetRequest(loadOptions[3]!, loadOptions[1]!)
-
-        if (delivery === `resolve`) {
-          expect(replayLoads).toHaveLength(2)
-          installReplayRows()
-          replayLoads[0]?.resolve()
-          replayLoads[1]?.resolve()
-        } else if (delivery === `reject`) {
-          expect(replayLoads).toHaveLength(2)
-          replayLoads[0]?.reject(new Error(`ordered replay failed`))
-          replayLoads[1]?.resolve()
-        } else {
-          expect(replayLoads).toEqual([])
-        }
-        await flushPromises()
-        expect(collection.toArray.map(({ id }) => id).sort()).toEqual(
-          succeeds ? [...expectedIds].sort() : [],
-        )
-
-        const batchCount = batches.length
-        subscription.requestLimitedSnapshot({
-          orderBy,
-          limit: 1,
-          minValues: [direction === `asc` ? 2 : 1],
-        })
-        expect(loadOptions[4]).toMatchObject({ offset: 0 })
-        expect(loadOptions[4]?.cursor?.lastKey).toBeUndefined()
-        if (succeeds) expect(batches.at(-1)).toEqual([])
-        else expect(batches).toHaveLength(batchCount)
-      } finally {
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A successful replacement restores the public row, but that row need not
-  // be a provider prefix. The plain remote array is the reference order. A
-  // provider may honor a last-key cursor before an offset; naming the sparse
-  // public row as that cursor would hide every earlier row. The held replay
-  // separates replacement settlement from the next ordered acquisition.
-  it(`loads rows before a sparse public key after successful replay`, async () => {
-    type Row = { id: string; value: number }
-    const remote: Array<Row> = [
-      { id: `one`, value: 1 },
-      { id: `two`, value: 2 },
-      { id: `three`, value: 3 },
-    ]
-    let begin!: () => void
-    let write!: (message: { type: `insert`; value: Row }) => void
-    let commit!: () => void
-    let truncate!: () => void
-    let holdReplay = false
-    let heldRequests = 0
-    const held = createDeferred<void>()
-    const orderedLoads: Array<LoadSubsetOptions> = []
-    const collection = createCollection<Row>({
-      id: `ordered-replay-sparse-provider-prefix`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          begin = params.begin
-          write = params.write
-          commit = params.commit
-          truncate = params.truncate
-          begin()
-          write({ type: `insert`, value: remote[2]! })
-          commit()
-          params.markReady()
-          return {
-            loadSubset: (options) => {
-              if (holdReplay && options.orderBy === undefined) {
-                holdReplay = false
-                heldRequests++
-                return held.promise
-              }
-              if (options.orderBy === undefined) return true
-
-              orderedLoads.push(options)
-              const cursorKey = options.cursor?.lastKey
-              const start =
-                cursorKey === undefined
-                  ? (options.offset ?? 0)
-                  : remote.findIndex(({ id }) => id === cursorKey) + 1
-              const page = remote.slice(
-                start,
-                options.limit === undefined ? undefined : start + options.limit,
-              )
-              const missing = page.filter(({ id }) => !collection.has(id))
-              if (missing.length > 0) {
-                begin()
-                for (const value of missing) write({ type: `insert`, value })
-                commit()
-              }
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const index = collection.createIndex((row) => row.value, {
-      indexType: BTreeIndex,
-    })
-    const orderBy = valueOrderBy()
-    const whereThree = new Func(`eq`, [new PropRef([`id`]), new Value(`three`)])
-    const publicRows = new Map<string, Row>()
-    const invalidChanges: Array<string> = []
-    const subscription = collection.subscribeChanges((changes) => {
-      for (const change of changes) {
-        const key = String(change.key)
-        if (change.type === `delete`) {
-          if (!publicRows.delete(key))
-            invalidChanges.push(`delete absent:${key}`)
-        } else {
-          if (change.type === `insert` && publicRows.has(key))
-            invalidChanges.push(`duplicate insert:${key}`)
-          publicRows.set(key, change.value)
-        }
-      }
-    })
-    subscription.setOrderByIndex(index)
-    try {
-      subscription.requestSnapshot({ where: whereThree })
-      expect([...publicRows.keys()]).toEqual([`three`])
-
-      holdReplay = true
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(heldRequests).toBe(1)
-      begin()
-      write({ type: `insert`, value: remote[2]! })
-      commit()
-      expect([...publicRows.keys()]).toEqual([`three`])
-      held.resolve()
-      await flushPromises()
-
-      for (const expectedRow of remote) {
-        subscription.requestLimitedSnapshot({
-          orderBy,
-          limit: 1,
-          minValues: [0],
-        })
-        expect(publicRows.has(expectedRow.id)).toBe(true)
-      }
-      await flushPromises()
-      expect(orderedLoads).toHaveLength(remote.length)
-      expect(orderedLoads[0]).toMatchObject({ offset: 0 })
-      expect(orderedLoads[0]?.cursor?.lastKey).toBeUndefined()
-      expect(invalidChanges).toEqual([])
-      expect([...publicRows.keys()].sort()).toEqual(
-        remote.map(({ id }) => id).sort(),
-      )
-    } finally {
-      held.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  // A direct subscriber buffers ordered rows privately while a replay is
-  // pending. Each row still counts once: repeated ordered snapshots during the
-  // replay continue after the rows already chosen. Those private selections
-  // widen the provider prefix without claiming a provider cursor boundary.
-  it(`continues after buffered rows when ordered snapshots repeat during a replay`, async () => {
-    type Row = { id: string; value: number }
-    let begin!: () => void
-    let write!: (message: { type: `insert`; value: Row }) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const loadOptions: Array<LoadSubsetOptions> = []
-    const heldReplay = createDeferred<void>()
-    let holdReplayRequest = false
-    let heldRequestCount = 0
-    const rows: Array<Row> = [
-      { id: `one`, value: 1 },
-      { id: `two`, value: 2 },
-      { id: `three`, value: 3 },
-    ]
-    const collection = createCollection<Row>({
-      id: `ordered-replay-repeated-snapshots`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          begin = params.begin
-          write = params.write
-          commit = params.commit
-          truncate = params.truncate
-          begin()
-          for (const value of rows) write({ type: `insert`, value })
-          commit()
-          params.markReady()
-          return {
-            // Hold the replay of the first ordered demand. The phase and
-            // request data identify it independently of other load calls.
-            loadSubset: (options) => {
-              loadOptions.push(options)
-              if (
-                holdReplayRequest &&
-                options.orderBy !== undefined &&
-                options.offset === 0 &&
-                options.cursor === undefined
-              ) {
-                holdReplayRequest = false
-                heldRequestCount++
-                return heldReplay.promise
-              }
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const index = collection.createIndex((row) => row.value, {
-      indexType: BTreeIndex,
-    })
-    const orderBy = valueOrderBy()
-    // The public subscriber model starts with one visible row. Replay adds
-    // the other two as one replacement batch, without re-inserting that row.
-    const publicRows = new Map<string, Row>()
-    const batches: Array<Array<string>> = []
-    const invalidChanges: Array<string> = []
-    const subscription = collection.subscribeChanges((changes) => {
-      const batch: Array<string> = []
-      for (const change of changes) {
-        batch.push(`${change.type}:${change.key}`)
-        if (change.type === `insert`) {
-          if (publicRows.has(String(change.key)))
-            invalidChanges.push(`duplicate insert:${change.key}`)
-          publicRows.set(String(change.key), change.value)
-        } else if (change.type === `delete`) {
-          publicRows.delete(String(change.key))
-        } else {
-          publicRows.set(String(change.key), change.value)
-        }
-      }
-      if (batch.length > 0) batches.push(batch)
-    })
-    subscription.setOrderByIndex(index)
-    try {
-      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
-      expect(batches).toEqual([[`insert:one`]])
-      // An unrelated empty demand may be added before replay. It must not
-      // determine which acquisition the fixture holds.
-      subscription.requestSnapshot({
-        where: new Func(`eq`, [new PropRef([`id`]), new Value(`missing`)]),
-      })
-      holdReplayRequest = true
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(heldRequestCount).toBe(1)
-      begin()
-      for (const value of rows) write({ type: `insert`, value })
-      commit()
-      await flushPromises()
-      expect(batches).toEqual([[`insert:one`]])
-
-      const before = loadOptions.length
-      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
-      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
-      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
-      expect(loadOptions[before + 2]).toMatchObject({ offset: 0 })
-      expect(loadOptions[before + 2]?.limit).toBeGreaterThanOrEqual(4)
-      expect(loadOptions[before + 2]?.cursor?.lastKey).toBeUndefined()
-      expect(batches).toEqual([[`insert:one`]])
-      heldReplay.resolve()
-      await flushPromises()
-      expect(batches.map((batch) => [...batch].sort())).toEqual([
-        [`insert:one`],
-        [`insert:three`, `insert:two`],
-      ])
-      expect(invalidChanges).toEqual([])
-      expect([...publicRows.keys()].sort()).toEqual(
-        rows.map(({ id }) => id).sort(),
-      )
-    } finally {
-      heldReplay.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  // A snapshot chosen while a direct truncate replay is pending enters the
-  // private replacement, not the callback mirror. Its key still excludes that
-  // row from the next ordered local selection. An earlier subscriber's callback
-  // is a legal reentry cut: it can read the source replacement before this
-  // subscriber receives the same source transaction.
-  it(`continues after a privately selected filtered snapshot during callback reentry`, async () => {
-    type Row = { id: string; value: number }
-    const rows: Array<Row> = [
-      { id: `one`, value: 1 },
-      { id: `two`, value: 2 },
-      { id: `three`, value: 3 },
-    ]
-    // The model separates a callback-visible row from rows selected locally
-    // during replay. Neither all source rows nor the callback mirror determines
-    // the next choice; only the filtered snapshot selected `one` here.
-    const privatelySelected = new Set(
-      rows.filter(({ id }) => id === `one`).map(({ id }) => id),
-    )
-    const nextOrdered = rows
-      .filter(({ value }) => value >= 1)
-      .sort((left, right) => left.value - right.value)
-      .find(({ id }) => !privatelySelected.has(id))
-    const initialPublicRows = new Map<string, Row>([[`one`, rows[0]!]])
-    const expectedReplacement = rows
-      .filter(({ id }) => !initialPublicRows.has(id))
-      .map(({ id }) => `insert:${id}`)
-    const publicRows = new Map<string, Row>()
-
-    let begin!: () => void
-    let write!: (message: { type: `insert`; value: Row }) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const heldReplay = createDeferred<void>()
-    const loadOptions: Array<LoadSubsetOptions> = []
-    let holdReplayRequest = false
-    let heldRequestCount = 0
-    const collection = createCollection<Row>({
-      id: `ordered-replay-mixed-snapshot-reentry`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          begin = params.begin
-          write = params.write
-          commit = params.commit
-          truncate = params.truncate
-          begin()
-          for (const value of rows) write({ type: `insert`, value })
-          commit()
-          params.markReady()
-          return {
-            loadSubset: (options) => {
-              loadOptions.push(options)
-              if (
-                holdReplayRequest &&
-                options.orderBy !== undefined &&
-                options.offset === 0 &&
-                options.cursor === undefined
-              ) {
-                holdReplayRequest = false
-                heldRequestCount++
-                return heldReplay.promise
-              }
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const index = collection.createIndex((row) => row.value, {
-      indexType: BTreeIndex,
-    })
-    const orderBy = valueOrderBy()
-    const whereOne = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const batches: Array<Array<string>> = []
-    const invalidChanges: Array<string> = []
-    let armed = false
-    let reentered = false
-    const trigger = collection.subscribeChanges(
-      (changes) => {
-        if (!armed || !changes.some(({ type }) => type === `insert`)) return
-        armed = false
-        reentered = true
-        target.requestSnapshot({ where: whereOne })
-        target.requestLimitedSnapshot({ orderBy, limit: 1 })
-      },
-      { includeInitialState: false },
-    )
-    const target = collection.subscribeChanges((changes) => {
-      if (changes.length === 0) return
-      const batch: Array<string> = []
-      for (const change of changes) {
-        batch.push(`${change.type}:${change.key}`)
-        if (change.type === `insert`) {
-          if (publicRows.has(String(change.key)))
-            invalidChanges.push(`duplicate insert:${change.key}`)
-          publicRows.set(String(change.key), change.value)
-        } else if (change.type === `delete`) {
-          publicRows.delete(String(change.key))
-        } else {
-          publicRows.set(String(change.key), change.value)
-        }
-      }
-      batches.push(batch)
-    })
-    target.setOrderByIndex(index)
-    try {
-      target.requestLimitedSnapshot({ orderBy, limit: 1 })
-      expect(batches).toEqual([[`insert:one`]])
-      batches.length = 0
-
-      target.requestSnapshot({
-        where: new Func(`eq`, [new PropRef([`id`]), new Value(`missing`)]),
-      })
-      holdReplayRequest = true
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(heldRequestCount).toBe(1)
-
-      armed = true
-      begin()
-      for (const value of rows) write({ type: `insert`, value })
-      commit()
-      await flushPromises()
-
-      expect(reentered).toBe(true)
-      expect(batches).toEqual([])
-      expect(loadOptions.at(-1)).toMatchObject({ offset: 0 })
-      expect(loadOptions.at(-1)?.limit).toBeGreaterThanOrEqual(
-        1 + privatelySelected.size + Number(nextOrdered !== undefined),
-      )
-      expect(loadOptions.at(-1)?.cursor?.lastKey).toBeUndefined()
-      heldReplay.resolve()
-      await flushPromises()
-      expect(batches.map((batch) => [...batch].sort())).toEqual([
-        expectedReplacement.sort(),
-      ])
-      expect(invalidChanges).toEqual([])
-      expect([...publicRows.keys()].sort()).toEqual(
-        rows.map(({ id }) => id).sort(),
-      )
-    } finally {
-      heldReplay.resolve()
-      trigger.unsubscribe()
-      target.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`keeps private row tracking through consecutive failed replays`, async () => {
-    await runReplayScenario({
-      initialRows: [
-        { id: `one`, value: -2 },
-        { id: `two`, value: 0 },
-      ],
-      demandIds: [`two`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `two`,
-              rows: [],
-              outcome: `reject`,
-              writeBeforeSettlement: true,
-            },
-          ],
-        },
-        {
-          loads: [
-            {
-              demandId: `two`,
-              rows: [],
-              outcome: `reject`,
-              writeBeforeSettlement: true,
-            },
-          ],
-        },
-        {
-          loads: [
-            {
-              demandId: `two`,
-              rows: [{ id: `two`, value: -2 }],
-              outcome: `resolve`,
-              writeBeforeSettlement: true,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [0, 2, 1],
-      settlementPhases: [0, 1, 2],
-      afterSettlement: [],
-    })
-  })
-
-  it(`retains a successful retry after retiring its failed peer`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `two`, value: 0 }],
-      demandIds: [`one`, `two`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 1 }],
-              outcome: `reject`,
-              writeBeforeSettlement: false,
-            },
-            {
-              demandId: `two`,
-              rows: [{ id: `two`, value: -1 }],
-              outcome: `reject`,
-              writeBeforeSettlement: false,
-            },
-          ],
-        },
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 2 }],
-              outcome: `reject`,
-              writeBeforeSettlement: true,
-            },
-            {
-              demandId: `two`,
-              rows: [{ id: `two`, value: 1 }],
-              outcome: `resolve`,
-              writeBeforeSettlement: false,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [3, 1, 0, 2],
-      settlementPhases: [0, 0, 1, 1],
-      releaseOnLastAttempt: `one`,
-      afterSettlement: [{ type: `request`, demandId: `one` }],
-    })
-  })
-
-  it(`does not republish an identical snapshot after a synchronous replay failure`, async () => {
-    await runSequentialReplayScenario({
-      initialRows: [{ id: `one`, value: 0 }],
-      loads: [
-        { rows: [], outcome: `throw` },
-        { rows: [{ id: `one`, value: 0 }], outcome: `return` },
-      ],
-    })
-  })
-
-  it(`keeps a same-key source replacement private after a failed replay`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `one`, value: 1 }],
-      demandIds: [`one`],
-      attempts: [
-        {
-          loads: [{ demandId: `one`, rows: [], outcome: `reject` }],
-        },
-      ],
-      settlementOrder: [0],
-      settlementPhases: [0],
-      afterSettlement: [{ type: `put`, row: { id: `one`, value: 2 } }],
-    })
-  })
-
-  it(`does not let an unpublished truncate delete suppress a later insert`, async () => {
-    await runReplayScenario({
-      initialRows: [],
-      demandIds: [`two`, `one`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `two`,
-              rows: [{ id: `two`, value: -1 }],
-              outcome: `resolve`,
-            },
-            { demandId: `one`, rows: [], outcome: `reject` },
-          ],
-        },
-        {
-          loads: [
-            { demandId: `two`, rows: [], outcome: `resolve` },
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: -1 }],
-              outcome: `resolve`,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [0, 1, 2, 3],
-      settlementPhases: [0, 0, 1, 1],
-      afterSettlement: [{ type: `put`, row: { id: `two`, value: 1 } }],
-    })
-  })
-
-  it(`lets the newest successful replay replace an older failed replay`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `one`, value: 1 }],
-      demandIds: [`one`],
-      attempts: [
-        {
-          loads: [{ demandId: `one`, rows: [], outcome: `reject` }],
-        },
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 2 }],
-              outcome: `resolve`,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [1, 0],
-      settlementPhases: [1, 1],
-      afterSettlement: [],
-    })
-  })
-
-  it(`ignores an obsolete replay that settles after the newest replay`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `one`, value: 0 }],
-      demandIds: [`one`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 1 }],
-              outcome: `resolve`,
-            },
-          ],
-        },
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 2 }],
-              outcome: `resolve`,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [1, 0],
-      settlementPhases: [1, 1],
-      afterSettlement: [],
-    })
-  })
-
-  it(`releases every successful overlapping replay acquisition`, async () => {
-    await runReplayScenario({
-      initialRows: [],
-      demandIds: [`one`],
-      attempts: [
-        {
-          loads: [{ demandId: `one`, rows: [], outcome: `resolve` }],
-        },
-        {
-          loads: [{ demandId: `one`, rows: [], outcome: `resolve` }],
-        },
-      ],
-      settlementOrder: [1, 0],
-      settlementPhases: [1, 1],
-      afterSettlement: [],
-    })
-  })
-
-  it(`uses the newest complete multi-demand replay`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `one`, value: 1 }],
-      demandIds: [`one`, `two`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 2 }],
-              outcome: `resolve`,
-            },
-            { demandId: `two`, rows: [], outcome: `reject` },
-          ],
-        },
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 3 }],
-              outcome: `resolve`,
-            },
-            {
-              demandId: `two`,
-              rows: [{ id: `two`, value: 4 }],
-              outcome: `resolve`,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [2, 3, 0, 1],
-      settlementPhases: [1, 1, 1, 1],
-      afterSettlement: [],
-    })
-  })
-
-  it(`retains applied rows after their replay demand is released`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `two`, value: 0 }],
-      demandIds: [`one`, `two`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 1 }],
-              outcome: `reject`,
-              writeBeforeSettlement: true,
-            },
-            {
-              demandId: `two`,
-              rows: [{ id: `two`, value: 2 }],
-              outcome: `resolve`,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [0, 1],
-      settlementPhases: [0, 0],
-      releaseOnLastAttempt: `one`,
-      afterSettlement: [{ type: `request`, demandId: `one` }],
-    })
-  })
-
-  it(`refreshes a retained row when its final released demand is reacquired`, async () => {
-    // Reduced from the fixed replay corpus after removing release-time pruning.
-    await runReplayScenario({
-      initialRows: [{ id: `one`, value: 0 }],
-      demandIds: [`one`],
-      attempts: [
-        {
-          loads: [
-            {
-              demandId: `one`,
-              rows: [{ id: `one`, value: 1 }],
-              outcome: `resolve`,
-              writeBeforeSettlement: true,
-            },
-          ],
-        },
-      ],
-      settlementOrder: [0],
-      settlementPhases: [0],
-      releaseOnLastAttempt: `one`,
-      afterSettlement: [{ type: `request`, demandId: `one` }],
-    })
-  })
-
-  // Law 9 at retirement: a failure in the current attempt keeps the replay
-  // private even after the last owner is released. Each site writes a row
-  // before it fails, so publishing the private rows would show that row.
-  // A throwing release is not such a failure; the next test owns that site.
-  it.each([
-    `replay load throws`,
-    `old lease unload throws`,
-    `new request throws`,
-  ])(
-    `keeps a replay private at retirement after a synchronous failure, except a throwing release: %s`,
-    async (site) => {
-      let begin!: () => void
-      let write!: (message: {
-        type: `insert` | `update`
-        value: ReplayRow
-      }) => void
-      let commit!: () => void
-      let truncate!: () => void
-      let loads = 0
-      let unloads = 0
-      const writeRow = (row: ReplayRow) => {
-        begin()
-        write({ type: `insert`, value: row })
-        commit()
-      }
-      const collection = createCollection<ReplayRow>({
-        id: `retired-replay-synchronous-failure-${site}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            write = operations.write
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                if (loads === 1) {
-                  writeRow({ id: `one`, value: 1 })
-                  return true
-                }
-                if (site === `replay load throws` && loads === 2) {
-                  writeRow({ id: `one`, value: 5 })
-                  throw new Error(`replay load failed`)
-                }
-                if (site === `new request throws` && loads === 3) {
-                  writeRow({ id: `two`, value: 2 })
-                  throw new Error(`request failed`)
-                }
-                return createDeferred<void>().promise
-              },
-              unloadSubset: () => {
-                unloads++
-                if (site === `old lease unload throws` && unloads === 1) {
-                  writeRow({ id: `two`, value: 2 })
-                  throw new Error(`unload failed`)
-                }
-              },
-            }
-          },
-        },
-      })
-      const visible = new Map<string | number, ReplayRow>()
-      const uncaught = captureMicrotaskErrors()
-      const subscription = collection.subscribeChanges((changes) => {
-        recordPublishedChanges(visible, changes)
-      })
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      try {
-        subscription.requestSnapshot({ where, optimizedOnly: false })
-        await flushPromises()
-        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 1 }])
-
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-        if (site === `new request throws`) {
-          // A synchronous throw is a rejection: the request fails its load.
-          expect(() =>
-            subscription.requestSnapshot({
-              where: new Func(`eq`, [new PropRef([`id`]), new Value(`two`)]),
-              optimizedOnly: false,
-            }),
-          ).not.toThrow()
-          await flushPromises()
-        }
-        subscription.releaseSnapshot(where)
-        await flushPromises()
-
-        expect(subscription.pendingTruncateReplacement).toBeUndefined()
-        // A release error fails no replay, so the retired replay publishes
-        // the rows it holds: the truncate removed `one`, and the adapter
-        // wrote `two` before it threw.
-        expect(sortedRows(visible)).toEqual(
-          site === `old lease unload throws`
-            ? [{ id: `two`, value: 2 }]
-            : [{ id: `one`, value: 1 }],
-        )
-        expect(
-          uncaught.errors.map((error) => (error as Error).message),
-        ).toEqual(site === `old lease unload throws` ? [`unload failed`] : [])
-      } finally {
-        uncaught.restore()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`replaces a retained snapshot with a later empty replay`, async () => {
-    await runReplayScenario({
-      initialRows: [{ id: `one`, value: 1 }],
-      demandIds: [`one`],
-      attempts: [
-        {
-          loads: [{ demandId: `one`, rows: [], outcome: `reject` }],
-        },
-        {
-          loads: [{ demandId: `one`, rows: [], outcome: `resolve` }],
-        },
-      ],
-      settlementOrder: [0, 1],
-      settlementPhases: [0, 1],
-      afterSettlement: [],
-    })
-  })
-
-  // A synchronous throw is a rejection (maintainer decision), so no failure
-  // is held by an attempt whose setup stack has not returned yet.
-  it.each(
-    [`current`, `pending`].flatMap((scope) =>
-      [`throw`, `reject`].map((failureMode) => ({ scope, failureMode })),
-    ),
-  )(
-    `drops released failure references: $scope, $failureMode`,
-    async ({ scope, failureMode }) => {
-      let begin!: () => void
-      let commit!: () => void
-      let truncate!: () => void
-      const pendingPeer = createDeferred<void>()
-      const replacement = createDeferred<void>()
-      const failure = new Error(`failed owner`)
-      let loads = 0
-      const collection = createCollection<ReplayRow>({
-        id: `released-replay-failure-${scope}-${failureMode}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                if (loads <= 2) return true
-                if (loads === 3) {
-                  if (failureMode === `throw`) throw failure
-                  return Promise.reject(failure)
-                }
-                return loads === 4 ? pendingPeer.promise : replacement.promise
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      const failedWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`one`),
-      ])
-      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-      const retainedFailures = () => {
-        // Narrow retention witness for old and new representations. Follow
-        // stored replay frames, not a captured map that the source discarded.
-        type Frame = { failures?: Map<unknown, Error> }
-        const replayState = (
-          subscription as unknown as {
-            truncateReplayState: Frame & {
-              currentAttempt: Frame
-              attempts?: Set<Frame>
-              pending?: Set<{ attempt: Frame }>
-            }
-          }
-        ).truncateReplayState
-        const frames = new Set([
-          replayState,
-          replayState.currentAttempt,
-          ...(replayState.attempts ?? []),
-          ...[...(replayState.pending ?? [])].map(({ attempt }) => attempt),
-        ])
-        return [...frames].flatMap((frame) => [
-          ...(frame.failures?.values() ?? []),
-        ])
-      }
-      const replaySource = async () => {
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-      }
-
-      try {
-        subscription.requestSnapshot({
-          where: failedWhere,
-          optimizedOnly: false,
-        })
-        subscription.requestSnapshot({ where: peerWhere, optimizedOnly: false })
-        await replaySource()
-        // This is a retained-state witness, not a row oracle or GC benchmark.
-        // Public rows cannot reveal a released owner held by an old error map.
-        // Adapt this witness if the replay representation changes again.
-        expect(retainedFailures()).toEqual([failure])
-        if (scope === `pending`) await replaySource()
-        subscription.releaseSnapshot(failedWhere)
-        expect(retainedFailures()).toEqual([])
-        expect(subscription.status).toBe(`loadingSubset`)
-        replacement.resolve()
-        pendingPeer.resolve()
-        await flushPromises()
-        expect(subscription.status).toBe(`ready`)
-      } finally {
-        replacement.resolve()
-        pendingPeer.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`does not start a queued replay after a newer truncate supersedes it`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    const loadSignals: Array<AbortSignal | undefined> = []
-    const collection = createCollection<ReplayRow>({
-      id: `superseded-before-replay-setup`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: ({ signal }) => {
-              loadSignals.push(signal)
-              return loadSignals.length === 1 ? true : replay.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({ optimizedOnly: false })
-
-      begin()
-      truncate()
-      commit()
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      expect(loadSignals).toHaveLength(2)
-      expect(loadSignals[0]?.aborted).toBe(true)
-      expect(loadSignals[1]?.aborted).toBe(false)
-    } finally {
-      replay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it.each([
-    `replay`,
-    `additional demand`,
-    `additional pending demand`,
-  ] as const)(
-    `aborts a %s acquisition before a reentrant newer truncate starts`,
-    async (start) => {
-      let begin!: () => void
-      let write!: (
-        message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-      ) => void
-      let commit!: () => void
-      let truncate!: () => void
-      const olderReplay = createDeferred<void>()
-      const newerReplay = createDeferred<void>()
-      const predecessor = createDeferred<void>()
-      const replaySignals: Array<AbortSignal | undefined> = []
-      let loadCount = 0
-      const collection = createCollection<ReplayRow>({
-        id: `reentrant-newer-replay`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            write = operations.write
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: ({ signal }) => {
-                loadCount++
-                if (loadCount === 1) {
-                  begin()
-                  write({ type: `insert`, value: { id: `one`, value: 0 } })
-                  commit()
-                  return true
-                }
-
-                if (loadCount === 2 && start !== `replay`) {
-                  if (start === `additional pending demand`) {
-                    return predecessor.promise
-                  }
-                  // A failed replay retains its public baseline after setup and
-                  // all participants finish. Start the extra demand in that gap.
-                  throw new Error(`retain the failed replay`)
-                }
-                replaySignals.push(signal)
-                if (loadCount === (start === `replay` ? 2 : 3)) {
-                  begin()
-                  truncate()
-                  commit()
-                  return olderReplay.promise
-                }
-                return newerReplay.promise
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const visible = new Map<string | number, ReplayRow>()
-      const subscription = collection.subscribeChanges((changes) => {
-        recordPublishedChanges(visible, changes as Array<ReplayChange>)
-      })
-
-      const install = (value: number) => {
-        begin()
-        write({
-          type: collection.has(`one`) ? `update` : `insert`,
-          value: { id: `one`, value },
-        })
-        commit()
-      }
-
-      try {
-        subscription.requestSnapshot({ optimizedOnly: false })
-        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
-
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-
-        if (start !== `replay`) {
-          if (start === `additional demand`) {
-            expect(subscription.lastError).toEqual(
-              new Error(`retain the failed replay`),
-            )
-          }
-          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
-          subscription.requestSnapshot({
-            where: new Func(`eq`, [new PropRef([`id`]), new Value(`two`)]),
-            optimizedOnly: false,
-          })
-          await flushPromises()
-        }
-
-        expect(replaySignals).toHaveLength(start === `replay` ? 2 : 3)
-        expect(replaySignals[0]?.aborted).toBe(true)
-        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
-
-        install(2)
-        newerReplay.resolve()
-        await flushPromises()
-        if (start === `additional pending demand`) {
-          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
-          predecessor.resolve()
-          await flushPromises()
-          // The returning extra demand joined the retained old attempt. Its
-          // transport still holds publication after that attempt's prior work.
-          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
-          expect(subscription.status).toBe(`loadingSubset`)
-        } else {
-          // A startup superseded before return does not hold publication. An
-          // ordinary demand still owns its separate readiness participant.
-          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-          expect(subscription.status).toBe(
-            start === `replay` ? `ready` : `loadingSubset`,
-          )
-        }
-        if (!replaySignals[0]?.aborted) install(1)
-        olderReplay.resolve()
-        await flushPromises()
-
-        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-        expect(subscription.status).toBe(`ready`)
-      } finally {
-        predecessor.resolve()
-        olderReplay.resolve()
-        newerReplay.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`does not retain replay work registered after its demand is released`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const releasedReplay = createDeferred<void>()
-    let loadCount = 0
-    const collection = createCollection<ReplayRow>({
-      id: `released-during-replay-start`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          begin()
-          write({ type: `insert`, value: { id: `one`, value: 1 } })
-          write({ type: `insert`, value: { id: `two`, value: 1 } })
-          commit()
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              loadCount++
-              if (loadCount <= 2) return true
-              if (loadCount === 3) {
-                subscription.releaseSnapshot(firstWhere)
-                return releasedReplay.promise
-              }
-              begin()
-              write({ type: `insert`, value: { id: `two`, value: 2 } })
-              commit()
-              return Promise.resolve()
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    const subscription = collection.subscribeChanges((changes) => {
-      recordPublishedChanges(visible, changes as Array<ReplayChange>)
-    })
-
-    try {
-      subscription.requestSnapshot({
-        where: firstWhere,
-        optimizedOnly: false,
-      })
-      subscription.requestSnapshot({
-        where: secondWhere,
-        optimizedOnly: false,
-      })
-
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      expect(subscription.status).toBe(`ready`)
-      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
-    } finally {
-      releasedReplay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`finishes replay state and surfaces an async subscriber failure`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    const listenerFailure = new Error(`replay subscriber failed`)
-    const queuedMicrotasks: Array<VoidFunction> = []
-    let loadCount = 0
-    let rejectReplacement = false
-    const collection = createCollection<ReplayRow>({
-      id: `async-replay-subscriber-failure`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              loadCount++
-              if (loadCount === 1) {
-                begin()
-                write({ type: `insert`, value: { id: `one`, value: 1 } })
-                commit()
-                return true
-              }
-              return replay.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    const subscription = collection.subscribeChanges((changes) => {
-      recordPublishedChanges(visible, changes as Array<ReplayChange>)
-      if (rejectReplacement) throw listenerFailure
-    })
-
-    try {
-      subscription.requestSnapshot({ optimizedOnly: false })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      begin()
-      write({ type: `insert`, value: { id: `one`, value: 2 } })
-      commit()
-      rejectReplacement = true
-      const queueMicrotaskSpy = vi
-        .spyOn(globalThis, `queueMicrotask`)
-        .mockImplementation((callback) => queuedMicrotasks.push(callback))
-      try {
-        replay.resolve()
-        await flushPromises()
-
-        expect(subscription.status).toBe(`ready`)
-        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-        expect(queuedMicrotasks).toHaveLength(1)
-        expect(() => queuedMicrotasks[0]!()).toThrow(listenerFailure)
-      } finally {
-        queueMicrotaskSpy.mockRestore()
-      }
-    } finally {
-      replay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not start another demand for a replay superseded by reentrancy`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    let loadCount = 0
-    let inSupersededSetup = false
-    let staleSecondDemandStarted = false
-    const collection = createCollection<ReplayRow>({
-      id: `reentrant-multi-demand-replay`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          begin()
-          write({ type: `insert`, value: { id: `one`, value: 0 } })
-          write({ type: `insert`, value: { id: `two`, value: 0 } })
-          commit()
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loadCount++
-              if (loadCount <= 2) return true
-              if (loadCount === 3) {
-                inSupersededSetup = true
-                queueMicrotask(() => {
-                  inSupersededSetup = false
-                })
-                begin()
-                truncate()
-                commit()
-                return true
-              }
-              if (inSupersededSetup) {
-                staleSecondDemandStarted = true
-                begin()
-                write({ type: `insert`, value: { id: `two`, value: 1 } })
-                commit()
-                return true
-              }
-              if (options.where === firstWhere) {
-                begin()
-                write({ type: `insert`, value: { id: `one`, value: 2 } })
-                commit()
-              }
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    const subscription = collection.subscribeChanges((changes) => {
-      recordPublishedChanges(visible, changes as Array<ReplayChange>)
-    })
-
-    try {
-      subscription.requestSnapshot({
-        where: firstWhere,
-        optimizedOnly: false,
-      })
-      subscription.requestSnapshot({
-        where: secondWhere,
-        optimizedOnly: false,
-      })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      expect(staleSecondDemandStarted).toBe(false)
-      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not start replay work retired by the loading transition`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createCollection<ReplayRow>({
-      id: `reentrant-status-release`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return loads.length === 1 ? true : replay.promise
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    let releaseOnLoading = false
-    subscription.on(`status:loadingSubset`, () => {
-      if (releaseOnLoading) subscription.releaseSnapshot(where)
-    })
-
-    try {
-      subscription.requestSnapshot({ where, optimizedOnly: false })
-      releaseOnLoading = true
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      expect(loads).toHaveLength(1)
-      expect(unloads).toEqual([loads[0]])
-      expect(subscription.status).toBe(`ready`)
-    } finally {
-      replay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`releases replay work when its final publication callback throws`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const listenerFailure = new Error(`release publication failed`)
-    let rejectReplacement = false
-    const collection = createCollection<ReplayRow>({
-      id: `replay-release-callback-cleanup`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              if (loads.length === 1) {
-                begin()
-                write({ type: `insert`, value: { id: `one`, value: 1 } })
-                commit()
-                return true
-              }
-              return replay.promise
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      truncateReplayPublication: {
-        start: () => {},
-        succeed: () => {
-          if (rejectReplacement) throw listenerFailure
-        },
-      },
-    })
-
-    try {
-      subscription.requestSnapshot({ where, optimizedOnly: false })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      begin()
-      write({ type: `insert`, value: { id: `one`, value: 2 } })
-      commit()
-      rejectReplacement = true
-
-      expect(() => subscription.releaseSnapshot(where)).toThrow(listenerFailure)
-      expect(loads[1]?.signal?.aborted).toBe(true)
-      expect(unloads.map((options) => loads.indexOf(options))).toEqual([0, 1])
-      expect(subscription.status).toBe(`ready`)
-    } finally {
-      rejectReplacement = false
-      replay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not retain a demand released during adapter startup`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    const releasedLoad = createDeferred<void>()
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createCollection<ReplayRow>({
-      id: `reentrant-new-demand-release`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              if (loads.length === 1) return true
-              if (loads.length === 2) return replay.promise
-              subscription.releaseSnapshot(secondWhere)
-              return releasedLoad.promise
-            },
-            unloadSubset: (options) => unloads.push(options),
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-
-    try {
-      subscription.requestSnapshot({
-        where: firstWhere,
-        optimizedOnly: false,
-      })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      subscription.requestSnapshot({
-        where: secondWhere,
-        optimizedOnly: false,
-      })
-      replay.resolve()
-      await flushPromises()
-
-      expect(loads).toHaveLength(3)
-      expect(loads[2]?.signal?.aborted).toBe(true)
-      expect(unloads).toContain(loads[2])
-      expect(subscription.status).toBe(`ready`)
-      expect(subscription.pendingTruncateReplacement).toBeUndefined()
-    } finally {
-      releasedLoad.resolve()
-      replay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`publishes a replay replacement before reporting ready`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    let loadCount = 0
-    const collection = createCollection<ReplayRow>({
-      id: `replay-ready-after-publication`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              loadCount++
-              if (loadCount === 1) {
-                begin()
-                write({ type: `insert`, value: { id: `one`, value: 1 } })
-                commit()
-                return true
-              }
-              return replay.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    const readyValues: Array<number | undefined> = []
-    const subscription = collection.subscribeChanges((changes) => {
-      recordPublishedChanges(visible, changes as Array<ReplayChange>)
-    })
-    subscription.on(`status:ready`, () => {
-      readyValues.push(visible.get(`one`)?.value)
-    })
-
-    try {
-      subscription.requestSnapshot({ optimizedOnly: false })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      begin()
-      write({ type: `insert`, value: { id: `one`, value: 2 } })
-      commit()
-
-      replay.resolve()
-      await flushPromises()
-
-      expect(readyValues).toEqual([2])
-      expect(visible.get(`one`)?.value).toBe(2)
-      expect(subscription.status).toBe(`ready`)
-    } finally {
-      replay.resolve()
-      await flushPromises()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`ignores a synchronous replay failure after its demand releases itself`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const releasedFailure = new Error(`released replay load failed`)
-    const reportedErrors: Array<unknown> = []
-    let loadCount = 0
-    const collection = createCollection<ReplayRow>({
-      id: `released-sync-failure`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          begin()
-          write({ type: `insert`, value: { id: `one`, value: 1 } })
-          write({ type: `insert`, value: { id: `two`, value: 1 } })
-          commit()
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              loadCount++
-              if (loadCount <= 2) return true
-              if (loadCount === 3) {
-                subscription.releaseSnapshot(firstWhere)
-                throw releasedFailure
-              }
-              begin()
-              write({ type: `insert`, value: { id: `two`, value: 2 } })
-              commit()
-              return true
+  it(`retains a successful retry after retiring its failed peer`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `two`, value: 0 }],
+      demandIds: [`one`, `two`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 1 }],
+              outcome: `reject`,
+              writeBeforeSettlement: false,
             },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<string | number, ReplayRow>()
-    const subscription = collection.subscribeChanges((changes) => {
-      recordPublishedChanges(visible, changes as Array<ReplayChange>)
-    })
-    subscription.on(`loadSubset:error`, ({ error }) => {
-      reportedErrors.push(error)
-    })
-
-    try {
-      subscription.requestSnapshot({
-        where: firstWhere,
-        optimizedOnly: false,
-      })
-      subscription.requestSnapshot({
-        where: secondWhere,
-        optimizedOnly: false,
-      })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-
-      expect(reportedErrors).not.toContain(releasedFailure)
-      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
-      expect(subscription.status).toBe(`ready`)
-      expect(subscription.pendingTruncateReplacement).toBeUndefined()
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it.each(
-    [false, true].flatMap((releaseDemand) =>
-      [false, true].map((failRelease) => ({ releaseDemand, failRelease })),
-    ),
-  )(
-    `releases before reacquisition with releaseDemand=$releaseDemand and failRelease=$failRelease`,
-    async ({ releaseDemand, failRelease }) => {
-      let begin!: () => void
-      let commit!: () => void
-      let truncate!: () => void
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      let reentered = false
-      const releaseFailure = new Error(
-        `old replay acquisition lease release failed`,
-      )
-      const collection = createCollection<ReplayRow>({
-        id: `reentrant-replay-acquisition-lease-replacement`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return true
-              },
-              unloadSubset: (options) => {
-                unloads.push(options)
-                if (options === loads[0] && !reentered) {
-                  reentered = true
-                  if (releaseDemand) subscription.releaseSnapshot(where)
-                  if (failRelease) throw releaseFailure
-                }
-              },
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      const uncaught = captureMicrotaskErrors()
-
-      try {
-        subscription.requestSnapshot({ where, optimizedOnly: false })
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-
-        // A failed release is reported uncaught and still counts as released,
-        // so only a retired logical demand stops the reacquisition.
-        const reacquires = !releaseDemand
-        expect(loads).toHaveLength(reacquires ? 2 : 1)
-        // indexOf checks the exact options object, not a structurally equal copy.
-        expect(unloads.map((options) => loads.indexOf(options))).toEqual([0])
-        if (reacquires) expect(loads[1]!.signal?.aborted).toBe(false)
-        expect(subscription.lastError).toBe(undefined)
-        expect(uncaught.errors).toEqual(failRelease ? [releaseFailure] : [])
-        subscription.unsubscribe()
-        // A retired logical demand never starts a replacement.
-        expect(unloads.map((options) => loads.indexOf(options))).toEqual(
-          reacquires ? [0, 1] : [0],
-        )
-      } finally {
-        uncaught.restore()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`rejects replay completion with the exact reported adapter error`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replayLoad = createDeferred<void>()
-    const failure = new Error(`exact replay failure`)
-    const reportedErrors: Array<unknown> = []
-    let loadCount = 0
-    const collection = createCollection<ReplayRow>({
-      id: `exact-replay-completion-error`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: () => (++loadCount === 1 ? true : replayLoad.promise),
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-      truncateReplayPublication: {
-        start: () => {},
-        succeed: () => {},
-      },
-    })
-    subscription.on(`loadSubset:error`, ({ error }) => {
-      reportedErrors.push(error)
-    })
-
-    try {
-      subscription.requestSnapshot({ optimizedOnly: false })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      const replacement = subscription.pendingTruncateReplacement
-      expect(replacement).toBeInstanceOf(Promise)
-
-      replayLoad.reject(failure)
-
-      await expect(replacement).rejects.toBe(failure)
-      expect(subscription.lastError).toBe(failure)
-      expect(reportedErrors).toEqual([failure])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`normalizes one primitive rejection for every observer of a shared replay`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replayLoad = createDeferred<void>()
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const reportedErrors: Array<{
-      options: LoadSubsetOptions
-      error: unknown
-    }> = []
-    let loadCount = 0
-    const collection = createCollection<ReplayRow>({
-      id: `shared-primitive-replay-error`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              loadCount++
-              return loadCount <= 2 ? true : replayLoad.promise
+            {
+              demandId: `two`,
+              rows: [{ id: `two`, value: -1 }],
+              outcome: `reject`,
+              writeBeforeSettlement: false,
             },
-            unloadSubset: () => {},
-          }
+          ],
         },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-      truncateReplayPublication: {
-        start: () => {},
-        succeed: () => {},
-      },
-    })
-    subscription.on(`loadSubset:error`, ({ options, error }) => {
-      reportedErrors.push({ options, error })
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 2 }],
+              outcome: `reject`,
+              writeBeforeSettlement: true,
+            },
+            {
+              demandId: `two`,
+              rows: [{ id: `two`, value: 1 }],
+              outcome: `resolve`,
+              writeBeforeSettlement: false,
+            },
+          ],
+        },
+      ],
+      settlementOrder: [3, 1, 0, 2],
+      settlementPhases: [0, 0, 1, 1],
+      releaseOnLastAttempt: `one`,
+      afterSettlement: [{ type: `request`, demandId: `one` }],
     })
-
-    try {
-      subscription.requestSnapshot({
-        where: firstWhere,
-        optimizedOnly: false,
-      })
-      subscription.requestSnapshot({
-        where: secondWhere,
-        optimizedOnly: false,
-      })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      const replacement = subscription.pendingTruncateReplacement
-      expect(replacement).toBeInstanceOf(Promise)
-      expect(loads.map(({ where }) => where)).toEqual([
-        firstWhere,
-        secondWhere,
-        firstWhere,
-        secondWhere,
-      ])
-
-      replayLoad.reject(undefined)
-
-      let replacementError: unknown
-      try {
-        await replacement
-      } catch (error) {
-        replacementError = error
-      }
-      expect(reportedErrors).toHaveLength(2)
-      expect(reportedErrors.map(({ options }) => options)).toEqual([
-        loads[2],
-        loads[3],
-      ])
-      expect(reportedErrors[0]?.error).toBeInstanceOf(Error)
-      expect(reportedErrors[1]?.error).toBe(reportedErrors[0]?.error)
-      expect(subscription.lastError).toBe(reportedErrors[0]?.error)
-      expect(replacementError).toBe(reportedErrors[0]?.error)
-    } finally {
-      replayLoad.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
   })
 
-  it.each([`none`, `first`, `second`, `both`] as const)(
-    `normalizes one primitive rejection for ordinary shared loads after releasing %s demand`,
-    async (released) => {
-      const sharedLoad = createDeferred<void>()
-      const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const secondWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`two`),
-      ])
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const reportedErrors: Array<{
-        options: LoadSubsetOptions
-        error: unknown
-      }> = []
-      const collection = createCollection<ReplayRow>({
-        id: `shared-primitive-ordinary-error-${released}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            operations.markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                return sharedLoad.promise
-              },
-              unloadSubset: (options) => unloads.push(options),
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      subscription.on(`loadSubset:error`, ({ options, error }) => {
-        reportedErrors.push({ options, error })
-      })
-
-      try {
-        subscription.requestSnapshot({ where: firstWhere })
-        subscription.requestSnapshot({ where: secondWhere })
-        expect(loads.map(({ where }) => where)).toEqual([
-          firstWhere,
-          secondWhere,
-        ])
-
-        if (released === `first` || released === `both`) {
-          subscription.releaseSnapshot(firstWhere)
-        }
-        if (released === `second` || released === `both`) {
-          subscription.releaseSnapshot(secondWhere)
-        }
-        expect(loads[0]?.signal?.aborted).toBe(
-          released === `first` || released === `both`,
-        )
-        expect(loads[1]?.signal?.aborted).toBe(
-          released === `second` || released === `both`,
-        )
-
-        sharedLoad.reject(undefined)
-        await flushPromises()
-
-        const activeLoads = loads.filter((load) => !load.signal?.aborted)
-        expect(reportedErrors.map(({ options }) => options)).toEqual(
-          activeLoads,
-        )
-        if (activeLoads.length > 0) {
-          expect(reportedErrors[0]?.error).toBeInstanceOf(Error)
-          for (const { error } of reportedErrors) {
-            expect(error).toBe(reportedErrors[0]?.error)
-          }
-          expect(subscription.lastError).toBe(reportedErrors[0]?.error)
-        } else {
-          expect(subscription.lastError).toBeUndefined()
-        }
-        expect(subscription.status).toBe(`ready`)
-      } finally {
-        sharedLoad.resolve()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-      expect(unloads).toHaveLength(loads.length)
-      for (const load of loads) {
-        expect(unloads.filter((options) => options === load)).toHaveLength(1)
-      }
-    },
-  )
-
-  it.each([`first`, `second`, `both`] as const)(
-    `settles a shared replay rejection after releasing %s demand`,
-    async (released) => {
-      let begin!: () => void
-      let commit!: () => void
-      let truncate!: () => void
-      const replayLoad = createDeferred<void>()
-      const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const secondWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`two`),
-      ])
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      const reportedErrors: Array<{
-        options: LoadSubsetOptions
-        error: unknown
-      }> = []
-      let loadCount = 0
-      let replayStarts = 0
-      let replaySuccesses = 0
-      const collection = createCollection<ReplayRow>({
-        id: `released-shared-primitive-replay-error-${released}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                loadCount++
-                return loadCount <= 2 ? true : replayLoad.promise
-              },
-              unloadSubset: (options) => unloads.push(options),
-            }
-          },
-        },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-        truncateReplayPublication: {
-          start: () => replayStarts++,
-          succeed: () => replaySuccesses++,
-        },
-      })
-      subscription.on(`loadSubset:error`, ({ options, error }) => {
-        reportedErrors.push({ options, error })
-      })
-
-      try {
-        subscription.requestSnapshot({ where: firstWhere })
-        subscription.requestSnapshot({ where: secondWhere })
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-        const replacement = subscription.pendingTruncateReplacement
-        expect(replacement).toBeInstanceOf(Promise)
-        expect(loads.map(({ where }) => where)).toEqual([
-          firstWhere,
-          secondWhere,
-          firstWhere,
-          secondWhere,
-        ])
-        const settlement = replacement!.then(
-          () => ({ status: `resolved` as const }),
-          (error: unknown) => ({ status: `rejected` as const, error }),
-        )
-        expect({ replayStarts, replaySuccesses }).toEqual({
-          replayStarts: 1,
-          replaySuccesses: 0,
-        })
-
-        if (released === `first` || released === `both`) {
-          subscription.releaseSnapshot(firstWhere)
-        }
-        if (released === `second` || released === `both`) {
-          subscription.releaseSnapshot(secondWhere)
-        }
-        expect(loads[2]?.signal?.aborted).toBe(
-          released === `first` || released === `both`,
-        )
-        expect(loads[3]?.signal?.aborted).toBe(
-          released === `second` || released === `both`,
-        )
-
-        if (released === `both`) {
-          const result = await settlement
-          expect(result).toMatchObject({
-            status: `rejected`,
-            error: { name: `AbortError` },
-          })
-          expect(reportedErrors).toEqual([])
-          expect(subscription.lastError).toBeUndefined()
-          expect(subscription.status).toBe(`ready`)
-          expect(replaySuccesses).toBe(1)
-        } else {
-          expect(subscription.pendingTruncateReplacement).toBe(replacement)
-          expect(subscription.status).toBe(`loadingSubset`)
-          replayLoad.reject(undefined)
-          const result = await settlement
-          expect(result.status).toBe(`rejected`)
-
-          const activeIndex = released === `first` ? 3 : 2
-          expect(reportedErrors).toHaveLength(1)
-          expect(reportedErrors[0]?.options).toBe(loads[activeIndex])
-          expect(reportedErrors[0]?.error).toBeInstanceOf(Error)
-          expect(subscription.lastError).toBe(reportedErrors[0]?.error)
-          expect(result).toMatchObject({
-            status: `rejected`,
-            error: reportedErrors[0]?.error,
-          })
-        }
-      } finally {
-        replayLoad.resolve()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-      expect(unloads).toHaveLength(loads.length)
-      for (const load of loads) {
-        expect(unloads.filter((options) => options === load)).toHaveLength(1)
-      }
-      expect(replayStarts).toBe(1)
-      expect(replaySuccesses).toBe(released === `both` ? 1 : 0)
-    },
-  )
+  it(`does not republish an identical snapshot after a synchronous replay failure`, async () => {
+    await runSequentialReplayScenario({
+      initialRows: [{ id: `one`, value: 0 }],
+      loads: [
+        { rows: [], outcome: `throw` },
+        { rows: [{ id: `one`, value: 0 }], outcome: `return` },
+      ],
+    })
+  })
 
-  it(`ignores a retired demand's replay failure once surviving demand succeeds`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const firstReplay = createDeferred<void>()
-    const secondReplay = createDeferred<void>()
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const failure = new Error(`retired demand failed`)
-    let replaySuccesses = 0
-    const collection = createCollection<ReplayRow>({
-      id: `retired-replay-failure`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              if (loads.length <= 2) return true
-              return loads.length === 3
-                ? firstReplay.promise
-                : secondReplay.promise
-            },
-            unloadSubset: () => {},
-          }
+  it(`keeps a same-key source replacement private after a failed replay`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `one`, value: 1 }],
+      demandIds: [`one`],
+      attempts: [
+        {
+          loads: [{ demandId: `one`, rows: [], outcome: `reject` }],
         },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-      truncateReplayPublication: {
-        start: () => {},
-        succeed: () => replaySuccesses++,
-      },
+      ],
+      settlementOrder: [0],
+      settlementPhases: [0],
+      afterSettlement: [{ type: `put`, row: { id: `one`, value: 2 } }],
     })
-
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      subscription.requestSnapshot({ where: secondWhere })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      const replacement = subscription.pendingTruncateReplacement
-      expect(replacement).toBeInstanceOf(Promise)
-
-      firstReplay.reject(failure)
-      await flushPromises()
-      subscription.releaseSnapshot(firstWhere)
-      secondReplay.resolve()
-
-      await expect(replacement).resolves.toBeUndefined()
-      expect(replaySuccesses).toBe(1)
-      expect(subscription.status).toBe(`ready`)
-    } finally {
-      firstReplay.resolve()
-      secondReplay.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
   })
 
-  it(`retains successful peer rows after failed replay demand retires`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const failed = createDeferred<void>()
-    const successful = createDeferred<void>()
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const visible = new Map<string | number, ReplayRow>()
-    const batches: Array<Array<ReplayChange>> = []
-    let survivingRows: Array<ReplayRow> = []
-    const collection = createCollection<ReplayRow>({
-      id: `settled-replay-peer`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              const id = options.where === firstWhere ? `one` : `two`
-              begin()
-              write({
-                type: `insert`,
-                value: { id, value: loads.length <= 2 ? 1 : 2 },
-              })
-              commit()
-              if (loads.length <= 2) return true
-              return id === `one` ? failed.promise : successful.promise
+  it(`does not let an unpublished truncate delete suppress a later insert`, async () => {
+    await runReplayScenario({
+      initialRows: [],
+      demandIds: [`two`, `one`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `two`,
+              rows: [{ id: `two`, value: -1 }],
+              outcome: `resolve`,
             },
-            unloadSubset: (options) => {
-              unloads.push(options)
+            { demandId: `one`, rows: [], outcome: `reject` },
+          ],
+        },
+        {
+          loads: [
+            { demandId: `two`, rows: [], outcome: `resolve` },
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: -1 }],
+              outcome: `resolve`,
             },
-          }
+          ],
         },
-      },
-    })
-    const subscription = collection.subscribeChanges((changes) => {
-      batches.push(recordPublishedChanges(visible, changes))
+      ],
+      settlementOrder: [0, 1, 2, 3],
+      settlementPhases: [0, 0, 1, 1],
+      afterSettlement: [{ type: `put`, row: { id: `two`, value: 1 } }],
     })
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      subscription.requestSnapshot({ where: secondWhere })
-      expect(sortedRows(visible)).toEqual([
-        { id: `one`, value: 1 },
-        { id: `two`, value: 1 },
-      ])
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(loads).toHaveLength(4)
-      failed.reject(new Error(`first demand replay failed`))
-      successful.resolve()
-      await flushPromises()
-      expect(sortedRows(visible)).toEqual([
-        { id: `one`, value: 1 },
-        { id: `two`, value: 1 },
-      ])
-      subscription.releaseSnapshot(firstWhere)
-      await flushPromises()
-      // Retirement leaves only the successful demand. Its replacement rows
-      // must survive failure handling for the now-retired peer.
-      survivingRows = sortedRows(visible)
-      subscription.releaseSnapshot(secondWhere)
-      // Outside replay, release ends acquisition ownership; this adapter does
-      // not evict its cached rows. The still-live subscriber observes deletion
-      // when the source actually removes the row.
-      expect(sortedRows(visible)).toEqual([
-        { id: `one`, value: 2 },
-        { id: `two`, value: 2 },
-      ])
-      begin()
-      write({ type: `delete`, key: `two` })
-      commit()
-      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-    } finally {
-      failed.resolve()
-      successful.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-    expect(unloads).toHaveLength(4)
-    for (const load of loads) {
-      expect(unloads.filter((options) => options === load)).toHaveLength(1)
-    }
-    expect(survivingRows).toEqual([
-      { id: `one`, value: 2 },
-      { id: `two`, value: 2 },
-    ])
   })
 
-  it(`keeps replay completion failure separate from a peer release failure`, async () => {
-    let begin!: () => void
-    let commit!: () => void
-    let truncate!: () => void
-    const failed = createDeferred<void>()
-    const peer = createDeferred<void>()
-    const replayFailure = new Error(`replay failed`)
-    const releaseFailure = new Error(`peer release failed`)
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloadAttempts: Array<LoadSubsetOptions> = []
-    const unloaded: Array<LoadSubsetOptions> = []
-    let failRelease = false
-    const succeeded = vi.fn()
-    const uncaught = captureMicrotaskErrors()
-    const collection = createCollection<ReplayRow>({
-      id: `replay-error-ownership`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              if (loads.length <= 2) return true
-              return options.where === firstWhere
-                ? failed.promise
-                : peer.promise
-            },
-            unloadSubset: (options) => {
-              unloadAttempts.push(options)
-              if (failRelease && options === loads[3]) {
-                failRelease = false
-                throw releaseFailure
-              }
-              unloaded.push(options)
+  it(`lets the newest successful replay replace an older failed replay`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `one`, value: 1 }],
+      demandIds: [`one`],
+      attempts: [
+        {
+          loads: [{ demandId: `one`, rows: [], outcome: `reject` }],
+        },
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 2 }],
+              outcome: `resolve`,
             },
-          }
+          ],
         },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
-      truncateReplayPublication: { start: () => {}, succeed: succeeded },
+      ],
+      settlementOrder: [1, 0],
+      settlementPhases: [1, 1],
+      afterSettlement: [],
     })
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      subscription.requestSnapshot({ where: peerWhere })
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(loads).toHaveLength(4)
-      const completion = subscription.pendingTruncateReplacement
-      expect(completion).toBeInstanceOf(Promise)
-      const observed = completion!.then(
-        () => ({ status: `resolved` as const }),
-        (error: unknown) => ({ status: `rejected` as const, error }),
-      )
-      failed.reject(replayFailure)
-      await flushPromises()
-      failRelease = true
-      // The release error goes uncaught; the replay keeps its own failure.
-      expect(() => subscription.releaseSnapshot(peerWhere)).not.toThrow()
-      await Promise.resolve()
-      expect(uncaught.errors).toEqual([releaseFailure])
-      expect(succeeded).not.toHaveBeenCalled()
-      await expect(observed).resolves.toEqual({
-        status: `rejected`,
-        error: replayFailure,
-      })
-      const result = await observed
-      expect(`error` in result ? result.error : undefined).toBe(replayFailure)
-      peer.resolve()
-      await flushPromises()
-      await expect(observed).resolves.toEqual({
-        status: `rejected`,
-        error: replayFailure,
-      })
-    } finally {
-      uncaught.restore()
-      failed.resolve()
-      peer.resolve()
-      failRelease = false
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-    expect(
-      unloadAttempts.filter((options) => options === loads[3]),
-    ).toHaveLength(1)
-    expect(unloaded).toHaveLength(3)
-    for (const load of loads) {
-      expect(unloaded.filter((options) => options === load)).toHaveLength(
-        load === loads[3] ? 0 : 1,
-      )
-    }
   })
 
-  it(`waits for a new async demand acquired while unloading a replay acquisition lease`, async () => {
-    let begin!: () => void
-    let write!: (
-      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-    ) => void
-    let commit!: () => void
-    let truncate!: () => void
-    const replay = createDeferred<void>()
-    const nested = createDeferred<void>()
-    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const nestedWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const ready = vi.fn()
-    const visible = new Map<string | number, ReplayRow>()
-    const publications: Array<Array<ReplayRow>> = []
-    const collection = createCollection<ReplayRow>({
-      id: `replay-new-demand-readiness`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              begin()
-              write({
-                type: `insert`,
-                value: {
-                  id: options.where === nestedWhere ? `two` : `one`,
-                  value: loads.length === 1 ? 1 : 2,
-                },
-              })
-              commit()
-              if (loads.length === 1) return true
-              return options.where === nestedWhere
-                ? nested.promise
-                : replay.promise
+  it(`ignores an obsolete replay that settles after the newest replay`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `one`, value: 0 }],
+      demandIds: [`one`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 1 }],
+              outcome: `resolve`,
             },
-            unloadSubset: (options) => {
-              unloads.push(options)
-              if (options === loads[0]) {
-                subscription.requestSnapshot({ where: nestedWhere })
-              }
+          ],
+        },
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 2 }],
+              outcome: `resolve`,
             },
-          }
+          ],
         },
-      },
+      ],
+      settlementOrder: [1, 0],
+      settlementPhases: [1, 1],
+      afterSettlement: [],
     })
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        recordPublishedChanges(visible, changes)
-        publications.push(sortedRows(visible))
-      },
-      { includeInitialState: false },
-    )
-    try {
-      subscription.requestSnapshot({ where: firstWhere })
-      publications.length = 0
-      subscription.on(`status:ready`, ready)
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      expect(loads.map(({ where }) => where)).toEqual([
-        firstWhere,
-        nestedWhere,
-        firstWhere,
-      ])
-      expect(unloads).toEqual([loads[0]])
-      const completion = subscription.pendingTruncateReplacement
-      expect(completion).toBeInstanceOf(Promise)
-      const settled = vi.fn()
-      void completion!.then(settled, settled)
-      replay.resolve()
-      await flushPromises()
-      expect(subscription.status).not.toBe(`ready`)
-      expect(ready).not.toHaveBeenCalled()
-      expect(settled).not.toHaveBeenCalled()
-      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 1 }])
-      expect(publications).toEqual([])
-      nested.resolve()
-      await completion
-      await flushPromises()
-      expect(subscription.status).toBe(`ready`)
-      expect(ready).toHaveBeenCalledTimes(1)
-      expect(settled).toHaveBeenCalledTimes(1)
-      expect(sortedRows(visible)).toEqual([
-        { id: `one`, value: 2 },
-        { id: `two`, value: 2 },
-      ])
-      expect(publications).toEqual([
-        [
-          { id: `one`, value: 2 },
-          { id: `two`, value: 2 },
-        ],
-      ])
-    } finally {
-      replay.resolve()
-      nested.resolve()
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-    expect(unloads).toHaveLength(3)
-    for (const load of loads) {
-      expect(unloads.filter((options) => options === load)).toHaveLength(1)
-    }
   })
 
-  it.each([`after-release`, `during-ready`, `during-unload`] as const)(
-    `reacquires a final released replay demand %s without waiting for obsolete work`,
-    async (reacquireTiming) => {
-      let begin!: () => void
-      let write!: (
-        message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
-      ) => void
-      let commit!: () => void
-      let truncate!: () => void
-      const replayLoad = createDeferred<void>()
-      const reacquiredLoad = createDeferred<void>()
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const loads: Array<LoadSubsetOptions> = []
-      const unloads: Array<LoadSubsetOptions> = []
-      let reacquireOnReady = false
-      let reacquireInUnload = false
-      const collection = createCollection<ReplayRow>({
-        id: `final-replay-reacquire-${reacquireTiming}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            write = operations.write
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: (options) => {
-                loads.push(options)
-                if (loads.length === 1) {
-                  begin()
-                  write({ type: `insert`, value: { id: `one`, value: 1 } })
-                  commit()
-                  return true
-                }
-                if (loads.length === 2) {
-                  begin()
-                  write({ type: `insert`, value: { id: `one`, value: 2 } })
-                  commit()
-                  return replayLoad.promise
-                }
-                return reacquireTiming === `during-unload`
-                  ? reacquiredLoad.promise
-                  : true
-              },
-              unloadSubset: (options) => {
-                unloads.push(options)
-                if (reacquireInUnload && options === loads[1]) {
-                  reacquireInUnload = false
-                  subscription.requestSnapshot({ where })
-                }
-              },
-            }
-          },
+  it(`releases every successful overlapping replay acquisition`, async () => {
+    await runReplayScenario({
+      initialRows: [],
+      demandIds: [`one`],
+      attempts: [
+        {
+          loads: [{ demandId: `one`, rows: [], outcome: `resolve` }],
         },
-      })
-      const visible = new Map<string | number, ReplayRow>()
-      const batches: Array<Array<ReplayChange>> = []
-      const subscription: CollectionSubscription = collection.subscribeChanges(
-        (changes) => {
-          batches.push(recordPublishedChanges(visible, changes))
+        {
+          loads: [{ demandId: `one`, rows: [], outcome: `resolve` }],
         },
-      )
-      const readyRows: Array<Array<ReplayRow>> = []
-      subscription.on(`status:ready`, () => {
-        readyRows.push(sortedRows(visible))
-        if (reacquireOnReady) {
-          reacquireOnReady = false
-          subscription.requestSnapshot({ where })
-        }
-      })
-
-      try {
-        subscription.requestSnapshot({ where })
-        begin()
-        truncate()
-        commit()
-        await flushPromises()
-        const replacement = subscription.pendingTruncateReplacement
-        expect(replacement).toBeInstanceOf(Promise)
-        const settlement = replacement!.then(
-          () => ({ status: `resolved` as const }),
-          (error: unknown) => ({ status: `rejected` as const, error }),
-        )
-
-        // Release has no synthetic delete callback. Reenter from its actual
-        // ready notification instead; the old replay is already retired then.
-        reacquireOnReady = reacquireTiming === `during-ready`
-        reacquireInUnload = reacquireTiming === `during-unload`
-        subscription.releaseSnapshot(where)
-        // Releasing the final demand retires the replay, which publishes the
-        // row it holds, so the replacement resolves.
-        if (reacquireTiming === `after-release`) {
-          await expect(settlement).resolves.toEqual({ status: `resolved` })
-          subscription.requestSnapshot({ where })
-        } else if (reacquireTiming === `during-unload`) {
-          let settled = false
-          void settlement.then(() => {
-            settled = true
-          })
-          const batchesBeforePendingFlush = batches.length
-          await flushPromises()
-          expect(settled).toBe(false)
-          expect(subscription.status).not.toBe(`ready`)
-          expect(readyRows).toEqual([])
-          expect(batches).toHaveLength(batchesBeforePendingFlush)
-          const batchesBeforeObsoleteSettlement = batches.length
-          replayLoad.resolve()
-          await flushPromises()
-          expect(settled).toBe(false)
-          expect(subscription.status).not.toBe(`ready`)
-          expect(readyRows).toEqual([])
-          expect(batches).toHaveLength(batchesBeforeObsoleteSettlement)
-          reacquiredLoad.resolve()
-          await expect(settlement).resolves.toEqual({ status: `resolved` })
-        } else {
-          expect(subscription.pendingTruncateReplacement).toBeUndefined()
-          await expect(settlement).resolves.toEqual({ status: `resolved` })
-        }
-
-        expect(subscription.pendingTruncateReplacement).toBeUndefined()
-        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
-        expect(sortedChanges(batches[0]!)).toEqual([
-          { type: `insert`, key: `one`, value: { id: `one`, value: 1 } },
-        ])
-        // Retiring the replay publishes its applied row at the release; the
-        // reacquired demand then has nothing new to deliver.
-        expect(
-          sortedChanges(batches.filter((batch) => batch.length > 0).at(-1)!),
-        ).toEqual([
-          {
-            type: `update`,
-            key: `one`,
-            value: { id: `one`, value: 2 },
-            previousValue: { id: `one`, value: 1 },
-          },
-        ])
-        expect(batches.filter((batch) => batch.length > 0)).toHaveLength(2)
-        expect(loads).toHaveLength(3)
-        expect(loads.map(({ where: requestWhere }) => requestWhere)).toEqual([
-          where,
-          where,
-          where,
-        ])
-        if (reacquireTiming === `during-unload`) {
-          expect(readyRows).toEqual([[{ id: `one`, value: 2 }]])
-        }
-      } finally {
-        replayLoad.resolve()
-        reacquiredLoad.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-      expect(unloads).toHaveLength(loads.length)
-      for (const load of loads) {
-        expect(unloads.filter((options) => options === load)).toHaveLength(1)
-      }
-    },
-  )
+      ],
+      settlementOrder: [1, 0],
+      settlementPhases: [1, 1],
+      afterSettlement: [],
+    })
+  })
 
-  it(`does not start replacement work after release unsubscribes`, () => {
-    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const collection = createCollection<ReplayRow>({
-      id: `reentrant-replacement-unsubscribe`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
+  it(`uses the newest complete multi-demand replay`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `one`, value: 1 }],
+      demandIds: [`one`, `two`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 2 }],
+              outcome: `resolve`,
             },
-            unloadSubset: (options) => {
-              unloads.push(options)
-              subscription.unsubscribe()
+            { demandId: `two`, rows: [], outcome: `reject` },
+          ],
+        },
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 3 }],
+              outcome: `resolve`,
             },
-          }
+            {
+              demandId: `two`,
+              rows: [{ id: `two`, value: 4 }],
+              outcome: `resolve`,
+            },
+          ],
         },
-      },
-    })
-    const subscription = collection.subscribeChanges(() => {}, {
-      includeInitialState: false,
+      ],
+      settlementOrder: [2, 3, 0, 1],
+      settlementPhases: [1, 1, 1, 1],
+      afterSettlement: [],
     })
+  })
 
-    let release: (() => void) | undefined
-    subscription.requestSnapshot({
-      where,
-      optimizedOnly: false,
-      onLoadSubsetResult: (_result, _options, releaseDemand) => {
-        release = releaseDemand
-      },
+  it(`retains applied rows after their replay demand is released`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `two`, value: 0 }],
+      demandIds: [`one`, `two`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 1 }],
+              outcome: `reject`,
+              writeBeforeSettlement: true,
+            },
+            {
+              demandId: `two`,
+              rows: [{ id: `two`, value: 2 }],
+              outcome: `resolve`,
+            },
+          ],
+        },
+      ],
+      settlementOrder: [0, 1],
+      settlementPhases: [0, 0],
+      releaseOnLastAttempt: `one`,
+      afterSettlement: [{ type: `request`, demandId: `one` }],
     })
-    expect(release).toBeTypeOf(`function`)
-    release!()
-    expect(
-      subscription.requestSnapshot({
-        where,
-        optimizedOnly: false,
-      }),
-    ).toBe(false)
-
-    expect(loads).toHaveLength(1)
-    expect(unloads).toEqual([loads[0]])
   })
 
-  it.each([`generic`, `specific`] as const)(
-    `does not emit a stale specific status after reentrant release from a %s listener`,
-    async (reentryEvent) => {
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const load = createDeferred<void>()
-      const collection = createCollection<ReplayRow>({
-        id: `reentrant-specific-status`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            operations.markReady()
-            return {
-              loadSubset: () => load.promise,
-              unloadSubset: () => {},
-            }
-          },
+  it(`refreshes a retained row when its final released demand is reacquired`, async () => {
+    // Reduced from the fixed replay corpus after removing release-time pruning.
+    await runReplayScenario({
+      initialRows: [{ id: `one`, value: 0 }],
+      demandIds: [`one`],
+      attempts: [
+        {
+          loads: [
+            {
+              demandId: `one`,
+              rows: [{ id: `one`, value: 1 }],
+              outcome: `resolve`,
+              writeBeforeSettlement: true,
+            },
+          ],
         },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      const observed: Array<{ event: string; current: string }> = []
-      if (reentryEvent === `generic`) {
-        subscription.on(`status:change`, ({ status }) => {
-          if (status === `loadingSubset`) subscription.releaseSnapshot(where)
-        })
-      } else {
-        subscription.on(`status:loadingSubset`, () => {
-          subscription.releaseSnapshot(where)
-        })
-      }
-      subscription.on(`status:loadingSubset`, ({ status }) => {
-        observed.push({ event: status, current: subscription.status })
-      })
-      subscription.on(`status:ready`, ({ status }) => {
-        observed.push({ event: status, current: subscription.status })
-      })
-
-      try {
-        subscription.requestSnapshot({ where, optimizedOnly: false })
-        expect(observed).toEqual([{ event: `ready`, current: `ready` }])
-      } finally {
-        load.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
+      ],
+      settlementOrder: [0],
+      settlementPhases: [0],
+      releaseOnLastAttempt: `one`,
+      afterSettlement: [{ type: `request`, demandId: `one` }],
+    })
+  })
 
-  it.each([`generic`, `specific`] as const)(
-    `does not resume an obsolete status transition after %s-listener ABA reentry`,
-    async (reentryEvent) => {
-      const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const secondWhere = new Func(`eq`, [
-        new PropRef([`id`]),
-        new Value(`two`),
-      ])
-      const load = createDeferred<void>()
-      const collection = createCollection<ReplayRow>({
-        id: `reentrant-status-aba-${reentryEvent}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            operations.markReady()
-            return {
-              loadSubset: () => load.promise,
-              unloadSubset: () => {},
-            }
-          },
+  it(`replaces a retained snapshot with a later empty replay`, async () => {
+    await runReplayScenario({
+      initialRows: [{ id: `one`, value: 1 }],
+      demandIds: [`one`],
+      attempts: [
+        {
+          loads: [{ demandId: `one`, rows: [], outcome: `reject` }],
         },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      const trace: Array<string> = []
-      let reentered = false
-      const reenter = () => {
-        if (reentered) return
-        reentered = true
-        subscription.releaseSnapshot(firstWhere)
-        subscription.requestSnapshot({ where: secondWhere })
-      }
-      if (reentryEvent === `generic`) {
-        subscription.on(`status:change`, ({ status }) => {
-          if (status === `loadingSubset`) reenter()
-        })
-      } else {
-        subscription.on(`status:loadingSubset`, reenter)
-      }
-      subscription.on(`status:change`, ({ previousStatus, status }) => {
-        trace.push(
-          `generic:${previousStatus}->${status}:${subscription.status}`,
-        )
-      })
-      subscription.on(`status:loadingSubset`, () => {
-        trace.push(`specific:loadingSubset:${subscription.status}`)
-      })
-
-      try {
-        subscription.requestSnapshot({ where: firstWhere })
-
-        expect(trace).toEqual(
-          reentryEvent === `generic`
-            ? [
-                `generic:loadingSubset->ready:ready`,
-                `generic:ready->loadingSubset:loadingSubset`,
-                `specific:loadingSubset:loadingSubset`,
-              ]
-            : [
-                `generic:ready->loadingSubset:loadingSubset`,
-                `generic:loadingSubset->ready:ready`,
-                `generic:ready->loadingSubset:loadingSubset`,
-                `specific:loadingSubset:loadingSubset`,
-              ],
-        )
-      } finally {
-        load.resolve()
-        await flushPromises()
-        subscription.unsubscribe()
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it.each([`generic`, `specific`] as const)(
-    `stops %s status delivery when an earlier ready listener unsubscribes`,
-    async (reentryEvent) => {
-      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
-      const load = createDeferred<void>()
-      const collection = createCollection<ReplayRow>({
-        id: `reentrant-status-unsubscribe-${reentryEvent}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            operations.markReady()
-            return {
-              loadSubset: () => load.promise,
-              unloadSubset: () => {},
-            }
-          },
+        {
+          loads: [{ demandId: `one`, rows: [], outcome: `resolve` }],
         },
-      })
-      const subscription = collection.subscribeChanges(() => {}, {
-        includeInitialState: false,
-      })
-      const trace: Array<string> = []
-      const unsubscribe = () => {
-        trace.push(`unsubscribe`)
-        subscription.unsubscribe()
-      }
-      if (reentryEvent === `generic`) {
-        subscription.on(`status:change`, ({ status }) => {
-          if (status === `ready`) unsubscribe()
-        })
-      } else {
-        subscription.on(`status:ready`, unsubscribe)
-      }
-      subscription.on(`status:change`, ({ status }) => {
-        if (status === `ready`) trace.push(`late-generic`)
-      })
-      subscription.on(`status:ready`, () => trace.push(`late-specific`))
-      subscription.on(`unsubscribed`, () => trace.push(`unsubscribed`))
-
-      try {
-        subscription.requestSnapshot({ where })
-        load.resolve()
-        await flushPromises()
-
-        expect(trace).toEqual(
-          reentryEvent === `generic`
-            ? [`unsubscribe`, `unsubscribed`]
-            : [`late-generic`, `unsubscribe`, `unsubscribed`],
-        )
-      } finally {
-        load.resolve()
-        await collection.cleanup()
-      }
-    },
-  )
+      ],
+      settlementOrder: [0, 1],
+      settlementPhases: [0, 1],
+      afterSettlement: [],
+    })
+  })
 
   fcTest.prop([replayScenarioArbitrary], {
     numRuns: generatedRuns,
diff --git a/packages/db/tests/collection-subscription-replay-support.ts b/packages/db/tests/collection-subscription-replay-support.ts
new file mode 100644
index 0000000000..852939e118
--- /dev/null
+++ b/packages/db/tests/collection-subscription-replay-support.ts
@@ -0,0 +1,61 @@
+// Shared helpers for the oracle file and the ordinary tests moved from it.
+import { expect } from 'vitest'
+import type { LoadSubsetOptions } from '../src/types.js'
+
+export type ReplayRow = {
+  id: `one` | `two`
+  value: number
+}
+export type ReplayChange = {
+  type: `insert` | `update` | `delete`
+  key: string | number
+  value: ReplayRow
+  previousValue?: ReplayRow
+}
+export function sortedRows(
+  rows: ReadonlyMap<string | number, ReplayRow>,
+): Array<ReplayRow> {
+  return [...rows.values()].sort((left, right) =>
+    left.id.localeCompare(right.id),
+  )
+}
+export function sortedChanges(
+  changes: ReadonlyArray<ReplayChange>,
+): Array<ReplayChange> {
+  return [...changes].sort((left, right) =>
+    String(left.key).localeCompare(String(right.key)),
+  )
+}
+export function recordPublishedChanges(
+  visible: Map<string | number, ReplayRow>,
+  changes: ReadonlyArray<ReplayChange>,
+): Array<ReplayChange> {
+  const recorded = changes.map((change) => ({
+    type: change.type,
+    key: change.key,
+    value: { id: change.value.id, value: change.value.value },
+    ...(change.previousValue === undefined
+      ? {}
+      : {
+          previousValue: {
+            id: change.previousValue.id,
+            value: change.previousValue.value,
+          },
+        }),
+  }))
+  for (const change of recorded) {
+    if (change.type === `delete`) visible.delete(change.key)
+    else visible.set(change.key, { ...change.value })
+  }
+  return recorded
+}
+export function expectSameSubsetRequest(
+  actual: LoadSubsetOptions,
+  expected: LoadSubsetOptions,
+): void {
+  expect(actual.where).toBe(expected.where)
+  expect(actual.orderBy).toBe(expected.orderBy)
+  expect(actual.limit).toBe(expected.limit)
+  expect(actual.cursor).toEqual(expected.cursor)
+  expect(actual.offset).toBe(expected.offset)
+}
diff --git a/packages/db/tests/collection-subscription-replay.test.ts b/packages/db/tests/collection-subscription-replay.test.ts
new file mode 100644
index 0000000000..c4fe4b8422
--- /dev/null
+++ b/packages/db/tests/collection-subscription-replay.test.ts
@@ -0,0 +1,3031 @@
+// Ordinary tests moved out of collection-subscription-replay-oracle.property.test.ts.
+// They keep literal expectations for replay publication, retirement, and ordering;
+// the replay laws and the scenario grammar stay in the oracle file.
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { ReverseIndex } from '../src/indexes/reverse-index.js'
+import { Func, PropRef, Value } from '../src/query/ir.js'
+import { valueOrderBy } from './collection-subscription-ordered-fixture.js'
+import { captureMicrotaskErrors, flushPromises } from './utils.js'
+import {
+  expectSameSubsetRequest,
+  recordPublishedChanges,
+  sortedChanges,
+  sortedRows,
+} from './collection-subscription-replay-support.js'
+import type {
+  ReplayChange,
+  ReplayRow,
+} from './collection-subscription-replay-support.js'
+import type { CollectionSubscription } from '../src/collection/subscription.js'
+import type {
+  ChangeMessageOrDeleteKeyMessage,
+  LoadSubsetOptions,
+  SyncConfig,
+} from '../src/types.js'
+
+describe(`CollectionSubscription replay oracle`, () => {
+  it.each([`resolve`, `reject`] as const)(
+    `starts a replacement that lets canceled replay %s`,
+    async (outcome) => {
+      const oldReplay = createDeferred<void>()
+      const newReplay = createDeferred<void>()
+      const aborted = new DOMException(`superseded`, `AbortError`)
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const events: Array<string> = []
+      let operations!: Parameters<SyncConfig<ReplayRow>[`sync`]>[0]
+      const collection = createCollection<ReplayRow>({
+        id: `replacement-start-dependency-${outcome}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (sync) => {
+            operations = sync
+            sync.markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                events.push(`load:${loads.length}`)
+                if (loads.length === 1) {
+                  sync.begin()
+                  sync.write({ type: `insert`, value: { id: `one`, value: 0 } })
+                  sync.commit()
+                  return true
+                }
+                if (loads.length === 2) return oldReplay.promise
+                // This provider has stopped old request-scoped writes on abort.
+                // Its shared refresh protocol completes the old waiter only
+                // when a replacement acquisition registers. Completion does
+                // not require new result publication or a callback from core.
+                expect(loads[1]?.signal?.aborted).toBe(true)
+                if (outcome === `resolve`) oldReplay.resolve()
+                else oldReplay.reject(aborted)
+                events.push(`old:settled`)
+                return newReplay.promise
+              },
+              unloadSubset: (options) => {
+                unloads.push(options)
+              },
+            }
+          },
+        },
+      })
+      const visible = new Map<string | number, ReplayRow>()
+      const subscription = collection.subscribeChanges((changes) => {
+        for (const change of changes) {
+          if (change.type === `delete`) visible.delete(change.key)
+          else {
+            const { id, value } = change.value
+            visible.set(change.key, { id, value })
+          }
+        }
+      })
+      const truncate = () => {
+        operations.begin()
+        operations.truncate()
+        operations.commit()
+      }
+      try {
+        subscription.requestSnapshot({ optimizedOnly: false })
+        expect([...visible.values()]).toEqual([{ id: `one`, value: 0 }])
+        truncate()
+        const completion = subscription.pendingTruncateReplacement
+        expect(completion).toBeDefined()
+        let completed = false
+        const completionErrors: Array<unknown> = []
+        void completion?.then(
+          () => {
+            completed = true
+          },
+          (error: unknown) => completionErrors.push(error),
+        )
+        await flushPromises()
+        expect(loads).toHaveLength(2)
+        expect(oldReplay.isPending()).toBe(true)
+        expect([...visible.values()]).toEqual([{ id: `one`, value: 0 }])
+
+        truncate()
+        await flushPromises()
+        expect(events).toEqual([`load:1`, `load:2`, `load:3`, `old:settled`])
+        expect(oldReplay.isPending()).toBe(false)
+        expect([...visible.values()]).toEqual([{ id: `one`, value: 0 }])
+        expect(subscription.status).toBe(`loadingSubset`)
+        expect(subscription.lastError).toBeUndefined()
+        expect(completed).toBe(false)
+        expect(completionErrors).toEqual([])
+
+        operations.begin()
+        operations.write({ type: `insert`, value: { id: `one`, value: 2 } })
+        await operations.commit()
+        newReplay.resolve()
+        await flushPromises()
+        expect([...visible.values()]).toEqual([{ id: `one`, value: 2 }])
+        expect(subscription.status).toBe(`ready`)
+        expect(subscription.lastError).toBeUndefined()
+        expect(completed).toBe(true)
+        expect(completionErrors).toEqual([])
+      } finally {
+        oldReplay.resolve()
+        newReplay.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+      expect(unloads).toHaveLength(loads.length)
+      for (const load of loads) {
+        expect(unloads.filter((unload) => unload === load)).toHaveLength(1)
+      }
+    },
+  )
+
+  it(`aborts an in-flight initial acquisition before its replay replaces it`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const loads: Array<{
+      options: LoadSubsetOptions
+      deferred: ReturnType<typeof createDeferred<void>>
+    }> = []
+    const collection = createCollection<ReplayRow>({
+      id: `initial-acquisition-replay`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          begin = params.begin
+          write = params.write
+          commit = params.commit
+          truncate = params.truncate
+          params.markReady()
+          return {
+            loadSubset: (options) => {
+              const deferred = createDeferred<void>()
+              loads.push({ options, deferred })
+              return deferred.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const subscription = collection.subscribeChanges((changes) => {
+      for (const change of changes) {
+        if (change.type === `delete`) visible.delete(change.key)
+        else {
+          visible.set(change.key, {
+            id: change.value.id,
+            value: change.value.value,
+          })
+        }
+      }
+    })
+
+    try {
+      subscription.requestSnapshot({ optimizedOnly: false })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(loads[0]?.options.signal?.aborted).toBe(true)
+
+      begin()
+      write({ type: `insert`, value: { id: `two`, value: 2 } })
+      commit()
+      loads[1]?.deferred.resolve()
+      await flushPromises()
+
+      if (!loads[0]?.options.signal?.aborted) {
+        begin()
+        write({ type: `insert`, value: { id: `one`, value: 1 } })
+        commit()
+      }
+      loads[0]?.deferred.resolve()
+      await flushPromises()
+
+      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
+      expect(subscription.status).toBe(`ready`)
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`keeps the published replacement after a reentrant replay fails`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    let loadCount = 0
+    const replayLoads: Array<ReturnType<typeof createDeferred<void>>> = []
+    const collection = createCollection<ReplayRow>({
+      id: `reentrant-replay`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          begin = params.begin
+          write = params.write
+          commit = params.commit
+          truncate = params.truncate
+          params.markReady()
+          return {
+            loadSubset: () => {
+              loadCount++
+              if (loadCount === 1) {
+                begin()
+                write({ type: `insert`, value: { id: `one`, value: 1 } })
+                commit()
+                return true
+              }
+
+              const deferred = createDeferred<void>()
+              replayLoads.push(deferred)
+              return deferred.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    let startedNestedReplay = false
+    const subscription = collection.subscribeChanges((changes) => {
+      for (const change of changes) {
+        if (change.type === `delete`) visible.delete(change.key)
+        else {
+          visible.set(change.key, {
+            id: change.value.id,
+            value: change.value.value,
+          })
+        }
+      }
+
+      if (!startedNestedReplay && visible.get(`one`)?.value === 2) {
+        startedNestedReplay = true
+        begin()
+        truncate()
+        commit()
+      }
+    })
+
+    try {
+      subscription.requestSnapshot({ optimizedOnly: false })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      begin()
+      write({ type: `insert`, value: { id: `one`, value: 2 } })
+      commit()
+      replayLoads[0]?.resolve()
+      await flushPromises()
+      expect(startedNestedReplay).toBe(true)
+
+      replayLoads[1]?.reject(new Error(`nested replay failed`))
+      await flushPromises()
+      begin()
+      write({ type: `insert`, value: { id: `one`, value: 1 } })
+      commit()
+
+      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`ignores an aborted released demand while publishing the remaining replay`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replays: Array<{
+      options: { signal?: AbortSignal }
+      deferred: ReturnType<typeof createDeferred<void>>
+    }> = []
+    let loadCount = 0
+    const collection = createCollection<ReplayRow>({
+      id: `released-demand-replay`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          begin = params.begin
+          write = params.write
+          commit = params.commit
+          truncate = params.truncate
+          params.markReady()
+          return {
+            loadSubset: (options) => {
+              loadCount++
+              if (loadCount === 1) {
+                begin()
+                write({ type: `insert`, value: { id: `one`, value: 0 } })
+                write({ type: `insert`, value: { id: `two`, value: 0 } })
+                commit()
+                return true
+              }
+              if (loadCount === 2) return true
+
+              const deferred = createDeferred<void>()
+              replays.push({ options, deferred })
+              return deferred.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const subscription = collection.subscribeChanges((changes) => {
+      for (const change of changes) {
+        if (change.type === `delete`) visible.delete(change.key)
+        else {
+          visible.set(change.key, {
+            id: change.value.id,
+            value: change.value.value,
+          })
+        }
+      }
+    })
+    const demandOne = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const demandTwo = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+
+    try {
+      subscription.requestSnapshot({ where: demandOne })
+      subscription.requestSnapshot({ where: demandTwo })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      subscription.releaseSnapshot(demandOne)
+      expect(replays[0]?.options.signal?.aborted).toBe(true)
+      begin()
+      write({ type: `insert`, value: { id: `two`, value: 2 } })
+      commit()
+      replays[1]?.deferred.resolve()
+      await flushPromises()
+
+      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
+      expect(subscription.status).toBe(`ready`)
+      expect(subscription.lastError).toBeUndefined()
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  const orderedReplayCases = ([`asc`, `desc`] as const).flatMap((direction) => [
+    ...([`return`, `resolve`] as const).flatMap((delivery) =>
+      ([`same`, `changed`] as const).map((identity) => ({
+        name: `${direction} ${delivery} with ${identity} keys`,
+        direction,
+        delivery,
+        identity,
+      })),
+    ),
+    ...([`throw`, `reject`] as const).map((delivery) => ({
+      name: `${direction} ${delivery}`,
+      direction,
+      delivery,
+      identity: `none` as const,
+    })),
+  ])
+
+  it.each(orderedReplayCases)(
+    `requests a safe ordered provider prefix after replay: $name`,
+    async ({ direction, delivery, identity }) => {
+      type OrderedReplayRow = {
+        id: `one` | `two` | `three` | `four`
+        value: number
+      }
+      let begin!: () => void
+      let write!: (
+        message: ChangeMessageOrDeleteKeyMessage<OrderedReplayRow, string>,
+      ) => void
+      let commit!: () => void
+      let truncate!: () => void
+      let loadCount = 0
+      const loadOptions: Array<LoadSubsetOptions> = []
+      const replayLoads: Array<ReturnType<typeof createDeferred<void>>> = []
+      const replayRows: ReadonlyArray<OrderedReplayRow> =
+        identity === `same`
+          ? [
+              { id: `one`, value: 1 },
+              { id: `two`, value: 2 },
+            ]
+          : [
+              { id: `three`, value: 1 },
+              { id: `four`, value: 2 },
+            ]
+      let replayRowsInstalled = false
+      const installReplayRows = () => {
+        if (replayRowsInstalled || identity === `none`) return
+        replayRowsInstalled = true
+        begin()
+        for (const row of replayRows) {
+          write({ type: `insert`, value: row })
+        }
+        commit()
+      }
+      const collection = createCollection<OrderedReplayRow>({
+        id: `ordered-replay-${direction}-${delivery}-${identity}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (params) => {
+            begin = params.begin
+            write = params.write
+            commit = params.commit
+            truncate = params.truncate
+            begin()
+            write({ type: `insert`, value: { id: `one`, value: 1 } })
+            write({ type: `insert`, value: { id: `two`, value: 2 } })
+            commit()
+            params.markReady()
+            return {
+              loadSubset: (options) => {
+                loadCount++
+                loadOptions.push(options)
+                if (loadCount <= 2) return true
+                if (loadCount > 4) return true
+
+                if (delivery === `return`) {
+                  installReplayRows()
+                  return true
+                }
+                if (delivery === `throw`) {
+                  if (loadCount === 3) {
+                    throw new Error(`ordered replay failed`)
+                  }
+                  return true
+                }
+
+                const deferred = createDeferred<void>()
+                replayLoads.push(deferred)
+                return deferred.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const index = collection.createIndex((row) => row.value, {
+        indexType: BTreeIndex,
+      })
+      const orderedIndex =
+        direction === `asc` ? index : new ReverseIndex(index, true)
+      const orderBy = valueOrderBy(direction)
+      const batches: Array<Array<OrderedReplayRow[`id`]>> = []
+      const subscription = collection.subscribeChanges((changes) => {
+        batches.push(changes.map(({ value }) => value.id))
+      })
+      subscription.setOrderByIndex(orderedIndex)
+
+      const initialIds =
+        direction === `asc`
+          ? ([`one`, `two`] as const)
+          : ([`two`, `one`] as const)
+      const replacementIds =
+        direction === `asc`
+          ? ([`three`, `four`] as const)
+          : ([`four`, `three`] as const)
+      const succeeds = delivery === `return` || delivery === `resolve`
+      const expectedIds = identity === `changed` ? replacementIds : initialIds
+
+      try {
+        subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
+        expect(batches).toEqual([[initialIds[0]]])
+        subscription.requestLimitedSnapshot({
+          orderBy,
+          limit: 1,
+          minValues: [direction === `asc` ? 1 : 2],
+        })
+        expect(loadOptions[1]).toMatchObject({ offset: 0 })
+        expect(loadOptions[1]?.limit).toBeUndefined()
+        expect(loadOptions[1]?.cursor?.lastKey).toBeUndefined()
+
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+        expectSameSubsetRequest(loadOptions[2]!, loadOptions[0]!)
+        expectSameSubsetRequest(loadOptions[3]!, loadOptions[1]!)
+
+        if (delivery === `resolve`) {
+          expect(replayLoads).toHaveLength(2)
+          installReplayRows()
+          replayLoads[0]?.resolve()
+          replayLoads[1]?.resolve()
+        } else if (delivery === `reject`) {
+          expect(replayLoads).toHaveLength(2)
+          replayLoads[0]?.reject(new Error(`ordered replay failed`))
+          replayLoads[1]?.resolve()
+        } else {
+          expect(replayLoads).toEqual([])
+        }
+        await flushPromises()
+        expect(collection.toArray.map(({ id }) => id).sort()).toEqual(
+          succeeds ? [...expectedIds].sort() : [],
+        )
+
+        const batchCount = batches.length
+        subscription.requestLimitedSnapshot({
+          orderBy,
+          limit: 1,
+          minValues: [direction === `asc` ? 2 : 1],
+        })
+        expect(loadOptions[4]).toMatchObject({ offset: 0 })
+        expect(loadOptions[4]?.cursor?.lastKey).toBeUndefined()
+        if (succeeds) expect(batches.at(-1)).toEqual([])
+        else expect(batches).toHaveLength(batchCount)
+      } finally {
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A successful replacement restores the public row, but that row need not
+  // be a provider prefix. The plain remote array is the reference order. A
+  // provider may honor a last-key cursor before an offset; naming the sparse
+  // public row as that cursor would hide every earlier row. The held replay
+  // separates replacement settlement from the next ordered acquisition.
+  it(`loads rows before a sparse public key after successful replay`, async () => {
+    type Row = { id: string; value: number }
+    const remote: Array<Row> = [
+      { id: `one`, value: 1 },
+      { id: `two`, value: 2 },
+      { id: `three`, value: 3 },
+    ]
+    let begin!: () => void
+    let write!: (message: { type: `insert`; value: Row }) => void
+    let commit!: () => void
+    let truncate!: () => void
+    let holdReplay = false
+    let heldRequests = 0
+    const held = createDeferred<void>()
+    const orderedLoads: Array<LoadSubsetOptions> = []
+    const collection = createCollection<Row>({
+      id: `ordered-replay-sparse-provider-prefix`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          begin = params.begin
+          write = params.write
+          commit = params.commit
+          truncate = params.truncate
+          begin()
+          write({ type: `insert`, value: remote[2]! })
+          commit()
+          params.markReady()
+          return {
+            loadSubset: (options) => {
+              if (holdReplay && options.orderBy === undefined) {
+                holdReplay = false
+                heldRequests++
+                return held.promise
+              }
+              if (options.orderBy === undefined) return true
+
+              orderedLoads.push(options)
+              const cursorKey = options.cursor?.lastKey
+              const start =
+                cursorKey === undefined
+                  ? (options.offset ?? 0)
+                  : remote.findIndex(({ id }) => id === cursorKey) + 1
+              const page = remote.slice(
+                start,
+                options.limit === undefined ? undefined : start + options.limit,
+              )
+              const missing = page.filter(({ id }) => !collection.has(id))
+              if (missing.length > 0) {
+                begin()
+                for (const value of missing) write({ type: `insert`, value })
+                commit()
+              }
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const index = collection.createIndex((row) => row.value, {
+      indexType: BTreeIndex,
+    })
+    const orderBy = valueOrderBy()
+    const whereThree = new Func(`eq`, [new PropRef([`id`]), new Value(`three`)])
+    const publicRows = new Map<string, Row>()
+    const invalidChanges: Array<string> = []
+    const subscription = collection.subscribeChanges((changes) => {
+      for (const change of changes) {
+        const key = String(change.key)
+        if (change.type === `delete`) {
+          if (!publicRows.delete(key))
+            invalidChanges.push(`delete absent:${key}`)
+        } else {
+          if (change.type === `insert` && publicRows.has(key))
+            invalidChanges.push(`duplicate insert:${key}`)
+          publicRows.set(key, change.value)
+        }
+      }
+    })
+    subscription.setOrderByIndex(index)
+    try {
+      subscription.requestSnapshot({ where: whereThree })
+      expect([...publicRows.keys()]).toEqual([`three`])
+
+      holdReplay = true
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(heldRequests).toBe(1)
+      begin()
+      write({ type: `insert`, value: remote[2]! })
+      commit()
+      expect([...publicRows.keys()]).toEqual([`three`])
+      held.resolve()
+      await flushPromises()
+
+      for (const expectedRow of remote) {
+        subscription.requestLimitedSnapshot({
+          orderBy,
+          limit: 1,
+          minValues: [0],
+        })
+        expect(publicRows.has(expectedRow.id)).toBe(true)
+      }
+      await flushPromises()
+      expect(orderedLoads).toHaveLength(remote.length)
+      expect(orderedLoads[0]).toMatchObject({ offset: 0 })
+      expect(orderedLoads[0]?.cursor?.lastKey).toBeUndefined()
+      expect(invalidChanges).toEqual([])
+      expect([...publicRows.keys()].sort()).toEqual(
+        remote.map(({ id }) => id).sort(),
+      )
+    } finally {
+      held.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  // A direct subscriber buffers ordered rows privately while a replay is
+  // pending. Each row still counts once: repeated ordered snapshots during the
+  // replay continue after the rows already chosen. Those private selections
+  // widen the provider prefix without claiming a provider cursor boundary.
+  it(`continues after buffered rows when ordered snapshots repeat during a replay`, async () => {
+    type Row = { id: string; value: number }
+    let begin!: () => void
+    let write!: (message: { type: `insert`; value: Row }) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const loadOptions: Array<LoadSubsetOptions> = []
+    const heldReplay = createDeferred<void>()
+    let holdReplayRequest = false
+    let heldRequestCount = 0
+    const rows: Array<Row> = [
+      { id: `one`, value: 1 },
+      { id: `two`, value: 2 },
+      { id: `three`, value: 3 },
+    ]
+    const collection = createCollection<Row>({
+      id: `ordered-replay-repeated-snapshots`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          begin = params.begin
+          write = params.write
+          commit = params.commit
+          truncate = params.truncate
+          begin()
+          for (const value of rows) write({ type: `insert`, value })
+          commit()
+          params.markReady()
+          return {
+            // Hold the replay of the first ordered demand. The phase and
+            // request data identify it independently of other load calls.
+            loadSubset: (options) => {
+              loadOptions.push(options)
+              if (
+                holdReplayRequest &&
+                options.orderBy !== undefined &&
+                options.offset === 0 &&
+                options.cursor === undefined
+              ) {
+                holdReplayRequest = false
+                heldRequestCount++
+                return heldReplay.promise
+              }
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const index = collection.createIndex((row) => row.value, {
+      indexType: BTreeIndex,
+    })
+    const orderBy = valueOrderBy()
+    // The public subscriber model starts with one visible row. Replay adds
+    // the other two as one replacement batch, without re-inserting that row.
+    const publicRows = new Map<string, Row>()
+    const batches: Array<Array<string>> = []
+    const invalidChanges: Array<string> = []
+    const subscription = collection.subscribeChanges((changes) => {
+      const batch: Array<string> = []
+      for (const change of changes) {
+        batch.push(`${change.type}:${change.key}`)
+        if (change.type === `insert`) {
+          if (publicRows.has(String(change.key)))
+            invalidChanges.push(`duplicate insert:${change.key}`)
+          publicRows.set(String(change.key), change.value)
+        } else if (change.type === `delete`) {
+          publicRows.delete(String(change.key))
+        } else {
+          publicRows.set(String(change.key), change.value)
+        }
+      }
+      if (batch.length > 0) batches.push(batch)
+    })
+    subscription.setOrderByIndex(index)
+    try {
+      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
+      expect(batches).toEqual([[`insert:one`]])
+      // An unrelated empty demand may be added before replay. It must not
+      // determine which acquisition the fixture holds.
+      subscription.requestSnapshot({
+        where: new Func(`eq`, [new PropRef([`id`]), new Value(`missing`)]),
+      })
+      holdReplayRequest = true
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(heldRequestCount).toBe(1)
+      begin()
+      for (const value of rows) write({ type: `insert`, value })
+      commit()
+      await flushPromises()
+      expect(batches).toEqual([[`insert:one`]])
+
+      const before = loadOptions.length
+      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
+      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
+      subscription.requestLimitedSnapshot({ orderBy, limit: 1 })
+      expect(loadOptions[before + 2]).toMatchObject({ offset: 0 })
+      expect(loadOptions[before + 2]?.limit).toBeGreaterThanOrEqual(4)
+      expect(loadOptions[before + 2]?.cursor?.lastKey).toBeUndefined()
+      expect(batches).toEqual([[`insert:one`]])
+      heldReplay.resolve()
+      await flushPromises()
+      expect(batches.map((batch) => [...batch].sort())).toEqual([
+        [`insert:one`],
+        [`insert:three`, `insert:two`],
+      ])
+      expect(invalidChanges).toEqual([])
+      expect([...publicRows.keys()].sort()).toEqual(
+        rows.map(({ id }) => id).sort(),
+      )
+    } finally {
+      heldReplay.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  // Law 9 at retirement: a failure in the current attempt keeps the replay
+  // private even after the last owner is released. Each site writes a row
+  // before it fails, so publishing the private rows would show that row.
+  // A throwing release is not such a failure; the next test owns that site.
+  it.each([
+    `replay load throws`,
+    `old lease unload throws`,
+    `new request throws`,
+  ])(
+    `keeps a replay private at retirement after a synchronous failure, except a throwing release: %s`,
+    async (site) => {
+      let begin!: () => void
+      let write!: (message: {
+        type: `insert` | `update`
+        value: ReplayRow
+      }) => void
+      let commit!: () => void
+      let truncate!: () => void
+      let loads = 0
+      let unloads = 0
+      const writeRow = (row: ReplayRow) => {
+        begin()
+        write({ type: `insert`, value: row })
+        commit()
+      }
+      const collection = createCollection<ReplayRow>({
+        id: `retired-replay-synchronous-failure-${site}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            write = operations.write
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                if (loads === 1) {
+                  writeRow({ id: `one`, value: 1 })
+                  return true
+                }
+                if (site === `replay load throws` && loads === 2) {
+                  writeRow({ id: `one`, value: 5 })
+                  throw new Error(`replay load failed`)
+                }
+                if (site === `new request throws` && loads === 3) {
+                  writeRow({ id: `two`, value: 2 })
+                  throw new Error(`request failed`)
+                }
+                return createDeferred<void>().promise
+              },
+              unloadSubset: () => {
+                unloads++
+                if (site === `old lease unload throws` && unloads === 1) {
+                  writeRow({ id: `two`, value: 2 })
+                  throw new Error(`unload failed`)
+                }
+              },
+            }
+          },
+        },
+      })
+      const visible = new Map<string | number, ReplayRow>()
+      const uncaught = captureMicrotaskErrors()
+      const subscription = collection.subscribeChanges((changes) => {
+        recordPublishedChanges(visible, changes)
+      })
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      try {
+        subscription.requestSnapshot({ where, optimizedOnly: false })
+        await flushPromises()
+        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 1 }])
+
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+        if (site === `new request throws`) {
+          // A synchronous throw is a rejection: the request fails its load.
+          expect(() =>
+            subscription.requestSnapshot({
+              where: new Func(`eq`, [new PropRef([`id`]), new Value(`two`)]),
+              optimizedOnly: false,
+            }),
+          ).not.toThrow()
+          await flushPromises()
+        }
+        subscription.releaseSnapshot(where)
+        await flushPromises()
+
+        expect(subscription.pendingTruncateReplacement).toBeUndefined()
+        // A release error fails no replay, so the retired replay publishes
+        // the rows it holds: the truncate removed `one`, and the adapter
+        // wrote `two` before it threw.
+        expect(sortedRows(visible)).toEqual(
+          site === `old lease unload throws`
+            ? [{ id: `two`, value: 2 }]
+            : [{ id: `one`, value: 1 }],
+        )
+        expect(
+          uncaught.errors.map((error) => (error as Error).message),
+        ).toEqual(site === `old lease unload throws` ? [`unload failed`] : [])
+      } finally {
+        uncaught.restore()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A synchronous throw is a rejection (maintainer decision), so no failure
+  // is held by an attempt whose setup stack has not returned yet.
+  it.each(
+    [`current`, `pending`].flatMap((scope) =>
+      [`throw`, `reject`].map((failureMode) => ({ scope, failureMode })),
+    ),
+  )(
+    `drops released failure references: $scope, $failureMode`,
+    async ({ scope, failureMode }) => {
+      let begin!: () => void
+      let commit!: () => void
+      let truncate!: () => void
+      const pendingPeer = createDeferred<void>()
+      const replacement = createDeferred<void>()
+      const failure = new Error(`failed owner`)
+      let loads = 0
+      const collection = createCollection<ReplayRow>({
+        id: `released-replay-failure-${scope}-${failureMode}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                if (loads <= 2) return true
+                if (loads === 3) {
+                  if (failureMode === `throw`) throw failure
+                  return Promise.reject(failure)
+                }
+                return loads === 4 ? pendingPeer.promise : replacement.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      const failedWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`one`),
+      ])
+      const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+      const retainedFailures = () => {
+        // Narrow retention witness for old and new representations. Follow
+        // stored replay frames, not a captured map that the source discarded.
+        type Frame = { failures?: Map<unknown, Error> }
+        const replayState = (
+          subscription as unknown as {
+            truncateReplayState: Frame & {
+              currentAttempt: Frame
+              attempts?: Set<Frame>
+              pending?: Set<{ attempt: Frame }>
+            }
+          }
+        ).truncateReplayState
+        const frames = new Set([
+          replayState,
+          replayState.currentAttempt,
+          ...(replayState.attempts ?? []),
+          ...[...(replayState.pending ?? [])].map(({ attempt }) => attempt),
+        ])
+        return [...frames].flatMap((frame) => [
+          ...(frame.failures?.values() ?? []),
+        ])
+      }
+      const replaySource = async () => {
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+      }
+
+      try {
+        subscription.requestSnapshot({
+          where: failedWhere,
+          optimizedOnly: false,
+        })
+        subscription.requestSnapshot({ where: peerWhere, optimizedOnly: false })
+        await replaySource()
+        // This is a retained-state witness, not a row oracle or GC benchmark.
+        // Public rows cannot reveal a released owner held by an old error map.
+        // Adapt this witness if the replay representation changes again.
+        expect(retainedFailures()).toEqual([failure])
+        if (scope === `pending`) await replaySource()
+        subscription.releaseSnapshot(failedWhere)
+        expect(retainedFailures()).toEqual([])
+        expect(subscription.status).toBe(`loadingSubset`)
+        replacement.resolve()
+        pendingPeer.resolve()
+        await flushPromises()
+        expect(subscription.status).toBe(`ready`)
+      } finally {
+        replacement.resolve()
+        pendingPeer.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`does not start a queued replay after a newer truncate supersedes it`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    const loadSignals: Array<AbortSignal | undefined> = []
+    const collection = createCollection<ReplayRow>({
+      id: `superseded-before-replay-setup`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: ({ signal }) => {
+              loadSignals.push(signal)
+              return loadSignals.length === 1 ? true : replay.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({ optimizedOnly: false })
+
+      begin()
+      truncate()
+      commit()
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      expect(loadSignals).toHaveLength(2)
+      expect(loadSignals[0]?.aborted).toBe(true)
+      expect(loadSignals[1]?.aborted).toBe(false)
+    } finally {
+      replay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it.each([
+    `replay`,
+    `additional demand`,
+    `additional pending demand`,
+  ] as const)(
+    `aborts a %s acquisition before a reentrant newer truncate starts`,
+    async (start) => {
+      let begin!: () => void
+      let write!: (
+        message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+      ) => void
+      let commit!: () => void
+      let truncate!: () => void
+      const olderReplay = createDeferred<void>()
+      const newerReplay = createDeferred<void>()
+      const predecessor = createDeferred<void>()
+      const replaySignals: Array<AbortSignal | undefined> = []
+      let loadCount = 0
+      const collection = createCollection<ReplayRow>({
+        id: `reentrant-newer-replay`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            write = operations.write
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: ({ signal }) => {
+                loadCount++
+                if (loadCount === 1) {
+                  begin()
+                  write({ type: `insert`, value: { id: `one`, value: 0 } })
+                  commit()
+                  return true
+                }
+
+                if (loadCount === 2 && start !== `replay`) {
+                  if (start === `additional pending demand`) {
+                    return predecessor.promise
+                  }
+                  // A failed replay retains its public baseline after setup and
+                  // all participants finish. Start the extra demand in that gap.
+                  throw new Error(`retain the failed replay`)
+                }
+                replaySignals.push(signal)
+                if (loadCount === (start === `replay` ? 2 : 3)) {
+                  begin()
+                  truncate()
+                  commit()
+                  return olderReplay.promise
+                }
+                return newerReplay.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const visible = new Map<string | number, ReplayRow>()
+      const subscription = collection.subscribeChanges((changes) => {
+        recordPublishedChanges(visible, changes as Array<ReplayChange>)
+      })
+
+      const install = (value: number) => {
+        begin()
+        write({
+          type: collection.has(`one`) ? `update` : `insert`,
+          value: { id: `one`, value },
+        })
+        commit()
+      }
+
+      try {
+        subscription.requestSnapshot({ optimizedOnly: false })
+        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
+
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+
+        if (start !== `replay`) {
+          if (start === `additional demand`) {
+            expect(subscription.lastError).toEqual(
+              new Error(`retain the failed replay`),
+            )
+          }
+          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
+          subscription.requestSnapshot({
+            where: new Func(`eq`, [new PropRef([`id`]), new Value(`two`)]),
+            optimizedOnly: false,
+          })
+          await flushPromises()
+        }
+
+        expect(replaySignals).toHaveLength(start === `replay` ? 2 : 3)
+        expect(replaySignals[0]?.aborted).toBe(true)
+        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
+
+        install(2)
+        newerReplay.resolve()
+        await flushPromises()
+        if (start === `additional pending demand`) {
+          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
+          predecessor.resolve()
+          await flushPromises()
+          // The returning extra demand joined the retained old attempt. Its
+          // transport still holds publication after that attempt's prior work.
+          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 0 }])
+          expect(subscription.status).toBe(`loadingSubset`)
+        } else {
+          // A startup superseded before return does not hold publication. An
+          // ordinary demand still owns its separate readiness participant.
+          expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+          expect(subscription.status).toBe(
+            start === `replay` ? `ready` : `loadingSubset`,
+          )
+        }
+        if (!replaySignals[0]?.aborted) install(1)
+        olderReplay.resolve()
+        await flushPromises()
+
+        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+        expect(subscription.status).toBe(`ready`)
+      } finally {
+        predecessor.resolve()
+        olderReplay.resolve()
+        newerReplay.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`does not retain replay work registered after its demand is released`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const releasedReplay = createDeferred<void>()
+    let loadCount = 0
+    const collection = createCollection<ReplayRow>({
+      id: `released-during-replay-start`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          begin()
+          write({ type: `insert`, value: { id: `one`, value: 1 } })
+          write({ type: `insert`, value: { id: `two`, value: 1 } })
+          commit()
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              loadCount++
+              if (loadCount <= 2) return true
+              if (loadCount === 3) {
+                subscription.releaseSnapshot(firstWhere)
+                return releasedReplay.promise
+              }
+              begin()
+              write({ type: `insert`, value: { id: `two`, value: 2 } })
+              commit()
+              return Promise.resolve()
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const subscription = collection.subscribeChanges((changes) => {
+      recordPublishedChanges(visible, changes as Array<ReplayChange>)
+    })
+
+    try {
+      subscription.requestSnapshot({
+        where: firstWhere,
+        optimizedOnly: false,
+      })
+      subscription.requestSnapshot({
+        where: secondWhere,
+        optimizedOnly: false,
+      })
+
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      expect(subscription.status).toBe(`ready`)
+      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
+    } finally {
+      releasedReplay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`finishes replay state and surfaces an async subscriber failure`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    const listenerFailure = new Error(`replay subscriber failed`)
+    const queuedMicrotasks: Array<VoidFunction> = []
+    let loadCount = 0
+    let rejectReplacement = false
+    const collection = createCollection<ReplayRow>({
+      id: `async-replay-subscriber-failure`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              loadCount++
+              if (loadCount === 1) {
+                begin()
+                write({ type: `insert`, value: { id: `one`, value: 1 } })
+                commit()
+                return true
+              }
+              return replay.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const subscription = collection.subscribeChanges((changes) => {
+      recordPublishedChanges(visible, changes as Array<ReplayChange>)
+      if (rejectReplacement) throw listenerFailure
+    })
+
+    try {
+      subscription.requestSnapshot({ optimizedOnly: false })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      begin()
+      write({ type: `insert`, value: { id: `one`, value: 2 } })
+      commit()
+      rejectReplacement = true
+      const queueMicrotaskSpy = vi
+        .spyOn(globalThis, `queueMicrotask`)
+        .mockImplementation((callback) => queuedMicrotasks.push(callback))
+      try {
+        replay.resolve()
+        await flushPromises()
+
+        expect(subscription.status).toBe(`ready`)
+        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+        expect(queuedMicrotasks).toHaveLength(1)
+        expect(() => queuedMicrotasks[0]!()).toThrow(listenerFailure)
+      } finally {
+        queueMicrotaskSpy.mockRestore()
+      }
+    } finally {
+      replay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not start another demand for a replay superseded by reentrancy`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    let loadCount = 0
+    let inSupersededSetup = false
+    let staleSecondDemandStarted = false
+    const collection = createCollection<ReplayRow>({
+      id: `reentrant-multi-demand-replay`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          begin()
+          write({ type: `insert`, value: { id: `one`, value: 0 } })
+          write({ type: `insert`, value: { id: `two`, value: 0 } })
+          commit()
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loadCount++
+              if (loadCount <= 2) return true
+              if (loadCount === 3) {
+                inSupersededSetup = true
+                queueMicrotask(() => {
+                  inSupersededSetup = false
+                })
+                begin()
+                truncate()
+                commit()
+                return true
+              }
+              if (inSupersededSetup) {
+                staleSecondDemandStarted = true
+                begin()
+                write({ type: `insert`, value: { id: `two`, value: 1 } })
+                commit()
+                return true
+              }
+              if (options.where === firstWhere) {
+                begin()
+                write({ type: `insert`, value: { id: `one`, value: 2 } })
+                commit()
+              }
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const subscription = collection.subscribeChanges((changes) => {
+      recordPublishedChanges(visible, changes as Array<ReplayChange>)
+    })
+
+    try {
+      subscription.requestSnapshot({
+        where: firstWhere,
+        optimizedOnly: false,
+      })
+      subscription.requestSnapshot({
+        where: secondWhere,
+        optimizedOnly: false,
+      })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      expect(staleSecondDemandStarted).toBe(false)
+      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not start replay work retired by the loading transition`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createCollection<ReplayRow>({
+      id: `reentrant-status-release`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return loads.length === 1 ? true : replay.promise
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    let releaseOnLoading = false
+    subscription.on(`status:loadingSubset`, () => {
+      if (releaseOnLoading) subscription.releaseSnapshot(where)
+    })
+
+    try {
+      subscription.requestSnapshot({ where, optimizedOnly: false })
+      releaseOnLoading = true
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      expect(loads).toHaveLength(1)
+      expect(unloads).toEqual([loads[0]])
+      expect(subscription.status).toBe(`ready`)
+    } finally {
+      replay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`releases replay work when its final publication callback throws`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const listenerFailure = new Error(`release publication failed`)
+    let rejectReplacement = false
+    const collection = createCollection<ReplayRow>({
+      id: `replay-release-callback-cleanup`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              if (loads.length === 1) {
+                begin()
+                write({ type: `insert`, value: { id: `one`, value: 1 } })
+                commit()
+                return true
+              }
+              return replay.promise
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      truncateReplayPublication: {
+        start: () => {},
+        succeed: () => {
+          if (rejectReplacement) throw listenerFailure
+        },
+      },
+    })
+
+    try {
+      subscription.requestSnapshot({ where, optimizedOnly: false })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      begin()
+      write({ type: `insert`, value: { id: `one`, value: 2 } })
+      commit()
+      rejectReplacement = true
+
+      expect(() => subscription.releaseSnapshot(where)).toThrow(listenerFailure)
+      expect(loads[1]?.signal?.aborted).toBe(true)
+      expect(unloads.map((options) => loads.indexOf(options))).toEqual([0, 1])
+      expect(subscription.status).toBe(`ready`)
+    } finally {
+      rejectReplacement = false
+      replay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not retain a demand released during adapter startup`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    const releasedLoad = createDeferred<void>()
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createCollection<ReplayRow>({
+      id: `reentrant-new-demand-release`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              if (loads.length === 1) return true
+              if (loads.length === 2) return replay.promise
+              subscription.releaseSnapshot(secondWhere)
+              return releasedLoad.promise
+            },
+            unloadSubset: (options) => unloads.push(options),
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    try {
+      subscription.requestSnapshot({
+        where: firstWhere,
+        optimizedOnly: false,
+      })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      subscription.requestSnapshot({
+        where: secondWhere,
+        optimizedOnly: false,
+      })
+      replay.resolve()
+      await flushPromises()
+
+      expect(loads).toHaveLength(3)
+      expect(loads[2]?.signal?.aborted).toBe(true)
+      expect(unloads).toContain(loads[2])
+      expect(subscription.status).toBe(`ready`)
+      expect(subscription.pendingTruncateReplacement).toBeUndefined()
+    } finally {
+      releasedLoad.resolve()
+      replay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`publishes a replay replacement before reporting ready`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    let loadCount = 0
+    const collection = createCollection<ReplayRow>({
+      id: `replay-ready-after-publication`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              loadCount++
+              if (loadCount === 1) {
+                begin()
+                write({ type: `insert`, value: { id: `one`, value: 1 } })
+                commit()
+                return true
+              }
+              return replay.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const readyValues: Array<number | undefined> = []
+    const subscription = collection.subscribeChanges((changes) => {
+      recordPublishedChanges(visible, changes as Array<ReplayChange>)
+    })
+    subscription.on(`status:ready`, () => {
+      readyValues.push(visible.get(`one`)?.value)
+    })
+
+    try {
+      subscription.requestSnapshot({ optimizedOnly: false })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      begin()
+      write({ type: `insert`, value: { id: `one`, value: 2 } })
+      commit()
+
+      replay.resolve()
+      await flushPromises()
+
+      expect(readyValues).toEqual([2])
+      expect(visible.get(`one`)?.value).toBe(2)
+      expect(subscription.status).toBe(`ready`)
+    } finally {
+      replay.resolve()
+      await flushPromises()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`ignores a synchronous replay failure after its demand releases itself`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const releasedFailure = new Error(`released replay load failed`)
+    const reportedErrors: Array<unknown> = []
+    let loadCount = 0
+    const collection = createCollection<ReplayRow>({
+      id: `released-sync-failure`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          begin()
+          write({ type: `insert`, value: { id: `one`, value: 1 } })
+          write({ type: `insert`, value: { id: `two`, value: 1 } })
+          commit()
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              loadCount++
+              if (loadCount <= 2) return true
+              if (loadCount === 3) {
+                subscription.releaseSnapshot(firstWhere)
+                throw releasedFailure
+              }
+              begin()
+              write({ type: `insert`, value: { id: `two`, value: 2 } })
+              commit()
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<string | number, ReplayRow>()
+    const subscription = collection.subscribeChanges((changes) => {
+      recordPublishedChanges(visible, changes as Array<ReplayChange>)
+    })
+    subscription.on(`loadSubset:error`, ({ error }) => {
+      reportedErrors.push(error)
+    })
+
+    try {
+      subscription.requestSnapshot({
+        where: firstWhere,
+        optimizedOnly: false,
+      })
+      subscription.requestSnapshot({
+        where: secondWhere,
+        optimizedOnly: false,
+      })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+
+      expect(reportedErrors).not.toContain(releasedFailure)
+      expect(sortedRows(visible)).toEqual([{ id: `two`, value: 2 }])
+      expect(subscription.status).toBe(`ready`)
+      expect(subscription.pendingTruncateReplacement).toBeUndefined()
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it.each(
+    [false, true].flatMap((releaseDemand) =>
+      [false, true].map((failRelease) => ({ releaseDemand, failRelease })),
+    ),
+  )(
+    `releases before reacquisition with releaseDemand=$releaseDemand and failRelease=$failRelease`,
+    async ({ releaseDemand, failRelease }) => {
+      let begin!: () => void
+      let commit!: () => void
+      let truncate!: () => void
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      let reentered = false
+      const releaseFailure = new Error(
+        `old replay acquisition lease release failed`,
+      )
+      const collection = createCollection<ReplayRow>({
+        id: `reentrant-replay-acquisition-lease-replacement`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return true
+              },
+              unloadSubset: (options) => {
+                unloads.push(options)
+                if (options === loads[0] && !reentered) {
+                  reentered = true
+                  if (releaseDemand) subscription.releaseSnapshot(where)
+                  if (failRelease) throw releaseFailure
+                }
+              },
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      const uncaught = captureMicrotaskErrors()
+
+      try {
+        subscription.requestSnapshot({ where, optimizedOnly: false })
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+
+        // A failed release is reported uncaught and still counts as released,
+        // so only a retired logical demand stops the reacquisition.
+        const reacquires = !releaseDemand
+        expect(loads).toHaveLength(reacquires ? 2 : 1)
+        // indexOf checks the exact options object, not a structurally equal copy.
+        expect(unloads.map((options) => loads.indexOf(options))).toEqual([0])
+        if (reacquires) expect(loads[1]!.signal?.aborted).toBe(false)
+        expect(subscription.lastError).toBe(undefined)
+        expect(uncaught.errors).toEqual(failRelease ? [releaseFailure] : [])
+        subscription.unsubscribe()
+        // A retired logical demand never starts a replacement.
+        expect(unloads.map((options) => loads.indexOf(options))).toEqual(
+          reacquires ? [0, 1] : [0],
+        )
+      } finally {
+        uncaught.restore()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`rejects replay completion with the exact reported adapter error`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replayLoad = createDeferred<void>()
+    const failure = new Error(`exact replay failure`)
+    const reportedErrors: Array<unknown> = []
+    let loadCount = 0
+    const collection = createCollection<ReplayRow>({
+      id: `exact-replay-completion-error`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: () => (++loadCount === 1 ? true : replayLoad.promise),
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+      truncateReplayPublication: {
+        start: () => {},
+        succeed: () => {},
+      },
+    })
+    subscription.on(`loadSubset:error`, ({ error }) => {
+      reportedErrors.push(error)
+    })
+
+    try {
+      subscription.requestSnapshot({ optimizedOnly: false })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      const replacement = subscription.pendingTruncateReplacement
+      expect(replacement).toBeInstanceOf(Promise)
+
+      replayLoad.reject(failure)
+
+      await expect(replacement).rejects.toBe(failure)
+      expect(subscription.lastError).toBe(failure)
+      expect(reportedErrors).toEqual([failure])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`normalizes one primitive rejection for every observer of a shared replay`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replayLoad = createDeferred<void>()
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const reportedErrors: Array<{
+      options: LoadSubsetOptions
+      error: unknown
+    }> = []
+    let loadCount = 0
+    const collection = createCollection<ReplayRow>({
+      id: `shared-primitive-replay-error`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              loadCount++
+              return loadCount <= 2 ? true : replayLoad.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+      truncateReplayPublication: {
+        start: () => {},
+        succeed: () => {},
+      },
+    })
+    subscription.on(`loadSubset:error`, ({ options, error }) => {
+      reportedErrors.push({ options, error })
+    })
+
+    try {
+      subscription.requestSnapshot({
+        where: firstWhere,
+        optimizedOnly: false,
+      })
+      subscription.requestSnapshot({
+        where: secondWhere,
+        optimizedOnly: false,
+      })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      const replacement = subscription.pendingTruncateReplacement
+      expect(replacement).toBeInstanceOf(Promise)
+      expect(loads.map(({ where }) => where)).toEqual([
+        firstWhere,
+        secondWhere,
+        firstWhere,
+        secondWhere,
+      ])
+
+      replayLoad.reject(undefined)
+
+      let replacementError: unknown
+      try {
+        await replacement
+      } catch (error) {
+        replacementError = error
+      }
+      expect(reportedErrors).toHaveLength(2)
+      expect(reportedErrors.map(({ options }) => options)).toEqual([
+        loads[2],
+        loads[3],
+      ])
+      expect(reportedErrors[0]?.error).toBeInstanceOf(Error)
+      expect(reportedErrors[1]?.error).toBe(reportedErrors[0]?.error)
+      expect(subscription.lastError).toBe(reportedErrors[0]?.error)
+      expect(replacementError).toBe(reportedErrors[0]?.error)
+    } finally {
+      replayLoad.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it.each([`none`, `first`, `second`, `both`] as const)(
+    `normalizes one primitive rejection for ordinary shared loads after releasing %s demand`,
+    async (released) => {
+      const sharedLoad = createDeferred<void>()
+      const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const secondWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`two`),
+      ])
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const reportedErrors: Array<{
+        options: LoadSubsetOptions
+        error: unknown
+      }> = []
+      const collection = createCollection<ReplayRow>({
+        id: `shared-primitive-ordinary-error-${released}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            operations.markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                return sharedLoad.promise
+              },
+              unloadSubset: (options) => unloads.push(options),
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      subscription.on(`loadSubset:error`, ({ options, error }) => {
+        reportedErrors.push({ options, error })
+      })
+
+      try {
+        subscription.requestSnapshot({ where: firstWhere })
+        subscription.requestSnapshot({ where: secondWhere })
+        expect(loads.map(({ where }) => where)).toEqual([
+          firstWhere,
+          secondWhere,
+        ])
+
+        if (released === `first` || released === `both`) {
+          subscription.releaseSnapshot(firstWhere)
+        }
+        if (released === `second` || released === `both`) {
+          subscription.releaseSnapshot(secondWhere)
+        }
+        expect(loads[0]?.signal?.aborted).toBe(
+          released === `first` || released === `both`,
+        )
+        expect(loads[1]?.signal?.aborted).toBe(
+          released === `second` || released === `both`,
+        )
+
+        sharedLoad.reject(undefined)
+        await flushPromises()
+
+        const activeLoads = loads.filter((load) => !load.signal?.aborted)
+        expect(reportedErrors.map(({ options }) => options)).toEqual(
+          activeLoads,
+        )
+        if (activeLoads.length > 0) {
+          expect(reportedErrors[0]?.error).toBeInstanceOf(Error)
+          for (const { error } of reportedErrors) {
+            expect(error).toBe(reportedErrors[0]?.error)
+          }
+          expect(subscription.lastError).toBe(reportedErrors[0]?.error)
+        } else {
+          expect(subscription.lastError).toBeUndefined()
+        }
+        expect(subscription.status).toBe(`ready`)
+      } finally {
+        sharedLoad.resolve()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+      expect(unloads).toHaveLength(loads.length)
+      for (const load of loads) {
+        expect(unloads.filter((options) => options === load)).toHaveLength(1)
+      }
+    },
+  )
+
+  it.each([`first`, `second`, `both`] as const)(
+    `settles a shared replay rejection after releasing %s demand`,
+    async (released) => {
+      let begin!: () => void
+      let commit!: () => void
+      let truncate!: () => void
+      const replayLoad = createDeferred<void>()
+      const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const secondWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`two`),
+      ])
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      const reportedErrors: Array<{
+        options: LoadSubsetOptions
+        error: unknown
+      }> = []
+      let loadCount = 0
+      let replayStarts = 0
+      let replaySuccesses = 0
+      const collection = createCollection<ReplayRow>({
+        id: `released-shared-primitive-replay-error-${released}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                loadCount++
+                return loadCount <= 2 ? true : replayLoad.promise
+              },
+              unloadSubset: (options) => unloads.push(options),
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+        truncateReplayPublication: {
+          start: () => replayStarts++,
+          succeed: () => replaySuccesses++,
+        },
+      })
+      subscription.on(`loadSubset:error`, ({ options, error }) => {
+        reportedErrors.push({ options, error })
+      })
+
+      try {
+        subscription.requestSnapshot({ where: firstWhere })
+        subscription.requestSnapshot({ where: secondWhere })
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+        const replacement = subscription.pendingTruncateReplacement
+        expect(replacement).toBeInstanceOf(Promise)
+        expect(loads.map(({ where }) => where)).toEqual([
+          firstWhere,
+          secondWhere,
+          firstWhere,
+          secondWhere,
+        ])
+        const settlement = replacement!.then(
+          () => ({ status: `resolved` as const }),
+          (error: unknown) => ({ status: `rejected` as const, error }),
+        )
+        expect({ replayStarts, replaySuccesses }).toEqual({
+          replayStarts: 1,
+          replaySuccesses: 0,
+        })
+
+        if (released === `first` || released === `both`) {
+          subscription.releaseSnapshot(firstWhere)
+        }
+        if (released === `second` || released === `both`) {
+          subscription.releaseSnapshot(secondWhere)
+        }
+        expect(loads[2]?.signal?.aborted).toBe(
+          released === `first` || released === `both`,
+        )
+        expect(loads[3]?.signal?.aborted).toBe(
+          released === `second` || released === `both`,
+        )
+
+        if (released === `both`) {
+          const result = await settlement
+          expect(result).toMatchObject({
+            status: `rejected`,
+            error: { name: `AbortError` },
+          })
+          expect(reportedErrors).toEqual([])
+          expect(subscription.lastError).toBeUndefined()
+          expect(subscription.status).toBe(`ready`)
+          expect(replaySuccesses).toBe(1)
+        } else {
+          expect(subscription.pendingTruncateReplacement).toBe(replacement)
+          expect(subscription.status).toBe(`loadingSubset`)
+          replayLoad.reject(undefined)
+          const result = await settlement
+          expect(result.status).toBe(`rejected`)
+
+          const activeIndex = released === `first` ? 3 : 2
+          expect(reportedErrors).toHaveLength(1)
+          expect(reportedErrors[0]?.options).toBe(loads[activeIndex])
+          expect(reportedErrors[0]?.error).toBeInstanceOf(Error)
+          expect(subscription.lastError).toBe(reportedErrors[0]?.error)
+          expect(result).toMatchObject({
+            status: `rejected`,
+            error: reportedErrors[0]?.error,
+          })
+        }
+      } finally {
+        replayLoad.resolve()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+      expect(unloads).toHaveLength(loads.length)
+      for (const load of loads) {
+        expect(unloads.filter((options) => options === load)).toHaveLength(1)
+      }
+      expect(replayStarts).toBe(1)
+      expect(replaySuccesses).toBe(released === `both` ? 1 : 0)
+    },
+  )
+
+  it(`ignores a retired demand's replay failure once surviving demand succeeds`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const firstReplay = createDeferred<void>()
+    const secondReplay = createDeferred<void>()
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const failure = new Error(`retired demand failed`)
+    let replaySuccesses = 0
+    const collection = createCollection<ReplayRow>({
+      id: `retired-replay-failure`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              if (loads.length <= 2) return true
+              return loads.length === 3
+                ? firstReplay.promise
+                : secondReplay.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+      truncateReplayPublication: {
+        start: () => {},
+        succeed: () => replaySuccesses++,
+      },
+    })
+
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      subscription.requestSnapshot({ where: secondWhere })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      const replacement = subscription.pendingTruncateReplacement
+      expect(replacement).toBeInstanceOf(Promise)
+
+      firstReplay.reject(failure)
+      await flushPromises()
+      subscription.releaseSnapshot(firstWhere)
+      secondReplay.resolve()
+
+      await expect(replacement).resolves.toBeUndefined()
+      expect(replaySuccesses).toBe(1)
+      expect(subscription.status).toBe(`ready`)
+    } finally {
+      firstReplay.resolve()
+      secondReplay.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`retains successful peer rows after failed replay demand retires`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const failed = createDeferred<void>()
+    const successful = createDeferred<void>()
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const secondWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const visible = new Map<string | number, ReplayRow>()
+    const batches: Array<Array<ReplayChange>> = []
+    let survivingRows: Array<ReplayRow> = []
+    const collection = createCollection<ReplayRow>({
+      id: `settled-replay-peer`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              const id = options.where === firstWhere ? `one` : `two`
+              begin()
+              write({
+                type: `insert`,
+                value: { id, value: loads.length <= 2 ? 1 : 2 },
+              })
+              commit()
+              if (loads.length <= 2) return true
+              return id === `one` ? failed.promise : successful.promise
+            },
+            unloadSubset: (options) => {
+              unloads.push(options)
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges((changes) => {
+      batches.push(recordPublishedChanges(visible, changes))
+    })
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      subscription.requestSnapshot({ where: secondWhere })
+      expect(sortedRows(visible)).toEqual([
+        { id: `one`, value: 1 },
+        { id: `two`, value: 1 },
+      ])
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(loads).toHaveLength(4)
+      failed.reject(new Error(`first demand replay failed`))
+      successful.resolve()
+      await flushPromises()
+      expect(sortedRows(visible)).toEqual([
+        { id: `one`, value: 1 },
+        { id: `two`, value: 1 },
+      ])
+      subscription.releaseSnapshot(firstWhere)
+      await flushPromises()
+      // Retirement leaves only the successful demand. Its replacement rows
+      // must survive failure handling for the now-retired peer.
+      survivingRows = sortedRows(visible)
+      subscription.releaseSnapshot(secondWhere)
+      // Outside replay, release ends acquisition ownership; this adapter does
+      // not evict its cached rows. The still-live subscriber observes deletion
+      // when the source actually removes the row.
+      expect(sortedRows(visible)).toEqual([
+        { id: `one`, value: 2 },
+        { id: `two`, value: 2 },
+      ])
+      begin()
+      write({ type: `delete`, key: `two` })
+      commit()
+      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+    } finally {
+      failed.resolve()
+      successful.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+    expect(unloads).toHaveLength(4)
+    for (const load of loads) {
+      expect(unloads.filter((options) => options === load)).toHaveLength(1)
+    }
+    expect(survivingRows).toEqual([
+      { id: `one`, value: 2 },
+      { id: `two`, value: 2 },
+    ])
+  })
+
+  it(`keeps replay completion failure separate from a peer release failure`, async () => {
+    let begin!: () => void
+    let commit!: () => void
+    let truncate!: () => void
+    const failed = createDeferred<void>()
+    const peer = createDeferred<void>()
+    const replayFailure = new Error(`replay failed`)
+    const releaseFailure = new Error(`peer release failed`)
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const peerWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloadAttempts: Array<LoadSubsetOptions> = []
+    const unloaded: Array<LoadSubsetOptions> = []
+    let failRelease = false
+    const succeeded = vi.fn()
+    const uncaught = captureMicrotaskErrors()
+    const collection = createCollection<ReplayRow>({
+      id: `replay-error-ownership`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              if (loads.length <= 2) return true
+              return options.where === firstWhere
+                ? failed.promise
+                : peer.promise
+            },
+            unloadSubset: (options) => {
+              unloadAttempts.push(options)
+              if (failRelease && options === loads[3]) {
+                failRelease = false
+                throw releaseFailure
+              }
+              unloaded.push(options)
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+      truncateReplayPublication: { start: () => {}, succeed: succeeded },
+    })
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      subscription.requestSnapshot({ where: peerWhere })
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(loads).toHaveLength(4)
+      const completion = subscription.pendingTruncateReplacement
+      expect(completion).toBeInstanceOf(Promise)
+      const observed = completion!.then(
+        () => ({ status: `resolved` as const }),
+        (error: unknown) => ({ status: `rejected` as const, error }),
+      )
+      failed.reject(replayFailure)
+      await flushPromises()
+      failRelease = true
+      // The release error goes uncaught; the replay keeps its own failure.
+      expect(() => subscription.releaseSnapshot(peerWhere)).not.toThrow()
+      await Promise.resolve()
+      expect(uncaught.errors).toEqual([releaseFailure])
+      expect(succeeded).not.toHaveBeenCalled()
+      await expect(observed).resolves.toEqual({
+        status: `rejected`,
+        error: replayFailure,
+      })
+      const result = await observed
+      expect(`error` in result ? result.error : undefined).toBe(replayFailure)
+      peer.resolve()
+      await flushPromises()
+      await expect(observed).resolves.toEqual({
+        status: `rejected`,
+        error: replayFailure,
+      })
+    } finally {
+      uncaught.restore()
+      failed.resolve()
+      peer.resolve()
+      failRelease = false
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+    expect(
+      unloadAttempts.filter((options) => options === loads[3]),
+    ).toHaveLength(1)
+    expect(unloaded).toHaveLength(3)
+    for (const load of loads) {
+      expect(unloaded.filter((options) => options === load)).toHaveLength(
+        load === loads[3] ? 0 : 1,
+      )
+    }
+  })
+
+  it(`waits for a new async demand acquired while unloading a replay acquisition lease`, async () => {
+    let begin!: () => void
+    let write!: (
+      message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+    ) => void
+    let commit!: () => void
+    let truncate!: () => void
+    const replay = createDeferred<void>()
+    const nested = createDeferred<void>()
+    const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const nestedWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`two`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const ready = vi.fn()
+    const visible = new Map<string | number, ReplayRow>()
+    const publications: Array<Array<ReplayRow>> = []
+    const collection = createCollection<ReplayRow>({
+      id: `replay-new-demand-readiness`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              begin()
+              write({
+                type: `insert`,
+                value: {
+                  id: options.where === nestedWhere ? `two` : `one`,
+                  value: loads.length === 1 ? 1 : 2,
+                },
+              })
+              commit()
+              if (loads.length === 1) return true
+              return options.where === nestedWhere
+                ? nested.promise
+                : replay.promise
+            },
+            unloadSubset: (options) => {
+              unloads.push(options)
+              if (options === loads[0]) {
+                subscription.requestSnapshot({ where: nestedWhere })
+              }
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        recordPublishedChanges(visible, changes)
+        publications.push(sortedRows(visible))
+      },
+      { includeInitialState: false },
+    )
+    try {
+      subscription.requestSnapshot({ where: firstWhere })
+      publications.length = 0
+      subscription.on(`status:ready`, ready)
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      expect(loads.map(({ where }) => where)).toEqual([
+        firstWhere,
+        nestedWhere,
+        firstWhere,
+      ])
+      expect(unloads).toEqual([loads[0]])
+      const completion = subscription.pendingTruncateReplacement
+      expect(completion).toBeInstanceOf(Promise)
+      const settled = vi.fn()
+      void completion!.then(settled, settled)
+      replay.resolve()
+      await flushPromises()
+      expect(subscription.status).not.toBe(`ready`)
+      expect(ready).not.toHaveBeenCalled()
+      expect(settled).not.toHaveBeenCalled()
+      expect(sortedRows(visible)).toEqual([{ id: `one`, value: 1 }])
+      expect(publications).toEqual([])
+      nested.resolve()
+      await completion
+      await flushPromises()
+      expect(subscription.status).toBe(`ready`)
+      expect(ready).toHaveBeenCalledTimes(1)
+      expect(settled).toHaveBeenCalledTimes(1)
+      expect(sortedRows(visible)).toEqual([
+        { id: `one`, value: 2 },
+        { id: `two`, value: 2 },
+      ])
+      expect(publications).toEqual([
+        [
+          { id: `one`, value: 2 },
+          { id: `two`, value: 2 },
+        ],
+      ])
+    } finally {
+      replay.resolve()
+      nested.resolve()
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+    expect(unloads).toHaveLength(3)
+    for (const load of loads) {
+      expect(unloads.filter((options) => options === load)).toHaveLength(1)
+    }
+  })
+
+  it.each([`after-release`, `during-ready`, `during-unload`] as const)(
+    `reacquires a final released replay demand %s without waiting for obsolete work`,
+    async (reacquireTiming) => {
+      let begin!: () => void
+      let write!: (
+        message: ChangeMessageOrDeleteKeyMessage<ReplayRow, string>,
+      ) => void
+      let commit!: () => void
+      let truncate!: () => void
+      const replayLoad = createDeferred<void>()
+      const reacquiredLoad = createDeferred<void>()
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const loads: Array<LoadSubsetOptions> = []
+      const unloads: Array<LoadSubsetOptions> = []
+      let reacquireOnReady = false
+      let reacquireInUnload = false
+      const collection = createCollection<ReplayRow>({
+        id: `final-replay-reacquire-${reacquireTiming}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            write = operations.write
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: (options) => {
+                loads.push(options)
+                if (loads.length === 1) {
+                  begin()
+                  write({ type: `insert`, value: { id: `one`, value: 1 } })
+                  commit()
+                  return true
+                }
+                if (loads.length === 2) {
+                  begin()
+                  write({ type: `insert`, value: { id: `one`, value: 2 } })
+                  commit()
+                  return replayLoad.promise
+                }
+                return reacquireTiming === `during-unload`
+                  ? reacquiredLoad.promise
+                  : true
+              },
+              unloadSubset: (options) => {
+                unloads.push(options)
+                if (reacquireInUnload && options === loads[1]) {
+                  reacquireInUnload = false
+                  subscription.requestSnapshot({ where })
+                }
+              },
+            }
+          },
+        },
+      })
+      const visible = new Map<string | number, ReplayRow>()
+      const batches: Array<Array<ReplayChange>> = []
+      const subscription: CollectionSubscription = collection.subscribeChanges(
+        (changes) => {
+          batches.push(recordPublishedChanges(visible, changes))
+        },
+      )
+      const readyRows: Array<Array<ReplayRow>> = []
+      subscription.on(`status:ready`, () => {
+        readyRows.push(sortedRows(visible))
+        if (reacquireOnReady) {
+          reacquireOnReady = false
+          subscription.requestSnapshot({ where })
+        }
+      })
+
+      try {
+        subscription.requestSnapshot({ where })
+        begin()
+        truncate()
+        commit()
+        await flushPromises()
+        const replacement = subscription.pendingTruncateReplacement
+        expect(replacement).toBeInstanceOf(Promise)
+        const settlement = replacement!.then(
+          () => ({ status: `resolved` as const }),
+          (error: unknown) => ({ status: `rejected` as const, error }),
+        )
+
+        // Release has no synthetic delete callback. Reenter from its actual
+        // ready notification instead; the old replay is already retired then.
+        reacquireOnReady = reacquireTiming === `during-ready`
+        reacquireInUnload = reacquireTiming === `during-unload`
+        subscription.releaseSnapshot(where)
+        // Releasing the final demand retires the replay, which publishes the
+        // row it holds, so the replacement resolves.
+        if (reacquireTiming === `after-release`) {
+          await expect(settlement).resolves.toEqual({ status: `resolved` })
+          subscription.requestSnapshot({ where })
+        } else if (reacquireTiming === `during-unload`) {
+          let settled = false
+          void settlement.then(() => {
+            settled = true
+          })
+          const batchesBeforePendingFlush = batches.length
+          await flushPromises()
+          expect(settled).toBe(false)
+          expect(subscription.status).not.toBe(`ready`)
+          expect(readyRows).toEqual([])
+          expect(batches).toHaveLength(batchesBeforePendingFlush)
+          const batchesBeforeObsoleteSettlement = batches.length
+          replayLoad.resolve()
+          await flushPromises()
+          expect(settled).toBe(false)
+          expect(subscription.status).not.toBe(`ready`)
+          expect(readyRows).toEqual([])
+          expect(batches).toHaveLength(batchesBeforeObsoleteSettlement)
+          reacquiredLoad.resolve()
+          await expect(settlement).resolves.toEqual({ status: `resolved` })
+        } else {
+          expect(subscription.pendingTruncateReplacement).toBeUndefined()
+          await expect(settlement).resolves.toEqual({ status: `resolved` })
+        }
+
+        expect(subscription.pendingTruncateReplacement).toBeUndefined()
+        expect(sortedRows(visible)).toEqual([{ id: `one`, value: 2 }])
+        expect(sortedChanges(batches[0]!)).toEqual([
+          { type: `insert`, key: `one`, value: { id: `one`, value: 1 } },
+        ])
+        // Retiring the replay publishes its applied row at the release; the
+        // reacquired demand then has nothing new to deliver.
+        expect(
+          sortedChanges(batches.filter((batch) => batch.length > 0).at(-1)!),
+        ).toEqual([
+          {
+            type: `update`,
+            key: `one`,
+            value: { id: `one`, value: 2 },
+            previousValue: { id: `one`, value: 1 },
+          },
+        ])
+        expect(batches.filter((batch) => batch.length > 0)).toHaveLength(2)
+        expect(loads).toHaveLength(3)
+        expect(loads.map(({ where: requestWhere }) => requestWhere)).toEqual([
+          where,
+          where,
+          where,
+        ])
+        if (reacquireTiming === `during-unload`) {
+          expect(readyRows).toEqual([[{ id: `one`, value: 2 }]])
+        }
+      } finally {
+        replayLoad.resolve()
+        reacquiredLoad.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+      expect(unloads).toHaveLength(loads.length)
+      for (const load of loads) {
+        expect(unloads.filter((options) => options === load)).toHaveLength(1)
+      }
+    },
+  )
+
+  it(`does not start replacement work after release unsubscribes`, () => {
+    const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const collection = createCollection<ReplayRow>({
+      id: `reentrant-replacement-unsubscribe`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: (options) => {
+              unloads.push(options)
+              subscription.unsubscribe()
+            },
+          }
+        },
+      },
+    })
+    const subscription = collection.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+
+    let release: (() => void) | undefined
+    subscription.requestSnapshot({
+      where,
+      optimizedOnly: false,
+      onLoadSubsetResult: (_result, _options, releaseDemand) => {
+        release = releaseDemand
+      },
+    })
+    expect(release).toBeTypeOf(`function`)
+    release!()
+    expect(
+      subscription.requestSnapshot({
+        where,
+        optimizedOnly: false,
+      }),
+    ).toBe(false)
+
+    expect(loads).toHaveLength(1)
+    expect(unloads).toEqual([loads[0]])
+  })
+
+  it.each([`generic`, `specific`] as const)(
+    `does not emit a stale specific status after reentrant release from a %s listener`,
+    async (reentryEvent) => {
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const load = createDeferred<void>()
+      const collection = createCollection<ReplayRow>({
+        id: `reentrant-specific-status`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            operations.markReady()
+            return {
+              loadSubset: () => load.promise,
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      const observed: Array<{ event: string; current: string }> = []
+      if (reentryEvent === `generic`) {
+        subscription.on(`status:change`, ({ status }) => {
+          if (status === `loadingSubset`) subscription.releaseSnapshot(where)
+        })
+      } else {
+        subscription.on(`status:loadingSubset`, () => {
+          subscription.releaseSnapshot(where)
+        })
+      }
+      subscription.on(`status:loadingSubset`, ({ status }) => {
+        observed.push({ event: status, current: subscription.status })
+      })
+      subscription.on(`status:ready`, ({ status }) => {
+        observed.push({ event: status, current: subscription.status })
+      })
+
+      try {
+        subscription.requestSnapshot({ where, optimizedOnly: false })
+        expect(observed).toEqual([{ event: `ready`, current: `ready` }])
+      } finally {
+        load.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each([`generic`, `specific`] as const)(
+    `does not resume an obsolete status transition after %s-listener ABA reentry`,
+    async (reentryEvent) => {
+      const firstWhere = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const secondWhere = new Func(`eq`, [
+        new PropRef([`id`]),
+        new Value(`two`),
+      ])
+      const load = createDeferred<void>()
+      const collection = createCollection<ReplayRow>({
+        id: `reentrant-status-aba-${reentryEvent}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            operations.markReady()
+            return {
+              loadSubset: () => load.promise,
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      const trace: Array<string> = []
+      let reentered = false
+      const reenter = () => {
+        if (reentered) return
+        reentered = true
+        subscription.releaseSnapshot(firstWhere)
+        subscription.requestSnapshot({ where: secondWhere })
+      }
+      if (reentryEvent === `generic`) {
+        subscription.on(`status:change`, ({ status }) => {
+          if (status === `loadingSubset`) reenter()
+        })
+      } else {
+        subscription.on(`status:loadingSubset`, reenter)
+      }
+      subscription.on(`status:change`, ({ previousStatus, status }) => {
+        trace.push(
+          `generic:${previousStatus}->${status}:${subscription.status}`,
+        )
+      })
+      subscription.on(`status:loadingSubset`, () => {
+        trace.push(`specific:loadingSubset:${subscription.status}`)
+      })
+
+      try {
+        subscription.requestSnapshot({ where: firstWhere })
+
+        expect(trace).toEqual(
+          reentryEvent === `generic`
+            ? [
+                `generic:loadingSubset->ready:ready`,
+                `generic:ready->loadingSubset:loadingSubset`,
+                `specific:loadingSubset:loadingSubset`,
+              ]
+            : [
+                `generic:ready->loadingSubset:loadingSubset`,
+                `generic:loadingSubset->ready:ready`,
+                `generic:ready->loadingSubset:loadingSubset`,
+                `specific:loadingSubset:loadingSubset`,
+              ],
+        )
+      } finally {
+        load.resolve()
+        await flushPromises()
+        subscription.unsubscribe()
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each([`generic`, `specific`] as const)(
+    `stops %s status delivery when an earlier ready listener unsubscribes`,
+    async (reentryEvent) => {
+      const where = new Func(`eq`, [new PropRef([`id`]), new Value(`one`)])
+      const load = createDeferred<void>()
+      const collection = createCollection<ReplayRow>({
+        id: `reentrant-status-unsubscribe-${reentryEvent}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            operations.markReady()
+            return {
+              loadSubset: () => load.promise,
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const subscription = collection.subscribeChanges(() => {}, {
+        includeInitialState: false,
+      })
+      const trace: Array<string> = []
+      const unsubscribe = () => {
+        trace.push(`unsubscribe`)
+        subscription.unsubscribe()
+      }
+      if (reentryEvent === `generic`) {
+        subscription.on(`status:change`, ({ status }) => {
+          if (status === `ready`) unsubscribe()
+        })
+      } else {
+        subscription.on(`status:ready`, unsubscribe)
+      }
+      subscription.on(`status:change`, ({ status }) => {
+        if (status === `ready`) trace.push(`late-generic`)
+      })
+      subscription.on(`status:ready`, () => trace.push(`late-specific`))
+      subscription.on(`unsubscribed`, () => trace.push(`unsubscribed`))
+
+      try {
+        subscription.requestSnapshot({ where })
+        load.resolve()
+        await flushPromises()
+
+        expect(trace).toEqual(
+          reentryEvent === `generic`
+            ? [`unsubscribe`, `unsubscribed`]
+            : [`late-generic`, `unsubscribe`, `unsubscribed`],
+        )
+      } finally {
+        load.resolve()
+        await collection.cleanup()
+      }
+    },
+  )
+})
diff --git a/packages/db/tests/collection-sync-reentrancy-oracle.test.ts b/packages/db/tests/collection-sync-reentrancy-oracle.test.ts
index b245c9be51..cb7cd398f6 100644
--- a/packages/db/tests/collection-sync-reentrancy-oracle.test.ts
+++ b/packages/db/tests/collection-sync-reentrancy-oracle.test.ts
@@ -31,31 +31,17 @@
  */
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { describe, expect, it, vi } from 'vitest'
-import { CollectionChangesManager } from '../src/collection/changes.js'
 import { createCollection } from '../src/collection/index.js'
 import { createLiveQueryCollection, eq } from '../src/query/index.js'
 import { createDeferred } from '../src/deferred.js'
 import { oracleRandomParameters, readOracleRunConfig } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import { flushPromises } from './utils.js'
-import type { SyncConfig } from '../src/types.js'
-
-type Row = {
-  id: number
-  value: string
-}
-
-type SyncOps = Parameters<SyncConfig<Row, number>[`sync`]>[0]
-
-type OrderedRow = Row & { rank: number }
-type OrderedSync = Parameters<SyncConfig<OrderedRow, number>[`sync`]>[0]
-
-type LayoutCallback = {
-  changes: Array<number>
-  keys: Array<number>
-  values: Array<string>
-  markedReceiptSettled: boolean
-  revision: number
-}
+import {
+  createSyncHarness,
+  stageInsert,
+} from './collection-sync-reentrancy-support.js'
+import type { Row, SyncOps } from './collection-sync-reentrancy-support.js'
 
 type ListenerAction = `commit` | `abort`
 
@@ -105,47 +91,6 @@ const exhaustiveListenerScenarios: Array<ListenerScenario> = enumerateActions(
 
 let generatedHarnessId = 0
 
-function createSyncHarness(id: string) {
-  let sync!: SyncOps
-  const collection = createCollection<Row, number>({
-    id,
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: {
-      sync: (ops) => {
-        sync = ops
-        ops.markReady()
-      },
-    },
-  })
-
-  return {
-    collection,
-    get sync() {
-      return sync
-    },
-  }
-}
-
-function stageInsert(sync: SyncOps, row: Row): void {
-  sync.begin()
-  sync.write({ type: `insert`, value: row })
-}
-
-function installInitialOrderedRows(sync: OrderedSync): void {
-  sync.begin()
-  sync.write({
-    type: `insert`,
-    value: { id: 1, value: `one`, rank: 0 },
-  })
-  sync.write({
-    type: `insert`,
-    value: { id: 2, value: `two`, rank: 1 },
-  })
-  sync.commit()
-  sync.markReady()
-}
-
 async function runListenerScenario(scenario: ListenerScenario): Promise<void> {
   const harness = createSyncHarness(
     `generated-listener-sync-${generatedHarnessId++}`,
@@ -247,449 +192,15 @@ async function runListenerScenario(scenario: ListenerScenario): Promise<void> {
   }
 }
 
+declareOracle({
+  check: [runListenerScenario],
+  grammar: [listenerScenarioArbitrary, exhaustiveListenerScenarios],
+})
+
 const { multiplier, ...replay } = readOracleRunConfig()
 const generatedRuns = 30 * multiplier
 
 describe(`sync publication reentrancy`, () => {
-  it.each([`cleanup`, `discard`] as const)(
-    `releases queued messages when %s retires a deferral`,
-    (ending) => {
-      const changes = new CollectionChangesManager<Row, number>()
-      const handle = changes.deferPublication()
-      changes.emitEvents([
-        { type: `insert`, key: 1, value: { id: 1, value: `queued` } },
-      ])
-
-      const retired = (
-        changes as unknown as { deferral?: { publications: Array<unknown> } }
-      ).deferral
-      if (!retired) throw new Error(`deferral did not open`)
-      expect(retired.publications).toHaveLength(1)
-
-      if (ending === `cleanup`) changes.cleanup()
-      else handle.discard()
-      expect(retired.publications).toHaveLength(0)
-      handle.publish()
-    },
-  )
-
-  it(`publishes nested deferrals as one coherent batch`, async () => {
-    const harness = createSyncHarness(`nested-publication-cycle`)
-    const { collection } = harness
-    const callbacks: Array<{ changes: Array<string>; visibleValue: string }> =
-      []
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        callbacks.push({
-          changes: changes.map((change) => change.value.value),
-          visibleValue: collection.get(1)!.value,
-        })
-      },
-      { includeInitialState: false },
-    )
-
-    try {
-      const outer = collection._deferPublication()
-      stageInsert(harness.sync, { id: 1, value: `first` })
-      harness.sync.commit()
-      const inner = collection._deferPublication()
-      harness.sync.begin()
-      harness.sync.write({
-        type: `update`,
-        value: { id: 1, value: `second` },
-      })
-      harness.sync.commit()
-
-      inner.publish()
-      expect(callbacks).toEqual([])
-      outer.publish()
-      expect(callbacks).toEqual([
-        { changes: [`first`, `second`], visibleValue: `second` },
-      ])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`starts a fresh publication after the previous one closes`, async () => {
-    const harness = createSyncHarness(`successive-publication-cycles`)
-    const { collection } = harness
-    const callbacks: Array<Array<string>> = []
-    const subscription = collection.subscribeChanges(
-      (changes) => callbacks.push(changes.map((change) => change.value.value)),
-      { includeInitialState: false },
-    )
-
-    try {
-      const first = collection._deferPublication()
-      stageInsert(harness.sync, { id: 1, value: `first` })
-      harness.sync.commit()
-      first.publish()
-
-      const second = collection._deferPublication()
-      harness.sync.begin()
-      harness.sync.write({
-        type: `update`,
-        value: { id: 1, value: `second` },
-      })
-      harness.sync.commit()
-      second.publish()
-
-      expect(callbacks).toEqual([[`first`], [`second`]])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`does not let a discarded deferral poison the next publication`, async () => {
-    const harness = createSyncHarness(`discarded-publication-cycle`)
-    const { collection } = harness
-    const callbacks: Array<Array<string>> = []
-    const subscription = collection.subscribeChanges(
-      (changes) => callbacks.push(changes.map((change) => change.value.value)),
-      { includeInitialState: false },
-    )
-
-    try {
-      const discarded = collection._deferPublication()
-      stageInsert(harness.sync, { id: 1, value: `discarded` })
-      harness.sync.commit()
-      discarded.discard()
-      expect(callbacks).toEqual([])
-
-      const published = collection._deferPublication()
-      harness.sync.begin()
-      harness.sync.write({
-        type: `update`,
-        value: { id: 1, value: `published` },
-      })
-      harness.sync.commit()
-      published.publish()
-      expect(callbacks).toEqual([[`published`]])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`lets a publication callback start the next publication cycle`, async () => {
-    const harness = createSyncHarness(`publication-cycle-from-callback`)
-    const { collection } = harness
-    const callbacks: Array<{
-      changes: Array<string>
-      visibleValue: string
-      revision: number
-    }> = []
-    const initialRevision = collection._stateRevision
-    const write = (type: `insert` | `update`, value: string) => {
-      harness.sync.begin()
-      harness.sync.write({ type, value: { id: 1, value } })
-      harness.sync.commit()
-    }
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        callbacks.push({
-          changes: changes.map((change) => change.value.value),
-          visibleValue: collection.get(1)!.value,
-          revision: collection._stateRevision,
-        })
-
-        if (changes[0]?.value.value === `first`) {
-          const secondPublication = collection._deferPublication()
-          write(`update`, `second`)
-          secondPublication.publish()
-        }
-      },
-      { includeInitialState: false },
-    )
-
-    try {
-      const firstPublication = collection._deferPublication()
-      write(`insert`, `first`)
-      firstPublication.publish()
-
-      expect(callbacks).toEqual([
-        {
-          changes: [`first`],
-          visibleValue: `first`,
-          revision: initialRevision + 1,
-        },
-        {
-          changes: [`second`],
-          visibleValue: `second`,
-          revision: initialRevision + 2,
-        },
-      ])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`publishes an internal layout swap with unchanged endpoints`, async () => {
-    let sync!: OrderedSync
-    const collection = createCollection<OrderedRow, number>({
-      id: `layout-middle-swap`,
-      getKey: (row) => row.id,
-      compare: (left, right) => left.rank - right.rank,
-      startSync: true,
-      sync: {
-        sync: (ops) => {
-          sync = ops
-          ops.begin()
-          for (let id = 1; id <= 5; id++) {
-            ops.write({
-              type: `insert`,
-              value: { id, value: `value-${id}`, rank: id },
-            })
-          }
-          ops.commit()
-          ops.markReady()
-        },
-      },
-    })
-    const callbacks: Array<LayoutCallback> = []
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        callbacks.push({
-          changes: changes.map(({ key }) => key),
-          keys: [...collection.keys()],
-          values: collection.toArray.map(({ value }) => value),
-          markedReceiptSettled: false,
-          revision: collection._layoutRevision,
-        })
-      },
-      { includeInitialState: false },
-    )
-
-    try {
-      const revisionBeforeSwap = collection._layoutRevision
-      sync.begin()
-      sync.write({
-        type: `update`,
-        value: { id: 3, value: `value-3`, rank: 4 },
-      })
-      sync.write({
-        type: `update`,
-        value: { id: 4, value: `value-4`, rank: 3 },
-      })
-      sync.collection._markLayoutChange()
-      expect(sync.commit()).toBe(true)
-
-      expect([...collection.keys()]).toEqual([1, 2, 4, 3, 5])
-      expect(collection._layoutRevision).toBe(revisionBeforeSwap + 1)
-      expect(callbacks).toEqual([
-        {
-          changes: [3, 4],
-          keys: [1, 2, 4, 3, 5],
-          values: [`value-1`, `value-2`, `value-4`, `value-3`, `value-5`],
-          markedReceiptSettled: false,
-          revision: revisionBeforeSwap + 1,
-        },
-      ])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`publishes a parked layout mark when optimistic persistence drains it`, async () => {
-    const updatePersistence = createDeferred<void>()
-    let sync!: OrderedSync
-    const collection = createCollection<OrderedRow, number>({
-      id: `layout-prefix-normal-drain`,
-      getKey: (row) => row.id,
-      compare: (left, right) => left.rank - right.rank,
-      startSync: true,
-      sync: {
-        sync: (ops) => {
-          sync = ops
-          installInitialOrderedRows(ops)
-        },
-      },
-      onUpdate: () => updatePersistence.promise,
-    })
-    let markedReceiptSettled = false
-    const callbacks: Array<LayoutCallback> = []
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        callbacks.push({
-          changes: changes.map(({ key }) => key),
-          keys: [...collection.keys()],
-          values: collection.toArray.map(({ value }) => value),
-          markedReceiptSettled,
-          revision: collection._layoutRevision,
-        })
-      },
-      { includeInitialState: false },
-    )
-    const update = collection.update(2, (draft) => {
-      draft.value = `optimistic-two`
-    })
-
-    try {
-      sync.begin()
-      sync.write({
-        type: `update`,
-        value: { id: 1, value: `one`, rank: 2 },
-      })
-      sync.collection._markLayoutChange()
-      const receipt = sync.commit()
-      expect(receipt).not.toBe(true)
-      if (receipt !== true) {
-        void receipt.then(() => {
-          markedReceiptSettled = true
-        })
-      }
-
-      callbacks.length = 0
-      const revisionBeforeDrain = collection._layoutRevision
-      await Promise.resolve()
-      expect(markedReceiptSettled).toBe(false)
-      expect([...collection.keys()]).toEqual([1, 2])
-
-      updatePersistence.resolve()
-      await update.isPersisted.promise
-      if (receipt !== true) await receipt
-
-      expect([...collection.keys()]).toEqual([2, 1])
-      expect(collection.toArray.map(({ value }) => value)).toEqual([
-        `two`,
-        `one`,
-      ])
-      expect(collection._layoutRevision).toBe(revisionBeforeDrain + 1)
-      // Deltas form one batch; their order is not the collection's row order.
-      // Assert exact membership while retaining ordered public-read assertions.
-      expect(
-        callbacks.map((callback) => ({
-          ...callback,
-          changes: [...callback.changes].sort((a, b) => a - b),
-        })),
-      ).toEqual([
-        {
-          changes: [1, 2],
-          keys: [2, 1],
-          values: [`two`, `one`],
-          markedReceiptSettled: false,
-          revision: revisionBeforeDrain + 1,
-        },
-      ])
-      expect(markedReceiptSettled).toBe(true)
-    } finally {
-      updatePersistence.resolve()
-      await update.isPersisted.promise.catch(() => undefined)
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`honors a parked layout mark when truncate drains its causal prefix`, async () => {
-    const updatePersistence = createDeferred<void>()
-    const insertPersistence = createDeferred<void>()
-    let sync!: OrderedSync
-    const collection = createCollection<OrderedRow, number>({
-      id: `layout-prefix-truncate-drain`,
-      getKey: (row) => row.id,
-      compare: (left, right) => left.rank - right.rank,
-      startSync: true,
-      sync: {
-        sync: (ops) => {
-          sync = ops
-          installInitialOrderedRows(ops)
-        },
-      },
-      onUpdate: () => updatePersistence.promise,
-      onInsert: () => insertPersistence.promise,
-    })
-    let markedReceiptSettled = false
-    const callbacks: Array<LayoutCallback> = []
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        callbacks.push({
-          changes: changes.map(({ key }) => key),
-          keys: [...collection.keys()],
-          values: collection.toArray.map(({ value }) => value),
-          markedReceiptSettled,
-          revision: collection._layoutRevision,
-        })
-      },
-      { includeInitialState: false },
-    )
-    const update = collection.update(1, (draft) => {
-      draft.value = `optimistic-one`
-    })
-    let insert: ReturnType<typeof collection.insert> | undefined
-
-    try {
-      sync.begin()
-      sync.write({
-        type: `update`,
-        value: { id: 1, value: `one`, rank: 2 },
-      })
-      sync.collection._markLayoutChange()
-      const firstReceipt = sync.commit()
-      expect(firstReceipt).not.toBe(true)
-      if (firstReceipt !== true) {
-        void firstReceipt.then(() => {
-          markedReceiptSettled = true
-        })
-      }
-
-      insert = collection.insert({
-        id: 3,
-        value: `optimistic-three`,
-        rank: 3,
-      })
-      callbacks.length = 0
-      const revisionBeforeDrain = collection._layoutRevision
-      expect([...collection.keys()]).toEqual([1, 2, 3])
-
-      sync.begin()
-      sync.truncate()
-      sync.write({
-        type: `insert`,
-        value: { id: 1, value: `one`, rank: 2 },
-      })
-      sync.write({
-        type: `insert`,
-        value: { id: 2, value: `two`, rank: 1 },
-      })
-      const truncateReceipt = sync.commit()
-
-      expect(truncateReceipt).toBe(true)
-      expect([...collection.keys()]).toEqual([2, 1, 3])
-      expect(collection.toArray.map(({ value }) => value)).toEqual([
-        `two`,
-        `optimistic-one`,
-        `optimistic-three`,
-      ])
-      expect(collection._layoutRevision).toBe(revisionBeforeDrain + 1)
-      expect(callbacks).toEqual([
-        {
-          // Delete the prior public layout [1, 2, 3], not the unpublished
-          // rank update's intermediate [2, 1, 3], then replay whole snapshots.
-          // Each key is inserted once after the delete prefix.
-          changes: [1, 2, 3, 1, 3, 2],
-          keys: [2, 1, 3],
-          values: [`two`, `optimistic-one`, `optimistic-three`],
-          markedReceiptSettled: false,
-          revision: revisionBeforeDrain + 1,
-        },
-      ])
-      if (firstReceipt !== true) await firstReceipt
-      expect(markedReceiptSettled).toBe(true)
-    } finally {
-      subscription.unsubscribe()
-      updatePersistence.resolve()
-      insertPersistence.resolve()
-      await update.isPersisted.promise.catch(() => undefined)
-      await insert?.isPersisted.promise.catch(() => undefined)
-      await collection.cleanup()
-    }
-  })
-
   // A truncate marks the Collection ready before it publishes its batch, and a
   // ready callback can write in that window. The callback's messages and the
   // truncate batch together must be valid for every subscriber, and must end
@@ -765,6 +276,11 @@ describe(`sync publication reentrancy`, () => {
       ),
   )
 
+  declareOracle({
+    model: [overlay],
+    grammar: [readyCases],
+  })
+
   it(`enumerates prior requests and legal ready-callback writes`, () => {
     // none and update 1 allow 6 writes, delete 1 allows 5, insert 3 allows 7.
     expect(readyCases).toHaveLength(2 * 24 * 3)
@@ -940,524 +456,6 @@ describe(`sync publication reentrancy`, () => {
     },
   )
 
-  // A subscriber or a ready callback can throw while a truncate makes the
-  // Collection ready. The commit must still settle every receipt it applied
-  // and report the error, as it does when the Collection is already ready.
-  it.each(
-    // An already-ready Collection runs no ready callbacks, so only a
-    // subscriber can throw there.
-    [
-      { alreadyReady: false, thrower: `subscriber` },
-      { alreadyReady: false, thrower: `ready callback` },
-      { alreadyReady: true, thrower: `subscriber` },
-    ] as const,
-  )(
-    `settles applied receipts when a $thrower throws during a truncate (alreadyReady: $alreadyReady)`,
-    async ({ alreadyReady, thrower }) => {
-      const failure = new Error(`${thrower} failure`)
-      const persistence = createDeferred<void>()
-      let sync!: SyncOps
-      const collection = createCollection<Row, number>({
-        id: `truncate-ready-throw-${thrower}-${alreadyReady}`,
-        getKey: (row) => row.id,
-        startSync: true,
-        sync: {
-          sync: (ops) => {
-            sync = ops
-            ops.begin()
-            ops.write({ type: `insert`, value: { id: 1, value: `one` } })
-            ops.commit()
-            if (alreadyReady) ops.markReady()
-          },
-        },
-        onUpdate: () => persistence.promise,
-      })
-      await flushPromises()
-      const blocker = collection.update(1, (draft) => {
-        draft.value = `optimistic`
-      })
-      let subscription: { unsubscribe: () => void } | undefined
-      try {
-        sync.begin()
-        sync.write({ type: `insert`, value: { id: 2, value: `two` } })
-        const held = sync.commit()
-        expect(held).not.toBe(true)
-        let heldSettled = false
-        if (held !== true)
-          void held.then(
-            () => (heldSettled = true),
-            () => (heldSettled = true),
-          )
-        if (thrower === `subscriber`) {
-          subscription = collection.subscribeChanges(() => {
-            throw failure
-          })
-        } else {
-          collection.onFirstReady(() => {
-            throw failure
-          })
-        }
-
-        sync.begin()
-        sync.truncate()
-        sync.write({ type: `insert`, value: { id: 3, value: `three` } })
-        expect(() => sync.commit()).toThrow(failure)
-        await flushPromises()
-
-        expect(heldSettled).toBe(true)
-        expect(collection.status).toBe(`ready`)
-        expect(
-          [...collection.state]
-            .map(([key, row]) => [key, row.value] as const)
-            .sort(([left], [right]) => left - right),
-        ).toEqual([
-          [1, `optimistic`],
-          [3, `three`],
-        ])
-      } finally {
-        subscription?.unsubscribe()
-        persistence.resolve()
-        await blocker.isPersisted.promise.catch(() => undefined)
-        await collection.cleanup()
-      }
-    },
-  )
-
-  // A sync function can make the Collection ready by calling markReady or
-  // by committing a truncate. If a ready callback throws during sync entry,
-  // the error surfaces once the sync function returns: the sync function
-  // finishes, and the Collection stays ready with the rows it committed.
-  it.each([`markReady`, `truncate commit`, `truncate commit, then markReady`])(
-    `defers a ready callback error until sync entry returns: %s`,
-    async (entry) => {
-      const failure = new Error(`ready callback failure`)
-      let finished = false
-      const collection = createCollection<Row, number>({
-        id: `sync-entry-ready-failure-${entry}`,
-        getKey: (row) => row.id,
-        startSync: false,
-        sync: {
-          sync: (ops) => {
-            ops.begin()
-            if (entry !== `markReady`) ops.truncate()
-            ops.write({ type: `insert`, value: { id: 1, value: `one` } })
-            ops.commit()
-            if (entry !== `truncate commit`) ops.markReady()
-            finished = true
-          },
-        },
-      })
-      try {
-        collection.onFirstReady(() => {
-          throw failure
-        })
-        expect(() => collection.startSyncImmediate()).toThrow(failure)
-        expect(finished).toBe(true)
-        expect(collection.status).toBe(`ready`)
-        expect([...collection.state.keys()]).toEqual([1])
-      } finally {
-        await collection.cleanup().catch(() => undefined)
-      }
-    },
-  )
-
-  it(`captures a fresh layout boundary for each reentrant causal prefix`, async () => {
-    let sync!: OrderedSync
-    const collection = createCollection<OrderedRow, number>({
-      id: `layout-reentrant-prefixes`,
-      getKey: (row) => row.id,
-      compare: (left, right) => left.rank - right.rank,
-      startSync: true,
-      sync: {
-        sync: (ops) => {
-          sync = ops
-          installInitialOrderedRows(ops)
-        },
-      },
-    })
-    let listenerDepth = 0
-    let maxListenerDepth = 0
-    let queuedRestore = false
-    let innerReceipt: Promise<void> | undefined
-    let innerReceiptSettled = false
-    const callbacks: Array<LayoutCallback> = []
-    const subscription = collection.subscribeChanges(
-      (changes) => {
-        listenerDepth++
-        maxListenerDepth = Math.max(maxListenerDepth, listenerDepth)
-        callbacks.push({
-          changes: changes.map(({ key }) => key),
-          keys: [...collection.keys()],
-          values: collection.toArray.map(({ value }) => value),
-          markedReceiptSettled: innerReceiptSettled,
-          revision: collection._layoutRevision,
-        })
-
-        if (!queuedRestore) {
-          queuedRestore = true
-          sync.begin()
-          sync.write({
-            type: `update`,
-            value: { id: 1, value: `one`, rank: 0 },
-          })
-          sync.collection._markLayoutChange()
-          const receipt = sync.commit()
-          if (receipt === true) {
-            throw new Error(`Expected listener-created work to queue`)
-          }
-          innerReceipt = receipt
-          void receipt.then(() => {
-            innerReceiptSettled = true
-          })
-        }
-
-        listenerDepth--
-      },
-      { includeInitialState: false },
-    )
-
-    try {
-      const revisionBeforeDrain = collection._layoutRevision
-      sync.begin()
-      sync.write({
-        type: `update`,
-        value: { id: 1, value: `one`, rank: 2 },
-      })
-      sync.collection._markLayoutChange()
-      expect(sync.commit()).toBe(true)
-
-      expect([...collection.keys()]).toEqual([1, 2])
-      expect(collection._layoutRevision).toBe(revisionBeforeDrain + 2)
-      expect(callbacks).toEqual([
-        {
-          changes: [1],
-          keys: [2, 1],
-          values: [`two`, `one`],
-          markedReceiptSettled: false,
-          revision: revisionBeforeDrain + 1,
-        },
-        {
-          changes: [1],
-          keys: [1, 2],
-          values: [`one`, `two`],
-          markedReceiptSettled: false,
-          revision: revisionBeforeDrain + 2,
-        },
-      ])
-      expect(maxListenerDepth).toBe(1)
-      expect(innerReceipt).toBeDefined()
-      await innerReceipt
-      expect(innerReceiptSettled).toBe(true)
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`preserves sync work opened by a listener until it is committed`, async () => {
-    const harness = createSyncHarness(`listener-opened-sync-work`)
-    const { collection } = harness
-    let openedInnerTransaction = false
-    const batches: Array<Array<number>> = []
-
-    const subscription = collection.subscribeChanges((changes) => {
-      batches.push(changes.map((change) => change.key))
-      if (!openedInnerTransaction && changes.some(({ key }) => key === 1)) {
-        openedInnerTransaction = true
-        stageInsert(harness.sync, { id: 2, value: `inner` })
-      }
-    })
-
-    try {
-      stageInsert(harness.sync, { id: 1, value: `outer` })
-      harness.sync.commit()
-
-      expect(openedInnerTransaction).toBe(true)
-      expect(collection.get(2)).toBeUndefined()
-
-      expect(() => harness.sync.commit()).not.toThrow()
-      expect(collection.get(2)).toMatchObject({ id: 2, value: `inner` })
-      expect(batches).toEqual([[1], [2]])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`publishes listener-committed sync work after the outer batch exactly once`, async () => {
-    const harness = createSyncHarness(`listener-committed-sync-work`)
-    const { collection } = harness
-    const appliedKeys: Array<number> = []
-    const originalSet = collection._state.syncedData.set.bind(
-      collection._state.syncedData,
-    )
-    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
-      (key, value) => {
-        appliedKeys.push(key)
-        return originalSet(key, value)
-      },
-    )
-    const batches: Array<Array<number>> = []
-    let listenerDepth = 0
-    let maxListenerDepth = 0
-    let committedInnerTransaction = false
-
-    const subscription = collection.subscribeChanges((changes) => {
-      listenerDepth++
-      maxListenerDepth = Math.max(maxListenerDepth, listenerDepth)
-      batches.push(changes.map((change) => change.key))
-
-      if (!committedInnerTransaction && changes.some(({ key }) => key === 1)) {
-        committedInnerTransaction = true
-        stageInsert(harness.sync, { id: 2, value: `inner` })
-        harness.sync.commit()
-      }
-
-      listenerDepth--
-    })
-
-    try {
-      stageInsert(harness.sync, { id: 1, value: `outer` })
-      harness.sync.commit()
-
-      expect(appliedKeys).toEqual([1, 2])
-      expect(batches).toEqual([[1], [2]])
-      expect(maxListenerDepth).toBe(1)
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`keeps callback work FIFO across committed, aborted, and open transactions`, async () => {
-    const harness = createSyncHarness(`listener-sync-action-order`)
-    const { collection } = harness
-    const batches: Array<Array<number>> = []
-    let ranListenerActions = false
-
-    const subscription = collection.subscribeChanges((changes) => {
-      batches.push(changes.map((change) => change.key))
-      if (ranListenerActions || !changes.some(({ key }) => key === 1)) return
-      ranListenerActions = true
-
-      stageInsert(harness.sync, { id: 2, value: `left-open` })
-
-      stageInsert(harness.sync, { id: 3, value: `committed` })
-      harness.sync.metadata!.row.set(3, { source: `listener` })
-      harness.sync.metadata!.collection.set(`listener:commit`, 3)
-      harness.sync.commit()
-
-      stageInsert(harness.sync, { id: 4, value: `aborted` })
-      const controller = new AbortController()
-      controller.abort()
-      const abortedReceipt = harness.sync.commit(controller.signal)
-      if (abortedReceipt !== true) {
-        void abortedReceipt.catch(() => undefined)
-      }
-    })
-
-    try {
-      stageInsert(harness.sync, { id: 1, value: `outer` })
-      harness.sync.commit()
-
-      expect(collection.get(3)).toMatchObject({ id: 3, value: `committed` })
-      expect(collection.get(4)).toBeUndefined()
-      expect(collection._state.syncedMetadata.get(3)).toEqual({
-        source: `listener`,
-      })
-      expect(
-        collection._state.syncedCollectionMetadata.get(`listener:commit`),
-      ).toBe(3)
-
-      harness.sync.commit()
-      expect(collection.get(2)).toMatchObject({ id: 2, value: `left-open` })
-      expect(batches).toEqual([[1], [3], [2]])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`drains listener-committed transactions in staging order`, async () => {
-    const harness = createSyncHarness(`listener-sync-fifo`)
-    const { collection } = harness
-    const batches: Array<Array<number>> = []
-    let stagedInnerTransactions = false
-
-    const subscription = collection.subscribeChanges((changes) => {
-      batches.push(changes.map((change) => change.key))
-      if (stagedInnerTransactions || !changes.some(({ key }) => key === 1)) {
-        return
-      }
-      stagedInnerTransactions = true
-
-      stageInsert(harness.sync, { id: 2, value: `first` })
-      harness.sync.commit()
-      stageInsert(harness.sync, { id: 3, value: `second` })
-      harness.sync.commit()
-    })
-
-    try {
-      stageInsert(harness.sync, { id: 1, value: `outer` })
-      harness.sync.commit()
-
-      expect([...collection._state.syncedData.keys()]).toEqual([1, 2, 3])
-      expect(batches).toEqual([[1], [2, 3]])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`drains callback work before surfacing a listener error`, async () => {
-    const harness = createSyncHarness(`throwing-sync-listener`)
-    const { collection } = harness
-    const failure = new Error(`listener failed`)
-    const appliedKeys: Array<number> = []
-    const originalSet = collection._state.syncedData.set.bind(
-      collection._state.syncedData,
-    )
-    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
-      (key, value) => {
-        appliedKeys.push(key)
-        return originalSet(key, value)
-      },
-    )
-    let queuedReceipt: Promise<void> | undefined
-    const subscription = collection.subscribeChanges((changes) => {
-      if (!changes.some(({ key }) => key === 1)) return
-      stageInsert(harness.sync, { id: 2, value: `queued` })
-      const receipt = harness.sync.commit()
-      if (receipt === true) {
-        throw new Error(`Expected callback-created work to queue`)
-      }
-      queuedReceipt = receipt
-      throw failure
-    })
-
-    try {
-      stageInsert(harness.sync, { id: 1, value: `first` })
-      expect(() => harness.sync.commit()).toThrow(failure)
-      expect(collection.get(1)).toMatchObject({ id: 1, value: `first` })
-      expect(collection.get(2)).toMatchObject({ id: 2, value: `queued` })
-      expect(queuedReceipt).toBeDefined()
-      await expect(queuedReceipt).resolves.toBeUndefined()
-
-      stageInsert(harness.sync, { id: 3, value: `second` })
-      expect(() => harness.sync.commit()).not.toThrow()
-
-      expect(appliedKeys).toEqual([1, 2, 3])
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`queues a listener truncate until the outer publication finishes`, async () => {
-    const harness = createSyncHarness(`listener-sync-truncate`)
-    const { collection } = harness
-    const appliedKeys: Array<number> = []
-    const originalSet = collection._state.syncedData.set.bind(
-      collection._state.syncedData,
-    )
-    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
-      (key, value) => {
-        appliedKeys.push(key)
-        return originalSet(key, value)
-      },
-    )
-    let stagedTruncate = false
-    const subscription = collection.subscribeChanges((changes) => {
-      if (stagedTruncate || !changes.some(({ key }) => key === 1)) return
-      stagedTruncate = true
-      harness.sync.begin()
-      harness.sync.truncate()
-      harness.sync.write({
-        type: `insert`,
-        value: { id: 2, value: `replacement` },
-      })
-      harness.sync.commit()
-    })
-
-    try {
-      stageInsert(harness.sync, { id: 1, value: `outer` })
-      harness.sync.commit()
-
-      expect(appliedKeys).toEqual([1, 2])
-      expect(collection.get(1)).toBeUndefined()
-      expect(collection.get(2)).toMatchObject({
-        id: 2,
-        value: `replacement`,
-      })
-    } finally {
-      subscription.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
-  it(`releases subset demand from a publication callback without nested delivery`, async () => {
-    let sync!: SyncOps
-    const unloadSubset = vi.fn()
-    const collection = createCollection<Row, number>({
-      id: `listener-subset-release-row-gc`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      sync: {
-        sync: (ops) => {
-          sync = ops
-          ops.markReady()
-          return {
-            loadSubset: async () => {
-              stageInsert(ops, { id: 2, value: `owned` })
-              const receipt = ops.commit()
-              if (receipt !== true) await receipt
-              return
-            },
-            unloadSubset,
-          }
-        },
-      },
-    })
-    let ownerUnsubscribed = false
-    const owner = collection.subscribeChanges((changes) => {
-      if (ownerUnsubscribed || !changes.some(({ key }) => key === 1)) return
-      ownerUnsubscribed = true
-      owner.unsubscribe()
-    })
-    owner.requestSnapshot({ optimizedOnly: false })
-    await flushPromises()
-
-    const batches: Array<Array<number>> = []
-    let listenerDepth = 0
-    let maxListenerDepth = 0
-    const observer = collection.subscribeChanges(
-      (changes) => {
-        listenerDepth++
-        maxListenerDepth = Math.max(maxListenerDepth, listenerDepth)
-        batches.push(changes.map((change) => change.key))
-        listenerDepth--
-      },
-      { includeInitialState: true },
-    )
-    batches.length = 0
-
-    try {
-      stageInsert(sync, { id: 1, value: `outer` })
-      expect(() => sync.commit()).not.toThrow()
-
-      expect(ownerUnsubscribed).toBe(true)
-      expect(unloadSubset).toHaveBeenCalledOnce()
-      expect(collection.get(2)).toMatchObject({ id: 2, value: `owned` })
-      expect(batches).toEqual([[1]])
-      expect(maxListenerDepth).toBe(1)
-    } finally {
-      owner.unsubscribe()
-      observer.unsubscribe()
-      await collection.cleanup()
-    }
-  })
-
   it(`matches every bounded reentrant listener history`, async () => {
     for (const scenario of exhaustiveListenerScenarios) {
       await runListenerScenario(scenario)
diff --git a/packages/db/tests/collection-sync-reentrancy-support.ts b/packages/db/tests/collection-sync-reentrancy-support.ts
new file mode 100644
index 0000000000..5f24a08b5d
--- /dev/null
+++ b/packages/db/tests/collection-sync-reentrancy-support.ts
@@ -0,0 +1,56 @@
+// Shared helpers for the oracle file and the ordinary tests moved from it.
+import { createCollection } from '../src/collection/index.js'
+import type { SyncConfig } from '../src/types.js'
+
+export type Row = {
+  id: number
+  value: string
+}
+export type SyncOps = Parameters<SyncConfig<Row, number>[`sync`]>[0]
+export type OrderedRow = Row & { rank: number }
+export type OrderedSync = Parameters<SyncConfig<OrderedRow, number>[`sync`]>[0]
+export type LayoutCallback = {
+  changes: Array<number>
+  keys: Array<number>
+  values: Array<string>
+  markedReceiptSettled: boolean
+  revision: number
+}
+export function createSyncHarness(id: string) {
+  let sync!: SyncOps
+  const collection = createCollection<Row, number>({
+    id,
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: {
+      sync: (ops) => {
+        sync = ops
+        ops.markReady()
+      },
+    },
+  })
+
+  return {
+    collection,
+    get sync() {
+      return sync
+    },
+  }
+}
+export function stageInsert(sync: SyncOps, row: Row): void {
+  sync.begin()
+  sync.write({ type: `insert`, value: row })
+}
+export function installInitialOrderedRows(sync: OrderedSync): void {
+  sync.begin()
+  sync.write({
+    type: `insert`,
+    value: { id: 1, value: `one`, rank: 0 },
+  })
+  sync.write({
+    type: `insert`,
+    value: { id: 2, value: `two`, rank: 1 },
+  })
+  sync.commit()
+  sync.markReady()
+}
diff --git a/packages/db/tests/collection-sync-reentrancy.test.ts b/packages/db/tests/collection-sync-reentrancy.test.ts
new file mode 100644
index 0000000000..b9f1713ddd
--- /dev/null
+++ b/packages/db/tests/collection-sync-reentrancy.test.ts
@@ -0,0 +1,979 @@
+// Ordinary tests moved out of collection-sync-reentrancy-oracle.test.ts. They keep
+// literal expectations for listener deferral, layout marks, and ready-callback
+// publication; the listener-history law stays in the oracle file.
+import { describe, expect, it, vi } from 'vitest'
+import { CollectionChangesManager } from '../src/collection/changes.js'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { flushPromises } from './utils.js'
+import {
+  createSyncHarness,
+  installInitialOrderedRows,
+  stageInsert,
+} from './collection-sync-reentrancy-support.js'
+import type {
+  LayoutCallback,
+  OrderedRow,
+  OrderedSync,
+  Row,
+  SyncOps,
+} from './collection-sync-reentrancy-support.js'
+
+describe(`sync publication reentrancy`, () => {
+  it.each([`cleanup`, `discard`] as const)(
+    `releases queued messages when %s retires a deferral`,
+    (ending) => {
+      const changes = new CollectionChangesManager<Row, number>()
+      const handle = changes.deferPublication()
+      changes.emitEvents([
+        { type: `insert`, key: 1, value: { id: 1, value: `queued` } },
+      ])
+
+      const retired = (
+        changes as unknown as { deferral?: { publications: Array<unknown> } }
+      ).deferral
+      if (!retired) throw new Error(`deferral did not open`)
+      expect(retired.publications).toHaveLength(1)
+
+      if (ending === `cleanup`) changes.cleanup()
+      else handle.discard()
+      expect(retired.publications).toHaveLength(0)
+      handle.publish()
+    },
+  )
+
+  it(`publishes nested deferrals as one coherent batch`, async () => {
+    const harness = createSyncHarness(`nested-publication-cycle`)
+    const { collection } = harness
+    const callbacks: Array<{ changes: Array<string>; visibleValue: string }> =
+      []
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        callbacks.push({
+          changes: changes.map((change) => change.value.value),
+          visibleValue: collection.get(1)!.value,
+        })
+      },
+      { includeInitialState: false },
+    )
+
+    try {
+      const outer = collection._deferPublication()
+      stageInsert(harness.sync, { id: 1, value: `first` })
+      harness.sync.commit()
+      const inner = collection._deferPublication()
+      harness.sync.begin()
+      harness.sync.write({
+        type: `update`,
+        value: { id: 1, value: `second` },
+      })
+      harness.sync.commit()
+
+      inner.publish()
+      expect(callbacks).toEqual([])
+      outer.publish()
+      expect(callbacks).toEqual([
+        { changes: [`first`, `second`], visibleValue: `second` },
+      ])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`starts a fresh publication after the previous one closes`, async () => {
+    const harness = createSyncHarness(`successive-publication-cycles`)
+    const { collection } = harness
+    const callbacks: Array<Array<string>> = []
+    const subscription = collection.subscribeChanges(
+      (changes) => callbacks.push(changes.map((change) => change.value.value)),
+      { includeInitialState: false },
+    )
+
+    try {
+      const first = collection._deferPublication()
+      stageInsert(harness.sync, { id: 1, value: `first` })
+      harness.sync.commit()
+      first.publish()
+
+      const second = collection._deferPublication()
+      harness.sync.begin()
+      harness.sync.write({
+        type: `update`,
+        value: { id: 1, value: `second` },
+      })
+      harness.sync.commit()
+      second.publish()
+
+      expect(callbacks).toEqual([[`first`], [`second`]])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`does not let a discarded deferral poison the next publication`, async () => {
+    const harness = createSyncHarness(`discarded-publication-cycle`)
+    const { collection } = harness
+    const callbacks: Array<Array<string>> = []
+    const subscription = collection.subscribeChanges(
+      (changes) => callbacks.push(changes.map((change) => change.value.value)),
+      { includeInitialState: false },
+    )
+
+    try {
+      const discarded = collection._deferPublication()
+      stageInsert(harness.sync, { id: 1, value: `discarded` })
+      harness.sync.commit()
+      discarded.discard()
+      expect(callbacks).toEqual([])
+
+      const published = collection._deferPublication()
+      harness.sync.begin()
+      harness.sync.write({
+        type: `update`,
+        value: { id: 1, value: `published` },
+      })
+      harness.sync.commit()
+      published.publish()
+      expect(callbacks).toEqual([[`published`]])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`lets a publication callback start the next publication cycle`, async () => {
+    const harness = createSyncHarness(`publication-cycle-from-callback`)
+    const { collection } = harness
+    const callbacks: Array<{
+      changes: Array<string>
+      visibleValue: string
+      revision: number
+    }> = []
+    const initialRevision = collection._stateRevision
+    const write = (type: `insert` | `update`, value: string) => {
+      harness.sync.begin()
+      harness.sync.write({ type, value: { id: 1, value } })
+      harness.sync.commit()
+    }
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        callbacks.push({
+          changes: changes.map((change) => change.value.value),
+          visibleValue: collection.get(1)!.value,
+          revision: collection._stateRevision,
+        })
+
+        if (changes[0]?.value.value === `first`) {
+          const secondPublication = collection._deferPublication()
+          write(`update`, `second`)
+          secondPublication.publish()
+        }
+      },
+      { includeInitialState: false },
+    )
+
+    try {
+      const firstPublication = collection._deferPublication()
+      write(`insert`, `first`)
+      firstPublication.publish()
+
+      expect(callbacks).toEqual([
+        {
+          changes: [`first`],
+          visibleValue: `first`,
+          revision: initialRevision + 1,
+        },
+        {
+          changes: [`second`],
+          visibleValue: `second`,
+          revision: initialRevision + 2,
+        },
+      ])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`publishes an internal layout swap with unchanged endpoints`, async () => {
+    let sync!: OrderedSync
+    const collection = createCollection<OrderedRow, number>({
+      id: `layout-middle-swap`,
+      getKey: (row) => row.id,
+      compare: (left, right) => left.rank - right.rank,
+      startSync: true,
+      sync: {
+        sync: (ops) => {
+          sync = ops
+          ops.begin()
+          for (let id = 1; id <= 5; id++) {
+            ops.write({
+              type: `insert`,
+              value: { id, value: `value-${id}`, rank: id },
+            })
+          }
+          ops.commit()
+          ops.markReady()
+        },
+      },
+    })
+    const callbacks: Array<LayoutCallback> = []
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        callbacks.push({
+          changes: changes.map(({ key }) => key),
+          keys: [...collection.keys()],
+          values: collection.toArray.map(({ value }) => value),
+          markedReceiptSettled: false,
+          revision: collection._layoutRevision,
+        })
+      },
+      { includeInitialState: false },
+    )
+
+    try {
+      const revisionBeforeSwap = collection._layoutRevision
+      sync.begin()
+      sync.write({
+        type: `update`,
+        value: { id: 3, value: `value-3`, rank: 4 },
+      })
+      sync.write({
+        type: `update`,
+        value: { id: 4, value: `value-4`, rank: 3 },
+      })
+      sync.collection._markLayoutChange()
+      expect(sync.commit()).toBe(true)
+
+      expect([...collection.keys()]).toEqual([1, 2, 4, 3, 5])
+      expect(collection._layoutRevision).toBe(revisionBeforeSwap + 1)
+      expect(callbacks).toEqual([
+        {
+          changes: [3, 4],
+          keys: [1, 2, 4, 3, 5],
+          values: [`value-1`, `value-2`, `value-4`, `value-3`, `value-5`],
+          markedReceiptSettled: false,
+          revision: revisionBeforeSwap + 1,
+        },
+      ])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`publishes a parked layout mark when optimistic persistence drains it`, async () => {
+    const updatePersistence = createDeferred<void>()
+    let sync!: OrderedSync
+    const collection = createCollection<OrderedRow, number>({
+      id: `layout-prefix-normal-drain`,
+      getKey: (row) => row.id,
+      compare: (left, right) => left.rank - right.rank,
+      startSync: true,
+      sync: {
+        sync: (ops) => {
+          sync = ops
+          installInitialOrderedRows(ops)
+        },
+      },
+      onUpdate: () => updatePersistence.promise,
+    })
+    let markedReceiptSettled = false
+    const callbacks: Array<LayoutCallback> = []
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        callbacks.push({
+          changes: changes.map(({ key }) => key),
+          keys: [...collection.keys()],
+          values: collection.toArray.map(({ value }) => value),
+          markedReceiptSettled,
+          revision: collection._layoutRevision,
+        })
+      },
+      { includeInitialState: false },
+    )
+    const update = collection.update(2, (draft) => {
+      draft.value = `optimistic-two`
+    })
+
+    try {
+      sync.begin()
+      sync.write({
+        type: `update`,
+        value: { id: 1, value: `one`, rank: 2 },
+      })
+      sync.collection._markLayoutChange()
+      const receipt = sync.commit()
+      expect(receipt).not.toBe(true)
+      if (receipt !== true) {
+        void receipt.then(() => {
+          markedReceiptSettled = true
+        })
+      }
+
+      callbacks.length = 0
+      const revisionBeforeDrain = collection._layoutRevision
+      await Promise.resolve()
+      expect(markedReceiptSettled).toBe(false)
+      expect([...collection.keys()]).toEqual([1, 2])
+
+      updatePersistence.resolve()
+      await update.isPersisted.promise
+      if (receipt !== true) await receipt
+
+      expect([...collection.keys()]).toEqual([2, 1])
+      expect(collection.toArray.map(({ value }) => value)).toEqual([
+        `two`,
+        `one`,
+      ])
+      expect(collection._layoutRevision).toBe(revisionBeforeDrain + 1)
+      // Deltas form one batch; their order is not the collection's row order.
+      // Assert exact membership while retaining ordered public-read assertions.
+      expect(
+        callbacks.map((callback) => ({
+          ...callback,
+          changes: [...callback.changes].sort((a, b) => a - b),
+        })),
+      ).toEqual([
+        {
+          changes: [1, 2],
+          keys: [2, 1],
+          values: [`two`, `one`],
+          markedReceiptSettled: false,
+          revision: revisionBeforeDrain + 1,
+        },
+      ])
+      expect(markedReceiptSettled).toBe(true)
+    } finally {
+      updatePersistence.resolve()
+      await update.isPersisted.promise.catch(() => undefined)
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`honors a parked layout mark when truncate drains its causal prefix`, async () => {
+    const updatePersistence = createDeferred<void>()
+    const insertPersistence = createDeferred<void>()
+    let sync!: OrderedSync
+    const collection = createCollection<OrderedRow, number>({
+      id: `layout-prefix-truncate-drain`,
+      getKey: (row) => row.id,
+      compare: (left, right) => left.rank - right.rank,
+      startSync: true,
+      sync: {
+        sync: (ops) => {
+          sync = ops
+          installInitialOrderedRows(ops)
+        },
+      },
+      onUpdate: () => updatePersistence.promise,
+      onInsert: () => insertPersistence.promise,
+    })
+    let markedReceiptSettled = false
+    const callbacks: Array<LayoutCallback> = []
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        callbacks.push({
+          changes: changes.map(({ key }) => key),
+          keys: [...collection.keys()],
+          values: collection.toArray.map(({ value }) => value),
+          markedReceiptSettled,
+          revision: collection._layoutRevision,
+        })
+      },
+      { includeInitialState: false },
+    )
+    const update = collection.update(1, (draft) => {
+      draft.value = `optimistic-one`
+    })
+    let insert: ReturnType<typeof collection.insert> | undefined
+
+    try {
+      sync.begin()
+      sync.write({
+        type: `update`,
+        value: { id: 1, value: `one`, rank: 2 },
+      })
+      sync.collection._markLayoutChange()
+      const firstReceipt = sync.commit()
+      expect(firstReceipt).not.toBe(true)
+      if (firstReceipt !== true) {
+        void firstReceipt.then(() => {
+          markedReceiptSettled = true
+        })
+      }
+
+      insert = collection.insert({
+        id: 3,
+        value: `optimistic-three`,
+        rank: 3,
+      })
+      callbacks.length = 0
+      const revisionBeforeDrain = collection._layoutRevision
+      expect([...collection.keys()]).toEqual([1, 2, 3])
+
+      sync.begin()
+      sync.truncate()
+      sync.write({
+        type: `insert`,
+        value: { id: 1, value: `one`, rank: 2 },
+      })
+      sync.write({
+        type: `insert`,
+        value: { id: 2, value: `two`, rank: 1 },
+      })
+      const truncateReceipt = sync.commit()
+
+      expect(truncateReceipt).toBe(true)
+      expect([...collection.keys()]).toEqual([2, 1, 3])
+      expect(collection.toArray.map(({ value }) => value)).toEqual([
+        `two`,
+        `optimistic-one`,
+        `optimistic-three`,
+      ])
+      expect(collection._layoutRevision).toBe(revisionBeforeDrain + 1)
+      expect(callbacks).toEqual([
+        {
+          // Delete the prior public layout [1, 2, 3], not the unpublished
+          // rank update's intermediate [2, 1, 3], then replay whole snapshots.
+          // Each key is inserted once after the delete prefix.
+          changes: [1, 2, 3, 1, 3, 2],
+          keys: [2, 1, 3],
+          values: [`two`, `optimistic-one`, `optimistic-three`],
+          markedReceiptSettled: false,
+          revision: revisionBeforeDrain + 1,
+        },
+      ])
+      if (firstReceipt !== true) await firstReceipt
+      expect(markedReceiptSettled).toBe(true)
+    } finally {
+      subscription.unsubscribe()
+      updatePersistence.resolve()
+      insertPersistence.resolve()
+      await update.isPersisted.promise.catch(() => undefined)
+      await insert?.isPersisted.promise.catch(() => undefined)
+      await collection.cleanup()
+    }
+  })
+
+  // A subscriber or a ready callback can throw while a truncate makes the
+  // Collection ready. The commit must still settle every receipt it applied
+  // and report the error, as it does when the Collection is already ready.
+  it.each(
+    // An already-ready Collection runs no ready callbacks, so only a
+    // subscriber can throw there.
+    [
+      { alreadyReady: false, thrower: `subscriber` },
+      { alreadyReady: false, thrower: `ready callback` },
+      { alreadyReady: true, thrower: `subscriber` },
+    ] as const,
+  )(
+    `settles applied receipts when a $thrower throws during a truncate (alreadyReady: $alreadyReady)`,
+    async ({ alreadyReady, thrower }) => {
+      const failure = new Error(`${thrower} failure`)
+      const persistence = createDeferred<void>()
+      let sync!: SyncOps
+      const collection = createCollection<Row, number>({
+        id: `truncate-ready-throw-${thrower}-${alreadyReady}`,
+        getKey: (row) => row.id,
+        startSync: true,
+        sync: {
+          sync: (ops) => {
+            sync = ops
+            ops.begin()
+            ops.write({ type: `insert`, value: { id: 1, value: `one` } })
+            ops.commit()
+            if (alreadyReady) ops.markReady()
+          },
+        },
+        onUpdate: () => persistence.promise,
+      })
+      await flushPromises()
+      const blocker = collection.update(1, (draft) => {
+        draft.value = `optimistic`
+      })
+      let subscription: { unsubscribe: () => void } | undefined
+      try {
+        sync.begin()
+        sync.write({ type: `insert`, value: { id: 2, value: `two` } })
+        const held = sync.commit()
+        expect(held).not.toBe(true)
+        let heldSettled = false
+        if (held !== true)
+          void held.then(
+            () => (heldSettled = true),
+            () => (heldSettled = true),
+          )
+        if (thrower === `subscriber`) {
+          subscription = collection.subscribeChanges(() => {
+            throw failure
+          })
+        } else {
+          collection.onFirstReady(() => {
+            throw failure
+          })
+        }
+
+        sync.begin()
+        sync.truncate()
+        sync.write({ type: `insert`, value: { id: 3, value: `three` } })
+        expect(() => sync.commit()).toThrow(failure)
+        await flushPromises()
+
+        expect(heldSettled).toBe(true)
+        expect(collection.status).toBe(`ready`)
+        expect(
+          [...collection.state]
+            .map(([key, row]) => [key, row.value] as const)
+            .sort(([left], [right]) => left - right),
+        ).toEqual([
+          [1, `optimistic`],
+          [3, `three`],
+        ])
+      } finally {
+        subscription?.unsubscribe()
+        persistence.resolve()
+        await blocker.isPersisted.promise.catch(() => undefined)
+        await collection.cleanup()
+      }
+    },
+  )
+
+  // A sync function can make the Collection ready by calling markReady or
+  // by committing a truncate. If a ready callback throws during sync entry,
+  // the error surfaces once the sync function returns: the sync function
+  // finishes, and the Collection stays ready with the rows it committed.
+  it.each([`markReady`, `truncate commit`, `truncate commit, then markReady`])(
+    `defers a ready callback error until sync entry returns: %s`,
+    async (entry) => {
+      const failure = new Error(`ready callback failure`)
+      let finished = false
+      const collection = createCollection<Row, number>({
+        id: `sync-entry-ready-failure-${entry}`,
+        getKey: (row) => row.id,
+        startSync: false,
+        sync: {
+          sync: (ops) => {
+            ops.begin()
+            if (entry !== `markReady`) ops.truncate()
+            ops.write({ type: `insert`, value: { id: 1, value: `one` } })
+            ops.commit()
+            if (entry !== `truncate commit`) ops.markReady()
+            finished = true
+          },
+        },
+      })
+      try {
+        collection.onFirstReady(() => {
+          throw failure
+        })
+        expect(() => collection.startSyncImmediate()).toThrow(failure)
+        expect(finished).toBe(true)
+        expect(collection.status).toBe(`ready`)
+        expect([...collection.state.keys()]).toEqual([1])
+      } finally {
+        await collection.cleanup().catch(() => undefined)
+      }
+    },
+  )
+
+  it(`captures a fresh layout boundary for each reentrant causal prefix`, async () => {
+    let sync!: OrderedSync
+    const collection = createCollection<OrderedRow, number>({
+      id: `layout-reentrant-prefixes`,
+      getKey: (row) => row.id,
+      compare: (left, right) => left.rank - right.rank,
+      startSync: true,
+      sync: {
+        sync: (ops) => {
+          sync = ops
+          installInitialOrderedRows(ops)
+        },
+      },
+    })
+    let listenerDepth = 0
+    let maxListenerDepth = 0
+    let queuedRestore = false
+    let innerReceipt: Promise<void> | undefined
+    let innerReceiptSettled = false
+    const callbacks: Array<LayoutCallback> = []
+    const subscription = collection.subscribeChanges(
+      (changes) => {
+        listenerDepth++
+        maxListenerDepth = Math.max(maxListenerDepth, listenerDepth)
+        callbacks.push({
+          changes: changes.map(({ key }) => key),
+          keys: [...collection.keys()],
+          values: collection.toArray.map(({ value }) => value),
+          markedReceiptSettled: innerReceiptSettled,
+          revision: collection._layoutRevision,
+        })
+
+        if (!queuedRestore) {
+          queuedRestore = true
+          sync.begin()
+          sync.write({
+            type: `update`,
+            value: { id: 1, value: `one`, rank: 0 },
+          })
+          sync.collection._markLayoutChange()
+          const receipt = sync.commit()
+          if (receipt === true) {
+            throw new Error(`Expected listener-created work to queue`)
+          }
+          innerReceipt = receipt
+          void receipt.then(() => {
+            innerReceiptSettled = true
+          })
+        }
+
+        listenerDepth--
+      },
+      { includeInitialState: false },
+    )
+
+    try {
+      const revisionBeforeDrain = collection._layoutRevision
+      sync.begin()
+      sync.write({
+        type: `update`,
+        value: { id: 1, value: `one`, rank: 2 },
+      })
+      sync.collection._markLayoutChange()
+      expect(sync.commit()).toBe(true)
+
+      expect([...collection.keys()]).toEqual([1, 2])
+      expect(collection._layoutRevision).toBe(revisionBeforeDrain + 2)
+      expect(callbacks).toEqual([
+        {
+          changes: [1],
+          keys: [2, 1],
+          values: [`two`, `one`],
+          markedReceiptSettled: false,
+          revision: revisionBeforeDrain + 1,
+        },
+        {
+          changes: [1],
+          keys: [1, 2],
+          values: [`one`, `two`],
+          markedReceiptSettled: false,
+          revision: revisionBeforeDrain + 2,
+        },
+      ])
+      expect(maxListenerDepth).toBe(1)
+      expect(innerReceipt).toBeDefined()
+      await innerReceipt
+      expect(innerReceiptSettled).toBe(true)
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`preserves sync work opened by a listener until it is committed`, async () => {
+    const harness = createSyncHarness(`listener-opened-sync-work`)
+    const { collection } = harness
+    let openedInnerTransaction = false
+    const batches: Array<Array<number>> = []
+
+    const subscription = collection.subscribeChanges((changes) => {
+      batches.push(changes.map((change) => change.key))
+      if (!openedInnerTransaction && changes.some(({ key }) => key === 1)) {
+        openedInnerTransaction = true
+        stageInsert(harness.sync, { id: 2, value: `inner` })
+      }
+    })
+
+    try {
+      stageInsert(harness.sync, { id: 1, value: `outer` })
+      harness.sync.commit()
+
+      expect(openedInnerTransaction).toBe(true)
+      expect(collection.get(2)).toBeUndefined()
+
+      expect(() => harness.sync.commit()).not.toThrow()
+      expect(collection.get(2)).toMatchObject({ id: 2, value: `inner` })
+      expect(batches).toEqual([[1], [2]])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`publishes listener-committed sync work after the outer batch exactly once`, async () => {
+    const harness = createSyncHarness(`listener-committed-sync-work`)
+    const { collection } = harness
+    const appliedKeys: Array<number> = []
+    const originalSet = collection._state.syncedData.set.bind(
+      collection._state.syncedData,
+    )
+    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
+      (key, value) => {
+        appliedKeys.push(key)
+        return originalSet(key, value)
+      },
+    )
+    const batches: Array<Array<number>> = []
+    let listenerDepth = 0
+    let maxListenerDepth = 0
+    let committedInnerTransaction = false
+
+    const subscription = collection.subscribeChanges((changes) => {
+      listenerDepth++
+      maxListenerDepth = Math.max(maxListenerDepth, listenerDepth)
+      batches.push(changes.map((change) => change.key))
+
+      if (!committedInnerTransaction && changes.some(({ key }) => key === 1)) {
+        committedInnerTransaction = true
+        stageInsert(harness.sync, { id: 2, value: `inner` })
+        harness.sync.commit()
+      }
+
+      listenerDepth--
+    })
+
+    try {
+      stageInsert(harness.sync, { id: 1, value: `outer` })
+      harness.sync.commit()
+
+      expect(appliedKeys).toEqual([1, 2])
+      expect(batches).toEqual([[1], [2]])
+      expect(maxListenerDepth).toBe(1)
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`keeps callback work FIFO across committed, aborted, and open transactions`, async () => {
+    const harness = createSyncHarness(`listener-sync-action-order`)
+    const { collection } = harness
+    const batches: Array<Array<number>> = []
+    let ranListenerActions = false
+
+    const subscription = collection.subscribeChanges((changes) => {
+      batches.push(changes.map((change) => change.key))
+      if (ranListenerActions || !changes.some(({ key }) => key === 1)) return
+      ranListenerActions = true
+
+      stageInsert(harness.sync, { id: 2, value: `left-open` })
+
+      stageInsert(harness.sync, { id: 3, value: `committed` })
+      harness.sync.metadata!.row.set(3, { source: `listener` })
+      harness.sync.metadata!.collection.set(`listener:commit`, 3)
+      harness.sync.commit()
+
+      stageInsert(harness.sync, { id: 4, value: `aborted` })
+      const controller = new AbortController()
+      controller.abort()
+      const abortedReceipt = harness.sync.commit(controller.signal)
+      if (abortedReceipt !== true) {
+        void abortedReceipt.catch(() => undefined)
+      }
+    })
+
+    try {
+      stageInsert(harness.sync, { id: 1, value: `outer` })
+      harness.sync.commit()
+
+      expect(collection.get(3)).toMatchObject({ id: 3, value: `committed` })
+      expect(collection.get(4)).toBeUndefined()
+      expect(collection._state.syncedMetadata.get(3)).toEqual({
+        source: `listener`,
+      })
+      expect(
+        collection._state.syncedCollectionMetadata.get(`listener:commit`),
+      ).toBe(3)
+
+      harness.sync.commit()
+      expect(collection.get(2)).toMatchObject({ id: 2, value: `left-open` })
+      expect(batches).toEqual([[1], [3], [2]])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`drains listener-committed transactions in staging order`, async () => {
+    const harness = createSyncHarness(`listener-sync-fifo`)
+    const { collection } = harness
+    const batches: Array<Array<number>> = []
+    let stagedInnerTransactions = false
+
+    const subscription = collection.subscribeChanges((changes) => {
+      batches.push(changes.map((change) => change.key))
+      if (stagedInnerTransactions || !changes.some(({ key }) => key === 1)) {
+        return
+      }
+      stagedInnerTransactions = true
+
+      stageInsert(harness.sync, { id: 2, value: `first` })
+      harness.sync.commit()
+      stageInsert(harness.sync, { id: 3, value: `second` })
+      harness.sync.commit()
+    })
+
+    try {
+      stageInsert(harness.sync, { id: 1, value: `outer` })
+      harness.sync.commit()
+
+      expect([...collection._state.syncedData.keys()]).toEqual([1, 2, 3])
+      expect(batches).toEqual([[1], [2, 3]])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`drains callback work before surfacing a listener error`, async () => {
+    const harness = createSyncHarness(`throwing-sync-listener`)
+    const { collection } = harness
+    const failure = new Error(`listener failed`)
+    const appliedKeys: Array<number> = []
+    const originalSet = collection._state.syncedData.set.bind(
+      collection._state.syncedData,
+    )
+    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
+      (key, value) => {
+        appliedKeys.push(key)
+        return originalSet(key, value)
+      },
+    )
+    let queuedReceipt: Promise<void> | undefined
+    const subscription = collection.subscribeChanges((changes) => {
+      if (!changes.some(({ key }) => key === 1)) return
+      stageInsert(harness.sync, { id: 2, value: `queued` })
+      const receipt = harness.sync.commit()
+      if (receipt === true) {
+        throw new Error(`Expected callback-created work to queue`)
+      }
+      queuedReceipt = receipt
+      throw failure
+    })
+
+    try {
+      stageInsert(harness.sync, { id: 1, value: `first` })
+      expect(() => harness.sync.commit()).toThrow(failure)
+      expect(collection.get(1)).toMatchObject({ id: 1, value: `first` })
+      expect(collection.get(2)).toMatchObject({ id: 2, value: `queued` })
+      expect(queuedReceipt).toBeDefined()
+      await expect(queuedReceipt).resolves.toBeUndefined()
+
+      stageInsert(harness.sync, { id: 3, value: `second` })
+      expect(() => harness.sync.commit()).not.toThrow()
+
+      expect(appliedKeys).toEqual([1, 2, 3])
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`queues a listener truncate until the outer publication finishes`, async () => {
+    const harness = createSyncHarness(`listener-sync-truncate`)
+    const { collection } = harness
+    const appliedKeys: Array<number> = []
+    const originalSet = collection._state.syncedData.set.bind(
+      collection._state.syncedData,
+    )
+    vi.spyOn(collection._state.syncedData, `set`).mockImplementation(
+      (key, value) => {
+        appliedKeys.push(key)
+        return originalSet(key, value)
+      },
+    )
+    let stagedTruncate = false
+    const subscription = collection.subscribeChanges((changes) => {
+      if (stagedTruncate || !changes.some(({ key }) => key === 1)) return
+      stagedTruncate = true
+      harness.sync.begin()
+      harness.sync.truncate()
+      harness.sync.write({
+        type: `insert`,
+        value: { id: 2, value: `replacement` },
+      })
+      harness.sync.commit()
+    })
+
+    try {
+      stageInsert(harness.sync, { id: 1, value: `outer` })
+      harness.sync.commit()
+
+      expect(appliedKeys).toEqual([1, 2])
+      expect(collection.get(1)).toBeUndefined()
+      expect(collection.get(2)).toMatchObject({
+        id: 2,
+        value: `replacement`,
+      })
+    } finally {
+      subscription.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+
+  it(`releases subset demand from a publication callback without nested delivery`, async () => {
+    let sync!: SyncOps
+    const unloadSubset = vi.fn()
+    const collection = createCollection<Row, number>({
+      id: `listener-subset-release-row-gc`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      sync: {
+        sync: (ops) => {
+          sync = ops
+          ops.markReady()
+          return {
+            loadSubset: async () => {
+              stageInsert(ops, { id: 2, value: `owned` })
+              const receipt = ops.commit()
+              if (receipt !== true) await receipt
+              return
+            },
+            unloadSubset,
+          }
+        },
+      },
+    })
+    let ownerUnsubscribed = false
+    const owner = collection.subscribeChanges((changes) => {
+      if (ownerUnsubscribed || !changes.some(({ key }) => key === 1)) return
+      ownerUnsubscribed = true
+      owner.unsubscribe()
+    })
+    owner.requestSnapshot({ optimizedOnly: false })
+    await flushPromises()
+
+    const batches: Array<Array<number>> = []
+    let listenerDepth = 0
+    let maxListenerDepth = 0
+    const observer = collection.subscribeChanges(
+      (changes) => {
+        listenerDepth++
+        maxListenerDepth = Math.max(maxListenerDepth, listenerDepth)
+        batches.push(changes.map((change) => change.key))
+        listenerDepth--
+      },
+      { includeInitialState: true },
+    )
+    batches.length = 0
+
+    try {
+      stageInsert(sync, { id: 1, value: `outer` })
+      expect(() => sync.commit()).not.toThrow()
+
+      expect(ownerUnsubscribed).toBe(true)
+      expect(unloadSubset).toHaveBeenCalledOnce()
+      expect(collection.get(2)).toMatchObject({ id: 2, value: `owned` })
+      expect(batches).toEqual([[1]])
+      expect(maxListenerDepth).toBe(1)
+    } finally {
+      owner.unsubscribe()
+      observer.unsubscribe()
+      await collection.cleanup()
+    }
+  })
+})
diff --git a/packages/db/tests/comparison-options.ts b/packages/db/tests/comparison-options.ts
new file mode 100644
index 0000000000..c1ea6fcfa1
--- /dev/null
+++ b/packages/db/tests/comparison-options.ts
@@ -0,0 +1,15 @@
+import type { CompareOptions } from '../src/query/builder/types'
+
+// Ascending locale and lexical option sets shared by the comparison oracle and
+// its ordinary tests.
+export const defaultOpts = {
+  direction: `asc`,
+  nulls: `first`,
+  stringSort: `locale`,
+} satisfies CompareOptions
+
+export const lexicalOpts = {
+  direction: `asc`,
+  nulls: `first`,
+  stringSort: `lexical`,
+} satisfies CompareOptions
diff --git a/packages/db/tests/comparison-oracle.property.test.ts b/packages/db/tests/comparison-oracle.property.test.ts
index c497ba6cf4..dc1ca18558 100644
--- a/packages/db/tests/comparison-oracle.property.test.ts
+++ b/packages/db/tests/comparison-oracle.property.test.ts
@@ -17,6 +17,8 @@ import {
   oracleRuns,
   recordOracleReplay,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
+import { defaultOpts, lexicalOpts } from './comparison-options.js'
 import type { CompareOptions } from '../src/query/builder/types'
 
 /**
@@ -54,18 +56,6 @@ import type { CompareOptions } from '../src/query/builder/types'
  * constant-overhead budget for the sampled 0..200-byte keys.
  */
 
-const defaultOpts: CompareOptions = {
-  direction: `asc`,
-  nulls: `first`,
-  stringSort: `locale`,
-}
-
-const lexicalOpts: CompareOptions = {
-  direction: `asc`,
-  nulls: `first`,
-  stringSort: `lexical`,
-}
-
 const nullsLastOpts: CompareOptions = {
   direction: `asc`,
   nulls: `last`,
@@ -423,6 +413,19 @@ function assertTransitive(ab: number, bc: number, ac: number): void {
   if (ab <= 0 && bc <= 0) expect(ac).toBeLessThanOrEqual(0)
 }
 
+declareOracle({
+  check: [
+    assertComparisonProperty,
+    checkAntisymmetry,
+    assertNonFiniteOrder,
+    assertChangedBytes,
+    assertTransitive,
+    assertPlainDateOrder,
+    assertZonedDateTimeOrder,
+  ],
+  model: [modelPlainDateSign, modelNanosecondSign],
+})
+
 describe(`comparison law controls`, () => {
   fcTest(
     `shrinking retains the first violated law and replays its checkpoint`,
@@ -659,12 +662,6 @@ describe(`ascComparator property-based tests`, () => {
   })
 
   describe(`string comparison`, () => {
-    it(`lexical and en-US locale order distinguish the string-mode axis`, () => {
-      const localeOpts: CompareOptions = { ...defaultOpts, locale: `en-US` }
-      expect(ascComparator(`a`, `B`, lexicalOpts)).toBeGreaterThan(0)
-      expect(ascComparator(`a`, `B`, localeOpts)).toBeLessThan(0)
-    })
-
     comparisonProperty([fc.string()])(
       `locale sort: reflexivity holds for strings`,
       (a) => {
@@ -932,32 +929,6 @@ describe(`makeComparator property-based tests`, () => {
     },
   )
 
-  it(`delegates only string pairs to a custom string comparator`, () => {
-    const calls: Array<[string, string]> = []
-    const compare = (a: string, b: string) => {
-      calls.push([a, b])
-      return a.replaceAll(` `, ``).localeCompare(b.replaceAll(` `, ``))
-    }
-    const custom: CompareOptions = {
-      direction: `asc`,
-      nulls: `first`,
-      stringSort: `custom`,
-      compare,
-    }
-
-    expect(makeComparator(custom)(`pillowfort`, `pillow fort`)).toBe(0)
-    expect(calls).toEqual([[`pillowfort`, `pillow fort`]])
-
-    calls.length = 0
-    expect(makeComparator(custom)(2, 1)).toBeGreaterThan(0)
-    expect(makeComparator(custom)(null, `value`)).toBeLessThan(0)
-    expect(calls).toEqual([])
-
-    expect(
-      makeComparator({ ...custom, direction: `desc` })(`a`, `b`),
-    ).toBeGreaterThan(0)
-  })
-
   it(`preserves signed infinity from a valid custom string comparator`, () => {
     const comparator = makeComparator({
       ...defaultOpts,
@@ -974,21 +945,6 @@ describe(`makeComparator property-based tests`, () => {
 })
 
 describe(`normalizeValue property-based tests`, () => {
-  it(`binary key size and content laws reach the bounded length margins`, () => {
-    for (const length of [0, 1, 128, 129, 200]) {
-      const bytes = Uint8Array.from({ length }, (_, index) => index % 256)
-      const normalized = normalizeValue(bytes)
-      expect(typeof normalized).toBe(`string`)
-      expect((normalized as string).length - length).toBeLessThan(32)
-      expect(normalizeValue(new Uint8Array(bytes))).toBe(normalized)
-      if (length > 0) {
-        const changed = new Uint8Array(bytes)
-        changed[length - 1] = (changed[length - 1]! + 1) % 256
-        expect(normalizeValue(changed)).not.toBe(normalized)
-      }
-    }
-  })
-
   comparisonProperty([arbitraryDate])(
     `dates normalize to their timestamp`,
     (date) => {
@@ -1036,11 +992,6 @@ describe(`normalizeValue property-based tests`, () => {
 })
 
 describe(`areValuesEqual property-based tests`, () => {
-  it(`different integer law reaches an unequal pair`, () => {
-    expect(areValuesEqual(1, 2)).toBe(false)
-    expect(areValuesEqual(2, 1)).toBe(false)
-  })
-
   comparisonProperty([fc.uint8Array({ minLength: 0, maxLength: 50 })])(
     `Uint8Arrays with same content are equal`,
     (arr) => {
diff --git a/packages/db/tests/comparison.test.ts b/packages/db/tests/comparison.test.ts
index 7c60bc5d0c..997fa3d493 100644
--- a/packages/db/tests/comparison.test.ts
+++ b/packages/db/tests/comparison.test.ts
@@ -1,6 +1,14 @@
 import { describe, expect, it } from 'vitest'
-import { ascComparator, compareValues } from '../src/utils/comparison'
+import {
+  areValuesEqual,
+  ascComparator,
+  compareValues,
+  makeComparator,
+  normalizeValue,
+} from '../src/utils/comparison'
 import { DEFAULT_COMPARE_OPTIONS } from '../src/utils'
+import { defaultOpts, lexicalOpts } from './comparison-options.js'
+import type { CompareOptions } from '../src/query/builder/types'
 
 describe(`ascComparator - symbols`, () => {
   const opts = DEFAULT_COMPARE_OPTIONS
@@ -29,3 +37,65 @@ describe(`compareValues - NaN behavior`, () => {
     expect(compareValues(5, NaN)).toBe(0)
   })
 })
+
+describe(`ascComparator property-based tests`, () => {
+  describe(`string comparison`, () => {
+    it(`lexical and en-US locale order distinguish the string-mode axis`, () => {
+      const localeOpts: CompareOptions = { ...defaultOpts, locale: `en-US` }
+      expect(ascComparator(`a`, `B`, lexicalOpts)).toBeGreaterThan(0)
+      expect(ascComparator(`a`, `B`, localeOpts)).toBeLessThan(0)
+    })
+  })
+})
+
+describe(`makeComparator property-based tests`, () => {
+  it(`delegates only string pairs to a custom string comparator`, () => {
+    const calls: Array<[string, string]> = []
+    const compare = (a: string, b: string) => {
+      calls.push([a, b])
+      return a.replaceAll(` `, ``).localeCompare(b.replaceAll(` `, ``))
+    }
+    const custom: CompareOptions = {
+      direction: `asc`,
+      nulls: `first`,
+      stringSort: `custom`,
+      compare,
+    }
+
+    expect(makeComparator(custom)(`pillowfort`, `pillow fort`)).toBe(0)
+    expect(calls).toEqual([[`pillowfort`, `pillow fort`]])
+
+    calls.length = 0
+    expect(makeComparator(custom)(2, 1)).toBeGreaterThan(0)
+    expect(makeComparator(custom)(null, `value`)).toBeLessThan(0)
+    expect(calls).toEqual([])
+
+    expect(
+      makeComparator({ ...custom, direction: `desc` })(`a`, `b`),
+    ).toBeGreaterThan(0)
+  })
+})
+
+describe(`normalizeValue property-based tests`, () => {
+  it(`binary key size and content laws reach the bounded length margins`, () => {
+    for (const length of [0, 1, 128, 129, 200]) {
+      const bytes = Uint8Array.from({ length }, (_, index) => index % 256)
+      const normalized = normalizeValue(bytes)
+      expect(typeof normalized).toBe(`string`)
+      expect((normalized as string).length - length).toBeLessThan(32)
+      expect(normalizeValue(new Uint8Array(bytes))).toBe(normalized)
+      if (length > 0) {
+        const changed = new Uint8Array(bytes)
+        changed[length - 1] = (changed[length - 1]! + 1) % 256
+        expect(normalizeValue(changed)).not.toBe(normalized)
+      }
+    }
+  })
+})
+
+describe(`areValuesEqual property-based tests`, () => {
+  it(`different integer law reaches an unequal pair`, () => {
+    expect(areValuesEqual(1, 2)).toBe(false)
+    expect(areValuesEqual(2, 1)).toBe(false)
+  })
+})
diff --git a/packages/db/tests/conformance-infinite-calibration.test.ts b/packages/db/tests/conformance-infinite-calibration.test.ts
index 754a5c36bd..dc6b106988 100644
--- a/packages/db/tests/conformance-infinite-calibration.test.ts
+++ b/packages/db/tests/conformance-infinite-calibration.test.ts
@@ -1,5 +1,6 @@
 import { vi } from 'vitest'
 import { runInfiniteQuerySuite } from './conformance/infinite-suite-oracle'
+import { registerInfiniteQueryUnitScenarios } from './conformance/infinite-suite-cases'
 import type { InfiniteQueryDriver } from './conformance/infinite-contract'
 import type * as Vitest from 'vitest'
 
@@ -81,7 +82,7 @@ it.each(
         },
       }),
     } as unknown as InfiniteQueryDriver
-    runInfiniteQuerySuite(driver)
+    runInfiniteQuerySuite(driver, registerInfiniteQueryUnitScenarios)
     const run = [...scenarios.entries()].find(([name]) =>
       name.startsWith(`[concurrent-fetch]`),
     )?.[1]
diff --git a/packages/db/tests/conformance/infinite-suite-cases.ts b/packages/db/tests/conformance/infinite-suite-cases.ts
new file mode 100644
index 0000000000..f9de9a4ea4
--- /dev/null
+++ b/packages/db/tests/conformance/infinite-suite-cases.ts
@@ -0,0 +1,249 @@
+/**
+ * Unit scenarios of the infinite-query suite. Each one compares production with
+ * a value that a person wrote down: a rejection message, an error the test
+ * created itself, a subscriber count of zero, or a fetch order recorded as
+ * booleans. None compares with the source rows or with a model, so none is
+ * oracle coverage. The page-ledger laws are in infinite-suite-oracle.ts, and
+ * the shared machinery is in infinite-suite-harness.ts.
+ */
+import { expect, it } from 'vitest'
+import {
+  captureError,
+  registerRegistrySelfTest,
+  rows,
+  runScenario,
+  scenarioLifetime,
+  trackScenarioPromise,
+  waitFor,
+} from './infinite-suite-harness'
+import type { QueryBuild } from './contract'
+import type { InfiniteQueryContext } from './infinite-suite-harness'
+
+export function registerInfiniteQueryCaseScenarios(
+  context: InfiniteQueryContext,
+): void {
+  const { driver, registry, state } = context
+  const lifetime = scenarioLifetime(state)
+  const trackPromise = (promise: Promise<void>): Promise<void> =>
+    trackScenarioPromise(state, promise)
+  const scenario = (
+    key: string,
+    name: string,
+    fn: () => Promise<void> | void,
+  ) => {
+    registry.register(key)
+    const label = `[${key}] ${name}`
+    it(label, () => runScenario(state, fn))
+  }
+
+  scenario(
+    `fetch-settlement`,
+    `fulfills the driver operation only after the window request fulfills`,
+    async () => {
+      const source = driver.makeSource(rows(8))
+      const handle = driver.mount(
+        (q) =>
+          q
+            .from({ items: source.collection })
+            .orderBy(({ items }: any) => items.rank, `desc`),
+        { pageSize: 3 },
+      )
+      await handle.flush()
+
+      const utils = handle.current().collection.utils as {
+        setWindow: (window: {
+          offset: number
+          limit: number
+        }) => true | Promise<void>
+      }
+      const originalSetWindow = utils.setWindow.bind(utils)
+      let resolveWindow: (() => void) | undefined
+      lifetime!.defer(() => resolveWindow?.())
+      utils.setWindow = (window) => {
+        originalSetWindow(window)
+        return new Promise<void>((resolve) => {
+          resolveWindow = resolve
+        })
+      }
+
+      try {
+        let fetchFulfilled = false
+        const fetch = trackPromise(handle.fetchNextPage()).then(() => {
+          fetchFulfilled = true
+        })
+        void fetch.catch(() => undefined)
+        await waitFor(() => resolveWindow !== undefined)
+        await Promise.resolve()
+        expect(fetchFulfilled).toBe(false)
+        resolveWindow?.()
+        await fetch
+        expect(fetchFulfilled).toBe(true)
+      } finally {
+        utils.setWindow = originalSetWindow
+      }
+    },
+  )
+
+  scenario(
+    `callback-error`,
+    `surfaces an error thrown while constructing the query`,
+    async () => {
+      const failure = new Error(`query construction failed`)
+      const error = await captureError(() =>
+        driver.mount(
+          ((..._args: Array<any>) => {
+            throw failure
+          }) as any,
+          { pageSize: 3 },
+        ),
+      )
+      expect(error).toBe(failure)
+    },
+  )
+
+  scenario(
+    `disabled-callback`,
+    `rejects a nullable query callback through the shared input policy`,
+    async () => {
+      const error = await captureError(() =>
+        driver.mount((() => null) as any, { pageSize: 3 }),
+      )
+      expect(error).toBeInstanceOf(Error)
+      expect((error as Error).message).toContain(
+        `Disabled null or undefined queries are not supported`,
+      )
+    },
+  )
+
+  scenario(
+    `findone-runtime`,
+    `rejects a single-result query at runtime`,
+    async () => {
+      const source = driver.makeSource(rows(4))
+      const error = await captureError(() =>
+        driver.mount(
+          ((q: any) =>
+            q
+              .from({ items: source.collection })
+              .orderBy(({ items }: any) => items.rank, `desc`)
+              .findOne()) as any,
+          { pageSize: 3 },
+        ),
+      )
+      expect(error).toBeInstanceOf(Error)
+      expect((error as Error).message).toContain(`Remove .findOne()`)
+      // A rejected query must not have started: its source stays unread.
+      expect(source.collection.subscriberCount).toBe(0)
+    },
+  )
+
+  scenario(
+    `unordered-collection`,
+    `rejects a pre-created collection without orderBy`,
+    async () => {
+      const source = driver.makeSource(rows(4))
+      const unordered = driver.makePrecreated((q) =>
+        q.from({ items: source.collection }),
+      ).collection
+      const error = await captureError(() =>
+        driver.mountCollection(unordered, { pageSize: 3 }),
+      )
+      expect(error).toBeInstanceOf(Error)
+      expect((error as Error).message).toMatch(/orderBy|ORDER BY/)
+    },
+  )
+
+  scenario(
+    `unordered-query`,
+    `rejects a query callback without orderBy`,
+    async () => {
+      const source = driver.makeSource(rows(4))
+      const error = await captureError(() =>
+        driver.mount((q) => q.from({ items: source.collection }), {
+          pageSize: 3,
+        }),
+      )
+      expect(error).toBeInstanceOf(Error)
+      expect((error as Error).message).toMatch(/orderBy|ORDER BY/)
+    },
+  )
+
+  scenario(
+    `findone-collection`,
+    `rejects a pre-created single-result collection`,
+    async () => {
+      const source = driver.makeSource(rows(4))
+      const single = driver.makePrecreated(((q: any) =>
+        q
+          .from({ items: source.collection })
+          .orderBy(({ items }: any) => items.rank, `desc`)
+          .findOne()) as any).collection
+      const error = await captureError(() =>
+        driver.mountCollection(single, { pageSize: 3 }),
+      )
+      expect(error).toBeInstanceOf(Error)
+      expect((error as Error).message).toContain(`Remove .findOne()`)
+    },
+  )
+
+  scenario(
+    `invalid-input`,
+    `rejects a first argument that is neither a query nor a collection`,
+    async () => {
+      const error = await captureError(() =>
+        driver.mount(null as unknown as Parameters<typeof driver.mount>[0], {
+          pageSize: 3,
+        }),
+      )
+      expect(error).toBeInstanceOf(Error)
+      expect((error as Error).message).toContain(`First argument`)
+    },
+  )
+
+  scenario(
+    `source-id-reuse-in-one-query`,
+    `rejects or pages one query that reads two sources under one Collection ID`,
+    async () => {
+      // Overlapping but different rows: ids 1-4 and 3-6.
+      const first = driver.makeSource(rows(4))
+      const reused = driver.makeSource(rows(6).slice(2), first.collection.id)
+      const build: QueryBuild = (q) =>
+        q
+          .from({ items: first.collection })
+          .join(
+            { other: reused.collection },
+            ({ items, other }: any) => driver.eq(items.id, other.id),
+            `inner`,
+          )
+          .orderBy(({ items }: any) => items.rank, `desc`)
+          .select(({ items }: any) => ({ ...items }))
+      if (driver.comparesQueryIdentity) {
+        const error = await captureError(() =>
+          driver.mount(build, { pageSize: 3 }),
+        )
+        expect(error).toMatchObject({ name: `SourceCollectionIdReuseError` })
+        return
+      }
+      // The inner join matches only ids both objects hold: 3 and 4.
+      // Reading the first object for both sides pages 1-3; the second, 3-5.
+      const handle = driver.mount(build, { pageSize: 3 })
+      await handle.flush()
+      expect(handle.current().data.map((row: any) => row.id)).toEqual([
+        `3`,
+        `4`,
+      ])
+    },
+  )
+}
+
+/**
+ * The unit scenarios of the infinite-query suite, and the registry self-test
+ * that counts them. An ordinary runner passes this registrar to
+ * runInfiniteQuerySuite, so the shared oracle file calls no registering helper.
+ */
+export function registerInfiniteQueryUnitScenarios(
+  context: InfiniteQueryContext,
+): void {
+  registerInfiniteQueryCaseScenarios(context)
+  registerRegistrySelfTest(context.registry)
+}
diff --git a/packages/db/tests/conformance/infinite-suite-harness.ts b/packages/db/tests/conformance/infinite-suite-harness.ts
new file mode 100644
index 0000000000..90567968b7
--- /dev/null
+++ b/packages/db/tests/conformance/infinite-suite-harness.ts
@@ -0,0 +1,174 @@
+/**
+ * Shared machinery for the infinite-query suite: row fixtures, the state that
+ * scopes each scenario's resources to that scenario, the driver wrapper, and
+ * the helpers that the oracle and unit scenario modules both use.
+ *
+ * This module declares no oracle part. Its registry self-test checks the
+ * harness's own bookkeeping, not a law. The laws are in
+ * infinite-suite-oracle.ts, and the hand-written scenarios are in
+ * infinite-suite-cases.ts.
+ */
+import { expect, it } from 'vitest'
+import { ScenarioLifetime } from './scenario-lifetime'
+import { ScenarioSources } from './scenario-sources'
+import type { scenarioRegistry } from './registration'
+import type {
+  InfiniteQueryDriver,
+  InfiniteQueryHandle,
+} from './infinite-contract'
+
+export interface InfiniteRow {
+  id: string
+  label: string
+  rank: number
+}
+
+export type ScenarioRegistry = ReturnType<typeof scenarioRegistry>
+
+/** Resources of the scenario that runs now. Both are null between scenarios. */
+export interface ScenarioState {
+  lifetime: ScenarioLifetime | null
+  sources: ScenarioSources | null
+}
+
+/** What a scenario module needs to register its scenarios into one suite. */
+export interface InfiniteQueryContext {
+  driver: InfiniteQueryDriver
+  registry: ScenarioRegistry
+  state: ScenarioState
+}
+
+export function createScenarioState(): ScenarioState {
+  return { lifetime: null, sources: null }
+}
+
+function runningLifetime(state: ScenarioState): ScenarioLifetime {
+  if (state.lifetime === null) throw new Error(`No scenario is running`)
+  return state.lifetime
+}
+
+/**
+ * The lifetime of whichever scenario runs when a body defers cleanup. A
+ * module binds it once, when it registers, and each call reads the state then.
+ * The binding is nullable like the state it reads: bodies assert that a
+ * scenario is running, and `defer` throws when none is.
+ */
+export function scenarioLifetime(
+  state: ScenarioState,
+): Pick<ScenarioLifetime, 'defer'> | null {
+  return { defer: (cleanup) => runningLifetime(state).defer(cleanup) }
+}
+
+/** Releases a promise with the running scenario, and observes its rejection. */
+export function trackScenarioPromise(
+  state: ScenarioState,
+  promise: Promise<void>,
+): Promise<void> {
+  void promise.catch(() => undefined)
+  runningLifetime(state).defer(() => promise)
+  return promise
+}
+
+/**
+ * Wraps the adapter's driver so that every source, handle, and mounted
+ * collection a scenario creates is released when that scenario ends.
+ */
+export function wrapDriver(
+  rawDriver: InfiniteQueryDriver,
+  state: ScenarioState,
+): InfiniteQueryDriver {
+  const track = <H extends InfiniteQueryHandle>(handle: H): H => {
+    const unmount = handle.unmount.bind(handle)
+    if (state.lifetime) handle.unmount = state.lifetime.defer(unmount)
+    return handle
+  }
+  return {
+    ...rawDriver,
+    makeSource: (data, collectionId) =>
+      state.sources!.track(rawDriver.makeSource(data, collectionId)),
+    makeOnDemandSource: (data, delay) =>
+      state.sources!.track(rawDriver.makeOnDemandSource(data, delay)),
+    makeLaggingOnDemandSource: (data) =>
+      state.sources!.track(rawDriver.makeLaggingOnDemandSource(data)),
+    makePrecreated: (build) =>
+      state.sources!.track(rawDriver.makePrecreated(build)),
+    mount: (build, config) => track(rawDriver.mount(build, config)),
+    mountControllable: (build, initial, config) =>
+      track(rawDriver.mountControllable(build, initial, config)),
+    mountCollection: (collection, config) =>
+      track(rawDriver.mountCollection(collection, config)),
+    mountCollectionControllable: (collection, config) =>
+      track(rawDriver.mountCollectionControllable(collection, config)),
+    mountConfigControllable: (build, config) =>
+      track(rawDriver.mountConfigControllable(build, config)),
+    mountInputControllable: (collection, build, config) =>
+      track(rawDriver.mountInputControllable(collection, build, config)),
+  }
+}
+
+/** Runs one scenario body with its own lifetime and sources, then releases both. */
+export async function runScenario(
+  state: ScenarioState,
+  fn: () => Promise<void> | void,
+): Promise<void> {
+  const resources = new ScenarioLifetime()
+  const ownedSources = new ScenarioSources()
+  state.lifetime = resources
+  state.sources = ownedSources
+  try {
+    await resources.run(async () => {
+      try {
+        await fn()
+      } finally {
+        ownedSources.defer(resources)
+      }
+    })
+  } finally {
+    state.lifetime = null
+    state.sources = null
+  }
+}
+
+export function rows(count: number, prefix = ``): Array<InfiniteRow> {
+  return Array.from({ length: count }, (_, index) => ({
+    id: `${prefix}${index + 1}`,
+    label: `${prefix || `row`}-${index + 1}`,
+    rank: count - index,
+  }))
+}
+
+export async function captureError(
+  fn: () => InfiniteQueryHandle,
+): Promise<unknown> {
+  try {
+    const handle = fn()
+    await handle.flush()
+    handle.unmount()
+    return undefined
+  } catch (error) {
+    return error
+  }
+}
+
+export async function waitFor(check: () => boolean): Promise<void> {
+  for (let attempt = 0; attempt < 20; attempt++) {
+    if (check()) return
+    await Promise.resolve()
+  }
+  throw new Error(`Condition did not become true`)
+}
+
+export async function waitForAsync(check: () => boolean): Promise<void> {
+  for (let attempt = 0; attempt < 50; attempt++) {
+    if (check()) return
+    await new Promise((resolve) => setTimeout(resolve, 5))
+  }
+  throw new Error(`Condition did not become true`)
+}
+
+/** Harness self-test: the suite registers each scenario key exactly once. */
+export function registerRegistrySelfTest(registry: ScenarioRegistry): void {
+  it(`registers every distinct scenario without whole-test waivers`, () => {
+    expect(registry.size).toBe(43)
+  })
+}
diff --git a/packages/db/tests/conformance/infinite-suite-oracle.ts b/packages/db/tests/conformance/infinite-suite-oracle.ts
index bf9d0cdb9a..3bab3babbd 100644
--- a/packages/db/tests/conformance/infinite-suite-oracle.ts
+++ b/packages/db/tests/conformance/infinite-suite-oracle.ts
@@ -14,24 +14,36 @@
  * differ in the value and lifecycle facts visible there. The suite tracks all
  * handles, sources, and pending fetches so cleanup is itself part of the tested
  * history instead of test-runner housekeeping.
+ *
+ * This module keeps the scenarios that compare production with the source rows
+ * or with a model. Scenarios whose only comparison is a value written down by
+ * hand are in infinite-suite-cases.ts. The shared machinery is in
+ * infinite-suite-harness.ts.
  */
 import { describe, expect, it, vi } from 'vitest'
 import { createOracleReach } from '../oracle-reach'
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  captureError,
+  createScenarioState,
+  rows,
+  runScenario,
+  scenarioLifetime,
+  trackScenarioPromise,
+  waitFor,
+  waitForAsync,
+  wrapDriver,
+} from './infinite-suite-harness'
 import { expectPageRows } from './page-laws-oracle'
-import { ScenarioLifetime } from './scenario-lifetime'
-import { ScenarioSources } from './scenario-sources'
 import { scenarioRegistry } from './registration'
+import type {
+  InfiniteQueryContext,
+  InfiniteRow,
+} from './infinite-suite-harness'
 import type {
   InfiniteQueryDriver,
   InfiniteQueryHandle,
 } from './infinite-contract'
-import type { QueryBuild } from './contract'
-
-interface InfiniteRow {
-  id: string
-  label: string
-  rank: number
-}
 
 /**
  * A fulfilled page fetch advances the committed prefix. A failed request leaves
@@ -126,25 +138,6 @@ function expectFirstOnDemandValue(
   }
 }
 
-function rows(count: number, prefix = ``): Array<InfiniteRow> {
-  return Array.from({ length: count }, (_, index) => ({
-    id: `${prefix}${index + 1}`,
-    label: `${prefix || `row`}-${index + 1}`,
-    rank: count - index,
-  }))
-}
-
-async function captureError(fn: () => InfiniteQueryHandle): Promise<unknown> {
-  try {
-    const handle = fn()
-    await handle.flush()
-    handle.unmount()
-    return undefined
-  } catch (error) {
-    return error
-  }
-}
-
 /** A rejected input throws at mount, reconfiguration, flush, or read. */
 async function captureRejection(
   run: () => Promise<unknown> | unknown,
@@ -175,59 +168,27 @@ function expectNoPagesAfterRejection(handle: InfiniteQueryHandle): void {
   }
 }
 
-async function waitFor(check: () => boolean): Promise<void> {
-  for (let attempt = 0; attempt < 20; attempt++) {
-    if (check()) return
-    await Promise.resolve()
-  }
-  throw new Error(`Condition did not become true`)
-}
-
-async function waitForAsync(check: () => boolean): Promise<void> {
-  for (let attempt = 0; attempt < 50; attempt++) {
-    if (check()) return
-    await new Promise((resolve) => setTimeout(resolve, 5))
-  }
-  throw new Error(`Condition did not become true`)
-}
-
-export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
+/**
+ * The two laws that this suite's scenarios compare with. The publication law
+ * checks every ready value against the source prefix for its page count. The
+ * overlapping-window model predicts the committed prefix, its continuation, and
+ * the retained error after overlapping window outcomes.
+ */
+declareOracle({
+  check: [expectReadyObservationsMatchSource],
+  model: [expectedOverlappingWindow],
+})
+
+export function runInfiniteQuerySuite(
+  rawDriver: InfiniteQueryDriver,
+  registerUnitScenarios: (context: InfiniteQueryContext) => void,
+): void {
   const registry = scenarioRegistry(rawDriver.knownGaps)
-  let lifetime: ScenarioLifetime | null = null
-  let sources: ScenarioSources | null = null
-
-  const track = <H extends InfiniteQueryHandle>(handle: H): H => {
-    const unmount = handle.unmount.bind(handle)
-    if (lifetime) handle.unmount = lifetime.defer(unmount)
-    return handle
-  }
-  const trackPromise = (promise: Promise<void>): Promise<void> => {
-    void promise.catch(() => undefined)
-    lifetime!.defer(() => promise)
-    return promise
-  }
-  const driver: InfiniteQueryDriver = {
-    ...rawDriver,
-    makeSource: (data, collectionId) =>
-      sources!.track(rawDriver.makeSource(data, collectionId)),
-    makeOnDemandSource: (data, delay) =>
-      sources!.track(rawDriver.makeOnDemandSource(data, delay)),
-    makeLaggingOnDemandSource: (data) =>
-      sources!.track(rawDriver.makeLaggingOnDemandSource(data)),
-    makePrecreated: (build) => sources!.track(rawDriver.makePrecreated(build)),
-    mount: (build, config) => track(rawDriver.mount(build, config)),
-    mountControllable: (build, initial, config) =>
-      track(rawDriver.mountControllable(build, initial, config)),
-    mountCollection: (collection, config) =>
-      track(rawDriver.mountCollection(collection, config)),
-    mountCollectionControllable: (collection, config) =>
-      track(rawDriver.mountCollectionControllable(collection, config)),
-    mountConfigControllable: (build, config) =>
-      track(rawDriver.mountConfigControllable(build, config)),
-    mountInputControllable: (collection, build, config) =>
-      track(rawDriver.mountInputControllable(collection, build, config)),
-  }
-
+  const state = createScenarioState()
+  const driver = wrapDriver(rawDriver, state)
+  const lifetime = scenarioLifetime(state)
+  const trackPromise = (promise: Promise<void>): Promise<void> =>
+    trackScenarioPromise(state, promise)
   const scenario = (
     key: string,
     name: string,
@@ -237,28 +198,12 @@ export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
   ) => {
     registry.register(key)
     const label = `[${key}] ${name}`
-    const run = async () => {
-      const resources = new ScenarioLifetime()
-      const ownedSources = new ScenarioSources()
-      lifetime = resources
-      sources = ownedSources
-      try {
-        await resources.run(async () => {
-          try {
-            await fn()
-          } finally {
-            ownedSources.defer(resources)
-          }
-        })
-      } finally {
-        lifetime = null
-        sources = null
-      }
-    }
-    it(label, run, timeoutMs)
+    it(label, () => runScenario(state, fn), timeoutMs)
   }
 
   describe(`infinite-query conformance :: ${driver.name}`, () => {
+    registerUnitScenarios({ driver, registry, state })
+
     scenario(
       `first-paint-ready`,
       `publishes the ready first page on the first paint for a synchronous source`,
@@ -648,54 +593,6 @@ export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
       },
     )
 
-    scenario(
-      `fetch-settlement`,
-      `fulfills the driver operation only after the window request fulfills`,
-      async () => {
-        const source = driver.makeSource(rows(8))
-        const handle = driver.mount(
-          (q) =>
-            q
-              .from({ items: source.collection })
-              .orderBy(({ items }: any) => items.rank, `desc`),
-          { pageSize: 3 },
-        )
-        await handle.flush()
-
-        const utils = handle.current().collection.utils as {
-          setWindow: (window: {
-            offset: number
-            limit: number
-          }) => true | Promise<void>
-        }
-        const originalSetWindow = utils.setWindow.bind(utils)
-        let resolveWindow: (() => void) | undefined
-        lifetime!.defer(() => resolveWindow?.())
-        utils.setWindow = (window) => {
-          originalSetWindow(window)
-          return new Promise<void>((resolve) => {
-            resolveWindow = resolve
-          })
-        }
-
-        try {
-          let fetchFulfilled = false
-          const fetch = trackPromise(handle.fetchNextPage()).then(() => {
-            fetchFulfilled = true
-          })
-          void fetch.catch(() => undefined)
-          await waitFor(() => resolveWindow !== undefined)
-          await Promise.resolve()
-          expect(fetchFulfilled).toBe(false)
-          resolveWindow?.()
-          await fetch
-          expect(fetchFulfilled).toBe(true)
-        } finally {
-          utils.setWindow = originalSetWindow
-        }
-      },
-    )
-
     scenario(
       `on-demand-paging`,
       `uses peek-ahead windows while paging an on-demand source`,
@@ -1462,108 +1359,6 @@ export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
       },
     )
 
-    scenario(
-      `callback-error`,
-      `surfaces an error thrown while constructing the query`,
-      async () => {
-        const failure = new Error(`query construction failed`)
-        const error = await captureError(() =>
-          driver.mount(
-            ((..._args: Array<any>) => {
-              throw failure
-            }) as any,
-            { pageSize: 3 },
-          ),
-        )
-        expect(error).toBe(failure)
-      },
-    )
-
-    scenario(
-      `disabled-callback`,
-      `rejects a nullable query callback through the shared input policy`,
-      async () => {
-        const error = await captureError(() =>
-          driver.mount((() => null) as any, { pageSize: 3 }),
-        )
-        expect(error).toBeInstanceOf(Error)
-        expect((error as Error).message).toContain(
-          `Disabled null or undefined queries are not supported`,
-        )
-      },
-    )
-
-    scenario(
-      `findone-runtime`,
-      `rejects a single-result query at runtime`,
-      async () => {
-        const source = driver.makeSource(rows(4))
-        const error = await captureError(() =>
-          driver.mount(
-            ((q: any) =>
-              q
-                .from({ items: source.collection })
-                .orderBy(({ items }: any) => items.rank, `desc`)
-                .findOne()) as any,
-            { pageSize: 3 },
-          ),
-        )
-        expect(error).toBeInstanceOf(Error)
-        expect((error as Error).message).toContain(`Remove .findOne()`)
-        // A rejected query must not have started: its source stays unread.
-        expect(source.collection.subscriberCount).toBe(0)
-      },
-    )
-
-    scenario(
-      `unordered-collection`,
-      `rejects a pre-created collection without orderBy`,
-      async () => {
-        const source = driver.makeSource(rows(4))
-        const unordered = driver.makePrecreated((q) =>
-          q.from({ items: source.collection }),
-        ).collection
-        const error = await captureError(() =>
-          driver.mountCollection(unordered, { pageSize: 3 }),
-        )
-        expect(error).toBeInstanceOf(Error)
-        expect((error as Error).message).toMatch(/orderBy|ORDER BY/)
-      },
-    )
-
-    scenario(
-      `unordered-query`,
-      `rejects a query callback without orderBy`,
-      async () => {
-        const source = driver.makeSource(rows(4))
-        const error = await captureError(() =>
-          driver.mount((q) => q.from({ items: source.collection }), {
-            pageSize: 3,
-          }),
-        )
-        expect(error).toBeInstanceOf(Error)
-        expect((error as Error).message).toMatch(/orderBy|ORDER BY/)
-      },
-    )
-
-    scenario(
-      `findone-collection`,
-      `rejects a pre-created single-result collection`,
-      async () => {
-        const source = driver.makeSource(rows(4))
-        const single = driver.makePrecreated(((q: any) =>
-          q
-            .from({ items: source.collection })
-            .orderBy(({ items }: any) => items.rank, `desc`)
-            .findOne()) as any).collection
-        const error = await captureError(() =>
-          driver.mountCollection(single, { pageSize: 3 }),
-        )
-        expect(error).toBeInstanceOf(Error)
-        expect((error as Error).message).toContain(`Remove .findOne()`)
-      },
-    )
-
     scenario(
       `collection-window-normalization`,
       `normalizes a pre-created collection to the first peek-ahead window`,
@@ -1630,20 +1425,6 @@ export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
       },
     )
 
-    scenario(
-      `invalid-input`,
-      `rejects a first argument that is neither a query nor a collection`,
-      async () => {
-        const error = await captureError(() =>
-          driver.mount(null as unknown as Parameters<typeof driver.mount>[0], {
-            pageSize: 3,
-          }),
-        )
-        expect(error).toBeInstanceOf(Error)
-        expect((error as Error).message).toContain(`First argument`)
-      },
-    )
-
     scenario(
       `shared-window-release`,
       `releases shared window leases and restores the initial window`,
@@ -1811,8 +1592,8 @@ export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
               await handle.flush()
               expectPageRows(handle.current(), pagesOf[start], 3)
               for (const next of [second, third]) {
-                const state = reachedState(history, next)
-                if (state) reach.reach(state)
+                const reached = reachedState(history, next)
+                if (reached) reach.reach(reached)
                 if (driver.comparesQueryIdentity && collides(history, next)) {
                   const error = await captureRejection(async () => {
                     handle.setParamSync(next)
@@ -1998,44 +1779,5 @@ export function runInfiniteQuerySuite(rawDriver: InfiniteQueryDriver): void {
         expectPageRows(handle.current(), rows(8).slice(6, 8), 3)
       },
     )
-
-    scenario(
-      `source-id-reuse-in-one-query`,
-      `rejects or pages one query that reads two sources under one Collection ID`,
-      async () => {
-        // Overlapping but different rows: ids 1-4 and 3-6.
-        const first = driver.makeSource(rows(4))
-        const reused = driver.makeSource(rows(6).slice(2), first.collection.id)
-        const build: QueryBuild = (q) =>
-          q
-            .from({ items: first.collection })
-            .join(
-              { other: reused.collection },
-              ({ items, other }: any) => driver.eq(items.id, other.id),
-              `inner`,
-            )
-            .orderBy(({ items }: any) => items.rank, `desc`)
-            .select(({ items }: any) => ({ ...items }))
-        if (driver.comparesQueryIdentity) {
-          const error = await captureError(() =>
-            driver.mount(build, { pageSize: 3 }),
-          )
-          expect(error).toMatchObject({ name: `SourceCollectionIdReuseError` })
-          return
-        }
-        // The inner join matches only ids both objects hold: 3 and 4.
-        // Reading the first object for both sides pages 1-3; the second, 3-5.
-        const handle = driver.mount(build, { pageSize: 3 })
-        await handle.flush()
-        expect(handle.current().data.map((row: any) => row.id)).toEqual([
-          `3`,
-          `4`,
-        ])
-      },
-    )
-
-    it(`registers every distinct scenario without whole-test waivers`, () => {
-      expect(registry.size).toBe(43)
-    })
   })
 }
diff --git a/packages/db/tests/conformance/page-laws-oracle.ts b/packages/db/tests/conformance/page-laws-oracle.ts
index cc03a2706e..61b78e2dd1 100644
--- a/packages/db/tests/conformance/page-laws-oracle.ts
+++ b/packages/db/tests/conformance/page-laws-oracle.ts
@@ -1,4 +1,5 @@
 import { expect } from 'vitest'
+import { declareOracle } from '../oracle-declaration.js'
 import { expectOrderedRows } from './result-laws'
 
 /** Page labels and request timing are separate laws, not inferred from rows. */
@@ -20,3 +21,5 @@ export function expectPageRows(
   }
   expectOrderedRows(actual.pages.flat(), actual.data)
 }
+
+declareOracle({ check: [expectPageRows] })
diff --git a/packages/db/tests/cursor-oracle.property.test.ts b/packages/db/tests/cursor-oracle.property.test.ts
index 25c74e4742..9b0fa3da73 100644
--- a/packages/db/tests/cursor-oracle.property.test.ts
+++ b/packages/db/tests/cursor-oracle.property.test.ts
@@ -8,9 +8,11 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import { withHistoryCleanup } from './optimistic-history-oracle.js'
+import { orderBy } from './cursor-order-terms.js'
 import { evaluateReferenceExpression } from './reference-expression-oracle.js'
-import type { OrderBy } from '../src/query/ir.js'
+import type { Term } from './cursor-order-terms.js'
 
 /**
  * A cursor denotes the strict suffix after one ordered boundary. The
@@ -37,11 +39,6 @@ const randomCampaign = (property: string) => oracleReplayTest(fcTest, property)
 
 const fixedSeed = 20260930
 
-type Term = {
-  direction: `asc` | `desc`
-  nulls: `first` | `last`
-}
-
 const termArbitrary = fc.record<Term>({
   direction: fc.constantFrom(`asc`, `desc`),
   nulls: fc.constantFrom(`first`, `last`),
@@ -83,13 +80,6 @@ function compareTuple(
   return 0
 }
 
-function orderBy(terms: ReadonlyArray<Term>): OrderBy {
-  return terms.map((compareOptions, index) => ({
-    expression: new PropRef([`column${index}`]),
-    compareOptions,
-  }))
-}
-
 function row(values: ReadonlyArray<unknown>): Record<string, unknown> {
   return Object.fromEntries(
     values.map((value, index) => [`column${index}`, value]),
@@ -231,6 +221,11 @@ const assertRepeatedCursor = (
   )
 }
 
+declareOracle({
+  check: [expectCursorDenotation, expectLocalTupleOrder, assertRepeatedCursor],
+  model: [compareValue, compareTuple],
+})
+
 // Boundary width distinguishes one-value continuation from rejected composite
 // values; one value remains legal with several order terms. Direction reverses
 // numeric order, null placement reverses null-versus-number order, and equal
@@ -358,16 +353,6 @@ describe(`buildCursor properties`, () => {
     ).toThrow()
   })
 
-  it(`returns no cursor without boundary values and rejects a boundary without an order`, () => {
-    expect(() => buildCursor([], [1])).toThrow(
-      `Only leading-column cursors are supported`,
-    )
-    expect(buildCursor([], [])).toBeUndefined()
-    expect(
-      buildCursor(orderBy([{ direction: `asc`, nulls: `first` }]), []),
-    ).toBeUndefined()
-  })
-
   fixedCampaign.prop([exactCursorArbitrary], {
     numRuns: oracleRuns(300),
     seed: fixedSeed,
diff --git a/packages/db/tests/cursor-order-terms.ts b/packages/db/tests/cursor-order-terms.ts
new file mode 100644
index 0000000000..74231fd84a
--- /dev/null
+++ b/packages/db/tests/cursor-order-terms.ts
@@ -0,0 +1,18 @@
+import { PropRef } from '../src/query/ir.js'
+import type { OrderBy } from '../src/query/ir.js'
+
+/**
+ * Column-indexed ordering for cursor tests: term `i` orders `column${i}`. The
+ * cursor oracle and the ordinary cursor tests share this helper.
+ */
+export type Term = {
+  direction: `asc` | `desc`
+  nulls: `first` | `last`
+}
+
+export function orderBy(terms: ReadonlyArray<Term>): OrderBy {
+  return terms.map((compareOptions, index) => ({
+    expression: new PropRef([`column${index}`]),
+    compareOptions,
+  }))
+}
diff --git a/packages/db/tests/cursor.test.ts b/packages/db/tests/cursor.test.ts
index ba0141b133..46b6116db8 100644
--- a/packages/db/tests/cursor.test.ts
+++ b/packages/db/tests/cursor.test.ts
@@ -2,9 +2,10 @@ import { describe, expect, it } from 'vitest'
 import { PropRef } from '../src/query/ir.js'
 import { buildCursor, canExpressCursorOrder } from '../src/utils/cursor.js'
 import { evaluateReferenceExpression } from './reference-expression-oracle.js'
+import { orderBy } from './cursor-order-terms.js'
 import type { OrderBy } from '../src/query/ir.js'
 
-function orderBy(
+function orderByPaths(
   ...terms: ReadonlyArray<readonly [string, `asc` | `desc`, `first` | `last`]>
 ): OrderBy {
   return terms.map(([path, direction, nulls]) => ({
@@ -25,32 +26,35 @@ function matches(
 
 describe(`buildCursor`, () => {
   it(`uses direction for one non-null term`, () => {
-    expect(matches(orderBy([`rank`, `asc`, `first`]), [10], { rank: 11 })).toBe(
-      true,
-    )
-    expect(matches(orderBy([`rank`, `asc`, `first`]), [10], { rank: 9 })).toBe(
-      false,
-    )
-    expect(matches(orderBy([`rank`, `desc`, `first`]), [10], { rank: 9 })).toBe(
-      true,
-    )
     expect(
-      matches(orderBy([`rank`, `desc`, `first`]), [10], { rank: 11 }),
+      matches(orderByPaths([`rank`, `asc`, `first`]), [10], { rank: 11 }),
+    ).toBe(true)
+    expect(
+      matches(orderByPaths([`rank`, `asc`, `first`]), [10], { rank: 9 }),
+    ).toBe(false)
+    expect(
+      matches(orderByPaths([`rank`, `desc`, `first`]), [10], { rank: 9 }),
+    ).toBe(true)
+    expect(
+      matches(orderByPaths([`rank`, `desc`, `first`]), [10], { rank: 11 }),
     ).toBe(false)
   })
 
   it(`places nullish values according to the term`, () => {
-    const nullsFirst = orderBy([`rank`, `asc`, `first`])
+    const nullsFirst = orderByPaths([`rank`, `asc`, `first`])
     expect(matches(nullsFirst, [null], { rank: 0 })).toBe(true)
     expect(matches(nullsFirst, [null], { rank: undefined })).toBe(false)
 
-    const nullsLast = orderBy([`rank`, `asc`, `last`])
+    const nullsLast = orderByPaths([`rank`, `asc`, `last`])
     expect(matches(nullsLast, [0], { rank: null })).toBe(true)
     expect(matches(nullsLast, [null], { rank: 0 })).toBe(false)
   })
 
   it(`rejects composite cursors with mixed-direction terms`, () => {
-    const order = orderBy([`group`, `asc`, `first`], [`rank`, `desc`, `last`])
+    const order = orderByPaths(
+      [`group`, `asc`, `first`],
+      [`rank`, `desc`, `last`],
+    )
 
     expect(() => buildCursor(order, [1, 10])).toThrow(
       `Only leading-column cursors are supported`,
@@ -59,7 +63,10 @@ describe(`buildCursor`, () => {
   })
 
   it(`uses the leading term for a partial composite cursor`, () => {
-    const order = orderBy([`first`, `asc`, `first`], [`second`, `asc`, `first`])
+    const order = orderByPaths(
+      [`first`, `asc`, `first`],
+      [`second`, `asc`, `first`],
+    )
     expect(matches(order, [1], { first: 2, second: 0 })).toBe(true)
     expect(matches(order, [1], { first: 0, second: 2 })).toBe(false)
     expect(canExpressCursorOrder(order, [1])).toBe(true)
@@ -109,3 +116,15 @@ describe(`buildCursor`, () => {
     expect(canExpressCursorOrder(customOrder, [`item2`])).toBe(false)
   })
 })
+
+describe(`buildCursor properties`, () => {
+  it(`returns no cursor without boundary values and rejects a boundary without an order`, () => {
+    expect(() => buildCursor([], [1])).toThrow(
+      `Only leading-column cursors are supported`,
+    )
+    expect(buildCursor([], [])).toBeUndefined()
+    expect(
+      buildCursor(orderBy([{ direction: `asc`, nulls: `first` }]), []),
+    ).toBeUndefined()
+  })
+})
diff --git a/packages/db/tests/d2-source-reconciliation-oracle.property.test.ts b/packages/db/tests/d2-source-reconciliation-oracle.property.test.ts
index 85ae9bd339..7631d235bc 100644
--- a/packages/db/tests/d2-source-reconciliation-oracle.property.test.ts
+++ b/packages/db/tests/d2-source-reconciliation-oracle.property.test.ts
@@ -1,20 +1,21 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { expect, it as vitestIt } from 'vitest'
-import {
-  createCollection,
-  createLiveQueryCollection,
-  eq,
-} from '../src/index.js'
-import { BTreeIndex } from '../src/indexes/btree-index.js'
-import { createEffect } from '../src/query/effect.js'
 import { reconcileChangesForD2 } from '../src/query/live/utils.js'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
-import { flushPromises } from './utils.js'
-import type { ChangeMessage, SyncConfig } from '../src/types.js'
+import { declareOracle } from './oracle-declaration.js'
+import {
+  addWeight,
+  expectedWeightedRowIdentity,
+} from './d2-source-reconciliation-support.js'
+import type {
+  SourceKey,
+  SourceRow,
+} from './d2-source-reconciliation-support.js'
+import type { ChangeMessage } from '../src/types.js'
 
 const it = oracleReplayTest(vitestIt)
 const fixedCampaign = oracleReplayTest(fcTest)
@@ -44,16 +45,6 @@ const randomCampaign = (property: string) => oracleReplayTest(fcTest, property)
  * not establish every graph shape or publication schedule.
  */
 
-type SourceRow = {
-  id: number
-  revision: number
-  value: number
-}
-
-type SourceSyncActions = Parameters<SyncConfig<SourceRow, number>[`sync`]>[0]
-
-type SourceKey = string | number
-
 type SourceOperation =
   | {
       type: `upsert`
@@ -201,30 +192,6 @@ const disjointHistoriesArbitrary = fc.tuple(
   }),
 )
 
-function rowIdentity(row: SourceRow): string {
-  return `${row.id}:${row.revision}:${row.value}`
-}
-
-function expectedWeightedRowIdentity(key: SourceKey, row: SourceRow): string {
-  const sourceIdentity = [typeof key, String(key)].join(`:`)
-  const payloadIdentity = [row.id, row.revision, row.value]
-    .map(String)
-    .join(`:`)
-  return `${sourceIdentity}|${payloadIdentity}`
-}
-
-function addWeight(
-  relation: Map<string, number>,
-  key: SourceKey,
-  row: SourceRow,
-  weight: 1 | -1,
-): void {
-  const identity = `${typeof key}:${String(key)}|${rowIdentity(row)}`
-  const nextWeight = (relation.get(identity) ?? 0) + weight
-  if (nextWeight === 0) relation.delete(identity)
-  else relation.set(identity, nextWeight)
-}
-
 function applyToRelation(
   relation: Map<string, number>,
   changes: ReadonlyArray<ChangeMessage<SourceRow, SourceKey>>,
@@ -393,646 +360,6 @@ function upsert(
   }
 }
 
-function createOrderedSourceHarness(id: string, autoIndex: `eager` | `off`) {
-  // Intentional fault-injection boundary: substitute stale subscription events
-  // while retaining the actual ordered Effect/live-query consumer. This does
-  // not establish that a particular SDK emits these events naturally.
-  // The Collection stays inert until initialize runs inside runWithCleanup;
-  // source sync and consumer construction can then fail without losing cleanup.
-  let sync!: SourceSyncActions
-  let replayHeld = false
-  const replayResolvers: Array<() => void> = []
-  const contributed = { id: 1, revision: 1, value: 1 }
-  const staleDelete = { id: 1, revision: 2, value: 1 }
-  const replacement = { id: 1, revision: 3, value: 2 }
-  const source = createCollection<SourceRow, number>({
-    id,
-    getKey: (row) => row.id,
-    startSync: false,
-    syncMode: `on-demand`,
-    autoIndex,
-    defaultIndexType: BTreeIndex,
-    sync: {
-      sync: (actions) => {
-        sync = actions
-        actions.markReady()
-        return {
-          loadSubset: () => {
-            // Initial demand settles immediately on both routes. Truncate
-            // replay demand remains held at the same public checkpoint.
-            if (replayHeld) {
-              return new Promise((resolve) => replayResolvers.push(resolve))
-            }
-            return true
-          },
-        }
-      },
-    },
-  })
-  let sourceCallback: Parameters<typeof source.subscribeChanges>[0] | undefined
-  let suppressSourceChanges = false
-  const settlePendingReplay = async () => {
-    // Stop holding future acquisitions before releasing the current ones.
-    // A graph continuation may request another page during this drain.
-    replayHeld = false
-    for (const resolve of replayResolvers.splice(0)) resolve()
-    await flushPromises()
-  }
-
-  return {
-    contributed,
-    replacement,
-    source,
-    staleDelete,
-    initialize: () => {
-      const subscribeChanges = source.subscribeChanges.bind(source)
-      source.subscribeChanges = ((callback, options) => {
-        sourceCallback = callback
-        return subscribeChanges((changes) => {
-          if (!suppressSourceChanges) callback(changes)
-        }, options)
-      }) as typeof source.subscribeChanges
-      source.startSyncImmediate()
-      sync.begin()
-      sync.write({ type: `insert`, value: contributed })
-      expect(sync.commit()).toBe(true)
-    },
-    suppressSourceChanges: () => {
-      suppressSourceChanges = true
-    },
-    publish: (changes: Array<ChangeMessage<SourceRow, number>>) => {
-      if (sourceCallback === undefined) {
-        throw new Error(`Query did not subscribe to its source`)
-      }
-      const publish = sourceCallback as unknown as (
-        messages: Array<ChangeMessage<SourceRow, number>>,
-      ) => void
-      publish(changes)
-    },
-    truncate: () => {
-      replayHeld = true
-      sync.begin()
-      sync.truncate()
-      expect(sync.commit()).toBe(true)
-    },
-    pendingReplayCount: () => replayResolvers.length,
-    settlePendingReplay,
-    resolveReplay: async () => {
-      if (replayResolvers.length === 0) {
-        throw new Error(`No truncate replay is pending`)
-      }
-      await settlePendingReplay()
-    },
-  }
-}
-
-async function runWithCleanup(
-  check: () => Promise<void>,
-  cleanups: ReadonlyArray<{
-    resource: string
-    release: () => void | Promise<void>
-  }>,
-): Promise<void> {
-  let failed = false
-  let primaryFailure: unknown
-  try {
-    await check()
-  } catch (error) {
-    failed = true
-    primaryFailure = error
-  }
-
-  const cleanupFailures: Array<Error> = []
-  for (const { resource, release } of cleanups) {
-    try {
-      await release()
-    } catch (error) {
-      cleanupFailures.push(
-        new Error(`D2 oracle ${resource} cleanup failed`, { cause: error }),
-      )
-    }
-  }
-
-  if (failed && cleanupFailures.length > 0) {
-    throw new AggregateError(cleanupFailures, `D2 oracle cleanup failed`, {
-      cause: primaryFailure,
-    })
-  }
-  if (failed) throw primaryFailure
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(cleanupFailures, `D2 oracle cleanup failed`)
-  }
-}
-
-it(`retains a D2 mismatch and later cleanup diagnostics while releasing every resource`, async () => {
-  const mismatch = new Error(`wrong D2 row`)
-  const cleanupFailure = new Error(`first release failed`)
-  const secondCleanupFailure = new Error(`second release failed`)
-  const released: Array<string> = []
-  let report: unknown
-  try {
-    await runWithCleanup(
-      () => Promise.reject(mismatch),
-      [
-        {
-          resource: `first resource`,
-          release: () => {
-            released.push(`first`)
-            throw cleanupFailure
-          },
-        },
-        {
-          resource: `second resource`,
-          release: () => {
-            released.push(`second`)
-            throw secondCleanupFailure
-          },
-        },
-        {
-          resource: `last resource`,
-          release: () => {
-            released.push(`last`)
-          },
-        },
-      ],
-    )
-  } catch (error) {
-    report = error
-  }
-
-  expect(report).toBeInstanceOf(AggregateError)
-  if (!(report instanceof AggregateError)) return
-  expect(report.cause).toBe(mismatch)
-  expect(report.errors).toEqual([
-    new Error(`D2 oracle first resource cleanup failed`, {
-      cause: cleanupFailure,
-    }),
-    new Error(`D2 oracle second resource cleanup failed`, {
-      cause: secondCleanupFailure,
-    }),
-  ])
-  expect(released).toEqual([`first`, `second`, `last`])
-})
-
-it(`releases an initialized source when consumer setup fails`, async () => {
-  const harness = createOrderedSourceHarness(`d2-setup-failure`, `eager`)
-  const setupFailure = new Error(`consumer setup failed`)
-  let reported: unknown
-  try {
-    await runWithCleanup(() => {
-      harness.initialize()
-      return Promise.reject(setupFailure)
-    }, [
-      {
-        resource: `source Collection`,
-        release: () => harness.source.cleanup(),
-      },
-    ])
-  } catch (error) {
-    reported = error
-  }
-  expect(reported).toBe(setupFailure)
-  expect(harness.source.status).toBe(`cleaned-up`)
-})
-
-it(`settles held replay work after a D2 mismatch without replacing it`, async () => {
-  const harness = createOrderedSourceHarness(`d2-held-replay-failure`, `eager`)
-  const mismatch = new Error(`wrong row during held replay`)
-  let disposeEffect: (() => void | Promise<void>) | undefined
-  let reported: unknown
-  try {
-    await runWithCleanup(async () => {
-      harness.initialize()
-      const effect = createEffect<SourceRow, number>({
-        query: (query) =>
-          query
-            .from({ row: harness.source })
-            .orderBy(({ row }) => row.value)
-            .limit(1),
-        onBatch: () => {},
-      })
-      disposeEffect = () => effect.dispose()
-      await flushPromises()
-      harness.truncate()
-      await flushPromises()
-      expect(harness.pendingReplayCount()).toBeGreaterThan(0)
-      throw mismatch
-    }, [
-      {
-        resource: `held truncate replay`,
-        release: () => harness.settlePendingReplay(),
-      },
-      { resource: `Effect`, release: () => disposeEffect?.() },
-      {
-        resource: `source Collection`,
-        release: () => harness.source.cleanup(),
-      },
-    ])
-  } catch (error) {
-    reported = error
-  }
-  expect(reported).toBe(mismatch)
-  expect(harness.pendingReplayCount()).toBe(0)
-  expect(harness.source.status).toBe(`cleaned-up`)
-})
-
-it(`uses sent-row membership and values at the D2 change boundary`, () => {
-  const sentRows = new Map<SourceKey, SourceRow>()
-  const stale = { id: 1, revision: 1, value: 1 }
-  const current = { id: 2, revision: 2, value: 2 }
-  const replacement = { id: 2, revision: 3, value: 3 }
-
-  expect(
-    reconcileChangesForD2(
-      [{ type: `delete`, key: `row`, value: stale }],
-      sentRows,
-    ),
-  ).toEqual([])
-  expect(
-    reconcileChangesForD2(
-      [
-        {
-          type: `update`,
-          key: `row`,
-          previousValue: stale,
-          value: current,
-        },
-      ],
-      sentRows,
-    ),
-  ).toEqual([{ type: `insert`, key: `row`, value: current }])
-  expect(sentRows).toEqual(new Map([[`row`, current]]))
-
-  // A known-key update and delete retract the row sent to D2, even when the
-  // source reports a different previous value. These adjacent cells reject
-  // both "always insert updates" and "trust the reported value" rules.
-  expect(
-    reconcileChangesForD2(
-      [
-        {
-          type: `update`,
-          key: `row`,
-          previousValue: stale,
-          value: replacement,
-        },
-      ],
-      sentRows,
-    ),
-  ).toEqual([
-    {
-      type: `update`,
-      key: `row`,
-      previousValue: current,
-      value: replacement,
-    },
-  ])
-  expect(
-    reconcileChangesForD2(
-      [{ type: `delete`, key: `row`, value: stale }],
-      sentRows,
-    ),
-  ).toEqual([{ type: `delete`, key: `row`, value: replacement }])
-  expect(sentRows).toEqual(new Map())
-})
-
-it.each([`eager`, `off`] as const)(
-  `retracts the exact Effect source row after an ordered truncate (%s index)`,
-  async (autoIndex) => {
-    const harness = createOrderedSourceHarness(
-      `d2-effect-truncate-reconciliation-${autoIndex}`,
-      autoIndex,
-    )
-    const { contributed, source, staleDelete } = harness
-    const events: Array<{
-      type: string
-      value: { id: number; revision: number; value: number }
-    }> = []
-    let disposeEffect: (() => void | Promise<void>) | undefined
-    await runWithCleanup(async () => {
-      harness.initialize()
-      const effect = createEffect<SourceRow, number>({
-        query: (query) =>
-          query
-            .from({ row: source })
-            .where(({ row }) => eq(row.revision, contributed.revision))
-            .orderBy(({ row }) => row.value)
-            .limit(1),
-        onBatch: (batch) => {
-          events.push(...batch)
-        },
-      })
-      disposeEffect = () => effect.dispose()
-      await flushPromises()
-      expect(events).toHaveLength(1)
-      expect(events[0]).toMatchObject({
-        type: `enter`,
-        key: 1,
-        value: contributed,
-      })
-      const publishedValue = events[0]!.value
-
-      harness.suppressSourceChanges()
-      harness.truncate()
-      await flushPromises()
-      expect(events).toEqual([{ type: `enter`, key: 1, value: publishedValue }])
-
-      harness.publish([{ type: `delete`, key: 1, value: staleDelete }])
-      await flushPromises()
-      expect(events).toEqual([{ type: `enter`, key: 1, value: publishedValue }])
-
-      await harness.resolveReplay()
-      expect(events).toEqual([
-        { type: `enter`, key: 1, value: publishedValue },
-        { type: `exit`, key: 1, value: publishedValue },
-      ])
-    }, [
-      {
-        resource: `held truncate replay`,
-        release: () => harness.settlePendingReplay(),
-      },
-      { resource: `Effect`, release: () => disposeEffect?.() },
-      { resource: `source Collection`, release: () => source.cleanup() },
-    ])
-  },
-)
-
-it.each([`eager`, `off`] as const)(
-  `retracts the exact live-query source row after ordered replay settles (%s index)`,
-  async (autoIndex) => {
-    const harness = createOrderedSourceHarness(
-      `d2-live-query-truncate-reconciliation-${autoIndex}`,
-      autoIndex,
-    )
-    const { contributed, source, staleDelete } = harness
-    let cleanupLive: (() => Promise<void>) | undefined
-    await runWithCleanup(async () => {
-      harness.initialize()
-      const live = createLiveQueryCollection({
-        id: `d2-live-query-truncate-result`,
-        query: (query) =>
-          query
-            .from({ row: source })
-            .where(({ row }) => eq(row.revision, contributed.revision))
-            .orderBy(({ row }) => row.value)
-            .limit(1),
-        startSync: true,
-      })
-      cleanupLive = () => live.cleanup()
-      await live.preload()
-      expect(live.get(contributed.id)).toMatchObject(contributed)
-
-      harness.suppressSourceChanges()
-      harness.truncate()
-      await flushPromises()
-      expect(live.get(contributed.id)).toMatchObject(contributed)
-
-      harness.publish([{ type: `delete`, key: 1, value: staleDelete }])
-      await flushPromises()
-      expect(live.get(contributed.id)).toMatchObject(contributed)
-
-      await harness.resolveReplay()
-      expect(live.get(contributed.id)).toBeUndefined()
-    }, [
-      {
-        resource: `held truncate replay`,
-        release: () => harness.settlePendingReplay(),
-      },
-      { resource: `live-query Collection`, release: () => cleanupLive?.() },
-      { resource: `source Collection`, release: () => source.cleanup() },
-    ])
-  },
-)
-
-it.each([`eager`, `off`] as const)(
-  `replaces the retained Effect source row after an ordered truncate (%s index)`,
-  async (autoIndex) => {
-    const harness = createOrderedSourceHarness(
-      `d2-effect-truncate-replacement-${autoIndex}`,
-      autoIndex,
-    )
-    const { contributed, replacement, source, staleDelete } = harness
-    const batches: Array<
-      Array<{
-        type: string
-        value: SourceRow
-        previousValue?: SourceRow
-      }>
-    > = []
-    let disposeEffect: (() => void | Promise<void>) | undefined
-    await runWithCleanup(async () => {
-      harness.initialize()
-      const effect = createEffect<SourceRow, number>({
-        query: (query) =>
-          query
-            .from({ row: source })
-            .orderBy(({ row }) => row.value)
-            .limit(1),
-        onBatch: (batch) => {
-          batches.push(batch)
-        },
-      })
-      disposeEffect = () => effect.dispose()
-      await flushPromises()
-      expect(batches).toHaveLength(1)
-      expect(batches[0]).toHaveLength(1)
-      expect(batches[0]![0]).toMatchObject({
-        type: `enter`,
-        key: 1,
-        value: contributed,
-      })
-      const publishedValue = batches[0]![0]!.value
-
-      harness.suppressSourceChanges()
-      harness.truncate()
-      await flushPromises()
-      expect(batches).toHaveLength(1)
-
-      harness.publish([
-        {
-          type: `update`,
-          key: 1,
-          previousValue: staleDelete,
-          value: replacement,
-        },
-      ])
-      await flushPromises()
-      expect(batches).toHaveLength(1)
-
-      await harness.resolveReplay()
-      expect(batches).toHaveLength(2)
-      expect(batches[1]).toHaveLength(1)
-      expect(batches[1]![0]).toMatchObject({
-        type: `update`,
-        key: 1,
-        value: replacement,
-      })
-      expect(batches[1]![0]!.previousValue).toBe(publishedValue)
-    }, [
-      {
-        resource: `held truncate replay`,
-        release: () => harness.settlePendingReplay(),
-      },
-      { resource: `Effect`, release: () => disposeEffect?.() },
-      { resource: `source Collection`, release: () => source.cleanup() },
-    ])
-  },
-)
-
-it.each([`eager`, `off`] as const)(
-  `replaces the retained live-query source row after ordered replay settles (%s index)`,
-  async (autoIndex) => {
-    const harness = createOrderedSourceHarness(
-      `d2-live-query-truncate-replacement-${autoIndex}`,
-      autoIndex,
-    )
-    const { contributed, replacement, source, staleDelete } = harness
-    const batches: Array<Array<ChangeMessage<SourceRow, SourceKey>>> = []
-    let unsubscribe: (() => void) | undefined
-    let cleanupLive: (() => Promise<void>) | undefined
-    await runWithCleanup(async () => {
-      harness.initialize()
-      const live = createLiveQueryCollection({
-        id: `d2-live-query-truncate-replacement-result`,
-        query: (query) =>
-          query
-            .from({ row: source })
-            .orderBy(({ row }) => row.value)
-            .limit(1),
-        startSync: true,
-      })
-      cleanupLive = () => live.cleanup()
-      await live.preload()
-      expect(live.get(contributed.id)).toMatchObject(contributed)
-      const publishedValue = live.get(contributed.id)
-      const subscription = live.subscribeChanges(
-        (changes) => batches.push(changes),
-        { includeInitialState: false },
-      )
-      unsubscribe = () => subscription.unsubscribe()
-
-      harness.suppressSourceChanges()
-      harness.truncate()
-      await flushPromises()
-      expect(batches).toEqual([])
-      expect(live.get(contributed.id)).toBe(publishedValue)
-
-      harness.publish([
-        {
-          type: `update`,
-          key: 1,
-          previousValue: staleDelete,
-          value: replacement,
-        },
-      ])
-      await flushPromises()
-      expect(batches).toEqual([])
-      expect(live.get(contributed.id)).toBe(publishedValue)
-
-      await harness.resolveReplay()
-      expect(batches).toHaveLength(1)
-      expect(batches[0]).toHaveLength(1)
-      expect(batches[0]![0]).toMatchObject({
-        type: `update`,
-        key: 1,
-        value: replacement,
-      })
-      expect(batches[0]![0]!.previousValue).toEqual(publishedValue)
-      expect(live.get(replacement.id)).toMatchObject(replacement)
-    }, [
-      {
-        resource: `held truncate replay`,
-        release: () => harness.settlePendingReplay(),
-      },
-      { resource: `live-query subscriber`, release: () => unsubscribe?.() },
-      { resource: `live-query Collection`, release: () => cleanupLive?.() },
-      { resource: `source Collection`, release: () => source.cleanup() },
-    ])
-  },
-)
-
-it.each([`eager`, `off`] as const)(
-  `retracts the previous graph contribution after a live-query restart (%s index)`,
-  async (autoIndex) => {
-    const harness = createOrderedSourceHarness(
-      `d2-live-query-graph-restart-${autoIndex}`,
-      autoIndex,
-    )
-    const { contributed, replacement, source, staleDelete } = harness
-    const batches: Array<Array<ChangeMessage<SourceRow, SourceKey>>> = []
-    let unsubscribe: (() => void) | undefined
-    let cleanupLive: (() => Promise<void>) | undefined
-    await runWithCleanup(async () => {
-      harness.initialize()
-      const live = createLiveQueryCollection({
-        id: `d2-live-query-graph-restart-result-${autoIndex}`,
-        query: (query) =>
-          query
-            .from({ row: source })
-            .orderBy(({ row }) => row.value)
-            .limit(1),
-        startSync: true,
-      })
-      cleanupLive = () => live.cleanup()
-      await live.preload()
-      expect(live.get(contributed.id)).toMatchObject(contributed)
-
-      await live.cleanup()
-      expect(live.status).toBe(`cleaned-up`)
-      await live.preload()
-      expect(live.get(contributed.id)).toMatchObject(contributed)
-      const restartedValue = live.get(contributed.id)
-      const subscription = live.subscribeChanges(
-        (changes) => batches.push(changes),
-        { includeInitialState: false },
-      )
-      unsubscribe = () => subscription.unsubscribe()
-
-      harness.publish([
-        {
-          type: `update`,
-          key: contributed.id,
-          previousValue: staleDelete,
-          value: replacement,
-        },
-      ])
-      await flushPromises()
-      expect(batches).toHaveLength(1)
-      expect(batches[0]).toHaveLength(1)
-      expect(batches[0]![0]).toMatchObject({
-        type: `update`,
-        key: contributed.id,
-        value: replacement,
-      })
-      expect(batches[0]![0]!.previousValue).toEqual(restartedValue)
-      expect(live.get(replacement.id)).toMatchObject(replacement)
-    }, [
-      { resource: `live-query subscriber`, release: () => unsubscribe?.() },
-      { resource: `live-query Collection`, release: () => cleanupLive?.() },
-      { resource: `source Collection`, release: () => source.cleanup() },
-    ])
-  },
-)
-
-it(`keeps revision and value in weighted row identity`, () => {
-  const key = `row`
-  const base = { id: 1, revision: 1, value: 1 }
-  const differentRevision = { id: 1, revision: 2, value: 1 }
-  const differentValue = { id: 1, revision: 1, value: 2 }
-  const relation = new Map<string, number>()
-
-  addWeight(relation, key, base, 1)
-  addWeight(relation, key, differentRevision, 1)
-  addWeight(relation, key, differentValue, 1)
-
-  expect(relation).toEqual(
-    new Map([
-      [expectedWeightedRowIdentity(key, base), 1],
-      [expectedWeightedRowIdentity(key, differentRevision), 1],
-      [expectedWeightedRowIdentity(key, differentValue), 1],
-    ]),
-  )
-})
-
 it(`keeps numeric and string source keys distinct across restart`, () => {
   const model = createReconciliationModel()
   const row = { id: 1, revision: 1, value: 1 }
@@ -1308,3 +635,16 @@ randomCampaign(`d2-source.disjoint-commutation`).prop(
   `commutes independent source histories for a random or replayed seed`,
   assertDisjointHistoriesCommute,
 )
+
+declareOracle({
+  check: [
+    applyReconciliationStep,
+    expectTrackerMatchesSource,
+    expectWeightedRelationMatchesSource,
+    assertExactSourceContributions,
+    assertChangedSourceReplay,
+    assertDisjointHistoriesCommute,
+  ],
+  model: [applyToRelation],
+  grammar: [reconciliationHistoryArbitrary],
+})
diff --git a/packages/db/tests/d2-source-reconciliation-support.ts b/packages/db/tests/d2-source-reconciliation-support.ts
new file mode 100644
index 0000000000..9f2b4edace
--- /dev/null
+++ b/packages/db/tests/d2-source-reconciliation-support.ts
@@ -0,0 +1,175 @@
+// Shared fixtures for the D2 source reconciliation oracle and its ordinary tests.
+import { expect } from 'vitest'
+import { createCollection } from '../src/index.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { flushPromises } from './utils.js'
+import type { ChangeMessage, SyncConfig } from '../src/types.js'
+
+export type SourceRow = {
+  id: number
+  revision: number
+  value: number
+}
+export type SourceKey = string | number
+export function rowIdentity(row: SourceRow): string {
+  return `${row.id}:${row.revision}:${row.value}`
+}
+export function expectedWeightedRowIdentity(
+  key: SourceKey,
+  row: SourceRow,
+): string {
+  const sourceIdentity = [typeof key, String(key)].join(`:`)
+  const payloadIdentity = [row.id, row.revision, row.value]
+    .map(String)
+    .join(`:`)
+  return `${sourceIdentity}|${payloadIdentity}`
+}
+export function addWeight(
+  relation: Map<string, number>,
+  key: SourceKey,
+  row: SourceRow,
+  weight: 1 | -1,
+): void {
+  const identity = `${typeof key}:${String(key)}|${rowIdentity(row)}`
+  const nextWeight = (relation.get(identity) ?? 0) + weight
+  if (nextWeight === 0) relation.delete(identity)
+  else relation.set(identity, nextWeight)
+}
+
+export type SourceSyncActions = Parameters<
+  SyncConfig<SourceRow, number>[`sync`]
+>[0]
+
+export function createOrderedSourceHarness(
+  id: string,
+  autoIndex: `eager` | `off`,
+) {
+  // Intentional fault-injection boundary: substitute stale subscription events
+  // while retaining the actual ordered Effect/live-query consumer. This does
+  // not establish that a particular SDK emits these events naturally.
+  // The Collection stays inert until initialize runs inside runWithCleanup;
+  // source sync and consumer construction can then fail without losing cleanup.
+  let sync!: SourceSyncActions
+  let replayHeld = false
+  const replayResolvers: Array<() => void> = []
+  const contributed = { id: 1, revision: 1, value: 1 }
+  const staleDelete = { id: 1, revision: 2, value: 1 }
+  const replacement = { id: 1, revision: 3, value: 2 }
+  const source = createCollection<SourceRow, number>({
+    id,
+    getKey: (row) => row.id,
+    startSync: false,
+    syncMode: `on-demand`,
+    autoIndex,
+    defaultIndexType: BTreeIndex,
+    sync: {
+      sync: (actions) => {
+        sync = actions
+        actions.markReady()
+        return {
+          loadSubset: () => {
+            // Initial demand settles immediately on both routes. Truncate
+            // replay demand remains held at the same public checkpoint.
+            if (replayHeld) {
+              return new Promise((resolve) => replayResolvers.push(resolve))
+            }
+            return true
+          },
+        }
+      },
+    },
+  })
+  let sourceCallback: Parameters<typeof source.subscribeChanges>[0] | undefined
+  let suppressSourceChanges = false
+  const settlePendingReplay = async () => {
+    // Stop holding future acquisitions before releasing the current ones.
+    // A graph continuation may request another page during this drain.
+    replayHeld = false
+    for (const resolve of replayResolvers.splice(0)) resolve()
+    await flushPromises()
+  }
+
+  return {
+    contributed,
+    replacement,
+    source,
+    staleDelete,
+    initialize: () => {
+      const subscribeChanges = source.subscribeChanges.bind(source)
+      source.subscribeChanges = ((callback, options) => {
+        sourceCallback = callback
+        return subscribeChanges((changes) => {
+          if (!suppressSourceChanges) callback(changes)
+        }, options)
+      }) as typeof source.subscribeChanges
+      source.startSyncImmediate()
+      sync.begin()
+      sync.write({ type: `insert`, value: contributed })
+      expect(sync.commit()).toBe(true)
+    },
+    suppressSourceChanges: () => {
+      suppressSourceChanges = true
+    },
+    publish: (changes: Array<ChangeMessage<SourceRow, number>>) => {
+      if (sourceCallback === undefined) {
+        throw new Error(`Query did not subscribe to its source`)
+      }
+      const publish = sourceCallback as unknown as (
+        messages: Array<ChangeMessage<SourceRow, number>>,
+      ) => void
+      publish(changes)
+    },
+    truncate: () => {
+      replayHeld = true
+      sync.begin()
+      sync.truncate()
+      expect(sync.commit()).toBe(true)
+    },
+    pendingReplayCount: () => replayResolvers.length,
+    settlePendingReplay,
+    resolveReplay: async () => {
+      if (replayResolvers.length === 0) {
+        throw new Error(`No truncate replay is pending`)
+      }
+      await settlePendingReplay()
+    },
+  }
+}
+
+export async function runWithCleanup(
+  check: () => Promise<void>,
+  cleanups: ReadonlyArray<{
+    resource: string
+    release: () => void | Promise<void>
+  }>,
+): Promise<void> {
+  let failed = false
+  let primaryFailure: unknown
+  try {
+    await check()
+  } catch (error) {
+    failed = true
+    primaryFailure = error
+  }
+
+  const cleanupFailures: Array<Error> = []
+  for (const { resource, release } of cleanups) {
+    try {
+      await release()
+    } catch (error) {
+      cleanupFailures.push(
+        new Error(`D2 oracle ${resource} cleanup failed`, { cause: error }),
+      )
+    }
+  }
+
+  if (failed && cleanupFailures.length > 0) {
+    throw new AggregateError(cleanupFailures, `D2 oracle cleanup failed`, {
+      cause: primaryFailure,
+    })
+  }
+  if (failed) throw primaryFailure
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(cleanupFailures, `D2 oracle cleanup failed`)
+  }
+}
diff --git a/packages/db/tests/d2-source-reconciliation.test.ts b/packages/db/tests/d2-source-reconciliation.test.ts
new file mode 100644
index 0000000000..a39033d3f8
--- /dev/null
+++ b/packages/db/tests/d2-source-reconciliation.test.ts
@@ -0,0 +1,528 @@
+// Ordinary tests moved out of d2-source-reconciliation-oracle.property.test.ts.
+// They keep literal expectations for Effect and live-query consumers and for the
+// D2 change boundary; the reconciliation laws stay in the oracle file.
+import { expect, it } from 'vitest'
+import { createLiveQueryCollection, eq } from '../src/index.js'
+import { createEffect } from '../src/query/effect.js'
+import { reconcileChangesForD2 } from '../src/query/live/utils.js'
+import { flushPromises } from './utils.js'
+import {
+  addWeight,
+  createOrderedSourceHarness,
+  expectedWeightedRowIdentity,
+  runWithCleanup,
+} from './d2-source-reconciliation-support.js'
+import type {
+  SourceKey,
+  SourceRow,
+} from './d2-source-reconciliation-support.js'
+import type { ChangeMessage } from '../src/types.js'
+
+it(`retains a D2 mismatch and later cleanup diagnostics while releasing every resource`, async () => {
+  const mismatch = new Error(`wrong D2 row`)
+  const cleanupFailure = new Error(`first release failed`)
+  const secondCleanupFailure = new Error(`second release failed`)
+  const released: Array<string> = []
+  let report: unknown
+  try {
+    await runWithCleanup(
+      () => Promise.reject(mismatch),
+      [
+        {
+          resource: `first resource`,
+          release: () => {
+            released.push(`first`)
+            throw cleanupFailure
+          },
+        },
+        {
+          resource: `second resource`,
+          release: () => {
+            released.push(`second`)
+            throw secondCleanupFailure
+          },
+        },
+        {
+          resource: `last resource`,
+          release: () => {
+            released.push(`last`)
+          },
+        },
+      ],
+    )
+  } catch (error) {
+    report = error
+  }
+
+  expect(report).toBeInstanceOf(AggregateError)
+  if (!(report instanceof AggregateError)) return
+  expect(report.cause).toBe(mismatch)
+  expect(report.errors).toEqual([
+    new Error(`D2 oracle first resource cleanup failed`, {
+      cause: cleanupFailure,
+    }),
+    new Error(`D2 oracle second resource cleanup failed`, {
+      cause: secondCleanupFailure,
+    }),
+  ])
+  expect(released).toEqual([`first`, `second`, `last`])
+})
+
+it(`releases an initialized source when consumer setup fails`, async () => {
+  const harness = createOrderedSourceHarness(`d2-setup-failure`, `eager`)
+  const setupFailure = new Error(`consumer setup failed`)
+  let reported: unknown
+  try {
+    await runWithCleanup(() => {
+      harness.initialize()
+      return Promise.reject(setupFailure)
+    }, [
+      {
+        resource: `source Collection`,
+        release: () => harness.source.cleanup(),
+      },
+    ])
+  } catch (error) {
+    reported = error
+  }
+  expect(reported).toBe(setupFailure)
+  expect(harness.source.status).toBe(`cleaned-up`)
+})
+
+it(`settles held replay work after a D2 mismatch without replacing it`, async () => {
+  const harness = createOrderedSourceHarness(`d2-held-replay-failure`, `eager`)
+  const mismatch = new Error(`wrong row during held replay`)
+  let disposeEffect: (() => void | Promise<void>) | undefined
+  let reported: unknown
+  try {
+    await runWithCleanup(async () => {
+      harness.initialize()
+      const effect = createEffect<SourceRow, number>({
+        query: (query) =>
+          query
+            .from({ row: harness.source })
+            .orderBy(({ row }) => row.value)
+            .limit(1),
+        onBatch: () => {},
+      })
+      disposeEffect = () => effect.dispose()
+      await flushPromises()
+      harness.truncate()
+      await flushPromises()
+      expect(harness.pendingReplayCount()).toBeGreaterThan(0)
+      throw mismatch
+    }, [
+      {
+        resource: `held truncate replay`,
+        release: () => harness.settlePendingReplay(),
+      },
+      { resource: `Effect`, release: () => disposeEffect?.() },
+      {
+        resource: `source Collection`,
+        release: () => harness.source.cleanup(),
+      },
+    ])
+  } catch (error) {
+    reported = error
+  }
+  expect(reported).toBe(mismatch)
+  expect(harness.pendingReplayCount()).toBe(0)
+  expect(harness.source.status).toBe(`cleaned-up`)
+})
+
+it(`uses sent-row membership and values at the D2 change boundary`, () => {
+  const sentRows = new Map<SourceKey, SourceRow>()
+  const stale = { id: 1, revision: 1, value: 1 }
+  const current = { id: 2, revision: 2, value: 2 }
+  const replacement = { id: 2, revision: 3, value: 3 }
+
+  expect(
+    reconcileChangesForD2(
+      [{ type: `delete`, key: `row`, value: stale }],
+      sentRows,
+    ),
+  ).toEqual([])
+  expect(
+    reconcileChangesForD2(
+      [
+        {
+          type: `update`,
+          key: `row`,
+          previousValue: stale,
+          value: current,
+        },
+      ],
+      sentRows,
+    ),
+  ).toEqual([{ type: `insert`, key: `row`, value: current }])
+  expect(sentRows).toEqual(new Map([[`row`, current]]))
+
+  // A known-key update and delete retract the row sent to D2, even when the
+  // source reports a different previous value. These adjacent cells reject
+  // both "always insert updates" and "trust the reported value" rules.
+  expect(
+    reconcileChangesForD2(
+      [
+        {
+          type: `update`,
+          key: `row`,
+          previousValue: stale,
+          value: replacement,
+        },
+      ],
+      sentRows,
+    ),
+  ).toEqual([
+    {
+      type: `update`,
+      key: `row`,
+      previousValue: current,
+      value: replacement,
+    },
+  ])
+  expect(
+    reconcileChangesForD2(
+      [{ type: `delete`, key: `row`, value: stale }],
+      sentRows,
+    ),
+  ).toEqual([{ type: `delete`, key: `row`, value: replacement }])
+  expect(sentRows).toEqual(new Map())
+})
+
+it.each([`eager`, `off`] as const)(
+  `retracts the exact Effect source row after an ordered truncate (%s index)`,
+  async (autoIndex) => {
+    const harness = createOrderedSourceHarness(
+      `d2-effect-truncate-reconciliation-${autoIndex}`,
+      autoIndex,
+    )
+    const { contributed, source, staleDelete } = harness
+    const events: Array<{
+      type: string
+      value: { id: number; revision: number; value: number }
+    }> = []
+    let disposeEffect: (() => void | Promise<void>) | undefined
+    await runWithCleanup(async () => {
+      harness.initialize()
+      const effect = createEffect<SourceRow, number>({
+        query: (query) =>
+          query
+            .from({ row: source })
+            .where(({ row }) => eq(row.revision, contributed.revision))
+            .orderBy(({ row }) => row.value)
+            .limit(1),
+        onBatch: (batch) => {
+          events.push(...batch)
+        },
+      })
+      disposeEffect = () => effect.dispose()
+      await flushPromises()
+      expect(events).toHaveLength(1)
+      expect(events[0]).toMatchObject({
+        type: `enter`,
+        key: 1,
+        value: contributed,
+      })
+      const publishedValue = events[0]!.value
+
+      harness.suppressSourceChanges()
+      harness.truncate()
+      await flushPromises()
+      expect(events).toEqual([{ type: `enter`, key: 1, value: publishedValue }])
+
+      harness.publish([{ type: `delete`, key: 1, value: staleDelete }])
+      await flushPromises()
+      expect(events).toEqual([{ type: `enter`, key: 1, value: publishedValue }])
+
+      await harness.resolveReplay()
+      expect(events).toEqual([
+        { type: `enter`, key: 1, value: publishedValue },
+        { type: `exit`, key: 1, value: publishedValue },
+      ])
+    }, [
+      {
+        resource: `held truncate replay`,
+        release: () => harness.settlePendingReplay(),
+      },
+      { resource: `Effect`, release: () => disposeEffect?.() },
+      { resource: `source Collection`, release: () => source.cleanup() },
+    ])
+  },
+)
+
+it.each([`eager`, `off`] as const)(
+  `retracts the exact live-query source row after ordered replay settles (%s index)`,
+  async (autoIndex) => {
+    const harness = createOrderedSourceHarness(
+      `d2-live-query-truncate-reconciliation-${autoIndex}`,
+      autoIndex,
+    )
+    const { contributed, source, staleDelete } = harness
+    let cleanupLive: (() => Promise<void>) | undefined
+    await runWithCleanup(async () => {
+      harness.initialize()
+      const live = createLiveQueryCollection({
+        id: `d2-live-query-truncate-result`,
+        query: (query) =>
+          query
+            .from({ row: source })
+            .where(({ row }) => eq(row.revision, contributed.revision))
+            .orderBy(({ row }) => row.value)
+            .limit(1),
+        startSync: true,
+      })
+      cleanupLive = () => live.cleanup()
+      await live.preload()
+      expect(live.get(contributed.id)).toMatchObject(contributed)
+
+      harness.suppressSourceChanges()
+      harness.truncate()
+      await flushPromises()
+      expect(live.get(contributed.id)).toMatchObject(contributed)
+
+      harness.publish([{ type: `delete`, key: 1, value: staleDelete }])
+      await flushPromises()
+      expect(live.get(contributed.id)).toMatchObject(contributed)
+
+      await harness.resolveReplay()
+      expect(live.get(contributed.id)).toBeUndefined()
+    }, [
+      {
+        resource: `held truncate replay`,
+        release: () => harness.settlePendingReplay(),
+      },
+      { resource: `live-query Collection`, release: () => cleanupLive?.() },
+      { resource: `source Collection`, release: () => source.cleanup() },
+    ])
+  },
+)
+
+it.each([`eager`, `off`] as const)(
+  `replaces the retained Effect source row after an ordered truncate (%s index)`,
+  async (autoIndex) => {
+    const harness = createOrderedSourceHarness(
+      `d2-effect-truncate-replacement-${autoIndex}`,
+      autoIndex,
+    )
+    const { contributed, replacement, source, staleDelete } = harness
+    const batches: Array<
+      Array<{
+        type: string
+        value: SourceRow
+        previousValue?: SourceRow
+      }>
+    > = []
+    let disposeEffect: (() => void | Promise<void>) | undefined
+    await runWithCleanup(async () => {
+      harness.initialize()
+      const effect = createEffect<SourceRow, number>({
+        query: (query) =>
+          query
+            .from({ row: source })
+            .orderBy(({ row }) => row.value)
+            .limit(1),
+        onBatch: (batch) => {
+          batches.push(batch)
+        },
+      })
+      disposeEffect = () => effect.dispose()
+      await flushPromises()
+      expect(batches).toHaveLength(1)
+      expect(batches[0]).toHaveLength(1)
+      expect(batches[0]![0]).toMatchObject({
+        type: `enter`,
+        key: 1,
+        value: contributed,
+      })
+      const publishedValue = batches[0]![0]!.value
+
+      harness.suppressSourceChanges()
+      harness.truncate()
+      await flushPromises()
+      expect(batches).toHaveLength(1)
+
+      harness.publish([
+        {
+          type: `update`,
+          key: 1,
+          previousValue: staleDelete,
+          value: replacement,
+        },
+      ])
+      await flushPromises()
+      expect(batches).toHaveLength(1)
+
+      await harness.resolveReplay()
+      expect(batches).toHaveLength(2)
+      expect(batches[1]).toHaveLength(1)
+      expect(batches[1]![0]).toMatchObject({
+        type: `update`,
+        key: 1,
+        value: replacement,
+      })
+      expect(batches[1]![0]!.previousValue).toBe(publishedValue)
+    }, [
+      {
+        resource: `held truncate replay`,
+        release: () => harness.settlePendingReplay(),
+      },
+      { resource: `Effect`, release: () => disposeEffect?.() },
+      { resource: `source Collection`, release: () => source.cleanup() },
+    ])
+  },
+)
+
+it.each([`eager`, `off`] as const)(
+  `replaces the retained live-query source row after ordered replay settles (%s index)`,
+  async (autoIndex) => {
+    const harness = createOrderedSourceHarness(
+      `d2-live-query-truncate-replacement-${autoIndex}`,
+      autoIndex,
+    )
+    const { contributed, replacement, source, staleDelete } = harness
+    const batches: Array<Array<ChangeMessage<SourceRow, SourceKey>>> = []
+    let unsubscribe: (() => void) | undefined
+    let cleanupLive: (() => Promise<void>) | undefined
+    await runWithCleanup(async () => {
+      harness.initialize()
+      const live = createLiveQueryCollection({
+        id: `d2-live-query-truncate-replacement-result`,
+        query: (query) =>
+          query
+            .from({ row: source })
+            .orderBy(({ row }) => row.value)
+            .limit(1),
+        startSync: true,
+      })
+      cleanupLive = () => live.cleanup()
+      await live.preload()
+      expect(live.get(contributed.id)).toMatchObject(contributed)
+      const publishedValue = live.get(contributed.id)
+      const subscription = live.subscribeChanges(
+        (changes) => batches.push(changes),
+        { includeInitialState: false },
+      )
+      unsubscribe = () => subscription.unsubscribe()
+
+      harness.suppressSourceChanges()
+      harness.truncate()
+      await flushPromises()
+      expect(batches).toEqual([])
+      expect(live.get(contributed.id)).toBe(publishedValue)
+
+      harness.publish([
+        {
+          type: `update`,
+          key: 1,
+          previousValue: staleDelete,
+          value: replacement,
+        },
+      ])
+      await flushPromises()
+      expect(batches).toEqual([])
+      expect(live.get(contributed.id)).toBe(publishedValue)
+
+      await harness.resolveReplay()
+      expect(batches).toHaveLength(1)
+      expect(batches[0]).toHaveLength(1)
+      expect(batches[0]![0]).toMatchObject({
+        type: `update`,
+        key: 1,
+        value: replacement,
+      })
+      expect(batches[0]![0]!.previousValue).toEqual(publishedValue)
+      expect(live.get(replacement.id)).toMatchObject(replacement)
+    }, [
+      {
+        resource: `held truncate replay`,
+        release: () => harness.settlePendingReplay(),
+      },
+      { resource: `live-query subscriber`, release: () => unsubscribe?.() },
+      { resource: `live-query Collection`, release: () => cleanupLive?.() },
+      { resource: `source Collection`, release: () => source.cleanup() },
+    ])
+  },
+)
+
+it.each([`eager`, `off`] as const)(
+  `retracts the previous graph contribution after a live-query restart (%s index)`,
+  async (autoIndex) => {
+    const harness = createOrderedSourceHarness(
+      `d2-live-query-graph-restart-${autoIndex}`,
+      autoIndex,
+    )
+    const { contributed, replacement, source, staleDelete } = harness
+    const batches: Array<Array<ChangeMessage<SourceRow, SourceKey>>> = []
+    let unsubscribe: (() => void) | undefined
+    let cleanupLive: (() => Promise<void>) | undefined
+    await runWithCleanup(async () => {
+      harness.initialize()
+      const live = createLiveQueryCollection({
+        id: `d2-live-query-graph-restart-result-${autoIndex}`,
+        query: (query) =>
+          query
+            .from({ row: source })
+            .orderBy(({ row }) => row.value)
+            .limit(1),
+        startSync: true,
+      })
+      cleanupLive = () => live.cleanup()
+      await live.preload()
+      expect(live.get(contributed.id)).toMatchObject(contributed)
+
+      await live.cleanup()
+      expect(live.status).toBe(`cleaned-up`)
+      await live.preload()
+      expect(live.get(contributed.id)).toMatchObject(contributed)
+      const restartedValue = live.get(contributed.id)
+      const subscription = live.subscribeChanges(
+        (changes) => batches.push(changes),
+        { includeInitialState: false },
+      )
+      unsubscribe = () => subscription.unsubscribe()
+
+      harness.publish([
+        {
+          type: `update`,
+          key: contributed.id,
+          previousValue: staleDelete,
+          value: replacement,
+        },
+      ])
+      await flushPromises()
+      expect(batches).toHaveLength(1)
+      expect(batches[0]).toHaveLength(1)
+      expect(batches[0]![0]).toMatchObject({
+        type: `update`,
+        key: contributed.id,
+        value: replacement,
+      })
+      expect(batches[0]![0]!.previousValue).toEqual(restartedValue)
+      expect(live.get(replacement.id)).toMatchObject(replacement)
+    }, [
+      { resource: `live-query subscriber`, release: () => unsubscribe?.() },
+      { resource: `live-query Collection`, release: () => cleanupLive?.() },
+      { resource: `source Collection`, release: () => source.cleanup() },
+    ])
+  },
+)
+
+it(`keeps revision and value in weighted row identity`, () => {
+  const key = `row`
+  const base = { id: 1, revision: 1, value: 1 }
+  const differentRevision = { id: 1, revision: 2, value: 1 }
+  const differentValue = { id: 1, revision: 1, value: 2 }
+  const relation = new Map<string, number>()
+
+  addWeight(relation, key, base, 1)
+  addWeight(relation, key, differentRevision, 1)
+  addWeight(relation, key, differentValue, 1)
+
+  expect(relation).toEqual(
+    new Map([
+      [expectedWeightedRowIdentity(key, base), 1],
+      [expectedWeightedRowIdentity(key, differentRevision), 1],
+      [expectedWeightedRowIdentity(key, differentValue), 1],
+    ]),
+  )
+})
diff --git a/packages/db/tests/db-client-hydration-authority-oracle.test.ts b/packages/db/tests/db-client-hydration-authority-oracle.test.ts
index 748e131956..1b6cffcced 100644
--- a/packages/db/tests/db-client-hydration-authority-oracle.test.ts
+++ b/packages/db/tests/db-client-hydration-authority-oracle.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { DbClient, collectionOptions } from '../src'
+import { declareOracle } from './oracle-declaration.js'
 import type { Collection, SyncConfig } from '../src'
 import type { ChangeMessage } from '../src/types'
 
@@ -267,6 +268,8 @@ async function runHistory(
     })
 }
 
+declareOracle({ check: [runHistory], model: [referenceRows] })
+
 describe(`DbClient hydration authority oracle`, () => {
   const cases: Array<{
     decisions: ReadonlyArray<AdapterDecision>
@@ -335,12 +338,51 @@ describe(`DbClient hydration authority oracle`, () => {
  * key after the chunk, and persisting with a source transaction open before
  * the chunk.
  */
+type Interleaving = {
+  persisting: boolean
+  source: `none` | `open-before-chunk` | `after-chunk`
+  sourceKey: `seed` | `other`
+}
+
+// Reference: the seed row, then the source row; a later write to the same
+// key wins.
+function expectedInterleavedRows({
+  source,
+  sourceKey,
+}: Interleaving): Array<Row> {
+  const rows = new Map<string, Row>([[`seed`, { id: `seed`, name: `seed` }]])
+  if (source !== `none`) rows.set(sourceKey, { id: sourceKey, name: `source` })
+  return [...rows.values()].sort((a, b) => a.id.localeCompare(b.id))
+}
+
+// The model: an accepted reader sees the source's staged write for the seed
+// key only when that transaction was opened before the chunk and names it.
+function expectedAcceptedSeedRow(history: Interleaving): Row {
+  return history.source === `open-before-chunk` && history.sourceKey === `seed`
+    ? { id: `seed`, name: `source` }
+    : { id: `seed`, name: `seed` }
+}
+
+// The check: accepted readers and the settled publication match the model.
+function expectAcceptedSeedRow(accepted: unknown, history: Interleaving): void {
+  expect(accepted, `accepted readers see the chunk`).toEqual(
+    expectedAcceptedSeedRow(history),
+  )
+}
+
+function expectInterleavedRows(
+  rows: ReadonlyArray<Row>,
+  history: Interleaving,
+): void {
+  expect(rows).toEqual(expectedInterleavedRows(history))
+}
+
+declareOracle({
+  check: [expectAcceptedSeedRow, expectInterleavedRows],
+  model: [expectedInterleavedRows, expectedAcceptedSeedRow],
+})
+
 describe(`DbClient hydration interleaving oracle`, () => {
-  type Interleaving = {
-    persisting: boolean
-    source: `none` | `open-before-chunk` | `after-chunk`
-    sourceKey: `seed` | `other`
-  }
   const interleavings: Array<Interleaving> = [false, true].flatMap(
     (persisting) =>
       ([`none`, `open-before-chunk`, `after-chunk`] as const).flatMap(
@@ -353,15 +395,6 @@ describe(`DbClient hydration interleaving oracle`, () => {
       ),
   )
 
-  // Reference: the seed row, then the source row; a later write to the same
-  // key wins.
-  const expectedRows = ({ source, sourceKey }: Interleaving) => {
-    const rows = new Map<string, Row>([[`seed`, { id: `seed`, name: `seed` }]])
-    if (source !== `none`)
-      rows.set(sourceKey, { id: sourceKey, name: `source` })
-    return [...rows.values()].sort((a, b) => a.id.localeCompare(b.id))
-  }
-
   it.each(interleavings)(
     `accepts a chunk with persisting=$persisting and source $source writing $sourceKey`,
     async (history) => {
@@ -405,13 +438,9 @@ describe(`DbClient hydration interleaving oracle`, () => {
         })
         // The accepted-row view also includes an open transaction's staged
         // writes, which follow the chunk in commit order.
-        expect(
+        expectAcceptedSeedRow(
           collection._state.getAcceptedSyncedRow(`seed`),
-          `accepted readers see the chunk`,
-        ).toEqual(
-          history.source === `open-before-chunk` && history.sourceKey === `seed`
-            ? { id: `seed`, name: `source` }
-            : { id: `seed`, name: `seed` },
+          history,
         )
         if (history.source === `after-chunk`) {
           sync.begin()
@@ -423,9 +452,10 @@ describe(`DbClient hydration interleaving oracle`, () => {
         }
         release()
         await mutation?.isPersisted.promise.catch(() => undefined)
-        expect(
+        expectInterleavedRows(
           observedRows(collection.values()).filter((row) => row.id !== `local`),
-        ).toEqual(expectedRows(history))
+          history,
+        )
       } finally {
         release()
         await collection.cleanup()
diff --git a/packages/db/tests/db-client-preload-identity-oracle.test.ts b/packages/db/tests/db-client-preload-identity.test.ts
similarity index 100%
rename from packages/db/tests/db-client-preload-identity-oracle.test.ts
rename to packages/db/tests/db-client-preload-identity.test.ts
diff --git a/packages/db/tests/deep-equals-support.ts b/packages/db/tests/deep-equals-support.ts
new file mode 100644
index 0000000000..9d635f630a
--- /dev/null
+++ b/packages/db/tests/deep-equals-support.ts
@@ -0,0 +1,120 @@
+/**
+ * Generators and assertion helpers shared by the deepEquals oracle and its
+ * ordinary tests: the utilsProperty registration, arbitrary value shapes, and
+ * the equality, ring, and distinct-type checks. The law lives in
+ * utils-oracle.property.test.ts.
+ */
+import { expect } from 'vitest'
+import { deepEquals } from '../src/utils'
+
+export const edgeCarriers = [`object`, `array`, `map`, `symbol`] as const
+
+export type EdgeCarrier = (typeof edgeCarriers)[number]
+
+export type EqualityNode = { value: number; next?: unknown }
+
+// Construct corresponding rings, not an implementation of deep equality.
+// Every node is reachable; replacing one numeric payload must be observable.
+// Map keys/symbol keys are shared tokens, while all structural nodes are fresh.
+export function equalityRing(
+  cells: ReadonlyArray<{ value: number; carrier: EdgeCarrier }>,
+  keys: ReadonlyArray<symbol>,
+): EqualityNode {
+  const nodes: Array<EqualityNode> = cells.map(({ value }) => ({ value }))
+  for (const [index, cell] of cells.entries()) {
+    const target = nodes[(index + 1) % nodes.length]!
+    switch (cell.carrier) {
+      case `object`:
+        nodes[index]!.next = { target }
+        break
+      case `array`:
+        nodes[index]!.next = [target]
+        break
+      case `map`:
+        nodes[index]!.next = new Map([[keys[index]!, target]])
+        break
+      case `symbol`:
+        nodes[index]!.next = { [keys[index]!]: target }
+        break
+    }
+  }
+  return nodes[0]!
+}
+
+export function expectEqualityPair(
+  a: unknown,
+  b: unknown,
+  expected: boolean,
+  equal: (a: unknown, b: unknown) => boolean = deepEquals,
+): void {
+  expect(equal(a, b), `forward equality`).toBe(expected)
+  expect(equal(b, a), `reverse equality`).toBe(expected)
+}
+
+export function expectCopyAndChanged(
+  original: unknown,
+  copy: unknown,
+  changed: unknown,
+  equal: (a: unknown, b: unknown) => boolean = deepEquals,
+): void {
+  expectEqualityPair(original, copy, true, equal)
+  expectEqualityPair(original, changed, false, equal)
+}
+
+export function expectRingLaw(
+  cells: ReadonlyArray<{ value: number; carrier: EdgeCarrier }>,
+  equal: (a: unknown, b: unknown) => boolean = deepEquals,
+): void {
+  expect(cells.length).toBeGreaterThan(0)
+  const keys = cells.map((_, index) => Symbol(`edge-${index}`))
+  const original = equalityRing(cells, keys)
+  const copy = equalityRing(cells, keys)
+  expect(original).not.toBe(copy)
+  expectEqualityPair(original, copy, true, equal)
+  // Check every reachable payload, including nodes past a mixed-container edge.
+  for (let changed = 0; changed < cells.length; changed++) {
+    const different = equalityRing(
+      cells.map((cell, index) => ({
+        ...cell,
+        value: cell.value + (index === changed ? 1 : 0),
+      })),
+      keys,
+    )
+    expectEqualityPair(original, different, false, equal)
+  }
+}
+
+export function assertExtraProperty(
+  {
+    original,
+    key,
+    value,
+  }: {
+    original: Record<string, number>
+    key: string
+    value: number
+  },
+  equal: (a: unknown, b: unknown) => boolean,
+): void {
+  expect(key in original).toBe(false)
+  const extended = { ...original, [key]: value }
+  expect(Object.keys(extended)).toHaveLength(Object.keys(original).length + 1)
+  expect(equal(original, { ...original }), `property copy must be equal`).toBe(
+    true,
+  )
+  expect(equal(original, extended), `extra property must be unequal`).toBe(
+    false,
+  )
+  expect(equal(extended, original), `extra property must be unequal`).toBe(
+    false,
+  )
+}
+
+export function assertDistinctTypes(
+  a: unknown,
+  b: unknown,
+  equal: (a: unknown, b: unknown) => boolean,
+): void {
+  expect(equal(a, b), `distinct types must be unequal (forward)`).toBe(false)
+  expect(equal(b, a), `distinct types must be unequal (reverse)`).toBe(false)
+}
diff --git a/packages/db/tests/duration-query-equality-oracle.test.ts b/packages/db/tests/duration-query-equality-oracle.test.ts
index 1651188f88..02421aeddb 100644
--- a/packages/db/tests/duration-query-equality-oracle.test.ts
+++ b/packages/db/tests/duration-query-equality-oracle.test.ts
@@ -24,6 +24,7 @@ import { BTreeIndex } from '../src/indexes/btree-index.js'
 import { eq } from '../src/query/builder/functions.js'
 import { PropRef } from '../src/query/ir.js'
 import { mockSyncCollectionOptions } from './utils.js'
+import { declareOracle } from './oracle-declaration.js'
 
 const fields = [
   `years`,
@@ -92,6 +93,21 @@ function modelKeys({ stored, probe }: Case): Set<string> {
   return new Set(modelEqual(stored, probe) ? [`row`] : [])
 }
 
+// The check: a public or direct read returns exactly the model's key set,
+// in the same representation, at the read that was made.
+function expectExactKeys(
+  actual: unknown,
+  expected: ReadonlySet<string> | ReadonlyArray<string>,
+  label: string,
+): void {
+  expect(actual, label).toEqual(expected)
+}
+
+declareOracle({
+  check: [expectExactKeys],
+  model: [modelEqual, modelKeys],
+})
+
 const indexTypes = [
   [`BasicIndex`, BasicIndex],
   [`BTreeIndex`, BTreeIndex],
@@ -136,8 +152,10 @@ it.each(indexTypes)(
     for (const { name, stored, probe } of cases) {
       const index = new IndexType(1, new PropRef([`value`]))
       index.add(`row`, { value: stored })
-      expect(index.lookup(`eq`, probe), name).toEqual(
+      expectExactKeys(
+        index.lookup(`eq`, probe),
         modelKeys({ name, stored, probe }),
+        name,
       )
     }
   },
@@ -162,10 +180,10 @@ it.each(indexTypes)(
         const expected = [...modelKeys({ name, stored, probe })]
         const readKeys = () =>
           source.currentStateAsChanges({ where })!.map((change) => change.key)
-        expect(readKeys(), `${name}: scan`).toEqual(expected)
+        expectExactKeys(readKeys(), expected, `${name}: scan`)
         const index = source.createIndex((row) => row.value)
         const lookup = vi.spyOn(index, `lookup`)
-        expect(readKeys(), `${name}: indexed`).toEqual(expected)
+        expectExactKeys(readKeys(), expected, `${name}: indexed`)
         expect(lookup, `${name}: index path`).toHaveBeenCalled()
       } finally {
         await source.cleanup()
diff --git a/packages/db/tests/effect-disposal-oracle.test.ts b/packages/db/tests/effect-disposal-oracle.test.ts
index f88a213e72..1a523e3158 100644
--- a/packages/db/tests/effect-disposal-oracle.test.ts
+++ b/packages/db/tests/effect-disposal-oracle.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { createCollection, createEffect } from '../src/index.js'
 import { createDeferred } from '../src/deferred.js'
 import { captureMicrotaskErrors, flushPromises } from './utils.js'
+import { declareOracle } from './oracle-declaration.js'
 
 /**
  * # What does concurrent effect disposal mean?
@@ -40,18 +41,51 @@ const scenarios = ([`abort`, `release`] as const).flatMap((reentry) =>
   ),
 )
 
+// The model: a release that throws reports exactly its thrown value, once.
+// A success reports nothing. Callers never see the failure.
+function expectedUncaughtReports(
+  outcome: (typeof scenarios)[number][`outcome`],
+  failure: Error,
+): Array<unknown> {
+  return outcome === `error`
+    ? [failure]
+    : outcome === `undefined`
+      ? [undefined]
+      : []
+}
+
+// The model: every caller of one attempt fulfills with the same outcome.
+function expectCallerOutcomes(
+  observed: ReadonlyArray<PromiseSettledResult<void>>,
+): void {
+  for (const result of observed) {
+    expect(result).toEqual({ status: `fulfilled`, value: undefined })
+  }
+}
+
+// The model: each reported value is the one the release threw, in order.
+function expectUncaughtReports(
+  errors: ReadonlyArray<unknown>,
+  reported: ReadonlyArray<unknown>,
+): void {
+  expect(errors).toHaveLength(reported.length)
+  errors.forEach((error, index) =>
+    expect(Object.is(error, reported[index])).toBe(true),
+  )
+}
+
+declareOracle({
+  check: [expectCallerOutcomes, expectUncaughtReports],
+  model: [expectedUncaughtReports],
+})
+
 describe(`Effect disposal outcome oracle`, () => {
   it.each(scenarios)(
     `joins all callers to one attempt: %j`,
     async ({ reentry, pendingHandler, outcome }) => {
       const failure = new Error(`release failed`)
       // The thrown value the model expects to see reported, if any.
-      const reported =
-        outcome === `error`
-          ? [failure]
-          : outcome === `undefined`
-            ? [undefined]
-            : []
+      const reported = expectedUncaughtReports(outcome, failure)
       const uncaught = captureMicrotaskErrors()
       const handler = createDeferred<void>()
       let nested: Promise<void> | undefined
@@ -127,14 +161,9 @@ describe(`Effect disposal outcome oracle`, () => {
         }
         handler.resolve()
         const observed = await results
-        for (const result of observed) {
-          expect(result).toEqual({ status: `fulfilled`, value: undefined })
-        }
+        expectCallerOutcomes(observed)
         await flushPromises()
-        expect(uncaught.errors).toHaveLength(reported.length)
-        uncaught.errors.forEach((error, index) =>
-          expect(Object.is(error, reported[index])).toBe(true),
-        )
+        expectUncaughtReports(uncaught.errors, reported)
         // A finished attempt does not make the acquisition lease retryable.
         await effect.dispose()
         await flushPromises()
diff --git a/packages/db/tests/error-sites-oracle.ts b/packages/db/tests/error-sites-oracle.ts
index 5573af2c6d..fc83b9d288 100644
--- a/packages/db/tests/error-sites-oracle.ts
+++ b/packages/db/tests/error-sites-oracle.ts
@@ -31,6 +31,7 @@
 import { readFileSync, readdirSync } from 'node:fs'
 import { dirname, join, relative } from 'node:path'
 import ts from 'typescript'
+import { declareOracle } from './oracle-declaration.js'
 
 export type CodedSite = {
   file: string
@@ -661,3 +662,5 @@ export function findErrorSites(
   }
   return { coded, plain, classGuards, developmentOnly }
 }
+
+declareOracle({ model: [findErrorSites] })
diff --git a/packages/db/tests/flat-change-tracking-fixture.ts b/packages/db/tests/flat-change-tracking-fixture.ts
new file mode 100644
index 0000000000..835530fba0
--- /dev/null
+++ b/packages/db/tests/flat-change-tracking-fixture.ts
@@ -0,0 +1,44 @@
+/**
+ * Row shape shared by flat-change-tracking-oracle.property.test.ts and
+ * flat-change-tracking.test.ts.
+ */
+export type Row = Record<string, unknown>
+
+export type RowShape = {
+  fields: Array<unknown>
+  nullPrototype: boolean
+  frozen: boolean
+  hidden: unknown
+}
+
+export const MISSING = Symbol(`missing`)
+
+export const plainRow = (rowFields: Array<unknown>, nullPrototype = false) => ({
+  fields: rowFields,
+  nullPrototype,
+  frozen: false,
+  hidden: MISSING,
+})
+
+export const FRESH_OBJECT = Symbol(`fresh object`)
+
+export function buildRow(shape: RowShape): Row {
+  const row: Row = shape.nullPrototype ? Object.create(null) : {}
+  shape.fields.forEach((value, index) => {
+    if (value !== MISSING) row[fields[index]!] = value
+  })
+  if (shape.hidden !== MISSING) {
+    Object.defineProperty(row, `h`, {
+      value: domainValue(shape.hidden),
+      enumerable: false,
+      writable: true,
+      configurable: true,
+    })
+  }
+  return shape.frozen ? Object.freeze(row) : row
+}
+
+export const fields = [`a`, `b`, `c`] as const
+
+export const domainValue = (value: unknown) =>
+  value === FRESH_OBJECT ? { nested: 1 } : value
diff --git a/packages/db/tests/flat-change-tracking-oracle.property.test.ts b/packages/db/tests/flat-change-tracking-oracle.property.test.ts
index 150f6c98c8..85f693db6a 100644
--- a/packages/db/tests/flat-change-tracking-oracle.property.test.ts
+++ b/packages/db/tests/flat-change-tracking-oracle.property.test.ts
@@ -83,11 +83,19 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
+import {
+  FRESH_OBJECT,
+  MISSING,
+  buildRow,
+  domainValue,
+  fields,
+  plainRow,
+} from './flat-change-tracking-fixture.js'
+import type { Row, RowShape } from './flat-change-tracking-fixture.js'
 
 const property = `flat-change-tracking.equivalence`
 
-const MISSING = Symbol(`missing`)
-const FRESH_OBJECT = Symbol(`fresh object`)
 const fn = () => 1
 const values: ReadonlyArray<unknown> = [
   0,
@@ -102,8 +110,6 @@ const values: ReadonlyArray<unknown> = [
   undefined,
   fn,
 ]
-const fields = [`a`, `b`, `c`] as const
-type Row = Record<string, unknown>
 type Operation =
   | { kind: `set`; field: string; value: unknown }
   | { kind: `revert`; field: string }
@@ -119,12 +125,6 @@ type Operation =
   | { kind: `store-draft`; field: string; row: number }
   // Writes the opposite-signed zero over every field the row holds as a zero.
   | { kind: `flip-zeros` }
-type RowShape = {
-  fields: Array<unknown>
-  nullPrototype: boolean
-  frozen: boolean
-  hidden: unknown
-}
 type History = {
   rows: Array<RowShape>
   operations: Array<Array<Operation>>
@@ -190,9 +190,6 @@ function expectedChanges(
   })
 }
 
-const domainValue = (value: unknown) =>
-  value === FRESH_OBJECT ? { nested: 1 } : value
-
 // Shared by the model and the driver; `drafts` are the callback's drafts.
 function applyOperation(
   draft: Row,
@@ -260,22 +257,6 @@ function normalize(value: unknown, copies = new Map<object, Row>()): unknown {
   return copy
 }
 
-function buildRow(shape: RowShape): Row {
-  const row: Row = shape.nullPrototype ? Object.create(null) : {}
-  shape.fields.forEach((value, index) => {
-    if (value !== MISSING) row[fields[index]!] = value
-  })
-  if (shape.hidden !== MISSING) {
-    Object.defineProperty(row, `h`, {
-      value: domainValue(shape.hidden),
-      enumerable: false,
-      writable: true,
-      configurable: true,
-    })
-  }
-  return shape.frozen ? Object.freeze(row) : row
-}
-
 // Captures a row's own properties, including non-enumerable ones.
 const rowState = (row: Row) => Object.getOwnPropertyDescriptors(row)
 
@@ -390,69 +371,9 @@ const historyArbitrary: fc.Arbitrary<History> = fc
     }),
   )
 
-const plainRow = (rowFields: Array<unknown>, nullPrototype = false) => ({
-  fields: rowFields,
-  nullPrototype,
-  frozen: false,
-  hidden: MISSING,
-})
-
-const firstDraft = (draft: Array<Row> | Row) =>
-  Array.isArray(draft) ? draft[0]! : draft
 // Each witness pins a shape the trackers once disagreed on to the change
 // set both must now report: defining a field acts as assigning it, and a
 // non-enumerable field is not row data unless the callback writes it.
-const descriptorLaws: ReadonlyArray<{
-  name: string
-  shape: RowShape
-  callback: (draft: Array<Row> | Row) => void
-  expected: Row
-}> = [
-  {
-    name: `an enumerable accessor defined in the callback reports its value`,
-    shape: plainRow([1, MISSING, MISSING]),
-    callback: (draft) => {
-      Object.defineProperty(firstDraft(draft), `g`, {
-        get: () => 7,
-        enumerable: true,
-        configurable: true,
-      })
-    },
-    expected: { g: 7 },
-  },
-  {
-    name: `defining a field with its own value is not a change`,
-    shape: plainRow([1, MISSING, MISSING]),
-    callback: (draft) => {
-      Object.defineProperty(firstDraft(draft), `a`, {
-        value: 1,
-        enumerable: true,
-        writable: true,
-        configurable: true,
-      })
-    },
-    expected: {},
-  },
-  {
-    name: `an equal object written to a non-enumerable object field is not a change`,
-    shape: { ...plainRow([1, MISSING, MISSING]), hidden: FRESH_OBJECT },
-    callback: (draft) => {
-      firstDraft(draft).h = { nested: 1 }
-    },
-    expected: {},
-  },
-  {
-    name: `a non-enumerable field written and then deleted is not a change`,
-    shape: { ...plainRow([1, MISSING, MISSING]), hidden: `x` },
-    callback: (draft) => {
-      firstDraft(draft).h = `y`
-      delete firstDraft(draft).h
-    },
-    expected: {},
-  },
-]
-
-// Each history isolates one place a plausible flat diff goes wrong.
 const pinnedHistories: ReadonlyArray<{ name: string; history: History }> = [
   {
     name: `a changed field defined back to its own value is not a change`,
@@ -659,56 +580,14 @@ function runHistory(history: History): void {
   expect(normalize(proxy), `proxy vs model`).toStrictEqual(normalize(model))
 }
 
+declareOracle({ check: [runHistory], model: [expectedChanges] })
+
 describe(`flat change tracking oracle`, () => {
   if (!oracleReplayRequested()) {
     for (const { name, history } of pinnedHistories) {
       it(`matches the draft proxy when ${name}`, () => runHistory(history))
     }
 
-    it(`falls back to the proxy for rows that are not flat`, () => {
-      const callback = () => {}
-      for (const row of [
-        { a: { nested: 1 } },
-        { a: [1] },
-        { a: new Date(0) },
-        { [Symbol(`s`)]: 1 },
-        new (class Row {
-          a = 1
-        })(),
-        // A getter can return a new value on each read, so only the proxy,
-        // which reads it once, reports a stable change set.
-        Object.defineProperty({}, `a`, { get: () => 1, enumerable: true }),
-      ]) {
-        expect(withFlatChangeTracking([row], callback, true)).toBeUndefined()
-      }
-    })
-
-    it(`detaches an assigned object from later mutation`, () => {
-      const assigned = { nested: 1 }
-      const [changes] = withFlatChangeTracking(
-        [{ a: 1 }],
-        (drafts) => {
-          ;(drafts as Array<Row>)[0]!.a = assigned
-        },
-        true,
-      )!
-      assigned.nested = 2
-      expect(changes).toStrictEqual({ a: { nested: 1 } })
-    })
-
-    for (const { name, shape, callback, expected } of descriptorLaws) {
-      it(`reports the same change set when ${name}`, () => {
-        expect(
-          withFlatChangeTracking([buildRow(shape)], callback, false),
-          `flat`,
-        ).toStrictEqual([expected])
-        expect(
-          withChangeTracking(buildRow(shape), callback),
-          `proxy`,
-        ).toStrictEqual(expected)
-      })
-    }
-
     fcTest.prop([historyArbitrary], {
       seed: 44_502_101,
       numRuns: oracleRuns(200),
diff --git a/packages/db/tests/flat-change-tracking.test.ts b/packages/db/tests/flat-change-tracking.test.ts
new file mode 100644
index 0000000000..2282be93fd
--- /dev/null
+++ b/packages/db/tests/flat-change-tracking.test.ts
@@ -0,0 +1,117 @@
+/**
+ * Ordinary flat change-tracking regressions: fallback to the proxy, detached
+ * assignments, and descriptor-shaped change sets. The law and its model are
+ * owned by flat-change-tracking-oracle.property.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { withChangeTracking, withFlatChangeTracking } from '../src/proxy.js'
+import {
+  FRESH_OBJECT,
+  MISSING,
+  buildRow,
+  plainRow,
+} from './flat-change-tracking-fixture.js'
+import type { Row, RowShape } from './flat-change-tracking-fixture.js'
+
+const firstDraft = (draft: Array<Row> | Row) =>
+  Array.isArray(draft) ? draft[0]! : draft
+
+const descriptorLaws: ReadonlyArray<{
+  name: string
+  shape: RowShape
+  callback: (draft: Array<Row> | Row) => void
+  expected: Row
+}> = [
+  {
+    name: `an enumerable accessor defined in the callback reports its value`,
+    shape: plainRow([1, MISSING, MISSING]),
+    callback: (draft) => {
+      Object.defineProperty(firstDraft(draft), `g`, {
+        get: () => 7,
+        enumerable: true,
+        configurable: true,
+      })
+    },
+    expected: { g: 7 },
+  },
+  {
+    name: `defining a field with its own value is not a change`,
+    shape: plainRow([1, MISSING, MISSING]),
+    callback: (draft) => {
+      Object.defineProperty(firstDraft(draft), `a`, {
+        value: 1,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      })
+    },
+    expected: {},
+  },
+  {
+    name: `an equal object written to a non-enumerable object field is not a change`,
+    shape: { ...plainRow([1, MISSING, MISSING]), hidden: FRESH_OBJECT },
+    callback: (draft) => {
+      firstDraft(draft).h = { nested: 1 }
+    },
+    expected: {},
+  },
+  {
+    name: `a non-enumerable field written and then deleted is not a change`,
+    shape: { ...plainRow([1, MISSING, MISSING]), hidden: `x` },
+    callback: (draft) => {
+      firstDraft(draft).h = `y`
+      delete firstDraft(draft).h
+    },
+    expected: {},
+  },
+]
+
+// Each history isolates one place a plausible flat diff goes wrong.
+
+describe(`flat change tracking oracle`, () => {
+  it(`falls back to the proxy for rows that are not flat`, () => {
+    const callback = () => {}
+    for (const row of [
+      { a: { nested: 1 } },
+      { a: [1] },
+      { a: new Date(0) },
+      { [Symbol(`s`)]: 1 },
+      new (class Row {
+        a = 1
+      })(),
+      // A getter can return a new value on each read, so only the proxy,
+      // which reads it once, reports a stable change set.
+      Object.defineProperty({}, `a`, { get: () => 1, enumerable: true }),
+    ]) {
+      expect(withFlatChangeTracking([row], callback, true)).toBeUndefined()
+    }
+  })
+
+  it(`detaches an assigned object from later mutation`, () => {
+    const assigned = { nested: 1 }
+    const [changes] = withFlatChangeTracking(
+      [{ a: 1 }],
+      (drafts) => {
+        ;(drafts as Array<Row>)[0]!.a = assigned
+      },
+      true,
+    )!
+    assigned.nested = 2
+    expect(changes).toStrictEqual({ a: { nested: 1 } })
+  })
+})
+
+describe(`flat change tracking oracle`, () => {
+  for (const { name, shape, callback, expected } of descriptorLaws) {
+    it(`reports the same change set when ${name}`, () => {
+      expect(
+        withFlatChangeTracking([buildRow(shape)], callback, false),
+        `flat`,
+      ).toStrictEqual([expected])
+      expect(
+        withChangeTracking(buildRow(shape), callback),
+        `proxy`,
+      ).toStrictEqual(expected)
+    })
+  }
+})
diff --git a/packages/db/tests/index-suggestion-oracle.test.ts b/packages/db/tests/index-suggestion-oracle.test.ts
index c6a0ae7408..0f7b5e5bfc 100644
--- a/packages/db/tests/index-suggestion-oracle.test.ts
+++ b/packages/db/tests/index-suggestion-oracle.test.ts
@@ -22,6 +22,7 @@ import {
 import { eq } from '../src/query/builder/functions.js'
 import { createLiveQueryCollection } from '../src/query/live-query-collection.js'
 import { mockSyncCollectionOptions, withOracleCleanup } from './utils.js'
+import { declareOracle } from './oracle-declaration.js'
 import type { IndexSuggestion } from '../src/indexes/index-registry.js'
 
 type Row = { id: number; url: string }
@@ -40,6 +41,41 @@ function expectedSuggestions(
   return enabled && size > 1000 && mode !== `eager` && index !== `url` ? 1 : 0
 }
 
+// The check: a size suggestion appears exactly when the model predicts one, and
+// names the Collection, the queried field, and its size.
+function expectSizeSuggestionOutcome(
+  sizeSuggestions: ReadonlyArray<IndexSuggestion>,
+  expected: number,
+  collectionId: string,
+  size: number,
+): void {
+  expect(sizeSuggestions).toHaveLength(expected)
+  if (expected) {
+    expect(sizeSuggestions[0]).toMatchObject({
+      collectionId,
+      fieldPath: [`url`],
+      collectionSize: size,
+    })
+  }
+}
+
+// The model: an eager or indexed field leaves one index; otherwise none.
+function expectedIndexCount(
+  mode: `off` | `eager` | undefined,
+  index: `none` | `url` | `id`,
+): number {
+  return mode === `eager` || index !== `none` ? 1 : 0
+}
+
+declareOracle({
+  check: [expectSizeSuggestionOutcome, expectOrderedIndexMessages],
+  model: [
+    expectedSuggestions,
+    expectedIndexCount,
+    expectedOrderedIndexDiagnostic,
+  ],
+})
+
 describe(`collection-size index suggestions`, () => {
   for (const scenario of [
     { mode: `off`, size: 1101, index: `none`, enabled: true },
@@ -97,16 +133,14 @@ describe(`collection-size index suggestions`, () => {
           scenario.index,
           scenario.enabled,
         )
-        expect(sizeSuggestions).toHaveLength(expected)
-        if (expected) {
-          expect(sizeSuggestions[0]).toMatchObject({
-            collectionId: source.id,
-            fieldPath: [`url`],
-            collectionSize: scenario.size,
-          })
-        }
+        expectSizeSuggestionOutcome(
+          sizeSuggestions,
+          expected,
+          source.id,
+          scenario.size,
+        )
         expect(source.indexes.size).toBe(
-          scenario.mode === `eager` || scenario.index !== `none` ? 1 : 0,
+          expectedIndexCount(scenario.mode, scenario.index),
         )
       } catch (error) {
         primaryFailure = { error }
@@ -177,6 +211,36 @@ function expectedOrderedIndexDiagnostic(
   return `ordered-capability`
 }
 
+// The check: the warnings match the diagnostic the model predicts, and name
+// the cause that remains after every candidate is considered.
+function expectOrderedIndexMessages(
+  messages: ReadonlyArray<string>,
+  expected: OrderedIndexDiagnostic,
+): void {
+  expect(messages).toHaveLength(expected === `none` ? 0 : 1)
+  if (expected === `missing-field`) {
+    expect(messages[0]).toContain(`requires an index on "name"`)
+  }
+  if (expected === `compare-options`) {
+    expect(messages[0]).toContain(
+      `found an index on "name", but none uses the query's compareOptions`,
+    )
+    // Direction completes the copyable options object, but an index in
+    // the other direction can be read in reverse.
+    expect(messages[0]).toContain(`direction: "asc"`)
+    expect(messages[0]).toContain(`nulls: "last"`)
+    expect(messages[0]).toContain(`stringSort: "locale"`)
+    expect(messages[0]).toContain(`importing BasicIndex`)
+    expect(messages[0]).toContain(`The index direction may differ.`)
+    expect(messages[0]).toContain(`options: { compareOptions:`)
+  }
+  if (expected === `ordered-capability`) {
+    expect(messages[0]).toContain(
+      `found an index on "name" with matching compareOptions, but none supports ordered lazy loading`,
+    )
+  }
+}
+
 describe(`bounded orderBy index diagnostics`, () => {
   const scenarios: ReadonlyArray<{
     name: string
@@ -302,28 +366,7 @@ describe(`bounded orderBy index diagnostics`, () => {
               message.includes(`orderBy with limit`),
           )
         const expected = expectedOrderedIndexDiagnostic(scenario.candidates)
-        expect(messages).toHaveLength(expected === `none` ? 0 : 1)
-        if (expected === `missing-field`) {
-          expect(messages[0]).toContain(`requires an index on "name"`)
-        }
-        if (expected === `compare-options`) {
-          expect(messages[0]).toContain(
-            `found an index on "name", but none uses the query's compareOptions`,
-          )
-          // Direction completes the copyable options object, but an index in
-          // the other direction can be read in reverse.
-          expect(messages[0]).toContain(`direction: "asc"`)
-          expect(messages[0]).toContain(`nulls: "last"`)
-          expect(messages[0]).toContain(`stringSort: "locale"`)
-          expect(messages[0]).toContain(`importing BasicIndex`)
-          expect(messages[0]).toContain(`The index direction may differ.`)
-          expect(messages[0]).toContain(`options: { compareOptions:`)
-        }
-        if (expected === `ordered-capability`) {
-          expect(messages[0]).toContain(
-            `found an index on "name" with matching compareOptions, but none supports ordered lazy loading`,
-          )
-        }
+        expectOrderedIndexMessages(messages, expected)
       }, [
         () => warning.mockRestore(),
         () => query?.cleanup(),
@@ -332,230 +375,6 @@ describe(`bounded orderBy index diagnostics`, () => {
     })
   }
 
-  test.each([false, true])(
-    `does not inspect cyclic locale options when field index presence is %s`,
-    async (hasFieldIndex) => {
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      const localeOptions: Record<string, unknown> = {}
-      localeOptions.self = localeOptions
-      const source = createCollection(
-        mockSyncCollectionOptions<{ id: number; name: string }>({
-          id: `cyclic-index-diagnostic-${hasFieldIndex}`,
-          getKey: (row) => row.id,
-          initialData: [{ id: 1, name: `Alice` }],
-          autoIndex: `off`,
-        }),
-      )
-      let query: ReturnType<typeof createLiveQueryCollection> | undefined
-      await withOracleCleanup(async () => {
-        await source.stateWhenReady()
-        if (hasFieldIndex) {
-          source.createIndex((row) => row.name, { indexType: BasicIndex })
-        }
-
-        expect(() => {
-          query = createLiveQueryCollection((q) =>
-            q
-              .from({ row: source })
-              .orderBy(({ row }) => row.name, {
-                direction: `asc`,
-                nulls: `last`,
-                stringSort: `locale`,
-                localeOptions,
-              })
-              .limit(1),
-          )
-        }).not.toThrow()
-        await query!.preload()
-        expect(query!.toArray.map((row) => row.name)).toEqual([`Alice`])
-      }, [
-        () => warning.mockRestore(),
-        () => query?.cleanup(),
-        () => source.cleanup(),
-      ])
-    },
-  )
-
-  test(`explains that a custom index must reuse the comparator reference`, async () => {
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const compare = (a: string, b: string) => a.length - b.length
-    const source = createCollection(
-      mockSyncCollectionOptions<{ id: number; name: string }>({
-        id: `custom-compare-index-diagnostic`,
-        getKey: (row) => row.id,
-        initialData: [{ id: 1, name: `Alice` }],
-        autoIndex: `off`,
-      }),
-    )
-    let query: ReturnType<typeof createLiveQueryCollection> | undefined
-    await withOracleCleanup(async () => {
-      await source.stateWhenReady()
-      source.createIndex((row) => row.name, { indexType: BasicIndex })
-      query = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.name, {
-            stringSort: `custom`,
-            compare,
-          })
-          .limit(1),
-      )
-
-      await query.preload()
-      const message = warning.mock.calls
-        .flat()
-        .find(
-          (value): value is string =>
-            typeof value === `string` && value.includes(`orderBy with limit`),
-        )
-      expect(message).toContain(`same compare function reference`)
-      expect(message).not.toContain(`"compare":"[function]"`)
-      expect(message).toContain(`full source`)
-      expect(message).not.toContain(`create a BasicIndex`)
-    }, [
-      () => warning.mockRestore(),
-      () => query?.cleanup(),
-      () => source.cleanup(),
-    ])
-  })
-
   // A local index cannot confer a provider collation identity. Even a
   // comparator-compatible index must leave the full-source cost visible.
-  test(`warns about custom ordering with a matching local index`, async () => {
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const compare = (a: string, b: string) => a.length - b.length
-    const requests: Array<{ orderBy?: unknown; limit?: number }> = []
-    const source = createCollection<{ id: number; name: string }>({
-      id: `custom-compare-matching-index-diagnostic`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      autoIndex: `off`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: 1, name: `Alice` } })
-          commit()
-          markReady()
-          return {
-            loadSubset: (options) => {
-              requests.push(options)
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    let query: ReturnType<typeof createLiveQueryCollection> | undefined
-    await withOracleCleanup(async () => {
-      source.createIndex((row) => row.name, {
-        indexType: BasicIndex,
-        options: {
-          compareOptions: {
-            direction: `asc`,
-            nulls: `first`,
-            stringSort: `custom`,
-            compare,
-          },
-        },
-      })
-      query = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.name, {
-            stringSort: `custom`,
-            compare,
-          })
-          .limit(1),
-      )
-      await query.preload()
-      expect(requests).toHaveLength(1)
-      expect(requests[0]).toMatchObject({
-        orderBy: undefined,
-        limit: undefined,
-      })
-      expect(warning.mock.calls.flat().join(` `)).toContain(`full source`)
-    }, [
-      () => warning.mockRestore(),
-      () => query?.cleanup(),
-      () => source.cleanup(),
-    ])
-  })
-
-  test(`describes an unindexed on-demand prefix without claiming a full load`, async () => {
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const requests: Array<{ orderBy?: unknown; limit?: number }> = []
-    const source = createCollection<{ id: number; name: string }>({
-      id: `unindexed-prefix-diagnostic`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      autoIndex: `off`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: 1, name: `Alice` } })
-          commit()
-          markReady()
-          return {
-            loadSubset: (options) => {
-              requests.push(options)
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    let query: ReturnType<typeof createLiveQueryCollection> | undefined
-    await withOracleCleanup(async () => {
-      query = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.name)
-          .limit(1),
-      )
-      await query.preload()
-      expect(
-        requests.some(({ orderBy, limit }) => orderBy && limit === 1),
-      ).toBe(true)
-      expect(warning.mock.calls.flat().join(` `)).not.toContain(
-        `loading all data`,
-      )
-    }, [
-      () => warning.mockRestore(),
-      () => query?.cleanup(),
-      () => source.cleanup(),
-    ])
-  })
-
-  test(`identifies an unindexable virtual order field`, async () => {
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const source = createCollection(
-      mockSyncCollectionOptions<{ id: number }>({
-        id: `virtual-order-diagnostic`,
-        getKey: (row) => row.id,
-        initialData: [{ id: 1 }],
-        autoIndex: `off`,
-      }),
-    )
-    let query: ReturnType<typeof createLiveQueryCollection> | undefined
-    await withOracleCleanup(async () => {
-      query = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.$synced)
-          .limit(1),
-      )
-      await query.preload()
-      const message = warning.mock.calls.flat().join(` `)
-      expect(message).toContain(`virtual`)
-      expect(message).not.toContain(`createIndex`)
-    }, [
-      () => warning.mockRestore(),
-      () => query?.cleanup(),
-      () => source.cleanup(),
-    ])
-  })
 })
diff --git a/packages/db/tests/index-suggestion.test.ts b/packages/db/tests/index-suggestion.test.ts
new file mode 100644
index 0000000000..001ccb5d08
--- /dev/null
+++ b/packages/db/tests/index-suggestion.test.ts
@@ -0,0 +1,238 @@
+/**
+ * Ordinary diagnostic examples for bounded orderBy index warnings: the cyclic
+ * locale options, custom comparator reuse, local-index comparator warnings,
+ * on-demand prefixes, and virtual order fields. The diagnostic law is owned by
+ * index-suggestion-oracle.test.ts, which runs the candidate grammar.
+ */
+import { describe, expect, test, vi } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { BasicIndex } from '../src/indexes/basic-index.js'
+import { createLiveQueryCollection } from '../src/query/live-query-collection.js'
+import { mockSyncCollectionOptions, withOracleCleanup } from './utils.js'
+
+describe(`bounded orderBy index diagnostics`, () => {
+  test.each([false, true])(
+    `does not inspect cyclic locale options when field index presence is %s`,
+    async (hasFieldIndex) => {
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      const localeOptions: Record<string, unknown> = {}
+      localeOptions.self = localeOptions
+      const source = createCollection(
+        mockSyncCollectionOptions<{ id: number; name: string }>({
+          id: `cyclic-index-diagnostic-${hasFieldIndex}`,
+          getKey: (row) => row.id,
+          initialData: [{ id: 1, name: `Alice` }],
+          autoIndex: `off`,
+        }),
+      )
+      let query: ReturnType<typeof createLiveQueryCollection> | undefined
+      await withOracleCleanup(async () => {
+        await source.stateWhenReady()
+        if (hasFieldIndex) {
+          source.createIndex((row) => row.name, { indexType: BasicIndex })
+        }
+
+        expect(() => {
+          query = createLiveQueryCollection((q) =>
+            q
+              .from({ row: source })
+              .orderBy(({ row }) => row.name, {
+                direction: `asc`,
+                nulls: `last`,
+                stringSort: `locale`,
+                localeOptions,
+              })
+              .limit(1),
+          )
+        }).not.toThrow()
+        await query!.preload()
+        expect(query!.toArray.map((row) => row.name)).toEqual([`Alice`])
+      }, [
+        () => warning.mockRestore(),
+        () => query?.cleanup(),
+        () => source.cleanup(),
+      ])
+    },
+  )
+
+  test(`explains that a custom index must reuse the comparator reference`, async () => {
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const compare = (a: string, b: string) => a.length - b.length
+    const source = createCollection(
+      mockSyncCollectionOptions<{ id: number; name: string }>({
+        id: `custom-compare-index-diagnostic`,
+        getKey: (row) => row.id,
+        initialData: [{ id: 1, name: `Alice` }],
+        autoIndex: `off`,
+      }),
+    )
+    let query: ReturnType<typeof createLiveQueryCollection> | undefined
+    await withOracleCleanup(async () => {
+      await source.stateWhenReady()
+      source.createIndex((row) => row.name, { indexType: BasicIndex })
+      query = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.name, {
+            stringSort: `custom`,
+            compare,
+          })
+          .limit(1),
+      )
+
+      await query.preload()
+      const message = warning.mock.calls
+        .flat()
+        .find(
+          (value): value is string =>
+            typeof value === `string` && value.includes(`orderBy with limit`),
+        )
+      expect(message).toContain(`same compare function reference`)
+      expect(message).not.toContain(`"compare":"[function]"`)
+      expect(message).toContain(`full source`)
+      expect(message).not.toContain(`create a BasicIndex`)
+    }, [
+      () => warning.mockRestore(),
+      () => query?.cleanup(),
+      () => source.cleanup(),
+    ])
+  })
+
+  test(`warns about custom ordering with a matching local index`, async () => {
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const compare = (a: string, b: string) => a.length - b.length
+    const requests: Array<{ orderBy?: unknown; limit?: number }> = []
+    const source = createCollection<{ id: number; name: string }>({
+      id: `custom-compare-matching-index-diagnostic`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      autoIndex: `off`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: 1, name: `Alice` } })
+          commit()
+          markReady()
+          return {
+            loadSubset: (options) => {
+              requests.push(options)
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    let query: ReturnType<typeof createLiveQueryCollection> | undefined
+    await withOracleCleanup(async () => {
+      source.createIndex((row) => row.name, {
+        indexType: BasicIndex,
+        options: {
+          compareOptions: {
+            direction: `asc`,
+            nulls: `first`,
+            stringSort: `custom`,
+            compare,
+          },
+        },
+      })
+      query = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.name, {
+            stringSort: `custom`,
+            compare,
+          })
+          .limit(1),
+      )
+      await query.preload()
+      expect(requests).toHaveLength(1)
+      expect(requests[0]).toMatchObject({
+        orderBy: undefined,
+        limit: undefined,
+      })
+      expect(warning.mock.calls.flat().join(` `)).toContain(`full source`)
+    }, [
+      () => warning.mockRestore(),
+      () => query?.cleanup(),
+      () => source.cleanup(),
+    ])
+  })
+
+  test(`describes an unindexed on-demand prefix without claiming a full load`, async () => {
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const requests: Array<{ orderBy?: unknown; limit?: number }> = []
+    const source = createCollection<{ id: number; name: string }>({
+      id: `unindexed-prefix-diagnostic`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      autoIndex: `off`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: 1, name: `Alice` } })
+          commit()
+          markReady()
+          return {
+            loadSubset: (options) => {
+              requests.push(options)
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    let query: ReturnType<typeof createLiveQueryCollection> | undefined
+    await withOracleCleanup(async () => {
+      query = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.name)
+          .limit(1),
+      )
+      await query.preload()
+      expect(
+        requests.some(({ orderBy, limit }) => orderBy && limit === 1),
+      ).toBe(true)
+      expect(warning.mock.calls.flat().join(` `)).not.toContain(
+        `loading all data`,
+      )
+    }, [
+      () => warning.mockRestore(),
+      () => query?.cleanup(),
+      () => source.cleanup(),
+    ])
+  })
+
+  test(`identifies an unindexable virtual order field`, async () => {
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const source = createCollection(
+      mockSyncCollectionOptions<{ id: number }>({
+        id: `virtual-order-diagnostic`,
+        getKey: (row) => row.id,
+        initialData: [{ id: 1 }],
+        autoIndex: `off`,
+      }),
+    )
+    let query: ReturnType<typeof createLiveQueryCollection> | undefined
+    await withOracleCleanup(async () => {
+      query = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.$synced)
+          .limit(1),
+      )
+      await query.preload()
+      const message = warning.mock.calls.flat().join(` `)
+      expect(message).toContain(`virtual`)
+      expect(message).not.toContain(`createIndex`)
+    }, [
+      () => warning.mockRestore(),
+      () => query?.cleanup(),
+      () => source.cleanup(),
+    ])
+  })
+})
diff --git a/packages/db/tests/index-update-oracle.property.test.ts b/packages/db/tests/index-update-oracle.property.test.ts
index d4dfb8fdbb..02f2ba0847 100644
--- a/packages/db/tests/index-update-oracle.property.test.ts
+++ b/packages/db/tests/index-update-oracle.property.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, expectTypeOf, test, vi } from 'vitest'
+import { describe, expect, test, vi } from 'vitest'
 import { fc } from '@fast-check/vitest'
 import { Temporal } from 'temporal-polyfill'
 import { createCollection } from '../src/collection/index.js'
@@ -7,13 +7,11 @@ import { BasicIndex } from '../src/indexes/basic-index.js'
 import { BTreeIndex } from '../src/indexes/btree-index.js'
 import { eq } from '../src/query/builder/functions.js'
 import { PropRef } from '../src/query/ir.js'
-import { DEFAULT_COMPARE_OPTIONS } from '../src/utils.js'
 import { mockSyncCollectionOptions } from './utils'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config'
-import type { BaseIndex, IndexInterface } from '../src/indexes/base-index.js'
-import type { CompareOptions } from '../src/query/builder/types.js'
-import type { BasicExpression } from '../src/query/ir.js'
-import type { StringCollationConfig } from '../src/types.js'
+import { declareOracle } from './oracle-declaration'
+import { indexTypes, withCollectionCleanup } from './index-update-support'
+import type { BaseIndex } from '../src/indexes/base-index.js'
 
 /**
  * An index is a derived multimap from indexed value to source keys.
@@ -53,26 +51,11 @@ import type { StringCollationConfig } from '../src/types.js'
 
 type IndexValue = number
 
-type IndexConstructor = new (
-  id: number,
-  expression: BasicExpression,
-  name?: string,
-  options?: {
-    compareFn?: (left: unknown, right: unknown) => number
-    compareOptions?: CompareOptions
-  },
-) => BaseIndex<string>
-
 type IndexAction =
   | { type: `put`; key: string; value: IndexValue }
   | { type: `delete`; key: string }
   | { type: `build`; entries: Array<[string, IndexValue]> }
 
-const indexTypes: Array<[string, IndexConstructor]> = [
-  [`BasicIndex`, BasicIndex as IndexConstructor],
-  [`BTreeIndex`, BTreeIndex as IndexConstructor],
-]
-
 const arbitraryValue: fc.Arbitrary<IndexValue> = fc.oneof(
   fc.integer({ min: -3, max: 3 }),
   fc.constant(-0),
@@ -119,6 +102,7 @@ const arbitraryAction: fc.Arbitrary<IndexAction> = fc.oneof(
  */
 
 const probeValues: Array<IndexValue> = [-3, -2, -1, -0, 0, 1, 2, 3, 99]
+
 const rangeBoundaries: Array<IndexValue> = [-2, 0, 2]
 
 function groupKeysByValue<T>(
@@ -319,35 +303,6 @@ describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
       )
     },
   )
-
-  test(`tracks range-domain safety through updates, rebuilds, and clear`, () => {
-    const index = new IndexType(1, new PropRef([`value`]))
-    const other = [20]
-
-    index.add(`number`, { value: 50 })
-    expect(index.canOptimizeRangeFor(100)).toBe(true)
-
-    index.add(`other`, { value: other })
-    expect(index.canOptimizeRangeFor(100)).toBe(false)
-
-    index.update(`other`, { value: other }, { value: 20 })
-    expect(index.canOptimizeRangeFor(100)).toBe(true)
-
-    index.update(`number`, { value: 50 }, { value: new Date(50) })
-    expect(index.canOptimizeRangeFor(100)).toBe(false)
-    index.remove(`other`, { value: 20 })
-    expect(index.canOptimizeRangeFor(new Date(100))).toBe(true)
-
-    index.clear()
-    expect(index.canOptimizeRangeFor(100)).toBe(true)
-
-    index.build([
-      [`number`, { value: 50 }],
-      [`other`, { value: [20] }],
-    ])
-    expect(index.canOptimizeRangeFor(100)).toBe(false)
-  })
-
   test.each([
     [`duplicate key`, `takeFromStart`, [`a`, `a`]],
     [`wrong reverse order`, `takeReversedFromEnd`, [`a`, `b`]],
@@ -371,7 +326,6 @@ describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
       wrongOutput.mockRestore()
     }
   })
-
   test(`inclusive lower bound rejects an exclusive-boundary result`, () => {
     const index = new IndexType(1, new PropRef([`value`]))
     index.add(`boundary`, { value: -2 })
@@ -389,7 +343,6 @@ describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
       wrongOutput.mockRestore()
     }
   })
-
   test(`upper-only range rejects a dropped minimum when the lower flag is exclusive`, () => {
     const index = new IndexType(1, new PropRef([`value`]))
     index.add(`minimum`, { value: -2 })
@@ -411,7 +364,6 @@ describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
       wrongOutput.mockRestore()
     }
   })
-
   test(`explicit exclusive lower bound rejects an included boundary value`, () => {
     const index = new IndexType(1, new PropRef([`value`]))
     index.add(`boundary`, { value: -2 })
@@ -444,67 +396,6 @@ describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
       wrongOutput.mockRestore()
     }
   })
-
-  test(`accepts indexed values rather than row keys through the index interface`, () => {
-    const index: IndexInterface<string> = new IndexType(
-      1,
-      new PropRef([`value`]),
-    )
-    expectTypeOf<
-      Parameters<IndexInterface<string>[`take`]>[1]
-    >().toEqualTypeOf<unknown>()
-    expectTypeOf<
-      Parameters<IndexInterface<string>[`takeReversed`]>[1]
-    >().toEqualTypeOf<unknown>()
-    expectTypeOf<
-      Parameters<BaseIndex<string>[`take`]>[1]
-    >().toEqualTypeOf<unknown>()
-    expectTypeOf<
-      Parameters<BaseIndex<string>[`takeReversed`]>[1]
-    >().toEqualTypeOf<unknown>()
-    index.add(`undefined`, { value: undefined })
-    index.add(`zero`, { value: 0 })
-    index.add(`one`, { value: 1 })
-
-    expect(index.take(3, 0)).toEqual([`one`])
-    expect(index.takeReversed(3, 1)).toEqual([`zero`, `undefined`])
-    expect(index.take(3, undefined)).toEqual([`zero`, `one`])
-    expect(index.takeReversed(3, undefined)).toEqual([])
-  })
-
-  test(`distinguishes explicit undefined range and cursor bounds`, () => {
-    const index = new IndexType(1, new PropRef([`value`]))
-    index.add(`undefined`, { value: undefined })
-    index.add(`null`, { value: null })
-    index.add(`one`, { value: 1 })
-
-    expect(index.rangeQuery({ to: undefined })).toEqual(
-      new Set([`undefined`, `null`]),
-    )
-    expect(index.rangeQueryReversed({ from: undefined })).toEqual(
-      new Set([`undefined`, `null`]),
-    )
-    expect(index.take(3, undefined)).toEqual([`one`])
-    expect(index.takeReversed(3, undefined)).toEqual([])
-  })
-
-  test(`executes the ordering advertised by compare options`, () => {
-    const compareOptions = {
-      ...DEFAULT_COMPARE_OPTIONS,
-      nulls: `last` as const,
-      stringSort: `lexical` as const,
-    }
-    const index = new IndexType(1, new PropRef([`value`]), undefined, {
-      compareOptions,
-    })
-    index.add(`undefined`, { value: undefined })
-    index.add(`null`, { value: null })
-    index.add(`one`, { value: 1 })
-
-    expect(index.matchesCompareOptions(compareOptions)).toBe(true)
-    expect(index.takeFromStart(3)).toEqual([`one`, `null`, `undefined`])
-    expect(index.rangeQuery({ to: 1 })).toEqual(new Set([`one`]))
-  })
 })
 
 /**
@@ -553,6 +444,7 @@ describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
  * identity, and instrumentation are outside this ordered and range claim.
  */
 type NullishIndexValue = number | null | undefined
+
 type NullishIndexAction =
   | { type: `put`; key: string; value: NullishIndexValue }
   | { type: `delete`; key: string }
@@ -565,6 +457,7 @@ const nullishProbeValues: ReadonlyArray<NullishIndexValue> = [
   2,
   3,
 ]
+
 const nullishInProbes: ReadonlyArray<ReadonlyArray<NullishIndexValue>> = [
   [],
   [undefined],
@@ -576,6 +469,7 @@ const nullishInProbes: ReadonlyArray<ReadonlyArray<NullishIndexValue>> = [
   [1, 2],
   [1, 1],
 ]
+
 const arbitraryNullishAction: fc.Arbitrary<NullishIndexAction> = fc.oneof(
   fc.record({
     type: fc.constant(`put` as const),
@@ -640,6 +534,7 @@ type ModelBound = Readonly<{
   value: NullishIndexValue
   inclusive: boolean
 }>
+
 type ModelRange = Readonly<{
   lower?: ModelBound
   upper?: ModelBound
@@ -791,6 +686,23 @@ function applyNullishAction(
   expectNullishMembership(index, rows)
 }
 
+declareOracle({
+  check: [
+    expectIndexMatchesModel,
+    expectCustomGroups,
+    expectExactIdentities,
+    expectExactMembership,
+    expectNullishMembership,
+    expectComparatorStepRefines,
+    expectPublishedKeysMatchCollection,
+    expectStringMembershipMatches,
+    expectSnapshotKeysMatchSource,
+    expectBinaryValueMembership,
+    expectConservedIndexKeys,
+  ],
+  model: [groupKeysByValue, nullishPosition, predictMonthDayOwners],
+})
+
 describe.each(indexTypes)(
   `%s nullish direct index refinement`,
   (_indexName, IndexType) => {
@@ -1315,29 +1227,31 @@ describe.each(indexTypes)(
 )
 
 /**
- * A custom index comparator must return a number that is not NaN.
- *
- * A broken comparator is a programming error, so the index crashes: the
- * operation that receives an invalid result must throw. It must never report
- * success from an operation that consumed an invalid result, and it must never
- * reject an operation whose comparisons were all valid. A rejected add or
- * remove throws before it changes the index, so the index still refines the
- * accepted rows. Update and build are not atomic; the Collection boundary
- * below crashes the whole collection instead.
- *
- * Model: a recording comparator counts invalid results during one operation.
- * The operation throws exactly when that count is nonzero. The model does not
- * use the production check.
- *
- * Grammar: index type x comparator x accepted numeric prefix x one probe
- * operation. The probe inserts or reads the non-numeric value `ann`. An
- * empty prefix is included: its first write compares nothing, so it must
- * succeed, and the next comparing operation must throw. Comparator
- * transitivity is outside this owner. A removal need not compare a surviving
- * value with its neighbors: the former representative-promotion example
- * prescribed one storage layout, while the rejected-removal witness above
- * retains the atomicity law for comparisons that actually occur.
+ * Refinement check for one operation under the invalid-comparator law. The
+ * recorder counts invalid comparator results made while `run` executes. The
+ * operation must throw a comparator TypeError exactly when that count is
+ * nonzero. Returns whether the operation crashed.
  */
+function expectComparatorStepRefines(
+  recorder: { invalidResults: number },
+  run: () => unknown,
+): boolean {
+  recorder.invalidResults = 0
+  let error: unknown
+  try {
+    run()
+  } catch (caught) {
+    error = caught
+  }
+  if (recorder.invalidResults === 0) {
+    expect(error).toBeUndefined()
+    return false
+  }
+  expect(error).toBeInstanceOf(TypeError)
+  expect((error as Error).message).toMatch(/comparator/)
+  return true
+}
+
 describe.each(indexTypes)(
   `%s invalid comparator results`,
   (_name, IndexType) => {
@@ -1395,7 +1309,6 @@ describe.each(indexTypes)(
           ]),
       },
     ]
-
     function createRecordedIndex(compare: (left: any, right: any) => unknown) {
       const recorder = { invalidResults: 0 }
       const index = new IndexType(1, new PropRef([`value`]), undefined, {
@@ -1406,26 +1319,10 @@ describe.each(indexTypes)(
           return result as number
         },
       })
-      // Refinement check for one operation. Returns whether the index crashed.
-      const step = (run: () => unknown): boolean => {
-        recorder.invalidResults = 0
-        let error: unknown
-        try {
-          run()
-        } catch (caught) {
-          error = caught
-        }
-        if (recorder.invalidResults === 0) {
-          expect(error).toBeUndefined()
-          return false
-        }
-        expect(error).toBeInstanceOf(TypeError)
-        expect((error as Error).message).toMatch(/comparator/)
-        return true
-      }
+      const step = (run: () => unknown): boolean =>
+        expectComparatorStepRefines(recorder, run)
       return { index, step }
     }
-
     describe.each(comparators)(
       `$name comparator`,
       ({ compare, ordersNumbers }) => {
@@ -1446,26 +1343,11 @@ describe.each(indexTypes)(
         })
       },
     )
-
     test(`crashes at the second write of the reported string rows`, () => {
       const { index, step } = createRecordedIndex((left, right) => left - right)
       expect(step(() => index.add(`1`, { value: `ann` }))).toBe(false)
       expect(step(() => index.add(`2`, { value: `bob` }))).toBe(true)
     })
-
-    test(`checks a custom collation compare from compareOptions`, () => {
-      const index = new IndexType(1, new PropRef([`value`]), undefined, {
-        compareOptions: {
-          ...DEFAULT_COMPARE_OPTIONS,
-          stringSort: `custom`,
-          compare: () => NaN,
-        },
-      })
-      index.add(`ann`, { value: `ann` })
-      expect(() => index.add(`bob`, { value: `bob` })).toThrow(TypeError)
-      expect(index.keyCount).toBe(1)
-    })
-
     test(`a rejected remove leaves its row indexed`, () => {
       const { index, step } = createRecordedIndex((left, right) => left - right)
       expect(step(() => index.add(`x`, { value: `x` }))).toBe(false)
@@ -1473,7 +1355,6 @@ describe.each(indexTypes)(
       expect(index.keyCount).toBe(1)
       expect(index.lookup(`eq`, `x`)).toEqual(new Set([`x`]))
     })
-
     test(`a rejected remove preserves other exact values`, () => {
       const { index, step } = createRecordedIndex((left, right) =>
         left === `x` && right === `x`
@@ -1489,15 +1370,6 @@ describe.each(indexTypes)(
         expect(index.lookup(`eq`, value)).toEqual(new Set([value]))
       }
     })
-
-    test(`keeps NaN keys after other values with the default comparator`, () => {
-      const index = new IndexType(1, new PropRef([`value`]))
-      index.add(`nan`, { value: NaN })
-      index.add(`one`, { value: 1 })
-      expect(index.lookup(`eq`, NaN)).toEqual(new Set([`nan`]))
-      expect(index.keyCount).toBe(2)
-      expect(index.takeFromStart(3)).toEqual([`one`, `nan`])
-    })
   },
 )
 
@@ -1518,53 +1390,17 @@ describe.each(indexTypes)(
  * string names with a subtracting comparator. The first row compares nothing;
  * the second is the first invalid comparison.
  */
-async function withCollectionCleanup(
-  collection: { cleanup: () => Promise<void> },
-  check: () => void | Promise<void>,
-): Promise<void> {
-  let primaryFailure: unknown
-  let failed = false
-  try {
-    await check()
-  } catch (error) {
-    primaryFailure = error
-    failed = true
-  }
-  try {
-    await collection.cleanup()
-  } catch (cleanupError) {
-    if (failed)
-      throw new AggregateError([cleanupError], `Index oracle cleanup failed`, {
-        cause: primaryFailure,
-      })
-    throw cleanupError
-  }
-  if (failed) throw primaryFailure
+/**
+ * Subscriber law at the Collection boundary: until a write throws, the keys
+ * accumulated from published change events equal the Collection's live keys.
+ */
+function expectPublishedKeysMatchCollection(
+  published: ReadonlySet<number>,
+  collection: { keys: () => IterableIterator<number> },
+): void {
+  expect(published).toEqual(new Set(collection.keys()))
 }
 
-test(`preserves the index mismatch when Collection cleanup also fails`, async () => {
-  const mismatch = new Error(`ordered index result differs`)
-  const cleanupFailure = new Error(`adapter cleanup failed`)
-  let caught: unknown
-  try {
-    await withCollectionCleanup(
-      {
-        cleanup: async () => {
-          throw cleanupFailure
-        },
-      },
-      () => {
-        throw mismatch
-      },
-    )
-  } catch (error) {
-    caught = error
-  }
-  expect(caught).toBeInstanceOf(AggregateError)
-  expect((caught as AggregateError).cause).toBe(mismatch)
-  expect((caught as AggregateError).errors).toEqual([cleanupFailure])
-})
-
 describe.each([
   [`BasicIndex`, BasicIndex],
   [`BTreeIndex`, BTreeIndex],
@@ -1635,7 +1471,7 @@ describe.each([
 
           write(collection, sync, { id: 1, name: `ann` })
           expect(collection.status).toBe(`ready`)
-          expect(published).toEqual(new Set(collection.keys()))
+          expectPublishedKeysMatchCollection(published, collection)
 
           expect(() => write(collection, sync, { id: 2, name: `bob` })).toThrow(
             TypeError,
@@ -1650,6 +1486,35 @@ describe.each([
   },
 )
 
+/**
+ * Exact string membership law for comparator groups: each exact value's
+ * equality lookup and `eq` dispatch return the source keys holding that value,
+ * and a range over its comparator group returns every key whose value shares
+ * the group. The source Map and the group labels are the model; the comparator
+ * is not consulted for exact membership.
+ */
+function expectStringMembershipMatches<Value extends string>(
+  index: BaseIndex<string>,
+  rows: ReadonlyMap<string, Value>,
+  group: Readonly<Record<Value, number>>,
+): void {
+  expect(index.keyCount).toBe(rows.size)
+  for (const value of Object.keys(group) as Array<Value>) {
+    const exactKeys = new Set(
+      [...rows].filter(([, current]) => current === value).map(([key]) => key),
+    )
+    expect(index.equalityLookup(value)).toEqual(exactKeys)
+    expect(index.lookup(`eq`, value)).toEqual(exactKeys)
+    expect(index.rangeQuery({ from: value, to: value })).toEqual(
+      new Set(
+        [...rows]
+          .filter(([, current]) => group[current] === group[value])
+          .map(([key]) => key),
+      ),
+    )
+  }
+}
+
 describe.each(indexTypes)(`%s comparator groups`, (_indexName, IndexType) => {
   test(`rejects stale retired identity outputs without rejecting live reuse`, () => {
     const symbol = Symbol(`same group`)
@@ -1754,25 +1619,8 @@ describe.each(indexTypes)(`%s comparator groups`, (_indexName, IndexType) => {
           .toLowerCase()
           .localeCompare((right as string).toLowerCase()),
     })
-    const expectMatchesSource = () => {
-      expect(index.keyCount).toBe(rows.size)
-      for (const value of Object.keys(group) as Array<Value>) {
-        const exactKeys = new Set(
-          [...rows]
-            .filter(([, current]) => current === value)
-            .map(([key]) => key),
-        )
-        expect(index.equalityLookup(value)).toEqual(exactKeys)
-        expect(index.lookup(`eq`, value)).toEqual(exactKeys)
-        expect(index.rangeQuery({ from: value, to: value })).toEqual(
-          new Set(
-            [...rows]
-              .filter(([, current]) => group[current] === group[value])
-              .map(([key]) => key),
-          ),
-        )
-      }
-    }
+    const expectMatchesSource = () =>
+      expectStringMembershipMatches(index, rows, group)
 
     // Check after each direct index action. First update a singleton, as in
     // the legacy witness; then add peers in both comparator groups. A shortcut
@@ -2142,253 +1990,6 @@ test(`retired-identity calibration shrinks and replays the same semantic failure
   expect(replay.counterexample).toEqual(failed.counterexample)
 })
 
-/**
- * Auto-indexes refine the Collection's declared collation: an ordered public
- * read must return the independent label order through the index path, and
- * repeated reads must reuse the one index for that field. These fixed cells
- * differ from the direct-index model above because index creation is driven
- * by the public Collection API rather than by the test.
- */
-const collationCases = [
-  {
-    name: `lexical`,
-    collation: { stringSort: `lexical` as const },
-    clause: { direction: `asc`, nulls: `first` },
-    expected: [`item10`, `item2`],
-  },
-  {
-    name: `numeric locale`,
-    collation: {
-      stringSort: `locale` as const,
-      locale: `en-US`,
-      localeOptions: { numeric: true },
-    },
-    clause: { direction: `asc`, nulls: `first` },
-    expected: [`item2`, `item10`],
-  },
-  {
-    name: `explicit ordinary locale override`,
-    collation: {
-      stringSort: `locale` as const,
-      locale: `en-US`,
-      localeOptions: { numeric: true },
-    },
-    clause: {
-      direction: `asc`,
-      nulls: `first`,
-      stringSort: `locale`,
-      locale: `en-US`,
-    },
-    expected: [`item10`, `item2`],
-  },
-] as const
-
-function createCollationCollection(
-  collation: StringCollationConfig,
-  autoIndex: `off` | `eager`,
-  defaultIndexType?: typeof BasicIndex | typeof BTreeIndex,
-  labels: ReadonlyArray<string> = [`item10`, `item2`],
-) {
-  return createCollection<{ id: string; label: string }>({
-    getKey: (row) => row.id,
-    autoIndex,
-    defaultIndexType,
-    defaultStringCollation: collation,
-    startSync: true,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        for (const [ordinal, label] of labels.entries()) {
-          write({ type: `insert`, value: { id: String(ordinal), label } })
-        }
-        commit()
-        markReady()
-      },
-    },
-  })
-}
-
-describe.each([
-  [`BasicIndex`, BasicIndex],
-  [`BTreeIndex`, BTreeIndex],
-] as const)(`%s Collection auto-index collation`, (_name, IndexType) => {
-  test.each(collationCases)(
-    `$name ordered public reads reuse one compatible index`,
-    async ({ collation, clause, expected }) => {
-      const collection = createCollationCollection(
-        collation,
-        `eager`,
-        IndexType,
-      )
-      const createIndex = vi.spyOn(collection, `createIndex`)
-
-      await withCollectionCleanup(collection, async () => {
-        try {
-          await collection.stateWhenReady()
-          expect(collection.indexes.size).toBe(0)
-          const read = () =>
-            collection
-              .currentStateAsChanges({
-                orderBy: [
-                  {
-                    expression: new PropRef([`label`]),
-                    compareOptions: clause,
-                  },
-                ],
-                optimizedOnly: true,
-              })
-              ?.map(({ value }) => value.label)
-
-          expect.soft(read(), `first indexed read`).toEqual(expected)
-          expect.soft(read(), `second indexed read`).toEqual(expected)
-          expect(createIndex, `one index construction`).toHaveBeenCalledTimes(1)
-          expect(collection.indexes.size, `one index per field`).toBe(1)
-        } finally {
-          createIndex.mockRestore()
-        }
-      })
-    },
-  )
-})
-
-test.each(collationCases)(
-  `$name ordered public reads honor Collection collation without an index`,
-  async ({ collation, clause, expected }) => {
-    const collection = createCollationCollection(collation, `off`)
-
-    await withCollectionCleanup(collection, async () => {
-      await collection.stateWhenReady()
-      const rows = collection.currentStateAsChanges({
-        orderBy: [
-          {
-            expression: new PropRef([`label`]),
-            compareOptions: clause,
-          },
-        ],
-      })
-      expect(rows?.map(({ value }) => value.label)).toEqual(expected)
-      expect(collection.indexes.size, `scan path reached`).toBe(0)
-    })
-  },
-)
-
-test(`ordered scan resolves inherited collation outside each comparison`, async () => {
-  const collection = createCollationCollection(
-    { stringSort: `lexical` },
-    `off`,
-    undefined,
-    [`f`, `e`, `d`, `c`, `b`, `a`],
-  )
-
-  await withCollectionCleanup(collection, async () => {
-    await collection.stateWhenReady()
-    const optionReads = vi.spyOn(collection, `compareOptions`, `get`)
-    const rows = collection.currentStateAsChanges({
-      orderBy: [
-        {
-          expression: new PropRef([`label`]),
-          compareOptions: { direction: `asc`, nulls: `first` },
-        },
-      ],
-    })
-
-    expect(rows?.map(({ value }) => value.label)).toEqual([
-      `a`,
-      `b`,
-      `c`,
-      `d`,
-      `e`,
-      `f`,
-    ])
-    // One resolution can check the index path; the scan needs only one more.
-    expect(optionReads.mock.calls.length).toBeLessThanOrEqual(2)
-    expect(collection.indexes.size).toBe(0)
-  })
-})
-
-/**
- * Public ordered reads compare the user's string values. An index escapes a
- * leading internal prefix for exact-key storage; that storage encoding must
- * not change the Collection's declared string order. The en-US locale and a
- * custom callback both place the prefixed value first. The scan and the
- * bounded indexed read must return that same first row.
- */
-const prefixedLabel = `\u0000tanstack-db:a`
-const plainLabel = `tanstack-db:r`
-const prefixedStringCases = [
-  {
-    name: `locale`,
-    collation: { stringSort: `locale`, locale: `en-US` },
-  },
-  {
-    name: `custom collation`,
-    collation: {
-      stringSort: `custom`,
-      compare: (left: string, right: string) =>
-        left.localeCompare(right, `en-US`),
-    },
-  },
-] as const satisfies ReadonlyArray<{
-  name: string
-  collation: StringCollationConfig
-}>
-
-describe.each([
-  [`BasicIndex`, BasicIndex],
-  [`BTreeIndex`, BTreeIndex],
-] as const)(`%s prefixed-string public order`, (_name, IndexType) => {
-  test.each(prefixedStringCases)(
-    `$name scan and bounded index return the same first row`,
-    async ({ collation }) => {
-      const labels = [plainLabel, prefixedLabel]
-      expect(prefixedLabel.localeCompare(plainLabel, `en-US`)).toBeLessThan(0)
-      const orderBy = [
-        {
-          expression: new PropRef([`label`]),
-          compareOptions: {
-            direction: `asc` as const,
-            nulls: `first` as const,
-          },
-        },
-      ]
-
-      const scan = createCollationCollection(
-        collation,
-        `off`,
-        undefined,
-        labels,
-      )
-      await withCollectionCleanup(scan, async () => {
-        await scan.stateWhenReady()
-        const changes = scan.currentStateAsChanges({ orderBy, limit: 1 })
-        expect(changes?.map(({ value }) => value.label)).toEqual([
-          prefixedLabel,
-        ])
-        expect(scan.indexes.size, `scan path reached`).toBe(0)
-      })
-
-      const indexed = createCollationCollection(
-        collation,
-        `eager`,
-        IndexType,
-        labels,
-      )
-      await withCollectionCleanup(indexed, async () => {
-        await indexed.stateWhenReady()
-        const changes = indexed.currentStateAsChanges({
-          orderBy,
-          limit: 1,
-          optimizedOnly: true,
-        })
-        expect(changes?.map(({ value }) => value.label)).toEqual([
-          prefixedLabel,
-        ])
-        expect(indexed.indexes.size, `index path reached`).toBe(1)
-      })
-    },
-  )
-})
-
 /**
  * Mixed primitive values can share a comparator position without sharing an
  * exact value. The source Map owns each key once. This model intentionally
@@ -2547,40 +2148,57 @@ describe.each([
       })
       expect(take).toHaveBeenCalled()
       expect(changes).toBeDefined()
-      const keys = changes!.map((change) => change.key)
-      expect(keys).toHaveLength(rows.size)
-      expect(new Set(keys)).toEqual(new Set(rows.keys()))
+      expectSnapshotKeysMatchSource(
+        changes!.map((change) => change.key),
+        rows,
+      )
     })
   })
 })
 
 /**
- * Binary equality is by byte content, so a fresh byte array can remove an
- * earlier equal value. The source Map predicts exact membership after removal,
- * re-addition, and replacement while another byte value remains. Complete
- * index reads must contain each live key once; byte ordering is unspecified.
+ * Public snapshot law after a source deletion: a complete bounded read returns
+ * each surviving source key exactly once. The source Map is the model.
  */
+function expectSnapshotKeysMatchSource(
+  keys: ReadonlyArray<unknown>,
+  rows: ReadonlyMap<string, unknown>,
+): void {
+  expect(keys).toHaveLength(rows.size)
+  expect(new Set(keys)).toEqual(new Set(rows.keys()))
+}
+
+/**
+ * Binary ownership law: exact membership and both complete index reads agree
+ * with the source Map after each action. Byte order is not part of the law.
+ */
+function expectBinaryValueMembership(
+  index: BaseIndex<string>,
+  rows: ReadonlyMap<string, Uint8Array>,
+  bytes: (value?: number) => Uint8Array,
+): void {
+  const expected = new Set(rows.keys())
+  expect(index.keyCount).toBe(rows.size)
+  expect(index.equalityLookup(bytes())).toEqual(
+    new Set(
+      [...rows].filter(([, value]) => value[0] === 1).map(([key]) => key),
+    ),
+  )
+  for (const read of [
+    index.takeFromStart(rows.size + 1),
+    index.takeReversedFromEnd(rows.size + 1),
+  ]) {
+    expect(read).toHaveLength(rows.size)
+    expect(new Set(read)).toEqual(expected)
+  }
+}
+
 describe.each(indexTypes)(`%s binary-value ownership`, (_name, IndexType) => {
   test(`does not retain an ordered entry after equal-content removal`, () => {
     const index = new IndexType(1, new PropRef([`value`]))
     const rows = new Map<string, Uint8Array>()
     const bytes = (value = 1) => new Uint8Array([value])
-    const check = () => {
-      const expected = new Set(rows.keys())
-      expect(index.keyCount).toBe(rows.size)
-      expect(index.equalityLookup(bytes())).toEqual(
-        new Set(
-          [...rows].filter(([, value]) => value[0] === 1).map(([key]) => key),
-        ),
-      )
-      for (const read of [
-        index.takeFromStart(rows.size + 1),
-        index.takeReversedFromEnd(rows.size + 1),
-      ]) {
-        expect(read).toHaveLength(rows.size)
-        expect(new Set(read)).toEqual(expected)
-      }
-    }
+    const check = () => expectBinaryValueMembership(index, rows, bytes)
 
     index.add(`a`, { value: bytes() })
     rows.set(`a`, bytes())
@@ -2605,29 +2223,26 @@ describe.each(indexTypes)(`%s binary-value ownership`, (_name, IndexType) => {
     rows.set(`d`, bytes())
     check()
   })
+})
 
-  test.each([2, 8193])(
-    `compares every byte for exact membership (%i bytes)`,
-    (length) => {
-      const index = new IndexType(1, new PropRef([`value`]))
-      const left = new Uint8Array(length)
-      left[0] = 1
-      const right = left.slice()
-      right[length - 1] = 1
-      index.add(`left`, { value: left })
-      index.add(`right`, { value: right })
-      expect(index.equalityLookup(left.slice())).toEqual(new Set([`left`]))
-      expect(index.equalityLookup(right.slice())).toEqual(new Set([`right`]))
-      for (const read of [
-        index.takeFromStart(3),
-        index.takeReversedFromEnd(3),
-      ]) {
-        expect(read).toHaveLength(2)
-        expect(new Set(read)).toEqual(new Set([`left`, `right`]))
-      }
-    },
+/**
+ * Model for PlainMonthDay equality: the keys whose source value has the same
+ * month code and day as the probe. It reads the source rows, not the index.
+ */
+function predictMonthDayOwners(
+  rows: ReadonlyArray<{ id: string; value: Temporal.PlainMonthDay }>,
+  probe: Temporal.PlainMonthDay,
+): Set<string> {
+  return new Set(
+    rows
+      .filter(
+        (row) =>
+          row.value.monthCode === probe.monthCode &&
+          row.value.day === probe.day,
+      )
+      .map((row) => row.id),
   )
-})
+}
 
 /**
  * PlainMonthDay has exact equality but no intrinsic order. The two-row source
@@ -2644,15 +2259,7 @@ describe.each(indexTypes)(
         { id: `feb`, value: Temporal.PlainMonthDay.from(`--02-01`) },
       ]
       const probe = Temporal.PlainMonthDay.from(`--02-01`)
-      const expected = new Set(
-        rows
-          .filter(
-            (row) =>
-              row.value.monthCode === probe.monthCode &&
-              row.value.day === probe.day,
-          )
-          .map((row) => row.id),
-      )
+      const expected = predictMonthDayOwners(rows, probe)
       const index = new IndexType(1, new PropRef([`value`]))
       for (const row of rows) index.add(row.id, row)
       expect(index.lookup(`eq`, probe)).toEqual(expected)
@@ -2683,124 +2290,3 @@ describe.each(indexTypes)(
     })
   },
 )
-
-/**
- * A bounded read should not make more comparator calls as retired values
- * accumulate. A fixed history retains one row while adding and removing 16,
- * 64, or 256 earlier values. A user comparator records calls made by the
- * public takeFromStart method after each history. This witnesses comparator
- * work only: a traversal over tombstones that avoids the comparator could
- * pass, and retained memory is measured separately.
- */
-describe.each(indexTypes)(`%s retired-value read work`, (_name, IndexType) => {
-  test(`takeFromStart comparator work does not grow with retired values`, () => {
-    const comparisons = [16, 64, 256].map((retiredCount) => {
-      let calls = 0
-      const index = new IndexType(1, new PropRef([`value`]), undefined, {
-        compareFn: (left: unknown, right: unknown) => {
-          calls++
-          return (left as number) - (right as number)
-        },
-      })
-      index.add(`live`, { value: 1000 })
-      for (let value = 0; value < retiredCount; value++) {
-        const key = String(value)
-        index.add(key, { value })
-        index.remove(key, { value })
-      }
-      expect(index.keyCount).toBe(1)
-      calls = 0
-      expect(index.takeFromStart(1)).toEqual([`live`])
-      return calls
-    })
-
-    expect(comparisons[2]).toBeLessThanOrEqual(comparisons[0]! + 4)
-  })
-})
-
-/**
- * Distinct exact values can share one comparator position. An ordered first
- * row still requires sorting that group's keys, but it need not recompare
- * every value in the group. The fixed 16/64/256 sizes distinguish a grouped
- * read from one tree search per tied exact value. This bounds comparator work
- * at the direct read checkpoint, not elapsed time or retained memory.
- */
-test(`BTreeIndex bounded reads do not recompare every live tie`, () => {
-  const comparisons = [16, 64, 256].map((count) => {
-    let calls = 0
-    const index = new BTreeIndex<string>(1, new PropRef([`value`]), undefined, {
-      compareFn: () => {
-        calls++
-        return 0
-      },
-    })
-    for (let value = 0; value < count; value++) {
-      index.add(String(value), { value })
-    }
-    calls = 0
-    expect(index.takeFromStart(1)).toEqual([`0`])
-    return calls
-  })
-  expect(comparisons[2]).toBeLessThanOrEqual(comparisons[0]! + 4)
-})
-
-/**
- * Preserve a bounded legacy callback input: older indexes supplied a Date's
- * timestamp and a string for Temporal and binary values. For two immutable
- * values of each named kind, a direct add comparison supplies that same scalar
- * kind in both index types. The model uses two values with a known order; it
- * does not copy or specify the index's string encoding. A callback that accepts
- * only the old scalar kind distinguishes a raw-object leak. After both adds,
- * full ordered keys and exact owners must match the supplied facts. This does
- * not establish arbitrary callbacks, build/update/range paths, or mutation of
- * the value objects after admission.
- */
-describe.each(indexTypes)(
-  `%s comparator input compatibility`,
-  (_name, IndexType) => {
-    test.each([
-      {
-        name: `Date`,
-        values: [new Date(1), new Date(2)],
-        kind: `number`,
-      },
-      {
-        name: `Temporal.Instant`,
-        values: [
-          Temporal.Instant.from(`2020-01-01T00:00:00Z`),
-          Temporal.Instant.from(`2021-01-01T00:00:00Z`),
-        ],
-        kind: `string`,
-      },
-      {
-        name: `Uint8Array`,
-        values: [new Uint8Array([1]), new Uint8Array([2])],
-        kind: `string`,
-      },
-    ])(
-      `passes $name to callbacks in its legacy scalar kind`,
-      ({ values, kind }) => {
-        let comparisons = 0
-        const index = new IndexType(1, new PropRef([`value`]), undefined, {
-          compareFn: (left, right) => {
-            comparisons++
-            expect(typeof left).toBe(kind)
-            expect(typeof right).toBe(kind)
-            if (kind === `number`) return (left as number) - (right as number)
-            const a = left as string
-            const b = right as string
-            return a < b ? -1 : a > b ? 1 : 0
-          },
-        })
-        // Keys oppose value order, so collapsing both inputs to one comparator
-        // position cannot pass by key-tie ordering alone.
-        index.add(`a`, { value: values[1] })
-        index.add(`z`, { value: values[0] })
-        expect(comparisons).toBeGreaterThan(0)
-        expect(index.takeFromStart(2)).toEqual([`z`, `a`])
-        expect(index.equalityLookup(values[0])).toEqual(new Set([`z`]))
-        expect(index.equalityLookup(values[1])).toEqual(new Set([`a`]))
-      },
-    )
-  },
-)
diff --git a/packages/db/tests/index-update-support.ts b/packages/db/tests/index-update-support.ts
new file mode 100644
index 0000000000..1747c97e3b
--- /dev/null
+++ b/packages/db/tests/index-update-support.ts
@@ -0,0 +1,44 @@
+import { BasicIndex } from '../src/indexes/basic-index.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import type { BaseIndex } from '../src/indexes/base-index.js'
+import type { CompareOptions } from '../src/query/builder/types.js'
+import type { BasicExpression } from '../src/query/ir.js'
+
+export type IndexConstructor = new (
+  id: number,
+  expression: BasicExpression,
+  name?: string,
+  options?: {
+    compareFn?: (left: unknown, right: unknown) => number
+    compareOptions?: CompareOptions
+  },
+) => BaseIndex<string>
+
+export const indexTypes: Array<[string, IndexConstructor]> = [
+  [`BasicIndex`, BasicIndex as IndexConstructor],
+  [`BTreeIndex`, BTreeIndex as IndexConstructor],
+]
+
+export async function withCollectionCleanup(
+  collection: { cleanup: () => Promise<void> },
+  check: () => void | Promise<void>,
+): Promise<void> {
+  let primaryFailure: unknown
+  let failed = false
+  try {
+    await check()
+  } catch (error) {
+    primaryFailure = error
+    failed = true
+  }
+  try {
+    await collection.cleanup()
+  } catch (cleanupError) {
+    if (failed)
+      throw new AggregateError([cleanupError], `Index oracle cleanup failed`, {
+        cause: primaryFailure,
+      })
+    throw cleanupError
+  }
+  if (failed) throw primaryFailure
+}
diff --git a/packages/db/tests/index-update.test.ts b/packages/db/tests/index-update.test.ts
new file mode 100644
index 0000000000..3efe3a830c
--- /dev/null
+++ b/packages/db/tests/index-update.test.ts
@@ -0,0 +1,537 @@
+/**
+ * Direct-index and Collection tests that compare with hand-written values:
+ * range-domain flags, compare options, a harness self-test, and fixed collation
+ * and prefixed-string cells. The index-update-oracle.property.test.ts file owns
+ * the index update, nullish, and comparator laws.
+ */
+import { describe, expect, expectTypeOf, test, vi } from 'vitest'
+import { Temporal } from 'temporal-polyfill'
+import { createCollection } from '../src/collection/index.js'
+import { BasicIndex } from '../src/indexes/basic-index.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { PropRef } from '../src/query/ir.js'
+import { DEFAULT_COMPARE_OPTIONS } from '../src/utils.js'
+import { indexTypes, withCollectionCleanup } from './index-update-support'
+import type { BaseIndex, IndexInterface } from '../src/indexes/base-index.js'
+import type { StringCollationConfig } from '../src/types.js'
+
+/**
+ * Auto-indexes refine the Collection's declared collation: an ordered public
+ * read must return the independent label order through the index path, and
+ * repeated reads must reuse the one index for that field. These fixed cells
+ * differ from the direct-index model above because index creation is driven
+ * by the public Collection API rather than by the test.
+ */
+const collationCases = [
+  {
+    name: `lexical`,
+    collation: { stringSort: `lexical` as const },
+    clause: { direction: `asc`, nulls: `first` },
+    expected: [`item10`, `item2`],
+  },
+  {
+    name: `numeric locale`,
+    collation: {
+      stringSort: `locale` as const,
+      locale: `en-US`,
+      localeOptions: { numeric: true },
+    },
+    clause: { direction: `asc`, nulls: `first` },
+    expected: [`item2`, `item10`],
+  },
+  {
+    name: `explicit ordinary locale override`,
+    collation: {
+      stringSort: `locale` as const,
+      locale: `en-US`,
+      localeOptions: { numeric: true },
+    },
+    clause: {
+      direction: `asc`,
+      nulls: `first`,
+      stringSort: `locale`,
+      locale: `en-US`,
+    },
+    expected: [`item10`, `item2`],
+  },
+] as const
+
+function createCollationCollection(
+  collation: StringCollationConfig,
+  autoIndex: `off` | `eager`,
+  defaultIndexType?: typeof BasicIndex | typeof BTreeIndex,
+  labels: ReadonlyArray<string> = [`item10`, `item2`],
+) {
+  return createCollection<{ id: string; label: string }>({
+    getKey: (row) => row.id,
+    autoIndex,
+    defaultIndexType,
+    defaultStringCollation: collation,
+    startSync: true,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        for (const [ordinal, label] of labels.entries()) {
+          write({ type: `insert`, value: { id: String(ordinal), label } })
+        }
+        commit()
+        markReady()
+      },
+    },
+  })
+}
+
+/**
+ * Public ordered reads compare the user's string values. An index escapes a
+ * leading internal prefix for exact-key storage; that storage encoding must
+ * not change the Collection's declared string order. The en-US locale and a
+ * custom callback both place the prefixed value first. The scan and the
+ * bounded indexed read must return that same first row.
+ */
+const prefixedLabel = `\u0000tanstack-db:a`
+
+const plainLabel = `tanstack-db:r`
+
+const prefixedStringCases = [
+  {
+    name: `locale`,
+    collation: { stringSort: `locale`, locale: `en-US` },
+  },
+  {
+    name: `custom collation`,
+    collation: {
+      stringSort: `custom`,
+      compare: (left: string, right: string) =>
+        left.localeCompare(right, `en-US`),
+    },
+  },
+] as const satisfies ReadonlyArray<{
+  name: string
+  collation: StringCollationConfig
+}>
+
+describe.each(indexTypes)(`%s update properties`, (_indexName, IndexType) => {
+  test(`tracks range-domain safety through updates, rebuilds, and clear`, () => {
+    const index = new IndexType(1, new PropRef([`value`]))
+    const other = [20]
+
+    index.add(`number`, { value: 50 })
+    expect(index.canOptimizeRangeFor(100)).toBe(true)
+
+    index.add(`other`, { value: other })
+    expect(index.canOptimizeRangeFor(100)).toBe(false)
+
+    index.update(`other`, { value: other }, { value: 20 })
+    expect(index.canOptimizeRangeFor(100)).toBe(true)
+
+    index.update(`number`, { value: 50 }, { value: new Date(50) })
+    expect(index.canOptimizeRangeFor(100)).toBe(false)
+    index.remove(`other`, { value: 20 })
+    expect(index.canOptimizeRangeFor(new Date(100))).toBe(true)
+
+    index.clear()
+    expect(index.canOptimizeRangeFor(100)).toBe(true)
+
+    index.build([
+      [`number`, { value: 50 }],
+      [`other`, { value: [20] }],
+    ])
+    expect(index.canOptimizeRangeFor(100)).toBe(false)
+  })
+  test(`accepts indexed values rather than row keys through the index interface`, () => {
+    const index: IndexInterface<string> = new IndexType(
+      1,
+      new PropRef([`value`]),
+    )
+    expectTypeOf<
+      Parameters<IndexInterface<string>[`take`]>[1]
+    >().toEqualTypeOf<unknown>()
+    expectTypeOf<
+      Parameters<IndexInterface<string>[`takeReversed`]>[1]
+    >().toEqualTypeOf<unknown>()
+    expectTypeOf<
+      Parameters<BaseIndex<string>[`take`]>[1]
+    >().toEqualTypeOf<unknown>()
+    expectTypeOf<
+      Parameters<BaseIndex<string>[`takeReversed`]>[1]
+    >().toEqualTypeOf<unknown>()
+    index.add(`undefined`, { value: undefined })
+    index.add(`zero`, { value: 0 })
+    index.add(`one`, { value: 1 })
+
+    expect(index.take(3, 0)).toEqual([`one`])
+    expect(index.takeReversed(3, 1)).toEqual([`zero`, `undefined`])
+    expect(index.take(3, undefined)).toEqual([`zero`, `one`])
+    expect(index.takeReversed(3, undefined)).toEqual([])
+  })
+  test(`distinguishes explicit undefined range and cursor bounds`, () => {
+    const index = new IndexType(1, new PropRef([`value`]))
+    index.add(`undefined`, { value: undefined })
+    index.add(`null`, { value: null })
+    index.add(`one`, { value: 1 })
+
+    expect(index.rangeQuery({ to: undefined })).toEqual(
+      new Set([`undefined`, `null`]),
+    )
+    expect(index.rangeQueryReversed({ from: undefined })).toEqual(
+      new Set([`undefined`, `null`]),
+    )
+    expect(index.take(3, undefined)).toEqual([`one`])
+    expect(index.takeReversed(3, undefined)).toEqual([])
+  })
+  test(`executes the ordering advertised by compare options`, () => {
+    const compareOptions = {
+      ...DEFAULT_COMPARE_OPTIONS,
+      nulls: `last` as const,
+      stringSort: `lexical` as const,
+    }
+    const index = new IndexType(1, new PropRef([`value`]), undefined, {
+      compareOptions,
+    })
+    index.add(`undefined`, { value: undefined })
+    index.add(`null`, { value: null })
+    index.add(`one`, { value: 1 })
+
+    expect(index.matchesCompareOptions(compareOptions)).toBe(true)
+    expect(index.takeFromStart(3)).toEqual([`one`, `null`, `undefined`])
+    expect(index.rangeQuery({ to: 1 })).toEqual(new Set([`one`]))
+  })
+})
+describe.each(indexTypes)(
+  `%s invalid comparator results`,
+  (_name, IndexType) => {
+    test(`checks a custom collation compare from compareOptions`, () => {
+      const index = new IndexType(1, new PropRef([`value`]), undefined, {
+        compareOptions: {
+          ...DEFAULT_COMPARE_OPTIONS,
+          stringSort: `custom`,
+          compare: () => NaN,
+        },
+      })
+      index.add(`ann`, { value: `ann` })
+      expect(() => index.add(`bob`, { value: `bob` })).toThrow(TypeError)
+      expect(index.keyCount).toBe(1)
+    })
+    test(`keeps NaN keys after other values with the default comparator`, () => {
+      const index = new IndexType(1, new PropRef([`value`]))
+      index.add(`nan`, { value: NaN })
+      index.add(`one`, { value: 1 })
+      expect(index.lookup(`eq`, NaN)).toEqual(new Set([`nan`]))
+      expect(index.keyCount).toBe(2)
+      expect(index.takeFromStart(3)).toEqual([`one`, `nan`])
+    })
+  },
+)
+test(`preserves the index mismatch when Collection cleanup also fails`, async () => {
+  const mismatch = new Error(`ordered index result differs`)
+  const cleanupFailure = new Error(`adapter cleanup failed`)
+  let caught: unknown
+  try {
+    await withCollectionCleanup(
+      {
+        cleanup: async () => {
+          throw cleanupFailure
+        },
+      },
+      () => {
+        throw mismatch
+      },
+    )
+  } catch (error) {
+    caught = error
+  }
+  expect(caught).toBeInstanceOf(AggregateError)
+  expect((caught as AggregateError).cause).toBe(mismatch)
+  expect((caught as AggregateError).errors).toEqual([cleanupFailure])
+})
+describe.each([
+  [`BasicIndex`, BasicIndex],
+  [`BTreeIndex`, BTreeIndex],
+] as const)(`%s Collection auto-index collation`, (_name, IndexType) => {
+  test.each(collationCases)(
+    `$name ordered public reads reuse one compatible index`,
+    async ({ collation, clause, expected }) => {
+      const collection = createCollationCollection(
+        collation,
+        `eager`,
+        IndexType,
+      )
+      const createIndex = vi.spyOn(collection, `createIndex`)
+
+      await withCollectionCleanup(collection, async () => {
+        try {
+          await collection.stateWhenReady()
+          expect(collection.indexes.size).toBe(0)
+          const read = () =>
+            collection
+              .currentStateAsChanges({
+                orderBy: [
+                  {
+                    expression: new PropRef([`label`]),
+                    compareOptions: clause,
+                  },
+                ],
+                optimizedOnly: true,
+              })
+              ?.map(({ value }) => value.label)
+
+          expect.soft(read(), `first indexed read`).toEqual(expected)
+          expect.soft(read(), `second indexed read`).toEqual(expected)
+          expect(createIndex, `one index construction`).toHaveBeenCalledTimes(1)
+          expect(collection.indexes.size, `one index per field`).toBe(1)
+        } finally {
+          createIndex.mockRestore()
+        }
+      })
+    },
+  )
+})
+test.each(collationCases)(
+  `$name ordered public reads honor Collection collation without an index`,
+  async ({ collation, clause, expected }) => {
+    const collection = createCollationCollection(collation, `off`)
+
+    await withCollectionCleanup(collection, async () => {
+      await collection.stateWhenReady()
+      const rows = collection.currentStateAsChanges({
+        orderBy: [
+          {
+            expression: new PropRef([`label`]),
+            compareOptions: clause,
+          },
+        ],
+      })
+      expect(rows?.map(({ value }) => value.label)).toEqual(expected)
+      expect(collection.indexes.size, `scan path reached`).toBe(0)
+    })
+  },
+)
+test(`ordered scan resolves inherited collation outside each comparison`, async () => {
+  const collection = createCollationCollection(
+    { stringSort: `lexical` },
+    `off`,
+    undefined,
+    [`f`, `e`, `d`, `c`, `b`, `a`],
+  )
+
+  await withCollectionCleanup(collection, async () => {
+    await collection.stateWhenReady()
+    const optionReads = vi.spyOn(collection, `compareOptions`, `get`)
+    const rows = collection.currentStateAsChanges({
+      orderBy: [
+        {
+          expression: new PropRef([`label`]),
+          compareOptions: { direction: `asc`, nulls: `first` },
+        },
+      ],
+    })
+
+    expect(rows?.map(({ value }) => value.label)).toEqual([
+      `a`,
+      `b`,
+      `c`,
+      `d`,
+      `e`,
+      `f`,
+    ])
+    // One resolution can check the index path; the scan needs only one more.
+    expect(optionReads.mock.calls.length).toBeLessThanOrEqual(2)
+    expect(collection.indexes.size).toBe(0)
+  })
+})
+describe.each([
+  [`BasicIndex`, BasicIndex],
+  [`BTreeIndex`, BTreeIndex],
+] as const)(`%s prefixed-string public order`, (_name, IndexType) => {
+  test.each(prefixedStringCases)(
+    `$name scan and bounded index return the same first row`,
+    async ({ collation }) => {
+      const labels = [plainLabel, prefixedLabel]
+      expect(prefixedLabel.localeCompare(plainLabel, `en-US`)).toBeLessThan(0)
+      const orderBy = [
+        {
+          expression: new PropRef([`label`]),
+          compareOptions: {
+            direction: `asc` as const,
+            nulls: `first` as const,
+          },
+        },
+      ]
+
+      const scan = createCollationCollection(
+        collation,
+        `off`,
+        undefined,
+        labels,
+      )
+      await withCollectionCleanup(scan, async () => {
+        await scan.stateWhenReady()
+        const changes = scan.currentStateAsChanges({ orderBy, limit: 1 })
+        expect(changes?.map(({ value }) => value.label)).toEqual([
+          prefixedLabel,
+        ])
+        expect(scan.indexes.size, `scan path reached`).toBe(0)
+      })
+
+      const indexed = createCollationCollection(
+        collation,
+        `eager`,
+        IndexType,
+        labels,
+      )
+      await withCollectionCleanup(indexed, async () => {
+        await indexed.stateWhenReady()
+        const changes = indexed.currentStateAsChanges({
+          orderBy,
+          limit: 1,
+          optimizedOnly: true,
+        })
+        expect(changes?.map(({ value }) => value.label)).toEqual([
+          prefixedLabel,
+        ])
+        expect(indexed.indexes.size, `index path reached`).toBe(1)
+      })
+    },
+  )
+})
+describe.each(indexTypes)(`%s binary-value ownership`, (_name, IndexType) => {
+  test.each([2, 8193])(
+    `compares every byte for exact membership (%i bytes)`,
+    (length) => {
+      const index = new IndexType(1, new PropRef([`value`]))
+      const left = new Uint8Array(length)
+      left[0] = 1
+      const right = left.slice()
+      right[length - 1] = 1
+      index.add(`left`, { value: left })
+      index.add(`right`, { value: right })
+      expect(index.equalityLookup(left.slice())).toEqual(new Set([`left`]))
+      expect(index.equalityLookup(right.slice())).toEqual(new Set([`right`]))
+      for (const read of [
+        index.takeFromStart(3),
+        index.takeReversedFromEnd(3),
+      ]) {
+        expect(read).toHaveLength(2)
+        expect(new Set(read)).toEqual(new Set([`left`, `right`]))
+      }
+    },
+  )
+})
+/**
+ * A bounded read should not make more comparator calls as retired values
+ * accumulate. A fixed history retains one row while adding and removing 16,
+ * 64, or 256 earlier values. A user comparator records calls made by the
+ * public takeFromStart method after each history. This witnesses comparator
+ * work only: a traversal over tombstones that avoids the comparator could
+ * pass, and retained memory is measured separately.
+ */
+describe.each(indexTypes)(`%s retired-value read work`, (_name, IndexType) => {
+  test(`takeFromStart comparator work does not grow with retired values`, () => {
+    const comparisons = [16, 64, 256].map((retiredCount) => {
+      let calls = 0
+      const index = new IndexType(1, new PropRef([`value`]), undefined, {
+        compareFn: (left: unknown, right: unknown) => {
+          calls++
+          return (left as number) - (right as number)
+        },
+      })
+      index.add(`live`, { value: 1000 })
+      for (let value = 0; value < retiredCount; value++) {
+        const key = String(value)
+        index.add(key, { value })
+        index.remove(key, { value })
+      }
+      expect(index.keyCount).toBe(1)
+      calls = 0
+      expect(index.takeFromStart(1)).toEqual([`live`])
+      return calls
+    })
+
+    expect(comparisons[2]).toBeLessThanOrEqual(comparisons[0]! + 4)
+  })
+})
+/**
+ * Distinct exact values can share one comparator position. An ordered first
+ * row still requires sorting that group's keys, but it need not recompare
+ * every value in the group. The fixed 16/64/256 sizes distinguish a grouped
+ * read from one tree search per tied exact value. This bounds comparator work
+ * at the direct read checkpoint, not elapsed time or retained memory.
+ */
+test(`BTreeIndex bounded reads do not recompare every live tie`, () => {
+  const comparisons = [16, 64, 256].map((count) => {
+    let calls = 0
+    const index = new BTreeIndex<string>(1, new PropRef([`value`]), undefined, {
+      compareFn: () => {
+        calls++
+        return 0
+      },
+    })
+    for (let value = 0; value < count; value++) {
+      index.add(String(value), { value })
+    }
+    calls = 0
+    expect(index.takeFromStart(1)).toEqual([`0`])
+    return calls
+  })
+  expect(comparisons[2]).toBeLessThanOrEqual(comparisons[0]! + 4)
+})
+/**
+ * Preserve a bounded legacy callback input: older indexes supplied a Date's
+ * timestamp and a string for Temporal and binary values. For two immutable
+ * values of each named kind, a direct add comparison supplies that same scalar
+ * kind in both index types. The model uses two values with a known order; it
+ * does not copy or specify the index's string encoding. A callback that accepts
+ * only the old scalar kind distinguishes a raw-object leak. After both adds,
+ * full ordered keys and exact owners must match the supplied facts. This does
+ * not establish arbitrary callbacks, build/update/range paths, or mutation of
+ * the value objects after admission.
+ */
+describe.each(indexTypes)(
+  `%s comparator input compatibility`,
+  (_name, IndexType) => {
+    test.each([
+      {
+        name: `Date`,
+        values: [new Date(1), new Date(2)],
+        kind: `number`,
+      },
+      {
+        name: `Temporal.Instant`,
+        values: [
+          Temporal.Instant.from(`2020-01-01T00:00:00Z`),
+          Temporal.Instant.from(`2021-01-01T00:00:00Z`),
+        ],
+        kind: `string`,
+      },
+      {
+        name: `Uint8Array`,
+        values: [new Uint8Array([1]), new Uint8Array([2])],
+        kind: `string`,
+      },
+    ])(
+      `passes $name to callbacks in its legacy scalar kind`,
+      ({ values, kind }) => {
+        let comparisons = 0
+        const index = new IndexType(1, new PropRef([`value`]), undefined, {
+          compareFn: (left, right) => {
+            comparisons++
+            expect(typeof left).toBe(kind)
+            expect(typeof right).toBe(kind)
+            if (kind === `number`) return (left as number) - (right as number)
+            const a = left as string
+            const b = right as string
+            return a < b ? -1 : a > b ? 1 : 0
+          },
+        })
+        // Keys oppose value order, so collapsing both inputs to one comparator
+        // position cannot pass by key-tie ordering alone.
+        index.add(`a`, { value: values[1] })
+        index.add(`z`, { value: values[0] })
+        expect(comparisons).toBeGreaterThan(0)
+        expect(index.takeFromStart(2)).toEqual([`z`, `a`])
+        expect(index.equalityLookup(values[0])).toEqual(new Set([`z`]))
+        expect(index.equalityLookup(values[1])).toEqual(new Set([`a`]))
+      },
+    )
+  },
+)
diff --git a/packages/db/tests/indexed-db/ORACLE.md b/packages/db/tests/indexed-db/ORACLE.md
index b3fa8d86be..7354b82f1b 100644
--- a/packages/db/tests/indexed-db/ORACLE.md
+++ b/packages/db/tests/indexed-db/ORACLE.md
@@ -7,15 +7,15 @@ Their laws inform this suite; their host guarantees do not transfer to fake-IDB.
 
 ## Initial owners and checkpoints
 
-| Owner                               | Independent judgment                                                                                               | Production path and checkpoint                                                                                                                                                                                                                                 |
-| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| persistence-oracle.test.ts          | Two arrays of authored rows, keyed by store and typed key                                                          | Automatic CRUD, manual acceptance, clear/import, cleanup/restart and fresh restore. Compare public, subscription, peer, export, raw durable rows and version ownership after settlement and explicit message delivery.                                         |
-| settlement-oracle.test.ts           | Before/after snapshots selected by application decision; source deletion survives removal of an optimistic overlay | Held handlers, resolve/reject, clone failures at either position in a batch, IDB aborts, populated restore, remote delete/clear during pending local deletion. Observe handler entry, settlement, source delivery, successful suffix and reopen.               |
-| transport-oracle.test.ts            | Authored durable operation order; union of disjoint writes; exclusion of self/foreign messages                     | Delayed CRUD and replacement, inactive utility writers, administrative deletion, and initial-load cleanup/restart. Compare raw durable rows, every affected Collection and fresh restore after controlled delivery.                                            |
-| compatibility-oracle.test.ts        | Authored rows per store; independent DbClient sync runs; untouched-store version ownership                         | Crypto capability, reusable descriptors and injected factories without ambient IndexedDB globals. Compare public, peer and durable rows after writes, cleanup, replacement and restore.                                                                        |
-| wrapper.test.ts                     | Callback success AND native transaction completion are separate obligations                                        | Request success followed by abort; callback settlement after transaction completion; exact error identity, multi-store rollback, request values, upgrades and deletion.                                                                                        |
-| wrapper-settlement-oracle.test.ts   | Independent callback/native outcome conjunction, unaffected by observer registration                               | Complete/abort × five observer registrations × immediate/held callback; native terminal and callback-release checkpoints, authored durable rows and exact user observer events. Canceled/uncanceled request-error neighbors distinguish progress from outcome. |
-| api.test.ts and indexeddb.test-d.ts | Configuration, schema and type contracts                                                                           | Synchronous validation, reserved metadata store, transformed import inputs, duplicate rejection, utilities and precise API types.                                                                                                                              |
+| Owner                                                                   | Independent judgment                                                                                               | Production path and checkpoint                                                                                                                                                                                                                                 |
+| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| persistence-oracle.test.ts                                              | Two arrays of authored rows, keyed by store and typed key                                                          | Automatic CRUD, manual acceptance, clear/import, cleanup/restart and fresh restore. Compare public, subscription, peer, export, raw durable rows and version ownership after settlement and explicit message delivery.                                         |
+| settlement.test.ts (fixed tests; no oracle owner (tracked in #2264))    | Before/after snapshots selected by application decision; source deletion survives removal of an optimistic overlay | Held handlers, resolve/reject, clone failures at either position in a batch, IDB aborts, populated restore, remote delete/clear during pending local deletion. Observe handler entry, settlement, source delivery, successful suffix and reopen.               |
+| transport-oracle.test.ts                                                | Authored durable operation order; union of disjoint writes; exclusion of self/foreign messages                     | Delayed CRUD and replacement, inactive utility writers, administrative deletion, and initial-load cleanup/restart. Compare raw durable rows, every affected Collection and fresh restore after controlled delivery.                                            |
+| compatibility.test.ts (fixed tests; no oracle owner (tracked in #2264)) | Authored rows per store; independent DbClient sync runs; untouched-store version ownership                         | Crypto capability, reusable descriptors and injected factories without ambient IndexedDB globals. Compare public, peer and durable rows after writes, cleanup, replacement and restore.                                                                        |
+| wrapper.test.ts                                                         | Callback success AND native transaction completion are separate obligations                                        | Request success followed by abort; callback settlement after transaction completion; exact error identity, multi-store rollback, request values, upgrades and deletion.                                                                                        |
+| wrapper-settlement-oracle.test.ts                                       | Independent callback/native outcome conjunction, unaffected by observer registration                               | Complete/abort × five observer registrations × immediate/held callback; native terminal and callback-release checkpoints, authored durable rows and exact user observer events. Canceled/uncanceled request-error neighbors distinguish progress from outcome. |
+| api.test.ts and indexeddb.test-d.ts                                     | Configuration, schema and type contracts                                                                           | Synchronous validation, reserved metadata store, transformed import inputs, duplicate rejection, utilities and precise API types.                                                                                                                              |
 
 harness.ts owns setup, raw IDB requests, controlled transport and cleanup. It
 supplies the provider and transport, never expected product results. It removes
@@ -175,7 +175,7 @@ core `truncate({ markReady: false })`. The separate core
 `truncate-readiness-oracle.test.ts` checks default recovery, explicit status
 preservation, optimistic holds, and composed reentrant replacements.
 
-`deletion-queue-oracle.test.ts` owns the native name queue and receipt authority
+`deletion-queue.test.ts` (fixed tests; no oracle owner (tracked in #2264)) holds the native name queue and receipt authority
 projection from `deletion_queue_oracle.tla`. Native deletion and caller receipt are
 separate cuts. Old receipts are delivered before/after recreation, while the new
 deletion is blocked, between its native success and caller, and after its caller.
@@ -284,7 +284,7 @@ The executable companions keep distinct responsibilities:
 | `cross-tab-boundary-oracle.test.ts`                                              | Stale-peer admission, genuine optional-field omission, caught/spurious/obsolete status, overlap and atomic replacement                                                                        | Positive boundary witnesses, partial-row and status controls, serial-fixture non-reach; 16 sender/delivery schedules in the history owner                                  |
 | `pending-history-oracle.test.ts`                                                 | One held multi-row intent, durable rows, exposed base, queued source batches and acknowledgement attribution; public/raw/downstream snapshots at handler entry, each peer step and settlement | 24 CRUD × peer action × decision cases, with all actual peer CRUD operations reached; 30+30 generated histories of up to four peer actions, 1–3 local rows; stress 300+300 |
 | `persistence-oracle.test.ts`                                                     | Three distinct Collection owners, mixed deletes/inserts, two stores and version isolation after each acceptance                                                                               | All six acceptance orders; no cross-Collection atomicity or same-ID identity policy                                                                                        |
-| `settlement-oracle.test.ts`                                                      | Failure before, within and after valid rows in a three-row native batch                                                                                                                       | First/middle/last clone failures × automatic/manual/import, each a `SerializationError`, with populated replacement rollback                                               |
+| `settlement.test.ts` (fixed tests; no oracle owner (tracked in #2264))           | Failure before, within and after valid rows in a three-row native batch                                                                                                                       | First/middle/last clone failures × automatic/manual/import, each a `SerializationError`, with populated replacement rollback                                               |
 | `e2e/indexed-db/cross-tab-oracle.spec.ts`                                        | Native IndexedDB and BroadcastChannel, independent same-origin pages, runner-owned raw evidence                                                                                               | Chromium, Firefox and WebKit; pinned receiving matrix and 10 fixed + 10 fresh histories per engine                                                                         |
 
 The transport model combines exposed base and public rows only when local
@@ -469,7 +469,7 @@ historical law-audit record preserves the earlier RED evidence.
 
 ## Donor value, initialization and package receiving extension
 
-`compatibility-oracle.test.ts` extends the same authored per-store array model
+`compatibility.test.ts` (fixed tests; no oracle owner (tracked in #2264)) extends the same authored per-store array model
 with six legal names, prefix neighbors and two/three competing first opens.
 First-open calls reach the native queue before any call settles, against an
 absent name. Held real transactions distinguish restore admission from readiness.
@@ -531,7 +531,7 @@ both property orders and existing one-argument subclass construction. Browser
 iframe witnesses receive foreign standard values; concurrent shared-memory
 writers and detached/resizable buffers are not modeled.
 
-The host owner in `e2e/indexed-db/host-oracle.spec.ts` uses authored per-store arrays across
+The host tests in `e2e/indexed-db/host.spec.ts` (fixed tests; no oracle owner (tracked in #2264)) use authored per-store arrays across
 six legal names, prefix neighbors and anchor stores. It receives numeric and
 string keys together in a single transaction, peer updates, import, clear,
 export and fresh restore. The core payload owner independently checks both key
diff --git a/packages/db/tests/indexed-db/compatibility-oracle.test.ts b/packages/db/tests/indexed-db/compatibility.test.ts
similarity index 98%
rename from packages/db/tests/indexed-db/compatibility-oracle.test.ts
rename to packages/db/tests/indexed-db/compatibility.test.ts
index eb115ace17..92df49ab5a 100644
--- a/packages/db/tests/indexed-db/compatibility-oracle.test.ts
+++ b/packages/db/tests/indexed-db/compatibility.test.ts
@@ -1,5 +1,9 @@
 /**
- * Compatibility boundary oracle.
+ * Compatibility boundary tests. This file declares no check or model: its
+ * expectations are authored rows per store, written into each scenario, and it
+ * generates no histories. The law below is the boundary's authority. Until a
+ * generated grammar and model own it, these are supplemental scenarios (see
+ * ORACLE.md).
  *
  * Authority: safeRandomUUID's supported capability domain, the first-party
  * DbClient materialization contract, and createIndexedDB's custom-factory API.
diff --git a/packages/db/tests/indexed-db/cross-tab-oracle.ts b/packages/db/tests/indexed-db/cross-tab-oracle.ts
index dd0df9dcc1..5420e5c15a 100644
--- a/packages/db/tests/indexed-db/cross-tab-oracle.ts
+++ b/packages/db/tests/indexed-db/cross-tab-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../oracle-declaration.js'
 /**
  * Independent cross-tab publication model.
  *
@@ -254,3 +255,13 @@ export function assertReplay(record: ReplayRecord) {
       record,
     )
 }
+
+declareOracle({
+  check: [
+    assertSnapshot,
+    assertStatuses,
+    assertPublicationHistory,
+    assertReplay,
+  ],
+  model: [CrossTabModel],
+})
diff --git a/packages/db/tests/indexed-db/deletion-queue-oracle.test.ts b/packages/db/tests/indexed-db/deletion-queue.test.ts
similarity index 94%
rename from packages/db/tests/indexed-db/deletion-queue-oracle.test.ts
rename to packages/db/tests/indexed-db/deletion-queue.test.ts
index ae67931094..3444053547 100644
--- a/packages/db/tests/indexed-db/deletion-queue-oracle.test.ts
+++ b/packages/db/tests/indexed-db/deletion-queue.test.ts
@@ -1,8 +1,13 @@
 /**
- * Administrative delete-by-name follows the native connection queue. Its
- * receipt has no Collection publication authority, even across recreation and
- * a second blocked deletion. This refines deletion_queue_oracle.tla: lifetimes
- * A/B below are test identities only, never stored database metadata.
+ * Scenario tests for administrative delete-by-name. They declare no check or
+ * model and generate no histories: each cell asserts literal outcomes, so this
+ * file is not an oracle. The TLA spec deletion_queue_oracle.tla, cited in
+ * ORACLE.md, states the refined law; these scenarios mirror it by hand.
+ *
+ * Authority: administrative delete-by-name follows the native connection
+ * queue. Its receipt has no Collection publication authority, even across
+ * recreation and a second blocked deletion. Lifetimes A/B below are test
+ * identities only, never stored database metadata.
  *
  * The grammar crosses old transaction/blocker release order with old receipt
  * delivery before recreation, after recreation, during B's blocked deletion,
@@ -10,6 +15,7 @@
  * native success; this models delivery delay, not a claim about browser tasks.
  * Every checkpoint checks native/caller outcome separately, retained public
  * rows, and sticky error status. Native blockers and writes are real IDB work.
+
  */
 import { expect, it, vi } from 'vitest'
 import { deleteDatabase } from '../../src'
diff --git a/packages/db/tests/indexed-db/local-write-order-oracle.test.ts b/packages/db/tests/indexed-db/local-write-order-oracle.test.ts
index e4d3e32228..10f0e549d8 100644
--- a/packages/db/tests/indexed-db/local-write-order-oracle.test.ts
+++ b/packages/db/tests/indexed-db/local-write-order-oracle.test.ts
@@ -18,6 +18,8 @@
  * specified here. harness.ts controls handlers and observes raw durable rows.
  */
 import { expect, it } from 'vitest'
+import { declareOracle } from '../oracle-declaration'
+import { initial } from './local-write-support'
 import {
   Channel,
   assertRows,
@@ -29,10 +31,6 @@ import {
 import type { Row } from './harness'
 
 type Effect = { key: number; row: Row | undefined }
-const initial: Array<Row> = [
-  { id: 1, name: 'initial' },
-  { id: 2, name: 'anchor' },
-]
 const grammars: Record<string, Array<Effect>> = {
   sameKey: [
     { key: 1, row: { id: 1, name: 'A' } },
@@ -68,6 +66,10 @@ function expectedRows(effects: Array<Effect>, mask: number, before = initial) {
   })
   return [...rows.values()]
 }
+// expectedRows is the model: the durable fold of the authored effects that the
+// mask accepts, in author order, from the rows that the peer action leaves.
+declareOracle({ model: [expectedRows] })
+
 for (const [kind, effects] of Object.entries(grammars)) {
   for (const peerAction of ['none', 'update', 'delete', 'replace'] as const)
     for (const order of orders)
@@ -191,127 +193,3 @@ for (const [kind, effects] of Object.entries(grammars)) {
         })
       }
 }
-
-// Releasing every handler before observing would miss premature later commits.
-// A native read supplies the cut while the first handler is explicitly held.
-it('holds a later accepted update until the earlier handler settles', async () => {
-  await withHarness(async (h) => {
-    await seed(h.db, 'items', initial)
-    const first = deferred(),
-      entered = deferred(),
-      later = deferred()
-    let calls = 0
-    const c = await h.open('items', {
-      onUpdate: async () => {
-        if (calls++ === 0) {
-          entered.resolve()
-          return first.promise
-        }
-        later.resolve()
-        return undefined
-      },
-    })
-    const a = c.update(1, (row) => {
-        row.name = 'A'
-      }),
-      aOutcome = a.isPersisted.promise
-    await entered.promise
-    const b = c.update(1, (row) => {
-      row.name = 'B'
-    })
-    let settled = false
-    const bOutcome = b.isPersisted.promise.then(() => {
-      settled = true
-    })
-    await later.promise
-    const held = await readStore<Row>(h.db, 'items'),
-      early = settled
-    first.resolve()
-    await Promise.all([aOutcome, bOutcome])
-    expect(early, 'later caller still pending').toBe(false)
-    assertRows(held.rows, initial, 'earlier handler held: durable')
-    assertRows(
-      (await readStore<Row>(h.db, 'items')).rows,
-      [{ id: 1, name: 'B' }, initial[1]!],
-      'ordered final durable',
-    )
-  })
-})
-
-// Reentry is another legal invocation order: application code for the first
-// update authors a second update before returning its held decision. Reserving
-// order after calling that code lets the second write overtake the first.
-it('reserves mutation order before a handler authors another update', async () => {
-  await withHarness(async (h) => {
-    await seed(h.db, 'items', initial)
-    const gate = deferred()
-    let reentered = false,
-      later: Promise<unknown> | undefined
-    const c = await h.open('items', {
-      onUpdate: async () => {
-        if (!reentered) {
-          reentered = true
-          later = c.update(1, (row) => {
-            row.name = 'B'
-          }).isPersisted.promise
-          return gate.promise
-        }
-        return undefined
-      },
-    })
-    const first = c.update(1, (row) => {
-      row.name = 'A'
-    })
-    const held = await readStore<Row>(h.db, 'items')
-    gate.resolve()
-    await Promise.all([first.isPersisted.promise, later])
-    expect(reentered).toBe(true)
-    assertRows(held.rows, initial, 'reentered handler held')
-    assertRows(
-      (await readStore<Row>(h.db, 'items')).rows,
-      [{ id: 1, name: 'B' }, initial[1]!],
-      'reentrant mutation order',
-    )
-  })
-})
-
-// Failure of an earlier native batch has the same durable identity effect as a
-// rejected application decision. A later write was already authored when the
-// failure occurs; it must still persist. Same-key repair removes the uncloneable
-// field explicitly, so it is a legal new whole-row value, not a leaked bad input.
-for (const sameKey of [false, true]) {
-  it(`continues queued writes after native failure with same key ${sameKey}`, async () => {
-    await withHarness(async (h) => {
-      const c = await h.open()
-      const peer = await h.open('items', { db: await h.connect() })
-      const first = c.insert({ id: 1, name: 'invalid', unsupported: () => {} })
-      const rejected = first.isPersisted.promise.then(
-        () => false,
-        () => true,
-      )
-      const next = sameKey
-        ? c.update(1, (row) => {
-            row.name = 'valid'
-            delete row.unsupported
-          })
-        : c.insert({ id: 2, name: 'valid' })
-      await next.isPersisted.promise
-      expect(await rejected, 'native failure reaches the earlier caller').toBe(
-        true,
-      )
-      await Channel.deliver()
-      const expected = [{ id: sameKey ? 1 : 2, name: 'valid' }]
-      assertRows(
-        (await readStore<Row>(h.db, 'items')).rows,
-        expected,
-        'native failure ordered suffix',
-      )
-      for (const subject of [c, peer, await h.open()])
-        assertRows(
-          subject.values(),
-          expected,
-          'native failure public and restore',
-        )
-    })
-  })
-}
diff --git a/packages/db/tests/indexed-db/local-write-order.test.ts b/packages/db/tests/indexed-db/local-write-order.test.ts
new file mode 100644
index 0000000000..698c33ba3b
--- /dev/null
+++ b/packages/db/tests/indexed-db/local-write-order.test.ts
@@ -0,0 +1,138 @@
+// Ordinary tests for local write ordering. local-write-order-oracle.test.ts owns
+// the mutation-order law and its model. These fixed scenarios hold one handler
+// or reenter it, and compare with literal rows and the native failure outcome.
+import { expect, it } from 'vitest'
+import { initial } from './local-write-support'
+import {
+  Channel,
+  assertRows,
+  deferred,
+  readStore,
+  seed,
+  withHarness,
+} from './harness'
+import type { Row } from './harness'
+
+// Releasing every handler before observing would miss premature later commits.
+// A native read supplies the cut while the first handler is explicitly held.
+it('holds a later accepted update until the earlier handler settles', async () => {
+  await withHarness(async (h) => {
+    await seed(h.db, 'items', initial)
+    const first = deferred(),
+      entered = deferred(),
+      later = deferred()
+    let calls = 0
+    const c = await h.open('items', {
+      onUpdate: async () => {
+        if (calls++ === 0) {
+          entered.resolve()
+          return first.promise
+        }
+        later.resolve()
+        return undefined
+      },
+    })
+    const a = c.update(1, (row) => {
+        row.name = 'A'
+      }),
+      aOutcome = a.isPersisted.promise
+    await entered.promise
+    const b = c.update(1, (row) => {
+      row.name = 'B'
+    })
+    let settled = false
+    const bOutcome = b.isPersisted.promise.then(() => {
+      settled = true
+    })
+    await later.promise
+    const held = await readStore<Row>(h.db, 'items'),
+      early = settled
+    first.resolve()
+    await Promise.all([aOutcome, bOutcome])
+    expect(early, 'later caller still pending').toBe(false)
+    assertRows(held.rows, initial, 'earlier handler held: durable')
+    assertRows(
+      (await readStore<Row>(h.db, 'items')).rows,
+      [{ id: 1, name: 'B' }, initial[1]!],
+      'ordered final durable',
+    )
+  })
+})
+
+// Reentry is another legal invocation order: application code for the first
+// update authors a second update before returning its held decision. Reserving
+// order after calling that code lets the second write overtake the first.
+it('reserves mutation order before a handler authors another update', async () => {
+  await withHarness(async (h) => {
+    await seed(h.db, 'items', initial)
+    const gate = deferred()
+    let reentered = false,
+      later: Promise<unknown> | undefined
+    const c = await h.open('items', {
+      onUpdate: async () => {
+        if (!reentered) {
+          reentered = true
+          later = c.update(1, (row) => {
+            row.name = 'B'
+          }).isPersisted.promise
+          return gate.promise
+        }
+        return undefined
+      },
+    })
+    const first = c.update(1, (row) => {
+      row.name = 'A'
+    })
+    const held = await readStore<Row>(h.db, 'items')
+    gate.resolve()
+    await Promise.all([first.isPersisted.promise, later])
+    expect(reentered).toBe(true)
+    assertRows(held.rows, initial, 'reentered handler held')
+    assertRows(
+      (await readStore<Row>(h.db, 'items')).rows,
+      [{ id: 1, name: 'B' }, initial[1]!],
+      'reentrant mutation order',
+    )
+  })
+})
+
+// Failure of an earlier native batch has the same durable identity effect as a
+// rejected application decision. A later write was already authored when the
+// failure occurs; it must still persist. Same-key repair removes the uncloneable
+// field explicitly, so it is a legal new whole-row value, not a leaked bad input.
+for (const sameKey of [false, true]) {
+  it(`continues queued writes after native failure with same key ${sameKey}`, async () => {
+    await withHarness(async (h) => {
+      const c = await h.open()
+      const peer = await h.open('items', { db: await h.connect() })
+      const first = c.insert({ id: 1, name: 'invalid', unsupported: () => {} })
+      const rejected = first.isPersisted.promise.then(
+        () => false,
+        () => true,
+      )
+      const next = sameKey
+        ? c.update(1, (row) => {
+            row.name = 'valid'
+            delete row.unsupported
+          })
+        : c.insert({ id: 2, name: 'valid' })
+      await next.isPersisted.promise
+      expect(await rejected, 'native failure reaches the earlier caller').toBe(
+        true,
+      )
+      await Channel.deliver()
+      const expected = [{ id: sameKey ? 1 : 2, name: 'valid' }]
+      assertRows(
+        (await readStore<Row>(h.db, 'items')).rows,
+        expected,
+        'native failure ordered suffix',
+      )
+      for (const subject of [c, peer, await h.open()])
+        assertRows(
+          subject.values(),
+          expected,
+          'native failure public and restore',
+        )
+    })
+  })
+}
diff --git a/packages/db/tests/indexed-db/local-write-support.ts b/packages/db/tests/indexed-db/local-write-support.ts
new file mode 100644
index 0000000000..e21e78240a
--- /dev/null
+++ b/packages/db/tests/indexed-db/local-write-support.ts
@@ -0,0 +1,8 @@
+// Shared by the local write ordering oracle and its ordinary tests: the durable
+// row set before any local handler decides.
+import type { Row } from './harness'
+
+export const initial: Array<Row> = [
+  { id: 1, name: 'initial' },
+  { id: 2, name: 'anchor' },
+]
diff --git a/packages/db/tests/indexed-db/persistence-oracle.test.ts b/packages/db/tests/indexed-db/persistence-oracle.test.ts
index 4b30aaf855..ec503d093c 100644
--- a/packages/db/tests/indexed-db/persistence-oracle.test.ts
+++ b/packages/db/tests/indexed-db/persistence-oracle.test.ts
@@ -29,13 +29,12 @@ import {
   oracleRuns,
   recordOracleReplay,
 } from '../oracle-config'
+import { declareOracle } from '../oracle-declaration'
 import {
   Channel,
   assertRows,
-  completed,
   readStore,
   seed,
-  sorted,
   userRow,
   withHarness,
 } from './harness'
@@ -295,18 +294,6 @@ describe('settled histories', () => {
     }
     await runHistory([repeated, repeated])
   })
-  it('rejects wrong snapshots without erasing extra fields or typed keys', () => {
-    const expected = [{ id: 0, name: 'value' }]
-    for (const wrong of [
-      [],
-      [...expected, ...expected],
-      [{ id: '0', name: 'value' }],
-      [{ ...expected[0]!, optional: 1 }],
-    ]) {
-      expect(() => assertRows(wrong, expected, 'hostile snapshot')).toThrow()
-    }
-    expect(sorted(expected)).toEqual(expected)
-  })
 
   // A fixed campaign and a random campaign share one grammar and budget. A path
   // replay of this property selects only its random campaign.
@@ -348,6 +335,30 @@ describe('settled histories', () => {
   )
 })
 
+// The manual-acceptance model: accepting one owner removes its authored key from
+// its store and adds its authored row there. Other rows keep their values, since
+// each owner's acceptance is a separate native transaction.
+function acceptOwnerInModel(
+  expected: Array<Array<Row>>,
+  store: number,
+  removed: string | number,
+  added: Row,
+): void {
+  expected[store] = [
+    ...expected[store]!.filter((row) => row.id !== removed),
+    added,
+  ]
+}
+
+// runHistory is the production driver and refinement check for the settled
+// history law: each checkpoint compares public, subscription, durable, export,
+// peer and version rows with the authored model that it keeps for the history.
+// acceptOwnerInModel is the model of the manual-acceptance test below.
+declareOracle({
+  check: [runHistory],
+  model: [acceptOwnerInModel],
+})
+
 /** Three distinct Collection identities receive one mixed manual payload.
  * The ledger changes only for the selected owner's acceptance, in each of six
  * orders. Same-store owners use disjoint keys; the sibling store reuses a key.
@@ -403,11 +414,10 @@ it('manual acceptance partitions mixed payloads across three Collections in ever
               '_versions',
             )
             await collections[index]!.utils.acceptMutations(transaction)
-            const store = index === 2 ? 1 : 0
-            expected[store] = [
-              ...expected[store]!.filter((row) => row.id !== removed[index]),
-              { id: added[index]!, name: `owner ${index}` },
-            ]
+            acceptOwnerInModel(expected, index === 2 ? 1 : 0, removed[index]!, {
+              id: added[index]!,
+              name: `owner ${index}`,
+            })
             for (const [slot, name] of ['items', 'other'].entries())
               assertRows(
                 (await readStore<Row>(h.db, name)).rows,
@@ -462,80 +472,3 @@ it('manual acceptance partitions mixed payloads across three Collections in ever
     })
   }
 })
-
-// Version tokens detect changes; wall-clock values have no ordering authority.
-// Legacy records may retain timestamps, but new writes need only a token. The
-// authored row fold is identical for absent, past and future legacy timestamps.
-// Restore, an ordinary write and an import must preserve this relation. The
-// untouched anchor proves cleanup does not require rewriting old metadata.
-for (const timestamp of [undefined, -1, Number.MAX_SAFE_INTEGER]) {
-  it(`preserves legacy metadata semantics with timestamp ${timestamp}`, async () => {
-    await withHarness(async (h) => {
-      const initial = [
-        { id: 1, name: 'before' },
-        { id: 2, name: 'anchor' },
-      ]
-      await seed(h.db, 'items', initial)
-      const metadata = {
-        versionKey: 'legacy',
-        ...(timestamp === undefined ? {} : { updatedAt: timestamp }),
-      }
-      const tx = h.db.db.transaction('_versions', 'readwrite')
-      const done = completed(tx)
-      for (const row of initial)
-        tx.objectStore('_versions').put(metadata, ['items', row.id])
-      await done
-      const source = await h.open()
-      const peer = await h.open('items', { db: await h.connect() })
-      assertRows(source.values(), initial, 'legacy restore')
-      await source.update(1, (row) => {
-        row.name = 'after'
-      }).isPersisted.promise
-      await Channel.deliver()
-      const after = [{ id: 1, name: 'after' }, initial[1]!]
-      assertRows(
-        peer.values(),
-        after,
-        'legacy timestamp cannot suppress notification',
-      )
-      const versions = await readStore(h.db, '_versions')
-      const changed = versions.keys.findIndex(
-        (key) => JSON.stringify(key) === '["items",1]',
-      )
-      const untouched = versions.keys.findIndex(
-        (key) => JSON.stringify(key) === '["items",2]',
-      )
-      expect(
-        versions.rows[changed],
-        'new metadata has no unused timestamp',
-      ).toEqual({ versionKey: expect.any(String) })
-      expect(
-        versions.rows[untouched],
-        'legacy anchor need not migrate',
-      ).toEqual(metadata)
-      assertRows(
-        (await readStore<Row>(h.db, 'items')).rows,
-        after,
-        'legacy durable suffix',
-      )
-      assertRows((await h.open()).values(), after, 'mixed-format restore')
-      await source.utils.importData([{ id: 3, name: 'replacement' }])
-      await Channel.deliver()
-      const replacementVersions = await readStore(h.db, '_versions')
-      expect(replacementVersions.keys).toEqual([['items', 3]])
-      expect(replacementVersions.rows).toEqual([
-        { versionKey: expect.any(String) },
-      ])
-      assertRows(
-        peer.values(),
-        [{ id: 3, name: 'replacement' }],
-        'legacy replacement peer',
-      )
-      assertRows(
-        (await h.open()).values(),
-        [{ id: 3, name: 'replacement' }],
-        'legacy replacement restore',
-      )
-    })
-  })
-}
diff --git a/packages/db/tests/indexed-db/persistence.test.ts b/packages/db/tests/indexed-db/persistence.test.ts
new file mode 100644
index 0000000000..d4d1de67d8
--- /dev/null
+++ b/packages/db/tests/indexed-db/persistence.test.ts
@@ -0,0 +1,109 @@
+// Ordinary tests for the settled-history owner in persistence-oracle.test.ts.
+// They pin legacy version-metadata semantics and reject wrong snapshots with
+// literal values. The law they support is that version tokens, not wall-clock
+// timestamps, order changes, and that assertRows distinguishes typed keys and
+// extra fields. The model and check that the owner declares are in
+// persistence-oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import {
+  Channel,
+  assertRows,
+  completed,
+  readStore,
+  seed,
+  sorted,
+  withHarness,
+} from './harness'
+import type { Row } from './harness'
+
+describe('settled histories', () => {
+  it('rejects wrong snapshots without erasing extra fields or typed keys', () => {
+    const expected = [{ id: 0, name: 'value' }]
+    for (const wrong of [
+      [],
+      [...expected, ...expected],
+      [{ id: '0', name: 'value' }],
+      [{ ...expected[0]!, optional: 1 }],
+    ]) {
+      expect(() => assertRows(wrong, expected, 'hostile snapshot')).toThrow()
+    }
+    expect(sorted(expected)).toEqual(expected)
+  })
+})
+
+// Version tokens detect changes; wall-clock values have no ordering authority.
+// Legacy records may retain timestamps, but new writes need only a token. The
+// authored row fold is identical for absent, past and future legacy timestamps.
+// Restore, an ordinary write and an import must preserve this relation. The
+// untouched anchor proves cleanup does not require rewriting old metadata.
+for (const timestamp of [undefined, -1, Number.MAX_SAFE_INTEGER]) {
+  it(`preserves legacy metadata semantics with timestamp ${timestamp}`, async () => {
+    await withHarness(async (h) => {
+      const initial = [
+        { id: 1, name: 'before' },
+        { id: 2, name: 'anchor' },
+      ]
+      await seed(h.db, 'items', initial)
+      const metadata = {
+        versionKey: 'legacy',
+        ...(timestamp === undefined ? {} : { updatedAt: timestamp }),
+      }
+      const tx = h.db.db.transaction('_versions', 'readwrite')
+      const done = completed(tx)
+      for (const row of initial)
+        tx.objectStore('_versions').put(metadata, ['items', row.id])
+      await done
+      const source = await h.open()
+      const peer = await h.open('items', { db: await h.connect() })
+      assertRows(source.values(), initial, 'legacy restore')
+      await source.update(1, (row) => {
+        row.name = 'after'
+      }).isPersisted.promise
+      await Channel.deliver()
+      const after = [{ id: 1, name: 'after' }, initial[1]!]
+      assertRows(
+        peer.values(),
+        after,
+        'legacy timestamp cannot suppress notification',
+      )
+      const versions = await readStore(h.db, '_versions')
+      const changed = versions.keys.findIndex(
+        (key) => JSON.stringify(key) === '["items",1]',
+      )
+      const untouched = versions.keys.findIndex(
+        (key) => JSON.stringify(key) === '["items",2]',
+      )
+      expect(
+        versions.rows[changed],
+        'new metadata has no unused timestamp',
+      ).toEqual({ versionKey: expect.any(String) })
+      expect(
+        versions.rows[untouched],
+        'legacy anchor need not migrate',
+      ).toEqual(metadata)
+      assertRows(
+        (await readStore<Row>(h.db, 'items')).rows,
+        after,
+        'legacy durable suffix',
+      )
+      assertRows((await h.open()).values(), after, 'mixed-format restore')
+      await source.utils.importData([{ id: 3, name: 'replacement' }])
+      await Channel.deliver()
+      const replacementVersions = await readStore(h.db, '_versions')
+      expect(replacementVersions.keys).toEqual([['items', 3]])
+      expect(replacementVersions.rows).toEqual([
+        { versionKey: expect.any(String) },
+      ])
+      assertRows(
+        peer.values(),
+        [{ id: 3, name: 'replacement' }],
+        'legacy replacement peer',
+      )
+      assertRows(
+        (await h.open()).values(),
+        [{ id: 3, name: 'replacement' }],
+        'legacy replacement restore',
+      )
+    })
+  })
+}
diff --git a/packages/db/tests/indexed-db/retirement-oracle.test.ts b/packages/db/tests/indexed-db/retirement-oracle.test.ts
index 795eac8a2f..e005f8955a 100644
--- a/packages/db/tests/indexed-db/retirement-oracle.test.ts
+++ b/packages/db/tests/indexed-db/retirement-oracle.test.ts
@@ -3,11 +3,13 @@
  * accepted sync obligations. This is the production refinement owner for the
  * finish policy in review-evidence/deletion-tla/retirement_oracle.tla.
  *
- * The independent model folds authored row operations only when the native
- * outcome commits. Each operation owns a different Collection on one shared
- * descriptor. Its local confirmation describes its own write; it need not
- * observe another Collection after closure. Disk follows native FIFO admission.
- * A closed Collection stays errored at every status event and caller checkpoint.
+ * The independent model, apply, folds authored row operations only when the
+ * native outcome commits. Each operation owns a different Collection on one
+ * shared descriptor. Its local confirmation describes its own write; it need
+ * not observe another Collection after closure. Disk follows native FIFO
+ * admission. A closed Collection stays errored at every status event and caller
+ * checkpoint. Ordinary scenario tests for the remaining cases are in
+ * retirement.test.ts.
  *
  * Grammar: all pairs of insert/update/delete/clear/import, both native admission
  * orders, both native outcomes per operation, and explicit/upgrade/delete close.
@@ -16,34 +18,31 @@
  * Native gates issue real requests; no IndexedDB transaction awaits a test gate.
  * These finite schedules cover the semantic cuts, not every TLC interleaving.
  */
-import { forceCloseDatabase } from 'fake-indexeddb'
 import { describe, expect, it, vi } from 'vitest'
-import { createTransaction, deleteDatabase } from '../../src'
+import { createTransaction } from '../../src'
+import { declareOracle } from '../oracle-declaration'
 import {
-  Channel,
   assertRows,
   deferred,
   readStore,
-  request,
   seed,
   sorted,
   withHarness,
 } from './harness'
 import { holdStore, observeTransactions } from './idb-driver'
+import {
+  close,
+  closed,
+  initial,
+  kinds,
+  observe,
+  reasons,
+  recordStatus,
+  start,
+} from './retirement-support'
+import type { Kind } from './retirement-support'
 import type { Row } from './harness'
 
-type Harness = Parameters<Parameters<typeof withHarness>[0]>[0]
-type Subject = ReturnType<Harness['make']>
-type Kind = 'insert' | 'update' | 'delete' | 'clear' | 'import'
-type Reason = 'explicit' | 'upgrade' | 'delete'
-const kinds: Array<Kind> = ['insert', 'update', 'delete', 'clear', 'import']
-const reasons: Array<Reason> = ['explicit', 'upgrade', 'delete']
-const initial: Array<Row> = [
-  { id: 1, name: 'one' },
-  { id: 2, name: 'two' },
-  { id: 'anchor', name: 'anchor' },
-]
-
 // Row truth comes from the authored operation and outcome, not adapter caches,
 // confirmation messages, or Collection output. Native abort is the identity.
 function apply(rows: Array<Row>, kind: Kind, owner: number): Array<Row> {
@@ -56,80 +55,8 @@ function apply(rows: Array<Row>, kind: Kind, owner: number): Array<Row> {
   if (kind === 'delete') return rows.filter((value) => value.id !== owner)
   return [...rows.filter((value) => value.id !== row.id), row]
 }
-function observe(
-  promise: Promise<unknown>,
-  capture: () => Array<Row> = () => [],
-) {
-  let atSettlement: Array<Row> | undefined
-  const result: {
-    state: 'pending' | 'fulfilled' | 'rejected'
-    reason?: unknown
-  } = { state: 'pending' }
-  const done = promise.then(
-    () => {
-      atSettlement = capture()
-      result.state = 'fulfilled'
-    },
-    (reason: unknown) => {
-      atSettlement = capture()
-      result.state = 'rejected'
-      result.reason = reason
-    },
-  )
-  return { result, done, snapshot: () => atSettlement }
-}
-function start(c: Subject, kind: Kind, owner: number): Promise<unknown> {
-  if (kind === 'clear') return c.utils.clearObjectStore()
-  if (kind === 'import') return c.utils.importData(apply([], kind, owner))
-  if (kind === 'insert')
-    return c.insert(apply([], kind, owner)[0]!).isPersisted.promise
-  if (kind === 'delete') return c.delete(owner).isPersisted.promise
-  return c.update(owner, (row) => {
-    row.name = `after-${owner}`
-  }).isPersisted.promise
-}
-function recordStatus(c: Subject) {
-  const statuses: Array<string> = []
-  c.on('status:change', ({ status }) => {
-    statuses.push(status)
-  })
-  return statuses
-}
-function closed(c: Subject, statuses: Array<string>) {
-  expect.soft(c.status, 'closed connection status').toBe('crashed')
-  const firstCrash = statuses.indexOf('crashed')
-  expect.soft(firstCrash, 'retirement is observable').toBeGreaterThanOrEqual(0)
-  expect
-    .soft(
-      statuses.slice(firstCrash).every((status) => status === 'crashed'),
-      'retired status stays crashed',
-    )
-    .toBe(true)
-}
 
-// An unmanaged connection permits independent durable reads while a native
-// upgrade/delete is blocked. Administrative success owns no Collection writes.
-async function close(h: Harness, reason: Reason) {
-  const inspector = await request(indexedDB.open(h.db.name, 1))
-  let administrative: Promise<unknown> = Promise.resolve()
-  h.disposers.push(async () => {
-    inspector.close()
-    await administrative
-  })
-  if (reason === 'explicit') h.db.close()
-  else {
-    const announced = deferred()
-    h.db.db.addEventListener('versionchange', () => announced.resolve(), {
-      once: true,
-    })
-    administrative =
-      reason === 'delete'
-        ? deleteDatabase(h.db.name)
-        : request(indexedDB.open(h.db.name, 2)).then((db) => db.close())
-    await announced.promise
-  }
-  return { ...h.db, db: inspector }
-}
+declareOracle({ model: [apply] })
 
 const pairCells = kinds.flatMap((first) =>
   kinds.flatMap((second) =>
@@ -273,47 +200,6 @@ describe('admitted native writes retain their actual outcome after closure', ()
 })
 
 for (const reason of reasons) {
-  for (const decision of ['resolve', 'reject'] as const) {
-    it(`does not admit a ${decision}d handler after ${reason} closure`, async () => {
-      await withHarness(async (h) => {
-        await seed(h.db, 'items', initial)
-        const decisionGate = deferred()
-        h.disposers.push(() => decisionGate.resolve())
-        const c = await h.open('items', {
-          onUpdate: () => decisionGate.promise,
-        })
-        const statuses = recordStatus(c)
-        const native = observeTransactions(h.db.db)
-        h.disposers.push(() => native.restore())
-        const caller = observe(start(c, 'update', 1))
-        const inspector = await close(h, reason)
-        expect(caller.result.state).toBe('pending')
-        const failure = new Error('application rejected')
-        if (decision === 'resolve') decisionGate.resolve()
-        else decisionGate.reject(failure)
-        await caller.done
-        expect(caller.result.state).toBe('rejected')
-        if (decision === 'reject') expect(caller.result.reason).toBe(failure)
-        expect(native.entries).toHaveLength(0)
-        assertRows(c.values(), initial, 'unadmitted write rolls back')
-        assertRows(
-          (await readStore<Row>(inspector, 'items')).rows,
-          initial,
-          'unadmitted disk',
-        )
-        closed(c, statuses)
-        // Utilities bypass Collection mutation admission but cannot bypass the
-        // native connection boundary. Late startup also has no read authority.
-        for (const kind of ['clear', 'import'] as const)
-          await expect(start(c, kind, 1)).rejects.toThrow()
-        const late = h.make()
-        const lateStatuses = recordStatus(late)
-        await expect(late.preload()).rejects.toThrow()
-        closed(late, lateStatuses)
-        expect(native.entries).toHaveLength(0)
-      })
-    })
-  }
   for (const kind of ['insert', 'update', 'delete'] as const) {
     it(`publishes accepted ${kind} before caller settlement after ${reason}`, async () => {
       await withHarness(async (h) => {
@@ -368,70 +254,6 @@ for (const reason of reasons) {
       })
     })
   }
-  for (const read of ['initial', 'replacement', 'targeted'] as const) {
-    it(`rejects late ${read} publication after ${reason}`, async () => {
-      await withHarness(async (h) => {
-        await seed(h.db, 'items', initial)
-        const c = read === 'initial' ? h.make() : await h.open()
-        const statuses = recordStatus(c)
-        if (read !== 'initial') {
-          const sender = await h.open()
-          if (read === 'replacement')
-            await sender.utils.importData([{ id: 3, name: 'new snapshot' }])
-          else
-            await sender.update(1, (row) => {
-              row.name = 'peer update'
-            }).isPersisted.promise
-        }
-        const gate = holdStore(h.db.db)
-        h.disposers.push(() => gate.release())
-        await gate.started
-        const native = observeTransactions(h.db.db)
-        h.disposers.push(() => native.restore())
-        const loading = read === 'initial' ? observe(c.preload()) : undefined
-        while (Channel.pending.length) Channel.dispatch()
-        await vi.waitFor(() =>
-          expect(
-            native.entries.some((entry) => entry.mode === 'readonly'),
-          ).toBe(true),
-        )
-        await close(h, reason)
-        closed(c, statuses)
-        await gate.release()
-        await Channel.drain()
-        await vi.waitFor(() =>
-          expect(
-            native.entries.every((entry) => entry.status === 'complete'),
-          ).toBe(true),
-        )
-        await loading?.done
-        if (loading) expect(loading.result.state).toBe('rejected')
-        assertRows(
-          c.base.values(),
-          read === 'initial' ? [] : initial,
-          'obsolete read has no publication authority',
-        )
-        assertRows(
-          c.values(),
-          read === 'initial' ? [] : initial,
-          'obsolete public snapshot',
-        )
-        closed(c, statuses)
-        const count = native.entries.length
-        const injector = new Channel(`tanstack-db:${h.db.name}`)
-        injector.postMessage({
-          type: 'data-changed',
-          database: h.db.name,
-          name: 'items',
-          tabId: 'later',
-          changedKeys: [1],
-        })
-        injector.close()
-        await Channel.drain()
-        expect(native.entries).toHaveLength(count)
-      })
-    })
-  }
 }
 
 for (const kind of kinds) {
@@ -637,208 +459,3 @@ it.each(mixedCells)(
     })
   },
 )
-
-// Retirement is an atomic admission boundary from an application listener's
-// perspective. Reentry may start a utility or another Collection while siblings
-// have yet to receive their status event; neither can admit native work.
-for (const reason of reasons)
-  it(`closes native admission before exposing ${reason} retirement`, async () => {
-    await withHarness(async (h) => {
-      const c = await h.open(),
-        sibling = await h.open('other')
-      const native = observeTransactions(h.db.db)
-      h.disposers.push(() => native.restore())
-      const attempts: Array<ReturnType<typeof observe>> = []
-      c.on('status:change', ({ status }) => {
-        if (status !== 'crashed') return
-        attempts.push(
-          observe(sibling.utils.importData([{ id: 1, name: 'forbidden' }])),
-        )
-        const late = h.make()
-        const statuses = recordStatus(late)
-        const loading = observe(late.preload())
-        attempts.push(loading)
-        void loading.done.then(() => closed(late, statuses))
-      })
-      const inspector = await close(h, reason)
-      await Promise.all(attempts.map((attempt) => attempt.done))
-      expect(attempts).toHaveLength(2)
-      expect(attempts.map((attempt) => attempt.result.state)).toEqual([
-        'rejected',
-        'rejected',
-      ])
-      expect(native.entries).toHaveLength(0)
-      expect([c.status, sibling.status]).toEqual(['crashed', 'crashed'])
-      assertRows(
-        (await readStore<Row>(inspector, 'other')).rows,
-        [],
-        'reentrant utility cannot write',
-      )
-    })
-  })
-
-// A late initial read and a locally admitted write can share the same sync run.
-// Startup loses read authority on closure; that does not discard the separate
-// committed-write obligation. Expected base contains only the authored insert,
-// while native storage also retains the pre-existing row that was never restored.
-for (const reason of reasons)
-  it(`separates initial-read authority from admitted write confirmation after ${reason}`, async () => {
-    await withHarness(async (h) => {
-      await seed(h.db, 'items', initial)
-      const gate = holdStore(h.db.db)
-      h.disposers.push(() => gate.release())
-      await gate.started
-      const c = h.make()
-      const statuses = recordStatus(c)
-      const loading = observe(c.preload())
-      const native = observeTransactions(h.db.db)
-      h.disposers.push(() => native.restore())
-      const row = { id: 3, name: 'admitted during startup' }
-      const caller = observe(c.insert(row).isPersisted.promise, () =>
-        sorted(c.base.values()),
-      )
-      await vi.waitFor(() =>
-        expect(native.entries.some((entry) => entry.mode === 'readwrite')).toBe(
-          true,
-        ),
-      )
-      const inspector = await close(h, reason)
-      await gate.release()
-      await loading.done
-      await caller.done
-      expect(loading.result.state).toBe('rejected')
-      expect(caller.result.state).toBe('fulfilled')
-      assertRows(
-        caller.snapshot()!,
-        [row],
-        'startup write confirms before caller',
-      )
-      assertRows(
-        c.base.values(),
-        [row],
-        'obsolete initial read never publishes',
-      )
-      assertRows(
-        (await readStore<Row>(inspector, 'items')).rows,
-        [...initial, row],
-        'native startup write preserves unseen rows',
-      )
-      closed(c, statuses)
-    })
-  })
-
-it('ignores the retired database-deleted message protocol before storage work', async () => {
-  await withHarness(async (h) => {
-    const c = await h.open()
-    await seed(h.db, 'items', [{ id: 1, name: 'unseen' }])
-    const native = observeTransactions(h.db.db)
-    h.disposers.push(() => native.restore())
-    const sender = new Channel(`tanstack-db:${h.db.name}`)
-    sender.postMessage({
-      type: 'database-deleted',
-      database: h.db.name,
-      name: 'items',
-      tabId: 'obsolete',
-      changedKeys: [1],
-    })
-    sender.close()
-    await Channel.drain()
-    expect(native.entries).toHaveLength(0)
-    expect(c.status).toBe('ready')
-    assertRows(c.values(), [], 'obsolete message has no authority')
-  })
-})
-
-// Core reports user status-listener errors on a microtask. Connection closure
-// preserves that reporting contract while synchronously notifying every owner.
-it('notifies sibling Collections while preserving listener error reporting', async () => {
-  await withHarness(async (h) => {
-    const first = await h.open(),
-      sibling = await h.open('other')
-    const failure = new Error('application status listener')
-    first.on('status:change', ({ status }) => {
-      if (status === 'crashed') throw failure
-    })
-    const errors: Array<VoidFunction> = []
-    const scheduled = vi
-      .spyOn(globalThis, 'queueMicrotask')
-      .mockImplementation((callback) => {
-        errors.push(callback)
-      })
-    try {
-      expect(() => h.db.close()).not.toThrow()
-      expect([first.status, sibling.status]).toEqual(['crashed', 'crashed'])
-      expect(errors).toHaveLength(1)
-      expect(errors[0]).toThrow(failure)
-      await expect(sibling.utils.clearObjectStore()).rejects.toThrow()
-      expect(() => h.db.close()).not.toThrow()
-    } finally {
-      scheduled.mockRestore()
-    }
-  })
-})
-
-// Abnormal native closure differs from ordinary close: the provider aborts
-// admitted work. fake-IDB's forceCloseDatabase closes admission but omits the
-// spec's forced-abort step. Supply that premise with native transaction.abort(),
-// then use its real close path; dispatching an Event alone would be invalid.
-// A separate inspector holds storage so both loading and write prefixes reach
-// the pending native cut. The model retains committed rows, rejects unfinished
-// work, and keeps every attached Collection in error after the close event.
-for (const phase of ['idle', 'ready', 'loading', ...kinds] as const) {
-  it(`retains committed rows after abnormal native close during ${phase}`, async () => {
-    await withHarness(async (h) => {
-      await seed(h.db, 'items', initial)
-      const inspector = await h.connect()
-      const c =
-        phase === 'idle' || phase === 'loading' ? h.make() : await h.open()
-      const statuses = recordStatus(c)
-      const native = observeTransactions(h.db.db)
-      h.disposers.push(() => native.restore())
-      const gate = holdStore(inspector.db)
-      h.disposers.push(() => gate.release())
-      await gate.started
-      const pending =
-        phase === 'loading'
-          ? observe(c.preload())
-          : phase === 'idle' || phase === 'ready'
-            ? undefined
-            : observe(start(c, phase, 1))
-      if (pending)
-        await vi.waitFor(() => expect(native.entries.length).toBeGreaterThan(0))
-      const terminated = new Promise<void>((resolve) =>
-        h.db.db.addEventListener('close', () => resolve(), { once: true }),
-      )
-      for (const entry of native.entries) entry.transaction.abort()
-      // fake-IDB 6.2.5 incorrectly declares a constructor parameter; its
-      // documented runtime API takes the native database instance.
-      ;(forceCloseDatabase as unknown as (db: IDBDatabase) => void)(h.db.db)
-      await gate.release()
-      await terminated
-      expect(() => h.db.db.transaction('items')).toThrow()
-      if (pending) {
-        await pending.done
-        expect(pending.result.state).toBe('rejected')
-        expect(native.entries.map((entry) => entry.status)).toEqual(['abort'])
-      }
-      if (phase === 'idle') await expect(c.preload()).rejects.toThrow()
-      closed(c, statuses)
-      assertRows(
-        c.values(),
-        phase === 'idle' || phase === 'loading' ? [] : initial,
-        'retained public snapshot',
-      )
-      assertRows(
-        (await readStore<Row>(inspector, 'items')).rows,
-        initial,
-        'aborted work cannot change disk',
-      )
-      const fresh = await h.open('items', { db: inspector })
-      assertRows(
-        fresh.values(),
-        initial,
-        'new descriptor restores committed rows',
-      )
-    })
-  })
-}
diff --git a/packages/db/tests/indexed-db/retirement-support.ts b/packages/db/tests/indexed-db/retirement-support.ts
new file mode 100644
index 0000000000..17b31a8bdc
--- /dev/null
+++ b/packages/db/tests/indexed-db/retirement-support.ts
@@ -0,0 +1,103 @@
+// Shared by retirement-oracle.test.ts and retirement.test.ts: the authored
+// initial rows, the operation and reason grammar, and the observers that record
+// admitted and closed Collections. The model that folds these operations is
+// apply in retirement-oracle.test.ts.
+import { expect } from 'vitest'
+import { deleteDatabase } from '../../src'
+import { deferred, request } from './harness'
+import type { Row, withHarness } from './harness'
+
+export type Harness = Parameters<Parameters<typeof withHarness>[0]>[0]
+export type Subject = ReturnType<Harness['make']>
+export type Kind = 'insert' | 'update' | 'delete' | 'clear' | 'import'
+export type Reason = 'explicit' | 'upgrade' | 'delete'
+export const kinds: Array<Kind> = [
+  'insert',
+  'update',
+  'delete',
+  'clear',
+  'import',
+]
+export const reasons: Array<Reason> = ['explicit', 'upgrade', 'delete']
+export const initial: Array<Row> = [
+  { id: 1, name: 'one' },
+  { id: 2, name: 'two' },
+  { id: 'anchor', name: 'anchor' },
+]
+
+export function observe(
+  promise: Promise<unknown>,
+  capture: () => Array<Row> = () => [],
+) {
+  let atSettlement: Array<Row> | undefined
+  const result: {
+    state: 'pending' | 'fulfilled' | 'rejected'
+    reason?: unknown
+  } = { state: 'pending' }
+  const done = promise.then(
+    () => {
+      atSettlement = capture()
+      result.state = 'fulfilled'
+    },
+    (reason: unknown) => {
+      atSettlement = capture()
+      result.state = 'rejected'
+      result.reason = reason
+    },
+  )
+  return { result, done, snapshot: () => atSettlement }
+}
+export function start(c: Subject, kind: Kind, owner: number): Promise<unknown> {
+  if (kind === 'clear') return c.utils.clearObjectStore()
+  if (kind === 'import')
+    return c.utils.importData([{ id: owner, name: `after-${owner}` }])
+  if (kind === 'insert')
+    return c.insert({ id: `new-${owner}`, name: `after-${owner}` }).isPersisted
+      .promise
+  if (kind === 'delete') return c.delete(owner).isPersisted.promise
+  return c.update(owner, (row) => {
+    row.name = `after-${owner}`
+  }).isPersisted.promise
+}
+export function recordStatus(c: Subject) {
+  const statuses: Array<string> = []
+  c.on('status:change', ({ status }) => {
+    statuses.push(status)
+  })
+  return statuses
+}
+export function closed(c: Subject, statuses: Array<string>) {
+  expect.soft(c.status, 'closed connection status').toBe('crashed')
+  const firstCrash = statuses.indexOf('crashed')
+  expect.soft(firstCrash, 'retirement is observable').toBeGreaterThanOrEqual(0)
+  expect
+    .soft(
+      statuses.slice(firstCrash).every((status) => status === 'crashed'),
+      'retired status stays crashed',
+    )
+    .toBe(true)
+}
+
+// An unmanaged connection permits independent durable reads while a native
+// upgrade/delete is blocked. Administrative success owns no Collection writes.
+export async function close(h: Harness, reason: Reason) {
+  const inspector = await request(indexedDB.open(h.db.name, 1))
+  let administrative: Promise<unknown> = Promise.resolve()
+  h.disposers.push(async () => {
+    inspector.close()
+    await administrative
+  })
+  if (reason === 'explicit') h.db.close()
+  else {
+    const announced = deferred()
+    h.db.db.addEventListener('versionchange', () => announced.resolve(), {
+      once: true,
+    })
+    administrative =
+      reason === 'delete'
+        ? deleteDatabase(h.db.name)
+        : request(indexedDB.open(h.db.name, 2)).then((db) => db.close())
+    await announced.promise
+  }
+  return { ...h.db, db: inspector }
+}
diff --git a/packages/db/tests/indexed-db/retirement.test.ts b/packages/db/tests/indexed-db/retirement.test.ts
new file mode 100644
index 0000000000..1ba450fe35
--- /dev/null
+++ b/packages/db/tests/indexed-db/retirement.test.ts
@@ -0,0 +1,341 @@
+// Ordinary tests for connection retirement. retirement-oracle.test.ts owns the
+// native-outcome fold (apply) and the mixed-prefix laws. These scenarios compare
+// with literal rows, literal statuses, or the premises that they establish, so
+// they are supplemental coverage. Their shared helpers are in
+// retirement-support.ts.
+import { forceCloseDatabase } from 'fake-indexeddb'
+import { expect, it, vi } from 'vitest'
+import {
+  Channel,
+  assertRows,
+  deferred,
+  readStore,
+  seed,
+  sorted,
+  withHarness,
+} from './harness'
+import { holdStore, observeTransactions } from './idb-driver'
+import {
+  close,
+  closed,
+  initial,
+  kinds,
+  observe,
+  reasons,
+  recordStatus,
+  start,
+} from './retirement-support'
+import type { Row } from './harness'
+
+for (const reason of reasons) {
+  for (const decision of ['resolve', 'reject'] as const) {
+    it(`does not admit a ${decision}d handler after ${reason} closure`, async () => {
+      await withHarness(async (h) => {
+        await seed(h.db, 'items', initial)
+        const decisionGate = deferred()
+        h.disposers.push(() => decisionGate.resolve())
+        const c = await h.open('items', {
+          onUpdate: () => decisionGate.promise,
+        })
+        const statuses = recordStatus(c)
+        const native = observeTransactions(h.db.db)
+        h.disposers.push(() => native.restore())
+        const caller = observe(start(c, 'update', 1))
+        const inspector = await close(h, reason)
+        expect(caller.result.state).toBe('pending')
+        const failure = new Error('application rejected')
+        if (decision === 'resolve') decisionGate.resolve()
+        else decisionGate.reject(failure)
+        await caller.done
+        expect(caller.result.state).toBe('rejected')
+        if (decision === 'reject') expect(caller.result.reason).toBe(failure)
+        expect(native.entries).toHaveLength(0)
+        assertRows(c.values(), initial, 'unadmitted write rolls back')
+        assertRows(
+          (await readStore<Row>(inspector, 'items')).rows,
+          initial,
+          'unadmitted disk',
+        )
+        closed(c, statuses)
+        // Utilities bypass Collection mutation admission but cannot bypass the
+        // native connection boundary. Late startup also has no read authority.
+        for (const kind of ['clear', 'import'] as const)
+          await expect(start(c, kind, 1)).rejects.toThrow()
+        const late = h.make()
+        const lateStatuses = recordStatus(late)
+        await expect(late.preload()).rejects.toThrow()
+        closed(late, lateStatuses)
+        expect(native.entries).toHaveLength(0)
+      })
+    })
+  }
+  for (const read of ['initial', 'replacement', 'targeted'] as const) {
+    it(`rejects late ${read} publication after ${reason}`, async () => {
+      await withHarness(async (h) => {
+        await seed(h.db, 'items', initial)
+        const c = read === 'initial' ? h.make() : await h.open()
+        const statuses = recordStatus(c)
+        if (read !== 'initial') {
+          const sender = await h.open()
+          if (read === 'replacement')
+            await sender.utils.importData([{ id: 3, name: 'new snapshot' }])
+          else
+            await sender.update(1, (row) => {
+              row.name = 'peer update'
+            }).isPersisted.promise
+        }
+        const gate = holdStore(h.db.db)
+        h.disposers.push(() => gate.release())
+        await gate.started
+        const native = observeTransactions(h.db.db)
+        h.disposers.push(() => native.restore())
+        const loading = read === 'initial' ? observe(c.preload()) : undefined
+        while (Channel.pending.length) Channel.dispatch()
+        await vi.waitFor(() =>
+          expect(
+            native.entries.some((entry) => entry.mode === 'readonly'),
+          ).toBe(true),
+        )
+        await close(h, reason)
+        closed(c, statuses)
+        await gate.release()
+        await Channel.drain()
+        await vi.waitFor(() =>
+          expect(
+            native.entries.every((entry) => entry.status === 'complete'),
+          ).toBe(true),
+        )
+        await loading?.done
+        if (loading) expect(loading.result.state).toBe('rejected')
+        assertRows(
+          c.base.values(),
+          read === 'initial' ? [] : initial,
+          'obsolete read has no publication authority',
+        )
+        assertRows(
+          c.values(),
+          read === 'initial' ? [] : initial,
+          'obsolete public snapshot',
+        )
+        closed(c, statuses)
+        const count = native.entries.length
+        const injector = new Channel(`tanstack-db:${h.db.name}`)
+        injector.postMessage({
+          type: 'data-changed',
+          database: h.db.name,
+          name: 'items',
+          tabId: 'later',
+          changedKeys: [1],
+        })
+        injector.close()
+        await Channel.drain()
+        expect(native.entries).toHaveLength(count)
+      })
+    })
+  }
+}
+
+// Retirement is an atomic admission boundary from an application listener's
+// perspective. Reentry may start a utility or another Collection while siblings
+// have yet to receive their status event; neither can admit native work.
+for (const reason of reasons)
+  it(`closes native admission before exposing ${reason} retirement`, async () => {
+    await withHarness(async (h) => {
+      const c = await h.open(),
+        sibling = await h.open('other')
+      const native = observeTransactions(h.db.db)
+      h.disposers.push(() => native.restore())
+      const attempts: Array<ReturnType<typeof observe>> = []
+      c.on('status:change', ({ status }) => {
+        if (status !== 'crashed') return
+        attempts.push(
+          observe(sibling.utils.importData([{ id: 1, name: 'forbidden' }])),
+        )
+        const late = h.make()
+        const statuses = recordStatus(late)
+        const loading = observe(late.preload())
+        attempts.push(loading)
+        void loading.done.then(() => closed(late, statuses))
+      })
+      const inspector = await close(h, reason)
+      await Promise.all(attempts.map((attempt) => attempt.done))
+      expect(attempts).toHaveLength(2)
+      expect(attempts.map((attempt) => attempt.result.state)).toEqual([
+        'rejected',
+        'rejected',
+      ])
+      expect(native.entries).toHaveLength(0)
+      expect([c.status, sibling.status]).toEqual(['crashed', 'crashed'])
+      assertRows(
+        (await readStore<Row>(inspector, 'other')).rows,
+        [],
+        'reentrant utility cannot write',
+      )
+    })
+  })
+
+// A late initial read and a locally admitted write can share the same sync run.
+// Startup loses read authority on closure; that does not discard the separate
+// committed-write obligation. Expected base contains only the authored insert,
+// while native storage also retains the pre-existing row that was never restored.
+for (const reason of reasons)
+  it(`separates initial-read authority from admitted write confirmation after ${reason}`, async () => {
+    await withHarness(async (h) => {
+      await seed(h.db, 'items', initial)
+      const gate = holdStore(h.db.db)
+      h.disposers.push(() => gate.release())
+      await gate.started
+      const c = h.make()
+      const statuses = recordStatus(c)
+      const loading = observe(c.preload())
+      const native = observeTransactions(h.db.db)
+      h.disposers.push(() => native.restore())
+      const row = { id: 3, name: 'admitted during startup' }
+      const caller = observe(c.insert(row).isPersisted.promise, () =>
+        sorted(c.base.values()),
+      )
+      await vi.waitFor(() =>
+        expect(native.entries.some((entry) => entry.mode === 'readwrite')).toBe(
+          true,
+        ),
+      )
+      const inspector = await close(h, reason)
+      await gate.release()
+      await loading.done
+      await caller.done
+      expect(loading.result.state).toBe('rejected')
+      expect(caller.result.state).toBe('fulfilled')
+      assertRows(
+        caller.snapshot()!,
+        [row],
+        'startup write confirms before caller',
+      )
+      assertRows(
+        c.base.values(),
+        [row],
+        'obsolete initial read never publishes',
+      )
+      assertRows(
+        (await readStore<Row>(inspector, 'items')).rows,
+        [...initial, row],
+        'native startup write preserves unseen rows',
+      )
+      closed(c, statuses)
+    })
+  })
+
+it('ignores the retired database-deleted message protocol before storage work', async () => {
+  await withHarness(async (h) => {
+    const c = await h.open()
+    await seed(h.db, 'items', [{ id: 1, name: 'unseen' }])
+    const native = observeTransactions(h.db.db)
+    h.disposers.push(() => native.restore())
+    const sender = new Channel(`tanstack-db:${h.db.name}`)
+    sender.postMessage({
+      type: 'database-deleted',
+      database: h.db.name,
+      name: 'items',
+      tabId: 'obsolete',
+      changedKeys: [1],
+    })
+    sender.close()
+    await Channel.drain()
+    expect(native.entries).toHaveLength(0)
+    expect(c.status).toBe('ready')
+    assertRows(c.values(), [], 'obsolete message has no authority')
+  })
+})
+
+// Core reports user status-listener errors on a microtask. Connection closure
+// preserves that reporting contract while synchronously notifying every owner.
+it('notifies sibling Collections while preserving listener error reporting', async () => {
+  await withHarness(async (h) => {
+    const first = await h.open(),
+      sibling = await h.open('other')
+    const failure = new Error('application status listener')
+    first.on('status:change', ({ status }) => {
+      if (status === 'crashed') throw failure
+    })
+    const errors: Array<VoidFunction> = []
+    const scheduled = vi
+      .spyOn(globalThis, 'queueMicrotask')
+      .mockImplementation((callback) => {
+        errors.push(callback)
+      })
+    try {
+      expect(() => h.db.close()).not.toThrow()
+      expect([first.status, sibling.status]).toEqual(['crashed', 'crashed'])
+      expect(errors).toHaveLength(1)
+      expect(errors[0]).toThrow(failure)
+      await expect(sibling.utils.clearObjectStore()).rejects.toThrow()
+      expect(() => h.db.close()).not.toThrow()
+    } finally {
+      scheduled.mockRestore()
+    }
+  })
+})
+
+// Abnormal native closure differs from ordinary close: the provider aborts
+// admitted work. fake-IDB's forceCloseDatabase closes admission but omits the
+// spec's forced-abort step. Supply that premise with native transaction.abort(),
+// then use its real close path; dispatching an Event alone would be invalid.
+// A separate inspector holds storage so both loading and write prefixes reach
+// the pending native cut. The model retains committed rows, rejects unfinished
+// work, and keeps every attached Collection in error after the close event.
+for (const phase of ['idle', 'ready', 'loading', ...kinds] as const) {
+  it(`retains committed rows after abnormal native close during ${phase}`, async () => {
+    await withHarness(async (h) => {
+      await seed(h.db, 'items', initial)
+      const inspector = await h.connect()
+      const c =
+        phase === 'idle' || phase === 'loading' ? h.make() : await h.open()
+      const statuses = recordStatus(c)
+      const native = observeTransactions(h.db.db)
+      h.disposers.push(() => native.restore())
+      const gate = holdStore(inspector.db)
+      h.disposers.push(() => gate.release())
+      await gate.started
+      const pending =
+        phase === 'loading'
+          ? observe(c.preload())
+          : phase === 'idle' || phase === 'ready'
+            ? undefined
+            : observe(start(c, phase, 1))
+      if (pending)
+        await vi.waitFor(() => expect(native.entries.length).toBeGreaterThan(0))
+      const terminated = new Promise<void>((resolve) =>
+        h.db.db.addEventListener('close', () => resolve(), { once: true }),
+      )
+      for (const entry of native.entries) entry.transaction.abort()
+      // fake-IDB 6.2.5 incorrectly declares a constructor parameter; its
+      // documented runtime API takes the native database instance.
+      ;(forceCloseDatabase as unknown as (db: IDBDatabase) => void)(h.db.db)
+      await gate.release()
+      await terminated
+      expect(() => h.db.db.transaction('items')).toThrow()
+      if (pending) {
+        await pending.done
+        expect(pending.result.state).toBe('rejected')
+        expect(native.entries.map((entry) => entry.status)).toEqual(['abort'])
+      }
+      if (phase === 'idle') await expect(c.preload()).rejects.toThrow()
+      closed(c, statuses)
+      assertRows(
+        c.values(),
+        phase === 'idle' || phase === 'loading' ? [] : initial,
+        'retained public snapshot',
+      )
+      assertRows(
+        (await readStore<Row>(inspector, 'items')).rows,
+        initial,
+        'aborted work cannot change disk',
+      )
+      const fresh = await h.open('items', { db: inspector })
+      assertRows(
+        fresh.values(),
+        initial,
+        'new descriptor restores committed rows',
+      )
+    })
+  })
+}
diff --git a/packages/db/tests/indexed-db/settlement-oracle.test.ts b/packages/db/tests/indexed-db/settlement.test.ts
similarity index 98%
rename from packages/db/tests/indexed-db/settlement-oracle.test.ts
rename to packages/db/tests/indexed-db/settlement.test.ts
index 17da0caaaf..38de157f2b 100644
--- a/packages/db/tests/indexed-db/settlement-oracle.test.ts
+++ b/packages/db/tests/indexed-db/settlement.test.ts
@@ -1,5 +1,7 @@
 /**
- * Persistence boundary oracle.
+ * Persistence boundary tests. This file declares no check or model. Each cell
+ * compares with authored before and after snapshots and a literal decision, and
+ * generates no histories, so it is supplemental coverage rather than an oracle.
  *
  * Authority: Collection handlers determine optimistic success/failure;
  * acceptMutations accepts only its Collection's mutations; IndexedDB transactions
diff --git a/packages/db/tests/indexed-db/structured-clone-oracle.ts b/packages/db/tests/indexed-db/structured-clone-oracle.ts
index c4a58a9315..35a6f0fe0b 100644
--- a/packages/db/tests/indexed-db/structured-clone-oracle.ts
+++ b/packages/db/tests/indexed-db/structured-clone-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from '../oracle-declaration.js'
 /**
  * Value fidelity is independent of lifecycle ordering. IndexedDB persists
  * structured-clone values; changing a scalar sibling must preserve an untouched
@@ -134,3 +135,5 @@ export async function observeValueRows(rows: Iterable<ValueRow>) {
 export function expectedValueRows(kind: ValueKind, name: string, id = 1) {
   return [{ id, name, nested: { value: expectedValue(kind) } }]
 }
+
+declareOracle({ model: [expectedValue, expectedValueRows] })
diff --git a/packages/db/tests/indexed-db/transport-oracle.test.ts b/packages/db/tests/indexed-db/transport-oracle.test.ts
index d35d082cc8..cfc607787c 100644
--- a/packages/db/tests/indexed-db/transport-oracle.test.ts
+++ b/packages/db/tests/indexed-db/transport-oracle.test.ts
@@ -17,153 +17,28 @@
  * Collections without replacing their rows; reuse requires a fresh descriptor.
  * These are bounded controlled histories, not browser scheduling evidence.
  */
-import { expect, it, vi } from 'vitest'
-import {
-  createCollection,
-  createIndexedDB,
-  createLiveQueryCollection,
-  createTransaction,
-  deleteDatabase,
-  executeTransaction,
-  indexedDBCollectionOptions,
-} from '../../src'
-import {
-  Channel,
-  assertRows,
-  deferred,
-  readStore,
-  request,
-  seed,
-  sorted,
-  withHarness,
-} from './harness'
+import { expect, it } from 'vitest'
+import { executeTransaction } from '../../src'
+import { declareOracle } from '../oracle-declaration'
+import { Channel, assertRows, readStore, seed, withHarness } from './harness'
 import type { Row } from './harness'
 
-for (const reverse of [false, true]) {
-  it(
-    'converges independent writers with ' +
-      (reverse ? 'reversed' : 'FIFO') +
-      ' notification delivery',
-    async () => {
-      await withHarness(async (h) => {
-        const left = await h.open(),
-          right = await h.open()
-        const rows: Array<Row> = [
-          { id: 'a:[0]/☃', name: 'left', optional: 1 },
-          { id: 0, name: 'right' },
-          { id: '0', name: 'typed key' },
-        ]
-        await Promise.all([
-          left.insert([rows[0]!, rows[2]!]).isPersisted.promise,
-          right.insert(rows[1]!).isPersisted.promise,
-        ])
-        expect(Channel.pending.length).toBe(2)
-        // Redelivery retains the original messages, making duplicate output
-        // representable rather than deduplicating it in the recorder.
-        Channel.pending.push(...Channel.pending)
-        if (reverse) Channel.pending.reverse()
-        expect(await Channel.deliver()).toBe(4)
-        for (const subject of [left, right, await h.open()])
-          assertRows(subject.values(), rows, 'disjoint writer convergence')
-        await left.update(rows[0]!.id, (row) => {
-          delete row.optional
-        }).isPersisted.promise
-        await left.delete(rows[2]!.id).isPersisted.promise
-        await left.insert({ id: 'temporary', name: 'removed' }).isPersisted
-          .promise
-        await left.delete('temporary').isPersisted.promise
-        await Channel.deliver()
-        const expected = [{ id: rows[0]!.id, name: 'left' }, rows[1]!]
-        for (const subject of [left, right, await h.open()])
-          assertRows(
-            subject.values(),
-            expected,
-            'delayed mixed changes and removed fields',
-          )
-      })
-    },
-  )
-}
-
-it('ignores self, foreign database and foreign store notifications', async () => {
-  await withHarness(async (h) => {
-    const collection = await h.open()
-    await collection.insert({ id: 1, name: 'kept' }).isPersisted.promise
-    const original = Channel.sent[0] as {
-      tabId: string
-      database: string
-      name: string
-    }
-    const channel = [...Channel.peers][0]!
-    // A raw provider write creates a distinguishing observation: incorrectly
-    // consuming an excluded notification would add this unseen row. Equal
-    // durable/public snapshots could let a missing exclusion pass unnoticed.
-    await seed(h.db, 'items', [{ id: 2, name: 'excluded source row' }])
-    for (const patch of [
-      { tabId: original.tabId },
-      { tabId: 'remote', database: 'foreign' },
-      { tabId: 'remote', name: 'other' },
-    ]) {
-      await channel.onmessage?.(
-        new MessageEvent('message', {
-          data: {
-            ...original,
-            ...patch,
-            type: 'data-changed',
-            changedKeys: [2],
-          },
-        }),
-      )
-      assertRows(
-        collection.values(),
-        [{ id: 1, name: 'kept' }],
-        'excluded notification',
-      )
-    }
-    expect(Channel.sent.length).toBe(1)
-  })
-})
-
-it('rejects illegal missing-key updates without changing durable data', async () => {
-  await withHarness(async (h) => {
-    const collection = await h.open()
-    expect(() =>
-      collection.update('absent', (row) => {
-        row.name = 'invalid'
-      }),
-    ).toThrow()
-    expect((await readStore(h.db, 'items')).rows).toEqual([])
-  })
-})
-
-it('does not let a late startup publish into a cleaned-up sync run', async () => {
-  await withHarness(async (h) => {
-    await seed(h.db, 'items', [{ id: 1, name: 'stored' }])
-    const collection = h.make()
-    const preload = collection.preload().catch(() => undefined)
-    await collection.cleanup()
-    await preload
-    // Another IDB read supplies a concrete completion boundary for the earlier
-    // startup transaction; no elapsed-time sleep decides correctness.
-    await readStore(h.db, 'items')
-    expect(collection.status).toBe('cleaned-up')
-    expect(Channel.peers.size).toBe(0)
-    await collection.preload()
-    assertRows(
-      collection.values(),
-      [{ id: 1, name: 'stored' }],
-      'fresh sync run',
-    )
-    expect(Channel.peers.size).toBe(1)
-  })
-})
-
 // The reference applies completed storage operations in their authored order:
 // replacement removes prior rows, then the later disjoint insertion adds one.
 // Notification order may change how the receiver learns that result, not which
 // durable rows exist after every message has been delivered. Each replacement
 // kind crosses FIFO, reverse and duplicate delivery; the latter two are stronger
 // controlled transport challenges, not claims about native BroadcastChannel.
+// The model applies the completed replacement, then the later insertion, in the
+// authored order. A clear leaves only the insertion; an import keeps its rows.
+function expectedAfterReplacement(
+  replacement: 'clear' | 'import',
+  imported: Row,
+  inserted: Row,
+): Array<Row> {
+  return replacement === 'clear' ? [inserted] : [imported, inserted]
+}
+
 for (const replacement of ['clear', 'import'] as const) {
   for (const delivery of ['FIFO', 'reverse', 'duplicate'] as const) {
     it(
@@ -182,8 +57,11 @@ for (const replacement of ['clear', 'import'] as const) {
           else await source.utils.importData([imported])
           const inserted = { id: 'later', name: 'accepted after replacement' }
           await receiver.insert(inserted).isPersisted.promise
-          const expected =
-            replacement === 'clear' ? [inserted] : [imported, inserted]
+          const expected = expectedAfterReplacement(
+            replacement,
+            imported,
+            inserted,
+          )
           const pending = Channel.pending.length
           expect(
             pending,
@@ -212,500 +90,22 @@ for (const replacement of ['clear', 'import'] as const) {
   }
 }
 
-// A utility does not require a subscriber or active sync run. The independent
-// before/after arrays define its durable replacement, and an already active
-// peer must learn the same result. Creating a Collection or completing cleanup
-// controls the missing-channel premise without mutating adapter internals.
-for (const status of ['idle', 'cleaned-up'] as const) {
-  for (const replacement of ['clear', 'import'] as const) {
-    it(
-      'publishes ' + replacement + ' from a ' + status + ' Collection',
-      async () => {
-        await withHarness(async (h) => {
-          await seed(h.db, 'items', [{ id: 'old', name: 'before' }])
-          const receiver = await h.open()
-          const writer = h.make()
-          if (status === 'cleaned-up') {
-            await writer.preload()
-            await writer.cleanup()
-          }
-          expect(writer.status, 'utility entry lifecycle').toBe(status)
-          const expected =
-            replacement === 'clear' ? [] : [{ id: 'new', name: 'replacement' }]
-          if (replacement === 'clear') await writer.utils.clearObjectStore()
-          else await writer.utils.importData(expected)
-          const delivered = await Channel.deliver()
-          assertRows(
-            (await readStore<Row>(h.db, 'items')).rows,
-            expected,
-            'utility durable snapshot',
-          )
-          assertRows(
-            (await h.open()).values(),
-            expected,
-            'utility fresh restore',
-          )
-          assertRows(receiver.values(), expected, 'active peer after utility')
-          expect(
-            delivered,
-            'utility notification reached the peer',
-          ).toBeGreaterThan(0)
-        })
-      },
-    )
-  }
+// Peer edit model. The reference applies one authored peer update or delete to the
+// initial rows; metadata completeness does not change this membership.
+function expectedAfterPeerEdit(
+  initial: Array<Row>,
+  key: number | string,
+  action: 'update' | 'delete',
+): Array<Row> {
+  return action === 'update'
+    ? [{ id: key, name: 'new' }, initial[1]!]
+    : initial.slice(1)
 }
 
-// Authorship starts a Collection sync run, so a real manual transaction cannot
-// be authored by its owning Collection while keeping that Collection initially
-// idle. Instead author while ready, clean up, then accept through the manual
-// transaction's ordinary mutationFn. Cleanup retires the sync run, not the
-// independently owned transaction or its later durable acceptance.
-it('publishes manual acceptance after the writer sync run is cleaned up', async () => {
-  await withHarness(async (h) => {
-    const receiver = await h.open()
-    const writer = await h.open()
-    const row = { id: 'accepted', name: 'after cleanup' }
-    const transaction = createTransaction({
-      autoCommit: false,
-      mutationFn: ({ transaction: pending }) =>
-        writer.utils.acceptMutations(pending),
-    })
-    transaction.mutate(() => writer.insert(row))
-    await writer.cleanup()
-    expect(writer.status, 'manual acceptance entry lifecycle').toBe(
-      'cleaned-up',
-    )
-    await transaction.commit()
-    await transaction.isPersisted.promise
-    const delivered = await Channel.deliver()
-    assertRows(
-      (await readStore<Row>(h.db, 'items')).rows,
-      [row],
-      'manual acceptance durable snapshot',
-    )
-    assertRows((await h.open()).values(), [row], 'manual acceptance restore')
-    assertRows(receiver.values(), [row], 'active peer after manual acceptance')
-    expect(
-      delivered,
-      'acceptance notification reached the peer',
-    ).toBeGreaterThan(0)
-  })
-})
-
-// Administrative deletion removes native rows in every store and retires
-// every managed Collection. Its caller receipt grants no row publication
-// authority: retained errored snapshots and fresh empty restores differ.
-it('retires every managed store without publishing database deletion', async () => {
-  await withHarness(async (h) => {
-    await seed(h.db, 'items', [{ id: 'item', name: 'removed item' }])
-    await seed(h.db, 'other', [{ id: 'other', name: 'removed sibling' }])
-    const source = await h.open()
-    const sameStore = await h.open()
-    const sibling = await h.open('other')
-    await deleteDatabase(h.db.name)
-    expect(
-      await Channel.deliver(),
-      'administrative deletion emits no row notification',
-    ).toBe(0)
-    const fresh = await createIndexedDB({
-      name: h.db.name,
-      version: 1,
-      stores: ['items', 'other'],
-    })
-    try {
-      for (const name of ['items', 'other']) {
-        assertRows(
-          (await readStore<Row>(fresh, name)).rows,
-          [],
-          'deleted durable store ' + name,
-        )
-        const restored = createCollection(
-          indexedDBCollectionOptions<Row>({
-            db: fresh,
-            name,
-            getKey: (row) => row.id,
-          }),
-        )
-        try {
-          await restored.preload()
-          assertRows(restored.values(), [], 'deleted fresh restore ' + name)
-        } finally {
-          await restored.cleanup()
-        }
-      }
-      expect([source.status, sameStore.status, sibling.status]).toEqual([
-        'crashed',
-        'crashed',
-        'crashed',
-      ])
-      assertRows(
-        source.values(),
-        [{ id: 'item', name: 'removed item' }],
-        'retained originating snapshot',
-      )
-      assertRows(
-        sameStore.values(),
-        [{ id: 'item', name: 'removed item' }],
-        'retained same-store snapshot',
-      )
-      assertRows(
-        sibling.values(),
-        [{ id: 'other', name: 'removed sibling' }],
-        'retained sibling snapshot',
-      )
-    } finally {
-      fresh.close()
-    }
-  })
-})
-
-// Ported settlement law: a native blocked event is nonterminal. The authored
-// before/after snapshots distinguish provider completion, caller settlement and
-// publication. A real fake-IDB connection holds deletion; no timer decides the
-// checkpoint. Native browser lock scheduling and cancellation are outside this
-// owner. The existing unblocked deletion case is the successful control.
-it('retains every public snapshot and sends no deletion before native deletion succeeds', async () => {
-  await withHarness(async (h) => {
-    const item = { id: 'item', name: 'retained until deletion' }
-    const other = { id: 'other', name: 'sibling retained until deletion' }
-    await seed(h.db, 'items', [item])
-    await seed(h.db, 'other', [other])
-    const source = await h.open()
-    const peer = await h.open()
-    const sibling = await h.open('other')
-    const blocker = await request(indexedDB.open(h.db.name, 1))
-    const blocked = deferred()
-    const terminal = deferred()
-    const nativeDelete = indexedDB.deleteDatabase.bind(indexedDB)
-    vi.spyOn(indexedDB, 'deleteDatabase').mockImplementation((...args) => {
-      const nativeRequest = nativeDelete(...args)
-      nativeRequest.addEventListener('blocked', () => blocked.resolve())
-      nativeRequest.addEventListener('success', () => terminal.resolve())
-      nativeRequest.addEventListener('error', () =>
-        terminal.reject(nativeRequest.error ?? new Error('delete failed')),
-      )
-      return nativeRequest
-    })
-    let status = 'pending'
-    const outcome = deleteDatabase(h.db.name).then(
-      () => {
-        status = 'fulfilled'
-      },
-      () => {
-        status = 'rejected'
-      },
-    )
-    try {
-      await blocked.promise
-      // The independent read also drains promise reactions after blocked.
-      const durable = await readStore<Row>({ ...h.db, db: blocker }, 'items')
-      const before = {
-        status,
-        sent: Channel.sent.length,
-        rows: [source, peer, sibling].map((collection) =>
-          sorted(collection.values()),
-        ),
-      }
-      blocker.close()
-      await terminal.promise
-      await outcome
-      await Channel.deliver()
-      expect(before, 'blocked deletion settlement and publication').toEqual({
-        status: 'pending',
-        sent: 0,
-        rows: [[item], [item], [other]],
-      })
-      assertRows(durable.rows, [item], 'blocked deletion durable snapshot')
-      expect(status, 'native deletion acknowledged to caller').toBe('fulfilled')
-      for (const collection of [source, peer, sibling]) {
-        assertRows(
-          collection.values(),
-          collection === sibling ? [other] : [item],
-          'deletion retains errored snapshot',
-        )
-        expect(collection.status).toBe('crashed')
-      }
-      const fresh = await createIndexedDB({
-        name: h.db.name,
-        version: 1,
-        stores: ['items', 'other'],
-      })
-      try {
-        for (const name of ['items', 'other'])
-          assertRows(
-            (await readStore<Row>(fresh, name)).rows,
-            [],
-            'fresh durable state after deletion',
-          )
-      } finally {
-        fresh.close()
-      }
-    } finally {
-      blocker.close()
-      await terminal.promise
-      await outcome
-    }
-  })
-})
-
-// Failure to issue deletion changes neither storage nor the published source.
-// This injected factory failure has no native request, so it makes no rollback
-// claim for an operation that already reached the provider. Rejected native
-// admission does not close an unrelated managed connection.
-it('preserves durable and public snapshots when deletion cannot be issued', async () => {
-  await withHarness(async (h) => {
-    const item = { id: 'item', name: 'retained item' }
-    const other = { id: 'other', name: 'retained sibling' }
-    await seed(h.db, 'items', [item])
-    await seed(h.db, 'other', [other])
-    const source = await h.open()
-    const peer = await h.open()
-    const sibling = await h.open('other')
-    const issue = vi
-      .spyOn(indexedDB, 'deleteDatabase')
-      .mockImplementation(() => {
-        throw new DOMException('storage deletion denied', 'SecurityError')
-      })
-    await expect(deleteDatabase(h.db.name)).rejects.toThrow(
-      'storage deletion denied',
-    )
-    issue.mockRestore()
-    expect(
-      Channel.sent,
-      'failed deletion sends no success notification',
-    ).toEqual([])
-    assertRows(source.values(), [item], 'failed deletion originating snapshot')
-    assertRows(peer.values(), [item], 'failed deletion same-store snapshot')
-    assertRows(sibling.values(), [other], 'failed deletion sibling snapshot')
-    const fresh = await createIndexedDB({
-      name: h.db.name,
-      version: 1,
-      stores: ['items', 'other'],
-    })
-    try {
-      for (const [name, rows] of [
-        ['items', [item]],
-        ['other', [other]],
-      ] as const)
-        assertRows(
-          (await readStore<Row>(fresh, name)).rows,
-          rows,
-          'failed deletion durable snapshot',
-        )
-    } finally {
-      fresh.close()
-    }
-  })
+declareOracle({
+  model: [expectedAfterReplacement, expectedAfterPeerEdit],
 })
 
-// Managed connection ownership, approved by the maintainer: createIndexedDB
-// closes its native connection when another request delivers versionchange.
-// Closing permits upgrade/deletion and marks affected Collections errored.
-// Upgrade preserves durable rows; deletion removes them without publishing
-// replacement rows into retained Collections. The caller recreates descriptors and Collections for
-// subsequent persistence through the changed database.
-//
-// The reference is authored rows plus the operation's native version: upgrade
-// retains rows at version 2; deletion recreates empty stores at version 1. The
-// finite grammar crosses two/three independent descriptors with upgrade/delete.
-// Source, same-store peer and sibling-store peer stay active through the native
-// operation. With two descriptors, both peers share the second connection; with
-// three, each Collection has its own. These roles expose connection ownership
-// that the shared-descriptor histories above cannot exercise.
-//
-// Native fake-IDB versionchange/blocked events are the reach witnesses. At a
-// blocked event the driver records the violation, then closes fixture-owned
-// descriptors so native completion and the remaining observations can run.
-// The final zero-blocked assertion therefore rejects missing automatic close
-// directly instead of timing out. Raw unmanaged blockers retain the separate
-// pending settlement contract in wrapper.test.ts. Real pages, transactions
-// already in flight, application notification and elapsed-time bounds are outside
-// this finite grammar; controlled Channel delivery is not browser scheduling.
-for (const count of [2, 3]) {
-  for (const operation of ['upgrade', 'delete'] as const) {
-    it(
-      operation + ' releases ' + count + ' independent managed connections',
-      async () => {
-        await withHarness(async (h) => {
-          const item = { id: 'item', name: 'retained by upgrade' }
-          const other = { id: 'other', name: 'sibling retained by upgrade' }
-          await seed(h.db, 'items', [item])
-          await seed(h.db, 'other', [other])
-          const descriptors = [h.db]
-          try {
-            for (let index = 1; index < count; index++)
-              descriptors.push(
-                await createIndexedDB({
-                  name: h.db.name,
-                  version: 1,
-                  stores: ['items', 'other'],
-                }),
-              )
-            expect(
-              new Set(descriptors.map((descriptor) => descriptor.db)).size,
-              'independent native connection premise',
-            ).toBe(count)
-            const source = await h.open()
-            const peer = await h.open('items', { db: descriptors[1]! })
-            const sibling = await h.open('other', {
-              db: descriptors[count - 1]!,
-            })
-            const collections = [source, peer, sibling]
-            const versionchanges = descriptors.map(
-              () =>
-                [] as Array<{ oldVersion: number; newVersion: number | null }>,
-            )
-            descriptors.forEach((descriptor, index) => {
-              descriptor.db.addEventListener('versionchange', (event) => {
-                versionchanges[index]!.push({
-                  oldVersion: event.oldVersion,
-                  newVersion: event.newVersion,
-                })
-              })
-            })
-            let blockedEvents = 0
-            function observe(nativeRequest: IDBOpenDBRequest) {
-              nativeRequest.addEventListener('blocked', () => {
-                blockedEvents++
-                for (const descriptor of descriptors) descriptor.close()
-              })
-              return nativeRequest
-            }
-            const nativeOpen = indexedDB.open.bind(indexedDB)
-            const nativeDelete = indexedDB.deleteDatabase.bind(indexedDB)
-            const openSpy = vi
-              .spyOn(indexedDB, 'open')
-              .mockImplementation((...args) => observe(nativeOpen(...args)))
-            const deleteSpy = vi
-              .spyOn(indexedDB, 'deleteDatabase')
-              .mockImplementation((...args) => observe(nativeDelete(...args)))
-            const fresh =
-              operation === 'upgrade'
-                ? await createIndexedDB({
-                    name: h.db.name,
-                    version: 2,
-                    stores: ['items', 'other', 'added'],
-                  })
-                : await (async () => {
-                    await deleteDatabase(h.db.name)
-                    expect(
-                      await Channel.deliver(),
-                      'administrative deletion has no notification',
-                    ).toBe(0)
-                    for (const collection of collections)
-                      assertRows(
-                        collection.values(),
-                        collection === sibling ? [other] : [item],
-                        'retained managed snapshot',
-                      )
-                    return createIndexedDB({
-                      name: h.db.name,
-                      version: 1,
-                      stores: ['items', 'other'],
-                    })
-                  })()
-            descriptors.push(fresh)
-            openSpy.mockRestore()
-            deleteSpy.mockRestore()
-
-            expect(
-              versionchanges,
-              'every open managed connection receives versionchange',
-            ).toEqual(
-              Array.from({ length: count }, () => [
-                {
-                  oldVersion: 1,
-                  newVersion: operation === 'upgrade' ? 2 : null,
-                },
-              ]),
-            )
-            expect(
-              fresh.version,
-              'native operation reached its terminal version',
-            ).toBe(operation === 'upgrade' ? 2 : 1)
-            for (const [name, before] of [
-              ['items', [item]],
-              ['other', [other]],
-            ] as const) {
-              const expected = operation === 'upgrade' ? before : []
-              assertRows(
-                (await readStore<Row>(fresh, name)).rows,
-                expected,
-                'durable rows after native ' + operation,
-              )
-            }
-            for (const [index, collection] of collections.entries()) {
-              expect(collection.status).toBe('crashed')
-              expect(() =>
-                collection.insert({ id: 'closed-' + index, name: 'rejected' }),
-              ).toThrow()
-              assertRows(
-                collection.values(),
-                index === 2 ? [other] : [item],
-                'errored Collection retains source',
-              )
-            }
-            // Recreate consumers explicitly. Delivering a later write into an
-            // obsolete connection would test a different receiving-work contract.
-            for (const collection of collections) await collection.cleanup()
-            const restored = await h.open('items', { db: fresh })
-            const restoredSibling = await h.open('other', { db: fresh })
-            assertRows(
-              restored.values(),
-              operation === 'upgrade' ? [item] : [],
-              'fresh items restore after native ' + operation,
-            )
-            assertRows(
-              restoredSibling.values(),
-              operation === 'upgrade' ? [other] : [],
-              'fresh sibling restore after native ' + operation,
-            )
-            if (operation === 'upgrade') {
-              const added = await h.open('added', { db: fresh })
-              assertRows(added.values(), [], 'new store starts empty')
-              const suffix = {
-                id: 'suffix',
-                name: 'written through new descriptor',
-              }
-              const addedRow = { id: 'added', name: 'written in new store' }
-              await restored.insert({ ...suffix }).isPersisted.promise
-              await added.insert({ ...addedRow }).isPersisted.promise
-              await Channel.deliver()
-              assertRows(
-                restored.values(),
-                [item, suffix],
-                'new descriptor write',
-              )
-              assertRows(
-                (await readStore<Row>(fresh, 'items')).rows,
-                [item, suffix],
-                'new descriptor durable write',
-              )
-              assertRows(
-                (await readStore<Row>(fresh, 'added')).rows,
-                [addedRow],
-                'new store durable write',
-              )
-              assertRows(
-                restoredSibling.values(),
-                [other],
-                'sibling remains intact',
-              )
-            }
-            expect(
-              blockedEvents,
-              'managed versionchange closes every connection',
-            ).toBe(0)
-          } finally {
-            for (const descriptor of descriptors) descriptor.close()
-          }
-        })
-      },
-    )
-  }
-}
-
 // Restored source membership does not depend on adapter metadata. The model
 // applies an authored peer edit to initial rows; metadata completeness is an
 // independent grammar axis. Raw wrapper rows reach the production restore path.
@@ -743,10 +143,7 @@ for (const metadata of ['none', 'mixed', 'all'] as const) {
           // insert, and repeated deletes must leave the independent anchor intact.
           Channel.pending.push(...Channel.pending)
           await Channel.deliver()
-          const expected =
-            action === 'update'
-              ? [{ id: key, name: 'new' }, initial[1]!]
-              : initial.slice(1)
+          const expected = expectedAfterPeerEdit(initial, key, action)
           expect(receiver.status).toBe('ready')
           for (const subject of [receiver, sender, await h.open()])
             assertRows(subject.values(), expected, 'unversioned reconciliation')
@@ -759,284 +156,3 @@ for (const metadata of ['none', 'mixed', 'all'] as const) {
       })
     }
 }
-
-// Invalid envelopes are not source writes. Keep a raw unseen row as a positive
-// witness: a valid neighboring envelope must read it, while each malformed form
-// must leave both the public snapshot and Collection status unchanged.
-it('excludes malformed channel envelopes before storage or publication', async () => {
-  await withHarness(async (h) => {
-    const c = await h.open(),
-      channel = [...Channel.peers][0]!
-    await seed(h.db, 'items', [{ id: 1, name: 'valid neighbor' }])
-    const valid = {
-      type: 'data-changed',
-      database: h.db.name,
-      name: 'items',
-      tabId: 'peer',
-      changedKeys: [1],
-    }
-    const invalid = [
-      null,
-      undefined,
-      1,
-      'message',
-      {},
-      { ...valid, type: 'unknown' },
-      { ...valid, changedKeys: null },
-      { ...valid, changedKeys: { length: 1 } },
-      { ...valid, changedKeys: [{}] },
-      { ...valid, changedKeys: [NaN] },
-      { ...valid, tabId: null },
-    ]
-    const reads = vi.spyOn(h.db.db, 'transaction')
-    for (const data of invalid) {
-      await channel.onmessage?.(new MessageEvent('message', { data }))
-      expect(c.status).toBe('ready')
-      assertRows(c.values(), [], 'invalid envelope exclusion')
-      expect(
-        reads,
-        'invalid envelope has no storage authority',
-      ).not.toHaveBeenCalled()
-    }
-    await channel.onmessage?.(new MessageEvent('message', { data: valid }))
-    expect(reads, 'valid envelope reaches storage').toHaveBeenCalledTimes(1)
-    assertRows(
-      c.values(),
-      [{ id: 1, name: 'valid neighbor' }],
-      'valid envelope reach',
-    )
-  })
-})
-
-// A deletion notification has authority only over the retired connection. A
-// native success event can be delivered after another context has recreated the
-// database. Hold that receipt (not native deletion), create and write through a
-// fresh descriptor, then compare its authored snapshot after late delivery.
-// This controlled callback premise still needs a native multi-page witness.
-it('ignores an old native deletion receipt after database recreation', async () => {
-  await withHarness(async (h) => {
-    const old = await h.open(),
-      nativeComplete = deferred(),
-      receipt = deferred(),
-      original = indexedDB.deleteDatabase.bind(indexedDB)
-    vi.spyOn(indexedDB, 'deleteDatabase').mockImplementation((name) => {
-      const req = original(name)
-      let callback: ((this: IDBRequest, event: Event) => unknown) | null = null
-      Object.defineProperty(req, 'onsuccess', {
-        get: () => null,
-        set: (value) => {
-          callback = value
-        },
-        configurable: true,
-      })
-      req.addEventListener('success', (event) => {
-        nativeComplete.resolve()
-        void receipt.promise.then(() => callback?.call(req, event))
-      })
-      return req
-    })
-    const deletion = deleteDatabase(h.db.name)
-    await nativeComplete.promise
-    expect(old.status).toBe('crashed')
-    const recreated = await createIndexedDB({
-      name: h.db.name,
-      version: 1,
-      stores: ['items'],
-    })
-    h.descriptors.push(recreated)
-    const fresh = await h.open('items', { db: recreated })
-    await fresh.insert({ id: 1, name: 'new incarnation' }).isPersisted.promise
-    Channel.pending = []
-    receipt.resolve()
-    await deletion
-    await Channel.deliver()
-    assertRows(
-      (await readStore<Row>(recreated, 'items')).rows,
-      [{ id: 1, name: 'new incarnation' }],
-      'recreated durable snapshot',
-    )
-    assertRows(
-      fresh.values(),
-      [{ id: 1, name: 'new incarnation' }],
-      'new incarnation public',
-    )
-  })
-})
-
-// Managed versionchange intentionally closes the old connection. A subsequent
-// read fails through the existing Collection error path; a fresh descriptor
-// restores the new durable rows. This preserves the approved recreation policy.
-it('reports connection closure immediately and supports fresh Collections', async () => {
-  await withHarness(async (h) => {
-    const old = await h.open()
-    const live = createLiveQueryCollection((q) => q.from({ row: old }))
-    h.disposers.push(() => live.cleanup())
-    await live.preload()
-    const upgraded = await createIndexedDB({
-      name: h.db.name,
-      version: 2,
-      stores: ['items'],
-    })
-    h.descriptors.push(upgraded)
-    // Closure crashes the source, and a crashed source ends every live query
-    // above it, even one that was already ready. Both trees explain why.
-    expect(old.status).toBe('crashed')
-    expect(live.status).toBe('crashed')
-    expect(live.health.sources[0]).toMatchObject({
-      status: 'crashed',
-      error: expect.anything(),
-    })
-    const fresh = await h.open('items', { db: upgraded })
-    await fresh.insert({ id: 1, name: 'new' }).isPersisted.promise
-    await Channel.deliver()
-    expect(old.status).toBe('crashed')
-    expect(live.status).toBe('crashed')
-    expect(live.health.hasErrors).toBe(true)
-    expect(fresh.status).toBe('ready')
-    assertRows(
-      fresh.values(),
-      [{ id: 1, name: 'new' }],
-      'new connection usable',
-    )
-  })
-})
-
-// A notification is an invalidation, not a row snapshot. A raw wrapper write
-// can replace its row and remove optional version metadata before delivery.
-// Current durable values still determine source membership and full-row values.
-// The finite grammar crosses present/absent initial rows, typed keys, and absent
-// or current metadata at the receiving read. Each history delivers a real peer
-// notification twice, then an ordinary peer suffix proves the cache stays usable.
-for (const present of [false, true]) {
-  for (const metadata of [false, true]) {
-    for (const key of [1, '1']) {
-      it(`reads current rows with initial membership ${present}, metadata ${metadata}, ${typeof key} key`, async () => {
-        await withHarness(async (h) => {
-          const anchor = { id: 'anchor', name: 'untouched' }
-          const before = { id: key, name: 'before', optional: 1 }
-          await seed(h.db, 'items', present ? [anchor, before] : [anchor])
-          const receiver = await h.open()
-          const sender = await h.open('items', { db: await h.connect() })
-          if (present)
-            await sender.update(key, (row) => {
-              row.name = 'notified'
-            }).isPersisted.promise
-          else
-            await sender.insert({ id: key, name: 'notified' }).isPersisted
-              .promise
-          const current = { id: key, name: 'current' }
-          await executeTransaction(
-            h.db.db,
-            ['items', '_versions'],
-            'readwrite',
-            (_, stores) => {
-              stores.items!.put(current, key)
-              if (!metadata) stores._versions!.delete(['items', key])
-            },
-          )
-          Channel.pending.push(...Channel.pending)
-          expect(
-            await Channel.deliver(),
-            'real peer notification delivered twice',
-          ).toBe(2)
-          expect(receiver.status).toBe('ready')
-          const expected = [anchor, current]
-          assertRows(
-            receiver.values(),
-            expected,
-            'current durable value without omitted field',
-          )
-          assertRows(
-            (await readStore<Row>(h.db, 'items')).rows,
-            expected,
-            'current raw storage',
-          )
-          const fresh = await h.open()
-          assertRows(fresh.values(), expected, 'current restore')
-          await fresh.update(key, (row) => {
-            row.name = 'suffix'
-          }).isPersisted.promise
-          await Channel.deliver()
-          assertRows(
-            receiver.values(),
-            [anchor, { ...current, name: 'suffix' }],
-            'ordinary versioned suffix',
-          )
-        })
-      })
-    }
-  }
-}
-
-// Two deletion lifetimes distinguish connection retirement from deletion
-// completion. An old successful receipt can arrive after a recreated peer has
-// observed a newer native deletion request that is still blocked. Only the
-// newer deletion's success may empty that peer; native versionchange alone
-// grants no authority to the unrelated old receipt.
-it('preserves a recreated peer while a newer deletion is blocked', async () => {
-  await withHarness(async (h) => {
-    const old = await h.open()
-    const nativeComplete = deferred(),
-      receipt = deferred(),
-      blocked = deferred()
-    const nativeDelete = indexedDB.deleteDatabase.bind(indexedDB)
-    let deletes = 0
-    vi.spyOn(indexedDB, 'deleteDatabase').mockImplementation((name) => {
-      const req = nativeDelete(name)
-      if (deletes++ === 0) {
-        let callback: ((this: IDBRequest, event: Event) => unknown) | null =
-          null
-        Object.defineProperty(req, 'onsuccess', {
-          get: () => null,
-          set: (value) => {
-            callback = value
-          },
-          configurable: true,
-        })
-        req.addEventListener('success', (event) => {
-          nativeComplete.resolve()
-          void receipt.promise.then(() => callback?.call(req, event))
-        })
-      } else req.addEventListener('blocked', () => blocked.resolve())
-      return req
-    })
-    const firstDeletion = deleteDatabase(h.db.name)
-    await nativeComplete.promise
-    expect(old.status).toBe('crashed')
-    const freshDb = await h.connect()
-    const peerDb = await h.connect()
-    const fresh = await h.open('items', { db: freshDb })
-    const peer = await h.open('items', { db: peerDb })
-    const expected = [{ id: 1, name: 'recreated' }]
-    await fresh.insert(expected[0]!).isPersisted.promise
-    await Channel.deliver()
-    const blockerRequest = indexedDB.open(h.db.name, 1)
-    const blocker = await request(blockerRequest)
-    let secondComplete = false
-    const secondDeletion = deleteDatabase(h.db.name).then(() => {
-      secondComplete = true
-    })
-    let observed: Array<Row> = [],
-      durable: Array<Row> = [],
-      premature = false
-    try {
-      await blocked.promise
-      receipt.resolve()
-      await firstDeletion
-      await Channel.deliver()
-      observed = sorted(peer.values())
-      durable = (await readStore<Row>({ ...freshDb, db: blocker }, 'items'))
-        .rows
-      premature = secondComplete
-    } finally {
-      receipt.resolve()
-      blocker.close()
-      await firstDeletion
-      await secondDeletion
-      await Channel.deliver()
-    }
-    expect(premature, 'newer native deletion remains blocked').toBe(false)
-    assertRows(durable, expected, 'newer blocked deletion durable')
-    assertRows(observed, expected, 'old receipt cannot complete newer deletion')
-  })
-})
diff --git a/packages/db/tests/indexed-db/transport.test.ts b/packages/db/tests/indexed-db/transport.test.ts
new file mode 100644
index 0000000000..3bdd349bec
--- /dev/null
+++ b/packages/db/tests/indexed-db/transport.test.ts
@@ -0,0 +1,919 @@
+// Ordinary tests for the controlled transport contract. transport-oracle.test.ts
+// owns the replacement-then-insert and peer-edit models; these scenarios compare
+// with literal rows, literal statuses, or native counts and events that they
+// establish. Their law is the one stated in the header of transport-oracle.test.ts.
+import { expect, it, vi } from 'vitest'
+import {
+  createCollection,
+  createIndexedDB,
+  createLiveQueryCollection,
+  createTransaction,
+  deleteDatabase,
+  executeTransaction,
+  indexedDBCollectionOptions,
+} from '../../src'
+import {
+  Channel,
+  assertRows,
+  deferred,
+  readStore,
+  request,
+  seed,
+  sorted,
+  withHarness,
+} from './harness'
+import type { Row } from './harness'
+
+for (const reverse of [false, true]) {
+  it(
+    'converges independent writers with ' +
+      (reverse ? 'reversed' : 'FIFO') +
+      ' notification delivery',
+    async () => {
+      await withHarness(async (h) => {
+        const left = await h.open(),
+          right = await h.open()
+        const rows: Array<Row> = [
+          { id: 'a:[0]/☃', name: 'left', optional: 1 },
+          { id: 0, name: 'right' },
+          { id: '0', name: 'typed key' },
+        ]
+        await Promise.all([
+          left.insert([rows[0]!, rows[2]!]).isPersisted.promise,
+          right.insert(rows[1]!).isPersisted.promise,
+        ])
+        expect(Channel.pending.length).toBe(2)
+        // Redelivery retains the original messages, making duplicate output
+        // representable rather than deduplicating it in the recorder.
+        Channel.pending.push(...Channel.pending)
+        if (reverse) Channel.pending.reverse()
+        expect(await Channel.deliver()).toBe(4)
+        for (const subject of [left, right, await h.open()])
+          assertRows(subject.values(), rows, 'disjoint writer convergence')
+        await left.update(rows[0]!.id, (row) => {
+          delete row.optional
+        }).isPersisted.promise
+        await left.delete(rows[2]!.id).isPersisted.promise
+        await left.insert({ id: 'temporary', name: 'removed' }).isPersisted
+          .promise
+        await left.delete('temporary').isPersisted.promise
+        await Channel.deliver()
+        const expected = [{ id: rows[0]!.id, name: 'left' }, rows[1]!]
+        for (const subject of [left, right, await h.open()])
+          assertRows(
+            subject.values(),
+            expected,
+            'delayed mixed changes and removed fields',
+          )
+      })
+    },
+  )
+}
+
+it('ignores self, foreign database and foreign store notifications', async () => {
+  await withHarness(async (h) => {
+    const collection = await h.open()
+    await collection.insert({ id: 1, name: 'kept' }).isPersisted.promise
+    const original = Channel.sent[0] as {
+      tabId: string
+      database: string
+      name: string
+    }
+    const channel = [...Channel.peers][0]!
+    // A raw provider write creates a distinguishing observation: incorrectly
+    // consuming an excluded notification would add this unseen row. Equal
+    // durable/public snapshots could let a missing exclusion pass unnoticed.
+    await seed(h.db, 'items', [{ id: 2, name: 'excluded source row' }])
+    for (const patch of [
+      { tabId: original.tabId },
+      { tabId: 'remote', database: 'foreign' },
+      { tabId: 'remote', name: 'other' },
+    ]) {
+      await channel.onmessage?.(
+        new MessageEvent('message', {
+          data: {
+            ...original,
+            ...patch,
+            type: 'data-changed',
+            changedKeys: [2],
+          },
+        }),
+      )
+      assertRows(
+        collection.values(),
+        [{ id: 1, name: 'kept' }],
+        'excluded notification',
+      )
+    }
+    expect(Channel.sent.length).toBe(1)
+  })
+})
+
+it('rejects illegal missing-key updates without changing durable data', async () => {
+  await withHarness(async (h) => {
+    const collection = await h.open()
+    expect(() =>
+      collection.update('absent', (row) => {
+        row.name = 'invalid'
+      }),
+    ).toThrow()
+    expect((await readStore(h.db, 'items')).rows).toEqual([])
+  })
+})
+
+it('does not let a late startup publish into a cleaned-up sync run', async () => {
+  await withHarness(async (h) => {
+    await seed(h.db, 'items', [{ id: 1, name: 'stored' }])
+    const collection = h.make()
+    const preload = collection.preload().catch(() => undefined)
+    await collection.cleanup()
+    await preload
+    // Another IDB read supplies a concrete completion boundary for the earlier
+    // startup transaction; no elapsed-time sleep decides correctness.
+    await readStore(h.db, 'items')
+    expect(collection.status).toBe('cleaned-up')
+    expect(Channel.peers.size).toBe(0)
+    await collection.preload()
+    assertRows(
+      collection.values(),
+      [{ id: 1, name: 'stored' }],
+      'fresh sync run',
+    )
+    expect(Channel.peers.size).toBe(1)
+  })
+})
+
+// A utility does not require a subscriber or active sync run. The independent
+// before/after arrays define its durable replacement, and an already active
+// peer must learn the same result. Creating a Collection or completing cleanup
+// controls the missing-channel premise without mutating adapter internals.
+for (const status of ['idle', 'cleaned-up'] as const) {
+  for (const replacement of ['clear', 'import'] as const) {
+    it(
+      'publishes ' + replacement + ' from a ' + status + ' Collection',
+      async () => {
+        await withHarness(async (h) => {
+          await seed(h.db, 'items', [{ id: 'old', name: 'before' }])
+          const receiver = await h.open()
+          const writer = h.make()
+          if (status === 'cleaned-up') {
+            await writer.preload()
+            await writer.cleanup()
+          }
+          expect(writer.status, 'utility entry lifecycle').toBe(status)
+          const expected =
+            replacement === 'clear' ? [] : [{ id: 'new', name: 'replacement' }]
+          if (replacement === 'clear') await writer.utils.clearObjectStore()
+          else await writer.utils.importData(expected)
+          const delivered = await Channel.deliver()
+          assertRows(
+            (await readStore<Row>(h.db, 'items')).rows,
+            expected,
+            'utility durable snapshot',
+          )
+          assertRows(
+            (await h.open()).values(),
+            expected,
+            'utility fresh restore',
+          )
+          assertRows(receiver.values(), expected, 'active peer after utility')
+          expect(
+            delivered,
+            'utility notification reached the peer',
+          ).toBeGreaterThan(0)
+        })
+      },
+    )
+  }
+}
+
+// Authorship starts a Collection sync run, so a real manual transaction cannot
+// be authored by its owning Collection while keeping that Collection initially
+// idle. Instead author while ready, clean up, then accept through the manual
+// transaction's ordinary mutationFn. Cleanup retires the sync run, not the
+// independently owned transaction or its later durable acceptance.
+it('publishes manual acceptance after the writer sync run is cleaned up', async () => {
+  await withHarness(async (h) => {
+    const receiver = await h.open()
+    const writer = await h.open()
+    const row = { id: 'accepted', name: 'after cleanup' }
+    const transaction = createTransaction({
+      autoCommit: false,
+      mutationFn: ({ transaction: pending }) =>
+        writer.utils.acceptMutations(pending),
+    })
+    transaction.mutate(() => writer.insert(row))
+    await writer.cleanup()
+    expect(writer.status, 'manual acceptance entry lifecycle').toBe(
+      'cleaned-up',
+    )
+    await transaction.commit()
+    await transaction.isPersisted.promise
+    const delivered = await Channel.deliver()
+    assertRows(
+      (await readStore<Row>(h.db, 'items')).rows,
+      [row],
+      'manual acceptance durable snapshot',
+    )
+    assertRows((await h.open()).values(), [row], 'manual acceptance restore')
+    assertRows(receiver.values(), [row], 'active peer after manual acceptance')
+    expect(
+      delivered,
+      'acceptance notification reached the peer',
+    ).toBeGreaterThan(0)
+  })
+})
+
+// Administrative deletion removes native rows in every store and retires
+// every managed Collection. Its caller receipt grants no row publication
+// authority: retained errored snapshots and fresh empty restores differ.
+it('retires every managed store without publishing database deletion', async () => {
+  await withHarness(async (h) => {
+    await seed(h.db, 'items', [{ id: 'item', name: 'removed item' }])
+    await seed(h.db, 'other', [{ id: 'other', name: 'removed sibling' }])
+    const source = await h.open()
+    const sameStore = await h.open()
+    const sibling = await h.open('other')
+    await deleteDatabase(h.db.name)
+    expect(
+      await Channel.deliver(),
+      'administrative deletion emits no row notification',
+    ).toBe(0)
+    const fresh = await createIndexedDB({
+      name: h.db.name,
+      version: 1,
+      stores: ['items', 'other'],
+    })
+    try {
+      for (const name of ['items', 'other']) {
+        assertRows(
+          (await readStore<Row>(fresh, name)).rows,
+          [],
+          'deleted durable store ' + name,
+        )
+        const restored = createCollection(
+          indexedDBCollectionOptions<Row>({
+            db: fresh,
+            name,
+            getKey: (row) => row.id,
+          }),
+        )
+        try {
+          await restored.preload()
+          assertRows(restored.values(), [], 'deleted fresh restore ' + name)
+        } finally {
+          await restored.cleanup()
+        }
+      }
+      expect([source.status, sameStore.status, sibling.status]).toEqual([
+        'crashed',
+        'crashed',
+        'crashed',
+      ])
+      assertRows(
+        source.values(),
+        [{ id: 'item', name: 'removed item' }],
+        'retained originating snapshot',
+      )
+      assertRows(
+        sameStore.values(),
+        [{ id: 'item', name: 'removed item' }],
+        'retained same-store snapshot',
+      )
+      assertRows(
+        sibling.values(),
+        [{ id: 'other', name: 'removed sibling' }],
+        'retained sibling snapshot',
+      )
+    } finally {
+      fresh.close()
+    }
+  })
+})
+
+// Ported settlement law: a native blocked event is nonterminal. The authored
+// before/after snapshots distinguish provider completion, caller settlement and
+// publication. A real fake-IDB connection holds deletion; no timer decides the
+// checkpoint. Native browser lock scheduling and cancellation are outside this
+// owner. The existing unblocked deletion case is the successful control.
+it('retains every public snapshot and sends no deletion before native deletion succeeds', async () => {
+  await withHarness(async (h) => {
+    const item = { id: 'item', name: 'retained until deletion' }
+    const other = { id: 'other', name: 'sibling retained until deletion' }
+    await seed(h.db, 'items', [item])
+    await seed(h.db, 'other', [other])
+    const source = await h.open()
+    const peer = await h.open()
+    const sibling = await h.open('other')
+    const blocker = await request(indexedDB.open(h.db.name, 1))
+    const blocked = deferred()
+    const terminal = deferred()
+    const nativeDelete = indexedDB.deleteDatabase.bind(indexedDB)
+    vi.spyOn(indexedDB, 'deleteDatabase').mockImplementation((...args) => {
+      const nativeRequest = nativeDelete(...args)
+      nativeRequest.addEventListener('blocked', () => blocked.resolve())
+      nativeRequest.addEventListener('success', () => terminal.resolve())
+      nativeRequest.addEventListener('error', () =>
+        terminal.reject(nativeRequest.error ?? new Error('delete failed')),
+      )
+      return nativeRequest
+    })
+    let status = 'pending'
+    const outcome = deleteDatabase(h.db.name).then(
+      () => {
+        status = 'fulfilled'
+      },
+      () => {
+        status = 'rejected'
+      },
+    )
+    try {
+      await blocked.promise
+      // The independent read also drains promise reactions after blocked.
+      const durable = await readStore<Row>({ ...h.db, db: blocker }, 'items')
+      const before = {
+        status,
+        sent: Channel.sent.length,
+        rows: [source, peer, sibling].map((collection) =>
+          sorted(collection.values()),
+        ),
+      }
+      blocker.close()
+      await terminal.promise
+      await outcome
+      await Channel.deliver()
+      expect(before, 'blocked deletion settlement and publication').toEqual({
+        status: 'pending',
+        sent: 0,
+        rows: [[item], [item], [other]],
+      })
+      assertRows(durable.rows, [item], 'blocked deletion durable snapshot')
+      expect(status, 'native deletion acknowledged to caller').toBe('fulfilled')
+      for (const collection of [source, peer, sibling]) {
+        assertRows(
+          collection.values(),
+          collection === sibling ? [other] : [item],
+          'deletion retains errored snapshot',
+        )
+        expect(collection.status).toBe('crashed')
+      }
+      const fresh = await createIndexedDB({
+        name: h.db.name,
+        version: 1,
+        stores: ['items', 'other'],
+      })
+      try {
+        for (const name of ['items', 'other'])
+          assertRows(
+            (await readStore<Row>(fresh, name)).rows,
+            [],
+            'fresh durable state after deletion',
+          )
+      } finally {
+        fresh.close()
+      }
+    } finally {
+      blocker.close()
+      await terminal.promise
+      await outcome
+    }
+  })
+})
+
+// Failure to issue deletion changes neither storage nor the published source.
+// This injected factory failure has no native request, so it makes no rollback
+// claim for an operation that already reached the provider. Rejected native
+// admission does not close an unrelated managed connection.
+it('preserves durable and public snapshots when deletion cannot be issued', async () => {
+  await withHarness(async (h) => {
+    const item = { id: 'item', name: 'retained item' }
+    const other = { id: 'other', name: 'retained sibling' }
+    await seed(h.db, 'items', [item])
+    await seed(h.db, 'other', [other])
+    const source = await h.open()
+    const peer = await h.open()
+    const sibling = await h.open('other')
+    const issue = vi
+      .spyOn(indexedDB, 'deleteDatabase')
+      .mockImplementation(() => {
+        throw new DOMException('storage deletion denied', 'SecurityError')
+      })
+    await expect(deleteDatabase(h.db.name)).rejects.toThrow(
+      'storage deletion denied',
+    )
+    issue.mockRestore()
+    expect(
+      Channel.sent,
+      'failed deletion sends no success notification',
+    ).toEqual([])
+    assertRows(source.values(), [item], 'failed deletion originating snapshot')
+    assertRows(peer.values(), [item], 'failed deletion same-store snapshot')
+    assertRows(sibling.values(), [other], 'failed deletion sibling snapshot')
+    const fresh = await createIndexedDB({
+      name: h.db.name,
+      version: 1,
+      stores: ['items', 'other'],
+    })
+    try {
+      for (const [name, rows] of [
+        ['items', [item]],
+        ['other', [other]],
+      ] as const)
+        assertRows(
+          (await readStore<Row>(fresh, name)).rows,
+          rows,
+          'failed deletion durable snapshot',
+        )
+    } finally {
+      fresh.close()
+    }
+  })
+})
+
+// Managed connection ownership, approved by the maintainer: createIndexedDB
+// closes its native connection when another request delivers versionchange.
+// Closing permits upgrade/deletion and marks affected Collections errored.
+// Upgrade preserves durable rows; deletion removes them without publishing
+// replacement rows into retained Collections. The caller recreates descriptors and Collections for
+// subsequent persistence through the changed database.
+//
+// The reference is authored rows plus the operation's native version: upgrade
+// retains rows at version 2; deletion recreates empty stores at version 1. The
+// finite grammar crosses two/three independent descriptors with upgrade/delete.
+// Source, same-store peer and sibling-store peer stay active through the native
+// operation. With two descriptors, both peers share the second connection; with
+// three, each Collection has its own. These roles expose connection ownership
+// that the shared-descriptor histories above cannot exercise.
+//
+// Native fake-IDB versionchange/blocked events are the reach witnesses. At a
+// blocked event the driver records the violation, then closes fixture-owned
+// descriptors so native completion and the remaining observations can run.
+// The final zero-blocked assertion therefore rejects missing automatic close
+// directly instead of timing out. Raw unmanaged blockers retain the separate
+// pending settlement contract in wrapper.test.ts. Real pages, transactions
+// already in flight, application notification and elapsed-time bounds are outside
+// this finite grammar; controlled Channel delivery is not browser scheduling.
+for (const count of [2, 3]) {
+  for (const operation of ['upgrade', 'delete'] as const) {
+    it(
+      operation + ' releases ' + count + ' independent managed connections',
+      async () => {
+        await withHarness(async (h) => {
+          const item = { id: 'item', name: 'retained by upgrade' }
+          const other = { id: 'other', name: 'sibling retained by upgrade' }
+          await seed(h.db, 'items', [item])
+          await seed(h.db, 'other', [other])
+          const descriptors = [h.db]
+          try {
+            for (let index = 1; index < count; index++)
+              descriptors.push(
+                await createIndexedDB({
+                  name: h.db.name,
+                  version: 1,
+                  stores: ['items', 'other'],
+                }),
+              )
+            expect(
+              new Set(descriptors.map((descriptor) => descriptor.db)).size,
+              'independent native connection premise',
+            ).toBe(count)
+            const source = await h.open()
+            const peer = await h.open('items', { db: descriptors[1]! })
+            const sibling = await h.open('other', {
+              db: descriptors[count - 1]!,
+            })
+            const collections = [source, peer, sibling]
+            const versionchanges = descriptors.map(
+              () =>
+                [] as Array<{ oldVersion: number; newVersion: number | null }>,
+            )
+            descriptors.forEach((descriptor, index) => {
+              descriptor.db.addEventListener('versionchange', (event) => {
+                versionchanges[index]!.push({
+                  oldVersion: event.oldVersion,
+                  newVersion: event.newVersion,
+                })
+              })
+            })
+            let blockedEvents = 0
+            function observe(nativeRequest: IDBOpenDBRequest) {
+              nativeRequest.addEventListener('blocked', () => {
+                blockedEvents++
+                for (const descriptor of descriptors) descriptor.close()
+              })
+              return nativeRequest
+            }
+            const nativeOpen = indexedDB.open.bind(indexedDB)
+            const nativeDelete = indexedDB.deleteDatabase.bind(indexedDB)
+            const openSpy = vi
+              .spyOn(indexedDB, 'open')
+              .mockImplementation((...args) => observe(nativeOpen(...args)))
+            const deleteSpy = vi
+              .spyOn(indexedDB, 'deleteDatabase')
+              .mockImplementation((...args) => observe(nativeDelete(...args)))
+            const fresh =
+              operation === 'upgrade'
+                ? await createIndexedDB({
+                    name: h.db.name,
+                    version: 2,
+                    stores: ['items', 'other', 'added'],
+                  })
+                : await (async () => {
+                    await deleteDatabase(h.db.name)
+                    expect(
+                      await Channel.deliver(),
+                      'administrative deletion has no notification',
+                    ).toBe(0)
+                    for (const collection of collections)
+                      assertRows(
+                        collection.values(),
+                        collection === sibling ? [other] : [item],
+                        'retained managed snapshot',
+                      )
+                    return createIndexedDB({
+                      name: h.db.name,
+                      version: 1,
+                      stores: ['items', 'other'],
+                    })
+                  })()
+            descriptors.push(fresh)
+            openSpy.mockRestore()
+            deleteSpy.mockRestore()
+
+            expect(
+              versionchanges,
+              'every open managed connection receives versionchange',
+            ).toEqual(
+              Array.from({ length: count }, () => [
+                {
+                  oldVersion: 1,
+                  newVersion: operation === 'upgrade' ? 2 : null,
+                },
+              ]),
+            )
+            expect(
+              fresh.version,
+              'native operation reached its terminal version',
+            ).toBe(operation === 'upgrade' ? 2 : 1)
+            for (const [name, before] of [
+              ['items', [item]],
+              ['other', [other]],
+            ] as const) {
+              const expected = operation === 'upgrade' ? before : []
+              assertRows(
+                (await readStore<Row>(fresh, name)).rows,
+                expected,
+                'durable rows after native ' + operation,
+              )
+            }
+            for (const [index, collection] of collections.entries()) {
+              expect(collection.status).toBe('crashed')
+              expect(() =>
+                collection.insert({ id: 'closed-' + index, name: 'rejected' }),
+              ).toThrow()
+              assertRows(
+                collection.values(),
+                index === 2 ? [other] : [item],
+                'errored Collection retains source',
+              )
+            }
+            // Recreate consumers explicitly. Delivering a later write into an
+            // obsolete connection would test a different receiving-work contract.
+            for (const collection of collections) await collection.cleanup()
+            const restored = await h.open('items', { db: fresh })
+            const restoredSibling = await h.open('other', { db: fresh })
+            assertRows(
+              restored.values(),
+              operation === 'upgrade' ? [item] : [],
+              'fresh items restore after native ' + operation,
+            )
+            assertRows(
+              restoredSibling.values(),
+              operation === 'upgrade' ? [other] : [],
+              'fresh sibling restore after native ' + operation,
+            )
+            if (operation === 'upgrade') {
+              const added = await h.open('added', { db: fresh })
+              assertRows(added.values(), [], 'new store starts empty')
+              const suffix = {
+                id: 'suffix',
+                name: 'written through new descriptor',
+              }
+              const addedRow = { id: 'added', name: 'written in new store' }
+              await restored.insert({ ...suffix }).isPersisted.promise
+              await added.insert({ ...addedRow }).isPersisted.promise
+              await Channel.deliver()
+              assertRows(
+                restored.values(),
+                [item, suffix],
+                'new descriptor write',
+              )
+              assertRows(
+                (await readStore<Row>(fresh, 'items')).rows,
+                [item, suffix],
+                'new descriptor durable write',
+              )
+              assertRows(
+                (await readStore<Row>(fresh, 'added')).rows,
+                [addedRow],
+                'new store durable write',
+              )
+              assertRows(
+                restoredSibling.values(),
+                [other],
+                'sibling remains intact',
+              )
+            }
+            expect(
+              blockedEvents,
+              'managed versionchange closes every connection',
+            ).toBe(0)
+          } finally {
+            for (const descriptor of descriptors) descriptor.close()
+          }
+        })
+      },
+    )
+  }
+}
+
+// Invalid envelopes are not source writes. Keep a raw unseen row as a positive
+// witness: a valid neighboring envelope must read it, while each malformed form
+// must leave both the public snapshot and Collection status unchanged.
+it('excludes malformed channel envelopes before storage or publication', async () => {
+  await withHarness(async (h) => {
+    const c = await h.open(),
+      channel = [...Channel.peers][0]!
+    await seed(h.db, 'items', [{ id: 1, name: 'valid neighbor' }])
+    const valid = {
+      type: 'data-changed',
+      database: h.db.name,
+      name: 'items',
+      tabId: 'peer',
+      changedKeys: [1],
+    }
+    const invalid = [
+      null,
+      undefined,
+      1,
+      'message',
+      {},
+      { ...valid, type: 'unknown' },
+      { ...valid, changedKeys: null },
+      { ...valid, changedKeys: { length: 1 } },
+      { ...valid, changedKeys: [{}] },
+      { ...valid, changedKeys: [NaN] },
+      { ...valid, tabId: null },
+    ]
+    const reads = vi.spyOn(h.db.db, 'transaction')
+    for (const data of invalid) {
+      await channel.onmessage?.(new MessageEvent('message', { data }))
+      expect(c.status).toBe('ready')
+      assertRows(c.values(), [], 'invalid envelope exclusion')
+      expect(
+        reads,
+        'invalid envelope has no storage authority',
+      ).not.toHaveBeenCalled()
+    }
+    await channel.onmessage?.(new MessageEvent('message', { data: valid }))
+    expect(reads, 'valid envelope reaches storage').toHaveBeenCalledTimes(1)
+    assertRows(
+      c.values(),
+      [{ id: 1, name: 'valid neighbor' }],
+      'valid envelope reach',
+    )
+  })
+})
+
+// A deletion notification has authority only over the retired connection. A
+// native success event can be delivered after another context has recreated the
+// database. Hold that receipt (not native deletion), create and write through a
+// fresh descriptor, then compare its authored snapshot after late delivery.
+// This controlled callback premise still needs a native multi-page witness.
+it('ignores an old native deletion receipt after database recreation', async () => {
+  await withHarness(async (h) => {
+    const old = await h.open(),
+      nativeComplete = deferred(),
+      receipt = deferred(),
+      original = indexedDB.deleteDatabase.bind(indexedDB)
+    vi.spyOn(indexedDB, 'deleteDatabase').mockImplementation((name) => {
+      const req = original(name)
+      let callback: ((this: IDBRequest, event: Event) => unknown) | null = null
+      Object.defineProperty(req, 'onsuccess', {
+        get: () => null,
+        set: (value) => {
+          callback = value
+        },
+        configurable: true,
+      })
+      req.addEventListener('success', (event) => {
+        nativeComplete.resolve()
+        void receipt.promise.then(() => callback?.call(req, event))
+      })
+      return req
+    })
+    const deletion = deleteDatabase(h.db.name)
+    await nativeComplete.promise
+    expect(old.status).toBe('crashed')
+    const recreated = await createIndexedDB({
+      name: h.db.name,
+      version: 1,
+      stores: ['items'],
+    })
+    h.descriptors.push(recreated)
+    const fresh = await h.open('items', { db: recreated })
+    await fresh.insert({ id: 1, name: 'new incarnation' }).isPersisted.promise
+    Channel.pending = []
+    receipt.resolve()
+    await deletion
+    await Channel.deliver()
+    assertRows(
+      (await readStore<Row>(recreated, 'items')).rows,
+      [{ id: 1, name: 'new incarnation' }],
+      'recreated durable snapshot',
+    )
+    assertRows(
+      fresh.values(),
+      [{ id: 1, name: 'new incarnation' }],
+      'new incarnation public',
+    )
+  })
+})
+
+// Managed versionchange intentionally closes the old connection. A subsequent
+// read fails through the existing Collection error path; a fresh descriptor
+// restores the new durable rows. This preserves the approved recreation policy.
+it('reports connection closure immediately and supports fresh Collections', async () => {
+  await withHarness(async (h) => {
+    const old = await h.open()
+    const live = createLiveQueryCollection((q) => q.from({ row: old }))
+    h.disposers.push(() => live.cleanup())
+    await live.preload()
+    const upgraded = await createIndexedDB({
+      name: h.db.name,
+      version: 2,
+      stores: ['items'],
+    })
+    h.descriptors.push(upgraded)
+    // Closure crashes the source, and a crashed source ends every live query
+    // above it, even one that was already ready. Both trees explain why.
+    expect(old.status).toBe('crashed')
+    expect(live.status).toBe('crashed')
+    expect(live.health.sources[0]).toMatchObject({
+      status: 'crashed',
+      error: expect.anything(),
+    })
+    const fresh = await h.open('items', { db: upgraded })
+    await fresh.insert({ id: 1, name: 'new' }).isPersisted.promise
+    await Channel.deliver()
+    expect(old.status).toBe('crashed')
+    expect(live.status).toBe('crashed')
+    expect(live.health.hasErrors).toBe(true)
+    expect(fresh.status).toBe('ready')
+    assertRows(
+      fresh.values(),
+      [{ id: 1, name: 'new' }],
+      'new connection usable',
+    )
+  })
+})
+
+// A notification is an invalidation, not a row snapshot. A raw wrapper write
+// can replace its row and remove optional version metadata before delivery.
+// Current durable values still determine source membership and full-row values.
+// The finite grammar crosses present/absent initial rows, typed keys, and absent
+// or current metadata at the receiving read. Each history delivers a real peer
+// notification twice, then an ordinary peer suffix proves the cache stays usable.
+for (const present of [false, true]) {
+  for (const metadata of [false, true]) {
+    for (const key of [1, '1']) {
+      it(`reads current rows with initial membership ${present}, metadata ${metadata}, ${typeof key} key`, async () => {
+        await withHarness(async (h) => {
+          const anchor = { id: 'anchor', name: 'untouched' }
+          const before = { id: key, name: 'before', optional: 1 }
+          await seed(h.db, 'items', present ? [anchor, before] : [anchor])
+          const receiver = await h.open()
+          const sender = await h.open('items', { db: await h.connect() })
+          if (present)
+            await sender.update(key, (row) => {
+              row.name = 'notified'
+            }).isPersisted.promise
+          else
+            await sender.insert({ id: key, name: 'notified' }).isPersisted
+              .promise
+          const current = { id: key, name: 'current' }
+          await executeTransaction(
+            h.db.db,
+            ['items', '_versions'],
+            'readwrite',
+            (_, stores) => {
+              stores.items!.put(current, key)
+              if (!metadata) stores._versions!.delete(['items', key])
+            },
+          )
+          Channel.pending.push(...Channel.pending)
+          expect(
+            await Channel.deliver(),
+            'real peer notification delivered twice',
+          ).toBe(2)
+          expect(receiver.status).toBe('ready')
+          const expected = [anchor, current]
+          assertRows(
+            receiver.values(),
+            expected,
+            'current durable value without omitted field',
+          )
+          assertRows(
+            (await readStore<Row>(h.db, 'items')).rows,
+            expected,
+            'current raw storage',
+          )
+          const fresh = await h.open()
+          assertRows(fresh.values(), expected, 'current restore')
+          await fresh.update(key, (row) => {
+            row.name = 'suffix'
+          }).isPersisted.promise
+          await Channel.deliver()
+          assertRows(
+            receiver.values(),
+            [anchor, { ...current, name: 'suffix' }],
+            'ordinary versioned suffix',
+          )
+        })
+      })
+    }
+  }
+}
+
+// Two deletion lifetimes distinguish connection retirement from deletion
+// completion. An old successful receipt can arrive after a recreated peer has
+// observed a newer native deletion request that is still blocked. Only the
+// newer deletion's success may empty that peer; native versionchange alone
+// grants no authority to the unrelated old receipt.
+it('preserves a recreated peer while a newer deletion is blocked', async () => {
+  await withHarness(async (h) => {
+    const old = await h.open()
+    const nativeComplete = deferred(),
+      receipt = deferred(),
+      blocked = deferred()
+    const nativeDelete = indexedDB.deleteDatabase.bind(indexedDB)
+    let deletes = 0
+    vi.spyOn(indexedDB, 'deleteDatabase').mockImplementation((name) => {
+      const req = nativeDelete(name)
+      if (deletes++ === 0) {
+        let callback: ((this: IDBRequest, event: Event) => unknown) | null =
+          null
+        Object.defineProperty(req, 'onsuccess', {
+          get: () => null,
+          set: (value) => {
+            callback = value
+          },
+          configurable: true,
+        })
+        req.addEventListener('success', (event) => {
+          nativeComplete.resolve()
+          void receipt.promise.then(() => callback?.call(req, event))
+        })
+      } else req.addEventListener('blocked', () => blocked.resolve())
+      return req
+    })
+    const firstDeletion = deleteDatabase(h.db.name)
+    await nativeComplete.promise
+    expect(old.status).toBe('crashed')
+    const freshDb = await h.connect()
+    const peerDb = await h.connect()
+    const fresh = await h.open('items', { db: freshDb })
+    const peer = await h.open('items', { db: peerDb })
+    const expected = [{ id: 1, name: 'recreated' }]
+    await fresh.insert(expected[0]!).isPersisted.promise
+    await Channel.deliver()
+    const blockerRequest = indexedDB.open(h.db.name, 1)
+    const blocker = await request(blockerRequest)
+    let secondComplete = false
+    const secondDeletion = deleteDatabase(h.db.name).then(() => {
+      secondComplete = true
+    })
+    let observed: Array<Row> = [],
+      durable: Array<Row> = [],
+      premature = false
+    try {
+      await blocked.promise
+      receipt.resolve()
+      await firstDeletion
+      await Channel.deliver()
+      observed = sorted(peer.values())
+      durable = (await readStore<Row>({ ...freshDb, db: blocker }, 'items'))
+        .rows
+      premature = secondComplete
+    } finally {
+      receipt.resolve()
+      blocker.close()
+      await firstDeletion
+      await secondDeletion
+      await Channel.deliver()
+    }
+    expect(premature, 'newer native deletion remains blocked').toBe(false)
+    assertRows(durable, expected, 'newer blocked deletion durable')
+    assertRows(observed, expected, 'old receipt cannot complete newer deletion')
+  })
+})
diff --git a/packages/db/tests/indexed-db/wrapper-settlement-oracle.test.ts b/packages/db/tests/indexed-db/wrapper-settlement-oracle.test.ts
index c2688b63c2..f582a41753 100644
--- a/packages/db/tests/indexed-db/wrapper-settlement-oracle.test.ts
+++ b/packages/db/tests/indexed-db/wrapper-settlement-oracle.test.ts
@@ -21,6 +21,7 @@
  */
 import { expect, it } from 'vitest'
 import { executeTransaction } from '../../src'
+import { declareOracle } from '../oracle-declaration'
 import { deferred, readStore, withHarness } from './harness'
 
 type NativeOutcome = 'complete' | 'abort'
@@ -35,6 +36,7 @@ function expectedCaller(
   if (native === 'abort') return 'rejected'
   return callbackFulfilled ? 'fulfilled' : 'pending'
 }
+declareOracle({ model: [expectedCaller] })
 
 for (const native of ['complete', 'abort'] as const) {
   for (const registration of [
diff --git a/packages/db/tests/live-query-deferred-acquisition-oracle.test.ts b/packages/db/tests/live-query-deferred-acquisition-oracle.test.ts
index 094bcf292b..9b29526b7a 100644
--- a/packages/db/tests/live-query-deferred-acquisition-oracle.test.ts
+++ b/packages/db/tests/live-query-deferred-acquisition-oracle.test.ts
@@ -50,55 +50,29 @@
  * `DbClient` stream preloads, a subscriber that outlives cleanup, and reads
  * that wait for readiness.
  */
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { fc } from '@fast-check/vitest'
+import { createCollection } from '../src'
 import { resumeDeferredLiveQueryCollections } from '../src/live-query-options.js'
-import {
-  BTreeIndex,
-  DbClient,
-  collectionOptions,
-  createCollection,
-  createLiveQueryCollection,
-  createLiveQueryObserver,
-  eq,
-  getLiveQueryHash,
-  prepareLiveQueryValue,
-} from '../src'
 import { Query } from '../src/query/builder/index.js'
 import { createPooledLiveQuery } from '../src/query/pooled-live-query.js'
 import { expectedStartHandoff } from './collection-subscription-lifecycle-grammar-oracle.js'
-import { createOracleReach } from './oracle-reach.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
-import type { Collection, LiveQueryObserver } from '../src'
-
-type Row = { id: string; rank: number; group: string }
-const ROWS: Array<Row> = [
-  { id: `a`, rank: 1, group: `g` },
-  { id: `b`, rank: 2, group: `g` },
-  { id: `c`, rank: 3, group: `g` },
-]
-
-/**
- * ## Source states
- *
- * `-running` and `-holding` source Collections already started their sync
- * run, by `startSync: true`, before any live-query Collection exists. An eager
- * source Collection writes every row when its sync run starts. An on-demand
- * source Collection writes rows only for an acquisition attempt, except that
- * `on-demand-holding` already holds every row, as it would after another
- * consumer's acquisition. Each fixture counts sync-run starts and acquisition
- * attempts: those are its provider work.
- * `-render-deferred` sources are idle behind an abandoned render's start gate.
- * They expose the same demand law through a different production start path.
- */
-type SourceState =
-  | `eager-idle`
-  | `eager-running`
-  | `eager-render-deferred`
-  | `on-demand-idle`
-  | `on-demand-running`
-  | `on-demand-holding`
-  | `on-demand-render-deferred`
+import { createOracleReach } from './oracle-reach.js'
+import { declareOracle } from './oracle-declaration.js'
+import {
+  EXPECTED_IDS,
+  QUERY_SHAPES,
+  makeLiveQuery,
+  makeSource,
+  pooledQuery,
+  settle,
+} from './live-query-deferred-acquisition-support.js'
+import type {
+  QueryShape,
+  Row,
+  SourceState,
+} from './live-query-deferred-acquisition-support.js'
 
 const SOURCE_STATES: Array<SourceState> = [
   `eager-idle`,
@@ -110,19 +84,6 @@ const SOURCE_STATES: Array<SourceState> = [
   `on-demand-render-deferred`,
 ]
 
-/**
- * ## Query shapes
- *
- * `all` reads every row. `window` orders by rank and keeps a limit of two,
- * which uses the ordered loading path.
- */
-type QueryShape = `all` | `window`
-const QUERY_SHAPES: Array<QueryShape> = [`all`, `window`]
-const EXPECTED_IDS: Record<QueryShape, Array<string>> = {
-  all: [`a`, `b`, `c`],
-  window: [`a`, `b`],
-}
-
 /**
  * ## History grammar
  *
@@ -334,95 +295,6 @@ function applyModel(
   }
 }
 
-/**
- * ## Production driver
- *
- * Real Collections only. The source Collection counts its own provider work.
- * The driver reads the outer live-query Collection's status right after each
- * command returns, for the synchronous observation cut, and its status and
- * rows again after the history settles.
- */
-let sequence = 0
-
-function makeSource(state: SourceState) {
-  const counts = { starts: 0, acquisitions: 0 }
-  const onDemand = state.startsWith(`on-demand`)
-  const written = new Set<string>()
-  // Set while a sync run is active: replaces the source's rows, as a
-  // must-refetch does. An eager source writes every row again.
-  let truncateRows: (() => void) | undefined
-  const collection = createCollection<Row>({
-    id: `deferred-acquisition-${sequence++}`,
-    getKey: (row) => row.id,
-    syncMode: onDemand ? `on-demand` : `eager`,
-    startSync: state.endsWith(`running`) || state.endsWith(`holding`),
-    autoIndex: `eager`,
-    defaultIndexType: BTreeIndex,
-    gcTime: 0,
-    sync: {
-      sync: ({ begin, write, commit, markReady, truncate }) => {
-        counts.starts++
-        const writeAll = () => {
-          begin()
-          for (const row of ROWS) {
-            if (written.has(row.id)) continue
-            written.add(row.id)
-            write({ type: `insert`, value: row })
-          }
-          commit()
-        }
-        if (!onDemand || state === `on-demand-holding`) writeAll()
-        truncateRows = () => {
-          begin()
-          truncate()
-          commit()
-          written.clear()
-          if (!onDemand) writeAll()
-        }
-        markReady()
-        if (!onDemand) return
-        return {
-          loadSubset: () => {
-            counts.acquisitions++
-            writeAll()
-            return true
-          },
-        }
-      },
-    },
-  })
-  if (state.endsWith(`render-deferred`)) collection._deferSyncStart()
-  return { collection, counts, truncate: () => truncateRows?.() }
-}
-
-function makeLiveQuery(
-  source: Collection<Row, string | number, any>,
-  shape: QueryShape,
-  depth: 1 | 2,
-) {
-  const read = (q: any, from: unknown) => {
-    const base = q
-      .from({ row: from })
-      .orderBy(({ row }: any) => row.rank, `asc`)
-    return shape === `window` ? base.limit(2) : base
-  }
-  const inner = createLiveQueryCollection({
-    query: (q) => read(q, source),
-    gcTime: 0,
-  })
-  if (depth === 1) return { outer: inner, collections: [inner] }
-  const outer = createLiveQueryCollection({
-    query: (q) => read(q, inner),
-    gcTime: 0,
-  })
-  return { outer, collections: [outer, inner] }
-}
-
-async function settle(): Promise<void> {
-  for (let turn = 0; turn < 4; turn++) await Promise.resolve()
-  await new Promise((resolve) => setTimeout(resolve, 0))
-}
-
 /**
  * ## Refinement check
  *
@@ -431,111 +303,115 @@ async function settle(): Promise<void> {
  * rows with the model. A failure names the source state, query shape, depth,
  * history, and step.
  */
+async function runAcquisitionHistory(
+  state: SourceState,
+  shape: QueryShape,
+  depth: 1 | 2,
+  commands: ReadonlyArray<Command>,
+): Promise<void> {
+  const {
+    collection: source,
+    counts,
+    truncate: truncateSource,
+  } = makeSource(state)
+  const { outer, collections } = makeLiveQuery(source, shape, depth)
+  let peer: { unsubscribe: () => void } | undefined
+  let model = initialModel(state)
+  let subscription: ReturnType<typeof outer.subscribeChanges> | undefined
+  try {
+    for (const [step, command] of commands.entries()) {
+      const before = { ...counts }
+      let pending: Promise<void> | undefined
+      switch (command) {
+        case `start`:
+          outer.startSyncImmediate()
+          break
+        case `read`:
+          break
+        case `subscribe`:
+          subscription = outer.subscribeChanges(() => {}, {
+            includeInitialState: true,
+          })
+          break
+        case `defer-subscribe`:
+          subscription = outer.subscribeChanges(() => {}, {
+            includeInitialState: true,
+            deferAcquisition: true,
+          })
+          break
+        case `resume`:
+          subscription!.resumeDeferredAcquisition()
+          break
+        case `unsubscribe`:
+          subscription?.unsubscribe()
+          subscription = undefined
+          break
+        case `preload`:
+          pending = outer.preload()
+          break
+        case `cleanup`:
+          subscription?.unsubscribe()
+          subscription = undefined
+          pending = outer.cleanup()
+          break
+        case `peer`:
+          peer = source.subscribeChanges(() => {})
+          break
+        case `truncate`:
+          truncateSource()
+          break
+      }
+      const statusAtCall = outer.status
+      await pending
+      await settle()
+      const result = applyModel(state, shape, depth, model, command)
+      model = result.next
+      const { expected } = result
+      const where = `${command} at step ${step}`
+
+      expect(
+        counts.starts - before.starts,
+        `${where}: source sync-run starts`,
+      ).toBe(expected.startsAdded)
+      const attempts = counts.acquisitions - before.acquisitions
+      if (expected.acquisitions === `none`) {
+        expect(attempts, `${where}: acquisition attempts`).toBe(0)
+      } else {
+        expect(attempts, `${where}: acquisition attempts`).toBeGreaterThan(0)
+      }
+      if (expected.readyAtCall) {
+        expect(statusAtCall, `${where}: ready before the call returns`).toBe(
+          `ready`,
+        )
+      }
+      if (expected.ready !== `unchecked`) {
+        expect(
+          outer.status === `ready`,
+          `${where}: initial-query readiness (status ${outer.status})`,
+        ).toBe(expected.ready)
+      }
+      if (expected.ids !== `unchecked`) {
+        expect(
+          outer.toArray.map((row) => row.id),
+          `${where}: rows`,
+        ).toEqual(expected.ids)
+      }
+    }
+  } finally {
+    subscription?.unsubscribe()
+    peer?.unsubscribe()
+    for (const collection of collections) await collection.cleanup()
+    await source.cleanup()
+  }
+}
+
 describe(`live-query deferred acquisition`, () => {
   for (const state of SOURCE_STATES) {
     for (const shape of QUERY_SHAPES) {
       for (const depth of [1, 2] as const) {
         for (const [name, commands] of Object.entries(HISTORIES)) {
           it(`${state}, ${shape}, depth ${depth}: ${name}`, async () => {
-            const {
-              collection: source,
-              counts,
-              truncate: truncateSource,
-            } = makeSource(state)
-            const { outer, collections } = makeLiveQuery(source, shape, depth)
-            let peer: { unsubscribe: () => void } | undefined
-            let model = initialModel(state)
-            let subscription:
-              ReturnType<typeof outer.subscribeChanges> | undefined
-            try {
-              for (const [step, command] of commands.entries()) {
-                const before = { ...counts }
-                let pending: Promise<void> | undefined
-                switch (command) {
-                  case `start`:
-                    outer.startSyncImmediate()
-                    break
-                  case `read`:
-                    break
-                  case `subscribe`:
-                    subscription = outer.subscribeChanges(() => {}, {
-                      includeInitialState: true,
-                    })
-                    break
-                  case `defer-subscribe`:
-                    subscription = outer.subscribeChanges(() => {}, {
-                      includeInitialState: true,
-                      deferAcquisition: true,
-                    })
-                    break
-                  case `resume`:
-                    subscription!.resumeDeferredAcquisition()
-                    break
-                  case `unsubscribe`:
-                    subscription?.unsubscribe()
-                    subscription = undefined
-                    break
-                  case `preload`:
-                    pending = outer.preload()
-                    break
-                  case `cleanup`:
-                    subscription?.unsubscribe()
-                    subscription = undefined
-                    pending = outer.cleanup()
-                    break
-                  case `peer`:
-                    peer = source.subscribeChanges(() => {})
-                    break
-                  case `truncate`:
-                    truncateSource()
-                    break
-                }
-                const statusAtCall = outer.status
-                await pending
-                await settle()
-                const result = applyModel(state, shape, depth, model, command)
-                model = result.next
-                const { expected } = result
-                const where = `${command} at step ${step}`
-
-                expect(
-                  counts.starts - before.starts,
-                  `${where}: source sync-run starts`,
-                ).toBe(expected.startsAdded)
-                const attempts = counts.acquisitions - before.acquisitions
-                if (expected.acquisitions === `none`) {
-                  expect(attempts, `${where}: acquisition attempts`).toBe(0)
-                } else {
-                  expect(
-                    attempts,
-                    `${where}: acquisition attempts`,
-                  ).toBeGreaterThan(0)
-                }
-                if (expected.readyAtCall) {
-                  expect(
-                    statusAtCall,
-                    `${where}: ready before the call returns`,
-                  ).toBe(`ready`)
-                }
-                if (expected.ready !== `unchecked`) {
-                  expect(
-                    outer.status === `ready`,
-                    `${where}: initial-query readiness (status ${outer.status})`,
-                  ).toBe(expected.ready)
-                }
-                if (expected.ids !== `unchecked`) {
-                  expect(
-                    outer.toArray.map((row) => row.id),
-                    `${where}: rows`,
-                  ).toEqual(expected.ids)
-                }
-              }
-            } finally {
-              subscription?.unsubscribe()
-              peer?.unsubscribe()
-              for (const collection of collections) await collection.cleanup()
-              await source.cleanup()
-            }
+            return runAcquisitionHistory(state, shape, depth, commands)
           })
         }
       }
@@ -558,69 +434,70 @@ describe(`live-query deferred acquisition`, () => {
  * client, which must not mistake the absent config for a live-query builder.
  */
 // The pooled entry point takes the internal builder, as its own oracle does.
-const pooledQuery =
-  (source: Collection<Row, string | number, any>) => (q: any) =>
-    q
-      .from({ row: source })
-      .where(({ row }: any) => eq(row.group, `g`))
-      .orderBy(({ row }: any) => row.rank, `asc`)
+declareOracle({
+  check: [runAcquisitionHistory, runPooledHistory],
+  model: [initialModel, applyModel, expectedReplacementRun],
+})
 
-describe(`pooled live-query deferred acquisition`, () => {
-  it.each([
-    [`eager-idle`, `no SSR cleanup client`],
-    [`eager-running`, `no SSR cleanup client`],
-    [`eager-idle`, `an SSR cleanup client`],
-    [`eager-running`, `an SSR cleanup client`],
-  ] as const)(
-    `an observer preload reaches a config-free pooled view from %s with %s`,
-    async (state, clientMode) => {
-      const { collection: source, counts } = makeSource(state)
-      const view = createPooledLiveQuery(pooledQuery(source)(new Query()), {
-        gcTime: 0,
-      })
-      expect(view, `the query is poolable`).toBeDefined()
-      const client =
-        clientMode === `an SSR cleanup client` ? new DbClient() : undefined
-      client?._setSsrServerCleanupEnabled(true)
-      let observer: LiveQueryObserver<Row, string | number> | undefined
-      let constructionError: unknown
-      try {
-        observer = createLiveQueryObserver(view as Collection<Row>, {
-          client,
-          queryHash: `config-free-pooled-view`,
-        })
-      } catch (error) {
-        constructionError = error
+async function runPooledHistory(
+  state: SourceState,
+  commands: ReadonlyArray<Command>,
+): Promise<void> {
+  const { collection: source, counts } = makeSource(state)
+  let view: any
+  let model = initialModel(state)
+  let subscription: { unsubscribe: () => void } | undefined
+  try {
+    for (const [step, command] of commands.entries()) {
+      const before = { ...counts }
+      switch (command) {
+        case `start`:
+          view = createPooledLiveQuery(pooledQuery(source)(new Query()), {
+            gcTime: 0,
+          })
+          expect(view, `the query is poolable`).toBeDefined()
+          break
+        case `read`:
+          break
+        case `subscribe`:
+          subscription = view.subscribeChanges(() => {})
+          break
+        case `preload`:
+          await view.preload()
+          break
+        default:
+          throw new Error(`pooled history uses no ${command}`)
       }
-      try {
+      await settle()
+      const result = applyModel(state, `all`, 1, model, command)
+      model = result.next
+      const { expected } = result
+      const where = `${command} at step ${step}`
+      expect(
+        counts.starts - before.starts,
+        `${where}: source sync-run starts`,
+      ).toBe(expected.startsAdded)
+      if (expected.ready !== `unchecked`) {
         expect(
-          constructionError,
-          `observer construction succeeds`,
-        ).toBeUndefined()
-        if (!observer) throw new Error(`missing observer after construction`)
-        // Model: explicit demand starts an idle source once. An already
-        // running source needs no second start for the same public rows.
-        const startsBefore = counts.starts
-        await expect(
-          Promise.resolve().then(() => observer.preload()),
-          `observer preload succeeds`,
-        ).resolves.toBeUndefined()
-        await settle()
-        expect(counts.starts - startsBefore, `new source starts`).toBe(
-          state === `eager-idle` ? 1 : 0,
-        )
-        expect(observer.getSnapshot().status).toBe(`ready`)
-        const rows = observer.getSnapshot().data as ReadonlyArray<Row>
-        expect(rows.map((row) => row.id)).toEqual(EXPECTED_IDS.all)
-      } finally {
-        observer?.dispose()
-        await view?.cleanup()
-        await source.cleanup({ dependents: true })
-        await client?.cleanup()
+          view.status === `ready`,
+          `${where}: initial-query readiness (status ${view.status})`,
+        ).toBe(expected.ready)
       }
-    },
-  )
+      if (expected.ids !== `unchecked`) {
+        expect(
+          Array.from(view.entries(), ([, row]: [unknown, Row]) => row.id),
+          `${where}: rows`,
+        ).toEqual(expected.ids)
+      }
+    }
+  } finally {
+    subscription?.unsubscribe()
+    await view?.cleanup()
+    await source.cleanup({ dependents: true })
+  }
+}
 
+describe(`pooled live-query deferred acquisition`, () => {
   const pooledHistories: Record<string, Array<Command>> = {
     'build and read without a subscriber': [`start`, `read`],
     'subscribe after build': [`start`, `read`, `subscribe`],
@@ -629,485 +506,31 @@ describe(`pooled live-query deferred acquisition`, () => {
   for (const state of [`eager-idle`, `eager-running`] as const) {
     for (const [name, commands] of Object.entries(pooledHistories)) {
       it(`${state}: ${name}`, async () => {
-        const { collection: source, counts } = makeSource(state)
-        let view: any
-        let model = initialModel(state)
-        let subscription: { unsubscribe: () => void } | undefined
-        try {
-          for (const [step, command] of commands.entries()) {
-            const before = { ...counts }
-            switch (command) {
-              case `start`:
-                view = createPooledLiveQuery(pooledQuery(source)(new Query()), {
-                  gcTime: 0,
-                })
-                expect(view, `the query is poolable`).toBeDefined()
-                break
-              case `read`:
-                break
-              case `subscribe`:
-                subscription = view.subscribeChanges(() => {})
-                break
-              case `preload`:
-                await view.preload()
-                break
-              default:
-                throw new Error(`pooled history uses no ${command}`)
-            }
-            await settle()
-            const result = applyModel(state, `all`, 1, model, command)
-            model = result.next
-            const { expected } = result
-            const where = `${command} at step ${step}`
-            expect(
-              counts.starts - before.starts,
-              `${where}: source sync-run starts`,
-            ).toBe(expected.startsAdded)
-            if (expected.ready !== `unchecked`) {
-              expect(
-                view.status === `ready`,
-                `${where}: initial-query readiness (status ${view.status})`,
-              ).toBe(expected.ready)
-            }
-            if (expected.ids !== `unchecked`) {
-              expect(
-                Array.from(view.entries(), ([, row]: [unknown, Row]) => row.id),
-                `${where}: rows`,
-              ).toEqual(expected.ids)
-            }
-          }
-        } finally {
-          subscription?.unsubscribe()
-          await view?.cleanup()
-          await source.cleanup({ dependents: true })
-        }
+        return runPooledHistory(state, commands)
       })
     }
   }
 })
 
 /**
- * ## A preload answered by a DbClient stream
- *
- * During SSR streaming, a DbClient may already hold a pending or settled
- * stream for a query. The observer's preload then returns that stream instead
- * of preloading the live-query Collection. It is still a request for the
- * Collection's data, so it counts as a preload: deferred acquisition resumes
- * and the idle source Collection starts its sync run. This includes a source
- * left deferred by a render: that render does not own the preload's demand.
+ * After cleanup during admission, the replacement run's subscriber count,
+ * readiness, and acquisition follow from how the surviving subscriber read.
+ * Only a handle that returned as acquiring is demand for the next run; a
+ * still-deferred handle contributes none. So a deferred reader leaves the
+ * replacement unready unless the source is eager and idle, and the replacement
+ * acquires only for an on-demand idle source that a non-deferred reader keeps.
  */
-describe(`preload answered by a DbClient stream`, () => {
-  it.each(
-    ([`pending`, `success`] as const).flatMap((stream) =>
-      (
-        [
-          `eager-idle`,
-          `eager-render-deferred`,
-          `on-demand-idle`,
-          `on-demand-render-deferred`,
-        ] as const
-      ).map((state) => ({ stream, state })),
-    ),
-  )(
-    `a $stream stream still resumes $state acquisition`,
-    async ({ stream, state }) => {
-      const { collection: source, counts } = makeSource(state)
-      const { outer } = makeLiveQuery(source, `all`, 1)
-      const client = new DbClient()
-      const queryHash = `deferred-acquisition-stream-${stream}`
-      const registered = client._registerLiveQuery(
-        queryHash,
-        stream === `pending`
-          ? new Promise<never>(() => {})
-          : Promise.resolve(undefined as never),
-      )
-      if (stream === `success`) await registered
-      const observer = createLiveQueryObserver(outer, { client, queryHash })
-      try {
-        outer.startSyncImmediate()
-        await settle()
-        expect(counts.starts, `before the preload`).toBe(0)
-        void observer.preload()
-        await settle()
-        expect(counts.starts, `after the preload`).toBe(1)
-        expect(counts.acquisitions > 0).toBe(state.startsWith(`on-demand`))
-        expect(outer.toArray.map((row) => row.id)).toEqual(EXPECTED_IDS.all)
-      } finally {
-        observer.dispose()
-        await outer.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-})
-
-/**
- * A DbClient preload owns the release of every source it prepared. If the
- * first source's sync run throws, that error belongs to the failed query;
- * the later healthy source still gets its release and can serve a direct
- * reader. The model needs only two independent start counts: zero before
- * preload, one for each after release. The public checkpoint is the failed
- * preload followed by readiness of the second source Collection.
- * The failed call has no result to stream. A dehydration request at the
- * synchronous error cut must not publish its pending query promise, even when
- * the caller opts to stream pending queries.
- * A later same-hash preload over a healthy replacement source must publish
- * that source's row; the failed attempt has no result to reuse.
- * The same options can be retried, but the failed source Collection remains
- * in error until explicitly restarted. That retry must report the source error
- * rather than wait on the failed query's former pending stream. A controlled
- * later `fail` crosses the asynchronous failure cut: the pending preload
- * rejects, its stream disappears, and a healthy replacement of the same
- * query hash can publish its own row while the peer source remains ready. A
- * failed stream has no reusable result, so a replacement observer may attach
- * through the same hash before a new preload. Its public snapshot must show
- * the replacement row as ready, with no stale stream error. The active-stream
- * identity rule also applies before that failure: a different same-hash
- * preload rejects while the original stream is pending. A synchronous source
- * throw crosses the same recovery law at a different cut. After the peer source
- * becomes ready, a replacement observer may attach before a new client preload
- * and must read only the replacement row. These fixed histories do not claim
- * all failure schedules or concurrent replacement observers.
- */
-describe(`DbClient preload releases independent source starts`, () => {
-  it(`retire a pending stream after asynchronous source startup failure`, async () => {
-    const failure = new Error(`late source startup failure`)
-    let failFirst!: () => void
-    let firstStarts = 0
-    let secondStarts = 0
-    const first = collectionOptions(`preload-async-first`, () => ({
-      id: `preload-async-first`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ fail }) => {
-          firstStarts++
-          failFirst = () => fail(failure)
-        },
-      },
-    }))
-    const second = collectionOptions(`preload-async-second`, () => ({
-      id: `preload-async-second`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ markReady }) => {
-          secondStarts++
-          markReady()
-        },
-      },
-    }))
-    const replacement = createCollection({
-      id: `preload-async-first`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: `recovered` } })
-          commit()
-          markReady()
-        },
-      },
-    })
-    const secondBranch = () =>
-      new Query().from({ second }).select(({ second: row }) => ({ id: row.id }))
-    const failedQuery = new Query().unionAll(
-      new Query().from({ first }).select(({ first: row }) => ({ id: row.id })),
-      secondBranch(),
-    )
-    const recoveredQuery = new Query().unionAll(
-      new Query()
-        .from({ first: replacement })
-        .select(({ first: row }) => ({ id: row.id })),
-      secondBranch(),
-    )
-    const client = new DbClient()
-
-    try {
-      const pending = client.preloadLiveQuery({ query: failedQuery })
-      expect([firstStarts, secondStarts]).toEqual([1, 1])
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toHaveLength(1)
-      // Model: the pending result still belongs to the original sources.
-      // The replacement becomes legal only after this stream fails.
-      expect(() => client.preloadLiveQuery({ query: recoveredQuery })).toThrow(
-        /different source Collections/,
-      )
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toHaveLength(1)
-
-      failFirst()
-      // The live query reports its source's own failure.
-      await expect(pending).rejects.toThrow(/late source startup failure/)
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toBeUndefined()
-      expect(client.collection(second).status).toBe(`ready`)
-
-      // Model: failure retired the first result. The observer's subscription
-      // is a new local demand for the healthy replacement, so it may attach
-      // and must show that source's row at the settled-read checkpoint.
-      const queryHash = getLiveQueryHash({ query: failedQuery })
-      expect(getLiveQueryHash({ query: recoveredQuery })).toBe(queryHash)
-      const prepared = prepareLiveQueryValue(recoveredQuery, client)
-      const view = createLiveQueryCollection({
-        query: prepared as typeof recoveredQuery,
-        startSync: false,
-      })
-      const observer = createLiveQueryObserver(view, {
-        client,
-        queryHash,
-        mode: `wholesale`,
-      })
-      try {
-        let unsubscribe!: () => void
-        expect(() => {
-          unsubscribe = observer.subscribe(() => {})
-        }, `replacement observer attaches after the failed stream`).not.toThrow()
-        try {
-          await observer.preload()
-          expect(observer.getSnapshot().data).toEqual([
-            expect.objectContaining({ id: `recovered` }),
-          ])
-          expect(observer.getSnapshot().status).toBe(`ready`)
-          expect(observer.getError()).toBeUndefined()
-        } finally {
-          unsubscribe()
-        }
-      } finally {
-        observer.dispose()
-        await view.cleanup()
-      }
-
-      await client.preloadLiveQuery({ query: recoveredQuery })
-      expect(
-        client
-          .dehydrate()
-          .liveQueries?.[0]?.snapshot?.rows.map(
-            ({ value }) => (value as { id: string }).id,
-          ),
-      ).toEqual([`recovered`])
-    } finally {
-      await client.cleanup()
-      await replacement.cleanup()
-    }
-  })
-
-  it(`reports source error instead of reusing a failed query stream`, async () => {
-    const failure = new Error(`source start failed`)
-    let starts = 0
-    const source = collectionOptions(`preload-transient-start`, () => ({
-      id: `preload-transient-start`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: () => {
-          starts++
-          throw failure
-        },
-      },
-    }))
-    const client = new DbClient()
-    const options = {
-      query: new Query()
-        .from({ item: source })
-        .select(({ item }) => ({ id: item.id })),
-    }
-
-    try {
-      expect(() => client.preloadLiveQuery(options)).toThrow(failure)
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toBeUndefined()
-      await expect(client.preloadLiveQuery(options)).rejects.toThrow(
-        /source start failed/,
-      )
-      expect(starts).toBe(1)
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toBeUndefined()
-    } finally {
-      await client.cleanup()
-    }
-  })
-
-  it(`releases a peer source and permits replacement after a synchronous throw`, async () => {
-    const failure = new Error(`first source failed`)
-    let firstStarts = 0
-    let secondStarts = 0
-    const first = collectionOptions(`preload-release-first`, () => ({
-      id: `preload-release-first`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: () => {
-          firstStarts++
-          throw failure
-        },
-      },
-    }))
-    const second = collectionOptions(`preload-release-second`, () => ({
-      id: `preload-release-second`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ markReady }) => {
-          secondStarts++
-          markReady()
-        },
-      },
-    }))
-    const client = new DbClient()
-    const query = new Query().unionAll(
-      new Query().from({ first }).select(({ first: row }) => ({ id: row.id })),
-      new Query()
-        .from({ second })
-        .select(({ second: row }) => ({ id: row.id })),
-    )
-    const replacement = createCollection({
-      id: `preload-release-first`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: `recovered` } })
-          commit()
-          markReady()
-        },
-      },
-    })
-    const recoveredQuery = new Query().unionAll(
-      new Query()
-        .from({ first: replacement })
-        .select(({ first: row }) => ({ id: row.id })),
-      new Query()
-        .from({ second })
-        .select(({ second: row }) => ({ id: row.id })),
-    )
-
-    try {
-      let thrown: unknown
-      try {
-        client.preloadLiveQuery({ query })
-      } catch (error) {
-        thrown = error
-      }
-      expect(thrown).toBe(failure)
-      expect(firstStarts).toBe(1)
-      expect(secondStarts).toBe(1)
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toBeUndefined()
-      const healthy = client.collection(second)
-      await healthy.preload()
-      expect(healthy.status).toBe(`ready`)
-
-      // The synchronous throw left no reusable result. A replacement observer
-      // may therefore attach under this hash before another client preload.
-      const queryHash = getLiveQueryHash({ query })
-      expect(getLiveQueryHash({ query: recoveredQuery })).toBe(queryHash)
-      const prepared = prepareLiveQueryValue(recoveredQuery, client)
-      const view = createLiveQueryCollection({
-        query: prepared as typeof recoveredQuery,
-        startSync: false,
-      })
-      const observer = createLiveQueryObserver(view, {
-        client,
-        queryHash,
-        mode: `wholesale`,
-      })
-      try {
-        let unsubscribe!: () => void
-        expect(() => {
-          unsubscribe = observer.subscribe(() => {})
-        }, `replacement observer attaches after a synchronous throw`).not.toThrow()
-        try {
-          await observer.preload()
-          expect(observer.getSnapshot().data).toEqual([
-            expect.objectContaining({ id: `recovered` }),
-          ])
-          expect(observer.getSnapshot().status).toBe(`ready`)
-          expect(observer.getError()).toBeUndefined()
-        } finally {
-          unsubscribe()
-        }
-      } finally {
-        observer.dispose()
-        await view.cleanup()
-      }
-
-      await client.preloadLiveQuery({ query: recoveredQuery })
-      expect(
-        client
-          .dehydrate()
-          .liveQueries?.[0]?.snapshot?.rows.map(
-            ({ value }) => (value as { id: string }).id,
-          ),
-      ).toEqual([`recovered`])
-    } finally {
-      await client.cleanup()
-      await replacement.cleanup()
-    }
-  })
-
-  it(`reports a preparation error even if a deferred source also throws`, async () => {
-    const preparationFailure = new Error(`second source factory failed`)
-    const startFailure = new Error(`first source start failed`)
-    let firstStarts = 0
-    const first = collectionOptions(`preload-primary-first`, () => ({
-      id: `preload-primary-first`,
-      getKey: (row: { id: string }) => row.id,
-      startSync: true,
-      sync: {
-        sync: () => {
-          firstStarts++
-          throw startFailure
-        },
-      },
-    }))
-    const second = collectionOptions(
-      `preload-primary-second`,
-      (): {
-        id: string
-        getKey: (row: { id: string }) => string
-        sync: { sync: () => void }
-      } => {
-        throw preparationFailure
-      },
-    )
-    const client = new DbClient()
-    const query = new Query().unionAll(
-      new Query().from({ first }).select(({ first: row }) => ({ id: row.id })),
-      new Query()
-        .from({ second })
-        .select(({ second: row }) => ({ id: row.id })),
-    )
-
-    try {
-      expect(() => client.preloadLiveQuery({ query })).toThrow(
-        preparationFailure,
-      )
-      expect(firstStarts).toBe(1)
-    } finally {
-      await client.cleanup()
-    }
-  })
-})
+function expectedReplacementRun(
+  state: SourceState,
+  reader: `ordinary` | `resumed` | `deferred`,
+) {
+  return {
+    acquiring: reader === `deferred` ? 0 : 1,
+    ready: reader !== `deferred` || state === `eager-idle`,
+    acquires: reader !== `deferred` && state === `on-demand-idle`,
+  }
+}
 
-/**
- * ## A subscriber that outlives cleanup
- *
- * Cleanup ends a live-query Collection's sync run but keeps its subscriptions.
- * A subscriber that survives is still a subscriber in the next sync run, so a
- * restarted live-query Collection acquires for it at once instead of
- * deferring until another subscriber or preload arrives. The finite command
- * histories above unsubscribe before cleanup. This block pins the history: subscribe,
- * clean up while subscribed, restart, then settle.
- */
 describe(`a subscriber that outlives cleanup`, () => {
   // Admission may still be transferring ownership when a source status callback
   // cleans up the live-query Collection. Cleanup retires that start, not the
@@ -1148,11 +571,7 @@ describe(`a subscriber that outlives cleanup`, () => {
       cleanupAt,
       restartFromCleanup,
     }) => {
-      const expected = {
-        acquiring: reader === `deferred` ? 0 : 1,
-        ready: reader !== `deferred` || state === `eager-idle`,
-        acquires: reader !== `deferred` && state === `on-demand-idle`,
-      }
+      const expected = expectedReplacementRun(state, reader)
       const { collection: source, counts } = makeSource(state)
       const { outer, collections } = makeLiveQuery(source, shape, depth)
       if (renderGate) expect(outer._deferSyncStart()).toBe(true)
@@ -1220,295 +639,6 @@ describe(`a subscriber that outlives cleanup`, () => {
       }
     },
   )
-
-  for (const state of [
-    `eager-idle`,
-    `on-demand-idle`,
-    `on-demand-running`,
-  ] as const) {
-    for (const shape of QUERY_SHAPES) {
-      it(`${state}, ${shape}: the restarted live query serves its subscriber`, async () => {
-        const { collection: source, counts } = makeSource(state)
-        const { outer } = makeLiveQuery(source, shape, 1)
-        const subscription = outer.subscribeChanges(() => {}, {
-          includeInitialState: true,
-        })
-        try {
-          await settle()
-          expect(outer.status, `before cleanup`).toBe(`ready`)
-          await outer.cleanup()
-          const before = counts.acquisitions
-          outer.startSyncImmediate()
-          await settle()
-          if (state.startsWith(`on-demand`)) {
-            expect(
-              counts.acquisitions - before,
-              `the restart acquires for the surviving subscriber`,
-            ).toBeGreaterThan(0)
-          }
-          expect(outer.status, `after restart`).toBe(`ready`)
-          expect(outer.toArray.map((row) => row.id)).toEqual(
-            EXPECTED_IDS[shape],
-          )
-        } finally {
-          subscription.unsubscribe()
-          await outer.cleanup()
-          await source.cleanup()
-        }
-      })
-    }
-  }
-
-  // A surviving subscriber that itself defers is not a request for data: an
-  // unsubscribed outer live query keeps its deferring subscription to the
-  // inner one across the inner one's cleanup.
-  it(`on-demand-idle: a surviving deferring subscriber does not resume a restart`, async () => {
-    const { collection: source, counts } = makeSource(`on-demand-idle`)
-    const { outer, collections } = makeLiveQuery(source, `window`, 2)
-    const inner = collections[1]!
-    try {
-      outer.startSyncImmediate()
-      await settle()
-      // Drive internal teardown, which bypasses cleanup admission.
-      await inner._lifecycle.cleanup()
-      inner.startSyncImmediate()
-      await settle()
-      expect(counts.starts, `source sync-run starts`).toBe(0)
-      expect(counts.acquisitions, `acquisition attempts`).toBe(0)
-    } finally {
-      for (const collection of collections) await collection.cleanup()
-      await source.cleanup()
-    }
-  })
-})
-
-/**
- * ## Reads that wait for readiness
- *
- * `toArrayWhenReady()` and `stateWhenReady()` ask for a Collection's data:
- * when it holds no rows they preload it. They are requests for data in either
- * branch, so they count as a preload. A deferring live-query Collection that
- * already shows its source's local rows returns those rows at once and resumes
- * acquisition for the rest.
- */
-describe(`reads that wait for readiness`, () => {
-  for (const read of [`toArrayWhenReady`, `stateWhenReady`] as const) {
-    it(`${read} resumes a deferring live query that already shows local rows`, async () => {
-      const { collection: source, counts } = makeSource(`on-demand-holding`)
-      const { outer } = makeLiveQuery(source, `all`, 1)
-      try {
-        outer.startSyncImmediate()
-        await settle()
-        expect(outer.toArray.length, `local rows before the read`).toBe(3)
-        expect(counts.acquisitions, `no request before the read`).toBe(0)
-        await outer[read]()
-        await settle()
-        expect(counts.acquisitions, `the read requests data`).toBeGreaterThan(0)
-        expect(outer.status).toBe(`ready`)
-      } finally {
-        await outer.cleanup()
-        await source.cleanup()
-      }
-    })
-  }
-})
-
-/**
- * ## A source whose start throws on resumption
- *
- * The first subscriber or preload resumes every deferred source subscription.
- * One source's start can throw synchronously. That failure is reported, as a
- * rejected preload, but it does not keep the other sources deferred: each is
- * resumed before the first error surfaces. `preload()` keeps its promise
- * contract and never throws.
- */
-describe(`a source whose start throws on resumption`, () => {
-  it(`a retried preload resumes a source whose first start failed`, async () => {
-    let attempts = 0
-    let loads = 0
-    const flaky = createCollection<Row>({
-      id: `deferred-acquisition-flaky-${sequence++}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      gcTime: 0,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          if (++attempts === 1) throw new Error(`transient start failure`)
-          markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              begin()
-              for (const row of ROWS) write({ type: `insert`, value: row })
-              commit()
-              return true
-            },
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection({
-      query: (q) => q.from({ row: flaky }).orderBy(({ row }) => row.rank),
-      gcTime: 0,
-    })
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    try {
-      live.startSyncImmediate()
-      await expect(live.preload(), `the first preload fails`).rejects.toThrow(
-        `transient start failure`,
-      )
-      // The failed start puts the source and its live query in error, so the
-      // supported recovery is cleanup and a new sync run, not a retry in place.
-      expect(live.status).toBe(`crashed`)
-      await live.cleanup()
-      await flaky.cleanup()
-      // A new preload after cleanup starts a new sync run and must resume.
-      await live.preload()
-      await settle()
-      expect(attempts, `the source started again`).toBe(2)
-      expect(loads, `the retry loaded the source`).toBeGreaterThan(0)
-      expect(live.status).toBe(`ready`)
-    } finally {
-      consoleError.mockRestore()
-      await live.cleanup()
-      await flaky.cleanup()
-    }
-  })
-
-  it(`rejects the preload and still resumes the other source`, async () => {
-    const failing = createCollection<Row>({
-      id: `deferred-acquisition-throwing-${sequence++}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      gcTime: 0,
-      sync: {
-        sync: () => {
-          throw new Error(`source start failed`)
-        },
-      },
-    })
-    const { collection: healthy, counts } = makeSource(`on-demand-idle`)
-    const live = createLiveQueryCollection({
-      query: (q) =>
-        q
-          .from({ a: failing })
-          .join({ b: healthy }, ({ a, b }) => eq(a.id, b.id)),
-      gcTime: 0,
-    })
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    try {
-      live.startSyncImmediate()
-      let pending: Promise<void> | undefined
-      expect(() => {
-        pending = live.preload()
-      }, `preload returns a promise`).not.toThrow()
-      await expect(pending, `the preload rejects`).rejects.toThrow(
-        `source start failed`,
-      )
-      await settle()
-      expect(counts.starts, `the other source was resumed`).toBe(1)
-    } finally {
-      consoleError.mockRestore()
-      await live.cleanup()
-      await healthy.cleanup()
-      await failing.cleanup()
-    }
-  })
-})
-
-/**
- * ## A deferring live query is not a subscriber of its sources
- *
- * Adapters read a source Collection's `subscriberCount` and
- * `subscribers:change` as a request for live data: Query Collection
- * resubscribes its observers, which can refetch. A live-query Collection that
- * defers asks for no data, so it does not count there. It still keeps its
- * source Collections from garbage collection, because it reads their rows.
- * Its first subscriber or preload makes it count.
- */
-describe(`a deferring live query is not a subscriber of its sources`, () => {
-  for (const state of [`eager-running`, `on-demand-running`] as const) {
-    it(`${state}: counts only once a subscriber asks for data`, async () => {
-      const { collection: source } = makeSource(state)
-      const { outer } = makeLiveQuery(source, `all`, 1)
-      const counts: Array<number> = []
-      const stop = source.on(`subscribers:change`, ({ subscriberCount }) =>
-        counts.push(subscriberCount),
-      )
-      let subscription: { unsubscribe: () => void } | undefined
-      try {
-        outer.startSyncImmediate()
-        await settle()
-        await new Promise((resolve) => setTimeout(resolve, 20))
-        expect(source.subscriberCount, `while deferring`).toBe(0)
-        expect(counts, `no change event while deferring`).toEqual([])
-        expect(source.status, `kept from garbage collection`).not.toBe(
-          `cleaned-up`,
-        )
-        subscription = outer.subscribeChanges(() => {})
-        await settle()
-        expect(source.subscriberCount, `after the first subscriber`).toBe(1)
-        expect(counts).toEqual([1])
-        subscription.unsubscribe()
-        subscription = undefined
-        await settle()
-        expect(
-          counts.at(-1),
-          `the live query keeps its claim until cleanup`,
-        ).toBe(1)
-      } finally {
-        stop()
-        subscription?.unsubscribe()
-        await outer.cleanup()
-        await source.cleanup()
-      }
-    })
-  }
-})
-
-/**
- * ## A request that arrives while a source subscription is created
- *
- * A live-query Collection decides that a source subscription defers when it
- * creates it. Creating it can run user code: subscribing to an inner
- * live-query Collection starts that Collection, whose status handlers run
- * before the outer subscription returns. If such a handler preloads or
- * subscribes to the outer live query, the request arrives after the decision
- * but before the outer one listens for it. It still resumes the source.
- */
-describe(`a request that arrives while a source subscription is created`, () => {
-  for (const request of [`preload`, `subscribe`] as const) {
-    it(`an inner status handler that ${request}s the outer live query resumes it`, async () => {
-      const { collection: source, counts } = makeSource(`on-demand-idle`)
-      const { outer, collections } = makeLiveQuery(source, `window`, 2)
-      const inner = collections[1]!
-      let subscription: { unsubscribe: () => void } | undefined
-      let requested = false
-      const stop = inner.on(`status:change`, () => {
-        if (requested) return
-        requested = true
-        if (request === `preload`) void outer.preload()
-        else subscription = outer.subscribeChanges(() => {})
-      })
-      try {
-        outer.startSyncImmediate()
-        await settle()
-        expect(requested, `the handler ran`).toBe(true)
-        expect(counts.acquisitions, `acquisition attempts`).toBeGreaterThan(0)
-        expect(outer.status).toBe(`ready`)
-        expect(outer.toArray.map((row) => row.id)).toEqual(EXPECTED_IDS.window)
-      } finally {
-        stop()
-        subscription?.unsubscribe()
-        for (const collection of collections) await collection.cleanup()
-        await source.cleanup()
-      }
-    })
-  }
 })
 
 /**
diff --git a/packages/db/tests/live-query-deferred-acquisition-support.ts b/packages/db/tests/live-query-deferred-acquisition-support.ts
new file mode 100644
index 0000000000..d0d46c81cb
--- /dev/null
+++ b/packages/db/tests/live-query-deferred-acquisition-support.ts
@@ -0,0 +1,142 @@
+// Shared helpers for the oracle file and the ordinary tests moved from it.
+import {
+  BTreeIndex,
+  createCollection,
+  createLiveQueryCollection,
+  eq,
+} from '../src'
+import type { Collection } from '../src'
+
+export type Row = { id: string; rank: number; group: string }
+export const ROWS: Array<Row> = [
+  { id: `a`, rank: 1, group: `g` },
+  { id: `b`, rank: 2, group: `g` },
+  { id: `c`, rank: 3, group: `g` },
+]
+/**
+ * ## Source states
+ *
+ * `-running` and `-holding` source Collections already started their sync
+ * run, by `startSync: true`, before any live-query Collection exists. An eager
+ * source Collection writes every row when its sync run starts. An on-demand
+ * source Collection writes rows only for an acquisition attempt, except that
+ * `on-demand-holding` already holds every row, as it would after another
+ * consumer's acquisition. Each fixture counts sync-run starts and acquisition
+ * attempts: those are its provider work.
+ * `-render-deferred` sources are idle behind an abandoned render's start gate.
+ * They expose the same demand law through a different production start path.
+ */
+export type SourceState =
+  | `eager-idle`
+  | `eager-running`
+  | `on-demand-idle`
+  | `on-demand-running`
+  | `on-demand-holding`
+  | `eager-render-deferred`
+  | `on-demand-render-deferred`
+/**
+ * ## Query shapes
+ *
+ * `all` reads every row. `window` orders by rank and keeps a limit of two,
+ * which uses the ordered loading path.
+ */
+export type QueryShape = `all` | `window`
+export const QUERY_SHAPES: Array<QueryShape> = [`all`, `window`]
+export const EXPECTED_IDS: Record<QueryShape, Array<string>> = {
+  all: [`a`, `b`, `c`],
+  window: [`a`, `b`],
+}
+/**
+ * ## Production driver
+ *
+ * Real Collections only. The source Collection counts its own provider work.
+ * The driver reads the outer live-query Collection's status right after each
+ * command returns, for the synchronous observation cut, and its status and
+ * rows again after the history settles.
+ */
+let sequence = 0
+export function makeSource(state: SourceState) {
+  const counts = { starts: 0, acquisitions: 0 }
+  const onDemand = state.startsWith(`on-demand`)
+  const written = new Set<string>()
+  // Set while a sync run is active: replaces the source's rows, as a
+  // must-refetch does. An eager source writes every row again.
+  let truncateRows: (() => void) | undefined
+  const collection = createCollection<Row>({
+    id: `deferred-acquisition-${sequence++}`,
+    getKey: (row) => row.id,
+    syncMode: onDemand ? `on-demand` : `eager`,
+    startSync: state.endsWith(`running`) || state.endsWith(`holding`),
+    autoIndex: `eager`,
+    defaultIndexType: BTreeIndex,
+    gcTime: 0,
+    sync: {
+      sync: ({ begin, write, commit, markReady, truncate }) => {
+        counts.starts++
+        const writeAll = () => {
+          begin()
+          for (const row of ROWS) {
+            if (written.has(row.id)) continue
+            written.add(row.id)
+            write({ type: `insert`, value: row })
+          }
+          commit()
+        }
+        if (!onDemand || state === `on-demand-holding`) writeAll()
+        truncateRows = () => {
+          begin()
+          truncate()
+          commit()
+          written.clear()
+          if (!onDemand) writeAll()
+        }
+        markReady()
+        if (!onDemand) return
+        return {
+          loadSubset: () => {
+            counts.acquisitions++
+            writeAll()
+            return true
+          },
+        }
+      },
+    },
+  })
+  if (state.endsWith(`render-deferred`)) collection._deferSyncStart()
+  return { collection, counts, truncate: () => truncateRows?.() }
+}
+export function makeLiveQuery(
+  source: Collection<Row, string | number, any>,
+  shape: QueryShape,
+  depth: 1 | 2,
+): {
+  outer: Collection<Row, string | number, any>
+  collections: Array<Collection<Row, string | number, any>>
+} {
+  const read = (q: any, from: unknown) => {
+    const base = q
+      .from({ row: from })
+      .orderBy(({ row }: any) => row.rank, `asc`)
+    return shape === `window` ? base.limit(2) : base
+  }
+  const inner = createLiveQueryCollection({
+    query: (q) => read(q, source),
+    gcTime: 0,
+  })
+  if (depth === 1) return { outer: inner, collections: [inner] }
+  const outer = createLiveQueryCollection({
+    query: (q) => read(q, inner),
+    gcTime: 0,
+  })
+  return { outer, collections: [outer, inner] }
+}
+export async function settle(): Promise<void> {
+  for (let turn = 0; turn < 4; turn++) await Promise.resolve()
+  await new Promise((resolve) => setTimeout(resolve, 0))
+}
+export const pooledQuery =
+  (source: Collection<Row, string | number, any>) => (q: any) =>
+    q
+      .from({ row: source })
+      .where(({ row }: any) => eq(row.group, `g`))
+      .orderBy(({ row }: any) => row.rank, `asc`)
diff --git a/packages/db/tests/live-query-deferred-acquisition.test.ts b/packages/db/tests/live-query-deferred-acquisition.test.ts
new file mode 100644
index 0000000000..41207ec428
--- /dev/null
+++ b/packages/db/tests/live-query-deferred-acquisition.test.ts
@@ -0,0 +1,801 @@
+// Ordinary tests moved out of live-query-deferred-acquisition-oracle.test.ts. They keep
+// literal expectations for pooled views, DbClient streams, and restarts; the deferred
+// acquisition law and its history grammar stay in the oracle file.
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BTreeIndex,
+  DbClient,
+  collectionOptions,
+  createCollection,
+  createLiveQueryCollection,
+  createLiveQueryObserver,
+  eq,
+  getLiveQueryHash,
+  prepareLiveQueryValue,
+} from '../src'
+import { Query } from '../src/query/builder/index.js'
+import { createPooledLiveQuery } from '../src/query/pooled-live-query.js'
+import {
+  EXPECTED_IDS,
+  QUERY_SHAPES,
+  ROWS,
+  makeLiveQuery,
+  makeSource,
+  pooledQuery,
+  settle,
+} from './live-query-deferred-acquisition-support.js'
+import type { Row } from './live-query-deferred-acquisition-support.js'
+import type { Collection, LiveQueryObserver } from '../src'
+
+let sequence = 0
+
+describe(`pooled live-query deferred acquisition`, () => {
+  it.each([
+    [`eager-idle`, `no SSR cleanup client`],
+    [`eager-running`, `no SSR cleanup client`],
+    [`eager-idle`, `an SSR cleanup client`],
+    [`eager-running`, `an SSR cleanup client`],
+  ] as const)(
+    `an observer preload reaches a config-free pooled view from %s with %s`,
+    async (state, clientMode) => {
+      const { collection: source, counts } = makeSource(state)
+      const view = createPooledLiveQuery(pooledQuery(source)(new Query()), {
+        gcTime: 0,
+      })
+      expect(view, `the query is poolable`).toBeDefined()
+      const client =
+        clientMode === `an SSR cleanup client` ? new DbClient() : undefined
+      client?._setSsrServerCleanupEnabled(true)
+      let observer: LiveQueryObserver<Row, string | number> | undefined
+      let constructionError: unknown
+      try {
+        observer = createLiveQueryObserver(view as Collection<Row>, {
+          client,
+          queryHash: `config-free-pooled-view`,
+        })
+      } catch (error) {
+        constructionError = error
+      }
+      try {
+        expect(
+          constructionError,
+          `observer construction succeeds`,
+        ).toBeUndefined()
+        if (!observer) throw new Error(`missing observer after construction`)
+        // Model: explicit demand starts an idle source once. An already
+        // running source needs no second start for the same public rows.
+        const startsBefore = counts.starts
+        await expect(
+          Promise.resolve().then(() => observer.preload()),
+          `observer preload succeeds`,
+        ).resolves.toBeUndefined()
+        await settle()
+        expect(counts.starts - startsBefore, `new source starts`).toBe(
+          state === `eager-idle` ? 1 : 0,
+        )
+        expect(observer.getSnapshot().status).toBe(`ready`)
+        const rows = observer.getSnapshot().data as ReadonlyArray<Row>
+        expect(rows.map((row) => row.id)).toEqual(EXPECTED_IDS.all)
+      } finally {
+        observer?.dispose()
+        await view?.cleanup()
+        await source.cleanup({ dependents: true })
+        await client?.cleanup()
+      }
+    },
+  )
+})
+
+/**
+ * A DbClient preload owns the release of every source it prepared. If the
+ * first source's sync run throws, that error belongs to the failed query;
+ * the later healthy source still gets its release and can serve a direct
+ * reader. The model needs only two independent start counts: zero before
+ * preload, one for each after release. The public checkpoint is the failed
+ * preload followed by readiness of the second source Collection.
+ * The failed call has no result to stream. A dehydration request at the
+ * synchronous error cut must not publish its pending query promise, even when
+ * the caller opts to stream pending queries.
+ * A later same-hash preload over a healthy replacement source must publish
+ * that source's row; the failed attempt has no result to reuse.
+ * The same options can be retried, but the failed source Collection remains
+ * in error until explicitly restarted. That retry must report the source error
+ * rather than wait on the failed query's former pending stream. A controlled
+ * later `fail` crosses the asynchronous failure cut: the pending preload
+ * rejects, its stream disappears, and a healthy replacement of the same
+ * query hash can publish its own row while the peer source remains ready. A
+ * failed stream has no reusable result, so a replacement observer may attach
+ * through the same hash before a new preload. Its public snapshot must show
+ * the replacement row as ready, with no stale stream error. The active-stream
+ * identity rule also applies before that failure: a different same-hash
+ * preload rejects while the original stream is pending. A synchronous source
+ * throw crosses the same recovery law at a different cut. After the peer source
+ * becomes ready, a replacement observer may attach before a new client preload
+ * and must read only the replacement row. These fixed histories do not claim
+ * all failure schedules or concurrent replacement observers.
+ */
+describe(`DbClient preload releases independent source starts`, () => {
+  it(`retire a pending stream after asynchronous source startup failure`, async () => {
+    const failure = new Error(`late source startup failure`)
+    let failFirst!: () => void
+    let firstStarts = 0
+    let secondStarts = 0
+    const first = collectionOptions(`preload-async-first`, () => ({
+      id: `preload-async-first`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ fail }) => {
+          firstStarts++
+          failFirst = () => fail(failure)
+        },
+      },
+    }))
+    const second = collectionOptions(`preload-async-second`, () => ({
+      id: `preload-async-second`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ markReady }) => {
+          secondStarts++
+          markReady()
+        },
+      },
+    }))
+    const replacement = createCollection({
+      id: `preload-async-first`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: `recovered` } })
+          commit()
+          markReady()
+        },
+      },
+    })
+    const secondBranch = () =>
+      new Query().from({ second }).select(({ second: row }) => ({ id: row.id }))
+    const failedQuery = new Query().unionAll(
+      new Query().from({ first }).select(({ first: row }) => ({ id: row.id })),
+      secondBranch(),
+    )
+    const recoveredQuery = new Query().unionAll(
+      new Query()
+        .from({ first: replacement })
+        .select(({ first: row }) => ({ id: row.id })),
+      secondBranch(),
+    )
+    const client = new DbClient()
+
+    try {
+      const pending = client.preloadLiveQuery({ query: failedQuery })
+      expect([firstStarts, secondStarts]).toEqual([1, 1])
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toHaveLength(1)
+      // Model: the pending result still belongs to the original sources.
+      // The replacement becomes legal only after this stream fails.
+      expect(() => client.preloadLiveQuery({ query: recoveredQuery })).toThrow(
+        /different source Collections/,
+      )
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toHaveLength(1)
+
+      failFirst()
+      // The live query reports its source's own failure.
+      await expect(pending).rejects.toThrow(/late source startup failure/)
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toBeUndefined()
+      expect(client.collection(second).status).toBe(`ready`)
+
+      // Model: failure retired the first result. The observer's subscription
+      // is a new local demand for the healthy replacement, so it may attach
+      // and must show that source's row at the settled-read checkpoint.
+      const queryHash = getLiveQueryHash({ query: failedQuery })
+      expect(getLiveQueryHash({ query: recoveredQuery })).toBe(queryHash)
+      const prepared = prepareLiveQueryValue(recoveredQuery, client)
+      const view = createLiveQueryCollection({
+        query: prepared as typeof recoveredQuery,
+        startSync: false,
+      })
+      const observer = createLiveQueryObserver(view, {
+        client,
+        queryHash,
+        mode: `wholesale`,
+      })
+      try {
+        let unsubscribe!: () => void
+        expect(() => {
+          unsubscribe = observer.subscribe(() => {})
+        }, `replacement observer attaches after the failed stream`).not.toThrow()
+        try {
+          await observer.preload()
+          expect(observer.getSnapshot().data).toEqual([
+            expect.objectContaining({ id: `recovered` }),
+          ])
+          expect(observer.getSnapshot().status).toBe(`ready`)
+          expect(observer.getError()).toBeUndefined()
+        } finally {
+          unsubscribe()
+        }
+      } finally {
+        observer.dispose()
+        await view.cleanup()
+      }
+
+      await client.preloadLiveQuery({ query: recoveredQuery })
+      expect(
+        client
+          .dehydrate()
+          .liveQueries?.[0]?.snapshot?.rows.map(
+            ({ value }) => (value as { id: string }).id,
+          ),
+      ).toEqual([`recovered`])
+    } finally {
+      await client.cleanup()
+      await replacement.cleanup()
+    }
+  })
+
+  it(`reports source error instead of reusing a failed query stream`, async () => {
+    const failure = new Error(`source start failed`)
+    let starts = 0
+    const source = collectionOptions(`preload-transient-start`, () => ({
+      id: `preload-transient-start`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: () => {
+          starts++
+          throw failure
+        },
+      },
+    }))
+    const client = new DbClient()
+    const options = {
+      query: new Query()
+        .from({ item: source })
+        .select(({ item }) => ({ id: item.id })),
+    }
+
+    try {
+      expect(() => client.preloadLiveQuery(options)).toThrow(failure)
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toBeUndefined()
+      await expect(client.preloadLiveQuery(options)).rejects.toThrow(
+        /source start failed/,
+      )
+      expect(starts).toBe(1)
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toBeUndefined()
+    } finally {
+      await client.cleanup()
+    }
+  })
+
+  it(`releases a peer source and permits replacement after a synchronous throw`, async () => {
+    const failure = new Error(`first source failed`)
+    let firstStarts = 0
+    let secondStarts = 0
+    const first = collectionOptions(`preload-release-first`, () => ({
+      id: `preload-release-first`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: () => {
+          firstStarts++
+          throw failure
+        },
+      },
+    }))
+    const second = collectionOptions(`preload-release-second`, () => ({
+      id: `preload-release-second`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ markReady }) => {
+          secondStarts++
+          markReady()
+        },
+      },
+    }))
+    const client = new DbClient()
+    const query = new Query().unionAll(
+      new Query().from({ first }).select(({ first: row }) => ({ id: row.id })),
+      new Query()
+        .from({ second })
+        .select(({ second: row }) => ({ id: row.id })),
+    )
+    const replacement = createCollection({
+      id: `preload-release-first`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: `recovered` } })
+          commit()
+          markReady()
+        },
+      },
+    })
+    const recoveredQuery = new Query().unionAll(
+      new Query()
+        .from({ first: replacement })
+        .select(({ first: row }) => ({ id: row.id })),
+      new Query()
+        .from({ second })
+        .select(({ second: row }) => ({ id: row.id })),
+    )
+
+    try {
+      let thrown: unknown
+      try {
+        client.preloadLiveQuery({ query })
+      } catch (error) {
+        thrown = error
+      }
+      expect(thrown).toBe(failure)
+      expect(firstStarts).toBe(1)
+      expect(secondStarts).toBe(1)
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toBeUndefined()
+      const healthy = client.collection(second)
+      await healthy.preload()
+      expect(healthy.status).toBe(`ready`)
+
+      // The synchronous throw left no reusable result. A replacement observer
+      // may therefore attach under this hash before another client preload.
+      const queryHash = getLiveQueryHash({ query })
+      expect(getLiveQueryHash({ query: recoveredQuery })).toBe(queryHash)
+      const prepared = prepareLiveQueryValue(recoveredQuery, client)
+      const view = createLiveQueryCollection({
+        query: prepared as typeof recoveredQuery,
+        startSync: false,
+      })
+      const observer = createLiveQueryObserver(view, {
+        client,
+        queryHash,
+        mode: `wholesale`,
+      })
+      try {
+        let unsubscribe!: () => void
+        expect(() => {
+          unsubscribe = observer.subscribe(() => {})
+        }, `replacement observer attaches after a synchronous throw`).not.toThrow()
+        try {
+          await observer.preload()
+          expect(observer.getSnapshot().data).toEqual([
+            expect.objectContaining({ id: `recovered` }),
+          ])
+          expect(observer.getSnapshot().status).toBe(`ready`)
+          expect(observer.getError()).toBeUndefined()
+        } finally {
+          unsubscribe()
+        }
+      } finally {
+        observer.dispose()
+        await view.cleanup()
+      }
+
+      await client.preloadLiveQuery({ query: recoveredQuery })
+      expect(
+        client
+          .dehydrate()
+          .liveQueries?.[0]?.snapshot?.rows.map(
+            ({ value }) => (value as { id: string }).id,
+          ),
+      ).toEqual([`recovered`])
+    } finally {
+      await client.cleanup()
+      await replacement.cleanup()
+    }
+  })
+
+  it(`reports a preparation error even if a deferred source also throws`, async () => {
+    const preparationFailure = new Error(`second source factory failed`)
+    const startFailure = new Error(`first source start failed`)
+    let firstStarts = 0
+    const first = collectionOptions(`preload-primary-first`, () => ({
+      id: `preload-primary-first`,
+      getKey: (row: { id: string }) => row.id,
+      startSync: true,
+      sync: {
+        sync: () => {
+          firstStarts++
+          throw startFailure
+        },
+      },
+    }))
+    const second = collectionOptions(
+      `preload-primary-second`,
+      (): {
+        id: string
+        getKey: (row: { id: string }) => string
+        sync: { sync: () => void }
+      } => {
+        throw preparationFailure
+      },
+    )
+    const client = new DbClient()
+    const query = new Query().unionAll(
+      new Query().from({ first }).select(({ first: row }) => ({ id: row.id })),
+      new Query()
+        .from({ second })
+        .select(({ second: row }) => ({ id: row.id })),
+    )
+
+    try {
+      expect(() => client.preloadLiveQuery({ query })).toThrow(
+        preparationFailure,
+      )
+      expect(firstStarts).toBe(1)
+    } finally {
+      await client.cleanup()
+    }
+  })
+})
+
+describe(`a subscriber that outlives cleanup`, () => {
+  // A surviving subscriber that itself defers is not a request for data: an
+  // unsubscribed outer live query keeps its deferring subscription to the
+  // inner one across the inner one's cleanup.
+  it(`on-demand-idle: a surviving deferring subscriber does not resume a restart`, async () => {
+    const { collection: source, counts } = makeSource(`on-demand-idle`)
+    const { outer, collections } = makeLiveQuery(source, `window`, 2)
+    const inner = collections[1]!
+    try {
+      outer.startSyncImmediate()
+      await settle()
+      // Drive internal teardown, which bypasses cleanup admission.
+      await inner._lifecycle.cleanup()
+      inner.startSyncImmediate()
+      await settle()
+      expect(counts.starts, `source sync-run starts`).toBe(0)
+      expect(counts.acquisitions, `acquisition attempts`).toBe(0)
+    } finally {
+      for (const collection of collections) await collection.cleanup()
+      await source.cleanup()
+    }
+  })
+})
+
+/**
+ * ## A source whose start throws on resumption
+ *
+ * The first subscriber or preload resumes every deferred source subscription.
+ * One source's start can throw synchronously. That failure is reported, as a
+ * rejected preload, but it does not keep the other sources deferred: each is
+ * resumed before the first error surfaces. `preload()` keeps its promise
+ * contract and never throws.
+ */
+describe(`a source whose start throws on resumption`, () => {
+  it(`a retried preload resumes a source whose first start failed`, async () => {
+    let attempts = 0
+    let loads = 0
+    const flaky = createCollection<Row>({
+      id: `deferred-acquisition-flaky-${sequence++}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      gcTime: 0,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          if (++attempts === 1) throw new Error(`transient start failure`)
+          markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              begin()
+              for (const row of ROWS) write({ type: `insert`, value: row })
+              commit()
+              return true
+            },
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection({
+      query: (q) => q.from({ row: flaky }).orderBy(({ row }) => row.rank),
+      gcTime: 0,
+    })
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    try {
+      live.startSyncImmediate()
+      await expect(live.preload(), `the first preload fails`).rejects.toThrow(
+        `transient start failure`,
+      )
+      // The failed start puts the source and its live query in error, so the
+      // supported recovery is cleanup and a new sync run, not a retry in place.
+      expect(live.status).toBe(`crashed`)
+      await live.cleanup()
+      await flaky.cleanup()
+      // A new preload after cleanup starts a new sync run and must resume.
+      await live.preload()
+      await settle()
+      expect(attempts, `the source started again`).toBe(2)
+      expect(loads, `the retry loaded the source`).toBeGreaterThan(0)
+      expect(live.status).toBe(`ready`)
+    } finally {
+      consoleError.mockRestore()
+      await live.cleanup()
+      await flaky.cleanup()
+    }
+  })
+
+  it(`rejects the preload and still resumes the other source`, async () => {
+    const failing = createCollection<Row>({
+      id: `deferred-acquisition-throwing-${sequence++}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      gcTime: 0,
+      sync: {
+        sync: () => {
+          throw new Error(`source start failed`)
+        },
+      },
+    })
+    const { collection: healthy, counts } = makeSource(`on-demand-idle`)
+    const live = createLiveQueryCollection({
+      query: (q) =>
+        q
+          .from({ a: failing })
+          .join({ b: healthy }, ({ a, b }) => eq(a.id, b.id)),
+      gcTime: 0,
+    })
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    try {
+      live.startSyncImmediate()
+      let pending: Promise<void> | undefined
+      expect(() => {
+        pending = live.preload()
+      }, `preload returns a promise`).not.toThrow()
+      await expect(pending, `the preload rejects`).rejects.toThrow(
+        `source start failed`,
+      )
+      await settle()
+      expect(counts.starts, `the other source was resumed`).toBe(1)
+    } finally {
+      consoleError.mockRestore()
+      await live.cleanup()
+      await healthy.cleanup()
+      await failing.cleanup()
+    }
+  })
+})
+/**
+ * ## A preload answered by a DbClient stream
+ *
+ * During SSR streaming, a DbClient may already hold a pending or settled
+ * stream for a query. The observer's preload then returns that stream instead
+ * of preloading the live-query Collection. It is still a request for the
+ * Collection's data, so it counts as a preload: deferred acquisition resumes
+ * and the idle source Collection starts its sync run. This includes a source
+ * left deferred by a render: that render does not own the preload's demand.
+ */
+describe(`preload answered by a DbClient stream`, () => {
+  it.each(
+    ([`pending`, `success`] as const).flatMap((stream) =>
+      (
+        [
+          `eager-idle`,
+          `eager-render-deferred`,
+          `on-demand-idle`,
+          `on-demand-render-deferred`,
+        ] as const
+      ).map((state) => ({ stream, state })),
+    ),
+  )(
+    `a $stream stream still resumes $state acquisition`,
+    async ({ stream, state }) => {
+      const { collection: source, counts } = makeSource(state)
+      const { outer } = makeLiveQuery(source, `all`, 1)
+      const client = new DbClient()
+      const queryHash = `deferred-acquisition-stream-${stream}`
+      const registered = client._registerLiveQuery(
+        queryHash,
+        stream === `pending`
+          ? new Promise<never>(() => {})
+          : Promise.resolve(undefined as never),
+      )
+      if (stream === `success`) await registered
+      const observer = createLiveQueryObserver(outer, { client, queryHash })
+      try {
+        outer.startSyncImmediate()
+        await settle()
+        expect(counts.starts, `before the preload`).toBe(0)
+        void observer.preload()
+        await settle()
+        expect(counts.starts, `after the preload`).toBe(1)
+        expect(counts.acquisitions > 0).toBe(state.startsWith(`on-demand`))
+        expect(outer.toArray.map((row) => row.id)).toEqual(EXPECTED_IDS.all)
+      } finally {
+        observer.dispose()
+        await outer.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+})
+
+/**
+ * ## A subscriber that outlives cleanup
+ *
+ * Cleanup ends a live-query Collection's sync run but keeps its subscriptions.
+ * A subscriber that survives is still a subscriber in the next sync run, so a
+ * restarted live-query Collection acquires for it at once instead of
+ * deferring until another subscriber or preload arrives. The finite command
+ * histories above unsubscribe before cleanup. This block pins the history: subscribe,
+ * clean up while subscribed, restart, then settle.
+ */
+describe(`a subscriber that outlives cleanup`, () => {
+  for (const state of [
+    `eager-idle`,
+    `on-demand-idle`,
+    `on-demand-running`,
+  ] as const) {
+    for (const shape of QUERY_SHAPES) {
+      it(`${state}, ${shape}: the restarted live query serves its subscriber`, async () => {
+        const { collection: source, counts } = makeSource(state)
+        const { outer } = makeLiveQuery(source, shape, 1)
+        const subscription = outer.subscribeChanges(() => {}, {
+          includeInitialState: true,
+        })
+        try {
+          await settle()
+          expect(outer.status, `before cleanup`).toBe(`ready`)
+          await outer.cleanup()
+          const before = counts.acquisitions
+          outer.startSyncImmediate()
+          await settle()
+          if (state.startsWith(`on-demand`)) {
+            expect(
+              counts.acquisitions - before,
+              `the restart acquires for the surviving subscriber`,
+            ).toBeGreaterThan(0)
+          }
+          expect(outer.status, `after restart`).toBe(`ready`)
+          expect(outer.toArray.map((row) => row.id)).toEqual(
+            EXPECTED_IDS[shape],
+          )
+        } finally {
+          subscription.unsubscribe()
+          await outer.cleanup()
+          await source.cleanup()
+        }
+      })
+    }
+  }
+})
+
+/**
+ * ## Reads that wait for readiness
+ *
+ * `toArrayWhenReady()` and `stateWhenReady()` ask for a Collection's data:
+ * when it holds no rows they preload it. They are requests for data in either
+ * branch, so they count as a preload. A deferring live-query Collection that
+ * already shows its source's local rows returns those rows at once and resumes
+ * acquisition for the rest.
+ */
+describe(`reads that wait for readiness`, () => {
+  for (const read of [`toArrayWhenReady`, `stateWhenReady`] as const) {
+    it(`${read} resumes a deferring live query that already shows local rows`, async () => {
+      const { collection: source, counts } = makeSource(`on-demand-holding`)
+      const { outer } = makeLiveQuery(source, `all`, 1)
+      try {
+        outer.startSyncImmediate()
+        await settle()
+        expect(outer.toArray.length, `local rows before the read`).toBe(3)
+        expect(counts.acquisitions, `no request before the read`).toBe(0)
+        await outer[read]()
+        await settle()
+        expect(counts.acquisitions, `the read requests data`).toBeGreaterThan(0)
+        expect(outer.status).toBe(`ready`)
+      } finally {
+        await outer.cleanup()
+        await source.cleanup()
+      }
+    })
+  }
+})
+
+/**
+ * ## A deferring live query is not a subscriber of its sources
+ *
+ * Adapters read a source Collection's `subscriberCount` and
+ * `subscribers:change` as a request for live data: Query Collection
+ * resubscribes its observers, which can refetch. A live-query Collection that
+ * defers asks for no data, so it does not count there. It still keeps its
+ * source Collections from garbage collection, because it reads their rows.
+ * Its first subscriber or preload makes it count.
+ */
+describe(`a deferring live query is not a subscriber of its sources`, () => {
+  for (const state of [`eager-running`, `on-demand-running`] as const) {
+    it(`${state}: counts only once a subscriber asks for data`, async () => {
+      const { collection: source } = makeSource(state)
+      const { outer } = makeLiveQuery(source, `all`, 1)
+      const counts: Array<number> = []
+      const stop = source.on(`subscribers:change`, ({ subscriberCount }) =>
+        counts.push(subscriberCount),
+      )
+      let subscription: { unsubscribe: () => void } | undefined
+      try {
+        outer.startSyncImmediate()
+        await settle()
+        await new Promise((resolve) => setTimeout(resolve, 20))
+        expect(source.subscriberCount, `while deferring`).toBe(0)
+        expect(counts, `no change event while deferring`).toEqual([])
+        expect(source.status, `kept from garbage collection`).not.toBe(
+          `cleaned-up`,
+        )
+        subscription = outer.subscribeChanges(() => {})
+        await settle()
+        expect(source.subscriberCount, `after the first subscriber`).toBe(1)
+        expect(counts).toEqual([1])
+        subscription.unsubscribe()
+        subscription = undefined
+        await settle()
+        expect(
+          counts.at(-1),
+          `the live query keeps its claim until cleanup`,
+        ).toBe(1)
+      } finally {
+        stop()
+        subscription?.unsubscribe()
+        await outer.cleanup()
+        await source.cleanup()
+      }
+    })
+  }
+})
+
+/**
+ * ## A request that arrives while a source subscription is created
+ *
+ * A live-query Collection decides that a source subscription defers when it
+ * creates it. Creating it can run user code: subscribing to an inner
+ * live-query Collection starts that Collection, whose status handlers run
+ * before the outer subscription returns. If such a handler preloads or
+ * subscribes to the outer live query, the request arrives after the decision
+ * but before the outer one listens for it. It still resumes the source.
+ */
+describe(`a request that arrives while a source subscription is created`, () => {
+  for (const request of [`preload`, `subscribe`] as const) {
+    it(`an inner status handler that ${request}s the outer live query resumes it`, async () => {
+      const { collection: source, counts } = makeSource(`on-demand-idle`)
+      const { outer, collections } = makeLiveQuery(source, `window`, 2)
+      const inner = collections[1]!
+      let subscription: { unsubscribe: () => void } | undefined
+      let requested = false
+      const stop = inner.on(`status:change`, () => {
+        if (requested) return
+        requested = true
+        if (request === `preload`) void outer.preload()
+        else subscription = outer.subscribeChanges(() => {})
+      })
+      try {
+        outer.startSyncImmediate()
+        await settle()
+        expect(requested, `the handler ran`).toBe(true)
+        expect(counts.acquisitions, `acquisition attempts`).toBeGreaterThan(0)
+        expect(outer.status).toBe(`ready`)
+        expect(outer.toArray.map((row) => row.id)).toEqual(EXPECTED_IDS.window)
+      } finally {
+        stop()
+        subscription?.unsubscribe()
+        for (const collection of collections) await collection.cleanup()
+        await source.cleanup()
+      }
+    })
+  }
+})
diff --git a/packages/db/tests/live-query-observer-history-oracle.property.test.ts b/packages/db/tests/live-query-observer-history-oracle.property.test.ts
index 4a704560cf..2e664fee4d 100644
--- a/packages/db/tests/live-query-observer-history-oracle.property.test.ts
+++ b/packages/db/tests/live-query-observer-history-oracle.property.test.ts
@@ -1,10 +1,11 @@
 import { fc } from '@fast-check/vitest'
 import { describe, expect, it, vi } from 'vitest'
 import { DbClient } from '../src/client.js'
-import { createDeferred } from '../src/deferred.js'
 import { createCollection } from '../src/collection/index.js'
 import { createLiveQueryObserver } from '../src/live-query-observer.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
+import { finishHistory } from './observer-history-cleanup.js'
 import { withOracleCleanup } from './utils.js'
 import { createOracleReach } from './oracle-reach.js'
 import type { ChangeMessage } from '../src/types.js'
@@ -148,218 +149,6 @@ describe(`observer hydration error timing`, () => {
   }
 })
 
-/**
- * Failed subscription setup transfers no listener ownership to the observer:
- * the caller received no release handle. This is the resource counterpart of
- * the eligibility ledger below, and follows the observer's subscribe/dispose
- * contract. A later explicit subscription must work on the same observer.
- *
- * The bounded grammar crosses both modes, cleanup rejection and a real sync
- * startup throw, and one or two failed attempts before an explicit retry.
- * The independent ownership judgment counts only calls that returned handles.
- * We observe client/status/layout leases immediately after each failure, then source
- * ownership and listener delivery after retry, publication and final release.
- * A neighboring granular history rejects one or two late listener seeds while
- * a healthy peer remains subscribed. Only the peer owns later publications.
- * These are controlled core boundaries; framework commit errors are not modeled.
- */
-describe(`observer subscription setup ownership`, () => {
-  it.each([1, 2])(
-    `preserves a healthy peer across %s failed late listener seeds`,
-    async (failures) => {
-      let publish = () => {}
-      const source = createCollection<Row>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            let version = 0
-            publish = () => {
-              begin()
-              write({
-                type: version === 0 ? `insert` : `update`,
-                value: { id: `a`, version: ++version },
-              })
-              commit()
-            }
-            publish()
-            markReady()
-          },
-        },
-      })
-      const observer = createLiveQueryObserver(source, { mode: `granular` })
-      const healthy = vi.fn()
-      const failure = new Error(`late listener seed failed`)
-      const failed = vi.fn(() => {
-        throw failure
-      })
-      let stop: (() => void) | undefined
-      await withOracleCleanup(() => {
-        stop = observer.subscribe(healthy)
-        for (let attempt = 1; attempt <= failures; attempt++) {
-          expect(() => observer.subscribe(failed)).toThrow(failure)
-          expect(failed).toHaveBeenCalledTimes(attempt)
-          expect(source.subscriberCount).toBe(1)
-        }
-        const prefix = healthy.mock.calls.length
-        expect(publish).not.toThrow()
-        expect(healthy).toHaveBeenCalledTimes(prefix + 1)
-        expect(failed).toHaveBeenCalledTimes(failures)
-        expect(observer.getSnapshot().state?.get(`a`)?.version).toBe(2)
-        stop()
-        expect(source.subscriberCount).toBe(0)
-      }, [() => stop?.(), () => observer.dispose(), () => source.cleanup()])
-    },
-  )
-
-  it.each(
-    ([`granular`, `wholesale`] as const).flatMap((mode) =>
-      ([`cleanup`, `sync-throw`] as const).flatMap((failureAt) =>
-        ([1, 2] as const).map((failures) => ({ mode, failureAt, failures })),
-      ),
-    ),
-  )(
-    `releases failed $mode setup at $failureAt before $failures-attempt retry`,
-    async ({ mode, failureAt, failures }) => {
-      const gate = createDeferred<void>()
-      const failure = new Error(`source startup failed`)
-      let failStart = failureAt === `sync-throw`
-      let publish = () => {}
-      const source = createCollection<Row>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            if (failStart) throw failure
-            publish = () => {
-              begin()
-              write({ type: `insert`, value: { id: `a`, version: 1 } })
-              commit()
-            }
-            markReady()
-            return { cleanup: () => gate.promise }
-          },
-        },
-      })
-      const client = new DbClient()
-      let statusLeases = 0
-      const on = source.on.bind(source)
-      source.on = (event, listener) => {
-        const stop = on(event, listener)
-        if (event !== `status:change`) return stop
-        statusLeases++
-        let active = true
-        return () => {
-          if (active) {
-            active = false
-            statusLeases--
-            stop()
-          }
-        }
-      }
-      let clientLeases = 0
-      const subscribeClient = client.subscribe.bind(client)
-      vi.spyOn(client, `subscribe`).mockImplementation((listener) => {
-        clientLeases++
-        const stop = subscribeClient(listener)
-        let active = true
-        return () => {
-          if (active) {
-            active = false
-            clientLeases--
-            stop()
-          }
-        }
-      })
-      let layoutLeases = 0
-      const subscribeLayout = source._subscribeLayoutChanges.bind(source)
-      vi.spyOn(source, `_subscribeLayoutChanges`).mockImplementation(
-        (listener) => {
-          layoutLeases++
-          const stop = subscribeLayout(listener)
-          let active = true
-          return () => {
-            if (active) {
-              active = false
-              layoutLeases--
-              stop()
-            }
-          }
-        },
-      )
-      const observer = createLiveQueryObserver(source, {
-        mode,
-        client,
-        queryHash: `setup-${mode}-${failureAt}-${failures}`,
-      })
-      const failedListener = vi.fn()
-      const listener = vi.fn()
-      let pending: Promise<void> | undefined
-      let release: (() => void) | undefined
-      await withOracleCleanup(async () => {
-        if (failureAt === `cleanup`) {
-          source.startSyncImmediate()
-          pending = source.cleanup()
-        }
-        for (let attempt = 0; attempt < failures; attempt++) {
-          expect(() => observer.subscribe(failedListener)).toThrow(
-            failureAt === `cleanup` ? /during cleanup/ : failure,
-          )
-          expect({
-            clientLeases,
-            layoutLeases,
-            statusLeases,
-            source: source.subscriberCount,
-          }).toEqual({
-            clientLeases: 0,
-            layoutLeases: 0,
-            statusLeases: 0,
-            source: 0,
-          })
-          if (failureAt === `sync-throw`) await source.cleanup()
-        }
-        const failedPrefix = failedListener.mock.calls.length
-        gate.resolve()
-        await pending
-        failStart = false
-        release = observer.subscribe(listener)
-        expect(source.subscriberCount).toBe(1)
-        expect({ clientLeases, layoutLeases }).toEqual({
-          clientLeases: 1,
-          layoutLeases: 1,
-        })
-        publish()
-        expect(
-          Array.from(
-            observer.getSnapshot().state!.values(),
-            ({ id, version }) => ({ id, version }),
-          ),
-        ).toEqual([{ id: `a`, version: 1 }])
-        expect(listener).toHaveBeenCalled()
-        expect(failedListener).toHaveBeenCalledTimes(failedPrefix)
-        release()
-        expect({
-          clientLeases,
-          layoutLeases,
-          statusLeases,
-          source: source.subscriberCount,
-        }).toEqual({
-          clientLeases: 0,
-          layoutLeases: 0,
-          statusLeases: 0,
-          source: 0,
-        })
-      }, [
-        () => gate.resolve(),
-        () => release?.(),
-        () => observer.dispose(),
-        () => source.cleanup(),
-        () => client.cleanup(),
-      ])
-    },
-  )
-})
-
 /**
  * A release retires its logical owner even when application notification throws.
  * Reporting that failure cannot leave the observer attached to zero channels.
@@ -1039,28 +828,6 @@ function applyDeliveryMutant(
   return corrupted
 }
 
-async function finishHistory(
-  cleanup: ReadonlyArray<() => void | Promise<void>>,
-  failure: { error: unknown } | undefined,
-): Promise<void> {
-  const cleanupFailures: Array<unknown> = []
-  for (const release of cleanup) {
-    try {
-      await release()
-    } catch (error) {
-      cleanupFailures.push(error)
-    }
-  }
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(
-      failure ? [failure.error, ...cleanupFailures] : cleanupFailures,
-      `Observer history cleanup failed`,
-      failure ? { cause: failure.error } : undefined,
-    )
-  }
-  if (failure) throw failure.error
-}
-
 async function runHistory(
   mode: Mode,
   history: Array<Command>,
@@ -1260,45 +1027,11 @@ function reactionHistory(reaction: Reaction): Array<Command> {
   ]
 }
 
-async function runStaleReadyHistory(
-  mode: Mode,
-  injectStaleReady: boolean,
-): Promise<void> {
-  let markReady!: () => void
-  const source = createCollection<Row, string>({
-    id: `observer-stale-ready-${collectionId++}`,
-    getKey: ({ id }) => id,
-    startSync: false,
-    sync: {
-      sync: (operations) => {
-        markReady = operations.markReady
-      },
-    },
-  })
-  source.startSyncImmediate()
-  const observer = createLiveQueryObserver(source, { mode })
-  let readyNotifications = 0
-  const readyListener = (
-    changes: Array<ChangeMessage<Row, string>> | undefined,
-  ): void => {
-    if (changes === undefined) readyNotifications++
-  }
-
-  let failure: { error: unknown } | undefined
-  try {
-    observer.subscribe(readyListener)
-    observer.dispose()
-    markReady()
-    if (injectStaleReady) readyListener(undefined)
-    expect(readyNotifications).toBe(0)
-  } catch (error) {
-    failure = { error }
-  }
-  await finishHistory(
-    [() => observer.dispose(), () => source.cleanup()],
-    failure,
-  )
-}
+declareOracle({
+  check: [runHistory, assertHistory],
+  model: [subscribeModel, unsubscribeModel, publishModel, disposeModel],
+  grammar: [command, listener],
+})
 
 describe(`LiveQueryObserver generated histories`, () => {
   for (const mode of [`granular`, `wholesale`] as const) {
@@ -1459,14 +1192,4 @@ describe(`LiveQueryObserver generated histories`, () => {
       expect(reach.reactions.nested).toBe(1)
     },
   )
-
-  it.each([`granular`, `wholesale`] as const)(
-    `rejects a stale ready notification after disposal through the %s status path`,
-    async (mode) => {
-      await runStaleReadyHistory(mode, false)
-      await expect(runStaleReadyHistory(mode, true)).rejects.toMatchObject({
-        name: `AssertionError`,
-      })
-    },
-  )
 })
diff --git a/packages/db/tests/live-query-observer-history.test.ts b/packages/db/tests/live-query-observer-history.test.ts
new file mode 100644
index 0000000000..7f766a9466
--- /dev/null
+++ b/packages/db/tests/live-query-observer-history.test.ts
@@ -0,0 +1,279 @@
+/**
+ * Ordinary LiveQueryObserver tests: a stale ready notification after disposal
+ * is rejected on the granular and wholesale status paths, and failed
+ * subscription setup releases its acquired resources. The eligibility ledger
+ * and delivery law are owned by live-query-observer-history-oracle.property.test.ts.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { DbClient } from '../src/client.js'
+import { createDeferred } from '../src/deferred.js'
+import { createCollection } from '../src/collection/index.js'
+import { createLiveQueryObserver } from '../src/live-query-observer.js'
+import { finishHistory } from './observer-history-cleanup.js'
+import { withOracleCleanup } from './utils.js'
+import type { ChangeMessage } from '../src/types.js'
+
+type Row = { id: string; version: number }
+type Mode = `granular` | `wholesale`
+
+let collectionId = 0
+
+async function runStaleReadyHistory(
+  mode: Mode,
+  injectStaleReady: boolean,
+): Promise<void> {
+  let markReady!: () => void
+  const source = createCollection<Row, string>({
+    id: `observer-stale-ready-${collectionId++}`,
+    getKey: ({ id }) => id,
+    startSync: false,
+    sync: {
+      sync: (operations) => {
+        markReady = operations.markReady
+      },
+    },
+  })
+  source.startSyncImmediate()
+  const observer = createLiveQueryObserver(source, { mode })
+  let readyNotifications = 0
+  const readyListener = (
+    changes: Array<ChangeMessage<Row, string>> | undefined,
+  ): void => {
+    if (changes === undefined) readyNotifications++
+  }
+
+  let failure: { error: unknown } | undefined
+  try {
+    observer.subscribe(readyListener)
+    observer.dispose()
+    markReady()
+    if (injectStaleReady) readyListener(undefined)
+    expect(readyNotifications).toBe(0)
+  } catch (error) {
+    failure = { error }
+  }
+  await finishHistory(
+    [() => observer.dispose(), () => source.cleanup()],
+    failure,
+  )
+}
+
+describe(`LiveQueryObserver generated histories`, () => {
+  it.each([`granular`, `wholesale`] as const)(
+    `rejects a stale ready notification after disposal through the %s status path`,
+    async (mode) => {
+      await runStaleReadyHistory(mode, false)
+      await expect(runStaleReadyHistory(mode, true)).rejects.toMatchObject({
+        name: `AssertionError`,
+      })
+    },
+  )
+})
+
+/**
+ * Failed subscription setup transfers no listener ownership to the observer:
+ * the caller received no release handle. These fixed cases pin each failure
+ * point, cleanup rejection and a real sync startup throw, in both modes, with
+ * one or two failed attempts before an explicit retry. They compare with
+ * written lease counts. The generated ownership law that these cases illustrate
+ * is owned by live-query-observer-history-oracle.property.test.ts.
+ * A late listener seed that fails leaves a healthy peer subscribed; that peer
+ * alone receives later publications. These are controlled core boundaries;
+ * framework commit errors are not modeled.
+ */
+describe(`observer subscription setup ownership`, () => {
+  it.each([1, 2])(
+    `preserves a healthy peer across %s failed late listener seeds`,
+    async (failures) => {
+      let publish = () => {}
+      const source = createCollection<Row>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            let version = 0
+            publish = () => {
+              begin()
+              write({
+                type: version === 0 ? `insert` : `update`,
+                value: { id: `a`, version: ++version },
+              })
+              commit()
+            }
+            publish()
+            markReady()
+          },
+        },
+      })
+      const observer = createLiveQueryObserver(source, { mode: `granular` })
+      const healthy = vi.fn()
+      const failure = new Error(`late listener seed failed`)
+      const failed = vi.fn(() => {
+        throw failure
+      })
+      let stop: (() => void) | undefined
+      await withOracleCleanup(() => {
+        stop = observer.subscribe(healthy)
+        for (let attempt = 1; attempt <= failures; attempt++) {
+          expect(() => observer.subscribe(failed)).toThrow(failure)
+          expect(failed).toHaveBeenCalledTimes(attempt)
+          expect(source.subscriberCount).toBe(1)
+        }
+        const prefix = healthy.mock.calls.length
+        expect(publish).not.toThrow()
+        expect(healthy).toHaveBeenCalledTimes(prefix + 1)
+        expect(failed).toHaveBeenCalledTimes(failures)
+        expect(observer.getSnapshot().state?.get(`a`)?.version).toBe(2)
+        stop()
+        expect(source.subscriberCount).toBe(0)
+      }, [() => stop?.(), () => observer.dispose(), () => source.cleanup()])
+    },
+  )
+
+  it.each(
+    ([`granular`, `wholesale`] as const).flatMap((mode) =>
+      ([`cleanup`, `sync-throw`] as const).flatMap((failureAt) =>
+        ([1, 2] as const).map((failures) => ({ mode, failureAt, failures })),
+      ),
+    ),
+  )(
+    `releases failed $mode setup at $failureAt before $failures-attempt retry`,
+    async ({ mode, failureAt, failures }) => {
+      const gate = createDeferred<void>()
+      const failure = new Error(`source startup failed`)
+      let failStart = failureAt === `sync-throw`
+      let publish = () => {}
+      const source = createCollection<Row>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            if (failStart) throw failure
+            publish = () => {
+              begin()
+              write({ type: `insert`, value: { id: `a`, version: 1 } })
+              commit()
+            }
+            markReady()
+            return { cleanup: () => gate.promise }
+          },
+        },
+      })
+      const client = new DbClient()
+      let statusLeases = 0
+      const on = source.on.bind(source)
+      source.on = (event, listener) => {
+        const stop = on(event, listener)
+        if (event !== `status:change`) return stop
+        statusLeases++
+        let active = true
+        return () => {
+          if (active) {
+            active = false
+            statusLeases--
+            stop()
+          }
+        }
+      }
+      let clientLeases = 0
+      const subscribeClient = client.subscribe.bind(client)
+      vi.spyOn(client, `subscribe`).mockImplementation((listener) => {
+        clientLeases++
+        const stop = subscribeClient(listener)
+        let active = true
+        return () => {
+          if (active) {
+            active = false
+            clientLeases--
+            stop()
+          }
+        }
+      })
+      let layoutLeases = 0
+      const subscribeLayout = source._subscribeLayoutChanges.bind(source)
+      vi.spyOn(source, `_subscribeLayoutChanges`).mockImplementation(
+        (listener) => {
+          layoutLeases++
+          const stop = subscribeLayout(listener)
+          let active = true
+          return () => {
+            if (active) {
+              active = false
+              layoutLeases--
+              stop()
+            }
+          }
+        },
+      )
+      const observer = createLiveQueryObserver(source, {
+        mode,
+        client,
+        queryHash: `setup-${mode}-${failureAt}-${failures}`,
+      })
+      const failedListener = vi.fn()
+      const listener = vi.fn()
+      let pending: Promise<void> | undefined
+      let release: (() => void) | undefined
+      await withOracleCleanup(async () => {
+        if (failureAt === `cleanup`) {
+          source.startSyncImmediate()
+          pending = source.cleanup()
+        }
+        for (let attempt = 0; attempt < failures; attempt++) {
+          expect(() => observer.subscribe(failedListener)).toThrow(
+            failureAt === `cleanup` ? /during cleanup/ : failure,
+          )
+          expect({
+            clientLeases,
+            layoutLeases,
+            statusLeases,
+            source: source.subscriberCount,
+          }).toEqual({
+            clientLeases: 0,
+            layoutLeases: 0,
+            statusLeases: 0,
+            source: 0,
+          })
+          if (failureAt === `sync-throw`) await source.cleanup()
+        }
+        const failedPrefix = failedListener.mock.calls.length
+        gate.resolve()
+        await pending
+        failStart = false
+        release = observer.subscribe(listener)
+        expect(source.subscriberCount).toBe(1)
+        expect({ clientLeases, layoutLeases }).toEqual({
+          clientLeases: 1,
+          layoutLeases: 1,
+        })
+        publish()
+        expect(
+          Array.from(
+            observer.getSnapshot().state!.values(),
+            ({ id, version }) => ({ id, version }),
+          ),
+        ).toEqual([{ id: `a`, version: 1 }])
+        expect(listener).toHaveBeenCalled()
+        expect(failedListener).toHaveBeenCalledTimes(failedPrefix)
+        release()
+        expect({
+          clientLeases,
+          layoutLeases,
+          statusLeases,
+          source: source.subscriberCount,
+        }).toEqual({
+          clientLeases: 0,
+          layoutLeases: 0,
+          statusLeases: 0,
+          source: 0,
+        })
+      }, [
+        () => gate.resolve(),
+        () => release?.(),
+        () => observer.dispose(),
+        () => source.cleanup(),
+        () => client.cleanup(),
+      ])
+    },
+  )
+})
diff --git a/packages/db/tests/live-query-observer-hydration-oracle.property.test.ts b/packages/db/tests/live-query-observer-hydration-oracle.property.test.ts
index e17ff473dc..e7995997e0 100644
--- a/packages/db/tests/live-query-observer-hydration-oracle.property.test.ts
+++ b/packages/db/tests/live-query-observer-hydration-oracle.property.test.ts
@@ -4,6 +4,7 @@ import { DbClient } from '../src/client.js'
 import { createCollection } from '../src/collection/index.js'
 import { createLiveQueryObserver } from '../src/live-query-observer.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import { createOracleReach } from './oracle-reach.js'
 import type {
   ChangeMessage,
@@ -184,6 +185,10 @@ function expectedView(
   return { status: liveStatus, rows: liveRows }
 }
 
+// The model predicts the view; the grammar draws the histories that the
+// driver below replays, including the fixed replays at the end of the file.
+declareOracle({ model: [advance, expectedView], grammar: [history] })
+
 // ---------------------------------------------------------------------------
 // Production driver
 // ---------------------------------------------------------------------------
diff --git a/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts b/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts
index dd9fa5d60f..48afa97e66 100644
--- a/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts
+++ b/packages/db/tests/live-query-observer-snapshot-oracle.property.test.ts
@@ -1,12 +1,13 @@
 import { fc } from '@fast-check/vitest'
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
-import { DbClient, collectionOptions } from '../src/client.js'
+import { DbClient } from '../src/client.js'
 import { getLiveQueryHash } from '../src/live-query-options.js'
 import { localOnlyCollectionOptions } from '../src/local-only.js'
 import { createLiveQueryObserver } from '../src/live-query-observer.js'
 import { Query, createLiveQueryCollection } from '../src/query/index.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import { createOracleReach } from './oracle-reach.js'
 import type { HealthNode } from '../src/types.js'
 
@@ -289,6 +290,11 @@ async function checkHistory(
   }
 }
 
+declareOracle({
+  check: [checkRead, checkHistory, checkHealthHistory],
+  model: [modelRows],
+})
+
 const history = fc.array(command, { minLength: 1, maxLength: 24 })
 const reads = fc.array(
   fc.record({ snapshot: fc.nat({ max: 30 }), dataFirst: fc.boolean() }),
@@ -632,182 +638,3 @@ describe(`a snapshot shows the current health tree`, () => {
     ])
   })
 })
-
-// Work probe: an unchanged prepared server revision needs one admission walk,
-// and checking row presence must not materialize its lazy keyed view.
-it(`reuses server admission without building the lazy state Map`, async () => {
-  const client = new DbClient()
-  const source = client.collection(
-    collectionOptions(`server-work`, () =>
-      localOnlyCollectionOptions<Row, string>({
-        id: `server-work`,
-        getKey: (row) => row.id,
-        initialData: [{ id: `a`, version: 1 }],
-      }),
-    ),
-  )
-  await source.preload()
-  const query = new Query().from({ row: source }).orderBy(({ row }) => row.id)
-  const collection = createLiveQueryCollection({ query })
-  await collection.preload()
-  const observer = createLiveQueryObserver(collection, {
-    client,
-    queryHash: getLiveQueryHash({ query }),
-  })
-  const walk = vi.spyOn(client, `_hasSsrCollectionSnapshot`)
-  const snapshot = observer.getSnapshot()
-  const state = vi.spyOn(snapshot, `state`, `get`)
-  const browserWindow = globalThis.window
-  vi.stubGlobal(`window`, undefined)
-  try {
-    const first = observer.getServerSnapshot()
-    for (let i = 0; i < 10; i++)
-      expect(observer.getServerSnapshot()).toBe(first)
-    expect(
-      walk.mock.calls.length,
-      `admit an unchanged revision once`,
-    ).toBeLessThanOrEqual(1)
-    expect(
-      state,
-      `row-presence check keeps keyed materialization lazy`,
-    ).not.toHaveBeenCalled()
-  } finally {
-    vi.stubGlobal(`window`, browserWindow)
-    observer.dispose()
-    await collection.cleanup()
-    await client.cleanup()
-  }
-})
-
-// Capturing a loading SSR view must not answer a later explicit data preload.
-// The real source controls readiness; server capture owns only the initial view.
-it(`keeps explicit preload pending after a loading server capture`, async () => {
-  let ready = () => {}
-  const client = new DbClient()
-  const descriptor = collectionOptions(`capture-preload`, () => ({
-    id: `capture-preload`,
-    getKey: (row: Row) => row.id,
-    sync: {
-      sync: ({ markReady }) => {
-        ready = markReady
-      },
-    },
-  }))
-  const source = client.collection(descriptor)
-  const query = new Query().from({ row: source })
-  const collection = createLiveQueryCollection({ query })
-  const observer = createLiveQueryObserver(collection, {
-    client,
-    queryHash: getLiveQueryHash({ query }),
-  })
-  const browserWindow = globalThis.window
-  vi.stubGlobal(`window`, undefined)
-  try {
-    expect(observer.getServerSnapshot().isReady).toBe(false)
-    let settled = false
-    const preload = client.preloadLiveQuery({ query }).then(() => {
-      settled = true
-    })
-    await Promise.resolve()
-    await Promise.resolve()
-    expect(settled, `an initial view is not completed data demand`).toBe(false)
-    ready()
-    await preload
-    expect(settled).toBe(true)
-  } finally {
-    vi.stubGlobal(`window`, browserWindow)
-    observer.dispose()
-    await collection.cleanup()
-    await client.cleanup()
-  }
-})
-
-// A pending stream owns one result promise. Capturing its initial loading view
-// must not replace that promise when another preload requests the same data.
-it(`retains a pending stream after capturing its loading view`, async () => {
-  let ready = () => {}
-  const client = new DbClient()
-  const descriptor = collectionOptions(`pending-capture`, () => ({
-    id: `pending-capture`,
-    getKey: (row: Row) => row.id,
-    sync: {
-      sync: ({ markReady }) => {
-        ready = markReady
-      },
-    },
-  }))
-  const query = new Query().from({ row: descriptor })
-  const hash = getLiveQueryHash({ query })
-  const preload = client.preloadLiveQuery({ query })
-  const original = client.dehydrate({ shouldDehydrateLiveQuery: () => true })
-    .liveQueries![0]!.promise
-  const source = client.collection(descriptor)
-  const collection = createLiveQueryCollection({
-    query: new Query().from({ row: source }),
-  })
-  const observer = createLiveQueryObserver(collection, {
-    client,
-    queryHash: hash,
-  })
-  const browserWindow = globalThis.window
-  vi.stubGlobal(`window`, undefined)
-  try {
-    expect(observer.getServerSnapshot().isReady).toBe(false)
-    const peer = client.preloadLiveQuery({ query })
-    expect(
-      client.dehydrate({ shouldDehydrateLiveQuery: () => true })
-        .liveQueries![0]!.promise,
-      `initial capture cannot replace the established stream`,
-    ).toBe(original)
-    ready()
-    await Promise.all([preload, peer])
-  } finally {
-    ready()
-    vi.stubGlobal(`window`, browserWindow)
-    observer.dispose()
-    await collection.cleanup()
-    await client.cleanup()
-  }
-})
-
-// Non-streaming transport remains JSON-compatible. Capturing an initial view
-// does not opt its route into promise streaming; opted-in streaming still keeps
-// the pending result promise beside the initial snapshot.
-it.each([false, true])(
-  `captures a pending initial view with streaming=%s`,
-  async (streaming) => {
-    const client = new DbClient()
-    client._setSsrStreamingEnabled(streaming)
-    const descriptor = collectionOptions(`pending-json`, () => ({
-      id: `pending-json`,
-      getKey: (row: Row) => row.id,
-      sync: { sync: () => {} },
-    }))
-    const query = new Query().from({ row: descriptor })
-    void client.preloadLiveQuery({ query }).catch(() => {})
-    const source = client.collection(descriptor)
-    const collection = createLiveQueryCollection({
-      query: new Query().from({ row: source }),
-    })
-    const observer = createLiveQueryObserver(collection, {
-      client,
-      queryHash: getLiveQueryHash({ query }),
-    })
-    const browserWindow = globalThis.window
-    vi.stubGlobal(`window`, undefined)
-    try {
-      observer.getServerSnapshot()
-      const transported = client.dehydrate().liveQueries![0]!
-      expect(transported.snapshot?.status).toBe(`loading`)
-      expect(
-        transported.promise instanceof Promise,
-        `only requested streaming carries a promise`,
-      ).toBe(streaming)
-    } finally {
-      vi.stubGlobal(`window`, browserWindow)
-      observer.dispose()
-      await collection.cleanup()
-      await client.cleanup()
-    }
-  },
-)
diff --git a/packages/db/tests/live-query-observer-snapshot.test.ts b/packages/db/tests/live-query-observer-snapshot.test.ts
new file mode 100644
index 0000000000..ecf85dc453
--- /dev/null
+++ b/packages/db/tests/live-query-observer-snapshot.test.ts
@@ -0,0 +1,192 @@
+// Ordinary regressions for live-query observer snapshots around SSR capture
+// and client preloads: an unchanged server revision keeps its identity, a
+// loading capture does not answer an explicit preload, a pending stream keeps
+// its promise, and transport streaming is opt-in. The point-in-time law for
+// retained snapshots belongs to live-query-observer-snapshot-oracle.property.test.ts.
+import { expect, it, vi } from 'vitest'
+import { DbClient, collectionOptions } from '../src/client.js'
+import { getLiveQueryHash } from '../src/live-query-options.js'
+import { localOnlyCollectionOptions } from '../src/local-only.js'
+import { createLiveQueryObserver } from '../src/live-query-observer.js'
+import { Query, createLiveQueryCollection } from '../src/query/index.js'
+
+type Row = { id: string; version: number }
+
+// Work probe: an unchanged prepared server revision needs one admission walk,
+// and checking row presence must not materialize its lazy keyed view.
+it(`reuses server admission without building the lazy state Map`, async () => {
+  const client = new DbClient()
+  const source = client.collection(
+    collectionOptions(`server-work`, () =>
+      localOnlyCollectionOptions<Row, string>({
+        id: `server-work`,
+        getKey: (row) => row.id,
+        initialData: [{ id: `a`, version: 1 }],
+      }),
+    ),
+  )
+  await source.preload()
+  const query = new Query().from({ row: source }).orderBy(({ row }) => row.id)
+  const collection = createLiveQueryCollection({ query })
+  await collection.preload()
+  const observer = createLiveQueryObserver(collection, {
+    client,
+    queryHash: getLiveQueryHash({ query }),
+  })
+  const walk = vi.spyOn(client, `_hasSsrCollectionSnapshot`)
+  const snapshot = observer.getSnapshot()
+  const state = vi.spyOn(snapshot, `state`, `get`)
+  const browserWindow = globalThis.window
+  vi.stubGlobal(`window`, undefined)
+  try {
+    const first = observer.getServerSnapshot()
+    for (let i = 0; i < 10; i++)
+      expect(observer.getServerSnapshot()).toBe(first)
+    expect(
+      walk.mock.calls.length,
+      `admit an unchanged revision once`,
+    ).toBeLessThanOrEqual(1)
+    expect(
+      state,
+      `row-presence check keeps keyed materialization lazy`,
+    ).not.toHaveBeenCalled()
+  } finally {
+    vi.stubGlobal(`window`, browserWindow)
+    observer.dispose()
+    await collection.cleanup()
+    await client.cleanup()
+  }
+})
+
+// Capturing a loading SSR view must not answer a later explicit data preload.
+// The real source controls readiness; server capture owns only the initial view.
+it(`keeps explicit preload pending after a loading server capture`, async () => {
+  let ready = () => {}
+  const client = new DbClient()
+  const descriptor = collectionOptions(`capture-preload`, () => ({
+    id: `capture-preload`,
+    getKey: (row: Row) => row.id,
+    sync: {
+      sync: ({ markReady }) => {
+        ready = markReady
+      },
+    },
+  }))
+  const source = client.collection(descriptor)
+  const query = new Query().from({ row: source })
+  const collection = createLiveQueryCollection({ query })
+  const observer = createLiveQueryObserver(collection, {
+    client,
+    queryHash: getLiveQueryHash({ query }),
+  })
+  const browserWindow = globalThis.window
+  vi.stubGlobal(`window`, undefined)
+  try {
+    expect(observer.getServerSnapshot().isReady).toBe(false)
+    let settled = false
+    const preload = client.preloadLiveQuery({ query }).then(() => {
+      settled = true
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(settled, `an initial view is not completed data demand`).toBe(false)
+    ready()
+    await preload
+    expect(settled).toBe(true)
+  } finally {
+    vi.stubGlobal(`window`, browserWindow)
+    observer.dispose()
+    await collection.cleanup()
+    await client.cleanup()
+  }
+})
+
+// A pending stream owns one result promise. Capturing its initial loading view
+// must not replace that promise when another preload requests the same data.
+it(`retains a pending stream after capturing its loading view`, async () => {
+  let ready = () => {}
+  const client = new DbClient()
+  const descriptor = collectionOptions(`pending-capture`, () => ({
+    id: `pending-capture`,
+    getKey: (row: Row) => row.id,
+    sync: {
+      sync: ({ markReady }) => {
+        ready = markReady
+      },
+    },
+  }))
+  const query = new Query().from({ row: descriptor })
+  const hash = getLiveQueryHash({ query })
+  const preload = client.preloadLiveQuery({ query })
+  const original = client.dehydrate({ shouldDehydrateLiveQuery: () => true })
+    .liveQueries![0]!.promise
+  const source = client.collection(descriptor)
+  const collection = createLiveQueryCollection({
+    query: new Query().from({ row: source }),
+  })
+  const observer = createLiveQueryObserver(collection, {
+    client,
+    queryHash: hash,
+  })
+  const browserWindow = globalThis.window
+  vi.stubGlobal(`window`, undefined)
+  try {
+    expect(observer.getServerSnapshot().isReady).toBe(false)
+    const peer = client.preloadLiveQuery({ query })
+    expect(
+      client.dehydrate({ shouldDehydrateLiveQuery: () => true })
+        .liveQueries![0]!.promise,
+      `initial capture cannot replace the established stream`,
+    ).toBe(original)
+    ready()
+    await Promise.all([preload, peer])
+  } finally {
+    ready()
+    vi.stubGlobal(`window`, browserWindow)
+    observer.dispose()
+    await collection.cleanup()
+    await client.cleanup()
+  }
+})
+
+// Non-streaming transport remains JSON-compatible. Capturing an initial view
+// does not opt its route into promise streaming; opted-in streaming still keeps
+// the pending result promise beside the initial snapshot.
+it.each([false, true])(
+  `captures a pending initial view with streaming=%s`,
+  async (streaming) => {
+    const client = new DbClient()
+    client._setSsrStreamingEnabled(streaming)
+    const descriptor = collectionOptions(`pending-json`, () => ({
+      id: `pending-json`,
+      getKey: (row: Row) => row.id,
+      sync: { sync: () => {} },
+    }))
+    const query = new Query().from({ row: descriptor })
+    void client.preloadLiveQuery({ query }).catch(() => {})
+    const source = client.collection(descriptor)
+    const collection = createLiveQueryCollection({
+      query: new Query().from({ row: source }),
+    })
+    const observer = createLiveQueryObserver(collection, {
+      client,
+      queryHash: getLiveQueryHash({ query }),
+    })
+    const browserWindow = globalThis.window
+    vi.stubGlobal(`window`, undefined)
+    try {
+      observer.getServerSnapshot()
+      const transported = client.dehydrate().liveQueries![0]!
+      expect(transported.snapshot?.status).toBe(`loading`)
+      expect(
+        transported.promise instanceof Promise,
+        `only requested streaming carries a promise`,
+      ).toBe(streaming)
+    } finally {
+      vi.stubGlobal(`window`, browserWindow)
+      observer.dispose()
+      await collection.cleanup()
+      await client.cleanup()
+    }
+  },
+)
diff --git a/packages/db/tests/local-only-direct-write-fixture.ts b/packages/db/tests/local-only-direct-write-fixture.ts
new file mode 100644
index 0000000000..3853993213
--- /dev/null
+++ b/packages/db/tests/local-only-direct-write-fixture.ts
@@ -0,0 +1,28 @@
+import { createCollection } from '../src/index'
+import { localOnlyCollectionOptions } from '../src/local-only'
+
+// Shared order collection for the local-only direct-write tests.
+export type Row = { id: number; value: string }
+
+export type Handlers = Partial<
+  Record<`onInsert` | `onUpdate` | `onDelete`, () => Promise<void>>
+>
+
+export function createOrders(handlers: Handlers = {}) {
+  return createCollection(
+    localOnlyCollectionOptions<Row, number>({
+      id: `local-only-direct-${Math.random()}`,
+      getKey: (row) => row.id,
+      initialData: [{ id: 1, value: `a` }],
+      ...handlers,
+    }),
+  )
+}
+
+export type Orders = ReturnType<typeof createOrders>
+
+export const confirmEverything: Handlers = {
+  onInsert: () => Promise.resolve(),
+  onUpdate: () => Promise.resolve(),
+  onDelete: () => Promise.resolve(),
+}
diff --git a/packages/db/tests/local-only-direct-write-oracle.test.ts b/packages/db/tests/local-only-direct-write-oracle.test.ts
index dc2b58559e..bfb0b639fa 100644
--- a/packages/db/tests/local-only-direct-write-oracle.test.ts
+++ b/packages/db/tests/local-only-direct-write-oracle.test.ts
@@ -1,10 +1,10 @@
 import { describe, expect, it } from 'vitest'
-import { z } from 'zod'
-import { createCollection } from '../src/index'
-import { localOnlyCollectionOptions } from '../src/local-only'
-import { createTransaction } from '../src/transactions'
-import { createDeferred } from '../src/deferred'
-import { captureCreatedTransactions } from './utils'
+import { declareOracle } from './oracle-declaration'
+import {
+  confirmEverything,
+  createOrders,
+} from './local-only-direct-write-fixture'
+import type { Handlers, Orders } from './local-only-direct-write-fixture'
 
 /**
  * # When does a local-only direct write skip the optimistic stage?
@@ -29,227 +29,7 @@ import { captureCreatedTransactions } from './utils'
  * batch aside), throw the same error for a rejected write without publishing
  * it, and end with completed transactions and none left on the Collection.
  */
-type Row = { id: number; value: string }
 
-type Handlers = Partial<
-  Record<`onInsert` | `onUpdate` | `onDelete`, () => Promise<void>>
->
-
-function createOrders(handlers: Handlers = {}) {
-  return createCollection(
-    localOnlyCollectionOptions<Row, number>({
-      id: `local-only-direct-${Math.random()}`,
-      getKey: (row) => row.id,
-      initialData: [{ id: 1, value: `a` }],
-      ...handlers,
-    }),
-  )
-}
-
-describe(`local-only direct writes`, () => {
-  it(`publishes each direct write once and returns a completed transaction`, async () => {
-    const orders = createOrders()
-    const batches: Array<Array<string>> = []
-    orders.subscribeChanges(
-      (changes) =>
-        batches.push(changes.map((change) => `${change.type}:${change.key}`)),
-      { includeInitialState: true },
-    )
-
-    const inserted = orders.insert({ id: 2, value: `b` })
-    const updated = orders.update(1, (draft) => {
-      draft.value = `c`
-    })
-    const deleted = orders.delete(2)
-
-    for (const transaction of [inserted, updated, deleted]) {
-      expect(transaction.state).toBe(`completed`)
-      await expect(transaction.isPersisted.promise).resolves.toBe(transaction)
-      await expect(transaction.when(`settled`)).resolves.toBe(transaction)
-    }
-    expect(batches).toEqual([
-      [`insert:1`],
-      [`insert:2`],
-      [`update:1`],
-      [`delete:2`],
-    ])
-    expect(orders.get(1)).toMatchObject({
-      value: `c`,
-      $synced: true,
-      $origin: `local`,
-    })
-    expect(orders.has(2)).toBe(false)
-  })
-
-  it(`overlays a pending transaction instead of writing beneath it`, () => {
-    const orders = createOrders()
-    const pending = createTransaction({
-      autoCommit: false,
-      mutationFn: () => Promise.resolve(),
-    })
-    pending.mutate(() =>
-      orders.update(1, (draft) => {
-        draft.value = `pending`
-      }),
-    )
-
-    const direct = orders.update(1, (draft) => {
-      draft.value = `direct`
-    })
-
-    expect(direct.state).not.toBe(`completed`)
-    expect(orders.get(1)?.value).toBe(`direct`)
-    pending.rollback()
-  })
-
-  it(`stays visible while another transaction persists`, async () => {
-    const orders = createOrders()
-    const release = createDeferred<void>()
-    const persisting = createTransaction({
-      mutationFn: () => release.promise,
-    })
-    persisting.mutate(() => orders.insert({ id: 3, value: `persisting` }))
-    expect(persisting.state).toBe(`persisting`)
-
-    orders.update(1, (draft) => {
-      draft.value = `direct`
-    })
-
-    expect(orders.get(1)?.value).toBe(`direct`)
-    release.resolve()
-    await persisting.isPersisted.promise
-  })
-
-  it(`joins an ambient transaction`, () => {
-    const orders = createOrders()
-    const ambient = createTransaction({
-      autoCommit: false,
-      mutationFn: () => Promise.resolve(),
-    })
-    ambient.mutate(() =>
-      orders.update(1, (draft) => {
-        draft.value = `ambient`
-      }),
-    )
-
-    expect(ambient.state).toBe(`pending`)
-    expect(ambient.mutations).toHaveLength(1)
-    expect(orders.get(1)?.value).toBe(`ambient`)
-    ambient.rollback()
-    expect(orders.get(1)?.value).toBe(`a`)
-  })
-
-  // The direct write stores its rows when it publishes them, so a throwing
-  // subscriber cannot undo the write. The call rethrows, and the transaction
-  // still completes instead of staying pending.
-  it(`completes a direct write whose subscriber throws`, async () => {
-    const orders = createOrders()
-    const { created, restore: restoreCreate } =
-      captureCreatedTransactions(orders)
-    const failure = new Error(`subscriber failed`)
-    const subscription = orders.subscribeChanges(() => {
-      throw failure
-    })
-    expect(() => orders.insert({ id: 2, value: `b` })).toThrow(failure)
-    subscription.unsubscribe()
-    restoreCreate()
-
-    expect(orders.get(2)?.value).toBe(`b`)
-    expect(created.map((transaction) => transaction.state)).toEqual([
-      `completed`,
-    ])
-    await expect(created[0]!.isPersisted.promise).resolves.toBe(created[0])
-    // The next direct write still takes the direct path.
-    expect(orders.insert({ id: 3, value: `c` }).state).toBe(`completed`)
-  })
-
-  // A subscriber may write the key it was told about, as a normalizing or
-  // rejecting subscriber does. The first write stored its rows before that,
-  // so it completes and does not throw.
-  for (const kind of [`update`, `delete`] as const) {
-    it(`completes a direct insert whose subscriber ${kind}s the same key`, async () => {
-      const orders = createOrders()
-      const { created, restore: restoreCreate } =
-        captureCreatedTransactions(orders)
-      let reacted = false
-      const subscription = orders.subscribeChanges((changes) => {
-        if (reacted || changes.every((change) => change.key !== 2)) return
-        reacted = true
-        if (kind === `update`)
-          orders.update(2, (draft) => {
-            draft.value = `normalized`
-          })
-        else orders.delete(2)
-      })
-      try {
-        expect(() => orders.insert({ id: 2, value: `b` })).not.toThrow()
-      } finally {
-        subscription.unsubscribe()
-        restoreCreate()
-      }
-      expect(orders.get(2)?.value).toBe(
-        kind === `update` ? `normalized` : undefined,
-      )
-      await Promise.all(
-        created.map((transaction) => transaction.isPersisted.promise),
-      )
-      expect(created.map((transaction) => transaction.state)).toEqual([
-        `completed`,
-        `completed`,
-      ])
-    })
-  }
-
-  // A subscriber may throw a value that is not an Error. The rolled-back
-  // transaction still records an Error, so its receipt names the failure.
-  it(`records an Error when a direct write's subscriber throws a non-Error`, async () => {
-    const orders = createOrders({ onInsert: async () => {} })
-    const { created, restore: restoreCreate } =
-      captureCreatedTransactions(orders)
-    const subscription = orders.subscribeChanges(() => {
-      throw `bad`
-    })
-    try {
-      expect(() => orders.insert({ id: 2, value: `b` })).toThrow(`bad`)
-    } finally {
-      subscription.unsubscribe()
-      restoreCreate()
-    }
-    expect(created.map((transaction) => transaction.state)).toEqual([`failed`])
-    expect(created[0]!.error?.error).toBeInstanceOf(Error)
-    expect(created[0]!.error?.message).toBe(`bad`)
-    await expect(created[0]!.isPersisted.promise).rejects.toBeInstanceOf(Error)
-  })
-
-  it(`runs the user's handler for that operation type`, async () => {
-    let calls = 0
-    const orders = createOrders({
-      onUpdate: () => {
-        calls++
-        return Promise.resolve()
-      },
-    })
-
-    const transaction = orders.update(1, (draft) => {
-      draft.value = `handled`
-    })
-
-    expect(transaction.state).not.toBe(`completed`)
-    await transaction.isPersisted.promise
-    expect(calls).toBe(1)
-    expect(orders.get(1)?.value).toBe(`handled`)
-    // Inserts have no handler, so they still take the direct path.
-    expect(orders.insert({ id: 4, value: `d` }).state).toBe(`completed`)
-  })
-})
-
-const confirmEverything: Handlers = {
-  onInsert: () => Promise.resolve(),
-  onUpdate: () => Promise.resolve(),
-  onDelete: () => Promise.resolve(),
-}
-
-type Orders = ReturnType<typeof createOrders>
 type Write = (orders: Orders) => unknown
 
 // Runs writes in order and records what a caller could observe. A write
@@ -288,6 +68,19 @@ async function observe(handlers: Handlers, writes: Array<Write>) {
   }
 }
 
+// The check: the direct path matches the confirmed optimistic path in rows,
+// batches, errors, and states, and leaves no transaction on the Collection.
+function expectDirectMatchesConfirmed(
+  direct: Awaited<ReturnType<typeof observe>>,
+  reference: Awaited<ReturnType<typeof observe>>,
+): void {
+  expect(direct).toEqual(reference)
+  expect(direct.states.every((state) => state === `completed`)).toBe(true)
+  expect(direct.remaining).toBe(0)
+}
+
+declareOracle({ check: [expectDirectMatchesConfirmed] })
+
 describe(`local-only direct writes match the confirmed optimistic path`, () => {
   const histories: Record<string, Array<Write>> = {
     'a mixed multi-key batch': [
@@ -346,156 +139,7 @@ describe(`local-only direct writes match the confirmed optimistic path`, () => {
       const direct = await observe({}, writes)
       const reference = await observe(confirmEverything, writes)
 
-      expect(direct).toEqual(reference)
-      expect(direct.states.every((state) => state === `completed`)).toBe(true)
-      expect(direct.remaining).toBe(0)
-    })
-  }
-
-  it(`for a write the schema rejects`, () => {
-    const results = []
-    for (const handlers of [{}, confirmEverything]) {
-      const orders = createCollection(
-        localOnlyCollectionOptions({
-          id: `local-only-direct-schema-${Math.random()}`,
-          getKey: (row) => row.id,
-          schema: z.object({ id: z.number(), value: z.string().min(1) }),
-          initialData: [{ id: 1, value: `a` }],
-          ...handlers,
-        }),
-      )
-      const batches: Array<number> = []
-      orders.subscribeChanges((changes) => batches.push(changes.length))
-      const errors = []
-      for (const write of [
-        () => orders.insert({ id: 2, value: `` }),
-        () =>
-          orders.update(1, (draft) => {
-            draft.value = ``
-          }),
-      ]) {
-        try {
-          write()
-        } catch (error) {
-          errors.push(`${(error as Error).name}: ${(error as Error).message}`)
-        }
-      }
-      results.push({
-        errors,
-        batches,
-        rows: orders.toArray.map(({ id, value }) => ({ id, value })),
-        remaining: orders._state.transactions.size,
-      })
-    }
-
-    expect(results[0]!.errors).toHaveLength(2)
-    expect(results[0]!.batches).toEqual([])
-    expect(results[0]).toEqual(results[1])
-  })
-})
-
-describe(`local-only fallbacks for every operation type`, () => {
-  type Kind = `insert` | `update` | `delete`
-  // However the fallback is reached, the write must stay visible and must
-  // not report completion before the optimistic stage confirms it.
-  const write: Record<Kind, (orders: Orders) => ReturnType<Orders[Kind]>> = {
-    insert: (orders) => orders.insert({ id: 5, value: `direct` }),
-    update: (orders) =>
-      orders.update(1, (draft) => {
-        draft.value = `direct`
-      }),
-    delete: (orders) => orders.delete(1),
-  }
-  const rollbackBatches: Record<Kind, Array<Array<string>>> = {
-    insert: [[`insert:1`], [`insert:5`], [`delete:5`]],
-    update: [[`insert:1`], [`update:1`], [`update:1`]],
-    delete: [[`insert:1`], [`delete:1`], [`insert:1`]],
-  }
-  const visible: Record<Kind, (orders: Orders) => boolean> = {
-    insert: (orders) => orders.get(5)?.value === `direct`,
-    update: (orders) => orders.get(1)?.value === `direct`,
-    delete: (orders) => !orders.has(1),
-  }
-
-  for (const kind of [`insert`, `update`, `delete`] as const) {
-    it(`keeps a ${kind} visible while another transaction persists`, async () => {
-      const orders = createOrders()
-      const release = createDeferred<void>()
-      const persisting = createTransaction({
-        mutationFn: () => release.promise,
-      })
-      persisting.mutate(() => orders.insert({ id: 3, value: `persisting` }))
-
-      const transaction = write[kind](orders)
-
-      expect(transaction.state).not.toBe(`completed`)
-      expect(visible[kind](orders)).toBe(true)
-      release.resolve()
-      await persisting.isPersisted.promise
-      await transaction.isPersisted.promise
-      expect(visible[kind](orders)).toBe(true)
-    })
-
-    it(`overlays a pending transaction with a ${kind}`, async () => {
-      const orders = createOrders()
-      const pending = createTransaction({
-        autoCommit: false,
-        mutationFn: () => Promise.resolve(),
-      })
-      pending.mutate(() =>
-        orders.update(1, (draft) => {
-          draft.value = `pending`
-        }),
-      )
-
-      const transaction = write[kind](orders)
-
-      expect(transaction.state).not.toBe(`completed`)
-      expect(visible[kind](orders)).toBe(true)
-      pending.rollback()
-      await transaction.isPersisted.promise
-      expect(visible[kind](orders)).toBe(true)
-    })
-
-    it(`joins an ambient transaction with a ${kind}`, () => {
-      const orders = createOrders()
-      const ambient = createTransaction({
-        autoCommit: false,
-        mutationFn: () => Promise.resolve(),
-      })
-      ambient.mutate(() => write[kind](orders))
-
-      expect(ambient.mutations.map((m) => m.type)).toEqual([kind])
-      expect(visible[kind](orders)).toBe(true)
-      ambient.rollback()
-      expect(visible[kind](orders)).toBe(false)
-    })
-
-    it(`rolls back a ${kind} whose handler rejects`, async () => {
-      const handler = `on${kind[0]!.toUpperCase()}${kind.slice(1)}` as const
-      const orders = createOrders({
-        [handler]: () => Promise.reject(new Error(`handler failed`)),
-      })
-      const batches: Array<Array<string>> = []
-      orders.subscribeChanges(
-        (changes) =>
-          batches.push(changes.map((change) => `${change.type}:${change.key}`)),
-        { includeInitialState: true },
-      )
-
-      const transaction = write[kind](orders)
-
-      expect(visible[kind](orders)).toBe(true)
-      await expect(transaction.isPersisted.promise).rejects.toThrow(
-        `handler failed`,
-      )
-      expect(transaction.state).toBe(`failed`)
-      expect(visible[kind](orders)).toBe(false)
-      expect(orders.get(1)?.value ?? `a`).toBe(`a`)
-      expect(batches).toEqual(rollbackBatches[kind])
-      // Operation types without a handler still write directly.
-      const other = kind === `insert` ? `update` : `insert`
-      expect(write[other](orders).state).toBe(`completed`)
+      expectDirectMatchesConfirmed(direct, reference)
     })
   }
 })
diff --git a/packages/db/tests/local-only-direct-write.test.ts b/packages/db/tests/local-only-direct-write.test.ts
new file mode 100644
index 0000000000..18d6ec0947
--- /dev/null
+++ b/packages/db/tests/local-only-direct-write.test.ts
@@ -0,0 +1,365 @@
+/**
+ * Ordinary tests for local-only direct writes: a direct write publishes once
+ * and completes; a write under a pending, persisting, or ambient transaction
+ * keeps its optimistic visibility; and a rejected schema write publishes
+ * nothing. The direct-path law is owned by local-only-direct-write-oracle.test.ts,
+ * which compares the direct and confirmed paths.
+ */
+import { describe, expect, it } from 'vitest'
+import { z } from 'zod'
+import { createCollection } from '../src/index'
+import { localOnlyCollectionOptions } from '../src/local-only'
+import { createTransaction } from '../src/transactions'
+import { createDeferred } from '../src/deferred'
+import {
+  confirmEverything,
+  createOrders,
+} from './local-only-direct-write-fixture'
+import { captureCreatedTransactions } from './utils'
+import type { Orders } from './local-only-direct-write-fixture'
+
+describe(`local-only direct writes`, () => {
+  it(`publishes each direct write once and returns a completed transaction`, async () => {
+    const orders = createOrders()
+    const batches: Array<Array<string>> = []
+    orders.subscribeChanges(
+      (changes) =>
+        batches.push(changes.map((change) => `${change.type}:${change.key}`)),
+      { includeInitialState: true },
+    )
+
+    const inserted = orders.insert({ id: 2, value: `b` })
+    const updated = orders.update(1, (draft) => {
+      draft.value = `c`
+    })
+    const deleted = orders.delete(2)
+
+    for (const transaction of [inserted, updated, deleted]) {
+      expect(transaction.state).toBe(`completed`)
+      await expect(transaction.isPersisted.promise).resolves.toBe(transaction)
+      await expect(transaction.when(`settled`)).resolves.toBe(transaction)
+    }
+    expect(batches).toEqual([
+      [`insert:1`],
+      [`insert:2`],
+      [`update:1`],
+      [`delete:2`],
+    ])
+    expect(orders.get(1)).toMatchObject({
+      value: `c`,
+      $synced: true,
+      $origin: `local`,
+    })
+    expect(orders.has(2)).toBe(false)
+  })
+
+  it(`overlays a pending transaction instead of writing beneath it`, () => {
+    const orders = createOrders()
+    const pending = createTransaction({
+      autoCommit: false,
+      mutationFn: () => Promise.resolve(),
+    })
+    pending.mutate(() =>
+      orders.update(1, (draft) => {
+        draft.value = `pending`
+      }),
+    )
+
+    const direct = orders.update(1, (draft) => {
+      draft.value = `direct`
+    })
+
+    expect(direct.state).not.toBe(`completed`)
+    expect(orders.get(1)?.value).toBe(`direct`)
+    pending.rollback()
+  })
+
+  it(`stays visible while another transaction persists`, async () => {
+    const orders = createOrders()
+    const release = createDeferred<void>()
+    const persisting = createTransaction({
+      mutationFn: () => release.promise,
+    })
+    persisting.mutate(() => orders.insert({ id: 3, value: `persisting` }))
+    expect(persisting.state).toBe(`persisting`)
+
+    orders.update(1, (draft) => {
+      draft.value = `direct`
+    })
+
+    expect(orders.get(1)?.value).toBe(`direct`)
+    release.resolve()
+    await persisting.isPersisted.promise
+  })
+
+  it(`joins an ambient transaction`, () => {
+    const orders = createOrders()
+    const ambient = createTransaction({
+      autoCommit: false,
+      mutationFn: () => Promise.resolve(),
+    })
+    ambient.mutate(() =>
+      orders.update(1, (draft) => {
+        draft.value = `ambient`
+      }),
+    )
+
+    expect(ambient.state).toBe(`pending`)
+    expect(ambient.mutations).toHaveLength(1)
+    expect(orders.get(1)?.value).toBe(`ambient`)
+    ambient.rollback()
+    expect(orders.get(1)?.value).toBe(`a`)
+  })
+
+  // The direct write stores its rows when it publishes them, so a throwing
+  // subscriber cannot undo the write. The call rethrows, and the transaction
+  // still completes instead of staying pending.
+  it(`completes a direct write whose subscriber throws`, async () => {
+    const orders = createOrders()
+    const { created, restore: restoreCreate } =
+      captureCreatedTransactions(orders)
+    const failure = new Error(`subscriber failed`)
+    const subscription = orders.subscribeChanges(() => {
+      throw failure
+    })
+    expect(() => orders.insert({ id: 2, value: `b` })).toThrow(failure)
+    subscription.unsubscribe()
+    restoreCreate()
+
+    expect(orders.get(2)?.value).toBe(`b`)
+    expect(created.map((transaction) => transaction.state)).toEqual([
+      `completed`,
+    ])
+    await expect(created[0]!.isPersisted.promise).resolves.toBe(created[0])
+    // The next direct write still takes the direct path.
+    expect(orders.insert({ id: 3, value: `c` }).state).toBe(`completed`)
+  })
+
+  // A subscriber may write the key it was told about, as a normalizing or
+  // rejecting subscriber does. The first write stored its rows before that,
+  // so it completes and does not throw.
+  for (const kind of [`update`, `delete`] as const) {
+    it(`completes a direct insert whose subscriber ${kind}s the same key`, async () => {
+      const orders = createOrders()
+      const { created, restore: restoreCreate } =
+        captureCreatedTransactions(orders)
+      let reacted = false
+      const subscription = orders.subscribeChanges((changes) => {
+        if (reacted || changes.every((change) => change.key !== 2)) return
+        reacted = true
+        if (kind === `update`)
+          orders.update(2, (draft) => {
+            draft.value = `normalized`
+          })
+        else orders.delete(2)
+      })
+      try {
+        expect(() => orders.insert({ id: 2, value: `b` })).not.toThrow()
+      } finally {
+        subscription.unsubscribe()
+        restoreCreate()
+      }
+      expect(orders.get(2)?.value).toBe(
+        kind === `update` ? `normalized` : undefined,
+      )
+      await Promise.all(
+        created.map((transaction) => transaction.isPersisted.promise),
+      )
+      expect(created.map((transaction) => transaction.state)).toEqual([
+        `completed`,
+        `completed`,
+      ])
+    })
+  }
+
+  // A subscriber may throw a value that is not an Error. The rolled-back
+  // transaction still records an Error, so its receipt names the failure.
+  it(`records an Error when a direct write's subscriber throws a non-Error`, async () => {
+    const orders = createOrders({ onInsert: async () => {} })
+    const { created, restore: restoreCreate } =
+      captureCreatedTransactions(orders)
+    const subscription = orders.subscribeChanges(() => {
+      throw `bad`
+    })
+    try {
+      expect(() => orders.insert({ id: 2, value: `b` })).toThrow(`bad`)
+    } finally {
+      subscription.unsubscribe()
+      restoreCreate()
+    }
+    expect(created.map((transaction) => transaction.state)).toEqual([`failed`])
+    expect(created[0]!.error?.error).toBeInstanceOf(Error)
+    expect(created[0]!.error?.message).toBe(`bad`)
+    await expect(created[0]!.isPersisted.promise).rejects.toBeInstanceOf(Error)
+  })
+
+  it(`runs the user's handler for that operation type`, async () => {
+    let calls = 0
+    const orders = createOrders({
+      onUpdate: () => {
+        calls++
+        return Promise.resolve()
+      },
+    })
+
+    const transaction = orders.update(1, (draft) => {
+      draft.value = `handled`
+    })
+
+    expect(transaction.state).not.toBe(`completed`)
+    await transaction.isPersisted.promise
+    expect(calls).toBe(1)
+    expect(orders.get(1)?.value).toBe(`handled`)
+    // Inserts have no handler, so they still take the direct path.
+    expect(orders.insert({ id: 4, value: `d` }).state).toBe(`completed`)
+  })
+})
+
+describe(`local-only fallbacks for every operation type`, () => {
+  type Kind = `insert` | `update` | `delete`
+  // However the fallback is reached, the write must stay visible and must
+  // not report completion before the optimistic stage confirms it.
+  const write: Record<Kind, (orders: Orders) => ReturnType<Orders[Kind]>> = {
+    insert: (orders) => orders.insert({ id: 5, value: `direct` }),
+    update: (orders) =>
+      orders.update(1, (draft) => {
+        draft.value = `direct`
+      }),
+    delete: (orders) => orders.delete(1),
+  }
+  const rollbackBatches: Record<Kind, Array<Array<string>>> = {
+    insert: [[`insert:1`], [`insert:5`], [`delete:5`]],
+    update: [[`insert:1`], [`update:1`], [`update:1`]],
+    delete: [[`insert:1`], [`delete:1`], [`insert:1`]],
+  }
+  const visible: Record<Kind, (orders: Orders) => boolean> = {
+    insert: (orders) => orders.get(5)?.value === `direct`,
+    update: (orders) => orders.get(1)?.value === `direct`,
+    delete: (orders) => !orders.has(1),
+  }
+
+  for (const kind of [`insert`, `update`, `delete`] as const) {
+    it(`keeps a ${kind} visible while another transaction persists`, async () => {
+      const orders = createOrders()
+      const release = createDeferred<void>()
+      const persisting = createTransaction({
+        mutationFn: () => release.promise,
+      })
+      persisting.mutate(() => orders.insert({ id: 3, value: `persisting` }))
+
+      const transaction = write[kind](orders)
+
+      expect(transaction.state).not.toBe(`completed`)
+      expect(visible[kind](orders)).toBe(true)
+      release.resolve()
+      await persisting.isPersisted.promise
+      await transaction.isPersisted.promise
+      expect(visible[kind](orders)).toBe(true)
+    })
+
+    it(`overlays a pending transaction with a ${kind}`, async () => {
+      const orders = createOrders()
+      const pending = createTransaction({
+        autoCommit: false,
+        mutationFn: () => Promise.resolve(),
+      })
+      pending.mutate(() =>
+        orders.update(1, (draft) => {
+          draft.value = `pending`
+        }),
+      )
+
+      const transaction = write[kind](orders)
+
+      expect(transaction.state).not.toBe(`completed`)
+      expect(visible[kind](orders)).toBe(true)
+      pending.rollback()
+      await transaction.isPersisted.promise
+      expect(visible[kind](orders)).toBe(true)
+    })
+
+    it(`joins an ambient transaction with a ${kind}`, () => {
+      const orders = createOrders()
+      const ambient = createTransaction({
+        autoCommit: false,
+        mutationFn: () => Promise.resolve(),
+      })
+      ambient.mutate(() => write[kind](orders))
+
+      expect(ambient.mutations.map((m) => m.type)).toEqual([kind])
+      expect(visible[kind](orders)).toBe(true)
+      ambient.rollback()
+      expect(visible[kind](orders)).toBe(false)
+    })
+
+    it(`rolls back a ${kind} whose handler rejects`, async () => {
+      const handler = `on${kind[0]!.toUpperCase()}${kind.slice(1)}` as const
+      const orders = createOrders({
+        [handler]: () => Promise.reject(new Error(`handler failed`)),
+      })
+      const batches: Array<Array<string>> = []
+      orders.subscribeChanges(
+        (changes) =>
+          batches.push(changes.map((change) => `${change.type}:${change.key}`)),
+        { includeInitialState: true },
+      )
+
+      const transaction = write[kind](orders)
+
+      expect(visible[kind](orders)).toBe(true)
+      await expect(transaction.isPersisted.promise).rejects.toThrow(
+        `handler failed`,
+      )
+      expect(transaction.state).toBe(`failed`)
+      expect(visible[kind](orders)).toBe(false)
+      expect(orders.get(1)?.value ?? `a`).toBe(`a`)
+      expect(batches).toEqual(rollbackBatches[kind])
+      // Operation types without a handler still write directly.
+      const other = kind === `insert` ? `update` : `insert`
+      expect(write[other](orders).state).toBe(`completed`)
+    })
+  }
+})
+
+describe(`local-only direct writes match the confirmed optimistic path`, () => {
+  it(`for a write the schema rejects`, () => {
+    const results = []
+    for (const handlers of [{}, confirmEverything]) {
+      const orders = createCollection(
+        localOnlyCollectionOptions({
+          id: `local-only-direct-schema-${Math.random()}`,
+          getKey: (row) => row.id,
+          schema: z.object({ id: z.number(), value: z.string().min(1) }),
+          initialData: [{ id: 1, value: `a` }],
+          ...handlers,
+        }),
+      )
+      const batches: Array<number> = []
+      orders.subscribeChanges((changes) => batches.push(changes.length))
+      const errors = []
+      for (const write of [
+        () => orders.insert({ id: 2, value: `` }),
+        () =>
+          orders.update(1, (draft) => {
+            draft.value = ``
+          }),
+      ]) {
+        try {
+          write()
+        } catch (error) {
+          errors.push(`${(error as Error).name}: ${(error as Error).message}`)
+        }
+      }
+      results.push({
+        errors,
+        batches,
+        rows: orders.toArray.map(({ id, value }) => ({ id, value })),
+        remaining: orders._state.transactions.size,
+      })
+    }
+
+    expect(results[0]!.errors).toHaveLength(2)
+    expect(results[0]!.batches).toEqual([])
+    expect(results[0]).toEqual(results[1])
+  })
+})
diff --git a/packages/db/tests/local-storage-fixtures.ts b/packages/db/tests/local-storage-fixtures.ts
new file mode 100644
index 0000000000..225bd169fc
--- /dev/null
+++ b/packages/db/tests/local-storage-fixtures.ts
@@ -0,0 +1,52 @@
+// Shared fixtures for the LocalStorage write-order tests. The law and its
+// generated histories are owned by local-storage-order-oracle.test.ts.
+import { expect } from 'vitest'
+
+export type Row = { id: string; value: number }
+export const initial: Array<Row> = [
+  { id: 'a', value: 0 },
+  { id: 'b', value: 0 },
+]
+
+export function sortedRows(values: Iterable<Row>) {
+  return [...values]
+    .map(({ id, value }) => ({ id, value }))
+    .sort((a, b) => a.id.localeCompare(b.id))
+}
+
+export function storedRows(raw: string | null): Array<Row> {
+  expect(raw).not.toBeNull()
+  const records = JSON.parse(raw!) as Record<string, { data: Row }>
+  return sortedRows(Object.values(records).map(({ data }) => data))
+}
+
+export function makeStorage() {
+  const values = new Map<string, string>()
+  return {
+    getItem(key: string) {
+      return values.get(key) ?? null
+    },
+    setItem(key: string, value: string) {
+      values.set(key, value)
+    },
+    removeItem(key: string) {
+      values.delete(key)
+    },
+  }
+}
+
+export function makeSeededStorage() {
+  const storage = makeStorage()
+  storage.setItem(
+    'rows',
+    JSON.stringify(
+      Object.fromEntries(
+        initial.map((row) => [
+          `s:${row.id}`,
+          { versionKey: `initial-${row.id}`, data: row },
+        ]),
+      ),
+    ),
+  )
+  return storage
+}
diff --git a/packages/db/tests/local-storage-order-oracle.test.ts b/packages/db/tests/local-storage-order-oracle.test.ts
index 47a8fbd5d9..a6f3fdf25c 100644
--- a/packages/db/tests/local-storage-order-oracle.test.ts
+++ b/packages/db/tests/local-storage-order-oracle.test.ts
@@ -39,16 +39,18 @@ import { DbClient, collectionOptions } from '../src/client'
 import { createDeferred } from '../src/deferred'
 import { localStorageCollectionOptions } from '../src/local-storage'
 import { createTransaction } from '../src/transactions'
+import { declareOracle } from './oracle-declaration'
 import {
   observeHistoryPromise,
   withHistoryCleanup,
 } from './optimistic-history-oracle'
-
-type Row = { id: string; value: number }
-const initial: Array<Row> = [
-  { id: 'a', value: 0 },
-  { id: 'b', value: 0 },
-]
+import {
+  initial,
+  makeSeededStorage,
+  sortedRows,
+  storedRows,
+} from './local-storage-fixtures'
+import type { Row } from './local-storage-fixtures'
 
 type Edit = { id: string; value: number }
 
@@ -65,6 +67,8 @@ function expectedRows(
   return [...rows.values()].sort((a, b) => a.id.localeCompare(b.id))
 }
 
+declareOracle({ model: [expectedRows] })
+
 // The outer handler admits a nested write while it is held. The independent
 // authored fold expects the outer row before the inner row. The storage trace
 // checks that order, while the held checkpoint rules out early inner persistence.
@@ -120,49 +124,6 @@ it('persists a nested fire-and-forget mutation after its handler returns', async
   )
 })
 
-function sortedRows(values: Iterable<Row>) {
-  return [...values]
-    .map(({ id, value }) => ({ id, value }))
-    .sort((a, b) => a.id.localeCompare(b.id))
-}
-
-function storedRows(raw: string | null): Array<Row> {
-  expect(raw).not.toBeNull()
-  const records = JSON.parse(raw!) as Record<string, { data: Row }>
-  return sortedRows(Object.values(records).map(({ data }) => data))
-}
-
-function makeStorage() {
-  const values = new Map<string, string>()
-  return {
-    getItem(key: string) {
-      return values.get(key) ?? null
-    },
-    setItem(key: string, value: string) {
-      values.set(key, value)
-    },
-    removeItem(key: string) {
-      values.delete(key)
-    },
-  }
-}
-
-function makeSeededStorage() {
-  const storage = makeStorage()
-  storage.setItem(
-    'rows',
-    JSON.stringify(
-      Object.fromEntries(
-        initial.map((row) => [
-          `s:${row.id}`,
-          { versionKey: `initial-${row.id}`, data: row },
-        ]),
-      ),
-    ),
-  )
-  return storage
-}
-
 /** A DbClient descriptor materializes a fresh Collection from module-level
  * LocalStorage options. The authored order is automatic update 1, then manual
  * update 2. Calling the module-level acceptance utility must enter the actual
@@ -260,164 +221,6 @@ it('orders module-level manual acceptance with a DbClient Collection', async ()
   )
 })
 
-/** The same descriptor utility can be called for a materialized Collection
- * before an explicit preload. The mutation itself establishes its Collection
- * owner. Manual acceptance must use that owner's Storage path, and a later
- * persisted restore must see exactly the authored row. */
-it('routes module-level manual acceptance before explicit preload', async () => {
-  const storage = makeStorage()
-  const settings = localStorageCollectionOptions<Row>({
-    id: 'client-rows',
-    storageKey: 'rows',
-    storage,
-    storageEventApi: { addEventListener() {}, removeEventListener() {} },
-    getKey: (row) => row.id,
-  })
-  const client = new DbClient()
-  const collection = client.collection(collectionOptions(settings))
-  let transaction:
-    ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
-  await withHistoryCleanup(
-    async () => {
-      transaction = createTransaction<Record<string, unknown>>({
-        autoCommit: false,
-        mutationFn: async ({ transaction: pending }) => {
-          await settings.utils.acceptMutations(pending)
-        },
-      })
-      transaction.mutate(() => {
-        collection.insert({ id: 'early', value: 1 })
-      })
-      await transaction.commit()
-      expect(
-        storedRows(storage.getItem('rows')),
-        'manual durable receipt',
-      ).toEqual([{ id: 'early', value: 1 }])
-      await collection.preload()
-      expect(sortedRows(collection.values()), 'later public restore').toEqual([
-        { id: 'early', value: 1 },
-      ])
-    },
-    () => [
-      () => {
-        if (transaction) {
-          void transaction.isPersisted.promise.catch(() => undefined)
-          if (transaction.state === 'pending') transaction.rollback()
-        }
-      },
-      () => client.cleanup(),
-    ],
-  )
-})
-
-/** The module-level utility belongs to both its direct Collection and every
- * fresh Collection made by its DbClient descriptor. A direct Collection's
- * sync-run state cannot change which materialized Collection owns a manual
- * mutation. The independent model accepts the one authored row in the
- * materialized Collection for each direct-owner state. A fulfilled receipt
- * must match durable bytes, both active public snapshots, and fresh restore.
- * The cleaned-up direct owner has no public-snapshot obligation until restart. */
-for (const directState of ['idle', 'ready', 'cleaned-up'] as const) {
-  it(`routes manual acceptance to a DbClient owner with a ${directState} direct owner`, async () => {
-    const storage = makeStorage()
-    const settings = localStorageCollectionOptions<Row>({
-      id: 'shared-options',
-      storageKey: 'rows',
-      storage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-    })
-    const direct = createCollection(settings)
-    const client = new DbClient()
-    const materialized = client.collection(collectionOptions(settings))
-    let reopened: typeof materialized | undefined
-    await withHistoryCleanup(
-      async () => {
-        if (directState !== 'idle') await direct.preload()
-        if (directState === 'cleaned-up') await direct.cleanup()
-        await materialized.preload()
-        const manual = createTransaction({
-          autoCommit: false,
-          mutationFn: async ({ transaction: pending }) => {
-            await settings.utils.acceptMutations(pending)
-          },
-        })
-        manual.mutate(() => materialized.insert({ id: 'owned', value: 1 }))
-        await manual.commit()
-        await manual.isPersisted.promise
-        const expected = [{ id: 'owned', value: 1 }]
-        expect(
-          storedRows(storage.getItem('rows')),
-          'manual durable receipt',
-        ).toEqual(expected)
-        expect(
-          sortedRows(materialized.values()),
-          'materialized public receipt',
-        ).toEqual(expected)
-        if (directState === 'ready')
-          expect(sortedRows(direct.values()), 'direct peer receipt').toEqual(
-            expected,
-          )
-        reopened = createCollection(
-          localStorageCollectionOptions<Row>({
-            id: 'reopened',
-            storageKey: 'rows',
-            storage,
-            storageEventApi: {
-              addEventListener() {},
-              removeEventListener() {},
-            },
-            getKey: (row) => row.id,
-          }),
-        )
-        await reopened.preload()
-        expect(sortedRows(reopened.values()), 'fresh restore').toEqual(expected)
-      },
-      () => [
-        () => reopened?.cleanup(),
-        () => client.cleanup(),
-        () => direct.cleanup(),
-      ],
-    )
-  })
-}
-
-// Storage is synchronous. The model applies each handler-free mutation before
-// the corresponding direct Collection call returns. These return checkpoints
-// catch a regression that final persistence receipts cannot detect.
-it('persists handler-free direct mutations before their calls return', async () => {
-  const storage = makeStorage()
-  const collection = createCollection(
-    localStorageCollectionOptions<Row>({
-      storageKey: 'rows',
-      storage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-    }),
-  )
-  await withHistoryCleanup(
-    async () => {
-      await collection.preload()
-      const insert = collection.insert({ id: 'a', value: 1 })
-      expect(storedRows(storage.getItem('rows'))).toEqual([
-        { id: 'a', value: 1 },
-      ])
-      await insert.isPersisted.promise
-      const update = collection.update('a', (draft) => {
-        draft.value = 2
-      })
-      expect(storedRows(storage.getItem('rows'))).toEqual([
-        { id: 'a', value: 2 },
-      ])
-      await update.isPersisted.promise
-      const deletion = collection.delete('a')
-      expect(storedRows(storage.getItem('rows'))).toEqual([])
-      await deletion.isPersisted.promise
-    },
-    () => [() => collection.cleanup()],
-  )
-})
-
 // A synchronous handler rejection has already decided that its mutation will
 // not write. The independent authored fold therefore excludes that update and
 // includes the next handler-free insert at the insert method's return cut.
@@ -474,610 +277,6 @@ it('persists a direct write at return after a synchronous handler failure', asyn
   )
 })
 
-// The synchronous rule is conditional on the absence of a predecessor. A
-// handler-free update submitted while an insert handler is held must wait for
-// that insert's storage slot, then both accepted effects reach durable state.
-it('holds a handler-free write behind an earlier pending handler', async () => {
-  const storage = makeSeededStorage()
-  const entered = createDeferred<void>()
-  const release = createDeferred<void>()
-  const collection = createCollection(
-    localStorageCollectionOptions<Row>({
-      storageKey: 'rows',
-      storage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-      onInsert: async () => {
-        entered.resolve()
-        await release.promise
-      },
-    }),
-  )
-  await withHistoryCleanup(
-    async () => {
-      await collection.preload()
-      const first = collection.insert({ id: 'new', value: 3 })
-      await entered.promise
-      const second = collection.update('a', (draft) => {
-        draft.value = 2
-      })
-      expect(storedRows(storage.getItem('rows'))).toEqual(initial)
-      release.resolve()
-      await Promise.all([first.isPersisted.promise, second.isPersisted.promise])
-      expect(storedRows(storage.getItem('rows'))).toEqual([
-        { id: 'a', value: 2 },
-        { id: 'b', value: 0 },
-        { id: 'new', value: 3 },
-      ])
-      const afterDrain = collection.update('b', (draft) => {
-        draft.value = 4
-      })
-      expect(storedRows(storage.getItem('rows'))).toEqual([
-        { id: 'a', value: 2 },
-        { id: 'b', value: 4 },
-        { id: 'new', value: 3 },
-      ])
-      await afterDrain.isPersisted.promise
-    },
-    () => [() => release.resolve(), () => collection.cleanup()],
-  )
-})
-
-// The model folds an automatic insert decision, then a manual same-key update
-// or disjoint insert. Rejection removes only the automatic effect. The manual
-// receipt remains pending while the earlier handler is held; after both
-// decisions, storage, public rows, and fresh restore match the authored fold.
-for (const sameKey of [true, false]) {
-  for (const firstAccepted of [true, false]) {
-    it(`orders manual ${sameKey ? 'same-key update' : 'disjoint insert'} after an ${firstAccepted ? 'accepted' : 'rejected'} automatic insert`, async () => {
-      const storage = makeStorage()
-      const entered = createDeferred<void>()
-      const release = createDeferred<void>()
-      const makeCollection = (withHandler: boolean) =>
-        createCollection(
-          localStorageCollectionOptions<Row>({
-            storageKey: 'rows',
-            storage,
-            storageEventApi: {
-              addEventListener() {},
-              removeEventListener() {},
-            },
-            getKey: (row) => row.id,
-            ...(withHandler
-              ? {
-                  onInsert: async () => {
-                    entered.resolve()
-                    await release.promise
-                  },
-                }
-              : {}),
-          }),
-        )
-      const collection = makeCollection(true)
-      let reopened: ReturnType<typeof makeCollection> | undefined
-      await withHistoryCleanup(
-        async () => {
-          await collection.preload()
-          const first = collection.insert({ id: 'k', value: 1 })
-          const firstOutcome = first.isPersisted.promise.then(
-            () => true,
-            () => false,
-          )
-          await entered.promise
-          const manual = createTransaction({
-            autoCommit: false,
-            mutationFn: async ({ transaction }) => {
-              await collection.utils.acceptMutations(transaction)
-            },
-          })
-          manual.mutate(() => {
-            if (sameKey) {
-              collection.update('k', (draft) => {
-                draft.value = 2
-              })
-            } else {
-              collection.insert({ id: 'other', value: 2 })
-            }
-          })
-          let manualSettled = false
-          const manualReceipt = manual.commit().then(() => {
-            manualSettled = true
-          })
-          await new Promise((resolve) => setTimeout(resolve, 0))
-          expect(
-            manualSettled,
-            'manual acceptance waits for its predecessor',
-          ).toBe(false)
-          expect(storage.getItem('rows')).toBeNull()
-          if (firstAccepted) release.resolve()
-          else release.reject(new Error('automatic insert rejected'))
-          const [actualFirst] = await Promise.all([firstOutcome, manualReceipt])
-          expect(actualFirst).toBe(firstAccepted)
-          const expected = sameKey
-            ? [{ id: 'k', value: 2 }]
-            : [
-                ...(firstAccepted ? [{ id: 'k', value: 1 }] : []),
-                { id: 'other', value: 2 },
-              ].sort((a, b) => a.id.localeCompare(b.id))
-          expect(storedRows(storage.getItem('rows'))).toEqual(expected)
-          expect(sortedRows(collection.values())).toEqual(expected)
-          reopened = makeCollection(false)
-          await reopened.preload()
-          expect(sortedRows(reopened.values())).toEqual(expected)
-        },
-        () => [
-          () => release.resolve(),
-          () => reopened?.cleanup(),
-          () => collection.cleanup(),
-        ],
-      )
-    })
-  }
-}
-
-// A manual transaction's persistence receipt represents its Storage write,
-// even when mutationFn does not await the utility's Promise. The authored
-// model includes the manual row only after its successful storage acceptance.
-// This finite grammar varies an earlier held automatic write and a manual
-// Storage fault. The driver enters through createTransaction and the public
-// utility. At the held cut neither receipt may settle; at the final cut both
-// receipts, durable rows, and the public snapshot must match the decision.
-for (const queued of [false, true]) {
-  for (const storageFails of [false, true]) {
-    it(`settles un-awaited manual acceptance after its ${queued ? 'queued' : 'direct'} ${storageFails ? 'failed' : 'successful'} storage write`, async () => {
-      const storage = makeStorage()
-      const storageError = new Error('manual storage fault')
-      const setItem = storage.setItem
-      storage.setItem = (key, value) => {
-        if (storageFails && value.includes('s:manual')) throw storageError
-        setItem(key, value)
-      }
-      const entered = createDeferred<void>()
-      const release = createDeferred<void>()
-      const accepted = createDeferred<void>()
-      const collection = createCollection(
-        localStorageCollectionOptions<Row>({
-          storageKey: 'rows',
-          storage,
-          storageEventApi: { addEventListener() {}, removeEventListener() {} },
-          getKey: (row) => row.id,
-          onInsert: async ({ transaction }) => {
-            if (transaction.mutations[0].modified.id === 'first') {
-              entered.resolve()
-              await release.promise
-            }
-          },
-        }),
-      )
-      let manual:
-        | ReturnType<typeof createTransaction<Record<string, unknown>>>
-        | undefined
-      await withHistoryCleanup(
-        async () => {
-          await collection.preload()
-          const first = queued
-            ? collection.insert({ id: 'first', value: 1 })
-            : undefined
-          if (queued) await entered.promise
-          manual = createTransaction<Record<string, unknown>>({
-            autoCommit: false,
-            mutationFn: ({ transaction }) => {
-              // The application deliberately omits await and return. A
-              // rejection observer prevents the test runner from replacing
-              // the receipt assertion with an unhandled-rejection failure.
-              void collection.utils.acceptMutations(transaction).catch(() => {})
-              accepted.resolve()
-              return Promise.resolve()
-            },
-          })
-          manual.mutate(() => collection.insert({ id: 'manual', value: 2 }))
-          const commit = observeHistoryPromise(manual.commit())
-          const receipt = observeHistoryPromise(manual.isPersisted.promise)
-          await accepted.promise
-          if (queued) {
-            await new Promise((resolve) => setTimeout(resolve, 0))
-            expect(commit.read().status, 'held commit').toBe('pending')
-            expect(receipt.read().status, 'held persistence receipt').toBe(
-              'pending',
-            )
-            expect(storage.getItem('rows')).toBeNull()
-            release.resolve()
-            await first!.isPersisted.promise
-          }
-          await Promise.all([commit.settled, receipt.settled])
-          if (storageFails) {
-            expect(commit.read()).toMatchObject({
-              status: 'rejected',
-              reason: storageError,
-            })
-            expect(receipt.read()).toMatchObject({
-              status: 'rejected',
-              reason: storageError,
-            })
-          } else {
-            expect(commit.read().status).toBe('fulfilled')
-            expect(receipt.read().status).toBe('fulfilled')
-          }
-          const expected = [
-            ...(queued ? [{ id: 'first', value: 1 }] : []),
-            ...(!storageFails ? [{ id: 'manual', value: 2 }] : []),
-          ]
-          if (expected.length)
-            expect(storedRows(storage.getItem('rows'))).toEqual(expected)
-          else expect(storage.getItem('rows')).toBeNull()
-          expect(sortedRows(collection.values())).toEqual(expected)
-        },
-        () => [() => release.resolve(), () => collection.cleanup()],
-      )
-    })
-  }
-}
-
-// A mutationFn may accept local work and then fail for another reason. The
-// accepted write remains authorized, but the transaction cannot report its
-// failure before that registered work settles. The independent fold contains
-// both accepted rows after the held predecessor is released. The held cut
-// checks commit and persistence receipts; the final cut checks durable data.
-it('waits for queued acceptance before reporting a later mutationFn failure', async () => {
-  const storage = makeStorage()
-  const entered = createDeferred<void>()
-  const release = createDeferred<void>()
-  const accepted = createDeferred<void>()
-  const failure = new Error('API failed after accepting local write')
-  const collection = createCollection(
-    localStorageCollectionOptions<Row>({
-      storageKey: 'rows',
-      storage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-      onInsert: async ({ transaction }) => {
-        if (transaction.mutations[0].modified.id === 'first') {
-          entered.resolve()
-          await release.promise
-        }
-      },
-    }),
-  )
-  let reopened: typeof collection | undefined
-  await withHistoryCleanup(
-    async () => {
-      await collection.preload()
-      const first = collection.insert({ id: 'first', value: 1 })
-      await entered.promise
-      const manual = createTransaction<Record<string, unknown>>({
-        autoCommit: false,
-        mutationFn: ({ transaction }) => {
-          void collection.utils.acceptMutations(transaction).catch(() => {})
-          accepted.resolve()
-          throw failure
-        },
-      })
-      manual.mutate(() => collection.insert({ id: 'manual', value: 2 }))
-      const commit = observeHistoryPromise(manual.commit())
-      const receipt = observeHistoryPromise(manual.isPersisted.promise)
-      await accepted.promise
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      expect(commit.read().status, 'held commit').toBe('pending')
-      expect(receipt.read().status, 'held persistence receipt').toBe('pending')
-      release.resolve()
-      await first.isPersisted.promise
-      await Promise.all([commit.settled, receipt.settled])
-      expect(commit.read()).toMatchObject({
-        status: 'rejected',
-        reason: failure,
-      })
-      expect(receipt.read()).toMatchObject({
-        status: 'rejected',
-        reason: failure,
-      })
-      const expected = [
-        { id: 'first', value: 1 },
-        { id: 'manual', value: 2 },
-      ]
-      expect(
-        storedRows(storage.getItem('rows')),
-        'durable at rejected receipt',
-      ).toEqual(expected)
-      expect(
-        sortedRows(collection.values()),
-        'public at rejected receipt',
-      ).toEqual(expected)
-      reopened = createCollection(
-        localStorageCollectionOptions<Row>({
-          id: 'reopened',
-          storageKey: 'rows',
-          storage,
-          storageEventApi: { addEventListener() {}, removeEventListener() {} },
-          getKey: (row) => row.id,
-        }),
-      )
-      await reopened.preload()
-      expect(sortedRows(reopened.values()), 'fresh restore').toEqual(expected)
-    },
-    () => [
-      () => release.resolve(),
-      () => reopened?.cleanup(),
-      () => collection.cleanup(),
-    ],
-  )
-})
-
-// One manual transaction can accept rows from more than one Collection. Its
-// receipt represents every accepted storage write, not merely the first work
-// registered. The model allows the independent direct write now, but keeps
-// transaction settlement behind the other Collection's held predecessor.
-it('waits for every un-awaited manual acceptance in one transaction', async () => {
-  const slowStorage = makeStorage()
-  const fastStorage = makeStorage()
-  const entered = createDeferred<void>()
-  const release = createDeferred<void>()
-  const slow = createCollection(
-    localStorageCollectionOptions<Row>({
-      id: 'slow',
-      storageKey: 'slow-rows',
-      storage: slowStorage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-      onInsert: async ({ transaction }) => {
-        if (transaction.mutations[0].modified.id === 'first') {
-          entered.resolve()
-          await release.promise
-        }
-      },
-    }),
-  )
-  const fast = createCollection(
-    localStorageCollectionOptions<Row>({
-      id: 'fast',
-      storageKey: 'fast-rows',
-      storage: fastStorage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-    }),
-  )
-  await withHistoryCleanup(
-    async () => {
-      await Promise.all([slow.preload(), fast.preload()])
-      const first = slow.insert({ id: 'first', value: 1 })
-      await entered.promise
-      const manual = createTransaction({
-        autoCommit: false,
-        mutationFn: ({ transaction }) => {
-          void slow.utils.acceptMutations(transaction).catch(() => {})
-          void fast.utils.acceptMutations(transaction).catch(() => {})
-          return Promise.resolve()
-        },
-      })
-      manual.mutate(() => {
-        slow.insert({ id: 'slow-manual', value: 2 })
-        fast.insert({ id: 'fast-manual', value: 3 })
-      })
-      const receipt = observeHistoryPromise(manual.isPersisted.promise)
-      const commit = observeHistoryPromise(manual.commit())
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      expect(storedRows(fastStorage.getItem('fast-rows'))).toEqual([
-        { id: 'fast-manual', value: 3 },
-      ])
-      expect(slowStorage.getItem('slow-rows')).toBeNull()
-      expect(receipt.read().status).toBe('pending')
-      expect(commit.read().status).toBe('pending')
-      release.resolve()
-      await Promise.all([
-        first.isPersisted.promise,
-        receipt.settled,
-        commit.settled,
-      ])
-      expect(receipt.read().status).toBe('fulfilled')
-      expect(commit.read().status).toBe('fulfilled')
-      expect(storedRows(slowStorage.getItem('slow-rows'))).toEqual([
-        { id: 'first', value: 1 },
-        { id: 'slow-manual', value: 2 },
-      ])
-      expect(sortedRows(slow.values())).toEqual(
-        storedRows(slowStorage.getItem('slow-rows')),
-      )
-      expect(sortedRows(fast.values())).toEqual(
-        storedRows(fastStorage.getItem('fast-rows')),
-      )
-    },
-    () => [() => release.resolve(), () => fast.cleanup(), () => slow.cleanup()],
-  )
-})
-
-// The Promise-returning manual API has one error channel. The finite grammar
-// varies whether an earlier automatic write reserves a slot. A storage fault
-// on the manual row must reject the returned Promise with the same error at
-// the direct-call or predecessor-release checkpoint, without publishing it.
-for (const queued of [false, true]) {
-  it(`returns a rejected manual acceptance Promise after a ${queued ? 'queued' : 'direct'} storage fault`, async () => {
-    const storage = makeStorage()
-    const savedSetItem = storage.setItem
-    const storageError = new Error('manual storage fault')
-    storage.setItem = (key, value) => {
-      if (value.includes('s:manual')) throw storageError
-      savedSetItem(key, value)
-    }
-    const entered = createDeferred<void>()
-    const release = createDeferred<void>()
-    const collection = createCollection(
-      localStorageCollectionOptions<Row>({
-        storageKey: 'rows',
-        storage,
-        storageEventApi: { addEventListener() {}, removeEventListener() {} },
-        getKey: (row) => row.id,
-        onInsert: async ({ transaction }) => {
-          if (transaction.mutations[0].modified.id === 'first') {
-            entered.resolve()
-            await release.promise
-          }
-        },
-      }),
-    )
-    let manual:
-      ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
-    await withHistoryCleanup(
-      async () => {
-        await collection.preload()
-        const first = queued
-          ? collection.insert({ id: 'first', value: 1 })
-          : undefined
-        if (queued) await entered.promise
-        manual = createTransaction<Record<string, unknown>>({
-          autoCommit: false,
-          mutationFn: async () => {},
-        })
-        manual.mutate(() => collection.insert({ id: 'manual', value: 2 }))
-        let receipt: Promise<void> | undefined
-        expect(() => {
-          receipt = collection.utils.acceptMutations(manual!)
-        }).not.toThrow()
-        expect(receipt).toBeInstanceOf(Promise)
-        if (queued) {
-          expect(storage.getItem('rows')).toBeNull()
-          release.resolve()
-          await first!.isPersisted.promise
-        }
-        await expect(receipt).rejects.toBe(storageError)
-        if (queued)
-          expect(storedRows(storage.getItem('rows'))).toEqual([
-            { id: 'first', value: 1 },
-          ])
-        else expect(storage.getItem('rows')).toBeNull()
-      },
-      () => [
-        () => release.resolve(),
-        () => {
-          if (manual) {
-            void manual.isPersisted.promise.catch(() => undefined)
-            manual.rollback()
-          }
-        },
-        () => collection.cleanup(),
-      ],
-    )
-  })
-}
-
-// Validation runs before a write reserves its slot. It still belongs to the
-// Promise-returning manual API: the caller observes rejection through that
-// Promise, and no durable row is published.
-it('returns a rejected manual acceptance Promise for invalid serialized data', async () => {
-  const storage = makeStorage()
-  const collection = createCollection(
-    localStorageCollectionOptions<Row>({
-      storageKey: 'rows',
-      storage,
-      storageEventApi: { addEventListener() {}, removeEventListener() {} },
-      getKey: (row) => row.id,
-      parser: {
-        parse: JSON.parse,
-        stringify: (value) => {
-          if (
-            typeof value === 'object' &&
-            value !== null &&
-            'id' in value &&
-            value.id === 'bad'
-          )
-            throw new Error('unserializable row')
-          return JSON.stringify(value)
-        },
-      },
-    }),
-  )
-  let manual:
-    ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
-  await withHistoryCleanup(
-    async () => {
-      await collection.preload()
-      manual = createTransaction<Record<string, unknown>>({
-        autoCommit: false,
-        mutationFn: async () => {},
-      })
-      manual.mutate(() => collection.insert({ id: 'bad', value: 1 }))
-      let receipt: Promise<void> | undefined
-      expect(() => {
-        receipt = collection.utils.acceptMutations(manual!)
-      }).not.toThrow()
-      await expect(receipt).rejects.toThrow('unserializable row')
-      expect(storage.getItem('rows')).toBeNull()
-    },
-    () => [
-      () => {
-        if (manual) {
-          void manual.isPersisted.promise.catch(() => undefined)
-          manual.rollback()
-        }
-      },
-      () => collection.cleanup(),
-    ],
-  )
-})
-
-// Handler rejection contributes no durable effect and releases its optimistic
-// row at its own decision checkpoint for same and disjoint keys. The earlier
-// held handler still owns the next storage slot, not the later failure receipt.
-for (const secondId of ['a', 'b']) {
-  it(`rejects a later failed ${secondId === 'a' ? 'same-key' : 'disjoint-key'} handler while an earlier handler is held`, async () => {
-    const storage = makeSeededStorage()
-    const firstEntered = createDeferred<void>()
-    const releaseFirst = createDeferred<void>()
-    const secondFailed = createDeferred<void>()
-    const collection = createCollection(
-      localStorageCollectionOptions<Row>({
-        storageKey: 'rows',
-        storage,
-        storageEventApi: { addEventListener() {}, removeEventListener() {} },
-        getKey: (row) => row.id,
-        onUpdate: async ({ transaction }) => {
-          if (transaction.mutations[0].modified.value === 1) {
-            firstEntered.resolve()
-            await releaseFirst.promise
-          } else {
-            secondFailed.resolve()
-            throw new Error('rejected second update')
-          }
-        },
-      }),
-    )
-    await withHistoryCleanup(
-      async () => {
-        await collection.preload()
-        const first = collection.update('a', (draft) => {
-          draft.value = 1
-        })
-        await firstEntered.promise
-        const second = collection.update(secondId, (draft) => {
-          draft.value = 2
-        })
-        const rejected = second.isPersisted.promise.then(
-          () => false,
-          () => true,
-        )
-        let settled = false
-        void rejected.then(() => {
-          settled = true
-        })
-        await secondFailed.promise
-        await new Promise((resolve) => setTimeout(resolve, 0))
-        expect(settled, 'the failed handler owns its receipt').toBe(true)
-        expect(await rejected).toBe(true)
-        expect(sortedRows(collection.values())).toEqual([
-          { id: 'a', value: 1 },
-          { id: 'b', value: 0 },
-        ])
-        expect(storedRows(storage.getItem('rows'))).toEqual(initial)
-        releaseFirst.resolve()
-        await first.isPersisted.promise
-        expect(storedRows(storage.getItem('rows'))).toEqual([
-          { id: 'a', value: 1 },
-          { id: 'b', value: 0 },
-        ])
-      },
-      () => [() => releaseFirst.resolve(), () => collection.cleanup()],
-    )
-  })
-}
-
 // This finite grammar covers same-key and disjoint-key updates and both handler
 // completion orders and all decision pairs. It excludes peer writes and
 // manual transactions; those require different event and ownership boundaries.
diff --git a/packages/db/tests/local-storage-order.test.ts b/packages/db/tests/local-storage-order.test.ts
new file mode 100644
index 0000000000..a61d333838
--- /dev/null
+++ b/packages/db/tests/local-storage-order.test.ts
@@ -0,0 +1,806 @@
+// Ordinary regression tests for LocalStorage write order. Each test runs one
+// fixed scenario and compares with hand-written rows. The law that orders
+// automatic and manual writes, and its generated histories, are owned by
+// local-storage-order-oracle.test.ts.
+import { expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index'
+import { DbClient, collectionOptions } from '../src/client'
+import { createDeferred } from '../src/deferred'
+import { localStorageCollectionOptions } from '../src/local-storage'
+import { createTransaction } from '../src/transactions'
+import {
+  observeHistoryPromise,
+  withHistoryCleanup,
+} from './optimistic-history-oracle'
+import {
+  initial,
+  makeSeededStorage,
+  makeStorage,
+  sortedRows,
+  storedRows,
+} from './local-storage-fixtures'
+import type { Row } from './local-storage-fixtures'
+
+/** The same descriptor utility can be called for a materialized Collection
+ * before an explicit preload. The mutation itself establishes its Collection
+ * owner. Manual acceptance must use that owner's Storage path, and a later
+ * persisted restore must see exactly the authored row. */
+it('routes module-level manual acceptance before explicit preload', async () => {
+  const storage = makeStorage()
+  const settings = localStorageCollectionOptions<Row>({
+    id: 'client-rows',
+    storageKey: 'rows',
+    storage,
+    storageEventApi: { addEventListener() {}, removeEventListener() {} },
+    getKey: (row) => row.id,
+  })
+  const client = new DbClient()
+  const collection = client.collection(collectionOptions(settings))
+  let transaction:
+    ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
+  await withHistoryCleanup(
+    async () => {
+      transaction = createTransaction<Record<string, unknown>>({
+        autoCommit: false,
+        mutationFn: async ({ transaction: pending }) => {
+          await settings.utils.acceptMutations(pending)
+        },
+      })
+      transaction.mutate(() => {
+        collection.insert({ id: 'early', value: 1 })
+      })
+      await transaction.commit()
+      expect(
+        storedRows(storage.getItem('rows')),
+        'manual durable receipt',
+      ).toEqual([{ id: 'early', value: 1 }])
+      await collection.preload()
+      expect(sortedRows(collection.values()), 'later public restore').toEqual([
+        { id: 'early', value: 1 },
+      ])
+    },
+    () => [
+      () => {
+        if (transaction) {
+          void transaction.isPersisted.promise.catch(() => undefined)
+          if (transaction.state === 'pending') transaction.rollback()
+        }
+      },
+      () => client.cleanup(),
+    ],
+  )
+})
+
+/** The module-level utility belongs to both its direct Collection and every
+ * fresh Collection made by its DbClient descriptor. A direct Collection's
+ * sync-run state cannot change which materialized Collection owns a manual
+ * mutation. The independent model accepts the one authored row in the
+ * materialized Collection for each direct-owner state. A fulfilled receipt
+ * must match durable bytes, both active public snapshots, and fresh restore.
+ * The cleaned-up direct owner has no public-snapshot obligation until restart. */
+for (const directState of ['idle', 'ready', 'cleaned-up'] as const) {
+  it(`routes manual acceptance to a DbClient owner with a ${directState} direct owner`, async () => {
+    const storage = makeStorage()
+    const settings = localStorageCollectionOptions<Row>({
+      id: 'shared-options',
+      storageKey: 'rows',
+      storage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+    })
+    const direct = createCollection(settings)
+    const client = new DbClient()
+    const materialized = client.collection(collectionOptions(settings))
+    let reopened: typeof materialized | undefined
+    await withHistoryCleanup(
+      async () => {
+        if (directState !== 'idle') await direct.preload()
+        if (directState === 'cleaned-up') await direct.cleanup()
+        await materialized.preload()
+        const manual = createTransaction({
+          autoCommit: false,
+          mutationFn: async ({ transaction: pending }) => {
+            await settings.utils.acceptMutations(pending)
+          },
+        })
+        manual.mutate(() => materialized.insert({ id: 'owned', value: 1 }))
+        await manual.commit()
+        await manual.isPersisted.promise
+        const expected = [{ id: 'owned', value: 1 }]
+        expect(
+          storedRows(storage.getItem('rows')),
+          'manual durable receipt',
+        ).toEqual(expected)
+        expect(
+          sortedRows(materialized.values()),
+          'materialized public receipt',
+        ).toEqual(expected)
+        if (directState === 'ready')
+          expect(sortedRows(direct.values()), 'direct peer receipt').toEqual(
+            expected,
+          )
+        reopened = createCollection(
+          localStorageCollectionOptions<Row>({
+            id: 'reopened',
+            storageKey: 'rows',
+            storage,
+            storageEventApi: {
+              addEventListener() {},
+              removeEventListener() {},
+            },
+            getKey: (row) => row.id,
+          }),
+        )
+        await reopened.preload()
+        expect(sortedRows(reopened.values()), 'fresh restore').toEqual(expected)
+      },
+      () => [
+        () => reopened?.cleanup(),
+        () => client.cleanup(),
+        () => direct.cleanup(),
+      ],
+    )
+  })
+}
+
+// Storage is synchronous. The model applies each handler-free mutation before
+// the corresponding direct Collection call returns. These return checkpoints
+// catch a regression that final persistence receipts cannot detect.
+it('persists handler-free direct mutations before their calls return', async () => {
+  const storage = makeStorage()
+  const collection = createCollection(
+    localStorageCollectionOptions<Row>({
+      storageKey: 'rows',
+      storage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+    }),
+  )
+  await withHistoryCleanup(
+    async () => {
+      await collection.preload()
+      const insert = collection.insert({ id: 'a', value: 1 })
+      expect(storedRows(storage.getItem('rows'))).toEqual([
+        { id: 'a', value: 1 },
+      ])
+      await insert.isPersisted.promise
+      const update = collection.update('a', (draft) => {
+        draft.value = 2
+      })
+      expect(storedRows(storage.getItem('rows'))).toEqual([
+        { id: 'a', value: 2 },
+      ])
+      await update.isPersisted.promise
+      const deletion = collection.delete('a')
+      expect(storedRows(storage.getItem('rows'))).toEqual([])
+      await deletion.isPersisted.promise
+    },
+    () => [() => collection.cleanup()],
+  )
+})
+
+// The synchronous rule is conditional on the absence of a predecessor. A
+// handler-free update submitted while an insert handler is held must wait for
+// that insert's storage slot, then both accepted effects reach durable state.
+it('holds a handler-free write behind an earlier pending handler', async () => {
+  const storage = makeSeededStorage()
+  const entered = createDeferred<void>()
+  const release = createDeferred<void>()
+  const collection = createCollection(
+    localStorageCollectionOptions<Row>({
+      storageKey: 'rows',
+      storage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+      onInsert: async () => {
+        entered.resolve()
+        await release.promise
+      },
+    }),
+  )
+  await withHistoryCleanup(
+    async () => {
+      await collection.preload()
+      const first = collection.insert({ id: 'new', value: 3 })
+      await entered.promise
+      const second = collection.update('a', (draft) => {
+        draft.value = 2
+      })
+      expect(storedRows(storage.getItem('rows'))).toEqual(initial)
+      release.resolve()
+      await Promise.all([first.isPersisted.promise, second.isPersisted.promise])
+      expect(storedRows(storage.getItem('rows'))).toEqual([
+        { id: 'a', value: 2 },
+        { id: 'b', value: 0 },
+        { id: 'new', value: 3 },
+      ])
+      const afterDrain = collection.update('b', (draft) => {
+        draft.value = 4
+      })
+      expect(storedRows(storage.getItem('rows'))).toEqual([
+        { id: 'a', value: 2 },
+        { id: 'b', value: 4 },
+        { id: 'new', value: 3 },
+      ])
+      await afterDrain.isPersisted.promise
+    },
+    () => [() => release.resolve(), () => collection.cleanup()],
+  )
+})
+
+// A mutationFn may accept local work and then fail for another reason. The
+// accepted write remains authorized, but the transaction cannot report its
+// failure before that registered work settles. The independent fold contains
+// both accepted rows after the held predecessor is released. The held cut
+// checks commit and persistence receipts; the final cut checks durable data.
+it('waits for queued acceptance before reporting a later mutationFn failure', async () => {
+  const storage = makeStorage()
+  const entered = createDeferred<void>()
+  const release = createDeferred<void>()
+  const accepted = createDeferred<void>()
+  const failure = new Error('API failed after accepting local write')
+  const collection = createCollection(
+    localStorageCollectionOptions<Row>({
+      storageKey: 'rows',
+      storage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+      onInsert: async ({ transaction }) => {
+        if (transaction.mutations[0].modified.id === 'first') {
+          entered.resolve()
+          await release.promise
+        }
+      },
+    }),
+  )
+  let reopened: typeof collection | undefined
+  await withHistoryCleanup(
+    async () => {
+      await collection.preload()
+      const first = collection.insert({ id: 'first', value: 1 })
+      await entered.promise
+      const manual = createTransaction<Record<string, unknown>>({
+        autoCommit: false,
+        mutationFn: ({ transaction }) => {
+          void collection.utils.acceptMutations(transaction).catch(() => {})
+          accepted.resolve()
+          throw failure
+        },
+      })
+      manual.mutate(() => collection.insert({ id: 'manual', value: 2 }))
+      const commit = observeHistoryPromise(manual.commit())
+      const receipt = observeHistoryPromise(manual.isPersisted.promise)
+      await accepted.promise
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(commit.read().status, 'held commit').toBe('pending')
+      expect(receipt.read().status, 'held persistence receipt').toBe('pending')
+      release.resolve()
+      await first.isPersisted.promise
+      await Promise.all([commit.settled, receipt.settled])
+      expect(commit.read()).toMatchObject({
+        status: 'rejected',
+        reason: failure,
+      })
+      expect(receipt.read()).toMatchObject({
+        status: 'rejected',
+        reason: failure,
+      })
+      const expected = [
+        { id: 'first', value: 1 },
+        { id: 'manual', value: 2 },
+      ]
+      expect(
+        storedRows(storage.getItem('rows')),
+        'durable at rejected receipt',
+      ).toEqual(expected)
+      expect(
+        sortedRows(collection.values()),
+        'public at rejected receipt',
+      ).toEqual(expected)
+      reopened = createCollection(
+        localStorageCollectionOptions<Row>({
+          id: 'reopened',
+          storageKey: 'rows',
+          storage,
+          storageEventApi: { addEventListener() {}, removeEventListener() {} },
+          getKey: (row) => row.id,
+        }),
+      )
+      await reopened.preload()
+      expect(sortedRows(reopened.values()), 'fresh restore').toEqual(expected)
+    },
+    () => [
+      () => release.resolve(),
+      () => reopened?.cleanup(),
+      () => collection.cleanup(),
+    ],
+  )
+})
+
+// One manual transaction can accept rows from more than one Collection. Its
+// receipt represents every accepted storage write, not merely the first work
+// registered. The model allows the independent direct write now, but keeps
+// transaction settlement behind the other Collection's held predecessor.
+it('waits for every un-awaited manual acceptance in one transaction', async () => {
+  const slowStorage = makeStorage()
+  const fastStorage = makeStorage()
+  const entered = createDeferred<void>()
+  const release = createDeferred<void>()
+  const slow = createCollection(
+    localStorageCollectionOptions<Row>({
+      id: 'slow',
+      storageKey: 'slow-rows',
+      storage: slowStorage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+      onInsert: async ({ transaction }) => {
+        if (transaction.mutations[0].modified.id === 'first') {
+          entered.resolve()
+          await release.promise
+        }
+      },
+    }),
+  )
+  const fast = createCollection(
+    localStorageCollectionOptions<Row>({
+      id: 'fast',
+      storageKey: 'fast-rows',
+      storage: fastStorage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+    }),
+  )
+  await withHistoryCleanup(
+    async () => {
+      await Promise.all([slow.preload(), fast.preload()])
+      const first = slow.insert({ id: 'first', value: 1 })
+      await entered.promise
+      const manual = createTransaction({
+        autoCommit: false,
+        mutationFn: ({ transaction }) => {
+          void slow.utils.acceptMutations(transaction).catch(() => {})
+          void fast.utils.acceptMutations(transaction).catch(() => {})
+          return Promise.resolve()
+        },
+      })
+      manual.mutate(() => {
+        slow.insert({ id: 'slow-manual', value: 2 })
+        fast.insert({ id: 'fast-manual', value: 3 })
+      })
+      const receipt = observeHistoryPromise(manual.isPersisted.promise)
+      const commit = observeHistoryPromise(manual.commit())
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(storedRows(fastStorage.getItem('fast-rows'))).toEqual([
+        { id: 'fast-manual', value: 3 },
+      ])
+      expect(slowStorage.getItem('slow-rows')).toBeNull()
+      expect(receipt.read().status).toBe('pending')
+      expect(commit.read().status).toBe('pending')
+      release.resolve()
+      await Promise.all([
+        first.isPersisted.promise,
+        receipt.settled,
+        commit.settled,
+      ])
+      expect(receipt.read().status).toBe('fulfilled')
+      expect(commit.read().status).toBe('fulfilled')
+      expect(storedRows(slowStorage.getItem('slow-rows'))).toEqual([
+        { id: 'first', value: 1 },
+        { id: 'slow-manual', value: 2 },
+      ])
+      expect(sortedRows(slow.values())).toEqual(
+        storedRows(slowStorage.getItem('slow-rows')),
+      )
+      expect(sortedRows(fast.values())).toEqual(
+        storedRows(fastStorage.getItem('fast-rows')),
+      )
+    },
+    () => [() => release.resolve(), () => fast.cleanup(), () => slow.cleanup()],
+  )
+})
+
+// The Promise-returning manual API has one error channel. The finite grammar
+// varies whether an earlier automatic write reserves a slot. A storage fault
+// on the manual row must reject the returned Promise with the same error at
+// the direct-call or predecessor-release checkpoint, without publishing it.
+for (const queued of [false, true]) {
+  it(`returns a rejected manual acceptance Promise after a ${queued ? 'queued' : 'direct'} storage fault`, async () => {
+    const storage = makeStorage()
+    const savedSetItem = storage.setItem
+    const storageError = new Error('manual storage fault')
+    storage.setItem = (key, value) => {
+      if (value.includes('s:manual')) throw storageError
+      savedSetItem(key, value)
+    }
+    const entered = createDeferred<void>()
+    const release = createDeferred<void>()
+    const collection = createCollection(
+      localStorageCollectionOptions<Row>({
+        storageKey: 'rows',
+        storage,
+        storageEventApi: { addEventListener() {}, removeEventListener() {} },
+        getKey: (row) => row.id,
+        onInsert: async ({ transaction }) => {
+          if (transaction.mutations[0].modified.id === 'first') {
+            entered.resolve()
+            await release.promise
+          }
+        },
+      }),
+    )
+    let manual:
+      ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
+    await withHistoryCleanup(
+      async () => {
+        await collection.preload()
+        const first = queued
+          ? collection.insert({ id: 'first', value: 1 })
+          : undefined
+        if (queued) await entered.promise
+        manual = createTransaction<Record<string, unknown>>({
+          autoCommit: false,
+          mutationFn: async () => {},
+        })
+        manual.mutate(() => collection.insert({ id: 'manual', value: 2 }))
+        let receipt: Promise<void> | undefined
+        expect(() => {
+          receipt = collection.utils.acceptMutations(manual!)
+        }).not.toThrow()
+        expect(receipt).toBeInstanceOf(Promise)
+        if (queued) {
+          expect(storage.getItem('rows')).toBeNull()
+          release.resolve()
+          await first!.isPersisted.promise
+        }
+        await expect(receipt).rejects.toBe(storageError)
+        if (queued)
+          expect(storedRows(storage.getItem('rows'))).toEqual([
+            { id: 'first', value: 1 },
+          ])
+        else expect(storage.getItem('rows')).toBeNull()
+      },
+      () => [
+        () => release.resolve(),
+        () => {
+          if (manual) {
+            void manual.isPersisted.promise.catch(() => undefined)
+            manual.rollback()
+          }
+        },
+        () => collection.cleanup(),
+      ],
+    )
+  })
+}
+
+// Validation runs before a write reserves its slot. It still belongs to the
+// Promise-returning manual API: the caller observes rejection through that
+// Promise, and no durable row is published.
+it('returns a rejected manual acceptance Promise for invalid serialized data', async () => {
+  const storage = makeStorage()
+  const collection = createCollection(
+    localStorageCollectionOptions<Row>({
+      storageKey: 'rows',
+      storage,
+      storageEventApi: { addEventListener() {}, removeEventListener() {} },
+      getKey: (row) => row.id,
+      parser: {
+        parse: JSON.parse,
+        stringify: (value) => {
+          if (
+            typeof value === 'object' &&
+            value !== null &&
+            'id' in value &&
+            value.id === 'bad'
+          )
+            throw new Error('unserializable row')
+          return JSON.stringify(value)
+        },
+      },
+    }),
+  )
+  let manual:
+    ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
+  await withHistoryCleanup(
+    async () => {
+      await collection.preload()
+      manual = createTransaction<Record<string, unknown>>({
+        autoCommit: false,
+        mutationFn: async () => {},
+      })
+      manual.mutate(() => collection.insert({ id: 'bad', value: 1 }))
+      let receipt: Promise<void> | undefined
+      expect(() => {
+        receipt = collection.utils.acceptMutations(manual!)
+      }).not.toThrow()
+      await expect(receipt).rejects.toThrow('unserializable row')
+      expect(storage.getItem('rows')).toBeNull()
+    },
+    () => [
+      () => {
+        if (manual) {
+          void manual.isPersisted.promise.catch(() => undefined)
+          manual.rollback()
+        }
+      },
+      () => collection.cleanup(),
+    ],
+  )
+})
+
+// Handler rejection contributes no durable effect and releases its optimistic
+// row at its own decision checkpoint for same and disjoint keys. The earlier
+// held handler still owns the next storage slot, not the later failure receipt.
+for (const secondId of ['a', 'b']) {
+  it(`rejects a later failed ${secondId === 'a' ? 'same-key' : 'disjoint-key'} handler while an earlier handler is held`, async () => {
+    const storage = makeSeededStorage()
+    const firstEntered = createDeferred<void>()
+    const releaseFirst = createDeferred<void>()
+    const secondFailed = createDeferred<void>()
+    const collection = createCollection(
+      localStorageCollectionOptions<Row>({
+        storageKey: 'rows',
+        storage,
+        storageEventApi: { addEventListener() {}, removeEventListener() {} },
+        getKey: (row) => row.id,
+        onUpdate: async ({ transaction }) => {
+          if (transaction.mutations[0].modified.value === 1) {
+            firstEntered.resolve()
+            await releaseFirst.promise
+          } else {
+            secondFailed.resolve()
+            throw new Error('rejected second update')
+          }
+        },
+      }),
+    )
+    await withHistoryCleanup(
+      async () => {
+        await collection.preload()
+        const first = collection.update('a', (draft) => {
+          draft.value = 1
+        })
+        await firstEntered.promise
+        const second = collection.update(secondId, (draft) => {
+          draft.value = 2
+        })
+        const rejected = second.isPersisted.promise.then(
+          () => false,
+          () => true,
+        )
+        let settled = false
+        void rejected.then(() => {
+          settled = true
+        })
+        await secondFailed.promise
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        expect(settled, 'the failed handler owns its receipt').toBe(true)
+        expect(await rejected).toBe(true)
+        expect(sortedRows(collection.values())).toEqual([
+          { id: 'a', value: 1 },
+          { id: 'b', value: 0 },
+        ])
+        expect(storedRows(storage.getItem('rows'))).toEqual(initial)
+        releaseFirst.resolve()
+        await first.isPersisted.promise
+        expect(storedRows(storage.getItem('rows'))).toEqual([
+          { id: 'a', value: 1 },
+          { id: 'b', value: 0 },
+        ])
+      },
+      () => [() => releaseFirst.resolve(), () => collection.cleanup()],
+    )
+  })
+}
+
+/** The manual row joins the authored order after the automatic insert it
+ * waits for. Rejection of that insert removes only its own effect; a same-key
+ * manual update then replaces the row, and a disjoint manual insert follows. */
+function expectedManualAfterAutomaticInsert(
+  sameKey: boolean,
+  firstAccepted: boolean,
+): Array<Row> {
+  return sameKey
+    ? [{ id: 'k', value: 2 }]
+    : [
+        ...(firstAccepted ? [{ id: 'k', value: 1 }] : []),
+        { id: 'other', value: 2 },
+      ].sort((a, b) => a.id.localeCompare(b.id))
+}
+
+/** A queued automatic `first` row is durable before the manual row is
+ * accepted. A Storage fault on the manual row removes only that row. */
+function expectedUnawaitedManualRows(
+  queued: boolean,
+  storageFails: boolean,
+): Array<Row> {
+  return [
+    ...(queued ? [{ id: 'first', value: 1 }] : []),
+    ...(!storageFails ? [{ id: 'manual', value: 2 }] : []),
+  ]
+}
+
+// The model folds an automatic insert decision, then a manual same-key update
+// or disjoint insert. Rejection removes only the automatic effect. The manual
+// receipt remains pending while the earlier handler is held; after both
+// decisions, storage, public rows, and fresh restore match the authored fold.
+for (const sameKey of [true, false]) {
+  for (const firstAccepted of [true, false]) {
+    it(`orders manual ${sameKey ? 'same-key update' : 'disjoint insert'} after an ${firstAccepted ? 'accepted' : 'rejected'} automatic insert`, async () => {
+      const storage = makeStorage()
+      const entered = createDeferred<void>()
+      const release = createDeferred<void>()
+      const makeCollection = (withHandler: boolean) =>
+        createCollection(
+          localStorageCollectionOptions<Row>({
+            storageKey: 'rows',
+            storage,
+            storageEventApi: {
+              addEventListener() {},
+              removeEventListener() {},
+            },
+            getKey: (row) => row.id,
+            ...(withHandler
+              ? {
+                  onInsert: async () => {
+                    entered.resolve()
+                    await release.promise
+                  },
+                }
+              : {}),
+          }),
+        )
+      const collection = makeCollection(true)
+      let reopened: ReturnType<typeof makeCollection> | undefined
+      await withHistoryCleanup(
+        async () => {
+          await collection.preload()
+          const first = collection.insert({ id: 'k', value: 1 })
+          const firstOutcome = first.isPersisted.promise.then(
+            () => true,
+            () => false,
+          )
+          await entered.promise
+          const manual = createTransaction({
+            autoCommit: false,
+            mutationFn: async ({ transaction }) => {
+              await collection.utils.acceptMutations(transaction)
+            },
+          })
+          manual.mutate(() => {
+            if (sameKey) {
+              collection.update('k', (draft) => {
+                draft.value = 2
+              })
+            } else {
+              collection.insert({ id: 'other', value: 2 })
+            }
+          })
+          let manualSettled = false
+          const manualReceipt = manual.commit().then(() => {
+            manualSettled = true
+          })
+          await new Promise((resolve) => setTimeout(resolve, 0))
+          expect(
+            manualSettled,
+            'manual acceptance waits for its predecessor',
+          ).toBe(false)
+          expect(storage.getItem('rows')).toBeNull()
+          if (firstAccepted) release.resolve()
+          else release.reject(new Error('automatic insert rejected'))
+          const [actualFirst] = await Promise.all([firstOutcome, manualReceipt])
+          expect(actualFirst).toBe(firstAccepted)
+          const expected = expectedManualAfterAutomaticInsert(
+            sameKey,
+            firstAccepted,
+          )
+          expect(storedRows(storage.getItem('rows'))).toEqual(expected)
+          expect(sortedRows(collection.values())).toEqual(expected)
+          reopened = makeCollection(false)
+          await reopened.preload()
+          expect(sortedRows(reopened.values())).toEqual(expected)
+        },
+        () => [
+          () => release.resolve(),
+          () => reopened?.cleanup(),
+          () => collection.cleanup(),
+        ],
+      )
+    })
+  }
+}
+
+// A manual transaction's persistence receipt represents its Storage write,
+// even when mutationFn does not await the utility's Promise. The authored
+// model includes the manual row only after its successful storage acceptance.
+// This finite grammar varies an earlier held automatic write and a manual
+// Storage fault. The driver enters through createTransaction and the public
+// utility. At the held cut neither receipt may settle; at the final cut both
+// receipts, durable rows, and the public snapshot must match the decision.
+for (const queued of [false, true]) {
+  for (const storageFails of [false, true]) {
+    it(`settles un-awaited manual acceptance after its ${queued ? 'queued' : 'direct'} ${storageFails ? 'failed' : 'successful'} storage write`, async () => {
+      const storage = makeStorage()
+      const storageError = new Error('manual storage fault')
+      const setItem = storage.setItem
+      storage.setItem = (key, value) => {
+        if (storageFails && value.includes('s:manual')) throw storageError
+        setItem(key, value)
+      }
+      const entered = createDeferred<void>()
+      const release = createDeferred<void>()
+      const accepted = createDeferred<void>()
+      const collection = createCollection(
+        localStorageCollectionOptions<Row>({
+          storageKey: 'rows',
+          storage,
+          storageEventApi: { addEventListener() {}, removeEventListener() {} },
+          getKey: (row) => row.id,
+          onInsert: async ({ transaction }) => {
+            if (transaction.mutations[0].modified.id === 'first') {
+              entered.resolve()
+              await release.promise
+            }
+          },
+        }),
+      )
+      let manual:
+        | ReturnType<typeof createTransaction<Record<string, unknown>>>
+        | undefined
+      await withHistoryCleanup(
+        async () => {
+          await collection.preload()
+          const first = queued
+            ? collection.insert({ id: 'first', value: 1 })
+            : undefined
+          if (queued) await entered.promise
+          manual = createTransaction<Record<string, unknown>>({
+            autoCommit: false,
+            mutationFn: ({ transaction }) => {
+              // The application deliberately omits await and return. A
+              // rejection observer prevents the test runner from replacing
+              // the receipt assertion with an unhandled-rejection failure.
+              void collection.utils.acceptMutations(transaction).catch(() => {})
+              accepted.resolve()
+              return Promise.resolve()
+            },
+          })
+          manual.mutate(() => collection.insert({ id: 'manual', value: 2 }))
+          const commit = observeHistoryPromise(manual.commit())
+          const receipt = observeHistoryPromise(manual.isPersisted.promise)
+          await accepted.promise
+          if (queued) {
+            await new Promise((resolve) => setTimeout(resolve, 0))
+            expect(commit.read().status, 'held commit').toBe('pending')
+            expect(receipt.read().status, 'held persistence receipt').toBe(
+              'pending',
+            )
+            expect(storage.getItem('rows')).toBeNull()
+            release.resolve()
+            await first!.isPersisted.promise
+          }
+          await Promise.all([commit.settled, receipt.settled])
+          if (storageFails) {
+            expect(commit.read()).toMatchObject({
+              status: 'rejected',
+              reason: storageError,
+            })
+            expect(receipt.read()).toMatchObject({
+              status: 'rejected',
+              reason: storageError,
+            })
+          } else {
+            expect(commit.read().status).toBe('fulfilled')
+            expect(receipt.read().status).toBe('fulfilled')
+          }
+          const expected = expectedUnawaitedManualRows(queued, storageFails)
+          if (expected.length)
+            expect(storedRows(storage.getItem('rows'))).toEqual(expected)
+          else expect(storage.getItem('rows')).toBeNull()
+          expect(sortedRows(collection.values())).toEqual(expected)
+        },
+        () => [() => release.resolve(), () => collection.cleanup()],
+      )
+    })
+  }
+}
diff --git a/packages/db/tests/local-storage-peer-fixtures.ts b/packages/db/tests/local-storage-peer-fixtures.ts
new file mode 100644
index 0000000000..e2ca87cbca
--- /dev/null
+++ b/packages/db/tests/local-storage-peer-fixtures.ts
@@ -0,0 +1,69 @@
+// Shared fixtures for the LocalStorage peer tests: a fake same-origin Storage
+// host with its event bus, and Collections that share one key. The fixed peer
+// histories are in local-storage-peer-history.test.ts.
+import { createCollection } from '../src/collection/index'
+import { localStorageCollectionOptions } from '../src/local-storage'
+import type { StorageApi, StorageEventApi } from '../src/local-storage'
+
+export type Row = { id: string | number; value: number }
+
+// Hosts that share `data` are tabs of one origin: they share the bytes, but
+// each has its own Storage object, so no same-tab publication crosses them.
+export function createHost(data = new Map<string, string>()) {
+  const listeners = new Set<(event: StorageEvent) => void>()
+  let storageReads = 0
+  const storage: StorageApi = {
+    getItem: (key) => {
+      storageReads++
+      return data.get(key) ?? null
+    },
+    setItem: (key, value) => {
+      data.set(key, value)
+    },
+    removeItem: (key) => {
+      data.delete(key)
+    },
+  }
+  const events: StorageEventApi = {
+    addEventListener: (_type, listener) => {
+      listeners.add(listener)
+    },
+    removeEventListener: (_type, listener) => {
+      listeners.delete(listener)
+    },
+  }
+  function deliver(key: string) {
+    const event = {
+      key,
+      storageArea: storage,
+      newValue: data.get(key) ?? null,
+    } as StorageEvent
+    for (const listener of [...listeners]) listener(event)
+  }
+  return {
+    storage,
+    events,
+    deliver,
+    listenerCount: () => listeners.size,
+    readCount: () => storageReads,
+    resetReadCount: () => {
+      storageReads = 0
+    },
+  }
+}
+
+export function makeCollection(
+  host: ReturnType<typeof createHost>,
+  storageKey: string,
+  id: string,
+) {
+  return createCollection(
+    localStorageCollectionOptions<Row>({
+      id,
+      storageKey,
+      storage: host.storage,
+      storageEventApi: host.events,
+      getKey: (row) => row.id,
+    }),
+  )
+}
diff --git a/packages/db/tests/local-storage-peer-oracle.test.ts b/packages/db/tests/local-storage-peer-history.test.ts
similarity index 86%
rename from packages/db/tests/local-storage-peer-oracle.test.ts
rename to packages/db/tests/local-storage-peer-history.test.ts
index bcec955793..c13d69434b 100644
--- a/packages/db/tests/local-storage-peer-oracle.test.ts
+++ b/packages/db/tests/local-storage-peer-history.test.ts
@@ -1,4 +1,8 @@
 /**
+ * Fixed LocalStorage peer histories. These tests state their expected rows by
+ * hand; `expectedRows` only copies and sorts them. They are not an oracle: the
+ * models described below are not yet executable (tracked in TanStack/db#2264).
+ *
  * A LocalStorage Collection stores whole snapshots under one key and receives
  * peer changes through storage events and same-tab publication. Active
  * Collections with fresh options that share one Storage object and key must
@@ -60,70 +64,9 @@ import { BasicIndex } from '../src/indexes/basic-index'
 import { localStorageCollectionOptions } from '../src/local-storage'
 import { createTransaction } from '../src/transactions'
 import { withHistoryCleanup } from './optimistic-history-oracle'
-import type { StorageApi, StorageEventApi } from '../src/local-storage'
-
-type Row = { id: string | number; value: number }
-
-// Hosts that share `data` are tabs of one origin: they share the bytes, but
-// each has its own Storage object, so no same-tab publication crosses them.
-function createHost(data = new Map<string, string>()) {
-  const listeners = new Set<(event: StorageEvent) => void>()
-  let storageReads = 0
-  const storage: StorageApi = {
-    getItem: (key) => {
-      storageReads++
-      return data.get(key) ?? null
-    },
-    setItem: (key, value) => {
-      data.set(key, value)
-    },
-    removeItem: (key) => {
-      data.delete(key)
-    },
-  }
-  const events: StorageEventApi = {
-    addEventListener: (_type, listener) => {
-      listeners.add(listener)
-    },
-    removeEventListener: (_type, listener) => {
-      listeners.delete(listener)
-    },
-  }
-  function deliver(key: string) {
-    const event = {
-      key,
-      storageArea: storage,
-      newValue: data.get(key) ?? null,
-    } as StorageEvent
-    for (const listener of [...listeners]) listener(event)
-  }
-  return {
-    storage,
-    events,
-    deliver,
-    listenerCount: () => listeners.size,
-    readCount: () => storageReads,
-    resetReadCount: () => {
-      storageReads = 0
-    },
-  }
-}
-
-function makeCollection(
-  host: ReturnType<typeof createHost>,
-  storageKey: string,
-  id: string,
-) {
-  return createCollection(
-    localStorageCollectionOptions<Row>({
-      id,
-      storageKey,
-      storage: host.storage,
-      storageEventApi: host.events,
-      getKey: (row) => row.id,
-    }),
-  )
-}
+import { createHost, makeCollection } from './local-storage-peer-fixtures'
+import type { StorageApi } from '../src/local-storage'
+import type { Row } from './local-storage-peer-fixtures'
 
 function expectedRows(authored: ReadonlyArray<Row>): Array<Row> {
   // The model compares typed IDs directly; string '1' and number 1 differ.
@@ -573,141 +516,6 @@ it('avoids reparsing the writer snapshot during same-tab publication', async ()
   )
 })
 
-/** The established direct-write contract keeps native Date fields in the
- * writing Collection. JSON bytes and Collections that read those bytes hold
- * ISO strings instead. This is a deliberate value-domain limit on the peer
- * agreement law above, not permission to leave ordinary JSON-native rows
- * stale. The test compares all three observations at the receipt and restore. */
-it('keeps an authored Date in the writer while peers read JSON bytes', async () => {
-  type DatedRow = { id: string; at: Date | string }
-  const host = createHost()
-  const make = (id: string) =>
-    createCollection(
-      localStorageCollectionOptions<DatedRow>({
-        id,
-        storageKey: 'dated',
-        storage: host.storage,
-        storageEventApi: host.events,
-        getKey: (row) => row.id,
-      }),
-    )
-  const writer = make('writer')
-  const peer = make('peer')
-  let reopened: typeof writer | undefined
-  await withHistoryCleanup(
-    async () => {
-      await Promise.all([writer.preload(), peer.preload()])
-      const at = new Date('2020-01-02T03:04:05.000Z')
-      await writer.insert({ id: 'row', at }).isPersisted.promise
-      const expected = [{ id: 'row', at: at.toISOString() }]
-      const durable = JSON.parse(host.storage.getItem('dated')!) as Record<
-        string,
-        { data: DatedRow }
-      >
-      expect(Object.values(durable).map(({ data }) => data)).toEqual(expected)
-      expect([...writer.values()], 'native Date writer receipt').toMatchObject([
-        { id: 'row', at },
-      ])
-      expect([...peer.values()], 'JSON peer receipt').toMatchObject(expected)
-      reopened = make('reopened')
-      await reopened.preload()
-      expect([...reopened.values()], 'JSON fresh restore').toMatchObject(
-        expected,
-      )
-    },
-    () => [
-      () => reopened?.cleanup(),
-      () => peer.cleanup(),
-      () => writer.cleanup(),
-    ],
-  )
-})
-
-/** A disjoint peer write is not a restore of this Collection. The default-JSON
- * writer keeps the Date it authored until its own persisted restore, while it
- * still receives the peer's newly accepted row. The independent model tracks
- * authored native values per Collection and the JSON form in durable bytes;
- * the driver compares both active snapshots at the peer receipt and a fresh
- * restore. This crosses native-value retention with same-tab publication. */
-it('keeps a native authored Date through a disjoint peer write', async () => {
-  type DatedRow = { id: string; at: Date | string }
-  const host = createHost()
-  const make = (id: string) =>
-    createCollection(
-      localStorageCollectionOptions<DatedRow>({
-        id,
-        storageKey: 'dated',
-        storage: host.storage,
-        storageEventApi: host.events,
-        getKey: (row) => row.id,
-      }),
-    )
-  const first = make('first')
-  const second = make('second')
-  let reopened: typeof first | undefined
-  await withHistoryCleanup(
-    async () => {
-      await Promise.all([first.preload(), second.preload()])
-      const at = new Date('2020-01-02T03:04:05.000Z')
-      await first.insert({ id: 'first-row', at }).isPersisted.promise
-      await second.insert({ id: 'second-row', at: 'later' }).isPersisted.promise
-      const durable = JSON.parse(host.storage.getItem('dated')!) as Record<
-        string,
-        { data: DatedRow }
-      >
-      expect(Object.values(durable).map(({ data }) => data)).toEqual(
-        expect.arrayContaining([
-          { id: 'first-row', at: at.toISOString() },
-          { id: 'second-row', at: 'later' },
-        ]),
-      )
-      expect(
-        [...first.values()].map(({ id, at: value }) => ({ id, at: value })),
-      ).toEqual(
-        expect.arrayContaining([
-          { id: 'first-row', at },
-          { id: 'second-row', at: 'later' },
-        ]),
-      )
-      expect(
-        [...second.values()].map(({ id, at: value }) => ({ id, at: value })),
-      ).toEqual(
-        expect.arrayContaining([
-          { id: 'first-row', at: at.toISOString() },
-          { id: 'second-row', at: 'later' },
-        ]),
-      )
-      reopened = make('reopened')
-      await reopened.preload()
-      expect(
-        [...reopened.values()].map(({ id, at: value }) => ({ id, at: value })),
-      ).toEqual(
-        expect.arrayContaining([
-          { id: 'first-row', at: at.toISOString() },
-          { id: 'second-row', at: 'later' },
-        ]),
-      )
-
-      // A peer's actual same-key edit has a new version and must replace the
-      // retained native value in the first Collection.
-      await second.update('first-row', (draft) => {
-        draft.at = 'changed'
-      }).isPersisted.promise
-      expect(
-        [...first.values()].find(({ id }) => id === 'first-row'),
-      ).toMatchObject({ at: 'changed' })
-      expect(
-        [...reopened.values()].find(({ id }) => id === 'first-row'),
-      ).toMatchObject({ at: 'changed' })
-    },
-    () => [
-      () => reopened?.cleanup(),
-      () => second.cleanup(),
-      () => first.cleanup(),
-    ],
-  )
-})
-
 /** A custom parser may normalize the bytes it writes. The writer's in-memory
  * staged Map is then not authoritative for untouched rows, even when Storage
  * still contains the exact string it just saved. The receiving model reads
@@ -1127,53 +935,6 @@ it('manual acceptance keeps equal-ID Collections in their own stores', async ()
   )
 })
 
-/** A module-level options utility is not a license to persist a different
- * Collection that happens to have the same ID. The independent ownership
- * model assigns the mutation only to the Collection built from its own
- * options. A mismatched utility must fail at acceptance without writing
- * either store, rather than silently reporting a successful wrong write. */
-for (const unrelatedKey of ['first-store', 'second-store']) {
-  it(`rejects module-level acceptance for an unrelated equal-ID Collection on ${unrelatedKey}`, async () => {
-    const host = createHost()
-    const settings = localStorageCollectionOptions<Row>({
-      id: 'same-id',
-      storageKey: 'first-store',
-      storage: host.storage,
-      storageEventApi: host.events,
-      getKey: (row) => row.id,
-    })
-    const unrelated = makeCollection(host, unrelatedKey, 'same-id')
-    let transaction:
-      ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
-    await withHistoryCleanup(
-      async () => {
-        await unrelated.preload()
-        transaction = createTransaction<Record<string, unknown>>({
-          autoCommit: false,
-          mutationFn: async () => {},
-        })
-        transaction.mutate(() => {
-          unrelated.insert({ id: 'other', value: 1 })
-        })
-        await expect(
-          settings.utils.acceptMutations(transaction),
-        ).rejects.toThrow(LocalStorageCollectionError)
-        expect(host.storage.getItem('first-store')).toBeNull()
-        expect(host.storage.getItem('second-store')).toBeNull()
-      },
-      () => [
-        () => {
-          if (transaction) {
-            void transaction.isPersisted.promise.catch(() => undefined)
-            transaction.rollback()
-          }
-        },
-        () => unrelated.cleanup(),
-      ],
-    )
-  })
-}
-
 /** One adapter options object owns one Collection. Its mutable sync and
  * utility state cannot represent two owners at once. The finite history
  * varies whether the first Collection has started its sync run and whether
@@ -1739,52 +1500,6 @@ it('keeps one legacy unprefixed string key writable and restorable', async () =>
   )
 })
 
-/** Map key identity uses SameValueZero: numeric NaN is the same key after
- * encoding and decoding, while numeric 1 and string "1" remain distinct.
- * The NaN key is derived from a serializable string, so the row itself can
- * round-trip. The independent model holds those three typed identities. */
-it('restores a serializable NaN key alongside distinct number and string keys', async () => {
-  const host = createHost()
-  type KeyedRow = { id: string; key: number | string; value: number }
-  const make = (id: string) =>
-    createCollection(
-      localStorageCollectionOptions<KeyedRow>({
-        id,
-        storageKey: 'typed',
-        storage: host.storage,
-        storageEventApi: host.events,
-        getKey: (row) => (row.id === 'nan' ? Number(row.key) : row.key),
-      }),
-    )
-  const writer = make('writer')
-  let reopened: typeof writer | undefined
-  await withHistoryCleanup(
-    async () => {
-      await writer.preload()
-      const authored: Array<KeyedRow> = [
-        { id: 'nan', key: 'NaN', value: 1 },
-        { id: 'number', key: 1, value: 2 },
-        { id: 'string', key: '1', value: 3 },
-      ]
-      for (const row of authored) await writer.insert(row).isPersisted.promise
-      expect(
-        [...writer.values()].map(({ id, key, value }) => ({ id, key, value })),
-      ).toEqual(expect.arrayContaining(authored))
-      reopened = make('reopened')
-      await reopened.preload()
-      expect(
-        [...reopened.values()].map(({ id, key, value }) => ({
-          id,
-          key,
-          value,
-        })),
-      ).toEqual(expect.arrayContaining(authored))
-      expect([...reopened.values()]).toHaveLength(authored.length)
-    },
-    () => [() => reopened?.cleanup(), () => writer.cleanup()],
-  )
-})
-
 /** A fulfilled receipt promises a restorable row. Default JSON cannot
  * round-trip a nonfinite numeric ID in row data, even though its storage key
  * has a stable text encoding. The model rejects that write before changing
@@ -1919,45 +1634,6 @@ it('does not retain a failed startup validation run', async () => {
   )
 })
 
-/** The row-shape check must run before an adapter `begin()`, not merely fail
- * later when core extracts the row key. A `null` row is present in the stored
- * envelope but cannot represent a Collection row. The begin counter is the
- * adapter-boundary observation; error status and intact bytes are public. */
-it('rejects null stored row data before opening a sync transaction', async () => {
-  const host = createHost()
-  const raw = JSON.stringify({
-    's:row': { versionKey: 'token', data: null },
-  })
-  host.storage.setItem('shared', raw)
-  const options = localStorageCollectionOptions<Row>({
-    id: 'reader',
-    storageKey: 'shared',
-    storage: host.storage,
-    storageEventApi: host.events,
-    getKey: (row) => row.id,
-  })
-  const originalSync = options.sync.sync
-  let begins = 0
-  options.sync.sync = (params) =>
-    originalSync({
-      ...params,
-      begin: () => {
-        begins++
-        return params.begin()
-      },
-    })
-  const collection = createCollection(options)
-  await withHistoryCleanup(
-    async () => {
-      await expect(collection.preload()).rejects.toThrow()
-      expect(collection.status).toBe('crashed')
-      expect(host.storage.getItem('shared')).toBe(raw)
-      expect(begins, 'malformed restore opens no transaction').toBe(0)
-    },
-    () => [() => collection.cleanup()],
-  )
-})
-
 // A transient read failure is also insufficient evidence for an empty
 // persisted restore. Unlike malformed bytes, the existing valid snapshot can
 // be read on restart without clearing it. The first preload must fail before
diff --git a/packages/db/tests/local-storage-peer.test.ts b/packages/db/tests/local-storage-peer.test.ts
new file mode 100644
index 0000000000..20d2b937ce
--- /dev/null
+++ b/packages/db/tests/local-storage-peer.test.ts
@@ -0,0 +1,280 @@
+// Ordinary regression tests for LocalStorage same-tab peers, typed keys, and
+// adapter construction. Each test runs one fixed scenario and compares with
+// hand-written rows, reads, or Storage bytes. The peer convergence law has no
+// oracle owner yet (TanStack/db#2264); its fixed histories are in
+// local-storage-peer-history.test.ts.
+import { expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index'
+import { LocalStorageCollectionError } from '../src/errors'
+import { localStorageCollectionOptions } from '../src/local-storage'
+import { createTransaction } from '../src/transactions'
+import { withHistoryCleanup } from './optimistic-history-oracle'
+import { createHost, makeCollection } from './local-storage-peer-fixtures'
+import type { Row } from './local-storage-peer-fixtures'
+
+/** The established direct-write contract keeps native Date fields in the
+ * writing Collection. JSON bytes and Collections that read those bytes hold
+ * ISO strings instead. This is a deliberate value-domain limit on the peer
+ * agreement law above, not permission to leave ordinary JSON-native rows
+ * stale. The test compares all three observations at the receipt and restore. */
+it('keeps an authored Date in the writer while peers read JSON bytes', async () => {
+  type DatedRow = { id: string; at: Date | string }
+  const host = createHost()
+  const make = (id: string) =>
+    createCollection(
+      localStorageCollectionOptions<DatedRow>({
+        id,
+        storageKey: 'dated',
+        storage: host.storage,
+        storageEventApi: host.events,
+        getKey: (row) => row.id,
+      }),
+    )
+  const writer = make('writer')
+  const peer = make('peer')
+  let reopened: typeof writer | undefined
+  await withHistoryCleanup(
+    async () => {
+      await Promise.all([writer.preload(), peer.preload()])
+      const at = new Date('2020-01-02T03:04:05.000Z')
+      await writer.insert({ id: 'row', at }).isPersisted.promise
+      const expected = [{ id: 'row', at: at.toISOString() }]
+      const durable = JSON.parse(host.storage.getItem('dated')!) as Record<
+        string,
+        { data: DatedRow }
+      >
+      expect(Object.values(durable).map(({ data }) => data)).toEqual(expected)
+      expect([...writer.values()], 'native Date writer receipt').toMatchObject([
+        { id: 'row', at },
+      ])
+      expect([...peer.values()], 'JSON peer receipt').toMatchObject(expected)
+      reopened = make('reopened')
+      await reopened.preload()
+      expect([...reopened.values()], 'JSON fresh restore').toMatchObject(
+        expected,
+      )
+    },
+    () => [
+      () => reopened?.cleanup(),
+      () => peer.cleanup(),
+      () => writer.cleanup(),
+    ],
+  )
+})
+
+/** A disjoint peer write is not a restore of this Collection. The default-JSON
+ * writer keeps the Date it authored until its own persisted restore, while it
+ * still receives the peer's newly accepted row. The independent model tracks
+ * authored native values per Collection and the JSON form in durable bytes;
+ * the driver compares both active snapshots at the peer receipt and a fresh
+ * restore. This crosses native-value retention with same-tab publication. */
+it('keeps a native authored Date through a disjoint peer write', async () => {
+  type DatedRow = { id: string; at: Date | string }
+  const host = createHost()
+  const make = (id: string) =>
+    createCollection(
+      localStorageCollectionOptions<DatedRow>({
+        id,
+        storageKey: 'dated',
+        storage: host.storage,
+        storageEventApi: host.events,
+        getKey: (row) => row.id,
+      }),
+    )
+  const first = make('first')
+  const second = make('second')
+  let reopened: typeof first | undefined
+  await withHistoryCleanup(
+    async () => {
+      await Promise.all([first.preload(), second.preload()])
+      const at = new Date('2020-01-02T03:04:05.000Z')
+      await first.insert({ id: 'first-row', at }).isPersisted.promise
+      await second.insert({ id: 'second-row', at: 'later' }).isPersisted.promise
+      const durable = JSON.parse(host.storage.getItem('dated')!) as Record<
+        string,
+        { data: DatedRow }
+      >
+      expect(Object.values(durable).map(({ data }) => data)).toEqual(
+        expect.arrayContaining([
+          { id: 'first-row', at: at.toISOString() },
+          { id: 'second-row', at: 'later' },
+        ]),
+      )
+      expect(
+        [...first.values()].map(({ id, at: value }) => ({ id, at: value })),
+      ).toEqual(
+        expect.arrayContaining([
+          { id: 'first-row', at },
+          { id: 'second-row', at: 'later' },
+        ]),
+      )
+      expect(
+        [...second.values()].map(({ id, at: value }) => ({ id, at: value })),
+      ).toEqual(
+        expect.arrayContaining([
+          { id: 'first-row', at: at.toISOString() },
+          { id: 'second-row', at: 'later' },
+        ]),
+      )
+      reopened = make('reopened')
+      await reopened.preload()
+      expect(
+        [...reopened.values()].map(({ id, at: value }) => ({ id, at: value })),
+      ).toEqual(
+        expect.arrayContaining([
+          { id: 'first-row', at: at.toISOString() },
+          { id: 'second-row', at: 'later' },
+        ]),
+      )
+
+      // A peer's actual same-key edit has a new version and must replace the
+      // retained native value in the first Collection.
+      await second.update('first-row', (draft) => {
+        draft.at = 'changed'
+      }).isPersisted.promise
+      expect(
+        [...first.values()].find(({ id }) => id === 'first-row'),
+      ).toMatchObject({ at: 'changed' })
+      expect(
+        [...reopened.values()].find(({ id }) => id === 'first-row'),
+      ).toMatchObject({ at: 'changed' })
+    },
+    () => [
+      () => reopened?.cleanup(),
+      () => second.cleanup(),
+      () => first.cleanup(),
+    ],
+  )
+})
+
+/** A module-level options utility is not a license to persist a different
+ * Collection that happens to have the same ID. The independent ownership
+ * model assigns the mutation only to the Collection built from its own
+ * options. A mismatched utility must fail at acceptance without writing
+ * either store, rather than silently reporting a successful wrong write. */
+for (const unrelatedKey of ['first-store', 'second-store']) {
+  it(`rejects module-level acceptance for an unrelated equal-ID Collection on ${unrelatedKey}`, async () => {
+    const host = createHost()
+    const settings = localStorageCollectionOptions<Row>({
+      id: 'same-id',
+      storageKey: 'first-store',
+      storage: host.storage,
+      storageEventApi: host.events,
+      getKey: (row) => row.id,
+    })
+    const unrelated = makeCollection(host, unrelatedKey, 'same-id')
+    let transaction:
+      ReturnType<typeof createTransaction<Record<string, unknown>>> | undefined
+    await withHistoryCleanup(
+      async () => {
+        await unrelated.preload()
+        transaction = createTransaction<Record<string, unknown>>({
+          autoCommit: false,
+          mutationFn: async () => {},
+        })
+        transaction.mutate(() => {
+          unrelated.insert({ id: 'other', value: 1 })
+        })
+        await expect(
+          settings.utils.acceptMutations(transaction),
+        ).rejects.toThrow(LocalStorageCollectionError)
+        expect(host.storage.getItem('first-store')).toBeNull()
+        expect(host.storage.getItem('second-store')).toBeNull()
+      },
+      () => [
+        () => {
+          if (transaction) {
+            void transaction.isPersisted.promise.catch(() => undefined)
+            transaction.rollback()
+          }
+        },
+        () => unrelated.cleanup(),
+      ],
+    )
+  })
+}
+
+/** Map key identity uses SameValueZero: numeric NaN is the same key after
+ * encoding and decoding, while numeric 1 and string "1" remain distinct.
+ * The NaN key is derived from a serializable string, so the row itself can
+ * round-trip. The independent model holds those three typed identities. */
+it('restores a serializable NaN key alongside distinct number and string keys', async () => {
+  const host = createHost()
+  type KeyedRow = { id: string; key: number | string; value: number }
+  const make = (id: string) =>
+    createCollection(
+      localStorageCollectionOptions<KeyedRow>({
+        id,
+        storageKey: 'typed',
+        storage: host.storage,
+        storageEventApi: host.events,
+        getKey: (row) => (row.id === 'nan' ? Number(row.key) : row.key),
+      }),
+    )
+  const writer = make('writer')
+  let reopened: typeof writer | undefined
+  await withHistoryCleanup(
+    async () => {
+      await writer.preload()
+      const authored: Array<KeyedRow> = [
+        { id: 'nan', key: 'NaN', value: 1 },
+        { id: 'number', key: 1, value: 2 },
+        { id: 'string', key: '1', value: 3 },
+      ]
+      for (const row of authored) await writer.insert(row).isPersisted.promise
+      expect(
+        [...writer.values()].map(({ id, key, value }) => ({ id, key, value })),
+      ).toEqual(expect.arrayContaining(authored))
+      reopened = make('reopened')
+      await reopened.preload()
+      expect(
+        [...reopened.values()].map(({ id, key, value }) => ({
+          id,
+          key,
+          value,
+        })),
+      ).toEqual(expect.arrayContaining(authored))
+      expect([...reopened.values()]).toHaveLength(authored.length)
+    },
+    () => [() => reopened?.cleanup(), () => writer.cleanup()],
+  )
+})
+
+/** The row-shape check must run before an adapter `begin()`, not merely fail
+ * later when core extracts the row key. A `null` row is present in the stored
+ * envelope but cannot represent a Collection row. The begin counter is the
+ * adapter-boundary observation; error status and intact bytes are public. */
+it('rejects null stored row data before opening a sync transaction', async () => {
+  const host = createHost()
+  const raw = JSON.stringify({
+    's:row': { versionKey: 'token', data: null },
+  })
+  host.storage.setItem('shared', raw)
+  const options = localStorageCollectionOptions<Row>({
+    id: 'reader',
+    storageKey: 'shared',
+    storage: host.storage,
+    storageEventApi: host.events,
+    getKey: (row) => row.id,
+  })
+  const originalSync = options.sync.sync
+  let begins = 0
+  options.sync.sync = (params) =>
+    originalSync({
+      ...params,
+      begin: () => {
+        begins++
+        return params.begin()
+      },
+    })
+  const collection = createCollection(options)
+  await withHistoryCleanup(
+    async () => {
+      await expect(collection.preload()).rejects.toThrow()
+      expect(collection.status).toBe('crashed')
+      expect(host.storage.getItem('shared')).toBe(raw)
+      expect(begins, 'malformed restore opens no transaction').toBe(0)
+    },
+    () => [() => collection.cleanup()],
+  )
+})
diff --git a/packages/db/tests/local-storage-value-fidelity-oracle.property.test.ts b/packages/db/tests/local-storage-value-fidelity-oracle.property.test.ts
index 466fc51910..85d8552f49 100644
--- a/packages/db/tests/local-storage-value-fidelity-oracle.property.test.ts
+++ b/packages/db/tests/local-storage-value-fidelity-oracle.property.test.ts
@@ -38,6 +38,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import {
   observeHistoryPromise,
   withHistoryCleanup,
@@ -372,6 +373,11 @@ async function runHistory({ entry, handler, payload }: History) {
   )
 }
 
+declareOracle({
+  check: [runHistory],
+  model: [restoredArray, restoredObject],
+})
+
 describe(`LocalStorage value fidelity oracle`, () => {
   if (!oracleReplayRequested()) {
     // Pinned witnesses. The first is the reported case: a function property in
diff --git a/packages/db/tests/metadata-publication-worlds.ts b/packages/db/tests/metadata-publication-worlds.ts
new file mode 100644
index 0000000000..37eb849c73
--- /dev/null
+++ b/packages/db/tests/metadata-publication-worlds.ts
@@ -0,0 +1,6 @@
+// This grammar contains structured values only. Clone the whole scenario, not
+// each write: aliases within one world stay intact, but cannot rewrite the
+// other world's authority or the original replay input.
+export function metadataWorlds<T>(scenario: T): { model: T; driver: T } {
+  return { model: structuredClone(scenario), driver: structuredClone(scenario) }
+}
diff --git a/packages/db/tests/mutation-handler-type-oracle.test-d.ts b/packages/db/tests/mutation-handler-type.test-d.ts
similarity index 100%
rename from packages/db/tests/mutation-handler-type-oracle.test-d.ts
rename to packages/db/tests/mutation-handler-type.test-d.ts
diff --git a/packages/db/tests/observer-history-cleanup.ts b/packages/db/tests/observer-history-cleanup.ts
new file mode 100644
index 0000000000..d8049b0227
--- /dev/null
+++ b/packages/db/tests/observer-history-cleanup.ts
@@ -0,0 +1,26 @@
+/**
+ * Releases an observer history's resources in order, then rethrows the
+ * history's failure. Cleanup errors are aggregated with that failure, so a
+ * failing history never hides a cleanup failure.
+ */
+export async function finishHistory(
+  cleanup: ReadonlyArray<() => void | Promise<void>>,
+  failure: { error: unknown } | undefined,
+): Promise<void> {
+  const cleanupFailures: Array<unknown> = []
+  for (const release of cleanup) {
+    try {
+      await release()
+    } catch (error) {
+      cleanupFailures.push(error)
+    }
+  }
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(
+      failure ? [failure.error, ...cleanupFailures] : cleanupFailures,
+      `Observer history cleanup failed`,
+      failure ? { cause: failure.error } : undefined,
+    )
+  }
+  if (failure) throw failure.error
+}
diff --git a/packages/db/tests/optimistic-composition-fixture.ts b/packages/db/tests/optimistic-composition-fixture.ts
new file mode 100644
index 0000000000..b7014920fb
--- /dev/null
+++ b/packages/db/tests/optimistic-composition-fixture.ts
@@ -0,0 +1,50 @@
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { createTransaction } from '../src/transactions.js'
+import type { SyncConfig } from '../src/types.js'
+
+// Shared collection and pending-transaction fixtures for the optimistic
+// snapshot ownership tests and their oracle.
+export type Row = { id: number; a: string; b: string; c: string }
+export const initial: Row = { id: 1, a: `a0`, b: `b0`, c: `c0` }
+export const orders = [
+  [0, 1, 2],
+  [0, 2, 1],
+  [1, 0, 2],
+  [1, 2, 0],
+  [2, 0, 1],
+  [2, 1, 0],
+]
+
+export function source(onUpdate = () => Promise.resolve()) {
+  let sync!: Parameters<SyncConfig<Row>[`sync`]>[0]
+  const collection = createCollection<Row>({
+    getKey: (row) => row.id,
+    onUpdate,
+    sync: {
+      sync: (params) => {
+        sync = params
+        params.begin()
+        params.write({ type: `insert`, value: initial })
+        params.commit()
+        params.markReady()
+      },
+    },
+  })
+  return {
+    collection,
+    get sync() {
+      return sync
+    },
+  }
+}
+
+export function pendingTransaction() {
+  const done = createDeferred<void>()
+  const tx = createTransaction({
+    autoCommit: false,
+    mutationFn: () => done.promise,
+  })
+  const settled = tx.isPersisted.promise.catch((error: unknown) => error)
+  return { tx, done, settled }
+}
diff --git a/packages/db/tests/optimistic-composition-oracle.test.ts b/packages/db/tests/optimistic-composition-oracle.test.ts
index 3bda778288..40d21bc259 100644
--- a/packages/db/tests/optimistic-composition-oracle.test.ts
+++ b/packages/db/tests/optimistic-composition-oracle.test.ts
@@ -1,3 +1,14 @@
+import { describe, expect, it } from 'vitest'
+import { declareOracle } from './oracle-declaration.js'
+import { stripVirtualProps } from './utils.js'
+import {
+  initial,
+  orders,
+  pendingTransaction,
+  source,
+} from './optimistic-composition-fixture.js'
+import type { Row } from './optimistic-composition-fixture.js'
+
 /**
  * Which row does a key show while several optimistic transactions cover it?
  *
@@ -25,58 +36,6 @@
  * Limits: this file owns one key and simple row snapshots. Generated
  * multi-key settlement histories belong to `optimistic-history-oracle.ts`.
  */
-import { describe, expect, it } from 'vitest'
-import { z } from 'zod'
-import { createCollection } from '../src/collection/index.js'
-import { createDeferred } from '../src/deferred.js'
-import { createLiveQueryCollection } from '../src/query/index.js'
-import { createTransaction } from '../src/transactions.js'
-import { stripVirtualProps } from './utils.js'
-import type { SyncConfig } from '../src/types.js'
-
-type Row = { id: number; a: string; b: string; c: string }
-const initial: Row = { id: 1, a: `a0`, b: `b0`, c: `c0` }
-const orders = [
-  [0, 1, 2],
-  [0, 2, 1],
-  [1, 0, 2],
-  [1, 2, 0],
-  [2, 0, 1],
-  [2, 1, 0],
-]
-
-function source(onUpdate = () => Promise.resolve()) {
-  let sync!: Parameters<SyncConfig<Row>[`sync`]>[0]
-  const collection = createCollection<Row>({
-    getKey: (row) => row.id,
-    onUpdate,
-    sync: {
-      sync: (params) => {
-        sync = params
-        params.begin()
-        params.write({ type: `insert`, value: initial })
-        params.commit()
-        params.markReady()
-      },
-    },
-  })
-  return {
-    collection,
-    get sync() {
-      return sync
-    },
-  }
-}
-
-function pendingTransaction() {
-  const done = createDeferred<void>()
-  const tx = createTransaction({
-    autoCommit: false,
-    mutationFn: () => done.promise,
-  })
-  const settled = tx.isPersisted.promise.catch((error: unknown) => error)
-  return { tx, done, settled }
-}
 
 const cases = orders.flatMap((order) =>
   ([`pending`, `persisting`] as const).flatMap((phase) =>
@@ -91,168 +50,31 @@ const cases = orders.flatMap((order) =>
   ),
 )
 
-describe(`optimistic snapshot ownership`, () => {
-  it.each([false, true])(
-    `does not attribute a later remote write to a failed-only update, optimistic=%s`,
-    async (optimistic) => {
-      const done = createDeferred<void>()
-      const fixture = source(() => done.promise)
-      await fixture.collection.preload()
-      const tx = fixture.collection.update(1, { optimistic }, (row) => {
-        row.a = `failed`
-      })
-      const settled = tx.isPersisted.promise.catch(() => {})
-      try {
-        done.reject(new Error(`failed update`))
-        await settled
-        fixture.sync.begin()
-        fixture.sync.write({
-          type: `update`,
-          value: { ...initial, a: `remote` },
-        })
-        await fixture.sync.commit()
-        expect(fixture.collection.get(1)?.$origin).toBe(`remote`)
-      } finally {
-        done.resolve()
-        await fixture.collection.cleanup()
-      }
-    },
-  )
-
-  it.each([false, true])(
-    `attributes synchronous handler acknowledgement to its local update, optimistic=%s`,
-    async (optimistic) => {
-      const fixture = source(() => {
-        fixture.sync.begin()
-        fixture.sync.write({
-          type: `update`,
-          value: { ...initial, a: `accepted` },
-        })
-        void fixture.sync.commit()
-        return Promise.resolve()
-      })
-      await fixture.collection.preload()
-      try {
-        const tx = fixture.collection.update(1, { optimistic }, (row) => {
-          row.a = `accepted`
-        })
-        await tx.isPersisted.promise
-        expect(fixture.collection.get(1)?.$origin).toBe(`local`)
-        expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
-          ...initial,
-          a: `accepted`,
-        })
-      } finally {
-        await fixture.collection.cleanup()
-      }
-    },
+// The model: the row a key shows is the newest snapshot that is not excluded,
+// or the synced row when none is.
+function expectedOwnedRow(
+  snapshots: ReadonlyArray<Row | undefined>,
+  synced: Row,
+  excluded: number,
+): Row {
+  return snapshots.reduce<Row>(
+    (last, row, index) =>
+      row !== undefined && index !== excluded ? row : last,
+    synced,
   )
+}
 
-  it.each([false, true])(
-    `attributes a confirmation committed after settlement to the source, completed first=%s`,
-    async (completedFirst) => {
-      const done = [createDeferred<void>(), createDeferred<void>()]
-      let calls = 0
-      const fixture = source(() => done[calls++]!.promise)
-      await fixture.collection.preload()
-      const first = fixture.collection.update(
-        1,
-        { optimistic: false },
-        (row) => {
-          row.a = `accepted`
-        },
-      )
-      const second = fixture.collection.update(1, (row) => {
-        row.b = `rejected`
-      })
-      const secondSettled = second.isPersisted.promise.catch(() => {})
-      try {
-        if (completedFirst) {
-          done[0]!.resolve()
-          await first.isPersisted.promise
-        }
-        done[1]!.reject(new Error(`sibling failure`))
-        await secondSettled
-        if (!completedFirst) {
-          done[0]!.resolve()
-          await first.isPersisted.promise
-        }
-        fixture.sync.begin()
-        fixture.sync.write({
-          type: `update`,
-          value: { ...initial, a: `accepted` },
-        })
-        await fixture.sync.commit()
-        // Committed after the optimistic state dropped, so it is remote.
-        expect(fixture.collection.get(1)?.$origin).toBe(`remote`)
-        expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
-          ...initial,
-          a: `accepted`,
-        })
-      } finally {
-        done.forEach((entry) => entry.resolve())
-        await Promise.allSettled([
-          first.isPersisted.promise,
-          second.isPersisted.promise,
-        ])
-        await fixture.collection.cleanup()
-      }
-    },
-  )
+// The check: the public row for the key equals the model's owned row.
+function expectVisibleRow(
+  collection: ReturnType<typeof source>[`collection`],
+  expectedRow: Row,
+): void {
+  expect(stripVirtualProps(collection.get(1))).toEqual(expectedRow)
+}
 
-  it.each([false, true])(
-    `publishes the queued sync rows when its update settles, confirm=%s`,
-    async (confirm) => {
-      const done = createDeferred<void>()
-      const fixture = source(() => done.promise)
-      const downstream = createLiveQueryCollection({
-        query: (q) => q.from({ row: fixture.collection }),
-      })
-      await downstream.preload()
-      const replica = new Map<string | number, Row>([[1, initial]])
-      const subscription = fixture.collection.subscribeChanges((changes) => {
-        for (const change of changes) {
-          if (change.type === `delete`) replica.delete(change.key)
-          else replica.set(change.key, stripVirtualProps(change.value))
-        }
-      })
-      const check = (expected: Row) => {
-        expect(stripVirtualProps(fixture.collection.get(1))).toEqual(expected)
-        expect(replica.get(1)).toEqual(expected)
-        expect(stripVirtualProps(downstream.get(1))).toEqual(expected)
-      }
-      try {
-        const tx = fixture.collection.update(1, (row) => {
-          row.a = `a1`
-        })
-        check({ ...initial, a: `a1` })
-        fixture.sync.begin()
-        fixture.sync.write({ type: `update`, value: { ...initial, b: `b1` } })
-        const held = fixture.sync.commit()
-        expect(held).not.toBe(true)
-        check({ ...initial, a: `a1` })
-        let applied: true | Promise<void> = true
-        if (confirm) {
-          fixture.sync.begin()
-          fixture.sync.write({ type: `update`, value: { ...initial, a: `a1` } })
-          applied = fixture.sync.commit()
-          expect(applied).not.toBe(true)
-        }
-        done.resolve()
-        await tx.isPersisted.promise
-        await held
-        await applied
-        // The optimistic row drops, and the held sync rows publish with it.
-        check(confirm ? { ...initial, a: `a1` } : { ...initial, b: `b1` })
-      } finally {
-        done.resolve()
-        subscription.unsubscribe()
-        await downstream.cleanup()
-        await fixture.collection.cleanup()
-      }
-    },
-  )
+declareOracle({ check: [expectVisibleRow], model: [expectedOwnedRow] })
 
+describe(`optimistic snapshot ownership`, () => {
   it.each(cases)(
     `$order / $phase / rollback $removed / $fields`,
     async ({ order, phase, removed, fields }) => {
@@ -272,11 +94,7 @@ describe(`optimistic snapshot ownership`, () => {
         undefined,
       ]
       const expected = (excluded = -1) =>
-        snapshots.reduce<Row>(
-          (last, row, index) =>
-            row !== undefined && index !== excluded ? row : last,
-          initial,
-        )
+        expectedOwnedRow(snapshots, initial, excluded)
       try {
         await fixture.collection.preload()
         for (const index of order) {
@@ -290,12 +108,10 @@ describe(`optimistic snapshot ownership`, () => {
         if (phase === `persisting`) {
           for (const entry of pending) void entry.tx.commit().catch(() => {})
         }
-        expect(stripVirtualProps(fixture.collection.get(1))).toEqual(expected())
+        expectVisibleRow(fixture.collection, expected())
         // Isolate one rollback's projection; conflict-cascade policy is unchanged.
         pending[removed]!.tx.rollback({ isSecondaryRollback: true })
-        expect(stripVirtualProps(fixture.collection.get(1))).toEqual(
-          expected(removed),
-        )
+        expectVisibleRow(fixture.collection, expected(removed))
       } finally {
         for (const entry of pending) {
           entry.tx.rollback({ isSecondaryRollback: true })
@@ -306,126 +122,4 @@ describe(`optimistic snapshot ownership`, () => {
       }
     },
   )
-
-  it.each([`pending`, `persisting`] as const)(
-    `does not merge new synced fields into a $phase mutation snapshot`,
-    async (phase) => {
-      const fixture = source()
-      const entry = pendingTransaction()
-      try {
-        await fixture.collection.preload()
-        entry.tx.mutate(() =>
-          fixture.collection.update(1, (row) => {
-            row.a = `local`
-          }),
-        )
-        if (phase === `persisting`) void entry.tx.commit().catch(() => {})
-        // A persisting mutation holds the sync transaction; a pending one
-        // lets it apply beneath the overlay.
-        fixture.sync.begin()
-        fixture.sync.write({
-          type: `update`,
-          value: { ...initial, b: `remote` },
-        })
-        expect(fixture.sync.commit() === true).toBe(phase === `pending`)
-        expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
-          ...initial,
-          a: `local`,
-        })
-      } finally {
-        entry.tx.rollback()
-        entry.done.resolve()
-        await entry.settled
-        await fixture.collection.cleanup()
-      }
-    },
-  )
-
-  it(`keeps a settled direct update beneath an older pending update`, async () => {
-    const fixture = source()
-    const entry = pendingTransaction()
-    try {
-      await fixture.collection.preload()
-      entry.tx.mutate(() =>
-        fixture.collection.update(1, (row) => {
-          row.a = `local`
-        }),
-      )
-      void entry.tx.commit().catch(() => {})
-      const settled = fixture.collection.update(1, (row) => {
-        row.b = `settled`
-      })
-      await settled.isPersisted.promise
-      fixture.sync.begin()
-      fixture.sync.write({ type: `insert`, value: { ...initial, id: 2 } })
-      expect(fixture.sync.commit()).not.toBe(true)
-      expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
-        ...initial,
-        a: `local`,
-      })
-    } finally {
-      entry.tx.rollback()
-      entry.done.resolve()
-      await entry.settled
-      await fixture.collection.cleanup()
-    }
-  })
-
-  it(`preserves insert defaults and suppresses unchanged overlay publications`, async () => {
-    const collection = createCollection({
-      schema: z.object({
-        id: z.number(),
-        title: z.string(),
-        priority: z.number().default(3),
-      }),
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ begin, commit, markReady }) => {
-          begin()
-          commit()
-          markReady()
-        },
-      },
-    })
-    const entries = [
-      pendingTransaction(),
-      pendingTransaction(),
-      pendingTransaction(),
-    ]
-    try {
-      await collection.preload()
-      entries[0]!.tx.mutate(() => collection.insert({ id: 1, title: `first` }))
-      entries[1]!.tx.mutate(() =>
-        collection.update(1, (row) => {
-          row.title = `second`
-        }),
-      )
-      expect(stripVirtualProps(collection.get(1))).toEqual({
-        id: 1,
-        title: `second`,
-        priority: 3,
-      })
-      const before = collection.get(1)
-      const seen: Array<unknown> = []
-      const subscription = collection.subscribeChanges((changes) => {
-        seen.push(...changes.filter((change) => change.key === 1))
-      })
-      try {
-        entries[2]!.tx.mutate(() =>
-          collection.insert({ id: 2, title: `unrelated` }),
-        )
-        expect(collection.get(1)).toBe(before)
-        expect(seen).toEqual([])
-      } finally {
-        subscription.unsubscribe()
-      }
-    } finally {
-      for (const entry of entries) {
-        entry.tx.rollback({ isSecondaryRollback: true })
-        entry.done.resolve()
-      }
-      await Promise.all(entries.map((entry) => entry.settled))
-      await collection.cleanup()
-    }
-  })
 })
diff --git a/packages/db/tests/optimistic-composition.test.ts b/packages/db/tests/optimistic-composition.test.ts
new file mode 100644
index 0000000000..1a69a1ee6c
--- /dev/null
+++ b/packages/db/tests/optimistic-composition.test.ts
@@ -0,0 +1,303 @@
+/**
+ * Ordinary scenario tests for optimistic snapshot ownership: a failed update
+ * does not own a later remote write, a synchronous handler acknowledgement is
+ * local, and settled or ambient transactions keep the right owner. The
+ * ownership law is owned by optimistic-composition-oracle.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { z } from 'zod'
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import { createLiveQueryCollection } from '../src/query/index.js'
+import { stripVirtualProps } from './utils.js'
+import {
+  initial,
+  pendingTransaction,
+  source,
+} from './optimistic-composition-fixture.js'
+import type { Row } from './optimistic-composition-fixture.js'
+
+describe(`optimistic snapshot ownership`, () => {
+  it.each([false, true])(
+    `does not attribute a later remote write to a failed-only update, optimistic=%s`,
+    async (optimistic) => {
+      const done = createDeferred<void>()
+      const fixture = source(() => done.promise)
+      await fixture.collection.preload()
+      const tx = fixture.collection.update(1, { optimistic }, (row) => {
+        row.a = `failed`
+      })
+      const settled = tx.isPersisted.promise.catch(() => {})
+      try {
+        done.reject(new Error(`failed update`))
+        await settled
+        fixture.sync.begin()
+        fixture.sync.write({
+          type: `update`,
+          value: { ...initial, a: `remote` },
+        })
+        await fixture.sync.commit()
+        expect(fixture.collection.get(1)?.$origin).toBe(`remote`)
+      } finally {
+        done.resolve()
+        await fixture.collection.cleanup()
+      }
+    },
+  )
+
+  it.each([false, true])(
+    `attributes synchronous handler acknowledgement to its local update, optimistic=%s`,
+    async (optimistic) => {
+      const fixture = source(() => {
+        fixture.sync.begin()
+        fixture.sync.write({
+          type: `update`,
+          value: { ...initial, a: `accepted` },
+        })
+        void fixture.sync.commit()
+        return Promise.resolve()
+      })
+      await fixture.collection.preload()
+      try {
+        const tx = fixture.collection.update(1, { optimistic }, (row) => {
+          row.a = `accepted`
+        })
+        await tx.isPersisted.promise
+        expect(fixture.collection.get(1)?.$origin).toBe(`local`)
+        expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
+          ...initial,
+          a: `accepted`,
+        })
+      } finally {
+        await fixture.collection.cleanup()
+      }
+    },
+  )
+
+  it.each([false, true])(
+    `attributes a confirmation committed after settlement to the source, completed first=%s`,
+    async (completedFirst) => {
+      const done = [createDeferred<void>(), createDeferred<void>()]
+      let calls = 0
+      const fixture = source(() => done[calls++]!.promise)
+      await fixture.collection.preload()
+      const first = fixture.collection.update(
+        1,
+        { optimistic: false },
+        (row) => {
+          row.a = `accepted`
+        },
+      )
+      const second = fixture.collection.update(1, (row) => {
+        row.b = `rejected`
+      })
+      const secondSettled = second.isPersisted.promise.catch(() => {})
+      try {
+        if (completedFirst) {
+          done[0]!.resolve()
+          await first.isPersisted.promise
+        }
+        done[1]!.reject(new Error(`sibling failure`))
+        await secondSettled
+        if (!completedFirst) {
+          done[0]!.resolve()
+          await first.isPersisted.promise
+        }
+        fixture.sync.begin()
+        fixture.sync.write({
+          type: `update`,
+          value: { ...initial, a: `accepted` },
+        })
+        await fixture.sync.commit()
+        // Committed after the optimistic state dropped, so it is remote.
+        expect(fixture.collection.get(1)?.$origin).toBe(`remote`)
+        expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
+          ...initial,
+          a: `accepted`,
+        })
+      } finally {
+        done.forEach((entry) => entry.resolve())
+        await Promise.allSettled([
+          first.isPersisted.promise,
+          second.isPersisted.promise,
+        ])
+        await fixture.collection.cleanup()
+      }
+    },
+  )
+
+  it.each([false, true])(
+    `publishes the queued sync rows when its update settles, confirm=%s`,
+    async (confirm) => {
+      const done = createDeferred<void>()
+      const fixture = source(() => done.promise)
+      const downstream = createLiveQueryCollection({
+        query: (q) => q.from({ row: fixture.collection }),
+      })
+      await downstream.preload()
+      const replica = new Map<string | number, Row>([[1, initial]])
+      const subscription = fixture.collection.subscribeChanges((changes) => {
+        for (const change of changes) {
+          if (change.type === `delete`) replica.delete(change.key)
+          else replica.set(change.key, stripVirtualProps(change.value))
+        }
+      })
+      const check = (expected: Row) => {
+        expect(stripVirtualProps(fixture.collection.get(1))).toEqual(expected)
+        expect(replica.get(1)).toEqual(expected)
+        expect(stripVirtualProps(downstream.get(1))).toEqual(expected)
+      }
+      try {
+        const tx = fixture.collection.update(1, (row) => {
+          row.a = `a1`
+        })
+        check({ ...initial, a: `a1` })
+        fixture.sync.begin()
+        fixture.sync.write({ type: `update`, value: { ...initial, b: `b1` } })
+        const held = fixture.sync.commit()
+        expect(held).not.toBe(true)
+        check({ ...initial, a: `a1` })
+        let applied: true | Promise<void> = true
+        if (confirm) {
+          fixture.sync.begin()
+          fixture.sync.write({ type: `update`, value: { ...initial, a: `a1` } })
+          applied = fixture.sync.commit()
+          expect(applied).not.toBe(true)
+        }
+        done.resolve()
+        await tx.isPersisted.promise
+        await held
+        await applied
+        // The optimistic row drops, and the held sync rows publish with it.
+        check(confirm ? { ...initial, a: `a1` } : { ...initial, b: `b1` })
+      } finally {
+        done.resolve()
+        subscription.unsubscribe()
+        await downstream.cleanup()
+        await fixture.collection.cleanup()
+      }
+    },
+  )
+
+  it.each([`pending`, `persisting`] as const)(
+    `does not merge new synced fields into a $phase mutation snapshot`,
+    async (phase) => {
+      const fixture = source()
+      const entry = pendingTransaction()
+      try {
+        await fixture.collection.preload()
+        entry.tx.mutate(() =>
+          fixture.collection.update(1, (row) => {
+            row.a = `local`
+          }),
+        )
+        if (phase === `persisting`) void entry.tx.commit().catch(() => {})
+        // A persisting mutation holds the sync transaction; a pending one
+        // lets it apply beneath the overlay.
+        fixture.sync.begin()
+        fixture.sync.write({
+          type: `update`,
+          value: { ...initial, b: `remote` },
+        })
+        expect(fixture.sync.commit() === true).toBe(phase === `pending`)
+        expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
+          ...initial,
+          a: `local`,
+        })
+      } finally {
+        entry.tx.rollback()
+        entry.done.resolve()
+        await entry.settled
+        await fixture.collection.cleanup()
+      }
+    },
+  )
+
+  it(`keeps a settled direct update beneath an older pending update`, async () => {
+    const fixture = source()
+    const entry = pendingTransaction()
+    try {
+      await fixture.collection.preload()
+      entry.tx.mutate(() =>
+        fixture.collection.update(1, (row) => {
+          row.a = `local`
+        }),
+      )
+      void entry.tx.commit().catch(() => {})
+      const settled = fixture.collection.update(1, (row) => {
+        row.b = `settled`
+      })
+      await settled.isPersisted.promise
+      fixture.sync.begin()
+      fixture.sync.write({ type: `insert`, value: { ...initial, id: 2 } })
+      expect(fixture.sync.commit()).not.toBe(true)
+      expect(stripVirtualProps(fixture.collection.get(1))).toEqual({
+        ...initial,
+        a: `local`,
+      })
+    } finally {
+      entry.tx.rollback()
+      entry.done.resolve()
+      await entry.settled
+      await fixture.collection.cleanup()
+    }
+  })
+
+  it(`preserves insert defaults and suppresses unchanged overlay publications`, async () => {
+    const collection = createCollection({
+      schema: z.object({
+        id: z.number(),
+        title: z.string(),
+        priority: z.number().default(3),
+      }),
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ begin, commit, markReady }) => {
+          begin()
+          commit()
+          markReady()
+        },
+      },
+    })
+    const entries = [
+      pendingTransaction(),
+      pendingTransaction(),
+      pendingTransaction(),
+    ]
+    try {
+      await collection.preload()
+      entries[0]!.tx.mutate(() => collection.insert({ id: 1, title: `first` }))
+      entries[1]!.tx.mutate(() =>
+        collection.update(1, (row) => {
+          row.title = `second`
+        }),
+      )
+      expect(stripVirtualProps(collection.get(1))).toEqual({
+        id: 1,
+        title: `second`,
+        priority: 3,
+      })
+      const before = collection.get(1)
+      const seen: Array<unknown> = []
+      const subscription = collection.subscribeChanges((changes) => {
+        seen.push(...changes.filter((change) => change.key === 1))
+      })
+      try {
+        entries[2]!.tx.mutate(() =>
+          collection.insert({ id: 2, title: `unrelated` }),
+        )
+        expect(collection.get(1)).toBe(before)
+        expect(seen).toEqual([])
+      } finally {
+        subscription.unsubscribe()
+      }
+    } finally {
+      for (const entry of entries) {
+        entry.tx.rollback({ isSecondaryRollback: true })
+        entry.done.resolve()
+      }
+      await Promise.all(entries.map((entry) => entry.settled))
+      await collection.cleanup()
+    }
+  })
+})
diff --git a/packages/db/tests/optimistic-history-oracle.ts b/packages/db/tests/optimistic-history-oracle.ts
index c0ef2a5f5c..e0c98e7c65 100644
--- a/packages/db/tests/optimistic-history-oracle.ts
+++ b/packages/db/tests/optimistic-history-oracle.ts
@@ -7,6 +7,7 @@ import { createDeferred } from '../src/deferred.js'
 import { createLiveQueryCollection } from '../src/query/index.js'
 import { whenSyncAccepted } from '../src/sync-receipt.js'
 import { createTransaction } from '../src/transactions.js'
+import { declareOracle } from './oracle-declaration.js'
 import type { CollectionConfig, SyncConfig } from '../src/types.js'
 
 /**
@@ -1677,3 +1678,5 @@ export async function runOptimisticHistory(
     ],
   )
 }
+
+declareOracle({ check: [runOptimisticHistory], model: [HistoryModel] })
diff --git a/packages/db/tests/optimistic-history-outcomes-oracle.test.ts b/packages/db/tests/optimistic-history-outcomes-oracle.test.ts
index 44f9f75d7d..bbf329efd3 100644
--- a/packages/db/tests/optimistic-history-outcomes-oracle.test.ts
+++ b/packages/db/tests/optimistic-history-outcomes-oracle.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import fc from 'fast-check'
 import { createDeferred } from '../src/deferred.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import {
   expectHistoryOutcome,
   observeHistoryPromise,
@@ -27,6 +28,10 @@ import type {
  * and that a shrunk failure can be replayed by seed and path.
  */
 
+// The outcome checker is imported from the companion, which does not declare
+// it. This file's calibrations reach it through the same check.
+declareOracle({ check: [expectHistoryOutcome] })
+
 type Scenario = {
   existing: boolean
   optimistic: boolean
@@ -240,44 +245,6 @@ describe(`Outcome observer calibration`, () => {
     expect(replay.counterexample).toEqual(failed.counterexample)
     expect(replay.errorInstance).toMatchObject({ name: `AssertionError` })
   })
-  it.each([undefined, Object.freeze(new Error(`frozen primary`))])(
-    `retains primary %s and every cleanup failure`,
-    async (primary) => {
-      const cleanupError = new Error(`cleanup`)
-      const calls: Array<number> = []
-      const observed = observeHistoryPromise(
-        withHistoryCleanup(
-          () => Promise.reject(primary),
-          () => [
-            () => {
-              calls.push(1)
-              throw cleanupError
-            },
-            () => {
-              calls.push(2)
-              return Promise.reject(undefined)
-            },
-            () => {
-              calls.push(3)
-            },
-          ],
-        ),
-      )
-      await observed.settled
-      expect(calls).toEqual([1, 2, 3])
-      const result = observed.read()
-      expect(result.status).toBe(`rejected`)
-      if (result.status !== `rejected`)
-        throw new Error(`missing cleanup rejection`)
-      expect(result.reason).toBeInstanceOf(AggregateError)
-      const aggregate = result.reason as AggregateError
-      expect(aggregate.cause).toBe(primary)
-      expect(aggregate.errors).toHaveLength(3)
-      expect(aggregate.errors[0]).toBe(primary)
-      expect(aggregate.errors[1]).toBe(cleanupError)
-      expect(aggregate.errors[2]).toBeUndefined()
-    },
-  )
   it(`preserves successful results and single errors without wrappers`, async () => {
     const value = { id: 1 }
     expect(
diff --git a/packages/db/tests/optimistic-history-outcomes.test.ts b/packages/db/tests/optimistic-history-outcomes.test.ts
new file mode 100644
index 0000000000..57db0165bc
--- /dev/null
+++ b/packages/db/tests/optimistic-history-outcomes.test.ts
@@ -0,0 +1,51 @@
+/**
+ * Ordinary harness self-tests for the optimistic-history outcome driver: a
+ * cleanup failure keeps the primary failure and every cleanup failure. The
+ * outcome law is owned by optimistic-history-outcomes-oracle.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  observeHistoryPromise,
+  withHistoryCleanup,
+} from './optimistic-history-oracle.js'
+
+describe(`Outcome observer calibration`, () => {
+  it.each([undefined, Object.freeze(new Error(`frozen primary`))])(
+    `retains primary %s and every cleanup failure`,
+    async (primary) => {
+      const cleanupError = new Error(`cleanup`)
+      const calls: Array<number> = []
+      const observed = observeHistoryPromise(
+        withHistoryCleanup(
+          () => Promise.reject(primary),
+          () => [
+            () => {
+              calls.push(1)
+              throw cleanupError
+            },
+            () => {
+              calls.push(2)
+              return Promise.reject(undefined)
+            },
+            () => {
+              calls.push(3)
+            },
+          ],
+        ),
+      )
+      await observed.settled
+      expect(calls).toEqual([1, 2, 3])
+      const result = observed.read()
+      expect(result.status).toBe(`rejected`)
+      if (result.status !== `rejected`)
+        throw new Error(`missing cleanup rejection`)
+      expect(result.reason).toBeInstanceOf(AggregateError)
+      const aggregate = result.reason as AggregateError
+      expect(aggregate.cause).toBe(primary)
+      expect(aggregate.errors).toHaveLength(3)
+      expect(aggregate.errors[0]).toBe(primary)
+      expect(aggregate.errors[1]).toBe(cleanupError)
+      expect(aggregate.errors[2]).toBeUndefined()
+    },
+  )
+})
diff --git a/packages/db/tests/optimistic-transaction-oracle.property.test.ts b/packages/db/tests/optimistic-transaction-oracle.property.test.ts
index 0b9d8cad88..96e9c90cdc 100644
--- a/packages/db/tests/optimistic-transaction-oracle.property.test.ts
+++ b/packages/db/tests/optimistic-transaction-oracle.property.test.ts
@@ -11,9 +11,10 @@ import {
   withHistoryCleanup,
 } from './optimistic-history-oracle.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import type { Collection } from '../src/collection/index.js'
 import type { ChangeMessage, SyncConfig } from '../src/types.js'
-
+import type { ReplacementRow, Row } from './optimistic-transaction-support.js'
 /**
  * # Are transaction payloads and publications whole and ordered?
  *
@@ -42,7 +43,6 @@ import type { ChangeMessage, SyncConfig } from '../src/types.js'
  * transactions, or arbitrary overlapping same-key histories.
  */
 
-type Row = { id: number; value: number; note: string }
 type Operation = `insert` | `update` | `delete`
 type Scenario = {
   order: Array<Operation>
@@ -52,392 +52,6 @@ type Scenario = {
   note: string
 }
 
-/**
- * A failed synchronous mutate callback contributes no lasting intent. This
- * bounded history may author a valid update, then throws after a same-key
- * update, a distinct insert, or a delete. The reference retains only the
- * successful callbacks. The real manual transaction must expose those rows
- * and payload at the throw cut, then persist only successful callbacks. A
- * second witness crosses two Collections, including a subscriber failure
- * during restoration. This pending-transaction grammar does not claim to hide
- * events emitted during the failed callback.
- */
-describe(`failed manual mutation callback`, () => {
-  it(`does not copy prior mutations for a callback with no writes`, async () => {
-    const collection = createCollection<Row>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: (actions) => {
-          actions.begin()
-          actions.commit()
-          actions.markReady()
-        },
-      },
-    })
-    const tx = createTransaction<Row>({
-      autoCommit: false,
-      mutationFn: () => Promise.resolve(),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await collection.preload()
-        for (let id = 1; id <= 16; id++)
-          tx.mutate(() => collection.insert({ id, value: id, note: `prior` }))
-        const mutations = tx.mutations
-        let visits = 0
-        tx.mutations = new Proxy(mutations, {
-          get(target, property, receiver) {
-            if (property === Symbol.iterator)
-              return function* () {
-                for (const mutation of target) {
-                  visits++
-                  yield mutation
-                }
-              }
-            return Reflect.get(target, property, receiver)
-          },
-        })
-        for (let index = 0; index < 5; index++) tx.mutate(() => {})
-        expect(visits, `no snapshot traversal without a write`).toBe(0)
-        expect(tx.mutations).toHaveLength(16)
-        tx.mutations = mutations
-      },
-      () => [
-        () => tx.rollback({ isSecondaryRollback: true }),
-        () => collection.cleanup(),
-      ],
-    )
-  })
-
-  for (const failure of [
-    `same-key update`,
-    `distinct insert`,
-    `same-key delete`,
-  ] as const)
-    for (const prior of [false, true])
-      it(`restores ${prior ? `earlier intent` : `the base`} after ${failure}`, async () => {
-        const collection = createCollection<Row>({
-          getKey: (row) => row.id,
-          sync: {
-            sync: (actions) => {
-              actions.begin()
-              actions.write({
-                type: `insert`,
-                value: { id: 1, value: 0, note: `base` },
-              })
-              actions.commit()
-              actions.markReady()
-            },
-          },
-        })
-        const payloads: Array<Array<{ id: number; value: number }>> = []
-        const tx = createTransaction<Row>({
-          autoCommit: false,
-          mutationFn: ({ transaction }) => {
-            payloads.push(
-              transaction.mutations.map(({ modified }) => ({
-                id: modified.id,
-                value: modified.value,
-              })),
-            )
-            return Promise.resolve()
-          },
-        })
-        await withHistoryCleanup(
-          async () => {
-            await collection.preload()
-            if (prior)
-              tx.mutate(() =>
-                collection.update(1, (draft) => {
-                  draft.value = 1
-                }),
-              )
-            const failureReason = new Error(`callback failed`)
-            expect(() =>
-              tx.mutate(() => {
-                if (failure === `same-key update`)
-                  collection.update(1, (draft) => {
-                    draft.value = 2
-                  })
-                else if (failure === `distinct insert`)
-                  collection.insert({ id: 2, value: 2, note: `failed` })
-                else collection.delete(1)
-                throw failureReason
-              }),
-            ).toThrow(failureReason)
-            expect(collection.get(1)?.value, `successful row survives`).toBe(
-              prior ? 1 : 0,
-            )
-            expect(collection.get(2), `failed insert is absent`).toBeUndefined()
-            const survivingIntent = prior ? [{ id: 1, value: 1 }] : []
-            expect(
-              tx.mutations.map(({ modified }) => ({
-                id: modified.id,
-                value: modified.value,
-              })),
-              `failed intent is absent`,
-            ).toEqual(survivingIntent)
-            tx.mutate(() =>
-              collection.insert({ id: 3, value: 3, note: `later` }),
-            )
-            await tx.commit()
-            expect(payloads).toEqual([
-              [...survivingIntent, { id: 3, value: 3 }],
-            ])
-          },
-          () => [() => collection.cleanup()],
-        )
-      })
-
-  it(`restores every touched Collection and keeps earlier intent`, async () => {
-    const makeCollection = (id: string, initial: Array<Row>) =>
-      createCollection<Row>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (actions) => {
-            actions.begin()
-            for (const row of initial)
-              actions.write({ type: `insert`, value: row })
-            actions.commit()
-            actions.markReady()
-          },
-        },
-      })
-    const first = makeCollection(`failed-callback-first`, [
-      { id: 1, value: 0, note: `base` },
-    ])
-    const second = makeCollection(`failed-callback-second`, [])
-    const tx = createTransaction<Row>({
-      autoCommit: false,
-      mutationFn: () => Promise.resolve(),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await Promise.all([first.preload(), second.preload()])
-        tx.mutate(() =>
-          first.update(1, (draft) => {
-            draft.value = 1
-          }),
-        )
-        const failureReason = new Error(`callback failed`)
-        expect(() =>
-          tx.mutate(() => {
-            first.update(1, (draft) => {
-              draft.value = 2
-            })
-            second.insert({ id: 2, value: 2, note: `failed` })
-            throw failureReason
-          }),
-        ).toThrow(failureReason)
-        expect(first.get(1)?.value).toBe(1)
-        expect(second.get(2)).toBeUndefined()
-        expect(tx.mutations).toHaveLength(1)
-        await tx.commit()
-      },
-      () => [() => first.cleanup(), () => second.cleanup()],
-    )
-  })
-
-  it(`restores every Collection when one restoration listener throws`, async () => {
-    const makeCollection = (id: string) =>
-      createCollection<Row>({
-        id,
-        getKey: (row) => row.id,
-        sync: {
-          sync: (actions) => {
-            actions.begin()
-            actions.write({
-              type: `insert`,
-              value: { id: 1, value: 0, note: `base` },
-            })
-            actions.commit()
-            actions.markReady()
-          },
-        },
-      })
-    const first = makeCollection(`failed-listener-first`)
-    const second = makeCollection(`failed-listener-second`)
-    const tx = createTransaction<Row>({
-      autoCommit: false,
-      mutationFn: () => Promise.resolve(),
-    })
-    let subscription: ReturnType<typeof first.subscribeChanges> | undefined
-    await withHistoryCleanup(
-      async () => {
-        await Promise.all([first.preload(), second.preload()])
-        tx.mutate(() =>
-          first.update(1, (draft) => {
-            draft.value = 1
-          }),
-        )
-        const listenerFailure = new Error(`restoration listener failed`)
-        subscription = first.subscribeChanges(
-          (batch) => {
-            if (batch.some((change) => change.value.value === 1))
-              throw listenerFailure
-          },
-          { includeInitialState: false },
-        )
-        const callbackFailure = new Error(`callback failed`)
-        let thrown: unknown
-        try {
-          tx.mutate(() => {
-            first.update(1, (draft) => {
-              draft.value = 2
-            })
-            second.update(1, (draft) => {
-              draft.value = 2
-            })
-            throw callbackFailure
-          })
-        } catch (error) {
-          thrown = error
-        }
-        expect(thrown).toBeInstanceOf(AggregateError)
-        expect((thrown as AggregateError).cause).toBe(callbackFailure)
-        expect((thrown as AggregateError).errors).toContain(listenerFailure)
-        expect(first.get(1)?.value).toBe(1)
-        expect(second.get(1)?.value).toBe(0)
-        expect(tx.mutations.map(({ modified }) => modified.value)).toEqual([1])
-      },
-      () => [
-        () => subscription?.unsubscribe(),
-        () => first.cleanup(),
-        () => second.cleanup(),
-      ],
-    )
-  })
-
-  /**
-   * The transaction context belongs to the synchronous mutate callback. A
-   * subscriber responding to restoration runs after that callback has thrown,
-   * so its new write is independent. The reference classifies intent by the
-   * authoring action: the failed callback contributes none, while the later
-   * subscriber contributes its own row. At the throw and commit cuts, the
-   * failed transaction must not contain or persist the subscriber's row.
-   */
-  it(`keeps a restoration subscriber write out of the failed callback transaction`, async () => {
-    const collection = createCollection<Row>({
-      getKey: (row) => row.id,
-      onInsert: () => Promise.resolve(),
-      sync: {
-        sync: (actions) => {
-          actions.begin()
-          actions.write({
-            type: `insert`,
-            value: { id: 1, value: 0, note: `base` },
-          })
-          actions.commit()
-          actions.markReady()
-        },
-      },
-    })
-    const payloads: Array<Array<number>> = []
-    const tx = createTransaction<Row>({
-      autoCommit: false,
-      mutationFn: ({ transaction }) => {
-        payloads.push(transaction.mutations.map(({ modified }) => modified.id))
-        return Promise.resolve()
-      },
-    })
-    let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
-    await withHistoryCleanup(
-      async () => {
-        await collection.preload()
-        let restored = false
-        subscription = collection.subscribeChanges(
-          (batch) => {
-            if (
-              !restored &&
-              batch.some(
-                (change) => change.value.id === 1 && change.value.value === 0,
-              )
-            ) {
-              restored = true
-              collection.insert({ id: 3, value: 3, note: `subscriber` })
-            }
-          },
-          { includeInitialState: false },
-        )
-        const failure = new Error(`callback failed`)
-        expect(() =>
-          tx.mutate(() => {
-            collection.update(1, (draft) => {
-              draft.value = 2
-            })
-            throw failure
-          }),
-        ).toThrow(failure)
-        expect(restored, `restoration reached the subscriber`).toBe(true)
-        expect(collection.get(1)?.value).toBe(0)
-        expect(collection.get(3)?.value).toBe(3)
-        expect(
-          tx.mutations.map(({ modified }) => modified.id),
-          `subscriber intent has a separate owner`,
-        ).toEqual([])
-        await tx.commit()
-        expect(
-          payloads,
-          `failed transaction persisted no subscriber write`,
-        ).toEqual([])
-      },
-      () => [() => subscription?.unsubscribe(), () => collection.cleanup()],
-    )
-  })
-
-  /**
-   * Nested mutate calls use one transaction context per callback frame. After
-   * the inner frame returns or throws, the outer frame still owns later
-   * Collection writes. The reference retains the inner row only on success
-   * and always retains the outer row authored after the inner cut.
-   */
-  for (const nestedFails of [false, true])
-    it(`keeps the outer transaction active after a nested ${nestedFails ? `failure` : `success`}`, async () => {
-      const collection = createCollection<Row>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: (actions) => {
-            actions.begin()
-            actions.commit()
-            actions.markReady()
-          },
-        },
-      })
-      const payloads: Array<Array<number>> = []
-      const tx = createTransaction<Row>({
-        autoCommit: false,
-        mutationFn: ({ transaction }) => {
-          payloads.push(
-            transaction.mutations.map(({ modified }) => modified.id),
-          )
-          return Promise.resolve()
-        },
-      })
-      await withHistoryCleanup(
-        async () => {
-          await collection.preload()
-          tx.mutate(() => {
-            const inner = () =>
-              tx.mutate(() => {
-                collection.insert({ id: 2, value: 2, note: `inner` })
-                if (nestedFails) throw new Error(`inner failed`)
-              })
-            if (nestedFails) expect(inner).toThrow(`inner failed`)
-            else inner()
-            collection.insert({ id: 3, value: 3, note: `outer` })
-          })
-          const expected = nestedFails ? [3] : [2, 3]
-          expect(tx.mutations.map(({ modified }) => modified.id)).toEqual(
-            expected,
-          )
-          await tx.commit()
-          expect(payloads).toEqual([expected])
-        },
-        () => [() => collection.cleanup()],
-      )
-    })
-})
 type ObservationFault =
   | `missing-delete`
   | `untouched-field`
@@ -701,14 +315,6 @@ describe(`Same-key transaction laws`, () => {
   )
 })
 
-type ReplacementRow = {
-  id: number
-  value: number | null | undefined
-  note?: string | null
-  added?: string
-  nested?: { count: number }
-}
-
 type ReplacementMutation = {
   type: Operation
   original: object
@@ -1000,168 +606,6 @@ describe(`Delete then insert transaction laws`, () => {
       `after`,
     ])
   })
-
-  it(`delivers a replacement after duplicate deletes of another overlay`, async () => {
-    const original = { id: 1, value: 0, note: `original` }
-    const overlaid = { id: 1, value: 1, note: `original` }
-    const collection = createCollection<ReplacementRow, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: (actions) => {
-          actions.begin()
-          actions.write({ type: `insert`, value: original })
-          actions.commit()
-          actions.markReady()
-        },
-      },
-    })
-    let rejectOverlay!: (error: Error) => void
-    const overlayGate = new Promise<void>((_resolve, reject) => {
-      rejectOverlay = reject
-    })
-    const overlay = createTransaction<ReplacementRow>({
-      autoCommit: false,
-      mutationFn: () => overlayGate,
-    })
-    let deliveries = 0
-    let delivered: ReplacementRow | undefined
-    const replacement = createTransaction<ReplacementRow>({
-      autoCommit: false,
-      mutationFn: ({ transaction }) => {
-        deliveries++
-        delivered = transaction.mutations[0].modified
-        return Promise.resolve()
-      },
-    })
-    const overlaySettlement = overlay.isPersisted.promise.catch(() => undefined)
-    const replacementSettlement = replacement.isPersisted.promise.catch(
-      () => undefined,
-    )
-
-    await withHistoryCleanup(
-      async () => {
-        await collection.preload()
-        overlay.mutate(() =>
-          collection.update(1, (draft) => {
-            draft.value = 1
-          }),
-        )
-        const overlayCommit = overlay.commit().catch(() => undefined)
-        await Promise.resolve()
-
-        replacement.mutate(() => {
-          collection.delete([1, 1])
-          collection.insert(overlaid)
-        })
-        await replacement.commit()
-
-        expect(deliveries, `replacement persistence delivery count`).toBe(1)
-        expect(delivered, `replacement server payload`).toStrictEqual(overlaid)
-
-        rejectOverlay(new Error(`earlier overlay failed`))
-        await overlayCommit
-      },
-      () => [
-        () => {
-          if (overlay.state === `pending` || overlay.state === `persisting`)
-            overlay.rollback()
-        },
-        () => {
-          if (
-            replacement.state === `pending` ||
-            replacement.state === `persisting`
-          )
-            replacement.rollback()
-        },
-        () => rejectOverlay(new Error(`overlay test cleanup`)),
-        () => overlaySettlement,
-        () => replacementSettlement,
-        () => collection.cleanup(),
-      ],
-    )
-  })
-
-  it(`delivers a replacement equal only to another pending insert`, async () => {
-    const inserted = { id: 1, value: 1, note: `inserted` }
-    const collection = createCollection<ReplacementRow, number>({
-      getKey: (row) => row.id,
-      sync: {
-        sync: ({ markReady }) => markReady(),
-      },
-    })
-    let rejectInsert!: (error: Error) => void
-    const insertGate = new Promise<void>((_resolve, reject) => {
-      rejectInsert = reject
-    })
-    const pendingInsert = createTransaction<ReplacementRow>({
-      autoCommit: false,
-      mutationFn: () => insertGate,
-    })
-    let deliveries = 0
-    let delivered: { type: string; modified: ReplacementRow } | undefined
-    const replacement = createTransaction<ReplacementRow>({
-      autoCommit: false,
-      mutationFn: ({ transaction }) => {
-        deliveries++
-        const mutation = transaction.mutations[0]
-        delivered = {
-          type: mutation.type,
-          modified: mutation.modified,
-        }
-        return Promise.resolve()
-      },
-    })
-    const insertSettlement = pendingInsert.isPersisted.promise.catch(
-      () => undefined,
-    )
-    const replacementSettlement = replacement.isPersisted.promise.catch(
-      () => undefined,
-    )
-
-    await withHistoryCleanup(
-      async () => {
-        await collection.preload()
-        pendingInsert.mutate(() => collection.insert(inserted))
-        const insertCommit = pendingInsert.commit().catch(() => undefined)
-        await Promise.resolve()
-
-        replacement.mutate(() => {
-          collection.delete(1)
-          collection.insert(inserted)
-        })
-        await replacement.commit()
-
-        expect(deliveries, `replacement persistence delivery count`).toBe(1)
-        expect(delivered, `replacement server mutation`).toStrictEqual({
-          type: `insert`,
-          modified: inserted,
-        })
-
-        rejectInsert(new Error(`earlier insert failed`))
-        await insertCommit
-      },
-      () => [
-        () => {
-          if (
-            pendingInsert.state === `pending` ||
-            pendingInsert.state === `persisting`
-          )
-            pendingInsert.rollback()
-        },
-        () => {
-          if (
-            replacement.state === `pending` ||
-            replacement.state === `persisting`
-          )
-            replacement.rollback()
-        },
-        () => rejectInsert(new Error(`insert test cleanup`)),
-        () => insertSettlement,
-        () => replacementSettlement,
-        () => collection.cleanup(),
-      ],
-    )
-  })
 })
 
 // Observe user fields without discarding unexpected fields or undefined keys.
@@ -1595,6 +1039,20 @@ describe(`Whole mixed transaction publication`, () => {
   )
 })
 
+// The authored key list, in order and with multiplicity, is the payload that
+// the handler receives for a transaction of this operation. A repeated update
+// reaches the handler as one update, and a delete carries no value.
+function expectedTypedKeyPayload(
+  keys: ReadonlyArray<string | number>,
+  operation: `insert` | `update` | `delete` | `repeat`,
+): Array<{ key: string | number; type: string; value: number }> {
+  return keys.map((key, index) => ({
+    key,
+    type: operation === `repeat` ? `update` : operation,
+    value: operation === `delete` ? 0 : index + 10,
+  }))
+}
+
 // Typed keys retain their identity through a whole transaction. The independent
 // expected payload is the authored key list, including multiplicity and order;
 // no encoded production globalKey participates in the comparison. Cross each
@@ -1682,11 +1140,7 @@ for (const { numberKey, reversed } of [0, -1, 1, 1.5].flatMap((key) =>
             await committed.settled
             await persisted.settled
             expect(payload, `handler payload retains typed keys`).toEqual(
-              keys.map((key, index) => ({
-                key,
-                type: operation === `repeat` ? `update` : operation,
-                value: operation === `delete` ? 0 : index + 10,
-              })),
+              expectedTypedKeyPayload(keys, operation),
             )
             const expected = success ? proposed : initial
             expect(source.size).toBe(expected.length)
@@ -1699,3 +1153,11 @@ for (const { numberKey, reversed } of [0, -1, 1, 1.5].flatMap((key) =>
     }
   }
 }
+
+// The check drivers run one history and compare its public observations with
+// the expected world they compute from the scenario. The typed-key payload model
+// is the authored key list.
+declareOracle({
+  check: [runTransaction, runSameKey, runDeleteInsertReplacement],
+  model: [expectedTypedKeyPayload],
+})
diff --git a/packages/db/tests/optimistic-transaction-support.ts b/packages/db/tests/optimistic-transaction-support.ts
new file mode 100644
index 0000000000..53cb74f956
--- /dev/null
+++ b/packages/db/tests/optimistic-transaction-support.ts
@@ -0,0 +1,12 @@
+// Row shapes shared by the optimistic transaction tests. The law and its oracle
+// are in optimistic-transaction-oracle.property.test.ts.
+
+export type Row = { id: number; value: number; note: string }
+
+export type ReplacementRow = {
+  id: number
+  value: number | null | undefined
+  note?: string | null
+  added?: string
+  nested?: { count: number }
+}
diff --git a/packages/db/tests/optimistic-transaction.test.ts b/packages/db/tests/optimistic-transaction.test.ts
new file mode 100644
index 0000000000..940884af7a
--- /dev/null
+++ b/packages/db/tests/optimistic-transaction.test.ts
@@ -0,0 +1,560 @@
+// Ordinary tests for manual transactions: fixed failed-callback and replacement
+// histories with literal expectations. They are supplemental coverage. The
+// transaction laws are owned by optimistic-transaction-oracle.property.test.ts,
+// and the optimistic snapshot law by optimistic-history-oracle.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { createTransaction } from '../src/transactions.js'
+import { withHistoryCleanup } from './optimistic-history-oracle.js'
+import type { ReplacementRow, Row } from './optimistic-transaction-support.js'
+
+/**
+ * A failed synchronous mutate callback contributes no lasting intent. This
+ * bounded history may author a valid update, then throws after a same-key
+ * update, a distinct insert, or a delete. The reference retains only the
+ * successful callbacks. The real manual transaction must expose those rows
+ * and payload at the throw cut, then persist only successful callbacks. A
+ * second witness crosses two Collections, including a subscriber failure
+ * during restoration. This pending-transaction grammar does not claim to hide
+ * events emitted during the failed callback.
+ */
+describe(`failed manual mutation callback`, () => {
+  it(`does not copy prior mutations for a callback with no writes`, async () => {
+    const collection = createCollection<Row>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: (actions) => {
+          actions.begin()
+          actions.commit()
+          actions.markReady()
+        },
+      },
+    })
+    const tx = createTransaction<Row>({
+      autoCommit: false,
+      mutationFn: () => Promise.resolve(),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await collection.preload()
+        for (let id = 1; id <= 16; id++)
+          tx.mutate(() => collection.insert({ id, value: id, note: `prior` }))
+        const mutations = tx.mutations
+        let visits = 0
+        tx.mutations = new Proxy(mutations, {
+          get(target, property, receiver) {
+            if (property === Symbol.iterator)
+              return function* () {
+                for (const mutation of target) {
+                  visits++
+                  yield mutation
+                }
+              }
+            return Reflect.get(target, property, receiver)
+          },
+        })
+        for (let index = 0; index < 5; index++) tx.mutate(() => {})
+        expect(visits, `no snapshot traversal without a write`).toBe(0)
+        expect(tx.mutations).toHaveLength(16)
+        tx.mutations = mutations
+      },
+      () => [
+        () => tx.rollback({ isSecondaryRollback: true }),
+        () => collection.cleanup(),
+      ],
+    )
+  })
+
+  for (const failure of [
+    `same-key update`,
+    `distinct insert`,
+    `same-key delete`,
+  ] as const)
+    for (const prior of [false, true])
+      it(`restores ${prior ? `earlier intent` : `the base`} after ${failure}`, async () => {
+        const collection = createCollection<Row>({
+          getKey: (row) => row.id,
+          sync: {
+            sync: (actions) => {
+              actions.begin()
+              actions.write({
+                type: `insert`,
+                value: { id: 1, value: 0, note: `base` },
+              })
+              actions.commit()
+              actions.markReady()
+            },
+          },
+        })
+        const payloads: Array<Array<{ id: number; value: number }>> = []
+        const tx = createTransaction<Row>({
+          autoCommit: false,
+          mutationFn: ({ transaction }) => {
+            payloads.push(
+              transaction.mutations.map(({ modified }) => ({
+                id: modified.id,
+                value: modified.value,
+              })),
+            )
+            return Promise.resolve()
+          },
+        })
+        await withHistoryCleanup(
+          async () => {
+            await collection.preload()
+            if (prior)
+              tx.mutate(() =>
+                collection.update(1, (draft) => {
+                  draft.value = 1
+                }),
+              )
+            const failureReason = new Error(`callback failed`)
+            expect(() =>
+              tx.mutate(() => {
+                if (failure === `same-key update`)
+                  collection.update(1, (draft) => {
+                    draft.value = 2
+                  })
+                else if (failure === `distinct insert`)
+                  collection.insert({ id: 2, value: 2, note: `failed` })
+                else collection.delete(1)
+                throw failureReason
+              }),
+            ).toThrow(failureReason)
+            expect(collection.get(1)?.value, `successful row survives`).toBe(
+              prior ? 1 : 0,
+            )
+            expect(collection.get(2), `failed insert is absent`).toBeUndefined()
+            const survivingIntent = prior ? [{ id: 1, value: 1 }] : []
+            expect(
+              tx.mutations.map(({ modified }) => ({
+                id: modified.id,
+                value: modified.value,
+              })),
+              `failed intent is absent`,
+            ).toEqual(survivingIntent)
+            tx.mutate(() =>
+              collection.insert({ id: 3, value: 3, note: `later` }),
+            )
+            await tx.commit()
+            expect(payloads).toEqual([
+              [...survivingIntent, { id: 3, value: 3 }],
+            ])
+          },
+          () => [() => collection.cleanup()],
+        )
+      })
+
+  it(`restores every touched Collection and keeps earlier intent`, async () => {
+    const makeCollection = (id: string, initial: Array<Row>) =>
+      createCollection<Row>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (actions) => {
+            actions.begin()
+            for (const row of initial)
+              actions.write({ type: `insert`, value: row })
+            actions.commit()
+            actions.markReady()
+          },
+        },
+      })
+    const first = makeCollection(`failed-callback-first`, [
+      { id: 1, value: 0, note: `base` },
+    ])
+    const second = makeCollection(`failed-callback-second`, [])
+    const tx = createTransaction<Row>({
+      autoCommit: false,
+      mutationFn: () => Promise.resolve(),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await Promise.all([first.preload(), second.preload()])
+        tx.mutate(() =>
+          first.update(1, (draft) => {
+            draft.value = 1
+          }),
+        )
+        const failureReason = new Error(`callback failed`)
+        expect(() =>
+          tx.mutate(() => {
+            first.update(1, (draft) => {
+              draft.value = 2
+            })
+            second.insert({ id: 2, value: 2, note: `failed` })
+            throw failureReason
+          }),
+        ).toThrow(failureReason)
+        expect(first.get(1)?.value).toBe(1)
+        expect(second.get(2)).toBeUndefined()
+        expect(tx.mutations).toHaveLength(1)
+        await tx.commit()
+      },
+      () => [() => first.cleanup(), () => second.cleanup()],
+    )
+  })
+
+  it(`restores every Collection when one restoration listener throws`, async () => {
+    const makeCollection = (id: string) =>
+      createCollection<Row>({
+        id,
+        getKey: (row) => row.id,
+        sync: {
+          sync: (actions) => {
+            actions.begin()
+            actions.write({
+              type: `insert`,
+              value: { id: 1, value: 0, note: `base` },
+            })
+            actions.commit()
+            actions.markReady()
+          },
+        },
+      })
+    const first = makeCollection(`failed-listener-first`)
+    const second = makeCollection(`failed-listener-second`)
+    const tx = createTransaction<Row>({
+      autoCommit: false,
+      mutationFn: () => Promise.resolve(),
+    })
+    let subscription: ReturnType<typeof first.subscribeChanges> | undefined
+    await withHistoryCleanup(
+      async () => {
+        await Promise.all([first.preload(), second.preload()])
+        tx.mutate(() =>
+          first.update(1, (draft) => {
+            draft.value = 1
+          }),
+        )
+        const listenerFailure = new Error(`restoration listener failed`)
+        subscription = first.subscribeChanges(
+          (batch) => {
+            if (batch.some((change) => change.value.value === 1))
+              throw listenerFailure
+          },
+          { includeInitialState: false },
+        )
+        const callbackFailure = new Error(`callback failed`)
+        let thrown: unknown
+        try {
+          tx.mutate(() => {
+            first.update(1, (draft) => {
+              draft.value = 2
+            })
+            second.update(1, (draft) => {
+              draft.value = 2
+            })
+            throw callbackFailure
+          })
+        } catch (error) {
+          thrown = error
+        }
+        expect(thrown).toBeInstanceOf(AggregateError)
+        expect((thrown as AggregateError).cause).toBe(callbackFailure)
+        expect((thrown as AggregateError).errors).toContain(listenerFailure)
+        expect(first.get(1)?.value).toBe(1)
+        expect(second.get(1)?.value).toBe(0)
+        expect(tx.mutations.map(({ modified }) => modified.value)).toEqual([1])
+      },
+      () => [
+        () => subscription?.unsubscribe(),
+        () => first.cleanup(),
+        () => second.cleanup(),
+      ],
+    )
+  })
+
+  /**
+   * The transaction context belongs to the synchronous mutate callback. A
+   * subscriber responding to restoration runs after that callback has thrown,
+   * so its new write is independent. The reference classifies intent by the
+   * authoring action: the failed callback contributes none, while the later
+   * subscriber contributes its own row. At the throw and commit cuts, the
+   * failed transaction must not contain or persist the subscriber's row.
+   */
+  it(`keeps a restoration subscriber write out of the failed callback transaction`, async () => {
+    const collection = createCollection<Row>({
+      getKey: (row) => row.id,
+      onInsert: () => Promise.resolve(),
+      sync: {
+        sync: (actions) => {
+          actions.begin()
+          actions.write({
+            type: `insert`,
+            value: { id: 1, value: 0, note: `base` },
+          })
+          actions.commit()
+          actions.markReady()
+        },
+      },
+    })
+    const payloads: Array<Array<number>> = []
+    const tx = createTransaction<Row>({
+      autoCommit: false,
+      mutationFn: ({ transaction }) => {
+        payloads.push(transaction.mutations.map(({ modified }) => modified.id))
+        return Promise.resolve()
+      },
+    })
+    let subscription: ReturnType<typeof collection.subscribeChanges> | undefined
+    await withHistoryCleanup(
+      async () => {
+        await collection.preload()
+        let restored = false
+        subscription = collection.subscribeChanges(
+          (batch) => {
+            if (
+              !restored &&
+              batch.some(
+                (change) => change.value.id === 1 && change.value.value === 0,
+              )
+            ) {
+              restored = true
+              collection.insert({ id: 3, value: 3, note: `subscriber` })
+            }
+          },
+          { includeInitialState: false },
+        )
+        const failure = new Error(`callback failed`)
+        expect(() =>
+          tx.mutate(() => {
+            collection.update(1, (draft) => {
+              draft.value = 2
+            })
+            throw failure
+          }),
+        ).toThrow(failure)
+        expect(restored, `restoration reached the subscriber`).toBe(true)
+        expect(collection.get(1)?.value).toBe(0)
+        expect(collection.get(3)?.value).toBe(3)
+        expect(
+          tx.mutations.map(({ modified }) => modified.id),
+          `subscriber intent has a separate owner`,
+        ).toEqual([])
+        await tx.commit()
+        expect(
+          payloads,
+          `failed transaction persisted no subscriber write`,
+        ).toEqual([])
+      },
+      () => [() => subscription?.unsubscribe(), () => collection.cleanup()],
+    )
+  })
+
+  /**
+   * Nested mutate calls use one transaction context per callback frame. After
+   * the inner frame returns or throws, the outer frame still owns later
+   * Collection writes. The reference retains the inner row only on success
+   * and always retains the outer row authored after the inner cut.
+   */
+  for (const nestedFails of [false, true])
+    it(`keeps the outer transaction active after a nested ${nestedFails ? `failure` : `success`}`, async () => {
+      const collection = createCollection<Row>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: (actions) => {
+            actions.begin()
+            actions.commit()
+            actions.markReady()
+          },
+        },
+      })
+      const payloads: Array<Array<number>> = []
+      const tx = createTransaction<Row>({
+        autoCommit: false,
+        mutationFn: ({ transaction }) => {
+          payloads.push(
+            transaction.mutations.map(({ modified }) => modified.id),
+          )
+          return Promise.resolve()
+        },
+      })
+      await withHistoryCleanup(
+        async () => {
+          await collection.preload()
+          tx.mutate(() => {
+            const inner = () =>
+              tx.mutate(() => {
+                collection.insert({ id: 2, value: 2, note: `inner` })
+                if (nestedFails) throw new Error(`inner failed`)
+              })
+            if (nestedFails) expect(inner).toThrow(`inner failed`)
+            else inner()
+            collection.insert({ id: 3, value: 3, note: `outer` })
+          })
+          const expected = nestedFails ? [3] : [2, 3]
+          expect(tx.mutations.map(({ modified }) => modified.id)).toEqual(
+            expected,
+          )
+          await tx.commit()
+          expect(payloads).toEqual([expected])
+        },
+        () => [() => collection.cleanup()],
+      )
+    })
+})
+
+describe(`Delete then insert transaction laws`, () => {
+  it(`delivers a replacement after duplicate deletes of another overlay`, async () => {
+    const original = { id: 1, value: 0, note: `original` }
+    const overlaid = { id: 1, value: 1, note: `original` }
+    const collection = createCollection<ReplacementRow, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: (actions) => {
+          actions.begin()
+          actions.write({ type: `insert`, value: original })
+          actions.commit()
+          actions.markReady()
+        },
+      },
+    })
+    let rejectOverlay!: (error: Error) => void
+    const overlayGate = new Promise<void>((_resolve, reject) => {
+      rejectOverlay = reject
+    })
+    const overlay = createTransaction<ReplacementRow>({
+      autoCommit: false,
+      mutationFn: () => overlayGate,
+    })
+    let deliveries = 0
+    let delivered: ReplacementRow | undefined
+    const replacement = createTransaction<ReplacementRow>({
+      autoCommit: false,
+      mutationFn: ({ transaction }) => {
+        deliveries++
+        delivered = transaction.mutations[0].modified
+        return Promise.resolve()
+      },
+    })
+    const overlaySettlement = overlay.isPersisted.promise.catch(() => undefined)
+    const replacementSettlement = replacement.isPersisted.promise.catch(
+      () => undefined,
+    )
+
+    await withHistoryCleanup(
+      async () => {
+        await collection.preload()
+        overlay.mutate(() =>
+          collection.update(1, (draft) => {
+            draft.value = 1
+          }),
+        )
+        const overlayCommit = overlay.commit().catch(() => undefined)
+        await Promise.resolve()
+
+        replacement.mutate(() => {
+          collection.delete([1, 1])
+          collection.insert(overlaid)
+        })
+        await replacement.commit()
+
+        expect(deliveries, `replacement persistence delivery count`).toBe(1)
+        expect(delivered, `replacement server payload`).toStrictEqual(overlaid)
+
+        rejectOverlay(new Error(`earlier overlay failed`))
+        await overlayCommit
+      },
+      () => [
+        () => {
+          if (overlay.state === `pending` || overlay.state === `persisting`)
+            overlay.rollback()
+        },
+        () => {
+          if (
+            replacement.state === `pending` ||
+            replacement.state === `persisting`
+          )
+            replacement.rollback()
+        },
+        () => rejectOverlay(new Error(`overlay test cleanup`)),
+        () => overlaySettlement,
+        () => replacementSettlement,
+        () => collection.cleanup(),
+      ],
+    )
+  })
+
+  it(`delivers a replacement equal only to another pending insert`, async () => {
+    const inserted = { id: 1, value: 1, note: `inserted` }
+    const collection = createCollection<ReplacementRow, number>({
+      getKey: (row) => row.id,
+      sync: {
+        sync: ({ markReady }) => markReady(),
+      },
+    })
+    let rejectInsert!: (error: Error) => void
+    const insertGate = new Promise<void>((_resolve, reject) => {
+      rejectInsert = reject
+    })
+    const pendingInsert = createTransaction<ReplacementRow>({
+      autoCommit: false,
+      mutationFn: () => insertGate,
+    })
+    let deliveries = 0
+    let delivered: { type: string; modified: ReplacementRow } | undefined
+    const replacement = createTransaction<ReplacementRow>({
+      autoCommit: false,
+      mutationFn: ({ transaction }) => {
+        deliveries++
+        const mutation = transaction.mutations[0]
+        delivered = {
+          type: mutation.type,
+          modified: mutation.modified,
+        }
+        return Promise.resolve()
+      },
+    })
+    const insertSettlement = pendingInsert.isPersisted.promise.catch(
+      () => undefined,
+    )
+    const replacementSettlement = replacement.isPersisted.promise.catch(
+      () => undefined,
+    )
+
+    await withHistoryCleanup(
+      async () => {
+        await collection.preload()
+        pendingInsert.mutate(() => collection.insert(inserted))
+        const insertCommit = pendingInsert.commit().catch(() => undefined)
+        await Promise.resolve()
+
+        replacement.mutate(() => {
+          collection.delete(1)
+          collection.insert(inserted)
+        })
+        await replacement.commit()
+
+        expect(deliveries, `replacement persistence delivery count`).toBe(1)
+        expect(delivered, `replacement server mutation`).toStrictEqual({
+          type: `insert`,
+          modified: inserted,
+        })
+
+        rejectInsert(new Error(`earlier insert failed`))
+        await insertCommit
+      },
+      () => [
+        () => {
+          if (
+            pendingInsert.state === `pending` ||
+            pendingInsert.state === `persisting`
+          )
+            pendingInsert.rollback()
+        },
+        () => {
+          if (
+            replacement.state === `pending` ||
+            replacement.state === `persisting`
+          )
+            replacement.rollback()
+        },
+        () => rejectInsert(new Error(`insert test cleanup`)),
+        () => insertSettlement,
+        () => replacementSettlement,
+        () => collection.cleanup(),
+      ],
+    )
+  })
+})
diff --git a/packages/db/tests/oracle-config.ts b/packages/db/tests/oracle-config.ts
index e250dd684b..f950fea895 100644
--- a/packages/db/tests/oracle-config.ts
+++ b/packages/db/tests/oracle-config.ts
@@ -5,6 +5,9 @@ export { recordOracleReplay } from './oracle-replay-witness.js'
 type OracleEnvironment = Record<string, string | undefined>
 
 const staticOracleProperties = [
+  `lint.part-reach`,
+  `scripts.lint-scope`,
+  `scripts.run-budget`,
   `react.ssr-ordinary`,
   `react.ssr-infinite`,
   `react.ssr-stream-cut`,
@@ -713,6 +716,8 @@ export function oracleCalibrationTest<TRegistration extends { skip: unknown }>(
   return standsAside ? (registration.skip as TRegistration) : registration
 }
 
+export { declareOracle } from './oracle-declaration.js'
+
 /** Keeps ordinary CI bounded while allowing long randomized oracle campaigns. */
 export function oracleRuns(baseRuns: number): number {
   return baseRuns * multiplier
diff --git a/packages/db/tests/oracle-declaration.ts b/packages/db/tests/oracle-declaration.ts
new file mode 100644
index 0000000000..f56143d90e
--- /dev/null
+++ b/packages/db/tests/oracle-declaration.ts
@@ -0,0 +1,31 @@
+// declareOracle has no imports, so a module that runs in a browser or a
+// native app can declare its parts without loading the Node-only replay
+// machinery in oracle-config.ts.
+
+/** A function or class that an oracle declares as one of its parts. */
+type OraclePart =
+  ((...args: never) => unknown) | (abstract new (...args: never) => unknown)
+
+/**
+ * Names the parts of an oracle that this module defines: its check, which
+ * compares production observations with the model or with a second
+ * formulation; its model; and its history grammar, the generators that
+ * produce legal histories. A type-level oracle names its model types in
+ * `typeModel`. Each is optional: a differential or metamorphic
+ * oracle has no model, and a companion module can hold only one part.
+ *
+ * Every test in an oracle file must use a declared part, directly or through
+ * a driver. A test that uses none compares production with a hand-written
+ * value: it is a unit test, and belongs in an ordinary test file. The
+ * `oracle/no-unit-test` lint rule reads this call. It does nothing at run
+ * time.
+ */
+export function declareOracle(_parts: {
+  check?: ReadonlyArray<OraclePart>
+  model?: ReadonlyArray<OraclePart>
+  // A grammar part is often a fast-check arbitrary, not a function.
+  grammar?: ReadonlyArray<object>
+  // A type-level oracle's model is a type, which has no value to pass, so it
+  // is named: each name is a type alias or interface in the same file.
+  typeModel?: ReadonlyArray<string>
+}): void {}
diff --git a/packages/db/tests/oracle-replay-manifest.ts b/packages/db/tests/oracle-replay-manifest.ts
index ad9be3dc1d..13e1bd2322 100644
--- a/packages/db/tests/oracle-replay-manifest.ts
+++ b/packages/db/tests/oracle-replay-manifest.ts
@@ -9,9 +9,17 @@ import { registeredOracleProperties } from './oracle-config.js'
  */
 // Each group is [owner file, prefix, suffixes] and, when the owner runs the
 // properties from another module, the module that names them.
+// A property whose owner lives outside packages/ names it with a `../` prefix.
 const ownerGroups: ReadonlyArray<
   readonly [string, string, string] | readonly [string, string, string, string]
 > = [
+  [
+    `../scripts/eslint-plugin-oracle/part-reach-oracle.property.test.js`,
+    `lint`,
+    `part-reach`,
+  ],
+  [`../scripts/run-budget-oracle.property.test.js`, `scripts`, `run-budget`],
+  [`../scripts/lint-scope-oracle.property.test.js`, `scripts`, `lint-scope`],
   [
     `db/tests/ssr-stream-record-wait-oracle.test.ts`,
     `ssr`,
@@ -362,7 +370,12 @@ const ownerGroups: ReadonlyArray<
   [
     `db-sqlite-persistence-core/tests/persisted-oracle.test.ts`,
     `persistence`,
-    `generation-notice follower-remote-demand`,
+    `follower-remote-demand`,
+  ],
+  [
+    `db-sqlite-persistence-core/tests/persisted-oracle.test.ts`,
+    `persistence`,
+    `generation-notice`,
   ],
   [
     `db-sqlite-persistence-core/tests/persisted-optimistic-history.test.ts`,
@@ -476,6 +489,7 @@ const ownerGroups: ReadonlyArray<
     `db/tests/proxy-native-methods-oracle.property.test.ts`,
     `proxy`,
     `native-array-methods native-typed-methods`,
+    `db/tests/proxy-native-methods-fixture.ts`,
   ],
   [
     `db-ivm/tests/hash-identity-oracle.property.test.ts`,
@@ -495,7 +509,12 @@ const ownerGroups: ReadonlyArray<
   [
     `electric-db-collection/tests/pg-serializer-oracle.property.test.ts`,
     `pg-serializer`,
-    `array-determinism bigint-round-trip bigint-text boolean-array-contents boolean-round-trip boolean-tokens date-iso date-round-trip double-round-trip integer-array-contents integer-array-format integer-round-trip integer-text mixed-array-contents nullish-array-contents nullish-empty scalar-determinism string-array-contents string-escaping string-idempotent string-passthrough`,
+    `array-determinism bigint-round-trip bigint-text boolean-array-contents boolean-round-trip boolean-tokens date-iso date-round-trip double-round-trip integer-array-contents integer-array-format integer-round-trip integer-text mixed-array-contents nullish-array-contents scalar-determinism string-array-contents string-escaping string-idempotent string-passthrough`,
+  ],
+  [
+    `electric-db-collection/tests/pg-serializer.test.ts`,
+    `pg-serializer`,
+    `nullish-empty`,
   ],
   [
     `db-ivm/tests/index-refinement-oracle.property.test.ts`,
@@ -801,6 +820,14 @@ function directReplayTestName(property: string): string | undefined {
   return replayTestNames.get(property)
 }
 
+/**
+ * The Vitest config for a directory outside packages/ whose config does not
+ * have a default name. Its owners replay with `--config`.
+ */
+const outsideReplayConfigs = new Map([
+  [`scripts`, `oracle-scripts.vitest.config.mjs`],
+])
+
 export const oracleReplayManifest: ReadonlyArray<OracleReplayManifestEntry> = [
   ...registeredOracleProperties,
 ].map((property) => {
@@ -816,7 +843,15 @@ export const oracleReplayManifest: ReadonlyArray<OracleReplayManifestEntry> = [
               property.endsWith(`.scenario-statistics`)
             ? `statistics-only`
             : `assertion`
-  const cwd = file?.split(`/`).slice(0, 2).join(`/`)
+  const outsidePackages = file?.startsWith(`packages/../`) === true
+  // An owner outside packages/ replays from its own directory, with the
+  // Vitest config that includes it there.
+  const outsidePath = file?.slice(`packages/../`.length)
+  const cwd = outsidePackages
+    ? outsidePath!.slice(0, outsidePath!.lastIndexOf(`/`))
+    : file?.split(`/`).slice(0, 2).join(`/`)
+  const outsideConfig =
+    cwd === undefined ? undefined : outsideReplayConfigs.get(cwd)
   return {
     property,
     status,
@@ -831,7 +866,9 @@ export const oracleReplayManifest: ReadonlyArray<OracleReplayManifestEntry> = [
           ? `pnpm exec playwright test --config playwright.indexed-db.config.ts ${file.split(`/`).slice(2).join(`/`)}`
           : status === `seed-replay`
             ? `pnpm exec vitest run ${file.split(`/`).slice(2).join(`/`)}`
-            : `node --import tsx ${cwd === `packages/db` ? `tests` : `../db/tests`}/oracle-replay.ts ${file.split(`/`).slice(2).join(`/`)}`,
+            : outsidePackages
+              ? `node --import tsx ${`../`.repeat(cwd!.split(`/`).length)}packages/db/tests/oracle-replay.ts ${outsideConfig === undefined ? `` : `--config ${outsideConfig} `}${file.split(`/`).pop()}`
+              : `node --import tsx ${cwd === `packages/db` ? `tests` : `../db/tests`}/oracle-replay.ts ${file.split(`/`).slice(2).join(`/`)}`,
     environment:
       status === `statistics-only`
         ? [
diff --git a/packages/db/tests/oracle-replay.test.ts b/packages/db/tests/oracle-replay.test.ts
index dd26c2d1a9..5ffec311db 100644
--- a/packages/db/tests/oracle-replay.test.ts
+++ b/packages/db/tests/oracle-replay.test.ts
@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process'
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { setImmediate } from 'node:timers/promises'
@@ -453,6 +453,56 @@ describe(`named oracle replay manifest`, () => {
     }
   })
 
+  it(`replays every owner from a directory where its command finds the owner`, () => {
+    // A replay command runs from its entry's cwd. From the wrong directory,
+    // the runner's file filter matches no test file, and the replay reports
+    // only that its target never executed. So, for every owner, each file
+    // that the command names must exist from that directory, its last file
+    // must be the owner itself, and a test-runner config must apply there:
+    // the one that `--config` names, or a default config in the directory.
+    const defaultConfigs = [`vitest`, `vite`].flatMap((name) =>
+      [`ts`, `mts`, `js`, `mjs`].map(
+        (extension) => `${name}.config.${extension}`,
+      ),
+    )
+    const failures: Array<string> = []
+    for (const entry of oracleReplayManifest) {
+      if (entry.command === undefined || entry.file === undefined) continue
+      const cwd = resolve(repositoryDirectory, entry.cwd ?? `.`)
+      const owner = resolve(repositoryDirectory, entry.file)
+      const words = entry.command.split(` `)
+      const configAt = words.indexOf(`--config`)
+      const config = configAt === -1 ? undefined : words[configAt + 1]
+      const files = words.filter(
+        (word, index) =>
+          index !== configAt + 1 &&
+          /\.(m?[jt]sx?)$/.test(word) &&
+          !word.startsWith(`-`),
+      )
+      const problems = [
+        ...files
+          .filter((file) => !existsSync(resolve(cwd, file)))
+          .map((file) => `${file} is missing`),
+        ...(resolve(cwd, files.at(-1) ?? ``) === owner
+          ? []
+          : [`the target ${files.at(-1)} is not the owner`]),
+        ...((
+          config === undefined
+            ? defaultConfigs.some((name) => existsSync(join(cwd, name)))
+            : existsSync(resolve(cwd, config))
+        )
+          ? []
+          : [`no test-runner config applies`]),
+      ]
+      if (problems.length > 0) {
+        failures.push(
+          `${entry.property} (cwd ${entry.cwd}): ${problems.join(`, `)}`,
+        )
+      }
+    }
+    expect(failures).toEqual([])
+  })
+
   it(`names an owner for every registered property`, () => {
     // A registered name that no file owns would pass replay validation and
     // run nothing. Every new registered property must name its owner.
diff --git a/packages/db/tests/paced-mutations-oracle.test.ts b/packages/db/tests/paced-mutations-oracle.test.ts
index b311f3be78..b49d2318ab 100644
--- a/packages/db/tests/paced-mutations-oracle.test.ts
+++ b/packages/db/tests/paced-mutations-oracle.test.ts
@@ -1,15 +1,19 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { createCollection } from '../src/collection'
 import { createDeferred } from '../src/deferred'
 import { createPacedMutations } from '../src/paced-mutations'
-import { createSerialPacer } from '../src/strategies/serial-pacer'
 import {
   debounceStrategy,
   queueStrategy,
   throttleStrategy,
 } from '../src/strategies'
-import { TransactionScope } from '../src/transactions'
-import { mockSyncCollectionOptionsNoInitialState } from './utils'
+import { declareOracle } from './oracle-declaration.js'
+import {
+  createReadyCollection,
+  observeReceipt,
+  origin,
+  withCleanup,
+} from './paced-mutations-support'
+import type { Start } from './paced-mutations-support'
 import type { Strategy } from '../src/strategies/types'
 import type { Transaction } from '../src/transactions'
 
@@ -58,7 +62,7 @@ import type { Transaction } from '../src/transactions'
  * not a production timer handle.
  */
 type Action = { kind: `mutate`; id: number } | { kind: `advance`; ms: number }
-type Start = { at: number; ids: Array<number> }
+
 type Position = `front` | `back`
 
 type Case = {
@@ -69,8 +73,6 @@ type Case = {
   strategy: () => Strategy
 }
 
-const origin = 1_000_000
-
 beforeEach(() => {
   vi.useFakeTimers()
   vi.setSystemTime(origin)
@@ -80,46 +82,6 @@ afterEach(() => {
   vi.useRealTimers()
 })
 
-/**
- * A callback can throw before returning a persistence promise. The serial
- * pacer's two-call law surfaces that same error and keeps the next eligible
- * callback runnable. This direct scheduler seam isolates the throw boundary;
- * public paced histories below check transaction and receipt behavior.
- */
-it(`serial pacing stays usable after a synchronous callback error`, async () => {
-  const pacer = createSerialPacer(0)
-  const failure = new Error(`callback failed`)
-  const starts: Array<number> = []
-  expect(() =>
-    pacer.schedule(() => {
-      throw failure
-    }),
-  ).toThrow(failure)
-  pacer.schedule(() => {
-    starts.push(2)
-    return Promise.resolve()
-  })
-  await vi.advanceTimersByTimeAsync(0)
-  expect(starts, `second eligible callback starts`).toEqual([2])
-})
-
-it(`serial pacing drains a successor scheduled before its callback throws`, async () => {
-  const pacer = createSerialPacer(0)
-  const failure = new Error(`callback failed`)
-  const starts: Array<number> = []
-  expect(() =>
-    pacer.schedule(() => {
-      pacer.schedule(() => {
-        starts.push(2)
-        return Promise.resolve()
-      })
-      throw failure
-    }),
-  ).toThrow(failure)
-  await vi.advanceTimersByTimeAsync(0)
-  expect(starts, `the reentrant successor remains admitted`).toEqual([2])
-})
-
 // The queue's documented position policy is list insertion/removal. The first
 // call starts immediately; wait separates later dequeues. This model does not
 // contain a promise chain: the driver supplies immediately fulfilled writes.
@@ -246,89 +208,6 @@ function nonLeadingThrottleStarts(
   return starts
 }
 
-async function createReadyCollection<T extends { id: number } = { id: number }>(
-  initial: Array<T> = [],
-) {
-  const collection = createCollection(
-    mockSyncCollectionOptionsNoInitialState<T>({
-      id: `paced-oracle`,
-      getKey: (item) => item.id,
-    }),
-  )
-  const preload = collection.preload()
-  collection.utils.begin()
-  for (const row of initial)
-    collection.utils.write({ type: `insert`, value: row })
-  collection.utils.commit()
-  collection.utils.markReady()
-  await preload
-  return collection
-}
-
-// Keep the violated law as the primary cause if cleanup also fails. Release
-// every resource even when an earlier cleanup step throws.
-async function withCleanup<T>(
-  strategy: Strategy,
-  collection: { cleanup: () => Promise<void> },
-  run: () => Promise<T>,
-  release?: () => Promise<void>,
-): Promise<T> {
-  const outcome = await Promise.resolve()
-    .then(run)
-    .then(
-      (value) => ({ ok: true, value }) as const,
-      (error: unknown) => ({ ok: false, error }) as const,
-    )
-  const cleanupErrors: Array<unknown> = []
-  try {
-    await release?.()
-  } catch (error) {
-    cleanupErrors.push(error)
-  }
-  try {
-    strategy.cleanup()
-  } catch (error) {
-    cleanupErrors.push(error)
-  }
-  try {
-    await collection.cleanup()
-  } catch (error) {
-    cleanupErrors.push(error)
-  }
-
-  if (!outcome.ok) {
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(cleanupErrors, `Oracle cleanup also failed`, {
-        cause: outcome.error,
-      })
-    }
-    throw outcome.error
-  }
-  if (cleanupErrors.length > 0) {
-    throw new AggregateError(cleanupErrors, `Oracle cleanup failed`)
-  }
-  return outcome.value
-}
-
-function observeReceipt<T extends object>(transaction: Transaction<T>) {
-  const receipt: {
-    outcome: `pending` | `fulfilled` | `rejected`
-    returnedSame?: boolean
-    error?: unknown
-  } = { outcome: `pending` }
-  void transaction.isPersisted.promise.then(
-    (resolved) => {
-      receipt.outcome = `fulfilled`
-      receipt.returnedSame = resolved === transaction
-    },
-    (error: unknown) => {
-      receipt.outcome = `rejected`
-      receipt.error = error
-    },
-  )
-  return receipt
-}
-
 type Observation = {
   starts: Array<Start>
   sameTransaction: Array<Array<number>>
@@ -418,6 +297,42 @@ async function runProduction(
   })
 }
 
+// The timeline check compares one production observation with the model's
+// prediction carried by its case: start times, transaction grouping, the
+// optimistic rows, and settlement of every receipt.
+function checkTimelineObservation(testCase: Case, actual: Observation): void {
+  expect(actual.starts).toEqual(testCase.expected)
+  expect(actual.sameTransaction).toEqual(testCase.sameTransaction)
+  expect(actual.optimistic).toEqual(
+    testCase.actions.flatMap((action) =>
+      action.kind === `mutate` ? [action.id] : [],
+    ),
+  )
+  expect(actual.states).toEqual(
+    testCase.sameTransaction.flatMap((group) => group.map(() => `completed`)),
+  )
+  expect(actual.persistence).toEqual(
+    testCase.sameTransaction.map(([id]) => ({
+      id,
+      outcome: `fulfilled`,
+      returnedSame: true,
+    })),
+  )
+}
+
+declareOracle({
+  check: [checkTimelineObservation, checkHeldPacing],
+  model: [
+    queueStarts,
+    debounceStarts,
+    throttleStarts,
+    nonLeadingThrottleStarts,
+    heldPacingTimes,
+    expectedHeldStarts,
+    expectedSuccessorCanceled,
+  ],
+})
+
 const queueActions: Array<Action> = [
   { kind: `mutate`, id: 1 },
   { kind: `mutate`, id: 2 },
@@ -538,1100 +453,121 @@ const cases: Array<Case> = [
 ]
 
 describe(`paced mutation timeline oracle`, () => {
-  it(`drains admitted queue writes after Collection cleanup`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = queueStrategy({ wait: 10 })
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        const id = transaction.mutations[0].changes.id
-        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-        starts.push(id)
-        return Promise.resolve()
-      },
-      strategy,
-    })
-    const first = mutate(1)
-    const second = mutate(2)
-    const firstReceipt = observeReceipt(first)
-    const secondReceipt = observeReceipt(second)
-    strategy.cleanup()
-    await collection.cleanup()
-    expect(starts).toEqual([1])
-    await vi.advanceTimersByTimeAsync(0)
-    expect(starts).toEqual([1])
-    await vi.advanceTimersByTimeAsync(10)
-    expect(starts).toEqual([1, 2])
-    expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-      `fulfilled`,
-      `fulfilled`,
-    ])
-  })
-
-  it(`rejects a mutation after queue cleanup with a disposal reason`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = queueStrategy({ wait: 10 })
-    let starts = 0
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: () => {
-        starts++
-        return Promise.resolve()
-      },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      const admitted = mutate(1)
-      const admittedReceipt = observeReceipt(admitted)
-      strategy.cleanup()
-      const transaction = mutate(2)
-      const receipt = observeReceipt(transaction)
-      expect(collection.get(1)?.id).toBe(1)
-      expect(collection.get(2)).toBeUndefined()
-      await vi.advanceTimersByTimeAsync(20)
-      expect(starts).toBe(1)
-      expect(admittedReceipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-      expect(transaction.state).toBe(`failed`)
-      expect(collection.get(2)).toBeUndefined()
-      expect(receipt).toMatchObject({
-        outcome: `rejected`,
-        error: { name: `QueueDisposedError` },
-      })
-    })
-  })
-
-  for (const leading of [true, undefined] as const) {
-    it(`drops a within-window throttle call when trailing is false and leading is ${String(leading)}`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = throttleStrategy({ wait: 10, leading, trailing: false })
-      const starts: Array<Start> = []
-      const mutate = createPacedMutations<number, { id: number }>({
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          const id = transaction.mutations[0].changes.id
-          if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-          starts.push({ at: Date.now() - origin, ids: [id] })
-          return Promise.resolve()
-        },
-        strategy,
-      })
-      await withCleanup(strategy, collection, async () => {
-        const first = mutate(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(4)
-        expect(starts).toEqual([{ at: 0, ids: [1] }])
-        expect(firstReceipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
-
-        const dropped = mutate(2)
-        const droppedReceipt = observeReceipt(dropped)
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts).toEqual([{ at: 0, ids: [1] }])
-        expect(dropped.state).toBe(`failed`)
-        expect(collection.get(2)).toBeUndefined()
-        expect(droppedReceipt).toMatchObject({
-          outcome: `rejected`,
-          error: { name: `ThrottleCallDroppedError` },
-        })
-
-        await vi.advanceTimersByTimeAsync(10)
-        const next = mutate(3)
-        const nextReceipt = observeReceipt(next)
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts).toEqual([
-          { at: 0, ids: [1] },
-          { at: 14, ids: [3] },
-        ])
-        expect(nextReceipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
-      })
-    })
-  }
-
-  it(`rejects every optimistic call when both throttle edges are disabled`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = throttleStrategy({
-      wait: 10,
-      leading: false,
-      trailing: false,
-    })
-    let starts = 0
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: () => {
-        starts++
-        return Promise.resolve()
-      },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      for (const id of [1, 2]) {
-        const transaction = mutate(id)
-        const receipt = observeReceipt(transaction)
-        await vi.advanceTimersByTimeAsync(10)
-        expect(transaction.state).toBe(`failed`)
-        expect(collection.get(id)).toBeUndefined()
-        expect(receipt).toMatchObject({
-          outcome: `rejected`,
-          error: { name: `ThrottleCallDroppedError` },
-        })
-      }
-      expect(starts).toBe(0)
-    })
-  })
-
-  for (const { name, strategyFactory, errorName } of [
-    {
-      name: `throttle`,
-      strategyFactory: () =>
-        throttleStrategy({ wait: 10, leading: true, trailing: false }),
-      errorName: `ThrottleCallDroppedError`,
-    },
-    {
-      name: `debounce`,
-      strategyFactory: () =>
-        debounceStrategy({ wait: 10, leading: true, trailing: false }),
-      errorName: `DebounceCallDroppedError`,
-    },
-  ]) {
-    it(`a dropped ${name} update preserves the prior same-row write`, async () => {
-      const collection = createCollection(
-        mockSyncCollectionOptionsNoInitialState<{ id: number; value: number }>({
-          id: `paced-${name}-same-row`,
-          getKey: (item) => item.id,
-        }),
-      )
-      const preload = collection.preload()
-      collection.utils.begin()
-      collection.utils.commit()
-      collection.utils.markReady()
-      await preload
-      const strategy = strategyFactory()
-      const starts: Array<number> = []
-      let releaseFirst: (() => void) | undefined
-      const mutate = createPacedMutations<
-        number,
-        { id: number; value: number }
-      >({
-        onMutate: (value) => {
-          if (value === 1) collection.insert({ id: 1, value })
-          else
-            collection.update(1, (draft) => {
-              draft.value = value
-            })
-        },
-        mutationFn: ({ transaction }) => {
-          const value = transaction.mutations[0].changes.value
-          if (typeof value !== `number`) throw new Error(`Missing value`)
-          starts.push(value)
-          if (value === 1)
-            return new Promise<void>((resolve) => {
-              releaseFirst = resolve
-            })
-          return Promise.resolve()
-        },
-        strategy,
-      })
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const first = mutate(1)
-          const firstReceipt = observeReceipt(first)
-          await vi.advanceTimersByTimeAsync(4)
-          expect(first.state).toBe(`persisting`)
-          const dropped = mutate(2)
-          const droppedReceipt = observeReceipt(dropped)
-          await vi.advanceTimersByTimeAsync(0)
-          expect(droppedReceipt).toMatchObject({
-            outcome: `rejected`,
-            error: { name: errorName },
-          })
-          expect(collection.get(1)?.value).toBe(1)
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(0)
-          expect(starts).toEqual([1])
-          expect(firstReceipt).toMatchObject({
-            outcome: `fulfilled`,
-            returnedSame: true,
-          })
-        },
-        async () => {
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(0)
-        },
+  for (const testCase of cases) {
+    it(testCase.name, async () => {
+      await runProduction(testCase, (actual) =>
+        checkTimelineObservation(testCase, actual),
       )
     })
   }
-
-  it(`drains an admitted trailing throttle write after cleanup at its regular edge`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = throttleStrategy({
-      wait: 10,
-      leading: false,
-      trailing: true,
-    })
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: () => {
-        starts.push(Date.now() - origin)
-        return Promise.resolve()
-      },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      const transaction = mutate(1)
-      const receipt = observeReceipt(transaction)
-      expect(collection.get(1)?.id).toBe(1)
-      await vi.advanceTimersByTimeAsync(4)
-      strategy.cleanup()
-      await collection.cleanup()
-      await vi.advanceTimersByTimeAsync(5)
-      expect(starts).toEqual([])
-      expect(transaction.state).toBe(`pending`)
-      expect(receipt.outcome).toBe(`pending`)
-      await vi.advanceTimersByTimeAsync(1)
-      expect(starts).toEqual([10])
-      expect(transaction.state).toBe(`completed`)
-      expect(receipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-    })
-  })
-
-  it(`drains a pending debounce write after cleanup at its quiet edge`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = debounceStrategy({ wait: 10 })
-    const starts: Array<Start> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        starts.push({
-          at: Date.now() - origin,
-          ids: transaction.mutations.map((mutation) => {
-            const id = mutation.changes.id
-            if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-            return id
+  it(`rejects front/back, trailing, and leading-edge mutants`, async () => {
+    const wrongStrategies: Array<{
+      caseName: string
+      strategy: () => Strategy
+    }> = [
+      {
+        caseName: `queue adds front and takes front`,
+        strategy: () =>
+          queueStrategy({
+            wait: 10,
+            addItemsTo: `front`,
+            getItemsFrom: `back`,
           }),
-        })
-        return Promise.resolve()
       },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      const transaction = mutate(1)
-      const receipt = observeReceipt(transaction)
-      expect(collection.get(1)?.id).toBe(1)
-      await vi.advanceTimersByTimeAsync(4)
-      expect(mutate(2)).toBe(transaction)
-      expect(collection.get(2)?.id).toBe(2)
-      await vi.advanceTimersByTimeAsync(4)
-      strategy.cleanup()
-      await collection.cleanup()
-      await vi.advanceTimersByTimeAsync(5)
-      expect(starts).toEqual([])
-      expect(transaction.state).toBe(`pending`)
-      expect(receipt.outcome).toBe(`pending`)
-      await vi.advanceTimersByTimeAsync(1)
-      expect(starts).toEqual([{ at: 14, ids: [1, 2] }])
-      expect(transaction.state).toBe(`completed`)
-      expect(receipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-    })
-  })
-
-  it(`drains a second leading debounce transaction when trailing is omitted`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = debounceStrategy({ wait: 10, leading: true })
-    const starts: Array<Start> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        starts.push({
-          at: Date.now() - origin,
-          ids: transaction.mutations.map((mutation) => {
-            const id = mutation.changes.id
-            if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-            return id
-          }),
-        })
-        return Promise.resolve()
+      {
+        caseName: `debounce persists after each quiet period`,
+        strategy: () =>
+          debounceStrategy({ wait: 10, leading: false, trailing: false }),
       },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      const first = mutate(1)
-      const firstReceipt = observeReceipt(first)
-      await vi.advanceTimersByTimeAsync(4)
-      expect(starts).toEqual([{ at: 0, ids: [1] }])
-      expect(firstReceipt.outcome).toBe(`fulfilled`)
-      const second = mutate(2)
-      const secondReceipt = observeReceipt(second)
-      expect(collection.get(2)?.id).toBe(2)
-      await vi.advanceTimersByTimeAsync(4)
-      strategy.cleanup()
-      await collection.cleanup()
-      await vi.advanceTimersByTimeAsync(5)
-      expect(starts).toEqual([{ at: 0, ids: [1] }])
-      expect(second.state).toBe(`pending`)
-      expect(secondReceipt.outcome).toBe(`pending`)
-      await vi.advanceTimersByTimeAsync(1)
-      expect(starts).toEqual([
-        { at: 0, ids: [1] },
-        { at: 14, ids: [2] },
-      ])
-      expect(secondReceipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-    })
-  })
-
-  it(`rejects a debounce call dropped inside a leading-only window`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = debounceStrategy({
-      wait: 10,
-      leading: true,
-      trailing: false,
-    })
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        const id = transaction.mutations[0].changes.id
-        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-        starts.push(id)
-        return Promise.resolve()
+      {
+        caseName: `throttle persists leading and trailing transactions`,
+        strategy: () =>
+          throttleStrategy({ wait: 10, leading: false, trailing: true }),
       },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      const first = mutate(1)
-      const firstReceipt = observeReceipt(first)
-      await vi.advanceTimersByTimeAsync(4)
-      expect(starts).toEqual([1])
-      expect(firstReceipt.outcome).toBe(`fulfilled`)
-      const dropped = mutate(2)
-      const droppedReceipt = observeReceipt(dropped)
-      await vi.advanceTimersByTimeAsync(0)
-      expect(dropped.state).toBe(`failed`)
-      expect(collection.get(2)).toBeUndefined()
-      expect(droppedReceipt).toMatchObject({
-        outcome: `rejected`,
-        error: { name: `DebounceCallDroppedError` },
-      })
-      await vi.advanceTimersByTimeAsync(10)
-      const next = mutate(3)
-      const nextReceipt = observeReceipt(next)
-      await vi.advanceTimersByTimeAsync(0)
-      expect(starts).toEqual([1, 3])
-      expect(nextReceipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-    })
+    ]
+    for (const { caseName, strategy } of wrongStrategies) {
+      const lawful = cases.find((testCase) => testCase.name === caseName)
+      if (!lawful) throw new Error(`Missing calibration case`)
+      await expect(
+        runProduction({ ...lawful, strategy }, (actual) => {
+          expect(actual.starts).toEqual(lawful.expected)
+        }),
+      ).rejects.toMatchObject({ name: `AssertionError` })
+    }
   })
-
-  for (const leading of [false, undefined] as const) {
-    it(`rejects debounce calls when both edges are disabled and leading is ${String(leading)}`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = debounceStrategy({ wait: 10, leading, trailing: false })
-      let starts = 0
-      const mutate = createPacedMutations<number, { id: number }>({
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: () => {
-          starts++
-          return Promise.resolve()
-        },
-        strategy,
-      })
-      await withCleanup(strategy, collection, async () => {
-        for (const id of [1, 2]) {
-          const transaction = mutate(id)
-          const receipt = observeReceipt(transaction)
-          await vi.advanceTimersByTimeAsync(10)
-          expect(transaction.state).toBe(`failed`)
-          expect(collection.get(id)).toBeUndefined()
-          expect(receipt).toMatchObject({
-            outcome: `rejected`,
-            error: { name: `DebounceCallDroppedError` },
-          })
-        }
-        expect(starts).toBe(0)
-      })
-    })
-  }
-
-  for (const trailing of [true, false] as const) {
-    it(`starts the first leading throttle call at epoch zero with trailing ${String(trailing)}`, async () => {
-      vi.setSystemTime(0)
+  it(`rejects capacity, overflow settlement, early throttle, and option mutation mutants`, async () => {
+    const capacityChecker = async (strategy: Strategy) => {
       const collection = await createReadyCollection()
-      const strategy = throttleStrategy({ wait: 10, leading: true, trailing })
-      const starts: Array<number> = []
       const mutate = createPacedMutations<number, { id: number }>({
         onMutate: (id) => collection.insert({ id }),
-        mutationFn: () => {
-          starts.push(Date.now())
-          return Promise.resolve()
-        },
+        mutationFn: () => Promise.resolve(),
         strategy,
       })
-      await withCleanup(strategy, collection, async () => {
-        const transaction = mutate(1)
-        const receipt = observeReceipt(transaction)
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts).toEqual([0])
-        expect(receipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
+      return withCleanup(strategy, collection, () => {
+        mutate(1)
+        mutate(2)
+        const third = mutate(3)
+        expect(third.state, `overflow settlement`).toBe(`failed`)
+        return Promise.resolve()
       })
-    })
-  }
+    }
+    await expect(
+      capacityChecker(queueStrategy({ maxSize: Infinity, wait: 10 })),
+    ).rejects.toMatchObject({ name: `AssertionError` })
 
-  it(`keeps queue wait spacing while draining after cleanup`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = queueStrategy({ wait: 10 })
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: () => {
-        starts.push(Date.now() - origin)
-        return Promise.resolve()
-      },
-      strategy,
-    })
-    await withCleanup(strategy, collection, async () => {
-      const first = mutate(1)
-      const second = mutate(2)
-      const firstReceipt = observeReceipt(first)
-      const secondReceipt = observeReceipt(second)
-      strategy.cleanup()
-      strategy.cleanup()
-      await vi.advanceTimersByTimeAsync(0)
-      expect(starts, `starts before wait`).toEqual([0])
-      expect(second.state).toBe(`pending`)
-      expect(secondReceipt.outcome).toBe(`pending`)
-      expect(collection.get(2)?.id).toBe(2)
-      await vi.advanceTimersByTimeAsync(10)
-      expect(starts).toEqual([0, 10])
-      expect([first.state, second.state]).toEqual([`completed`, `completed`])
-      expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-        `fulfilled`,
-        `fulfilled`,
-      ])
+    const falseGreen = queueStrategy({ maxSize: 1, wait: 10 })
+    const originalExecute = falseGreen.execute
+    falseGreen.execute = (fn) => {
+      originalExecute(fn)
+      return true
+    }
+    await expect(capacityChecker(falseGreen)).rejects.toMatchObject({
+      name: `AssertionError`,
     })
-  })
 
-  for (const getItemsFrom of [`front`, `back`] as const) {
-    it(`drains admitted queue work in ${getItemsFrom} order after cleanup`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = queueStrategy({ wait: 10, getItemsFrom })
-      const started: Array<number> = []
-      let releaseFirst: (() => void) | undefined
-      const mutate = createPacedMutations<number, { id: number }>({
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          const id = transaction.mutations[0].changes.id
-          if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-          started.push(id)
-          if (id === 1) {
-            return new Promise<void>((resolve) => {
-              releaseFirst = resolve
-            })
-          }
-          return Promise.resolve()
+    const nonLeading = cases.find(
+      (testCase) =>
+        testCase.name ===
+        `explicit non-leading throttle waits for each trailing edge`,
+    )
+    if (!nonLeading) throw new Error(`Missing non-leading calibration case`)
+    await expect(
+      runProduction(
+        {
+          ...nonLeading,
+          strategy: () =>
+            throttleStrategy({ wait: 10, leading: true, trailing: true }),
         },
-        strategy,
-      })
+        (actual) => expect(actual.starts).toEqual(nonLeading.expected),
+      ),
+    ).rejects.toMatchObject({ name: `AssertionError` })
 
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const first = mutate(1)
-          const second = mutate(2)
-          const third = mutate(3)
-          const firstReceipt = observeReceipt(first)
-          const secondReceipt = observeReceipt(second)
-          const thirdReceipt = observeReceipt(third)
-          await vi.advanceTimersByTimeAsync(0)
-          expect(started).toEqual([1])
-          strategy.cleanup()
-          strategy.cleanup()
-          await vi.advanceTimersByTimeAsync(20)
-          expect(started).toEqual([1])
-          expect(second.state).toBe(`pending`)
-          expect(collection.get(2)?.id).toBe(2)
-          expect(collection.get(3)?.id).toBe(3)
+    const options: { wait: number; trailing?: boolean } = { wait: 10 }
+    options.trailing = true
+    expect(() => expect(options).toEqual({ wait: 10 })).toThrowError(
+      expect.objectContaining({ name: `AssertionError` }),
+    )
+  })
+})
 
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(0)
-          expect(started, `admitted work after cleanup`).toEqual(
-            getItemsFrom === `front` ? [1, 2, 3] : [1, 3, 2],
-          )
-          expect([first.state, second.state, third.state]).toEqual([
-            `completed`,
-            `completed`,
-            `completed`,
-          ])
-          expect([
-            firstReceipt.outcome,
-            secondReceipt.outcome,
-            thirdReceipt.outcome,
-          ]).toEqual([`fulfilled`, `fulfilled`, `fulfilled`])
-          await vi.advanceTimersByTimeAsync(10)
-          expect(started, `no write after drain`).toEqual(
-            getItemsFrom === `front` ? [1, 2, 3] : [1, 3, 2],
-          )
-
-          expect(() =>
-            strategy.execute(() => {
-              throw new Error(`Disposed queue ran a new callback`)
-            }),
-          ).toThrowError(`Queue has been cleaned up`)
-        },
-        async () => {
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(0)
-        },
-      )
-    })
-  }
-
-  for (const testCase of cases) {
-    it(testCase.name, async () => {
-      await runProduction(testCase, (actual) => {
-        expect(actual.starts).toEqual(testCase.expected)
-        expect(actual.sameTransaction).toEqual(testCase.sameTransaction)
-        expect(actual.optimistic).toEqual(
-          testCase.actions.flatMap((action) =>
-            action.kind === `mutate` ? [action.id] : [],
-          ),
-        )
-        expect(actual.states).toEqual(
-          testCase.sameTransaction.flatMap((group) =>
-            group.map(() => `completed`),
-          ),
-        )
-        expect(actual.persistence).toEqual(
-          testCase.sameTransaction.map(([id]) => ({
-            id,
-            outcome: `fulfilled`,
-            returnedSame: true,
-          })),
-        )
-      })
-    })
-  }
-
-  it(`holds later queue writes until each prior transaction settles`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = queueStrategy({ wait: 10 })
-    const started: Array<number> = []
-    const releases = new Map<number, () => void>()
-    let releaseFutureWrites = false
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        const id = transaction.mutations[0].changes.id
-        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-        started.push(id)
-        if (releaseFutureWrites || id === 3) return Promise.resolve()
-        return new Promise<void>((resolve) => releases.set(id, resolve))
-      },
-      strategy,
-    })
-
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutate(1)
-        const second = mutate(2)
-        const third = mutate(3)
-        expect(collection.get(1)?.id).toBe(1)
-        expect(collection.get(2)?.id).toBe(2)
-        expect(collection.get(3)?.id).toBe(3)
-
-        await vi.advanceTimersByTimeAsync(30)
-        expect(started).toEqual([1])
-        expect([first.state, second.state, third.state]).toEqual([
-          `persisting`,
-          `pending`,
-          `pending`,
-        ])
-
-        releases.get(1)?.()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(started).toEqual([1, 2])
-        expect([first.state, second.state, third.state]).toEqual([
-          `completed`,
-          `persisting`,
-          `pending`,
-        ])
-
-        releases.get(2)?.()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(started).toEqual([1, 2, 3])
-        for (const transaction of [first, second, third]) {
-          expect(await transaction.isPersisted.promise).toBe(transaction)
-        }
-      },
-      async () => {
-        releaseFutureWrites = true
-        for (const resolve of releases.values()) resolve()
-        await vi.advanceTimersByTimeAsync(0)
-      },
-    )
-  })
-
-  for (const { maxSize, wait, expectedStarts, expectedStates } of [
-    {
-      maxSize: 0,
-      wait: 0,
-      expectedStarts: [],
-      expectedStates: [`failed`, `failed`, `failed`],
-    },
-    {
-      maxSize: 1,
-      wait: 10,
-      expectedStarts: [1, 2],
-      expectedStates: [`persisting`, `pending`, `failed`],
-    },
-    {
-      maxSize: 1,
-      wait: 0,
-      expectedStarts: [1, 2, 3],
-      expectedStates: [`persisting`, `pending`, `pending`],
-    },
-  ]) {
-    it(`queue capacity ${maxSize} at wait ${wait} rejects only overflow`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = queueStrategy({ maxSize, wait })
-      const started: Array<number> = []
-      const releases: Array<() => void> = []
-      const mutate = createPacedMutations<number, { id: number }>({
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          const id = transaction.mutations[0].changes.id
-          if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-          started.push(id)
-          return new Promise<void>((resolve) => releases.push(resolve))
-        },
-        strategy,
-      })
-
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const transactions = [mutate(1), mutate(2), mutate(3)]
-          const receipts = transactions.map(observeReceipt)
-          await vi.advanceTimersByTimeAsync(0)
-          expect(transactions.map((transaction) => transaction.state)).toEqual(
-            expectedStates,
-          )
-          for (const [index, state] of expectedStates.entries()) {
-            expect(collection.get(index + 1)?.id).toBe(
-              state === `failed` ? undefined : index + 1,
-            )
-          }
-          for (const [index, state] of expectedStates.entries()) {
-            if (state === `failed`) {
-              expect(
-                receipts[index],
-                `overflow receipt at admission`,
-              ).toMatchObject({
-                outcome: `rejected`,
-                error: { name: `QueueCapacityExceededError` },
-              })
-            }
-          }
-          await vi.advanceTimersByTimeAsync(30)
-          for (let index = 0; index < expectedStarts.length; index++) {
-            releases[index]?.()
-            await vi.advanceTimersByTimeAsync(0)
-          }
-          expect(started).toEqual(expectedStarts)
-          for (const [index, state] of expectedStates.entries()) {
-            if (state !== `failed`) {
-              expect(
-                receipts[index],
-                `admitted receipt after drain`,
-              ).toMatchObject({
-                outcome: `fulfilled`,
-                returnedSame: true,
-              })
-            }
-          }
-        },
-        async () => {
-          for (const release of releases) release()
-          await vi.advanceTimersByTimeAsync(0)
-        },
-      )
-    })
-  }
-
-  it(`queue overflow preserves admitted same-key mutations`, async () => {
-    const collection = createCollection(
-      mockSyncCollectionOptionsNoInitialState<{ id: number; value: number }>({
-        id: `paced-capacity-same-key`,
-        getKey: (item) => item.id,
-      }),
-    )
-    const preload = collection.preload()
-    collection.utils.begin()
-    collection.utils.commit()
-    collection.utils.markReady()
-    await preload
-    const strategy = queueStrategy({ maxSize: 1, wait: 10 })
-    const started: Array<number> = []
-    const releases: Array<() => void> = []
-    const mutate = createPacedMutations<number, { id: number; value: number }>({
-      onMutate: (value) => {
-        if (value === 1) collection.insert({ id: 1, value })
-        else
-          collection.update(1, (draft) => {
-            draft.value = value
-          })
-      },
-      mutationFn: ({ transaction }) => {
-        const value = transaction.mutations[0].changes.value
-        if (typeof value !== `number`) throw new Error(`Missing value`)
-        started.push(value)
-        return new Promise<void>((resolve) => releases.push(resolve))
-      },
-      strategy,
-    })
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutate(1)
-        const second = mutate(2)
-        const overflow = mutate(3)
-        const firstReceipt = observeReceipt(first)
-        const secondReceipt = observeReceipt(second)
-        const overflowReceipt = observeReceipt(overflow)
-        await vi.advanceTimersByTimeAsync(0)
-        expect([first.state, second.state, overflow.state]).toEqual([
-          `persisting`,
-          `pending`,
-          `failed`,
-        ])
-        expect(collection.get(1)?.value).toBe(2)
-        expect(overflowReceipt, `same-key overflow receipt`).toMatchObject({
-          outcome: `rejected`,
-          error: { name: `QueueCapacityExceededError` },
-        })
-        await vi.advanceTimersByTimeAsync(10)
-        releases[0]?.()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(started).toEqual([1, 2])
-        expect(firstReceipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
-        expect(secondReceipt.outcome).toBe(`pending`)
-        expect(
-          collection.get(1)?.value,
-          `admitted optimistic update after first settlement`,
-        ).toBe(2)
-        releases[1]?.()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(secondReceipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
-      },
-      async () => {
-        for (const release of releases) release()
-        await vi.advanceTimersByTimeAsync(0)
-      },
-    )
-  })
-
-  it(`keeps a void-returning custom queue transaction pending until its callback`, async () => {
-    const collection = await createReadyCollection()
-    let timer: ReturnType<typeof setTimeout> | undefined
-    const strategy: Strategy = {
-      _type: `queue`,
-      execute: (fn) => {
-        timer = setTimeout(() => fn(), 10)
-      },
-      cleanup: () => {
-        if (timer !== undefined) clearTimeout(timer)
-      },
-    }
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: () => {
-        starts.push(Date.now() - origin)
-        return Promise.resolve()
-      },
-      strategy,
-    })
-
-    await withCleanup(strategy, collection, async () => {
-      const transaction = mutate(1)
-      const receipt = observeReceipt(transaction)
-      expect(transaction.state, `custom queue admission`).toBe(`pending`)
-      expect(collection.get(1)?.id).toBe(1)
-      await vi.advanceTimersByTimeAsync(10)
-      expect(starts).toEqual([10])
-      expect(receipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-    })
-  })
-
-  it(`keeps a false-returning custom batch transaction pending until its callback`, async () => {
-    const collection = await createReadyCollection()
-    let timer: ReturnType<typeof setTimeout> | undefined
-    const strategy: Strategy = {
-      _type: `batch`,
-      execute: (fn) => {
-        timer = setTimeout(() => fn(), 10)
-        return false
-      },
-      cleanup: () => {
-        if (timer !== undefined) clearTimeout(timer)
-      },
-    }
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: () => {
-        starts.push(Date.now() - origin)
-        return Promise.resolve()
-      },
-      strategy,
-    })
-
-    await withCleanup(strategy, collection, async () => {
-      const transaction = mutate(1)
-      const receipt = observeReceipt(transaction)
-      expect(transaction.state, `custom batch admission`).toBe(`pending`)
-      expect(collection.get(1)?.id).toBe(1)
-      await vi.advanceTimersByTimeAsync(10)
-      expect(starts).toEqual([10])
-      expect(receipt).toMatchObject({
-        outcome: `fulfilled`,
-        returnedSame: true,
-      })
-    })
-  })
-
-  it(`uses captured debounce options when reporting a dropped call`, async () => {
-    const collection = await createReadyCollection()
-    const options = { wait: 10, leading: true, trailing: false }
-    const strategy = debounceStrategy(options)
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        const id = transaction.mutations[0].changes.id
-        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
-        starts.push(id)
-        return Promise.resolve()
-      },
-      strategy,
-    })
-
-    await withCleanup(strategy, collection, async () => {
-      const first = mutate(1)
-      const firstReceipt = observeReceipt(first)
-      await vi.advanceTimersByTimeAsync(4)
-      expect(firstReceipt.outcome).toBe(`fulfilled`)
-      options.trailing = true
-      const dropped = mutate(2)
-      const droppedReceipt = observeReceipt(dropped)
-      await vi.advanceTimersByTimeAsync(0)
-      expect(dropped.state).toBe(`failed`)
-      expect(collection.get(2)).toBeUndefined()
-      expect(droppedReceipt).toMatchObject({
-        outcome: `rejected`,
-        error: { name: `DebounceCallDroppedError` },
-      })
-      await vi.advanceTimersByTimeAsync(10)
-      expect(starts).toEqual([1])
-    })
-  })
-
-  it(`strategy factories preserve frozen caller options`, () => {
-    const debounceOptions = Object.freeze({ wait: 10 })
-    const throttleOptions = Object.freeze({ wait: 10 })
-    const queueOptions = Object.freeze({ wait: 10, maxSize: 1 })
-    const debounce = debounceStrategy(debounceOptions)
-    const throttle = throttleStrategy(throttleOptions)
-    const queue = queueStrategy(queueOptions)
-    try {
-      expect(debounceOptions).toEqual({ wait: 10 })
-      expect(throttleOptions).toEqual({ wait: 10 })
-      expect(queueOptions).toEqual({ wait: 10, maxSize: 1 })
-    } finally {
-      debounce.cleanup()
-      throttle.cleanup()
-      queue.cleanup()
-    }
-  })
-
-  it(`preserves a trace failure and cleanup failure separately`, async () => {
-    const collection = await createReadyCollection()
-    const cleanupCollection = vi.spyOn(collection, `cleanup`)
-    const cleanupError = new Error(`strategy cleanup failed`)
-    const strategy: Strategy = {
-      _type: `queue`,
-      execute: () => true,
-      cleanup: () => {
-        throw cleanupError
-      },
-    }
-    const caught: unknown = await withCleanup(strategy, collection, () => {
-      expect([{ at: 0, ids: [1] }], `final execution trace`).toEqual([
-        { at: 10, ids: [1] },
-      ])
-      return Promise.resolve()
-    }).then(
-      () => undefined,
-      (error: unknown) => error,
-    )
-
-    expect(caught).toBeInstanceOf(AggregateError)
-    const aggregate = caught as AggregateError
-    expect(aggregate.cause).toMatchObject({ name: `AssertionError` })
-    expect((aggregate.cause as Error).message).toContain(
-      `final execution trace`,
-    )
-    expect(aggregate.errors).toEqual([cleanupError])
-    expect(cleanupCollection).toHaveBeenCalledTimes(1)
-  })
-
-  it(`rejects front/back, trailing, and leading-edge mutants`, async () => {
-    const wrongStrategies: Array<{
-      caseName: string
-      strategy: () => Strategy
-    }> = [
-      {
-        caseName: `queue adds front and takes front`,
-        strategy: () =>
-          queueStrategy({
-            wait: 10,
-            addItemsTo: `front`,
-            getItemsFrom: `back`,
-          }),
-      },
-      {
-        caseName: `debounce persists after each quiet period`,
-        strategy: () =>
-          debounceStrategy({ wait: 10, leading: false, trailing: false }),
-      },
-      {
-        caseName: `throttle persists leading and trailing transactions`,
-        strategy: () =>
-          throttleStrategy({ wait: 10, leading: false, trailing: true }),
-      },
-    ]
-    for (const { caseName, strategy } of wrongStrategies) {
-      const lawful = cases.find((testCase) => testCase.name === caseName)
-      if (!lawful) throw new Error(`Missing calibration case`)
-      await expect(
-        runProduction({ ...lawful, strategy }, (actual) => {
-          expect(actual.starts).toEqual(lawful.expected)
-        }),
-      ).rejects.toMatchObject({ name: `AssertionError` })
-    }
-  })
-
-  it(`rejects capacity, overflow settlement, early throttle, and option mutation mutants`, async () => {
-    const capacityChecker = async (strategy: Strategy) => {
-      const collection = await createReadyCollection()
-      const mutate = createPacedMutations<number, { id: number }>({
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: () => Promise.resolve(),
-        strategy,
-      })
-      return withCleanup(strategy, collection, () => {
-        mutate(1)
-        mutate(2)
-        const third = mutate(3)
-        expect(third.state, `overflow settlement`).toBe(`failed`)
-        return Promise.resolve()
-      })
-    }
-    await expect(
-      capacityChecker(queueStrategy({ maxSize: Infinity, wait: 10 })),
-    ).rejects.toMatchObject({ name: `AssertionError` })
-
-    const falseGreen = queueStrategy({ maxSize: 1, wait: 10 })
-    const originalExecute = falseGreen.execute
-    falseGreen.execute = (fn) => {
-      originalExecute(fn)
-      return true
-    }
-    await expect(capacityChecker(falseGreen)).rejects.toMatchObject({
-      name: `AssertionError`,
-    })
-
-    const nonLeading = cases.find(
-      (testCase) =>
-        testCase.name ===
-        `explicit non-leading throttle waits for each trailing edge`,
-    )
-    if (!nonLeading) throw new Error(`Missing non-leading calibration case`)
-    await expect(
-      runProduction(
-        {
-          ...nonLeading,
-          strategy: () =>
-            throttleStrategy({ wait: 10, leading: true, trailing: true }),
-        },
-        (actual) => expect(actual.starts).toEqual(nonLeading.expected),
-      ),
-    ).rejects.toMatchObject({ name: `AssertionError` })
-
-    const options: { wait: number; trailing?: boolean } = { wait: 10 }
-    options.trailing = true
-    expect(() => expect(options).toEqual({ wait: 10 })).toThrowError(
-      expect.objectContaining({ name: `AssertionError` }),
-    )
-  })
-})
-
-/**
- * Debounce/throttle promise one pending and one persisting transaction in
- * docs/guides/mutations.md, "Key Design". Timer eligibility alone cannot start
- * a second write. Successful settlement must release admitted work, preserving
- * its optimistic rows and returned receipt until its own write settles.
- *
- * This bounded extension crosses both strategies, leading/non-leading/default
- * admission, and release one tick before, at, one tick after, or ten ticks after
- * the second edge. It controls mutationFn promises through the real manager.
- * It does not model server ordering, rejected writes, cleanup during a hold,
- * same-key rebasing, or arbitrary call bursts. Later tests challenge bursts.
- */
-type HeldPacingCase = {
-  kind: `debounce` | `throttle`
-  leading: boolean | undefined
-  trailing: true | undefined
-  releaseOffset: number
-}
+/**
+ * Debounce/throttle promise one pending and one persisting transaction in
+ * docs/guides/mutations.md, "Key Design". Timer eligibility alone cannot start
+ * a second write. Successful settlement must release admitted work, preserving
+ * its optimistic rows and returned receipt until its own write settles.
+ *
+ * This bounded extension crosses both strategies, leading/non-leading/default
+ * admission, and release one tick before, at, one tick after, or ten ticks after
+ * the second edge. It controls mutationFn promises through the real manager.
+ * It does not model server ordering, rejected writes, cleanup during a hold,
+ * same-key rebasing, or arbitrary call bursts. Later tests challenge bursts.
+ */
+type HeldPacingCase = {
+  kind: `debounce` | `throttle`
+  leading: boolean | undefined
+  trailing: true | undefined
+  releaseOffset: number
+}
 
 // A two-call schedule needs only two independent prerequisites for its second
 // start: the documented time edge and the first write's release. Their maximum
@@ -1661,6 +597,19 @@ function heldPacingTimes({
   }
 }
 
+// The held-pacing model: the first call starts at its edge. The second starts
+// at its own edge, but only once the first write has released by then.
+function expectedHeldStarts(
+  times: ReturnType<typeof heldPacingTimes>,
+  now: number,
+  firstReleased: boolean,
+): Array<Start> {
+  const expectedStarts: Array<Start> = [{ at: times.firstAt, ids: [1] }]
+  if (now >= times.secondAt && firstReleased)
+    expectedStarts.push({ at: times.secondAt, ids: [2] })
+  return expectedStarts
+}
+
 async function checkHeldPacing(testCase: HeldPacingCase): Promise<void> {
   const times = heldPacingTimes(testCase)
   const collection = await createReadyCollection()
@@ -1701,10 +650,11 @@ async function checkHeldPacing(testCase: HeldPacingCase): Promise<void> {
     firstReleased: boolean,
     secondReleased = false,
   ) => {
-    const now = Date.now() - origin
-    const expectedStarts = [{ at: times.firstAt, ids: [1] }]
-    if (now >= times.secondAt && firstReleased)
-      expectedStarts.push({ at: times.secondAt, ids: [2] })
+    const expectedStarts = expectedHeldStarts(
+      times,
+      Date.now() - origin,
+      firstReleased,
+    )
     expect(concurrency, `${label}: single persistence`).toEqual(
       expectedStarts.map(() => 1),
     )
@@ -1806,194 +756,14 @@ describe(`paced persistence hold/release oracle`, () => {
           })
 })
 
-// Serialization must compose with timing rather than replace it. A delayed
-// throttle start moves its next spacing boundary. A new debounce call moves
-// the quiet boundary even if an earlier edge became eligible during the hold.
-// These three-call histories distinguish a bare manager lock from that law.
-describe(`paced persistence timing after a hold`, () => {
-  for (const kind of [`debounce`, `throttle`] as const) {
-    it(`${kind} preserves its next time boundary around a delayed write`, async () => {
-      const collection = await createReadyCollection()
-      const strategy =
-        kind === `debounce`
-          ? debounceStrategy({ wait: 10, leading: false, trailing: true })
-          : throttleStrategy({ wait: 10, leading: true, trailing: true })
-      const starts: Array<Start> = []
-      let releaseFirst: (() => void) | undefined
-      const receipts: Array<ReturnType<typeof observeReceipt>> = []
-      const mutate = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          const ids = transaction.mutations.map(
-            (mutation) => mutation.modified.id,
-          )
-          starts.push({ at: Date.now() - origin, ids })
-          return ids[0] === 1
-            ? new Promise<void>((resolve) => {
-                releaseFirst = resolve
-              })
-            : Promise.resolve()
-        },
-      })
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const first = mutate(1)
-          receipts.push(observeReceipt(first))
-          await vi.advanceTimersByTimeAsync(kind === `debounce` ? 11 : 1)
-          const second = mutate(2)
-          receipts.push(observeReceipt(second))
-          if (kind === `debounce`) {
-            await vi.advanceTimersByTimeAsync(11)
-            // t22: a new call invalidates the old t21 quiet edge; now due at t32.
-            const third = mutate(3)
-            receipts.push(observeReceipt(third))
-            expect(third, `one pending transaction while held`).toBe(second)
-            await vi.advanceTimersByTimeAsync(1)
-            releaseFirst!()
-            await vi.advanceTimersByTimeAsync(0)
-            expect(starts, `release before renewed quiet edge`).toEqual([
-              { at: 10, ids: [1] },
-            ])
-            expect(second.state).toBe(`pending`)
-            expect([...collection.keys()].sort()).toEqual([2, 3])
-            await vi.advanceTimersByTimeAsync(8)
-            expect(starts, `one tick before renewed quiet edge`).toEqual([
-              { at: 10, ids: [1] },
-            ])
-            await vi.advanceTimersByTimeAsync(1)
-            expect(starts, `renewed quiet edge`).toEqual([
-              { at: 10, ids: [1] },
-              { at: 32, ids: [2, 3] },
-            ])
-          } else {
-            await vi.advanceTimersByTimeAsync(14)
-            // t15: actual execution, rather than the blocked t10 appointment,
-            // starts the documented ten-tick minimum spacing for the next write.
-            releaseFirst!()
-            await vi.advanceTimersByTimeAsync(0)
-            expect(starts, `delayed second write`).toEqual([
-              { at: 0, ids: [1] },
-              { at: 15, ids: [2] },
-            ])
-            await vi.advanceTimersByTimeAsync(1)
-            const third = mutate(3)
-            receipts.push(observeReceipt(third))
-            expect(collection.get(3)?.id).toBe(3)
-            await vi.advanceTimersByTimeAsync(8)
-            expect(starts, `one tick before actual-start spacing`).toHaveLength(
-              2,
-            )
-            expect(third.state).toBe(`pending`)
-            await vi.advanceTimersByTimeAsync(1)
-            expect(starts, `actual-start spacing edge`).toEqual([
-              { at: 0, ids: [1] },
-              { at: 15, ids: [2] },
-              { at: 25, ids: [3] },
-            ])
-          }
-          expect(
-            receipts.map((receipt) => receipt.outcome),
-            `all admitted callers settle`,
-          ).toEqual([`fulfilled`, `fulfilled`, `fulfilled`])
-          expect(receipts.every((receipt) => receipt.returnedSame)).toBe(true)
-          await vi.advanceTimersByTimeAsync(20)
-          expect(starts, `no duplicate callback after drain`).toHaveLength(
-            kind === `debounce` ? 2 : 3,
-          )
-        },
-        async () => {
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(40)
-        },
-      )
-    })
-  }
-})
-
-// A leading-only timer may admit work after its old window while persistence
-// is still held. A later within-window dropped call must reject only itself,
-// as the existing dropped-call contract requires. Serializing writes exposes
-// this admission boundary because the admitted transaction stays pending.
-describe(`paced pending admission isolation`, () => {
-  for (const factory of [debounceStrategy, throttleStrategy])
-    it(`${factory.name} rejects only the skipped call while an admitted successor waits`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = factory({
-        wait: 10,
-        leading: true,
-        trailing: false,
-      })
-      const starts: Array<number> = []
-      let releaseFirst: (() => void) | undefined
-      const mutate = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          const id = transaction.mutations[0].modified.id
-          starts.push(id)
-          return id === 1
-            ? new Promise<void>((resolve) => {
-                releaseFirst = resolve
-              })
-            : Promise.resolve()
-        },
-      })
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const first = mutate(1)
-          const firstReceipt = observeReceipt(first)
-          await vi.advanceTimersByTimeAsync(11)
-          const admitted = mutate(2)
-          const admittedReceipt = observeReceipt(admitted)
-          await vi.advanceTimersByTimeAsync(1)
-          const dropped = mutate(3)
-          const droppedReceipt = observeReceipt(dropped)
-          await vi.advanceTimersByTimeAsync(0)
-          expect(
-            dropped,
-            `dropped call cannot own the admitted receipt`,
-          ).not.toBe(admitted)
-          expect(
-            droppedReceipt,
-            `within-window admission rejection`,
-          ).toMatchObject({
-            outcome: `rejected`,
-            error: {
-              name:
-                factory === debounceStrategy
-                  ? `DebounceCallDroppedError`
-                  : `ThrottleCallDroppedError`,
-            },
-          })
-          expect(admittedReceipt.outcome, `admitted receipt retained`).toBe(
-            `pending`,
-          )
-          expect(admitted.state, `admitted successor waits`).toBe(`pending`)
-          expect(
-            [...collection.keys()].sort(),
-            `only skipped optimism removed`,
-          ).toEqual([1, 2])
-          expect(starts, `one persisting transaction`).toEqual([1])
-          releaseFirst!()
-          await vi.advanceTimersByTimeAsync(0)
-          expect(starts, `admitted successor drains`).toEqual([1, 2])
-          expect([firstReceipt.outcome, admittedReceipt.outcome]).toEqual([
-            `fulfilled`,
-            `fulfilled`,
-          ])
-        },
-        async () => {
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(30)
-        },
-      )
-    })
-})
+// The settlement model: a pending successor is canceled by its own explicit
+// rollback, or by a failed same-key predecessor. Distinct keys survive failure.
+function expectedSuccessorCanceled(
+  outcome: `resolve` | `reject` | `cancel-pending`,
+  sameKey: boolean,
+): boolean {
+  return outcome === `cancel-pending` || (outcome === `reject` && sameKey)
+}
 
 /**
  * Settlement keeps the ordinary Transaction rollback contract. A failed prior
@@ -2066,9 +836,10 @@ describe(`paced settlement and pending ownership oracle`, () => {
                 if (outcome === `reject`) firstWrite.reject(failure)
                 else firstWrite.resolve()
                 await vi.advanceTimersByTimeAsync(0)
-                const successorCanceled =
-                  outcome === `cancel-pending` ||
-                  (outcome === `reject` && sameKey)
+                const successorCanceled = expectedSuccessorCanceled(
+                  outcome,
+                  sameKey,
+                )
                 expect(starts, `only uncanceled successor persists`).toEqual(
                   successorCanceled ? [1] : [1, 2],
                 )
@@ -2126,969 +897,3 @@ describe(`paced settlement and pending ownership oracle`, () => {
             )
           })
 })
-
-/**
- * A manual rollback settles the public receipt before the held mutation
- * handler has returned. It cannot cancel an already-started backend write.
- * The one-writing-at-a-time promise therefore waits for the old handler's
- * actual completion before starting a distinct-key successor. This three-path
- * grammar covers debounce, throttle, and queue. The model's active-handler
- * count stays one until the first controlled promise resolves; the driver
- * observes that count, receipts, and optimism at rollback and handler release.
- */
-describe(`paced persistence after manual rollback`, () => {
-  for (const [name, createStrategy] of [
-    [
-      `debounce`,
-      () => debounceStrategy({ wait: 10, leading: true, trailing: true }),
-    ],
-    [
-      `throttle`,
-      () => throttleStrategy({ wait: 10, leading: true, trailing: true }),
-    ],
-    [`queue`, () => queueStrategy({ wait: 10 })],
-  ] as const)
-    it(`${name} waits for the rolled-back handler to finish before starting another`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = createStrategy()
-      const firstWrite = createDeferred<void>()
-      const secondWrite = createDeferred<void>()
-      const canceled = new Error(`manual rollback`)
-      const starts: Array<number> = []
-      const active = new Set<number>()
-      const concurrency: Array<number> = []
-      const mutate = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: async ({ transaction }) => {
-          const id = transaction.mutations[0].modified.id
-          starts.push(id)
-          active.add(id)
-          concurrency.push(active.size)
-          await (id === 1 ? firstWrite.promise : secondWrite.promise)
-          active.delete(id)
-        },
-      })
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const first = mutate(1)
-          const firstReceipt = observeReceipt(first)
-          await vi.advanceTimersByTimeAsync(1)
-          const second = mutate(2)
-          const secondReceipt = observeReceipt(second)
-          await vi.advanceTimersByTimeAsync(20)
-          expect(starts).toEqual([1])
-          first.rollback({ error: canceled, isSecondaryRollback: true })
-          await vi.advanceTimersByTimeAsync(0)
-          expect(firstReceipt).toMatchObject({
-            outcome: `rejected`,
-            error: canceled,
-          })
-          expect(
-            secondReceipt.outcome,
-            `successor waits for handler completion`,
-          ).toBe(`pending`)
-          expect(starts, `no overlapping backend handler`).toEqual([1])
-          expect([...collection.keys()]).toEqual([2])
-          firstWrite.resolve()
-          await vi.advanceTimersByTimeAsync(0)
-          expect(starts, `successor begins after handler return`).toEqual([
-            1, 2,
-          ])
-          expect(concurrency, `one active backend handler`).toEqual([1, 1])
-          secondWrite.resolve()
-          await vi.advanceTimersByTimeAsync(0)
-          expect(secondReceipt).toMatchObject({
-            outcome: `fulfilled`,
-            returnedSame: true,
-          })
-        },
-        async () => {
-          firstWrite.resolve()
-          secondWrite.resolve()
-          await vi.advanceTimersByTimeAsync(30)
-        },
-      )
-    })
-})
-
-/**
- * A synchronous onMutate may call its own paced mutation function. The outer
- * call already owns the leading edge, so the nested call joins its pending
- * transaction. Both optimistic rows must be applied before the one handler
- * starts. A later timer must not invoke that completed transaction twice.
- */
-describe(`paced admission reentry`, () => {
-  for (const factory of [debounceStrategy, throttleStrategy])
-    it(`${factory.name} admits a nested mutation without a second leading write`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = factory({ wait: 10, leading: true, trailing: true })
-      const starts: Array<Array<number>> = []
-      let nested: Transaction<{ id: number }> | undefined
-      const mutate = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => {
-          collection.insert({ id })
-          if (id === 1) nested = mutate(2)
-        },
-        mutationFn: ({ transaction }) => {
-          starts.push(
-            transaction.mutations.map((mutation) => mutation.modified.id),
-          )
-          return Promise.resolve()
-        },
-      })
-      await withCleanup(strategy, collection, async () => {
-        const outer = mutate(1)
-        const outerReceipt = observeReceipt(outer)
-        expect(nested, `nested admission reached`).toBe(outer)
-        expect([...collection.keys()].sort()).toEqual([1, 2])
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts, `one merged leading write`).toEqual([[1, 2]])
-        expect(outerReceipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
-        await vi.advanceTimersByTimeAsync(20)
-        expect(starts, `no stale trailing callback`).toEqual([[1, 2]])
-        const next = mutate(3)
-        const nextReceipt = observeReceipt(next)
-        await vi.advanceTimersByTimeAsync(20)
-        expect(starts, `later admission still works`).toEqual([[1, 2], [3]])
-        expect(nextReceipt).toMatchObject({
-          outcome: `fulfilled`,
-          returnedSame: true,
-        })
-      })
-    })
-})
-
-/**
- * One strategy object supplies one timing boundary to two managers. Their
- * transactions cannot merge, so a shared tick must retain both callbacks.
- * Reentry is the shortest history that exposes a leading call replacing a
- * second manager's trailing callback before either receipt settles.
- */
-describe(`shared strategy timing across managers`, () => {
-  it(`one queue strategy serializes separate managers without merging receipts`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = queueStrategy({ wait: 10 })
-    const starts: Array<number> = []
-    let releaseFirst: (() => void) | undefined
-    const manager = (hold: boolean) =>
-      createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          starts.push(transaction.mutations[0].modified.id)
-          return hold
-            ? new Promise<void>((resolve) => {
-                releaseFirst = resolve
-              })
-            : Promise.resolve()
-        },
-      })
-    const mutateFirst = manager(true)
-    const mutateSecond = manager(false)
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutateFirst(1)
-        const second = mutateSecond(2)
-        const receipts = [observeReceipt(first), observeReceipt(second)]
-        expect(second, `separate manager transactions`).not.toBe(first)
-        await vi.advanceTimersByTimeAsync(11)
-        expect(starts, `queue waits for the held handler`).toEqual([1])
-        releaseFirst!()
-        await vi.advanceTimersByTimeAsync(20)
-        expect(starts, `both managers drain in queue order`).toEqual([1, 2])
-        expect(receipts.map((receipt) => receipt.outcome)).toEqual([
-          `fulfilled`,
-          `fulfilled`,
-        ])
-      },
-      async () => {
-        releaseFirst?.()
-        await vi.advanceTimersByTimeAsync(30)
-      },
-    )
-  })
-
-  for (const factory of [debounceStrategy, throttleStrategy])
-    it(`${factory.name} persists both managers after a reentrant shared tick`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = factory({ wait: 10, leading: true, trailing: true })
-      const starts: Array<number> = []
-      let second: Transaction<{ id: number }> | undefined
-      const mutateSecond = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          starts.push(transaction.mutations[0].modified.id)
-          return Promise.resolve()
-        },
-      })
-      const mutateFirst = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => {
-          collection.insert({ id })
-          second = mutateSecond(2)
-        },
-        mutationFn: ({ transaction }) => {
-          starts.push(transaction.mutations[0].modified.id)
-          return Promise.resolve()
-        },
-      })
-      await withCleanup(strategy, collection, async () => {
-        const first = mutateFirst(1)
-        const firstReceipt = observeReceipt(first)
-        expect(second, `reentrant manager admitted`).toBeDefined()
-        const secondReceipt = observeReceipt(second!)
-        expect(second, `manager transactions remain separate`).not.toBe(first)
-        expect([...collection.keys()].sort(), `both optimistic rows`).toEqual([
-          1, 2,
-        ])
-        expect(starts, `leading write starts once`).toEqual([1])
-        await vi.advanceTimersByTimeAsync(9)
-        expect(starts, `trailing write waits for shared edge`).toEqual([1])
-        await vi.advanceTimersByTimeAsync(1)
-        expect(starts, `both admitted writes start`).toEqual([1, 2])
-        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-          `fulfilled`,
-          `fulfilled`,
-        ])
-        await vi.advanceTimersByTimeAsync(20)
-        expect(starts, `no stale callback`).toEqual([1, 2])
-      })
-    })
-
-  for (const kind of [`debounce`, `throttle`] as const)
-    it(`${kind} retains separate manager writes at one shared trailing edge`, async () => {
-      const collection = await createReadyCollection()
-      const strategy =
-        kind === `debounce`
-          ? debounceStrategy({ wait: 10, leading: false, trailing: true })
-          : throttleStrategy({ wait: 10, leading: false, trailing: true })
-      const starts: Array<Start> = []
-      const manager = () =>
-        createPacedMutations<number, { id: number }>({
-          strategy,
-          onMutate: (id) => collection.insert({ id }),
-          mutationFn: ({ transaction }) => {
-            starts.push({
-              at: Date.now() - origin,
-              ids: transaction.mutations.map(
-                (mutation) => mutation.modified.id,
-              ),
-            })
-            return Promise.resolve()
-          },
-        })
-      const mutateFirst = manager()
-      const mutateSecond = manager()
-      await withCleanup(strategy, collection, async () => {
-        const first = mutateFirst(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(1)
-        const second = mutateSecond(2)
-        const secondReceipt = observeReceipt(second)
-        expect(second, `separate manager receipts`).not.toBe(first)
-        await vi.advanceTimersByTimeAsync(8)
-        expect(starts, `before shared edge`).toEqual([])
-        await vi.advanceTimersByTimeAsync(12)
-        expect(starts, `both writes keep their timing`).toEqual(
-          kind === `debounce`
-            ? [
-                { at: 11, ids: [1] },
-                { at: 11, ids: [2] },
-              ]
-            : [
-                { at: 10, ids: [1] },
-                { at: 20, ids: [2] },
-              ],
-        )
-        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-          `fulfilled`,
-          `fulfilled`,
-        ])
-      })
-    })
-
-  for (const factory of [debounceStrategy, throttleStrategy])
-    it(`${factory.name} waits for a shared manager's rolled-back handler before starting another`, async () => {
-      const collection = await createReadyCollection()
-      const strategy = factory({ wait: 10, leading: true, trailing: true })
-      const starts: Array<number> = []
-      let releaseFirst: (() => void) | undefined
-      const mutateFirst = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          starts.push(transaction.mutations[0].modified.id)
-          return new Promise<void>((resolve) => {
-            releaseFirst = resolve
-          })
-        },
-      })
-      const mutateSecond = createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          starts.push(transaction.mutations[0].modified.id)
-          return Promise.resolve()
-        },
-      })
-      await withCleanup(
-        strategy,
-        collection,
-        async () => {
-          const first = mutateFirst(1)
-          const firstReceipt = observeReceipt(first)
-          const second = mutateSecond(2)
-          const secondReceipt = observeReceipt(second)
-          first.rollback({ isSecondaryRollback: true })
-          await vi.advanceTimersByTimeAsync(11)
-          expect(starts, `timer cannot bypass held handler`).toEqual([1])
-          expect(secondReceipt.outcome, `other manager still admitted`).toBe(
-            `pending`,
-          )
-          releaseFirst!()
-          await vi.advanceTimersByTimeAsync(0)
-          expect(starts, `second manager starts after handler release`).toEqual(
-            [1, 2],
-          )
-          expect(firstReceipt.outcome).toBe(`rejected`)
-          expect(secondReceipt.outcome).toBe(`fulfilled`)
-        },
-        async () => {
-          releaseFirst?.()
-          await vi.advanceTimersByTimeAsync(30)
-        },
-      )
-    })
-
-  it(`shared debounce renews the quiet edge for another manager's eligible write`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = debounceStrategy({
-      wait: 10,
-      leading: false,
-      trailing: true,
-    })
-    const starts: Array<Start> = []
-    let releaseFirst: (() => void) | undefined
-    const manager = () =>
-      createPacedMutations<number, { id: number }>({
-        strategy,
-        onMutate: (id) => collection.insert({ id }),
-        mutationFn: ({ transaction }) => {
-          const ids = transaction.mutations.map(
-            (mutation) => mutation.modified.id,
-          )
-          starts.push({ at: Date.now() - origin, ids })
-          return ids[0] === 1
-            ? new Promise<void>((resolve) => {
-                releaseFirst = resolve
-              })
-            : Promise.resolve()
-        },
-      })
-    const mutateFirst = manager()
-    const mutateSecond = manager()
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutateFirst(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(11)
-        const second = mutateSecond(2)
-        const secondReceipt = observeReceipt(second)
-        await vi.advanceTimersByTimeAsync(11)
-        expect(starts, `second edge waits behind first handler`).toEqual([
-          { at: 10, ids: [1] },
-        ])
-        const third = mutateFirst(3)
-        const thirdReceipt = observeReceipt(third)
-        await vi.advanceTimersByTimeAsync(2)
-        releaseFirst!()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts, `new call renews shared quiet edge`).toEqual([
-          { at: 10, ids: [1] },
-        ])
-        await vi.advanceTimersByTimeAsync(8)
-        expect(starts, `both managers start after renewed edge`).toEqual([
-          { at: 10, ids: [1] },
-          { at: 32, ids: [2] },
-          { at: 32, ids: [3] },
-        ])
-        expect(
-          [firstReceipt, secondReceipt, thirdReceipt].map(
-            (receipt) => receipt.outcome,
-          ),
-        ).toEqual([`fulfilled`, `fulfilled`, `fulfilled`])
-      },
-      async () => {
-        releaseFirst?.()
-        await vi.advanceTimersByTimeAsync(30)
-      },
-    )
-  })
-})
-
-/**
- * A failed onMutate that changed no row admits no work and consumes no leading
- * edge. This two-action model starts the next valid call at the same clock
- * instant. The production driver catches the user's original error, then
- * observes the next receipt and handler start before any timer can expire.
- */
-describe(`paced admission after an optimistic callback throws`, () => {
-  for (const kind of [`debounce`, `throttle`] as const)
-    for (const trailing of [false, true])
-      it(`${kind} trailing ${trailing} leaves its leading edge available after a failed call`, async () => {
-        const collection = await createReadyCollection()
-        const strategy =
-          kind === `debounce`
-            ? debounceStrategy({ wait: 10, leading: true, trailing })
-            : throttleStrategy({ wait: 10, leading: true, trailing })
-        const failure = new Error(`optimistic callback failed`)
-        const starts: Array<number> = []
-        const mutate = createPacedMutations<number, { id: number }>({
-          strategy,
-          onMutate: (id) => {
-            if (id === 1) throw failure
-            collection.insert({ id })
-          },
-          mutationFn: ({ transaction }) => {
-            starts.push(transaction.mutations[0].modified.id)
-            return Promise.resolve()
-          },
-        })
-        await withCleanup(strategy, collection, async () => {
-          expect(() => mutate(1)).toThrow(failure)
-          const next = mutate(2)
-          const receipt = observeReceipt(next)
-          await vi.advanceTimersByTimeAsync(0)
-          expect(starts, `failed call did not consume leading edge`).toEqual([
-            2,
-          ])
-          expect(receipt).toMatchObject({
-            outcome: `fulfilled`,
-            returnedSame: true,
-          })
-        })
-      })
-})
-
-/**
- * A failed onMutate can change a row before it throws. The reference retains
- * only successful calls. At the throw cut, the failed row is absent and the
- * earlier admitted transaction is still pending. After its timer and any held
- * handler complete, the backend sees only that earlier call. This checks the
- * transaction rollback rule through both paced admission paths.
- */
-for (const kind of [`debounce`, `throttle`] as const)
-  it(`${kind} keeps an earlier admitted call when a joined callback changes a row then throws`, async () => {
-    const collection = await createReadyCollection()
-    const strategy =
-      kind === `debounce`
-        ? debounceStrategy({ wait: 10, leading: false, trailing: true })
-        : throttleStrategy({ wait: 10, leading: true, trailing: true })
-    const firstWrite = createDeferred<void>()
-    const starts: Array<Array<number>> = []
-    const failure = new Error(`optimistic callback failed`)
-    const mutate = createPacedMutations<number, { id: number }>({
-      strategy,
-      onMutate: (id) => {
-        collection.insert({ id })
-        if (id === 3) throw failure
-      },
-      mutationFn: ({ transaction }) => {
-        const ids = transaction.mutations.map(
-          (mutation) => mutation.modified.id,
-        )
-        starts.push(ids)
-        return ids.includes(1) ? firstWrite.promise : Promise.resolve()
-      },
-    })
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutate(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(1)
-        const second = mutate(2)
-        const secondReceipt = observeReceipt(second)
-        expect(() => mutate(3)).toThrow(failure)
-        expect(
-          collection.get(3),
-          `failed row is absent at throw cut`,
-        ).toBeUndefined()
-        expect(collection.get(2)?.id).toBe(2)
-        expect(second.state).toBe(`pending`)
-        await vi.advanceTimersByTimeAsync(10)
-        firstWrite.resolve()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts, `only successful calls reach handlers`).toEqual(
-          kind === `debounce` ? [[1, 2]] : [[1], [2]],
-        )
-        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-          `fulfilled`,
-          `fulfilled`,
-        ])
-      },
-      async () => {
-        firstWrite.resolve()
-        await vi.advanceTimersByTimeAsync(30)
-      },
-    )
-  })
-
-/**
- * An admitted leading call is eligible before a later call renews debounce's
- * quiet period. While an older handler runs, the later call can merge into the
- * pending transaction, but cannot revoke its eligible start. The model starts
- * the merged successor when the held handler returns, before the quiet timer.
- */
-for (const releaseAt of [12, 24])
-  it(`debounce keeps an eligible leading write when the held handler releases at ${releaseAt}`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = debounceStrategy({
-      wait: 10,
-      leading: true,
-      trailing: true,
-    })
-    const firstWrite = createDeferred<void>()
-    const starts: Array<Array<number>> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      strategy,
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        const ids = transaction.mutations.map(
-          (mutation) => mutation.modified.id,
-        )
-        starts.push(ids)
-        return ids.includes(1) ? firstWrite.promise : Promise.resolve()
-      },
-    })
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutate(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(11)
-        const second = mutate(2)
-        const secondReceipt = observeReceipt(second)
-        await vi.advanceTimersByTimeAsync(1)
-        const third = mutate(3)
-        expect(third).toBe(second)
-        expect(starts).toEqual([[1]])
-        await vi.advanceTimersByTimeAsync(releaseAt - 12)
-        firstWrite.resolve()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts, `leading eligibility survives later call`).toEqual([
-          [1],
-          [2, 3],
-        ])
-        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-          `fulfilled`,
-          `fulfilled`,
-        ])
-        await vi.advanceTimersByTimeAsync(20)
-        expect(starts, `renewed quiet timer cannot repeat the write`).toEqual([
-          [1],
-          [2, 3],
-        ])
-      },
-      async () => {
-        firstWrite.resolve()
-        await vi.advanceTimersByTimeAsync(30)
-      },
-    )
-  })
-
-/**
- * A paced manager owns the commit edge. A caller's manual commit attempt on
- * its pending receipt must throw before any backend handler starts or state
- * changes. The scheduled callback still runs once its timer edge and the held
- * predecessor's release both occur. This two-write grammar crosses all three
- * serial strategies and checks starts, state, and receipts at each cut.
- */
-for (const kind of [`debounce`, `throttle`, `queue`] as const)
-  it(`${kind} rejects manual commit without bypassing paced persistence`, async () => {
-    const collection = await createReadyCollection()
-    const strategy =
-      kind === `debounce`
-        ? debounceStrategy({ wait: 10, leading: true, trailing: true })
-        : kind === `throttle`
-          ? throttleStrategy({ wait: 10, leading: true, trailing: true })
-          : queueStrategy({ wait: 0 })
-    const firstWrite = createDeferred<void>()
-    const starts: Array<number> = []
-    const mutate = createPacedMutations<number, { id: number }>({
-      strategy,
-      onMutate: (id) => collection.insert({ id }),
-      mutationFn: ({ transaction }) => {
-        const id = transaction.mutations[0].modified.id
-        starts.push(id)
-        return id === 1 ? firstWrite.promise : Promise.resolve()
-      },
-    })
-    let second: Transaction<{ id: number }> | undefined
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutate(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts).toEqual([1])
-        second = mutate(2)
-        const secondReceipt = observeReceipt(second)
-        expect(second.state).toBe(`pending`)
-        expect(() => second!.commit()).toThrow(
-          `Paced mutations are committed by their strategy`,
-        )
-        expect(second.state, `manual attempt cannot start persistence`).toBe(
-          `pending`,
-        )
-        expect(starts).toEqual([1])
-        await vi.advanceTimersByTimeAsync(10)
-        expect(starts, `the held handler still owns the flight`).toEqual([1])
-        firstWrite.resolve()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(starts, `the scheduled write starts after release`).toEqual([
-          1, 2,
-        ])
-        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-          `fulfilled`,
-          `fulfilled`,
-        ])
-      },
-      async () => {
-        firstWrite.resolve()
-        if (second?.state === `pending`)
-          second.rollback({ isSecondaryRollback: true })
-        await vi.advanceTimersByTimeAsync(20)
-      },
-    )
-  })
-
-/**
- * An admitted call after a pending transaction rolls back owns a new
- * persistence obligation. The canceled leading callback may still occupy the
- * serial slot, but it cannot consume the later call's quiet edge. This legal
- * history holds the first handler, cancels its pending successor directly or
- * by same-key cascade, admits a new transaction, then crosses the quiet and
- * handler-release cuts. The independent expectation is backend starts 1 and 3:
- * the first already started, the canceled second never starts, and the third
- * retains its own persistence obligation.
- */
-for (const cancellation of [`direct`, `same-key cascade`] as const)
-  it(`debounce persists a new call after ${cancellation} cancels its pending leading predecessor`, async () => {
-    const collection = await createReadyCollection<{
-      id: number
-      value: number
-    }>([{ id: 1, value: 0 }])
-    const strategy = debounceStrategy({
-      wait: 10,
-      leading: true,
-      trailing: true,
-    })
-    const firstWrite = createDeferred<void>()
-    const starts: Array<number> = []
-    const canceled = new Error(`pending leading canceled`)
-    const mutate = createPacedMutations<number, { id: number; value: number }>({
-      strategy,
-      onMutate: (value) =>
-        collection.update(1, (draft) => {
-          draft.value = value
-        }),
-      mutationFn: ({ transaction }) => {
-        const value = transaction.mutations[0].modified.value
-        starts.push(value)
-        return value === 1 ? firstWrite.promise : Promise.resolve()
-      },
-    })
-    let third: Transaction<{ id: number; value: number }> | undefined
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        const first = mutate(1)
-        const firstReceipt = observeReceipt(first)
-        await vi.advanceTimersByTimeAsync(11)
-        const second = mutate(2)
-        const secondReceipt = observeReceipt(second)
-        if (cancellation === `direct`)
-          second.rollback({ error: canceled, isSecondaryRollback: true })
-        else first.rollback({ error: canceled })
-        await vi.advanceTimersByTimeAsync(0)
-        expect(secondReceipt.outcome, `pending successor was canceled`).toBe(
-          `rejected`,
-        )
-        third = mutate(3)
-        const thirdReceipt = observeReceipt(third)
-        expect(third, `a canceled predecessor cannot own later work`).not.toBe(
-          second,
-        )
-        expect(collection.get(1)?.value, `new optimism is retained`).toBe(3)
-        await vi.advanceTimersByTimeAsync(10)
-        expect(starts, `the first handler still holds persistence`).toEqual([1])
-        firstWrite.resolve()
-        await vi.advanceTimersByTimeAsync(0)
-        expect(
-          starts,
-          `new transaction starts after both prerequisites`,
-        ).toEqual([1, 3])
-        expect([
-          firstReceipt.outcome,
-          secondReceipt.outcome,
-          thirdReceipt.outcome,
-        ]).toEqual([
-          cancellation === `direct` ? `fulfilled` : `rejected`,
-          `rejected`,
-          `fulfilled`,
-        ])
-      },
-      async () => {
-        firstWrite.resolve()
-        if (third?.state === `pending`)
-          third.rollback({ isSecondaryRollback: true })
-        await vi.advanceTimersByTimeAsync(30)
-      },
-    )
-  })
-
-/**
- * A callback that throws before admission returns has no caller-visible
- * transaction receipt. Its newly created empty transaction must leave the
- * scope rather than remain pending forever. The resource witness inspects the
- * owning scope after the throw for both admitted and dropped calls; the public
- * Collection state alone cannot reveal this retained empty object.
- */
-for (const admission of [`admitted`, `dropped`, `queued`] as const)
-  it(`releases a newly created ${admission} transaction after onMutate throws`, () => {
-    const create = vi.spyOn(TransactionScope.prototype, `createTransaction`)
-    const failure = new Error(`optimistic callback failed`)
-    const strategy =
-      admission === `queued`
-        ? queueStrategy({ wait: 0 })
-        : debounceStrategy({
-            wait: 10,
-            leading: false,
-            trailing: admission === `admitted`,
-          })
-    const mutate = createPacedMutations<number, { id: number }>({
-      strategy,
-      onMutate: () => {
-        throw failure
-      },
-      mutationFn: () => Promise.resolve(),
-    })
-    try {
-      expect(() => mutate(1)).toThrow(failure)
-      const scope = create.mock.instances.at(-1) as unknown as TransactionScope
-      const transaction = create.mock.results.at(-1)?.value as Transaction<{
-        id: number
-      }>
-      const retained = (
-        scope as unknown as { transactions: Array<Transaction<{ id: number }>> }
-      ).transactions
-      expect(transaction.state, `failed callback owns no pending work`).toBe(
-        `failed`,
-      )
-      expect(retained, `the scope releases failed admission`).not.toContain(
-        transaction,
-      )
-    } finally {
-      const transaction = create.mock.results.at(-1)?.value as
-        Transaction<{ id: number }> | undefined
-      if (transaction?.state === `pending`) {
-        void transaction.isPersisted.promise.catch(() => {})
-        transaction.rollback({ isSecondaryRollback: true })
-      }
-      create.mockRestore()
-      strategy.cleanup()
-    }
-  })
-
-/**
- * Calls merged into one pending paced transaction settle together. When an
- * outer onMutate throws after admitting a nested call, the failed group has no
- * backend attempt and every receipt in that group rejects with the callback
- * error. A later independent call must still persist. The driver observes the
- * rollback immediately, then checks backend starts and receipts after the
- * scheduled edge. This group-failure rule is a product decision for paced
- * reentry; ordinary manual mutate callbacks retain earlier successful calls.
- */
-for (const factory of [debounceStrategy, throttleStrategy])
-  it(`${factory.name} does not fulfill erased nested intent after an outer callback throws`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = factory({ wait: 10, leading: true, trailing: true })
-    const starts: Array<Array<number>> = []
-    const failure = new Error(`outer callback failed`)
-    let nested: Transaction<{ id: number }> | undefined
-    const mutate = createPacedMutations<number, { id: number }>({
-      strategy,
-      onMutate: (id) => {
-        collection.insert({ id })
-        if (id === 1) {
-          nested = mutate(2)
-          throw failure
-        }
-      },
-      mutationFn: ({ transaction }) => {
-        starts.push(
-          transaction.mutations.map((mutation) => mutation.modified.id),
-        )
-        return Promise.resolve()
-      },
-    })
-    await withCleanup(
-      strategy,
-      collection,
-      async () => {
-        expect(() => mutate(1)).toThrow(failure)
-        expect(nested, `nested admission returned a receipt`).toBeDefined()
-        const receipt = observeReceipt(nested!)
-        expect(nested!.state, `the merged group rolls back`).toBe(`failed`)
-        expect(
-          [...collection.keys()],
-          `the failed group has no visible row`,
-        ).toEqual([])
-        const later = mutate(3)
-        const laterReceipt = observeReceipt(later)
-        await vi.advanceTimersByTimeAsync(11)
-        expect(
-          starts,
-          `only the later independent call reaches the backend`,
-        ).toEqual([[3]])
-        expect(receipt).toMatchObject({ outcome: `rejected`, error: failure })
-        expect(laterReceipt.outcome).toBe(`fulfilled`)
-      },
-      async () => {
-        if (nested?.state === `pending`)
-          nested.rollback({ isSecondaryRollback: true })
-        await vi.advanceTimersByTimeAsync(20)
-      },
-    )
-  })
-
-/**
- * An earlier call in the same pending transaction shares the failure. The
- * group has one optimistic lifetime and one backend attempt, so rejecting only
- * the nested call would leave an earlier receipt claiming a partial group.
- * The model rejects both receipts at the throw cut, and a later transaction
- * proves that the strategy did not retain a stale callback.
- */
-for (const factory of [debounceStrategy, throttleStrategy])
-  it(`${factory.name} does not fulfill erased nested intent in an existing pending transaction`, async () => {
-    const collection = await createReadyCollection()
-    const strategy = factory({ wait: 10, leading: false, trailing: true })
-    const starts: Array<Array<number>> = []
-    const failure = new Error(`outer callback failed`)
-    let nested: Transaction<{ id: number }> | undefined
-    const mutate = createPacedMutations<number, { id: number }>({
-      strategy,
-      onMutate: (id) => {
-        collection.insert({ id })
-        if (id === 1) {
-          nested = mutate(2)
-          throw failure
-        }
-      },
-      mutationFn: ({ transaction }) => {
-        starts.push(
-          transaction.mutations.map((mutation) => mutation.modified.id),
-        )
-        return Promise.resolve()
-      },
-    })
-    await withCleanup(strategy, collection, async () => {
-      const prior = mutate(0)
-      const priorReceipt = observeReceipt(prior)
-      expect(() => mutate(1)).toThrow(failure)
-      expect(nested, `nested admission returned a receipt`).toBeDefined()
-      const nestedReceipt = observeReceipt(nested!)
-      expect(prior.state, `the merged group rolls back`).toBe(`failed`)
-      expect(
-        [...collection.keys()],
-        `the failed group has no visible row`,
-      ).toEqual([])
-      const later = mutate(3)
-      const laterReceipt = observeReceipt(later)
-      await vi.advanceTimersByTimeAsync(11)
-      expect(starts, `only the later transaction persists`).toEqual([[3]])
-      expect(priorReceipt).toMatchObject({
-        outcome: `rejected`,
-        error: failure,
-      })
-      expect(nestedReceipt).toMatchObject({
-        outcome: `rejected`,
-        error: failure,
-      })
-      expect(laterReceipt.outcome).toBe(`fulfilled`)
-    })
-  })
-
-/**
- * A throttle timer transfers one eligible transaction to serial persistence.
- * A later call while that transaction waits for a held handler joins it. The
- * model has one pending transaction and no timer after the transfer. At the
- * release cut, the handler receives both rows once; no later timer repeats it.
- */
-it(`throttle merges a pending serial write without a stale trailing timer`, async () => {
-  const collection = await createReadyCollection()
-  const strategy = throttleStrategy({ wait: 10, leading: true, trailing: true })
-  const firstWrite = createDeferred<void>()
-  const starts: Array<Array<number>> = []
-  const mutate = createPacedMutations<number, { id: number }>({
-    strategy,
-    onMutate: (id) => collection.insert({ id }),
-    mutationFn: ({ transaction }) => {
-      const ids = transaction.mutations.map((mutation) => mutation.modified.id)
-      starts.push(ids)
-      return ids.includes(1) ? firstWrite.promise : Promise.resolve()
-    },
-  })
-  await withCleanup(
-    strategy,
-    collection,
-    async () => {
-      const first = mutate(1)
-      const firstReceipt = observeReceipt(first)
-      await vi.advanceTimersByTimeAsync(1)
-      const second = mutate(2)
-      const secondReceipt = observeReceipt(second)
-      await vi.advanceTimersByTimeAsync(10)
-      const third = mutate(3)
-      expect(third).toBe(second)
-      expect(second.state).toBe(`pending`)
-      expect([...collection.keys()].sort()).toEqual([1, 2, 3])
-      firstWrite.resolve()
-      await vi.advanceTimersByTimeAsync(0)
-      expect(starts, `release starts the one pending transaction`).toEqual([
-        [1],
-        [2, 3],
-      ])
-      expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
-        `fulfilled`,
-        `fulfilled`,
-      ])
-      await vi.advanceTimersByTimeAsync(30)
-      expect(starts, `no stale timer repeats the transaction`).toEqual([
-        [1],
-        [2, 3],
-      ])
-    },
-    async () => {
-      firstWrite.resolve()
-      await vi.advanceTimersByTimeAsync(30)
-    },
-  )
-})
diff --git a/packages/db/tests/paced-mutations-scenarios.test.ts b/packages/db/tests/paced-mutations-scenarios.test.ts
new file mode 100644
index 0000000000..477d6e202d
--- /dev/null
+++ b/packages/db/tests/paced-mutations-scenarios.test.ts
@@ -0,0 +1,2150 @@
+/** Ordinary tests moved from paced-mutations-oracle.test.ts; the oracle file owns the law. */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../src/collection'
+import { createDeferred } from '../src/deferred'
+import { createPacedMutations } from '../src/paced-mutations'
+import { createSerialPacer } from '../src/strategies/serial-pacer'
+import {
+  debounceStrategy,
+  queueStrategy,
+  throttleStrategy,
+} from '../src/strategies'
+import { TransactionScope } from '../src/transactions'
+import { mockSyncCollectionOptionsNoInitialState } from './utils'
+import {
+  createReadyCollection,
+  observeReceipt,
+  origin,
+  withCleanup,
+} from './paced-mutations-support'
+import type { Start } from './paced-mutations-support'
+import type { Strategy } from '../src/strategies/types'
+import type { Transaction } from '../src/transactions'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(origin)
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * A callback can throw before returning a persistence promise. The serial
+ * pacer's two-call law surfaces that same error and keeps the next eligible
+ * callback runnable. This direct scheduler seam isolates the throw boundary;
+ * public paced histories below check transaction and receipt behavior.
+ */
+it(`serial pacing stays usable after a synchronous callback error`, async () => {
+  const pacer = createSerialPacer(0)
+  const failure = new Error(`callback failed`)
+  const starts: Array<number> = []
+  expect(() =>
+    pacer.schedule(() => {
+      throw failure
+    }),
+  ).toThrow(failure)
+  pacer.schedule(() => {
+    starts.push(2)
+    return Promise.resolve()
+  })
+  await vi.advanceTimersByTimeAsync(0)
+  expect(starts, `second eligible callback starts`).toEqual([2])
+})
+it(`serial pacing drains a successor scheduled before its callback throws`, async () => {
+  const pacer = createSerialPacer(0)
+  const failure = new Error(`callback failed`)
+  const starts: Array<number> = []
+  expect(() =>
+    pacer.schedule(() => {
+      pacer.schedule(() => {
+        starts.push(2)
+        return Promise.resolve()
+      })
+      throw failure
+    }),
+  ).toThrow(failure)
+  await vi.advanceTimersByTimeAsync(0)
+  expect(starts, `the reentrant successor remains admitted`).toEqual([2])
+})
+describe(`paced mutation timeline oracle`, () => {
+  it(`drains admitted queue writes after Collection cleanup`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = queueStrategy({ wait: 10 })
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        const id = transaction.mutations[0].changes.id
+        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+        starts.push(id)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    const first = mutate(1)
+    const second = mutate(2)
+    const firstReceipt = observeReceipt(first)
+    const secondReceipt = observeReceipt(second)
+    strategy.cleanup()
+    await collection.cleanup()
+    expect(starts).toEqual([1])
+    await vi.advanceTimersByTimeAsync(0)
+    expect(starts).toEqual([1])
+    await vi.advanceTimersByTimeAsync(10)
+    expect(starts).toEqual([1, 2])
+    expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+      `fulfilled`,
+      `fulfilled`,
+    ])
+  })
+  it(`rejects a mutation after queue cleanup with a disposal reason`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = queueStrategy({ wait: 10 })
+    let starts = 0
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: () => {
+        starts++
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      const admitted = mutate(1)
+      const admittedReceipt = observeReceipt(admitted)
+      strategy.cleanup()
+      const transaction = mutate(2)
+      const receipt = observeReceipt(transaction)
+      expect(collection.get(1)?.id).toBe(1)
+      expect(collection.get(2)).toBeUndefined()
+      await vi.advanceTimersByTimeAsync(20)
+      expect(starts).toBe(1)
+      expect(admittedReceipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+      expect(transaction.state).toBe(`failed`)
+      expect(collection.get(2)).toBeUndefined()
+      expect(receipt).toMatchObject({
+        outcome: `rejected`,
+        error: { name: `QueueDisposedError` },
+      })
+    })
+  })
+  for (const leading of [true, undefined] as const) {
+    it(`drops a within-window throttle call when trailing is false and leading is ${String(leading)}`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = throttleStrategy({ wait: 10, leading, trailing: false })
+      const starts: Array<Start> = []
+      const mutate = createPacedMutations<number, { id: number }>({
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          const id = transaction.mutations[0].changes.id
+          if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+          starts.push({ at: Date.now() - origin, ids: [id] })
+          return Promise.resolve()
+        },
+        strategy,
+      })
+      await withCleanup(strategy, collection, async () => {
+        const first = mutate(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(4)
+        expect(starts).toEqual([{ at: 0, ids: [1] }])
+        expect(firstReceipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+
+        const dropped = mutate(2)
+        const droppedReceipt = observeReceipt(dropped)
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts).toEqual([{ at: 0, ids: [1] }])
+        expect(dropped.state).toBe(`failed`)
+        expect(collection.get(2)).toBeUndefined()
+        expect(droppedReceipt).toMatchObject({
+          outcome: `rejected`,
+          error: { name: `ThrottleCallDroppedError` },
+        })
+
+        await vi.advanceTimersByTimeAsync(10)
+        const next = mutate(3)
+        const nextReceipt = observeReceipt(next)
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts).toEqual([
+          { at: 0, ids: [1] },
+          { at: 14, ids: [3] },
+        ])
+        expect(nextReceipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+      })
+    })
+  }
+  it(`rejects every optimistic call when both throttle edges are disabled`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = throttleStrategy({
+      wait: 10,
+      leading: false,
+      trailing: false,
+    })
+    let starts = 0
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: () => {
+        starts++
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      for (const id of [1, 2]) {
+        const transaction = mutate(id)
+        const receipt = observeReceipt(transaction)
+        await vi.advanceTimersByTimeAsync(10)
+        expect(transaction.state).toBe(`failed`)
+        expect(collection.get(id)).toBeUndefined()
+        expect(receipt).toMatchObject({
+          outcome: `rejected`,
+          error: { name: `ThrottleCallDroppedError` },
+        })
+      }
+      expect(starts).toBe(0)
+    })
+  })
+  for (const { name, strategyFactory, errorName } of [
+    {
+      name: `throttle`,
+      strategyFactory: () =>
+        throttleStrategy({ wait: 10, leading: true, trailing: false }),
+      errorName: `ThrottleCallDroppedError`,
+    },
+    {
+      name: `debounce`,
+      strategyFactory: () =>
+        debounceStrategy({ wait: 10, leading: true, trailing: false }),
+      errorName: `DebounceCallDroppedError`,
+    },
+  ]) {
+    it(`a dropped ${name} update preserves the prior same-row write`, async () => {
+      const collection = createCollection(
+        mockSyncCollectionOptionsNoInitialState<{ id: number; value: number }>({
+          id: `paced-${name}-same-row`,
+          getKey: (item) => item.id,
+        }),
+      )
+      const preload = collection.preload()
+      collection.utils.begin()
+      collection.utils.commit()
+      collection.utils.markReady()
+      await preload
+      const strategy = strategyFactory()
+      const starts: Array<number> = []
+      let releaseFirst: (() => void) | undefined
+      const mutate = createPacedMutations<
+        number,
+        { id: number; value: number }
+      >({
+        onMutate: (value) => {
+          if (value === 1) collection.insert({ id: 1, value })
+          else
+            collection.update(1, (draft) => {
+              draft.value = value
+            })
+        },
+        mutationFn: ({ transaction }) => {
+          const value = transaction.mutations[0].changes.value
+          if (typeof value !== `number`) throw new Error(`Missing value`)
+          starts.push(value)
+          if (value === 1)
+            return new Promise<void>((resolve) => {
+              releaseFirst = resolve
+            })
+          return Promise.resolve()
+        },
+        strategy,
+      })
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const first = mutate(1)
+          const firstReceipt = observeReceipt(first)
+          await vi.advanceTimersByTimeAsync(4)
+          expect(first.state).toBe(`persisting`)
+          const dropped = mutate(2)
+          const droppedReceipt = observeReceipt(dropped)
+          await vi.advanceTimersByTimeAsync(0)
+          expect(droppedReceipt).toMatchObject({
+            outcome: `rejected`,
+            error: { name: errorName },
+          })
+          expect(collection.get(1)?.value).toBe(1)
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(0)
+          expect(starts).toEqual([1])
+          expect(firstReceipt).toMatchObject({
+            outcome: `fulfilled`,
+            returnedSame: true,
+          })
+        },
+        async () => {
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(0)
+        },
+      )
+    })
+  }
+  it(`drains an admitted trailing throttle write after cleanup at its regular edge`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = throttleStrategy({
+      wait: 10,
+      leading: false,
+      trailing: true,
+    })
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: () => {
+        starts.push(Date.now() - origin)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      const transaction = mutate(1)
+      const receipt = observeReceipt(transaction)
+      expect(collection.get(1)?.id).toBe(1)
+      await vi.advanceTimersByTimeAsync(4)
+      strategy.cleanup()
+      await collection.cleanup()
+      await vi.advanceTimersByTimeAsync(5)
+      expect(starts).toEqual([])
+      expect(transaction.state).toBe(`pending`)
+      expect(receipt.outcome).toBe(`pending`)
+      await vi.advanceTimersByTimeAsync(1)
+      expect(starts).toEqual([10])
+      expect(transaction.state).toBe(`completed`)
+      expect(receipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+    })
+  })
+  it(`drains a pending debounce write after cleanup at its quiet edge`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = debounceStrategy({ wait: 10 })
+    const starts: Array<Start> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        starts.push({
+          at: Date.now() - origin,
+          ids: transaction.mutations.map((mutation) => {
+            const id = mutation.changes.id
+            if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+            return id
+          }),
+        })
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      const transaction = mutate(1)
+      const receipt = observeReceipt(transaction)
+      expect(collection.get(1)?.id).toBe(1)
+      await vi.advanceTimersByTimeAsync(4)
+      expect(mutate(2)).toBe(transaction)
+      expect(collection.get(2)?.id).toBe(2)
+      await vi.advanceTimersByTimeAsync(4)
+      strategy.cleanup()
+      await collection.cleanup()
+      await vi.advanceTimersByTimeAsync(5)
+      expect(starts).toEqual([])
+      expect(transaction.state).toBe(`pending`)
+      expect(receipt.outcome).toBe(`pending`)
+      await vi.advanceTimersByTimeAsync(1)
+      expect(starts).toEqual([{ at: 14, ids: [1, 2] }])
+      expect(transaction.state).toBe(`completed`)
+      expect(receipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+    })
+  })
+  it(`drains a second leading debounce transaction when trailing is omitted`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = debounceStrategy({ wait: 10, leading: true })
+    const starts: Array<Start> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        starts.push({
+          at: Date.now() - origin,
+          ids: transaction.mutations.map((mutation) => {
+            const id = mutation.changes.id
+            if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+            return id
+          }),
+        })
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      const first = mutate(1)
+      const firstReceipt = observeReceipt(first)
+      await vi.advanceTimersByTimeAsync(4)
+      expect(starts).toEqual([{ at: 0, ids: [1] }])
+      expect(firstReceipt.outcome).toBe(`fulfilled`)
+      const second = mutate(2)
+      const secondReceipt = observeReceipt(second)
+      expect(collection.get(2)?.id).toBe(2)
+      await vi.advanceTimersByTimeAsync(4)
+      strategy.cleanup()
+      await collection.cleanup()
+      await vi.advanceTimersByTimeAsync(5)
+      expect(starts).toEqual([{ at: 0, ids: [1] }])
+      expect(second.state).toBe(`pending`)
+      expect(secondReceipt.outcome).toBe(`pending`)
+      await vi.advanceTimersByTimeAsync(1)
+      expect(starts).toEqual([
+        { at: 0, ids: [1] },
+        { at: 14, ids: [2] },
+      ])
+      expect(secondReceipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+    })
+  })
+  it(`rejects a debounce call dropped inside a leading-only window`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = debounceStrategy({
+      wait: 10,
+      leading: true,
+      trailing: false,
+    })
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        const id = transaction.mutations[0].changes.id
+        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+        starts.push(id)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      const first = mutate(1)
+      const firstReceipt = observeReceipt(first)
+      await vi.advanceTimersByTimeAsync(4)
+      expect(starts).toEqual([1])
+      expect(firstReceipt.outcome).toBe(`fulfilled`)
+      const dropped = mutate(2)
+      const droppedReceipt = observeReceipt(dropped)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(dropped.state).toBe(`failed`)
+      expect(collection.get(2)).toBeUndefined()
+      expect(droppedReceipt).toMatchObject({
+        outcome: `rejected`,
+        error: { name: `DebounceCallDroppedError` },
+      })
+      await vi.advanceTimersByTimeAsync(10)
+      const next = mutate(3)
+      const nextReceipt = observeReceipt(next)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(starts).toEqual([1, 3])
+      expect(nextReceipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+    })
+  })
+  for (const leading of [false, undefined] as const) {
+    it(`rejects debounce calls when both edges are disabled and leading is ${String(leading)}`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = debounceStrategy({ wait: 10, leading, trailing: false })
+      let starts = 0
+      const mutate = createPacedMutations<number, { id: number }>({
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: () => {
+          starts++
+          return Promise.resolve()
+        },
+        strategy,
+      })
+      await withCleanup(strategy, collection, async () => {
+        for (const id of [1, 2]) {
+          const transaction = mutate(id)
+          const receipt = observeReceipt(transaction)
+          await vi.advanceTimersByTimeAsync(10)
+          expect(transaction.state).toBe(`failed`)
+          expect(collection.get(id)).toBeUndefined()
+          expect(receipt).toMatchObject({
+            outcome: `rejected`,
+            error: { name: `DebounceCallDroppedError` },
+          })
+        }
+        expect(starts).toBe(0)
+      })
+    })
+  }
+  for (const trailing of [true, false] as const) {
+    it(`starts the first leading throttle call at epoch zero with trailing ${String(trailing)}`, async () => {
+      vi.setSystemTime(0)
+      const collection = await createReadyCollection()
+      const strategy = throttleStrategy({ wait: 10, leading: true, trailing })
+      const starts: Array<number> = []
+      const mutate = createPacedMutations<number, { id: number }>({
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: () => {
+          starts.push(Date.now())
+          return Promise.resolve()
+        },
+        strategy,
+      })
+      await withCleanup(strategy, collection, async () => {
+        const transaction = mutate(1)
+        const receipt = observeReceipt(transaction)
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts).toEqual([0])
+        expect(receipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+      })
+    })
+  }
+  it(`keeps queue wait spacing while draining after cleanup`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = queueStrategy({ wait: 10 })
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: () => {
+        starts.push(Date.now() - origin)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+    await withCleanup(strategy, collection, async () => {
+      const first = mutate(1)
+      const second = mutate(2)
+      const firstReceipt = observeReceipt(first)
+      const secondReceipt = observeReceipt(second)
+      strategy.cleanup()
+      strategy.cleanup()
+      await vi.advanceTimersByTimeAsync(0)
+      expect(starts, `starts before wait`).toEqual([0])
+      expect(second.state).toBe(`pending`)
+      expect(secondReceipt.outcome).toBe(`pending`)
+      expect(collection.get(2)?.id).toBe(2)
+      await vi.advanceTimersByTimeAsync(10)
+      expect(starts).toEqual([0, 10])
+      expect([first.state, second.state]).toEqual([`completed`, `completed`])
+      expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+        `fulfilled`,
+        `fulfilled`,
+      ])
+    })
+  })
+  for (const getItemsFrom of [`front`, `back`] as const) {
+    it(`drains admitted queue work in ${getItemsFrom} order after cleanup`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = queueStrategy({ wait: 10, getItemsFrom })
+      const started: Array<number> = []
+      let releaseFirst: (() => void) | undefined
+      const mutate = createPacedMutations<number, { id: number }>({
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          const id = transaction.mutations[0].changes.id
+          if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+          started.push(id)
+          if (id === 1) {
+            return new Promise<void>((resolve) => {
+              releaseFirst = resolve
+            })
+          }
+          return Promise.resolve()
+        },
+        strategy,
+      })
+
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const first = mutate(1)
+          const second = mutate(2)
+          const third = mutate(3)
+          const firstReceipt = observeReceipt(first)
+          const secondReceipt = observeReceipt(second)
+          const thirdReceipt = observeReceipt(third)
+          await vi.advanceTimersByTimeAsync(0)
+          expect(started).toEqual([1])
+          strategy.cleanup()
+          strategy.cleanup()
+          await vi.advanceTimersByTimeAsync(20)
+          expect(started).toEqual([1])
+          expect(second.state).toBe(`pending`)
+          expect(collection.get(2)?.id).toBe(2)
+          expect(collection.get(3)?.id).toBe(3)
+
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(0)
+          expect(started, `admitted work after cleanup`).toEqual(
+            getItemsFrom === `front` ? [1, 2, 3] : [1, 3, 2],
+          )
+          expect([first.state, second.state, third.state]).toEqual([
+            `completed`,
+            `completed`,
+            `completed`,
+          ])
+          expect([
+            firstReceipt.outcome,
+            secondReceipt.outcome,
+            thirdReceipt.outcome,
+          ]).toEqual([`fulfilled`, `fulfilled`, `fulfilled`])
+          await vi.advanceTimersByTimeAsync(10)
+          expect(started, `no write after drain`).toEqual(
+            getItemsFrom === `front` ? [1, 2, 3] : [1, 3, 2],
+          )
+
+          expect(() =>
+            strategy.execute(() => {
+              throw new Error(`Disposed queue ran a new callback`)
+            }),
+          ).toThrowError(`Queue has been cleaned up`)
+        },
+        async () => {
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(0)
+        },
+      )
+    })
+  }
+  it(`holds later queue writes until each prior transaction settles`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = queueStrategy({ wait: 10 })
+    const started: Array<number> = []
+    const releases = new Map<number, () => void>()
+    let releaseFutureWrites = false
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        const id = transaction.mutations[0].changes.id
+        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+        started.push(id)
+        if (releaseFutureWrites || id === 3) return Promise.resolve()
+        return new Promise<void>((resolve) => releases.set(id, resolve))
+      },
+      strategy,
+    })
+
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutate(1)
+        const second = mutate(2)
+        const third = mutate(3)
+        expect(collection.get(1)?.id).toBe(1)
+        expect(collection.get(2)?.id).toBe(2)
+        expect(collection.get(3)?.id).toBe(3)
+
+        await vi.advanceTimersByTimeAsync(30)
+        expect(started).toEqual([1])
+        expect([first.state, second.state, third.state]).toEqual([
+          `persisting`,
+          `pending`,
+          `pending`,
+        ])
+
+        releases.get(1)?.()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(started).toEqual([1, 2])
+        expect([first.state, second.state, third.state]).toEqual([
+          `completed`,
+          `persisting`,
+          `pending`,
+        ])
+
+        releases.get(2)?.()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(started).toEqual([1, 2, 3])
+        for (const transaction of [first, second, third]) {
+          expect(await transaction.isPersisted.promise).toBe(transaction)
+        }
+      },
+      async () => {
+        releaseFutureWrites = true
+        for (const resolve of releases.values()) resolve()
+        await vi.advanceTimersByTimeAsync(0)
+      },
+    )
+  })
+  for (const { maxSize, wait, expectedStarts, expectedStates } of [
+    {
+      maxSize: 0,
+      wait: 0,
+      expectedStarts: [],
+      expectedStates: [`failed`, `failed`, `failed`],
+    },
+    {
+      maxSize: 1,
+      wait: 10,
+      expectedStarts: [1, 2],
+      expectedStates: [`persisting`, `pending`, `failed`],
+    },
+    {
+      maxSize: 1,
+      wait: 0,
+      expectedStarts: [1, 2, 3],
+      expectedStates: [`persisting`, `pending`, `pending`],
+    },
+  ]) {
+    it(`queue capacity ${maxSize} at wait ${wait} rejects only overflow`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = queueStrategy({ maxSize, wait })
+      const started: Array<number> = []
+      const releases: Array<() => void> = []
+      const mutate = createPacedMutations<number, { id: number }>({
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          const id = transaction.mutations[0].changes.id
+          if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+          started.push(id)
+          return new Promise<void>((resolve) => releases.push(resolve))
+        },
+        strategy,
+      })
+
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const transactions = [mutate(1), mutate(2), mutate(3)]
+          const receipts = transactions.map(observeReceipt)
+          await vi.advanceTimersByTimeAsync(0)
+          expect(transactions.map((transaction) => transaction.state)).toEqual(
+            expectedStates,
+          )
+          for (const [index, state] of expectedStates.entries()) {
+            expect(collection.get(index + 1)?.id).toBe(
+              state === `failed` ? undefined : index + 1,
+            )
+          }
+          for (const [index, state] of expectedStates.entries()) {
+            if (state === `failed`) {
+              expect(
+                receipts[index],
+                `overflow receipt at admission`,
+              ).toMatchObject({
+                outcome: `rejected`,
+                error: { name: `QueueCapacityExceededError` },
+              })
+            }
+          }
+          await vi.advanceTimersByTimeAsync(30)
+          for (let index = 0; index < expectedStarts.length; index++) {
+            releases[index]?.()
+            await vi.advanceTimersByTimeAsync(0)
+          }
+          expect(started).toEqual(expectedStarts)
+          for (const [index, state] of expectedStates.entries()) {
+            if (state !== `failed`) {
+              expect(
+                receipts[index],
+                `admitted receipt after drain`,
+              ).toMatchObject({
+                outcome: `fulfilled`,
+                returnedSame: true,
+              })
+            }
+          }
+        },
+        async () => {
+          for (const release of releases) release()
+          await vi.advanceTimersByTimeAsync(0)
+        },
+      )
+    })
+  }
+  it(`queue overflow preserves admitted same-key mutations`, async () => {
+    const collection = createCollection(
+      mockSyncCollectionOptionsNoInitialState<{ id: number; value: number }>({
+        id: `paced-capacity-same-key`,
+        getKey: (item) => item.id,
+      }),
+    )
+    const preload = collection.preload()
+    collection.utils.begin()
+    collection.utils.commit()
+    collection.utils.markReady()
+    await preload
+    const strategy = queueStrategy({ maxSize: 1, wait: 10 })
+    const started: Array<number> = []
+    const releases: Array<() => void> = []
+    const mutate = createPacedMutations<number, { id: number; value: number }>({
+      onMutate: (value) => {
+        if (value === 1) collection.insert({ id: 1, value })
+        else
+          collection.update(1, (draft) => {
+            draft.value = value
+          })
+      },
+      mutationFn: ({ transaction }) => {
+        const value = transaction.mutations[0].changes.value
+        if (typeof value !== `number`) throw new Error(`Missing value`)
+        started.push(value)
+        return new Promise<void>((resolve) => releases.push(resolve))
+      },
+      strategy,
+    })
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutate(1)
+        const second = mutate(2)
+        const overflow = mutate(3)
+        const firstReceipt = observeReceipt(first)
+        const secondReceipt = observeReceipt(second)
+        const overflowReceipt = observeReceipt(overflow)
+        await vi.advanceTimersByTimeAsync(0)
+        expect([first.state, second.state, overflow.state]).toEqual([
+          `persisting`,
+          `pending`,
+          `failed`,
+        ])
+        expect(collection.get(1)?.value).toBe(2)
+        expect(overflowReceipt, `same-key overflow receipt`).toMatchObject({
+          outcome: `rejected`,
+          error: { name: `QueueCapacityExceededError` },
+        })
+        await vi.advanceTimersByTimeAsync(10)
+        releases[0]?.()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(started).toEqual([1, 2])
+        expect(firstReceipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+        expect(secondReceipt.outcome).toBe(`pending`)
+        expect(
+          collection.get(1)?.value,
+          `admitted optimistic update after first settlement`,
+        ).toBe(2)
+        releases[1]?.()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(secondReceipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+      },
+      async () => {
+        for (const release of releases) release()
+        await vi.advanceTimersByTimeAsync(0)
+      },
+    )
+  })
+  it(`keeps a void-returning custom queue transaction pending until its callback`, async () => {
+    const collection = await createReadyCollection()
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const strategy: Strategy = {
+      _type: `queue`,
+      execute: (fn) => {
+        timer = setTimeout(() => fn(), 10)
+      },
+      cleanup: () => {
+        if (timer !== undefined) clearTimeout(timer)
+      },
+    }
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: () => {
+        starts.push(Date.now() - origin)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+
+    await withCleanup(strategy, collection, async () => {
+      const transaction = mutate(1)
+      const receipt = observeReceipt(transaction)
+      expect(transaction.state, `custom queue admission`).toBe(`pending`)
+      expect(collection.get(1)?.id).toBe(1)
+      await vi.advanceTimersByTimeAsync(10)
+      expect(starts).toEqual([10])
+      expect(receipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+    })
+  })
+  it(`keeps a false-returning custom batch transaction pending until its callback`, async () => {
+    const collection = await createReadyCollection()
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const strategy: Strategy = {
+      _type: `batch`,
+      execute: (fn) => {
+        timer = setTimeout(() => fn(), 10)
+        return false
+      },
+      cleanup: () => {
+        if (timer !== undefined) clearTimeout(timer)
+      },
+    }
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: () => {
+        starts.push(Date.now() - origin)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+
+    await withCleanup(strategy, collection, async () => {
+      const transaction = mutate(1)
+      const receipt = observeReceipt(transaction)
+      expect(transaction.state, `custom batch admission`).toBe(`pending`)
+      expect(collection.get(1)?.id).toBe(1)
+      await vi.advanceTimersByTimeAsync(10)
+      expect(starts).toEqual([10])
+      expect(receipt).toMatchObject({
+        outcome: `fulfilled`,
+        returnedSame: true,
+      })
+    })
+  })
+  it(`uses captured debounce options when reporting a dropped call`, async () => {
+    const collection = await createReadyCollection()
+    const options = { wait: 10, leading: true, trailing: false }
+    const strategy = debounceStrategy(options)
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        const id = transaction.mutations[0].changes.id
+        if (typeof id !== `number`) throw new Error(`Missing mutation ID`)
+        starts.push(id)
+        return Promise.resolve()
+      },
+      strategy,
+    })
+
+    await withCleanup(strategy, collection, async () => {
+      const first = mutate(1)
+      const firstReceipt = observeReceipt(first)
+      await vi.advanceTimersByTimeAsync(4)
+      expect(firstReceipt.outcome).toBe(`fulfilled`)
+      options.trailing = true
+      const dropped = mutate(2)
+      const droppedReceipt = observeReceipt(dropped)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(dropped.state).toBe(`failed`)
+      expect(collection.get(2)).toBeUndefined()
+      expect(droppedReceipt).toMatchObject({
+        outcome: `rejected`,
+        error: { name: `DebounceCallDroppedError` },
+      })
+      await vi.advanceTimersByTimeAsync(10)
+      expect(starts).toEqual([1])
+    })
+  })
+  it(`strategy factories preserve frozen caller options`, () => {
+    const debounceOptions = Object.freeze({ wait: 10 })
+    const throttleOptions = Object.freeze({ wait: 10 })
+    const queueOptions = Object.freeze({ wait: 10, maxSize: 1 })
+    const debounce = debounceStrategy(debounceOptions)
+    const throttle = throttleStrategy(throttleOptions)
+    const queue = queueStrategy(queueOptions)
+    try {
+      expect(debounceOptions).toEqual({ wait: 10 })
+      expect(throttleOptions).toEqual({ wait: 10 })
+      expect(queueOptions).toEqual({ wait: 10, maxSize: 1 })
+    } finally {
+      debounce.cleanup()
+      throttle.cleanup()
+      queue.cleanup()
+    }
+  })
+  it(`preserves a trace failure and cleanup failure separately`, async () => {
+    const collection = await createReadyCollection()
+    const cleanupCollection = vi.spyOn(collection, `cleanup`)
+    const cleanupError = new Error(`strategy cleanup failed`)
+    const strategy: Strategy = {
+      _type: `queue`,
+      execute: () => true,
+      cleanup: () => {
+        throw cleanupError
+      },
+    }
+    const caught: unknown = await withCleanup(strategy, collection, () => {
+      expect([{ at: 0, ids: [1] }], `final execution trace`).toEqual([
+        { at: 10, ids: [1] },
+      ])
+      return Promise.resolve()
+    }).then(
+      () => undefined,
+      (error: unknown) => error,
+    )
+
+    expect(caught).toBeInstanceOf(AggregateError)
+    const aggregate = caught as AggregateError
+    expect(aggregate.cause).toMatchObject({ name: `AssertionError` })
+    expect((aggregate.cause as Error).message).toContain(
+      `final execution trace`,
+    )
+    expect(aggregate.errors).toEqual([cleanupError])
+    expect(cleanupCollection).toHaveBeenCalledTimes(1)
+  })
+})
+// Serialization must compose with timing rather than replace it. A delayed
+// throttle start moves its next spacing boundary. A new debounce call moves
+// the quiet boundary even if an earlier edge became eligible during the hold.
+// These three-call histories distinguish a bare manager lock from that law.
+describe(`paced persistence timing after a hold`, () => {
+  for (const kind of [`debounce`, `throttle`] as const) {
+    it(`${kind} preserves its next time boundary around a delayed write`, async () => {
+      const collection = await createReadyCollection()
+      const strategy =
+        kind === `debounce`
+          ? debounceStrategy({ wait: 10, leading: false, trailing: true })
+          : throttleStrategy({ wait: 10, leading: true, trailing: true })
+      const starts: Array<Start> = []
+      let releaseFirst: (() => void) | undefined
+      const receipts: Array<ReturnType<typeof observeReceipt>> = []
+      const mutate = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          const ids = transaction.mutations.map(
+            (mutation) => mutation.modified.id,
+          )
+          starts.push({ at: Date.now() - origin, ids })
+          return ids[0] === 1
+            ? new Promise<void>((resolve) => {
+                releaseFirst = resolve
+              })
+            : Promise.resolve()
+        },
+      })
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const first = mutate(1)
+          receipts.push(observeReceipt(first))
+          await vi.advanceTimersByTimeAsync(kind === `debounce` ? 11 : 1)
+          const second = mutate(2)
+          receipts.push(observeReceipt(second))
+          if (kind === `debounce`) {
+            await vi.advanceTimersByTimeAsync(11)
+            // t22: a new call invalidates the old t21 quiet edge; now due at t32.
+            const third = mutate(3)
+            receipts.push(observeReceipt(third))
+            expect(third, `one pending transaction while held`).toBe(second)
+            await vi.advanceTimersByTimeAsync(1)
+            releaseFirst!()
+            await vi.advanceTimersByTimeAsync(0)
+            expect(starts, `release before renewed quiet edge`).toEqual([
+              { at: 10, ids: [1] },
+            ])
+            expect(second.state).toBe(`pending`)
+            expect([...collection.keys()].sort()).toEqual([2, 3])
+            await vi.advanceTimersByTimeAsync(8)
+            expect(starts, `one tick before renewed quiet edge`).toEqual([
+              { at: 10, ids: [1] },
+            ])
+            await vi.advanceTimersByTimeAsync(1)
+            expect(starts, `renewed quiet edge`).toEqual([
+              { at: 10, ids: [1] },
+              { at: 32, ids: [2, 3] },
+            ])
+          } else {
+            await vi.advanceTimersByTimeAsync(14)
+            // t15: actual execution, rather than the blocked t10 appointment,
+            // starts the documented ten-tick minimum spacing for the next write.
+            releaseFirst!()
+            await vi.advanceTimersByTimeAsync(0)
+            expect(starts, `delayed second write`).toEqual([
+              { at: 0, ids: [1] },
+              { at: 15, ids: [2] },
+            ])
+            await vi.advanceTimersByTimeAsync(1)
+            const third = mutate(3)
+            receipts.push(observeReceipt(third))
+            expect(collection.get(3)?.id).toBe(3)
+            await vi.advanceTimersByTimeAsync(8)
+            expect(starts, `one tick before actual-start spacing`).toHaveLength(
+              2,
+            )
+            expect(third.state).toBe(`pending`)
+            await vi.advanceTimersByTimeAsync(1)
+            expect(starts, `actual-start spacing edge`).toEqual([
+              { at: 0, ids: [1] },
+              { at: 15, ids: [2] },
+              { at: 25, ids: [3] },
+            ])
+          }
+          expect(
+            receipts.map((receipt) => receipt.outcome),
+            `all admitted callers settle`,
+          ).toEqual([`fulfilled`, `fulfilled`, `fulfilled`])
+          expect(receipts.every((receipt) => receipt.returnedSame)).toBe(true)
+          await vi.advanceTimersByTimeAsync(20)
+          expect(starts, `no duplicate callback after drain`).toHaveLength(
+            kind === `debounce` ? 2 : 3,
+          )
+        },
+        async () => {
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(40)
+        },
+      )
+    })
+  }
+})
+// A leading-only timer may admit work after its old window while persistence
+// is still held. A later within-window dropped call must reject only itself,
+// as the existing dropped-call contract requires. Serializing writes exposes
+// this admission boundary because the admitted transaction stays pending.
+describe(`paced pending admission isolation`, () => {
+  for (const factory of [debounceStrategy, throttleStrategy])
+    it(`${factory.name} rejects only the skipped call while an admitted successor waits`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = factory({
+        wait: 10,
+        leading: true,
+        trailing: false,
+      })
+      const starts: Array<number> = []
+      let releaseFirst: (() => void) | undefined
+      const mutate = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          const id = transaction.mutations[0].modified.id
+          starts.push(id)
+          return id === 1
+            ? new Promise<void>((resolve) => {
+                releaseFirst = resolve
+              })
+            : Promise.resolve()
+        },
+      })
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const first = mutate(1)
+          const firstReceipt = observeReceipt(first)
+          await vi.advanceTimersByTimeAsync(11)
+          const admitted = mutate(2)
+          const admittedReceipt = observeReceipt(admitted)
+          await vi.advanceTimersByTimeAsync(1)
+          const dropped = mutate(3)
+          const droppedReceipt = observeReceipt(dropped)
+          await vi.advanceTimersByTimeAsync(0)
+          expect(
+            dropped,
+            `dropped call cannot own the admitted receipt`,
+          ).not.toBe(admitted)
+          expect(
+            droppedReceipt,
+            `within-window admission rejection`,
+          ).toMatchObject({
+            outcome: `rejected`,
+            error: {
+              name:
+                factory === debounceStrategy
+                  ? `DebounceCallDroppedError`
+                  : `ThrottleCallDroppedError`,
+            },
+          })
+          expect(admittedReceipt.outcome, `admitted receipt retained`).toBe(
+            `pending`,
+          )
+          expect(admitted.state, `admitted successor waits`).toBe(`pending`)
+          expect(
+            [...collection.keys()].sort(),
+            `only skipped optimism removed`,
+          ).toEqual([1, 2])
+          expect(starts, `one persisting transaction`).toEqual([1])
+          releaseFirst!()
+          await vi.advanceTimersByTimeAsync(0)
+          expect(starts, `admitted successor drains`).toEqual([1, 2])
+          expect([firstReceipt.outcome, admittedReceipt.outcome]).toEqual([
+            `fulfilled`,
+            `fulfilled`,
+          ])
+        },
+        async () => {
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(30)
+        },
+      )
+    })
+})
+/**
+ * A manual rollback settles the public receipt before the held mutation
+ * handler has returned. It cannot cancel an already-started backend write.
+ * The one-writing-at-a-time promise therefore waits for the old handler's
+ * actual completion before starting a distinct-key successor. This three-path
+ * grammar covers debounce, throttle, and queue. The model's active-handler
+ * count stays one until the first controlled promise resolves; the driver
+ * observes that count, receipts, and optimism at rollback and handler release.
+ */
+describe(`paced persistence after manual rollback`, () => {
+  for (const [name, createStrategy] of [
+    [
+      `debounce`,
+      () => debounceStrategy({ wait: 10, leading: true, trailing: true }),
+    ],
+    [
+      `throttle`,
+      () => throttleStrategy({ wait: 10, leading: true, trailing: true }),
+    ],
+    [`queue`, () => queueStrategy({ wait: 10 })],
+  ] as const)
+    it(`${name} waits for the rolled-back handler to finish before starting another`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = createStrategy()
+      const firstWrite = createDeferred<void>()
+      const secondWrite = createDeferred<void>()
+      const canceled = new Error(`manual rollback`)
+      const starts: Array<number> = []
+      const active = new Set<number>()
+      const concurrency: Array<number> = []
+      const mutate = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: async ({ transaction }) => {
+          const id = transaction.mutations[0].modified.id
+          starts.push(id)
+          active.add(id)
+          concurrency.push(active.size)
+          await (id === 1 ? firstWrite.promise : secondWrite.promise)
+          active.delete(id)
+        },
+      })
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const first = mutate(1)
+          const firstReceipt = observeReceipt(first)
+          await vi.advanceTimersByTimeAsync(1)
+          const second = mutate(2)
+          const secondReceipt = observeReceipt(second)
+          await vi.advanceTimersByTimeAsync(20)
+          expect(starts).toEqual([1])
+          first.rollback({ error: canceled, isSecondaryRollback: true })
+          await vi.advanceTimersByTimeAsync(0)
+          expect(firstReceipt).toMatchObject({
+            outcome: `rejected`,
+            error: canceled,
+          })
+          expect(
+            secondReceipt.outcome,
+            `successor waits for handler completion`,
+          ).toBe(`pending`)
+          expect(starts, `no overlapping backend handler`).toEqual([1])
+          expect([...collection.keys()]).toEqual([2])
+          firstWrite.resolve()
+          await vi.advanceTimersByTimeAsync(0)
+          expect(starts, `successor begins after handler return`).toEqual([
+            1, 2,
+          ])
+          expect(concurrency, `one active backend handler`).toEqual([1, 1])
+          secondWrite.resolve()
+          await vi.advanceTimersByTimeAsync(0)
+          expect(secondReceipt).toMatchObject({
+            outcome: `fulfilled`,
+            returnedSame: true,
+          })
+        },
+        async () => {
+          firstWrite.resolve()
+          secondWrite.resolve()
+          await vi.advanceTimersByTimeAsync(30)
+        },
+      )
+    })
+})
+/**
+ * A synchronous onMutate may call its own paced mutation function. The outer
+ * call already owns the leading edge, so the nested call joins its pending
+ * transaction. Both optimistic rows must be applied before the one handler
+ * starts. A later timer must not invoke that completed transaction twice.
+ */
+describe(`paced admission reentry`, () => {
+  for (const factory of [debounceStrategy, throttleStrategy])
+    it(`${factory.name} admits a nested mutation without a second leading write`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = factory({ wait: 10, leading: true, trailing: true })
+      const starts: Array<Array<number>> = []
+      let nested: Transaction<{ id: number }> | undefined
+      const mutate = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => {
+          collection.insert({ id })
+          if (id === 1) nested = mutate(2)
+        },
+        mutationFn: ({ transaction }) => {
+          starts.push(
+            transaction.mutations.map((mutation) => mutation.modified.id),
+          )
+          return Promise.resolve()
+        },
+      })
+      await withCleanup(strategy, collection, async () => {
+        const outer = mutate(1)
+        const outerReceipt = observeReceipt(outer)
+        expect(nested, `nested admission reached`).toBe(outer)
+        expect([...collection.keys()].sort()).toEqual([1, 2])
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts, `one merged leading write`).toEqual([[1, 2]])
+        expect(outerReceipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+        await vi.advanceTimersByTimeAsync(20)
+        expect(starts, `no stale trailing callback`).toEqual([[1, 2]])
+        const next = mutate(3)
+        const nextReceipt = observeReceipt(next)
+        await vi.advanceTimersByTimeAsync(20)
+        expect(starts, `later admission still works`).toEqual([[1, 2], [3]])
+        expect(nextReceipt).toMatchObject({
+          outcome: `fulfilled`,
+          returnedSame: true,
+        })
+      })
+    })
+})
+/**
+ * One strategy object supplies one timing boundary to two managers. Their
+ * transactions cannot merge, so a shared tick must retain both callbacks.
+ * Reentry is the shortest history that exposes a leading call replacing a
+ * second manager's trailing callback before either receipt settles.
+ */
+describe(`shared strategy timing across managers`, () => {
+  it(`one queue strategy serializes separate managers without merging receipts`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = queueStrategy({ wait: 10 })
+    const starts: Array<number> = []
+    let releaseFirst: (() => void) | undefined
+    const manager = (hold: boolean) =>
+      createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          starts.push(transaction.mutations[0].modified.id)
+          return hold
+            ? new Promise<void>((resolve) => {
+                releaseFirst = resolve
+              })
+            : Promise.resolve()
+        },
+      })
+    const mutateFirst = manager(true)
+    const mutateSecond = manager(false)
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutateFirst(1)
+        const second = mutateSecond(2)
+        const receipts = [observeReceipt(first), observeReceipt(second)]
+        expect(second, `separate manager transactions`).not.toBe(first)
+        await vi.advanceTimersByTimeAsync(11)
+        expect(starts, `queue waits for the held handler`).toEqual([1])
+        releaseFirst!()
+        await vi.advanceTimersByTimeAsync(20)
+        expect(starts, `both managers drain in queue order`).toEqual([1, 2])
+        expect(receipts.map((receipt) => receipt.outcome)).toEqual([
+          `fulfilled`,
+          `fulfilled`,
+        ])
+      },
+      async () => {
+        releaseFirst?.()
+        await vi.advanceTimersByTimeAsync(30)
+      },
+    )
+  })
+
+  for (const factory of [debounceStrategy, throttleStrategy])
+    it(`${factory.name} persists both managers after a reentrant shared tick`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = factory({ wait: 10, leading: true, trailing: true })
+      const starts: Array<number> = []
+      let second: Transaction<{ id: number }> | undefined
+      const mutateSecond = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          starts.push(transaction.mutations[0].modified.id)
+          return Promise.resolve()
+        },
+      })
+      const mutateFirst = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => {
+          collection.insert({ id })
+          second = mutateSecond(2)
+        },
+        mutationFn: ({ transaction }) => {
+          starts.push(transaction.mutations[0].modified.id)
+          return Promise.resolve()
+        },
+      })
+      await withCleanup(strategy, collection, async () => {
+        const first = mutateFirst(1)
+        const firstReceipt = observeReceipt(first)
+        expect(second, `reentrant manager admitted`).toBeDefined()
+        const secondReceipt = observeReceipt(second!)
+        expect(second, `manager transactions remain separate`).not.toBe(first)
+        expect([...collection.keys()].sort(), `both optimistic rows`).toEqual([
+          1, 2,
+        ])
+        expect(starts, `leading write starts once`).toEqual([1])
+        await vi.advanceTimersByTimeAsync(9)
+        expect(starts, `trailing write waits for shared edge`).toEqual([1])
+        await vi.advanceTimersByTimeAsync(1)
+        expect(starts, `both admitted writes start`).toEqual([1, 2])
+        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+          `fulfilled`,
+          `fulfilled`,
+        ])
+        await vi.advanceTimersByTimeAsync(20)
+        expect(starts, `no stale callback`).toEqual([1, 2])
+      })
+    })
+
+  for (const kind of [`debounce`, `throttle`] as const)
+    it(`${kind} retains separate manager writes at one shared trailing edge`, async () => {
+      const collection = await createReadyCollection()
+      const strategy =
+        kind === `debounce`
+          ? debounceStrategy({ wait: 10, leading: false, trailing: true })
+          : throttleStrategy({ wait: 10, leading: false, trailing: true })
+      const starts: Array<Start> = []
+      const manager = () =>
+        createPacedMutations<number, { id: number }>({
+          strategy,
+          onMutate: (id) => collection.insert({ id }),
+          mutationFn: ({ transaction }) => {
+            starts.push({
+              at: Date.now() - origin,
+              ids: transaction.mutations.map(
+                (mutation) => mutation.modified.id,
+              ),
+            })
+            return Promise.resolve()
+          },
+        })
+      const mutateFirst = manager()
+      const mutateSecond = manager()
+      await withCleanup(strategy, collection, async () => {
+        const first = mutateFirst(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(1)
+        const second = mutateSecond(2)
+        const secondReceipt = observeReceipt(second)
+        expect(second, `separate manager receipts`).not.toBe(first)
+        await vi.advanceTimersByTimeAsync(8)
+        expect(starts, `before shared edge`).toEqual([])
+        await vi.advanceTimersByTimeAsync(12)
+        expect(starts, `both writes keep their timing`).toEqual(
+          kind === `debounce`
+            ? [
+                { at: 11, ids: [1] },
+                { at: 11, ids: [2] },
+              ]
+            : [
+                { at: 10, ids: [1] },
+                { at: 20, ids: [2] },
+              ],
+        )
+        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+          `fulfilled`,
+          `fulfilled`,
+        ])
+      })
+    })
+
+  for (const factory of [debounceStrategy, throttleStrategy])
+    it(`${factory.name} waits for a shared manager's rolled-back handler before starting another`, async () => {
+      const collection = await createReadyCollection()
+      const strategy = factory({ wait: 10, leading: true, trailing: true })
+      const starts: Array<number> = []
+      let releaseFirst: (() => void) | undefined
+      const mutateFirst = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          starts.push(transaction.mutations[0].modified.id)
+          return new Promise<void>((resolve) => {
+            releaseFirst = resolve
+          })
+        },
+      })
+      const mutateSecond = createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          starts.push(transaction.mutations[0].modified.id)
+          return Promise.resolve()
+        },
+      })
+      await withCleanup(
+        strategy,
+        collection,
+        async () => {
+          const first = mutateFirst(1)
+          const firstReceipt = observeReceipt(first)
+          const second = mutateSecond(2)
+          const secondReceipt = observeReceipt(second)
+          first.rollback({ isSecondaryRollback: true })
+          await vi.advanceTimersByTimeAsync(11)
+          expect(starts, `timer cannot bypass held handler`).toEqual([1])
+          expect(secondReceipt.outcome, `other manager still admitted`).toBe(
+            `pending`,
+          )
+          releaseFirst!()
+          await vi.advanceTimersByTimeAsync(0)
+          expect(starts, `second manager starts after handler release`).toEqual(
+            [1, 2],
+          )
+          expect(firstReceipt.outcome).toBe(`rejected`)
+          expect(secondReceipt.outcome).toBe(`fulfilled`)
+        },
+        async () => {
+          releaseFirst?.()
+          await vi.advanceTimersByTimeAsync(30)
+        },
+      )
+    })
+
+  it(`shared debounce renews the quiet edge for another manager's eligible write`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = debounceStrategy({
+      wait: 10,
+      leading: false,
+      trailing: true,
+    })
+    const starts: Array<Start> = []
+    let releaseFirst: (() => void) | undefined
+    const manager = () =>
+      createPacedMutations<number, { id: number }>({
+        strategy,
+        onMutate: (id) => collection.insert({ id }),
+        mutationFn: ({ transaction }) => {
+          const ids = transaction.mutations.map(
+            (mutation) => mutation.modified.id,
+          )
+          starts.push({ at: Date.now() - origin, ids })
+          return ids[0] === 1
+            ? new Promise<void>((resolve) => {
+                releaseFirst = resolve
+              })
+            : Promise.resolve()
+        },
+      })
+    const mutateFirst = manager()
+    const mutateSecond = manager()
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutateFirst(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(11)
+        const second = mutateSecond(2)
+        const secondReceipt = observeReceipt(second)
+        await vi.advanceTimersByTimeAsync(11)
+        expect(starts, `second edge waits behind first handler`).toEqual([
+          { at: 10, ids: [1] },
+        ])
+        const third = mutateFirst(3)
+        const thirdReceipt = observeReceipt(third)
+        await vi.advanceTimersByTimeAsync(2)
+        releaseFirst!()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts, `new call renews shared quiet edge`).toEqual([
+          { at: 10, ids: [1] },
+        ])
+        await vi.advanceTimersByTimeAsync(8)
+        expect(starts, `both managers start after renewed edge`).toEqual([
+          { at: 10, ids: [1] },
+          { at: 32, ids: [2] },
+          { at: 32, ids: [3] },
+        ])
+        expect(
+          [firstReceipt, secondReceipt, thirdReceipt].map(
+            (receipt) => receipt.outcome,
+          ),
+        ).toEqual([`fulfilled`, `fulfilled`, `fulfilled`])
+      },
+      async () => {
+        releaseFirst?.()
+        await vi.advanceTimersByTimeAsync(30)
+      },
+    )
+  })
+})
+/**
+ * A failed onMutate that changed no row admits no work and consumes no leading
+ * edge. This two-action model starts the next valid call at the same clock
+ * instant. The production driver catches the user's original error, then
+ * observes the next receipt and handler start before any timer can expire.
+ */
+describe(`paced admission after an optimistic callback throws`, () => {
+  for (const kind of [`debounce`, `throttle`] as const)
+    for (const trailing of [false, true])
+      it(`${kind} trailing ${trailing} leaves its leading edge available after a failed call`, async () => {
+        const collection = await createReadyCollection()
+        const strategy =
+          kind === `debounce`
+            ? debounceStrategy({ wait: 10, leading: true, trailing })
+            : throttleStrategy({ wait: 10, leading: true, trailing })
+        const failure = new Error(`optimistic callback failed`)
+        const starts: Array<number> = []
+        const mutate = createPacedMutations<number, { id: number }>({
+          strategy,
+          onMutate: (id) => {
+            if (id === 1) throw failure
+            collection.insert({ id })
+          },
+          mutationFn: ({ transaction }) => {
+            starts.push(transaction.mutations[0].modified.id)
+            return Promise.resolve()
+          },
+        })
+        await withCleanup(strategy, collection, async () => {
+          expect(() => mutate(1)).toThrow(failure)
+          const next = mutate(2)
+          const receipt = observeReceipt(next)
+          await vi.advanceTimersByTimeAsync(0)
+          expect(starts, `failed call did not consume leading edge`).toEqual([
+            2,
+          ])
+          expect(receipt).toMatchObject({
+            outcome: `fulfilled`,
+            returnedSame: true,
+          })
+        })
+      })
+})
+/**
+ * A failed onMutate can change a row before it throws. The reference retains
+ * only successful calls. At the throw cut, the failed row is absent and the
+ * earlier admitted transaction is still pending. After its timer and any held
+ * handler complete, the backend sees only that earlier call. This checks the
+ * transaction rollback rule through both paced admission paths.
+ */
+for (const kind of [`debounce`, `throttle`] as const)
+  it(`${kind} keeps an earlier admitted call when a joined callback changes a row then throws`, async () => {
+    const collection = await createReadyCollection()
+    const strategy =
+      kind === `debounce`
+        ? debounceStrategy({ wait: 10, leading: false, trailing: true })
+        : throttleStrategy({ wait: 10, leading: true, trailing: true })
+    const firstWrite = createDeferred<void>()
+    const starts: Array<Array<number>> = []
+    const failure = new Error(`optimistic callback failed`)
+    const mutate = createPacedMutations<number, { id: number }>({
+      strategy,
+      onMutate: (id) => {
+        collection.insert({ id })
+        if (id === 3) throw failure
+      },
+      mutationFn: ({ transaction }) => {
+        const ids = transaction.mutations.map(
+          (mutation) => mutation.modified.id,
+        )
+        starts.push(ids)
+        return ids.includes(1) ? firstWrite.promise : Promise.resolve()
+      },
+    })
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutate(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(1)
+        const second = mutate(2)
+        const secondReceipt = observeReceipt(second)
+        expect(() => mutate(3)).toThrow(failure)
+        expect(
+          collection.get(3),
+          `failed row is absent at throw cut`,
+        ).toBeUndefined()
+        expect(collection.get(2)?.id).toBe(2)
+        expect(second.state).toBe(`pending`)
+        await vi.advanceTimersByTimeAsync(10)
+        firstWrite.resolve()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts, `only successful calls reach handlers`).toEqual(
+          kind === `debounce` ? [[1, 2]] : [[1], [2]],
+        )
+        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+          `fulfilled`,
+          `fulfilled`,
+        ])
+      },
+      async () => {
+        firstWrite.resolve()
+        await vi.advanceTimersByTimeAsync(30)
+      },
+    )
+  })
+/**
+ * An admitted leading call is eligible before a later call renews debounce's
+ * quiet period. While an older handler runs, the later call can merge into the
+ * pending transaction, but cannot revoke its eligible start. The model starts
+ * the merged successor when the held handler returns, before the quiet timer.
+ */
+for (const releaseAt of [12, 24])
+  it(`debounce keeps an eligible leading write when the held handler releases at ${releaseAt}`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = debounceStrategy({
+      wait: 10,
+      leading: true,
+      trailing: true,
+    })
+    const firstWrite = createDeferred<void>()
+    const starts: Array<Array<number>> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      strategy,
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        const ids = transaction.mutations.map(
+          (mutation) => mutation.modified.id,
+        )
+        starts.push(ids)
+        return ids.includes(1) ? firstWrite.promise : Promise.resolve()
+      },
+    })
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutate(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(11)
+        const second = mutate(2)
+        const secondReceipt = observeReceipt(second)
+        await vi.advanceTimersByTimeAsync(1)
+        const third = mutate(3)
+        expect(third).toBe(second)
+        expect(starts).toEqual([[1]])
+        await vi.advanceTimersByTimeAsync(releaseAt - 12)
+        firstWrite.resolve()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts, `leading eligibility survives later call`).toEqual([
+          [1],
+          [2, 3],
+        ])
+        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+          `fulfilled`,
+          `fulfilled`,
+        ])
+        await vi.advanceTimersByTimeAsync(20)
+        expect(starts, `renewed quiet timer cannot repeat the write`).toEqual([
+          [1],
+          [2, 3],
+        ])
+      },
+      async () => {
+        firstWrite.resolve()
+        await vi.advanceTimersByTimeAsync(30)
+      },
+    )
+  })
+/**
+ * A paced manager owns the commit edge. A caller's manual commit attempt on
+ * its pending receipt must throw before any backend handler starts or state
+ * changes. The scheduled callback still runs once its timer edge and the held
+ * predecessor's release both occur. This two-write grammar crosses all three
+ * serial strategies and checks starts, state, and receipts at each cut.
+ */
+for (const kind of [`debounce`, `throttle`, `queue`] as const)
+  it(`${kind} rejects manual commit without bypassing paced persistence`, async () => {
+    const collection = await createReadyCollection()
+    const strategy =
+      kind === `debounce`
+        ? debounceStrategy({ wait: 10, leading: true, trailing: true })
+        : kind === `throttle`
+          ? throttleStrategy({ wait: 10, leading: true, trailing: true })
+          : queueStrategy({ wait: 0 })
+    const firstWrite = createDeferred<void>()
+    const starts: Array<number> = []
+    const mutate = createPacedMutations<number, { id: number }>({
+      strategy,
+      onMutate: (id) => collection.insert({ id }),
+      mutationFn: ({ transaction }) => {
+        const id = transaction.mutations[0].modified.id
+        starts.push(id)
+        return id === 1 ? firstWrite.promise : Promise.resolve()
+      },
+    })
+    let second: Transaction<{ id: number }> | undefined
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutate(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts).toEqual([1])
+        second = mutate(2)
+        const secondReceipt = observeReceipt(second)
+        expect(second.state).toBe(`pending`)
+        expect(() => second!.commit()).toThrow(
+          `Paced mutations are committed by their strategy`,
+        )
+        expect(second.state, `manual attempt cannot start persistence`).toBe(
+          `pending`,
+        )
+        expect(starts).toEqual([1])
+        await vi.advanceTimersByTimeAsync(10)
+        expect(starts, `the held handler still owns the flight`).toEqual([1])
+        firstWrite.resolve()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(starts, `the scheduled write starts after release`).toEqual([
+          1, 2,
+        ])
+        expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+          `fulfilled`,
+          `fulfilled`,
+        ])
+      },
+      async () => {
+        firstWrite.resolve()
+        if (second?.state === `pending`)
+          second.rollback({ isSecondaryRollback: true })
+        await vi.advanceTimersByTimeAsync(20)
+      },
+    )
+  })
+/**
+ * An admitted call after a pending transaction rolls back owns a new
+ * persistence obligation. The canceled leading callback may still occupy the
+ * serial slot, but it cannot consume the later call's quiet edge. This legal
+ * history holds the first handler, cancels its pending successor directly or
+ * by same-key cascade, admits a new transaction, then crosses the quiet and
+ * handler-release cuts. The independent expectation is backend starts 1 and 3:
+ * the first already started, the canceled second never starts, and the third
+ * retains its own persistence obligation.
+ */
+for (const cancellation of [`direct`, `same-key cascade`] as const)
+  it(`debounce persists a new call after ${cancellation} cancels its pending leading predecessor`, async () => {
+    const collection = await createReadyCollection<{
+      id: number
+      value: number
+    }>([{ id: 1, value: 0 }])
+    const strategy = debounceStrategy({
+      wait: 10,
+      leading: true,
+      trailing: true,
+    })
+    const firstWrite = createDeferred<void>()
+    const starts: Array<number> = []
+    const canceled = new Error(`pending leading canceled`)
+    const mutate = createPacedMutations<number, { id: number; value: number }>({
+      strategy,
+      onMutate: (value) =>
+        collection.update(1, (draft) => {
+          draft.value = value
+        }),
+      mutationFn: ({ transaction }) => {
+        const value = transaction.mutations[0].modified.value
+        starts.push(value)
+        return value === 1 ? firstWrite.promise : Promise.resolve()
+      },
+    })
+    let third: Transaction<{ id: number; value: number }> | undefined
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        const first = mutate(1)
+        const firstReceipt = observeReceipt(first)
+        await vi.advanceTimersByTimeAsync(11)
+        const second = mutate(2)
+        const secondReceipt = observeReceipt(second)
+        if (cancellation === `direct`)
+          second.rollback({ error: canceled, isSecondaryRollback: true })
+        else first.rollback({ error: canceled })
+        await vi.advanceTimersByTimeAsync(0)
+        expect(secondReceipt.outcome, `pending successor was canceled`).toBe(
+          `rejected`,
+        )
+        third = mutate(3)
+        const thirdReceipt = observeReceipt(third)
+        expect(third, `a canceled predecessor cannot own later work`).not.toBe(
+          second,
+        )
+        expect(collection.get(1)?.value, `new optimism is retained`).toBe(3)
+        await vi.advanceTimersByTimeAsync(10)
+        expect(starts, `the first handler still holds persistence`).toEqual([1])
+        firstWrite.resolve()
+        await vi.advanceTimersByTimeAsync(0)
+        expect(
+          starts,
+          `new transaction starts after both prerequisites`,
+        ).toEqual([1, 3])
+        expect([
+          firstReceipt.outcome,
+          secondReceipt.outcome,
+          thirdReceipt.outcome,
+        ]).toEqual([
+          cancellation === `direct` ? `fulfilled` : `rejected`,
+          `rejected`,
+          `fulfilled`,
+        ])
+      },
+      async () => {
+        firstWrite.resolve()
+        if (third?.state === `pending`)
+          third.rollback({ isSecondaryRollback: true })
+        await vi.advanceTimersByTimeAsync(30)
+      },
+    )
+  })
+/**
+ * A callback that throws before admission returns has no caller-visible
+ * transaction receipt. Its newly created empty transaction must leave the
+ * scope rather than remain pending forever. The resource witness inspects the
+ * owning scope after the throw for both admitted and dropped calls; the public
+ * Collection state alone cannot reveal this retained empty object.
+ */
+for (const admission of [`admitted`, `dropped`, `queued`] as const)
+  it(`releases a newly created ${admission} transaction after onMutate throws`, () => {
+    const create = vi.spyOn(TransactionScope.prototype, `createTransaction`)
+    const failure = new Error(`optimistic callback failed`)
+    const strategy =
+      admission === `queued`
+        ? queueStrategy({ wait: 0 })
+        : debounceStrategy({
+            wait: 10,
+            leading: false,
+            trailing: admission === `admitted`,
+          })
+    const mutate = createPacedMutations<number, { id: number }>({
+      strategy,
+      onMutate: () => {
+        throw failure
+      },
+      mutationFn: () => Promise.resolve(),
+    })
+    try {
+      expect(() => mutate(1)).toThrow(failure)
+      const scope = create.mock.instances.at(-1) as unknown as TransactionScope
+      const transaction = create.mock.results.at(-1)?.value as Transaction<{
+        id: number
+      }>
+      const retained = (
+        scope as unknown as { transactions: Array<Transaction<{ id: number }>> }
+      ).transactions
+      expect(transaction.state, `failed callback owns no pending work`).toBe(
+        `failed`,
+      )
+      expect(retained, `the scope releases failed admission`).not.toContain(
+        transaction,
+      )
+    } finally {
+      const transaction = create.mock.results.at(-1)?.value as
+        Transaction<{ id: number }> | undefined
+      if (transaction?.state === `pending`) {
+        void transaction.isPersisted.promise.catch(() => {})
+        transaction.rollback({ isSecondaryRollback: true })
+      }
+      create.mockRestore()
+      strategy.cleanup()
+    }
+  })
+/**
+ * Calls merged into one pending paced transaction settle together. When an
+ * outer onMutate throws after admitting a nested call, the failed group has no
+ * backend attempt and every receipt in that group rejects with the callback
+ * error. A later independent call must still persist. The driver observes the
+ * rollback immediately, then checks backend starts and receipts after the
+ * scheduled edge. This group-failure rule is a product decision for paced
+ * reentry; ordinary manual mutate callbacks retain earlier successful calls.
+ */
+for (const factory of [debounceStrategy, throttleStrategy])
+  it(`${factory.name} does not fulfill erased nested intent after an outer callback throws`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = factory({ wait: 10, leading: true, trailing: true })
+    const starts: Array<Array<number>> = []
+    const failure = new Error(`outer callback failed`)
+    let nested: Transaction<{ id: number }> | undefined
+    const mutate = createPacedMutations<number, { id: number }>({
+      strategy,
+      onMutate: (id) => {
+        collection.insert({ id })
+        if (id === 1) {
+          nested = mutate(2)
+          throw failure
+        }
+      },
+      mutationFn: ({ transaction }) => {
+        starts.push(
+          transaction.mutations.map((mutation) => mutation.modified.id),
+        )
+        return Promise.resolve()
+      },
+    })
+    await withCleanup(
+      strategy,
+      collection,
+      async () => {
+        expect(() => mutate(1)).toThrow(failure)
+        expect(nested, `nested admission returned a receipt`).toBeDefined()
+        const receipt = observeReceipt(nested!)
+        expect(nested!.state, `the merged group rolls back`).toBe(`failed`)
+        expect(
+          [...collection.keys()],
+          `the failed group has no visible row`,
+        ).toEqual([])
+        const later = mutate(3)
+        const laterReceipt = observeReceipt(later)
+        await vi.advanceTimersByTimeAsync(11)
+        expect(
+          starts,
+          `only the later independent call reaches the backend`,
+        ).toEqual([[3]])
+        expect(receipt).toMatchObject({ outcome: `rejected`, error: failure })
+        expect(laterReceipt.outcome).toBe(`fulfilled`)
+      },
+      async () => {
+        if (nested?.state === `pending`)
+          nested.rollback({ isSecondaryRollback: true })
+        await vi.advanceTimersByTimeAsync(20)
+      },
+    )
+  })
+/**
+ * An earlier call in the same pending transaction shares the failure. The
+ * group has one optimistic lifetime and one backend attempt, so rejecting only
+ * the nested call would leave an earlier receipt claiming a partial group.
+ * The model rejects both receipts at the throw cut, and a later transaction
+ * proves that the strategy did not retain a stale callback.
+ */
+for (const factory of [debounceStrategy, throttleStrategy])
+  it(`${factory.name} does not fulfill erased nested intent in an existing pending transaction`, async () => {
+    const collection = await createReadyCollection()
+    const strategy = factory({ wait: 10, leading: false, trailing: true })
+    const starts: Array<Array<number>> = []
+    const failure = new Error(`outer callback failed`)
+    let nested: Transaction<{ id: number }> | undefined
+    const mutate = createPacedMutations<number, { id: number }>({
+      strategy,
+      onMutate: (id) => {
+        collection.insert({ id })
+        if (id === 1) {
+          nested = mutate(2)
+          throw failure
+        }
+      },
+      mutationFn: ({ transaction }) => {
+        starts.push(
+          transaction.mutations.map((mutation) => mutation.modified.id),
+        )
+        return Promise.resolve()
+      },
+    })
+    await withCleanup(strategy, collection, async () => {
+      const prior = mutate(0)
+      const priorReceipt = observeReceipt(prior)
+      expect(() => mutate(1)).toThrow(failure)
+      expect(nested, `nested admission returned a receipt`).toBeDefined()
+      const nestedReceipt = observeReceipt(nested!)
+      expect(prior.state, `the merged group rolls back`).toBe(`failed`)
+      expect(
+        [...collection.keys()],
+        `the failed group has no visible row`,
+      ).toEqual([])
+      const later = mutate(3)
+      const laterReceipt = observeReceipt(later)
+      await vi.advanceTimersByTimeAsync(11)
+      expect(starts, `only the later transaction persists`).toEqual([[3]])
+      expect(priorReceipt).toMatchObject({
+        outcome: `rejected`,
+        error: failure,
+      })
+      expect(nestedReceipt).toMatchObject({
+        outcome: `rejected`,
+        error: failure,
+      })
+      expect(laterReceipt.outcome).toBe(`fulfilled`)
+    })
+  })
+/**
+ * A throttle timer transfers one eligible transaction to serial persistence.
+ * A later call while that transaction waits for a held handler joins it. The
+ * model has one pending transaction and no timer after the transfer. At the
+ * release cut, the handler receives both rows once; no later timer repeats it.
+ */
+it(`throttle merges a pending serial write without a stale trailing timer`, async () => {
+  const collection = await createReadyCollection()
+  const strategy = throttleStrategy({ wait: 10, leading: true, trailing: true })
+  const firstWrite = createDeferred<void>()
+  const starts: Array<Array<number>> = []
+  const mutate = createPacedMutations<number, { id: number }>({
+    strategy,
+    onMutate: (id) => collection.insert({ id }),
+    mutationFn: ({ transaction }) => {
+      const ids = transaction.mutations.map((mutation) => mutation.modified.id)
+      starts.push(ids)
+      return ids.includes(1) ? firstWrite.promise : Promise.resolve()
+    },
+  })
+  await withCleanup(
+    strategy,
+    collection,
+    async () => {
+      const first = mutate(1)
+      const firstReceipt = observeReceipt(first)
+      await vi.advanceTimersByTimeAsync(1)
+      const second = mutate(2)
+      const secondReceipt = observeReceipt(second)
+      await vi.advanceTimersByTimeAsync(10)
+      const third = mutate(3)
+      expect(third).toBe(second)
+      expect(second.state).toBe(`pending`)
+      expect([...collection.keys()].sort()).toEqual([1, 2, 3])
+      firstWrite.resolve()
+      await vi.advanceTimersByTimeAsync(0)
+      expect(starts, `release starts the one pending transaction`).toEqual([
+        [1],
+        [2, 3],
+      ])
+      expect([firstReceipt.outcome, secondReceipt.outcome]).toEqual([
+        `fulfilled`,
+        `fulfilled`,
+      ])
+      await vi.advanceTimersByTimeAsync(30)
+      expect(starts, `no stale timer repeats the transaction`).toEqual([
+        [1],
+        [2, 3],
+      ])
+    },
+    async () => {
+      firstWrite.resolve()
+      await vi.advanceTimersByTimeAsync(30)
+    },
+  )
+})
diff --git a/packages/db/tests/paced-mutations-support.ts b/packages/db/tests/paced-mutations-support.ts
new file mode 100644
index 0000000000..1339320a90
--- /dev/null
+++ b/packages/db/tests/paced-mutations-support.ts
@@ -0,0 +1,97 @@
+/**
+ * Helpers shared by the paced-mutation oracle and its ordinary scenario tests:
+ * a ready collection, cleanup that keeps the first failure, and a receipt
+ * observer. The law lives in paced-mutations-oracle.test.ts.
+ */
+
+import { createCollection } from '../src/collection'
+import { mockSyncCollectionOptionsNoInitialState } from './utils'
+import type { Strategy } from '../src/strategies/types'
+import type { Transaction } from '../src/transactions'
+
+export type Start = { at: number; ids: Array<number> }
+
+export const origin = 1_000_000
+
+export async function createReadyCollection<
+  T extends { id: number } = { id: number },
+>(initial: Array<T> = []) {
+  const collection = createCollection(
+    mockSyncCollectionOptionsNoInitialState<T>({
+      id: `paced-oracle`,
+      getKey: (item) => item.id,
+    }),
+  )
+  const preload = collection.preload()
+  collection.utils.begin()
+  for (const row of initial)
+    collection.utils.write({ type: `insert`, value: row })
+  collection.utils.commit()
+  collection.utils.markReady()
+  await preload
+  return collection
+}
+
+// Keep the violated law as the primary cause if cleanup also fails. Release
+// every resource even when an earlier cleanup step throws.
+export async function withCleanup<T>(
+  strategy: Strategy,
+  collection: { cleanup: () => Promise<void> },
+  run: () => Promise<T>,
+  release?: () => Promise<void>,
+): Promise<T> {
+  const outcome = await Promise.resolve()
+    .then(run)
+    .then(
+      (value) => ({ ok: true, value }) as const,
+      (error: unknown) => ({ ok: false, error }) as const,
+    )
+  const cleanupErrors: Array<unknown> = []
+  try {
+    await release?.()
+  } catch (error) {
+    cleanupErrors.push(error)
+  }
+  try {
+    strategy.cleanup()
+  } catch (error) {
+    cleanupErrors.push(error)
+  }
+  try {
+    await collection.cleanup()
+  } catch (error) {
+    cleanupErrors.push(error)
+  }
+
+  if (!outcome.ok) {
+    if (cleanupErrors.length > 0) {
+      throw new AggregateError(cleanupErrors, `Oracle cleanup also failed`, {
+        cause: outcome.error,
+      })
+    }
+    throw outcome.error
+  }
+  if (cleanupErrors.length > 0) {
+    throw new AggregateError(cleanupErrors, `Oracle cleanup failed`)
+  }
+  return outcome.value
+}
+
+export function observeReceipt<T extends object>(transaction: Transaction<T>) {
+  const receipt: {
+    outcome: `pending` | `fulfilled` | `rejected`
+    returnedSame?: boolean
+    error?: unknown
+  } = { outcome: `pending` }
+  void transaction.isPersisted.promise.then(
+    (resolved) => {
+      receipt.outcome = `fulfilled`
+      receipt.returnedSame = resolved === transaction
+    },
+    (error: unknown) => {
+      receipt.outcome = `rejected`
+      receipt.error = error
+    },
+  )
+  return receipt
+}
diff --git a/packages/db/tests/production-error-messages-fixture.ts b/packages/db/tests/production-error-messages-fixture.ts
new file mode 100644
index 0000000000..6bb512431f
--- /dev/null
+++ b/packages/db/tests/production-error-messages-fixture.ts
@@ -0,0 +1,7 @@
+import * as Errors from '../src/index'
+
+// The error classes the package exports, shared by the production-message oracle and its ordinary coverage test.
+export const exportedErrorClasses = Object.entries(Errors).filter(
+  ([, value]) =>
+    typeof value === `function` && value.prototype instanceof Error,
+)
diff --git a/packages/db/tests/production-error-messages-oracle.test.ts b/packages/db/tests/production-error-messages-oracle.test.ts
index 803ff7a17b..03424c1a4e 100644
--- a/packages/db/tests/production-error-messages-oracle.test.ts
+++ b/packages/db/tests/production-error-messages-oracle.test.ts
@@ -66,7 +66,9 @@ import { fileURLToPath } from 'node:url'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import * as Errors from '../src/index'
 import { codedWarning } from '../src/error-message'
+import { declareOracle } from './oracle-declaration.js'
 import { errorSampleArguments } from './error-sample-arguments'
+import { exportedErrorClasses } from './production-error-messages-fixture'
 import { findErrorSites } from './error-sites-oracle'
 
 const testsDirectory = dirname(fileURLToPath(import.meta.url))
@@ -131,11 +133,6 @@ const hostileInputs: Array<unknown> = [
   [undefined],
 ]
 
-const exportedErrorClasses = Object.entries(Errors).filter(
-  ([, value]) =>
-    typeof value === `function` && value.prototype instanceof Error,
-)
-
 function construct(name: string, args: Array<unknown>, mode: string): Error {
   vi.stubEnv(`NODE_ENV`, mode)
   try {
@@ -169,112 +166,200 @@ function shownInputs(args: Array<unknown>, devMessage: string): Array<string> {
     .map((arg) => JSON.stringify(arg))
 }
 
+// The check: the production outputs match the expected record for this claim.
+function expectEveryClassCoded(): void {
+  const codes: Record<string, number> = JSON.parse(
+    readFileSync(codesPath, `utf8`),
+  )
+  const uncoded = exportedErrorClasses
+    .map(([name]) => name)
+    .filter(
+      (name) =>
+        !(name in codes) &&
+        !callerMessageClasses.has(name) &&
+        !fullMessageClasses.has(name),
+    )
+  expect(uncoded).toEqual([])
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectFullTextInProduction(): void {
+  for (const name of fullMessageClasses)
+    errorSampleArguments[name]!.forEach((args, index) => {
+      expect(construct(name, args, `production`).message, name).toBe(
+        devMessages[name]![index],
+      )
+    })
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectDevelopmentMessages(): void {
+  for (const [name, argSets] of Object.entries(errorSampleArguments))
+    argSets.forEach((args, index) => {
+      expect(
+        construct(name, args, `development`).message,
+        `${name} sample ${index}`,
+      ).toBe(devMessages[name]![index])
+    })
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectClassShapeInBothModes(): void {
+  for (const [name, argSets] of Object.entries(errorSampleArguments))
+    for (const args of argSets) {
+      const dev = construct(name, args, `development`)
+      const prod = construct(name, args, `production`)
+      expect(shape(prod), name).toEqual(shape(dev))
+      expect(prod, name).toBeInstanceOf(
+        (Errors as unknown as Record<string, ErrorConstructor>)[name]!,
+      )
+    }
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectCodedProductionLines(): void {
+  const codes: Record<string, number> = JSON.parse(
+    readFileSync(codesPath, `utf8`),
+  )
+  const seen = new Map<number, string>()
+  for (const [name, argSets] of Object.entries(errorSampleArguments)) {
+    if (!(name in codes)) continue
+    argSets.forEach((args, index) => {
+      const message = construct(name, args, `production`).message
+      const match = productionLine.exec(message)
+      expect(match, `${name}: ${message}`).not.toBeNull()
+      const code = Number(match![1])
+      expect(Number(match![3]), `${name} anchor`).toBe(code)
+      expect(code, `${name} code`).toBe(codes[name])
+      for (const input of shownInputs(args, devMessages[name]![index]!))
+        expect(match![2] ?? ``, `${name} keeps ${input}`).toContain(input)
+    })
+    const owner = seen.get(codes[name]!)
+    expect(owner, `code ${codes[name]} reused by ${name}`).toBeUndefined()
+    seen.set(codes[name]!, name)
+  }
+  expect(seen.size).toBeGreaterThan(80)
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectHostileInputsCoded(): void {
+  const codes: Record<string, number> = JSON.parse(
+    readFileSync(codesPath, `utf8`),
+  )
+  for (const [name, argSets] of Object.entries(errorSampleArguments)) {
+    if (!(name in codes)) continue
+    for (const args of argSets)
+      args.forEach((_, position) => {
+        for (const hostile of hostileInputs) {
+          const replaced = args.map((arg, index) =>
+            index === position ? hostile : arg,
+          )
+          let message: string
+          try {
+            message = construct(name, replaced, `production`).message
+          } catch (error) {
+            throw new Error(`${name} argument ${position} threw: ${error}`)
+          }
+          const match = productionLine.exec(message)
+          expect(match, `${name}: ${message}`).not.toBeNull()
+          expect(Number(match![1]), name).toBe(codes[name])
+          // A plain object never reaches the line, not even inside an array.
+          expect(message, name).not.toContain(`secret`)
+        }
+      })
+  }
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectUnencodableValuesShown(): void {
+  const codes: Record<string, number> = JSON.parse(
+    readFileSync(codesPath, `utf8`),
+  )
+  for (const [name, argSets] of Object.entries(errorSampleArguments)) {
+    if (!(name in codes)) continue
+    argSets.forEach((args, index) => {
+      args.forEach((arg, position) => {
+        if (typeof arg !== `string` || arg.length < 3) return
+        if (!devMessages[name]![index]!.includes(arg)) return
+        for (const [value, shown] of [
+          [Symbol(`probe`), `"Symbol(probe)"`],
+          [7n, `"7"`],
+          [undefined, `=undefined`],
+          [NaN, `=NaN`],
+          [-Infinity, `=-Infinity`],
+          [[7n, undefined, NaN], `=["7","undefined","NaN"]`],
+        ] as const) {
+          const replaced = args.map((original, at) =>
+            at === position ? value : original,
+          )
+          const message = construct(name, replaced, `production`).message
+          expect(message, `${name} argument ${position}`).toContain(shown)
+        }
+      })
+    })
+  }
+}
+
+// The check: the production outputs match the expected record for this claim.
+function expectCodesDocumented(): void {
+  const codes: Record<string, number> = JSON.parse(
+    readFileSync(codesPath, `utf8`),
+  )
+  const docs = readFileSync(docsPath, `utf8`)
+  for (const [name, code] of Object.entries(codes)) {
+    const heading = new RegExp(`^## Error ${code}\\b.*${name}`, `m`)
+    expect(docs, `${name} (${code})`).toMatch(heading)
+  }
+  const sites: Record<string, { file: string; kind?: string }> = JSON.parse(
+    readFileSync(sitesPath, `utf8`),
+  )
+  for (const [code, { file, kind }] of Object.entries(sites)) {
+    const title = kind === `warning` ? `Warning` : `Error`
+    const anchor = `<a id="${kind ?? `error`}-${code}"></a>`
+    const heading = new RegExp(`^## ${title} ${code}\\b.*${file}`, `m`)
+    expect(docs, `${title} ${code} (${file})`).toMatch(heading)
+    expect(docs, `${title} ${code} anchor`).toContain(anchor)
+  }
+}
+
+declareOracle({
+  check: [
+    expectEveryClassCoded,
+    expectFullTextInProduction,
+    expectDevelopmentMessages,
+    expectClassShapeInBothModes,
+    expectCodedProductionLines,
+    expectHostileInputsCoded,
+    expectUnencodableValuesShown,
+    expectCodesDocumented,
+  ],
+})
+
 describe(`production error messages`, () => {
   afterEach(() => vi.unstubAllEnvs())
 
   it(`codes every exported class except the caller-message bases`, () => {
-    const codes: Record<string, number> = JSON.parse(
-      readFileSync(codesPath, `utf8`),
-    )
-    const uncoded = exportedErrorClasses
-      .map(([name]) => name)
-      .filter(
-        (name) =>
-          !(name in codes) &&
-          !callerMessageClasses.has(name) &&
-          !fullMessageClasses.has(name),
-      )
-    expect(uncoded).toEqual([])
+    expectEveryClassCoded()
   })
 
   it(`keeps the full message in production for full-text classes`, () => {
-    for (const name of fullMessageClasses)
-      errorSampleArguments[name]!.forEach((args, index) => {
-        expect(construct(name, args, `production`).message, name).toBe(
-          devMessages[name]![index],
-        )
-      })
-  })
-
-  it(`has sample inputs for every exported error class`, () => {
-    const missing = exportedErrorClasses
-      .map(([name]) => name)
-      .filter((name) => !(name in errorSampleArguments))
-    expect(missing).toEqual([])
+    expectFullTextInProduction()
   })
 
   it(`keeps every development message unchanged`, () => {
-    for (const [name, argSets] of Object.entries(errorSampleArguments))
-      argSets.forEach((args, index) => {
-        expect(
-          construct(name, args, `development`).message,
-          `${name} sample ${index}`,
-        ).toBe(devMessages[name]![index])
-      })
+    expectDevelopmentMessages()
   })
 
   it(`keeps class, name, instanceof, and fields in both modes`, () => {
-    for (const [name, argSets] of Object.entries(errorSampleArguments))
-      for (const args of argSets) {
-        const dev = construct(name, args, `development`)
-        const prod = construct(name, args, `production`)
-        expect(shape(prod), name).toEqual(shape(dev))
-        expect(prod, name).toBeInstanceOf(
-          (Errors as unknown as Record<string, ErrorConstructor>)[name]!,
-        )
-      }
+    expectClassShapeInBothModes()
   })
 
   it(`writes a coded production line with the shown inputs`, () => {
-    const codes: Record<string, number> = JSON.parse(
-      readFileSync(codesPath, `utf8`),
-    )
-    const seen = new Map<number, string>()
-    for (const [name, argSets] of Object.entries(errorSampleArguments)) {
-      if (!(name in codes)) continue
-      argSets.forEach((args, index) => {
-        const message = construct(name, args, `production`).message
-        const match = productionLine.exec(message)
-        expect(match, `${name}: ${message}`).not.toBeNull()
-        const code = Number(match![1])
-        expect(Number(match![3]), `${name} anchor`).toBe(code)
-        expect(code, `${name} code`).toBe(codes[name])
-        for (const input of shownInputs(args, devMessages[name]![index]!))
-          expect(match![2] ?? ``, `${name} keeps ${input}`).toContain(input)
-      })
-      const owner = seen.get(codes[name]!)
-      expect(owner, `code ${codes[name]} reused by ${name}`).toBeUndefined()
-      seen.set(codes[name]!, name)
-    }
-    expect(seen.size).toBeGreaterThan(80)
+    expectCodedProductionLines()
   })
 
   it(`writes one coded line for hostile inputs`, () => {
-    const codes: Record<string, number> = JSON.parse(
-      readFileSync(codesPath, `utf8`),
-    )
-    for (const [name, argSets] of Object.entries(errorSampleArguments)) {
-      if (!(name in codes)) continue
-      for (const args of argSets)
-        args.forEach((_, position) => {
-          for (const hostile of hostileInputs) {
-            const replaced = args.map((arg, index) =>
-              index === position ? hostile : arg,
-            )
-            let message: string
-            try {
-              message = construct(name, replaced, `production`).message
-            } catch (error) {
-              throw new Error(`${name} argument ${position} threw: ${error}`)
-            }
-            const match = productionLine.exec(message)
-            expect(match, `${name}: ${message}`).not.toBeNull()
-            expect(Number(match![1]), name).toBe(codes[name])
-            // A plain object never reaches the line, not even inside an array.
-            expect(message, name).not.toContain(`secret`)
-          }
-        })
-    }
+    expectHostileInputsCoded()
   })
 
   describe(`error sites`, () => {
@@ -430,52 +515,10 @@ describe(`production error messages`, () => {
   // a symbol or bigint shows as a quoted string, and `undefined`, `NaN`, and
   // the infinities show as themselves rather than as `null` or nothing.
   it(`shows values that JSON cannot encode in a shown position`, () => {
-    const codes: Record<string, number> = JSON.parse(
-      readFileSync(codesPath, `utf8`),
-    )
-    for (const [name, argSets] of Object.entries(errorSampleArguments)) {
-      if (!(name in codes)) continue
-      argSets.forEach((args, index) => {
-        args.forEach((arg, position) => {
-          if (typeof arg !== `string` || arg.length < 3) return
-          if (!devMessages[name]![index]!.includes(arg)) return
-          for (const [value, shown] of [
-            [Symbol(`probe`), `"Symbol(probe)"`],
-            [7n, `"7"`],
-            [undefined, `=undefined`],
-            [NaN, `=NaN`],
-            [-Infinity, `=-Infinity`],
-            [[7n, undefined, NaN], `=["7","undefined","NaN"]`],
-          ] as const) {
-            const replaced = args.map((original, at) =>
-              at === position ? value : original,
-            )
-            const message = construct(name, replaced, `production`).message
-            expect(message, `${name} argument ${position}`).toContain(shown)
-          }
-        })
-      })
-    }
+    expectUnencodableValuesShown()
   })
 
   it(`documents every code with its class`, () => {
-    const codes: Record<string, number> = JSON.parse(
-      readFileSync(codesPath, `utf8`),
-    )
-    const docs = readFileSync(docsPath, `utf8`)
-    for (const [name, code] of Object.entries(codes)) {
-      const heading = new RegExp(`^## Error ${code}\\b.*${name}`, `m`)
-      expect(docs, `${name} (${code})`).toMatch(heading)
-    }
-    const sites: Record<string, { file: string; kind?: string }> = JSON.parse(
-      readFileSync(sitesPath, `utf8`),
-    )
-    for (const [code, { file, kind }] of Object.entries(sites)) {
-      const title = kind === `warning` ? `Warning` : `Error`
-      const anchor = `<a id="${kind ?? `error`}-${code}"></a>`
-      const heading = new RegExp(`^## ${title} ${code}\\b.*${file}`, `m`)
-      expect(docs, `${title} ${code} (${file})`).toMatch(heading)
-      expect(docs, `${title} ${code} anchor`).toContain(anchor)
-    }
+    expectCodesDocumented()
   })
 })
diff --git a/packages/db/tests/production-error-messages.test.ts b/packages/db/tests/production-error-messages.test.ts
new file mode 100644
index 0000000000..3693439939
--- /dev/null
+++ b/packages/db/tests/production-error-messages.test.ts
@@ -0,0 +1,17 @@
+/**
+ * Ordinary coverage pin for production error messages: every exported error
+ * class has sample inputs. The production-message law is owned by
+ * production-error-messages-oracle.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { errorSampleArguments } from './error-sample-arguments'
+import { exportedErrorClasses } from './production-error-messages-fixture'
+
+describe(`production error messages`, () => {
+  it(`has sample inputs for every exported error class`, () => {
+    const missing = exportedErrorClasses
+      .map(([name]) => name)
+      .filter((name) => !(name in errorSampleArguments))
+    expect(missing).toEqual([])
+  })
+})
diff --git a/packages/db/tests/proxy-detachment-contract-oracle.test.ts b/packages/db/tests/proxy-detachment-contract-oracle.test.ts
index 31a5251e50..505bb09b5f 100644
--- a/packages/db/tests/proxy-detachment-contract-oracle.test.ts
+++ b/packages/db/tests/proxy-detachment-contract-oracle.test.ts
@@ -1,12 +1,3 @@
-import { runInNewContext } from 'node:vm'
-import { describe, expect, it, vi } from 'vitest'
-import fc from 'fast-check'
-import { createCollection } from '../src/collection/index.js'
-import { createChangeProxy, withChangeTracking } from '../src/proxy.js'
-import { oracleRuns } from './oracle-config.js'
-import type { StandardSchemaV1 } from '@standard-schema/spec'
-import type { CollectionConfig } from '../src/types.js'
-
 /**
  * # What crosses the draft-to-stored-row boundary by value?
  *
@@ -25,126 +16,26 @@ import type { CollectionConfig } from '../src/types.js'
  * Native Set and Map iteration order is part of the detached snapshot: a
  * reorder with identical members or entries is still a draft change.
  */
-
-class Label {
-  #text: string
-  constructor(text: string) {
-    this.#text = text
-  }
-  read() {
-    return this.#text
-  }
-  rename(text: string) {
-    this.#text = text
-  }
-}
-
-// The handler confirms each update through sync, so the stored row is the
-// update's result once the mutation settles.
-function storedRowOptions<T extends object>(row: T & { id: number }) {
-  let confirm: (rows: Array<T & { id: number }>) => void = () => {}
-  return {
-    getKey: (value) => value.id,
-    startSync: true,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({ type: `insert`, value: row })
-        commit()
-        markReady()
-        confirm = (rows) => {
-          begin()
-          for (const value of rows) write({ type: `update`, value })
-          commit()
-        }
-      },
-    },
-    onUpdate: ({ transaction }) => {
-      confirm(transaction.mutations.map((mutation) => mutation.modified))
-      return Promise.resolve()
-    },
-  } satisfies CollectionConfig<T & { id: number }, number>
-}
-
-function storedRow<T extends object>(row: T & { id: number }) {
-  return createCollection(storedRowOptions(row))
-}
-
-function storedDataRow(
-  row: Record<string, unknown> & { id: number },
-  identitySchema: boolean,
-) {
-  if (!identitySchema) return storedRow(row)
-  const schema: StandardSchemaV1<typeof row, typeof row> = {
-    '~standard': {
-      version: 1,
-      vendor: `identity`,
-      validate: (value) => ({ value: value as typeof row }),
-    },
-  }
-  return createCollection({ ...storedRowOptions(row), schema })
-}
-
-type CycleKind = `Map` | `Set` | `array` | `object`
-type CycleMember = { owner: CycleRow }
-type CycleContainer =
-  | Map<string, CycleMember>
-  | Set<CycleMember>
-  | Array<CycleMember>
-  | { member: CycleMember }
-type CycleRow = { id: number; count: number; link?: CycleContainer }
-
-const cycleKinds: ReadonlyArray<CycleKind> = [`Map`, `Set`, `array`, `object`]
-
-function cycleContainer(kind: CycleKind, owner: CycleRow): CycleContainer {
-  const member = { owner }
-  if (kind === `Map`) return new Map([[`member`, member]])
-  if (kind === `Set`) return new Set([member])
-  if (kind === `array`) return [member]
-  return { member }
-}
-
-function cycleMember(link: CycleContainer | undefined, kind: CycleKind) {
-  if (kind === `Map`) {
-    expect(link).toBeInstanceOf(Map)
-    const map = link as Map<string, CycleMember>
-    expect([...map.keys()]).toEqual([`member`])
-    return map.get(`member`)!
-  }
-  if (kind === `Set`) {
-    expect(link).toBeInstanceOf(Set)
-    const set = link as Set<CycleMember>
-    expect(set.size).toBe(1)
-    return [...set][0]!
-  }
-  if (kind === `array`) {
-    expect(Array.isArray(link)).toBe(true)
-    expect(link).toHaveLength(1)
-    return (link as Array<CycleMember>)[0]!
-  }
-  expect(Object.keys(link!)).toEqual([`member`])
-  return (link as { member: CycleMember }).member
-}
-
-function expectCycleSnapshot(row: CycleRow, kind: CycleKind) {
-  expect(row.id).toBe(1)
-  expect(row.count).toBe(1)
-  const member = cycleMember(row.link, kind)
-  expect(Object.keys(member)).toEqual([`owner`])
-  const owner = member.owner
-  expect(owner.id).toBe(1)
-  expect(owner.count).toBe(1)
-  expect(owner.link).toBe(row.link)
-  expect(cycleMember(owner.link, kind).owner).toBe(owner)
-}
-
-function expectOwnDataProperty(object: object, key: string, value: unknown) {
-  expect(Object.hasOwn(object, key)).toBe(true)
-  expect(Object.getPrototypeOf(object)).toBe(Object.prototype)
-  expect((object as Record<string, unknown>)[key]).toStrictEqual(value)
-}
+import { describe, expect, it, vi } from 'vitest'
+import fc from 'fast-check'
+import { withChangeTracking } from '../src/proxy.js'
+import { oracleRuns } from './oracle-config.js'
+import {
+  cycleContainer,
+  cycleKinds,
+  cycleMember,
+  expectCycleSnapshot,
+  expectDetachedBinaryClone,
+  expectDetachedPayloadJson,
+  expectOwnDataProperty,
+  storedDataRow,
+  storedRow,
+} from './proxy-detachment-fixture.js'
+import type { CycleRow } from './proxy-detachment-fixture.js'
 
 describe(`Mutation result detachment`, () => {
+  // For any number of ordinary fields, one write changes only that field and
+  // defines no property descriptors: a generated law over the field count.
   it(`copies ordinary fields without descriptor writes`, () => {
     fc.assert(
       fc.property(fc.integer({ min: 1, max: 40 }), (count) => {
@@ -274,204 +165,12 @@ describe(`Mutation result detachment`, () => {
     },
   )
 
-  it.each([null, undefined])(
-    `reads an assigned %s before a later write`,
-    (value) => {
-      const original = {
-        value: `before` as string | null | undefined,
-        read: ``,
-      }
-      const expected = { ...original }
-      const run = (row: typeof original) => {
-        row.value = value
-        row.read = String(row.value)
-      }
-      run(expected)
-      const changes = withChangeTracking(original, run)
-      expect({ ...original, ...changes }).toStrictEqual(expected)
-    },
-  )
-
-  it.each([`replace`, `delete`] as const)(
-    `keeps retired edges retired after %s with and without a surviving alias`,
-    async (operation) => {
-      type Row = {
-        id: number
-        child?: { value: number }
-        alias?: { value: number }
-      }
-      for (const survivingAlias of [false, true]) {
-        const make = (): Row => {
-          const child = { value: 1 }
-          return { id: 1, child, ...(survivingAlias ? { alias: child } : {}) }
-        }
-        const run = (row: Row) => {
-          const retired = row.child!
-          if (operation === `replace`) row.child = { value: 2 }
-          else delete row.child
-          retired.value = 3
-        }
-        const expected = make()
-        run(expected)
-        const collection = storedRow(make())
-        try {
-          const tx = collection.update(1, run)
-          await tx.isPersisted.promise
-          expect(collection.get(1)!.child).toStrictEqual(expected.child)
-          expect(collection.get(1)!.alias).toStrictEqual(expected.alias)
-        } finally {
-          await collection.cleanup()
-        }
-      }
-    },
-  )
-
-  it.each(
-    ([`Set`, `RegExp`] as const).flatMap((kind) =>
-      [false, true].map((nested) => ({ kind, nested })),
-    ),
-  )(
-    `preserves native state across existing $kind replacement and reversion, nested=$nested`,
-    async ({ kind, nested }) => {
-      const makeNativeValue = (value: number) => {
-        if (kind === `Set`) return new Set([{ value }])
-        const expression = /x/g
-        expression.lastIndex = value
-        return expression
-      }
-      const makeValue = (value: number) =>
-        nested ? { nested: makeNativeValue(value) } : makeNativeValue(value)
-      const observe = (container: ReturnType<typeof makeValue>) => {
-        const value = `nested` in container ? container.nested : container
-        return value instanceof Set ? [...value] : value.lastIndex
-      }
-      for (const values of [[2], [2, 1]]) {
-        const make = () => ({ id: 1, value: makeValue(1) })
-        const expected = make()
-        const original = make()
-        const { proxy, getChanges } = createChangeProxy(original)
-        for (const value of values) {
-          expected.value = makeValue(value)
-          proxy.value = makeValue(value)
-          const changes = getChanges()
-          expect(observe({ ...original, ...changes }.value)).toStrictEqual(
-            observe(expected.value),
-          )
-        }
-        const collection = storedRow(make())
-        try {
-          const tx = collection.update(1, (draft) => {
-            for (const value of values) draft.value = makeValue(value)
-          })
-          await tx.isPersisted.promise
-          expect(observe(collection.get(1)!.value)).toStrictEqual(
-            observe(expected.value),
-          )
-        } finally {
-          await collection.cleanup()
-        }
-      }
-    },
-  )
-
   // Contract: a native container's insertion order survives the draft patch
   // and the stored-row publication, even when its members are unchanged.
   // Model: run the same reorder on a fresh native Set or Map.
   // Grammar: Set/Map × replacement/clear-and-readd of two entries.
   // Driver and checkpoint: compare the change patch after the callback and
   // the public Collection row after update() publishes and persists it.
-  it.each(
-    ([`Set`, `Map`] as const).flatMap((kind) =>
-      ([`replace`, `clear-and-readd`] as const).map((action) => ({
-        kind,
-        action,
-      })),
-    ),
-  )(
-    `records $kind $action order in draft patches and stored rows`,
-    async ({ kind, action }) => {
-      const make = (): {
-        id: number
-        value: Set<string> | Map<string, number>
-      } => ({
-        id: 1,
-        value:
-          kind === `Set`
-            ? new Set([`a`, `b`])
-            : new Map<string, number>([
-                [`a`, 1],
-                [`b`, 2],
-              ]),
-      })
-      const reorder = (row: ReturnType<typeof make>) => {
-        if (kind === `Set`) {
-          if (action === `replace`) row.value = new Set([`b`, `a`])
-          else {
-            const value = row.value as Set<string>
-            value.clear()
-            value.add(`b`).add(`a`)
-          }
-        } else if (action === `replace`)
-          row.value = new Map<string, number>([
-            [`b`, 2],
-            [`a`, 1],
-          ])
-        else {
-          const value = row.value as Map<string, number>
-          value.clear()
-          value.set(`b`, 2).set(`a`, 1)
-        }
-      }
-      const entries = (value: Set<string> | Map<string, number>) => [...value]
-      const expected = make()
-      reorder(expected)
-      const original = make()
-      const changes = withChangeTracking(original, reorder)
-      expect(Object.hasOwn(changes, `value`)).toBe(true)
-      expect(
-        entries(changes.value as Set<string> | Map<string, number>),
-      ).toEqual(entries(expected.value))
-      expect(entries(original.value)).toEqual(entries(make().value))
-
-      const collection = storedRow(make())
-      try {
-        const tx = collection.update(1, reorder)
-        await tx.isPersisted.promise
-        expect(entries(collection.get(1)!.value)).toEqual(
-          entries(expected.value),
-        )
-      } finally {
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it(`preserves array length and present indices independently`, () => {
-    for (const length of [0, 1, 3]) {
-      for (const mask of [0, 1, 2, 7]) {
-        const make = () => {
-          const values = new Array<number>(length)
-          for (let index = 0; index < length; index++)
-            if (mask & (1 << index)) values[index] = index
-          return values
-        }
-        const expected = make()
-        const shape = (values: Array<number>) => ({
-          length: values.length,
-          keys: Object.keys(values),
-          visits: values.map((value, index) => [index, value]),
-        })
-        const { proxy } = createChangeProxy({ values: make() })
-        expect(shape(proxy.values)).toStrictEqual(shape(expected))
-        const changes = withChangeTracking({ values: [99] }, (draft) => {
-          draft.values = make()
-        })
-        expect(shape(changes.values as Array<number>)).toStrictEqual(
-          shape(expected),
-        )
-      }
-    }
-  })
 
   it.each([20260914, undefined])(
     `preserves JSON data keys on assignment seed=%s`,
@@ -491,18 +190,14 @@ describe(`Mutation result detachment`, () => {
             })
             // JSON data can own a non-function "constructor" field. Do not
             // let the assertion library mistake that field for a class tag.
-            expect(JSON.stringify(changes.payload)).toBe(
-              JSON.stringify(expected),
-            )
+            expectDetachedPayloadJson(changes.payload, expected)
             const saved = nested
               ? (changes.payload as { nested: Array<object> }).nested[0]!
               : changes.payload!
             expect(Object.hasOwn(saved, key)).toBe(true)
             expect(Object.getPrototypeOf(saved)).toBe(Object.prototype)
             object[key]!.value++
-            expect(JSON.stringify(changes.payload)).toBe(
-              JSON.stringify(expected),
-            )
+            expectDetachedPayloadJson(changes.payload, expected)
             expect(original).toEqual({ payload: { before: true } })
           },
         ),
@@ -571,255 +266,9 @@ describe(`Mutation result detachment`, () => {
     expect(() => expectCycleSnapshot(row, kind)).toThrow()
   })
 
-  it(`keeps arbitrary class instances by reference as an explicit isolation exception`, async () => {
-    const label = new Label(`before`)
-    const collection = storedRow({ id: 1, value: undefined as unknown })
-    try {
-      const tx = collection.update(1, (draft) => {
-        draft.value = label
-      })
-      expect(collection.get(1)!.value).toBe(label)
-      label.rename(`after`)
-      expect((collection.get(1)!.value as Label).read()).toBe(`after`)
-      await tx.isPersisted.promise
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it(`preserves and detaches a regular expression's matching position`, () => {
-    const expression = /x/g
-    expression.lastIndex = 2
-    const changes = withChangeTracking(
-      { value: undefined as unknown },
-      (draft) => {
-        draft.value = expression
-      },
-    )
-    expect((changes.value as RegExp).lastIndex).toBe(2)
-    expression.lastIndex = 0
-    expect((changes.value as RegExp).lastIndex).toBe(2)
-  })
-
-  it.each([`URL`, `class`, `Date`, `RegExp`, `typed-array`] as const)(
-    `preserves a newly assigned %s in the stored row`,
-    async (kind) => {
-      const value =
-        kind === `URL`
-          ? new URL(`https://example.com/path`)
-          : kind === `class`
-            ? new Label(`saved`)
-            : kind === `Date`
-              ? new Date(`2026-01-01T00:00:00Z`)
-              : kind === `RegExp`
-                ? /saved/gi
-                : new Uint8Array([1, 2])
-      const collection = storedRow({ id: 1, value: undefined as unknown })
-      try {
-        const tx = collection.update(1, (draft) => {
-          draft.value = value
-        })
-        const saved = collection.get(1)!.value
-        expect(Object.getPrototypeOf(saved)).toBe(Object.getPrototypeOf(value))
-        if (value instanceof URL) expect((saved as URL).href).toBe(value.href)
-        else if (value instanceof Label)
-          expect((saved as Label).read()).toBe(`saved`)
-        else expect(saved).toEqual(value)
-        await tx.isPersisted.promise
-      } finally {
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it.each([`Date`, `typed-array`] as const)(
-    `detaches a known mutable %s after callback return`,
-    (kind) => {
-      const value = kind === `Date` ? new Date(0) : new Uint8Array([1])
-      const changes = withChangeTracking(
-        { value: undefined as unknown },
-        (draft) => {
-          draft.value = value
-        },
-      )
-      if (value instanceof Date) {
-        value.setTime(1000)
-        expect((changes.value as Date).getTime()).toBe(0)
-      } else {
-        value[0] = 2
-        expect((changes.value as Uint8Array)[0]).toBe(1)
-      }
-    },
-  )
-
-  it(`keeps a stored URL unchanged when the caller later changes its URL`, async () => {
-    const value = new URL(`https://example.com/before`)
-    const collection = storedRow({ id: 1, value: undefined as unknown })
-    try {
-      const tx = collection.update(1, (draft) => {
-        draft.value = value
-      })
-      value.pathname = `/after`
-      expect((collection.get(1)!.value as URL).pathname).toBe(`/before`)
-      await tx.isPersisted.promise
-    } finally {
-      await collection.cleanup()
-    }
-  })
-
-  it.each([`Set`, `array`] as const)(
-    `can commit a new %s member holding a draft handle`,
-    async (kind) => {
-      type Row = {
-        id: number
-        count: number
-        s: Set<{ back: Row }>
-        arr: Array<{ owner: Row }>
-      }
-      const collection = storedRow<Row>({
-        id: 1,
-        count: 0,
-        s: new Set(),
-        arr: [],
-      })
-      try {
-        const tx = collection.update(1, (draft) => {
-          draft.count = 1
-          if (kind === `Set`) draft.s.add({ back: draft })
-          else draft.arr.push({ owner: draft })
-        })
-        const saved = collection.get(1)!
-        const back =
-          kind === `Set`
-            ? saved.s.values().next().value!.back
-            : saved.arr[0]!.owner
-        expect(back.count).toBe(1)
-        // The draft becomes a detached snapshot, not the published row wrapper.
-        // Its containers must still lead back to that same snapshot.
-        expect(kind === `Set` ? back.s : back.arr).toBe(
-          kind === `Set` ? saved.s : saved.arr,
-        )
-        const cycle =
-          kind === `Set`
-            ? back.s.values().next().value!.back
-            : back.arr[0]!.owner
-        expect(cycle).toBe(back)
-        await tx.isPersisted.promise
-      } finally {
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it.each(
-    ([`scalar`, `object`] as const).flatMap((kind) =>
-      ([`object`, `array`, `Map`, `Set`] as const).map((path) => ({
-        kind,
-        path,
-      })),
-    ),
-  )(
-    `omits an untouched $path back-reference on a $kind-only edit`,
-    ({ kind, path }) => {
-      type Row = {
-        count: number
-        value: { x: number }
-        child?: {
-          name: string
-          back: Row | Array<Row> | Map<string, Row> | Set<Row>
-        }
-      }
-      const row: Row = { count: 0, value: { x: 0 } }
-      row.child = {
-        name: `before`,
-        back:
-          path === `array`
-            ? [row]
-            : path === `Map`
-              ? new Map([[`row`, row]])
-              : path === `Set`
-                ? new Set([row])
-                : row,
-      }
-      const changes = withChangeTracking(row, (draft) => {
-        if (kind === `scalar`) draft.count = 1
-        else draft.value = { x: 1 }
-      })
-      expect(Object.keys(changes)).toEqual([
-        kind === `scalar` ? `count` : `value`,
-      ])
-    },
-  )
-
-  it(`keeps a real nested edit even when that child also reaches the row`, () => {
-    type Row = { count: number; child?: { name: string; back: Row } }
-    const row: Row = { count: 0 }
-    row.child = { name: `before`, back: row }
-    const changes = withChangeTracking(row, (draft) => {
-      draft.count = 1
-      draft.child!.name = `after`
-    })
-    expect((changes.child as NonNullable<Row[`child`]>).name).toBe(`after`)
-    expect(row.child.name).toBe(`before`)
-  })
-
-  it(`includes a changed sibling alias in detached changes even when it has a nested row back-reference`, () => {
-    type Child = { name: string; back?: Row }
-    type Row = { child: Child; alias: Child }
-    const child: Child = { name: `before` }
-    const row: Row = { child, alias: child }
-    child.back = row
-    const changes = withChangeTracking(row, (draft) => {
-      draft.alias.name = `after`
-    })
-    const saved = { ...row, ...changes }
-    expect(saved.child.name).toBe(`after`)
-    expect(saved.child).toBe(saved.alias)
-    expect(child.name).toBe(`before`)
-  })
-
   // Current behavior, not a promise: a draft copies a row's own enumerable
   // string keys and every own symbol key, enumerable or not. Non-enumerable
   // string keys are not copied. The change record keeps only the written key.
-  it.each([`unchanged`, `nested`] as const)(
-    `copies enumerable string keys and every symbol key into a %s draft`,
-    (shape) => {
-      const tag = Symbol(`tag`)
-      const hidden = Symbol(`hidden`)
-      const make = () => {
-        const value: Record<PropertyKey, unknown> = { id: 1, title: `a` }
-        Object.defineProperty(value, `secret`, {
-          value: `s`,
-          enumerable: false,
-          writable: true,
-          configurable: true,
-        })
-        value[tag] = `t`
-        Object.defineProperty(value, hidden, {
-          value: `h`,
-          enumerable: false,
-          writable: true,
-          configurable: true,
-        })
-        return value
-      }
-      const row = shape === `nested` ? { child: make() } : make()
-      const { proxy, getChanges } = createChangeProxy(row)
-      const draft = (
-        shape === `nested` ? (proxy as { child: object }).child : proxy
-      ) as Record<PropertyKey, unknown>
-      expect(Reflect.ownKeys(draft)).toEqual([`id`, `title`, tag, hidden])
-      expect(draft.secret).toBeUndefined()
-      expect(draft[tag]).toBe(`t`)
-      expect(draft[hidden]).toBe(`h`)
-      draft.title = `b`
-      expect(Reflect.ownKeys(draft)).toEqual([`id`, `title`, tag, hidden])
-      const changes = getChanges() as Record<PropertyKey, unknown>
-      expect(Object.keys(changes)).toEqual([
-        shape === `nested` ? `child` : `title`,
-      ])
-    },
-  )
 })
 
 // Native binary snapshots preserve the entire backing buffer and view range,
@@ -845,18 +294,7 @@ for (const kind of [`buffer`, `view`, `u8`, `i64`] as const) {
     bytes.fill(99)
     const actual = changes.value as typeof value
     expect(actual).not.toBe(value)
-    const buffer = (input: typeof value) =>
-      ArrayBuffer.isView(input) ? input.buffer : input
-    expect([...new Uint8Array(buffer(actual))]).toEqual([
-      ...new Uint8Array(buffer(expected)),
-    ])
-    expect(Object.prototype.toString.call(actual)).toBe(
-      Object.prototype.toString.call(expected),
-    )
-    if (ArrayBuffer.isView(actual) && ArrayBuffer.isView(expected)) {
-      expect(actual.byteOffset).toBe(expected.byteOffset)
-      expect(actual.byteLength).toBe(expected.byteLength)
-    }
+    expectDetachedBinaryClone(actual, expected)
   })
 }
 
@@ -864,99 +302,7 @@ for (const kind of [`buffer`, `view`, `u8`, `i64`] as const) {
 // length-sensitive subclass, and local versus foreign/shared backing storage.
 // Each was accepted before native range preservation. A scalar edit must still
 // work, and a newly assigned view must detach without changing its elements.
-for (const kind of [
-  `length-subclass`,
-  `legacy-subclass`,
-  `foreign`,
-  `shared`,
-] as const) {
-  it(`keeps ${kind} typed arrays usable and detached`, () => {
-    class LengthOnly extends Uint8Array {
-      constructor(length: number) {
-        if (typeof length !== `number` || arguments.length !== 1)
-          throw new TypeError(`one numeric length required`)
-        super(length)
-      }
-    }
-    function Legacy(length: number): Uint8Array {
-      if (typeof length !== `number`)
-        throw new TypeError(`numeric length required`)
-      return Reflect.construct(Uint8Array, [length], Legacy) as Uint8Array
-    }
-    Object.setPrototypeOf(Legacy.prototype, Uint8Array.prototype)
-    const value =
-      kind === `legacy-subclass`
-        ? Legacy(3)
-        : kind === `length-subclass`
-          ? new LengthOnly(3)
-          : kind === `foreign`
-            ? (runInNewContext(
-                `new Uint8Array(new Uint8Array([7,1,2,3,8]).buffer, 1, 3)`,
-              ) as Uint8Array)
-            : new Uint8Array(new SharedArrayBuffer(3))
-    value.set([1, 2, 3])
-    expect(
-      withChangeTracking({ value, other: 0 }, (draft) => {
-        draft.other = 1
-      }),
-    ).toEqual({ other: 1 })
-    const changes = withChangeTracking({ value: null as unknown }, (draft) => {
-      draft.value = value
-    })
-    const copy = changes.value as Uint8Array
-    value.fill(99)
-    expect([...copy]).toEqual([1, 2, 3])
-    expect(copy).not.toBe(value)
-    expect(copy.buffer).not.toBe(value.buffer)
-    expect(Object.getPrototypeOf(copy)).toBe(Object.getPrototypeOf(value))
-    if (kind === `foreign`) {
-      expect(copy.byteOffset).toBe(1)
-      expect([...new Uint8Array(copy.buffer)]).toEqual([7, 1, 2, 3, 8])
-    }
-  })
-}
 
 // Buffer and view are two references to one authored backing store. Copying
 // must preserve that graph regardless of property traversal order or realm.
 // Shared-memory concurrency is excluded: the caller mutates only after capture.
-for (const kind of [`local`, `foreign`, `shared`] as const) {
-  for (const viewFirst of [false, true]) {
-    it(`preserves ${kind} buffer aliases with viewFirst=${viewFirst}`, () => {
-      const buffer =
-        kind === `local`
-          ? new ArrayBuffer(8)
-          : kind === `foreign`
-            ? (runInNewContext(`new ArrayBuffer(8)`) as ArrayBuffer)
-            : new SharedArrayBuffer(8)
-      const bytes = new Uint8Array(buffer)
-      bytes.set([0, 1, 2, 3, 4, 5, 6, 7])
-      const view = new Uint8Array(buffer, 2, 3)
-      const value = viewFirst ? { view, buffer } : { buffer, view }
-      expect(
-        withChangeTracking({ value, other: 0 }, (draft) => {
-          draft.other = 1
-        }),
-      ).toEqual({ other: 1 })
-      const changes = withChangeTracking(
-        { value: null as unknown },
-        (draft) => {
-          draft.value = value
-        },
-      )
-      const copy = changes.value as typeof value
-      bytes.fill(99)
-      expect(copy.buffer).not.toBe(buffer)
-      expect(copy.view.buffer).toBe(copy.buffer)
-      expect(copy.view.byteOffset).toBe(2)
-      expect([...new Uint8Array(copy.buffer)]).toEqual([0, 1, 2, 3, 4, 5, 6, 7])
-    })
-  }
-}
-it(`does not classify ordinary tagged data as a native buffer`, () => {
-  const value = { [Symbol.toStringTag]: `ArrayBuffer`, marker: 1 }
-  const changes = withChangeTracking({ value: null as unknown }, (draft) => {
-    draft.value = value
-  })
-  expect(changes.value).toEqual(value)
-  expect(changes.value).not.toBe(value)
-})
diff --git a/packages/db/tests/proxy-detachment-contract.test.ts b/packages/db/tests/proxy-detachment-contract.test.ts
new file mode 100644
index 0000000000..4cbcc406d2
--- /dev/null
+++ b/packages/db/tests/proxy-detachment-contract.test.ts
@@ -0,0 +1,549 @@
+/**
+ * Ordinary detachment regressions for draft values stored in a Collection.
+ * The law and its independent model are owned by
+ * proxy-detachment-contract-oracle.test.ts, which also runs the generated
+ * descriptor-write property. These tests pin literal expectations and do not
+ * compare against a model.
+ */
+
+import { runInNewContext } from 'node:vm'
+import { describe, expect, it } from 'vitest'
+import { createChangeProxy, withChangeTracking } from '../src/proxy.js'
+import { Label, storedRow } from './proxy-detachment-fixture.js'
+
+describe(`Mutation result detachment`, () => {
+  it.each([null, undefined])(
+    `reads an assigned %s before a later write`,
+    (value) => {
+      const original = {
+        value: `before` as string | null | undefined,
+        read: ``,
+      }
+      const expected = { ...original }
+      const run = (row: typeof original) => {
+        row.value = value
+        row.read = String(row.value)
+      }
+      run(expected)
+      const changes = withChangeTracking(original, run)
+      expect({ ...original, ...changes }).toStrictEqual(expected)
+    },
+  )
+
+  it.each([`replace`, `delete`] as const)(
+    `keeps retired edges retired after %s with and without a surviving alias`,
+    async (operation) => {
+      type Row = {
+        id: number
+        child?: { value: number }
+        alias?: { value: number }
+      }
+      for (const survivingAlias of [false, true]) {
+        const make = (): Row => {
+          const child = { value: 1 }
+          return { id: 1, child, ...(survivingAlias ? { alias: child } : {}) }
+        }
+        const run = (row: Row) => {
+          const retired = row.child!
+          if (operation === `replace`) row.child = { value: 2 }
+          else delete row.child
+          retired.value = 3
+        }
+        const expected = make()
+        run(expected)
+        const collection = storedRow(make())
+        try {
+          const tx = collection.update(1, run)
+          await tx.isPersisted.promise
+          expect(collection.get(1)!.child).toStrictEqual(expected.child)
+          expect(collection.get(1)!.alias).toStrictEqual(expected.alias)
+        } finally {
+          await collection.cleanup()
+        }
+      }
+    },
+  )
+
+  it.each(
+    ([`Set`, `RegExp`] as const).flatMap((kind) =>
+      [false, true].map((nested) => ({ kind, nested })),
+    ),
+  )(
+    `preserves native state across existing $kind replacement and reversion, nested=$nested`,
+    async ({ kind, nested }) => {
+      const makeNativeValue = (value: number) => {
+        if (kind === `Set`) return new Set([{ value }])
+        const expression = /x/g
+        expression.lastIndex = value
+        return expression
+      }
+      const makeValue = (value: number) =>
+        nested ? { nested: makeNativeValue(value) } : makeNativeValue(value)
+      const observe = (container: ReturnType<typeof makeValue>) => {
+        const value = `nested` in container ? container.nested : container
+        return value instanceof Set ? [...value] : value.lastIndex
+      }
+      for (const values of [[2], [2, 1]]) {
+        const make = () => ({ id: 1, value: makeValue(1) })
+        const expected = make()
+        const original = make()
+        const { proxy, getChanges } = createChangeProxy(original)
+        for (const value of values) {
+          expected.value = makeValue(value)
+          proxy.value = makeValue(value)
+          const changes = getChanges()
+          expect(observe({ ...original, ...changes }.value)).toStrictEqual(
+            observe(expected.value),
+          )
+        }
+        const collection = storedRow(make())
+        try {
+          const tx = collection.update(1, (draft) => {
+            for (const value of values) draft.value = makeValue(value)
+          })
+          await tx.isPersisted.promise
+          expect(observe(collection.get(1)!.value)).toStrictEqual(
+            observe(expected.value),
+          )
+        } finally {
+          await collection.cleanup()
+        }
+      }
+    },
+  )
+
+  it.each(
+    ([`Set`, `Map`] as const).flatMap((kind) =>
+      ([`replace`, `clear-and-readd`] as const).map((action) => ({
+        kind,
+        action,
+      })),
+    ),
+  )(
+    `records $kind $action order in draft patches and stored rows`,
+    async ({ kind, action }) => {
+      const make = (): {
+        id: number
+        value: Set<string> | Map<string, number>
+      } => ({
+        id: 1,
+        value:
+          kind === `Set`
+            ? new Set([`a`, `b`])
+            : new Map<string, number>([
+                [`a`, 1],
+                [`b`, 2],
+              ]),
+      })
+      const reorder = (row: ReturnType<typeof make>) => {
+        if (kind === `Set`) {
+          if (action === `replace`) row.value = new Set([`b`, `a`])
+          else {
+            const value = row.value as Set<string>
+            value.clear()
+            value.add(`b`).add(`a`)
+          }
+        } else if (action === `replace`)
+          row.value = new Map<string, number>([
+            [`b`, 2],
+            [`a`, 1],
+          ])
+        else {
+          const value = row.value as Map<string, number>
+          value.clear()
+          value.set(`b`, 2).set(`a`, 1)
+        }
+      }
+      const entries = (value: Set<string> | Map<string, number>) => [...value]
+      const expected = make()
+      reorder(expected)
+      const original = make()
+      const changes = withChangeTracking(original, reorder)
+      expect(Object.hasOwn(changes, `value`)).toBe(true)
+      expect(
+        entries(changes.value as Set<string> | Map<string, number>),
+      ).toEqual(entries(expected.value))
+      expect(entries(original.value)).toEqual(entries(make().value))
+
+      const collection = storedRow(make())
+      try {
+        const tx = collection.update(1, reorder)
+        await tx.isPersisted.promise
+        expect(entries(collection.get(1)!.value)).toEqual(
+          entries(expected.value),
+        )
+      } finally {
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it(`preserves array length and present indices independently`, () => {
+    for (const length of [0, 1, 3]) {
+      for (const mask of [0, 1, 2, 7]) {
+        const make = () => {
+          const values = new Array<number>(length)
+          for (let index = 0; index < length; index++)
+            if (mask & (1 << index)) values[index] = index
+          return values
+        }
+        const expected = make()
+        const shape = (values: Array<number>) => ({
+          length: values.length,
+          keys: Object.keys(values),
+          visits: values.map((value, index) => [index, value]),
+        })
+        const { proxy } = createChangeProxy({ values: make() })
+        expect(shape(proxy.values)).toStrictEqual(shape(expected))
+        const changes = withChangeTracking({ values: [99] }, (draft) => {
+          draft.values = make()
+        })
+        expect(shape(changes.values as Array<number>)).toStrictEqual(
+          shape(expected),
+        )
+      }
+    }
+  })
+
+  it(`keeps arbitrary class instances by reference as an explicit isolation exception`, async () => {
+    const label = new Label(`before`)
+    const collection = storedRow({ id: 1, value: undefined as unknown })
+    try {
+      const tx = collection.update(1, (draft) => {
+        draft.value = label
+      })
+      expect(collection.get(1)!.value).toBe(label)
+      label.rename(`after`)
+      expect((collection.get(1)!.value as Label).read()).toBe(`after`)
+      await tx.isPersisted.promise
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it(`preserves and detaches a regular expression's matching position`, () => {
+    const expression = /x/g
+    expression.lastIndex = 2
+    const changes = withChangeTracking(
+      { value: undefined as unknown },
+      (draft) => {
+        draft.value = expression
+      },
+    )
+    expect((changes.value as RegExp).lastIndex).toBe(2)
+    expression.lastIndex = 0
+    expect((changes.value as RegExp).lastIndex).toBe(2)
+  })
+
+  it.each([`URL`, `class`, `Date`, `RegExp`, `typed-array`] as const)(
+    `preserves a newly assigned %s in the stored row`,
+    async (kind) => {
+      const value =
+        kind === `URL`
+          ? new URL(`https://example.com/path`)
+          : kind === `class`
+            ? new Label(`saved`)
+            : kind === `Date`
+              ? new Date(`2026-01-01T00:00:00Z`)
+              : kind === `RegExp`
+                ? /saved/gi
+                : new Uint8Array([1, 2])
+      const collection = storedRow({ id: 1, value: undefined as unknown })
+      try {
+        const tx = collection.update(1, (draft) => {
+          draft.value = value
+        })
+        const saved = collection.get(1)!.value
+        expect(Object.getPrototypeOf(saved)).toBe(Object.getPrototypeOf(value))
+        if (value instanceof URL) expect((saved as URL).href).toBe(value.href)
+        else if (value instanceof Label)
+          expect((saved as Label).read()).toBe(`saved`)
+        else expect(saved).toEqual(value)
+        await tx.isPersisted.promise
+      } finally {
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each([`Date`, `typed-array`] as const)(
+    `detaches a known mutable %s after callback return`,
+    (kind) => {
+      const value = kind === `Date` ? new Date(0) : new Uint8Array([1])
+      const changes = withChangeTracking(
+        { value: undefined as unknown },
+        (draft) => {
+          draft.value = value
+        },
+      )
+      if (value instanceof Date) {
+        value.setTime(1000)
+        expect((changes.value as Date).getTime()).toBe(0)
+      } else {
+        value[0] = 2
+        expect((changes.value as Uint8Array)[0]).toBe(1)
+      }
+    },
+  )
+
+  it(`keeps a stored URL unchanged when the caller later changes its URL`, async () => {
+    const value = new URL(`https://example.com/before`)
+    const collection = storedRow({ id: 1, value: undefined as unknown })
+    try {
+      const tx = collection.update(1, (draft) => {
+        draft.value = value
+      })
+      value.pathname = `/after`
+      expect((collection.get(1)!.value as URL).pathname).toBe(`/before`)
+      await tx.isPersisted.promise
+    } finally {
+      await collection.cleanup()
+    }
+  })
+
+  it.each([`Set`, `array`] as const)(
+    `can commit a new %s member holding a draft handle`,
+    async (kind) => {
+      type Row = {
+        id: number
+        count: number
+        s: Set<{ back: Row }>
+        arr: Array<{ owner: Row }>
+      }
+      const collection = storedRow<Row>({
+        id: 1,
+        count: 0,
+        s: new Set(),
+        arr: [],
+      })
+      try {
+        const tx = collection.update(1, (draft) => {
+          draft.count = 1
+          if (kind === `Set`) draft.s.add({ back: draft })
+          else draft.arr.push({ owner: draft })
+        })
+        const saved = collection.get(1)!
+        const back =
+          kind === `Set`
+            ? saved.s.values().next().value!.back
+            : saved.arr[0]!.owner
+        expect(back.count).toBe(1)
+        // The draft becomes a detached snapshot, not the published row wrapper.
+        // Its containers must still lead back to that same snapshot.
+        expect(kind === `Set` ? back.s : back.arr).toBe(
+          kind === `Set` ? saved.s : saved.arr,
+        )
+        const cycle =
+          kind === `Set`
+            ? back.s.values().next().value!.back
+            : back.arr[0]!.owner
+        expect(cycle).toBe(back)
+        await tx.isPersisted.promise
+      } finally {
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each(
+    ([`scalar`, `object`] as const).flatMap((kind) =>
+      ([`object`, `array`, `Map`, `Set`] as const).map((path) => ({
+        kind,
+        path,
+      })),
+    ),
+  )(
+    `omits an untouched $path back-reference on a $kind-only edit`,
+    ({ kind, path }) => {
+      type Row = {
+        count: number
+        value: { x: number }
+        child?: {
+          name: string
+          back: Row | Array<Row> | Map<string, Row> | Set<Row>
+        }
+      }
+      const row: Row = { count: 0, value: { x: 0 } }
+      row.child = {
+        name: `before`,
+        back:
+          path === `array`
+            ? [row]
+            : path === `Map`
+              ? new Map([[`row`, row]])
+              : path === `Set`
+                ? new Set([row])
+                : row,
+      }
+      const changes = withChangeTracking(row, (draft) => {
+        if (kind === `scalar`) draft.count = 1
+        else draft.value = { x: 1 }
+      })
+      expect(Object.keys(changes)).toEqual([
+        kind === `scalar` ? `count` : `value`,
+      ])
+    },
+  )
+
+  it(`keeps a real nested edit even when that child also reaches the row`, () => {
+    type Row = { count: number; child?: { name: string; back: Row } }
+    const row: Row = { count: 0 }
+    row.child = { name: `before`, back: row }
+    const changes = withChangeTracking(row, (draft) => {
+      draft.count = 1
+      draft.child!.name = `after`
+    })
+    expect((changes.child as NonNullable<Row[`child`]>).name).toBe(`after`)
+    expect(row.child.name).toBe(`before`)
+  })
+
+  it(`includes a changed sibling alias in detached changes even when it has a nested row back-reference`, () => {
+    type Child = { name: string; back?: Row }
+    type Row = { child: Child; alias: Child }
+    const child: Child = { name: `before` }
+    const row: Row = { child, alias: child }
+    child.back = row
+    const changes = withChangeTracking(row, (draft) => {
+      draft.alias.name = `after`
+    })
+    const saved = { ...row, ...changes }
+    expect(saved.child.name).toBe(`after`)
+    expect(saved.child).toBe(saved.alias)
+    expect(child.name).toBe(`before`)
+  })
+
+  it.each([`unchanged`, `nested`] as const)(
+    `copies enumerable string keys and every symbol key into a %s draft`,
+    (shape) => {
+      const tag = Symbol(`tag`)
+      const hidden = Symbol(`hidden`)
+      const make = () => {
+        const value: Record<PropertyKey, unknown> = { id: 1, title: `a` }
+        Object.defineProperty(value, `secret`, {
+          value: `s`,
+          enumerable: false,
+          writable: true,
+          configurable: true,
+        })
+        value[tag] = `t`
+        Object.defineProperty(value, hidden, {
+          value: `h`,
+          enumerable: false,
+          writable: true,
+          configurable: true,
+        })
+        return value
+      }
+      const row = shape === `nested` ? { child: make() } : make()
+      const { proxy, getChanges } = createChangeProxy(row)
+      const draft = (
+        shape === `nested` ? (proxy as { child: object }).child : proxy
+      ) as Record<PropertyKey, unknown>
+      expect(Reflect.ownKeys(draft)).toEqual([`id`, `title`, tag, hidden])
+      expect(draft.secret).toBeUndefined()
+      expect(draft[tag]).toBe(`t`)
+      expect(draft[hidden]).toBe(`h`)
+      draft.title = `b`
+      expect(Reflect.ownKeys(draft)).toEqual([`id`, `title`, tag, hidden])
+      const changes = getChanges() as Record<PropertyKey, unknown>
+      expect(Object.keys(changes)).toEqual([
+        shape === `nested` ? `child` : `title`,
+      ])
+    },
+  )
+})
+
+for (const kind of [
+  `length-subclass`,
+  `legacy-subclass`,
+  `foreign`,
+  `shared`,
+] as const) {
+  it(`keeps ${kind} typed arrays usable and detached`, () => {
+    class LengthOnly extends Uint8Array {
+      constructor(length: number) {
+        if (typeof length !== `number` || arguments.length !== 1)
+          throw new TypeError(`one numeric length required`)
+        super(length)
+      }
+    }
+    function Legacy(length: number): Uint8Array {
+      if (typeof length !== `number`)
+        throw new TypeError(`numeric length required`)
+      return Reflect.construct(Uint8Array, [length], Legacy) as Uint8Array
+    }
+    Object.setPrototypeOf(Legacy.prototype, Uint8Array.prototype)
+    const value =
+      kind === `legacy-subclass`
+        ? Legacy(3)
+        : kind === `length-subclass`
+          ? new LengthOnly(3)
+          : kind === `foreign`
+            ? (runInNewContext(
+                `new Uint8Array(new Uint8Array([7,1,2,3,8]).buffer, 1, 3)`,
+              ) as Uint8Array)
+            : new Uint8Array(new SharedArrayBuffer(3))
+    value.set([1, 2, 3])
+    expect(
+      withChangeTracking({ value, other: 0 }, (draft) => {
+        draft.other = 1
+      }),
+    ).toEqual({ other: 1 })
+    const changes = withChangeTracking({ value: null as unknown }, (draft) => {
+      draft.value = value
+    })
+    const copy = changes.value as Uint8Array
+    value.fill(99)
+    expect([...copy]).toEqual([1, 2, 3])
+    expect(copy).not.toBe(value)
+    expect(copy.buffer).not.toBe(value.buffer)
+    expect(Object.getPrototypeOf(copy)).toBe(Object.getPrototypeOf(value))
+    if (kind === `foreign`) {
+      expect(copy.byteOffset).toBe(1)
+      expect([...new Uint8Array(copy.buffer)]).toEqual([7, 1, 2, 3, 8])
+    }
+  })
+}
+
+for (const kind of [`local`, `foreign`, `shared`] as const) {
+  for (const viewFirst of [false, true]) {
+    it(`preserves ${kind} buffer aliases with viewFirst=${viewFirst}`, () => {
+      const buffer =
+        kind === `local`
+          ? new ArrayBuffer(8)
+          : kind === `foreign`
+            ? (runInNewContext(`new ArrayBuffer(8)`) as ArrayBuffer)
+            : new SharedArrayBuffer(8)
+      const bytes = new Uint8Array(buffer)
+      bytes.set([0, 1, 2, 3, 4, 5, 6, 7])
+      const view = new Uint8Array(buffer, 2, 3)
+      const value = viewFirst ? { view, buffer } : { buffer, view }
+      expect(
+        withChangeTracking({ value, other: 0 }, (draft) => {
+          draft.other = 1
+        }),
+      ).toEqual({ other: 1 })
+      const changes = withChangeTracking(
+        { value: null as unknown },
+        (draft) => {
+          draft.value = value
+        },
+      )
+      const copy = changes.value as typeof value
+      bytes.fill(99)
+      expect(copy.buffer).not.toBe(buffer)
+      expect(copy.view.buffer).toBe(copy.buffer)
+      expect(copy.view.byteOffset).toBe(2)
+      expect([...new Uint8Array(copy.buffer)]).toEqual([0, 1, 2, 3, 4, 5, 6, 7])
+    })
+  }
+}
+
+it(`does not classify ordinary tagged data as a native buffer`, () => {
+  const value = { [Symbol.toStringTag]: `ArrayBuffer`, marker: 1 }
+  const changes = withChangeTracking({ value: null as unknown }, (draft) => {
+    draft.value = value
+  })
+  expect(changes.value).toEqual(value)
+  expect(changes.value).not.toBe(value)
+})
diff --git a/packages/db/tests/proxy-detachment-fixture.ts b/packages/db/tests/proxy-detachment-fixture.ts
new file mode 100644
index 0000000000..9fd8ef1ec0
--- /dev/null
+++ b/packages/db/tests/proxy-detachment-fixture.ts
@@ -0,0 +1,181 @@
+/**
+ * Fixtures and checks shared by proxy-detachment-contract-oracle.test.ts,
+ * which owns the detachment law, and proxy-detachment-contract.test.ts, which
+ * holds the ordinary detachment regressions. The native structuredClone and
+ * cycle-shape checks here are the independent comparisons.
+ */
+import { expect } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { declareOracle } from './oracle-declaration.js'
+import type { StandardSchemaV1 } from '@standard-schema/spec'
+import type { CollectionConfig } from '../src/types.js'
+
+export class Label {
+  #text: string
+  constructor(text: string) {
+    this.#text = text
+  }
+  read() {
+    return this.#text
+  }
+  rename(text: string) {
+    this.#text = text
+  }
+}
+
+// The handler confirms each update through sync, so the stored row is the
+// update's result once the mutation settles.
+export function storedRowOptions<T extends object>(row: T & { id: number }) {
+  let confirm: (rows: Array<T & { id: number }>) => void = () => {}
+  return {
+    getKey: (value) => value.id,
+    startSync: true,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({ type: `insert`, value: row })
+        commit()
+        markReady()
+        confirm = (rows) => {
+          begin()
+          for (const value of rows) write({ type: `update`, value })
+          commit()
+        }
+      },
+    },
+    onUpdate: ({ transaction }) => {
+      confirm(transaction.mutations.map((mutation) => mutation.modified))
+      return Promise.resolve()
+    },
+  } satisfies CollectionConfig<T & { id: number }, number>
+}
+
+export function storedRow<T extends object>(row: T & { id: number }) {
+  return createCollection(storedRowOptions(row))
+}
+
+export function storedDataRow(
+  row: Record<string, unknown> & { id: number },
+  identitySchema: boolean,
+) {
+  if (!identitySchema) return storedRow(row)
+  const schema: StandardSchemaV1<typeof row, typeof row> = {
+    '~standard': {
+      version: 1,
+      vendor: `identity`,
+      validate: (value) => ({ value: value as typeof row }),
+    },
+  }
+  return createCollection({ ...storedRowOptions(row), schema })
+}
+
+export type CycleKind = `Map` | `Set` | `array` | `object`
+export type CycleMember = { owner: CycleRow }
+export type CycleContainer =
+  | Map<string, CycleMember>
+  | Set<CycleMember>
+  | Array<CycleMember>
+  | { member: CycleMember }
+export type CycleRow = { id: number; count: number; link?: CycleContainer }
+
+export const cycleKinds: ReadonlyArray<CycleKind> = [
+  `Map`,
+  `Set`,
+  `array`,
+  `object`,
+]
+
+export function cycleContainer(
+  kind: CycleKind,
+  owner: CycleRow,
+): CycleContainer {
+  const member = { owner }
+  if (kind === `Map`) return new Map([[`member`, member]])
+  if (kind === `Set`) return new Set([member])
+  if (kind === `array`) return [member]
+  return { member }
+}
+
+export function cycleMember(link: CycleContainer | undefined, kind: CycleKind) {
+  if (kind === `Map`) {
+    expect(link).toBeInstanceOf(Map)
+    const map = link as Map<string, CycleMember>
+    expect([...map.keys()]).toEqual([`member`])
+    return map.get(`member`)!
+  }
+  if (kind === `Set`) {
+    expect(link).toBeInstanceOf(Set)
+    const set = link as Set<CycleMember>
+    expect(set.size).toBe(1)
+    return [...set][0]!
+  }
+  if (kind === `array`) {
+    expect(Array.isArray(link)).toBe(true)
+    expect(link).toHaveLength(1)
+    return (link as Array<CycleMember>)[0]!
+  }
+  expect(Object.keys(link!)).toEqual([`member`])
+  return (link as { member: CycleMember }).member
+}
+
+export function expectCycleSnapshot(row: CycleRow, kind: CycleKind) {
+  expect(row.id).toBe(1)
+  expect(row.count).toBe(1)
+  const member = cycleMember(row.link, kind)
+  expect(Object.keys(member)).toEqual([`owner`])
+  const owner = member.owner
+  expect(owner.id).toBe(1)
+  expect(owner.count).toBe(1)
+  expect(owner.link).toBe(row.link)
+  expect(cycleMember(owner.link, kind).owner).toBe(owner)
+}
+
+export function expectOwnDataProperty(
+  object: object,
+  key: string,
+  value: unknown,
+) {
+  expect(Object.hasOwn(object, key)).toBe(true)
+  expect(Object.getPrototypeOf(object)).toBe(Object.prototype)
+  expect((object as Record<string, unknown>)[key]).toStrictEqual(value)
+}
+
+// The native structuredClone of an assigned payload is the model. The detached
+// draft must serialize to the same JSON, before and after the caller edits
+// its original object.
+export function expectDetachedPayloadJson(
+  actual: unknown,
+  expected: unknown,
+): void {
+  expect(JSON.stringify(actual)).toBe(JSON.stringify(expected))
+}
+
+// The native structuredClone of an assigned binary value is the model. The
+// detached draft keeps the clone's bytes, class tag, and view range after the
+// caller overwrites its source buffer.
+export function expectDetachedBinaryClone(
+  actual: unknown,
+  expected: unknown,
+): void {
+  const buffer = (input: unknown) =>
+    ArrayBuffer.isView(input) ? input.buffer : (input as ArrayBuffer)
+  expect([...new Uint8Array(buffer(actual))]).toEqual([
+    ...new Uint8Array(buffer(expected)),
+  ])
+  expect(Object.prototype.toString.call(actual)).toBe(
+    Object.prototype.toString.call(expected),
+  )
+  if (ArrayBuffer.isView(actual) && ArrayBuffer.isView(expected)) {
+    expect(actual.byteOffset).toBe(expected.byteOffset)
+    expect(actual.byteLength).toBe(expected.byteLength)
+  }
+}
+
+declareOracle({
+  check: [
+    expectCycleSnapshot,
+    expectOwnDataProperty,
+    expectDetachedPayloadJson,
+    expectDetachedBinaryClone,
+  ],
+})
diff --git a/packages/db/tests/proxy-iteration-contract-oracle.test.ts b/packages/db/tests/proxy-iteration-contract-oracle.test.ts
index 3c34a57a97..82cb48c749 100644
--- a/packages/db/tests/proxy-iteration-contract-oracle.test.ts
+++ b/packages/db/tests/proxy-iteration-contract-oracle.test.ts
@@ -1,10 +1,9 @@
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
-import {
-  createChangeProxy,
-  withArrayChangeTracking,
-  withChangeTracking,
-} from '../src/proxy.js'
+import { withChangeTracking } from '../src/proxy.js'
+import { declareOracle } from './oracle-declaration.js'
+import { expectMembers, protocols, visit } from './proxy-iteration-fixture.js'
+import type { Item, Protocol } from './proxy-iteration-fixture.js'
 
 /**
  * # Do draft Map and Set iterators preserve native live semantics?
@@ -26,83 +25,34 @@ import {
  * is open (a push, a removal, an index write, a length cut) changes what it
  * visits next, as on a native array, and an object element is a draft.
  */
-describe.each([`Map`, `Set`] as const)(`%s draft iteration`, (kind) => {
-  it(`calls a read-only forEach callback once per entry without reporting changes`, () => {
-    const values =
-      kind === `Map` ? new Map([[1, { x: 1 }]]) : new Set([{ x: 1 }])
-    const context = {}
-    const callback =
-      vi.fn<(value: unknown, key: unknown, collection: unknown) => void>()
-    const { proxy: draft, getChanges } = createChangeProxy({ values })
-    const draftValues = draft.values
-    draftValues.forEach(callback, context)
-    expect(callback).toHaveBeenCalledTimes(1)
-    expect(getChanges()).toEqual({})
-    expect(callback.mock.contexts).toEqual([context])
-    const [value, key, collection] = callback.mock.calls[0]!
-    expect(collection).toBe(draftValues)
-    if (kind === `Set`) expect(key).toBe(value)
-  })
 
-  it(`rejects an invalid forEach callback even when empty`, () => {
-    const values = kind === `Map` ? new Map() : new Set()
-    withChangeTracking({ values }, (draft) => {
-      expect(() => draft.values.forEach(null!)).toThrow(TypeError)
-    })
-  })
-  it(`visits entries added before consuming an existing iterator`, () => {
-    const values = kind === `Map` ? new Map([[1, 1]]) : new Set([1])
-    withChangeTracking({ values }, (draft) => {
-      const iterator = draft.values.values()
-      if (draft.values instanceof Map) draft.values.set(2, 2)
-      else draft.values.add(2)
-      expect([...iterator]).toEqual([1, 2])
-    })
-  })
+/**
+ * The native Map, Set, or Array run is the model. A draft run must visit the
+ * same members in the same order, and report the same detached changes.
+ */
+function expectNativeVisits(actual: unknown, expected: unknown): void {
+  expect(actual).toEqual(expected)
+}
 
-  it(`skips entries deleted before consuming an existing iterator`, () => {
-    const values =
-      kind === `Map`
-        ? new Map([
-            [1, 1],
-            [2, 2],
-          ])
-        : new Set([1, 2])
-    withChangeTracking({ values }, (draft) => {
-      const iterator = draft.values.values()
-      draft.values.delete(2)
-      expect([...iterator]).toEqual([1])
-    })
+/**
+ * The native Map or Set after `visit` writes `x = 2` through every member.
+ * A draft write under the same protocol must match these values before and
+ * after the update persists. This is the native model of that write.
+ */
+function nativeWrittenValues<T extends Map<unknown, Item> | Set<Item>>(
+  values: T,
+  protocol: Protocol,
+): T {
+  visit(values, protocol, (value) => {
+    value.x = 2
   })
-})
-
-type Item = { x: number }
-
-function expectMembers(
-  actual: Map<unknown, Item> | Set<Item>,
-  expected: Map<unknown, Item> | Set<Item>,
-): void {
-  expect(actual).toBeInstanceOf(expected instanceof Map ? Map : Set)
-  // Preserve Map keys, cardinality and iteration order before checking values.
-  // An empty container must not pass a per-member predicate vacuously.
-  expect([...actual]).toEqual([...expected])
+  return values
 }
 
-it.each([`Map`, `Set`] as const)(
-  `%s member checker rejects missing output and accepts complete output`,
-  (kind) => {
-    const expected =
-      kind === `Map` ? new Map([[`item`, { x: 2 }]]) : new Set([{ x: 2 }])
-    const empty = kind === `Map` ? new Map() : new Set<Item>()
-    expect(() => expectMembers(empty, expected)).toThrow()
-    expectMembers(expected, expected)
-    if (kind === `Map`) {
-      expect(() =>
-        expectMembers(new Map([[`wrong`, { x: 2 }]]), expected),
-      ).toThrow()
-    }
-  },
-)
+declareOracle({
+  check: [expectNativeVisits],
+  model: [nativeWrittenValues],
+})
 
 describe(`Array draft iteration`, () => {
   type Element = { x: number } | number
@@ -158,8 +108,8 @@ describe(`Array draft iteration`, () => {
         const changes = withChangeTracking(make(), (draft) => {
           visits = run(draft.items, iterate, edit)
         })
-        expect(visits).toEqual(expectedVisits)
-        expect(changes).toEqual({ items: native.items })
+        expectNativeVisits(visits, expectedVisits)
+        expectNativeVisits(changes, { items: native.items })
       },
     )
   })
@@ -193,259 +143,16 @@ describe.each([`Map`, `Set`] as const)(
         const changes = withChangeTracking({ values: make() }, (draft) =>
           run(draft.values),
         )
-        expect([
-          ...(changes.values as ReturnType<typeof make>).values(),
-        ]).toEqual([...expected.values()])
+        expectNativeVisits(
+          [...(changes.values as ReturnType<typeof make>).values()],
+          [...expected.values()],
+        )
       },
     )
   },
 )
-const protocols = [`values`, `entries`, `iterator`, `forEach`] as const
-
-describe(`Whole-draft identity boundary`, () => {
-  it.each([`object`, `array`, `Map`, `Set`] as const)(
-    `%s preserves existing data when a callback throws after editing a new object`,
-    (kind) => {
-      const item = { x: 1 }
-      const original = { x: 10 }
-      const input = {
-        original,
-        object: undefined as Item | undefined,
-        array: [] as Array<Item>,
-        map: new Map<string, Item>(),
-        set: new Set<Item>(),
-      }
-      const failure = new Error(`callback failed`)
-      expect(() =>
-        withChangeTracking(input, (draft) => {
-          draft.original.x = 20
-          let added: Item
-          if (kind === `object`) {
-            draft.object = item
-            added = draft.object
-          } else if (kind === `array`) {
-            draft.array.push(item)
-            added = draft.array[0]!
-          } else if (kind === `Map`) {
-            draft.map.set(`item`, item)
-            added = draft.map.get(`item`)!
-          } else {
-            draft.set.add(item)
-            added = draft.set.values().next().value!
-          }
-          added.x = 2
-          expect(item.x).toBe(2)
-          throw failure
-        }),
-      ).toThrow(failure)
-      expect(item.x).toBe(2)
-      expect(original.x).toBe(10)
-      expect(input.object).toBeUndefined()
-      expect(input.array).toEqual([])
-      expect(input.map.size).toBe(0)
-      expect(input.set.size).toBe(0)
-    },
-  )
-
-  it.each([`Map`, `Set`] as const)(
-    `shares a new object across two row drafts through %s and detaches both results`,
-    (kind) => {
-      const item = { x: 1 }
-      const rows = [1, 2].map((id) => ({
-        id,
-        values: kind === `Map` ? new Map<string, Item>() : new Set<Item>(),
-      }))
-      const changes = withArrayChangeTracking(rows, (drafts) => {
-        for (const draft of drafts) {
-          if (draft.values instanceof Map) draft.values.set(`item`, item)
-          else draft.values.add(item)
-        }
-        drafts[0]!.values.values().next().value!.x = 2
-        expect(drafts[1]!.values.values().next().value!.x).toBe(2)
-        expect(item.x).toBe(2)
-      })
-      item.x = 3
-      for (const change of changes) {
-        expect([
-          ...(change.values as (typeof rows)[number][`values`]).values(),
-        ]).toEqual([{ x: 2 }])
-      }
-      expect(rows.map((row) => row.values.size)).toEqual([0, 0])
-    },
-  )
-
-  it(`reports replacing a self link while omitting an untouched self link`, () => {
-    type Linked = { name: string; self?: Linked }
-    const input: Linked = { name: `before` }
-    input.self = input
-    const untouched = withChangeTracking(input, (draft) => {
-      draft.name = `after`
-    })
-    expect(untouched).toEqual({ name: `after` })
-    const replaced = withChangeTracking(input, (draft) => {
-      draft.name = `after`
-      draft.self = { name: `replacement` }
-    })
-    expect(replaced).toEqual({ name: `after`, self: { name: `replacement` } })
-    expect(input.self).toBe(input)
-    expect(input.name).toBe(`before`)
-  })
-
-  it.each(
-    ([`object`, `array`, `Map`, `Set`] as const).flatMap((kind) =>
-      [false, true].map((throughAlias) => ({ kind, throughAlias })),
-    ),
-  )(
-    `includes both aliases in detached changes for $kind, throughAlias=$throughAlias`,
-    ({ kind, throughAlias }) => {
-      const item = { x: 1 }
-      const alias =
-        kind === `object`
-          ? { item }
-          : kind === `array`
-            ? [item]
-            : kind === `Map`
-              ? new Map([[`item`, item]])
-              : new Set([item])
-      const input = { item, alias }
-      const readAlias = (container: typeof alias) =>
-        container instanceof Map
-          ? container.get(`item`)!
-          : container instanceof Set
-            ? container.values().next().value!
-            : Array.isArray(container)
-              ? container[0]!
-              : container.item
-      const changes = withChangeTracking(input, (draft) => {
-        const value = throughAlias ? readAlias(draft.alias) : draft.item
-        value.x = 2
-      })
-      const result = { ...input, ...changes }
-      expect(result.item.x).toBe(2)
-      expect(readAlias(result.alias).x).toBe(2)
-      expect(readAlias(result.alias)).toBe(result.item)
-      expect(item.x).toBe(1)
-    },
-  )
-})
-type Protocol = (typeof protocols)[number]
-
-function visit(
-  values: Map<unknown, Item> | Set<Item>,
-  protocol: Protocol,
-  callback: (value: Item) => void,
-) {
-  switch (protocol) {
-    case `forEach`:
-      values.forEach(callback)
-      break
-    case `entries`:
-      for (const [, value] of values.entries()) callback(value)
-      break
-    case `values`:
-      for (const value of values.values()) callback(value)
-      break
-    case `iterator`:
-      if (values instanceof Map) for (const [, value] of values) callback(value)
-      else for (const value of values) callback(value)
-  }
-}
 
 describe.each([`Map`, `Set`] as const)(`%s nested iteration laws`, (kind) => {
-  it(`reuses an original member handle without duplicating or splitting its draft identity`, () => {
-    const item = { x: 1 }
-    const values = kind === `Map` ? new Map([[`old`, item]]) : new Set([item])
-    const changes = withChangeTracking({ values }, (draft) => {
-      if (draft.values instanceof Map) {
-        draft.values.set(`new`, item)
-        draft.values.get(`new`)!.x = 2
-        expect(draft.values.get(`old`)!.x).toBe(2)
-      } else {
-        draft.values.add(item)
-        expect(draft.values.size).toBe(1)
-        draft.values.values().next().value!.x = 2
-      }
-    })
-    expect(item.x).toBe(1)
-    expectMembers(
-      changes.values as typeof values,
-      kind === `Map`
-        ? new Map([
-            [`old`, { x: 2 }],
-            [`new`, { x: 2 }],
-          ])
-        : new Set([{ x: 2 }]),
-    )
-  })
-
-  it.each(protocols)(
-    `%s tracks each nested edit once and leaves the input untouched`,
-    (protocol) => {
-      const input = [{ x: 1 }, { x: 2 }]
-      const values =
-        kind === `Map`
-          ? new Map(input.map((value) => [value.x, value]))
-          : new Set(input)
-      let visits = 0
-      const changes = withChangeTracking({ values }, (draft) => {
-        visit(draft.values, protocol, (value) => {
-          if (++visits > 2) throw new Error(`An edit reinserted an entry`)
-          value.x += 10
-        })
-      })
-      expect(visits).toBe(2)
-      expect([...(changes.values as typeof values).values()]).toEqual([
-        { x: 11 },
-        { x: 12 },
-      ])
-      expect([...values.values()]).toEqual([{ x: 1 }, { x: 2 }])
-    },
-  )
-
-  it.each(protocols)(
-    `%s can write and revert without revisiting entries or reporting changes`,
-    (protocol) => {
-      const values =
-        kind === `Map` ? new Map([[1, { x: 1 }]]) : new Set([{ x: 1 }])
-      let visits = 0
-      const changes = withChangeTracking({ values }, (draft) => {
-        visit(draft.values, protocol, (value) => {
-          if (++visits > 1) throw new Error(`An edit reinserted an entry`)
-          value.x = 2
-          value.x = 1
-        })
-      })
-      expect(visits).toBe(1)
-      expect(changes).toEqual({})
-    },
-  )
-
-  it.each(protocols)(
-    `%s preserves sibling changes when another entry reverts`,
-    (protocol) => {
-      const values =
-        kind === `Map`
-          ? new Map([
-              [1, { x: 1 }],
-              [2, { x: 2 }],
-            ])
-          : new Set([{ x: 1 }, { x: 2 }])
-      let visits = 0
-      const changes = withChangeTracking({ values }, (draft) => {
-        visit(draft.values, protocol, (value) => {
-          if (++visits > 2) throw new Error(`An edit reinserted an entry`)
-          const original = value.x
-          value.x += 10
-          if (original === 2) value.x = original
-        })
-      })
-      expect([...(changes.values as typeof values).values()]).toEqual([
-        { x: 11 },
-        { x: 2 },
-      ])
-    },
-  )
-
   it.each(protocols)(
     `%s matches native membership changes during iteration`,
     (protocol) => {
@@ -476,41 +183,13 @@ describe.each([`Map`, `Set`] as const)(`%s nested iteration laws`, (kind) => {
           : new Set([{ x: 1 }, { x: 2 }])
       const expected = run(make())
       const changes = withChangeTracking({ values: make() }, (draft) => {
-        expect(run(draft.values)).toEqual(expected)
+        expectNativeVisits(run(draft.values), expected)
       })
       expect([
         ...(changes.values as Map<unknown, Item> | Set<Item>).values(),
       ]).toEqual(expected.values)
     },
   )
-
-  it(`shares newly added values during chained mutators and detaches the result`, () => {
-    const item = { x: 1 }
-    const values = kind === `Map` ? new Map<unknown, Item>() : new Set<Item>()
-    const changes = withChangeTracking({ values }, (draft) => {
-      if (draft.values instanceof Map) {
-        expect(draft.values.set(`a`, item).set(`b`, item)).toBe(draft.values)
-        draft.values.get(`a`)!.x = 2
-        expect(draft.values.get(`b`)!.x).toBe(2)
-      } else {
-        expect(draft.values.add(item).add(item)).toBe(draft.values)
-        expect(draft.values.has(item)).toBe(true)
-        draft.values.values().next().value!.x = 2
-        expect(draft.values.size).toBe(1)
-      }
-    })
-    expect(item.x).toBe(2)
-    item.x = 3
-    expectMembers(
-      changes.values as typeof values,
-      kind === `Map`
-        ? new Map([
-            [`a`, { x: 2 }],
-            [`b`, { x: 2 }],
-          ])
-        : new Set([{ x: 2 }]),
-    )
-  })
 })
 
 it.each(protocols)(
@@ -533,54 +212,13 @@ it.each(protocols)(
     const changes = withChangeTracking(
       { values: new Set([{ x: 1 }, { x: 2 }]) },
       (draft) => {
-        expect(run(draft.values)).toEqual(expected)
+        expectNativeVisits(run(draft.values), expected)
       },
     )
     expect(changes.values).toEqual(new Set([{ x: 3 }]))
   },
 )
 
-it.each(protocols)(
-  `Set %s keys and values expose the same draft handle`,
-  (protocol) => {
-    const changes = withChangeTracking(
-      { values: new Set([{ x: 1 }]) },
-      (draft) => {
-        const key = draft.values.keys().next().value!
-        visit(draft.values, protocol, (value) => expect(value).toBe(key))
-        key.x = 2
-      },
-    )
-    expect(changes.values).toEqual(new Set([{ x: 2 }]))
-  },
-)
-
-it.each([...protocols, `keys`] as const)(
-  `Set %s handles retain membership after editing`,
-  (protocol) => {
-    const changes = withChangeTracking(
-      { values: new Set([{ x: 1 }]) },
-      (draft) => {
-        let visits = 0
-        const edit = (value: Item) => {
-          if (++visits > 1) throw new Error(`An edit reinserted an entry`)
-          value.x = 2
-          expect(draft.values.has(value)).toBe(true)
-          expect(draft.values.add(value)).toBe(draft.values)
-          draft.values.add(value)
-          expect(draft.values.size).toBe(1)
-          expect(draft.values.delete(value)).toBe(true)
-          expect(draft.values.has(value)).toBe(false)
-        }
-        if (protocol === `keys`)
-          for (const value of draft.values.keys()) edit(value)
-        else visit(draft.values, protocol, edit)
-      },
-    )
-    expect(changes.values).toEqual(new Set())
-  },
-)
-
 it.each(
   ([`Map`, `Set`] as const).flatMap((kind) =>
     protocols.map((protocol) => ({ kind, protocol })),
@@ -590,10 +228,7 @@ it.each(
   async ({ kind, protocol }) => {
     const make = () =>
       kind === `Map` ? new Map([[`a`, { x: 1 }]]) : new Set([{ x: 1 }])
-    const expected = make()
-    visit(expected, protocol, (value) => {
-      value.x = 2
-    })
+    const expected = nativeWrittenValues(make(), protocol)
     let confirm: (value: {
       id: number
       values: ReturnType<typeof make>
@@ -644,73 +279,3 @@ it.each(
     }
   },
 )
-
-it.each([`Map`, `Set`] as const)(
-  `%s accepts raw edits inside the callback but detaches committed values afterward`,
-  async (kind) => {
-    type Row = { id: number; values: Map<string, Item> | Set<Item> }
-    const collection = createCollection<Row>({
-      getKey: (row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({
-            type: `insert`,
-            value: { id: 1, values: kind === `Map` ? new Map() : new Set() },
-          })
-          commit()
-          markReady()
-        },
-      },
-      onUpdate: () => Promise.resolve(),
-    })
-    try {
-      const item = { x: 1 }
-      const tx = collection.update(1, (draft) => {
-        if (draft.values instanceof Map) draft.values.set(`a`, item)
-        else draft.values.add(item)
-        item.x = 2
-      })
-      expect([...collection.get(1)!.values.values()]).toEqual([{ x: 2 }])
-      item.x = 3
-      expect([...collection.get(1)!.values.values()]).toEqual([{ x: 2 }])
-      await tx.isPersisted.promise
-    } finally {
-      await collection.cleanup()
-    }
-  },
-)
-
-it.each([`entries`, `values`] as const)(
-  `taking one Map %s value advances one entries step after draft construction`,
-  (protocol) => {
-    const { proxy } = createChangeProxy({
-      values: new Map(Array.from({ length: 1000 }, (_, i) => [i, i])),
-    })
-    const values = proxy.values
-    let visits = 0
-    const original = Map.prototype.entries
-    const spy = vi.spyOn(Map.prototype, `entries`).mockImplementation(function (
-      this: Map<unknown, unknown>,
-    ) {
-      const iterator = original.call(this)
-      const next = iterator.next.bind(iterator)
-      iterator.next = () => {
-        const result = next()
-        if (!result.done) visits++
-        return result
-      }
-      return iterator
-    })
-    try {
-      expect(values[protocol]().next()).toEqual({
-        done: false,
-        value: protocol === `entries` ? [0, 0] : 0,
-      })
-      expect(visits).toBe(1)
-    } finally {
-      spy.mockRestore()
-    }
-  },
-)
diff --git a/packages/db/tests/proxy-iteration-contract.test.ts b/packages/db/tests/proxy-iteration-contract.test.ts
new file mode 100644
index 0000000000..a794726615
--- /dev/null
+++ b/packages/db/tests/proxy-iteration-contract.test.ts
@@ -0,0 +1,444 @@
+/**
+ * Ordinary draft Map, Set, and Array iteration tests for the proxy contract.
+ * The native-comparison laws that these tests describe are owned by
+ * proxy-iteration-contract-oracle.test.ts, which checks draft visits against
+ * native runs. The literal expectations here are regression witnesses, not
+ * an independent model.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import {
+  createChangeProxy,
+  withArrayChangeTracking,
+  withChangeTracking,
+} from '../src/proxy.js'
+import { expectMembers, protocols, visit } from './proxy-iteration-fixture.js'
+import type { Item } from './proxy-iteration-fixture.js'
+
+describe.each([`Map`, `Set`] as const)(`%s draft iteration`, (kind) => {
+  it(`calls a read-only forEach callback once per entry without reporting changes`, () => {
+    const values =
+      kind === `Map` ? new Map([[1, { x: 1 }]]) : new Set([{ x: 1 }])
+    const context = {}
+    const callback =
+      vi.fn<(value: unknown, key: unknown, collection: unknown) => void>()
+    const { proxy: draft, getChanges } = createChangeProxy({ values })
+    const draftValues = draft.values
+    draftValues.forEach(callback, context)
+    expect(callback).toHaveBeenCalledTimes(1)
+    expect(getChanges()).toEqual({})
+    expect(callback.mock.contexts).toEqual([context])
+    const [value, key, collection] = callback.mock.calls[0]!
+    expect(collection).toBe(draftValues)
+    if (kind === `Set`) expect(key).toBe(value)
+  })
+
+  it(`rejects an invalid forEach callback even when empty`, () => {
+    const values = kind === `Map` ? new Map() : new Set()
+    withChangeTracking({ values }, (draft) => {
+      expect(() => draft.values.forEach(null!)).toThrow(TypeError)
+    })
+  })
+  it(`visits entries added before consuming an existing iterator`, () => {
+    const values = kind === `Map` ? new Map([[1, 1]]) : new Set([1])
+    withChangeTracking({ values }, (draft) => {
+      const iterator = draft.values.values()
+      if (draft.values instanceof Map) draft.values.set(2, 2)
+      else draft.values.add(2)
+      expect([...iterator]).toEqual([1, 2])
+    })
+  })
+
+  it(`skips entries deleted before consuming an existing iterator`, () => {
+    const values =
+      kind === `Map`
+        ? new Map([
+            [1, 1],
+            [2, 2],
+          ])
+        : new Set([1, 2])
+    withChangeTracking({ values }, (draft) => {
+      const iterator = draft.values.values()
+      draft.values.delete(2)
+      expect([...iterator]).toEqual([1])
+    })
+  })
+})
+
+describe(`Whole-draft identity boundary`, () => {
+  it.each([`object`, `array`, `Map`, `Set`] as const)(
+    `%s preserves existing data when a callback throws after editing a new object`,
+    (kind) => {
+      const item = { x: 1 }
+      const original = { x: 10 }
+      const input = {
+        original,
+        object: undefined as Item | undefined,
+        array: [] as Array<Item>,
+        map: new Map<string, Item>(),
+        set: new Set<Item>(),
+      }
+      const failure = new Error(`callback failed`)
+      expect(() =>
+        withChangeTracking(input, (draft) => {
+          draft.original.x = 20
+          let added: Item
+          if (kind === `object`) {
+            draft.object = item
+            added = draft.object
+          } else if (kind === `array`) {
+            draft.array.push(item)
+            added = draft.array[0]!
+          } else if (kind === `Map`) {
+            draft.map.set(`item`, item)
+            added = draft.map.get(`item`)!
+          } else {
+            draft.set.add(item)
+            added = draft.set.values().next().value!
+          }
+          added.x = 2
+          expect(item.x).toBe(2)
+          throw failure
+        }),
+      ).toThrow(failure)
+      expect(item.x).toBe(2)
+      expect(original.x).toBe(10)
+      expect(input.object).toBeUndefined()
+      expect(input.array).toEqual([])
+      expect(input.map.size).toBe(0)
+      expect(input.set.size).toBe(0)
+    },
+  )
+
+  it.each([`Map`, `Set`] as const)(
+    `shares a new object across two row drafts through %s and detaches both results`,
+    (kind) => {
+      const item = { x: 1 }
+      const rows = [1, 2].map((id) => ({
+        id,
+        values: kind === `Map` ? new Map<string, Item>() : new Set<Item>(),
+      }))
+      const changes = withArrayChangeTracking(rows, (drafts) => {
+        for (const draft of drafts) {
+          if (draft.values instanceof Map) draft.values.set(`item`, item)
+          else draft.values.add(item)
+        }
+        drafts[0]!.values.values().next().value!.x = 2
+        expect(drafts[1]!.values.values().next().value!.x).toBe(2)
+        expect(item.x).toBe(2)
+      })
+      item.x = 3
+      for (const change of changes) {
+        expect([
+          ...(change.values as (typeof rows)[number][`values`]).values(),
+        ]).toEqual([{ x: 2 }])
+      }
+      expect(rows.map((row) => row.values.size)).toEqual([0, 0])
+    },
+  )
+
+  it(`reports replacing a self link while omitting an untouched self link`, () => {
+    type Linked = { name: string; self?: Linked }
+    const input: Linked = { name: `before` }
+    input.self = input
+    const untouched = withChangeTracking(input, (draft) => {
+      draft.name = `after`
+    })
+    expect(untouched).toEqual({ name: `after` })
+    const replaced = withChangeTracking(input, (draft) => {
+      draft.name = `after`
+      draft.self = { name: `replacement` }
+    })
+    expect(replaced).toEqual({ name: `after`, self: { name: `replacement` } })
+    expect(input.self).toBe(input)
+    expect(input.name).toBe(`before`)
+  })
+
+  it.each(
+    ([`object`, `array`, `Map`, `Set`] as const).flatMap((kind) =>
+      [false, true].map((throughAlias) => ({ kind, throughAlias })),
+    ),
+  )(
+    `includes both aliases in detached changes for $kind, throughAlias=$throughAlias`,
+    ({ kind, throughAlias }) => {
+      const item = { x: 1 }
+      const alias =
+        kind === `object`
+          ? { item }
+          : kind === `array`
+            ? [item]
+            : kind === `Map`
+              ? new Map([[`item`, item]])
+              : new Set([item])
+      const input = { item, alias }
+      const readAlias = (container: typeof alias) =>
+        container instanceof Map
+          ? container.get(`item`)!
+          : container instanceof Set
+            ? container.values().next().value!
+            : Array.isArray(container)
+              ? container[0]!
+              : container.item
+      const changes = withChangeTracking(input, (draft) => {
+        const value = throughAlias ? readAlias(draft.alias) : draft.item
+        value.x = 2
+      })
+      const result = { ...input, ...changes }
+      expect(result.item.x).toBe(2)
+      expect(readAlias(result.alias).x).toBe(2)
+      expect(readAlias(result.alias)).toBe(result.item)
+      expect(item.x).toBe(1)
+    },
+  )
+})
+
+describe.each([`Map`, `Set`] as const)(`%s nested iteration laws`, (kind) => {
+  it.each(protocols)(
+    `%s tracks each nested edit once and leaves the input untouched`,
+    (protocol) => {
+      const input = [{ x: 1 }, { x: 2 }]
+      const values =
+        kind === `Map`
+          ? new Map(input.map((value) => [value.x, value]))
+          : new Set(input)
+      let visits = 0
+      const changes = withChangeTracking({ values }, (draft) => {
+        visit(draft.values, protocol, (value) => {
+          if (++visits > 2) throw new Error(`An edit reinserted an entry`)
+          value.x += 10
+        })
+      })
+      expect(visits).toBe(2)
+      expect([...(changes.values as typeof values).values()]).toEqual([
+        { x: 11 },
+        { x: 12 },
+      ])
+      expect([...values.values()]).toEqual([{ x: 1 }, { x: 2 }])
+    },
+  )
+
+  it.each(protocols)(
+    `%s can write and revert without revisiting entries or reporting changes`,
+    (protocol) => {
+      const values =
+        kind === `Map` ? new Map([[1, { x: 1 }]]) : new Set([{ x: 1 }])
+      let visits = 0
+      const changes = withChangeTracking({ values }, (draft) => {
+        visit(draft.values, protocol, (value) => {
+          if (++visits > 1) throw new Error(`An edit reinserted an entry`)
+          value.x = 2
+          value.x = 1
+        })
+      })
+      expect(visits).toBe(1)
+      expect(changes).toEqual({})
+    },
+  )
+
+  it.each(protocols)(
+    `%s preserves sibling changes when another entry reverts`,
+    (protocol) => {
+      const values =
+        kind === `Map`
+          ? new Map([
+              [1, { x: 1 }],
+              [2, { x: 2 }],
+            ])
+          : new Set([{ x: 1 }, { x: 2 }])
+      let visits = 0
+      const changes = withChangeTracking({ values }, (draft) => {
+        visit(draft.values, protocol, (value) => {
+          if (++visits > 2) throw new Error(`An edit reinserted an entry`)
+          const original = value.x
+          value.x += 10
+          if (original === 2) value.x = original
+        })
+      })
+      expect([...(changes.values as typeof values).values()]).toEqual([
+        { x: 11 },
+        { x: 2 },
+      ])
+    },
+  )
+
+  it(`reuses an original member handle without duplicating or splitting its draft identity`, () => {
+    const item = { x: 1 }
+    const values = kind === `Map` ? new Map([[`old`, item]]) : new Set([item])
+    const changes = withChangeTracking({ values }, (draft) => {
+      if (draft.values instanceof Map) {
+        draft.values.set(`new`, item)
+        draft.values.get(`new`)!.x = 2
+        expect(draft.values.get(`old`)!.x).toBe(2)
+      } else {
+        draft.values.add(item)
+        expect(draft.values.size).toBe(1)
+        draft.values.values().next().value!.x = 2
+      }
+    })
+    expect(item.x).toBe(1)
+    expectMembers(
+      changes.values as typeof values,
+      kind === `Map`
+        ? new Map([
+            [`old`, { x: 2 }],
+            [`new`, { x: 2 }],
+          ])
+        : new Set([{ x: 2 }]),
+    )
+  })
+
+  it(`shares newly added values during chained mutators and detaches the result`, () => {
+    const item = { x: 1 }
+    const values = kind === `Map` ? new Map<unknown, Item>() : new Set<Item>()
+    const changes = withChangeTracking({ values }, (draft) => {
+      if (draft.values instanceof Map) {
+        expect(draft.values.set(`a`, item).set(`b`, item)).toBe(draft.values)
+        draft.values.get(`a`)!.x = 2
+        expect(draft.values.get(`b`)!.x).toBe(2)
+      } else {
+        expect(draft.values.add(item).add(item)).toBe(draft.values)
+        expect(draft.values.has(item)).toBe(true)
+        draft.values.values().next().value!.x = 2
+        expect(draft.values.size).toBe(1)
+      }
+    })
+    expect(item.x).toBe(2)
+    item.x = 3
+    expectMembers(
+      changes.values as typeof values,
+      kind === `Map`
+        ? new Map([
+            [`a`, { x: 2 }],
+            [`b`, { x: 2 }],
+          ])
+        : new Set([{ x: 2 }]),
+    )
+  })
+})
+
+it.each(protocols)(
+  `Set %s keys and values expose the same draft handle`,
+  (protocol) => {
+    const changes = withChangeTracking(
+      { values: new Set([{ x: 1 }]) },
+      (draft) => {
+        const key = draft.values.keys().next().value!
+        visit(draft.values, protocol, (value) => expect(value).toBe(key))
+        key.x = 2
+      },
+    )
+    expect(changes.values).toEqual(new Set([{ x: 2 }]))
+  },
+)
+
+it.each([...protocols, `keys`] as const)(
+  `Set %s handles retain membership after editing`,
+  (protocol) => {
+    const changes = withChangeTracking(
+      { values: new Set([{ x: 1 }]) },
+      (draft) => {
+        let visits = 0
+        const edit = (value: Item) => {
+          if (++visits > 1) throw new Error(`An edit reinserted an entry`)
+          value.x = 2
+          expect(draft.values.has(value)).toBe(true)
+          expect(draft.values.add(value)).toBe(draft.values)
+          draft.values.add(value)
+          expect(draft.values.size).toBe(1)
+          expect(draft.values.delete(value)).toBe(true)
+          expect(draft.values.has(value)).toBe(false)
+        }
+        if (protocol === `keys`)
+          for (const value of draft.values.keys()) edit(value)
+        else visit(draft.values, protocol, edit)
+      },
+    )
+    expect(changes.values).toEqual(new Set())
+  },
+)
+
+it.each([`Map`, `Set`] as const)(
+  `%s accepts raw edits inside the callback but detaches committed values afterward`,
+  async (kind) => {
+    type Row = { id: number; values: Map<string, Item> | Set<Item> }
+    const collection = createCollection<Row>({
+      getKey: (row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({
+            type: `insert`,
+            value: { id: 1, values: kind === `Map` ? new Map() : new Set() },
+          })
+          commit()
+          markReady()
+        },
+      },
+      onUpdate: () => Promise.resolve(),
+    })
+    try {
+      const item = { x: 1 }
+      const tx = collection.update(1, (draft) => {
+        if (draft.values instanceof Map) draft.values.set(`a`, item)
+        else draft.values.add(item)
+        item.x = 2
+      })
+      expect([...collection.get(1)!.values.values()]).toEqual([{ x: 2 }])
+      item.x = 3
+      expect([...collection.get(1)!.values.values()]).toEqual([{ x: 2 }])
+      await tx.isPersisted.promise
+    } finally {
+      await collection.cleanup()
+    }
+  },
+)
+
+it.each([`entries`, `values`] as const)(
+  `taking one Map %s value advances one entries step after draft construction`,
+  (protocol) => {
+    const { proxy } = createChangeProxy({
+      values: new Map(Array.from({ length: 1000 }, (_, i) => [i, i])),
+    })
+    const values = proxy.values
+    let visits = 0
+    const original = Map.prototype.entries
+    const spy = vi.spyOn(Map.prototype, `entries`).mockImplementation(function (
+      this: Map<unknown, unknown>,
+    ) {
+      const iterator = original.call(this)
+      const next = iterator.next.bind(iterator)
+      iterator.next = () => {
+        const result = next()
+        if (!result.done) visits++
+        return result
+      }
+      return iterator
+    })
+    try {
+      expect(values[protocol]().next()).toEqual({
+        done: false,
+        value: protocol === `entries` ? [0, 0] : 0,
+      })
+      expect(visits).toBe(1)
+    } finally {
+      spy.mockRestore()
+    }
+  },
+)
+
+it.each([`Map`, `Set`] as const)(
+  `%s member checker rejects missing output and accepts complete output`,
+  (kind) => {
+    const expected =
+      kind === `Map` ? new Map([[`item`, { x: 2 }]]) : new Set([{ x: 2 }])
+    const empty = kind === `Map` ? new Map() : new Set<Item>()
+    expect(() => expectMembers(empty, expected)).toThrow()
+    expectMembers(expected, expected)
+    if (kind === `Map`) {
+      expect(() =>
+        expectMembers(new Map([[`wrong`, { x: 2 }]]), expected),
+      ).toThrow()
+    }
+  },
+)
diff --git a/packages/db/tests/proxy-iteration-fixture.ts b/packages/db/tests/proxy-iteration-fixture.ts
new file mode 100644
index 0000000000..a7aa76b085
--- /dev/null
+++ b/packages/db/tests/proxy-iteration-fixture.ts
@@ -0,0 +1,44 @@
+/**
+ * Shared draft-iteration helpers for proxy-iteration-contract-oracle.test.ts
+ * and proxy-iteration-contract.test.ts. The native visit order is the model the
+ * oracle compares against; `visit` runs one protocol over a draft or native
+ * container.
+ */
+import { expect } from 'vitest'
+
+export type Item = { x: number }
+
+export const protocols = [`values`, `entries`, `iterator`, `forEach`] as const
+
+export type Protocol = (typeof protocols)[number]
+
+export function visit(
+  values: Map<unknown, Item> | Set<Item>,
+  protocol: Protocol,
+  callback: (value: Item) => void,
+) {
+  switch (protocol) {
+    case `forEach`:
+      values.forEach(callback)
+      break
+    case `entries`:
+      for (const [, value] of values.entries()) callback(value)
+      break
+    case `values`:
+      for (const value of values.values()) callback(value)
+      break
+    case `iterator`:
+      if (values instanceof Map) for (const [, value] of values) callback(value)
+      else for (const value of values) callback(value)
+  }
+}
+
+export function expectMembers(
+  actual: Map<unknown, Item> | Set<Item>,
+  expected: Map<unknown, Item> | Set<Item>,
+): void {
+  expect(actual).toBeInstanceOf(expected instanceof Map ? Map : Set)
+  // Preserve Map keys, cardinality and iteration order before checking values.
+  // An empty container must not pass a per-member predicate vacuously.
+  expect([...actual]).toEqual([...expected])
+}
diff --git a/packages/db/tests/proxy-native-methods-fixture.ts b/packages/db/tests/proxy-native-methods-fixture.ts
new file mode 100644
index 0000000000..e1d856c8cc
--- /dev/null
+++ b/packages/db/tests/proxy-native-methods-fixture.ts
@@ -0,0 +1,299 @@
+// Shared generators, call tables, and observers for the native-method oracle and
+// its ordinary coverage tests. The oracle owns the law; these are its inputs.
+import { fc } from '@fast-check/vitest'
+import { expect } from 'vitest'
+import { withChangeTracking } from '../src/proxy'
+
+export const FIXED_SEED = 2026102
+export const RUNS = 400
+export const ARRAY_METHODS = `proxy.native-array-methods`
+export const TYPED_METHODS = `proxy.native-typed-methods`
+
+export const prototypeMethods = (prototype: object, skip: Set<string>) =>
+  Object.getOwnPropertyNames(prototype).filter(
+    (name) =>
+      !skip.has(name) &&
+      typeof Object.getOwnPropertyDescriptor(prototype, name)?.value ===
+        `function`,
+  )
+
+// ---------------------------------------------------------------------------
+// Arrays.
+
+// Original objects have `x` from 0 to 3; objects the callback inserts have
+// `x` of 5 or more, so identity can be checked for original objects only.
+export type Item = { x: number }
+export type Element = number | undefined | Item | Array<Item>
+export type ElementSpec = Element | `hole`
+export type ArrayRow = { items: Array<Element> }
+
+export const itemArb = fc.integer({ min: 0, max: 3 }).map((x): Item => ({ x }))
+export const elementArb: fc.Arbitrary<ElementSpec> = fc.oneof(
+  fc.integer({ min: 0, max: 3 }),
+  fc.constant(undefined),
+  fc.constant(`hole` as const),
+  itemArb,
+  fc.array(itemArb, { maxLength: 2 }),
+)
+export const arraySpecArb = fc.array(elementArb, { maxLength: 4 })
+
+export function realizeArray(spec: Array<ElementSpec>): ArrayRow {
+  const items: Array<Element> = []
+  items.length = spec.length
+  spec.forEach((element, i) => {
+    if (element === `hole`) return
+    items[i] =
+      typeof element === `object`
+        ? (JSON.parse(JSON.stringify(element)) as Item | Array<Item>)
+        : element
+  })
+  return { items }
+}
+
+export const readsObject = (v: unknown) => typeof v === `object`
+export const arrayMethods = prototypeMethods(
+  Array.prototype,
+  new Set([`constructor`]),
+)
+// Arguments for each method, from the row and an index-shaped number `k`.
+export const arrayCalls: Record<
+  string,
+  (row: ArrayRow, k: number) => Array<unknown>
+> = {
+  at: (_row, k) => [k - 2],
+  concat: (row) => [[{ x: 9 }], row.items],
+  copyWithin: (_row, k) => [0, k],
+  entries: () => [],
+  every: () => [readsObject],
+  fill: (_row, k) => [{ x: 6 }, k],
+  filter: () => [readsObject],
+  find: () => [readsObject],
+  findIndex: () => [readsObject],
+  findLast: () => [readsObject],
+  findLastIndex: () => [readsObject],
+  flat: () => [],
+  flatMap: () => [(v: unknown) => v],
+  forEach: () => [() => undefined],
+  includes: (row, k) => [row.items[k % Math.max(row.items.length, 1)]],
+  indexOf: (row, k) => [row.items[k % Math.max(row.items.length, 1)]],
+  join: () => [`,`],
+  keys: () => [],
+  lastIndexOf: (row, k) => [row.items[k % Math.max(row.items.length, 1)]],
+  map: () => [(v: unknown) => v],
+  pop: () => [],
+  push: () => [{ x: 5 }],
+  reduce: () => [(_acc: unknown, v: unknown) => v, 0],
+  reduceRight: () => [(_acc: unknown, v: unknown) => v, 0],
+  reverse: () => [],
+  shift: () => [],
+  slice: (_row, k) => [k - 2, k],
+  some: () => [readsObject],
+  sort: () => [() => 0],
+  splice: (_row, k) => [k, 1, { x: 7 }],
+  toLocaleString: () => [],
+  toReversed: () => [],
+  toSorted: () => [() => 0],
+  toSpliced: (_row, k) => [k, 1],
+  toString: () => [],
+  unshift: () => [{ x: 5 }],
+  values: () => [],
+  with: () => [0, { x: 7 }],
+}
+
+// Objects reachable from a result, in visit order, without repeats.
+export function objectsIn(
+  value: unknown,
+  seen: Array<object> = [],
+): Array<object> {
+  if (value === null || typeof value !== `object` || seen.includes(value))
+    return seen
+  seen.push(value)
+  for (const child of Array.isArray(value) ? value : Object.values(value))
+    objectsIn(child, seen)
+  return seen
+}
+
+export function observeArray(row: ArrayRow, method: string, k: number) {
+  const call = (
+    row.items as unknown as Record<string, (...a: Array<unknown>) => unknown>
+  )[method]!
+  let raw: unknown
+  try {
+    raw = call.apply(row.items, arrayCalls[method]!(row, k))
+  } catch (error) {
+    // A native error, such as a RangeError from `with`, is an observation.
+    return { threw: (error as Error).constructor.name }
+  }
+  const returnsSelf = raw === row.items
+  const result =
+    raw !== null && typeof raw === `object` && Symbol.iterator in raw
+      ? [...(raw as Iterable<unknown>)]
+      : raw
+  const snapshot = JSON.stringify(result ?? null)
+  const originals = objectsIn(result).filter(
+    (o): o is Item => !Array.isArray(o) && (o as Item).x <= 3,
+  )
+  // Where each original object of the result sits in the row, by identity.
+  const identity = originals.map((o) =>
+    row.items.flatMap((element, i) =>
+      element === o
+        ? [i]
+        : Array.isArray(element) && element.includes(o)
+          ? [i + 0.5]
+          : [],
+    ),
+  )
+  for (const o of originals) o.x += 100
+  return { snapshot, returnsSelf, identity }
+}
+
+// Holes count: a detached array must preserve the native array's holes.
+export const encodeArray = (items: Array<Element>) =>
+  JSON.stringify({ items, present: items.map((_, i) => i in items) })
+
+export function expectArrayCall(
+  spec: Array<ElementSpec>,
+  method: string,
+  k: number,
+): void {
+  const native = realizeArray(spec)
+  const expected = observeArray(native, method, k)
+  let actual: unknown
+  const changes = withChangeTracking(realizeArray(spec), (draft) => {
+    actual = observeArray(draft, method, k)
+  })
+  const context = JSON.stringify({ spec, method, k })
+  expect(actual, `result, ${context}`).toEqual(expected)
+  const changed =
+    encodeArray(native.items) !== encodeArray(realizeArray(spec).items)
+  const detachedItems = (changes as Partial<ArrayRow>).items
+  if (changed || detachedItems !== undefined)
+    expect(
+      detachedItems && encodeArray(detachedItems),
+      `detached items, ${context}`,
+    ).toBe(encodeArray(native.items))
+  if (!changed && !MUTATORS.has(method))
+    expect(changes, `no change, ${context}`).toEqual({})
+}
+export const MUTATORS = new Set([
+  `copyWithin`,
+  `fill`,
+  `pop`,
+  `push`,
+  `reverse`,
+  `shift`,
+  `sort`,
+  `splice`,
+  `unshift`,
+])
+export type TypedRow = { t: Float64Array }
+export const typedSpecArb = fc.array(fc.constantFrom(0, -0, 1, 2, NaN, 3.5), {
+  maxLength: 4,
+})
+export const typedArrayPrototype = Object.getPrototypeOf(Float64Array.prototype)
+export const typedMethods = prototypeMethods(
+  typedArrayPrototype,
+  new Set([`constructor`]),
+)
+export const positive = (v: number) => v > 1
+export const sum = (a: number, v: number) => a + v
+export const typedCalls: Record<string, (k: number) => Array<unknown>> = {
+  at: (k) => [k - 2],
+  copyWithin: (k) => [0, k],
+  entries: () => [],
+  every: () => [positive],
+  fill: (k) => [7, k],
+  filter: () => [positive],
+  find: () => [positive],
+  findIndex: () => [positive],
+  findLast: () => [positive],
+  findLastIndex: () => [positive],
+  forEach: () => [() => undefined],
+  includes: () => [NaN],
+  indexOf: () => [1],
+  join: () => [`,`],
+  keys: () => [],
+  lastIndexOf: () => [1],
+  map: () => [(v: number) => v * 2],
+  reduce: () => [sum, 0],
+  reduceRight: () => [sum, 0],
+  reverse: () => [],
+  set: () => [[9]],
+  slice: (k) => [k - 2, k],
+  some: () => [positive],
+  sort: () => [],
+  subarray: (k) => [k - 2, k],
+  toLocaleString: () => [],
+  toReversed: () => [],
+  toSorted: () => [],
+  toString: () => [],
+  values: () => [],
+  with: () => [0, 9],
+}
+export const TYPED_MUTATORS = new Set([
+  `copyWithin`,
+  `fill`,
+  `reverse`,
+  `set`,
+  `sort`,
+])
+
+export function observeTyped(
+  row: TypedRow,
+  method: string,
+  k: number,
+  write: boolean,
+) {
+  const call = (
+    row.t as unknown as Record<string, (...a: Array<unknown>) => unknown>
+  )[method]!
+  let raw: unknown
+  try {
+    raw = call.apply(row.t, typedCalls[method]!(k))
+  } catch (error) {
+    return { threw: (error as Error).constructor.name }
+  }
+  const returnsSelf = raw === row.t
+  const result =
+    raw !== null && typeof raw === `object` && Symbol.iterator in raw
+      ? Array.from(raw as Iterable<unknown>, String)
+      : String(raw)
+  // A write through a typed-array result changes the row when it shares the
+  // buffer (`subarray`).
+  if (write && raw instanceof Float64Array && raw.length > 0) raw[0] = 42
+  return { result, returnsSelf }
+}
+
+export const encodeTyped = (t: Float64Array) => Array.from(t, (v) => String(v))
+
+export function expectTypedCall(
+  values: Array<number>,
+  method: string,
+  k: number,
+  write: boolean,
+): void {
+  const make = (): TypedRow => ({ t: Float64Array.from(values) })
+  const native = make()
+  const expected = observeTyped(native, method, k, write)
+  let actual: unknown
+  const changes = withChangeTracking(make(), (draft) => {
+    actual = observeTyped(draft, method, k, write)
+  })
+  const context = JSON.stringify({
+    values: values.map(String),
+    method,
+    k,
+    write,
+  })
+  expect(actual, `result, ${context}`).toEqual(expected)
+  // -0 differs from 0 here: a typed array stores the sign.
+  const changed = native.t.some((v, i) => !Object.is(v, values[i]))
+  const detachedArray = (changes as Partial<TypedRow>).t
+  if (changed || detachedArray !== undefined)
+    expect(
+      detachedArray && encodeTyped(detachedArray),
+      `detached typed array, ${context}`,
+    ).toEqual(encodeTyped(native.t))
+  if (!changed && !TYPED_MUTATORS.has(method))
+    expect(changes, `no change, ${context}`).toEqual({})
+}
diff --git a/packages/db/tests/proxy-native-methods-oracle.property.test.ts b/packages/db/tests/proxy-native-methods-oracle.property.test.ts
index 2d79ef610f..8bc5546cd6 100644
--- a/packages/db/tests/proxy-native-methods-oracle.property.test.ts
+++ b/packages/db/tests/proxy-native-methods-oracle.property.test.ts
@@ -1,11 +1,11 @@
-import { describe, expect, it as vitestIt } from 'vitest'
+import { describe, it as vitestIt } from 'vitest'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { withChangeTracking } from '../src/proxy'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 
 /**
  * # Do built-in array and typed-array methods behave on a draft as natively?
@@ -51,188 +51,26 @@ import {
 // runs its recorded history once and every other test stands aside. A seed
 // alone reseeds the random campaigns.
 
-const FIXED_SEED = 2026102
-const RUNS = 400
-const ARRAY_METHODS = `proxy.native-array-methods`
-const TYPED_METHODS = `proxy.native-typed-methods`
+import {
+  ARRAY_METHODS,
+  FIXED_SEED,
+  RUNS,
+  TYPED_METHODS,
+  arrayMethods,
+  arraySpecArb,
+  expectArrayCall,
+  expectTypedCall,
+  typedMethods,
+  typedSpecArb,
+} from './proxy-native-methods-fixture.js'
 
 const it = oracleReplayTest(vitestIt)
 
-const prototypeMethods = (prototype: object, skip: Set<string>) =>
-  Object.getOwnPropertyNames(prototype).filter(
-    (name) =>
-      !skip.has(name) &&
-      typeof Object.getOwnPropertyDescriptor(prototype, name)?.value ===
-        `function`,
-  )
-
-// ---------------------------------------------------------------------------
-// Arrays.
-
-// Original objects have `x` from 0 to 3; objects the callback inserts have
-// `x` of 5 or more, so identity can be checked for original objects only.
-type Item = { x: number }
-type Element = number | undefined | Item | Array<Item>
-type ElementSpec = Element | `hole`
-type ArrayRow = { items: Array<Element> }
-
-const itemArb = fc.integer({ min: 0, max: 3 }).map((x): Item => ({ x }))
-const elementArb: fc.Arbitrary<ElementSpec> = fc.oneof(
-  fc.integer({ min: 0, max: 3 }),
-  fc.constant(undefined),
-  fc.constant(`hole` as const),
-  itemArb,
-  fc.array(itemArb, { maxLength: 2 }),
-)
-const arraySpecArb = fc.array(elementArb, { maxLength: 4 })
-
-function realizeArray(spec: Array<ElementSpec>): ArrayRow {
-  const items: Array<Element> = []
-  items.length = spec.length
-  spec.forEach((element, i) => {
-    if (element === `hole`) return
-    items[i] =
-      typeof element === `object`
-        ? (JSON.parse(JSON.stringify(element)) as Item | Array<Item>)
-        : element
-  })
-  return { items }
-}
-
-const readsObject = (v: unknown) => typeof v === `object`
-const arrayMethods = prototypeMethods(Array.prototype, new Set([`constructor`]))
-// Arguments for each method, from the row and an index-shaped number `k`.
-const arrayCalls: Record<string, (row: ArrayRow, k: number) => Array<unknown>> =
-  {
-    at: (_row, k) => [k - 2],
-    concat: (row) => [[{ x: 9 }], row.items],
-    copyWithin: (_row, k) => [0, k],
-    entries: () => [],
-    every: () => [readsObject],
-    fill: (_row, k) => [{ x: 6 }, k],
-    filter: () => [readsObject],
-    find: () => [readsObject],
-    findIndex: () => [readsObject],
-    findLast: () => [readsObject],
-    findLastIndex: () => [readsObject],
-    flat: () => [],
-    flatMap: () => [(v: unknown) => v],
-    forEach: () => [() => undefined],
-    includes: (row, k) => [row.items[k % Math.max(row.items.length, 1)]],
-    indexOf: (row, k) => [row.items[k % Math.max(row.items.length, 1)]],
-    join: () => [`,`],
-    keys: () => [],
-    lastIndexOf: (row, k) => [row.items[k % Math.max(row.items.length, 1)]],
-    map: () => [(v: unknown) => v],
-    pop: () => [],
-    push: () => [{ x: 5 }],
-    reduce: () => [(_acc: unknown, v: unknown) => v, 0],
-    reduceRight: () => [(_acc: unknown, v: unknown) => v, 0],
-    reverse: () => [],
-    shift: () => [],
-    slice: (_row, k) => [k - 2, k],
-    some: () => [readsObject],
-    sort: () => [() => 0],
-    splice: (_row, k) => [k, 1, { x: 7 }],
-    toLocaleString: () => [],
-    toReversed: () => [],
-    toSorted: () => [() => 0],
-    toSpliced: (_row, k) => [k, 1],
-    toString: () => [],
-    unshift: () => [{ x: 5 }],
-    values: () => [],
-    with: () => [0, { x: 7 }],
-  }
-
-// Objects reachable from a result, in visit order, without repeats.
-function objectsIn(value: unknown, seen: Array<object> = []): Array<object> {
-  if (value === null || typeof value !== `object` || seen.includes(value))
-    return seen
-  seen.push(value)
-  for (const child of Array.isArray(value) ? value : Object.values(value))
-    objectsIn(child, seen)
-  return seen
-}
-
-function observeArray(row: ArrayRow, method: string, k: number) {
-  const call = (
-    row.items as unknown as Record<string, (...a: Array<unknown>) => unknown>
-  )[method]!
-  let raw: unknown
-  try {
-    raw = call.apply(row.items, arrayCalls[method]!(row, k))
-  } catch (error) {
-    // A native error, such as a RangeError from `with`, is an observation.
-    return { threw: (error as Error).constructor.name }
-  }
-  const returnsSelf = raw === row.items
-  const result =
-    raw !== null && typeof raw === `object` && Symbol.iterator in raw
-      ? [...(raw as Iterable<unknown>)]
-      : raw
-  const snapshot = JSON.stringify(result ?? null)
-  const originals = objectsIn(result).filter(
-    (o): o is Item => !Array.isArray(o) && (o as Item).x <= 3,
-  )
-  // Where each original object of the result sits in the row, by identity.
-  const identity = originals.map((o) =>
-    row.items.flatMap((element, i) =>
-      element === o
-        ? [i]
-        : Array.isArray(element) && element.includes(o)
-          ? [i + 0.5]
-          : [],
-    ),
-  )
-  for (const o of originals) o.x += 100
-  return { snapshot, returnsSelf, identity }
-}
-
-// Holes count: a detached array must preserve the native array's holes.
-const encodeArray = (items: Array<Element>) =>
-  JSON.stringify({ items, present: items.map((_, i) => i in items) })
-
-function expectArrayCall(
-  spec: Array<ElementSpec>,
-  method: string,
-  k: number,
-): void {
-  const native = realizeArray(spec)
-  const expected = observeArray(native, method, k)
-  let actual: unknown
-  const changes = withChangeTracking(realizeArray(spec), (draft) => {
-    actual = observeArray(draft, method, k)
-  })
-  const context = JSON.stringify({ spec, method, k })
-  expect(actual, `result, ${context}`).toEqual(expected)
-  const changed =
-    encodeArray(native.items) !== encodeArray(realizeArray(spec).items)
-  const detachedItems = (changes as Partial<ArrayRow>).items
-  if (changed || detachedItems !== undefined)
-    expect(
-      detachedItems && encodeArray(detachedItems),
-      `detached items, ${context}`,
-    ).toBe(encodeArray(native.items))
-  if (!changed && !MUTATORS.has(method))
-    expect(changes, `no change, ${context}`).toEqual({})
-}
-const MUTATORS = new Set([
-  `copyWithin`,
-  `fill`,
-  `pop`,
-  `push`,
-  `reverse`,
-  `shift`,
-  `sort`,
-  `splice`,
-  `unshift`,
-])
+// The model is native array and typed-array behavior. observeArray and
+// observeTyped record a call on either side, so they are not declared.
+declareOracle({ check: [expectArrayCall, expectTypedCall] })
 
 describe(`array methods behave like native arrays`, () => {
-  it(`has arguments for every method`, () => {
-    expect(arrayMethods.filter((name) => !(name in arrayCalls))).toEqual([])
-  })
-
   // The row of the original pinned table, for every method.
   it.each(arrayMethods)(`%s on a fixed row gives the native result`, (m) => {
     for (const k of [0, 1, 3])
@@ -254,139 +92,8 @@ describe(`array methods behave like native arrays`, () => {
     [arraySpecArb, fc.constantFrom(...arrayMethods), fc.nat(4)],
     oraclePropertyOptions(RUNS, ARRAY_METHODS),
   )(`matches native arrays across generated rows (random)`, expectArrayCall)
-
-  it(`reaches every method, holes, empty rows, and nested objects in the fixed campaign`, () => {
-    const sample = fc.sample(
-      fc.tuple(arraySpecArb, fc.constantFrom(...arrayMethods), fc.nat(4)),
-      { seed: FIXED_SEED, numRuns: RUNS },
-    )
-    expect(new Set(sample.map(([, m]) => m)).size).toBe(arrayMethods.length)
-    expect(sample.filter(([spec]) => spec.length === 0).length).toBeGreaterThan(
-      0,
-    )
-    expect(
-      sample.filter(([spec]) => spec.includes(`hole`)).length,
-    ).toBeGreaterThan(0)
-    expect(
-      sample.filter(([spec]) => spec.some((e) => Array.isArray(e))).length,
-    ).toBeGreaterThan(0)
-  })
 })
-
-// ---------------------------------------------------------------------------
-// Typed arrays.
-
-type TypedRow = { t: Float64Array }
-const typedSpecArb = fc.array(fc.constantFrom(0, -0, 1, 2, NaN, 3.5), {
-  maxLength: 4,
-})
-const typedArrayPrototype = Object.getPrototypeOf(Float64Array.prototype)
-const typedMethods = prototypeMethods(
-  typedArrayPrototype,
-  new Set([`constructor`]),
-)
-const positive = (v: number) => v > 1
-const sum = (a: number, v: number) => a + v
-const typedCalls: Record<string, (k: number) => Array<unknown>> = {
-  at: (k) => [k - 2],
-  copyWithin: (k) => [0, k],
-  entries: () => [],
-  every: () => [positive],
-  fill: (k) => [7, k],
-  filter: () => [positive],
-  find: () => [positive],
-  findIndex: () => [positive],
-  findLast: () => [positive],
-  findLastIndex: () => [positive],
-  forEach: () => [() => undefined],
-  includes: () => [NaN],
-  indexOf: () => [1],
-  join: () => [`,`],
-  keys: () => [],
-  lastIndexOf: () => [1],
-  map: () => [(v: number) => v * 2],
-  reduce: () => [sum, 0],
-  reduceRight: () => [sum, 0],
-  reverse: () => [],
-  set: () => [[9]],
-  slice: (k) => [k - 2, k],
-  some: () => [positive],
-  sort: () => [],
-  subarray: (k) => [k - 2, k],
-  toLocaleString: () => [],
-  toReversed: () => [],
-  toSorted: () => [],
-  toString: () => [],
-  values: () => [],
-  with: () => [0, 9],
-}
-const TYPED_MUTATORS = new Set([`copyWithin`, `fill`, `reverse`, `set`, `sort`])
-
-function observeTyped(
-  row: TypedRow,
-  method: string,
-  k: number,
-  write: boolean,
-) {
-  const call = (
-    row.t as unknown as Record<string, (...a: Array<unknown>) => unknown>
-  )[method]!
-  let raw: unknown
-  try {
-    raw = call.apply(row.t, typedCalls[method]!(k))
-  } catch (error) {
-    return { threw: (error as Error).constructor.name }
-  }
-  const returnsSelf = raw === row.t
-  const result =
-    raw !== null && typeof raw === `object` && Symbol.iterator in raw
-      ? Array.from(raw as Iterable<unknown>, String)
-      : String(raw)
-  // A write through a typed-array result changes the row when it shares the
-  // buffer (`subarray`).
-  if (write && raw instanceof Float64Array && raw.length > 0) raw[0] = 42
-  return { result, returnsSelf }
-}
-
-const encodeTyped = (t: Float64Array) => Array.from(t, (v) => String(v))
-
-function expectTypedCall(
-  values: Array<number>,
-  method: string,
-  k: number,
-  write: boolean,
-): void {
-  const make = (): TypedRow => ({ t: Float64Array.from(values) })
-  const native = make()
-  const expected = observeTyped(native, method, k, write)
-  let actual: unknown
-  const changes = withChangeTracking(make(), (draft) => {
-    actual = observeTyped(draft, method, k, write)
-  })
-  const context = JSON.stringify({
-    values: values.map(String),
-    method,
-    k,
-    write,
-  })
-  expect(actual, `result, ${context}`).toEqual(expected)
-  // -0 differs from 0 here: a typed array stores the sign.
-  const changed = native.t.some((v, i) => !Object.is(v, values[i]))
-  const detachedArray = (changes as Partial<TypedRow>).t
-  if (changed || detachedArray !== undefined)
-    expect(
-      detachedArray && encodeTyped(detachedArray),
-      `detached typed array, ${context}`,
-    ).toEqual(encodeTyped(native.t))
-  if (!changed && !TYPED_MUTATORS.has(method))
-    expect(changes, `no change, ${context}`).toEqual({})
-}
-
 describe(`typed-array methods behave like native typed arrays`, () => {
-  it(`has arguments for every method`, () => {
-    expect(typedMethods.filter((name) => !(name in typedCalls))).toEqual([])
-  })
-
   // The row of the original pinned table, for every method.
   it.each(typedMethods)(`%s on a fixed row gives the native result`, (m) => {
     for (const write of [false, true]) expectTypedCall([3, 1, 2], m, 1, write)
@@ -417,15 +124,4 @@ describe(`typed-array methods behave like native typed arrays`, () => {
     `matches native typed arrays across generated rows (random)`,
     expectTypedCall,
   )
-
-  it(`reaches every method, empty rows, NaN, and -0 in the fixed campaign`, () => {
-    const sample = fc.sample(
-      fc.tuple(typedSpecArb, fc.constantFrom(...typedMethods)),
-      { seed: FIXED_SEED, numRuns: RUNS },
-    )
-    expect(new Set(sample.map(([, m]) => m)).size).toBe(typedMethods.length)
-    expect(sample.some(([v]) => v.length === 0)).toBe(true)
-    expect(sample.some(([v]) => v.some((x) => Number.isNaN(x)))).toBe(true)
-    expect(sample.some(([v]) => v.some((x) => Object.is(x, -0)))).toBe(true)
-  })
 })
diff --git a/packages/db/tests/proxy-native-methods.test.ts b/packages/db/tests/proxy-native-methods.test.ts
new file mode 100644
index 0000000000..6db9f653ef
--- /dev/null
+++ b/packages/db/tests/proxy-native-methods.test.ts
@@ -0,0 +1,57 @@
+/**
+ * Ordinary coverage pins for native array and typed-array method tests: every
+ * method has call arguments, and the fixed campaign reaches each generator
+ * shape. The native-method law is owned by proxy-native-methods-oracle.property.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { fc } from '@fast-check/vitest'
+import {
+  FIXED_SEED,
+  RUNS,
+  arrayCalls,
+  arrayMethods,
+  arraySpecArb,
+  typedCalls,
+  typedMethods,
+  typedSpecArb,
+} from './proxy-native-methods-fixture.js'
+
+describe(`array methods behave like native arrays`, () => {
+  it(`has arguments for every method`, () => {
+    expect(arrayMethods.filter((name) => !(name in arrayCalls))).toEqual([])
+  })
+
+  it(`reaches every method, holes, empty rows, and nested objects in the fixed campaign`, () => {
+    const sample = fc.sample(
+      fc.tuple(arraySpecArb, fc.constantFrom(...arrayMethods), fc.nat(4)),
+      { seed: FIXED_SEED, numRuns: RUNS },
+    )
+    expect(new Set(sample.map(([, m]) => m)).size).toBe(arrayMethods.length)
+    expect(sample.filter(([spec]) => spec.length === 0).length).toBeGreaterThan(
+      0,
+    )
+    expect(
+      sample.filter(([spec]) => spec.includes(`hole`)).length,
+    ).toBeGreaterThan(0)
+    expect(
+      sample.filter(([spec]) => spec.some((e) => Array.isArray(e))).length,
+    ).toBeGreaterThan(0)
+  })
+})
+
+describe(`typed-array methods behave like native typed arrays`, () => {
+  it(`has arguments for every method`, () => {
+    expect(typedMethods.filter((name) => !(name in typedCalls))).toEqual([])
+  })
+
+  it(`reaches every method, empty rows, NaN, and -0 in the fixed campaign`, () => {
+    const sample = fc.sample(
+      fc.tuple(typedSpecArb, fc.constantFrom(...typedMethods)),
+      { seed: FIXED_SEED, numRuns: RUNS },
+    )
+    expect(new Set(sample.map(([, m]) => m)).size).toBe(typedMethods.length)
+    expect(sample.some(([v]) => v.length === 0)).toBe(true)
+    expect(sample.some(([v]) => v.some((x) => Number.isNaN(x)))).toBe(true)
+    expect(sample.some(([v]) => v.some((x) => Object.is(x, -0)))).toBe(true)
+  })
+})
diff --git a/packages/db/tests/proxy-native-rows.ts b/packages/db/tests/proxy-native-rows.ts
new file mode 100644
index 0000000000..2c48ff3501
--- /dev/null
+++ b/packages/db/tests/proxy-native-rows.ts
@@ -0,0 +1,35 @@
+/**
+ * Row fixtures shared by proxy-oracle.test.ts and proxy.test.ts. A stored
+ * function row keeps functions as data in several places. A frozen row is a
+ * small nested object for freeze and seal histories.
+ */
+export type StoredRow = {
+  handler: () => number
+  fns: Array<() => number>
+  obj: { g: () => number; count: number; bump: () => unknown }
+  m: Map<string, () => number>
+  s: Set<() => number>
+}
+
+export function makeStoredRow(f: () => number, f2: () => number): StoredRow {
+  return {
+    handler: f,
+    fns: [f, f2],
+    obj: {
+      g: f,
+      count: 0,
+      bump() {
+        this.count++
+        return this
+      },
+    },
+    m: new Map([[`k`, f]]),
+    s: new Set([f]),
+  }
+}
+
+export type FrozenRow = { n: { x: number }; m: number }
+
+export function makeFrozenRow(): FrozenRow {
+  return { n: { x: 1 }, m: 1 }
+}
diff --git a/packages/db/tests/proxy-oracle.test.ts b/packages/db/tests/proxy-oracle.test.ts
index d8111605e7..c82ef54125 100644
--- a/packages/db/tests/proxy-oracle.test.ts
+++ b/packages/db/tests/proxy-oracle.test.ts
@@ -1,18 +1,15 @@
 import { fc } from '@fast-check/vitest'
-import { describe, expect, it, vi } from 'vitest'
-import { Temporal } from 'temporal-polyfill'
+import { describe, expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index'
-import {
-  createArrayChangeProxy,
-  createChangeProxy,
-  withArrayChangeTracking,
-  withChangeTracking,
-} from '../src/proxy'
+import { createChangeProxy, withChangeTracking } from '../src/proxy'
+import { makeFrozenRow, makeStoredRow } from './proxy-native-rows'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config'
+import { declareOracle } from './oracle-declaration'
+import type { FrozenRow, StoredRow } from './proxy-native-rows'
 
 /**
  * # Does a draft behave like the native value it represents?
@@ -23,8 +20,8 @@ import {
  * descriptors, keys, iteration, cycles, aliases, and revert-to-original rules.
  * The input object must remain unchanged.
  *
- * Most examples pin individual language operations. The array callback oracle
- * is differential: it runs the same callback history on a plain native row and
+ * Pinned examples of individual language operations live in proxy.test.ts.
+ * The array callback oracle is differential: it runs the same callback history on a plain native row and
  * on a draft, then compares callback results, visit order, reconstructed rows,
  * change records, peers, and the untouched baseline. Generated two-step
  * histories explore interactions that single method tests cannot reach.
@@ -34,6 +31,14 @@ import {
  * conformance suite from growing another copy of their models.
  */
 
+const accessPaths = [
+  `element`,
+  `array`,
+  `accumulator`,
+  `values`,
+  `entries`,
+] as const
+
 const callbackMethods = [
   `forEach`,
   `some`,
@@ -147,6 +152,38 @@ function assertArrayCallbacks(cuts: ReturnType<typeof observeArrayCallbacks>) {
   }
 }
 
+/**
+ * The native write model: one authored write through an access path, applied
+ * to a plain row. A draft that records the same write must report the same
+ * row. The write reaches `items[0]` through the named path.
+ */
+function writeThroughAccessPath(
+  row: { id: number; items: Array<{ value: number }> },
+  path: (typeof accessPaths)[number],
+  delta: number,
+) {
+  if (path === `accumulator`)
+    row.items.reduce((first) => {
+      first.value += delta
+      return first
+    })
+  else if (path === `values`) row.items.values().next().value!.value += delta
+  else if (path === `entries`)
+    row.items.entries().next().value![1].value += delta
+  else
+    row.items.forEach((item, index, array) => {
+      expect(array).toBe(row.items)
+      if (index === 0)
+        (path === `element` ? item : array[index]!).value += delta
+    })
+  return row
+}
+
+declareOracle({
+  check: [assertArrayCallbacks],
+  model: [runArrayCallback, writeThroughAccessPath],
+})
+
 describe(`native array callback oracle`, () => {
   it(`keeps the shared baseline independent of every captured actual cut`, () => {
     const cuts = observeArrayCallbacks(
@@ -165,30 +202,14 @@ describe(`native array callback oracle`, () => {
     expect(cuts[1]!.original.items[0]!.value).toBe(1)
     expect(() => assertArrayCallbacks(cuts)).toThrow()
   })
-  it.each([`element`, `array`, `accumulator`, `values`, `entries`] as const)(
+  it.each(accessPaths)(
     `preserves native writes through the %s access path`,
     async (path) => {
       for (const delta of [0, 3, -2]) {
         const make = () => ({ id: 1, items: [{ value: 1 }, { value: 2 }] })
-        const run = (row: ReturnType<typeof make>) => {
-          if (path === `accumulator`)
-            row.items.reduce((first) => {
-              first.value += delta
-              return first
-            })
-          else if (path === `values`)
-            row.items.values().next().value!.value += delta
-          else if (path === `entries`)
-            row.items.entries().next().value![1].value += delta
-          else
-            row.items.forEach((item, index, array) => {
-              expect(array).toBe(row.items)
-              if (index === 0)
-                (path === `element` ? item : array[index]!).value += delta
-            })
-        }
-        const expected = make()
-        run(expected)
+        const run = (row: ReturnType<typeof make>) =>
+          writeThroughAccessPath(row, path, delta)
+        const expected = writeThroughAccessPath(make(), path, delta)
         const original = make()
         const changes = withChangeTracking(original, run)
         expect({ ...original, ...changes }).toStrictEqual(expected)
@@ -298,2355 +319,242 @@ describe(`native array callback oracle`, () => {
   )
 })
 
-describe(`Proxy Library`, () => {
-  it.each([null, `true`])(
-    `tracks reads, writes and reverts without consulting DEBUG=%s`,
-    (debug) => {
-      const getItem = vi.fn(() => debug)
-      const log = vi.spyOn(console, `log`).mockImplementation(() => {})
-      vi.stubGlobal(`localStorage`, { getItem })
-      try {
-        const original = { value: 1, nested: { value: 2 } }
-        const { proxy, getChanges } = createChangeProxy(original)
-        expect(proxy.value).toBe(1)
-        proxy.value = 3
-        proxy.nested.value = 4
-        expect(getChanges()).toEqual({ value: 3, nested: { value: 4 } })
-        proxy.value = 1
-        proxy.nested.value = 2
-        expect(getChanges()).toEqual({})
-        expect(original).toEqual({ value: 1, nested: { value: 2 } })
-        expect(getItem).not.toHaveBeenCalled()
-        expect(log).not.toHaveBeenCalled()
-      } finally {
-        vi.unstubAllGlobals()
-        log.mockRestore()
-      }
-    },
-  )
-
-  describe(`createChangeProxy`, () => {
-    it(`should track changes to an object`, () => {
-      const obj = { name: `John`, age: 30 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Make changes to the proxy
-      proxy.name = `Jane`
-      proxy.age = 31
-
-      // Check that the changes are tracked
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-        age: 31,
-      })
-
-      // Check that the original object is not modified
-      expect(obj).toEqual({
-        name: `John`,
-        age: 30,
-      })
-    })
-
-    it(`should only track properties that actually change`, () => {
-      const obj = { name: `John`, age: 30 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Set a property to the same value
-      proxy.name = `John`
-      // Change another property
-      proxy.age = 31
-
-      // Only the changed property should be tracked
-      expect(getChanges()).toEqual({
-        age: 31,
-      })
-    })
-
-    it(`should handle nested property access`, () => {
-      const obj = { user: { name: `John`, age: 30 } }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Change a nested property
-      proxy.user = { name: `Jane`, age: 31 }
-
-      // The entire user object should be tracked as a change
-      expect(getChanges()).toEqual({
-        user: { name: `Jane`, age: 31 },
-      })
-    })
-
-    it(`should track when object properties are changed`, () => {
-      const obj = { name: `John`, age: 30, active: false }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.name = `Jane`
-      proxy.active = true
-
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-        active: true,
-      })
-      expect(obj.name).toBe(`John`)
-      expect(obj.active).toBe(false)
-    })
-
-    it(`should track changes to properties within nested objects`, () => {
-      const obj = {
-        user: {
-          name: `John`,
-          contact: {
-            email: `john@example.com`,
-            phone: `123-456-7890`,
-          },
-        },
-      }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.user.contact = {
-        email: `john.doe@example.com`,
-        phone: `123-456-7890`,
-      }
-
-      expect(getChanges()).toEqual({
-        user: {
-          name: `John`,
-          contact: {
-            email: `john.doe@example.com`,
-            phone: `123-456-7890`,
-          },
-        },
-      })
-    })
-
-    it(`should track when properties are deleted from objects`, () => {
-      const obj: { name: string; age: number; role?: string } = {
-        name: `John`,
-        age: 30,
-        role: `admin`,
-      }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      delete proxy.role
-
-      expect(getChanges()).toStrictEqual({
-        role: undefined,
-      })
-      expect(obj).toEqual({
-        name: `John`,
-        age: 30,
-        role: `admin`,
-      })
-    })
-
-    it(`should not track properties when values remain the same`, () => {
-      const obj = { name: `John`, age: 30, active: true }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.name = `John`
-      proxy.age = 30
-      proxy.active = true
-
-      expect(getChanges()).toEqual({})
-      expect(obj).toEqual({ name: `John`, age: 30, active: true })
-    })
-
-    it(`should properly handle objects with circular references`, () => {
-      const obj: unknown = { name: `John`, age: 30 }
-      // @ts-expect-error ignore for test
-      obj.self = obj // Create circular reference
-
-      const { proxy, getChanges } = createChangeProxy(
-        obj as Record<string | symbol, any>,
-      )
-
-      proxy.name = `Jane`
-
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-      })
-      // @ts-expect-error ignore for test
-      expect(obj.name).toBe(`John`)
-    })
-
-    it(`should properly handle Date object mutations`, () => {
-      const obj = {
-        name: `John`,
-        createdAt: new Date(`2023-01-01`),
-      }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      const newDate = new Date(`2023-02-01`)
-      proxy.createdAt = newDate
-
-      expect(getChanges()).toEqual({
-        createdAt: newDate,
-      })
-      expect(obj.createdAt).toEqual(new Date(`2023-01-01`))
-    })
+// Commented-out draft checks kept from the Proxy Library suite.
+// TODO worth it to make this work?
+// it(`should handle symbolic properties`, () => {
+//   const symbolKey = Symbol(`test`)
+//   const obj = {
+//     [symbolKey]: `value`,
+//   }
+//
+//   const { proxy, getChanges } = createChangeProxy(obj)
+//   proxy[symbolKey] = `new value`
+//
+//   const changes = getChanges()
+//   expect(changes[symbolKey]).toBe(`new value`)
+//   expect(obj[symbolKey]).toBe(`new value`)
+// })
+// it(`should prevent prototype pollution`, () => {
+//   const obj = { constructor: { prototype: {} } }
+//   const { proxy } = createChangeProxy(obj)
+//
+//   // Attempt to modify Object.prototype through the proxy
+//   // @ts-expect-error ignore for test
+//   proxy.__proto__ = { malicious: true }
+//   // @ts-expect-error ignore for test
+//   proxy.constructor.prototype.malicious = true
+//
+//   // Verify that Object.prototype wasn't polluted
+//   // @ts-expect-error ignore for test
+//   expect({}.malicious).toBeUndefined()
+//   // @ts-expect-error ignore for test
+//   expect(Object.prototype.malicious).toBeUndefined()
+//
+//   // The changes should only affect the proxy's own prototype chain
+//   // @ts-expect-error ignore for test
+//   expect(proxy.__proto__.malicious).toBe(true)
+//   // @ts-expect-error ignore for test
+//   expect(proxy.constructor.prototype.malicious).toBe(true)
+// })
+// it(`should track array length changes through truncation`, () => {
+//   const arr = [1, 2, 3, 4, 5]
+//   const { proxy, getChanges } = createChangeProxy({ arr })
+//
+//   proxy.arr.length = 3
+//
+//   expect(getChanges()).toEqual({
+//     arr: [1, 2, 3],
+//   })
+//   expect(arr.length).toBe(3)
+//   expect(arr).toEqual([1, 2, 3, 4, 5])
+// })
+// it.only(`should prevent prototype pollution`, () => {
+//   const obj = { constructor: { prototype: {} } }
+//   const { proxy } = createChangeProxy(obj)
+//
+//   // Attempt to modify Object.prototype through the proxy
+//   // @ts-expect-error ignore for test
+//   proxy.__proto__ = { malicious: true }
+//   // @ts-expect-error ignore for test
+//   proxy.constructor.prototype.malicious = true
+//
+//   // Verify that Object.prototype wasn't polluted
+//   // @ts-expect-error ignore for test
+//   expect({}.malicious).toBeUndefined()
+//   // @ts-expect-error ignore for test
+//   expect(Object.prototype.malicious).toBeUndefined()
+//
+//   // The changes should only affect the proxy's own prototype chain
+//   // @ts-expect-error ignore for test
+//   expect(proxy.__proto__.malicious).toBe(true)
+//   // @ts-expect-error ignore for test
+//   expect(proxy.constructor.prototype.malicious).toBe(true)
+// })
 
-    it(`should track changes to custom class properties`, () => {
-      class Person {
-        name: string
-        age: number
+// A function stored as data is a value like any other. Reading it from a draft
+// must give back the stored function, by any read path, as the native row
+// does. Calling a stored method must see the draft as `this`, so its writes are
+// tracked. Inherited methods (Array, Map, and Set methods) are not data and
+// keep their own draft handling.
+describe(`stored functions behave like native values`, () => {
+  type Row = StoredRow
+  const make = makeStoredRow
 
-        constructor(name: string, age: number) {
-          this.name = name
-          this.age = age
+  // Each probe returns an observation that must be the same for a native row
+  // and for a draft of an equal row.
+  const probes: Array<[string, (row: Row, f: () => number) => unknown]> = [
+    [`field access`, (row, f) => row.handler === f],
+    [`array index`, (row, f) => row.fns[0] === f],
+    [
+      `for...of`,
+      (row, f) => {
+        for (const fn of row.fns) return fn === f
+        return undefined
+      },
+    ],
+    [`spread`, (row, f) => [...row.fns][0] === f],
+    [
+      `includes and indexOf`,
+      (row, f) => [row.fns.includes(f), row.fns.indexOf(f)],
+    ],
+    [`array callback`, (row, f) => row.fns.map((fn) => fn === f)],
+    [`nested field`, (row, f) => row.obj.g === f],
+    [`Object.values`, (row, f) => Object.values(row.obj).includes(f)],
+    [`Map value`, (row, f) => row.m.get(`k`) === f],
+    [`Set member`, (row, f) => [...row.s][0] === f && row.s.has(f)],
+    [`calling a stored function`, (row) => row.handler()],
+    [
+      `a function assigned during the callback`,
+      (row, f) => {
+        const assigned = row as Row & { added?: () => number }
+        assigned.added = f
+        return assigned.added === f
+      },
+    ],
+    [
+      `a stored method sees its object as this`,
+      (row) => row.obj.bump() === row.obj,
+    ],
+    [
+      `a detached stored method has no this`,
+      (row) => {
+        const { bump } = row.obj
+        try {
+          bump()
+          return `returned`
+        } catch (error) {
+          return (error as Error).constructor.name
         }
-      }
-
-      const obj = {
-        person: new Person(`John`, 30),
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-      proxy.person = new Person(`Jane`, 25)
-
-      expect(getChanges()).toEqual({
-        person: new Person(`Jane`, 25),
-      })
-      expect(obj.person).toEqual(new Person(`John`, 30))
-    })
-
-    it(`should track changes in deeply nested object structures`, () => {
-      const obj = {
-        company: {
-          department: {
-            team: {
-              lead: {
-                name: `John`,
-                role: `Team Lead`,
-              },
-              members: [`Alice`, `Bob`],
-            },
-          },
-        },
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Access the nested property through the proxy chain
-      const companyProxy = proxy.company
-      const departmentProxy = companyProxy.department
-      const teamProxy = departmentProxy.team
-      const leadProxy = teamProxy.lead
-      leadProxy.name = `Jane`
-
-      expect(getChanges()).toEqual({
-        company: {
-          department: {
-            team: {
-              lead: {
-                name: `Jane`,
-                role: `Team Lead`,
-              },
-              members: [`Alice`, `Bob`],
-            },
-          },
-        },
-      })
-    })
-
-    it(`should handle regular expression mutations`, () => {
-      const obj = {
-        pattern: /test/i,
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.pattern = /new-pattern/g
-
-      expect(getChanges()).toEqual({
-        pattern: /new-pattern/g,
-      })
-      expect(obj.pattern).toEqual(/test/i)
-    })
-
-    it(`should properly track BigInt type values`, () => {
-      const obj = {
-        id: BigInt(123456789),
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.id = BigInt(987654321)
-
-      expect(getChanges()).toEqual({
-        id: BigInt(987654321),
-      })
-      expect(obj.id).toBe(BigInt(123456789))
-    })
-
-    it(`should handle complex objects with multiple special types`, () => {
-      const obj = {
-        id: BigInt(123),
-        pattern: /test/,
-        date: new Date(`2023-01-01`),
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.id = BigInt(456)
-      proxy.pattern = /updated/
-      proxy.date = new Date(`2023-06-01`)
-
-      expect(getChanges()).toEqual({
-        id: BigInt(456),
-        pattern: /updated/,
-        date: new Date(`2023-06-01`),
-      })
-    })
-
-    it(`should handle property descriptors with getters and setters`, () => {
-      const obj = {
-        _name: `John`,
-        get name() {
-          return this._name
-        },
-        set name(value) {
-          this._name = value
-        },
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-      proxy.name = `Jane`
+      },
+    ],
+    [
+      `an inherited constructor`,
+      (row) => [
+        row.constructor === Object,
+        row.fns.constructor === Array,
+        row.m.constructor === Map,
+        row.s.constructor === Set,
+      ],
+    ],
+  ]
 
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-      })
-      expect(obj._name).toBe(`John`)
-      expect(obj.name).toBe(`John`)
-    })
+  // The native model: a probe on a plain row gives the observation that a
+  // draft of an equal row must give.
+  function expectNativeProbeResult(
+    probe: (row: Row, f: () => number) => unknown,
+  ) {
+    const f = () => 1
+    const f2 = () => 2
+    const native = probe(make(f, f2), f)
+    const { proxy } = createChangeProxy(make(f, f2))
+    expect(probe(proxy, f)).toEqual(native)
+  }
+  declareOracle({ check: [expectNativeProbeResult] })
 
-    // TODO worth it to make this work?
-    // it(`should handle symbolic properties`, () => {
-    //   const symbolKey = Symbol(`test`)
-    //   const obj = {
-    //     [symbolKey]: `value`,
-    //   }
-    //
-    //   const { proxy, getChanges } = createChangeProxy(obj)
-    //   proxy[symbolKey] = `new value`
-    //
-    //   const changes = getChanges()
-    //   expect(changes[symbolKey]).toBe(`new value`)
-    //   expect(obj[symbolKey]).toBe(`new value`)
-    // })
+  it.each(probes)(`%s gives the native result`, (_name, probe) => {
+    expectNativeProbeResult(probe)
+  })
+})
 
-    it(`should handle non-enumerable properties`, () => {
-      const obj = {}
-      Object.defineProperty(obj, `hidden`, {
-        value: `original`,
-        enumerable: false,
+/**
+ * `Object.defineProperty` on a draft defines the property as on a native row:
+ * the same result, value, and descriptor. A defined enumerable value is a
+ * change.
+ */
+describe(`defineProperty behaves like on a native row`, () => {
+  type Row = Record<string, unknown>
+  const make = (): Row => ({ a: 1, nested: { b: 2 } })
+  // One getter for both rows, so their descriptors compare equal.
+  const getTwo = () => 2
+  const definitions: Array<
+    [string, (row: Row) => PropertyDescriptor & { key: string }]
+  > = [
+    [`a new key with only a value`, () => ({ key: `k`, value: 5 })],
+    [`an existing key with only a value`, () => ({ key: `a`, value: 5 })],
+    [
+      `an existing key made read-only`,
+      () => ({ key: `a`, value: 6, writable: false }),
+    ],
+    [
+      `a new enumerable writable key`,
+      () => ({
+        key: `k`,
+        value: 7,
         writable: true,
+        enumerable: true,
         configurable: true,
-      })
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-      // @ts-expect-error ignore for test
-      proxy.hidden = `modified`
+      }),
+    ],
+    [`an object value`, () => ({ key: `a`, value: { c: 3 }, writable: false })],
+    [`a nested key`, () => ({ key: `nested`, value: { b: 3 } })],
+    [
+      `a new key with only an object value`,
+      () => ({ key: `k`, value: { c: 3 } }),
+    ],
+    [`a getter over an existing key`, () => ({ key: `a`, get: getTwo })],
+    [
+      `a new enumerable getter`,
+      () => ({ key: `k`, get: getTwo, enumerable: true, configurable: true }),
+    ],
+  ]
+  const observe = (
+    row: Row,
+    define: (row: Row) => PropertyDescriptor & { key: string },
+  ) => {
+    const { key, ...descriptor } = define(row)
+    const defined = Reflect.defineProperty(row, key, descriptor)
+    const { value, ...rest } = Object.getOwnPropertyDescriptor(row, key) ?? {}
+    // A read-only, non-configurable property must read back as defined.
+    const fixed = rest.configurable === false && rest.writable === false
+    const same = fixed ? row[key] === descriptor.value : undefined
+    return {
+      same,
+      defined,
+      value: JSON.stringify(value),
+      rest,
+      read: JSON.stringify(row[key]),
+    }
+  }
 
-      expect(getChanges()).toEqual({
-        hidden: `modified`,
-      })
-      // @ts-expect-error ignore for test
-      expect(obj.hidden).toBe(`original`)
-    })
+  // Like a clone, changes hold enumerable string keys only, with the value
+  // the native row now reads.
+  function expectDefinitionMatchesNative(
+    define: (row: Row) => PropertyDescriptor & { key: string },
+  ) {
+    const native = make()
+    const expected = observe(native, define)
+    const { proxy, getChanges } = createChangeProxy(make())
+    expect(observe(proxy, define)).toEqual(expected)
+    const { key } = define(proxy)
+    const enumerable = expected.rest.enumerable === true
+    expect(getChanges()).toEqual(enumerable ? { [key]: native[key] } : {})
+  }
+  declareOracle({ check: [expectDefinitionMatchesNative] })
 
-    // it(`should prevent prototype pollution`, () => {
-    //   const obj = { constructor: { prototype: {} } }
-    //   const { proxy } = createChangeProxy(obj)
-    //
-    //   // Attempt to modify Object.prototype through the proxy
-    //   // @ts-expect-error ignore for test
-    //   proxy.__proto__ = { malicious: true }
-    //   // @ts-expect-error ignore for test
-    //   proxy.constructor.prototype.malicious = true
-    //
-    //   // Verify that Object.prototype wasn't polluted
-    //   // @ts-expect-error ignore for test
-    //   expect({}.malicious).toBeUndefined()
-    //   // @ts-expect-error ignore for test
-    //   expect(Object.prototype.malicious).toBeUndefined()
-    //
-    //   // The changes should only affect the proxy's own prototype chain
-    //   // @ts-expect-error ignore for test
-    //   expect(proxy.__proto__.malicious).toBe(true)
-    //   // @ts-expect-error ignore for test
-    //   expect(proxy.constructor.prototype.malicious).toBe(true)
-    // })
+  it.each(definitions)(`%s`, (_name, define) => {
+    expectDefinitionMatchesNative(define)
   })
-
-  describe(`Frozen object handling`, () => {
-    it(`should handle creating a proxy for an already-frozen object`, () => {
-      const obj = { name: `John`, age: 30 }
-      Object.freeze(obj)
-
-      // This should not throw - the proxy should work with frozen objects
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify properties via the proxy
-      proxy.name = `Jane`
-      proxy.age = 31
-
-      // Changes should be tracked
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-        age: 31,
-      })
-
-      // Original frozen object should remain unchanged
-      expect(obj).toEqual({
-        name: `John`,
-        age: 30,
-      })
-      expect(Object.isFrozen(obj)).toBe(true)
-    })
-
-    it(`should handle deeply frozen nested objects`, () => {
-      const obj = {
-        user: {
-          name: `John`,
-          address: {
-            city: `NYC`,
-            zip: `10001`,
-          },
-        },
-      }
-      // Deep freeze the object
-      Object.freeze(obj)
-      Object.freeze(obj.user)
-      Object.freeze(obj.user.address)
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify nested properties
-      proxy.user.name = `Jane`
-      proxy.user.address.city = `LA`
-
-      // Changes should be tracked
-      expect(getChanges()).toEqual({
-        user: {
-          name: `Jane`,
-          address: {
-            city: `LA`,
-            zip: `10001`,
-          },
-        },
-      })
-
-      // Original should be unchanged
-      expect(obj.user.name).toBe(`John`)
-      expect(obj.user.address.city).toBe(`NYC`)
-    })
-
-    it(`should handle withArrayChangeTracking with frozen objects`, () => {
-      const item1 = { id: 1, name: `Item 1` }
-      const item2 = { id: 2, name: `Item 2` }
-      Object.freeze(item1)
-      Object.freeze(item2)
-      const frozenArray = [item1, item2]
-      Object.freeze(frozenArray)
-
-      // This should not throw - matches the RTK Query adapter use case
-      const changes = withArrayChangeTracking(frozenArray, (drafts) => {
-        if (drafts[0]) {
-          drafts[0].name = `Updated Item 1`
-        }
-      })
-
-      // Changes should be captured
-      expect(changes[0]).toEqual({ name: `Updated Item 1` })
-      expect(changes[1]).toEqual({})
-
-      // Original frozen objects should be unchanged
-      expect(item1.name).toBe(`Item 1`)
-      expect(Object.isFrozen(item1)).toBe(true)
-    })
-
-    it(`should handle withChangeTracking with a frozen object`, () => {
-      const obj = { id: 1, name: `Test`, value: 100 }
-      Object.freeze(obj)
-
-      const changes = withChangeTracking(obj, (draft) => {
-        draft.name = `Updated`
-        draft.value = 200
-      })
-
-      expect(changes).toEqual({
-        name: `Updated`,
-        value: 200,
-      })
-
-      // Original should be unchanged
-      expect(obj.name).toBe(`Test`)
-      expect(obj.value).toBe(100)
-    })
-
-    it(`should handle frozen arrays with nested frozen objects`, () => {
-      const data = [
-        { id: 1, details: { score: 10 } },
-        { id: 2, details: { score: 20 } },
-      ]
-      // Deep freeze everything
-      data.forEach((item) => {
-        Object.freeze(item.details)
-        Object.freeze(item)
-      })
-      Object.freeze(data)
-
-      const changes = withArrayChangeTracking(data, (drafts) => {
-        // Modify nested property
-        if (drafts[0]) {
-          drafts[0].details.score = 100
-        }
-      })
-
-      expect(changes[0]).toEqual({
-        details: { score: 100 },
-      })
-
-      // Original should be unchanged
-      expect(data[0]!.details.score).toBe(10)
-    })
-
-    it(`should handle iteration over frozen array elements`, () => {
-      const items = [
-        { id: 1, name: `A` },
-        { id: 2, name: `B` },
-        { id: 3, name: `C` },
-      ]
-      items.forEach((item) => Object.freeze(item))
-      Object.freeze(items)
-
-      const changes = withArrayChangeTracking(items, (drafts) => {
-        // Use find to locate and modify an item
-        const found = drafts.find((d) => d.id === 2)
-        if (found) {
-          found.name = `Updated B`
-        }
-      })
-
-      expect(changes[1]).toEqual({ name: `Updated B` })
-      expect(items[1]!.name).toBe(`B`) // Original unchanged
-    })
-
-    it(`should handle createArrayChangeProxy with frozen objects`, () => {
-      const items = [
-        { id: 1, status: `pending` },
-        { id: 2, status: `pending` },
-      ]
-      items.forEach((item) => Object.freeze(item))
-
-      const { proxies, getChanges } = createArrayChangeProxy(items)
-
-      proxies[0]!.status = `completed`
-      proxies[1]!.status = `in-progress`
-
-      const changes = getChanges()
-      expect(changes[0]).toEqual({ status: `completed` })
-      expect(changes[1]).toEqual({ status: `in-progress` })
-    })
-  })
-
-  describe(`Object.seal and Object.preventExtensions handling`, () => {
-    it(`should handle Object.seal correctly`, () => {
-      const obj = { name: `John`, age: 30 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Seal the proxy
-      Object.seal(proxy)
-
-      // Modify existing property (should work)
-      proxy.name = `Jane`
-
-      // Attempt to add a new property (should throw in strict mode)
-      expect(() => {
-        // @ts-expect-error testing runtime behavior
-        proxy.role = `admin`
-      }).toThrow(/not extensible/)
-
-      // Check that only the name change was tracked
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-      })
-
-      // Original object should be unchanged
-      expect(obj).toEqual({
-        name: `John`,
-        age: 30,
-      })
-    })
-
-    it(`should handle Object.preventExtensions correctly`, () => {
-      const obj = { name: `John`, age: 30 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Prevent extensions on the proxy
-      Object.preventExtensions(proxy)
-
-      // Modify existing property (should work)
-      proxy.name = `Jane`
-
-      // Attempt to add a new property (should throw)
-      expect(() => {
-        // @ts-expect-error testing runtime behavior
-        proxy.role = `admin`
-      }).toThrow(/not extensible/)
-
-      // Check that only the name change was tracked
-      expect(getChanges()).toEqual({
-        name: `Jane`,
-      })
-
-      // Original object should be unchanged
-      expect(obj).toEqual({
-        name: `John`,
-        age: 30,
-      })
-    })
-
-    it(`should allow deleting properties with preventExtensions (but not seal)`, () => {
-      const obj = { name: `John`, age: 30 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Object.preventExtensions allows deletion of configurable properties
-      // Object.seal makes properties non-configurable, so delete wouldn't work
-      Object.preventExtensions(proxy)
-
-      // Modify and delete
-      proxy.name = `Jane`
-      // @ts-expect-error testing delete on non-optional property
-      delete proxy.age
-
-      // Only the modified property is returned by getChanges
-      // (deleted properties are tracked internally but not in the result)
-      const changes = getChanges()
-      expect(changes.name).toBe(`Jane`)
-    })
-
-    it(`should not allow deleting properties on sealed objects`, () => {
-      const obj = { name: `John`, age: 30 }
-      const { proxy } = createChangeProxy(obj)
-
-      // Object.seal makes properties non-configurable
-      Object.seal(proxy)
-
-      // In strict mode (which Vitest uses), deleting a non-configurable property throws
-      expect(() => {
-        // @ts-expect-error testing delete on non-optional property
-        delete proxy.age
-      }).toThrow()
-
-      // Property should still exist
-      expect(proxy.age).toBe(30)
-    })
-
-    it(`should handle sealing a proxy with nested objects`, () => {
-      const obj = { user: { name: `John` }, count: 0 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      Object.seal(proxy)
-
-      // Modifying nested objects should still work
-      proxy.user.name = `Jane`
-      proxy.count = 5
-
-      expect(getChanges()).toEqual({
-        user: { name: `Jane` },
-        count: 5,
-      })
-    })
-  })
-
-  describe(`Enhanced Iterator Method Tracking`, () => {
-    it(`should track changes when Map values are modified via iterator`, () => {
-      const map = new Map([
-        [`key1`, { count: 1 }],
-        [`key2`, { count: 2 }],
-      ])
-
-      // Wrap the map in an object to track changes to the nested objects
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Get an entry via iterator and modify it
-      for (const [key, value] of proxy.myMap.entries()) {
-        if (key === `key1`) {
-          value.count = 10
-        }
-      }
-
-      // Verify the original map was not modified
-      expect(map.get(`key1`)?.count).toBe(1)
-
-      // Check that the change was tracked correctly
-      expect(getChanges()).toEqual({
-        myMap: new Map([
-          [`key1`, { count: 10 }],
-          [`key2`, { count: 2 }],
-        ]),
-      })
-    })
-
-    it(`should track changes when Set object values are modified via iterator`, () => {
-      const set = new Set([
-        { id: 1, value: `one` },
-        { id: 2, value: `two` },
-      ])
-
-      // Wrap the set in an object to track changes to the nested objects
-      const obj = { mySet: set }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Find and modify an object in the set via iterator
-      for (const item of proxy.mySet.values()) {
-        if (item.id === 1) {
-          item.value = `modified`
-        }
-      }
-
-      // Verify the original set was not modified
-      let found = false
-      for (const item of set) {
-        if (item.id === 1) {
-          expect(item.value).toBe(`one`)
-          found = true
-        }
-      }
-      expect(found).toBe(true)
-
-      // Check that the change was tracked correctly
-      const changes = getChanges()
-      expect(changes.mySet).toBeInstanceOf(Set)
-      const changedItems = Array.from(changes.mySet as Set<any>)
-      expect(changedItems).toEqual(
-        expect.arrayContaining([
-          { id: 1, value: `modified` },
-          { id: 2, value: `two` },
-        ]),
-      )
-      expect(changes).toEqual({
-        mySet: new Set([
-          { id: 1, value: `modified` },
-          { id: 2, value: `two` },
-        ]),
-      })
-      expect(changes.mySet.size).toBe(2)
-      expect([...set]).toEqual([
-        { id: 1, value: `one` },
-        { id: 2, value: `two` },
-      ])
-    })
-
-    it(`should track changes when Map values are modified via forEach`, () => {
-      const map = new Map([
-        [`key1`, { count: 1 }],
-        [`key2`, { count: 2 }],
-      ])
-
-      // Wrap the map in an object to track changes to the nested objects
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify values using forEach
-      proxy.myMap.forEach((value, key) => {
-        if (key === `key2`) {
-          value.count = 20
-        }
-      })
-
-      // Verify the original map was not modified
-      expect(map.get(`key2`)?.count).toBe(2)
-
-      // Check that the change was tracked correctly
-      expect(getChanges()).toEqual({
-        myMap: new Map([
-          [`key1`, { count: 1 }],
-          [`key2`, { count: 20 }],
-        ]),
-      })
-    })
-
-    it(`should track changes when Set values are modified via forEach`, () => {
-      const set = new Set([
-        { id: 1, value: `one` },
-        { id: 2, value: `two` },
-      ])
-
-      // Wrap the set in an object to track changes to the nested objects
-      const obj = { mySet: set }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify values using forEach
-      proxy.mySet.forEach((item) => {
-        if (item.id === 2) {
-          item.value = `modified two`
-        }
-      })
-
-      // Verify the original set was not modified
-      let found = false
-      for (const item of set) {
-        if (item.id === 2) {
-          expect(item.value).toBe(`two`)
-          found = true
-        }
-      }
-      expect(found).toBe(true)
-
-      // Check that the change was tracked correctly
-      const changes = getChanges()
-      expect(changes.mySet).toBeInstanceOf(Set)
-      const changedItems = Array.from(changes.mySet as Set<any>)
-      expect(changedItems).toEqual(
-        expect.arrayContaining([
-          { id: 1, value: `one` },
-          { id: 2, value: `modified two` },
-        ]),
-      )
-      expect(changes).toEqual({
-        mySet: new Set([
-          { id: 1, value: `one` },
-          { id: 2, value: `modified two` },
-        ]),
-      })
-      expect(changes.mySet.size).toBe(2)
-      expect([...set]).toEqual([
-        { id: 1, value: `one` },
-        { id: 2, value: `two` },
-      ])
-    })
-
-    it(`should handle multiple modifications to the same object via different iterators`, () => {
-      const map = new Map([
-        [`key1`, { count: 1, name: `test` }],
-        [`key2`, { count: 2, name: `test2` }],
-      ])
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify via entries()
-      for (const [key, value] of proxy.myMap.entries()) {
-        if (key === `key1`) {
-          value.count = 10
-        }
-      }
-
-      // Modify via values()
-      for (const value of proxy.myMap.values()) {
-        if (value.name === `test`) {
-          value.name = `modified`
-        }
-      }
-
-      // Verify the original map was not modified.
-      expect(map.get(`key1`)).toEqual({ count: 1, name: `test` })
-
-      expect(getChanges()).toEqual({
-        myMap: new Map([
-          [`key1`, { count: 10, name: `modified` }],
-          [`key2`, { count: 2, name: `test2` }],
-        ]),
-      })
-    })
-
-    it(`should handle nested object modifications via iterators`, () => {
-      const map = new Map([
-        [`user1`, { profile: { name: `Alice`, settings: { theme: `dark` } } }],
-        [`user2`, { profile: { name: `Bob`, settings: { theme: `light` } } }],
-      ])
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      for (const [key, user] of proxy.myMap.entries()) {
-        if (key === `user1`) {
-          user.profile.settings.theme = `auto`
-        }
-      }
-
-      expect(getChanges()).toEqual({
-        myMap: new Map([
-          [
-            `user1`,
-            { profile: { name: `Alice`, settings: { theme: `auto` } } },
-          ],
-          [`user2`, { profile: { name: `Bob`, settings: { theme: `light` } } }],
-        ]),
-      })
-      expect(map.get(`user1`)?.profile.settings.theme).toBe(`dark`)
-    })
-
-    it(`should handle Set modifications with duplicate objects`, () => {
-      const obj1 = { id: 1, value: `one` }
-      const obj2 = { id: 2, value: `two` }
-      const set = new Set([obj1, obj2, obj1]) // obj1 appears twice but Set deduplicates
-      const obj = { mySet: set }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      for (const item of proxy.mySet) {
-        if (item.id === 1) {
-          item.value = `modified`
-        }
-      }
-
-      const changes = getChanges()
-      expect(changes.mySet).toBeInstanceOf(Set)
-      expect(changes.mySet.size).toBe(2)
-      const changedItems = Array.from(changes.mySet as Set<any>)
-      expect(changedItems).toEqual(
-        expect.arrayContaining([
-          { id: 1, value: `modified` },
-          { id: 2, value: `two` },
-        ]),
-      )
-      expect(obj1.value).toBe(`one`) // Original unchanged
-      expect(changes).toEqual({
-        mySet: new Set([
-          { id: 1, value: `modified` },
-          { id: 2, value: `two` },
-        ]),
-      })
-      expect([...set]).toEqual([
-        { id: 1, value: `one` },
-        { id: 2, value: `two` },
-      ])
-    })
-
-    it(`should handle reverting changes made via iterators`, () => {
-      const map = new Map([
-        [`key1`, { count: 5 }],
-        [`key2`, { count: 10 }],
-      ])
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify via entries()
-      for (const [key, value] of proxy.myMap.entries()) {
-        if (key === `key1`) {
-          value.count = 20 // Change
-          value.count = 5 // Revert to original
-        }
-      }
-
-      // Should have no changes since we reverted
-      expect(getChanges()).toEqual({})
-    })
-
-    it(`should handle mixed Map and Set nested operations`, () => {
-      const data = {
-        userGroups: new Map([
-          [
-            `admins`,
-            {
-              users: new Set([
-                { id: 1, name: `Alice` },
-                { id: 2, name: `Bob` },
-              ]),
-            },
-          ],
-          [
-            `users`,
-            {
-              users: new Set([{ id: 3, name: `Charlie` }]),
-            },
-          ],
-        ]),
-      }
-      const { proxy, getChanges } = createChangeProxy(data)
-
-      // Navigate through Map.values() then Set iteration
-      for (const group of proxy.userGroups.values()) {
-        for (const user of group.users) {
-          if (user.name === `Alice`) {
-            user.name = `Alice Admin`
-          }
-        }
-      }
-
-      const changes = getChanges()
-      expect(changes.userGroups).toBeInstanceOf(Map)
-      const adminGroup = changes.userGroups.get(`admins`)
-      expect(adminGroup?.users).toBeInstanceOf(Set)
-      const users = Array.from(adminGroup?.users as Set<any>)
-      expect(users).toEqual(
-        expect.arrayContaining([
-          { id: 1, name: `Alice Admin` },
-          { id: 2, name: `Bob` },
-        ]),
-      )
-    })
-  })
-
-  describe(`Map and Set Operations`, () => {
-    it(`should track Map clear operations`, () => {
-      const map = new Map([
-        [`key1`, `value1`],
-        [`key2`, `value2`],
-      ])
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.myMap.clear()
-
-      expect(getChanges()).toEqual({
-        myMap: new Map(),
-      })
-      expect(map.size).toBe(2)
-    })
-
-    it(`should track Map delete operations`, () => {
-      const map = new Map([
-        [`key1`, `value1`],
-        [`key2`, `value2`],
-      ])
-      const obj = { myMap: map }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.myMap.delete(`key1`)
-
-      expect(getChanges()).toEqual({
-        myMap: new Map([[`key2`, `value2`]]),
-      })
-      expect(map.has(`key1`)).toBe(true)
-    })
-
-    it(`should track Map set operations with object keys`, () => {
-      const objKey = { id: 1 }
-      const map = new Map([[objKey, `value1`]])
-      const { proxy, getChanges } = createChangeProxy({ map })
-
-      const newObjKey = { id: 2 }
-      proxy.map.set(newObjKey, `value2`)
-
-      const changes = getChanges()
-      expect(changes.map.get(newObjKey)).toBe(`value2`)
-      expect(map.get(newObjKey)).toBeUndefined()
-    })
-
-    it(`should track Set add and delete operations`, () => {
-      const set = new Set([1, 2, 3])
-      const { proxy, getChanges } = createChangeProxy({ set })
-
-      proxy.set.add(4)
-      proxy.set.delete(2)
-
-      expect(getChanges()).toEqual({
-        set: new Set([1, 3, 4]),
-      })
-      expect(set.has(4)).toBe(false)
-      expect(set.has(2)).toBe(true)
-    })
-
-    it(`should handle iteration over collections during modification`, () => {
-      const map = new Map([
-        [`key1`, `value1`],
-        [`key2`, `value2`],
-      ])
-      const { proxy, getChanges } = createChangeProxy({ map })
-
-      // Modify during iteration
-      for (const [key] of proxy.map) {
-        proxy.map.set(key, `modified`)
-      }
-
-      expect(getChanges()).toEqual({
-        map: new Map([
-          [`key1`, `modified`],
-          [`key2`, `modified`],
-        ]),
-      })
-      expect(map.get(`key1`)).toBe(`value1`)
-      expect(map.get(`key2`)).toBe(`value2`)
-    })
-  })
-
-  describe(`createArrayChangeProxy`, () => {
-    it(`should track changes to an array of objects`, () => {
-      const objs = [
-        { id: 1, name: `John` },
-        { id: 2, name: `Jane` },
-      ]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Make changes to the proxies
-      // @ts-expect-error ok possibly undefined
-      proxies[0].name = `Johnny`
-      // @ts-expect-error ok possibly undefined
-      proxies[1].name = `Janet`
-
-      // Check that the changes are tracked
-      expect(getChanges()).toEqual([{ name: `Johnny` }, { name: `Janet` }])
-
-      // Check that the original objects are not modified
-      expect(objs).toEqual([
-        { id: 1, name: `John` },
-        { id: 2, name: `Jane` },
-      ])
-    })
-
-    it(`should track when items are added to arrays`, () => {
-      const obj = {
-        items: [`apple`, `banana`],
-      }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.items = [...obj.items, `cherry`]
-
-      expect(getChanges()).toEqual({
-        items: [`apple`, `banana`, `cherry`],
-      })
-      expect(obj.items).toEqual([`apple`, `banana`])
-    })
-
-    it(`should track array pop() operations`, () => {
-      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call pop() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.pop()
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`apple`, `banana`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
-    })
-
-    it(`should track array shift() operations`, () => {
-      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call shift() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.shift()
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`banana`, `cherry`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
-    })
-
-    it(`should track array unshift() operations`, () => {
-      const objs = [{ items: [`banana`, `cherry`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call unshift() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.unshift(`apple`)
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`apple`, `banana`, `cherry`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`banana`, `cherry`])
-    })
-
-    it(`should track array push() operations`, () => {
-      const obj = { items: [`apple`, `banana`] }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      proxy.items.push(`cherry`)
-
-      expect(getChanges()).toEqual({
-        items: [`apple`, `banana`, `cherry`],
-      })
-      expect(obj.items).toEqual([`apple`, `banana`])
-    })
-
-    it(`should track array splice() operations`, () => {
-      const objs = [{ items: [`apple`, `banana`, `cherry`, `date`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call splice() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.splice(1, 2, `blueberry`, `cranberry`)
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`apple`, `blueberry`, `cranberry`, `date`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`, `date`])
-    })
-
-    it(`should track array sort() operations`, () => {
-      const objs = [{ items: [`cherry`, `apple`, `banana`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call sort() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.sort()
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`apple`, `banana`, `cherry`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`cherry`, `apple`, `banana`])
-    })
-
-    it(`should track array reverse() operations`, () => {
-      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call reverse() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.reverse()
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`cherry`, `banana`, `apple`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
-    })
-
-    it(`should track array fill() operations`, () => {
-      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call fill() method directly
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.fill(`orange`, 1, 3)
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`apple`, `orange`, `orange`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
-    })
-
-    it(`should track array copyWithin() operations`, () => {
-      const objs = [
-        { items: [`apple`, `banana`, `cherry`, `date`, `elderberry`] },
-      ]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Call copyWithin() method directly - copy elements from index 3-4 to index 0-1
-      // @ts-expect-error ok possibly undefined
-      proxies[0].items.copyWithin(0, 3, 5)
-
-      expect(getChanges()).toEqual([
-        {
-          items: [`date`, `elderberry`, `cherry`, `date`, `elderberry`],
-        },
-      ])
-      // @ts-expect-error ok possibly undefined
-      expect(objs[0].items).toEqual([
-        `apple`,
-        `banana`,
-        `cherry`,
-        `date`,
-        `elderberry`,
-      ])
-    })
-
-    it(`should track changes in multi-dimensional arrays`, () => {
-      const objs = [
-        {
-          matrix: [
-            [1, 2],
-            [3, 4],
-          ],
-        },
-      ]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Update a nested array
-      // @ts-expect-error ok possibly undefined
-      const newMatrix = [...proxies[0].matrix]
-      newMatrix[0] = [5, 6]
-      // @ts-expect-error ok possibly undefined
-      proxies[0].matrix = newMatrix
-
-      expect(getChanges()).toEqual([
-        {
-          matrix: [
-            [5, 6],
-            [3, 4],
-          ],
-        },
-      ])
-      if (objs[0]) {
-        expect(objs[0].matrix).toEqual([
-          [1, 2],
-          [3, 4],
-        ])
-      }
-    })
-
-    it(`should handle objects containing arrays as properties`, () => {
-      const objs = [
-        {
-          user: {
-            name: `John`,
-            hobbies: [`reading`, `swimming`],
-          },
-        },
-      ]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Update the array within the nested object
-      // @ts-expect-error ok for test.
-      const updatedUser = { ...proxies[0].user }
-      updatedUser.hobbies = [...updatedUser.hobbies, `cycling`]
-      // @ts-expect-error ok for test.
-      proxies[0].user = updatedUser
-
-      expect(getChanges()).toEqual([
-        {
-          user: {
-            name: `John`,
-            hobbies: [`reading`, `swimming`, `cycling`],
-          },
-        },
-      ])
-      if (objs[0]) {
-        expect(objs[0].user.hobbies).toEqual([`reading`, `swimming`])
-      }
-    })
-
-    it(`should handle Temporal objects correctly`, () => {
-      const zonedDateTime = Temporal.Now.zonedDateTimeISO()
-      const plainDate = Temporal.PlainDate.from(`2024-01-15`)
-      const duration = Temporal.Duration.from({ hours: 2, minutes: 30 })
-
-      const obj = {
-        appointment: {
-          date: zonedDateTime,
-          reminder: plainDate,
-          duration: duration,
-        },
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify the temporal objects
-      proxy.appointment = {
-        date: Temporal.Now.zonedDateTimeISO(),
-        reminder: Temporal.PlainDate.from(`2024-01-16`),
-        duration: Temporal.Duration.from({ hours: 3 }),
-      }
-
-      const changes = getChanges()
-
-      // The changed values should be proper Temporal objects, not empty objects
-      expect(changes.appointment.date).toBeInstanceOf(Temporal.ZonedDateTime)
-      expect(changes.appointment.reminder).toBeInstanceOf(Temporal.PlainDate)
-      expect(changes.appointment.duration).toBeInstanceOf(Temporal.Duration)
-
-      // Original should be unchanged
-      expect(obj.appointment.date).toEqual(zonedDateTime)
-      expect(obj.appointment.reminder).toEqual(plainDate)
-      expect(obj.appointment.duration).toEqual(duration)
-    })
-
-    it(`should handle Set and Map objects`, () => {
-      const set = new Set([1, 2, 3])
-      const map = new Map([
-        [`key1`, `value1`],
-        [`key2`, `value2`],
-      ])
-
-      const objs = [
-        {
-          collections: {
-            set,
-            map,
-          },
-        },
-      ]
-      const { proxies, getChanges } = createArrayChangeProxy(objs)
-
-      // Create new collections with modifications
-      const newSet = new Set([...set, 4])
-      const newMap = new Map([...map, [`key3`, `value3`]])
-
-      if (proxies[0]) {
-        proxies[0].collections = {
-          set: newSet,
-          map: newMap,
-        }
-      }
-
-      expect(getChanges()).toEqual([
-        {
-          collections: {
-            set: newSet,
-            map: newMap,
-          },
-        },
-      ])
-      if (objs[0]) {
-        expect(objs[0].collections.set).toEqual(set)
-        expect(objs[0].collections.map).toEqual(map)
-      }
-    })
-  })
-
-  describe(`withChangeTracking`, () => {
-    it(`should track changes made in the callback`, () => {
-      const obj = { name: `John`, age: 30 }
-
-      const changes = withChangeTracking(obj, (proxy) => {
-        proxy.name = `Jane`
-        proxy.age = 31
-      })
-
-      // Check that the changes are tracked
-      expect(changes).toEqual({
-        name: `Jane`,
-        age: 31,
-      })
-
-      // Check that the original object is not modified
-      expect(obj).toEqual({
-        name: `John`,
-        age: 30,
-      })
-    })
-  })
-
-  describe(`withArrayChangeTracking`, () => {
-    it(`should track changes made to multiple objects in the callback`, () => {
-      const objs = [
-        { id: 1, name: `John` },
-        { id: 2, name: `Jane` },
-      ]
-
-      const changes = withArrayChangeTracking(objs, (proxies) => {
-        if (proxies[0] && proxies[1]) {
-          proxies[0].name = `Johnny`
-          proxies[1].name = `Janet`
-        }
-      })
-
-      // Check that the changes are tracked
-      expect(changes).toEqual([{ name: `Johnny` }, { name: `Janet` }])
-
-      // Check that the original objects are modified
-      expect(objs).toEqual([
-        { id: 1, name: `John` },
-        { id: 2, name: `Jane` },
-      ])
-    })
-
-    it(`should handle empty changes`, () => {
-      const objs = [
-        { id: 1, name: `John` },
-        { id: 2, name: `Jane` },
-      ]
-
-      const changes = withArrayChangeTracking(objs, () => {
-        // No changes made
-      })
-
-      // No changes should be tracked
-      expect(changes).toEqual([{}, {}])
-
-      // Original objects should remain unchanged
-      expect(objs).toEqual([
-        { id: 1, name: `John` },
-        { id: 2, name: `Jane` },
-      ])
-    })
-  })
-
-  describe(`Proxy revocation and cleanup`, () => {
-    it(`should handle accessing proxies after tracking function completes`, () => {
-      const obj = { name: `John`, age: 30 }
-      const changes = withChangeTracking(obj, (proxy) => {
-        proxy.name = `Jane`
-      })
-
-      expect(changes).toEqual({ name: `Jane` })
-      expect(obj.name).toBe(`John`)
-    })
-
-    it(`should handle nested proxy access after tracking`, () => {
-      const obj = { user: { name: `John`, age: 30 } }
-      const changes = withChangeTracking(obj, (proxy) => {
-        proxy.user.name = `Jane`
-      })
-
-      expect(changes).toEqual({
-        user: { name: `Jane`, age: 30 },
-      })
-      expect(obj.user.name).toBe(`John`)
-    })
-  })
-
-  describe(`Advanced Proxy Change Detection`, () => {
-    describe(`Structural Sharing and Equality Detection`, () => {
-      it(`should return the original object when changes are reverted`, () => {
-        const obj = { name: `John`, age: 30 }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        // Make changes
-        proxy.name = `Jane`
-        // Revert changes
-        proxy.name = `John`
-
-        // No changes should be tracked
-        expect(getChanges()).toEqual({})
-      })
-
-      it(`should handle Maps that have items added and then removed`, () => {
-        const map = new Map([[`key1`, `value1`]])
-        const obj = { myMap: map }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        // Create a new map with an added item
-        const modifiedMap = new Map(map)
-        modifiedMap.set(`key2`, `value2`)
-        proxy.myMap = modifiedMap
-
-        // Create a new map that's identical to the original
-        const revertedMap = new Map([[`key1`, `value1`]])
-        proxy.myMap = revertedMap
-
-        // No changes should be tracked since final state matches initial state
-        expect(getChanges()).toEqual({})
-      })
-
-      it(`should handle restoring original references to nested objects`, () => {
-        const nestedObj = { value: 42 }
-        const obj = { nested: nestedObj, other: `data` }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        // Replace with different object
-        proxy.nested = { value: 100 }
-
-        // Restore original reference
-        proxy.nested = nestedObj
-
-        // No changes should be tracked for nested
-        expect(getChanges()).toEqual({})
-      })
-    })
-  })
-
-  describe(`Deep Nested Reverts`, () => {
-    it(`should correctly detect when a deeply nested property is reverted to original value`, () => {
-      const obj = { nested: { count: 10 } }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Make a change to a deep nested property
-      proxy.nested.count = 5
-
-      expect(proxy.nested.count).toEqual(5)
-      // Verify changes are tracked
-      expect(getChanges()).toEqual({
-        nested: { count: 5 },
-      })
-
-      // Revert back to original value
-      proxy.nested.count = 10
-
-      // Verify no changes are reported
-      expect(getChanges()).toEqual({})
-
-      // Original object should be unchanged
-      expect(obj).toEqual({ nested: { count: 10 } })
-    })
-
-    it(`should correctly handle complex nested object reverts`, () => {
-      const obj = {
-        user: {
-          profile: {
-            name: `John`,
-            settings: {
-              theme: `dark`,
-              notifications: true,
-            },
-          },
-          stats: {
-            visits: 10,
-          },
-        },
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Make changes at different levels
-      proxy.user.profile.name = `Jane`
-      proxy.user.profile.settings.theme = `light`
-      proxy.user.stats.visits = 15
-
-      // Verify all changes are tracked
-      expect(getChanges()).toEqual({
-        user: {
-          profile: {
-            name: `Jane`,
-            settings: {
-              theme: `light`,
-              notifications: true,
-            },
-          },
-          stats: {
-            visits: 15,
-          },
-        },
-      })
-
-      // Revert changes one by one
-      proxy.user.profile.name = `John`
-
-      // Should still show other changes
-      expect(Object.keys(getChanges()).length).toBeGreaterThan(0)
-      expect(getChanges()).toEqual({
-        user: {
-          profile: {
-            name: `John`,
-            settings: { theme: `light`, notifications: true },
-          },
-          stats: { visits: 15 },
-        },
-      })
-
-      proxy.user.profile.settings.theme = `dark`
-
-      // Should still show other changes
-      expect(Object.keys(getChanges()).length).toBeGreaterThan(0)
-      expect(getChanges()).toEqual({
-        user: {
-          profile: {
-            name: `John`,
-            settings: { theme: `dark`, notifications: true },
-          },
-          stats: { visits: 15 },
-        },
-      })
-
-      // Revert final change
-      proxy.user.stats.visits = 10
-
-      // No changes should be reported
-      expect(getChanges()).toEqual({})
-    })
-  })
-
-  describe(`Array Edge Cases`, () => {
-    // it(`should track array length changes through truncation`, () => {
-    //   const arr = [1, 2, 3, 4, 5]
-    //   const { proxy, getChanges } = createChangeProxy({ arr })
-    //
-    //   proxy.arr.length = 3
-    //
-    //   expect(getChanges()).toEqual({
-    //     arr: [1, 2, 3],
-    //   })
-    //   expect(arr.length).toBe(3)
-    //   expect(arr).toEqual([1, 2, 3, 4, 5])
-    // })
-
-    it(`should handle sparse arrays`, () => {
-      const arr = [1, 2, 3, 4, 5]
-      const { proxy, getChanges } = createChangeProxy({ arr })
-
-      delete proxy.arr[2]
-
-      expect(getChanges()).toEqual({
-        // eslint-disable-next-line no-sparse-arrays -- the deleted index is a hole
-        arr: [1, 2, , 4, 5],
-      })
-      expect(2 in arr).toBe(true)
-      expect(arr.length).toBe(5)
-    })
-
-    it(`should handle out-of-bounds array assignments`, () => {
-      const arr = [1, 2, 3]
-      const { proxy, getChanges } = createChangeProxy({ arr })
-
-      proxy.arr[5] = 6
-
-      expect(getChanges()).toEqual({
-        arr: [1, 2, 3, undefined, undefined, 6],
-      })
-      expect(arr.length).toBe(3)
-    })
-  })
-
-  describe(`Object.defineProperty and Meta Operations`, () => {
-    it(`should track changes made through Object.defineProperty`, () => {
-      const obj: { name: string; age?: number } = { name: `John` }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      Object.defineProperty(proxy, `age`, {
-        value: 30,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
-
-      expect(getChanges()).toEqual({
-        age: 30,
-      })
-      expect(obj.age).toBeUndefined()
-    })
-
-    // it.only(`should prevent prototype pollution`, () => {
-    //   const obj = { constructor: { prototype: {} } }
-    //   const { proxy } = createChangeProxy(obj)
-    //
-    //   // Attempt to modify Object.prototype through the proxy
-    //   // @ts-expect-error ignore for test
-    //   proxy.__proto__ = { malicious: true }
-    //   // @ts-expect-error ignore for test
-    //   proxy.constructor.prototype.malicious = true
-    //
-    //   // Verify that Object.prototype wasn't polluted
-    //   // @ts-expect-error ignore for test
-    //   expect({}.malicious).toBeUndefined()
-    //   // @ts-expect-error ignore for test
-    //   expect(Object.prototype.malicious).toBeUndefined()
-    //
-    //   // The changes should only affect the proxy's own prototype chain
-    //   // @ts-expect-error ignore for test
-    //   expect(proxy.__proto__.malicious).toBe(true)
-    //   // @ts-expect-error ignore for test
-    //   expect(proxy.constructor.prototype.malicious).toBe(true)
-    // })
-  })
-
-  describe(`Optimization Cases`, () => {
-    it(`should not track changes when setting to the same value`, () => {
-      const obj = { name: `John`, age: 30, scores: [1, 2, 3] }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Set to same primitive value
-      proxy.name = `John`
-      proxy.age = 30
-
-      // Set to same array value
-      proxy.scores = [1, 2, 3]
-
-      // Should have no changes
-      expect(getChanges()).toEqual({})
-    })
-
-    it(`should not track changes when modifying and reverting`, () => {
-      const obj = { name: `John`, nested: { count: 5 } }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify and revert primitive
-      proxy.name = `Jane`
-      proxy.name = `John`
-
-      // Modify and revert nested
-      proxy.nested.count = 10
-      proxy.nested.count = 5
-
-      // The object shouldn't be mutated.
-      expect(obj.name).toEqual(`John`)
-      expect(obj.nested.count).toEqual(5)
-
-      // Should have no changes
-      expect(getChanges()).toEqual({})
-    })
-
-    it(`should efficiently handle repeated changes to the same property`, () => {
-      const obj = { count: 0 }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Make many changes to the same property
-      for (let i = 0; i < 10000; i++) {
-        proxy.count = i
-      }
-
-      // Should only track the final change
-      expect(getChanges()).toEqual({ count: 9999 })
-    })
-  })
-
-  describe(`TypedArray Support`, () => {
-    it(`should track changes to TypedArrays`, () => {
-      const obj = {
-        int8: new Int8Array([1, 2, 3]),
-        uint8: new Uint8Array([4, 5, 6]),
-        float32: new Float32Array([1.1, 2.2, 3.3]),
-      }
-
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Modify values
-      proxy.int8[0] = 10
-      proxy.uint8[1] = 50
-      proxy.float32[2] = 33.3
-
-      const changes = getChanges()
-      expect(changes.int8[0]).toBe(10)
-      expect(changes.uint8[1]).toBe(50)
-      expect(changes.float32[2]).toBeCloseTo(33.3)
-
-      // Verify original object was modified
-      expect(obj.int8[0]).toBe(1)
-      expect(obj.uint8[1]).toBe(5)
-      expect(obj.float32[2]).toBeCloseTo(3.3)
-    })
-
-    it(`should handle replacing entire TypedArrays`, () => {
-      const obj = { data: new Uint8Array([1, 2, 3]) }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Replace entire array
-      proxy.data = new Uint8Array([4, 5, 6])
-
-      const changes = getChanges()
-      expect(changes.data instanceof Uint8Array).toBe(true)
-      expect(Array.from(changes.data)).toEqual([4, 5, 6])
-
-      // Verify original was not modified
-      expect(Array.from(obj.data)).toEqual([1, 2, 3])
-    })
-
-    it(`should detect when TypedArray values are the same`, () => {
-      const obj = { data: new Uint8Array([1, 2, 3]) }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Set to same values
-      proxy.data = new Uint8Array([1, 2, 3])
-
-      // Should have no changes
-      expect(getChanges()).toEqual({})
-    })
-  })
-
-  describe(`Shallow Copy Handling`, () => {
-    it(`should properly handle Array shallow copies`, () => {
-      const obj = { items: [1, 2, 3] }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Replace the array instead of modifying it to ensure changes are tracked
-      proxy.items = [1, 2, 3, 4]
-
-      expect(getChanges()).toEqual({
-        items: [1, 2, 3, 4],
-      })
-      expect(obj.items).toEqual([1, 2, 3])
-    })
-
-    it(`should properly handle RegExp shallow copies`, () => {
-      const obj = { pattern: /test/i }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      // Replace with a new RegExp to trigger shallow copy
-      proxy.pattern = /modified/g
-
-      expect(getChanges()).toEqual({
-        pattern: /modified/g,
-      })
-      expect(obj.pattern).toEqual(/test/i)
-      expect(obj.pattern.flags).toBe(`i`)
-      expect(obj.pattern.source).toBe(`test`)
-    })
-
-    it(`should handle primitive values directly`, () => {
-      // Test with a primitive value
-      const primitiveObj = { value: 42 }
-      const { proxy: primitiveProxy, getChanges: getPrimitiveChanges } =
-        createChangeProxy(primitiveObj)
-
-      primitiveProxy.value = 100
-
-      expect(getPrimitiveChanges()).toEqual({
-        value: 100,
-      })
-      expect(primitiveObj.value).toBe(42)
-    })
-
-    it(`should handle Date objects correctly`, () => {
-      const originalDate = new Date(`2023-01-01T00:00:00Z`)
-      const obj = { date: originalDate }
-      const { proxy, getChanges } = createChangeProxy(obj)
-
-      const newDate = new Date(`2024-01-01T00:00:00Z`)
-      proxy.date = newDate
-
-      expect(getChanges()).toEqual({
-        date: newDate,
-      })
-      expect(obj.date).toEqual(originalDate)
-    })
-
-    describe(`array iteration methods`, () => {
-      it(`should track changes when modifying array items retrieved via find()`, () => {
-        const obj = {
-          job: {
-            orders: [
-              { orderId: `order-1`, orderBinInt: 1 },
-              { orderId: `order-2`, orderBinInt: 2 },
-            ],
-          },
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        // Use find() to get an array item and modify it
-        const order = proxy.job.orders.find((o) => o.orderId === `order-1`)
-        if (order) {
-          order.orderBinInt = 99
-        }
-
-        const changes = getChanges()
-        expect(Object.keys(changes).length).toBeGreaterThan(0)
-        expect(changes.job?.orders?.[0]?.orderBinInt).toBe(99)
-        expect(changes).toEqual({
-          job: {
-            orders: [
-              { orderId: `order-1`, orderBinInt: 99 },
-              { orderId: `order-2`, orderBinInt: 2 },
-            ],
-          },
-        })
-        expect(obj).toEqual({
-          job: {
-            orders: [
-              { orderId: `order-1`, orderBinInt: 1 },
-              { orderId: `order-2`, orderBinInt: 2 },
-            ],
-          },
-        })
-      })
-
-      it(`should track changes when modifying array items via forEach`, () => {
-        const obj = {
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        const visits: Array<number> = []
-        const result = proxy.items.forEach((item) => {
-          visits.push(item.id)
-          item.value = item.value * 2
-        })
-
-        const changes = getChanges()
-        expect(Object.keys(changes).length).toBeGreaterThan(0)
-        expect(result).toBeUndefined()
-        expect(visits).toEqual([1, 2])
-        expect(changes).toEqual({
-          items: [
-            { id: 1, value: 20 },
-            { id: 2, value: 40 },
-          ],
-        })
-        expect(obj).toEqual({
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        })
-      })
-
-      it(`should track changes when modifying array items via for...of`, () => {
-        const obj = {
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        for (const item of proxy.items) {
-          item.value = item.value * 2
-        }
-
-        const changes = getChanges()
-        expect(Object.keys(changes).length).toBeGreaterThan(0)
-        expect(changes).toEqual({
-          items: [
-            { id: 1, value: 20 },
-            { id: 2, value: 40 },
-          ],
-        })
-        expect(obj).toEqual({
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        })
-      })
-
-      it(`should track changes when modifying array items via index access`, () => {
-        const obj = {
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        // Direct index access should work
-        const firstItem = proxy.items[0]
-        if (firstItem) {
-          firstItem.value = 100
-        }
-
-        const changes = getChanges()
-        expect(Object.keys(changes).length).toBeGreaterThan(0)
-        expect(changes).toEqual({
-          items: [
-            { id: 1, value: 100 },
-            { id: 2, value: 20 },
-          ],
-        })
-        expect(obj).toEqual({
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        })
-      })
-
-      it(`should track changes when modifying items from filter() result`, () => {
-        const obj = {
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        const filtered = proxy.items.filter((item) => item.id === 1)
-        const first = filtered[0]
-        if (first) {
-          first.value = 42
-        }
-
-        const changes = getChanges()
-        expect(changes.items?.[0]?.value).toBe(42)
-        expect(filtered.map((item) => item.id)).toEqual([1])
-        expect(changes).toEqual({
-          items: [
-            { id: 1, value: 42 },
-            { id: 2, value: 20 },
-          ],
-        })
-        expect(obj).toEqual({
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        })
-      })
-
-      it(`should track changes when modifying array items retrieved via findLast()`, () => {
-        const obj = {
-          job: {
-            orders: [
-              { orderId: `order-1`, orderBinInt: 1 },
-              { orderId: `order-2`, orderBinInt: 2 },
-            ],
-          },
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        // Use type assertion to call findLast (ES2023 method)
-        type Order = { orderId: string; orderBinInt: number }
-        const orders = proxy.job.orders as unknown as {
-          findLast: (predicate: (o: Order) => boolean) => Order | undefined
-        }
-        const order = orders.findLast((o) => o.orderId.startsWith(`order-`))
-        if (order) {
-          order.orderBinInt = 123
-        }
-
-        const changes = getChanges()
-        expect(changes.job?.orders?.[1]?.orderBinInt).toBe(123)
-        expect(changes).toEqual({
-          job: {
-            orders: [
-              { orderId: `order-1`, orderBinInt: 1 },
-              { orderId: `order-2`, orderBinInt: 123 },
-            ],
-          },
-        })
-        expect(obj).toEqual({
-          job: {
-            orders: [
-              { orderId: `order-1`, orderBinInt: 1 },
-              { orderId: `order-2`, orderBinInt: 2 },
-            ],
-          },
-        })
-      })
-
-      it(`should track changes when modifying array items inside some() callback`, () => {
-        const obj = {
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        const visits: Array<number> = []
-        const result = proxy.items.some((item) => {
-          visits.push(item.id)
-          item.value = item.value * 2
-          return false
-        })
-
-        const changes = getChanges()
-        expect(changes.items?.[0]?.value).toBe(20)
-        expect(changes.items?.[1]?.value).toBe(40)
-        expect(result).toBe(false)
-        expect(visits).toEqual([1, 2])
-        expect(changes).toEqual({
-          items: [
-            { id: 1, value: 20 },
-            { id: 2, value: 40 },
-          ],
-        })
-        expect(obj).toEqual({
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        })
-      })
-
-      it(`should track changes when modifying array items inside reduce() callback`, () => {
-        const obj = {
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        }
-        const { proxy, getChanges } = createChangeProxy(obj)
-
-        const visits: Array<number> = []
-        const result = proxy.items.reduce((acc, item) => {
-          visits.push(item.id)
-          item.value = item.value + 1
-          return acc + item.value
-        }, 0)
-
-        const changes = getChanges()
-        expect(changes.items?.[0]?.value).toBe(11)
-        expect(changes.items?.[1]?.value).toBe(21)
-        expect(result).toBe(32)
-        expect(visits).toEqual([1, 2])
-        expect(changes).toEqual({
-          items: [
-            { id: 1, value: 11 },
-            { id: 2, value: 21 },
-          ],
-        })
-        expect(obj).toEqual({
-          items: [
-            { id: 1, value: 10 },
-            { id: 2, value: 20 },
-          ],
-        })
-      })
-    })
-  })
-})
-
-// A function stored as data is a value like any other. Reading it from a draft
-// must give back the stored function, by any read path, as the native row
-// does. Calling a stored method must see the draft as `this`, so its writes are
-// tracked. Inherited methods (Array, Map, and Set methods) are not data and
-// keep their own draft handling.
-describe(`stored functions behave like native values`, () => {
-  type Row = {
-    handler: () => number
-    fns: Array<() => number>
-    obj: { g: () => number; count: number; bump: () => unknown }
-    m: Map<string, () => number>
-    s: Set<() => number>
-  }
-  const make = (f: () => number, f2: () => number): Row => ({
-    handler: f,
-    fns: [f, f2],
-    obj: {
-      g: f,
-      count: 0,
-      bump() {
-        this.count++
-        return this
-      },
-    },
-    m: new Map([[`k`, f]]),
-    s: new Set([f]),
-  })
-
-  // Each probe returns an observation that must be the same for a native row
-  // and for a draft of an equal row.
-  const probes: Array<[string, (row: Row, f: () => number) => unknown]> = [
-    [`field access`, (row, f) => row.handler === f],
-    [`array index`, (row, f) => row.fns[0] === f],
-    [
-      `for...of`,
-      (row, f) => {
-        for (const fn of row.fns) return fn === f
-        return undefined
-      },
-    ],
-    [`spread`, (row, f) => [...row.fns][0] === f],
-    [
-      `includes and indexOf`,
-      (row, f) => [row.fns.includes(f), row.fns.indexOf(f)],
-    ],
-    [`array callback`, (row, f) => row.fns.map((fn) => fn === f)],
-    [`nested field`, (row, f) => row.obj.g === f],
-    [`Object.values`, (row, f) => Object.values(row.obj).includes(f)],
-    [`Map value`, (row, f) => row.m.get(`k`) === f],
-    [`Set member`, (row, f) => [...row.s][0] === f && row.s.has(f)],
-    [`calling a stored function`, (row) => row.handler()],
-    [
-      `a function assigned during the callback`,
-      (row, f) => {
-        const assigned = row as Row & { added?: () => number }
-        assigned.added = f
-        return assigned.added === f
-      },
-    ],
-    [
-      `a stored method sees its object as this`,
-      (row) => row.obj.bump() === row.obj,
-    ],
-    [
-      `a detached stored method has no this`,
-      (row) => {
-        const { bump } = row.obj
-        try {
-          bump()
-          return `returned`
-        } catch (error) {
-          return (error as Error).constructor.name
-        }
-      },
-    ],
-    [
-      `an inherited constructor`,
-      (row) => [
-        row.constructor === Object,
-        row.fns.constructor === Array,
-        row.m.constructor === Map,
-        row.s.constructor === Set,
-      ],
-    ],
-  ]
-
-  it.each(probes)(`%s gives the native result`, (_name, probe) => {
-    const f = () => 1
-    const f2 = () => 2
-    const native = probe(make(f, f2), f)
-    const { proxy } = createChangeProxy(make(f, f2))
-    expect(probe(proxy, f)).toEqual(native)
-  })
-
-  it(`tracks writes a stored method makes through this`, () => {
-    const native = make(
-      () => 1,
-      () => 2,
-    )
-    native.obj.bump()
-    const { proxy, getChanges } = createChangeProxy(
-      make(
-        () => 1,
-        () => 2,
-      ),
-    )
-    proxy.obj.bump()
-    expect(proxy.obj.count).toBe(native.obj.count)
-    const changes = getChanges() as Partial<Row>
-    expect(Object.keys(changes)).toEqual([`obj`])
-    expect(changes.obj?.count).toBe(1)
-  })
-})
-
-/**
- * `Object.defineProperty` on a draft defines the property as on a native row:
- * the same result, value, and descriptor. A defined enumerable value is a
- * change.
- */
-describe(`defineProperty behaves like on a native row`, () => {
-  type Row = Record<string, unknown>
-  const make = (): Row => ({ a: 1, nested: { b: 2 } })
-  // One getter for both rows, so their descriptors compare equal.
-  const getTwo = () => 2
-  const definitions: Array<
-    [string, (row: Row) => PropertyDescriptor & { key: string }]
-  > = [
-    [`a new key with only a value`, () => ({ key: `k`, value: 5 })],
-    [`an existing key with only a value`, () => ({ key: `a`, value: 5 })],
-    [
-      `an existing key made read-only`,
-      () => ({ key: `a`, value: 6, writable: false }),
-    ],
-    [
-      `a new enumerable writable key`,
-      () => ({
-        key: `k`,
-        value: 7,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      }),
-    ],
-    [`an object value`, () => ({ key: `a`, value: { c: 3 }, writable: false })],
-    [`a nested key`, () => ({ key: `nested`, value: { b: 3 } })],
-    [
-      `a new key with only an object value`,
-      () => ({ key: `k`, value: { c: 3 } }),
-    ],
-    [`a getter over an existing key`, () => ({ key: `a`, get: getTwo })],
-    [
-      `a new enumerable getter`,
-      () => ({ key: `k`, get: getTwo, enumerable: true, configurable: true }),
-    ],
-  ]
-  const observe = (
-    row: Row,
-    define: (row: Row) => PropertyDescriptor & { key: string },
-  ) => {
-    const { key, ...descriptor } = define(row)
-    const defined = Reflect.defineProperty(row, key, descriptor)
-    const { value, ...rest } = Object.getOwnPropertyDescriptor(row, key) ?? {}
-    // A read-only, non-configurable property must read back as defined.
-    const fixed = rest.configurable === false && rest.writable === false
-    const same = fixed ? row[key] === descriptor.value : undefined
-    return {
-      same,
-      defined,
-      value: JSON.stringify(value),
-      rest,
-      read: JSON.stringify(row[key]),
-    }
-  }
-
-  it.each(definitions)(`%s`, (_name, define) => {
-    const native = make()
-    const expected = observe(native, define)
-    const { proxy, getChanges } = createChangeProxy(make())
-    expect(observe(proxy, define)).toEqual(expected)
-    // Like a clone, changes hold enumerable string keys only, with the value
-    // the native row now reads.
-    const { key } = define(proxy)
-    const enumerable = expected.rest.enumerable === true
-    expect(getChanges()).toEqual(enumerable ? { [key]: native[key] } : {})
-  })
-})
+})
 
 /**
  * Freezing, sealing, or fixing a key of a draft must not lose a later write
@@ -2656,8 +564,8 @@ describe(`defineProperty behaves like on a native row`, () => {
  * original must give the native row.
  */
 describe(`frozen and sealed drafts keep nested writes`, () => {
-  type Row = { n: { x: number }; m: number }
-  const make = (): Row => ({ n: { x: 1 }, m: 1 })
+  type Row = FrozenRow
+  const make = makeFrozenRow
   const histories: Array<[string, (row: Row) => void]> = [
     [
       `freeze, then a nested write`,
@@ -2686,56 +594,22 @@ describe(`frozen and sealed drafts keep nested writes`, () => {
     ],
   ]
 
-  it.each(histories)(`%s gives the native row`, (_name, run) => {
+  // The native model: the row that a plain object gives after the history.
+  function expectNativeRowAfter(run: (row: Row) => void) {
     const native = make()
     run(native)
     const { proxy, getChanges } = createChangeProxy(make())
     run(proxy)
     expect({ ...make(), ...getChanges() }).toEqual({ ...native })
-  })
+  }
+  declareOracle({ check: [expectNativeRowAfter] })
 
-  it(`does not count a primitive read under a frozen key`, () => {
-    const { proxy, getChanges } = createChangeProxy(make())
-    void Object.freeze(proxy).m
-    expect(getChanges()).toEqual({})
+  it.each(histories)(`%s gives the native row`, (_name, run) => {
+    expectNativeRowAfter(run)
   })
 
   // The boundary is a read-only and non-configurable key. A sealed key is
   // non-configurable but writable, and a read-only key may stay configurable.
   // Either way the draft hands out a draft, so a read is no change. These
   // cases reject a boundary that checks only one of the two attributes.
-  it.each([
-    [`sealed`, (row: Row) => Object.seal(row)],
-    [
-      `read-only but configurable`,
-      (row: Row) =>
-        Object.defineProperty(row, `n`, {
-          writable: false,
-          configurable: true,
-        }),
-    ],
-  ])(`does not count an object read under a %s key`, (_name, fix) => {
-    const { proxy, getChanges } = createChangeProxy(make())
-    fix(proxy)
-    void proxy.n.x
-    expect(getChanges()).toEqual({})
-  })
-
-  it(`does not count writing back the row's own class instance`, () => {
-    class Point {
-      constructor(public x: number) {}
-    }
-    const row = { p: new Point(1) }
-    expect(
-      withChangeTracking(row, (draft) => {
-        draft.p = row.p
-      }),
-    ).toEqual({})
-    expect(
-      withChangeTracking(row, (draft) => {
-        draft.p = new Point(2)
-        draft.p = row.p
-      }),
-    ).toEqual({})
-  })
 })
diff --git a/packages/db/tests/proxy-revert-oracle.property.test.ts b/packages/db/tests/proxy-revert-oracle.property.test.ts
index 112964b051..31f420969e 100644
--- a/packages/db/tests/proxy-revert-oracle.property.test.ts
+++ b/packages/db/tests/proxy-revert-oracle.property.test.ts
@@ -1,11 +1,12 @@
 import { describe, expect, it as vitestIt } from 'vitest'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { createChangeProxy, withChangeTracking } from '../src/proxy'
+import { createChangeProxy } from '../src/proxy'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config'
+import { declareOracle } from './oracle-declaration'
 
 /**
  * # Which draft writes count as changes, and which count as reverts?
@@ -1418,6 +1419,12 @@ function expectNativeHistory(history: NativeHistory): void {
   expectNativeResult(history, driveNative(history))
 }
 
+declareOracle({
+  check: [expectHistory, expectNativeResult],
+  model: [step, expectedChanges, nativeModel],
+  grammar: [nativeHistoryArb],
+})
+
 describe(`draft revert oracle: native mutators mixed with assignments`, () => {
   it(`rejects an unwritten field in the change report`, () => {
     const histories: Array<NativeHistory> = [
@@ -1529,93 +1536,4 @@ describe(`draft revert oracle: native mutators mixed with assignments`, () => {
       },
     ],
   ])(`%s`, (_name, history) => expectNativeHistory(history))
-
-  // The generated row nests the native site two levels deep. One level more
-  // checks that a report three levels up still carries the final value.
-  it(`restoring a native write three levels deep reports at most the original value`, () => {
-    const row = { f: { h: { arr: [0] }, g: { a: 0 } } }
-    const changes = withChangeTracking(structuredClone(row), (draft) => {
-      draft.f.h.arr.pop()
-      draft.f.g = {} as { a: number }
-      draft.f.h.arr = [0]
-      draft.f.g.a = 0
-    })
-    expect(Object.keys(changes).every((key) => key === `f`)).toBe(true)
-    if (`f` in changes) expect(changes.f).toEqual(row.f)
-  })
-
-  // A native write through any handle that reaches the row's value is a
-  // change, and a missed change is the error that matters. These handles share
-  // their parent's value: a Map or Set value, a typed-array view, and a value
-  // read through a frozen draft.
-  it.each<[string, Record<string, unknown>, (draft: any) => void, string]>([
-    [
-      `a Map value`,
-      { m: new Map([[`k`, [1]]]) },
-      (draft) => draft.m.get(`k`).push(2),
-      `m`,
-    ],
-    [
-      `a Map value from iteration`,
-      { m: new Map([[`k`, [1]]]) },
-      (draft) => {
-        for (const value of draft.m.values()) value.push(2)
-      },
-      `m`,
-    ],
-    [
-      `a Set value from iteration`,
-      { s: new Set([[1]]) },
-      (draft) => {
-        for (const value of draft.s) value.push(2)
-      },
-      `s`,
-    ],
-    [
-      `a typed-array view`,
-      { t: new Float64Array([1, 2, 3]) },
-      (draft) => draft.t.subarray(1).fill(9),
-      `t`,
-    ],
-    [
-      `a value read through a frozen draft`,
-      { f: { arr: [1] } },
-      (draft) => Object.freeze(draft).f.arr.push(2),
-      `f`,
-    ],
-  ])(`reports a native write through %s`, (_name, row, write, key) => {
-    const changes = withChangeTracking(row, write)
-    expect(key in changes).toBe(true)
-  })
-
-  // A nested revert inside a Map or Set value must not hide another write to
-  // the same container.
-  it.each<[string, Record<string, unknown>, (draft: any) => void, string]>([
-    [
-      `a Map`,
-      { m: new Map<string, unknown>([[`k`, { a: 0 }]]) },
-      (draft) => {
-        draft.m.set(`j`, 1)
-        draft.m.get(`k`).a = 1
-        draft.m.get(`k`).a = 0
-      },
-      `m`,
-    ],
-    [
-      `a Set`,
-      { s: new Set<unknown>([{ a: 0 }]) },
-      (draft) => {
-        draft.s.add(1)
-        for (const value of draft.s) if (typeof value === `object`) value.a = 1
-        for (const value of draft.s) if (typeof value === `object`) value.a = 0
-      },
-      `s`,
-    ],
-  ])(
-    `a nested revert in %s keeps its other write`,
-    (_name, row, write, key) => {
-      const changes = withChangeTracking(row, write)
-      expect(key in changes).toBe(true)
-    },
-  )
 })
diff --git a/packages/db/tests/proxy-revert.test.ts b/packages/db/tests/proxy-revert.test.ts
new file mode 100644
index 0000000000..3e797b5c14
--- /dev/null
+++ b/packages/db/tests/proxy-revert.test.ts
@@ -0,0 +1,98 @@
+/**
+ * Ordinary draft-revert tests: hand-written native-write rows and their
+ * change reports. The revert law and its generated histories are owned by
+ * proxy-revert-oracle.property.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { withChangeTracking } from '../src/proxy'
+
+describe(`draft revert oracle: native mutators mixed with assignments`, () => {
+  // The generated row nests the native site two levels deep. One level more
+  // checks that a report three levels up still carries the final value.
+  it(`restoring a native write three levels deep reports at most the original value`, () => {
+    const row = { f: { h: { arr: [0] }, g: { a: 0 } } }
+    const changes = withChangeTracking(structuredClone(row), (draft) => {
+      draft.f.h.arr.pop()
+      draft.f.g = {} as { a: number }
+      draft.f.h.arr = [0]
+      draft.f.g.a = 0
+    })
+    expect(Object.keys(changes).every((key) => key === `f`)).toBe(true)
+    if (`f` in changes) expect(changes.f).toEqual(row.f)
+  })
+
+  // A native write through any handle that reaches the row's value is a
+  // change, and a missed change is the error that matters. These handles share
+  // their parent's value: a Map or Set value, a typed-array view, and a value
+  // read through a frozen draft.
+  it.each<[string, Record<string, unknown>, (draft: any) => void, string]>([
+    [
+      `a Map value`,
+      { m: new Map([[`k`, [1]]]) },
+      (draft) => draft.m.get(`k`).push(2),
+      `m`,
+    ],
+    [
+      `a Map value from iteration`,
+      { m: new Map([[`k`, [1]]]) },
+      (draft) => {
+        for (const value of draft.m.values()) value.push(2)
+      },
+      `m`,
+    ],
+    [
+      `a Set value from iteration`,
+      { s: new Set([[1]]) },
+      (draft) => {
+        for (const value of draft.s) value.push(2)
+      },
+      `s`,
+    ],
+    [
+      `a typed-array view`,
+      { t: new Float64Array([1, 2, 3]) },
+      (draft) => draft.t.subarray(1).fill(9),
+      `t`,
+    ],
+    [
+      `a value read through a frozen draft`,
+      { f: { arr: [1] } },
+      (draft) => Object.freeze(draft).f.arr.push(2),
+      `f`,
+    ],
+  ])(`reports a native write through %s`, (_name, row, write, key) => {
+    const changes = withChangeTracking(row, write)
+    expect(key in changes).toBe(true)
+  })
+
+  // A nested revert inside a Map or Set value must not hide another write to
+  // the same container.
+  it.each<[string, Record<string, unknown>, (draft: any) => void, string]>([
+    [
+      `a Map`,
+      { m: new Map<string, unknown>([[`k`, { a: 0 }]]) },
+      (draft) => {
+        draft.m.set(`j`, 1)
+        draft.m.get(`k`).a = 1
+        draft.m.get(`k`).a = 0
+      },
+      `m`,
+    ],
+    [
+      `a Set`,
+      { s: new Set<unknown>([{ a: 0 }]) },
+      (draft) => {
+        draft.s.add(1)
+        for (const value of draft.s) if (typeof value === `object`) value.a = 1
+        for (const value of draft.s) if (typeof value === `object`) value.a = 0
+      },
+      `s`,
+    ],
+  ])(
+    `a nested revert in %s keeps its other write`,
+    (_name, row, write, key) => {
+      const changes = withChangeTracking(row, write)
+      expect(key in changes).toBe(true)
+    },
+  )
+})
diff --git a/packages/db/tests/proxy.test.ts b/packages/db/tests/proxy.test.ts
new file mode 100644
index 0000000000..089fa33e6f
--- /dev/null
+++ b/packages/db/tests/proxy.test.ts
@@ -0,0 +1,2209 @@
+/**
+ * Ordinary draft-behavior tests for the proxy: hand-written expectations for
+ * reads, writes, reverts, frozen and sealed drafts, and array methods. The
+ * native-comparison laws (array callbacks, stored functions, property
+ * definitions, frozen history rows) are owned by proxy-oracle.test.ts.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { Temporal } from 'temporal-polyfill'
+import {
+  createArrayChangeProxy,
+  createChangeProxy,
+  withArrayChangeTracking,
+  withChangeTracking,
+} from '../src/proxy'
+import { makeFrozenRow, makeStoredRow } from './proxy-native-rows'
+import type { FrozenRow, StoredRow } from './proxy-native-rows'
+
+describe(`Proxy Library`, () => {
+  it.each([null, `true`])(
+    `tracks reads, writes and reverts without consulting DEBUG=%s`,
+    (debug) => {
+      const getItem = vi.fn(() => debug)
+      const log = vi.spyOn(console, `log`).mockImplementation(() => {})
+      vi.stubGlobal(`localStorage`, { getItem })
+      try {
+        const original = { value: 1, nested: { value: 2 } }
+        const { proxy, getChanges } = createChangeProxy(original)
+        expect(proxy.value).toBe(1)
+        proxy.value = 3
+        proxy.nested.value = 4
+        expect(getChanges()).toEqual({ value: 3, nested: { value: 4 } })
+        proxy.value = 1
+        proxy.nested.value = 2
+        expect(getChanges()).toEqual({})
+        expect(original).toEqual({ value: 1, nested: { value: 2 } })
+        expect(getItem).not.toHaveBeenCalled()
+        expect(log).not.toHaveBeenCalled()
+      } finally {
+        vi.unstubAllGlobals()
+        log.mockRestore()
+      }
+    },
+  )
+})
+
+describe(`Proxy Library`, () => {
+  describe(`createChangeProxy`, () => {
+    it(`should track changes to an object`, () => {
+      const obj = { name: `John`, age: 30 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Make changes to the proxy
+      proxy.name = `Jane`
+      proxy.age = 31
+
+      // Check that the changes are tracked
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+        age: 31,
+      })
+
+      // Check that the original object is not modified
+      expect(obj).toEqual({
+        name: `John`,
+        age: 30,
+      })
+    })
+
+    it(`should only track properties that actually change`, () => {
+      const obj = { name: `John`, age: 30 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Set a property to the same value
+      proxy.name = `John`
+      // Change another property
+      proxy.age = 31
+
+      // Only the changed property should be tracked
+      expect(getChanges()).toEqual({
+        age: 31,
+      })
+    })
+
+    it(`should handle nested property access`, () => {
+      const obj = { user: { name: `John`, age: 30 } }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Change a nested property
+      proxy.user = { name: `Jane`, age: 31 }
+
+      // The entire user object should be tracked as a change
+      expect(getChanges()).toEqual({
+        user: { name: `Jane`, age: 31 },
+      })
+    })
+
+    it(`should track when object properties are changed`, () => {
+      const obj = { name: `John`, age: 30, active: false }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.name = `Jane`
+      proxy.active = true
+
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+        active: true,
+      })
+      expect(obj.name).toBe(`John`)
+      expect(obj.active).toBe(false)
+    })
+
+    it(`should track changes to properties within nested objects`, () => {
+      const obj = {
+        user: {
+          name: `John`,
+          contact: {
+            email: `john@example.com`,
+            phone: `123-456-7890`,
+          },
+        },
+      }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.user.contact = {
+        email: `john.doe@example.com`,
+        phone: `123-456-7890`,
+      }
+
+      expect(getChanges()).toEqual({
+        user: {
+          name: `John`,
+          contact: {
+            email: `john.doe@example.com`,
+            phone: `123-456-7890`,
+          },
+        },
+      })
+    })
+
+    it(`should track when properties are deleted from objects`, () => {
+      const obj: { name: string; age: number; role?: string } = {
+        name: `John`,
+        age: 30,
+        role: `admin`,
+      }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      delete proxy.role
+
+      expect(getChanges()).toStrictEqual({
+        role: undefined,
+      })
+      expect(obj).toEqual({
+        name: `John`,
+        age: 30,
+        role: `admin`,
+      })
+    })
+
+    it(`should not track properties when values remain the same`, () => {
+      const obj = { name: `John`, age: 30, active: true }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.name = `John`
+      proxy.age = 30
+      proxy.active = true
+
+      expect(getChanges()).toEqual({})
+      expect(obj).toEqual({ name: `John`, age: 30, active: true })
+    })
+
+    it(`should properly handle objects with circular references`, () => {
+      const obj: unknown = { name: `John`, age: 30 }
+      // @ts-expect-error ignore for test
+      obj.self = obj // Create circular reference
+
+      const { proxy, getChanges } = createChangeProxy(
+        obj as Record<string | symbol, any>,
+      )
+
+      proxy.name = `Jane`
+
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+      })
+      // @ts-expect-error ignore for test
+      expect(obj.name).toBe(`John`)
+    })
+
+    it(`should properly handle Date object mutations`, () => {
+      const obj = {
+        name: `John`,
+        createdAt: new Date(`2023-01-01`),
+      }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      const newDate = new Date(`2023-02-01`)
+      proxy.createdAt = newDate
+
+      expect(getChanges()).toEqual({
+        createdAt: newDate,
+      })
+      expect(obj.createdAt).toEqual(new Date(`2023-01-01`))
+    })
+
+    it(`should track changes to custom class properties`, () => {
+      class Person {
+        name: string
+        age: number
+
+        constructor(name: string, age: number) {
+          this.name = name
+          this.age = age
+        }
+      }
+
+      const obj = {
+        person: new Person(`John`, 30),
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+      proxy.person = new Person(`Jane`, 25)
+
+      expect(getChanges()).toEqual({
+        person: new Person(`Jane`, 25),
+      })
+      expect(obj.person).toEqual(new Person(`John`, 30))
+    })
+
+    it(`should track changes in deeply nested object structures`, () => {
+      const obj = {
+        company: {
+          department: {
+            team: {
+              lead: {
+                name: `John`,
+                role: `Team Lead`,
+              },
+              members: [`Alice`, `Bob`],
+            },
+          },
+        },
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Access the nested property through the proxy chain
+      const companyProxy = proxy.company
+      const departmentProxy = companyProxy.department
+      const teamProxy = departmentProxy.team
+      const leadProxy = teamProxy.lead
+      leadProxy.name = `Jane`
+
+      expect(getChanges()).toEqual({
+        company: {
+          department: {
+            team: {
+              lead: {
+                name: `Jane`,
+                role: `Team Lead`,
+              },
+              members: [`Alice`, `Bob`],
+            },
+          },
+        },
+      })
+    })
+
+    it(`should handle regular expression mutations`, () => {
+      const obj = {
+        pattern: /test/i,
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.pattern = /new-pattern/g
+
+      expect(getChanges()).toEqual({
+        pattern: /new-pattern/g,
+      })
+      expect(obj.pattern).toEqual(/test/i)
+    })
+
+    it(`should properly track BigInt type values`, () => {
+      const obj = {
+        id: BigInt(123456789),
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.id = BigInt(987654321)
+
+      expect(getChanges()).toEqual({
+        id: BigInt(987654321),
+      })
+      expect(obj.id).toBe(BigInt(123456789))
+    })
+
+    it(`should handle complex objects with multiple special types`, () => {
+      const obj = {
+        id: BigInt(123),
+        pattern: /test/,
+        date: new Date(`2023-01-01`),
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.id = BigInt(456)
+      proxy.pattern = /updated/
+      proxy.date = new Date(`2023-06-01`)
+
+      expect(getChanges()).toEqual({
+        id: BigInt(456),
+        pattern: /updated/,
+        date: new Date(`2023-06-01`),
+      })
+    })
+
+    it(`should handle property descriptors with getters and setters`, () => {
+      const obj = {
+        _name: `John`,
+        get name() {
+          return this._name
+        },
+        set name(value) {
+          this._name = value
+        },
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+      proxy.name = `Jane`
+
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+      })
+      expect(obj._name).toBe(`John`)
+      expect(obj.name).toBe(`John`)
+    })
+
+    it(`should handle non-enumerable properties`, () => {
+      const obj = {}
+      Object.defineProperty(obj, `hidden`, {
+        value: `original`,
+        enumerable: false,
+        writable: true,
+        configurable: true,
+      })
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+      // @ts-expect-error ignore for test
+      proxy.hidden = `modified`
+
+      expect(getChanges()).toEqual({
+        hidden: `modified`,
+      })
+      // @ts-expect-error ignore for test
+      expect(obj.hidden).toBe(`original`)
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Frozen object handling`, () => {
+    it(`should handle creating a proxy for an already-frozen object`, () => {
+      const obj = { name: `John`, age: 30 }
+      Object.freeze(obj)
+
+      // This should not throw - the proxy should work with frozen objects
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify properties via the proxy
+      proxy.name = `Jane`
+      proxy.age = 31
+
+      // Changes should be tracked
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+        age: 31,
+      })
+
+      // Original frozen object should remain unchanged
+      expect(obj).toEqual({
+        name: `John`,
+        age: 30,
+      })
+      expect(Object.isFrozen(obj)).toBe(true)
+    })
+
+    it(`should handle deeply frozen nested objects`, () => {
+      const obj = {
+        user: {
+          name: `John`,
+          address: {
+            city: `NYC`,
+            zip: `10001`,
+          },
+        },
+      }
+      // Deep freeze the object
+      Object.freeze(obj)
+      Object.freeze(obj.user)
+      Object.freeze(obj.user.address)
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify nested properties
+      proxy.user.name = `Jane`
+      proxy.user.address.city = `LA`
+
+      // Changes should be tracked
+      expect(getChanges()).toEqual({
+        user: {
+          name: `Jane`,
+          address: {
+            city: `LA`,
+            zip: `10001`,
+          },
+        },
+      })
+
+      // Original should be unchanged
+      expect(obj.user.name).toBe(`John`)
+      expect(obj.user.address.city).toBe(`NYC`)
+    })
+
+    it(`should handle withArrayChangeTracking with frozen objects`, () => {
+      const item1 = { id: 1, name: `Item 1` }
+      const item2 = { id: 2, name: `Item 2` }
+      Object.freeze(item1)
+      Object.freeze(item2)
+      const frozenArray = [item1, item2]
+      Object.freeze(frozenArray)
+
+      // This should not throw - matches the RTK Query adapter use case
+      const changes = withArrayChangeTracking(frozenArray, (drafts) => {
+        if (drafts[0]) {
+          drafts[0].name = `Updated Item 1`
+        }
+      })
+
+      // Changes should be captured
+      expect(changes[0]).toEqual({ name: `Updated Item 1` })
+      expect(changes[1]).toEqual({})
+
+      // Original frozen objects should be unchanged
+      expect(item1.name).toBe(`Item 1`)
+      expect(Object.isFrozen(item1)).toBe(true)
+    })
+
+    it(`should handle withChangeTracking with a frozen object`, () => {
+      const obj = { id: 1, name: `Test`, value: 100 }
+      Object.freeze(obj)
+
+      const changes = withChangeTracking(obj, (draft) => {
+        draft.name = `Updated`
+        draft.value = 200
+      })
+
+      expect(changes).toEqual({
+        name: `Updated`,
+        value: 200,
+      })
+
+      // Original should be unchanged
+      expect(obj.name).toBe(`Test`)
+      expect(obj.value).toBe(100)
+    })
+
+    it(`should handle frozen arrays with nested frozen objects`, () => {
+      const data = [
+        { id: 1, details: { score: 10 } },
+        { id: 2, details: { score: 20 } },
+      ]
+      // Deep freeze everything
+      data.forEach((item) => {
+        Object.freeze(item.details)
+        Object.freeze(item)
+      })
+      Object.freeze(data)
+
+      const changes = withArrayChangeTracking(data, (drafts) => {
+        // Modify nested property
+        if (drafts[0]) {
+          drafts[0].details.score = 100
+        }
+      })
+
+      expect(changes[0]).toEqual({
+        details: { score: 100 },
+      })
+
+      // Original should be unchanged
+      expect(data[0]!.details.score).toBe(10)
+    })
+
+    it(`should handle iteration over frozen array elements`, () => {
+      const items = [
+        { id: 1, name: `A` },
+        { id: 2, name: `B` },
+        { id: 3, name: `C` },
+      ]
+      items.forEach((item) => Object.freeze(item))
+      Object.freeze(items)
+
+      const changes = withArrayChangeTracking(items, (drafts) => {
+        // Use find to locate and modify an item
+        const found = drafts.find((d) => d.id === 2)
+        if (found) {
+          found.name = `Updated B`
+        }
+      })
+
+      expect(changes[1]).toEqual({ name: `Updated B` })
+      expect(items[1]!.name).toBe(`B`) // Original unchanged
+    })
+
+    it(`should handle createArrayChangeProxy with frozen objects`, () => {
+      const items = [
+        { id: 1, status: `pending` },
+        { id: 2, status: `pending` },
+      ]
+      items.forEach((item) => Object.freeze(item))
+
+      const { proxies, getChanges } = createArrayChangeProxy(items)
+
+      proxies[0]!.status = `completed`
+      proxies[1]!.status = `in-progress`
+
+      const changes = getChanges()
+      expect(changes[0]).toEqual({ status: `completed` })
+      expect(changes[1]).toEqual({ status: `in-progress` })
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Object.seal and Object.preventExtensions handling`, () => {
+    it(`should handle Object.seal correctly`, () => {
+      const obj = { name: `John`, age: 30 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Seal the proxy
+      Object.seal(proxy)
+
+      // Modify existing property (should work)
+      proxy.name = `Jane`
+
+      // Attempt to add a new property (should throw in strict mode)
+      expect(() => {
+        // @ts-expect-error testing runtime behavior
+        proxy.role = `admin`
+      }).toThrow(/not extensible/)
+
+      // Check that only the name change was tracked
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+      })
+
+      // Original object should be unchanged
+      expect(obj).toEqual({
+        name: `John`,
+        age: 30,
+      })
+    })
+
+    it(`should handle Object.preventExtensions correctly`, () => {
+      const obj = { name: `John`, age: 30 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Prevent extensions on the proxy
+      Object.preventExtensions(proxy)
+
+      // Modify existing property (should work)
+      proxy.name = `Jane`
+
+      // Attempt to add a new property (should throw)
+      expect(() => {
+        // @ts-expect-error testing runtime behavior
+        proxy.role = `admin`
+      }).toThrow(/not extensible/)
+
+      // Check that only the name change was tracked
+      expect(getChanges()).toEqual({
+        name: `Jane`,
+      })
+
+      // Original object should be unchanged
+      expect(obj).toEqual({
+        name: `John`,
+        age: 30,
+      })
+    })
+
+    it(`should allow deleting properties with preventExtensions (but not seal)`, () => {
+      const obj = { name: `John`, age: 30 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Object.preventExtensions allows deletion of configurable properties
+      // Object.seal makes properties non-configurable, so delete wouldn't work
+      Object.preventExtensions(proxy)
+
+      // Modify and delete
+      proxy.name = `Jane`
+      // @ts-expect-error testing delete on non-optional property
+      delete proxy.age
+
+      // Only the modified property is returned by getChanges
+      // (deleted properties are tracked internally but not in the result)
+      const changes = getChanges()
+      expect(changes.name).toBe(`Jane`)
+    })
+
+    it(`should not allow deleting properties on sealed objects`, () => {
+      const obj = { name: `John`, age: 30 }
+      const { proxy } = createChangeProxy(obj)
+
+      // Object.seal makes properties non-configurable
+      Object.seal(proxy)
+
+      // In strict mode (which Vitest uses), deleting a non-configurable property throws
+      expect(() => {
+        // @ts-expect-error testing delete on non-optional property
+        delete proxy.age
+      }).toThrow()
+
+      // Property should still exist
+      expect(proxy.age).toBe(30)
+    })
+
+    it(`should handle sealing a proxy with nested objects`, () => {
+      const obj = { user: { name: `John` }, count: 0 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      Object.seal(proxy)
+
+      // Modifying nested objects should still work
+      proxy.user.name = `Jane`
+      proxy.count = 5
+
+      expect(getChanges()).toEqual({
+        user: { name: `Jane` },
+        count: 5,
+      })
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Enhanced Iterator Method Tracking`, () => {
+    it(`should track changes when Map values are modified via iterator`, () => {
+      const map = new Map([
+        [`key1`, { count: 1 }],
+        [`key2`, { count: 2 }],
+      ])
+
+      // Wrap the map in an object to track changes to the nested objects
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Get an entry via iterator and modify it
+      for (const [key, value] of proxy.myMap.entries()) {
+        if (key === `key1`) {
+          value.count = 10
+        }
+      }
+
+      // Verify the original map was not modified
+      expect(map.get(`key1`)?.count).toBe(1)
+
+      // Check that the change was tracked correctly
+      expect(getChanges()).toEqual({
+        myMap: new Map([
+          [`key1`, { count: 10 }],
+          [`key2`, { count: 2 }],
+        ]),
+      })
+    })
+
+    it(`should track changes when Set object values are modified via iterator`, () => {
+      const set = new Set([
+        { id: 1, value: `one` },
+        { id: 2, value: `two` },
+      ])
+
+      // Wrap the set in an object to track changes to the nested objects
+      const obj = { mySet: set }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Find and modify an object in the set via iterator
+      for (const item of proxy.mySet.values()) {
+        if (item.id === 1) {
+          item.value = `modified`
+        }
+      }
+
+      // Verify the original set was not modified
+      let found = false
+      for (const item of set) {
+        if (item.id === 1) {
+          expect(item.value).toBe(`one`)
+          found = true
+        }
+      }
+      expect(found).toBe(true)
+
+      // Check that the change was tracked correctly
+      const changes = getChanges()
+      expect(changes.mySet).toBeInstanceOf(Set)
+      const changedItems = Array.from(changes.mySet as Set<any>)
+      expect(changedItems).toEqual(
+        expect.arrayContaining([
+          { id: 1, value: `modified` },
+          { id: 2, value: `two` },
+        ]),
+      )
+      expect(changes).toEqual({
+        mySet: new Set([
+          { id: 1, value: `modified` },
+          { id: 2, value: `two` },
+        ]),
+      })
+      expect(changes.mySet.size).toBe(2)
+      expect([...set]).toEqual([
+        { id: 1, value: `one` },
+        { id: 2, value: `two` },
+      ])
+    })
+
+    it(`should track changes when Map values are modified via forEach`, () => {
+      const map = new Map([
+        [`key1`, { count: 1 }],
+        [`key2`, { count: 2 }],
+      ])
+
+      // Wrap the map in an object to track changes to the nested objects
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify values using forEach
+      proxy.myMap.forEach((value, key) => {
+        if (key === `key2`) {
+          value.count = 20
+        }
+      })
+
+      // Verify the original map was not modified
+      expect(map.get(`key2`)?.count).toBe(2)
+
+      // Check that the change was tracked correctly
+      expect(getChanges()).toEqual({
+        myMap: new Map([
+          [`key1`, { count: 1 }],
+          [`key2`, { count: 20 }],
+        ]),
+      })
+    })
+
+    it(`should track changes when Set values are modified via forEach`, () => {
+      const set = new Set([
+        { id: 1, value: `one` },
+        { id: 2, value: `two` },
+      ])
+
+      // Wrap the set in an object to track changes to the nested objects
+      const obj = { mySet: set }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify values using forEach
+      proxy.mySet.forEach((item) => {
+        if (item.id === 2) {
+          item.value = `modified two`
+        }
+      })
+
+      // Verify the original set was not modified
+      let found = false
+      for (const item of set) {
+        if (item.id === 2) {
+          expect(item.value).toBe(`two`)
+          found = true
+        }
+      }
+      expect(found).toBe(true)
+
+      // Check that the change was tracked correctly
+      const changes = getChanges()
+      expect(changes.mySet).toBeInstanceOf(Set)
+      const changedItems = Array.from(changes.mySet as Set<any>)
+      expect(changedItems).toEqual(
+        expect.arrayContaining([
+          { id: 1, value: `one` },
+          { id: 2, value: `modified two` },
+        ]),
+      )
+      expect(changes).toEqual({
+        mySet: new Set([
+          { id: 1, value: `one` },
+          { id: 2, value: `modified two` },
+        ]),
+      })
+      expect(changes.mySet.size).toBe(2)
+      expect([...set]).toEqual([
+        { id: 1, value: `one` },
+        { id: 2, value: `two` },
+      ])
+    })
+
+    it(`should handle multiple modifications to the same object via different iterators`, () => {
+      const map = new Map([
+        [`key1`, { count: 1, name: `test` }],
+        [`key2`, { count: 2, name: `test2` }],
+      ])
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify via entries()
+      for (const [key, value] of proxy.myMap.entries()) {
+        if (key === `key1`) {
+          value.count = 10
+        }
+      }
+
+      // Modify via values()
+      for (const value of proxy.myMap.values()) {
+        if (value.name === `test`) {
+          value.name = `modified`
+        }
+      }
+
+      // Verify the original map was not modified.
+      expect(map.get(`key1`)).toEqual({ count: 1, name: `test` })
+
+      expect(getChanges()).toEqual({
+        myMap: new Map([
+          [`key1`, { count: 10, name: `modified` }],
+          [`key2`, { count: 2, name: `test2` }],
+        ]),
+      })
+    })
+
+    it(`should handle nested object modifications via iterators`, () => {
+      const map = new Map([
+        [`user1`, { profile: { name: `Alice`, settings: { theme: `dark` } } }],
+        [`user2`, { profile: { name: `Bob`, settings: { theme: `light` } } }],
+      ])
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      for (const [key, user] of proxy.myMap.entries()) {
+        if (key === `user1`) {
+          user.profile.settings.theme = `auto`
+        }
+      }
+
+      expect(getChanges()).toEqual({
+        myMap: new Map([
+          [
+            `user1`,
+            { profile: { name: `Alice`, settings: { theme: `auto` } } },
+          ],
+          [`user2`, { profile: { name: `Bob`, settings: { theme: `light` } } }],
+        ]),
+      })
+      expect(map.get(`user1`)?.profile.settings.theme).toBe(`dark`)
+    })
+
+    it(`should handle Set modifications with duplicate objects`, () => {
+      const obj1 = { id: 1, value: `one` }
+      const obj2 = { id: 2, value: `two` }
+      const set = new Set([obj1, obj2, obj1]) // obj1 appears twice but Set deduplicates
+      const obj = { mySet: set }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      for (const item of proxy.mySet) {
+        if (item.id === 1) {
+          item.value = `modified`
+        }
+      }
+
+      const changes = getChanges()
+      expect(changes.mySet).toBeInstanceOf(Set)
+      expect(changes.mySet.size).toBe(2)
+      const changedItems = Array.from(changes.mySet as Set<any>)
+      expect(changedItems).toEqual(
+        expect.arrayContaining([
+          { id: 1, value: `modified` },
+          { id: 2, value: `two` },
+        ]),
+      )
+      expect(obj1.value).toBe(`one`) // Original unchanged
+      expect(changes).toEqual({
+        mySet: new Set([
+          { id: 1, value: `modified` },
+          { id: 2, value: `two` },
+        ]),
+      })
+      expect([...set]).toEqual([
+        { id: 1, value: `one` },
+        { id: 2, value: `two` },
+      ])
+    })
+
+    it(`should handle reverting changes made via iterators`, () => {
+      const map = new Map([
+        [`key1`, { count: 5 }],
+        [`key2`, { count: 10 }],
+      ])
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify via entries()
+      for (const [key, value] of proxy.myMap.entries()) {
+        if (key === `key1`) {
+          value.count = 20 // Change
+          value.count = 5 // Revert to original
+        }
+      }
+
+      // Should have no changes since we reverted
+      expect(getChanges()).toEqual({})
+    })
+
+    it(`should handle mixed Map and Set nested operations`, () => {
+      const data = {
+        userGroups: new Map([
+          [
+            `admins`,
+            {
+              users: new Set([
+                { id: 1, name: `Alice` },
+                { id: 2, name: `Bob` },
+              ]),
+            },
+          ],
+          [
+            `users`,
+            {
+              users: new Set([{ id: 3, name: `Charlie` }]),
+            },
+          ],
+        ]),
+      }
+      const { proxy, getChanges } = createChangeProxy(data)
+
+      // Navigate through Map.values() then Set iteration
+      for (const group of proxy.userGroups.values()) {
+        for (const user of group.users) {
+          if (user.name === `Alice`) {
+            user.name = `Alice Admin`
+          }
+        }
+      }
+
+      const changes = getChanges()
+      expect(changes.userGroups).toBeInstanceOf(Map)
+      const adminGroup = changes.userGroups.get(`admins`)
+      expect(adminGroup?.users).toBeInstanceOf(Set)
+      const users = Array.from(adminGroup?.users as Set<any>)
+      expect(users).toEqual(
+        expect.arrayContaining([
+          { id: 1, name: `Alice Admin` },
+          { id: 2, name: `Bob` },
+        ]),
+      )
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Map and Set Operations`, () => {
+    it(`should track Map clear operations`, () => {
+      const map = new Map([
+        [`key1`, `value1`],
+        [`key2`, `value2`],
+      ])
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.myMap.clear()
+
+      expect(getChanges()).toEqual({
+        myMap: new Map(),
+      })
+      expect(map.size).toBe(2)
+    })
+
+    it(`should track Map delete operations`, () => {
+      const map = new Map([
+        [`key1`, `value1`],
+        [`key2`, `value2`],
+      ])
+      const obj = { myMap: map }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.myMap.delete(`key1`)
+
+      expect(getChanges()).toEqual({
+        myMap: new Map([[`key2`, `value2`]]),
+      })
+      expect(map.has(`key1`)).toBe(true)
+    })
+
+    it(`should track Map set operations with object keys`, () => {
+      const objKey = { id: 1 }
+      const map = new Map([[objKey, `value1`]])
+      const { proxy, getChanges } = createChangeProxy({ map })
+
+      const newObjKey = { id: 2 }
+      proxy.map.set(newObjKey, `value2`)
+
+      const changes = getChanges()
+      expect(changes.map.get(newObjKey)).toBe(`value2`)
+      expect(map.get(newObjKey)).toBeUndefined()
+    })
+
+    it(`should track Set add and delete operations`, () => {
+      const set = new Set([1, 2, 3])
+      const { proxy, getChanges } = createChangeProxy({ set })
+
+      proxy.set.add(4)
+      proxy.set.delete(2)
+
+      expect(getChanges()).toEqual({
+        set: new Set([1, 3, 4]),
+      })
+      expect(set.has(4)).toBe(false)
+      expect(set.has(2)).toBe(true)
+    })
+
+    it(`should handle iteration over collections during modification`, () => {
+      const map = new Map([
+        [`key1`, `value1`],
+        [`key2`, `value2`],
+      ])
+      const { proxy, getChanges } = createChangeProxy({ map })
+
+      // Modify during iteration
+      for (const [key] of proxy.map) {
+        proxy.map.set(key, `modified`)
+      }
+
+      expect(getChanges()).toEqual({
+        map: new Map([
+          [`key1`, `modified`],
+          [`key2`, `modified`],
+        ]),
+      })
+      expect(map.get(`key1`)).toBe(`value1`)
+      expect(map.get(`key2`)).toBe(`value2`)
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`createArrayChangeProxy`, () => {
+    it(`should track changes to an array of objects`, () => {
+      const objs = [
+        { id: 1, name: `John` },
+        { id: 2, name: `Jane` },
+      ]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Make changes to the proxies
+      // @ts-expect-error ok possibly undefined
+      proxies[0].name = `Johnny`
+      // @ts-expect-error ok possibly undefined
+      proxies[1].name = `Janet`
+
+      // Check that the changes are tracked
+      expect(getChanges()).toEqual([{ name: `Johnny` }, { name: `Janet` }])
+
+      // Check that the original objects are not modified
+      expect(objs).toEqual([
+        { id: 1, name: `John` },
+        { id: 2, name: `Jane` },
+      ])
+    })
+
+    it(`should track when items are added to arrays`, () => {
+      const obj = {
+        items: [`apple`, `banana`],
+      }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.items = [...obj.items, `cherry`]
+
+      expect(getChanges()).toEqual({
+        items: [`apple`, `banana`, `cherry`],
+      })
+      expect(obj.items).toEqual([`apple`, `banana`])
+    })
+
+    it(`should track array pop() operations`, () => {
+      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call pop() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.pop()
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`apple`, `banana`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
+    })
+
+    it(`should track array shift() operations`, () => {
+      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call shift() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.shift()
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`banana`, `cherry`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
+    })
+
+    it(`should track array unshift() operations`, () => {
+      const objs = [{ items: [`banana`, `cherry`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call unshift() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.unshift(`apple`)
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`apple`, `banana`, `cherry`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`banana`, `cherry`])
+    })
+
+    it(`should track array push() operations`, () => {
+      const obj = { items: [`apple`, `banana`] }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      proxy.items.push(`cherry`)
+
+      expect(getChanges()).toEqual({
+        items: [`apple`, `banana`, `cherry`],
+      })
+      expect(obj.items).toEqual([`apple`, `banana`])
+    })
+
+    it(`should track array splice() operations`, () => {
+      const objs = [{ items: [`apple`, `banana`, `cherry`, `date`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call splice() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.splice(1, 2, `blueberry`, `cranberry`)
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`apple`, `blueberry`, `cranberry`, `date`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`, `date`])
+    })
+
+    it(`should track array sort() operations`, () => {
+      const objs = [{ items: [`cherry`, `apple`, `banana`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call sort() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.sort()
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`apple`, `banana`, `cherry`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`cherry`, `apple`, `banana`])
+    })
+
+    it(`should track array reverse() operations`, () => {
+      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call reverse() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.reverse()
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`cherry`, `banana`, `apple`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
+    })
+
+    it(`should track array fill() operations`, () => {
+      const objs = [{ items: [`apple`, `banana`, `cherry`] }]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call fill() method directly
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.fill(`orange`, 1, 3)
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`apple`, `orange`, `orange`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([`apple`, `banana`, `cherry`])
+    })
+
+    it(`should track array copyWithin() operations`, () => {
+      const objs = [
+        { items: [`apple`, `banana`, `cherry`, `date`, `elderberry`] },
+      ]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Call copyWithin() method directly - copy elements from index 3-4 to index 0-1
+      // @ts-expect-error ok possibly undefined
+      proxies[0].items.copyWithin(0, 3, 5)
+
+      expect(getChanges()).toEqual([
+        {
+          items: [`date`, `elderberry`, `cherry`, `date`, `elderberry`],
+        },
+      ])
+      // @ts-expect-error ok possibly undefined
+      expect(objs[0].items).toEqual([
+        `apple`,
+        `banana`,
+        `cherry`,
+        `date`,
+        `elderberry`,
+      ])
+    })
+
+    it(`should track changes in multi-dimensional arrays`, () => {
+      const objs = [
+        {
+          matrix: [
+            [1, 2],
+            [3, 4],
+          ],
+        },
+      ]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Update a nested array
+      // @ts-expect-error ok possibly undefined
+      const newMatrix = [...proxies[0].matrix]
+      newMatrix[0] = [5, 6]
+      // @ts-expect-error ok possibly undefined
+      proxies[0].matrix = newMatrix
+
+      expect(getChanges()).toEqual([
+        {
+          matrix: [
+            [5, 6],
+            [3, 4],
+          ],
+        },
+      ])
+      if (objs[0]) {
+        expect(objs[0].matrix).toEqual([
+          [1, 2],
+          [3, 4],
+        ])
+      }
+    })
+
+    it(`should handle objects containing arrays as properties`, () => {
+      const objs = [
+        {
+          user: {
+            name: `John`,
+            hobbies: [`reading`, `swimming`],
+          },
+        },
+      ]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Update the array within the nested object
+      // @ts-expect-error ok for test.
+      const updatedUser = { ...proxies[0].user }
+      updatedUser.hobbies = [...updatedUser.hobbies, `cycling`]
+      // @ts-expect-error ok for test.
+      proxies[0].user = updatedUser
+
+      expect(getChanges()).toEqual([
+        {
+          user: {
+            name: `John`,
+            hobbies: [`reading`, `swimming`, `cycling`],
+          },
+        },
+      ])
+      if (objs[0]) {
+        expect(objs[0].user.hobbies).toEqual([`reading`, `swimming`])
+      }
+    })
+
+    it(`should handle Temporal objects correctly`, () => {
+      const zonedDateTime = Temporal.Now.zonedDateTimeISO()
+      const plainDate = Temporal.PlainDate.from(`2024-01-15`)
+      const duration = Temporal.Duration.from({ hours: 2, minutes: 30 })
+
+      const obj = {
+        appointment: {
+          date: zonedDateTime,
+          reminder: plainDate,
+          duration: duration,
+        },
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify the temporal objects
+      proxy.appointment = {
+        date: Temporal.Now.zonedDateTimeISO(),
+        reminder: Temporal.PlainDate.from(`2024-01-16`),
+        duration: Temporal.Duration.from({ hours: 3 }),
+      }
+
+      const changes = getChanges()
+
+      // The changed values should be proper Temporal objects, not empty objects
+      expect(changes.appointment.date).toBeInstanceOf(Temporal.ZonedDateTime)
+      expect(changes.appointment.reminder).toBeInstanceOf(Temporal.PlainDate)
+      expect(changes.appointment.duration).toBeInstanceOf(Temporal.Duration)
+
+      // Original should be unchanged
+      expect(obj.appointment.date).toEqual(zonedDateTime)
+      expect(obj.appointment.reminder).toEqual(plainDate)
+      expect(obj.appointment.duration).toEqual(duration)
+    })
+
+    it(`should handle Set and Map objects`, () => {
+      const set = new Set([1, 2, 3])
+      const map = new Map([
+        [`key1`, `value1`],
+        [`key2`, `value2`],
+      ])
+
+      const objs = [
+        {
+          collections: {
+            set,
+            map,
+          },
+        },
+      ]
+      const { proxies, getChanges } = createArrayChangeProxy(objs)
+
+      // Create new collections with modifications
+      const newSet = new Set([...set, 4])
+      const newMap = new Map([...map, [`key3`, `value3`]])
+
+      if (proxies[0]) {
+        proxies[0].collections = {
+          set: newSet,
+          map: newMap,
+        }
+      }
+
+      expect(getChanges()).toEqual([
+        {
+          collections: {
+            set: newSet,
+            map: newMap,
+          },
+        },
+      ])
+      if (objs[0]) {
+        expect(objs[0].collections.set).toEqual(set)
+        expect(objs[0].collections.map).toEqual(map)
+      }
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`withChangeTracking`, () => {
+    it(`should track changes made in the callback`, () => {
+      const obj = { name: `John`, age: 30 }
+
+      const changes = withChangeTracking(obj, (proxy) => {
+        proxy.name = `Jane`
+        proxy.age = 31
+      })
+
+      // Check that the changes are tracked
+      expect(changes).toEqual({
+        name: `Jane`,
+        age: 31,
+      })
+
+      // Check that the original object is not modified
+      expect(obj).toEqual({
+        name: `John`,
+        age: 30,
+      })
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`withArrayChangeTracking`, () => {
+    it(`should track changes made to multiple objects in the callback`, () => {
+      const objs = [
+        { id: 1, name: `John` },
+        { id: 2, name: `Jane` },
+      ]
+
+      const changes = withArrayChangeTracking(objs, (proxies) => {
+        if (proxies[0] && proxies[1]) {
+          proxies[0].name = `Johnny`
+          proxies[1].name = `Janet`
+        }
+      })
+
+      // Check that the changes are tracked
+      expect(changes).toEqual([{ name: `Johnny` }, { name: `Janet` }])
+
+      // Check that the original objects are modified
+      expect(objs).toEqual([
+        { id: 1, name: `John` },
+        { id: 2, name: `Jane` },
+      ])
+    })
+
+    it(`should handle empty changes`, () => {
+      const objs = [
+        { id: 1, name: `John` },
+        { id: 2, name: `Jane` },
+      ]
+
+      const changes = withArrayChangeTracking(objs, () => {
+        // No changes made
+      })
+
+      // No changes should be tracked
+      expect(changes).toEqual([{}, {}])
+
+      // Original objects should remain unchanged
+      expect(objs).toEqual([
+        { id: 1, name: `John` },
+        { id: 2, name: `Jane` },
+      ])
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Proxy revocation and cleanup`, () => {
+    it(`should handle accessing proxies after tracking function completes`, () => {
+      const obj = { name: `John`, age: 30 }
+      const changes = withChangeTracking(obj, (proxy) => {
+        proxy.name = `Jane`
+      })
+
+      expect(changes).toEqual({ name: `Jane` })
+      expect(obj.name).toBe(`John`)
+    })
+
+    it(`should handle nested proxy access after tracking`, () => {
+      const obj = { user: { name: `John`, age: 30 } }
+      const changes = withChangeTracking(obj, (proxy) => {
+        proxy.user.name = `Jane`
+      })
+
+      expect(changes).toEqual({
+        user: { name: `Jane`, age: 30 },
+      })
+      expect(obj.user.name).toBe(`John`)
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Advanced Proxy Change Detection`, () => {
+    describe(`Structural Sharing and Equality Detection`, () => {
+      it(`should return the original object when changes are reverted`, () => {
+        const obj = { name: `John`, age: 30 }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        // Make changes
+        proxy.name = `Jane`
+        // Revert changes
+        proxy.name = `John`
+
+        // No changes should be tracked
+        expect(getChanges()).toEqual({})
+      })
+
+      it(`should handle Maps that have items added and then removed`, () => {
+        const map = new Map([[`key1`, `value1`]])
+        const obj = { myMap: map }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        // Create a new map with an added item
+        const modifiedMap = new Map(map)
+        modifiedMap.set(`key2`, `value2`)
+        proxy.myMap = modifiedMap
+
+        // Create a new map that's identical to the original
+        const revertedMap = new Map([[`key1`, `value1`]])
+        proxy.myMap = revertedMap
+
+        // No changes should be tracked since final state matches initial state
+        expect(getChanges()).toEqual({})
+      })
+
+      it(`should handle restoring original references to nested objects`, () => {
+        const nestedObj = { value: 42 }
+        const obj = { nested: nestedObj, other: `data` }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        // Replace with different object
+        proxy.nested = { value: 100 }
+
+        // Restore original reference
+        proxy.nested = nestedObj
+
+        // No changes should be tracked for nested
+        expect(getChanges()).toEqual({})
+      })
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Deep Nested Reverts`, () => {
+    it(`should correctly detect when a deeply nested property is reverted to original value`, () => {
+      const obj = { nested: { count: 10 } }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Make a change to a deep nested property
+      proxy.nested.count = 5
+
+      expect(proxy.nested.count).toEqual(5)
+      // Verify changes are tracked
+      expect(getChanges()).toEqual({
+        nested: { count: 5 },
+      })
+
+      // Revert back to original value
+      proxy.nested.count = 10
+
+      // Verify no changes are reported
+      expect(getChanges()).toEqual({})
+
+      // Original object should be unchanged
+      expect(obj).toEqual({ nested: { count: 10 } })
+    })
+
+    it(`should correctly handle complex nested object reverts`, () => {
+      const obj = {
+        user: {
+          profile: {
+            name: `John`,
+            settings: {
+              theme: `dark`,
+              notifications: true,
+            },
+          },
+          stats: {
+            visits: 10,
+          },
+        },
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Make changes at different levels
+      proxy.user.profile.name = `Jane`
+      proxy.user.profile.settings.theme = `light`
+      proxy.user.stats.visits = 15
+
+      // Verify all changes are tracked
+      expect(getChanges()).toEqual({
+        user: {
+          profile: {
+            name: `Jane`,
+            settings: {
+              theme: `light`,
+              notifications: true,
+            },
+          },
+          stats: {
+            visits: 15,
+          },
+        },
+      })
+
+      // Revert changes one by one
+      proxy.user.profile.name = `John`
+
+      // Should still show other changes
+      expect(Object.keys(getChanges()).length).toBeGreaterThan(0)
+      expect(getChanges()).toEqual({
+        user: {
+          profile: {
+            name: `John`,
+            settings: { theme: `light`, notifications: true },
+          },
+          stats: { visits: 15 },
+        },
+      })
+
+      proxy.user.profile.settings.theme = `dark`
+
+      // Should still show other changes
+      expect(Object.keys(getChanges()).length).toBeGreaterThan(0)
+      expect(getChanges()).toEqual({
+        user: {
+          profile: {
+            name: `John`,
+            settings: { theme: `dark`, notifications: true },
+          },
+          stats: { visits: 15 },
+        },
+      })
+
+      // Revert final change
+      proxy.user.stats.visits = 10
+
+      // No changes should be reported
+      expect(getChanges()).toEqual({})
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Array Edge Cases`, () => {
+    it(`should handle sparse arrays`, () => {
+      const arr = [1, 2, 3, 4, 5]
+      const { proxy, getChanges } = createChangeProxy({ arr })
+
+      delete proxy.arr[2]
+
+      expect(getChanges()).toEqual({
+        // eslint-disable-next-line no-sparse-arrays -- the deleted index is a hole
+        arr: [1, 2, , 4, 5],
+      })
+      expect(2 in arr).toBe(true)
+      expect(arr.length).toBe(5)
+    })
+
+    it(`should handle out-of-bounds array assignments`, () => {
+      const arr = [1, 2, 3]
+      const { proxy, getChanges } = createChangeProxy({ arr })
+
+      proxy.arr[5] = 6
+
+      expect(getChanges()).toEqual({
+        arr: [1, 2, 3, undefined, undefined, 6],
+      })
+      expect(arr.length).toBe(3)
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Object.defineProperty and Meta Operations`, () => {
+    it(`should track changes made through Object.defineProperty`, () => {
+      const obj: { name: string; age?: number } = { name: `John` }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      Object.defineProperty(proxy, `age`, {
+        value: 30,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      })
+
+      expect(getChanges()).toEqual({
+        age: 30,
+      })
+      expect(obj.age).toBeUndefined()
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Optimization Cases`, () => {
+    it(`should not track changes when setting to the same value`, () => {
+      const obj = { name: `John`, age: 30, scores: [1, 2, 3] }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Set to same primitive value
+      proxy.name = `John`
+      proxy.age = 30
+
+      // Set to same array value
+      proxy.scores = [1, 2, 3]
+
+      // Should have no changes
+      expect(getChanges()).toEqual({})
+    })
+
+    it(`should not track changes when modifying and reverting`, () => {
+      const obj = { name: `John`, nested: { count: 5 } }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify and revert primitive
+      proxy.name = `Jane`
+      proxy.name = `John`
+
+      // Modify and revert nested
+      proxy.nested.count = 10
+      proxy.nested.count = 5
+
+      // The object shouldn't be mutated.
+      expect(obj.name).toEqual(`John`)
+      expect(obj.nested.count).toEqual(5)
+
+      // Should have no changes
+      expect(getChanges()).toEqual({})
+    })
+
+    it(`should efficiently handle repeated changes to the same property`, () => {
+      const obj = { count: 0 }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Make many changes to the same property
+      for (let i = 0; i < 10000; i++) {
+        proxy.count = i
+      }
+
+      // Should only track the final change
+      expect(getChanges()).toEqual({ count: 9999 })
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`TypedArray Support`, () => {
+    it(`should track changes to TypedArrays`, () => {
+      const obj = {
+        int8: new Int8Array([1, 2, 3]),
+        uint8: new Uint8Array([4, 5, 6]),
+        float32: new Float32Array([1.1, 2.2, 3.3]),
+      }
+
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Modify values
+      proxy.int8[0] = 10
+      proxy.uint8[1] = 50
+      proxy.float32[2] = 33.3
+
+      const changes = getChanges()
+      expect(changes.int8[0]).toBe(10)
+      expect(changes.uint8[1]).toBe(50)
+      expect(changes.float32[2]).toBeCloseTo(33.3)
+
+      // Verify original object was modified
+      expect(obj.int8[0]).toBe(1)
+      expect(obj.uint8[1]).toBe(5)
+      expect(obj.float32[2]).toBeCloseTo(3.3)
+    })
+
+    it(`should handle replacing entire TypedArrays`, () => {
+      const obj = { data: new Uint8Array([1, 2, 3]) }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Replace entire array
+      proxy.data = new Uint8Array([4, 5, 6])
+
+      const changes = getChanges()
+      expect(changes.data instanceof Uint8Array).toBe(true)
+      expect(Array.from(changes.data)).toEqual([4, 5, 6])
+
+      // Verify original was not modified
+      expect(Array.from(obj.data)).toEqual([1, 2, 3])
+    })
+
+    it(`should detect when TypedArray values are the same`, () => {
+      const obj = { data: new Uint8Array([1, 2, 3]) }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Set to same values
+      proxy.data = new Uint8Array([1, 2, 3])
+
+      // Should have no changes
+      expect(getChanges()).toEqual({})
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Shallow Copy Handling`, () => {
+    it(`should properly handle Array shallow copies`, () => {
+      const obj = { items: [1, 2, 3] }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Replace the array instead of modifying it to ensure changes are tracked
+      proxy.items = [1, 2, 3, 4]
+
+      expect(getChanges()).toEqual({
+        items: [1, 2, 3, 4],
+      })
+      expect(obj.items).toEqual([1, 2, 3])
+    })
+
+    it(`should properly handle RegExp shallow copies`, () => {
+      const obj = { pattern: /test/i }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      // Replace with a new RegExp to trigger shallow copy
+      proxy.pattern = /modified/g
+
+      expect(getChanges()).toEqual({
+        pattern: /modified/g,
+      })
+      expect(obj.pattern).toEqual(/test/i)
+      expect(obj.pattern.flags).toBe(`i`)
+      expect(obj.pattern.source).toBe(`test`)
+    })
+
+    it(`should handle primitive values directly`, () => {
+      // Test with a primitive value
+      const primitiveObj = { value: 42 }
+      const { proxy: primitiveProxy, getChanges: getPrimitiveChanges } =
+        createChangeProxy(primitiveObj)
+
+      primitiveProxy.value = 100
+
+      expect(getPrimitiveChanges()).toEqual({
+        value: 100,
+      })
+      expect(primitiveObj.value).toBe(42)
+    })
+
+    it(`should handle Date objects correctly`, () => {
+      const originalDate = new Date(`2023-01-01T00:00:00Z`)
+      const obj = { date: originalDate }
+      const { proxy, getChanges } = createChangeProxy(obj)
+
+      const newDate = new Date(`2024-01-01T00:00:00Z`)
+      proxy.date = newDate
+
+      expect(getChanges()).toEqual({
+        date: newDate,
+      })
+      expect(obj.date).toEqual(originalDate)
+    })
+  })
+})
+
+describe(`Proxy Library`, () => {
+  describe(`Shallow Copy Handling`, () => {
+    describe(`array iteration methods`, () => {
+      it(`should track changes when modifying array items retrieved via find()`, () => {
+        const obj = {
+          job: {
+            orders: [
+              { orderId: `order-1`, orderBinInt: 1 },
+              { orderId: `order-2`, orderBinInt: 2 },
+            ],
+          },
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        // Use find() to get an array item and modify it
+        const order = proxy.job.orders.find((o) => o.orderId === `order-1`)
+        if (order) {
+          order.orderBinInt = 99
+        }
+
+        const changes = getChanges()
+        expect(Object.keys(changes).length).toBeGreaterThan(0)
+        expect(changes.job?.orders?.[0]?.orderBinInt).toBe(99)
+        expect(changes).toEqual({
+          job: {
+            orders: [
+              { orderId: `order-1`, orderBinInt: 99 },
+              { orderId: `order-2`, orderBinInt: 2 },
+            ],
+          },
+        })
+        expect(obj).toEqual({
+          job: {
+            orders: [
+              { orderId: `order-1`, orderBinInt: 1 },
+              { orderId: `order-2`, orderBinInt: 2 },
+            ],
+          },
+        })
+      })
+
+      it(`should track changes when modifying array items via forEach`, () => {
+        const obj = {
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        const visits: Array<number> = []
+        const result = proxy.items.forEach((item) => {
+          visits.push(item.id)
+          item.value = item.value * 2
+        })
+
+        const changes = getChanges()
+        expect(Object.keys(changes).length).toBeGreaterThan(0)
+        expect(result).toBeUndefined()
+        expect(visits).toEqual([1, 2])
+        expect(changes).toEqual({
+          items: [
+            { id: 1, value: 20 },
+            { id: 2, value: 40 },
+          ],
+        })
+        expect(obj).toEqual({
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        })
+      })
+
+      it(`should track changes when modifying array items via for...of`, () => {
+        const obj = {
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        for (const item of proxy.items) {
+          item.value = item.value * 2
+        }
+
+        const changes = getChanges()
+        expect(Object.keys(changes).length).toBeGreaterThan(0)
+        expect(changes).toEqual({
+          items: [
+            { id: 1, value: 20 },
+            { id: 2, value: 40 },
+          ],
+        })
+        expect(obj).toEqual({
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        })
+      })
+
+      it(`should track changes when modifying array items via index access`, () => {
+        const obj = {
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        // Direct index access should work
+        const firstItem = proxy.items[0]
+        if (firstItem) {
+          firstItem.value = 100
+        }
+
+        const changes = getChanges()
+        expect(Object.keys(changes).length).toBeGreaterThan(0)
+        expect(changes).toEqual({
+          items: [
+            { id: 1, value: 100 },
+            { id: 2, value: 20 },
+          ],
+        })
+        expect(obj).toEqual({
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        })
+      })
+
+      it(`should track changes when modifying items from filter() result`, () => {
+        const obj = {
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        const filtered = proxy.items.filter((item) => item.id === 1)
+        const first = filtered[0]
+        if (first) {
+          first.value = 42
+        }
+
+        const changes = getChanges()
+        expect(changes.items?.[0]?.value).toBe(42)
+        expect(filtered.map((item) => item.id)).toEqual([1])
+        expect(changes).toEqual({
+          items: [
+            { id: 1, value: 42 },
+            { id: 2, value: 20 },
+          ],
+        })
+        expect(obj).toEqual({
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        })
+      })
+
+      it(`should track changes when modifying array items retrieved via findLast()`, () => {
+        const obj = {
+          job: {
+            orders: [
+              { orderId: `order-1`, orderBinInt: 1 },
+              { orderId: `order-2`, orderBinInt: 2 },
+            ],
+          },
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        // Use type assertion to call findLast (ES2023 method)
+        type Order = { orderId: string; orderBinInt: number }
+        const orders = proxy.job.orders as unknown as {
+          findLast: (predicate: (o: Order) => boolean) => Order | undefined
+        }
+        const order = orders.findLast((o) => o.orderId.startsWith(`order-`))
+        if (order) {
+          order.orderBinInt = 123
+        }
+
+        const changes = getChanges()
+        expect(changes.job?.orders?.[1]?.orderBinInt).toBe(123)
+        expect(changes).toEqual({
+          job: {
+            orders: [
+              { orderId: `order-1`, orderBinInt: 1 },
+              { orderId: `order-2`, orderBinInt: 123 },
+            ],
+          },
+        })
+        expect(obj).toEqual({
+          job: {
+            orders: [
+              { orderId: `order-1`, orderBinInt: 1 },
+              { orderId: `order-2`, orderBinInt: 2 },
+            ],
+          },
+        })
+      })
+
+      it(`should track changes when modifying array items inside some() callback`, () => {
+        const obj = {
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        const visits: Array<number> = []
+        const result = proxy.items.some((item) => {
+          visits.push(item.id)
+          item.value = item.value * 2
+          return false
+        })
+
+        const changes = getChanges()
+        expect(changes.items?.[0]?.value).toBe(20)
+        expect(changes.items?.[1]?.value).toBe(40)
+        expect(result).toBe(false)
+        expect(visits).toEqual([1, 2])
+        expect(changes).toEqual({
+          items: [
+            { id: 1, value: 20 },
+            { id: 2, value: 40 },
+          ],
+        })
+        expect(obj).toEqual({
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        })
+      })
+
+      it(`should track changes when modifying array items inside reduce() callback`, () => {
+        const obj = {
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        }
+        const { proxy, getChanges } = createChangeProxy(obj)
+
+        const visits: Array<number> = []
+        const result = proxy.items.reduce((acc, item) => {
+          visits.push(item.id)
+          item.value = item.value + 1
+          return acc + item.value
+        }, 0)
+
+        const changes = getChanges()
+        expect(changes.items?.[0]?.value).toBe(11)
+        expect(changes.items?.[1]?.value).toBe(21)
+        expect(result).toBe(32)
+        expect(visits).toEqual([1, 2])
+        expect(changes).toEqual({
+          items: [
+            { id: 1, value: 11 },
+            { id: 2, value: 21 },
+          ],
+        })
+        expect(obj).toEqual({
+          items: [
+            { id: 1, value: 10 },
+            { id: 2, value: 20 },
+          ],
+        })
+      })
+    })
+  })
+})
+
+describe(`stored functions behave like native values`, () => {
+  type Row = StoredRow
+  const make = makeStoredRow
+  it(`tracks writes a stored method makes through this`, () => {
+    const native = make(
+      () => 1,
+      () => 2,
+    )
+    native.obj.bump()
+    const { proxy, getChanges } = createChangeProxy(
+      make(
+        () => 1,
+        () => 2,
+      ),
+    )
+    proxy.obj.bump()
+    expect(proxy.obj.count).toBe(native.obj.count)
+    const changes = getChanges() as Partial<Row>
+    expect(Object.keys(changes)).toEqual([`obj`])
+    expect(changes.obj?.count).toBe(1)
+  })
+})
+
+describe(`frozen and sealed drafts keep nested writes`, () => {
+  type Row = FrozenRow
+  const make = makeFrozenRow
+  it(`does not count a primitive read under a frozen key`, () => {
+    const { proxy, getChanges } = createChangeProxy(make())
+    void Object.freeze(proxy).m
+    expect(getChanges()).toEqual({})
+  })
+
+  it.each([
+    [`sealed`, (row: Row) => Object.seal(row)],
+    [
+      `read-only but configurable`,
+      (row: Row) =>
+        Object.defineProperty(row, `n`, {
+          writable: false,
+          configurable: true,
+        }),
+    ],
+  ])(`does not count an object read under a %s key`, (_name, fix) => {
+    const { proxy, getChanges } = createChangeProxy(make())
+    fix(proxy)
+    void proxy.n.x
+    expect(getChanges()).toEqual({})
+  })
+
+  it(`does not count writing back the row's own class instance`, () => {
+    class Point {
+      constructor(public x: number) {}
+    }
+    const row = { p: new Point(1) }
+    expect(
+      withChangeTracking(row, (draft) => {
+        draft.p = row.p
+      }),
+    ).toEqual({})
+    expect(
+      withChangeTracking(row, (draft) => {
+        draft.p = new Point(2)
+        draft.p = row.p
+      }),
+    ).toEqual({})
+  })
+})
diff --git a/packages/db/tests/query/aggregate-select-oracle.property.test.ts b/packages/db/tests/query/aggregate-select-oracle.property.test.ts
index 570ddc99af..83f6a50131 100644
--- a/packages/db/tests/query/aggregate-select-oracle.property.test.ts
+++ b/packages/db/tests/query/aggregate-select-oracle.property.test.ts
@@ -38,6 +38,7 @@ import {
 import { mockSyncCollectionOptions, stripVirtualProps } from '../utils.js'
 import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
 import { createOracleReach } from '../oracle-reach.js'
+import { declareOracle } from '../oracle-declaration.js'
 
 /**
  * # What does an aggregate query publish beside its aggregates?
@@ -1610,6 +1611,15 @@ const reachStates = [
 let reach:
   ReturnType<typeof createOracleReach<(typeof reachStates)[number]>> | undefined
 
+// The check is `runHistory`: it runs each generated history, and after every
+// step it compares the published rows and the compile outcome with
+// `modelGroup` and `modelError`. The generated properties and the pinned
+// replays above reach it.
+declareOracle({
+  check: [runHistory],
+  model: [modelGroup, modelError],
+})
+
 describe(`aggregate select shapes`, () => {
   it(`match the model across generated shapes (fixed campaign)`, async () => {
     // A repeatable baseline. Seed 2094 is arbitrary.
@@ -1747,38 +1757,4 @@ describe(`aggregate select shapes`, () => {
       [],
     )
   })
-
-  // Pinned witness: a group key that holds a literal object or NaN matches a
-  // select value that builds the same literal again.
-  it(`matches group keys holding array, Date and NaN literals`, async () => {
-    const source = createCollection(
-      mockSyncCollectionOptions<{ id: number; v: number; d: Date | null }>({
-        id: `sg-literals-${Math.random().toString(36).slice(2)}`,
-        getKey: (r) => r.id,
-        initialData: [{ id: 1, v: 1, d: null }],
-      }),
-    )
-    const keys: Record<string, (c: any) => any> = {
-      array: (c) => inArray(c.v, [1, 2]),
-      date: (c) => coalesce(c.d, new Date(5)),
-      nan: (c) => add(c.v, NaN),
-    }
-    for (const [name, key] of Object.entries(keys)) {
-      const query = createLiveQueryCollection((q) =>
-        q
-          .from({ c: source })
-          .groupBy(groupKeys(({ c }) => key(c)))
-          .select(({ c }) => ({ g: key(c), n: count(c.id) })),
-      )
-      await query.preload()
-      expect(
-        query.toArray.map((row: any) => [row.g, row.n]),
-        name,
-      ).toEqual([
-        [name === `array` ? true : name === `date` ? new Date(5) : NaN, 1],
-      ])
-      await query.cleanup()
-    }
-    await source.cleanup()
-  })
 })
diff --git a/packages/db/tests/query/aggregate-select.test.ts b/packages/db/tests/query/aggregate-select.test.ts
new file mode 100644
index 0000000000..2ef5555602
--- /dev/null
+++ b/packages/db/tests/query/aggregate-select.test.ts
@@ -0,0 +1,51 @@
+// Unit tests for group keys that hold literal values in aggregate selects: a
+// group key built from an array, Date, or NaN literal matches a select value
+// that builds the same literal again. The law and its oracle owner are in
+// aggregate-select-oracle.property.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import {
+  add,
+  coalesce,
+  count,
+  createLiveQueryCollection,
+  groupKeys,
+  inArray,
+} from '../../src/query/index.js'
+import { mockSyncCollectionOptions } from '../utils.js'
+
+describe(`aggregate select shapes`, () => {
+  // Pinned witness: a group key that holds a literal object or NaN matches a
+  // select value that builds the same literal again.
+  it(`matches group keys holding array, Date and NaN literals`, async () => {
+    const source = createCollection(
+      mockSyncCollectionOptions<{ id: number; v: number; d: Date | null }>({
+        id: `sg-literals-${Math.random().toString(36).slice(2)}`,
+        getKey: (r) => r.id,
+        initialData: [{ id: 1, v: 1, d: null }],
+      }),
+    )
+    const keys: Record<string, (c: any) => any> = {
+      array: (c) => inArray(c.v, [1, 2]),
+      date: (c) => coalesce(c.d, new Date(5)),
+      nan: (c) => add(c.v, NaN),
+    }
+    for (const [name, key] of Object.entries(keys)) {
+      const query = createLiveQueryCollection((q) =>
+        q
+          .from({ c: source })
+          .groupBy(groupKeys(({ c }) => key(c)))
+          .select(({ c }) => ({ g: key(c), n: count(c.id) })),
+      )
+      await query.preload()
+      expect(
+        query.toArray.map((row: any) => [row.g, row.n]),
+        name,
+      ).toEqual([
+        [name === `array` ? true : name === `date` ? new Date(5) : NaN, 1],
+      ])
+      await query.cleanup()
+    }
+    await source.cleanup()
+  })
+})
diff --git a/packages/db/tests/query/bucket-facade-rollback-oracle.property.test.ts b/packages/db/tests/query/bucket-facade-rollback-oracle.property.test.ts
index d4620917b6..ed768a469e 100644
--- a/packages/db/tests/query/bucket-facade-rollback-oracle.property.test.ts
+++ b/packages/db/tests/query/bucket-facade-rollback-oracle.property.test.ts
@@ -1,15 +1,22 @@
-import { D2, MultiSet } from '@tanstack/db-ivm'
-import { describe, expect, it } from 'vitest'
 import { fc } from '@fast-check/vitest'
-import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
-import { createTransaction } from '../../src/transactions.js'
+import { describe, expect, it } from 'vitest'
 import { stripVirtualProps } from '../utils.js'
 import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
-import { BUCKET_FACADE_REF } from '../../src/query/live/materialized-pipeline.js'
-import type { Collection } from '../../src/collection/index.js'
-import type { ChangeMessage, SyncConfig } from '../../src/types.js'
-import type { Transaction } from '../../src/transactions.js'
-import type { BucketRow } from '../../src/query/live/materialized-pipeline.js'
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  BUCKETS,
+  Driver,
+  expectedRows,
+  injectFailure,
+  orderOf,
+  withCleanup,
+} from './bucket-facade-rollback-support.js'
+import type {
+  BucketKey,
+  Model,
+  ModelRow,
+  Op,
+} from './bucket-facade-rollback-support.js'
 
 /**
  * # Does a failed facade flush restore exactly what it wrote, and only that?
@@ -146,21 +153,8 @@ import type { BucketRow } from '../../src/query/live/materialized-pipeline.js'
  */
 
 const PROPERTY = `bucket-facade.rollback-history`
-const BUCKETS = [`b0`, `b1`, `b2`, `b3`] as const
 const IDS = [1, 2, 3, 4, 5, 6] as const
 
-type BucketKey = string
-type Row = { id: number; v: number }
-type ModelRow = { value: Row; order: string }
-type Model = Map<BucketKey, Map<number, ModelRow>>
-
-type Op =
-  | { type: `activate`; bucket: BucketKey }
-  | { type: `insert`; bucket: BucketKey; id: number; v: number; rank: number }
-  | { type: `update`; bucket: BucketKey; id: number; v: number; rank: number }
-  | { type: `delete`; bucket: BucketKey; id: number }
-  | { type: `retire`; bucket: BucketKey }
-
 /**
  * How a flush ends. `contradict` retires a shown bucket without the graph's
  * retractions, a contradictory graph signal: the flush throws code 240 and
@@ -175,19 +169,6 @@ type Outcome =
   | `rollback`
   | `contradict`
 
-type FacadeSync = Parameters<SyncConfig<Record<string, unknown>>[`sync`]>[0]
-type FacadeEntry = {
-  collection: Collection<Row, number>
-  sync: FacadeSync | undefined
-}
-
-/** The rows a facade must show, in order. */
-function expectedRows(rows: Map<number, ModelRow> | undefined): Array<Row> {
-  return [...(rows?.values() ?? [])]
-    .sort((left, right) => (left.order < right.order ? -1 : 1))
-    .map((row) => row.value)
-}
-
 type LayoutExpectation = `required` | `forbidden` | `permitted`
 
 /**
@@ -240,34 +221,6 @@ function shownLayoutExpectation(
     : expectation
 }
 
-/**
- * Run `body`, then `cleanup`. When both throw, keep the body's failure as the
- * primary error: an AggregateError whose `cause` is that failure and whose
- * `errors` list it before the cleanup error (ORC-010).
- */
-async function withCleanup(
-  body: () => void | Promise<void>,
-  cleanup: () => Promise<void>,
-): Promise<void> {
-  let failure: { error: unknown } | undefined
-  try {
-    await body()
-  } catch (error) {
-    failure = { error }
-  }
-  try {
-    await cleanup()
-  } catch (cleanupError) {
-    if (!failure) throw cleanupError
-    throw new AggregateError(
-      [failure.error, cleanupError],
-      `oracle failure, then cleanup failure`,
-      { cause: failure.error },
-    )
-  }
-  if (failure) throw failure.error
-}
-
 function cloneModel(model: Model): Model {
   return new Map([...model].map(([bucket, rows]) => [bucket, new Map(rows)]))
 }
@@ -287,11 +240,6 @@ function applyOps(model: Model, ops: ReadonlyArray<Op>): Model {
   }
   return next
 }
-
-function orderOf(rank: number, id: number): string {
-  return `${rank}:${id}`
-}
-
 /** Buckets whose facade a flush of these operations writes. */
 function writtenBuckets(ops: ReadonlyArray<Op>): Set<BucketKey> {
   return new Set(
@@ -341,459 +289,6 @@ function legalize(
   return ops
 }
 
-/** The child facade a parent row's `kids` field points to. */
-function kidsOf(row: unknown): unknown {
-  return (row as { kids?: unknown } | undefined)?.kids
-}
-
-/**
- * Make the next `commit` or `write` of a facade's sync throw once. A `write`
- * failure leaves the facade's sync transaction open, as a validation error
- * from a real write would.
- */
-function injectFailure(
-  sync: FacadeSync,
-  method: `commit` | `write` | `staged`,
-): void {
-  if (method === `staged`) {
-    // The facade's writes are staged, then the commit throws before it
-    // commits, so the sync transaction stays open with those writes.
-    const commit = sync.commit
-    sync.commit = () => {
-      sync.commit = commit
-      throw new Error(`injected facade write failure`)
-    }
-    return
-  }
-  if (method === `commit`) {
-    const commit = sync.commit
-    sync.commit = () => {
-      sync.commit = commit
-      commit()
-      throw new Error(`injected facade write failure`)
-    }
-    return
-  }
-  const write = sync.write
-  sync.write = () => {
-    sync.write = write
-    throw new Error(`injected facade write failure`)
-  }
-}
-
-class Driver {
-  private readonly graph = new D2()
-  private readonly rows = this.graph.newInput<[string, BucketRow]>()
-  private readonly activity = this.graph.newInput<[string, true]>()
-  readonly adapter: BucketFacadeAdapter
-  private readonly events = new Map<object, number>()
-  private changes = new Map<object, Array<ChangeMessage<Row, number>>>()
-  private readonly wrapped = new WeakSet<object>()
-  private reads = new Map<object, number>()
-  private readonly sent = new Map<BucketKey, Map<number, BucketRow>>()
-  // Rows a user transaction inserted into a facade. They are optimistic, so
-  // the graph never sent them and the model's synced rows do not hold them.
-  /** Optimistic row ids per facade, and whether the row is visible. */
-  private localIds = new WeakMap<object, Map<number, boolean>>()
-  private readonly localTransactions: Array<Transaction> = []
-  private nextLocalId = 100
-  // Rows of a persisting user transaction that holds a facade's sync commits.
-  // The transaction settles without a sync write, so its row then leaves.
-  readonly heldIds = new Set<number>()
-  private nextHeldId = 1000
-
-  constructor() {
-    this.adapter = new BucketFacadeAdapter(
-      `rollback-oracle-${Math.random()}`,
-      [
-        {
-          edgeId: `children`,
-          rows: this.rows,
-          activeBuckets: this.activity,
-          hasOrderBy: true,
-        },
-      ],
-      () => {},
-    )
-    this.graph.finalize()
-  }
-
-  private entries(): Map<string, FacadeEntry> {
-    return (
-      (
-        this.adapter as unknown as {
-          entries: Map<string, Map<string, FacadeEntry>>
-        }
-      ).entries.get(`children`) ?? new Map()
-    )
-  }
-
-  entry(bucket: BucketKey): FacadeEntry | undefined {
-    return this.entries().get(bucket)
-  }
-
-  /** Send operations to the graph as the materialization graph would. */
-  send(ops: ReadonlyArray<Op>): void {
-    for (const op of ops) {
-      const sent = this.sent.get(op.bucket)
-      if (op.type === `activate`) {
-        this.activity.sendData(new MultiSet([[[op.bucket, true], 1]]))
-        this.sent.set(op.bucket, new Map())
-      } else if (op.type === `retire`) {
-        for (const row of sent?.values() ?? []) {
-          this.rows.sendData(new MultiSet([[[op.bucket, row], -1]]))
-        }
-        this.activity.sendData(new MultiSet([[[op.bucket, true], -1]]))
-        this.sent.delete(op.bucket)
-      } else if (op.type === `delete`) {
-        this.rows.sendData(new MultiSet([[[op.bucket, sent!.get(op.id)!], -1]]))
-        sent!.delete(op.id)
-      } else {
-        const previous = sent!.get(op.id)
-        if (previous) {
-          this.rows.sendData(new MultiSet([[[op.bucket, previous], -1]]))
-        }
-        const row: BucketRow = [
-          op.id,
-          { id: op.id, v: op.v },
-          orderOf(op.rank, op.id),
-        ]
-        this.rows.sendData(new MultiSet([[[op.bucket, row], 1]]))
-        sent!.set(op.id, row)
-      }
-    }
-    this.graph.run()
-  }
-
-  /** Retire a bucket without retracting its rows, which a legal graph never does. */
-  retireWithoutRetractions(bucket: BucketKey): void {
-    this.activity.sendData(new MultiSet([[[bucket, true], -1]]))
-    this.graph.run()
-  }
-
-  /** Cancel a contradictory retirement that a failed flush kept pending. */
-  cancelRetirement(bucket: BucketKey): void {
-    this.activity.sendData(new MultiSet([[[bucket, true], 1]]))
-    this.graph.run()
-  }
-
-  /**
-   * Insert a row into a shown facade inside a user transaction that stays
-   * pending, as an application may with a Collection-valued include. The
-   * facade then shows an optimistic row the graph never sent.
-   */
-  addLocal(
-    bucket: BucketKey,
-    sharedId?: number,
-    shown?: { id: number; type: `delete` | `update` },
-  ): void {
-    const facade = this.entry(bucket)?.collection
-    if (!facade) return
-    if (shown && !facade.has(shown.id)) return
-    const id = shown?.id ?? sharedId ?? this.nextLocalId++
-    const transaction = createTransaction({
-      autoCommit: false,
-      mutationFn: () => new Promise<void>(() => {}),
-    })
-    // An optimistic delete or update of a graph row makes the visible rows
-    // differ from the projected synced rows without any hold.
-    transaction.mutate(() => {
-      if (shown?.type === `delete`) facade.delete(id)
-      else if (shown?.type === `update`)
-        // A fresh value, so the update always records a mutation: an empty
-        // transaction is tracked by no Collection, and its rollback would
-        // reject with no handler (core behavior, outside this oracle).
-        facade.update(id, (draft) => {
-          draft.v = 100 + this.nextLocalId++
-        })
-      else facade.insert({ id, v: 0, $key: id } as unknown as Row)
-    })
-    this.localTransactions.push(transaction)
-    const ids = this.localIds.get(facade) ?? new Map()
-    ids.set(id, shown?.type !== `delete`)
-    this.localIds.set(facade, ids)
-  }
-
-  /**
-   * Start a persisting user transaction on a shown facade. While it persists,
-   * the facade holds every sync commit, including the adapter's flush and
-   * rollback writes. Returns a function that settles it.
-   */
-  hold(bucket: BucketKey): (() => Promise<void>) | undefined {
-    const facade = this.entry(bucket)?.collection
-    if (!facade) return undefined
-    const id = this.nextHeldId++
-    this.heldIds.add(id)
-    let settle!: () => void
-    const transaction = createTransaction({
-      autoCommit: false,
-      mutationFn: () =>
-        new Promise<void>((resolve) => {
-          settle = resolve
-        }),
-    })
-    transaction.mutate(() => {
-      facade.insert({ id, v: 0, $key: id } as unknown as Row)
-    })
-    const committed = transaction.commit()
-    return async () => {
-      settle()
-      await committed
-    }
-  }
-
-  /** Count events and stored-row reads for every facade that exists now. */
-  instrument(): void {
-    for (const entry of this.entries().values()) {
-      const facade = entry.collection
-      if (!this.events.has(facade)) {
-        this.events.set(facade, 0)
-        const seen = new Set<number>()
-        facade.subscribeChanges(
-          (messages) => {
-            this.events.set(facade, (this.events.get(facade) ?? 0) + 1)
-            // Change-message protocol: an insert names a key this subscriber
-            // does not have, and an update or delete names one it has.
-            for (const message of messages) {
-              if (seen.has(message.key) === (message.type === `insert`))
-                this.protocolViolations.push(
-                  `${facade.id}: ${message.type} of ${message.key} while ${seen.has(message.key) ? `present` : `absent`}`,
-                )
-              if (message.type === `delete`) seen.delete(message.key)
-              else seen.add(message.key)
-            }
-            const changes = this.changes.get(facade) ?? []
-            changes.push(...messages)
-            this.changes.set(facade, changes)
-            // Start from the facade's current rows, so the replay begins from
-            // what this subscriber has seen. A subscriber without initial state
-            // never hears of rows it was not sent.
-          },
-          { includeInitialState: true },
-        )
-      }
-      const stored = facade._state.syncedData as unknown as Record<
-        PropertyKey,
-        (...args: Array<unknown>) => unknown
-      >
-      if (this.wrapped.has(stored)) continue
-      this.wrapped.add(stored)
-      // The adapter also reads the projected synced rows, held writes included.
-      const state = facade._state as unknown as Record<
-        string,
-        (...args: Array<unknown>) => unknown
-      >
-      for (const method of [`acceptedSyncedEntries`, `getAcceptedSyncedRow`]) {
-        const original = state[method]!.bind(state)
-        state[method] = (...args: Array<unknown>) => {
-          this.reads.set(facade, (this.reads.get(facade) ?? 0) + 1)
-          return original(...args)
-        }
-      }
-      // Every read path of the stored rows: iteration and lookups.
-      for (const method of [
-        Symbol.iterator,
-        `entries`,
-        `keys`,
-        `values`,
-        `get`,
-        `has`,
-      ]) {
-        const original = stored[method]!.bind(stored)
-        stored[method] = (...args: Array<unknown>) => {
-          this.reads.set(facade, (this.reads.get(facade) ?? 0) + 1)
-          return original(...args)
-        }
-      }
-    }
-  }
-
-  /**
-   * Make the facade the flush creates for `bucket` throw from its first
-   * commit. The facade does not exist before the flush, so wrap the adapter's
-   * entry factory for this one flush.
-   */
-  failNewFacade(bucket: BucketKey): void {
-    const adapter = this.adapter as unknown as {
-      getEntry: (edgeId: string, bucketKey: string) => FacadeEntry
-    }
-    const getEntry = adapter.getEntry
-    adapter.getEntry = (edgeId, bucketKey) => {
-      const existed = this.entries().has(bucketKey)
-      const entry = getEntry.call(this.adapter, edgeId, bucketKey)
-      if (!existed && bucketKey === bucket) {
-        adapter.getEntry = getEntry
-        injectFailure(entry.sync!, `commit`)
-      }
-      return entry
-    }
-  }
-
-  /**
-   * Record every facade the next flush creates. A failed flush must dispose
-   * of them, which a holder sees as the facade's public `cleaned-up` status.
-   */
-  recordCreated(): Array<Collection<Row, number>> {
-    const created: Array<Collection<Row, number>> = []
-    const adapter = this.adapter as unknown as {
-      getEntry: (edgeId: string, bucketKey: string) => FacadeEntry
-    }
-    const getEntry = adapter.getEntry
-    const recording = (edgeId: string, bucketKey: string) => {
-      const existed = this.entries().has(bucketKey)
-      const entry = getEntry.call(this.adapter, edgeId, bucketKey)
-      if (!existed) created.push(entry.collection)
-      return entry
-    }
-    adapter.getEntry = recording
-    this.restoreGetEntry = () => {
-      // A one-shot failure wrapper underneath may already have removed both.
-      if (adapter.getEntry === recording) adapter.getEntry = getEntry
-    }
-    return created
-  }
-
-  restoreGetEntry: () => void = () => {}
-
-  eventCounts(): Map<object, number> {
-    return new Map(this.events)
-  }
-
-  /**
-   * Each existing facade's layout revision. The live-query observer compares
-   * it to detect a reorder of a Collection-valued include. A committed batch
-   * advances it when it marks a layout change and the visible key order
-   * changes; a discarded publication restores it.
-   */
-  layoutCounts(): Map<object, number> {
-    return new Map(
-      [...this.entries().values()].map((entry) => [
-        entry.collection,
-        entry.collection._layoutRevision,
-      ]),
-    )
-  }
-
-  /** Change events each facade published since the last call. */
-  takeChanges(): Map<object, Array<ChangeMessage<Row, number>>> {
-    const changes = this.changes
-    this.changes = new Map()
-    return changes
-  }
-
-  /** Facades read since the last call. */
-  takeReads(): Map<object, number> {
-    const reads = this.reads
-    this.reads = new Map()
-    return reads
-  }
-
-  /** The adapter holds exactly the facades the model shows. */
-  checkHeld(model: Model, label: string): void {
-    expect(
-      [...this.entries().keys()].sort(),
-      `${label}: facades held by the adapter`,
-    ).toEqual([...model.keys()].sort())
-  }
-
-  check(model: Model, label: string): void {
-    expect(
-      this.protocolViolations,
-      `${label}: change-message protocol`,
-    ).toEqual([])
-    // The adapter holds exactly the facades the model shows: a failed flush
-    // removes the facades it created, and a retired bucket has no facade.
-    expect(
-      [...this.entries().keys()].sort(),
-      `${label}: facades held by the adapter`,
-    ).toEqual([...model.keys()].sort())
-    // A retired or replaced facade shows only its visible optimistic rows,
-    // including one retired while a hold spanned several flushes.
-    const held = new Set([...this.entries().values()].map((e) => e.collection))
-    for (const facade of held) this.shownFacades.add(facade)
-    for (const facade of this.shownFacades) {
-      if (held.has(facade)) continue
-      const visible = [...this.local(facade)]
-        .filter(([, shown]) => shown)
-        .map(([id]) => id)
-      expect(
-        [...facade.keys()].sort(),
-        `${label}: rows of a retired facade`,
-      ).toEqual(visible.sort())
-    }
-    for (const bucket of BUCKETS) {
-      const rows = model.get(bucket)
-      const facade = this.entry(bucket)?.collection
-      if (!rows) continue
-      expect(facade, `${label}: facade ${bucket}`).toBeDefined()
-      // A facade the model shows has been made ready by the flush that
-      // created it.
-      expect(facade!.status, `${label}: status of ${bucket}`).toBe(`ready`)
-      // An optimistic row overlays a graph row with the same id, so neither is
-      // compared by value.
-      const local = this.local(facade!)
-      expect(
-        facade!.toArray
-          .map(stripVirtualProps)
-          .filter((row) => !local.has(row.id)),
-        `${label}: rows of ${bucket}`,
-      ).toEqual(expectedRows(rows).filter((row) => !local.has(row.id)))
-      for (const [id, visible] of local) {
-        expect(facade!.has(id), `${label}: local row ${bucket}/${id}`).toBe(
-          visible,
-        )
-      }
-      for (const id of rows.keys()) {
-        if (local.has(id)) continue
-        const stored = facade!.get(id)
-        expect(stored, `${label}: row ${bucket}/${id}`).toBeDefined()
-        expect(facade!.getKeyFromItem(stored!), `${label}: key ${id}`).toBe(id)
-      }
-    }
-  }
-
-  /** Change messages that were invalid for the subscriber that got them. */
-  readonly protocolViolations: Array<string> = []
-
-  /** Every facade a check has seen the adapter hold. */
-  private readonly shownFacades = new Set<Collection<any, any, any>>()
-
-  /**
-   * Try to clean up a shown facade from outside the adapter, as a holder
-   * might. Its live query owns it, so the call throws and the facade keeps
-   * receiving the graph's writes.
-   */
-  async attemptCleanup(bucket: BucketKey): Promise<void> {
-    const facade = this.entry(bucket)?.collection
-    if (!facade) return
-    await expect(facade.cleanup(), `holder cleanup`).rejects.toThrow(
-      /cannot be cleaned up directly/,
-    )
-    expect(facade.status, `status after a refused cleanup`).toBe(`ready`)
-  }
-
-  /**
-   * Roll back every open optimistic transaction. Its rows leave, so a graph
-   * row that shared one of their ids is compared by value from now on.
-   */
-  settleLocals(): void {
-    for (const transaction of this.localTransactions.splice(0))
-      transaction.rollback()
-    this.localIds = new WeakMap()
-  }
-
-  /** Optimistic row ids on a facade. */
-  local(facade: object): Map<number, boolean> {
-    return this.localIds.get(facade) ?? new Map()
-  }
-
-  async cleanup(): Promise<void> {
-    for (const transaction of this.localTransactions) transaction.rollback()
-    this.adapter.cleanup()
-    await Promise.resolve()
-  }
-}
-
 /** The row ids a facade's events may name after these operations. */
 function touchedIds(
   bucket: BucketKey,
@@ -1279,6 +774,15 @@ const step = fc.record({
   settleLocal: fc.integer({ min: 0, max: 5 }).map((n) => n === 0),
 })
 const history = fc.array(step, { minLength: 1, maxLength: 8 })
+// The parts this file declares. runHistory runs one generated or pinned
+// history through the real adapter and compares it with the model after each
+// flush; checkEvents is its exactly-once publication comparison. The model
+// predicts the rows that each flush owes, which events it may name, and which
+// layout revision it owes.
+declareOracle({
+  check: [runHistory, checkEvents],
+  model: [applyOps, layoutExpectation, shownLayoutExpectation, touchedIds],
+})
 
 describe(`bucket facade rollback`, () => {
   it(`restores written facades and reads no others (fixed campaign)`, async () => {
@@ -1296,40 +800,6 @@ describe(`bucket facade rollback`, () => {
     )
   })
 
-  // Pinned: a list of 50 buckets with 3 rows each, where one insert touches
-  // one bucket. The flush must read that bucket's rows and no others.
-  it(`reads only the written facade in a wide list`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        const wide = Array.from({ length: 50 }, (_, index) => `w${index}`)
-        for (const bucket of wide) {
-          driver.send([
-            { type: `activate`, bucket },
-            ...[1, 2, 3].map((id): Op => ({
-              type: `insert`,
-              bucket,
-              id,
-              v: id,
-              rank: id,
-            })),
-          ])
-        }
-        driver.adapter.flush().publish()
-        driver.instrument()
-        driver.send([{ type: `insert`, bucket: `w7`, id: 4, v: 4, rank: 4 }])
-        driver.takeReads()
-        driver.adapter.flush().publish()
-        const written = driver.entry(`w7`)!.collection
-        const untouchedReads = [...driver.takeReads()]
-          .filter(([facade]) => facade !== written)
-          .map(([facade]) => (facade as Collection<Row, number>).id)
-        expect(untouchedReads).toEqual([])
-      },
-      () => driver.cleanup(),
-    )
-  })
-
   // Pinned: a flush that reorders a shown row throws. The retried flush must
   // still publish the layout change, so the failed flush must not leave its
   // new order behind as the facade's current order.
@@ -1410,197 +880,6 @@ describe(`bucket facade rollback`, () => {
     ])
   })
 
-  // Pinned: nested facades. A parent facade's row refers to a child facade.
-  // The child edge commits first, then the parent edge's commit throws. The
-  // failed flush must restore the child's rows, keep the parent's reference
-  // to the old child facade, and drop the child facade it created. The retry
-  // then applies every change.
-  it(`restores a child facade when its parent edge fails`, async () => {
-    const graph = new D2()
-    const childRows = graph.newInput<[string, BucketRow]>()
-    const childActive = graph.newInput<[string, true]>()
-    const parentRows = graph.newInput<[string, BucketRow]>()
-    const parentActive = graph.newInput<[string, true]>()
-    const adapter = new BucketFacadeAdapter(
-      `rollback-oracle-nested-${Math.random()}`,
-      [
-        {
-          edgeId: `children`,
-          rows: childRows,
-          activeBuckets: childActive,
-          hasOrderBy: false,
-        },
-        {
-          edgeId: `parents`,
-          rows: parentRows,
-          activeBuckets: parentActive,
-          hasOrderBy: false,
-        },
-      ],
-      () => {},
-    )
-    graph.finalize()
-    const entries = (
-      adapter as unknown as {
-        entries: Map<string, Map<string, FacadeEntry>>
-      }
-    ).entries
-    const facade = (edgeId: string, bucket: string) =>
-      entries.get(edgeId)?.get(bucket)?.collection
-    const ref = (bucketKey: string) => ({
-      [BUCKET_FACADE_REF]: { edgeId: `children`, bucketKey },
-    })
-    const row = (publicKey: number, value: object): BucketRow => [
-      publicKey,
-      value,
-      undefined,
-    ]
-    const child10 = row(10, { id: 10, v: 1 })
-    const parent1 = row(1, { id: 1, kids: ref(`c1`) })
-
-    await withCleanup(
-      () => {
-        childActive.sendData(new MultiSet([[[`c1`, true], 1]]))
-        childRows.sendData(new MultiSet([[[`c1`, child10], 1]]))
-        parentActive.sendData(new MultiSet([[[`p1`, true], 1]]))
-        parentRows.sendData(new MultiSet([[[`p1`, parent1], 1]]))
-        graph.run()
-        adapter.flush().publish()
-        const c1 = facade(`children`, `c1`)!
-        const p1 = facade(`parents`, `p1`)!
-        expect(kidsOf(p1.get(1))).toBe(c1)
-
-        let events = 0
-        c1.subscribeChanges(() => events++)
-        p1.subscribeChanges(() => events++)
-
-        // The flush updates c1, creates c2, and moves parent 1 to c2.
-        const child10v2 = row(10, { id: 10, v: 2 })
-        const child11 = row(11, { id: 11, v: 1 })
-        const parent1moved = row(1, { id: 1, kids: ref(`c2`) })
-        childRows.sendData(
-          new MultiSet([
-            [[`c1`, child10], -1],
-            [[`c1`, child10v2], 1],
-          ]),
-        )
-        childActive.sendData(new MultiSet([[[`c2`, true], 1]]))
-        childRows.sendData(new MultiSet([[[`c2`, child11], 1]]))
-        parentRows.sendData(
-          new MultiSet([
-            [[`p1`, parent1], -1],
-            [[`p1`, parent1moved], 1],
-          ]),
-        )
-        graph.run()
-        injectFailure(entries.get(`parents`)!.get(`p1`)!.sync!, `commit`)
-
-        expect(() => adapter.flush()).toThrow(`injected facade write failure`)
-        expect(c1.toArray.map(stripVirtualProps)).toEqual([{ id: 10, v: 1 }])
-        expect(kidsOf(p1.get(1))).toBe(c1)
-        expect([...entries.get(`children`)!.keys()]).toEqual([`c1`])
-        expect(events).toBe(0)
-
-        // The retry applies the pending changes the failed flush kept.
-        adapter.flush().publish()
-        const c2 = facade(`children`, `c2`)!
-        expect(c1.toArray.map(stripVirtualProps)).toEqual([{ id: 10, v: 2 }])
-        expect(c2.toArray.map(stripVirtualProps)).toEqual([{ id: 11, v: 1 }])
-        expect(kidsOf(p1.get(1))).toBe(c2)
-      },
-      async () => {
-        adapter.cleanup()
-        await Promise.resolve()
-      },
-    )
-  })
-
-  // Calibration for ORC-010: when the history fails and cleanup also throws,
-  // the report keeps the history's failure as its cause.
-  it(`keeps the oracle failure when cleanup also fails`, async () => {
-    const failure = new Error(`oracle assertion`)
-    const cleanupFailure = new Error(`cleanup failure`)
-    const result = await withCleanup(
-      () => Promise.reject(failure),
-      () => Promise.reject(cleanupFailure),
-    ).then(
-      () => undefined,
-      (error: unknown) => error,
-    )
-    expect(result).toBeInstanceOf(AggregateError)
-    const aggregate = result as AggregateError
-    expect(aggregate.cause).toBe(failure)
-    expect(aggregate.errors).toEqual([failure, cleanupFailure])
-
-    // Without a history failure, the cleanup failure is reported as is.
-    await expect(
-      withCleanup(
-        () => Promise.resolve(),
-        () => Promise.reject(cleanupFailure),
-      ),
-    ).rejects.toBe(cleanupFailure)
-  })
-
-  // Invariant witness: the flush runs inside the graph run, so graph output
-  // cannot reach the adapter before its rollback. If it did, restoring the
-  // consumed deltas would overwrite it, so the rollback throws instead.
-  it(`throws when graph output arrives between a flush and its rollback`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        driver.send([{ type: `update`, bucket: `b0`, id: 1, v: 2, rank: 1 }])
-        const publication = driver.adapter.flush()
-        driver.send([{ type: `insert`, bucket: `b0`, id: 2, v: 3, rank: 2 }])
-        expect(() => publication.rollback()).toThrow(
-          `Bucket facade received graph output between a flush and its rollback`,
-        )
-        // The rollback restored the facade and closed its deferral before it
-        // threw, so the new delta still publishes on the next flush.
-        const facade = driver.entry(`b0`)!.collection
-        expect(facade.toArray.map(stripVirtualProps)).toEqual([{ id: 1, v: 1 }])
-        let events = 0
-        facade.subscribeChanges(() => {
-          events++
-        })
-        driver.adapter.flush().publish()
-        expect(facade.toArray.map(stripVirtualProps)).toEqual([
-          { id: 1, v: 1 },
-          { id: 2, v: 3 },
-        ])
-        expect(events).toBe(1)
-      },
-      () => driver.cleanup(),
-    )
-  })
-
-  // A live query can be disposed between a flush and its rollback, for
-  // example by a listener that runs during the root commit. The rollback then
-  // has nothing to restore and must not bring the disposed facades back.
-  it(`does nothing on rollback after cleanup`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        driver.send([{ type: `update`, bucket: `b0`, id: 1, v: 2, rank: 1 }])
-        const publication = driver.adapter.flush()
-        driver.adapter.cleanup()
-        publication.rollback()
-        expect(driver.entry(`b0`)).toBeUndefined()
-        expect(driver.adapter.hasPendingChanges()).toBe(false)
-      },
-      () => driver.cleanup(),
-    )
-  })
-
   // A retired facade can still show rows the graph never sent: an optimistic
   // row from a pending user transaction, or a held sync commit behind a
   // persisting one. Retiring the bucket must not fail the flush.
@@ -1623,84 +902,6 @@ describe(`bucket facade rollback`, () => {
     ])
   })
 
-  it(`retires a bucket while a facade transaction persists`, async () => {
-    const driver = new Driver()
-    let settle!: () => void
-    await withCleanup(
-      async () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        const facade = driver.entry(`b0`)!.collection
-        const transaction = createTransaction({
-          autoCommit: false,
-          mutationFn: () =>
-            new Promise<void>((resolve) => {
-              settle = resolve
-            }),
-        })
-        transaction.mutate(() => {
-          facade.insert({ id: 50, v: 0, $key: 50 } as unknown as Row)
-        })
-        const committed = transaction.commit()
-        driver.send([{ type: `retire`, bucket: `b0` }])
-        expect(() => driver.adapter.flush().publish()).not.toThrow()
-        expect(driver.entry(`b0`)).toBeUndefined()
-        settle()
-        await committed
-      },
-      () => driver.cleanup(),
-    )
-  })
-
-  // The graph retracts a bucket's rows before it retires the bucket, so a
-  // row the graph sent and never retracted is a contradictory graph signal.
-  // The flush throws and restores the facade, as for any failed flush.
-  it(`throws when a retired bucket still has rows the graph sent`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        const facade = driver.entry(`b0`)!.collection
-        driver.retireWithoutRetractions(`b0`)
-        expect(() => driver.adapter.flush()).toThrow(
-          `Bucket facade retired with rows the graph did not retract`,
-        )
-        expect(driver.entry(`b0`)?.collection).toBe(facade)
-        expect(facade.toArray.map(stripVirtualProps)).toEqual([{ id: 1, v: 1 }])
-      },
-      () => driver.cleanup(),
-    )
-  })
-
-  // The retraction is an ordinary facade write, so a rollback restores it.
-  it(`restores a retired facade's rows when the root commit fails`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        const facade = driver.entry(`b0`)!.collection
-        driver.send([{ type: `retire`, bucket: `b0` }])
-        const publication = driver.adapter.flush()
-        publication.prepare()
-        publication.rollback()
-        expect(driver.entry(`b0`)?.collection).toBe(facade)
-        expect(facade.toArray.map(stripVirtualProps)).toEqual([{ id: 1, v: 1 }])
-      },
-      () => driver.cleanup(),
-    )
-  })
-
   // Pinned: a failed flush that writes two existing buckets and retires a
   // third restores all three, then the retried flush applies everything.
   it(`restores two written buckets and a retired bucket, then retries`, async () => {
@@ -1734,104 +935,6 @@ describe(`bucket facade rollback`, () => {
     ])
   })
 
-  // A throwing subscriber of one facade must not keep another facade's
-  // deferral open. Each facade publishes, then the first error is rethrown.
-  it(`publishes every facade when one facade's subscriber throws`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `activate`, bucket: `b1` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-          { type: `insert`, bucket: `b1`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        const subscriberError = new Error(`subscriber failure`)
-        const throwing = driver.entry(`b0`)!.collection.subscribeChanges(() => {
-          throw subscriberError
-        })
-        const keys: Array<number> = []
-        driver
-          .entry(`b1`)!
-          .collection.subscribeChanges((changes) =>
-            keys.push(...changes.map((change) => change.key)),
-          )
-        driver.send([
-          { type: `insert`, bucket: `b0`, id: 2, v: 1, rank: 2 },
-          { type: `insert`, bucket: `b1`, id: 2, v: 1, rank: 2 },
-        ])
-        expect(() => driver.adapter.flush().publish()).toThrow(subscriberError)
-        expect(keys).toEqual([2])
-        throwing.unsubscribe()
-        driver.send([{ type: `insert`, bucket: `b1`, id: 3, v: 1, rank: 3 }])
-        driver.adapter.flush().publish()
-        expect(keys).toEqual([2, 3])
-      },
-      () => driver.cleanup(),
-    )
-  })
-
-  // A failed flush whose restore also throws still discards every deferral,
-  // so the facade publishes the next successful flush.
-  it(`keeps publishing a facade after its restore throws`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        const entry = driver.entry(`b0`)!
-        const keys: Array<number> = []
-        entry.collection.subscribeChanges((changes) =>
-          keys.push(...changes.map((change) => change.key)),
-        )
-        driver.send([{ type: `insert`, bucket: `b0`, id: 2, v: 1, rank: 2 }])
-        const publication = driver.adapter.flush()
-        publication.prepare()
-        // The restore's commit throws.
-        injectFailure(entry.sync!, `commit`)
-        expect(() => publication.rollback()).toThrow(
-          `injected facade write failure`,
-        )
-        driver.send([{ type: `insert`, bucket: `b0`, id: 3, v: 1, rank: 3 }])
-        driver.adapter.flush().publish()
-        expect(keys).toContain(3)
-      },
-      () => driver.cleanup(),
-    )
-  })
-
-  // A flush with no facade changes copies no bookkeeping, so a root-only
-  // write does no work proportional to the number of buckets.
-  it(`copies nothing for a flush without facade changes`, async () => {
-    const driver = new Driver()
-    await withCleanup(
-      () => {
-        driver.send([
-          { type: `activate`, bucket: `b0` },
-          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
-        ])
-        driver.adapter.flush().publish()
-        const adapter = driver.adapter as unknown as { snapshot: () => unknown }
-        let snapshots = 0
-        const snapshot = adapter.snapshot
-        adapter.snapshot = () => {
-          snapshots++
-          return snapshot.call(driver.adapter)
-        }
-        const publication = driver.adapter.flush()
-        publication.prepare()
-        publication.rollback()
-        driver.adapter.flush().publish()
-        expect(snapshots).toBe(0)
-      },
-      () => driver.cleanup(),
-    )
-  })
-
   // Pinned replay of a generated failure: an update to a row that an earlier
   // flush wrote behind a still-persisting transaction keeps the row.
   it(`updates a row that a persisting transaction still holds`, async () => {
diff --git a/packages/db/tests/query/bucket-facade-rollback-support.ts b/packages/db/tests/query/bucket-facade-rollback-support.ts
new file mode 100644
index 0000000000..856b133212
--- /dev/null
+++ b/packages/db/tests/query/bucket-facade-rollback-support.ts
@@ -0,0 +1,527 @@
+import { D2, MultiSet } from '@tanstack/db-ivm'
+import { expect } from 'vitest'
+import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
+import { createTransaction } from '../../src/transactions.js'
+import { stripVirtualProps } from '../utils.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { ChangeMessage, SyncConfig } from '../../src/types.js'
+import type { Transaction } from '../../src/transactions.js'
+import type { BucketRow } from '../../src/query/live/materialized-pipeline.js'
+
+/**
+ * Shared adapter driver for the bucket-facade rollback oracle
+ * (bucket-facade-rollback-oracle.property.test.ts), which owns the law. The
+ * Driver runs the real BucketFacadeAdapter over a D2 graph and observes the
+ * facades it holds. Its check method compares what it observes with a model
+ * that the oracle supplies, so the oracle's runHistory is the declared check.
+ * The helpers here do not declare any part of their own.
+ */
+
+export const BUCKETS = [`b0`, `b1`, `b2`, `b3`] as const
+
+export type BucketKey = string
+export type Row = { id: number; v: number }
+export type ModelRow = { value: Row; order: string }
+export type Model = Map<BucketKey, Map<number, ModelRow>>
+
+export type Op =
+  | { type: `activate`; bucket: BucketKey }
+  | { type: `insert`; bucket: BucketKey; id: number; v: number; rank: number }
+  | { type: `update`; bucket: BucketKey; id: number; v: number; rank: number }
+  | { type: `delete`; bucket: BucketKey; id: number }
+  | { type: `retire`; bucket: BucketKey }
+
+type FacadeSync = Parameters<SyncConfig<Record<string, unknown>>[`sync`]>[0]
+export type FacadeEntry = {
+  collection: Collection<Row, number>
+  sync: FacadeSync | undefined
+}
+
+/** The rows a facade must show, in order. */
+export function expectedRows(
+  rows: Map<number, ModelRow> | undefined,
+): Array<Row> {
+  return [...(rows?.values() ?? [])]
+    .sort((left, right) => (left.order < right.order ? -1 : 1))
+    .map((row) => row.value)
+}
+
+/**
+ * Run `body`, then `cleanup`. When both throw, keep the body's failure as the
+ * primary error: an AggregateError whose `cause` is that failure and whose
+ * `errors` list it before the cleanup error (ORC-010).
+ */
+export async function withCleanup(
+  body: () => void | Promise<void>,
+  cleanup: () => Promise<void>,
+): Promise<void> {
+  let failure: { error: unknown } | undefined
+  try {
+    await body()
+  } catch (error) {
+    failure = { error }
+  }
+  try {
+    await cleanup()
+  } catch (cleanupError) {
+    if (!failure) throw cleanupError
+    throw new AggregateError(
+      [failure.error, cleanupError],
+      `oracle failure, then cleanup failure`,
+      { cause: failure.error },
+    )
+  }
+  if (failure) throw failure.error
+}
+
+export function orderOf(rank: number, id: number): string {
+  return `${rank}:${id}`
+}
+
+/**
+ * Make the next `commit` or `write` of a facade's sync throw once. A `write`
+ * failure leaves the facade's sync transaction open, as a validation error
+ * from a real write would.
+ */
+export function injectFailure(
+  sync: FacadeSync,
+  method: `commit` | `write` | `staged`,
+): void {
+  if (method === `staged`) {
+    // The facade's writes are staged, then the commit throws before it
+    // commits, so the sync transaction stays open with those writes.
+    const commit = sync.commit
+    sync.commit = () => {
+      sync.commit = commit
+      throw new Error(`injected facade write failure`)
+    }
+    return
+  }
+  if (method === `commit`) {
+    const commit = sync.commit
+    sync.commit = () => {
+      sync.commit = commit
+      commit()
+      throw new Error(`injected facade write failure`)
+    }
+    return
+  }
+  const write = sync.write
+  sync.write = () => {
+    sync.write = write
+    throw new Error(`injected facade write failure`)
+  }
+}
+
+export class Driver {
+  private readonly graph = new D2()
+  private readonly rows = this.graph.newInput<[string, BucketRow]>()
+  private readonly activity = this.graph.newInput<[string, true]>()
+  readonly adapter: BucketFacadeAdapter
+  private readonly events = new Map<object, number>()
+  private changes = new Map<object, Array<ChangeMessage<Row, number>>>()
+  private readonly wrapped = new WeakSet<object>()
+  private reads = new Map<object, number>()
+  private readonly sent = new Map<BucketKey, Map<number, BucketRow>>()
+  // Rows a user transaction inserted into a facade. They are optimistic, so
+  // the graph never sent them and the model's synced rows do not hold them.
+  /** Optimistic row ids per facade, and whether the row is visible. */
+  private localIds = new WeakMap<object, Map<number, boolean>>()
+  private readonly localTransactions: Array<Transaction> = []
+  private nextLocalId = 100
+  // Rows of a persisting user transaction that holds a facade's sync commits.
+  // The transaction settles without a sync write, so its row then leaves.
+  readonly heldIds = new Set<number>()
+  private nextHeldId = 1000
+
+  constructor() {
+    this.adapter = new BucketFacadeAdapter(
+      `rollback-oracle-${Math.random()}`,
+      [
+        {
+          edgeId: `children`,
+          rows: this.rows,
+          activeBuckets: this.activity,
+          hasOrderBy: true,
+        },
+      ],
+      () => {},
+    )
+    this.graph.finalize()
+  }
+
+  private entries(): Map<string, FacadeEntry> {
+    return (
+      (
+        this.adapter as unknown as {
+          entries: Map<string, Map<string, FacadeEntry>>
+        }
+      ).entries.get(`children`) ?? new Map()
+    )
+  }
+
+  entry(bucket: BucketKey): FacadeEntry | undefined {
+    return this.entries().get(bucket)
+  }
+
+  /** Send operations to the graph as the materialization graph would. */
+  send(ops: ReadonlyArray<Op>): void {
+    for (const op of ops) {
+      const sent = this.sent.get(op.bucket)
+      if (op.type === `activate`) {
+        this.activity.sendData(new MultiSet([[[op.bucket, true], 1]]))
+        this.sent.set(op.bucket, new Map())
+      } else if (op.type === `retire`) {
+        for (const row of sent?.values() ?? []) {
+          this.rows.sendData(new MultiSet([[[op.bucket, row], -1]]))
+        }
+        this.activity.sendData(new MultiSet([[[op.bucket, true], -1]]))
+        this.sent.delete(op.bucket)
+      } else if (op.type === `delete`) {
+        this.rows.sendData(new MultiSet([[[op.bucket, sent!.get(op.id)!], -1]]))
+        sent!.delete(op.id)
+      } else {
+        const previous = sent!.get(op.id)
+        if (previous) {
+          this.rows.sendData(new MultiSet([[[op.bucket, previous], -1]]))
+        }
+        const row: BucketRow = [
+          op.id,
+          { id: op.id, v: op.v },
+          orderOf(op.rank, op.id),
+        ]
+        this.rows.sendData(new MultiSet([[[op.bucket, row], 1]]))
+        sent!.set(op.id, row)
+      }
+    }
+    this.graph.run()
+  }
+
+  /** Retire a bucket without retracting its rows, which a legal graph never does. */
+  retireWithoutRetractions(bucket: BucketKey): void {
+    this.activity.sendData(new MultiSet([[[bucket, true], -1]]))
+    this.graph.run()
+  }
+
+  /** Cancel a contradictory retirement that a failed flush kept pending. */
+  cancelRetirement(bucket: BucketKey): void {
+    this.activity.sendData(new MultiSet([[[bucket, true], 1]]))
+    this.graph.run()
+  }
+
+  /**
+   * Insert a row into a shown facade inside a user transaction that stays
+   * pending, as an application may with a Collection-valued include. The
+   * facade then shows an optimistic row the graph never sent.
+   */
+  addLocal(
+    bucket: BucketKey,
+    sharedId?: number,
+    shown?: { id: number; type: `delete` | `update` },
+  ): void {
+    const facade = this.entry(bucket)?.collection
+    if (!facade) return
+    if (shown && !facade.has(shown.id)) return
+    const id = shown?.id ?? sharedId ?? this.nextLocalId++
+    const transaction = createTransaction({
+      autoCommit: false,
+      mutationFn: () => new Promise<void>(() => {}),
+    })
+    // An optimistic delete or update of a graph row makes the visible rows
+    // differ from the projected synced rows without any hold.
+    transaction.mutate(() => {
+      if (shown?.type === `delete`) facade.delete(id)
+      else if (shown?.type === `update`)
+        // A fresh value, so the update always records a mutation: an empty
+        // transaction is tracked by no Collection, and its rollback would
+        // reject with no handler (core behavior, outside this oracle).
+        facade.update(id, (draft) => {
+          draft.v = 100 + this.nextLocalId++
+        })
+      else facade.insert({ id, v: 0, $key: id } as unknown as Row)
+    })
+    this.localTransactions.push(transaction)
+    const ids = this.localIds.get(facade) ?? new Map()
+    ids.set(id, shown?.type !== `delete`)
+    this.localIds.set(facade, ids)
+  }
+
+  /**
+   * Start a persisting user transaction on a shown facade. While it persists,
+   * the facade holds every sync commit, including the adapter's flush and
+   * rollback writes. Returns a function that settles it.
+   */
+  hold(bucket: BucketKey): (() => Promise<void>) | undefined {
+    const facade = this.entry(bucket)?.collection
+    if (!facade) return undefined
+    const id = this.nextHeldId++
+    this.heldIds.add(id)
+    let settle!: () => void
+    const transaction = createTransaction({
+      autoCommit: false,
+      mutationFn: () =>
+        new Promise<void>((resolve) => {
+          settle = resolve
+        }),
+    })
+    transaction.mutate(() => {
+      facade.insert({ id, v: 0, $key: id } as unknown as Row)
+    })
+    const committed = transaction.commit()
+    return async () => {
+      settle()
+      await committed
+    }
+  }
+
+  /** Count events and stored-row reads for every facade that exists now. */
+  instrument(): void {
+    for (const entry of this.entries().values()) {
+      const facade = entry.collection
+      if (!this.events.has(facade)) {
+        this.events.set(facade, 0)
+        const seen = new Set<number>()
+        facade.subscribeChanges(
+          (messages) => {
+            this.events.set(facade, (this.events.get(facade) ?? 0) + 1)
+            // Change-message protocol: an insert names a key this subscriber
+            // does not have, and an update or delete names one it has.
+            for (const message of messages) {
+              if (seen.has(message.key) === (message.type === `insert`))
+                this.protocolViolations.push(
+                  `${facade.id}: ${message.type} of ${message.key} while ${seen.has(message.key) ? `present` : `absent`}`,
+                )
+              if (message.type === `delete`) seen.delete(message.key)
+              else seen.add(message.key)
+            }
+            const changes = this.changes.get(facade) ?? []
+            changes.push(...messages)
+            this.changes.set(facade, changes)
+            // Start from the facade's current rows, so the replay begins from
+            // what this subscriber has seen. A subscriber without initial state
+            // never hears of rows it was not sent.
+          },
+          { includeInitialState: true },
+        )
+      }
+      const stored = facade._state.syncedData as unknown as Record<
+        PropertyKey,
+        (...args: Array<unknown>) => unknown
+      >
+      if (this.wrapped.has(stored)) continue
+      this.wrapped.add(stored)
+      // The adapter also reads the projected synced rows, held writes included.
+      const state = facade._state as unknown as Record<
+        string,
+        (...args: Array<unknown>) => unknown
+      >
+      for (const method of [`acceptedSyncedEntries`, `getAcceptedSyncedRow`]) {
+        const original = state[method]!.bind(state)
+        state[method] = (...args: Array<unknown>) => {
+          this.reads.set(facade, (this.reads.get(facade) ?? 0) + 1)
+          return original(...args)
+        }
+      }
+      // Every read path of the stored rows: iteration and lookups.
+      for (const method of [
+        Symbol.iterator,
+        `entries`,
+        `keys`,
+        `values`,
+        `get`,
+        `has`,
+      ]) {
+        const original = stored[method]!.bind(stored)
+        stored[method] = (...args: Array<unknown>) => {
+          this.reads.set(facade, (this.reads.get(facade) ?? 0) + 1)
+          return original(...args)
+        }
+      }
+    }
+  }
+
+  /**
+   * Make the facade the flush creates for `bucket` throw from its first
+   * commit. The facade does not exist before the flush, so wrap the adapter's
+   * entry factory for this one flush.
+   */
+  failNewFacade(bucket: BucketKey): void {
+    const adapter = this.adapter as unknown as {
+      getEntry: (edgeId: string, bucketKey: string) => FacadeEntry
+    }
+    const getEntry = adapter.getEntry
+    adapter.getEntry = (edgeId, bucketKey) => {
+      const existed = this.entries().has(bucketKey)
+      const entry = getEntry.call(this.adapter, edgeId, bucketKey)
+      if (!existed && bucketKey === bucket) {
+        adapter.getEntry = getEntry
+        injectFailure(entry.sync!, `commit`)
+      }
+      return entry
+    }
+  }
+
+  /**
+   * Record every facade the next flush creates. A failed flush must dispose
+   * of them, which a holder sees as the facade's public `cleaned-up` status.
+   */
+  recordCreated(): Array<Collection<Row, number>> {
+    const created: Array<Collection<Row, number>> = []
+    const adapter = this.adapter as unknown as {
+      getEntry: (edgeId: string, bucketKey: string) => FacadeEntry
+    }
+    const getEntry = adapter.getEntry
+    const recording = (edgeId: string, bucketKey: string) => {
+      const existed = this.entries().has(bucketKey)
+      const entry = getEntry.call(this.adapter, edgeId, bucketKey)
+      if (!existed) created.push(entry.collection)
+      return entry
+    }
+    adapter.getEntry = recording
+    this.restoreGetEntry = () => {
+      // A one-shot failure wrapper underneath may already have removed both.
+      if (adapter.getEntry === recording) adapter.getEntry = getEntry
+    }
+    return created
+  }
+
+  restoreGetEntry: () => void = () => {}
+
+  eventCounts(): Map<object, number> {
+    return new Map(this.events)
+  }
+
+  /**
+   * Each existing facade's layout revision. The live-query observer compares
+   * it to detect a reorder of a Collection-valued include. A committed batch
+   * advances it when it marks a layout change and the visible key order
+   * changes; a discarded publication restores it.
+   */
+  layoutCounts(): Map<object, number> {
+    return new Map(
+      [...this.entries().values()].map((entry) => [
+        entry.collection,
+        entry.collection._layoutRevision,
+      ]),
+    )
+  }
+
+  /** Change events each facade published since the last call. */
+  takeChanges(): Map<object, Array<ChangeMessage<Row, number>>> {
+    const changes = this.changes
+    this.changes = new Map()
+    return changes
+  }
+
+  /** Facades read since the last call. */
+  takeReads(): Map<object, number> {
+    const reads = this.reads
+    this.reads = new Map()
+    return reads
+  }
+
+  /** The adapter holds exactly the facades the model shows. */
+  checkHeld(model: Model, label: string): void {
+    expect(
+      [...this.entries().keys()].sort(),
+      `${label}: facades held by the adapter`,
+    ).toEqual([...model.keys()].sort())
+  }
+
+  check(model: Model, label: string): void {
+    expect(
+      this.protocolViolations,
+      `${label}: change-message protocol`,
+    ).toEqual([])
+    // The adapter holds exactly the facades the model shows: a failed flush
+    // removes the facades it created, and a retired bucket has no facade.
+    expect(
+      [...this.entries().keys()].sort(),
+      `${label}: facades held by the adapter`,
+    ).toEqual([...model.keys()].sort())
+    // A retired or replaced facade shows only its visible optimistic rows,
+    // including one retired while a hold spanned several flushes.
+    const held = new Set([...this.entries().values()].map((e) => e.collection))
+    for (const facade of held) this.shownFacades.add(facade)
+    for (const facade of this.shownFacades) {
+      if (held.has(facade)) continue
+      const visible = [...this.local(facade)]
+        .filter(([, shown]) => shown)
+        .map(([id]) => id)
+      expect(
+        [...facade.keys()].sort(),
+        `${label}: rows of a retired facade`,
+      ).toEqual(visible.sort())
+    }
+    for (const bucket of BUCKETS) {
+      const rows = model.get(bucket)
+      const facade = this.entry(bucket)?.collection
+      if (!rows) continue
+      expect(facade, `${label}: facade ${bucket}`).toBeDefined()
+      // A facade the model shows has been made ready by the flush that
+      // created it.
+      expect(facade!.status, `${label}: status of ${bucket}`).toBe(`ready`)
+      // An optimistic row overlays a graph row with the same id, so neither is
+      // compared by value.
+      const local = this.local(facade!)
+      expect(
+        facade!.toArray
+          .map(stripVirtualProps)
+          .filter((row) => !local.has(row.id)),
+        `${label}: rows of ${bucket}`,
+      ).toEqual(expectedRows(rows).filter((row) => !local.has(row.id)))
+      for (const [id, visible] of local) {
+        expect(facade!.has(id), `${label}: local row ${bucket}/${id}`).toBe(
+          visible,
+        )
+      }
+      for (const id of rows.keys()) {
+        if (local.has(id)) continue
+        const stored = facade!.get(id)
+        expect(stored, `${label}: row ${bucket}/${id}`).toBeDefined()
+        expect(facade!.getKeyFromItem(stored!), `${label}: key ${id}`).toBe(id)
+      }
+    }
+  }
+
+  /** Change messages that were invalid for the subscriber that got them. */
+  readonly protocolViolations: Array<string> = []
+
+  /** Every facade a check has seen the adapter hold. */
+  private readonly shownFacades = new Set<Collection<any, any, any>>()
+
+  /**
+   * Try to clean up a shown facade from outside the adapter, as a holder
+   * might. Its live query owns it, so the call throws and the facade keeps
+   * receiving the graph's writes.
+   */
+  async attemptCleanup(bucket: BucketKey): Promise<void> {
+    const facade = this.entry(bucket)?.collection
+    if (!facade) return
+    await expect(facade.cleanup(), `holder cleanup`).rejects.toThrow(
+      /cannot be cleaned up directly/,
+    )
+    expect(facade.status, `status after a refused cleanup`).toBe(`ready`)
+  }
+
+  /**
+   * Roll back every open optimistic transaction. Its rows leave, so a graph
+   * row that shared one of their ids is compared by value from now on.
+   */
+  settleLocals(): void {
+    for (const transaction of this.localTransactions.splice(0))
+      transaction.rollback()
+    this.localIds = new WeakMap()
+  }
+
+  /** Optimistic row ids on a facade. */
+  local(facade: object): Map<number, boolean> {
+    return this.localIds.get(facade) ?? new Map()
+  }
+
+  async cleanup(): Promise<void> {
+    for (const transaction of this.localTransactions) transaction.rollback()
+    this.adapter.cleanup()
+    await Promise.resolve()
+  }
+}
diff --git a/packages/db/tests/query/bucket-facade-rollback.test.ts b/packages/db/tests/query/bucket-facade-rollback.test.ts
new file mode 100644
index 0000000000..ab8b55381d
--- /dev/null
+++ b/packages/db/tests/query/bucket-facade-rollback.test.ts
@@ -0,0 +1,419 @@
+import { D2, MultiSet } from '@tanstack/db-ivm'
+import { describe, expect, it } from 'vitest'
+import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
+import { createTransaction } from '../../src/transactions.js'
+import { stripVirtualProps } from '../utils.js'
+import { BUCKET_FACADE_REF } from '../../src/query/live/materialized-pipeline.js'
+import {
+  Driver,
+  injectFailure,
+  withCleanup,
+} from './bucket-facade-rollback-support.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { BucketRow } from '../../src/query/live/materialized-pipeline.js'
+import type { FacadeEntry, Op, Row } from './bucket-facade-rollback-support.js'
+
+// Unit tests for the bucket-facade rollback oracle. Each test here is a fixed
+// scenario whose expectations are literal values, or a check of the oracle's
+// own cleanup machinery, so no declared check or model reaches it. The laws of
+// flush atomicity, bounded rollback work, and layout are owned by
+// bucket-facade-rollback-oracle.property.test.ts. Its shared Driver lives in
+// bucket-facade-rollback-support.ts.
+
+/** The child facade a parent row's `kids` field points to. */
+function kidsOf(row: unknown): unknown {
+  return (row as { kids?: unknown } | undefined)?.kids
+}
+
+describe(`bucket facade rollback`, () => {
+  // Pinned: a list of 50 buckets with 3 rows each, where one insert touches
+  // one bucket. The flush must read that bucket's rows and no others.
+  it(`reads only the written facade in a wide list`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        const wide = Array.from({ length: 50 }, (_, index) => `w${index}`)
+        for (const bucket of wide) {
+          driver.send([
+            { type: `activate`, bucket },
+            ...[1, 2, 3].map((id): Op => ({
+              type: `insert`,
+              bucket,
+              id,
+              v: id,
+              rank: id,
+            })),
+          ])
+        }
+        driver.adapter.flush().publish()
+        driver.instrument()
+        driver.send([{ type: `insert`, bucket: `w7`, id: 4, v: 4, rank: 4 }])
+        driver.takeReads()
+        driver.adapter.flush().publish()
+        const written = driver.entry(`w7`)!.collection
+        const untouchedReads = [...driver.takeReads()]
+          .filter(([facade]) => facade !== written)
+          .map(([facade]) => (facade as Collection<Row, number>).id)
+        expect(untouchedReads).toEqual([])
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // Pinned: nested facades. A parent facade's row refers to a child facade.
+  // The child edge commits first, then the parent edge's commit throws. The
+  // failed flush must restore the child's rows, keep the parent's reference
+  // to the old child facade, and drop the child facade it created. The retry
+  // then applies every change.
+  it(`restores a child facade when its parent edge fails`, async () => {
+    const graph = new D2()
+    const childRows = graph.newInput<[string, BucketRow]>()
+    const childActive = graph.newInput<[string, true]>()
+    const parentRows = graph.newInput<[string, BucketRow]>()
+    const parentActive = graph.newInput<[string, true]>()
+    const adapter = new BucketFacadeAdapter(
+      `rollback-oracle-nested-${Math.random()}`,
+      [
+        {
+          edgeId: `children`,
+          rows: childRows,
+          activeBuckets: childActive,
+          hasOrderBy: false,
+        },
+        {
+          edgeId: `parents`,
+          rows: parentRows,
+          activeBuckets: parentActive,
+          hasOrderBy: false,
+        },
+      ],
+      () => {},
+    )
+    graph.finalize()
+    const entries = (
+      adapter as unknown as {
+        entries: Map<string, Map<string, FacadeEntry>>
+      }
+    ).entries
+    const facade = (edgeId: string, bucket: string) =>
+      entries.get(edgeId)?.get(bucket)?.collection
+    const ref = (bucketKey: string) => ({
+      [BUCKET_FACADE_REF]: { edgeId: `children`, bucketKey },
+    })
+    const row = (publicKey: number, value: object): BucketRow => [
+      publicKey,
+      value,
+      undefined,
+    ]
+    const child10 = row(10, { id: 10, v: 1 })
+    const parent1 = row(1, { id: 1, kids: ref(`c1`) })
+
+    await withCleanup(
+      () => {
+        childActive.sendData(new MultiSet([[[`c1`, true], 1]]))
+        childRows.sendData(new MultiSet([[[`c1`, child10], 1]]))
+        parentActive.sendData(new MultiSet([[[`p1`, true], 1]]))
+        parentRows.sendData(new MultiSet([[[`p1`, parent1], 1]]))
+        graph.run()
+        adapter.flush().publish()
+        const c1 = facade(`children`, `c1`)!
+        const p1 = facade(`parents`, `p1`)!
+        expect(kidsOf(p1.get(1))).toBe(c1)
+
+        let events = 0
+        c1.subscribeChanges(() => events++)
+        p1.subscribeChanges(() => events++)
+
+        // The flush updates c1, creates c2, and moves parent 1 to c2.
+        const child10v2 = row(10, { id: 10, v: 2 })
+        const child11 = row(11, { id: 11, v: 1 })
+        const parent1moved = row(1, { id: 1, kids: ref(`c2`) })
+        childRows.sendData(
+          new MultiSet([
+            [[`c1`, child10], -1],
+            [[`c1`, child10v2], 1],
+          ]),
+        )
+        childActive.sendData(new MultiSet([[[`c2`, true], 1]]))
+        childRows.sendData(new MultiSet([[[`c2`, child11], 1]]))
+        parentRows.sendData(
+          new MultiSet([
+            [[`p1`, parent1], -1],
+            [[`p1`, parent1moved], 1],
+          ]),
+        )
+        graph.run()
+        injectFailure(entries.get(`parents`)!.get(`p1`)!.sync!, `commit`)
+
+        expect(() => adapter.flush()).toThrow(`injected facade write failure`)
+        expect(c1.toArray.map(stripVirtualProps)).toEqual([{ id: 10, v: 1 }])
+        expect(kidsOf(p1.get(1))).toBe(c1)
+        expect([...entries.get(`children`)!.keys()]).toEqual([`c1`])
+        expect(events).toBe(0)
+
+        // The retry applies the pending changes the failed flush kept.
+        adapter.flush().publish()
+        const c2 = facade(`children`, `c2`)!
+        expect(c1.toArray.map(stripVirtualProps)).toEqual([{ id: 10, v: 2 }])
+        expect(c2.toArray.map(stripVirtualProps)).toEqual([{ id: 11, v: 1 }])
+        expect(kidsOf(p1.get(1))).toBe(c2)
+      },
+      async () => {
+        adapter.cleanup()
+        await Promise.resolve()
+      },
+    )
+  })
+  // Calibration for ORC-010: when the history fails and cleanup also throws,
+  // the report keeps the history's failure as its cause.
+  it(`keeps the oracle failure when cleanup also fails`, async () => {
+    const failure = new Error(`oracle assertion`)
+    const cleanupFailure = new Error(`cleanup failure`)
+    const result = await withCleanup(
+      () => Promise.reject(failure),
+      () => Promise.reject(cleanupFailure),
+    ).then(
+      () => undefined,
+      (error: unknown) => error,
+    )
+    expect(result).toBeInstanceOf(AggregateError)
+    const aggregate = result as AggregateError
+    expect(aggregate.cause).toBe(failure)
+    expect(aggregate.errors).toEqual([failure, cleanupFailure])
+
+    // Without a history failure, the cleanup failure is reported as is.
+    await expect(
+      withCleanup(
+        () => Promise.resolve(),
+        () => Promise.reject(cleanupFailure),
+      ),
+    ).rejects.toBe(cleanupFailure)
+  })
+  // Invariant witness: the flush runs inside the graph run, so graph output
+  // cannot reach the adapter before its rollback. If it did, restoring the
+  // consumed deltas would overwrite it, so the rollback throws instead.
+  it(`throws when graph output arrives between a flush and its rollback`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        driver.send([{ type: `update`, bucket: `b0`, id: 1, v: 2, rank: 1 }])
+        const publication = driver.adapter.flush()
+        driver.send([{ type: `insert`, bucket: `b0`, id: 2, v: 3, rank: 2 }])
+        expect(() => publication.rollback()).toThrow(
+          `Bucket facade received graph output between a flush and its rollback`,
+        )
+        // The rollback restored the facade and closed its deferral before it
+        // threw, so the new delta still publishes on the next flush.
+        const facade = driver.entry(`b0`)!.collection
+        expect(facade.toArray.map(stripVirtualProps)).toEqual([{ id: 1, v: 1 }])
+        let events = 0
+        facade.subscribeChanges(() => {
+          events++
+        })
+        driver.adapter.flush().publish()
+        expect(facade.toArray.map(stripVirtualProps)).toEqual([
+          { id: 1, v: 1 },
+          { id: 2, v: 3 },
+        ])
+        expect(events).toBe(1)
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // A live query can be disposed between a flush and its rollback, for
+  // example by a listener that runs during the root commit. The rollback then
+  // has nothing to restore and must not bring the disposed facades back.
+  it(`does nothing on rollback after cleanup`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        driver.send([{ type: `update`, bucket: `b0`, id: 1, v: 2, rank: 1 }])
+        const publication = driver.adapter.flush()
+        driver.adapter.cleanup()
+        publication.rollback()
+        expect(driver.entry(`b0`)).toBeUndefined()
+        expect(driver.adapter.hasPendingChanges()).toBe(false)
+      },
+      () => driver.cleanup(),
+    )
+  })
+  it(`retires a bucket while a facade transaction persists`, async () => {
+    const driver = new Driver()
+    let settle!: () => void
+    await withCleanup(
+      async () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        const facade = driver.entry(`b0`)!.collection
+        const transaction = createTransaction({
+          autoCommit: false,
+          mutationFn: () =>
+            new Promise<void>((resolve) => {
+              settle = resolve
+            }),
+        })
+        transaction.mutate(() => {
+          facade.insert({ id: 50, v: 0, $key: 50 } as unknown as Row)
+        })
+        const committed = transaction.commit()
+        driver.send([{ type: `retire`, bucket: `b0` }])
+        expect(() => driver.adapter.flush().publish()).not.toThrow()
+        expect(driver.entry(`b0`)).toBeUndefined()
+        settle()
+        await committed
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // The graph retracts a bucket's rows before it retires the bucket, so a
+  // row the graph sent and never retracted is a contradictory graph signal.
+  // The flush throws and restores the facade, as for any failed flush.
+  it(`throws when a retired bucket still has rows the graph sent`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        const facade = driver.entry(`b0`)!.collection
+        driver.retireWithoutRetractions(`b0`)
+        expect(() => driver.adapter.flush()).toThrow(
+          `Bucket facade retired with rows the graph did not retract`,
+        )
+        expect(driver.entry(`b0`)?.collection).toBe(facade)
+        expect(facade.toArray.map(stripVirtualProps)).toEqual([{ id: 1, v: 1 }])
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // The retraction is an ordinary facade write, so a rollback restores it.
+  it(`restores a retired facade's rows when the root commit fails`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        const facade = driver.entry(`b0`)!.collection
+        driver.send([{ type: `retire`, bucket: `b0` }])
+        const publication = driver.adapter.flush()
+        publication.prepare()
+        publication.rollback()
+        expect(driver.entry(`b0`)?.collection).toBe(facade)
+        expect(facade.toArray.map(stripVirtualProps)).toEqual([{ id: 1, v: 1 }])
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // A throwing subscriber of one facade must not keep another facade's
+  // deferral open. Each facade publishes, then the first error is rethrown.
+  it(`publishes every facade when one facade's subscriber throws`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `activate`, bucket: `b1` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+          { type: `insert`, bucket: `b1`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        const subscriberError = new Error(`subscriber failure`)
+        const throwing = driver.entry(`b0`)!.collection.subscribeChanges(() => {
+          throw subscriberError
+        })
+        const keys: Array<number> = []
+        driver
+          .entry(`b1`)!
+          .collection.subscribeChanges((changes) =>
+            keys.push(...changes.map((change) => change.key)),
+          )
+        driver.send([
+          { type: `insert`, bucket: `b0`, id: 2, v: 1, rank: 2 },
+          { type: `insert`, bucket: `b1`, id: 2, v: 1, rank: 2 },
+        ])
+        expect(() => driver.adapter.flush().publish()).toThrow(subscriberError)
+        expect(keys).toEqual([2])
+        throwing.unsubscribe()
+        driver.send([{ type: `insert`, bucket: `b1`, id: 3, v: 1, rank: 3 }])
+        driver.adapter.flush().publish()
+        expect(keys).toEqual([2, 3])
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // A failed flush whose restore also throws still discards every deferral,
+  // so the facade publishes the next successful flush.
+  it(`keeps publishing a facade after its restore throws`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        const entry = driver.entry(`b0`)!
+        const keys: Array<number> = []
+        entry.collection.subscribeChanges((changes) =>
+          keys.push(...changes.map((change) => change.key)),
+        )
+        driver.send([{ type: `insert`, bucket: `b0`, id: 2, v: 1, rank: 2 }])
+        const publication = driver.adapter.flush()
+        publication.prepare()
+        // The restore's commit throws.
+        injectFailure(entry.sync!, `commit`)
+        expect(() => publication.rollback()).toThrow(
+          `injected facade write failure`,
+        )
+        driver.send([{ type: `insert`, bucket: `b0`, id: 3, v: 1, rank: 3 }])
+        driver.adapter.flush().publish()
+        expect(keys).toContain(3)
+      },
+      () => driver.cleanup(),
+    )
+  })
+  // A flush with no facade changes copies no bookkeeping, so a root-only
+  // write does no work proportional to the number of buckets.
+  it(`copies nothing for a flush without facade changes`, async () => {
+    const driver = new Driver()
+    await withCleanup(
+      () => {
+        driver.send([
+          { type: `activate`, bucket: `b0` },
+          { type: `insert`, bucket: `b0`, id: 1, v: 1, rank: 1 },
+        ])
+        driver.adapter.flush().publish()
+        const adapter = driver.adapter as unknown as { snapshot: () => unknown }
+        let snapshots = 0
+        const snapshot = adapter.snapshot
+        adapter.snapshot = () => {
+          snapshots++
+          return snapshot.call(driver.adapter)
+        }
+        const publication = driver.adapter.flush()
+        publication.prepare()
+        publication.rollback()
+        driver.adapter.flush().publish()
+        expect(snapshots).toBe(0)
+      },
+      () => driver.cleanup(),
+    )
+  })
+})
diff --git a/packages/db/tests/query/cold-join-reconciliation-oracle.test.ts b/packages/db/tests/query/cold-join-reconciliation-oracle.test.ts
index ae233249bd..9a018c1e77 100644
--- a/packages/db/tests/query/cold-join-reconciliation-oracle.test.ts
+++ b/packages/db/tests/query/cold-join-reconciliation-oracle.test.ts
@@ -1,24 +1,26 @@
 import fc from 'fast-check'
 import { Temporal } from 'temporal-polyfill'
 import { describe, expect, it } from 'vitest'
-import {
-  Query,
-  and,
-  createLiveQueryCollection,
-  eq,
-  gt,
-  or,
-} from '../../src/query/index.js'
-import { Func } from '../../src/query/ir.js'
-import { JoinConditionMustBeEqualityError } from '../../src/errors.js'
 import { createCollection } from '../../src/collection/index.js'
 import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import { and, createLiveQueryCollection, eq } from '../../src/query/index.js'
 import {
   oraclePropertyOptions,
   oracleRuns,
   readOracleRunConfig,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { runTrace } from '../trace-runner.js'
+import {
+  checkWithCleanup,
+  createEqualitySource,
+  sortJoinPairs,
+} from './cold-join-support.js'
+import type {
+  EqualityMode,
+  EqualityRow,
+  JoinPair,
+} from './cold-join-support.js'
 import type { Collection } from '../../src/collection/index.js'
 import type {
   ChangeMessage,
@@ -76,6 +78,27 @@ const plain = ({ id, parentId, name, amount }: Joined): Joined => ({
 const ordered = (rows: Iterable<Joined>) =>
   [...rows].map(plain).sort((a, b) => a.id - b.id)
 
+/**
+ * The cold-join model: each parent's name joins every child that names it,
+ * computed from a plain Map of the children that the history has written. The
+ * model never reads the live Collection, so it predicts the complete joined
+ * result after each step.
+ */
+function expectedColdJoinRows(
+  model: ReadonlyMap<number, Child>,
+): Array<Joined> {
+  return parents.flatMap((parent) =>
+    [...model.values()]
+      .filter((child) => child.parentId === parent.id)
+      .map((child) => ({
+        id: child.id,
+        parentId: parent.id,
+        name: parent.name,
+        amount: child.amount,
+      })),
+  )
+}
+
 async function runColdJoin(
   steps: ReadonlyArray<Step>,
   mutant?: ObservationMutant,
@@ -232,17 +255,7 @@ async function runColdJoin(
           calls: mutant === `hide-acquisition` ? [] : calls,
         }
       },
-      recompute: () =>
-        parents.flatMap((parent) =>
-          [...model.values()]
-            .filter((child) => child.parentId === parent.id)
-            .map((child) => ({
-              id: child.id,
-              parentId: parent.id,
-              name: parent.name,
-              amount: child.amount,
-            })),
-        ),
+      recompute: () => expectedColdJoinRows(model),
       assertEqual: (actual, expected) => {
         expect(
           actual.calls.some((call) => call.rows.length > 0),
@@ -266,13 +279,6 @@ async function runColdJoin(
  * demand, and off/eager index modes guard the historical key-normalization
  * defect without claiming compound join syntax.
  */
-type EqualityRow = { id: number; value: unknown }
-type JoinPair = readonly [number | undefined, number | undefined]
-type EqualityMode = `off` | `eager`
-type MutableEqualitySource<T extends { id: number }> = Collection<T, number> & {
-  oracleReplace: (row: T) => Promise<void>
-}
-
 const equalityJoinCases = [
   {
     label: `scalar strings`,
@@ -347,131 +353,18 @@ const equalityJoinCases = [
   },
 ] as const
 
-let equalitySourceId = 0
-
-function createEqualitySource<T extends { id: number }>(
-  label: string,
-  rows: ReadonlyArray<T>,
-  autoIndex: EqualityMode,
-): MutableEqualitySource<T> {
-  let actions!: Parameters<SyncConfig<T, number>[`sync`]>[0]
-  const collection = createCollection<T, number>({
-    id: `${label}-${equalitySourceId++}`,
-    getKey: (row) => row.id,
-    autoIndex,
-    defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
-    startSync: true,
-    sync: {
-      sync: (nextActions) => {
-        actions = nextActions
-        const { begin, write, commit, markReady } = nextActions
-        begin()
-        for (const row of rows) write({ type: `insert`, value: { ...row } })
-        commit()
-        markReady()
-      },
-    },
-  })
-  return Object.assign(collection, {
-    oracleReplace: async (row: T) => {
-      actions.begin()
-      actions.write({ type: `update`, value: row })
-      await actions.commit()
-    },
-  })
-}
-
-function sortJoinPairs(pairs: Array<JoinPair>): Array<JoinPair> {
-  return pairs.sort(
-    ([leftA, rightA], [leftB, rightB]) =>
-      (leftA ?? Number.POSITIVE_INFINITY) -
-        (leftB ?? Number.POSITIVE_INFINITY) ||
-      (rightA ?? Number.POSITIVE_INFINITY) -
-        (rightB ?? Number.POSITIVE_INFINITY),
-  )
-}
-
-async function cleanupAll(
-  ...resources: Array<{ cleanup: () => Promise<void> }>
-) {
-  const results = await Promise.allSettled(
-    resources.map((resource) =>
-      Promise.resolve().then(() => resource.cleanup()),
-    ),
-  )
-  const errors = results.flatMap((result) =>
-    result.status === `rejected` ? [result.reason] : [],
-  )
-  if (errors.length)
-    throw new AggregateError(errors, `join oracle cleanup failed`)
-}
-
-async function checkWithCleanup(
-  check: () => Promise<void>,
-  ...resources: Array<{ cleanup: () => Promise<void> }>
-): Promise<void> {
-  let primaryFailure: unknown
-  let checkFailed = false
-  try {
-    await check()
-  } catch (error) {
-    primaryFailure = error
-    checkFailed = true
-  }
-
-  try {
-    await cleanupAll(...resources)
-  } catch (cleanupFailure) {
-    if (checkFailed) {
-      throw new AggregateError(
-        [primaryFailure, cleanupFailure],
-        `join oracle check and cleanup failed`,
-        { cause: primaryFailure },
-      )
-    }
-    throw cleanupFailure
-  }
-  if (checkFailed) throw primaryFailure
-}
-
-it(`preserves the primary mismatch and releases every resource after cleanup failure`, async () => {
-  const mismatch = new Error(`join result mismatch`)
-  const cleanupFailure = new Error(`first cleanup failed`)
-  const released: Array<string> = []
-  let reported: unknown
-  try {
-    await checkWithCleanup(
-      async () => {
-        throw mismatch
-      },
-      {
-        cleanup: () => {
-          released.push(`first`)
-          throw cleanupFailure
-        },
-      },
-      {
-        cleanup: async () => {
-          released.push(`second`)
-        },
-      },
-    )
-  } catch (error) {
-    reported = error
-  }
-  expect(reported).toBeInstanceOf(AggregateError)
-  expect((reported as AggregateError).cause).toBe(mismatch)
-  expect((reported as AggregateError).errors).toEqual([
-    mismatch,
-    expect.objectContaining({ errors: [cleanupFailure] }),
-  ])
-  expect(released).toEqual([`first`, `second`])
-})
-
-function bytesEqual(left: Uint8Array, right: Uint8Array): boolean {
-  return (
-    left.length === right.length &&
-    left.every((byte, index) => byte === right[index])
+/**
+ * The differential check: a compiled equality join must publish the same rows
+ * as a predicate over the same value. The predicate collection is a second
+ * formulation of the equality law, so a shared index cannot make the two agree
+ * by construction.
+ */
+function expectEqualityJoinMatchesPredicate(
+  joined: { readonly toArray: ReadonlyArray<{ id: number }> },
+  filtered: { readonly toArray: ReadonlyArray<{ id: number }> },
+): void {
+  expect(joined.toArray.map(({ id }) => ({ id }))).toEqual(
+    filtered.toArray.map(({ id }) => ({ id })),
   )
 }
 
@@ -530,9 +423,7 @@ describe.each([`off`, `eager`] as const)(
             expect(filtered.toArray, `${label} predicate result`).toMatchObject(
               expected,
             )
-            expect(joined.toArray.map(({ id }) => ({ id }))).toEqual(
-              filtered.toArray.map(({ id }) => ({ id })),
-            )
+            expectEqualityJoinMatchesPredicate(joined, filtered)
             if (autoIndex === `eager`)
               expect(
                 right.indexes.size,
@@ -548,282 +439,6 @@ describe.each([`off`, `eager`] as const)(
         )
       },
     )
-
-    it(`keeps binary encodings and nullish operands in disjoint join classes`, async () => {
-      const bytes = new Uint8Array([65])
-      const text = `\u0000tanstack-db:binary:A`
-      const binaryLeft = createEqualitySource<EqualityRow>(
-        `binary-disjoint-left`,
-        [{ id: 1, value: bytes }],
-        autoIndex,
-      )
-      const binaryRight = createEqualitySource<EqualityRow>(
-        `binary-disjoint-right`,
-        [
-          { id: 10, value: new Uint8Array(bytes) },
-          { id: 20, value: text },
-        ],
-        autoIndex,
-      )
-      const binaryJoin = createLiveQueryCollection({
-        startSync: true,
-        query: (q) =>
-          q
-            .from({ left: binaryLeft })
-            .innerJoin({ right: binaryRight }, ({ left, right }) =>
-              eq(left.value, right.value),
-            )
-            .select(({ right }) => ({ id: right.id })),
-      })
-
-      type NullishRow = { id: number; value: null | undefined | string }
-      const nullishRows: Array<NullishRow> = [
-        { id: 1, value: null },
-        { id: 2, value: undefined },
-        { id: 3, value: `\0m` },
-        { id: 4, value: `\0j` },
-      ]
-      const nullishLeft = createEqualitySource(
-        `nullish-left`,
-        nullishRows,
-        autoIndex,
-      )
-      const nullishRight = createEqualitySource(
-        `nullish-right`,
-        nullishRows,
-        autoIndex,
-      )
-      const fullJoin = createLiveQueryCollection({
-        startSync: true,
-        query: (q) =>
-          q
-            .from({ left: nullishLeft })
-            .fullJoin({ right: nullishRight }, ({ left, right }) =>
-              eq(left.value, right.value),
-            )
-            .select(({ left, right }) => ({
-              leftId: left.id,
-              rightId: right.id,
-            })),
-      })
-
-      await checkWithCleanup(
-        async () => {
-          await Promise.all([binaryJoin.preload(), fullJoin.preload()])
-          expect(binaryJoin.toArray).toMatchObject([{ id: 10 }])
-          expect(
-            sortJoinPairs(
-              fullJoin.toArray.map(
-                ({ leftId, rightId }) => [leftId, rightId] as const,
-              ),
-            ),
-          ).toEqual([
-            [1, undefined],
-            [2, undefined],
-            [3, 3],
-            [4, 4],
-            [undefined, 1],
-            [undefined, 2],
-          ])
-        },
-        binaryJoin,
-        fullJoin,
-        binaryRight,
-        binaryLeft,
-        nullishRight,
-        nullishLeft,
-      )
-    })
-
-    it(`preserves equality classes through equal, unequal, and nullish replacements`, async () => {
-      type LifecycleRow = { id: number; value: Uint8Array | number | null }
-      const left = createEqualitySource<LifecycleRow>(
-        `lifecycle-left`,
-        [
-          { id: 1, value: new Uint8Array([1, 2, 3]) },
-          { id: 2, value: null },
-        ],
-        autoIndex,
-      )
-      const right = createEqualitySource<LifecycleRow>(
-        `lifecycle-right`,
-        [
-          { id: 10, value: new Uint8Array([1, 2, 3]) },
-          { id: 20, value: null },
-          { id: 30, value: null },
-        ],
-        autoIndex,
-      )
-      const joined = createLiveQueryCollection({
-        startSync: true,
-        query: (q) =>
-          q
-            .from({ left })
-            .fullJoin({ right }, ({ left: l, right: r }) =>
-              eq(l.value, r.value),
-            )
-            .select(({ left: l, right: r }) => ({
-              leftId: l.id,
-              rightId: r.id,
-            })),
-      })
-      const pairs = () =>
-        sortJoinPairs(
-          joined.toArray.map(
-            ({ leftId, rightId }) => [leftId, rightId] as const,
-          ),
-        )
-      const duplicateNullPair: JoinPair = [undefined, 30]
-      const expectPairs = (expected: Array<JoinPair>) => {
-        expect(
-          pairs(),
-          `duplicate same-side null outer row must remain observable`,
-        ).toEqual([...expected, duplicateNullPair])
-      }
-      await checkWithCleanup(
-        async () => {
-          await joined.preload()
-          expectPairs([
-            [1, 10],
-            [2, undefined],
-            [undefined, 20],
-          ])
-          await right.oracleReplace({
-            id: 10,
-            value: new Uint8Array([1, 2, 3]),
-          })
-          expectPairs([
-            [1, 10],
-            [2, undefined],
-            [undefined, 20],
-          ])
-          await right.oracleReplace({
-            id: 10,
-            value: new Uint8Array([1, 2, 4]),
-          })
-          expectPairs([
-            [1, undefined],
-            [2, undefined],
-            [undefined, 10],
-            [undefined, 20],
-          ])
-          await right.oracleReplace({
-            id: 10,
-            value: new Uint8Array([1, 2, 3]),
-          })
-          expectPairs([
-            [1, 10],
-            [2, undefined],
-            [undefined, 20],
-          ])
-          await right.oracleReplace({ id: 20, value: 1 })
-          expectPairs([
-            [1, 10],
-            [2, undefined],
-            [undefined, 20],
-          ])
-          await left.oracleReplace({ id: 2, value: 1 })
-          expectPairs([
-            [1, 10],
-            [2, 20],
-          ])
-          await left.oracleReplace({ id: 2, value: null })
-          expectPairs([
-            [1, 10],
-            [2, undefined],
-            [undefined, 20],
-          ])
-        },
-        joined,
-        right,
-        left,
-      )
-    })
-
-    it(`passes raw binary equality demand through the lazy join path`, async () => {
-      type BinaryRow = { id: number; binaryId: Uint8Array }
-      const activeKey = new Uint8Array([1, 2, 3])
-      const active = createEqualitySource<BinaryRow>(
-        `binary-demand-active`,
-        [{ id: 1, binaryId: activeKey }],
-        autoIndex,
-      )
-      const backend: Array<BinaryRow> = [
-        { id: 10, binaryId: new Uint8Array(activeKey) },
-        { id: 20, binaryId: new Uint8Array([1, 2, 4]) },
-      ]
-      let loadCalls = 0
-      let candidateChecks = 0
-      const requestedValues: Array<unknown> = []
-      const lazy = createCollection<BinaryRow>({
-        id: `binary-demand-lazy-${autoIndex}-${equalitySourceId++}`,
-        getKey: (row) => row.id,
-        autoIndex,
-        defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (actions) => {
-            actions.markReady()
-            return {
-              loadSubset: (options: LoadSubsetOptions) => {
-                loadCalls++
-                const where = options.where
-                if (where?.type !== `func` || where.name !== `in`)
-                  throw new Error(`expected binary demand to use IN`)
-                const candidates = where.args[1]
-                if (
-                  candidates?.type !== `val` ||
-                  !Array.isArray(candidates.value)
-                )
-                  throw new Error(`expected binary demand candidates`)
-                requestedValues.push(...candidates.value)
-                const requested = candidates.value[0]
-                if (!(requested instanceof Uint8Array))
-                  throw new Error(`expected raw binary demand value`)
-                actions.begin()
-                for (const row of backend) {
-                  candidateChecks++
-                  if (bytesEqual(row.binaryId, requested))
-                    actions.write({ type: `insert`, value: row })
-                }
-                const receipt = actions.commit()
-                return receipt === true ? true : receipt
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const joined = createLiveQueryCollection({
-        query: (q) =>
-          q
-            .from({ left: active })
-            .leftJoin({ right: lazy }, ({ left, right }) =>
-              eq(left.binaryId, right.binaryId),
-            )
-            .select(({ left, right }) => ({
-              leftId: left.id,
-              rightId: right.id,
-            })),
-      })
-
-      await checkWithCleanup(
-        async () => {
-          await joined.preload()
-          expect(loadCalls).toBe(1)
-          expect(candidateChecks).toBe(2)
-          expect(requestedValues).toHaveLength(1)
-          expect(requestedValues[0]).toBeInstanceOf(Uint8Array)
-          expect(Array.from(requestedValues[0] as Uint8Array)).toEqual(
-            Array.from(activeKey),
-          )
-          expect(joined.toArray).toMatchObject([{ leftId: 1, rightId: 10 }])
-        },
-        joined,
-        lazy,
-        active,
-      )
-    })
   },
 )
 
@@ -1212,6 +827,17 @@ async function runCompoundHistory(
   )
 }
 
+/**
+ * The checks are the cold-join driver, the compound driver, and the
+ * differential equality check. The models are the cold-join recomputation and
+ * the compound nested-loop model. Each driver builds its own expectation from
+ * the scenario it runs, so the caller supplies inputs, not expected rows.
+ */
+declareOracle({
+  check: [runColdJoin, runCompoundHistory, expectEqualityJoinMatchesPredicate],
+  model: [expectedColdJoinRows, compoundPairs],
+})
+
 // All atom classes occur in the initial matrix. Partial matches differ only
 // in the last term; nulls occur in both tuple positions. The pinned scenario
 // leaves, restores, deletes and reinserts a match on each side.
@@ -1385,41 +1011,3 @@ describe(`compound join relational oracle`, () => {
     },
   )
 })
-
-// Admission is a finite predicate grammar. OR, inequalities, and empty AND
-// are outside the feature contract, including when buried in a valid AND.
-// Rejection must happen at the builder boundary, before source acquisition.
-it.each([`or`, `inequality`, `empty`, `nested-invalid`] as const)(
-  `rejects unsupported compound join predicate %s`,
-  async (shape) => {
-    const source = () =>
-      createCollection<{ id: number }>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: () => {
-            throw new Error(`unexpected acquisition`)
-          },
-        },
-      })
-    const left = source()
-    const right = source()
-    await checkWithCleanup(
-      () => {
-        expect(() =>
-          new Query()
-            .from({ left })
-            .innerJoin({ right }, ({ left: l, right: r }) => {
-              const equality = eq(l.id, r.id)
-              if (shape === `or`) return or(equality, equality)
-              if (shape === `inequality`) return gt(l.id, r.id)
-              if (shape === `empty`) return new Func<boolean>(`and`, [])
-              return and(equality, and(equality, gt(l.id, r.id)))
-            }),
-        ).toThrow(JoinConditionMustBeEqualityError)
-        return Promise.resolve()
-      },
-      left,
-      right,
-    )
-  },
-)
diff --git a/packages/db/tests/query/cold-join-reconciliation.test.ts b/packages/db/tests/query/cold-join-reconciliation.test.ts
new file mode 100644
index 0000000000..1d262908f1
--- /dev/null
+++ b/packages/db/tests/query/cold-join-reconciliation.test.ts
@@ -0,0 +1,389 @@
+/**
+ * Ordinary unit tests moved out of cold-join-reconciliation-oracle.test.ts.
+ * Each one checks a fixed result written in the test: a cleanup failure, a
+ * binary and nullish join class, a lifecycle of equal and unequal replacements,
+ * a raw binary demand, and an unsupported compound predicate. The laws they
+ * touch are owned by cold-join-reconciliation-oracle.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { Func } from '../../src/query/ir.js'
+import { JoinConditionMustBeEqualityError } from '../../src/errors.js'
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import {
+  Query,
+  and,
+  createLiveQueryCollection,
+  eq,
+  gt,
+  or,
+} from '../../src/query/index.js'
+import {
+  checkWithCleanup,
+  createEqualitySource,
+  sortJoinPairs,
+} from './cold-join-support.js'
+import type { EqualityRow, JoinPair } from './cold-join-support.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+
+it(`preserves the primary mismatch and releases every resource after cleanup failure`, async () => {
+  const mismatch = new Error(`join result mismatch`)
+  const cleanupFailure = new Error(`first cleanup failed`)
+  const released: Array<string> = []
+  let reported: unknown
+  try {
+    await checkWithCleanup(
+      async () => {
+        throw mismatch
+      },
+      {
+        cleanup: () => {
+          released.push(`first`)
+          throw cleanupFailure
+        },
+      },
+      {
+        cleanup: async () => {
+          released.push(`second`)
+        },
+      },
+    )
+  } catch (error) {
+    reported = error
+  }
+  expect(reported).toBeInstanceOf(AggregateError)
+  expect((reported as AggregateError).cause).toBe(mismatch)
+  expect((reported as AggregateError).errors).toEqual([
+    mismatch,
+    expect.objectContaining({ errors: [cleanupFailure] }),
+  ])
+  expect(released).toEqual([`first`, `second`])
+})
+
+function bytesEqual(left: Uint8Array, right: Uint8Array): boolean {
+  return (
+    left.length === right.length &&
+    left.every((byte, index) => byte === right[index])
+  )
+}
+
+let equalitySourceId = 0
+
+describe.each([`off`, `eager`] as const)(
+  `join equality oracle with auto-index %s`,
+  (autoIndex) => {
+    it(`keeps binary encodings and nullish operands in disjoint join classes`, async () => {
+      const bytes = new Uint8Array([65])
+      const text = `\u0000tanstack-db:binary:A`
+      const binaryLeft = createEqualitySource<EqualityRow>(
+        `binary-disjoint-left`,
+        [{ id: 1, value: bytes }],
+        autoIndex,
+      )
+      const binaryRight = createEqualitySource<EqualityRow>(
+        `binary-disjoint-right`,
+        [
+          { id: 10, value: new Uint8Array(bytes) },
+          { id: 20, value: text },
+        ],
+        autoIndex,
+      )
+      const binaryJoin = createLiveQueryCollection({
+        startSync: true,
+        query: (q) =>
+          q
+            .from({ left: binaryLeft })
+            .innerJoin({ right: binaryRight }, ({ left, right }) =>
+              eq(left.value, right.value),
+            )
+            .select(({ right }) => ({ id: right.id })),
+      })
+
+      type NullishRow = { id: number; value: null | undefined | string }
+      const nullishRows: Array<NullishRow> = [
+        { id: 1, value: null },
+        { id: 2, value: undefined },
+        { id: 3, value: `\0m` },
+        { id: 4, value: `\0j` },
+      ]
+      const nullishLeft = createEqualitySource(
+        `nullish-left`,
+        nullishRows,
+        autoIndex,
+      )
+      const nullishRight = createEqualitySource(
+        `nullish-right`,
+        nullishRows,
+        autoIndex,
+      )
+      const fullJoin = createLiveQueryCollection({
+        startSync: true,
+        query: (q) =>
+          q
+            .from({ left: nullishLeft })
+            .fullJoin({ right: nullishRight }, ({ left, right }) =>
+              eq(left.value, right.value),
+            )
+            .select(({ left, right }) => ({
+              leftId: left.id,
+              rightId: right.id,
+            })),
+      })
+
+      await checkWithCleanup(
+        async () => {
+          await Promise.all([binaryJoin.preload(), fullJoin.preload()])
+          expect(binaryJoin.toArray).toMatchObject([{ id: 10 }])
+          expect(
+            sortJoinPairs(
+              fullJoin.toArray.map(
+                ({ leftId, rightId }) => [leftId, rightId] as const,
+              ),
+            ),
+          ).toEqual([
+            [1, undefined],
+            [2, undefined],
+            [3, 3],
+            [4, 4],
+            [undefined, 1],
+            [undefined, 2],
+          ])
+        },
+        binaryJoin,
+        fullJoin,
+        binaryRight,
+        binaryLeft,
+        nullishRight,
+        nullishLeft,
+      )
+    })
+
+    it(`preserves equality classes through equal, unequal, and nullish replacements`, async () => {
+      type LifecycleRow = { id: number; value: Uint8Array | number | null }
+      const left = createEqualitySource<LifecycleRow>(
+        `lifecycle-left`,
+        [
+          { id: 1, value: new Uint8Array([1, 2, 3]) },
+          { id: 2, value: null },
+        ],
+        autoIndex,
+      )
+      const right = createEqualitySource<LifecycleRow>(
+        `lifecycle-right`,
+        [
+          { id: 10, value: new Uint8Array([1, 2, 3]) },
+          { id: 20, value: null },
+          { id: 30, value: null },
+        ],
+        autoIndex,
+      )
+      const joined = createLiveQueryCollection({
+        startSync: true,
+        query: (q) =>
+          q
+            .from({ left })
+            .fullJoin({ right }, ({ left: l, right: r }) =>
+              eq(l.value, r.value),
+            )
+            .select(({ left: l, right: r }) => ({
+              leftId: l.id,
+              rightId: r.id,
+            })),
+      })
+      const pairs = () =>
+        sortJoinPairs(
+          joined.toArray.map(
+            ({ leftId, rightId }) => [leftId, rightId] as const,
+          ),
+        )
+      const duplicateNullPair: JoinPair = [undefined, 30]
+      const expectPairs = (expected: Array<JoinPair>) => {
+        expect(
+          pairs(),
+          `duplicate same-side null outer row must remain observable`,
+        ).toEqual([...expected, duplicateNullPair])
+      }
+      await checkWithCleanup(
+        async () => {
+          await joined.preload()
+          expectPairs([
+            [1, 10],
+            [2, undefined],
+            [undefined, 20],
+          ])
+          await right.oracleReplace({
+            id: 10,
+            value: new Uint8Array([1, 2, 3]),
+          })
+          expectPairs([
+            [1, 10],
+            [2, undefined],
+            [undefined, 20],
+          ])
+          await right.oracleReplace({
+            id: 10,
+            value: new Uint8Array([1, 2, 4]),
+          })
+          expectPairs([
+            [1, undefined],
+            [2, undefined],
+            [undefined, 10],
+            [undefined, 20],
+          ])
+          await right.oracleReplace({
+            id: 10,
+            value: new Uint8Array([1, 2, 3]),
+          })
+          expectPairs([
+            [1, 10],
+            [2, undefined],
+            [undefined, 20],
+          ])
+          await right.oracleReplace({ id: 20, value: 1 })
+          expectPairs([
+            [1, 10],
+            [2, undefined],
+            [undefined, 20],
+          ])
+          await left.oracleReplace({ id: 2, value: 1 })
+          expectPairs([
+            [1, 10],
+            [2, 20],
+          ])
+          await left.oracleReplace({ id: 2, value: null })
+          expectPairs([
+            [1, 10],
+            [2, undefined],
+            [undefined, 20],
+          ])
+        },
+        joined,
+        right,
+        left,
+      )
+    })
+
+    it(`passes raw binary equality demand through the lazy join path`, async () => {
+      type BinaryRow = { id: number; binaryId: Uint8Array }
+      const activeKey = new Uint8Array([1, 2, 3])
+      const active = createEqualitySource<BinaryRow>(
+        `binary-demand-active`,
+        [{ id: 1, binaryId: activeKey }],
+        autoIndex,
+      )
+      const backend: Array<BinaryRow> = [
+        { id: 10, binaryId: new Uint8Array(activeKey) },
+        { id: 20, binaryId: new Uint8Array([1, 2, 4]) },
+      ]
+      let loadCalls = 0
+      let candidateChecks = 0
+      const requestedValues: Array<unknown> = []
+      const lazy = createCollection<BinaryRow>({
+        id: `binary-demand-lazy-${autoIndex}-${equalitySourceId++}`,
+        getKey: (row) => row.id,
+        autoIndex,
+        defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (actions) => {
+            actions.markReady()
+            return {
+              loadSubset: (options: LoadSubsetOptions) => {
+                loadCalls++
+                const where = options.where
+                if (where?.type !== `func` || where.name !== `in`)
+                  throw new Error(`expected binary demand to use IN`)
+                const candidates = where.args[1]
+                if (
+                  candidates?.type !== `val` ||
+                  !Array.isArray(candidates.value)
+                )
+                  throw new Error(`expected binary demand candidates`)
+                requestedValues.push(...candidates.value)
+                const requested = candidates.value[0]
+                if (!(requested instanceof Uint8Array))
+                  throw new Error(`expected raw binary demand value`)
+                actions.begin()
+                for (const row of backend) {
+                  candidateChecks++
+                  if (bytesEqual(row.binaryId, requested))
+                    actions.write({ type: `insert`, value: row })
+                }
+                const receipt = actions.commit()
+                return receipt === true ? true : receipt
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const joined = createLiveQueryCollection({
+        query: (q) =>
+          q
+            .from({ left: active })
+            .leftJoin({ right: lazy }, ({ left, right }) =>
+              eq(left.binaryId, right.binaryId),
+            )
+            .select(({ left, right }) => ({
+              leftId: left.id,
+              rightId: right.id,
+            })),
+      })
+
+      await checkWithCleanup(
+        async () => {
+          await joined.preload()
+          expect(loadCalls).toBe(1)
+          expect(candidateChecks).toBe(2)
+          expect(requestedValues).toHaveLength(1)
+          expect(requestedValues[0]).toBeInstanceOf(Uint8Array)
+          expect(Array.from(requestedValues[0] as Uint8Array)).toEqual(
+            Array.from(activeKey),
+          )
+          expect(joined.toArray).toMatchObject([{ leftId: 1, rightId: 10 }])
+        },
+        joined,
+        lazy,
+        active,
+      )
+    })
+  },
+)
+
+// Admission is a finite predicate grammar. OR, inequalities, and empty AND
+// are outside the feature contract, including when buried in a valid AND.
+// Rejection must happen at the builder boundary, before source acquisition.
+it.each([`or`, `inequality`, `empty`, `nested-invalid`] as const)(
+  `rejects unsupported compound join predicate %s`,
+  async (shape) => {
+    const source = () =>
+      createCollection<{ id: number }>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: () => {
+            throw new Error(`unexpected acquisition`)
+          },
+        },
+      })
+    const left = source()
+    const right = source()
+    await checkWithCleanup(
+      () => {
+        expect(() =>
+          new Query()
+            .from({ left })
+            .innerJoin({ right }, ({ left: l, right: r }) => {
+              const equality = eq(l.id, r.id)
+              if (shape === `or`) return or(equality, equality)
+              if (shape === `inequality`) return gt(l.id, r.id)
+              if (shape === `empty`) return new Func<boolean>(`and`, [])
+              return and(equality, and(equality, gt(l.id, r.id)))
+            }),
+        ).toThrow(JoinConditionMustBeEqualityError)
+        return Promise.resolve()
+      },
+      left,
+      right,
+    )
+  },
+)
diff --git a/packages/db/tests/query/cold-join-support.ts b/packages/db/tests/query/cold-join-support.ts
new file mode 100644
index 0000000000..83e94599ef
--- /dev/null
+++ b/packages/db/tests/query/cold-join-support.ts
@@ -0,0 +1,107 @@
+/**
+ * Fixture and cleanup helpers shared by the cold-join reconciliation oracle and
+ * its ordinary unit tests in cold-join-reconciliation.test.ts. They build
+ * equality sources, compare join pairs, and release resources after a check.
+ * The laws are owned by cold-join-reconciliation-oracle.test.ts.
+ */
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { SyncConfig } from '../../src/types.js'
+
+export type EqualityRow = { id: number; value: unknown }
+export type JoinPair = readonly [number | undefined, number | undefined]
+export type EqualityMode = `off` | `eager`
+export type MutableEqualitySource<T extends { id: number }> = Collection<
+  T,
+  number
+> & {
+  oracleReplace: (row: T) => Promise<void>
+}
+
+let equalitySourceId = 0
+
+export function createEqualitySource<T extends { id: number }>(
+  label: string,
+  rows: ReadonlyArray<T>,
+  autoIndex: EqualityMode,
+): MutableEqualitySource<T> {
+  let actions!: Parameters<SyncConfig<T, number>[`sync`]>[0]
+  const collection = createCollection<T, number>({
+    id: `${label}-${equalitySourceId++}`,
+    getKey: (row) => row.id,
+    autoIndex,
+    defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
+    startSync: true,
+    sync: {
+      sync: (nextActions) => {
+        actions = nextActions
+        const { begin, write, commit, markReady } = nextActions
+        begin()
+        for (const row of rows) write({ type: `insert`, value: { ...row } })
+        commit()
+        markReady()
+      },
+    },
+  })
+  return Object.assign(collection, {
+    oracleReplace: async (row: T) => {
+      actions.begin()
+      actions.write({ type: `update`, value: row })
+      await actions.commit()
+    },
+  })
+}
+
+export function sortJoinPairs(pairs: Array<JoinPair>): Array<JoinPair> {
+  return pairs.sort(
+    ([leftA, rightA], [leftB, rightB]) =>
+      (leftA ?? Number.POSITIVE_INFINITY) -
+        (leftB ?? Number.POSITIVE_INFINITY) ||
+      (rightA ?? Number.POSITIVE_INFINITY) -
+        (rightB ?? Number.POSITIVE_INFINITY),
+  )
+}
+
+export async function cleanupAll(
+  ...resources: Array<{ cleanup: () => Promise<void> }>
+) {
+  const results = await Promise.allSettled(
+    resources.map((resource) =>
+      Promise.resolve().then(() => resource.cleanup()),
+    ),
+  )
+  const errors = results.flatMap((result) =>
+    result.status === `rejected` ? [result.reason] : [],
+  )
+  if (errors.length)
+    throw new AggregateError(errors, `join oracle cleanup failed`)
+}
+
+export async function checkWithCleanup(
+  check: () => Promise<void>,
+  ...resources: Array<{ cleanup: () => Promise<void> }>
+): Promise<void> {
+  let primaryFailure: unknown
+  let checkFailed = false
+  try {
+    await check()
+  } catch (error) {
+    primaryFailure = error
+    checkFailed = true
+  }
+
+  try {
+    await cleanupAll(...resources)
+  } catch (cleanupFailure) {
+    if (checkFailed) {
+      throw new AggregateError(
+        [primaryFailure, cleanupFailure],
+        `join oracle check and cleanup failed`,
+        { cause: primaryFailure },
+      )
+    }
+    throw cleanupFailure
+  }
+  if (checkFailed) throw primaryFailure
+}
diff --git a/packages/db/tests/query/compiler/evaluators-oracle.test.ts b/packages/db/tests/query/compiler/evaluators-oracle.test.ts
index 03af6bd8c8..88b2312d1a 100644
--- a/packages/db/tests/query/compiler/evaluators-oracle.test.ts
+++ b/packages/db/tests/query/compiler/evaluators-oracle.test.ts
@@ -1,16 +1,12 @@
 import { describe, expect, it } from 'vitest'
-import { Temporal } from 'temporal-polyfill'
-import {
-  compileExpression,
-  compileSingleRowExpression,
-} from '../../../src/query/compiler/evaluators.js'
-import { Func, PropRef, Value } from '../../../src/query/ir.js'
+import { compileExpression } from '../../../src/query/compiler/evaluators.js'
+import { Func, Value } from '../../../src/query/ir.js'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from '../../oracle-config.js'
-import type { NamespacedRow } from '../../../src/types.js'
+import { declareOracle } from '../../oracle-declaration.js'
 
 /**
  * # Does the LIKE evaluator preserve wildcard meaning without regex work?
@@ -35,7 +31,8 @@ import type { NamespacedRow } from '../../../src/types.js'
  * every fixed, random, or replayed case. The recorder retains the seed and the
  * first five mismatches. A deliberate wrong-result control proves that the
  * comparison rejects the literal-before-wildcard regression. Nullish SQL
- * three-valued logic and broader Unicode folding remain in focused tests.
+ * three-valued logic and broader Unicode folding remain in focused unit tests
+ * in evaluators.test.ts.
  */
 type LikeCase = {
   value: string
@@ -166,364 +163,16 @@ function findLikeMismatch(
   return actual === expected ? undefined : { ...testCase, expected, actual }
 }
 
+declareOracle({
+  check: [findLikeMismatch],
+  model: [referenceLike],
+  grammar: [seededLikeCases],
+})
+
 describe(`evaluators`, () => {
   describe(`compileExpression`, () => {
-    it(`handles unknown expression type`, () => {
-      const unknownExpr = { type: `unknown` } as any
-      expect(() => compileExpression(unknownExpr)).toThrow(
-        `Unknown expression type: unknown`,
-      )
-    })
-
-    describe(`ref compilation`, () => {
-      it(`throws error for empty reference path`, () => {
-        const emptyRef = new PropRef([])
-        expect(() => compileExpression(emptyRef)).toThrow(
-          `Reference path cannot be empty`,
-        )
-      })
-
-      it(`handles simple table reference`, () => {
-        const ref = new PropRef([`users`])
-        const compiled = compileExpression(ref)
-        const row: NamespacedRow = { users: { id: 1, name: `John` } }
-
-        expect(compiled(row)).toEqual({ id: 1, name: `John` })
-      })
-
-      it(`handles single property access`, () => {
-        const ref = new PropRef([`users`, `name`])
-        const compiled = compileExpression(ref)
-        const row: NamespacedRow = { users: { id: 1, name: `John` } }
-
-        expect(compiled(row)).toBe(`John`)
-      })
-
-      it(`handles single property access with undefined table`, () => {
-        const ref = new PropRef([`users`, `name`])
-        const compiled = compileExpression(ref)
-        const row: NamespacedRow = { users: undefined as any }
-
-        expect(compiled(row)).toBeUndefined()
-      })
-
-      it(`handles multiple property navigation`, () => {
-        const ref = new PropRef([`users`, `profile`, `bio`])
-        const compiled = compileExpression(ref)
-        const row: NamespacedRow = {
-          users: { profile: { bio: `Hello world` } },
-        }
-
-        expect(compiled(row)).toBe(`Hello world`)
-      })
-
-      it(`handles multiple property navigation with null value`, () => {
-        const ref = new PropRef([`users`, `profile`, `bio`])
-        const compiled = compileExpression(ref)
-        const row: NamespacedRow = { users: { profile: null } }
-
-        expect(compiled(row)).toBeNull()
-      })
-
-      it(`handles multiple property navigation with undefined table`, () => {
-        const ref = new PropRef([`users`, `profile`, `bio`])
-        const compiled = compileExpression(ref)
-        const row: NamespacedRow = { users: undefined as any }
-
-        expect(compiled(row)).toBeUndefined()
-      })
-
-      it(`uses explicit qualification in namespaced and single-row evaluation`, () => {
-        const ref = new PropRef([`users`, `profile`, `score`], `users`)
-
-        expect(
-          compileExpression(ref)({ users: { profile: { score: 7 } } }),
-        ).toBe(7)
-        expect(compileSingleRowExpression(ref)({ profile: { score: 7 } })).toBe(
-          7,
-        )
-      })
-
-      it(`keeps unqualified multi-segment refs as nested single-row paths`, () => {
-        const ref = new PropRef([`profile`, `score`])
-        const row = {
-          score: 3,
-          profile: { score: 7 },
-        }
-
-        expect(compileSingleRowExpression(ref)(row)).toBe(7)
-      })
-    })
-
     describe(`function compilation`, () => {
-      it(`throws error for unknown function`, () => {
-        const unknownFunc = new Func(`unknownFunc`, [])
-        expect(() => compileExpression(unknownFunc)).toThrow(
-          `Unknown function: unknownFunc`,
-        )
-      })
-
-      describe(`string functions`, () => {
-        it(`handles upper with non-string value`, () => {
-          const func = new Func(`upper`, [new Value(42)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(42)
-        })
-
-        it(`handles lower with non-string value`, () => {
-          const func = new Func(`lower`, [new Value(true)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles length with non-string, non-array value`, () => {
-          const func = new Func(`length`, [new Value(42)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(0)
-        })
-
-        it(`handles length with array`, () => {
-          const func = new Func(`length`, [new Value([1, 2, 3])])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(3)
-        })
-
-        it(`handles concat with various types`, () => {
-          const func = new Func(`concat`, [
-            new Value(`Hello`),
-            new Value(null),
-            new Value(undefined),
-            new Value(42),
-            new Value({ a: 1 }),
-            new Value([1, 2, 3]),
-          ])
-          const compiled = compileExpression(func)
-
-          const result = compiled({})
-          expect(result).toContain(`Hello`)
-          expect(result).toContain(`42`)
-        })
-
-        it(`handles concat with objects that can't be stringified`, () => {
-          const circular: any = {}
-          circular.self = circular
-
-          const func = new Func(`concat`, [new Value(circular)])
-          const compiled = compileExpression(func)
-
-          // Should not throw and should return some fallback string
-          const result = compiled({})
-          expect(typeof result).toBe(`string`)
-        })
-
-        it(`handles coalesce with all null/undefined values`, () => {
-          const func = new Func(`coalesce`, [
-            new Value(null),
-            new Value(undefined),
-            new Value(null),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBeNull()
-        })
-
-        it(`handles coalesce with first non-null value`, () => {
-          const func = new Func(`coalesce`, [
-            new Value(null),
-            new Value(`first`),
-            new Value(`second`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(`first`)
-        })
-      })
-
-      describe(`array functions`, () => {
-        it(`handles in with non-array value`, () => {
-          const func = new Func(`in`, [new Value(1), new Value(`not an array`)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles in with array`, () => {
-          const func = new Func(`in`, [
-            new Value(2),
-            new Value([1, 2, 3, null]),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles in with null value (3-valued logic)`, () => {
-          const func = new Func(`in`, [new Value(null), new Value([1, 2, 3])])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, null in array returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles in with undefined value (3-valued logic)`, () => {
-          const func = new Func(`in`, [
-            new Value(undefined),
-            new Value([1, 2, 3]),
-          ])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, undefined in array returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-      })
-
-      describe(`math functions`, () => {
-        it(`handles add with null values (should default to 0)`, () => {
-          const func = new Func(`add`, [new Value(null), new Value(undefined)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(0)
-        })
-
-        it(`handles subtract with null values`, () => {
-          const func = new Func(`subtract`, [new Value(null), new Value(5)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(-5)
-        })
-
-        it(`handles multiply with null values`, () => {
-          const func = new Func(`multiply`, [new Value(null), new Value(5)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(0)
-        })
-
-        it(`handles divide with zero divisor`, () => {
-          const func = new Func(`divide`, [new Value(10), new Value(0)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBeNull()
-        })
-
-        it(`handles divide with null values`, () => {
-          const func = new Func(`divide`, [new Value(null), new Value(null)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBeNull()
-        })
-      })
-
-      describe(`date/time functions`, () => {
-        it(`handles date by normalizing to YYYY-MM-DD`, () => {
-          const func = new Func(`date`, [new Value(`2026-01-02T05:06:07.000Z`)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(`2026-01-02`)
-        })
-
-        it(`handles datetime by normalizing to ISO string`, () => {
-          const func = new Func(`datetime`, [new Value(1767225600000)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(`2026-01-01T00:00:00.000Z`)
-        })
-
-        it(`handles strftime with supported date format`, () => {
-          const func = new Func(`strftime`, [
-            new Value(`%Y-%m-%d`),
-            new Value(`2026-01-02T05:06:07.000Z`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(`2026-01-02`)
-        })
-
-        it(`returns null for strftime with non-string format`, () => {
-          const func = new Func(`strftime`, [
-            new Value(123),
-            new Value(`2026-01-02T05:06:07.000Z`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBeNull()
-        })
-      })
-
       describe(`like/ilike functions`, () => {
-        it(`handles like with non-string value`, () => {
-          const func = new Func(`like`, [new Value(42), new Value(`%2%`)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles like with non-string pattern`, () => {
-          const func = new Func(`like`, [new Value(`hello`), new Value(42)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles like with wildcard patterns`, () => {
-          const func = new Func(`like`, [
-            new Value(`hello world`),
-            new Value(`hello%`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles like with single character wildcard`, () => {
-          const func = new Func(`like`, [
-            new Value(`hello`),
-            new Value(`hell_`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles like with regex special characters`, () => {
-          const func = new Func(`like`, [
-            new Value(`test.string`),
-            new Value(`test.string`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles like with wildcard in the middle`, () => {
-          const func = new Func(`like`, [
-            new Value(`hello brave new world`),
-            new Value(`hello%world`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`treats % as a wildcard when the value also contains %`, () => {
-          const likeFunc = compileExpression(
-            new Func(`like`, [new Value(`100% done`), new Value(`100%done`)]),
-          )
-          const ilikeFunc = compileExpression(
-            new Func(`ilike`, [
-              new Value(`A% LONG VALUE`),
-              new Value(`a%value`),
-            ]),
-          )
-
-          expect(likeFunc({})).toBe(true)
-          expect(ilikeFunc({})).toBe(true)
-        })
-
         it(`rejects the literal-before-wildcard wrong result`, () => {
           const witness: LikeCase = {
             value: `100% done`,
@@ -586,944 +235,6 @@ describe(`evaluators`, () => {
               ).toEqual([])
             },
           )
-
-        it(`handles like where _ must match exactly one character`, () => {
-          const func = new Func(`like`, [new Value(`hell`), new Value(`hell_`)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles like with a pattern of only wildcards`, () => {
-          const func = new Func(`like`, [new Value(``), new Value(`%%`)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles like with an empty pattern`, () => {
-          const emptyValue = compileExpression(
-            new Func(`like`, [new Value(``), new Value(``)]),
-          )
-          const nonEmptyValue = compileExpression(
-            new Func(`like`, [new Value(`a`), new Value(``)]),
-          )
-
-          expect(emptyValue({})).toBe(true)
-          expect(nonEmptyValue({})).toBe(false)
-        })
-
-        it(`handles like matching across line breaks`, () => {
-          const func = new Func(`like`, [
-            new Value(`hello\nworld`),
-            new Value(`hello%world`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`evaluates pathological wildcard patterns without backtracking (ReDoS)`, () => {
-          // Compiled to a regex, this pattern produces 20 overlapping `.*`
-          // segments; the near-miss value (fails only at the last character)
-          // then made the regex engine backtrack exponentially and hang.
-          const pattern = `a%`.repeat(19) + `a`
-          const nearMiss = `a`.repeat(200) + `b`
-          const likeFunc = compileExpression(
-            new Func(`like`, [new Value(nearMiss), new Value(pattern)]),
-          )
-          const ilikeFunc = compileExpression(
-            new Func(`ilike`, [
-              new Value(nearMiss.toUpperCase()),
-              new Value(pattern),
-            ]),
-          )
-
-          const start = performance.now()
-          expect(likeFunc({})).toBe(false)
-          expect(ilikeFunc({})).toBe(false)
-          expect(performance.now() - start).toBeLessThan(1000)
-        })
-
-        it(`handles like with null value (3-valued logic)`, () => {
-          const func = new Func(`like`, [new Value(null), new Value(`hello%`)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, like with null value returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles like with undefined value (3-valued logic)`, () => {
-          const func = new Func(`like`, [
-            new Value(undefined),
-            new Value(`hello%`),
-          ])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, like with undefined value returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles like with null pattern (3-valued logic)`, () => {
-          const func = new Func(`like`, [new Value(`hello`), new Value(null)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, like with null pattern returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles like with undefined pattern (3-valued logic)`, () => {
-          const func = new Func(`like`, [
-            new Value(`hello`),
-            new Value(undefined),
-          ])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, like with undefined pattern returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles ilike (case insensitive)`, () => {
-          const func = new Func(`ilike`, [
-            new Value(`HELLO`),
-            new Value(`hello`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles ilike with patterns`, () => {
-          const func = new Func(`ilike`, [
-            new Value(`HELLO WORLD`),
-            new Value(`hello%`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles ilike with null value (3-valued logic)`, () => {
-          const func = new Func(`ilike`, [new Value(null), new Value(`hello%`)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, ilike with null value returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles ilike with undefined value (3-valued logic)`, () => {
-          const func = new Func(`ilike`, [
-            new Value(undefined),
-            new Value(`hello%`),
-          ])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, ilike with undefined value returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles ilike with null pattern (3-valued logic)`, () => {
-          const func = new Func(`ilike`, [new Value(`hello`), new Value(null)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, ilike with null pattern returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles ilike with undefined pattern (3-valued logic)`, () => {
-          const func = new Func(`ilike`, [
-            new Value(`hello`),
-            new Value(undefined),
-          ])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, ilike with undefined pattern returns UNKNOWN (null)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`like % wildcard matches across newline characters`, () => {
-          const func = new Func(`like`, [
-            new Value(`hello\nworld`),
-            new Value(`%world`),
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`like _ wildcard matches a newline character`, () => {
-          const func = new Func(`like`, [new Value(`a\nb`), new Value(`a_b`)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-      })
-
-      describe(`comparison operators`, () => {
-        describe(`eq (equality)`, () => {
-          it(`handles eq with null and null (3-valued logic)`, () => {
-            const func = new Func(`eq`, [new Value(null), new Value(null)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, null = null returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles eq with null and value (3-valued logic)`, () => {
-            const func = new Func(`eq`, [new Value(null), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, null = value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles eq with value and null (3-valued logic)`, () => {
-            const func = new Func(`eq`, [new Value(5), new Value(null)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, value = null returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles eq with undefined and value (3-valued logic)`, () => {
-            const func = new Func(`eq`, [new Value(undefined), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, undefined = value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles eq with matching values`, () => {
-            const func = new Func(`eq`, [new Value(5), new Value(5)])
-            const compiled = compileExpression(func)
-
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`handles eq with non-matching values`, () => {
-            const func = new Func(`eq`, [new Value(5), new Value(10)])
-            const compiled = compileExpression(func)
-
-            expect(compiled({})).toBe(false)
-          })
-
-          it(`handles eq with matching Uint8Arrays (content equality)`, () => {
-            const array1 = new Uint8Array([1, 2, 3, 4, 5])
-            const array2 = new Uint8Array([1, 2, 3, 4, 5])
-            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
-            const compiled = compileExpression(func)
-
-            // Should return true because content is the same
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`handles eq with non-matching Uint8Arrays (different content)`, () => {
-            const array1 = new Uint8Array([1, 2, 3, 4, 5])
-            const array2 = new Uint8Array([1, 2, 3, 4, 6])
-            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
-            const compiled = compileExpression(func)
-
-            // Should return false because content is different
-            expect(compiled({})).toBe(false)
-          })
-
-          it(`handles eq with Uint8Arrays of different lengths`, () => {
-            const array1 = new Uint8Array([1, 2, 3, 4])
-            const array2 = new Uint8Array([1, 2, 3, 4, 5])
-            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
-            const compiled = compileExpression(func)
-
-            // Should return false because lengths are different
-            expect(compiled({})).toBe(false)
-          })
-
-          it(`handles eq with same Uint8Array reference`, () => {
-            const array = new Uint8Array([1, 2, 3, 4, 5])
-            const func = new Func(`eq`, [new Value(array), new Value(array)])
-            const compiled = compileExpression(func)
-
-            // Should return true (fast path for reference equality)
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`handles eq with Uint8Array and non-Uint8Array`, () => {
-            const array = new Uint8Array([1, 2, 3])
-            const value = [1, 2, 3]
-            const func = new Func(`eq`, [new Value(array), new Value(value)])
-            const compiled = compileExpression(func)
-
-            // Should return false because types are different
-            expect(compiled({})).toBe(false)
-          })
-
-          it(`handles eq with ULIDs (16-byte Uint8Arrays)`, () => {
-            // Simulate ULID comparison - 16 bytes
-            const ulid1 = new Uint8Array(16)
-            const ulid2 = new Uint8Array(16)
-
-            // Fill with same values
-            for (let i = 0; i < 16; i++) {
-              ulid1[i] = i
-              ulid2[i] = i
-            }
-
-            const func = new Func(`eq`, [new Value(ulid1), new Value(ulid2)])
-            const compiled = compileExpression(func)
-
-            // Should return true because content is identical
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`handles eq with Buffers (if available)`, () => {
-            if (typeof Buffer !== `undefined`) {
-              const buffer1 = Buffer.from([1, 2, 3, 4, 5])
-              const buffer2 = Buffer.from([1, 2, 3, 4, 5])
-              const func = new Func(`eq`, [
-                new Value(buffer1),
-                new Value(buffer2),
-              ])
-              const compiled = compileExpression(func)
-
-              // Should return true because content is the same
-              expect(compiled({})).toBe(true)
-            }
-          })
-
-          it(`handles eq with Date objects (should compare by getTime(), not reference)`, () => {
-            // Create two Date objects with the same time value
-            // They are different object instances but represent the same moment
-            const date1 = new Date(`2024-01-15T10:30:45.123Z`)
-            const date2 = new Date(`2024-01-15T10:30:45.123Z`)
-
-            // Verify they are different object references
-            expect(date1).not.toBe(date2)
-            // But they have the same time value
-            expect(date1.getTime()).toBe(date2.getTime())
-
-            const func = new Func(`eq`, [new Value(date1), new Value(date2)])
-            const compiled = compileExpression(func)
-
-            // Should return true because they represent the same time
-            // Currently this fails because eq() does referential comparison
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`handles eq with Date objects with different times`, () => {
-            const date1 = new Date(`2024-01-15T10:30:45.123Z`)
-            const date2 = new Date(`2024-01-15T10:30:45.124Z`) // 1ms later
-
-            const func = new Func(`eq`, [new Value(date1), new Value(date2)])
-            const compiled = compileExpression(func)
-
-            // Should return false because they represent different times
-            expect(compiled({})).toBe(false)
-          })
-
-          it(`handles eq with Uint8Arrays created with length (repro case)`, () => {
-            // Reproduction of user's issue: new Uint8Array(5) creates [0,0,0,0,0]
-            const array1 = new Uint8Array(5) // Creates array of length 5, all zeros
-            const array2 = new Uint8Array(5) // Creates another array of length 5, all zeros
-            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
-            const compiled = compileExpression(func)
-
-            // Should return true because both have same content (all zeros)
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`handles eq with empty Uint8Arrays`, () => {
-            const array1 = new Uint8Array(0)
-            const array2 = new Uint8Array(0)
-            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
-            const compiled = compileExpression(func)
-
-            // Empty arrays should be equal
-            expect(compiled({})).toBe(true)
-          })
-
-          it(`still handles eq with strings correctly`, () => {
-            const func1 = new Func(`eq`, [
-              new Value(`hello`),
-              new Value(`hello`),
-            ])
-            const compiled1 = compileExpression(func1)
-            expect(compiled1({})).toBe(true)
-
-            const func2 = new Func(`eq`, [
-              new Value(`hello`),
-              new Value(`world`),
-            ])
-            const compiled2 = compileExpression(func2)
-            expect(compiled2({})).toBe(false)
-          })
-
-          it(`still handles eq with numbers correctly`, () => {
-            const func1 = new Func(`eq`, [new Value(42), new Value(42)])
-            const compiled1 = compileExpression(func1)
-            expect(compiled1({})).toBe(true)
-
-            const func2 = new Func(`eq`, [new Value(42), new Value(43)])
-            const compiled2 = compileExpression(func2)
-            expect(compiled2({})).toBe(false)
-          })
-        })
-
-        describe(`gt (greater than)`, () => {
-          it(`handles gt with null and value (3-valued logic)`, () => {
-            const func = new Func(`gt`, [new Value(null), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, null > value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles gt with value and null (3-valued logic)`, () => {
-            const func = new Func(`gt`, [new Value(5), new Value(null)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, value > null returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles gt with undefined (3-valued logic)`, () => {
-            const func = new Func(`gt`, [new Value(undefined), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, undefined > value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles gt with valid values`, () => {
-            const func = new Func(`gt`, [new Value(10), new Value(5)])
-            const compiled = compileExpression(func)
-
-            expect(compiled({})).toBe(true)
-          })
-        })
-
-        describe(`gte (greater than or equal)`, () => {
-          it(`handles gte with null (3-valued logic)`, () => {
-            const func = new Func(`gte`, [new Value(null), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, null >= value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles gte with undefined (3-valued logic)`, () => {
-            const func = new Func(`gte`, [new Value(undefined), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, undefined >= value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-        })
-
-        describe(`lt (less than)`, () => {
-          it(`handles lt with null (3-valued logic)`, () => {
-            const func = new Func(`lt`, [new Value(null), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, null < value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles lt with undefined (3-valued logic)`, () => {
-            const func = new Func(`lt`, [new Value(undefined), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, undefined < value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles lt with valid values`, () => {
-            const func = new Func(`lt`, [new Value(3), new Value(5)])
-            const compiled = compileExpression(func)
-
-            expect(compiled({})).toBe(true)
-          })
-        })
-
-        describe(`lte (less than or equal)`, () => {
-          it(`handles lte with null (3-valued logic)`, () => {
-            const func = new Func(`lte`, [new Value(null), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, null <= value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-
-          it(`handles lte with undefined (3-valued logic)`, () => {
-            const func = new Func(`lte`, [new Value(undefined), new Value(5)])
-            const compiled = compileExpression(func)
-
-            // In 3-valued logic, undefined <= value returns UNKNOWN (null)
-            expect(compiled({})).toBe(null)
-          })
-        })
-
-        describe(`NaN (PostgreSQL float semantics)`, () => {
-          // Following PostgreSQL, NaN is equal to itself and greater than every
-          // other (non-null) value, so it has a well-defined order.
-          it(`treats NaN as equal to NaN`, () => {
-            const func = new Func(`eq`, [new Value(NaN), new Value(NaN)])
-            expect(compileExpression(func)({})).toBe(true)
-          })
-
-          it(`treats NaN as not equal to a number`, () => {
-            const func = new Func(`eq`, [new Value(NaN), new Value(5)])
-            expect(compileExpression(func)({})).toBe(false)
-          })
-
-          it(`still returns UNKNOWN when comparing NaN with null`, () => {
-            const func = new Func(`eq`, [new Value(NaN), new Value(null)])
-            expect(compileExpression(func)({})).toBe(null)
-          })
-
-          it(`treats NaN as greater than every number`, () => {
-            expect(
-              compileExpression(new Func(`gt`, [new Value(NaN), new Value(5)]))(
-                {},
-              ),
-            ).toBe(true)
-            expect(
-              compileExpression(new Func(`gt`, [new Value(5), new Value(NaN)]))(
-                {},
-              ),
-            ).toBe(false)
-            expect(
-              compileExpression(
-                new Func(`gt`, [new Value(NaN), new Value(NaN)]),
-              )({}),
-            ).toBe(false)
-          })
-
-          it(`orders NaN with gte/lt/lte consistently`, () => {
-            // NaN >= anything (including NaN); nothing finite >= NaN
-            expect(
-              compileExpression(
-                new Func(`gte`, [new Value(NaN), new Value(5)]),
-              )({}),
-            ).toBe(true)
-            expect(
-              compileExpression(
-                new Func(`gte`, [new Value(NaN), new Value(NaN)]),
-              )({}),
-            ).toBe(true)
-            // NaN < nothing; a finite value < NaN
-            expect(
-              compileExpression(new Func(`lt`, [new Value(NaN), new Value(5)]))(
-                {},
-              ),
-            ).toBe(false)
-            expect(
-              compileExpression(new Func(`lt`, [new Value(5), new Value(NaN)]))(
-                {},
-              ),
-            ).toBe(true)
-            // NaN <= NaN; a finite value <= NaN
-            expect(
-              compileExpression(
-                new Func(`lte`, [new Value(NaN), new Value(NaN)]),
-              )({}),
-            ).toBe(true)
-            expect(
-              compileExpression(
-                new Func(`lte`, [new Value(5), new Value(NaN)]),
-              )({}),
-            ).toBe(true)
-          })
-
-          it(`matches NaN inside an IN list`, () => {
-            const func = new Func(`in`, [
-              new Value(NaN),
-              new Value([NaN, 1, 2]),
-            ])
-            expect(compileExpression(func)({})).toBe(true)
-          })
-        })
-
-        describe(`Temporal objects`, () => {
-          const evalOp = (op: string, left: any, right: any) =>
-            compileExpression(
-              new Func(op, [new Value(left), new Value(right)]),
-            )({})
-
-          describe(`Instant`, () => {
-            const earlier = Temporal.Instant.from(`2024-01-15T10:00:00Z`)
-            const later = Temporal.Instant.from(`2024-01-15T11:00:00Z`)
-
-            it(`orders chronologically`, () => {
-              expect(evalOp(`gt`, later, earlier)).toBe(true)
-              expect(evalOp(`gt`, earlier, later)).toBe(false)
-              expect(evalOp(`gt`, earlier, earlier)).toBe(false)
-              expect(evalOp(`gte`, earlier, earlier)).toBe(true)
-              expect(evalOp(`lt`, earlier, later)).toBe(true)
-              expect(evalOp(`lte`, earlier, earlier)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with the same instant`, () => {
-              const earlierCopy = Temporal.Instant.from(earlier)
-              expect(earlier).not.toBe(earlierCopy)
-              expect(evalOp(`eq`, earlier, earlierCopy)).toBe(true)
-            })
-          })
-
-          describe(`PlainDate`, () => {
-            const jan15 = Temporal.PlainDate.from(`2024-01-15`)
-            const jan16 = Temporal.PlainDate.from(`2024-01-16`)
-
-            it(`orders chronologically`, () => {
-              expect(evalOp(`gt`, jan16, jan15)).toBe(true)
-              expect(evalOp(`gt`, jan15, jan16)).toBe(false)
-              expect(evalOp(`gt`, jan15, jan15)).toBe(false)
-              expect(evalOp(`gte`, jan15, jan15)).toBe(true)
-              expect(evalOp(`lt`, jan15, jan16)).toBe(true)
-              expect(evalOp(`lte`, jan15, jan15)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with the same date`, () => {
-              const jan15Copy = Temporal.PlainDate.from(jan15)
-              expect(jan15).not.toBe(jan15Copy)
-              expect(evalOp(`eq`, jan15, jan15Copy)).toBe(true)
-            })
-
-            it(`eq returns false for different dates`, () => {
-              expect(evalOp(`eq`, jan15, jan16)).toBe(false)
-            })
-          })
-
-          describe(`PlainDateTime`, () => {
-            const a = Temporal.PlainDateTime.from(`2024-01-15T10:30:00`)
-            const b = Temporal.PlainDateTime.from(`2024-01-15T10:30:01`)
-
-            it(`orders chronologically`, () => {
-              expect(evalOp(`gt`, b, a)).toBe(true)
-              expect(evalOp(`gt`, a, b)).toBe(false)
-              expect(evalOp(`gt`, a, a)).toBe(false)
-              expect(evalOp(`gte`, a, a)).toBe(true)
-              expect(evalOp(`lt`, a, b)).toBe(true)
-              expect(evalOp(`lte`, a, a)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with the same value`, () => {
-              const aCopy = Temporal.PlainDateTime.from(a)
-              expect(a).not.toBe(aCopy)
-              expect(evalOp(`eq`, a, aCopy)).toBe(true)
-            })
-          })
-
-          describe(`PlainTime`, () => {
-            const morning = Temporal.PlainTime.from(`08:00:00`)
-            const evening = Temporal.PlainTime.from(`20:00:00`)
-
-            it(`orders by time of day`, () => {
-              expect(evalOp(`gt`, evening, morning)).toBe(true)
-              expect(evalOp(`gt`, morning, evening)).toBe(false)
-              expect(evalOp(`gt`, morning, morning)).toBe(false)
-              expect(evalOp(`gte`, morning, morning)).toBe(true)
-              expect(evalOp(`lt`, morning, evening)).toBe(true)
-              expect(evalOp(`lte`, morning, morning)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with the same time`, () => {
-              const morningCopy = Temporal.PlainTime.from(morning)
-              expect(morning).not.toBe(morningCopy)
-              expect(evalOp(`eq`, morning, morningCopy)).toBe(true)
-            })
-
-            it(`eq returns false for different times`, () => {
-              expect(evalOp(`eq`, morning, evening)).toBe(false)
-            })
-          })
-
-          describe(`PlainYearMonth`, () => {
-            const feb = Temporal.PlainYearMonth.from(`2024-02`)
-            const mar = Temporal.PlainYearMonth.from(`2024-03`)
-
-            it(`orders chronologically`, () => {
-              expect(evalOp(`gt`, mar, feb)).toBe(true)
-              expect(evalOp(`gt`, feb, mar)).toBe(false)
-              expect(evalOp(`gt`, feb, feb)).toBe(false)
-              expect(evalOp(`gte`, feb, feb)).toBe(true)
-              expect(evalOp(`lt`, feb, mar)).toBe(true)
-              expect(evalOp(`lte`, feb, feb)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with the same year/month`, () => {
-              const febCopy = Temporal.PlainYearMonth.from(feb)
-              expect(feb).not.toBe(febCopy)
-              expect(evalOp(`eq`, feb, febCopy)).toBe(true)
-            })
-
-            it(`eq returns false for different year/month pairs`, () => {
-              expect(evalOp(`eq`, feb, mar)).toBe(false)
-            })
-          })
-
-          describe(`PlainMonthDay`, () => {
-            // PlainMonthDay has no static .compare() — there is no canonical ordering
-            // without a year (e.g. Feb 29 only sometimes follows Feb 28). Equality is
-            // still well-defined.
-            const md1 = Temporal.PlainMonthDay.from(`--03-15`)
-            const md2 = Temporal.PlainMonthDay.from(`--04-15`)
-
-            it(`eq returns true for distinct instances with the same month/day`, () => {
-              const md1Copy = Temporal.PlainMonthDay.from(md1)
-              expect(md1).not.toBe(md1Copy)
-              expect(evalOp(`eq`, md1, md1Copy)).toBe(true)
-            })
-
-            it(`eq returns false for different month/day pairs`, () => {
-              expect(evalOp(`eq`, md1, md2)).toBe(false)
-            })
-
-            it(`gt throws since PlainMonthDay has no defined ordering`, () => {
-              expect(() => evalOp(`gt`, md1, md2)).toThrow(
-                /no defined ordering/,
-              )
-            })
-          })
-
-          describe(`ZonedDateTime`, () => {
-            // Same wall-clock noon in two zones is a different instant.
-            // Tokyo is ahead of New York, so noon Tokyo precedes noon NY by ~14h.
-            const tokyoNoon = Temporal.ZonedDateTime.from(
-              `2024-01-15T12:00:00[Asia/Tokyo]`,
-            )
-            const nyNoon = Temporal.ZonedDateTime.from(
-              `2024-01-15T12:00:00[America/New_York]`,
-            )
-
-            it(`orders by underlying instant across time zones`, () => {
-              expect(evalOp(`gt`, nyNoon, tokyoNoon)).toBe(true)
-              expect(evalOp(`gt`, tokyoNoon, nyNoon)).toBe(false)
-              expect(evalOp(`gt`, tokyoNoon, tokyoNoon)).toBe(false)
-              expect(evalOp(`gte`, tokyoNoon, tokyoNoon)).toBe(true)
-              expect(evalOp(`lt`, tokyoNoon, nyNoon)).toBe(true)
-              expect(evalOp(`lte`, tokyoNoon, tokyoNoon)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with same instant AND zone`, () => {
-              const tokyoNoonCopy = Temporal.ZonedDateTime.from(tokyoNoon)
-              expect(tokyoNoon).not.toBe(tokyoNoonCopy)
-              expect(evalOp(`eq`, tokyoNoon, tokyoNoonCopy)).toBe(true)
-            })
-
-            it(`eq returns false for same instant in different zones`, () => {
-              // ZonedDateTime.equals treats the time zone as part of identity, so two
-              // ZonedDateTimes for the same instant in different zones are not equal —
-              // even though .compare() returns 0 for them.
-              const inTokyo = nyNoon.withTimeZone(`Asia/Tokyo`)
-              expect(evalOp(`eq`, nyNoon, inTokyo)).toBe(false)
-            })
-
-            it(`ranks same-instant-different-zone as positionally equal`, () => {
-              // .compare() ranks by underlying instant, so two ZonedDateTimes for
-              // the same instant in different zones are positionally equal — even
-              // though .equals() returns false (see the eq test above). This
-              // verifies we dispatch to .compare() rather than lex-comparing
-              // toString output, which would order by zone name.
-              const inTokyo = nyNoon.withTimeZone(`Asia/Tokyo`)
-              expect(evalOp(`gt`, nyNoon, inTokyo)).toBe(false)
-              expect(evalOp(`lt`, nyNoon, inTokyo)).toBe(false)
-              expect(evalOp(`gte`, nyNoon, inTokyo)).toBe(true)
-              expect(evalOp(`lte`, nyNoon, inTokyo)).toBe(true)
-            })
-          })
-
-          describe(`Duration`, () => {
-            // Without a relativeTo, Duration ordering is only well-defined when both
-            // values are time/day-only. Calendar-affected fields (years/months/weeks)
-            // are not exercised here.
-            const oneHour = Temporal.Duration.from(`PT1H`)
-            const twoHours = Temporal.Duration.from(`PT2H`)
-
-            it(`orders time-only durations by length`, () => {
-              expect(evalOp(`gt`, twoHours, oneHour)).toBe(true)
-              expect(evalOp(`gt`, oneHour, twoHours)).toBe(false)
-              expect(evalOp(`gt`, oneHour, oneHour)).toBe(false)
-              expect(evalOp(`gte`, oneHour, oneHour)).toBe(true)
-              expect(evalOp(`lt`, oneHour, twoHours)).toBe(true)
-              expect(evalOp(`lte`, oneHour, oneHour)).toBe(true)
-            })
-
-            it(`eq returns true for distinct instances with the same value`, () => {
-              const oneHourCopy = Temporal.Duration.from(oneHour)
-              expect(oneHour).not.toBe(oneHourCopy)
-              expect(evalOp(`eq`, oneHour, oneHourCopy)).toBe(true)
-            })
-
-            it(`eq returns false for different durations`, () => {
-              expect(evalOp(`eq`, oneHour, twoHours)).toBe(false)
-            })
-
-            it(`equivalent forms compare equal but eq returns false`, () => {
-              // PT60M and PT1H represent the same duration. .compare() ranks them
-              // as equal, but .equals() (structural, field-by-field) does not, so
-              // eq returns false. This pins the asymmetry — and verifies we
-              // dispatch to .compare() rather than lex-comparing toString output,
-              // which would say "PT1H" < "PT60M".
-              const sixtyMinutes = Temporal.Duration.from(`PT60M`)
-              const oneHourLit = Temporal.Duration.from(`PT1H`)
-              expect(evalOp(`gt`, sixtyMinutes, oneHourLit)).toBe(false)
-              expect(evalOp(`lt`, sixtyMinutes, oneHourLit)).toBe(false)
-              expect(evalOp(`gte`, sixtyMinutes, oneHourLit)).toBe(true)
-              expect(evalOp(`lte`, sixtyMinutes, oneHourLit)).toBe(true)
-              expect(evalOp(`eq`, sixtyMinutes, oneHourLit)).toBe(false)
-            })
-          })
-
-          it(`eq returns false for different Temporal types with overlapping string forms`, () => {
-            // PlainDate and PlainDateTime can both stringify to "2024-01-15..." but
-            // should compare unequal because the types differ.
-            const date = Temporal.PlainDate.from(`2024-01-15`)
-            const dateTime = Temporal.PlainDateTime.from(`2024-01-15`)
-            // sanity-check the strings share a prefix
-            expect(dateTime.toString().startsWith(date.toString())).toBe(true)
-            expect(evalOp(`eq`, date, dateTime)).toBe(false)
-          })
-
-          it(`gt throws when comparing different Temporal types`, () => {
-            // Mixed-type ordering is undefined; surfacing a TypeError beats the
-            // string-lex pseudo-comparison Temporal explicitly designs against.
-            const date = Temporal.PlainDate.from(`2024-01-15`)
-            const dateTime = Temporal.PlainDateTime.from(`2024-01-15T00:00:00`)
-            expect(() => evalOp(`gt`, date, dateTime)).toThrow(
-              /different types/,
-            )
-          })
-        })
-      })
-
-      describe(`boolean operators`, () => {
-        it(`handles and with short-circuit evaluation`, () => {
-          const func = new Func(`and`, [
-            new Value(false),
-            new Func(`divide`, [new Value(1), new Value(0)]), // This would return null, but shouldn't be evaluated
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles and with null value (3-valued logic)`, () => {
-          const func = new Func(`and`, [new Value(true), new Value(null)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, true AND null = null (UNKNOWN)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles and with undefined value (3-valued logic)`, () => {
-          const func = new Func(`and`, [new Value(true), new Value(undefined)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, true AND undefined = null (UNKNOWN)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles and with null and false (3-valued logic)`, () => {
-          const func = new Func(`and`, [new Value(null), new Value(false)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, null AND false = false
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles and with all true values`, () => {
-          const func = new Func(`and`, [new Value(true), new Value(true)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles or with short-circuit evaluation`, () => {
-          const func = new Func(`or`, [
-            new Value(true),
-            new Func(`divide`, [new Value(1), new Value(0)]), // This would return null, but shouldn't be evaluated
-          ])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles or with null value (3-valued logic)`, () => {
-          const func = new Func(`or`, [
-            new Value(false),
-            new Value(0),
-            new Value(null),
-          ])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, false OR null = null (UNKNOWN)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles or with undefined value (3-valued logic)`, () => {
-          const func = new Func(`or`, [
-            new Value(false),
-            new Value(0),
-            new Value(undefined),
-          ])
-          const compiled = compileExpression(func)
-          // In 3-valued logic, false OR undefined = null (UNKNOWN)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles or with null and true (3-valued logic)`, () => {
-          const func = new Func(`or`, [new Value(null), new Value(true)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, null OR true = true
-          expect(compiled({})).toBe(true)
-        })
-
-        it(`handles or with all false values`, () => {
-          const func = new Func(`or`, [new Value(false), new Value(0)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles not with null value (3-valued logic)`, () => {
-          const func = new Func(`not`, [new Value(null)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, NOT null = null (UNKNOWN)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles not with undefined value (3-valued logic)`, () => {
-          const func = new Func(`not`, [new Value(undefined)])
-          const compiled = compileExpression(func)
-
-          // In 3-valued logic, NOT undefined = null (UNKNOWN)
-          expect(compiled({})).toBe(null)
-        })
-
-        it(`handles not with true value`, () => {
-          const func = new Func(`not`, [new Value(true)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(false)
-        })
-
-        it(`handles not with false value`, () => {
-          const func = new Func(`not`, [new Value(false)])
-          const compiled = compileExpression(func)
-
-          expect(compiled({})).toBe(true)
-        })
-      })
-    })
-
-    describe(`value compilation`, () => {
-      it(`returns constant function for values`, () => {
-        const val = new Value(42)
-        const compiled = compileExpression(val)
-
-        expect(compiled({})).toBe(42)
-        expect(compiled({ users: { id: 1 } })).toBe(42) // Should be same regardless of input
       })
     })
   })
diff --git a/packages/db/tests/query/compiler/evaluators.test.ts b/packages/db/tests/query/compiler/evaluators.test.ts
new file mode 100644
index 0000000000..ecf981355f
--- /dev/null
+++ b/packages/db/tests/query/compiler/evaluators.test.ts
@@ -0,0 +1,1278 @@
+// Ordinary evaluator unit tests: literal inputs with hand-written expectations
+// for compileExpression and compileSingleRowExpression. The LIKE law and its
+// campaigns are owned by evaluators-oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import { Temporal } from 'temporal-polyfill'
+import {
+  compileExpression,
+  compileSingleRowExpression,
+} from '../../../src/query/compiler/evaluators.js'
+import { Func, PropRef, Value } from '../../../src/query/ir.js'
+import type { NamespacedRow } from '../../../src/types.js'
+
+describe(`evaluators`, () => {
+  describe(`compileExpression`, () => {
+    it(`handles unknown expression type`, () => {
+      const unknownExpr = { type: `unknown` } as any
+      expect(() => compileExpression(unknownExpr)).toThrow(
+        `Unknown expression type: unknown`,
+      )
+    })
+    describe(`ref compilation`, () => {
+      it(`throws error for empty reference path`, () => {
+        const emptyRef = new PropRef([])
+        expect(() => compileExpression(emptyRef)).toThrow(
+          `Reference path cannot be empty`,
+        )
+      })
+
+      it(`handles simple table reference`, () => {
+        const ref = new PropRef([`users`])
+        const compiled = compileExpression(ref)
+        const row: NamespacedRow = { users: { id: 1, name: `John` } }
+
+        expect(compiled(row)).toEqual({ id: 1, name: `John` })
+      })
+
+      it(`handles single property access`, () => {
+        const ref = new PropRef([`users`, `name`])
+        const compiled = compileExpression(ref)
+        const row: NamespacedRow = { users: { id: 1, name: `John` } }
+
+        expect(compiled(row)).toBe(`John`)
+      })
+
+      it(`handles single property access with undefined table`, () => {
+        const ref = new PropRef([`users`, `name`])
+        const compiled = compileExpression(ref)
+        const row: NamespacedRow = { users: undefined as any }
+
+        expect(compiled(row)).toBeUndefined()
+      })
+
+      it(`handles multiple property navigation`, () => {
+        const ref = new PropRef([`users`, `profile`, `bio`])
+        const compiled = compileExpression(ref)
+        const row: NamespacedRow = {
+          users: { profile: { bio: `Hello world` } },
+        }
+
+        expect(compiled(row)).toBe(`Hello world`)
+      })
+
+      it(`handles multiple property navigation with null value`, () => {
+        const ref = new PropRef([`users`, `profile`, `bio`])
+        const compiled = compileExpression(ref)
+        const row: NamespacedRow = { users: { profile: null } }
+
+        expect(compiled(row)).toBeNull()
+      })
+
+      it(`handles multiple property navigation with undefined table`, () => {
+        const ref = new PropRef([`users`, `profile`, `bio`])
+        const compiled = compileExpression(ref)
+        const row: NamespacedRow = { users: undefined as any }
+
+        expect(compiled(row)).toBeUndefined()
+      })
+
+      it(`uses explicit qualification in namespaced and single-row evaluation`, () => {
+        const ref = new PropRef([`users`, `profile`, `score`], `users`)
+
+        expect(
+          compileExpression(ref)({ users: { profile: { score: 7 } } }),
+        ).toBe(7)
+        expect(compileSingleRowExpression(ref)({ profile: { score: 7 } })).toBe(
+          7,
+        )
+      })
+
+      it(`keeps unqualified multi-segment refs as nested single-row paths`, () => {
+        const ref = new PropRef([`profile`, `score`])
+        const row = {
+          score: 3,
+          profile: { score: 7 },
+        }
+
+        expect(compileSingleRowExpression(ref)(row)).toBe(7)
+      })
+    })
+    describe(`function compilation`, () => {
+      it(`throws error for unknown function`, () => {
+        const unknownFunc = new Func(`unknownFunc`, [])
+        expect(() => compileExpression(unknownFunc)).toThrow(
+          `Unknown function: unknownFunc`,
+        )
+      })
+      describe(`string functions`, () => {
+        it(`handles upper with non-string value`, () => {
+          const func = new Func(`upper`, [new Value(42)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(42)
+        })
+
+        it(`handles lower with non-string value`, () => {
+          const func = new Func(`lower`, [new Value(true)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+
+        it(`handles length with non-string, non-array value`, () => {
+          const func = new Func(`length`, [new Value(42)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(0)
+        })
+
+        it(`handles length with array`, () => {
+          const func = new Func(`length`, [new Value([1, 2, 3])])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(3)
+        })
+
+        it(`handles concat with various types`, () => {
+          const func = new Func(`concat`, [
+            new Value(`Hello`),
+            new Value(null),
+            new Value(undefined),
+            new Value(42),
+            new Value({ a: 1 }),
+            new Value([1, 2, 3]),
+          ])
+          const compiled = compileExpression(func)
+
+          const result = compiled({})
+          expect(result).toContain(`Hello`)
+          expect(result).toContain(`42`)
+        })
+
+        it(`handles concat with objects that can't be stringified`, () => {
+          const circular: any = {}
+          circular.self = circular
+
+          const func = new Func(`concat`, [new Value(circular)])
+          const compiled = compileExpression(func)
+
+          // Should not throw and should return some fallback string
+          const result = compiled({})
+          expect(typeof result).toBe(`string`)
+        })
+
+        it(`handles coalesce with all null/undefined values`, () => {
+          const func = new Func(`coalesce`, [
+            new Value(null),
+            new Value(undefined),
+            new Value(null),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBeNull()
+        })
+
+        it(`handles coalesce with first non-null value`, () => {
+          const func = new Func(`coalesce`, [
+            new Value(null),
+            new Value(`first`),
+            new Value(`second`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(`first`)
+        })
+      })
+      describe(`array functions`, () => {
+        it(`handles in with non-array value`, () => {
+          const func = new Func(`in`, [new Value(1), new Value(`not an array`)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+
+        it(`handles in with array`, () => {
+          const func = new Func(`in`, [
+            new Value(2),
+            new Value([1, 2, 3, null]),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+
+        it(`handles in with null value (3-valued logic)`, () => {
+          const func = new Func(`in`, [new Value(null), new Value([1, 2, 3])])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, null in array returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles in with undefined value (3-valued logic)`, () => {
+          const func = new Func(`in`, [
+            new Value(undefined),
+            new Value([1, 2, 3]),
+          ])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, undefined in array returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+      })
+      describe(`math functions`, () => {
+        it(`handles add with null values (should default to 0)`, () => {
+          const func = new Func(`add`, [new Value(null), new Value(undefined)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(0)
+        })
+
+        it(`handles subtract with null values`, () => {
+          const func = new Func(`subtract`, [new Value(null), new Value(5)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(-5)
+        })
+
+        it(`handles multiply with null values`, () => {
+          const func = new Func(`multiply`, [new Value(null), new Value(5)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(0)
+        })
+
+        it(`handles divide with zero divisor`, () => {
+          const func = new Func(`divide`, [new Value(10), new Value(0)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBeNull()
+        })
+
+        it(`handles divide with null values`, () => {
+          const func = new Func(`divide`, [new Value(null), new Value(null)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBeNull()
+        })
+      })
+      describe(`date/time functions`, () => {
+        it(`handles date by normalizing to YYYY-MM-DD`, () => {
+          const func = new Func(`date`, [new Value(`2026-01-02T05:06:07.000Z`)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(`2026-01-02`)
+        })
+
+        it(`handles datetime by normalizing to ISO string`, () => {
+          const func = new Func(`datetime`, [new Value(1767225600000)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(`2026-01-01T00:00:00.000Z`)
+        })
+
+        it(`handles strftime with supported date format`, () => {
+          const func = new Func(`strftime`, [
+            new Value(`%Y-%m-%d`),
+            new Value(`2026-01-02T05:06:07.000Z`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(`2026-01-02`)
+        })
+
+        it(`returns null for strftime with non-string format`, () => {
+          const func = new Func(`strftime`, [
+            new Value(123),
+            new Value(`2026-01-02T05:06:07.000Z`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBeNull()
+        })
+      })
+      describe(`like/ilike functions`, () => {
+        it(`handles like with non-string value`, () => {
+          const func = new Func(`like`, [new Value(42), new Value(`%2%`)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+        it(`handles like with non-string pattern`, () => {
+          const func = new Func(`like`, [new Value(`hello`), new Value(42)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+        it(`handles like with wildcard patterns`, () => {
+          const func = new Func(`like`, [
+            new Value(`hello world`),
+            new Value(`hello%`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`handles like with single character wildcard`, () => {
+          const func = new Func(`like`, [
+            new Value(`hello`),
+            new Value(`hell_`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`handles like with regex special characters`, () => {
+          const func = new Func(`like`, [
+            new Value(`test.string`),
+            new Value(`test.string`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`handles like with wildcard in the middle`, () => {
+          const func = new Func(`like`, [
+            new Value(`hello brave new world`),
+            new Value(`hello%world`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`treats % as a wildcard when the value also contains %`, () => {
+          const likeFunc = compileExpression(
+            new Func(`like`, [new Value(`100% done`), new Value(`100%done`)]),
+          )
+          const ilikeFunc = compileExpression(
+            new Func(`ilike`, [
+              new Value(`A% LONG VALUE`),
+              new Value(`a%value`),
+            ]),
+          )
+
+          expect(likeFunc({})).toBe(true)
+          expect(ilikeFunc({})).toBe(true)
+        })
+        it(`handles like where _ must match exactly one character`, () => {
+          const func = new Func(`like`, [new Value(`hell`), new Value(`hell_`)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+        it(`handles like with a pattern of only wildcards`, () => {
+          const func = new Func(`like`, [new Value(``), new Value(`%%`)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`handles like with an empty pattern`, () => {
+          const emptyValue = compileExpression(
+            new Func(`like`, [new Value(``), new Value(``)]),
+          )
+          const nonEmptyValue = compileExpression(
+            new Func(`like`, [new Value(`a`), new Value(``)]),
+          )
+
+          expect(emptyValue({})).toBe(true)
+          expect(nonEmptyValue({})).toBe(false)
+        })
+        it(`handles like matching across line breaks`, () => {
+          const func = new Func(`like`, [
+            new Value(`hello\nworld`),
+            new Value(`hello%world`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`evaluates pathological wildcard patterns without backtracking (ReDoS)`, () => {
+          // Compiled to a regex, this pattern produces 20 overlapping `.*`
+          // segments; the near-miss value (fails only at the last character)
+          // then made the regex engine backtrack exponentially and hang.
+          const pattern = `a%`.repeat(19) + `a`
+          const nearMiss = `a`.repeat(200) + `b`
+          const likeFunc = compileExpression(
+            new Func(`like`, [new Value(nearMiss), new Value(pattern)]),
+          )
+          const ilikeFunc = compileExpression(
+            new Func(`ilike`, [
+              new Value(nearMiss.toUpperCase()),
+              new Value(pattern),
+            ]),
+          )
+
+          const start = performance.now()
+          expect(likeFunc({})).toBe(false)
+          expect(ilikeFunc({})).toBe(false)
+          expect(performance.now() - start).toBeLessThan(1000)
+        })
+        it(`handles like with null value (3-valued logic)`, () => {
+          const func = new Func(`like`, [new Value(null), new Value(`hello%`)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, like with null value returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles like with undefined value (3-valued logic)`, () => {
+          const func = new Func(`like`, [
+            new Value(undefined),
+            new Value(`hello%`),
+          ])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, like with undefined value returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles like with null pattern (3-valued logic)`, () => {
+          const func = new Func(`like`, [new Value(`hello`), new Value(null)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, like with null pattern returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles like with undefined pattern (3-valued logic)`, () => {
+          const func = new Func(`like`, [
+            new Value(`hello`),
+            new Value(undefined),
+          ])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, like with undefined pattern returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles ilike (case insensitive)`, () => {
+          const func = new Func(`ilike`, [
+            new Value(`HELLO`),
+            new Value(`hello`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`handles ilike with patterns`, () => {
+          const func = new Func(`ilike`, [
+            new Value(`HELLO WORLD`),
+            new Value(`hello%`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`handles ilike with null value (3-valued logic)`, () => {
+          const func = new Func(`ilike`, [new Value(null), new Value(`hello%`)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, ilike with null value returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles ilike with undefined value (3-valued logic)`, () => {
+          const func = new Func(`ilike`, [
+            new Value(undefined),
+            new Value(`hello%`),
+          ])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, ilike with undefined value returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles ilike with null pattern (3-valued logic)`, () => {
+          const func = new Func(`ilike`, [new Value(`hello`), new Value(null)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, ilike with null pattern returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`handles ilike with undefined pattern (3-valued logic)`, () => {
+          const func = new Func(`ilike`, [
+            new Value(`hello`),
+            new Value(undefined),
+          ])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, ilike with undefined pattern returns UNKNOWN (null)
+          expect(compiled({})).toBe(null)
+        })
+        it(`like % wildcard matches across newline characters`, () => {
+          const func = new Func(`like`, [
+            new Value(`hello\nworld`),
+            new Value(`%world`),
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+        it(`like _ wildcard matches a newline character`, () => {
+          const func = new Func(`like`, [new Value(`a\nb`), new Value(`a_b`)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+      })
+      describe(`comparison operators`, () => {
+        describe(`eq (equality)`, () => {
+          it(`handles eq with null and null (3-valued logic)`, () => {
+            const func = new Func(`eq`, [new Value(null), new Value(null)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, null = null returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles eq with null and value (3-valued logic)`, () => {
+            const func = new Func(`eq`, [new Value(null), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, null = value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles eq with value and null (3-valued logic)`, () => {
+            const func = new Func(`eq`, [new Value(5), new Value(null)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, value = null returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles eq with undefined and value (3-valued logic)`, () => {
+            const func = new Func(`eq`, [new Value(undefined), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, undefined = value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles eq with matching values`, () => {
+            const func = new Func(`eq`, [new Value(5), new Value(5)])
+            const compiled = compileExpression(func)
+
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`handles eq with non-matching values`, () => {
+            const func = new Func(`eq`, [new Value(5), new Value(10)])
+            const compiled = compileExpression(func)
+
+            expect(compiled({})).toBe(false)
+          })
+
+          it(`handles eq with matching Uint8Arrays (content equality)`, () => {
+            const array1 = new Uint8Array([1, 2, 3, 4, 5])
+            const array2 = new Uint8Array([1, 2, 3, 4, 5])
+            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
+            const compiled = compileExpression(func)
+
+            // Should return true because content is the same
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`handles eq with non-matching Uint8Arrays (different content)`, () => {
+            const array1 = new Uint8Array([1, 2, 3, 4, 5])
+            const array2 = new Uint8Array([1, 2, 3, 4, 6])
+            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
+            const compiled = compileExpression(func)
+
+            // Should return false because content is different
+            expect(compiled({})).toBe(false)
+          })
+
+          it(`handles eq with Uint8Arrays of different lengths`, () => {
+            const array1 = new Uint8Array([1, 2, 3, 4])
+            const array2 = new Uint8Array([1, 2, 3, 4, 5])
+            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
+            const compiled = compileExpression(func)
+
+            // Should return false because lengths are different
+            expect(compiled({})).toBe(false)
+          })
+
+          it(`handles eq with same Uint8Array reference`, () => {
+            const array = new Uint8Array([1, 2, 3, 4, 5])
+            const func = new Func(`eq`, [new Value(array), new Value(array)])
+            const compiled = compileExpression(func)
+
+            // Should return true (fast path for reference equality)
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`handles eq with Uint8Array and non-Uint8Array`, () => {
+            const array = new Uint8Array([1, 2, 3])
+            const value = [1, 2, 3]
+            const func = new Func(`eq`, [new Value(array), new Value(value)])
+            const compiled = compileExpression(func)
+
+            // Should return false because types are different
+            expect(compiled({})).toBe(false)
+          })
+
+          it(`handles eq with ULIDs (16-byte Uint8Arrays)`, () => {
+            // Simulate ULID comparison - 16 bytes
+            const ulid1 = new Uint8Array(16)
+            const ulid2 = new Uint8Array(16)
+
+            // Fill with same values
+            for (let i = 0; i < 16; i++) {
+              ulid1[i] = i
+              ulid2[i] = i
+            }
+
+            const func = new Func(`eq`, [new Value(ulid1), new Value(ulid2)])
+            const compiled = compileExpression(func)
+
+            // Should return true because content is identical
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`handles eq with Buffers (if available)`, () => {
+            if (typeof Buffer !== `undefined`) {
+              const buffer1 = Buffer.from([1, 2, 3, 4, 5])
+              const buffer2 = Buffer.from([1, 2, 3, 4, 5])
+              const func = new Func(`eq`, [
+                new Value(buffer1),
+                new Value(buffer2),
+              ])
+              const compiled = compileExpression(func)
+
+              // Should return true because content is the same
+              expect(compiled({})).toBe(true)
+            }
+          })
+
+          it(`handles eq with Date objects (should compare by getTime(), not reference)`, () => {
+            // Create two Date objects with the same time value
+            // They are different object instances but represent the same moment
+            const date1 = new Date(`2024-01-15T10:30:45.123Z`)
+            const date2 = new Date(`2024-01-15T10:30:45.123Z`)
+
+            // Verify they are different object references
+            expect(date1).not.toBe(date2)
+            // But they have the same time value
+            expect(date1.getTime()).toBe(date2.getTime())
+
+            const func = new Func(`eq`, [new Value(date1), new Value(date2)])
+            const compiled = compileExpression(func)
+
+            // Should return true because they represent the same time
+            // Currently this fails because eq() does referential comparison
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`handles eq with Date objects with different times`, () => {
+            const date1 = new Date(`2024-01-15T10:30:45.123Z`)
+            const date2 = new Date(`2024-01-15T10:30:45.124Z`) // 1ms later
+
+            const func = new Func(`eq`, [new Value(date1), new Value(date2)])
+            const compiled = compileExpression(func)
+
+            // Should return false because they represent different times
+            expect(compiled({})).toBe(false)
+          })
+
+          it(`handles eq with Uint8Arrays created with length (repro case)`, () => {
+            // Reproduction of user's issue: new Uint8Array(5) creates [0,0,0,0,0]
+            const array1 = new Uint8Array(5) // Creates array of length 5, all zeros
+            const array2 = new Uint8Array(5) // Creates another array of length 5, all zeros
+            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
+            const compiled = compileExpression(func)
+
+            // Should return true because both have same content (all zeros)
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`handles eq with empty Uint8Arrays`, () => {
+            const array1 = new Uint8Array(0)
+            const array2 = new Uint8Array(0)
+            const func = new Func(`eq`, [new Value(array1), new Value(array2)])
+            const compiled = compileExpression(func)
+
+            // Empty arrays should be equal
+            expect(compiled({})).toBe(true)
+          })
+
+          it(`still handles eq with strings correctly`, () => {
+            const func1 = new Func(`eq`, [
+              new Value(`hello`),
+              new Value(`hello`),
+            ])
+            const compiled1 = compileExpression(func1)
+            expect(compiled1({})).toBe(true)
+
+            const func2 = new Func(`eq`, [
+              new Value(`hello`),
+              new Value(`world`),
+            ])
+            const compiled2 = compileExpression(func2)
+            expect(compiled2({})).toBe(false)
+          })
+
+          it(`still handles eq with numbers correctly`, () => {
+            const func1 = new Func(`eq`, [new Value(42), new Value(42)])
+            const compiled1 = compileExpression(func1)
+            expect(compiled1({})).toBe(true)
+
+            const func2 = new Func(`eq`, [new Value(42), new Value(43)])
+            const compiled2 = compileExpression(func2)
+            expect(compiled2({})).toBe(false)
+          })
+        })
+
+        describe(`gt (greater than)`, () => {
+          it(`handles gt with null and value (3-valued logic)`, () => {
+            const func = new Func(`gt`, [new Value(null), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, null > value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles gt with value and null (3-valued logic)`, () => {
+            const func = new Func(`gt`, [new Value(5), new Value(null)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, value > null returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles gt with undefined (3-valued logic)`, () => {
+            const func = new Func(`gt`, [new Value(undefined), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, undefined > value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles gt with valid values`, () => {
+            const func = new Func(`gt`, [new Value(10), new Value(5)])
+            const compiled = compileExpression(func)
+
+            expect(compiled({})).toBe(true)
+          })
+        })
+
+        describe(`gte (greater than or equal)`, () => {
+          it(`handles gte with null (3-valued logic)`, () => {
+            const func = new Func(`gte`, [new Value(null), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, null >= value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles gte with undefined (3-valued logic)`, () => {
+            const func = new Func(`gte`, [new Value(undefined), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, undefined >= value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+        })
+
+        describe(`lt (less than)`, () => {
+          it(`handles lt with null (3-valued logic)`, () => {
+            const func = new Func(`lt`, [new Value(null), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, null < value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles lt with undefined (3-valued logic)`, () => {
+            const func = new Func(`lt`, [new Value(undefined), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, undefined < value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles lt with valid values`, () => {
+            const func = new Func(`lt`, [new Value(3), new Value(5)])
+            const compiled = compileExpression(func)
+
+            expect(compiled({})).toBe(true)
+          })
+        })
+
+        describe(`lte (less than or equal)`, () => {
+          it(`handles lte with null (3-valued logic)`, () => {
+            const func = new Func(`lte`, [new Value(null), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, null <= value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+
+          it(`handles lte with undefined (3-valued logic)`, () => {
+            const func = new Func(`lte`, [new Value(undefined), new Value(5)])
+            const compiled = compileExpression(func)
+
+            // In 3-valued logic, undefined <= value returns UNKNOWN (null)
+            expect(compiled({})).toBe(null)
+          })
+        })
+
+        describe(`NaN (PostgreSQL float semantics)`, () => {
+          // Following PostgreSQL, NaN is equal to itself and greater than every
+          // other (non-null) value, so it has a well-defined order.
+          it(`treats NaN as equal to NaN`, () => {
+            const func = new Func(`eq`, [new Value(NaN), new Value(NaN)])
+            expect(compileExpression(func)({})).toBe(true)
+          })
+
+          it(`treats NaN as not equal to a number`, () => {
+            const func = new Func(`eq`, [new Value(NaN), new Value(5)])
+            expect(compileExpression(func)({})).toBe(false)
+          })
+
+          it(`still returns UNKNOWN when comparing NaN with null`, () => {
+            const func = new Func(`eq`, [new Value(NaN), new Value(null)])
+            expect(compileExpression(func)({})).toBe(null)
+          })
+
+          it(`treats NaN as greater than every number`, () => {
+            expect(
+              compileExpression(new Func(`gt`, [new Value(NaN), new Value(5)]))(
+                {},
+              ),
+            ).toBe(true)
+            expect(
+              compileExpression(new Func(`gt`, [new Value(5), new Value(NaN)]))(
+                {},
+              ),
+            ).toBe(false)
+            expect(
+              compileExpression(
+                new Func(`gt`, [new Value(NaN), new Value(NaN)]),
+              )({}),
+            ).toBe(false)
+          })
+
+          it(`orders NaN with gte/lt/lte consistently`, () => {
+            // NaN >= anything (including NaN); nothing finite >= NaN
+            expect(
+              compileExpression(
+                new Func(`gte`, [new Value(NaN), new Value(5)]),
+              )({}),
+            ).toBe(true)
+            expect(
+              compileExpression(
+                new Func(`gte`, [new Value(NaN), new Value(NaN)]),
+              )({}),
+            ).toBe(true)
+            // NaN < nothing; a finite value < NaN
+            expect(
+              compileExpression(new Func(`lt`, [new Value(NaN), new Value(5)]))(
+                {},
+              ),
+            ).toBe(false)
+            expect(
+              compileExpression(new Func(`lt`, [new Value(5), new Value(NaN)]))(
+                {},
+              ),
+            ).toBe(true)
+            // NaN <= NaN; a finite value <= NaN
+            expect(
+              compileExpression(
+                new Func(`lte`, [new Value(NaN), new Value(NaN)]),
+              )({}),
+            ).toBe(true)
+            expect(
+              compileExpression(
+                new Func(`lte`, [new Value(5), new Value(NaN)]),
+              )({}),
+            ).toBe(true)
+          })
+
+          it(`matches NaN inside an IN list`, () => {
+            const func = new Func(`in`, [
+              new Value(NaN),
+              new Value([NaN, 1, 2]),
+            ])
+            expect(compileExpression(func)({})).toBe(true)
+          })
+        })
+
+        describe(`Temporal objects`, () => {
+          const evalOp = (op: string, left: any, right: any) =>
+            compileExpression(
+              new Func(op, [new Value(left), new Value(right)]),
+            )({})
+
+          describe(`Instant`, () => {
+            const earlier = Temporal.Instant.from(`2024-01-15T10:00:00Z`)
+            const later = Temporal.Instant.from(`2024-01-15T11:00:00Z`)
+
+            it(`orders chronologically`, () => {
+              expect(evalOp(`gt`, later, earlier)).toBe(true)
+              expect(evalOp(`gt`, earlier, later)).toBe(false)
+              expect(evalOp(`gt`, earlier, earlier)).toBe(false)
+              expect(evalOp(`gte`, earlier, earlier)).toBe(true)
+              expect(evalOp(`lt`, earlier, later)).toBe(true)
+              expect(evalOp(`lte`, earlier, earlier)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with the same instant`, () => {
+              const earlierCopy = Temporal.Instant.from(earlier)
+              expect(earlier).not.toBe(earlierCopy)
+              expect(evalOp(`eq`, earlier, earlierCopy)).toBe(true)
+            })
+          })
+
+          describe(`PlainDate`, () => {
+            const jan15 = Temporal.PlainDate.from(`2024-01-15`)
+            const jan16 = Temporal.PlainDate.from(`2024-01-16`)
+
+            it(`orders chronologically`, () => {
+              expect(evalOp(`gt`, jan16, jan15)).toBe(true)
+              expect(evalOp(`gt`, jan15, jan16)).toBe(false)
+              expect(evalOp(`gt`, jan15, jan15)).toBe(false)
+              expect(evalOp(`gte`, jan15, jan15)).toBe(true)
+              expect(evalOp(`lt`, jan15, jan16)).toBe(true)
+              expect(evalOp(`lte`, jan15, jan15)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with the same date`, () => {
+              const jan15Copy = Temporal.PlainDate.from(jan15)
+              expect(jan15).not.toBe(jan15Copy)
+              expect(evalOp(`eq`, jan15, jan15Copy)).toBe(true)
+            })
+
+            it(`eq returns false for different dates`, () => {
+              expect(evalOp(`eq`, jan15, jan16)).toBe(false)
+            })
+          })
+
+          describe(`PlainDateTime`, () => {
+            const a = Temporal.PlainDateTime.from(`2024-01-15T10:30:00`)
+            const b = Temporal.PlainDateTime.from(`2024-01-15T10:30:01`)
+
+            it(`orders chronologically`, () => {
+              expect(evalOp(`gt`, b, a)).toBe(true)
+              expect(evalOp(`gt`, a, b)).toBe(false)
+              expect(evalOp(`gt`, a, a)).toBe(false)
+              expect(evalOp(`gte`, a, a)).toBe(true)
+              expect(evalOp(`lt`, a, b)).toBe(true)
+              expect(evalOp(`lte`, a, a)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with the same value`, () => {
+              const aCopy = Temporal.PlainDateTime.from(a)
+              expect(a).not.toBe(aCopy)
+              expect(evalOp(`eq`, a, aCopy)).toBe(true)
+            })
+          })
+
+          describe(`PlainTime`, () => {
+            const morning = Temporal.PlainTime.from(`08:00:00`)
+            const evening = Temporal.PlainTime.from(`20:00:00`)
+
+            it(`orders by time of day`, () => {
+              expect(evalOp(`gt`, evening, morning)).toBe(true)
+              expect(evalOp(`gt`, morning, evening)).toBe(false)
+              expect(evalOp(`gt`, morning, morning)).toBe(false)
+              expect(evalOp(`gte`, morning, morning)).toBe(true)
+              expect(evalOp(`lt`, morning, evening)).toBe(true)
+              expect(evalOp(`lte`, morning, morning)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with the same time`, () => {
+              const morningCopy = Temporal.PlainTime.from(morning)
+              expect(morning).not.toBe(morningCopy)
+              expect(evalOp(`eq`, morning, morningCopy)).toBe(true)
+            })
+
+            it(`eq returns false for different times`, () => {
+              expect(evalOp(`eq`, morning, evening)).toBe(false)
+            })
+          })
+
+          describe(`PlainYearMonth`, () => {
+            const feb = Temporal.PlainYearMonth.from(`2024-02`)
+            const mar = Temporal.PlainYearMonth.from(`2024-03`)
+
+            it(`orders chronologically`, () => {
+              expect(evalOp(`gt`, mar, feb)).toBe(true)
+              expect(evalOp(`gt`, feb, mar)).toBe(false)
+              expect(evalOp(`gt`, feb, feb)).toBe(false)
+              expect(evalOp(`gte`, feb, feb)).toBe(true)
+              expect(evalOp(`lt`, feb, mar)).toBe(true)
+              expect(evalOp(`lte`, feb, feb)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with the same year/month`, () => {
+              const febCopy = Temporal.PlainYearMonth.from(feb)
+              expect(feb).not.toBe(febCopy)
+              expect(evalOp(`eq`, feb, febCopy)).toBe(true)
+            })
+
+            it(`eq returns false for different year/month pairs`, () => {
+              expect(evalOp(`eq`, feb, mar)).toBe(false)
+            })
+          })
+
+          describe(`PlainMonthDay`, () => {
+            // PlainMonthDay has no static .compare() — there is no canonical ordering
+            // without a year (e.g. Feb 29 only sometimes follows Feb 28). Equality is
+            // still well-defined.
+            const md1 = Temporal.PlainMonthDay.from(`--03-15`)
+            const md2 = Temporal.PlainMonthDay.from(`--04-15`)
+
+            it(`eq returns true for distinct instances with the same month/day`, () => {
+              const md1Copy = Temporal.PlainMonthDay.from(md1)
+              expect(md1).not.toBe(md1Copy)
+              expect(evalOp(`eq`, md1, md1Copy)).toBe(true)
+            })
+
+            it(`eq returns false for different month/day pairs`, () => {
+              expect(evalOp(`eq`, md1, md2)).toBe(false)
+            })
+
+            it(`gt throws since PlainMonthDay has no defined ordering`, () => {
+              expect(() => evalOp(`gt`, md1, md2)).toThrow(
+                /no defined ordering/,
+              )
+            })
+          })
+
+          describe(`ZonedDateTime`, () => {
+            // Same wall-clock noon in two zones is a different instant.
+            // Tokyo is ahead of New York, so noon Tokyo precedes noon NY by ~14h.
+            const tokyoNoon = Temporal.ZonedDateTime.from(
+              `2024-01-15T12:00:00[Asia/Tokyo]`,
+            )
+            const nyNoon = Temporal.ZonedDateTime.from(
+              `2024-01-15T12:00:00[America/New_York]`,
+            )
+
+            it(`orders by underlying instant across time zones`, () => {
+              expect(evalOp(`gt`, nyNoon, tokyoNoon)).toBe(true)
+              expect(evalOp(`gt`, tokyoNoon, nyNoon)).toBe(false)
+              expect(evalOp(`gt`, tokyoNoon, tokyoNoon)).toBe(false)
+              expect(evalOp(`gte`, tokyoNoon, tokyoNoon)).toBe(true)
+              expect(evalOp(`lt`, tokyoNoon, nyNoon)).toBe(true)
+              expect(evalOp(`lte`, tokyoNoon, tokyoNoon)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with same instant AND zone`, () => {
+              const tokyoNoonCopy = Temporal.ZonedDateTime.from(tokyoNoon)
+              expect(tokyoNoon).not.toBe(tokyoNoonCopy)
+              expect(evalOp(`eq`, tokyoNoon, tokyoNoonCopy)).toBe(true)
+            })
+
+            it(`eq returns false for same instant in different zones`, () => {
+              // ZonedDateTime.equals treats the time zone as part of identity, so two
+              // ZonedDateTimes for the same instant in different zones are not equal —
+              // even though .compare() returns 0 for them.
+              const inTokyo = nyNoon.withTimeZone(`Asia/Tokyo`)
+              expect(evalOp(`eq`, nyNoon, inTokyo)).toBe(false)
+            })
+
+            it(`ranks same-instant-different-zone as positionally equal`, () => {
+              // .compare() ranks by underlying instant, so two ZonedDateTimes for
+              // the same instant in different zones are positionally equal — even
+              // though .equals() returns false (see the eq test above). This
+              // verifies we dispatch to .compare() rather than lex-comparing
+              // toString output, which would order by zone name.
+              const inTokyo = nyNoon.withTimeZone(`Asia/Tokyo`)
+              expect(evalOp(`gt`, nyNoon, inTokyo)).toBe(false)
+              expect(evalOp(`lt`, nyNoon, inTokyo)).toBe(false)
+              expect(evalOp(`gte`, nyNoon, inTokyo)).toBe(true)
+              expect(evalOp(`lte`, nyNoon, inTokyo)).toBe(true)
+            })
+          })
+
+          describe(`Duration`, () => {
+            // Without a relativeTo, Duration ordering is only well-defined when both
+            // values are time/day-only. Calendar-affected fields (years/months/weeks)
+            // are not exercised here.
+            const oneHour = Temporal.Duration.from(`PT1H`)
+            const twoHours = Temporal.Duration.from(`PT2H`)
+
+            it(`orders time-only durations by length`, () => {
+              expect(evalOp(`gt`, twoHours, oneHour)).toBe(true)
+              expect(evalOp(`gt`, oneHour, twoHours)).toBe(false)
+              expect(evalOp(`gt`, oneHour, oneHour)).toBe(false)
+              expect(evalOp(`gte`, oneHour, oneHour)).toBe(true)
+              expect(evalOp(`lt`, oneHour, twoHours)).toBe(true)
+              expect(evalOp(`lte`, oneHour, oneHour)).toBe(true)
+            })
+
+            it(`eq returns true for distinct instances with the same value`, () => {
+              const oneHourCopy = Temporal.Duration.from(oneHour)
+              expect(oneHour).not.toBe(oneHourCopy)
+              expect(evalOp(`eq`, oneHour, oneHourCopy)).toBe(true)
+            })
+
+            it(`eq returns false for different durations`, () => {
+              expect(evalOp(`eq`, oneHour, twoHours)).toBe(false)
+            })
+
+            it(`equivalent forms compare equal but eq returns false`, () => {
+              // PT60M and PT1H represent the same duration. .compare() ranks them
+              // as equal, but .equals() (structural, field-by-field) does not, so
+              // eq returns false. This pins the asymmetry — and verifies we
+              // dispatch to .compare() rather than lex-comparing toString output,
+              // which would say "PT1H" < "PT60M".
+              const sixtyMinutes = Temporal.Duration.from(`PT60M`)
+              const oneHourLit = Temporal.Duration.from(`PT1H`)
+              expect(evalOp(`gt`, sixtyMinutes, oneHourLit)).toBe(false)
+              expect(evalOp(`lt`, sixtyMinutes, oneHourLit)).toBe(false)
+              expect(evalOp(`gte`, sixtyMinutes, oneHourLit)).toBe(true)
+              expect(evalOp(`lte`, sixtyMinutes, oneHourLit)).toBe(true)
+              expect(evalOp(`eq`, sixtyMinutes, oneHourLit)).toBe(false)
+            })
+          })
+
+          it(`eq returns false for different Temporal types with overlapping string forms`, () => {
+            // PlainDate and PlainDateTime can both stringify to "2024-01-15..." but
+            // should compare unequal because the types differ.
+            const date = Temporal.PlainDate.from(`2024-01-15`)
+            const dateTime = Temporal.PlainDateTime.from(`2024-01-15`)
+            // sanity-check the strings share a prefix
+            expect(dateTime.toString().startsWith(date.toString())).toBe(true)
+            expect(evalOp(`eq`, date, dateTime)).toBe(false)
+          })
+
+          it(`gt throws when comparing different Temporal types`, () => {
+            // Mixed-type ordering is undefined; surfacing a TypeError beats the
+            // string-lex pseudo-comparison Temporal explicitly designs against.
+            const date = Temporal.PlainDate.from(`2024-01-15`)
+            const dateTime = Temporal.PlainDateTime.from(`2024-01-15T00:00:00`)
+            expect(() => evalOp(`gt`, date, dateTime)).toThrow(
+              /different types/,
+            )
+          })
+        })
+      })
+      describe(`boolean operators`, () => {
+        it(`handles and with short-circuit evaluation`, () => {
+          const func = new Func(`and`, [
+            new Value(false),
+            new Func(`divide`, [new Value(1), new Value(0)]), // This would return null, but shouldn't be evaluated
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+
+        it(`handles and with null value (3-valued logic)`, () => {
+          const func = new Func(`and`, [new Value(true), new Value(null)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, true AND null = null (UNKNOWN)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles and with undefined value (3-valued logic)`, () => {
+          const func = new Func(`and`, [new Value(true), new Value(undefined)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, true AND undefined = null (UNKNOWN)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles and with null and false (3-valued logic)`, () => {
+          const func = new Func(`and`, [new Value(null), new Value(false)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, null AND false = false
+          expect(compiled({})).toBe(false)
+        })
+
+        it(`handles and with all true values`, () => {
+          const func = new Func(`and`, [new Value(true), new Value(true)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+
+        it(`handles or with short-circuit evaluation`, () => {
+          const func = new Func(`or`, [
+            new Value(true),
+            new Func(`divide`, [new Value(1), new Value(0)]), // This would return null, but shouldn't be evaluated
+          ])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+
+        it(`handles or with null value (3-valued logic)`, () => {
+          const func = new Func(`or`, [
+            new Value(false),
+            new Value(0),
+            new Value(null),
+          ])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, false OR null = null (UNKNOWN)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles or with undefined value (3-valued logic)`, () => {
+          const func = new Func(`or`, [
+            new Value(false),
+            new Value(0),
+            new Value(undefined),
+          ])
+          const compiled = compileExpression(func)
+          // In 3-valued logic, false OR undefined = null (UNKNOWN)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles or with null and true (3-valued logic)`, () => {
+          const func = new Func(`or`, [new Value(null), new Value(true)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, null OR true = true
+          expect(compiled({})).toBe(true)
+        })
+
+        it(`handles or with all false values`, () => {
+          const func = new Func(`or`, [new Value(false), new Value(0)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+
+        it(`handles not with null value (3-valued logic)`, () => {
+          const func = new Func(`not`, [new Value(null)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, NOT null = null (UNKNOWN)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles not with undefined value (3-valued logic)`, () => {
+          const func = new Func(`not`, [new Value(undefined)])
+          const compiled = compileExpression(func)
+
+          // In 3-valued logic, NOT undefined = null (UNKNOWN)
+          expect(compiled({})).toBe(null)
+        })
+
+        it(`handles not with true value`, () => {
+          const func = new Func(`not`, [new Value(true)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(false)
+        })
+
+        it(`handles not with false value`, () => {
+          const func = new Func(`not`, [new Value(false)])
+          const compiled = compileExpression(func)
+
+          expect(compiled({})).toBe(true)
+        })
+      })
+    })
+    describe(`value compilation`, () => {
+      it(`returns constant function for values`, () => {
+        const val = new Value(42)
+        const compiled = compileExpression(val)
+
+        expect(compiled({})).toBe(42)
+        expect(compiled({ users: { id: 1 } })).toBe(42) // Should be same regardless of input
+      })
+    })
+  })
+})
diff --git a/packages/db/tests/query/compiler/in-evaluator-oracle.property.test.ts b/packages/db/tests/query/compiler/in-evaluator-oracle.property.test.ts
index bca8b0ed6e..b0e4a144c6 100644
--- a/packages/db/tests/query/compiler/in-evaluator-oracle.property.test.ts
+++ b/packages/db/tests/query/compiler/in-evaluator-oracle.property.test.ts
@@ -4,6 +4,7 @@ import { Temporal } from 'temporal-polyfill'
 import { compileExpression } from '../../../src/query/compiler/evaluators.js'
 import { Func, PropRef, Value } from '../../../src/query/ir.js'
 import { oraclePropertyOptions, oracleRuns } from '../../oracle-config.js'
+import { declareOracle } from '../../oracle-declaration.js'
 
 /**
  * # Which values does `in` find in a list?
@@ -222,6 +223,8 @@ function describeCase(testCase: InCase): string {
   return `value=${show(testCase.value)} list=[${testCase.list.map(show).join(`, `)}] listFromRow=${testCase.listFromRow}`
 }
 
+declareOracle({ check: [check], model: [referenceIn] })
+
 describe(`in evaluator`, () => {
   const property = fc.property(inCase, (testCase) =>
     check(evaluateWithProduction, testCase),
diff --git a/packages/db/tests/query/custom-index-order-selection-oracle.test.ts b/packages/db/tests/query/custom-index-order-selection-oracle.test.ts
index 949a8dd3a2..8f444d29f5 100644
--- a/packages/db/tests/query/custom-index-order-selection-oracle.test.ts
+++ b/packages/db/tests/query/custom-index-order-selection-oracle.test.ts
@@ -31,6 +31,7 @@ import { createCollection } from '../../src/collection/index.js'
 import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import { createLiveQueryCollection } from '../../src/query/live-query-collection.js'
 import { PropRef } from '../../src/query/ir.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { mockSyncCollectionOptions, withOracleCleanup } from '../utils.js'
 import type { LoadSubsetOptions } from '../../src/types.js'
 
@@ -43,10 +44,23 @@ const rows: ReadonlyArray<Row> = [
 ]
 
 // The query's rank order comes from its declaration, not index traversal.
-const expectedIds = [...rows]
-  .sort((a, b) => a.rank - b.rank)
-  .slice(0, 2)
-  .map((row) => row.id)
+// The model sorts the rows by rank and keeps the first two ids of the window.
+function expectedRankWindowIds(): Array<number> {
+  return [...rows]
+    .sort((a, b) => a.rank - b.rank)
+    .slice(0, 2)
+    .map((row) => row.id)
+}
+
+// Each public window must equal the model's prediction for the same rows.
+function expectRankWindow(actualIds: unknown): void {
+  expect(actualIds).toEqual(expectedRankWindowIds())
+}
+
+declareOracle({
+  check: [expectRankWindow],
+  model: [expectedRankWindowIds],
+})
 
 function makeSource(
   mode: `eager` | `on-demand`,
@@ -116,7 +130,7 @@ it.each(
         ],
         limit: 2,
       })!
-      expect(direct.map((change) => change.value.id)).toEqual(expectedIds)
+      expectRankWindow(direct.map((change) => change.value.id))
 
       live = createLiveQueryCollection((q) =>
         q
@@ -125,7 +139,7 @@ it.each(
           .limit(2),
       )
       await live.preload()
-      expect([...live.values()].map((row) => row.id)).toEqual(expectedIds)
+      expectRankWindow([...live.values()].map((row) => row.id))
     }, [() => live?.cleanup(), () => source.cleanup()])
   },
 )
@@ -165,7 +179,7 @@ it(`uses a later eligible index after an unusable matching index`, async () => {
       limit: 2,
       optimizedOnly: true,
     })
-    expect(direct?.map((change) => change.value.id)).toEqual(expectedIds)
+    expectRankWindow(direct?.map((change) => change.value.id))
 
     live = createLiveQueryCollection((q) =>
       q
@@ -175,7 +189,7 @@ it(`uses a later eligible index after an unusable matching index`, async () => {
     )
     await live.preload()
 
-    expect([...live.values()].map((row) => row.id)).toEqual(expectedIds)
+    expectRankWindow([...live.values()].map((row) => row.id))
     expect(
       requests.some((request) => request.orderBy && request.limit === 2),
     ).toBe(true)
@@ -221,7 +235,7 @@ it(`eager indexing creates an ordered reader when only a custom reader exists`,
         .limit(2),
     )
     await live.preload()
-    expect([...live.values()].map((row) => row.id)).toEqual(expectedIds)
+    expectRankWindow([...live.values()].map((row) => row.id))
     expect(
       [...source.indexes.values()].filter(
         (index) =>
@@ -238,6 +252,6 @@ it(`eager indexing creates an ordered reader when only a custom reader exists`,
       limit: 2,
       optimizedOnly: true,
     })
-    expect(direct?.map((change) => change.value.id)).toEqual(expectedIds)
+    expectRankWindow(direct?.map((change) => change.value.id))
   }, [() => live?.cleanup(), () => source.cleanup()])
 })
diff --git a/packages/db/tests/query/derived-delete-reconciliation-oracle.test.ts b/packages/db/tests/query/derived-delete-reconciliation-oracle.test.ts
index 7b05413b4a..0ed2da5bd2 100644
--- a/packages/db/tests/query/derived-delete-reconciliation-oracle.test.ts
+++ b/packages/db/tests/query/derived-delete-reconciliation-oracle.test.ts
@@ -6,8 +6,20 @@ import { createLiveQueryCollection } from '../../src/query/index.js'
 import { createTransaction } from '../../src/transactions.js'
 import { stripVirtualProps } from '../utils.js'
 import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import type { SyncConfig } from '../../src/types.js'
 
+// Law: while an optimistic delete hides a derived row, synced batches for the
+// source are queued in the derived collection and publish nothing until the
+// transaction settles. After settlement, the derived collection and its
+// downstream hold the source's committed rows, whatever the batches'
+// membership deltas and whether the delete was acknowledged or rolled back.
+// Membership lookups run only for batches that carry an update. The check
+// (runFlushHistory) runs generated queue histories and compares the output
+// with the source rows it wrote. The model predicts the final rows of the
+// parameter grid. Unit tests for the same subsystem are in
+// derived-delete-reconciliation.test.ts.
+
 type Row = { id: number; value: number }
 type WritePhase = `initial` | `update` | `insert`
 const cases = ([`pass-through`, `order`, `select`] as const).flatMap((shape) =>
@@ -98,6 +110,25 @@ async function runFlushHistory(
   }
 }
 
+// The derived collection's committed rows after the queued batches settle:
+// row 1 keeps the last update, and each batch inserts row 2 + index. Row 2 is
+// updated to 40 by the second batch, so it keeps 40 when more than one batch
+// runs, and it keeps the value of its own insert otherwise.
+function expectedRowsAfterQueuedBatches(batches: number): Array<Row> {
+  return [
+    { id: 1, value: 19 + batches },
+    ...Array.from({ length: batches }, (_, index) => ({
+      id: 2 + index,
+      value: batches > 1 && index === 0 ? 40 : 30 + index,
+    })),
+  ]
+}
+
+declareOracle({
+  check: [runFlushHistory],
+  model: [expectedRowsAfterQueuedBatches],
+})
+
 it.each([`initial`, `update`, `insert`] as const)(
   `detects driver-only row mutation at the %s boundary`,
   async (phase) => {
@@ -125,144 +156,6 @@ fcTest.prop(
 )
 
 describe(`derived updates beneath optimistic deletes`, () => {
-  it.each([false, true])(
-    `uses committed last writes and truncate=%s for membership`,
-    async (truncate) => {
-      const collection = createCollection<Row>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            begin()
-            write({ type: `insert`, value: { id: 1, value: 0 } })
-            write({ type: `insert`, value: { id: 2, value: 0 } })
-            commit()
-            markReady()
-          },
-        },
-      })
-      try {
-        await collection.preload()
-        const batch = (
-          committed: boolean,
-        ): (typeof collection._state.pendingSyncedTransactions)[number] => ({
-          committed,
-          applicationStarted: false,
-          layoutChanged: false,
-          operations: [],
-          rowMetadataWrites: new Map(),
-          explicitRowMetadataWrites: new Map(),
-          collectionMetadataWrites: new Map(),
-          applied: createDeferred<void>(),
-        })
-        const earlier = batch(true)
-        earlier.operations.push({
-          type: `insert`,
-          key: 3,
-          value: { id: 3, value: 0 },
-        })
-        const later = batch(true)
-        later.truncate = truncate
-        later.operations.push(
-          { type: `delete`, key: 1, value: { id: 1, value: 0 } },
-          { type: `insert`, key: 4, value: { id: 4, value: 0 } },
-          { type: `delete`, key: 4, value: { id: 4, value: 0 } },
-          { type: `insert`, key: 1, value: { id: 1, value: 1 } },
-        )
-        const uncommitted = batch(false)
-        uncommitted.truncate = true
-        uncommitted.operations.push({
-          type: `insert`,
-          key: 5,
-          value: { id: 5, value: 0 },
-        })
-        // Directly exercise the membership snapshot; a real truncate normally
-        // drains immediately and must not be delayed just to construct this case.
-        collection._state.pendingSyncedTransactions.push(
-          earlier,
-          later,
-          uncommitted,
-        )
-        const hasKey = collection._state.createSyncedKeyLookup()
-        expect([1, 2, 3, 4, 5].map(hasKey)).toEqual([
-          true,
-          !truncate,
-          !truncate,
-          false,
-          false,
-        ])
-      } finally {
-        for (const batch of collection._state.pendingSyncedTransactions)
-          batch.applied.resolve()
-        collection._state.pendingSyncedTransactions.length = 0
-        await collection.cleanup()
-      }
-    },
-  )
-
-  it.each([64, 256])(
-    `classifies %i queued updates with linear membership work`,
-    async (count) => {
-      let sync!: Parameters<SyncConfig<Row>[`sync`]>[0]
-      const source = createCollection<Row>({
-        getKey: (row) => row.id,
-        sync: {
-          sync: (params) => {
-            sync = params
-            params.begin()
-            for (let id = 0; id < count; id++)
-              params.write({ type: `insert`, value: { id, value: 0 } })
-            params.commit()
-            params.markReady()
-          },
-        },
-      })
-      const derived = createLiveQueryCollection({
-        query: (q) => q.from({ row: source }),
-      })
-      const done = createDeferred<void>()
-      const tx = createTransaction({ mutationFn: () => done.promise })
-      const settled = tx.isPersisted.promise.catch(() => {})
-      try {
-        await derived.preload()
-        tx.mutate(() => derived.delete(0))
-        const publish = (value: number) => {
-          sync.begin()
-          for (let id = 0; id < count; id++)
-            sync.write({ type: `update`, value: { id, value } })
-          expect(sync.commit()).toBe(true)
-        }
-        publish(1)
-        let keyReads = 0
-        const queued = derived._state.pendingSyncedTransactions.flatMap(
-          (batch) => batch.operations,
-        )
-        expect(queued).toHaveLength(count)
-        for (const operation of queued) {
-          const key = operation.key
-          Object.defineProperty(operation, `key`, {
-            configurable: true,
-            get: () => {
-              keyReads++
-              return key
-            },
-          })
-        }
-        publish(2)
-        expect(keyReads).toBeLessThanOrEqual(count * 4)
-        done.resolve()
-        await settled
-        expect(
-          [...derived.values()].map((row) => stripVirtualProps(row)),
-        ).toEqual(Array.from({ length: count }, (_, id) => ({ id, value: 2 })))
-      } finally {
-        done.resolve()
-        await settled
-        await derived.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-
   it.each(cases)(
     `$shape / layered=$layered / $outcome / $batches batches`,
     async ({ shape, layered, outcome, batches }) => {
@@ -332,13 +225,7 @@ describe(`derived updates beneath optimistic deletes`, () => {
           if (outcome === `rollback`) done.reject(new Error(`Rejected delete`))
           else done.resolve()
           await settled
-          const expected = [
-            { id: 1, value: 19 + batches },
-            ...Array.from({ length: batches }, (_, index) => ({
-              id: 2 + index,
-              value: batches > 1 && index === 0 ? 40 : 30 + index,
-            })),
-          ]
+          const expected = expectedRowsAfterQueuedBatches(batches)
           expect(read(derived)).toEqual(expected)
           expect(read(downstream)).toEqual(expected)
         } finally {
diff --git a/packages/db/tests/query/derived-delete-reconciliation.test.ts b/packages/db/tests/query/derived-delete-reconciliation.test.ts
new file mode 100644
index 0000000000..4b4e62ff9e
--- /dev/null
+++ b/packages/db/tests/query/derived-delete-reconciliation.test.ts
@@ -0,0 +1,153 @@
+// Unit tests for derived collections beneath optimistic deletes: committed
+// membership and value reads while queued batches wait for the delete to
+// settle. The law and its oracle owner are in
+// derived-delete-reconciliation-oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { createLiveQueryCollection } from '../../src/query/index.js'
+import { createTransaction } from '../../src/transactions.js'
+import { stripVirtualProps } from '../utils.js'
+import type { SyncConfig } from '../../src/types.js'
+
+type Row = { id: number; value: number }
+
+describe(`derived updates beneath optimistic deletes`, () => {
+  it.each([false, true])(
+    `uses committed last writes and truncate=%s for membership`,
+    async (truncate) => {
+      const collection = createCollection<Row>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            begin()
+            write({ type: `insert`, value: { id: 1, value: 0 } })
+            write({ type: `insert`, value: { id: 2, value: 0 } })
+            commit()
+            markReady()
+          },
+        },
+      })
+      try {
+        await collection.preload()
+        const batch = (
+          committed: boolean,
+        ): (typeof collection._state.pendingSyncedTransactions)[number] => ({
+          committed,
+          applicationStarted: false,
+          layoutChanged: false,
+          operations: [],
+          rowMetadataWrites: new Map(),
+          explicitRowMetadataWrites: new Map(),
+          collectionMetadataWrites: new Map(),
+          applied: createDeferred<void>(),
+        })
+        const earlier = batch(true)
+        earlier.operations.push({
+          type: `insert`,
+          key: 3,
+          value: { id: 3, value: 0 },
+        })
+        const later = batch(true)
+        later.truncate = truncate
+        later.operations.push(
+          { type: `delete`, key: 1, value: { id: 1, value: 0 } },
+          { type: `insert`, key: 4, value: { id: 4, value: 0 } },
+          { type: `delete`, key: 4, value: { id: 4, value: 0 } },
+          { type: `insert`, key: 1, value: { id: 1, value: 1 } },
+        )
+        const uncommitted = batch(false)
+        uncommitted.truncate = true
+        uncommitted.operations.push({
+          type: `insert`,
+          key: 5,
+          value: { id: 5, value: 0 },
+        })
+        // Directly exercise the membership snapshot; a real truncate normally
+        // drains immediately and must not be delayed just to construct this case.
+        collection._state.pendingSyncedTransactions.push(
+          earlier,
+          later,
+          uncommitted,
+        )
+        const hasKey = collection._state.createSyncedKeyLookup()
+        expect([1, 2, 3, 4, 5].map(hasKey)).toEqual([
+          true,
+          !truncate,
+          !truncate,
+          false,
+          false,
+        ])
+      } finally {
+        for (const batch of collection._state.pendingSyncedTransactions)
+          batch.applied.resolve()
+        collection._state.pendingSyncedTransactions.length = 0
+        await collection.cleanup()
+      }
+    },
+  )
+
+  it.each([64, 256])(
+    `classifies %i queued updates with linear membership work`,
+    async (count) => {
+      let sync!: Parameters<SyncConfig<Row>[`sync`]>[0]
+      const source = createCollection<Row>({
+        getKey: (row) => row.id,
+        sync: {
+          sync: (params) => {
+            sync = params
+            params.begin()
+            for (let id = 0; id < count; id++)
+              params.write({ type: `insert`, value: { id, value: 0 } })
+            params.commit()
+            params.markReady()
+          },
+        },
+      })
+      const derived = createLiveQueryCollection({
+        query: (q) => q.from({ row: source }),
+      })
+      const done = createDeferred<void>()
+      const tx = createTransaction({ mutationFn: () => done.promise })
+      const settled = tx.isPersisted.promise.catch(() => {})
+      try {
+        await derived.preload()
+        tx.mutate(() => derived.delete(0))
+        const publish = (value: number) => {
+          sync.begin()
+          for (let id = 0; id < count; id++)
+            sync.write({ type: `update`, value: { id, value } })
+          expect(sync.commit()).toBe(true)
+        }
+        publish(1)
+        let keyReads = 0
+        const queued = derived._state.pendingSyncedTransactions.flatMap(
+          (batch) => batch.operations,
+        )
+        expect(queued).toHaveLength(count)
+        for (const operation of queued) {
+          const key = operation.key
+          Object.defineProperty(operation, `key`, {
+            configurable: true,
+            get: () => {
+              keyReads++
+              return key
+            },
+          })
+        }
+        publish(2)
+        expect(keyReads).toBeLessThanOrEqual(count * 4)
+        done.resolve()
+        await settled
+        expect(
+          [...derived.values()].map((row) => stripVirtualProps(row)),
+        ).toEqual(Array.from({ length: count }, (_, id) => ({ id, value: 2 })))
+      } finally {
+        done.resolve()
+        await settled
+        await derived.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+})
diff --git a/packages/db/tests/query/group-result-key-oracle.property.test.ts b/packages/db/tests/query/group-result-key-oracle.property.test.ts
index 5c64104fb0..c3a03e53a7 100644
--- a/packages/db/tests/query/group-result-key-oracle.property.test.ts
+++ b/packages/db/tests/query/group-result-key-oracle.property.test.ts
@@ -50,6 +50,7 @@ import { count } from '../../src/query/builder/functions.js'
 import { createCollection } from '../../src/collection/index.js'
 import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
 import { createOracleReach } from '../oracle-reach.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { mockSyncCollectionOptions, withOracleCleanup } from '../utils.js'
 
 const property = `group-result-key.groups`
@@ -257,6 +258,8 @@ async function runHistory(history: History, reach?: Reach): Promise<void> {
   }, [() => live.cleanup(), () => source.cleanup()])
 }
 
+declareOracle({ check: [runHistory], model: [expectedGroups] })
+
 describe(`grouped result key oracle`, () => {
   for (const [index, history] of pinnedHistories.entries()) {
     it(`keeps lookalike group values apart (pinned ${index})`, () =>
diff --git a/packages/db/tests/query/identity-output-shape-oracle.test.ts b/packages/db/tests/query/identity-output-shape-oracle.test.ts
index e332be63bc..488a0737fe 100644
--- a/packages/db/tests/query/identity-output-shape-oracle.test.ts
+++ b/packages/db/tests/query/identity-output-shape-oracle.test.ts
@@ -1,36 +1,32 @@
 import { isDeepStrictEqual } from 'node:util'
-import { D2, MultiSet, output, serializeValue } from '@tanstack/db-ivm'
+import { D2, MultiSet, output } from '@tanstack/db-ivm'
 import { Temporal } from 'temporal-polyfill'
 import fc from 'fast-check'
 import { describe, expect, it } from 'vitest'
+import { getQueryIR } from '../../src/query/builder/query-ir.js'
+import { createCollection } from '../../src/collection/index.js'
+import { compileQuery } from '../../src/query/compiler/index.js'
 import {
   Query,
   and,
   createLiveQueryCollection,
   eq,
 } from '../../src/query/index.js'
-import { getQueryIR } from '../../src/query/builder/query-ir.js'
-import { createCollection } from '../../src/collection/index.js'
-import { count as countRows } from '../../src/query/builder/functions.js'
-import { compileExpression } from '../../src/query/compiler/evaluators.js'
-import { compileQuery } from '../../src/query/compiler/index.js'
-import { getEqualityValueIdentity } from '../../src/query/equality-value-identity.js'
 import { queriesMatchForCaching } from '../../src/query/compiler/query-equivalence.js'
-import {
-  getLoadSubsetDemandKey,
-  getQueryIdentity,
-} from '../../src/query/ir-stable-identity.js'
+import { getQueryIdentity } from '../../src/query/ir-stable-identity.js'
 import {
   CollectionRef,
   Func,
   PropRef,
   QueryRef,
   UnionFrom,
-  Value,
 } from '../../src/query/ir.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
 import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { mockSyncCollectionOptions } from '../utils.js'
+import { assertEqualityPartition } from './identity-output-shape-support.js'
+import type { EqualityPair } from './identity-output-shape-support.js'
 import type { CollectionImpl } from '../../src/collection/index.js'
 import type { QueryIR } from '../../src/query/ir.js'
 
@@ -51,8 +47,9 @@ import type { QueryIR } from '../../src/query/ir.js'
  * Equality-value identity (D2 keyed state) and equality-operand identity
  * (query IR) must partition supported values alike. The value-pair grammar
  * declares expected equality independently, then checks both identity paths
- * at key construction. Fixed pairs also check public group rows after initial
- * publication. This law does not claim that SQL NULL matches a row.
+ * at key construction. Hand-written pairs and their public group rows are
+ * ordinary tests in identity-output-shape.test.ts. This law does not claim
+ * that SQL NULL matches a row.
  */
 
 type User = { id: number; label: string }
@@ -96,6 +93,37 @@ function expectBag(
   expect(remaining, 'no extra rows or duplicate multiplicity').toStrictEqual([])
 }
 
+/**
+ * Predicts the complete output bag of one form over the initial sources. The
+ * shape law: runShapes checks every compiled result against this prediction.
+ */
+function expectedShapeRows(
+  form: Form,
+  rows: Array<User>,
+  initialPosts: Array<Post>,
+  userAlias: string,
+  postAlias: string,
+): Array<unknown> {
+  const explicit = form.startsWith('explicit')
+  if (form === 'explicit-nested') return rows.map((row) => ({ ...row }))
+  if (form === 'empty-group')
+    return rows.map((row) => ({ [userAlias]: { ...row } }))
+  if (form === 'implicit-union')
+    return [
+      ...rows.map((row) => ({ [userAlias]: { ...row } })),
+      ...initialPosts.map((row) => ({ [postAlias]: { ...row } })),
+    ]
+  return rows.flatMap((user) =>
+    initialPosts
+      .filter((post) => post.userId === user.id)
+      .map((post) =>
+        explicit
+          ? { userId: user.id, label: user.label, title: post.title }
+          : { [userAlias]: { ...user }, [postAlias]: { ...post } },
+      ),
+  )
+}
+
 async function runShapes(
   form: Form,
   aliases: [string, string, string, string],
@@ -254,29 +282,6 @@ async function runShapes(
         identities[0] === identities[1],
         'output-sensitive identity law',
       ).toBe(explicit)
-      const expected = (
-        rows: Array<User>,
-        userAlias: string,
-        postAlias: string,
-      ): Array<unknown> => {
-        if (form === 'explicit-nested') return rows.map((row) => ({ ...row }))
-        if (form === 'empty-group')
-          return rows.map((row) => ({ [userAlias]: { ...row } }))
-        if (form === 'implicit-union')
-          return [
-            ...rows.map((row) => ({ [userAlias]: { ...row } })),
-            ...initialPosts.map((row) => ({ [postAlias]: { ...row } })),
-          ]
-        return rows.flatMap((user) =>
-          initialPosts
-            .filter((post) => post.userId === user.id)
-            .map((post) =>
-              explicit
-                ? { userId: user.id, label: user.label, title: post.title }
-                : { [userAlias]: { ...user }, [postAlias]: { ...post } },
-            ),
-        )
-      }
       const check = (outputs: Array<Array<unknown>>, rows: Array<User>) => {
         if (mutant === 'alias') outputs[1]![0] = { wrongAlias: outputs[1]![0] }
         if (mutant === 'missing-peer') outputs[1]!.pop()
@@ -284,8 +289,26 @@ async function runShapes(
           outputs[0] = [{ wrong: true }]
           outputs[1] = [{ wrong: true }]
         }
-        expectBag(outputs[0]!, expected(rows, left.userAlias, left.postAlias))
-        expectBag(outputs[1]!, expected(rows, right.userAlias, right.postAlias))
+        expectBag(
+          outputs[0]!,
+          expectedShapeRows(
+            form,
+            rows,
+            initialPosts,
+            left.userAlias,
+            left.postAlias,
+          ),
+        )
+        expectBag(
+          outputs[1]!,
+          expectedShapeRows(
+            form,
+            rows,
+            initialPosts,
+            right.userAlias,
+            right.postAlias,
+          ),
+        )
         if (explicit) expectBag(outputs[0]!, outputs[1]!)
       }
       check(initialOutputs, initialUsers)
@@ -353,135 +376,6 @@ describe('query identity agrees with compiled lexical output shape', () => {
   )
 })
 
-type EqualityPair = {
-  label: string
-  left: unknown
-  right: unknown
-  equal: boolean
-}
-
-function equalityKey(value: unknown): string {
-  return serializeValue(getEqualityValueIdentity(value))
-}
-
-function equalityOperandKey(value: unknown): string {
-  const where = new Func(`eq`, [
-    new PropRef([`row`, `value`]),
-    new Value(value),
-  ])
-  const key = getLoadSubsetDemandKey({ where })
-  if (key === undefined) throw new Error(`equality predicate lost its key`)
-  return key
-}
-
-function assertEqualityPartition({ label, left, right, equal }: EqualityPair) {
-  expect(equalityKey(left) === equalityKey(right), `${label}: D2 key`).toBe(
-    equal,
-  )
-  expect(
-    equalityOperandKey(left) === equalityOperandKey(right),
-    `${label}: IR operand key`,
-  ).toBe(equal)
-  const predicate = new Func(`eq`, [new Value(left), new Value(right)])
-  expect(compileExpression(predicate)({}), `${label}: predicate result`).toBe(
-    left == null || right == null ? null : equal,
-  )
-}
-
-// These pairs state the relation before either identity function runs. Fresh
-// nested objects retain reference identity; only Date, Temporal and byte views
-// have the value equality promised by the query contract.
-const sharedSymbol = Symbol(`same`)
-const sharedFunction = () => 1
-const fixedEqualityPairs: Array<EqualityPair> = [
-  { label: `signed zero`, left: -0, right: 0, equal: true },
-  { label: `NaN`, left: NaN, right: NaN, equal: true },
-  {
-    label: `invalid Date and NaN`,
-    left: new Date(Number.NaN),
-    right: NaN,
-    equal: true,
-  },
-  {
-    label: `valid Date and timestamp`,
-    left: new Date(1_700_000_000_000),
-    right: 1_700_000_000_000,
-    equal: true,
-  },
-  { label: `null and undefined`, left: null, right: undefined, equal: false },
-  { label: `bigint and number`, left: 1n, right: 1, equal: false },
-  { label: `infinities`, left: Infinity, right: -Infinity, equal: false },
-  { label: `empty string`, left: ``, right: ``, equal: true },
-  { label: `different strings`, left: `alpha`, right: `beta`, equal: false },
-  { label: `same-prefix strings`, left: `ab`, right: `ac`, equal: false },
-  {
-    label: `binary and reserved-looking string`,
-    left: new Uint8Array([1]),
-    right: `\u0000tanstack-db:binary:\u0001`,
-    equal: false,
-  },
-  {
-    label: `different Temporal types`,
-    left: Temporal.PlainDate.from(`2024-01-15`),
-    right: Temporal.PlainDateTime.from(`2024-01-15T00:00`),
-    equal: false,
-  },
-  {
-    label: `different Temporal dates`,
-    left: Temporal.PlainDate.from(`2024-01-15`),
-    right: Temporal.PlainDate.from(`2024-01-16`),
-    equal: false,
-  },
-  {
-    label: `different Date timestamps`,
-    left: new Date(100),
-    right: new Date(101),
-    equal: false,
-  },
-  {
-    label: `different bytes`,
-    left: Buffer.from([1, 2]),
-    right: new Uint8Array([1, 3]),
-    equal: false,
-  },
-  {
-    label: `empty binary encodings`,
-    left: Buffer.from([]),
-    right: new Uint8Array(),
-    equal: true,
-  },
-  {
-    label: `different typed-array constructors`,
-    left: new Int8Array([1]),
-    right: new Uint8Array([1]),
-    equal: false,
-  },
-  {
-    label: `same symbol`,
-    left: sharedSymbol,
-    right: sharedSymbol,
-    equal: true,
-  },
-  {
-    label: `different symbols`,
-    left: Symbol(`same`),
-    right: Symbol(`same`),
-    equal: false,
-  },
-  {
-    label: `same function`,
-    left: sharedFunction,
-    right: sharedFunction,
-    equal: true,
-  },
-  {
-    label: `fresh functions`,
-    left: () => 1,
-    right: () => 1,
-    equal: false,
-  },
-]
-
 const equalityPairArbitrary: fc.Arbitrary<EqualityPair> = fc.oneof(
   fc.integer().map((value) => ({
     label: `number`,
@@ -560,47 +454,6 @@ const equalityPairArbitrary: fc.Arbitrary<EqualityPair> = fc.oneof(
 )
 
 describe(`equality-value and IR operand identity agree`, () => {
-  it.each(fixedEqualityPairs)(`partitions $label as declared`, (pair) => {
-    assertEqualityPartition(pair)
-  })
-
-  it.each(fixedEqualityPairs)(
-    `materializes $label into the declared public groups`,
-    async ({ left, right, equal }) => {
-      const source = createCollection(
-        mockSyncCollectionOptions<{ id: number; value: unknown }>({
-          id: `equality-identity-public-groups`,
-          getKey: (row) => row.id,
-          initialData: [
-            { id: 1, value: left },
-            { id: 2, value: right },
-          ],
-        }),
-      )
-      const groups = createLiveQueryCollection({
-        startSync: true,
-        query: (q) =>
-          q
-            .from({ source })
-            .groupBy(({ source: row }) => row.value)
-            .select(({ source: row }) => ({
-              value: row.value,
-              count: countRows(row.id),
-            })),
-      })
-      await withHistoryCleanup(
-        () => {
-          expect(groups.size).toBe(equal ? 1 : 2)
-          expect(groups.toArray.map((row) => row.count).sort()).toStrictEqual(
-            equal ? [2] : [1, 1],
-          )
-          return Promise.resolve()
-        },
-        () => [() => groups.cleanup(), () => source.cleanup()],
-      )
-    },
-  )
-
   it.each([20260928, undefined])(
     `agrees across the supported value grammar, seed=%s`,
     async (seed) => {
@@ -617,6 +470,27 @@ describe(`equality-value and IR operand identity agree`, () => {
   )
 })
 
+type CompoundRow = { id: number; a: number; b: number; c: number }
+
+/**
+ * Predicts the pairs of one compound join variant. The independent model is a
+ * nested loop over the numeric rows: `different` compares the later operand
+ * with `c` where the other variants compare `b`.
+ */
+function expectedCompoundJoinRows(
+  leftRows: ReadonlyArray<CompoundRow>,
+  rightRows: ReadonlyArray<CompoundRow>,
+  variant: string,
+): Array<{ leftId: number; rightId: number }> {
+  return leftRows.flatMap((l) =>
+    rightRows
+      .filter(
+        (r) => l.a === r.a && l.b === (variant === `different` ? r.c : r.b),
+      )
+      .map((r) => ({ leftId: l.id, rightId: r.id })),
+  )
+}
+
 /**
  * AND is commutative, associative and idempotent, but changing an operand can
  * change the output. The feature request extends the existing identity law to
@@ -718,14 +592,10 @@ describe(`compound join identity and output`, () => {
           }
           for (const [variant, { live }] of Object.entries(queries)) {
             await live.preload()
-            const expected = leftRows.flatMap((l) =>
-              rightRows
-                .filter(
-                  (r) =>
-                    l.a === r.a &&
-                    l.b === (variant === `different` ? r.c : r.b),
-                )
-                .map((r) => ({ leftId: l.id, rightId: r.id })),
+            const expected = expectedCompoundJoinRows(
+              leftRows,
+              rightRows,
+              variant,
             )
             expectBag(
               live.toArray.map(({ leftId, rightId }) => ({ leftId, rightId })),
@@ -749,3 +619,7 @@ describe(`compound join identity and output`, () => {
     })
   }
 })
+declareOracle({
+  check: [runShapes],
+  model: [expectedShapeRows, expectedCompoundJoinRows],
+})
diff --git a/packages/db/tests/query/identity-output-shape-support.ts b/packages/db/tests/query/identity-output-shape-support.ts
new file mode 100644
index 0000000000..42e6d2adeb
--- /dev/null
+++ b/packages/db/tests/query/identity-output-shape-support.ts
@@ -0,0 +1,48 @@
+// Equality-partition checks for identity-output-shape. The law and its generated
+// campaign are owned by identity-output-shape-oracle.test.ts.
+import { serializeValue } from '@tanstack/db-ivm'
+import { expect } from 'vitest'
+import { compileExpression } from '../../src/query/compiler/evaluators.js'
+import { getEqualityValueIdentity } from '../../src/query/equality-value-identity.js'
+import { getLoadSubsetDemandKey } from '../../src/query/ir-stable-identity.js'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+
+export type EqualityPair = {
+  label: string
+  left: unknown
+  right: unknown
+  equal: boolean
+}
+
+function equalityKey(value: unknown): string {
+  return serializeValue(getEqualityValueIdentity(value))
+}
+
+function equalityOperandKey(value: unknown): string {
+  const where = new Func(`eq`, [
+    new PropRef([`row`, `value`]),
+    new Value(value),
+  ])
+  const key = getLoadSubsetDemandKey({ where })
+  if (key === undefined) throw new Error(`equality predicate lost its key`)
+  return key
+}
+
+export function assertEqualityPartition({
+  label,
+  left,
+  right,
+  equal,
+}: EqualityPair) {
+  expect(equalityKey(left) === equalityKey(right), `${label}: D2 key`).toBe(
+    equal,
+  )
+  expect(
+    equalityOperandKey(left) === equalityOperandKey(right),
+    `${label}: IR operand key`,
+  ).toBe(equal)
+  const predicate = new Func(`eq`, [new Value(left), new Value(right)])
+  expect(compileExpression(predicate)({}), `${label}: predicate result`).toBe(
+    left == null || right == null ? null : equal,
+  )
+}
diff --git a/packages/db/tests/query/identity-output-shape.test.ts b/packages/db/tests/query/identity-output-shape.test.ts
new file mode 100644
index 0000000000..dc31e81103
--- /dev/null
+++ b/packages/db/tests/query/identity-output-shape.test.ts
@@ -0,0 +1,149 @@
+// Hand-written equality pairs that pin the value relation, and the public group
+// rows they produce. identity-output-shape-oracle.test.ts owns the law and its
+// generated campaign.
+import { Temporal } from 'temporal-polyfill'
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { count as countRows } from '../../src/query/builder/functions.js'
+import { createLiveQueryCollection } from '../../src/query/index.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { mockSyncCollectionOptions } from '../utils.js'
+import { assertEqualityPartition } from './identity-output-shape-support.js'
+import type { EqualityPair } from './identity-output-shape-support.js'
+
+// These pairs state the relation before either identity function runs. Fresh
+// nested objects retain reference identity; only Date, Temporal and byte views
+// have the value equality promised by the query contract.
+const sharedSymbol = Symbol(`same`)
+const sharedFunction = () => 1
+const fixedEqualityPairs: Array<EqualityPair> = [
+  { label: `signed zero`, left: -0, right: 0, equal: true },
+  { label: `NaN`, left: NaN, right: NaN, equal: true },
+  {
+    label: `invalid Date and NaN`,
+    left: new Date(Number.NaN),
+    right: NaN,
+    equal: true,
+  },
+  {
+    label: `valid Date and timestamp`,
+    left: new Date(1_700_000_000_000),
+    right: 1_700_000_000_000,
+    equal: true,
+  },
+  { label: `null and undefined`, left: null, right: undefined, equal: false },
+  { label: `bigint and number`, left: 1n, right: 1, equal: false },
+  { label: `infinities`, left: Infinity, right: -Infinity, equal: false },
+  { label: `empty string`, left: ``, right: ``, equal: true },
+  { label: `different strings`, left: `alpha`, right: `beta`, equal: false },
+  { label: `same-prefix strings`, left: `ab`, right: `ac`, equal: false },
+  {
+    label: `binary and reserved-looking string`,
+    left: new Uint8Array([1]),
+    right: `\u0000tanstack-db:binary:\u0001`,
+    equal: false,
+  },
+  {
+    label: `different Temporal types`,
+    left: Temporal.PlainDate.from(`2024-01-15`),
+    right: Temporal.PlainDateTime.from(`2024-01-15T00:00`),
+    equal: false,
+  },
+  {
+    label: `different Temporal dates`,
+    left: Temporal.PlainDate.from(`2024-01-15`),
+    right: Temporal.PlainDate.from(`2024-01-16`),
+    equal: false,
+  },
+  {
+    label: `different Date timestamps`,
+    left: new Date(100),
+    right: new Date(101),
+    equal: false,
+  },
+  {
+    label: `different bytes`,
+    left: Buffer.from([1, 2]),
+    right: new Uint8Array([1, 3]),
+    equal: false,
+  },
+  {
+    label: `empty binary encodings`,
+    left: Buffer.from([]),
+    right: new Uint8Array(),
+    equal: true,
+  },
+  {
+    label: `different typed-array constructors`,
+    left: new Int8Array([1]),
+    right: new Uint8Array([1]),
+    equal: false,
+  },
+  {
+    label: `same symbol`,
+    left: sharedSymbol,
+    right: sharedSymbol,
+    equal: true,
+  },
+  {
+    label: `different symbols`,
+    left: Symbol(`same`),
+    right: Symbol(`same`),
+    equal: false,
+  },
+  {
+    label: `same function`,
+    left: sharedFunction,
+    right: sharedFunction,
+    equal: true,
+  },
+  {
+    label: `fresh functions`,
+    left: () => 1,
+    right: () => 1,
+    equal: false,
+  },
+]
+
+describe(`equality-value and IR operand identity agree`, () => {
+  it.each(fixedEqualityPairs)(`partitions $label as declared`, (pair) => {
+    assertEqualityPartition(pair)
+  })
+
+  it.each(fixedEqualityPairs)(
+    `materializes $label into the declared public groups`,
+    async ({ left, right, equal }) => {
+      const source = createCollection(
+        mockSyncCollectionOptions<{ id: number; value: unknown }>({
+          id: `equality-identity-public-groups`,
+          getKey: (row) => row.id,
+          initialData: [
+            { id: 1, value: left },
+            { id: 2, value: right },
+          ],
+        }),
+      )
+      const groups = createLiveQueryCollection({
+        startSync: true,
+        query: (q) =>
+          q
+            .from({ source })
+            .groupBy(({ source: row }) => row.value)
+            .select(({ source: row }) => ({
+              value: row.value,
+              count: countRows(row.id),
+            })),
+      })
+      await withHistoryCleanup(
+        () => {
+          expect(groups.size).toBe(equal ? 1 : 2)
+          expect(groups.toArray.map((row) => row.count).sort()).toStrictEqual(
+            equal ? [2] : [1, 1],
+          )
+          return Promise.resolve()
+        },
+        () => [() => groups.cleanup(), () => source.cleanup()],
+      )
+    },
+  )
+})
diff --git a/packages/db/tests/query/includes-alias-shadowing-oracle.test.ts b/packages/db/tests/query/includes-alias-shadowing-oracle.test.ts
index 5f4e9d49fa..311583f01f 100644
--- a/packages/db/tests/query/includes-alias-shadowing-oracle.test.ts
+++ b/packages/db/tests/query/includes-alias-shadowing-oracle.test.ts
@@ -2,7 +2,6 @@ import { describe, expect, test } from 'vitest'
 import {
   Query,
   add,
-  caseWhen,
   count,
   createLiveQueryCollection,
   eq,
@@ -12,13 +11,24 @@ import {
   toArray,
 } from '../../src/query/index.js'
 import { getQueryIR } from '../../src/query/builder/query-ir.js'
-import { IncludesSubquery, PropRef } from '../../src/query/ir.js'
 import { getQueryIdentity } from '../../src/query/ir-stable-identity.js'
 import { optimizeQuery } from '../../src/query/optimizer.js'
 import { BasicIndex } from '../../src/indexes/basic-index.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
 import { flushPromises } from '../utils.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { createScopedSource } from './includes-scope-identity-oracle.js'
+import {
+  initialLocks,
+  initialVotes,
+  voteAt,
+} from './includes-alias-shadowing-support.js'
+import type {
+  ChildAlias,
+  Context,
+  Lock,
+  Vote,
+} from './includes-alias-shadowing-support.js'
 
 /**
  * # Captured references survive alias shadowing
@@ -43,23 +53,9 @@ import { createScopedSource } from './includes-scope-identity-oracle.js'
  * generation.
  */
 
-type Lock = { id: number; name: string }
-type Vote = { id: number; lockId: number; lockName: string }
 type Form = `direct` | `queryRef` | `union` | `joinedImplicit`
 type OperandOrder = `childFirst` | `parentFirst`
-type ChildAlias = `lock` | `vote`
-type Context = Record<string, unknown>
 
-const initialLocks: Array<Lock> = [
-  { id: 1, name: `A` },
-  { id: 2, name: `B` },
-]
-const initialVotes: Array<Vote> = [
-  { id: 10, lockId: 1, lockName: `A` },
-  { id: 11, lockId: 1, lockName: `B` },
-  { id: 12, lockId: 2, lockName: `B` },
-  { id: 15, lockId: 99, lockName: `A` },
-]
 // Collection rows expose these documented virtual fields in addition to the
 // selected user fields. Their values are not part of this alias-scope law.
 const rootVirtualKeys = [
@@ -70,9 +66,6 @@ const rootVirtualKeys = [
   `$synced`,
 ]
 
-const voteAt = (context: Context, alias: ChildAlias): Vote =>
-  context[alias] as Vote
-
 /**
  * Model: source roles, not aliases, decide the relation. Each current lock
  * receives votes whose lockId equals its id. Recursive forms also require
@@ -168,6 +161,29 @@ function observedRows(
     .sort((a, b) => a.id - b.id)
 }
 
+/**
+ * The check: after each committed write, the public rows of the live query
+ * must equal the model's rows for the same source roles. The model's maps
+ * track the same writes the driver makes.
+ */
+function expectRowsFollowModel(
+  live: ReturnType<typeof createLiveQueryCollection>,
+  modelLocks: ReadonlyMap<number, Lock>,
+  modelVotes: ReadonlyMap<number, Vote>,
+  form: Form,
+  alias: ChildAlias,
+  checkpoint: string,
+) {
+  expect(observedRows(live, form, alias), checkpoint).toEqual(
+    modelRows(modelLocks, modelVotes, form, alias),
+  )
+}
+
+declareOracle({
+  check: [expectRowsFollowModel],
+  model: [modelRows],
+})
+
 /** The driver builds through the public Query and live Collection entry points. */
 function buildQuery(
   form: Form,
@@ -262,6 +278,70 @@ function buildQuery(
  * checkpoint. A union with duplicate branch aliases is outside the legal
  * grammar and has its own rejection witness.
  */
+function expectedVoteIds(votes: ReadonlyArray<Vote>, lockId: number) {
+  return votes
+    .filter((vote) => vote.lockId === lockId)
+    .map((vote) => ({ id: vote.id }))
+    .sort((a, b) => a.id - b.id)
+}
+
+function expectedReports(
+  employeeRows: ReadonlyMap<number, { id: number; managerId: number }>,
+  placement: `queryRef` | `union` | `joined`,
+) {
+  return [
+    ...employeeRows.values(),
+    ...(placement === `union` ? [{ id: 4, managerId: 0 }] : []),
+  ]
+    .map(({ id }) => ({
+      id,
+      reports: [...employeeRows.values()]
+        .filter((row) => row.managerId === id)
+        .map((row) => row.id)
+        .sort(),
+    }))
+    .sort((a, b) => a.id - b.id)
+}
+
+function expectedChildIdsByParent(
+  rows: ReadonlyArray<{ id: number; parentId: number }>,
+) {
+  return rows.map((parent) => ({
+    id: parent.id,
+    children: rows
+      .filter((child) => child.parentId === parent.id)
+      .map((child) => child.id)
+      .sort(),
+  }))
+}
+
+function expectedLockChildren(
+  locks: ReadonlyArray<Lock>,
+  currentVotes: ReadonlyMap<number, Vote>,
+) {
+  return locks.map((lock) => {
+    const members = [...currentVotes.values()]
+      .filter((vote) => vote.lockId === lock.id)
+      .sort((a, b) => a.id - b.id)
+    return {
+      id: lock.id,
+      children: members.map((member) => ({
+        id: member.id,
+        siblings: members.map((sibling) => sibling.id),
+      })),
+    }
+  })
+}
+
+declareOracle({
+  model: [
+    expectedVoteIds,
+    expectedReports,
+    expectedChildIdsByParent,
+    expectedLockChildren,
+  ],
+})
+
 describe(`captured alias scope oracle`, () => {
   for (const form of [
     `direct`,
@@ -288,8 +368,13 @@ describe(`captured alias scope oracle`, () => {
               async () => {
                 await live.preload()
                 const check = (checkpoint: string) =>
-                  expect(observedRows(live, form, alias), checkpoint).toEqual(
-                    modelRows(modelLocks, modelVotes, form, alias),
+                  expectRowsFollowModel(
+                    live,
+                    modelLocks,
+                    modelVotes,
+                    form,
+                    alias,
+                    checkpoint,
                   )
                 check(`initial publication`)
 
@@ -355,10 +440,7 @@ describe(`captured alias scope oracle`, () => {
       async () => {
         await live.preload()
         for (const row of live.toArray) {
-          const expected = initialVotes
-            .filter((vote) => vote.lockId === row.id)
-            .map((vote) => ({ id: vote.id }))
-            .sort((a, b) => a.id - b.id)
+          const expected = expectedVoteIds(initialVotes, row.id)
           expect(Object.keys(row).sort()).toEqual([
             ...rootVirtualKeys,
             `first`,
@@ -486,19 +568,7 @@ describe(`captured alias scope oracle`, () => {
               reports: reports.map(({ id: reportId }) => reportId).sort(),
             }))
             .sort((a, b) => a.id - b.id)
-        const model = () =>
-          [
-            ...employeeRows.values(),
-            ...(placement === `union` ? [{ id: 4, managerId: 0 }] : []),
-          ]
-            .map(({ id }) => ({
-              id,
-              reports: [...employeeRows.values()]
-                .filter((row) => row.managerId === id)
-                .map((row) => row.id)
-                .sort(),
-            }))
-            .sort((a, b) => a.id - b.id)
+        const model = () => expectedReports(employeeRows, placement)
         let live: ReturnType<typeof build> | undefined
         await withHistoryCleanup(
           async () => {
@@ -525,203 +595,6 @@ describe(`captured alias scope oracle`, () => {
     }
   }
 
-  /**
-   * One source declaration cannot play both the ancestor and descendant role.
-   * The same binding ID would make the required equality ambiguous before any
-   * live row is published. Sibling placement above remains legal because the
-   * two fields have no ancestor/descendant relationship.
-   */
-  for (const placement of [`direct`, `queryRef`] as const) {
-    test(`an ancestor builder reused in a ${placement} child asks for a new Query`, async () => {
-      const source = createScopedSource(
-        `ancestor-reuse-${placement}`,
-        [
-          { id: 1, parentId: 1 },
-          { id: 2, parentId: 1 },
-        ],
-        `eager`,
-      )
-      const base = new Query().from({ n: source.collection })
-
-      try {
-        expect(() =>
-          base.select(({ n: parent }) => ({
-            id: parent.id,
-            children:
-              placement === `direct`
-                ? toArray(
-                    base
-                      .where(({ n: child }) => eq(child.parentId, parent.id))
-                      .select(({ n: child }) => ({ id: child.id })),
-                  )
-                : toArray(
-                    new Query()
-                      .from({
-                        inner: base.select(({ n }) => ({
-                          id: n.id,
-                          parentId: n.parentId,
-                        })),
-                      })
-                      .where(({ inner }) => eq(inner.parentId, parent.id))
-                      .select(({ inner }) => ({ id: inner.id })),
-                  ),
-          })),
-        ).toThrow(/new Query\(\).*instead of passing the ancestor builder/)
-      } finally {
-        await source.collection.cleanup()
-      }
-    })
-  }
-
-  test(`an ancestor binding inside a union branch asks for a new Query`, async () => {
-    const source = createScopedSource(
-      `ancestor-union-reuse`,
-      [{ id: 1, parentId: 1 }],
-      `eager`,
-    )
-    const base = new Query().from({ n: source.collection })
-    try {
-      expect(() =>
-        base.select(({ n: parent }) => ({
-          id: parent.id,
-          children: toArray(
-            new Query()
-              .unionAll(
-                base.select(({ n }) => ({ id: n.id, parentId: n.parentId })),
-                new Query()
-                  .from({ other: source.collection })
-                  .select(({ other }) => ({
-                    id: other.id,
-                    parentId: other.parentId,
-                  })),
-              )
-              .where(({ parentId }) => eq(parentId, parent.id))
-              .select(({ id }) => ({ id })),
-          ),
-        })),
-      ).toThrow(/new Query\(\)/)
-    } finally {
-      await source.collection.cleanup()
-    }
-  })
-
-  /** A union branch and an include child are siblings, even when the union
-   * feeds the parent row. The branch's private source is not an ancestor. */
-  test(`an include may reuse a builder inside a sibling union branch`, async () => {
-    const source = createScopedSource(
-      `ancestor-union-branch-reuse`,
-      [{ id: 1, parentId: 1 }],
-      `eager`,
-    )
-    const first = new Query()
-      .from({ first: source.collection })
-      .select(({ first: row }) => ({ id: row.id, parentId: row.parentId }))
-    const second = new Query()
-      .from({ second: source.collection })
-      .select(({ second: row }) => ({ id: row.id, parentId: row.parentId }))
-
-    const live = createLiveQueryCollection({
-      query: new Query()
-        .unionAll(first, second)
-        .innerJoin({ anchor: source.collection }, ({ id, anchor }) =>
-          eq(id, anchor.id),
-        )
-        .select(({ anchor }) => ({
-          id: anchor.id,
-          children: toArray(
-            first
-              .where(({ first: child }) => eq(child.parentId, anchor.id))
-              .select(({ first: child }) => ({ id: child.id })),
-          ),
-        })),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await live.preload()
-        expect(
-          live.toArray.map(({ id, children }) => ({
-            id,
-            children: children.map(({ id: childId }) => ({ id: childId })),
-          })),
-        ).toEqual([
-          { id: 1, children: [{ id: 1 }] },
-          { id: 1, children: [{ id: 1 }] },
-        ])
-      },
-      () => [() => live.cleanup(), () => source.collection.cleanup()],
-    )
-  })
-
-  test(`an include may reuse a builder inside a sibling QueryRef`, async () => {
-    const source = createScopedSource(
-      `ancestor-queryref-source-reuse`,
-      [{ id: 1, parentId: 1 }],
-      `eager`,
-    )
-    const inner = new Query()
-      .from({ inner: source.collection })
-      .select(({ inner: row }) => ({ id: row.id, parentId: row.parentId }))
-
-    const live = createLiveQueryCollection({
-      query: new Query()
-        .from({ wrapped: inner })
-        .innerJoin({ anchor: source.collection }, ({ wrapped, anchor }) =>
-          eq(wrapped.id, anchor.id),
-        )
-        .select(({ anchor }) => ({
-          id: anchor.id,
-          children: toArray(
-            inner
-              .where(({ inner: child }) => eq(child.parentId, anchor.id))
-              .select(({ inner: child }) => ({ id: child.id })),
-          ),
-        })),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await live.preload()
-        expect(
-          live.toArray.map(({ id, children }) => ({
-            id,
-            children: children.map(({ id: childId }) => ({ id: childId })),
-          })),
-        ).toEqual([{ id: 1, children: [{ id: 1 }] }])
-      },
-      () => [() => live.cleanup(), () => source.collection.cleanup()],
-    )
-  })
-
-  test(`an ancestor binding inside a nested include asks for a new Query`, async () => {
-    const source = createScopedSource(
-      `ancestor-nested-reuse`,
-      [{ id: 1, parentId: 1 }],
-      `eager`,
-    )
-    const base = new Query().from({ n: source.collection })
-    try {
-      expect(() =>
-        base.select(({ n: parent }) => ({
-          id: parent.id,
-          children: toArray(
-            new Query()
-              .from({ c: source.collection })
-              .where(({ c }) => eq(c.parentId, parent.id))
-              .select(({ c }) => ({
-                id: c.id,
-                descendants: toArray(
-                  base
-                    .where(({ n }) => eq(n.parentId, c.id))
-                    .select(({ n }) => ({ id: n.id })),
-                ),
-              })),
-          ),
-        })),
-      ).toThrow(/new Query\(\)/)
-    } finally {
-      await source.collection.cleanup()
-    }
-  })
-
   /**
    * The inner QueryRef owns a different lexical scope from the include that
    * contains it. Its declarations cannot classify the captured parent ref as
@@ -762,15 +635,7 @@ describe(`captured alias scope oracle`, () => {
             children: children.map((child) => child.id).sort(),
           }))
           .sort((a, b) => a.id - b.id),
-      ).toEqual(
-        rows.map((parent) => ({
-          id: parent.id,
-          children: rows
-            .filter((child) => child.parentId === parent.id)
-            .map((child) => child.id)
-            .sort(),
-        })),
-      )
+      ).toEqual(expectedChildIdsByParent(rows))
     await withHistoryCleanup(
       async () => {
         await live.preload()
@@ -864,18 +729,7 @@ describe(`captured alias scope oracle`, () => {
         })),
     })
     const check = () => {
-      const expected = initialLocks.map((lock) => {
-        const members = [...currentVotes.values()]
-          .filter((vote) => vote.lockId === lock.id)
-          .sort((a, b) => a.id - b.id)
-        return {
-          id: lock.id,
-          children: members.map((member) => ({
-            id: member.id,
-            siblings: members.map((sibling) => sibling.id),
-          })),
-        }
-      })
+      const expected = expectedLockChildren(initialLocks, currentVotes)
       const actual = live.toArray
         .map((lock) => ({
           id: lock.id,
@@ -906,165 +760,6 @@ describe(`captured alias scope oracle`, () => {
     )
   })
 
-  test(`a functional callback reads child values under its public alias`, async () => {
-    const locks = createScopedSource(`functional-locks`, initialLocks, `eager`)
-    const votes = createScopedSource(`functional-votes`, initialVotes, `eager`)
-    const seen: Array<{
-      keys: Array<string>
-      id: number | undefined
-      lockId: number | undefined
-      lockName: string | undefined
-    }> = []
-    const live = createLiveQueryCollection({
-      query: new Query()
-        .from({ lock: locks.collection })
-        .select(({ lock: parent }) => ({
-          id: parent.id,
-          children: toArray(
-            new Query()
-              .from({ lock: votes.collection })
-              .where(({ lock: child }) => eq(child.lockId, parent.id))
-              .fn.where((row) => {
-                const child = row.lock as Vote | undefined
-                seen.push({
-                  keys: Object.keys(row).sort(),
-                  id: child?.id,
-                  lockId: child?.lockId,
-                  lockName: child?.lockName,
-                })
-                return child?.lockId !== undefined && child.id !== 11
-              })
-              .select(({ lock: child }) => ({ id: child.id })),
-          ),
-        })),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await live.preload()
-        // The callback drops vote 11. A parent row substituted for the child
-        // lacks lockId and drops every child at this public checkpoint.
-        expect(
-          live.toArray
-            .map((row) => ({
-              id: row.id,
-              children: row.children
-                .map((child) => child.id)
-                .sort((a, b) => a - b),
-            }))
-            .sort((a, b) => a.id - b.id),
-        ).toEqual([
-          { id: 1, children: [10] },
-          { id: 2, children: [12] },
-        ])
-        expect(seen.length).toBeGreaterThan(0)
-        expect(seen.some(({ id }) => id === 11)).toBe(true)
-        expect(
-          seen.every(
-            ({ keys, id, lockId, lockName }) =>
-              keys.join() === `lock` &&
-              initialVotes.some(
-                (vote) =>
-                  vote.id === id &&
-                  vote.lockId === lockId &&
-                  vote.lockName === lockName,
-              ),
-          ),
-        ).toBe(true)
-      },
-      () => [
-        () => live.cleanup(),
-        () => locks.collection.cleanup(),
-        () => votes.collection.cleanup(),
-      ],
-    )
-  })
-
-  test(`query identity preserves binding roles and erases explicit alias spelling`, async () => {
-    const locks = createScopedSource(`identity-locks`, initialLocks, `eager`)
-    const votes = createScopedSource(`identity-votes`, initialVotes, `eager`)
-    const make = (alias: ChildAlias, sameBinding: boolean) =>
-      new Query()
-        .from({ lock: locks.collection })
-        .select(({ lock: parent }) => ({
-          id: parent.id,
-          children: toArray(
-            new Query()
-              .from({ [alias]: votes.collection })
-              .where((context: Context) =>
-                eq(voteAt(context, alias).lockId, parent.id),
-              )
-              .where((context: Context) =>
-                eq(
-                  voteAt(context, alias).id,
-                  sameBinding ? voteAt(context, alias).id : parent.id,
-                ),
-              )
-              .select((context: Context) => ({
-                id: voteAt(context, alias).id,
-              })),
-          ),
-        }))
-    await withHistoryCleanup(
-      () =>
-        Promise.resolve().then(() => {
-          const identity = (alias: ChildAlias, sameBinding: boolean) =>
-            getQueryIdentity(getQueryIR(make(alias, sameBinding)))
-          expect(identity(`lock`, true)).toBe(identity(`vote`, true))
-          expect(identity(`lock`, false)).not.toBe(identity(`lock`, true))
-        }),
-      () => [
-        () => locks.collection.cleanup(),
-        () => votes.collection.cleanup(),
-      ],
-    )
-  })
-
-  test(`grouping reads the captured ancestor under a shadowed child name`, async () => {
-    const locks = createScopedSource(`group-locks`, initialLocks, `eager`)
-    const votes = createScopedSource(`group-votes`, initialVotes, `eager`)
-    const live = createLiveQueryCollection({
-      query: new Query()
-        .from({ lock: locks.collection })
-        .select(({ lock: parent }) => ({
-          id: parent.id,
-          children: toArray(
-            new Query()
-              .from({ lock: votes.collection })
-              .where(({ lock: child }) => eq(child.lockId, parent.id))
-              .groupBy(({ lock: child }) => [child.lockId, parent.id])
-              .select(({ lock: child }) => ({
-                lockId: child.lockId,
-                total: count(child.id),
-              })),
-          ),
-        })),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await live.preload()
-        expect(
-          live.toArray
-            .map((row) => ({
-              id: row.id,
-              children: row.children.map((child) => ({
-                lockId: child.lockId,
-                total: child.total,
-              })),
-            }))
-            .sort((a, b) => a.id - b.id),
-        ).toEqual([
-          { id: 1, children: [{ lockId: 1, total: 2 }] },
-          { id: 2, children: [{ lockId: 2, total: 1 }] },
-        ])
-      },
-      () => [
-        () => live.cleanup(),
-        () => locks.collection.cleanup(),
-        () => votes.collection.cleanup(),
-      ],
-    )
-  })
-
   /**
    * Spread model: the parent and child have deliberately different labels and
    * profile tags. A captured parent spread contributes the parent's value at
@@ -1073,150 +768,6 @@ describe(`captured alias scope oracle`, () => {
    * This tests whole-row and nested-path spread lowering separately from
    * ordinary scalar PropRefs in the generated matrix above.
    */
-  for (const alias of [`parent`, `child`] as const) {
-    for (const mode of [`eager`, `onDemand`] as const) {
-      for (const spread of [`row`, `profile`] as const) {
-        test(`captured ${spread} spread keeps parent binding with ${alias} child, ${mode}`, async () => {
-          const parents = createScopedSource(
-            `spread-parent`,
-            [{ id: 1, label: `parent`, profile: { tag: `parent-tag` } }],
-            `eager`,
-          )
-          const children = createScopedSource(
-            `spread-child`,
-            [
-              {
-                id: 10,
-                parentId: 1,
-                label: `child`,
-                profile: { tag: `child-tag` },
-              },
-            ],
-            mode,
-          )
-          const live = createLiveQueryCollection({
-            query: new Query()
-              .from({ parent: parents.collection })
-              .select(({ parent }) => ({
-                id: parent.id,
-                children: toArray(
-                  new Query()
-                    .from({ [alias]: children.collection })
-                    .where((context: Context) =>
-                      eq(
-                        (context[alias] as { parentId: number }).parentId,
-                        parent.id,
-                      ),
-                    )
-                    .select((context: Context) =>
-                      spread === `row`
-                        ? {
-                            ...parent,
-                            childId: (context[alias] as { id: number }).id,
-                          }
-                        : {
-                            ...parent.profile,
-                            childId: (context[alias] as { id: number }).id,
-                          },
-                    ),
-                ),
-              })),
-          })
-          const check = (label: string, tag: string) => {
-            const projected = (
-              live.toArray[0]?.children as Array<Record<string, unknown>>
-            ).map((row) =>
-              spread === `row`
-                ? { id: row.id, label: row.label, childId: row.childId }
-                : { tag: row.tag, childId: row.childId },
-            )
-            expect(projected).toEqual([
-              spread === `row`
-                ? { id: 1, label, childId: 10 }
-                : { tag, childId: 10 },
-            ])
-          }
-          await withHistoryCleanup(
-            async () => {
-              await live.preload()
-              check(`parent`, `parent-tag`)
-              parents.put({
-                id: 1,
-                label: `updated-parent`,
-                profile: { tag: `updated-parent-tag` },
-              })
-              check(`updated-parent`, `updated-parent-tag`)
-              children.put({
-                id: 10,
-                parentId: 1,
-                label: `updated-child`,
-                profile: { tag: `updated-child-tag` },
-              })
-              check(`updated-parent`, `updated-parent-tag`)
-            },
-            () => [
-              () => live.cleanup(),
-              () => parents.collection.cleanup(),
-              () => children.collection.cleanup(),
-            ],
-          )
-        })
-      }
-    }
-  }
-})
-
-/**
- * A child may use a captured ancestor only when its route projects that
- * binding. This is an internal plan invariant, separate from the public row
- * model above. Remove the projection from a legal, shadowed plan after the
- * builder made it: compilation must reject the malformed plan before a child
- * can silently read its same-named local row.
- */
-test(`a missing captured parent projection fails before child rows are read`, async () => {
-  const parents = createScopedSource(
-    `missing-projection-parent`,
-    [{ id: 1, name: `PARENT` }],
-    `eager`,
-  )
-  const children = createScopedSource(
-    `missing-projection-child`,
-    [{ id: 10, parentId: 1, name: `CHILD` }],
-    `eager`,
-  )
-  const query = new Query()
-    .from({ item: parents.collection })
-    .select(({ item: parent }) => ({
-      id: parent.id,
-      children: toArray(
-        new Query()
-          .from({ item: children.collection })
-          .where(({ item }) => eq(item.parentId, parent.id))
-          .select(({ item }) => ({
-            id: item.id,
-            parentName: parent.name,
-          })),
-      ),
-    }))
-  const includes = (getQueryIR(query).select as Record<string, unknown>)[
-    `children`
-  ]
-  expect(includes).toBeInstanceOf(IncludesSubquery)
-  const childPlan = includes as IncludesSubquery
-  expect(childPlan.parentProjection?.length).toBeGreaterThan(0)
-  childPlan.parentProjection = []
-  let live: ReturnType<typeof createLiveQueryCollection> | undefined
-
-  try {
-    await expect(async () => {
-      live = createLiveQueryCollection({ query })
-      await live.preload()
-    }).rejects.toThrow(/missing a captured parent projection/)
-  } finally {
-    await live?.cleanup()
-    await parents.collection.cleanup()
-    await children.collection.cleanup()
-  }
 })
 
 /**
@@ -1252,6 +803,8 @@ describe(`outer filters stay with their source under alias shadowing`, () => {
             },
       )
 
+  declareOracle({ model: [model] })
+
   for (const form of [`join`, `include`] as const) {
     for (const mode of [`eager`, `onDemand`] as const) {
       for (const childId of [1, 2] as const) {
@@ -1389,6 +942,8 @@ describe(`captured projections keep their binding during predicate pushdown`, ()
           : [],
     }))
 
+  declareOracle({ model: [model] })
+
   for (const mode of [`eager`, `onDemand`] as const) {
     test(`${mode}: parent rank controls the child result under both child aliases`, async () => {
       const parentRow = { id: 1, rank: `A` }
@@ -1563,6 +1118,8 @@ describe(`same-path group keys across alias scopes`, () => {
       })
       .sort((a, b) => a.id - b.id)
 
+  declareOracle({ model: [modelRowsForRanks] })
+
   for (const alias of [`parent`, `child`] as const) {
     for (const order of [`parentFirst`, `childFirst`] as const) {
       test(`group values retain ${alias} child binding with ${order} keys`, async () => {
@@ -1680,6 +1237,23 @@ describe(`group keys through nested source filtering`, () => {
     { id: 3, sourceId: 3 },
   ]
 
+  const expectedCategoryTotals = (
+    sourceRows: ReadonlyMap<number, Source>,
+    tagRows: ReadonlyMap<number, Tag>,
+  ) => {
+    const total = [...sourceRows.values()].reduce(
+      (sum, row) =>
+        sum +
+        (row.category === `A`
+          ? [...tagRows.values()].filter((tag) => tag.sourceId === row.id)
+              .length
+          : 0),
+      0,
+    )
+    return total ? [{ category: `A`, total }] : []
+  }
+  declareOracle({ model: [expectedCategoryTotals] })
+
   for (const innerAlias of [`x`, `u`] as const) {
     for (const mode of [`eager`, `onDemand`] as const) {
       test(`${mode} groups preserve the ${innerAlias} source through filtered joins and writes`, async () => {
@@ -1718,18 +1292,7 @@ describe(`group keys through nested source filtering`, () => {
 
         // The model counts joined matches afresh at each observation cut. It does
         // not inspect the optimized plan or derive expectations from it.
-        const expected = () => {
-          const total = [...sourceRows.values()].reduce(
-            (sum, row) =>
-              sum +
-              (row.category === `A`
-                ? [...tagRows.values()].filter((tag) => tag.sourceId === row.id)
-                    .length
-                : 0),
-            0,
-          )
-          return total ? [{ category: `A`, total }] : []
-        }
+        const expected = () => expectedCategoryTotals(sourceRows, tagRows)
         const check = (cut: string) =>
           expect(
             live.toArray.map(({ category, total }) => ({ category, total })),
@@ -1779,6 +1342,15 @@ describe(`group keys through nested source filtering`, () => {
   }
 })
 
+function expectedWrapperRows(
+  model: ReadonlyMap<number, { id: number; label: string }>,
+) {
+  return [...model.values()]
+    .map(({ id, label }) => ({ id, label }))
+    .sort((a, b) => a.id - b.id)
+}
+declareOracle({ model: [expectedWrapperRows] })
+
 /**
  * # A redundant wrapper does not change alpha-normalized identity
  *
@@ -1811,9 +1383,7 @@ test(`optimized redundant wrappers erase alias spelling`, async () => {
   // Observation: the rows establish the same public meaning before the
   // identity assertion; the model reads only its own plain Map.
   const checkRows = (checkpoint: string) => {
-    const expected = [...model.values()]
-      .map(({ id, label }) => ({ id, label }))
-      .sort((a, b) => a.id - b.id)
+    const expected = expectedWrapperRows(model)
     for (const live of [namedLive, renamedLive]) {
       expect(
         live.toArray
@@ -1945,6 +1515,8 @@ describe(`lazy join demand across nested alias scopes`, () => {
       })
       .sort((a, b) => a.anchorId - b.anchorId)
 
+  declareOracle({ model: [modelJoinedRows, requestMatches] })
+
   const buildCase = (postAlias: PostAlias, placement: PostPlacement) => {
     const anchors = createScopedSource(
       `lazy-alias-anchors-${postAlias}-${placement}`,
@@ -2083,72 +1655,40 @@ describe(`lazy join demand across nested alias scopes`, () => {
  * selection. It does not cover arbitrary join trees or provider schedules.
  */
 describe(`lexical bindings through recursive joins and selections`, () => {
-  test.each([`eager`, `onDemand`] as const)(
-    `a self-join with a shadowed FROM alias returns the same rows with %s loading`,
-    async (mode) => {
-      const people = createScopedSource(
-        `shadowed-self-join`,
-        [
-          { id: 1, managerId: 0, name: `manager` },
-          { id: 2, managerId: 1, name: `A` },
-          { id: 3, managerId: 1, name: `B` },
-          { id: 4, managerId: 1, name: `C` },
-        ],
-        mode,
-      )
-      people.collection.createIndex((person) => person.managerId, {
-        indexType: BasicIndex,
-      })
-      const build = (innerAlias: `user` | `u`) => {
-        const managers = new Query()
-          .from({ [innerAlias]: people.collection })
-          .where((context: Context) =>
-            eq((context[innerAlias] as { id: number }).id, 1),
-          )
-          .select((context: Context) => ({
-            id: (context[innerAlias] as { id: number }).id,
-          }))
-        return createLiveQueryCollection({
-          query: new Query()
-            .from({ manager: managers })
-            .leftJoin({ user: people.collection }, ({ manager, user }) =>
-              eq(manager.id, user.managerId),
-            )
-            .where(({ user }) => eq(user.managerId, 1))
-            .select(({ manager, user }) => ({
+  type ExpectedRow = {
+    managerId: number
+    userId: number | undefined
+    userName: string | undefined
+  }
+  const expectedManagerRows = (
+    managerRows: ReadonlyArray<{ id: number; name: string }>,
+    modelUsers: ReadonlyMap<
+      number,
+      { id: number; managerId: number; name: string }
+    >,
+  ): Array<ExpectedRow> =>
+    managerRows
+      .flatMap((manager): Array<ExpectedRow> => {
+        const matching = [...modelUsers.values()].filter(
+          (user) => user.managerId === manager.id,
+        )
+        return matching.length > 0
+          ? matching.map((user) => ({
               managerId: manager.id,
               userId: user.id,
-            })),
-        })
-      }
-      const shadowed = build(`user`)
-      const renamed = build(`u`)
-      const check = (live: typeof shadowed) =>
-        expect(
-          live.toArray
-            .map(({ managerId, userId }) => ({ managerId, userId }))
-            .sort((a, b) => (a.userId ?? Infinity) - (b.userId ?? Infinity)),
-        ).toEqual([
-          { managerId: 1, userId: 2 },
-          { managerId: 1, userId: 3 },
-          { managerId: 1, userId: 4 },
-        ])
-      await withHistoryCleanup(
-        async () => {
-          await shadowed.preload()
-          check(shadowed)
-          await renamed.preload()
-          check(shadowed)
-          check(renamed)
-        },
-        () => [
-          () => shadowed.cleanup(),
-          () => renamed.cleanup(),
-          () => people.collection.cleanup(),
-        ],
-      )
-    },
-  )
+              userName: user.name,
+            }))
+          : [
+              {
+                managerId: manager.id,
+                userId: undefined,
+                userName: undefined,
+              },
+            ]
+      })
+      .sort((a, b) => (a.userId ?? Infinity) - (b.userId ?? Infinity))
+
+  declareOracle({ model: [expectedManagerRows] })
 
   test.each([`eager`, `onDemand`] as const)(
     `a shadowed FROM subquery preserves joined rows with %s loading`,
@@ -2198,32 +1738,7 @@ describe(`lexical bindings through recursive joins and selections`, () => {
       const renamed = build(`member`)
 
       // Model: each manager joins its matching users, regardless of spelling.
-      type ExpectedRow = {
-        managerId: number
-        userId: number | undefined
-        userName: string | undefined
-      }
-      const expected = (): Array<ExpectedRow> =>
-        managerRows
-          .flatMap((manager): Array<ExpectedRow> => {
-            const matching = [...modelUsers.values()].filter(
-              (user) => user.managerId === manager.id,
-            )
-            return matching.length > 0
-              ? matching.map((user) => ({
-                  managerId: manager.id,
-                  userId: user.id,
-                  userName: user.name,
-                }))
-              : [
-                  {
-                    managerId: manager.id,
-                    userId: undefined,
-                    userName: undefined,
-                  },
-                ]
-          })
-          .sort((a, b) => (a.userId ?? Infinity) - (b.userId ?? Infinity))
+      const expected = () => expectedManagerRows(managerRows, modelUsers)
       const check = (checkpoint: string) => {
         for (const live of [shadowed, renamed]) {
           expect(
@@ -2270,541 +1785,84 @@ describe(`lexical bindings through recursive joins and selections`, () => {
       )
     },
   )
+})
 
-  test.each([`issue`, `comment`] as const)(
-    `joined child keeps its local source when named %s`,
-    async (childAlias) => {
-      const parents = createScopedSource(
-        `join-context-parent`,
-        [{ id: 1 }],
-        `eager`,
-      )
-      const children = createScopedSource(
-        `join-context-child`,
-        [{ id: 10, parentId: 1, anchorId: 7, title: `CHILD` }],
-        `eager`,
-      )
-      const anchors = createScopedSource(
-        `join-context-anchor`,
-        [{ id: 7, parentId: 1 }],
-        `eager`,
-      )
-      const live = createLiveQueryCollection({
-        query: new Query()
-          .from({ issue: parents.collection })
-          .select(({ issue: parent }) => {
-            const anchorQuery = new Query()
-              .from({ a: anchors.collection })
-              .where(({ a }) => eq(a.parentId, parent.id))
-              .select(({ a }) => ({ id: a.id }))
-            return {
-              id: parent.id,
-              children: toArray(
-                new Query()
-                  .from({ [childAlias]: children.collection })
-                  .innerJoin({ anchor: anchorQuery }, (context: Context) =>
-                    eq(
-                      (context[childAlias] as { anchorId: number }).anchorId,
-                      (context.anchor as { id: number }).id,
-                    ),
-                  )
-                  .where((context: Context) =>
-                    eq(
-                      (context[childAlias] as { parentId: number }).parentId,
-                      parent.id,
-                    ),
-                  )
-                  .select((context: Context) => ({
-                    title: (context[childAlias] as { title: string }).title,
-                    anchorId: (context.anchor as { id: number }).id,
-                  })),
-              ),
-            }
-          }),
-      })
-      await withHistoryCleanup(
-        async () => {
-          await live.preload()
-          // Model: child.title and anchor.id come from separate source roles.
-          const check = (title: string) =>
-            expect(
-              live.toArray.map(({ id, children: rows }) => ({
-                id,
-                children: rows.map(({ title: value, anchorId }) => ({
-                  title: value,
-                  anchorId,
-                })),
-              })),
-            ).toEqual([{ id: 1, children: [{ title, anchorId: 7 }] }])
-          check(`CHILD`)
-          children.put({ id: 10, parentId: 1, anchorId: 7, title: `UPDATED` })
-          await flushPromises()
-          check(`UPDATED`)
-        },
-        () => [
-          () => live.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-          () => anchors.collection.cleanup(),
-        ],
-      )
-    },
-  )
+/**
+ * ARCHITECTURE.md §Identity promises that a source in a nested query keeps its
+ * identity when its alias matches an outer join. A captured outer row also
+ * remains outer when the child selects its fields or spreads the whole row.
+ * Renaming the child alias therefore cannot change the public relation.
+ *
+ * This grammar crosses a child FROM or JOIN, field or whole-row capture,
+ * shadowed or renamed spelling, and eager or on-demand child sources. Its
+ * history moves a detail, changes the captured assignment, and moves that
+ * assignment between managers. The fixture keeps at most one outer joined row and one child row
+ * per anchor, so their default public keys remain unambiguous. It checks rows
+ * and, in on-demand mode, source requests after each committed write. It does
+ * not cover RIGHT or FULL joins, arbitrary join trees, or provider scheduling
+ * outside this controlled finite source.
+ */
+describe(`nested source placement preserves captured outer rows`, () => {
+  type Manager = { id: number; name: string }
+  type Assignment = { id: number; managerId: number; ownerTag: string }
+  type Detail = { id: number; managerId: number; label: string }
+  type Capture = `fields` | `spread`
 
-  test.each([`issue`, `anchor`] as const)(
-    `a missing joined source named %s does not read its parent alias`,
-    async (joinAlias) => {
-      const parents = createScopedSource(
-        `missing-join-parent`,
-        [{ id: 1 }],
-        `eager`,
-      )
-      const comments = createScopedSource(
-        `missing-join-comment`,
-        [{ id: 10, parentId: 1, anchorId: 7 }],
-        `eager`,
-      )
-      const anchors = createScopedSource<{ id: number }>(
-        `missing-join-anchor`,
-        [],
-        `eager`,
-      )
-      const live = createLiveQueryCollection({
-        query: new Query()
-          .from({ issue: parents.collection })
-          .select(({ issue: parent }) => ({
-            id: parent.id,
-            children: toArray(
-              new Query()
-                .from({ comment: comments.collection })
-                .leftJoin(
-                  { [joinAlias]: anchors.collection },
-                  (context: Context) =>
-                    eq(
-                      (context.comment as { anchorId: number }).anchorId,
-                      (context[joinAlias] as { id: number }).id,
-                    ),
-                )
-                .where((context: Context) =>
-                  eq(
-                    (context.comment as { parentId: number }).parentId,
-                    parent.id,
-                  ),
-                )
-                .select((context: Context) => ({
-                  childId: (context.comment as { id: number }).id,
-                  parentId: parent.id,
-                  joinedId: (context[joinAlias] as { id: number }).id,
-                })),
-            ),
-          })),
-      })
-      await withHistoryCleanup(
-        async () => {
-          await live.preload()
-          // Model: a left join without an anchor has no joined ID, even when
-          // the missing alias is also the parent's lexical name.
-          const check = (joinedId: number | undefined) =>
-            expect(
-              live.toArray.map(({ children }) =>
-                children.map((child) => ({
-                  childId: child.childId,
-                  parentId: child.parentId,
-                  joinedId: child.joinedId,
-                })),
-              ),
-            ).toEqual([[{ childId: 10, parentId: 1, joinedId }]])
-          check(undefined)
-          anchors.put({ id: 7 })
-          await flushPromises()
-          check(7)
-          anchors.remove(7)
-          await flushPromises()
-          check(undefined)
-        },
-        () => [
-          () => live.cleanup(),
-          () => parents.collection.cleanup(),
-          () => comments.collection.cleanup(),
-          () => anchors.collection.cleanup(),
-        ],
-      )
-    },
-  )
+  const initialManagers: Array<Manager> = [
+    { id: 1, name: `ONE` },
+    { id: 2, name: `TWO` },
+  ]
+  const initialAssignments: Array<Assignment> = [
+    { id: 101, managerId: 1, ownerTag: `OUTER` },
+  ]
+  const initialDetails: Array<Detail> = [
+    { id: 201, managerId: 1, label: `A` },
+    { id: 202, managerId: 2, label: `B` },
+  ]
 
-  test.each([`issue`, `comment`] as const)(
-    `captured and local spreads keep both sources when named %s`,
-    async (childAlias) => {
-      const parents = createScopedSource(
-        `spread-parent`,
-        [{ id: 1, parentName: `PARENT` }],
-        `eager`,
-      )
-      const children = createScopedSource(
-        `spread-child`,
-        [{ id: 10, parentId: 1, childName: `CHILD` }],
-        `eager`,
-      )
-      const live = createLiveQueryCollection({
-        query: new Query()
-          .from({ issue: parents.collection })
-          .select(({ issue: parent }) => ({
-            id: parent.id,
-            children: toArray(
-              new Query()
-                .from({ [childAlias]: children.collection })
-                .where((context: Context) =>
-                  eq(
-                    (context[childAlias] as { parentId: number }).parentId,
-                    parent.id,
-                  ),
-                )
-                .select((context: Context) => ({
-                  ...parent,
-                  ...(context[childAlias] as object),
-                })),
-            ),
-          })),
-      })
-      await withHistoryCleanup(
-        async () => {
-          await live.preload()
-          // Model: the later child spread replaces shared fields only.
-          const check = (parentName: string, childName: string) =>
-            expect(
-              live.toArray.map(({ children: rows }) =>
-                rows.map((row) => {
-                  const child = row as typeof row & { childName?: string }
-                  return {
-                    id: child.id,
-                    parentName: child.parentName,
-                    childName: child.childName,
+  /**
+   * Model: plain source roles determine a joined assignment and each
+   * manager's details. The child placement and aliases do not enter this
+   * computation. A later detail spread replaces its assignment's `id` only;
+   * fields with different names retain their source values.
+   */
+  const model = (
+    managers: ReadonlyMap<number, Manager>,
+    assignments: ReadonlyMap<number, Assignment>,
+    details: ReadonlyMap<number, Detail>,
+    capture: Capture,
+  ) =>
+    [...managers.values()]
+      .flatMap((manager) => {
+        const matching = [...assignments.values()].filter(
+          (assignment) => assignment.managerId === manager.id,
+        )
+        return matching.map((assignment) => ({
+          managerId: manager.id,
+          managerName: manager.name,
+          assignmentId: assignment.id,
+          details: [...details.values()]
+            .filter((detail) => detail.managerId === manager.id)
+            .map((detail) =>
+              capture === `fields`
+                ? {
+                    outerAssignmentId: assignment.id,
+                    detailId: detail.id,
+                    label: detail.label,
                   }
-                }),
-              ),
-            ).toEqual([[{ id: 10, parentName, childName }]])
-          check(`PARENT`, `CHILD`)
-          parents.put({ id: 1, parentName: `PARENT2` })
-          await flushPromises()
-          check(`PARENT2`, `CHILD`)
-          children.put({ id: 10, parentId: 1, childName: `CHILD2` })
-          await flushPromises()
-          check(`PARENT2`, `CHILD2`)
-        },
-        () => [
-          () => live.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ],
-      )
-    },
-  )
+                : {
+                    id: detail.id,
+                    managerId: detail.managerId,
+                    ownerTag: assignment.ownerTag,
+                    label: detail.label,
+                  },
+            )
+            .sort((a, b) => (a.detailId ?? a.id) - (b.detailId ?? b.id)),
+        }))
+      })
+      .sort((a, b) => a.managerId - b.managerId)
 
-  test(`a grandchild whole-row capture retains its grandparent fields`, async () => {
-    const roots = createScopedSource(
-      `grand-spread-root`,
-      [{ id: 1, rootName: `ROOT` }],
-      `eager`,
-    )
-    const middle = createScopedSource(
-      `grand-spread-middle`,
-      [{ id: 10, rootId: 1 }],
-      `eager`,
-    )
-    const leaves = createScopedSource(
-      `grand-spread-leaf`,
-      [{ id: 100, middleId: 10, leafName: `LEAF` }],
-      `eager`,
-    )
-    const live = createLiveQueryCollection({
-      query: new Query()
-        .from({ root: roots.collection })
-        .select(({ root: grandparent }) => ({
-          id: grandparent.id,
-          middle: toArray(
-            new Query()
-              .from({ m: middle.collection })
-              .where(({ m }) => eq(m.rootId, grandparent.id))
-              .select(({ m: parent }) => ({
-                id: parent.id,
-                leaves: toArray(
-                  new Query()
-                    .from({ leaf: leaves.collection })
-                    .where(({ leaf }) => eq(leaf.middleId, parent.id))
-                    .select(({ leaf }) => ({
-                      ...grandparent,
-                      leafName: leaf.leafName,
-                    })),
-                ),
-              })),
-          ),
-        })),
-    })
-    await withHistoryCleanup(
-      async () => {
-        await live.preload()
-        // Model: the leaf belongs to middle 10, and its captured root is 1.
-        const check = (rootName: string) =>
-          expect(
-            live.toArray.map(({ middle: rows }) =>
-              rows.map(({ leaves: nested }) =>
-                nested.map(({ rootName: value, leafName }) => ({
-                  rootName: value,
-                  leafName,
-                })),
-              ),
-            ),
-          ).toEqual([[[{ rootName, leafName: `LEAF` }]]])
-        check(`ROOT`)
-        roots.put({ id: 1, rootName: `ROOT2` })
-        await flushPromises()
-        check(`ROOT2`)
-      },
-      () => [
-        () => live.cleanup(),
-        () => roots.collection.cleanup(),
-        () => middle.collection.cleanup(),
-        () => leaves.collection.cleanup(),
-      ],
-    )
-  })
-
-  test.each([`issue`, `comment`] as const)(
-    `selecting a captured alias directly keeps its binding with child %s`,
-    async (childAlias) => {
-      const parents = createScopedSource(
-        `direct-parent`,
-        [{ id: 1, name: `PARENT` }],
-        `eager`,
-      )
-      const children = createScopedSource(
-        `direct-child`,
-        [{ id: 10, parentId: 1, name: `CHILD` }],
-        `eager`,
-      )
-      const live = createLiveQueryCollection({
-        query: new Query()
-          .from({ issue: parents.collection })
-          .select(({ issue: parent }) => ({
-            id: parent.id,
-            copies: toArray(
-              new Query()
-                .from({ [childAlias]: children.collection })
-                .where((context: Context) =>
-                  eq(
-                    (context[childAlias] as { parentId: number }).parentId,
-                    parent.id,
-                  ),
-                )
-                .select(() => parent),
-            ),
-          })),
-      })
-      await withHistoryCleanup(
-        async () => {
-          await live.preload()
-          const check = (name: string) =>
-            expect(
-              live.toArray.map(({ copies }) =>
-                copies.map(({ id, name: value }) => ({ id, name: value })),
-              ),
-            ).toEqual([[{ id: 1, name }]])
-          check(`PARENT`)
-          parents.put({ id: 1, name: `PARENT2` })
-          await flushPromises()
-          check(`PARENT2`)
-          children.put({ id: 10, parentId: 1, name: `CHILD2` })
-          await flushPromises()
-          check(`PARENT2`)
-        },
-        () => [
-          () => live.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ],
-      )
-    },
-  )
-
-  test(`repeated captured and local spreads have stable query identity`, async () => {
-    const parents = createScopedSource(
-      `identity-parent`,
-      [{ id: 1, name: `P` }],
-      `eager`,
-    )
-    const children = createScopedSource(
-      `identity-child`,
-      [{ id: 10, parentId: 1 }],
-      `eager`,
-    )
-    const build = () =>
-      new Query()
-        .from({ issue: parents.collection })
-        .select(({ issue: parent }) => ({
-          id: parent.id,
-          children: toArray(
-            new Query()
-              .from({ issue: children.collection })
-              .where(({ issue: child }) => eq(child.parentId, parent.id))
-              .select(({ issue: child }) => ({ ...parent, ...child })),
-          ),
-        }))
-    try {
-      expect(getQueryIdentity(getQueryIR(build()))).toBe(
-        getQueryIdentity(getQueryIR(build())),
-      )
-    } finally {
-      await parents.collection.cleanup()
-      await children.collection.cleanup()
-    }
-  })
-
-  /** A discarded spread may enumerate a captured proxy, but it contributes
-   * no field to the selected plan. The independent relation still joins each
-   * child to its parent once, and equivalent selected plans have one identity.
-   * This challenges whether spread bookkeeping leaks across two enumerations
-   * of the same proxy before the public row and identity checkpoints. */
-  test(`discarded proxy spreads do not change rows or query identity`, async () => {
-    const parents = createScopedSource(
-      `discarded-spread-parent`,
-      [{ id: 1, name: `PARENT` }],
-      `eager`,
-    )
-    const children = createScopedSource(
-      `discarded-spread-child`,
-      [{ id: 10, parentId: 1, name: `CHILD` }],
-      `eager`,
-    )
-    const build = (discard: boolean) =>
-      new Query()
-        .from({ issue: parents.collection })
-        .select(({ issue: parent }) => {
-          if (discard) {
-            const ignored = { ...parent }
-            void ignored
-          }
-          return {
-            id: parent.id,
-            children: toArray(
-              new Query()
-                .from({ issue: children.collection })
-                .where(({ issue: child }) => eq(child.parentId, parent.id))
-                .select(({ issue: child }) => ({ ...parent, ...child })),
-            ),
-          }
-        })
-    const ordinary = build(false)
-    const enumerated = build(true)
-    const first = createLiveQueryCollection({ query: ordinary })
-    const second = createLiveQueryCollection({ query: enumerated })
-    await withHistoryCleanup(
-      async () => {
-        expect(getQueryIdentity(getQueryIR(ordinary))).toBe(
-          getQueryIdentity(getQueryIR(enumerated)),
-        )
-        await first.preload()
-        await second.preload()
-        const observe = (live: typeof first) =>
-          live.toArray.map(({ id, children: rows }) => ({
-            id,
-            children: rows.map(({ id: childId, name }) => ({
-              id: childId,
-              name,
-            })),
-          }))
-        const expected = [{ id: 1, children: [{ id: 10, name: `CHILD` }] }]
-        expect(observe(first)).toEqual(expected)
-        expect(observe(second)).toEqual(expected)
-        children.put({ id: 10, parentId: 1, name: `UPDATED` })
-        await flushPromises()
-        const changed = [{ id: 1, children: [{ id: 10, name: `UPDATED` }] }]
-        expect(observe(first)).toEqual(changed)
-        expect(observe(second)).toEqual(changed)
-      },
-      () => [
-        () => first.cleanup(),
-        () => second.cleanup(),
-        () => parents.collection.cleanup(),
-        () => children.collection.cleanup(),
-      ],
-    )
-  })
-})
-
-/**
- * ARCHITECTURE.md §Identity promises that a source in a nested query keeps its
- * identity when its alias matches an outer join. A captured outer row also
- * remains outer when the child selects its fields or spreads the whole row.
- * Renaming the child alias therefore cannot change the public relation.
- *
- * This grammar crosses a child FROM or JOIN, field or whole-row capture,
- * shadowed or renamed spelling, and eager or on-demand child sources. Its
- * history moves a detail, changes the captured assignment, and moves that
- * assignment between managers. The fixture keeps at most one outer joined row and one child row
- * per anchor, so their default public keys remain unambiguous. It checks rows
- * and, in on-demand mode, source requests after each committed write. It does
- * not cover RIGHT or FULL joins, arbitrary join trees, or provider scheduling
- * outside this controlled finite source.
- */
-describe(`nested source placement preserves captured outer rows`, () => {
-  type Manager = { id: number; name: string }
-  type Assignment = { id: number; managerId: number; ownerTag: string }
-  type Detail = { id: number; managerId: number; label: string }
-  type Capture = `fields` | `spread`
-
-  const initialManagers: Array<Manager> = [
-    { id: 1, name: `ONE` },
-    { id: 2, name: `TWO` },
-  ]
-  const initialAssignments: Array<Assignment> = [
-    { id: 101, managerId: 1, ownerTag: `OUTER` },
-  ]
-  const initialDetails: Array<Detail> = [
-    { id: 201, managerId: 1, label: `A` },
-    { id: 202, managerId: 2, label: `B` },
-  ]
-
-  /**
-   * Model: plain source roles determine a joined assignment and each
-   * manager's details. The child placement and aliases do not enter this
-   * computation. A later detail spread replaces its assignment's `id` only;
-   * fields with different names retain their source values.
-   */
-  const model = (
-    managers: ReadonlyMap<number, Manager>,
-    assignments: ReadonlyMap<number, Assignment>,
-    details: ReadonlyMap<number, Detail>,
-    capture: Capture,
-  ) =>
-    [...managers.values()]
-      .flatMap((manager) => {
-        const matching = [...assignments.values()].filter(
-          (assignment) => assignment.managerId === manager.id,
-        )
-        return matching.map((assignment) => ({
-          managerId: manager.id,
-          managerName: manager.name,
-          assignmentId: assignment.id,
-          details: [...details.values()]
-            .filter((detail) => detail.managerId === manager.id)
-            .map((detail) =>
-              capture === `fields`
-                ? {
-                    outerAssignmentId: assignment.id,
-                    detailId: detail.id,
-                    label: detail.label,
-                  }
-                : {
-                    id: detail.id,
-                    managerId: detail.managerId,
-                    ownerTag: assignment.ownerTag,
-                    label: detail.label,
-                  },
-            )
-            .sort((a, b) => (a.detailId ?? a.id) - (b.detailId ?? b.id)),
-        }))
-      })
-      .sort((a, b) => a.managerId - b.managerId)
+  declareOracle({ model: [model] })
 
   for (const placement of [`from`, `join`] as const) {
     for (const capture of [`fields`, `spread`] as const) {
@@ -3114,6 +2172,8 @@ describe(`outer joins preserve absent source bindings under shadowing`, () => {
     )
   }
 
+  declareOracle({ model: [model] })
+
   for (const [kind, correlationSide] of [
     [`right`, `joined`],
     [`right`, `main`],
@@ -3380,6 +2440,8 @@ describe(`chained joins keep an absent local source absent`, () => {
       )
       .sort((a, b) => a.parentId - b.parentId || a.commentId - b.commentId)
 
+  declareOracle({ model: [model] })
+
   for (const mode of [`eager`, `onDemand`] as const) {
     test(`${mode} chained joins preserve absence under shadowing and renaming`, async () => {
       const parentRows = new Map<number, Issue>([
@@ -3609,6 +2671,8 @@ describe(`joined QueryRef lazy targets retain lexical source identity`, () => {
       }
     })
 
+  declareOracle({ model: [model] })
+
   for (const alias of [`u`, `post`] as const) {
     test(`${alias} post alias: projected tag drives on-demand rows`, async () => {
       const userRows = new Map<number, User>([
@@ -3836,6 +2900,8 @@ describe(`mixed outer-join chains retain absent source roles`, () => {
     )
   }
 
+  declareOracle({ model: [model] })
+
   for (const { first, second, correlation } of chains) {
     for (const mode of [`eager`, `onDemand`] as const) {
       test(`${first} then ${second}, ${correlation} correlation, ${mode} sources`, async () => {
@@ -4077,6 +3143,8 @@ describe(`captured ancestor join operands retain their bindings`, () => {
       }))
       .sort((a, b) => a.id - b.id)
 
+  declareOracle({ model: [model] })
+
   for (const mode of [`eager`, `onDemand`] as const) {
     test(`${mode} sources preserve captured operands across alias and equality order`, async () => {
       const parentRows = new Map<number, Parent>([[1, { id: 1, offset: 1 }]])
@@ -4235,269 +3303,6 @@ describe(`captured ancestor join operands retain their bindings`, () => {
   }
 })
 
-/**
- * # A captured source must be in the query's lexical scope
- *
- * ARCHITECTURE.md §Identity gives captured references their original source,
- * not the meaning of a later source with the same alias. A root query has no
- * ancestor; an include can use only its own sources and the containing query's
- * ancestors. The independent provenance model here has three source roles:
- * an unrelated declaration, the local main source, and the joined source.
- * Only the latter two are in scope, so a join using the unrelated declaration
- * must reject before preload can accept public rows. Renaming that declaration
- * cannot make it legal. The valid local operand and the ancestor-operand
- * matrix above distinguish this law from a validator that rejects every
- * captured reference.
- *
- * The finite grammar crosses root or include placement, eager or on-demand
- * sources, and matching or different alias spelling. It does not claim every
- * expression position or recursive source form. The driver uses public Query
- * and live-query Collection APIs; the observation cut is preload settlement.
- */
-describe(`join operands reject captured sources outside lexical scope`, () => {
-  type Row = { id: number }
-  type ForeignAlias = `local` | `unrelated`
-
-  for (const mode of [`eager`, `onDemand`] as const) {
-    for (const placement of [`root`, `include`] as const) {
-      test(`${mode} ${placement} joins reject foreign bindings regardless of alias`, async () => {
-        const unrelated = createScopedSource<Row>(
-          `foreign-${mode}-${placement}`,
-          [{ id: 999 }],
-          mode,
-        )
-        const local = createScopedSource<Row>(
-          `foreign-local-${mode}-${placement}`,
-          [{ id: 1 }],
-          mode,
-        )
-        const joined = createScopedSource<Row>(
-          `foreign-joined-${mode}-${placement}`,
-          [{ id: 1 }],
-          mode,
-        )
-        const parent = createScopedSource<Row>(
-          `foreign-parent-${mode}-${placement}`,
-          [{ id: 1 }],
-          `eager`,
-        )
-        joined.collection.createIndex((row) => row.id, {
-          indexType: BasicIndex,
-        })
-
-        // Capture the unrelated declaration through the same public callback
-        // mechanism as a legal ancestor reference. Its row value differs from
-        // the local source, so alias-based substitution would be observable.
-        const capture = (alias: ForeignAlias): number => {
-          let ref!: number
-          new Query()
-            .from({ [alias]: unrelated.collection })
-            .select((context: Context) => {
-              ref = (context[alias] as Row).id
-              return { id: ref }
-            })
-          return ref
-        }
-
-        const child = (operand: number) =>
-          new Query()
-            .from({ local: local.collection })
-            .innerJoin({ joined: joined.collection }, ({ joined: target }) =>
-              eq(operand, target.id),
-            )
-            .select(({ local: own, joined: target }) => ({
-              localId: own.id,
-              joinedId: target.id,
-            }))
-        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
-        const preloadForeign = async (alias: ForeignAlias) => {
-          const operand = capture(alias)
-          if (placement === `root`) {
-            const live = createLiveQueryCollection({ query: child(operand) })
-            invalidCleanups.push(() => live.cleanup())
-            await live.preload()
-            return
-          }
-          const live = createLiveQueryCollection({
-            query: new Query()
-              .from({ parent: parent.collection })
-              .select(({ parent: ancestor }) => ({
-                id: ancestor.id,
-                rows: toArray(
-                  child(operand).where(({ local: own }) =>
-                    eq(own.id, ancestor.id),
-                  ),
-                ),
-              })),
-          })
-          invalidCleanups.push(() => live.cleanup())
-          await live.preload()
-        }
-        const localControl = createLiveQueryCollection({
-          query: new Query()
-            .from({ local: local.collection })
-            .innerJoin(
-              { joined: joined.collection },
-              ({ local: own, joined: target }) => eq(own.id, target.id),
-            )
-            .select(({ local: own, joined: target }) => ({
-              localId: own.id,
-              joinedId: target.id,
-            })),
-        })
-
-        await withHistoryCleanup(
-          async () => {
-            await localControl.preload()
-            expect(
-              localControl.toArray.map(({ localId, joinedId }) => ({
-                localId,
-                joinedId,
-              })),
-            ).toEqual([{ localId: 1, joinedId: 1 }])
-            for (const alias of [`local`, `unrelated`] as const) {
-              await expect(
-                () => preloadForeign(alias),
-                `${placement}, ${mode}, unrelated alias ${alias}`,
-              ).rejects.toThrow(/out of scope/)
-            }
-          },
-          () => [
-            () => localControl.cleanup(),
-            ...invalidCleanups,
-            () => unrelated.collection.cleanup(),
-            () => local.collection.cleanup(),
-            () => joined.collection.cleanup(),
-            () => parent.collection.cleanup(),
-          ],
-        )
-      })
-    }
-  }
-})
-
-/**
- * # An unrelated bound reference cannot acquire a local alias's meaning
- *
- * ARCHITECTURE.md §Identity makes a captured reference name its declaration.
- * The foreign Query below is neither this query nor an ancestor, so its field
- * cannot be evaluated in a WHERE, GROUP BY, HAVING, ORDER BY, or SELECT
- * expression. The source-role model
- * predicts rejection before rows are accepted, regardless of whether the
- * foreign alias spells the local alias. A valid local reference must still
- * publish its row. This finite matrix owns those expression positions at
- * root preload; joins and recursive placements have separate cells above.
- */
-describe(`non-join expressions reject unrelated bound references`, () => {
-  type Row = { id: number }
-  for (const position of [
-    `where`,
-    `groupBy`,
-    `having`,
-    `orderBy`,
-    `select`,
-    `conditionalSelect`,
-  ] as const) {
-    for (const alias of [`local`, `unrelated`] as const) {
-      test(`${position} rejects a foreign source named ${alias}`, async () => {
-        const foreign = createScopedSource<Row>(
-          `foreign-${position}-${alias}`,
-          [{ id: 999 }],
-          `eager`,
-        )
-        const local = createScopedSource<Row>(
-          `local-${position}-${alias}`,
-          [{ id: 1 }],
-          `eager`,
-        )
-        let foreignRef!: number
-        new Query()
-          .from({ [alias]: foreign.collection })
-          .select((context: Context) => {
-            foreignRef = (context[alias] as Row).id
-            return { id: foreignRef }
-          })
-        const root = new Query().from({ local: local.collection })
-        const createInvalid = () => {
-          switch (position) {
-            case `where`:
-              return createLiveQueryCollection({
-                query: root
-                  .where(({ local: own }) => eq(foreignRef, own.id))
-                  .select(({ local: own }) => ({ id: own.id })),
-              })
-            case `groupBy`:
-              return createLiveQueryCollection({
-                query: root
-                  .groupBy(() => foreignRef)
-                  .select(({ local: own }) => ({
-                    total: count(own.id),
-                  })),
-              })
-            case `having`:
-              return createLiveQueryCollection({
-                query: root
-                  .groupBy(({ local: own }) => own.id)
-                  .select(({ local: own }) => ({
-                    id: own.id,
-                    total: count(own.id),
-                  }))
-                  .having(() => eq(foreignRef, 999)),
-              })
-            case `orderBy`:
-              return createLiveQueryCollection({
-                query: root
-                  .orderBy(() => foreignRef, `asc`)
-                  .select(({ local: own }) => ({ id: own.id })),
-              })
-            case `select`:
-              return createLiveQueryCollection({
-                query: root.select(({ local: own }) => ({
-                  id: own.id,
-                  foreignId: foreignRef,
-                })),
-              })
-            case `conditionalSelect`:
-              return createLiveQueryCollection({
-                query: root.select(({ local: own }) => ({
-                  id: own.id,
-                  selected: caseWhen(eq(foreignRef, own.id), own.id, 0),
-                })),
-              })
-          }
-        }
-        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
-        const preloadInvalid = async () => {
-          const invalid = createInvalid()
-          invalidCleanups.push(() => invalid.cleanup())
-          await invalid.preload()
-        }
-        const control = createLiveQueryCollection({
-          query: new Query()
-            .from({ local: local.collection })
-            .where(({ local: own }) => eq(own.id, 1))
-            .select(({ local: own }) => ({ id: own.id })),
-        })
-        await withHistoryCleanup(
-          async () => {
-            await control.preload()
-            expect(control.toArray.map(({ id }) => ({ id }))).toEqual([
-              { id: 1 },
-            ])
-            await expect(() => preloadInvalid()).rejects.toThrow(/out of scope/)
-          },
-          () => [
-            ...invalidCleanups,
-            () => control.cleanup(),
-            () => foreign.collection.cleanup(),
-            () => local.collection.cleanup(),
-          ],
-        )
-      })
-    }
-  }
-})
-
 /**
  * # A real ancestor remains available in grouping, HAVING, and ordering
  *
@@ -4538,6 +3343,8 @@ describe(`grouped includes keep valid ancestor references`, () => {
       })
       .sort((a, b) => a.id - b.id)
 
+  declareOracle({ model: [model] })
+
   for (const mode of [`eager`, `onDemand`] as const) {
     test(`${mode} grouped includes use ancestors across shadowing and updates`, async () => {
       const parentRows = new Map<number, Parent>([
@@ -4649,327 +3456,6 @@ describe(`grouped includes keep valid ancestor references`, () => {
   }
 })
 
-/**
- * # Extracting an include filter does not grant a foreign source ancestry
- *
- * A child WHERE that also reads its actual parent is evaluated per route.
- * The builder may move that predicate into the include's parent filters, but
- * moving it does not make an unrelated bound reference a parent. The model
- * distinguishes the parent's desired ID from a foreign declaration and
- * predicts exact rows for the legal filter and rejection for the foreign one.
- * The grammar crosses foreign alias spelling and source mode. Public preload
- * is the observation cut, before any invalid rows can be accepted.
- */
-describe(`include parent filters retain lexical provenance`, () => {
-  type Parent = { id: number; desiredId: number }
-  type Child = { id: number; parentId: number }
-  for (const mode of [`eager`, `onDemand`] as const) {
-    for (const foreignAlias of [`issue`, `unrelated`] as const) {
-      test(`${mode} include filter rejects foreign ${foreignAlias} but accepts its parent`, async () => {
-        const parent = createScopedSource<Parent>(
-          `filter-parent-${mode}-${foreignAlias}`,
-          [{ id: 1, desiredId: 1 }],
-          `eager`,
-        )
-        const child = createScopedSource<Child>(
-          `filter-child-${mode}-${foreignAlias}`,
-          [
-            { id: 1, parentId: 1 },
-            { id: 2, parentId: 1 },
-          ],
-          mode,
-        )
-        const foreign = createScopedSource(
-          `filter-foreign-${mode}-${foreignAlias}`,
-          [{ id: 999 }],
-          mode,
-        )
-        child.collection.createIndex((row) => row.parentId, {
-          indexType: BasicIndex,
-        })
-        child.collection.createIndex((row) => row.id, {
-          indexType: BasicIndex,
-        })
-        let foreignRef!: number
-        new Query()
-          .from({ [foreignAlias]: foreign.collection })
-          .select((context: Context) => {
-            foreignRef = (context[foreignAlias] as { id: number }).id
-            return { id: foreignRef }
-          })
-        const build = (useForeign: boolean) =>
-          createLiveQueryCollection({
-            query: new Query()
-              .from({ issue: parent.collection })
-              .select(({ issue: ancestor }) => ({
-                id: ancestor.id,
-                rows: toArray(
-                  new Query()
-                    .from({ issue: child.collection })
-                    .where(({ issue: own }) => eq(own.parentId, ancestor.id))
-                    .where(({ issue: own }) =>
-                      useForeign
-                        ? eq(foreignRef, own.id)
-                        : eq(own.id, ancestor.desiredId),
-                    )
-                    .select(({ issue: own }) => ({ id: own.id })),
-                ),
-              })),
-          })
-        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
-        const preloadInvalid = async () => {
-          const live = build(true)
-          invalidCleanups.push(() => live.cleanup())
-          await live.preload()
-        }
-        const valid = build(false)
-
-        await withHistoryCleanup(
-          async () => {
-            await valid.preload()
-            expect(
-              valid.toArray.map(({ id, rows }) => ({
-                id,
-                rows: rows.map(({ id: childId }) => ({ id: childId })),
-              })),
-            ).toEqual([{ id: 1, rows: [{ id: 1 }] }])
-            await expect(() => preloadInvalid()).rejects.toThrow(/out of scope/)
-          },
-          () => [
-            () => valid.cleanup(),
-            ...invalidCleanups,
-            () => parent.collection.cleanup(),
-            () => child.collection.cleanup(),
-            () => foreign.collection.cleanup(),
-          ],
-        )
-      })
-    }
-  }
-})
-
-/**
- * # Extracted include correlations still require a visible parent source
- *
- * ARCHITECTURE.md §Identity gives an include child access to its containing
- * query's declarations, not a source captured from an unrelated Query. The
- * builder removes the correlation equality from the child's WHERE, so the
- * source-role model checks that extracted field separately. A real parent
- * correlation must publish its child row. An unrelated source must reject
- * before rows are accepted, whether its alias matches the parent's or not.
- * The finite driver crosses both alias spellings and controlled source modes
- * at public preload; it makes no provider scheduling claim.
- */
-describe(`extracted include correlations retain lexical provenance`, () => {
-  type Parent = { id: number }
-  type Child = { id: number; parentId: number }
-  for (const mode of [`eager`, `onDemand`] as const) {
-    for (const foreignAlias of [`issue`, `unrelated`] as const) {
-      test(`${mode} correlation rejects foreign ${foreignAlias} but accepts its parent`, async () => {
-        const parent = createScopedSource<Parent>(
-          `correlation-parent-${mode}-${foreignAlias}`,
-          [{ id: 1 }],
-          `eager`,
-        )
-        const child = createScopedSource<Child>(
-          `correlation-child-${mode}-${foreignAlias}`,
-          [{ id: 10, parentId: 1 }],
-          mode,
-        )
-        const foreign = createScopedSource<Parent>(
-          `correlation-foreign-${mode}-${foreignAlias}`,
-          [{ id: 999 }],
-          mode,
-        )
-        child.collection.createIndex((row) => row.parentId, {
-          indexType: BasicIndex,
-        })
-        let foreignRef!: number
-        new Query()
-          .from({ [foreignAlias]: foreign.collection })
-          .select((context: Context) => {
-            foreignRef = (context[foreignAlias] as Parent).id
-            return { id: foreignRef }
-          })
-        const build = (useForeign: boolean) =>
-          createLiveQueryCollection({
-            query: new Query()
-              .from({ issue: parent.collection })
-              .select(({ issue: ancestor }) => ({
-                id: ancestor.id,
-                rows: toArray(
-                  new Query()
-                    .from({ child: child.collection })
-                    .where(({ child: own }) =>
-                      eq(own.parentId, useForeign ? foreignRef : ancestor.id),
-                    )
-                    .select(({ child: own }) => ({ id: own.id })),
-                ),
-              })),
-          })
-        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
-        const preloadInvalid = async () => {
-          const live = build(true)
-          invalidCleanups.push(() => live.cleanup())
-          await live.preload()
-        }
-        const valid = build(false)
-
-        await withHistoryCleanup(
-          async () => {
-            await valid.preload()
-            expect(
-              valid.toArray.map(({ id, rows }) => ({
-                id,
-                rows: rows.map(({ id: childId }) => ({ id: childId })),
-              })),
-            ).toEqual([{ id: 1, rows: [{ id: 10 }] }])
-            await expect(() => preloadInvalid()).rejects.toThrow(/out of scope/)
-          },
-          () => [
-            () => valid.cleanup(),
-            ...invalidCleanups,
-            () => parent.collection.cleanup(),
-            () => child.collection.cleanup(),
-            () => foreign.collection.cleanup(),
-          ],
-        )
-      })
-    }
-  }
-})
-
-/**
- * # A source inside a parent operand is not an include ancestor
- *
- * ARCHITECTURE.md §Identity/law 1 gives a child include access to the parent
- * query's declarations and its actual ancestors. A FROM QueryRef's own source
- * and a union branch's source are hidden behind their result rows. Capturing
- * either source's ref in an include join is therefore out of scope, whether
- * its alias matches the child's local alias or has another spelling.
- *
- * The independent provenance model here labels the inner declaration
- * `hidden` and predicts rejection; it never reads binding IDs or source-tree
- * traversal. The finite grammar crosses one or two recursive source levels,
- * QueryRef or union placement, matching or renamed hidden alias, and eager or
- * on-demand sources. Public Query and live Collection entry points must reject
- * by construction or preload, before accepting public rows. The legal local
- * and true-ancestor controls above prevent a blanket captured-ref rejection
- * from satisfying this rule. This does not claim every recursive expression
- * position; the captured value is a join operand in the include child.
- */
-describe(`include joins reject sources hidden inside parent operands`, () => {
-  type Hidden = { id: number; secret: number }
-  type Row = { id: number }
-
-  for (const mode of [`eager`, `onDemand`] as const) {
-    for (const placement of [
-      `queryRef`,
-      `unionBranch`,
-      `nestedQueryRef`,
-      `nestedUnionBranch`,
-    ] as const) {
-      for (const alias of [`local`, `inner`] as const) {
-        test(`${mode} ${placement} cannot expose inner binding ${alias} to its include`, async () => {
-          const hidden = createScopedSource<Hidden>(
-            `hidden-${mode}-${placement}`,
-            [{ id: 1, secret: 999 }],
-            mode,
-          )
-          const other = createScopedSource<Row>(
-            `hidden-other-${mode}-${placement}`,
-            [{ id: 2 }],
-            mode,
-          )
-          const local = createScopedSource<Row>(
-            `hidden-local-${mode}-${placement}`,
-            [{ id: 1 }],
-            mode,
-          )
-          const joined = createScopedSource<Row>(
-            `hidden-joined-${mode}-${placement}`,
-            [{ id: 1 }, { id: 999 }],
-            mode,
-          )
-          local.collection.createIndex((row) => row.id, {
-            indexType: BasicIndex,
-          })
-          joined.collection.createIndex((row) => row.id, {
-            indexType: BasicIndex,
-          })
-          const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
-
-          const preloadHidden = async () => {
-            let hiddenRef!: number
-            const inner = new Query()
-              .from({ [alias]: hidden.collection })
-              .select((context: Context) => {
-                const row = context[alias] as Hidden
-                hiddenRef = row.secret
-                return { id: row.id }
-              })
-            const branch =
-              placement === `unionBranch` || placement === `nestedUnionBranch`
-                ? new Query().unionAll(
-                    inner,
-                    new Query()
-                      .from({ other: other.collection })
-                      .select(({ other: row }) => ({ id: row.id })),
-                  )
-                : inner
-            const parentSource = placement.startsWith(`nested`)
-              ? new Query()
-                  .from({ middle: branch })
-                  .select((context: Context) => ({
-                    id: (context.middle as Row).id,
-                  }))
-              : branch
-            const outer = new Query().from({ parent: parentSource })
-            const live = createLiveQueryCollection({
-              query: outer.select((context: Context) => {
-                const parentId = (context.parent as Row).id
-                return {
-                  id: parentId,
-                  rows: toArray(
-                    new Query()
-                      .from({ local: local.collection })
-                      .innerJoin(
-                        { joined: joined.collection },
-                        ({ joined: target }) => eq(hiddenRef, target.id),
-                      )
-                      .where(({ local: row }) => eq(row.id, parentId))
-                      .select(({ local: row, joined: target }) => ({
-                        localId: row.id,
-                        joinedId: target.id,
-                      })),
-                  ),
-                }
-              }),
-            })
-            invalidCleanups.push(() => live.cleanup())
-            await live.preload()
-          }
-
-          await withHistoryCleanup(
-            async () => {
-              await expect(() => preloadHidden()).rejects.toThrow(
-                /out of scope/,
-              )
-            },
-            () => [
-              ...invalidCleanups,
-              () => hidden.collection.cleanup(),
-              () => other.collection.cleanup(),
-              () => local.collection.cleanup(),
-              () => joined.collection.cleanup(),
-            ],
-          )
-        })
-      }
-    }
-  }
-})
-
 /**
  * # A joined QueryRef cannot read an enclosing query's sibling source
  *
@@ -4986,92 +3472,31 @@ describe(`include joins reject sources hidden inside parent operands`, () => {
 describe(`joined subqueries reject captured sibling sources`, () => {
   type Row = { id: number }
 
-  for (const placement of [`root`, `include`] as const) {
-    for (const mode of [`eager`, `onDemand`] as const) {
-      for (const alias of [`local`, `inner`] as const) {
-        test(`${placement}, ${mode}, inner alias ${alias} rejects a sibling capture`, async () => {
-          const main = createScopedSource<Row>(
-            `sibling-main-${placement}-${mode}-${alias}`,
-            [{ id: 1 }],
-            mode,
-          )
-          const inner = createScopedSource<Row>(
-            `sibling-inner-${placement}-${mode}-${alias}`,
-            [{ id: 1 }],
-            mode,
-          )
-          const probe = createScopedSource<Row>(
-            `sibling-probe-${placement}-${mode}-${alias}`,
-            [{ id: 1 }],
-            mode,
-          )
-          const parent = createScopedSource<Row>(
-            `sibling-parent-${placement}-${mode}-${alias}`,
-            [{ id: 1 }],
-            `eager`,
+  const expectedAncestorRows = (
+    parentRows: ReadonlyArray<{ id: number }>,
+    mainRows: ReadonlyArray<{ id: number }>,
+    innerRows: ReadonlyArray<{ id: number }>,
+    probeRows: ReadonlyArray<{ id: number }>,
+  ) =>
+    parentRows.map((parent) => ({
+      id: parent.id,
+      rows: mainRows.flatMap((main) =>
+        innerRows
+          .filter(
+            (inner) =>
+              main.id === inner.id &&
+              main.id === parent.id &&
+              probeRows.some((probe) => probe.id === parent.id),
           )
-          const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
-
-          const preloadSibling = async () => {
-            let siblingRef!: number
-            const base = new Query()
-              .from({ local: main.collection })
-              .where((context: Context) => {
-                const row = context.local as Row
-                siblingRef = row.id
-                return eq(row.id, 1)
-              })
-            const joinedQuery = new Query()
-              .from({ [alias]: inner.collection })
-              .innerJoin({ probe: probe.collection }, ({ probe: row }) =>
-                eq(siblingRef, row.id),
-              )
-              .select((context: Context) => ({
-                id: (context[alias] as Row).id,
-              }))
-            const child = base
-              .innerJoin({ nested: joinedQuery }, ({ local: row, nested }) =>
-                eq(row.id, nested.id),
-              )
-              .select(({ local: row, nested }) => ({
-                localId: row.id,
-                joinedId: nested.id,
-              }))
-            const live =
-              placement === `root`
-                ? createLiveQueryCollection({ query: child })
-                : createLiveQueryCollection({
-                    query: new Query()
-                      .from({ parent: parent.collection })
-                      .select(({ parent: row }) => ({
-                        id: row.id,
-                        rows: toArray(
-                          child.where(({ local: own }) => eq(own.id, row.id)),
-                        ),
-                      })),
-                  })
-            invalidCleanups.push(() => live.cleanup())
-            await live.preload()
-          }
+          .map((inner) => ({
+            localId: main.id,
+            joinedId: inner.id,
+            ancestorId: parent.id,
+          })),
+      ),
+    }))
 
-          await withHistoryCleanup(
-            async () => {
-              await expect(() => preloadSibling()).rejects.toThrow(
-                /out of scope/,
-              )
-            },
-            () => [
-              ...invalidCleanups,
-              () => main.collection.cleanup(),
-              () => inner.collection.cleanup(),
-              () => probe.collection.cleanup(),
-              () => parent.collection.cleanup(),
-            ],
-          )
-        })
-      }
-    }
-  }
+  declareOracle({ model: [expectedAncestorRows] })
 
   for (const mode of [`eager`, `onDemand`] as const) {
     for (const alias of [`issue`, `inner`] as const) {
@@ -5080,23 +3505,12 @@ describe(`joined subqueries reject captured sibling sources`, () => {
         const mainRows = [{ id: 1 }, { id: 2 }]
         const innerRows = [{ id: 1 }, { id: 2 }]
         const probeRows = [{ id: 1 }, { id: 2 }]
-        const expected = parentRows.map((parent) => ({
-          id: parent.id,
-          rows: mainRows.flatMap((main) =>
-            innerRows
-              .filter(
-                (inner) =>
-                  main.id === inner.id &&
-                  main.id === parent.id &&
-                  probeRows.some((probe) => probe.id === parent.id),
-              )
-              .map((inner) => ({
-                localId: main.id,
-                joinedId: inner.id,
-                ancestorId: parent.id,
-              })),
-          ),
-        }))
+        const expected = expectedAncestorRows(
+          parentRows,
+          mainRows,
+          innerRows,
+          probeRows,
+        )
         const parent = createScopedSource(
           `sibling-control-parent-${mode}-${alias}`,
           parentRows,
@@ -5179,57 +3593,3 @@ describe(`joined subqueries reject captured sibling sources`, () => {
     }
   }
 })
-
-/**
- * A bound ancestor reference and an unbound raw-IR reference to the child's
- * joined alias name different declarations. The small public-row control
- * checks admission at preload; it does not model arbitrary raw-IR expressions.
- */
-test(`mixed bound and unbound same-alias join references name separate sources`, async () => {
-  const parent = createScopedSource(`mixed-bound-parent`, [{ id: 1 }], `eager`)
-  const child = createScopedSource(
-    `mixed-bound-child`,
-    [{ id: 10, parentId: 1 }],
-    `eager`,
-  )
-  const local = createScopedSource(`mixed-bound-local`, [{ id: 1 }], `eager`)
-  child.collection.createIndex((row) => row.parentId, {
-    indexType: BasicIndex,
-  })
-  local.collection.createIndex((row) => row.id, {
-    indexType: BasicIndex,
-  })
-  const live = createLiveQueryCollection({
-    query: new Query()
-      .from({ issue: parent.collection })
-      .select(({ issue: ancestor }) => ({
-        id: ancestor.id,
-        rows: toArray(
-          new Query()
-            .from({ child: child.collection })
-            .innerJoin({ issue: local.collection }, () =>
-              eq(ancestor.id, new PropRef([`issue`, `id`])),
-            )
-            .where(({ child: row }) => eq(row.parentId, ancestor.id))
-            .select(({ child: row, issue }) => ({
-              childId: row.id,
-              localIssueId: issue.id,
-            })),
-        ),
-      })),
-  })
-  await withHistoryCleanup(
-    async () => {
-      await live.preload()
-      expect(live.toArray.map(({ id, rows }) => ({ id, rows }))).toEqual([
-        { id: 1, rows: [{ childId: 10, localIssueId: 1 }] },
-      ])
-    },
-    () => [
-      () => live.cleanup(),
-      () => parent.collection.cleanup(),
-      () => child.collection.cleanup(),
-      () => local.collection.cleanup(),
-    ],
-  )
-})
diff --git a/packages/db/tests/query/includes-alias-shadowing-support.ts b/packages/db/tests/query/includes-alias-shadowing-support.ts
new file mode 100644
index 0000000000..2cfd46eefd
--- /dev/null
+++ b/packages/db/tests/query/includes-alias-shadowing-support.ts
@@ -0,0 +1,22 @@
+// Row types and fixture rows shared by the alias-shadowing oracle and its unit
+// tests. The oracle file owns the law; these rows have no model of their own.
+
+export type Lock = { id: number; name: string }
+export type Vote = { id: number; lockId: number; lockName: string }
+export type Context = Record<string, unknown>
+export type ChildAlias = `lock` | `vote`
+
+export const voteAt = (context: Context, alias: ChildAlias): Vote =>
+  context[alias] as Vote
+
+export const initialLocks: Array<Lock> = [
+  { id: 1, name: `A` },
+  { id: 2, name: `B` },
+]
+
+export const initialVotes: Array<Vote> = [
+  { id: 10, lockId: 1, lockName: `A` },
+  { id: 11, lockId: 1, lockName: `B` },
+  { id: 12, lockId: 2, lockName: `B` },
+  { id: 15, lockId: 99, lockName: `A` },
+]
diff --git a/packages/db/tests/query/includes-alias-shadowing.test.ts b/packages/db/tests/query/includes-alias-shadowing.test.ts
new file mode 100644
index 0000000000..d822a7f904
--- /dev/null
+++ b/packages/db/tests/query/includes-alias-shadowing.test.ts
@@ -0,0 +1,1795 @@
+// Unit tests for alias-scope rejections, captured-source projections, spreads,
+// and identity equalities. Each asserts literal rows, a thrown error, or a
+// production identity equality, and none compares production with a model.
+// The model-checked alias-scope cells, and the law they state (ARCHITECTURE.md
+// §Identity and law 1), are in includes-alias-shadowing-oracle.test.ts.
+import { describe, expect, test } from 'vitest'
+import {
+  Query,
+  caseWhen,
+  count,
+  createLiveQueryCollection,
+  eq,
+  toArray,
+} from '../../src/query/index.js'
+import { getQueryIR } from '../../src/query/builder/query-ir.js'
+import { IncludesSubquery, PropRef } from '../../src/query/ir.js'
+import { getQueryIdentity } from '../../src/query/ir-stable-identity.js'
+import { BasicIndex } from '../../src/indexes/basic-index.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { flushPromises } from '../utils.js'
+import { createScopedSource } from './includes-scope-identity-oracle.js'
+import {
+  initialLocks,
+  initialVotes,
+  voteAt,
+} from './includes-alias-shadowing-support.js'
+import type {
+  ChildAlias,
+  Context,
+  Vote,
+} from './includes-alias-shadowing-support.js'
+
+describe(`captured alias scope oracle`, () => {
+  /**
+   * One source declaration cannot play both the ancestor and descendant role.
+   * The same binding ID would make the required equality ambiguous before any
+   * live row is published. Sibling placement above remains legal because the
+   * two fields have no ancestor/descendant relationship.
+   */
+  for (const placement of [`direct`, `queryRef`] as const) {
+    test(`an ancestor builder reused in a ${placement} child asks for a new Query`, async () => {
+      const source = createScopedSource(
+        `ancestor-reuse-${placement}`,
+        [
+          { id: 1, parentId: 1 },
+          { id: 2, parentId: 1 },
+        ],
+        `eager`,
+      )
+      const base = new Query().from({ n: source.collection })
+
+      try {
+        expect(() =>
+          base.select(({ n: parent }) => ({
+            id: parent.id,
+            children:
+              placement === `direct`
+                ? toArray(
+                    base
+                      .where(({ n: child }) => eq(child.parentId, parent.id))
+                      .select(({ n: child }) => ({ id: child.id })),
+                  )
+                : toArray(
+                    new Query()
+                      .from({
+                        inner: base.select(({ n }) => ({
+                          id: n.id,
+                          parentId: n.parentId,
+                        })),
+                      })
+                      .where(({ inner }) => eq(inner.parentId, parent.id))
+                      .select(({ inner }) => ({ id: inner.id })),
+                  ),
+          })),
+        ).toThrow(/new Query\(\).*instead of passing the ancestor builder/)
+      } finally {
+        await source.collection.cleanup()
+      }
+    })
+  }
+
+  test(`an ancestor binding inside a union branch asks for a new Query`, async () => {
+    const source = createScopedSource(
+      `ancestor-union-reuse`,
+      [{ id: 1, parentId: 1 }],
+      `eager`,
+    )
+    const base = new Query().from({ n: source.collection })
+    try {
+      expect(() =>
+        base.select(({ n: parent }) => ({
+          id: parent.id,
+          children: toArray(
+            new Query()
+              .unionAll(
+                base.select(({ n }) => ({ id: n.id, parentId: n.parentId })),
+                new Query()
+                  .from({ other: source.collection })
+                  .select(({ other }) => ({
+                    id: other.id,
+                    parentId: other.parentId,
+                  })),
+              )
+              .where(({ parentId }) => eq(parentId, parent.id))
+              .select(({ id }) => ({ id })),
+          ),
+        })),
+      ).toThrow(/new Query\(\)/)
+    } finally {
+      await source.collection.cleanup()
+    }
+  })
+
+  test(`an ancestor binding inside a nested include asks for a new Query`, async () => {
+    const source = createScopedSource(
+      `ancestor-nested-reuse`,
+      [{ id: 1, parentId: 1 }],
+      `eager`,
+    )
+    const base = new Query().from({ n: source.collection })
+    try {
+      expect(() =>
+        base.select(({ n: parent }) => ({
+          id: parent.id,
+          children: toArray(
+            new Query()
+              .from({ c: source.collection })
+              .where(({ c }) => eq(c.parentId, parent.id))
+              .select(({ c }) => ({
+                id: c.id,
+                descendants: toArray(
+                  base
+                    .where(({ n }) => eq(n.parentId, c.id))
+                    .select(({ n }) => ({ id: n.id })),
+                ),
+              })),
+          ),
+        })),
+      ).toThrow(/new Query\(\)/)
+    } finally {
+      await source.collection.cleanup()
+    }
+  })
+})
+
+/**
+ * A child may use a captured ancestor only when its route projects that
+ * binding. This is an internal plan invariant, separate from the public row
+ * model above. Remove the projection from a legal, shadowed plan after the
+ * builder made it: compilation must reject the malformed plan before a child
+ * can silently read its same-named local row.
+ */
+test(`a missing captured parent projection fails before child rows are read`, async () => {
+  const parents = createScopedSource(
+    `missing-projection-parent`,
+    [{ id: 1, name: `PARENT` }],
+    `eager`,
+  )
+  const children = createScopedSource(
+    `missing-projection-child`,
+    [{ id: 10, parentId: 1, name: `CHILD` }],
+    `eager`,
+  )
+  const query = new Query()
+    .from({ item: parents.collection })
+    .select(({ item: parent }) => ({
+      id: parent.id,
+      children: toArray(
+        new Query()
+          .from({ item: children.collection })
+          .where(({ item }) => eq(item.parentId, parent.id))
+          .select(({ item }) => ({
+            id: item.id,
+            parentName: parent.name,
+          })),
+      ),
+    }))
+  const includes = (getQueryIR(query).select as Record<string, unknown>)[
+    `children`
+  ]
+  expect(includes).toBeInstanceOf(IncludesSubquery)
+  const childPlan = includes as IncludesSubquery
+  expect(childPlan.parentProjection?.length).toBeGreaterThan(0)
+  childPlan.parentProjection = []
+  let live: ReturnType<typeof createLiveQueryCollection> | undefined
+
+  try {
+    await expect(async () => {
+      live = createLiveQueryCollection({ query })
+      await live.preload()
+    }).rejects.toThrow(/missing a captured parent projection/)
+  } finally {
+    await live?.cleanup()
+    await parents.collection.cleanup()
+    await children.collection.cleanup()
+  }
+})
+
+describe(`lexical bindings through recursive joins and selections`, () => {
+  test(`repeated captured and local spreads have stable query identity`, async () => {
+    const parents = createScopedSource(
+      `identity-parent`,
+      [{ id: 1, name: `P` }],
+      `eager`,
+    )
+    const children = createScopedSource(
+      `identity-child`,
+      [{ id: 10, parentId: 1 }],
+      `eager`,
+    )
+    const build = () =>
+      new Query()
+        .from({ issue: parents.collection })
+        .select(({ issue: parent }) => ({
+          id: parent.id,
+          children: toArray(
+            new Query()
+              .from({ issue: children.collection })
+              .where(({ issue: child }) => eq(child.parentId, parent.id))
+              .select(({ issue: child }) => ({ ...parent, ...child })),
+          ),
+        }))
+    try {
+      expect(getQueryIdentity(getQueryIR(build()))).toBe(
+        getQueryIdentity(getQueryIR(build())),
+      )
+    } finally {
+      await parents.collection.cleanup()
+      await children.collection.cleanup()
+    }
+  })
+})
+
+describe(`captured alias scope oracle`, () => {
+  /** A union branch and an include child are siblings, even when the union
+   * feeds the parent row. The branch's private source is not an ancestor. */
+  test(`an include may reuse a builder inside a sibling union branch`, async () => {
+    const source = createScopedSource(
+      `ancestor-union-branch-reuse`,
+      [{ id: 1, parentId: 1 }],
+      `eager`,
+    )
+    const first = new Query()
+      .from({ first: source.collection })
+      .select(({ first: row }) => ({ id: row.id, parentId: row.parentId }))
+    const second = new Query()
+      .from({ second: source.collection })
+      .select(({ second: row }) => ({ id: row.id, parentId: row.parentId }))
+
+    const live = createLiveQueryCollection({
+      query: new Query()
+        .unionAll(first, second)
+        .innerJoin({ anchor: source.collection }, ({ id, anchor }) =>
+          eq(id, anchor.id),
+        )
+        .select(({ anchor }) => ({
+          id: anchor.id,
+          children: toArray(
+            first
+              .where(({ first: child }) => eq(child.parentId, anchor.id))
+              .select(({ first: child }) => ({ id: child.id })),
+          ),
+        })),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await live.preload()
+        expect(
+          live.toArray.map(({ id, children }) => ({
+            id,
+            children: children.map(({ id: childId }) => ({ id: childId })),
+          })),
+        ).toEqual([
+          { id: 1, children: [{ id: 1 }] },
+          { id: 1, children: [{ id: 1 }] },
+        ])
+      },
+      () => [() => live.cleanup(), () => source.collection.cleanup()],
+    )
+  })
+
+  test(`an include may reuse a builder inside a sibling QueryRef`, async () => {
+    const source = createScopedSource(
+      `ancestor-queryref-source-reuse`,
+      [{ id: 1, parentId: 1 }],
+      `eager`,
+    )
+    const inner = new Query()
+      .from({ inner: source.collection })
+      .select(({ inner: row }) => ({ id: row.id, parentId: row.parentId }))
+
+    const live = createLiveQueryCollection({
+      query: new Query()
+        .from({ wrapped: inner })
+        .innerJoin({ anchor: source.collection }, ({ wrapped, anchor }) =>
+          eq(wrapped.id, anchor.id),
+        )
+        .select(({ anchor }) => ({
+          id: anchor.id,
+          children: toArray(
+            inner
+              .where(({ inner: child }) => eq(child.parentId, anchor.id))
+              .select(({ inner: child }) => ({ id: child.id })),
+          ),
+        })),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await live.preload()
+        expect(
+          live.toArray.map(({ id, children }) => ({
+            id,
+            children: children.map(({ id: childId }) => ({ id: childId })),
+          })),
+        ).toEqual([{ id: 1, children: [{ id: 1 }] }])
+      },
+      () => [() => live.cleanup(), () => source.collection.cleanup()],
+    )
+  })
+
+  test(`a functional callback reads child values under its public alias`, async () => {
+    const locks = createScopedSource(`functional-locks`, initialLocks, `eager`)
+    const votes = createScopedSource(`functional-votes`, initialVotes, `eager`)
+    const seen: Array<{
+      keys: Array<string>
+      id: number | undefined
+      lockId: number | undefined
+      lockName: string | undefined
+    }> = []
+    const live = createLiveQueryCollection({
+      query: new Query()
+        .from({ lock: locks.collection })
+        .select(({ lock: parent }) => ({
+          id: parent.id,
+          children: toArray(
+            new Query()
+              .from({ lock: votes.collection })
+              .where(({ lock: child }) => eq(child.lockId, parent.id))
+              .fn.where((row) => {
+                const child = row.lock as Vote | undefined
+                seen.push({
+                  keys: Object.keys(row).sort(),
+                  id: child?.id,
+                  lockId: child?.lockId,
+                  lockName: child?.lockName,
+                })
+                return child?.lockId !== undefined && child.id !== 11
+              })
+              .select(({ lock: child }) => ({ id: child.id })),
+          ),
+        })),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await live.preload()
+        // The callback drops vote 11. A parent row substituted for the child
+        // lacks lockId and drops every child at this public checkpoint.
+        expect(
+          live.toArray
+            .map((row) => ({
+              id: row.id,
+              children: row.children
+                .map((child) => child.id)
+                .sort((a, b) => a - b),
+            }))
+            .sort((a, b) => a.id - b.id),
+        ).toEqual([
+          { id: 1, children: [10] },
+          { id: 2, children: [12] },
+        ])
+        expect(seen.length).toBeGreaterThan(0)
+        expect(seen.some(({ id }) => id === 11)).toBe(true)
+        expect(
+          seen.every(
+            ({ keys, id, lockId, lockName }) =>
+              keys.join() === `lock` &&
+              initialVotes.some(
+                (vote) =>
+                  vote.id === id &&
+                  vote.lockId === lockId &&
+                  vote.lockName === lockName,
+              ),
+          ),
+        ).toBe(true)
+      },
+      () => [
+        () => live.cleanup(),
+        () => locks.collection.cleanup(),
+        () => votes.collection.cleanup(),
+      ],
+    )
+  })
+
+  test(`query identity preserves binding roles and erases explicit alias spelling`, async () => {
+    const locks = createScopedSource(`identity-locks`, initialLocks, `eager`)
+    const votes = createScopedSource(`identity-votes`, initialVotes, `eager`)
+    const make = (alias: ChildAlias, sameBinding: boolean) =>
+      new Query()
+        .from({ lock: locks.collection })
+        .select(({ lock: parent }) => ({
+          id: parent.id,
+          children: toArray(
+            new Query()
+              .from({ [alias]: votes.collection })
+              .where((context: Context) =>
+                eq(voteAt(context, alias).lockId, parent.id),
+              )
+              .where((context: Context) =>
+                eq(
+                  voteAt(context, alias).id,
+                  sameBinding ? voteAt(context, alias).id : parent.id,
+                ),
+              )
+              .select((context: Context) => ({
+                id: voteAt(context, alias).id,
+              })),
+          ),
+        }))
+    await withHistoryCleanup(
+      () =>
+        Promise.resolve().then(() => {
+          const identity = (alias: ChildAlias, sameBinding: boolean) =>
+            getQueryIdentity(getQueryIR(make(alias, sameBinding)))
+          expect(identity(`lock`, true)).toBe(identity(`vote`, true))
+          expect(identity(`lock`, false)).not.toBe(identity(`lock`, true))
+        }),
+      () => [
+        () => locks.collection.cleanup(),
+        () => votes.collection.cleanup(),
+      ],
+    )
+  })
+
+  test(`grouping reads the captured ancestor under a shadowed child name`, async () => {
+    const locks = createScopedSource(`group-locks`, initialLocks, `eager`)
+    const votes = createScopedSource(`group-votes`, initialVotes, `eager`)
+    const live = createLiveQueryCollection({
+      query: new Query()
+        .from({ lock: locks.collection })
+        .select(({ lock: parent }) => ({
+          id: parent.id,
+          children: toArray(
+            new Query()
+              .from({ lock: votes.collection })
+              .where(({ lock: child }) => eq(child.lockId, parent.id))
+              .groupBy(({ lock: child }) => [child.lockId, parent.id])
+              .select(({ lock: child }) => ({
+                lockId: child.lockId,
+                total: count(child.id),
+              })),
+          ),
+        })),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await live.preload()
+        expect(
+          live.toArray
+            .map((row) => ({
+              id: row.id,
+              children: row.children.map((child) => ({
+                lockId: child.lockId,
+                total: child.total,
+              })),
+            }))
+            .sort((a, b) => a.id - b.id),
+        ).toEqual([
+          { id: 1, children: [{ lockId: 1, total: 2 }] },
+          { id: 2, children: [{ lockId: 2, total: 1 }] },
+        ])
+      },
+      () => [
+        () => live.cleanup(),
+        () => locks.collection.cleanup(),
+        () => votes.collection.cleanup(),
+      ],
+    )
+  })
+
+  for (const alias of [`parent`, `child`] as const) {
+    for (const mode of [`eager`, `onDemand`] as const) {
+      for (const spread of [`row`, `profile`] as const) {
+        test(`captured ${spread} spread keeps parent binding with ${alias} child, ${mode}`, async () => {
+          const parents = createScopedSource(
+            `spread-parent`,
+            [{ id: 1, label: `parent`, profile: { tag: `parent-tag` } }],
+            `eager`,
+          )
+          const children = createScopedSource(
+            `spread-child`,
+            [
+              {
+                id: 10,
+                parentId: 1,
+                label: `child`,
+                profile: { tag: `child-tag` },
+              },
+            ],
+            mode,
+          )
+          const live = createLiveQueryCollection({
+            query: new Query()
+              .from({ parent: parents.collection })
+              .select(({ parent }) => ({
+                id: parent.id,
+                children: toArray(
+                  new Query()
+                    .from({ [alias]: children.collection })
+                    .where((context: Context) =>
+                      eq(
+                        (context[alias] as { parentId: number }).parentId,
+                        parent.id,
+                      ),
+                    )
+                    .select((context: Context) =>
+                      spread === `row`
+                        ? {
+                            ...parent,
+                            childId: (context[alias] as { id: number }).id,
+                          }
+                        : {
+                            ...parent.profile,
+                            childId: (context[alias] as { id: number }).id,
+                          },
+                    ),
+                ),
+              })),
+          })
+          const check = (label: string, tag: string) => {
+            const projected = (
+              live.toArray[0]?.children as Array<Record<string, unknown>>
+            ).map((row) =>
+              spread === `row`
+                ? { id: row.id, label: row.label, childId: row.childId }
+                : { tag: row.tag, childId: row.childId },
+            )
+            expect(projected).toEqual([
+              spread === `row`
+                ? { id: 1, label, childId: 10 }
+                : { tag, childId: 10 },
+            ])
+          }
+          await withHistoryCleanup(
+            async () => {
+              await live.preload()
+              check(`parent`, `parent-tag`)
+              parents.put({
+                id: 1,
+                label: `updated-parent`,
+                profile: { tag: `updated-parent-tag` },
+              })
+              check(`updated-parent`, `updated-parent-tag`)
+              children.put({
+                id: 10,
+                parentId: 1,
+                label: `updated-child`,
+                profile: { tag: `updated-child-tag` },
+              })
+              check(`updated-parent`, `updated-parent-tag`)
+            },
+            () => [
+              () => live.cleanup(),
+              () => parents.collection.cleanup(),
+              () => children.collection.cleanup(),
+            ],
+          )
+        })
+      }
+    }
+  }
+})
+
+describe(`lexical bindings through recursive joins and selections`, () => {
+  test.each([`eager`, `onDemand`] as const)(
+    `a self-join with a shadowed FROM alias returns the same rows with %s loading`,
+    async (mode) => {
+      const people = createScopedSource(
+        `shadowed-self-join`,
+        [
+          { id: 1, managerId: 0, name: `manager` },
+          { id: 2, managerId: 1, name: `A` },
+          { id: 3, managerId: 1, name: `B` },
+          { id: 4, managerId: 1, name: `C` },
+        ],
+        mode,
+      )
+      people.collection.createIndex((person) => person.managerId, {
+        indexType: BasicIndex,
+      })
+      const build = (innerAlias: `user` | `u`) => {
+        const managers = new Query()
+          .from({ [innerAlias]: people.collection })
+          .where((context: Context) =>
+            eq((context[innerAlias] as { id: number }).id, 1),
+          )
+          .select((context: Context) => ({
+            id: (context[innerAlias] as { id: number }).id,
+          }))
+        return createLiveQueryCollection({
+          query: new Query()
+            .from({ manager: managers })
+            .leftJoin({ user: people.collection }, ({ manager, user }) =>
+              eq(manager.id, user.managerId),
+            )
+            .where(({ user }) => eq(user.managerId, 1))
+            .select(({ manager, user }) => ({
+              managerId: manager.id,
+              userId: user.id,
+            })),
+        })
+      }
+      const shadowed = build(`user`)
+      const renamed = build(`u`)
+      const check = (live: typeof shadowed) =>
+        expect(
+          live.toArray
+            .map(({ managerId, userId }) => ({ managerId, userId }))
+            .sort((a, b) => (a.userId ?? Infinity) - (b.userId ?? Infinity)),
+        ).toEqual([
+          { managerId: 1, userId: 2 },
+          { managerId: 1, userId: 3 },
+          { managerId: 1, userId: 4 },
+        ])
+      await withHistoryCleanup(
+        async () => {
+          await shadowed.preload()
+          check(shadowed)
+          await renamed.preload()
+          check(shadowed)
+          check(renamed)
+        },
+        () => [
+          () => shadowed.cleanup(),
+          () => renamed.cleanup(),
+          () => people.collection.cleanup(),
+        ],
+      )
+    },
+  )
+
+  test.each([`issue`, `comment`] as const)(
+    `joined child keeps its local source when named %s`,
+    async (childAlias) => {
+      const parents = createScopedSource(
+        `join-context-parent`,
+        [{ id: 1 }],
+        `eager`,
+      )
+      const children = createScopedSource(
+        `join-context-child`,
+        [{ id: 10, parentId: 1, anchorId: 7, title: `CHILD` }],
+        `eager`,
+      )
+      const anchors = createScopedSource(
+        `join-context-anchor`,
+        [{ id: 7, parentId: 1 }],
+        `eager`,
+      )
+      const live = createLiveQueryCollection({
+        query: new Query()
+          .from({ issue: parents.collection })
+          .select(({ issue: parent }) => {
+            const anchorQuery = new Query()
+              .from({ a: anchors.collection })
+              .where(({ a }) => eq(a.parentId, parent.id))
+              .select(({ a }) => ({ id: a.id }))
+            return {
+              id: parent.id,
+              children: toArray(
+                new Query()
+                  .from({ [childAlias]: children.collection })
+                  .innerJoin({ anchor: anchorQuery }, (context: Context) =>
+                    eq(
+                      (context[childAlias] as { anchorId: number }).anchorId,
+                      (context.anchor as { id: number }).id,
+                    ),
+                  )
+                  .where((context: Context) =>
+                    eq(
+                      (context[childAlias] as { parentId: number }).parentId,
+                      parent.id,
+                    ),
+                  )
+                  .select((context: Context) => ({
+                    title: (context[childAlias] as { title: string }).title,
+                    anchorId: (context.anchor as { id: number }).id,
+                  })),
+              ),
+            }
+          }),
+      })
+      await withHistoryCleanup(
+        async () => {
+          await live.preload()
+          // Model: child.title and anchor.id come from separate source roles.
+          const check = (title: string) =>
+            expect(
+              live.toArray.map(({ id, children: rows }) => ({
+                id,
+                children: rows.map(({ title: value, anchorId }) => ({
+                  title: value,
+                  anchorId,
+                })),
+              })),
+            ).toEqual([{ id: 1, children: [{ title, anchorId: 7 }] }])
+          check(`CHILD`)
+          children.put({ id: 10, parentId: 1, anchorId: 7, title: `UPDATED` })
+          await flushPromises()
+          check(`UPDATED`)
+        },
+        () => [
+          () => live.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+          () => anchors.collection.cleanup(),
+        ],
+      )
+    },
+  )
+
+  test.each([`issue`, `anchor`] as const)(
+    `a missing joined source named %s does not read its parent alias`,
+    async (joinAlias) => {
+      const parents = createScopedSource(
+        `missing-join-parent`,
+        [{ id: 1 }],
+        `eager`,
+      )
+      const comments = createScopedSource(
+        `missing-join-comment`,
+        [{ id: 10, parentId: 1, anchorId: 7 }],
+        `eager`,
+      )
+      const anchors = createScopedSource<{ id: number }>(
+        `missing-join-anchor`,
+        [],
+        `eager`,
+      )
+      const live = createLiveQueryCollection({
+        query: new Query()
+          .from({ issue: parents.collection })
+          .select(({ issue: parent }) => ({
+            id: parent.id,
+            children: toArray(
+              new Query()
+                .from({ comment: comments.collection })
+                .leftJoin(
+                  { [joinAlias]: anchors.collection },
+                  (context: Context) =>
+                    eq(
+                      (context.comment as { anchorId: number }).anchorId,
+                      (context[joinAlias] as { id: number }).id,
+                    ),
+                )
+                .where((context: Context) =>
+                  eq(
+                    (context.comment as { parentId: number }).parentId,
+                    parent.id,
+                  ),
+                )
+                .select((context: Context) => ({
+                  childId: (context.comment as { id: number }).id,
+                  parentId: parent.id,
+                  joinedId: (context[joinAlias] as { id: number }).id,
+                })),
+            ),
+          })),
+      })
+      await withHistoryCleanup(
+        async () => {
+          await live.preload()
+          // Model: a left join without an anchor has no joined ID, even when
+          // the missing alias is also the parent's lexical name.
+          const check = (joinedId: number | undefined) =>
+            expect(
+              live.toArray.map(({ children }) =>
+                children.map((child) => ({
+                  childId: child.childId,
+                  parentId: child.parentId,
+                  joinedId: child.joinedId,
+                })),
+              ),
+            ).toEqual([[{ childId: 10, parentId: 1, joinedId }]])
+          check(undefined)
+          anchors.put({ id: 7 })
+          await flushPromises()
+          check(7)
+          anchors.remove(7)
+          await flushPromises()
+          check(undefined)
+        },
+        () => [
+          () => live.cleanup(),
+          () => parents.collection.cleanup(),
+          () => comments.collection.cleanup(),
+          () => anchors.collection.cleanup(),
+        ],
+      )
+    },
+  )
+
+  test.each([`issue`, `comment`] as const)(
+    `captured and local spreads keep both sources when named %s`,
+    async (childAlias) => {
+      const parents = createScopedSource(
+        `spread-parent`,
+        [{ id: 1, parentName: `PARENT` }],
+        `eager`,
+      )
+      const children = createScopedSource(
+        `spread-child`,
+        [{ id: 10, parentId: 1, childName: `CHILD` }],
+        `eager`,
+      )
+      const live = createLiveQueryCollection({
+        query: new Query()
+          .from({ issue: parents.collection })
+          .select(({ issue: parent }) => ({
+            id: parent.id,
+            children: toArray(
+              new Query()
+                .from({ [childAlias]: children.collection })
+                .where((context: Context) =>
+                  eq(
+                    (context[childAlias] as { parentId: number }).parentId,
+                    parent.id,
+                  ),
+                )
+                .select((context: Context) => ({
+                  ...parent,
+                  ...(context[childAlias] as object),
+                })),
+            ),
+          })),
+      })
+      await withHistoryCleanup(
+        async () => {
+          await live.preload()
+          // Model: the later child spread replaces shared fields only.
+          const check = (parentName: string, childName: string) =>
+            expect(
+              live.toArray.map(({ children: rows }) =>
+                rows.map((row) => {
+                  const child = row as typeof row & { childName?: string }
+                  return {
+                    id: child.id,
+                    parentName: child.parentName,
+                    childName: child.childName,
+                  }
+                }),
+              ),
+            ).toEqual([[{ id: 10, parentName, childName }]])
+          check(`PARENT`, `CHILD`)
+          parents.put({ id: 1, parentName: `PARENT2` })
+          await flushPromises()
+          check(`PARENT2`, `CHILD`)
+          children.put({ id: 10, parentId: 1, childName: `CHILD2` })
+          await flushPromises()
+          check(`PARENT2`, `CHILD2`)
+        },
+        () => [
+          () => live.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ],
+      )
+    },
+  )
+
+  test(`a grandchild whole-row capture retains its grandparent fields`, async () => {
+    const roots = createScopedSource(
+      `grand-spread-root`,
+      [{ id: 1, rootName: `ROOT` }],
+      `eager`,
+    )
+    const middle = createScopedSource(
+      `grand-spread-middle`,
+      [{ id: 10, rootId: 1 }],
+      `eager`,
+    )
+    const leaves = createScopedSource(
+      `grand-spread-leaf`,
+      [{ id: 100, middleId: 10, leafName: `LEAF` }],
+      `eager`,
+    )
+    const live = createLiveQueryCollection({
+      query: new Query()
+        .from({ root: roots.collection })
+        .select(({ root: grandparent }) => ({
+          id: grandparent.id,
+          middle: toArray(
+            new Query()
+              .from({ m: middle.collection })
+              .where(({ m }) => eq(m.rootId, grandparent.id))
+              .select(({ m: parent }) => ({
+                id: parent.id,
+                leaves: toArray(
+                  new Query()
+                    .from({ leaf: leaves.collection })
+                    .where(({ leaf }) => eq(leaf.middleId, parent.id))
+                    .select(({ leaf }) => ({
+                      ...grandparent,
+                      leafName: leaf.leafName,
+                    })),
+                ),
+              })),
+          ),
+        })),
+    })
+    await withHistoryCleanup(
+      async () => {
+        await live.preload()
+        // Model: the leaf belongs to middle 10, and its captured root is 1.
+        const check = (rootName: string) =>
+          expect(
+            live.toArray.map(({ middle: rows }) =>
+              rows.map(({ leaves: nested }) =>
+                nested.map(({ rootName: value, leafName }) => ({
+                  rootName: value,
+                  leafName,
+                })),
+              ),
+            ),
+          ).toEqual([[[{ rootName, leafName: `LEAF` }]]])
+        check(`ROOT`)
+        roots.put({ id: 1, rootName: `ROOT2` })
+        await flushPromises()
+        check(`ROOT2`)
+      },
+      () => [
+        () => live.cleanup(),
+        () => roots.collection.cleanup(),
+        () => middle.collection.cleanup(),
+        () => leaves.collection.cleanup(),
+      ],
+    )
+  })
+
+  test.each([`issue`, `comment`] as const)(
+    `selecting a captured alias directly keeps its binding with child %s`,
+    async (childAlias) => {
+      const parents = createScopedSource(
+        `direct-parent`,
+        [{ id: 1, name: `PARENT` }],
+        `eager`,
+      )
+      const children = createScopedSource(
+        `direct-child`,
+        [{ id: 10, parentId: 1, name: `CHILD` }],
+        `eager`,
+      )
+      const live = createLiveQueryCollection({
+        query: new Query()
+          .from({ issue: parents.collection })
+          .select(({ issue: parent }) => ({
+            id: parent.id,
+            copies: toArray(
+              new Query()
+                .from({ [childAlias]: children.collection })
+                .where((context: Context) =>
+                  eq(
+                    (context[childAlias] as { parentId: number }).parentId,
+                    parent.id,
+                  ),
+                )
+                .select(() => parent),
+            ),
+          })),
+      })
+      await withHistoryCleanup(
+        async () => {
+          await live.preload()
+          const check = (name: string) =>
+            expect(
+              live.toArray.map(({ copies }) =>
+                copies.map(({ id, name: value }) => ({ id, name: value })),
+              ),
+            ).toEqual([[{ id: 1, name }]])
+          check(`PARENT`)
+          parents.put({ id: 1, name: `PARENT2` })
+          await flushPromises()
+          check(`PARENT2`)
+          children.put({ id: 10, parentId: 1, name: `CHILD2` })
+          await flushPromises()
+          check(`PARENT2`)
+        },
+        () => [
+          () => live.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ],
+      )
+    },
+  )
+
+  /** A discarded spread may enumerate a captured proxy, but it contributes
+   * no field to the selected plan. The independent relation still joins each
+   * child to its parent once, and equivalent selected plans have one identity.
+   * This challenges whether spread bookkeeping leaks across two enumerations
+   * of the same proxy before the public row and identity checkpoints. */
+  test(`discarded proxy spreads do not change rows or query identity`, async () => {
+    const parents = createScopedSource(
+      `discarded-spread-parent`,
+      [{ id: 1, name: `PARENT` }],
+      `eager`,
+    )
+    const children = createScopedSource(
+      `discarded-spread-child`,
+      [{ id: 10, parentId: 1, name: `CHILD` }],
+      `eager`,
+    )
+    const build = (discard: boolean) =>
+      new Query()
+        .from({ issue: parents.collection })
+        .select(({ issue: parent }) => {
+          if (discard) {
+            const ignored = { ...parent }
+            void ignored
+          }
+          return {
+            id: parent.id,
+            children: toArray(
+              new Query()
+                .from({ issue: children.collection })
+                .where(({ issue: child }) => eq(child.parentId, parent.id))
+                .select(({ issue: child }) => ({ ...parent, ...child })),
+            ),
+          }
+        })
+    const ordinary = build(false)
+    const enumerated = build(true)
+    const first = createLiveQueryCollection({ query: ordinary })
+    const second = createLiveQueryCollection({ query: enumerated })
+    await withHistoryCleanup(
+      async () => {
+        expect(getQueryIdentity(getQueryIR(ordinary))).toBe(
+          getQueryIdentity(getQueryIR(enumerated)),
+        )
+        await first.preload()
+        await second.preload()
+        const observe = (live: typeof first) =>
+          live.toArray.map(({ id, children: rows }) => ({
+            id,
+            children: rows.map(({ id: childId, name }) => ({
+              id: childId,
+              name,
+            })),
+          }))
+        const expected = [{ id: 1, children: [{ id: 10, name: `CHILD` }] }]
+        expect(observe(first)).toEqual(expected)
+        expect(observe(second)).toEqual(expected)
+        children.put({ id: 10, parentId: 1, name: `UPDATED` })
+        await flushPromises()
+        const changed = [{ id: 1, children: [{ id: 10, name: `UPDATED` }] }]
+        expect(observe(first)).toEqual(changed)
+        expect(observe(second)).toEqual(changed)
+      },
+      () => [
+        () => first.cleanup(),
+        () => second.cleanup(),
+        () => parents.collection.cleanup(),
+        () => children.collection.cleanup(),
+      ],
+    )
+  })
+})
+
+/**
+ * # A captured source must be in the query's lexical scope
+ *
+ * ARCHITECTURE.md §Identity gives captured references their original source,
+ * not the meaning of a later source with the same alias. A root query has no
+ * ancestor; an include can use only its own sources and the containing query's
+ * ancestors. The independent provenance model here has three source roles:
+ * an unrelated declaration, the local main source, and the joined source.
+ * Only the latter two are in scope, so a join using the unrelated declaration
+ * must reject before preload can accept public rows. Renaming that declaration
+ * cannot make it legal. The valid local operand and the ancestor-operand
+ * matrix above distinguish this law from a validator that rejects every
+ * captured reference.
+ *
+ * The finite grammar crosses root or include placement, eager or on-demand
+ * sources, and matching or different alias spelling. It does not claim every
+ * expression position or recursive source form. The driver uses public Query
+ * and live-query Collection APIs; the observation cut is preload settlement.
+ */
+describe(`join operands reject captured sources outside lexical scope`, () => {
+  type Row = { id: number }
+  type ForeignAlias = `local` | `unrelated`
+
+  for (const mode of [`eager`, `onDemand`] as const) {
+    for (const placement of [`root`, `include`] as const) {
+      test(`${mode} ${placement} joins reject foreign bindings regardless of alias`, async () => {
+        const unrelated = createScopedSource<Row>(
+          `foreign-${mode}-${placement}`,
+          [{ id: 999 }],
+          mode,
+        )
+        const local = createScopedSource<Row>(
+          `foreign-local-${mode}-${placement}`,
+          [{ id: 1 }],
+          mode,
+        )
+        const joined = createScopedSource<Row>(
+          `foreign-joined-${mode}-${placement}`,
+          [{ id: 1 }],
+          mode,
+        )
+        const parent = createScopedSource<Row>(
+          `foreign-parent-${mode}-${placement}`,
+          [{ id: 1 }],
+          `eager`,
+        )
+        joined.collection.createIndex((row) => row.id, {
+          indexType: BasicIndex,
+        })
+
+        // Capture the unrelated declaration through the same public callback
+        // mechanism as a legal ancestor reference. Its row value differs from
+        // the local source, so alias-based substitution would be observable.
+        const capture = (alias: ForeignAlias): number => {
+          let ref!: number
+          new Query()
+            .from({ [alias]: unrelated.collection })
+            .select((context: Context) => {
+              ref = (context[alias] as Row).id
+              return { id: ref }
+            })
+          return ref
+        }
+
+        const child = (operand: number) =>
+          new Query()
+            .from({ local: local.collection })
+            .innerJoin({ joined: joined.collection }, ({ joined: target }) =>
+              eq(operand, target.id),
+            )
+            .select(({ local: own, joined: target }) => ({
+              localId: own.id,
+              joinedId: target.id,
+            }))
+        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
+        const preloadForeign = async (alias: ForeignAlias) => {
+          const operand = capture(alias)
+          if (placement === `root`) {
+            const live = createLiveQueryCollection({ query: child(operand) })
+            invalidCleanups.push(() => live.cleanup())
+            await live.preload()
+            return
+          }
+          const live = createLiveQueryCollection({
+            query: new Query()
+              .from({ parent: parent.collection })
+              .select(({ parent: ancestor }) => ({
+                id: ancestor.id,
+                rows: toArray(
+                  child(operand).where(({ local: own }) =>
+                    eq(own.id, ancestor.id),
+                  ),
+                ),
+              })),
+          })
+          invalidCleanups.push(() => live.cleanup())
+          await live.preload()
+        }
+        const localControl = createLiveQueryCollection({
+          query: new Query()
+            .from({ local: local.collection })
+            .innerJoin(
+              { joined: joined.collection },
+              ({ local: own, joined: target }) => eq(own.id, target.id),
+            )
+            .select(({ local: own, joined: target }) => ({
+              localId: own.id,
+              joinedId: target.id,
+            })),
+        })
+
+        await withHistoryCleanup(
+          async () => {
+            await localControl.preload()
+            expect(
+              localControl.toArray.map(({ localId, joinedId }) => ({
+                localId,
+                joinedId,
+              })),
+            ).toEqual([{ localId: 1, joinedId: 1 }])
+            for (const alias of [`local`, `unrelated`] as const) {
+              await expect(
+                () => preloadForeign(alias),
+                `${placement}, ${mode}, unrelated alias ${alias}`,
+              ).rejects.toThrow(/out of scope/)
+            }
+          },
+          () => [
+            () => localControl.cleanup(),
+            ...invalidCleanups,
+            () => unrelated.collection.cleanup(),
+            () => local.collection.cleanup(),
+            () => joined.collection.cleanup(),
+            () => parent.collection.cleanup(),
+          ],
+        )
+      })
+    }
+  }
+})
+
+/**
+ * # An unrelated bound reference cannot acquire a local alias's meaning
+ *
+ * ARCHITECTURE.md §Identity makes a captured reference name its declaration.
+ * The foreign Query below is neither this query nor an ancestor, so its field
+ * cannot be evaluated in a WHERE, GROUP BY, HAVING, ORDER BY, or SELECT
+ * expression. The source-role model
+ * predicts rejection before rows are accepted, regardless of whether the
+ * foreign alias spells the local alias. A valid local reference must still
+ * publish its row. This finite matrix owns those expression positions at
+ * root preload; joins and recursive placements have separate cells above.
+ */
+describe(`non-join expressions reject unrelated bound references`, () => {
+  type Row = { id: number }
+  for (const position of [
+    `where`,
+    `groupBy`,
+    `having`,
+    `orderBy`,
+    `select`,
+    `conditionalSelect`,
+  ] as const) {
+    for (const alias of [`local`, `unrelated`] as const) {
+      test(`${position} rejects a foreign source named ${alias}`, async () => {
+        const foreign = createScopedSource<Row>(
+          `foreign-${position}-${alias}`,
+          [{ id: 999 }],
+          `eager`,
+        )
+        const local = createScopedSource<Row>(
+          `local-${position}-${alias}`,
+          [{ id: 1 }],
+          `eager`,
+        )
+        let foreignRef!: number
+        new Query()
+          .from({ [alias]: foreign.collection })
+          .select((context: Context) => {
+            foreignRef = (context[alias] as Row).id
+            return { id: foreignRef }
+          })
+        const root = new Query().from({ local: local.collection })
+        const createInvalid = () => {
+          switch (position) {
+            case `where`:
+              return createLiveQueryCollection({
+                query: root
+                  .where(({ local: own }) => eq(foreignRef, own.id))
+                  .select(({ local: own }) => ({ id: own.id })),
+              })
+            case `groupBy`:
+              return createLiveQueryCollection({
+                query: root
+                  .groupBy(() => foreignRef)
+                  .select(({ local: own }) => ({
+                    total: count(own.id),
+                  })),
+              })
+            case `having`:
+              return createLiveQueryCollection({
+                query: root
+                  .groupBy(({ local: own }) => own.id)
+                  .select(({ local: own }) => ({
+                    id: own.id,
+                    total: count(own.id),
+                  }))
+                  .having(() => eq(foreignRef, 999)),
+              })
+            case `orderBy`:
+              return createLiveQueryCollection({
+                query: root
+                  .orderBy(() => foreignRef, `asc`)
+                  .select(({ local: own }) => ({ id: own.id })),
+              })
+            case `select`:
+              return createLiveQueryCollection({
+                query: root.select(({ local: own }) => ({
+                  id: own.id,
+                  foreignId: foreignRef,
+                })),
+              })
+            case `conditionalSelect`:
+              return createLiveQueryCollection({
+                query: root.select(({ local: own }) => ({
+                  id: own.id,
+                  selected: caseWhen(eq(foreignRef, own.id), own.id, 0),
+                })),
+              })
+          }
+        }
+        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
+        const preloadInvalid = async () => {
+          const invalid = createInvalid()
+          invalidCleanups.push(() => invalid.cleanup())
+          await invalid.preload()
+        }
+        const control = createLiveQueryCollection({
+          query: new Query()
+            .from({ local: local.collection })
+            .where(({ local: own }) => eq(own.id, 1))
+            .select(({ local: own }) => ({ id: own.id })),
+        })
+        await withHistoryCleanup(
+          async () => {
+            await control.preload()
+            expect(control.toArray.map(({ id }) => ({ id }))).toEqual([
+              { id: 1 },
+            ])
+            await expect(() => preloadInvalid()).rejects.toThrow(/out of scope/)
+          },
+          () => [
+            ...invalidCleanups,
+            () => control.cleanup(),
+            () => foreign.collection.cleanup(),
+            () => local.collection.cleanup(),
+          ],
+        )
+      })
+    }
+  }
+})
+
+/**
+ * # Extracting an include filter does not grant a foreign source ancestry
+ *
+ * A child WHERE that also reads its actual parent is evaluated per route.
+ * The builder may move that predicate into the include's parent filters, but
+ * moving it does not make an unrelated bound reference a parent. The model
+ * distinguishes the parent's desired ID from a foreign declaration and
+ * predicts exact rows for the legal filter and rejection for the foreign one.
+ * The grammar crosses foreign alias spelling and source mode. Public preload
+ * is the observation cut, before any invalid rows can be accepted.
+ */
+describe(`include parent filters retain lexical provenance`, () => {
+  type Parent = { id: number; desiredId: number }
+  type Child = { id: number; parentId: number }
+  for (const mode of [`eager`, `onDemand`] as const) {
+    for (const foreignAlias of [`issue`, `unrelated`] as const) {
+      test(`${mode} include filter rejects foreign ${foreignAlias} but accepts its parent`, async () => {
+        const parent = createScopedSource<Parent>(
+          `filter-parent-${mode}-${foreignAlias}`,
+          [{ id: 1, desiredId: 1 }],
+          `eager`,
+        )
+        const child = createScopedSource<Child>(
+          `filter-child-${mode}-${foreignAlias}`,
+          [
+            { id: 1, parentId: 1 },
+            { id: 2, parentId: 1 },
+          ],
+          mode,
+        )
+        const foreign = createScopedSource(
+          `filter-foreign-${mode}-${foreignAlias}`,
+          [{ id: 999 }],
+          mode,
+        )
+        child.collection.createIndex((row) => row.parentId, {
+          indexType: BasicIndex,
+        })
+        child.collection.createIndex((row) => row.id, {
+          indexType: BasicIndex,
+        })
+        let foreignRef!: number
+        new Query()
+          .from({ [foreignAlias]: foreign.collection })
+          .select((context: Context) => {
+            foreignRef = (context[foreignAlias] as { id: number }).id
+            return { id: foreignRef }
+          })
+        const build = (useForeign: boolean) =>
+          createLiveQueryCollection({
+            query: new Query()
+              .from({ issue: parent.collection })
+              .select(({ issue: ancestor }) => ({
+                id: ancestor.id,
+                rows: toArray(
+                  new Query()
+                    .from({ issue: child.collection })
+                    .where(({ issue: own }) => eq(own.parentId, ancestor.id))
+                    .where(({ issue: own }) =>
+                      useForeign
+                        ? eq(foreignRef, own.id)
+                        : eq(own.id, ancestor.desiredId),
+                    )
+                    .select(({ issue: own }) => ({ id: own.id })),
+                ),
+              })),
+          })
+        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
+        const preloadInvalid = async () => {
+          const live = build(true)
+          invalidCleanups.push(() => live.cleanup())
+          await live.preload()
+        }
+        const valid = build(false)
+
+        await withHistoryCleanup(
+          async () => {
+            await valid.preload()
+            expect(
+              valid.toArray.map(({ id, rows }) => ({
+                id,
+                rows: rows.map(({ id: childId }) => ({ id: childId })),
+              })),
+            ).toEqual([{ id: 1, rows: [{ id: 1 }] }])
+            await expect(() => preloadInvalid()).rejects.toThrow(/out of scope/)
+          },
+          () => [
+            () => valid.cleanup(),
+            ...invalidCleanups,
+            () => parent.collection.cleanup(),
+            () => child.collection.cleanup(),
+            () => foreign.collection.cleanup(),
+          ],
+        )
+      })
+    }
+  }
+})
+
+/**
+ * # Extracted include correlations still require a visible parent source
+ *
+ * ARCHITECTURE.md §Identity gives an include child access to its containing
+ * query's declarations, not a source captured from an unrelated Query. The
+ * builder removes the correlation equality from the child's WHERE, so the
+ * source-role model checks that extracted field separately. A real parent
+ * correlation must publish its child row. An unrelated source must reject
+ * before rows are accepted, whether its alias matches the parent's or not.
+ * The finite driver crosses both alias spellings and controlled source modes
+ * at public preload; it makes no provider scheduling claim.
+ */
+describe(`extracted include correlations retain lexical provenance`, () => {
+  type Parent = { id: number }
+  type Child = { id: number; parentId: number }
+  for (const mode of [`eager`, `onDemand`] as const) {
+    for (const foreignAlias of [`issue`, `unrelated`] as const) {
+      test(`${mode} correlation rejects foreign ${foreignAlias} but accepts its parent`, async () => {
+        const parent = createScopedSource<Parent>(
+          `correlation-parent-${mode}-${foreignAlias}`,
+          [{ id: 1 }],
+          `eager`,
+        )
+        const child = createScopedSource<Child>(
+          `correlation-child-${mode}-${foreignAlias}`,
+          [{ id: 10, parentId: 1 }],
+          mode,
+        )
+        const foreign = createScopedSource<Parent>(
+          `correlation-foreign-${mode}-${foreignAlias}`,
+          [{ id: 999 }],
+          mode,
+        )
+        child.collection.createIndex((row) => row.parentId, {
+          indexType: BasicIndex,
+        })
+        let foreignRef!: number
+        new Query()
+          .from({ [foreignAlias]: foreign.collection })
+          .select((context: Context) => {
+            foreignRef = (context[foreignAlias] as Parent).id
+            return { id: foreignRef }
+          })
+        const build = (useForeign: boolean) =>
+          createLiveQueryCollection({
+            query: new Query()
+              .from({ issue: parent.collection })
+              .select(({ issue: ancestor }) => ({
+                id: ancestor.id,
+                rows: toArray(
+                  new Query()
+                    .from({ child: child.collection })
+                    .where(({ child: own }) =>
+                      eq(own.parentId, useForeign ? foreignRef : ancestor.id),
+                    )
+                    .select(({ child: own }) => ({ id: own.id })),
+                ),
+              })),
+          })
+        const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
+        const preloadInvalid = async () => {
+          const live = build(true)
+          invalidCleanups.push(() => live.cleanup())
+          await live.preload()
+        }
+        const valid = build(false)
+
+        await withHistoryCleanup(
+          async () => {
+            await valid.preload()
+            expect(
+              valid.toArray.map(({ id, rows }) => ({
+                id,
+                rows: rows.map(({ id: childId }) => ({ id: childId })),
+              })),
+            ).toEqual([{ id: 1, rows: [{ id: 10 }] }])
+            await expect(() => preloadInvalid()).rejects.toThrow(/out of scope/)
+          },
+          () => [
+            () => valid.cleanup(),
+            ...invalidCleanups,
+            () => parent.collection.cleanup(),
+            () => child.collection.cleanup(),
+            () => foreign.collection.cleanup(),
+          ],
+        )
+      })
+    }
+  }
+})
+
+/**
+ * # A source inside a parent operand is not an include ancestor
+ *
+ * ARCHITECTURE.md §Identity/law 1 gives a child include access to the parent
+ * query's declarations and its actual ancestors. A FROM QueryRef's own source
+ * and a union branch's source are hidden behind their result rows. Capturing
+ * either source's ref in an include join is therefore out of scope, whether
+ * its alias matches the child's local alias or has another spelling.
+ *
+ * The independent provenance model here labels the inner declaration
+ * `hidden` and predicts rejection; it never reads binding IDs or source-tree
+ * traversal. The finite grammar crosses one or two recursive source levels,
+ * QueryRef or union placement, matching or renamed hidden alias, and eager or
+ * on-demand sources. Public Query and live Collection entry points must reject
+ * by construction or preload, before accepting public rows. The legal local
+ * and true-ancestor controls above prevent a blanket captured-ref rejection
+ * from satisfying this rule. This does not claim every recursive expression
+ * position; the captured value is a join operand in the include child.
+ */
+describe(`include joins reject sources hidden inside parent operands`, () => {
+  type Hidden = { id: number; secret: number }
+  type Row = { id: number }
+
+  for (const mode of [`eager`, `onDemand`] as const) {
+    for (const placement of [
+      `queryRef`,
+      `unionBranch`,
+      `nestedQueryRef`,
+      `nestedUnionBranch`,
+    ] as const) {
+      for (const alias of [`local`, `inner`] as const) {
+        test(`${mode} ${placement} cannot expose inner binding ${alias} to its include`, async () => {
+          const hidden = createScopedSource<Hidden>(
+            `hidden-${mode}-${placement}`,
+            [{ id: 1, secret: 999 }],
+            mode,
+          )
+          const other = createScopedSource<Row>(
+            `hidden-other-${mode}-${placement}`,
+            [{ id: 2 }],
+            mode,
+          )
+          const local = createScopedSource<Row>(
+            `hidden-local-${mode}-${placement}`,
+            [{ id: 1 }],
+            mode,
+          )
+          const joined = createScopedSource<Row>(
+            `hidden-joined-${mode}-${placement}`,
+            [{ id: 1 }, { id: 999 }],
+            mode,
+          )
+          local.collection.createIndex((row) => row.id, {
+            indexType: BasicIndex,
+          })
+          joined.collection.createIndex((row) => row.id, {
+            indexType: BasicIndex,
+          })
+          const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
+
+          const preloadHidden = async () => {
+            let hiddenRef!: number
+            const inner = new Query()
+              .from({ [alias]: hidden.collection })
+              .select((context: Context) => {
+                const row = context[alias] as Hidden
+                hiddenRef = row.secret
+                return { id: row.id }
+              })
+            const branch =
+              placement === `unionBranch` || placement === `nestedUnionBranch`
+                ? new Query().unionAll(
+                    inner,
+                    new Query()
+                      .from({ other: other.collection })
+                      .select(({ other: row }) => ({ id: row.id })),
+                  )
+                : inner
+            const parentSource = placement.startsWith(`nested`)
+              ? new Query()
+                  .from({ middle: branch })
+                  .select((context: Context) => ({
+                    id: (context.middle as Row).id,
+                  }))
+              : branch
+            const outer = new Query().from({ parent: parentSource })
+            const live = createLiveQueryCollection({
+              query: outer.select((context: Context) => {
+                const parentId = (context.parent as Row).id
+                return {
+                  id: parentId,
+                  rows: toArray(
+                    new Query()
+                      .from({ local: local.collection })
+                      .innerJoin(
+                        { joined: joined.collection },
+                        ({ joined: target }) => eq(hiddenRef, target.id),
+                      )
+                      .where(({ local: row }) => eq(row.id, parentId))
+                      .select(({ local: row, joined: target }) => ({
+                        localId: row.id,
+                        joinedId: target.id,
+                      })),
+                  ),
+                }
+              }),
+            })
+            invalidCleanups.push(() => live.cleanup())
+            await live.preload()
+          }
+
+          await withHistoryCleanup(
+            async () => {
+              await expect(() => preloadHidden()).rejects.toThrow(
+                /out of scope/,
+              )
+            },
+            () => [
+              ...invalidCleanups,
+              () => hidden.collection.cleanup(),
+              () => other.collection.cleanup(),
+              () => local.collection.cleanup(),
+              () => joined.collection.cleanup(),
+            ],
+          )
+        })
+      }
+    }
+  }
+})
+
+describe(`joined subqueries reject captured sibling sources`, () => {
+  type Row = { id: number }
+
+  for (const placement of [`root`, `include`] as const) {
+    for (const mode of [`eager`, `onDemand`] as const) {
+      for (const alias of [`local`, `inner`] as const) {
+        test(`${placement}, ${mode}, inner alias ${alias} rejects a sibling capture`, async () => {
+          const main = createScopedSource<Row>(
+            `sibling-main-${placement}-${mode}-${alias}`,
+            [{ id: 1 }],
+            mode,
+          )
+          const inner = createScopedSource<Row>(
+            `sibling-inner-${placement}-${mode}-${alias}`,
+            [{ id: 1 }],
+            mode,
+          )
+          const probe = createScopedSource<Row>(
+            `sibling-probe-${placement}-${mode}-${alias}`,
+            [{ id: 1 }],
+            mode,
+          )
+          const parent = createScopedSource<Row>(
+            `sibling-parent-${placement}-${mode}-${alias}`,
+            [{ id: 1 }],
+            `eager`,
+          )
+          const invalidCleanups: Array<() => unknown | Promise<unknown>> = []
+
+          const preloadSibling = async () => {
+            let siblingRef!: number
+            const base = new Query()
+              .from({ local: main.collection })
+              .where((context: Context) => {
+                const row = context.local as Row
+                siblingRef = row.id
+                return eq(row.id, 1)
+              })
+            const joinedQuery = new Query()
+              .from({ [alias]: inner.collection })
+              .innerJoin({ probe: probe.collection }, ({ probe: row }) =>
+                eq(siblingRef, row.id),
+              )
+              .select((context: Context) => ({
+                id: (context[alias] as Row).id,
+              }))
+            const child = base
+              .innerJoin({ nested: joinedQuery }, ({ local: row, nested }) =>
+                eq(row.id, nested.id),
+              )
+              .select(({ local: row, nested }) => ({
+                localId: row.id,
+                joinedId: nested.id,
+              }))
+            const live =
+              placement === `root`
+                ? createLiveQueryCollection({ query: child })
+                : createLiveQueryCollection({
+                    query: new Query()
+                      .from({ parent: parent.collection })
+                      .select(({ parent: row }) => ({
+                        id: row.id,
+                        rows: toArray(
+                          child.where(({ local: own }) => eq(own.id, row.id)),
+                        ),
+                      })),
+                  })
+            invalidCleanups.push(() => live.cleanup())
+            await live.preload()
+          }
+
+          await withHistoryCleanup(
+            async () => {
+              await expect(() => preloadSibling()).rejects.toThrow(
+                /out of scope/,
+              )
+            },
+            () => [
+              ...invalidCleanups,
+              () => main.collection.cleanup(),
+              () => inner.collection.cleanup(),
+              () => probe.collection.cleanup(),
+              () => parent.collection.cleanup(),
+            ],
+          )
+        })
+      }
+    }
+  }
+})
+
+/**
+ * A bound ancestor reference and an unbound raw-IR reference to the child's
+ * joined alias name different declarations. The small public-row control
+ * checks admission at preload; it does not model arbitrary raw-IR expressions.
+ */
+test(`mixed bound and unbound same-alias join references name separate sources`, async () => {
+  const parent = createScopedSource(`mixed-bound-parent`, [{ id: 1 }], `eager`)
+  const child = createScopedSource(
+    `mixed-bound-child`,
+    [{ id: 10, parentId: 1 }],
+    `eager`,
+  )
+  const local = createScopedSource(`mixed-bound-local`, [{ id: 1 }], `eager`)
+  child.collection.createIndex((row) => row.parentId, {
+    indexType: BasicIndex,
+  })
+  local.collection.createIndex((row) => row.id, {
+    indexType: BasicIndex,
+  })
+  const live = createLiveQueryCollection({
+    query: new Query()
+      .from({ issue: parent.collection })
+      .select(({ issue: ancestor }) => ({
+        id: ancestor.id,
+        rows: toArray(
+          new Query()
+            .from({ child: child.collection })
+            .innerJoin({ issue: local.collection }, () =>
+              eq(ancestor.id, new PropRef([`issue`, `id`])),
+            )
+            .where(({ child: row }) => eq(row.parentId, ancestor.id))
+            .select(({ child: row, issue }) => ({
+              childId: row.id,
+              localIssueId: issue.id,
+            })),
+        ),
+      })),
+  })
+  await withHistoryCleanup(
+    async () => {
+      await live.preload()
+      expect(live.toArray.map(({ id, rows }) => ({ id, rows }))).toEqual([
+        { id: 1, rows: [{ childId: 10, localIssueId: 1 }] },
+      ])
+    },
+    () => [
+      () => live.cleanup(),
+      () => parent.collection.cleanup(),
+      () => child.collection.cleanup(),
+      () => local.collection.cleanup(),
+    ],
+  )
+})
diff --git a/packages/db/tests/query/includes-collection-driver-oracle.ts b/packages/db/tests/query/includes-collection-driver-oracle.ts
new file mode 100644
index 0000000000..d7cc3fcf7d
--- /dev/null
+++ b/packages/db/tests/query/includes-collection-driver-oracle.ts
@@ -0,0 +1,256 @@
+// The Collection-valued include driver and its Map model. The driver runs
+// generated or fixed source histories through a live include query, and the
+// model recomputes the parent rows that the public Collection facade must
+// show. The laws and their comparisons are owned by
+// includes-collection-oracle.property.test.ts, which declares the model;
+// includes-collection.test.ts runs the driver for its fixed scenarios.
+import {
+  createLiveQueryCollection,
+  eq,
+  include,
+  materialize,
+  toArray,
+} from '../../src/query/index.js'
+import { declareOracle } from '../oracle-declaration.js'
+import { createControlledCollection } from './includes-collection-support.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { TraceDriver } from '../trace-runner.js'
+import type { ControlledCollection } from './includes-oracle-helpers.js'
+import type { ChildRow, ParentRow } from './includes-collection-support.js'
+
+export type CollectionAction =
+  | { type: `putParent`; row: ParentRow }
+  | { type: `deleteParent`; id: number }
+  | { type: `putChild`; row: ChildRow }
+  | { type: `deleteChild`; id: number }
+
+export type ProjectedParent = {
+  id: number
+  group: number
+  childrenReady: boolean
+  children: Array<ChildRow>
+  arrayChildren: Array<ChildRow>
+  materializedChildren: Array<ChildRow>
+}
+
+export type EventValue = Pick<
+  ProjectedParent,
+  `id` | `group` | `arrayChildren` | `materializedChildren`
+>
+
+export type ParentEvent = {
+  type: `insert` | `update` | `delete`
+  key: number | string
+  value: EventValue
+  previousValue?: EventValue
+}
+
+export function projectEventValue(row: EventValue): EventValue {
+  const children = (rows: Array<ChildRow>) =>
+    rows.map(({ id, parentGroup, value }) => ({ id, parentGroup, value }))
+  return {
+    id: row.id,
+    group: row.group,
+    arrayChildren: children(row.arrayChildren),
+    materializedChildren: children(row.materializedChildren),
+  }
+}
+
+export type CollectionContext = {
+  parents: ControlledCollection<ParentRow>
+  children: ControlledCollection<ChildRow>
+  live: ReturnType<typeof createCollectionQuery>
+  model: {
+    parents: Map<number, ParentRow>
+    children: Map<number, ChildRow>
+  }
+  publications: Array<Array<ProjectedParent>>
+  events: Array<ParentEvent>
+  before: Array<ProjectedParent>
+  subscription?: { unsubscribe: () => void }
+}
+
+export function createCollectionQuery(
+  parents: Collection<ParentRow>,
+  children: Collection<ChildRow>,
+  reuseChildRelation = true,
+) {
+  return createLiveQueryCollection((q) =>
+    q
+      .from({ parent: parents })
+      .orderBy(({ parent }) => parent.id)
+      .select(({ parent }) => {
+        const createChildRows = () =>
+          q
+            .from({ child: children })
+            .where(({ child }) => eq(child.parentGroup, parent.group))
+            .orderBy(({ child }) => child.id)
+            .select(({ child }) => ({
+              id: child.id,
+              parentGroup: child.parentGroup,
+              value: child.value,
+            }))
+        const childRows = createChildRows()
+
+        return {
+          id: parent.id,
+          group: parent.group,
+          children: include(childRows),
+          arrayChildren: toArray(
+            reuseChildRelation ? childRows : createChildRows(),
+          ),
+          materializedChildren: materialize(
+            reuseChildRelation ? childRows : createChildRows(),
+          ),
+        }
+      }),
+  )
+}
+
+export type IncludedChildCollection = ReturnType<
+  typeof createCollectionQuery
+>[`toArray`][number][`children`]
+
+export function projectLive(
+  live: ReturnType<typeof createCollectionQuery>,
+): Array<ProjectedParent> {
+  return [...live.values()].map((parent) => {
+    const projectChildren = (rows: Iterable<ChildRow>) =>
+      [...rows].map(({ id, parentGroup, value }) => ({
+        id,
+        parentGroup,
+        value,
+      }))
+
+    return {
+      id: parent.id,
+      group: parent.group,
+      childrenReady: parent.children.isReady(),
+      children: projectChildren(parent.children.values()),
+      arrayChildren: projectChildren(parent.arrayChildren),
+      materializedChildren: projectChildren(parent.materializedChildren),
+    }
+  })
+}
+
+// This value model uses only current source Maps and the declared relation and
+// child order. Facade identity has separate focused models below.
+export function recompute(context: CollectionContext): Array<ProjectedParent> {
+  return [...context.model.parents.values()]
+    .sort((left, right) => left.id - right.id)
+    .map((parent) => {
+      const children = [...context.model.children.values()]
+        .filter((child) => child.parentGroup === parent.group)
+        .sort((left, right) => left.id - right.id)
+        .map((child) => ({ ...child }))
+
+      return {
+        ...parent,
+        childrenReady: true,
+        children,
+        arrayChildren: children,
+        materializedChildren: children,
+      }
+    })
+}
+
+declareOracle({ model: [recompute] })
+
+export function createCollectionDriver(
+  initialParents: ReadonlyArray<ParentRow>,
+  initialChildren: ReadonlyArray<ChildRow>,
+  reuseChildRelation = true,
+): TraceDriver<CollectionAction, CollectionContext> {
+  return {
+    setup() {
+      const parents = createControlledCollection(
+        `collection-oracle-parents`,
+        initialParents,
+      )
+      const children = createControlledCollection(
+        `collection-oracle-children`,
+        initialChildren,
+      )
+      return {
+        parents,
+        children,
+        live: createCollectionQuery(
+          parents.collection,
+          children.collection,
+          reuseChildRelation,
+        ),
+        model: {
+          parents: new Map(initialParents.map((row) => [row.id, { ...row }])),
+          children: new Map(initialChildren.map((row) => [row.id, { ...row }])),
+        },
+        publications: [],
+        events: [],
+        before: [],
+      }
+    },
+    async start(context) {
+      await context.live.preload()
+      context.before = recompute(context)
+      context.subscription = context.live.subscribeChanges(
+        (changes) => {
+          context.publications.push(projectLive(context.live))
+          context.events.push(
+            ...changes.map((change) => ({
+              type: change.type,
+              key: change.key,
+              value: projectEventValue(change.value),
+              ...(change.previousValue
+                ? { previousValue: projectEventValue(change.previousValue) }
+                : {}),
+            })),
+          )
+        },
+        { includeInitialState: false },
+      )
+    },
+    apply(action, context) {
+      context.publications = []
+      context.events = []
+      context.before = recompute(context)
+      switch (action.type) {
+        case `putParent`: {
+          const type = context.model.parents.has(action.row.id)
+            ? `update`
+            : `insert`
+          context.model.parents.set(action.row.id, { ...action.row })
+          context.parents.write(type, action.row)
+          return
+        }
+        case `deleteParent`: {
+          const previous = context.model.parents.get(action.id)
+          if (!previous) return
+          context.model.parents.delete(action.id)
+          context.parents.write(`delete`, previous)
+          return
+        }
+        case `putChild`: {
+          const type = context.model.children.has(action.row.id)
+            ? `update`
+            : `insert`
+          context.model.children.set(action.row.id, { ...action.row })
+          context.children.write(type, action.row)
+          return
+        }
+        case `deleteChild`: {
+          const previous = context.model.children.get(action.id)
+          if (!previous) return
+          context.model.children.delete(action.id)
+          context.children.write(`delete`, previous)
+        }
+      }
+    },
+    async cleanup(context) {
+      context.subscription?.unsubscribe()
+      await Promise.all([
+        context.live.cleanup(),
+        context.parents.collection.cleanup(),
+        context.children.collection.cleanup(),
+      ])
+    },
+  }
+}
diff --git a/packages/db/tests/query/includes-collection-oracle.property.test.ts b/packages/db/tests/query/includes-collection-oracle.property.test.ts
index 19ad0a9d3a..c499595305 100644
--- a/packages/db/tests/query/includes-collection-oracle.property.test.ts
+++ b/packages/db/tests/query/includes-collection-oracle.property.test.ts
@@ -1,22 +1,15 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { describe, expect } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import {
-  add,
-  caseWhen,
   concat,
-  count,
   createLiveQueryCollection,
   eq,
-  gt,
   include,
-  lt,
   materialize,
-  multiply,
-  sum,
   toArray,
 } from '../../src/query/index.js'
-import { createCollection } from '../../src/collection/index.js'
-import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import { runTrace } from '../trace-runner.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
 import {
@@ -24,12 +17,37 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { flushPromises, withExpectedRejection } from '../utils.js'
-import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
+import {
+  assertDeleteIdentityEvents,
+  assertFacadeRootSnapshots,
+  assertRetiredFacade,
+  createControlledCollection,
+  expectedMaterializations,
+} from './includes-collection-support.js'
+import {
+  createCollectionDriver,
+  projectEventValue,
+  projectLive,
+  recompute,
+} from './includes-collection-driver-oracle.js'
+import type {
+  CollectionAction,
+  CollectionContext,
+  IncludedChildCollection,
+  ParentEvent,
+  ProjectedParent,
+} from './includes-collection-driver-oracle.js'
 import type { Collection } from '../../src/collection/index.js'
 import type { TraceDriver, TraceProjection } from '../trace-runner.js'
-import type { ControlledCollection } from './includes-oracle-helpers.js'
 import type { SyncConfig } from '../../src/types.js'
+import type {
+  ChildRow,
+  DeleteIdentityObservation,
+  FacadeRootSnapshot,
+  ParentRow,
+} from './includes-collection-support.js'
 
 /**
  * # What does a Collection-valued include promise?
@@ -89,62 +107,14 @@ import type { SyncConfig } from '../../src/types.js'
  * scheduling remain outside this owner.
  */
 
-type ParentRow = {
-  id: number
-  group: number
-}
-
 type SampleOf<T> = T extends fc.Arbitrary<infer TValue> ? TValue : never
 
-type ChildRow = {
-  id: number
-  parentGroup: number
-  value: number
-}
-
-type CollectionAction =
-  | { type: `putParent`; row: ParentRow }
-  | { type: `deleteParent`; id: number }
-  | { type: `putChild`; row: ChildRow }
-  | { type: `deleteChild`; id: number }
-
-type ProjectedParent = {
-  id: number
-  group: number
-  childrenReady: boolean
-  children: Array<ChildRow>
-  arrayChildren: Array<ChildRow>
-  materializedChildren: Array<ChildRow>
-}
-
 type CollectionObservation = {
   rows: Array<ProjectedParent>
   publications: Array<Array<ProjectedParent>>
   events: Array<ParentEvent>
 }
 
-type EventValue = Pick<
-  ProjectedParent,
-  `id` | `group` | `arrayChildren` | `materializedChildren`
->
-type ParentEvent = {
-  type: `insert` | `update` | `delete`
-  key: number | string
-  value: EventValue
-  previousValue?: EventValue
-}
-
-function projectEventValue(row: EventValue): EventValue {
-  const children = (rows: Array<ChildRow>) =>
-    rows.map(({ id, parentGroup, value }) => ({ id, parentGroup, value }))
-  return {
-    id: row.id,
-    group: row.group,
-    arrayChildren: children(row.arrayChildren),
-    materializedChildren: children(row.materializedChildren),
-  }
-}
-
 function diffParents(
   before: Array<ProjectedParent>,
   after: Array<ProjectedParent>,
@@ -163,263 +133,6 @@ function diffParents(
   return result.sort((a, b) => Number(a.key) - Number(b.key))
 }
 
-type CollectionContext = {
-  parents: ControlledCollection<ParentRow>
-  children: ControlledCollection<ChildRow>
-  live: ReturnType<typeof createCollectionQuery>
-  model: {
-    parents: Map<number, ParentRow>
-    children: Map<number, ChildRow>
-  }
-  publications: Array<Array<ProjectedParent>>
-  events: Array<ParentEvent>
-  before: Array<ProjectedParent>
-  subscription?: { unsubscribe: () => void }
-}
-
-function createControlledCollection<T extends { id: number }>(
-  name: string,
-  initialData: ReadonlyArray<T>,
-): ControlledCollection<T> {
-  return createOracleControlledCollection(name, initialData, {
-    autoIndex: `eager`,
-    rowUpdateMode: `full`,
-  })
-}
-
-function expectedMaterializations<T>(rows: ReadonlyArray<T>) {
-  return {
-    facade: [...rows],
-    array: [...rows],
-    materialized: [...rows],
-  }
-}
-
-function createCollectionQuery(
-  parents: Collection<ParentRow>,
-  children: Collection<ChildRow>,
-  reuseChildRelation = true,
-) {
-  return createLiveQueryCollection((q) =>
-    q
-      .from({ parent: parents })
-      .orderBy(({ parent }) => parent.id)
-      .select(({ parent }) => {
-        const createChildRows = () =>
-          q
-            .from({ child: children })
-            .where(({ child }) => eq(child.parentGroup, parent.group))
-            .orderBy(({ child }) => child.id)
-            .select(({ child }) => ({
-              id: child.id,
-              parentGroup: child.parentGroup,
-              value: child.value,
-            }))
-        const childRows = createChildRows()
-
-        return {
-          id: parent.id,
-          group: parent.group,
-          children: include(childRows),
-          arrayChildren: toArray(
-            reuseChildRelation ? childRows : createChildRows(),
-          ),
-          materializedChildren: materialize(
-            reuseChildRelation ? childRows : createChildRows(),
-          ),
-        }
-      }),
-  )
-}
-
-type IncludedChildCollection = ReturnType<
-  typeof createCollectionQuery
->[`toArray`][number][`children`]
-
-type DeleteIdentityObservation = {
-  type: string
-  key: unknown
-  id: number
-  matchesPublishedFacade: boolean
-}
-
-function assertDeleteIdentityEvents(
-  events: ReadonlyArray<DeleteIdentityObservation>,
-  deleted: boolean,
-): void {
-  expect(events).toEqual(
-    deleted
-      ? [
-          {
-            type: `delete`,
-            key: 1,
-            id: 1,
-            matchesPublishedFacade: true,
-          },
-        ]
-      : [],
-  )
-}
-
-function assertRetiredFacade(observation: {
-  status: string | undefined
-  rows: Array<ChildRow> | undefined
-}): void {
-  expect(observation).toEqual({ status: `ready`, rows: [] })
-}
-
-type FacadeRootSnapshot = {
-  group: number | undefined
-  usesOldFacade: boolean
-  rows: Array<string | number>
-}
-
-function assertFacadeRootSnapshots(snapshots: Array<FacadeRootSnapshot>): void {
-  expect(snapshots).toEqual([{ group: 2, usesOldFacade: false, rows: [20] }])
-}
-
-function projectLive(
-  live: ReturnType<typeof createCollectionQuery>,
-): Array<ProjectedParent> {
-  return [...live.values()].map((parent) => {
-    const projectChildren = (rows: Iterable<ChildRow>) =>
-      [...rows].map(({ id, parentGroup, value }) => ({
-        id,
-        parentGroup,
-        value,
-      }))
-
-    return {
-      id: parent.id,
-      group: parent.group,
-      childrenReady: parent.children.isReady(),
-      children: projectChildren(parent.children.values()),
-      arrayChildren: projectChildren(parent.arrayChildren),
-      materializedChildren: projectChildren(parent.materializedChildren),
-    }
-  })
-}
-
-// This value model uses only current source Maps and the declared relation and
-// child order. Facade identity has separate focused models below.
-function recompute(context: CollectionContext): Array<ProjectedParent> {
-  return [...context.model.parents.values()]
-    .sort((left, right) => left.id - right.id)
-    .map((parent) => {
-      const children = [...context.model.children.values()]
-        .filter((child) => child.parentGroup === parent.group)
-        .sort((left, right) => left.id - right.id)
-        .map((child) => ({ ...child }))
-
-      return {
-        ...parent,
-        childrenReady: true,
-        children,
-        arrayChildren: children,
-        materializedChildren: children,
-      }
-    })
-}
-
-function createCollectionDriver(
-  initialParents: ReadonlyArray<ParentRow>,
-  initialChildren: ReadonlyArray<ChildRow>,
-  reuseChildRelation = true,
-): TraceDriver<CollectionAction, CollectionContext> {
-  return {
-    setup() {
-      const parents = createControlledCollection(
-        `collection-oracle-parents`,
-        initialParents,
-      )
-      const children = createControlledCollection(
-        `collection-oracle-children`,
-        initialChildren,
-      )
-      return {
-        parents,
-        children,
-        live: createCollectionQuery(
-          parents.collection,
-          children.collection,
-          reuseChildRelation,
-        ),
-        model: {
-          parents: new Map(initialParents.map((row) => [row.id, { ...row }])),
-          children: new Map(initialChildren.map((row) => [row.id, { ...row }])),
-        },
-        publications: [],
-        events: [],
-        before: [],
-      }
-    },
-    async start(context) {
-      await context.live.preload()
-      context.before = recompute(context)
-      context.subscription = context.live.subscribeChanges(
-        (changes) => {
-          context.publications.push(projectLive(context.live))
-          context.events.push(
-            ...changes.map((change) => ({
-              type: change.type,
-              key: change.key,
-              value: projectEventValue(change.value),
-              ...(change.previousValue
-                ? { previousValue: projectEventValue(change.previousValue) }
-                : {}),
-            })),
-          )
-        },
-        { includeInitialState: false },
-      )
-    },
-    apply(action, context) {
-      context.publications = []
-      context.events = []
-      context.before = recompute(context)
-      switch (action.type) {
-        case `putParent`: {
-          const type = context.model.parents.has(action.row.id)
-            ? `update`
-            : `insert`
-          context.model.parents.set(action.row.id, { ...action.row })
-          context.parents.write(type, action.row)
-          return
-        }
-        case `deleteParent`: {
-          const previous = context.model.parents.get(action.id)
-          if (!previous) return
-          context.model.parents.delete(action.id)
-          context.parents.write(`delete`, previous)
-          return
-        }
-        case `putChild`: {
-          const type = context.model.children.has(action.row.id)
-            ? `update`
-            : `insert`
-          context.model.children.set(action.row.id, { ...action.row })
-          context.children.write(type, action.row)
-          return
-        }
-        case `deleteChild`: {
-          const previous = context.model.children.get(action.id)
-          if (!previous) return
-          context.model.children.delete(action.id)
-          context.children.write(`delete`, previous)
-        }
-      }
-    },
-    async cleanup(context) {
-      context.subscription?.unsubscribe()
-      await Promise.all([
-        context.live.cleanup(),
-        context.parents.collection.cleanup(),
-        context.children.collection.cleanup(),
-      ])
-    },
-  }
-}
-
 type OptimisticAction =
   | { type: `insert`; row: ChildRow; settlement: `confirm` | `rollback` }
   | { type: `delete`; id: number; settlement: `confirm` | `rollback` }
@@ -599,6 +312,24 @@ const collectionProjection: TraceProjection<
   },
 }
 
+// The layout that a source Map of ordered children implies: the rows in rank
+// order, with only id and value, because the facade row omits rank. Ties on
+// rank are not generated in these histories, so the order is total.
+function expectedOrderedRows(
+  sourceRows: ReadonlyMap<number, { id: number; rank: number; value: string }>,
+) {
+  return [...sourceRows.values()]
+    .sort((left, right) => left.rank - right.rank)
+    .map(({ id, value }) => ({ id, value }))
+}
+
+// The model derives the expected parent rows from the current source Maps and
+// the expected events from the prior and current rows. The projection passes it
+// to every trace as `recompute`, so each history reaches it.
+declareOracle({
+  model: [recompute, diffParents, expectedOrderedRows],
+})
+
 const actionArbitrary: fc.Arbitrary<CollectionAction> = fc.oneof(
   fc.record({
     type: fc.constant(`putParent` as const),
@@ -677,8 +408,11 @@ const exhaustiveActions: ReadonlyArray<CollectionAction> = [
 ]
 
 const relationshipProperty = `includes-collection.relationship-history`
+
 const publicKeyOrderProperty = `includes-collection.public-key-order`
+
 const layoutSwapProperty = `includes-collection.layout-swap`
+
 const optimisticChildProperty = `includes-collection.optimistic-child-history`
 
 describe(`Collection-valued includes oracle`, () => {
@@ -829,6 +563,7 @@ describe(`Collection-valued includes oracle`, () => {
     `keeps Collection, toArray, and materialize equivalent across fixed relationship histories`,
     runRelationshipHistory,
   )
+
   oracleReplayTest(fcTest, relationshipProperty).prop(
     [collectionScenarioArbitrary],
     oraclePropertyOptions(30, relationshipProperty),
@@ -1035,80 +770,6 @@ describe(`Collection-valued includes oracle`, () => {
     assertDeleteIdentityEvents(eventSnapshots[1]!, true)
   })
 
-  fcTest(
-    `delete identity observations reject missing and overwritten failures`,
-    () => {
-      const valid: DeleteIdentityObservation = {
-        type: `delete`,
-        key: 1,
-        id: 1,
-        matchesPublishedFacade: true,
-      }
-      assertDeleteIdentityEvents([], false)
-      assertDeleteIdentityEvents([valid], true)
-      for (const invalid of [
-        [],
-        [valid, valid],
-        [{ ...valid, matchesPublishedFacade: false }, valid],
-        [{ ...valid, type: `update` }],
-        [{ ...valid, key: `1` }],
-      ])
-        expect(() => assertDeleteIdentityEvents(invalid, true)).toThrow()
-    },
-  )
-
-  fcTest(`retirement observations reject rows retained until cleanup`, () => {
-    assertRetiredFacade({ status: `ready`, rows: [] })
-    expect(() =>
-      assertRetiredFacade({
-        status: `ready`,
-        rows: [{ id: 10, parentGroup: 1, value: 1 }],
-      }),
-    ).toThrow()
-    expect(() =>
-      assertRetiredFacade({ status: `cleaned-up`, rows: [] }),
-    ).toThrow()
-  })
-
-  fcTest(
-    `facade callback observations reject unexpected raw public keys`,
-    () => {
-      assertFacadeRootSnapshots([
-        { group: 2, usesOldFacade: false, rows: [20] },
-      ])
-      expect(() =>
-        assertFacadeRootSnapshots([
-          { group: 2, usesOldFacade: false, rows: [20, `unexpected`] },
-        ]),
-      ).toThrow()
-    },
-  )
-
-  fcTest(`facade public keys survive row cloning`, async () => {
-    const driver = createCollectionDriver(
-      [{ id: 1, group: 1 }],
-      [{ id: 10, parentGroup: 1, value: 1 }],
-    )
-    const projection: TraceProjection<
-      CollectionContext,
-      { clonedKey: unknown },
-      { clonedKey: number }
-    > = {
-      observe(context) {
-        const facade = context.live.get(1)!.children
-        const row = facade.get(10)!
-        return { clonedKey: facade.getKeyFromItem({ ...row }) }
-      },
-      recompute: () => ({ clonedKey: 10 }),
-      assertEqual(observed, expected) {
-        expect(observed).toEqual(expected)
-        return undefined
-      },
-    }
-
-    await runTrace({ steps: [], driver, projection })
-  })
-
   fcTest(`reactivating a retired route restores its current snapshot`, () =>
     runTrace({
       steps: [
@@ -1201,748 +862,59 @@ describe(`Collection-valued includes oracle`, () => {
     },
   )
 
-  fcTest(
-    `root application failure rolls back a prepared facade publication`,
-    async () => {
-      type NodeRow = {
-        id: number
-        kind: `parent` | `child`
-        group: number
-        value: number
-      }
-      const initialParent: NodeRow = {
-        id: 1,
-        kind: `parent`,
-        group: 1,
-        value: 1,
-      }
-      const initialChild: NodeRow = {
-        id: 10,
-        kind: `child`,
-        group: 1,
-        value: 1,
-      }
-      const nodes = createControlledCollection<NodeRow>(`rollback-nodes`, [
-        initialParent,
-        initialChild,
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ parent: nodes.collection })
-          .where(({ parent }) => eq(parent.kind, `parent`))
-          .select(({ parent }) => ({
-            id: parent.id,
-            value: parent.value,
-            children: include(
-              q
-                .from({ child: nodes.collection })
-                .where(({ child }) => eq(child.kind, `child`))
-                .where(({ child }) => eq(child.group, parent.group)),
-            ),
-          })),
-      )
-
-      await live.preload()
-      const facade = live.get(1)!.children
-      const rootPublications: Array<unknown> = []
-      const childPublications: Array<unknown> = []
-      const rootSubscription = live.subscribeChanges(
-        (batch) => rootPublications.push(...batch),
-        { includeInitialState: false },
-      )
-      const childSubscription = facade.subscribeChanges(
-        (batch) => childPublications.push(...batch),
-        { includeInitialState: false },
-      )
-      const originalGetKey = live.config.getKey
-      live.config.getKey = (row) => {
-        if (row.value === 2) throw new Error(`root key failed`)
-        return originalGetKey(row)
-      }
+  fcTest(`facade events observe the matching root publication`, async () => {
+    const driver = createCollectionDriver(
+      [{ id: 1, group: 1 }],
+      [
+        { id: 10, parentGroup: 1, value: 1 },
+        { id: 20, parentGroup: 2, value: 2 },
+      ],
+    )
+    const context = await driver.setup()
+    await driver.start?.(context)
+    const oldFacade = context.live.get(1)!.children
+    const callbackSnapshots: Array<FacadeRootSnapshot> = []
+    const subscription = oldFacade.subscribeChanges(
+      () => {
+        const current = context.live.get(1)
+        callbackSnapshots.push({
+          group: current?.group,
+          usesOldFacade: current?.children === oldFacade,
+          rows: current ? [...current.children.keys()] : [],
+        })
+      },
+      { includeInitialState: false },
+    )
 
-      try {
-        expect(() =>
-          nodes.writeBatch([
-            {
-              type: `update`,
-              value: { ...initialParent, value: 2 },
-            },
-            {
-              type: `update`,
-              value: { ...initialChild, value: 2 },
-            },
-          ]),
-        ).toThrow(`root key failed`)
-        expect(live.get(1)!.value).toBe(1)
-        expect(facade.get(10)!.value).toBe(1)
-        expect(rootPublications).toEqual([])
-        expect(childPublications).toEqual([])
-
-        live.config.getKey = originalGetKey
-        nodes.writeBatch([
-          {
-            type: `update`,
-            value: { ...initialParent, value: 3 },
-          },
-          {
-            type: `update`,
-            value: { ...initialChild, value: 3 },
-          },
-        ])
-        expect(live.get(1)!.value).toBe(3)
-        expect(facade.get(10)!.value).toBe(3)
-        expect(rootPublications).toHaveLength(1)
-        expect(childPublications).toHaveLength(1)
-      } finally {
-        live.config.getKey = originalGetKey
-        rootSubscription.unsubscribe()
-        childSubscription.unsubscribe()
-        await Promise.all([live.cleanup(), nodes.collection.cleanup()])
-      }
-    },
-  )
+    try {
+      context.parents.write(`update`, { id: 1, group: 2 })
+      assertFacadeRootSnapshots(callbackSnapshots)
+    } finally {
+      subscription.unsubscribe()
+      await driver.cleanup(context)
+    }
+  })
 
   fcTest(
-    `a retry after a failed root commit publishes the pending child change`,
+    `shared facades remain active until their last parent departs`,
     async () => {
-      // The failed root commit keeps the parent and child changes pending.
-      // The retry carries only a further parent change, and must still
-      // publish the child change once.
-      type NodeRow = {
-        id: number
-        kind: `parent` | `child`
-        group: number
-        value: number
-      }
-      const parent: NodeRow = { id: 1, kind: `parent`, group: 1, value: 1 }
-      const child: NodeRow = { id: 10, kind: `child`, group: 1, value: 1 }
-      const nodes = createControlledCollection<NodeRow>(`retry-nodes`, [
-        parent,
-        child,
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ parent: nodes.collection })
-          .where(({ parent }) => eq(parent.kind, `parent`))
-          .select(({ parent }) => ({
-            id: parent.id,
-            value: parent.value,
-            children: include(
-              q
-                .from({ child: nodes.collection })
-                .where(({ child }) => eq(child.kind, `child`))
-                .where(({ child }) => eq(child.group, parent.group)),
-            ),
-          })),
-      )
-
-      await live.preload()
-      const facade = live.get(1)!.children
-      const childPublications: Array<unknown> = []
-      const childSubscription = facade.subscribeChanges(
-        (batch) => childPublications.push(...batch),
-        { includeInitialState: false },
+      const driver = createCollectionDriver(
+        [
+          { id: 1, group: 1 },
+          { id: 2, group: 1 },
+        ],
+        [{ id: 10, parentGroup: 1, value: 1 }],
       )
-      const originalGetKey = live.config.getKey
-      live.config.getKey = (row) => {
-        if (row.value === 2) throw new Error(`root key failed`)
-        return originalGetKey(row)
-      }
+      const context = await driver.setup()
+      await driver.start?.(context)
+      const sharedFacade = context.live.get(1)!.children
 
       try {
-        expect(() =>
-          nodes.writeBatch([
-            { type: `update`, value: { ...parent, value: 2 } },
-            { type: `update`, value: { ...child, value: 2 } },
-          ]),
-        ).toThrow(`root key failed`)
-        expect(facade.get(10)!.value).toBe(1)
-
-        live.config.getKey = originalGetKey
-        nodes.writeBatch([{ type: `update`, value: { ...parent, value: 3 } }])
-        expect(live.get(1)!.value).toBe(3)
-        expect(facade.get(10)!.value).toBe(2)
-        expect(childPublications).toHaveLength(1)
-      } finally {
-        live.config.getKey = originalGetKey
-        childSubscription.unsubscribe()
-        await Promise.all([live.cleanup(), nodes.collection.cleanup()])
-      }
-    },
-  )
-
-  fcTest(
-    `child-only changes flush the facade without republishing the parent`,
-    async () => {
-      const parents = createControlledCollection(`facade-only-parents`, [
-        { id: 1, group: 1 },
-      ])
-      const children = createControlledCollection(`facade-only-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q.from({ parent: parents.collection }).select(({ parent }) => ({
-          id: parent.id,
-          children: include(
-            q
-              .from({ child: children.collection })
-              .where(({ child }) => eq(child.parentGroup, parent.group)),
-          ),
-        })),
-      )
-
-      await live.preload()
-      const facade = live.get(1)!.children
-      const rootPublications: Array<unknown> = []
-      const childPublications: Array<unknown> = []
-      const rootSubscription = live.subscribeChanges(
-        (batch) => rootPublications.push(...batch),
-        { includeInitialState: false },
-      )
-      const childSubscription = facade.subscribeChanges(
-        (batch) => childPublications.push(...batch),
-        { includeInitialState: false },
-      )
-
-      try {
-        children.write(`update`, {
-          id: 10,
-          parentGroup: 1,
-          value: 2,
-        })
-
-        expect(rootPublications).toEqual([])
-        expect(childPublications).toHaveLength(1)
-        expect(live.get(1)!.children).toBe(facade)
-        expect(
-          [...facade.values()].map(({ id, parentGroup, value }) => ({
-            id,
-            parentGroup,
-            value,
-          })),
-        ).toEqual([{ id: 10, parentGroup: 1, value: 2 }])
-      } finally {
-        rootSubscription.unsubscribe()
-        childSubscription.unsubscribe()
-        await Promise.all([
-          live.cleanup(),
-          parents.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(
-    `outer fn.select recomputes nested values after a union branch include changes`,
-    async () => {
-      const callbackRows: Array<Record<PropertyKey, unknown>> = []
-      const messages = createControlledCollection(`fn-select-messages`, [
-        { id: 1, group: 1 },
-      ])
-      const tools = createControlledCollection(`fn-select-tools`, [
-        { id: 2, group: 2 },
-      ])
-      const children = createControlledCollection(`fn-select-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-      ])
-      const live = createLiveQueryCollection((q) => {
-        const messageRows = q
-          .from({ message: messages.collection })
-          .select(({ message }) => ({
-            kind: `message` as const,
-            id: message.id,
-            children: toArray(
-              q
-                .from({ messageChild: children.collection })
-                .where(({ messageChild }) =>
-                  eq(messageChild.parentGroup, message.group),
-                )
-                .select(({ messageChild }) => ({
-                  id: messageChild.id,
-                  value: messageChild.value,
-                })),
-            ),
-          }))
-        const toolRows = q
-          .from({ tool: tools.collection })
-          .select(({ tool }) => ({
-            kind: `tool` as const,
-            id: tool.id,
-          }))
-
-        return q.unionAll(messageRows, toolRows).fn.select((row) => {
-          callbackRows.push(row)
-          return {
-            kind: row.kind,
-            id: row.id,
-            payload: { children: row.children },
-          }
-        })
-      })
-
-      try {
-        await live.preload()
-        const message = live.toArray.find((row) => row.kind === `message`)!
-        expect(message.payload.children).toEqual([{ id: 10, value: 1 }])
-
-        children.write(`update`, {
-          id: 10,
-          parentGroup: 1,
-          value: 2,
-        })
-        expect(
-          live.toArray.find((row) => row.kind === `message`)!.payload.children,
-        ).toEqual([{ id: 10, value: 2 }])
-        expect(
-          callbackRows.flatMap((row) => Object.getOwnPropertySymbols(row)),
-        ).toEqual([])
-      } finally {
-        await Promise.all([
-          live.cleanup(),
-          messages.collection.cleanup(),
-          tools.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(
-    `outer fn.select rejects a bare union include before invoking the callback`,
-    async () => {
-      class Box {
-        constructor(readonly child: unknown) {}
-      }
-
-      const callbackChildren: Array<unknown> = []
-      const messages = createControlledCollection(`fn-select-bare-messages`, [
-        { id: 1, group: 1 },
-      ])
-      const tools = createControlledCollection(`fn-select-bare-tools`, [
-        { id: 2, group: 2 },
-      ])
-      const children = createControlledCollection(`fn-select-bare-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-        { id: 20, parentGroup: 2, value: 2 },
-      ])
-      const buildQuery = () =>
-        createLiveQueryCollection((q) => {
-          const messageRows = q
-            .from({ message: messages.collection })
-            .select(({ message }) => ({
-              kind: `message` as const,
-              id: message.id,
-              children: include(
-                q
-                  .from({ messageChild: children.collection })
-                  .where(({ messageChild }) =>
-                    eq(messageChild.parentGroup, message.group),
-                  ),
-              ),
-            }))
-          const toolRows = q
-            .from({ tool: tools.collection })
-            .select(({ tool }) => ({
-              kind: `tool` as const,
-              id: tool.id,
-            }))
-
-          return q.unionAll(messageRows, toolRows).fn.select((row) => {
-            const child = `children` in row ? row.children : undefined
-            callbackChildren.push(child)
-            return { kind: row.kind, id: row.id, box: new Box(child) }
-          })
-        })
-
-      try {
-        expect(buildQuery).toThrow(
-          `fn.select() cannot consume Collection-valued includes`,
-        )
-        expect(callbackChildren).toEqual([])
-      } finally {
-        await Promise.all([
-          messages.collection.cleanup(),
-          tools.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(
-    `fn.select rejects query values returned during include rematerialization`,
-    async () => {
-      const messages = createControlledCollection(`fn-select-reject-messages`, [
-        { id: 1, group: 1 },
-      ])
-      const tools = createControlledCollection(`fn-select-reject-tools`, [
-        { id: 2, group: 2 },
-      ])
-      const children = createControlledCollection(`fn-select-reject-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-      ])
-      const live = createLiveQueryCollection((q) => {
-        const messageRows = q
-          .from({ message: messages.collection })
-          .select(({ message }) => ({
-            kind: `message` as const,
-            id: message.id,
-            children: toArray(
-              q
-                .from({ messageChild: children.collection })
-                .where(({ messageChild }) =>
-                  eq(messageChild.parentGroup, message.group),
-                ),
-            ),
-          }))
-        const toolRows = q
-          .from({ tool: tools.collection })
-          .select(({ tool }) => ({
-            kind: `tool` as const,
-            id: tool.id,
-          }))
-
-        return q.unionAll(messageRows, toolRows).fn.select((row) => {
-          const includedChildren =
-            row.kind === `message`
-              ? (row.children as typeof row.children | null)
-              : null
-
-          return {
-            kind: row.kind,
-            id: row.id,
-            leakedQuery:
-              includedChildren?.[0]?.value === 2
-                ? q.from({ child: children.collection })
-                : null,
-          } as any
-        })
-      })
-
-      try {
-        await live.preload()
-
-        expect(() =>
-          children.write(`update`, {
-            id: 10,
-            parentGroup: 1,
-            value: 2,
-          }),
-        ).toThrow(`fn.select() cannot return a child query builder`)
-      } finally {
-        await Promise.all([
-          live.cleanup(),
-          messages.collection.cleanup(),
-          tools.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(
-    `rejects collapsed contributors that disagree by value, order, or outgoing route`,
-    async () => {
-      type CommentRow = {
-        id: number
-        userId: number
-        text: string
-      }
-      const users = createControlledCollection(`congruence-users`, [
-        { id: 1, group: 1 },
-      ])
-
-      const expectIncrementalRejection = async (
-        mode: `value` | `order`,
-      ): Promise<void> => {
-        const comments = createControlledCollection<CommentRow>(
-          `congruence-${mode}-comments`,
-          [{ id: 1, userId: 1, text: `first` }],
-        )
-        const live = createLiveQueryCollection({
-          query: (q) => {
-            const joined = q
-              .from({ comment: comments.collection })
-              .join({ user: users.collection }, ({ comment, user }) =>
-                eq(comment.userId, user.id),
-              )
-            return mode === `value`
-              ? joined.select(({ comment }) => ({
-                  publicId: comment.userId,
-                  visible: comment.text,
-                }))
-              : joined
-                  .orderBy(({ comment }) => comment.id)
-                  .select(({ comment }) => ({
-                    publicId: comment.userId,
-                    visible: `same`,
-                  }))
-          },
-          getKey: (row) => row.publicId,
-        })
-
-        try {
-          await live.preload()
-          expect(() =>
-            comments.write(`insert`, {
-              id: 2,
-              userId: 1,
-              text: mode === `value` ? `second` : `ignored`,
-            }),
-          ).toThrow(`not congruent`)
-        } finally {
-          await live.cleanup()
-          await comments.collection.cleanup()
-        }
-      }
-
-      await expectIncrementalRejection(`value`)
-      await expectIncrementalRejection(`order`)
-
-      const parents = createControlledCollection(`congruence-parents`, [
-        { id: 1, group: 1 },
-      ])
-      const children = createControlledCollection<ChildRow>(
-        `congruence-children`,
-        [],
-      )
-      const routed = createLiveQueryCollection({
-        query: (q) =>
-          q.from({ parent: parents.collection }).select(({ parent }) => ({
-            publicId: 1,
-            visible: `same`,
-            children: toArray(
-              q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.parentGroup, parent.group)),
-            ),
-          })),
-        getKey: (row) => row.publicId,
-      })
-
-      try {
-        await routed.preload()
-        expect(() => parents.write(`insert`, { id: 2, group: 2 })).toThrow(
-          `not congruent`,
-        )
-      } finally {
-        await routed.cleanup()
-        await Promise.all([
-          parents.collection.cleanup(),
-          children.collection.cleanup(),
-          users.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(`facade events observe the matching root publication`, async () => {
-    const driver = createCollectionDriver(
-      [{ id: 1, group: 1 }],
-      [
-        { id: 10, parentGroup: 1, value: 1 },
-        { id: 20, parentGroup: 2, value: 2 },
-      ],
-    )
-    const context = await driver.setup()
-    await driver.start?.(context)
-    const oldFacade = context.live.get(1)!.children
-    const callbackSnapshots: Array<FacadeRootSnapshot> = []
-    const subscription = oldFacade.subscribeChanges(
-      () => {
-        const current = context.live.get(1)
-        callbackSnapshots.push({
-          group: current?.group,
-          usesOldFacade: current?.children === oldFacade,
-          rows: current ? [...current.children.keys()] : [],
-        })
-      },
-      { includeInitialState: false },
-    )
-
-    try {
-      context.parents.write(`update`, { id: 1, group: 2 })
-      assertFacadeRootSnapshots(callbackSnapshots)
-    } finally {
-      subscription.unsubscribe()
-      await driver.cleanup(context)
-    }
-  })
-
-  fcTest(
-    `a holder's cleanup during root publication throws and keeps the facade`,
-    async () => {
-      type NodeRow = {
-        id: number
-        kind: `parent` | `child`
-        group: number
-        value: number
-      }
-      const nodes = createControlledCollection<NodeRow>(`publication-cleanup`, [
-        { id: 1, kind: `parent`, group: 1, value: 1 },
-        { id: 10, kind: `child`, group: 1, value: 1 },
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ parent: nodes.collection })
-          .where(({ parent }) => eq(parent.kind, `parent`))
-          .select(({ parent }) => ({
-            id: parent.id,
-            value: parent.value,
-            children: include(
-              q
-                .from({ child: nodes.collection })
-                .where(({ child }) => eq(child.kind, `child`))
-                .where(({ child }) => eq(child.group, parent.group)),
-            ),
-          })),
-      )
-
-      await live.preload()
-      const facade = live.get(1)!.children
-      const rootSnapshots: Array<Array<number>> = []
-      const facadeSnapshots: Array<Array<number>> = []
-      // The live query owns its child collections, so a holder's cleanup
-      // throws, even inside the root's publication.
-      const cleanupErrors: Array<unknown> = []
-      const rootSubscription = live.subscribeChanges(
-        () => {
-          rootSnapshots.push(facade.toArray.map(({ value }) => value))
-          facade.cleanup().catch((error: unknown) => cleanupErrors.push(error))
-        },
-        { includeInitialState: false },
-      )
-      const facadeSubscription = facade.subscribeChanges(
-        () => facadeSnapshots.push(facade.toArray.map(({ value }) => value)),
-        { includeInitialState: false },
-      )
-
-      try {
-        nodes.writeBatch([
-          {
-            type: `update`,
-            value: { id: 1, kind: `parent`, group: 1, value: 2 },
-          },
-          {
-            type: `update`,
-            value: { id: 10, kind: `child`, group: 1, value: 2 },
-          },
-        ])
-        await Promise.resolve()
-        expect(rootSnapshots).toEqual([[2]])
-        expect(cleanupErrors).toHaveLength(1)
-        expect(String(cleanupErrors[0])).toMatch(
-          /cannot be cleaned up directly/,
-        )
-        expect(facadeSnapshots).toEqual([[2]])
-        expect(facade.status).toBe(`ready`)
-        expect(facade.toArray.map(({ value }) => value)).toEqual([2])
-      } finally {
-        rootSubscription.unsubscribe()
-        facadeSubscription.unsubscribe()
-        await Promise.all([live.cleanup(), nodes.collection.cleanup()])
-      }
-    },
-  )
-
-  fcTest(
-    `live query cleanup during root publication suppresses the prepared facade callback`,
-    async () => {
-      type NodeRow = {
-        id: number
-        kind: `parent` | `child`
-        group: number
-        value: number
-      }
-      const nodes = createControlledCollection<NodeRow>(
-        `publication-live-cleanup`,
-        [
-          { id: 1, kind: `parent`, group: 1, value: 1 },
-          { id: 10, kind: `child`, group: 1, value: 1 },
-        ],
-      )
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ parent: nodes.collection })
-          .where(({ parent }) => eq(parent.kind, `parent`))
-          .select(({ parent }) => ({
-            id: parent.id,
-            value: parent.value,
-            children: include(
-              q
-                .from({ child: nodes.collection })
-                .where(({ child }) => eq(child.kind, `child`))
-                .where(({ child }) => eq(child.group, parent.group)),
-            ),
-          })),
-      )
-
-      await live.preload()
-      const facade = live.get(1)!.children
-      const rootSnapshots: Array<Array<number>> = []
-      const facadeSnapshots: Array<Array<number>> = []
-      // The owner ends its child collections while the root publishes. The
-      // facade's prepared publication must not reach its subscribers after
-      // that.
-      let cleanup: Promise<void> | undefined
-      const rootSubscription = live.subscribeChanges(
-        () => {
-          rootSnapshots.push(facade.toArray.map(({ value }) => value))
-          cleanup = live.cleanup()
-        },
-        { includeInitialState: false },
-      )
-      const facadeSubscription = facade.subscribeChanges(
-        () => facadeSnapshots.push(facade.toArray.map(({ value }) => value)),
-        { includeInitialState: false },
-      )
-
-      try {
-        nodes.writeBatch([
-          {
-            type: `update`,
-            value: { id: 1, kind: `parent`, group: 1, value: 2 },
-          },
-          {
-            type: `update`,
-            value: { id: 10, kind: `child`, group: 1, value: 2 },
-          },
-        ])
-        await cleanup
-
-        expect(rootSnapshots).toEqual([[2]])
-        expect(facadeSnapshots).toEqual([])
-        expect(facade.status).toBe(`cleaned-up`)
-        expect(facade.toArray).toEqual([])
-      } finally {
-        rootSubscription.unsubscribe()
-        facadeSubscription.unsubscribe()
-        await nodes.collection.cleanup()
-      }
-    },
-  )
-
-  fcTest(
-    `shared facades remain active until their last parent departs`,
-    async () => {
-      const driver = createCollectionDriver(
-        [
-          { id: 1, group: 1 },
-          { id: 2, group: 1 },
-        ],
-        [{ id: 10, parentGroup: 1, value: 1 }],
-      )
-      const context = await driver.setup()
-      await driver.start?.(context)
-      const sharedFacade = context.live.get(1)!.children
-
-      try {
-        expect(context.live.get(2)!.children).toBe(sharedFacade)
-        context.parents.write(`delete`, { id: 1, group: 1 })
-        expect(context.live.get(2)!.children).toBe(sharedFacade)
-        expect([...sharedFacade.keys()]).toEqual([10])
-        expect(sharedFacade.status).toBe(`ready`)
+        expect(context.live.get(2)!.children).toBe(sharedFacade)
+        context.parents.write(`delete`, { id: 1, group: 1 })
+        expect(context.live.get(2)!.children).toBe(sharedFacade)
+        expect([...sharedFacade.keys()]).toEqual([10])
+        expect(sharedFacade.status).toBe(`ready`)
 
         context.parents.write(`delete`, { id: 2, group: 1 })
         expect(context.live.toArray).toEqual([])
@@ -1985,40 +957,6 @@ describe(`Collection-valued includes oracle`, () => {
     },
   )
 
-  fcTest(`a matched null singleton remains null`, async () => {
-    type NullableChild = { id: number; parentGroup: number; value: null }
-    const parents = createControlledCollection(`nullable-oracle-parents`, [
-      { id: 1, group: 1 },
-    ])
-    const children = createControlledCollection<NullableChild>(
-      `nullable-oracle-children`,
-      [{ id: 10, parentGroup: 1, value: null }],
-    )
-    const live = createLiveQueryCollection((q) =>
-      q.from({ parent: parents.collection }).select(({ parent }) => ({
-        id: parent.id,
-        value: materialize(
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentGroup, parent.group))
-            .select(({ child }) => child.value)
-            .findOne(),
-        ),
-      })),
-    )
-
-    try {
-      await live.preload()
-      expect(live.get(1)!.value).toBeNull()
-    } finally {
-      await Promise.all([
-        live.cleanup(),
-        parents.collection.cleanup(),
-        children.collection.cleanup(),
-      ])
-    }
-  })
-
   const runPublicKeyOrder = async ({
     smallId,
     wideId,
@@ -2090,6 +1028,7 @@ describe(`Collection-valued includes oracle`, () => {
     `uses one raw public-key order across Collection and inline materializations with a fixed seed`,
     runPublicKeyOrder,
   )
+
   oracleReplayTest(fcTest, publicKeyOrderProperty).prop(
     [publicKeyOrderArbitrary],
     oraclePropertyOptions(20, publicKeyOrderProperty),
@@ -2218,6 +1157,7 @@ describe(`Collection-valued includes oracle`, () => {
     `propagates order-only child swaps through every materialization with a fixed seed`,
     runLayoutSwap,
   )
+
   oracleReplayTest(fcTest, layoutSwapProperty).prop(
     [orderSwapArbitrary],
     oraclePropertyOptions(20, layoutSwapProperty),
@@ -2246,10 +1186,7 @@ describe(`Collection-valued includes oracle`, () => {
         ])
         // This source Map is the reference model. The selected facade rows
         // omit rank, so final row equality alone cannot prove layout delivery.
-        const expectedRows = () =>
-          [...sourceRows.values()]
-            .sort((left, right) => left.rank - right.rank)
-            .map(({ id, value }) => ({ id, value }))
+        const expectedRows = () => expectedOrderedRows(sourceRows)
 
         let sync!: Parameters<SyncConfig<OrderedChild, number>[`sync`]>[0]
         let holdRepair = false
@@ -2460,10 +1397,7 @@ describe(`Collection-valued includes oracle`, () => {
       // Rank is absent from the facade row but retained in this source model:
       // two otherwise equal rows with different ranks yield different layouts.
       // The provider receives copies, so it cannot mutate the expected rows.
-      const expectedRows = () =>
-        [...sourceRows.values()]
-          .sort((left, right) => left.rank - right.rank)
-          .map(({ id, value }) => ({ id, value }))
+      const expectedRows = () => expectedOrderedRows(sourceRows)
 
       let sync!: Parameters<SyncConfig<OrderedChild, number>[`sync`]>[0]
       let holdReplay = false
@@ -2600,561 +1534,6 @@ describe(`Collection-valued includes oracle`, () => {
     },
   )
 
-  fcTest(
-    `held-facade cleanup retains the primary and both cleanup failures`,
-    async () => {
-      const primary = new Error(`facade publication mismatch`)
-      const firstCleanup = new Error(`facade unsubscribe failed`)
-      const secondCleanup = new Error(`source cleanup failed`)
-      const released: Array<string> = []
-      let failure: unknown
-      try {
-        await withHistoryCleanup(
-          async () => {
-            throw primary
-          },
-          () => [
-            () => {
-              released.push(`facade`)
-              throw firstCleanup
-            },
-            () => {
-              released.push(`source`)
-              throw secondCleanup
-            },
-            () => {
-              released.push(`parent`)
-            },
-          ],
-        )
-      } catch (error) {
-        failure = error
-      }
-      expect(released).toEqual([`facade`, `source`, `parent`])
-      expect(failure).toBeInstanceOf(AggregateError)
-      expect((failure as AggregateError).cause).toBe(primary)
-      expect((failure as AggregateError).errors).toEqual([
-        primary,
-        firstCleanup,
-        secondCleanup,
-      ])
-    },
-  )
-
-  fcTest(
-    `reconstructs nested conditional includes through guard transitions`,
-    async () => {
-      type GuardedParent = ParentRow & { active: boolean }
-      const parents = createControlledCollection<GuardedParent>(
-        `guarded-parents`,
-        [{ id: 1, group: 1, active: true }],
-      )
-      const children = createControlledCollection(`guarded-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q.from({ parent: parents.collection }).select(({ parent }) => {
-          const childRows = () =>
-            q
-              .from({ child: children.collection })
-              .where(({ child }) => eq(child.parentGroup, parent.group))
-              .orderBy(({ child }) => child.id)
-              .select(({ child }) => ({
-                id: child.id,
-                parentGroup: child.parentGroup,
-                value: child.value,
-              }))
-
-          return {
-            id: parent.id,
-            profile: caseWhen(
-              eq(parent.active, true),
-              {
-                kind: `active` as const,
-                facade: include(childRows()),
-                array: toArray(childRows()),
-                materialized: materialize(childRows()),
-              },
-              { kind: `inactive` as const },
-            ),
-          }
-        }),
-      )
-
-      const project = () => {
-        const profile = live.get(1)!.profile
-        if (profile.kind === `inactive`) return profile
-        const rows = (values: Iterable<ChildRow>) =>
-          [...values].map(({ id, value }) => ({ id, value }))
-        return {
-          kind: profile.kind,
-          facade: rows(profile.facade.values()),
-          array: rows(profile.array),
-          materialized: rows(profile.materialized),
-        }
-      }
-
-      try {
-        await live.preload()
-        const initialProfile = live.get(1)!.profile
-        if (initialProfile.kind === `inactive`) {
-          throw new Error(
-            `Expected the initial conditional branch to be active`,
-          )
-        }
-        const initialFacade = initialProfile.facade
-        expect(project()).toEqual({
-          kind: `active`,
-          ...expectedMaterializations([{ id: 10, value: 1 }]),
-        })
-
-        parents.write(`update`, { id: 1, group: 1, active: false })
-        expect(project()).toEqual({ kind: `inactive` })
-        expect(initialFacade.toArray).toEqual([])
-        expect(initialFacade.status).toBe(`ready`)
-        children.write(`insert`, { id: 20, parentGroup: 1, value: 2 })
-        expect(project()).toEqual({ kind: `inactive` })
-
-        parents.write(`update`, { id: 1, group: 1, active: true })
-        const reactivatedProfile = live.get(1)!.profile
-        if (reactivatedProfile.kind === `inactive`) {
-          throw new Error(`Expected the conditional branch to reactivate`)
-        }
-        expect(reactivatedProfile.facade).not.toBe(initialFacade)
-        expect(project()).toEqual({
-          kind: `active`,
-          ...expectedMaterializations([
-            { id: 10, value: 1 },
-            { id: 20, value: 2 },
-          ]),
-        })
-      } finally {
-        await Promise.all([
-          live.cleanup(),
-          parents.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(
-    `matches recomputation for correlated aggregate child relations`,
-    async () => {
-      const parents = createControlledCollection(`aggregate-parents`, [
-        { id: 1, group: 1, factor: 1 },
-        { id: 2, group: 1, factor: -1 },
-        { id: 3, group: 2, factor: 2 },
-      ])
-      const children = createControlledCollection(`aggregate-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-        { id: 20, parentGroup: 1, value: 2 },
-        { id: 30, parentGroup: 2, value: 5 },
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ parent: parents.collection })
-          .orderBy(({ parent }) => parent.id)
-          .select(({ parent }) => {
-            const summaries = () =>
-              q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.parentGroup, parent.group))
-                .groupBy(({ child }) => child.parentGroup)
-                .select(({ child }) => ({
-                  parentGroup: child.parentGroup,
-                  count: count(child.id),
-                  total: sum(multiply(child.value, parent.factor)),
-                }))
-            const total = () =>
-              q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.parentGroup, parent.group))
-                .select(({ child }) => ({
-                  count: count(child.id),
-                  total: sum(multiply(child.value, parent.factor)),
-                }))
-
-            return {
-              id: parent.id,
-              facade: include(summaries()),
-              array: toArray(summaries()),
-              materialized: materialize(summaries()),
-              implicit: materialize(total()),
-            }
-          }),
-      )
-
-      type Summary = { parentGroup: number; count: number; total: number }
-      const project = () =>
-        live.toArray.map((row) => {
-          const clean = (values: Iterable<Summary>) =>
-            [...values].map(({ parentGroup, count: size, total }) => ({
-              parentGroup,
-              count: size,
-              total,
-            }))
-          return {
-            id: row.id,
-            facade: clean(row.facade.values()),
-            array: clean(row.array),
-            materialized: clean(row.materialized),
-            implicit: row.implicit.map(({ count: size, total }) => ({
-              count: size,
-              total,
-            })),
-          }
-        })
-
-      const expected = (groupOneTotal: number, groupOneCount: number) => [
-        {
-          id: 1,
-          ...expectedMaterializations([
-            { parentGroup: 1, count: groupOneCount, total: groupOneTotal },
-          ]),
-          implicit: [{ count: groupOneCount, total: groupOneTotal }],
-        },
-        {
-          id: 2,
-          ...expectedMaterializations([
-            {
-              parentGroup: 1,
-              count: groupOneCount,
-              total: -groupOneTotal,
-            },
-          ]),
-          implicit: [{ count: groupOneCount, total: -groupOneTotal }],
-        },
-        {
-          id: 3,
-          ...expectedMaterializations([
-            { parentGroup: 2, count: 1, total: 10 },
-          ]),
-          implicit: [{ count: 1, total: 10 }],
-        },
-      ]
-
-      try {
-        await live.preload()
-        expect(project()).toEqual(expected(3, 2))
-
-        children.write(`update`, { id: 20, parentGroup: 1, value: 7 })
-        expect(project()).toEqual(expected(8, 2))
-
-        children.write(`delete`, { id: 10, parentGroup: 1, value: 1 })
-        expect(project()).toEqual(expected(7, 1))
-      } finally {
-        await Promise.all([
-          live.cleanup(),
-          parents.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(
-    `evaluates correlated having clauses with parent context`,
-    async () => {
-      type HavingParent = ParentRow & { threshold: number }
-      const parents = createControlledCollection<HavingParent>(
-        `having-parents`,
-        [
-          { id: 1, group: 1, threshold: 1 },
-          { id: 2, group: 1, threshold: 3 },
-        ],
-      )
-      const children = createControlledCollection(`having-children`, [
-        { id: 10, parentGroup: 1, value: 1 },
-        { id: 20, parentGroup: 1, value: 2 },
-      ])
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ parent: parents.collection })
-          .orderBy(({ parent }) => parent.id)
-          .select(({ parent }) => {
-            const summaries = () =>
-              q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.parentGroup, parent.group))
-                .groupBy(({ child }) => child.parentGroup)
-                .having(({ child }) => gt(count(child.id), parent.threshold))
-                .select(({ child }) => ({ count: count(child.id) }))
-
-            return {
-              id: parent.id,
-              facade: include(summaries()),
-              array: toArray(summaries()),
-              materialized: materialize(summaries()),
-            }
-          }),
-      )
-
-      const project = () =>
-        live.toArray.map((row) => {
-          const counts = (values: Iterable<{ count: number }>) =>
-            [...values].map(({ count: size }) => size)
-          return {
-            id: row.id,
-            facade: counts(row.facade.values()),
-            array: counts(row.array),
-            materialized: counts(row.materialized),
-          }
-        })
-
-      try {
-        await live.preload()
-        expect(project()).toEqual([
-          { id: 1, ...expectedMaterializations([2]) },
-          { id: 2, ...expectedMaterializations([]) },
-        ])
-
-        // The count equals this threshold, so `gt` must still exclude it.
-        parents.write(`update`, { id: 2, group: 1, threshold: 2 })
-        expect(project()).toEqual([
-          { id: 1, ...expectedMaterializations([2]) },
-          { id: 2, ...expectedMaterializations([]) },
-        ])
-
-        parents.write(`update`, { id: 2, group: 1, threshold: 1 })
-        expect(project()).toEqual([
-          { id: 1, ...expectedMaterializations([2]) },
-          { id: 2, ...expectedMaterializations([2]) },
-        ])
-      } finally {
-        await Promise.all([
-          live.cleanup(),
-          parents.collection.cleanup(),
-          children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(`routes changes to non-key parent filter inputs`, async () => {
-    type FilterParent = ParentRow & { threshold: number }
-    const parents = createControlledCollection<FilterParent>(
-      `parent-filter-input-parents`,
-      [{ id: 1, group: 1, threshold: 2 }],
-    )
-    const children = createControlledCollection(
-      `parent-filter-input-children`,
-      [
-        { id: 10, parentGroup: 1, value: 1 },
-        { id: 20, parentGroup: 1, value: 3 },
-      ],
-    )
-    const live = createLiveQueryCollection((q) =>
-      q.from({ parent: parents.collection }).select(({ parent }) => {
-        const childRows = () =>
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentGroup, parent.group))
-            .where(({ child }) => lt(child.value, parent.threshold))
-            .orderBy(({ child }) => child.id)
-            .select(({ child }) => ({ id: child.id, value: child.value }))
-
-        return {
-          id: parent.id,
-          facade: include(childRows()),
-          array: toArray(childRows()),
-          materialized: materialize(childRows()),
-        }
-      }),
-    )
-
-    const project = () => {
-      const row = live.get(1)!
-      const ids = (values: Iterable<{ id: number }>) =>
-        [...values].map(({ id }) => id)
-      return {
-        facade: ids(row.facade.values()),
-        array: ids(row.array),
-        materialized: ids(row.materialized),
-      }
-    }
-
-    try {
-      await live.preload()
-      expect(project()).toEqual(expectedMaterializations([10]))
-
-      // Both equality boundaries distinguish `<` from an inclusive filter.
-      parents.write(`update`, { id: 1, group: 1, threshold: 1 })
-      expect(project()).toEqual(expectedMaterializations([]))
-
-      parents.write(`update`, { id: 1, group: 1, threshold: 3 })
-      expect(project()).toEqual(expectedMaterializations([10]))
-
-      parents.write(`update`, { id: 1, group: 1, threshold: 4 })
-      expect(project()).toEqual(expectedMaterializations([10, 20]))
-
-      parents.write(`update`, { id: 1, group: 1, threshold: 0 })
-      expect(project()).toEqual(expectedMaterializations([]))
-    } finally {
-      await Promise.all([
-        live.cleanup(),
-        parents.collection.cleanup(),
-        children.collection.cleanup(),
-      ])
-    }
-  })
-
-  fcTest(`routes changes to parent-dependent child ordering`, async () => {
-    type OrderingParent = ParentRow & { direction: number }
-    const parents = createControlledCollection<OrderingParent>(
-      `parent-order-input-parents`,
-      [
-        { id: 1, group: 1, direction: 1 },
-        { id: 2, group: 1, direction: -1 },
-      ],
-    )
-    const children = createControlledCollection(`parent-order-input-children`, [
-      { id: 10, parentGroup: 1, value: 1 },
-      { id: 20, parentGroup: 1, value: 2 },
-    ])
-    const live = createLiveQueryCollection((q) =>
-      q.from({ parent: parents.collection }).select(({ parent }) => {
-        const childRows = () =>
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentGroup, parent.group))
-            .orderBy(({ child }) => multiply(child.value, parent.direction))
-            .select(({ child }) => ({ id: child.id, value: child.value }))
-
-        return {
-          id: parent.id,
-          facade: include(childRows()),
-          array: toArray(childRows()),
-          materialized: materialize(childRows()),
-        }
-      }),
-    )
-
-    const project = (id: number) => {
-      const row = live.get(id)!
-      const rows = (values: Iterable<{ id: number; value: number }>) =>
-        [...values].map(({ id: childId, value }) => ({ id: childId, value }))
-      return {
-        facade: rows(row.facade.values()),
-        array: rows(row.array),
-        materialized: rows(row.materialized),
-      }
-    }
-
-    try {
-      await live.preload()
-      const ascendingFacade = live.get(1)!.facade
-      const descendingFacade = live.get(2)!.facade
-      expect(project(1)).toEqual(
-        expectedMaterializations([
-          { id: 10, value: 1 },
-          { id: 20, value: 2 },
-        ]),
-      )
-      expect(project(2)).toEqual(
-        expectedMaterializations([
-          { id: 20, value: 2 },
-          { id: 10, value: 1 },
-        ]),
-      )
-      expect(ascendingFacade).not.toBe(descendingFacade)
-
-      parents.write(`update`, { id: 1, group: 1, direction: -1 })
-      expect(live.get(1)!.facade).toBe(descendingFacade)
-      expect(ascendingFacade.toArray).toEqual([])
-      expect(project(1)).toEqual(
-        expectedMaterializations([
-          { id: 20, value: 2 },
-          { id: 10, value: 1 },
-        ]),
-      )
-    } finally {
-      await Promise.all([
-        live.cleanup(),
-        parents.collection.cleanup(),
-        children.collection.cleanup(),
-      ])
-    }
-  })
-
-  fcTest(`routes changes to parent-dependent child joins`, async () => {
-    type JoinParent = ParentRow & { offset: number }
-    type JoinedChild = ChildRow & { tagId: number }
-    type Tag = { id: number; label: string }
-    const parents = createControlledCollection<JoinParent>(
-      `parent-join-parents`,
-      [
-        { id: 1, group: 1, offset: 0 },
-        { id: 2, group: 1, offset: 1 },
-      ],
-    )
-    const children = createControlledCollection<JoinedChild>(
-      `parent-join-children`,
-      [{ id: 10, parentGroup: 1, value: 1, tagId: 1 }],
-    )
-    const tags = createControlledCollection<Tag>(`parent-join-tags`, [
-      { id: 1, label: `direct` },
-      { id: 2, label: `offset` },
-    ])
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ parent: parents.collection })
-        .orderBy(({ parent }) => parent.id)
-        .select(({ parent }) => {
-          const childRows = () =>
-            q
-              .from({ child: children.collection })
-              .innerJoin({ tag: tags.collection }, ({ child, tag }) =>
-                eq(tag.id, add(child.tagId, parent.offset)),
-              )
-              .where(({ child }) => eq(child.parentGroup, parent.group))
-              .select(({ child, tag }) => ({
-                id: child.id,
-                label: tag.label,
-              }))
-
-          return {
-            id: parent.id,
-            facade: include(childRows()),
-            array: toArray(childRows()),
-            materialized: materialize(childRows()),
-          }
-        }),
-    )
-
-    const project = (id: number) => {
-      const row = live.get(id)!
-      const labels = (values: Iterable<{ label: string }>) =>
-        [...values].map(({ label }) => label)
-      return {
-        facade: labels(row.facade.values()),
-        array: labels(row.array),
-        materialized: labels(row.materialized),
-      }
-    }
-
-    try {
-      await live.preload()
-      const directFacade = live.get(1)!.facade
-      const offsetFacade = live.get(2)!.facade
-      expect(directFacade).not.toBe(offsetFacade)
-      expect(project(1)).toEqual(expectedMaterializations([`direct`]))
-      expect(project(2)).toEqual(expectedMaterializations([`offset`]))
-
-      parents.write(`update`, { id: 1, group: 1, offset: 1 })
-      expect(live.get(1)!.facade).toBe(offsetFacade)
-      expect(directFacade.toArray).toEqual([])
-      expect(project(1)).toEqual(expectedMaterializations([`offset`]))
-    } finally {
-      await Promise.all([
-        live.cleanup(),
-        parents.collection.cleanup(),
-        children.collection.cleanup(),
-        tags.collection.cleanup(),
-      ])
-    }
-  })
-
   const runOptimisticChildHistory = async ({
     group,
     insertedId,
@@ -3220,6 +1599,7 @@ describe(`Collection-valued includes oracle`, () => {
     `matches optimistic child settlement histories with a fixed seed`,
     runOptimisticChildHistory,
   )
+
   oracleReplayTest(fcTest, optimisticChildProperty).prop(
     [optimisticChildArbitrary],
     oraclePropertyOptions(20, optimisticChildProperty),
diff --git a/packages/db/tests/query/includes-collection-support.ts b/packages/db/tests/query/includes-collection-support.ts
new file mode 100644
index 0000000000..ac86667a23
--- /dev/null
+++ b/packages/db/tests/query/includes-collection-support.ts
@@ -0,0 +1,79 @@
+// Shared fixtures and facade assertions for the Collection-valued include tests:
+// the parent and child rows, the controlled Collection wrapper, and the
+// observation helpers. The laws are owned by includes-collection-oracle.property.test.ts.
+import { expect } from 'vitest'
+import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
+import type { ControlledCollection } from './includes-oracle-helpers.js'
+
+export type ParentRow = {
+  id: number
+  group: number
+}
+
+export type ChildRow = {
+  id: number
+  parentGroup: number
+  value: number
+}
+
+export function createControlledCollection<T extends { id: number }>(
+  name: string,
+  initialData: ReadonlyArray<T>,
+): ControlledCollection<T> {
+  return createOracleControlledCollection(name, initialData, {
+    autoIndex: `eager`,
+    rowUpdateMode: `full`,
+  })
+}
+
+export function expectedMaterializations<T>(rows: ReadonlyArray<T>) {
+  return {
+    facade: [...rows],
+    array: [...rows],
+    materialized: [...rows],
+  }
+}
+
+export type DeleteIdentityObservation = {
+  type: string
+  key: unknown
+  id: number
+  matchesPublishedFacade: boolean
+}
+
+export function assertDeleteIdentityEvents(
+  events: ReadonlyArray<DeleteIdentityObservation>,
+  deleted: boolean,
+): void {
+  expect(events).toEqual(
+    deleted
+      ? [
+          {
+            type: `delete`,
+            key: 1,
+            id: 1,
+            matchesPublishedFacade: true,
+          },
+        ]
+      : [],
+  )
+}
+
+export function assertRetiredFacade(observation: {
+  status: string | undefined
+  rows: Array<ChildRow> | undefined
+}): void {
+  expect(observation).toEqual({ status: `ready`, rows: [] })
+}
+
+export type FacadeRootSnapshot = {
+  group: number | undefined
+  usesOldFacade: boolean
+  rows: Array<string | number>
+}
+
+export function assertFacadeRootSnapshots(
+  snapshots: Array<FacadeRootSnapshot>,
+): void {
+  expect(snapshots).toEqual([{ group: 2, usesOldFacade: false, rows: [20] }])
+}
diff --git a/packages/db/tests/query/includes-collection.test.ts b/packages/db/tests/query/includes-collection.test.ts
new file mode 100644
index 0000000000..af71b98182
--- /dev/null
+++ b/packages/db/tests/query/includes-collection.test.ts
@@ -0,0 +1,1392 @@
+// Fixed-scenario Collection-valued include tests: each runs one hand-written
+// history, or a fixed structural observation, and checks literal facade rows,
+// events, and states. These are unit tests. The generated facade laws, the
+// Map model, and the exhaustive relationship lane are owned by
+// includes-collection-oracle.property.test.ts.
+import { test as fcTest } from '@fast-check/vitest'
+import { describe, expect } from 'vitest'
+import {
+  add,
+  caseWhen,
+  count,
+  createLiveQueryCollection,
+  eq,
+  gt,
+  include,
+  lt,
+  materialize,
+  multiply,
+  sum,
+  toArray,
+} from '../../src/query/index.js'
+import { runTrace } from '../trace-runner.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import {
+  assertDeleteIdentityEvents,
+  assertFacadeRootSnapshots,
+  assertRetiredFacade,
+  createControlledCollection,
+  expectedMaterializations,
+} from './includes-collection-support.js'
+import { createCollectionDriver } from './includes-collection-driver-oracle.js'
+import type { TraceProjection } from '../trace-runner.js'
+import type { CollectionContext } from './includes-collection-driver-oracle.js'
+import type {
+  ChildRow,
+  DeleteIdentityObservation,
+  ParentRow,
+} from './includes-collection-support.js'
+
+describe(`Collection-valued includes oracle`, () => {
+  fcTest(
+    `delete identity observations reject missing and overwritten failures`,
+    () => {
+      const valid: DeleteIdentityObservation = {
+        type: `delete`,
+        key: 1,
+        id: 1,
+        matchesPublishedFacade: true,
+      }
+      assertDeleteIdentityEvents([], false)
+      assertDeleteIdentityEvents([valid], true)
+      for (const invalid of [
+        [],
+        [valid, valid],
+        [{ ...valid, matchesPublishedFacade: false }, valid],
+        [{ ...valid, type: `update` }],
+        [{ ...valid, key: `1` }],
+      ])
+        expect(() => assertDeleteIdentityEvents(invalid, true)).toThrow()
+    },
+  )
+
+  fcTest(`retirement observations reject rows retained until cleanup`, () => {
+    assertRetiredFacade({ status: `ready`, rows: [] })
+    expect(() =>
+      assertRetiredFacade({
+        status: `ready`,
+        rows: [{ id: 10, parentGroup: 1, value: 1 }],
+      }),
+    ).toThrow()
+    expect(() =>
+      assertRetiredFacade({ status: `cleaned-up`, rows: [] }),
+    ).toThrow()
+  })
+
+  fcTest(
+    `facade callback observations reject unexpected raw public keys`,
+    () => {
+      assertFacadeRootSnapshots([
+        { group: 2, usesOldFacade: false, rows: [20] },
+      ])
+      expect(() =>
+        assertFacadeRootSnapshots([
+          { group: 2, usesOldFacade: false, rows: [20, `unexpected`] },
+        ]),
+      ).toThrow()
+    },
+  )
+
+  fcTest(
+    `root application failure rolls back a prepared facade publication`,
+    async () => {
+      type NodeRow = {
+        id: number
+        kind: `parent` | `child`
+        group: number
+        value: number
+      }
+      const initialParent: NodeRow = {
+        id: 1,
+        kind: `parent`,
+        group: 1,
+        value: 1,
+      }
+      const initialChild: NodeRow = {
+        id: 10,
+        kind: `child`,
+        group: 1,
+        value: 1,
+      }
+      const nodes = createControlledCollection<NodeRow>(`rollback-nodes`, [
+        initialParent,
+        initialChild,
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ parent: nodes.collection })
+          .where(({ parent }) => eq(parent.kind, `parent`))
+          .select(({ parent }) => ({
+            id: parent.id,
+            value: parent.value,
+            children: include(
+              q
+                .from({ child: nodes.collection })
+                .where(({ child }) => eq(child.kind, `child`))
+                .where(({ child }) => eq(child.group, parent.group)),
+            ),
+          })),
+      )
+
+      await live.preload()
+      const facade = live.get(1)!.children
+      const rootPublications: Array<unknown> = []
+      const childPublications: Array<unknown> = []
+      const rootSubscription = live.subscribeChanges(
+        (batch) => rootPublications.push(...batch),
+        { includeInitialState: false },
+      )
+      const childSubscription = facade.subscribeChanges(
+        (batch) => childPublications.push(...batch),
+        { includeInitialState: false },
+      )
+      const originalGetKey = live.config.getKey
+      live.config.getKey = (row) => {
+        if (row.value === 2) throw new Error(`root key failed`)
+        return originalGetKey(row)
+      }
+
+      try {
+        expect(() =>
+          nodes.writeBatch([
+            {
+              type: `update`,
+              value: { ...initialParent, value: 2 },
+            },
+            {
+              type: `update`,
+              value: { ...initialChild, value: 2 },
+            },
+          ]),
+        ).toThrow(`root key failed`)
+        expect(live.get(1)!.value).toBe(1)
+        expect(facade.get(10)!.value).toBe(1)
+        expect(rootPublications).toEqual([])
+        expect(childPublications).toEqual([])
+
+        live.config.getKey = originalGetKey
+        nodes.writeBatch([
+          {
+            type: `update`,
+            value: { ...initialParent, value: 3 },
+          },
+          {
+            type: `update`,
+            value: { ...initialChild, value: 3 },
+          },
+        ])
+        expect(live.get(1)!.value).toBe(3)
+        expect(facade.get(10)!.value).toBe(3)
+        expect(rootPublications).toHaveLength(1)
+        expect(childPublications).toHaveLength(1)
+      } finally {
+        live.config.getKey = originalGetKey
+        rootSubscription.unsubscribe()
+        childSubscription.unsubscribe()
+        await Promise.all([live.cleanup(), nodes.collection.cleanup()])
+      }
+    },
+  )
+
+  fcTest(
+    `a retry after a failed root commit publishes the pending child change`,
+    async () => {
+      // The failed root commit keeps the parent and child changes pending.
+      // The retry carries only a further parent change, and must still
+      // publish the child change once.
+      type NodeRow = {
+        id: number
+        kind: `parent` | `child`
+        group: number
+        value: number
+      }
+      const parent: NodeRow = { id: 1, kind: `parent`, group: 1, value: 1 }
+      const child: NodeRow = { id: 10, kind: `child`, group: 1, value: 1 }
+      const nodes = createControlledCollection<NodeRow>(`retry-nodes`, [
+        parent,
+        child,
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ parent: nodes.collection })
+          .where(({ parent }) => eq(parent.kind, `parent`))
+          .select(({ parent }) => ({
+            id: parent.id,
+            value: parent.value,
+            children: include(
+              q
+                .from({ child: nodes.collection })
+                .where(({ child }) => eq(child.kind, `child`))
+                .where(({ child }) => eq(child.group, parent.group)),
+            ),
+          })),
+      )
+
+      await live.preload()
+      const facade = live.get(1)!.children
+      const childPublications: Array<unknown> = []
+      const childSubscription = facade.subscribeChanges(
+        (batch) => childPublications.push(...batch),
+        { includeInitialState: false },
+      )
+      const originalGetKey = live.config.getKey
+      live.config.getKey = (row) => {
+        if (row.value === 2) throw new Error(`root key failed`)
+        return originalGetKey(row)
+      }
+
+      try {
+        expect(() =>
+          nodes.writeBatch([
+            { type: `update`, value: { ...parent, value: 2 } },
+            { type: `update`, value: { ...child, value: 2 } },
+          ]),
+        ).toThrow(`root key failed`)
+        expect(facade.get(10)!.value).toBe(1)
+
+        live.config.getKey = originalGetKey
+        nodes.writeBatch([{ type: `update`, value: { ...parent, value: 3 } }])
+        expect(live.get(1)!.value).toBe(3)
+        expect(facade.get(10)!.value).toBe(2)
+        expect(childPublications).toHaveLength(1)
+      } finally {
+        live.config.getKey = originalGetKey
+        childSubscription.unsubscribe()
+        await Promise.all([live.cleanup(), nodes.collection.cleanup()])
+      }
+    },
+  )
+
+  fcTest(
+    `child-only changes flush the facade without republishing the parent`,
+    async () => {
+      const parents = createControlledCollection(`facade-only-parents`, [
+        { id: 1, group: 1 },
+      ])
+      const children = createControlledCollection(`facade-only-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q.from({ parent: parents.collection }).select(({ parent }) => ({
+          id: parent.id,
+          children: include(
+            q
+              .from({ child: children.collection })
+              .where(({ child }) => eq(child.parentGroup, parent.group)),
+          ),
+        })),
+      )
+
+      await live.preload()
+      const facade = live.get(1)!.children
+      const rootPublications: Array<unknown> = []
+      const childPublications: Array<unknown> = []
+      const rootSubscription = live.subscribeChanges(
+        (batch) => rootPublications.push(...batch),
+        { includeInitialState: false },
+      )
+      const childSubscription = facade.subscribeChanges(
+        (batch) => childPublications.push(...batch),
+        { includeInitialState: false },
+      )
+
+      try {
+        children.write(`update`, {
+          id: 10,
+          parentGroup: 1,
+          value: 2,
+        })
+
+        expect(rootPublications).toEqual([])
+        expect(childPublications).toHaveLength(1)
+        expect(live.get(1)!.children).toBe(facade)
+        expect(
+          [...facade.values()].map(({ id, parentGroup, value }) => ({
+            id,
+            parentGroup,
+            value,
+          })),
+        ).toEqual([{ id: 10, parentGroup: 1, value: 2 }])
+      } finally {
+        rootSubscription.unsubscribe()
+        childSubscription.unsubscribe()
+        await Promise.all([
+          live.cleanup(),
+          parents.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `outer fn.select recomputes nested values after a union branch include changes`,
+    async () => {
+      const callbackRows: Array<Record<PropertyKey, unknown>> = []
+      const messages = createControlledCollection(`fn-select-messages`, [
+        { id: 1, group: 1 },
+      ])
+      const tools = createControlledCollection(`fn-select-tools`, [
+        { id: 2, group: 2 },
+      ])
+      const children = createControlledCollection(`fn-select-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+      ])
+      const live = createLiveQueryCollection((q) => {
+        const messageRows = q
+          .from({ message: messages.collection })
+          .select(({ message }) => ({
+            kind: `message` as const,
+            id: message.id,
+            children: toArray(
+              q
+                .from({ messageChild: children.collection })
+                .where(({ messageChild }) =>
+                  eq(messageChild.parentGroup, message.group),
+                )
+                .select(({ messageChild }) => ({
+                  id: messageChild.id,
+                  value: messageChild.value,
+                })),
+            ),
+          }))
+        const toolRows = q
+          .from({ tool: tools.collection })
+          .select(({ tool }) => ({
+            kind: `tool` as const,
+            id: tool.id,
+          }))
+
+        return q.unionAll(messageRows, toolRows).fn.select((row) => {
+          callbackRows.push(row)
+          return {
+            kind: row.kind,
+            id: row.id,
+            payload: { children: row.children },
+          }
+        })
+      })
+
+      try {
+        await live.preload()
+        const message = live.toArray.find((row) => row.kind === `message`)!
+        expect(message.payload.children).toEqual([{ id: 10, value: 1 }])
+
+        children.write(`update`, {
+          id: 10,
+          parentGroup: 1,
+          value: 2,
+        })
+        expect(
+          live.toArray.find((row) => row.kind === `message`)!.payload.children,
+        ).toEqual([{ id: 10, value: 2 }])
+        expect(
+          callbackRows.flatMap((row) => Object.getOwnPropertySymbols(row)),
+        ).toEqual([])
+      } finally {
+        await Promise.all([
+          live.cleanup(),
+          messages.collection.cleanup(),
+          tools.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `outer fn.select rejects a bare union include before invoking the callback`,
+    async () => {
+      class Box {
+        constructor(readonly child: unknown) {}
+      }
+
+      const callbackChildren: Array<unknown> = []
+      const messages = createControlledCollection(`fn-select-bare-messages`, [
+        { id: 1, group: 1 },
+      ])
+      const tools = createControlledCollection(`fn-select-bare-tools`, [
+        { id: 2, group: 2 },
+      ])
+      const children = createControlledCollection(`fn-select-bare-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+        { id: 20, parentGroup: 2, value: 2 },
+      ])
+      const buildQuery = () =>
+        createLiveQueryCollection((q) => {
+          const messageRows = q
+            .from({ message: messages.collection })
+            .select(({ message }) => ({
+              kind: `message` as const,
+              id: message.id,
+              children: include(
+                q
+                  .from({ messageChild: children.collection })
+                  .where(({ messageChild }) =>
+                    eq(messageChild.parentGroup, message.group),
+                  ),
+              ),
+            }))
+          const toolRows = q
+            .from({ tool: tools.collection })
+            .select(({ tool }) => ({
+              kind: `tool` as const,
+              id: tool.id,
+            }))
+
+          return q.unionAll(messageRows, toolRows).fn.select((row) => {
+            const child = `children` in row ? row.children : undefined
+            callbackChildren.push(child)
+            return { kind: row.kind, id: row.id, box: new Box(child) }
+          })
+        })
+
+      try {
+        expect(buildQuery).toThrow(
+          `fn.select() cannot consume Collection-valued includes`,
+        )
+        expect(callbackChildren).toEqual([])
+      } finally {
+        await Promise.all([
+          messages.collection.cleanup(),
+          tools.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `fn.select rejects query values returned during include rematerialization`,
+    async () => {
+      const messages = createControlledCollection(`fn-select-reject-messages`, [
+        { id: 1, group: 1 },
+      ])
+      const tools = createControlledCollection(`fn-select-reject-tools`, [
+        { id: 2, group: 2 },
+      ])
+      const children = createControlledCollection(`fn-select-reject-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+      ])
+      const live = createLiveQueryCollection((q) => {
+        const messageRows = q
+          .from({ message: messages.collection })
+          .select(({ message }) => ({
+            kind: `message` as const,
+            id: message.id,
+            children: toArray(
+              q
+                .from({ messageChild: children.collection })
+                .where(({ messageChild }) =>
+                  eq(messageChild.parentGroup, message.group),
+                ),
+            ),
+          }))
+        const toolRows = q
+          .from({ tool: tools.collection })
+          .select(({ tool }) => ({
+            kind: `tool` as const,
+            id: tool.id,
+          }))
+
+        return q.unionAll(messageRows, toolRows).fn.select((row) => {
+          const includedChildren =
+            row.kind === `message`
+              ? (row.children as typeof row.children | null)
+              : null
+
+          return {
+            kind: row.kind,
+            id: row.id,
+            leakedQuery:
+              includedChildren?.[0]?.value === 2
+                ? q.from({ child: children.collection })
+                : null,
+          } as any
+        })
+      })
+
+      try {
+        await live.preload()
+
+        expect(() =>
+          children.write(`update`, {
+            id: 10,
+            parentGroup: 1,
+            value: 2,
+          }),
+        ).toThrow(`fn.select() cannot return a child query builder`)
+      } finally {
+        await Promise.all([
+          live.cleanup(),
+          messages.collection.cleanup(),
+          tools.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `rejects collapsed contributors that disagree by value, order, or outgoing route`,
+    async () => {
+      type CommentRow = {
+        id: number
+        userId: number
+        text: string
+      }
+      const users = createControlledCollection(`congruence-users`, [
+        { id: 1, group: 1 },
+      ])
+
+      const expectIncrementalRejection = async (
+        mode: `value` | `order`,
+      ): Promise<void> => {
+        const comments = createControlledCollection<CommentRow>(
+          `congruence-${mode}-comments`,
+          [{ id: 1, userId: 1, text: `first` }],
+        )
+        const live = createLiveQueryCollection({
+          query: (q) => {
+            const joined = q
+              .from({ comment: comments.collection })
+              .join({ user: users.collection }, ({ comment, user }) =>
+                eq(comment.userId, user.id),
+              )
+            return mode === `value`
+              ? joined.select(({ comment }) => ({
+                  publicId: comment.userId,
+                  visible: comment.text,
+                }))
+              : joined
+                  .orderBy(({ comment }) => comment.id)
+                  .select(({ comment }) => ({
+                    publicId: comment.userId,
+                    visible: `same`,
+                  }))
+          },
+          getKey: (row) => row.publicId,
+        })
+
+        try {
+          await live.preload()
+          expect(() =>
+            comments.write(`insert`, {
+              id: 2,
+              userId: 1,
+              text: mode === `value` ? `second` : `ignored`,
+            }),
+          ).toThrow(`not congruent`)
+        } finally {
+          await live.cleanup()
+          await comments.collection.cleanup()
+        }
+      }
+
+      await expectIncrementalRejection(`value`)
+      await expectIncrementalRejection(`order`)
+
+      const parents = createControlledCollection(`congruence-parents`, [
+        { id: 1, group: 1 },
+      ])
+      const children = createControlledCollection<ChildRow>(
+        `congruence-children`,
+        [],
+      )
+      const routed = createLiveQueryCollection({
+        query: (q) =>
+          q.from({ parent: parents.collection }).select(({ parent }) => ({
+            publicId: 1,
+            visible: `same`,
+            children: toArray(
+              q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.parentGroup, parent.group)),
+            ),
+          })),
+        getKey: (row) => row.publicId,
+      })
+
+      try {
+        await routed.preload()
+        expect(() => parents.write(`insert`, { id: 2, group: 2 })).toThrow(
+          `not congruent`,
+        )
+      } finally {
+        await routed.cleanup()
+        await Promise.all([
+          parents.collection.cleanup(),
+          children.collection.cleanup(),
+          users.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `a holder's cleanup during root publication throws and keeps the facade`,
+    async () => {
+      type NodeRow = {
+        id: number
+        kind: `parent` | `child`
+        group: number
+        value: number
+      }
+      const nodes = createControlledCollection<NodeRow>(`publication-cleanup`, [
+        { id: 1, kind: `parent`, group: 1, value: 1 },
+        { id: 10, kind: `child`, group: 1, value: 1 },
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ parent: nodes.collection })
+          .where(({ parent }) => eq(parent.kind, `parent`))
+          .select(({ parent }) => ({
+            id: parent.id,
+            value: parent.value,
+            children: include(
+              q
+                .from({ child: nodes.collection })
+                .where(({ child }) => eq(child.kind, `child`))
+                .where(({ child }) => eq(child.group, parent.group)),
+            ),
+          })),
+      )
+
+      await live.preload()
+      const facade = live.get(1)!.children
+      const rootSnapshots: Array<Array<number>> = []
+      const facadeSnapshots: Array<Array<number>> = []
+      // The live query owns its child collections, so a holder's cleanup
+      // throws, even inside the root's publication.
+      const cleanupErrors: Array<unknown> = []
+      const rootSubscription = live.subscribeChanges(
+        () => {
+          rootSnapshots.push(facade.toArray.map(({ value }) => value))
+          facade.cleanup().catch((error: unknown) => cleanupErrors.push(error))
+        },
+        { includeInitialState: false },
+      )
+      const facadeSubscription = facade.subscribeChanges(
+        () => facadeSnapshots.push(facade.toArray.map(({ value }) => value)),
+        { includeInitialState: false },
+      )
+
+      try {
+        nodes.writeBatch([
+          {
+            type: `update`,
+            value: { id: 1, kind: `parent`, group: 1, value: 2 },
+          },
+          {
+            type: `update`,
+            value: { id: 10, kind: `child`, group: 1, value: 2 },
+          },
+        ])
+        await Promise.resolve()
+        expect(rootSnapshots).toEqual([[2]])
+        expect(cleanupErrors).toHaveLength(1)
+        expect(String(cleanupErrors[0])).toMatch(
+          /cannot be cleaned up directly/,
+        )
+        expect(facadeSnapshots).toEqual([[2]])
+        expect(facade.status).toBe(`ready`)
+        expect(facade.toArray.map(({ value }) => value)).toEqual([2])
+      } finally {
+        rootSubscription.unsubscribe()
+        facadeSubscription.unsubscribe()
+        await Promise.all([live.cleanup(), nodes.collection.cleanup()])
+      }
+    },
+  )
+
+  fcTest(
+    `live query cleanup during root publication suppresses the prepared facade callback`,
+    async () => {
+      type NodeRow = {
+        id: number
+        kind: `parent` | `child`
+        group: number
+        value: number
+      }
+      const nodes = createControlledCollection<NodeRow>(
+        `publication-live-cleanup`,
+        [
+          { id: 1, kind: `parent`, group: 1, value: 1 },
+          { id: 10, kind: `child`, group: 1, value: 1 },
+        ],
+      )
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ parent: nodes.collection })
+          .where(({ parent }) => eq(parent.kind, `parent`))
+          .select(({ parent }) => ({
+            id: parent.id,
+            value: parent.value,
+            children: include(
+              q
+                .from({ child: nodes.collection })
+                .where(({ child }) => eq(child.kind, `child`))
+                .where(({ child }) => eq(child.group, parent.group)),
+            ),
+          })),
+      )
+
+      await live.preload()
+      const facade = live.get(1)!.children
+      const rootSnapshots: Array<Array<number>> = []
+      const facadeSnapshots: Array<Array<number>> = []
+      // The owner ends its child collections while the root publishes. The
+      // facade's prepared publication must not reach its subscribers after
+      // that.
+      let cleanup: Promise<void> | undefined
+      const rootSubscription = live.subscribeChanges(
+        () => {
+          rootSnapshots.push(facade.toArray.map(({ value }) => value))
+          cleanup = live.cleanup()
+        },
+        { includeInitialState: false },
+      )
+      const facadeSubscription = facade.subscribeChanges(
+        () => facadeSnapshots.push(facade.toArray.map(({ value }) => value)),
+        { includeInitialState: false },
+      )
+
+      try {
+        nodes.writeBatch([
+          {
+            type: `update`,
+            value: { id: 1, kind: `parent`, group: 1, value: 2 },
+          },
+          {
+            type: `update`,
+            value: { id: 10, kind: `child`, group: 1, value: 2 },
+          },
+        ])
+        await cleanup
+
+        expect(rootSnapshots).toEqual([[2]])
+        expect(facadeSnapshots).toEqual([])
+        expect(facade.status).toBe(`cleaned-up`)
+        expect(facade.toArray).toEqual([])
+      } finally {
+        rootSubscription.unsubscribe()
+        facadeSubscription.unsubscribe()
+        await nodes.collection.cleanup()
+      }
+    },
+  )
+
+  fcTest(`a matched null singleton remains null`, async () => {
+    type NullableChild = { id: number; parentGroup: number; value: null }
+    const parents = createControlledCollection(`nullable-oracle-parents`, [
+      { id: 1, group: 1 },
+    ])
+    const children = createControlledCollection<NullableChild>(
+      `nullable-oracle-children`,
+      [{ id: 10, parentGroup: 1, value: null }],
+    )
+    const live = createLiveQueryCollection((q) =>
+      q.from({ parent: parents.collection }).select(({ parent }) => ({
+        id: parent.id,
+        value: materialize(
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentGroup, parent.group))
+            .select(({ child }) => child.value)
+            .findOne(),
+        ),
+      })),
+    )
+
+    try {
+      await live.preload()
+      expect(live.get(1)!.value).toBeNull()
+    } finally {
+      await Promise.all([
+        live.cleanup(),
+        parents.collection.cleanup(),
+        children.collection.cleanup(),
+      ])
+    }
+  })
+
+  fcTest(
+    `held-facade cleanup retains the primary and both cleanup failures`,
+    async () => {
+      const primary = new Error(`facade publication mismatch`)
+      const firstCleanup = new Error(`facade unsubscribe failed`)
+      const secondCleanup = new Error(`source cleanup failed`)
+      const released: Array<string> = []
+      let failure: unknown
+      try {
+        await withHistoryCleanup(
+          async () => {
+            throw primary
+          },
+          () => [
+            () => {
+              released.push(`facade`)
+              throw firstCleanup
+            },
+            () => {
+              released.push(`source`)
+              throw secondCleanup
+            },
+            () => {
+              released.push(`parent`)
+            },
+          ],
+        )
+      } catch (error) {
+        failure = error
+      }
+      expect(released).toEqual([`facade`, `source`, `parent`])
+      expect(failure).toBeInstanceOf(AggregateError)
+      expect((failure as AggregateError).cause).toBe(primary)
+      expect((failure as AggregateError).errors).toEqual([
+        primary,
+        firstCleanup,
+        secondCleanup,
+      ])
+    },
+  )
+
+  fcTest(
+    `reconstructs nested conditional includes through guard transitions`,
+    async () => {
+      type GuardedParent = ParentRow & { active: boolean }
+      const parents = createControlledCollection<GuardedParent>(
+        `guarded-parents`,
+        [{ id: 1, group: 1, active: true }],
+      )
+      const children = createControlledCollection(`guarded-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q.from({ parent: parents.collection }).select(({ parent }) => {
+          const childRows = () =>
+            q
+              .from({ child: children.collection })
+              .where(({ child }) => eq(child.parentGroup, parent.group))
+              .orderBy(({ child }) => child.id)
+              .select(({ child }) => ({
+                id: child.id,
+                parentGroup: child.parentGroup,
+                value: child.value,
+              }))
+
+          return {
+            id: parent.id,
+            profile: caseWhen(
+              eq(parent.active, true),
+              {
+                kind: `active` as const,
+                facade: include(childRows()),
+                array: toArray(childRows()),
+                materialized: materialize(childRows()),
+              },
+              { kind: `inactive` as const },
+            ),
+          }
+        }),
+      )
+
+      const project = () => {
+        const profile = live.get(1)!.profile
+        if (profile.kind === `inactive`) return profile
+        const rows = (values: Iterable<ChildRow>) =>
+          [...values].map(({ id, value }) => ({ id, value }))
+        return {
+          kind: profile.kind,
+          facade: rows(profile.facade.values()),
+          array: rows(profile.array),
+          materialized: rows(profile.materialized),
+        }
+      }
+
+      try {
+        await live.preload()
+        const initialProfile = live.get(1)!.profile
+        if (initialProfile.kind === `inactive`) {
+          throw new Error(
+            `Expected the initial conditional branch to be active`,
+          )
+        }
+        const initialFacade = initialProfile.facade
+        expect(project()).toEqual({
+          kind: `active`,
+          ...expectedMaterializations([{ id: 10, value: 1 }]),
+        })
+
+        parents.write(`update`, { id: 1, group: 1, active: false })
+        expect(project()).toEqual({ kind: `inactive` })
+        expect(initialFacade.toArray).toEqual([])
+        expect(initialFacade.status).toBe(`ready`)
+        children.write(`insert`, { id: 20, parentGroup: 1, value: 2 })
+        expect(project()).toEqual({ kind: `inactive` })
+
+        parents.write(`update`, { id: 1, group: 1, active: true })
+        const reactivatedProfile = live.get(1)!.profile
+        if (reactivatedProfile.kind === `inactive`) {
+          throw new Error(`Expected the conditional branch to reactivate`)
+        }
+        expect(reactivatedProfile.facade).not.toBe(initialFacade)
+        expect(project()).toEqual({
+          kind: `active`,
+          ...expectedMaterializations([
+            { id: 10, value: 1 },
+            { id: 20, value: 2 },
+          ]),
+        })
+      } finally {
+        await Promise.all([
+          live.cleanup(),
+          parents.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `matches recomputation for correlated aggregate child relations`,
+    async () => {
+      const parents = createControlledCollection(`aggregate-parents`, [
+        { id: 1, group: 1, factor: 1 },
+        { id: 2, group: 1, factor: -1 },
+        { id: 3, group: 2, factor: 2 },
+      ])
+      const children = createControlledCollection(`aggregate-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+        { id: 20, parentGroup: 1, value: 2 },
+        { id: 30, parentGroup: 2, value: 5 },
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ parent: parents.collection })
+          .orderBy(({ parent }) => parent.id)
+          .select(({ parent }) => {
+            const summaries = () =>
+              q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.parentGroup, parent.group))
+                .groupBy(({ child }) => child.parentGroup)
+                .select(({ child }) => ({
+                  parentGroup: child.parentGroup,
+                  count: count(child.id),
+                  total: sum(multiply(child.value, parent.factor)),
+                }))
+            const total = () =>
+              q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.parentGroup, parent.group))
+                .select(({ child }) => ({
+                  count: count(child.id),
+                  total: sum(multiply(child.value, parent.factor)),
+                }))
+
+            return {
+              id: parent.id,
+              facade: include(summaries()),
+              array: toArray(summaries()),
+              materialized: materialize(summaries()),
+              implicit: materialize(total()),
+            }
+          }),
+      )
+
+      type Summary = { parentGroup: number; count: number; total: number }
+      const project = () =>
+        live.toArray.map((row) => {
+          const clean = (values: Iterable<Summary>) =>
+            [...values].map(({ parentGroup, count: size, total }) => ({
+              parentGroup,
+              count: size,
+              total,
+            }))
+          return {
+            id: row.id,
+            facade: clean(row.facade.values()),
+            array: clean(row.array),
+            materialized: clean(row.materialized),
+            implicit: row.implicit.map(({ count: size, total }) => ({
+              count: size,
+              total,
+            })),
+          }
+        })
+
+      const expected = (groupOneTotal: number, groupOneCount: number) => [
+        {
+          id: 1,
+          ...expectedMaterializations([
+            { parentGroup: 1, count: groupOneCount, total: groupOneTotal },
+          ]),
+          implicit: [{ count: groupOneCount, total: groupOneTotal }],
+        },
+        {
+          id: 2,
+          ...expectedMaterializations([
+            {
+              parentGroup: 1,
+              count: groupOneCount,
+              total: -groupOneTotal,
+            },
+          ]),
+          implicit: [{ count: groupOneCount, total: -groupOneTotal }],
+        },
+        {
+          id: 3,
+          ...expectedMaterializations([
+            { parentGroup: 2, count: 1, total: 10 },
+          ]),
+          implicit: [{ count: 1, total: 10 }],
+        },
+      ]
+
+      try {
+        await live.preload()
+        expect(project()).toEqual(expected(3, 2))
+
+        children.write(`update`, { id: 20, parentGroup: 1, value: 7 })
+        expect(project()).toEqual(expected(8, 2))
+
+        children.write(`delete`, { id: 10, parentGroup: 1, value: 1 })
+        expect(project()).toEqual(expected(7, 1))
+      } finally {
+        await Promise.all([
+          live.cleanup(),
+          parents.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(
+    `evaluates correlated having clauses with parent context`,
+    async () => {
+      type HavingParent = ParentRow & { threshold: number }
+      const parents = createControlledCollection<HavingParent>(
+        `having-parents`,
+        [
+          { id: 1, group: 1, threshold: 1 },
+          { id: 2, group: 1, threshold: 3 },
+        ],
+      )
+      const children = createControlledCollection(`having-children`, [
+        { id: 10, parentGroup: 1, value: 1 },
+        { id: 20, parentGroup: 1, value: 2 },
+      ])
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ parent: parents.collection })
+          .orderBy(({ parent }) => parent.id)
+          .select(({ parent }) => {
+            const summaries = () =>
+              q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.parentGroup, parent.group))
+                .groupBy(({ child }) => child.parentGroup)
+                .having(({ child }) => gt(count(child.id), parent.threshold))
+                .select(({ child }) => ({ count: count(child.id) }))
+
+            return {
+              id: parent.id,
+              facade: include(summaries()),
+              array: toArray(summaries()),
+              materialized: materialize(summaries()),
+            }
+          }),
+      )
+
+      const project = () =>
+        live.toArray.map((row) => {
+          const counts = (values: Iterable<{ count: number }>) =>
+            [...values].map(({ count: size }) => size)
+          return {
+            id: row.id,
+            facade: counts(row.facade.values()),
+            array: counts(row.array),
+            materialized: counts(row.materialized),
+          }
+        })
+
+      try {
+        await live.preload()
+        expect(project()).toEqual([
+          { id: 1, ...expectedMaterializations([2]) },
+          { id: 2, ...expectedMaterializations([]) },
+        ])
+
+        // The count equals this threshold, so `gt` must still exclude it.
+        parents.write(`update`, { id: 2, group: 1, threshold: 2 })
+        expect(project()).toEqual([
+          { id: 1, ...expectedMaterializations([2]) },
+          { id: 2, ...expectedMaterializations([]) },
+        ])
+
+        parents.write(`update`, { id: 2, group: 1, threshold: 1 })
+        expect(project()).toEqual([
+          { id: 1, ...expectedMaterializations([2]) },
+          { id: 2, ...expectedMaterializations([2]) },
+        ])
+      } finally {
+        await Promise.all([
+          live.cleanup(),
+          parents.collection.cleanup(),
+          children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(`routes changes to non-key parent filter inputs`, async () => {
+    type FilterParent = ParentRow & { threshold: number }
+    const parents = createControlledCollection<FilterParent>(
+      `parent-filter-input-parents`,
+      [{ id: 1, group: 1, threshold: 2 }],
+    )
+    const children = createControlledCollection(
+      `parent-filter-input-children`,
+      [
+        { id: 10, parentGroup: 1, value: 1 },
+        { id: 20, parentGroup: 1, value: 3 },
+      ],
+    )
+    const live = createLiveQueryCollection((q) =>
+      q.from({ parent: parents.collection }).select(({ parent }) => {
+        const childRows = () =>
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentGroup, parent.group))
+            .where(({ child }) => lt(child.value, parent.threshold))
+            .orderBy(({ child }) => child.id)
+            .select(({ child }) => ({ id: child.id, value: child.value }))
+
+        return {
+          id: parent.id,
+          facade: include(childRows()),
+          array: toArray(childRows()),
+          materialized: materialize(childRows()),
+        }
+      }),
+    )
+
+    const project = () => {
+      const row = live.get(1)!
+      const ids = (values: Iterable<{ id: number }>) =>
+        [...values].map(({ id }) => id)
+      return {
+        facade: ids(row.facade.values()),
+        array: ids(row.array),
+        materialized: ids(row.materialized),
+      }
+    }
+
+    try {
+      await live.preload()
+      expect(project()).toEqual(expectedMaterializations([10]))
+
+      // Both equality boundaries distinguish `<` from an inclusive filter.
+      parents.write(`update`, { id: 1, group: 1, threshold: 1 })
+      expect(project()).toEqual(expectedMaterializations([]))
+
+      parents.write(`update`, { id: 1, group: 1, threshold: 3 })
+      expect(project()).toEqual(expectedMaterializations([10]))
+
+      parents.write(`update`, { id: 1, group: 1, threshold: 4 })
+      expect(project()).toEqual(expectedMaterializations([10, 20]))
+
+      parents.write(`update`, { id: 1, group: 1, threshold: 0 })
+      expect(project()).toEqual(expectedMaterializations([]))
+    } finally {
+      await Promise.all([
+        live.cleanup(),
+        parents.collection.cleanup(),
+        children.collection.cleanup(),
+      ])
+    }
+  })
+
+  fcTest(`routes changes to parent-dependent child ordering`, async () => {
+    type OrderingParent = ParentRow & { direction: number }
+    const parents = createControlledCollection<OrderingParent>(
+      `parent-order-input-parents`,
+      [
+        { id: 1, group: 1, direction: 1 },
+        { id: 2, group: 1, direction: -1 },
+      ],
+    )
+    const children = createControlledCollection(`parent-order-input-children`, [
+      { id: 10, parentGroup: 1, value: 1 },
+      { id: 20, parentGroup: 1, value: 2 },
+    ])
+    const live = createLiveQueryCollection((q) =>
+      q.from({ parent: parents.collection }).select(({ parent }) => {
+        const childRows = () =>
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentGroup, parent.group))
+            .orderBy(({ child }) => multiply(child.value, parent.direction))
+            .select(({ child }) => ({ id: child.id, value: child.value }))
+
+        return {
+          id: parent.id,
+          facade: include(childRows()),
+          array: toArray(childRows()),
+          materialized: materialize(childRows()),
+        }
+      }),
+    )
+
+    const project = (id: number) => {
+      const row = live.get(id)!
+      const rows = (values: Iterable<{ id: number; value: number }>) =>
+        [...values].map(({ id: childId, value }) => ({ id: childId, value }))
+      return {
+        facade: rows(row.facade.values()),
+        array: rows(row.array),
+        materialized: rows(row.materialized),
+      }
+    }
+
+    try {
+      await live.preload()
+      const ascendingFacade = live.get(1)!.facade
+      const descendingFacade = live.get(2)!.facade
+      expect(project(1)).toEqual(
+        expectedMaterializations([
+          { id: 10, value: 1 },
+          { id: 20, value: 2 },
+        ]),
+      )
+      expect(project(2)).toEqual(
+        expectedMaterializations([
+          { id: 20, value: 2 },
+          { id: 10, value: 1 },
+        ]),
+      )
+      expect(ascendingFacade).not.toBe(descendingFacade)
+
+      parents.write(`update`, { id: 1, group: 1, direction: -1 })
+      expect(live.get(1)!.facade).toBe(descendingFacade)
+      expect(ascendingFacade.toArray).toEqual([])
+      expect(project(1)).toEqual(
+        expectedMaterializations([
+          { id: 20, value: 2 },
+          { id: 10, value: 1 },
+        ]),
+      )
+    } finally {
+      await Promise.all([
+        live.cleanup(),
+        parents.collection.cleanup(),
+        children.collection.cleanup(),
+      ])
+    }
+  })
+
+  fcTest(`routes changes to parent-dependent child joins`, async () => {
+    type JoinParent = ParentRow & { offset: number }
+    type JoinedChild = ChildRow & { tagId: number }
+    type Tag = { id: number; label: string }
+    const parents = createControlledCollection<JoinParent>(
+      `parent-join-parents`,
+      [
+        { id: 1, group: 1, offset: 0 },
+        { id: 2, group: 1, offset: 1 },
+      ],
+    )
+    const children = createControlledCollection<JoinedChild>(
+      `parent-join-children`,
+      [{ id: 10, parentGroup: 1, value: 1, tagId: 1 }],
+    )
+    const tags = createControlledCollection<Tag>(`parent-join-tags`, [
+      { id: 1, label: `direct` },
+      { id: 2, label: `offset` },
+    ])
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ parent: parents.collection })
+        .orderBy(({ parent }) => parent.id)
+        .select(({ parent }) => {
+          const childRows = () =>
+            q
+              .from({ child: children.collection })
+              .innerJoin({ tag: tags.collection }, ({ child, tag }) =>
+                eq(tag.id, add(child.tagId, parent.offset)),
+              )
+              .where(({ child }) => eq(child.parentGroup, parent.group))
+              .select(({ child, tag }) => ({
+                id: child.id,
+                label: tag.label,
+              }))
+
+          return {
+            id: parent.id,
+            facade: include(childRows()),
+            array: toArray(childRows()),
+            materialized: materialize(childRows()),
+          }
+        }),
+    )
+
+    const project = (id: number) => {
+      const row = live.get(id)!
+      const labels = (values: Iterable<{ label: string }>) =>
+        [...values].map(({ label }) => label)
+      return {
+        facade: labels(row.facade.values()),
+        array: labels(row.array),
+        materialized: labels(row.materialized),
+      }
+    }
+
+    try {
+      await live.preload()
+      const directFacade = live.get(1)!.facade
+      const offsetFacade = live.get(2)!.facade
+      expect(directFacade).not.toBe(offsetFacade)
+      expect(project(1)).toEqual(expectedMaterializations([`direct`]))
+      expect(project(2)).toEqual(expectedMaterializations([`offset`]))
+
+      parents.write(`update`, { id: 1, group: 1, offset: 1 })
+      expect(live.get(1)!.facade).toBe(offsetFacade)
+      expect(directFacade.toArray).toEqual([])
+      expect(project(1)).toEqual(expectedMaterializations([`offset`]))
+    } finally {
+      await Promise.all([
+        live.cleanup(),
+        parents.collection.cleanup(),
+        children.collection.cleanup(),
+        tags.collection.cleanup(),
+      ])
+    }
+  })
+
+  fcTest(`facade public keys survive row cloning`, async () => {
+    const driver = createCollectionDriver(
+      [{ id: 1, group: 1 }],
+      [{ id: 10, parentGroup: 1, value: 1 }],
+    )
+    const projection: TraceProjection<
+      CollectionContext,
+      { clonedKey: unknown },
+      { clonedKey: number }
+    > = {
+      observe(context) {
+        const facade = context.live.get(1)!.children
+        const row = facade.get(10)!
+        return { clonedKey: facade.getKeyFromItem({ ...row }) }
+      },
+      recompute: () => ({ clonedKey: 10 }),
+      assertEqual(observed, expected) {
+        expect(observed).toEqual(expected)
+        return undefined
+      },
+    }
+
+    await runTrace({ steps: [], driver, projection })
+  })
+})
diff --git a/packages/db/tests/query/includes-context-transport-helpers.ts b/packages/db/tests/query/includes-context-transport-helpers.ts
new file mode 100644
index 0000000000..7d90dcc365
--- /dev/null
+++ b/packages/db/tests/query/includes-context-transport-helpers.ts
@@ -0,0 +1,162 @@
+/**
+ * Shared harness for the correlated include route-context transport tests.
+ * It creates controlled sources, runs a scenario with its cleanup, and compares
+ * the public forms of a materialized row. It states no expected value; the
+ * models and the grammar that check them are in
+ * `includes-context-transport-oracle.test.ts`.
+ */
+
+import { expect } from 'vitest'
+import { include, materialize, toArray } from '../../src/query/index.js'
+import { createControlledCollection } from './includes-oracle-helpers.js'
+import type { Context, QueryBuilder } from '../../src/query/builder/index.js'
+import type { ControlledCollection } from './includes-oracle-helpers.js'
+
+export type Cleanable = { cleanup: () => Promise<void> }
+
+export type MaterializationForm = (typeof materializationForms)[number]
+
+export type MaterializedForms<T> = {
+  collection: { values: () => Iterable<T> }
+  array: Iterable<T>
+  materialized: Iterable<T>
+}
+
+export const materializationForms = [
+  `collection`,
+  `array`,
+  `materialized`,
+] as const
+async function cleanup(
+  live: Cleanable,
+  sources: Array<{ collection: Cleanable }>,
+): Promise<Array<Error>> {
+  const failures: Array<Error> = []
+  try {
+    await live.cleanup()
+  } catch (error) {
+    failures.push(
+      new Error(`live-query Collection cleanup failed`, { cause: error }),
+    )
+  }
+  const sourceResults = await Promise.allSettled(
+    sources.map(({ collection }) =>
+      Promise.resolve().then(() => collection.cleanup()),
+    ),
+  )
+  for (const [index, result] of sourceResults.entries()) {
+    if (result.status === `rejected`) {
+      failures.push(
+        new Error(`source Collection ${index} cleanup failed`, {
+          cause: result.reason,
+        }),
+      )
+    }
+  }
+  return failures
+}
+
+export async function runWithCleanup(
+  live: Cleanable,
+  sources: Array<{ collection: Cleanable }>,
+  run: () => Promise<void>,
+): Promise<void> {
+  const outcome = await Promise.resolve()
+    .then(run)
+    .then(
+      () => ({ ok: true }) as const,
+      (error: unknown) => ({ ok: false, error }) as const,
+    )
+  const cleanupFailures = await cleanup(live, sources)
+  if (!outcome.ok) {
+    if (cleanupFailures.length > 0) {
+      throw new AggregateError(cleanupFailures, `Oracle cleanup also failed`, {
+        cause: outcome.error,
+      })
+    }
+    throw outcome.error
+  }
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(cleanupFailures, `Oracle cleanup failed`)
+  }
+}
+
+export function createGrammarCollection<T extends { id: number }>(
+  name: string,
+  rows: ReadonlyArray<T>,
+): ControlledCollection<T> {
+  return createControlledCollection(name, rows, { autoIndex: `eager` })
+}
+
+export function includeInEveryForm<TContext extends Context>(
+  query: QueryBuilder<TContext>,
+) {
+  return {
+    collection: include(query),
+    array: toArray(query),
+    materialized: materialize(query),
+  }
+}
+
+// Read each public form through the same projection. This keeps normalization
+// outside the production query while preserving exact row counts and values.
+export function readEveryForm<T, U>(
+  forms: MaterializedForms<T>,
+  project: (rows: Iterable<T>) => U,
+): Record<MaterializationForm, U> {
+  return {
+    collection: project(forms.collection.values()),
+    array: project(forms.array),
+    materialized: project(forms.materialized),
+  }
+}
+
+export function expectEveryForm<T, U>(
+  forms: MaterializedForms<T>,
+  project: (rows: Iterable<T>) => U,
+  expected: U,
+): void {
+  expect(readEveryForm(forms, project)).toEqual(
+    Object.fromEntries(materializationForms.map((form) => [form, expected])),
+  )
+}
+
+export function ids(rows: Iterable<{ id: number }>): Array<number> {
+  return [...rows].map((row) => row.id)
+}
+
+// Public-surface cells deliberately retain callback values and opaque wrappers.
+// A cleaner that only fixes the final array will still fail these observations.
+export function expectNoPrivateSymbolsDeep(
+  value: unknown,
+  allowedSymbols: ReadonlySet<symbol>,
+  seen = new WeakSet<object>(),
+): void {
+  if (value == null || typeof value !== `object` || seen.has(value)) return
+  seen.add(value)
+
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key === `symbol`) {
+      expect(
+        allowedSymbols.has(key),
+        `unexpected private symbol in public query output`,
+      ).toBe(true)
+    }
+    expectNoPrivateSymbolsDeep(
+      (value as Record<PropertyKey, unknown>)[key],
+      allowedSymbols,
+      seen,
+    )
+  }
+
+  if (value instanceof Map) {
+    for (const [key, entry] of value) {
+      expectNoPrivateSymbolsDeep(key, allowedSymbols, seen)
+      expectNoPrivateSymbolsDeep(entry, allowedSymbols, seen)
+    }
+  } else if (value instanceof Set) {
+    for (const entry of value) {
+      expectNoPrivateSymbolsDeep(entry, allowedSymbols, seen)
+    }
+  }
+}
diff --git a/packages/db/tests/query/includes-context-transport-oracle.test.ts b/packages/db/tests/query/includes-context-transport-oracle.test.ts
index 29b8578283..acb28abde3 100644
--- a/packages/db/tests/query/includes-context-transport-oracle.test.ts
+++ b/packages/db/tests/query/includes-context-transport-oracle.test.ts
@@ -1,31 +1,36 @@
 import { describe, expect, test } from 'vitest'
+import { declareOracle } from '../oracle-declaration.js'
 import {
   add,
   and,
-  caseWhen,
   coalesce,
   count,
   createLiveQueryCollection,
   eq,
   groupKeys,
   gt,
-  include,
   lt,
   lte,
-  materialize,
   multiply,
   sum,
-  toArray,
 } from '../../src/query/index.js'
 import {
-  attachRouteMetadata,
-  stripInternalRouteMetadata,
-} from '../../src/query/compiler/route-metadata.js'
-import { createControlledCollection } from './includes-oracle-helpers.js'
+  createGrammarCollection,
+  expectEveryForm,
+  expectNoPrivateSymbolsDeep,
+  ids,
+  includeInEveryForm,
+  materializationForms,
+  readEveryForm,
+  runWithCleanup,
+} from './includes-context-transport-helpers.js'
 import type { RefLeaf } from '../../src/query/builder/types.js'
 import type { Collection } from '../../src/collection/index.js'
-import type { Context, QueryBuilder } from '../../src/query/builder/index.js'
 import type { ControlledCollection } from './includes-oracle-helpers.js'
+import type {
+  MaterializationForm,
+  MaterializedForms,
+} from './includes-context-transport-helpers.js'
 
 /**
  * # How can a parent value cross a nested query without becoming user data?
@@ -60,213 +65,22 @@ import type { ControlledCollection } from './includes-oracle-helpers.js'
  * oracle owns demand lifetime. The publication oracle owns coherent callbacks.
  * The Collection oracle owns facade identity and retirement.
  *
- * The focused path witnesses below model a property path as its sequence of
- * segments: a parent field named `a.b` and a nested field `a.b` are distinct
- * values, as are a dotted ancestor alias and two ordinary path segments. Their
- * public checks cover initial materialization and source updates. The include
- * result-path witness also checks that two different child routes stay separate.
- * These fixed fixtures do not claim arbitrary path segments or materialization
- * forms beyond the displayed `toArray` queries.
+ * The fixed path witnesses, which check dotted and nested parent fields and
+ * distinct include result paths, are unit tests in
+ * `includes-context-transport.test.ts`. They model a property path as its
+ * sequence of segments: a parent field named `a.b` and a nested field `a.b`
+ * are distinct values, as are a dotted ancestor alias and two ordinary path
+ * segments. These fixed fixtures do not claim arbitrary path segments or
+ * materialization forms beyond the displayed `toArray` queries.
  */
 
-type Cleanable = { cleanup: () => Promise<void> }
-
-test('carries dotted and nested parent fields through one include', async () => {
-  const parents = createGrammarCollection('path-parent', [
-    { id: 1, 'a.b': 11, a: { b: 22 } },
-  ])
-  const children = createGrammarCollection('path-child', [
-    { id: 10, parentId: 1 },
-  ])
-  const live = createLiveQueryCollection((q) =>
-    q.from({ parent: parents.collection }).select(({ parent }) => ({
-      id: parent.id,
-      children: toArray(
-        q
-          .from({ child: children.collection })
-          .where(({ child }) => eq(child.parentId, parent.id))
-          .select(({ child }) => ({
-            id: child.id,
-            flat: parent['a.b'],
-            nested: parent.a.b,
-          })),
-      ),
-    })),
-  )
-  await runWithCleanup(live, [parents, children], async () => {
-    await live.preload()
-    expect(live.get(1)?.children).toEqual([{ id: 10, flat: 11, nested: 22 }])
-
-    parents.write(`update`, { id: 1, 'a.b': 33, a: { b: 44 } })
-    expect(live.get(1)?.children).toEqual([{ id: 10, flat: 33, nested: 44 }])
-  })
-})
-
-test('carries both parent paths through nested includes', async () => {
-  const parents = createGrammarCollection('nested-path-parent', [
-    { id: 1, 'a.b': 11, a: { b: 22 } },
-  ])
-  const children = createGrammarCollection('nested-path-child', [
-    { id: 10, parentId: 1 },
-  ])
-  const grandchildren = createGrammarCollection('nested-path-grandchild', [
-    { id: 100, childId: 10 },
-  ])
-  const live = createLiveQueryCollection((q) =>
-    q.from({ parent: parents.collection }).select(({ parent }) => ({
-      id: parent.id,
-      children: toArray(
-        q
-          .from({ child: children.collection })
-          .where(({ child }) => eq(child.parentId, parent.id))
-          .select(({ child }) => ({
-            id: child.id,
-            grandchildren: toArray(
-              q
-                .from({ grandchild: grandchildren.collection })
-                .where(({ grandchild }) => eq(grandchild.childId, child.id))
-                .select(({ grandchild }) => ({
-                  id: grandchild.id,
-                  flat: parent['a.b'],
-                  nested: parent.a.b,
-                })),
-            ),
-          })),
-      ),
-    })),
-  )
-  await runWithCleanup(live, [parents, children, grandchildren], async () => {
-    await live.preload()
-    expect(live.toArray).toHaveLength(1)
-    expect(live.toArray[0]?.children).toEqual([
-      { id: 10, grandchildren: [{ id: 100, flat: 11, nested: 22 }] },
-    ])
-  })
-})
-
-test('keeps dotted ancestor aliases distinct in nested includes', async () => {
-  const dotted = createGrammarCollection('dotted-alias-parent', [
-    { id: 1, x: 11 },
-  ])
-  const nested = createGrammarCollection('nested-alias-parent', [
-    { id: 1, q: { x: 22 } },
-  ])
-  const children = createGrammarCollection('alias-path-child', [
-    { id: 10, parentId: 1 },
-  ])
-  const grandchildren = createGrammarCollection('alias-path-grandchild', [
-    { id: 100, childId: 10 },
-  ])
-  const live = createLiveQueryCollection((q) =>
-    q
-      .from({ 'p.q': dotted.collection })
-      .innerJoin({ p: nested.collection }, ({ 'p.q': left, p }) =>
-        eq(left.id, p.id),
-      )
-      .select(({ 'p.q': left, p }) => ({
-        id: left.id,
-        children: toArray(
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentId, left.id))
-            .select(({ child }) => ({
-              id: child.id,
-              grandchildren: toArray(
-                q
-                  .from({ grandchild: grandchildren.collection })
-                  .where(({ grandchild }) => eq(grandchild.childId, child.id))
-                  .select(({ grandchild }) => ({
-                    id: grandchild.id,
-                    flat: left.x,
-                    nested: p.q.x,
-                  })),
-              ),
-            })),
-        ),
-      })),
-  )
-  await runWithCleanup(
-    live,
-    [dotted, nested, children, grandchildren],
-    async () => {
-      await live.preload()
-      expect(live.toArray).toHaveLength(1)
-      expect(live.toArray[0]?.children).toEqual([
-        { id: 10, grandchildren: [{ id: 100, flat: 11, nested: 22 }] },
-      ])
-    },
-  )
-})
-
-test('routes dotted and nested include result paths independently', async () => {
-  const parents = createGrammarCollection('route-path-parent', [
-    { id: 1, flatKey: 1, nestedKey: 2 },
-  ])
-  const flatChildren = createGrammarCollection('route-path-flat', [
-    { id: 10, parentId: 1 },
-  ])
-  const nestedChildren = createGrammarCollection('route-path-nested', [
-    { id: 20, parentId: 2 },
-  ])
-  const live = createLiveQueryCollection((q) =>
-    q.from({ parent: parents.collection }).select(({ parent }) => ({
-      id: parent.id,
-      'a.b': toArray(
-        q
-          .from({ child: flatChildren.collection })
-          .where(({ child }) => eq(child.parentId, parent.flatKey))
-          .select(({ child }) => ({ id: child.id })),
-      ),
-      a: caseWhen(
-        eq(parent.id, 1),
-        {
-          b: toArray(
-            q
-              .from({ child: nestedChildren.collection })
-              .where(({ child }) => eq(child.parentId, parent.nestedKey))
-              .select(({ child }) => ({ id: child.id })),
-          ),
-        },
-        { b: [] as Array<{ id: number }> },
-      ),
-    })),
-  )
-  await runWithCleanup(
-    live,
-    [parents, flatChildren, nestedChildren],
-    async () => {
-      await live.preload()
-      expect(live.toArray).toHaveLength(1)
-      expect(live.toArray[0]?.['a.b']).toEqual([{ id: 10 }])
-      expect(live.toArray[0]?.a.b).toEqual([{ id: 20 }])
-
-      parents.write(`update`, { id: 1, flatKey: 2, nestedKey: 1 })
-      expect(live.toArray[0]?.['a.b']).toEqual([])
-      expect(live.toArray[0]?.a.b).toEqual([])
-
-      flatChildren.write(`insert`, { id: 11, parentId: 2 })
-      nestedChildren.write(`insert`, { id: 21, parentId: 1 })
-      expect(live.toArray[0]?.['a.b']).toEqual([{ id: 11 }])
-      expect(live.toArray[0]?.a.b).toEqual([{ id: 21 }])
-    },
-  )
-})
-
-type MaterializationForm = (typeof materializationForms)[number]
-
-type MaterializedForms<T> = {
-  collection: { values: () => Iterable<T> }
-  array: Iterable<T>
-  materialized: Iterable<T>
-}
-
-const materializationForms = [`collection`, `array`, `materialized`] as const
 const checkpoints = [`initial`, `parent-update`, `child-update`] as const
 
 // These axes name semantic boundaries, not implementation functions. Adding a
 // compiler feature means adding its boundary here or stating why it cannot
 // carry correlated context. Each declared tuple gets one named test below;
-// the path-specific witnesses above reconstruct the separate dotted-path cases.
+// the path-specific witnesses in `includes-context-transport.test.ts`
+// reconstruct the separate dotted-path cases.
 //
 // Removing a family loses a distinct question: field versus whole-parent
 // projection; unmatched versus null correlation; immediate versus ancestor
@@ -341,12 +155,6 @@ const routeContextGrammar = {
   },
 } as const
 
-const queryRefMetadataGrammar = {
-  routeModes: [`plain`, `routed`] as const,
-} as const
-
-type QueryRefMetadataMode = (typeof queryRefMetadataGrammar.routeModes)[number]
-
 type ParentProjectionCell = {
   family: `parent-projection`
   shape: (typeof routeContextGrammar.parentProjection.shapes)[number]
@@ -495,104 +303,6 @@ const grammarCells: Array<GrammarCell> = [
   ),
 ]
 
-async function cleanup(
-  live: Cleanable,
-  sources: Array<{ collection: Cleanable }>,
-): Promise<Array<Error>> {
-  const failures: Array<Error> = []
-  try {
-    await live.cleanup()
-  } catch (error) {
-    failures.push(
-      new Error(`live-query Collection cleanup failed`, { cause: error }),
-    )
-  }
-  const sourceResults = await Promise.allSettled(
-    sources.map(({ collection }) =>
-      Promise.resolve().then(() => collection.cleanup()),
-    ),
-  )
-  for (const [index, result] of sourceResults.entries()) {
-    if (result.status === `rejected`) {
-      failures.push(
-        new Error(`source Collection ${index} cleanup failed`, {
-          cause: result.reason,
-        }),
-      )
-    }
-  }
-  return failures
-}
-
-async function runWithCleanup(
-  live: Cleanable,
-  sources: Array<{ collection: Cleanable }>,
-  run: () => Promise<void>,
-): Promise<void> {
-  const outcome = await Promise.resolve()
-    .then(run)
-    .then(
-      () => ({ ok: true }) as const,
-      (error: unknown) => ({ ok: false, error }) as const,
-    )
-  const cleanupFailures = await cleanup(live, sources)
-  if (!outcome.ok) {
-    if (cleanupFailures.length > 0) {
-      throw new AggregateError(cleanupFailures, `Oracle cleanup also failed`, {
-        cause: outcome.error,
-      })
-    }
-    throw outcome.error
-  }
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(cleanupFailures, `Oracle cleanup failed`)
-  }
-}
-
-function createGrammarCollection<T extends { id: number }>(
-  name: string,
-  rows: ReadonlyArray<T>,
-): ControlledCollection<T> {
-  return createControlledCollection(name, rows, { autoIndex: `eager` })
-}
-
-function includeInEveryForm<TContext extends Context>(
-  query: QueryBuilder<TContext>,
-) {
-  return {
-    collection: include(query),
-    array: toArray(query),
-    materialized: materialize(query),
-  }
-}
-
-// Read each public form through the same projection. This keeps normalization
-// outside the production query while preserving exact row counts and values.
-function readEveryForm<T, U>(
-  forms: MaterializedForms<T>,
-  project: (rows: Iterable<T>) => U,
-): Record<MaterializationForm, U> {
-  return {
-    collection: project(forms.collection.values()),
-    array: project(forms.array),
-    materialized: project(forms.materialized),
-  }
-}
-
-function expectEveryForm<T, U>(
-  forms: MaterializedForms<T>,
-  project: (rows: Iterable<T>) => U,
-  expected: U,
-): void {
-  expect(readEveryForm(forms, project)).toEqual(
-    Object.fromEntries(materializationForms.map((form) => [form, expected])),
-  )
-}
-
-function ids(rows: Iterable<{ id: number }>): Array<number> {
-  return [...rows].map((row) => row.id)
-}
-
 function grammarCellName(cell: GrammarCell): string {
   switch (cell.family) {
     case `parent-projection`:
@@ -618,6 +328,25 @@ function grammarCellName(cell: GrammarCell): string {
   }
 }
 
+// Law: a child row carries each parent snapshot in the form its projection
+// selected, read from the current parent row, so a parent update changes every
+// form.
+function expectedParentSnapshots(
+  parents: ControlledCollection<{ id: number; group: number; token: string }>,
+  children: ControlledCollection<{ id: number; parentGroup: number }>,
+  shape: (typeof routeContextGrammar.parentProjection.shapes)[number],
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  return children.collection.toArray
+    .filter((child) => child.parentGroup === parent.group)
+    .map(({ id }) => ({
+      id,
+      parentSnapshot:
+        shape === `field` ? { token: parent.token } : { ...parent },
+    }))
+}
+
 async function runParentProjectionCell({
   shape,
 }: ParentProjectionCell): Promise<void> {
@@ -655,21 +384,15 @@ async function runParentProjectionCell({
       }),
   )
 
-  const expected = (parentId: number) => {
-    const parent = parents.collection.get(parentId)!
-    return children.collection.toArray
-      .filter((child) => child.parentGroup === parent.group)
-      .map(({ id }) => ({
-        id,
-        parentSnapshot:
-          shape === `field` ? { token: parent.token } : { ...parent },
-      }))
-  }
   const project = (rows: Iterable<{ id: number; parentSnapshot: unknown }>) =>
     [...rows].map(({ id, parentSnapshot }) => ({ id, parentSnapshot }))
   const assertParents = () => {
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedParentSnapshots(parents, children, shape, parent.id),
+      )
     }
   }
 
@@ -686,6 +409,23 @@ async function runParentProjectionCell({
   })
 }
 
+// Law: a child correlates with a parent only when both correlation values are
+// equal and non-null; a null value on either side matches no child.
+function expectedCorrelatedIds(
+  parents: ControlledCollection<{ id: number; group: number | null }>,
+  children: ControlledCollection<{ id: number; parentGroup: number | null }>,
+) {
+  const parentGroup = parents.collection.get(1)!.group
+  return children.collection.toArray
+    .filter(
+      (child) =>
+        parentGroup != null &&
+        child.parentGroup != null &&
+        child.parentGroup === parentGroup,
+    )
+    .map(({ id }) => id)
+}
+
 async function runCorrelationDomainCell({
   state,
 }: CorrelationDomainCell): Promise<void> {
@@ -713,18 +453,8 @@ async function runCorrelationDomainCell({
     }),
   )
 
-  const expected = () => {
-    const parentGroup = parents.collection.get(1)!.group
-    return children.collection.toArray
-      .filter(
-        (child) =>
-          parentGroup != null &&
-          child.parentGroup != null &&
-          child.parentGroup === parentGroup,
-      )
-      .map(({ id }) => id)
-  }
-  const assertResult = () => expectEveryForm(live.get(1)!, ids, expected())
+  const assertResult = () =>
+    expectEveryForm(live.get(1)!, ids, expectedCorrelatedIds(parents, children))
 
   await runWithCleanup(live, [parents, children], async () => {
     await live.preload()
@@ -738,6 +468,95 @@ async function runCorrelationDomainCell({
   })
 }
 
+// Law: an immediate parent includes the children of its group whose value is
+// below that parent threshold, in ascending id order.
+function expectedThresholdChildIds(
+  parents: ControlledCollection<{
+    id: number
+    group: number
+    threshold: number
+  }>,
+  children: ControlledCollection<{
+    id: number
+    parentGroup: number
+    group: number
+    value: number
+  }>,
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  return children.collection.toArray
+    .filter(
+      (child) =>
+        child.parentGroup === parent.group && child.value < parent.threshold,
+    )
+    .map(({ id }) => id)
+    .sort((left, right) => left - right)
+}
+
+// Law: a lexical ancestor's threshold filters the grandchildren whose parent
+// group equals the given child group.
+function expectedGrandchildIds(
+  parents: ControlledCollection<{
+    id: number
+    group: number
+    threshold: number
+  }>,
+  grandchildren: ControlledCollection<{
+    id: number
+    parentGroup: number
+    value: number
+  }>,
+  parentId: number,
+  childGroup: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  return grandchildren.collection.toArray
+    .filter(
+      (grandchild) =>
+        grandchild.parentGroup === childGroup &&
+        grandchild.value < parent.threshold,
+    )
+    .map(({ id }) => id)
+    .sort((left, right) => left - right)
+}
+
+// Law: each child of the parent carries the grandchild ids of its group,
+// computed by the grandchild model, in every public form.
+function expectedNestedRows(
+  parents: ControlledCollection<{
+    id: number
+    group: number
+    threshold: number
+  }>,
+  children: ControlledCollection<{
+    id: number
+    parentGroup: number
+    group: number
+    value: number
+  }>,
+  grandchildren: ControlledCollection<{
+    id: number
+    parentGroup: number
+    value: number
+  }>,
+  parentId: number,
+) {
+  return children.collection.toArray
+    .filter(
+      (child) => child.parentGroup === parents.collection.get(parentId)!.group,
+    )
+    .map((child) => ({
+      id: child.id,
+      grandchildren: Object.fromEntries(
+        materializationForms.map((form) => [
+          form,
+          expectedGrandchildIds(parents, grandchildren, parentId, child.group),
+        ]),
+      ),
+    }))
+}
+
 async function runLexicalScopeCell({ scope }: LexicalScopeCell): Promise<void> {
   const parents = createGrammarCollection(`scope-${scope}-parents`, [
     { id: 1, group: 1, threshold: 2 },
@@ -771,27 +590,27 @@ async function runLexicalScopeCell({ scope }: LexicalScopeCell): Promise<void> {
         }),
     )
 
-    const expected = (parentId: number) => {
-      const parent = parents.collection.get(parentId)!
-      return children.collection.toArray
-        .filter(
-          (child) =>
-            child.parentGroup === parent.group &&
-            child.value < parent.threshold,
-        )
-        .map(({ id }) => id)
-        .sort((left, right) => left - right)
-    }
-
     await runWithCleanup(live, [parents, children, grandchildren], async () => {
       await live.preload()
       for (const parent of parents.collection.toArray) {
-        expectEveryForm(live.get(parent.id)!, ids, expected(parent.id))
+        expectEveryForm(
+          live.get(parent.id)!,
+          ids,
+          expectedThresholdChildIds(parents, children, parent.id),
+        )
       }
 
       parents.write(`update`, { id: 1, group: 1, threshold: 4 })
-      expectEveryForm(live.get(1)!, ids, expected(1))
-      expectEveryForm(live.get(2)!, ids, expected(2))
+      expectEveryForm(
+        live.get(1)!,
+        ids,
+        expectedThresholdChildIds(parents, children, 1),
+      )
+      expectEveryForm(
+        live.get(2)!,
+        ids,
+        expectedThresholdChildIds(parents, children, 2),
+      )
 
       children.write(`insert`, {
         id: 30,
@@ -800,7 +619,11 @@ async function runLexicalScopeCell({ scope }: LexicalScopeCell): Promise<void> {
         value: 2,
       })
       for (const parent of parents.collection.toArray) {
-        expectEveryForm(live.get(parent.id)!, ids, expected(parent.id))
+        expectEveryForm(
+          live.get(parent.id)!,
+          ids,
+          expectedThresholdChildIds(parents, children, parent.id),
+        )
       }
     })
     return
@@ -834,18 +657,6 @@ async function runLexicalScopeCell({ scope }: LexicalScopeCell): Promise<void> {
       }),
   )
 
-  const expected = (parentId: number, childGroup: number) => {
-    const parent = parents.collection.get(parentId)!
-    return grandchildren.collection.toArray
-      .filter(
-        (grandchild) =>
-          grandchild.parentGroup === childGroup &&
-          grandchild.value < parent.threshold,
-      )
-      .map(({ id }) => id)
-      .sort((left, right) => left - right)
-  }
-
   const projectOuterForm = (
     parentId: number,
     outerForm: MaterializationForm,
@@ -862,20 +673,12 @@ async function runLexicalScopeCell({ scope }: LexicalScopeCell): Promise<void> {
   }
 
   const assertNestedProduct = (parentId: number) => {
-    const expectedRows = children.collection.toArray
-      .filter(
-        (child) =>
-          child.parentGroup === parents.collection.get(parentId)!.group,
-      )
-      .map((child) => ({
-        id: child.id,
-        grandchildren: Object.fromEntries(
-          materializationForms.map((form) => [
-            form,
-            expected(parentId, child.group),
-          ]),
-        ),
-      }))
+    const expectedRows = expectedNestedRows(
+      parents,
+      children,
+      grandchildren,
+      parentId,
+    )
     for (const outerForm of materializationForms) {
       expect(projectOuterForm(parentId, outerForm)).toEqual(expectedRows)
     }
@@ -896,6 +699,32 @@ async function runLexicalScopeCell({ scope }: LexicalScopeCell): Promise<void> {
   })
 }
 
+// Law: an aggregate score is the children values plus the parent factor, added
+// once per child inside the aggregate or once in total outside it.
+function expectedAggregateScores(
+  parents: ControlledCollection<{ id: number; group: number; factor: number }>,
+  children: ControlledCollection<{
+    id: number
+    parentGroup: number
+    value: number
+  }>,
+  placement: (typeof routeContextGrammar.aggregation.placements)[number],
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  const total = children.collection.toArray
+    .filter((child) => child.parentGroup === parent.group)
+    .reduce((result, child) => result + child.value, 0)
+  const childCount = children.collection.toArray.filter(
+    (child) => child.parentGroup === parent.group,
+  ).length
+  return [
+    placement === `inside-aggregate`
+      ? total + childCount * parent.factor
+      : total + parent.factor,
+  ]
+}
+
 async function runAggregationCell({
   grouping,
   placement,
@@ -937,37 +766,38 @@ async function runAggregationCell({
       }),
   )
 
-  const expected = (parentId: number) => {
-    const parent = parents.collection.get(parentId)!
-    const total = children.collection.toArray
-      .filter((child) => child.parentGroup === parent.group)
-      .reduce((result, child) => result + child.value, 0)
-    const childCount = children.collection.toArray.filter(
-      (child) => child.parentGroup === parent.group,
-    ).length
-    return [
-      placement === `inside-aggregate`
-        ? total + childCount * parent.factor
-        : total + parent.factor,
-    ]
-  }
-
   const project = (rows: Iterable<{ score: number }>) =>
     [...rows].map(({ score }) => score)
 
   await runWithCleanup(live, [parents, children], async () => {
     await live.preload()
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedAggregateScores(parents, children, placement, parent.id),
+      )
     }
 
     parents.write(`update`, { id: 2, group: 1, factor: 3 })
-    expectEveryForm(live.get(2)!, project, expected(2))
-    expectEveryForm(live.get(1)!, project, expected(1))
+    expectEveryForm(
+      live.get(2)!,
+      project,
+      expectedAggregateScores(parents, children, placement, 2),
+    )
+    expectEveryForm(
+      live.get(1)!,
+      project,
+      expectedAggregateScores(parents, children, placement, 1),
+    )
 
     children.write(`insert`, { id: 30, parentGroup: 1, value: 4 })
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedAggregateScores(parents, children, placement, parent.id),
+      )
     }
   })
 }
@@ -978,6 +808,65 @@ type CandidateRow = {
   value: number
 }
 
+// Law: each phase selects, for each parent, the candidate rows of its
+// correlated group that the phase admits; the phase value uses the parent
+// parameter.
+function expectedCandidateRows(
+  parents: ControlledCollection<{
+    id: number
+    group: number
+    parameter: number
+  }>,
+  modelRows: ReadonlyMap<number, CandidateRow>,
+  leftModelIds: ReadonlySet<number>,
+  { boundary, phase }: Pick<RecursiveSourceCell, `boundary` | `phase`>,
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  const correlated = [...modelRows.values()].filter(
+    (candidate) => candidate.parentGroup === parent.group,
+  )
+  switch (phase) {
+    case `filter`:
+      return correlated
+        .filter((candidate) => candidate.value <= parent.parameter)
+        .map((candidate) => ({ id: candidate.id, value: candidate.id }))
+    case `projection`:
+      return correlated.map((candidate) => ({
+        id: candidate.id,
+        value: candidate.value + parent.parameter,
+      }))
+    case `aggregate`:
+      return correlated.map((candidate) => ({
+        id: candidate.id,
+        value: 1 + parent.parameter,
+      }))
+    case `having`:
+      return parent.parameter < 1
+        ? correlated.map((candidate) => ({ id: candidate.id, value: 1 }))
+        : []
+    case `order-window`: {
+      const partitions =
+        boundary === `union-branch`
+          ? [
+              correlated.filter(({ id }) => leftModelIds.has(id)),
+              correlated.filter(({ id }) => !leftModelIds.has(id)),
+            ]
+          : [correlated]
+      return partitions.flatMap((partition) =>
+        partition
+          .sort(
+            (leftRow, rightRow) =>
+              leftRow.value * parent.parameter -
+                rightRow.value * parent.parameter || leftRow.id - rightRow.id,
+          )
+          .slice(0, 1)
+          .map((candidate) => ({ id: candidate.id, value: candidate.id })),
+      )
+    }
+  }
+}
+
 async function runRecursiveSourceCell({
   boundary,
   phase,
@@ -1271,51 +1160,6 @@ async function runRecursiveSourceCell({
   const leftModelIds = new Set(
     initialCandidates.filter(({ id }) => id % 20 === 10).map(({ id }) => id),
   )
-  const expected = (parentId: number) => {
-    const parent = parents.collection.get(parentId)!
-    const correlated = [...modelRows.values()].filter(
-      (candidate) => candidate.parentGroup === parent.group,
-    )
-    switch (phase) {
-      case `filter`:
-        return correlated
-          .filter((candidate) => candidate.value <= parent.parameter)
-          .map((candidate) => ({ id: candidate.id, value: candidate.id }))
-      case `projection`:
-        return correlated.map((candidate) => ({
-          id: candidate.id,
-          value: candidate.value + parent.parameter,
-        }))
-      case `aggregate`:
-        return correlated.map((candidate) => ({
-          id: candidate.id,
-          value: 1 + parent.parameter,
-        }))
-      case `having`:
-        return parent.parameter < 1
-          ? correlated.map((candidate) => ({ id: candidate.id, value: 1 }))
-          : []
-      case `order-window`: {
-        const partitions =
-          boundary === `union-branch`
-            ? [
-                correlated.filter(({ id }) => leftModelIds.has(id)),
-                correlated.filter(({ id }) => !leftModelIds.has(id)),
-              ]
-            : [correlated]
-        return partitions.flatMap((partition) =>
-          partition
-            .sort(
-              (leftRow, rightRow) =>
-                leftRow.value * parent.parameter -
-                  rightRow.value * parent.parameter || leftRow.id - rightRow.id,
-            )
-            .slice(0, 1)
-            .map((candidate) => ({ id: candidate.id, value: candidate.id })),
-        )
-      }
-    }
-  }
 
   const project = (rows: Iterable<{ id: number; value: number }>) =>
     [...rows]
@@ -1323,7 +1167,17 @@ async function runRecursiveSourceCell({
       .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
   const assertParents = () => {
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedCandidateRows(
+          parents,
+          modelRows,
+          leftModelIds,
+          { boundary, phase },
+          parent.id,
+        ),
+      )
     }
   }
 
@@ -1364,6 +1218,28 @@ async function runRecursiveSourceCell({
   )
 }
 
+// Law: a unionAll of two candidate branches yields each correlated candidate
+// value plus the parent parameter, sorted by id.
+function expectedUnionRows(
+  parents: ControlledCollection<{
+    id: number
+    group: number
+    parameter: number
+  }>,
+  left: ControlledCollection<CandidateRow>,
+  right: ControlledCollection<CandidateRow>,
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  return [...left.collection.toArray, ...right.collection.toArray]
+    .filter((candidate) => candidate.parentGroup === parent.group)
+    .map((candidate) => ({
+      id: candidate.id,
+      value: candidate.value + parent.parameter,
+    }))
+    .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
+}
+
 async function runUnionIdentityCell({
   form,
 }: UnionIdentityCell): Promise<void> {
@@ -1437,16 +1313,6 @@ async function runUnionIdentityCell({
     [...rows]
       .map(({ id, value }) => ({ id, value }))
       .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
-  const expected = (parentId: number) => {
-    const parent = parents.collection.get(parentId)!
-    return [...left.collection.toArray, ...right.collection.toArray]
-      .filter((candidate) => candidate.parentGroup === parent.group)
-      .map((candidate) => ({
-        id: candidate.id,
-        value: candidate.value + parent.parameter,
-      }))
-      .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
-  }
   const keys = (parentId: number) => {
     const collection = live.get(parentId)!.collection
     return new Map(
@@ -1455,7 +1321,11 @@ async function runUnionIdentityCell({
   }
   const assertParents = () => {
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedUnionRows(parents, left, right, parent.id),
+      )
     }
   }
   const assertRouteIndependentKeys = () => expect(keys(2)).toEqual(keys(1))
@@ -1483,6 +1353,33 @@ type DerivedCandidateRow = {
   value: number | null
 }
 
+// Law: a derived value joins each anchor whose value equals a non-null
+// candidate value and whose parent group is the parent group.
+function expectedDerivedRows(
+  parents: ControlledCollection<{ id: number; group: number }>,
+  modelRows: ReadonlyMap<number, DerivedCandidateRow>,
+  anchors: ControlledCollection<{
+    id: number
+    parentGroup: number
+    value: number
+  }>,
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  return [...modelRows.values()]
+    .flatMap((candidate) =>
+      anchors.collection.toArray
+        .filter(
+          (anchor) =>
+            candidate.value != null &&
+            anchor.value === candidate.value &&
+            anchor.parentGroup === parent.group,
+        )
+        .map((anchor) => ({ id: anchor.id, value: candidate.value })),
+    )
+    .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
+}
+
 async function runDerivedResultCell({
   boundary,
   selection,
@@ -1603,21 +1500,6 @@ async function runDerivedResultCell({
   )
 
   const modelRows = new Map(initialCandidates.map((row) => [row.id, row]))
-  const expected = (parentId: number) => {
-    const parent = parents.collection.get(parentId)!
-    return [...modelRows.values()]
-      .flatMap((candidate) =>
-        anchors.collection.toArray
-          .filter(
-            (anchor) =>
-              candidate.value != null &&
-              anchor.value === candidate.value &&
-              anchor.parentGroup === parent.group,
-          )
-          .map((anchor) => ({ id: anchor.id, value: candidate.value })),
-      )
-      .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
-  }
   const project = (
     rows: Iterable<{ id: number; value: number | null | undefined }>,
   ) =>
@@ -1626,7 +1508,11 @@ async function runDerivedResultCell({
       .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
   const assertParents = () => {
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedDerivedRows(parents, modelRows, anchors, parent.id),
+      )
     }
   }
 
@@ -1649,140 +1535,44 @@ async function runDerivedResultCell({
   )
 }
 
-function expectNoRouteMetadata(row: object): void {
-  expect(Object.hasOwn(row, `__correlationKey`)).toBe(false)
-  expect(Object.hasOwn(row, `__parentContext`)).toBe(false)
-}
-
-// Public VirtualRowProps names these five keys, not arbitrary $-prefixed data.
-const publicMetadataKeys = new Set([
-  `$hasPendingWrites`,
-  `$synced`,
-  `$origin`,
-  `$key`,
-  `$collectionId`,
-])
-
-function expectSelectedOwnKeys(
-  row: object,
-  selected: ReadonlyArray<string>,
-): void {
-  expect(
-    new Set(
-      Reflect.ownKeys(row).filter(
-        (key) => typeof key !== `string` || !publicMetadataKeys.has(key),
-      ),
-    ),
-  ).toEqual(new Set(selected))
-}
-
-function captureMetadataRows(
-  rows: Iterable<{ id: number; label: string }>,
-): Array<{ id: number; label: string }> {
-  if (Array.isArray(rows)) {
-    expect(new Set(Reflect.ownKeys(rows))).toEqual(
-      new Set([
-        `length`,
-        ...Array.from({ length: rows.length }, (_, index) => String(index)),
-      ]),
+// Law: a join pairs a child with each tag whose key matches under the join side
+// and whose route attachment matches the parent group.
+function expectedJoinRows(
+  parents: ControlledCollection<{ id: number; group: number; offset: number }>,
+  children: ControlledCollection<{
+    id: number
+    parentGroup: number
+    tagId: number
+  }>,
+  tags: ControlledCollection<{
+    id: number
+    parentGroup: number
+    label: string
+  }>,
+  {
+    keySide,
+    correlationAttachment,
+  }: Pick<JoinCell, `keySide` | `correlationAttachment`>,
+  parentId: number,
+) {
+  const parent = parents.collection.get(parentId)!
+  return children.collection.toArray
+    .flatMap((child) =>
+      tags.collection.toArray
+        .filter((tag) => {
+          const keyMatches =
+            keySide === `main`
+              ? tag.id === child.tagId + parent.offset
+              : tag.id + parent.offset === child.tagId
+          const routeMatches =
+            correlationAttachment === `main`
+              ? child.parentGroup === parent.group
+              : tag.parentGroup === parent.group
+          return keyMatches && routeMatches
+        })
+        .map((tag) => ({ id: child.id, value: tag.label })),
     )
-  }
-  return [...rows].map((row) => {
-    expectNoRouteMetadata(row)
-    expectSelectedOwnKeys(row, [`id`, `label`])
-    return { id: row.id, label: row.label }
-  })
-}
-
-async function runQueryRefMetadataCell(
-  routeMode: QueryRefMetadataMode,
-): Promise<void> {
-  const anchors = createGrammarCollection(`metadata-${routeMode}-anchors`, [
-    { id: 1, candidateId: 10, parentGroup: 1 },
-  ])
-  const candidates = createGrammarCollection(
-    `metadata-${routeMode}-candidates`,
-    [{ id: 10, label: `ten` }],
-  )
-
-  if (routeMode === `plain`) {
-    const live = createLiveQueryCollection((q) => {
-      const projectedCandidates = q
-        .from({ candidate: candidates.collection })
-        .select(({ candidate }) => ({
-          id: candidate.id,
-          label: candidate.label,
-        }))
-      return q
-        .from({ anchor: anchors.collection })
-        .innerJoin(
-          { candidateResult: projectedCandidates },
-          ({ anchor, candidateResult }) =>
-            eq(anchor.candidateId, candidateResult.id),
-        )
-        .select(({ candidateResult }) => candidateResult)
-    })
-
-    await runWithCleanup(live, [anchors, candidates], async () => {
-      await live.preload()
-      expect(captureMetadataRows(live.toArray)).toEqual([
-        { id: 10, label: `ten` },
-      ])
-
-      candidates.write(`update`, { id: 10, label: `updated` })
-      expect(captureMetadataRows(live.toArray)).toEqual([
-        { id: 10, label: `updated` },
-      ])
-    })
-    return
-  }
-
-  const parents = createGrammarCollection(`metadata-routed-parents`, [
-    { id: 1, group: 1 },
-  ])
-  const live = createLiveQueryCollection((q) =>
-    q.from({ parent: parents.collection }).select(({ parent }) => {
-      const projectedCandidates = q
-        .from({ candidate: candidates.collection })
-        .select(({ candidate }) => ({
-          id: candidate.id,
-          label: candidate.label,
-        }))
-      const rows = q
-        .from({ anchor: anchors.collection })
-        .innerJoin(
-          { candidateResult: projectedCandidates },
-          ({ anchor, candidateResult }) =>
-            eq(anchor.candidateId, candidateResult.id),
-        )
-        .where(({ anchor }) => eq(anchor.parentGroup, parent.group))
-        .select(({ candidateResult }) => candidateResult)
-      return { id: parent.id, ...includeInEveryForm(rows) }
-    }),
-  )
-  const assertClean = (expected: Array<{ id: number; label: string }>) => {
-    expect(live.toArray.map(({ id }) => id)).toEqual([1])
-    const forms = live.get(1)!
-    expectSelectedOwnKeys(forms, [`id`, `collection`, `array`, `materialized`])
-    for (const rows of [
-      forms.collection.values(),
-      forms.array,
-      forms.materialized,
-    ]) {
-      expect(captureMetadataRows(rows)).toEqual(expected)
-    }
-  }
-
-  await runWithCleanup(live, [parents, anchors, candidates], async () => {
-    await live.preload()
-    assertClean([{ id: 10, label: `ten` }])
-
-    parents.write(`update`, { id: 1, group: 2 })
-    assertClean([])
-
-    anchors.write(`update`, { id: 1, candidateId: 10, parentGroup: 2 })
-    assertClean([{ id: 10, label: `ten` }])
-  })
+    .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
 }
 
 async function runJoinCell({
@@ -1831,32 +1621,21 @@ async function runJoinCell({
       }),
   )
 
-  const expected = (parentId: number) => {
-    const parent = parents.collection.get(parentId)!
-    return children.collection.toArray
-      .flatMap((child) =>
-        tags.collection.toArray
-          .filter((tag) => {
-            const keyMatches =
-              keySide === `main`
-                ? tag.id === child.tagId + parent.offset
-                : tag.id + parent.offset === child.tagId
-            const routeMatches =
-              correlationAttachment === `main`
-                ? child.parentGroup === parent.group
-                : tag.parentGroup === parent.group
-            return keyMatches && routeMatches
-          })
-          .map((tag) => ({ id: child.id, value: tag.label })),
-      )
-      .sort((leftRow, rightRow) => leftRow.id - rightRow.id)
-  }
-
   const project = (rows: Iterable<{ id: number; value: string }>) =>
     [...rows].map(({ id, value }) => ({ id, value }))
   const assertParents = () => {
     for (const parent of parents.collection.toArray) {
-      expectEveryForm(live.get(parent.id)!, project, expected(parent.id))
+      expectEveryForm(
+        live.get(parent.id)!,
+        project,
+        expectedJoinRows(
+          parents,
+          children,
+          tags,
+          { keySide, correlationAttachment },
+          parent.id,
+        ),
+      )
     }
   }
 
@@ -1872,6 +1651,27 @@ async function runJoinCell({
   })
 }
 
+// Law: the parent group and token select the children whose label is the
+// included value under the parent alias or field name.
+function expectedCollisionRows(
+  parents: ControlledCollection<{ id: number; group: number; token: string }>,
+  children: ControlledCollection<{
+    id: number
+    parentGroup: number
+    token: string
+    label: string
+  }>,
+) {
+  const group = parents.collection.get(1)!.group
+  return children.collection.toArray
+    .filter(
+      (child) =>
+        child.parentGroup === group &&
+        child.token === parents.collection.get(1)!.token,
+    )
+    .map((child) => ({ id: child.id, value: child.label }))
+}
+
 async function runNamespaceCollisionCell({
   location,
   boundary,
@@ -2026,16 +1826,6 @@ async function runNamespaceCollisionCell({
           }),
         )
 
-  const expected = () => {
-    const group = parents.collection.get(1)!.group
-    return children.collection.toArray
-      .filter(
-        (child) =>
-          child.parentGroup === group &&
-          child.token === parents.collection.get(1)!.token,
-      )
-      .map((child) => ({ id: child.id, value: child.label }))
-  }
   const project = (rows: Iterable<Record<string, unknown>>) =>
     [...rows].map((row) => ({
       id: row.id,
@@ -2045,7 +1835,7 @@ async function runNamespaceCollisionCell({
     expectEveryForm(
       live.get(1)! as MaterializedForms<Record<string, unknown>>,
       project,
-      expected(),
+      expectedCollisionRows(parents, children),
     )
 
   await runWithCleanup(live, [parents, children, tags], async () => {
@@ -2075,42 +1865,6 @@ class PublicSurfaceBox {
   }
 }
 
-// Public-surface cells deliberately retain callback values and opaque wrappers.
-// A cleaner that only fixes the final array will still fail these observations.
-function expectNoPrivateSymbolsDeep(
-  value: unknown,
-  allowedSymbols: ReadonlySet<symbol>,
-  seen = new WeakSet<object>(),
-): void {
-  if (value == null || typeof value !== `object` || seen.has(value)) return
-  seen.add(value)
-
-  for (const key of Reflect.ownKeys(value)) {
-    if (typeof key === `symbol`) {
-      expect(
-        allowedSymbols.has(key),
-        `unexpected private symbol in public query output`,
-      ).toBe(true)
-    }
-    expectNoPrivateSymbolsDeep(
-      (value as Record<PropertyKey, unknown>)[key],
-      allowedSymbols,
-      seen,
-    )
-  }
-
-  if (value instanceof Map) {
-    for (const [key, entry] of value) {
-      expectNoPrivateSymbolsDeep(key, allowedSymbols, seen)
-      expectNoPrivateSymbolsDeep(entry, allowedSymbols, seen)
-    }
-  } else if (value instanceof Set) {
-    for (const entry of value) {
-      expectNoPrivateSymbolsDeep(entry, allowedSymbols, seen)
-    }
-  }
-}
-
 async function runPublicSurfaceCell({
   shape,
 }: PublicSurfaceCell): Promise<void> {
@@ -2455,114 +2209,27 @@ async function runGrammarCell(cell: GrammarCell): Promise<void> {
   }
 }
 
-describe(`correlated include route-context transport grammar`, () => {
-  test(`public result comparison rejects wrong routes, omissions, and duplicates`, () => {
-    const expected = [{ id: 10, value: `one` }]
-    const forms: MaterializedForms<{ id: number; value: string }> = {
-      collection: { values: () => expected },
-      array: expected,
-      materialized: expected,
-    }
-    const project = (rows: Iterable<{ id: number; value: string }>) => [...rows]
-
-    expectEveryForm(forms, project, expected)
-    expect(() =>
-      expectEveryForm(
-        { ...forms, array: [{ id: 20, value: `two` }] },
-        project,
-        expected,
-      ),
-    ).toThrow()
-    expect(() =>
-      expectEveryForm(
-        { ...forms, collection: { values: () => [] } },
-        project,
-        expected,
-      ),
-    ).toThrow()
-    expect(() =>
-      expectEveryForm(
-        { ...forms, materialized: [...expected, ...expected] },
-        project,
-        expected,
-      ),
-    ).toThrow()
-  })
-
-  test(`cleanup retains the primary failure and releases every source`, async () => {
-    const primary = new Error(`route mismatch`)
-    const liveCleanupFailure = new Error(`live cleanup failed`)
-    const sourceCleanupFailure = new Error(`source cleanup failed`)
-    const released: Array<string> = []
-    const live: Cleanable = {
-      cleanup: async () => {
-        released.push(`live`)
-        throw liveCleanupFailure
-      },
-    }
-    const sources = [
-      {
-        collection: {
-          cleanup: async () => {
-            released.push(`first source`)
-            throw sourceCleanupFailure
-          },
-        },
-      },
-      {
-        collection: {
-          cleanup: async () => {
-            released.push(`second source`)
-          },
-        },
-      },
-    ]
-
-    let caught: unknown
-    try {
-      await runWithCleanup(live, sources, async () => {
-        throw primary
-      })
-    } catch (error) {
-      caught = error
-    }
-    expect(caught).toBeInstanceOf(AggregateError)
-    const failure = caught as AggregateError
-    expect(failure.cause).toBe(primary)
-    expect(failure.errors).toHaveLength(2)
-    expect((failure.errors[0] as Error).cause).toBe(liveCleanupFailure)
-    expect((failure.errors[1] as Error).cause).toBe(sourceCleanupFailure)
-    expect(released).toEqual([`live`, `first source`, `second source`])
-  })
-
-  test(`metadata observations reject vacuity, extra rows, and unknown own keys`, () => {
-    const expected = [{ id: 10, label: `ten` }]
-    const valid = { id: 10, label: `ten` }
-    for (const key of publicMetadataKeys) {
-      Object.defineProperty(valid, key, { value: undefined })
-    }
-    expect(captureMetadataRows([valid])).toEqual(expected)
-    expect(captureMetadataRows([])).toEqual([])
-    const check = (rows: Array<{ id: number; label: string }>) =>
-      expect(captureMetadataRows(rows)).toEqual(expected)
-    for (const rows of [
-      [],
-      [...expected, ...expected],
-      [{ id: 10, label: `wrong` }],
-    ])
-      expect(() => check(rows)).toThrow()
-    for (const key of [`extra`, `$unknown`, Symbol(`private`)] as const) {
-      const row = { id: 10, label: `ten` }
-      Object.defineProperty(row, key, { value: undefined })
-      expect(() => check([row])).toThrow()
-    }
-    const rows = [...expected]
-    Object.defineProperty(rows, Symbol(`private array carrier`), {
-      value: undefined,
-    })
-    expect(() => check(rows)).toThrow()
-  })
+// Each grammar cell is checked against the models below. Each expectation is
+// computed from the source Collections, not written as a value.
+declareOracle({
+  check: [runGrammarCell],
+  model: [
+    expectedParentSnapshots,
+    expectedCorrelatedIds,
+    expectedThresholdChildIds,
+    expectedGrandchildIds,
+    expectedNestedRows,
+    expectedAggregateScores,
+    expectedCandidateRows,
+    expectedUnionRows,
+    expectedDerivedRows,
+    expectedJoinRows,
+    expectedCollisionRows,
+  ],
+  grammar: [grammarCells],
+})
 
+describe(`correlated include route-context transport grammar`, () => {
   test(`expands every declared product without duplicate cells`, () => {
     const expectedCellCount =
       routeContextGrammar.parentProjection.shapes.length +
@@ -2591,65 +2258,41 @@ describe(`correlated include route-context transport grammar`, () => {
     ).toBe(819)
   })
 
-  test(`preserves cycles while removing nested route metadata`, () => {
-    const routed = attachRouteMetadata({ id: 1 }, 1, null)
-    const value: Record<string, unknown> = { routed }
-    value.self = value
-
-    const cleaned = stripInternalRouteMetadata(value) as typeof value
-
-    expect(cleaned).not.toBe(value)
-    expect(cleaned.self).toBe(cleaned)
-    expectNoPrivateSymbolsDeep(cleaned, new Set())
-  })
-
-  test(`does not evaluate unused accessors while cleaning routed callback rows`, async () => {
-    let reads = 0
-    const payload = {}
-    Object.defineProperty(payload, `unused`, {
-      get() {
-        reads++
-        throw new Error(`unused getter evaluated`)
-      },
-      enumerable: true,
-    })
-    const parents = createGrammarCollection(`getter-parents`, [
-      { id: 1, group: 1 },
-    ])
-    const children = createGrammarCollection(`getter-children`, [
-      { id: 10, parentGroup: 1, payload },
-    ])
-    const live = createLiveQueryCollection((q) =>
-      q.from({ parent: parents.collection }).select(({ parent }) => ({
-        id: parent.id,
-        children: toArray(
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentGroup, parent.group))
-            .fn.where(() => true)
-            .fn.select(({ child }) => ({ id: child.id })),
-        ),
-      })),
-    )
-
-    await runWithCleanup(live, [parents, children], async () => {
-      await live.preload()
-      expect(live.get(1)?.children).toEqual([{ id: 10 }])
-      expect(reads).toBe(0)
-    })
-  })
-
   for (const cell of grammarCells) {
     test(`${grammarCellName(cell)} × every materialization form × parent/child updates`, () =>
       runGrammarCell(cell))
   }
-
-  for (const routeMode of queryRefMetadataGrammar.routeModes) {
-    test(`query-ref metadata / ${routeMode}`, () =>
-      runQueryRefMetadataCell(routeMode))
-  }
 })
 
+// Law: a compound join pairs a child with a peer when the first equality holds
+// and the second equality holds with the parent parameter on the chosen side.
+function expectedCompoundRows(
+  children: ControlledCollection<{
+    id: number
+    group: number
+    a: number
+    b: number
+  }>,
+  peers: ControlledCollection<{ id: number; a: number; b: number }>,
+  parentSide: `main` | `joined`,
+  parent: { group: number; parameter: number },
+) {
+  return children.collection.toArray.flatMap((child) =>
+    peers.collection.toArray
+      .filter(
+        (peer) =>
+          child.group === parent.group &&
+          child.a === peer.a &&
+          (parentSide === `main`
+            ? child.b + parent.parameter === peer.b
+            : child.b === peer.b + parent.parameter),
+      )
+      .map((peer) => ({ id: child.id, peerId: peer.id })),
+  )
+}
+
+declareOracle({ model: [expectedCompoundRows] })
+
 /**
  * A parent value used only in the second join equality is still route context.
  * Parents sharing the correlation key may disagree on that equality. This
@@ -2733,17 +2376,11 @@ describe(`compound join parent context`, () => {
                 .sort((a, b) => a[0]! - b[0]! || a[1]! - b[1]!)
             const check = () => {
               for (const parent of parents.collection.toArray) {
-                const expected = children.collection.toArray.flatMap((child) =>
-                  peers.collection.toArray
-                    .filter(
-                      (peer) =>
-                        child.group === parent.group &&
-                        child.a === peer.a &&
-                        (parentSide === `main`
-                          ? child.b + parent.parameter === peer.b
-                          : child.b === peer.b + parent.parameter),
-                    )
-                    .map((peer) => ({ id: child.id, peerId: peer.id })),
+                const expected = expectedCompoundRows(
+                  children,
+                  peers,
+                  parentSide,
+                  parent,
                 )
                 expectEveryForm(
                   live.get(parent.id)!,
diff --git a/packages/db/tests/query/includes-context-transport.test.ts b/packages/db/tests/query/includes-context-transport.test.ts
new file mode 100644
index 0000000000..6d4264c06a
--- /dev/null
+++ b/packages/db/tests/query/includes-context-transport.test.ts
@@ -0,0 +1,516 @@
+/**
+ * Fixed-scenario and harness tests for correlated include route-context
+ * transport. Each test checks literal values or the harness's own failure
+ * reporting, so it is supplemental coverage. The grammar cells, their models,
+ * and the compound join matrix are the oracle in
+ * `includes-context-transport-oracle.test.ts`, which owns the transport law
+ * from ARCHITECTURE.md.
+ */
+
+import { describe, expect, test } from 'vitest'
+import {
+  caseWhen,
+  createLiveQueryCollection,
+  eq,
+  toArray,
+} from '../../src/query/index.js'
+import {
+  attachRouteMetadata,
+  stripInternalRouteMetadata,
+} from '../../src/query/compiler/route-metadata.js'
+import {
+  createGrammarCollection,
+  expectEveryForm,
+  expectNoPrivateSymbolsDeep,
+  includeInEveryForm,
+  runWithCleanup,
+} from './includes-context-transport-helpers.js'
+import type {
+  Cleanable,
+  MaterializedForms,
+} from './includes-context-transport-helpers.js'
+
+test('carries dotted and nested parent fields through one include', async () => {
+  const parents = createGrammarCollection('path-parent', [
+    { id: 1, 'a.b': 11, a: { b: 22 } },
+  ])
+  const children = createGrammarCollection('path-child', [
+    { id: 10, parentId: 1 },
+  ])
+  const live = createLiveQueryCollection((q) =>
+    q.from({ parent: parents.collection }).select(({ parent }) => ({
+      id: parent.id,
+      children: toArray(
+        q
+          .from({ child: children.collection })
+          .where(({ child }) => eq(child.parentId, parent.id))
+          .select(({ child }) => ({
+            id: child.id,
+            flat: parent['a.b'],
+            nested: parent.a.b,
+          })),
+      ),
+    })),
+  )
+  await runWithCleanup(live, [parents, children], async () => {
+    await live.preload()
+    expect(live.get(1)?.children).toEqual([{ id: 10, flat: 11, nested: 22 }])
+
+    parents.write(`update`, { id: 1, 'a.b': 33, a: { b: 44 } })
+    expect(live.get(1)?.children).toEqual([{ id: 10, flat: 33, nested: 44 }])
+  })
+})
+
+test('carries both parent paths through nested includes', async () => {
+  const parents = createGrammarCollection('nested-path-parent', [
+    { id: 1, 'a.b': 11, a: { b: 22 } },
+  ])
+  const children = createGrammarCollection('nested-path-child', [
+    { id: 10, parentId: 1 },
+  ])
+  const grandchildren = createGrammarCollection('nested-path-grandchild', [
+    { id: 100, childId: 10 },
+  ])
+  const live = createLiveQueryCollection((q) =>
+    q.from({ parent: parents.collection }).select(({ parent }) => ({
+      id: parent.id,
+      children: toArray(
+        q
+          .from({ child: children.collection })
+          .where(({ child }) => eq(child.parentId, parent.id))
+          .select(({ child }) => ({
+            id: child.id,
+            grandchildren: toArray(
+              q
+                .from({ grandchild: grandchildren.collection })
+                .where(({ grandchild }) => eq(grandchild.childId, child.id))
+                .select(({ grandchild }) => ({
+                  id: grandchild.id,
+                  flat: parent['a.b'],
+                  nested: parent.a.b,
+                })),
+            ),
+          })),
+      ),
+    })),
+  )
+  await runWithCleanup(live, [parents, children, grandchildren], async () => {
+    await live.preload()
+    expect(live.toArray).toHaveLength(1)
+    expect(live.toArray[0]?.children).toEqual([
+      { id: 10, grandchildren: [{ id: 100, flat: 11, nested: 22 }] },
+    ])
+  })
+})
+
+test('keeps dotted ancestor aliases distinct in nested includes', async () => {
+  const dotted = createGrammarCollection('dotted-alias-parent', [
+    { id: 1, x: 11 },
+  ])
+  const nested = createGrammarCollection('nested-alias-parent', [
+    { id: 1, q: { x: 22 } },
+  ])
+  const children = createGrammarCollection('alias-path-child', [
+    { id: 10, parentId: 1 },
+  ])
+  const grandchildren = createGrammarCollection('alias-path-grandchild', [
+    { id: 100, childId: 10 },
+  ])
+  const live = createLiveQueryCollection((q) =>
+    q
+      .from({ 'p.q': dotted.collection })
+      .innerJoin({ p: nested.collection }, ({ 'p.q': left, p }) =>
+        eq(left.id, p.id),
+      )
+      .select(({ 'p.q': left, p }) => ({
+        id: left.id,
+        children: toArray(
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentId, left.id))
+            .select(({ child }) => ({
+              id: child.id,
+              grandchildren: toArray(
+                q
+                  .from({ grandchild: grandchildren.collection })
+                  .where(({ grandchild }) => eq(grandchild.childId, child.id))
+                  .select(({ grandchild }) => ({
+                    id: grandchild.id,
+                    flat: left.x,
+                    nested: p.q.x,
+                  })),
+              ),
+            })),
+        ),
+      })),
+  )
+  await runWithCleanup(
+    live,
+    [dotted, nested, children, grandchildren],
+    async () => {
+      await live.preload()
+      expect(live.toArray).toHaveLength(1)
+      expect(live.toArray[0]?.children).toEqual([
+        { id: 10, grandchildren: [{ id: 100, flat: 11, nested: 22 }] },
+      ])
+    },
+  )
+})
+
+test('routes dotted and nested include result paths independently', async () => {
+  const parents = createGrammarCollection('route-path-parent', [
+    { id: 1, flatKey: 1, nestedKey: 2 },
+  ])
+  const flatChildren = createGrammarCollection('route-path-flat', [
+    { id: 10, parentId: 1 },
+  ])
+  const nestedChildren = createGrammarCollection('route-path-nested', [
+    { id: 20, parentId: 2 },
+  ])
+  const live = createLiveQueryCollection((q) =>
+    q.from({ parent: parents.collection }).select(({ parent }) => ({
+      id: parent.id,
+      'a.b': toArray(
+        q
+          .from({ child: flatChildren.collection })
+          .where(({ child }) => eq(child.parentId, parent.flatKey))
+          .select(({ child }) => ({ id: child.id })),
+      ),
+      a: caseWhen(
+        eq(parent.id, 1),
+        {
+          b: toArray(
+            q
+              .from({ child: nestedChildren.collection })
+              .where(({ child }) => eq(child.parentId, parent.nestedKey))
+              .select(({ child }) => ({ id: child.id })),
+          ),
+        },
+        { b: [] as Array<{ id: number }> },
+      ),
+    })),
+  )
+  await runWithCleanup(
+    live,
+    [parents, flatChildren, nestedChildren],
+    async () => {
+      await live.preload()
+      expect(live.toArray).toHaveLength(1)
+      expect(live.toArray[0]?.['a.b']).toEqual([{ id: 10 }])
+      expect(live.toArray[0]?.a.b).toEqual([{ id: 20 }])
+
+      parents.write(`update`, { id: 1, flatKey: 2, nestedKey: 1 })
+      expect(live.toArray[0]?.['a.b']).toEqual([])
+      expect(live.toArray[0]?.a.b).toEqual([])
+
+      flatChildren.write(`insert`, { id: 11, parentId: 2 })
+      nestedChildren.write(`insert`, { id: 21, parentId: 1 })
+      expect(live.toArray[0]?.['a.b']).toEqual([{ id: 11 }])
+      expect(live.toArray[0]?.a.b).toEqual([{ id: 21 }])
+    },
+  )
+})
+
+const queryRefMetadataGrammar = {
+  routeModes: [`plain`, `routed`] as const,
+} as const
+
+type QueryRefMetadataMode = (typeof queryRefMetadataGrammar.routeModes)[number]
+
+function expectNoRouteMetadata(row: object): void {
+  expect(Object.hasOwn(row, `__correlationKey`)).toBe(false)
+  expect(Object.hasOwn(row, `__parentContext`)).toBe(false)
+}
+
+// Public VirtualRowProps names these five keys, not arbitrary $-prefixed data.
+const publicMetadataKeys = new Set([
+  `$hasPendingWrites`,
+  `$synced`,
+  `$origin`,
+  `$key`,
+  `$collectionId`,
+])
+
+function expectSelectedOwnKeys(
+  row: object,
+  selected: ReadonlyArray<string>,
+): void {
+  expect(
+    new Set(
+      Reflect.ownKeys(row).filter(
+        (key) => typeof key !== `string` || !publicMetadataKeys.has(key),
+      ),
+    ),
+  ).toEqual(new Set(selected))
+}
+
+function captureMetadataRows(
+  rows: Iterable<{ id: number; label: string }>,
+): Array<{ id: number; label: string }> {
+  if (Array.isArray(rows)) {
+    expect(new Set(Reflect.ownKeys(rows))).toEqual(
+      new Set([
+        `length`,
+        ...Array.from({ length: rows.length }, (_, index) => String(index)),
+      ]),
+    )
+  }
+  return [...rows].map((row) => {
+    expectNoRouteMetadata(row)
+    expectSelectedOwnKeys(row, [`id`, `label`])
+    return { id: row.id, label: row.label }
+  })
+}
+
+async function runQueryRefMetadataCell(
+  routeMode: QueryRefMetadataMode,
+): Promise<void> {
+  const anchors = createGrammarCollection(`metadata-${routeMode}-anchors`, [
+    { id: 1, candidateId: 10, parentGroup: 1 },
+  ])
+  const candidates = createGrammarCollection(
+    `metadata-${routeMode}-candidates`,
+    [{ id: 10, label: `ten` }],
+  )
+
+  if (routeMode === `plain`) {
+    const live = createLiveQueryCollection((q) => {
+      const projectedCandidates = q
+        .from({ candidate: candidates.collection })
+        .select(({ candidate }) => ({
+          id: candidate.id,
+          label: candidate.label,
+        }))
+      return q
+        .from({ anchor: anchors.collection })
+        .innerJoin(
+          { candidateResult: projectedCandidates },
+          ({ anchor, candidateResult }) =>
+            eq(anchor.candidateId, candidateResult.id),
+        )
+        .select(({ candidateResult }) => candidateResult)
+    })
+
+    await runWithCleanup(live, [anchors, candidates], async () => {
+      await live.preload()
+      expect(captureMetadataRows(live.toArray)).toEqual([
+        { id: 10, label: `ten` },
+      ])
+
+      candidates.write(`update`, { id: 10, label: `updated` })
+      expect(captureMetadataRows(live.toArray)).toEqual([
+        { id: 10, label: `updated` },
+      ])
+    })
+    return
+  }
+
+  const parents = createGrammarCollection(`metadata-routed-parents`, [
+    { id: 1, group: 1 },
+  ])
+  const live = createLiveQueryCollection((q) =>
+    q.from({ parent: parents.collection }).select(({ parent }) => {
+      const projectedCandidates = q
+        .from({ candidate: candidates.collection })
+        .select(({ candidate }) => ({
+          id: candidate.id,
+          label: candidate.label,
+        }))
+      const rows = q
+        .from({ anchor: anchors.collection })
+        .innerJoin(
+          { candidateResult: projectedCandidates },
+          ({ anchor, candidateResult }) =>
+            eq(anchor.candidateId, candidateResult.id),
+        )
+        .where(({ anchor }) => eq(anchor.parentGroup, parent.group))
+        .select(({ candidateResult }) => candidateResult)
+      return { id: parent.id, ...includeInEveryForm(rows) }
+    }),
+  )
+  const assertClean = (expected: Array<{ id: number; label: string }>) => {
+    expect(live.toArray.map(({ id }) => id)).toEqual([1])
+    const forms = live.get(1)!
+    expectSelectedOwnKeys(forms, [`id`, `collection`, `array`, `materialized`])
+    for (const rows of [
+      forms.collection.values(),
+      forms.array,
+      forms.materialized,
+    ]) {
+      expect(captureMetadataRows(rows)).toEqual(expected)
+    }
+  }
+
+  await runWithCleanup(live, [parents, anchors, candidates], async () => {
+    await live.preload()
+    assertClean([{ id: 10, label: `ten` }])
+
+    parents.write(`update`, { id: 1, group: 2 })
+    assertClean([])
+
+    anchors.write(`update`, { id: 1, candidateId: 10, parentGroup: 2 })
+    assertClean([{ id: 10, label: `ten` }])
+  })
+}
+
+describe(`correlated include route-context transport grammar`, () => {
+  test(`public result comparison rejects wrong routes, omissions, and duplicates`, () => {
+    const expected = [{ id: 10, value: `one` }]
+    const forms: MaterializedForms<{ id: number; value: string }> = {
+      collection: { values: () => expected },
+      array: expected,
+      materialized: expected,
+    }
+    const project = (rows: Iterable<{ id: number; value: string }>) => [...rows]
+
+    expectEveryForm(forms, project, expected)
+    expect(() =>
+      expectEveryForm(
+        { ...forms, array: [{ id: 20, value: `two` }] },
+        project,
+        expected,
+      ),
+    ).toThrow()
+    expect(() =>
+      expectEveryForm(
+        { ...forms, collection: { values: () => [] } },
+        project,
+        expected,
+      ),
+    ).toThrow()
+    expect(() =>
+      expectEveryForm(
+        { ...forms, materialized: [...expected, ...expected] },
+        project,
+        expected,
+      ),
+    ).toThrow()
+  })
+
+  test(`cleanup retains the primary failure and releases every source`, async () => {
+    const primary = new Error(`route mismatch`)
+    const liveCleanupFailure = new Error(`live cleanup failed`)
+    const sourceCleanupFailure = new Error(`source cleanup failed`)
+    const released: Array<string> = []
+    const live: Cleanable = {
+      cleanup: async () => {
+        released.push(`live`)
+        throw liveCleanupFailure
+      },
+    }
+    const sources = [
+      {
+        collection: {
+          cleanup: async () => {
+            released.push(`first source`)
+            throw sourceCleanupFailure
+          },
+        },
+      },
+      {
+        collection: {
+          cleanup: async () => {
+            released.push(`second source`)
+          },
+        },
+      },
+    ]
+
+    let caught: unknown
+    try {
+      await runWithCleanup(live, sources, async () => {
+        throw primary
+      })
+    } catch (error) {
+      caught = error
+    }
+    expect(caught).toBeInstanceOf(AggregateError)
+    const failure = caught as AggregateError
+    expect(failure.cause).toBe(primary)
+    expect(failure.errors).toHaveLength(2)
+    expect((failure.errors[0] as Error).cause).toBe(liveCleanupFailure)
+    expect((failure.errors[1] as Error).cause).toBe(sourceCleanupFailure)
+    expect(released).toEqual([`live`, `first source`, `second source`])
+  })
+
+  test(`metadata observations reject vacuity, extra rows, and unknown own keys`, () => {
+    const expected = [{ id: 10, label: `ten` }]
+    const valid = { id: 10, label: `ten` }
+    for (const key of publicMetadataKeys) {
+      Object.defineProperty(valid, key, { value: undefined })
+    }
+    expect(captureMetadataRows([valid])).toEqual(expected)
+    expect(captureMetadataRows([])).toEqual([])
+    const check = (rows: Array<{ id: number; label: string }>) =>
+      expect(captureMetadataRows(rows)).toEqual(expected)
+    for (const rows of [
+      [],
+      [...expected, ...expected],
+      [{ id: 10, label: `wrong` }],
+    ])
+      expect(() => check(rows)).toThrow()
+    for (const key of [`extra`, `$unknown`, Symbol(`private`)] as const) {
+      const row = { id: 10, label: `ten` }
+      Object.defineProperty(row, key, { value: undefined })
+      expect(() => check([row])).toThrow()
+    }
+    const rows = [...expected]
+    Object.defineProperty(rows, Symbol(`private array carrier`), {
+      value: undefined,
+    })
+    expect(() => check(rows)).toThrow()
+  })
+
+  test(`preserves cycles while removing nested route metadata`, () => {
+    const routed = attachRouteMetadata({ id: 1 }, 1, null)
+    const value: Record<string, unknown> = { routed }
+    value.self = value
+
+    const cleaned = stripInternalRouteMetadata(value) as typeof value
+
+    expect(cleaned).not.toBe(value)
+    expect(cleaned.self).toBe(cleaned)
+    expectNoPrivateSymbolsDeep(cleaned, new Set())
+  })
+
+  test(`does not evaluate unused accessors while cleaning routed callback rows`, async () => {
+    let reads = 0
+    const payload = {}
+    Object.defineProperty(payload, `unused`, {
+      get() {
+        reads++
+        throw new Error(`unused getter evaluated`)
+      },
+      enumerable: true,
+    })
+    const parents = createGrammarCollection(`getter-parents`, [
+      { id: 1, group: 1 },
+    ])
+    const children = createGrammarCollection(`getter-children`, [
+      { id: 10, parentGroup: 1, payload },
+    ])
+    const live = createLiveQueryCollection((q) =>
+      q.from({ parent: parents.collection }).select(({ parent }) => ({
+        id: parent.id,
+        children: toArray(
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentGroup, parent.group))
+            .fn.where(() => true)
+            .fn.select(({ child }) => ({ id: child.id })),
+        ),
+      })),
+    )
+
+    await runWithCleanup(live, [parents, children], async () => {
+      await live.preload()
+      expect(live.get(1)?.children).toEqual([{ id: 10 }])
+      expect(reads).toBe(0)
+    })
+  })
+
+  for (const routeMode of queryRefMetadataGrammar.routeModes) {
+    test(`query-ref metadata / ${routeMode}`, () =>
+      runQueryRefMetadataCell(routeMode))
+  }
+})
diff --git a/packages/db/tests/query/includes-cross-formulation-oracle.property.test.ts b/packages/db/tests/query/includes-cross-formulation-oracle.property.test.ts
index f188d3b8e8..1ea3892a4f 100644
--- a/packages/db/tests/query/includes-cross-formulation-oracle.property.test.ts
+++ b/packages/db/tests/query/includes-cross-formulation-oracle.property.test.ts
@@ -1,6 +1,8 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { describe, expect, test } from 'vitest'
 import { Temporal } from 'temporal-polyfill'
+import { createCollection } from '../../src/collection/index.js'
+import { createFilterFunctionFromExpression } from '../../src/collection/change-events.js'
 import {
   and,
   count,
@@ -12,9 +14,6 @@ import {
   queryOnce,
   toArray,
 } from '../../src/query/index.js'
-import { Func, PropRef, Value } from '../../src/query/ir.js'
-import { createCollection } from '../../src/collection/index.js'
-import { createFilterFunctionFromExpression } from '../../src/collection/change-events.js'
 import {
   oracleCalibrationTest,
   oraclePropertyOptions,
@@ -23,12 +22,34 @@ import {
   oracleRuns,
   readOracleRunConfig,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { flushPromises } from '../utils.js'
-import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
+import {
+  assertArrayKeys,
+  assertGroupedRouteCounts,
+  captureCounts,
+  captureGroupedRows,
+  captureOrderedNested,
+  captureReferenceRows,
+  compareChildren,
+  compareParents,
+  createControlledCollection,
+  normalizeChild,
+  normalizeFlat,
+  normalizeNested,
+  withCleanup,
+} from './includes-cross-formulation-support.js'
 import type { Collection } from '../../src/collection/index.js'
 import type { LoadSubsetOptions } from '../../src/types.js'
-import type { BasicExpression } from '../../src/query/ir.js'
 import type { ControlledCollection } from './includes-oracle-helpers.js'
+import type {
+  ChildRow,
+  NormalizedParent,
+  ParentRow,
+  ReferenceChild,
+  ReferenceKey,
+  ReferenceParent,
+} from './includes-cross-formulation-support.js'
 
 /**
  * # Why ask the same relationship question five ways?
@@ -60,19 +81,6 @@ import type { ControlledCollection } from './includes-oracle-helpers.js'
  * demand, publication, or facade lifecycle contracts.
  */
 
-type ParentRow = {
-  id: number
-  group: number
-  position: number
-}
-
-type ChildRow = {
-  id: number
-  parentGroup: number
-  score: number | null
-  position: number
-}
-
 type CrossFormulationAction =
   // `put` is model shorthand for a Collection insert when the id is absent
   // and a Collection update when it is present. Deletes of absent ids are
@@ -89,96 +97,6 @@ type CrossFormulationScenario = {
   actions: Array<CrossFormulationAction>
 }
 
-type NormalizedParent = ParentRow & {
-  children: Array<ChildRow>
-}
-
-type FlatRow = {
-  parentId: number
-  parentGroup: number
-  parentPosition: number
-  child: ChildRow | undefined
-}
-
-// Opaque reference routes form a second value domain. Equal object shapes do
-// not make two reference-sensitive correlation keys equal.
-type ReferenceKey = { code: number }
-
-type ReferenceParent = {
-  id: number
-  group: ReferenceKey
-}
-
-type ReferenceChild = {
-  id: number
-  parentGroup: ReferenceKey
-}
-
-type ReferenceRequest =
-  | { readonly type: `ref`; readonly path: ReadonlyArray<string> }
-  | { readonly type: `val`; readonly value: unknown }
-  | {
-      readonly type: `func`
-      readonly name: string
-      readonly args: ReadonlyArray<ReferenceRequest>
-    }
-
-// Copy request structure, but preserve opaque key identities. This finite
-// provider accepts only unbounded parentGroup eq/in predicates and conjunctions.
-function captureReferenceRequest(
-  expression: BasicExpression,
-): ReferenceRequest {
-  switch (expression.type) {
-    case `ref`:
-      return Object.freeze({
-        type: `ref`,
-        path: Object.freeze([...expression.path]),
-      })
-    case `val`: {
-      const value: unknown = expression.value
-      return Object.freeze({
-        type: `val`,
-        value: Array.isArray(value) ? Object.freeze([...value]) : value,
-      })
-    }
-    case `func`:
-      return Object.freeze({
-        type: `func`,
-        name: expression.name,
-        args: Object.freeze(expression.args.map(captureReferenceRequest)),
-      })
-  }
-}
-
-function referenceRequestPredicate(
-  request: ReferenceRequest | undefined,
-): (row: ReferenceChild) => boolean {
-  if (!request) return () => true
-  if (request.type === `func`) {
-    if (request.name === `and` && request.args.length > 0) {
-      const predicates = request.args.map(referenceRequestPredicate)
-      return (row) => predicates.every((predicate) => predicate(row))
-    }
-    let [reference, constant] = request.args
-    if (request.name === `eq` && reference?.type === `val`) {
-      ;[reference, constant] = [constant, reference]
-    }
-    if (
-      request.args.length === 2 &&
-      reference?.type === `ref` &&
-      reference.path.length === 1 &&
-      reference.path[0] === `parentGroup` &&
-      constant?.type === `val`
-    ) {
-      const value = constant.value
-      if (request.name === `eq`) return (row) => row.parentGroup === value
-      if (request.name === `in` && Array.isArray(value))
-        return (row) => value.some((key: unknown) => row.parentGroup === key)
-    }
-  }
-  throw new Error(`Unsupported cold reference fixture predicate`)
-}
-
 type ReferenceContextParent = {
   id: number
   group: number
@@ -192,220 +110,6 @@ type ReferenceContextChild = {
   token: ReferenceKey
 }
 
-// Public VirtualRowProps and docs/guides/live-queries.md name only these keys.
-// Their values and presence are a separate metadata law. They are not part of
-// this projection.
-const virtualKeys = new Set<string>([
-  `$hasPendingWrites`,
-  `$synced`,
-  `$origin`,
-  `$key`,
-  `$collectionId`,
-])
-
-function assertSelectedKeys(
-  value: object,
-  keys: ReadonlyArray<string>,
-  context: string,
-): void {
-  expect(value, context).not.toBeNull()
-  const actual = Reflect.ownKeys(value).filter(
-    (key) => typeof key !== `string` || !virtualKeys.has(key),
-  )
-  expect(new Set(actual), context).toEqual(new Set(keys))
-}
-
-function assertArrayKeys(value: ReadonlyArray<unknown>, context: string): void {
-  expect(new Set(Reflect.ownKeys(value)), context).toEqual(
-    new Set([
-      `length`,
-      ...Array.from({ length: value.length }, (_, index) => String(index)),
-    ]),
-  )
-}
-
-async function withCleanup(
-  work: () => Promise<void>,
-  cleanups: ReadonlyArray<() => Promise<void>>,
-): Promise<void> {
-  let primary: { error: unknown } | undefined
-  try {
-    await work()
-  } catch (error) {
-    primary = { error }
-  }
-  const results = await Promise.allSettled(
-    cleanups.map(async (cleanup) => {
-      await cleanup()
-    }),
-  )
-  const errors = results.flatMap((result) =>
-    result.status === `rejected` ? [result.reason as unknown] : [],
-  )
-  if (errors.length > 0) {
-    if (primary)
-      throw new AggregateError(
-        [primary.error, ...errors],
-        `Oracle and cleanup failed`,
-        { cause: primary.error },
-      )
-    if (errors.length === 1) throw errors[0]
-    throw new AggregateError(errors, `Oracle cleanup failed`)
-  }
-  if (primary) throw primary.error
-}
-
-function captureCounts(
-  rows: Array<{ count: number }>,
-): Array<{ count: number }> {
-  assertArrayKeys(rows, `group counts`)
-  return rows.map((row) => {
-    assertSelectedKeys(row, [`count`], `group count`)
-    return { count: row.count }
-  })
-}
-
-function captureGroupedRows(
-  observed: Array<{ id: number; summaries: Array<{ count: number }> }>,
-): Array<{ id: number; summaries: Array<{ count: number }> }> {
-  assertArrayKeys(observed, `grouped roots`)
-  return observed.map((row) => {
-    assertSelectedKeys(row, [`id`, `summaries`], `grouped parent ${row.id}`)
-    return { id: row.id, summaries: captureCounts(row.summaries) }
-  })
-}
-
-function captureReferenceRows(
-  rows: Array<{ id: number; children: Array<number> }>,
-): Array<{ id: number; children: Array<number> }> {
-  assertArrayKeys(rows, `reference roots`)
-  return rows.map((row) => {
-    assertSelectedKeys(row, [`id`, `children`], `reference parent ${row.id}`)
-    assertArrayKeys(row.children, `reference children ${row.id}`)
-    return { id: row.id, children: [...row.children] }
-  })
-}
-
-function assertGroupedRouteCounts(
-  observed: Array<{ id: number; summaries: Array<{ count: number }> }>,
-  counts: ReadonlyArray<number>,
-): void {
-  expect(captureGroupedRows(observed), `group-route checkpoint`).toEqual(
-    counts.map((childCount, index) => ({
-      id: index + 1,
-      summaries: childCount === 0 ? [] : [{ count: childCount }],
-    })),
-  )
-}
-
-function createControlledCollection<T extends { id: number }>(
-  name: string,
-  initialData: ReadonlyArray<T>,
-): ControlledCollection<T> {
-  return createOracleControlledCollection(name, initialData, {
-    autoIndex: `eager`,
-    rowUpdateMode: `full`,
-  })
-}
-
-function compareParents(left: ParentRow, right: ParentRow): number {
-  return left.position - right.position || left.id - right.id
-}
-
-function compareChildren(left: ChildRow, right: ChildRow): number {
-  return left.position - right.position || left.id - right.id
-}
-
-function normalizeChild(child: ChildRow, context = `child`): ChildRow {
-  assertSelectedKeys(child, [`id`, `parentGroup`, `score`, `position`], context)
-  return {
-    id: child.id,
-    parentGroup: child.parentGroup,
-    score: child.score,
-    position: child.position,
-  }
-}
-
-function captureOrderedNested(
-  rows: ReadonlyArray<NormalizedParent>,
-  context = `nested`,
-): Array<NormalizedParent> {
-  assertArrayKeys(rows, `${context} roots`)
-  return rows.map((parent) => {
-    assertSelectedKeys(
-      parent,
-      [`id`, `group`, `position`, `children`],
-      `${context} parent ${parent.id}`,
-    )
-    assertArrayKeys(parent.children, `${context} children ${parent.id}`)
-    return {
-      id: parent.id,
-      group: parent.group,
-      position: parent.position,
-      children: parent.children.map((child) =>
-        normalizeChild(
-          child,
-          `${context} parent ${parent.id} child ${child.id}`,
-        ),
-      ),
-    }
-  })
-}
-
-// Canonicalize only model rows and formulations with no common result order.
-// Ordered production observations use `captureOrderedNested` directly.
-function normalizeNested(
-  rows: ReadonlyArray<NormalizedParent>,
-): Array<NormalizedParent> {
-  return captureOrderedNested(rows)
-    .map((parent) => ({
-      ...parent,
-      children: parent.children.sort(compareChildren),
-    }))
-    .sort(compareParents)
-}
-
-function normalizeFlat(
-  rows: ReadonlyArray<FlatRow>,
-  context = `flat`,
-): Array<NormalizedParent> {
-  assertArrayKeys(rows, `${context} rows`)
-  const parents = new Map<number, NormalizedParent>()
-  const placeholders = new Set<number>()
-  for (const row of rows) {
-    assertSelectedKeys(
-      row,
-      [`parentId`, `parentGroup`, `parentPosition`, `child`],
-      context,
-    )
-    const parent = parents.get(row.parentId) ?? {
-      id: row.parentId,
-      group: row.parentGroup,
-      position: row.parentPosition,
-      children: [],
-    }
-    expect(
-      [row.parentGroup, row.parentPosition],
-      `${context} parent ${row.parentId}`,
-    ).toEqual([parent.group, parent.position])
-    expect(
-      placeholders.has(row.parentId),
-      `${context} duplicate or mixed placeholder ${row.parentId}`,
-    ).toBe(false)
-    if (row.child === undefined) {
-      expect(
-        parent.children,
-        `${context} mixed placeholder ${row.parentId}`,
-      ).toEqual([])
-      placeholders.add(row.parentId)
-    } else {
-      parent.children.push(normalizeChild(row.child, `${context} child`))
-    }
-    parents.set(row.parentId, parent)
-  }
-  return normalizeNested([...parents.values()])
-}
-
 // This is the independent relationship model. It uses only current source
 // Maps, strict group equality, and the declared total orders.
 function recomputeNestedModel(
@@ -843,6 +547,19 @@ async function expectWindowedIncludeMatches(
   ])
 }
 
+// The nested include's group counts for a route must equal the counts of the
+// standalone grouped query over the same route. The standalone query is a
+// second formulation, so this compares query equality for the route with an
+// independent answer.
+function expectNestedCountsMatchStandalone(
+  nested: Array<{ id: number; summaries: Array<{ count: number }> }>,
+  standalone: Array<{ count: number }>,
+): Array<{ count: number }> | undefined {
+  const nestedCounts = captureGroupedRows(nested)[0]?.summaries
+  expect(nestedCounts).toEqual(captureCounts(standalone))
+  return nestedCounts
+}
+
 const parentRowArbitrary = (id: number) =>
   fc.record({
     id: fc.constant(id),
@@ -984,9 +701,35 @@ const windowedExamples: Array<
   [{ scenario: partitionAndRouteScenario, offset: 2, limit: 3 }],
 ]
 
+// The parts this file declares. The equivalence check compares the nested,
+// flat, per-parent, and TLP formulations with the recomputed model, and the
+// window check does the same for ordered child windows. The TLP check compares
+// each partition with a direct relation over source rows. The grouped check
+// compares a nested route's counts with the standalone grouped query.
+declareOracle({
+  check: [
+    expectFormulationsEquivalent,
+    expectWindowedIncludeMatches,
+    assertTlpPartitions,
+    expectNestedCountsMatchStandalone,
+  ],
+  model: [recomputeNestedModel, recomputeWindowedModel],
+})
+
 describe(`includes cross-formulation oracle`, () => {
   const replay = readOracleRunConfig()
 
+  // The reference-sensitive and symbol-route checks compare a lazy or nested
+  // formulation with a fully loaded or standalone one. Each generated seed runs
+  // its own parent and child history.
+  declareOracle({
+    check: [
+      checkReferenceContextRouting,
+      checkReferenceKeyRouting,
+      checkSymbolGroupRouting,
+    ],
+  })
+
   test(`bounded grammar axes distinguish routes, order, partitions, and windows`, () => {
     const parents = new Map(
       partitionAndRouteScenario.parents.map((row) => [row.id, row]),
@@ -1095,416 +838,6 @@ describe(`includes cross-formulation oracle`, () => {
     ).toThrow(`TLP calibration predicate partition`)
   })
 
-  test(`cold provider predicates preserve opaque reference membership`, () => {
-    const first = { code: 0 }
-    const second = { code: 0 }
-    const rows = [
-      { id: 10, parentGroup: first },
-      { id: 20, parentGroup: second },
-      { id: 30, parentGroup: { code: 0 } },
-    ]
-    const ref = new PropRef([`parentGroup`])
-    const cases: Array<[BasicExpression | undefined, Array<number>]> = [
-      [undefined, [10, 20, 30]],
-      [new Func(`eq`, [ref, new Value(first)]), [10]],
-      [new Func(`eq`, [new Value(second), ref]), [20]],
-      [new Func(`eq`, [ref, new Value({ code: 0 })]), []],
-      [new Func(`in`, [ref, new Value([first, second])]), [10, 20]],
-      [new Func(`in`, [ref, new Value([])]), []],
-      [
-        new Func(`and`, [
-          new Func(`in`, [ref, new Value([first, second])]),
-          new Func(`eq`, [ref, new Value(second)]),
-        ]),
-        [20],
-      ],
-    ]
-    for (const [expression, ids] of cases) {
-      const predicate = referenceRequestPredicate(
-        expression && captureReferenceRequest(expression),
-      )
-      expect(rows.filter(predicate).map((row) => row.id)).toEqual(ids)
-    }
-    // These are fixture-domain failures, not claims about runtime support.
-    for (const expression of [
-      new Func(`lt`, [ref, new Value(first)]),
-      new Func(`eq`, [new PropRef([`id`]), new Value(first)]),
-      new Func(`eq`, [ref]),
-      new Func(`in`, [ref, new Value(first)]),
-    ]) {
-      expect(() =>
-        referenceRequestPredicate(captureReferenceRequest(expression)),
-      ).toThrow(`Unsupported cold reference fixture predicate`)
-    }
-  })
-
-  test(`request snapshots copy paths and membership arrays without cloning keys`, () => {
-    const first = { code: 0 }
-    const second = { code: 0 }
-    const path = [`parentGroup`]
-    const keys = [first, second]
-    const snapshot = captureReferenceRequest(
-      new Func(`in`, [new PropRef(path), new Value(keys)]),
-    )
-    // Mutate only test-owned input, never a submitted runtime request.
-    path[0] = `changed`
-    keys.splice(0, 2, { code: 0 })
-    expect(snapshot.type).toBe(`func`)
-    if (snapshot.type !== `func`) throw new Error(`Expected function snapshot`)
-    expect(Object.isFrozen(snapshot.args)).toBe(true)
-    expect(snapshot.args[0]).toEqual({ type: `ref`, path: [`parentGroup`] })
-    const membership = snapshot.args[1]
-    if (membership?.type !== `val` || !Array.isArray(membership.value))
-      throw new Error(`Expected membership snapshot`)
-    expect(Object.isFrozen(membership.value)).toBe(true)
-    expect(membership.value[0]).toBe(first)
-    expect(membership.value[1]).toBe(second)
-    expect(membership.value).toHaveLength(2)
-  })
-
-  test(`cold grouped-only loading keeps equal-shaped reference routes distinct`, async () => {
-    const first = Object.freeze({ code: 0 })
-    const second = Object.freeze({ code: 0 })
-    const unmatched = Object.freeze({ code: 0 })
-    const rows: Array<ReferenceChild> = [
-      { id: 10, parentGroup: first },
-      { id: 11, parentGroup: first },
-      { id: 20, parentGroup: second },
-      { id: 30, parentGroup: unmatched },
-    ]
-    const parents = createControlledCollection<ReferenceParent>(
-      `cold-grouped-parents`,
-      [
-        { id: 1, group: first },
-        { id: 2, group: second },
-      ],
-    )
-    const requests: Array<ReferenceRequest | undefined> = []
-    const loaded = new Set<number>()
-    const children = createCollection<ReferenceChild>({
-      id: `cold-grouped-children`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => ({
-          loadSubset: (options: LoadSubsetOptions) => {
-            const request =
-              options.where && captureReferenceRequest(options.where)
-            requests.push(request)
-            if (
-              options.orderBy?.length ||
-              options.cursor !== undefined ||
-              options.limit !== undefined ||
-              (options.offset ?? 0) !== 0
-            )
-              throw new Error(
-                `Unsupported bounded cold reference fixture request`,
-              )
-            const matches = referenceRequestPredicate(request)
-            begin()
-            for (const row of rows) {
-              if (!loaded.has(row.id) && matches(row)) {
-                write({ type: `insert`, value: { ...row } })
-                loaded.add(row.id)
-              }
-            }
-            const receipt = commit()
-            if (receipt !== true) return receipt.then(() => markReady())
-            markReady()
-            return true
-          },
-        }),
-      },
-    })
-    const grouped = createLiveQueryCollection({
-      getKey: (row) => row.id,
-      query: (q) =>
-        q
-          .from({ parent: parents.collection })
-          .orderBy(({ parent }) => parent.id, `asc`)
-          .select(({ parent }) => ({
-            id: parent.id,
-            summaries: toArray(
-              q
-                .from({ child: children })
-                .where(({ child }) => eq(child.parentGroup, parent.group))
-                .groupBy(({ child }) => child.parentGroup)
-                .select(({ child }) => ({ count: count(child.id) })),
-            ),
-          })),
-    })
-    await withCleanup(async () => {
-      expect(loaded.size).toBe(0)
-      await grouped.preload()
-      expect(requests.length).toBeGreaterThan(0)
-      expect(loaded.size).toBeGreaterThan(0)
-      // Full-source or broader requests are legal. Counts alone decide routing.
-      assertGroupedRouteCounts(grouped.toArray, [2, 1])
-    }, [
-      () => grouped.cleanup(),
-      () => parents.collection.cleanup(),
-      () => children.cleanup(),
-    ])
-  })
-
-  test.each([
-    { name: `success`, failWork: false, cleanupFailures: 0 },
-    { name: `primary only`, failWork: true, cleanupFailures: 0 },
-    { name: `cleanup only`, failWork: false, cleanupFailures: 1 },
-    { name: `multiple cleanups`, failWork: false, cleanupFailures: 2 },
-    { name: `primary and cleanups`, failWork: true, cleanupFailures: 2 },
-  ])(
-    `retains $name outcomes while attempting every cleanup`,
-    async ({ failWork, cleanupFailures }) => {
-      const primary = new Error(`primary`)
-      const first = new Error(`synchronous cleanup`)
-      const second = new Error(`asynchronous cleanup`)
-      const calls: Array<number> = []
-      const run = withCleanup(() => {
-        if (failWork) throw primary
-        return Promise.resolve()
-      }, [
-        () => {
-          calls.push(1)
-          if (cleanupFailures > 0) throw first
-          return Promise.resolve()
-        },
-        () => {
-          calls.push(2)
-          return cleanupFailures > 1
-            ? Promise.reject(second)
-            : Promise.resolve()
-        },
-        () => {
-          calls.push(3)
-          return Promise.resolve()
-        },
-      ])
-      if (failWork && cleanupFailures > 0) {
-        await expect(run).rejects.toMatchObject({
-          cause: primary,
-          errors: [primary, first, second],
-        })
-      } else if (failWork) {
-        await expect(run).rejects.toBe(primary)
-      } else if (cleanupFailures === 1) {
-        await expect(run).rejects.toBe(first)
-      } else if (cleanupFailures === 2) {
-        await expect(run).rejects.toMatchObject({ errors: [first, second] })
-      } else {
-        await run
-      }
-      expect(calls).toEqual([1, 2, 3])
-    },
-  )
-
-  test.each([
-    `field`,
-    `dollar`,
-    `symbol`,
-    `child symbol`,
-    `array symbol`,
-    `missing field`,
-  ] as const)(
-    `raw capture rejects %s before selected-field projection`,
-    (fault) => {
-      const expected: Array<NormalizedParent> = [
-        {
-          id: 0,
-          group: 0,
-          position: 0,
-          children: [{ id: 10, parentGroup: 0, score: null, position: 0 }],
-        },
-      ]
-      const rows = captureOrderedNested(expected)
-      Object.assign(rows[0]!, {
-        $hasPendingWrites: false,
-        $synced: true,
-        $origin: `remote`,
-        $key: 0,
-        $collectionId: `source`,
-      })
-      expect(captureOrderedNested(rows)).toEqual(expected)
-      if (fault === `missing field`)
-        Reflect.deleteProperty(rows[0]!, `position`)
-      else {
-        const target =
-          fault === `child symbol`
-            ? rows[0]!.children[0]!
-            : fault === `array symbol`
-              ? rows[0]!.children
-              : rows[0]!
-        const key =
-          fault === `field`
-            ? `unexpected`
-            : fault === `dollar`
-              ? `$unexpected`
-              : Symbol(`private`)
-        Object.defineProperty(target, key, { value: undefined })
-      }
-      expect(() => captureOrderedNested(rows)).toThrowError(
-        expect.objectContaining({ name: `AssertionError` }),
-      )
-    },
-  )
-
-  test.each([
-    `metadata`,
-    `placeholder after child`,
-    `placeholder before child`,
-    `duplicate placeholder`,
-    `null child`,
-  ] as const)(`raw flat capture rejects %s`, (fault) => {
-    const row: FlatRow = {
-      parentId: 0,
-      parentGroup: 0,
-      parentPosition: 0,
-      child: { id: 10, parentGroup: 0, score: null, position: 0 },
-    }
-    const second: FlatRow = { ...row, child: { ...row.child!, id: 11 } }
-    const empty: FlatRow = { ...row, child: undefined }
-    expect(
-      normalizeFlat([row, second])[0]?.children.map((child) => child.id),
-    ).toEqual([10, 11])
-    expect(normalizeFlat([empty])[0]?.children).toEqual([])
-    const wrong =
-      fault === `metadata`
-        ? [row, { ...second, parentPosition: 1 }]
-        : fault === `placeholder after child`
-          ? [row, empty]
-          : fault === `placeholder before child`
-            ? [empty, row]
-            : fault === `duplicate placeholder`
-              ? [empty, empty]
-              : [row]
-    if (fault === `null child`) Reflect.set(row, `child`, null)
-    expect(() => normalizeFlat(wrong)).toThrowError(
-      expect.objectContaining({ name: `AssertionError` }),
-    )
-  })
-
-  test(`literal group counts reject common-mode missing, merged and stale groups`, () => {
-    const initial = [
-      { id: 1, summaries: [{ count: 2 }] },
-      { id: 2, summaries: [{ count: 1 }] },
-    ]
-    assertGroupedRouteCounts(initial, [2, 1])
-    for (const wrong of [
-      [],
-      [
-        { id: 1, summaries: [{ count: 3 }] },
-        { id: 2, summaries: [{ count: 3 }] },
-      ],
-      initial,
-    ]) {
-      expect(() => assertGroupedRouteCounts(wrong, [1, 2])).toThrowError(
-        expect.objectContaining({ name: `AssertionError` }),
-      )
-    }
-    assertGroupedRouteCounts(
-      [
-        { id: 1, summaries: [{ count: 1 }] },
-        { id: 2, summaries: [{ count: 2 }] },
-      ],
-      [1, 2],
-    )
-  })
-
-  // These synthetic wrong answers calibrate the local comparisons (ORC-006).
-  // ORC-007 direct-command evidence belongs to the production drivers below.
-  test(`reference-identity checker rejects a wrong answer after shrinking`, () => {
-    const property = fc.property(fc.integer(), (code) => {
-      const first = { code }
-      const second = { code }
-      expect(first).not.toBe(second)
-      const merged = [
-        { id: 1, children: [10, 20] },
-        { id: 2, children: [10, 20] },
-      ]
-      expect(
-        captureReferenceRows(merged),
-        `reference route checkpoint`,
-      ).toEqual([
-        { id: 1, children: [10] },
-        { id: 2, children: [20] },
-      ])
-    })
-    const failure = fc.check(property, { seed: 1_658_002, numRuns: 4 })
-    expect(failure.failed).toBe(true)
-    expect(failure.numShrinks).toBeGreaterThan(0)
-    expect(failure.error).toContain(`reference route checkpoint`)
-    if (failure.counterexamplePath === null)
-      throw new Error(`reference-route mutant did not produce a replay path`)
-    const replayResult = fc.check(property, {
-      seed: failure.seed,
-      path: failure.counterexamplePath,
-      numRuns: 1,
-      endOnFailure: true,
-    })
-    expect(replayResult.failed).toBe(true)
-    expect(replayResult.error).toContain(`reference route checkpoint`)
-    expect(replayResult.counterexample).toEqual(failure.counterexample)
-  })
-
-  test(`symbol-group checker rejects a wrong answer after shrinking`, () => {
-    const property = fc.property(fc.integer(), (code) => {
-      const first = Symbol(`group-${code}`)
-      const second = Symbol(`group-${code}`)
-      expect(first).not.toBe(second)
-      assertGroupedRouteCounts(
-        [
-          { id: 1, summaries: [{ count: 2 }] },
-          { id: 2, summaries: [{ count: 2 }] },
-        ],
-        [1, 1],
-      )
-    })
-    const failure = fc.check(property, { seed: 1_658_003, numRuns: 4 })
-    expect(failure.failed).toBe(true)
-    expect(failure.numShrinks).toBeGreaterThan(0)
-    expect(failure.error).toContain(`group-route checkpoint`)
-    if (failure.counterexamplePath === null)
-      throw new Error(`symbol-group mutant did not produce a replay path`)
-    const replayResult = fc.check(property, {
-      seed: failure.seed,
-      path: failure.counterexamplePath,
-      numRuns: 1,
-      endOnFailure: true,
-    })
-    expect(replayResult.failed).toBe(true)
-    expect(replayResult.error).toContain(`group-route checkpoint`)
-    expect(replayResult.counterexample).toEqual(failure.counterexample)
-  })
-
-  test.each([`root`, `child`] as const)(
-    `retains wrong %s order that unordered normalization would erase`,
-    (level) => {
-      const expected: Array<NormalizedParent> = [
-        {
-          id: 1,
-          group: 0,
-          position: 0,
-          children: [
-            { id: 11, parentGroup: 0, score: null, position: 0 },
-            { id: 10, parentGroup: 0, score: 1, position: 1 },
-          ],
-        },
-        { id: 0, group: 1, position: 1, children: [] },
-      ]
-      const wrong = captureOrderedNested(expected)
-      if (level === `root`) wrong.reverse()
-      else wrong[0]!.children.reverse()
-
-      // The old checker was false green. The new observation retains the
-      // violation.
-      expect(normalizeNested(wrong)).toEqual(expected)
-      expect(captureOrderedNested(expected)).toEqual(expected)
-      expect(() =>
-        expect(captureOrderedNested(wrong)).toEqual(expected),
-      ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
-    },
-  )
-
   // The next three properties have fixed route-transition histories. Their
   // generated integer is only a user token label: values span FastCheck's
   // default integer domain, while zero is reconstructed by the cold fixed
@@ -1737,9 +1070,10 @@ describe(`includes cross-formulation oracle`, () => {
 
       const assertCounts = (expectedCount: number) => {
         assertGroupedRouteCounts(nested.toArray, [expectedCount])
-        const nestedCounts = captureGroupedRows(nested.toArray)[0]?.summaries
-        const standaloneCounts = captureCounts(standalone.toArray)
-        expect(nestedCounts).toEqual(standaloneCounts)
+        const nestedCounts = expectNestedCountsMatchStandalone(
+          nested.toArray,
+          standalone.toArray,
+        )
         expect(nestedCounts).toEqual(
           expectedCount === 0 ? [] : [{ count: expectedCount }],
         )
@@ -1767,59 +1101,6 @@ describe(`includes cross-formulation oracle`, () => {
     },
   )
 
-  test.each([`__correlationKey`, `__tanstack_group_correlation_key`])(
-    `grouped includes preserve internal-looking aggregate alias %s`,
-    async (alias) => {
-      const parents = createControlledCollection(`aggregate-alias-parents`, [
-        { id: 1, group: 1 },
-      ])
-      const children = createControlledCollection(`aggregate-alias-children`, [
-        { id: 10, parentGroup: 1 },
-        { id: 11, parentGroup: 1 },
-      ])
-      const nested = createLiveQueryCollection({
-        query: (q) =>
-          q.from({ parent: parents.collection }).select(({ parent }) => ({
-            id: parent.id,
-            summaries: toArray(
-              q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.parentGroup, parent.group))
-                .groupBy(({ child }) => child.parentGroup)
-                .select(({ child }) => ({ [alias]: count(child.id) })),
-            ),
-          })),
-      })
-
-      await withCleanup(async () => {
-        await nested.preload()
-        assertArrayKeys(nested.toArray, `aggregate alias roots`)
-        expect(
-          nested.toArray.map((row) => {
-            assertSelectedKeys(
-              row,
-              [`id`, `summaries`],
-              `aggregate alias parent`,
-            )
-            assertArrayKeys(row.summaries, `aggregate alias summaries`)
-            return {
-              id: row.id,
-              summaries: row.summaries.map((summary) => {
-                assertSelectedKeys(summary, [alias], `aggregate alias summary`)
-                return { [alias]: summary[alias] }
-              }),
-            }
-          }),
-        ).toEqual([{ id: 1, summaries: [{ [alias]: 2 }] }])
-        expect(nested.get(1)?.summaries.map((row) => row[alias])).toEqual([2])
-      }, [
-        () => nested.cleanup(),
-        () => parents.collection.cleanup(),
-        () => children.collection.cleanup(),
-      ])
-    },
-  )
-
   oracleReplayTest(fcTest).prop([fc.integer()], {
     numRuns: oracleRuns(4),
     seed: 1_658_002,
diff --git a/packages/db/tests/query/includes-cross-formulation-support.ts b/packages/db/tests/query/includes-cross-formulation-support.ts
new file mode 100644
index 0000000000..4632b44e31
--- /dev/null
+++ b/packages/db/tests/query/includes-cross-formulation-support.ts
@@ -0,0 +1,334 @@
+import { expect } from 'vitest'
+import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
+import type { BasicExpression } from '../../src/query/ir.js'
+import type { ControlledCollection } from './includes-oracle-helpers.js'
+
+/**
+ * Shared observers, normalizers, and cleanup for the cross-formulation oracle
+ * (includes-cross-formulation-oracle.property.test.ts), which owns the
+ * equivalence law. The capture functions copy production observations raw,
+ * so an unexpected field, symbol, or placeholder fails before normalization.
+ * The cold reference-request fixture is the provider stand-in for the
+ * reference-sensitive loading tests. This module compares nothing against a
+ * model, so none of its exports is a declared part.
+ */
+
+export type ParentRow = {
+  id: number
+  group: number
+  position: number
+}
+
+export type ChildRow = {
+  id: number
+  parentGroup: number
+  score: number | null
+  position: number
+}
+
+export type NormalizedParent = ParentRow & {
+  children: Array<ChildRow>
+}
+
+export type FlatRow = {
+  parentId: number
+  parentGroup: number
+  parentPosition: number
+  child: ChildRow | undefined
+}
+
+// Opaque reference routes form a second value domain. Equal object shapes do
+// not make two reference-sensitive correlation keys equal.
+export type ReferenceKey = { code: number }
+
+export type ReferenceParent = {
+  id: number
+  group: ReferenceKey
+}
+
+export type ReferenceChild = {
+  id: number
+  parentGroup: ReferenceKey
+}
+
+export type ReferenceRequest =
+  | { readonly type: `ref`; readonly path: ReadonlyArray<string> }
+  | { readonly type: `val`; readonly value: unknown }
+  | {
+      readonly type: `func`
+      readonly name: string
+      readonly args: ReadonlyArray<ReferenceRequest>
+    }
+
+// Copy request structure, but preserve opaque key identities. This finite
+// provider accepts only unbounded parentGroup eq/in predicates and conjunctions.
+export function captureReferenceRequest(
+  expression: BasicExpression,
+): ReferenceRequest {
+  switch (expression.type) {
+    case `ref`:
+      return Object.freeze({
+        type: `ref`,
+        path: Object.freeze([...expression.path]),
+      })
+    case `val`: {
+      const value: unknown = expression.value
+      return Object.freeze({
+        type: `val`,
+        value: Array.isArray(value) ? Object.freeze([...value]) : value,
+      })
+    }
+    case `func`:
+      return Object.freeze({
+        type: `func`,
+        name: expression.name,
+        args: Object.freeze(expression.args.map(captureReferenceRequest)),
+      })
+  }
+}
+
+export function referenceRequestPredicate(
+  request: ReferenceRequest | undefined,
+): (row: ReferenceChild) => boolean {
+  if (!request) return () => true
+  if (request.type === `func`) {
+    if (request.name === `and` && request.args.length > 0) {
+      const predicates = request.args.map(referenceRequestPredicate)
+      return (row) => predicates.every((predicate) => predicate(row))
+    }
+    let [reference, constant] = request.args
+    if (request.name === `eq` && reference?.type === `val`) {
+      ;[reference, constant] = [constant, reference]
+    }
+    if (
+      request.args.length === 2 &&
+      reference?.type === `ref` &&
+      reference.path.length === 1 &&
+      reference.path[0] === `parentGroup` &&
+      constant?.type === `val`
+    ) {
+      const value = constant.value
+      if (request.name === `eq`) return (row) => row.parentGroup === value
+      if (request.name === `in` && Array.isArray(value))
+        return (row) => value.some((key: unknown) => row.parentGroup === key)
+    }
+  }
+  throw new Error(`Unsupported cold reference fixture predicate`)
+}
+
+// Public VirtualRowProps and docs/guides/live-queries.md name only these keys.
+// Their values and presence are a separate metadata law. They are not part of
+// this projection.
+const virtualKeys = new Set<string>([
+  `$hasPendingWrites`,
+  `$synced`,
+  `$origin`,
+  `$key`,
+  `$collectionId`,
+])
+
+export function assertSelectedKeys(
+  value: object,
+  keys: ReadonlyArray<string>,
+  context: string,
+): void {
+  expect(value, context).not.toBeNull()
+  const actual = Reflect.ownKeys(value).filter(
+    (key) => typeof key !== `string` || !virtualKeys.has(key),
+  )
+  expect(new Set(actual), context).toEqual(new Set(keys))
+}
+
+export function assertArrayKeys(
+  value: ReadonlyArray<unknown>,
+  context: string,
+): void {
+  expect(new Set(Reflect.ownKeys(value)), context).toEqual(
+    new Set([
+      `length`,
+      ...Array.from({ length: value.length }, (_, index) => String(index)),
+    ]),
+  )
+}
+
+export async function withCleanup(
+  work: () => Promise<void>,
+  cleanups: ReadonlyArray<() => Promise<void>>,
+): Promise<void> {
+  let primary: { error: unknown } | undefined
+  try {
+    await work()
+  } catch (error) {
+    primary = { error }
+  }
+  const results = await Promise.allSettled(
+    cleanups.map(async (cleanup) => {
+      await cleanup()
+    }),
+  )
+  const errors = results.flatMap((result) =>
+    result.status === `rejected` ? [result.reason as unknown] : [],
+  )
+  if (errors.length > 0) {
+    if (primary)
+      throw new AggregateError(
+        [primary.error, ...errors],
+        `Oracle and cleanup failed`,
+        { cause: primary.error },
+      )
+    if (errors.length === 1) throw errors[0]
+    throw new AggregateError(errors, `Oracle cleanup failed`)
+  }
+  if (primary) throw primary.error
+}
+
+export function captureCounts(
+  rows: Array<{ count: number }>,
+): Array<{ count: number }> {
+  assertArrayKeys(rows, `group counts`)
+  return rows.map((row) => {
+    assertSelectedKeys(row, [`count`], `group count`)
+    return { count: row.count }
+  })
+}
+
+export function captureGroupedRows(
+  observed: Array<{ id: number; summaries: Array<{ count: number }> }>,
+): Array<{ id: number; summaries: Array<{ count: number }> }> {
+  assertArrayKeys(observed, `grouped roots`)
+  return observed.map((row) => {
+    assertSelectedKeys(row, [`id`, `summaries`], `grouped parent ${row.id}`)
+    return { id: row.id, summaries: captureCounts(row.summaries) }
+  })
+}
+
+export function captureReferenceRows(
+  rows: Array<{ id: number; children: Array<number> }>,
+): Array<{ id: number; children: Array<number> }> {
+  assertArrayKeys(rows, `reference roots`)
+  return rows.map((row) => {
+    assertSelectedKeys(row, [`id`, `children`], `reference parent ${row.id}`)
+    assertArrayKeys(row.children, `reference children ${row.id}`)
+    return { id: row.id, children: [...row.children] }
+  })
+}
+
+export function assertGroupedRouteCounts(
+  observed: Array<{ id: number; summaries: Array<{ count: number }> }>,
+  counts: ReadonlyArray<number>,
+): void {
+  expect(captureGroupedRows(observed), `group-route checkpoint`).toEqual(
+    counts.map((childCount, index) => ({
+      id: index + 1,
+      summaries: childCount === 0 ? [] : [{ count: childCount }],
+    })),
+  )
+}
+
+export function createControlledCollection<T extends { id: number }>(
+  name: string,
+  initialData: ReadonlyArray<T>,
+): ControlledCollection<T> {
+  return createOracleControlledCollection(name, initialData, {
+    autoIndex: `eager`,
+    rowUpdateMode: `full`,
+  })
+}
+
+export function compareParents(left: ParentRow, right: ParentRow): number {
+  return left.position - right.position || left.id - right.id
+}
+
+export function compareChildren(left: ChildRow, right: ChildRow): number {
+  return left.position - right.position || left.id - right.id
+}
+
+export function normalizeChild(child: ChildRow, context = `child`): ChildRow {
+  assertSelectedKeys(child, [`id`, `parentGroup`, `score`, `position`], context)
+  return {
+    id: child.id,
+    parentGroup: child.parentGroup,
+    score: child.score,
+    position: child.position,
+  }
+}
+
+export function captureOrderedNested(
+  rows: ReadonlyArray<NormalizedParent>,
+  context = `nested`,
+): Array<NormalizedParent> {
+  assertArrayKeys(rows, `${context} roots`)
+  return rows.map((parent) => {
+    assertSelectedKeys(
+      parent,
+      [`id`, `group`, `position`, `children`],
+      `${context} parent ${parent.id}`,
+    )
+    assertArrayKeys(parent.children, `${context} children ${parent.id}`)
+    return {
+      id: parent.id,
+      group: parent.group,
+      position: parent.position,
+      children: parent.children.map((child) =>
+        normalizeChild(
+          child,
+          `${context} parent ${parent.id} child ${child.id}`,
+        ),
+      ),
+    }
+  })
+}
+
+// Canonicalize only model rows and formulations with no common result order.
+// Ordered production observations use `captureOrderedNested` directly.
+export function normalizeNested(
+  rows: ReadonlyArray<NormalizedParent>,
+): Array<NormalizedParent> {
+  return captureOrderedNested(rows)
+    .map((parent) => ({
+      ...parent,
+      children: parent.children.sort(compareChildren),
+    }))
+    .sort(compareParents)
+}
+
+export function normalizeFlat(
+  rows: ReadonlyArray<FlatRow>,
+  context = `flat`,
+): Array<NormalizedParent> {
+  assertArrayKeys(rows, `${context} rows`)
+  const parents = new Map<number, NormalizedParent>()
+  const placeholders = new Set<number>()
+  for (const row of rows) {
+    assertSelectedKeys(
+      row,
+      [`parentId`, `parentGroup`, `parentPosition`, `child`],
+      context,
+    )
+    const parent = parents.get(row.parentId) ?? {
+      id: row.parentId,
+      group: row.parentGroup,
+      position: row.parentPosition,
+      children: [],
+    }
+    expect(
+      [row.parentGroup, row.parentPosition],
+      `${context} parent ${row.parentId}`,
+    ).toEqual([parent.group, parent.position])
+    expect(
+      placeholders.has(row.parentId),
+      `${context} duplicate or mixed placeholder ${row.parentId}`,
+    ).toBe(false)
+    if (row.child === undefined) {
+      expect(
+        parent.children,
+        `${context} mixed placeholder ${row.parentId}`,
+      ).toEqual([])
+      placeholders.add(row.parentId)
+    } else {
+      parent.children.push(normalizeChild(row.child, `${context} child`))
+    }
+    parents.set(row.parentId, parent)
+  }
+  return normalizeNested([...parents.values()])
+}
diff --git a/packages/db/tests/query/includes-cross-formulation.test.ts b/packages/db/tests/query/includes-cross-formulation.test.ts
new file mode 100644
index 0000000000..859fd9a3d5
--- /dev/null
+++ b/packages/db/tests/query/includes-cross-formulation.test.ts
@@ -0,0 +1,504 @@
+// Unit tests for the cross-formulation oracle. Each test here compares
+// production with literal values or with a fixture predicate, or checks the
+// oracle's own cleanup and replay machinery, so no declared check or model
+// reaches it. The equivalence law across the five formulations is owned by
+// includes-cross-formulation-oracle.property.test.ts. The shared observers
+// and fixtures live in includes-cross-formulation-support.ts.
+
+import { fc } from '@fast-check/vitest'
+import { describe, expect, test } from 'vitest'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import { createCollection } from '../../src/collection/index.js'
+import {
+  count,
+  createLiveQueryCollection,
+  eq,
+  toArray,
+} from '../../src/query/index.js'
+import {
+  assertArrayKeys,
+  assertGroupedRouteCounts,
+  assertSelectedKeys,
+  captureOrderedNested,
+  captureReferenceRequest,
+  captureReferenceRows,
+  createControlledCollection,
+  normalizeFlat,
+  normalizeNested,
+  referenceRequestPredicate,
+  withCleanup,
+} from './includes-cross-formulation-support.js'
+import type { BasicExpression } from '../../src/query/ir.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+import type {
+  FlatRow,
+  NormalizedParent,
+  ReferenceChild,
+  ReferenceParent,
+  ReferenceRequest,
+} from './includes-cross-formulation-support.js'
+
+describe(`includes cross-formulation oracle`, () => {
+  test(`cold provider predicates preserve opaque reference membership`, () => {
+    const first = { code: 0 }
+    const second = { code: 0 }
+    const rows = [
+      { id: 10, parentGroup: first },
+      { id: 20, parentGroup: second },
+      { id: 30, parentGroup: { code: 0 } },
+    ]
+    const ref = new PropRef([`parentGroup`])
+    const cases: Array<[BasicExpression | undefined, Array<number>]> = [
+      [undefined, [10, 20, 30]],
+      [new Func(`eq`, [ref, new Value(first)]), [10]],
+      [new Func(`eq`, [new Value(second), ref]), [20]],
+      [new Func(`eq`, [ref, new Value({ code: 0 })]), []],
+      [new Func(`in`, [ref, new Value([first, second])]), [10, 20]],
+      [new Func(`in`, [ref, new Value([])]), []],
+      [
+        new Func(`and`, [
+          new Func(`in`, [ref, new Value([first, second])]),
+          new Func(`eq`, [ref, new Value(second)]),
+        ]),
+        [20],
+      ],
+    ]
+    for (const [expression, ids] of cases) {
+      const predicate = referenceRequestPredicate(
+        expression && captureReferenceRequest(expression),
+      )
+      expect(rows.filter(predicate).map((row) => row.id)).toEqual(ids)
+    }
+    // These are fixture-domain failures, not claims about runtime support.
+    for (const expression of [
+      new Func(`lt`, [ref, new Value(first)]),
+      new Func(`eq`, [new PropRef([`id`]), new Value(first)]),
+      new Func(`eq`, [ref]),
+      new Func(`in`, [ref, new Value(first)]),
+    ]) {
+      expect(() =>
+        referenceRequestPredicate(captureReferenceRequest(expression)),
+      ).toThrow(`Unsupported cold reference fixture predicate`)
+    }
+  })
+
+  test(`request snapshots copy paths and membership arrays without cloning keys`, () => {
+    const first = { code: 0 }
+    const second = { code: 0 }
+    const path = [`parentGroup`]
+    const keys = [first, second]
+    const snapshot = captureReferenceRequest(
+      new Func(`in`, [new PropRef(path), new Value(keys)]),
+    )
+    // Mutate only test-owned input, never a submitted runtime request.
+    path[0] = `changed`
+    keys.splice(0, 2, { code: 0 })
+    expect(snapshot.type).toBe(`func`)
+    if (snapshot.type !== `func`) throw new Error(`Expected function snapshot`)
+    expect(Object.isFrozen(snapshot.args)).toBe(true)
+    expect(snapshot.args[0]).toEqual({ type: `ref`, path: [`parentGroup`] })
+    const membership = snapshot.args[1]
+    if (membership?.type !== `val` || !Array.isArray(membership.value))
+      throw new Error(`Expected membership snapshot`)
+    expect(Object.isFrozen(membership.value)).toBe(true)
+    expect(membership.value[0]).toBe(first)
+    expect(membership.value[1]).toBe(second)
+    expect(membership.value).toHaveLength(2)
+  })
+
+  test(`cold grouped-only loading keeps equal-shaped reference routes distinct`, async () => {
+    const first = Object.freeze({ code: 0 })
+    const second = Object.freeze({ code: 0 })
+    const unmatched = Object.freeze({ code: 0 })
+    const rows: Array<ReferenceChild> = [
+      { id: 10, parentGroup: first },
+      { id: 11, parentGroup: first },
+      { id: 20, parentGroup: second },
+      { id: 30, parentGroup: unmatched },
+    ]
+    const parents = createControlledCollection<ReferenceParent>(
+      `cold-grouped-parents`,
+      [
+        { id: 1, group: first },
+        { id: 2, group: second },
+      ],
+    )
+    const requests: Array<ReferenceRequest | undefined> = []
+    const loaded = new Set<number>()
+    const children = createCollection<ReferenceChild>({
+      id: `cold-grouped-children`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => ({
+          loadSubset: (options: LoadSubsetOptions) => {
+            const request =
+              options.where && captureReferenceRequest(options.where)
+            requests.push(request)
+            if (
+              options.orderBy?.length ||
+              options.cursor !== undefined ||
+              options.limit !== undefined ||
+              (options.offset ?? 0) !== 0
+            )
+              throw new Error(
+                `Unsupported bounded cold reference fixture request`,
+              )
+            const matches = referenceRequestPredicate(request)
+            begin()
+            for (const row of rows) {
+              if (!loaded.has(row.id) && matches(row)) {
+                write({ type: `insert`, value: { ...row } })
+                loaded.add(row.id)
+              }
+            }
+            const receipt = commit()
+            if (receipt !== true) return receipt.then(() => markReady())
+            markReady()
+            return true
+          },
+        }),
+      },
+    })
+    const grouped = createLiveQueryCollection({
+      getKey: (row) => row.id,
+      query: (q) =>
+        q
+          .from({ parent: parents.collection })
+          .orderBy(({ parent }) => parent.id, `asc`)
+          .select(({ parent }) => ({
+            id: parent.id,
+            summaries: toArray(
+              q
+                .from({ child: children })
+                .where(({ child }) => eq(child.parentGroup, parent.group))
+                .groupBy(({ child }) => child.parentGroup)
+                .select(({ child }) => ({ count: count(child.id) })),
+            ),
+          })),
+    })
+    await withCleanup(async () => {
+      expect(loaded.size).toBe(0)
+      await grouped.preload()
+      expect(requests.length).toBeGreaterThan(0)
+      expect(loaded.size).toBeGreaterThan(0)
+      // Full-source or broader requests are legal. Counts alone decide routing.
+      assertGroupedRouteCounts(grouped.toArray, [2, 1])
+    }, [
+      () => grouped.cleanup(),
+      () => parents.collection.cleanup(),
+      () => children.cleanup(),
+    ])
+  })
+
+  test.each([
+    { name: `success`, failWork: false, cleanupFailures: 0 },
+    { name: `primary only`, failWork: true, cleanupFailures: 0 },
+    { name: `cleanup only`, failWork: false, cleanupFailures: 1 },
+    { name: `multiple cleanups`, failWork: false, cleanupFailures: 2 },
+    { name: `primary and cleanups`, failWork: true, cleanupFailures: 2 },
+  ])(
+    `retains $name outcomes while attempting every cleanup`,
+    async ({ failWork, cleanupFailures }) => {
+      const primary = new Error(`primary`)
+      const first = new Error(`synchronous cleanup`)
+      const second = new Error(`asynchronous cleanup`)
+      const calls: Array<number> = []
+      const run = withCleanup(() => {
+        if (failWork) throw primary
+        return Promise.resolve()
+      }, [
+        () => {
+          calls.push(1)
+          if (cleanupFailures > 0) throw first
+          return Promise.resolve()
+        },
+        () => {
+          calls.push(2)
+          return cleanupFailures > 1
+            ? Promise.reject(second)
+            : Promise.resolve()
+        },
+        () => {
+          calls.push(3)
+          return Promise.resolve()
+        },
+      ])
+      if (failWork && cleanupFailures > 0) {
+        await expect(run).rejects.toMatchObject({
+          cause: primary,
+          errors: [primary, first, second],
+        })
+      } else if (failWork) {
+        await expect(run).rejects.toBe(primary)
+      } else if (cleanupFailures === 1) {
+        await expect(run).rejects.toBe(first)
+      } else if (cleanupFailures === 2) {
+        await expect(run).rejects.toMatchObject({ errors: [first, second] })
+      } else {
+        await run
+      }
+      expect(calls).toEqual([1, 2, 3])
+    },
+  )
+
+  test.each([
+    `field`,
+    `dollar`,
+    `symbol`,
+    `child symbol`,
+    `array symbol`,
+    `missing field`,
+  ] as const)(
+    `raw capture rejects %s before selected-field projection`,
+    (fault) => {
+      const expected: Array<NormalizedParent> = [
+        {
+          id: 0,
+          group: 0,
+          position: 0,
+          children: [{ id: 10, parentGroup: 0, score: null, position: 0 }],
+        },
+      ]
+      const rows = captureOrderedNested(expected)
+      Object.assign(rows[0]!, {
+        $hasPendingWrites: false,
+        $synced: true,
+        $origin: `remote`,
+        $key: 0,
+        $collectionId: `source`,
+      })
+      expect(captureOrderedNested(rows)).toEqual(expected)
+      if (fault === `missing field`)
+        Reflect.deleteProperty(rows[0]!, `position`)
+      else {
+        const target =
+          fault === `child symbol`
+            ? rows[0]!.children[0]!
+            : fault === `array symbol`
+              ? rows[0]!.children
+              : rows[0]!
+        const key =
+          fault === `field`
+            ? `unexpected`
+            : fault === `dollar`
+              ? `$unexpected`
+              : Symbol(`private`)
+        Object.defineProperty(target, key, { value: undefined })
+      }
+      expect(() => captureOrderedNested(rows)).toThrowError(
+        expect.objectContaining({ name: `AssertionError` }),
+      )
+    },
+  )
+
+  test.each([
+    `metadata`,
+    `placeholder after child`,
+    `placeholder before child`,
+    `duplicate placeholder`,
+    `null child`,
+  ] as const)(`raw flat capture rejects %s`, (fault) => {
+    const row: FlatRow = {
+      parentId: 0,
+      parentGroup: 0,
+      parentPosition: 0,
+      child: { id: 10, parentGroup: 0, score: null, position: 0 },
+    }
+    const second: FlatRow = { ...row, child: { ...row.child!, id: 11 } }
+    const empty: FlatRow = { ...row, child: undefined }
+    expect(
+      normalizeFlat([row, second])[0]?.children.map((child) => child.id),
+    ).toEqual([10, 11])
+    expect(normalizeFlat([empty])[0]?.children).toEqual([])
+    const wrong =
+      fault === `metadata`
+        ? [row, { ...second, parentPosition: 1 }]
+        : fault === `placeholder after child`
+          ? [row, empty]
+          : fault === `placeholder before child`
+            ? [empty, row]
+            : fault === `duplicate placeholder`
+              ? [empty, empty]
+              : [row]
+    if (fault === `null child`) Reflect.set(row, `child`, null)
+    expect(() => normalizeFlat(wrong)).toThrowError(
+      expect.objectContaining({ name: `AssertionError` }),
+    )
+  })
+
+  test(`literal group counts reject common-mode missing, merged and stale groups`, () => {
+    const initial = [
+      { id: 1, summaries: [{ count: 2 }] },
+      { id: 2, summaries: [{ count: 1 }] },
+    ]
+    assertGroupedRouteCounts(initial, [2, 1])
+    for (const wrong of [
+      [],
+      [
+        { id: 1, summaries: [{ count: 3 }] },
+        { id: 2, summaries: [{ count: 3 }] },
+      ],
+      initial,
+    ]) {
+      expect(() => assertGroupedRouteCounts(wrong, [1, 2])).toThrowError(
+        expect.objectContaining({ name: `AssertionError` }),
+      )
+    }
+    assertGroupedRouteCounts(
+      [
+        { id: 1, summaries: [{ count: 1 }] },
+        { id: 2, summaries: [{ count: 2 }] },
+      ],
+      [1, 2],
+    )
+  })
+
+  // These synthetic wrong answers calibrate the local comparisons (ORC-006).
+  // ORC-007 direct-command evidence belongs to the production drivers below.
+  test(`reference-identity checker rejects a wrong answer after shrinking`, () => {
+    const property = fc.property(fc.integer(), (code) => {
+      const first = { code }
+      const second = { code }
+      expect(first).not.toBe(second)
+      const merged = [
+        { id: 1, children: [10, 20] },
+        { id: 2, children: [10, 20] },
+      ]
+      expect(
+        captureReferenceRows(merged),
+        `reference route checkpoint`,
+      ).toEqual([
+        { id: 1, children: [10] },
+        { id: 2, children: [20] },
+      ])
+    })
+    const failure = fc.check(property, { seed: 1_658_002, numRuns: 4 })
+    expect(failure.failed).toBe(true)
+    expect(failure.numShrinks).toBeGreaterThan(0)
+    expect(failure.error).toContain(`reference route checkpoint`)
+    if (failure.counterexamplePath === null)
+      throw new Error(`reference-route mutant did not produce a replay path`)
+    const replayResult = fc.check(property, {
+      seed: failure.seed,
+      path: failure.counterexamplePath,
+      numRuns: 1,
+      endOnFailure: true,
+    })
+    expect(replayResult.failed).toBe(true)
+    expect(replayResult.error).toContain(`reference route checkpoint`)
+    expect(replayResult.counterexample).toEqual(failure.counterexample)
+  })
+
+  test(`symbol-group checker rejects a wrong answer after shrinking`, () => {
+    const property = fc.property(fc.integer(), (code) => {
+      const first = Symbol(`group-${code}`)
+      const second = Symbol(`group-${code}`)
+      expect(first).not.toBe(second)
+      assertGroupedRouteCounts(
+        [
+          { id: 1, summaries: [{ count: 2 }] },
+          { id: 2, summaries: [{ count: 2 }] },
+        ],
+        [1, 1],
+      )
+    })
+    const failure = fc.check(property, { seed: 1_658_003, numRuns: 4 })
+    expect(failure.failed).toBe(true)
+    expect(failure.numShrinks).toBeGreaterThan(0)
+    expect(failure.error).toContain(`group-route checkpoint`)
+    if (failure.counterexamplePath === null)
+      throw new Error(`symbol-group mutant did not produce a replay path`)
+    const replayResult = fc.check(property, {
+      seed: failure.seed,
+      path: failure.counterexamplePath,
+      numRuns: 1,
+      endOnFailure: true,
+    })
+    expect(replayResult.failed).toBe(true)
+    expect(replayResult.error).toContain(`group-route checkpoint`)
+    expect(replayResult.counterexample).toEqual(failure.counterexample)
+  })
+
+  test.each([`root`, `child`] as const)(
+    `retains wrong %s order that unordered normalization would erase`,
+    (level) => {
+      const expected: Array<NormalizedParent> = [
+        {
+          id: 1,
+          group: 0,
+          position: 0,
+          children: [
+            { id: 11, parentGroup: 0, score: null, position: 0 },
+            { id: 10, parentGroup: 0, score: 1, position: 1 },
+          ],
+        },
+        { id: 0, group: 1, position: 1, children: [] },
+      ]
+      const wrong = captureOrderedNested(expected)
+      if (level === `root`) wrong.reverse()
+      else wrong[0]!.children.reverse()
+
+      // The old checker was false green. The new observation retains the
+      // violation.
+      expect(normalizeNested(wrong)).toEqual(expected)
+      expect(captureOrderedNested(expected)).toEqual(expected)
+      expect(() =>
+        expect(captureOrderedNested(wrong)).toEqual(expected),
+      ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
+    },
+  )
+
+  test.each([`__correlationKey`, `__tanstack_group_correlation_key`])(
+    `grouped includes preserve internal-looking aggregate alias %s`,
+    async (alias) => {
+      const parents = createControlledCollection(`aggregate-alias-parents`, [
+        { id: 1, group: 1 },
+      ])
+      const children = createControlledCollection(`aggregate-alias-children`, [
+        { id: 10, parentGroup: 1 },
+        { id: 11, parentGroup: 1 },
+      ])
+      const nested = createLiveQueryCollection({
+        query: (q) =>
+          q.from({ parent: parents.collection }).select(({ parent }) => ({
+            id: parent.id,
+            summaries: toArray(
+              q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.parentGroup, parent.group))
+                .groupBy(({ child }) => child.parentGroup)
+                .select(({ child }) => ({ [alias]: count(child.id) })),
+            ),
+          })),
+      })
+
+      await withCleanup(async () => {
+        await nested.preload()
+        assertArrayKeys(nested.toArray, `aggregate alias roots`)
+        expect(
+          nested.toArray.map((row) => {
+            assertSelectedKeys(
+              row,
+              [`id`, `summaries`],
+              `aggregate alias parent`,
+            )
+            assertArrayKeys(row.summaries, `aggregate alias summaries`)
+            return {
+              id: row.id,
+              summaries: row.summaries.map((summary) => {
+                assertSelectedKeys(summary, [alias], `aggregate alias summary`)
+                return { [alias]: summary[alias] }
+              }),
+            }
+          }),
+        ).toEqual([{ id: 1, summaries: [{ [alias]: 2 }] }])
+        expect(nested.get(1)?.summaries.map((row) => row[alias])).toEqual([2])
+      }, [
+        () => nested.cleanup(),
+        () => parents.collection.cleanup(),
+        () => children.collection.cleanup(),
+      ])
+    },
+  )
+})
diff --git a/packages/db/tests/query/includes-functional-projection-oracle.test.ts b/packages/db/tests/query/includes-functional-projection-oracle.test.ts
index fb3d280055..203d29af67 100644
--- a/packages/db/tests/query/includes-functional-projection-oracle.test.ts
+++ b/packages/db/tests/query/includes-functional-projection-oracle.test.ts
@@ -1,4 +1,5 @@
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
+import { declareOracle } from '../oracle-declaration.js'
 import {
   createLiveQueryCollection,
   eq,
@@ -6,12 +7,28 @@ import {
   materialize,
   toArray,
 } from '../../src/query/index.js'
-import { createCollection } from '../../src/collection/index.js'
-import { createDeferred } from '../../src/deferred.js'
-import { BasicIndex } from '../../src/indexes/basic-index.js'
-import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
-import { flushPromises } from '../utils.js'
 import { createControlledCollection } from './includes-oracle-helpers.js'
+import {
+  Projection,
+  cells,
+  cleanupAfterOracle,
+  collectionInputError,
+  noPrimaryFailure,
+  operatorCells,
+  orderedPairCells,
+  publicRows,
+  readChildren,
+  rejectsCollectionInput,
+  renamedCells,
+  selectedRows,
+  valueCells,
+} from './includes-functional-projection-support.js'
+import type {
+  Child,
+  ChildView,
+  Input,
+  Phase,
+} from './includes-functional-projection-support.js'
 
 /**
  * # What may cross a functional projection boundary?
@@ -46,942 +63,44 @@ import { createControlledCollection } from './includes-oracle-helpers.js'
  * provider timing, or every recursive query shape.
  */
 
-// These products are finite contract partitions. Calibration tests below
-// reject missing or duplicate cells before the behavior tests run.
-const boundaries = [`query-ref`, `recursive-query-ref`, `union`] as const
-const forms = [`collection`, `array`, `materialized`] as const
-const outputs = [`expression`, `record`, `opaque-root`] as const
-const initialStates = [`empty`, `populated`] as const
-const cells = boundaries.flatMap((boundary) =>
-  forms.flatMap((form) =>
-    outputs.flatMap((output) =>
-      initialStates.map((initial) => ({ boundary, form, output, initial })),
-    ),
-  ),
-)
-const orderedPairCells = cells
-  .filter(({ initial }) => initial === `populated`)
-  .map((cell) => ({ ...cell, initial: `ordered-pair` as const }))
-const consumers = [`expression`, `functional`] as const
-const valueShapes = [`number`, `null`, `date`, `dropped-record`] as const
-const valueCells = forms.flatMap((form) =>
-  consumers.flatMap((consumer) =>
-    valueShapes.flatMap((shape) =>
-      [false, true].map((withInclude) => ({
-        form,
-        consumer,
-        shape,
-        withInclude,
-      })),
-    ),
-  ),
-)
-const renamedCells = forms.flatMap((form) =>
-  consumers.flatMap((consumer) =>
-    consumers.flatMap((projection) =>
-      [false, true].map((withSibling) => ({
-        form,
-        consumer,
-        projection,
-        withSibling,
-      })),
-    ),
-  ),
-)
-const operatorCells = forms.flatMap((form) =>
-  ([`custom-key`, `selected-order`, `distinct`] as const).flatMap((operator) =>
-    [false, true].map((readsInclude) => ({ form, operator, readsInclude })),
-  ),
-)
-
-type Child = { id: number; parentGroup: number; value: number }
-type Input = { id: number; kind: string; children?: unknown }
-// Phase labels name this oracle's observation cuts. They do not model D2 phases.
-type Phase = `initial` | `child-update` | `sibling-update` | `route-move`
-type ChildView = {
-  valid: boolean
-  ready: boolean | undefined
-  rows: Array<Child>
-}
-
-function readChildren(value: unknown, form: (typeof forms)[number]): ChildView {
-  if (form !== `collection`) {
-    return {
-      valid: Array.isArray(value),
-      ready: undefined,
-      rows: Array.isArray(value) ? value : [],
-    }
-  }
-  if (
-    typeof value !== `object` ||
-    value === null ||
-    !(`toArray` in value) ||
-    !(`isReady` in value) ||
-    typeof value.isReady !== `function`
-  ) {
-    return { valid: false, ready: undefined, rows: [] }
-  }
-  return {
-    valid: Array.isArray(value.toArray),
-    ready: value.isReady(),
-    rows: Array.isArray(value.toArray) ? value.toArray : [],
-  }
-}
-
-// Keep only the selected public fields in row comparisons. Other assertions
-// check callback-time shape and facade readiness.
-function selectedRows(rows: ReadonlyArray<Child>) {
-  return rows.map(({ id, parentGroup, value }) => ({ id, parentGroup, value }))
-}
-
-function publicRows(rows: ReadonlyArray<Child>) {
-  return selectedRows(rows).sort((left, right) => left.id - right.id)
-}
-
-const collectionInputError = `fn.select() cannot consume Collection-valued includes`
-function rejectsCollectionInput(
-  form: string,
-  ...functional: Array<boolean>
-): boolean {
-  return form === `collection` && functional.some(Boolean)
-}
-
-const noPrimaryFailure = Symbol(`no primary oracle failure`)
+declareOracle({
+  model: [expectedGroupChildren, expectedOperatorRows],
+  grammar: [cells, orderedPairCells, valueCells, renamedCells, operatorCells],
+})
 
-// Run every release even when an earlier one fails. If the oracle already
-// failed, keep that mismatch as the cause and report cleanup separately.
-async function cleanupAfterOracle(
-  primaryFailure: unknown,
-  releases: ReadonlyArray<() => void | Promise<void>>,
-): Promise<void> {
-  const cleanupFailures: Array<unknown> = []
-  for (const release of releases) {
-    try {
-      await release()
-    } catch (error) {
-      cleanupFailures.push(error)
-    }
-  }
-  if (cleanupFailures.length === 0) return
-  if (primaryFailure === noPrimaryFailure && cleanupFailures.length === 1)
-    throw cleanupFailures[0]
-  throw new AggregateError(cleanupFailures, `oracle cleanup failed`, {
-    ...(primaryFailure === noPrimaryFailure ? {} : { cause: primaryFailure }),
-  })
+// The public rows of the children that a route group owns, predicted from the
+// source truth. A route move changes which group a parent reads, so the
+// prediction follows the group that the caller passes.
+function expectedGroupChildren(
+  truth: ReadonlyMap<number, Child>,
+  group: number,
+): Array<Child> {
+  return publicRows(
+    [...truth.values()].filter((child) => child.parentGroup === group),
+  )
 }
 
-class Projection {
-  constructor(
-    readonly id: number,
-    readonly kind: string,
-    readonly children: unknown,
-    readonly total: number,
-  ) {}
+// The projected rows that an operator must publish for these parent scores.
+// The operator decides the output: distinct keeps one row per score, and
+// selected-order keeps the highest score.
+function expectedOperatorRows(
+  expectedScores: ReadonlyMap<number, number>,
+  operator: (typeof operatorCells)[number][`operator`],
+): Array<{ id: number; score: number }> {
+  let expected = [...expectedScores].map(([id, score]) => ({ id, score }))
+  if (operator === `distinct`)
+    expected = [...new Set(expected.map((row) => row.score))].map((score) => ({
+      id: 0,
+      score,
+    }))
+  if (operator === `selected-order`)
+    expected = expected
+      .sort((left, right) => right.score - left.score || left.id - right.id)
+      .slice(0, 1)
+  return expected
 }
 
 describe(`functional projection output compatibility`, () => {
-  it(`retains the first mismatch and all cleanup failures`, async () => {
-    const primary = new Error(`public result mismatch`)
-    const firstCleanup = new Error(`first cleanup failed`)
-    const secondCleanup = new Error(`second cleanup failed`)
-    const released: Array<number> = []
-    let reported: unknown
-    let primaryFailure: unknown = noPrimaryFailure
-    try {
-      try {
-        throw primary
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => {
-            released.push(1)
-            throw firstCleanup
-          },
-          () => {
-            released.push(2)
-            throw secondCleanup
-          },
-          () => {
-            released.push(3)
-          },
-        ])
-      }
-    } catch (error) {
-      reported = error
-    }
-    expect(released).toEqual([1, 2, 3])
-    expect(reported).toBeInstanceOf(AggregateError)
-    expect((reported as AggregateError).cause).toBe(primary)
-    expect((reported as AggregateError).errors).toEqual([
-      firstCleanup,
-      secondCleanup,
-    ])
-  })
-
-  it.each(
-    ([`expression`, `functional`] as const).flatMap((projection) =>
-      ([`resolve`, `reject`, `cleanup-resolve`, `cleanup-reject`] as const).map(
-        (settlement) => ({ projection, settlement }),
-      ),
-    ),
-  )(
-    `$projection projection fences $settlement of a pending child load`,
-    async ({ projection, settlement }) => {
-      const parents = createControlledCollection(`pending-parent`, [
-        { id: 1, groupId: 1 },
-      ])
-      const requests: Array<{
-        gate: ReturnType<typeof createDeferred<void>>
-        signal: AbortSignal | undefined
-      }> = []
-      const children = createCollection<{ id: number; groupId: number }>({
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => ({
-            loadSubset: ({ signal }) => {
-              const gate = createDeferred<void>()
-              requests.push({ gate, signal })
-              return gate.promise.then(async () => {
-                if (signal?.aborted) return
-                begin()
-                write({ type: `insert`, value: { id: 10, groupId: 1 } })
-                await commit()
-                markReady()
-              })
-            },
-          }),
-        },
-      })
-      const captured: Array<Pick<typeof children, `toArray`>> = []
-      const buildQuery = () =>
-        createLiveQueryCollection((q) => {
-          const source = q.from({
-            row: q
-              .from({ parent: parents.collection })
-              .select(({ parent }) => ({
-                id: parent.id,
-                children: include(
-                  q
-                    .from({ child: children })
-                    .where(({ child }) => eq(child.groupId, parent.groupId)),
-                ),
-              })),
-          })
-          return projection === `expression`
-            ? source.select(({ row }) => row)
-            : source.fn.select(({ row }) => {
-                captured.push(row.children)
-                return { id: row.id, children: row.children }
-              })
-        })
-      if (rejectsCollectionInput(`collection`, projection === `functional`)) {
-        let primaryFailure: unknown = noPrimaryFailure
-        try {
-          expect(buildQuery).toThrow(collectionInputError)
-          expect(captured).toEqual([])
-        } catch (error) {
-          primaryFailure = error
-          throw error
-        } finally {
-          await cleanupAfterOracle(primaryFailure, [
-            () => parents.collection.cleanup(),
-            () => children.cleanup(),
-          ])
-        }
-        return
-      }
-      const query = buildQuery()
-      const failure = new Error(`pending child failed`)
-      // Attach both outcomes immediately. A pending-length assertion must not
-      // leave a rejected preload promise unobserved.
-      const preload = () => {
-        const result: { settled: boolean; error?: unknown } = { settled: false }
-        const observed = query.preload().then(
-          () => {
-            result.settled = true
-          },
-          (error) => {
-            result.settled = true
-            result.error = error
-          },
-        )
-        return { result, observed }
-      }
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        const initial = preload()
-        await flushPromises()
-        expect(requests).toHaveLength(1)
-        expect(initial.result.settled).toBe(false)
-        expect(query.isReady()).toBe(false)
-        const held = query.get(1)!.children
-        expect(held.toArray).toEqual([])
-        if (projection === `functional`) expect(captured).toHaveLength(1)
-        const obsoleteViews = [...captured, held]
-
-        if (settlement.startsWith(`cleanup`)) {
-          await query.cleanup()
-          await children.cleanup()
-          await initial.observed
-          expect(initial.result.error).toMatchObject({ name: `AbortError` })
-          expect(requests[0]!.signal?.aborted).toBe(true)
-          const restarted = preload()
-          await flushPromises()
-          expect(requests).toHaveLength(2)
-          const current = query.get(1)!.children
-          if (settlement === `cleanup-reject`) requests[0]!.gate.reject(failure)
-          else requests[0]!.gate.resolve()
-          await flushPromises()
-          expect(
-            restarted.result.settled,
-            `obsolete completion cannot finish preload`,
-          ).toBe(false)
-          expect(query.isReady()).toBe(false)
-          expect(current.toArray).toEqual([])
-          requests[1]!.gate.resolve()
-          await restarted.observed
-          expect(restarted.result.error).toBeUndefined()
-          expect(query.isReady()).toBe(true)
-          expect(current.toArray.map((child) => child.id)).toEqual([10])
-          for (const view of obsoleteViews) expect(view.toArray).toEqual([])
-        } else {
-          if (settlement === `reject`) requests[0]!.gate.reject(failure)
-          else requests[0]!.gate.resolve()
-          await initial.observed
-          if (settlement === `reject`) {
-            expect(initial.result.error).toBe(failure)
-            expect(query.isReady()).toBe(false)
-            expect(held.toArray).toEqual([])
-          } else {
-            expect(initial.result.error).toBeUndefined()
-            expect(query.isReady()).toBe(true)
-            expect(held.toArray.map((child) => child.id)).toEqual([10])
-            for (const view of captured)
-              expect(view.toArray.map((child) => child.id)).toEqual([10])
-          }
-        }
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => query.cleanup(),
-          ...requests.map(({ gate }) => gate.resolve),
-          () => children.cleanup(),
-          () => parents.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  it.each(
-    ([`publication`, `after-preload`] as const).flatMap((subscribeAt) =>
-      ([`none`, `callback`, `flush`] as const).map((failureAt) => ({
-        subscribeAt,
-        failureAt,
-      })),
-    ),
-  )(
-    `keeps $subscribeAt subscriptions isolated through $failureAt failure and restart`,
-    async ({ subscribeAt, failureAt }) => {
-      const parents = createControlledCollection(`subscription-parent`, [
-        { id: 1, groupId: 1 },
-      ])
-      const children = createControlledCollection(`subscription-child`, [
-        { id: 10, groupId: 1 },
-        { id: 20, groupId: 2 },
-      ])
-      const observers: Array<{
-        rows: Set<number>
-        batches: Array<Array<string>>
-        view: Pick<typeof children.collection, `toArray` | `subscribeChanges`>
-      }> = []
-      const releases: Array<() => void> = []
-      const observe = (view: (typeof observers)[number][`view`]) => {
-        const rows = new Set<number>()
-        const batches: Array<Array<string>> = []
-        const subscription = view.subscribeChanges(
-          (changes) => {
-            batches.push(
-              changes.map((change) => `${change.type}:${change.value.id}`),
-            )
-            for (const change of changes) {
-              if (change.type === `delete`) rows.delete(change.value.id)
-              else rows.add(change.value.id)
-            }
-          },
-          { includeInitialState: true },
-        )
-        releases.push(() => subscription.unsubscribe())
-        observers.push({ rows, batches, view })
-      }
-      const failure = new Error(`projection subscription ${failureAt} failure`)
-      let failing = false
-      let flushReached = false
-      const originalFlush = BucketFacadeAdapter.prototype.flush
-      // Fail after actual facade writes, before any deferred public events.
-      // An event-listener throw is asynchronous and would not test rollback.
-      const flush =
-        failureAt === `flush`
-          ? vi
-              .spyOn(BucketFacadeAdapter.prototype, `flush`)
-              .mockImplementation(function (this: BucketFacadeAdapter) {
-                const publication = originalFlush.call(this)
-                return {
-                  ...publication,
-                  prepare: () => {
-                    publication.prepare()
-                    if (failing) {
-                      flushReached = true
-                      throw failure
-                    }
-                  },
-                }
-              })
-          : undefined
-      const query = createLiveQueryCollection((q) => {
-        const projected = q
-          .from({ parent: parents.collection })
-          .fn.select(({ parent }) => {
-            if (failing && failureAt === `callback`) throw failure
-            return parent
-          })
-        return q.from({ row: projected }).select(({ row }) => ({
-          id: row.id,
-          groupId: row.groupId,
-          children: include(
-            q
-              .from({ child: children.collection })
-              .where(({ child }) => eq(child.groupId, row.groupId)),
-          ),
-        }))
-      })
-      if (subscribeAt === `publication`) {
-        const rootSubscription = query.subscribeChanges(
-          (changes) => {
-            for (const change of changes)
-              if (change.type !== `delete`) observe(change.value.children)
-          },
-          { includeInitialState: true },
-        )
-        releases.push(() => rootSubscription.unsubscribe())
-      }
-      const ids = (observer: (typeof observers)[number]) =>
-        [...observer.rows].sort((a, b) => a - b)
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        await query.preload()
-        if (subscribeAt === `after-preload`) observe(query.get(1)!.children)
-        const first = observers[0]!
-        expect(ids(first), `initial subscription snapshot`).toEqual([10])
-        children.write(`insert`, { id: 11, groupId: 1 })
-        expect(ids(first), `initial live insert`).toEqual([10, 11])
-        const originalRow = query.get(1)
-        const beforeFailure = first.batches.length
-        failing = failureAt !== `none`
-        const move = () => parents.write(`update`, { id: 1, groupId: 2 })
-        if (failing) {
-          let thrown: unknown
-          try {
-            move()
-          } catch (error) {
-            thrown = error
-          }
-          expect(thrown).toBe(failure)
-          expect(query.get(1), `root rollback`).toBe(originalRow)
-          expect(ids(first), `old subscriber rollback`).toEqual([10, 11])
-          expect(first.batches.length, `no partial public events`).toBe(
-            beforeFailure,
-          )
-          expect(observers).toHaveLength(1)
-          if (failureAt === `flush`) expect(flushReached).toBe(true)
-        } else {
-          move()
-          if (subscribeAt === `after-preload`) observe(query.get(1)!.children)
-          expect(ids(first), `retired route`).toEqual([])
-          expect(ids(observers[1]!), `destination subscription`).toEqual([20])
-        }
-
-        // Keep the external subscriptions alive across cleanup. They belong to
-        // the old graph, not the next graph created by preload on this query.
-        await query.cleanup()
-        const oldObservers = [...observers]
-        const oldBatches = oldObservers.map(
-          (observer) => observer.batches.length,
-        )
-        failing = false
-        await query.preload()
-        if (subscribeAt === `after-preload`) observe(query.get(1)!.children)
-        expect(observers).toHaveLength(oldObservers.length + 1)
-        expect(query.get(1)!.groupId, `restart uses current source`).toBe(2)
-        const restarted = observers.at(-1)!
-        expect(ids(restarted), `restart subscription snapshot`).toEqual([20])
-        children.write(`insert`, { id: 22, groupId: 2 })
-        expect(ids(restarted), `restart live insert`).toEqual([20, 22])
-        expect(
-          oldObservers.map((observer) => observer.batches.length),
-          `old graph receives no fresh events`,
-        ).toEqual(oldBatches)
-        for (const observer of oldObservers) {
-          expect(
-            observer.view.toArray,
-            `old graph exposes no fresh rows`,
-          ).toEqual([])
-        }
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        failing = false
-        await cleanupAfterOracle(primaryFailure, [
-          () => flush?.mockRestore(),
-          ...releases,
-          () => query.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  const readSurfaces = [
-    `toArray`,
-    `get`,
-    `has`,
-    `size`,
-    `keys`,
-    `values`,
-    `entries`,
-    `iterator`,
-    `forEach`,
-    `map`,
-    `state`,
-    `virtual-key`,
-    `virtual-metadata`,
-    `index`,
-  ] as const
-  it.each(
-    readSurfaces.flatMap((surface) =>
-      [false, true].map((ordered) => ({ surface, ordered })),
-    ),
-  )(
-    `keeps published $surface reads live (ordered=$ordered)`,
-    async ({ surface, ordered }) => {
-      const parents = createControlledCollection(`read-api-parent`, [
-        { id: 1, groupId: 1 },
-      ])
-      const children = createControlledCollection(`read-api-child`, [
-        { id: 10, groupId: 1 },
-        { id: 11, groupId: 1 },
-        { id: 20, groupId: 2 },
-        { id: 21, groupId: 2 },
-      ])
-      const readers = new Map<
-        number,
-        (keys: Array<number>) => Array<number | string>
-      >()
-      const retainedIndexReaders = new Map<
-        number,
-        (keys: Array<number>) => Array<number | string>
-      >()
-      const query = createLiveQueryCollection((q) =>
-        q
-          .from({
-            row: q.from({ parent: parents.collection }).select(({ parent }) => {
-              const childQuery = q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.groupId, parent.groupId))
-              return {
-                id: parent.id,
-                groupId: parent.groupId,
-                children: include(
-                  ordered
-                    ? childQuery.orderBy(({ child }) => child.id, `desc`)
-                    : childQuery,
-                ),
-              }
-            }),
-          })
-          .select(({ row }) => row),
-      )
-      const capture = (row: NonNullable<ReturnType<typeof query.get>>) => {
-        const view = row.children
-        const expectedKeys = [row.groupId * 10, row.groupId * 10 + 1]
-        const createIndex = view.createIndex.bind(view)
-        if (surface === `index`) {
-          const retainedIndex = createIndex((child) => child.id, {
-            indexType: BasicIndex,
-          })
-          retainedIndexReaders.set(row.groupId, (keys) =>
-            keys.flatMap((key) => [...retainedIndex.lookup(`eq`, key)]),
-          )
-        }
-        const read = (keys: Array<number>) => {
-          let ids: Array<number | string>
-          switch (surface) {
-            case `toArray`:
-              ids = view.toArray.map((child) => child.id)
-              break
-            case `get`:
-              ids = keys.flatMap((key) => view.get(key)?.id ?? [])
-              break
-            case `has`:
-              ids = keys.filter((key) => view.has(key))
-              break
-            case `size`:
-              ids = [view.size]
-              break
-            case `keys`:
-              ids = [...view.keys()]
-              break
-            case `values`:
-              ids = [...view.values()].map((child) => child.id)
-              break
-            case `entries`:
-              ids = [...view.entries()].map(([key]) => key)
-              break
-            case `iterator`:
-              ids = [...view].map(([key]) => key)
-              break
-            case `forEach`:
-              ids = []
-              view.forEach((child) => ids.push(child.id))
-              break
-            case `map`:
-              ids = view.map((child) => child.id)
-              break
-            case `state`:
-              ids = [...view.state.keys()]
-              break
-            case `virtual-key`:
-              ids = view.toArray.map((child) => child.$key)
-              break
-            case `virtual-metadata`:
-              ids = view.toArray.map((child) => {
-                expect(child.$collectionId).toBe(children.collection.id)
-                expect(child.$synced).toBe(true)
-                expect(child.$origin).toBe(`remote`)
-                return child.id
-              })
-              break
-            case `index`: {
-              const index = createIndex((child) => child.id, {
-                indexType: BasicIndex,
-              })
-              ids = keys.flatMap((key) => [...index.lookup(`eq`, key)])
-              break
-            }
-          }
-          return ids
-        }
-        readers.set(row.groupId, read)
-        const ids = read(expectedKeys)
-        return { id: row.id, ids, children: view }
-      }
-      const expected = (group: number) => {
-        if (surface === `size`) return [2]
-        const ids = [group * 10, group * 10 + 1]
-        return ordered && ![`get`, `has`, `index`].includes(surface)
-          ? ids.reverse()
-          : ids
-      }
-      const checkPublished = (
-        group: number,
-        ids: Array<number>,
-        phase: string,
-      ) => {
-        const actual = readers.get(group)!([
-          group * 10,
-          group * 10 + 1,
-          group * 10 + 2,
-        ])
-        const result =
-          surface === `size`
-            ? [ids.length]
-            : ordered && ![`get`, `has`, `index`].includes(surface)
-              ? [...ids].reverse()
-              : ids
-        expect.soft(actual, phase).toEqual(result)
-        if (surface === `index`) {
-          const readRetained = retainedIndexReaders.get(group)
-          expect(readRetained, `${phase}: retained index reader`).toBeDefined()
-          expect
-            .soft(
-              readRetained!([group * 10, group * 10 + 1, group * 10 + 2]),
-              `${phase}: retained index`,
-            )
-            .toEqual(result)
-        }
-      }
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        await query.preload()
-        const initialRead = capture(query.get(1)!)
-        checkPublished(1, [10, 11], `initial published read`)
-        expect
-          .soft(initialRead.ids, `initial published input`)
-          .toEqual(expected(1))
-        parents.write(`update`, { id: 1, groupId: 2 })
-        const movedRead = capture(query.get(1)!)
-        expect.soft(movedRead.ids, `moved published input`).toEqual(expected(2))
-        checkPublished(1, [], `retired route read`)
-        checkPublished(2, [20, 21], `moved published read`)
-        const held = query.get(1)!.children
-        children.write(`insert`, { id: 22, groupId: 2 })
-        expect(held.toArray.map((child) => child.id)).toEqual(
-          ordered ? [22, 21, 20] : [20, 21, 22],
-        )
-        checkPublished(1, [], `retired route ignores later insert`)
-        checkPublished(2, [20, 21, 22], `published insertion read`)
-        children.write(`delete`, { id: 21, groupId: 2 })
-        checkPublished(2, [20, 22], `published deletion read`)
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => query.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  it.each([`expression`, `plain`, `opaque`, `closure`] as const)(
-    `keeps retained views live across a same-route parent update through a %s holder`,
-    async (holder) => {
-      const parents = createControlledCollection(`facade-identity-parent`, [
-        { id: 1, groupId: 1, label: `first` },
-        { id: 2, groupId: 1, label: `second` },
-      ])
-      const childSource = createControlledCollection(`facade-identity-child`, [
-        { id: 10, groupId: 1 },
-      ])
-      class Holder<T> {
-        constructor(readonly children: T) {}
-      }
-      const query = createLiveQueryCollection((q) => {
-        const source = q.from({
-          row: q.from({ parent: parents.collection }).select(({ parent }) => ({
-            id: parent.id,
-            label: parent.label,
-            children: include(
-              q
-                .from({ child: childSource.collection })
-                .where(({ child }) => eq(child.groupId, parent.groupId)),
-            ),
-          })),
-        })
-        return source.select(({ row }) => ({
-          id: row.id,
-          label: row.label,
-          box: { children: row.children },
-        }))
-      })
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        await query.preload()
-        const childrenAtPublication = query.get(1)!.box.children
-        const retained =
-          holder === `opaque`
-            ? new Holder(childrenAtPublication)
-            : holder === `closure`
-              ? {
-                  get children() {
-                    return childrenAtPublication
-                  },
-                }
-              : { children: childrenAtPublication }
-        const held = retained.children
-        expect
-          .soft(
-            held.toArray.map((child) => child.id),
-            `initial rows`,
-          )
-          .toEqual([10])
-        expect
-          .soft(query.get(2)!.box.children, `initial shared identity`)
-          .toBe(held)
-        parents.write(`update`, { id: 1, groupId: 1, label: `changed` })
-        expect
-          .soft(query.get(1)!.label, `parent update is visible`)
-          .toBe(`changed`)
-        expect(query.get(1)!.box.children).toBe(held)
-        expect
-          .soft(
-            query.get(2)!.box.children,
-            `unchanged parent keeps shared facade`,
-          )
-          .toBe(held)
-        childSource.write(`insert`, { id: 11, groupId: 1 })
-        for (const facade of [
-          held,
-          query.get(1)!.box.children,
-          query.get(2)!.box.children,
-        ]) {
-          expect
-            .soft(
-              facade.toArray.map((child) => child.id).sort(),
-              `retained view stays live`,
-            )
-            .toEqual([10, 11])
-        }
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => query.cleanup(),
-          () => parents.collection.cleanup(),
-          () => childSource.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  it.each([`rows`, `index`, `callback-read`, `captured-method`] as const)(
-    `keeps held facade %s unchanged when a parent projection throws`,
-    async (surface) => {
-      const parents = createControlledCollection(`snapshot-parent`, [
-        { id: 1, groupId: 1 },
-      ])
-      const children = createControlledCollection(`snapshot-child`, [
-        { id: 10, groupId: 1 },
-        { id: 20, groupId: 2 },
-      ])
-      const failure = new Error(`parent projection failed`)
-      let fail = false
-      let readPublished: (() => Array<number>) | undefined
-      let capturedGet: ((key: number) => { id: number } | undefined) | undefined
-      let observed: Array<number> | undefined
-      const query = createLiveQueryCollection((q) => {
-        const projected = q
-          .from({ parent: parents.collection })
-          .fn.select(({ parent }) => {
-            if (fail) {
-              observed = readPublished?.()
-              throw failure
-            }
-            return parent
-          })
-        return q.from({ row: projected }).select(({ row }) => ({
-          id: row.id,
-          children: include(
-            q
-              .from({ child: children.collection })
-              .where(({ child }) => eq(child.groupId, row.groupId)),
-          ),
-        }))
-      })
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        await query.preload()
-        const original = query.get(1)!
-        const held = original.children
-        capturedGet = held.get.bind(held)
-        readPublished = () =>
-          surface === `captured-method`
-            ? [capturedGet?.(10)?.id].filter((id) => id !== undefined)
-            : held.toArray.map((child) => child.id)
-        const index = held.createIndex((child) => child.id, {
-          indexType: BasicIndex,
-        })
-        expect(held.toArray.map((child) => child.id)).toEqual([10])
-        expect(index.lookup(`eq`, 10)).toEqual(new Set([10]))
-        fail = true
-        expect(() => parents.write(`update`, { id: 1, groupId: 2 })).toThrow(
-          failure,
-        )
-        expect(query.get(1)).toBe(original)
-        if (surface === `rows`) {
-          expect(held.toArray.map((child) => child.id)).toEqual([10])
-        } else if (surface === `index`) {
-          expect(index.lookup(`eq`, 10)).toEqual(new Set([10]))
-          expect(index.lookup(`eq`, 20)).toEqual(new Set())
-        } else {
-          expect(observed).toEqual([10])
-          if (surface === `captured-method`)
-            expect(capturedGet(20)).toBeUndefined()
-        }
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => query.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  it.each([false, true])(
-    `preserves projection through public-facade changes and parent restoration (reads=%s)`,
-    async (readsFacade) => {
-      const parents = createControlledCollection(`published-parent`, [
-        { id: 1 },
-      ])
-      const children = createControlledCollection(`published-child`, [
-        { id: 10, parentId: 1 },
-      ])
-      const source = createLiveQueryCollection((q) =>
-        q.from({ parent: parents.collection }).select(({ parent }) => ({
-          id: parent.id,
-          children: include(
-            q
-              .from({ child: children.collection })
-              .where(({ child }) => eq(child.parentId, parent.id)),
-          ),
-        })),
-      )
-      const projected = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .fn.select(({ row }) => {
-            const count = readsFacade
-              ? readChildren(row.children, `collection`).rows.length
-              : 1
-            return { id: row.id, count }
-          })
-          .distinct(),
-      )
-      const rows = () =>
-        projected.toArray.map(({ id, count }) => ({ id, count }))
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        await source.preload()
-        await projected.preload()
-        expect(rows()).toEqual([{ id: 1, count: 1 }])
-        children.write(`insert`, { id: 11, parentId: 1 })
-        expect(
-          readChildren(source.toArray[0]?.children, `collection`).rows,
-        ).toHaveLength(2)
-        // A stable facade does not make its scalar reads child dependencies.
-        expect(rows()).toEqual([{ id: 1, count: 1 }])
-        parents.write(`delete`, { id: 1 })
-        expect(rows()).toEqual([])
-        children.write(`delete`, { id: 11, parentId: 1 })
-        parents.write(`insert`, { id: 1 })
-        expect(rows()).toEqual([{ id: 1, count: 1 }])
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => projected.cleanup(),
-          () => source.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
   it(`covers the declared output and renamed-field products`, () => {
     expect(valueCells).toHaveLength(48)
     expect(renamedCells).toHaveLength(24)
@@ -1077,17 +196,7 @@ describe(`functional projection output compatibility`, () => {
       }
       const live = buildQuery()
       const check = () => {
-        let expected = [...expectedScores].map(([id, score]) => ({ id, score }))
-        if (operator === `distinct`)
-          expected = [...new Set(expected.map((row) => row.score))].map(
-            (score) => ({ id: 0, score }),
-          )
-        if (operator === `selected-order`)
-          expected = expected
-            .sort(
-              (left, right) => right.score - left.score || left.id - right.id,
-            )
-            .slice(0, 1)
+        const expected = expectedOperatorRows(expectedScores, operator)
         const sort = (rows: Array<{ id: number; score: number }>) =>
           rows.sort(
             (left, right) => left.id - right.id || left.score - right.score,
@@ -1134,135 +243,6 @@ describe(`functional projection output compatibility`, () => {
     },
   )
 
-  it.each(valueCells)(
-    `$form / $consumer / $shape / include=$withInclude preserves arbitrary output`,
-    async ({ form, consumer, shape, withInclude }) => {
-      const parents = createControlledCollection(`output-parent`, [
-        { id: 1, value: 2 },
-      ])
-      const children = createControlledCollection(`output-child`, [
-        { id: 10, parentId: 1 },
-      ])
-      let expectedValue = 2
-      const assertValue = (value: unknown, expected?: number) => {
-        switch (shape) {
-          case `number`:
-            expect.soft(typeof value).toBe(`number`)
-            if (expected !== undefined) expect.soft(value).toBe(expected)
-            break
-          case `null`:
-            expect.soft(value).toBeNull()
-            break
-          case `date`:
-            expect.soft(value instanceof Date).toBe(true)
-            if (expected !== undefined && value instanceof Date)
-              expect.soft(value.getTime()).toBe(expected * 1000)
-            break
-          case `dropped-record`:
-            expect.soft(value !== null && typeof value === `object`).toBe(true)
-            if (value !== null && typeof value === `object`) {
-              // Virtual properties are public metadata. Check the selected field
-              // and forbid leaked input fields without imposing a new metadata
-              // contract on virtual properties.
-              expect
-                .soft(Object.keys(value).filter((key) => !key.startsWith(`$`)))
-                .toEqual([`code`])
-              expect.soft(`children` in value || `row` in value).toBe(false)
-              expect.soft(`code` in value).toBe(true)
-              if (expected !== undefined && `code` in value)
-                expect.soft(value.code).toBe(expected)
-            }
-        }
-      }
-      const buildQuery = () =>
-        createLiveQueryCollection((q) => {
-          const source = q
-            .from({ parent: parents.collection })
-            .select(({ parent }) => {
-              const childRows = q
-                .from({ child: children.collection })
-                .where(({ child }) => eq(child.parentId, parent.id))
-              return {
-                id: parent.id,
-                value: parent.value,
-                ...(withInclude
-                  ? {
-                      children:
-                        form === `collection`
-                          ? include(childRows)
-                          : form === `array`
-                            ? toArray(childRows)
-                            : materialize(childRows),
-                    }
-                  : {}),
-              }
-            })
-          const projected = q.from({ row: source }).fn.select(({ row }) => {
-            switch (shape) {
-              case `number`:
-                return row.value
-              case `null`:
-                return null
-              case `date`:
-                return new Date(row.value * 1000)
-              case `dropped-record`:
-                return { code: row.value }
-            }
-          })
-          const outer = q.from({ result: projected })
-          return consumer === `expression`
-            ? outer.select(({ result }) => ({ value: result }))
-            : outer.fn.select(({ result }) => {
-                // Observe the value on entry, including retract callbacks. Those
-                // may carry an earlier value, but must still have its proper type.
-                assertValue(result)
-                return { value: result }
-              })
-        })
-      if (rejectsCollectionInput(form, withInclude)) {
-        let primaryFailure: unknown = noPrimaryFailure
-        try {
-          expect(buildQuery).toThrow(collectionInputError)
-        } catch (error) {
-          primaryFailure = error
-          throw error
-        } finally {
-          await cleanupAfterOracle(primaryFailure, [
-            () => parents.collection.cleanup(),
-            () => children.collection.cleanup(),
-          ])
-        }
-        return
-      }
-      const live = buildQuery()
-      const check = () => {
-        expect.soft(live.toArray).toHaveLength(1)
-        assertValue(live.toArray[0]?.value, expectedValue)
-      }
-      let primaryFailure: unknown = noPrimaryFailure
-      try {
-        await live.preload()
-        check()
-        children.write(`insert`, { id: 11, parentId: 1 })
-        check()
-        expectedValue = 4
-        parents.write(`update`, { id: 1, value: expectedValue })
-        check()
-        parents.write(`delete`, { id: 1, value: expectedValue })
-        expect.soft(live.toArray).toEqual([])
-      } catch (error) {
-        primaryFailure = error
-        throw error
-      } finally {
-        await cleanupAfterOracle(primaryFailure, [
-          () => live.cleanup(),
-          () => parents.collection.cleanup(),
-          () => children.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
   it.each(renamedCells)(
     `$form / $projection / $consumer / sibling=$withSibling materializes inputs before renaming them`,
     async ({ form, consumer, projection, withSibling }) => {
@@ -1389,13 +369,9 @@ describe(`functional projection output compatibility`, () => {
         const row = live.toArray[0]?.value
         expect.soft(live.toArray, `${phase}: row count`).toHaveLength(1)
         expect.soft(row?.id, `${phase}: public id`).toBe(1)
-        const expectedPrimary = publicRows(
-          [...truth.values()].filter((child) => child.parentGroup === group),
-        )
+        const expectedPrimary = expectedGroupChildren(truth, group)
         const expectedSibling = withSibling
-          ? publicRows(
-              [...truth.values()].filter((child) => child.parentGroup === 2),
-            )
+          ? expectedGroupChildren(truth, 2)
           : []
         for (const [value, expected] of [
           [row?.renamed.primary, expectedPrimary],
@@ -1496,77 +472,6 @@ describe(`functional projection output compatibility`, () => {
 })
 
 describe(`functional include projection boundary grammar`, () => {
-  it(`preserves a scalar result when a functional projection drops its include`, async () => {
-    const parents = createControlledCollection(`scalar-projection-parent`, [
-      { id: 1 },
-    ])
-    const children = createControlledCollection(`scalar-projection-child`, [
-      { id: 10, parentId: 1 },
-    ])
-    const live = createLiveQueryCollection((q) => {
-      const included = q
-        .from({ parent: parents.collection })
-        .select(({ parent }) => ({
-          id: parent.id,
-          children: toArray(
-            q
-              .from({ child: children.collection })
-              .where(({ child }) => eq(child.parentId, parent.id)),
-          ),
-        }))
-      const scalar = q.from({ row: included }).fn.select(({ row }) => row.id)
-      return q
-        .from({ result: scalar })
-        .select(({ result }) => ({ value: result }))
-    })
-    let primaryFailure: unknown = noPrimaryFailure
-    try {
-      await live.preload()
-      expect(live.toArray.map((row) => row.value)).toEqual([1])
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      await cleanupAfterOracle(primaryFailure, [
-        () => live.cleanup(),
-        () => parents.collection.cleanup(),
-        () => children.collection.cleanup(),
-      ])
-    }
-  })
-
-  it(`preserves opaque-root fields without include materialization`, async () => {
-    const parents = createControlledCollection(`opaque-root-control`, [
-      { id: 1 },
-    ])
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ parent: parents.collection })
-        .fn.select(
-          ({ parent }) => new Projection(parent.id, `plain`, undefined, 0),
-        ),
-    )
-    let primaryFailure: unknown = noPrimaryFailure
-    try {
-      await live.preload()
-      expect(live.toArray).toHaveLength(1)
-      const row = live.toArray[0]
-      expect(row?.id).toBe(1)
-      expect(row?.kind).toBe(`plain`)
-      expect(row?.total).toBe(0)
-      // Collection root records already flatten prototypes without includes.
-      // This matrix checks their fields, not a new prototype-preservation API.
-    } catch (error) {
-      primaryFailure = error
-      throw error
-    } finally {
-      await cleanupAfterOracle(primaryFailure, [
-        () => live.cleanup(),
-        () => parents.collection.cleanup(),
-      ])
-    }
-  })
-
   it(`covers every declared boundary product without duplicate cells`, () => {
     expect(cells).toHaveLength(54)
     expect(new Set(cells.map((cell) => JSON.stringify(cell))).size).toBe(54)
@@ -1712,9 +617,7 @@ describe(`functional include projection boundary grammar`, () => {
         )
         expect.soft(row, `${phase}: included public row`).toBeDefined()
         if (!row) return
-        const expected = publicRows(
-          [...truth.values()].filter((item) => item.parentGroup === group),
-        )
+        const expected = expectedGroupChildren(truth, group)
         const view = readChildren(row.children, form)
         expect.soft(view.valid, `${phase}: public include form`).toBe(true)
         expect
diff --git a/packages/db/tests/query/includes-functional-projection-support.ts b/packages/db/tests/query/includes-functional-projection-support.ts
new file mode 100644
index 0000000000..3831a4907a
--- /dev/null
+++ b/packages/db/tests/query/includes-functional-projection-support.ts
@@ -0,0 +1,139 @@
+// Shared helpers and finite cell grammars for the functional projection tests.
+// The law these support: functional projection contract in
+// packages/db/src/query/live/ARCHITECTURE.md. The oracle that owns the law is
+// includes-functional-projection-oracle.test.ts; the ordinary tests are in
+// includes-functional-projection.test.ts.
+
+export const boundaries = [`query-ref`, `recursive-query-ref`, `union`] as const
+export const forms = [`collection`, `array`, `materialized`] as const
+export const outputs = [`expression`, `record`, `opaque-root`] as const
+export const initialStates = [`empty`, `populated`] as const
+export const cells = boundaries.flatMap((boundary) =>
+  forms.flatMap((form) =>
+    outputs.flatMap((output) =>
+      initialStates.map((initial) => ({ boundary, form, output, initial })),
+    ),
+  ),
+)
+export const orderedPairCells = cells
+  .filter(({ initial }) => initial === `populated`)
+  .map((cell) => ({ ...cell, initial: `ordered-pair` as const }))
+export const consumers = [`expression`, `functional`] as const
+export const valueShapes = [`number`, `null`, `date`, `dropped-record`] as const
+export const valueCells = forms.flatMap((form) =>
+  consumers.flatMap((consumer) =>
+    valueShapes.flatMap((shape) =>
+      [false, true].map((withInclude) => ({
+        form,
+        consumer,
+        shape,
+        withInclude,
+      })),
+    ),
+  ),
+)
+export const renamedCells = forms.flatMap((form) =>
+  consumers.flatMap((consumer) =>
+    consumers.flatMap((projection) =>
+      [false, true].map((withSibling) => ({
+        form,
+        consumer,
+        projection,
+        withSibling,
+      })),
+    ),
+  ),
+)
+export const operatorCells = forms.flatMap((form) =>
+  ([`custom-key`, `selected-order`, `distinct`] as const).flatMap((operator) =>
+    [false, true].map((readsInclude) => ({ form, operator, readsInclude })),
+  ),
+)
+
+export type Child = { id: number; parentGroup: number; value: number }
+export type Input = { id: number; kind: string; children?: unknown }
+// Phase labels name this oracle's observation cuts. They do not model D2 phases.
+export type Phase = `initial` | `child-update` | `sibling-update` | `route-move`
+export type ChildView = {
+  valid: boolean
+  ready: boolean | undefined
+  rows: Array<Child>
+}
+
+export function readChildren(
+  value: unknown,
+  form: (typeof forms)[number],
+): ChildView {
+  if (form !== `collection`) {
+    return {
+      valid: Array.isArray(value),
+      ready: undefined,
+      rows: Array.isArray(value) ? value : [],
+    }
+  }
+  if (
+    typeof value !== `object` ||
+    value === null ||
+    !(`toArray` in value) ||
+    !(`isReady` in value) ||
+    typeof value.isReady !== `function`
+  ) {
+    return { valid: false, ready: undefined, rows: [] }
+  }
+  return {
+    valid: Array.isArray(value.toArray),
+    ready: value.isReady(),
+    rows: Array.isArray(value.toArray) ? value.toArray : [],
+  }
+}
+
+// Keep only the selected public fields in row comparisons. Other assertions
+// check callback-time shape and facade readiness.
+export function selectedRows(rows: ReadonlyArray<Child>) {
+  return rows.map(({ id, parentGroup, value }) => ({ id, parentGroup, value }))
+}
+
+export function publicRows(rows: ReadonlyArray<Child>) {
+  return selectedRows(rows).sort((left, right) => left.id - right.id)
+}
+
+export const collectionInputError = `fn.select() cannot consume Collection-valued includes`
+export function rejectsCollectionInput(
+  form: string,
+  ...functional: Array<boolean>
+): boolean {
+  return form === `collection` && functional.some(Boolean)
+}
+
+export const noPrimaryFailure = Symbol(`no primary oracle failure`)
+
+// Run every release even when an earlier one fails. If the oracle already
+// failed, keep that mismatch as the cause and report cleanup separately.
+export async function cleanupAfterOracle(
+  primaryFailure: unknown,
+  releases: ReadonlyArray<() => void | Promise<void>>,
+): Promise<void> {
+  const cleanupFailures: Array<unknown> = []
+  for (const release of releases) {
+    try {
+      await release()
+    } catch (error) {
+      cleanupFailures.push(error)
+    }
+  }
+  if (cleanupFailures.length === 0) return
+  if (primaryFailure === noPrimaryFailure && cleanupFailures.length === 1)
+    throw cleanupFailures[0]
+  throw new AggregateError(cleanupFailures, `oracle cleanup failed`, {
+    ...(primaryFailure === noPrimaryFailure ? {} : { cause: primaryFailure }),
+  })
+}
+
+export class Projection {
+  constructor(
+    readonly id: number,
+    readonly kind: string,
+    readonly children: unknown,
+    readonly total: number,
+  ) {}
+}
diff --git a/packages/db/tests/query/includes-functional-projection.test.ts b/packages/db/tests/query/includes-functional-projection.test.ts
new file mode 100644
index 0000000000..20133a016a
--- /dev/null
+++ b/packages/db/tests/query/includes-functional-projection.test.ts
@@ -0,0 +1,1036 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { BasicIndex } from '../../src/indexes/basic-index.js'
+import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  include,
+  materialize,
+  toArray,
+} from '../../src/query/index.js'
+import { flushPromises } from '../utils.js'
+import { createControlledCollection } from './includes-oracle-helpers.js'
+import {
+  Projection,
+  cleanupAfterOracle,
+  collectionInputError,
+  noPrimaryFailure,
+  readChildren,
+  rejectsCollectionInput,
+  valueCells,
+} from './includes-functional-projection-support.js'
+
+// Ordinary functional projection tests. They compare production with written
+// values: a fixed lifecycle, a cleanup machinery check, read surfaces, facade
+// identity, and value output. The law owner is
+// includes-functional-projection-oracle.test.ts, which keeps the model-based
+// cells and the grammar calibration.
+
+describe(`functional projection output compatibility`, () => {
+  it(`retains the first mismatch and all cleanup failures`, async () => {
+    const primary = new Error(`public result mismatch`)
+    const firstCleanup = new Error(`first cleanup failed`)
+    const secondCleanup = new Error(`second cleanup failed`)
+    const released: Array<number> = []
+    let reported: unknown
+    let primaryFailure: unknown = noPrimaryFailure
+    try {
+      try {
+        throw primary
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => {
+            released.push(1)
+            throw firstCleanup
+          },
+          () => {
+            released.push(2)
+            throw secondCleanup
+          },
+          () => {
+            released.push(3)
+          },
+        ])
+      }
+    } catch (error) {
+      reported = error
+    }
+    expect(released).toEqual([1, 2, 3])
+    expect(reported).toBeInstanceOf(AggregateError)
+    expect((reported as AggregateError).cause).toBe(primary)
+    expect((reported as AggregateError).errors).toEqual([
+      firstCleanup,
+      secondCleanup,
+    ])
+  })
+
+  it.each(
+    ([`expression`, `functional`] as const).flatMap((projection) =>
+      ([`resolve`, `reject`, `cleanup-resolve`, `cleanup-reject`] as const).map(
+        (settlement) => ({ projection, settlement }),
+      ),
+    ),
+  )(
+    `$projection projection fences $settlement of a pending child load`,
+    async ({ projection, settlement }) => {
+      const parents = createControlledCollection(`pending-parent`, [
+        { id: 1, groupId: 1 },
+      ])
+      const requests: Array<{
+        gate: ReturnType<typeof createDeferred<void>>
+        signal: AbortSignal | undefined
+      }> = []
+      const children = createCollection<{ id: number; groupId: number }>({
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => ({
+            loadSubset: ({ signal }) => {
+              const gate = createDeferred<void>()
+              requests.push({ gate, signal })
+              return gate.promise.then(async () => {
+                if (signal?.aborted) return
+                begin()
+                write({ type: `insert`, value: { id: 10, groupId: 1 } })
+                await commit()
+                markReady()
+              })
+            },
+          }),
+        },
+      })
+      const captured: Array<Pick<typeof children, `toArray`>> = []
+      const buildQuery = () =>
+        createLiveQueryCollection((q) => {
+          const source = q.from({
+            row: q
+              .from({ parent: parents.collection })
+              .select(({ parent }) => ({
+                id: parent.id,
+                children: include(
+                  q
+                    .from({ child: children })
+                    .where(({ child }) => eq(child.groupId, parent.groupId)),
+                ),
+              })),
+          })
+          return projection === `expression`
+            ? source.select(({ row }) => row)
+            : source.fn.select(({ row }) => {
+                captured.push(row.children)
+                return { id: row.id, children: row.children }
+              })
+        })
+      if (rejectsCollectionInput(`collection`, projection === `functional`)) {
+        let primaryFailure: unknown = noPrimaryFailure
+        try {
+          expect(buildQuery).toThrow(collectionInputError)
+          expect(captured).toEqual([])
+        } catch (error) {
+          primaryFailure = error
+          throw error
+        } finally {
+          await cleanupAfterOracle(primaryFailure, [
+            () => parents.collection.cleanup(),
+            () => children.cleanup(),
+          ])
+        }
+        return
+      }
+      const query = buildQuery()
+      const failure = new Error(`pending child failed`)
+      // Attach both outcomes immediately. A pending-length assertion must not
+      // leave a rejected preload promise unobserved.
+      const preload = () => {
+        const result: { settled: boolean; error?: unknown } = { settled: false }
+        const observed = query.preload().then(
+          () => {
+            result.settled = true
+          },
+          (error) => {
+            result.settled = true
+            result.error = error
+          },
+        )
+        return { result, observed }
+      }
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        const initial = preload()
+        await flushPromises()
+        expect(requests).toHaveLength(1)
+        expect(initial.result.settled).toBe(false)
+        expect(query.isReady()).toBe(false)
+        const held = query.get(1)!.children
+        expect(held.toArray).toEqual([])
+        if (projection === `functional`) expect(captured).toHaveLength(1)
+        const obsoleteViews = [...captured, held]
+
+        if (settlement.startsWith(`cleanup`)) {
+          await query.cleanup()
+          await children.cleanup()
+          await initial.observed
+          expect(initial.result.error).toMatchObject({ name: `AbortError` })
+          expect(requests[0]!.signal?.aborted).toBe(true)
+          const restarted = preload()
+          await flushPromises()
+          expect(requests).toHaveLength(2)
+          const current = query.get(1)!.children
+          if (settlement === `cleanup-reject`) requests[0]!.gate.reject(failure)
+          else requests[0]!.gate.resolve()
+          await flushPromises()
+          expect(
+            restarted.result.settled,
+            `obsolete completion cannot finish preload`,
+          ).toBe(false)
+          expect(query.isReady()).toBe(false)
+          expect(current.toArray).toEqual([])
+          requests[1]!.gate.resolve()
+          await restarted.observed
+          expect(restarted.result.error).toBeUndefined()
+          expect(query.isReady()).toBe(true)
+          expect(current.toArray.map((child) => child.id)).toEqual([10])
+          for (const view of obsoleteViews) expect(view.toArray).toEqual([])
+        } else {
+          if (settlement === `reject`) requests[0]!.gate.reject(failure)
+          else requests[0]!.gate.resolve()
+          await initial.observed
+          if (settlement === `reject`) {
+            expect(initial.result.error).toBe(failure)
+            expect(query.isReady()).toBe(false)
+            expect(held.toArray).toEqual([])
+          } else {
+            expect(initial.result.error).toBeUndefined()
+            expect(query.isReady()).toBe(true)
+            expect(held.toArray.map((child) => child.id)).toEqual([10])
+            for (const view of captured)
+              expect(view.toArray.map((child) => child.id)).toEqual([10])
+          }
+        }
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => query.cleanup(),
+          ...requests.map(({ gate }) => gate.resolve),
+          () => children.cleanup(),
+          () => parents.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  it.each(
+    ([`publication`, `after-preload`] as const).flatMap((subscribeAt) =>
+      ([`none`, `callback`, `flush`] as const).map((failureAt) => ({
+        subscribeAt,
+        failureAt,
+      })),
+    ),
+  )(
+    `keeps $subscribeAt subscriptions isolated through $failureAt failure and restart`,
+    async ({ subscribeAt, failureAt }) => {
+      const parents = createControlledCollection(`subscription-parent`, [
+        { id: 1, groupId: 1 },
+      ])
+      const children = createControlledCollection(`subscription-child`, [
+        { id: 10, groupId: 1 },
+        { id: 20, groupId: 2 },
+      ])
+      const observers: Array<{
+        rows: Set<number>
+        batches: Array<Array<string>>
+        view: Pick<typeof children.collection, `toArray` | `subscribeChanges`>
+      }> = []
+      const releases: Array<() => void> = []
+      const observe = (view: (typeof observers)[number][`view`]) => {
+        const rows = new Set<number>()
+        const batches: Array<Array<string>> = []
+        const subscription = view.subscribeChanges(
+          (changes) => {
+            batches.push(
+              changes.map((change) => `${change.type}:${change.value.id}`),
+            )
+            for (const change of changes) {
+              if (change.type === `delete`) rows.delete(change.value.id)
+              else rows.add(change.value.id)
+            }
+          },
+          { includeInitialState: true },
+        )
+        releases.push(() => subscription.unsubscribe())
+        observers.push({ rows, batches, view })
+      }
+      const failure = new Error(`projection subscription ${failureAt} failure`)
+      let failing = false
+      let flushReached = false
+      const originalFlush = BucketFacadeAdapter.prototype.flush
+      // Fail after actual facade writes, before any deferred public events.
+      // An event-listener throw is asynchronous and would not test rollback.
+      const flush =
+        failureAt === `flush`
+          ? vi
+              .spyOn(BucketFacadeAdapter.prototype, `flush`)
+              .mockImplementation(function (this: BucketFacadeAdapter) {
+                const publication = originalFlush.call(this)
+                return {
+                  ...publication,
+                  prepare: () => {
+                    publication.prepare()
+                    if (failing) {
+                      flushReached = true
+                      throw failure
+                    }
+                  },
+                }
+              })
+          : undefined
+      const query = createLiveQueryCollection((q) => {
+        const projected = q
+          .from({ parent: parents.collection })
+          .fn.select(({ parent }) => {
+            if (failing && failureAt === `callback`) throw failure
+            return parent
+          })
+        return q.from({ row: projected }).select(({ row }) => ({
+          id: row.id,
+          groupId: row.groupId,
+          children: include(
+            q
+              .from({ child: children.collection })
+              .where(({ child }) => eq(child.groupId, row.groupId)),
+          ),
+        }))
+      })
+      if (subscribeAt === `publication`) {
+        const rootSubscription = query.subscribeChanges(
+          (changes) => {
+            for (const change of changes)
+              if (change.type !== `delete`) observe(change.value.children)
+          },
+          { includeInitialState: true },
+        )
+        releases.push(() => rootSubscription.unsubscribe())
+      }
+      const ids = (observer: (typeof observers)[number]) =>
+        [...observer.rows].sort((a, b) => a - b)
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        await query.preload()
+        if (subscribeAt === `after-preload`) observe(query.get(1)!.children)
+        const first = observers[0]!
+        expect(ids(first), `initial subscription snapshot`).toEqual([10])
+        children.write(`insert`, { id: 11, groupId: 1 })
+        expect(ids(first), `initial live insert`).toEqual([10, 11])
+        const originalRow = query.get(1)
+        const beforeFailure = first.batches.length
+        failing = failureAt !== `none`
+        const move = () => parents.write(`update`, { id: 1, groupId: 2 })
+        if (failing) {
+          let thrown: unknown
+          try {
+            move()
+          } catch (error) {
+            thrown = error
+          }
+          expect(thrown).toBe(failure)
+          expect(query.get(1), `root rollback`).toBe(originalRow)
+          expect(ids(first), `old subscriber rollback`).toEqual([10, 11])
+          expect(first.batches.length, `no partial public events`).toBe(
+            beforeFailure,
+          )
+          expect(observers).toHaveLength(1)
+          if (failureAt === `flush`) expect(flushReached).toBe(true)
+        } else {
+          move()
+          if (subscribeAt === `after-preload`) observe(query.get(1)!.children)
+          expect(ids(first), `retired route`).toEqual([])
+          expect(ids(observers[1]!), `destination subscription`).toEqual([20])
+        }
+
+        // Keep the external subscriptions alive across cleanup. They belong to
+        // the old graph, not the next graph created by preload on this query.
+        await query.cleanup()
+        const oldObservers = [...observers]
+        const oldBatches = oldObservers.map(
+          (observer) => observer.batches.length,
+        )
+        failing = false
+        await query.preload()
+        if (subscribeAt === `after-preload`) observe(query.get(1)!.children)
+        expect(observers).toHaveLength(oldObservers.length + 1)
+        expect(query.get(1)!.groupId, `restart uses current source`).toBe(2)
+        const restarted = observers.at(-1)!
+        expect(ids(restarted), `restart subscription snapshot`).toEqual([20])
+        children.write(`insert`, { id: 22, groupId: 2 })
+        expect(ids(restarted), `restart live insert`).toEqual([20, 22])
+        expect(
+          oldObservers.map((observer) => observer.batches.length),
+          `old graph receives no fresh events`,
+        ).toEqual(oldBatches)
+        for (const observer of oldObservers) {
+          expect(
+            observer.view.toArray,
+            `old graph exposes no fresh rows`,
+          ).toEqual([])
+        }
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        failing = false
+        await cleanupAfterOracle(primaryFailure, [
+          () => flush?.mockRestore(),
+          ...releases,
+          () => query.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  const readSurfaces = [
+    `toArray`,
+    `get`,
+    `has`,
+    `size`,
+    `keys`,
+    `values`,
+    `entries`,
+    `iterator`,
+    `forEach`,
+    `map`,
+    `state`,
+    `virtual-key`,
+    `virtual-metadata`,
+    `index`,
+  ] as const
+
+  it.each(
+    readSurfaces.flatMap((surface) =>
+      [false, true].map((ordered) => ({ surface, ordered })),
+    ),
+  )(
+    `keeps published $surface reads live (ordered=$ordered)`,
+    async ({ surface, ordered }) => {
+      const parents = createControlledCollection(`read-api-parent`, [
+        { id: 1, groupId: 1 },
+      ])
+      const children = createControlledCollection(`read-api-child`, [
+        { id: 10, groupId: 1 },
+        { id: 11, groupId: 1 },
+        { id: 20, groupId: 2 },
+        { id: 21, groupId: 2 },
+      ])
+      const readers = new Map<
+        number,
+        (keys: Array<number>) => Array<number | string>
+      >()
+      const retainedIndexReaders = new Map<
+        number,
+        (keys: Array<number>) => Array<number | string>
+      >()
+      const query = createLiveQueryCollection((q) =>
+        q
+          .from({
+            row: q.from({ parent: parents.collection }).select(({ parent }) => {
+              const childQuery = q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.groupId, parent.groupId))
+              return {
+                id: parent.id,
+                groupId: parent.groupId,
+                children: include(
+                  ordered
+                    ? childQuery.orderBy(({ child }) => child.id, `desc`)
+                    : childQuery,
+                ),
+              }
+            }),
+          })
+          .select(({ row }) => row),
+      )
+      const capture = (row: NonNullable<ReturnType<typeof query.get>>) => {
+        const view = row.children
+        const expectedKeys = [row.groupId * 10, row.groupId * 10 + 1]
+        const createIndex = view.createIndex.bind(view)
+        if (surface === `index`) {
+          const retainedIndex = createIndex((child) => child.id, {
+            indexType: BasicIndex,
+          })
+          retainedIndexReaders.set(row.groupId, (keys) =>
+            keys.flatMap((key) => [...retainedIndex.lookup(`eq`, key)]),
+          )
+        }
+        const read = (keys: Array<number>) => {
+          let ids: Array<number | string>
+          switch (surface) {
+            case `toArray`:
+              ids = view.toArray.map((child) => child.id)
+              break
+            case `get`:
+              ids = keys.flatMap((key) => view.get(key)?.id ?? [])
+              break
+            case `has`:
+              ids = keys.filter((key) => view.has(key))
+              break
+            case `size`:
+              ids = [view.size]
+              break
+            case `keys`:
+              ids = [...view.keys()]
+              break
+            case `values`:
+              ids = [...view.values()].map((child) => child.id)
+              break
+            case `entries`:
+              ids = [...view.entries()].map(([key]) => key)
+              break
+            case `iterator`:
+              ids = [...view].map(([key]) => key)
+              break
+            case `forEach`:
+              ids = []
+              view.forEach((child) => ids.push(child.id))
+              break
+            case `map`:
+              ids = view.map((child) => child.id)
+              break
+            case `state`:
+              ids = [...view.state.keys()]
+              break
+            case `virtual-key`:
+              ids = view.toArray.map((child) => child.$key)
+              break
+            case `virtual-metadata`:
+              ids = view.toArray.map((child) => {
+                expect(child.$collectionId).toBe(children.collection.id)
+                expect(child.$synced).toBe(true)
+                expect(child.$origin).toBe(`remote`)
+                return child.id
+              })
+              break
+            case `index`: {
+              const index = createIndex((child) => child.id, {
+                indexType: BasicIndex,
+              })
+              ids = keys.flatMap((key) => [...index.lookup(`eq`, key)])
+              break
+            }
+          }
+          return ids
+        }
+        readers.set(row.groupId, read)
+        const ids = read(expectedKeys)
+        return { id: row.id, ids, children: view }
+      }
+      const expected = (group: number) => {
+        if (surface === `size`) return [2]
+        const ids = [group * 10, group * 10 + 1]
+        return ordered && ![`get`, `has`, `index`].includes(surface)
+          ? ids.reverse()
+          : ids
+      }
+      const checkPublished = (
+        group: number,
+        ids: Array<number>,
+        phase: string,
+      ) => {
+        const actual = readers.get(group)!([
+          group * 10,
+          group * 10 + 1,
+          group * 10 + 2,
+        ])
+        const result =
+          surface === `size`
+            ? [ids.length]
+            : ordered && ![`get`, `has`, `index`].includes(surface)
+              ? [...ids].reverse()
+              : ids
+        expect.soft(actual, phase).toEqual(result)
+        if (surface === `index`) {
+          const readRetained = retainedIndexReaders.get(group)
+          expect(readRetained, `${phase}: retained index reader`).toBeDefined()
+          expect
+            .soft(
+              readRetained!([group * 10, group * 10 + 1, group * 10 + 2]),
+              `${phase}: retained index`,
+            )
+            .toEqual(result)
+        }
+      }
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        await query.preload()
+        const initialRead = capture(query.get(1)!)
+        checkPublished(1, [10, 11], `initial published read`)
+        expect
+          .soft(initialRead.ids, `initial published input`)
+          .toEqual(expected(1))
+        parents.write(`update`, { id: 1, groupId: 2 })
+        const movedRead = capture(query.get(1)!)
+        expect.soft(movedRead.ids, `moved published input`).toEqual(expected(2))
+        checkPublished(1, [], `retired route read`)
+        checkPublished(2, [20, 21], `moved published read`)
+        const held = query.get(1)!.children
+        children.write(`insert`, { id: 22, groupId: 2 })
+        expect(held.toArray.map((child) => child.id)).toEqual(
+          ordered ? [22, 21, 20] : [20, 21, 22],
+        )
+        checkPublished(1, [], `retired route ignores later insert`)
+        checkPublished(2, [20, 21, 22], `published insertion read`)
+        children.write(`delete`, { id: 21, groupId: 2 })
+        checkPublished(2, [20, 22], `published deletion read`)
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => query.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  it.each([`expression`, `plain`, `opaque`, `closure`] as const)(
+    `keeps retained views live across a same-route parent update through a %s holder`,
+    async (holder) => {
+      const parents = createControlledCollection(`facade-identity-parent`, [
+        { id: 1, groupId: 1, label: `first` },
+        { id: 2, groupId: 1, label: `second` },
+      ])
+      const childSource = createControlledCollection(`facade-identity-child`, [
+        { id: 10, groupId: 1 },
+      ])
+      class Holder<T> {
+        constructor(readonly children: T) {}
+      }
+      const query = createLiveQueryCollection((q) => {
+        const source = q.from({
+          row: q.from({ parent: parents.collection }).select(({ parent }) => ({
+            id: parent.id,
+            label: parent.label,
+            children: include(
+              q
+                .from({ child: childSource.collection })
+                .where(({ child }) => eq(child.groupId, parent.groupId)),
+            ),
+          })),
+        })
+        return source.select(({ row }) => ({
+          id: row.id,
+          label: row.label,
+          box: { children: row.children },
+        }))
+      })
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        await query.preload()
+        const childrenAtPublication = query.get(1)!.box.children
+        const retained =
+          holder === `opaque`
+            ? new Holder(childrenAtPublication)
+            : holder === `closure`
+              ? {
+                  get children() {
+                    return childrenAtPublication
+                  },
+                }
+              : { children: childrenAtPublication }
+        const held = retained.children
+        expect
+          .soft(
+            held.toArray.map((child) => child.id),
+            `initial rows`,
+          )
+          .toEqual([10])
+        expect
+          .soft(query.get(2)!.box.children, `initial shared identity`)
+          .toBe(held)
+        parents.write(`update`, { id: 1, groupId: 1, label: `changed` })
+        expect
+          .soft(query.get(1)!.label, `parent update is visible`)
+          .toBe(`changed`)
+        expect(query.get(1)!.box.children).toBe(held)
+        expect
+          .soft(
+            query.get(2)!.box.children,
+            `unchanged parent keeps shared facade`,
+          )
+          .toBe(held)
+        childSource.write(`insert`, { id: 11, groupId: 1 })
+        for (const facade of [
+          held,
+          query.get(1)!.box.children,
+          query.get(2)!.box.children,
+        ]) {
+          expect
+            .soft(
+              facade.toArray.map((child) => child.id).sort(),
+              `retained view stays live`,
+            )
+            .toEqual([10, 11])
+        }
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => query.cleanup(),
+          () => parents.collection.cleanup(),
+          () => childSource.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  it.each([`rows`, `index`, `callback-read`, `captured-method`] as const)(
+    `keeps held facade %s unchanged when a parent projection throws`,
+    async (surface) => {
+      const parents = createControlledCollection(`snapshot-parent`, [
+        { id: 1, groupId: 1 },
+      ])
+      const children = createControlledCollection(`snapshot-child`, [
+        { id: 10, groupId: 1 },
+        { id: 20, groupId: 2 },
+      ])
+      const failure = new Error(`parent projection failed`)
+      let fail = false
+      let readPublished: (() => Array<number>) | undefined
+      let capturedGet: ((key: number) => { id: number } | undefined) | undefined
+      let observed: Array<number> | undefined
+      const query = createLiveQueryCollection((q) => {
+        const projected = q
+          .from({ parent: parents.collection })
+          .fn.select(({ parent }) => {
+            if (fail) {
+              observed = readPublished?.()
+              throw failure
+            }
+            return parent
+          })
+        return q.from({ row: projected }).select(({ row }) => ({
+          id: row.id,
+          children: include(
+            q
+              .from({ child: children.collection })
+              .where(({ child }) => eq(child.groupId, row.groupId)),
+          ),
+        }))
+      })
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        await query.preload()
+        const original = query.get(1)!
+        const held = original.children
+        capturedGet = held.get.bind(held)
+        readPublished = () =>
+          surface === `captured-method`
+            ? [capturedGet?.(10)?.id].filter((id) => id !== undefined)
+            : held.toArray.map((child) => child.id)
+        const index = held.createIndex((child) => child.id, {
+          indexType: BasicIndex,
+        })
+        expect(held.toArray.map((child) => child.id)).toEqual([10])
+        expect(index.lookup(`eq`, 10)).toEqual(new Set([10]))
+        fail = true
+        expect(() => parents.write(`update`, { id: 1, groupId: 2 })).toThrow(
+          failure,
+        )
+        expect(query.get(1)).toBe(original)
+        if (surface === `rows`) {
+          expect(held.toArray.map((child) => child.id)).toEqual([10])
+        } else if (surface === `index`) {
+          expect(index.lookup(`eq`, 10)).toEqual(new Set([10]))
+          expect(index.lookup(`eq`, 20)).toEqual(new Set())
+        } else {
+          expect(observed).toEqual([10])
+          if (surface === `captured-method`)
+            expect(capturedGet(20)).toBeUndefined()
+        }
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => query.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  it.each([false, true])(
+    `preserves projection through public-facade changes and parent restoration (reads=%s)`,
+    async (readsFacade) => {
+      const parents = createControlledCollection(`published-parent`, [
+        { id: 1 },
+      ])
+      const children = createControlledCollection(`published-child`, [
+        { id: 10, parentId: 1 },
+      ])
+      const source = createLiveQueryCollection((q) =>
+        q.from({ parent: parents.collection }).select(({ parent }) => ({
+          id: parent.id,
+          children: include(
+            q
+              .from({ child: children.collection })
+              .where(({ child }) => eq(child.parentId, parent.id)),
+          ),
+        })),
+      )
+      const projected = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .fn.select(({ row }) => {
+            const count = readsFacade
+              ? readChildren(row.children, `collection`).rows.length
+              : 1
+            return { id: row.id, count }
+          })
+          .distinct(),
+      )
+      const rows = () =>
+        projected.toArray.map(({ id, count }) => ({ id, count }))
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        await source.preload()
+        await projected.preload()
+        expect(rows()).toEqual([{ id: 1, count: 1 }])
+        children.write(`insert`, { id: 11, parentId: 1 })
+        expect(
+          readChildren(source.toArray[0]?.children, `collection`).rows,
+        ).toHaveLength(2)
+        // A stable facade does not make its scalar reads child dependencies.
+        expect(rows()).toEqual([{ id: 1, count: 1 }])
+        parents.write(`delete`, { id: 1 })
+        expect(rows()).toEqual([])
+        children.write(`delete`, { id: 11, parentId: 1 })
+        parents.write(`insert`, { id: 1 })
+        expect(rows()).toEqual([{ id: 1, count: 1 }])
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => projected.cleanup(),
+          () => source.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  it.each(valueCells)(
+    `$form / $consumer / $shape / include=$withInclude preserves arbitrary output`,
+    async ({ form, consumer, shape, withInclude }) => {
+      const parents = createControlledCollection(`output-parent`, [
+        { id: 1, value: 2 },
+      ])
+      const children = createControlledCollection(`output-child`, [
+        { id: 10, parentId: 1 },
+      ])
+      let expectedValue = 2
+      const assertValue = (value: unknown, expected?: number) => {
+        switch (shape) {
+          case `number`:
+            expect.soft(typeof value).toBe(`number`)
+            if (expected !== undefined) expect.soft(value).toBe(expected)
+            break
+          case `null`:
+            expect.soft(value).toBeNull()
+            break
+          case `date`:
+            expect.soft(value instanceof Date).toBe(true)
+            if (expected !== undefined && value instanceof Date)
+              expect.soft(value.getTime()).toBe(expected * 1000)
+            break
+          case `dropped-record`:
+            expect.soft(value !== null && typeof value === `object`).toBe(true)
+            if (value !== null && typeof value === `object`) {
+              // Virtual properties are public metadata. Check the selected field
+              // and forbid leaked input fields without imposing a new metadata
+              // contract on virtual properties.
+              expect
+                .soft(Object.keys(value).filter((key) => !key.startsWith(`$`)))
+                .toEqual([`code`])
+              expect.soft(`children` in value || `row` in value).toBe(false)
+              expect.soft(`code` in value).toBe(true)
+              if (expected !== undefined && `code` in value)
+                expect.soft(value.code).toBe(expected)
+            }
+        }
+      }
+      const buildQuery = () =>
+        createLiveQueryCollection((q) => {
+          const source = q
+            .from({ parent: parents.collection })
+            .select(({ parent }) => {
+              const childRows = q
+                .from({ child: children.collection })
+                .where(({ child }) => eq(child.parentId, parent.id))
+              return {
+                id: parent.id,
+                value: parent.value,
+                ...(withInclude
+                  ? {
+                      children:
+                        form === `collection`
+                          ? include(childRows)
+                          : form === `array`
+                            ? toArray(childRows)
+                            : materialize(childRows),
+                    }
+                  : {}),
+              }
+            })
+          const projected = q.from({ row: source }).fn.select(({ row }) => {
+            switch (shape) {
+              case `number`:
+                return row.value
+              case `null`:
+                return null
+              case `date`:
+                return new Date(row.value * 1000)
+              case `dropped-record`:
+                return { code: row.value }
+            }
+          })
+          const outer = q.from({ result: projected })
+          return consumer === `expression`
+            ? outer.select(({ result }) => ({ value: result }))
+            : outer.fn.select(({ result }) => {
+                // Observe the value on entry, including retract callbacks. Those
+                // may carry an earlier value, but must still have its proper type.
+                assertValue(result)
+                return { value: result }
+              })
+        })
+      if (rejectsCollectionInput(form, withInclude)) {
+        let primaryFailure: unknown = noPrimaryFailure
+        try {
+          expect(buildQuery).toThrow(collectionInputError)
+        } catch (error) {
+          primaryFailure = error
+          throw error
+        } finally {
+          await cleanupAfterOracle(primaryFailure, [
+            () => parents.collection.cleanup(),
+            () => children.collection.cleanup(),
+          ])
+        }
+        return
+      }
+      const live = buildQuery()
+      const check = () => {
+        expect.soft(live.toArray).toHaveLength(1)
+        assertValue(live.toArray[0]?.value, expectedValue)
+      }
+      let primaryFailure: unknown = noPrimaryFailure
+      try {
+        await live.preload()
+        check()
+        children.write(`insert`, { id: 11, parentId: 1 })
+        check()
+        expectedValue = 4
+        parents.write(`update`, { id: 1, value: expectedValue })
+        check()
+        parents.write(`delete`, { id: 1, value: expectedValue })
+        expect.soft(live.toArray).toEqual([])
+      } catch (error) {
+        primaryFailure = error
+        throw error
+      } finally {
+        await cleanupAfterOracle(primaryFailure, [
+          () => live.cleanup(),
+          () => parents.collection.cleanup(),
+          () => children.collection.cleanup(),
+        ])
+      }
+    },
+  )
+})
+
+describe(`functional include projection boundary grammar`, () => {
+  it(`preserves a scalar result when a functional projection drops its include`, async () => {
+    const parents = createControlledCollection(`scalar-projection-parent`, [
+      { id: 1 },
+    ])
+    const children = createControlledCollection(`scalar-projection-child`, [
+      { id: 10, parentId: 1 },
+    ])
+    const live = createLiveQueryCollection((q) => {
+      const included = q
+        .from({ parent: parents.collection })
+        .select(({ parent }) => ({
+          id: parent.id,
+          children: toArray(
+            q
+              .from({ child: children.collection })
+              .where(({ child }) => eq(child.parentId, parent.id)),
+          ),
+        }))
+      const scalar = q.from({ row: included }).fn.select(({ row }) => row.id)
+      return q
+        .from({ result: scalar })
+        .select(({ result }) => ({ value: result }))
+    })
+    let primaryFailure: unknown = noPrimaryFailure
+    try {
+      await live.preload()
+      expect(live.toArray.map((row) => row.value)).toEqual([1])
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      await cleanupAfterOracle(primaryFailure, [
+        () => live.cleanup(),
+        () => parents.collection.cleanup(),
+        () => children.collection.cleanup(),
+      ])
+    }
+  })
+
+  it(`preserves opaque-root fields without include materialization`, async () => {
+    const parents = createControlledCollection(`opaque-root-control`, [
+      { id: 1 },
+    ])
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ parent: parents.collection })
+        .fn.select(
+          ({ parent }) => new Projection(parent.id, `plain`, undefined, 0),
+        ),
+    )
+    let primaryFailure: unknown = noPrimaryFailure
+    try {
+      await live.preload()
+      expect(live.toArray).toHaveLength(1)
+      const row = live.toArray[0]
+      expect(row?.id).toBe(1)
+      expect(row?.kind).toBe(`plain`)
+      expect(row?.total).toBe(0)
+      // Collection root records already flatten prototypes without includes.
+      // This matrix checks their fields, not a new prototype-preservation API.
+    } catch (error) {
+      primaryFailure = error
+      throw error
+    } finally {
+      await cleanupAfterOracle(primaryFailure, [
+        () => live.cleanup(),
+        () => parents.collection.cleanup(),
+      ])
+    }
+  })
+})
diff --git a/packages/db/tests/query/includes-optimistic-oracle.property.test.ts b/packages/db/tests/query/includes-optimistic-oracle.property.test.ts
index 9190d819d3..308b470683 100644
--- a/packages/db/tests/query/includes-optimistic-oracle.property.test.ts
+++ b/packages/db/tests/query/includes-optimistic-oracle.property.test.ts
@@ -15,6 +15,11 @@ import { withHistoryCleanup } from '../optimistic-history-oracle.js'
 import { flushPromises, withExpectedRejection } from '../utils.js'
 import { runTrace } from '../trace-runner.js'
 import { oraclePropertyOptions, oracleReplayTest } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  assertCanStartOptimisticChange,
+  assertMatchingConfirmation,
+} from './includes-optimistic-support.js'
 import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
 import type { TraceDriver, TraceProjection } from '../trace-runner.js'
 import type { OracleSyncChange as SyncChange } from './includes-oracle-helpers.js'
@@ -208,35 +213,6 @@ function releaseRuntimeMutation(
   if (entry.settled) context.runtimePending.delete(entry)
 }
 
-function assertCanStartOptimisticChange(
-  pending: ReadonlyMap<string, Pick<PendingOptimisticChange, `level`>>,
-  level: ChildLevel,
-  handle?: string,
-): void {
-  if (handle !== undefined && pending.has(handle)) {
-    throw new Error(`Duplicate optimistic handle ${handle}`)
-  }
-  const sameLevel = [...pending.entries()].find(
-    ([, change]) => change.level === level,
-  )
-  if (sameLevel) {
-    throw new Error(
-      `Level ${level} already has pending optimistic handle ${sameLevel[0]}`,
-    )
-  }
-}
-
-function assertMatchingConfirmation(
-  pending: Pick<PendingOptimisticChange, `id`>,
-  authoritative: Pick<ChildRow, `id`>,
-): void {
-  if (authoritative.id !== pending.id) {
-    throw new Error(
-      `Confirmation row ${authoritative.id} does not match pending row ${pending.id}`,
-    )
-  }
-}
-
 type RouteValues = {
   rootA: number
   rootB: number
@@ -630,6 +606,33 @@ async function expectHistoryMatches(
   await runTrace({ steps, driver: createDriver(roots, levels), projection })
 }
 
+// The check is `expectHistoryMatches`: it runs a generated relationship history
+// through the trace driver, and at each checkpoint the live query's rows are
+// compared with `recompute`, the model's rows for the same context. The
+// projection that the fixed traces use also calls `recompute`, so those traces
+// reach the model.
+/** The held-repair reference sorts the current authoritative roots by rank,
+ * then applies the one whole-row optimistic snapshot. It has no repair or D2
+ * state, so the live query must match it only after the ordered repair
+ * publishes. */
+function expectedHeldRepairRows(
+  sourceRows: ReadonlyMap<number, { id: number; rank: number; value: string }>,
+  optimisticValue?: string,
+): Array<{ id: number; value: string; children: Array<{ id: number }> }> {
+  return [...sourceRows.values()]
+    .sort((left, right) => left.rank - right.rank)
+    .map(({ id, value }) => ({
+      id,
+      value: id === 1 ? (optimisticValue ?? value) : value,
+      children: id === 1 ? [{ id: 10 }] : [],
+    }))
+}
+
+declareOracle({
+  check: [expectHistoryMatches],
+  model: [recompute, expectedHeldRepairRows],
+})
+
 const routeValuesArbitrary: fc.Arbitrary<RouteValues> = fc.record({
   // Routes are equality keys. Disjoint ranges preserve distinctness while
   // letting FastCheck shrink each semantic role independently.
@@ -681,17 +684,6 @@ describe(`optimistic relationship-transition oracle`, () => {
         [1, { id: 1, rank: 1, value: `A` }],
         [2, { id: 2, rank: 2, value: `X` }],
       ])
-      // The reference sorts current authoritative rows, then applies the
-      // one whole-row optimistic snapshot. It has no repair or D2 state.
-      const expectedRows = (optimisticValue?: string): Array<PublishedRoot> =>
-        [...sourceRows.values()]
-          .sort((left, right) => left.rank - right.rank)
-          .map(({ id, value }) => ({
-            id,
-            value: id === 1 ? (optimisticValue ?? value) : value,
-            children: id === 1 ? [{ id: 10 }] : [],
-          }))
-
       let sync!: Parameters<SyncConfig<OrderedRoot, number>[`sync`]>[0]
       let holdRepair = false
       let requests = 0
@@ -768,7 +760,7 @@ describe(`optimistic relationship-transition oracle`, () => {
       await withHistoryCleanup(
         async () => {
           await live.preload()
-          const before = expectedRows()
+          const before = expectedHeldRepairRows(sourceRows)
           expect(snapshot()).toEqual(before)
           const subscription = live.subscribeChanges(
             (changes) => {
@@ -831,15 +823,17 @@ describe(`optimistic relationship-transition oracle`, () => {
           }
           // Wrong-result controls reach this cut: early optimistic visibility
           // and a premature root retraction both fail the same refinement.
-          expect(() => checkHeldCut(expectedRows(`B`), [])).toThrow()
+          expect(() =>
+            checkHeldCut(expectedHeldRepairRows(sourceRows, `B`), []),
+          ).toThrow()
           expect(() => checkHeldCut(before.slice(1), [])).toThrow()
           checkHeldCut(snapshot(), callbacks)
 
           holdRepair = false
           for (const release of held.splice(0)) release()
           await flushPromises()
-          const after = expectedRows(`B`)
-          const withoutOverlay = expectedRows()
+          const after = expectedHeldRepairRows(sourceRows, `B`)
+          const withoutOverlay = expectedHeldRepairRows(sourceRows)
           expect(after).not.toEqual(before)
           expect(after).not.toEqual(withoutOverlay)
           const expectedPublication: typeof callbacks = [
@@ -1239,23 +1233,6 @@ describe(`optimistic relationship-transition oracle`, () => {
     },
   )
 
-  fcTest(
-    `rejects optimistic handles the sync mock cannot settle independently`,
-    () => {
-      const pending = new Map([[`first`, { level: 1 as const }]])
-
-      expect(() => assertCanStartOptimisticChange(pending, 2, `first`)).toThrow(
-        /Duplicate optimistic handle first/,
-      )
-      expect(() =>
-        assertCanStartOptimisticChange(pending, 1, `second`),
-      ).toThrow(/Level 1 already has pending optimistic handle first/)
-      expect(() => assertMatchingConfirmation({ id: 11 }, { id: 12 })).toThrow(
-        /Confirmation row 12 does not match pending row 11/,
-      )
-    },
-  )
-
   fcTest(
     `rejects a stale route at the immediate optimistic checkpoint`,
     async () => {
diff --git a/packages/db/tests/query/includes-optimistic-support.ts b/packages/db/tests/query/includes-optimistic-support.ts
new file mode 100644
index 0000000000..63c4e3641c
--- /dev/null
+++ b/packages/db/tests/query/includes-optimistic-support.ts
@@ -0,0 +1,33 @@
+// Guards that the optimistic relationship oracle's driver applies before it
+// starts or confirms an optimistic change. The oracle that uses them is
+// includes-optimistic-oracle.property.test.ts; its ordinary harness tests are in
+// includes-optimistic.test.ts.
+
+export function assertCanStartOptimisticChange(
+  pending: ReadonlyMap<string, { level: number }>,
+  level: number,
+  handle?: string,
+): void {
+  if (handle !== undefined && pending.has(handle)) {
+    throw new Error(`Duplicate optimistic handle ${handle}`)
+  }
+  const sameLevel = [...pending.entries()].find(
+    ([, change]) => change.level === level,
+  )
+  if (sameLevel) {
+    throw new Error(
+      `Level ${level} already has pending optimistic handle ${sameLevel[0]}`,
+    )
+  }
+}
+
+export function assertMatchingConfirmation(
+  pending: { id: number },
+  authoritative: { id: number },
+): void {
+  if (authoritative.id !== pending.id) {
+    throw new Error(
+      `Confirmation row ${authoritative.id} does not match pending row ${pending.id}`,
+    )
+  }
+}
diff --git a/packages/db/tests/query/includes-optimistic.test.ts b/packages/db/tests/query/includes-optimistic.test.ts
new file mode 100644
index 0000000000..b7f1d48589
--- /dev/null
+++ b/packages/db/tests/query/includes-optimistic.test.ts
@@ -0,0 +1,30 @@
+// Harness tests for the optimistic relationship oracle's driver guards: a
+// duplicate or same-level optimistic handle and a mismatched confirmation are
+// rejected. These test the oracle's own machinery, not a relationship law. The
+// owner is includes-optimistic-oracle.property.test.ts, and the guards are in
+// includes-optimistic-support.ts.
+import { test as fcTest } from '@fast-check/vitest'
+import { describe, expect } from 'vitest'
+import {
+  assertCanStartOptimisticChange,
+  assertMatchingConfirmation,
+} from './includes-optimistic-support.js'
+
+describe(`optimistic relationship-transition oracle`, () => {
+  fcTest(
+    `rejects optimistic handles the sync mock cannot settle independently`,
+    () => {
+      const pending = new Map([[`first`, { level: 1 as const }]])
+
+      expect(() => assertCanStartOptimisticChange(pending, 2, `first`)).toThrow(
+        /Duplicate optimistic handle first/,
+      )
+      expect(() =>
+        assertCanStartOptimisticChange(pending, 1, `second`),
+      ).toThrow(/Level 1 already has pending optimistic handle first/)
+      expect(() => assertMatchingConfirmation({ id: 11 }, { id: 12 })).toThrow(
+        /Confirmation row 12 does not match pending row 11/,
+      )
+    },
+  )
+})
diff --git a/packages/db/tests/query/includes-oracle.property.test.ts b/packages/db/tests/query/includes-oracle.property.test.ts
index 5ea782c83f..a38d292e04 100644
--- a/packages/db/tests/query/includes-oracle.property.test.ts
+++ b/packages/db/tests/query/includes-oracle.property.test.ts
@@ -15,8 +15,32 @@ import {
   oracleReplaySkips,
   oracleRuns,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { runTrace } from '../trace-runner.js'
-import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
+import {
+  cleanupPendingWork,
+  createControlledCollection,
+  createSources,
+  plainSubquery,
+  refsInclude,
+  releasePendingWork,
+  stripVirtualProperties,
+  trackPendingWork,
+  withPendingWorkCleanup,
+} from './includes-structural-support.js'
+import {
+  assertDisjointRelationshipKeys,
+  batchChild,
+  batchRoot,
+  createConnectedBatchBranches,
+  createRouteLifecycleScenario,
+  createVisibleRelationshipScenario,
+  otherBranch,
+  rowAt,
+  transitionHistoryBranches,
+  updateFullRowBatchModels,
+  updateModel,
+} from './includes-route-grammar-oracle.js'
 import {
   applyScopedWrite,
   canonicalScopedAliases,
@@ -29,6 +53,24 @@ import {
   scopedScenarioArbitrary,
   sortedRequests,
 } from './includes-scope-identity-oracle.js'
+import type {
+  ConnectedBranch,
+  FullRowBatchScenario,
+  FullRowBatchStep,
+  IncludeDepth,
+  RouteLifecycleScenario,
+  RouteTransitionDescriptor,
+  VisibleRelationshipScenario,
+  VisibleRelationshipScenarioOptions,
+  VisibleScalarNoise,
+} from './includes-route-grammar-oracle.js'
+import type {
+  ChildRow,
+  PendingTransaction,
+  PendingWork,
+  RootRow,
+  Sources,
+} from './includes-structural-support.js'
 import type {
   TraceCheckpoint,
   TraceDriver,
@@ -37,72 +79,13 @@ import type {
 import type { OracleSyncChange as SyncChange } from './includes-oracle-helpers.js'
 import type {
   ScopedAliases,
-  ScopedInclude,
   ScopedPart,
   ScopedRef,
   ScopedResultRow,
   ScopedScenario,
   ScopedShape,
-  ScopedSubquery,
 } from './includes-scope-identity-oracle.js'
 
-/**
- * # Does the incremental include graph equal full relationship recomputation?
- *
- * Authority: `packages/db/src/query/live/ARCHITECTURE.md`, normative laws
- * 1, 3–5, and 8. This owner checks inline result values and order through the
- * public live-query Collection after each synchronous source change.
- *
- * This is the central structural oracle for inline includes. Production updates
- * nested results incrementally. The reference stores source rows in plain Maps
- * and rebuilds the whole tree after every meaningful checkpoint.
- *
- * The suite protects five groups of laws:
- *
- * 1. Inserts, updates, deletes, and optimistic settlement match recomputation
- *    at one to four include levels.
- * 2. Rekey and reparent histories preserve route ownership through fresh,
- *    shared, retired, restored, merged, and split routes.
- * 3. Atomic and split full-row batches produce the same tree when they encode
- *    the same logical source state.
- * 4. Nested scalar materialization follows reference changes and shared paths.
- * 5. Alpha-renaming, sibling order, and unrelated siblings do not change the
- *    relevant result, including when sibling scopes such as a `from()`
- *    subquery and an include reuse alias names.
- *
- * These laws use a model graph, not one universal controller. The structural
- * node recomputes relationship trees. A separate scalar-reference node follows
- * explicit foreign keys. Metamorphic checks compare equivalent query forms.
- * Scenario builders describe legal route histories, but they do not compute
- * the expected result.
- *
- * The trace runner checks each intermediate cut that the contract exposes.
- * Focused pinned histories preserve small boundary cases. Random or replayed
- * campaigns explore longer action sequences and wider route values. Other
- * include suites own Collection facades, demand lifetime, functional callbacks,
- * and publication coherence.
- *
- * Known limits: the structural histories use numeric correlation groups,
- * finite row IDs, one to four levels, and the declared transition shapes.
- * Their public-row checks protect those represented histories at the named
- * checkpoints; they do not prove every route relation state or source schedule.
- * This file owns further structural route witnesses. The architecture's
- * executable-contract map assigns other include boundaries to their suites.
- */
-
-type IncludeDepth = 1 | 2 | 3 | 4
-
-type RootRow = {
-  id: number
-  group: number
-  value: number
-  position: number
-}
-
-type ChildRow = RootRow & {
-  parentGroup: number
-}
-
 type HistoryAction = {
   type: `put` | `delete` | `optimisticConfirm` | `optimisticRollback`
   level: 0 | IncludeDepth
@@ -454,16 +437,6 @@ const confirmedChildReorderSeed: Scenario = {
   ],
 }
 
-function createControlledCollection<T extends { id: number }>(
-  name: string,
-  initialData: Array<T> = [],
-  rowUpdateMode: `partial` | `full` = `partial`,
-) {
-  return createOracleControlledCollection(name, initialData, {
-    rowUpdateMode,
-  })
-}
-
 function compareRows(left: RootRow, right: RootRow): number {
   return left.position - right.position || left.id - right.id
 }
@@ -506,22 +479,22 @@ function recompute(
 
 // Collection delivery metadata is independent of include materialization.
 // Compare only the user-defined row shape modeled by the recompute oracle.
-function stripVirtualProperties(value: unknown): unknown {
-  if (Array.isArray(value)) {
-    return value.map(stripVirtualProperties)
-  }
-  if (!value || typeof value !== `object`) {
-    return value
-  }
-
-  return Object.fromEntries(
-    Object.entries(value)
-      .filter(([key]) => !key.startsWith(`$`))
-      .map(([key, entry]) => [key, stripVirtualProperties(entry)]),
-  )
-}
+declareOracle({
+  check: [
+    expectScenarioMatches,
+    expectFullRowBatchScenarioMatches,
+    expectFlatMaterializationScenarioMatches,
+    expectMaterializeScenarioMatches,
+  ],
+  model: [
+    recompute,
+    recomputeFullRowBatchScenario,
+    recomputeFlatMaterialization,
+    recomputeMaterialize,
+  ],
 
-type Sources = ReturnType<typeof createSources>
+  grammar: [independentTransitionPrefix],
+})
 
 function createIncrementalQuery(depth: IncludeDepth, sources: Sources) {
   const { roots } = sources
@@ -738,22 +711,6 @@ function createIncrementalQuery(depth: IncludeDepth, sources: Sources) {
   }
 }
 
-function createSources(rowUpdateMode: `partial` | `full` = `partial`) {
-  return {
-    roots: createControlledCollection<RootRow>(
-      `oracle-roots`,
-      [],
-      rowUpdateMode,
-    ),
-    levels: [
-      createControlledCollection<ChildRow>(`oracle-level-1`, [], rowUpdateMode),
-      createControlledCollection<ChildRow>(`oracle-level-2`, [], rowUpdateMode),
-      createControlledCollection<ChildRow>(`oracle-level-3`, [], rowUpdateMode),
-      createControlledCollection<ChildRow>(`oracle-level-4`, [], rowUpdateMode),
-    ] as const,
-  }
-}
-
 function sameRoot(left: RootRow, right: RootRow): boolean {
   return (
     left.group === right.group &&
@@ -766,112 +723,6 @@ function sameChild(left: ChildRow, right: ChildRow): boolean {
   return left.parentGroup === right.parentGroup && sameRoot(left, right)
 }
 
-type PendingTransaction = ReturnType<Sources[`roots`][`collection`][`update`]>
-
-type PendingWork = {
-  transaction: PendingTransaction
-  release: () => void
-  releaseAttempted: boolean
-  released: boolean
-  settled: boolean
-  receipt: Promise<void>
-}
-
-function trackPendingWork(
-  pending: Set<PendingWork>,
-  transaction: PendingTransaction,
-  release: () => void,
-): PendingWork {
-  const entry: PendingWork = {
-    transaction,
-    release,
-    releaseAttempted: false,
-    released: false,
-    settled: false,
-    receipt: Promise.resolve(),
-  }
-  pending.add(entry)
-  const settled = () => {
-    entry.settled = true
-    if (entry.released) pending.delete(entry)
-  }
-  entry.receipt = transaction.isPersisted.promise.then(settled, settled)
-  return entry
-}
-
-function releasePendingWork(
-  pending: Set<PendingWork>,
-  entry: PendingWork,
-  release: () => void,
-): void {
-  entry.releaseAttempted = true
-  release()
-  entry.released = true
-  if (entry.settled) pending.delete(entry)
-}
-
-async function cleanupPendingWork(
-  pending: Set<PendingWork>,
-  collections: ReadonlyArray<{ cleanup: () => Promise<void> }>,
-): Promise<void> {
-  const errors: Array<unknown> = []
-  const entries = [...pending]
-  const attempt = (work: () => void) => {
-    try {
-      work()
-    } catch (error) {
-      errors.push(error)
-    }
-  }
-  for (const entry of entries) {
-    if (
-      entry.transaction.state === `pending` ||
-      entry.transaction.state === `persisting`
-    )
-      attempt(() => {
-        entry.transaction.rollback()
-      })
-    if (!entry.releaseAttempted)
-      attempt(() => releasePendingWork(pending, entry, entry.release))
-  }
-  if (errors.length === 0)
-    await Promise.all(entries.map(({ receipt }) => receipt))
-  const results = await Promise.allSettled(
-    collections.map(async (collection) => collection.cleanup()),
-  )
-  for (const result of results)
-    if (result.status === `rejected`) errors.push(result.reason as unknown)
-  if (errors.length === 1) throw errors[0]
-  if (errors.length > 1)
-    throw new AggregateError(errors, `Core oracle cleanup failed`)
-}
-
-async function withPendingWorkCleanup(
-  pending: Set<PendingWork>,
-  collections: ReadonlyArray<{ cleanup: () => Promise<void> }>,
-  work: () => Promise<void>,
-): Promise<void> {
-  let primary: { error: unknown } | undefined
-  try {
-    await work()
-  } catch (error) {
-    primary = { error }
-  }
-  try {
-    await cleanupPendingWork(pending, collections)
-  } catch (error) {
-    if (!primary) throw error
-    throw new AggregateError(
-      [primary.error, error],
-      `Core oracle work and cleanup failed`,
-      {
-        cause: primary.error,
-      },
-    )
-  }
-  if (primary) throw primary.error
-}
-
 async function settleOptimisticAction(
   action: HistoryAction,
   resolveSync: () => void,
@@ -1086,10 +937,6 @@ function createStructuralTraceDriver(
   }
 }
 
-type FullRowBatchStep =
-  | { level: 0; changes: Array<SyncChange<RootRow>> }
-  | { level: IncludeDepth; changes: Array<SyncChange<ChildRow>> }
-
 type FullRowBatchInput = {
   level: 0 | IncludeDepth
   changes: Array<{
@@ -1102,36 +949,6 @@ type FullRowBatchInput = {
   }>
 }
 
-type FullRowBatchScenario = {
-  depth: IncludeDepth
-  steps: Array<FullRowBatchStep>
-}
-
-function updateModel<T extends { id: number }>(
-  model: Map<number, T>,
-  changes: ReadonlyArray<SyncChange<T>>,
-): void {
-  for (const change of changes) {
-    if (change.type === `delete`) {
-      model.delete(change.value.id)
-    } else {
-      model.set(change.value.id, change.value)
-    }
-  }
-}
-
-function updateFullRowBatchModels(
-  step: FullRowBatchStep,
-  roots: Map<number, RootRow>,
-  levels: Array<Map<number, ChildRow>>,
-): void {
-  if (step.level === 0) {
-    updateModel(roots, step.changes)
-  } else {
-    updateModel(levels[step.level - 1]!, step.changes)
-  }
-}
-
 function createFullRowBatchTraceDriver(
   depth: IncludeDepth,
 ): TraceDriver<FullRowBatchStep, StructuralTraceContext> {
@@ -1150,24 +967,6 @@ function createFullRowBatchTraceDriver(
   }
 }
 
-function batchRoot(
-  id: number,
-  group: number,
-  value = id * 10,
-  position = id - 1,
-): RootRow {
-  return { id, group, value, position }
-}
-
-function batchChild(
-  id: number,
-  parentGroup: number,
-  value = id * 10,
-  position = id - 1,
-): ChildRow {
-  return { id, parentGroup, group: id * 10, value, position }
-}
-
 const fullRowBatchTrace: Array<FullRowBatchStep> = [
   {
     level: 0,
@@ -1292,49 +1091,6 @@ function createConnectedBatchPrefix(
   return steps
 }
 
-type ConnectedBranch = {
-  idBase: number
-  groupBase: number
-}
-
-function createConnectedBatchBranches(
-  depth: IncludeDepth,
-  branches: ReadonlyArray<ConnectedBranch> = [
-    { idBase: 100, groupBase: 100 },
-    { idBase: 200, groupBase: 200 },
-  ],
-): Array<FullRowBatchStep> {
-  const steps: Array<FullRowBatchStep> = [
-    {
-      level: 0,
-      changes: branches.map(({ idBase, groupBase }) => ({
-        type: `insert`,
-        value: batchRoot(idBase, groupBase, idBase, 0),
-      })),
-    },
-  ]
-
-  for (let level = 1; level <= depth; level++) {
-    steps.push({
-      level: level as IncludeDepth,
-      changes: branches.map(({ idBase, groupBase }) => ({
-        type: `insert`,
-        value: {
-          ...batchChild(
-            idBase + level,
-            groupBase + level - 1,
-            idBase + level,
-            0,
-          ),
-          group: groupBase + level,
-        },
-      })),
-    })
-  }
-
-  return steps
-}
-
 function normalizeFullRowBatchInputs(
   depth: IncludeDepth,
   inputs: Array<FullRowBatchInput>,
@@ -1448,10 +1204,6 @@ const branchDeliveryOrders: ReadonlyArray<BranchDeliveryOrder> = [
   `reverse`,
 ]
 
-function otherBranch(branch: 0 | 1): 0 | 1 {
-  return branch === 0 ? 1 : 0
-}
-
 function deliverBranches(
   branches: readonly [ConnectedBranch, ConnectedBranch],
   order: BranchDeliveryOrder,
@@ -1466,145 +1218,11 @@ function deliveredBranchIndex(
   return order === `forward` ? branch : otherBranch(branch)
 }
 
-type VisibleRelationshipScenario = FullRowBatchScenario & {
-  transitionStepIndex: number
-}
-
 type VisibleRelationshipScenarios = {
   transitionOnly: VisibleRelationshipScenario
   stateful: VisibleRelationshipScenario
 }
 
-type VisibleScalarNoise = {
-  side: `before` | `after`
-  level: 0 | IncludeDepth
-  branch: 0 | 1
-  value: number
-  position: number
-}
-
-type VisibleRelationshipScenarioOptions = {
-  depth: IncludeDepth
-  targetLevel: IncludeDepth
-  sourceBranch: 0 | 1
-  branches: readonly [ConnectedBranch, ConnectedBranch]
-  noise: ReadonlyArray<VisibleScalarNoise>
-} & (
-  | { transition: `reparent`; rekeyGroup?: never }
-  | { transition: `rekey`; rekeyGroup: number }
-)
-
-function assertDisjointRelationshipKeys(
-  depth: IncludeDepth,
-  branches: readonly [ConnectedBranch, ConnectedBranch],
-  {
-    extraIds = [],
-    extraGroups = [],
-  }: {
-    extraIds?: ReadonlyArray<number>
-    extraGroups?: ReadonlyArray<number>
-  } = {},
-): void {
-  const ids = [
-    ...branches.flatMap(({ idBase }) =>
-      Array.from({ length: depth + 1 }, (_, level) => idBase + level),
-    ),
-    ...extraIds,
-  ]
-  const groups = [
-    ...branches.flatMap(({ groupBase }) =>
-      Array.from({ length: depth + 1 }, (_, level) => groupBase + level),
-    ),
-    ...extraGroups,
-  ]
-  if (
-    new Set(ids).size !== ids.length ||
-    new Set(groups).size !== groups.length
-  ) {
-    throw new Error(`Visible relationship keys overlap`)
-  }
-}
-
-function createVisibleRelationshipScenario(
-  options: VisibleRelationshipScenarioOptions,
-): VisibleRelationshipScenario {
-  const { depth, transition, targetLevel, sourceBranch, branches, noise } =
-    options
-  assertDisjointRelationshipKeys(
-    depth,
-    branches,
-    transition === `rekey` ? { extraGroups: [options.rekeyGroup] } : {},
-  )
-  const steps = createConnectedBatchBranches(depth, branches)
-  const roots = new Map<number, RootRow>()
-  const levels = Array.from({ length: 4 }, () => new Map<number, ChildRow>())
-
-  for (const step of steps) {
-    updateFullRowBatchModels(step, roots, levels)
-  }
-
-  const appendNoise = (entry: VisibleScalarNoise): void => {
-    const branch = branches[entry.branch]
-    if (entry.level === 0) {
-      const current = roots.get(branch.idBase)!
-      const value = {
-        ...current,
-        value: entry.value,
-        position: entry.position,
-      }
-      roots.set(value.id, value)
-      steps.push({ level: 0, changes: [{ type: `update`, value }] })
-      return
-    }
-
-    const model = levels[entry.level - 1]!
-    const current = model.get(branch.idBase + entry.level)!
-    const value = {
-      ...current,
-      value: entry.value,
-      position: entry.position,
-    }
-    model.set(value.id, value)
-    steps.push({
-      level: entry.level,
-      changes: [{ type: `update`, value }],
-    })
-  }
-
-  for (const entry of noise.filter(({ side }) => side === `before`)) {
-    appendNoise(entry)
-  }
-
-  const source = branches[sourceBranch]
-  const destination = branches[otherBranch(sourceBranch)]
-  const targetModel = levels[targetLevel - 1]!
-  const current = targetModel.get(source.idBase + targetLevel)!
-  const value: ChildRow = {
-    ...current,
-    parentGroup:
-      transition === `reparent`
-        ? destination.groupBase + targetLevel - 1
-        : current.parentGroup,
-    group: transition === `rekey` ? options.rekeyGroup : current.group,
-  }
-  const transitionStepIndex = steps.length
-  steps.push({
-    level: targetLevel,
-    changes: [{ type: `update`, value }],
-  })
-  targetModel.set(value.id, value)
-
-  for (const entry of noise.filter(({ side }) => side === `after`)) {
-    appendNoise(entry)
-  }
-
-  return {
-    depth,
-    steps,
-    transitionStepIndex,
-  }
-}
-
 function visibleRelationshipScenarioArbitrary(
   depth: IncludeDepth,
   transition: VisibleRelationshipTransition,
@@ -1977,241 +1595,6 @@ function expectEveryHistoryStepVisible(
   }
 }
 
-type RouteDestination = {
-  strategy: `fresh` | `restore` | `merge` | `split` | `retired`
-  route: number
-}
-
-// Route lifecycle descriptors form a constrained design grammar. A numeric
-// `route` is a model-only parent group value for one include edge, not a
-// production BucketKey or route-relation row. `strategy` classifies legal
-// histories for generation; the Map recomputation still supplies the answer.
-// Constructors reject combinations that do not name a real lifecycle state.
-type RouteTransitionDescriptor = {
-  row: 0 | 1
-  stepsBefore?: ReadonlyArray<FullRowBatchStep>
-} & (
-  | {
-      kind: `reparent`
-      level: IncludeDepth
-      destination: { strategy: `merge`; route: number }
-    }
-  | {
-      kind: `rekey`
-      level: 0 | IncludeDepth
-      destination: RouteDestination
-    }
-)
-
-type RouteLifecycleScenario = FullRowBatchScenario & {
-  transitionStepIndexes: ReadonlyArray<number>
-}
-
-type RouteLifecycleScenarioOptions = {
-  depth: IncludeDepth
-  branches: readonly [ConnectedBranch, ConnectedBranch]
-  descriptors: ReadonlyArray<RouteTransitionDescriptor>
-  prefixSteps?: ReadonlyArray<FullRowBatchStep>
-  trailingSteps?: ReadonlyArray<FullRowBatchStep>
-}
-
-function rowAt(
-  branches: readonly [ConnectedBranch, ConnectedBranch],
-  row: 0 | 1,
-  level: 0 | IncludeDepth,
-): number {
-  return branches[row].idBase + level
-}
-
-function applyRouteLifecycleStep(
-  step: FullRowBatchStep,
-  roots: Map<number, RootRow>,
-  levels: Array<Map<number, ChildRow>>,
-  seenRoutes: Set<string>,
-  retiredRouteOwners: Map<string, number>,
-): void {
-  const rows = step.level === 0 ? roots : levels[step.level - 1]!
-  const previousRouteOwners = new Map<number, Set<number>>()
-
-  for (const change of step.changes) {
-    const previous = rows.get(change.value.id)
-    if (!previous) continue
-    const owners = previousRouteOwners.get(previous.group) ?? new Set<number>()
-    owners.add(previous.id)
-    previousRouteOwners.set(previous.group, owners)
-  }
-
-  updateFullRowBatchModels(step, roots, levels)
-
-  for (const row of rows.values()) {
-    const route = routeIdentity(step.level, row.group)
-    seenRoutes.add(route)
-    retiredRouteOwners.delete(route)
-  }
-  for (const [route, previousOwners] of previousRouteOwners) {
-    if ([...rows.values()].some((row) => row.group === route)) continue
-    const retiredRoute = routeIdentity(step.level, route)
-    if (previousOwners.size === 1) {
-      retiredRouteOwners.set(retiredRoute, [...previousOwners][0]!)
-    } else {
-      retiredRouteOwners.delete(retiredRoute)
-    }
-  }
-}
-
-function routeIdentity(level: 0 | IncludeDepth, route: number): string {
-  // This oracle has one include edge per level, so level plus correlation value
-  // is the complete route identity. Equal values at different levels are not
-  // the same subscription lifecycle.
-  return `${level}:${route}`
-}
-
-function createRouteLifecycleScenario({
-  depth,
-  branches,
-  descriptors,
-  prefixSteps = createConnectedBatchBranches(depth, branches),
-  trailingSteps = [],
-}: RouteLifecycleScenarioOptions): RouteLifecycleScenario {
-  const seenRoutes = new Set<string>()
-  const retiredRouteOwners = new Map<string, number>()
-
-  const steps = [...prefixSteps]
-  const roots = new Map<number, RootRow>()
-  const levels = Array.from({ length: 4 }, () => new Map<number, ChildRow>())
-  for (const step of steps) {
-    applyRouteLifecycleStep(step, roots, levels, seenRoutes, retiredRouteOwners)
-  }
-
-  const transitionStepIndexes: Array<number> = []
-  for (const descriptor of descriptors) {
-    const destination = descriptor.destination as RouteDestination
-    if (descriptor.kind === `reparent` && destination.strategy !== `merge`) {
-      throw new Error(
-        `reparent transitions only support live merge destinations`,
-      )
-    }
-    for (const step of descriptor.stepsBefore ?? []) {
-      steps.push(step)
-      applyRouteLifecycleStep(
-        step,
-        roots,
-        levels,
-        seenRoutes,
-        retiredRouteOwners,
-      )
-    }
-
-    const id = rowAt(branches, descriptor.row, descriptor.level)
-    const rowsAtLevel =
-      descriptor.level === 0
-        ? [...roots.values()]
-        : [...levels[descriptor.level - 1]!.values()]
-    const current = rowsAtLevel.find((row) => row.id === id)
-    if (!current) throw new Error(`Missing transition row ${id}`)
-    const currentRoute =
-      descriptor.kind === `rekey`
-        ? current.group
-        : (current as ChildRow).parentGroup
-    const destinationRows =
-      descriptor.kind === `rekey`
-        ? rowsAtLevel
-        : descriptor.level === 1
-          ? [...roots.values()]
-          : [...levels[descriptor.level - 2]!.values()]
-    const destinationIsLive = destinationRows.some(
-      (row) => row.group === descriptor.destination.route,
-    )
-    const currentRouteUsers = rowsAtLevel.filter((row) =>
-      descriptor.kind === `rekey`
-        ? row.group === currentRoute
-        : (row as ChildRow).parentGroup === currentRoute,
-    ).length
-    const destinationRoute = routeIdentity(
-      descriptor.level,
-      descriptor.destination.route,
-    )
-    const retiredOwner = retiredRouteOwners.get(destinationRoute)
-
-    switch (descriptor.destination.strategy) {
-      case `fresh`:
-        if (seenRoutes.has(destinationRoute)) {
-          throw new Error(`fresh route must never have been used`)
-        }
-        break
-      case `restore`:
-        if (destinationIsLive || retiredOwner !== id) {
-          throw new Error(`restore route must have been retired by this row`)
-        }
-        break
-      case `merge`:
-        if (
-          !destinationIsLive ||
-          descriptor.destination.route === currentRoute
-        ) {
-          throw new Error(`merge route must be live and different`)
-        }
-        break
-      case `split`:
-        if (seenRoutes.has(destinationRoute)) {
-          throw new Error(`split destination must be unused`)
-        }
-        if (currentRouteUsers < 2) {
-          throw new Error(`split source route must be shared`)
-        }
-        break
-      case `retired`:
-        if (
-          destinationIsLive ||
-          retiredOwner === undefined ||
-          retiredOwner === id
-        ) {
-          throw new Error(`retired route must have been retired by another row`)
-        }
-        break
-    }
-
-    let step: FullRowBatchStep
-    if (descriptor.level === 0) {
-      const root = roots.get(id)
-      if (!root) throw new Error(`Missing transition root ${id}`)
-      step = {
-        level: 0,
-        changes: [
-          {
-            type: `update`,
-            value: { ...root, group: descriptor.destination.route },
-          },
-        ],
-      }
-    } else {
-      const child = levels[descriptor.level - 1]!.get(id)
-      if (!child) throw new Error(`Missing transition child ${id}`)
-      step = {
-        level: descriptor.level,
-        changes: [
-          {
-            type: `update`,
-            value:
-              descriptor.kind === `rekey`
-                ? { ...child, group: descriptor.destination.route }
-                : {
-                    ...child,
-                    parentGroup: descriptor.destination.route,
-                  },
-          },
-        ],
-      }
-    }
-    transitionStepIndexes.push(steps.length)
-    steps.push(step)
-    applyRouteLifecycleStep(step, roots, levels, seenRoutes, retiredRouteOwners)
-  }
-
-  steps.push(...trailingSteps)
-  return { depth, steps, transitionStepIndexes }
-}
-
 function expectEveryRouteTransitionVisible(
   scenario: RouteLifecycleScenario,
 ): void {
@@ -3766,11 +3149,6 @@ const minimalRekeyScenario = createVisibleRelationshipScenario({
   noise: [],
 })
 
-const transitionHistoryBranches = [
-  { idBase: 100, groupBase: 600 },
-  { idBase: 1_100, groupBase: 1_600 },
-] as const
-
 const {
   control: rekeyRouteReuseControl,
   candidate: rekeyRouteResurrectionScenario,
@@ -4008,46 +3386,6 @@ describe(`includes recompute oracle`, () => {
     }
   }
 
-  fcTest(`rejects subscriber lifecycle labels on reparent transitions`, () => {
-    expect(() =>
-      createRouteLifecycleScenario({
-        depth: 3,
-        branches: transitionHistoryBranches,
-        descriptors: [
-          {
-            kind: `reparent`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `fresh`, route: 2_100 },
-          } as unknown as RouteTransitionDescriptor,
-        ],
-      }),
-    ).toThrow(/reparent transitions only support live merge destinations/)
-  })
-
-  fcTest(`scopes rekey route histories to their include level`, () => {
-    expect(() =>
-      createRouteLifecycleScenario({
-        depth: 3,
-        branches: transitionHistoryBranches,
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 1,
-            row: 0,
-            destination: { strategy: `fresh`, route: 2_100 },
-          },
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `fresh`, route: 2_100 },
-          },
-        ],
-      }),
-    ).not.toThrow()
-  })
-
   fcTest(`the sibling topology targets rows under one parent`, () => {
     const branches = transitionHistoryBranches
     const prefix = independentTransitionPrefix(`sibling`, branches)
@@ -4546,190 +3884,6 @@ describe(`includes recompute oracle`, () => {
     )
   }
 
-  fcTest(`rejects invalid route destination strategies`, () => {
-    const branches = transitionHistoryBranches
-    const ownRoute = branches[0].groupBase + 2
-    const otherRoute = branches[1].groupBase + 2
-    const freshRoute = 2_100
-    const invalidCases: ReadonlyArray<{
-      descriptors: ReadonlyArray<RouteTransitionDescriptor>
-      message: RegExp
-    }> = [
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `fresh`, route: otherRoute },
-          },
-        ],
-        message: /fresh route must never have been used/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `restore`, route: ownRoute },
-          },
-        ],
-        message: /restore route must have been retired by this row/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `fresh`, route: freshRoute },
-          },
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 1,
-            destination: { strategy: `restore`, route: ownRoute },
-          },
-        ],
-        message: /restore route must have been retired by this row/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `merge`, route: freshRoute },
-          },
-        ],
-        message: /merge route must be live and different/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `merge`, route: ownRoute },
-          },
-        ],
-        message: /merge route must be live and different/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `split`, route: freshRoute },
-          },
-        ],
-        message: /split source route must be shared/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `merge`, route: otherRoute },
-          },
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `split`, route: ownRoute },
-          },
-        ],
-        message: /split destination must be unused/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `retired`, route: otherRoute },
-          },
-        ],
-        message: /retired route must have been retired by another row/,
-      },
-      {
-        descriptors: [
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `fresh`, route: freshRoute },
-          },
-          {
-            kind: `rekey`,
-            level: 2,
-            row: 0,
-            destination: { strategy: `retired`, route: ownRoute },
-          },
-        ],
-        message: /retired route must have been retired by another row/,
-      },
-    ]
-
-    for (const invalidCase of invalidCases) {
-      expect(() =>
-        createRouteLifecycleScenario({
-          depth: 3,
-          branches,
-          descriptors: invalidCase.descriptors,
-        }),
-      ).toThrow(invalidCase.message)
-    }
-  })
-
-  fcTest(`rejects overlapping visible relationship keys`, () => {
-    const base = {
-      depth: 4,
-      transition: `rekey`,
-      targetLevel: 1,
-      sourceBranch: 0,
-      noise: [],
-    } as const
-    const collisions: Array<{
-      branches: readonly [ConnectedBranch, ConnectedBranch]
-      rekeyGroup: number
-    }> = [
-      {
-        branches: [
-          { idBase: 100, groupBase: 600 },
-          { idBase: 102, groupBase: 1_600 },
-        ],
-        rekeyGroup: 2_100,
-      },
-      {
-        branches: [
-          { idBase: 100, groupBase: 600 },
-          { idBase: 1_100, groupBase: 602 },
-        ],
-        rekeyGroup: 2_100,
-      },
-      {
-        branches: [
-          { idBase: 100, groupBase: 600 },
-          { idBase: 1_100, groupBase: 1_600 },
-        ],
-        rekeyGroup: 603,
-      },
-    ]
-
-    for (const collision of collisions) {
-      expect(() =>
-        createVisibleRelationshipScenario({
-          ...base,
-          ...collision,
-        }),
-      ).toThrow(/overlap/)
-    }
-  })
-
   for (const materialization of [`array`, `concat`] as const) {
     fcTest(`${materialization} follows an intra-batch child hand-off`, () =>
       expectFlatMaterializationScenarioMatches(
@@ -5381,211 +4535,6 @@ describe(`includes recompute oracle`, () => {
   fcTest(`shared scalar materialization preserves the deepest row`, () =>
     expectMaterializeScenarioMatches(sharedMaterializeSeed),
   )
-
-  fcTest(`parent correlation-key update rematerializes children`, async () => {
-    const roots = createControlledCollection<RootRow>(`correlation-seed-roots`)
-    const children = createControlledCollection<ChildRow>(
-      `correlation-seed-children`,
-    )
-    const live = createLiveQueryCollection((q) =>
-      q.from({ root: roots.collection }).select(({ root }) => ({
-        id: root.id,
-        group: root.group,
-        children: toArray(
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentGroup, root.group))
-            .select(({ child }) => ({ id: child.id })),
-        ),
-      })),
-    )
-
-    try {
-      await live.preload()
-      children.write(`insert`, {
-        id: 1,
-        parentGroup: 0,
-        group: 0,
-        value: 0,
-        position: 0,
-      })
-      children.write(`insert`, {
-        id: 2,
-        parentGroup: 1,
-        group: 0,
-        value: 0,
-        position: 0,
-      })
-      roots.write(`insert`, { id: 1, group: 1, value: 0, position: 0 })
-      roots.write(`update`, { id: 1, group: 0, value: 0, position: 0 })
-
-      expect(stripVirtualProperties(live.toArray)).toEqual([
-        { id: 1, group: 0, children: [{ id: 1 }] },
-      ])
-    } finally {
-      await live.cleanup()
-      await Promise.all([
-        roots.collection.cleanup(),
-        children.collection.cleanup(),
-      ])
-    }
-  })
-
-  fcTest(
-    `alpha-renaming a duplicate sibling alias preserves results`,
-    async () => {
-      const roots = createControlledCollection<RootRow>(`alias-seed-roots`, [
-        { id: 1, group: 1, value: 0, position: 0 },
-      ])
-      const issues = createControlledCollection<ChildRow>(`alias-seed-issues`, [
-        {
-          id: 10,
-          parentGroup: 1,
-          group: 10,
-          value: 10,
-          position: 0,
-        },
-        {
-          id: 11,
-          parentGroup: 1,
-          group: 11,
-          value: 99,
-          position: 1,
-        },
-      ])
-      const tags = createControlledCollection<ChildRow>(`alias-seed-tags`, [
-        {
-          id: 20,
-          parentGroup: 1,
-          group: 20,
-          value: 20,
-          position: 0,
-        },
-        {
-          id: 21,
-          parentGroup: 1,
-          group: 21,
-          value: 99,
-          position: 1,
-        },
-      ])
-
-      try {
-        const uniqueAliases = await queryOnce((q) =>
-          q.from({ root: roots.collection }).select(({ root }) => ({
-            id: root.id,
-            issues: toArray(
-              q
-                .from({ issue: issues.collection })
-                .where(({ issue }) => eq(issue.parentGroup, root.group))
-                .where(({ issue }) => eq(issue.value, 10))
-                .select(({ issue }) => ({ id: issue.id })),
-            ),
-            tags: toArray(
-              q
-                .from({ tag: tags.collection })
-                .where(({ tag }) => eq(tag.parentGroup, root.group))
-                .where(({ tag }) => eq(tag.value, 20))
-                .select(({ tag }) => ({ id: tag.id })),
-            ),
-          })),
-        )
-        const duplicateAliases = await queryOnce((q) =>
-          q.from({ root: roots.collection }).select(({ root }) => ({
-            id: root.id,
-            issues: toArray(
-              q
-                .from({ item: issues.collection })
-                .where(({ item }) => eq(item.parentGroup, root.group))
-                .where(({ item }) => eq(item.value, 10))
-                .select(({ item }) => ({ id: item.id })),
-            ),
-            tags: toArray(
-              q
-                .from({ item: tags.collection })
-                .where(({ item }) => eq(item.parentGroup, root.group))
-                .where(({ item }) => eq(item.value, 20))
-                .select(({ item }) => ({ id: item.id })),
-            ),
-          })),
-        )
-
-        const expected = [{ id: 1, issues: [{ id: 10 }], tags: [{ id: 20 }] }]
-        expect(stripVirtualProperties(uniqueAliases)).toEqual(expected)
-        expect(stripVirtualProperties(duplicateAliases)).toEqual(expected)
-      } finally {
-        await Promise.all([
-          roots.collection.cleanup(),
-          issues.collection.cleanup(),
-          tags.collection.cleanup(),
-        ])
-      }
-    },
-  )
-
-  fcTest(`optimistic child reorder matches recomputation`, async () => {
-    const roots = createControlledCollection<RootRow>(`order-seed-roots`, [
-      { id: 1, group: 1, value: 0, position: 0 },
-    ])
-    const children = createControlledCollection<ChildRow>(
-      `order-seed-children`,
-      [
-        {
-          id: 1,
-          parentGroup: 1,
-          group: 1,
-          value: 1,
-          position: 0,
-        },
-        {
-          id: 2,
-          parentGroup: 1,
-          group: 1,
-          value: 2,
-          position: 1,
-        },
-      ],
-    )
-    const live = createLiveQueryCollection((q) =>
-      q.from({ root: roots.collection }).select(({ root }) => ({
-        id: root.id,
-        children: toArray(
-          q
-            .from({ child: children.collection })
-            .where(({ child }) => eq(child.parentGroup, root.group))
-            .orderBy(({ child }) => child.position)
-            .select(({ child }) => ({
-              id: child.id,
-              position: child.position,
-            })),
-        ),
-      })),
-    )
-
-    const pending = new Set<PendingWork>()
-    await withPendingWorkCleanup(
-      pending,
-      [live, roots.collection, children.collection],
-      async () => {
-        await live.preload()
-        const transaction = children.collection.update([1, 2], (drafts) => {
-          drafts[0]!.position = 1
-          drafts[1]!.position = 0
-        })
-        trackPendingWork(pending, transaction, children.resolveSync)
-
-        expect(stripVirtualProperties(live.toArray)).toEqual([
-          {
-            id: 1,
-            children: [
-              { id: 2, position: 0 },
-              { id: 1, position: 1 },
-            ],
-          },
-        ])
-      },
-    )
-  })
 })
 
 /**
@@ -5764,22 +4713,6 @@ const scopedNoteRows: Array<ScopedRef> = [
   { id: 200, partId: 2, clientId: 1 },
 ]
 
-const plainSubquery: ScopedSubquery = {
-  joins: `refs`,
-  refsJoin: `left`,
-  predicates: [`subActive`],
-  predicateForm: `separate`,
-  body: `plain`,
-  subSelect: `row`,
-}
-const refsInclude: ScopedInclude = {
-  body: `plain`,
-  form: `toArray`,
-  source: `refs`,
-  clientFilter: false,
-  outerSelect: `spread`,
-}
-
 function pinnedScenario(
   shape: ScopedShape,
   aliases: ScopedAliases,
@@ -5953,64 +4886,6 @@ describe(`includes alpha-renaming across lexical scopes`, () => {
     }
   }
 
-  fcTest(`legality admits shadowing and rejects same-scope reuse`, () => {
-    const shape: ScopedShape = {
-      topology: `fromSubquery`,
-      subquery: { ...plainSubquery, joins: `refsThenNotes` },
-      include: refsInclude,
-    }
-    const legal = {
-      outer: `a`,
-      sub: `a`,
-      joined: `b`,
-      noted: `c`,
-      include: `b`,
-    }
-    expect(classifyScopedNaming(shape, legal)).toBe(`legal`)
-    expect(classifyScopedNaming(shape, { ...legal, include: `a` })).toBe(
-      `shadowing`,
-    )
-    expect(classifyScopedNaming(shape, { ...legal, noted: `b` })).toBe(
-      `sameScope`,
-    )
-    expect(
-      classifyScopedNaming(
-        { ...shape, topology: `unionBranch` },
-        { ...legal, inactive: `c` },
-      ),
-    ).toBe(`sameScope`)
-    expect(
-      classifyScopedNaming(
-        { topology: `wrapper`, wrapperJoin: `left` },
-        { wrapped: `x`, joinSub: `x`, joinSource: `y` },
-      ),
-    ).toBe(`sameScope`)
-    const nestedShape: ScopedShape = {
-      ...shape,
-      include: { ...refsInclude, body: `nestedFrom` },
-    }
-    expect(
-      classifyScopedNaming(nestedShape, {
-        ...legal,
-        include: `a`,
-        includeOuter: `c`,
-      }),
-    ).toBe(`shadowing`)
-    expect(
-      classifyScopedNaming(nestedShape, {
-        ...legal,
-        include: `c`,
-        includeOuter: `c`,
-      }),
-    ).toBe(`shadowing`)
-    expect(
-      classifyScopedNaming(
-        { topology: `unionParent`, includeSource: `refs` },
-        { activeBranch: `a`, inactiveBranch: `a`, anchor: `b`, include: `c` },
-      ),
-    ).toBe(`sameScope`)
-  })
-
   for (const { label, options } of generatedCampaigns(
     80,
     `includes.scoped-alpha-renaming`,
diff --git a/packages/db/tests/query/includes-outer-join-route-work-oracle.test.ts b/packages/db/tests/query/includes-outer-join-route-work-oracle.test.ts
index 531b46defa..b2b2ae8164 100644
--- a/packages/db/tests/query/includes-outer-join-route-work-oracle.test.ts
+++ b/packages/db/tests/query/includes-outer-join-route-work-oracle.test.ts
@@ -8,6 +8,7 @@ import {
 import { BasicIndex } from '../../src/indexes/basic-index.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
 import { flushPromises } from '../utils.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { createScopedSource } from './includes-scope-identity-oracle.js'
 import type { crossJoinParentRoutes } from '../../src/query/compiler/parent-routes.js'
 
@@ -60,57 +61,59 @@ vi.mock('../../src/query/compiler/parent-routes.js', async (importOriginal) => {
   }
 })
 
-describe(`direct outer-join route work`, () => {
-  type Parent = { id: number }
-  type Main = { id: number; parentId: number; anchorId: number }
-  type Anchor = { id: number }
-  type Kind = `right` | `full`
-  type Expected = {
-    parentId: number
-    mainId: number | undefined
-    anchorId: number | undefined
-  }
+type Parent = { id: number }
+type Main = { id: number; parentId: number; anchorId: number }
+type Anchor = { id: number }
+type Kind = `right` | `full`
+type Expected = {
+  parentId: number
+  mainId: number | undefined
+  anchorId: number | undefined
+}
 
-  const sortRows = (rows: Array<Expected>) =>
-    rows.sort(
-      (a, b) =>
-        a.parentId - b.parentId ||
-        (a.mainId ?? Infinity) - (b.mainId ?? Infinity) ||
-        (a.anchorId ?? Infinity) - (b.anchorId ?? Infinity),
-    )
+const sortRows = (rows: Array<Expected>) =>
+  rows.sort(
+    (a, b) =>
+      a.parentId - b.parentId ||
+      (a.mainId ?? Infinity) - (b.mainId ?? Infinity) ||
+      (a.anchorId ?? Infinity) - (b.anchorId ?? Infinity),
+  )
 
-  const model = (
-    parents: ReadonlyArray<Parent>,
-    mains: ReadonlyArray<Main>,
-    anchors: ReadonlyArray<Anchor>,
-    kind: Kind,
-  ): Array<Expected> =>
-    sortRows(
-      parents.flatMap((parent) =>
-        mains
-          .filter((main) => main.parentId === parent.id)
-          .flatMap((main): Array<Expected> => {
-            const matches = anchors.filter(
-              (anchor) => anchor.id === main.anchorId,
-            )
-            if (matches.length === 0 && kind === `full`) {
-              return [
-                {
-                  parentId: parent.id,
-                  mainId: main.id,
-                  anchorId: undefined,
-                },
-              ]
-            }
-            return matches.map((anchor) => ({
-              parentId: parent.id,
-              mainId: main.id,
-              anchorId: anchor.id,
-            }))
-          }),
-      ),
-    )
+const model = (
+  parents: ReadonlyArray<Parent>,
+  mains: ReadonlyArray<Main>,
+  anchors: ReadonlyArray<Anchor>,
+  kind: Kind,
+): Array<Expected> =>
+  sortRows(
+    parents.flatMap((parent) =>
+      mains
+        .filter((main) => main.parentId === parent.id)
+        .flatMap((main): Array<Expected> => {
+          const matches = anchors.filter(
+            (anchor) => anchor.id === main.anchorId,
+          )
+          if (matches.length === 0 && kind === `full`) {
+            return [
+              {
+                parentId: parent.id,
+                mainId: main.id,
+                anchorId: undefined,
+              },
+            ]
+          }
+          return matches.map((anchor) => ({
+            parentId: parent.id,
+            mainId: main.id,
+            anchorId: anchor.id,
+          }))
+        }),
+    ),
+  )
 
+declareOracle({ model: [model] })
+
+describe(`direct outer-join route work`, () => {
   for (const kind of [`right`, `full`] as const) {
     for (const mode of [`eager`, `onDemand`] as const) {
       test(`${kind} main correlation with ${mode} sources avoids work from unrelated joined rows`, async () => {
diff --git a/packages/db/tests/query/includes-publication-oracle.test.ts b/packages/db/tests/query/includes-publication-oracle.test.ts
index 9550aa4c9d..e97df9f258 100644
--- a/packages/db/tests/query/includes-publication-oracle.test.ts
+++ b/packages/db/tests/query/includes-publication-oracle.test.ts
@@ -12,6 +12,7 @@ import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import { createEffect } from '../../src/query/effect.js'
 import { runTrace } from '../trace-runner.js'
 import { oraclePropertyOptions, readOracleRunConfig } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
 import { flushPromises, withExpectedRejection } from '../utils.js'
 import { createControlledCollection } from './includes-oracle-helpers.js'
@@ -563,6 +564,28 @@ async function expectPublicationMatches(
   })
 }
 
+/**
+ * The held include reference sorts the authoritative source rows by rank and
+ * attaches child 10 to root 1. Only the source publication after repair may
+ * change the public snapshot, so this reference has no optimistic overlay.
+ */
+function expectedHeldPublicationRows(
+  sourceRows: ReadonlyMap<number, { id: number; rank: number; value: string }>,
+): Array<{ id: number; value: string; children: Array<number> }> {
+  return [...sourceRows.values()]
+    .sort((left, right) => left.rank - right.rank)
+    .map(({ id, value }) => ({
+      id,
+      value,
+      children: id === 1 ? [10] : [],
+    }))
+}
+
+declareOracle({
+  check: [expectPublicationMatches],
+  model: [recomputeRows, expectedHeldPublicationRows],
+})
+
 const q2Shapes = [`passThrough`, `where`, `orderBy`, `select`] as const
 const q1Shapes = [`direct`, `joined`] as const
 
@@ -932,15 +955,6 @@ describe(`held include publication`, () => {
         [1, { id: 1, rank: 1, value: `A` }],
         [2, { id: 2, rank: 2, value: `X` }],
       ])
-      const expectedRows = () =>
-        [...sourceRows.values()]
-          .sort((left, right) => left.rank - right.rank)
-          .map(({ id, value }) => ({
-            id,
-            value,
-            children: id === 1 ? [10] : [],
-          }))
-
       let sync!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
       let holdRepair = false
       const held: Array<() => void> = []
@@ -1054,7 +1068,7 @@ describe(`held include publication`, () => {
           })
           await flushPromises()
           const before = snapshot()
-          expect(before).toEqual(expectedRows())
+          expect(before).toEqual(expectedHeldPublicationRows(sourceRows))
           const subscription = query.subscribeChanges(
             (changes) => {
               callbacks.push({
@@ -1093,7 +1107,7 @@ describe(`held include publication`, () => {
           holdRepair = false
           for (const release of held.splice(0)) release()
           await flushPromises()
-          const after = expectedRows()
+          const after = expectedHeldPublicationRows(sourceRows)
           expect(snapshot()).toEqual(after)
           expect(callbacks).toEqual([
             {
diff --git a/packages/db/tests/query/includes-query-shape-oracle.test.ts b/packages/db/tests/query/includes-query-shape-oracle.test.ts
index 4291c10808..d5507b0e8c 100644
--- a/packages/db/tests/query/includes-query-shape-oracle.test.ts
+++ b/packages/db/tests/query/includes-query-shape-oracle.test.ts
@@ -8,7 +8,9 @@ import {
 import { BasicIndex } from '../../src/indexes/basic-index.js'
 import { runTrace } from '../trace-runner.js'
 import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { createControlledCollection } from './includes-oracle-helpers.js'
+import { cleanupQuery } from './includes-query-shape-support.js'
 import type { TraceDriver, TraceProjection } from '../trace-runner.js'
 
 /**
@@ -67,30 +69,6 @@ function assertRowsEqual(observed: unknown, expected: unknown): undefined {
   return undefined
 }
 
-type Cleanable = { cleanup: () => Promise<void> }
-
-async function cleanupQuery(
-  live: Cleanable,
-  sources: Array<{ collection: Cleanable }>,
-): Promise<void> {
-  const failures: Array<unknown> = []
-  try {
-    await live.cleanup()
-  } catch (error) {
-    failures.push(error)
-  }
-  const results = await Promise.allSettled(
-    sources.map(({ collection }) => collection.cleanup()),
-  )
-  for (const result of results) {
-    if (result.status === `rejected`) failures.push(result.reason)
-  }
-  if (failures.length === 1) throw failures[0]
-  if (failures.length > 1) {
-    throw new AggregateError(failures, `Query cleanup failed`)
-  }
-}
-
 type ParentRow = { id: number }
 type ChildRow = { id: number; parentId: number }
 
@@ -167,6 +145,22 @@ function createMultiplicityDriver(
   }
 }
 
+/**
+ * The multiplicity model: a parent row is visible while at least one child
+ * names it, however many children do. It scans plain Maps and keeps no join
+ * state, so it predicts the row set that the joined query must publish.
+ */
+function expectedMultiplicityRows({
+  children,
+  parents,
+}: Pick<MultiplicityContext, 'children' | 'parents'>): Array<ParentRow> {
+  return [...parents.values()]
+    .filter((parent) =>
+      [...children.values()].some((child) => child.parentId === parent.id),
+    )
+    .sort((left, right) => left.id - right.id)
+}
+
 const multiplicityProjection: TraceProjection<
   MultiplicityContext,
   unknown,
@@ -174,12 +168,7 @@ const multiplicityProjection: TraceProjection<
 > = {
   // A join projects one parent row for any positive contributor count.
   observe: ({ live }) => stripVirtualProperties(live.toArray),
-  recompute: ({ children, parents }) =>
-    [...parents.values()]
-      .filter((parent) =>
-        [...children.values()].some((child) => child.parentId === parent.id),
-      )
-      .sort((left, right) => left.id - right.id),
+  recompute: expectedMultiplicityRows,
   assertEqual: assertRowsEqual,
 }
 
@@ -304,6 +293,37 @@ type CorrelationResult = Array<{
   productions: Array<ProductionRow>
 }>
 
+/**
+ * The correlation model: each part's route holds the productions whose order
+ * matches the correlation alias the target names. The joined alias routes by
+ * `order.partId`, and the source alias routes by `production.orderId`. Plain
+ * scans over Maps predict the published rows.
+ */
+function expectedCorrelationRows({
+  orders,
+  parts,
+  productions,
+  target,
+}: Pick<
+  CorrelationContext,
+  'orders' | 'parts' | 'productions' | 'target'
+>): CorrelationResult {
+  return [...parts.values()]
+    .sort((left, right) => left.id - right.id)
+    .map((part) => ({
+      id: part.id,
+      productions: [...productions.values()]
+        .filter((production) => {
+          const order = orders.get(production.orderId)
+          if (!order) return false
+          return target === `joined`
+            ? order.partId === part.id
+            : production.orderId === part.id
+        })
+        .sort((left, right) => left.id - right.id),
+    }))
+}
+
 const correlationProjection: TraceProjection<
   CorrelationContext,
   unknown,
@@ -311,21 +331,7 @@ const correlationProjection: TraceProjection<
 > = {
   // Correlation chooses a route. Join identity only decides which rows meet.
   observe: ({ live }) => stripVirtualProperties(live.toArray),
-  recompute: ({ orders, parts, productions, target }) =>
-    [...parts.values()]
-      .sort((left, right) => left.id - right.id)
-      .map((part) => ({
-        id: part.id,
-        productions: [...productions.values()]
-          .filter((production) => {
-            const order = orders.get(production.orderId)
-            if (!order) return false
-            return target === `joined`
-              ? order.partId === part.id
-              : production.orderId === part.id
-          })
-          .sort((left, right) => left.id - right.id),
-      })),
+  recompute: expectedCorrelationRows,
   assertEqual: assertRowsEqual,
 }
 
@@ -406,6 +412,23 @@ type NullableResult = Array<{
   author: AuthorRow | undefined
 }>
 
+/**
+ * The nullable model: each post shows the author its key names, and a null key
+ * or an unmatched key shows no author. The model reads the Maps directly, so it
+ * never routes through a join.
+ */
+function expectedNullableRows({
+  authors,
+  posts,
+}: Pick<NullableContext, 'authors' | 'posts'>): NullableResult {
+  return [...posts.values()]
+    .sort((left, right) => left.id - right.id)
+    .map((post) => ({
+      id: post.id,
+      author: post.authorId === null ? undefined : authors.get(post.authorId),
+    }))
+}
+
 const nullableProjection: TraceProjection<
   NullableContext,
   unknown,
@@ -413,16 +436,24 @@ const nullableProjection: TraceProjection<
 > = {
   // SQL equality never matches null. A later non-null key starts a fresh route.
   observe: ({ live }) => stripVirtualProperties(live.toArray),
-  recompute: ({ authors, posts }) =>
-    [...posts.values()]
-      .sort((left, right) => left.id - right.id)
-      .map((post) => ({
-        id: post.id,
-        author: post.authorId === null ? undefined : authors.get(post.authorId),
-      })),
+  recompute: expectedNullableRows,
   assertEqual: assertRowsEqual,
 }
 
+/**
+ * The check is `runTrace`. After preload and after every source write, it
+ * compares the live query's rows with the projection's model, and it reports
+ * the first divergent checkpoint. The models are the three recomputations above,
+ * each computed from the driver's own Maps.
+ */
+declareOracle({
+  model: [
+    expectedMultiplicityRows,
+    expectedCorrelationRows,
+    expectedNullableRows,
+  ],
+})
+
 function campaigns(fixedSeed: number, property: string) {
   // Grammar controls: the pinned 1-child case reconstructs final retirement,
   // while counts 2–5 keep a surviving contributor. Equal route keys are the
@@ -443,40 +474,6 @@ function campaigns(fixedSeed: number, property: string) {
 }
 
 describe(`includes query-shape recompute oracle`, () => {
-  fcTest(`releases every source and retains cleanup errors`, async () => {
-    const liveError = new Error(`live cleanup`)
-    const sourceError = new Error(`source cleanup`)
-    const released: Array<string> = []
-    await expect(
-      cleanupQuery(
-        {
-          cleanup: async () => {
-            released.push(`live`)
-            throw liveError
-          },
-        },
-        [
-          {
-            collection: {
-              cleanup: async () => {
-                released.push(`first source`)
-                throw sourceError
-              },
-            },
-          },
-          {
-            collection: {
-              cleanup: async () => {
-                released.push(`second source`)
-              },
-            },
-          },
-        ],
-      ),
-    ).rejects.toMatchObject({ errors: [liveError, sourceError] })
-    expect(released).toEqual([`live`, `first source`, `second source`])
-  })
-
   for (const campaign of campaigns(1703, `includes-query-shape.multiplicity`)) {
     fcTest.prop([fc.integer({ min: 2, max: 5 })], campaign.options)(
       `deleting one joined contributor preserves remaining multiplicity (${campaign.name})`,
diff --git a/packages/db/tests/query/includes-query-shape-support.ts b/packages/db/tests/query/includes-query-shape-support.ts
new file mode 100644
index 0000000000..ae2010a45f
--- /dev/null
+++ b/packages/db/tests/query/includes-query-shape-support.ts
@@ -0,0 +1,30 @@
+/**
+ * Cleanup helper shared by the query-shape oracle's drivers and its ordinary
+ * harness test in includes-query-shape.test.ts. Each source and the live query
+ * are released even when another release fails. The law is owned by
+ * includes-query-shape-oracle.test.ts.
+ */
+
+export type Cleanable = { cleanup: () => Promise<void> }
+
+export async function cleanupQuery(
+  live: Cleanable,
+  sources: Array<{ collection: Cleanable }>,
+): Promise<void> {
+  const failures: Array<unknown> = []
+  try {
+    await live.cleanup()
+  } catch (error) {
+    failures.push(error)
+  }
+  const results = await Promise.allSettled(
+    sources.map(({ collection }) => collection.cleanup()),
+  )
+  for (const result of results) {
+    if (result.status === `rejected`) failures.push(result.reason)
+  }
+  if (failures.length === 1) throw failures[0]
+  if (failures.length > 1) {
+    throw new AggregateError(failures, `Query cleanup failed`)
+  }
+}
diff --git a/packages/db/tests/query/includes-query-shape.test.ts b/packages/db/tests/query/includes-query-shape.test.ts
new file mode 100644
index 0000000000..080b6c8d3c
--- /dev/null
+++ b/packages/db/tests/query/includes-query-shape.test.ts
@@ -0,0 +1,45 @@
+/**
+ * Ordinary harness test for the query-shape oracle. It checks the cleanup
+ * helper that the oracle's drivers use: every release runs and every error is
+ * kept. The oracle's law (join multiplicity, correlation identity, and null
+ * keys) is owned by includes-query-shape-oracle.test.ts.
+ */
+import { test as fcTest } from '@fast-check/vitest'
+import { describe, expect } from 'vitest'
+import { cleanupQuery } from './includes-query-shape-support.js'
+
+describe(`includes query-shape recompute oracle`, () => {
+  fcTest(`releases every source and retains cleanup errors`, async () => {
+    const liveError = new Error(`live cleanup`)
+    const sourceError = new Error(`source cleanup`)
+    const released: Array<string> = []
+    await expect(
+      cleanupQuery(
+        {
+          cleanup: async () => {
+            released.push(`live`)
+            throw liveError
+          },
+        },
+        [
+          {
+            collection: {
+              cleanup: async () => {
+                released.push(`first source`)
+                throw sourceError
+              },
+            },
+          },
+          {
+            collection: {
+              cleanup: async () => {
+                released.push(`second source`)
+              },
+            },
+          },
+        ],
+      ),
+    ).rejects.toMatchObject({ errors: [liveError, sourceError] })
+    expect(released).toEqual([`live`, `first source`, `second source`])
+  })
+})
diff --git a/packages/db/tests/query/includes-route-grammar-oracle.ts b/packages/db/tests/query/includes-route-grammar-oracle.ts
new file mode 100644
index 0000000000..9142339884
--- /dev/null
+++ b/packages/db/tests/query/includes-route-grammar-oracle.ts
@@ -0,0 +1,526 @@
+// The route-lifecycle and visible-relationship history grammar for the
+// includes recompute oracle in includes-oracle.property.test.ts. The builders
+// here construct legal route histories and reject illegal ones; they compute no
+// expected result. The model that predicts each result is the oracle file's
+// recompute, and the grammar's law is owned by that oracle.
+import type { OracleSyncChange as SyncChange } from './includes-oracle-helpers.js'
+import type { ChildRow, RootRow } from './includes-structural-support.js'
+
+/**
+ * # Does the incremental include graph equal full relationship recomputation?
+ *
+ * Authority: `packages/db/src/query/live/ARCHITECTURE.md`, normative laws
+ * 1, 3–5, and 8. This owner checks inline result values and order through the
+ * public live-query Collection after each synchronous source change.
+ *
+ * This is the central structural oracle for inline includes. Production updates
+ * nested results incrementally. The reference stores source rows in plain Maps
+ * and rebuilds the whole tree after every meaningful checkpoint.
+ *
+ * The suite protects five groups of laws:
+ *
+ * 1. Inserts, updates, deletes, and optimistic settlement match recomputation
+ *    at one to four include levels.
+ * 2. Rekey and reparent histories preserve route ownership through fresh,
+ *    shared, retired, restored, merged, and split routes.
+ * 3. Atomic and split full-row batches produce the same tree when they encode
+ *    the same logical source state.
+ * 4. Nested scalar materialization follows reference changes and shared paths.
+ * 5. Alpha-renaming, sibling order, and unrelated siblings do not change the
+ *    relevant result, including when sibling scopes such as a `from()`
+ *    subquery and an include reuse alias names.
+ *
+ * These laws use a model graph, not one universal controller. The structural
+ * node recomputes relationship trees. A separate scalar-reference node follows
+ * explicit foreign keys. Metamorphic checks compare equivalent query forms.
+ * Scenario builders describe legal route histories, but they do not compute
+ * the expected result.
+ *
+ * The trace runner checks each intermediate cut that the contract exposes.
+ * Focused pinned histories preserve small boundary cases. Random or replayed
+ * campaigns explore longer action sequences and wider route values. Other
+ * include suites own Collection facades, demand lifetime, functional callbacks,
+ * and publication coherence.
+ *
+ * Known limits: the structural histories use numeric correlation groups,
+ * finite row IDs, one to four levels, and the declared transition shapes.
+ * Their public-row checks protect those represented histories at the named
+ * checkpoints; they do not prove every route relation state or source schedule.
+ * This file owns further structural route witnesses. The architecture's
+ * executable-contract map assigns other include boundaries to their suites.
+ */
+
+export type IncludeDepth = 1 | 2 | 3 | 4
+
+export type FullRowBatchStep =
+  | { level: 0; changes: Array<SyncChange<RootRow>> }
+  | { level: IncludeDepth; changes: Array<SyncChange<ChildRow>> }
+
+export type FullRowBatchScenario = {
+  depth: IncludeDepth
+  steps: Array<FullRowBatchStep>
+}
+
+export function updateModel<T extends { id: number }>(
+  model: Map<number, T>,
+  changes: ReadonlyArray<SyncChange<T>>,
+): void {
+  for (const change of changes) {
+    if (change.type === `delete`) {
+      model.delete(change.value.id)
+    } else {
+      model.set(change.value.id, change.value)
+    }
+  }
+}
+
+export function updateFullRowBatchModels(
+  step: FullRowBatchStep,
+  roots: Map<number, RootRow>,
+  levels: Array<Map<number, ChildRow>>,
+): void {
+  if (step.level === 0) {
+    updateModel(roots, step.changes)
+  } else {
+    updateModel(levels[step.level - 1]!, step.changes)
+  }
+}
+
+export function batchRoot(
+  id: number,
+  group: number,
+  value = id * 10,
+  position = id - 1,
+): RootRow {
+  return { id, group, value, position }
+}
+
+export function batchChild(
+  id: number,
+  parentGroup: number,
+  value = id * 10,
+  position = id - 1,
+): ChildRow {
+  return { id, parentGroup, group: id * 10, value, position }
+}
+
+export type ConnectedBranch = {
+  idBase: number
+  groupBase: number
+}
+
+export function createConnectedBatchBranches(
+  depth: IncludeDepth,
+  branches: ReadonlyArray<ConnectedBranch> = [
+    { idBase: 100, groupBase: 100 },
+    { idBase: 200, groupBase: 200 },
+  ],
+): Array<FullRowBatchStep> {
+  const steps: Array<FullRowBatchStep> = [
+    {
+      level: 0,
+      changes: branches.map(({ idBase, groupBase }) => ({
+        type: `insert`,
+        value: batchRoot(idBase, groupBase, idBase, 0),
+      })),
+    },
+  ]
+
+  for (let level = 1; level <= depth; level++) {
+    steps.push({
+      level: level as IncludeDepth,
+      changes: branches.map(({ idBase, groupBase }) => ({
+        type: `insert`,
+        value: {
+          ...batchChild(
+            idBase + level,
+            groupBase + level - 1,
+            idBase + level,
+            0,
+          ),
+          group: groupBase + level,
+        },
+      })),
+    })
+  }
+
+  return steps
+}
+
+export function otherBranch(branch: 0 | 1): 0 | 1 {
+  return branch === 0 ? 1 : 0
+}
+
+export type VisibleRelationshipScenario = FullRowBatchScenario & {
+  transitionStepIndex: number
+}
+
+export type VisibleScalarNoise = {
+  side: `before` | `after`
+  level: 0 | IncludeDepth
+  branch: 0 | 1
+  value: number
+  position: number
+}
+
+export type VisibleRelationshipScenarioOptions = {
+  depth: IncludeDepth
+  targetLevel: IncludeDepth
+  sourceBranch: 0 | 1
+  branches: readonly [ConnectedBranch, ConnectedBranch]
+  noise: ReadonlyArray<VisibleScalarNoise>
+} & (
+  | { transition: `reparent`; rekeyGroup?: never }
+  | { transition: `rekey`; rekeyGroup: number }
+)
+
+export function assertDisjointRelationshipKeys(
+  depth: IncludeDepth,
+  branches: readonly [ConnectedBranch, ConnectedBranch],
+  {
+    extraIds = [],
+    extraGroups = [],
+  }: {
+    extraIds?: ReadonlyArray<number>
+    extraGroups?: ReadonlyArray<number>
+  } = {},
+): void {
+  const ids = [
+    ...branches.flatMap(({ idBase }) =>
+      Array.from({ length: depth + 1 }, (_, level) => idBase + level),
+    ),
+    ...extraIds,
+  ]
+  const groups = [
+    ...branches.flatMap(({ groupBase }) =>
+      Array.from({ length: depth + 1 }, (_, level) => groupBase + level),
+    ),
+    ...extraGroups,
+  ]
+  if (
+    new Set(ids).size !== ids.length ||
+    new Set(groups).size !== groups.length
+  ) {
+    throw new Error(`Visible relationship keys overlap`)
+  }
+}
+
+export function createVisibleRelationshipScenario(
+  options: VisibleRelationshipScenarioOptions,
+): VisibleRelationshipScenario {
+  const { depth, transition, targetLevel, sourceBranch, branches, noise } =
+    options
+  assertDisjointRelationshipKeys(
+    depth,
+    branches,
+    transition === `rekey` ? { extraGroups: [options.rekeyGroup] } : {},
+  )
+  const steps = createConnectedBatchBranches(depth, branches)
+  const roots = new Map<number, RootRow>()
+  const levels = Array.from({ length: 4 }, () => new Map<number, ChildRow>())
+
+  for (const step of steps) {
+    updateFullRowBatchModels(step, roots, levels)
+  }
+
+  const appendNoise = (entry: VisibleScalarNoise): void => {
+    const branch = branches[entry.branch]
+    if (entry.level === 0) {
+      const current = roots.get(branch.idBase)!
+      const value = {
+        ...current,
+        value: entry.value,
+        position: entry.position,
+      }
+      roots.set(value.id, value)
+      steps.push({ level: 0, changes: [{ type: `update`, value }] })
+      return
+    }
+
+    const model = levels[entry.level - 1]!
+    const current = model.get(branch.idBase + entry.level)!
+    const value = {
+      ...current,
+      value: entry.value,
+      position: entry.position,
+    }
+    model.set(value.id, value)
+    steps.push({
+      level: entry.level,
+      changes: [{ type: `update`, value }],
+    })
+  }
+
+  for (const entry of noise.filter(({ side }) => side === `before`)) {
+    appendNoise(entry)
+  }
+
+  const source = branches[sourceBranch]
+  const destination = branches[otherBranch(sourceBranch)]
+  const targetModel = levels[targetLevel - 1]!
+  const current = targetModel.get(source.idBase + targetLevel)!
+  const value: ChildRow = {
+    ...current,
+    parentGroup:
+      transition === `reparent`
+        ? destination.groupBase + targetLevel - 1
+        : current.parentGroup,
+    group: transition === `rekey` ? options.rekeyGroup : current.group,
+  }
+  const transitionStepIndex = steps.length
+  steps.push({
+    level: targetLevel,
+    changes: [{ type: `update`, value }],
+  })
+  targetModel.set(value.id, value)
+
+  for (const entry of noise.filter(({ side }) => side === `after`)) {
+    appendNoise(entry)
+  }
+
+  return {
+    depth,
+    steps,
+    transitionStepIndex,
+  }
+}
+
+export type RouteDestination = {
+  strategy: `fresh` | `restore` | `merge` | `split` | `retired`
+  route: number
+}
+
+// Route lifecycle descriptors form a constrained design grammar. A numeric
+// `route` is a model-only parent group value for one include edge, not a
+// production BucketKey or route-relation row. `strategy` classifies legal
+// histories for generation; the Map recomputation still supplies the answer.
+// Constructors reject combinations that do not name a real lifecycle state.
+export type RouteTransitionDescriptor = {
+  row: 0 | 1
+  stepsBefore?: ReadonlyArray<FullRowBatchStep>
+} & (
+  | {
+      kind: `reparent`
+      level: IncludeDepth
+      destination: { strategy: `merge`; route: number }
+    }
+  | {
+      kind: `rekey`
+      level: 0 | IncludeDepth
+      destination: RouteDestination
+    }
+)
+
+export type RouteLifecycleScenario = FullRowBatchScenario & {
+  transitionStepIndexes: ReadonlyArray<number>
+}
+
+export type RouteLifecycleScenarioOptions = {
+  depth: IncludeDepth
+  branches: readonly [ConnectedBranch, ConnectedBranch]
+  descriptors: ReadonlyArray<RouteTransitionDescriptor>
+  prefixSteps?: ReadonlyArray<FullRowBatchStep>
+  trailingSteps?: ReadonlyArray<FullRowBatchStep>
+}
+
+export function rowAt(
+  branches: readonly [ConnectedBranch, ConnectedBranch],
+  row: 0 | 1,
+  level: 0 | IncludeDepth,
+): number {
+  return branches[row].idBase + level
+}
+
+export function applyRouteLifecycleStep(
+  step: FullRowBatchStep,
+  roots: Map<number, RootRow>,
+  levels: Array<Map<number, ChildRow>>,
+  seenRoutes: Set<string>,
+  retiredRouteOwners: Map<string, number>,
+): void {
+  const rows = step.level === 0 ? roots : levels[step.level - 1]!
+  const previousRouteOwners = new Map<number, Set<number>>()
+
+  for (const change of step.changes) {
+    const previous = rows.get(change.value.id)
+    if (!previous) continue
+    const owners = previousRouteOwners.get(previous.group) ?? new Set<number>()
+    owners.add(previous.id)
+    previousRouteOwners.set(previous.group, owners)
+  }
+
+  updateFullRowBatchModels(step, roots, levels)
+
+  for (const row of rows.values()) {
+    const route = routeIdentity(step.level, row.group)
+    seenRoutes.add(route)
+    retiredRouteOwners.delete(route)
+  }
+  for (const [route, previousOwners] of previousRouteOwners) {
+    if ([...rows.values()].some((row) => row.group === route)) continue
+    const retiredRoute = routeIdentity(step.level, route)
+    if (previousOwners.size === 1) {
+      retiredRouteOwners.set(retiredRoute, [...previousOwners][0]!)
+    } else {
+      retiredRouteOwners.delete(retiredRoute)
+    }
+  }
+}
+
+export function routeIdentity(level: 0 | IncludeDepth, route: number): string {
+  // This oracle has one include edge per level, so level plus correlation value
+  // is the complete route identity. Equal values at different levels are not
+  // the same subscription lifecycle.
+  return `${level}:${route}`
+}
+
+export function createRouteLifecycleScenario({
+  depth,
+  branches,
+  descriptors,
+  prefixSteps = createConnectedBatchBranches(depth, branches),
+  trailingSteps = [],
+}: RouteLifecycleScenarioOptions): RouteLifecycleScenario {
+  const seenRoutes = new Set<string>()
+  const retiredRouteOwners = new Map<string, number>()
+
+  const steps = [...prefixSteps]
+  const roots = new Map<number, RootRow>()
+  const levels = Array.from({ length: 4 }, () => new Map<number, ChildRow>())
+  for (const step of steps) {
+    applyRouteLifecycleStep(step, roots, levels, seenRoutes, retiredRouteOwners)
+  }
+
+  const transitionStepIndexes: Array<number> = []
+  for (const descriptor of descriptors) {
+    const destination = descriptor.destination as RouteDestination
+    if (descriptor.kind === `reparent` && destination.strategy !== `merge`) {
+      throw new Error(
+        `reparent transitions only support live merge destinations`,
+      )
+    }
+    for (const step of descriptor.stepsBefore ?? []) {
+      steps.push(step)
+      applyRouteLifecycleStep(
+        step,
+        roots,
+        levels,
+        seenRoutes,
+        retiredRouteOwners,
+      )
+    }
+
+    const id = rowAt(branches, descriptor.row, descriptor.level)
+    const rowsAtLevel =
+      descriptor.level === 0
+        ? [...roots.values()]
+        : [...levels[descriptor.level - 1]!.values()]
+    const current = rowsAtLevel.find((row) => row.id === id)
+    if (!current) throw new Error(`Missing transition row ${id}`)
+    const currentRoute =
+      descriptor.kind === `rekey`
+        ? current.group
+        : (current as ChildRow).parentGroup
+    const destinationRows =
+      descriptor.kind === `rekey`
+        ? rowsAtLevel
+        : descriptor.level === 1
+          ? [...roots.values()]
+          : [...levels[descriptor.level - 2]!.values()]
+    const destinationIsLive = destinationRows.some(
+      (row) => row.group === descriptor.destination.route,
+    )
+    const currentRouteUsers = rowsAtLevel.filter((row) =>
+      descriptor.kind === `rekey`
+        ? row.group === currentRoute
+        : (row as ChildRow).parentGroup === currentRoute,
+    ).length
+    const destinationRoute = routeIdentity(
+      descriptor.level,
+      descriptor.destination.route,
+    )
+    const retiredOwner = retiredRouteOwners.get(destinationRoute)
+
+    switch (descriptor.destination.strategy) {
+      case `fresh`:
+        if (seenRoutes.has(destinationRoute)) {
+          throw new Error(`fresh route must never have been used`)
+        }
+        break
+      case `restore`:
+        if (destinationIsLive || retiredOwner !== id) {
+          throw new Error(`restore route must have been retired by this row`)
+        }
+        break
+      case `merge`:
+        if (
+          !destinationIsLive ||
+          descriptor.destination.route === currentRoute
+        ) {
+          throw new Error(`merge route must be live and different`)
+        }
+        break
+      case `split`:
+        if (seenRoutes.has(destinationRoute)) {
+          throw new Error(`split destination must be unused`)
+        }
+        if (currentRouteUsers < 2) {
+          throw new Error(`split source route must be shared`)
+        }
+        break
+      case `retired`:
+        if (
+          destinationIsLive ||
+          retiredOwner === undefined ||
+          retiredOwner === id
+        ) {
+          throw new Error(`retired route must have been retired by another row`)
+        }
+        break
+    }
+
+    let step: FullRowBatchStep
+    if (descriptor.level === 0) {
+      const root = roots.get(id)
+      if (!root) throw new Error(`Missing transition root ${id}`)
+      step = {
+        level: 0,
+        changes: [
+          {
+            type: `update`,
+            value: { ...root, group: descriptor.destination.route },
+          },
+        ],
+      }
+    } else {
+      const child = levels[descriptor.level - 1]!.get(id)
+      if (!child) throw new Error(`Missing transition child ${id}`)
+      step = {
+        level: descriptor.level,
+        changes: [
+          {
+            type: `update`,
+            value:
+              descriptor.kind === `rekey`
+                ? { ...child, group: descriptor.destination.route }
+                : {
+                    ...child,
+                    parentGroup: descriptor.destination.route,
+                  },
+          },
+        ],
+      }
+    }
+    transitionStepIndexes.push(steps.length)
+    steps.push(step)
+    applyRouteLifecycleStep(step, roots, levels, seenRoutes, retiredRouteOwners)
+  }
+
+  steps.push(...trailingSteps)
+  return { depth, steps, transitionStepIndexes }
+}
+
+export const transitionHistoryBranches = [
+  { idBase: 100, groupBase: 600 },
+  { idBase: 1_100, groupBase: 1_600 },
+] as const
diff --git a/packages/db/tests/query/includes-scope-identity-oracle.ts b/packages/db/tests/query/includes-scope-identity-oracle.ts
index 613244e91e..621c4bdf09 100644
--- a/packages/db/tests/query/includes-scope-identity-oracle.ts
+++ b/packages/db/tests/query/includes-scope-identity-oracle.ts
@@ -1,4 +1,7 @@
 import { fc } from '@fast-check/vitest'
+import { declareOracle } from '../oracle-declaration.js'
+import { createCollection } from '../../src/collection/index.js'
+import { createFilterFunctionFromExpression } from '../../src/collection/change-events.js'
 import {
   and,
   createLiveQueryCollection,
@@ -7,8 +10,6 @@ import {
   not,
   toArray,
 } from '../../src/query/index.js'
-import { createCollection } from '../../src/collection/index.js'
-import { createFilterFunctionFromExpression } from '../../src/collection/change-events.js'
 import { mockSyncCollectionOptions } from '../utils.js'
 import type { Collection } from '../../src/collection/index.js'
 import type { LoadSubsetOptions } from '../../src/types.js'
@@ -850,3 +851,5 @@ export function sortedRequests(sources: ScopedSources) {
     notes: [...sources.notes.requests].sort(),
   }
 }
+
+declareOracle({ model: [recomputeScopedRows] })
diff --git a/packages/db/tests/query/includes-space-helpers.ts b/packages/db/tests/query/includes-space-helpers.ts
new file mode 100644
index 0000000000..1a194073c1
--- /dev/null
+++ b/packages/db/tests/query/includes-space-helpers.ts
@@ -0,0 +1,48 @@
+// Shared harness for the nested Collection space tests: facade-map spying and a
+// fixture wrapper with cleanup. The space law is owned by
+// includes-space-oracle.test.ts; ordinary setup tests live in includes-space.test.ts.
+import { vi } from 'vitest'
+import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { createNestedCollectionFixture } from './includes-space-oracle-fixture.js'
+
+// Inspect retained adapter state only in tests; diagnostics need no runtime API.
+export type AdapterState = {
+  getEntry: (...args: Array<unknown>) => { collection: object }
+  entries: Map<string, Map<string, unknown>>
+  retiredEntries: Map<string, Map<string, unknown>>
+}
+
+export function countEntries(entries: AdapterState[`entries`]): number {
+  return [...entries.values()].reduce(
+    (total, buckets) => total + buckets.size,
+    0,
+  )
+}
+
+export function spyFacadeEntries() {
+  return vi.spyOn(
+    BucketFacadeAdapter.prototype as unknown as AdapterState,
+    `getEntry`,
+  )
+}
+
+export async function withSpaceFixture(
+  rootCount: number,
+  inspect: (
+    fixture: Awaited<ReturnType<typeof createNestedCollectionFixture>>,
+    entries: ReturnType<typeof spyFacadeEntries>,
+  ) => Promise<void>,
+  leafCount = 10,
+) {
+  const entries = spyFacadeEntries()
+  let fixture:
+    Awaited<ReturnType<typeof createNestedCollectionFixture>> | undefined
+  return withHistoryCleanup(
+    async () => {
+      fixture = await createNestedCollectionFixture(rootCount, leafCount)
+      await inspect(fixture, entries)
+    },
+    () => [() => fixture?.cleanup(), () => entries.mockRestore()],
+  )
+}
diff --git a/packages/db/tests/query/includes-space-oracle.test.ts b/packages/db/tests/query/includes-space-oracle.test.ts
index fba732c3a2..5c6add893d 100644
--- a/packages/db/tests/query/includes-space-oracle.test.ts
+++ b/packages/db/tests/query/includes-space-oracle.test.ts
@@ -1,8 +1,7 @@
-import { describe, expect, it, vi } from 'vitest'
-import { CollectionImpl } from '../../src/collection/index.js'
-import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
-import { withHistoryCleanup } from '../optimistic-history-oracle.js'
-import { createNestedCollectionFixture } from './includes-space-oracle-fixture.js'
+import { describe, expect, it } from 'vitest'
+import { declareOracle } from '../oracle-declaration.js'
+import { countEntries, withSpaceFixture } from './includes-space-helpers.js'
+import type { AdapterState } from './includes-space-helpers.js'
 
 /**
  * # Does nested Collection materialization retain only reachable facades?
@@ -28,108 +27,16 @@ import { createNestedCollectionFixture } from './includes-space-oracle-fixture.j
  * It does not measure retained D2 rows, demand, or route churn.
  */
 
-// Inspect retained adapter state only in tests; diagnostics need no runtime API.
-type AdapterState = {
-  getEntry: (...args: Array<unknown>) => { collection: object }
-  entries: Map<string, Map<string, unknown>>
-  retiredEntries: Map<string, Map<string, unknown>>
+// The space law counts one facade for each reachable bucket: each root, the two
+// branches under it, and the five twigs under each branch. Leaves change row
+// volume but add no facade, so the count does not depend on leafCount.
+function expectedFacadeCount(rootCount: number): number {
+  return rootCount + rootCount * 2 + rootCount * 2 * 5
 }
 
-function countEntries(entries: AdapterState[`entries`]): number {
-  return [...entries.values()].reduce(
-    (total, buckets) => total + buckets.size,
-    0,
-  )
-}
-
-function spyFacadeEntries() {
-  return vi.spyOn(
-    BucketFacadeAdapter.prototype as unknown as AdapterState,
-    `getEntry`,
-  )
-}
-
-async function withSpaceFixture(
-  rootCount: number,
-  inspect: (
-    fixture: Awaited<ReturnType<typeof createNestedCollectionFixture>>,
-    entries: ReturnType<typeof spyFacadeEntries>,
-  ) => Promise<void>,
-  leafCount = 10,
-) {
-  const entries = spyFacadeEntries()
-  let fixture:
-    Awaited<ReturnType<typeof createNestedCollectionFixture>> | undefined
-  return withHistoryCleanup(
-    async () => {
-      fixture = await createNestedCollectionFixture(rootCount, leafCount)
-      await inspect(fixture, entries)
-    },
-    () => [() => fixture?.cleanup(), () => entries.mockRestore()],
-  )
-}
+declareOracle({ model: [expectedFacadeCount] })
 
 describe(`nested Collection materialization space oracle`, () => {
-  // Exhaust the setup ownership boundary: four sources, every distinct
-  // failing/held pair, and both synchronous and asynchronous failures.
-  for (const failed of [0, 1, 2, 3]) {
-    for (const held of [0, 1, 2, 3].filter((index) => index !== failed)) {
-      it.each([`throw`, `reject`] as const)(
-        `settles held source ${held} before cleanup after source ${failed} %s`,
-        async (mode) => {
-          const primary = new Error(`first preload failure`)
-          let release!: () => void
-          const gate = new Promise<void>((resolve) => {
-            release = resolve
-          })
-          const original = CollectionImpl.prototype.preload
-          let started = 0
-          const preload = vi
-            .spyOn(CollectionImpl.prototype, `preload`)
-            .mockImplementation(function (this: CollectionImpl) {
-              const index = started++
-              if (index === held) return gate
-              if (index === failed) {
-                if (mode === `throw`) throw primary
-                return Promise.reject(primary)
-              }
-              return original.call(this)
-            })
-          const cleanup = vi.spyOn(CollectionImpl.prototype, `cleanup`)
-          let settled = false
-          const result = createNestedCollectionFixture(1).then(
-            async (fixture) => {
-              settled = true
-              await fixture.cleanup()
-              return undefined
-            },
-            (error: unknown) => {
-              settled = true
-              return error
-            },
-          )
-          try {
-            // Let every runnable preload and failure continuation run, without
-            // releasing the held source. This is a host cut, not a sleep budget.
-            await new Promise<void>((resolve) => setTimeout(resolve, 0))
-            expect(started).toBe(4)
-            expect(settled).toBe(false)
-            expect(cleanup).not.toHaveBeenCalled()
-            release()
-            expect(await result).toBe(primary)
-            expect(cleanup).toHaveBeenCalledTimes(4)
-            expect(new Set(cleanup.mock.contexts).size).toBe(4)
-          } finally {
-            release()
-            await result
-            preload.mockRestore()
-            cleanup.mockRestore()
-          }
-        },
-      )
-    }
-  }
-
   it.each([0, 1, 20])(
     `constructs exactly one facade per reachable bucket for %i roots`,
     async (rootCount) => {
@@ -142,16 +49,16 @@ describe(`nested Collection materialization space oracle`, () => {
             .filter((result) => result.type === `return`)
             .map((result) => result.value),
         )
-        expect(created.size).toBe(fixture.expectedFacadeCount)
+        expect(created.size).toBe(expectedFacadeCount(rootCount))
         expect(
           new Set([...created].map((entry) => entry.collection)).size,
-        ).toBe(fixture.expectedFacadeCount)
+        ).toBe(expectedFacadeCount(rootCount))
         expect(
           [...adapters].reduce(
             (n, adapter) => n + countEntries(adapter.entries),
             0,
           ),
-        ).toBe(fixture.expectedFacadeCount)
+        ).toBe(expectedFacadeCount(rootCount))
         expect(
           [...adapters].reduce(
             (n, adapter) => n + countEntries(adapter.retiredEntries),
@@ -161,123 +68,4 @@ describe(`nested Collection materialization space oracle`, () => {
       })
     },
   )
-
-  // A leaf-based facade rule predicts 0 or 100 for the endpoints, not 13.
-  // Read the leaf rows too, so a fixture that ignores leafCount cannot pass.
-  it.each([0, 1, 10])(
-    `keeps facade count at thirteen when each twig has %i leaves`,
-    async (leafCount) => {
-      await withSpaceFixture(
-        1,
-        async (fixture, entries) => {
-          await fixture.live.preload()
-          const twigs = fixture.live.toArray.flatMap((root) =>
-            root.branches.toArray.flatMap((branch) => branch.twigs.toArray),
-          )
-          expect(twigs).toHaveLength(10)
-          expect(
-            twigs.reduce(
-              (total, twig) => total + twig.leaves.toArray.length,
-              0,
-            ),
-          ).toBe(10 * leafCount)
-          // A facade-per-leaf result must fail the same count comparison.
-          expect(() => expect(10 * leafCount).toBe(13)).toThrow()
-
-          const adapters = new Set(entries.mock.contexts as Array<AdapterState>)
-          const created = new Set(
-            entries.mock.results
-              .filter((result) => result.type === `return`)
-              .map((result) => result.value),
-          )
-          expect(created.size).toBe(13)
-          expect(
-            new Set([...created].map((entry) => entry.collection)).size,
-          ).toBe(13)
-          expect(
-            [...adapters].reduce(
-              (total, adapter) => total + countEntries(adapter.entries),
-              0,
-            ),
-          ).toBe(13)
-        },
-        leafCount,
-      )
-    },
-  )
-
-  for (const { phase, index } of [
-    { phase: `preload`, index: 0 },
-    { phase: `preload-rejection`, index: 0 },
-    { phase: `createIndex`, index: 0 },
-    { phase: `createIndex`, index: 1 },
-    { phase: `createIndex`, index: 2 },
-  ] as const) {
-    it.each([false, true])(
-      `cleans every source and restores its spy after ${phase} ${index} fails (cleanup failure=%s)`,
-      async (failCleanup) => {
-        const primary = new Error(`space setup failure`)
-        const secondary = new Error(`space cleanup failure`)
-        const originalEntry = (
-          BucketFacadeAdapter.prototype as unknown as AdapterState
-        ).getEntry
-        const originalCleanup = CollectionImpl.prototype.cleanup
-        const cleanup = vi.spyOn(CollectionImpl.prototype, `cleanup`)
-        if (failCleanup)
-          cleanup.mockImplementationOnce(async function (this: CollectionImpl) {
-            await originalCleanup.call(this)
-            throw secondary
-          })
-        const setup =
-          phase === `preload-rejection`
-            ? vi
-                .spyOn(CollectionImpl.prototype, `preload`)
-                .mockRejectedValueOnce(primary)
-            : phase === `createIndex`
-              ? (() => {
-                  const originalIndex = CollectionImpl.prototype.createIndex
-                  const spy = vi.spyOn(CollectionImpl.prototype, `createIndex`)
-                  for (let prior = 0; prior < index; prior++)
-                    spy.mockImplementationOnce(originalIndex)
-                  return spy.mockImplementationOnce(() => {
-                    throw primary
-                  })
-                })()
-              : vi
-                  .spyOn(CollectionImpl.prototype, phase)
-                  .mockImplementationOnce(() => {
-                    throw primary
-                  })
-        await withHistoryCleanup(
-          async () => {
-            const result = withSpaceFixture(1, () =>
-              Promise.reject(
-                new Error(`failed setup must not reach inspection`),
-              ),
-            )
-            if (failCleanup) {
-              const failure: unknown = await result.catch(
-                (error: unknown) => error,
-              )
-              expect(failure).toBeInstanceOf(AggregateError)
-              if (!(failure instanceof AggregateError)) throw failure
-              expect(failure.cause).toBe(primary)
-              expect(failure.errors).toHaveLength(2)
-              expect(failure.errors[0]).toBe(primary)
-              expect(failure.errors[1]).toBe(secondary)
-            } else {
-              await expect(result).rejects.toBe(primary)
-            }
-            expect(cleanup).toHaveBeenCalledTimes(4)
-            expect(new Set(cleanup.mock.contexts).size).toBe(4)
-            expect(
-              (BucketFacadeAdapter.prototype as unknown as AdapterState)
-                .getEntry,
-            ).toBe(originalEntry)
-          },
-          () => [() => setup.mockRestore(), () => cleanup.mockRestore()],
-        )
-      },
-    )
-  }
 })
diff --git a/packages/db/tests/query/includes-space.test.ts b/packages/db/tests/query/includes-space.test.ts
new file mode 100644
index 0000000000..227a54057b
--- /dev/null
+++ b/packages/db/tests/query/includes-space.test.ts
@@ -0,0 +1,192 @@
+// Ordinary regression tests for nested Collection materialization space: setup
+// ownership under held or failing sources, and facade counts with literal
+// expectations. The facade-per-reachable-bucket law is owned by
+// includes-space-oracle.test.ts.
+import { describe, expect, it, vi } from 'vitest'
+import { CollectionImpl } from '../../src/collection/index.js'
+import { BucketFacadeAdapter } from '../../src/query/live/bucket-facade-adapter.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { createNestedCollectionFixture } from './includes-space-oracle-fixture.js'
+import { countEntries, withSpaceFixture } from './includes-space-helpers.js'
+import type { AdapterState } from './includes-space-helpers.js'
+
+describe(`nested Collection materialization space oracle`, () => {
+  // Exhaust the setup ownership boundary: four sources, every distinct
+  // failing/held pair, and both synchronous and asynchronous failures.
+  for (const failed of [0, 1, 2, 3]) {
+    for (const held of [0, 1, 2, 3].filter((index) => index !== failed)) {
+      it.each([`throw`, `reject`] as const)(
+        `settles held source ${held} before cleanup after source ${failed} %s`,
+        async (mode) => {
+          const primary = new Error(`first preload failure`)
+          let release!: () => void
+          const gate = new Promise<void>((resolve) => {
+            release = resolve
+          })
+          const original = CollectionImpl.prototype.preload
+          let started = 0
+          const preload = vi
+            .spyOn(CollectionImpl.prototype, `preload`)
+            .mockImplementation(function (this: CollectionImpl) {
+              const index = started++
+              if (index === held) return gate
+              if (index === failed) {
+                if (mode === `throw`) throw primary
+                return Promise.reject(primary)
+              }
+              return original.call(this)
+            })
+          const cleanup = vi.spyOn(CollectionImpl.prototype, `cleanup`)
+          let settled = false
+          const result = createNestedCollectionFixture(1).then(
+            async (fixture) => {
+              settled = true
+              await fixture.cleanup()
+              return undefined
+            },
+            (error: unknown) => {
+              settled = true
+              return error
+            },
+          )
+          try {
+            // Let every runnable preload and failure continuation run, without
+            // releasing the held source. This is a host cut, not a sleep budget.
+            await new Promise<void>((resolve) => setTimeout(resolve, 0))
+            expect(started).toBe(4)
+            expect(settled).toBe(false)
+            expect(cleanup).not.toHaveBeenCalled()
+            release()
+            expect(await result).toBe(primary)
+            expect(cleanup).toHaveBeenCalledTimes(4)
+            expect(new Set(cleanup.mock.contexts).size).toBe(4)
+          } finally {
+            release()
+            await result
+            preload.mockRestore()
+            cleanup.mockRestore()
+          }
+        },
+      )
+    }
+  }
+
+  // A leaf-based facade rule predicts 0 or 100 for the endpoints, not 13.
+  // Read the leaf rows too, so a fixture that ignores leafCount cannot pass.
+  it.each([0, 1, 10])(
+    `keeps facade count at thirteen when each twig has %i leaves`,
+    async (leafCount) => {
+      await withSpaceFixture(
+        1,
+        async (fixture, entries) => {
+          await fixture.live.preload()
+          const twigs = fixture.live.toArray.flatMap((root) =>
+            root.branches.toArray.flatMap((branch) => branch.twigs.toArray),
+          )
+          expect(twigs).toHaveLength(10)
+          expect(
+            twigs.reduce(
+              (total, twig) => total + twig.leaves.toArray.length,
+              0,
+            ),
+          ).toBe(10 * leafCount)
+          // A facade-per-leaf result must fail the same count comparison.
+          expect(() => expect(10 * leafCount).toBe(13)).toThrow()
+
+          const adapters = new Set(entries.mock.contexts as Array<AdapterState>)
+          const created = new Set(
+            entries.mock.results
+              .filter((result) => result.type === `return`)
+              .map((result) => result.value),
+          )
+          expect(created.size).toBe(13)
+          expect(
+            new Set([...created].map((entry) => entry.collection)).size,
+          ).toBe(13)
+          expect(
+            [...adapters].reduce(
+              (total, adapter) => total + countEntries(adapter.entries),
+              0,
+            ),
+          ).toBe(13)
+        },
+        leafCount,
+      )
+    },
+  )
+
+  for (const { phase, index } of [
+    { phase: `preload`, index: 0 },
+    { phase: `preload-rejection`, index: 0 },
+    { phase: `createIndex`, index: 0 },
+    { phase: `createIndex`, index: 1 },
+    { phase: `createIndex`, index: 2 },
+  ] as const) {
+    it.each([false, true])(
+      `cleans every source and restores its spy after ${phase} ${index} fails (cleanup failure=%s)`,
+      async (failCleanup) => {
+        const primary = new Error(`space setup failure`)
+        const secondary = new Error(`space cleanup failure`)
+        const originalEntry = (
+          BucketFacadeAdapter.prototype as unknown as AdapterState
+        ).getEntry
+        const originalCleanup = CollectionImpl.prototype.cleanup
+        const cleanup = vi.spyOn(CollectionImpl.prototype, `cleanup`)
+        if (failCleanup)
+          cleanup.mockImplementationOnce(async function (this: CollectionImpl) {
+            await originalCleanup.call(this)
+            throw secondary
+          })
+        const setup =
+          phase === `preload-rejection`
+            ? vi
+                .spyOn(CollectionImpl.prototype, `preload`)
+                .mockRejectedValueOnce(primary)
+            : phase === `createIndex`
+              ? (() => {
+                  const originalIndex = CollectionImpl.prototype.createIndex
+                  const spy = vi.spyOn(CollectionImpl.prototype, `createIndex`)
+                  for (let prior = 0; prior < index; prior++)
+                    spy.mockImplementationOnce(originalIndex)
+                  return spy.mockImplementationOnce(() => {
+                    throw primary
+                  })
+                })()
+              : vi
+                  .spyOn(CollectionImpl.prototype, phase)
+                  .mockImplementationOnce(() => {
+                    throw primary
+                  })
+        await withHistoryCleanup(
+          async () => {
+            const result = withSpaceFixture(1, () =>
+              Promise.reject(
+                new Error(`failed setup must not reach inspection`),
+              ),
+            )
+            if (failCleanup) {
+              const failure: unknown = await result.catch(
+                (error: unknown) => error,
+              )
+              expect(failure).toBeInstanceOf(AggregateError)
+              if (!(failure instanceof AggregateError)) throw failure
+              expect(failure.cause).toBe(primary)
+              expect(failure.errors).toHaveLength(2)
+              expect(failure.errors[0]).toBe(primary)
+              expect(failure.errors[1]).toBe(secondary)
+            } else {
+              await expect(result).rejects.toBe(primary)
+            }
+            expect(cleanup).toHaveBeenCalledTimes(4)
+            expect(new Set(cleanup.mock.contexts).size).toBe(4)
+            expect(
+              (BucketFacadeAdapter.prototype as unknown as AdapterState)
+                .getEntry,
+            ).toBe(originalEntry)
+          },
+          () => [() => setup.mockRestore(), () => cleanup.mockRestore()],
+        )
+      },
+    )
+  }
+})
diff --git a/packages/db/tests/query/includes-structural-support.ts b/packages/db/tests/query/includes-structural-support.ts
new file mode 100644
index 0000000000..b61b418a4e
--- /dev/null
+++ b/packages/db/tests/query/includes-structural-support.ts
@@ -0,0 +1,189 @@
+// Fixture sources, pending-work cleanup, and row shapes shared by the
+// structural include oracle in includes-oracle.property.test.ts. These helpers
+// compare nothing: they build controlled collections, track transactions so a
+// failed test can release them, and project rows for the public-row checks.
+// The laws and their models are owned by the oracle file.
+import { createControlledCollection as createOracleControlledCollection } from './includes-oracle-helpers.js'
+import type {
+  ScopedInclude,
+  ScopedSubquery,
+} from './includes-scope-identity-oracle.js'
+
+export type RootRow = {
+  id: number
+  group: number
+  value: number
+  position: number
+}
+
+export type ChildRow = RootRow & {
+  parentGroup: number
+}
+
+export function createControlledCollection<T extends { id: number }>(
+  name: string,
+  initialData: Array<T> = [],
+  rowUpdateMode: `partial` | `full` = `partial`,
+) {
+  return createOracleControlledCollection(name, initialData, {
+    rowUpdateMode,
+  })
+}
+
+export function stripVirtualProperties(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(stripVirtualProperties)
+  }
+  if (!value || typeof value !== `object`) {
+    return value
+  }
+
+  return Object.fromEntries(
+    Object.entries(value)
+      .filter(([key]) => !key.startsWith(`$`))
+      .map(([key, entry]) => [key, stripVirtualProperties(entry)]),
+  )
+}
+
+export type Sources = ReturnType<typeof createSources>
+
+export function createSources(rowUpdateMode: `partial` | `full` = `partial`) {
+  return {
+    roots: createControlledCollection<RootRow>(
+      `oracle-roots`,
+      [],
+      rowUpdateMode,
+    ),
+    levels: [
+      createControlledCollection<ChildRow>(`oracle-level-1`, [], rowUpdateMode),
+      createControlledCollection<ChildRow>(`oracle-level-2`, [], rowUpdateMode),
+      createControlledCollection<ChildRow>(`oracle-level-3`, [], rowUpdateMode),
+      createControlledCollection<ChildRow>(`oracle-level-4`, [], rowUpdateMode),
+    ] as const,
+  }
+}
+
+export type PendingTransaction = ReturnType<
+  Sources[`roots`][`collection`][`update`]
+>
+
+export type PendingWork = {
+  transaction: PendingTransaction
+  release: () => void
+  releaseAttempted: boolean
+  released: boolean
+  settled: boolean
+  receipt: Promise<void>
+}
+
+export function trackPendingWork(
+  pending: Set<PendingWork>,
+  transaction: PendingTransaction,
+  release: () => void,
+): PendingWork {
+  const entry: PendingWork = {
+    transaction,
+    release,
+    releaseAttempted: false,
+    released: false,
+    settled: false,
+    receipt: Promise.resolve(),
+  }
+  pending.add(entry)
+  const settled = () => {
+    entry.settled = true
+    if (entry.released) pending.delete(entry)
+  }
+  entry.receipt = transaction.isPersisted.promise.then(settled, settled)
+  return entry
+}
+
+export function releasePendingWork(
+  pending: Set<PendingWork>,
+  entry: PendingWork,
+  release: () => void,
+): void {
+  entry.releaseAttempted = true
+  release()
+  entry.released = true
+  if (entry.settled) pending.delete(entry)
+}
+
+export async function cleanupPendingWork(
+  pending: Set<PendingWork>,
+  collections: ReadonlyArray<{ cleanup: () => Promise<void> }>,
+): Promise<void> {
+  const errors: Array<unknown> = []
+  const entries = [...pending]
+  const attempt = (work: () => void) => {
+    try {
+      work()
+    } catch (error) {
+      errors.push(error)
+    }
+  }
+  for (const entry of entries) {
+    if (
+      entry.transaction.state === `pending` ||
+      entry.transaction.state === `persisting`
+    )
+      attempt(() => {
+        entry.transaction.rollback()
+      })
+    if (!entry.releaseAttempted)
+      attempt(() => releasePendingWork(pending, entry, entry.release))
+  }
+  if (errors.length === 0)
+    await Promise.all(entries.map(({ receipt }) => receipt))
+  const results = await Promise.allSettled(
+    collections.map(async (collection) => collection.cleanup()),
+  )
+  for (const result of results)
+    if (result.status === `rejected`) errors.push(result.reason as unknown)
+  if (errors.length === 1) throw errors[0]
+  if (errors.length > 1)
+    throw new AggregateError(errors, `Core oracle cleanup failed`)
+}
+
+export async function withPendingWorkCleanup(
+  pending: Set<PendingWork>,
+  collections: ReadonlyArray<{ cleanup: () => Promise<void> }>,
+  work: () => Promise<void>,
+): Promise<void> {
+  let primary: { error: unknown } | undefined
+  try {
+    await work()
+  } catch (error) {
+    primary = { error }
+  }
+  try {
+    await cleanupPendingWork(pending, collections)
+  } catch (error) {
+    if (!primary) throw error
+    throw new AggregateError(
+      [primary.error, error],
+      `Core oracle work and cleanup failed`,
+      {
+        cause: primary.error,
+      },
+    )
+  }
+  if (primary) throw primary.error
+}
+
+export const plainSubquery: ScopedSubquery = {
+  joins: `refs`,
+  refsJoin: `left`,
+  predicates: [`subActive`],
+  predicateForm: `separate`,
+  body: `plain`,
+  subSelect: `row`,
+}
+
+export const refsInclude: ScopedInclude = {
+  body: `plain`,
+  form: `toArray`,
+  source: `refs`,
+  clientFilter: false,
+  outerSelect: `spread`,
+}
diff --git a/packages/db/tests/query/includes-temporal-oracle.test.ts b/packages/db/tests/query/includes-temporal-oracle.test.ts
index e76104463d..cb960e7dff 100644
--- a/packages/db/tests/query/includes-temporal-oracle.test.ts
+++ b/packages/db/tests/query/includes-temporal-oracle.test.ts
@@ -1,5 +1,11 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { BasicIndex } from '../../src/indexes/basic-index.js'
+import { SubsetDemandController } from '../../src/query/live/subset-demand-controller.js'
+import { createEffect } from '../../src/query/effect.js'
+import { LoadSubsetOperationAbortedError } from '../../src/errors.js'
 import {
   createLiveQueryCollection,
   eq,
@@ -7,32 +13,41 @@ import {
   queryOnce,
   toArray,
 } from '../../src/query/index.js'
-import { createCollection } from '../../src/collection/index.js'
-import { createDeferred } from '../../src/deferred.js'
-import { BasicIndex } from '../../src/indexes/basic-index.js'
-import { extractSimpleComparisons } from '../../src/query/expression-helpers.js'
-import { Func, PropRef, Value } from '../../src/query/ir.js'
-import { SubsetDemandController } from '../../src/query/live/subset-demand-controller.js'
-import { DeduplicatedLoadSubset } from '../../src/query/subset-dedupe.js'
-import { createEffect } from '../../src/query/effect.js'
-import { LoadSubsetOperationAbortedError } from '../../src/errors.js'
 import { runTrace } from '../trace-runner.js'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { captureMicrotaskErrors, flushPromises } from '../utils.js'
+import {
+  correlationKeys,
+  createColdPosts,
+  createMutablePosts,
+  createPostsWithCommentsLive,
+  createRemovablePost,
+  finishPreload,
+  finishTemporalCleanup,
+  nextCollectionId,
+  startPreload,
+} from './includes-temporal-support.js'
 import type { Collection } from '../../src/collection/index.js'
-import type { CollectionSubscription } from '../../src/collection/subscription.js'
 import type { Deferred } from '../../src/deferred.js'
-import type { LoadSubsetOptions, SyncAppliedReceipt } from '../../src/types.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
 import type { LazyDemandPlan } from '../../src/query/compiler/joins.js'
-import type { BasicExpression } from '../../src/query/ir.js'
 import type { Effect } from '../../src/query/effect.js'
 import type { InitialQueryBuilder } from '../../src/query/builder/index.js'
 import type { TraceDriver, TraceProjection } from '../trace-runner.js'
 import type { Scheduler } from 'fast-check'
+import type {
+  CapturedFailure,
+  Comment,
+  Post,
+  PreloadState,
+  ProgressivePost,
+  User,
+} from './includes-temporal-support.js'
 
 /**
  * # Which child acquisitions control initial-query readiness and publication?
@@ -57,10 +72,12 @@ import type { Scheduler } from 'fast-check'
  *    demand alone. An Effect with `skipInitial` ends suppression at the same
  *    point.
  *
- * No one state machine mirrors the production controller. The file uses small
- * models for initial-query readiness, cancellation, acquisition promise
- * settlement, progressive delivery, and source readiness. Each model records
- * only the public facts needed for its law.
+ * No one state machine mirrors the production controller. The declared models
+ * cover initial-query readiness (Model A), the current demand of scheduled
+ * acquisitions, release reentry, and source readiness (Model D). Each model
+ * records only the public facts needed for its law. Fixed scenarios for churn,
+ * cancellation, failed replay, and progressive delivery have literal
+ * expectations and no model; they live in includes-temporal.test.ts.
  * "Demand incarnation" is a model label for one interval of active logical
  * demand on a route. Reactivation starts another interval; the label does not
  * imply one physical acquisition or one provider transport. The fast/late
@@ -76,12 +93,9 @@ import type { Scheduler } from 'fast-check'
  * preload promise fulfilled or rejected. The live-query architecture remains
  * the contract source.
  *
- * The fragmented-demand lanes observe requested key unions and adapter abort
- * signals before settlement and after success, rejection, retry, or
- * obsolescence. The direct controller lane proves the acquisition-retirement
- * boundary. A compiled includes lane also makes adapter unload remove owned
- * rows, so rejection proves that established child rows remain publicly
- * visible rather than only that old signals remain live.
+ * The fragmented-demand checks (requested key unions, abort signals, and
+ * retained rows after rejection) are fixed scenarios with literal expectations.
+ * They moved unchanged to includes-temporal.test.ts as supplemental coverage.
  *
  * Known omissions: these controlled adapters establish core demand and graph
  * behavior, not that a real provider honors abort or supplies the same applied
@@ -93,486 +107,6 @@ import type { Scheduler } from 'fast-check'
  * witness.
  */
 
-type Post = {
-  id: number
-  authorId: string
-  title: string
-}
-
-type PostChange = {
-  type: `insert` | `delete`
-  value: Post
-}
-
-type Comment = {
-  id: number
-  postId: number
-  body: string
-}
-
-type User = {
-  id: number
-  name: string
-}
-
-type ProgressivePost = {
-  id: number
-  userId: number
-  title: string
-}
-
-let collectionId = 0
-
-function nextCollectionId(prefix: string): string {
-  collectionId += 1
-  return `${prefix}-${collectionId}`
-}
-
-type PreloadState = {
-  preloadFailure?: { error: unknown }
-  preloadOutcome?: Promise<void>
-  preloadSettled: boolean
-}
-
-type CapturedFailure = { error: unknown }
-
-// Run every cleanup step after the first mismatch. Keep that mismatch as the
-// cause and retain each secondary cleanup error separately.
-async function finishTemporalCleanup(
-  primary: CapturedFailure | undefined,
-  cleanups: ReadonlyArray<() => unknown>,
-): Promise<void> {
-  const cleanupFailures: Array<unknown> = []
-  for (const cleanup of cleanups) {
-    try {
-      await cleanup()
-    } catch (error) {
-      cleanupFailures.push(error)
-    }
-  }
-  if (cleanupFailures.length > 0) {
-    if (!primary && cleanupFailures.length === 1) throw cleanupFailures[0]
-    throw new AggregateError(
-      [...(primary ? [primary.error] : []), ...cleanupFailures],
-      `Temporal oracle and cleanup failed`,
-      { cause: primary ? primary.error : cleanupFailures[0] },
-    )
-  }
-  if (primary) throw primary.error
-}
-
-it(`preserves a row mismatch and later cleanup failures together`, async () => {
-  const mismatch = new Error(`row mismatch at checkpoint 1`)
-  const cleanupError = new Error(`release failed`)
-  const cleanupCalls: Array<string> = []
-  let reported: unknown
-  try {
-    await finishTemporalCleanup({ error: mismatch }, [
-      () => {
-        cleanupCalls.push(`release`)
-        throw cleanupError
-      },
-      () => {
-        cleanupCalls.push(`remaining cleanup`)
-      },
-    ])
-  } catch (error) {
-    reported = error
-  }
-  expect(reported).toBeInstanceOf(AggregateError)
-  if (!(reported instanceof AggregateError)) return
-  expect(reported.cause).toBe(mismatch)
-  expect(reported.errors).toEqual([mismatch, cleanupError])
-  expect(cleanupCalls).toEqual([`release`, `remaining cleanup`])
-})
-
-// A preload can reject before cleanup observes it. This record retains both
-// settlement and the original error without changing the production Promise.
-function startPreload(
-  live: ReturnType<typeof createLiveQueryCollection>,
-  state: PreloadState,
-): Promise<void> {
-  const preload = live.preload()
-  state.preloadOutcome = preload.then(
-    () => {
-      state.preloadSettled = true
-    },
-    (error) => {
-      state.preloadFailure = { error }
-      state.preloadSettled = true
-    },
-  )
-  return preload
-}
-
-async function finishPreload(state: PreloadState): Promise<void> {
-  await state.preloadOutcome
-  if (state.preloadFailure) throw state.preloadFailure.error
-}
-
-function correlationKeys(
-  loads: ReadonlyArray<LoadSubsetOptions>,
-  field: string,
-): Array<number> {
-  return [
-    ...new Set(
-      loads.flatMap((load) =>
-        extractSimpleComparisons(load.where).flatMap((filter) => {
-          if (filter.field[0] !== field) return []
-          if (filter.operator === `eq` && typeof filter.value === `number`) {
-            return [filter.value]
-          }
-          if (filter.operator !== `in` || !Array.isArray(filter.value)) {
-            return []
-          }
-          return filter.value.filter(
-            (value): value is number => typeof value === `number`,
-          )
-        }),
-      ),
-    ),
-  ].sort((left, right) => left - right)
-}
-
-type CommentRequest =
-  | { readonly type: `ref`; readonly path: ReadonlyArray<string> }
-  | { readonly type: `val`; readonly value: unknown }
-  | {
-      readonly type: `func`
-      readonly name: string
-      readonly args: ReadonlyArray<CommentRequest>
-    }
-
-function captureCommentRequest(
-  expression: BasicExpression | undefined,
-): CommentRequest {
-  if (!expression)
-    throw new Error(`Unsupported bounded comment fixture predicate`)
-  switch (expression.type) {
-    case `ref`:
-      return Object.freeze({
-        type: `ref`,
-        path: Object.freeze([...expression.path]),
-      })
-    case `val`:
-      return Object.freeze({
-        type: `val`,
-        value: Array.isArray(expression.value)
-          ? Object.freeze([...expression.value])
-          : expression.value,
-      })
-    case `func`:
-      return Object.freeze({
-        type: `func`,
-        name: expression.name,
-        args: Object.freeze([...expression.args].map(captureCommentRequest)),
-      })
-  }
-}
-
-// A bounded fixture interpreter, not the production filter evaluator. Compile
-// every branch before inspecting rows, including false-first conjunctions.
-function commentRequestPredicate(
-  request: CommentRequest | undefined,
-): (row: Comment) => boolean {
-  if (!request) return () => true
-  if (request.type === `func`) {
-    if (request.name === `and` && request.args.length > 0) {
-      const predicates = request.args.map(commentRequestPredicate)
-      return (row) => predicates.every((predicate) => predicate(row))
-    }
-    let [reference, constant] = request.args
-    if (request.name === `eq` && reference?.type === `val`)
-      [reference, constant] = [constant, reference]
-    if (
-      request.args.length === 2 &&
-      reference?.type === `ref` &&
-      reference.path.length === 1 &&
-      reference.path[0] === `postId` &&
-      constant?.type === `val`
-    ) {
-      const value = constant.value
-      if (
-        request.name === `eq` &&
-        typeof value === `number` &&
-        Number.isFinite(value)
-      )
-        return (row) => row.postId === value
-      if (
-        request.name === `in` &&
-        Array.isArray(value) &&
-        value.every(
-          (key: unknown) => typeof key === `number` && Number.isFinite(key),
-        )
-      )
-        return (row) => value.includes(row.postId)
-    }
-  }
-  throw new Error(`Unsupported bounded comment fixture predicate`)
-}
-
-function createValidatedColdComments(initial: ReadonlyArray<Comment>) {
-  const requests: Array<CommentRequest | undefined> = []
-  const loaded = new Set<number>()
-  const collection = createCollection<Comment>({
-    id: nextCollectionId(`validated-temporal-comments`),
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => ({
-        loadSubset: (options) => {
-          const request = options.where && captureCommentRequest(options.where)
-          requests.push(request)
-          if (
-            options.orderBy?.length ||
-            options.cursor !== undefined ||
-            options.limit !== undefined ||
-            (options.offset ?? 0) !== 0
-          )
-            throw new Error(`Unsupported bounded comment fixture request`)
-          const matches = commentRequestPredicate(request)
-          begin()
-          for (const row of initial) {
-            if (!loaded.has(row.id) && matches(row)) {
-              write({ type: `insert`, value: { ...row } })
-              loaded.add(row.id)
-            }
-          }
-          const receipt = commit()
-          if (receipt !== true) return receipt.then(() => markReady())
-          markReady()
-          return true
-        },
-      }),
-    },
-  })
-  return { collection, requests }
-}
-
-function captureCommentRows(value: unknown): Array<Comment> {
-  if (!Array.isArray(value)) throw new Error(`Expected inline comment rows`)
-  return value.map((row: unknown) => {
-    if (
-      row === null ||
-      typeof row !== `object` ||
-      !(`id` in row) ||
-      !(`postId` in row) ||
-      !(`body` in row) ||
-      typeof row.id !== `number` ||
-      typeof row.postId !== `number` ||
-      typeof row.body !== `string`
-    )
-      throw new Error(`Expected selected comment fields`)
-    return { id: row.id, postId: row.postId, body: row.body }
-  })
-}
-
-describe(`bounded cold comment request observations`, () => {
-  it(`validates complete predicates before filtering even an empty input`, () => {
-    const rows: Array<Comment> = [
-      { id: 100, postId: 1, body: `one` },
-      { id: 200, postId: 2, body: `two` },
-      { id: 300, postId: 3, body: `three` },
-    ]
-    const ref = new PropRef([`postId`])
-    const cases: Array<[BasicExpression | undefined, Array<number>]> = [
-      [undefined, [100, 200, 300]],
-      [new Func(`eq`, [ref, new Value(1)]), [100]],
-      [new Func(`eq`, [new Value(2), ref]), [200]],
-      [new Func(`in`, [ref, new Value([1, 3])]), [100, 300]],
-      [new Func(`in`, [ref, new Value([2])]), [200]],
-      [new Func(`in`, [ref, new Value([])]), []],
-      [
-        new Func(`and`, [
-          new Func(`in`, [ref, new Value([1, 3])]),
-          new Func(`eq`, [ref, new Value(3)]),
-        ]),
-        [300],
-      ],
-    ]
-    for (const [expression, expected] of cases) {
-      const predicate = commentRequestPredicate(
-        expression && captureCommentRequest(expression),
-      )
-      expect(rows.filter(predicate).map(({ id }) => id)).toEqual(expected)
-    }
-    // These reject the fixture's unsupported domain, not runtime query syntax.
-    for (const expression of [
-      new Func(`lt`, [ref, new Value(1)]),
-      new Func(`eq`, [new PropRef([`id`]), new Value(1)]),
-      new Func(`eq`, [new PropRef([`postId`, `nested`]), new Value(1)]),
-      new Func(`eq`, [ref]),
-      new Func(`in`, [ref, new Value(1)]),
-      new Func(`and`, [
-        new Func(`eq`, [ref, new Value(999)]),
-        new Func(`lt`, [ref, new Value(1)]),
-      ]),
-    ]) {
-      const request = captureCommentRequest(expression)
-      expect(() => commentRequestPredicate(request)).toThrow(
-        `Unsupported bounded comment fixture predicate`,
-      )
-      expect(() => [].filter(commentRequestPredicate(request))).toThrow(
-        `Unsupported bounded comment fixture predicate`,
-      )
-    }
-  })
-
-  it(`retains immutable request paths, branches and membership values`, () => {
-    const path = [`postId`]
-    const membership = [1, 3]
-    const args = [new PropRef(path), new Value(membership)]
-    const snapshot = captureCommentRequest(new Func(`in`, args))
-    // Change only test-owned input after capture, never a runtime request.
-    path[0] = `changed`
-    membership.splice(0, 2, 2)
-    args.pop()
-    expect(snapshot).toEqual({
-      type: `func`,
-      name: `in`,
-      args: [
-        { type: `ref`, path: [`postId`] },
-        { type: `val`, value: [1, 3] },
-      ],
-    })
-    expect(Object.isFrozen(snapshot)).toBe(true)
-    if (snapshot.type !== `func`) throw new Error(`Expected function snapshot`)
-    expect(Object.isFrozen(snapshot.args)).toBe(true)
-    const [reference, constant] = snapshot.args
-    if (reference?.type !== `ref` || constant?.type !== `val`)
-      throw new Error(`Expected reference and value snapshots`)
-    expect(Object.isFrozen(reference.path)).toBe(true)
-    expect(Object.isFrozen(constant.value)).toBe(true)
-  })
-
-  it.each(
-    ([`array`, `materialized`] as const).flatMap((form) =>
-      ([`expression`, `functional`] as const).map((projection) => ({
-        form,
-        projection,
-      })),
-    ),
-  )(
-    `$form / $projection becomes ready for selected parents without counting an excluded parent`,
-    async ({ form, projection }) => {
-      const posts = createColdPosts([
-        { id: 1, authorId: `selected`, title: `one` },
-        { id: 2, authorId: `excluded`, title: `two` },
-        { id: 3, authorId: `selected`, title: `three` },
-      ])
-      const comments = createValidatedColdComments([
-        { id: 100, postId: 1, body: `one` },
-        { id: 200, postId: 2, body: `two` },
-        { id: 300, postId: 3, body: `three` },
-      ])
-      const live = createLiveQueryCollection((q) => {
-        const included = q
-          .from({ post: posts.collection })
-          .where(({ post }) => eq(post.authorId, `selected`))
-          .select(({ post }) => {
-            const childRows = q
-              .from({ comment: comments.collection })
-              .where(({ comment }) => eq(comment.postId, post.id))
-              .select(({ comment }) => ({
-                id: comment.id,
-                postId: comment.postId,
-                body: comment.body,
-              }))
-            return {
-              id: post.id,
-              comments:
-                form === `array` ? toArray(childRows) : materialize(childRows),
-              count: 0,
-            }
-          })
-        const outer = q.from({ row: included })
-        return projection === `expression`
-          ? outer.select(({ row }) => row)
-          : outer.fn.select(({ row }) => {
-              expect(Array.isArray(row.comments)).toBe(true)
-              return {
-                ...row,
-                count: Array.isArray(row.comments) ? row.comments.length : -1,
-              }
-            })
-      })
-      let primaryFailure: { error: unknown } | undefined
-      try {
-        expect(comments.collection.size).toBe(0)
-        await live.preload()
-        expect(live.isReady()).toBe(true)
-        expect(comments.requests.length).toBeGreaterThan(0)
-        expect(
-          live.toArray
-            .map((row) => ({
-              id: row.id,
-              comments: captureCommentRows(row.comments),
-              count: row.count,
-            }))
-            .sort((left, right) => left.id - right.id),
-        ).toEqual([
-          {
-            id: 1,
-            comments: [{ id: 100, postId: 1, body: `one` }],
-            count: projection === `functional` ? 1 : 0,
-          },
-          {
-            id: 3,
-            comments: [{ id: 300, postId: 3, body: `three` }],
-            count: projection === `functional` ? 1 : 0,
-          },
-        ])
-      } catch (error) {
-        primaryFailure = { error }
-      }
-      const results = await Promise.allSettled(
-        [live, posts.collection, comments.collection].map(async (collection) =>
-          collection.cleanup(),
-        ),
-      )
-      const failures = results.flatMap((result): Array<unknown> =>
-        result.status === `rejected` ? [result.reason as unknown] : [],
-      )
-      if (failures.length > 0) {
-        if (!primaryFailure && failures.length === 1) throw failures[0]
-        throw new AggregateError(
-          [...(primaryFailure ? [primaryFailure.error] : []), ...failures],
-          `Cold comment observation and cleanup failed`,
-          { cause: primaryFailure ? primaryFailure.error : failures[0] },
-        )
-      }
-      if (primaryFailure) throw primaryFailure.error
-    },
-  )
-})
-
-function createColdPosts(initial: ReadonlyArray<Post>): {
-  collection: Collection<Post>
-  loaded: Deferred<void>
-} {
-  const loaded = createDeferred<void>()
-  const collection = createCollection<Post>({
-    id: nextCollectionId(`temporal-posts`),
-    getKey: (post) => post.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => ({
-        loadSubset: () => {
-          begin()
-          for (const post of initial) {
-            write({ type: `insert`, value: post })
-          }
-          commit()
-          markReady()
-          loaded.resolve()
-          return Promise.resolve()
-        },
-      }),
-    },
-  })
-  return { collection, loaded }
-}
-
 function createColdComments(): {
   collection: Collection<Comment>
   loads: Array<LoadSubsetOptions>
@@ -607,312 +141,6 @@ function createColdComments(): {
   return { collection, loads }
 }
 
-it.each(
-  ([`array`, `materialized`] as const).flatMap((form) =>
-    ([`expression`, `functional`] as const).map((projection) => ({
-      form,
-      projection,
-    })),
-  ),
-)(
-  `$form / $projection preserves child demand and applied settlement across projection`,
-  async ({ form, projection }) => {
-    const posts = createColdPosts([{ id: 1, authorId: `one`, title: `post` }])
-    const started = createDeferred<void>()
-    const release = createDeferred<void>()
-    const loads: Array<LoadSubsetOptions> = []
-    const comments = createCollection<Comment>({
-      id: nextCollectionId(`projection-pending-comments`),
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => ({
-          loadSubset: (options) => {
-            loads.push(options)
-            const keys = correlationKeys([options], `postId`)
-            started.resolve()
-            return release.promise.then(async () => {
-              if (options.signal?.aborted) return
-              begin()
-              if (keys.includes(1))
-                write({
-                  type: `insert`,
-                  value: { id: 100, postId: 1, body: `one` },
-                })
-              await commit()
-              markReady()
-            })
-          },
-        }),
-      },
-    })
-    const live = createLiveQueryCollection((q) => {
-      const included = q.from({ post: posts.collection }).select(({ post }) => {
-        const childRows = q
-          .from({ comment: comments })
-          .where(({ comment }) => eq(comment.postId, post.id))
-        return {
-          id: post.id,
-          comments:
-            form === `array` ? toArray(childRows) : materialize(childRows),
-          count: 0,
-        }
-      })
-      const outer = q.from({ row: included })
-      return projection === `expression`
-        ? outer.select(({ row }) => row)
-        : outer.fn.select(({ row }) => {
-            expect
-              .soft(
-                Array.isArray(row.comments),
-                `callback receives an inline value`,
-              )
-              .toBe(true)
-            return {
-              id: row.id,
-              comments: row.comments,
-              count: Array.isArray(row.comments) ? row.comments.length : -1,
-            }
-          })
-    })
-    let settled = false
-    const preload = live.preload()
-    const observed = preload.then(
-      () => {
-        settled = true
-      },
-      () => {
-        settled = true
-      },
-    )
-    let primaryFailure: CapturedFailure | undefined
-    try {
-      await Promise.race([started.promise, preload])
-      expect(loads).toHaveLength(1)
-      expect(correlationKeys(loads, `postId`)).toEqual([1])
-      expect(settled).toBe(false)
-      release.resolve()
-      await preload
-      expect(live.toArray).toHaveLength(1)
-      // Observe the runtime boundary: a broken projection can omit this value.
-      const publishedComments = live.toArray[0]?.comments as unknown as
-        Array<Comment> | undefined
-      expect(
-        publishedComments?.map(({ id, postId, body }) => ({
-          id,
-          postId,
-          body,
-        })),
-      ).toEqual([{ id: 100, postId: 1, body: `one` }])
-      if (projection === `functional`) expect(live.toArray[0]?.count).toBe(1)
-    } catch (error) {
-      primaryFailure = { error }
-    }
-    release.resolve()
-    await finishTemporalCleanup(primaryFailure, [
-      () => live.cleanup(),
-      () => observed,
-      () => posts.collection.cleanup(),
-      () => comments.cleanup(),
-    ])
-  },
-)
-
-it.each(
-  ([`array`, `materialized`] as const).flatMap((form) =>
-    ([`expression`, `functional`] as const).flatMap((projection) =>
-      [false, true].map((pending) => ({ form, projection, pending })),
-    ),
-  ),
-)(
-  `$form / $projection waits for actual source application with pending=$pending`,
-  async ({ form, projection, pending }) => {
-    const posts = createColdPosts([{ id: 1, authorId: `one`, title: `post` }])
-    const mutation = createDeferred<void>()
-    const started = createDeferred<void>()
-    const requests: Array<{
-      receipt: SyncAppliedReceipt
-      settled: boolean
-      outcome: Promise<void>
-    }> = []
-    let writeChild: (row: Comment) => SyncAppliedReceipt = () => {
-      throw new Error(`Comment source has not started`)
-    }
-    const comments = createCollection<Comment>({
-      id: nextCollectionId(`actual-applied-receipt-comments`),
-      getKey: (row) => row.id,
-      startSync: true,
-      syncMode: `on-demand`,
-      onInsert: () => mutation.promise,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          markReady()
-          writeChild = (row) => {
-            begin()
-            write({ type: `insert`, value: row })
-            return commit()
-          }
-          return {
-            loadSubset: (options) => {
-              begin()
-              write({
-                type: `insert`,
-                value: { id: 100, postId: 1, body: `applied` },
-              })
-              const receipt = commit(options.signal)
-              const request = {
-                receipt,
-                settled: false,
-                outcome: Promise.resolve(),
-              }
-              request.outcome = Promise.resolve(receipt).then(
-                () => {
-                  request.settled = true
-                },
-                () => {
-                  request.settled = true
-                },
-              )
-              requests.push(request)
-              started.resolve()
-              return Promise.resolve(receipt).then(() => {
-                markReady()
-              })
-            },
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) => {
-      const included = q.from({ post: posts.collection }).select(({ post }) => {
-        const rows = q
-          .from({ comment: comments })
-          .where(({ comment }) => eq(comment.postId, post.id))
-          .orderBy(({ comment }) => comment.id)
-        return {
-          id: post.id,
-          comments: form === `array` ? toArray(rows) : materialize(rows),
-          count: 0,
-        }
-      })
-      const outer = q.from({ row: included })
-      return projection === `expression`
-        ? outer.select(({ row }) => row)
-        : outer.fn.select(({ row }) => {
-            expect.soft(Array.isArray(row.comments)).toBe(true)
-            return {
-              ...row,
-              count: Array.isArray(row.comments) ? row.comments.length : -1,
-            }
-          })
-    })
-    let transaction: ReturnType<typeof comments.insert> | undefined
-    let transactionOutcome: Promise<unknown> | undefined
-    const state: PreloadState = { preloadSettled: false }
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      if (pending) {
-        transaction = comments.insert({
-          id: 999,
-          postId: 999,
-          body: `unrelated`,
-        })
-        transactionOutcome = transaction.isPersisted.promise.then(
-          () => undefined,
-          () => undefined,
-        )
-      }
-      const preload = startPreload(live, state)
-      await Promise.race([started.promise, preload])
-      await flushPromises()
-      expect(requests.length).toBeGreaterThan(0)
-      if (pending) {
-        expect(transaction?.state).toBe(`persisting`)
-        expect(
-          requests.every(({ receipt }) => receipt instanceof Promise),
-        ).toBe(true)
-        expect(requests.every(({ settled }) => !settled)).toBe(true)
-        expect(comments.has(100)).toBe(false)
-        expect(comments.get(100)).toBeUndefined()
-        expect(state.preloadSettled).toBe(false)
-        expect(live.isReady()).toBe(false)
-      } else {
-        expect(requests.every(({ receipt }) => receipt === true)).toBe(true)
-        expect(comments.get(100)).toMatchObject({
-          id: 100,
-          postId: 1,
-          body: `applied`,
-        })
-      }
-      mutation.resolve()
-      if (transaction) await transaction.isPersisted.promise
-      await preload
-      await Promise.all(requests.map(({ outcome }) => outcome))
-      expect(requests.every(({ settled }) => settled)).toBe(true)
-      expect(live.isReady()).toBe(true)
-      const capture = () =>
-        live.toArray.map((row) => ({
-          id: row.id,
-          comments: captureCommentRows(row.comments),
-          count: row.count,
-        }))
-      expect(capture()).toEqual([
-        {
-          id: 1,
-          comments: [{ id: 100, postId: 1, body: `applied` }],
-          count: projection === `functional` ? 1 : 0,
-        },
-      ])
-      await writeChild({ id: 101, postId: 1, body: `continued` })
-      expect(capture()).toEqual([
-        {
-          id: 1,
-          comments: [
-            { id: 100, postId: 1, body: `applied` },
-            { id: 101, postId: 1, body: `continued` },
-          ],
-          count: projection === `functional` ? 2 : 0,
-        },
-      ])
-    } catch (error) {
-      primaryFailure = { error }
-    }
-    const cleanupErrors: Array<unknown> = []
-    try {
-      if (
-        transaction?.state === `pending` ||
-        transaction?.state === `persisting`
-      )
-        transaction.rollback()
-    } catch (error) {
-      cleanupErrors.push(error)
-    }
-    mutation.resolve()
-    if (cleanupErrors.length === 0) await transactionOutcome
-    const results = await Promise.allSettled(
-      [live, posts.collection, comments].map(async (collection) =>
-        collection.cleanup(),
-      ),
-    )
-    for (const result of results)
-      if (result.status === `rejected`)
-        cleanupErrors.push(result.reason as unknown)
-    if (cleanupErrors.length === 0) {
-      await state.preloadOutcome
-      await Promise.all(requests.map(({ outcome }) => outcome))
-    }
-    if (cleanupErrors.length > 0) {
-      if (!primaryFailure && cleanupErrors.length === 1) throw cleanupErrors[0]
-      throw new AggregateError(
-        [...(primaryFailure ? [primaryFailure.error] : []), ...cleanupErrors],
-        `Applied receipt observation and cleanup failed`,
-        { cause: primaryFailure ? primaryFailure.error : cleanupErrors[0] },
-      )
-    }
-    if (primaryFailure) throw primaryFailure.error
-  },
-)
-
 // Model A: initial-query readiness depends only on currently reachable demand.
 type ReadinessObservation = {
   ready: boolean
@@ -932,6 +160,21 @@ type ReadinessContext = {
   expected: ReadinessObservation
 }
 
+// Model A's prediction after the parent rows load: every reachable child demand
+// settles, so the query is ready. One grouped child acquisition covers every
+// selected parent key, and an empty parent set issues none.
+function expectedReadinessObservation(
+  initialPosts: ReadonlyArray<Post>,
+): ReadinessObservation {
+  return {
+    ready: true,
+    preloadSettled: true,
+    rowCount: initialPosts.length,
+    childLoadCount: initialPosts.length === 0 ? 0 : 1,
+    loadedPostIds: initialPosts.map(({ id }) => id),
+  }
+}
+
 function createReadinessDriver(
   initialPosts: ReadonlyArray<Post>,
 ): TraceDriver<never, ReadinessContext> {
@@ -961,13 +204,7 @@ function createReadinessDriver(
         loads,
         preload: { preloadSettled: false },
         parentLoaded,
-        expected: {
-          ready: true,
-          preloadSettled: true,
-          rowCount: initialPosts.length,
-          childLoadCount: initialPosts.length === 0 ? 0 : 1,
-          loadedPostIds: initialPosts.map(({ id }) => id),
-        },
+        expected: expectedReadinessObservation(initialPosts),
       }
     },
     start: async (context) => {
@@ -1015,269 +252,22 @@ async function expectReadinessMatches(
   })
 }
 
-// Model B: retiring the only route removes its child acquisition from
-// initial-query readiness, even when that acquisition's promise is pending.
-type DemandCancellationObservation = {
-  ready: boolean
-  rowCount: number
-  childLoadStarted: boolean
-  childLoadPending: boolean
-}
-
-type DemandCancellationContext = {
-  posts: Collection<Post>
-  comments: Collection<Comment>
-  live: ReturnType<typeof createLiveQueryCollection>
-  removePost: () => void
-  childLoad: ReturnType<typeof createDeferred<void>>
-  childLoadStarted: Deferred<void>
-  preload: PreloadState
-  expected: DemandCancellationObservation
-}
-
-function createRemovablePost(): {
-  collection: Collection<Post>
-  remove: () => void
-  add: () => void
-} {
-  const post: Post = {
-    id: 1,
-    authorId: `selected`,
-    title: `selected`,
-  }
-  let remove: () => void = () => {
-    throw new Error(`Post collection has not started`)
-  }
-  let add: () => void = () => {
-    throw new Error(`Post collection has not started`)
-  }
-  const collection = createCollection<Post>({
-    id: nextCollectionId(`temporal-removable-post`),
-    getKey: (row) => row.id,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({ type: `insert`, value: post })
-        commit()
-        markReady()
-        remove = () => {
-          begin()
-          write({ type: `delete`, value: post })
-          commit()
-        }
-        add = () => {
-          begin()
-          write({ type: `insert`, value: post })
-          commit()
-        }
-      },
-    },
-  })
-  return { collection, remove: () => remove(), add: () => add() }
-}
-
-function createDemandCancellationDriver(): TraceDriver<
-  `remove-parent`,
-  DemandCancellationContext
-> {
-  return {
-    setup: () => {
-      const { collection: posts, remove } = createRemovablePost()
-      const childLoad = createDeferred<void>()
-      const childLoadStarted = createDeferred<void>()
-      const comments = createCollection<Comment>({
-        id: nextCollectionId(`temporal-pending-comments`),
-        getKey: (comment) => comment.id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: () => ({
-            loadSubset: () => {
-              childLoadStarted.resolve()
-              return childLoad.promise
-            },
-          }),
-        },
-      })
-      const live = createLiveQueryCollection((q) =>
-        q.from({ post: posts }).select(({ post }) => ({
-          id: post.id,
-          comments: toArray(
-            q
-              .from({ comment: comments })
-              .where(({ comment }) => eq(comment.postId, post.id)),
-          ),
-        })),
-      )
-      return {
-        posts,
-        comments,
-        live,
-        removePost: remove,
-        childLoad,
-        childLoadStarted,
-        preload: { preloadSettled: false },
-        expected: {
-          ready: false,
-          rowCount: 1,
-          childLoadStarted: true,
-          childLoadPending: true,
-        },
-      }
-    },
-    start: async (context) => {
-      startPreload(context.live, context.preload)
-      await context.childLoadStarted.promise
-    },
-    apply: (_step, context) => {
-      context.removePost()
-      context.expected = {
-        ready: true,
-        rowCount: 0,
-        childLoadStarted: true,
-        childLoadPending: true,
-      }
-    },
-    cleanup: async ({ posts, comments, live, childLoad, preload }) => {
-      childLoad.resolve()
-      await finishTemporalCleanup(undefined, [
-        () => live.cleanup(),
-        () => finishPreload(preload),
-        () => posts.cleanup(),
-        () => comments.cleanup(),
-      ])
-    },
-  }
-}
-
-const demandCancellationProjection: TraceProjection<
-  DemandCancellationContext,
-  DemandCancellationObservation
-> = {
-  observe: ({ live, childLoadStarted, childLoad }) => ({
-    ready: live.isReady(),
-    rowCount: live.size,
-    childLoadStarted: !childLoadStarted.isPending(),
-    childLoadPending: childLoad.isPending(),
-  }),
-  recompute: ({ expected }) => expected,
-  assertEqual: (observed, expected) => {
-    expect(observed).toEqual(expected)
-    return undefined
-  },
-}
-
-async function expectObsoleteDemandDoesNotBlockReadiness(): Promise<void> {
-  await runTrace({
-    steps: [`remove-parent`],
-    driver: createDemandCancellationDriver(),
-    projection: demandCancellationProjection,
-  })
-}
-
-async function expectObsoleteAcquisitionCannotPublishAfterReactivation(): Promise<void> {
-  const { collection: posts, remove, add } = createRemovablePost()
-  const requests: Array<{
-    deferred: Deferred<void>
-    outcome: Promise<void>
-    signal: AbortSignal | undefined
-  }> = []
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-generation-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => ({
-        loadSubset: (options) => {
-          const requestIndex = requests.length
-          const deferred = createDeferred<void>()
-          const signal = options.signal
-          const outcome = deferred.promise.then(() => {
-            if (signal?.aborted) return
-            begin()
-            write({
-              type: `insert`,
-              value:
-                requestIndex === 0
-                  ? { id: 100, postId: 1, body: `obsolete` }
-                  : { id: 200, postId: 1, body: `current` },
-            })
-            commit()
-            markReady()
-          })
-          requests.push({ deferred, outcome, signal })
-          return outcome
-        },
-      }),
-    },
-  })
-  const live = createLiveQueryCollection((q) =>
-    q.from({ post: posts }).select(({ post }) => ({
-      id: post.id,
-      comments: toArray(
-        q
-          .from({ comment: comments })
-          .where(({ comment }) => eq(comment.postId, post.id))
-          .select(({ comment }) => ({
-            id: comment.id,
-            body: comment.body,
-          })),
-      ),
-    })),
-  )
-
-  const preload = live.preload()
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await flushPromises()
-    expect(requests).toHaveLength(1)
-
-    remove()
-    await preload
-    expect(live.size).toBe(0)
-
-    add()
-    await flushPromises()
-    expect(requests).toHaveLength(2)
-
-    requests[1]!.deferred.resolve()
-    await requests[1]!.outcome
-    await flushPromises()
-    expect(live.get(1)?.comments).toEqual([{ id: 200, body: `current` }])
-
-    requests[0]!.deferred.resolve()
-    await requests[0]!.outcome
-    await flushPromises()
-    expect(live.get(1)?.comments).toEqual([{ id: 200, body: `current` }])
-    expect(requests[0]!.signal?.aborted).toBe(true)
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  for (const request of requests) request.deferred.resolve()
-  await finishTemporalCleanup(primaryFailure, [
-    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
-    () => live.cleanup(),
-    () => Promise.allSettled([preload]),
-    () => posts.cleanup(),
-    () => comments.cleanup(),
-  ])
-}
-
-async function expectScheduledAcquisitionsRespectCurrentDemand(
-  scheduler: Scheduler,
-): Promise<void> {
-  // The scheduler changes only acquisition promise settlement order. An aborted
-  // acquisition cannot publish request-scoped rows for the reactivated demand.
-  const { collection: posts, remove, add } = createRemovablePost()
-  const requests: Array<{
-    outcome: Promise<void>
-    signal: AbortSignal | undefined
-  }> = []
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-scheduled-generation-comments`),
-    getKey: (comment) => comment.id,
-    autoIndex: `eager`,
-    defaultIndexType: BasicIndex,
-    syncMode: `on-demand`,
+async function expectScheduledAcquisitionsRespectCurrentDemand(
+  scheduler: Scheduler,
+): Promise<void> {
+  // The scheduler changes only acquisition promise settlement order. An aborted
+  // acquisition cannot publish request-scoped rows for the reactivated demand.
+  const { collection: posts, remove, add } = createRemovablePost()
+  const requests: Array<{
+    outcome: Promise<void>
+    signal: AbortSignal | undefined
+  }> = []
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-scheduled-generation-comments`),
+    getKey: (comment) => comment.id,
+    autoIndex: `eager`,
+    defaultIndexType: BasicIndex,
+    syncMode: `on-demand`,
     sync: {
       sync: ({ begin, write, commit, markReady }) => ({
         loadSubset: (options) => {
@@ -1318,1232 +308,171 @@ async function expectScheduledAcquisitionsRespectCurrentDemand(
     await preload
     add()
     await flushPromises()
-    expect(requests).toHaveLength(2)
-    expect(requests[0]!.signal?.aborted).toBe(true)
-
-    await scheduler.waitAll(async (task) => {
-      await task()
-      await flushPromises()
-      // Copy this completion's public value. Later completions must not replace
-      // it.
-      observations.push({
-        completed: scheduler
-          .report()
-          .filter(({ status }) => status === `resolved`)
-          .map(({ label }) => label),
-        ready: live.isReady(),
-        rows: live.toArray.map(({ id, comments: rows }) => ({
-          id,
-          comments: rows.map(({ id: childId, body }) => ({
-            id: childId,
-            body,
-          })),
-        })),
-      })
-    })
-    await Promise.all(requests.map(({ outcome }) => outcome))
-    await flushPromises()
-
-    expect(observations).toHaveLength(2)
-    for (const [index, observation] of observations.entries()) {
-      expectScheduledDemandObservation(observation, index)
-    }
-    expect(live.isReady()).toBe(true)
-    expect(live.get(1)?.comments.map(({ id, body }) => ({ id, body }))).toEqual(
-      [{ id: 200, body: `current` }],
-    )
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishTemporalCleanup(primaryFailure, [
-    () => scheduler.count() > 0 && scheduler.waitAll(),
-    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
-    () => live.cleanup(),
-    () => Promise.allSettled([preload]),
-    () => posts.cleanup(),
-    () => comments.cleanup(),
-  ])
-}
-
-type ScheduledDemandObservation = {
-  completed: Array<string>
-  ready: boolean
-  rows: Array<{ id: number; comments: Array<{ id: number; body: string }> }>
-}
-
-// The public row depends on whether the current acquisition's promise fulfilled.
-// An obsolete acquisition's settlement alone cannot add its child row.
-function expectScheduledDemandObservation(
-  observation: ScheduledDemandObservation,
-  index: number,
-): void {
-  expect(observation.completed).toHaveLength(index + 1)
-  const currentCompleted = observation.completed.includes(`demand-1`)
-  expect(observation.rows).toEqual([
-    {
-      id: 1,
-      comments: currentCompleted ? [{ id: 200, body: `current` }] : [],
-    },
-  ])
-  if (currentCompleted) expect(observation.ready).toBe(true)
-}
-
-function createMutablePosts(
-  initial: ReadonlyArray<Post>,
-  options: { markReadyInitially?: boolean } = {},
-): {
-  collection: Collection<Post>
-  write: (type: PostChange[`type`], post: Post) => void
-  writeBatch: (changes: ReadonlyArray<PostChange>) => void
-  markReady: () => void
-} {
-  let writePosts: (changes: ReadonlyArray<PostChange>) => void = () => {
-    throw new Error(`Post collection has not started`)
-  }
-  let markPostsReady: () => void = () => {
-    throw new Error(`Post collection has not started`)
-  }
-  const collection = createCollection<Post>({
-    id: nextCollectionId(`temporal-mutable-posts`),
-    getKey: (post) => post.id,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        for (const post of initial) write({ type: `insert`, value: post })
-        commit()
-        if (options.markReadyInitially !== false) markReady()
-        writePosts = (changes) => {
-          begin()
-          for (const change of changes) write(change)
-          commit()
-        }
-        markPostsReady = markReady
-      },
-    },
-  })
-  return {
-    collection,
-    write: (type, post) => writePosts([{ type, value: post }]),
-    writeBatch: (changes) => writePosts(changes),
-    markReady: () => markPostsReady(),
-  }
-}
-
-function createPendingComments(): {
-  collection: Collection<Comment>
-  requests: Array<{
-    deferred: Deferred<void>
-    outcome: Promise<void>
-    keys: Array<number>
-    signal: AbortSignal | undefined
-  }>
-} {
-  const requests: Array<{
-    deferred: Deferred<void>
-    outcome: Promise<void>
-    keys: Array<number>
-    signal: AbortSignal | undefined
-  }> = []
-  const collection = createCollection<Comment>({
-    id: nextCollectionId(`temporal-pending-coverage-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ markReady }) => ({
-        loadSubset: (options) => {
-          const deferred = createDeferred<void>()
-          const outcome = deferred.promise.then(() => {
-            if (!options.signal?.aborted) markReady()
-          })
-          requests.push({
-            deferred,
-            outcome,
-            keys: correlationKeys([options], `postId`),
-            signal: options.signal,
-          })
-          return outcome
-        },
-      }),
-    },
-  })
-  return { collection, requests }
-}
-
-function createPostsWithCommentsLive(
-  posts: Collection<Post>,
-  comments: Collection<Comment>,
-) {
-  return createLiveQueryCollection((q) =>
-    q.from({ post: posts }).select(({ post }) => ({
-      id: post.id,
-      comments: toArray(
-        q
-          .from({ comment: comments })
-          .where(({ comment }) => eq(comment.postId, post.id)),
-      ),
-    })),
-  )
-}
-
-async function expectRetainedDemandBlocksReadiness(): Promise<void> {
-  const firstPost = { id: 1, authorId: `selected`, title: `one` }
-  const secondPost = { id: 2, authorId: `selected`, title: `two` }
-  const posts = createMutablePosts([firstPost])
-  const { collection: comments, requests } = createPendingComments()
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const preload: PreloadState = { preloadSettled: false }
-  startPreload(live, preload)
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await flushPromises()
-    expect(requests.map(({ keys }) => keys)).toEqual([[1]])
-
-    posts.write(`insert`, secondPost)
-    await flushPromises()
-    expect(requests.map(({ keys }) => keys)).toEqual([[1], [2]])
-
-    requests[1]!.deferred.resolve()
-    await requests[1]!.outcome
-    await flushPromises()
-    expect(preload.preloadSettled).toBe(false)
-    expect(live.isReady()).toBe(false)
-
-    requests[0]!.deferred.resolve()
-    await requests[0]!.outcome
-    await finishPreload(preload)
-    expect(live.isReady()).toBe(true)
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  for (const request of requests) request.deferred.resolve()
-  await finishTemporalCleanup(primaryFailure, [
-    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
-    () => live.cleanup(),
-    () => preload.preloadOutcome,
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-  ])
-}
-
-async function expectDemandChurnPreservesCoverage(
-  replacementOutcome: `success` | `failure` | `obsolete`,
-): Promise<void> {
-  const { collection, requests } = createPendingComments()
-  const subscription = collection.subscribeChanges(() => {}, {
-    includeInitialState: false,
-  })
-  const controller = new SubsetDemandController()
-  const plan: LazyDemandPlan = {
-    id: `churn-consolidation`,
-    path: [`postId`],
-    collectionId: collection.id,
-    initialKeys: new Set(),
-  }
-  const settle = async (index: number, ready: Promise<unknown> | true) => {
-    requests[index]!.deferred.resolve()
-    await requests[index]!.outcome
-    if (ready instanceof Promise) await ready
-  }
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    for (let key = 1; key <= 3; key++) {
-      const update = controller.setDemand(
-        subscription,
-        plan,
-        new Set(Array.from({ length: key }, (_, index) => index + 1)),
-      )
-      expect(requests[key - 1]!.keys).toEqual([key])
-      await settle(key - 1, update.ready)
-    }
-    expect(requests.flatMap(({ keys }) => keys)).toHaveLength(3)
-
-    const replacement = controller.setDemand(
-      subscription,
-      plan,
-      new Set([2, 3, 4]),
-    )
-    expect(requests[3]!.keys).toEqual([2, 3, 4])
-    expect(requests[1]!.signal?.aborted).toBe(false)
-    expect(requests[2]!.signal?.aborted).toBe(false)
-
-    if (replacementOutcome === `failure`) {
-      if (!(replacement.ready instanceof Promise)) {
-        throw new Error(`Expected replacement demand to be asynchronous`)
-      }
-      const failure = new Error(`replacement failed`)
-      const failed = Promise.all([requests[3]!.outcome, replacement.ready])
-      requests[3]!.deferred.reject(failure)
-      await expect(failed).rejects.toBe(failure)
-      expect(requests[1]!.signal?.aborted).toBe(false)
-      expect(requests[2]!.signal?.aborted).toBe(false)
-
-      const retry = controller.setDemand(subscription, plan, new Set([2, 3, 4]))
-      expect(requests[3]!.signal?.aborted).toBe(true)
-      expect(requests[4]!.keys).toEqual([2, 3, 4])
-      expect(requests[1]!.signal?.aborted).toBe(false)
-      expect(requests[2]!.signal?.aborted).toBe(false)
-      await settle(4, retry.ready)
-    } else if (replacementOutcome === `obsolete`) {
-      const current = controller.setDemand(subscription, plan, new Set([2, 3]))
-      expect(requests[3]!.signal?.aborted).toBe(true)
-      expect(requests[4]!.keys).toEqual([2, 3])
-      expect(requests[1]!.signal?.aborted).toBe(false)
-      expect(requests[2]!.signal?.aborted).toBe(false)
-      await settle(3, replacement.ready)
-      expect(requests[1]!.signal?.aborted).toBe(false)
-      expect(requests[2]!.signal?.aborted).toBe(false)
-      await settle(4, current.ready)
-    } else {
-      await settle(3, replacement.ready)
-    }
-
-    expect(requests[1]!.signal?.aborted).toBe(true)
-    expect(requests[2]!.signal?.aborted).toBe(true)
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  for (const request of requests) request.deferred.resolve()
-  await finishTemporalCleanup(primaryFailure, [
-    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
-    () => controller.clear(),
-    () => subscription.unsubscribe(),
-    () => collection.cleanup(),
-  ])
-}
-
-async function expectFailedConsolidationKeepsVisibleRows(): Promise<void> {
-  const posts = createMutablePosts([
-    { id: 1, authorId: `selected`, title: `one` },
-  ])
-  const requests: Array<{
-    deferred: Deferred<void>
-    outcome: Promise<void>
-    keys: Array<number>
-    signal: AbortSignal | undefined
-  }> = []
-  const installed = new Map<number, Comment>()
-  const acquisitionKeys = new Map<LoadSubsetOptions, Array<number>>()
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-visible-coverage-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    autoIndex: `eager`,
-    defaultIndexType: BasicIndex,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => ({
-        loadSubset: (options) => {
-          const deferred = createDeferred<void>()
-          const keys = correlationKeys([options], `postId`)
-          const outcome = deferred.promise.then(async () => {
-            if (options.signal?.aborted) return
-            begin()
-            for (const postId of keys) {
-              const comment = {
-                id: postId * 100,
-                postId,
-                body: `comment ${postId}`,
-              }
-              installed.set(postId, comment)
-              write({ type: `insert`, value: comment })
-            }
-            const applied = commit(options.signal)
-            if (applied instanceof Promise) await applied
-            acquisitionKeys.set(options, keys)
-            markReady()
-          })
-          requests.push({ deferred, outcome, keys, signal: options.signal })
-          return outcome
-        },
-        unloadSubset: (options) => {
-          const keys = acquisitionKeys.get(options)
-          if (!keys) return
-          acquisitionKeys.delete(options)
-          begin()
-          for (const postId of keys) {
-            const comment = installed.get(postId)
-            if (comment) write({ type: `delete`, value: comment })
-            installed.delete(postId)
-          }
-          commit()
-        },
-      }),
-    },
-  })
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-  const settle = async (index: number) => {
-    requests[index]!.deferred.resolve()
-    await requests[index]!.outcome
-    await flushPromises()
-  }
-  const visibleCommentIds = () =>
-    live.toArray
-      .flatMap(({ comments: rows }) => rows.map(({ id }) => id))
-      .sort((left, right) => left - right)
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    const preload = live.preload()
-    await flushPromises()
-    expect(requests.map(({ keys }) => keys)).toEqual([[1]])
-    await settle(0)
-    await preload
-
-    for (let postId = 2; postId <= 3; postId++) {
-      posts.write(`insert`, {
-        id: postId,
-        authorId: `selected`,
-        title: String(postId),
-      })
-      await flushPromises()
-      expect(requests.at(-1)?.keys).toEqual([postId])
-      await settle(postId - 1)
-    }
-    expect(visibleCommentIds()).toEqual([100, 200, 300])
-
-    posts.writeBatch([
-      {
-        type: `delete`,
-        value: { id: 1, authorId: `selected`, title: `one` },
-      },
-      {
-        type: `insert`,
-        value: { id: 4, authorId: `selected`, title: `four` },
-      },
-    ])
-    await flushPromises()
-    expect(requests[3]?.keys).toEqual([2, 3, 4])
-    expect(requests[1]?.signal?.aborted).toBe(false)
-    expect(requests[2]?.signal?.aborted).toBe(false)
-
-    const failure = new Error(`replacement failed`)
-    requests[3]!.deferred.reject(failure)
-    await expect(requests[3]!.outcome).rejects.toBe(failure)
-    await flushPromises()
-
-    // After the first ready, the failed replacement is a request error on the
-    // live query's node. The query stays ready and keeps established rows.
-    expect(live.status).toBe(`ready`)
-    expect(live.health.error).toEqual(expect.anything())
-    expect(live.utils.lastSubsetError).toBe(failure)
-    expect(visibleCommentIds()).toEqual([200, 300])
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  for (const request of requests) request.deferred.resolve()
-  await finishTemporalCleanup(primaryFailure, [
-    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
-    () => live.cleanup(),
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-    () => consoleError.mockRestore(),
-  ])
-}
-
-function expectContradictoryReplacementStartCrashes(): void {
-  const releaseSnapshot = vi.fn()
-  let requestCount = 0
-  const subscription = {
-    requestSnapshot: (
-      options?: Parameters<CollectionSubscription[`requestSnapshot`]>[0],
-    ) => {
-      requestCount += 1
-      options?.onLoadSubsetResult?.(true, { where: options.where }, () => {})
-      return requestCount === 1
-    },
-    releaseSnapshot,
-  } as unknown as CollectionSubscription
-  const controller = new SubsetDemandController()
-  const plan: LazyDemandPlan = {
-    id: `contradictory-replacement-start`,
-    path: [`postId`],
-    collectionId: `contradictory-replacement-start`,
-    initialKeys: new Set(),
-  }
-
-  controller.setDemand(subscription, plan, new Set([1, 2]))
-  expect(() =>
-    controller.setDemand(subscription, plan, new Set([2, 3])),
-  ).toThrow(`Subset demand snapshot did not start`)
-  expect(releaseSnapshot).not.toHaveBeenCalled()
-}
-
-async function expectObsoleteAcquisitionCannotCompleteCurrentPreload(): Promise<void> {
-  const post = { id: 1, authorId: `selected`, title: `one` }
-  const posts = createMutablePosts([post], { markReadyInitially: false })
-  const { collection: comments, requests } = createPendingComments()
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const preload: PreloadState = { preloadSettled: false }
-  startPreload(live, preload)
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await flushPromises()
-    expect(requests).toHaveLength(1)
-
-    posts.write(`delete`, post)
-    posts.write(`insert`, post)
-    await flushPromises()
-    expect(requests).toHaveLength(2)
-    expect(requests[0]!.signal?.aborted).toBe(true)
-
-    requests[0]!.deferred.resolve()
-    await requests[0]!.outcome
-    posts.markReady()
-    await flushPromises()
-    expect(preload.preloadSettled).toBe(false)
-    expect(live.isReady()).toBe(false)
-
-    requests[1]!.deferred.resolve()
-    await requests[1]!.outcome
-    await finishPreload(preload)
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  for (const request of requests) request.deferred.resolve()
-  await finishTemporalCleanup(primaryFailure, [
-    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
-    () => live.cleanup(),
-    () => preload.preloadOutcome,
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-  ])
-}
-
-async function expectRejectedDemandEntersError(): Promise<void> {
-  const posts = createMutablePosts([
-    { id: 1, authorId: `selected`, title: `one` },
-  ])
-  let loadCount = 0
-  let shouldReject = true
-  let writeAfterRestart: () => void = () => {
-    throw new Error(`Successful demand has not started`)
-  }
-  const childLoadError = new Error(`child load failed`)
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-rejected-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => ({
-        loadSubset: () => {
-          loadCount += 1
-          if (shouldReject) {
-            return Promise.reject(childLoadError)
-          }
-          writeAfterRestart = () => {
-            begin()
-            write({
-              type: `insert`,
-              value: { id: 100, postId: 1, body: `after restart` },
-            })
-            commit()
-          }
-          markReady()
-          return true
-        },
-      }),
-    },
-  })
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const preload: PreloadState = { preloadSettled: false }
-  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-  startPreload(live, preload)
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await flushPromises()
-    expect(loadCount).toBe(1)
-    expect(live.status).toBe(`error`)
-    expect(preload.preloadSettled).toBe(true)
-    expect(preload.preloadFailure?.error).toBe(childLoadError)
-
-    await live.cleanup()
-    await preload.preloadOutcome
-    shouldReject = false
-    await live.preload()
-    expect(loadCount).toBe(2)
-    expect(live.isReady()).toBe(true)
-    writeAfterRestart()
-    expect(
-      live.toArray.map(({ id, comments: rows }) => ({
-        id,
-        comments: rows.map(({ id: childId, body }) => ({ id: childId, body })),
-      })),
-    ).toEqual([{ id: 1, comments: [{ id: 100, body: `after restart` }] }])
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishTemporalCleanup(primaryFailure, [
-    () => live.cleanup(),
-    () => preload.preloadOutcome,
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-    () => consoleError.mockRestore(),
-  ])
-}
-
-async function expectFailedDemandRetriesSameCoverage(): Promise<void> {
-  let loadCount = 0
-  let shouldReject = true
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-demand-retry-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    autoIndex: `eager`,
-    defaultIndexType: BasicIndex,
-    sync: {
-      sync: ({ markReady }) => ({
-        loadSubset: () => {
-          loadCount += 1
-          if (shouldReject) {
-            return Promise.reject(new Error(`child load failed`))
-          }
-          markReady()
-          return true
-        },
-      }),
-    },
-  })
-  comments.createIndex((comment) => comment.postId)
-  const subscription = comments.subscribeChanges(() => {}, {
-    includeInitialState: false,
-  })
-  const controller = new SubsetDemandController()
-  const plan: LazyDemandPlan = {
-    id: `same-coverage-retry`,
-    path: [`postId`],
-    collectionId: comments.id,
-    initialKeys: new Set(),
-  }
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    const first = controller.setDemand(subscription, plan, new Set([1]))
-    expect(first.ready).toBeInstanceOf(Promise)
-    if (!(first.ready instanceof Promise)) {
-      throw new Error(`Expected failed demand to be asynchronous`)
-    }
-    await expect(first.ready).rejects.toThrow(`child load failed`)
-
-    shouldReject = false
-    const retry = controller.setDemand(subscription, plan, new Set([1]))
-    expect(retry.changed).toBe(true)
-    expect(loadCount).toBe(2)
-    if (retry.ready instanceof Promise) await retry.ready
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishTemporalCleanup(primaryFailure, [
-    () => controller.clear(),
-    () => subscription.unsubscribe(),
-    () => comments.cleanup(),
-  ])
-}
-
-async function expectDemandReactivationRetriesAfterReleaseFailure(
-  keys: ReadonlyArray<number>,
-): Promise<void> {
-  let loadCount = 0
-  let unloadCount = 0
-  let allowUnload = false
-  const requestedKeys: Array<Array<number>> = []
-  const releaseError = new Error(`child release failed`)
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-release-retry-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    autoIndex: `eager`,
-    defaultIndexType: BasicIndex,
-    sync: {
-      sync: ({ markReady }) => ({
-        loadSubset: (options) => {
-          loadCount += 1
-          requestedKeys.push(correlationKeys([options], `postId`))
-          markReady()
-          return true
-        },
-        unloadSubset: () => {
-          unloadCount += 1
-          if (!allowUnload) throw releaseError
-        },
-      }),
-    },
-  })
-  comments.createIndex((comment) => comment.postId)
-  const subscription = comments.subscribeChanges(() => {}, {
-    includeInitialState: false,
-  })
-  const controller = new SubsetDemandController()
-  const plan: LazyDemandPlan = {
-    id: `release-failure-retry`,
-    path: [`postId`],
-    collectionId: comments.id,
-    initialKeys: new Set(),
-  }
-  // Core reports the throwing release uncaught, once.
-  const uncaught = captureMicrotaskErrors()
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    expect(
-      controller.setDemand(subscription, plan, new Set(keys)),
-    ).toMatchObject({ changed: true, empty: false })
-    expect(loadCount).toBe(1)
-
-    const retired = controller.setDemand(subscription, plan, new Set())
-    expect(retired).toMatchObject({ changed: true, empty: true })
-    expect(unloadCount).toBe(1)
-    await flushPromises()
-    expect(uncaught.errors).toEqual([releaseError])
-
-    const reactivated = controller.setDemand(subscription, plan, new Set(keys))
-    expectReleaseReentryObservation(
-      {
-        changed: reactivated.changed,
-        empty: reactivated.empty,
-        loadCount,
-        requestedKeys,
-      },
-      keys,
-    )
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  allowUnload = true
-  await finishTemporalCleanup(primaryFailure, [
-    () => controller.clear(),
-    () => subscription.unsubscribe(),
-    () => comments.cleanup(),
-    () => uncaught.restore(),
-  ])
-}
-
-type ReleaseReentryObservation = {
-  changed: boolean
-  empty: boolean
-  loadCount: number
-  requestedKeys: Array<Array<number>>
-}
-
-function expectReleaseReentryObservation(
-  observed: ReleaseReentryObservation,
-  keys: ReadonlyArray<number>,
-): void {
-  const expectedKeys = [...keys].sort((left, right) => left - right)
-  expect(observed).toEqual({
-    changed: true,
-    empty: false,
-    loadCount: 2,
-    requestedKeys: [expectedKeys, expectedKeys],
-  })
-}
-
-async function expectRetiredDemandStaysNonfatalAfterReleaseFailure(): Promise<void> {
-  const post = { id: 1, authorId: `selected`, title: `one` }
-  const posts = createMutablePosts([post])
-  let loadCount = 0
-  let allowUnload = false
-  const releaseError = new Error(`child release failed`)
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-retired-release-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    autoIndex: `eager`,
-    defaultIndexType: BasicIndex,
-    sync: {
-      sync: ({ markReady }) => ({
-        loadSubset: () => {
-          loadCount += 1
-          markReady()
-          return true
-        },
-        unloadSubset: () => {
-          if (!allowUnload) throw releaseError
-        },
-      }),
-    },
-  })
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-  // A throwing release is an adapter bug: core reports it uncaught, once,
-  // and records no subset error.
-  const uncaught = captureMicrotaskErrors()
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await live.preload()
-    expect(loadCount).toBe(1)
-    expect(live.status).toBe(`ready`)
-
-    posts.write(`delete`, post)
-    await flushPromises()
-    expect(live.size).toBe(0)
-    expect(live.status).toBe(`ready`)
-    expect(uncaught.errors).toEqual([releaseError])
-    expect(live.utils.lastSubsetError).toBeUndefined()
-
-    posts.write(`insert`, post)
-    await flushPromises()
-    expect(loadCount).toBe(2)
-    expect(live.status).toBe(`ready`)
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  allowUnload = true
-  await finishTemporalCleanup(primaryFailure, [
-    () => live.cleanup(),
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-    () => consoleError.mockRestore(),
-    () => uncaught.restore(),
-  ])
-}
-
-async function expectFailedReplayStopsGatingAfterLastDemandRetires(): Promise<void> {
-  const post = { id: 1, authorId: `selected`, title: `one` }
-  const posts = createMutablePosts([post])
-  const replay = createDeferred<void>()
-  let begin!: () => void
-  let write!: (message: { type: `insert`; value: Comment }) => void
-  let commit!: () => true | Promise<void>
-  let truncate!: () => void
-  let loadCount = 0
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-retired-replay-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    autoIndex: `eager`,
-    defaultIndexType: BasicIndex,
-    sync: {
-      sync: (operations) => {
-        begin = operations.begin
-        write = operations.write
-        commit = operations.commit
-        truncate = operations.truncate
-        operations.markReady()
-        return {
-          loadSubset: () => {
-            loadCount += 1
-            if (loadCount === 1) {
-              begin()
-              write({
-                type: `insert`,
-                value: { id: 10, postId: post.id, body: `old` },
-              })
-              commit()
-              return true
-            }
-            begin()
-            write({
-              type: `insert`,
-              value: { id: 20, postId: post.id, body: `private replacement` },
-            })
-            commit()
-            return replay.promise
-          },
-          unloadSubset: () => {},
-        }
-      },
-    },
-  })
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const publications: Array<Array<number>> = []
-  const subscription = live.subscribeChanges(
-    () => publications.push(live.toArray.map(({ id }) => id)),
-    { includeInitialState: false },
-  )
-  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await live.preload()
-    expect(live.get(post.id)?.comments.map(({ id }) => id)).toEqual([10])
-    publications.length = 0
-
-    begin()
-    truncate()
-    commit()
-    await flushPromises()
-    expect(loadCount).toBe(2)
-
-    replay.reject(new Error(`replacement failed`))
-    await flushPromises()
-    expect(live.get(post.id)?.comments.map(({ id }) => id)).toEqual([10])
-    expect(publications).toEqual([])
-
-    posts.write(`delete`, post)
-    await flushPromises()
-
-    // Once the parent retires the last child demand, its failed replay can no
-    // longer gate unrelated parent changes in the shared graph.
-    expect(live.size).toBe(0)
-    expect(publications).toEqual([[]])
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  replay.resolve()
-  await finishTemporalCleanup(primaryFailure, [
-    () => subscription.unsubscribe(),
-    () => live.cleanup(),
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-    () => consoleError.mockRestore(),
-  ])
-}
-
-async function expectSynchronousEmptyDemandIsReady(): Promise<void> {
-  const posts = createMutablePosts([
-    { id: 1, authorId: `selected`, title: `one` },
-  ])
-  let loadCount = 0
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-empty-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: () => ({
-        loadSubset: () => {
-          loadCount += 1
-          return true
-        },
-      }),
-    },
-  })
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await live.preload()
-    expect(loadCount).toBe(1)
-    expect(live.isReady()).toBe(true)
-    expect(live.get(1)?.comments).toEqual([])
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishTemporalCleanup(primaryFailure, [
-    () => live.cleanup(),
-    () => posts.collection.cleanup(),
-    () => comments.cleanup(),
-  ])
-}
-
-async function expectPartialShrinkRetainsCoverage(): Promise<void> {
-  const firstPost = { id: 1, authorId: `selected`, title: `one` }
-  const secondPost = { id: 2, authorId: `selected`, title: `two` }
-  const posts = createMutablePosts([firstPost, secondPost])
-  const initialLoad = createDeferred<void>()
-  const installed = new Map<number, Comment>()
-  let begin: () => void
-  let write: (change: { type: `insert` | `delete`; value: Comment }) => void
-  let commit: () => void
-  let markReady: () => void
-  let deduped: DeduplicatedLoadSubset
-  const unloads: Array<Array<number>> = []
-  const comments = createCollection<Comment>({
-    id: nextCollectionId(`temporal-shrink-comments`),
-    getKey: (comment) => comment.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: (methods) => {
-        ;({ begin, write, commit, markReady } = methods)
-        deduped = new DeduplicatedLoadSubset({
-          loadSubset: (options) =>
-            initialLoad.promise.then(() => {
-              const keys = correlationKeys([options], `postId`)
-              begin()
-              for (const postId of keys) {
-                const comment = { id: postId * 100, postId, body: `${postId}` }
-                installed.set(postId, comment)
-                write({ type: `insert`, value: comment })
-              }
-              commit()
-              markReady()
-            }),
-        })
-        return {
-          loadSubset: (options) => deduped.loadSubset(options),
-          unloadSubset: (options) => {
-            const keys = correlationKeys([options], `postId`)
-            unloads.push(keys)
-            begin()
-            for (const postId of keys) {
-              const comment = installed.get(postId)
-              if (comment) write({ type: `delete`, value: comment })
-              installed.delete(postId)
-            }
-            commit()
-          },
-        }
-      },
-    },
-  })
-  const live = createPostsWithCommentsLive(posts.collection, comments)
-  const preload = live.preload()
-
-  let primaryFailure: CapturedFailure | undefined
-  try {
-    await flushPromises()
-    initialLoad.resolve()
-    await preload
-    expect(live.get(1)?.comments).toHaveLength(1)
+    expect(requests).toHaveLength(2)
+    expect(requests[0]!.signal?.aborted).toBe(true)
 
-    posts.write(`delete`, secondPost)
+    await scheduler.waitAll(async (task) => {
+      await task()
+      await flushPromises()
+      // Copy this completion's public value. Later completions must not replace
+      // it.
+      observations.push({
+        completed: scheduler
+          .report()
+          .filter(({ status }) => status === `resolved`)
+          .map(({ label }) => label),
+        ready: live.isReady(),
+        rows: live.toArray.map(({ id, comments: rows }) => ({
+          id,
+          comments: rows.map(({ id: childId, body }) => ({
+            id: childId,
+            body,
+          })),
+        })),
+      })
+    })
+    await Promise.all(requests.map(({ outcome }) => outcome))
     await flushPromises()
-    expect(live.get(1)?.comments).toHaveLength(1)
-    expect(unloads).toEqual([])
 
-    posts.write(`delete`, firstPost)
-    await flushPromises()
-    expect(unloads).toEqual([[1, 2]])
+    expect(observations).toHaveLength(2)
+    for (const [index, observation] of observations.entries()) {
+      expectScheduledDemandObservation(observation, index)
+    }
+    expect(live.isReady()).toBe(true)
+    expect(live.get(1)?.comments.map(({ id, body }) => ({ id, body }))).toEqual(
+      [{ id: 200, body: `current` }],
+    )
   } catch (error) {
     primaryFailure = { error }
   }
-  initialLoad.resolve()
   await finishTemporalCleanup(primaryFailure, [
+    () => scheduler.count() > 0 && scheduler.waitAll(),
+    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
     () => live.cleanup(),
     () => Promise.allSettled([preload]),
-    () => posts.collection.cleanup(),
+    () => posts.cleanup(),
     () => comments.cleanup(),
   ])
 }
 
-type FastPathEvent = {
-  phase: `fast` | `late`
-  keys: Array<number>
-}
-
-// Model C: progressive rows can publish while the acquisition promise is pending.
-// The load starts inside the initial fast-path phase; initial-query readiness
-// waits for fulfillment.
-type ProgressiveObservation = {
-  events: Array<FastPathEvent>
+type ScheduledDemandObservation = {
+  completed: Array<string>
   ready: boolean
-  preloadSettled: boolean
+  rows: Array<{ id: number; comments: Array<{ id: number; body: string }> }>
 }
 
-type ProgressiveStep = `release-parent`
-
-type ProgressiveContext = {
-  users: Collection<User> | undefined
-  posts: Collection<ProgressivePost>
-  live: ReturnType<typeof createLiveQueryCollection>
-  events: Array<FastPathEvent>
-  closeWindow: () => void
-  releaseParent: (() => void) | undefined
-  startReached: Deferred<void>
-  parentDelivery: Promise<void> | undefined
-  preload: PreloadState
-  expected: ProgressiveObservation
+// The public row depends on whether the current acquisition's promise fulfilled.
+// An obsolete acquisition's settlement alone cannot add its child row.
+function expectScheduledDemandObservation(
+  observation: ScheduledDemandObservation,
+  index: number,
+): void {
+  expect(observation.completed).toHaveLength(index + 1)
+  const currentCompleted = observation.completed.includes(`demand-1`)
+  expect(observation.rows).toEqual([
+    {
+      id: 1,
+      comments: currentCompleted ? [{ id: 200, body: `current` }] : [],
+    },
+  ])
+  if (currentCompleted) expect(observation.ready).toBe(true)
 }
 
-function createProgressivePosts(): {
-  collection: Collection<ProgressivePost>
-  events: Array<FastPathEvent>
-  closeWindow: () => void
-  syncStarted: Deferred<void>
-} {
-  let windowOpen = true
-  const events: Array<FastPathEvent> = []
-  const syncStarted = createDeferred<void>()
-  const collection = createCollection<ProgressivePost>({
-    id: nextCollectionId(`temporal-progressive-posts`),
-    getKey: (post) => post.id,
+async function expectDemandReactivationRetriesAfterReleaseFailure(
+  keys: ReadonlyArray<number>,
+): Promise<void> {
+  let loadCount = 0
+  let unloadCount = 0
+  let allowUnload = false
+  const requestedKeys: Array<Array<number>> = []
+  const releaseError = new Error(`child release failed`)
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-release-retry-comments`),
+    getKey: (comment) => comment.id,
     syncMode: `on-demand`,
+    autoIndex: `eager`,
+    defaultIndexType: BasicIndex,
     sync: {
-      sync: ({ begin, commit, markReady }) => {
-        syncStarted.resolve()
-        begin()
-        commit()
-        markReady()
-        return {
-          loadSubset: (options) => {
-            events.push({
-              phase: windowOpen ? `fast` : `late`,
-              keys: correlationKeys([options], `userId`),
-            })
-            return Promise.resolve()
-          },
-        }
-      },
+      sync: ({ markReady }) => ({
+        loadSubset: (options) => {
+          loadCount += 1
+          requestedKeys.push(correlationKeys([options], `postId`))
+          markReady()
+          return true
+        },
+        unloadSubset: () => {
+          unloadCount += 1
+          if (!allowUnload) throw releaseError
+        },
+      }),
     },
   })
-  return {
-    collection,
-    events,
-    syncStarted,
-    closeWindow: () => {
-      windowOpen = false
-    },
-  }
-}
-
-function createGatedUsers(): {
-  collection: Collection<User>
-  release: () => void
-  started: Deferred<void>
-  delivery: Promise<void>
-} {
-  const gate = createDeferred<void>()
-  const started = createDeferred<void>()
-  const delivery = createDeferred<void>()
-  const collection = createCollection<User>({
-    id: nextCollectionId(`temporal-users`),
-    getKey: (user) => user.id,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        started.resolve()
-        gate.promise.then(
-          () => {
-            begin()
-            write({ type: `insert`, value: { id: 2, name: `selected` } })
-            commit()
-            markReady()
-            delivery.resolve()
-          },
-          (error) => delivery.reject(error),
-        )
-      },
-    },
+  comments.createIndex((comment) => comment.postId)
+  const subscription = comments.subscribeChanges(() => {}, {
+    includeInitialState: false,
   })
-  return {
-    collection,
-    release: () => gate.resolve(),
-    started,
-    delivery: delivery.promise,
+  const controller = new SubsetDemandController()
+  const plan: LazyDemandPlan = {
+    id: `release-failure-retry`,
+    path: [`postId`],
+    collectionId: comments.id,
+    initialKeys: new Set(),
   }
-}
+  // Core reports the throwing release uncaught, once.
+  const uncaught = captureMicrotaskErrors()
 
-function createProgressiveDriver(
-  mode: `direct` | `nested`,
-): TraceDriver<ProgressiveStep, ProgressiveContext> {
-  return {
-    setup: () => {
-      const {
-        collection: posts,
-        events,
-        closeWindow,
-        syncStarted,
-      } = createProgressivePosts()
-
-      if (mode === `direct`) {
-        const live = createLiveQueryCollection((q) =>
-          q.from({ post: posts }).where(({ post }) => eq(post.userId, 2)),
-        )
-        return {
-          users: undefined,
-          posts,
-          live,
-          events,
-          closeWindow,
-          releaseParent: undefined,
-          startReached: syncStarted,
-          parentDelivery: undefined,
-          preload: { preloadSettled: false },
-          expected: {
-            events: [{ phase: `fast`, keys: [2] }],
-            ready: true,
-            preloadSettled: true,
-          },
-        }
-      }
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    expect(
+      controller.setDemand(subscription, plan, new Set(keys)),
+    ).toMatchObject({ changed: true, empty: false })
+    expect(loadCount).toBe(1)
 
-      const {
-        collection: users,
-        release,
-        started,
-        delivery,
-      } = createGatedUsers()
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ user: users })
-          .where(({ user }) => eq(user.id, 2))
-          .select(({ user }) => ({
-            id: user.id,
-            posts: toArray(
-              q
-                .from({ post: posts })
-                .where(({ post }) => eq(post.userId, user.id)),
-            ),
-          })),
-      )
-      return {
-        users,
-        posts,
-        live,
-        events,
-        closeWindow,
-        releaseParent: release,
-        startReached: started,
-        parentDelivery: delivery,
-        preload: { preloadSettled: false },
-        expected: {
-          events: [{ phase: `fast`, keys: [2] }],
-          ready: false,
-          preloadSettled: false,
-        },
-      }
-    },
-    start: async (context) => {
-      const preload = startPreload(context.live, context.preload)
-      await context.startReached.promise
-      context.closeWindow()
-      if (mode === `direct`) await preload
-    },
-    apply: async (_step, context) => {
-      context.releaseParent?.()
-      context.expected = {
-        events: [{ phase: `fast`, keys: [2] }],
-        ready: true,
-        preloadSettled: true,
-      }
-      await finishPreload(context.preload)
-    },
-    cleanup: async ({
-      users,
-      posts,
-      live,
-      releaseParent,
-      parentDelivery,
-      preload,
-    }) => {
-      releaseParent?.()
-      await finishTemporalCleanup(undefined, [
-        () => parentDelivery,
-        () => live.cleanup(),
-        () => finishPreload(preload),
-        () => users?.cleanup(),
-        () => posts.cleanup(),
-      ])
-    },
+    const retired = controller.setDemand(subscription, plan, new Set())
+    expect(retired).toMatchObject({ changed: true, empty: true })
+    expect(unloadCount).toBe(1)
+    await flushPromises()
+    expect(uncaught.errors).toEqual([releaseError])
+
+    const reactivated = controller.setDemand(subscription, plan, new Set(keys))
+    expectReleaseReentryObservation(
+      {
+        changed: reactivated.changed,
+        empty: reactivated.empty,
+        loadCount,
+        requestedKeys,
+      },
+      keys,
+    )
+  } catch (error) {
+    primaryFailure = { error }
   }
+  allowUnload = true
+  await finishTemporalCleanup(primaryFailure, [
+    () => controller.clear(),
+    () => subscription.unsubscribe(),
+    () => comments.cleanup(),
+    () => uncaught.restore(),
+  ])
 }
 
-const progressiveProjection: TraceProjection<
-  ProgressiveContext,
-  ProgressiveObservation
-> = {
-  observe: ({ events, live, preload }) => ({
-    events: [...events],
-    ready: live.isReady(),
-    preloadSettled: preload.preloadSettled,
-  }),
-  recompute: ({ expected }) => expected,
-  assertEqual: (observed, expected) => {
-    expect(observed).toEqual(expected)
-    return undefined
-  },
+type ReleaseReentryObservation = {
+  changed: boolean
+  empty: boolean
+  loadCount: number
+  requestedKeys: Array<Array<number>>
 }
 
-async function expectProgressiveTraceMatches(
-  mode: `direct` | `nested`,
-): Promise<void> {
-  await runTrace({
-    steps: mode === `nested` ? [`release-parent`] : [],
-    driver: createProgressiveDriver(mode),
-    projection: progressiveProjection,
+function expectReleaseReentryObservation(
+  observed: ReleaseReentryObservation,
+  keys: ReadonlyArray<number>,
+): void {
+  const expectedKeys = [...keys].sort((left, right) => left - right)
+  expect(observed).toEqual({
+    changed: true,
+    empty: false,
+    loadCount: 2,
+    requestedKeys: [expectedKeys, expectedKeys],
   })
 }
 
@@ -2628,6 +557,7 @@ async function expectProgressiveTraceMatches(
 // the receiving witnesses for a real progressive source and for an on-demand
 // source that is ready before its subset loads.
 type LaggingSourceMode = `on-demand` | `eager`
+
 type LaggingSourceShape =
   | `direct`
   | `find-one`
@@ -2636,6 +566,7 @@ type LaggingSourceShape =
   | `join`
   | `eager-root`
   | `eager-default`
+
 type LaggingSourceConsumer =
   | `live-query`
   | `effect`
@@ -2648,6 +579,7 @@ const isReadConsumer = (consumer: LaggingSourceConsumer): boolean =>
   consumer === `query-once` ||
   consumer === `to-array-when-ready` ||
   consumer === `state-when-ready`
+
 type LaggingSourceStep =
   `deliver` | `settle` | `source-ready` | `change` | `rekey` | `truncate`
 
@@ -2719,6 +651,7 @@ function disturbedHistories(
 }
 
 const INITIAL_POST_ID = 2
+
 const CHANGED_POST_ID = 4
 
 type LaggingSourceFacts = {
@@ -3193,12 +1126,12 @@ function createLaggingSourceDriver(
       applyLaggingSourceStep(step, context)
       await flushPromises()
       if (step === `deliver` && context.main.startRead) {
-        const { facts, shape } = context
+        const { facts } = context
         facts.readOwes =
           facts.idsAtReadiness === undefined
             ? `at-readiness`
             : facts.posts
-                .filter((post) => postMatchesShape(shape, facts, post))
+                .filter((post) => postMatchesShape(context.shape, facts, post))
                 .map(({ id }) => id)
                 .sort((a, b) => a - b)
         context.main.startRead()
@@ -3360,6 +1293,21 @@ function temporalCampaigns(property: string, fixedSeed: number) {
   ]
 }
 
+declareOracle({
+  check: [
+    expectReadinessMatches,
+    expectScheduledDemandObservation,
+    expectReleaseReentryObservation,
+    expectLaggingSourceTraceMatches,
+  ],
+  model: [
+    expectedReadinessObservation,
+    expectedLiveQueryObservation,
+    expectedReadObservation,
+    expectedEffectObservation,
+  ],
+})
+
 describe(`includes temporal oracle`, () => {
   it(`an empty outer does not wait for an undemanded child`, () =>
     expectReadinessMatches([]))
@@ -3371,16 +1319,6 @@ describe(`includes temporal oracle`, () => {
     ])
   })
 
-  it(
-    `retired child demand does not block initial-query readiness`,
-    expectObsoleteDemandDoesNotBlockReadiness,
-  )
-
-  it(
-    `an obsolete child acquisition cannot publish after the route is reactivated`,
-    expectObsoleteAcquisitionCannotPublishAfterReactivation,
-  )
-
   // Grammar: one route is retired and reactivated, leaving one obsolete and
   // one current acquisition. The scheduler permutes their two completions.
   // Retire, reactivate, and completion order each distinguish the stale-demand
@@ -3388,6 +1326,7 @@ describe(`includes temporal oracle`, () => {
   // excludes a third incarnation. A canceled source write is forbidden by the
   // fixture's signal guard, not treated as a valid completion.
   const demandScheduler = fc.scheduler()
+
   for (const campaign of temporalCampaigns(
     `includes-temporal.demand-scheduling`,
     1_658_301,
@@ -3417,42 +1356,6 @@ describe(`includes temporal oracle`, () => {
     ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
   })
 
-  it(
-    `retained demand with a pending acquisition blocks initial-query readiness after demand expands`,
-    expectRetainedDemandBlocksReadiness,
-  )
-
-  it(`consolidates churn after apply without reloading monotonic growth`, () =>
-    expectDemandChurnPreservesCoverage(`success`))
-
-  it(`failed churn replacement retains coverage and retries its union`, () =>
-    expectDemandChurnPreservesCoverage(`failure`))
-
-  it(
-    `failed churn replacement keeps established child rows visible`,
-    expectFailedConsolidationKeepsVisibleRows,
-  )
-
-  it(`obsolete churn replacement cannot retire established coverage`, () =>
-    expectDemandChurnPreservesCoverage(`obsolete`))
-
-  it(
-    `crashes before replacing coverage when snapshot admission contradicts its result`,
-    expectContradictoryReplacementStartCrashes,
-  )
-
-  it(
-    `an obsolete acquisition cannot complete preload for reactivated demand`,
-    expectObsoleteAcquisitionCannotCompleteCurrentPreload,
-  )
-
-  it(`rejected demand enters error`, expectRejectedDemandEntersError)
-
-  it(
-    `failed demand retries the same coverage`,
-    expectFailedDemandRetriesSameCoverage,
-  )
-
   it(`reactivated demand retries after its prior release fails`, () =>
     expectDemandReactivationRetriesAfterReleaseFailure([1]))
 
@@ -3482,6 +1385,7 @@ describe(`includes temporal oracle`, () => {
     minLength: 1,
     maxLength: 5,
   })
+
   for (const campaign of temporalCampaigns(
     `includes-temporal.release-reentry`,
     1_658_302,
@@ -3492,33 +1396,6 @@ describe(`includes temporal oracle`, () => {
     )
   }
 
-  it(
-    `failed release retires an empty live-query demand, reported uncaught, without poisoning reentry`,
-    expectRetiredDemandStaysNonfatalAfterReleaseFailure,
-  )
-
-  it(
-    `failed replay stops gating after its last demand retires`,
-    expectFailedReplayStopsGatingAfterLastDemandRetires,
-  )
-
-  it(
-    `a synchronous empty demand can establish ready coverage`,
-    expectSynchronousEmptyDemandIsReady,
-  )
-
-  it(
-    `partially shrinking demand retains established coverage`,
-    expectPartialShrinkRetainsCoverage,
-  )
-
-  it(`loads a direct progressive subset inside the fast-path window`, async () => {
-    await expectProgressiveTraceMatches(`direct`)
-  })
-
-  it(`a nested progressive subset loads inside the fast-path window`, () =>
-    expectProgressiveTraceMatches(`nested`))
-
   describe(`source Collection readiness gates only an eager source`, () => {
     const consumers: Record<
       LaggingSourceConsumer,
@@ -3565,6 +1442,7 @@ describe(`includes temporal oracle`, () => {
     minLength: 2,
     maxLength: 4,
   })
+
   for (const campaign of temporalCampaigns(
     `includes-temporal.partial-values`,
     1_658_303,
diff --git a/packages/db/tests/query/includes-temporal-support.ts b/packages/db/tests/query/includes-temporal-support.ts
new file mode 100644
index 0000000000..05b050943b
--- /dev/null
+++ b/packages/db/tests/query/includes-temporal-support.ts
@@ -0,0 +1,256 @@
+// Shared helpers for the includes temporal tests. The oracle that owns the
+// temporal laws is includes-temporal-oracle.test.ts; the ordinary tests are in
+// includes-temporal.test.ts. Each helper here is used by both files.
+
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { extractSimpleComparisons } from '../../src/query/expression-helpers.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  toArray,
+} from '../../src/query/index.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { Deferred } from '../../src/deferred.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+
+export type Post = {
+  id: number
+  authorId: string
+  title: string
+}
+
+export type PostChange = {
+  type: `insert` | `delete`
+  value: Post
+}
+
+export type Comment = {
+  id: number
+  postId: number
+  body: string
+}
+
+export type User = {
+  id: number
+  name: string
+}
+
+export type ProgressivePost = {
+  id: number
+  userId: number
+  title: string
+}
+
+let collectionId = 0
+
+export function nextCollectionId(prefix: string): string {
+  collectionId += 1
+  return `${prefix}-${collectionId}`
+}
+
+export type PreloadState = {
+  preloadFailure?: { error: unknown }
+  preloadOutcome?: Promise<void>
+  preloadSettled: boolean
+}
+
+export type CapturedFailure = { error: unknown }
+
+export // Run every cleanup step after the first mismatch. Keep that mismatch as the
+// cause and retain each secondary cleanup error separately.
+async function finishTemporalCleanup(
+  primary: CapturedFailure | undefined,
+  cleanups: ReadonlyArray<() => unknown>,
+): Promise<void> {
+  const cleanupFailures: Array<unknown> = []
+  for (const cleanup of cleanups) {
+    try {
+      await cleanup()
+    } catch (error) {
+      cleanupFailures.push(error)
+    }
+  }
+  if (cleanupFailures.length > 0) {
+    if (!primary && cleanupFailures.length === 1) throw cleanupFailures[0]
+    throw new AggregateError(
+      [...(primary ? [primary.error] : []), ...cleanupFailures],
+      `Temporal oracle and cleanup failed`,
+      { cause: primary ? primary.error : cleanupFailures[0] },
+    )
+  }
+  if (primary) throw primary.error
+}
+
+export // A preload can reject before cleanup observes it. This record retains both
+// settlement and the original error without changing the production Promise.
+function startPreload(
+  live: ReturnType<typeof createLiveQueryCollection>,
+  state: PreloadState,
+): Promise<void> {
+  const preload = live.preload()
+  state.preloadOutcome = preload.then(
+    () => {
+      state.preloadSettled = true
+    },
+    (error) => {
+      state.preloadFailure = { error }
+      state.preloadSettled = true
+    },
+  )
+  return preload
+}
+
+export async function finishPreload(state: PreloadState): Promise<void> {
+  await state.preloadOutcome
+  if (state.preloadFailure) throw state.preloadFailure.error
+}
+
+export function correlationKeys(
+  loads: ReadonlyArray<LoadSubsetOptions>,
+  field: string,
+): Array<number> {
+  return [
+    ...new Set(
+      loads.flatMap((load) =>
+        extractSimpleComparisons(load.where).flatMap((filter) => {
+          if (filter.field[0] !== field) return []
+          if (filter.operator === `eq` && typeof filter.value === `number`) {
+            return [filter.value]
+          }
+          if (filter.operator !== `in` || !Array.isArray(filter.value)) {
+            return []
+          }
+          return filter.value.filter(
+            (value): value is number => typeof value === `number`,
+          )
+        }),
+      ),
+    ),
+  ].sort((left, right) => left - right)
+}
+
+export function createColdPosts(initial: ReadonlyArray<Post>): {
+  collection: Collection<Post>
+  loaded: Deferred<void>
+} {
+  const loaded = createDeferred<void>()
+  const collection = createCollection<Post>({
+    id: nextCollectionId(`temporal-posts`),
+    getKey: (post) => post.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => ({
+        loadSubset: () => {
+          begin()
+          for (const post of initial) {
+            write({ type: `insert`, value: post })
+          }
+          commit()
+          markReady()
+          loaded.resolve()
+          return Promise.resolve()
+        },
+      }),
+    },
+  })
+  return { collection, loaded }
+}
+
+export function createRemovablePost(): {
+  collection: Collection<Post>
+  remove: () => void
+  add: () => void
+} {
+  const post: Post = {
+    id: 1,
+    authorId: `selected`,
+    title: `selected`,
+  }
+  let remove: () => void = () => {
+    throw new Error(`Post collection has not started`)
+  }
+  let add: () => void = () => {
+    throw new Error(`Post collection has not started`)
+  }
+  const collection = createCollection<Post>({
+    id: nextCollectionId(`temporal-removable-post`),
+    getKey: (row) => row.id,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({ type: `insert`, value: post })
+        commit()
+        markReady()
+        remove = () => {
+          begin()
+          write({ type: `delete`, value: post })
+          commit()
+        }
+        add = () => {
+          begin()
+          write({ type: `insert`, value: post })
+          commit()
+        }
+      },
+    },
+  })
+  return { collection, remove: () => remove(), add: () => add() }
+}
+
+export function createMutablePosts(
+  initial: ReadonlyArray<Post>,
+  options: { markReadyInitially?: boolean } = {},
+): {
+  collection: Collection<Post>
+  write: (type: PostChange[`type`], post: Post) => void
+  writeBatch: (changes: ReadonlyArray<PostChange>) => void
+  markReady: () => void
+} {
+  let writePosts: (changes: ReadonlyArray<PostChange>) => void = () => {
+    throw new Error(`Post collection has not started`)
+  }
+  let markPostsReady: () => void = () => {
+    throw new Error(`Post collection has not started`)
+  }
+  const collection = createCollection<Post>({
+    id: nextCollectionId(`temporal-mutable-posts`),
+    getKey: (post) => post.id,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        for (const post of initial) write({ type: `insert`, value: post })
+        commit()
+        if (options.markReadyInitially !== false) markReady()
+        writePosts = (changes) => {
+          begin()
+          for (const change of changes) write(change)
+          commit()
+        }
+        markPostsReady = markReady
+      },
+    },
+  })
+  return {
+    collection,
+    write: (type, post) => writePosts([{ type, value: post }]),
+    writeBatch: (changes) => writePosts(changes),
+    markReady: () => markPostsReady(),
+  }
+}
+
+export function createPostsWithCommentsLive(
+  posts: Collection<Post>,
+  comments: Collection<Comment>,
+) {
+  return createLiveQueryCollection((q) =>
+    q.from({ post: posts }).select(({ post }) => ({
+      id: post.id,
+      comments: toArray(
+        q
+          .from({ comment: comments })
+          .where(({ comment }) => eq(comment.postId, post.id)),
+      ),
+    })),
+  )
+}
diff --git a/packages/db/tests/query/includes-temporal.test.ts b/packages/db/tests/query/includes-temporal.test.ts
new file mode 100644
index 0000000000..5ae48a73e2
--- /dev/null
+++ b/packages/db/tests/query/includes-temporal.test.ts
@@ -0,0 +1,1978 @@
+/**
+ * Ordinary tests moved from includes-temporal-oracle.test.ts. They check literal
+ * values, harness failure reporting, or a fixed scenario that has no computed
+ * expectation, so they are supplemental coverage. The temporal laws and their
+ * models are owned by includes-temporal-oracle.test.ts, which keeps the
+ * generated and driver-based checks. Shared helpers live in
+ * includes-temporal-support.ts.
+ */
+
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { BasicIndex } from '../../src/indexes/basic-index.js'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import { SubsetDemandController } from '../../src/query/live/subset-demand-controller.js'
+import { DeduplicatedLoadSubset } from '../../src/query/subset-dedupe.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  materialize,
+  toArray,
+} from '../../src/query/index.js'
+import { runTrace } from '../trace-runner.js'
+import { captureMicrotaskErrors, flushPromises } from '../utils.js'
+import {
+  correlationKeys,
+  createColdPosts,
+  createMutablePosts,
+  createPostsWithCommentsLive,
+  createRemovablePost,
+  finishPreload,
+  finishTemporalCleanup,
+  nextCollectionId,
+  startPreload,
+} from './includes-temporal-support.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { CollectionSubscription } from '../../src/collection/subscription.js'
+import type { Deferred } from '../../src/deferred.js'
+import type { LoadSubsetOptions, SyncAppliedReceipt } from '../../src/types.js'
+import type { LazyDemandPlan } from '../../src/query/compiler/joins.js'
+import type { BasicExpression } from '../../src/query/ir.js'
+import type { TraceDriver, TraceProjection } from '../trace-runner.js'
+import type {
+  CapturedFailure,
+  Comment,
+  Post,
+  PreloadState,
+  ProgressivePost,
+  User,
+} from './includes-temporal-support.js'
+
+it(`preserves a row mismatch and later cleanup failures together`, async () => {
+  const mismatch = new Error(`row mismatch at checkpoint 1`)
+  const cleanupError = new Error(`release failed`)
+  const cleanupCalls: Array<string> = []
+  let reported: unknown
+  try {
+    await finishTemporalCleanup({ error: mismatch }, [
+      () => {
+        cleanupCalls.push(`release`)
+        throw cleanupError
+      },
+      () => {
+        cleanupCalls.push(`remaining cleanup`)
+      },
+    ])
+  } catch (error) {
+    reported = error
+  }
+  expect(reported).toBeInstanceOf(AggregateError)
+  if (!(reported instanceof AggregateError)) return
+  expect(reported.cause).toBe(mismatch)
+  expect(reported.errors).toEqual([mismatch, cleanupError])
+  expect(cleanupCalls).toEqual([`release`, `remaining cleanup`])
+})
+
+type CommentRequest =
+  | { readonly type: `ref`; readonly path: ReadonlyArray<string> }
+  | { readonly type: `val`; readonly value: unknown }
+  | {
+      readonly type: `func`
+      readonly name: string
+      readonly args: ReadonlyArray<CommentRequest>
+    }
+
+function captureCommentRequest(
+  expression: BasicExpression | undefined,
+): CommentRequest {
+  if (!expression)
+    throw new Error(`Unsupported bounded comment fixture predicate`)
+  switch (expression.type) {
+    case `ref`:
+      return Object.freeze({
+        type: `ref`,
+        path: Object.freeze([...expression.path]),
+      })
+    case `val`:
+      return Object.freeze({
+        type: `val`,
+        value: Array.isArray(expression.value)
+          ? Object.freeze([...expression.value])
+          : expression.value,
+      })
+    case `func`:
+      return Object.freeze({
+        type: `func`,
+        name: expression.name,
+        args: Object.freeze([...expression.args].map(captureCommentRequest)),
+      })
+  }
+}
+
+// A bounded fixture interpreter, not the production filter evaluator. Compile
+// every branch before inspecting rows, including false-first conjunctions.
+function commentRequestPredicate(
+  request: CommentRequest | undefined,
+): (row: Comment) => boolean {
+  if (!request) return () => true
+  if (request.type === `func`) {
+    if (request.name === `and` && request.args.length > 0) {
+      const predicates = request.args.map(commentRequestPredicate)
+      return (row) => predicates.every((predicate) => predicate(row))
+    }
+    let [reference, constant] = request.args
+    if (request.name === `eq` && reference?.type === `val`)
+      [reference, constant] = [constant, reference]
+    if (
+      request.args.length === 2 &&
+      reference?.type === `ref` &&
+      reference.path.length === 1 &&
+      reference.path[0] === `postId` &&
+      constant?.type === `val`
+    ) {
+      const value = constant.value
+      if (
+        request.name === `eq` &&
+        typeof value === `number` &&
+        Number.isFinite(value)
+      )
+        return (row) => row.postId === value
+      if (
+        request.name === `in` &&
+        Array.isArray(value) &&
+        value.every(
+          (key: unknown) => typeof key === `number` && Number.isFinite(key),
+        )
+      )
+        return (row) => value.includes(row.postId)
+    }
+  }
+  throw new Error(`Unsupported bounded comment fixture predicate`)
+}
+
+function createValidatedColdComments(initial: ReadonlyArray<Comment>) {
+  const requests: Array<CommentRequest | undefined> = []
+  const loaded = new Set<number>()
+  const collection = createCollection<Comment>({
+    id: nextCollectionId(`validated-temporal-comments`),
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => ({
+        loadSubset: (options) => {
+          const request = options.where && captureCommentRequest(options.where)
+          requests.push(request)
+          if (
+            options.orderBy?.length ||
+            options.cursor !== undefined ||
+            options.limit !== undefined ||
+            (options.offset ?? 0) !== 0
+          )
+            throw new Error(`Unsupported bounded comment fixture request`)
+          const matches = commentRequestPredicate(request)
+          begin()
+          for (const row of initial) {
+            if (!loaded.has(row.id) && matches(row)) {
+              write({ type: `insert`, value: { ...row } })
+              loaded.add(row.id)
+            }
+          }
+          const receipt = commit()
+          if (receipt !== true) return receipt.then(() => markReady())
+          markReady()
+          return true
+        },
+      }),
+    },
+  })
+  return { collection, requests }
+}
+
+function captureCommentRows(value: unknown): Array<Comment> {
+  if (!Array.isArray(value)) throw new Error(`Expected inline comment rows`)
+  return value.map((row: unknown) => {
+    if (
+      row === null ||
+      typeof row !== `object` ||
+      !(`id` in row) ||
+      !(`postId` in row) ||
+      !(`body` in row) ||
+      typeof row.id !== `number` ||
+      typeof row.postId !== `number` ||
+      typeof row.body !== `string`
+    )
+      throw new Error(`Expected selected comment fields`)
+    return { id: row.id, postId: row.postId, body: row.body }
+  })
+}
+
+describe(`bounded cold comment request observations`, () => {
+  it(`validates complete predicates before filtering even an empty input`, () => {
+    const rows: Array<Comment> = [
+      { id: 100, postId: 1, body: `one` },
+      { id: 200, postId: 2, body: `two` },
+      { id: 300, postId: 3, body: `three` },
+    ]
+    const ref = new PropRef([`postId`])
+    const cases: Array<[BasicExpression | undefined, Array<number>]> = [
+      [undefined, [100, 200, 300]],
+      [new Func(`eq`, [ref, new Value(1)]), [100]],
+      [new Func(`eq`, [new Value(2), ref]), [200]],
+      [new Func(`in`, [ref, new Value([1, 3])]), [100, 300]],
+      [new Func(`in`, [ref, new Value([2])]), [200]],
+      [new Func(`in`, [ref, new Value([])]), []],
+      [
+        new Func(`and`, [
+          new Func(`in`, [ref, new Value([1, 3])]),
+          new Func(`eq`, [ref, new Value(3)]),
+        ]),
+        [300],
+      ],
+    ]
+    for (const [expression, expected] of cases) {
+      const predicate = commentRequestPredicate(
+        expression && captureCommentRequest(expression),
+      )
+      expect(rows.filter(predicate).map(({ id }) => id)).toEqual(expected)
+    }
+    // These reject the fixture's unsupported domain, not runtime query syntax.
+    for (const expression of [
+      new Func(`lt`, [ref, new Value(1)]),
+      new Func(`eq`, [new PropRef([`id`]), new Value(1)]),
+      new Func(`eq`, [new PropRef([`postId`, `nested`]), new Value(1)]),
+      new Func(`eq`, [ref]),
+      new Func(`in`, [ref, new Value(1)]),
+      new Func(`and`, [
+        new Func(`eq`, [ref, new Value(999)]),
+        new Func(`lt`, [ref, new Value(1)]),
+      ]),
+    ]) {
+      const request = captureCommentRequest(expression)
+      expect(() => commentRequestPredicate(request)).toThrow(
+        `Unsupported bounded comment fixture predicate`,
+      )
+      expect(() => [].filter(commentRequestPredicate(request))).toThrow(
+        `Unsupported bounded comment fixture predicate`,
+      )
+    }
+  })
+
+  it(`retains immutable request paths, branches and membership values`, () => {
+    const path = [`postId`]
+    const membership = [1, 3]
+    const args = [new PropRef(path), new Value(membership)]
+    const snapshot = captureCommentRequest(new Func(`in`, args))
+    // Change only test-owned input after capture, never a runtime request.
+    path[0] = `changed`
+    membership.splice(0, 2, 2)
+    args.pop()
+    expect(snapshot).toEqual({
+      type: `func`,
+      name: `in`,
+      args: [
+        { type: `ref`, path: [`postId`] },
+        { type: `val`, value: [1, 3] },
+      ],
+    })
+    expect(Object.isFrozen(snapshot)).toBe(true)
+    if (snapshot.type !== `func`) throw new Error(`Expected function snapshot`)
+    expect(Object.isFrozen(snapshot.args)).toBe(true)
+    const [reference, constant] = snapshot.args
+    if (reference?.type !== `ref` || constant?.type !== `val`)
+      throw new Error(`Expected reference and value snapshots`)
+    expect(Object.isFrozen(reference.path)).toBe(true)
+    expect(Object.isFrozen(constant.value)).toBe(true)
+  })
+
+  it.each(
+    ([`array`, `materialized`] as const).flatMap((form) =>
+      ([`expression`, `functional`] as const).map((projection) => ({
+        form,
+        projection,
+      })),
+    ),
+  )(
+    `$form / $projection becomes ready for selected parents without counting an excluded parent`,
+    async ({ form, projection }) => {
+      const posts = createColdPosts([
+        { id: 1, authorId: `selected`, title: `one` },
+        { id: 2, authorId: `excluded`, title: `two` },
+        { id: 3, authorId: `selected`, title: `three` },
+      ])
+      const comments = createValidatedColdComments([
+        { id: 100, postId: 1, body: `one` },
+        { id: 200, postId: 2, body: `two` },
+        { id: 300, postId: 3, body: `three` },
+      ])
+      const live = createLiveQueryCollection((q) => {
+        const included = q
+          .from({ post: posts.collection })
+          .where(({ post }) => eq(post.authorId, `selected`))
+          .select(({ post }) => {
+            const childRows = q
+              .from({ comment: comments.collection })
+              .where(({ comment }) => eq(comment.postId, post.id))
+              .select(({ comment }) => ({
+                id: comment.id,
+                postId: comment.postId,
+                body: comment.body,
+              }))
+            return {
+              id: post.id,
+              comments:
+                form === `array` ? toArray(childRows) : materialize(childRows),
+              count: 0,
+            }
+          })
+        const outer = q.from({ row: included })
+        return projection === `expression`
+          ? outer.select(({ row }) => row)
+          : outer.fn.select(({ row }) => {
+              expect(Array.isArray(row.comments)).toBe(true)
+              return {
+                ...row,
+                count: Array.isArray(row.comments) ? row.comments.length : -1,
+              }
+            })
+      })
+      let primaryFailure: { error: unknown } | undefined
+      try {
+        expect(comments.collection.size).toBe(0)
+        await live.preload()
+        expect(live.isReady()).toBe(true)
+        expect(comments.requests.length).toBeGreaterThan(0)
+        expect(
+          live.toArray
+            .map((row) => ({
+              id: row.id,
+              comments: captureCommentRows(row.comments),
+              count: row.count,
+            }))
+            .sort((left, right) => left.id - right.id),
+        ).toEqual([
+          {
+            id: 1,
+            comments: [{ id: 100, postId: 1, body: `one` }],
+            count: projection === `functional` ? 1 : 0,
+          },
+          {
+            id: 3,
+            comments: [{ id: 300, postId: 3, body: `three` }],
+            count: projection === `functional` ? 1 : 0,
+          },
+        ])
+      } catch (error) {
+        primaryFailure = { error }
+      }
+      const results = await Promise.allSettled(
+        [live, posts.collection, comments.collection].map(async (collection) =>
+          collection.cleanup(),
+        ),
+      )
+      const failures = results.flatMap((result): Array<unknown> =>
+        result.status === `rejected` ? [result.reason as unknown] : [],
+      )
+      if (failures.length > 0) {
+        if (!primaryFailure && failures.length === 1) throw failures[0]
+        throw new AggregateError(
+          [...(primaryFailure ? [primaryFailure.error] : []), ...failures],
+          `Cold comment observation and cleanup failed`,
+          { cause: primaryFailure ? primaryFailure.error : failures[0] },
+        )
+      }
+      if (primaryFailure) throw primaryFailure.error
+    },
+  )
+})
+
+it.each(
+  ([`array`, `materialized`] as const).flatMap((form) =>
+    ([`expression`, `functional`] as const).map((projection) => ({
+      form,
+      projection,
+    })),
+  ),
+)(
+  `$form / $projection preserves child demand and applied settlement across projection`,
+  async ({ form, projection }) => {
+    const posts = createColdPosts([{ id: 1, authorId: `one`, title: `post` }])
+    const started = createDeferred<void>()
+    const release = createDeferred<void>()
+    const loads: Array<LoadSubsetOptions> = []
+    const comments = createCollection<Comment>({
+      id: nextCollectionId(`projection-pending-comments`),
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => ({
+          loadSubset: (options) => {
+            loads.push(options)
+            const keys = correlationKeys([options], `postId`)
+            started.resolve()
+            return release.promise.then(async () => {
+              if (options.signal?.aborted) return
+              begin()
+              if (keys.includes(1))
+                write({
+                  type: `insert`,
+                  value: { id: 100, postId: 1, body: `one` },
+                })
+              await commit()
+              markReady()
+            })
+          },
+        }),
+      },
+    })
+    const live = createLiveQueryCollection((q) => {
+      const included = q.from({ post: posts.collection }).select(({ post }) => {
+        const childRows = q
+          .from({ comment: comments })
+          .where(({ comment }) => eq(comment.postId, post.id))
+        return {
+          id: post.id,
+          comments:
+            form === `array` ? toArray(childRows) : materialize(childRows),
+          count: 0,
+        }
+      })
+      const outer = q.from({ row: included })
+      return projection === `expression`
+        ? outer.select(({ row }) => row)
+        : outer.fn.select(({ row }) => {
+            expect
+              .soft(
+                Array.isArray(row.comments),
+                `callback receives an inline value`,
+              )
+              .toBe(true)
+            return {
+              id: row.id,
+              comments: row.comments,
+              count: Array.isArray(row.comments) ? row.comments.length : -1,
+            }
+          })
+    })
+    let settled = false
+    const preload = live.preload()
+    const observed = preload.then(
+      () => {
+        settled = true
+      },
+      () => {
+        settled = true
+      },
+    )
+    let primaryFailure: CapturedFailure | undefined
+    try {
+      await Promise.race([started.promise, preload])
+      expect(loads).toHaveLength(1)
+      expect(correlationKeys(loads, `postId`)).toEqual([1])
+      expect(settled).toBe(false)
+      release.resolve()
+      await preload
+      expect(live.toArray).toHaveLength(1)
+      // Observe the runtime boundary: a broken projection can omit this value.
+      const publishedComments = live.toArray[0]?.comments as unknown as
+        Array<Comment> | undefined
+      expect(
+        publishedComments?.map(({ id, postId, body }) => ({
+          id,
+          postId,
+          body,
+        })),
+      ).toEqual([{ id: 100, postId: 1, body: `one` }])
+      if (projection === `functional`) expect(live.toArray[0]?.count).toBe(1)
+    } catch (error) {
+      primaryFailure = { error }
+    }
+    release.resolve()
+    await finishTemporalCleanup(primaryFailure, [
+      () => live.cleanup(),
+      () => observed,
+      () => posts.collection.cleanup(),
+      () => comments.cleanup(),
+    ])
+  },
+)
+
+it.each(
+  ([`array`, `materialized`] as const).flatMap((form) =>
+    ([`expression`, `functional`] as const).flatMap((projection) =>
+      [false, true].map((pending) => ({ form, projection, pending })),
+    ),
+  ),
+)(
+  `$form / $projection waits for actual source application with pending=$pending`,
+  async ({ form, projection, pending }) => {
+    const posts = createColdPosts([{ id: 1, authorId: `one`, title: `post` }])
+    const mutation = createDeferred<void>()
+    const started = createDeferred<void>()
+    const requests: Array<{
+      receipt: SyncAppliedReceipt
+      settled: boolean
+      outcome: Promise<void>
+    }> = []
+    let writeChild: (row: Comment) => SyncAppliedReceipt = () => {
+      throw new Error(`Comment source has not started`)
+    }
+    const comments = createCollection<Comment>({
+      id: nextCollectionId(`actual-applied-receipt-comments`),
+      getKey: (row) => row.id,
+      startSync: true,
+      syncMode: `on-demand`,
+      onInsert: () => mutation.promise,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          markReady()
+          writeChild = (row) => {
+            begin()
+            write({ type: `insert`, value: row })
+            return commit()
+          }
+          return {
+            loadSubset: (options) => {
+              begin()
+              write({
+                type: `insert`,
+                value: { id: 100, postId: 1, body: `applied` },
+              })
+              const receipt = commit(options.signal)
+              const request = {
+                receipt,
+                settled: false,
+                outcome: Promise.resolve(),
+              }
+              request.outcome = Promise.resolve(receipt).then(
+                () => {
+                  request.settled = true
+                },
+                () => {
+                  request.settled = true
+                },
+              )
+              requests.push(request)
+              started.resolve()
+              return Promise.resolve(receipt).then(() => {
+                markReady()
+              })
+            },
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) => {
+      const included = q.from({ post: posts.collection }).select(({ post }) => {
+        const rows = q
+          .from({ comment: comments })
+          .where(({ comment }) => eq(comment.postId, post.id))
+          .orderBy(({ comment }) => comment.id)
+        return {
+          id: post.id,
+          comments: form === `array` ? toArray(rows) : materialize(rows),
+          count: 0,
+        }
+      })
+      const outer = q.from({ row: included })
+      return projection === `expression`
+        ? outer.select(({ row }) => row)
+        : outer.fn.select(({ row }) => {
+            expect.soft(Array.isArray(row.comments)).toBe(true)
+            return {
+              ...row,
+              count: Array.isArray(row.comments) ? row.comments.length : -1,
+            }
+          })
+    })
+    let transaction: ReturnType<typeof comments.insert> | undefined
+    let transactionOutcome: Promise<unknown> | undefined
+    const state: PreloadState = { preloadSettled: false }
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      if (pending) {
+        transaction = comments.insert({
+          id: 999,
+          postId: 999,
+          body: `unrelated`,
+        })
+        transactionOutcome = transaction.isPersisted.promise.then(
+          () => undefined,
+          () => undefined,
+        )
+      }
+      const preload = startPreload(live, state)
+      await Promise.race([started.promise, preload])
+      await flushPromises()
+      expect(requests.length).toBeGreaterThan(0)
+      if (pending) {
+        expect(transaction?.state).toBe(`persisting`)
+        expect(
+          requests.every(({ receipt }) => receipt instanceof Promise),
+        ).toBe(true)
+        expect(requests.every(({ settled }) => !settled)).toBe(true)
+        expect(comments.has(100)).toBe(false)
+        expect(comments.get(100)).toBeUndefined()
+        expect(state.preloadSettled).toBe(false)
+        expect(live.isReady()).toBe(false)
+      } else {
+        expect(requests.every(({ receipt }) => receipt === true)).toBe(true)
+        expect(comments.get(100)).toMatchObject({
+          id: 100,
+          postId: 1,
+          body: `applied`,
+        })
+      }
+      mutation.resolve()
+      if (transaction) await transaction.isPersisted.promise
+      await preload
+      await Promise.all(requests.map(({ outcome }) => outcome))
+      expect(requests.every(({ settled }) => settled)).toBe(true)
+      expect(live.isReady()).toBe(true)
+      const capture = () =>
+        live.toArray.map((row) => ({
+          id: row.id,
+          comments: captureCommentRows(row.comments),
+          count: row.count,
+        }))
+      expect(capture()).toEqual([
+        {
+          id: 1,
+          comments: [{ id: 100, postId: 1, body: `applied` }],
+          count: projection === `functional` ? 1 : 0,
+        },
+      ])
+      await writeChild({ id: 101, postId: 1, body: `continued` })
+      expect(capture()).toEqual([
+        {
+          id: 1,
+          comments: [
+            { id: 100, postId: 1, body: `applied` },
+            { id: 101, postId: 1, body: `continued` },
+          ],
+          count: projection === `functional` ? 2 : 0,
+        },
+      ])
+    } catch (error) {
+      primaryFailure = { error }
+    }
+    const cleanupErrors: Array<unknown> = []
+    try {
+      if (
+        transaction?.state === `pending` ||
+        transaction?.state === `persisting`
+      )
+        transaction.rollback()
+    } catch (error) {
+      cleanupErrors.push(error)
+    }
+    mutation.resolve()
+    if (cleanupErrors.length === 0) await transactionOutcome
+    const results = await Promise.allSettled(
+      [live, posts.collection, comments].map(async (collection) =>
+        collection.cleanup(),
+      ),
+    )
+    for (const result of results)
+      if (result.status === `rejected`)
+        cleanupErrors.push(result.reason as unknown)
+    if (cleanupErrors.length === 0) {
+      await state.preloadOutcome
+      await Promise.all(requests.map(({ outcome }) => outcome))
+    }
+    if (cleanupErrors.length > 0) {
+      if (!primaryFailure && cleanupErrors.length === 1) throw cleanupErrors[0]
+      throw new AggregateError(
+        [...(primaryFailure ? [primaryFailure.error] : []), ...cleanupErrors],
+        `Applied receipt observation and cleanup failed`,
+        { cause: primaryFailure ? primaryFailure.error : cleanupErrors[0] },
+      )
+    }
+    if (primaryFailure) throw primaryFailure.error
+  },
+)
+
+// Model B: retiring the only route removes its child acquisition from
+// initial-query readiness, even when that acquisition's promise is pending.
+type DemandCancellationObservation = {
+  ready: boolean
+  rowCount: number
+  childLoadStarted: boolean
+  childLoadPending: boolean
+}
+
+type DemandCancellationContext = {
+  posts: Collection<Post>
+  comments: Collection<Comment>
+  live: ReturnType<typeof createLiveQueryCollection>
+  removePost: () => void
+  childLoad: ReturnType<typeof createDeferred<void>>
+  childLoadStarted: Deferred<void>
+  preload: PreloadState
+  expected: DemandCancellationObservation
+}
+
+function createDemandCancellationDriver(): TraceDriver<
+  `remove-parent`,
+  DemandCancellationContext
+> {
+  return {
+    setup: () => {
+      const { collection: posts, remove } = createRemovablePost()
+      const childLoad = createDeferred<void>()
+      const childLoadStarted = createDeferred<void>()
+      const comments = createCollection<Comment>({
+        id: nextCollectionId(`temporal-pending-comments`),
+        getKey: (comment) => comment.id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: () => ({
+            loadSubset: () => {
+              childLoadStarted.resolve()
+              return childLoad.promise
+            },
+          }),
+        },
+      })
+      const live = createLiveQueryCollection((q) =>
+        q.from({ post: posts }).select(({ post }) => ({
+          id: post.id,
+          comments: toArray(
+            q
+              .from({ comment: comments })
+              .where(({ comment }) => eq(comment.postId, post.id)),
+          ),
+        })),
+      )
+      return {
+        posts,
+        comments,
+        live,
+        removePost: remove,
+        childLoad,
+        childLoadStarted,
+        preload: { preloadSettled: false },
+        expected: {
+          ready: false,
+          rowCount: 1,
+          childLoadStarted: true,
+          childLoadPending: true,
+        },
+      }
+    },
+    start: async (context) => {
+      startPreload(context.live, context.preload)
+      await context.childLoadStarted.promise
+    },
+    apply: (_step, context) => {
+      context.removePost()
+      context.expected = {
+        ready: true,
+        rowCount: 0,
+        childLoadStarted: true,
+        childLoadPending: true,
+      }
+    },
+    cleanup: async ({ posts, comments, live, childLoad, preload }) => {
+      childLoad.resolve()
+      await finishTemporalCleanup(undefined, [
+        () => live.cleanup(),
+        () => finishPreload(preload),
+        () => posts.cleanup(),
+        () => comments.cleanup(),
+      ])
+    },
+  }
+}
+
+const demandCancellationProjection: TraceProjection<
+  DemandCancellationContext,
+  DemandCancellationObservation
+> = {
+  observe: ({ live, childLoadStarted, childLoad }) => ({
+    ready: live.isReady(),
+    rowCount: live.size,
+    childLoadStarted: !childLoadStarted.isPending(),
+    childLoadPending: childLoad.isPending(),
+  }),
+  recompute: ({ expected }) => expected,
+  assertEqual: (observed, expected) => {
+    expect(observed).toEqual(expected)
+    return undefined
+  },
+}
+
+async function expectObsoleteDemandDoesNotBlockReadiness(): Promise<void> {
+  await runTrace({
+    steps: [`remove-parent`],
+    driver: createDemandCancellationDriver(),
+    projection: demandCancellationProjection,
+  })
+}
+
+async function expectObsoleteAcquisitionCannotPublishAfterReactivation(): Promise<void> {
+  const { collection: posts, remove, add } = createRemovablePost()
+  const requests: Array<{
+    deferred: Deferred<void>
+    outcome: Promise<void>
+    signal: AbortSignal | undefined
+  }> = []
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-generation-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => ({
+        loadSubset: (options) => {
+          const requestIndex = requests.length
+          const deferred = createDeferred<void>()
+          const signal = options.signal
+          const outcome = deferred.promise.then(() => {
+            if (signal?.aborted) return
+            begin()
+            write({
+              type: `insert`,
+              value:
+                requestIndex === 0
+                  ? { id: 100, postId: 1, body: `obsolete` }
+                  : { id: 200, postId: 1, body: `current` },
+            })
+            commit()
+            markReady()
+          })
+          requests.push({ deferred, outcome, signal })
+          return outcome
+        },
+      }),
+    },
+  })
+  const live = createLiveQueryCollection((q) =>
+    q.from({ post: posts }).select(({ post }) => ({
+      id: post.id,
+      comments: toArray(
+        q
+          .from({ comment: comments })
+          .where(({ comment }) => eq(comment.postId, post.id))
+          .select(({ comment }) => ({
+            id: comment.id,
+            body: comment.body,
+          })),
+      ),
+    })),
+  )
+
+  const preload = live.preload()
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await flushPromises()
+    expect(requests).toHaveLength(1)
+
+    remove()
+    await preload
+    expect(live.size).toBe(0)
+
+    add()
+    await flushPromises()
+    expect(requests).toHaveLength(2)
+
+    requests[1]!.deferred.resolve()
+    await requests[1]!.outcome
+    await flushPromises()
+    expect(live.get(1)?.comments).toEqual([{ id: 200, body: `current` }])
+
+    requests[0]!.deferred.resolve()
+    await requests[0]!.outcome
+    await flushPromises()
+    expect(live.get(1)?.comments).toEqual([{ id: 200, body: `current` }])
+    expect(requests[0]!.signal?.aborted).toBe(true)
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  for (const request of requests) request.deferred.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
+    () => live.cleanup(),
+    () => Promise.allSettled([preload]),
+    () => posts.cleanup(),
+    () => comments.cleanup(),
+  ])
+}
+
+function createPendingComments(): {
+  collection: Collection<Comment>
+  requests: Array<{
+    deferred: Deferred<void>
+    outcome: Promise<void>
+    keys: Array<number>
+    signal: AbortSignal | undefined
+  }>
+} {
+  const requests: Array<{
+    deferred: Deferred<void>
+    outcome: Promise<void>
+    keys: Array<number>
+    signal: AbortSignal | undefined
+  }> = []
+  const collection = createCollection<Comment>({
+    id: nextCollectionId(`temporal-pending-coverage-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ markReady }) => ({
+        loadSubset: (options) => {
+          const deferred = createDeferred<void>()
+          const outcome = deferred.promise.then(() => {
+            if (!options.signal?.aborted) markReady()
+          })
+          requests.push({
+            deferred,
+            outcome,
+            keys: correlationKeys([options], `postId`),
+            signal: options.signal,
+          })
+          return outcome
+        },
+      }),
+    },
+  })
+  return { collection, requests }
+}
+
+async function expectRetainedDemandBlocksReadiness(): Promise<void> {
+  const firstPost = { id: 1, authorId: `selected`, title: `one` }
+  const secondPost = { id: 2, authorId: `selected`, title: `two` }
+  const posts = createMutablePosts([firstPost])
+  const { collection: comments, requests } = createPendingComments()
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const preload: PreloadState = { preloadSettled: false }
+  startPreload(live, preload)
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await flushPromises()
+    expect(requests.map(({ keys }) => keys)).toEqual([[1]])
+
+    posts.write(`insert`, secondPost)
+    await flushPromises()
+    expect(requests.map(({ keys }) => keys)).toEqual([[1], [2]])
+
+    requests[1]!.deferred.resolve()
+    await requests[1]!.outcome
+    await flushPromises()
+    expect(preload.preloadSettled).toBe(false)
+    expect(live.isReady()).toBe(false)
+
+    requests[0]!.deferred.resolve()
+    await requests[0]!.outcome
+    await finishPreload(preload)
+    expect(live.isReady()).toBe(true)
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  for (const request of requests) request.deferred.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
+    () => live.cleanup(),
+    () => preload.preloadOutcome,
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+  ])
+}
+
+async function expectDemandChurnPreservesCoverage(
+  replacementOutcome: `success` | `failure` | `obsolete`,
+): Promise<void> {
+  const { collection, requests } = createPendingComments()
+  const subscription = collection.subscribeChanges(() => {}, {
+    includeInitialState: false,
+  })
+  const controller = new SubsetDemandController()
+  const plan: LazyDemandPlan = {
+    id: `churn-consolidation`,
+    path: [`postId`],
+    collectionId: collection.id,
+    initialKeys: new Set(),
+  }
+  const settle = async (index: number, ready: Promise<unknown> | true) => {
+    requests[index]!.deferred.resolve()
+    await requests[index]!.outcome
+    if (ready instanceof Promise) await ready
+  }
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    for (let key = 1; key <= 3; key++) {
+      const update = controller.setDemand(
+        subscription,
+        plan,
+        new Set(Array.from({ length: key }, (_, index) => index + 1)),
+      )
+      expect(requests[key - 1]!.keys).toEqual([key])
+      await settle(key - 1, update.ready)
+    }
+    expect(requests.flatMap(({ keys }) => keys)).toHaveLength(3)
+
+    const replacement = controller.setDemand(
+      subscription,
+      plan,
+      new Set([2, 3, 4]),
+    )
+    expect(requests[3]!.keys).toEqual([2, 3, 4])
+    expect(requests[1]!.signal?.aborted).toBe(false)
+    expect(requests[2]!.signal?.aborted).toBe(false)
+
+    if (replacementOutcome === `failure`) {
+      if (!(replacement.ready instanceof Promise)) {
+        throw new Error(`Expected replacement demand to be asynchronous`)
+      }
+      const failure = new Error(`replacement failed`)
+      const failed = Promise.all([requests[3]!.outcome, replacement.ready])
+      requests[3]!.deferred.reject(failure)
+      await expect(failed).rejects.toBe(failure)
+      expect(requests[1]!.signal?.aborted).toBe(false)
+      expect(requests[2]!.signal?.aborted).toBe(false)
+
+      const retry = controller.setDemand(subscription, plan, new Set([2, 3, 4]))
+      expect(requests[3]!.signal?.aborted).toBe(true)
+      expect(requests[4]!.keys).toEqual([2, 3, 4])
+      expect(requests[1]!.signal?.aborted).toBe(false)
+      expect(requests[2]!.signal?.aborted).toBe(false)
+      await settle(4, retry.ready)
+    } else if (replacementOutcome === `obsolete`) {
+      const current = controller.setDemand(subscription, plan, new Set([2, 3]))
+      expect(requests[3]!.signal?.aborted).toBe(true)
+      expect(requests[4]!.keys).toEqual([2, 3])
+      expect(requests[1]!.signal?.aborted).toBe(false)
+      expect(requests[2]!.signal?.aborted).toBe(false)
+      await settle(3, replacement.ready)
+      expect(requests[1]!.signal?.aborted).toBe(false)
+      expect(requests[2]!.signal?.aborted).toBe(false)
+      await settle(4, current.ready)
+    } else {
+      await settle(3, replacement.ready)
+    }
+
+    expect(requests[1]!.signal?.aborted).toBe(true)
+    expect(requests[2]!.signal?.aborted).toBe(true)
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  for (const request of requests) request.deferred.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
+    () => controller.clear(),
+    () => subscription.unsubscribe(),
+    () => collection.cleanup(),
+  ])
+}
+
+async function expectFailedConsolidationKeepsVisibleRows(): Promise<void> {
+  const posts = createMutablePosts([
+    { id: 1, authorId: `selected`, title: `one` },
+  ])
+  const requests: Array<{
+    deferred: Deferred<void>
+    outcome: Promise<void>
+    keys: Array<number>
+    signal: AbortSignal | undefined
+  }> = []
+  const installed = new Map<number, Comment>()
+  const acquisitionKeys = new Map<LoadSubsetOptions, Array<number>>()
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-visible-coverage-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    autoIndex: `eager`,
+    defaultIndexType: BasicIndex,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => ({
+        loadSubset: (options) => {
+          const deferred = createDeferred<void>()
+          const keys = correlationKeys([options], `postId`)
+          const outcome = deferred.promise.then(async () => {
+            if (options.signal?.aborted) return
+            begin()
+            for (const postId of keys) {
+              const comment = {
+                id: postId * 100,
+                postId,
+                body: `comment ${postId}`,
+              }
+              installed.set(postId, comment)
+              write({ type: `insert`, value: comment })
+            }
+            const applied = commit(options.signal)
+            if (applied instanceof Promise) await applied
+            acquisitionKeys.set(options, keys)
+            markReady()
+          })
+          requests.push({ deferred, outcome, keys, signal: options.signal })
+          return outcome
+        },
+        unloadSubset: (options) => {
+          const keys = acquisitionKeys.get(options)
+          if (!keys) return
+          acquisitionKeys.delete(options)
+          begin()
+          for (const postId of keys) {
+            const comment = installed.get(postId)
+            if (comment) write({ type: `delete`, value: comment })
+            installed.delete(postId)
+          }
+          commit()
+        },
+      }),
+    },
+  })
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+  const settle = async (index: number) => {
+    requests[index]!.deferred.resolve()
+    await requests[index]!.outcome
+    await flushPromises()
+  }
+  const visibleCommentIds = () =>
+    live.toArray
+      .flatMap(({ comments: rows }) => rows.map(({ id }) => id))
+      .sort((left, right) => left - right)
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    const preload = live.preload()
+    await flushPromises()
+    expect(requests.map(({ keys }) => keys)).toEqual([[1]])
+    await settle(0)
+    await preload
+
+    for (let postId = 2; postId <= 3; postId++) {
+      posts.write(`insert`, {
+        id: postId,
+        authorId: `selected`,
+        title: String(postId),
+      })
+      await flushPromises()
+      expect(requests.at(-1)?.keys).toEqual([postId])
+      await settle(postId - 1)
+    }
+    expect(visibleCommentIds()).toEqual([100, 200, 300])
+
+    posts.writeBatch([
+      {
+        type: `delete`,
+        value: { id: 1, authorId: `selected`, title: `one` },
+      },
+      {
+        type: `insert`,
+        value: { id: 4, authorId: `selected`, title: `four` },
+      },
+    ])
+    await flushPromises()
+    expect(requests[3]?.keys).toEqual([2, 3, 4])
+    expect(requests[1]?.signal?.aborted).toBe(false)
+    expect(requests[2]?.signal?.aborted).toBe(false)
+
+    const failure = new Error(`replacement failed`)
+    requests[3]!.deferred.reject(failure)
+    await expect(requests[3]!.outcome).rejects.toBe(failure)
+    await flushPromises()
+
+    // After the first ready, the failed replacement is a request error on the
+    // live query's node. The query stays ready and keeps established rows.
+    expect(live.status).toBe(`ready`)
+    expect(live.health.error).toEqual(expect.anything())
+    expect(live.utils.lastSubsetError).toBe(failure)
+    expect(visibleCommentIds()).toEqual([200, 300])
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  for (const request of requests) request.deferred.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
+    () => live.cleanup(),
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+    () => consoleError.mockRestore(),
+  ])
+}
+
+function expectContradictoryReplacementStartCrashes(): void {
+  const releaseSnapshot = vi.fn()
+  let requestCount = 0
+  const subscription = {
+    requestSnapshot: (
+      options?: Parameters<CollectionSubscription[`requestSnapshot`]>[0],
+    ) => {
+      requestCount += 1
+      options?.onLoadSubsetResult?.(true, { where: options.where }, () => {})
+      return requestCount === 1
+    },
+    releaseSnapshot,
+  } as unknown as CollectionSubscription
+  const controller = new SubsetDemandController()
+  const plan: LazyDemandPlan = {
+    id: `contradictory-replacement-start`,
+    path: [`postId`],
+    collectionId: `contradictory-replacement-start`,
+    initialKeys: new Set(),
+  }
+
+  controller.setDemand(subscription, plan, new Set([1, 2]))
+  expect(() =>
+    controller.setDemand(subscription, plan, new Set([2, 3])),
+  ).toThrow(`Subset demand snapshot did not start`)
+  expect(releaseSnapshot).not.toHaveBeenCalled()
+}
+
+async function expectObsoleteAcquisitionCannotCompleteCurrentPreload(): Promise<void> {
+  const post = { id: 1, authorId: `selected`, title: `one` }
+  const posts = createMutablePosts([post], { markReadyInitially: false })
+  const { collection: comments, requests } = createPendingComments()
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const preload: PreloadState = { preloadSettled: false }
+  startPreload(live, preload)
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await flushPromises()
+    expect(requests).toHaveLength(1)
+
+    posts.write(`delete`, post)
+    posts.write(`insert`, post)
+    await flushPromises()
+    expect(requests).toHaveLength(2)
+    expect(requests[0]!.signal?.aborted).toBe(true)
+
+    requests[0]!.deferred.resolve()
+    await requests[0]!.outcome
+    posts.markReady()
+    await flushPromises()
+    expect(preload.preloadSettled).toBe(false)
+    expect(live.isReady()).toBe(false)
+
+    requests[1]!.deferred.resolve()
+    await requests[1]!.outcome
+    await finishPreload(preload)
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  for (const request of requests) request.deferred.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => Promise.allSettled(requests.map(({ outcome }) => outcome)),
+    () => live.cleanup(),
+    () => preload.preloadOutcome,
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+  ])
+}
+
+async function expectRejectedDemandEntersError(): Promise<void> {
+  const posts = createMutablePosts([
+    { id: 1, authorId: `selected`, title: `one` },
+  ])
+  let loadCount = 0
+  let shouldReject = true
+  let writeAfterRestart: () => void = () => {
+    throw new Error(`Successful demand has not started`)
+  }
+  const childLoadError = new Error(`child load failed`)
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-rejected-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => ({
+        loadSubset: () => {
+          loadCount += 1
+          if (shouldReject) {
+            return Promise.reject(childLoadError)
+          }
+          writeAfterRestart = () => {
+            begin()
+            write({
+              type: `insert`,
+              value: { id: 100, postId: 1, body: `after restart` },
+            })
+            commit()
+          }
+          markReady()
+          return true
+        },
+      }),
+    },
+  })
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const preload: PreloadState = { preloadSettled: false }
+  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+  startPreload(live, preload)
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await flushPromises()
+    expect(loadCount).toBe(1)
+    expect(live.status).toBe(`error`)
+    expect(preload.preloadSettled).toBe(true)
+    expect(preload.preloadFailure?.error).toBe(childLoadError)
+
+    await live.cleanup()
+    await preload.preloadOutcome
+    shouldReject = false
+    await live.preload()
+    expect(loadCount).toBe(2)
+    expect(live.isReady()).toBe(true)
+    writeAfterRestart()
+    expect(
+      live.toArray.map(({ id, comments: rows }) => ({
+        id,
+        comments: rows.map(({ id: childId, body }) => ({ id: childId, body })),
+      })),
+    ).toEqual([{ id: 1, comments: [{ id: 100, body: `after restart` }] }])
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  await finishTemporalCleanup(primaryFailure, [
+    () => live.cleanup(),
+    () => preload.preloadOutcome,
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+    () => consoleError.mockRestore(),
+  ])
+}
+
+async function expectFailedDemandRetriesSameCoverage(): Promise<void> {
+  let loadCount = 0
+  let shouldReject = true
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-demand-retry-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    autoIndex: `eager`,
+    defaultIndexType: BasicIndex,
+    sync: {
+      sync: ({ markReady }) => ({
+        loadSubset: () => {
+          loadCount += 1
+          if (shouldReject) {
+            return Promise.reject(new Error(`child load failed`))
+          }
+          markReady()
+          return true
+        },
+      }),
+    },
+  })
+  comments.createIndex((comment) => comment.postId)
+  const subscription = comments.subscribeChanges(() => {}, {
+    includeInitialState: false,
+  })
+  const controller = new SubsetDemandController()
+  const plan: LazyDemandPlan = {
+    id: `same-coverage-retry`,
+    path: [`postId`],
+    collectionId: comments.id,
+    initialKeys: new Set(),
+  }
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    const first = controller.setDemand(subscription, plan, new Set([1]))
+    expect(first.ready).toBeInstanceOf(Promise)
+    if (!(first.ready instanceof Promise)) {
+      throw new Error(`Expected failed demand to be asynchronous`)
+    }
+    await expect(first.ready).rejects.toThrow(`child load failed`)
+
+    shouldReject = false
+    const retry = controller.setDemand(subscription, plan, new Set([1]))
+    expect(retry.changed).toBe(true)
+    expect(loadCount).toBe(2)
+    if (retry.ready instanceof Promise) await retry.ready
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  await finishTemporalCleanup(primaryFailure, [
+    () => controller.clear(),
+    () => subscription.unsubscribe(),
+    () => comments.cleanup(),
+  ])
+}
+
+async function expectRetiredDemandStaysNonfatalAfterReleaseFailure(): Promise<void> {
+  const post = { id: 1, authorId: `selected`, title: `one` }
+  const posts = createMutablePosts([post])
+  let loadCount = 0
+  let allowUnload = false
+  const releaseError = new Error(`child release failed`)
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-retired-release-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    autoIndex: `eager`,
+    defaultIndexType: BasicIndex,
+    sync: {
+      sync: ({ markReady }) => ({
+        loadSubset: () => {
+          loadCount += 1
+          markReady()
+          return true
+        },
+        unloadSubset: () => {
+          if (!allowUnload) throw releaseError
+        },
+      }),
+    },
+  })
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+  // A throwing release is an adapter bug: core reports it uncaught, once,
+  // and records no subset error.
+  const uncaught = captureMicrotaskErrors()
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await live.preload()
+    expect(loadCount).toBe(1)
+    expect(live.status).toBe(`ready`)
+
+    posts.write(`delete`, post)
+    await flushPromises()
+    expect(live.size).toBe(0)
+    expect(live.status).toBe(`ready`)
+    expect(uncaught.errors).toEqual([releaseError])
+    expect(live.utils.lastSubsetError).toBeUndefined()
+
+    posts.write(`insert`, post)
+    await flushPromises()
+    expect(loadCount).toBe(2)
+    expect(live.status).toBe(`ready`)
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  allowUnload = true
+  await finishTemporalCleanup(primaryFailure, [
+    () => live.cleanup(),
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+    () => consoleError.mockRestore(),
+    () => uncaught.restore(),
+  ])
+}
+
+async function expectFailedReplayStopsGatingAfterLastDemandRetires(): Promise<void> {
+  const post = { id: 1, authorId: `selected`, title: `one` }
+  const posts = createMutablePosts([post])
+  const replay = createDeferred<void>()
+  let begin!: () => void
+  let write!: (message: { type: `insert`; value: Comment }) => void
+  let commit!: () => true | Promise<void>
+  let truncate!: () => void
+  let loadCount = 0
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-retired-replay-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    autoIndex: `eager`,
+    defaultIndexType: BasicIndex,
+    sync: {
+      sync: (operations) => {
+        begin = operations.begin
+        write = operations.write
+        commit = operations.commit
+        truncate = operations.truncate
+        operations.markReady()
+        return {
+          loadSubset: () => {
+            loadCount += 1
+            if (loadCount === 1) {
+              begin()
+              write({
+                type: `insert`,
+                value: { id: 10, postId: post.id, body: `old` },
+              })
+              commit()
+              return true
+            }
+            begin()
+            write({
+              type: `insert`,
+              value: { id: 20, postId: post.id, body: `private replacement` },
+            })
+            commit()
+            return replay.promise
+          },
+          unloadSubset: () => {},
+        }
+      },
+    },
+  })
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const publications: Array<Array<number>> = []
+  const subscription = live.subscribeChanges(
+    () => publications.push(live.toArray.map(({ id }) => id)),
+    { includeInitialState: false },
+  )
+  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await live.preload()
+    expect(live.get(post.id)?.comments.map(({ id }) => id)).toEqual([10])
+    publications.length = 0
+
+    begin()
+    truncate()
+    commit()
+    await flushPromises()
+    expect(loadCount).toBe(2)
+
+    replay.reject(new Error(`replacement failed`))
+    await flushPromises()
+    expect(live.get(post.id)?.comments.map(({ id }) => id)).toEqual([10])
+    expect(publications).toEqual([])
+
+    posts.write(`delete`, post)
+    await flushPromises()
+
+    // Once the parent retires the last child demand, its failed replay can no
+    // longer gate unrelated parent changes in the shared graph.
+    expect(live.size).toBe(0)
+    expect(publications).toEqual([[]])
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  replay.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => subscription.unsubscribe(),
+    () => live.cleanup(),
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+    () => consoleError.mockRestore(),
+  ])
+}
+
+async function expectSynchronousEmptyDemandIsReady(): Promise<void> {
+  const posts = createMutablePosts([
+    { id: 1, authorId: `selected`, title: `one` },
+  ])
+  let loadCount = 0
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-empty-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: () => ({
+        loadSubset: () => {
+          loadCount += 1
+          return true
+        },
+      }),
+    },
+  })
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await live.preload()
+    expect(loadCount).toBe(1)
+    expect(live.isReady()).toBe(true)
+    expect(live.get(1)?.comments).toEqual([])
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  await finishTemporalCleanup(primaryFailure, [
+    () => live.cleanup(),
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+  ])
+}
+
+async function expectPartialShrinkRetainsCoverage(): Promise<void> {
+  const firstPost = { id: 1, authorId: `selected`, title: `one` }
+  const secondPost = { id: 2, authorId: `selected`, title: `two` }
+  const posts = createMutablePosts([firstPost, secondPost])
+  const initialLoad = createDeferred<void>()
+  const installed = new Map<number, Comment>()
+  let begin: () => void
+  let write: (change: { type: `insert` | `delete`; value: Comment }) => void
+  let commit: () => void
+  let markReady: () => void
+  let deduped: DeduplicatedLoadSubset
+  const unloads: Array<Array<number>> = []
+  const comments = createCollection<Comment>({
+    id: nextCollectionId(`temporal-shrink-comments`),
+    getKey: (comment) => comment.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: (methods) => {
+        ;({ begin, write, commit, markReady } = methods)
+        deduped = new DeduplicatedLoadSubset({
+          loadSubset: (options) =>
+            initialLoad.promise.then(() => {
+              const keys = correlationKeys([options], `postId`)
+              begin()
+              for (const postId of keys) {
+                const comment = { id: postId * 100, postId, body: `${postId}` }
+                installed.set(postId, comment)
+                write({ type: `insert`, value: comment })
+              }
+              commit()
+              markReady()
+            }),
+        })
+        return {
+          loadSubset: (options) => deduped.loadSubset(options),
+          unloadSubset: (options) => {
+            const keys = correlationKeys([options], `postId`)
+            unloads.push(keys)
+            begin()
+            for (const postId of keys) {
+              const comment = installed.get(postId)
+              if (comment) write({ type: `delete`, value: comment })
+              installed.delete(postId)
+            }
+            commit()
+          },
+        }
+      },
+    },
+  })
+  const live = createPostsWithCommentsLive(posts.collection, comments)
+  const preload = live.preload()
+
+  let primaryFailure: CapturedFailure | undefined
+  try {
+    await flushPromises()
+    initialLoad.resolve()
+    await preload
+    expect(live.get(1)?.comments).toHaveLength(1)
+
+    posts.write(`delete`, secondPost)
+    await flushPromises()
+    expect(live.get(1)?.comments).toHaveLength(1)
+    expect(unloads).toEqual([])
+
+    posts.write(`delete`, firstPost)
+    await flushPromises()
+    expect(unloads).toEqual([[1, 2]])
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  initialLoad.resolve()
+  await finishTemporalCleanup(primaryFailure, [
+    () => live.cleanup(),
+    () => Promise.allSettled([preload]),
+    () => posts.collection.cleanup(),
+    () => comments.cleanup(),
+  ])
+}
+
+type FastPathEvent = {
+  phase: `fast` | `late`
+  keys: Array<number>
+}
+
+// Model C: progressive rows can publish while the acquisition promise is pending.
+// The load starts inside the initial fast-path phase; initial-query readiness
+// waits for fulfillment.
+type ProgressiveObservation = {
+  events: Array<FastPathEvent>
+  ready: boolean
+  preloadSettled: boolean
+}
+
+type ProgressiveStep = `release-parent`
+
+type ProgressiveContext = {
+  users: Collection<User> | undefined
+  posts: Collection<ProgressivePost>
+  live: ReturnType<typeof createLiveQueryCollection>
+  events: Array<FastPathEvent>
+  closeWindow: () => void
+  releaseParent: (() => void) | undefined
+  startReached: Deferred<void>
+  parentDelivery: Promise<void> | undefined
+  preload: PreloadState
+  expected: ProgressiveObservation
+}
+
+function createProgressivePosts(): {
+  collection: Collection<ProgressivePost>
+  events: Array<FastPathEvent>
+  closeWindow: () => void
+  syncStarted: Deferred<void>
+} {
+  let windowOpen = true
+  const events: Array<FastPathEvent> = []
+  const syncStarted = createDeferred<void>()
+  const collection = createCollection<ProgressivePost>({
+    id: nextCollectionId(`temporal-progressive-posts`),
+    getKey: (post) => post.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, commit, markReady }) => {
+        syncStarted.resolve()
+        begin()
+        commit()
+        markReady()
+        return {
+          loadSubset: (options) => {
+            events.push({
+              phase: windowOpen ? `fast` : `late`,
+              keys: correlationKeys([options], `userId`),
+            })
+            return Promise.resolve()
+          },
+        }
+      },
+    },
+  })
+  return {
+    collection,
+    events,
+    syncStarted,
+    closeWindow: () => {
+      windowOpen = false
+    },
+  }
+}
+
+function createGatedUsers(): {
+  collection: Collection<User>
+  release: () => void
+  started: Deferred<void>
+  delivery: Promise<void>
+} {
+  const gate = createDeferred<void>()
+  const started = createDeferred<void>()
+  const delivery = createDeferred<void>()
+  const collection = createCollection<User>({
+    id: nextCollectionId(`temporal-users`),
+    getKey: (user) => user.id,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        started.resolve()
+        gate.promise.then(
+          () => {
+            begin()
+            write({ type: `insert`, value: { id: 2, name: `selected` } })
+            commit()
+            markReady()
+            delivery.resolve()
+          },
+          (error) => delivery.reject(error),
+        )
+      },
+    },
+  })
+  return {
+    collection,
+    release: () => gate.resolve(),
+    started,
+    delivery: delivery.promise,
+  }
+}
+
+function createProgressiveDriver(
+  mode: `direct` | `nested`,
+): TraceDriver<ProgressiveStep, ProgressiveContext> {
+  return {
+    setup: () => {
+      const {
+        collection: posts,
+        events,
+        closeWindow,
+        syncStarted,
+      } = createProgressivePosts()
+
+      if (mode === `direct`) {
+        const live = createLiveQueryCollection((q) =>
+          q.from({ post: posts }).where(({ post }) => eq(post.userId, 2)),
+        )
+        return {
+          users: undefined,
+          posts,
+          live,
+          events,
+          closeWindow,
+          releaseParent: undefined,
+          startReached: syncStarted,
+          parentDelivery: undefined,
+          preload: { preloadSettled: false },
+          expected: {
+            events: [{ phase: `fast`, keys: [2] }],
+            ready: true,
+            preloadSettled: true,
+          },
+        }
+      }
+
+      const {
+        collection: users,
+        release,
+        started,
+        delivery,
+      } = createGatedUsers()
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ user: users })
+          .where(({ user }) => eq(user.id, 2))
+          .select(({ user }) => ({
+            id: user.id,
+            posts: toArray(
+              q
+                .from({ post: posts })
+                .where(({ post }) => eq(post.userId, user.id)),
+            ),
+          })),
+      )
+      return {
+        users,
+        posts,
+        live,
+        events,
+        closeWindow,
+        releaseParent: release,
+        startReached: started,
+        parentDelivery: delivery,
+        preload: { preloadSettled: false },
+        expected: {
+          events: [{ phase: `fast`, keys: [2] }],
+          ready: false,
+          preloadSettled: false,
+        },
+      }
+    },
+    start: async (context) => {
+      const preload = startPreload(context.live, context.preload)
+      await context.startReached.promise
+      context.closeWindow()
+      if (mode === `direct`) await preload
+    },
+    apply: async (_step, context) => {
+      context.releaseParent?.()
+      context.expected = {
+        events: [{ phase: `fast`, keys: [2] }],
+        ready: true,
+        preloadSettled: true,
+      }
+      await finishPreload(context.preload)
+    },
+    cleanup: async ({
+      users,
+      posts,
+      live,
+      releaseParent,
+      parentDelivery,
+      preload,
+    }) => {
+      releaseParent?.()
+      await finishTemporalCleanup(undefined, [
+        () => parentDelivery,
+        () => live.cleanup(),
+        () => finishPreload(preload),
+        () => users?.cleanup(),
+        () => posts.cleanup(),
+      ])
+    },
+  }
+}
+
+const progressiveProjection: TraceProjection<
+  ProgressiveContext,
+  ProgressiveObservation
+> = {
+  observe: ({ events, live, preload }) => ({
+    events: [...events],
+    ready: live.isReady(),
+    preloadSettled: preload.preloadSettled,
+  }),
+  recompute: ({ expected }) => expected,
+  assertEqual: (observed, expected) => {
+    expect(observed).toEqual(expected)
+    return undefined
+  },
+}
+
+async function expectProgressiveTraceMatches(
+  mode: `direct` | `nested`,
+): Promise<void> {
+  await runTrace({
+    steps: mode === `nested` ? [`release-parent`] : [],
+    driver: createProgressiveDriver(mode),
+    projection: progressiveProjection,
+  })
+}
+
+describe(`includes temporal oracle`, () => {
+  it(
+    `retired child demand does not block initial-query readiness`,
+    expectObsoleteDemandDoesNotBlockReadiness,
+  )
+
+  it(
+    `an obsolete child acquisition cannot publish after the route is reactivated`,
+    expectObsoleteAcquisitionCannotPublishAfterReactivation,
+  )
+
+  it(
+    `retained demand with a pending acquisition blocks initial-query readiness after demand expands`,
+    expectRetainedDemandBlocksReadiness,
+  )
+
+  it(`consolidates churn after apply without reloading monotonic growth`, () =>
+    expectDemandChurnPreservesCoverage(`success`))
+
+  it(`failed churn replacement retains coverage and retries its union`, () =>
+    expectDemandChurnPreservesCoverage(`failure`))
+
+  it(
+    `failed churn replacement keeps established child rows visible`,
+    expectFailedConsolidationKeepsVisibleRows,
+  )
+
+  it(`obsolete churn replacement cannot retire established coverage`, () =>
+    expectDemandChurnPreservesCoverage(`obsolete`))
+
+  it(
+    `crashes before replacing coverage when snapshot admission contradicts its result`,
+    expectContradictoryReplacementStartCrashes,
+  )
+
+  it(
+    `an obsolete acquisition cannot complete preload for reactivated demand`,
+    expectObsoleteAcquisitionCannotCompleteCurrentPreload,
+  )
+
+  it(`rejected demand enters error`, expectRejectedDemandEntersError)
+
+  it(
+    `failed demand retries the same coverage`,
+    expectFailedDemandRetriesSameCoverage,
+  )
+
+  it(
+    `failed release retires an empty live-query demand, reported uncaught, without poisoning reentry`,
+    expectRetiredDemandStaysNonfatalAfterReleaseFailure,
+  )
+
+  it(
+    `failed replay stops gating after its last demand retires`,
+    expectFailedReplayStopsGatingAfterLastDemandRetires,
+  )
+
+  it(
+    `a synchronous empty demand can establish ready coverage`,
+    expectSynchronousEmptyDemandIsReady,
+  )
+
+  it(
+    `partially shrinking demand retains established coverage`,
+    expectPartialShrinkRetainsCoverage,
+  )
+
+  it(`loads a direct progressive subset inside the fast-path window`, async () => {
+    await expectProgressiveTraceMatches(`direct`)
+  })
+
+  it(`a nested progressive subset loads inside the fast-path window`, () =>
+    expectProgressiveTraceMatches(`nested`))
+})
diff --git a/packages/db/tests/query/includes-work-counter-oracle.test.ts b/packages/db/tests/query/includes-work-counter-oracle.test.ts
index 52ac609ede..375258f484 100644
--- a/packages/db/tests/query/includes-work-counter-oracle.test.ts
+++ b/packages/db/tests/query/includes-work-counter-oracle.test.ts
@@ -1,5 +1,9 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { beforeAll, describe, expect, it } from 'vitest'
+import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import {
   createLiveQueryCollection,
   eq,
@@ -8,17 +12,22 @@ import {
   materialize,
   toArray,
 } from '../../src/query/index.js'
-import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
-import { createCollection } from '../../src/collection/index.js'
-import { BTreeIndex } from '../../src/indexes/btree-index.js'
-import { localOnlyCollectionOptions } from '../../src/local-only.js'
 import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
 import {
-  SetWindowFindOneLimitError,
-  SetWindowRequiresOrderByError,
-} from '../../src/errors.js'
+  countSourceWork,
+  createSourceCollection,
+  expectSourceWorkBound,
+  expectedResult,
+  noFillers,
+  observeWork,
+  runCleanups,
+} from './includes-work-counter-support.js'
 import type { Collection } from '../../src/collection/index.js'
 import type { LoadSubsetOptions } from '../../src/types.js'
+import type {
+  SourceWork,
+  WorkObservation,
+} from './includes-work-counter-support.js'
 
 /**
  * # Does unrelated source size increase correlated include work?
@@ -53,359 +62,6 @@ import type { LoadSubsetOptions } from '../../src/types.js'
  */
 
 let nextCollectionId = 0
-
-type TermRow = { id: string; text: string }
-type MeaningRow = { id: string; termId: string }
-type GroupRow = { id: string; meaningId: string }
-type LinkRow = { id: string; groupId: string; targetId: string }
-
-type SourceRows = {
-  terms: Array<TermRow>
-  meanings: Array<MeaningRow>
-  groups: Array<GroupRow>
-  links: Array<LinkRow>
-}
-
-type FillerCounts = {
-  terms: number
-  meanings: number
-  groups: number
-  links: number
-}
-
-type WorkScenario = {
-  filler: FillerCounts
-  joinTargets: boolean
-}
-
-type WorkCount = {
-  delivered: number
-  examined: number
-}
-
-type SourceWork = {
-  terms: WorkCount
-  meanings: WorkCount
-  groups: WorkCount
-  links: WorkCount
-}
-
-type LinkObservation =
-  { id: string; text: string } | { id: string; targetId: string }
-
-type WorkObservation = {
-  result: Array<{
-    id: string
-    meanings: Array<{
-      id: string
-      groups: Array<{
-        id: string
-        links: Array<LinkObservation>
-      }>
-    }>
-  }>
-  sourceWork: SourceWork
-}
-
-async function runCleanups(
-  cleanups: ReadonlyArray<() => void | Promise<void>>,
-  primary?: { error: unknown },
-): Promise<void> {
-  const results = await Promise.allSettled(
-    cleanups.map(async (cleanup) => cleanup()),
-  )
-  const failures = results.flatMap((result) =>
-    result.status === `rejected` ? [result.reason as unknown] : [],
-  )
-  if (failures.length > 0 && primary) {
-    throw new AggregateError(
-      [primary.error, ...failures],
-      `Oracle and cleanup failed`,
-      { cause: primary.error },
-    )
-  }
-  if (failures.length === 1) throw failures[0]
-  if (failures.length > 1) {
-    throw new AggregateError(failures, `Oracle cleanup failed`)
-  }
-}
-
-const noFillers: FillerCounts = {
-  terms: 0,
-  meanings: 0,
-  groups: 0,
-  links: 0,
-}
-
-function createSourceCollection<T extends { id: string }>(
-  name: string,
-  initialData: Array<T>,
-) {
-  return createCollection(
-    localOnlyCollectionOptions<T>({
-      id: `${name}-${nextCollectionId++}`,
-      getKey: (row) => row.id,
-      initialData,
-    }),
-  )
-}
-
-// Count both sides of the source boundary. Delivered rows show what enters the
-// dataflow graph. entries() visits capture scans and get() calls capture keyed
-// reads, so examined work cannot hide behind a filter.
-function countSourceWork<T extends object>(collection: Collection<T>) {
-  let deliveredRows = 0
-  let examinedRows = 0
-  let readingEntry = false
-  const originalSubscribeChanges = collection.subscribeChanges.bind(collection)
-  const originalEntries = collection.entries.bind(collection)
-  const originalGet = collection.get.bind(collection)
-
-  collection.subscribeChanges = (callback, options) => {
-    return originalSubscribeChanges((changes) => {
-      deliveredRows += changes.length
-      callback(changes)
-    }, options)
-  }
-
-  collection.get = (key) => {
-    if (!readingEntry) examinedRows++
-    return originalGet(key)
-  }
-
-  collection.entries = function* () {
-    const entries = originalEntries()
-    const readNext = () => {
-      readingEntry = true
-      try {
-        return entries.next()
-      } finally {
-        readingEntry = false
-      }
-    }
-
-    for (let next = readNext(); !next.done; next = readNext()) {
-      examinedRows++
-      yield next.value
-    }
-  }
-
-  return (): WorkCount => ({ delivered: deliveredRows, examined: examinedRows })
-}
-
-function createFixtureRows(filler: FillerCounts): SourceRows {
-  return {
-    terms: [
-      { id: `term-0`, text: `selected term` },
-      { id: `term-1`, text: `first target` },
-      { id: `term-2`, text: `second target` },
-      ...Array.from({ length: filler.terms }, (_, index) => ({
-        id: `term-filler-${index}`,
-        text: `irrelevant target ${index}`,
-      })),
-    ],
-    meanings: [
-      { id: `meaning-0`, termId: `term-0` },
-      ...Array.from({ length: filler.meanings }, (_, index) => ({
-        id: `meaning-filler-${index}`,
-        termId: `term-never-selected`,
-      })),
-    ],
-    groups: [
-      { id: `group-0`, meaningId: `meaning-0` },
-      ...Array.from({ length: filler.groups }, (_, index) => ({
-        id: `group-filler-${index}`,
-        meaningId: `meaning-never-selected`,
-      })),
-    ],
-    links: [
-      // Keep filler links on one existing target key. Only the left-side input
-      // grows. The term-filler control probes right-side input growth separately.
-      { id: `link-0`, groupId: `group-0`, targetId: `term-1` },
-      {
-        id: `link-1`,
-        groupId: `group-0`,
-        targetId: `term-2`,
-      },
-      ...Array.from({ length: filler.links }, (_, index) => ({
-        id: `link-filler-${index}`,
-        groupId: `group-never-selected`,
-        targetId: `term-1`,
-      })),
-    ],
-  }
-}
-
-function observeLink(link: LinkObservation): LinkObservation {
-  if (`text` in link) return { id: link.id, text: link.text }
-  if (`targetId` in link) return { id: link.id, targetId: link.targetId }
-
-  const exhaustive: never = link
-  return exhaustive
-}
-
-function observeResult(
-  roots: ReadonlyArray<WorkObservation[`result`][number]>,
-): WorkObservation[`result`] {
-  return roots.map((root) => ({
-    id: root.id,
-    meanings: root.meanings.map((meaning) => ({
-      id: meaning.id,
-      groups: meaning.groups.map((group) => ({
-        id: group.id,
-        links: group.links.map(observeLink),
-      })),
-    })),
-  }))
-}
-
-async function observeWork({
-  filler,
-  joinTargets,
-}: WorkScenario): Promise<WorkObservation> {
-  const rows = createFixtureRows(filler)
-  const sources = {
-    terms: createSourceCollection(`work-terms`, rows.terms),
-    meanings: createSourceCollection(`work-meanings`, rows.meanings),
-    groups: createSourceCollection(`work-groups`, rows.groups),
-    links: createSourceCollection(`work-links`, rows.links),
-  }
-  let cleanupLive: (() => Promise<void>) | undefined
-  let primary: { error: unknown } | undefined
-
-  try {
-    await Promise.all(Object.values(sources).map((source) => source.preload()))
-
-    // Match the reported boundary: load first, then add a B-tree index on each
-    // correlation and join column before constructing the live query.
-    sources.terms.createIndex((row) => row.id, { indexType: BTreeIndex })
-    sources.meanings.createIndex((row) => row.termId, {
-      indexType: BTreeIndex,
-    })
-    sources.groups.createIndex((row) => row.meaningId, {
-      indexType: BTreeIndex,
-    })
-    sources.links.createIndex((row) => row.groupId, { indexType: BTreeIndex })
-    sources.links.createIndex((row) => row.targetId, {
-      indexType: BTreeIndex,
-    })
-
-    const counters = {
-      terms: countSourceWork(sources.terms),
-      meanings: countSourceWork(sources.meanings),
-      groups: countSourceWork(sources.groups),
-      links: countSourceWork(sources.links),
-    }
-
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ term: sources.terms })
-        .where(({ term }) => eq(term.id, `term-0`))
-        .select(({ term }) => ({
-          id: term.id,
-          meanings: materialize(
-            q
-              .from({ meaning: sources.meanings })
-              .where(({ meaning }) => eq(meaning.termId, term.id))
-              .select(({ meaning }) => ({
-                id: meaning.id,
-                groups: materialize(
-                  q
-                    .from({ group: sources.groups })
-                    .where(({ group }) => eq(group.meaningId, meaning.id))
-                    .select(({ group }) => {
-                      const selectedLinks = q
-                        .from({ link: sources.links })
-                        .where(({ link }) => eq(link.groupId, group.id))
-
-                      return {
-                        id: group.id,
-                        links: joinTargets
-                          ? materialize(
-                              selectedLinks
-                                .innerJoin(
-                                  { target: sources.terms },
-                                  ({ link, target }) =>
-                                    eq(link.targetId, target.id),
-                                )
-                                .select(({ link, target }) => ({
-                                  id: link.id,
-                                  text: target.text,
-                                })),
-                            )
-                          : materialize(
-                              selectedLinks.select(({ link }) => ({
-                                id: link.id,
-                                targetId: link.targetId,
-                              })),
-                            ),
-                      }
-                    }),
-                ),
-              })),
-          ),
-        })),
-    )
-    cleanupLive = () => live.cleanup()
-
-    await live.preload()
-    return {
-      result: observeResult(live.toArray),
-      sourceWork: {
-        terms: counters.terms(),
-        meanings: counters.meanings(),
-        groups: counters.groups(),
-        links: counters.links(),
-      },
-    }
-  } catch (error) {
-    primary = { error }
-    throw error
-  } finally {
-    await runCleanups(
-      [
-        async () => cleanupLive?.(),
-        ...Object.values(sources).map((source) => async () => source.cleanup()),
-      ],
-      primary,
-    )
-  }
-}
-
-function expectedResult({
-  joinTargets,
-}: Pick<WorkScenario, 'joinTargets'>): WorkObservation[`result`] {
-  return [
-    {
-      id: `term-0`,
-      meanings: [
-        {
-          id: `meaning-0`,
-          groups: [
-            {
-              id: `group-0`,
-              links: [
-                joinTargets
-                  ? { id: `link-0`, text: `first target` }
-                  : { id: `link-0`, targetId: `term-1` },
-                joinTargets
-                  ? {
-                      id: `link-1`,
-                      text: `second target`,
-                    }
-                  : {
-                      id: `link-1`,
-                      targetId: `term-2`,
-                    },
-              ],
-            },
-          ],
-        },
-      ],
-    },
-  ]
-}
-
 const joinedBaselineWork: SourceWork = {
   terms: { delivered: 3, examined: 3 },
   meanings: { delivered: 1, examined: 1 },
@@ -423,10 +79,6 @@ const joinFreeBaselineWork: SourceWork = {
 let joinedBaselineObservation: WorkObservation
 let joinFreeBaselineObservation: WorkObservation
 
-function expectSourceWorkBound(actual: SourceWork, expected: SourceWork): void {
-  expect(actual).toEqual(expected)
-}
-
 async function expectCorrelatedJoinWorkBound(
   fillerCount: number,
 ): Promise<void> {
@@ -497,50 +149,6 @@ function campaigns(fixedSeed: number, property: string, baseRuns = 6) {
 }
 
 describe(`includes deterministic work-counter oracle`, () => {
-  it(`preserves the primary failure and every cleanup failure`, async () => {
-    const primary = new Error(`source preload failed`)
-    const firstCleanup = new Error(`live query cleanup failed`)
-    const secondCleanup = new Error(`source cleanup failed`)
-    const attempted: Array<string> = []
-
-    await expect(
-      runCleanups(
-        [
-          () => {
-            attempted.push(`live`)
-            throw firstCleanup
-          },
-          () => {
-            attempted.push(`source`)
-            throw secondCleanup
-          },
-        ],
-        { error: primary },
-      ),
-    ).rejects.toMatchObject({
-      cause: primary,
-      errors: [primary, firstCleanup, secondCleanup],
-    })
-    expect(attempted).toEqual([`live`, `source`])
-  })
-
-  it.each([true, false])(
-    `retains and rejects extra roots with joinTargets=%s`,
-    (joinTargets) => {
-      const expected = expectedResult({ joinTargets })
-      expect(observeResult(expected)).toEqual(expected)
-      const extra = { id: `term-extra`, meanings: [] }
-      const faulty = [...expected, extra]
-      // The old first-root capture erases this violation.
-      expect(observeResult(faulty.slice(0, 1))).toEqual(expected)
-      const observed = observeResult(faulty)
-      expect(observed).toEqual(faulty)
-      expect(() => expect(observed).toEqual(expected)).toThrow()
-      expect(observeResult([])).toEqual([])
-      expect(() => expect(observeResult([])).toEqual(expected)).toThrow()
-    },
-  )
-
   beforeAll(async () => {
     const [joinedBaseline, joinFreeBaseline] = await Promise.all([
       observeWork({ filler: noFillers, joinTargets: true }),
@@ -550,22 +158,6 @@ describe(`includes deterministic work-counter oracle`, () => {
     joinFreeBaselineObservation = joinFreeBaseline
   })
 
-  it(`rejects extra source reads at the preload checkpoint`, () => {
-    const baseline = joinedBaselineObservation
-    const faultyWork: SourceWork = {
-      ...baseline.sourceWork,
-      links: {
-        ...baseline.sourceWork.links,
-        examined: baseline.sourceWork.links.examined + 1,
-      },
-    }
-
-    expect(baseline.result).toEqual(expectedResult({ joinTargets: true }))
-    expect(() =>
-      expectSourceWorkBound(faultyWork, baseline.sourceWork),
-    ).toThrow()
-  })
-
   it.each([1, 2, 3])(
     `pins the work bound at the small filler boundary (%i)`,
     expectCorrelatedJoinWorkBound,
@@ -1446,6 +1038,21 @@ async function checkWindowedIncludeWork(testCase: WindowCase): Promise<number> {
   }
 }
 
+// The parts this file declares. The windowed check runs each history through
+// the window model and compares the shown rows with it. The three metamorphic
+// checks compare each scaled fixture with its minimal baseline run. The grammar
+// is the windowed history generator, which the reconstruction test samples.
+declareOracle({
+  check: [
+    checkWindowedIncludeWork,
+    expectCorrelatedJoinWorkBound,
+    expectJoinTargetWorkBound,
+    expectJoinFreeWorkBound,
+  ],
+  model: [windowUnits, modelKids],
+  grammar: [windowCase],
+})
+
 // Enough runs that each dimension appears at the default multiplier; the
 // reconstruction check below counts them.
 const WINDOW_RUNS = 60
@@ -1540,41 +1147,6 @@ describe(`includes work under an ordered parent window`, () => {
       offset: 5,
     }))
 
-  // An include child's orderBy gives the parent no window to move, so an
-  // unordered parent rejects setWindow instead of moving the child windows.
-  it(`rejects setWindow on an unordered parent with an ordered child`, async () => {
-    const parentSource = createSourceCollection(`unordered-parents`, [
-      { id: `parent-0`, group: `group-0` },
-    ])
-    const childSource = createSourceCollection(`unordered-children`, [
-      { id: `child-0`, group: `group-0`, n: 0 },
-    ])
-    const live = createLiveQueryCollection((q) =>
-      q.from({ parent: parentSource }).select(({ parent }) => ({
-        id: parent.id,
-        kids: toArray(
-          q
-            .from({ child: childSource })
-            .where(({ child }) => eq(child.group, parent.group))
-            .orderBy(({ child }) => child.n)
-            .limit(1),
-        ),
-      })),
-    )
-    try {
-      await live.preload()
-      expect(() => live.utils.setWindow({ offset: 0, limit: 1 })).toThrow(
-        SetWindowRequiresOrderByError,
-      )
-    } finally {
-      await runCleanups([
-        () => live.cleanup(),
-        () => parentSource.cleanup(),
-        () => childSource.cleanup(),
-      ])
-    }
-  })
-
   // A window requested before start can drop rows a static filter names,
   // so static child demand must not load their children.
   it(`creates no static child demand under a window requested before start`, () =>
@@ -1824,301 +1396,3 @@ describe(`includes work under an ordered parent window`, () => {
     )
   }
 })
-
-/**
- * # Static demand and window ownership
- *
- * A static parent filter that names one row of a `findOne` with no `offset`
- * leaves the window nothing to drop, so the include may create that child's
- * demand at once: a detail page starts its child acquisition attempt beside
- * its parent acquisition attempt instead of after the parent's rows arrive.
- * Each test's `loadSubset` handler stands in for both the sync adapter and the
- * provider, and records each acquisition attempt in order. Only the query's
- * own window answers `setWindow`; a window inside a `from` or a joined
- * subquery never does.
- */
-describe(`static include demand and setWindow ownership`, () => {
-  // A window requested before start at offset 0 drops nothing, so it keeps
-  // the static demand.
-  it.each([null, { offset: 0 }] as const)(
-    `starts a findOne detail page's child load beside its parent load (window before start: %o)`,
-    async (startWindow) => {
-      const calls: Array<string> = []
-      let releaseParent!: () => void
-      const parentHeld = new Promise<void>((resolve) => {
-        releaseParent = resolve
-      })
-      const parents = createCollection<{ id: string }, string>({
-        id: `detail-parents-${nextCollectionId++}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                calls.push(`parent`)
-                return parentHeld.then(() => {
-                  begin()
-                  write({ type: `insert`, value: { id: `parent-1` } })
-                  commit()
-                })
-              },
-            }
-          },
-        },
-      })
-      const children = createCollection<
-        { id: string; parentId: string },
-        string
-      >({
-        id: `detail-children-${nextCollectionId++}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                calls.push(`child`)
-                begin()
-                write({
-                  type: `insert`,
-                  value: { id: `child-1`, parentId: `parent-1` },
-                })
-                commit()
-                return true
-              },
-            }
-          },
-        },
-      })
-      const live = createLiveQueryCollection({
-        startSync: false,
-        query: (q) =>
-          q
-            .from({ parent: parents })
-            .where(({ parent }) => eq(parent.id, `parent-1`))
-            .select(({ parent }) => ({
-              id: parent.id,
-              kids: toArray(
-                q
-                  .from({ child: children })
-                  .where(({ child }) => eq(child.parentId, parent.id))
-                  .select(({ child }) => ({ id: child.id })),
-              ),
-            }))
-            .findOne(),
-      })
-      if (startWindow) {
-        const settled = live.utils.setWindow(startWindow)
-        if (settled !== true) void settled.catch(() => {})
-      }
-      try {
-        const ready = live.toArrayWhenReady()
-        await new Promise((resolve) => setTimeout(resolve, 0))
-        // The child acquisition attempt has started while the parent's is held.
-        expect(calls).toEqual([`parent`, `child`])
-        releaseParent()
-        await ready
-        expect(
-          (
-            live.toArray as unknown as Array<{
-              id: string
-              kids: Array<{ id: string }>
-            }>
-          ).map((row) => ({ id: row.id, kids: row.kids.map((kid) => kid.id) })),
-        ).toEqual([{ id: `parent-1`, kids: [`child-1`] }])
-        expect(calls).toEqual([`parent`, `child`])
-      } finally {
-        releaseParent()
-        await runCleanups([
-          () => live.cleanup(),
-          () => parents.cleanup(),
-          () => children.cleanup(),
-        ])
-      }
-    },
-  )
-
-  // A findOne with limit 0 shows no row, so its named correlation value's child must
-  // not load.
-  it(`starts no child acquisition for a findOne with limit 0`, async () => {
-    const calls: Array<string> = []
-    const onDemand = <T extends { id: string }>(name: string, rows: Array<T>) =>
-      createCollection<T, string>({
-        id: `limit-zero-${name}-${nextCollectionId++}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                calls.push(name)
-                begin()
-                for (const value of rows) write({ type: `insert`, value })
-                commit()
-                return true
-              },
-            }
-          },
-        },
-      })
-    const parents = onDemand(`parent`, [{ id: `parent-1` }])
-    const children = onDemand(`child`, [
-      { id: `child-1`, parentId: `parent-1` },
-    ])
-    const live = createLiveQueryCollection({
-      startSync: true,
-      query: (q) =>
-        q
-          .from({ parent: parents })
-          .where(({ parent }) => eq(parent.id, `parent-1`))
-          .select(({ parent }) => ({
-            id: parent.id,
-            kids: toArray(
-              q
-                .from({ child: children })
-                .where(({ child }) => eq(child.parentId, parent.id)),
-            ),
-          }))
-          .orderBy(({ parent }) => parent.id)
-          .limit(0)
-          .findOne(),
-    })
-    try {
-      await live.toArrayWhenReady()
-      expect(calls).not.toContain(`child`)
-      expect(live.toArray).toEqual([])
-    } finally {
-      await runCleanups([
-        () => live.cleanup(),
-        () => parents.cleanup(),
-        () => children.cleanup(),
-      ])
-    }
-  })
-
-  // A findOne keeps its compiled limit, and setWindow throws for any other
-  // limit. An ordered findOne has a movable window; an unordered one is a
-  // fixed one-row result that rejects offset moves.
-  it(`keeps a findOne's compiled limit and moves only an ordered findOne`, async () => {
-    const rows = createSourceCollection(
-      `find-one-window-rows`,
-      Array.from({ length: 4 }, (_, rank) => ({ id: `row-${rank}`, rank })),
-    )
-    const one = createLiveQueryCollection((q) =>
-      q
-        .from({ row: rows })
-        .orderBy(({ row }) => row.rank)
-        .findOne(),
-    )
-    const none = createLiveQueryCollection((q) =>
-      q
-        .from({ row: rows })
-        .orderBy(({ row }) => row.rank)
-        .limit(0)
-        .findOne(),
-    )
-    const unordered = createLiveQueryCollection((q) =>
-      q.from({ row: rows }).findOne(),
-    )
-    try {
-      await Promise.all([one.preload(), none.preload(), unordered.preload()])
-      expect(() => one.utils.setWindow({ offset: 0, limit: 3 })).toThrow(
-        SetWindowFindOneLimitError,
-      )
-      for (const window of [{ offset: 2 }, { offset: 1, limit: 1 }]) {
-        const settled = one.utils.setWindow(window)
-        if (settled !== true) await settled
-        expect(one.toArray.map((row) => row.id)).toEqual([
-          `row-${window.offset}`,
-        ])
-        expect(one.utils.getWindow()).toEqual({
-          offset: window.offset,
-          limit: 1,
-        })
-      }
-      const moved = none.utils.setWindow({ offset: 1 })
-      if (moved !== true) await moved
-      expect(none.toArray).toEqual([])
-      expect(none.utils.getWindow()).toEqual({ offset: 1, limit: 0 })
-      expect(() => none.utils.setWindow({ limit: 1 })).toThrow(
-        SetWindowFindOneLimitError,
-      )
-      // A window is an ordered view: an unordered findOne keeps offset 0.
-      expect(() => unordered.utils.setWindow({ offset: 1 })).toThrow(
-        SetWindowRequiresOrderByError,
-      )
-      expect(unordered.utils.setWindow({ offset: 0 })).toBe(true)
-      expect(unordered.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
-    } finally {
-      await runCleanups([
-        () => one.cleanup(),
-        () => none.cleanup(),
-        () => unordered.cleanup(),
-        () => rows.cleanup(),
-      ])
-    }
-  })
-
-  it.each([`from`, `join`] as const)(
-    `rejects setWindow when only a %s subquery has a window`,
-    async (placement) => {
-      const rows = createSourceCollection(`owner-rows`, [
-        { id: `row-0`, rank: 0 },
-        { id: `row-1`, rank: 1 },
-        { id: `row-2`, rank: 2 },
-      ])
-      const live = createLiveQueryCollection((q) => {
-        const page = q
-          .from({ row: rows })
-          .orderBy(({ row }) => row.rank)
-          .limit(2)
-        return placement === `from`
-          ? q.from({ page })
-          : q
-              .from({ row: rows })
-              .join({ page }, ({ row, page: paged }) => eq(row.id, paged.id))
-      })
-      try {
-        await live.preload()
-        expect(() => live.utils.setWindow({ offset: 1, limit: 2 })).toThrow(
-          SetWindowRequiresOrderByError,
-        )
-      } finally {
-        await runCleanups([() => live.cleanup(), () => rows.cleanup()])
-      }
-    },
-  )
-
-  it(`moves the outer window, not a from subquery's`, async () => {
-    const rows = createSourceCollection(
-      `outer-owner-rows`,
-      Array.from({ length: 6 }, (_, rank) => ({ id: `row-${rank}`, rank })),
-    )
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({
-          page: q
-            .from({ row: rows })
-            .orderBy(({ row }) => row.rank)
-            .limit(4),
-        })
-        .orderBy(({ page }) => page.rank)
-        .limit(2),
-    )
-    try {
-      await live.preload()
-      const settled = live.utils.setWindow({ offset: 2, limit: 2 })
-      if (settled !== true) await settled
-      expect(live.toArray.map((row) => row.id)).toEqual([`row-2`, `row-3`])
-    } finally {
-      await runCleanups([() => live.cleanup(), () => rows.cleanup()])
-    }
-  })
-})
diff --git a/packages/db/tests/query/includes-work-counter-support.ts b/packages/db/tests/query/includes-work-counter-support.ts
new file mode 100644
index 0000000000..7cb30a5172
--- /dev/null
+++ b/packages/db/tests/query/includes-work-counter-support.ts
@@ -0,0 +1,379 @@
+import { expect } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import { localOnlyCollectionOptions } from '../../src/local-only.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  materialize,
+} from '../../src/query/index.js'
+import type { Collection } from '../../src/collection/index.js'
+
+/**
+ * Shared fixtures and observers for the includes work-counter oracle. The
+ * oracle file, includes-work-counter-oracle.test.ts, owns the work law and
+ * declares its checks and model. This module only builds the production
+ * observations and the reference expectations that those checks compare, so
+ * its own exports reach nothing by themselves.
+ */
+
+let nextCollectionId = 0
+
+type TermRow = { id: string; text: string }
+type MeaningRow = { id: string; termId: string }
+type GroupRow = { id: string; meaningId: string }
+type LinkRow = { id: string; groupId: string; targetId: string }
+
+type SourceRows = {
+  terms: Array<TermRow>
+  meanings: Array<MeaningRow>
+  groups: Array<GroupRow>
+  links: Array<LinkRow>
+}
+
+type FillerCounts = {
+  terms: number
+  meanings: number
+  groups: number
+  links: number
+}
+
+type WorkScenario = {
+  filler: FillerCounts
+  joinTargets: boolean
+}
+
+type WorkCount = {
+  delivered: number
+  examined: number
+}
+
+export type SourceWork = {
+  terms: WorkCount
+  meanings: WorkCount
+  groups: WorkCount
+  links: WorkCount
+}
+
+type LinkObservation =
+  { id: string; text: string } | { id: string; targetId: string }
+
+export type WorkObservation = {
+  result: Array<{
+    id: string
+    meanings: Array<{
+      id: string
+      groups: Array<{
+        id: string
+        links: Array<LinkObservation>
+      }>
+    }>
+  }>
+  sourceWork: SourceWork
+}
+
+export async function runCleanups(
+  cleanups: ReadonlyArray<() => void | Promise<void>>,
+  primary?: { error: unknown },
+): Promise<void> {
+  const results = await Promise.allSettled(
+    cleanups.map(async (cleanup) => cleanup()),
+  )
+  const failures = results.flatMap((result) =>
+    result.status === `rejected` ? [result.reason as unknown] : [],
+  )
+  if (failures.length > 0 && primary) {
+    throw new AggregateError(
+      [primary.error, ...failures],
+      `Oracle and cleanup failed`,
+      { cause: primary.error },
+    )
+  }
+  if (failures.length === 1) throw failures[0]
+  if (failures.length > 1) {
+    throw new AggregateError(failures, `Oracle cleanup failed`)
+  }
+}
+
+export const noFillers: FillerCounts = {
+  terms: 0,
+  meanings: 0,
+  groups: 0,
+  links: 0,
+}
+
+export function createSourceCollection<T extends { id: string }>(
+  name: string,
+  initialData: Array<T>,
+) {
+  return createCollection(
+    localOnlyCollectionOptions<T>({
+      id: `${name}-${nextCollectionId++}`,
+      getKey: (row) => row.id,
+      initialData,
+    }),
+  )
+}
+
+// Count both sides of the source boundary. Delivered rows show what enters the
+// dataflow graph. entries() visits capture scans and get() calls capture keyed
+// reads, so examined work cannot hide behind a filter.
+export function countSourceWork<T extends object>(collection: Collection<T>) {
+  let deliveredRows = 0
+  let examinedRows = 0
+  let readingEntry = false
+  const originalSubscribeChanges = collection.subscribeChanges.bind(collection)
+  const originalEntries = collection.entries.bind(collection)
+  const originalGet = collection.get.bind(collection)
+
+  collection.subscribeChanges = (callback, options) => {
+    return originalSubscribeChanges((changes) => {
+      deliveredRows += changes.length
+      callback(changes)
+    }, options)
+  }
+
+  collection.get = (key) => {
+    if (!readingEntry) examinedRows++
+    return originalGet(key)
+  }
+
+  collection.entries = function* () {
+    const entries = originalEntries()
+    const readNext = () => {
+      readingEntry = true
+      try {
+        return entries.next()
+      } finally {
+        readingEntry = false
+      }
+    }
+
+    for (let next = readNext(); !next.done; next = readNext()) {
+      examinedRows++
+      yield next.value
+    }
+  }
+
+  return (): WorkCount => ({ delivered: deliveredRows, examined: examinedRows })
+}
+
+function createFixtureRows(filler: FillerCounts): SourceRows {
+  return {
+    terms: [
+      { id: `term-0`, text: `selected term` },
+      { id: `term-1`, text: `first target` },
+      { id: `term-2`, text: `second target` },
+      ...Array.from({ length: filler.terms }, (_, index) => ({
+        id: `term-filler-${index}`,
+        text: `irrelevant target ${index}`,
+      })),
+    ],
+    meanings: [
+      { id: `meaning-0`, termId: `term-0` },
+      ...Array.from({ length: filler.meanings }, (_, index) => ({
+        id: `meaning-filler-${index}`,
+        termId: `term-never-selected`,
+      })),
+    ],
+    groups: [
+      { id: `group-0`, meaningId: `meaning-0` },
+      ...Array.from({ length: filler.groups }, (_, index) => ({
+        id: `group-filler-${index}`,
+        meaningId: `meaning-never-selected`,
+      })),
+    ],
+    links: [
+      // Keep filler links on one existing target key. Only the left-side input
+      // grows. The term-filler control probes right-side input growth separately.
+      { id: `link-0`, groupId: `group-0`, targetId: `term-1` },
+      {
+        id: `link-1`,
+        groupId: `group-0`,
+        targetId: `term-2`,
+      },
+      ...Array.from({ length: filler.links }, (_, index) => ({
+        id: `link-filler-${index}`,
+        groupId: `group-never-selected`,
+        targetId: `term-1`,
+      })),
+    ],
+  }
+}
+
+function observeLink(link: LinkObservation): LinkObservation {
+  if (`text` in link) return { id: link.id, text: link.text }
+  if (`targetId` in link) return { id: link.id, targetId: link.targetId }
+
+  const exhaustive: never = link
+  return exhaustive
+}
+
+export function observeResult(
+  roots: ReadonlyArray<WorkObservation[`result`][number]>,
+): WorkObservation[`result`] {
+  return roots.map((root) => ({
+    id: root.id,
+    meanings: root.meanings.map((meaning) => ({
+      id: meaning.id,
+      groups: meaning.groups.map((group) => ({
+        id: group.id,
+        links: group.links.map(observeLink),
+      })),
+    })),
+  }))
+}
+
+export async function observeWork({
+  filler,
+  joinTargets,
+}: WorkScenario): Promise<WorkObservation> {
+  const rows = createFixtureRows(filler)
+  const sources = {
+    terms: createSourceCollection(`work-terms`, rows.terms),
+    meanings: createSourceCollection(`work-meanings`, rows.meanings),
+    groups: createSourceCollection(`work-groups`, rows.groups),
+    links: createSourceCollection(`work-links`, rows.links),
+  }
+  let cleanupLive: (() => Promise<void>) | undefined
+  let primary: { error: unknown } | undefined
+
+  try {
+    await Promise.all(Object.values(sources).map((source) => source.preload()))
+
+    // Match the reported boundary: load first, then add a B-tree index on each
+    // correlation and join column before constructing the live query.
+    sources.terms.createIndex((row) => row.id, { indexType: BTreeIndex })
+    sources.meanings.createIndex((row) => row.termId, {
+      indexType: BTreeIndex,
+    })
+    sources.groups.createIndex((row) => row.meaningId, {
+      indexType: BTreeIndex,
+    })
+    sources.links.createIndex((row) => row.groupId, { indexType: BTreeIndex })
+    sources.links.createIndex((row) => row.targetId, {
+      indexType: BTreeIndex,
+    })
+
+    const counters = {
+      terms: countSourceWork(sources.terms),
+      meanings: countSourceWork(sources.meanings),
+      groups: countSourceWork(sources.groups),
+      links: countSourceWork(sources.links),
+    }
+
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ term: sources.terms })
+        .where(({ term }) => eq(term.id, `term-0`))
+        .select(({ term }) => ({
+          id: term.id,
+          meanings: materialize(
+            q
+              .from({ meaning: sources.meanings })
+              .where(({ meaning }) => eq(meaning.termId, term.id))
+              .select(({ meaning }) => ({
+                id: meaning.id,
+                groups: materialize(
+                  q
+                    .from({ group: sources.groups })
+                    .where(({ group }) => eq(group.meaningId, meaning.id))
+                    .select(({ group }) => {
+                      const selectedLinks = q
+                        .from({ link: sources.links })
+                        .where(({ link }) => eq(link.groupId, group.id))
+
+                      return {
+                        id: group.id,
+                        links: joinTargets
+                          ? materialize(
+                              selectedLinks
+                                .innerJoin(
+                                  { target: sources.terms },
+                                  ({ link, target }) =>
+                                    eq(link.targetId, target.id),
+                                )
+                                .select(({ link, target }) => ({
+                                  id: link.id,
+                                  text: target.text,
+                                })),
+                            )
+                          : materialize(
+                              selectedLinks.select(({ link }) => ({
+                                id: link.id,
+                                targetId: link.targetId,
+                              })),
+                            ),
+                      }
+                    }),
+                ),
+              })),
+          ),
+        })),
+    )
+    cleanupLive = () => live.cleanup()
+
+    await live.preload()
+    return {
+      result: observeResult(live.toArray),
+      sourceWork: {
+        terms: counters.terms(),
+        meanings: counters.meanings(),
+        groups: counters.groups(),
+        links: counters.links(),
+      },
+    }
+  } catch (error) {
+    primary = { error }
+    throw error
+  } finally {
+    await runCleanups(
+      [
+        async () => cleanupLive?.(),
+        ...Object.values(sources).map((source) => async () => source.cleanup()),
+      ],
+      primary,
+    )
+  }
+}
+
+export function expectedResult({
+  joinTargets,
+}: Pick<WorkScenario, 'joinTargets'>): WorkObservation[`result`] {
+  return [
+    {
+      id: `term-0`,
+      meanings: [
+        {
+          id: `meaning-0`,
+          groups: [
+            {
+              id: `group-0`,
+              links: [
+                joinTargets
+                  ? { id: `link-0`, text: `first target` }
+                  : { id: `link-0`, targetId: `term-1` },
+                joinTargets
+                  ? {
+                      id: `link-1`,
+                      text: `second target`,
+                    }
+                  : {
+                      id: `link-1`,
+                      targetId: `term-2`,
+                    },
+              ],
+            },
+          ],
+        },
+      ],
+    },
+  ]
+}
+
+export function expectSourceWorkBound(
+  actual: SourceWork,
+  expected: SourceWork,
+): void {
+  expect(actual).toEqual(expected)
+}
diff --git a/packages/db/tests/query/includes-work-counter.test.ts b/packages/db/tests/query/includes-work-counter.test.ts
new file mode 100644
index 0000000000..6776bea24d
--- /dev/null
+++ b/packages/db/tests/query/includes-work-counter.test.ts
@@ -0,0 +1,436 @@
+// Unit tests for the includes work-counter oracle. Each test here compares
+// production with a value written by hand, or checks the oracle's own cleanup
+// and comparison helpers, so no declared check or model reaches it. The law
+// that the work bound states is owned by includes-work-counter-oracle.test.ts,
+// and the shared fixtures live in includes-work-counter-support.ts.
+
+import { beforeAll, describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import {
+  SetWindowFindOneLimitError,
+  SetWindowRequiresOrderByError,
+} from '../../src/errors.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  toArray,
+} from '../../src/query/index.js'
+import {
+  createSourceCollection,
+  expectSourceWorkBound,
+  expectedResult,
+  noFillers,
+  observeResult,
+  observeWork,
+  runCleanups,
+} from './includes-work-counter-support.js'
+import type {
+  SourceWork,
+  WorkObservation,
+} from './includes-work-counter-support.js'
+
+let nextCollectionId = 0
+let joinedBaselineObservation: WorkObservation
+
+describe(`includes deterministic work-counter oracle`, () => {
+  it(`preserves the primary failure and every cleanup failure`, async () => {
+    const primary = new Error(`source preload failed`)
+    const firstCleanup = new Error(`live query cleanup failed`)
+    const secondCleanup = new Error(`source cleanup failed`)
+    const attempted: Array<string> = []
+
+    await expect(
+      runCleanups(
+        [
+          () => {
+            attempted.push(`live`)
+            throw firstCleanup
+          },
+          () => {
+            attempted.push(`source`)
+            throw secondCleanup
+          },
+        ],
+        { error: primary },
+      ),
+    ).rejects.toMatchObject({
+      cause: primary,
+      errors: [primary, firstCleanup, secondCleanup],
+    })
+    expect(attempted).toEqual([`live`, `source`])
+  })
+
+  it.each([true, false])(
+    `retains and rejects extra roots with joinTargets=%s`,
+    (joinTargets) => {
+      const expected = expectedResult({ joinTargets })
+      expect(observeResult(expected)).toEqual(expected)
+      const extra = { id: `term-extra`, meanings: [] }
+      const faulty = [...expected, extra]
+      // The old first-root capture erases this violation.
+      expect(observeResult(faulty.slice(0, 1))).toEqual(expected)
+      const observed = observeResult(faulty)
+      expect(observed).toEqual(faulty)
+      expect(() => expect(observed).toEqual(expected)).toThrow()
+      expect(observeResult([])).toEqual([])
+      expect(() => expect(observeResult([])).toEqual(expected)).toThrow()
+    },
+  )
+  beforeAll(async () => {
+    joinedBaselineObservation = await observeWork({
+      filler: noFillers,
+      joinTargets: true,
+    })
+  })
+
+  it(`rejects extra source reads at the preload checkpoint`, () => {
+    const baseline = joinedBaselineObservation
+    const faultyWork: SourceWork = {
+      ...baseline.sourceWork,
+      links: {
+        ...baseline.sourceWork.links,
+        examined: baseline.sourceWork.links.examined + 1,
+      },
+    }
+
+    expect(baseline.result).toEqual(expectedResult({ joinTargets: true }))
+    expect(() =>
+      expectSourceWorkBound(faultyWork, baseline.sourceWork),
+    ).toThrow()
+  })
+})
+
+describe(`includes work under an ordered parent window`, () => {
+  // An include child's orderBy gives the parent no window to move, so an
+  // unordered parent rejects setWindow instead of moving the child windows.
+  it(`rejects setWindow on an unordered parent with an ordered child`, async () => {
+    const parentSource = createSourceCollection(`unordered-parents`, [
+      { id: `parent-0`, group: `group-0` },
+    ])
+    const childSource = createSourceCollection(`unordered-children`, [
+      { id: `child-0`, group: `group-0`, n: 0 },
+    ])
+    const live = createLiveQueryCollection((q) =>
+      q.from({ parent: parentSource }).select(({ parent }) => ({
+        id: parent.id,
+        kids: toArray(
+          q
+            .from({ child: childSource })
+            .where(({ child }) => eq(child.group, parent.group))
+            .orderBy(({ child }) => child.n)
+            .limit(1),
+        ),
+      })),
+    )
+    try {
+      await live.preload()
+      expect(() => live.utils.setWindow({ offset: 0, limit: 1 })).toThrow(
+        SetWindowRequiresOrderByError,
+      )
+    } finally {
+      await runCleanups([
+        () => live.cleanup(),
+        () => parentSource.cleanup(),
+        () => childSource.cleanup(),
+      ])
+    }
+  })
+})
+
+/**
+ * # Static demand and window ownership
+ *
+ * A static parent filter that names one row of a `findOne` with no `offset`
+ * leaves the window nothing to drop, so the include may create that child's
+ * demand at once: a detail page starts its child acquisition attempt beside
+ * its parent acquisition attempt instead of after the parent's rows arrive.
+ * Each test's `loadSubset` handler stands in for both the sync adapter and the
+ * provider, and records each acquisition attempt in order. Only the query's
+ * own window answers `setWindow`; a window inside a `from` or a joined
+ * subquery never does.
+ */
+describe(`static include demand and setWindow ownership`, () => {
+  // A window requested before start at offset 0 drops nothing, so it keeps
+  // the static demand.
+  it.each([null, { offset: 0 }] as const)(
+    `starts a findOne detail page's child load beside its parent load (window before start: %o)`,
+    async (startWindow) => {
+      const calls: Array<string> = []
+      let releaseParent!: () => void
+      const parentHeld = new Promise<void>((resolve) => {
+        releaseParent = resolve
+      })
+      const parents = createCollection<{ id: string }, string>({
+        id: `detail-parents-${nextCollectionId++}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                calls.push(`parent`)
+                return parentHeld.then(() => {
+                  begin()
+                  write({ type: `insert`, value: { id: `parent-1` } })
+                  commit()
+                })
+              },
+            }
+          },
+        },
+      })
+      const children = createCollection<
+        { id: string; parentId: string },
+        string
+      >({
+        id: `detail-children-${nextCollectionId++}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                calls.push(`child`)
+                begin()
+                write({
+                  type: `insert`,
+                  value: { id: `child-1`, parentId: `parent-1` },
+                })
+                commit()
+                return true
+              },
+            }
+          },
+        },
+      })
+      const live = createLiveQueryCollection({
+        startSync: false,
+        query: (q) =>
+          q
+            .from({ parent: parents })
+            .where(({ parent }) => eq(parent.id, `parent-1`))
+            .select(({ parent }) => ({
+              id: parent.id,
+              kids: toArray(
+                q
+                  .from({ child: children })
+                  .where(({ child }) => eq(child.parentId, parent.id))
+                  .select(({ child }) => ({ id: child.id })),
+              ),
+            }))
+            .findOne(),
+      })
+      if (startWindow) {
+        const settled = live.utils.setWindow(startWindow)
+        if (settled !== true) void settled.catch(() => {})
+      }
+      try {
+        const ready = live.toArrayWhenReady()
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        // The child acquisition attempt has started while the parent's is held.
+        expect(calls).toEqual([`parent`, `child`])
+        releaseParent()
+        await ready
+        expect(
+          (
+            live.toArray as unknown as Array<{
+              id: string
+              kids: Array<{ id: string }>
+            }>
+          ).map((row) => ({ id: row.id, kids: row.kids.map((kid) => kid.id) })),
+        ).toEqual([{ id: `parent-1`, kids: [`child-1`] }])
+        expect(calls).toEqual([`parent`, `child`])
+      } finally {
+        releaseParent()
+        await runCleanups([
+          () => live.cleanup(),
+          () => parents.cleanup(),
+          () => children.cleanup(),
+        ])
+      }
+    },
+  )
+
+  // A findOne with limit 0 shows no row, so its named correlation value's child must
+  // not load.
+  it(`starts no child acquisition for a findOne with limit 0`, async () => {
+    const calls: Array<string> = []
+    const onDemand = <T extends { id: string }>(name: string, rows: Array<T>) =>
+      createCollection<T, string>({
+        id: `limit-zero-${name}-${nextCollectionId++}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                calls.push(name)
+                begin()
+                for (const value of rows) write({ type: `insert`, value })
+                commit()
+                return true
+              },
+            }
+          },
+        },
+      })
+    const parents = onDemand(`parent`, [{ id: `parent-1` }])
+    const children = onDemand(`child`, [
+      { id: `child-1`, parentId: `parent-1` },
+    ])
+    const live = createLiveQueryCollection({
+      startSync: true,
+      query: (q) =>
+        q
+          .from({ parent: parents })
+          .where(({ parent }) => eq(parent.id, `parent-1`))
+          .select(({ parent }) => ({
+            id: parent.id,
+            kids: toArray(
+              q
+                .from({ child: children })
+                .where(({ child }) => eq(child.parentId, parent.id)),
+            ),
+          }))
+          .orderBy(({ parent }) => parent.id)
+          .limit(0)
+          .findOne(),
+    })
+    try {
+      await live.toArrayWhenReady()
+      expect(calls).not.toContain(`child`)
+      expect(live.toArray).toEqual([])
+    } finally {
+      await runCleanups([
+        () => live.cleanup(),
+        () => parents.cleanup(),
+        () => children.cleanup(),
+      ])
+    }
+  })
+
+  // A findOne keeps its compiled limit, and setWindow throws for any other
+  // limit. An ordered findOne has a movable window; an unordered one is a
+  // fixed one-row result that rejects offset moves.
+  it(`keeps a findOne's compiled limit and moves only an ordered findOne`, async () => {
+    const rows = createSourceCollection(
+      `find-one-window-rows`,
+      Array.from({ length: 4 }, (_, rank) => ({ id: `row-${rank}`, rank })),
+    )
+    const one = createLiveQueryCollection((q) =>
+      q
+        .from({ row: rows })
+        .orderBy(({ row }) => row.rank)
+        .findOne(),
+    )
+    const none = createLiveQueryCollection((q) =>
+      q
+        .from({ row: rows })
+        .orderBy(({ row }) => row.rank)
+        .limit(0)
+        .findOne(),
+    )
+    const unordered = createLiveQueryCollection((q) =>
+      q.from({ row: rows }).findOne(),
+    )
+    try {
+      await Promise.all([one.preload(), none.preload(), unordered.preload()])
+      expect(() => one.utils.setWindow({ offset: 0, limit: 3 })).toThrow(
+        SetWindowFindOneLimitError,
+      )
+      for (const window of [{ offset: 2 }, { offset: 1, limit: 1 }]) {
+        const settled = one.utils.setWindow(window)
+        if (settled !== true) await settled
+        expect(one.toArray.map((row) => row.id)).toEqual([
+          `row-${window.offset}`,
+        ])
+        expect(one.utils.getWindow()).toEqual({
+          offset: window.offset,
+          limit: 1,
+        })
+      }
+      const moved = none.utils.setWindow({ offset: 1 })
+      if (moved !== true) await moved
+      expect(none.toArray).toEqual([])
+      expect(none.utils.getWindow()).toEqual({ offset: 1, limit: 0 })
+      expect(() => none.utils.setWindow({ limit: 1 })).toThrow(
+        SetWindowFindOneLimitError,
+      )
+      // A window is an ordered view: an unordered findOne keeps offset 0.
+      expect(() => unordered.utils.setWindow({ offset: 1 })).toThrow(
+        SetWindowRequiresOrderByError,
+      )
+      expect(unordered.utils.setWindow({ offset: 0 })).toBe(true)
+      expect(unordered.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
+    } finally {
+      await runCleanups([
+        () => one.cleanup(),
+        () => none.cleanup(),
+        () => unordered.cleanup(),
+        () => rows.cleanup(),
+      ])
+    }
+  })
+
+  it.each([`from`, `join`] as const)(
+    `rejects setWindow when only a %s subquery has a window`,
+    async (placement) => {
+      const rows = createSourceCollection(`owner-rows`, [
+        { id: `row-0`, rank: 0 },
+        { id: `row-1`, rank: 1 },
+        { id: `row-2`, rank: 2 },
+      ])
+      const live = createLiveQueryCollection((q) => {
+        const page = q
+          .from({ row: rows })
+          .orderBy(({ row }) => row.rank)
+          .limit(2)
+        return placement === `from`
+          ? q.from({ page })
+          : q
+              .from({ row: rows })
+              .join({ page }, ({ row, page: paged }) => eq(row.id, paged.id))
+      })
+      try {
+        await live.preload()
+        expect(() => live.utils.setWindow({ offset: 1, limit: 2 })).toThrow(
+          SetWindowRequiresOrderByError,
+        )
+      } finally {
+        await runCleanups([() => live.cleanup(), () => rows.cleanup()])
+      }
+    },
+  )
+
+  it(`moves the outer window, not a from subquery's`, async () => {
+    const rows = createSourceCollection(
+      `outer-owner-rows`,
+      Array.from({ length: 6 }, (_, rank) => ({ id: `row-${rank}`, rank })),
+    )
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({
+          page: q
+            .from({ row: rows })
+            .orderBy(({ row }) => row.rank)
+            .limit(4),
+        })
+        .orderBy(({ page }) => page.rank)
+        .limit(2),
+    )
+    try {
+      await live.preload()
+      const settled = live.utils.setWindow({ offset: 2, limit: 2 })
+      if (settled !== true) await settled
+      expect(live.toArray.map((row) => row.id)).toEqual([`row-2`, `row-3`])
+    } finally {
+      await runCleanups([() => live.cleanup(), () => rows.cleanup()])
+    }
+  })
+})
diff --git a/packages/db/tests/query/includes.test.ts b/packages/db/tests/query/includes.test.ts
index bd42ca758c..e76ae72825 100644
--- a/packages/db/tests/query/includes.test.ts
+++ b/packages/db/tests/query/includes.test.ts
@@ -1,3 +1,4 @@
+import { test as fcTest } from '@fast-check/vitest'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   and,
@@ -11,6 +12,7 @@ import {
   gte,
   include,
   materialize,
+  queryOnce,
   toArray,
 } from '../../src/query/index.js'
 import { createCollection } from '../../src/collection/index.js'
@@ -23,6 +25,30 @@ import {
   stripVirtualProps,
 } from '../utils.js'
 import { IncludeOperatorRequiredError } from '../../src/errors.js'
+import {
+  createRouteLifecycleScenario,
+  createVisibleRelationshipScenario,
+  transitionHistoryBranches,
+} from './includes-route-grammar-oracle.js'
+import { classifyScopedNaming } from './includes-scope-identity-oracle.js'
+import {
+  createControlledCollection,
+  plainSubquery,
+  refsInclude,
+  stripVirtualProperties,
+  trackPendingWork,
+  withPendingWorkCleanup,
+} from './includes-structural-support.js'
+import type {
+  ConnectedBranch,
+  RouteTransitionDescriptor,
+} from './includes-route-grammar-oracle.js'
+import type {
+  ChildRow,
+  PendingWork,
+  RootRow,
+} from './includes-structural-support.js'
+import type { ScopedShape } from './includes-scope-identity-oracle.js'
 import type { SyncConfig } from '../../src/types.js'
 
 type Project = {
@@ -8000,6 +8026,497 @@ describe(`includes subqueries`, () => {
   })
 })
 
+describe(`includes recompute oracle`, () => {
+  fcTest(`parent correlation-key update rematerializes children`, async () => {
+    const roots = createControlledCollection<RootRow>(`correlation-seed-roots`)
+    const children = createControlledCollection<ChildRow>(
+      `correlation-seed-children`,
+    )
+    const live = createLiveQueryCollection((q) =>
+      q.from({ root: roots.collection }).select(({ root }) => ({
+        id: root.id,
+        group: root.group,
+        children: toArray(
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentGroup, root.group))
+            .select(({ child }) => ({ id: child.id })),
+        ),
+      })),
+    )
+
+    try {
+      await live.preload()
+      children.write(`insert`, {
+        id: 1,
+        parentGroup: 0,
+        group: 0,
+        value: 0,
+        position: 0,
+      })
+      children.write(`insert`, {
+        id: 2,
+        parentGroup: 1,
+        group: 0,
+        value: 0,
+        position: 0,
+      })
+      roots.write(`insert`, { id: 1, group: 1, value: 0, position: 0 })
+      roots.write(`update`, { id: 1, group: 0, value: 0, position: 0 })
+
+      expect(stripVirtualProperties(live.toArray)).toEqual([
+        { id: 1, group: 0, children: [{ id: 1 }] },
+      ])
+    } finally {
+      await live.cleanup()
+      await Promise.all([
+        roots.collection.cleanup(),
+        children.collection.cleanup(),
+      ])
+    }
+  })
+
+  fcTest(
+    `alpha-renaming a duplicate sibling alias preserves results`,
+    async () => {
+      const roots = createControlledCollection<RootRow>(`alias-seed-roots`, [
+        { id: 1, group: 1, value: 0, position: 0 },
+      ])
+      const issues = createControlledCollection<ChildRow>(`alias-seed-issues`, [
+        {
+          id: 10,
+          parentGroup: 1,
+          group: 10,
+          value: 10,
+          position: 0,
+        },
+        {
+          id: 11,
+          parentGroup: 1,
+          group: 11,
+          value: 99,
+          position: 1,
+        },
+      ])
+      const tags = createControlledCollection<ChildRow>(`alias-seed-tags`, [
+        {
+          id: 20,
+          parentGroup: 1,
+          group: 20,
+          value: 20,
+          position: 0,
+        },
+        {
+          id: 21,
+          parentGroup: 1,
+          group: 21,
+          value: 99,
+          position: 1,
+        },
+      ])
+
+      try {
+        const uniqueAliases = await queryOnce((q) =>
+          q.from({ root: roots.collection }).select(({ root }) => ({
+            id: root.id,
+            issues: toArray(
+              q
+                .from({ issue: issues.collection })
+                .where(({ issue }) => eq(issue.parentGroup, root.group))
+                .where(({ issue }) => eq(issue.value, 10))
+                .select(({ issue }) => ({ id: issue.id })),
+            ),
+            tags: toArray(
+              q
+                .from({ tag: tags.collection })
+                .where(({ tag }) => eq(tag.parentGroup, root.group))
+                .where(({ tag }) => eq(tag.value, 20))
+                .select(({ tag }) => ({ id: tag.id })),
+            ),
+          })),
+        )
+        const duplicateAliases = await queryOnce((q) =>
+          q.from({ root: roots.collection }).select(({ root }) => ({
+            id: root.id,
+            issues: toArray(
+              q
+                .from({ item: issues.collection })
+                .where(({ item }) => eq(item.parentGroup, root.group))
+                .where(({ item }) => eq(item.value, 10))
+                .select(({ item }) => ({ id: item.id })),
+            ),
+            tags: toArray(
+              q
+                .from({ item: tags.collection })
+                .where(({ item }) => eq(item.parentGroup, root.group))
+                .where(({ item }) => eq(item.value, 20))
+                .select(({ item }) => ({ id: item.id })),
+            ),
+          })),
+        )
+
+        const expected = [{ id: 1, issues: [{ id: 10 }], tags: [{ id: 20 }] }]
+        expect(stripVirtualProperties(uniqueAliases)).toEqual(expected)
+        expect(stripVirtualProperties(duplicateAliases)).toEqual(expected)
+      } finally {
+        await Promise.all([
+          roots.collection.cleanup(),
+          issues.collection.cleanup(),
+          tags.collection.cleanup(),
+        ])
+      }
+    },
+  )
+
+  fcTest(`optimistic child reorder matches recomputation`, async () => {
+    const roots = createControlledCollection<RootRow>(`order-seed-roots`, [
+      { id: 1, group: 1, value: 0, position: 0 },
+    ])
+    const children = createControlledCollection<ChildRow>(
+      `order-seed-children`,
+      [
+        {
+          id: 1,
+          parentGroup: 1,
+          group: 1,
+          value: 1,
+          position: 0,
+        },
+        {
+          id: 2,
+          parentGroup: 1,
+          group: 1,
+          value: 2,
+          position: 1,
+        },
+      ],
+    )
+    const live = createLiveQueryCollection((q) =>
+      q.from({ root: roots.collection }).select(({ root }) => ({
+        id: root.id,
+        children: toArray(
+          q
+            .from({ child: children.collection })
+            .where(({ child }) => eq(child.parentGroup, root.group))
+            .orderBy(({ child }) => child.position)
+            .select(({ child }) => ({
+              id: child.id,
+              position: child.position,
+            })),
+        ),
+      })),
+    )
+
+    const pending = new Set<PendingWork>()
+    await withPendingWorkCleanup(
+      pending,
+      [live, roots.collection, children.collection],
+      async () => {
+        await live.preload()
+        const transaction = children.collection.update([1, 2], (drafts) => {
+          drafts[0]!.position = 1
+          drafts[1]!.position = 0
+        })
+        trackPendingWork(pending, transaction, children.resolveSync)
+
+        expect(stripVirtualProperties(live.toArray)).toEqual([
+          {
+            id: 1,
+            children: [
+              { id: 2, position: 0 },
+              { id: 1, position: 1 },
+            ],
+          },
+        ])
+      },
+    )
+  })
+
+  fcTest(`rejects subscriber lifecycle labels on reparent transitions`, () => {
+    expect(() =>
+      createRouteLifecycleScenario({
+        depth: 3,
+        branches: transitionHistoryBranches,
+        descriptors: [
+          {
+            kind: `reparent`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `fresh`, route: 2_100 },
+          } as unknown as RouteTransitionDescriptor,
+        ],
+      }),
+    ).toThrow(/reparent transitions only support live merge destinations/)
+  })
+
+  fcTest(`scopes rekey route histories to their include level`, () => {
+    expect(() =>
+      createRouteLifecycleScenario({
+        depth: 3,
+        branches: transitionHistoryBranches,
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 1,
+            row: 0,
+            destination: { strategy: `fresh`, route: 2_100 },
+          },
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `fresh`, route: 2_100 },
+          },
+        ],
+      }),
+    ).not.toThrow()
+  })
+
+  fcTest(`rejects invalid route destination strategies`, () => {
+    const branches = transitionHistoryBranches
+    const ownRoute = branches[0].groupBase + 2
+    const otherRoute = branches[1].groupBase + 2
+    const freshRoute = 2_100
+    const invalidCases: ReadonlyArray<{
+      descriptors: ReadonlyArray<RouteTransitionDescriptor>
+      message: RegExp
+    }> = [
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `fresh`, route: otherRoute },
+          },
+        ],
+        message: /fresh route must never have been used/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `restore`, route: ownRoute },
+          },
+        ],
+        message: /restore route must have been retired by this row/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `fresh`, route: freshRoute },
+          },
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 1,
+            destination: { strategy: `restore`, route: ownRoute },
+          },
+        ],
+        message: /restore route must have been retired by this row/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `merge`, route: freshRoute },
+          },
+        ],
+        message: /merge route must be live and different/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `merge`, route: ownRoute },
+          },
+        ],
+        message: /merge route must be live and different/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `split`, route: freshRoute },
+          },
+        ],
+        message: /split source route must be shared/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `merge`, route: otherRoute },
+          },
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `split`, route: ownRoute },
+          },
+        ],
+        message: /split destination must be unused/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `retired`, route: otherRoute },
+          },
+        ],
+        message: /retired route must have been retired by another row/,
+      },
+      {
+        descriptors: [
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `fresh`, route: freshRoute },
+          },
+          {
+            kind: `rekey`,
+            level: 2,
+            row: 0,
+            destination: { strategy: `retired`, route: ownRoute },
+          },
+        ],
+        message: /retired route must have been retired by another row/,
+      },
+    ]
+
+    for (const invalidCase of invalidCases) {
+      expect(() =>
+        createRouteLifecycleScenario({
+          depth: 3,
+          branches,
+          descriptors: invalidCase.descriptors,
+        }),
+      ).toThrow(invalidCase.message)
+    }
+  })
+
+  fcTest(`rejects overlapping visible relationship keys`, () => {
+    const base = {
+      depth: 4,
+      transition: `rekey`,
+      targetLevel: 1,
+      sourceBranch: 0,
+      noise: [],
+    } as const
+    const collisions: Array<{
+      branches: readonly [ConnectedBranch, ConnectedBranch]
+      rekeyGroup: number
+    }> = [
+      {
+        branches: [
+          { idBase: 100, groupBase: 600 },
+          { idBase: 102, groupBase: 1_600 },
+        ],
+        rekeyGroup: 2_100,
+      },
+      {
+        branches: [
+          { idBase: 100, groupBase: 600 },
+          { idBase: 1_100, groupBase: 602 },
+        ],
+        rekeyGroup: 2_100,
+      },
+      {
+        branches: [
+          { idBase: 100, groupBase: 600 },
+          { idBase: 1_100, groupBase: 1_600 },
+        ],
+        rekeyGroup: 603,
+      },
+    ]
+
+    for (const collision of collisions) {
+      expect(() =>
+        createVisibleRelationshipScenario({
+          ...base,
+          ...collision,
+        }),
+      ).toThrow(/overlap/)
+    }
+  })
+})
+
+describe(`includes alpha-renaming across lexical scopes`, () => {
+  fcTest(`legality admits shadowing and rejects same-scope reuse`, () => {
+    const shape: ScopedShape = {
+      topology: `fromSubquery`,
+      subquery: { ...plainSubquery, joins: `refsThenNotes` },
+      include: refsInclude,
+    }
+    const legal = {
+      outer: `a`,
+      sub: `a`,
+      joined: `b`,
+      noted: `c`,
+      include: `b`,
+    }
+    expect(classifyScopedNaming(shape, legal)).toBe(`legal`)
+    expect(classifyScopedNaming(shape, { ...legal, include: `a` })).toBe(
+      `shadowing`,
+    )
+    expect(classifyScopedNaming(shape, { ...legal, noted: `b` })).toBe(
+      `sameScope`,
+    )
+    expect(
+      classifyScopedNaming(
+        { ...shape, topology: `unionBranch` },
+        { ...legal, inactive: `c` },
+      ),
+    ).toBe(`sameScope`)
+    expect(
+      classifyScopedNaming(
+        { topology: `wrapper`, wrapperJoin: `left` },
+        { wrapped: `x`, joinSub: `x`, joinSource: `y` },
+      ),
+    ).toBe(`sameScope`)
+    const nestedShape: ScopedShape = {
+      ...shape,
+      include: { ...refsInclude, body: `nestedFrom` },
+    }
+    expect(
+      classifyScopedNaming(nestedShape, {
+        ...legal,
+        include: `a`,
+        includeOuter: `c`,
+      }),
+    ).toBe(`shadowing`)
+    expect(
+      classifyScopedNaming(nestedShape, {
+        ...legal,
+        include: `c`,
+        includeOuter: `c`,
+      }),
+    ).toBe(`shadowing`)
+    expect(
+      classifyScopedNaming(
+        { topology: `unionParent`, includeSource: `refs` },
+        { activeBranch: `a`, inactiveBranch: `a`, anchor: `b`, include: `c` },
+      ),
+    ).toBe(`sameScope`)
+  })
+})
+
 describe(`a subquery in select needs an include operator`, () => {
   const query = (shape: `field` | `nested` | `caseWhen`) => () =>
     createLiveQueryCollection((q) =>
diff --git a/packages/db/tests/query/index-path-collision-oracle.test.ts b/packages/db/tests/query/index-path-collision-oracle.test.ts
index e1932ab1e8..b3269eb668 100644
--- a/packages/db/tests/query/index-path-collision-oracle.test.ts
+++ b/packages/db/tests/query/index-path-collision-oracle.test.ts
@@ -42,6 +42,9 @@ import { add, and, gt, lt, lte } from '../../src/query/builder/functions.js'
 import { PropRef } from '../../src/query/ir.js'
 import { createLiveQueryCollection } from '../../src/query/live-query-collection.js'
 import { mockSyncCollectionOptions } from '../utils.js'
+import { declareOracle } from '../oracle-declaration.js'
+import { checkWithCleanup } from './index-path-collision-support.js'
+import type { Release } from './index-path-collision-support.js'
 import type { BasicExpression } from '../../src/query/ir.js'
 
 interface Row {
@@ -50,35 +53,6 @@ interface Row {
   a: { b: number }
 }
 
-type Release = () => void | Promise<void>
-
-async function checkWithCleanup(
-  check: (register: (release: Release) => void) => void | Promise<void>,
-) {
-  const releases: Array<Release> = []
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    await check((release) => releases.unshift(release))
-  } catch (error) {
-    primaryFailure = { error }
-  }
-
-  const cleanupErrors: Array<unknown> = []
-  for (const release of releases) {
-    try {
-      await release()
-    } catch (error) {
-      cleanupErrors.push(error)
-    }
-  }
-  if (cleanupErrors.length) {
-    throw new AggregateError(cleanupErrors, `Path oracle cleanup failed`, {
-      cause: primaryFailure?.error,
-    })
-  }
-  if (primaryFailure) throw primaryFailure.error
-}
-
 const flat = new PropRef([`a.b`])
 const nested = new PropRef([`a`, `b`])
 const rows: Array<Row> = [0, 10, 25].flatMap((flatValue) =>
@@ -107,10 +81,32 @@ async function readyCollection(
   return collection
 }
 
-const expectedKeys = rows
-  .filter((row) => row[`a.b`] > 5 && row.a.b < 20)
-  .map((row) => row.id)
-  .sort()
+// Model: plain JavaScript keeps the rows that a predicate accepts, then sorts
+// their ids. The predicate is the only input, so every query shape shares it.
+function modelKeys(accepts: (row: Row) => boolean): Array<string> {
+  return rows
+    .filter(accepts)
+    .map((row) => row.id)
+    .sort()
+}
+
+// Model: the selected-field order is a JavaScript sort of both path values,
+// with ids breaking ties.
+function modelSelectedOrder(): Array<string> {
+  return [...rows]
+    .sort(
+      (left, right) =>
+        left[`a.b`] + left.a.b - (right[`a.b`] + right.a.b) ||
+        left.id.localeCompare(right.id),
+    )
+    .map((row) => row.id)
+}
+
+const expectedKeys = modelKeys((row) => row[`a.b`] > 5 && row.a.b < 20)
+
+declareOracle({
+  model: [modelKeys, modelSelectedOrder],
+})
 
 const cases: Array<{
   name: string
@@ -144,10 +140,7 @@ it.each(cases)(
   async ({ name, where, accepts }) => {
     await checkWithCleanup(async (register) => {
       const collection = await readyCollection(name, register)
-      const expected = rows
-        .filter(accepts)
-        .map((row) => row.id)
-        .sort()
+      const expected = modelKeys(accepts)
       const queryKeys = () =>
         collection
           .currentStateAsChanges({ where })!
@@ -205,13 +198,7 @@ it(`keeps selected dotted and nested paths distinct in a public order`, async ()
     register(() => result.cleanup())
 
     await result.stateWhenReady()
-    const expected = [...rows]
-      .sort(
-        (left, right) =>
-          left[`a.b`] + left.a.b - (right[`a.b`] + right.a.b) ||
-          left.id.localeCompare(right.id),
-      )
-      .map((row) => row.id)
+    const expected = modelSelectedOrder()
     expect(result.toArray.map((row) => row.id)).toEqual(expected)
   })
 })
@@ -239,30 +226,3 @@ it.each([false, true])(
     })
   },
 )
-
-it(`preserves a mismatch and secondary cleanup error`, async () => {
-  const primary = new Error(`wrong public rows`)
-  const cleanup = new Error(`cleanup failed`)
-  const released: Array<string> = []
-  let failure: unknown
-
-  try {
-    await checkWithCleanup((register) => {
-      register(() => {
-        released.push(`source`)
-        throw cleanup
-      })
-      register(() => {
-        released.push(`query`)
-      })
-      throw primary
-    })
-  } catch (error) {
-    failure = error
-  }
-
-  expect(released).toEqual([`query`, `source`])
-  expect(failure).toBeInstanceOf(AggregateError)
-  expect((failure as AggregateError).cause).toBe(primary)
-  expect((failure as AggregateError).errors).toEqual([cleanup])
-})
diff --git a/packages/db/tests/query/index-path-collision-support.ts b/packages/db/tests/query/index-path-collision-support.ts
new file mode 100644
index 0000000000..9acf1456f9
--- /dev/null
+++ b/packages/db/tests/query/index-path-collision-support.ts
@@ -0,0 +1,30 @@
+// Shared cleanup harness for the index path collision tests. It runs a check,
+// then every registered release, and keeps the check's failure as the cause.
+export type Release = () => void | Promise<void>
+
+export async function checkWithCleanup(
+  check: (register: (release: Release) => void) => void | Promise<void>,
+) {
+  const releases: Array<Release> = []
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    await check((release) => releases.unshift(release))
+  } catch (error) {
+    primaryFailure = { error }
+  }
+
+  const cleanupErrors: Array<unknown> = []
+  for (const release of releases) {
+    try {
+      await release()
+    } catch (error) {
+      cleanupErrors.push(error)
+    }
+  }
+  if (cleanupErrors.length) {
+    throw new AggregateError(cleanupErrors, `Path oracle cleanup failed`, {
+      cause: primaryFailure?.error,
+    })
+  }
+  if (primaryFailure) throw primaryFailure.error
+}
diff --git a/packages/db/tests/query/index-path-collision.test.ts b/packages/db/tests/query/index-path-collision.test.ts
new file mode 100644
index 0000000000..e736932ce8
--- /dev/null
+++ b/packages/db/tests/query/index-path-collision.test.ts
@@ -0,0 +1,31 @@
+// Ordinary cleanup-harness tests for the index path collision oracle. The
+// distinct-path law is owned by index-path-collision-oracle.test.ts.
+import { expect, it } from 'vitest'
+import { checkWithCleanup } from './index-path-collision-support.js'
+
+it(`preserves a mismatch and secondary cleanup error`, async () => {
+  const primary = new Error(`wrong public rows`)
+  const cleanup = new Error(`cleanup failed`)
+  const released: Array<string> = []
+  let failure: unknown
+
+  try {
+    await checkWithCleanup((register) => {
+      register(() => {
+        released.push(`source`)
+        throw cleanup
+      })
+      register(() => {
+        released.push(`query`)
+      })
+      throw primary
+    })
+  } catch (error) {
+    failure = error
+  }
+
+  expect(released).toEqual([`query`, `source`])
+  expect(failure).toBeInstanceOf(AggregateError)
+  expect((failure as AggregateError).cause).toBe(primary)
+  expect((failure as AggregateError).errors).toEqual([cleanup])
+})
diff --git a/packages/db/tests/query/ir-stable-identity-oracle.test.ts b/packages/db/tests/query/ir-stable-identity-oracle.test.ts
index fd66c1f50c..2827748f9f 100644
--- a/packages/db/tests/query/ir-stable-identity-oracle.test.ts
+++ b/packages/db/tests/query/ir-stable-identity-oracle.test.ts
@@ -1,6 +1,14 @@
-import { describe, expect, it, vi } from 'vitest'
+// Stable query identity law: two query IRs, expression values, or demand keys
+// share an identity only when they are equivalent under the relation that the
+// checks below state. The output model, interpretOutputProgram, is a direct
+// denotation of a finite literal and wrapper grammar. assertOutputProgram
+// compares each observation's compiled output and projected identity with that
+// denotation, so the generated programs and their calibrations run through it.
+// The generated properties check canonical boolean forms, IN candidates as a
+// set, alias renaming, and reference-valued captures against inputs they read.
+// Fixed scenarios and literal identities live in ir-stable-identity.test.ts.
+import { describe, expect, it } from 'vitest'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { Temporal } from 'temporal-polyfill'
 import {
   BaseQueryBuilder,
   createLiveQueryCollection,
@@ -12,91 +20,32 @@ import {
   GroupingOperatorRequiredError,
   IncludeOperatorRequiredError,
 } from '../../src/errors.js'
-import { includesRuntime } from '../../src/query/live/includes-runtime.js'
-import { CollectionImpl } from '../../src/collection/index.js'
+import { getPreparedLiveQueryIdentity } from '../../src/live-query-options.js'
 import { Query, getQueryIR } from '../../src/query/builder/index.js'
+import { caseWhen, count, eq } from '../../src/query/builder/functions.js'
+import { compileExpression } from '../../src/query/compiler/evaluators.js'
 import {
-  add,
-  and,
-  avg,
-  caseWhen,
-  coalesce,
-  concat,
-  count,
-  eq,
-  gt,
-  gte,
-  inArray,
-  isNull,
-  isUndefined,
-  length,
-  like,
-  lower,
-  lt,
-  max,
-  not,
-  or,
-  subtract,
-  sum,
-  upper,
-} from '../../src/query/builder/functions.js'
-import {
-  UnhashableQueryIRError,
   getLoadSubsetDemandKey,
   getQueryIdentity,
-  getStableQueryIRHash,
-  getStableValueHash,
 } from '../../src/query/ir-stable-identity.js'
-import {
-  CollectionRef,
-  Func,
-  IncludesSubquery,
-  PropRef,
-  QueryRef,
-  UnionAll,
-  Value,
-} from '../../src/query/ir.js'
-import {
-  compileExpression,
-  toBooleanPredicate,
-} from '../../src/query/compiler/evaluators.js'
-import {
-  createRuntimeReferenceIdentityFactory,
-  getRuntimeReferenceIdentity,
-} from '../../src/query/runtime-reference-identity.js'
-import { createValueIdentity } from '../../src/query/equality-value-identity.js'
-import { getPreparedLiveQueryIdentity } from '../../src/live-query-options.js'
+import { Func, IncludesSubquery, PropRef, Value } from '../../src/query/ir.js'
 import { oracleRuns } from '../oracle-config.js'
-import type { BasicExpression, OrderBy, QueryIR } from '../../src/query/ir.js'
-import type { LoadSubsetOptions } from '../../src/types.js'
-
-interface User {
-  id: number
-  name: string
-  email?: string | null
-  active: boolean
-  age: number
-  salary: number
-  status: `active` | `inactive`
-  teamId: string
-  departmentId: number | null
-  createdAt: Date
-  profile?: {
-    skills: Array<string>
-    experience: {
-      years: number
-    }
-  }
-  blob?: Uint8Array
-  largeViewCount?: bigint
-}
-
-function getProjectedExpressionIdentity(expression: BasicExpression): string {
-  return getQueryIdentity({
-    ...getQueryIR(new Query().from({ user: usersCollection })),
-    select: { value: expression },
-  })
-}
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  createAlphaRenamedIncludesQuery,
+  createAlphaRenamedJoinQuery,
+  createAlphaRenamedNestedQuery,
+  createCorrelatedUnionIncludesQuery,
+  createProfileValueQuery,
+  createProjectedExpressionQuery,
+  createUnionDerivedIncludesQuery,
+  createUnionDerivedNestedOutputQuery,
+  createUnionDerivedNestedQuery,
+  getProjectedExpressionIdentity,
+  postsCollection,
+  usersCollection,
+} from './ir-stable-identity-support.js'
+import type { BasicExpression, QueryIR } from '../../src/query/ir.js'
 
 const referenceSemanticPairArbitrary = fc.oneof(
   fc
@@ -284,33 +233,9 @@ const outputProgramArbitrary: fc.Arbitrary<OutputProgram> = fc.record({
   ),
 })
 
-interface Post {
-  id: number
-  userId: number
-  title: string
-  published: boolean
-  views: number
-  createdAt: Date
-}
-
-const usersCollection = new CollectionImpl<User>({
-  id: `users`,
-  getKey: (item) => item.id,
-  sync: { sync: () => {} },
-})
-
-describe(`stable runtime value hashing`, () => {
-  it(`normalizes object key order`, () => {
-    expect(getStableValueHash([`todos`, { status: `open`, page: 1 }])).toBe(
-      getStableValueHash([`todos`, { page: 1, status: `open` }]),
-    )
-  })
-
-  it(`reports the path of an unhashable query key value`, () => {
-    expect(() =>
-      getStableValueHash([`todos`, { predicate: () => true }], `queryKey`),
-    ).toThrow(/queryKey\[1\]\.predicate/)
-  })
+declareOracle({
+  check: [expectIdentitySharingMatchesOutcome],
+  model: [interpretOutputProgram, modelOutcome],
 })
 
 describe(`semantic expression identity`, () => {
@@ -389,52 +314,6 @@ describe(`semantic expression identity`, () => {
     },
   )
 
-  it(`normalizes associative, commutative, and idempotent boolean forms`, () => {
-    const adult = new Func<boolean>(`gte`, [age, new Value(18)])
-    const enabled = new Func<boolean>(`eq`, [active, new Value(true)])
-    const nested = new Func<boolean>(`and`, [
-      enabled,
-      new Func<boolean>(`and`, [adult, enabled]),
-    ])
-    const flat = new Func<boolean>(`and`, [adult, enabled])
-
-    expect(getProjectedExpressionIdentity(nested)).toBe(
-      getProjectedExpressionIdentity(flat),
-    )
-    expect(getProjectedExpressionIdentity(new Func(`or`, [adult, adult]))).toBe(
-      getProjectedExpressionIdentity(new Func(`or`, [adult])),
-    )
-  })
-
-  it(`keeps a boolean wrapper when duplicate operands coerce their result`, () => {
-    const bareAge = new PropRef<number>([`user`, `age`])
-    const duplicateAnd = new Func<boolean>(`and`, [bareAge, bareAge])
-    const row = { user: { age: 18 } }
-
-    expect(toBooleanPredicate(compileExpression(bareAge)(row))).toBe(false)
-    expect(toBooleanPredicate(compileExpression(duplicateAnd)(row))).toBe(true)
-    expect(getProjectedExpressionIdentity(duplicateAnd)).not.toBe(
-      getProjectedExpressionIdentity(bareAge),
-    )
-  })
-
-  it(`normalizes equality and reversed inequalities`, () => {
-    expect(
-      getProjectedExpressionIdentity(new Func(`eq`, [age, new Value(18)])),
-    ).toBe(getProjectedExpressionIdentity(new Func(`eq`, [new Value(18), age])))
-    expect(
-      getProjectedExpressionIdentity(new Func(`gt`, [age, new Value(18)])),
-    ).toBe(getProjectedExpressionIdentity(new Func(`lt`, [new Value(18), age])))
-  })
-
-  it(`preserves order-sensitive function arguments`, () => {
-    expect(
-      getProjectedExpressionIdentity(new Func(`subtract`, [age, new Value(1)])),
-    ).not.toBe(
-      getProjectedExpressionIdentity(new Func(`subtract`, [new Value(1), age])),
-    )
-  })
-
   fcTest.prop([
     equivalentExpressionPairArbitrary,
     fc.record({ age: fc.integer(), active: fc.boolean() }),
@@ -471,137 +350,6 @@ describe(`semantic expression identity`, () => {
     },
   )
 
-  it(`does not initialize runtime reference identities during module evaluation`, async () => {
-    const getRandomValues = vi.fn((values: Uint32Array) => values)
-    vi.stubGlobal(`crypto`, { getRandomValues })
-    vi.resetModules()
-
-    try {
-      const { getRuntimeReferenceIdentity: getFreshRuntimeReferenceIdentity } =
-        await import(`../../src/query/runtime-reference-identity.js`)
-
-      expect(getRandomValues).not.toHaveBeenCalled()
-
-      getFreshRuntimeReferenceIdentity({})
-      getFreshRuntimeReferenceIdentity({})
-
-      expect(getRandomValues).toHaveBeenCalledOnce()
-    } finally {
-      vi.unstubAllGlobals()
-    }
-  })
-
-  it(`does not reuse reference identities across runtimes`, () => {
-    const firstRuntime = createRuntimeReferenceIdentityFactory()
-    const secondRuntime = createRuntimeReferenceIdentityFactory()
-
-    expect(firstRuntime({ a: 1 })).not.toEqual(secondRuntime({ b: 2 }))
-  })
-
-  it(`allocates runtime entropy only when the first identity is requested`, () => {
-    const getRandomValues = vi.fn((values: Uint32Array) => values)
-    vi.stubGlobal(`crypto`, { getRandomValues })
-    try {
-      const runtime = createRuntimeReferenceIdentityFactory()
-      expect(getRandomValues).not.toHaveBeenCalled()
-
-      runtime({})
-      runtime({})
-      expect(getRandomValues).toHaveBeenCalledOnce()
-    } finally {
-      vi.unstubAllGlobals()
-    }
-  })
-
-  it(`keeps symbol identities stable and distinct`, () => {
-    const first = Symbol(`value`)
-    const second = Symbol(`value`)
-
-    expect(getRuntimeReferenceIdentity(first)).toEqual(
-      getRuntimeReferenceIdentity(first),
-    )
-    expect(getRuntimeReferenceIdentity(first)).not.toEqual(
-      getRuntimeReferenceIdentity(second),
-    )
-  })
-
-  it(`does not retain symbols in strong identity maps when weak symbol keys are supported`, () => {
-    const NativeMap = Map
-    const stronglyStoredSymbols = new Set<symbol>()
-    class TrackingMap<K, V> extends NativeMap<K, V> {
-      override set(key: K, value: V): this {
-        if (typeof key === `symbol`) stronglyStoredSymbols.add(key)
-        return super.set(key, value)
-      }
-    }
-    const local = Symbol(`local`)
-    const registered = Symbol.for(
-      `tanstack-db-runtime-reference-test-${Date.now()}`,
-    )
-
-    vi.stubGlobal(`Map`, TrackingMap)
-    try {
-      const runtime = createRuntimeReferenceIdentityFactory()
-      runtime(local)
-      runtime(registered)
-    } finally {
-      vi.unstubAllGlobals()
-    }
-
-    expect(stronglyStoredSymbols).not.toContain(local)
-    expect(stronglyStoredSymbols).not.toContain(registered)
-  })
-
-  it(`keeps correct symbol identity when weak symbol keys are unavailable`, () => {
-    const NativeWeakMap = WeakMap
-    class ObjectOnlyWeakMap<K extends object, V> extends NativeWeakMap<K, V> {
-      override set(key: K, value: V): this {
-        if (typeof key === `symbol`) {
-          throw new TypeError(`Symbols cannot be weak keys`)
-        }
-        return super.set(key, value)
-      }
-    }
-    const first = Symbol(`value`)
-    const second = Symbol(`value`)
-
-    vi.stubGlobal(`WeakMap`, ObjectOnlyWeakMap)
-    try {
-      const runtime = createRuntimeReferenceIdentityFactory()
-
-      expect(runtime(first)).toEqual(runtime(first))
-      expect(runtime(first)).not.toEqual(runtime(second))
-    } finally {
-      vi.unstubAllGlobals()
-    }
-  })
-
-  it(`scopes opaque value identities to their owner`, () => {
-    const firstScope = createValueIdentity()
-    const secondScope = createValueIdentity()
-    const first = Symbol(`value`)
-    const second = Symbol(`value`)
-
-    expect(firstScope.equality(first)).toEqual(firstScope.equality(first))
-    expect(firstScope.equality(first)).not.toEqual(firstScope.equality(second))
-    expect(firstScope.equality(first)).not.toEqual(secondScope.equality(first))
-  })
-
-  it(`falls back when the runtime crypto object lacks getRandomValues`, () => {
-    vi.stubGlobal(`crypto`, {})
-    try {
-      const runtime = createRuntimeReferenceIdentityFactory()
-
-      expect(runtime({ a: 1 })).toEqual([
-        `runtimeReference`,
-        expect.any(String),
-        1,
-      ])
-    } finally {
-      vi.unstubAllGlobals()
-    }
-  })
-
   fcTest.prop([
     fc.uniqueArray(fc.oneof(fc.integer(), fc.string(), fc.boolean()), {
       minLength: 1,
@@ -640,777 +388,7 @@ describe(`semantic expression identity`, () => {
   })
 })
 
-describe(`loadSubset demand identity`, () => {
-  it(`preserves legacy nested-ref identity and distinguishes explicit qualification`, () => {
-    const nested = new PropRef([`profile`, `score`])
-    const qualified = new PropRef([`profile`, `score`], `profile`)
-
-    expect(getLoadSubsetDemandKey({ where: nested })).toBe(
-      `{"type":"loadSubsetDemand","query":{"type":"loadSubsetQuery","where":{"type":"ref","path":[["string","profile"],["string","score"]]}}}`,
-    )
-    expect(getLoadSubsetDemandKey({ where: qualified })).not.toBe(
-      getLoadSubsetDemandKey({ where: nested }),
-    )
-    expect(JSON.stringify(nested)).toBe(
-      `{"path":["profile","score"],"type":"ref"}`,
-    )
-  })
-
-  it(`gives an unqualified ref no source alias property`, () => {
-    expect(Object.hasOwn(new PropRef([`profile`]), `sourceAlias`)).toBe(false)
-    expect(
-      Object.hasOwn(
-        new PropRef([`profile`, `score`], `profile`),
-        `sourceAlias`,
-      ),
-    ).toBe(true)
-  })
-
-  const id = new PropRef<string>([`id`])
-  const group = new PropRef<string>([`group`])
-  const first = new Func<boolean>(`eq`, [id, new Value(`a`)])
-  const second = new Func<boolean>(`eq`, [group, new Value(`x`)])
-  const orderBy: NonNullable<LoadSubsetOptions[`orderBy`]> = [
-    {
-      expression: id,
-      compareOptions: { direction: `asc`, nulls: `first` },
-    },
-    {
-      expression: group,
-      compareOptions: { direction: `desc`, nulls: `last` },
-    },
-  ]
-
-  it(`includes the exact requested window`, () => {
-    const narrow = { where: first, orderBy, limit: 10, offset: 5 }
-    const wide = { where: first, orderBy, limit: 20, offset: 0 }
-
-    expect(getLoadSubsetDemandKey(narrow)).not.toBe(
-      getLoadSubsetDemandKey(wide),
-    )
-  })
-
-  it(`normalizes predicates but preserves orderBy sequence`, () => {
-    const left = new Func<boolean>(`and`, [first, second])
-    const right = new Func<boolean>(`and`, [second, first])
-
-    expect(getLoadSubsetDemandKey({ where: left, orderBy })).toBe(
-      getLoadSubsetDemandKey({ where: right, orderBy }),
-    )
-    expect(getLoadSubsetDemandKey({ where: left, orderBy })).not.toBe(
-      getLoadSubsetDemandKey({ where: right, orderBy: [...orderBy].reverse() }),
-    )
-  })
-
-  it(`includes cursor shape and excludes runtime owners`, () => {
-    const cursor = {
-      whereFrom: new Func<boolean>(`gt`, [id, new Value(`a`)]),
-      whereCurrent: first,
-      lastKey: `a`,
-    }
-    const firstOwner = new AbortController()
-    const secondOwner = new AbortController()
-    const subscription = {} as NonNullable<LoadSubsetOptions[`subscription`]>
-
-    expect(
-      getLoadSubsetDemandKey({
-        where: first,
-        cursor,
-        signal: firstOwner.signal,
-        subscription,
-      }),
-    ).toBe(
-      getLoadSubsetDemandKey({
-        where: first,
-        cursor,
-        signal: secondOwner.signal,
-      }),
-    )
-    expect(getLoadSubsetDemandKey({ where: first, cursor })).not.toBe(
-      getLoadSubsetDemandKey({
-        where: first,
-        cursor: { ...cursor, lastKey: `b` },
-      }),
-    )
-  })
-
-  it(`uses the base query key for an unconstrained owner-only demand`, () => {
-    expect(getLoadSubsetDemandKey({})).toBeUndefined()
-    expect(getLoadSubsetDemandKey({ offset: 0 })).toBeUndefined()
-    expect(
-      getLoadSubsetDemandKey({ signal: new AbortController().signal }),
-    ).toBeUndefined()
-    expect(getLoadSubsetDemandKey({ where: first, offset: 0 })).toBe(
-      getLoadSubsetDemandKey({ where: first }),
-    )
-  })
-
-  it.each([
-    [`function`, () => `value`, () => `value`],
-    [`symbol`, Symbol(`value`), Symbol(`value`)],
-  ])(`uses runtime reference identity for %s demand values`, (_name, a, b) => {
-    const field = new PropRef<unknown>([`row`, `value`])
-    const demand = (value: unknown): LoadSubsetOptions => ({
-      where: new Func(`eq`, [field, new Value(value)]),
-    })
-
-    expect(getLoadSubsetDemandKey(demand(a))).toBe(
-      getLoadSubsetDemandKey(demand(a)),
-    )
-    expect(getLoadSubsetDemandKey(demand(a))).not.toBe(
-      getLoadSubsetDemandKey(demand(b)),
-    )
-  })
-
-  it(`uses exact custom comparator identity for order terms`, () => {
-    const compare = (a: string, b: string) => a.length - b.length
-    const orderByFor = (candidate: typeof compare): OrderBy => [
-      {
-        expression: new PropRef([`row`, `label`]),
-        compareOptions: {
-          direction: `asc` as const,
-          nulls: `first` as const,
-          stringSort: `custom`,
-          compare: candidate,
-        },
-      },
-    ]
-    const queryFor = (candidate: typeof compare): QueryIR => ({
-      ...getQueryIR(new Query().from({ user: usersCollection })),
-      orderBy: [
-        {
-          expression: new PropRef([`user`, `name`]),
-          compareOptions: {
-            direction: `asc`,
-            nulls: `first`,
-            stringSort: `custom`,
-            compare: candidate,
-          },
-        },
-      ],
-    })
-    const clone = (a: string, b: string) => a.length - b.length
-
-    expect(getLoadSubsetDemandKey({ orderBy: orderByFor(compare) })).toBe(
-      getLoadSubsetDemandKey({ orderBy: orderByFor(compare) }),
-    )
-    expect(getLoadSubsetDemandKey({ orderBy: orderByFor(compare) })).not.toBe(
-      getLoadSubsetDemandKey({ orderBy: orderByFor(clone) }),
-    )
-    expect(getQueryIdentity(queryFor(compare))).toBe(
-      getQueryIdentity(queryFor(compare)),
-    )
-    expect(getQueryIdentity(queryFor(compare))).not.toBe(
-      getQueryIdentity(queryFor(clone)),
-    )
-  })
-
-  it.each([
-    [`signed zero`, -0, 0],
-    [`invalid Date`, new Date(Number.NaN), new Date(Number.NaN)],
-    [
-      `Temporal.PlainDate`,
-      Temporal.PlainDate.from(`2024-01-15`),
-      Temporal.PlainDate.from(`2024-01-15`),
-    ],
-    [
-      `Temporal.Duration`,
-      Temporal.Duration.from(`PT1H`),
-      Temporal.Duration.from(`PT1H`),
-    ],
-    [
-      `large cross-constructor binary`,
-      new Uint8Array(129).fill(7),
-      Buffer.from(new Uint8Array(129).fill(7)),
-    ],
-  ])(
-    `uses comparison semantics for equivalent %s values`,
-    (_label, firstValue, secondValue) => {
-      const value = new PropRef<unknown>([`row`, `value`])
-      const firstPredicate = new Func<boolean>(`eq`, [
-        value,
-        new Value(firstValue),
-      ])
-      const secondPredicate = new Func<boolean>(`eq`, [
-        value,
-        new Value(secondValue),
-      ])
-
-      expect(
-        compileExpression(firstPredicate)({ row: { value: secondValue } }),
-      ).toBe(true)
-      expect(getProjectedExpressionIdentity(firstPredicate)).toBe(
-        getProjectedExpressionIdentity(secondPredicate),
-      )
-      expect(getLoadSubsetDemandKey({ where: firstPredicate })).toBe(
-        getLoadSubsetDemandKey({ where: secondPredicate }),
-      )
-      expect(getQueryIdentity(createProfileValueQuery(firstValue))).toBe(
-        getQueryIdentity(createProfileValueQuery(secondValue)),
-      )
-    },
-  )
-})
-
-const postsCollection = new CollectionImpl<Post>({
-  id: `posts`,
-  getKey: (item) => item.id,
-  sync: { sync: () => {} },
-})
-
-function createProfileValueQuery(value: unknown): QueryIR {
-  return {
-    ...getQueryIR(new Query().from({ user: usersCollection })),
-    where: [
-      new Func<boolean>(`eq`, [
-        new PropRef([`user`, `profile`]),
-        new Value(value),
-      ]),
-    ],
-  }
-}
-
-function createAlphaRenamedJoinQuery(
-  userAlias: string,
-  postAlias: string,
-): QueryIR {
-  return {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      userAlias,
-    ),
-    join: [
-      {
-        type: `inner`,
-        from: new CollectionRef(
-          postsCollection as unknown as ConstructorParameters<
-            typeof CollectionRef
-          >[0],
-          postAlias,
-        ),
-        on: new Func('eq', [
-          new PropRef([userAlias, `id`]),
-          new PropRef([postAlias, `userId`]),
-        ]),
-      },
-    ],
-    where: [
-      new Func(`eq`, [new PropRef([postAlias, `published`]), new Value(true)]),
-    ],
-    select: {
-      userId: new PropRef([userAlias, `id`]),
-      postTitle: new PropRef([postAlias, `title`]),
-    },
-    orderBy: [
-      {
-        expression: new PropRef([postAlias, `createdAt`]),
-        compareOptions: { direction: `desc`, nulls: `last` },
-      },
-    ],
-  }
-}
-
-function createAlphaRenamedImplicitJoinQuery(
-  userAlias: string,
-  postAlias: string,
-): QueryIR {
-  return {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      userAlias,
-    ),
-    join: [
-      {
-        type: `inner`,
-        from: new CollectionRef(
-          postsCollection as unknown as ConstructorParameters<
-            typeof CollectionRef
-          >[0],
-          postAlias,
-        ),
-        on: new Func('eq', [
-          new PropRef([userAlias, `id`]),
-          new PropRef([postAlias, `userId`]),
-        ]),
-      },
-    ],
-  }
-}
-
-function createProjectedExpressionQuery(expression: BasicExpression): QueryIR {
-  return {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      `user`,
-    ),
-    select: { value: expression },
-  }
-}
-
-function createAlphaRenamedNestedQuery(
-  innerAlias: string,
-  outerAlias: string,
-): QueryIR {
-  const inner: QueryIR = {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      innerAlias,
-    ),
-    select: {
-      id: new PropRef([innerAlias, `id`]),
-      status: new PropRef([innerAlias, `status`]),
-    },
-  }
-  return {
-    from: new QueryRef(inner, outerAlias),
-    where: [
-      new Func(`eq`, [
-        new PropRef([outerAlias, `status`]),
-        new Value(`active`),
-      ]),
-    ],
-    select: { id: new PropRef([outerAlias, `id`]) },
-  }
-}
-
-function createUnionDerivedNestedQuery(outerAlias: string): QueryIR {
-  const users = new Query()
-    .from({ user: usersCollection })
-    .select(({ user }) => ({ id: user.id, kind: user.status }))
-  const posts = new Query()
-    .from({ post: postsCollection })
-    .select(({ post }) => ({ id: post.id, kind: post.title }))
-  const union = new Query()
-    .unionAll(users, posts)
-    .where(({ kind }) => eq(kind, `active`))
-
-  return getQueryIR(
-    new Query().from({ [outerAlias]: union } as Record<string, typeof union>),
-  )
-}
-
-function createUnionDerivedNestedOutputQuery(outerAlias: string): QueryIR {
-  const users = new Query()
-    .from({ user: usersCollection })
-    .select(({ user }) => ({ profile: { id: user.id } }))
-  const posts = new Query()
-    .from({ post: postsCollection })
-    .select(({ post }) => ({ profile: { id: post.id } }))
-  const union = new Query()
-    .unionAll(users, posts)
-    .where(({ profile }) => eq(profile.id, 1))
-
-  return getQueryIR(
-    new Query().from({ [outerAlias]: union } as Record<string, typeof union>),
-  )
-}
-
-function createUnionDerivedIncludesQuery(parentAlias: string): QueryIR {
-  const firstPosts = new Query()
-    .from({ post: postsCollection })
-    .select(({ post }) => ({ id: post.id, userId: post.userId }))
-  const secondPosts = new Query()
-    .from({ otherPost: postsCollection })
-    .select(({ otherPost }) => ({
-      id: otherPost.id,
-      userId: otherPost.userId,
-    }))
-  const childQuery = getQueryIR(new Query().unionAll(firstPosts, secondPosts))
-  const posts = new IncludesSubquery(
-    childQuery,
-    new PropRef([parentAlias, `id`]),
-    new PropRef([`userId`]),
-    `posts`,
-    includesRuntime,
-    undefined,
-    undefined,
-    `array`,
-  )
-
-  return {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      parentAlias,
-    ),
-    select: {
-      id: new PropRef([parentAlias, `id`]),
-      posts,
-    },
-  }
-}
-
-function createCorrelatedUnionIncludesQuery(parentAlias: string): QueryIR {
-  const createBranch = (childAlias: string): QueryIR => ({
-    from: new CollectionRef(
-      postsCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      childAlias,
-    ),
-    select: {
-      profile: { id: new PropRef([childAlias, `id`]) },
-      userId: new PropRef([childAlias, `userId`]),
-      parentAge: new PropRef([parentAlias, `age`]),
-    },
-  })
-  const childQuery: QueryIR = {
-    from: new UnionAll([createBranch(`firstPost`), createBranch(`secondPost`)]),
-    where: [new Func(`eq`, [new PropRef([`profile`, `id`]), new Value(1)])],
-  }
-  const posts = new IncludesSubquery(
-    childQuery,
-    new PropRef([parentAlias, `id`]),
-    new PropRef([`userId`]),
-    `posts`,
-    includesRuntime,
-    undefined,
-    [new PropRef([parentAlias, `age`])],
-    `array`,
-  )
-
-  return {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      parentAlias,
-    ),
-    select: {
-      id: new PropRef([parentAlias, `id`]),
-      posts,
-    },
-  }
-}
-
-function createAlphaRenamedIncludesQuery(
-  parentAlias: string,
-  childAlias: string,
-): QueryIR {
-  const childQuery: QueryIR = {
-    from: new CollectionRef(
-      postsCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      childAlias,
-    ),
-    select: {
-      id: new PropRef([childAlias, `id`]),
-      title: new PropRef([childAlias, `title`]),
-    },
-  }
-  const posts = new IncludesSubquery(
-    childQuery,
-    new PropRef([parentAlias, `id`]),
-    new PropRef([childAlias, `userId`]),
-    `posts`,
-    includesRuntime,
-    [
-      new Func(`eq`, [
-        new PropRef([parentAlias, `status`]),
-        new Value(`active`),
-      ]),
-    ],
-    [new PropRef([parentAlias, `id`])],
-    `array`,
-  )
-  return {
-    from: new CollectionRef(
-      usersCollection as unknown as ConstructorParameters<
-        typeof CollectionRef
-      >[0],
-      parentAlias,
-    ),
-    select: {
-      id: new PropRef([parentAlias, `id`]),
-      posts,
-    },
-  }
-}
-
-const structuredQueries: Array<[string, () => QueryIR]> = [
-  [
-    `basic collection source`,
-    () => getQueryIR(new Query().from({ user: usersCollection })),
-  ],
-  [
-    `captured primitive where value`,
-    () => {
-      const status = `active` as const
-      return getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) => eq(user.status, status)),
-      )
-    },
-  ],
-  [
-    `boolean expression tree`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) =>
-            and(
-              eq(user.active, true),
-              or(gt(user.age, 30), not(isNull(user.email))),
-            ),
-          ),
-      ),
-  ],
-  [
-    `array membership and undefined checks`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) =>
-            and(
-              inArray(user.teamId, [`eng`, `design`]),
-              not(isUndefined(user.profile)),
-            ),
-          ),
-      ),
-  ],
-  [
-    `date bigint and typed array values`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) =>
-            and(
-              gte(user.createdAt, new Date(`2024-01-01T00:00:00.000Z`)),
-              gt(user.largeViewCount, 9007199254740993n),
-              eq(user.blob, new Uint8Array([1, 2, 3])),
-            ),
-          ),
-      ),
-  ],
-  [
-    `plain object values`,
-    () =>
-      getQueryIR(
-        new Query().from({ user: usersCollection }).where(({ user }) =>
-          eq(user.profile, {
-            experience: { years: 5 },
-            skills: [`ts`, `db`],
-          }),
-        ),
-      ),
-  ],
-  [
-    `nested select and computed expressions`,
-    () =>
-      getQueryIR(
-        new Query().from({ user: usersCollection }).select(({ user }) => ({
-          id: user.id,
-          displayName: concat(upper(user.name), ` <`, lower(user.email), `>`),
-          score: add(user.salary, 1000),
-          fallbackEmail: coalesce(user.email, `missing@example.com`),
-          meta: {
-            active: user.active,
-            nameLength: length(user.name),
-          },
-        })),
-      ),
-  ],
-  [
-    `conditional projection select`,
-    () =>
-      getQueryIR(
-        new Query().from({ user: usersCollection }).select(({ user }) => ({
-          id: user.id,
-          profile: caseWhen(
-            gt(user.age, 18),
-            {
-              label: `adult`,
-              email: user.email,
-            },
-            {
-              label: `minor`,
-              email: null,
-            },
-          ),
-        })),
-      ),
-  ],
-  [
-    `top-level alias spread select`,
-    () =>
-      getQueryIR(
-        new Query().from({ user: usersCollection }).select(({ user }) => user),
-      ),
-  ],
-  [
-    `locale orderBy options`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .orderBy(({ user }) => user.name, {
-            direction: `asc`,
-            nulls: `last`,
-            stringSort: `locale`,
-            locale: `en-US`,
-            localeOptions: { sensitivity: `base`, numeric: true },
-          }),
-      ),
-  ],
-  [
-    `groupBy aggregates and selected orderBy`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .groupBy(({ user }) => user.teamId)
-          .select(({ user }) => ({
-            teamId: user.teamId,
-            userCount: count(user.id),
-            avgAge: avg(user.age),
-            totalSalary: sum(user.salary),
-            latestSignup: max(user.createdAt),
-          }))
-          .having(({ $selected }) => gt($selected.userCount, 1))
-          .orderBy(({ $selected }) => $selected.avgAge, `desc`),
-      ),
-  ],
-  [
-    `join query`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .join(
-            { post: postsCollection },
-            ({ user, post }) => eq(user.id, post.userId),
-            `left`,
-          )
-          .where(({ post }) => eq(post.published, true))
-          .select(({ user, post }) => ({
-            userId: user.id,
-            postTitle: post.title,
-          })),
-      ),
-  ],
-  [
-    `subquery join`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({
-            post: new Query()
-              .from({ post: postsCollection })
-              .where(({ post }) => gt(post.views, 100)),
-          })
-          .join(
-            {
-              activeUser: new Query()
-                .from({ user: usersCollection })
-                .where(({ user }) => eq(user.status, `active`)),
-            },
-            ({ post, activeUser }) => eq(post.userId, activeUser.id),
-            `inner`,
-          ),
-      ),
-  ],
-  [
-    `unioned source object`,
-    () =>
-      getQueryIR(
-        new Query().unionAll({ user: usersCollection, post: postsCollection }),
-      ),
-  ],
-  [
-    `unioned query branches`,
-    () =>
-      getQueryIR(
-        new Query().unionAll(
-          new Query().from({ user: usersCollection }).select(({ user }) => ({
-            id: user.id,
-            label: user.name,
-          })),
-          new Query().from({ post: postsCollection }).select(({ post }) => ({
-            id: post.id,
-            label: post.title,
-          })),
-        ),
-      ),
-  ],
-  [
-    `includes subquery`,
-    () =>
-      getQueryIR(
-        new Query().from({ user: usersCollection }).select(({ user }) => ({
-          id: user.id,
-          posts: include(
-            new Query()
-              .from({ post: postsCollection })
-              .where(({ post }) => eq(post.userId, user.id))
-              .select(({ post }) => ({
-                id: post.id,
-                title: post.title,
-              })),
-          ),
-        })),
-      ),
-  ],
-  [
-    `pagination shape`,
-    () =>
-      getQueryIR(
-        new Query()
-          .from({ post: postsCollection })
-          .where(({ post }) => like(post.title, `%db%`))
-          .orderBy(({ post }) => post.createdAt, `desc`)
-          .offset(20)
-          .limit(10),
-      ),
-  ],
-]
-
 describe(`stable QueryIR identity smoke test`, () => {
-  it(`can derive identity for representative structured query shapes`, () => {
-    expect(structuredQueries).toHaveLength(17)
-
-    const hashes = structuredQueries.map(([name, createQuery]) => {
-      const hash = getStableQueryIRHash(createQuery())
-      expect(hash, name).toContain(`"type":"query"`)
-      expect(() => JSON.parse(hash), name).not.toThrow()
-      return hash
-    })
-
-    expect(new Set(hashes).size).toBe(hashes.length)
-  })
-
-  it(`does not depend on collection object identity when ids match`, () => {
-    const otherUsersCollection = new CollectionImpl<User>({
-      id: `users`,
-      getKey: (item) => item.id,
-      sync: { sync: () => {} },
-    })
-
-    const createQuery = (collection: CollectionImpl<User>) =>
-      getQueryIR(
-        new Query()
-          .from({ user: collection })
-          .where(({ user }) => eq(user.status, `active`)),
-      )
-
-    expect(getStableQueryIRHash(createQuery(usersCollection))).toBe(
-      getStableQueryIRHash(createQuery(otherUsersCollection)),
-    )
-  })
-
   fcTest.prop([
     fc.uniqueArray(fc.stringMatching(/^[a-z][a-z0-9]{0,8}$/), {
       minLength: 4,
@@ -1438,81 +416,6 @@ describe(`stable QueryIR identity smoke test`, () => {
     )
   })
 
-  it(`keeps aliases that define an implicit joined result shape`, () => {
-    expect(
-      getQueryIdentity(createAlphaRenamedImplicitJoinQuery(`user`, `post`)),
-    ).not.toBe(
-      getQueryIdentity(
-        createAlphaRenamedImplicitJoinQuery(`account`, `article`),
-      ),
-    )
-  })
-
-  it(`keeps aliases that define an implicit union-source result shape`, () => {
-    const usersAndPosts = getQueryIR(
-      new Query().unionAll({
-        user: usersCollection,
-        post: postsCollection,
-      }),
-    )
-    const accountsAndArticles = getQueryIR(
-      new Query().unionAll({
-        account: usersCollection,
-        article: postsCollection,
-      }),
-    )
-
-    expect(usersAndPosts.from.type).toBe(`unionFrom`)
-    expect(getQueryIdentity(usersAndPosts)).not.toBe(
-      getQueryIdentity(accountsAndArticles),
-    )
-  })
-
-  it(`keeps aliases when an empty groupBy still selects a namespaced row`, () => {
-    const createQuery = (alias: string) =>
-      getQueryIR(
-        new Query()
-          .from({ [alias]: usersCollection } as Record<
-            string,
-            typeof usersCollection
-          >)
-          .groupBy(() => []),
-      )
-
-    expect(getQueryIdentity(createQuery(`user`))).not.toBe(
-      getQueryIdentity(createQuery(`account`)),
-    )
-  })
-
-  it(`keeps output-producing runtime values exact`, () => {
-    const bufferExpression = new Func(`concat`, [new Value(Buffer.from([65]))])
-    const uint8Expression = new Func(`concat`, [
-      new Value(new Uint8Array([65])),
-    ])
-
-    expect(compileExpression(bufferExpression)({})).toBe(`A`)
-    expect(compileExpression(uint8Expression)({})).toBe(`65`)
-    expect(
-      getQueryIdentity(createProjectedExpressionQuery(bufferExpression)),
-    ).not.toBe(
-      getQueryIdentity(createProjectedExpressionQuery(uint8Expression)),
-    )
-
-    expect(
-      getQueryIdentity(createProjectedExpressionQuery(new Value(-0))),
-    ).not.toBe(getQueryIdentity(createProjectedExpressionQuery(new Value(0))))
-
-    const firstObject = { value: 1 }
-    const secondObject = { value: 1 }
-    expect(
-      getQueryIdentity(createProjectedExpressionQuery(new Value(firstObject))),
-    ).not.toBe(
-      getQueryIdentity(createProjectedExpressionQuery(new Value(secondObject))),
-    )
-    expect(compileExpression(new Value(firstObject))({})).toBe(firstObject)
-    expect(compileExpression(new Value(secondObject))({})).toBe(secondObject)
-  })
-
   fcTest.prop([outputExpressionPairArbitrary])(
     `equal query identities imply equal projected expression results`,
     ({ first, second }) => {
@@ -1603,152 +506,6 @@ describe(`stable QueryIR identity smoke test`, () => {
     ).toBe(getQueryIdentity(createCorrelatedUnionIncludesQuery(alias)))
   })
 
-  it(`shares identity across equivalent predicate formulations`, () => {
-    const left = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .where(({ user }) => and(eq(user.status, `active`), gt(user.age, 18))),
-    )
-    const right = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .where(({ user }) => and(lt(18, user.age), eq(`active`, user.status))),
-    )
-
-    expect(getQueryIdentity(left)).toBe(getQueryIdentity(right))
-  })
-
-  it(`normalizes the implicit conjunction order of repeated where clauses`, () => {
-    const left = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .where(({ user }) => eq(user.status, `active`))
-        .where(({ user }) => gt(user.age, 18)),
-    )
-    const right = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .where(({ user }) => gt(user.age, 18))
-        .where(({ user }) => eq(user.status, `active`)),
-    )
-    const duplicate = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .where(({ user }) => eq(user.status, `active`))
-        .where(({ user }) => gt(user.age, 18))
-        .where(({ user }) => eq(user.status, `active`)),
-    )
-
-    expect(getQueryIdentity(left)).toBe(getQueryIdentity(right))
-    expect(getQueryIdentity(left)).toBe(getQueryIdentity(duplicate))
-  })
-
-  it(`normalizes the implicit conjunction order of repeated having clauses`, () => {
-    const left = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .groupBy(({ user }) => user.teamId)
-        .select(({ user }) => ({
-          teamId: user.teamId,
-          userCount: count(user.id),
-          averageAge: avg(user.age),
-        }))
-        .having(({ $selected }) => gt($selected.userCount, 1))
-        .having(({ $selected }) => gt($selected.averageAge, 18)),
-    )
-    const right = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .groupBy(({ user }) => user.teamId)
-        .select(({ user }) => ({
-          teamId: user.teamId,
-          userCount: count(user.id),
-          averageAge: avg(user.age),
-        }))
-        .having(({ $selected }) => gt($selected.averageAge, 18))
-        .having(({ $selected }) => gt($selected.userCount, 1)),
-    )
-
-    expect(getQueryIdentity(left)).toBe(getQueryIdentity(right))
-  })
-
-  it(`includes a query plan's result window`, () => {
-    const createQuery = (limit: number) =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .orderBy(({ user }) => user.age)
-          .limit(limit),
-      )
-
-    expect(getQueryIdentity(createQuery(10))).not.toBe(
-      getQueryIdentity(createQuery(20)),
-    )
-  })
-
-  it(`elides the default query offset`, () => {
-    const base = getQueryIR(new Query().from({ user: usersCollection }))
-    const offsetZero = getQueryIR(
-      new Query().from({ user: usersCollection }).offset(0),
-    )
-
-    expect(getQueryIdentity(base)).toBe(getQueryIdentity(offsetZero))
-  })
-
-  it(`preserves function-argument and orderBy-clause order`, () => {
-    const subtractAge = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .orderBy(({ user }) => subtract(user.age, 1))
-        .orderBy(({ user }) => user.name),
-    )
-    const subtractFromOne = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .orderBy(({ user }) => subtract(1, user.age))
-        .orderBy(({ user }) => user.name),
-    )
-    const reversedClauses = getQueryIR(
-      new Query()
-        .from({ user: usersCollection })
-        .orderBy(({ user }) => user.name)
-        .orderBy(({ user }) => subtract(user.age, 1)),
-    )
-
-    expect(getQueryIdentity(subtractAge)).not.toBe(
-      getQueryIdentity(subtractFromOne),
-    )
-    expect(getQueryIdentity(subtractAge)).not.toBe(
-      getQueryIdentity(reversedClauses),
-    )
-  })
-
-  it(`preserves semantically significant union source ordering`, () => {
-    const usersThenPosts = getQueryIR(
-      new Query().unionAll({ user: usersCollection, post: postsCollection }),
-    )
-    const postsThenUsers = getQueryIR(
-      new Query().unionAll({ post: postsCollection, user: usersCollection }),
-    )
-
-    expect(getStableQueryIRHash(usersThenPosts)).not.toBe(
-      getStableQueryIRHash(postsThenUsers),
-    )
-  })
-
-  it(`changes identity when captured structured values change`, () => {
-    const createQuery = (status: User[`status`]) =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) => eq(user.status, status)),
-      )
-
-    expect(getStableQueryIRHash(createQuery(`active`))).not.toBe(
-      getStableQueryIRHash(createQuery(`inactive`)),
-    )
-  })
-
   fcTest.prop([referenceSemanticPairArbitrary])(
     `keeps queries distinct when captured values compare by reference`,
     ([first, second]) => {
@@ -1765,134 +522,45 @@ describe(`stable QueryIR identity smoke test`, () => {
       )
     },
   )
+})
 
-  it(`uses evaluator semantics for invalid Date and Temporal values`, () => {
-    expect(getQueryIdentity(createProfileValueQuery(new Date(`invalid`)))).toBe(
-      getQueryIdentity(createProfileValueQuery(new Date(`also invalid`))),
-    )
-    expect(
-      getQueryIdentity(
-        createProfileValueQuery(Temporal.PlainDate.from(`2026-08-24`)),
-      ),
-    ).toBe(
-      getQueryIdentity(
-        createProfileValueQuery(Temporal.PlainDate.from(`2026-08-24`)),
-      ),
-    )
-  })
-
-  it(`normalizes object property ordering in structural value hashes`, () => {
-    expect(
-      getStableValueHash({
-        skills: [`ts`, `db`],
-        experience: { years: 5 },
-      }),
-    ).toBe(
-      getStableValueHash({
-        experience: { years: 5 },
-        skills: [`ts`, `db`],
-      }),
-    )
-  })
-
-  it(`keeps runtime values disjoint from internal identity tags`, () => {
-    const createQuery = (value: unknown) =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) => eq(user.profile, value as never)),
-      )
-
-    const hashes = [
-      undefined,
-      { type: `undefined` },
-      [`undefined`],
-      Number.NaN,
-      { type: `number`, value: `NaN` },
-      new Date(`2024-01-01T00:00:00.000Z`),
-      { type: `Date`, value: `2024-01-01T00:00:00.000Z` },
-    ].map((value) => getStableQueryIRHash(createQuery(value)))
-
-    expect(new Set(hashes).size).toBe(hashes.length)
-  })
-
-  it(`preserves __proto__ as a normal object key`, () => {
-    const withProtoKey = JSON.parse(`{"__proto__":{"value":true}}`) as object
-    const withoutProtoKey = {}
-    const createQuery = (value: object) =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) => eq(user.profile, value as never)),
-      )
-
-    expect(getStableQueryIRHash(createQuery(withProtoKey))).not.toBe(
-      getStableQueryIRHash(createQuery(withoutProtoKey)),
-    )
-  })
-
-  it(`rejects functional query variants`, () => {
-    const queries = [
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .fn.where(({ user }) => user.active),
-      ),
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .fn.select(({ user }) => ({ id: user.id })),
-      ),
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .groupBy(({ user }) => user.teamId)
-          .select(({ user }) => ({
-            teamId: user.teamId,
-            userCount: count(user.id),
-          }))
-          .fn.having(({ $selected }) => $selected.userCount > 1),
-      ),
-    ]
-
-    for (const query of queries) {
-      expect(() => getStableQueryIRHash(query)).toThrow(UnhashableQueryIRError)
-    }
-  })
-
-  it.each([
-    [`function`, () => `Tanner`, () => `Tanner`],
-    [`symbol`, Symbol(`name`), Symbol(`name`)],
-  ])(`keeps %s query values distinct by reference`, (_name, a, b) => {
-    const query = (value: unknown) =>
-      getQueryIR(
-        new Query()
-          .from({ user: usersCollection })
-          .where(({ user }) => eq(user.name, value as never)),
-      )
-
-    expect(getStableQueryIRHash(query(a))).toBe(getStableQueryIRHash(query(a)))
-    expect(getStableQueryIRHash(query(a))).not.toBe(
-      getStableQueryIRHash(query(b)),
-    )
-  })
-
-  it(`accepts opaque object values by reference`, () => {
-    const circularValue: Record<string, unknown> = {}
-    circularValue.self = circularValue
+type GroupBy = `none` | `bare` | `groupKeys`
+type Agg = `none` | `built` | `stripped`
+type Inc = `none` | `built` | `stripped`
+type Outcome = `compiles` | `groupingRequired` | `includeRequired`
+
+function modelOutcome(groupBy: GroupBy, agg: Agg, inc: Inc): Outcome {
+  const grouping = groupBy === `groupKeys` || agg === `built`
+  if ((groupBy !== `none` || agg !== `none`) && !grouping)
+    return `groupingRequired`
+  if (inc === `stripped`) return `includeRequired`
+  return `compiles`
+}
 
-    class OpaqueValue {
-      value = `Tanner`
+// The wide-product law: two identity functions may give one identity to two
+// queries only when production compiles them to the same outcome. A shared
+// identity lets a hook reuse the compiled query and hide the other's error.
+// Each `identityOf` is a production identity function, and the outcomes are
+// production's compile results, so this compares two production observations
+// over every generated combination.
+function expectIdentitySharingMatchesOutcome(
+  built: ReadonlyArray<{ label: string; ir: QueryIR; outcome: string }>,
+  identities: Record<string, (ir: QueryIR) => string>,
+): void {
+  for (const [name, identityOf] of Object.entries(identities)) {
+    const byIdentity = new Map<string, { label: string; outcome: string }>()
+    for (const { label, ir, outcome } of built) {
+      const identity = identityOf(ir)
+      const seen = byIdentity.get(identity)
+      if (seen)
+        expect(
+          outcome,
+          `${name} identity shared by ${seen.label} and ${label}`,
+        ).toBe(seen.outcome)
+      else byIdentity.set(identity, { label, outcome })
     }
-
-    expect(() =>
-      getQueryIdentity(createProfileValueQuery(circularValue)),
-    ).not.toThrow()
-    expect(() =>
-      getQueryIdentity(createProfileValueQuery(new OpaqueValue())),
-    ).not.toThrow()
-  })
-})
+  }
+}
 
 /**
  * Operator code is part of what a query means. Two queries with one identity
@@ -1911,19 +579,6 @@ describe(`stable QueryIR identity smoke test`, () => {
  * Combinations with equal outcomes may share an identity or not.
  */
 describe(`operator-code identity`, () => {
-  type GroupBy = `none` | `bare` | `groupKeys`
-  type Agg = `none` | `built` | `stripped`
-  type Inc = `none` | `built` | `stripped`
-  type Outcome = `compiles` | `groupingRequired` | `includeRequired`
-
-  function modelOutcome(groupBy: GroupBy, agg: Agg, inc: Inc): Outcome {
-    const grouping = groupBy === `groupKeys` || agg === `built`
-    if ((groupBy !== `none` || agg !== `none`) && !grouping)
-      return `groupingRequired`
-    if (inc === `stripped`) return `includeRequired`
-    return `compiles`
-  }
-
   // A copy of an IR node without one field of operator code.
   const without = <T extends object>(node: T, field: string): T =>
     Object.assign(Object.create(Object.getPrototypeOf(node)), node, {
@@ -2176,18 +831,6 @@ describe(`operator-code identity`, () => {
       `IncludeOperatorRequiredError`,
     ])
       expect(outcomes, `reaches ${expected}`).toContain(expected)
-    for (const [name, identityOf] of Object.entries(identities)) {
-      const byIdentity = new Map<string, { label: string; outcome: string }>()
-      for (const { label, ir, outcome } of built) {
-        const identity = identityOf(ir)
-        const seen = byIdentity.get(identity)
-        if (seen)
-          expect(
-            outcome,
-            `${name} identity shared by ${seen.label} and ${label}`,
-          ).toBe(seen.outcome)
-        else byIdentity.set(identity, { label, outcome })
-      }
-    }
+    expectIdentitySharingMatchesOutcome(built, identities)
   })
 })
diff --git a/packages/db/tests/query/ir-stable-identity-support.ts b/packages/db/tests/query/ir-stable-identity-support.ts
new file mode 100644
index 0000000000..dfbeb82e1f
--- /dev/null
+++ b/packages/db/tests/query/ir-stable-identity-support.ts
@@ -0,0 +1,354 @@
+// Shared query fixtures for the stable identity tests. The law and its
+// oracle are owned by ir-stable-identity-oracle.test.ts; these helpers only
+// build query IRs and the production identity of a projected expression.
+import { CollectionImpl } from '../../src/collection/index.js'
+import { Query, getQueryIR } from '../../src/query/builder/index.js'
+import { eq } from '../../src/query/builder/functions.js'
+import { getQueryIdentity } from '../../src/query/ir-stable-identity.js'
+import {
+  CollectionRef,
+  Func,
+  IncludesSubquery,
+  PropRef,
+  QueryRef,
+  UnionAll,
+  Value,
+} from '../../src/query/ir.js'
+import { includesRuntime } from '../../src/query/live/includes-runtime.js'
+import type { BasicExpression, QueryIR } from '../../src/query/ir.js'
+
+export interface User {
+  id: number
+  name: string
+  email?: string | null
+  active: boolean
+  age: number
+  salary: number
+  status: `active` | `inactive`
+  teamId: string
+  departmentId: number | null
+  createdAt: Date
+  profile?: {
+    skills: Array<string>
+    experience: {
+      years: number
+    }
+  }
+  blob?: Uint8Array
+  largeViewCount?: bigint
+}
+
+export function getProjectedExpressionIdentity(
+  expression: BasicExpression,
+): string {
+  return getQueryIdentity({
+    ...getQueryIR(new Query().from({ user: usersCollection })),
+    select: { value: expression },
+  })
+}
+
+export interface Post {
+  id: number
+  userId: number
+  title: string
+  published: boolean
+  views: number
+  createdAt: Date
+}
+
+export const usersCollection = new CollectionImpl<User>({
+  id: `users`,
+  getKey: (item) => item.id,
+  sync: { sync: () => {} },
+})
+
+export const postsCollection = new CollectionImpl<Post>({
+  id: `posts`,
+  getKey: (item) => item.id,
+  sync: { sync: () => {} },
+})
+
+export function createProfileValueQuery(value: unknown): QueryIR {
+  return {
+    ...getQueryIR(new Query().from({ user: usersCollection })),
+    where: [
+      new Func<boolean>(`eq`, [
+        new PropRef([`user`, `profile`]),
+        new Value(value),
+      ]),
+    ],
+  }
+}
+
+export function createAlphaRenamedJoinQuery(
+  userAlias: string,
+  postAlias: string,
+): QueryIR {
+  return {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      userAlias,
+    ),
+    join: [
+      {
+        type: `inner`,
+        from: new CollectionRef(
+          postsCollection as unknown as ConstructorParameters<
+            typeof CollectionRef
+          >[0],
+          postAlias,
+        ),
+        on: new Func('eq', [
+          new PropRef([userAlias, `id`]),
+          new PropRef([postAlias, `userId`]),
+        ]),
+      },
+    ],
+    where: [
+      new Func(`eq`, [new PropRef([postAlias, `published`]), new Value(true)]),
+    ],
+    select: {
+      userId: new PropRef([userAlias, `id`]),
+      postTitle: new PropRef([postAlias, `title`]),
+    },
+    orderBy: [
+      {
+        expression: new PropRef([postAlias, `createdAt`]),
+        compareOptions: { direction: `desc`, nulls: `last` },
+      },
+    ],
+  }
+}
+
+export function createAlphaRenamedImplicitJoinQuery(
+  userAlias: string,
+  postAlias: string,
+): QueryIR {
+  return {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      userAlias,
+    ),
+    join: [
+      {
+        type: `inner`,
+        from: new CollectionRef(
+          postsCollection as unknown as ConstructorParameters<
+            typeof CollectionRef
+          >[0],
+          postAlias,
+        ),
+        on: new Func('eq', [
+          new PropRef([userAlias, `id`]),
+          new PropRef([postAlias, `userId`]),
+        ]),
+      },
+    ],
+  }
+}
+
+export function createProjectedExpressionQuery(
+  expression: BasicExpression,
+): QueryIR {
+  return {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      `user`,
+    ),
+    select: { value: expression },
+  }
+}
+
+export function createAlphaRenamedNestedQuery(
+  innerAlias: string,
+  outerAlias: string,
+): QueryIR {
+  const inner: QueryIR = {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      innerAlias,
+    ),
+    select: {
+      id: new PropRef([innerAlias, `id`]),
+      status: new PropRef([innerAlias, `status`]),
+    },
+  }
+  return {
+    from: new QueryRef(inner, outerAlias),
+    where: [
+      new Func(`eq`, [
+        new PropRef([outerAlias, `status`]),
+        new Value(`active`),
+      ]),
+    ],
+    select: { id: new PropRef([outerAlias, `id`]) },
+  }
+}
+
+export function createUnionDerivedNestedQuery(outerAlias: string): QueryIR {
+  const users = new Query()
+    .from({ user: usersCollection })
+    .select(({ user }) => ({ id: user.id, kind: user.status }))
+  const posts = new Query()
+    .from({ post: postsCollection })
+    .select(({ post }) => ({ id: post.id, kind: post.title }))
+  const union = new Query()
+    .unionAll(users, posts)
+    .where(({ kind }) => eq(kind, `active`))
+
+  return getQueryIR(
+    new Query().from({ [outerAlias]: union } as Record<string, typeof union>),
+  )
+}
+
+export function createUnionDerivedNestedOutputQuery(
+  outerAlias: string,
+): QueryIR {
+  const users = new Query()
+    .from({ user: usersCollection })
+    .select(({ user }) => ({ profile: { id: user.id } }))
+  const posts = new Query()
+    .from({ post: postsCollection })
+    .select(({ post }) => ({ profile: { id: post.id } }))
+  const union = new Query()
+    .unionAll(users, posts)
+    .where(({ profile }) => eq(profile.id, 1))
+
+  return getQueryIR(
+    new Query().from({ [outerAlias]: union } as Record<string, typeof union>),
+  )
+}
+
+export function createUnionDerivedIncludesQuery(parentAlias: string): QueryIR {
+  const firstPosts = new Query()
+    .from({ post: postsCollection })
+    .select(({ post }) => ({ id: post.id, userId: post.userId }))
+  const secondPosts = new Query()
+    .from({ otherPost: postsCollection })
+    .select(({ otherPost }) => ({
+      id: otherPost.id,
+      userId: otherPost.userId,
+    }))
+  const childQuery = getQueryIR(new Query().unionAll(firstPosts, secondPosts))
+  const posts = new IncludesSubquery(
+    childQuery,
+    new PropRef([parentAlias, `id`]),
+    new PropRef([`userId`]),
+    `posts`,
+    includesRuntime,
+    undefined,
+    undefined,
+    `array`,
+  )
+
+  return {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      parentAlias,
+    ),
+    select: {
+      id: new PropRef([parentAlias, `id`]),
+      posts,
+    },
+  }
+}
+
+export function createCorrelatedUnionIncludesQuery(
+  parentAlias: string,
+): QueryIR {
+  const createBranch = (childAlias: string): QueryIR => ({
+    from: new CollectionRef(
+      postsCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      childAlias,
+    ),
+    select: {
+      profile: { id: new PropRef([childAlias, `id`]) },
+      userId: new PropRef([childAlias, `userId`]),
+      parentAge: new PropRef([parentAlias, `age`]),
+    },
+  })
+  const childQuery: QueryIR = {
+    from: new UnionAll([createBranch(`firstPost`), createBranch(`secondPost`)]),
+    where: [new Func(`eq`, [new PropRef([`profile`, `id`]), new Value(1)])],
+  }
+  const posts = new IncludesSubquery(
+    childQuery,
+    new PropRef([parentAlias, `id`]),
+    new PropRef([`userId`]),
+    `posts`,
+    includesRuntime,
+    undefined,
+    [new PropRef([parentAlias, `age`])],
+    `array`,
+  )
+
+  return {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      parentAlias,
+    ),
+    select: {
+      id: new PropRef([parentAlias, `id`]),
+      posts,
+    },
+  }
+}
+
+export function createAlphaRenamedIncludesQuery(
+  parentAlias: string,
+  childAlias: string,
+): QueryIR {
+  const childQuery: QueryIR = {
+    from: new CollectionRef(
+      postsCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      childAlias,
+    ),
+    select: {
+      id: new PropRef([childAlias, `id`]),
+      title: new PropRef([childAlias, `title`]),
+    },
+  }
+  const posts = new IncludesSubquery(
+    childQuery,
+    new PropRef([parentAlias, `id`]),
+    new PropRef([childAlias, `userId`]),
+    `posts`,
+    includesRuntime,
+    [
+      new Func(`eq`, [
+        new PropRef([parentAlias, `status`]),
+        new Value(`active`),
+      ]),
+    ],
+    [new PropRef([parentAlias, `id`])],
+    `array`,
+  )
+  return {
+    from: new CollectionRef(
+      usersCollection as unknown as ConstructorParameters<
+        typeof CollectionRef
+      >[0],
+      parentAlias,
+    ),
+    select: {
+      id: new PropRef([parentAlias, `id`]),
+      posts,
+    },
+  }
+}
diff --git a/packages/db/tests/query/ir-stable-identity.test.ts b/packages/db/tests/query/ir-stable-identity.test.ts
new file mode 100644
index 0000000000..7806cb4d4d
--- /dev/null
+++ b/packages/db/tests/query/ir-stable-identity.test.ts
@@ -0,0 +1,1094 @@
+// Unit tests for stable query identity, demand keys, and runtime reference
+// identity: fixed scenarios whose expectations are literal values or
+// production identity equalities. The law and its oracle are owned by
+// ir-stable-identity-oracle.test.ts; the shared fixtures live in
+// ir-stable-identity-support.ts.
+import { describe, expect, it, vi } from 'vitest'
+import { Temporal } from 'temporal-polyfill'
+import { CollectionImpl } from '../../src/collection/index.js'
+import { Query, getQueryIR } from '../../src/query/builder/index.js'
+import {
+  add,
+  and,
+  avg,
+  caseWhen,
+  coalesce,
+  concat,
+  count,
+  eq,
+  gt,
+  gte,
+  inArray,
+  isNull,
+  isUndefined,
+  length,
+  like,
+  lower,
+  lt,
+  max,
+  not,
+  or,
+  subtract,
+  sum,
+  upper,
+} from '../../src/query/builder/functions.js'
+import { include } from '../../src/query/index.js'
+import {
+  UnhashableQueryIRError,
+  getLoadSubsetDemandKey,
+  getQueryIdentity,
+  getStableQueryIRHash,
+  getStableValueHash,
+} from '../../src/query/ir-stable-identity.js'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import {
+  compileExpression,
+  toBooleanPredicate,
+} from '../../src/query/compiler/evaluators.js'
+import {
+  createRuntimeReferenceIdentityFactory,
+  getRuntimeReferenceIdentity,
+} from '../../src/query/runtime-reference-identity.js'
+import { createValueIdentity } from '../../src/query/equality-value-identity.js'
+import {
+  createAlphaRenamedImplicitJoinQuery,
+  createProfileValueQuery,
+  createProjectedExpressionQuery,
+  getProjectedExpressionIdentity,
+  postsCollection,
+  usersCollection,
+} from './ir-stable-identity-support.js'
+import type { User } from './ir-stable-identity-support.js'
+import type { OrderBy, QueryIR } from '../../src/query/ir.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+
+describe(`stable runtime value hashing`, () => {
+  it(`normalizes object key order`, () => {
+    expect(getStableValueHash([`todos`, { status: `open`, page: 1 }])).toBe(
+      getStableValueHash([`todos`, { page: 1, status: `open` }]),
+    )
+  })
+
+  it(`reports the path of an unhashable query key value`, () => {
+    expect(() =>
+      getStableValueHash([`todos`, { predicate: () => true }], `queryKey`),
+    ).toThrow(/queryKey\[1\]\.predicate/)
+  })
+})
+
+describe(`semantic expression identity`, () => {
+  const age = new PropRef<number>([`user`, `age`])
+  const active = new PropRef<boolean>([`user`, `active`])
+
+  it(`normalizes associative, commutative, and idempotent boolean forms`, () => {
+    const adult = new Func<boolean>(`gte`, [age, new Value(18)])
+    const enabled = new Func<boolean>(`eq`, [active, new Value(true)])
+    const nested = new Func<boolean>(`and`, [
+      enabled,
+      new Func<boolean>(`and`, [adult, enabled]),
+    ])
+    const flat = new Func<boolean>(`and`, [adult, enabled])
+
+    expect(getProjectedExpressionIdentity(nested)).toBe(
+      getProjectedExpressionIdentity(flat),
+    )
+    expect(getProjectedExpressionIdentity(new Func(`or`, [adult, adult]))).toBe(
+      getProjectedExpressionIdentity(new Func(`or`, [adult])),
+    )
+  })
+
+  it(`keeps a boolean wrapper when duplicate operands coerce their result`, () => {
+    const bareAge = new PropRef<number>([`user`, `age`])
+    const duplicateAnd = new Func<boolean>(`and`, [bareAge, bareAge])
+    const row = { user: { age: 18 } }
+
+    expect(toBooleanPredicate(compileExpression(bareAge)(row))).toBe(false)
+    expect(toBooleanPredicate(compileExpression(duplicateAnd)(row))).toBe(true)
+    expect(getProjectedExpressionIdentity(duplicateAnd)).not.toBe(
+      getProjectedExpressionIdentity(bareAge),
+    )
+  })
+
+  it(`normalizes equality and reversed inequalities`, () => {
+    expect(
+      getProjectedExpressionIdentity(new Func(`eq`, [age, new Value(18)])),
+    ).toBe(getProjectedExpressionIdentity(new Func(`eq`, [new Value(18), age])))
+    expect(
+      getProjectedExpressionIdentity(new Func(`gt`, [age, new Value(18)])),
+    ).toBe(getProjectedExpressionIdentity(new Func(`lt`, [new Value(18), age])))
+  })
+
+  it(`preserves order-sensitive function arguments`, () => {
+    expect(
+      getProjectedExpressionIdentity(new Func(`subtract`, [age, new Value(1)])),
+    ).not.toBe(
+      getProjectedExpressionIdentity(new Func(`subtract`, [new Value(1), age])),
+    )
+  })
+
+  it(`does not initialize runtime reference identities during module evaluation`, async () => {
+    const getRandomValues = vi.fn((values: Uint32Array) => values)
+    vi.stubGlobal(`crypto`, { getRandomValues })
+    vi.resetModules()
+
+    try {
+      const { getRuntimeReferenceIdentity: getFreshRuntimeReferenceIdentity } =
+        await import(`../../src/query/runtime-reference-identity.js`)
+
+      expect(getRandomValues).not.toHaveBeenCalled()
+
+      getFreshRuntimeReferenceIdentity({})
+      getFreshRuntimeReferenceIdentity({})
+
+      expect(getRandomValues).toHaveBeenCalledOnce()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it(`does not reuse reference identities across runtimes`, () => {
+    const firstRuntime = createRuntimeReferenceIdentityFactory()
+    const secondRuntime = createRuntimeReferenceIdentityFactory()
+
+    expect(firstRuntime({ a: 1 })).not.toEqual(secondRuntime({ b: 2 }))
+  })
+
+  it(`allocates runtime entropy only when the first identity is requested`, () => {
+    const getRandomValues = vi.fn((values: Uint32Array) => values)
+    vi.stubGlobal(`crypto`, { getRandomValues })
+    try {
+      const runtime = createRuntimeReferenceIdentityFactory()
+      expect(getRandomValues).not.toHaveBeenCalled()
+
+      runtime({})
+      runtime({})
+      expect(getRandomValues).toHaveBeenCalledOnce()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it(`keeps symbol identities stable and distinct`, () => {
+    const first = Symbol(`value`)
+    const second = Symbol(`value`)
+
+    expect(getRuntimeReferenceIdentity(first)).toEqual(
+      getRuntimeReferenceIdentity(first),
+    )
+    expect(getRuntimeReferenceIdentity(first)).not.toEqual(
+      getRuntimeReferenceIdentity(second),
+    )
+  })
+
+  it(`does not retain symbols in strong identity maps when weak symbol keys are supported`, () => {
+    const NativeMap = Map
+    const stronglyStoredSymbols = new Set<symbol>()
+    class TrackingMap<K, V> extends NativeMap<K, V> {
+      override set(key: K, value: V): this {
+        if (typeof key === `symbol`) stronglyStoredSymbols.add(key)
+        return super.set(key, value)
+      }
+    }
+    const local = Symbol(`local`)
+    const registered = Symbol.for(
+      `tanstack-db-runtime-reference-test-${Date.now()}`,
+    )
+
+    vi.stubGlobal(`Map`, TrackingMap)
+    try {
+      const runtime = createRuntimeReferenceIdentityFactory()
+      runtime(local)
+      runtime(registered)
+    } finally {
+      vi.unstubAllGlobals()
+    }
+
+    expect(stronglyStoredSymbols).not.toContain(local)
+    expect(stronglyStoredSymbols).not.toContain(registered)
+  })
+
+  it(`keeps correct symbol identity when weak symbol keys are unavailable`, () => {
+    const NativeWeakMap = WeakMap
+    class ObjectOnlyWeakMap<K extends object, V> extends NativeWeakMap<K, V> {
+      override set(key: K, value: V): this {
+        if (typeof key === `symbol`) {
+          throw new TypeError(`Symbols cannot be weak keys`)
+        }
+        return super.set(key, value)
+      }
+    }
+    const first = Symbol(`value`)
+    const second = Symbol(`value`)
+
+    vi.stubGlobal(`WeakMap`, ObjectOnlyWeakMap)
+    try {
+      const runtime = createRuntimeReferenceIdentityFactory()
+
+      expect(runtime(first)).toEqual(runtime(first))
+      expect(runtime(first)).not.toEqual(runtime(second))
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it(`scopes opaque value identities to their owner`, () => {
+    const firstScope = createValueIdentity()
+    const secondScope = createValueIdentity()
+    const first = Symbol(`value`)
+    const second = Symbol(`value`)
+
+    expect(firstScope.equality(first)).toEqual(firstScope.equality(first))
+    expect(firstScope.equality(first)).not.toEqual(firstScope.equality(second))
+    expect(firstScope.equality(first)).not.toEqual(secondScope.equality(first))
+  })
+
+  it(`falls back when the runtime crypto object lacks getRandomValues`, () => {
+    vi.stubGlobal(`crypto`, {})
+    try {
+      const runtime = createRuntimeReferenceIdentityFactory()
+
+      expect(runtime({ a: 1 })).toEqual([
+        `runtimeReference`,
+        expect.any(String),
+        1,
+      ])
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+})
+
+describe(`loadSubset demand identity`, () => {
+  it(`preserves legacy nested-ref identity and distinguishes explicit qualification`, () => {
+    const nested = new PropRef([`profile`, `score`])
+    const qualified = new PropRef([`profile`, `score`], `profile`)
+
+    expect(getLoadSubsetDemandKey({ where: nested })).toBe(
+      `{"type":"loadSubsetDemand","query":{"type":"loadSubsetQuery","where":{"type":"ref","path":[["string","profile"],["string","score"]]}}}`,
+    )
+    expect(getLoadSubsetDemandKey({ where: qualified })).not.toBe(
+      getLoadSubsetDemandKey({ where: nested }),
+    )
+    expect(JSON.stringify(nested)).toBe(
+      `{"path":["profile","score"],"type":"ref"}`,
+    )
+  })
+
+  it(`gives an unqualified ref no source alias property`, () => {
+    expect(Object.hasOwn(new PropRef([`profile`]), `sourceAlias`)).toBe(false)
+    expect(
+      Object.hasOwn(
+        new PropRef([`profile`, `score`], `profile`),
+        `sourceAlias`,
+      ),
+    ).toBe(true)
+  })
+
+  const id = new PropRef<string>([`id`])
+  const group = new PropRef<string>([`group`])
+  const first = new Func<boolean>(`eq`, [id, new Value(`a`)])
+  const second = new Func<boolean>(`eq`, [group, new Value(`x`)])
+  const orderBy: NonNullable<LoadSubsetOptions[`orderBy`]> = [
+    {
+      expression: id,
+      compareOptions: { direction: `asc`, nulls: `first` },
+    },
+    {
+      expression: group,
+      compareOptions: { direction: `desc`, nulls: `last` },
+    },
+  ]
+
+  it(`includes the exact requested window`, () => {
+    const narrow = { where: first, orderBy, limit: 10, offset: 5 }
+    const wide = { where: first, orderBy, limit: 20, offset: 0 }
+
+    expect(getLoadSubsetDemandKey(narrow)).not.toBe(
+      getLoadSubsetDemandKey(wide),
+    )
+  })
+
+  it(`normalizes predicates but preserves orderBy sequence`, () => {
+    const left = new Func<boolean>(`and`, [first, second])
+    const right = new Func<boolean>(`and`, [second, first])
+
+    expect(getLoadSubsetDemandKey({ where: left, orderBy })).toBe(
+      getLoadSubsetDemandKey({ where: right, orderBy }),
+    )
+    expect(getLoadSubsetDemandKey({ where: left, orderBy })).not.toBe(
+      getLoadSubsetDemandKey({ where: right, orderBy: [...orderBy].reverse() }),
+    )
+  })
+
+  it(`includes cursor shape and excludes runtime owners`, () => {
+    const cursor = {
+      whereFrom: new Func<boolean>(`gt`, [id, new Value(`a`)]),
+      whereCurrent: first,
+      lastKey: `a`,
+    }
+    const firstOwner = new AbortController()
+    const secondOwner = new AbortController()
+    const subscription = {} as NonNullable<LoadSubsetOptions[`subscription`]>
+
+    expect(
+      getLoadSubsetDemandKey({
+        where: first,
+        cursor,
+        signal: firstOwner.signal,
+        subscription,
+      }),
+    ).toBe(
+      getLoadSubsetDemandKey({
+        where: first,
+        cursor,
+        signal: secondOwner.signal,
+      }),
+    )
+    expect(getLoadSubsetDemandKey({ where: first, cursor })).not.toBe(
+      getLoadSubsetDemandKey({
+        where: first,
+        cursor: { ...cursor, lastKey: `b` },
+      }),
+    )
+  })
+
+  it(`uses the base query key for an unconstrained owner-only demand`, () => {
+    expect(getLoadSubsetDemandKey({})).toBeUndefined()
+    expect(getLoadSubsetDemandKey({ offset: 0 })).toBeUndefined()
+    expect(
+      getLoadSubsetDemandKey({ signal: new AbortController().signal }),
+    ).toBeUndefined()
+    expect(getLoadSubsetDemandKey({ where: first, offset: 0 })).toBe(
+      getLoadSubsetDemandKey({ where: first }),
+    )
+  })
+
+  it.each([
+    [`function`, () => `value`, () => `value`],
+    [`symbol`, Symbol(`value`), Symbol(`value`)],
+  ])(`uses runtime reference identity for %s demand values`, (_name, a, b) => {
+    const field = new PropRef<unknown>([`row`, `value`])
+    const demand = (value: unknown): LoadSubsetOptions => ({
+      where: new Func(`eq`, [field, new Value(value)]),
+    })
+
+    expect(getLoadSubsetDemandKey(demand(a))).toBe(
+      getLoadSubsetDemandKey(demand(a)),
+    )
+    expect(getLoadSubsetDemandKey(demand(a))).not.toBe(
+      getLoadSubsetDemandKey(demand(b)),
+    )
+  })
+
+  it(`uses exact custom comparator identity for order terms`, () => {
+    const compare = (a: string, b: string) => a.length - b.length
+    const orderByFor = (candidate: typeof compare): OrderBy => [
+      {
+        expression: new PropRef([`row`, `label`]),
+        compareOptions: {
+          direction: `asc` as const,
+          nulls: `first` as const,
+          stringSort: `custom`,
+          compare: candidate,
+        },
+      },
+    ]
+    const queryFor = (candidate: typeof compare): QueryIR => ({
+      ...getQueryIR(new Query().from({ user: usersCollection })),
+      orderBy: [
+        {
+          expression: new PropRef([`user`, `name`]),
+          compareOptions: {
+            direction: `asc`,
+            nulls: `first`,
+            stringSort: `custom`,
+            compare: candidate,
+          },
+        },
+      ],
+    })
+    const clone = (a: string, b: string) => a.length - b.length
+
+    expect(getLoadSubsetDemandKey({ orderBy: orderByFor(compare) })).toBe(
+      getLoadSubsetDemandKey({ orderBy: orderByFor(compare) }),
+    )
+    expect(getLoadSubsetDemandKey({ orderBy: orderByFor(compare) })).not.toBe(
+      getLoadSubsetDemandKey({ orderBy: orderByFor(clone) }),
+    )
+    expect(getQueryIdentity(queryFor(compare))).toBe(
+      getQueryIdentity(queryFor(compare)),
+    )
+    expect(getQueryIdentity(queryFor(compare))).not.toBe(
+      getQueryIdentity(queryFor(clone)),
+    )
+  })
+
+  it.each([
+    [`signed zero`, -0, 0],
+    [`invalid Date`, new Date(Number.NaN), new Date(Number.NaN)],
+    [
+      `Temporal.PlainDate`,
+      Temporal.PlainDate.from(`2024-01-15`),
+      Temporal.PlainDate.from(`2024-01-15`),
+    ],
+    [
+      `Temporal.Duration`,
+      Temporal.Duration.from(`PT1H`),
+      Temporal.Duration.from(`PT1H`),
+    ],
+    [
+      `large cross-constructor binary`,
+      new Uint8Array(129).fill(7),
+      Buffer.from(new Uint8Array(129).fill(7)),
+    ],
+  ])(
+    `uses comparison semantics for equivalent %s values`,
+    (_label, firstValue, secondValue) => {
+      const value = new PropRef<unknown>([`row`, `value`])
+      const firstPredicate = new Func<boolean>(`eq`, [
+        value,
+        new Value(firstValue),
+      ])
+      const secondPredicate = new Func<boolean>(`eq`, [
+        value,
+        new Value(secondValue),
+      ])
+
+      expect(
+        compileExpression(firstPredicate)({ row: { value: secondValue } }),
+      ).toBe(true)
+      expect(getProjectedExpressionIdentity(firstPredicate)).toBe(
+        getProjectedExpressionIdentity(secondPredicate),
+      )
+      expect(getLoadSubsetDemandKey({ where: firstPredicate })).toBe(
+        getLoadSubsetDemandKey({ where: secondPredicate }),
+      )
+      expect(getQueryIdentity(createProfileValueQuery(firstValue))).toBe(
+        getQueryIdentity(createProfileValueQuery(secondValue)),
+      )
+    },
+  )
+})
+
+const structuredQueries: Array<[string, () => QueryIR]> = [
+  [
+    `basic collection source`,
+    () => getQueryIR(new Query().from({ user: usersCollection })),
+  ],
+  [
+    `captured primitive where value`,
+    () => {
+      const status = `active` as const
+      return getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) => eq(user.status, status)),
+      )
+    },
+  ],
+  [
+    `boolean expression tree`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) =>
+            and(
+              eq(user.active, true),
+              or(gt(user.age, 30), not(isNull(user.email))),
+            ),
+          ),
+      ),
+  ],
+  [
+    `array membership and undefined checks`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) =>
+            and(
+              inArray(user.teamId, [`eng`, `design`]),
+              not(isUndefined(user.profile)),
+            ),
+          ),
+      ),
+  ],
+  [
+    `date bigint and typed array values`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) =>
+            and(
+              gte(user.createdAt, new Date(`2024-01-01T00:00:00.000Z`)),
+              gt(user.largeViewCount, 9007199254740993n),
+              eq(user.blob, new Uint8Array([1, 2, 3])),
+            ),
+          ),
+      ),
+  ],
+  [
+    `plain object values`,
+    () =>
+      getQueryIR(
+        new Query().from({ user: usersCollection }).where(({ user }) =>
+          eq(user.profile, {
+            experience: { years: 5 },
+            skills: [`ts`, `db`],
+          }),
+        ),
+      ),
+  ],
+  [
+    `nested select and computed expressions`,
+    () =>
+      getQueryIR(
+        new Query().from({ user: usersCollection }).select(({ user }) => ({
+          id: user.id,
+          displayName: concat(upper(user.name), ` <`, lower(user.email), `>`),
+          score: add(user.salary, 1000),
+          fallbackEmail: coalesce(user.email, `missing@example.com`),
+          meta: {
+            active: user.active,
+            nameLength: length(user.name),
+          },
+        })),
+      ),
+  ],
+  [
+    `conditional projection select`,
+    () =>
+      getQueryIR(
+        new Query().from({ user: usersCollection }).select(({ user }) => ({
+          id: user.id,
+          profile: caseWhen(
+            gt(user.age, 18),
+            {
+              label: `adult`,
+              email: user.email,
+            },
+            {
+              label: `minor`,
+              email: null,
+            },
+          ),
+        })),
+      ),
+  ],
+  [
+    `top-level alias spread select`,
+    () =>
+      getQueryIR(
+        new Query().from({ user: usersCollection }).select(({ user }) => user),
+      ),
+  ],
+  [
+    `locale orderBy options`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .orderBy(({ user }) => user.name, {
+            direction: `asc`,
+            nulls: `last`,
+            stringSort: `locale`,
+            locale: `en-US`,
+            localeOptions: { sensitivity: `base`, numeric: true },
+          }),
+      ),
+  ],
+  [
+    `groupBy aggregates and selected orderBy`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .groupBy(({ user }) => user.teamId)
+          .select(({ user }) => ({
+            teamId: user.teamId,
+            userCount: count(user.id),
+            avgAge: avg(user.age),
+            totalSalary: sum(user.salary),
+            latestSignup: max(user.createdAt),
+          }))
+          .having(({ $selected }) => gt($selected.userCount, 1))
+          .orderBy(({ $selected }) => $selected.avgAge, `desc`),
+      ),
+  ],
+  [
+    `join query`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .join(
+            { post: postsCollection },
+            ({ user, post }) => eq(user.id, post.userId),
+            `left`,
+          )
+          .where(({ post }) => eq(post.published, true))
+          .select(({ user, post }) => ({
+            userId: user.id,
+            postTitle: post.title,
+          })),
+      ),
+  ],
+  [
+    `subquery join`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({
+            post: new Query()
+              .from({ post: postsCollection })
+              .where(({ post }) => gt(post.views, 100)),
+          })
+          .join(
+            {
+              activeUser: new Query()
+                .from({ user: usersCollection })
+                .where(({ user }) => eq(user.status, `active`)),
+            },
+            ({ post, activeUser }) => eq(post.userId, activeUser.id),
+            `inner`,
+          ),
+      ),
+  ],
+  [
+    `unioned source object`,
+    () =>
+      getQueryIR(
+        new Query().unionAll({ user: usersCollection, post: postsCollection }),
+      ),
+  ],
+  [
+    `unioned query branches`,
+    () =>
+      getQueryIR(
+        new Query().unionAll(
+          new Query().from({ user: usersCollection }).select(({ user }) => ({
+            id: user.id,
+            label: user.name,
+          })),
+          new Query().from({ post: postsCollection }).select(({ post }) => ({
+            id: post.id,
+            label: post.title,
+          })),
+        ),
+      ),
+  ],
+  [
+    `includes subquery`,
+    () =>
+      getQueryIR(
+        new Query().from({ user: usersCollection }).select(({ user }) => ({
+          id: user.id,
+          posts: include(
+            new Query()
+              .from({ post: postsCollection })
+              .where(({ post }) => eq(post.userId, user.id))
+              .select(({ post }) => ({
+                id: post.id,
+                title: post.title,
+              })),
+          ),
+        })),
+      ),
+  ],
+  [
+    `pagination shape`,
+    () =>
+      getQueryIR(
+        new Query()
+          .from({ post: postsCollection })
+          .where(({ post }) => like(post.title, `%db%`))
+          .orderBy(({ post }) => post.createdAt, `desc`)
+          .offset(20)
+          .limit(10),
+      ),
+  ],
+]
+
+describe(`stable QueryIR identity smoke test`, () => {
+  it(`can derive identity for representative structured query shapes`, () => {
+    expect(structuredQueries).toHaveLength(17)
+
+    const hashes = structuredQueries.map(([name, createQuery]) => {
+      const hash = getStableQueryIRHash(createQuery())
+      expect(hash, name).toContain(`"type":"query"`)
+      expect(() => JSON.parse(hash), name).not.toThrow()
+      return hash
+    })
+
+    expect(new Set(hashes).size).toBe(hashes.length)
+  })
+
+  it(`does not depend on collection object identity when ids match`, () => {
+    const otherUsersCollection = new CollectionImpl<User>({
+      id: `users`,
+      getKey: (item) => item.id,
+      sync: { sync: () => {} },
+    })
+
+    const createQuery = (collection: CollectionImpl<User>) =>
+      getQueryIR(
+        new Query()
+          .from({ user: collection })
+          .where(({ user }) => eq(user.status, `active`)),
+      )
+
+    expect(getStableQueryIRHash(createQuery(usersCollection))).toBe(
+      getStableQueryIRHash(createQuery(otherUsersCollection)),
+    )
+  })
+
+  it(`keeps aliases that define an implicit joined result shape`, () => {
+    expect(
+      getQueryIdentity(createAlphaRenamedImplicitJoinQuery(`user`, `post`)),
+    ).not.toBe(
+      getQueryIdentity(
+        createAlphaRenamedImplicitJoinQuery(`account`, `article`),
+      ),
+    )
+  })
+
+  it(`keeps aliases that define an implicit union-source result shape`, () => {
+    const usersAndPosts = getQueryIR(
+      new Query().unionAll({
+        user: usersCollection,
+        post: postsCollection,
+      }),
+    )
+    const accountsAndArticles = getQueryIR(
+      new Query().unionAll({
+        account: usersCollection,
+        article: postsCollection,
+      }),
+    )
+
+    expect(usersAndPosts.from.type).toBe(`unionFrom`)
+    expect(getQueryIdentity(usersAndPosts)).not.toBe(
+      getQueryIdentity(accountsAndArticles),
+    )
+  })
+
+  it(`keeps aliases when an empty groupBy still selects a namespaced row`, () => {
+    const createQuery = (alias: string) =>
+      getQueryIR(
+        new Query()
+          .from({ [alias]: usersCollection } as Record<
+            string,
+            typeof usersCollection
+          >)
+          .groupBy(() => []),
+      )
+
+    expect(getQueryIdentity(createQuery(`user`))).not.toBe(
+      getQueryIdentity(createQuery(`account`)),
+    )
+  })
+
+  it(`keeps output-producing runtime values exact`, () => {
+    const bufferExpression = new Func(`concat`, [new Value(Buffer.from([65]))])
+    const uint8Expression = new Func(`concat`, [
+      new Value(new Uint8Array([65])),
+    ])
+
+    expect(compileExpression(bufferExpression)({})).toBe(`A`)
+    expect(compileExpression(uint8Expression)({})).toBe(`65`)
+    expect(
+      getQueryIdentity(createProjectedExpressionQuery(bufferExpression)),
+    ).not.toBe(
+      getQueryIdentity(createProjectedExpressionQuery(uint8Expression)),
+    )
+
+    expect(
+      getQueryIdentity(createProjectedExpressionQuery(new Value(-0))),
+    ).not.toBe(getQueryIdentity(createProjectedExpressionQuery(new Value(0))))
+
+    const firstObject = { value: 1 }
+    const secondObject = { value: 1 }
+    expect(
+      getQueryIdentity(createProjectedExpressionQuery(new Value(firstObject))),
+    ).not.toBe(
+      getQueryIdentity(createProjectedExpressionQuery(new Value(secondObject))),
+    )
+    expect(compileExpression(new Value(firstObject))({})).toBe(firstObject)
+    expect(compileExpression(new Value(secondObject))({})).toBe(secondObject)
+  })
+
+  it(`shares identity across equivalent predicate formulations`, () => {
+    const left = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .where(({ user }) => and(eq(user.status, `active`), gt(user.age, 18))),
+    )
+    const right = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .where(({ user }) => and(lt(18, user.age), eq(`active`, user.status))),
+    )
+
+    expect(getQueryIdentity(left)).toBe(getQueryIdentity(right))
+  })
+
+  it(`normalizes the implicit conjunction order of repeated where clauses`, () => {
+    const left = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .where(({ user }) => eq(user.status, `active`))
+        .where(({ user }) => gt(user.age, 18)),
+    )
+    const right = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .where(({ user }) => gt(user.age, 18))
+        .where(({ user }) => eq(user.status, `active`)),
+    )
+    const duplicate = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .where(({ user }) => eq(user.status, `active`))
+        .where(({ user }) => gt(user.age, 18))
+        .where(({ user }) => eq(user.status, `active`)),
+    )
+
+    expect(getQueryIdentity(left)).toBe(getQueryIdentity(right))
+    expect(getQueryIdentity(left)).toBe(getQueryIdentity(duplicate))
+  })
+
+  it(`normalizes the implicit conjunction order of repeated having clauses`, () => {
+    const left = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .groupBy(({ user }) => user.teamId)
+        .select(({ user }) => ({
+          teamId: user.teamId,
+          userCount: count(user.id),
+          averageAge: avg(user.age),
+        }))
+        .having(({ $selected }) => gt($selected.userCount, 1))
+        .having(({ $selected }) => gt($selected.averageAge, 18)),
+    )
+    const right = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .groupBy(({ user }) => user.teamId)
+        .select(({ user }) => ({
+          teamId: user.teamId,
+          userCount: count(user.id),
+          averageAge: avg(user.age),
+        }))
+        .having(({ $selected }) => gt($selected.averageAge, 18))
+        .having(({ $selected }) => gt($selected.userCount, 1)),
+    )
+
+    expect(getQueryIdentity(left)).toBe(getQueryIdentity(right))
+  })
+
+  it(`includes a query plan's result window`, () => {
+    const createQuery = (limit: number) =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .orderBy(({ user }) => user.age)
+          .limit(limit),
+      )
+
+    expect(getQueryIdentity(createQuery(10))).not.toBe(
+      getQueryIdentity(createQuery(20)),
+    )
+  })
+
+  it(`elides the default query offset`, () => {
+    const base = getQueryIR(new Query().from({ user: usersCollection }))
+    const offsetZero = getQueryIR(
+      new Query().from({ user: usersCollection }).offset(0),
+    )
+
+    expect(getQueryIdentity(base)).toBe(getQueryIdentity(offsetZero))
+  })
+
+  it(`preserves function-argument and orderBy-clause order`, () => {
+    const subtractAge = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .orderBy(({ user }) => subtract(user.age, 1))
+        .orderBy(({ user }) => user.name),
+    )
+    const subtractFromOne = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .orderBy(({ user }) => subtract(1, user.age))
+        .orderBy(({ user }) => user.name),
+    )
+    const reversedClauses = getQueryIR(
+      new Query()
+        .from({ user: usersCollection })
+        .orderBy(({ user }) => user.name)
+        .orderBy(({ user }) => subtract(user.age, 1)),
+    )
+
+    expect(getQueryIdentity(subtractAge)).not.toBe(
+      getQueryIdentity(subtractFromOne),
+    )
+    expect(getQueryIdentity(subtractAge)).not.toBe(
+      getQueryIdentity(reversedClauses),
+    )
+  })
+
+  it(`preserves semantically significant union source ordering`, () => {
+    const usersThenPosts = getQueryIR(
+      new Query().unionAll({ user: usersCollection, post: postsCollection }),
+    )
+    const postsThenUsers = getQueryIR(
+      new Query().unionAll({ post: postsCollection, user: usersCollection }),
+    )
+
+    expect(getStableQueryIRHash(usersThenPosts)).not.toBe(
+      getStableQueryIRHash(postsThenUsers),
+    )
+  })
+
+  it(`changes identity when captured structured values change`, () => {
+    const createQuery = (status: User[`status`]) =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) => eq(user.status, status)),
+      )
+
+    expect(getStableQueryIRHash(createQuery(`active`))).not.toBe(
+      getStableQueryIRHash(createQuery(`inactive`)),
+    )
+  })
+
+  it(`uses evaluator semantics for invalid Date and Temporal values`, () => {
+    expect(getQueryIdentity(createProfileValueQuery(new Date(`invalid`)))).toBe(
+      getQueryIdentity(createProfileValueQuery(new Date(`also invalid`))),
+    )
+    expect(
+      getQueryIdentity(
+        createProfileValueQuery(Temporal.PlainDate.from(`2026-08-24`)),
+      ),
+    ).toBe(
+      getQueryIdentity(
+        createProfileValueQuery(Temporal.PlainDate.from(`2026-08-24`)),
+      ),
+    )
+  })
+
+  it(`normalizes object property ordering in structural value hashes`, () => {
+    expect(
+      getStableValueHash({
+        skills: [`ts`, `db`],
+        experience: { years: 5 },
+      }),
+    ).toBe(
+      getStableValueHash({
+        experience: { years: 5 },
+        skills: [`ts`, `db`],
+      }),
+    )
+  })
+
+  it(`keeps runtime values disjoint from internal identity tags`, () => {
+    const createQuery = (value: unknown) =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) => eq(user.profile, value as never)),
+      )
+
+    const hashes = [
+      undefined,
+      { type: `undefined` },
+      [`undefined`],
+      Number.NaN,
+      { type: `number`, value: `NaN` },
+      new Date(`2024-01-01T00:00:00.000Z`),
+      { type: `Date`, value: `2024-01-01T00:00:00.000Z` },
+    ].map((value) => getStableQueryIRHash(createQuery(value)))
+
+    expect(new Set(hashes).size).toBe(hashes.length)
+  })
+
+  it(`preserves __proto__ as a normal object key`, () => {
+    const withProtoKey = JSON.parse(`{"__proto__":{"value":true}}`) as object
+    const withoutProtoKey = {}
+    const createQuery = (value: object) =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) => eq(user.profile, value as never)),
+      )
+
+    expect(getStableQueryIRHash(createQuery(withProtoKey))).not.toBe(
+      getStableQueryIRHash(createQuery(withoutProtoKey)),
+    )
+  })
+
+  it(`rejects functional query variants`, () => {
+    const queries = [
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .fn.where(({ user }) => user.active),
+      ),
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .fn.select(({ user }) => ({ id: user.id })),
+      ),
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .groupBy(({ user }) => user.teamId)
+          .select(({ user }) => ({
+            teamId: user.teamId,
+            userCount: count(user.id),
+          }))
+          .fn.having(({ $selected }) => $selected.userCount > 1),
+      ),
+    ]
+
+    for (const query of queries) {
+      expect(() => getStableQueryIRHash(query)).toThrow(UnhashableQueryIRError)
+    }
+  })
+
+  it.each([
+    [`function`, () => `Tanner`, () => `Tanner`],
+    [`symbol`, Symbol(`name`), Symbol(`name`)],
+  ])(`keeps %s query values distinct by reference`, (_name, a, b) => {
+    const query = (value: unknown) =>
+      getQueryIR(
+        new Query()
+          .from({ user: usersCollection })
+          .where(({ user }) => eq(user.name, value as never)),
+      )
+
+    expect(getStableQueryIRHash(query(a))).toBe(getStableQueryIRHash(query(a)))
+    expect(getStableQueryIRHash(query(a))).not.toBe(
+      getStableQueryIRHash(query(b)),
+    )
+  })
+
+  it(`accepts opaque object values by reference`, () => {
+    const circularValue: Record<string, unknown> = {}
+    circularValue.self = circularValue
+
+    class OpaqueValue {
+      value = `Tanner`
+    }
+
+    expect(() =>
+      getQueryIdentity(createProfileValueQuery(circularValue)),
+    ).not.toThrow()
+    expect(() =>
+      getQueryIdentity(createProfileValueQuery(new OpaqueValue())),
+    ).not.toThrow()
+  })
+})
diff --git a/packages/db/tests/query/join-result-key-oracle.property.test.ts b/packages/db/tests/query/join-result-key-oracle.property.test.ts
index 8ba8d28b13..9a951ef7a8 100644
--- a/packages/db/tests/query/join-result-key-oracle.property.test.ts
+++ b/packages/db/tests/query/join-result-key-oracle.property.test.ts
@@ -50,6 +50,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { mockSyncCollectionOptions, withOracleCleanup } from '../utils.js'
 
 const property = `join-result-key.pairs`
@@ -259,6 +260,8 @@ async function runHistory(history: History): Promise<void> {
   ])
 }
 
+declareOracle({ check: [runHistory], model: [expectedPairs] })
+
 describe(`joined result key oracle`, () => {
   // The pinned histories and the fixed campaign stand aside during any path
   // replay. The random campaign below is the one that a replay of this
diff --git a/packages/db/tests/query/load-subset-oracle.property.test.ts b/packages/db/tests/query/load-subset-oracle.property.test.ts
index 5c44b67f41..8f3b023e76 100644
--- a/packages/db/tests/query/load-subset-oracle.property.test.ts
+++ b/packages/db/tests/query/load-subset-oracle.property.test.ts
@@ -1,104 +1,54 @@
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { describe, expect, it } from 'vitest'
-import { createCollection } from '../../src/collection/index.js'
 import { createDeferred } from '../../src/deferred.js'
-import {
-  LoadSubsetOperationAbortedError,
-  SyncQueueInvariantError,
-} from '../../src/errors.js'
-import { createOptimisticAction } from '../../src/optimistic-action.js'
-import { createLiveQueryCollection, eq } from '../../src/query/index.js'
 import { Func, PropRef, Value } from '../../src/query/ir.js'
 import { DeduplicatedLoadSubset } from '../../src/query/subset-dedupe.js'
-import { createTransaction } from '../../src/transactions.js'
-import { expectAssertionFailure } from '../expected-failure.js'
 import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
 import {
   oracleRandomParameters,
   readOracleRunConfig,
 } from '../oracle-config.js'
-import { TraceAssertionError } from '../trace-runner.js'
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  exactDemandAxisPairs,
+  toLoadSubsetOptions,
+} from './load-subset-support.js'
+import type { ExactDemand } from './load-subset-support.js'
 import type {
   LoadSubsetOptions,
   LoadSubsetRequestResult,
-  SyncAppliedReceipt,
 } from '../../src/types.js'
 
 /**
- * # When are two loadSubset demands the same, applied, or canceled?
+ * # When are two loadSubset demands the same, and when do they share work?
  *
  * Exact demand identity includes predicate values, order terms and comparison
  * options, offset, limit, and cursor boundary. Equal demands share one physical
  * acquisition; distinct demands do not. Rejection reaches every waiter, then
- * leaves the demand retryable.
- * `refetch` starts fresh work for the same request data. Requests with separate
- * abort signals cannot share in-flight work.
- *
- * A separate application law says provider completion is not enough. Successful
- * loadSubset results wait for their establishing applied receipts. Loaded rows
- * must cross the source Collection publication boundary before initial-query
- * readiness.
- * Abort before that boundary rejects and suppresses the rows. Abort after
- * publication is too late and the applied rows remain visible.
+ * leaves the demand retryable. `refetch` starts fresh work for the same request
+ * data. Requests with separate abort signals cannot share in-flight work.
  *
- * The identity model uses canonical plain records and an independent SQL
- * expression evaluator. The application driver uses real transactions, sync
- * receipts, optimistic work, and live queries. Keeping these nodes separate
- * prevents a correct key function from hiding a broken settlement boundary.
+ * The model is the demand-identity rule: a completed demand starts once, and
+ * only identical in-flight demands share a promise. The checks run the
+ * deduplicating loader over generated demand traces and compare each start
+ * count and promise identity with that rule. The identity model uses an
+ * independent SQL expression evaluator for nullish comparisons, and it does not
+ * use the production fingerprint as the expected value.
  *
- * Authority: the exact-request and applied-settlement contracts in
- * `packages/db/src/query/live/ARCHITECTURE.md` (Demand grouping and ownership,
- * Source cancellation and applied settlement). The plain-record fingerprint
- * models equality of request data, not source coverage or row ownership.
- * The identity driver uses a controlled adapter; its result does not establish
- * that an external provider honors an abort or returns complete ordered rows.
- * `ir-stable-identity-oracle.test.ts` owns demand-key construction. This file
- * owns runtime sharing, retry, and readiness for equal and distinct demands.
- * `load-subset-transaction-refinement-oracle.test.ts` owns the precise
- * abort-versus-acceptance phase law; this campaign checks its effects while
- * demands are deduplicated or retried.
+ * Authority: the exact-request contract in
+ * `packages/db/src/query/live/ARCHITECTURE.md` (Demand grouping and ownership).
+ * The plain-record fingerprint models equality of request data, not source
+ * coverage or row ownership. This file owns runtime sharing and retry for equal
+ * and distinct demands. `ir-stable-identity-oracle.test.ts` owns demand-key
+ * construction. The applied-settlement and cancellation law, which needs real
+ * transactions and sync receipts, is in `load-subset.test.ts`.
  */
 
-type PersistedLoadRow = {
-  id: string
-  projectId: string
-}
-
-type OptimisticDerivedRow = {
-  id: string
-  value: string
-}
-
-type ExactDemand = {
-  values: ReadonlyArray<number>
-  orderField: `rank` | `score`
-  direction: `asc` | `desc`
-  nulls: `first` | `last`
-  stringSort: `lexical` | `locale`
-  offset: number
-  limit: number | undefined
-  cursorBoundary: number | undefined
-}
-
 type ConcurrentExactScenario = {
   trace: ReadonlyArray<ExactDemand>
   settlementOrder: `forward` | `reverse`
 }
 
-const rankRef = new PropRef<number>([`rank`])
-const scoreRef = new PropRef<number>([`score`])
-
-// A load result may include delivery before it awaits the establishing applied
-// receipt. Only commit() returns that receipt.
-function requirePendingLoadSubsetResult(
-  loadResult: LoadSubsetRequestResult,
-): Promise<void> {
-  if (loadResult === true) {
-    throw new Error(`Expected an asynchronous subset load`)
-  }
-  return loadResult
-}
-
 const exactDemandArbitrary: fc.Arbitrary<ExactDemand> = fc
   .record({
     values: fc.uniqueArray(fc.integer({ min: -3, max: 3 }), {
@@ -145,66 +95,6 @@ const concurrentExactScenarioArbitrary: fc.Arbitrary<ConcurrentExactScenario> =
     settlementOrder: fc.constantFrom(`forward` as const, `reverse` as const),
   })
 
-// Each pair differs in only one request-data axis. A deduper that drops that
-// axis would wrongly reuse the first acquisition at the second request.
-const exactDemandAxisPairs: ReadonlyArray<
-  readonly [axis: string, first: ExactDemand, second: ExactDemand]
-> = (() => {
-  const first: ExactDemand = {
-    values: [1, 2],
-    orderField: `rank`,
-    direction: `asc`,
-    nulls: `last`,
-    stringSort: `lexical`,
-    offset: 0,
-    limit: 2,
-    cursorBoundary: undefined,
-  }
-  return [
-    [`predicate values`, first, { ...first, values: [1, 3] }],
-    [`order field`, first, { ...first, orderField: `score` }],
-    [`direction`, first, { ...first, direction: `desc` }],
-    [`null placement`, first, { ...first, nulls: `first` }],
-    [`string sort`, first, { ...first, stringSort: `locale` }],
-    [`offset`, first, { ...first, offset: 1 }],
-    [`limit`, first, { ...first, limit: undefined }],
-    [`cursor boundary`, first, { ...first, cursorBoundary: 1 }],
-  ]
-})()
-
-function toLoadSubsetOptions(demand: ExactDemand): LoadSubsetOptions {
-  const orderRef = demand.orderField === `rank` ? rankRef : scoreRef
-  return {
-    where: new Func(`in`, [scoreRef, new Value([...demand.values])]),
-    orderBy: [
-      {
-        expression: orderRef,
-        compareOptions: {
-          direction: demand.direction,
-          nulls: demand.nulls,
-          stringSort: demand.stringSort,
-        },
-      },
-    ],
-    offset: demand.offset,
-    limit: demand.limit,
-    cursor:
-      demand.cursorBoundary === undefined
-        ? undefined
-        : {
-            whereFrom: new Func(demand.direction === `asc` ? `gt` : `lt`, [
-              orderRef,
-              new Value(demand.cursorBoundary),
-            ]),
-            whereCurrent: new Func(`eq`, [
-              orderRef,
-              new Value(demand.cursorBoundary),
-            ]),
-            lastKey: demand.cursorBoundary,
-          },
-  }
-}
-
 function assertCompletedExactDemandTrace(
   trace: ReadonlyArray<ExactDemand>,
 ): void {
@@ -381,965 +271,19 @@ async function expectExactWaitersShareRejection({
 const { multiplier, ...replay } = readOracleRunConfig()
 const exactScenarioRuns = 40 * multiplier
 
-let collectionSequence = 0
-
-type OracleCleanupStep = {
-  label: string
-  run: () => void | Promise<void>
-}
-
-// A failed law remains the cause even if one or more releases also fail. Run
-// every release so an earlier cleanup failure cannot strand later resources.
-async function runOracleCleanup(
-  law: string,
-  primaryFailure: { error: unknown } | undefined,
-  steps: ReadonlyArray<OracleCleanupStep>,
-): Promise<void> {
-  const cleanupFailures: Array<Error> = []
-  for (const { label, run } of steps) {
-    try {
-      await run()
-    } catch (error) {
-      cleanupFailures.push(
-        new Error(`${label} cleanup failed`, { cause: error }),
-      )
-    }
-  }
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(cleanupFailures, `${law}: cleanup failed`, {
-      cause: primaryFailure?.error,
-    })
-  }
-}
-
-function releasePersistingMutation(
-  persistence: ReturnType<typeof createDeferred<void>>,
-  settlement?: Promise<unknown>,
-): void {
-  persistence.resolve()
-  // A broken applied-settlement path can leave optimistic transaction
-  // settlement pending forever. Collection teardown must proceed; observing
-  // rejection prevents an abandoned promise from becoming an unrelated error.
-  void settlement?.catch(() => undefined)
-}
-
-async function expectPersistingLoadIsApplied(
-  persisting: boolean,
-  delivery: `synchronous` | `asynchronous` = `synchronous`,
-  transactionStart: `during-load` | `before-load` = `during-load`,
-) {
-  const rows: Array<PersistedLoadRow> = [
-    { id: `r1`, projectId: `p1` },
-    { id: `r2`, projectId: `p1` },
-  ]
-  let loadCalls = 0
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-oracle-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        if (transactionStart === `before-load`) begin()
-        markReady()
-        return {
-          loadSubset: () => {
-            loadCalls += 1
-            const applyRows = () => {
-              if (transactionStart === `during-load`) begin()
-              for (const row of rows) {
-                write({ type: `insert`, value: { ...row } })
-              }
-              return commit()
-            }
-            if (delivery === `synchronous`) {
-              return applyRows()
-            }
-            return Promise.resolve().then(async () => {
-              const applied = applyRows()
-              if (applied !== true) await applied
-            })
-          },
-        }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let cleanupLive: (() => Promise<void>) | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    if (persisting) {
-      transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
-    }
-    const live = createLiveQueryCollection((query) =>
-      query.from({ row: source }).where(({ row }) => eq(row.projectId, `p1`)),
-    )
-    cleanupLive = () => live.cleanup()
-    if (persisting) expect(transaction.state).toBe(`persisting`)
-    const ready = live.toArrayWhenReady()
-    if (persisting) {
-      let fulfilled = false
-      void ready.then(
-        () => {
-          fulfilled = true
-        },
-        () => undefined,
-      )
-      await Promise.resolve()
-      await Promise.resolve()
-
-      expect(fulfilled).toBe(false)
-      expect(source.get(`r1`)).toBeUndefined()
-      expect(source.get(`r2`)).toBeUndefined()
-
-      persistence.resolve()
-      await transaction.isPersisted.promise
-    }
-
-    const result = await ready
-    expect(loadCalls).toBe(1)
-    try {
-      expect(result.map(({ id }) => id).sort()).toEqual([`r1`, `r2`])
-    } catch (error) {
-      throw new TraceAssertionError(0, error)
-    }
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `applied load reaches live-query readiness`,
-      primaryFailure,
-      [
-        {
-          label: `optimistic persistence`,
-          run: () => {
-            if (persisting) {
-              releasePersistingMutation(persistence, settlement)
-            }
-          },
-        },
-        { label: `live query`, run: () => cleanupLive?.() },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectAppliedReceiptTiming(
-  gate: `free` | `parked`,
-  delivery: `synchronous` | `asynchronous`,
-): Promise<void> {
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-timing-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        markReady()
-        return {
-          loadSubset: () => {
-            const applyRow = () => {
-              begin()
-              write({
-                type: `insert`,
-                value: { id: `remote`, projectId: `p1` },
-              })
-              return commit()
-            }
-
-            return delivery === `synchronous`
-              ? applyRow()
-              : Promise.resolve().then(async () => {
-                  const applied = applyRow()
-                  if (applied !== true) await applied
-                })
-          },
-        }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    if (gate === `parked`) {
-      transaction.mutate(() => source.insert({ id: `local`, projectId: `p2` }))
-    }
-    if (gate === `parked`) expect(transaction.state).toBe(`persisting`)
-    const loadResult = source._sync.loadSubset({})
-    if (gate === `free` && delivery === `synchronous`) {
-      expect(loadResult).toBe(true)
-      expect(source.get(`remote`)).toEqual(
-        expect.objectContaining({ id: `remote`, projectId: `p1` }),
-      )
-      return
-    }
-
-    const pending = requirePendingLoadSubsetResult(loadResult)
-    let fulfilled = false
-    let visibleWhenFulfilled = false
-    void pending
-      .then(
-        () => {
-          fulfilled = true
-          visibleWhenFulfilled = source.get(`remote`)?.id === `remote`
-        },
-        () => undefined,
-      )
-      .catch(() => undefined)
-
-    expect(fulfilled).toBe(false)
-    expect(source.get(`remote`)).toBeUndefined()
-    await Promise.resolve()
-    await Promise.resolve()
-
-    if (gate === `parked`) {
-      expect(fulfilled).toBe(false)
-      expect(source.get(`remote`)).toBeUndefined()
-      persistence.resolve()
-      await transaction.isPersisted.promise
-    }
-
-    await pending
-    expect(fulfilled).toBe(true)
-    expect(visibleWhenFulfilled).toBe(true)
-    expect(source.get(`remote`)).toEqual(
-      expect.objectContaining({ id: `remote`, projectId: `p1` }),
-    )
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `subset load fulfillment follows application`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectAppliedLoadDoesNotFlushEarlierParkedSync() {
-  const rows: Array<PersistedLoadRow> = [
-    { id: `r1`, projectId: `p1` },
-    { id: `r2`, projectId: `p1` },
-  ]
-  let publishUnrelated!: () => void
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-order-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        publishUnrelated = () => {
-          begin()
-          write({
-            type: `insert`,
-            value: { id: `unrelated`, projectId: `p2` },
-          })
-          commit()
-        }
-        markReady()
-        return {
-          loadSubset: () => {
-            begin()
-            for (const row of rows) {
-              write({ type: `insert`, value: { ...row } })
-            }
-            return commit()
-          },
-        }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let cleanupLive: (() => Promise<void>) | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
-    publishUnrelated()
-    const live = createLiveQueryCollection((query) =>
-      query.from({ row: source }).where(({ row }) => eq(row.projectId, `p1`)),
-    )
-    cleanupLive = () => live.cleanup()
-    expect(transaction.state).toBe(`persisting`)
-    const ready = live.toArrayWhenReady()
-    let fulfilled = false
-    void ready.then(
-      () => {
-        fulfilled = true
-      },
-      () => undefined,
-    )
-    await Promise.resolve()
-    await Promise.resolve()
-
-    expect(fulfilled).toBe(false)
-    expect(source.get(`unrelated`)).toBeUndefined()
-
-    persistence.resolve()
-    await transaction.isPersisted.promise
-    await expect(ready).resolves.toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({ id: `r1` }),
-        expect.objectContaining({ id: `r2` }),
-      ]),
-    )
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `parked stream remains behind applied subset`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `live query`, run: () => cleanupLive?.() },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectCompletionWaitsForAppliedRows() {
-  let publishUnrelated!: () => void
-  let transportCalls = 0
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-coverage-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        publishUnrelated = () => {
-          begin()
-          write({
-            type: `insert`,
-            value: { id: `unrelated`, projectId: `p2` },
-          })
-          commit()
-        }
-        const deduplicated = new DeduplicatedLoadSubset({
-          loadSubset: () => {
-            transportCalls += 1
-            begin()
-            write({
-              type: `insert`,
-              value: { id: `r1`, projectId: `p1` },
-            })
-            return commit()
-          },
-        })
-        markReady()
-        return { loadSubset: deduplicated.loadSubset }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
-    publishUnrelated()
-    const first = source._sync.loadSubset({})
-    expect(first).toBeInstanceOf(Promise)
-    await Promise.resolve()
-    await Promise.resolve()
-
-    const concurrent = source._sync.loadSubset({})
-    expect(concurrent).toBe(first)
-    expect(transportCalls).toBe(1)
-    expect(source.get(`r1`)).toBeUndefined()
-
-    persistence.resolve()
-    await transaction.isPersisted.promise
-    await Promise.all([first, concurrent])
-    expect(source.get(`r1`)).toEqual(
-      expect.objectContaining({ id: `r1`, projectId: `p1` }),
-    )
-    expect(source._sync.loadSubset({})).toBe(true)
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `subset completion follows applied rows`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectConcurrentStreamCommitStaysParked(
-  cancelBeforePersistence = false,
-) {
-  let publishUnrelated!: () => void
-  let publishSubset!: () => void
-  let rejectPendingSubset: ((reason: unknown) => void) | undefined
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-concurrent-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        publishUnrelated = () => {
-          begin()
-          write({
-            type: `insert`,
-            value: { id: `unrelated`, projectId: `p2` },
-          })
-          commit()
-        }
-        markReady()
-        return {
-          loadSubset: () =>
-            new Promise<void>((resolve, reject) => {
-              const fulfill = () => {
-                rejectPendingSubset = undefined
-                resolve()
-              }
-              const fail = (reason: unknown) => {
-                rejectPendingSubset = undefined
-                reject(reason)
-              }
-              rejectPendingSubset = fail
-              publishSubset = () => {
-                try {
-                  begin()
-                  write({
-                    type: `insert`,
-                    value: { id: `r1`, projectId: `p1` },
-                  })
-                  const applied = commit()
-                  if (applied === true) {
-                    fulfill()
-                  } else {
-                    void applied.then(fulfill, fail)
-                  }
-                } catch (error) {
-                  fail(error)
-                }
-              }
-            }),
-        }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
-    const load = requirePendingLoadSubsetResult(source._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    publishUnrelated()
-    publishSubset()
-    let fulfilled = false
-    void load.then(
-      () => {
-        fulfilled = true
-      },
-      () => undefined,
-    )
-    await Promise.resolve()
-    await Promise.resolve()
-
-    expect(fulfilled).toBe(false)
-    expect(source.get(`unrelated`)).toBeUndefined()
-    expect(source.get(`r1`)).toBeUndefined()
-    if (cancelBeforePersistence) {
-      await source.cleanup()
-      await expect(load).rejects.toMatchObject({ name: `AbortError` })
-      return
-    }
-    persistence.resolve()
-    await transaction.isPersisted.promise
-    await load
-    expect(source.get(`unrelated`)).toEqual(
-      expect.objectContaining({ id: `unrelated`, projectId: `p2` }),
-    )
-    expect(source.get(`r1`)).toEqual(
-      expect.objectContaining({ id: `r1`, projectId: `p1` }),
-    )
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `concurrent stream commit remains parked`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        {
-          label: `controlled subset transport`,
-          run: () =>
-            rejectPendingSubset?.(
-              new DOMException(`Oracle fixture released`, `AbortError`),
-            ),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectAbortedReceiptDoesNotSettleDemand(
-  abortPhase: `before-commit` | `while-parked`,
-) {
-  let transportCalls = 0
-  const committed = createDeferred<void>()
-  const deduplicated = new DeduplicatedLoadSubset({
-    loadSubset: async ({ signal }) => {
-      transportCalls += 1
-      if (abortPhase === `before-commit`) {
-        // Give cancellation a chance to revoke this request before its
-        // request-scoped rows enter the collection transaction.
-        await Promise.resolve()
-        if (signal?.aborted) {
-          return
-        }
-      }
-      begin()
-      write({
-        type: `insert`,
-        value: { id: `row`, projectId: `p1` },
-      })
-      const applied = commit(signal)
-      committed.resolve()
-      if (applied !== true) await applied
-      // Source contract: accepted rows apply, but a caller that aborted sees
-      // `AbortError`.
-      if (signal?.aborted) throw new LoadSubsetOperationAbortedError()
-    },
-  })
-  let begin!: () => void
-  let write!: (message: { type: `insert`; value: PersistedLoadRow }) => void
-  let commit!: (signal?: AbortSignal) => SyncAppliedReceipt
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-abort-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: (params) => {
-        begin = params.begin
-        write = params.write
-        commit = params.commit
-        params.markReady()
-        return { loadSubset: deduplicated.loadSubset }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  const controller = new AbortController()
-  let settlement: Promise<unknown> | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() => source.insert({ id: `local`, projectId: `p2` }))
-    const first = requirePendingLoadSubsetResult(
-      source._sync.loadSubset({ signal: controller.signal }),
-    )
-    if (abortPhase === `while-parked`) {
-      await committed.promise
-    }
-    controller.abort()
-    persistence.resolve()
-    await transaction.isPersisted.promise
-    // An accepted transaction always applies, so the row publishes when the
-    // mutation settles. A caller that aborted still sees `AbortError`.
-    if (abortPhase === `while-parked`)
-      await expect(first).rejects.toMatchObject({ name: `AbortError` })
-    else await first
-    expect(transportCalls).toBe(1)
-    if (abortPhase === `while-parked`)
-      expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
-    else expect(source.get(`row`)).toBeUndefined()
-
-    const retry = source._sync.loadSubset({})
-    if (retry !== true) await retry
-    expect(transportCalls).toBe(2)
-    expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `aborted receipt remains retryable`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectAbortDuringPublicationDoesNotCancelReceipt() {
-  const controller = new AbortController()
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-publication-abort-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        markReady()
-        return {
-          loadSubset: ({ signal }) => {
-            begin()
-            write({
-              type: `insert`,
-              value: { id: `row`, projectId: `p1` },
-            })
-            return commit(signal)
-          },
-        }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let unsubscribe: (() => void) | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() =>
-      source.insert({ id: `local`, projectId: `pending` }),
-    )
-    const subscription = source.subscribeChanges((changes) => {
-      if (changes.some((change) => change.key === `row`)) {
-        controller.abort()
-      }
-    })
-    unsubscribe = () => subscription.unsubscribe()
-    const load = requirePendingLoadSubsetResult(
-      source._sync.loadSubset({ signal: controller.signal }),
-    )
-    persistence.resolve()
-    await transaction.isPersisted.promise
-    await expect(load).resolves.toBeUndefined()
-    expect(controller.signal.aborted).toBe(true)
-    expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `abort during publication retains applied rows`,
-      primaryFailure,
-      [
-        { label: `change subscription`, run: () => unsubscribe?.() },
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectCanceledReceiptReleasesOnlyItsSuppression() {
-  let begin!: () => void
-  let write!: (message: { type: `update`; value: PersistedLoadRow }) => void
-  let commit!: (signal?: AbortSignal) => SyncAppliedReceipt
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-cancel-suppression-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    sync: {
-      sync: (params) => {
-        begin = params.begin
-        write = params.write
-        commit = params.commit
-        begin()
-        write({ type: `update`, value: { id: `first`, projectId: `old` } })
-        write({ type: `update`, value: { id: `second`, projectId: `old` } })
-        commit()
-        params.markReady()
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    await source.preload()
-    await Promise.resolve()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() =>
-      source.insert({ id: `local`, projectId: `pending` }),
-    )
-    expect(transaction.state).toBe(`persisting`)
-    begin()
-    write({ type: `update`, value: { id: `first`, projectId: `new` } })
-    const accepted = commit()
-    const acceptedTransaction = source._state.pendingSyncedTransactions.at(-1)!
-    expect(source._state.pendingSyncedTransactions).toHaveLength(1)
-    begin()
-    write({ type: `update`, value: { id: `second`, projectId: `new` } })
-    expect(source._state.pendingSyncedTransactions).toHaveLength(2)
-
-    // Only the accepted transaction publishes in a drain, so only its key is
-    // suppressed; the open one holds no suppression to release.
-    source._state.capturePreSyncVisibleState()
-    expect(source._state.recentlySyncedKeys).toEqual(new Set([`first`]))
-
-    // Only the open last transaction can be canceled.
-    expect(() =>
-      source._state.cancelPendingSyncedTransaction(acceptedTransaction),
-    ).toThrow(SyncQueueInvariantError)
-    const controller = new AbortController()
-    controller.abort()
-    const canceled = commit(controller.signal)
-    expect(source._state.pendingSyncedTransactions).toHaveLength(1)
-    expect(source._state.recentlySyncedKeys).toEqual(new Set([`first`]))
-    expect(source._state.preSyncVisibleState.has(`second`)).toBe(false)
-    expect(source._state.preSyncVisibleState.has(`first`)).toBe(true)
-    await expect(canceled).rejects.toMatchObject({ name: `AbortError` })
-    expect(accepted).not.toBe(true)
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `canceled receipt releases only its suppression`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectCleanupRejectsDemandOnce() {
-  let receipt!: Promise<void>
-  let transportCalls = 0
-  const deduplicated = new DeduplicatedLoadSubset({
-    loadSubset: () => {
-      transportCalls += 1
-      begin()
-      write({
-        type: `insert`,
-        value: { id: `row`, projectId: `p1` },
-      })
-      const applied = commit()
-      if (transportCalls === 1) {
-        if (applied === true) {
-          throw new Error(`Expected the subset transaction to remain parked`)
-        }
-        receipt = applied
-      }
-      return applied
-    },
-  })
-  let begin!: () => void
-  let write!: (message: { type: `insert`; value: PersistedLoadRow }) => void
-  let commit!: () => SyncAppliedReceipt
-  const source = createCollection<PersistedLoadRow>({
-    id: `load-subset-applied-cleanup-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: (params) => {
-        begin = params.begin
-        write = params.write
-        commit = params.commit
-        params.markReady()
-        return {
-          loadSubset: deduplicated.loadSubset,
-          cleanup: () => deduplicated.reset(),
-        }
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let settlements = 0
-
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    source.startSyncImmediate()
-    const transaction = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    settlement = transaction.isPersisted.promise
-    transaction.mutate(() => source.insert({ id: `local`, projectId: `p2` }))
-    const load = requirePendingLoadSubsetResult(source._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    void receipt.then(
-      () => {
-        settlements += 1
-      },
-      () => {
-        settlements += 1
-      },
-    )
-    await source.cleanup()
-    await expect(load).rejects.toMatchObject({ name: `AbortError` })
-    await expect(receipt).rejects.toMatchObject({ name: `AbortError` })
-    expect(settlements).toBe(1)
-
-    persistence.resolve()
-    await transaction.isPersisted.promise.catch(() => undefined)
-    await Promise.resolve()
-    expect(settlements).toBe(1)
-
-    // Restarting installs fresh sync controls. Reacquisition must both perform
-    // transport work and publish its rows; stale callbacks cannot prove either.
-    source.startSyncImmediate()
-    const retry = source._sync.loadSubset({})
-    if (retry !== true) await retry
-    expect(transportCalls).toBe(2)
-    expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `cleanup rejects abandoned demand once`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
-
-async function expectDerivedSyncDuringOptimisticMutation(): Promise<void> {
-  let begin!: () => void
-  let write!: (message: { type: `insert`; value: OptimisticDerivedRow }) => void
-  let commit!: () => void
-  const source = createCollection<OptimisticDerivedRow>({
-    id: `optimistic-derived-source-${collectionSequence++}`,
-    getKey: (row) => row.id,
-    sync: {
-      sync: (params) => {
-        begin = params.begin
-        write = params.write
-        commit = params.commit
-        params.markReady()
-      },
-    },
-  })
-  const persistence = createDeferred<void>()
-  let settlement: Promise<unknown> | undefined
-  let cleanupDerived: (() => Promise<void>) | undefined
-  let primaryFailure: { error: unknown } | undefined
-  try {
-    const derived = createLiveQueryCollection({
-      query: (query) =>
-        query
-          .from({ row: source })
-          .select(({ row }) => ({ id: row.id, value: row.value })),
-      getKey: (row) => row.id,
-      startSync: true,
-    })
-    cleanupDerived = () => derived.cleanup()
-    // Query collections currently expose read-side virtual properties in their
-    // insert input type even though the runtime accepts the plain selected row.
-    const insertDerived = derived.insert.bind(derived) as unknown as (
-      row: OptimisticDerivedRow,
-    ) => ReturnType<typeof derived.insert>
-    const insertOptimistically = createOptimisticAction<OptimisticDerivedRow>({
-      onMutate: insertDerived,
-      mutationFn: () => persistence.promise,
-    })
-    await derived.preload()
-    const transaction = insertOptimistically({
-      id: `optimistic`,
-      value: `optimistic`,
-    })
-    settlement = transaction.isPersisted.promise
-    begin()
-    write({ type: `insert`, value: { id: `synced`, value: `synced` } })
-    commit()
-
-    try {
-      expect([...derived.keys()].sort()).toEqual([`optimistic`, `synced`])
-    } catch (error) {
-      throw new TraceAssertionError(0, error)
-    }
-  } catch (error) {
-    primaryFailure = { error }
-    throw error
-  } finally {
-    await runOracleCleanup(
-      `derived sync during optimistic mutation`,
-      primaryFailure,
-      [
-        {
-          label: `persistence gate`,
-          run: () => releasePersistingMutation(persistence, settlement),
-        },
-        { label: `derived collection`, run: () => cleanupDerived?.() },
-        { label: `source collection`, run: () => source.cleanup() },
-      ],
-    )
-  }
-}
+// The checks are the drivers that run one history and compare it with the
+// demand-identity model: a completed demand starts once, and only identical
+// in-flight demands share a promise. The rejected-waiter driver compares each
+// attempt with the transports that it expects. The grammar is the exact-demand
+// trace arbitrary, which the calibration test below reads for coverage.
+declareOracle({
+  check: [
+    assertCompletedExactDemandTrace,
+    assertConcurrentExactDemandTrace,
+    expectExactWaitersShareRejection,
+  ],
+  grammar: [exactDemandTraceArbitrary],
+})
 
 describe(`exact loadSubset demand oracle`, () => {
   it.each(exactDemandAxisPairs)(
@@ -1353,51 +297,6 @@ describe(`exact loadSubset demand oracle`, () => {
     },
   )
 
-  it(`refetch starts fresh work for the same exact demand`, () => {
-    let starts = 0
-    const dedupe = new DeduplicatedLoadSubset({
-      loadSubset: () => {
-        starts++
-        return true
-      },
-    })
-    const options = toLoadSubsetOptions(exactDemandAxisPairs[0]![1])
-
-    expect(dedupe.loadSubset(options)).toBe(true)
-    expect(dedupe.loadSubset(options)).toBe(true)
-    expect(starts).toBe(1)
-
-    expect(dedupe.loadSubset({ ...options, refetch: true })).toBe(true)
-    expect(starts).toBe(2)
-    expect(dedupe.loadSubset(options)).toBe(true)
-    expect(starts).toBe(2)
-  })
-
-  it(`starts separate acquisitions for independently cancelable exact demands`, async () => {
-    const acquisitions: Array<ReturnType<typeof createDeferred<void>>> = []
-    const dedupe = new DeduplicatedLoadSubset({
-      loadSubset: () => {
-        const acquisition = createDeferred<void>()
-        acquisitions.push(acquisition)
-        return acquisition.promise
-      },
-    })
-    const options = toLoadSubsetOptions(exactDemandAxisPairs[0]![1])
-    const first = dedupe.loadSubset({
-      ...options,
-      signal: new AbortController().signal,
-    })
-    const second = dedupe.loadSubset({
-      ...options,
-      signal: new AbortController().signal,
-    })
-
-    expect(acquisitions).toHaveLength(2)
-    expect(first).not.toBe(second)
-    for (const acquisition of acquisitions) acquisition.resolve()
-    await Promise.all([first, second])
-  })
-
   it(`uses SQL unknown for nullish comparisons in the independent model`, () => {
     const missing = new PropRef<number | null>([`missing`])
 
@@ -1530,204 +429,3 @@ describe(`exact loadSubset demand oracle`, () => {
     expectExactWaitersShareRejection,
   )
 })
-
-describe(`loadSubset application and cancellation`, () => {
-  it(`releases a pending mutation and source despite a cleanup fault`, async () => {
-    const primary = new TraceAssertionError(
-      4,
-      new Error(`subset load fulfilled before application`),
-    )
-    const persistence = createDeferred<void>()
-    const stillPending = createDeferred<void>()
-    const cleanupFault = new Error(`subscription release failed`)
-    const released: Array<string> = []
-    let cleanupWaitFulfilled = false
-    let cleanupWaitFulfilledAtCleanup = false
-    void stillPending.promise.then(
-      () => {
-        cleanupWaitFulfilled = true
-      },
-      () => undefined,
-    )
-
-    let failure: unknown
-    try {
-      await runOracleCleanup(
-        `subset load fulfillment follows application`,
-        { error: primary },
-        [
-          {
-            label: `persistence gate`,
-            run: () => {
-              released.push(`persistence gate`)
-              releasePersistingMutation(persistence, stillPending.promise)
-            },
-          },
-          {
-            label: `subscription`,
-            run: () => {
-              released.push(`subscription`)
-              throw cleanupFault
-            },
-          },
-          {
-            label: `source collection`,
-            run: () => {
-              released.push(`source collection`)
-            },
-          },
-        ],
-      )
-    } catch (error) {
-      failure = error
-    } finally {
-      cleanupWaitFulfilledAtCleanup = cleanupWaitFulfilled
-      stillPending.resolve()
-    }
-
-    await persistence.promise
-    expect(released).toEqual([
-      `persistence gate`,
-      `subscription`,
-      `source collection`,
-    ])
-    expect(cleanupWaitFulfilledAtCleanup).toBe(false)
-    expect(failure).toBeInstanceOf(AggregateError)
-    const aggregate = failure as AggregateError
-    expect(aggregate.cause).toBe(primary)
-    expect(primary.checkpoint).toBe(4)
-    expect(aggregate.errors).toEqual([
-      new Error(`subscription cleanup failed`, { cause: cleanupFault }),
-    ])
-  })
-
-  it(`keeps the violated law and checkpoint when two cleanup steps fail`, async () => {
-    const primary = new TraceAssertionError(
-      3,
-      new Error(`loaded row absent at readiness`),
-    )
-    const firstCleanup = new Error(`release failed`)
-    const secondCleanup = new Error(`collection cleanup failed`)
-    const releases: Array<string> = []
-
-    let failure: unknown
-    try {
-      await runOracleCleanup(
-        `applied load reaches live-query readiness`,
-        { error: primary },
-        [
-          {
-            label: `acquisition`,
-            run: () => {
-              releases.push(`acquisition`)
-              throw firstCleanup
-            },
-          },
-          {
-            label: `live query`,
-            run: () => {
-              releases.push(`live query`)
-              throw secondCleanup
-            },
-          },
-          {
-            label: `source collection`,
-            run: () => {
-              releases.push(`source collection`)
-            },
-          },
-        ],
-      )
-    } catch (error) {
-      failure = error
-    }
-
-    expect(failure).toBeInstanceOf(AggregateError)
-    const aggregate = failure as AggregateError
-    expect(aggregate.message).toContain(
-      `applied load reaches live-query readiness`,
-    )
-    expect(aggregate.cause).toBe(primary)
-    expect(primary.checkpoint).toBe(3)
-    expect(aggregate.errors).toHaveLength(2)
-    expect(aggregate.errors[0]).toMatchObject({
-      message: `acquisition cleanup failed`,
-      cause: firstCleanup,
-    })
-    expect(aggregate.errors[1]).toMatchObject({
-      message: `live query cleanup failed`,
-      cause: secondCleanup,
-    })
-    expect(releases).toEqual([`acquisition`, `live query`, `source collection`])
-  })
-
-  it(`applies loaded rows when no mutation is persisting`, async () => {
-    await expectPersistingLoadIsApplied(false)
-  })
-
-  it(`applies loaded rows before resolving readiness behind a persisting mutation`, async () => {
-    await expectPersistingLoadIsApplied(true)
-  })
-
-  it(`applies asynchronously delivered rows before resolving readiness`, async () => {
-    await expectPersistingLoadIsApplied(true, `asynchronous`)
-  })
-
-  it(`applies a transaction opened before its subset demand`, async () => {
-    await expectPersistingLoadIsApplied(true, `synchronous`, `before-load`)
-  })
-
-  it.each([
-    [`free`, `synchronous`],
-    [`free`, `asynchronous`],
-    [`parked`, `synchronous`],
-    [`parked`, `asynchronous`],
-  ] as const)(
-    `preserves applied-receipt timing with a %s gate and %s delivery`,
-    expectAppliedReceiptTiming,
-  )
-
-  it(`does not flush earlier parked sync work to apply a subset load`, async () => {
-    await expectAppliedLoadDoesNotFlushEarlierParkedSync()
-  })
-
-  it(`fulfills a subset load only after its rows apply`, async () => {
-    await expectCompletionWaitsForAppliedRows()
-  })
-
-  it(`keeps an unrelated stream commit parked during a subset acquisition`, async () => {
-    await expectConcurrentStreamCommitStaysParked()
-  })
-
-  it(`rejects the controlled subset transport when its applied receipt is canceled`, async () => {
-    await expectConcurrentStreamCommitStaysParked(true)
-  })
-
-  it.each([`before-commit`, `while-parked`] as const)(
-    `rejects an aborted demand and keeps its accepted rows when aborted %s`,
-    expectAbortedReceiptDoesNotSettleDemand,
-  )
-
-  it(`ignores an abort raised after application starts publishing`, async () => {
-    await expectAbortDuringPublicationDoesNotCancelReceipt()
-  })
-
-  it(`releases only a canceled receipt's event suppression`, async () => {
-    await expectCanceledReceiptReleasesOnlyItsSuppression()
-  })
-
-  it(`rejects an abandoned demand once`, async () => {
-    await expectCleanupRejectsDemandOnce()
-  })
-
-  it(`publishes synced source rows while a derived mutation persists`, async () => {
-    await expectAssertionFailure(expectDerivedSyncDuringOptimisticMutation, {
-      checkpoint: 0,
-      classify: ({ actual, expected }) =>
-        Array.isArray(actual) &&
-        actual.join(`,`) === `optimistic` &&
-        Array.isArray(expected) &&
-        expected.join(`,`) === `optimistic,synced`,
-    })()
-  })
-})
diff --git a/packages/db/tests/query/load-subset-replay-refinement-oracle.test.ts b/packages/db/tests/query/load-subset-replay-refinement-oracle.test.ts
index 82ad13c645..03fabfe257 100644
--- a/packages/db/tests/query/load-subset-replay-refinement-oracle.test.ts
+++ b/packages/db/tests/query/load-subset-replay-refinement-oracle.test.ts
@@ -1,5 +1,6 @@
 import fc from 'fast-check'
 import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
 import {
   createLiveQueryCollection,
   eq,
@@ -7,1066 +8,31 @@ import {
   not,
   toArray,
 } from '../../src/query/index.js'
-import { createCollection } from '../../src/collection/index.js'
-import { CollectionSubscription } from '../../src/collection/subscription.js'
-import { createDeferred } from '../../src/deferred.js'
-import { BasicIndex } from '../../src/indexes/basic-index.js'
 import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import { CollectionSubscription } from '../../src/collection/subscription.js'
+import { createOracleReach } from '../oracle-reach.js'
 import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
 import { flushPromises } from '../utils.js'
-import { createOracleReach } from '../oracle-reach.js'
 import {
   oraclePropertyOptions,
   oracleRuns,
   readOracleRunConfig,
 } from '../oracle-config.js'
-import type {
-  ChangeMessageOrDeleteKeyMessage,
-  LoadSubsetOptions,
-  SyncConfig,
-} from '../../src/types.js'
+import { declareOracle } from '../oracle-declaration.js'
+import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
 
 /**
- * # Which replay may replace a loadSubset publication?
- *
- * Contract: The replay-participant rules and normative publication law 9 in
- * packages/db/src/query/live/ARCHITECTURE.md require a complete participating
- * source set before a truncate replay publishes. A failed replay keeps the
- * prior public snapshot and later partial source changes private. A retired
- * logical demand stops participating. Source cleanup terminates dependent
- * live queries. A direct subscriber can acquire again after restart.
- *
- * Model: the expected public rows are the last complete public snapshot until
- * every current replay participant succeeds or retires. Older overlapping
- * work that a newer replay aborted participates no more: an abort ends the
- * load (maintainer decision), so its later settlement neither holds nor
- * changes publication. A completed replacement supplies the next public
- * rows.
- * The literal expected row sets below instantiate this rule independently of
- * the Collection's replay bookkeeping.
+ * # Which ordered window does a truncate replay publish?
  *
- * History grammar: fixed one-row and multi-row source replacements, failed
- * work, later writes, overlapping attempts, retired include routes, joined
- * sources, and cleanup/restart. Deferred loadSubset results control settlement.
- * The driver uses real Collections and live queries. At each held or settled
- * checkpoint, it compares exact public rows and callback reads with the model;
- * selected histories also compare batches, readiness, and acquisition release.
- * These controlled adapter promises do not establish real-provider cancellation
- * or every legal replay interleaving.
+ * Contract: ARCHITECTURE.md, "Ordered requests, continuation, and recovery"
+ * and the truncate-replay rules (law 9). A truncate replays the demands that
+ * a subscription holds, and a failed replay keeps the prior public rows. The
+ * generated ordered-window histories below are checked by `checkOrderedReplay`.
+ * The fixed-scenario replay tests that compared literal row sets were moved to
+ * load-subset-replay-refinement.test.ts, because their expectations were written
+ * values, not a model.
  */
 
-type Row = { id: string; version: number }
-type ObservedRow = { sourceId: string; rowKey: string; version: number }
-
-type CleanupTask = { name: string; run: () => unknown | Promise<unknown> }
-
-async function finishCleanup(
-  primaryFailure: { error: unknown } | undefined,
-  phases: ReadonlyArray<ReadonlyArray<CleanupTask>>,
-): Promise<void> {
-  const cleanupErrors: Array<Error> = []
-  for (const phase of phases) {
-    const results = await Promise.allSettled(
-      phase.map(({ run }) => Promise.resolve().then(run)),
-    )
-    for (const [index, result] of results.entries()) {
-      if (result.status === `rejected`) {
-        cleanupErrors.push(
-          new Error(`${phase[index]!.name} cleanup failed`, {
-            cause: result.reason,
-          }),
-        )
-      }
-    }
-  }
-  if (cleanupErrors.length > 0) {
-    throw new AggregateError(
-      cleanupErrors,
-      `Replay oracle cleanup failed`,
-      primaryFailure && { cause: primaryFailure.error },
-    )
-  }
-}
-
-describe(`loadSubset replay refinement`, () => {
-  it(`preserves a replay mismatch and separate cleanup failures`, async () => {
-    const mismatch = new Error(`public snapshot mismatch after failed replay`)
-    const unloadFailure = new Error(`unload failed`)
-    const sourceFailure = new Error(`source cleanup failed`)
-    const completed: Array<string> = []
-    let reported: unknown
-
-    try {
-      await finishCleanup({ error: mismatch }, [
-        [
-          {
-            name: `acquisition unload`,
-            run: () => {
-              completed.push(`unload`)
-              throw unloadFailure
-            },
-          },
-          {
-            name: `subscription`,
-            run: () => completed.push(`subscription`),
-          },
-        ],
-        [
-          {
-            name: `source`,
-            run: () => {
-              completed.push(`source`)
-              throw sourceFailure
-            },
-          },
-        ],
-      ])
-    } catch (error) {
-      reported = error
-    }
-
-    expect(completed).toEqual([`unload`, `subscription`, `source`])
-    expect(reported).toBeInstanceOf(AggregateError)
-    const failure = reported as AggregateError
-    expect(failure.cause).toBe(mismatch)
-    expect(failure.errors).toHaveLength(2)
-    expect((failure.errors[0] as Error).message).toBe(
-      `acquisition unload cleanup failed`,
-    )
-    expect((failure.errors[0] as Error).cause).toBe(unloadFailure)
-    expect((failure.errors[1] as Error).message).toBe(`source cleanup failed`)
-    expect((failure.errors[1] as Error).cause).toBe(sourceFailure)
-  })
-
-  // A direct subscriber survives source Collection cleanup. A dependent live
-  // query enters
-  // a terminal error instead; restarting only its source must not revive it.
-  it.each(
-    ([`direct`, `live`] as const).flatMap((consumer) =>
-      ([`resolve`, `reject`] as const).map((outcome) => ({
-        consumer,
-        outcome,
-      })),
-    ),
-  )(
-    `separates direct restart from fatal source Collection cleanup for a live query: %j`,
-    async ({ consumer, outcome }) => {
-      let operations!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
-      let loads = 0
-      const pending = createDeferred<void>()
-      void pending.promise.catch(() => undefined)
-      const initial = [{ id: `row`, version: 1 }]
-      const replacement = [{ id: `row`, version: 2 }]
-      const source = createCollection<Row, string>({
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (next) => {
-            operations = next
-            next.markReady()
-            return {
-              loadSubset: () => {
-                if (++loads > 1) return pending.promise
-                next.begin()
-                next.write({ type: `insert`, value: initial[0]! })
-                next.commit()
-                return true
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const live =
-        consumer === `live`
-          ? createLiveQueryCollection((q) => q.from({ row: source }))
-          : undefined
-      const visible = new Map<string, Row>()
-      const rows = (values: ReadonlyArray<Row>) =>
-        values.map(({ id, version }) => ({ id, version }))
-      const readEvents = () => rows([...visible.values()])
-      const read = () => (live ? rows(live.toArray) : readEvents())
-      const publications: Array<Array<Row>> = []
-      const subscription = (live ?? source).subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            if (change.type === `delete`) visible.delete(String(change.key))
-            else visible.set(String(change.key), { ...change.value })
-          }
-          publications.push(readEvents())
-        },
-        { includeInitialState: consumer === `live` },
-      )
-
-      let primaryFailure: { error: unknown } | undefined
-      try {
-        if (live) await live.preload()
-        else subscription.requestSnapshot({})
-        await flushPromises()
-        expect(loads).toBe(1)
-        expect(read()).toEqual(initial)
-        expect(readEvents()).toEqual(initial)
-        publications.length = 0
-
-        // A live query refuses the public cleanup; internal teardown that
-        // bypasses it is fatal for the query.
-        if (live) {
-          await expect(source.cleanup()).rejects.toThrow(/dependent/)
-          await source._lifecycle.cleanup()
-          expect(live.status).toBe(`crashed`)
-        } else await source.cleanup()
-        source.startSyncImmediate()
-        await flushPromises()
-        expect(loads).toBe(2)
-        expect(read()).toEqual(initial)
-        // Cleanup may change row metadata without changing the public data.
-        for (const publication of publications)
-          expect(publication).toEqual(initial)
-
-        operations.begin()
-        operations.write({ type: `insert`, value: replacement[0]! })
-        await operations.commit()
-        await flushPromises()
-        expect(rows(source.toArray)).toEqual(replacement)
-        expect(read()).toEqual(initial)
-        expect(readEvents()).toEqual(initial)
-        for (const publication of publications)
-          expect(publication).toEqual(initial)
-        publications.length = 0
-
-        if (outcome === `resolve`) pending.resolve()
-        else pending.reject(new Error(`restart failed`))
-        await flushPromises()
-        const publishes = consumer === `direct` && outcome === `resolve`
-        const expected = publishes ? replacement : initial
-        expect(read()).toEqual(expected)
-        expect(readEvents()).toEqual(expected)
-        expect(publications).toEqual(publishes ? [replacement] : [])
-        if (live) expect(live.status).toBe(`crashed`)
-      } catch (error) {
-        primaryFailure = { error }
-        throw error
-      } finally {
-        await finishCleanup(primaryFailure, [
-          [
-            { name: `pending replay`, run: () => pending.resolve() },
-            { name: `subscription`, run: () => subscription.unsubscribe() },
-          ],
-          [{ name: `live query`, run: () => live?.cleanup() }],
-          [{ name: `source`, run: () => source.cleanup() }],
-        ])
-      }
-    },
-  )
-
-  it(`publishes a successful sibling after a settled failed include route retires`, async () => {
-    type Parent = { id: string; left: number | null; right: number }
-    type Child = { id: number; version: number }
-    let parentSync!: Parameters<SyncConfig<Parent, string>[`sync`]>[0]
-    let childSync!: Parameters<SyncConfig<Child, number>[`sync`]>[0]
-    const failed = createDeferred<void>()
-    const successful = createDeferred<void>()
-    const loads: Array<{ options: LoadSubsetOptions; ids: Array<number> }> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    const parents = createCollection<Parent, string>({
-      id: `settled-peer-parent`,
-      getKey: ({ id }) => id,
-      sync: {
-        sync: (operations) => {
-          parentSync = operations
-          operations.begin()
-          operations.write({
-            type: `insert`,
-            value: { id: `parent`, left: 1, right: 2 },
-          })
-          operations.commit()
-          operations.markReady()
-        },
-      },
-    })
-    const children = createCollection<Child, number>({
-      id: `settled-peer-children`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      autoIndex: `eager`,
-      defaultIndexType: BasicIndex,
-      sync: {
-        sync: (operations) => {
-          childSync = operations
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              const rows = [1, 2]
-                .map((id) => ({ id, version: loads.length < 2 ? 1 : 2 }))
-                .filter(
-                  (row) =>
-                    !options.where ||
-                    evaluateReferenceExpression(options.where, row) === true,
-                )
-              loads.push({ options, ids: rows.map(({ id }) => id) })
-              operations.begin()
-              for (const value of rows)
-                operations.write({ type: `insert`, value })
-              operations.commit()
-              if (loads.length <= 2) return true
-              return rows.some(({ id }) => id === 1)
-                ? failed.promise
-                : successful.promise
-            },
-            unloadSubset: (options) => {
-              unloads.push(options)
-            },
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) =>
-      q.from({ parent: parents }).select(({ parent }) => ({
-        id: parent.id,
-        left: toArray(
-          q
-            .from({ leftChild: children })
-            .where(({ leftChild }) => eq(leftChild.id, parent.left)),
-        ),
-        right: toArray(
-          q
-            .from({ rightChild: children })
-            .where(({ rightChild }) => eq(rightChild.id, parent.right)),
-        ),
-      })),
-    )
-    const read = () =>
-      live.toArray.map(({ id, left, right }) => ({
-        id,
-        left: left.map(({ id: key, version }) => ({ id: key, version })),
-        right: right.map(({ id: key, version }) => ({ id: key, version })),
-      }))
-    const publications: Array<ReturnType<typeof read>> = []
-    const subscription = live.subscribeChanges(
-      () => publications.push(read()),
-      { includeInitialState: false },
-    )
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      await live.preload()
-      expect(loads.map(({ ids }) => ids)).toEqual([[1], [2]])
-      const initial = [
-        {
-          id: `parent`,
-          left: [{ id: 1, version: 1 }],
-          right: [{ id: 2, version: 1 }],
-        },
-      ]
-      expect(read()).toEqual(initial)
-      publications.length = 0
-      childSync.begin()
-      childSync.truncate()
-      childSync.commit()
-      await flushPromises()
-      expect(loads.slice(2).map(({ ids }) => ids)).toEqual([[1], [2]])
-      failed.reject(new Error(`left replay failed`))
-      successful.resolve()
-      await flushPromises()
-      expect(read()).toEqual(initial)
-      expect(publications).toEqual([])
-      parentSync.begin()
-      parentSync.write({
-        type: `update`,
-        value: { id: `parent`, left: null, right: 2 },
-      })
-      parentSync.commit()
-      await flushPromises()
-      expect(read()).toEqual([
-        { id: `parent`, left: [], right: [{ id: 2, version: 2 }] },
-      ])
-      expect(publications).toEqual([
-        [{ id: `parent`, left: [], right: [{ id: 2, version: 2 }] }],
-      ])
-      expect(loads).toHaveLength(4)
-      expect(unloads).toContain(loads[2]!.options)
-      expect(loads[2]!.options.signal?.aborted).toBe(true)
-      expect(loads[3]!.options.signal?.aborted).toBe(false)
-      childSync.begin()
-      childSync.write({ type: `update`, value: { id: 2, version: 3 } })
-      childSync.commit()
-      await flushPromises()
-      expect(read()).toEqual([
-        { id: `parent`, left: [], right: [{ id: 2, version: 3 }] },
-      ])
-      expect(publications).toHaveLength(2)
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishCleanup(primaryFailure, [
-        [
-          { name: `failed replay`, run: () => failed.resolve() },
-          { name: `successful replay`, run: () => successful.resolve() },
-          { name: `subscription`, run: () => subscription.unsubscribe() },
-        ],
-        [{ name: `live query`, run: () => live.cleanup() }],
-        [
-          { name: `parents`, run: () => parents.cleanup() },
-          { name: `children`, run: () => children.cleanup() },
-        ],
-      ])
-    }
-    expect(unloads).toHaveLength(loads.length)
-    for (const { options } of loads) {
-      expect(unloads.filter((unloaded) => unloaded === options)).toHaveLength(1)
-    }
-  })
-
-  function createHarness(
-    sourceId: string,
-    initialRows: ReadonlyArray<Row> = [{ id: `row`, version: 1 }],
-  ) {
-    let begin!: () => void
-    let write!: (message: ChangeMessageOrDeleteKeyMessage<Row, string>) => void
-    let commit!: () => void
-    let truncate!: () => void
-    let loadCount = 0
-    const pending: Array<{
-      options: LoadSubsetOptions
-      deferred: ReturnType<typeof createDeferred<void>>
-    }> = []
-    const batches: Array<
-      Array<{
-        type: `insert` | `update` | `delete`
-        row: { sourceId: string; rowKey: string; version: number }
-        previousVersion?: number
-      }>
-    > = []
-    const source = createCollection<Row>({
-      id: sourceId,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          begin = params.begin
-          write = params.write
-          commit = params.commit
-          truncate = params.truncate
-          params.markReady()
-          return {
-            loadSubset: (options) => {
-              loadCount++
-              if (loadCount === 1) {
-                begin()
-                for (const value of initialRows) {
-                  write({ type: `insert`, value })
-                }
-                commit()
-                return true
-              }
-              const deferred = createDeferred<void>()
-              pending.push({ options, deferred })
-              return deferred.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const downstream = createLiveQueryCollection({
-      id: `${sourceId}-downstream`,
-      query: (q) =>
-        q.from({ row: source }).select(({ row }) => ({
-          id: row.id,
-          version: row.version,
-        })),
-      startSync: true,
-    })
-    const callbackReads: Array<Array<ObservedRow>> = []
-    const subscription = downstream.subscribeChanges(
-      (changes) => {
-        const batch = changes.map((change) => ({
-          type: change.type,
-          row: {
-            sourceId,
-            rowKey: String(change.key),
-            version: change.value.version,
-          },
-          ...(change.previousValue === undefined
-            ? {}
-            : { previousVersion: change.previousValue.version }),
-        }))
-        if (batch.length > 0) {
-          batches.push(batch)
-          callbackReads.push(
-            downstream.toArray.map(({ id, version }) => ({
-              sourceId,
-              rowKey: id,
-              version,
-            })),
-          )
-        }
-      },
-      { includeInitialState: true },
-    )
-
-    const replaceCore = (version: number) => {
-      begin()
-      write({ type: `insert`, value: { id: `row`, version } })
-      commit()
-    }
-    const updateCore = (previousVersion: number, version: number) => {
-      begin()
-      write({
-        type: `update`,
-        value: { id: `row`, version },
-        previousValue: { id: `row`, version: previousVersion },
-      })
-      commit()
-    }
-    const applyCore = (
-      changes: ReadonlyArray<ChangeMessageOrDeleteKeyMessage<Row, string>>,
-    ) => {
-      begin()
-      for (const change of changes) write(change)
-      commit()
-    }
-    const startReplay = async () => {
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-    }
-    const coreRows = () =>
-      source.toArray.map(({ id, version }) => ({
-        sourceId,
-        rowKey: id,
-        version,
-      }))
-    const visibleRows = () =>
-      downstream.toArray.map(({ id, version }) => ({
-        sourceId,
-        rowKey: id,
-        version,
-      }))
-
-    return {
-      source,
-      downstream,
-      subscription,
-      pending,
-      batches,
-      callbackReads,
-      replaceCore,
-      updateCore,
-      applyCore,
-      startReplay,
-      coreRows,
-      visibleRows,
-    }
-  }
-
-  async function finishHarnessCleanup(
-    primaryFailure: { error: unknown } | undefined,
-    harness: ReturnType<typeof createHarness>,
-  ): Promise<void> {
-    await finishCleanup(primaryFailure, [
-      [
-        ...harness.pending.map(({ deferred }, index) => ({
-          name: `replay ${index}`,
-          run: () => deferred.resolve(),
-        })),
-        { name: `subscription`, run: () => harness.subscription.unsubscribe() },
-      ],
-      [
-        { name: `downstream`, run: () => harness.downstream.cleanup() },
-        { name: `source`, run: () => harness.source.cleanup() },
-      ],
-    ])
-  }
-
-  it(`retains the last complete publication when replay fails after writing`, async () => {
-    const sourceId = `replay-refinement-failure`
-    const row = (version: number) => ({
-      sourceId,
-      rowKey: `row`,
-      version,
-    })
-    const harness = createHarness(sourceId)
-
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      await harness.downstream.preload()
-      await harness.startReplay()
-      expect(harness.pending).toHaveLength(1)
-
-      harness.replaceCore(2)
-      harness.pending[0]!.deferred.reject(new Error(`replay failed`))
-      await flushPromises()
-
-      expect(harness.coreRows()).toEqual([row(2)])
-      expect(harness.visibleRows()).toEqual([row(1)])
-      expect(harness.batches).toEqual([[{ type: `insert`, row: row(1) }]])
-      expect(harness.callbackReads).toEqual([[row(1)]])
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishHarnessCleanup(primaryFailure, harness)
-    }
-  })
-
-  it(`publishes a truncate-replay replacement before its source subscription reports ready`, async () => {
-    const replay = createDeferred<void>()
-    let loadCount = 0
-    let begin!: () => void
-    let write!: (message: ChangeMessageOrDeleteKeyMessage<Row, string>) => void
-    let commit!: () => void
-    let truncate!: () => void
-    let sourceSubscription: LoadSubsetOptions[`subscription`]
-    const source = createCollection<Row>({
-      id: `replay-ready-publication-source`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          truncate = operations.truncate
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              sourceSubscription = options.subscription
-              loadCount++
-              if (loadCount === 1) {
-                begin()
-                write({ type: `insert`, value: { id: `row`, version: 1 } })
-                commit()
-                return true
-              }
-              return replay.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) =>
-      q.from({ row: source }).select(({ row }) => ({
-        id: row.id,
-        version: row.version,
-      })),
-    )
-    const readVersions = () => live.toArray.map(({ version }) => version)
-    const readyReads: Array<Array<number>> = []
-
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      await live.preload()
-      expect(readVersions()).toEqual([1])
-      sourceSubscription!.on(`status:ready`, () => {
-        readyReads.push(readVersions())
-      })
-
-      begin()
-      truncate()
-      commit()
-      await flushPromises()
-      begin()
-      write({ type: `insert`, value: { id: `row`, version: 2 } })
-      commit()
-
-      replay.resolve()
-      await flushPromises()
-
-      expect(readyReads).toEqual([[2]])
-      expect(readVersions()).toEqual([2])
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishCleanup(primaryFailure, [
-        [{ name: `replay`, run: () => replay.resolve() }],
-        [
-          { name: `live query`, run: () => live.cleanup() },
-          { name: `source`, run: () => source.cleanup() },
-        ],
-      ])
-    }
-  })
-
-  it(`keeps a failed replay private until a later authoritative replay`, async () => {
-    const sourceId = `replay-refinement-failure-liveness`
-    const row = (version: number) => ({ sourceId, rowKey: `row`, version })
-    const harness = createHarness(sourceId)
-
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      await harness.downstream.preload()
-      expect(harness.visibleRows().map(({ version }) => version)).toEqual([1])
-
-      await harness.startReplay()
-      expect(harness.pending).toHaveLength(1)
-      harness.replaceCore(2)
-      harness.pending[0]!.deferred.reject(new Error(`replay failed`))
-      await flushPromises()
-
-      expect(harness.visibleRows()).toEqual([row(1)])
-      expect(harness.downstream.status).toBe(`ready`)
-      expect(harness.batches).toEqual([[{ type: `insert`, row: row(1) }]])
-
-      harness.updateCore(2, 3)
-      await flushPromises()
-
-      expect(harness.visibleRows()).toEqual([row(1)])
-      expect(harness.batches).toEqual([[{ type: `insert`, row: row(1) }]])
-      expect(harness.callbackReads).toEqual([[row(1)]])
-
-      await harness.startReplay()
-      expect(harness.pending).toHaveLength(2)
-      harness.replaceCore(4)
-      harness.pending[1]!.deferred.resolve()
-      await flushPromises()
-
-      expect(harness.visibleRows()).toEqual([row(4)])
-      expect(harness.batches).toEqual([
-        [{ type: `insert`, row: row(1) }],
-        [{ type: `update`, row: row(4), previousVersion: 1 }],
-      ])
-      expect(harness.callbackReads).toEqual([[row(1)], [row(4)]])
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishHarnessCleanup(primaryFailure, harness)
-    }
-  })
-
-  it(`replaces a multi-row failed replay only with later authoritative state`, async () => {
-    const sourceId = `replay-refinement-multi-row-failure`
-    const observed = (id: string, version: number) => ({
-      sourceId,
-      rowKey: id,
-      version,
-    })
-    const harness = createHarness(sourceId, [
-      { id: `a`, version: 1 },
-      { id: `b`, version: 1 },
-      { id: `c`, version: 1 },
-    ])
-    const sortedVisible = () =>
-      harness
-        .visibleRows()
-        .sort((left, right) => left.rowKey.localeCompare(right.rowKey))
-    const sortedCore = () =>
-      harness
-        .coreRows()
-        .sort((left, right) => left.rowKey.localeCompare(right.rowKey))
-
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      await harness.downstream.preload()
-      expect(sortedVisible()).toEqual([
-        observed(`a`, 1),
-        observed(`b`, 1),
-        observed(`c`, 1),
-      ])
-      const publishedBatches = harness.batches.length
-
-      await harness.startReplay()
-      expect(harness.pending).toHaveLength(1)
-      harness.applyCore([
-        { type: `insert`, value: { id: `a`, version: 2 } },
-        { type: `insert`, value: { id: `d`, version: 1 } },
-      ])
-      harness.pending[0]!.deferred.reject(new Error(`partial replay failed`))
-      await flushPromises()
-
-      harness.applyCore([
-        {
-          type: `update`,
-          value: { id: `a`, version: 3 },
-          previousValue: { id: `a`, version: 2 },
-        },
-        { type: `delete`, key: `d` },
-        { type: `insert`, value: { id: `e`, version: 1 } },
-      ])
-      await flushPromises()
-
-      expect(sortedCore()).toEqual([observed(`a`, 3), observed(`e`, 1)])
-      expect(sortedVisible()).toEqual([
-        observed(`a`, 1),
-        observed(`b`, 1),
-        observed(`c`, 1),
-      ])
-      expect(harness.batches).toHaveLength(publishedBatches)
-
-      await harness.startReplay()
-      expect(harness.pending).toHaveLength(2)
-      harness.applyCore([
-        { type: `insert`, value: { id: `a`, version: 4 } },
-        { type: `insert`, value: { id: `b`, version: 1 } },
-        { type: `insert`, value: { id: `e`, version: 2 } },
-      ])
-      harness.pending[1]!.deferred.resolve()
-      await flushPromises()
-
-      expect(sortedVisible()).toEqual([
-        observed(`a`, 4),
-        observed(`b`, 1),
-        observed(`e`, 2),
-      ])
-      expect(harness.batches).toHaveLength(publishedBatches + 1)
-      expect(harness.batches.at(-1)).toEqual([
-        {
-          type: `update`,
-          row: observed(`a`, 4),
-          previousVersion: 1,
-        },
-        { type: `delete`, row: observed(`c`, 1) },
-        { type: `insert`, row: observed(`e`, 2) },
-      ])
-      expect(
-        harness.callbackReads
-          .at(-1)
-          ?.sort((left, right) => left.rowKey.localeCompare(right.rowKey)),
-      ).toEqual([observed(`a`, 4), observed(`b`, 1), observed(`e`, 2)])
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishHarnessCleanup(primaryFailure, harness)
-    }
-  })
-
-  it(`publishes the newest replay's success without waiting for the replay it aborted`, async () => {
-    const sourceId = `replay-refinement-overlap`
-    const row = (version: number) => ({
-      sourceId,
-      rowKey: `row`,
-      version,
-    })
-    const harness = createHarness(sourceId)
-
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      await harness.downstream.preload()
-      await harness.startReplay()
-      await harness.startReplay()
-      expect(harness.pending).toHaveLength(2)
-
-      expect(harness.pending[0]!.options.signal?.aborted).toBe(true)
-      harness.replaceCore(3)
-      harness.pending[1]!.deferred.resolve()
-      await flushPromises()
-
-      const published = () => {
-        expect(harness.coreRows()).toEqual([row(3)])
-        expect(harness.visibleRows()).toEqual([row(3)])
-        expect(harness.batches).toEqual([
-          [{ type: `insert`, row: row(1) }],
-          [{ type: `update`, row: row(3), previousVersion: 1 }],
-        ])
-        expect(harness.callbackReads).toEqual([[row(1)], [row(3)]])
-      }
-      published()
-
-      // The aborted load's late settlement changes nothing.
-      harness.pending[0]!.deferred.reject(
-        new DOMException(`obsolete`, `AbortError`),
-      )
-      await flushPromises()
-      published()
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishHarnessCleanup(primaryFailure, harness)
-    }
-  })
-
-  it(`waits for every recovering source before publishing a joined replacement`, async () => {
-    type Primary = { id: string; joinKey: string; version: number }
-    type Secondary = { id: string; joinKey: string; version: number }
-
-    const createSource = <T extends { id: string }>(id: string) => {
-      let begin!: () => void
-      let write!: (message: { type: `insert`; value: T }) => void
-      let commit!: () => true | Promise<void>
-      let truncate!: () => void
-      const pending: Array<ReturnType<typeof createDeferred<void>>> = []
-      const collection = createCollection<T>({
-        id,
-        getKey: ({ id: key }) => key,
-        syncMode: `on-demand`,
-        sync: {
-          sync: (operations) => {
-            begin = operations.begin
-            write = operations.write
-            commit = operations.commit
-            truncate = operations.truncate
-            operations.markReady()
-            return {
-              loadSubset: () => {
-                const request = createDeferred<void>()
-                pending.push(request)
-                return request.promise
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      return {
-        collection,
-        pending,
-        async apply(row: T) {
-          begin()
-          write({ type: `insert`, value: row })
-          const receipt = commit()
-          if (receipt !== true) await receipt
-        },
-        replay() {
-          begin()
-          truncate()
-          return commit()
-        },
-      }
-    }
-
-    const primary = createSource<Primary>(`joined-replay-primary`)
-    const secondary = createSource<Secondary>(`joined-replay-secondary`)
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ primary: primary.collection })
-        .innerJoin(
-          { secondary: secondary.collection },
-          ({ primary: left, secondary: right }) =>
-            eq(left.joinKey, right.joinKey),
-        )
-        .orderBy(({ primary: row }) => row.version)
-        .limit(1)
-        .select(({ primary: left, secondary: right }) => ({
-          id: left.id,
-          secondaryId: right.id,
-          primaryVersion: left.version,
-          secondaryVersion: right.version,
-        })),
-    )
-    const read = () =>
-      live.toArray.map(
-        ({ id, secondaryId, primaryVersion, secondaryVersion }) => ({
-          id,
-          secondaryId,
-          primaryVersion,
-          secondaryVersion,
-        }),
-      )
-    const publications: Array<ReturnType<typeof read>> = []
-    let subscription: ReturnType<typeof live.subscribeChanges> | undefined
-    let primaryReplay: true | Promise<void> = true
-    let secondaryReplay: true | Promise<void> = true
-
-    let primaryFailure: { error: unknown } | undefined
-    try {
-      const preload = live.preload()
-      await flushPromises()
-      expect(primary.pending).toHaveLength(1)
-      await primary.apply({ id: `p`, joinKey: `shared`, version: 1 })
-      primary.pending[0]!.resolve()
-      await flushPromises()
-      expect(secondary.pending).toHaveLength(1)
-      await secondary.apply({ id: `s`, joinKey: `shared`, version: 1 })
-      secondary.pending[0]!.resolve()
-      await flushPromises()
-      for (const request of primary.pending.slice(1)) request.resolve()
-      await preload
-      expect(read()).toEqual([
-        {
-          id: `p`,
-          secondaryId: `s`,
-          primaryVersion: 1,
-          secondaryVersion: 1,
-        },
-      ])
-
-      subscription = live.subscribeChanges(() => publications.push(read()), {
-        includeInitialState: false,
-      })
-      const initialPrimaryLoads = primary.pending.length
-      const initialSecondaryLoads = secondary.pending.length
-      primaryReplay = primary.replay()
-      secondaryReplay = secondary.replay()
-      await flushPromises()
-      expect(primary.pending.length).toBeGreaterThan(initialPrimaryLoads)
-      expect(secondary.pending.length).toBeGreaterThan(initialSecondaryLoads)
-
-      await primary.apply({ id: `p`, joinKey: `shared`, version: 2 })
-      await secondary.apply({ id: `s`, joinKey: `shared`, version: 2 })
-      for (const request of primary.pending.slice(initialPrimaryLoads)) {
-        request.resolve()
-      }
-      await flushPromises()
-
-      expect(read()).toEqual([
-        {
-          id: `p`,
-          secondaryId: `s`,
-          primaryVersion: 1,
-          secondaryVersion: 1,
-        },
-      ])
-      expect(publications).toEqual([])
-
-      for (const request of secondary.pending.slice(initialSecondaryLoads)) {
-        request.resolve()
-      }
-      await Promise.all([primaryReplay, secondaryReplay])
-      await flushPromises()
-
-      expect(read()).toEqual([
-        {
-          id: `p`,
-          secondaryId: `s`,
-          primaryVersion: 2,
-          secondaryVersion: 2,
-        },
-      ])
-      expect(publications).toEqual([
-        [
-          {
-            id: `p`,
-            secondaryId: `s`,
-            primaryVersion: 2,
-            secondaryVersion: 2,
-          },
-        ],
-      ])
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      await finishCleanup(primaryFailure, [
-        [
-          ...[...primary.pending, ...secondary.pending].map(
-            (request, index) => ({
-              name: `source request ${index}`,
-              run: () => request.resolve(),
-            }),
-          ),
-          { name: `subscription`, run: () => subscription?.unsubscribe() },
-        ],
-        [
-          { name: `primary replay`, run: () => primaryReplay },
-          { name: `secondary replay`, run: () => secondaryReplay },
-          { name: `live query`, run: () => live.cleanup() },
-          { name: `primary source`, run: () => primary.collection.cleanup() },
-          {
-            name: `secondary source`,
-            run: () => secondary.collection.cleanup(),
-          },
-        ],
-      ])
-    }
-  })
-})
-
 /**
  * # Ordered windows across truncate replays with adapter faults
  *
@@ -2073,6 +1039,13 @@ async function checkOrderedReplay(
   return reach
 }
 
+// The check is `checkOrderedReplay`: it runs each generated history of
+// ordered-window commands and adapter faults through a live query, and compares
+// the published window at each checkpoint with the expectation that the history
+// implies. Its expectation is computed inside the function body, not by a named
+// model part yet.
+declareOracle({ check: [checkOrderedReplay] })
+
 const orderedReplayProperty = `replay.ordered-window-faults`
 const orderedReplayConfig = readOracleRunConfig()
 const orderedReplayCampaigns =
diff --git a/packages/db/tests/query/load-subset-replay-refinement.test.ts b/packages/db/tests/query/load-subset-replay-refinement.test.ts
new file mode 100644
index 0000000000..f4e29847dc
--- /dev/null
+++ b/packages/db/tests/query/load-subset-replay-refinement.test.ts
@@ -0,0 +1,1064 @@
+// Unit tests for loadSubset replay publication and failure with fixed,
+// written row expectations: a replay mismatch with cleanup failures, a
+// successful sibling after a failed include route retires, failed replays kept
+// private until an authoritative replay, and overlapping replays. The law and its
+// owner (ARCHITECTURE.md law 9, truncate replay) are in
+// load-subset-replay-refinement-oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  toArray,
+} from '../../src/query/index.js'
+import { BasicIndex } from '../../src/indexes/basic-index.js'
+import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
+import { flushPromises } from '../utils.js'
+import {} from '../oracle-config.js'
+import type {
+  ChangeMessageOrDeleteKeyMessage,
+  LoadSubsetOptions,
+  SyncConfig,
+} from '../../src/types.js'
+
+/**
+ * # Which replay may replace a loadSubset publication?
+ *
+ * Contract: The replay-participant rules and normative publication law 9 in
+ * packages/db/src/query/live/ARCHITECTURE.md require a complete participating
+ * source set before a truncate replay publishes. A failed replay keeps the
+ * prior public snapshot and later partial source changes private. A retired
+ * logical demand stops participating. Source cleanup terminates dependent
+ * live queries. A direct subscriber can acquire again after restart.
+ *
+ * Model: the expected public rows are the last complete public snapshot until
+ * every current replay participant succeeds or retires. Older overlapping
+ * work that a newer replay aborted participates no more: an abort ends the
+ * load (maintainer decision), so its later settlement neither holds nor
+ * changes publication. A completed replacement supplies the next public
+ * rows.
+ * The literal expected row sets below instantiate this rule independently of
+ * the Collection's replay bookkeeping.
+ *
+ * History grammar: fixed one-row and multi-row source replacements, failed
+ * work, later writes, overlapping attempts, retired include routes, joined
+ * sources, and cleanup/restart. Deferred loadSubset results control settlement.
+ * The driver uses real Collections and live queries. At each held or settled
+ * checkpoint, it compares exact public rows and callback reads with the model;
+ * selected histories also compare batches, readiness, and acquisition release.
+ * These controlled adapter promises do not establish real-provider cancellation
+ * or every legal replay interleaving.
+ */
+
+type Row = { id: string; version: number }
+type ObservedRow = { sourceId: string; rowKey: string; version: number }
+
+type CleanupTask = { name: string; run: () => unknown | Promise<unknown> }
+
+async function finishCleanup(
+  primaryFailure: { error: unknown } | undefined,
+  phases: ReadonlyArray<ReadonlyArray<CleanupTask>>,
+): Promise<void> {
+  const cleanupErrors: Array<Error> = []
+  for (const phase of phases) {
+    const results = await Promise.allSettled(
+      phase.map(({ run }) => Promise.resolve().then(run)),
+    )
+    for (const [index, result] of results.entries()) {
+      if (result.status === `rejected`) {
+        cleanupErrors.push(
+          new Error(`${phase[index]!.name} cleanup failed`, {
+            cause: result.reason,
+          }),
+        )
+      }
+    }
+  }
+  if (cleanupErrors.length > 0) {
+    throw new AggregateError(
+      cleanupErrors,
+      `Replay oracle cleanup failed`,
+      primaryFailure && { cause: primaryFailure.error },
+    )
+  }
+}
+
+describe(`loadSubset replay refinement`, () => {
+  it(`preserves a replay mismatch and separate cleanup failures`, async () => {
+    const mismatch = new Error(`public snapshot mismatch after failed replay`)
+    const unloadFailure = new Error(`unload failed`)
+    const sourceFailure = new Error(`source cleanup failed`)
+    const completed: Array<string> = []
+    let reported: unknown
+
+    try {
+      await finishCleanup({ error: mismatch }, [
+        [
+          {
+            name: `acquisition unload`,
+            run: () => {
+              completed.push(`unload`)
+              throw unloadFailure
+            },
+          },
+          {
+            name: `subscription`,
+            run: () => completed.push(`subscription`),
+          },
+        ],
+        [
+          {
+            name: `source`,
+            run: () => {
+              completed.push(`source`)
+              throw sourceFailure
+            },
+          },
+        ],
+      ])
+    } catch (error) {
+      reported = error
+    }
+
+    expect(completed).toEqual([`unload`, `subscription`, `source`])
+    expect(reported).toBeInstanceOf(AggregateError)
+    const failure = reported as AggregateError
+    expect(failure.cause).toBe(mismatch)
+    expect(failure.errors).toHaveLength(2)
+    expect((failure.errors[0] as Error).message).toBe(
+      `acquisition unload cleanup failed`,
+    )
+    expect((failure.errors[0] as Error).cause).toBe(unloadFailure)
+    expect((failure.errors[1] as Error).message).toBe(`source cleanup failed`)
+    expect((failure.errors[1] as Error).cause).toBe(sourceFailure)
+  })
+
+  // A direct subscriber survives source Collection cleanup. A dependent live
+  // query enters
+  // a terminal error instead; restarting only its source must not revive it.
+  it.each(
+    ([`direct`, `live`] as const).flatMap((consumer) =>
+      ([`resolve`, `reject`] as const).map((outcome) => ({
+        consumer,
+        outcome,
+      })),
+    ),
+  )(
+    `separates direct restart from fatal source Collection cleanup for a live query: %j`,
+    async ({ consumer, outcome }) => {
+      let operations!: Parameters<SyncConfig<Row, string>[`sync`]>[0]
+      let loads = 0
+      const pending = createDeferred<void>()
+      void pending.promise.catch(() => undefined)
+      const initial = [{ id: `row`, version: 1 }]
+      const replacement = [{ id: `row`, version: 2 }]
+      const source = createCollection<Row, string>({
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (next) => {
+            operations = next
+            next.markReady()
+            return {
+              loadSubset: () => {
+                if (++loads > 1) return pending.promise
+                next.begin()
+                next.write({ type: `insert`, value: initial[0]! })
+                next.commit()
+                return true
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const live =
+        consumer === `live`
+          ? createLiveQueryCollection((q) => q.from({ row: source }))
+          : undefined
+      const visible = new Map<string, Row>()
+      const rows = (values: ReadonlyArray<Row>) =>
+        values.map(({ id, version }) => ({ id, version }))
+      const readEvents = () => rows([...visible.values()])
+      const read = () => (live ? rows(live.toArray) : readEvents())
+      const publications: Array<Array<Row>> = []
+      const subscription = (live ?? source).subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            if (change.type === `delete`) visible.delete(String(change.key))
+            else visible.set(String(change.key), { ...change.value })
+          }
+          publications.push(readEvents())
+        },
+        { includeInitialState: consumer === `live` },
+      )
+
+      let primaryFailure: { error: unknown } | undefined
+      try {
+        if (live) await live.preload()
+        else subscription.requestSnapshot({})
+        await flushPromises()
+        expect(loads).toBe(1)
+        expect(read()).toEqual(initial)
+        expect(readEvents()).toEqual(initial)
+        publications.length = 0
+
+        // A live query refuses the public cleanup; internal teardown that
+        // bypasses it is fatal for the query.
+        if (live) {
+          await expect(source.cleanup()).rejects.toThrow(/dependent/)
+          await source._lifecycle.cleanup()
+          expect(live.status).toBe(`crashed`)
+        } else await source.cleanup()
+        source.startSyncImmediate()
+        await flushPromises()
+        expect(loads).toBe(2)
+        expect(read()).toEqual(initial)
+        // Cleanup may change row metadata without changing the public data.
+        for (const publication of publications)
+          expect(publication).toEqual(initial)
+
+        operations.begin()
+        operations.write({ type: `insert`, value: replacement[0]! })
+        await operations.commit()
+        await flushPromises()
+        expect(rows(source.toArray)).toEqual(replacement)
+        expect(read()).toEqual(initial)
+        expect(readEvents()).toEqual(initial)
+        for (const publication of publications)
+          expect(publication).toEqual(initial)
+        publications.length = 0
+
+        if (outcome === `resolve`) pending.resolve()
+        else pending.reject(new Error(`restart failed`))
+        await flushPromises()
+        const publishes = consumer === `direct` && outcome === `resolve`
+        const expected = publishes ? replacement : initial
+        expect(read()).toEqual(expected)
+        expect(readEvents()).toEqual(expected)
+        expect(publications).toEqual(publishes ? [replacement] : [])
+        if (live) expect(live.status).toBe(`crashed`)
+      } catch (error) {
+        primaryFailure = { error }
+        throw error
+      } finally {
+        await finishCleanup(primaryFailure, [
+          [
+            { name: `pending replay`, run: () => pending.resolve() },
+            { name: `subscription`, run: () => subscription.unsubscribe() },
+          ],
+          [{ name: `live query`, run: () => live?.cleanup() }],
+          [{ name: `source`, run: () => source.cleanup() }],
+        ])
+      }
+    },
+  )
+
+  it(`publishes a successful sibling after a settled failed include route retires`, async () => {
+    type Parent = { id: string; left: number | null; right: number }
+    type Child = { id: number; version: number }
+    let parentSync!: Parameters<SyncConfig<Parent, string>[`sync`]>[0]
+    let childSync!: Parameters<SyncConfig<Child, number>[`sync`]>[0]
+    const failed = createDeferred<void>()
+    const successful = createDeferred<void>()
+    const loads: Array<{ options: LoadSubsetOptions; ids: Array<number> }> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    const parents = createCollection<Parent, string>({
+      id: `settled-peer-parent`,
+      getKey: ({ id }) => id,
+      sync: {
+        sync: (operations) => {
+          parentSync = operations
+          operations.begin()
+          operations.write({
+            type: `insert`,
+            value: { id: `parent`, left: 1, right: 2 },
+          })
+          operations.commit()
+          operations.markReady()
+        },
+      },
+    })
+    const children = createCollection<Child, number>({
+      id: `settled-peer-children`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      autoIndex: `eager`,
+      defaultIndexType: BasicIndex,
+      sync: {
+        sync: (operations) => {
+          childSync = operations
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              const rows = [1, 2]
+                .map((id) => ({ id, version: loads.length < 2 ? 1 : 2 }))
+                .filter(
+                  (row) =>
+                    !options.where ||
+                    evaluateReferenceExpression(options.where, row) === true,
+                )
+              loads.push({ options, ids: rows.map(({ id }) => id) })
+              operations.begin()
+              for (const value of rows)
+                operations.write({ type: `insert`, value })
+              operations.commit()
+              if (loads.length <= 2) return true
+              return rows.some(({ id }) => id === 1)
+                ? failed.promise
+                : successful.promise
+            },
+            unloadSubset: (options) => {
+              unloads.push(options)
+            },
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) =>
+      q.from({ parent: parents }).select(({ parent }) => ({
+        id: parent.id,
+        left: toArray(
+          q
+            .from({ leftChild: children })
+            .where(({ leftChild }) => eq(leftChild.id, parent.left)),
+        ),
+        right: toArray(
+          q
+            .from({ rightChild: children })
+            .where(({ rightChild }) => eq(rightChild.id, parent.right)),
+        ),
+      })),
+    )
+    const read = () =>
+      live.toArray.map(({ id, left, right }) => ({
+        id,
+        left: left.map(({ id: key, version }) => ({ id: key, version })),
+        right: right.map(({ id: key, version }) => ({ id: key, version })),
+      }))
+    const publications: Array<ReturnType<typeof read>> = []
+    const subscription = live.subscribeChanges(
+      () => publications.push(read()),
+      { includeInitialState: false },
+    )
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      await live.preload()
+      expect(loads.map(({ ids }) => ids)).toEqual([[1], [2]])
+      const initial = [
+        {
+          id: `parent`,
+          left: [{ id: 1, version: 1 }],
+          right: [{ id: 2, version: 1 }],
+        },
+      ]
+      expect(read()).toEqual(initial)
+      publications.length = 0
+      childSync.begin()
+      childSync.truncate()
+      childSync.commit()
+      await flushPromises()
+      expect(loads.slice(2).map(({ ids }) => ids)).toEqual([[1], [2]])
+      failed.reject(new Error(`left replay failed`))
+      successful.resolve()
+      await flushPromises()
+      expect(read()).toEqual(initial)
+      expect(publications).toEqual([])
+      parentSync.begin()
+      parentSync.write({
+        type: `update`,
+        value: { id: `parent`, left: null, right: 2 },
+      })
+      parentSync.commit()
+      await flushPromises()
+      expect(read()).toEqual([
+        { id: `parent`, left: [], right: [{ id: 2, version: 2 }] },
+      ])
+      expect(publications).toEqual([
+        [{ id: `parent`, left: [], right: [{ id: 2, version: 2 }] }],
+      ])
+      expect(loads).toHaveLength(4)
+      expect(unloads).toContain(loads[2]!.options)
+      expect(loads[2]!.options.signal?.aborted).toBe(true)
+      expect(loads[3]!.options.signal?.aborted).toBe(false)
+      childSync.begin()
+      childSync.write({ type: `update`, value: { id: 2, version: 3 } })
+      childSync.commit()
+      await flushPromises()
+      expect(read()).toEqual([
+        { id: `parent`, left: [], right: [{ id: 2, version: 3 }] },
+      ])
+      expect(publications).toHaveLength(2)
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishCleanup(primaryFailure, [
+        [
+          { name: `failed replay`, run: () => failed.resolve() },
+          { name: `successful replay`, run: () => successful.resolve() },
+          { name: `subscription`, run: () => subscription.unsubscribe() },
+        ],
+        [{ name: `live query`, run: () => live.cleanup() }],
+        [
+          { name: `parents`, run: () => parents.cleanup() },
+          { name: `children`, run: () => children.cleanup() },
+        ],
+      ])
+    }
+    expect(unloads).toHaveLength(loads.length)
+    for (const { options } of loads) {
+      expect(unloads.filter((unloaded) => unloaded === options)).toHaveLength(1)
+    }
+  })
+
+  function createHarness(
+    sourceId: string,
+    initialRows: ReadonlyArray<Row> = [{ id: `row`, version: 1 }],
+  ) {
+    let begin!: () => void
+    let write!: (message: ChangeMessageOrDeleteKeyMessage<Row, string>) => void
+    let commit!: () => void
+    let truncate!: () => void
+    let loadCount = 0
+    const pending: Array<{
+      options: LoadSubsetOptions
+      deferred: ReturnType<typeof createDeferred<void>>
+    }> = []
+    const batches: Array<
+      Array<{
+        type: `insert` | `update` | `delete`
+        row: { sourceId: string; rowKey: string; version: number }
+        previousVersion?: number
+      }>
+    > = []
+    const source = createCollection<Row>({
+      id: sourceId,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          begin = params.begin
+          write = params.write
+          commit = params.commit
+          truncate = params.truncate
+          params.markReady()
+          return {
+            loadSubset: (options) => {
+              loadCount++
+              if (loadCount === 1) {
+                begin()
+                for (const value of initialRows) {
+                  write({ type: `insert`, value })
+                }
+                commit()
+                return true
+              }
+              const deferred = createDeferred<void>()
+              pending.push({ options, deferred })
+              return deferred.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const downstream = createLiveQueryCollection({
+      id: `${sourceId}-downstream`,
+      query: (q) =>
+        q.from({ row: source }).select(({ row }) => ({
+          id: row.id,
+          version: row.version,
+        })),
+      startSync: true,
+    })
+    const callbackReads: Array<Array<ObservedRow>> = []
+    const subscription = downstream.subscribeChanges(
+      (changes) => {
+        const batch = changes.map((change) => ({
+          type: change.type,
+          row: {
+            sourceId,
+            rowKey: String(change.key),
+            version: change.value.version,
+          },
+          ...(change.previousValue === undefined
+            ? {}
+            : { previousVersion: change.previousValue.version }),
+        }))
+        if (batch.length > 0) {
+          batches.push(batch)
+          callbackReads.push(
+            downstream.toArray.map(({ id, version }) => ({
+              sourceId,
+              rowKey: id,
+              version,
+            })),
+          )
+        }
+      },
+      { includeInitialState: true },
+    )
+
+    const replaceCore = (version: number) => {
+      begin()
+      write({ type: `insert`, value: { id: `row`, version } })
+      commit()
+    }
+    const updateCore = (previousVersion: number, version: number) => {
+      begin()
+      write({
+        type: `update`,
+        value: { id: `row`, version },
+        previousValue: { id: `row`, version: previousVersion },
+      })
+      commit()
+    }
+    const applyCore = (
+      changes: ReadonlyArray<ChangeMessageOrDeleteKeyMessage<Row, string>>,
+    ) => {
+      begin()
+      for (const change of changes) write(change)
+      commit()
+    }
+    const startReplay = async () => {
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+    }
+    const coreRows = () =>
+      source.toArray.map(({ id, version }) => ({
+        sourceId,
+        rowKey: id,
+        version,
+      }))
+    const visibleRows = () =>
+      downstream.toArray.map(({ id, version }) => ({
+        sourceId,
+        rowKey: id,
+        version,
+      }))
+
+    return {
+      source,
+      downstream,
+      subscription,
+      pending,
+      batches,
+      callbackReads,
+      replaceCore,
+      updateCore,
+      applyCore,
+      startReplay,
+      coreRows,
+      visibleRows,
+    }
+  }
+
+  async function finishHarnessCleanup(
+    primaryFailure: { error: unknown } | undefined,
+    harness: ReturnType<typeof createHarness>,
+  ): Promise<void> {
+    await finishCleanup(primaryFailure, [
+      [
+        ...harness.pending.map(({ deferred }, index) => ({
+          name: `replay ${index}`,
+          run: () => deferred.resolve(),
+        })),
+        { name: `subscription`, run: () => harness.subscription.unsubscribe() },
+      ],
+      [
+        { name: `downstream`, run: () => harness.downstream.cleanup() },
+        { name: `source`, run: () => harness.source.cleanup() },
+      ],
+    ])
+  }
+
+  it(`retains the last complete publication when replay fails after writing`, async () => {
+    const sourceId = `replay-refinement-failure`
+    const row = (version: number) => ({
+      sourceId,
+      rowKey: `row`,
+      version,
+    })
+    const harness = createHarness(sourceId)
+
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      await harness.downstream.preload()
+      await harness.startReplay()
+      expect(harness.pending).toHaveLength(1)
+
+      harness.replaceCore(2)
+      harness.pending[0]!.deferred.reject(new Error(`replay failed`))
+      await flushPromises()
+
+      expect(harness.coreRows()).toEqual([row(2)])
+      expect(harness.visibleRows()).toEqual([row(1)])
+      expect(harness.batches).toEqual([[{ type: `insert`, row: row(1) }]])
+      expect(harness.callbackReads).toEqual([[row(1)]])
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishHarnessCleanup(primaryFailure, harness)
+    }
+  })
+
+  it(`publishes a truncate-replay replacement before its source subscription reports ready`, async () => {
+    const replay = createDeferred<void>()
+    let loadCount = 0
+    let begin!: () => void
+    let write!: (message: ChangeMessageOrDeleteKeyMessage<Row, string>) => void
+    let commit!: () => void
+    let truncate!: () => void
+    let sourceSubscription: LoadSubsetOptions[`subscription`]
+    const source = createCollection<Row>({
+      id: `replay-ready-publication-source`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          truncate = operations.truncate
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              sourceSubscription = options.subscription
+              loadCount++
+              if (loadCount === 1) {
+                begin()
+                write({ type: `insert`, value: { id: `row`, version: 1 } })
+                commit()
+                return true
+              }
+              return replay.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) =>
+      q.from({ row: source }).select(({ row }) => ({
+        id: row.id,
+        version: row.version,
+      })),
+    )
+    const readVersions = () => live.toArray.map(({ version }) => version)
+    const readyReads: Array<Array<number>> = []
+
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      await live.preload()
+      expect(readVersions()).toEqual([1])
+      sourceSubscription!.on(`status:ready`, () => {
+        readyReads.push(readVersions())
+      })
+
+      begin()
+      truncate()
+      commit()
+      await flushPromises()
+      begin()
+      write({ type: `insert`, value: { id: `row`, version: 2 } })
+      commit()
+
+      replay.resolve()
+      await flushPromises()
+
+      expect(readyReads).toEqual([[2]])
+      expect(readVersions()).toEqual([2])
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishCleanup(primaryFailure, [
+        [{ name: `replay`, run: () => replay.resolve() }],
+        [
+          { name: `live query`, run: () => live.cleanup() },
+          { name: `source`, run: () => source.cleanup() },
+        ],
+      ])
+    }
+  })
+
+  it(`keeps a failed replay private until a later authoritative replay`, async () => {
+    const sourceId = `replay-refinement-failure-liveness`
+    const row = (version: number) => ({ sourceId, rowKey: `row`, version })
+    const harness = createHarness(sourceId)
+
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      await harness.downstream.preload()
+      expect(harness.visibleRows().map(({ version }) => version)).toEqual([1])
+
+      await harness.startReplay()
+      expect(harness.pending).toHaveLength(1)
+      harness.replaceCore(2)
+      harness.pending[0]!.deferred.reject(new Error(`replay failed`))
+      await flushPromises()
+
+      expect(harness.visibleRows()).toEqual([row(1)])
+      expect(harness.downstream.status).toBe(`ready`)
+      expect(harness.batches).toEqual([[{ type: `insert`, row: row(1) }]])
+
+      harness.updateCore(2, 3)
+      await flushPromises()
+
+      expect(harness.visibleRows()).toEqual([row(1)])
+      expect(harness.batches).toEqual([[{ type: `insert`, row: row(1) }]])
+      expect(harness.callbackReads).toEqual([[row(1)]])
+
+      await harness.startReplay()
+      expect(harness.pending).toHaveLength(2)
+      harness.replaceCore(4)
+      harness.pending[1]!.deferred.resolve()
+      await flushPromises()
+
+      expect(harness.visibleRows()).toEqual([row(4)])
+      expect(harness.batches).toEqual([
+        [{ type: `insert`, row: row(1) }],
+        [{ type: `update`, row: row(4), previousVersion: 1 }],
+      ])
+      expect(harness.callbackReads).toEqual([[row(1)], [row(4)]])
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishHarnessCleanup(primaryFailure, harness)
+    }
+  })
+
+  it(`replaces a multi-row failed replay only with later authoritative state`, async () => {
+    const sourceId = `replay-refinement-multi-row-failure`
+    const observed = (id: string, version: number) => ({
+      sourceId,
+      rowKey: id,
+      version,
+    })
+    const harness = createHarness(sourceId, [
+      { id: `a`, version: 1 },
+      { id: `b`, version: 1 },
+      { id: `c`, version: 1 },
+    ])
+    const sortedVisible = () =>
+      harness
+        .visibleRows()
+        .sort((left, right) => left.rowKey.localeCompare(right.rowKey))
+    const sortedCore = () =>
+      harness
+        .coreRows()
+        .sort((left, right) => left.rowKey.localeCompare(right.rowKey))
+
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      await harness.downstream.preload()
+      expect(sortedVisible()).toEqual([
+        observed(`a`, 1),
+        observed(`b`, 1),
+        observed(`c`, 1),
+      ])
+      const publishedBatches = harness.batches.length
+
+      await harness.startReplay()
+      expect(harness.pending).toHaveLength(1)
+      harness.applyCore([
+        { type: `insert`, value: { id: `a`, version: 2 } },
+        { type: `insert`, value: { id: `d`, version: 1 } },
+      ])
+      harness.pending[0]!.deferred.reject(new Error(`partial replay failed`))
+      await flushPromises()
+
+      harness.applyCore([
+        {
+          type: `update`,
+          value: { id: `a`, version: 3 },
+          previousValue: { id: `a`, version: 2 },
+        },
+        { type: `delete`, key: `d` },
+        { type: `insert`, value: { id: `e`, version: 1 } },
+      ])
+      await flushPromises()
+
+      expect(sortedCore()).toEqual([observed(`a`, 3), observed(`e`, 1)])
+      expect(sortedVisible()).toEqual([
+        observed(`a`, 1),
+        observed(`b`, 1),
+        observed(`c`, 1),
+      ])
+      expect(harness.batches).toHaveLength(publishedBatches)
+
+      await harness.startReplay()
+      expect(harness.pending).toHaveLength(2)
+      harness.applyCore([
+        { type: `insert`, value: { id: `a`, version: 4 } },
+        { type: `insert`, value: { id: `b`, version: 1 } },
+        { type: `insert`, value: { id: `e`, version: 2 } },
+      ])
+      harness.pending[1]!.deferred.resolve()
+      await flushPromises()
+
+      expect(sortedVisible()).toEqual([
+        observed(`a`, 4),
+        observed(`b`, 1),
+        observed(`e`, 2),
+      ])
+      expect(harness.batches).toHaveLength(publishedBatches + 1)
+      expect(harness.batches.at(-1)).toEqual([
+        {
+          type: `update`,
+          row: observed(`a`, 4),
+          previousVersion: 1,
+        },
+        { type: `delete`, row: observed(`c`, 1) },
+        { type: `insert`, row: observed(`e`, 2) },
+      ])
+      expect(
+        harness.callbackReads
+          .at(-1)
+          ?.sort((left, right) => left.rowKey.localeCompare(right.rowKey)),
+      ).toEqual([observed(`a`, 4), observed(`b`, 1), observed(`e`, 2)])
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishHarnessCleanup(primaryFailure, harness)
+    }
+  })
+
+  it(`publishes the newest replay's success without waiting for the replay it aborted`, async () => {
+    const sourceId = `replay-refinement-overlap`
+    const row = (version: number) => ({
+      sourceId,
+      rowKey: `row`,
+      version,
+    })
+    const harness = createHarness(sourceId)
+
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      await harness.downstream.preload()
+      await harness.startReplay()
+      await harness.startReplay()
+      expect(harness.pending).toHaveLength(2)
+
+      expect(harness.pending[0]!.options.signal?.aborted).toBe(true)
+      harness.replaceCore(3)
+      harness.pending[1]!.deferred.resolve()
+      await flushPromises()
+
+      const published = () => {
+        expect(harness.coreRows()).toEqual([row(3)])
+        expect(harness.visibleRows()).toEqual([row(3)])
+        expect(harness.batches).toEqual([
+          [{ type: `insert`, row: row(1) }],
+          [{ type: `update`, row: row(3), previousVersion: 1 }],
+        ])
+        expect(harness.callbackReads).toEqual([[row(1)], [row(3)]])
+      }
+      published()
+
+      // The aborted load's late settlement changes nothing.
+      harness.pending[0]!.deferred.reject(
+        new DOMException(`obsolete`, `AbortError`),
+      )
+      await flushPromises()
+      published()
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishHarnessCleanup(primaryFailure, harness)
+    }
+  })
+
+  it(`waits for every recovering source before publishing a joined replacement`, async () => {
+    type Primary = { id: string; joinKey: string; version: number }
+    type Secondary = { id: string; joinKey: string; version: number }
+
+    const createSource = <T extends { id: string }>(id: string) => {
+      let begin!: () => void
+      let write!: (message: { type: `insert`; value: T }) => void
+      let commit!: () => true | Promise<void>
+      let truncate!: () => void
+      const pending: Array<ReturnType<typeof createDeferred<void>>> = []
+      const collection = createCollection<T>({
+        id,
+        getKey: ({ id: key }) => key,
+        syncMode: `on-demand`,
+        sync: {
+          sync: (operations) => {
+            begin = operations.begin
+            write = operations.write
+            commit = operations.commit
+            truncate = operations.truncate
+            operations.markReady()
+            return {
+              loadSubset: () => {
+                const request = createDeferred<void>()
+                pending.push(request)
+                return request.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      return {
+        collection,
+        pending,
+        async apply(row: T) {
+          begin()
+          write({ type: `insert`, value: row })
+          const receipt = commit()
+          if (receipt !== true) await receipt
+        },
+        replay() {
+          begin()
+          truncate()
+          return commit()
+        },
+      }
+    }
+
+    const primary = createSource<Primary>(`joined-replay-primary`)
+    const secondary = createSource<Secondary>(`joined-replay-secondary`)
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ primary: primary.collection })
+        .innerJoin(
+          { secondary: secondary.collection },
+          ({ primary: left, secondary: right }) =>
+            eq(left.joinKey, right.joinKey),
+        )
+        .orderBy(({ primary: row }) => row.version)
+        .limit(1)
+        .select(({ primary: left, secondary: right }) => ({
+          id: left.id,
+          secondaryId: right.id,
+          primaryVersion: left.version,
+          secondaryVersion: right.version,
+        })),
+    )
+    const read = () =>
+      live.toArray.map(
+        ({ id, secondaryId, primaryVersion, secondaryVersion }) => ({
+          id,
+          secondaryId,
+          primaryVersion,
+          secondaryVersion,
+        }),
+      )
+    const publications: Array<ReturnType<typeof read>> = []
+    let subscription: ReturnType<typeof live.subscribeChanges> | undefined
+    let primaryReplay: true | Promise<void> = true
+    let secondaryReplay: true | Promise<void> = true
+
+    let primaryFailure: { error: unknown } | undefined
+    try {
+      const preload = live.preload()
+      await flushPromises()
+      expect(primary.pending).toHaveLength(1)
+      await primary.apply({ id: `p`, joinKey: `shared`, version: 1 })
+      primary.pending[0]!.resolve()
+      await flushPromises()
+      expect(secondary.pending).toHaveLength(1)
+      await secondary.apply({ id: `s`, joinKey: `shared`, version: 1 })
+      secondary.pending[0]!.resolve()
+      await flushPromises()
+      for (const request of primary.pending.slice(1)) request.resolve()
+      await preload
+      expect(read()).toEqual([
+        {
+          id: `p`,
+          secondaryId: `s`,
+          primaryVersion: 1,
+          secondaryVersion: 1,
+        },
+      ])
+
+      subscription = live.subscribeChanges(() => publications.push(read()), {
+        includeInitialState: false,
+      })
+      const initialPrimaryLoads = primary.pending.length
+      const initialSecondaryLoads = secondary.pending.length
+      primaryReplay = primary.replay()
+      secondaryReplay = secondary.replay()
+      await flushPromises()
+      expect(primary.pending.length).toBeGreaterThan(initialPrimaryLoads)
+      expect(secondary.pending.length).toBeGreaterThan(initialSecondaryLoads)
+
+      await primary.apply({ id: `p`, joinKey: `shared`, version: 2 })
+      await secondary.apply({ id: `s`, joinKey: `shared`, version: 2 })
+      for (const request of primary.pending.slice(initialPrimaryLoads)) {
+        request.resolve()
+      }
+      await flushPromises()
+
+      expect(read()).toEqual([
+        {
+          id: `p`,
+          secondaryId: `s`,
+          primaryVersion: 1,
+          secondaryVersion: 1,
+        },
+      ])
+      expect(publications).toEqual([])
+
+      for (const request of secondary.pending.slice(initialSecondaryLoads)) {
+        request.resolve()
+      }
+      await Promise.all([primaryReplay, secondaryReplay])
+      await flushPromises()
+
+      expect(read()).toEqual([
+        {
+          id: `p`,
+          secondaryId: `s`,
+          primaryVersion: 2,
+          secondaryVersion: 2,
+        },
+      ])
+      expect(publications).toEqual([
+        [
+          {
+            id: `p`,
+            secondaryId: `s`,
+            primaryVersion: 2,
+            secondaryVersion: 2,
+          },
+        ],
+      ])
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      await finishCleanup(primaryFailure, [
+        [
+          ...[...primary.pending, ...secondary.pending].map(
+            (request, index) => ({
+              name: `source request ${index}`,
+              run: () => request.resolve(),
+            }),
+          ),
+          { name: `subscription`, run: () => subscription?.unsubscribe() },
+        ],
+        [
+          { name: `primary replay`, run: () => primaryReplay },
+          { name: `secondary replay`, run: () => secondaryReplay },
+          { name: `live query`, run: () => live.cleanup() },
+          { name: `primary source`, run: () => primary.collection.cleanup() },
+          {
+            name: `secondary source`,
+            run: () => secondary.collection.cleanup(),
+          },
+        ],
+      ])
+    }
+  })
+})
diff --git a/packages/db/tests/query/load-subset-source-readiness-refinement-oracle.test.ts b/packages/db/tests/query/load-subset-source-readiness-refinement-oracle.test.ts
index ceedcd364a..1d1e17d839 100644
--- a/packages/db/tests/query/load-subset-source-readiness-refinement-oracle.test.ts
+++ b/packages/db/tests/query/load-subset-source-readiness-refinement-oracle.test.ts
@@ -8,7 +8,9 @@ import {
   eq,
   toArray,
 } from '../../src/query/index.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { flushPromises } from '../utils.js'
+import { finishCleanup } from './load-subset-source-readiness-support.js'
 import type { LoadSubsetOptions } from '../../src/types.js'
 
 /**
@@ -45,35 +47,7 @@ function expectedRows(
   ]
 }
 
-async function finishCleanup(
-  primaryFailure: { error: unknown } | undefined,
-  phases: ReadonlyArray<
-    ReadonlyArray<{ name: string; run: () => Promise<unknown> }>
-  >,
-): Promise<void> {
-  const cleanupErrors: Array<Error> = []
-  for (const phase of phases) {
-    const results = await Promise.allSettled(
-      phase.map(({ run }) => Promise.resolve().then(run)),
-    )
-    for (const [index, result] of results.entries()) {
-      if (result.status === `rejected`) {
-        cleanupErrors.push(
-          new Error(`${phase[index]!.name} cleanup failed`, {
-            cause: result.reason,
-          }),
-        )
-      }
-    }
-  }
-  if (cleanupErrors.length > 0) {
-    throw new AggregateError(
-      cleanupErrors,
-      `Oracle cleanup failed`,
-      primaryFailure && { cause: primaryFailure.error },
-    )
-  }
-}
+declareOracle({ model: [expectedRows] })
 
 it.each([
   { oldOutcome: `resolve`, settlementOrder: `old-first` },
@@ -355,121 +329,3 @@ it.each([
  * right source then either completes the join, fails preload, or is abandoned
  * by cleanup. The controlled adapters hold only delivery, not a real provider.
  */
-it.each([`resolve`, `reject`, `cleanup`] as const)(
-  `matches cross-source initial readiness through %s`,
-  async (secondOutcome) => {
-    const leftId = `readiness-left-${secondOutcome}`
-    const rightId = `readiness-right-${secondOutcome}`
-    const leftDelivery = createDeferred<void>()
-    const rightDelivery = createDeferred<void>()
-    const createSource = (
-      id: string,
-      row: Row,
-      delivery: ReturnType<typeof createDeferred<void>>,
-    ) =>
-      createCollection<Row>({
-        id,
-        getKey: (value) => value.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            markReady()
-            return {
-              loadSubset: () =>
-                delivery.promise.then(async () => {
-                  begin()
-                  write({ type: `insert`, value: row })
-                  const applied = commit()
-                  if (applied !== true) await applied
-                  return
-                }),
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-    const left = createSource(
-      leftId,
-      { id: `left`, group: `shared` },
-      leftDelivery,
-    )
-    const right = createSource(
-      rightId,
-      { id: `right`, group: `shared` },
-      rightDelivery,
-    )
-    const live = createLiveQueryCollection({
-      id: `readiness-live-${secondOutcome}`,
-      query: (q) =>
-        q
-          .from({ left })
-          .innerJoin({ right }, ({ left: leftRow, right: rightRow }) =>
-            eq(leftRow.group, rightRow.group),
-          )
-          .select(({ left: leftRow, right: rightRow }) => ({
-            leftId: leftRow.id,
-            rightId: rightRow.id,
-          })),
-      startSync: true,
-    })
-    const preload = live.preload()
-    void preload.catch(() => undefined)
-    let primaryFailure: { error: unknown } | undefined
-
-    try {
-      expect(live.status).toBe(`loading`)
-
-      leftDelivery.resolve()
-      await flushPromises()
-
-      expect(live.status).toBe(`loading`)
-      expect(live.toArray).toEqual([])
-
-      if (secondOutcome === `cleanup`) {
-        await live.cleanup()
-        expect(live.status).toBe(`cleaned-up`)
-        await expect(preload).rejects.toMatchObject({ name: `AbortError` })
-
-        // This late write probes terminal query status with a nonconforming
-        // source; a conforming request-scoped loader stops after cancellation.
-        rightDelivery.resolve()
-        await flushPromises()
-
-        expect(live.status).toBe(`cleaned-up`)
-        expect(live.toArray).toEqual([])
-        return
-      } else if (secondOutcome === `resolve`) {
-        rightDelivery.resolve()
-      } else {
-        rightDelivery.reject(new Error(`right source failed`))
-      }
-      await flushPromises()
-
-      expect(live.status).toBe(secondOutcome === `resolve` ? `ready` : `error`)
-      if (secondOutcome === `resolve`) {
-        await expect(preload).resolves.toBeUndefined()
-        expect(live.toArray).toEqual([
-          expect.objectContaining({ leftId: `left`, rightId: `right` }),
-        ])
-      } else {
-        await expect(preload).rejects.toThrow(`right source failed`)
-      }
-    } catch (error) {
-      primaryFailure = { error }
-      throw error
-    } finally {
-      leftDelivery.resolve()
-      rightDelivery.resolve()
-      await finishCleanup(primaryFailure, [
-        [{ name: `live query`, run: () => live.cleanup() }],
-        [
-          { name: `left source`, run: () => left.cleanup() },
-          { name: `right source`, run: () => right.cleanup() },
-        ],
-      ])
-    }
-  },
-)
diff --git a/packages/db/tests/query/load-subset-source-readiness-support.ts b/packages/db/tests/query/load-subset-source-readiness-support.ts
new file mode 100644
index 0000000000..e0eb386dba
--- /dev/null
+++ b/packages/db/tests/query/load-subset-source-readiness-support.ts
@@ -0,0 +1,33 @@
+// Shared cleanup for the load-subset source-readiness tests. It runs each
+// phase of cleanup, collects every failure, and keeps the primary failure as
+// the cause. The readiness law is owned by
+// load-subset-source-readiness-refinement-oracle.test.ts.
+export async function finishCleanup(
+  primaryFailure: { error: unknown } | undefined,
+  phases: ReadonlyArray<
+    ReadonlyArray<{ name: string; run: () => Promise<unknown> }>
+  >,
+): Promise<void> {
+  const cleanupErrors: Array<Error> = []
+  for (const phase of phases) {
+    const results = await Promise.allSettled(
+      phase.map(({ run }) => Promise.resolve().then(run)),
+    )
+    for (const [index, result] of results.entries()) {
+      if (result.status === `rejected`) {
+        cleanupErrors.push(
+          new Error(`${phase[index]!.name} cleanup failed`, {
+            cause: result.reason,
+          }),
+        )
+      }
+    }
+  }
+  if (cleanupErrors.length > 0) {
+    throw new AggregateError(
+      cleanupErrors,
+      `Oracle cleanup failed`,
+      primaryFailure && { cause: primaryFailure.error },
+    )
+  }
+}
diff --git a/packages/db/tests/query/load-subset-source-readiness.test.ts b/packages/db/tests/query/load-subset-source-readiness.test.ts
new file mode 100644
index 0000000000..0cb3bbe1ab
--- /dev/null
+++ b/packages/db/tests/query/load-subset-source-readiness.test.ts
@@ -0,0 +1,132 @@
+// Ordinary loadSubset source-readiness tests: a join whose right source
+// resolves, rejects, or is cleaned up while preload waits, with each terminal
+// status written out. The fenced-attempt law that the generated cases check is
+// owned by load-subset-source-readiness-refinement-oracle.test.ts.
+import { expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { BTreeIndex } from '../../src/index.js'
+import { createLiveQueryCollection, eq } from '../../src/query/index.js'
+import { flushPromises } from '../utils.js'
+import { finishCleanup } from './load-subset-source-readiness-support.js'
+
+type Row = { id: string; group: string }
+
+it.each([`resolve`, `reject`, `cleanup`] as const)(
+  `matches cross-source initial readiness through %s`,
+  async (secondOutcome) => {
+    const leftId = `readiness-left-${secondOutcome}`
+    const rightId = `readiness-right-${secondOutcome}`
+    const leftDelivery = createDeferred<void>()
+    const rightDelivery = createDeferred<void>()
+    const createSource = (
+      id: string,
+      row: Row,
+      delivery: ReturnType<typeof createDeferred<void>>,
+    ) =>
+      createCollection<Row>({
+        id,
+        getKey: (value) => value.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            markReady()
+            return {
+              loadSubset: () =>
+                delivery.promise.then(async () => {
+                  begin()
+                  write({ type: `insert`, value: row })
+                  const applied = commit()
+                  if (applied !== true) await applied
+                  return
+                }),
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+    const left = createSource(
+      leftId,
+      { id: `left`, group: `shared` },
+      leftDelivery,
+    )
+    const right = createSource(
+      rightId,
+      { id: `right`, group: `shared` },
+      rightDelivery,
+    )
+    const live = createLiveQueryCollection({
+      id: `readiness-live-${secondOutcome}`,
+      query: (q) =>
+        q
+          .from({ left })
+          .innerJoin({ right }, ({ left: leftRow, right: rightRow }) =>
+            eq(leftRow.group, rightRow.group),
+          )
+          .select(({ left: leftRow, right: rightRow }) => ({
+            leftId: leftRow.id,
+            rightId: rightRow.id,
+          })),
+      startSync: true,
+    })
+    const preload = live.preload()
+    void preload.catch(() => undefined)
+    let primaryFailure: { error: unknown } | undefined
+
+    try {
+      expect(live.status).toBe(`loading`)
+
+      leftDelivery.resolve()
+      await flushPromises()
+
+      expect(live.status).toBe(`loading`)
+      expect(live.toArray).toEqual([])
+
+      if (secondOutcome === `cleanup`) {
+        await live.cleanup()
+        expect(live.status).toBe(`cleaned-up`)
+        await expect(preload).rejects.toMatchObject({ name: `AbortError` })
+
+        // This late write probes terminal query status with a nonconforming
+        // source; a conforming request-scoped loader stops after cancellation.
+        rightDelivery.resolve()
+        await flushPromises()
+
+        expect(live.status).toBe(`cleaned-up`)
+        expect(live.toArray).toEqual([])
+        return
+      } else if (secondOutcome === `resolve`) {
+        rightDelivery.resolve()
+      } else {
+        rightDelivery.reject(new Error(`right source failed`))
+      }
+      await flushPromises()
+
+      expect(live.status).toBe(secondOutcome === `resolve` ? `ready` : `error`)
+      if (secondOutcome === `resolve`) {
+        await expect(preload).resolves.toBeUndefined()
+        expect(live.toArray).toEqual([
+          expect.objectContaining({ leftId: `left`, rightId: `right` }),
+        ])
+      } else {
+        await expect(preload).rejects.toThrow(`right source failed`)
+      }
+    } catch (error) {
+      primaryFailure = { error }
+      throw error
+    } finally {
+      leftDelivery.resolve()
+      rightDelivery.resolve()
+      await finishCleanup(primaryFailure, [
+        [{ name: `live query`, run: () => live.cleanup() }],
+        [
+          { name: `left source`, run: () => left.cleanup() },
+          { name: `right source`, run: () => right.cleanup() },
+        ],
+      ])
+    }
+  },
+)
diff --git a/packages/db/tests/query/load-subset-support.ts b/packages/db/tests/query/load-subset-support.ts
new file mode 100644
index 0000000000..14dd8a1b80
--- /dev/null
+++ b/packages/db/tests/query/load-subset-support.ts
@@ -0,0 +1,80 @@
+// Shared fixtures for the loadSubset demand tests: the exact-demand record, the
+// axis pairs that each differ in one request-data field, and the conversion of a
+// demand to LoadSubsetOptions. The identity laws are owned by
+// load-subset-oracle.property.test.ts.
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+
+export type ExactDemand = {
+  values: ReadonlyArray<number>
+  orderField: `rank` | `score`
+  direction: `asc` | `desc`
+  nulls: `first` | `last`
+  stringSort: `lexical` | `locale`
+  offset: number
+  limit: number | undefined
+  cursorBoundary: number | undefined
+}
+
+const rankRef = new PropRef<number>([`rank`])
+const scoreRef = new PropRef<number>([`score`])
+
+// Each pair differs in only one request-data axis. A deduper that drops that
+// axis would wrongly reuse the first acquisition at the second request.
+export const exactDemandAxisPairs: ReadonlyArray<
+  readonly [axis: string, first: ExactDemand, second: ExactDemand]
+> = (() => {
+  const first: ExactDemand = {
+    values: [1, 2],
+    orderField: `rank`,
+    direction: `asc`,
+    nulls: `last`,
+    stringSort: `lexical`,
+    offset: 0,
+    limit: 2,
+    cursorBoundary: undefined,
+  }
+  return [
+    [`predicate values`, first, { ...first, values: [1, 3] }],
+    [`order field`, first, { ...first, orderField: `score` }],
+    [`direction`, first, { ...first, direction: `desc` }],
+    [`null placement`, first, { ...first, nulls: `first` }],
+    [`string sort`, first, { ...first, stringSort: `locale` }],
+    [`offset`, first, { ...first, offset: 1 }],
+    [`limit`, first, { ...first, limit: undefined }],
+    [`cursor boundary`, first, { ...first, cursorBoundary: 1 }],
+  ]
+})()
+
+export function toLoadSubsetOptions(demand: ExactDemand): LoadSubsetOptions {
+  const orderRef = demand.orderField === `rank` ? rankRef : scoreRef
+  return {
+    where: new Func(`in`, [scoreRef, new Value([...demand.values])]),
+    orderBy: [
+      {
+        expression: orderRef,
+        compareOptions: {
+          direction: demand.direction,
+          nulls: demand.nulls,
+          stringSort: demand.stringSort,
+        },
+      },
+    ],
+    offset: demand.offset,
+    limit: demand.limit,
+    cursor:
+      demand.cursorBoundary === undefined
+        ? undefined
+        : {
+            whereFrom: new Func(demand.direction === `asc` ? `gt` : `lt`, [
+              orderRef,
+              new Value(demand.cursorBoundary),
+            ]),
+            whereCurrent: new Func(`eq`, [
+              orderRef,
+              new Value(demand.cursorBoundary),
+            ]),
+            lastKey: demand.cursorBoundary,
+          },
+  }
+}
diff --git a/packages/db/tests/query/load-subset-transaction-refinement-oracle.test.ts b/packages/db/tests/query/load-subset-transaction-refinement-oracle.test.ts
index b7f3c5ac2b..59c4fcdafe 100644
--- a/packages/db/tests/query/load-subset-transaction-refinement-oracle.test.ts
+++ b/packages/db/tests/query/load-subset-transaction-refinement-oracle.test.ts
@@ -3,6 +3,7 @@ import { createCollection } from '../../src/collection/index.js'
 import { createDeferred } from '../../src/deferred.js'
 import { createTransaction } from '../../src/transactions.js'
 import { LoadSubsetOperationAbortedError } from '../../src/errors.js'
+import { declareOracle } from '../oracle-declaration.js'
 
 /**
  * # When can an abort cancel a load?
@@ -58,40 +59,9 @@ function expectedOutcome(
   }
 }
 
-describe(`loadSubset transaction refinement`, () => {
-  // A load aborted before it starts rejects with `AbortError` and never
-  // reaches the source.
-  it(`rejects a load aborted before it reaches the source`, async () => {
-    let loadSubsetCalls = 0
-    const source = createCollection<Row>({
-      id: `transaction-refinement-before-load`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ markReady }) => {
-          markReady()
-          return {
-            loadSubset: () => {
-              loadSubsetCalls++
-              return true
-            },
-          }
-        },
-      },
-    })
-    source.startSyncImmediate()
-    try {
-      const controller = new AbortController()
-      controller.abort()
-      const load = source._sync.loadSubset({ signal: controller.signal })
-      if (load === true) throw new Error(`Expected a rejected load`)
-      await expect(load).rejects.toMatchObject({ name: `AbortError` })
-      expect(loadSubsetCalls).toBe(0)
-    } finally {
-      await source.cleanup()
-    }
-  })
+declareOracle({ model: [expectedOutcome] })
 
+describe(`loadSubset transaction refinement`, () => {
   // These three phases cover the contract:
   // - The caller aborts during commit.
   // - The caller aborts after commit while publication waits.
diff --git a/packages/db/tests/query/load-subset-transaction-refinement.test.ts b/packages/db/tests/query/load-subset-transaction-refinement.test.ts
new file mode 100644
index 0000000000..ee96c7af72
--- /dev/null
+++ b/packages/db/tests/query/load-subset-transaction-refinement.test.ts
@@ -0,0 +1,42 @@
+// Ordinary loadSubset transaction tests: a load aborted before it reaches the
+// source. The abort-timing law for accepted and parked batches is owned by
+// load-subset-transaction-refinement-oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+
+type Row = { id: string; group: string }
+
+describe(`loadSubset transaction refinement`, () => {
+  // A load aborted before it starts rejects with `AbortError` and never
+  // reaches the source.
+  it(`rejects a load aborted before it reaches the source`, async () => {
+    let loadSubsetCalls = 0
+    const source = createCollection<Row>({
+      id: `transaction-refinement-before-load`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ markReady }) => {
+          markReady()
+          return {
+            loadSubset: () => {
+              loadSubsetCalls++
+              return true
+            },
+          }
+        },
+      },
+    })
+    source.startSyncImmediate()
+    try {
+      const controller = new AbortController()
+      controller.abort()
+      const load = source._sync.loadSubset({ signal: controller.signal })
+      if (load === true) throw new Error(`Expected a rejected load`)
+      await expect(load).rejects.toMatchObject({ name: `AbortError` })
+      expect(loadSubsetCalls).toBe(0)
+    } finally {
+      await source.cleanup()
+    }
+  })
+})
diff --git a/packages/db/tests/query/load-subset.test.ts b/packages/db/tests/query/load-subset.test.ts
new file mode 100644
index 0000000000..e507ef0756
--- /dev/null
+++ b/packages/db/tests/query/load-subset.test.ts
@@ -0,0 +1,1262 @@
+// Fixed-scenario tests for loadSubset application, cancellation, and cleanup.
+// Each test runs one hand-written history and checks literal rows, counts, or
+// error names, so these are unit tests. The generated demand-identity laws are
+// owned by load-subset-oracle.property.test.ts. The applied-receipt contract is
+// in packages/db/src/query/live/ARCHITECTURE.md (Source cancellation and applied
+// settlement).
+//
+// The application law: provider completion is not enough. A successful
+// loadSubset result waits for its establishing applied receipt, and its loaded
+// rows must cross the source Collection publication boundary before initial-query
+// readiness. An abort before that boundary rejects and suppresses the rows. An
+// abort after publication is too late, and the applied rows stay visible.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import {
+  LoadSubsetOperationAbortedError,
+  SyncQueueInvariantError,
+} from '../../src/errors.js'
+import { createOptimisticAction } from '../../src/optimistic-action.js'
+import { createLiveQueryCollection, eq } from '../../src/query/index.js'
+import { DeduplicatedLoadSubset } from '../../src/query/subset-dedupe.js'
+import { createTransaction } from '../../src/transactions.js'
+import { expectAssertionFailure } from '../expected-failure.js'
+import { TraceAssertionError } from '../trace-runner.js'
+import {
+  exactDemandAxisPairs,
+  toLoadSubsetOptions,
+} from './load-subset-support.js'
+import type {
+  LoadSubsetRequestResult,
+  SyncAppliedReceipt,
+} from '../../src/types.js'
+
+type PersistedLoadRow = {
+  id: string
+  projectId: string
+}
+
+type OptimisticDerivedRow = {
+  id: string
+  value: string
+}
+
+// A load result may include delivery before it awaits the establishing applied
+// receipt. Only commit() returns that receipt.
+function requirePendingLoadSubsetResult(
+  loadResult: LoadSubsetRequestResult,
+): Promise<void> {
+  if (loadResult === true) {
+    throw new Error(`Expected an asynchronous subset load`)
+  }
+  return loadResult
+}
+
+let collectionSequence = 0
+
+type OracleCleanupStep = {
+  label: string
+  run: () => void | Promise<void>
+}
+
+// A failed law remains the cause even if one or more releases also fail. Run
+// every release so an earlier cleanup failure cannot strand later resources.
+async function runOracleCleanup(
+  law: string,
+  primaryFailure: { error: unknown } | undefined,
+  steps: ReadonlyArray<OracleCleanupStep>,
+): Promise<void> {
+  const cleanupFailures: Array<Error> = []
+  for (const { label, run } of steps) {
+    try {
+      await run()
+    } catch (error) {
+      cleanupFailures.push(
+        new Error(`${label} cleanup failed`, { cause: error }),
+      )
+    }
+  }
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(cleanupFailures, `${law}: cleanup failed`, {
+      cause: primaryFailure?.error,
+    })
+  }
+}
+
+function releasePersistingMutation(
+  persistence: ReturnType<typeof createDeferred<void>>,
+  settlement?: Promise<unknown>,
+): void {
+  persistence.resolve()
+  // A broken applied-settlement path can leave optimistic transaction
+  // settlement pending forever. Collection teardown must proceed; observing
+  // rejection prevents an abandoned promise from becoming an unrelated error.
+  void settlement?.catch(() => undefined)
+}
+
+async function expectPersistingLoadIsApplied(
+  persisting: boolean,
+  delivery: `synchronous` | `asynchronous` = `synchronous`,
+  transactionStart: `during-load` | `before-load` = `during-load`,
+) {
+  const rows: Array<PersistedLoadRow> = [
+    { id: `r1`, projectId: `p1` },
+    { id: `r2`, projectId: `p1` },
+  ]
+  let loadCalls = 0
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-oracle-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        if (transactionStart === `before-load`) begin()
+        markReady()
+        return {
+          loadSubset: () => {
+            loadCalls += 1
+            const applyRows = () => {
+              if (transactionStart === `during-load`) begin()
+              for (const row of rows) {
+                write({ type: `insert`, value: { ...row } })
+              }
+              return commit()
+            }
+            if (delivery === `synchronous`) {
+              return applyRows()
+            }
+            return Promise.resolve().then(async () => {
+              const applied = applyRows()
+              if (applied !== true) await applied
+            })
+          },
+        }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let cleanupLive: (() => Promise<void>) | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    if (persisting) {
+      transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
+    }
+    const live = createLiveQueryCollection((query) =>
+      query.from({ row: source }).where(({ row }) => eq(row.projectId, `p1`)),
+    )
+    cleanupLive = () => live.cleanup()
+    if (persisting) expect(transaction.state).toBe(`persisting`)
+    const ready = live.toArrayWhenReady()
+    if (persisting) {
+      let fulfilled = false
+      void ready.then(
+        () => {
+          fulfilled = true
+        },
+        () => undefined,
+      )
+      await Promise.resolve()
+      await Promise.resolve()
+
+      expect(fulfilled).toBe(false)
+      expect(source.get(`r1`)).toBeUndefined()
+      expect(source.get(`r2`)).toBeUndefined()
+
+      persistence.resolve()
+      await transaction.isPersisted.promise
+    }
+
+    const result = await ready
+    expect(loadCalls).toBe(1)
+    try {
+      expect(result.map(({ id }) => id).sort()).toEqual([`r1`, `r2`])
+    } catch (error) {
+      throw new TraceAssertionError(0, error)
+    }
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `applied load reaches live-query readiness`,
+      primaryFailure,
+      [
+        {
+          label: `optimistic persistence`,
+          run: () => {
+            if (persisting) {
+              releasePersistingMutation(persistence, settlement)
+            }
+          },
+        },
+        { label: `live query`, run: () => cleanupLive?.() },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectAppliedReceiptTiming(
+  gate: `free` | `parked`,
+  delivery: `synchronous` | `asynchronous`,
+): Promise<void> {
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-timing-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        markReady()
+        return {
+          loadSubset: () => {
+            const applyRow = () => {
+              begin()
+              write({
+                type: `insert`,
+                value: { id: `remote`, projectId: `p1` },
+              })
+              return commit()
+            }
+
+            return delivery === `synchronous`
+              ? applyRow()
+              : Promise.resolve().then(async () => {
+                  const applied = applyRow()
+                  if (applied !== true) await applied
+                })
+          },
+        }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    if (gate === `parked`) {
+      transaction.mutate(() => source.insert({ id: `local`, projectId: `p2` }))
+    }
+    if (gate === `parked`) expect(transaction.state).toBe(`persisting`)
+    const loadResult = source._sync.loadSubset({})
+    if (gate === `free` && delivery === `synchronous`) {
+      expect(loadResult).toBe(true)
+      expect(source.get(`remote`)).toEqual(
+        expect.objectContaining({ id: `remote`, projectId: `p1` }),
+      )
+      return
+    }
+
+    const pending = requirePendingLoadSubsetResult(loadResult)
+    let fulfilled = false
+    let visibleWhenFulfilled = false
+    void pending
+      .then(
+        () => {
+          fulfilled = true
+          visibleWhenFulfilled = source.get(`remote`)?.id === `remote`
+        },
+        () => undefined,
+      )
+      .catch(() => undefined)
+
+    expect(fulfilled).toBe(false)
+    expect(source.get(`remote`)).toBeUndefined()
+    await Promise.resolve()
+    await Promise.resolve()
+
+    if (gate === `parked`) {
+      expect(fulfilled).toBe(false)
+      expect(source.get(`remote`)).toBeUndefined()
+      persistence.resolve()
+      await transaction.isPersisted.promise
+    }
+
+    await pending
+    expect(fulfilled).toBe(true)
+    expect(visibleWhenFulfilled).toBe(true)
+    expect(source.get(`remote`)).toEqual(
+      expect.objectContaining({ id: `remote`, projectId: `p1` }),
+    )
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `subset load fulfillment follows application`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectAppliedLoadDoesNotFlushEarlierParkedSync() {
+  const rows: Array<PersistedLoadRow> = [
+    { id: `r1`, projectId: `p1` },
+    { id: `r2`, projectId: `p1` },
+  ]
+  let publishUnrelated!: () => void
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-order-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        publishUnrelated = () => {
+          begin()
+          write({
+            type: `insert`,
+            value: { id: `unrelated`, projectId: `p2` },
+          })
+          commit()
+        }
+        markReady()
+        return {
+          loadSubset: () => {
+            begin()
+            for (const row of rows) {
+              write({ type: `insert`, value: { ...row } })
+            }
+            return commit()
+          },
+        }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let cleanupLive: (() => Promise<void>) | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
+    publishUnrelated()
+    const live = createLiveQueryCollection((query) =>
+      query.from({ row: source }).where(({ row }) => eq(row.projectId, `p1`)),
+    )
+    cleanupLive = () => live.cleanup()
+    expect(transaction.state).toBe(`persisting`)
+    const ready = live.toArrayWhenReady()
+    let fulfilled = false
+    void ready.then(
+      () => {
+        fulfilled = true
+      },
+      () => undefined,
+    )
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(fulfilled).toBe(false)
+    expect(source.get(`unrelated`)).toBeUndefined()
+
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await expect(ready).resolves.toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ id: `r1` }),
+        expect.objectContaining({ id: `r2` }),
+      ]),
+    )
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `parked stream remains behind applied subset`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `live query`, run: () => cleanupLive?.() },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectCompletionWaitsForAppliedRows() {
+  let publishUnrelated!: () => void
+  let transportCalls = 0
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-coverage-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        publishUnrelated = () => {
+          begin()
+          write({
+            type: `insert`,
+            value: { id: `unrelated`, projectId: `p2` },
+          })
+          commit()
+        }
+        const deduplicated = new DeduplicatedLoadSubset({
+          loadSubset: () => {
+            transportCalls += 1
+            begin()
+            write({
+              type: `insert`,
+              value: { id: `r1`, projectId: `p1` },
+            })
+            return commit()
+          },
+        })
+        markReady()
+        return { loadSubset: deduplicated.loadSubset }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
+    publishUnrelated()
+    const first = source._sync.loadSubset({})
+    expect(first).toBeInstanceOf(Promise)
+    await Promise.resolve()
+    await Promise.resolve()
+
+    const concurrent = source._sync.loadSubset({})
+    expect(concurrent).toBe(first)
+    expect(transportCalls).toBe(1)
+    expect(source.get(`r1`)).toBeUndefined()
+
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await Promise.all([first, concurrent])
+    expect(source.get(`r1`)).toEqual(
+      expect.objectContaining({ id: `r1`, projectId: `p1` }),
+    )
+    expect(source._sync.loadSubset({})).toBe(true)
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `subset completion follows applied rows`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectConcurrentStreamCommitStaysParked(
+  cancelBeforePersistence = false,
+) {
+  let publishUnrelated!: () => void
+  let publishSubset!: () => void
+  let rejectPendingSubset: ((reason: unknown) => void) | undefined
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-concurrent-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        publishUnrelated = () => {
+          begin()
+          write({
+            type: `insert`,
+            value: { id: `unrelated`, projectId: `p2` },
+          })
+          commit()
+        }
+        markReady()
+        return {
+          loadSubset: () =>
+            new Promise<void>((resolve, reject) => {
+              const fulfill = () => {
+                rejectPendingSubset = undefined
+                resolve()
+              }
+              const fail = (reason: unknown) => {
+                rejectPendingSubset = undefined
+                reject(reason)
+              }
+              rejectPendingSubset = fail
+              publishSubset = () => {
+                try {
+                  begin()
+                  write({
+                    type: `insert`,
+                    value: { id: `r1`, projectId: `p1` },
+                  })
+                  const applied = commit()
+                  if (applied === true) {
+                    fulfill()
+                  } else {
+                    void applied.then(fulfill, fail)
+                  }
+                } catch (error) {
+                  fail(error)
+                }
+              }
+            }),
+        }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() => source.insert({ id: `other`, projectId: `p2` }))
+    const load = requirePendingLoadSubsetResult(source._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    publishUnrelated()
+    publishSubset()
+    let fulfilled = false
+    void load.then(
+      () => {
+        fulfilled = true
+      },
+      () => undefined,
+    )
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(fulfilled).toBe(false)
+    expect(source.get(`unrelated`)).toBeUndefined()
+    expect(source.get(`r1`)).toBeUndefined()
+    if (cancelBeforePersistence) {
+      await source.cleanup()
+      await expect(load).rejects.toMatchObject({ name: `AbortError` })
+      return
+    }
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await load
+    expect(source.get(`unrelated`)).toEqual(
+      expect.objectContaining({ id: `unrelated`, projectId: `p2` }),
+    )
+    expect(source.get(`r1`)).toEqual(
+      expect.objectContaining({ id: `r1`, projectId: `p1` }),
+    )
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `concurrent stream commit remains parked`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        {
+          label: `controlled subset transport`,
+          run: () =>
+            rejectPendingSubset?.(
+              new DOMException(`Oracle fixture released`, `AbortError`),
+            ),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectAbortedReceiptDoesNotSettleDemand(
+  abortPhase: `before-commit` | `while-parked`,
+) {
+  let transportCalls = 0
+  const committed = createDeferred<void>()
+  const deduplicated = new DeduplicatedLoadSubset({
+    loadSubset: async ({ signal }) => {
+      transportCalls += 1
+      if (abortPhase === `before-commit`) {
+        // Give cancellation a chance to revoke this request before its
+        // request-scoped rows enter the collection transaction.
+        await Promise.resolve()
+        if (signal?.aborted) {
+          return
+        }
+      }
+      begin()
+      write({
+        type: `insert`,
+        value: { id: `row`, projectId: `p1` },
+      })
+      const applied = commit(signal)
+      committed.resolve()
+      if (applied !== true) await applied
+      // Source contract: accepted rows apply, but a caller that aborted sees
+      // `AbortError`.
+      if (signal?.aborted) throw new LoadSubsetOperationAbortedError()
+    },
+  })
+  let begin!: () => void
+  let write!: (message: { type: `insert`; value: PersistedLoadRow }) => void
+  let commit!: (signal?: AbortSignal) => SyncAppliedReceipt
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-abort-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: (params) => {
+        begin = params.begin
+        write = params.write
+        commit = params.commit
+        params.markReady()
+        return { loadSubset: deduplicated.loadSubset }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  const controller = new AbortController()
+  let settlement: Promise<unknown> | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() => source.insert({ id: `local`, projectId: `p2` }))
+    const first = requirePendingLoadSubsetResult(
+      source._sync.loadSubset({ signal: controller.signal }),
+    )
+    if (abortPhase === `while-parked`) {
+      await committed.promise
+    }
+    controller.abort()
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    // An accepted transaction always applies, so the row publishes when the
+    // mutation settles. A caller that aborted still sees `AbortError`.
+    if (abortPhase === `while-parked`)
+      await expect(first).rejects.toMatchObject({ name: `AbortError` })
+    else await first
+    expect(transportCalls).toBe(1)
+    if (abortPhase === `while-parked`)
+      expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
+    else expect(source.get(`row`)).toBeUndefined()
+
+    const retry = source._sync.loadSubset({})
+    if (retry !== true) await retry
+    expect(transportCalls).toBe(2)
+    expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `aborted receipt remains retryable`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectAbortDuringPublicationDoesNotCancelReceipt() {
+  const controller = new AbortController()
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-publication-abort-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        markReady()
+        return {
+          loadSubset: ({ signal }) => {
+            begin()
+            write({
+              type: `insert`,
+              value: { id: `row`, projectId: `p1` },
+            })
+            return commit(signal)
+          },
+        }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let unsubscribe: (() => void) | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() =>
+      source.insert({ id: `local`, projectId: `pending` }),
+    )
+    const subscription = source.subscribeChanges((changes) => {
+      if (changes.some((change) => change.key === `row`)) {
+        controller.abort()
+      }
+    })
+    unsubscribe = () => subscription.unsubscribe()
+    const load = requirePendingLoadSubsetResult(
+      source._sync.loadSubset({ signal: controller.signal }),
+    )
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await expect(load).resolves.toBeUndefined()
+    expect(controller.signal.aborted).toBe(true)
+    expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `abort during publication retains applied rows`,
+      primaryFailure,
+      [
+        { label: `change subscription`, run: () => unsubscribe?.() },
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectCanceledReceiptReleasesOnlyItsSuppression() {
+  let begin!: () => void
+  let write!: (message: { type: `update`; value: PersistedLoadRow }) => void
+  let commit!: (signal?: AbortSignal) => SyncAppliedReceipt
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-cancel-suppression-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    sync: {
+      sync: (params) => {
+        begin = params.begin
+        write = params.write
+        commit = params.commit
+        begin()
+        write({ type: `update`, value: { id: `first`, projectId: `old` } })
+        write({ type: `update`, value: { id: `second`, projectId: `old` } })
+        commit()
+        params.markReady()
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    await source.preload()
+    await Promise.resolve()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() =>
+      source.insert({ id: `local`, projectId: `pending` }),
+    )
+    expect(transaction.state).toBe(`persisting`)
+    begin()
+    write({ type: `update`, value: { id: `first`, projectId: `new` } })
+    const accepted = commit()
+    const acceptedTransaction = source._state.pendingSyncedTransactions.at(-1)!
+    expect(source._state.pendingSyncedTransactions).toHaveLength(1)
+    begin()
+    write({ type: `update`, value: { id: `second`, projectId: `new` } })
+    expect(source._state.pendingSyncedTransactions).toHaveLength(2)
+
+    // Only the accepted transaction publishes in a drain, so only its key is
+    // suppressed; the open one holds no suppression to release.
+    source._state.capturePreSyncVisibleState()
+    expect(source._state.recentlySyncedKeys).toEqual(new Set([`first`]))
+
+    // Only the open last transaction can be canceled.
+    expect(() =>
+      source._state.cancelPendingSyncedTransaction(acceptedTransaction),
+    ).toThrow(SyncQueueInvariantError)
+    const controller = new AbortController()
+    controller.abort()
+    const canceled = commit(controller.signal)
+    expect(source._state.pendingSyncedTransactions).toHaveLength(1)
+    expect(source._state.recentlySyncedKeys).toEqual(new Set([`first`]))
+    expect(source._state.preSyncVisibleState.has(`second`)).toBe(false)
+    expect(source._state.preSyncVisibleState.has(`first`)).toBe(true)
+    await expect(canceled).rejects.toMatchObject({ name: `AbortError` })
+    expect(accepted).not.toBe(true)
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `canceled receipt releases only its suppression`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectCleanupRejectsDemandOnce() {
+  let receipt!: Promise<void>
+  let transportCalls = 0
+  const deduplicated = new DeduplicatedLoadSubset({
+    loadSubset: () => {
+      transportCalls += 1
+      begin()
+      write({
+        type: `insert`,
+        value: { id: `row`, projectId: `p1` },
+      })
+      const applied = commit()
+      if (transportCalls === 1) {
+        if (applied === true) {
+          throw new Error(`Expected the subset transaction to remain parked`)
+        }
+        receipt = applied
+      }
+      return applied
+    },
+  })
+  let begin!: () => void
+  let write!: (message: { type: `insert`; value: PersistedLoadRow }) => void
+  let commit!: () => SyncAppliedReceipt
+  const source = createCollection<PersistedLoadRow>({
+    id: `load-subset-applied-cleanup-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: (params) => {
+        begin = params.begin
+        write = params.write
+        commit = params.commit
+        params.markReady()
+        return {
+          loadSubset: deduplicated.loadSubset,
+          cleanup: () => deduplicated.reset(),
+        }
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let settlements = 0
+
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    source.startSyncImmediate()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    settlement = transaction.isPersisted.promise
+    transaction.mutate(() => source.insert({ id: `local`, projectId: `p2` }))
+    const load = requirePendingLoadSubsetResult(source._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    void receipt.then(
+      () => {
+        settlements += 1
+      },
+      () => {
+        settlements += 1
+      },
+    )
+    await source.cleanup()
+    await expect(load).rejects.toMatchObject({ name: `AbortError` })
+    await expect(receipt).rejects.toMatchObject({ name: `AbortError` })
+    expect(settlements).toBe(1)
+
+    persistence.resolve()
+    await transaction.isPersisted.promise.catch(() => undefined)
+    await Promise.resolve()
+    expect(settlements).toBe(1)
+
+    // Restarting installs fresh sync controls. Reacquisition must both perform
+    // transport work and publish its rows; stale callbacks cannot prove either.
+    source.startSyncImmediate()
+    const retry = source._sync.loadSubset({})
+    if (retry !== true) await retry
+    expect(transportCalls).toBe(2)
+    expect(source.get(`row`)).toEqual(expect.objectContaining({ id: `row` }))
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `cleanup rejects abandoned demand once`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+async function expectDerivedSyncDuringOptimisticMutation(): Promise<void> {
+  let begin!: () => void
+  let write!: (message: { type: `insert`; value: OptimisticDerivedRow }) => void
+  let commit!: () => void
+  const source = createCollection<OptimisticDerivedRow>({
+    id: `optimistic-derived-source-${collectionSequence++}`,
+    getKey: (row) => row.id,
+    sync: {
+      sync: (params) => {
+        begin = params.begin
+        write = params.write
+        commit = params.commit
+        params.markReady()
+      },
+    },
+  })
+  const persistence = createDeferred<void>()
+  let settlement: Promise<unknown> | undefined
+  let cleanupDerived: (() => Promise<void>) | undefined
+  let primaryFailure: { error: unknown } | undefined
+  try {
+    const derived = createLiveQueryCollection({
+      query: (query) =>
+        query
+          .from({ row: source })
+          .select(({ row }) => ({ id: row.id, value: row.value })),
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    cleanupDerived = () => derived.cleanup()
+    // Query collections currently expose read-side virtual properties in their
+    // insert input type even though the runtime accepts the plain selected row.
+    const insertDerived = derived.insert.bind(derived) as unknown as (
+      row: OptimisticDerivedRow,
+    ) => ReturnType<typeof derived.insert>
+    const insertOptimistically = createOptimisticAction<OptimisticDerivedRow>({
+      onMutate: insertDerived,
+      mutationFn: () => persistence.promise,
+    })
+    await derived.preload()
+    const transaction = insertOptimistically({
+      id: `optimistic`,
+      value: `optimistic`,
+    })
+    settlement = transaction.isPersisted.promise
+    begin()
+    write({ type: `insert`, value: { id: `synced`, value: `synced` } })
+    commit()
+
+    try {
+      expect([...derived.keys()].sort()).toEqual([`optimistic`, `synced`])
+    } catch (error) {
+      throw new TraceAssertionError(0, error)
+    }
+  } catch (error) {
+    primaryFailure = { error }
+    throw error
+  } finally {
+    await runOracleCleanup(
+      `derived sync during optimistic mutation`,
+      primaryFailure,
+      [
+        {
+          label: `persistence gate`,
+          run: () => releasePersistingMutation(persistence, settlement),
+        },
+        { label: `derived collection`, run: () => cleanupDerived?.() },
+        { label: `source collection`, run: () => source.cleanup() },
+      ],
+    )
+  }
+}
+
+describe(`exact loadSubset demand oracle`, () => {
+  it(`refetch starts fresh work for the same exact demand`, () => {
+    let starts = 0
+    const dedupe = new DeduplicatedLoadSubset({
+      loadSubset: () => {
+        starts++
+        return true
+      },
+    })
+    const options = toLoadSubsetOptions(exactDemandAxisPairs[0]![1])
+
+    expect(dedupe.loadSubset(options)).toBe(true)
+    expect(dedupe.loadSubset(options)).toBe(true)
+    expect(starts).toBe(1)
+
+    expect(dedupe.loadSubset({ ...options, refetch: true })).toBe(true)
+    expect(starts).toBe(2)
+    expect(dedupe.loadSubset(options)).toBe(true)
+    expect(starts).toBe(2)
+  })
+
+  it(`starts separate acquisitions for independently cancelable exact demands`, async () => {
+    const acquisitions: Array<ReturnType<typeof createDeferred<void>>> = []
+    const dedupe = new DeduplicatedLoadSubset({
+      loadSubset: () => {
+        const acquisition = createDeferred<void>()
+        acquisitions.push(acquisition)
+        return acquisition.promise
+      },
+    })
+    const options = toLoadSubsetOptions(exactDemandAxisPairs[0]![1])
+    const first = dedupe.loadSubset({
+      ...options,
+      signal: new AbortController().signal,
+    })
+    const second = dedupe.loadSubset({
+      ...options,
+      signal: new AbortController().signal,
+    })
+
+    expect(acquisitions).toHaveLength(2)
+    expect(first).not.toBe(second)
+    for (const acquisition of acquisitions) acquisition.resolve()
+    await Promise.all([first, second])
+  })
+})
+
+describe(`loadSubset application and cancellation`, () => {
+  it(`releases a pending mutation and source despite a cleanup fault`, async () => {
+    const primary = new TraceAssertionError(
+      4,
+      new Error(`subset load fulfilled before application`),
+    )
+    const persistence = createDeferred<void>()
+    const stillPending = createDeferred<void>()
+    const cleanupFault = new Error(`subscription release failed`)
+    const released: Array<string> = []
+    let cleanupWaitFulfilled = false
+    let cleanupWaitFulfilledAtCleanup = false
+    void stillPending.promise.then(
+      () => {
+        cleanupWaitFulfilled = true
+      },
+      () => undefined,
+    )
+
+    let failure: unknown
+    try {
+      await runOracleCleanup(
+        `subset load fulfillment follows application`,
+        { error: primary },
+        [
+          {
+            label: `persistence gate`,
+            run: () => {
+              released.push(`persistence gate`)
+              releasePersistingMutation(persistence, stillPending.promise)
+            },
+          },
+          {
+            label: `subscription`,
+            run: () => {
+              released.push(`subscription`)
+              throw cleanupFault
+            },
+          },
+          {
+            label: `source collection`,
+            run: () => {
+              released.push(`source collection`)
+            },
+          },
+        ],
+      )
+    } catch (error) {
+      failure = error
+    } finally {
+      cleanupWaitFulfilledAtCleanup = cleanupWaitFulfilled
+      stillPending.resolve()
+    }
+
+    await persistence.promise
+    expect(released).toEqual([
+      `persistence gate`,
+      `subscription`,
+      `source collection`,
+    ])
+    expect(cleanupWaitFulfilledAtCleanup).toBe(false)
+    expect(failure).toBeInstanceOf(AggregateError)
+    const aggregate = failure as AggregateError
+    expect(aggregate.cause).toBe(primary)
+    expect(primary.checkpoint).toBe(4)
+    expect(aggregate.errors).toEqual([
+      new Error(`subscription cleanup failed`, { cause: cleanupFault }),
+    ])
+  })
+
+  it(`keeps the violated law and checkpoint when two cleanup steps fail`, async () => {
+    const primary = new TraceAssertionError(
+      3,
+      new Error(`loaded row absent at readiness`),
+    )
+    const firstCleanup = new Error(`release failed`)
+    const secondCleanup = new Error(`collection cleanup failed`)
+    const releases: Array<string> = []
+
+    let failure: unknown
+    try {
+      await runOracleCleanup(
+        `applied load reaches live-query readiness`,
+        { error: primary },
+        [
+          {
+            label: `acquisition`,
+            run: () => {
+              releases.push(`acquisition`)
+              throw firstCleanup
+            },
+          },
+          {
+            label: `live query`,
+            run: () => {
+              releases.push(`live query`)
+              throw secondCleanup
+            },
+          },
+          {
+            label: `source collection`,
+            run: () => {
+              releases.push(`source collection`)
+            },
+          },
+        ],
+      )
+    } catch (error) {
+      failure = error
+    }
+
+    expect(failure).toBeInstanceOf(AggregateError)
+    const aggregate = failure as AggregateError
+    expect(aggregate.message).toContain(
+      `applied load reaches live-query readiness`,
+    )
+    expect(aggregate.cause).toBe(primary)
+    expect(primary.checkpoint).toBe(3)
+    expect(aggregate.errors).toHaveLength(2)
+    expect(aggregate.errors[0]).toMatchObject({
+      message: `acquisition cleanup failed`,
+      cause: firstCleanup,
+    })
+    expect(aggregate.errors[1]).toMatchObject({
+      message: `live query cleanup failed`,
+      cause: secondCleanup,
+    })
+    expect(releases).toEqual([`acquisition`, `live query`, `source collection`])
+  })
+
+  it(`applies loaded rows when no mutation is persisting`, async () => {
+    await expectPersistingLoadIsApplied(false)
+  })
+
+  it(`applies loaded rows before resolving readiness behind a persisting mutation`, async () => {
+    await expectPersistingLoadIsApplied(true)
+  })
+
+  it(`applies asynchronously delivered rows before resolving readiness`, async () => {
+    await expectPersistingLoadIsApplied(true, `asynchronous`)
+  })
+
+  it(`applies a transaction opened before its subset demand`, async () => {
+    await expectPersistingLoadIsApplied(true, `synchronous`, `before-load`)
+  })
+
+  it.each([
+    [`free`, `synchronous`],
+    [`free`, `asynchronous`],
+    [`parked`, `synchronous`],
+    [`parked`, `asynchronous`],
+  ] as const)(
+    `preserves applied-receipt timing with a %s gate and %s delivery`,
+    expectAppliedReceiptTiming,
+  )
+
+  it(`does not flush earlier parked sync work to apply a subset load`, async () => {
+    await expectAppliedLoadDoesNotFlushEarlierParkedSync()
+  })
+
+  it(`fulfills a subset load only after its rows apply`, async () => {
+    await expectCompletionWaitsForAppliedRows()
+  })
+
+  it(`keeps an unrelated stream commit parked during a subset acquisition`, async () => {
+    await expectConcurrentStreamCommitStaysParked()
+  })
+
+  it(`rejects the controlled subset transport when its applied receipt is canceled`, async () => {
+    await expectConcurrentStreamCommitStaysParked(true)
+  })
+
+  it.each([`before-commit`, `while-parked`] as const)(
+    `rejects an aborted demand and keeps its accepted rows when aborted %s`,
+    expectAbortedReceiptDoesNotSettleDemand,
+  )
+
+  it(`ignores an abort raised after application starts publishing`, async () => {
+    await expectAbortDuringPublicationDoesNotCancelReceipt()
+  })
+
+  it(`releases only a canceled receipt's event suppression`, async () => {
+    await expectCanceledReceiptReleasesOnlyItsSuppression()
+  })
+
+  it(`rejects an abandoned demand once`, async () => {
+    await expectCleanupRejectsDemandOnce()
+  })
+
+  it(`publishes synced source rows while a derived mutation persists`, async () => {
+    await expectAssertionFailure(expectDerivedSyncDuringOptimisticMutation, {
+      checkpoint: 0,
+      classify: ({ actual, expected }) =>
+        Array.isArray(actual) &&
+        actual.join(`,`) === `optimistic` &&
+        Array.isArray(expected) &&
+        expected.join(`,`) === `optimistic,synced`,
+    })()
+  })
+})
diff --git a/packages/db/tests/query/mixed-index-order-oracle.test.ts b/packages/db/tests/query/mixed-index-order-oracle.test.ts
index 6d3ba8489e..d188a56dc0 100644
--- a/packages/db/tests/query/mixed-index-order-oracle.test.ts
+++ b/packages/db/tests/query/mixed-index-order-oracle.test.ts
@@ -30,6 +30,7 @@ import { BasicIndex } from '../../src/indexes/basic-index.js'
 import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import { createLiveQueryCollection } from '../../src/query/live-query-collection.js'
 import { PropRef } from '../../src/query/ir.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
 import { mockSyncCollectionOptions, withOracleCleanup } from '../utils.js'
 import type { Collection } from '../../src/collection/index.js'
@@ -159,100 +160,105 @@ function applyStep(
   source.utils.commit()
 }
 
+async function expectIndexedPublicOrder(
+  scenario: Scenario,
+  IndexType: typeof BasicIndex | typeof BTreeIndex,
+  direction: `asc` | `desc`,
+): Promise<void> {
+  const scanOptions = mockSyncCollectionOptions<Row>({
+    id: `mixed-order-scan-${scenario.name}-${IndexType.name}`,
+    getKey: (row) => row.id,
+    initialData: scenario.initial,
+    autoIndex: `off`,
+  })
+  const indexedOptions = mockSyncCollectionOptions<Row>({
+    id: `mixed-order-indexed-${scenario.name}-${IndexType.name}`,
+    getKey: (row) => row.id,
+    initialData: scenario.initial,
+    autoIndex: `eager`,
+    defaultIndexType: IndexType,
+  })
+  const scan = createCollection(scanOptions)
+  const indexed = createCollection(indexedOptions)
+  const scanRows = new Map(scenario.initial.map((row) => [row.id, row]))
+  const indexedRows = new Map(scanRows)
+  let scanLive: ReturnType<typeof createLiveQueryCollection> | undefined
+  let indexedLive: ReturnType<typeof createLiveQueryCollection> | undefined
+  await withOracleCleanup(async () => {
+    await Promise.all([scan.stateWhenReady(), indexed.stateWhenReady()])
+    // Keep one ascending physical index so descending reads must use
+    // ReverseIndex rather than auto-creating a descending index.
+    indexed.createIndex((row) => row.value, { indexType: IndexType })
+    const check = (checkpoint: string, expectIndexRead: boolean) => {
+      const expected = orderedSnapshot(scan, direction)
+      const indexes = [...indexed.indexes.values()]
+      expect(indexes, `${checkpoint}: index exists`).toHaveLength(1)
+      const index = indexes[0] as BaseIndex<string>
+      expect(index, `${checkpoint}: index type`).toBeInstanceOf(IndexType)
+      expect(index.matchesDirection(`asc`)).toBe(true)
+      const take = vi.spyOn(
+        index,
+        direction === `asc` ? `takeFromStart` : `takeReversedFromEnd`,
+      )
+      try {
+        expect(
+          orderedSnapshot(indexed, direction),
+          `${checkpoint}: direct prefix`,
+        ).toEqual(expected)
+        if (expectIndexRead)
+          expect(take, `${checkpoint}: indexed route`).toHaveBeenCalled()
+        else
+          expect(take, `${checkpoint}: full-scan route`).not.toHaveBeenCalled()
+      } finally {
+        take.mockRestore()
+      }
+      expect(
+        [...scanLive!.values()].map((row) => row.id),
+        `${checkpoint}: scan live prefix`,
+      ).toEqual(expected)
+      expect(
+        [...indexedLive!.values()].map((row) => row.id),
+        `${checkpoint}: indexed live prefix`,
+      ).toEqual(expected)
+    }
+    // Compile both live queries while the initial source domain is mixed.
+    scanLive = createLiveQueryCollection((q) =>
+      q
+        .from({ row: scan })
+        .orderBy(({ row }) => row.value, direction)
+        .limit(2),
+    )
+    indexedLive = createLiveQueryCollection((q) =>
+      q
+        .from({ row: indexed })
+        .orderBy(({ row }) => row.value, direction)
+        .limit(2),
+    )
+    await Promise.all([scanLive.preload(), indexedLive.preload()])
+    check(`initial domain`, scenario.indexedReads[0]!)
+    for (const [position, step] of scenario.steps.entries()) {
+      applyStep(scanOptions, scanRows, step)
+      applyStep(indexedOptions, indexedRows, step)
+      check(
+        `step ${position + 1}: ${step.type}`,
+        scenario.indexedReads[position + 1]!,
+      )
+    }
+  }, [
+    () => indexedLive?.cleanup(),
+    () => scanLive?.cleanup(),
+    () => indexed.cleanup(),
+    () => scan.cleanup(),
+  ])
+}
+
+declareOracle({ check: [expectIndexedPublicOrder] })
+
 for (const scenario of histories) {
   for (const IndexType of [BasicIndex, BTreeIndex]) {
     for (const direction of [`asc`, `desc`] as const) {
-      it(`${IndexType.name} preserves ${scenario.name} ${direction} public order across kind changes`, async () => {
-        const scanOptions = mockSyncCollectionOptions<Row>({
-          id: `mixed-order-scan-${scenario.name}-${IndexType.name}`,
-          getKey: (row) => row.id,
-          initialData: scenario.initial,
-          autoIndex: `off`,
-        })
-        const indexedOptions = mockSyncCollectionOptions<Row>({
-          id: `mixed-order-indexed-${scenario.name}-${IndexType.name}`,
-          getKey: (row) => row.id,
-          initialData: scenario.initial,
-          autoIndex: `eager`,
-          defaultIndexType: IndexType,
-        })
-        const scan = createCollection(scanOptions)
-        const indexed = createCollection(indexedOptions)
-        const scanRows = new Map(scenario.initial.map((row) => [row.id, row]))
-        const indexedRows = new Map(scanRows)
-        let scanLive: ReturnType<typeof createLiveQueryCollection> | undefined
-        let indexedLive:
-          ReturnType<typeof createLiveQueryCollection> | undefined
-        await withOracleCleanup(async () => {
-          await Promise.all([scan.stateWhenReady(), indexed.stateWhenReady()])
-          // Keep one ascending physical index so descending reads must use
-          // ReverseIndex rather than auto-creating a descending index.
-          indexed.createIndex((row) => row.value, { indexType: IndexType })
-          const check = (checkpoint: string, expectIndexRead: boolean) => {
-            const expected = orderedSnapshot(scan, direction)
-            const indexes = [...indexed.indexes.values()]
-            expect(indexes, `${checkpoint}: index exists`).toHaveLength(1)
-            const index = indexes[0] as BaseIndex<string>
-            expect(index, `${checkpoint}: index type`).toBeInstanceOf(IndexType)
-            expect(index.matchesDirection(`asc`)).toBe(true)
-            const take = vi.spyOn(
-              index,
-              direction === `asc` ? `takeFromStart` : `takeReversedFromEnd`,
-            )
-            try {
-              expect(
-                orderedSnapshot(indexed, direction),
-                `${checkpoint}: direct prefix`,
-              ).toEqual(expected)
-              if (expectIndexRead)
-                expect(take, `${checkpoint}: indexed route`).toHaveBeenCalled()
-              else
-                expect(
-                  take,
-                  `${checkpoint}: full-scan route`,
-                ).not.toHaveBeenCalled()
-            } finally {
-              take.mockRestore()
-            }
-            expect(
-              [...scanLive!.values()].map((row) => row.id),
-              `${checkpoint}: scan live prefix`,
-            ).toEqual(expected)
-            expect(
-              [...indexedLive!.values()].map((row) => row.id),
-              `${checkpoint}: indexed live prefix`,
-            ).toEqual(expected)
-          }
-          // Compile both live queries while the initial source domain is mixed.
-          scanLive = createLiveQueryCollection((q) =>
-            q
-              .from({ row: scan })
-              .orderBy(({ row }) => row.value, direction)
-              .limit(2),
-          )
-          indexedLive = createLiveQueryCollection((q) =>
-            q
-              .from({ row: indexed })
-              .orderBy(({ row }) => row.value, direction)
-              .limit(2),
-          )
-          await Promise.all([scanLive.preload(), indexedLive.preload()])
-          check(`initial domain`, scenario.indexedReads[0]!)
-          for (const [position, step] of scenario.steps.entries()) {
-            applyStep(scanOptions, scanRows, step)
-            applyStep(indexedOptions, indexedRows, step)
-            check(
-              `step ${position + 1}: ${step.type}`,
-              scenario.indexedReads[position + 1]!,
-            )
-          }
-        }, [
-          () => indexedLive?.cleanup(),
-          () => scanLive?.cleanup(),
-          () => indexed.cleanup(),
-          () => scan.cleanup(),
-        ])
-      })
+      it(`${IndexType.name} preserves ${scenario.name} ${direction} public order across kind changes`, () =>
+        expectIndexedPublicOrder(scenario, IndexType, direction))
     }
   }
 }
diff --git a/packages/db/tests/query/optimizer-semantics-oracle.test.ts b/packages/db/tests/query/optimizer-semantics-oracle.test.ts
index 1b66ea04fd..7ea0d35f2c 100644
--- a/packages/db/tests/query/optimizer-semantics-oracle.test.ts
+++ b/packages/db/tests/query/optimizer-semantics-oracle.test.ts
@@ -19,8 +19,11 @@
  * An inner join has a separate boundary: the global aggregate joins when its
  * computed total matches an anchor. A materialized aggregate Collection
  * supplies a second formulation for matching and nonmatching controls.
+ * The fixed matching and nonmatching scenarios are ordinary tests in
+ * optimizer-semantics.test.ts.
  * The nested matching cases also reject an all-empty QueryRef implementation.
  */
+
 import { describe, expect, test } from 'vitest'
 import { createLiveQueryCollection } from '../../src/query/index.js'
 import { createCollection } from '../../src/collection/index.js'
@@ -34,122 +37,23 @@ import {
   or,
   sum,
 } from '../../src/query/builder/functions.js'
-import {
-  CollectionRef,
-  Func,
-  PropRef,
-  QueryRef,
-  Value,
-  createResidualWhere,
-} from '../../src/query/ir.js'
+import { CollectionRef, Func, PropRef } from '../../src/query/ir.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { mockSyncCollectionOptions, stripVirtualProps } from '../utils.js'
-import type { CollectionImpl } from '../../src/collection/index.js'
-import type {
-  BasicExpression,
-  From,
-  QueryIR,
-  Where,
-} from '../../src/query/ir.js'
-
-type Row = { id: number; k: number; v: number }
-
-const rows: Array<Row> = [
-  { id: 1, k: 1, v: 10 },
-  { id: 2, k: 2, v: 20 },
-]
+import {
+  expectedTerms,
+  inertCollection,
+  members,
+  observedTerms,
+  predicate,
+  rows,
+  sourceTerms,
+  teams,
+} from './optimizer-semantics-support.js'
+import type { Member, Row, Team } from './optimizer-semantics-support.js'
+import type { QueryIR, Where } from '../../src/query/ir.js'
 
 describe('optimizer aggregate semantics', () => {
-  for (const scenario of [
-    {
-      name: `matching without outer filter`,
-      target: 30,
-      filter: `none`,
-      expected: [{ total: 30 }],
-    },
-    {
-      name: `matching with accepting outer filter`,
-      target: 30,
-      filter: `accept`,
-      expected: [{ total: 30 }],
-    },
-    {
-      name: `matching with rejecting outer filter`,
-      target: 30,
-      filter: `reject`,
-      expected: [],
-    },
-    {
-      name: `nonmatching without outer filter`,
-      target: 31,
-      filter: `none`,
-      expected: [],
-    },
-  ] as const) {
-    test(`inner join of a global aggregate ${scenario.name}`, () => {
-      const source = createCollection(
-        mockSyncCollectionOptions<Row>({
-          id: `optimizer-inner-source-${scenario.name}`,
-          getKey: (row) => row.id,
-          initialData: rows,
-        }),
-      )
-      const anchor = createCollection(
-        mockSyncCollectionOptions({
-          id: `optimizer-inner-anchor-${scenario.name}`,
-          getKey: (row: { id: number; target: number }) => row.id,
-          initialData: [{ id: 1, target: scenario.target }],
-        }),
-      )
-      const result = createLiveQueryCollection({
-        startSync: true,
-        query: (q) => {
-          const summary = q.from({ b: source }).select(({ b }) => ({
-            k: max(b.k),
-            total: sum(b.v),
-          }))
-          const joined = q
-            .from({ s: summary })
-            .innerJoin({ a: anchor }, ({ s, a }) => eq(s.total, a.target))
-          if (scenario.filter === `accept`) {
-            return joined
-              .where(({ s }) => eq(s.k, 2))
-              .select(({ s }) => ({ total: s.total }))
-          }
-          if (scenario.filter === `reject`) {
-            return joined
-              .where(({ s }) => eq(s.k, 1))
-              .select(({ s }) => ({ total: s.total }))
-          }
-          return joined.select(({ s }) => ({ total: s.total }))
-        },
-      })
-
-      // The first synchronous public snapshot must follow aggregate, join,
-      // then outer-filter semantics. This compares complete rows, not counts.
-      const actual = result.toArray.map(stripVirtualProps)
-      expect(actual).toEqual(scenario.expected)
-
-      if (scenario.filter === `none`) {
-        const aggregate = createLiveQueryCollection({
-          startSync: true,
-          query: (q) =>
-            q.from({ b: source }).select(({ b }) => ({ total: sum(b.v) })),
-        })
-        const materialized = createLiveQueryCollection({
-          startSync: true,
-          query: (q) =>
-            q
-              .from({ s: aggregate })
-              .innerJoin({ a: anchor }, ({ s, a }) => eq(s.total, a.target))
-              .select(({ s }) => ({ total: s.total })),
-        })
-        expect(materialized.toArray.map(stripVirtualProps)).toEqual(
-          scenario.expected,
-        )
-      }
-    })
-  }
-
   for (const shape of [
     `direct`,
     `wrapped`,
@@ -172,9 +76,7 @@ describe('optimizer aggregate semantics', () => {
         }),
       )
       const modelTotal = rows.reduce((total, row) => total + row.v, 0)
-      const expected = [
-        { total: shape === `caseWhenCondition` ? 1 : modelTotal },
-      ]
+      const expected = expectedAggregateTotals(shape, rows)
 
       const aggregate = createLiveQueryCollection({
         startSync: true,
@@ -256,11 +158,6 @@ describe('optimizer aggregate semantics', () => {
         initialData: [{ id: 1, target: 1 }],
       }),
     )
-    const total = (filter: (row: Row) => boolean) =>
-      rows.filter(filter).reduce((n, row) => n + row.v, 0)
-    const keys = [...new Set(rows.map((row) => row.k))].sort((a, b) =>
-      a < b ? -1 : 1,
-    )
     for (const grouped of [false, true]) {
       const query = createLiveQueryCollection({
         startSync: true,
@@ -283,11 +180,7 @@ describe('optimizer aggregate semantics', () => {
           .map(stripVirtualProps)
           .sort((a: any, b: any) => (a.k < b.k ? -1 : 1)),
         grouped ? `grouped` : `single group`,
-      ).toEqual(
-        grouped
-          ? keys.map((k) => ({ k, total: total((row) => row.k === k) }))
-          : [{ k: 1, total: total(() => true) }],
-      )
+      ).toEqual(expectedLiteralFieldRows(grouped, rows))
     }
   })
 
@@ -320,14 +213,9 @@ describe('optimizer aggregate semantics', () => {
           .select(({ s }) => ({ k: s.k, total: s.total }))
       },
     })
-    expect(grouped.toArray.map(stripVirtualProps)).toEqual([
-      {
-        k: 1,
-        total: rows
-          .filter((row) => row.k === 1)
-          .reduce((n, row) => n + row.v, 0),
-      },
-    ])
+    expect(grouped.toArray.map(stripVirtualProps)).toEqual(
+      expectedGroupKeyRows(rows),
+    )
   })
 })
 
@@ -350,7 +238,9 @@ describe('optimizer aggregate semantics', () => {
  * pushdown check preservation of regular predicates. Re-optimizing output
  * checks the later-pass boundary. The public driver includes matched and
  * unmatched rows, an OR predicate that accepts an unmatched row, and a
- * source-free false predicate that rejects every row.
+ * source-free false predicate that rejects every row. The fixed source-free,
+ * namespace, ordered-QueryRef, and later-pass witnesses are ordinary tests in
+ * optimizer-semantics.test.ts.
  *
  * The structural checkpoint is `optimizeQuery` return: each source and outer
  * predicate has its expected exact multiplicity and marker, and the extracted
@@ -359,111 +249,8 @@ describe('optimizer aggregate semantics', () => {
  * checks do not claim incremental histories, arbitrary functions, UNIONs, or
  * a maximum wall-clock runtime.
  */
-type ObservedTerm = { key: string; residual: boolean }
-
-function observedTerms(where: Array<Where> | undefined): Array<ObservedTerm> {
-  const terms: Array<ObservedTerm> = []
-  for (const clause of where ?? []) {
-    const residual = `expression` in clause && clause.residual === true
-    const expression = `expression` in clause ? clause.expression : clause
-    const visit = (current: BasicExpression): void => {
-      if (current instanceof Func && current.name === `and`) {
-        current.args.forEach(visit)
-        return
-      }
-      if (current instanceof Func && current.name === `or`) {
-        const keys = current.args.map((arg) => {
-          if (
-            !(arg instanceof Func) ||
-            arg.name !== `eq` ||
-            !(arg.args[0] instanceof PropRef) ||
-            !(arg.args[1] instanceof Value)
-          ) {
-            throw new Error(`Unexpected OR term in residual oracle`)
-          }
-          return `${arg.args[0].path.join(`.`)}=${JSON.stringify(arg.args[1].value)}`
-        })
-        terms.push({ key: `or(${keys.join(`,`)})`, residual })
-        return
-      }
-      if (
-        !(current instanceof Func) ||
-        ![`eq`, `gt`, `isUndefined`].includes(current.name) ||
-        !(current.args[0] instanceof PropRef)
-      ) {
-        throw new Error(`Unexpected optimizer predicate in residual oracle`)
-      }
-      const path = current.args[0].path.join(`.`)
-      const compared = current.args[1]
-      let key: string
-      if (current.name === `isUndefined`) {
-        key = `isUndefined(${path})`
-      } else if (compared instanceof Value) {
-        key =
-          current.name === `gt`
-            ? `gt(${path},${JSON.stringify(compared.value)})`
-            : `${path}=${JSON.stringify(compared.value)}`
-      } else if (current.name === `eq` && compared instanceof PropRef) {
-        key = `${path}=${compared.path.join(`.`)}`
-      } else {
-        throw new Error(`Unexpected compared value in residual oracle`)
-      }
-      terms.push({ key, residual })
-    }
-    visit(expression)
-  }
-  return terms.sort(
-    (a, b) =>
-      a.key.localeCompare(b.key) || Number(a.residual) - Number(b.residual),
-  )
-}
-
-function sourceTerms(source: From): Array<ObservedTerm> {
-  if (source.type === `collectionRef`) return []
-  if (source.type !== `queryRef`) {
-    throw new Error(`Unexpected optimizer source in residual oracle`)
-  }
-  return observedTerms(source.query.where)
-}
-
-function predicate(
-  alias: string,
-  field: string,
-  value: unknown,
-): Func<boolean> {
-  return new Func(`eq`, [new PropRef([alias, field]), new Value(value)])
-}
-
-function inertCollection(id: string): CollectionImpl {
-  // The optimizer uses Collection identity but does not read Collection methods.
-  return { id } as unknown as CollectionImpl
-}
-
-function expectedTerms(
-  keys: Array<string>,
-  residual: boolean,
-): Array<ObservedTerm> {
-  return keys
-    .map((key) => ({ key, residual }))
-    .sort((a, b) => a.key.localeCompare(b.key))
-}
 
 describe(`optimizer residual convergence`, () => {
-  test(`structural recorder distinguishes changed predicate values`, () => {
-    expect(observedTerms([predicate(`team`, `active`, true)])).not.toEqual(
-      observedTerms([predicate(`team`, `active`, false)]),
-    )
-    expect(
-      observedTerms([
-        new Func(`gt`, [new PropRef([`team`, `score`]), new Value(5)]),
-      ]),
-    ).not.toEqual(
-      observedTerms([
-        new Func(`gt`, [new PropRef([`team`, `score`]), new Value(6)]),
-      ]),
-    )
-  })
-
   const joins = [
     { type: `left`, teamPush: true, memberPush: false, residual: true },
     { type: `right`, teamPush: false, memberPush: true, residual: true },
@@ -512,11 +299,9 @@ describe(`optimizer residual convergence`, () => {
 
             const result = optimizeQuery(query)
             const optimized = result.optimizedQuery
+            const shape = expectedPushdownShape(join, teamKeys, memberKeys)
             expect([...result.sourceWhereClauses.keys()].sort()).toEqual(
-              [
-                ...(join.teamPush ? [`team`] : []),
-                ...(join.memberPush ? [`member`] : []),
-              ].sort(),
+              shape.sourceAliases,
             )
             for (const [alias, keys] of [
               [`team`, teamKeys],
@@ -531,25 +316,12 @@ describe(`optimizer residual convergence`, () => {
             }
             const laterPass = optimizeQuery(optimized).optimizedQuery
             for (const actual of [optimized, laterPass]) {
-              expect(sourceTerms(actual.from)).toEqual(
-                join.teamPush ? expectedTerms(teamKeys, false) : [],
-              )
+              expect(sourceTerms(actual.from)).toEqual(shape.teamSource)
               expect(sourceTerms(actual.join![0]!.from)).toEqual(
-                join.memberPush ? expectedTerms(memberKeys, false) : [],
-              )
-              expect(observedTerms(actual.where)).toEqual(
-                [
-                  ...(!join.teamPush || join.residual
-                    ? expectedTerms(teamKeys, join.teamPush)
-                    : []),
-                  ...(!join.memberPush || join.residual
-                    ? expectedTerms(memberKeys, join.memberPush)
-                    : []),
-                ].sort((a, b) => a.key.localeCompare(b.key)),
-              )
-              expect(actual.where).toHaveLength(
-                join.type === `inner` ? 0 : join.type === `full` ? 1 : 2,
+                shape.memberSource,
               )
+              expect(observedTerms(actual.where)).toEqual(shape.where)
+              expect(actual.where).toHaveLength(shape.whereLength)
             }
           })
         }
@@ -557,375 +329,6 @@ describe(`optimizer residual convergence`, () => {
     }
   }
 
-  test(`two active sources retain both residual predicates across passes`, () => {
-    const collection = inertCollection(`residual-multi-source`)
-    const query: QueryIR = {
-      from: new CollectionRef(collection, `team`),
-      join: [
-        {
-          type: `left`,
-          from: new CollectionRef(collection, `member`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`member`, `teamId`]),
-          ]),
-        },
-        {
-          type: `inner`,
-          from: new CollectionRef(collection, `tag`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`tag`, `teamId`]),
-          ]),
-        },
-      ],
-      where: [
-        predicate(`member`, `userId`, 100),
-        predicate(`team`, `active`, true),
-        predicate(`tag`, `region`, `west`),
-      ],
-    }
-    const optimized = optimizeQuery(query).optimizedQuery
-    for (const actual of [optimized, optimizeQuery(optimized).optimizedQuery]) {
-      expect(sourceTerms(actual.from)).toEqual(
-        expectedTerms([`team.active=true`], false),
-      )
-      expect(sourceTerms(actual.join![0]!.from)).toEqual([])
-      expect(sourceTerms(actual.join![1]!.from)).toEqual(
-        expectedTerms([`tag.region="west"`], false),
-      )
-      expect(observedTerms(actual.where)).toEqual([
-        { key: `member.userId=100`, residual: false },
-        { key: `tag.region="west"`, residual: true },
-        { key: `team.active=true`, residual: true },
-      ])
-    }
-  })
-
-  for (const joinType of [`left`, `right`] as const) {
-    test(`${joinType} keeps an OR clause residual and a cross-source clause regular`, () => {
-      const collection = inertCollection(`residual-clause-forms`)
-      const activeAlias = joinType === `left` ? `team` : `member`
-      const active = new Func(`or`, [
-        predicate(activeAlias, `active`, true),
-        predicate(activeAlias, `region`, `west`),
-      ])
-      const cross = new Func(`eq`, [
-        new PropRef([`team`, `id`]),
-        new PropRef([`member`, `teamId`]),
-      ])
-      const query: QueryIR = {
-        from: new CollectionRef(collection, `team`),
-        join: [
-          {
-            type: joinType,
-            from: new CollectionRef(collection, `member`),
-            on: new Func('eq', [
-              new PropRef([`team`, `id`]),
-              new PropRef([`member`, `teamId`]),
-            ]),
-          },
-        ],
-        where: [cross, active],
-      }
-      const optimized = optimizeQuery(query).optimizedQuery
-      const activeKey = `or(${activeAlias}.active=true,${activeAlias}.region="west")`
-      const activeSource =
-        joinType === `left` ? optimized.from : optimized.join![0]!.from
-      expect(sourceTerms(activeSource)).toEqual(
-        expectedTerms([activeKey], false),
-      )
-      expect(observedTerms(optimized.where)).toEqual(
-        [
-          { key: activeKey, residual: true },
-          { key: `team.id=member.teamId`, residual: false },
-        ].sort((a, b) => a.key.localeCompare(b.key)),
-      )
-    })
-  }
-
-  test(`non-equality pushdown retains its residual while nullable checks remain regular`, () => {
-    const collection = inertCollection(`residual-predicate-kinds`)
-    const query: QueryIR = {
-      from: new CollectionRef(collection, `team`),
-      join: [
-        {
-          type: `left`,
-          from: new CollectionRef(collection, `member`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`member`, `teamId`]),
-          ]),
-        },
-      ],
-      where: [
-        new Func(`gt`, [new PropRef([`team`, `score`]), new Value(5)]),
-        new Func(`isUndefined`, [new PropRef([`member`, `optional`])]),
-      ],
-    }
-
-    const optimized = optimizeQuery(query).optimizedQuery
-    for (const actual of [optimized, optimizeQuery(optimized).optimizedQuery]) {
-      expect(sourceTerms(actual.from)).toEqual(
-        expectedTerms([`gt(team.score,5)`], false),
-      )
-      expect(sourceTerms(actual.join![0]!.from)).toEqual([])
-      expect(observedTerms(actual.where)).toEqual([
-        { key: `gt(team.score,5)`, residual: true },
-        { key: `isUndefined(member.optional)`, residual: false },
-      ])
-    }
-  })
-
-  test(`a source-free false predicate survives optimization passes`, () => {
-    const collection = inertCollection(`residual-constant`)
-    const query: QueryIR = {
-      from: new CollectionRef(collection, `team`),
-      join: [
-        {
-          type: `left`,
-          from: new CollectionRef(collection, `member`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`member`, `teamId`]),
-          ]),
-        },
-      ],
-      where: [predicate(`team`, `active`, true), new Value(false)],
-    }
-
-    for (const actual of [
-      optimizeQuery(query).optimizedQuery,
-      optimizeQuery(optimizeQuery(query).optimizedQuery).optimizedQuery,
-    ]) {
-      expect(
-        actual.where?.some(
-          (clause) => clause instanceof Value && clause.value === false,
-        ),
-      ).toBe(true)
-    }
-  })
-
-  test(`a namespace predicate stays outside a nullable source`, () => {
-    const collection = inertCollection(`residual-namespace`)
-    const query: QueryIR = {
-      from: new CollectionRef(collection, `team`),
-      join: [
-        {
-          type: `left`,
-          from: new CollectionRef(collection, `member`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`member`, `teamId`]),
-          ]),
-        },
-      ],
-      where: [
-        predicate(`team`, `active`, true),
-        new Func(`isUndefined`, [new PropRef([`member`])]),
-      ],
-    }
-
-    const result = optimizeQuery(query)
-    expect([...result.sourceWhereClauses.keys()]).toEqual([`team`])
-    for (const actual of [
-      result.optimizedQuery,
-      optimizeQuery(result.optimizedQuery).optimizedQuery,
-    ]) {
-      expect(sourceTerms(actual.from)).toEqual(
-        expectedTerms([`team.active=true`], false),
-      )
-      expect(sourceTerms(actual.join![0]!.from)).toEqual([])
-      expect(observedTerms(actual.where)).toEqual([
-        { key: `isUndefined(member)`, residual: false },
-        { key: `team.active=true`, residual: true },
-      ])
-    }
-  })
-
-  for (const laterJoin of [`right`, `full`] as const) {
-    test(`a later ${laterJoin} join keeps earlier aliases nullable`, () => {
-      const collection = inertCollection(`residual-later-${laterJoin}`)
-      const query: QueryIR = {
-        from: new CollectionRef(collection, `team`),
-        join: [
-          {
-            type: `left`,
-            from: new CollectionRef(collection, `member`),
-            on: new Func('eq', [
-              new PropRef([`team`, `id`]),
-              new PropRef([`member`, `teamId`]),
-            ]),
-          },
-          {
-            type: laterJoin,
-            from: new CollectionRef(collection, `tag`),
-            on: new Func('eq', [
-              new PropRef([`team`, `id`]),
-              new PropRef([`tag`, `teamId`]),
-            ]),
-          },
-        ],
-        where: [
-          predicate(`team`, `active`, true),
-          predicate(`member`, `userId`, 100),
-          predicate(`tag`, `region`, `west`),
-        ],
-      }
-
-      const result = optimizeQuery(query)
-      expect([...result.sourceWhereClauses.keys()]).toEqual(
-        laterJoin === `right` ? [`tag`] : [],
-      )
-      for (const actual of [
-        result.optimizedQuery,
-        optimizeQuery(result.optimizedQuery).optimizedQuery,
-      ]) {
-        expect(sourceTerms(actual.from)).toEqual([])
-        expect(sourceTerms(actual.join![0]!.from)).toEqual([])
-        expect(sourceTerms(actual.join![1]!.from)).toEqual(
-          laterJoin === `right`
-            ? expectedTerms([`tag.region="west"`], false)
-            : [],
-        )
-        expect(observedTerms(actual.where)).toEqual([
-          { key: `member.userId=100`, residual: false },
-          { key: `tag.region="west"`, residual: laterJoin === `right` },
-          { key: `team.active=true`, residual: false },
-        ])
-      }
-    })
-  }
-
-  test(`an ordered QueryRef that declines pushdown keeps its outer predicate`, () => {
-    const collection = inertCollection(`residual-declined-queryref`)
-    const query: QueryIR = {
-      from: new QueryRef(
-        {
-          from: new CollectionRef(collection, `team`),
-          orderBy: [
-            {
-              expression: new PropRef([`team`, `id`]),
-              compareOptions: {
-                direction: `desc`,
-                nulls: `first`,
-                stringSort: `locale`,
-              },
-            },
-          ],
-          limit: 1,
-        },
-        `team`,
-      ),
-      join: [
-        {
-          type: `left`,
-          from: new CollectionRef(collection, `member`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`member`, `teamId`]),
-          ]),
-        },
-      ],
-      where: [
-        predicate(`team`, `active`, true),
-        predicate(`member`, `userId`, 100),
-      ],
-    }
-
-    const result = optimizeQuery(query)
-    expect(result.sourceWhereClauses.size).toBe(0)
-    for (const actual of [
-      result.optimizedQuery,
-      optimizeQuery(result.optimizedQuery).optimizedQuery,
-    ]) {
-      expect(sourceTerms(actual.from)).toEqual([])
-      expect(observedTerms(actual.where)).toEqual(
-        expectedTerms([`member.userId=100`, `team.active=true`], false),
-      )
-    }
-  })
-
-  test(`a later pass keeps existing residuals while pushing a new predicate`, () => {
-    const collection = inertCollection(`residual-later-pass`)
-    const prior = predicate(`team`, `region`, `west`)
-    const newlyPushable = predicate(`team`, `active`, true)
-    const nullable = predicate(`member`, `userId`, 100)
-    const query: QueryIR = {
-      from: new QueryRef(
-        { from: new CollectionRef(collection, `team`), where: [prior] },
-        `team`,
-      ),
-      join: [
-        {
-          type: `left`,
-          from: new CollectionRef(collection, `member`),
-          on: new Func('eq', [
-            new PropRef([`team`, `id`]),
-            new PropRef([`member`, `teamId`]),
-          ]),
-        },
-      ],
-      where: [createResidualWhere(prior), nullable, newlyPushable],
-    }
-    const optimized = optimizeQuery(query).optimizedQuery
-    for (const actual of [optimized, optimizeQuery(optimized).optimizedQuery]) {
-      expect(sourceTerms(actual.from)).toEqual(
-        expectedTerms([`team.active=true`, `team.region="west"`], false),
-      )
-      expect(observedTerms(actual.where)).toEqual([
-        { key: `member.userId=100`, residual: false },
-        { key: `team.active=true`, residual: true },
-        { key: `team.region="west"`, residual: true },
-      ])
-      expect(actual.where).toHaveLength(2)
-    }
-  })
-
-  type Team = { id: number; active: boolean }
-  type Member = { id: number; teamId: number; userId: number }
-  const teams: Array<Team> = [
-    { id: 1, active: true },
-    { id: 2, active: false },
-    { id: 3, active: true },
-  ]
-  const members: Array<Member> = [
-    { id: 10, teamId: 1, userId: 100 },
-    { id: 11, teamId: 1, userId: 200 },
-    { id: 12, teamId: 2, userId: 100 },
-    { id: 13, teamId: 4, userId: 100 },
-  ]
-
-  test(`a source-free false predicate publishes no joined rows`, () => {
-    const teamCollection = createCollection(
-      mockSyncCollectionOptions<Team>({
-        id: `optimizer-residual-constant-team`,
-        getKey: (row) => row.id,
-        initialData: teams,
-      }),
-    )
-    const memberCollection = createCollection(
-      mockSyncCollectionOptions<Member>({
-        id: `optimizer-residual-constant-member`,
-        getKey: (row) => row.id,
-        initialData: members,
-      }),
-    )
-    const result = createLiveQueryCollection({
-      startSync: true,
-      query: (q) =>
-        q
-          .from({ team: teamCollection })
-          .leftJoin({ member: memberCollection }, ({ team, member }) =>
-            eq(team.id, member.teamId),
-          )
-          .where(({ team }) => eq(team.active, true))
-          .where(() => new Value(false)),
-    })
-
-    expect(result.toArray).toEqual([])
-  })
-
   for (const joinType of [`left`, `right`] as const) {
     test(`${joinType} join publishes the independently joined rows`, () => {
       const teamCollection = createCollection(
@@ -943,31 +346,7 @@ describe(`optimizer residual convergence`, () => {
         }),
       )
 
-      // The model fully joins arrays, including the unmatched preserved side,
-      // then applies the WHERE rule to each joined occurrence.
-      const pairs: Array<{ team?: Team; member?: Member }> = []
-      for (const team of teams) {
-        const matching = members.filter((member) => member.teamId === team.id)
-        for (const member of matching) pairs.push({ team, member })
-        if (matching.length === 0 && joinType === `left`) pairs.push({ team })
-      }
-      if (joinType === `right`) {
-        for (const member of members) {
-          if (teams.every((team) => team.id !== member.teamId)) {
-            pairs.push({ member })
-          }
-        }
-      }
-      const expected = pairs
-        .filter(({ team, member }) =>
-          joinType === `left`
-            ? team?.active === true &&
-              (member === undefined || member.userId === 100)
-            : member?.userId === 100 &&
-              (team === undefined || team.active === true),
-        )
-        .map(({ team, member }) => [team?.id ?? null, member?.id ?? null])
-        .sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+      const expected = expectedPreservedJoinRows(joinType, teams, members)
 
       const result =
         joinType === `left`
@@ -1045,26 +424,7 @@ describe(`optimizer residual convergence`, () => {
       }),
     )
 
-    const expected = teams
-      .flatMap((team) => {
-        if (!team.active) return []
-        const matchingMembers = members.filter(
-          (member) => member.teamId === team.id,
-        )
-        const acceptedMembers = matchingMembers.length
-          ? matchingMembers.filter((member) => member.userId === 100)
-          : [undefined]
-        return tags
-          .filter((tag) => tag.teamId === team.id && tag.region === `west`)
-          .flatMap((tag) =>
-            acceptedMembers.map((member) => [
-              team.id,
-              member?.id ?? null,
-              tag.id,
-            ]),
-          )
-      })
-      .sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+    const expected = expectedChainRows(teams, members, tags)
 
     const result = createLiveQueryCollection({
       startSync: true,
@@ -1097,3 +457,153 @@ describe(`optimizer residual convergence`, () => {
     expect(actual).toEqual(expected)
   })
 })
+
+/**
+ * The aggregate law: a nested global aggregate publishes one total row, and an
+ * accepting outer predicate keeps it. The caseWhenCondition shape publishes the
+ * condition's value, 1, rather than the total.
+ */
+function expectedAggregateTotals(shape: string, sourceRows: Array<Row>) {
+  const modelTotal = sourceRows.reduce((total, row) => total + row.v, 0)
+  return [{ total: shape === `caseWhenCondition` ? 1 : modelTotal }]
+}
+
+/**
+ * The literal-field law: a literal select field has one value per group, so a
+ * predicate on it stays outside the aggregate. Ungrouped, the one row sums the
+ * whole source.
+ */
+function expectedLiteralFieldRows(grouped: boolean, sourceRows: Array<Row>) {
+  const total = (filter: (row: Row) => boolean) =>
+    sourceRows.filter(filter).reduce((n, row) => n + row.v, 0)
+  const keys = [...new Set(sourceRows.map((row) => row.k))].sort((a, b) =>
+    a < b ? -1 : 1,
+  )
+  return grouped
+    ? keys.map((k) => ({ k, total: total((row) => row.k === k) }))
+    : [{ k: 1, total: total(() => true) }]
+}
+
+/** The group-key law: filtering on the grouping key keeps that group's total. */
+function expectedGroupKeyRows(sourceRows: Array<Row>) {
+  return [
+    {
+      k: 1,
+      total: sourceRows
+        .filter((row) => row.k === 1)
+        .reduce((n, row) => n + row.v, 0),
+    },
+  ]
+}
+
+type JoinRole = {
+  readonly type: string
+  readonly teamPush: boolean
+  readonly memberPush: boolean
+  readonly residual: boolean
+}
+
+/**
+ * The pushdown law: a side's predicates enter its source only when that side
+ * is nonnullable. A residual copy stays in the outer WHERE where the join keeps
+ * it. The predicate multiset is the same before and after each pass.
+ */
+function expectedPushdownShape(
+  join: JoinRole,
+  teamKeys: Array<string>,
+  memberKeys: Array<string>,
+) {
+  return {
+    sourceAliases: [
+      ...(join.teamPush ? [`team`] : []),
+      ...(join.memberPush ? [`member`] : []),
+    ].sort(),
+    teamSource: join.teamPush ? expectedTerms(teamKeys, false) : [],
+    memberSource: join.memberPush ? expectedTerms(memberKeys, false) : [],
+    where: [
+      ...(!join.teamPush || join.residual
+        ? expectedTerms(teamKeys, join.teamPush)
+        : []),
+      ...(!join.memberPush || join.residual
+        ? expectedTerms(memberKeys, join.memberPush)
+        : []),
+    ].sort((a, b) => a.key.localeCompare(b.key)),
+    whereLength: join.type === `inner` ? 0 : join.type === `full` ? 1 : 2,
+  }
+}
+
+/**
+ * The preserved-join law: the model joins the arrays fully, including the
+ * unmatched preserved side, then applies the WHERE rule to each joined occurrence.
+ */
+function expectedPreservedJoinRows(
+  joinType: `left` | `right`,
+  teamRows: Array<Team>,
+  memberRows: Array<Member>,
+) {
+  const pairs: Array<{ team?: Team; member?: Member }> = []
+  for (const team of teamRows) {
+    const matching = memberRows.filter((member) => member.teamId === team.id)
+    for (const member of matching) pairs.push({ team, member })
+    if (matching.length === 0 && joinType === `left`) pairs.push({ team })
+  }
+  if (joinType === `right`) {
+    for (const member of memberRows) {
+      if (teamRows.every((team) => team.id !== member.teamId)) {
+        pairs.push({ member })
+      }
+    }
+  }
+  return pairs
+    .filter(({ team, member }) =>
+      joinType === `left`
+        ? team?.active === true &&
+          (member === undefined || member.userId === 100)
+        : member?.userId === 100 &&
+          (team === undefined || team.active === true),
+    )
+    .map(({ team, member }) => [team?.id ?? null, member?.id ?? null])
+    .sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+}
+
+/**
+ * The chain law: a left join of memberRows and an inner join of tags keep a team
+ * with no accepted member as one row with a null member.
+ */
+function expectedChainRows(
+  teamRows: Array<Team>,
+  memberRows: Array<Member>,
+  tags: Array<{ id: number; teamId: number; region: string }>,
+) {
+  return teamRows
+    .flatMap((team) => {
+      if (!team.active) return []
+      const matchingMembers = memberRows.filter(
+        (member) => member.teamId === team.id,
+      )
+      const acceptedMembers = matchingMembers.length
+        ? matchingMembers.filter((member) => member.userId === 100)
+        : [undefined]
+      return tags
+        .filter((tag) => tag.teamId === team.id && tag.region === `west`)
+        .flatMap((tag) =>
+          acceptedMembers.map((member) => [
+            team.id,
+            member?.id ?? null,
+            tag.id,
+          ]),
+        )
+    })
+    .sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+}
+
+declareOracle({
+  model: [
+    expectedAggregateTotals,
+    expectedLiteralFieldRows,
+    expectedGroupKeyRows,
+    expectedPushdownShape,
+    expectedPreservedJoinRows,
+    expectedChainRows,
+  ],
+})
diff --git a/packages/db/tests/query/optimizer-semantics-support.ts b/packages/db/tests/query/optimizer-semantics-support.ts
new file mode 100644
index 0000000000..d3c0fba662
--- /dev/null
+++ b/packages/db/tests/query/optimizer-semantics-support.ts
@@ -0,0 +1,118 @@
+// Shared fixtures and observation helpers for optimizer-semantics-oracle.test.ts
+// and optimizer-semantics.test.ts. The laws they serve are owned by
+// optimizer-semantics-oracle.test.ts.
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import type { CollectionImpl } from '../../src/collection/index.js'
+import type { BasicExpression, From, Where } from '../../src/query/ir.js'
+
+export type Row = { id: number; k: number; v: number }
+
+export const rows: Array<Row> = [
+  { id: 1, k: 1, v: 10 },
+  { id: 2, k: 2, v: 20 },
+]
+
+export type ObservedTerm = { key: string; residual: boolean }
+
+export function observedTerms(
+  where: Array<Where> | undefined,
+): Array<ObservedTerm> {
+  const terms: Array<ObservedTerm> = []
+  for (const clause of where ?? []) {
+    const residual = `expression` in clause && clause.residual === true
+    const expression = `expression` in clause ? clause.expression : clause
+    const visit = (current: BasicExpression): void => {
+      if (current instanceof Func && current.name === `and`) {
+        current.args.forEach(visit)
+        return
+      }
+      if (current instanceof Func && current.name === `or`) {
+        const keys = current.args.map((arg) => {
+          if (
+            !(arg instanceof Func) ||
+            arg.name !== `eq` ||
+            !(arg.args[0] instanceof PropRef) ||
+            !(arg.args[1] instanceof Value)
+          ) {
+            throw new Error(`Unexpected OR term in residual oracle`)
+          }
+          return `${arg.args[0].path.join(`.`)}=${JSON.stringify(arg.args[1].value)}`
+        })
+        terms.push({ key: `or(${keys.join(`,`)})`, residual })
+        return
+      }
+      if (
+        !(current instanceof Func) ||
+        ![`eq`, `gt`, `isUndefined`].includes(current.name) ||
+        !(current.args[0] instanceof PropRef)
+      ) {
+        throw new Error(`Unexpected optimizer predicate in residual oracle`)
+      }
+      const path = current.args[0].path.join(`.`)
+      const compared = current.args[1]
+      let key: string
+      if (current.name === `isUndefined`) {
+        key = `isUndefined(${path})`
+      } else if (compared instanceof Value) {
+        key =
+          current.name === `gt`
+            ? `gt(${path},${JSON.stringify(compared.value)})`
+            : `${path}=${JSON.stringify(compared.value)}`
+      } else if (current.name === `eq` && compared instanceof PropRef) {
+        key = `${path}=${compared.path.join(`.`)}`
+      } else {
+        throw new Error(`Unexpected compared value in residual oracle`)
+      }
+      terms.push({ key, residual })
+    }
+    visit(expression)
+  }
+  return terms.sort(
+    (a, b) =>
+      a.key.localeCompare(b.key) || Number(a.residual) - Number(b.residual),
+  )
+}
+
+export function sourceTerms(source: From): Array<ObservedTerm> {
+  if (source.type === `collectionRef`) return []
+  if (source.type !== `queryRef`) {
+    throw new Error(`Unexpected optimizer source in residual oracle`)
+  }
+  return observedTerms(source.query.where)
+}
+
+export function predicate(
+  alias: string,
+  field: string,
+  value: unknown,
+): Func<boolean> {
+  return new Func(`eq`, [new PropRef([alias, field]), new Value(value)])
+}
+
+export function inertCollection(id: string): CollectionImpl {
+  // The optimizer uses Collection identity but does not read Collection methods.
+  return { id } as unknown as CollectionImpl
+}
+
+export function expectedTerms(
+  keys: Array<string>,
+  residual: boolean,
+): Array<ObservedTerm> {
+  return keys
+    .map((key) => ({ key, residual }))
+    .sort((a, b) => a.key.localeCompare(b.key))
+}
+
+export type Team = { id: number; active: boolean }
+export type Member = { id: number; teamId: number; userId: number }
+export const teams: Array<Team> = [
+  { id: 1, active: true },
+  { id: 2, active: false },
+  { id: 3, active: true },
+]
+export const members: Array<Member> = [
+  { id: 10, teamId: 1, userId: 100 },
+  { id: 11, teamId: 1, userId: 200 },
+  { id: 12, teamId: 2, userId: 100 },
+  { id: 13, teamId: 4, userId: 100 },
+]
diff --git a/packages/db/tests/query/optimizer-semantics.test.ts b/packages/db/tests/query/optimizer-semantics.test.ts
new file mode 100644
index 0000000000..cd9ff3fa96
--- /dev/null
+++ b/packages/db/tests/query/optimizer-semantics.test.ts
@@ -0,0 +1,494 @@
+// Ordinary optimizer tests: fixed aggregate-join scenarios and residual
+// predicate witnesses with hand-written expectations. The aggregate, pushdown,
+// and join laws are owned by optimizer-semantics-oracle.test.ts.
+import { describe, expect, test } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createLiveQueryCollection } from '../../src/query/index.js'
+import { optimizeQuery } from '../../src/query/optimizer.js'
+import { eq, max, sum } from '../../src/query/builder/functions.js'
+import {
+  CollectionRef,
+  Func,
+  PropRef,
+  QueryRef,
+  Value,
+  createResidualWhere,
+} from '../../src/query/ir.js'
+import { mockSyncCollectionOptions, stripVirtualProps } from '../utils.js'
+import {
+  expectedTerms,
+  inertCollection,
+  members,
+  observedTerms,
+  predicate,
+  rows,
+  sourceTerms,
+  teams,
+} from './optimizer-semantics-support.js'
+import type { Member, Row, Team } from './optimizer-semantics-support.js'
+import type { QueryIR } from '../../src/query/ir.js'
+
+describe('optimizer aggregate semantics', () => {
+  for (const scenario of [
+    {
+      name: `matching without outer filter`,
+      target: 30,
+      filter: `none`,
+      expected: [{ total: 30 }],
+    },
+    {
+      name: `matching with accepting outer filter`,
+      target: 30,
+      filter: `accept`,
+      expected: [{ total: 30 }],
+    },
+    {
+      name: `matching with rejecting outer filter`,
+      target: 30,
+      filter: `reject`,
+      expected: [],
+    },
+    {
+      name: `nonmatching without outer filter`,
+      target: 31,
+      filter: `none`,
+      expected: [],
+    },
+  ] as const) {
+    test(`inner join of a global aggregate ${scenario.name}`, () => {
+      const source = createCollection(
+        mockSyncCollectionOptions<Row>({
+          id: `optimizer-inner-source-${scenario.name}`,
+          getKey: (row) => row.id,
+          initialData: rows,
+        }),
+      )
+      const anchor = createCollection(
+        mockSyncCollectionOptions({
+          id: `optimizer-inner-anchor-${scenario.name}`,
+          getKey: (row: { id: number; target: number }) => row.id,
+          initialData: [{ id: 1, target: scenario.target }],
+        }),
+      )
+      const result = createLiveQueryCollection({
+        startSync: true,
+        query: (q) => {
+          const summary = q.from({ b: source }).select(({ b }) => ({
+            k: max(b.k),
+            total: sum(b.v),
+          }))
+          const joined = q
+            .from({ s: summary })
+            .innerJoin({ a: anchor }, ({ s, a }) => eq(s.total, a.target))
+          if (scenario.filter === `accept`) {
+            return joined
+              .where(({ s }) => eq(s.k, 2))
+              .select(({ s }) => ({ total: s.total }))
+          }
+          if (scenario.filter === `reject`) {
+            return joined
+              .where(({ s }) => eq(s.k, 1))
+              .select(({ s }) => ({ total: s.total }))
+          }
+          return joined.select(({ s }) => ({ total: s.total }))
+        },
+      })
+
+      // The first synchronous public snapshot must follow aggregate, join,
+      // then outer-filter semantics. This compares complete rows, not counts.
+      const actual = result.toArray.map(stripVirtualProps)
+      expect(actual).toEqual(scenario.expected)
+
+      if (scenario.filter === `none`) {
+        const aggregate = createLiveQueryCollection({
+          startSync: true,
+          query: (q) =>
+            q.from({ b: source }).select(({ b }) => ({ total: sum(b.v) })),
+        })
+        const materialized = createLiveQueryCollection({
+          startSync: true,
+          query: (q) =>
+            q
+              .from({ s: aggregate })
+              .innerJoin({ a: anchor }, ({ s, a }) => eq(s.total, a.target))
+              .select(({ s }) => ({ total: s.total })),
+        })
+        expect(materialized.toArray.map(stripVirtualProps)).toEqual(
+          scenario.expected,
+        )
+      }
+    })
+  }
+})
+
+describe(`optimizer residual convergence`, () => {
+  test(`structural recorder distinguishes changed predicate values`, () => {
+    expect(observedTerms([predicate(`team`, `active`, true)])).not.toEqual(
+      observedTerms([predicate(`team`, `active`, false)]),
+    )
+    expect(
+      observedTerms([
+        new Func(`gt`, [new PropRef([`team`, `score`]), new Value(5)]),
+      ]),
+    ).not.toEqual(
+      observedTerms([
+        new Func(`gt`, [new PropRef([`team`, `score`]), new Value(6)]),
+      ]),
+    )
+  })
+
+  test(`two active sources retain both residual predicates across passes`, () => {
+    const collection = inertCollection(`residual-multi-source`)
+    const query: QueryIR = {
+      from: new CollectionRef(collection, `team`),
+      join: [
+        {
+          type: `left`,
+          from: new CollectionRef(collection, `member`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`member`, `teamId`]),
+          ]),
+        },
+        {
+          type: `inner`,
+          from: new CollectionRef(collection, `tag`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`tag`, `teamId`]),
+          ]),
+        },
+      ],
+      where: [
+        predicate(`member`, `userId`, 100),
+        predicate(`team`, `active`, true),
+        predicate(`tag`, `region`, `west`),
+      ],
+    }
+    const optimized = optimizeQuery(query).optimizedQuery
+    for (const actual of [optimized, optimizeQuery(optimized).optimizedQuery]) {
+      expect(sourceTerms(actual.from)).toEqual(
+        expectedTerms([`team.active=true`], false),
+      )
+      expect(sourceTerms(actual.join![0]!.from)).toEqual([])
+      expect(sourceTerms(actual.join![1]!.from)).toEqual(
+        expectedTerms([`tag.region="west"`], false),
+      )
+      expect(observedTerms(actual.where)).toEqual([
+        { key: `member.userId=100`, residual: false },
+        { key: `tag.region="west"`, residual: true },
+        { key: `team.active=true`, residual: true },
+      ])
+    }
+  })
+
+  for (const joinType of [`left`, `right`] as const) {
+    test(`${joinType} keeps an OR clause residual and a cross-source clause regular`, () => {
+      const collection = inertCollection(`residual-clause-forms`)
+      const activeAlias = joinType === `left` ? `team` : `member`
+      const active = new Func(`or`, [
+        predicate(activeAlias, `active`, true),
+        predicate(activeAlias, `region`, `west`),
+      ])
+      const cross = new Func(`eq`, [
+        new PropRef([`team`, `id`]),
+        new PropRef([`member`, `teamId`]),
+      ])
+      const query: QueryIR = {
+        from: new CollectionRef(collection, `team`),
+        join: [
+          {
+            type: joinType,
+            from: new CollectionRef(collection, `member`),
+            on: new Func('eq', [
+              new PropRef([`team`, `id`]),
+              new PropRef([`member`, `teamId`]),
+            ]),
+          },
+        ],
+        where: [cross, active],
+      }
+      const optimized = optimizeQuery(query).optimizedQuery
+      const activeKey = `or(${activeAlias}.active=true,${activeAlias}.region="west")`
+      const activeSource =
+        joinType === `left` ? optimized.from : optimized.join![0]!.from
+      expect(sourceTerms(activeSource)).toEqual(
+        expectedTerms([activeKey], false),
+      )
+      expect(observedTerms(optimized.where)).toEqual(
+        [
+          { key: activeKey, residual: true },
+          { key: `team.id=member.teamId`, residual: false },
+        ].sort((a, b) => a.key.localeCompare(b.key)),
+      )
+    })
+  }
+
+  test(`non-equality pushdown retains its residual while nullable checks remain regular`, () => {
+    const collection = inertCollection(`residual-predicate-kinds`)
+    const query: QueryIR = {
+      from: new CollectionRef(collection, `team`),
+      join: [
+        {
+          type: `left`,
+          from: new CollectionRef(collection, `member`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`member`, `teamId`]),
+          ]),
+        },
+      ],
+      where: [
+        new Func(`gt`, [new PropRef([`team`, `score`]), new Value(5)]),
+        new Func(`isUndefined`, [new PropRef([`member`, `optional`])]),
+      ],
+    }
+
+    const optimized = optimizeQuery(query).optimizedQuery
+    for (const actual of [optimized, optimizeQuery(optimized).optimizedQuery]) {
+      expect(sourceTerms(actual.from)).toEqual(
+        expectedTerms([`gt(team.score,5)`], false),
+      )
+      expect(sourceTerms(actual.join![0]!.from)).toEqual([])
+      expect(observedTerms(actual.where)).toEqual([
+        { key: `gt(team.score,5)`, residual: true },
+        { key: `isUndefined(member.optional)`, residual: false },
+      ])
+    }
+  })
+
+  test(`a source-free false predicate survives optimization passes`, () => {
+    const collection = inertCollection(`residual-constant`)
+    const query: QueryIR = {
+      from: new CollectionRef(collection, `team`),
+      join: [
+        {
+          type: `left`,
+          from: new CollectionRef(collection, `member`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`member`, `teamId`]),
+          ]),
+        },
+      ],
+      where: [predicate(`team`, `active`, true), new Value(false)],
+    }
+
+    for (const actual of [
+      optimizeQuery(query).optimizedQuery,
+      optimizeQuery(optimizeQuery(query).optimizedQuery).optimizedQuery,
+    ]) {
+      expect(
+        actual.where?.some(
+          (clause) => clause instanceof Value && clause.value === false,
+        ),
+      ).toBe(true)
+    }
+  })
+
+  test(`a namespace predicate stays outside a nullable source`, () => {
+    const collection = inertCollection(`residual-namespace`)
+    const query: QueryIR = {
+      from: new CollectionRef(collection, `team`),
+      join: [
+        {
+          type: `left`,
+          from: new CollectionRef(collection, `member`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`member`, `teamId`]),
+          ]),
+        },
+      ],
+      where: [
+        predicate(`team`, `active`, true),
+        new Func(`isUndefined`, [new PropRef([`member`])]),
+      ],
+    }
+
+    const result = optimizeQuery(query)
+    expect([...result.sourceWhereClauses.keys()]).toEqual([`team`])
+    for (const actual of [
+      result.optimizedQuery,
+      optimizeQuery(result.optimizedQuery).optimizedQuery,
+    ]) {
+      expect(sourceTerms(actual.from)).toEqual(
+        expectedTerms([`team.active=true`], false),
+      )
+      expect(sourceTerms(actual.join![0]!.from)).toEqual([])
+      expect(observedTerms(actual.where)).toEqual([
+        { key: `isUndefined(member)`, residual: false },
+        { key: `team.active=true`, residual: true },
+      ])
+    }
+  })
+
+  for (const laterJoin of [`right`, `full`] as const) {
+    test(`a later ${laterJoin} join keeps earlier aliases nullable`, () => {
+      const collection = inertCollection(`residual-later-${laterJoin}`)
+      const query: QueryIR = {
+        from: new CollectionRef(collection, `team`),
+        join: [
+          {
+            type: `left`,
+            from: new CollectionRef(collection, `member`),
+            on: new Func('eq', [
+              new PropRef([`team`, `id`]),
+              new PropRef([`member`, `teamId`]),
+            ]),
+          },
+          {
+            type: laterJoin,
+            from: new CollectionRef(collection, `tag`),
+            on: new Func('eq', [
+              new PropRef([`team`, `id`]),
+              new PropRef([`tag`, `teamId`]),
+            ]),
+          },
+        ],
+        where: [
+          predicate(`team`, `active`, true),
+          predicate(`member`, `userId`, 100),
+          predicate(`tag`, `region`, `west`),
+        ],
+      }
+
+      const result = optimizeQuery(query)
+      expect([...result.sourceWhereClauses.keys()]).toEqual(
+        laterJoin === `right` ? [`tag`] : [],
+      )
+      for (const actual of [
+        result.optimizedQuery,
+        optimizeQuery(result.optimizedQuery).optimizedQuery,
+      ]) {
+        expect(sourceTerms(actual.from)).toEqual([])
+        expect(sourceTerms(actual.join![0]!.from)).toEqual([])
+        expect(sourceTerms(actual.join![1]!.from)).toEqual(
+          laterJoin === `right`
+            ? expectedTerms([`tag.region="west"`], false)
+            : [],
+        )
+        expect(observedTerms(actual.where)).toEqual([
+          { key: `member.userId=100`, residual: false },
+          { key: `tag.region="west"`, residual: laterJoin === `right` },
+          { key: `team.active=true`, residual: false },
+        ])
+      }
+    })
+  }
+
+  test(`an ordered QueryRef that declines pushdown keeps its outer predicate`, () => {
+    const collection = inertCollection(`residual-declined-queryref`)
+    const query: QueryIR = {
+      from: new QueryRef(
+        {
+          from: new CollectionRef(collection, `team`),
+          orderBy: [
+            {
+              expression: new PropRef([`team`, `id`]),
+              compareOptions: {
+                direction: `desc`,
+                nulls: `first`,
+                stringSort: `locale`,
+              },
+            },
+          ],
+          limit: 1,
+        },
+        `team`,
+      ),
+      join: [
+        {
+          type: `left`,
+          from: new CollectionRef(collection, `member`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`member`, `teamId`]),
+          ]),
+        },
+      ],
+      where: [
+        predicate(`team`, `active`, true),
+        predicate(`member`, `userId`, 100),
+      ],
+    }
+
+    const result = optimizeQuery(query)
+    expect(result.sourceWhereClauses.size).toBe(0)
+    for (const actual of [
+      result.optimizedQuery,
+      optimizeQuery(result.optimizedQuery).optimizedQuery,
+    ]) {
+      expect(sourceTerms(actual.from)).toEqual([])
+      expect(observedTerms(actual.where)).toEqual(
+        expectedTerms([`member.userId=100`, `team.active=true`], false),
+      )
+    }
+  })
+
+  test(`a later pass keeps existing residuals while pushing a new predicate`, () => {
+    const collection = inertCollection(`residual-later-pass`)
+    const prior = predicate(`team`, `region`, `west`)
+    const newlyPushable = predicate(`team`, `active`, true)
+    const nullable = predicate(`member`, `userId`, 100)
+    const query: QueryIR = {
+      from: new QueryRef(
+        { from: new CollectionRef(collection, `team`), where: [prior] },
+        `team`,
+      ),
+      join: [
+        {
+          type: `left`,
+          from: new CollectionRef(collection, `member`),
+          on: new Func('eq', [
+            new PropRef([`team`, `id`]),
+            new PropRef([`member`, `teamId`]),
+          ]),
+        },
+      ],
+      where: [createResidualWhere(prior), nullable, newlyPushable],
+    }
+    const optimized = optimizeQuery(query).optimizedQuery
+    for (const actual of [optimized, optimizeQuery(optimized).optimizedQuery]) {
+      expect(sourceTerms(actual.from)).toEqual(
+        expectedTerms([`team.active=true`, `team.region="west"`], false),
+      )
+      expect(observedTerms(actual.where)).toEqual([
+        { key: `member.userId=100`, residual: false },
+        { key: `team.active=true`, residual: true },
+        { key: `team.region="west"`, residual: true },
+      ])
+      expect(actual.where).toHaveLength(2)
+    }
+  })
+
+  test(`a source-free false predicate publishes no joined rows`, () => {
+    const teamCollection = createCollection(
+      mockSyncCollectionOptions<Team>({
+        id: `optimizer-residual-constant-team`,
+        getKey: (row) => row.id,
+        initialData: teams,
+      }),
+    )
+    const memberCollection = createCollection(
+      mockSyncCollectionOptions<Member>({
+        id: `optimizer-residual-constant-member`,
+        getKey: (row) => row.id,
+        initialData: members,
+      }),
+    )
+    const result = createLiveQueryCollection({
+      startSync: true,
+      query: (q) =>
+        q
+          .from({ team: teamCollection })
+          .leftJoin({ member: memberCollection }, ({ team, member }) =>
+            eq(team.id, member.teamId),
+          )
+          .where(({ team }) => eq(team.active, true))
+          .where(() => new Value(false)),
+    })
+
+    expect(result.toArray).toEqual([])
+  })
+})
diff --git a/packages/db/tests/query/ordered-lifecycle-oracle.property.test.ts b/packages/db/tests/query/ordered-lifecycle-oracle.property.test.ts
index 1ffa8c8234..e9f1254b6c 100644
--- a/packages/db/tests/query/ordered-lifecycle-oracle.property.test.ts
+++ b/packages/db/tests/query/ordered-lifecycle-oracle.property.test.ts
@@ -17,7 +17,19 @@ import {
   oracleRandomParameters,
   readOracleRunConfig,
 } from '../oracle-config.js'
-import type { Collection } from '../../src/collection/index.js'
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  assertFullSourceRequest,
+  finishOracleCleanup,
+  fullSourceFeatures,
+  observeEagerFullSourceSettlement,
+  observeFullSourceSettlement,
+} from './ordered-lifecycle-support.js'
+import type {
+  CapturedOracleFailure,
+  InitialSettlementObservation,
+  InitialSettlementShape,
+} from './ordered-lifecycle-support.js'
 import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
 
 /**
@@ -101,7 +113,6 @@ type Row = {
 }
 type OrderTerm = { direction: `asc` | `desc`; nulls: `first` | `last` }
 type AcquisitionPath = `page` | `prefix` | `boundary` | `full-source`
-type InitialSettlementShape = `synchronous` | `promise`
 // The controlled providerResponse gate models a provider response, not the
 // loadSubset result. Both delivery schedules await establishing applied receipts
 // before acquisition fulfillment; only their order around this response differs.
@@ -118,35 +129,6 @@ type Scenario = {
   repair?: boolean
 }
 
-type CapturedOracleFailure = { error: unknown }
-
-async function finishOracleCleanup(
-  primaryFailure: CapturedOracleFailure | undefined,
-  cleanups: ReadonlyArray<() => unknown | Promise<unknown>>,
-  message: string,
-): Promise<void> {
-  const results = await Promise.allSettled(
-    cleanups.map((cleanup) => Promise.resolve().then(cleanup)),
-  )
-  const cleanupFailures = results.flatMap((result) =>
-    result.status === `rejected` ? [result.reason] : [],
-  )
-  if (!primaryFailure) {
-    if (cleanupFailures.length === 0) return
-    throw new AggregateError(cleanupFailures, message, {
-      cause: cleanupFailures[0],
-    })
-  }
-  if (cleanupFailures.length === 0) throw primaryFailure.error
-  throw new AggregateError(
-    [primaryFailure.error, ...cleanupFailures],
-    message,
-    {
-      cause: primaryFailure.error,
-    },
-  )
-}
-
 function compareNullable(
   left: unknown,
   right: unknown,
@@ -189,6 +171,32 @@ function expectedNullablePaletteIds(
   )
 }
 
+/**
+ * The nullable reference order, compareNullable over the nine-row palette with
+ * ties by ID, must list IDs in the order that expectedNullablePaletteIds states
+ * for these term directions and null placements. The palette is written as a
+ * table, so this comparison is the refinement check of the reference against it.
+ */
+function expectNullableOrderMatchesPalette(
+  primary: OrderTerm,
+  secondary: OrderTerm,
+): void {
+  const rows = Array.from({ length: 9 }, (_, index) => ({
+    id: index + 1,
+    primary: [null, -2, 2][Math.floor(index / 3)]!,
+    secondary: [null, 2, -2][index % 3]!,
+  }))
+  const actual = [...rows]
+    .sort(
+      (a, b) =>
+        compareNullable(a.primary, b.primary, primary) ||
+        compareNullable(a.secondary, b.secondary, secondary) ||
+        a.id - b.id,
+    )
+    .map(({ id }) => id)
+  expect(actual).toEqual(expectedNullablePaletteIds(primary, secondary))
+}
+
 const acquisitionPaths: ReadonlyArray<AcquisitionPath> = [
   `page`,
   `prefix`,
@@ -793,11 +801,6 @@ async function assertHistory(
   return result
 }
 
-type InitialSettlementObservation = {
-  rows: Array<number>
-  status: string
-}
-
 type InitialAcquisitionPath = `page` | `prefix`
 
 function expectedInitialSettlementObservation(
@@ -942,44 +945,6 @@ async function observeInitialSettlement(
   return observation!
 }
 
-describe(`oracle harness failure fidelity`, () => {
-  it(`preserves the primary mismatch and every cleanup diagnostic`, async () => {
-    const primary = new Error(`primary mismatch`)
-    const firstCleanup = new Error(`first cleanup failed`)
-    const secondCleanup = new Error(`second cleanup failed`)
-    const attempted: Array<string> = []
-    let observed: unknown
-
-    try {
-      await finishOracleCleanup(
-        { error: primary },
-        [
-          () => {
-            attempted.push(`first`)
-            throw firstCleanup
-          },
-          () => {
-            attempted.push(`second`)
-            throw secondCleanup
-          },
-        ],
-        `Hostile cleanup control`,
-      )
-    } catch (error) {
-      observed = error
-    }
-
-    expect(attempted).toEqual([`first`, `second`])
-    expect(observed).toBeInstanceOf(AggregateError)
-    expect((observed as AggregateError).cause).toBe(primary)
-    expect((observed as AggregateError).errors).toEqual([
-      primary,
-      firstCleanup,
-      secondCleanup,
-    ])
-  })
-})
-
 describe(`synchronous initial settlement refinement`, () => {
   const cells = ([`eager`, `off`] as const).flatMap((autoIndex) =>
     ([`synchronous`, `promise`] as const).map((settlement) => ({
@@ -988,6 +953,8 @@ describe(`synchronous initial settlement refinement`, () => {
     })),
   )
 
+  declareOracle({ grammar: [cells] })
+
   it(`enumerates every initial path and settlement cell exactly once`, () => {
     expect(cells).toHaveLength(4)
     expect(new Set(cells.map((cell) => JSON.stringify(cell))).size).toBe(4)
@@ -1013,137 +980,6 @@ describe(`synchronous initial settlement refinement`, () => {
     },
   )
 
-  // The synchronous cut covers the initial load. For a query that must read
-  // its whole source first (here a function filter), the initial load is its
-  // first full-source request. When the source answers with literal `true`,
-  // the query is ready with its rows at creation. Full-source work after that
-  // initial window and a full-source repair remain outside this guarantee.
-  it(`publishes an eager full-source ordered window at creation`, async () => {
-    const source = createCollection<{ id: number; rank: number }, number>({
-      id: `full-source-initial-${Math.random()}`,
-      getKey: (row) => row.id,
-      syncMode: `eager`,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          for (let id = 0; id < 5; id++) {
-            write({ type: `insert`, value: { id, rank: id } })
-          }
-          commit()
-          markReady()
-        },
-      },
-    })
-    source.createIndex((row) => row.rank, { indexType: BTreeIndex })
-    const query = createLiveQueryCollection({
-      startSync: true,
-      query: (q) =>
-        q
-          .from({ row: source })
-          .fn.where(({ row }) => row.rank >= 0)
-          .orderBy(({ row }) => row.rank, `desc`)
-          .limit(2),
-    })
-    try {
-      expect({
-        status: query.status,
-        rows: query.toArray.map((row) => row.id),
-      }).toEqual({ status: `ready`, rows: [4, 3] })
-    } finally {
-      await query.cleanup()
-      await source.cleanup()
-    }
-  })
-
-  // The initial full-source cut and #2055's joined-filter rule meet here. A
-  // function filter makes the plan read its whole source, so its synchronous
-  // initial load installs every source row. #2055's hazard needs a bounded read
-  // that left an eligible row out; after a full read the window can always
-  // reach the next eligible row, even when a distant row entered through a live
-  // update first. This pins that the synchronous initial load keeps that
-  // property through later changes.
-  it(`keeps the first eligible joined rows after a synchronous full-source load`, async () => {
-    type Row = { id: number; rank: number; label: string }
-    let source: Parameters<SyncConfig<Row, number>[`sync`]>[0] | undefined
-    const writeRow = (
-      message: { type: `update`; value: Row } | { type: `delete`; key: number },
-    ) => {
-      source!.begin()
-      source!.write(message)
-      source!.commit()
-    }
-    const rows = createCollection<Row, number>({
-      id: `full-source-joined-rows-${Math.random()}`,
-      getKey: (row) => row.id,
-      syncMode: `eager`,
-      startSync: true,
-      sync: {
-        sync: (params) => {
-          source = params
-          params.begin()
-          for (let id = 1; id <= 10; id++) {
-            params.write({
-              type: `insert`,
-              value: { id, rank: id, label: `a` },
-            })
-          }
-          params.commit()
-          params.markReady()
-        },
-      },
-    })
-    rows.createIndex((row) => row.rank, { indexType: BTreeIndex })
-    const markers = createCollection<{ id: number; rowId: number }, number>({
-      id: `full-source-joined-markers-${Math.random()}`,
-      getKey: (marker) => marker.id,
-      syncMode: `eager`,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          for (let id = 2; id <= 10; id += 2) {
-            write({ type: `insert`, value: { id, rowId: id } })
-          }
-          commit()
-          markReady()
-        },
-      },
-    })
-    const query = createLiveQueryCollection({
-      startSync: true,
-      query: (q) =>
-        q
-          .from({ row: rows })
-          .leftJoin({ marker: markers }, ({ row, marker }) =>
-            eq(row.id, marker.rowId),
-          )
-          .where(({ marker }) => not(isUndefined(marker.rowId)))
-          .fn.where(({ row }) => row.rank > 0)
-          .orderBy(({ row }) => row.rank)
-          .limit(1),
-    })
-    const ids = () => query.toArray.map((result) => result.row.id)
-    try {
-      expect({ status: query.status, ids: ids() }).toEqual({
-        status: `ready`,
-        ids: [2],
-      })
-      // A label-only update brings the distant row 10 into the graph.
-      writeRow({ type: `update`, value: { id: 10, rank: 10, label: `b` } })
-      await flushPromises()
-      expect(ids()).toEqual([2])
-      // Deleting the visible row must expose the next eligible row, 4.
-      writeRow({ type: `delete`, key: 2 })
-      await flushPromises()
-      expect(ids()).toEqual([4])
-    } finally {
-      await query.cleanup()
-      await markers.cleanup()
-      await rows.cleanup()
-    }
-  })
-
   it(`rejects the old Promise-wrapped observation at the synchronous checkpoint`, () => {
     expect(() =>
       assertInitialSettlementObservation(
@@ -1152,132 +988,6 @@ describe(`synchronous initial settlement refinement`, () => {
       ),
     ).toThrow()
   })
-
-  it(`processes sibling source input before draining an ordered continuation`, async () => {
-    type LeftRow = { id: number; group: string; rank: number }
-    type RightRow = { id: number; group: string }
-
-    let rightSync!: Parameters<SyncConfig<RightRow, number>[`sync`]>[0]
-    const right = createCollection<RightRow, number>({
-      id: `ordered-initial-cross-source-right`,
-      getKey: ({ id }) => id,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          rightSync = operations
-          operations.markReady()
-        },
-      },
-    })
-
-    const requests: Array<LoadSubsetOptions> = []
-    let wroteSiblingInput = false
-    const left = createCollection<LeftRow, number>({
-      id: `ordered-initial-cross-source-left`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          markReady()
-          return {
-            loadSubset: (options) => {
-              requests.push(options)
-              if (requests.length === 1) {
-                begin()
-                write({
-                  type: `insert`,
-                  value: { id: 1, group: `shared`, rank: 1 },
-                })
-                expect(commit()).toBe(true)
-              } else if (!wroteSiblingInput) {
-                wroteSiblingInput = true
-                rightSync.begin()
-                rightSync.write({
-                  type: `insert`,
-                  value: { id: 10, group: `shared` },
-                })
-                rightSync.write({
-                  type: `insert`,
-                  value: { id: 11, group: `shared` },
-                })
-                expect(rightSync.commit()).toBe(true)
-              }
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-
-    const live = createLiveQueryCollection({
-      id: `ordered-initial-cross-source-live`,
-      startSync: false,
-      query: (q) =>
-        q
-          .from({ left })
-          .leftJoin({ right }, ({ left: leftRow, right: rightRow }) =>
-            eq(leftRow.group, rightRow.group),
-          )
-          .orderBy(({ left: leftRow }) => leftRow.rank)
-          .limit(2)
-          .select(({ left: leftRow, right: rightRow }) => ({
-            id: leftRow.id,
-            rightId: rightRow.id,
-          })),
-    })
-    const readyRows: Array<Array<number | undefined>> = []
-    const unsubscribeStatus = live.on(`status:ready`, () => {
-      readyRows.push(live.toArray.map(({ rightId }) => rightId))
-    })
-
-    try {
-      const preload = live.preload()
-      const immediate = {
-        rows: live.toArray.map(({ rightId }) => rightId),
-        status: live.status,
-      }
-      await preload
-
-      expect(wroteSiblingInput).toBe(true)
-      expect(
-        requests.map(({ orderBy, limit, offset, where, cursor }) => ({
-          orderTerms: orderBy?.length ?? 0,
-          limit,
-          offset,
-          hasWhere: where !== undefined,
-          hasCursor: cursor !== undefined,
-        })),
-      ).toEqual([
-        {
-          orderTerms: 1,
-          limit: 2,
-          offset: 0,
-          hasWhere: false,
-          hasCursor: false,
-        },
-        {
-          orderTerms: 0,
-          limit: undefined,
-          offset: undefined,
-          hasWhere: true,
-          hasCursor: false,
-        },
-      ])
-      expect(readyRows).toEqual([[10, 11]])
-      expect(immediate).toEqual({ rows: [10, 11], status: `ready` })
-      expect({
-        rows: live.toArray.map(({ rightId }) => rightId),
-        status: live.status,
-      }).toEqual({ rows: [10, 11], status: `ready` })
-    } finally {
-      unsubscribeStatus()
-      await Promise.all([live.cleanup(), left.cleanup(), right.cleanup()])
-    }
-  })
 })
 
 describe(`ordered lifecycle product`, () => {
@@ -1301,6 +1011,8 @@ describe(`ordered lifecycle product`, () => {
         ),
     ),
   )
+  declareOracle({ grammar: [cells] })
+
   it(`keeps all 192 declared histories distinct`, () => {
     expect(cells).toHaveLength(192)
     expect(new Set(cells.map((cell) => JSON.stringify(cell))).size).toBe(192)
@@ -1313,7 +1025,7 @@ describe(`ordered lifecycle product`, () => {
     },
   )
   it(`reaches all 192 histories through physical work and terminal cleanup`, () => {
-    expect(observed.size).toBe(192)
+    expect(observed.size).toBe(cells.length)
   })
   const arbitrary = fc.record({
     acquisitionPath: fc.constantFrom(...acquisitionPaths),
@@ -1560,6 +1272,8 @@ describe(`initial locale-string fallback oracle`, () => {
     ),
   )
 
+  declareOracle({ grammar: [cells] })
+
   it(`enumerates every index, settlement, and row-order cell exactly once`, () => {
     expect(cells).toHaveLength(8)
     expect(new Set(cells.map((cell) => JSON.stringify(cell))).size).toBe(8)
@@ -2534,258 +2248,8 @@ describe(`post-publication null fallback oracle`, () => {
   )
 })
 
-describe(`warm ordered readiness oracle`, () => {
-  // The four remote rows have the ascending order [3, 4, 1, 2], with null
-  // last. When preload starts the live-query sync run, a warm literal-true
-  // response to each acquisition owes that complete window and `ready` before
-  // the call returns. A constructor-started sync run resumes deferred
-  // on-demand acquisition asynchronously, so it owes the same window after
-  // settlement. The zero-limit neighbor needs no acquisition.
-  it.each([
-    { limit: 0, startsAtConstruction: false, expectedRequests: [] },
-    {
-      limit: 50,
-      startsAtConstruction: false,
-      expectedRequests: [
-        { ordered: true, filtered: false, limit: 50 },
-        { ordered: false, filtered: false, limit: undefined },
-      ],
-    },
-    {
-      limit: 50,
-      startsAtConstruction: true,
-      expectedRequests: [
-        { ordered: true, filtered: false, limit: 50 },
-        { ordered: false, filtered: false, limit: undefined },
-      ],
-    },
-  ])(
-    `settles a retained $limit-row window after an async cold prime (constructor start: $startsAtConstruction)`,
-    async ({ limit, startsAtConstruction, expectedRequests }) => {
-      type DatedRow = { id: number; createdAt: Date | null }
-      const remote: Array<DatedRow> = [
-        { id: 1, createdAt: new Date(`2026-01-03T00:00:00.000Z`) },
-        { id: 2, createdAt: null },
-        { id: 3, createdAt: new Date(`2026-01-01T00:00:00.000Z`) },
-        { id: 4, createdAt: new Date(`2026-01-02T00:00:00.000Z`) },
-      ]
-      const installed = new Set<number>()
-      const warmRequests: Array<{
-        ordered: boolean
-        filtered: boolean
-        limit: number | undefined
-      }> = []
-      let cold = true
-      const source = createCollection<DatedRow, number>({
-        id: `warm-ordered-readiness-${limit}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            markReady()
-            return {
-              loadSubset: (options) => {
-                if (!cold) {
-                  warmRequests.push({
-                    ordered: options.orderBy !== undefined,
-                    filtered: options.where !== undefined,
-                    limit: options.limit,
-                  })
-                }
-                const missing = remote.filter(({ id }) => !installed.has(id))
-                if (missing.length > 0) {
-                  begin()
-                  for (const row of missing) {
-                    installed.add(row.id)
-                    write({ type: `insert`, value: row })
-                  }
-                  commit()
-                }
-                return cold ? Promise.resolve() : true
-              },
-            }
-          },
-        },
-      })
-      const query = (queryLimit: number, startSync = true) =>
-        createLiveQueryCollection({
-          query: (q) =>
-            q
-              .from({ row: source })
-              .orderBy(({ row }) => row.createdAt, {
-                direction: `asc`,
-                nulls: `last`,
-              })
-              .limit(queryLimit),
-          startSync,
-        })
-      const coldQuery = query(50)
-      let warmQuery: ReturnType<typeof query> | undefined
-      let observation:
-        | {
-            requestsAtCut: Array<{
-              ordered: boolean
-              filtered: boolean
-              limit: number | undefined
-            }>
-            requestsAfterSettlement: Array<{
-              ordered: boolean
-              filtered: boolean
-              limit: number | undefined
-            }>
-            immediate: InitialSettlementObservation
-            settled: InitialSettlementObservation
-            isLoadingSubset: boolean
-          }
-        | undefined
-      let primaryFailure: CapturedOracleFailure | undefined
-      try {
-        await coldQuery.preload()
-        cold = false
-        warmQuery = query(limit, startsAtConstruction)
-        // Preload starts a new sync run when startSync is false. When the
-        // constructor started it, preload resumes deferred on-demand work
-        // through the asynchronous subscription restart path. Both receive
-        // the same warm rows, but only the first owes the synchronous cut.
-        const requestsBeforePreload = [...warmRequests]
-        const preload = warmQuery.preload()
-        const requestsAtCut = [...warmRequests]
-        const immediate = {
-          status: warmQuery.status,
-          rows: warmQuery.toArray.map(({ id }) => id),
-        }
-        await preload
-        observation = {
-          requestsAtCut,
-          requestsAfterSettlement: [...warmRequests],
-          immediate,
-          settled: {
-            status: warmQuery.status,
-            rows: warmQuery.toArray.map(({ id }) => id),
-          },
-          isLoadingSubset: warmQuery.isLoadingSubset,
-        }
-        expect(requestsBeforePreload).toEqual([])
-      } catch (error) {
-        primaryFailure = { error }
-      }
-      await finishOracleCleanup(
-        primaryFailure,
-        [
-          () => warmQuery?.cleanup(),
-          () => coldQuery.cleanup(),
-          () => source.cleanup(),
-        ],
-        `Warm ordered readiness oracle cleanup failed`,
-      )
-      expect(observation!.requestsAtCut).toEqual(
-        startsAtConstruction ? expectedRequests.slice(0, 1) : expectedRequests,
-      )
-      expect(observation!.requestsAfterSettlement).toEqual(expectedRequests)
-      expect(observation!.immediate).toEqual({
-        status: startsAtConstruction ? `loading` : `ready`,
-        rows: startsAtConstruction || limit === 0 ? [] : [3, 4, 1, 2],
-      })
-      expect(observation!.settled).toEqual({
-        status: `ready`,
-        rows: limit === 0 ? [] : [3, 4, 1, 2],
-      })
-      expect(observation!.isLoadingSubset).toBe(false)
-    },
-  )
-
-  it(`makes a retained nonzero-offset prefix and boundary synchronously ready`, async () => {
-    type WarmRow = { id: number; rank: number; tie: number }
-    const remote: Array<WarmRow> = [
-      { id: 1, rank: 1, tie: 1 },
-      { id: 2, rank: 2, tie: 1 },
-      { id: 3, rank: 3, tie: 1 },
-      { id: 4, rank: 4, tie: 1 },
-    ]
-    const installed = new Set<number>()
-    const warmRequests: Array<{
-      ordered: boolean
-      filtered: boolean
-      limit: number | undefined
-    }> = []
-    let cold = true
-    const source = createCollection<WarmRow, number>({
-      id: `warm-offset-prefix-readiness`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          markReady()
-          return {
-            loadSubset: (options) => {
-              if (!cold) {
-                warmRequests.push({
-                  ordered: options.orderBy !== undefined,
-                  filtered: options.where !== undefined,
-                  limit: options.limit,
-                })
-              }
-              const missing = remote.filter(({ id }) => !installed.has(id))
-              if (missing.length > 0) {
-                begin()
-                for (const row of missing) {
-                  installed.add(row.id)
-                  write({ type: `insert`, value: row })
-                }
-                commit()
-              }
-              return cold ? Promise.resolve() : true
-            },
-          }
-        },
-      },
-    })
-    const query = () =>
-      createLiveQueryCollection({
-        query: (q) =>
-          q
-            .from({ row: source })
-            .orderBy(({ row }) => row.rank, `asc`)
-            .orderBy(({ row }) => row.tie, `asc`)
-            .offset(1)
-            .limit(2),
-      })
-    const owner = query()
-    try {
-      await owner.preload()
-      cold = false
-      const sibling = query()
-      try {
-        // Construction starts no provider work. The sibling's first preload
-        // starts its sync run, and both warm acquisitions return true, so it
-        // is ready before preload returns: the synchronous observation cut.
-        expect(warmRequests).toEqual([])
-        void sibling.preload()
-        expect(sibling.status).toBe(`ready`)
-        expect(sibling.toArray.map(({ id }) => id)).toEqual([2, 3])
-        expect(warmRequests).toEqual([
-          { ordered: true, filtered: false, limit: 3 },
-          { ordered: false, filtered: true, limit: undefined },
-        ])
-      } finally {
-        await sibling.cleanup()
-      }
-    } finally {
-      await owner.cleanup()
-      await source.cleanup()
-    }
-  })
-})
-
 describe(`nullable multi-term lifecycle product`, () => {
   it(`anchors the nullable reference and controlled provider to an independent order palette`, () => {
-    const rows = Array.from({ length: 9 }, (_, index) => ({
-      id: index + 1,
-      primary: [null, -2, 2][Math.floor(index / 3)]!,
-      secondary: [null, 2, -2][index % 3]!,
-    }))
     for (const primaryNulls of [`first`, `last`] as const)
       for (const primaryDirection of [`asc`, `desc`] as const)
         for (const secondaryNulls of [`first`, `last`] as const)
@@ -2798,17 +2262,7 @@ describe(`nullable multi-term lifecycle product`, () => {
               nulls: secondaryNulls,
               direction: secondaryDirection,
             }
-            const actual = [...rows]
-              .sort(
-                (a, b) =>
-                  compareNullable(a.primary, b.primary, primary) ||
-                  compareNullable(a.secondary, b.secondary, secondary) ||
-                  a.id - b.id,
-              )
-              .map(({ id }) => id)
-            expect(actual).toEqual(
-              expectedNullablePaletteIds(primary, secondary),
-            )
+            expectNullableOrderMatchesPalette(primary, secondary)
           }
   })
   const cells: Array<Scenario> = ([`first`, `last`] as const)
@@ -2854,6 +2308,8 @@ describe(`nullable multi-term lifecycle product`, () => {
         secondaryDirection,
       })),
   )
+  declareOracle({ grammar: [cells, directionCells] })
+
   it(`enumerates every nullable lifecycle and direction-overlay cell exactly once`, () => {
     expect(cells).toHaveLength(22)
     expect(new Set(cells.map((cell) => JSON.stringify(cell))).size).toBe(22)
@@ -2943,6 +2399,8 @@ describe(`nullable multi-term lifecycle product`, () => {
         },
       }),
     )
+  declareOracle({ grammar: [arbitrary] })
+
   it(`generates the nullable value and lifecycle dimensions`, () => {
     const sample = fc.sample(arbitrary, { seed: 93472, numRuns: 100 })
     expect(new Set(sample.map((scenario) => scenario.acquisitionPath))).toEqual(
@@ -3003,310 +2461,6 @@ describe(`nullable multi-term lifecycle product`, () => {
   )
 })
 
-/**
- * ## Initial full-source loads share the synchronous readiness cut
- *
- * A plan whose window cannot come from a provider prefix (an inner join, a
- * functional predicate, `distinct`, or a custom string comparator) loads its
- * ordered source with one filtered full-source request and orders locally.
- * That request is still the query's initial load. When it returns literal
- * `true` after its establishing receipts apply, the live query is ready with
- * its complete window before the initiating call returns, exactly as for the
- * ordinary ordered request above. A Promise result stays asynchronous.
- *
- * The model is the same two-valued reference as the ordinary cut: synchronous
- * settlement predicts ready with ids [1, 2] at the immediate checkpoint, and
- * Promise settlement predicts loading with no rows. The rows come from a
- * three-row source ordered by rank, so the expectation does not read the
- * production comparator. The driver also records the provider request, which
- * must be the predicate-only full-source shape, so a plan that silently took
- * the ordered path cannot pass.
- *
- * A fallback remains in the initial chain when its leading boundary cannot
- * be expressed as a cursor. The warm readiness oracle above checks a null
- * boundary after an ordered request. It observes the request trace and public
- * status immediately after preload starts the sync run, rather than before
- * acquisition. The locale-string cells check the same law for `findOne()`.
- * A Promise result for the fallback keeps the window unpublished at that cut.
- *
- * Replay is outside this cut. After the initial window settles, a truncate
- * replays the same full-source request. Even when its provider answers with
- * literal `true`, the prior window stays published at the call that started
- * the replay and the replacement publishes a task later. This neighbouring case
- * distinguishes a purpose-based gate (initial load versus later authoritative
- * work) from a kind-based one that would make every full-source request
- * synchronous. A requiresFullSource plan holds every source row locally, so an
- * ordinary visible delete recomputes its window without any repair request.
- */
-
-type FullSourceFeature =
-  `inner-join` | `fn-where` | `distinct` | `custom-collation`
-type FullSourceRow = { id: number; rank: number; label: string; tag: string }
-
-const fullSourceRows: ReadonlyArray<FullSourceRow> = [
-  { id: 1, rank: 1, label: `a`, tag: `x` },
-  { id: 2, rank: 2, label: `b`, tag: `x` },
-  { id: 3, rank: 3, label: `c`, tag: `x` },
-]
-const fullSourceFeatures: ReadonlyArray<FullSourceFeature> = [
-  `inner-join`,
-  `fn-where`,
-  `distinct`,
-  `custom-collation`,
-]
-const labelRank = new Map([
-  [`a`, 1],
-  [`b`, 2],
-  [`c`, 3],
-])
-
-function createFullSourceQuery(
-  feature: FullSourceFeature,
-  source: Collection<FullSourceRow, number>,
-  tags: Collection<{ tag: string }, string>,
-) {
-  return createLiveQueryCollection({
-    startSync: false,
-    query: (q) => {
-      const base = q.from({ row: source })
-      switch (feature) {
-        case `inner-join`:
-          return base
-            .innerJoin({ tag: tags }, ({ row, tag }) => eq(row.tag, tag.tag))
-            .orderBy(({ row }) => row.rank)
-            .limit(2)
-            .select(({ row }) => ({ id: row.id }))
-        case `fn-where`:
-          return base.fn
-            .where(({ row }) => row.id > 0)
-            .orderBy(({ row }) => row.rank)
-            .limit(2)
-            .select(({ row }) => ({ id: row.id }))
-        case `distinct`:
-          return base
-            .orderBy(({ row }) => row.rank)
-            .limit(2)
-            .select(({ row }) => ({ id: row.id }))
-            .distinct()
-        case `custom-collation`:
-          return base
-            .orderBy(({ row }) => row.label, {
-              direction: `asc`,
-              stringSort: `custom`,
-              compare: (a, b) => labelRank.get(a)! - labelRank.get(b)!,
-            })
-            .limit(2)
-            .select(({ row }) => ({ id: row.id }))
-      }
-    },
-  })
-}
-
-function assertFullSourceRequest(request: LoadSubsetOptions | undefined): void {
-  if (
-    request === undefined ||
-    request.orderBy !== undefined ||
-    request.limit !== undefined ||
-    request.cursor !== undefined ||
-    request.offset !== undefined
-  ) {
-    throw new Error(
-      `Expected one predicate-only full-source request, received ${JSON.stringify(request)}`,
-    )
-  }
-}
-
-async function observeFullSourceSettlement(
-  feature: FullSourceFeature,
-  settlement: InitialSettlementShape,
-) {
-  const delivered = new Set<number>()
-  const requests: Array<LoadSubsetOptions> = []
-  let sync!: Parameters<SyncConfig<FullSourceRow, number>[`sync`]>[0]
-  const source = createCollection<FullSourceRow, number>({
-    id: `ordered-full-source-${feature}-${settlement}`,
-    getKey: ({ id }) => id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: (operations) => {
-        sync = operations
-        operations.markReady()
-        return {
-          loadSubset: (options) => {
-            requests.push(options)
-            const fresh = fullSourceRows.filter(({ id }) => !delivered.has(id))
-            if (fresh.length > 0) {
-              sync.begin()
-              for (const value of fresh) {
-                delivered.add(value.id)
-                sync.write({ type: `insert`, value })
-              }
-              expect(sync.commit()).toBe(true)
-            }
-            return settlement === `synchronous` ? true : Promise.resolve()
-          },
-        }
-      },
-    },
-  })
-  const tags = createCollection<{ tag: string }, string>({
-    id: `ordered-full-source-tags-${feature}-${settlement}`,
-    getKey: ({ tag }) => tag,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({ type: `insert`, value: { tag: `x` } })
-        commit()
-        markReady()
-      },
-    },
-  })
-  const live = createFullSourceQuery(feature, source, tags)
-  const subscription = live.subscribeChanges(() => {}, {
-    includeInitialState: false,
-  })
-  const observeCurrent = (): InitialSettlementObservation => ({
-    rows: live.toArray.map(({ id }) => id),
-    status: live.status,
-  })
-  let observation:
-    | {
-        immediate: InitialSettlementObservation
-        settled: InitialSettlementObservation
-        requests: Array<LoadSubsetOptions>
-      }
-    | undefined
-  let primaryFailure: CapturedOracleFailure | undefined
-  try {
-    const preload = live.preload()
-    const immediate = observeCurrent()
-    await preload
-    observation = { immediate, settled: observeCurrent(), requests }
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishOracleCleanup(
-    primaryFailure,
-    [
-      () => subscription.unsubscribe(),
-      () => live.cleanup(),
-      () => tags.cleanup(),
-      () => source.cleanup(),
-    ],
-    `Full-source settlement oracle cleanup failed`,
-  )
-  return observation!
-}
-
-async function observeFullSourceReplay(feature: FullSourceFeature) {
-  let served: ReadonlyArray<FullSourceRow> = fullSourceRows
-  let sync!: Parameters<SyncConfig<FullSourceRow, number>[`sync`]>[0]
-  const source = createCollection<FullSourceRow, number>({
-    id: `ordered-full-source-replay-${feature}`,
-    getKey: ({ id }) => id,
-    syncMode: `on-demand`,
-    sync: {
-      sync: (operations) => {
-        sync = operations
-        operations.markReady()
-        return {
-          loadSubset: () => {
-            const missing = served.filter(({ id }) => !source.has(id))
-            if (missing.length > 0) {
-              sync.begin()
-              for (const value of missing) sync.write({ type: `insert`, value })
-              expect(sync.commit()).toBe(true)
-            }
-            return true
-          },
-        }
-      },
-    },
-  })
-  const tags = createCollection<{ tag: string }, string>({
-    id: `ordered-full-source-replay-tags-${feature}`,
-    getKey: ({ tag }) => tag,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({ type: `insert`, value: { tag: `x` } })
-        commit()
-        markReady()
-      },
-    },
-  })
-  const live = createFullSourceQuery(feature, source, tags)
-  let primaryFailure: CapturedOracleFailure | undefined
-  let observation:
-    { immediate: Array<number>; settled: Array<number> } | undefined
-  try {
-    await live.preload()
-    // The source drops row 1 and replays its replacement through a truncate.
-    served = fullSourceRows.slice(1)
-    sync.begin()
-    sync.truncate()
-    sync.commit()
-    const immediate = live.toArray.map(({ id }) => id)
-    await flushPromises()
-    await new Promise((resolve) => setTimeout(resolve, 0))
-    observation = { immediate, settled: live.toArray.map(({ id }) => id) }
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishOracleCleanup(
-    primaryFailure,
-    [() => live.cleanup(), () => tags.cleanup(), () => source.cleanup()],
-    `Full-source replay oracle cleanup failed`,
-  )
-  return observation!
-}
-
-async function observeEagerFullSourceSettlement(feature: FullSourceFeature) {
-  const source = createCollection<FullSourceRow, number>({
-    id: `ordered-full-source-eager-${feature}`,
-    getKey: ({ id }) => id,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        for (const value of fullSourceRows) write({ type: `insert`, value })
-        commit()
-        markReady()
-      },
-    },
-  })
-  const tags = createCollection<{ tag: string }, string>({
-    id: `ordered-full-source-eager-tags-${feature}`,
-    getKey: ({ tag }) => tag,
-    sync: {
-      sync: ({ begin, write, commit, markReady }) => {
-        begin()
-        write({ type: `insert`, value: { tag: `x` } })
-        commit()
-        markReady()
-      },
-    },
-  })
-  const live = createFullSourceQuery(feature, source, tags)
-  let primaryFailure: CapturedOracleFailure | undefined
-  let immediate: InitialSettlementObservation | undefined
-  try {
-    const preload = live.preload()
-    immediate = {
-      rows: live.toArray.map(({ id }) => id),
-      status: live.status,
-    }
-    await preload
-  } catch (error) {
-    primaryFailure = { error }
-  }
-  await finishOracleCleanup(
-    primaryFailure,
-    [() => live.cleanup(), () => tags.cleanup(), () => source.cleanup()],
-    `Eager full-source settlement oracle cleanup failed`,
-  )
-  return immediate!
-}
-
 describe(`synchronous initial full-source settlement refinement`, () => {
   const cells = fullSourceFeatures.flatMap((feature) =>
     ([`synchronous`, `promise`] as const).map((settlement) => ({
@@ -3315,6 +2469,8 @@ describe(`synchronous initial full-source settlement refinement`, () => {
     })),
   )
 
+  declareOracle({ grammar: [cells] })
+
   it(`enumerates every full-source feature and settlement cell exactly once`, () => {
     expect(cells).toHaveLength(8)
     expect(new Set(cells.map((cell) => JSON.stringify(cell))).size).toBe(8)
@@ -3340,16 +2496,22 @@ describe(`synchronous initial full-source settlement refinement`, () => {
       )
     },
   )
+})
 
-  it.each(fullSourceFeatures)(
-    `keeps the %s full-source truncate replay behind its publication barrier`,
-    async (feature) => {
-      const observed = await observeFullSourceReplay(feature)
-      // Replay is excluded from the synchronous cut: the prior window stays
-      // published at the call that started the replay, even though the
-      // provider answers it with literal `true`.
-      expect(observed.immediate).toEqual([1, 2])
-      expect(observed.settled).toEqual([2, 3])
-    },
-  )
+// The refinement checks compare production observations with the models they
+// name. observeHistory compares each history with its finite reference inside
+// the driver. compareNullable is the nullable-order model; the palette table is
+// its authority, and expectNullableOrderMatchesPalette pins the model to it.
+declareOracle({
+  check: [
+    observeHistory,
+    assertInitialSettlementObservation,
+    assertLaterFallbackObservation,
+  ],
+  model: [
+    compareNullable,
+    expectedInitialSettlementObservation,
+    expectedInitialFallback,
+    expectedLaterFallbackWindow,
+  ],
 })
diff --git a/packages/db/tests/query/ordered-lifecycle-support.ts b/packages/db/tests/query/ordered-lifecycle-support.ts
new file mode 100644
index 0000000000..7d819643c1
--- /dev/null
+++ b/packages/db/tests/query/ordered-lifecycle-support.ts
@@ -0,0 +1,362 @@
+// Shared cleanup, initial-settlement, and full-source drivers for the ordered
+// lifecycle tests. The oracle file ordered-lifecycle-oracle.property.test.ts
+// owns the laws; these helpers only observe the controlled Collections and
+// Effects. Ordinary tests here state their expectations by hand.
+import { expect } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createLiveQueryCollection, eq } from '../../src/query/index.js'
+import { flushPromises } from '../utils.js'
+import type { Collection } from '../../src/collection/index.js'
+import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
+
+export type InitialSettlementShape = `synchronous` | `promise`
+
+export type CapturedOracleFailure = { error: unknown }
+
+export async function finishOracleCleanup(
+  primaryFailure: CapturedOracleFailure | undefined,
+  cleanups: ReadonlyArray<() => unknown | Promise<unknown>>,
+  message: string,
+): Promise<void> {
+  const results = await Promise.allSettled(
+    cleanups.map((cleanup) => Promise.resolve().then(cleanup)),
+  )
+  const cleanupFailures = results.flatMap((result) =>
+    result.status === `rejected` ? [result.reason] : [],
+  )
+  if (!primaryFailure) {
+    if (cleanupFailures.length === 0) return
+    throw new AggregateError(cleanupFailures, message, {
+      cause: cleanupFailures[0],
+    })
+  }
+  if (cleanupFailures.length === 0) throw primaryFailure.error
+  throw new AggregateError(
+    [primaryFailure.error, ...cleanupFailures],
+    message,
+    {
+      cause: primaryFailure.error,
+    },
+  )
+}
+
+export type InitialSettlementObservation = {
+  rows: Array<number>
+  status: string
+}
+
+/**
+ * ## Initial full-source loads share the synchronous readiness cut
+ *
+ * A plan whose window cannot come from a provider prefix (an inner join, a
+ * functional predicate, `distinct`, or a custom string comparator) loads its
+ * ordered source with one filtered full-source request and orders locally.
+ * That request is still the query's initial load. When it returns literal
+ * `true` after its establishing receipts apply, the live query is ready with
+ * its complete window before the initiating call returns, exactly as for the
+ * ordinary ordered request above. A Promise result stays asynchronous.
+ *
+ * The model is the same two-valued reference as the ordinary cut: synchronous
+ * settlement predicts ready with ids [1, 2] at the immediate checkpoint, and
+ * Promise settlement predicts loading with no rows. The rows come from a
+ * three-row source ordered by rank, so the expectation does not read the
+ * production comparator. The driver also records the provider request, which
+ * must be the predicate-only full-source shape, so a plan that silently took
+ * the ordered path cannot pass.
+ *
+ * A fallback remains in the initial chain when its leading boundary cannot
+ * be expressed as a cursor. The warm readiness oracle above checks a null
+ * boundary after an ordered request. It observes the request trace and public
+ * status immediately after preload starts the sync run, rather than before
+ * acquisition. The locale-string cells check the same law for `findOne()`.
+ * A Promise result for the fallback keeps the window unpublished at that cut.
+ *
+ * Replay is outside this cut. After the initial window settles, a truncate
+ * replays the same full-source request. Even when its provider answers with
+ * literal `true`, the prior window stays published at the call that started
+ * the replay and the replacement publishes a task later. This neighbouring case
+ * distinguishes a purpose-based gate (initial load versus later authoritative
+ * work) from a kind-based one that would make every full-source request
+ * synchronous. A requiresFullSource plan holds every source row locally, so an
+ * ordinary visible delete recomputes its window without any repair request.
+ */
+
+export type FullSourceFeature =
+  `inner-join` | `fn-where` | `distinct` | `custom-collation`
+
+export type FullSourceRow = {
+  id: number
+  rank: number
+  label: string
+  tag: string
+}
+
+const fullSourceRows: ReadonlyArray<FullSourceRow> = [
+  { id: 1, rank: 1, label: `a`, tag: `x` },
+  { id: 2, rank: 2, label: `b`, tag: `x` },
+  { id: 3, rank: 3, label: `c`, tag: `x` },
+]
+
+export const fullSourceFeatures: ReadonlyArray<FullSourceFeature> = [
+  `inner-join`,
+  `fn-where`,
+  `distinct`,
+  `custom-collation`,
+]
+
+const labelRank = new Map([
+  [`a`, 1],
+  [`b`, 2],
+  [`c`, 3],
+])
+
+function createFullSourceQuery(
+  feature: FullSourceFeature,
+  source: Collection<FullSourceRow, number>,
+  tags: Collection<{ tag: string }, string>,
+) {
+  return createLiveQueryCollection({
+    startSync: false,
+    query: (q) => {
+      const base = q.from({ row: source })
+      switch (feature) {
+        case `inner-join`:
+          return base
+            .innerJoin({ tag: tags }, ({ row, tag }) => eq(row.tag, tag.tag))
+            .orderBy(({ row }) => row.rank)
+            .limit(2)
+            .select(({ row }) => ({ id: row.id }))
+        case `fn-where`:
+          return base.fn
+            .where(({ row }) => row.id > 0)
+            .orderBy(({ row }) => row.rank)
+            .limit(2)
+            .select(({ row }) => ({ id: row.id }))
+        case `distinct`:
+          return base
+            .orderBy(({ row }) => row.rank)
+            .limit(2)
+            .select(({ row }) => ({ id: row.id }))
+            .distinct()
+        case `custom-collation`:
+          return base
+            .orderBy(({ row }) => row.label, {
+              direction: `asc`,
+              stringSort: `custom`,
+              compare: (a, b) => labelRank.get(a)! - labelRank.get(b)!,
+            })
+            .limit(2)
+            .select(({ row }) => ({ id: row.id }))
+      }
+    },
+  })
+}
+
+export function assertFullSourceRequest(
+  request: LoadSubsetOptions | undefined,
+): void {
+  if (
+    request === undefined ||
+    request.orderBy !== undefined ||
+    request.limit !== undefined ||
+    request.cursor !== undefined ||
+    request.offset !== undefined
+  ) {
+    throw new Error(
+      `Expected one predicate-only full-source request, received ${JSON.stringify(request)}`,
+    )
+  }
+}
+
+export async function observeFullSourceSettlement(
+  feature: FullSourceFeature,
+  settlement: InitialSettlementShape,
+) {
+  const delivered = new Set<number>()
+  const requests: Array<LoadSubsetOptions> = []
+  let sync!: Parameters<SyncConfig<FullSourceRow, number>[`sync`]>[0]
+  const source = createCollection<FullSourceRow, number>({
+    id: `ordered-full-source-${feature}-${settlement}`,
+    getKey: ({ id }) => id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: (operations) => {
+        sync = operations
+        operations.markReady()
+        return {
+          loadSubset: (options) => {
+            requests.push(options)
+            const fresh = fullSourceRows.filter(({ id }) => !delivered.has(id))
+            if (fresh.length > 0) {
+              sync.begin()
+              for (const value of fresh) {
+                delivered.add(value.id)
+                sync.write({ type: `insert`, value })
+              }
+              expect(sync.commit()).toBe(true)
+            }
+            return settlement === `synchronous` ? true : Promise.resolve()
+          },
+        }
+      },
+    },
+  })
+  const tags = createCollection<{ tag: string }, string>({
+    id: `ordered-full-source-tags-${feature}-${settlement}`,
+    getKey: ({ tag }) => tag,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({ type: `insert`, value: { tag: `x` } })
+        commit()
+        markReady()
+      },
+    },
+  })
+  const live = createFullSourceQuery(feature, source, tags)
+  const subscription = live.subscribeChanges(() => {}, {
+    includeInitialState: false,
+  })
+  const observeCurrent = (): InitialSettlementObservation => ({
+    rows: live.toArray.map(({ id }) => id),
+    status: live.status,
+  })
+  let observation:
+    | {
+        immediate: InitialSettlementObservation
+        settled: InitialSettlementObservation
+        requests: Array<LoadSubsetOptions>
+      }
+    | undefined
+  let primaryFailure: CapturedOracleFailure | undefined
+  try {
+    const preload = live.preload()
+    const immediate = observeCurrent()
+    await preload
+    observation = { immediate, settled: observeCurrent(), requests }
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  await finishOracleCleanup(
+    primaryFailure,
+    [
+      () => subscription.unsubscribe(),
+      () => live.cleanup(),
+      () => tags.cleanup(),
+      () => source.cleanup(),
+    ],
+    `Full-source settlement oracle cleanup failed`,
+  )
+  return observation!
+}
+
+export async function observeFullSourceReplay(feature: FullSourceFeature) {
+  let served: ReadonlyArray<FullSourceRow> = fullSourceRows
+  let sync!: Parameters<SyncConfig<FullSourceRow, number>[`sync`]>[0]
+  const source = createCollection<FullSourceRow, number>({
+    id: `ordered-full-source-replay-${feature}`,
+    getKey: ({ id }) => id,
+    syncMode: `on-demand`,
+    sync: {
+      sync: (operations) => {
+        sync = operations
+        operations.markReady()
+        return {
+          loadSubset: () => {
+            const missing = served.filter(({ id }) => !source.has(id))
+            if (missing.length > 0) {
+              sync.begin()
+              for (const value of missing) sync.write({ type: `insert`, value })
+              expect(sync.commit()).toBe(true)
+            }
+            return true
+          },
+        }
+      },
+    },
+  })
+  const tags = createCollection<{ tag: string }, string>({
+    id: `ordered-full-source-replay-tags-${feature}`,
+    getKey: ({ tag }) => tag,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({ type: `insert`, value: { tag: `x` } })
+        commit()
+        markReady()
+      },
+    },
+  })
+  const live = createFullSourceQuery(feature, source, tags)
+  let primaryFailure: CapturedOracleFailure | undefined
+  let observation:
+    { immediate: Array<number>; settled: Array<number> } | undefined
+  try {
+    await live.preload()
+    // The source drops row 1 and replays its replacement through a truncate.
+    served = fullSourceRows.slice(1)
+    sync.begin()
+    sync.truncate()
+    sync.commit()
+    const immediate = live.toArray.map(({ id }) => id)
+    await flushPromises()
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    observation = { immediate, settled: live.toArray.map(({ id }) => id) }
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  await finishOracleCleanup(
+    primaryFailure,
+    [() => live.cleanup(), () => tags.cleanup(), () => source.cleanup()],
+    `Full-source replay oracle cleanup failed`,
+  )
+  return observation!
+}
+
+export async function observeEagerFullSourceSettlement(
+  feature: FullSourceFeature,
+) {
+  const source = createCollection<FullSourceRow, number>({
+    id: `ordered-full-source-eager-${feature}`,
+    getKey: ({ id }) => id,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        for (const value of fullSourceRows) write({ type: `insert`, value })
+        commit()
+        markReady()
+      },
+    },
+  })
+  const tags = createCollection<{ tag: string }, string>({
+    id: `ordered-full-source-eager-tags-${feature}`,
+    getKey: ({ tag }) => tag,
+    sync: {
+      sync: ({ begin, write, commit, markReady }) => {
+        begin()
+        write({ type: `insert`, value: { tag: `x` } })
+        commit()
+        markReady()
+      },
+    },
+  })
+  const live = createFullSourceQuery(feature, source, tags)
+  let primaryFailure: CapturedOracleFailure | undefined
+  let immediate: InitialSettlementObservation | undefined
+  try {
+    const preload = live.preload()
+    immediate = {
+      rows: live.toArray.map(({ id }) => id),
+      status: live.status,
+    }
+    await preload
+  } catch (error) {
+    primaryFailure = { error }
+  }
+  await finishOracleCleanup(
+    primaryFailure,
+    [() => live.cleanup(), () => tags.cleanup(), () => source.cleanup()],
+    `Eager full-source settlement oracle cleanup failed`,
+  )
+  return immediate!
+}
diff --git a/packages/db/tests/query/ordered-lifecycle.test.ts b/packages/db/tests/query/ordered-lifecycle.test.ts
new file mode 100644
index 0000000000..fbdcd30593
--- /dev/null
+++ b/packages/db/tests/query/ordered-lifecycle.test.ts
@@ -0,0 +1,580 @@
+// Ordinary tests for the ordered lifecycle: fixed histories and cleanup checks
+// with literal expectations. They are supplemental coverage. The laws they
+// touch (initial settlement, warm readiness, and full-source replay) are owned
+// by ordered-lifecycle-oracle.property.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import {
+  createLiveQueryCollection,
+  eq,
+  isUndefined,
+  not,
+} from '../../src/query/index.js'
+import { flushPromises } from '../utils.js'
+import {
+  finishOracleCleanup,
+  fullSourceFeatures,
+  observeFullSourceReplay,
+} from './ordered-lifecycle-support.js'
+import type {
+  CapturedOracleFailure,
+  InitialSettlementObservation,
+} from './ordered-lifecycle-support.js'
+import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
+
+describe(`oracle harness failure fidelity`, () => {
+  it(`preserves the primary mismatch and every cleanup diagnostic`, async () => {
+    const primary = new Error(`primary mismatch`)
+    const firstCleanup = new Error(`first cleanup failed`)
+    const secondCleanup = new Error(`second cleanup failed`)
+    const attempted: Array<string> = []
+    let observed: unknown
+
+    try {
+      await finishOracleCleanup(
+        { error: primary },
+        [
+          () => {
+            attempted.push(`first`)
+            throw firstCleanup
+          },
+          () => {
+            attempted.push(`second`)
+            throw secondCleanup
+          },
+        ],
+        `Hostile cleanup control`,
+      )
+    } catch (error) {
+      observed = error
+    }
+
+    expect(attempted).toEqual([`first`, `second`])
+    expect(observed).toBeInstanceOf(AggregateError)
+    expect((observed as AggregateError).cause).toBe(primary)
+    expect((observed as AggregateError).errors).toEqual([
+      primary,
+      firstCleanup,
+      secondCleanup,
+    ])
+  })
+})
+
+describe(`synchronous initial settlement refinement`, () => {
+  // The synchronous cut covers the initial load. For a query that must read
+  // its whole source first (here a function filter), the initial load is its
+  // first full-source request. When the source answers with literal `true`,
+  // the query is ready with its rows at creation. Full-source work after that
+  // initial window and a full-source repair remain outside this guarantee.
+  it(`publishes an eager full-source ordered window at creation`, async () => {
+    const source = createCollection<{ id: number; rank: number }, number>({
+      id: `full-source-initial-${Math.random()}`,
+      getKey: (row) => row.id,
+      syncMode: `eager`,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          for (let id = 0; id < 5; id++) {
+            write({ type: `insert`, value: { id, rank: id } })
+          }
+          commit()
+          markReady()
+        },
+      },
+    })
+    source.createIndex((row) => row.rank, { indexType: BTreeIndex })
+    const query = createLiveQueryCollection({
+      startSync: true,
+      query: (q) =>
+        q
+          .from({ row: source })
+          .fn.where(({ row }) => row.rank >= 0)
+          .orderBy(({ row }) => row.rank, `desc`)
+          .limit(2),
+    })
+    try {
+      expect({
+        status: query.status,
+        rows: query.toArray.map((row) => row.id),
+      }).toEqual({ status: `ready`, rows: [4, 3] })
+    } finally {
+      await query.cleanup()
+      await source.cleanup()
+    }
+  })
+
+  // The initial full-source cut and #2055's joined-filter rule meet here. A
+  // function filter makes the plan read its whole source, so its synchronous
+  // initial load installs every source row. #2055's hazard needs a bounded read
+  // that left an eligible row out; after a full read the window can always
+  // reach the next eligible row, even when a distant row entered through a live
+  // update first. This pins that the synchronous initial load keeps that
+  // property through later changes.
+  it(`keeps the first eligible joined rows after a synchronous full-source load`, async () => {
+    type Row = { id: number; rank: number; label: string }
+    let source: Parameters<SyncConfig<Row, number>[`sync`]>[0] | undefined
+    const writeRow = (
+      message: { type: `update`; value: Row } | { type: `delete`; key: number },
+    ) => {
+      source!.begin()
+      source!.write(message)
+      source!.commit()
+    }
+    const rows = createCollection<Row, number>({
+      id: `full-source-joined-rows-${Math.random()}`,
+      getKey: (row) => row.id,
+      syncMode: `eager`,
+      startSync: true,
+      sync: {
+        sync: (params) => {
+          source = params
+          params.begin()
+          for (let id = 1; id <= 10; id++) {
+            params.write({
+              type: `insert`,
+              value: { id, rank: id, label: `a` },
+            })
+          }
+          params.commit()
+          params.markReady()
+        },
+      },
+    })
+    rows.createIndex((row) => row.rank, { indexType: BTreeIndex })
+    const markers = createCollection<{ id: number; rowId: number }, number>({
+      id: `full-source-joined-markers-${Math.random()}`,
+      getKey: (marker) => marker.id,
+      syncMode: `eager`,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          for (let id = 2; id <= 10; id += 2) {
+            write({ type: `insert`, value: { id, rowId: id } })
+          }
+          commit()
+          markReady()
+        },
+      },
+    })
+    const query = createLiveQueryCollection({
+      startSync: true,
+      query: (q) =>
+        q
+          .from({ row: rows })
+          .leftJoin({ marker: markers }, ({ row, marker }) =>
+            eq(row.id, marker.rowId),
+          )
+          .where(({ marker }) => not(isUndefined(marker.rowId)))
+          .fn.where(({ row }) => row.rank > 0)
+          .orderBy(({ row }) => row.rank)
+          .limit(1),
+    })
+    const ids = () => query.toArray.map((result) => result.row.id)
+    try {
+      expect({ status: query.status, ids: ids() }).toEqual({
+        status: `ready`,
+        ids: [2],
+      })
+      // A label-only update brings the distant row 10 into the graph.
+      writeRow({ type: `update`, value: { id: 10, rank: 10, label: `b` } })
+      await flushPromises()
+      expect(ids()).toEqual([2])
+      // Deleting the visible row must expose the next eligible row, 4.
+      writeRow({ type: `delete`, key: 2 })
+      await flushPromises()
+      expect(ids()).toEqual([4])
+    } finally {
+      await query.cleanup()
+      await markers.cleanup()
+      await rows.cleanup()
+    }
+  })
+
+  it(`processes sibling source input before draining an ordered continuation`, async () => {
+    type LeftRow = { id: number; group: string; rank: number }
+    type RightRow = { id: number; group: string }
+
+    let rightSync!: Parameters<SyncConfig<RightRow, number>[`sync`]>[0]
+    const right = createCollection<RightRow, number>({
+      id: `ordered-initial-cross-source-right`,
+      getKey: ({ id }) => id,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          rightSync = operations
+          operations.markReady()
+        },
+      },
+    })
+
+    const requests: Array<LoadSubsetOptions> = []
+    let wroteSiblingInput = false
+    const left = createCollection<LeftRow, number>({
+      id: `ordered-initial-cross-source-left`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          markReady()
+          return {
+            loadSubset: (options) => {
+              requests.push(options)
+              if (requests.length === 1) {
+                begin()
+                write({
+                  type: `insert`,
+                  value: { id: 1, group: `shared`, rank: 1 },
+                })
+                expect(commit()).toBe(true)
+              } else if (!wroteSiblingInput) {
+                wroteSiblingInput = true
+                rightSync.begin()
+                rightSync.write({
+                  type: `insert`,
+                  value: { id: 10, group: `shared` },
+                })
+                rightSync.write({
+                  type: `insert`,
+                  value: { id: 11, group: `shared` },
+                })
+                expect(rightSync.commit()).toBe(true)
+              }
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+
+    const live = createLiveQueryCollection({
+      id: `ordered-initial-cross-source-live`,
+      startSync: false,
+      query: (q) =>
+        q
+          .from({ left })
+          .leftJoin({ right }, ({ left: leftRow, right: rightRow }) =>
+            eq(leftRow.group, rightRow.group),
+          )
+          .orderBy(({ left: leftRow }) => leftRow.rank)
+          .limit(2)
+          .select(({ left: leftRow, right: rightRow }) => ({
+            id: leftRow.id,
+            rightId: rightRow.id,
+          })),
+    })
+    const readyRows: Array<Array<number | undefined>> = []
+    const unsubscribeStatus = live.on(`status:ready`, () => {
+      readyRows.push(live.toArray.map(({ rightId }) => rightId))
+    })
+
+    try {
+      const preload = live.preload()
+      const immediate = {
+        rows: live.toArray.map(({ rightId }) => rightId),
+        status: live.status,
+      }
+      await preload
+
+      expect(wroteSiblingInput).toBe(true)
+      expect(
+        requests.map(({ orderBy, limit, offset, where, cursor }) => ({
+          orderTerms: orderBy?.length ?? 0,
+          limit,
+          offset,
+          hasWhere: where !== undefined,
+          hasCursor: cursor !== undefined,
+        })),
+      ).toEqual([
+        {
+          orderTerms: 1,
+          limit: 2,
+          offset: 0,
+          hasWhere: false,
+          hasCursor: false,
+        },
+        {
+          orderTerms: 0,
+          limit: undefined,
+          offset: undefined,
+          hasWhere: true,
+          hasCursor: false,
+        },
+      ])
+      expect(readyRows).toEqual([[10, 11]])
+      expect(immediate).toEqual({ rows: [10, 11], status: `ready` })
+      expect({
+        rows: live.toArray.map(({ rightId }) => rightId),
+        status: live.status,
+      }).toEqual({ rows: [10, 11], status: `ready` })
+    } finally {
+      unsubscribeStatus()
+      await Promise.all([live.cleanup(), left.cleanup(), right.cleanup()])
+    }
+  })
+})
+
+describe(`warm ordered readiness oracle`, () => {
+  // The four remote rows have the ascending order [3, 4, 1, 2], with null
+  // last. When preload starts the live-query sync run, a warm literal-true
+  // response to each acquisition owes that complete window and `ready` before
+  // the call returns. A constructor-started sync run resumes deferred
+  // on-demand acquisition asynchronously, so it owes the same window after
+  // settlement. The zero-limit neighbor needs no acquisition.
+  it.each([
+    { limit: 0, startsAtConstruction: false, expectedRequests: [] },
+    {
+      limit: 50,
+      startsAtConstruction: false,
+      expectedRequests: [
+        { ordered: true, filtered: false, limit: 50 },
+        { ordered: false, filtered: false, limit: undefined },
+      ],
+    },
+    {
+      limit: 50,
+      startsAtConstruction: true,
+      expectedRequests: [
+        { ordered: true, filtered: false, limit: 50 },
+        { ordered: false, filtered: false, limit: undefined },
+      ],
+    },
+  ])(
+    `settles a retained $limit-row window after an async cold prime (constructor start: $startsAtConstruction)`,
+    async ({ limit, startsAtConstruction, expectedRequests }) => {
+      type DatedRow = { id: number; createdAt: Date | null }
+      const remote: Array<DatedRow> = [
+        { id: 1, createdAt: new Date(`2026-01-03T00:00:00.000Z`) },
+        { id: 2, createdAt: null },
+        { id: 3, createdAt: new Date(`2026-01-01T00:00:00.000Z`) },
+        { id: 4, createdAt: new Date(`2026-01-02T00:00:00.000Z`) },
+      ]
+      const installed = new Set<number>()
+      const warmRequests: Array<{
+        ordered: boolean
+        filtered: boolean
+        limit: number | undefined
+      }> = []
+      let cold = true
+      const source = createCollection<DatedRow, number>({
+        id: `warm-ordered-readiness-${limit}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            markReady()
+            return {
+              loadSubset: (options) => {
+                if (!cold) {
+                  warmRequests.push({
+                    ordered: options.orderBy !== undefined,
+                    filtered: options.where !== undefined,
+                    limit: options.limit,
+                  })
+                }
+                const missing = remote.filter(({ id }) => !installed.has(id))
+                if (missing.length > 0) {
+                  begin()
+                  for (const row of missing) {
+                    installed.add(row.id)
+                    write({ type: `insert`, value: row })
+                  }
+                  commit()
+                }
+                return cold ? Promise.resolve() : true
+              },
+            }
+          },
+        },
+      })
+      const query = (queryLimit: number, startSync = true) =>
+        createLiveQueryCollection({
+          query: (q) =>
+            q
+              .from({ row: source })
+              .orderBy(({ row }) => row.createdAt, {
+                direction: `asc`,
+                nulls: `last`,
+              })
+              .limit(queryLimit),
+          startSync,
+        })
+      const coldQuery = query(50)
+      let warmQuery: ReturnType<typeof query> | undefined
+      let observation:
+        | {
+            requestsAtCut: Array<{
+              ordered: boolean
+              filtered: boolean
+              limit: number | undefined
+            }>
+            requestsAfterSettlement: Array<{
+              ordered: boolean
+              filtered: boolean
+              limit: number | undefined
+            }>
+            immediate: InitialSettlementObservation
+            settled: InitialSettlementObservation
+            isLoadingSubset: boolean
+          }
+        | undefined
+      let primaryFailure: CapturedOracleFailure | undefined
+      try {
+        await coldQuery.preload()
+        cold = false
+        warmQuery = query(limit, startsAtConstruction)
+        // Preload starts a new sync run when startSync is false. When the
+        // constructor started it, preload resumes deferred on-demand work
+        // through the asynchronous subscription restart path. Both receive
+        // the same warm rows, but only the first owes the synchronous cut.
+        const requestsBeforePreload = [...warmRequests]
+        const preload = warmQuery.preload()
+        const requestsAtCut = [...warmRequests]
+        const immediate = {
+          status: warmQuery.status,
+          rows: warmQuery.toArray.map(({ id }) => id),
+        }
+        await preload
+        observation = {
+          requestsAtCut,
+          requestsAfterSettlement: [...warmRequests],
+          immediate,
+          settled: {
+            status: warmQuery.status,
+            rows: warmQuery.toArray.map(({ id }) => id),
+          },
+          isLoadingSubset: warmQuery.isLoadingSubset,
+        }
+        expect(requestsBeforePreload).toEqual([])
+      } catch (error) {
+        primaryFailure = { error }
+      }
+      await finishOracleCleanup(
+        primaryFailure,
+        [
+          () => warmQuery?.cleanup(),
+          () => coldQuery.cleanup(),
+          () => source.cleanup(),
+        ],
+        `Warm ordered readiness oracle cleanup failed`,
+      )
+      expect(observation!.requestsAtCut).toEqual(
+        startsAtConstruction ? expectedRequests.slice(0, 1) : expectedRequests,
+      )
+      expect(observation!.requestsAfterSettlement).toEqual(expectedRequests)
+      expect(observation!.immediate).toEqual({
+        status: startsAtConstruction ? `loading` : `ready`,
+        rows: startsAtConstruction || limit === 0 ? [] : [3, 4, 1, 2],
+      })
+      expect(observation!.settled).toEqual({
+        status: `ready`,
+        rows: limit === 0 ? [] : [3, 4, 1, 2],
+      })
+      expect(observation!.isLoadingSubset).toBe(false)
+    },
+  )
+
+  it(`makes a retained nonzero-offset prefix and boundary synchronously ready`, async () => {
+    type WarmRow = { id: number; rank: number; tie: number }
+    const remote: Array<WarmRow> = [
+      { id: 1, rank: 1, tie: 1 },
+      { id: 2, rank: 2, tie: 1 },
+      { id: 3, rank: 3, tie: 1 },
+      { id: 4, rank: 4, tie: 1 },
+    ]
+    const installed = new Set<number>()
+    const warmRequests: Array<{
+      ordered: boolean
+      filtered: boolean
+      limit: number | undefined
+    }> = []
+    let cold = true
+    const source = createCollection<WarmRow, number>({
+      id: `warm-offset-prefix-readiness`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          markReady()
+          return {
+            loadSubset: (options) => {
+              if (!cold) {
+                warmRequests.push({
+                  ordered: options.orderBy !== undefined,
+                  filtered: options.where !== undefined,
+                  limit: options.limit,
+                })
+              }
+              const missing = remote.filter(({ id }) => !installed.has(id))
+              if (missing.length > 0) {
+                begin()
+                for (const row of missing) {
+                  installed.add(row.id)
+                  write({ type: `insert`, value: row })
+                }
+                commit()
+              }
+              return cold ? Promise.resolve() : true
+            },
+          }
+        },
+      },
+    })
+    const query = () =>
+      createLiveQueryCollection({
+        query: (q) =>
+          q
+            .from({ row: source })
+            .orderBy(({ row }) => row.rank, `asc`)
+            .orderBy(({ row }) => row.tie, `asc`)
+            .offset(1)
+            .limit(2),
+      })
+    const owner = query()
+    try {
+      await owner.preload()
+      cold = false
+      const sibling = query()
+      try {
+        // Construction starts no provider work. The sibling's first preload
+        // starts its sync run, and both warm acquisitions return true, so it
+        // is ready before preload returns: the synchronous observation cut.
+        expect(warmRequests).toEqual([])
+        void sibling.preload()
+        expect(sibling.status).toBe(`ready`)
+        expect(sibling.toArray.map(({ id }) => id)).toEqual([2, 3])
+        expect(warmRequests).toEqual([
+          { ordered: true, filtered: false, limit: 3 },
+          { ordered: false, filtered: true, limit: undefined },
+        ])
+      } finally {
+        await sibling.cleanup()
+      }
+    } finally {
+      await owner.cleanup()
+      await source.cleanup()
+    }
+  })
+})
+
+describe(`synchronous initial full-source settlement refinement`, () => {
+  it.each(fullSourceFeatures)(
+    `keeps the %s full-source truncate replay behind its publication barrier`,
+    async (feature) => {
+      const observed = await observeFullSourceReplay(feature)
+      // Replay is excluded from the synchronous cut: the prior window stays
+      // published at the call that started the replay, even though the
+      // provider answers it with literal `true`.
+      expect(observed.immediate).toEqual([1, 2])
+      expect(observed.settled).toEqual([2, 3])
+    },
+  )
+})
diff --git a/packages/db/tests/query/ordered-source-loader-oracle.test.ts b/packages/db/tests/query/ordered-source-loader-oracle.test.ts
index e7daa2df8c..675d25293f 100644
--- a/packages/db/tests/query/ordered-source-loader-oracle.test.ts
+++ b/packages/db/tests/query/ordered-source-loader-oracle.test.ts
@@ -1,546 +1,47 @@
+// Law: an explicit window that consumes a staged boundary continuation issues
+// only the immediate work that its boundary and remaining demand require. The
+// model `expectedStagedWindowTrace` states that trace for each cell of the
+// boundary-by-demand grammar `stagedWindowCases`. The remaining scenarios in
+// this area are fixed histories, owned by ordered-source-loader.test.ts.
 import { describe, expect, it, vi } from 'vitest'
-import { createCollection } from '../../src/collection/index.js'
 import { OrderedSourceLoader } from '../../src/query/live/ordered-source-loader.js'
-import { Func, PropRef, Value } from '../../src/query/ir.js'
-import { captureMicrotaskErrors, flushPromises } from '../utils.js'
-import type {
-  CollectionSubscription,
-  ReleaseLoadSubset,
-} from '../../src/collection/subscription.js'
-import type { OrderByOptimizationInfo } from '../../src/query/compiler/order-by.js'
-import type {
-  LoadSubsetOptions,
-  LoadSubsetRequestResult,
-} from '../../src/types.js'
-
-const pendingPromise = (loader: OrderedSourceLoader) =>
-  (loader as unknown as { pending: Promise<unknown> | undefined }).pending
-
-type RequestOptions = LoadSubsetOptions & {
-  minValues?: Array<unknown>
-  onLoadSubsetResult?: (
-    result: LoadSubsetRequestResult,
-    acquisition: LoadSubsetOptions,
-    release: ReleaseLoadSubset,
-  ) => void
-}
-
-function createDeferred() {
-  let resolve!: () => void
-  let reject!: (error: unknown) => void
-  const promise = new Promise<void>((done, fail) => {
-    resolve = done
-    reject = fail
-  })
-  return { promise, resolve, reject }
-}
-
-function createOrderByInfo(
-  overrides: Partial<OrderByOptimizationInfo> = {},
-): OrderByOptimizationInfo {
-  return {
-    sourceId: `source`,
-    alias: `row`,
-    orderBy: [
-      {
-        expression: new PropRef([`row`, `rank`]),
-        compareOptions: {
-          direction: `asc`,
-          nulls: `first`,
-          stringSort: `lexical`,
-        },
-      },
-    ],
-    offset: 0,
-    limit: 1,
-    comparator: (left, right) =>
-      (left?.rank as number) - (right?.rank as number),
-    valueExtractorForRawRow: (row) => row.rank,
-    index: {} as NonNullable<OrderByOptimizationInfo[`index`]>,
-    dataNeeded: () => 1,
-    requiresFullSource: false,
-    // A finite provider, not an eager source: its rows are not all installed.
-    sourceHoldsAllRows: false,
-    ...overrides,
-  }
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  createDeferred,
+  createOrderByInfo,
+} from './ordered-source-loader-support.js'
+import type { RequestOptions } from './ordered-source-loader-support.js'
+import type { CollectionSubscription } from '../../src/collection/subscription.js'
+
+const stagedWindowAxes = {
+  boundary: [`absent`, `present`] as const,
+  demand: [`satisfied`, `widened`] as const,
 }
+const stagedWindowCases = stagedWindowAxes.boundary.flatMap((boundary) =>
+  stagedWindowAxes.demand.map((demand) => ({ boundary, demand })),
+)
+
+/**
+ * Independent immediate-work model for an explicit window that consumes a
+ * staged boundary continuation. A present boundary requires its tie
+ * acquisition. An absent boundary starts no work, so only remaining window
+ * demand can require a prefix acquisition.
+ */
+const expectedStagedWindowTrace = (
+  boundary: (typeof stagedWindowAxes.boundary)[number],
+  demand: (typeof stagedWindowAxes.demand)[number],
+): Array<`page` | `boundary`> => [
+  `page`,
+  ...(boundary === `present` ? ([`boundary`] as const) : []),
+  ...(demand === `widened` ? ([`page`] as const) : []),
+]
+
+declareOracle({
+  model: [expectedStagedWindowTrace],
+  grammar: [stagedWindowCases],
+})
 
 describe(`OrderedSourceLoader`, () => {
-  it(`pages an indexed multi-column order from its leading term`, async () => {
-    const requests: Array<{ method: string; options: RequestOptions }> = []
-    let dataNeeded = 0
-    const request = (method: string, options: RequestOptions) => {
-      requests.push({ method, options })
-      options.onLoadSubsetResult?.(true, options, () => {})
-    }
-    const subscription = {
-      setOrderByIndex: () => {},
-      readOrderedSnapshot: () => [{ value: { rank: 1, id: 2 } }],
-      requestLimitedSnapshot: (options: RequestOptions) =>
-        request(`limited`, options),
-      requestSnapshot: (options: RequestOptions) =>
-        request(`snapshot`, options),
-    }
-    const orderBy = [
-      ...createOrderByInfo().orderBy,
-      {
-        expression: new PropRef([`row`, `id`]),
-        compareOptions: {
-          direction: `desc` as const,
-          nulls: `last` as const,
-          stringSort: `lexical` as const,
-        },
-      },
-    ]
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({
-        orderBy,
-        dataNeeded: () => dataNeeded,
-      }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-
-    try {
-      loader.start()
-      await pendingPromise(loader)
-      await pendingPromise(loader)
-
-      expect(requests[0]?.method).toBe(`limited`)
-      expect(requests[0]?.options).toMatchObject({
-        limit: 1,
-        offset: 0,
-      })
-      expect(requests[0]?.options.orderBy).toHaveLength(2)
-      expect(
-        requests[0]?.options.orderBy?.map(({ expression }) => expression),
-      ).toEqual([new PropRef([`rank`]), new PropRef([`id`])])
-      expect(requests[1]?.method).toBe(`snapshot`)
-      expect(requests[1]?.options.where).toBeDefined()
-
-      dataNeeded = 2
-      loader.loadMore(1)
-      await pendingPromise(loader)
-
-      const continuation = requests.find(
-        ({ method, options }) =>
-          method === `limited` && options.minValues !== undefined,
-      )
-      expect(continuation?.options).toMatchObject({
-        limit: 2,
-        minValues: [1],
-      })
-      expect(continuation?.options.orderBy).toHaveLength(2)
-    } finally {
-      loader.dispose()
-    }
-  })
-
-  it(`settles a larger prefix after an older lease release throws`, async () => {
-    const failure = new Error(`old prefix release failed`)
-    const requests: Array<LoadSubsetOptions> = []
-    const source = createCollection<{ id: number; rank: number }>({
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          for (let id = 1; id <= 3; id++)
-            write({ type: `insert`, value: { id, rank: id } })
-          commit()
-          markReady()
-          return {
-            loadSubset: (options) => {
-              requests.push(options)
-              return Promise.resolve()
-            },
-            unloadSubset: (options) => {
-              if (options === requests[0]) throw failure
-            },
-          }
-        },
-      },
-    })
-    const subscription = source.subscribeChanges(() => {}, {
-      includeInitialState: false,
-    })
-    const reads = vi.spyOn(subscription, `readOrderedSnapshot`)
-    const info = createOrderByInfo({ index: undefined, dataNeeded: () => 0 })
-    const loader = new OrderedSourceLoader(
-      info,
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-    // A throwing release is an adapter bug: it is reported uncaught and the
-    // larger prefix still settles.
-    const uncaught = captureMicrotaskErrors()
-    try {
-      loader.start()
-      await pendingPromise(loader)
-      reads.mockClear()
-      info.limit = 2
-      await loader.loadMore(1)
-      await flushPromises()
-      expect(uncaught.errors).toEqual([failure])
-      expect(reads).toHaveBeenCalledWith(expect.objectContaining({ limit: 2 }))
-      // A release failure is not a load error.
-      expect(subscription.lastError).toBeUndefined()
-      info.limit = 3
-      await loader.loadMore(2)
-      expect(requests.map((request) => request.limit)).toEqual([
-        1,
-        undefined,
-        2,
-        undefined,
-        3,
-        undefined,
-      ])
-      expect(
-        requests
-          .filter((request) => request.limit === undefined)
-          .every((request) => request.where !== undefined),
-      ).toBe(true)
-      expect(source.size).toBe(3)
-    } finally {
-      uncaught.restore()
-      loader.dispose()
-      subscription.unsubscribe()
-      await source.cleanup()
-    }
-  })
-
-  it(`keeps a literal-true replacement when retiring the older prefix throws`, async () => {
-    const failure = new Error(`old prefix release failed`)
-    const requests: Array<{
-      options: RequestOptions
-      acquisition: LoadSubsetOptions
-      release: ReleaseLoadSubset
-    }> = []
-    const released: Array<LoadSubsetOptions> = []
-    const request = (options: RequestOptions) => {
-      const acquisition: LoadSubsetOptions = {
-        orderBy: options.orderBy,
-        limit: options.limit,
-        where: options.where,
-      }
-      const requestIndex = requests.length
-      const release = () => {
-        released.push(acquisition)
-        if (requestIndex === 0) throw failure
-      }
-      requests.push({ options, acquisition, release })
-      options.onLoadSubsetResult?.(true, acquisition, release)
-    }
-    const subscription = {
-      readOrderedSnapshot: (options: LoadSubsetOptions) => [
-        { value: { rank: options.limit ?? 1 } },
-      ],
-      requestSnapshot: request,
-    }
-    const info = createOrderByInfo({ index: undefined, dataNeeded: () => 0 })
-    const loader = new OrderedSourceLoader(
-      info,
-      subscription as unknown as CollectionSubscription,
-      `row`,
-      undefined,
-      undefined,
-      () => 0,
-    )
-    const uncaught = captureMicrotaskErrors()
-
-    try {
-      loader.start()
-      info.limit = 2
-
-      loader.loadMore()
-      await flushPromises()
-      expect(uncaught.errors).toEqual([failure])
-
-      expect(requests.map(({ options }) => options.limit)).toEqual([
-        1,
-        undefined,
-        2,
-        undefined,
-      ])
-      expect(released).toEqual([requests[0]!.acquisition])
-      expect(
-        (
-          loader as unknown as {
-            settledFiniteAcquisitions: Map<
-              ReleaseLoadSubset,
-              number | undefined
-            >
-          }
-        ).settledFiniteAcquisitions.has(requests[2]!.release),
-      ).toBe(true)
-      expect(
-        (loader as unknown as { failedRequest?: unknown }).failedRequest,
-      ).toBeUndefined()
-      expect(
-        (loader as unknown as { needsOrderingRepair: boolean })
-          .needsOrderingRepair,
-      ).toBe(false)
-      expect(
-        (loader as unknown as { stagedContinuation?: unknown })
-          .stagedContinuation,
-      ).toBeUndefined()
-    } finally {
-      uncaught.restore()
-      loader.dispose()
-    }
-  })
-
-  it(`does not fail a literal-true parent when its drained continuation throws`, () => {
-    const failure = new Error(`continuation request failed`)
-    const requests: Array<{
-      options: RequestOptions
-      acquisition?: LoadSubsetOptions
-      release?: ReleaseLoadSubset
-    }> = []
-    const released: Array<LoadSubsetOptions> = []
-    const subscription = {
-      setOrderByIndex: () => {},
-      readOrderedSnapshot: () => [{ value: { rank: 1 } }],
-      requestLimitedSnapshot: (options: RequestOptions) => {
-        const acquisition: LoadSubsetOptions = {
-          orderBy: options.orderBy,
-          limit: options.limit,
-        }
-        const release = () => released.push(acquisition)
-        requests.push({ options, acquisition, release })
-        options.onLoadSubsetResult?.(true, acquisition, release)
-      },
-      requestSnapshot: (options: RequestOptions) => {
-        requests.push({ options })
-        throw failure
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ dataNeeded: () => 0 }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-      undefined,
-      undefined,
-      () => 0,
-    )
-
-    try {
-      expect(() => loader.start()).toThrow(failure)
-
-      expect(requests).toHaveLength(2)
-      expect(released).toEqual([])
-      expect(
-        (
-          loader as unknown as {
-            settledFiniteAcquisitions: Map<
-              ReleaseLoadSubset,
-              number | undefined
-            >
-          }
-        ).settledFiniteAcquisitions.has(requests[0]!.release!),
-      ).toBe(true)
-      expect(
-        (loader as unknown as { orderedLoadGeneration: number })
-          .orderedLoadGeneration,
-      ).toBe(0)
-      expect(
-        (loader as unknown as { failedRequest?: unknown }).failedRequest,
-      ).toBeDefined()
-    } finally {
-      loader.dispose()
-    }
-  })
-
-  it(`drains more than one literal-true continuation before returning`, () => {
-    const methods: Array<`page` | `boundary`> = []
-    let pageCount = 0
-    let boundary = 0
-    const subscription = {
-      setOrderByIndex: () => {},
-      readOrderedSnapshot: () => [{ value: { rank: boundary } }],
-      requestLimitedSnapshot: (options: RequestOptions) => {
-        methods.push(`page`)
-        pageCount++
-        boundary = pageCount
-        options.onLoadSubsetResult?.(true, options, () => {})
-      },
-      requestSnapshot: (options: RequestOptions) => {
-        methods.push(`boundary`)
-        options.onLoadSubsetResult?.(true, options, () => {})
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ dataNeeded: () => (pageCount < 2 ? 1 : 0) }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-      undefined,
-      undefined,
-      () => 0,
-    )
-
-    try {
-      loader.start()
-
-      expect(methods).toEqual([`page`, `boundary`, `page`, `boundary`])
-      expect(pendingPromise(loader)).toBeUndefined()
-    } finally {
-      loader.dispose()
-    }
-  })
-
-  it(`does not release a fulfilled Promise parent when its continuation throws`, async () => {
-    const failure = new Error(`continuation request failed`)
-    const requests: Array<{
-      options: RequestOptions
-      acquisition?: LoadSubsetOptions
-      release?: ReleaseLoadSubset
-    }> = []
-    const released: Array<LoadSubsetOptions> = []
-    const subscription = {
-      setOrderByIndex: () => {},
-      readOrderedSnapshot: () => [{ value: { rank: 1 } }],
-      requestLimitedSnapshot: (options: RequestOptions) => {
-        const acquisition: LoadSubsetOptions = {
-          orderBy: options.orderBy,
-          limit: options.limit,
-        }
-        const release = () => released.push(acquisition)
-        requests.push({ options, acquisition, release })
-        options.onLoadSubsetResult?.(Promise.resolve(), acquisition, release)
-      },
-      requestSnapshot: (options: RequestOptions) => {
-        requests.push({ options })
-        throw failure
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ dataNeeded: () => 0 }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-
-    try {
-      loader.start()
-      const parent = pendingPromise(loader)
-      expect(parent).toBeInstanceOf(Promise)
-      await expect(parent).rejects.toBe(failure)
-
-      expect(requests).toHaveLength(2)
-      expect(released).toEqual([])
-      expect(
-        (
-          loader as unknown as {
-            settledFiniteAcquisitions: Map<
-              ReleaseLoadSubset,
-              number | undefined
-            >
-          }
-        ).settledFiniteAcquisitions.has(requests[0]!.release!),
-      ).toBe(true)
-      expect(
-        (loader as unknown as { orderedLoadGeneration: number })
-          .orderedLoadGeneration,
-      ).toBe(0)
-      expect(
-        (loader as unknown as { failedRequest?: unknown }).failedRequest,
-      ).toBeDefined()
-    } finally {
-      loader.dispose()
-    }
-  })
-
-  it(`repairs ordering before an explicit window consumes a staged ordinary continuation`, () => {
-    const requests: Array<{ method: string; options: RequestOptions }> = []
-    let graphInputRevision = 0
-    const sentRows = new Map([[1, { rank: 1 }]])
-    const request = (method: string, options: RequestOptions) => {
-      requests.push({ method, options })
-      if (requests.length === 1) {
-        graphInputRevision++
-        loader.onSourceChanges(
-          [{ type: `update`, key: 1, value: { rank: 2 } }],
-          sentRows,
-          () => false,
-        )
-      }
-      options.onLoadSubsetResult?.(true, options, () => {})
-    }
-    const subscription = {
-      setOrderByIndex: () => {},
-      readOrderedSnapshot: () => [{ value: { rank: 2 } }],
-      requestLimitedSnapshot: (options: RequestOptions) =>
-        request(`limited`, options),
-      requestSnapshot: (options: RequestOptions) =>
-        request(`snapshot`, options),
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-      undefined,
-      undefined,
-      () => graphInputRevision,
-    )
-
-    try {
-      loader.start()
-
-      const stagedContinuation = (
-        loader as unknown as {
-          stagedContinuation?: {
-            role: `finite` | `repair` | `full-source`
-            windowOperationGeneration?: number
-          }
-        }
-      ).stagedContinuation
-      // The first request's own delivery invalidated ordering, so it proves
-      // no current coverage: no ordinary continuation may survive it. It
-      // stages none, or only authoritative work; a stamp taken after the
-      // request returns would stage a finite one.
-      expect(stagedContinuation?.role).not.toBe(`finite`)
-      expect(
-        (loader as unknown as { needsOrderingRepair: boolean })
-          .needsOrderingRepair,
-      ).toBe(true)
-
-      loader.loadMore(1)
-
-      expect(requests).toHaveLength(2)
-      expect(requests[1]?.method).toBe(`snapshot`)
-      expect(requests[1]?.options).toMatchObject({ refetch: true })
-      expect(requests[1]?.options.orderBy).toBeUndefined()
-      expect(requests[1]?.options.limit).toBeUndefined()
-      expect(requests[1]?.options.cursor).toBeUndefined()
-      expect(requests[1]?.options.where).toBeUndefined()
-    } finally {
-      loader.dispose()
-    }
-  })
-
-  const stagedWindowAxes = {
-    boundary: [`absent`, `present`] as const,
-    demand: [`satisfied`, `widened`] as const,
-  }
-  const stagedWindowCases = stagedWindowAxes.boundary.flatMap((boundary) =>
-    stagedWindowAxes.demand.map((demand) => ({ boundary, demand })),
-  )
-
-  /**
-   * Independent immediate-work model for an explicit window that consumes a
-   * staged boundary continuation. A present boundary requires its tie
-   * acquisition. An absent boundary starts no work, so only remaining window
-   * demand can require a prefix acquisition.
-   */
-  const expectedStagedWindowTrace = (
-    boundary: (typeof stagedWindowAxes.boundary)[number],
-    demand: (typeof stagedWindowAxes.demand)[number],
-  ): Array<`page` | `boundary`> => [
-    `page`,
-    ...(boundary === `present` ? ([`boundary`] as const) : []),
-    ...(demand === `widened` ? ([`page`] as const) : []),
-  ]
-
   it(`enumerates every staged-boundary explicit-window cell exactly once`, () => {
     const keys = stagedWindowCases.map(
       ({ boundary, demand }) => `${boundary}:${demand}`,
@@ -644,996 +145,4 @@ describe(`OrderedSourceLoader`, () => {
       }
     },
   )
-
-  const syncRouteCells = (
-    [`page`, `prefix`, `boundary`, `full-source`] as const
-  ).flatMap((route) =>
-    ([`success`, `throw`, `callback-then-throw`] as const).map((outcome) => ({
-      route,
-      outcome,
-    })),
-  )
-
-  it.each(syncRouteCells)(
-    `preserves $route request semantics with synchronous $outcome`,
-    async ({ route, outcome }) => {
-      const requests: Array<{ method: string; options: RequestOptions }> = []
-      const released: Array<RequestOptions> = []
-      const failure = new Error(`target request failed`)
-      const waiting = createDeferred()
-      let boundaryReads = 0
-      const targetIndex = route === `boundary` ? 1 : 0
-      const request = (method: string, options: RequestOptions) => {
-        const index = requests.length
-        requests.push({ method, options })
-        if (index !== targetIndex) {
-          // Bootstrap the boundary case; leave later refinement/retry in flight.
-          options.onLoadSubsetResult?.(
-            index < targetIndex ? true : waiting.promise,
-            options,
-            () => {},
-          )
-          return
-        }
-        if (outcome !== `throw`) {
-          options.onLoadSubsetResult?.(true, options, () =>
-            released.push(options),
-          )
-        }
-        if (outcome !== `success`) throw failure
-      }
-      const subscription = {
-        setOrderByIndex: () => {},
-        readOrderedSnapshot: () => {
-          boundaryReads++
-          return [{ value: { rank: 1 } }]
-        },
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`limited`, options),
-        requestSnapshot: (options: RequestOptions) =>
-          request(`snapshot`, options),
-      }
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({
-          dataNeeded: () => 0,
-          ...(route === `prefix` ? { index: undefined } : {}),
-          requiresFullSource: route === `full-source`,
-        }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-      try {
-        if (outcome !== `success` && route !== `boundary`) {
-          expect(() => loader.start()).toThrow(failure)
-        } else {
-          loader.start()
-          if (outcome === `success`) await pendingPromise(loader)
-          else await expect(pendingPromise(loader)).rejects.toBe(failure)
-        }
-        // Drain the synchronous boundary's own settlement as well as its parent.
-        await Promise.resolve()
-        const target = requests[targetIndex]!
-        expect(target.method).toBe(route === `page` ? `limited` : `snapshot`)
-        expect(target.options.limit).toBe(
-          route === `page` || route === `prefix` ? 1 : undefined,
-        )
-        expect(Boolean(target.options.where)).toBe(route === `boundary`)
-        expect(released).toEqual(
-          outcome === `callback-then-throw` ? [target.options] : [],
-        )
-        if (outcome === `success`) {
-          // Ordered loads establish a cursor and refine ties; neither a tie
-          // load nor a full-source load may restart that refinement step.
-          expect(boundaryReads).toBe(route === `full-source` ? 0 : 1)
-          expect(requests).toHaveLength(route === `full-source` ? 1 : 2)
-          if (route === `page` || route === `prefix`) {
-            expect(requests[1]!.options.where).toBeDefined()
-            expect(requests[1]!.options.orderBy).toBeUndefined()
-          }
-        } else {
-          const count = requests.length
-          loader.loadMore()
-          expect(requests).toHaveLength(count)
-          loader.loadMore(1)
-          expect(requests).toHaveLength(count + 1)
-          const retry = requests.at(-1)!
-          expect(retry.method).toBe(`snapshot`)
-          expect(retry.options.orderBy).toBeUndefined()
-          expect(retry.options.where).toBeUndefined()
-          expect(retry.options.limit).toBeUndefined()
-        }
-      } finally {
-        loader.dispose()
-        waiting.resolve()
-        await Promise.resolve()
-      }
-    },
-  )
-
-  it.each([`page`, `prefix`] as const)(
-    `settles an ordinary synchronous $route chain before start returns`,
-    (route) => {
-      const requests: Array<string> = []
-      const request = (method: string, options: RequestOptions): void => {
-        requests.push(method)
-        options.onLoadSubsetResult?.(true, options, () => {})
-      }
-      const subscription = {
-        setOrderByIndex: () => {},
-        readOrderedSnapshot: () => [{ value: { rank: 1 } }],
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`limited`, options),
-        requestSnapshot: (options: RequestOptions) =>
-          request(`snapshot`, options),
-      }
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({
-          dataNeeded: () => 0,
-          ...(route === `prefix` ? { index: undefined } : {}),
-        }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-        undefined,
-        undefined,
-        () => 0,
-      )
-      try {
-        loader.start()
-        expect(pendingPromise(loader)).toBeUndefined()
-        expect(requests).toEqual(
-          route === `prefix`
-            ? [`snapshot`, `snapshot`]
-            : [`limited`, `snapshot`],
-        )
-      } finally {
-        loader.dispose()
-      }
-    },
-  )
-
-  // An eager prefix repair settles synchronously only when its local read is
-  // bounded: one order term over an index. A second term or a missing index
-  // keeps the full local read, so that repair keeps its asynchronous
-  // settlement, as does every on-demand source.
-  it.each([
-    {
-      name: `one indexed term`,
-      terms: 1,
-      indexed: true,
-      eager: true,
-      sync: true,
-    },
-    {
-      name: `two indexed terms`,
-      terms: 2,
-      indexed: true,
-      eager: true,
-      sync: false,
-    },
-    { name: `no index`, terms: 1, indexed: false, eager: true, sync: false },
-    {
-      name: `an on-demand source`,
-      terms: 1,
-      indexed: true,
-      eager: false,
-      sync: false,
-    },
-  ])(
-    `settles an eager prefix repair synchronously only for a bounded read ($name)`,
-    async ({ terms, indexed, eager, sync }) => {
-      const requests: Array<{ method: string; options: RequestOptions }> = []
-      const request = (method: string, options: RequestOptions): void => {
-        requests.push({ method, options })
-        options.onLoadSubsetResult?.(true, options, () => {})
-      }
-      const subscription = {
-        setOrderByIndex: () => {},
-        readOrderedSnapshot: () => [{ value: { rank: 1 } }],
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`limited`, options),
-        requestSnapshot: (options: RequestOptions) =>
-          request(`snapshot`, options),
-      }
-      const base = createOrderByInfo()
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({
-          dataNeeded: () => 0,
-          sourceHoldsAllRows: eager,
-          ...(indexed ? {} : { index: undefined }),
-          orderBy:
-            terms === 2
-              ? [
-                  ...base.orderBy,
-                  {
-                    expression: new PropRef([`row`, `id`]),
-                    compareOptions: base.orderBy[0]!.compareOptions,
-                  },
-                ]
-              : base.orderBy,
-        }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-        undefined,
-        undefined,
-        () => 0,
-      )
-      try {
-        loader.start()
-        expect(pendingPromise(loader)).toBeUndefined()
-        loader.invalidateSourceOrdering()
-        requests.length = 0
-        loader.loadMore()
-        expect(requests[0]?.options.limit, `a prefix repair ran`).toBe(1)
-        expect(
-          pendingPromise(loader) === undefined,
-          `repair settled before loadMore returned`,
-        ).toBe(sync)
-        await pendingPromise(loader)
-      } finally {
-        loader.dispose()
-      }
-    },
-  )
-
-  it(`recovers authoritatively when reading a settled boundary fails`, async () => {
-    const failure = new Error(`boundary read failed`)
-    const requests: Array<{ method: string; options: RequestOptions }> = []
-    const released: Array<LoadSubsetOptions> = []
-    const request = (method: string, options: RequestOptions) => {
-      requests.push({ method, options })
-      options.onLoadSubsetResult?.(Promise.resolve(), options, () =>
-        released.push(options),
-      )
-    }
-    const subscription = {
-      setOrderByIndex: () => {},
-      readOrderedSnapshot: () => {
-        throw failure
-      },
-      requestLimitedSnapshot: (options: RequestOptions) =>
-        request(`limited`, options),
-      requestSnapshot: (options: RequestOptions) =>
-        request(`snapshot`, options),
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-    loader.start()
-    await expect(pendingPromise(loader)).rejects.toBe(failure)
-    loader.loadMore()
-    expect(requests).toHaveLength(1)
-    await loader.loadMore(1)
-    expect(released).toEqual([requests[0]!.options])
-    expect(requests.map(({ method }) => method)).toEqual([
-      `limited`,
-      `snapshot`,
-    ])
-    expect(requests[1]!.options.limit).toBeUndefined()
-    loader.dispose()
-  })
-
-  const asyncRouteCells = (
-    [`page`, `prefix`, `boundary`, `full-source`] as const
-  ).flatMap((route) =>
-    (
-      [
-        `resolve`,
-        `reject`,
-        `abort`,
-        `dispose-resolve`,
-        `dispose-reject`,
-      ] as const
-    ).map((outcome) => ({ route, outcome })),
-  )
-
-  it.each(asyncRouteCells)(
-    `keeps the $route acquisition lifecycle exact for $outcome`,
-    async ({ route, outcome }) => {
-      type ObservedRequest = {
-        method: `limited` | `snapshot`
-        options: RequestOptions
-        acquisition: LoadSubsetOptions
-        controller: AbortController
-        deferred: ReturnType<typeof createDeferred>
-      }
-      const requests: Array<ObservedRequest> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const request = (
-        method: ObservedRequest[`method`],
-        options: RequestOptions,
-      ) => {
-        const controller = new AbortController()
-        const acquisition: LoadSubsetOptions = {
-          signal: controller.signal,
-          orderBy: options.orderBy,
-          limit: options.limit,
-        }
-        const deferred = createDeferred()
-        requests.push({ method, options, acquisition, controller, deferred })
-        options.onLoadSubsetResult?.(deferred.promise, acquisition, () =>
-          releases.push(acquisition),
-        )
-      }
-      const subscription = {
-        readOrderedSnapshot: () =>
-          route === `boundary` ? [{ value: { rank: 1 } }] : [],
-        setOrderByIndex: () => {},
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`limited`, options),
-        requestSnapshot: (options: RequestOptions) =>
-          request(`snapshot`, options),
-      }
-      const info = createOrderByInfo(
-        route === `prefix`
-          ? { index: undefined }
-          : route === `full-source`
-            ? { requiresFullSource: true }
-            : {},
-      )
-      const loader = new OrderedSourceLoader(
-        info,
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-
-      loader.start()
-      if (route === `boundary`) {
-        expect(requests.map(({ method }) => method)).toEqual([`limited`])
-        requests[0]!.deferred.resolve()
-        await Promise.resolve()
-        await Promise.resolve()
-        expect(requests.map(({ method }) => method)).toEqual([
-          `limited`,
-          `snapshot`,
-        ])
-      }
-      const target = requests.at(-1)!
-      const targetSettlement = pendingPromise(loader)!
-      const failure =
-        outcome === `abort`
-          ? new DOMException(`${route} canceled`, `AbortError`)
-          : new Error(`${route} rejected`)
-
-      if (outcome === `dispose-resolve` || outcome === `dispose-reject`) {
-        loader.dispose()
-        if (outcome === `dispose-resolve`) target.deferred.resolve()
-        else target.deferred.reject(failure)
-        await targetSettlement
-        expect(requests.at(-1)).toBe(target)
-        expect(releases).toEqual([])
-        return
-      }
-
-      if (outcome === `resolve`) {
-        target.deferred.resolve()
-        await targetSettlement
-        expect(target.controller.signal.aborted).toBe(false)
-        expect(releases).toEqual([])
-      } else {
-        if (outcome === `abort`) target.controller.abort()
-        target.deferred.reject(failure)
-        await expect(targetSettlement).rejects.toBe(failure)
-        expect(target.controller.signal.aborted).toBe(outcome === `abort`)
-
-        const requestCount = requests.length
-        expect(loader.loadMore()).toBeUndefined()
-        expect(requests).toHaveLength(requestCount)
-
-        loader.loadMore(1)
-        expect(releases).toEqual([target.acquisition])
-        expect(requests).toHaveLength(requestCount + 1)
-        const retry = requests.at(-1)!
-        expect(retry.method).toBe(`snapshot`)
-        retry.deferred.resolve()
-        await pendingPromise(loader)
-        expect(releases).toEqual([
-          target.acquisition,
-          ...(route === `boundary` ? [requests[0]!.acquisition] : []),
-        ])
-      }
-
-      loader.dispose()
-    },
-  )
-
-  it.each(
-    ([`reset`, `dispose`] as const).flatMap((lifecycle) =>
-      ([`resolve`, `reject`, `abort`] as const).map((outcome) => ({
-        lifecycle,
-        outcome,
-      })),
-    ),
-  )(
-    `preserves replacement ownership after $lifecycle and obsolete $outcome`,
-    async ({ lifecycle, outcome }) => {
-      const requests: Array<{
-        method: string
-        options: RequestOptions
-        deferred: ReturnType<typeof createDeferred>
-      }> = []
-      const releases: Array<RequestOptions> = []
-      const request = (method: string, options: RequestOptions) => {
-        const deferred = createDeferred()
-        requests.push({ method, options, deferred })
-        options.onLoadSubsetResult?.(deferred.promise, options, () =>
-          releases.push(options),
-        )
-      }
-      const subscription = {
-        setOrderByIndex: () => {},
-        readOrderedSnapshot: () => [],
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`page`, options),
-        requestSnapshot: (options: RequestOptions) =>
-          request(`full-source`, options),
-      }
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({ dataNeeded: () => 0 }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-      try {
-        loader.start()
-        const obsolete = pendingPromise(loader)!
-        if (lifecycle === `reset`) loader.resetCursor()
-        else loader.dispose()
-        const replacement = loader.loadMore(1)
-        expect(requests.map(({ method }) => method)).toEqual(
-          lifecycle === `reset` ? [`page`, `page`] : [`page`],
-        )
-        if (lifecycle === `reset`) {
-          expect(replacement).toBeInstanceOf(Promise)
-          expect(requests[1]!.options.offset).toBe(0)
-          expect(requests[1]!.options.minValues).toBeUndefined()
-        }
-
-        if (outcome === `resolve`) requests[0]!.deferred.resolve()
-        else {
-          requests[0]!.deferred.reject(
-            outcome === `abort`
-              ? new DOMException(`obsolete request canceled`, `AbortError`)
-              : new Error(`obsolete request failed`),
-          )
-        }
-        await obsolete
-        expect(pendingPromise(loader)).toBe(replacement)
-        expect(releases).toEqual([])
-
-        if (lifecycle === `reset`) {
-          requests[1]!.deferred.resolve()
-          await replacement
-          // A successful finite replacement cannot prove that partial writes
-          // from the obsolete failure were repaired. Success and repair debt
-          // coexist; only an authoritative full-source request clears it.
-          loader.loadMore(2)
-          expect(requests.map(({ method }) => method)).toEqual(
-            outcome === `resolve`
-              ? [`page`, `page`]
-              : [`page`, `page`, `full-source`],
-          )
-          if (outcome !== `resolve`) {
-            expect(requests[2]!.options.orderBy).toBeUndefined()
-            expect(requests[2]!.options.limit).toBeUndefined()
-            requests[2]!.deferred.resolve()
-            await pendingPromise(loader)
-            loader.loadMore(3)
-            expect(requests).toHaveLength(3)
-          }
-        } else {
-          expect(loader.loadMore(2)).toBeUndefined()
-          expect(requests).toHaveLength(1)
-        }
-      } finally {
-        loader.dispose()
-        requests.forEach(({ deferred }) => deferred.resolve())
-      }
-    },
-  )
-
-  it.each([
-    { label: `undefined`, value: undefined, continuation: `full-source` },
-    { label: `null`, value: null, continuation: `full-source` },
-    { label: `zero`, value: 0, continuation: `tie` },
-    { label: `false`, value: false, continuation: `tie` },
-    { label: `empty string`, value: ``, continuation: `tie` },
-  ])(
-    `uses $continuation for a $label boundary`,
-    async ({ value, continuation }) => {
-      const methods: Array<string> = []
-      let needed = 0
-      const request = (method: string, options: RequestOptions) => {
-        methods.push(method)
-        options.onLoadSubsetResult?.(true, options, () => {})
-      }
-      const subscription = {
-        setOrderByIndex: () => {},
-        readOrderedSnapshot: () => [{ value: { rank: value } }],
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`page`, options),
-        requestSnapshot: (options: RequestOptions) => {
-          const kind = options.where ? `tie` : `full-source`
-          expect(kind).toBe(continuation)
-          request(kind, options)
-        },
-      }
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({ dataNeeded: () => needed, comparator: () => 0 }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-
-      loader.start()
-      await pendingPromise(loader)
-      await pendingPromise(loader)
-      expect(methods).toEqual([`page`, continuation])
-
-      needed = 2
-      loader.loadMore(1)
-      await pendingPromise(loader)
-      expect(methods).toEqual(
-        continuation === `tie`
-          ? [`page`, `tie`, `page`]
-          : [`page`, `full-source`],
-      )
-      loader.dispose()
-    },
-  )
-
-  it(`retains only bounded promise state during a long refinement chain`, async () => {
-    let biggest: { rank: number } | undefined
-    const requests: Array<ReturnType<typeof createDeferred>> = []
-    const tracked: Array<{ settled: boolean }> = []
-    const request = (options: RequestOptions) => {
-      const next = createDeferred()
-      requests.push(next)
-      options.onLoadSubsetResult?.(
-        next.promise,
-        {
-          orderBy: options.orderBy,
-          limit: options.limit,
-        },
-        () => {},
-      )
-    }
-    const subscription = {
-      readOrderedSnapshot: () => (biggest ? [{ value: biggest }] : []),
-      setOrderByIndex: () => {},
-      requestLimitedSnapshot: request,
-      requestSnapshot: request,
-    }
-    const info = createOrderByInfo()
-    const loader = new OrderedSourceLoader(
-      info,
-      subscription as unknown as CollectionSubscription,
-      `row`,
-      (promise) => {
-        if (!(promise instanceof Promise)) return
-        const participant = { settled: false }
-        tracked.push(participant)
-        void promise.then(
-          () => {
-            participant.settled = true
-          },
-          () => {
-            participant.settled = true
-          },
-        )
-      },
-    )
-
-    loader.start()
-    for (let step = 0; step < 20; step++) {
-      expect(requests[step]).toBeDefined()
-      if (step % 2 === 0) biggest = { rank: step / 2 }
-      requests[step]!.resolve()
-      await Promise.resolve()
-      await Promise.resolve()
-      await Promise.resolve()
-    }
-
-    // One request is active and its predecessor may still be settling during
-    // the handoff. Earlier ancestors must already be collectible.
-    expect(
-      tracked.filter(({ settled }) => !settled).length,
-    ).toBeLessThanOrEqual(2)
-    loader.dispose()
-  })
-
-  it.each([
-    {
-      name: `page`,
-      info: createOrderByInfo(),
-      expectedMethod: `limited`,
-    },
-    {
-      name: `prefix`,
-      info: createOrderByInfo({ index: undefined }),
-      expectedMethod: `snapshot`,
-    },
-    {
-      name: `full source`,
-      info: createOrderByInfo({ requiresFullSource: true }),
-      expectedMethod: `snapshot`,
-    },
-  ])(
-    `keeps a callback-before-throw $name request failed until a later operation`,
-    async ({ info, expectedMethod }) => {
-      const failure = new Error(`${expectedMethod} request failed`)
-      const methods: Array<string> = []
-      let fail = true
-      const request = (
-        method: string,
-        options: {
-          onLoadSubsetResult?: (
-            result: true,
-            acquisition: LoadSubsetOptions,
-            release: ReleaseLoadSubset,
-          ) => void
-        },
-      ) => {
-        methods.push(method)
-        if (!fail) return
-        fail = false
-        options.onLoadSubsetResult?.(true, {}, () =>
-          subscription.releaseLoadSubset({}),
-        )
-        loader.loadMore()
-        throw failure
-      }
-      const subscription = {
-        setOrderByIndex: () => {},
-        releaseLoadSubset: (_options: LoadSubsetOptions) => {},
-        requestLimitedSnapshot: (options: RequestOptions) =>
-          request(`limited`, options),
-        requestSnapshot: (options: RequestOptions) =>
-          request(`snapshot`, options),
-      }
-      const loader = new OrderedSourceLoader(
-        info,
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-
-      expect(() => loader.start()).toThrow(failure)
-      await Promise.resolve()
-      await Promise.resolve()
-      expect(methods).toEqual([expectedMethod])
-      expect(loader.loadMore()).toBeUndefined()
-      expect(methods).toEqual([expectedMethod])
-
-      loader.loadMore(1)
-      expect(methods).toEqual([expectedMethod, `snapshot`])
-      loader.dispose()
-    },
-  )
-
-  it(`blocks retry reentered from provisional acquisition cleanup`, () => {
-    const failure = new Error(`prefix request failed`)
-    const methods: Array<string> = []
-    let fail = true
-    const subscription = {
-      setOrderByIndex: () => {},
-      releaseLoadSubset: (_options: LoadSubsetOptions) => {
-        loader.loadMore(1)
-      },
-      requestSnapshot: (options: RequestOptions) => {
-        methods.push(`snapshot`)
-        if (!fail) return
-        fail = false
-        options.onLoadSubsetResult?.(true, {}, () =>
-          subscription.releaseLoadSubset({}),
-        )
-        throw failure
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ index: undefined }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-
-    expect(() => loader.start()).toThrow(failure)
-    expect(methods).toEqual([`snapshot`])
-
-    loader.loadMore(2)
-    expect(methods).toEqual([`snapshot`, `snapshot`])
-    loader.dispose()
-  })
-
-  it(`preserves the request failure when provisional cleanup also throws`, async () => {
-    const requestFailure = new Error(`snapshot publication failed`)
-    const cleanupFailure = new Error(`provisional cleanup failed`)
-    const reported: Array<unknown> = []
-    const loads: Array<LoadSubsetOptions> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    let failedReleaseAttempts = 0
-    const source = createCollection<{ id: number; rank: number }>({
-      id: `ordered-provisional-cleanup-error`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: 1, rank: 1 } })
-          commit()
-          markReady()
-          return {
-            loadSubset: (options) => {
-              loads.push(options)
-              return true
-            },
-            unloadSubset: (options) => {
-              unloads.push(options)
-              if (options === loads[1] && ++failedReleaseAttempts === 1) {
-                throw cleanupFailure
-              }
-            },
-          }
-        },
-      },
-    })
-    const subscription = source.subscribeChanges(
-      (changes) => {
-        if (changes.length > 0) throw requestFailure
-      },
-      { includeInitialState: false },
-    )
-    subscription.on(`loadSubset:error`, ({ error }) => reported.push(error))
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ index: undefined }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-
-    // The provisional lease's release also throws: an adapter bug, reported
-    // uncaught, so the request failure stays the reported error.
-    const uncaught = captureMicrotaskErrors()
-    try {
-      subscription.requestSnapshot({
-        where: new Func(`eq`, [new PropRef([`id`]), new Value(`unrelated`)]),
-        optimizedOnly: false,
-      })
-      expect(() => loader.start()).toThrow(requestFailure)
-      expect(subscription.lastError).toBe(requestFailure)
-      expect(reported).toEqual([requestFailure])
-      expect(unloads).toEqual([loads[1]])
-      await flushPromises()
-      expect(uncaught.errors).toEqual([cleanupFailure])
-
-      loader.dispose()
-      subscription.unsubscribe()
-      expect(unloads).toEqual([loads[1], loads[0]])
-      expect(subscription.lastError).toBe(requestFailure)
-      expect(reported).toEqual([requestFailure])
-
-      subscription.unsubscribe()
-      expect(unloads).toEqual([loads[1], loads[0]])
-    } finally {
-      uncaught.restore()
-      loader.dispose()
-      subscription.unsubscribe()
-      await source.cleanup()
-    }
-  })
-
-  it.each([
-    [`string`, `snapshot publication failed`],
-    [`undefined`, undefined],
-  ] as const)(
-    `normalizes a %s provisional failure once for every observer`,
-    async (_label, thrownValue) => {
-      const cleanupFailure = new Error(`provisional cleanup failed`)
-      const reported: Array<unknown> = []
-      let unloads = 0
-      const source = createCollection<{ id: number; rank: number }>({
-        id: `ordered-provisional-non-error-${String(thrownValue)}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        startSync: true,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            begin()
-            write({ type: `insert`, value: { id: 1, rank: 1 } })
-            commit()
-            markReady()
-            return {
-              loadSubset: () => true,
-              unloadSubset: () => {
-                unloads++
-                if (unloads === 1) throw cleanupFailure
-              },
-            }
-          },
-        },
-      })
-      const subscription = source.subscribeChanges(
-        (changes) => {
-          if (changes.length > 0) throw thrownValue
-        },
-        { includeInitialState: false },
-      )
-      subscription.on(`loadSubset:error`, ({ error }) => reported.push(error))
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({ index: undefined }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-      const notCaught = Symbol(`not caught`)
-      let caught: unknown = notCaught
-      const uncaught = captureMicrotaskErrors()
-
-      try {
-        loader.start()
-      } catch (error) {
-        caught = error
-      }
-      await flushPromises()
-      uncaught.restore()
-      // The provisional release's error is an adapter bug, reported uncaught.
-      expect(uncaught.errors).toEqual([cleanupFailure])
-
-      expect(caught).not.toBe(notCaught)
-      expect(caught).toBeInstanceOf(Error)
-      expect((caught as Error).message).toBe(String(thrownValue))
-      expect(subscription.lastError).toBe(caught)
-      expect(reported).toEqual([caught])
-
-      loader.dispose()
-      subscription.unsubscribe()
-      await source.cleanup()
-    },
-  )
-
-  it(`retires an acquisition when its internal result observer throws`, async () => {
-    const observerFailure = new Error(`ordered result observer failed`)
-    const acquisition: LoadSubsetOptions = {}
-    const methods: Array<string> = []
-    const releases: Array<LoadSubsetOptions> = []
-    let failObserver = true
-    const subscription = {
-      setOrderByIndex: () => {},
-      releaseLoadSubset: (options: LoadSubsetOptions) => {
-        releases.push(options)
-        loader.loadMore(1)
-      },
-      requestSnapshot: (options: RequestOptions) => {
-        methods.push(`snapshot`)
-        options.onLoadSubsetResult?.(true, acquisition, () =>
-          subscription.releaseLoadSubset(acquisition),
-        )
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ index: undefined }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-      () => {
-        if (!failObserver) return
-        failObserver = false
-        throw observerFailure
-      },
-    )
-
-    expect(() => loader.start()).toThrow(observerFailure)
-    await Promise.resolve()
-    await Promise.resolve()
-    expect(releases).toEqual([acquisition])
-    expect(methods).toEqual([`snapshot`])
-
-    expect(loader.loadMore()).toBeUndefined()
-    expect(methods).toEqual([`snapshot`])
-
-    loader.loadMore(1)
-    expect(methods).toEqual([`snapshot`, `snapshot`])
-    loader.dispose()
-  })
-
-  it(`does not replace a failed acquisition while its release is running`, async () => {
-    const requestFailure = new Error(`ordered acquisition rejected`)
-    const releaseFailure = new Error(`ordered acquisition release failed`)
-    const acquisition: LoadSubsetOptions = {}
-    const methods: Array<string> = []
-    let firstRequest = true
-    const subscription = {
-      setOrderByIndex: () => {},
-      releaseLoadSubset: (_options: LoadSubsetOptions) => {
-        loader.loadMore(2)
-        throw releaseFailure
-      },
-      requestSnapshot: (options: RequestOptions) => {
-        methods.push(`snapshot`)
-        if (!firstRequest) return
-        firstRequest = false
-        options.onLoadSubsetResult?.(
-          Promise.reject(requestFailure),
-          acquisition,
-          () => subscription.releaseLoadSubset(acquisition),
-        )
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ index: undefined }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-
-    // The release reenters, but refinement stays blocked until it returns;
-    // its error is reported uncaught and the retry then replaces the lease.
-    const uncaught = captureMicrotaskErrors()
-    try {
-      loader.start()
-      await expect(pendingPromise(loader)).rejects.toBe(requestFailure)
-      loader.loadMore(1)
-      expect(methods).toEqual([`snapshot`, `snapshot`])
-      await flushPromises()
-      expect(uncaught.errors).toEqual([releaseFailure])
-
-      loader.loadMore(3)
-      expect(methods).toEqual([`snapshot`, `snapshot`])
-    } finally {
-      uncaught.restore()
-      loader.dispose()
-    }
-  })
-
-  it(`blocks a reentrant boundary retry until a later operation`, async () => {
-    const failure = new Error(`boundary request failed`)
-    const methods: Array<string> = []
-    let failBoundary = true
-    const subscription = {
-      readOrderedSnapshot: () => [{ value: { rank: 1 } }],
-      setOrderByIndex: () => {},
-      releaseLoadSubset: (_options: LoadSubsetOptions) => {},
-      requestLimitedSnapshot: (options: RequestOptions) => {
-        methods.push(`limited`)
-        options.onLoadSubsetResult?.(
-          true,
-          {
-            orderBy: options.orderBy,
-            limit: options.limit,
-          },
-          () =>
-            subscription.releaseLoadSubset({
-              orderBy: options.orderBy,
-              limit: options.limit,
-            }),
-        )
-      },
-      requestSnapshot: (options: {
-        onLoadSubsetResult?: (
-          result: true,
-          acquisition: LoadSubsetOptions,
-          release: ReleaseLoadSubset,
-        ) => void
-      }) => {
-        methods.push(`snapshot`)
-        if (!failBoundary) return
-        failBoundary = false
-        options.onLoadSubsetResult?.(true, {}, () =>
-          subscription.releaseLoadSubset({}),
-        )
-        loader.loadMore()
-        throw failure
-      },
-    }
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-
-    loader.start()
-    const initial = pendingPromise(loader)
-    await expect(initial).rejects.toBe(failure)
-    expect(methods).toEqual([`limited`, `snapshot`])
-    expect(loader.loadMore()).toBeUndefined()
-    expect(methods).toEqual([`limited`, `snapshot`])
-
-    loader.loadMore(1)
-    expect(methods).toEqual([`limited`, `snapshot`, `snapshot`])
-    loader.dispose()
-  })
 })
diff --git a/packages/db/tests/query/ordered-source-loader-state-oracle.test.ts b/packages/db/tests/query/ordered-source-loader-state-oracle.test.ts
index 78475bc857..6f7f1d77da 100644
--- a/packages/db/tests/query/ordered-source-loader-state-oracle.test.ts
+++ b/packages/db/tests/query/ordered-source-loader-state-oracle.test.ts
@@ -1,1778 +1,27 @@
 import fc from 'fast-check'
 import { describe, expect, it, vi } from 'vitest'
-import { createCollection } from '../../src/collection/index.js'
-import { BTreeIndex } from '../../src/indexes/btree-index.js'
-import { createLiveQueryCollection } from '../../src/query/index.js'
 import {
   OrderedLoaderInvariantError,
   OrderedSourceLoader,
 } from '../../src/query/live/ordered-source-loader.js'
 import { PropRef } from '../../src/query/ir.js'
-import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
-import { captureMicrotaskErrors, flushPromises } from '../utils.js'
+import { captureMicrotaskErrors } from '../utils.js'
 import {
   oraclePropertyOptions,
   oracleRuns,
   readOracleRunConfig,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
+import {
+  createDeferred,
+  createOrderByInfo,
+} from './ordered-source-loader-support.js'
+import type { CollectionSubscription } from '../../src/collection/subscription.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
 import type {
-  CollectionSubscription,
-  ReleaseLoadSubset,
-} from '../../src/collection/subscription.js'
-import type { OrderByOptimizationInfo } from '../../src/query/compiler/order-by.js'
-import type {
-  LoadSubsetOptions,
-  LoadSubsetRequestResult,
-} from '../../src/types.js'
-
-type RequestOptions = LoadSubsetOptions & {
-  minValues?: Array<unknown>
-  onLoadSubsetResult?: (
-    result: LoadSubsetRequestResult,
-    acquisition: LoadSubsetOptions,
-    release: ReleaseLoadSubset,
-  ) => void
-}
-
-function createDeferred() {
-  let resolve!: () => void
-  let reject!: (error: unknown) => void
-  const promise = new Promise<void>((done, fail) => {
-    resolve = done
-    reject = fail
-  })
-  return { promise, resolve, reject }
-}
-
-function createOrderByInfo(
-  overrides: Partial<OrderByOptimizationInfo> = {},
-): OrderByOptimizationInfo {
-  return {
-    sourceId: `source`,
-    alias: `row`,
-    orderBy: [
-      {
-        expression: new PropRef([`row`, `rank`]),
-        compareOptions: {
-          direction: `asc`,
-          nulls: `first`,
-          stringSort: `lexical`,
-        },
-      },
-    ],
-    offset: 0,
-    limit: 1,
-    comparator: (left, right) =>
-      (left?.rank as number) - (right?.rank as number),
-    valueExtractorForRawRow: (row) => row.rank,
-    index: {} as NonNullable<OrderByOptimizationInfo[`index`]>,
-    dataNeeded: () => 1,
-    requiresFullSource: false,
-    // A finite provider, not an eager source: its rows are not all installed.
-    sourceHoldsAllRows: false,
-    ...overrides,
-  }
-}
-
-type Observed = {
-  method: `limited` | `snapshot`
-  options: RequestOptions
-  acquisition: LoadSubsetOptions
-  deferred: ReturnType<typeof createDeferred>
-}
-
-function fakeSubscription(
-  requests: Array<Observed>,
-  releases: Array<LoadSubsetOptions>,
-  onRelease: () => void = () => {},
-) {
-  const request = (method: Observed[`method`], options: RequestOptions) => {
-    const acquisition: LoadSubsetOptions = {
-      orderBy: options.orderBy,
-      limit: options.limit,
-      where: options.where,
-    }
-    const deferred = createDeferred()
-    requests.push({ method, options, acquisition, deferred })
-    options.onLoadSubsetResult?.(deferred.promise, acquisition, () => {
-      releases.push(acquisition)
-      onRelease()
-    })
-  }
-  return {
-    readOrderedSnapshot: () => [],
-    setOrderByIndex: () => {},
-    requestLimitedSnapshot: (options: RequestOptions) =>
-      request(`limited`, options),
-    requestSnapshot: (options: RequestOptions) => request(`snapshot`, options),
-  } as unknown as CollectionSubscription
-}
-
-describe(`Ordered source request ownership`, () => {
-  // A request from before a cursor reset that fails raises the debt to a
-  // full-source read but keeps the work staged after the reset. A finite step
-  // staged there must not run first: its boundary would come from rows the
-  // failed request may have written only in part. The failure clears that
-  // boundary, so the staged tie issues nothing and the owed read comes next.
-  it(`starts the owed full-source read before a finite step staged after a reset`, async () => {
-    const requests: Array<{
-      options: RequestOptions
-      deferred: ReturnType<typeof createDeferred>
-    }> = []
-    let revision = 0
-    let answerAtOnce = false
-    const request = (options: RequestOptions) => {
-      const acquisition: LoadSubsetOptions = {
-        orderBy: options.orderBy,
-        limit: options.limit,
-        where: options.where,
-      }
-      const deferred = createDeferred()
-      requests.push({ options, deferred })
-      if (answerAtOnce) {
-        // The answer writes rows, so the graph has input it has not run.
-        revision++
-        options.onLoadSubsetResult?.(true, acquisition, () => {})
-      } else {
-        options.onLoadSubsetResult?.(deferred.promise, acquisition, () => {})
-      }
-    }
-    const subscription = {
-      readOrderedSnapshot: () => [{ value: { id: 1, rank: 1 } }],
-      setOrderByIndex: () => {},
-      requestLimitedSnapshot: request,
-      requestSnapshot: request,
-    } as unknown as CollectionSubscription
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      subscription,
-      `row`,
-      undefined,
-      undefined,
-      () => revision,
-    )
-    try {
-      loader.start()
-      const dead = requests[0]!
-      loader.resetCursor()
-      answerAtOnce = true
-      loader.loadMore()
-      expect(requests).toHaveLength(2)
-      answerAtOnce = false
-      dead.deferred.reject(new Error(`page from before the reset failed`))
-      await flushPromises()
-      loader.loadMore()
-      const next = requests[2]!.options
-      expect(next.where, `a tie from the staged step`).toBeUndefined()
-      expect(next.orderBy, `the owed full-source read`).toBeUndefined()
-    } finally {
-      loader.dispose()
-      for (const { deferred } of requests) deferred.resolve()
-    }
-  })
-
-  it(`retains an explicit failed-request retry blocked by joined demand`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    let joinedPending = false
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({
-        joinedFilterSourceId: `child`,
-        requiresFullSource: true,
-      }),
-      fakeSubscription(requests, releases),
-      `row`,
-      undefined,
-      undefined,
-      undefined,
-      () => joinedPending,
-    )
-
-    try {
-      loader.start()
-      const first = (loader as unknown as { pending: Promise<void> }).pending
-      const failure = new Error(`initial full-source request failed`)
-      requests[0]!.deferred.reject(failure)
-      await expect(first).rejects.toBe(failure)
-
-      joinedPending = true
-      expect(loader.loadMore(1)).toBeUndefined()
-      expect(requests).toHaveLength(1)
-
-      joinedPending = false
-      const retry = loader.loadMore()
-      expect(requests).toHaveLength(2)
-      requests[1]!.deferred.resolve()
-      await retry
-    } finally {
-      for (const request of requests) request.deferred.resolve()
-      loader.dispose()
-    }
-  })
-
-  it(`keeps nested refinement pending when an older lease release throws`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<number> = []
-    const participants: Array<Promise<unknown>> = []
-    const participantErrors = new Map<Promise<unknown>, unknown>()
-    const cleanupError = new Error(`older prefix cleanup failed`)
-    let boundary = 1
-    const request = (method: Observed[`method`], options: RequestOptions) => {
-      const index = requests.length
-      const acquisition: LoadSubsetOptions = {
-        orderBy: options.orderBy,
-        limit: options.limit,
-        where: options.where,
-      }
-      const deferred = createDeferred()
-      requests.push({ method, options, acquisition, deferred })
-      options.onLoadSubsetResult?.(
-        index === 2 ? true : deferred.promise,
-        acquisition,
-        () => {
-          releases.push(index)
-          if (index === 0) throw cleanupError
-        },
-      )
-    }
-    const subscription = {
-      readOrderedSnapshot: () => [
-        {
-          type: `insert`,
-          key: boundary,
-          value: { id: boundary, rank: boundary },
-        },
-      ],
-      setOrderByIndex: () => {},
-      requestLimitedSnapshot: (options: RequestOptions) =>
-        request(`limited`, options),
-      requestSnapshot: (options: RequestOptions) =>
-        request(`snapshot`, options),
-    } as unknown as CollectionSubscription
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      subscription,
-      `row`,
-      (result) => {
-        if (result instanceof Promise) {
-          participants.push(result)
-          void result.catch((error) => participantErrors.set(result, error))
-        }
-      },
-    )
-
-    const uncaught = captureMicrotaskErrors()
-    try {
-      loader.start()
-      requests[0]!.deferred.resolve()
-      await participants[0]
-      requests[1]!.deferred.resolve()
-      await participants[1]
-
-      boundary = 2
-      loader.invalidateCursor()
-      const result = loader.loadMore(1)!
-      expect(requests).toHaveLength(4)
-      expect(participants).toHaveLength(4)
-      await flushPromises()
-      // The older prefix's release throws: an adapter bug, reported
-      // uncaught. No participant reports it, and the nested refinement stays
-      // pending.
-      const recent = participants.slice(2)
-      const pending = (
-        loader as unknown as { pending: Promise<unknown> | undefined }
-      ).pending
-      expect(result).toBe(pending)
-      expect(recent).toContain(pending)
-      expect(
-        recent.some((participant) => participantErrors.has(participant)),
-      ).toBe(false)
-      expect(uncaught.errors).toEqual([cleanupError])
-
-      expect(loader.loadMore()).toBe(pending)
-      expect(requests).toHaveLength(4)
-      expect(releases).toEqual([0])
-    } finally {
-      uncaught.restore()
-      loader.dispose()
-      for (const observed of requests) observed.deferred.resolve()
-      await Promise.allSettled(participants)
-    }
-  })
-
-  it.each([
-    { name: `indexed page`, indexed: true },
-    { name: `unindexed prefix`, indexed: false },
-  ] as const)(
-    `finishes a repeated $name repair continuation and permits the next repair`,
-    async ({ indexed }) => {
-      type Row = { id: number; rank: number }
-      let rows: Array<Row> = [
-        { id: 1, rank: 1 },
-        { id: 2, rank: 2 },
-        { id: 3, rank: 3 },
-      ]
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const subscription = fakeSubscription(requests, releases) as unknown as {
-        readOrderedSnapshot: () => Array<{ value: Row }>
-      }
-      subscription.readOrderedSnapshot = () =>
-        rows
-          .slice()
-          .sort((left, right) => left.rank - right.rank)
-          .map((value) => ({ value }))
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({
-          index: indexed
-            ? ({} as NonNullable<OrderByOptimizationInfo[`index`]>)
-            : undefined,
-          limit: 10,
-          dataNeeded: () => (indexed ? 10 - rows.length : 0),
-        }),
-        subscription as unknown as CollectionSubscription,
-        `row`,
-      )
-      let nextRequest = 0
-      const settleThrough = async (finalCount: number) => {
-        while (nextRequest < finalCount) {
-          const pending = (
-            loader as unknown as { pending: Promise<unknown> | undefined }
-          ).pending
-          requests[nextRequest]!.deferred.resolve()
-          nextRequest++
-          await pending
-        }
-      }
-
-      try {
-        loader.start()
-        await settleThrough(indexed ? 3 : 2)
-
-        rows = rows.filter(({ id }) => id !== 2)
-        loader.invalidateSourceOrdering()
-        loader.loadMore(indexed ? undefined : 7)
-        const repairEnd = indexed ? 6 : 4
-        await settleThrough(repairEnd)
-
-        expect(releases).toEqual(
-          requests
-            .slice(0, indexed ? 3 : 2)
-            .map(({ acquisition }) => acquisition),
-        )
-
-        loader.invalidateSourceOrdering()
-        loader.loadMore(8)
-        expect(requests).toHaveLength(repairEnd + 1)
-      } finally {
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-      }
-    },
-  )
-
-  it(`starts a replacement repair before continuing a stale repair chain`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    let needed = 0
-    const subscription = fakeSubscription(requests, releases) as unknown as {
-      readOrderedSnapshot: () => Array<{
-        value: { id: number; rank: number }
-      }>
-    }
-    subscription.readOrderedSnapshot = () => [{ value: { id: 1, rank: 1 } }]
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ dataNeeded: () => needed }),
-      subscription as unknown as CollectionSubscription,
-      `row`,
-    )
-    let nextRequest = 0
-    const settle = async () => {
-      const pending = (
-        loader as unknown as { pending: Promise<unknown> | undefined }
-      ).pending
-      requests[nextRequest]!.deferred.resolve()
-      nextRequest++
-      await pending
-    }
-
-    try {
-      loader.start()
-      await settle()
-      await settle()
-
-      loader.invalidateSourceOrdering()
-      loader.loadMore()
-      await settle()
-      expect(requests).toHaveLength(4)
-
-      // A second mutation invalidates the chain while its tie request is held.
-      // Its settlement may apply rows, but it must not start stale refill work.
-      needed = 1
-      loader.invalidateSourceOrdering()
-      await settle()
-
-      expect(requests).toHaveLength(5)
-      expect(requests[4]!.method).toBe(`snapshot`)
-      expect(requests[4]!.options).toMatchObject({
-        refetch: true,
-        limit: 1,
-      })
-      expect(requests[4]!.options.orderBy).toBeDefined()
-      expect(requests[4]!.options.cursor).toBeUndefined()
-    } finally {
-      loader.dispose()
-      for (const request of requests) request.deferred.resolve()
-    }
-  })
-
-  it(`reissues a bounded prefix when settled source ordering is invalidated`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({
-        index: undefined,
-        offset: 2,
-        limit: 2,
-        dataNeeded: () => 0,
-      }),
-      fakeSubscription(requests, releases),
-      `row`,
-    )
-    let repair: Promise<unknown> | undefined
-
-    try {
-      loader.start()
-      const initial = (
-        loader as unknown as { pending: Promise<unknown> | undefined }
-      ).pending!
-      requests[0]!.deferred.resolve()
-      await initial
-
-      loader.invalidateSourceOrdering()
-      repair = loader.loadMore()
-
-      expect(requests).toHaveLength(2)
-      expect(requests[1]!.method).toBe(`snapshot`)
-      expect(
-        requests[1]!.options.orderBy?.map(({ expression, compareOptions }) => ({
-          path: expression instanceof PropRef ? expression.path : undefined,
-          direction: compareOptions.direction,
-        })),
-      ).toStrictEqual([{ path: [`rank`], direction: `asc` }])
-      expect(requests[1]!.options.limit).toBe(4)
-      expect(requests[1]!.options.refetch).toBe(true)
-      expect(requests[1]!.options.cursor).toBeUndefined()
-      expect(requests[1]!.options.offset).toBeUndefined()
-    } finally {
-      for (const request of requests) request.deferred.resolve()
-      await Promise.allSettled(repair ? [repair] : [])
-      loader.dispose()
-    }
-  })
-
-  it(`retains finite leases after bounded repair fails until full-source recovery succeeds`, async () => {
-    const requests: Array<{
-      options: RequestOptions
-      acquisition: LoadSubsetOptions
-      deferred: ReturnType<typeof createDeferred>
-    }> = []
-    const releases: Array<number> = []
-    const request = (options: RequestOptions) => {
-      const deferred = createDeferred()
-      const acquisition: LoadSubsetOptions = {
-        orderBy: options.orderBy,
-        limit: options.limit,
-        where: options.where,
-        cursor: options.cursor,
-        offset: options.offset,
-      }
-      const index = requests.length
-      requests.push({ options, acquisition, deferred })
-      options.onLoadSubsetResult?.(deferred.promise, acquisition, () => {
-        releases.push(index)
-      })
-    }
-    const subscription = {
-      hasPendingTruncateReplacement: false,
-      readOrderedSnapshot: () => [{ value: { id: 1, rank: 1 } }],
-      setOrderByIndex: () => {},
-      requestLimitedSnapshot: request,
-      requestSnapshot: request,
-    } as unknown as CollectionSubscription
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({
-        index: undefined,
-        dataNeeded: () => 0,
-      }),
-      subscription,
-      `row`,
-    )
-    const pending = () =>
-      (loader as unknown as { pending: Promise<unknown> | undefined }).pending!
-    const settle = async (index: number) => {
-      const participant = pending()
-      requests[index]!.deferred.resolve()
-      await participant
-    }
-
-    try {
-      loader.start()
-      await settle(0)
-      await settle(1)
-
-      loader.invalidateSourceOrdering()
-      loader.loadMore()
-      await settle(2)
-      expect(requests).toHaveLength(4)
-
-      // Core cannot know whether the failed adapter request wrote a partial
-      // result, so finite continuation is no longer authoritative.
-      const failedTie = pending()
-      const failure = new Error(`partial bounded-repair failure`)
-      requests[3]!.deferred.reject(failure)
-      await expect(failedTie).rejects.toBe(failure)
-
-      const retry = loader.loadMore(1)
-      expect(retry).toBeDefined()
-      expect(requests).toHaveLength(5)
-      expect(requests[4]!.options.orderBy).toBeUndefined()
-      expect(requests[4]!.options.where).toBeUndefined()
-      expect(requests[4]!.options.limit).toBeUndefined()
-      expect(requests[4]!.options.cursor).toBeUndefined()
-      expect(requests[4]!.options.offset).toBeUndefined()
-      await settle(4)
-
-      expect(
-        requests.map(({ options }) =>
-          options.orderBy ? `prefix` : options.where ? `tie` : `full-source`,
-        ),
-      ).toEqual([`prefix`, `tie`, `prefix`, `tie`, `full-source`])
-      expect(releases).toEqual([3, 0, 1, 2])
-    } finally {
-      loader.dispose()
-      for (const observed of requests) observed.deferred.resolve()
-    }
-  })
-
-  // An order change while a tie request is in flight starts a bounded prefix
-  // repair at once; the tie's later result is ignored for the boundary. When
-  // that repair fails, the window move rejects with its error and the last
-  // public window stays, whatever the older tie request does. An explicit
-  // retry then recovers under today's failure law, from the full source, and
-  // publishes once.
-  it.each([`success`, `failure`] as const)(
-    `keeps a failed public window private when its older tie request ends in %s`,
-    async (olderOutcome) => {
-      type Row = { id: number; rank: number }
-      const truth: Array<Row> = [1, 2, 3].map((id) => ({ id, rank: id }))
-      const requests: Array<{
-        kind: `page` | `boundary` | `full`
-        options: LoadSubsetOptions
-        gate: ReturnType<typeof createDeferred>
-      }> = []
-      const releases: Array<LoadSubsetOptions> = []
-      let hold = false
-      let holdRepair = false
-      let update!: (row: Row) => void
-      const source = createCollection<Row, number>({
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: (sync) => {
-            const installed = new Map<number, Row>()
-            update = (row) => {
-              installed.set(row.id, row)
-              sync.begin()
-              sync.write({ type: `update`, value: row })
-              sync.commit()
-            }
-            sync.markReady()
-            return {
-              loadSubset: async (options) => {
-                const kind = options.orderBy
-                  ? `page`
-                  : options.where
-                    ? `boundary`
-                    : `full`
-                const gate = createDeferred()
-                requests.push({ kind, options, gate })
-                if (!hold || (kind === `page` && !holdRepair)) gate.resolve()
-                await gate.promise
-                if (options.signal?.aborted) return
-                const rows = truth
-                  .filter(
-                    (row) =>
-                      (!options.where ||
-                        evaluateReferenceExpression(options.where, row) ===
-                          true) &&
-                      (!options.cursor ||
-                        evaluateReferenceExpression(
-                          options.cursor.whereFrom,
-                          row,
-                        ) === true),
-                  )
-                  .sort((a, b) => a.rank - b.rank)
-                const offset = options.cursor ? 0 : (options.offset ?? 0)
-                const selected = rows.slice(
-                  offset,
-                  options.limit === undefined
-                    ? undefined
-                    : offset + options.limit,
-                )
-                sync.begin()
-                for (const row of selected) {
-                  if (installed.get(row.id) === row) continue
-                  sync.write({
-                    type: installed.has(row.id) ? `update` : `insert`,
-                    value: row,
-                  })
-                  installed.set(row.id, row)
-                }
-                await sync.commit()
-              },
-              unloadSubset: (options) => {
-                releases.push(options)
-              },
-            }
-          },
-        },
-      })
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.rank)
-          .limit(1)
-          .select(({ row }) => ({ id: row.id, rank: row.rank })),
-      )
-      const visibleRows = () =>
-        live.toArray.map(({ id, rank }) => ({ id, rank }))
-      const publications: Array<Array<Row>> = []
-      live.subscribeChanges(
-        (batch) => {
-          if (batch.length) publications.push(visibleRows())
-        },
-        { includeInitialState: false },
-      )
-      try {
-        await live.preload()
-        expect(visibleRows()).toEqual([{ id: 1, rank: 1 }])
-        publications.length = 0
-        hold = true
-        const move = Promise.resolve(live.utils.setWindow({ limit: 2 })).then(
-          () => ({ status: `fulfilled` as const }),
-          (error) => ({ status: `rejected` as const, error }),
-        )
-        await flushPromises()
-        const boundary = requests.at(-1)!
-        expect(boundary.kind).toBe(`boundary`)
-        holdRepair = true
-        truth[0] = { id: 1, rank: 10 }
-        update(truth[0])
-        await flushPromises()
-        const repair = requests.at(-1)!
-        expect(repair.kind).toBe(`page`)
-        expect(repair.options.limit).toBe(2)
-        expect(repair.options.cursor).toBeUndefined()
-        const count = requests.length
-        const failure = new Error(`authoritative repair failed`)
-        repair.gate.reject(failure)
-        // The window still waits for its older publication participant to settle.
-        await flushPromises()
-        if (olderOutcome === `failure`)
-          boundary.gate.reject(new Error(`older tie failed`))
-        else boundary.gate.resolve()
-        await flushPromises()
-        expect(requests).toHaveLength(count)
-        expect(await move).toEqual({ status: `rejected`, error: failure })
-        expect(releases).toEqual([])
-        expect(publications).toEqual([])
-        expect(visibleRows()).toEqual([{ id: 1, rank: 1 }])
-        expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
-
-        hold = false
-        holdRepair = false
-        await live.utils.setWindow({ limit: 2 })
-        expect(requests).toHaveLength(count + 1)
-        expect(requests.at(-1)!.kind).toBe(`full`)
-        expect(releases).toHaveLength(count)
-        expect(new Set(releases)).toEqual(
-          new Set(requests.slice(0, count).map(({ options }) => options)),
-        )
-        expect(visibleRows()).toEqual([
-          { id: 2, rank: 2 },
-          { id: 3, rank: 3 },
-        ])
-        expect(publications).toEqual([
-          [
-            { id: 2, rank: 2 },
-            { id: 3, rank: 3 },
-          ],
-        ])
-      } finally {
-        await live.cleanup()
-        for (const request of requests) request.gate.resolve()
-        await source.cleanup()
-      }
-    },
-  )
-
-  // Finite success is not authority to repair a newer full-source failure.
-  // Cross settlement order with both outcomes instead of testing each alone.
-  // An invalidation while the first page is still in flight comes before any
-  // request has settled, so the loader still recovers from the full source.
-  // An overlap after the source has settled once repairs with a bounded
-  // prefix instead; the next property owns that case.
-  it.each(
-    ([`older-first`, `full-first`] as const).flatMap((order) =>
-      ([`success`, `failure`] as const).flatMap((outcome) =>
-        ([`success`, `failure`] as const).map((olderOutcome) => ({
-          order,
-          outcome,
-          olderOutcome,
-        })),
-      ),
-    ),
-  )(
-    `keeps full-source recovery authoritative across an initial page overlap: %j`,
-    async ({ order, outcome, olderOutcome }) => {
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const participants: Array<Promise<unknown>> = []
-      const subscription = fakeSubscription(requests, releases)
-      subscription.readOrderedSnapshot = () => [
-        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-      ]
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo(),
-        subscription,
-        `row`,
-        (result) => {
-          if (result instanceof Promise) participants.push(result)
-        },
-      )
-      try {
-        loader.start()
-        const olderIndex = requests.length - 1
-        loader.invalidateSourceOrdering()
-        loader.loadMore()
-        const fullIndex = olderIndex + 1
-        const count = fullIndex + 1
-        expect(requests).toHaveLength(count)
-        expect(requests[fullIndex]!.options.orderBy).toBeUndefined()
-        expect(requests[fullIndex]!.options.where).toBeUndefined()
-        const failure = new Error(`full-source failed`)
-        const olderFailure = new Error(`older request failed`)
-        const settleOlder = async () => {
-          if (olderOutcome === `failure`) {
-            requests[olderIndex]!.deferred.reject(olderFailure)
-            await expect(participants[olderIndex]).rejects.toBe(olderFailure)
-          } else {
-            requests[olderIndex]!.deferred.resolve()
-            await participants[olderIndex]
-          }
-          expect(requests).toHaveLength(count)
-        }
-        const settleFull = async () => {
-          if (outcome === `failure`) {
-            requests[fullIndex]!.deferred.reject(failure)
-            await expect(participants[fullIndex]).rejects.toBe(failure)
-          } else {
-            requests[fullIndex]!.deferred.resolve()
-            await participants[fullIndex]
-          }
-          expect(requests).toHaveLength(count)
-        }
-        if (order === `older-first`) {
-          await settleOlder()
-          await settleFull()
-        } else {
-          await settleFull()
-          await settleOlder()
-        }
-        loader.loadMore()
-        expect(requests).toHaveLength(count)
-        // A successful full-source read retires every settled finite demand.
-        // It also retires the older request when that request failed: the
-        // full-source read superseded it, so its partial writes are covered
-        // and its lease needs no explicit retry.
-        const successfulFinite =
-          outcome === `success`
-            ? requests.slice(0, fullIndex).map(({ acquisition }) => acquisition)
-            : []
-        expect(releases).toEqual(successfulFinite)
-
-        // An explicit retry releases the failed demands that remain, in
-        // failure order: all of them when the full-source read failed.
-        loader.loadMore(1)
-        const failedIndices =
-          outcome === `success`
-            ? []
-            : (order === `older-first`
-                ? [olderIndex, fullIndex]
-                : [fullIndex, olderIndex]
-              ).filter(
-                (index) =>
-                  (index === olderIndex ? olderOutcome : outcome) === `failure`,
-              )
-        expect(releases).toEqual([
-          ...successfulFinite,
-          ...failedIndices.map((index) => requests[index]!.acquisition),
-        ])
-        if (outcome === `failure`) {
-          expect(requests).toHaveLength(count + 1)
-          loader.loadMore(1)
-          expect(requests).toHaveLength(count + 1)
-          requests[count]!.deferred.resolve()
-          await participants[count]
-        } else expect(requests).toHaveLength(count)
-      } finally {
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-        await Promise.allSettled(participants)
-      }
-    },
-  )
-
-  // An invalidation that overlaps an in-flight tie request, after the source
-  // has settled once, repairs with a bounded prefix: full-source reads can be
-  // very expensive, and the bounded repair sets its boundary from its own
-  // settled requests. The older tie's later success is ignored for that
-  // boundary. When both succeed, the repair chain runs to its fixed point and
-  // retires exactly the acquisitions it replaced, once each, with no
-  // full-source request. When the repair succeeds but the older tie fails,
-  // the tie's partial writes need the full-source read that the overlap
-  // replaced, so the loader starts it at once, in either settlement order,
-  // and needs no explicit retry; on main, the overlapping full-source read
-  // recovered this case. When the repair itself fails, today's failure law
-  // holds: nothing retries eagerly, and an explicit retry releases exactly
-  // the failed acquisitions, in failure order, and recovers from the full
-  // source.
-  it.each(
-    ([`older-first`, `repair-first`] as const).flatMap((order) =>
-      ([`success`, `failure`] as const).flatMap((outcome) =>
-        ([`success`, `failure`] as const).map((olderOutcome) => ({
-          order,
-          outcome,
-          olderOutcome,
-        })),
-      ),
-    ),
-  )(
-    `repairs a tie overlap with a bounded prefix: %j`,
-    async ({ order, outcome, olderOutcome }) => {
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const participants: Array<Promise<unknown>> = []
-      const subscription = fakeSubscription(requests, releases)
-      subscription.readOrderedSnapshot = () => [
-        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-      ]
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo(),
-        subscription,
-        `row`,
-        (result) => {
-          if (result instanceof Promise) {
-            participants.push(result.catch(() => undefined))
-          }
-        },
-      )
-      const flush = async () => {
-        for (let turn = 0; turn < 5; turn++) await Promise.resolve()
-      }
-      const settle = async (index: number, succeeds: boolean) => {
-        if (succeeds) requests[index]!.deferred.resolve()
-        else requests[index]!.deferred.reject(new Error(`request failed`))
-        await flush()
-      }
-      const isFullSource = ({ options }: Observed) =>
-        options.orderBy === undefined && options.where === undefined
-      try {
-        loader.start()
-        await settle(0, true)
-        expect(requests).toHaveLength(2)
-        expect(requests[1]!.options.where).toBeDefined()
-        const olderIndex = 1
-        loader.invalidateSourceOrdering()
-        loader.loadMore()
-        const repairIndex = 2
-        expect(requests).toHaveLength(3)
-        expect(requests[repairIndex]!.options.orderBy).toBeDefined()
-        expect(requests[repairIndex]!.options.limit).toBe(1)
-        expect(requests[repairIndex]!.options.where).toBeUndefined()
-
-        const settleOlder = () => settle(olderIndex, olderOutcome === `success`)
-        const settleRepair = () => settle(repairIndex, outcome === `success`)
-        if (order === `older-first`) {
-          await settleOlder()
-          await settleRepair()
-        } else {
-          await settleRepair()
-          await settleOlder()
-        }
-
-        if (outcome === `success` && olderOutcome === `success`) {
-          // Run the repair chain to its fixed point.
-          for (let index = repairIndex + 1; index < requests.length; index++) {
-            await settle(index, true)
-          }
-          const settled = requests.length
-          expect(settled).toBeGreaterThan(repairIndex + 1)
-          expect(requests.some(isFullSource)).toBe(false)
-          expect(releases).toEqual([
-            requests[0]!.acquisition,
-            requests[olderIndex]!.acquisition,
-          ])
-          loader.loadMore()
-          loader.loadMore(1)
-          expect(requests).toHaveLength(settled)
-          expect(releases).toHaveLength(2)
-          return
-        }
-
-        if (outcome === `success`) {
-          // The older tie failed: the loader recovers from the full source.
-          for (let index = repairIndex + 1; index < requests.length; index++) {
-            if (isFullSource(requests[index]!)) break
-            await settle(index, true)
-          }
-          const full = requests.findIndex(isFullSource)
-          expect(full).toBeGreaterThan(repairIndex)
-          expect(requests.filter(isFullSource)).toHaveLength(1)
-          await settle(full, true)
-          const settled = requests.length
-          loader.loadMore()
-          expect(requests).toHaveLength(settled)
-          return
-        }
-
-        // The repair failed: nothing retries eagerly. Repair-chain work
-        // already in flight settles first; an explicit retry then waits for
-        // no request.
-        for (let index = repairIndex + 1; index < requests.length; index++) {
-          await settle(index, true)
-        }
-        const before = requests.length
-        loader.loadMore()
-        expect(requests).toHaveLength(before)
-        expect(requests.some(isFullSource)).toBe(false)
-        const failed = (
-          order === `older-first`
-            ? [olderIndex, repairIndex]
-            : [repairIndex, olderIndex]
-        ).filter(
-          (index) =>
-            (index === olderIndex ? olderOutcome : outcome) === `failure`,
-        )
-        const releasedBeforeRetry = releases.length
-        loader.loadMore(1)
-        expect(releases.slice(releasedBeforeRetry)).toEqual(
-          failed.map((index) => requests[index]!.acquisition),
-        )
-        expect(requests).toHaveLength(before + 1)
-        expect(isFullSource(requests[before]!)).toBe(true)
-      } finally {
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-        await Promise.allSettled(participants)
-      }
-    },
-  )
-
-  // A request that a bounded repair superseded can fail after that repair
-  // has finished and after a newer ordering invalidation. The failure law
-  // lets the loader's own failure block ordinary refills until an explicit
-  // retry. A superseded request's failure is not the loader's own: its
-  // partial writes need the full-source read that the overlap replaced, and
-  // nothing else will start one. Here the newer invalidation's reaction is
-  // deferred, as pending joined work or a later graph run can defer it, so
-  // the old tie fails first. The next ordinary pass must still recover.
-  // Found by a TLA+ model of the loader's request authority (#2191).
-  it(`recovers a superseded tie that fails after its repair and a newer invalidation`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const participants: Array<Promise<unknown>> = []
-    const subscription = fakeSubscription(requests, releases)
-    subscription.readOrderedSnapshot = () => [
-      { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-    ]
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      subscription,
-      `row`,
-      (result) => {
-        if (result instanceof Promise) {
-          participants.push(result.catch(() => undefined))
-        }
-      },
-    )
-    const flush = async () => {
-      for (let turn = 0; turn < 5; turn++) await Promise.resolve()
-    }
-    const isFullSource = ({ options }: Observed) =>
-      options.orderBy === undefined && options.where === undefined
-    try {
-      loader.start()
-      requests[0]!.deferred.resolve()
-      await flush()
-      const tieIndex = 1
-      expect(requests[tieIndex]!.options.where).toBeDefined()
-
-      // The repair supersedes the in-flight tie and runs to its fixed point.
-      loader.invalidateSourceOrdering()
-      loader.loadMore()
-      const repairIndex = 2
-      expect(requests[repairIndex]!.options.where).toBeUndefined()
-      for (let index = repairIndex; index < requests.length; index++) {
-        requests[index]!.deferred.resolve()
-        await flush()
-      }
-      expect(requests.some(isFullSource)).toBe(false)
-
-      // A newer invalidation arrives; the loader's reaction is deferred.
-      loader.invalidateSourceOrdering()
-      const before = requests.length
-      requests[tieIndex]!.deferred.reject(new Error(`tie failed`))
-      await flush()
-      loader.loadMore()
-      // One full-source read recovers it, with no explicit retry.
-      expect(requests.slice(before).filter(isFullSource)).toHaveLength(1)
-    } finally {
-      loader.dispose()
-      for (const request of requests) request.deferred.resolve()
-      await Promise.allSettled(participants)
-    }
-  })
-
-  // The same overlap with an in-flight prefix read. A prefix acquisition
-  // normally supersedes every smaller settled prefix, because it covers their
-  // rows. A prefix issued before an ordering invalidation proves no current
-  // coverage, so its later result is ignored for the boundary, and for the
-  // same reason it must not release the repair's acquisitions. A refetching
-  // provider removes the rows only a released request holds, so releasing the
-  // repair's prefix can drop a row the stale read never saw. The stale prefix
-  // itself is superseded by the repair, so it is released too, in either
-  // settlement order; holding it would make every later refetch read it.
-  it.each([`older-first`, `repair-first`] as const)(
-    `keeps the repair's prefix when an older prefix read settles %s`,
-    async (order) => {
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const participants: Array<Promise<unknown>> = []
-      const subscription = fakeSubscription(requests, releases)
-      subscription.readOrderedSnapshot = () => [
-        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-      ]
-      const info = createOrderByInfo({ index: undefined, dataNeeded: () => 0 })
-      const loader = new OrderedSourceLoader(
-        info,
-        subscription,
-        `row`,
-        (result) => {
-          if (result instanceof Promise) {
-            participants.push(result.catch(() => undefined))
-          }
-        },
-      )
-      const flush = async () => {
-        for (let turn = 0; turn < 5; turn++) await Promise.resolve()
-      }
-      const settle = async (index: number) => {
-        requests[index]!.deferred.resolve()
-        await flush()
-      }
-      const isPrefix = ({ options }: Observed) =>
-        options.orderBy !== undefined && options.cursor === undefined
-      try {
-        loader.start()
-        for (let index = 0; index < requests.length; index++) {
-          await settle(index)
-        }
-        const initial = requests.length
-
-        // A window move reads a longer prefix; it is still in flight when an
-        // order change invalidates the source.
-        info.limit = 3
-        loader.loadMore(1)
-        expect(requests).toHaveLength(initial + 1)
-        const olderIndex = initial
-        expect(requests[olderIndex]!.options.limit).toBe(3)
-        loader.invalidateSourceOrdering()
-        loader.loadMore()
-        const repairIndex = initial + 1
-        expect(requests).toHaveLength(initial + 2)
-        expect(requests[repairIndex]!.options).toMatchObject({
-          refetch: true,
-          limit: 3,
-        })
-
-        const runRepair = async () => {
-          for (let index = repairIndex; index < requests.length; index++) {
-            if (index !== olderIndex) await settle(index)
-          }
-        }
-        if (order === `older-first`) {
-          await settle(olderIndex)
-          await runRepair()
-        } else {
-          await runRepair()
-          await settle(olderIndex)
-        }
-
-        const repairAcquisitions = requests
-          .slice(repairIndex)
-          .map(({ acquisition }) => acquisition)
-        expect(requests.slice(repairIndex).filter(isPrefix)).toHaveLength(1)
-        expect(
-          releases.filter((release) => repairAcquisitions.includes(release)),
-        ).toEqual([])
-        expect(releases).toEqual(
-          expect.arrayContaining(
-            requests.slice(0, initial).map(({ acquisition }) => acquisition),
-          ),
-        )
-
-        // A stale prefix that settles after the repair finished is already
-        // superseded, so it is released at once. One that settled first is
-        // covered by the repair's own retirement.
-        expect(releases).toContain(requests[olderIndex]!.acquisition)
-
-        // A later repair still runs normally.
-        loader.invalidateSourceOrdering()
-        loader.loadMore()
-        for (let index = 0; index < requests.length; index++) {
-          await settle(index)
-        }
-        expect(releases).toContain(requests[olderIndex]!.acquisition)
-      } finally {
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-        await Promise.allSettled(participants)
-      }
-    },
-  )
-
-  // When a bounded repair finishes, it releases the acquisitions it
-  // superseded. A refetching provider then removes the rows only those
-  // acquisitions held, and the loader sees a delete of a row it sent. That
-  // removal is the repair's own retirement, not a source change: every row
-  // through the repair's boundary is held by the repair. The repair's
-  // boundary must survive it. Otherwise the loader restarts paging from the
-  // start of the order with a smaller first page that cannot retire the
-  // repair's larger prefix, and every later refetch reads both prefixes.
-  // Law: once a chain settles, the loader holds at most one acquisition that
-  // reads from the start of the order.
-  it(`keeps a repair's boundary when its retirement removes a row the loader sent`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const participants: Array<Promise<unknown>> = []
-    let removedOnRelease = false
-    // Releasing the first tie request removes row 9, which only it held.
-    const subscription = fakeSubscription(requests, releases, () => {
-      if (removedOnRelease || releases.at(-1)?.where === undefined) return
-      removedOnRelease = true
-      const row = { id: 9, rank: 2 }
-      loader.onSourceChanges(
-        [{ type: `delete`, key: 9, value: row }],
-        new Map([[9, row]]),
-        () => false,
-      )
-    })
-    subscription.readOrderedSnapshot = () => [
-      { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-      { type: `insert`, key: 2, value: { id: 2, rank: 2 } },
-    ]
-    let needed = 0
-    const info = createOrderByInfo({ limit: 2, dataNeeded: () => needed })
-    const loader = new OrderedSourceLoader(
-      info,
-      subscription,
-      `row`,
-      (result) => {
-        if (result instanceof Promise) {
-          participants.push(result.catch(() => undefined))
-        }
-      },
-    )
-    const settleAll = async () => {
-      for (let index = 0; index < requests.length; index++) {
-        requests[index]!.deferred.resolve()
-        for (let turn = 0; turn < 5; turn++) await Promise.resolve()
-      }
-    }
-    const heldPrefixes = () =>
-      requests.filter(
-        ({ options, acquisition }) =>
-          options.orderBy !== undefined &&
-          options.where === undefined &&
-          options.minValues === undefined &&
-          !releases.includes(acquisition),
-      )
-    try {
-      loader.start()
-      await settleAll()
-      expect(heldPrefixes()).toHaveLength(1)
-
-      loader.invalidateSourceOrdering()
-      loader.loadMore()
-      await settleAll()
-      expect(removedOnRelease).toBe(true)
-      expect(heldPrefixes()).toHaveLength(1)
-
-      // The window now needs one more row. It continues after the repair's
-      // boundary instead of restarting from the start of the order.
-      needed = 1
-      const before = requests.length
-      loader.loadMore()
-      await settleAll()
-      expect(requests.length).toBeGreaterThan(before)
-      expect(requests[before]!.options.minValues).toEqual([2])
-      expect(heldPrefixes()).toHaveLength(1)
-    } finally {
-      loader.dispose()
-      for (const request of requests) request.deferred.resolve()
-      await Promise.allSettled(participants)
-    }
-  })
-
-  // A provider can answer a request synchronously, as Query DB does when it
-  // reacquires a released Query from its cache. Its writes run a graph turn
-  // inside the request; that turn asks the loader for more, but the loader
-  // is still requesting and ignores it. The continuation it then stages has
-  // no later graph turn to resume it. When a turn has already processed the
-  // request's writes, the loader must continue at once, or a short window
-  // stops paging and treats unread rows as loaded.
-  it(`continues a chain whose synchronous answer the graph already processed`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    let revision = 0
-    const subscription = fakeSubscription(requests, releases)
-    const asyncRequest = subscription.requestSnapshot
-    subscription.readOrderedSnapshot = () => [
-      { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-    ]
-    // Tie requests answer synchronously: they write a row, the graph turn
-    // processes it and asks for more, and the request returns `true`.
-    subscription.requestSnapshot = ((options: RequestOptions) => {
-      if (options.where === undefined) {
-        asyncRequest(options)
-        return
-      }
-      const acquisition: LoadSubsetOptions = { where: options.where }
-      requests.push({
-        method: `snapshot`,
-        options,
-        acquisition,
-        deferred: createDeferred(),
-      })
-      revision++
-      loader.loadMore()
-      options.onLoadSubsetResult?.(true, acquisition, () => {
-        releases.push(acquisition)
-      })
-    }) as typeof subscription.requestSnapshot
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ limit: 3, dataNeeded: () => 1 }),
-      subscription,
-      `row`,
-      () => {},
-      () => false,
-      () => revision,
-    )
-    try {
-      loader.start()
-      requests[0]!.deferred.resolve()
-      await flushPromises()
-      expect(
-        requests.map(({ options }) => options.where !== undefined),
-      ).toEqual([false, true, false])
-      expect(requests[2]!.options.minValues).toEqual([1])
-    } finally {
-      loader.dispose()
-      for (const request of requests) request.deferred.resolve()
-      await flushPromises()
-    }
-  })
-
-  it.each(
-    [false, true].flatMap((fullFirst) =>
-      [false, true].flatMap((replayed) =>
-        [false, true].map((releaseThrows) => ({
-          fullFirst,
-          replayed,
-          releaseThrows,
-        })),
-      ),
-    ),
-  )(
-    `releases each failed lease once, at a covering replay or the explicit retry: %j`,
-    async ({ fullFirst, replayed, releaseThrows }) => {
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const participants: Array<Promise<unknown>> = []
-      const cleanupError = new Error(`release failed`)
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo(),
-        fakeSubscription(requests, releases, () => {
-          if (releaseThrows) throw cleanupError
-        }),
-        `row`,
-        (result) => {
-          if (result instanceof Promise) participants.push(result)
-        },
-      )
-      const uncaught = captureMicrotaskErrors()
-      try {
-        loader.start()
-        loader.invalidateSourceOrdering()
-        loader.loadMore()
-        expect(requests).toHaveLength(2)
-        const order = fullFirst ? [1, 0] : [0, 1]
-        for (const index of order) {
-          const failure = new Error(`request ${index} failed`)
-          requests[index]!.deferred.reject(failure)
-          await expect(participants[index]).rejects.toBe(failure)
-        }
-        // A replay covers the source like a full-source success, so it
-        // releases the superseded page itself. Without a replay, the explicit
-        // retry releases both. A throwing release is reported uncaught.
-        if (replayed) loader.settleFullSourceReplay()
-        loader.loadMore(1)
-        await flushPromises()
-        const expected = order
-          .filter((index) => !replayed || index === 0)
-          .map((index) => requests[index]!.acquisition)
-        expect(releases).toEqual(expected)
-        // Each throwing release is reported uncaught, exactly once.
-        expect(uncaught.errors).toEqual(
-          releaseThrows ? releases.map(() => cleanupError) : [],
-        )
-        loader.loadMore(2)
-        expect(releases).toEqual(expected)
-        expect(requests).toHaveLength(replayed ? 2 : 3)
-      } finally {
-        uncaught.restore()
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-        await Promise.allSettled(participants)
-      }
-    },
-  )
-
-  it(`a page failure while a full-source demand is held releases only the page`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo(),
-      fakeSubscription(requests, releases),
-      `row`,
-    )
-    loader.start()
-    const page = (
-      loader as unknown as { pending: Promise<unknown> | undefined }
-    ).pending!
-    expect(requests.map(({ method }) => method)).toEqual([`limited`])
-
-    // A delete during the in-flight page requires authoritative repair.
-    loader.invalidateSourceOrdering()
-    loader.loadMore()
-    expect(requests.map(({ method }) => method)).toEqual([
-      `limited`,
-      `snapshot`,
-    ])
-    expect(requests[1]!.options.limit).toBeUndefined()
-    const fullSource = (
-      loader as unknown as { pending: Promise<unknown> | undefined }
-    ).pending!
-    expect(fullSource).not.toBe(page)
-
-    const failure = new Error(`page rejected`)
-    requests[0]!.deferred.reject(failure)
-    await expect(page).rejects.toBe(failure)
-
-    // Blocked automatic retry; explicit retry releases the page only and must
-    // not issue a duplicate full-source demand while one is already held.
-    expect(loader.loadMore()).toBe(fullSource)
-    expect(requests).toHaveLength(2)
-    expect(releases).toEqual([])
-    expect(loader.loadMore(1)).toBe(fullSource)
-    expect(releases).toEqual([requests[0]!.acquisition])
-    expect(requests).toHaveLength(2)
-
-    requests[1]!.deferred.resolve()
-    await fullSource
-    expect(loader.loadMore(2)).toBeUndefined()
-    expect(requests).toHaveLength(2)
-    expect(releases).toEqual([requests[0]!.acquisition])
-    loader.dispose()
-  })
-
-  it(`sync full-source failure retains no demand: replay settle is a no-op and retry reissues once`, () => {
-    const releases: Array<LoadSubsetOptions> = []
-    const methods: Array<string> = []
-    const failure = new Error(`full-source threw after callback`)
-    const acquisition: LoadSubsetOptions = {}
-    let fail = true
-    const subscription = {
-      setOrderByIndex: () => {},
-      requestSnapshot: (options: RequestOptions) => {
-        methods.push(`snapshot`)
-        if (!fail) return
-        fail = false
-        options.onLoadSubsetResult?.(true, acquisition, () =>
-          releases.push(acquisition),
-        )
-        throw failure
-      },
-    } as unknown as CollectionSubscription
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ requiresFullSource: true }),
-      subscription,
-      `row`,
-    )
-    expect(() => loader.start()).toThrow(failure)
-    expect(releases).toEqual([acquisition])
-    expect(methods).toEqual([`snapshot`])
-
-    loader.settleFullSourceReplay()
-    expect(loader.loadMore()).toBeUndefined()
-    expect(methods).toEqual([`snapshot`])
-
-    loader.loadMore(1)
-    expect(methods).toEqual([`snapshot`, `snapshot`])
-    expect(releases).toEqual([acquisition])
-    loader.dispose()
-  })
-
-  it(`replay repairs a failed full-source demand: a later explicit retry releases nothing`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ requiresFullSource: true }),
-      fakeSubscription(requests, releases),
-      `row`,
-    )
-    loader.start()
-    const pending = (
-      loader as unknown as { pending: Promise<unknown> | undefined }
-    ).pending!
-    const failure = new Error(`full-source rejected`)
-    requests[0]!.deferred.reject(failure)
-    await expect(pending).rejects.toBe(failure)
-    expect(requests).toHaveLength(1)
-
-    loader.settleFullSourceReplay()
-    expect(loader.loadMore(1)).toBeUndefined()
-    expect(releases).toEqual([])
-    expect(requests).toHaveLength(1)
-    expect(loader.loadMore(2)).toBeUndefined()
-    expect(requests).toHaveLength(1)
-    loader.dispose()
-  })
-
-  it(`without replay the explicit retry releases and reissues exactly once`, async () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const loader = new OrderedSourceLoader(
-      createOrderByInfo({ requiresFullSource: true }),
-      fakeSubscription(requests, releases),
-      `row`,
-    )
-    loader.start()
-    const pending = (
-      loader as unknown as { pending: Promise<unknown> | undefined }
-    ).pending!
-    requests[0]!.deferred.reject(new Error(`full-source rejected`))
-    await expect(pending).rejects.toThrow(`full-source rejected`)
-
-    loader.loadMore(1)
-    expect(releases).toEqual([requests[0]!.acquisition])
-    expect(requests).toHaveLength(2)
-    loader.loadMore(1)
-    expect(requests).toHaveLength(2)
-    loader.dispose()
-  })
-
-  it(`a zero window opening with an offset requests the whole prefix from zero`, () => {
-    const requests: Array<Observed> = []
-    const releases: Array<LoadSubsetOptions> = []
-    const info = createOrderByInfo({ offset: 2, limit: 0 })
-    // Production dataNeeded is limit - topK size; it never adds the offset.
-    info.dataNeeded = () => info.limit
-    const loader = new OrderedSourceLoader(
-      info,
-      fakeSubscription(requests, releases),
-      `row`,
-    )
-    loader.start()
-    expect(requests).toHaveLength(0)
-
-    info.limit = 3
-    loader.loadMore(1)
-    expect(requests).toHaveLength(1)
-    expect(requests[0]!.method).toBe(`limited`)
-    expect(requests[0]!.options.limit).toBe(5)
-    expect(requests[0]!.options.offset).toBe(0)
-    expect(requests[0]!.options.minValues).toBeUndefined()
-    loader.dispose()
-  })
-
-  it(`a failed window move keeps the snapshot; the retry loads the source once`, async () => {
-    type Row = { id: number; rank: number }
-    const truth: Array<Row> = [1, 2, 3, 4, 5, 6].map((id) => ({ id, rank: id }))
-    const failure = new Error(`page rejected`)
-    const requests: Array<{ kind: string; options: LoadSubsetOptions }> = []
-    const unloads: Array<LoadSubsetOptions> = []
-    let failNextCursor = false
-    const kindOf = (options: LoadSubsetOptions) =>
-      options.orderBy !== undefined
-        ? options.cursor
-          ? `cursor-page`
-          : `page`
-        : options.where !== undefined
-          ? `boundary`
-          : `full`
-    const source = createCollection<Row, number>({
-      id: `cut-c-probe-source`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (sync) => {
-          const installed = new Set<number>()
-          sync.markReady()
-          return {
-            loadSubset: (options) => {
-              requests.push({ kind: kindOf(options), options })
-              if (options.cursor && failNextCursor) {
-                failNextCursor = false
-                return Promise.reject(failure)
-              }
-              let rows = truth.filter(
-                (row) =>
-                  !options.where ||
-                  evaluateReferenceExpression(options.where, row) === true,
-              )
-              if (options.cursor)
-                rows = rows.filter(
-                  (row) =>
-                    evaluateReferenceExpression(
-                      options.cursor!.whereFrom,
-                      row,
-                    ) === true,
-                )
-              const offset = options.cursor ? 0 : (options.offset ?? 0)
-              rows = rows.slice(
-                offset,
-                options.limit === undefined
-                  ? undefined
-                  : offset + options.limit,
-              )
-              return (async () => {
-                await Promise.resolve()
-                const fresh = rows.filter(({ id }) => !installed.has(id))
-                if (fresh.length === 0) return
-                sync.begin()
-                for (const value of fresh) {
-                  installed.add(value.id)
-                  sync.write({ type: `insert`, value })
-                }
-                const receipt = sync.commit()
-                if (receipt !== true) await receipt
-              })()
-            },
-            unloadSubset: (options) => {
-              unloads.push(options)
-            },
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ row: source })
-        .orderBy(({ row }) => row.rank)
-        .limit(2)
-        .select(({ row }) => ({ id: row.id, rank: row.rank })),
-    )
-    const publications: Array<Array<number>> = []
-    live.subscribeChanges(
-      (batch) => {
-        if (batch.length > 0)
-          publications.push(live.toArray.map(({ id }) => id))
-      },
-      { includeInitialState: false },
-    )
-    try {
-      await live.preload()
-      expect(live.toArray.map(({ id }) => id)).toEqual([1, 2])
-      expect(requests.map(({ kind }) => kind)).toEqual([`page`, `boundary`])
-      expect(unloads).toEqual([])
-      const initialRequests = requests.length
-      publications.length = 0
-
-      failNextCursor = true
-      const move = live.utils.setWindow({ limit: 4 })
-      expect(move).not.toBe(true)
-      await expect(move).rejects.toBe(failure)
-      await flushPromises()
-      // Rows: last settled snapshot; events: none; wait: rejected; requests: one.
-      expect(live.toArray.map(({ id }) => id)).toEqual([1, 2])
-      expect(publications).toEqual([])
-      expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
-      expect(requests.slice(initialRequests).map(({ kind }) => kind)).toEqual([
-        `cursor-page`,
-      ])
-      expect(unloads).toEqual([])
-      expect(live.status).not.toBe(`error`)
-
-      const retry = live.utils.setWindow({ limit: 4 })
-      expect(retry).not.toBe(true)
-      await retry
-      await flushPromises()
-      expect(live.toArray.map(({ id }) => id)).toEqual([1, 2, 3, 4])
-      expect(publications).toEqual([[1, 2, 3, 4]])
-      expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 4 })
-      expect(requests.slice(initialRequests).map(({ kind }) => kind)).toEqual([
-        `cursor-page`,
-        `full`,
-      ])
-      // Retry retires the failed page; successful repair then retires earlier
-      // finite demands while keeping the new authoritative demand.
-      expect(unloads).toEqual([
-        requests[initialRequests]!.options,
-        ...requests.slice(0, initialRequests).map(({ options }) => options),
-      ])
-
-      await flushPromises()
-      expect(requests).toHaveLength(initialRequests + 2)
-    } finally {
-      await live.cleanup()
-      await source.cleanup()
-    }
-  })
-})
-
-describe(`Successful finite demand retirement`, () => {
-  it.each([`none`, `throw`, `truncate`, `dispose`] as const)(
-    `attempts releases once across %s reentry`,
-    async (action) => {
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const participants: Array<Promise<unknown>> = []
-      const failure = new Error(`release failed`)
-      let first = true
-      const subscription = fakeSubscription(requests, releases, () => {
-        if (!first) return
-        first = false
-        if (action === `throw`) throw failure
-        if (action === `truncate`) loader.resetCursor()
-        if (action === `dispose`) loader.dispose()
-      })
-      subscription.readOrderedSnapshot = () => [
-        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
-      ]
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo({ dataNeeded: () => 0 }),
-        subscription,
-        `row`,
-        (result) => {
-          if (result instanceof Promise) participants.push(result)
-        },
-      )
-      const uncaught = captureMicrotaskErrors()
-      try {
-        loader.start()
-        requests[0]!.deferred.resolve()
-        await participants[0]
-        requests[1]!.deferred.resolve()
-        await participants[1]
-        loader.invalidateSourceOrdering()
-        loader.loadMore()
-        requests[2]!.deferred.resolve()
-        await participants[2]
-        requests[3]!.deferred.resolve()
-        // A throwing release is reported uncaught; the load still settles.
-        await participants[3]
-        await flushPromises()
-        expect(uncaught.errors).toEqual(action === `throw` ? [failure] : [])
-        expect(releases).toEqual(
-          requests
-            .slice(0, action === `truncate` || action === `dispose` ? 1 : 2)
-            .map(({ acquisition }) => acquisition),
-        )
-        if (action === `truncate`) {
-          loader.settleFullSourceReplay()
-          expect(releases).toEqual(
-            requests.slice(0, 2).map(({ acquisition }) => acquisition),
-          )
-        }
-        loader.loadMore(1)
-        expect(new Set(releases).size).toBe(releases.length)
-        expect(requests).toHaveLength(4)
-      } finally {
-        uncaught.restore()
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-        await Promise.allSettled(participants)
-      }
-    },
-  )
-
-  it.each([`before-replay`, `after-replay`] as const)(
-    `keeps unfinished physical work observed when it settles %s`,
-    async (when) => {
-      const requests: Array<Observed> = []
-      const releases: Array<LoadSubsetOptions> = []
-      const participants: Array<Promise<unknown>> = []
-      const subscription = fakeSubscription(requests, releases)
-      let replaying = false
-      Object.defineProperty(subscription, `hasPendingTruncateReplacement`, {
-        get: () => replaying,
-      })
-      const loader = new OrderedSourceLoader(
-        createOrderByInfo(),
-        subscription,
-        `row`,
-        (result) => {
-          if (result instanceof Promise) participants.push(result)
-        },
-      )
-      try {
-        loader.start()
-        replaying = true
-        loader.resetCursor()
-        loader.loadFullSource()
-        requests[1]!.deferred.resolve()
-        await participants[1]
-        expect(releases).toEqual([])
-        const settlePage = async () => {
-          requests[0]!.deferred.resolve()
-          await participants[0]
-        }
-        if (when === `before-replay`) {
-          await settlePage()
-          expect(releases).toEqual([])
-        }
-        replaying = false
-        loader.settleFullSourceReplay()
-        if (when === `after-replay`) {
-          expect(releases).toEqual([])
-          await settlePage()
-        }
-        expect(releases).toEqual([requests[0]!.acquisition])
-      } finally {
-        loader.dispose()
-        for (const request of requests) request.deferred.resolve()
-        await Promise.allSettled(participants)
-      }
-    },
-  )
-})
+  Observed,
+  RequestOptions,
+} from './ordered-source-loader-state-support.js'
 
 /**
  * # Request authority under generated settlement orders
@@ -3237,6 +1486,15 @@ const authorityCampaigns =
       ? ([`replay`] as const)
       : ([] as const)
 
+// The authority law is checked by checkAuthorityCase: it runs one generated or
+// replayed history through the real loader and compares each observation with
+// the request ledger. The grammar is authorityCaseArbitrary, which the campaigns
+// and the calibration witnesses below read for coverage.
+declareOracle({
+  check: [checkAuthorityCase],
+  grammar: [authorityCaseArbitrary],
+})
+
 describe(`Ordered source request authority`, () => {
   // The model's strand trace: a repair supersedes the in-flight tie and
   // finishes; a newer invalidation's reaction is deferred; the old tie fails.
diff --git a/packages/db/tests/query/ordered-source-loader-state-support.ts b/packages/db/tests/query/ordered-source-loader-state-support.ts
new file mode 100644
index 0000000000..5c150852ba
--- /dev/null
+++ b/packages/db/tests/query/ordered-source-loader-state-support.ts
@@ -0,0 +1,57 @@
+// Shared fakes for the OrderedSourceLoader state tests: the ordered-window
+// request options, the observed request record, and a fake subscription that
+// records each request. The deferred promise and the order-by info come from
+// ordered-source-loader-support.ts. The request-authority laws are owned by
+// ordered-source-loader-state-oracle.test.ts.
+import { createDeferred } from './ordered-source-loader-support.js'
+import type {
+  CollectionSubscription,
+  ReleaseLoadSubset,
+} from '../../src/collection/subscription.js'
+import type {
+  LoadSubsetOptions,
+  LoadSubsetRequestResult,
+} from '../../src/types.js'
+
+export type RequestOptions = LoadSubsetOptions & {
+  minValues?: Array<unknown>
+  onLoadSubsetResult?: (
+    result: LoadSubsetRequestResult,
+    acquisition: LoadSubsetOptions,
+    release: ReleaseLoadSubset,
+  ) => void
+}
+
+export type Observed = {
+  method: `limited` | `snapshot`
+  options: RequestOptions
+  acquisition: LoadSubsetOptions
+  deferred: ReturnType<typeof createDeferred>
+}
+
+export function fakeSubscription(
+  requests: Array<Observed>,
+  releases: Array<LoadSubsetOptions>,
+  onRelease: () => void = () => {},
+) {
+  const request = (method: Observed[`method`], options: RequestOptions) => {
+    const acquisition: LoadSubsetOptions = {
+      orderBy: options.orderBy,
+      limit: options.limit,
+      where: options.where,
+    }
+    const deferred = createDeferred()
+    requests.push({ method, options, acquisition, deferred })
+    options.onLoadSubsetResult?.(deferred.promise, acquisition, () => {
+      releases.push(acquisition)
+      onRelease()
+    })
+  }
+  return {
+    readOrderedSnapshot: () => [],
+    setOrderByIndex: () => {},
+    requestLimitedSnapshot: (options: RequestOptions) =>
+      request(`limited`, options),
+    requestSnapshot: (options: RequestOptions) => request(`snapshot`, options),
+  } as unknown as CollectionSubscription
+}
diff --git a/packages/db/tests/query/ordered-source-loader-state.test.ts b/packages/db/tests/query/ordered-source-loader-state.test.ts
new file mode 100644
index 0000000000..a633d793cb
--- /dev/null
+++ b/packages/db/tests/query/ordered-source-loader-state.test.ts
@@ -0,0 +1,1690 @@
+// Scripted tests for the OrderedSourceLoader's request ownership and finite demand
+// retirement. Each test replays one fixed sequence of settlements and checks the
+// literal requests, releases, and windows it expects, so these are unit tests.
+// The generated request-authority laws are owned by
+// ordered-source-loader-state-oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import { createLiveQueryCollection } from '../../src/query/index.js'
+import { OrderedSourceLoader } from '../../src/query/live/ordered-source-loader.js'
+import { PropRef } from '../../src/query/ir.js'
+import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
+import { captureMicrotaskErrors, flushPromises } from '../utils.js'
+import {
+  createDeferred,
+  createOrderByInfo,
+} from './ordered-source-loader-support.js'
+import { fakeSubscription } from './ordered-source-loader-state-support.js'
+import type { CollectionSubscription } from '../../src/collection/subscription.js'
+import type { OrderByOptimizationInfo } from '../../src/query/compiler/order-by.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+import type {
+  Observed,
+  RequestOptions,
+} from './ordered-source-loader-state-support.js'
+
+describe(`Ordered source request ownership`, () => {
+  // A request from before a cursor reset that fails raises the debt to a
+  // full-source read but keeps the work staged after the reset. A finite step
+  // staged there must not run first: its boundary would come from rows the
+  // failed request may have written only in part. The failure clears that
+  // boundary, so the staged tie issues nothing and the owed read comes next.
+  it(`starts the owed full-source read before a finite step staged after a reset`, async () => {
+    const requests: Array<{
+      options: RequestOptions
+      deferred: ReturnType<typeof createDeferred>
+    }> = []
+    let revision = 0
+    let answerAtOnce = false
+    const request = (options: RequestOptions) => {
+      const acquisition: LoadSubsetOptions = {
+        orderBy: options.orderBy,
+        limit: options.limit,
+        where: options.where,
+      }
+      const deferred = createDeferred()
+      requests.push({ options, deferred })
+      if (answerAtOnce) {
+        // The answer writes rows, so the graph has input it has not run.
+        revision++
+        options.onLoadSubsetResult?.(true, acquisition, () => {})
+      } else {
+        options.onLoadSubsetResult?.(deferred.promise, acquisition, () => {})
+      }
+    }
+    const subscription = {
+      readOrderedSnapshot: () => [{ value: { id: 1, rank: 1 } }],
+      setOrderByIndex: () => {},
+      requestLimitedSnapshot: request,
+      requestSnapshot: request,
+    } as unknown as CollectionSubscription
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      subscription,
+      `row`,
+      undefined,
+      undefined,
+      () => revision,
+    )
+    try {
+      loader.start()
+      const dead = requests[0]!
+      loader.resetCursor()
+      answerAtOnce = true
+      loader.loadMore()
+      expect(requests).toHaveLength(2)
+      answerAtOnce = false
+      dead.deferred.reject(new Error(`page from before the reset failed`))
+      await flushPromises()
+      loader.loadMore()
+      const next = requests[2]!.options
+      expect(next.where, `a tie from the staged step`).toBeUndefined()
+      expect(next.orderBy, `the owed full-source read`).toBeUndefined()
+    } finally {
+      loader.dispose()
+      for (const { deferred } of requests) deferred.resolve()
+    }
+  })
+
+  it(`retains an explicit failed-request retry blocked by joined demand`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    let joinedPending = false
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({
+        joinedFilterSourceId: `child`,
+        requiresFullSource: true,
+      }),
+      fakeSubscription(requests, releases),
+      `row`,
+      undefined,
+      undefined,
+      undefined,
+      () => joinedPending,
+    )
+
+    try {
+      loader.start()
+      const first = (loader as unknown as { pending: Promise<void> }).pending
+      const failure = new Error(`initial full-source request failed`)
+      requests[0]!.deferred.reject(failure)
+      await expect(first).rejects.toBe(failure)
+
+      joinedPending = true
+      expect(loader.loadMore(1)).toBeUndefined()
+      expect(requests).toHaveLength(1)
+
+      joinedPending = false
+      const retry = loader.loadMore()
+      expect(requests).toHaveLength(2)
+      requests[1]!.deferred.resolve()
+      await retry
+    } finally {
+      for (const request of requests) request.deferred.resolve()
+      loader.dispose()
+    }
+  })
+
+  it(`keeps nested refinement pending when an older lease release throws`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<number> = []
+    const participants: Array<Promise<unknown>> = []
+    const participantErrors = new Map<Promise<unknown>, unknown>()
+    const cleanupError = new Error(`older prefix cleanup failed`)
+    let boundary = 1
+    const request = (method: Observed[`method`], options: RequestOptions) => {
+      const index = requests.length
+      const acquisition: LoadSubsetOptions = {
+        orderBy: options.orderBy,
+        limit: options.limit,
+        where: options.where,
+      }
+      const deferred = createDeferred()
+      requests.push({ method, options, acquisition, deferred })
+      options.onLoadSubsetResult?.(
+        index === 2 ? true : deferred.promise,
+        acquisition,
+        () => {
+          releases.push(index)
+          if (index === 0) throw cleanupError
+        },
+      )
+    }
+    const subscription = {
+      readOrderedSnapshot: () => [
+        {
+          type: `insert`,
+          key: boundary,
+          value: { id: boundary, rank: boundary },
+        },
+      ],
+      setOrderByIndex: () => {},
+      requestLimitedSnapshot: (options: RequestOptions) =>
+        request(`limited`, options),
+      requestSnapshot: (options: RequestOptions) =>
+        request(`snapshot`, options),
+    } as unknown as CollectionSubscription
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      subscription,
+      `row`,
+      (result) => {
+        if (result instanceof Promise) {
+          participants.push(result)
+          void result.catch((error) => participantErrors.set(result, error))
+        }
+      },
+    )
+
+    const uncaught = captureMicrotaskErrors()
+    try {
+      loader.start()
+      requests[0]!.deferred.resolve()
+      await participants[0]
+      requests[1]!.deferred.resolve()
+      await participants[1]
+
+      boundary = 2
+      loader.invalidateCursor()
+      const result = loader.loadMore(1)!
+      expect(requests).toHaveLength(4)
+      expect(participants).toHaveLength(4)
+      await flushPromises()
+      // The older prefix's release throws: an adapter bug, reported
+      // uncaught. No participant reports it, and the nested refinement stays
+      // pending.
+      const recent = participants.slice(2)
+      const pending = (
+        loader as unknown as { pending: Promise<unknown> | undefined }
+      ).pending
+      expect(result).toBe(pending)
+      expect(recent).toContain(pending)
+      expect(
+        recent.some((participant) => participantErrors.has(participant)),
+      ).toBe(false)
+      expect(uncaught.errors).toEqual([cleanupError])
+
+      expect(loader.loadMore()).toBe(pending)
+      expect(requests).toHaveLength(4)
+      expect(releases).toEqual([0])
+    } finally {
+      uncaught.restore()
+      loader.dispose()
+      for (const observed of requests) observed.deferred.resolve()
+      await Promise.allSettled(participants)
+    }
+  })
+
+  it.each([
+    { name: `indexed page`, indexed: true },
+    { name: `unindexed prefix`, indexed: false },
+  ] as const)(
+    `finishes a repeated $name repair continuation and permits the next repair`,
+    async ({ indexed }) => {
+      type Row = { id: number; rank: number }
+      let rows: Array<Row> = [
+        { id: 1, rank: 1 },
+        { id: 2, rank: 2 },
+        { id: 3, rank: 3 },
+      ]
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const subscription = fakeSubscription(requests, releases) as unknown as {
+        readOrderedSnapshot: () => Array<{ value: Row }>
+      }
+      subscription.readOrderedSnapshot = () =>
+        rows
+          .slice()
+          .sort((left, right) => left.rank - right.rank)
+          .map((value) => ({ value }))
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({
+          index: indexed
+            ? ({} as NonNullable<OrderByOptimizationInfo[`index`]>)
+            : undefined,
+          limit: 10,
+          dataNeeded: () => (indexed ? 10 - rows.length : 0),
+        }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+      let nextRequest = 0
+      const settleThrough = async (finalCount: number) => {
+        while (nextRequest < finalCount) {
+          const pending = (
+            loader as unknown as { pending: Promise<unknown> | undefined }
+          ).pending
+          requests[nextRequest]!.deferred.resolve()
+          nextRequest++
+          await pending
+        }
+      }
+
+      try {
+        loader.start()
+        await settleThrough(indexed ? 3 : 2)
+
+        rows = rows.filter(({ id }) => id !== 2)
+        loader.invalidateSourceOrdering()
+        loader.loadMore(indexed ? undefined : 7)
+        const repairEnd = indexed ? 6 : 4
+        await settleThrough(repairEnd)
+
+        expect(releases).toEqual(
+          requests
+            .slice(0, indexed ? 3 : 2)
+            .map(({ acquisition }) => acquisition),
+        )
+
+        loader.invalidateSourceOrdering()
+        loader.loadMore(8)
+        expect(requests).toHaveLength(repairEnd + 1)
+      } finally {
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+      }
+    },
+  )
+
+  it(`starts a replacement repair before continuing a stale repair chain`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    let needed = 0
+    const subscription = fakeSubscription(requests, releases) as unknown as {
+      readOrderedSnapshot: () => Array<{
+        value: { id: number; rank: number }
+      }>
+    }
+    subscription.readOrderedSnapshot = () => [{ value: { id: 1, rank: 1 } }]
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ dataNeeded: () => needed }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+    let nextRequest = 0
+    const settle = async () => {
+      const pending = (
+        loader as unknown as { pending: Promise<unknown> | undefined }
+      ).pending
+      requests[nextRequest]!.deferred.resolve()
+      nextRequest++
+      await pending
+    }
+
+    try {
+      loader.start()
+      await settle()
+      await settle()
+
+      loader.invalidateSourceOrdering()
+      loader.loadMore()
+      await settle()
+      expect(requests).toHaveLength(4)
+
+      // A second mutation invalidates the chain while its tie request is held.
+      // Its settlement may apply rows, but it must not start stale refill work.
+      needed = 1
+      loader.invalidateSourceOrdering()
+      await settle()
+
+      expect(requests).toHaveLength(5)
+      expect(requests[4]!.method).toBe(`snapshot`)
+      expect(requests[4]!.options).toMatchObject({
+        refetch: true,
+        limit: 1,
+      })
+      expect(requests[4]!.options.orderBy).toBeDefined()
+      expect(requests[4]!.options.cursor).toBeUndefined()
+    } finally {
+      loader.dispose()
+      for (const request of requests) request.deferred.resolve()
+    }
+  })
+
+  it(`reissues a bounded prefix when settled source ordering is invalidated`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({
+        index: undefined,
+        offset: 2,
+        limit: 2,
+        dataNeeded: () => 0,
+      }),
+      fakeSubscription(requests, releases),
+      `row`,
+    )
+    let repair: Promise<unknown> | undefined
+
+    try {
+      loader.start()
+      const initial = (
+        loader as unknown as { pending: Promise<unknown> | undefined }
+      ).pending!
+      requests[0]!.deferred.resolve()
+      await initial
+
+      loader.invalidateSourceOrdering()
+      repair = loader.loadMore()
+
+      expect(requests).toHaveLength(2)
+      expect(requests[1]!.method).toBe(`snapshot`)
+      expect(
+        requests[1]!.options.orderBy?.map(({ expression, compareOptions }) => ({
+          path: expression instanceof PropRef ? expression.path : undefined,
+          direction: compareOptions.direction,
+        })),
+      ).toStrictEqual([{ path: [`rank`], direction: `asc` }])
+      expect(requests[1]!.options.limit).toBe(4)
+      expect(requests[1]!.options.refetch).toBe(true)
+      expect(requests[1]!.options.cursor).toBeUndefined()
+      expect(requests[1]!.options.offset).toBeUndefined()
+    } finally {
+      for (const request of requests) request.deferred.resolve()
+      await Promise.allSettled(repair ? [repair] : [])
+      loader.dispose()
+    }
+  })
+
+  it(`retains finite leases after bounded repair fails until full-source recovery succeeds`, async () => {
+    const requests: Array<{
+      options: RequestOptions
+      acquisition: LoadSubsetOptions
+      deferred: ReturnType<typeof createDeferred>
+    }> = []
+    const releases: Array<number> = []
+    const request = (options: RequestOptions) => {
+      const deferred = createDeferred()
+      const acquisition: LoadSubsetOptions = {
+        orderBy: options.orderBy,
+        limit: options.limit,
+        where: options.where,
+        cursor: options.cursor,
+        offset: options.offset,
+      }
+      const index = requests.length
+      requests.push({ options, acquisition, deferred })
+      options.onLoadSubsetResult?.(deferred.promise, acquisition, () => {
+        releases.push(index)
+      })
+    }
+    const subscription = {
+      hasPendingTruncateReplacement: false,
+      readOrderedSnapshot: () => [{ value: { id: 1, rank: 1 } }],
+      setOrderByIndex: () => {},
+      requestLimitedSnapshot: request,
+      requestSnapshot: request,
+    } as unknown as CollectionSubscription
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({
+        index: undefined,
+        dataNeeded: () => 0,
+      }),
+      subscription,
+      `row`,
+    )
+    const pending = () =>
+      (loader as unknown as { pending: Promise<unknown> | undefined }).pending!
+    const settle = async (index: number) => {
+      const participant = pending()
+      requests[index]!.deferred.resolve()
+      await participant
+    }
+
+    try {
+      loader.start()
+      await settle(0)
+      await settle(1)
+
+      loader.invalidateSourceOrdering()
+      loader.loadMore()
+      await settle(2)
+      expect(requests).toHaveLength(4)
+
+      // Core cannot know whether the failed adapter request wrote a partial
+      // result, so finite continuation is no longer authoritative.
+      const failedTie = pending()
+      const failure = new Error(`partial bounded-repair failure`)
+      requests[3]!.deferred.reject(failure)
+      await expect(failedTie).rejects.toBe(failure)
+
+      const retry = loader.loadMore(1)
+      expect(retry).toBeDefined()
+      expect(requests).toHaveLength(5)
+      expect(requests[4]!.options.orderBy).toBeUndefined()
+      expect(requests[4]!.options.where).toBeUndefined()
+      expect(requests[4]!.options.limit).toBeUndefined()
+      expect(requests[4]!.options.cursor).toBeUndefined()
+      expect(requests[4]!.options.offset).toBeUndefined()
+      await settle(4)
+
+      expect(
+        requests.map(({ options }) =>
+          options.orderBy ? `prefix` : options.where ? `tie` : `full-source`,
+        ),
+      ).toEqual([`prefix`, `tie`, `prefix`, `tie`, `full-source`])
+      expect(releases).toEqual([3, 0, 1, 2])
+    } finally {
+      loader.dispose()
+      for (const observed of requests) observed.deferred.resolve()
+    }
+  })
+
+  // Finite success is not authority to repair a newer full-source failure.
+  // Cross settlement order with both outcomes instead of testing each alone.
+  // An invalidation while the first page is still in flight comes before any
+  // request has settled, so the loader still recovers from the full source.
+  // An overlap after the source has settled once repairs with a bounded
+  // prefix instead; the next property owns that case.
+  it.each(
+    ([`older-first`, `full-first`] as const).flatMap((order) =>
+      ([`success`, `failure`] as const).flatMap((outcome) =>
+        ([`success`, `failure`] as const).map((olderOutcome) => ({
+          order,
+          outcome,
+          olderOutcome,
+        })),
+      ),
+    ),
+  )(
+    `keeps full-source recovery authoritative across an initial page overlap: %j`,
+    async ({ order, outcome, olderOutcome }) => {
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const participants: Array<Promise<unknown>> = []
+      const subscription = fakeSubscription(requests, releases)
+      subscription.readOrderedSnapshot = () => [
+        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+      ]
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo(),
+        subscription,
+        `row`,
+        (result) => {
+          if (result instanceof Promise) participants.push(result)
+        },
+      )
+      try {
+        loader.start()
+        const olderIndex = requests.length - 1
+        loader.invalidateSourceOrdering()
+        loader.loadMore()
+        const fullIndex = olderIndex + 1
+        const count = fullIndex + 1
+        expect(requests).toHaveLength(count)
+        expect(requests[fullIndex]!.options.orderBy).toBeUndefined()
+        expect(requests[fullIndex]!.options.where).toBeUndefined()
+        const failure = new Error(`full-source failed`)
+        const olderFailure = new Error(`older request failed`)
+        const settleOlder = async () => {
+          if (olderOutcome === `failure`) {
+            requests[olderIndex]!.deferred.reject(olderFailure)
+            await expect(participants[olderIndex]).rejects.toBe(olderFailure)
+          } else {
+            requests[olderIndex]!.deferred.resolve()
+            await participants[olderIndex]
+          }
+          expect(requests).toHaveLength(count)
+        }
+        const settleFull = async () => {
+          if (outcome === `failure`) {
+            requests[fullIndex]!.deferred.reject(failure)
+            await expect(participants[fullIndex]).rejects.toBe(failure)
+          } else {
+            requests[fullIndex]!.deferred.resolve()
+            await participants[fullIndex]
+          }
+          expect(requests).toHaveLength(count)
+        }
+        if (order === `older-first`) {
+          await settleOlder()
+          await settleFull()
+        } else {
+          await settleFull()
+          await settleOlder()
+        }
+        loader.loadMore()
+        expect(requests).toHaveLength(count)
+        // A successful full-source read retires every settled finite demand.
+        // It also retires the older request when that request failed: the
+        // full-source read superseded it, so its partial writes are covered
+        // and its lease needs no explicit retry.
+        const successfulFinite =
+          outcome === `success`
+            ? requests.slice(0, fullIndex).map(({ acquisition }) => acquisition)
+            : []
+        expect(releases).toEqual(successfulFinite)
+
+        // An explicit retry releases the failed demands that remain, in
+        // failure order: all of them when the full-source read failed.
+        loader.loadMore(1)
+        const failedIndices =
+          outcome === `success`
+            ? []
+            : (order === `older-first`
+                ? [olderIndex, fullIndex]
+                : [fullIndex, olderIndex]
+              ).filter(
+                (index) =>
+                  (index === olderIndex ? olderOutcome : outcome) === `failure`,
+              )
+        expect(releases).toEqual([
+          ...successfulFinite,
+          ...failedIndices.map((index) => requests[index]!.acquisition),
+        ])
+        if (outcome === `failure`) {
+          expect(requests).toHaveLength(count + 1)
+          loader.loadMore(1)
+          expect(requests).toHaveLength(count + 1)
+          requests[count]!.deferred.resolve()
+          await participants[count]
+        } else expect(requests).toHaveLength(count)
+      } finally {
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+        await Promise.allSettled(participants)
+      }
+    },
+  )
+
+  // An invalidation that overlaps an in-flight tie request, after the source
+  // has settled once, repairs with a bounded prefix: full-source reads can be
+  // very expensive, and the bounded repair sets its boundary from its own
+  // settled requests. The older tie's later success is ignored for that
+  // boundary. When both succeed, the repair chain runs to its fixed point and
+  // retires exactly the acquisitions it replaced, once each, with no
+  // full-source request. When the repair succeeds but the older tie fails,
+  // the tie's partial writes need the full-source read that the overlap
+  // replaced, so the loader starts it at once, in either settlement order,
+  // and needs no explicit retry; on main, the overlapping full-source read
+  // recovered this case. When the repair itself fails, today's failure law
+  // holds: nothing retries eagerly, and an explicit retry releases exactly
+  // the failed acquisitions, in failure order, and recovers from the full
+  // source.
+  it.each(
+    ([`older-first`, `repair-first`] as const).flatMap((order) =>
+      ([`success`, `failure`] as const).flatMap((outcome) =>
+        ([`success`, `failure`] as const).map((olderOutcome) => ({
+          order,
+          outcome,
+          olderOutcome,
+        })),
+      ),
+    ),
+  )(
+    `repairs a tie overlap with a bounded prefix: %j`,
+    async ({ order, outcome, olderOutcome }) => {
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const participants: Array<Promise<unknown>> = []
+      const subscription = fakeSubscription(requests, releases)
+      subscription.readOrderedSnapshot = () => [
+        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+      ]
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo(),
+        subscription,
+        `row`,
+        (result) => {
+          if (result instanceof Promise) {
+            participants.push(result.catch(() => undefined))
+          }
+        },
+      )
+      const flush = async () => {
+        for (let turn = 0; turn < 5; turn++) await Promise.resolve()
+      }
+      const settle = async (index: number, succeeds: boolean) => {
+        if (succeeds) requests[index]!.deferred.resolve()
+        else requests[index]!.deferred.reject(new Error(`request failed`))
+        await flush()
+      }
+      const isFullSource = ({ options }: Observed) =>
+        options.orderBy === undefined && options.where === undefined
+      try {
+        loader.start()
+        await settle(0, true)
+        expect(requests).toHaveLength(2)
+        expect(requests[1]!.options.where).toBeDefined()
+        const olderIndex = 1
+        loader.invalidateSourceOrdering()
+        loader.loadMore()
+        const repairIndex = 2
+        expect(requests).toHaveLength(3)
+        expect(requests[repairIndex]!.options.orderBy).toBeDefined()
+        expect(requests[repairIndex]!.options.limit).toBe(1)
+        expect(requests[repairIndex]!.options.where).toBeUndefined()
+
+        const settleOlder = () => settle(olderIndex, olderOutcome === `success`)
+        const settleRepair = () => settle(repairIndex, outcome === `success`)
+        if (order === `older-first`) {
+          await settleOlder()
+          await settleRepair()
+        } else {
+          await settleRepair()
+          await settleOlder()
+        }
+
+        if (outcome === `success` && olderOutcome === `success`) {
+          // Run the repair chain to its fixed point.
+          for (let index = repairIndex + 1; index < requests.length; index++) {
+            await settle(index, true)
+          }
+          const settled = requests.length
+          expect(settled).toBeGreaterThan(repairIndex + 1)
+          expect(requests.some(isFullSource)).toBe(false)
+          expect(releases).toEqual([
+            requests[0]!.acquisition,
+            requests[olderIndex]!.acquisition,
+          ])
+          loader.loadMore()
+          loader.loadMore(1)
+          expect(requests).toHaveLength(settled)
+          expect(releases).toHaveLength(2)
+          return
+        }
+
+        if (outcome === `success`) {
+          // The older tie failed: the loader recovers from the full source.
+          for (let index = repairIndex + 1; index < requests.length; index++) {
+            if (isFullSource(requests[index]!)) break
+            await settle(index, true)
+          }
+          const full = requests.findIndex(isFullSource)
+          expect(full).toBeGreaterThan(repairIndex)
+          expect(requests.filter(isFullSource)).toHaveLength(1)
+          await settle(full, true)
+          const settled = requests.length
+          loader.loadMore()
+          expect(requests).toHaveLength(settled)
+          return
+        }
+
+        // The repair failed: nothing retries eagerly. Repair-chain work
+        // already in flight settles first; an explicit retry then waits for
+        // no request.
+        for (let index = repairIndex + 1; index < requests.length; index++) {
+          await settle(index, true)
+        }
+        const before = requests.length
+        loader.loadMore()
+        expect(requests).toHaveLength(before)
+        expect(requests.some(isFullSource)).toBe(false)
+        const failed = (
+          order === `older-first`
+            ? [olderIndex, repairIndex]
+            : [repairIndex, olderIndex]
+        ).filter(
+          (index) =>
+            (index === olderIndex ? olderOutcome : outcome) === `failure`,
+        )
+        const releasedBeforeRetry = releases.length
+        loader.loadMore(1)
+        expect(releases.slice(releasedBeforeRetry)).toEqual(
+          failed.map((index) => requests[index]!.acquisition),
+        )
+        expect(requests).toHaveLength(before + 1)
+        expect(isFullSource(requests[before]!)).toBe(true)
+      } finally {
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+        await Promise.allSettled(participants)
+      }
+    },
+  )
+
+  // A request that a bounded repair superseded can fail after that repair
+  // has finished and after a newer ordering invalidation. The failure law
+  // lets the loader's own failure block ordinary refills until an explicit
+  // retry. A superseded request's failure is not the loader's own: its
+  // partial writes need the full-source read that the overlap replaced, and
+  // nothing else will start one. Here the newer invalidation's reaction is
+  // deferred, as pending joined work or a later graph run can defer it, so
+  // the old tie fails first. The next ordinary pass must still recover.
+  // Found by a TLA+ model of the loader's request authority (#2191).
+  it(`recovers a superseded tie that fails after its repair and a newer invalidation`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const participants: Array<Promise<unknown>> = []
+    const subscription = fakeSubscription(requests, releases)
+    subscription.readOrderedSnapshot = () => [
+      { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+    ]
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      subscription,
+      `row`,
+      (result) => {
+        if (result instanceof Promise) {
+          participants.push(result.catch(() => undefined))
+        }
+      },
+    )
+    const flush = async () => {
+      for (let turn = 0; turn < 5; turn++) await Promise.resolve()
+    }
+    const isFullSource = ({ options }: Observed) =>
+      options.orderBy === undefined && options.where === undefined
+    try {
+      loader.start()
+      requests[0]!.deferred.resolve()
+      await flush()
+      const tieIndex = 1
+      expect(requests[tieIndex]!.options.where).toBeDefined()
+
+      // The repair supersedes the in-flight tie and runs to its fixed point.
+      loader.invalidateSourceOrdering()
+      loader.loadMore()
+      const repairIndex = 2
+      expect(requests[repairIndex]!.options.where).toBeUndefined()
+      for (let index = repairIndex; index < requests.length; index++) {
+        requests[index]!.deferred.resolve()
+        await flush()
+      }
+      expect(requests.some(isFullSource)).toBe(false)
+
+      // A newer invalidation arrives; the loader's reaction is deferred.
+      loader.invalidateSourceOrdering()
+      const before = requests.length
+      requests[tieIndex]!.deferred.reject(new Error(`tie failed`))
+      await flush()
+      loader.loadMore()
+      // One full-source read recovers it, with no explicit retry.
+      expect(requests.slice(before).filter(isFullSource)).toHaveLength(1)
+    } finally {
+      loader.dispose()
+      for (const request of requests) request.deferred.resolve()
+      await Promise.allSettled(participants)
+    }
+  })
+
+  // The same overlap with an in-flight prefix read. A prefix acquisition
+  // normally supersedes every smaller settled prefix, because it covers their
+  // rows. A prefix issued before an ordering invalidation proves no current
+  // coverage, so its later result is ignored for the boundary, and for the
+  // same reason it must not release the repair's acquisitions. A refetching
+  // provider removes the rows only a released request holds, so releasing the
+  // repair's prefix can drop a row the stale read never saw. The stale prefix
+  // itself is superseded by the repair, so it is released too, in either
+  // settlement order; holding it would make every later refetch read it.
+  it.each([`older-first`, `repair-first`] as const)(
+    `keeps the repair's prefix when an older prefix read settles %s`,
+    async (order) => {
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const participants: Array<Promise<unknown>> = []
+      const subscription = fakeSubscription(requests, releases)
+      subscription.readOrderedSnapshot = () => [
+        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+      ]
+      const info = createOrderByInfo({ index: undefined, dataNeeded: () => 0 })
+      const loader = new OrderedSourceLoader(
+        info,
+        subscription,
+        `row`,
+        (result) => {
+          if (result instanceof Promise) {
+            participants.push(result.catch(() => undefined))
+          }
+        },
+      )
+      const flush = async () => {
+        for (let turn = 0; turn < 5; turn++) await Promise.resolve()
+      }
+      const settle = async (index: number) => {
+        requests[index]!.deferred.resolve()
+        await flush()
+      }
+      const isPrefix = ({ options }: Observed) =>
+        options.orderBy !== undefined && options.cursor === undefined
+      try {
+        loader.start()
+        for (let index = 0; index < requests.length; index++) {
+          await settle(index)
+        }
+        const initial = requests.length
+
+        // A window move reads a longer prefix; it is still in flight when an
+        // order change invalidates the source.
+        info.limit = 3
+        loader.loadMore(1)
+        expect(requests).toHaveLength(initial + 1)
+        const olderIndex = initial
+        expect(requests[olderIndex]!.options.limit).toBe(3)
+        loader.invalidateSourceOrdering()
+        loader.loadMore()
+        const repairIndex = initial + 1
+        expect(requests).toHaveLength(initial + 2)
+        expect(requests[repairIndex]!.options).toMatchObject({
+          refetch: true,
+          limit: 3,
+        })
+
+        const runRepair = async () => {
+          for (let index = repairIndex; index < requests.length; index++) {
+            if (index !== olderIndex) await settle(index)
+          }
+        }
+        if (order === `older-first`) {
+          await settle(olderIndex)
+          await runRepair()
+        } else {
+          await runRepair()
+          await settle(olderIndex)
+        }
+
+        const repairAcquisitions = requests
+          .slice(repairIndex)
+          .map(({ acquisition }) => acquisition)
+        expect(requests.slice(repairIndex).filter(isPrefix)).toHaveLength(1)
+        expect(
+          releases.filter((release) => repairAcquisitions.includes(release)),
+        ).toEqual([])
+        expect(releases).toEqual(
+          expect.arrayContaining(
+            requests.slice(0, initial).map(({ acquisition }) => acquisition),
+          ),
+        )
+
+        // A stale prefix that settles after the repair finished is already
+        // superseded, so it is released at once. One that settled first is
+        // covered by the repair's own retirement.
+        expect(releases).toContain(requests[olderIndex]!.acquisition)
+
+        // A later repair still runs normally.
+        loader.invalidateSourceOrdering()
+        loader.loadMore()
+        for (let index = 0; index < requests.length; index++) {
+          await settle(index)
+        }
+        expect(releases).toContain(requests[olderIndex]!.acquisition)
+      } finally {
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+        await Promise.allSettled(participants)
+      }
+    },
+  )
+
+  // When a bounded repair finishes, it releases the acquisitions it
+  // superseded. A refetching provider then removes the rows only those
+  // acquisitions held, and the loader sees a delete of a row it sent. That
+  // removal is the repair's own retirement, not a source change: every row
+  // through the repair's boundary is held by the repair. The repair's
+  // boundary must survive it. Otherwise the loader restarts paging from the
+  // start of the order with a smaller first page that cannot retire the
+  // repair's larger prefix, and every later refetch reads both prefixes.
+  // Law: once a chain settles, the loader holds at most one acquisition that
+  // reads from the start of the order.
+  it(`keeps a repair's boundary when its retirement removes a row the loader sent`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const participants: Array<Promise<unknown>> = []
+    let removedOnRelease = false
+    // Releasing the first tie request removes row 9, which only it held.
+    const subscription = fakeSubscription(requests, releases, () => {
+      if (removedOnRelease || releases.at(-1)?.where === undefined) return
+      removedOnRelease = true
+      const row = { id: 9, rank: 2 }
+      loader.onSourceChanges(
+        [{ type: `delete`, key: 9, value: row }],
+        new Map([[9, row]]),
+        () => false,
+      )
+    })
+    subscription.readOrderedSnapshot = () => [
+      { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+      { type: `insert`, key: 2, value: { id: 2, rank: 2 } },
+    ]
+    let needed = 0
+    const info = createOrderByInfo({ limit: 2, dataNeeded: () => needed })
+    const loader = new OrderedSourceLoader(
+      info,
+      subscription,
+      `row`,
+      (result) => {
+        if (result instanceof Promise) {
+          participants.push(result.catch(() => undefined))
+        }
+      },
+    )
+    const settleAll = async () => {
+      for (let index = 0; index < requests.length; index++) {
+        requests[index]!.deferred.resolve()
+        for (let turn = 0; turn < 5; turn++) await Promise.resolve()
+      }
+    }
+    const heldPrefixes = () =>
+      requests.filter(
+        ({ options, acquisition }) =>
+          options.orderBy !== undefined &&
+          options.where === undefined &&
+          options.minValues === undefined &&
+          !releases.includes(acquisition),
+      )
+    try {
+      loader.start()
+      await settleAll()
+      expect(heldPrefixes()).toHaveLength(1)
+
+      loader.invalidateSourceOrdering()
+      loader.loadMore()
+      await settleAll()
+      expect(removedOnRelease).toBe(true)
+      expect(heldPrefixes()).toHaveLength(1)
+
+      // The window now needs one more row. It continues after the repair's
+      // boundary instead of restarting from the start of the order.
+      needed = 1
+      const before = requests.length
+      loader.loadMore()
+      await settleAll()
+      expect(requests.length).toBeGreaterThan(before)
+      expect(requests[before]!.options.minValues).toEqual([2])
+      expect(heldPrefixes()).toHaveLength(1)
+    } finally {
+      loader.dispose()
+      for (const request of requests) request.deferred.resolve()
+      await Promise.allSettled(participants)
+    }
+  })
+
+  // A provider can answer a request synchronously, as Query DB does when it
+  // reacquires a released Query from its cache. Its writes run a graph turn
+  // inside the request; that turn asks the loader for more, but the loader
+  // is still requesting and ignores it. The continuation it then stages has
+  // no later graph turn to resume it. When a turn has already processed the
+  // request's writes, the loader must continue at once, or a short window
+  // stops paging and treats unread rows as loaded.
+  it(`continues a chain whose synchronous answer the graph already processed`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    let revision = 0
+    const subscription = fakeSubscription(requests, releases)
+    const asyncRequest = subscription.requestSnapshot
+    subscription.readOrderedSnapshot = () => [
+      { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+    ]
+    // Tie requests answer synchronously: they write a row, the graph turn
+    // processes it and asks for more, and the request returns `true`.
+    subscription.requestSnapshot = ((options: RequestOptions) => {
+      if (options.where === undefined) {
+        asyncRequest(options)
+        return
+      }
+      const acquisition: LoadSubsetOptions = { where: options.where }
+      requests.push({
+        method: `snapshot`,
+        options,
+        acquisition,
+        deferred: createDeferred(),
+      })
+      revision++
+      loader.loadMore()
+      options.onLoadSubsetResult?.(true, acquisition, () => {
+        releases.push(acquisition)
+      })
+    }) as typeof subscription.requestSnapshot
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ limit: 3, dataNeeded: () => 1 }),
+      subscription,
+      `row`,
+      () => {},
+      () => false,
+      () => revision,
+    )
+    try {
+      loader.start()
+      requests[0]!.deferred.resolve()
+      await flushPromises()
+      expect(
+        requests.map(({ options }) => options.where !== undefined),
+      ).toEqual([false, true, false])
+      expect(requests[2]!.options.minValues).toEqual([1])
+    } finally {
+      loader.dispose()
+      for (const request of requests) request.deferred.resolve()
+      await flushPromises()
+    }
+  })
+
+  it.each(
+    [false, true].flatMap((fullFirst) =>
+      [false, true].flatMap((replayed) =>
+        [false, true].map((releaseThrows) => ({
+          fullFirst,
+          replayed,
+          releaseThrows,
+        })),
+      ),
+    ),
+  )(
+    `releases each failed lease once, at a covering replay or the explicit retry: %j`,
+    async ({ fullFirst, replayed, releaseThrows }) => {
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const participants: Array<Promise<unknown>> = []
+      const cleanupError = new Error(`release failed`)
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo(),
+        fakeSubscription(requests, releases, () => {
+          if (releaseThrows) throw cleanupError
+        }),
+        `row`,
+        (result) => {
+          if (result instanceof Promise) participants.push(result)
+        },
+      )
+      const uncaught = captureMicrotaskErrors()
+      try {
+        loader.start()
+        loader.invalidateSourceOrdering()
+        loader.loadMore()
+        expect(requests).toHaveLength(2)
+        const order = fullFirst ? [1, 0] : [0, 1]
+        for (const index of order) {
+          const failure = new Error(`request ${index} failed`)
+          requests[index]!.deferred.reject(failure)
+          await expect(participants[index]).rejects.toBe(failure)
+        }
+        // A replay covers the source like a full-source success, so it
+        // releases the superseded page itself. Without a replay, the explicit
+        // retry releases both. A throwing release is reported uncaught.
+        if (replayed) loader.settleFullSourceReplay()
+        loader.loadMore(1)
+        await flushPromises()
+        const expected = order
+          .filter((index) => !replayed || index === 0)
+          .map((index) => requests[index]!.acquisition)
+        expect(releases).toEqual(expected)
+        // Each throwing release is reported uncaught, exactly once.
+        expect(uncaught.errors).toEqual(
+          releaseThrows ? releases.map(() => cleanupError) : [],
+        )
+        loader.loadMore(2)
+        expect(releases).toEqual(expected)
+        expect(requests).toHaveLength(replayed ? 2 : 3)
+      } finally {
+        uncaught.restore()
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+        await Promise.allSettled(participants)
+      }
+    },
+  )
+
+  it(`a page failure while a full-source demand is held releases only the page`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      fakeSubscription(requests, releases),
+      `row`,
+    )
+    loader.start()
+    const page = (
+      loader as unknown as { pending: Promise<unknown> | undefined }
+    ).pending!
+    expect(requests.map(({ method }) => method)).toEqual([`limited`])
+
+    // A delete during the in-flight page requires authoritative repair.
+    loader.invalidateSourceOrdering()
+    loader.loadMore()
+    expect(requests.map(({ method }) => method)).toEqual([
+      `limited`,
+      `snapshot`,
+    ])
+    expect(requests[1]!.options.limit).toBeUndefined()
+    const fullSource = (
+      loader as unknown as { pending: Promise<unknown> | undefined }
+    ).pending!
+    expect(fullSource).not.toBe(page)
+
+    const failure = new Error(`page rejected`)
+    requests[0]!.deferred.reject(failure)
+    await expect(page).rejects.toBe(failure)
+
+    // Blocked automatic retry; explicit retry releases the page only and must
+    // not issue a duplicate full-source demand while one is already held.
+    expect(loader.loadMore()).toBe(fullSource)
+    expect(requests).toHaveLength(2)
+    expect(releases).toEqual([])
+    expect(loader.loadMore(1)).toBe(fullSource)
+    expect(releases).toEqual([requests[0]!.acquisition])
+    expect(requests).toHaveLength(2)
+
+    requests[1]!.deferred.resolve()
+    await fullSource
+    expect(loader.loadMore(2)).toBeUndefined()
+    expect(requests).toHaveLength(2)
+    expect(releases).toEqual([requests[0]!.acquisition])
+    loader.dispose()
+  })
+
+  it(`sync full-source failure retains no demand: replay settle is a no-op and retry reissues once`, () => {
+    const releases: Array<LoadSubsetOptions> = []
+    const methods: Array<string> = []
+    const failure = new Error(`full-source threw after callback`)
+    const acquisition: LoadSubsetOptions = {}
+    let fail = true
+    const subscription = {
+      setOrderByIndex: () => {},
+      requestSnapshot: (options: RequestOptions) => {
+        methods.push(`snapshot`)
+        if (!fail) return
+        fail = false
+        options.onLoadSubsetResult?.(true, acquisition, () =>
+          releases.push(acquisition),
+        )
+        throw failure
+      },
+    } as unknown as CollectionSubscription
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ requiresFullSource: true }),
+      subscription,
+      `row`,
+    )
+    expect(() => loader.start()).toThrow(failure)
+    expect(releases).toEqual([acquisition])
+    expect(methods).toEqual([`snapshot`])
+
+    loader.settleFullSourceReplay()
+    expect(loader.loadMore()).toBeUndefined()
+    expect(methods).toEqual([`snapshot`])
+
+    loader.loadMore(1)
+    expect(methods).toEqual([`snapshot`, `snapshot`])
+    expect(releases).toEqual([acquisition])
+    loader.dispose()
+  })
+
+  it(`replay repairs a failed full-source demand: a later explicit retry releases nothing`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ requiresFullSource: true }),
+      fakeSubscription(requests, releases),
+      `row`,
+    )
+    loader.start()
+    const pending = (
+      loader as unknown as { pending: Promise<unknown> | undefined }
+    ).pending!
+    const failure = new Error(`full-source rejected`)
+    requests[0]!.deferred.reject(failure)
+    await expect(pending).rejects.toBe(failure)
+    expect(requests).toHaveLength(1)
+
+    loader.settleFullSourceReplay()
+    expect(loader.loadMore(1)).toBeUndefined()
+    expect(releases).toEqual([])
+    expect(requests).toHaveLength(1)
+    expect(loader.loadMore(2)).toBeUndefined()
+    expect(requests).toHaveLength(1)
+    loader.dispose()
+  })
+
+  it(`without replay the explicit retry releases and reissues exactly once`, async () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ requiresFullSource: true }),
+      fakeSubscription(requests, releases),
+      `row`,
+    )
+    loader.start()
+    const pending = (
+      loader as unknown as { pending: Promise<unknown> | undefined }
+    ).pending!
+    requests[0]!.deferred.reject(new Error(`full-source rejected`))
+    await expect(pending).rejects.toThrow(`full-source rejected`)
+
+    loader.loadMore(1)
+    expect(releases).toEqual([requests[0]!.acquisition])
+    expect(requests).toHaveLength(2)
+    loader.loadMore(1)
+    expect(requests).toHaveLength(2)
+    loader.dispose()
+  })
+
+  it(`a zero window opening with an offset requests the whole prefix from zero`, () => {
+    const requests: Array<Observed> = []
+    const releases: Array<LoadSubsetOptions> = []
+    const info = createOrderByInfo({ offset: 2, limit: 0 })
+    // Production dataNeeded is limit - topK size; it never adds the offset.
+    info.dataNeeded = () => info.limit
+    const loader = new OrderedSourceLoader(
+      info,
+      fakeSubscription(requests, releases),
+      `row`,
+    )
+    loader.start()
+    expect(requests).toHaveLength(0)
+
+    info.limit = 3
+    loader.loadMore(1)
+    expect(requests).toHaveLength(1)
+    expect(requests[0]!.method).toBe(`limited`)
+    expect(requests[0]!.options.limit).toBe(5)
+    expect(requests[0]!.options.offset).toBe(0)
+    expect(requests[0]!.options.minValues).toBeUndefined()
+    loader.dispose()
+  })
+
+  // An order change while a tie request is in flight starts a bounded prefix
+  // repair at once; the tie's later result is ignored for the boundary. When
+  // that repair fails, the window move rejects with its error and the last
+  // public window stays, whatever the older tie request does. An explicit
+  // retry then recovers under today's failure law, from the full source, and
+  // publishes once.
+  it.each([`success`, `failure`] as const)(
+    `keeps a failed public window private when its older tie request ends in %s`,
+    async (olderOutcome) => {
+      type Row = { id: number; rank: number }
+      const truth: Array<Row> = [1, 2, 3].map((id) => ({ id, rank: id }))
+      const requests: Array<{
+        kind: `page` | `boundary` | `full`
+        options: LoadSubsetOptions
+        gate: ReturnType<typeof createDeferred>
+      }> = []
+      const releases: Array<LoadSubsetOptions> = []
+      let hold = false
+      let holdRepair = false
+      let update!: (row: Row) => void
+      const source = createCollection<Row, number>({
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: (sync) => {
+            const installed = new Map<number, Row>()
+            update = (row) => {
+              installed.set(row.id, row)
+              sync.begin()
+              sync.write({ type: `update`, value: row })
+              sync.commit()
+            }
+            sync.markReady()
+            return {
+              loadSubset: async (options) => {
+                const kind = options.orderBy
+                  ? `page`
+                  : options.where
+                    ? `boundary`
+                    : `full`
+                const gate = createDeferred()
+                requests.push({ kind, options, gate })
+                if (!hold || (kind === `page` && !holdRepair)) gate.resolve()
+                await gate.promise
+                if (options.signal?.aborted) return
+                const rows = truth
+                  .filter(
+                    (row) =>
+                      (!options.where ||
+                        evaluateReferenceExpression(options.where, row) ===
+                          true) &&
+                      (!options.cursor ||
+                        evaluateReferenceExpression(
+                          options.cursor.whereFrom,
+                          row,
+                        ) === true),
+                  )
+                  .sort((a, b) => a.rank - b.rank)
+                const offset = options.cursor ? 0 : (options.offset ?? 0)
+                const selected = rows.slice(
+                  offset,
+                  options.limit === undefined
+                    ? undefined
+                    : offset + options.limit,
+                )
+                sync.begin()
+                for (const row of selected) {
+                  if (installed.get(row.id) === row) continue
+                  sync.write({
+                    type: installed.has(row.id) ? `update` : `insert`,
+                    value: row,
+                  })
+                  installed.set(row.id, row)
+                }
+                await sync.commit()
+              },
+              unloadSubset: (options) => {
+                releases.push(options)
+              },
+            }
+          },
+        },
+      })
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.rank)
+          .limit(1)
+          .select(({ row }) => ({ id: row.id, rank: row.rank })),
+      )
+      const visibleRows = () =>
+        live.toArray.map(({ id, rank }) => ({ id, rank }))
+      const publications: Array<Array<Row>> = []
+      live.subscribeChanges(
+        (batch) => {
+          if (batch.length) publications.push(visibleRows())
+        },
+        { includeInitialState: false },
+      )
+      try {
+        await live.preload()
+        expect(visibleRows()).toEqual([{ id: 1, rank: 1 }])
+        publications.length = 0
+        hold = true
+        const move = Promise.resolve(live.utils.setWindow({ limit: 2 })).then(
+          () => ({ status: `fulfilled` as const }),
+          (error) => ({ status: `rejected` as const, error }),
+        )
+        await flushPromises()
+        const boundary = requests.at(-1)!
+        expect(boundary.kind).toBe(`boundary`)
+        holdRepair = true
+        truth[0] = { id: 1, rank: 10 }
+        update(truth[0])
+        await flushPromises()
+        const repair = requests.at(-1)!
+        expect(repair.kind).toBe(`page`)
+        expect(repair.options.limit).toBe(2)
+        expect(repair.options.cursor).toBeUndefined()
+        const count = requests.length
+        const failure = new Error(`authoritative repair failed`)
+        repair.gate.reject(failure)
+        // The window still waits for its older publication participant to settle.
+        await flushPromises()
+        if (olderOutcome === `failure`)
+          boundary.gate.reject(new Error(`older tie failed`))
+        else boundary.gate.resolve()
+        await flushPromises()
+        expect(requests).toHaveLength(count)
+        expect(await move).toEqual({ status: `rejected`, error: failure })
+        expect(releases).toEqual([])
+        expect(publications).toEqual([])
+        expect(visibleRows()).toEqual([{ id: 1, rank: 1 }])
+        expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
+
+        hold = false
+        holdRepair = false
+        await live.utils.setWindow({ limit: 2 })
+        expect(requests).toHaveLength(count + 1)
+        expect(requests.at(-1)!.kind).toBe(`full`)
+        expect(releases).toHaveLength(count)
+        expect(new Set(releases)).toEqual(
+          new Set(requests.slice(0, count).map(({ options }) => options)),
+        )
+        expect(visibleRows()).toEqual([
+          { id: 2, rank: 2 },
+          { id: 3, rank: 3 },
+        ])
+        expect(publications).toEqual([
+          [
+            { id: 2, rank: 2 },
+            { id: 3, rank: 3 },
+          ],
+        ])
+      } finally {
+        await live.cleanup()
+        for (const request of requests) request.gate.resolve()
+        await source.cleanup()
+      }
+    },
+  )
+  it(`a failed window move keeps the snapshot; the retry loads the source once`, async () => {
+    type Row = { id: number; rank: number }
+    const truth: Array<Row> = [1, 2, 3, 4, 5, 6].map((id) => ({ id, rank: id }))
+    const failure = new Error(`page rejected`)
+    const requests: Array<{ kind: string; options: LoadSubsetOptions }> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    let failNextCursor = false
+    const kindOf = (options: LoadSubsetOptions) =>
+      options.orderBy !== undefined
+        ? options.cursor
+          ? `cursor-page`
+          : `page`
+        : options.where !== undefined
+          ? `boundary`
+          : `full`
+    const source = createCollection<Row, number>({
+      id: `cut-c-probe-source`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (sync) => {
+          const installed = new Set<number>()
+          sync.markReady()
+          return {
+            loadSubset: (options) => {
+              requests.push({ kind: kindOf(options), options })
+              if (options.cursor && failNextCursor) {
+                failNextCursor = false
+                return Promise.reject(failure)
+              }
+              let rows = truth.filter(
+                (row) =>
+                  !options.where ||
+                  evaluateReferenceExpression(options.where, row) === true,
+              )
+              if (options.cursor)
+                rows = rows.filter(
+                  (row) =>
+                    evaluateReferenceExpression(
+                      options.cursor!.whereFrom,
+                      row,
+                    ) === true,
+                )
+              const offset = options.cursor ? 0 : (options.offset ?? 0)
+              rows = rows.slice(
+                offset,
+                options.limit === undefined
+                  ? undefined
+                  : offset + options.limit,
+              )
+              return (async () => {
+                await Promise.resolve()
+                const fresh = rows.filter(({ id }) => !installed.has(id))
+                if (fresh.length === 0) return
+                sync.begin()
+                for (const value of fresh) {
+                  installed.add(value.id)
+                  sync.write({ type: `insert`, value })
+                }
+                const receipt = sync.commit()
+                if (receipt !== true) await receipt
+              })()
+            },
+            unloadSubset: (options) => {
+              unloads.push(options)
+            },
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ row: source })
+        .orderBy(({ row }) => row.rank)
+        .limit(2)
+        .select(({ row }) => ({ id: row.id, rank: row.rank })),
+    )
+    const publications: Array<Array<number>> = []
+    live.subscribeChanges(
+      (batch) => {
+        if (batch.length > 0)
+          publications.push(live.toArray.map(({ id }) => id))
+      },
+      { includeInitialState: false },
+    )
+    try {
+      await live.preload()
+      expect(live.toArray.map(({ id }) => id)).toEqual([1, 2])
+      expect(requests.map(({ kind }) => kind)).toEqual([`page`, `boundary`])
+      expect(unloads).toEqual([])
+      const initialRequests = requests.length
+      publications.length = 0
+
+      failNextCursor = true
+      const move = live.utils.setWindow({ limit: 4 })
+      expect(move).not.toBe(true)
+      await expect(move).rejects.toBe(failure)
+      await flushPromises()
+      // Rows: last settled snapshot; events: none; wait: rejected; requests: one.
+      expect(live.toArray.map(({ id }) => id)).toEqual([1, 2])
+      expect(publications).toEqual([])
+      expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
+      expect(requests.slice(initialRequests).map(({ kind }) => kind)).toEqual([
+        `cursor-page`,
+      ])
+      expect(unloads).toEqual([])
+      expect(live.status).not.toBe(`error`)
+
+      const retry = live.utils.setWindow({ limit: 4 })
+      expect(retry).not.toBe(true)
+      await retry
+      await flushPromises()
+      expect(live.toArray.map(({ id }) => id)).toEqual([1, 2, 3, 4])
+      expect(publications).toEqual([[1, 2, 3, 4]])
+      expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 4 })
+      expect(requests.slice(initialRequests).map(({ kind }) => kind)).toEqual([
+        `cursor-page`,
+        `full`,
+      ])
+      // Retry retires the failed page; successful repair then retires earlier
+      // finite demands while keeping the new authoritative demand.
+      expect(unloads).toEqual([
+        requests[initialRequests]!.options,
+        ...requests.slice(0, initialRequests).map(({ options }) => options),
+      ])
+
+      await flushPromises()
+      expect(requests).toHaveLength(initialRequests + 2)
+    } finally {
+      await live.cleanup()
+      await source.cleanup()
+    }
+  })
+})
+
+describe(`Successful finite demand retirement`, () => {
+  it.each([`none`, `throw`, `truncate`, `dispose`] as const)(
+    `attempts releases once across %s reentry`,
+    async (action) => {
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const participants: Array<Promise<unknown>> = []
+      const failure = new Error(`release failed`)
+      let first = true
+      const subscription = fakeSubscription(requests, releases, () => {
+        if (!first) return
+        first = false
+        if (action === `throw`) throw failure
+        if (action === `truncate`) loader.resetCursor()
+        if (action === `dispose`) loader.dispose()
+      })
+      subscription.readOrderedSnapshot = () => [
+        { type: `insert`, key: 1, value: { id: 1, rank: 1 } },
+      ]
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({ dataNeeded: () => 0 }),
+        subscription,
+        `row`,
+        (result) => {
+          if (result instanceof Promise) participants.push(result)
+        },
+      )
+      const uncaught = captureMicrotaskErrors()
+      try {
+        loader.start()
+        requests[0]!.deferred.resolve()
+        await participants[0]
+        requests[1]!.deferred.resolve()
+        await participants[1]
+        loader.invalidateSourceOrdering()
+        loader.loadMore()
+        requests[2]!.deferred.resolve()
+        await participants[2]
+        requests[3]!.deferred.resolve()
+        // A throwing release is reported uncaught; the load still settles.
+        await participants[3]
+        await flushPromises()
+        expect(uncaught.errors).toEqual(action === `throw` ? [failure] : [])
+        expect(releases).toEqual(
+          requests
+            .slice(0, action === `truncate` || action === `dispose` ? 1 : 2)
+            .map(({ acquisition }) => acquisition),
+        )
+        if (action === `truncate`) {
+          loader.settleFullSourceReplay()
+          expect(releases).toEqual(
+            requests.slice(0, 2).map(({ acquisition }) => acquisition),
+          )
+        }
+        loader.loadMore(1)
+        expect(new Set(releases).size).toBe(releases.length)
+        expect(requests).toHaveLength(4)
+      } finally {
+        uncaught.restore()
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+        await Promise.allSettled(participants)
+      }
+    },
+  )
+
+  it.each([`before-replay`, `after-replay`] as const)(
+    `keeps unfinished physical work observed when it settles %s`,
+    async (when) => {
+      const requests: Array<Observed> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const participants: Array<Promise<unknown>> = []
+      const subscription = fakeSubscription(requests, releases)
+      let replaying = false
+      Object.defineProperty(subscription, `hasPendingTruncateReplacement`, {
+        get: () => replaying,
+      })
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo(),
+        subscription,
+        `row`,
+        (result) => {
+          if (result instanceof Promise) participants.push(result)
+        },
+      )
+      try {
+        loader.start()
+        replaying = true
+        loader.resetCursor()
+        loader.loadFullSource()
+        requests[1]!.deferred.resolve()
+        await participants[1]
+        expect(releases).toEqual([])
+        const settlePage = async () => {
+          requests[0]!.deferred.resolve()
+          await participants[0]
+        }
+        if (when === `before-replay`) {
+          await settlePage()
+          expect(releases).toEqual([])
+        }
+        replaying = false
+        loader.settleFullSourceReplay()
+        if (when === `after-replay`) {
+          expect(releases).toEqual([])
+          await settlePage()
+        }
+        expect(releases).toEqual([requests[0]!.acquisition])
+      } finally {
+        loader.dispose()
+        for (const request of requests) request.deferred.resolve()
+        await Promise.allSettled(participants)
+      }
+    },
+  )
+})
diff --git a/packages/db/tests/query/ordered-source-loader-support.ts b/packages/db/tests/query/ordered-source-loader-support.ts
new file mode 100644
index 0000000000..ebe3e41f64
--- /dev/null
+++ b/packages/db/tests/query/ordered-source-loader-support.ts
@@ -0,0 +1,63 @@
+// Shared fixtures for the OrderedSourceLoader tests: a deferred promise, the
+// ordered-window request options, and the order-by info that the loader reads.
+// The ordering laws are owned by ordered-source-loader-oracle.test.ts.
+import { PropRef } from '../../src/query/ir.js'
+import type { ReleaseLoadSubset } from '../../src/collection/subscription.js'
+import type { OrderByOptimizationInfo } from '../../src/query/compiler/order-by.js'
+import type {
+  LoadSubsetOptions,
+  LoadSubsetRequestResult,
+} from '../../src/types.js'
+import type { OrderedSourceLoader } from '../../src/query/live/ordered-source-loader.js'
+
+export const pendingPromise = (loader: OrderedSourceLoader) =>
+  (loader as unknown as { pending: Promise<unknown> | undefined }).pending
+
+export type RequestOptions = LoadSubsetOptions & {
+  minValues?: Array<unknown>
+  onLoadSubsetResult?: (
+    result: LoadSubsetRequestResult,
+    acquisition: LoadSubsetOptions,
+    release: ReleaseLoadSubset,
+  ) => void
+}
+
+export function createDeferred() {
+  let resolve!: () => void
+  let reject!: (error: unknown) => void
+  const promise = new Promise<void>((done, fail) => {
+    resolve = done
+    reject = fail
+  })
+  return { promise, resolve, reject }
+}
+
+export function createOrderByInfo(
+  overrides: Partial<OrderByOptimizationInfo> = {},
+): OrderByOptimizationInfo {
+  return {
+    sourceId: `source`,
+    alias: `row`,
+    orderBy: [
+      {
+        expression: new PropRef([`row`, `rank`]),
+        compareOptions: {
+          direction: `asc`,
+          nulls: `first`,
+          stringSort: `lexical`,
+        },
+      },
+    ],
+    offset: 0,
+    limit: 1,
+    comparator: (left, right) =>
+      (left?.rank as number) - (right?.rank as number),
+    valueExtractorForRawRow: (row) => row.rank,
+    index: {} as NonNullable<OrderByOptimizationInfo[`index`]>,
+    dataNeeded: () => 1,
+    requiresFullSource: false,
+    // A finite provider, not an eager source: its rows are not all installed.
+    sourceHoldsAllRows: false,
+    ...overrides,
+  }
+}
diff --git a/packages/db/tests/query/ordered-source-loader.test.ts b/packages/db/tests/query/ordered-source-loader.test.ts
new file mode 100644
index 0000000000..c6508e07ce
--- /dev/null
+++ b/packages/db/tests/query/ordered-source-loader.test.ts
@@ -0,0 +1,1466 @@
+// Ordinary OrderedSourceLoader tests: request routing, prefix repair, retry, and
+// cleanup for fixed scenarios whose expectations are written out. The staged
+// window law that the generated cells check is owned by
+// ordered-source-loader-oracle.test.ts.
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { OrderedSourceLoader } from '../../src/query/live/ordered-source-loader.js'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import { captureMicrotaskErrors, flushPromises } from '../utils.js'
+import {
+  createDeferred,
+  createOrderByInfo,
+  pendingPromise,
+} from './ordered-source-loader-support.js'
+import type { RequestOptions } from './ordered-source-loader-support.js'
+import type {
+  CollectionSubscription,
+  ReleaseLoadSubset,
+} from '../../src/collection/subscription.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+
+describe(`OrderedSourceLoader`, () => {
+  it(`pages an indexed multi-column order from its leading term`, async () => {
+    const requests: Array<{ method: string; options: RequestOptions }> = []
+    let dataNeeded = 0
+    const request = (method: string, options: RequestOptions) => {
+      requests.push({ method, options })
+      options.onLoadSubsetResult?.(true, options, () => {})
+    }
+    const subscription = {
+      setOrderByIndex: () => {},
+      readOrderedSnapshot: () => [{ value: { rank: 1, id: 2 } }],
+      requestLimitedSnapshot: (options: RequestOptions) =>
+        request(`limited`, options),
+      requestSnapshot: (options: RequestOptions) =>
+        request(`snapshot`, options),
+    }
+    const orderBy = [
+      ...createOrderByInfo().orderBy,
+      {
+        expression: new PropRef([`row`, `id`]),
+        compareOptions: {
+          direction: `desc` as const,
+          nulls: `last` as const,
+          stringSort: `lexical` as const,
+        },
+      },
+    ]
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({
+        orderBy,
+        dataNeeded: () => dataNeeded,
+      }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+
+    try {
+      loader.start()
+      await pendingPromise(loader)
+      await pendingPromise(loader)
+
+      expect(requests[0]?.method).toBe(`limited`)
+      expect(requests[0]?.options).toMatchObject({
+        limit: 1,
+        offset: 0,
+      })
+      expect(requests[0]?.options.orderBy).toHaveLength(2)
+      expect(
+        requests[0]?.options.orderBy?.map(({ expression }) => expression),
+      ).toEqual([new PropRef([`rank`]), new PropRef([`id`])])
+      expect(requests[1]?.method).toBe(`snapshot`)
+      expect(requests[1]?.options.where).toBeDefined()
+
+      dataNeeded = 2
+      loader.loadMore(1)
+      await pendingPromise(loader)
+
+      const continuation = requests.find(
+        ({ method, options }) =>
+          method === `limited` && options.minValues !== undefined,
+      )
+      expect(continuation?.options).toMatchObject({
+        limit: 2,
+        minValues: [1],
+      })
+      expect(continuation?.options.orderBy).toHaveLength(2)
+    } finally {
+      loader.dispose()
+    }
+  })
+
+  it(`settles a larger prefix after an older lease release throws`, async () => {
+    const failure = new Error(`old prefix release failed`)
+    const requests: Array<LoadSubsetOptions> = []
+    const source = createCollection<{ id: number; rank: number }>({
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          for (let id = 1; id <= 3; id++)
+            write({ type: `insert`, value: { id, rank: id } })
+          commit()
+          markReady()
+          return {
+            loadSubset: (options) => {
+              requests.push(options)
+              return Promise.resolve()
+            },
+            unloadSubset: (options) => {
+              if (options === requests[0]) throw failure
+            },
+          }
+        },
+      },
+    })
+    const subscription = source.subscribeChanges(() => {}, {
+      includeInitialState: false,
+    })
+    const reads = vi.spyOn(subscription, `readOrderedSnapshot`)
+    const info = createOrderByInfo({ index: undefined, dataNeeded: () => 0 })
+    const loader = new OrderedSourceLoader(
+      info,
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+    // A throwing release is an adapter bug: it is reported uncaught and the
+    // larger prefix still settles.
+    const uncaught = captureMicrotaskErrors()
+    try {
+      loader.start()
+      await pendingPromise(loader)
+      reads.mockClear()
+      info.limit = 2
+      await loader.loadMore(1)
+      await flushPromises()
+      expect(uncaught.errors).toEqual([failure])
+      expect(reads).toHaveBeenCalledWith(expect.objectContaining({ limit: 2 }))
+      // A release failure is not a load error.
+      expect(subscription.lastError).toBeUndefined()
+      info.limit = 3
+      await loader.loadMore(2)
+      expect(requests.map((request) => request.limit)).toEqual([
+        1,
+        undefined,
+        2,
+        undefined,
+        3,
+        undefined,
+      ])
+      expect(
+        requests
+          .filter((request) => request.limit === undefined)
+          .every((request) => request.where !== undefined),
+      ).toBe(true)
+      expect(source.size).toBe(3)
+    } finally {
+      uncaught.restore()
+      loader.dispose()
+      subscription.unsubscribe()
+      await source.cleanup()
+    }
+  })
+
+  it(`keeps a literal-true replacement when retiring the older prefix throws`, async () => {
+    const failure = new Error(`old prefix release failed`)
+    const requests: Array<{
+      options: RequestOptions
+      acquisition: LoadSubsetOptions
+      release: ReleaseLoadSubset
+    }> = []
+    const released: Array<LoadSubsetOptions> = []
+    const request = (options: RequestOptions) => {
+      const acquisition: LoadSubsetOptions = {
+        orderBy: options.orderBy,
+        limit: options.limit,
+        where: options.where,
+      }
+      const requestIndex = requests.length
+      const release = () => {
+        released.push(acquisition)
+        if (requestIndex === 0) throw failure
+      }
+      requests.push({ options, acquisition, release })
+      options.onLoadSubsetResult?.(true, acquisition, release)
+    }
+    const subscription = {
+      readOrderedSnapshot: (options: LoadSubsetOptions) => [
+        { value: { rank: options.limit ?? 1 } },
+      ],
+      requestSnapshot: request,
+    }
+    const info = createOrderByInfo({ index: undefined, dataNeeded: () => 0 })
+    const loader = new OrderedSourceLoader(
+      info,
+      subscription as unknown as CollectionSubscription,
+      `row`,
+      undefined,
+      undefined,
+      () => 0,
+    )
+    const uncaught = captureMicrotaskErrors()
+
+    try {
+      loader.start()
+      info.limit = 2
+
+      loader.loadMore()
+      await flushPromises()
+      expect(uncaught.errors).toEqual([failure])
+
+      expect(requests.map(({ options }) => options.limit)).toEqual([
+        1,
+        undefined,
+        2,
+        undefined,
+      ])
+      expect(released).toEqual([requests[0]!.acquisition])
+      expect(
+        (
+          loader as unknown as {
+            settledFiniteAcquisitions: Map<
+              ReleaseLoadSubset,
+              number | undefined
+            >
+          }
+        ).settledFiniteAcquisitions.has(requests[2]!.release),
+      ).toBe(true)
+      expect(
+        (loader as unknown as { failedRequest?: unknown }).failedRequest,
+      ).toBeUndefined()
+      expect(
+        (loader as unknown as { needsOrderingRepair: boolean })
+          .needsOrderingRepair,
+      ).toBe(false)
+      expect(
+        (loader as unknown as { stagedContinuation?: unknown })
+          .stagedContinuation,
+      ).toBeUndefined()
+    } finally {
+      uncaught.restore()
+      loader.dispose()
+    }
+  })
+
+  it(`does not fail a literal-true parent when its drained continuation throws`, () => {
+    const failure = new Error(`continuation request failed`)
+    const requests: Array<{
+      options: RequestOptions
+      acquisition?: LoadSubsetOptions
+      release?: ReleaseLoadSubset
+    }> = []
+    const released: Array<LoadSubsetOptions> = []
+    const subscription = {
+      setOrderByIndex: () => {},
+      readOrderedSnapshot: () => [{ value: { rank: 1 } }],
+      requestLimitedSnapshot: (options: RequestOptions) => {
+        const acquisition: LoadSubsetOptions = {
+          orderBy: options.orderBy,
+          limit: options.limit,
+        }
+        const release = () => released.push(acquisition)
+        requests.push({ options, acquisition, release })
+        options.onLoadSubsetResult?.(true, acquisition, release)
+      },
+      requestSnapshot: (options: RequestOptions) => {
+        requests.push({ options })
+        throw failure
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ dataNeeded: () => 0 }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+      undefined,
+      undefined,
+      () => 0,
+    )
+
+    try {
+      expect(() => loader.start()).toThrow(failure)
+
+      expect(requests).toHaveLength(2)
+      expect(released).toEqual([])
+      expect(
+        (
+          loader as unknown as {
+            settledFiniteAcquisitions: Map<
+              ReleaseLoadSubset,
+              number | undefined
+            >
+          }
+        ).settledFiniteAcquisitions.has(requests[0]!.release!),
+      ).toBe(true)
+      expect(
+        (loader as unknown as { orderedLoadGeneration: number })
+          .orderedLoadGeneration,
+      ).toBe(0)
+      expect(
+        (loader as unknown as { failedRequest?: unknown }).failedRequest,
+      ).toBeDefined()
+    } finally {
+      loader.dispose()
+    }
+  })
+
+  it(`drains more than one literal-true continuation before returning`, () => {
+    const methods: Array<`page` | `boundary`> = []
+    let pageCount = 0
+    let boundary = 0
+    const subscription = {
+      setOrderByIndex: () => {},
+      readOrderedSnapshot: () => [{ value: { rank: boundary } }],
+      requestLimitedSnapshot: (options: RequestOptions) => {
+        methods.push(`page`)
+        pageCount++
+        boundary = pageCount
+        options.onLoadSubsetResult?.(true, options, () => {})
+      },
+      requestSnapshot: (options: RequestOptions) => {
+        methods.push(`boundary`)
+        options.onLoadSubsetResult?.(true, options, () => {})
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ dataNeeded: () => (pageCount < 2 ? 1 : 0) }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+      undefined,
+      undefined,
+      () => 0,
+    )
+
+    try {
+      loader.start()
+
+      expect(methods).toEqual([`page`, `boundary`, `page`, `boundary`])
+      expect(pendingPromise(loader)).toBeUndefined()
+    } finally {
+      loader.dispose()
+    }
+  })
+
+  it(`does not release a fulfilled Promise parent when its continuation throws`, async () => {
+    const failure = new Error(`continuation request failed`)
+    const requests: Array<{
+      options: RequestOptions
+      acquisition?: LoadSubsetOptions
+      release?: ReleaseLoadSubset
+    }> = []
+    const released: Array<LoadSubsetOptions> = []
+    const subscription = {
+      setOrderByIndex: () => {},
+      readOrderedSnapshot: () => [{ value: { rank: 1 } }],
+      requestLimitedSnapshot: (options: RequestOptions) => {
+        const acquisition: LoadSubsetOptions = {
+          orderBy: options.orderBy,
+          limit: options.limit,
+        }
+        const release = () => released.push(acquisition)
+        requests.push({ options, acquisition, release })
+        options.onLoadSubsetResult?.(Promise.resolve(), acquisition, release)
+      },
+      requestSnapshot: (options: RequestOptions) => {
+        requests.push({ options })
+        throw failure
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ dataNeeded: () => 0 }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+
+    try {
+      loader.start()
+      const parent = pendingPromise(loader)
+      expect(parent).toBeInstanceOf(Promise)
+      await expect(parent).rejects.toBe(failure)
+
+      expect(requests).toHaveLength(2)
+      expect(released).toEqual([])
+      expect(
+        (
+          loader as unknown as {
+            settledFiniteAcquisitions: Map<
+              ReleaseLoadSubset,
+              number | undefined
+            >
+          }
+        ).settledFiniteAcquisitions.has(requests[0]!.release!),
+      ).toBe(true)
+      expect(
+        (loader as unknown as { orderedLoadGeneration: number })
+          .orderedLoadGeneration,
+      ).toBe(0)
+      expect(
+        (loader as unknown as { failedRequest?: unknown }).failedRequest,
+      ).toBeDefined()
+    } finally {
+      loader.dispose()
+    }
+  })
+
+  it(`repairs ordering before an explicit window consumes a staged ordinary continuation`, () => {
+    const requests: Array<{ method: string; options: RequestOptions }> = []
+    let graphInputRevision = 0
+    const sentRows = new Map([[1, { rank: 1 }]])
+    const request = (method: string, options: RequestOptions) => {
+      requests.push({ method, options })
+      if (requests.length === 1) {
+        graphInputRevision++
+        loader.onSourceChanges(
+          [{ type: `update`, key: 1, value: { rank: 2 } }],
+          sentRows,
+          () => false,
+        )
+      }
+      options.onLoadSubsetResult?.(true, options, () => {})
+    }
+    const subscription = {
+      setOrderByIndex: () => {},
+      readOrderedSnapshot: () => [{ value: { rank: 2 } }],
+      requestLimitedSnapshot: (options: RequestOptions) =>
+        request(`limited`, options),
+      requestSnapshot: (options: RequestOptions) =>
+        request(`snapshot`, options),
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+      undefined,
+      undefined,
+      () => graphInputRevision,
+    )
+
+    try {
+      loader.start()
+
+      const stagedContinuation = (
+        loader as unknown as {
+          stagedContinuation?: {
+            role: `finite` | `repair` | `full-source`
+            windowOperationGeneration?: number
+          }
+        }
+      ).stagedContinuation
+      // The first request's own delivery invalidated ordering, so it proves
+      // no current coverage: no ordinary continuation may survive it. It
+      // stages none, or only authoritative work; a stamp taken after the
+      // request returns would stage a finite one.
+      expect(stagedContinuation?.role).not.toBe(`finite`)
+      expect(
+        (loader as unknown as { needsOrderingRepair: boolean })
+          .needsOrderingRepair,
+      ).toBe(true)
+
+      loader.loadMore(1)
+
+      expect(requests).toHaveLength(2)
+      expect(requests[1]?.method).toBe(`snapshot`)
+      expect(requests[1]?.options).toMatchObject({ refetch: true })
+      expect(requests[1]?.options.orderBy).toBeUndefined()
+      expect(requests[1]?.options.limit).toBeUndefined()
+      expect(requests[1]?.options.cursor).toBeUndefined()
+      expect(requests[1]?.options.where).toBeUndefined()
+    } finally {
+      loader.dispose()
+    }
+  })
+
+  const syncRouteCells = (
+    [`page`, `prefix`, `boundary`, `full-source`] as const
+  ).flatMap((route) =>
+    ([`success`, `throw`, `callback-then-throw`] as const).map((outcome) => ({
+      route,
+      outcome,
+    })),
+  )
+
+  it.each(syncRouteCells)(
+    `preserves $route request semantics with synchronous $outcome`,
+    async ({ route, outcome }) => {
+      const requests: Array<{ method: string; options: RequestOptions }> = []
+      const released: Array<RequestOptions> = []
+      const failure = new Error(`target request failed`)
+      const waiting = createDeferred()
+      let boundaryReads = 0
+      const targetIndex = route === `boundary` ? 1 : 0
+      const request = (method: string, options: RequestOptions) => {
+        const index = requests.length
+        requests.push({ method, options })
+        if (index !== targetIndex) {
+          // Bootstrap the boundary case; leave later refinement/retry in flight.
+          options.onLoadSubsetResult?.(
+            index < targetIndex ? true : waiting.promise,
+            options,
+            () => {},
+          )
+          return
+        }
+        if (outcome !== `throw`) {
+          options.onLoadSubsetResult?.(true, options, () =>
+            released.push(options),
+          )
+        }
+        if (outcome !== `success`) throw failure
+      }
+      const subscription = {
+        setOrderByIndex: () => {},
+        readOrderedSnapshot: () => {
+          boundaryReads++
+          return [{ value: { rank: 1 } }]
+        },
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`limited`, options),
+        requestSnapshot: (options: RequestOptions) =>
+          request(`snapshot`, options),
+      }
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({
+          dataNeeded: () => 0,
+          ...(route === `prefix` ? { index: undefined } : {}),
+          requiresFullSource: route === `full-source`,
+        }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+      try {
+        if (outcome !== `success` && route !== `boundary`) {
+          expect(() => loader.start()).toThrow(failure)
+        } else {
+          loader.start()
+          if (outcome === `success`) await pendingPromise(loader)
+          else await expect(pendingPromise(loader)).rejects.toBe(failure)
+        }
+        // Drain the synchronous boundary's own settlement as well as its parent.
+        await Promise.resolve()
+        const target = requests[targetIndex]!
+        expect(target.method).toBe(route === `page` ? `limited` : `snapshot`)
+        expect(target.options.limit).toBe(
+          route === `page` || route === `prefix` ? 1 : undefined,
+        )
+        expect(Boolean(target.options.where)).toBe(route === `boundary`)
+        expect(released).toEqual(
+          outcome === `callback-then-throw` ? [target.options] : [],
+        )
+        if (outcome === `success`) {
+          // Ordered loads establish a cursor and refine ties; neither a tie
+          // load nor a full-source load may restart that refinement step.
+          expect(boundaryReads).toBe(route === `full-source` ? 0 : 1)
+          expect(requests).toHaveLength(route === `full-source` ? 1 : 2)
+          if (route === `page` || route === `prefix`) {
+            expect(requests[1]!.options.where).toBeDefined()
+            expect(requests[1]!.options.orderBy).toBeUndefined()
+          }
+        } else {
+          const count = requests.length
+          loader.loadMore()
+          expect(requests).toHaveLength(count)
+          loader.loadMore(1)
+          expect(requests).toHaveLength(count + 1)
+          const retry = requests.at(-1)!
+          expect(retry.method).toBe(`snapshot`)
+          expect(retry.options.orderBy).toBeUndefined()
+          expect(retry.options.where).toBeUndefined()
+          expect(retry.options.limit).toBeUndefined()
+        }
+      } finally {
+        loader.dispose()
+        waiting.resolve()
+        await Promise.resolve()
+      }
+    },
+  )
+
+  it.each([`page`, `prefix`] as const)(
+    `settles an ordinary synchronous $route chain before start returns`,
+    (route) => {
+      const requests: Array<string> = []
+      const request = (method: string, options: RequestOptions): void => {
+        requests.push(method)
+        options.onLoadSubsetResult?.(true, options, () => {})
+      }
+      const subscription = {
+        setOrderByIndex: () => {},
+        readOrderedSnapshot: () => [{ value: { rank: 1 } }],
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`limited`, options),
+        requestSnapshot: (options: RequestOptions) =>
+          request(`snapshot`, options),
+      }
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({
+          dataNeeded: () => 0,
+          ...(route === `prefix` ? { index: undefined } : {}),
+        }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+        undefined,
+        undefined,
+        () => 0,
+      )
+      try {
+        loader.start()
+        expect(pendingPromise(loader)).toBeUndefined()
+        expect(requests).toEqual(
+          route === `prefix`
+            ? [`snapshot`, `snapshot`]
+            : [`limited`, `snapshot`],
+        )
+      } finally {
+        loader.dispose()
+      }
+    },
+  )
+
+  // An eager prefix repair settles synchronously only when its local read is
+  // bounded: one order term over an index. A second term or a missing index
+  // keeps the full local read, so that repair keeps its asynchronous
+  // settlement, as does every on-demand source.
+  it.each([
+    {
+      name: `one indexed term`,
+      terms: 1,
+      indexed: true,
+      eager: true,
+      sync: true,
+    },
+    {
+      name: `two indexed terms`,
+      terms: 2,
+      indexed: true,
+      eager: true,
+      sync: false,
+    },
+    { name: `no index`, terms: 1, indexed: false, eager: true, sync: false },
+    {
+      name: `an on-demand source`,
+      terms: 1,
+      indexed: true,
+      eager: false,
+      sync: false,
+    },
+  ])(
+    `settles an eager prefix repair synchronously only for a bounded read ($name)`,
+    async ({ terms, indexed, eager, sync }) => {
+      const requests: Array<{ method: string; options: RequestOptions }> = []
+      const request = (method: string, options: RequestOptions): void => {
+        requests.push({ method, options })
+        options.onLoadSubsetResult?.(true, options, () => {})
+      }
+      const subscription = {
+        setOrderByIndex: () => {},
+        readOrderedSnapshot: () => [{ value: { rank: 1 } }],
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`limited`, options),
+        requestSnapshot: (options: RequestOptions) =>
+          request(`snapshot`, options),
+      }
+      const base = createOrderByInfo()
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({
+          dataNeeded: () => 0,
+          sourceHoldsAllRows: eager,
+          ...(indexed ? {} : { index: undefined }),
+          orderBy:
+            terms === 2
+              ? [
+                  ...base.orderBy,
+                  {
+                    expression: new PropRef([`row`, `id`]),
+                    compareOptions: base.orderBy[0]!.compareOptions,
+                  },
+                ]
+              : base.orderBy,
+        }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+        undefined,
+        undefined,
+        () => 0,
+      )
+      try {
+        loader.start()
+        expect(pendingPromise(loader)).toBeUndefined()
+        loader.invalidateSourceOrdering()
+        requests.length = 0
+        loader.loadMore()
+        expect(requests[0]?.options.limit, `a prefix repair ran`).toBe(1)
+        expect(
+          pendingPromise(loader) === undefined,
+          `repair settled before loadMore returned`,
+        ).toBe(sync)
+        await pendingPromise(loader)
+      } finally {
+        loader.dispose()
+      }
+    },
+  )
+
+  it(`recovers authoritatively when reading a settled boundary fails`, async () => {
+    const failure = new Error(`boundary read failed`)
+    const requests: Array<{ method: string; options: RequestOptions }> = []
+    const released: Array<LoadSubsetOptions> = []
+    const request = (method: string, options: RequestOptions) => {
+      requests.push({ method, options })
+      options.onLoadSubsetResult?.(Promise.resolve(), options, () =>
+        released.push(options),
+      )
+    }
+    const subscription = {
+      setOrderByIndex: () => {},
+      readOrderedSnapshot: () => {
+        throw failure
+      },
+      requestLimitedSnapshot: (options: RequestOptions) =>
+        request(`limited`, options),
+      requestSnapshot: (options: RequestOptions) =>
+        request(`snapshot`, options),
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+    loader.start()
+    await expect(pendingPromise(loader)).rejects.toBe(failure)
+    loader.loadMore()
+    expect(requests).toHaveLength(1)
+    await loader.loadMore(1)
+    expect(released).toEqual([requests[0]!.options])
+    expect(requests.map(({ method }) => method)).toEqual([
+      `limited`,
+      `snapshot`,
+    ])
+    expect(requests[1]!.options.limit).toBeUndefined()
+    loader.dispose()
+  })
+
+  const asyncRouteCells = (
+    [`page`, `prefix`, `boundary`, `full-source`] as const
+  ).flatMap((route) =>
+    (
+      [
+        `resolve`,
+        `reject`,
+        `abort`,
+        `dispose-resolve`,
+        `dispose-reject`,
+      ] as const
+    ).map((outcome) => ({ route, outcome })),
+  )
+
+  it.each(asyncRouteCells)(
+    `keeps the $route acquisition lifecycle exact for $outcome`,
+    async ({ route, outcome }) => {
+      type ObservedRequest = {
+        method: `limited` | `snapshot`
+        options: RequestOptions
+        acquisition: LoadSubsetOptions
+        controller: AbortController
+        deferred: ReturnType<typeof createDeferred>
+      }
+      const requests: Array<ObservedRequest> = []
+      const releases: Array<LoadSubsetOptions> = []
+      const request = (
+        method: ObservedRequest[`method`],
+        options: RequestOptions,
+      ) => {
+        const controller = new AbortController()
+        const acquisition: LoadSubsetOptions = {
+          signal: controller.signal,
+          orderBy: options.orderBy,
+          limit: options.limit,
+        }
+        const deferred = createDeferred()
+        requests.push({ method, options, acquisition, controller, deferred })
+        options.onLoadSubsetResult?.(deferred.promise, acquisition, () =>
+          releases.push(acquisition),
+        )
+      }
+      const subscription = {
+        readOrderedSnapshot: () =>
+          route === `boundary` ? [{ value: { rank: 1 } }] : [],
+        setOrderByIndex: () => {},
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`limited`, options),
+        requestSnapshot: (options: RequestOptions) =>
+          request(`snapshot`, options),
+      }
+      const info = createOrderByInfo(
+        route === `prefix`
+          ? { index: undefined }
+          : route === `full-source`
+            ? { requiresFullSource: true }
+            : {},
+      )
+      const loader = new OrderedSourceLoader(
+        info,
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+
+      loader.start()
+      if (route === `boundary`) {
+        expect(requests.map(({ method }) => method)).toEqual([`limited`])
+        requests[0]!.deferred.resolve()
+        await Promise.resolve()
+        await Promise.resolve()
+        expect(requests.map(({ method }) => method)).toEqual([
+          `limited`,
+          `snapshot`,
+        ])
+      }
+      const target = requests.at(-1)!
+      const targetSettlement = pendingPromise(loader)!
+      const failure =
+        outcome === `abort`
+          ? new DOMException(`${route} canceled`, `AbortError`)
+          : new Error(`${route} rejected`)
+
+      if (outcome === `dispose-resolve` || outcome === `dispose-reject`) {
+        loader.dispose()
+        if (outcome === `dispose-resolve`) target.deferred.resolve()
+        else target.deferred.reject(failure)
+        await targetSettlement
+        expect(requests.at(-1)).toBe(target)
+        expect(releases).toEqual([])
+        return
+      }
+
+      if (outcome === `resolve`) {
+        target.deferred.resolve()
+        await targetSettlement
+        expect(target.controller.signal.aborted).toBe(false)
+        expect(releases).toEqual([])
+      } else {
+        if (outcome === `abort`) target.controller.abort()
+        target.deferred.reject(failure)
+        await expect(targetSettlement).rejects.toBe(failure)
+        expect(target.controller.signal.aborted).toBe(outcome === `abort`)
+
+        const requestCount = requests.length
+        expect(loader.loadMore()).toBeUndefined()
+        expect(requests).toHaveLength(requestCount)
+
+        loader.loadMore(1)
+        expect(releases).toEqual([target.acquisition])
+        expect(requests).toHaveLength(requestCount + 1)
+        const retry = requests.at(-1)!
+        expect(retry.method).toBe(`snapshot`)
+        retry.deferred.resolve()
+        await pendingPromise(loader)
+        expect(releases).toEqual([
+          target.acquisition,
+          ...(route === `boundary` ? [requests[0]!.acquisition] : []),
+        ])
+      }
+
+      loader.dispose()
+    },
+  )
+
+  it.each(
+    ([`reset`, `dispose`] as const).flatMap((lifecycle) =>
+      ([`resolve`, `reject`, `abort`] as const).map((outcome) => ({
+        lifecycle,
+        outcome,
+      })),
+    ),
+  )(
+    `preserves replacement ownership after $lifecycle and obsolete $outcome`,
+    async ({ lifecycle, outcome }) => {
+      const requests: Array<{
+        method: string
+        options: RequestOptions
+        deferred: ReturnType<typeof createDeferred>
+      }> = []
+      const releases: Array<RequestOptions> = []
+      const request = (method: string, options: RequestOptions) => {
+        const deferred = createDeferred()
+        requests.push({ method, options, deferred })
+        options.onLoadSubsetResult?.(deferred.promise, options, () =>
+          releases.push(options),
+        )
+      }
+      const subscription = {
+        setOrderByIndex: () => {},
+        readOrderedSnapshot: () => [],
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`page`, options),
+        requestSnapshot: (options: RequestOptions) =>
+          request(`full-source`, options),
+      }
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({ dataNeeded: () => 0 }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+      try {
+        loader.start()
+        const obsolete = pendingPromise(loader)!
+        if (lifecycle === `reset`) loader.resetCursor()
+        else loader.dispose()
+        const replacement = loader.loadMore(1)
+        expect(requests.map(({ method }) => method)).toEqual(
+          lifecycle === `reset` ? [`page`, `page`] : [`page`],
+        )
+        if (lifecycle === `reset`) {
+          expect(replacement).toBeInstanceOf(Promise)
+          expect(requests[1]!.options.offset).toBe(0)
+          expect(requests[1]!.options.minValues).toBeUndefined()
+        }
+
+        if (outcome === `resolve`) requests[0]!.deferred.resolve()
+        else {
+          requests[0]!.deferred.reject(
+            outcome === `abort`
+              ? new DOMException(`obsolete request canceled`, `AbortError`)
+              : new Error(`obsolete request failed`),
+          )
+        }
+        await obsolete
+        expect(pendingPromise(loader)).toBe(replacement)
+        expect(releases).toEqual([])
+
+        if (lifecycle === `reset`) {
+          requests[1]!.deferred.resolve()
+          await replacement
+          // A successful finite replacement cannot prove that partial writes
+          // from the obsolete failure were repaired. Success and repair debt
+          // coexist; only an authoritative full-source request clears it.
+          loader.loadMore(2)
+          expect(requests.map(({ method }) => method)).toEqual(
+            outcome === `resolve`
+              ? [`page`, `page`]
+              : [`page`, `page`, `full-source`],
+          )
+          if (outcome !== `resolve`) {
+            expect(requests[2]!.options.orderBy).toBeUndefined()
+            expect(requests[2]!.options.limit).toBeUndefined()
+            requests[2]!.deferred.resolve()
+            await pendingPromise(loader)
+            loader.loadMore(3)
+            expect(requests).toHaveLength(3)
+          }
+        } else {
+          expect(loader.loadMore(2)).toBeUndefined()
+          expect(requests).toHaveLength(1)
+        }
+      } finally {
+        loader.dispose()
+        requests.forEach(({ deferred }) => deferred.resolve())
+      }
+    },
+  )
+
+  it.each([
+    { label: `undefined`, value: undefined, continuation: `full-source` },
+    { label: `null`, value: null, continuation: `full-source` },
+    { label: `zero`, value: 0, continuation: `tie` },
+    { label: `false`, value: false, continuation: `tie` },
+    { label: `empty string`, value: ``, continuation: `tie` },
+  ])(
+    `uses $continuation for a $label boundary`,
+    async ({ value, continuation }) => {
+      const methods: Array<string> = []
+      let needed = 0
+      const request = (method: string, options: RequestOptions) => {
+        methods.push(method)
+        options.onLoadSubsetResult?.(true, options, () => {})
+      }
+      const subscription = {
+        setOrderByIndex: () => {},
+        readOrderedSnapshot: () => [{ value: { rank: value } }],
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`page`, options),
+        requestSnapshot: (options: RequestOptions) => {
+          const kind = options.where ? `tie` : `full-source`
+          expect(kind).toBe(continuation)
+          request(kind, options)
+        },
+      }
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({ dataNeeded: () => needed, comparator: () => 0 }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+
+      loader.start()
+      await pendingPromise(loader)
+      await pendingPromise(loader)
+      expect(methods).toEqual([`page`, continuation])
+
+      needed = 2
+      loader.loadMore(1)
+      await pendingPromise(loader)
+      expect(methods).toEqual(
+        continuation === `tie`
+          ? [`page`, `tie`, `page`]
+          : [`page`, `full-source`],
+      )
+      loader.dispose()
+    },
+  )
+
+  it(`retains only bounded promise state during a long refinement chain`, async () => {
+    let biggest: { rank: number } | undefined
+    const requests: Array<ReturnType<typeof createDeferred>> = []
+    const tracked: Array<{ settled: boolean }> = []
+    const request = (options: RequestOptions) => {
+      const next = createDeferred()
+      requests.push(next)
+      options.onLoadSubsetResult?.(
+        next.promise,
+        {
+          orderBy: options.orderBy,
+          limit: options.limit,
+        },
+        () => {},
+      )
+    }
+    const subscription = {
+      readOrderedSnapshot: () => (biggest ? [{ value: biggest }] : []),
+      setOrderByIndex: () => {},
+      requestLimitedSnapshot: request,
+      requestSnapshot: request,
+    }
+    const info = createOrderByInfo()
+    const loader = new OrderedSourceLoader(
+      info,
+      subscription as unknown as CollectionSubscription,
+      `row`,
+      (promise) => {
+        if (!(promise instanceof Promise)) return
+        const participant = { settled: false }
+        tracked.push(participant)
+        void promise.then(
+          () => {
+            participant.settled = true
+          },
+          () => {
+            participant.settled = true
+          },
+        )
+      },
+    )
+
+    loader.start()
+    for (let step = 0; step < 20; step++) {
+      expect(requests[step]).toBeDefined()
+      if (step % 2 === 0) biggest = { rank: step / 2 }
+      requests[step]!.resolve()
+      await Promise.resolve()
+      await Promise.resolve()
+      await Promise.resolve()
+    }
+
+    // One request is active and its predecessor may still be settling during
+    // the handoff. Earlier ancestors must already be collectible.
+    expect(
+      tracked.filter(({ settled }) => !settled).length,
+    ).toBeLessThanOrEqual(2)
+    loader.dispose()
+  })
+
+  it.each([
+    {
+      name: `page`,
+      info: createOrderByInfo(),
+      expectedMethod: `limited`,
+    },
+    {
+      name: `prefix`,
+      info: createOrderByInfo({ index: undefined }),
+      expectedMethod: `snapshot`,
+    },
+    {
+      name: `full source`,
+      info: createOrderByInfo({ requiresFullSource: true }),
+      expectedMethod: `snapshot`,
+    },
+  ])(
+    `keeps a callback-before-throw $name request failed until a later operation`,
+    async ({ info, expectedMethod }) => {
+      const failure = new Error(`${expectedMethod} request failed`)
+      const methods: Array<string> = []
+      let fail = true
+      const request = (
+        method: string,
+        options: {
+          onLoadSubsetResult?: (
+            result: true,
+            acquisition: LoadSubsetOptions,
+            release: ReleaseLoadSubset,
+          ) => void
+        },
+      ) => {
+        methods.push(method)
+        if (!fail) return
+        fail = false
+        options.onLoadSubsetResult?.(true, {}, () =>
+          subscription.releaseLoadSubset({}),
+        )
+        loader.loadMore()
+        throw failure
+      }
+      const subscription = {
+        setOrderByIndex: () => {},
+        releaseLoadSubset: (_options: LoadSubsetOptions) => {},
+        requestLimitedSnapshot: (options: RequestOptions) =>
+          request(`limited`, options),
+        requestSnapshot: (options: RequestOptions) =>
+          request(`snapshot`, options),
+      }
+      const loader = new OrderedSourceLoader(
+        info,
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+
+      expect(() => loader.start()).toThrow(failure)
+      await Promise.resolve()
+      await Promise.resolve()
+      expect(methods).toEqual([expectedMethod])
+      expect(loader.loadMore()).toBeUndefined()
+      expect(methods).toEqual([expectedMethod])
+
+      loader.loadMore(1)
+      expect(methods).toEqual([expectedMethod, `snapshot`])
+      loader.dispose()
+    },
+  )
+
+  it(`blocks retry reentered from provisional acquisition cleanup`, () => {
+    const failure = new Error(`prefix request failed`)
+    const methods: Array<string> = []
+    let fail = true
+    const subscription = {
+      setOrderByIndex: () => {},
+      releaseLoadSubset: (_options: LoadSubsetOptions) => {
+        loader.loadMore(1)
+      },
+      requestSnapshot: (options: RequestOptions) => {
+        methods.push(`snapshot`)
+        if (!fail) return
+        fail = false
+        options.onLoadSubsetResult?.(true, {}, () =>
+          subscription.releaseLoadSubset({}),
+        )
+        throw failure
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ index: undefined }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+
+    expect(() => loader.start()).toThrow(failure)
+    expect(methods).toEqual([`snapshot`])
+
+    loader.loadMore(2)
+    expect(methods).toEqual([`snapshot`, `snapshot`])
+    loader.dispose()
+  })
+
+  it(`preserves the request failure when provisional cleanup also throws`, async () => {
+    const requestFailure = new Error(`snapshot publication failed`)
+    const cleanupFailure = new Error(`provisional cleanup failed`)
+    const reported: Array<unknown> = []
+    const loads: Array<LoadSubsetOptions> = []
+    const unloads: Array<LoadSubsetOptions> = []
+    let failedReleaseAttempts = 0
+    const source = createCollection<{ id: number; rank: number }>({
+      id: `ordered-provisional-cleanup-error`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: 1, rank: 1 } })
+          commit()
+          markReady()
+          return {
+            loadSubset: (options) => {
+              loads.push(options)
+              return true
+            },
+            unloadSubset: (options) => {
+              unloads.push(options)
+              if (options === loads[1] && ++failedReleaseAttempts === 1) {
+                throw cleanupFailure
+              }
+            },
+          }
+        },
+      },
+    })
+    const subscription = source.subscribeChanges(
+      (changes) => {
+        if (changes.length > 0) throw requestFailure
+      },
+      { includeInitialState: false },
+    )
+    subscription.on(`loadSubset:error`, ({ error }) => reported.push(error))
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ index: undefined }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+
+    // The provisional lease's release also throws: an adapter bug, reported
+    // uncaught, so the request failure stays the reported error.
+    const uncaught = captureMicrotaskErrors()
+    try {
+      subscription.requestSnapshot({
+        where: new Func(`eq`, [new PropRef([`id`]), new Value(`unrelated`)]),
+        optimizedOnly: false,
+      })
+      expect(() => loader.start()).toThrow(requestFailure)
+      expect(subscription.lastError).toBe(requestFailure)
+      expect(reported).toEqual([requestFailure])
+      expect(unloads).toEqual([loads[1]])
+      await flushPromises()
+      expect(uncaught.errors).toEqual([cleanupFailure])
+
+      loader.dispose()
+      subscription.unsubscribe()
+      expect(unloads).toEqual([loads[1], loads[0]])
+      expect(subscription.lastError).toBe(requestFailure)
+      expect(reported).toEqual([requestFailure])
+
+      subscription.unsubscribe()
+      expect(unloads).toEqual([loads[1], loads[0]])
+    } finally {
+      uncaught.restore()
+      loader.dispose()
+      subscription.unsubscribe()
+      await source.cleanup()
+    }
+  })
+
+  it.each([
+    [`string`, `snapshot publication failed`],
+    [`undefined`, undefined],
+  ] as const)(
+    `normalizes a %s provisional failure once for every observer`,
+    async (_label, thrownValue) => {
+      const cleanupFailure = new Error(`provisional cleanup failed`)
+      const reported: Array<unknown> = []
+      let unloads = 0
+      const source = createCollection<{ id: number; rank: number }>({
+        id: `ordered-provisional-non-error-${String(thrownValue)}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        startSync: true,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            begin()
+            write({ type: `insert`, value: { id: 1, rank: 1 } })
+            commit()
+            markReady()
+            return {
+              loadSubset: () => true,
+              unloadSubset: () => {
+                unloads++
+                if (unloads === 1) throw cleanupFailure
+              },
+            }
+          },
+        },
+      })
+      const subscription = source.subscribeChanges(
+        (changes) => {
+          if (changes.length > 0) throw thrownValue
+        },
+        { includeInitialState: false },
+      )
+      subscription.on(`loadSubset:error`, ({ error }) => reported.push(error))
+      const loader = new OrderedSourceLoader(
+        createOrderByInfo({ index: undefined }),
+        subscription as unknown as CollectionSubscription,
+        `row`,
+      )
+      const notCaught = Symbol(`not caught`)
+      let caught: unknown = notCaught
+      const uncaught = captureMicrotaskErrors()
+
+      try {
+        loader.start()
+      } catch (error) {
+        caught = error
+      }
+      await flushPromises()
+      uncaught.restore()
+      // The provisional release's error is an adapter bug, reported uncaught.
+      expect(uncaught.errors).toEqual([cleanupFailure])
+
+      expect(caught).not.toBe(notCaught)
+      expect(caught).toBeInstanceOf(Error)
+      expect((caught as Error).message).toBe(String(thrownValue))
+      expect(subscription.lastError).toBe(caught)
+      expect(reported).toEqual([caught])
+
+      loader.dispose()
+      subscription.unsubscribe()
+      await source.cleanup()
+    },
+  )
+
+  it(`retires an acquisition when its internal result observer throws`, async () => {
+    const observerFailure = new Error(`ordered result observer failed`)
+    const acquisition: LoadSubsetOptions = {}
+    const methods: Array<string> = []
+    const releases: Array<LoadSubsetOptions> = []
+    let failObserver = true
+    const subscription = {
+      setOrderByIndex: () => {},
+      releaseLoadSubset: (options: LoadSubsetOptions) => {
+        releases.push(options)
+        loader.loadMore(1)
+      },
+      requestSnapshot: (options: RequestOptions) => {
+        methods.push(`snapshot`)
+        options.onLoadSubsetResult?.(true, acquisition, () =>
+          subscription.releaseLoadSubset(acquisition),
+        )
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ index: undefined }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+      () => {
+        if (!failObserver) return
+        failObserver = false
+        throw observerFailure
+      },
+    )
+
+    expect(() => loader.start()).toThrow(observerFailure)
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(releases).toEqual([acquisition])
+    expect(methods).toEqual([`snapshot`])
+
+    expect(loader.loadMore()).toBeUndefined()
+    expect(methods).toEqual([`snapshot`])
+
+    loader.loadMore(1)
+    expect(methods).toEqual([`snapshot`, `snapshot`])
+    loader.dispose()
+  })
+
+  it(`does not replace a failed acquisition while its release is running`, async () => {
+    const requestFailure = new Error(`ordered acquisition rejected`)
+    const releaseFailure = new Error(`ordered acquisition release failed`)
+    const acquisition: LoadSubsetOptions = {}
+    const methods: Array<string> = []
+    let firstRequest = true
+    const subscription = {
+      setOrderByIndex: () => {},
+      releaseLoadSubset: (_options: LoadSubsetOptions) => {
+        loader.loadMore(2)
+        throw releaseFailure
+      },
+      requestSnapshot: (options: RequestOptions) => {
+        methods.push(`snapshot`)
+        if (!firstRequest) return
+        firstRequest = false
+        options.onLoadSubsetResult?.(
+          Promise.reject(requestFailure),
+          acquisition,
+          () => subscription.releaseLoadSubset(acquisition),
+        )
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo({ index: undefined }),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+
+    // The release reenters, but refinement stays blocked until it returns;
+    // its error is reported uncaught and the retry then replaces the lease.
+    const uncaught = captureMicrotaskErrors()
+    try {
+      loader.start()
+      await expect(pendingPromise(loader)).rejects.toBe(requestFailure)
+      loader.loadMore(1)
+      expect(methods).toEqual([`snapshot`, `snapshot`])
+      await flushPromises()
+      expect(uncaught.errors).toEqual([releaseFailure])
+
+      loader.loadMore(3)
+      expect(methods).toEqual([`snapshot`, `snapshot`])
+    } finally {
+      uncaught.restore()
+      loader.dispose()
+    }
+  })
+
+  it(`blocks a reentrant boundary retry until a later operation`, async () => {
+    const failure = new Error(`boundary request failed`)
+    const methods: Array<string> = []
+    let failBoundary = true
+    const subscription = {
+      readOrderedSnapshot: () => [{ value: { rank: 1 } }],
+      setOrderByIndex: () => {},
+      releaseLoadSubset: (_options: LoadSubsetOptions) => {},
+      requestLimitedSnapshot: (options: RequestOptions) => {
+        methods.push(`limited`)
+        options.onLoadSubsetResult?.(
+          true,
+          {
+            orderBy: options.orderBy,
+            limit: options.limit,
+          },
+          () =>
+            subscription.releaseLoadSubset({
+              orderBy: options.orderBy,
+              limit: options.limit,
+            }),
+        )
+      },
+      requestSnapshot: (options: {
+        onLoadSubsetResult?: (
+          result: true,
+          acquisition: LoadSubsetOptions,
+          release: ReleaseLoadSubset,
+        ) => void
+      }) => {
+        methods.push(`snapshot`)
+        if (!failBoundary) return
+        failBoundary = false
+        options.onLoadSubsetResult?.(true, {}, () =>
+          subscription.releaseLoadSubset({}),
+        )
+        loader.loadMore()
+        throw failure
+      },
+    }
+    const loader = new OrderedSourceLoader(
+      createOrderByInfo(),
+      subscription as unknown as CollectionSubscription,
+      `row`,
+    )
+
+    loader.start()
+    const initial = pendingPromise(loader)
+    await expect(initial).rejects.toBe(failure)
+    expect(methods).toEqual([`limited`, `snapshot`])
+    expect(loader.loadMore()).toBeUndefined()
+    expect(methods).toEqual([`limited`, `snapshot`])
+
+    loader.loadMore(1)
+    expect(methods).toEqual([`limited`, `snapshot`, `snapshot`])
+    loader.dispose()
+  })
+})
diff --git a/packages/db/tests/query/ordered-work-oracle.property.test.ts b/packages/db/tests/query/ordered-work-oracle.property.test.ts
index 4a71fb36fe..3c4816f46a 100644
--- a/packages/db/tests/query/ordered-work-oracle.property.test.ts
+++ b/packages/db/tests/query/ordered-work-oracle.property.test.ts
@@ -7,19 +7,28 @@ import { createDeferred } from '../../src/deferred.js'
 import { LoadSubsetOperationAbortedError } from '../../src/errors.js'
 import { BTreeIndex } from '../../src/indexes/btree-index.js'
 import { createEffect } from '../../src/query/effect.js'
-import { getCollectionBuilder } from '../../src/query/live/collection-registry.js'
 import { getLoadSubsetDemandKey } from '../../src/query/ir-stable-identity.js'
 import { DeduplicatedLoadSubset } from '../../src/query/subset-dedupe.js'
-import { Func, PropRef, Value } from '../../src/query/ir.js'
 import { createLiveQueryCollection } from '../../src/query/live-query-collection.js'
 import { eq, gte, isUndefined, not } from '../../src/query/builder/functions.js'
 import {
   oracleRandomParameters,
   readOracleRunConfig,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
 import { flushPromises } from '../utils.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import {
+  compareRows,
+  expectDistinctRequests,
+  expectInitialWindows,
+  expectNoProviderStart,
+  expectRawWindow,
+  requestFingerprint,
+  rowsForScenario,
+} from './ordered-work-support.js'
+import type { Marker, Row, Scenario } from './ordered-work-support.js'
 import type { InitialQueryBuilder } from '../../src/query/builder/index.js'
 import type { DeltaEvent } from '../../src/query/effect.js'
 import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
@@ -78,26 +87,6 @@ type JoinMarker = { key: number; rowId: number }
 // Result-row ids at or above this name a matched (root row, marker) pair.
 const PAIR_ID = 1_000_000
 
-type Row = {
-  id: number
-  rank: number
-  eligible: boolean
-  label: string
-  // The marker key a joined plan matches; the row's id unless eligibility is
-  // held on the join key (EagerCase.via).
-  link?: number
-}
-
-type Marker = { id: number; rowId: number }
-
-type Scenario = {
-  middleCount: number
-  middleEligible: boolean
-  lastEligible: boolean
-  tied: boolean
-  direction: `asc` | `desc`
-}
-
 type JoinFilter = `two-alias` | `joined-only` | `some` | `none` | `to-one`
 
 // These recorder categories describe only the presence of adapter orderBy.
@@ -160,95 +149,12 @@ const exhaustiveScenarios: ReadonlyArray<Scenario> = (
   ),
 )
 
-function compareRows(direction: Scenario[`direction`]) {
-  return (left: Row, right: Row): number => {
-    const rank = left.rank - right.rank
-    return (direction === `asc` ? rank : -rank) || left.id - right.id
-  }
-}
-
-function rowsForScenario(scenario: Scenario): Array<Row> {
-  return [
-    { id: 1, rank: 0, eligible: true, label: `first` },
-    ...Array.from({ length: scenario.middleCount }, (_, index) => ({
-      id: index + 3,
-      rank: scenario.tied ? 0 : index + 1,
-      eligible: scenario.middleEligible,
-      label: `middle-${index}`,
-    })),
-    {
-      id: 2,
-      rank: scenario.middleCount + 1,
-      eligible: scenario.lastEligible,
-      label: `last`,
-    },
-  ]
-}
-
 function matchesJoinFilter(row: Row, joinFilter: JoinFilter): boolean {
   return joinFilter === `none` ? !row.eligible : row.eligible
 }
 
 let harnessId = 0
 
-// A finite request recorder, not another production identity implementation.
-// Preserve fields and primitive kinds; reject opaque values rather than merging
-// them into an empty object. Signals/subscriptions are ownership, while
-// refetch controls the attempt; none of the three changes demand identity.
-function requestFingerprint(options: LoadSubsetOptions): string {
-  const semantic = new Set([`where`, `orderBy`, `limit`, `offset`, `cursor`])
-  for (const key of Reflect.ownKeys(options)) {
-    if (
-      !semantic.has(String(key)) &&
-      key !== `signal` &&
-      key !== `subscription` &&
-      key !== `refetch`
-    )
-      throw new Error(`Unsupported request field ${String(key)}`)
-  }
-  const encode = (value: unknown): unknown => {
-    if (value === undefined) return [`undefined`]
-    if (value === null) return [`null`]
-    if (typeof value === `number`) {
-      if (!Number.isFinite(value)) throw new Error(`Nonfinite request value`)
-      return [`number`, Object.is(value, -0) ? `-0` : value]
-    }
-    if (typeof value === `boolean` || typeof value === `string`)
-      return [typeof value, value]
-    if (Array.isArray(value)) return [`array`, value.map(encode)]
-    if (typeof value !== `object`) throw new Error(`Opaque request value`)
-    const prototype = Object.getPrototypeOf(value)
-    if (
-      prototype !== Object.prototype &&
-      prototype !== null &&
-      !(value instanceof Func) &&
-      !(value instanceof PropRef) &&
-      !(value instanceof Value)
-    )
-      throw new Error(`Opaque request object`)
-    if (Reflect.ownKeys(value).some((key) => typeof key !== `string`))
-      throw new Error(`Symbol request field`)
-    // Absent optional compare fields and explicit undefined mean the same option.
-    return [
-      `object`,
-      Object.entries(value)
-        .filter(([, field]) => field !== undefined)
-        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-        .map(([key, field]) => [key, encode(field)]),
-    ]
-  }
-  return JSON.stringify(
-    encode(
-      Object.fromEntries(
-        [...semantic].map((key) => [
-          key,
-          options[key as keyof LoadSubsetOptions],
-        ]),
-      ),
-    ),
-  )
-}
-
 function copiedRow(row: Row): Row {
   const copy: Record<string, unknown> = { ...row }
   for (const field of [
@@ -262,51 +168,6 @@ function copiedRow(row: Row): Row {
   return copy as Row
 }
 
-function expectRawWindow(
-  actual: ReadonlyArray<Row>,
-  expected: ReadonlyArray<Row>,
-  direction: Scenario[`direction`],
-  idTieBreak: boolean,
-) {
-  expect([...actual].sort(compareRows(direction))).toStrictEqual(
-    [...expected].sort(compareRows(direction)),
-  )
-  for (let index = 1; index < actual.length; index++) {
-    const left = actual[index - 1]!
-    const right = actual[index]!
-    const rank =
-      direction === `asc` ? left.rank - right.rank : right.rank - left.rank
-    expect(rank || (idTieBreak ? left.id - right.id : 0)).toBeLessThanOrEqual(0)
-  }
-}
-
-function expectInitialWindows(
-  publications: ReadonlyArray<ReadonlyArray<Row>>,
-  expected: ReadonlyArray<Row>,
-  direction: Scenario[`direction`],
-  idTieBreak: boolean,
-) {
-  let published = expected.length === 0
-  for (const rows of publications) {
-    if (!published && rows.length === 0) continue
-    expectRawWindow(rows, expected, direction, idTieBreak)
-    published = true
-  }
-  expect(published, `complete initial public window reached`).toBe(true)
-}
-
-function expectNoProviderStart(before: number, after: number) {
-  expect(after, `no provider start during disposal`).toBe(before)
-}
-
-function expectDistinctRequests(
-  requests: ReadonlyArray<{ fingerprint: string }>,
-) {
-  expect(new Set(requests.map(({ fingerprint }) => fingerprint)).size).toBe(
-    requests.length,
-  )
-}
-
 async function observeConsumer(
   kind: `collection` | `effect`,
   scenario: Scenario,
@@ -1749,58 +1610,6 @@ describe(`ordered source work oracle`, () => {
     ).toBe(64)
   })
 
-  it(`rejects scrambled order and partial or regressed initial publications`, () => {
-    const rows: Array<Row> = [
-      { id: 1, rank: 1, eligible: true, label: `first` },
-      { id: 2, rank: 2, eligible: true, label: `second` },
-    ]
-    expectInitialWindows([[], rows], rows, `asc`, true)
-    expect(() =>
-      expectRawWindow([...rows].reverse(), rows, `asc`, true),
-    ).toThrow()
-    expect(() =>
-      expectInitialWindows([[rows[0]!], rows], rows, `asc`, true),
-    ).toThrow()
-    expect(() => expectInitialWindows([rows, []], rows, `asc`, true)).toThrow()
-    const tied = rows.map((row) => ({ ...row, rank: 1 })).reverse()
-    expectRawWindow(tied, tied, `asc`, false)
-    expect(() => expectRawWindow(tied, tied, `asc`, true)).toThrow()
-  })
-
-  it(`identifies repeated finite requests without the production request key`, () => {
-    const options: LoadSubsetOptions = { limit: 1 }
-    const fingerprint = requestFingerprint(options)
-    const requests = [
-      { key: `a`, fingerprint },
-      { key: `b`, fingerprint },
-    ]
-    expect(() => expectDistinctRequests(requests)).toThrow()
-    options.limit = 2
-    expectDistinctRequests([
-      requests[0]!,
-      { fingerprint: requestFingerprint(options) },
-    ])
-    expect(fingerprint).toBe(requestFingerprint({ limit: 1 }))
-    expect(() =>
-      requestFingerprint({
-        where: new Func<boolean>(`eq`, [
-          new Value(new Date()),
-          new Value(new Date()),
-        ]),
-      }),
-    ).toThrow()
-  })
-
-  it(`checks the live request recorder after disposal rather than its earlier copy`, () => {
-    const requests = [{ fingerprint: requestFingerprint({ limit: 1 }) }]
-    const returned = [...requests]
-    const before = requests.length
-    expectNoProviderStart(before, requests.length)
-    requests.push({ fingerprint: requestFingerprint({ limit: 2 }) })
-    expect(returned).toHaveLength(1)
-    expect(() => expectNoProviderStart(before, requests.length)).toThrow()
-  })
-
   it(`keeps later order-term invalidation equal across consumers`, async () => {
     const [collection, effect] = await Promise.all([
       observeLaterOrderTermMutation(`collection`),
@@ -1994,153 +1803,6 @@ describe(`ordered source work oracle`, () => {
     })
   })
 
-  it(`suppresses the initial joined-filter window while child demand settles`, async () => {
-    type Root = { id: number; rank: number; label: string }
-    const initial = { id: 1, rank: 1, label: `initial` }
-    let rootSync!: Parameters<SyncConfig<Root, number>[`sync`]>[0]
-    const root = createCollection<Root, number>({
-      id: `ordered-skip-joined-root-${harnessId++}`,
-      getKey: ({ id }) => id,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          rootSync = operations
-          operations.begin()
-          operations.write({ type: `insert`, value: initial })
-          operations.commit()
-          operations.markReady()
-        },
-      },
-    })
-    const childGate = createDeferred<void>()
-    let childLoads = 0
-    const child = createCollection<Marker, number>({
-      id: `ordered-skip-joined-child-${harnessId++}`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      startSync: true,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              childLoads++
-              return childGate.promise
-            },
-          }
-        },
-      },
-    })
-    const events: Array<string> = []
-    const effect = createEffect<{ id: number; label: string }>({
-      query: (q) =>
-        q
-          .from({ row: root })
-          .leftJoin({ marker: child }, ({ row, marker }) =>
-            eq(row.id, marker.rowId),
-          )
-          .where(({ marker }) => isUndefined(marker.rowId))
-          .orderBy(({ row }) => row.rank)
-          .limit(1)
-          .select(({ row }) => ({ id: row.id, label: row.label })),
-      skipInitial: true,
-      onBatch: (batch) => {
-        events.push(...batch.map((event) => event.type))
-      },
-    })
-    await withHistoryCleanup(
-      async () => {
-        await vi.waitFor(() => expect(childLoads).toBeGreaterThan(0))
-        await flushPromises()
-        expect(events).toEqual([])
-        childGate.resolve()
-        await flushPromises()
-        expect(events).toEqual([])
-
-        rootSync.begin()
-        rootSync.write({
-          type: `update`,
-          value: { ...initial, label: `later` },
-        })
-        const receipt = rootSync.commit()
-        if (receipt !== true) await receipt
-        await vi.waitFor(() => expect(events).toContain(`update`))
-      },
-      () => [
-        () => childGate.resolve(),
-        () => effect.dispose(),
-        () => root.cleanup(),
-        () => child.cleanup(),
-      ],
-    )
-  })
-
-  it(`avoids an extra joined-filter graph turn when the root becomes ready`, async () => {
-    type Root = { id: number; rank: number }
-    let rootSync!: Parameters<SyncConfig<Root, number>[`sync`]>[0]
-    let joinedSync!: Parameters<SyncConfig<Marker, number>[`sync`]>[0]
-    const root = createCollection<Root, number>({
-      id: `ordered-ready-root-${harnessId++}`,
-      getKey: ({ id }) => id,
-      startSync: true,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: { sync: (operations) => void (rootSync = operations) },
-    })
-    const joined = createCollection<Marker, number>({
-      id: `ordered-ready-joined-${harnessId++}`,
-      getKey: ({ id }) => id,
-      startSync: true,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (operations) => {
-          joinedSync = operations
-          return { loadSubset: () => true }
-        },
-      },
-    })
-    const live = createLiveQueryCollection({
-      id: `ordered-ready-live-${harnessId++}`,
-      startSync: true,
-      query: (q) =>
-        q
-          .from({ row: root })
-          .leftJoin({ marker: joined }, ({ row, marker }) =>
-            eq(row.id, marker.rowId),
-          )
-          .where(({ marker }) => isUndefined(marker.rowId))
-          .orderBy(({ row }) => row.rank)
-          .limit(0)
-          .select(({ row }) => ({ id: row.id })),
-    })
-    await withHistoryCleanup(
-      () => {
-        const builder = getCollectionBuilder(live)!
-        expect(
-          Object.values(builder.optimizableOrderByCollections).some(
-            (info) => info.joinedFilterSourceId !== undefined,
-          ),
-        ).toBe(true)
-        const scheduled = vi.spyOn(builder, `scheduleGraphRun`)
-        rootSync.markReady()
-        // Root readiness already schedules its ordinary graph turn.
-        expect(scheduled).toHaveBeenCalledTimes(1)
-        joinedSync.markReady()
-        // Joined readiness also rechecks the joined-filter demand gate.
-        expect(scheduled).toHaveBeenCalledTimes(3)
-        return Promise.resolve()
-      },
-      () => [
-        () => live.cleanup(),
-        () => root.cleanup(),
-        () => joined.cleanup(),
-      ],
-    )
-  })
-
   it(`restarts bounded repair when another order mutation arrives during its tie request`, async () => {
     await expect(observeMutationDuringBoundedRepair()).resolves.toMatchObject({
       rows: [3],
@@ -2162,229 +1824,6 @@ describe(`ordered source work oracle`, () => {
     ).resolves.toMatchObject({ rows: [3, 4] })
   })
 
-  it(`loads each source of a filtered join once`, async () => {
-    type Order = {
-      id: number
-      scheduledAt: string
-      status: string
-      addressId: number
-    }
-    type Charge = { id: number; addressId: number }
-    let orderLoads = 0
-    let chargeLoads = 0
-    const orders = createCollection<Order>({
-      id: `ordered-filtered-join-orders`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({
-            type: `insert`,
-            value: {
-              id: 1,
-              scheduledAt: `2024-01-15`,
-              status: `queued`,
-              addressId: 1,
-            },
-          })
-          write({
-            type: `insert`,
-            value: {
-              id: 2,
-              scheduledAt: `2024-01-10`,
-              status: `queued`,
-              addressId: 2,
-            },
-          })
-          commit()
-          markReady()
-          return {
-            loadSubset: () => {
-              orderLoads++
-              return true
-            },
-          }
-        },
-      },
-    })
-    const charges = createCollection<Charge>({
-      id: `ordered-filtered-join-charges`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: 10, addressId: 1 } })
-          write({ type: `insert`, value: { id: 20, addressId: 2 } })
-          commit()
-          markReady()
-          return {
-            loadSubset: () => {
-              chargeLoads++
-              return true
-            },
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ order: orders })
-        .where(({ order }) => gte(order.scheduledAt, `2024-01-12`))
-        .where(({ order }) => eq(order.status, `queued`))
-        .innerJoin({ charge: charges }, ({ order, charge }) =>
-          eq(order.addressId, charge.addressId),
-        ),
-    )
-
-    try {
-      await live.preload()
-      expect(
-        [...live.values()].map(({ order, charge }) => [order.id, charge.id]),
-      ).toEqual([[1, 10]])
-      expect(orderLoads).toBe(1)
-      expect(chargeLoads).toBe(1)
-    } finally {
-      await Promise.all([live.cleanup(), orders.cleanup(), charges.cleanup()])
-    }
-  })
-
-  it.each([`collection`, `effect`] as const)(
-    `does no source work for a zero-sized %s window`,
-    async (consumer) => {
-      let loads = 0
-      const source = createCollection<Row, number>({
-        id: `ordered-zero-window`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                loads++
-                return true
-              },
-            }
-          },
-        },
-      })
-      const query = (q: InitialQueryBuilder) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.rank)
-          .limit(0)
-      const live =
-        consumer === `collection`
-          ? createLiveQueryCollection({
-              id: `ordered-zero-window-live`,
-              query,
-              startSync: true,
-            })
-          : undefined
-      const effect =
-        consumer === `effect`
-          ? createEffect({ query, onBatch: () => {} })
-          : undefined
-
-      try {
-        if (live) await live.preload()
-        else await flushPromises()
-        expect(loads).toBe(0)
-      } finally {
-        if (effect) await effect.dispose()
-        if (live) await live.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-
-  it.each(
-    ([`collection`, `effect`] as const).flatMap((consumer) =>
-      ([`eager`, `off`] as const).map((autoIndex) => ({
-        consumer,
-        autoIndex,
-      })),
-    ),
-  )(
-    `does no source work for a joined $consumer with a zero-sized $autoIndex window`,
-    async ({ consumer, autoIndex }) => {
-      let rowLoads = 0
-      let markerLoads = 0
-      const source = createCollection<Row, number>({
-        id: `ordered-zero-window-unindexed-${consumer}-source`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex,
-        defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                rowLoads++
-                return true
-              },
-            }
-          },
-        },
-      })
-      const markers = createCollection<Marker, number>({
-        id: `ordered-zero-window-unindexed-${consumer}-marker`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex,
-        defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                markerLoads++
-                return true
-              },
-            }
-          },
-        },
-      })
-      const query = (q: InitialQueryBuilder) =>
-        q
-          .from({ row: source })
-          .innerJoin({ marker: markers }, ({ row, marker }) =>
-            eq(row.id, marker.rowId),
-          )
-          .orderBy(({ row }) => row.rank)
-          .limit(0)
-      const live =
-        consumer === `collection`
-          ? createLiveQueryCollection({ query, startSync: true })
-          : undefined
-      const effect =
-        consumer === `effect`
-          ? createEffect({ query, onBatch: () => {} })
-          : undefined
-
-      try {
-        if (live) await live.preload()
-        else await flushPromises()
-        expect({ rowLoads, markerLoads }).toEqual({
-          rowLoads: 0,
-          markerLoads: 0,
-        })
-      } finally {
-        if (effect) await effect.dispose()
-        if (live) await live.cleanup()
-        await Promise.all([source.cleanup(), markers.cleanup()])
-      }
-    },
-  )
-
   it.each(
     ([`collection`, `effect`] as const).flatMap((consumer) =>
       [2, 5].flatMap((limit) =>
@@ -2469,7 +1908,7 @@ describe(`ordered source work oracle`, () => {
       try {
         if (live) await live.preload()
         await flushPromises()
-        const expected = [...rows].sort(compareRows(direction)).slice(0, limit)
+        const expected = expectedVisibleWindow(rows, direction, limit)
         expect(readRows()).toEqual(expected)
         const loadCount = loads
         const row = position === `first` ? expected[0]! : expected.at(-1)!
@@ -3169,156 +2608,6 @@ describe(`ordered source work oracle`, () => {
     )
   })
 
-  it.each([`resolve`, `reject`, `retire`] as const)(
-    `keeps a widened window aligned with existing joined demand (%s)`,
-    async (outcome) => {
-      type Root = { id: number; rank: number }
-      type Child = { id: number; rootId: number }
-      const childGate = createDeferred<void>()
-      const rootContinuationGate = createDeferred<void>()
-      const rootRequests: Array<LoadSubsetOptions> = []
-      let childLoads = 0
-      let rootSync!: Parameters<SyncConfig<Root, number>[`sync`]>[0]
-      const rootCollection = createCollection<Root, number>({
-        id: `ordered-held-window-root`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: (operations) => {
-            rootSync = operations
-            const { begin, write, commit, markReady } = operations
-            markReady()
-            let delivered = false
-            return {
-              loadSubset: async (options) => {
-                rootRequests.push(options)
-                if (options.cursor) await rootContinuationGate.promise
-                if (!delivered && options.orderBy) {
-                  delivered = true
-                  begin()
-                  write({ type: `insert`, value: { id: 1, rank: 1 } })
-                  const receipt = commit(options.signal)
-                  if (receipt !== true) await receipt
-                }
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const childCollection = createCollection<Child, number>({
-        id: `ordered-held-window-child`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: ({ markReady }) => {
-            markReady()
-            return {
-              loadSubset: () => {
-                childLoads++
-                return childGate.promise
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const live = createLiveQueryCollection({
-        id: `ordered-held-window-live`,
-        startSync: false,
-        query: (q) =>
-          q
-            .from({ root: rootCollection })
-            .leftJoin({ child: childCollection }, ({ root, child }) =>
-              eq(root.id, child.rootId),
-            )
-            .where(({ child }) => isUndefined(child.rootId))
-            .orderBy(({ root }) => root.rank)
-            .limit(1)
-            .select(({ root }) => ({ id: root.id })),
-      })
-
-      await withHistoryCleanup(
-        async () => {
-          const preload = live.preload()
-          void preload.catch(() => {})
-          await vi.waitFor(() => {
-            expect(childLoads).toBe(1)
-            expect(rootRequests).toHaveLength(2)
-          })
-
-          let moveSettled = false
-          const move = Promise.resolve(
-            live.utils.setWindow({ offset: 0, limit: 2 }),
-          ).then(() => {
-            moveSettled = true
-          })
-          await flushPromises()
-          expect(moveSettled).toBe(false)
-          expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
-          expect(live.toArray.map(({ id }) => id)).toEqual([])
-
-          if (outcome === `reject`) {
-            childGate.reject(new Error(`joined demand failed`))
-            await expect(move).rejects.toThrow(`joined demand failed`)
-            expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
-            await Promise.allSettled([preload])
-            return
-          }
-
-          if (outcome === `retire`) {
-            rootSync.begin()
-            rootSync.write({
-              type: `delete`,
-              value: { id: 1, rank: 1 },
-            })
-            const receipt = rootSync.commit()
-            if (receipt !== true) await receipt
-            rootContinuationGate.resolve()
-            await vi.waitFor(() => expect(moveSettled).toBe(true))
-            expect(rootRequests.length).toBeGreaterThan(2)
-            expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
-            expect(live.toArray).toEqual([])
-            childGate.reject(new Error(`obsolete joined demand failed`))
-            await flushPromises()
-            expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
-            return
-          }
-
-          childGate.resolve()
-          await vi.waitFor(() =>
-            expect(
-              rootRequests.some(({ cursor }) => cursor !== undefined),
-            ).toBe(true),
-          )
-          await flushPromises()
-          expect(moveSettled).toBe(false)
-          expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
-          rootContinuationGate.resolve()
-          await Promise.all([move, preload])
-          expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
-          expect(live.toArray.map(({ id }) => id)).toEqual([1])
-          expect(rootRequests.some(({ cursor }) => cursor !== undefined)).toBe(
-            true,
-          )
-        },
-        () => [
-          () => childGate.resolve(),
-          () => rootContinuationGate.resolve(),
-          () => live.cleanup(),
-          () => rootCollection.cleanup(),
-          () => childCollection.cleanup(),
-        ],
-      )
-    },
-  )
-
   it(`resumes bounded ordered repair after joined demand settles`, async () => {
     type Root = { id: number; rank: number }
     type Child = { id: number; rootId: number }
@@ -3744,71 +3033,6 @@ describe(`ordered source work oracle`, () => {
     }
   })
 
-  it.each([false, true])(
-    `cancels queued ordered recovery on cleanup (restart=%s)`,
-    async (restart) => {
-      const seedRow: Row = { id: 1, rank: 1, eligible: true, label: `retained` }
-      let sync!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
-      let installed = false
-      const requests: Array<LoadSubsetOptions> = []
-      const source = createCollection<Row, number>({
-        id: `queued-recovery-cleanup-${harnessId++}`,
-        getKey: ({ id }) => id,
-        syncMode: `on-demand`,
-        startSync: true,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: (operations) => {
-            sync = operations
-            operations.markReady()
-            return {
-              loadSubset: (options) => {
-                requests.push(options)
-                if (installed) return true
-                installed = true
-                operations.begin()
-                operations.write({ type: `insert`, value: seedRow })
-                return operations.commit()
-              },
-              unloadSubset: () => {},
-            }
-          },
-        },
-      })
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.rank)
-          .limit(1),
-      )
-      try {
-        await live.preload()
-        const initialRequests = requests.length
-        sync.begin()
-        sync.truncate()
-        installed = false
-        expect(sync.commit()).toBe(true)
-        await live.cleanup()
-        await flushPromises()
-        expect(requests).toHaveLength(initialRequests)
-        if (restart) {
-          await live.preload()
-          expect(live.toArray.map(({ id }) => id)).toEqual([1])
-          expect(live.utils.lastSubsetError).toBeUndefined()
-          expect(requests.length).toBeGreaterThan(initialRequests)
-        }
-        expect(
-          requests.filter(
-            ({ where, limit }) => where === undefined && limit === undefined,
-          ),
-        ).toEqual([])
-      } finally {
-        await Promise.all([live.cleanup(), source.cleanup()])
-      }
-    },
-  )
-
   it.each([
     { name: `until full-source recovery settles`, failure: undefined },
     {
@@ -4215,93 +3439,6 @@ describe(`ordered source work oracle`, () => {
     },
   )
 
-  it(`releases held Effect changes after an empty joined replay`, async () => {
-    type ReplayRow = { id: number; rank: number; label: string }
-    const initialRow = { id: 1, rank: 1, label: `old` }
-    let rootSync!: Parameters<SyncConfig<ReplayRow, number>[`sync`]>[0]
-    const root = createCollection<ReplayRow, number>({
-      id: `ordered-replay-wakeup-root-${harnessId++}`,
-      getKey: ({ id }) => id,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          rootSync = operations
-          operations.begin()
-          operations.write({ type: `insert`, value: initialRow })
-          operations.commit()
-          operations.markReady()
-        },
-      },
-    })
-    const replayGate = createDeferred<void>()
-    let joinedLoads = 0
-    let joinedSync!: Parameters<
-      SyncConfig<{ id: number; rowId: number }, number>[`sync`]
-    >[0]
-    const joined = createCollection<{ id: number; rowId: number }, number>({
-      id: `ordered-replay-wakeup-joined-${harnessId++}`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      startSync: true,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          joinedSync = operations
-          operations.markReady()
-          return {
-            loadSubset: () => {
-              joinedLoads++
-              return joinedLoads === 1 ? true : replayGate.promise
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const visible = new Map<number, string>()
-    const effect = createEffect<{ id: number; label: string }>({
-      query: (q) =>
-        q
-          .from({ row: root })
-          .leftJoin({ marker: joined }, ({ row, marker }) =>
-            eq(row.id, marker.rowId),
-          )
-          .where(({ marker }) => isUndefined(marker.rowId))
-          .orderBy(({ row }) => row.rank)
-          .limit(1)
-          .select(({ row }) => ({ id: row.id, label: row.label })),
-      onBatch: (events) => {
-        for (const event of events) {
-          if (event.type === `exit`) visible.delete(event.value.id)
-          else visible.set(event.value.id, event.value.label)
-        }
-      },
-    })
-    try {
-      await vi.waitFor(() => expect(visible.get(1)).toBe(`old`))
-      joinedSync.begin()
-      joinedSync.truncate()
-      const truncateReceipt = joinedSync.commit()
-      if (truncateReceipt !== true) await truncateReceipt
-      await vi.waitFor(() => expect(joinedLoads).toBeGreaterThan(1))
-
-      rootSync.begin()
-      rootSync.write({ type: `update`, value: { ...initialRow, label: `new` } })
-      const updateReceipt = rootSync.commit()
-      if (updateReceipt !== true) await updateReceipt
-      for (let i = 0; i < 5; i++) await flushPromises()
-      expect(visible.get(1)).toBe(`old`)
-
-      replayGate.resolve()
-      await vi.waitFor(() => expect(visible.get(1)).toBe(`new`))
-    } finally {
-      replayGate.resolve()
-      await Promise.all([effect.dispose(), root.cleanup(), joined.cleanup()])
-    }
-  })
-
   const { multiplier, ...replay } = readOracleRunConfig()
   const runs = 20 * multiplier
 
@@ -7753,15 +6890,7 @@ describe(`eager indexed ordered windows`, () => {
       })
       const ids = () => query.toArray.map(({ id }) => id)
       const order = (removed?: number) =>
-        rows
-          .filter(({ id }) => id !== removed)
-          .sort((left, right) =>
-            direction === `asc`
-              ? left.rank - right.rank
-              : right.rank - left.rank,
-          )
-          .slice(offset, offset + limit)
-          .map(({ id }) => id)
+        expectedInstalledWindow(rows, { direction, offset, limit }, removed)
       let unsubscribe: (() => void) | undefined
       try {
         await query.preload()
@@ -8140,3 +7269,54 @@ describe(`eager indexed ordered windows`, () => {
     checkEagerWindow,
   )
 })
+
+/**
+ * A visible ordered window after a change that leaves the ordering key alone:
+ * the first `limit` authored rows in `orderBy` order. The law is that a value
+ * change outside the key does not move rows, so this prediction also holds
+ * after such a change.
+ */
+function expectedVisibleWindow(
+  rows: ReadonlyArray<Row>,
+  direction: Scenario[`direction`],
+  limit: number,
+): Array<Row> {
+  return [...rows].sort(compareRows(direction)).slice(0, limit)
+}
+
+/**
+ * The installed window after one optimistic departure: the requested slice of
+ * the authored rows without the departed key, in rank order. The departure
+ * removes one key from a plain row list before the window is taken.
+ */
+function expectedInstalledWindow(
+  rows: ReadonlyArray<{ id: number; rank: number }>,
+  {
+    direction,
+    offset,
+    limit,
+  }: { direction: `asc` | `desc`; offset: number; limit: number },
+  removed?: number,
+): Array<number> {
+  return rows
+    .filter(({ id }) => id !== removed)
+    .sort((left, right) =>
+      direction === `asc` ? left.rank - right.rank : right.rank - left.rank,
+    )
+    .slice(offset, offset + limit)
+    .map(({ id }) => id)
+}
+
+// Each check compares production with the model it names. The grammar parts
+// are the generators of legal histories: the exhaustive small domain and the
+// full-join case that the null-group calibration samples.
+declareOracle({
+  check: [expectEagerWindow, optimisticWindowViolations, assertConsumerParity],
+  model: [
+    eagerWindow,
+    referenceOptimisticWindow,
+    expectedVisibleWindow,
+    expectedInstalledWindow,
+  ],
+  grammar: [exhaustiveScenarios, eagerFullJoinCase],
+})
diff --git a/packages/db/tests/query/ordered-work-support.ts b/packages/db/tests/query/ordered-work-support.ts
new file mode 100644
index 0000000000..017f0ad6b6
--- /dev/null
+++ b/packages/db/tests/query/ordered-work-support.ts
@@ -0,0 +1,154 @@
+// Shared request and window checkers for the ordered source work tests. The
+// oracle file ordered-work-oracle.property.test.ts owns the laws these helpers
+// are used to state; ordinary tests here import them and do not state a law.
+import { expect } from 'vitest'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import type { LoadSubsetOptions } from '../../src/types.js'
+
+export type Row = {
+  id: number
+  rank: number
+  eligible: boolean
+  label: string
+  // The marker key a joined plan matches; the row's id unless eligibility is
+  // held on the join key (EagerCase.via).
+  link?: number
+}
+
+export type Marker = { id: number; rowId: number }
+
+export type Scenario = {
+  middleCount: number
+  middleEligible: boolean
+  lastEligible: boolean
+  tied: boolean
+  direction: `asc` | `desc`
+}
+
+export function compareRows(direction: Scenario[`direction`]) {
+  return (left: Row, right: Row): number => {
+    const rank = left.rank - right.rank
+    return (direction === `asc` ? rank : -rank) || left.id - right.id
+  }
+}
+
+export function rowsForScenario(scenario: Scenario): Array<Row> {
+  return [
+    { id: 1, rank: 0, eligible: true, label: `first` },
+    ...Array.from({ length: scenario.middleCount }, (_, index) => ({
+      id: index + 3,
+      rank: scenario.tied ? 0 : index + 1,
+      eligible: scenario.middleEligible,
+      label: `middle-${index}`,
+    })),
+    {
+      id: 2,
+      rank: scenario.middleCount + 1,
+      eligible: scenario.lastEligible,
+      label: `last`,
+    },
+  ]
+}
+
+// A finite request recorder, not another production identity implementation.
+// Preserve fields and primitive kinds; reject opaque values rather than merging
+// them into an empty object. Signals/subscriptions are ownership, while
+// refetch controls the attempt; none of the three changes demand identity.
+export function requestFingerprint(options: LoadSubsetOptions): string {
+  const semantic = new Set([`where`, `orderBy`, `limit`, `offset`, `cursor`])
+  for (const key of Reflect.ownKeys(options)) {
+    if (
+      !semantic.has(String(key)) &&
+      key !== `signal` &&
+      key !== `subscription` &&
+      key !== `refetch`
+    )
+      throw new Error(`Unsupported request field ${String(key)}`)
+  }
+  const encode = (value: unknown): unknown => {
+    if (value === undefined) return [`undefined`]
+    if (value === null) return [`null`]
+    if (typeof value === `number`) {
+      if (!Number.isFinite(value)) throw new Error(`Nonfinite request value`)
+      return [`number`, Object.is(value, -0) ? `-0` : value]
+    }
+    if (typeof value === `boolean` || typeof value === `string`)
+      return [typeof value, value]
+    if (Array.isArray(value)) return [`array`, value.map(encode)]
+    if (typeof value !== `object`) throw new Error(`Opaque request value`)
+    const prototype = Object.getPrototypeOf(value)
+    if (
+      prototype !== Object.prototype &&
+      prototype !== null &&
+      !(value instanceof Func) &&
+      !(value instanceof PropRef) &&
+      !(value instanceof Value)
+    )
+      throw new Error(`Opaque request object`)
+    if (Reflect.ownKeys(value).some((key) => typeof key !== `string`))
+      throw new Error(`Symbol request field`)
+    // Absent optional compare fields and explicit undefined mean the same option.
+    return [
+      `object`,
+      Object.entries(value)
+        .filter(([, field]) => field !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([key, field]) => [key, encode(field)]),
+    ]
+  }
+  return JSON.stringify(
+    encode(
+      Object.fromEntries(
+        [...semantic].map((key) => [
+          key,
+          options[key as keyof LoadSubsetOptions],
+        ]),
+      ),
+    ),
+  )
+}
+
+export function expectRawWindow(
+  actual: ReadonlyArray<Row>,
+  expected: ReadonlyArray<Row>,
+  direction: Scenario[`direction`],
+  idTieBreak: boolean,
+) {
+  expect([...actual].sort(compareRows(direction))).toStrictEqual(
+    [...expected].sort(compareRows(direction)),
+  )
+  for (let index = 1; index < actual.length; index++) {
+    const left = actual[index - 1]!
+    const right = actual[index]!
+    const rank =
+      direction === `asc` ? left.rank - right.rank : right.rank - left.rank
+    expect(rank || (idTieBreak ? left.id - right.id : 0)).toBeLessThanOrEqual(0)
+  }
+}
+
+export function expectInitialWindows(
+  publications: ReadonlyArray<ReadonlyArray<Row>>,
+  expected: ReadonlyArray<Row>,
+  direction: Scenario[`direction`],
+  idTieBreak: boolean,
+) {
+  let published = expected.length === 0
+  for (const rows of publications) {
+    if (!published && rows.length === 0) continue
+    expectRawWindow(rows, expected, direction, idTieBreak)
+    published = true
+  }
+  expect(published, `complete initial public window reached`).toBe(true)
+}
+
+export function expectNoProviderStart(before: number, after: number) {
+  expect(after, `no provider start during disposal`).toBe(before)
+}
+
+export function expectDistinctRequests(
+  requests: ReadonlyArray<{ fingerprint: string }>,
+) {
+  expect(new Set(requests.map(({ fingerprint }) => fingerprint)).size).toBe(
+    requests.length,
+  )
+}
diff --git a/packages/db/tests/query/ordered-work.test.ts b/packages/db/tests/query/ordered-work.test.ts
new file mode 100644
index 0000000000..a8353e33cf
--- /dev/null
+++ b/packages/db/tests/query/ordered-work.test.ts
@@ -0,0 +1,754 @@
+// Ordinary tests for the ordered source work: fixed histories and checker
+// calibrations with literal expectations. They are supplemental coverage. The
+// laws they touch (ordered demand, joined-window publication, and Effect
+// readiness) are owned by ordered-work-oracle.property.test.ts.
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { BTreeIndex } from '../../src/indexes/btree-index.js'
+import { createEffect } from '../../src/query/effect.js'
+import { getCollectionBuilder } from '../../src/query/live/collection-registry.js'
+import { Func, Value } from '../../src/query/ir.js'
+import { createLiveQueryCollection } from '../../src/query/live-query-collection.js'
+import { eq, gte, isUndefined } from '../../src/query/builder/functions.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { flushPromises } from '../utils.js'
+import {
+  expectDistinctRequests,
+  expectInitialWindows,
+  expectNoProviderStart,
+  expectRawWindow,
+  requestFingerprint,
+} from './ordered-work-support.js'
+import type { InitialQueryBuilder } from '../../src/query/builder/index.js'
+import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
+import type { Marker, Row } from './ordered-work-support.js'
+
+// Distinct collection IDs for the fixed histories in this file.
+let harnessId = 0
+
+describe(`ordered source work oracle`, () => {
+  it(`rejects scrambled order and partial or regressed initial publications`, () => {
+    const rows: Array<Row> = [
+      { id: 1, rank: 1, eligible: true, label: `first` },
+      { id: 2, rank: 2, eligible: true, label: `second` },
+    ]
+    expectInitialWindows([[], rows], rows, `asc`, true)
+    expect(() =>
+      expectRawWindow([...rows].reverse(), rows, `asc`, true),
+    ).toThrow()
+    expect(() =>
+      expectInitialWindows([[rows[0]!], rows], rows, `asc`, true),
+    ).toThrow()
+    expect(() => expectInitialWindows([rows, []], rows, `asc`, true)).toThrow()
+    const tied = rows.map((row) => ({ ...row, rank: 1 })).reverse()
+    expectRawWindow(tied, tied, `asc`, false)
+    expect(() => expectRawWindow(tied, tied, `asc`, true)).toThrow()
+  })
+
+  it(`identifies repeated finite requests without the production request key`, () => {
+    const options: LoadSubsetOptions = { limit: 1 }
+    const fingerprint = requestFingerprint(options)
+    const requests = [
+      { key: `a`, fingerprint },
+      { key: `b`, fingerprint },
+    ]
+    expect(() => expectDistinctRequests(requests)).toThrow()
+    options.limit = 2
+    expectDistinctRequests([
+      requests[0]!,
+      { fingerprint: requestFingerprint(options) },
+    ])
+    expect(fingerprint).toBe(requestFingerprint({ limit: 1 }))
+    expect(() =>
+      requestFingerprint({
+        where: new Func<boolean>(`eq`, [
+          new Value(new Date()),
+          new Value(new Date()),
+        ]),
+      }),
+    ).toThrow()
+  })
+
+  it(`checks the live request recorder after disposal rather than its earlier copy`, () => {
+    const requests = [{ fingerprint: requestFingerprint({ limit: 1 }) }]
+    const returned = [...requests]
+    const before = requests.length
+    expectNoProviderStart(before, requests.length)
+    requests.push({ fingerprint: requestFingerprint({ limit: 2 }) })
+    expect(returned).toHaveLength(1)
+    expect(() => expectNoProviderStart(before, requests.length)).toThrow()
+  })
+
+  it(`suppresses the initial joined-filter window while child demand settles`, async () => {
+    type Root = { id: number; rank: number; label: string }
+    const initial = { id: 1, rank: 1, label: `initial` }
+    let rootSync!: Parameters<SyncConfig<Root, number>[`sync`]>[0]
+    const root = createCollection<Root, number>({
+      id: `ordered-skip-joined-root-${harnessId++}`,
+      getKey: ({ id }) => id,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          rootSync = operations
+          operations.begin()
+          operations.write({ type: `insert`, value: initial })
+          operations.commit()
+          operations.markReady()
+        },
+      },
+    })
+    const childGate = createDeferred<void>()
+    let childLoads = 0
+    const child = createCollection<Marker, number>({
+      id: `ordered-skip-joined-child-${harnessId++}`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      startSync: true,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              childLoads++
+              return childGate.promise
+            },
+          }
+        },
+      },
+    })
+    const events: Array<string> = []
+    const effect = createEffect<{ id: number; label: string }>({
+      query: (q) =>
+        q
+          .from({ row: root })
+          .leftJoin({ marker: child }, ({ row, marker }) =>
+            eq(row.id, marker.rowId),
+          )
+          .where(({ marker }) => isUndefined(marker.rowId))
+          .orderBy(({ row }) => row.rank)
+          .limit(1)
+          .select(({ row }) => ({ id: row.id, label: row.label })),
+      skipInitial: true,
+      onBatch: (batch) => {
+        events.push(...batch.map((event) => event.type))
+      },
+    })
+    await withHistoryCleanup(
+      async () => {
+        await vi.waitFor(() => expect(childLoads).toBeGreaterThan(0))
+        await flushPromises()
+        expect(events).toEqual([])
+        childGate.resolve()
+        await flushPromises()
+        expect(events).toEqual([])
+
+        rootSync.begin()
+        rootSync.write({
+          type: `update`,
+          value: { ...initial, label: `later` },
+        })
+        const receipt = rootSync.commit()
+        if (receipt !== true) await receipt
+        await vi.waitFor(() => expect(events).toContain(`update`))
+      },
+      () => [
+        () => childGate.resolve(),
+        () => effect.dispose(),
+        () => root.cleanup(),
+        () => child.cleanup(),
+      ],
+    )
+  })
+
+  it(`avoids an extra joined-filter graph turn when the root becomes ready`, async () => {
+    type Root = { id: number; rank: number }
+    let rootSync!: Parameters<SyncConfig<Root, number>[`sync`]>[0]
+    let joinedSync!: Parameters<SyncConfig<Marker, number>[`sync`]>[0]
+    const root = createCollection<Root, number>({
+      id: `ordered-ready-root-${harnessId++}`,
+      getKey: ({ id }) => id,
+      startSync: true,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: { sync: (operations) => void (rootSync = operations) },
+    })
+    const joined = createCollection<Marker, number>({
+      id: `ordered-ready-joined-${harnessId++}`,
+      getKey: ({ id }) => id,
+      startSync: true,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (operations) => {
+          joinedSync = operations
+          return { loadSubset: () => true }
+        },
+      },
+    })
+    const live = createLiveQueryCollection({
+      id: `ordered-ready-live-${harnessId++}`,
+      startSync: true,
+      query: (q) =>
+        q
+          .from({ row: root })
+          .leftJoin({ marker: joined }, ({ row, marker }) =>
+            eq(row.id, marker.rowId),
+          )
+          .where(({ marker }) => isUndefined(marker.rowId))
+          .orderBy(({ row }) => row.rank)
+          .limit(0)
+          .select(({ row }) => ({ id: row.id })),
+    })
+    await withHistoryCleanup(
+      () => {
+        const builder = getCollectionBuilder(live)!
+        expect(
+          Object.values(builder.optimizableOrderByCollections).some(
+            (info) => info.joinedFilterSourceId !== undefined,
+          ),
+        ).toBe(true)
+        const scheduled = vi.spyOn(builder, `scheduleGraphRun`)
+        rootSync.markReady()
+        // Root readiness already schedules its ordinary graph turn.
+        expect(scheduled).toHaveBeenCalledTimes(1)
+        joinedSync.markReady()
+        // Joined readiness also rechecks the joined-filter demand gate.
+        expect(scheduled).toHaveBeenCalledTimes(3)
+        return Promise.resolve()
+      },
+      () => [
+        () => live.cleanup(),
+        () => root.cleanup(),
+        () => joined.cleanup(),
+      ],
+    )
+  })
+
+  it(`loads each source of a filtered join once`, async () => {
+    type Order = {
+      id: number
+      scheduledAt: string
+      status: string
+      addressId: number
+    }
+    type Charge = { id: number; addressId: number }
+    let orderLoads = 0
+    let chargeLoads = 0
+    const orders = createCollection<Order>({
+      id: `ordered-filtered-join-orders`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({
+            type: `insert`,
+            value: {
+              id: 1,
+              scheduledAt: `2024-01-15`,
+              status: `queued`,
+              addressId: 1,
+            },
+          })
+          write({
+            type: `insert`,
+            value: {
+              id: 2,
+              scheduledAt: `2024-01-10`,
+              status: `queued`,
+              addressId: 2,
+            },
+          })
+          commit()
+          markReady()
+          return {
+            loadSubset: () => {
+              orderLoads++
+              return true
+            },
+          }
+        },
+      },
+    })
+    const charges = createCollection<Charge>({
+      id: `ordered-filtered-join-charges`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: 10, addressId: 1 } })
+          write({ type: `insert`, value: { id: 20, addressId: 2 } })
+          commit()
+          markReady()
+          return {
+            loadSubset: () => {
+              chargeLoads++
+              return true
+            },
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ order: orders })
+        .where(({ order }) => gte(order.scheduledAt, `2024-01-12`))
+        .where(({ order }) => eq(order.status, `queued`))
+        .innerJoin({ charge: charges }, ({ order, charge }) =>
+          eq(order.addressId, charge.addressId),
+        ),
+    )
+
+    try {
+      await live.preload()
+      expect(
+        [...live.values()].map(({ order, charge }) => [order.id, charge.id]),
+      ).toEqual([[1, 10]])
+      expect(orderLoads).toBe(1)
+      expect(chargeLoads).toBe(1)
+    } finally {
+      await Promise.all([live.cleanup(), orders.cleanup(), charges.cleanup()])
+    }
+  })
+
+  it.each([`collection`, `effect`] as const)(
+    `does no source work for a zero-sized %s window`,
+    async (consumer) => {
+      let loads = 0
+      const source = createCollection<Row, number>({
+        id: `ordered-zero-window`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                loads++
+                return true
+              },
+            }
+          },
+        },
+      })
+      const query = (q: InitialQueryBuilder) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.rank)
+          .limit(0)
+      const live =
+        consumer === `collection`
+          ? createLiveQueryCollection({
+              id: `ordered-zero-window-live`,
+              query,
+              startSync: true,
+            })
+          : undefined
+      const effect =
+        consumer === `effect`
+          ? createEffect({ query, onBatch: () => {} })
+          : undefined
+
+      try {
+        if (live) await live.preload()
+        else await flushPromises()
+        expect(loads).toBe(0)
+      } finally {
+        if (effect) await effect.dispose()
+        if (live) await live.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+
+  it.each(
+    ([`collection`, `effect`] as const).flatMap((consumer) =>
+      ([`eager`, `off`] as const).map((autoIndex) => ({
+        consumer,
+        autoIndex,
+      })),
+    ),
+  )(
+    `does no source work for a joined $consumer with a zero-sized $autoIndex window`,
+    async ({ consumer, autoIndex }) => {
+      let rowLoads = 0
+      let markerLoads = 0
+      const source = createCollection<Row, number>({
+        id: `ordered-zero-window-unindexed-${consumer}-source`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex,
+        defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                rowLoads++
+                return true
+              },
+            }
+          },
+        },
+      })
+      const markers = createCollection<Marker, number>({
+        id: `ordered-zero-window-unindexed-${consumer}-marker`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex,
+        defaultIndexType: autoIndex === `eager` ? BTreeIndex : undefined,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                markerLoads++
+                return true
+              },
+            }
+          },
+        },
+      })
+      const query = (q: InitialQueryBuilder) =>
+        q
+          .from({ row: source })
+          .innerJoin({ marker: markers }, ({ row, marker }) =>
+            eq(row.id, marker.rowId),
+          )
+          .orderBy(({ row }) => row.rank)
+          .limit(0)
+      const live =
+        consumer === `collection`
+          ? createLiveQueryCollection({ query, startSync: true })
+          : undefined
+      const effect =
+        consumer === `effect`
+          ? createEffect({ query, onBatch: () => {} })
+          : undefined
+
+      try {
+        if (live) await live.preload()
+        else await flushPromises()
+        expect({ rowLoads, markerLoads }).toEqual({
+          rowLoads: 0,
+          markerLoads: 0,
+        })
+      } finally {
+        if (effect) await effect.dispose()
+        if (live) await live.cleanup()
+        await Promise.all([source.cleanup(), markers.cleanup()])
+      }
+    },
+  )
+
+  it.each([`resolve`, `reject`, `retire`] as const)(
+    `keeps a widened window aligned with existing joined demand (%s)`,
+    async (outcome) => {
+      type Root = { id: number; rank: number }
+      type Child = { id: number; rootId: number }
+      const childGate = createDeferred<void>()
+      const rootContinuationGate = createDeferred<void>()
+      const rootRequests: Array<LoadSubsetOptions> = []
+      let childLoads = 0
+      let rootSync!: Parameters<SyncConfig<Root, number>[`sync`]>[0]
+      const rootCollection = createCollection<Root, number>({
+        id: `ordered-held-window-root`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: (operations) => {
+            rootSync = operations
+            const { begin, write, commit, markReady } = operations
+            markReady()
+            let delivered = false
+            return {
+              loadSubset: async (options) => {
+                rootRequests.push(options)
+                if (options.cursor) await rootContinuationGate.promise
+                if (!delivered && options.orderBy) {
+                  delivered = true
+                  begin()
+                  write({ type: `insert`, value: { id: 1, rank: 1 } })
+                  const receipt = commit(options.signal)
+                  if (receipt !== true) await receipt
+                }
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const childCollection = createCollection<Child, number>({
+        id: `ordered-held-window-child`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: ({ markReady }) => {
+            markReady()
+            return {
+              loadSubset: () => {
+                childLoads++
+                return childGate.promise
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const live = createLiveQueryCollection({
+        id: `ordered-held-window-live`,
+        startSync: false,
+        query: (q) =>
+          q
+            .from({ root: rootCollection })
+            .leftJoin({ child: childCollection }, ({ root, child }) =>
+              eq(root.id, child.rootId),
+            )
+            .where(({ child }) => isUndefined(child.rootId))
+            .orderBy(({ root }) => root.rank)
+            .limit(1)
+            .select(({ root }) => ({ id: root.id })),
+      })
+
+      await withHistoryCleanup(
+        async () => {
+          const preload = live.preload()
+          void preload.catch(() => {})
+          await vi.waitFor(() => {
+            expect(childLoads).toBe(1)
+            expect(rootRequests).toHaveLength(2)
+          })
+
+          let moveSettled = false
+          const move = Promise.resolve(
+            live.utils.setWindow({ offset: 0, limit: 2 }),
+          ).then(() => {
+            moveSettled = true
+          })
+          await flushPromises()
+          expect(moveSettled).toBe(false)
+          expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
+          expect(live.toArray.map(({ id }) => id)).toEqual([])
+
+          if (outcome === `reject`) {
+            childGate.reject(new Error(`joined demand failed`))
+            await expect(move).rejects.toThrow(`joined demand failed`)
+            expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
+            await Promise.allSettled([preload])
+            return
+          }
+
+          if (outcome === `retire`) {
+            rootSync.begin()
+            rootSync.write({
+              type: `delete`,
+              value: { id: 1, rank: 1 },
+            })
+            const receipt = rootSync.commit()
+            if (receipt !== true) await receipt
+            rootContinuationGate.resolve()
+            await vi.waitFor(() => expect(moveSettled).toBe(true))
+            expect(rootRequests.length).toBeGreaterThan(2)
+            expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
+            expect(live.toArray).toEqual([])
+            childGate.reject(new Error(`obsolete joined demand failed`))
+            await flushPromises()
+            expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
+            return
+          }
+
+          childGate.resolve()
+          await vi.waitFor(() =>
+            expect(
+              rootRequests.some(({ cursor }) => cursor !== undefined),
+            ).toBe(true),
+          )
+          await flushPromises()
+          expect(moveSettled).toBe(false)
+          expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 1 })
+          rootContinuationGate.resolve()
+          await Promise.all([move, preload])
+          expect(live.utils.getWindow()).toEqual({ offset: 0, limit: 2 })
+          expect(live.toArray.map(({ id }) => id)).toEqual([1])
+          expect(rootRequests.some(({ cursor }) => cursor !== undefined)).toBe(
+            true,
+          )
+        },
+        () => [
+          () => childGate.resolve(),
+          () => rootContinuationGate.resolve(),
+          () => live.cleanup(),
+          () => rootCollection.cleanup(),
+          () => childCollection.cleanup(),
+        ],
+      )
+    },
+  )
+
+  it.each([false, true])(
+    `cancels queued ordered recovery on cleanup (restart=%s)`,
+    async (restart) => {
+      const seedRow: Row = { id: 1, rank: 1, eligible: true, label: `retained` }
+      let sync!: Parameters<SyncConfig<Row, number>[`sync`]>[0]
+      let installed = false
+      const requests: Array<LoadSubsetOptions> = []
+      const source = createCollection<Row, number>({
+        id: `queued-recovery-cleanup-${harnessId++}`,
+        getKey: ({ id }) => id,
+        syncMode: `on-demand`,
+        startSync: true,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: (operations) => {
+            sync = operations
+            operations.markReady()
+            return {
+              loadSubset: (options) => {
+                requests.push(options)
+                if (installed) return true
+                installed = true
+                operations.begin()
+                operations.write({ type: `insert`, value: seedRow })
+                return operations.commit()
+              },
+              unloadSubset: () => {},
+            }
+          },
+        },
+      })
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.rank)
+          .limit(1),
+      )
+      try {
+        await live.preload()
+        const initialRequests = requests.length
+        sync.begin()
+        sync.truncate()
+        installed = false
+        expect(sync.commit()).toBe(true)
+        await live.cleanup()
+        await flushPromises()
+        expect(requests).toHaveLength(initialRequests)
+        if (restart) {
+          await live.preload()
+          expect(live.toArray.map(({ id }) => id)).toEqual([1])
+          expect(live.utils.lastSubsetError).toBeUndefined()
+          expect(requests.length).toBeGreaterThan(initialRequests)
+        }
+        expect(
+          requests.filter(
+            ({ where, limit }) => where === undefined && limit === undefined,
+          ),
+        ).toEqual([])
+      } finally {
+        await Promise.all([live.cleanup(), source.cleanup()])
+      }
+    },
+  )
+
+  it(`releases held Effect changes after an empty joined replay`, async () => {
+    type ReplayRow = { id: number; rank: number; label: string }
+    const initialRow = { id: 1, rank: 1, label: `old` }
+    let rootSync!: Parameters<SyncConfig<ReplayRow, number>[`sync`]>[0]
+    const root = createCollection<ReplayRow, number>({
+      id: `ordered-replay-wakeup-root-${harnessId++}`,
+      getKey: ({ id }) => id,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          rootSync = operations
+          operations.begin()
+          operations.write({ type: `insert`, value: initialRow })
+          operations.commit()
+          operations.markReady()
+        },
+      },
+    })
+    const replayGate = createDeferred<void>()
+    let joinedLoads = 0
+    let joinedSync!: Parameters<
+      SyncConfig<{ id: number; rowId: number }, number>[`sync`]
+    >[0]
+    const joined = createCollection<{ id: number; rowId: number }, number>({
+      id: `ordered-replay-wakeup-joined-${harnessId++}`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      startSync: true,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          joinedSync = operations
+          operations.markReady()
+          return {
+            loadSubset: () => {
+              joinedLoads++
+              return joinedLoads === 1 ? true : replayGate.promise
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const visible = new Map<number, string>()
+    const effect = createEffect<{ id: number; label: string }>({
+      query: (q) =>
+        q
+          .from({ row: root })
+          .leftJoin({ marker: joined }, ({ row, marker }) =>
+            eq(row.id, marker.rowId),
+          )
+          .where(({ marker }) => isUndefined(marker.rowId))
+          .orderBy(({ row }) => row.rank)
+          .limit(1)
+          .select(({ row }) => ({ id: row.id, label: row.label })),
+      onBatch: (events) => {
+        for (const event of events) {
+          if (event.type === `exit`) visible.delete(event.value.id)
+          else visible.set(event.value.id, event.value.label)
+        }
+      },
+    })
+    try {
+      await vi.waitFor(() => expect(visible.get(1)).toBe(`old`))
+      joinedSync.begin()
+      joinedSync.truncate()
+      const truncateReceipt = joinedSync.commit()
+      if (truncateReceipt !== true) await truncateReceipt
+      await vi.waitFor(() => expect(joinedLoads).toBeGreaterThan(1))
+
+      rootSync.begin()
+      rootSync.write({ type: `update`, value: { ...initialRow, label: `new` } })
+      const updateReceipt = rootSync.commit()
+      if (updateReceipt !== true) await updateReceipt
+      for (let i = 0; i < 5; i++) await flushPromises()
+      expect(visible.get(1)).toBe(`old`)
+
+      replayGate.resolve()
+      await vi.waitFor(() => expect(visible.get(1)).toBe(`new`))
+    } finally {
+      replayGate.resolve()
+      await Promise.all([effect.dispose(), root.cleanup(), joined.cleanup()])
+    }
+  })
+})
diff --git a/packages/db/tests/query/pagination-oracle.property.test.ts b/packages/db/tests/query/pagination-oracle.property.test.ts
index 65a31e56a4..4a87646e25 100644
--- a/packages/db/tests/query/pagination-oracle.property.test.ts
+++ b/packages/db/tests/query/pagination-oracle.property.test.ts
@@ -11,11 +11,13 @@ import {
   oracleRandomParameters,
   readOracleRunConfig,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { evaluateReferenceExpression } from '../reference-expression-oracle.js'
 import { TraceAssertionError } from '../trace-runner.js'
 import { flushPromises, mockSyncCollectionOptions } from '../utils.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
-import type { Deferred } from '../../src/deferred.js'
+import { cleanupAll } from './pagination-support.js'
+import type { PageRow } from './pagination-support.js'
 import type {
   ChangeMessage,
   LoadSubsetOptions,
@@ -67,12 +69,6 @@ import type {
  * parity.
  */
 
-type PageRow = {
-  id: number
-  rank: number
-  keep?: boolean
-}
-
 type PublicPageRow = Pick<PageRow, `id` | `rank`>
 type PublicPageChange = {
   type: `insert` | `update` | `delete`
@@ -593,22 +589,6 @@ const nullableCursorScenarioArbitrary: fc.Arbitrary<NullableCursorScenario> =
     direction: fc.constantFrom(`asc` as const, `desc` as const),
   })
 
-type CleanupTarget = {
-  cleanup: () => unknown
-}
-
-async function cleanupAll(
-  ...targets: ReadonlyArray<CleanupTarget>
-): Promise<void> {
-  const results = await Promise.allSettled(
-    targets.map((target) => Promise.resolve().then(() => target.cleanup())),
-  )
-  const rejection = results.find(
-    (result): result is PromiseRejectedResult => result.status === `rejected`,
-  )
-  if (rejection) throw rejection.reason
-}
-
 const { multiplier, ...replay } = readOracleRunConfig()
 const orderedScenarioRuns = 12 * multiplier
 const transitionScenarioRuns = 8 * multiplier
@@ -846,6 +826,16 @@ async function runPaginationScenario(
   )
 }
 
+/**
+ * The check: after every window change, the rows that a live query publishes
+ * must equal the model's window over the authoritative rows. The driver runs
+ * one history, and `referenceWindowRows` predicts each window from the rows.
+ */
+declareOracle({
+  check: [runPaginationScenario, runMultiOrderScenario],
+  model: [referenceWindowRows, referenceMultiOrder],
+})
+
 async function expectMultiOrderBoundaryMatches(): Promise<void> {
   await runMultiOrderScenario({
     rows: [
@@ -2860,125 +2850,6 @@ async function expectInflightRequestFillsNewWindow(): Promise<void> {
 }
 
 describe(`pagination recomputation oracle`, () => {
-  it.each([
-    { label: `Error`, reason: new Error(`first cleanup failed`) },
-    { label: `undefined`, reason: undefined },
-    { label: `null`, reason: null },
-    { label: `false`, reason: false },
-    { label: `zero`, reason: 0 },
-    { label: `NaN`, reason: Number.NaN },
-    { label: `empty string`, reason: `` },
-  ])(
-    `observes $label cleanup failure after every teardown settles`,
-    async ({ reason: firstFailure }) => {
-      const secondFailure = new Error(`second cleanup failed`)
-      const firstFailureRelease = createDeferred<void>()
-      const lastCleanupRelease = createDeferred<void>()
-      const repeatedFirstFailureRelease = createDeferred<void>()
-      const repeatedLastCleanupRelease = createDeferred<void>()
-      const events: Array<string> = []
-      const unhandled: Array<unknown> = []
-      const recordUnhandled = (reason: unknown) => unhandled.push(reason)
-      const createTargets = (
-        firstRelease: Deferred<void>,
-        lastRelease: Deferred<void>,
-      ): ReadonlyArray<CleanupTarget> => [
-        {
-          cleanup: async () => {
-            events.push(`first`)
-            await firstRelease.promise
-            throw firstFailure
-          },
-        },
-        {
-          cleanup: () => {
-            events.push(`second`)
-            throw secondFailure
-          },
-        },
-        {
-          cleanup: async () => {
-            events.push(`third`)
-            await lastRelease.promise
-          },
-        },
-      ]
-      const observeFirstFailure = (cleanup: Promise<void>) =>
-        cleanup.then(
-          () => {
-            throw new Error(`expected cleanup to reject`)
-          },
-          (error: unknown) => expect(error).toBe(firstFailure),
-        )
-      let cleanupFinished = false
-      process.on(`unhandledRejection`, recordUnhandled)
-
-      try {
-        const cleanup = cleanupAll(
-          ...createTargets(firstFailureRelease, lastCleanupRelease),
-        ).finally(() => {
-          cleanupFinished = true
-        })
-        const observedFailure = observeFirstFailure(cleanup)
-
-        await flushPromises()
-        expect(events).toEqual([`first`, `second`, `third`])
-        expect(cleanupFinished).toBe(false)
-        expect(unhandled).toEqual([])
-
-        firstFailureRelease.resolve()
-        await flushPromises()
-        expect(cleanupFinished).toBe(false)
-        expect(unhandled).toEqual([])
-
-        lastCleanupRelease.resolve()
-        await observedFailure
-        await flushPromises()
-        expect(cleanupFinished).toBe(true)
-        expect(unhandled).toEqual([])
-
-        let repeatedCleanupFinished = false
-        const repeatedCleanup = cleanupAll(
-          ...createTargets(
-            repeatedFirstFailureRelease,
-            repeatedLastCleanupRelease,
-          ),
-        ).finally(() => {
-          repeatedCleanupFinished = true
-        })
-        const repeatedObservedFailure = observeFirstFailure(repeatedCleanup)
-        await flushPromises()
-        expect(events).toEqual([
-          `first`,
-          `second`,
-          `third`,
-          `first`,
-          `second`,
-          `third`,
-        ])
-        expect(repeatedCleanupFinished).toBe(false)
-        expect(unhandled).toEqual([])
-
-        repeatedFirstFailureRelease.resolve()
-        await flushPromises()
-        expect(repeatedCleanupFinished).toBe(false)
-        expect(unhandled).toEqual([])
-
-        repeatedLastCleanupRelease.resolve()
-        await repeatedObservedFailure
-        await flushPromises()
-        expect(repeatedCleanupFinished).toBe(true)
-        expect(unhandled).toEqual([])
-      } finally {
-        firstFailureRelease.resolve()
-        lastCleanupRelease.resolve()
-        repeatedFirstFailureRelease.resolve()
-        repeatedLastCleanupRelease.resolve()
-        process.off(`unhandledRejection`, recordUnhandled)
-      }
-    },
-  )
-
   it(`refills a joined result window through a contract-compliant source`, async () => {
     type ParentRow = { id: number; rank: number; groupId: number }
     type ChildRow = { id: number; groupId: number }
@@ -3134,68 +3005,6 @@ describe(`pagination recomputation oracle`, () => {
     })
   })
 
-  it(`does not refetch when live insertion fills a settled empty window`, async () => {
-    let sync!: Parameters<SyncConfig<PageRow, number>[`sync`]>[0]
-    const requests: Array<LoadSubsetOptions> = []
-    const source = createCollection<PageRow, number>({
-      id: `settled-empty-window`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      startSync: true,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          sync = operations
-          operations.markReady()
-          return {
-            loadSubset: (options) => {
-              requests.push(options)
-              return true
-            },
-            unloadSubset: () => {},
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((q) =>
-      q
-        .from({ row: source })
-        .orderBy(({ row }) => row.rank)
-        .limit(1),
-    )
-    try {
-      await live.preload()
-      expect(live.toArray).toEqual([])
-      expect(requests).toHaveLength(1)
-
-      sync.begin()
-      sync.write({ type: `insert`, value: { id: 1, rank: 1 } })
-      const receipt = sync.commit()
-      if (receipt !== true) await receipt
-      await flushPromises()
-
-      expect(live.toArray.map(({ id, rank }) => ({ id, rank }))).toEqual([
-        { id: 1, rank: 1 },
-      ])
-      expect(live.utils.lastSubsetError).toBeUndefined()
-      // Correct rows alone would miss a repeated prefix and boundary fetch.
-      expect(
-        requests.map(({ limit, offset, orderBy, where, cursor }) => ({
-          limit,
-          offset,
-          ordered: Boolean(orderBy),
-          filtered: Boolean(where),
-          cursor: Boolean(cursor),
-        })),
-      ).toEqual([
-        { limit: 1, offset: 0, ordered: true, filtered: false, cursor: false },
-      ])
-    } finally {
-      await cleanupAll(live, source)
-    }
-  })
-
   it(`materializes an offset past the final row`, async () => {
     await runPaginationScenario({
       ranks: [0, 1],
@@ -6178,63 +5987,6 @@ describe(`pagination recomputation oracle`, () => {
     },
   )
 
-  it(`does not recover the full source when a visible row keeps its order`, async () => {
-    const loads: Array<LoadSubsetOptions> = []
-    let begin!: () => void
-    let write!: (message: { type: `insert` | `update`; value: PageRow }) => void
-    let commit!: () => void
-    const source = createCollection<PageRow>({
-      id: `pagination-stable-order-update-${collectionSequence++}`,
-      getKey: ({ id }) => id,
-      syncMode: `on-demand`,
-      startSync: true,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      sync: {
-        sync: (operations) => {
-          begin = operations.begin
-          write = operations.write
-          commit = operations.commit
-          operations.markReady()
-          return {
-            loadSubset: (options: LoadSubsetOptions) => {
-              loads.push(options)
-              begin()
-              write({
-                type: `insert`,
-                value: { id: 1, rank: 0, keep: true },
-              })
-              commit()
-              return true
-            },
-          }
-        },
-      },
-    })
-    const live = createLiveQueryCollection((query) =>
-      query
-        .from({ row: source })
-        .orderBy(({ row }) => row.rank, `asc`)
-        .limit(1),
-    )
-
-    try {
-      await live.preload()
-      const loadsBeforeMutation = loads.length
-      begin()
-      write({ type: `update`, value: { id: 1, rank: 0, keep: false } })
-      commit()
-      await flushPromises()
-
-      expect(
-        live.toArray.map(({ id, rank, keep }) => ({ id, rank, keep })),
-      ).toEqual([{ id: 1, rank: 0, keep: false }])
-      expect(loads).toHaveLength(loadsBeforeMutation)
-    } finally {
-      await cleanupAll(live, source)
-    }
-  })
-
   it.each([
     [`top-one`, [0, 0], { offset: 0, limit: 1 }, 1, 1],
     [`offset`, [0, 0, 1], { offset: 1, limit: 1 }, 2, 2],
@@ -6751,33 +6503,6 @@ describe(`pagination recomputation oracle`, () => {
     }
   })
 
-  it.each([{ ids: [1, Number.NaN] }, { ids: [Number.NaN, 1] }])(
-    `keeps finite public keys before NaN across insertion order`,
-    async ({ ids }) => {
-      const source = createCollection(
-        mockSyncCollectionOptions({
-          id: `pagination-nan-key-order-${collectionSequence++}`,
-          initialData: ids.map((id) => ({ id, rank: 0 })),
-          getKey: (row: PageRow) => row.id,
-          autoIndex: `eager`,
-        }),
-      )
-      const live = createLiveQueryCollection((query) =>
-        query
-          .from({ row: source })
-          .orderBy(({ row }) => row.rank, `asc`)
-          .limit(1),
-      )
-
-      try {
-        await live.preload()
-        expect(Array.from(live.values(), ({ id }) => id)).toEqual([1])
-      } finally {
-        await cleanupAll(live, source)
-      }
-    },
-  )
-
   it(`stabilizes an on-demand window with a NaN public-key tie`, async () => {
     const loads = await runAdversarialOrderedProviderScenario({
       providerRows: [
diff --git a/packages/db/tests/query/pagination-support.ts b/packages/db/tests/query/pagination-support.ts
new file mode 100644
index 0000000000..7bb958ff57
--- /dev/null
+++ b/packages/db/tests/query/pagination-support.ts
@@ -0,0 +1,27 @@
+/**
+ * Row type and teardown shared by the pagination oracle and its ordinary unit
+ * tests in pagination.test.ts. The law that the ordered window equals
+ * independent recomputation is owned by pagination-oracle.property.test.ts.
+ */
+
+export type PageRow = {
+  id: number
+  rank: number
+  keep?: boolean
+}
+
+export type CleanupTarget = {
+  cleanup: () => unknown
+}
+
+export async function cleanupAll(
+  ...targets: ReadonlyArray<CleanupTarget>
+): Promise<void> {
+  const results = await Promise.allSettled(
+    targets.map((target) => Promise.resolve().then(() => target.cleanup())),
+  )
+  const rejection = results.find(
+    (result): result is PromiseRejectedResult => result.status === `rejected`,
+  )
+  if (rejection) throw rejection.reason
+}
diff --git a/packages/db/tests/query/pagination.test.ts b/packages/db/tests/query/pagination.test.ts
new file mode 100644
index 0000000000..141808c28a
--- /dev/null
+++ b/packages/db/tests/query/pagination.test.ts
@@ -0,0 +1,287 @@
+/**
+ * Ordinary unit tests moved out of pagination-oracle.property.test.ts. They
+ * compare with values written in the test, not with the model: a teardown
+ * observation, a settled empty window that a live insert fills, a stable-order
+ * update that needs no reload, and a NaN public-key tie. The law they belong
+ * to, ordered windows equal independent recomputation, is owned by
+ * pagination-oracle.property.test.ts.
+ */
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import { BTreeIndex } from '../../src/index.js'
+import { createLiveQueryCollection } from '../../src/query/live-query-collection.js'
+import { flushPromises, mockSyncCollectionOptions } from '../utils.js'
+import { cleanupAll } from './pagination-support.js'
+import type { CleanupTarget, PageRow } from './pagination-support.js'
+import type { Deferred } from '../../src/deferred.js'
+import type { LoadSubsetOptions, SyncConfig } from '../../src/types.js'
+
+let collectionSequence = 0
+
+describe(`pagination recomputation oracle`, () => {
+  it.each([
+    { label: `Error`, reason: new Error(`first cleanup failed`) },
+    { label: `undefined`, reason: undefined },
+    { label: `null`, reason: null },
+    { label: `false`, reason: false },
+    { label: `zero`, reason: 0 },
+    { label: `NaN`, reason: Number.NaN },
+    { label: `empty string`, reason: `` },
+  ])(
+    `observes $label cleanup failure after every teardown settles`,
+    async ({ reason: firstFailure }) => {
+      const secondFailure = new Error(`second cleanup failed`)
+      const firstFailureRelease = createDeferred<void>()
+      const lastCleanupRelease = createDeferred<void>()
+      const repeatedFirstFailureRelease = createDeferred<void>()
+      const repeatedLastCleanupRelease = createDeferred<void>()
+      const events: Array<string> = []
+      const unhandled: Array<unknown> = []
+      const recordUnhandled = (reason: unknown) => unhandled.push(reason)
+      const createTargets = (
+        firstRelease: Deferred<void>,
+        lastRelease: Deferred<void>,
+      ): ReadonlyArray<CleanupTarget> => [
+        {
+          cleanup: async () => {
+            events.push(`first`)
+            await firstRelease.promise
+            throw firstFailure
+          },
+        },
+        {
+          cleanup: () => {
+            events.push(`second`)
+            throw secondFailure
+          },
+        },
+        {
+          cleanup: async () => {
+            events.push(`third`)
+            await lastRelease.promise
+          },
+        },
+      ]
+      const observeFirstFailure = (cleanup: Promise<void>) =>
+        cleanup.then(
+          () => {
+            throw new Error(`expected cleanup to reject`)
+          },
+          (error: unknown) => expect(error).toBe(firstFailure),
+        )
+      let cleanupFinished = false
+      process.on(`unhandledRejection`, recordUnhandled)
+
+      try {
+        const cleanup = cleanupAll(
+          ...createTargets(firstFailureRelease, lastCleanupRelease),
+        ).finally(() => {
+          cleanupFinished = true
+        })
+        const observedFailure = observeFirstFailure(cleanup)
+
+        await flushPromises()
+        expect(events).toEqual([`first`, `second`, `third`])
+        expect(cleanupFinished).toBe(false)
+        expect(unhandled).toEqual([])
+
+        firstFailureRelease.resolve()
+        await flushPromises()
+        expect(cleanupFinished).toBe(false)
+        expect(unhandled).toEqual([])
+
+        lastCleanupRelease.resolve()
+        await observedFailure
+        await flushPromises()
+        expect(cleanupFinished).toBe(true)
+        expect(unhandled).toEqual([])
+
+        let repeatedCleanupFinished = false
+        const repeatedCleanup = cleanupAll(
+          ...createTargets(
+            repeatedFirstFailureRelease,
+            repeatedLastCleanupRelease,
+          ),
+        ).finally(() => {
+          repeatedCleanupFinished = true
+        })
+        const repeatedObservedFailure = observeFirstFailure(repeatedCleanup)
+        await flushPromises()
+        expect(events).toEqual([
+          `first`,
+          `second`,
+          `third`,
+          `first`,
+          `second`,
+          `third`,
+        ])
+        expect(repeatedCleanupFinished).toBe(false)
+        expect(unhandled).toEqual([])
+
+        repeatedFirstFailureRelease.resolve()
+        await flushPromises()
+        expect(repeatedCleanupFinished).toBe(false)
+        expect(unhandled).toEqual([])
+
+        repeatedLastCleanupRelease.resolve()
+        await repeatedObservedFailure
+        await flushPromises()
+        expect(repeatedCleanupFinished).toBe(true)
+        expect(unhandled).toEqual([])
+      } finally {
+        firstFailureRelease.resolve()
+        lastCleanupRelease.resolve()
+        repeatedFirstFailureRelease.resolve()
+        repeatedLastCleanupRelease.resolve()
+        process.off(`unhandledRejection`, recordUnhandled)
+      }
+    },
+  )
+
+  it(`does not refetch when live insertion fills a settled empty window`, async () => {
+    let sync!: Parameters<SyncConfig<PageRow, number>[`sync`]>[0]
+    const requests: Array<LoadSubsetOptions> = []
+    const source = createCollection<PageRow, number>({
+      id: `settled-empty-window`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      startSync: true,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          sync = operations
+          operations.markReady()
+          return {
+            loadSubset: (options) => {
+              requests.push(options)
+              return true
+            },
+            unloadSubset: () => {},
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((q) =>
+      q
+        .from({ row: source })
+        .orderBy(({ row }) => row.rank)
+        .limit(1),
+    )
+    try {
+      await live.preload()
+      expect(live.toArray).toEqual([])
+      expect(requests).toHaveLength(1)
+
+      sync.begin()
+      sync.write({ type: `insert`, value: { id: 1, rank: 1 } })
+      const receipt = sync.commit()
+      if (receipt !== true) await receipt
+      await flushPromises()
+
+      expect(live.toArray.map(({ id, rank }) => ({ id, rank }))).toEqual([
+        { id: 1, rank: 1 },
+      ])
+      expect(live.utils.lastSubsetError).toBeUndefined()
+      // Correct rows alone would miss a repeated prefix and boundary fetch.
+      expect(
+        requests.map(({ limit, offset, orderBy, where, cursor }) => ({
+          limit,
+          offset,
+          ordered: Boolean(orderBy),
+          filtered: Boolean(where),
+          cursor: Boolean(cursor),
+        })),
+      ).toEqual([
+        { limit: 1, offset: 0, ordered: true, filtered: false, cursor: false },
+      ])
+    } finally {
+      await cleanupAll(live, source)
+    }
+  })
+
+  it(`does not recover the full source when a visible row keeps its order`, async () => {
+    const loads: Array<LoadSubsetOptions> = []
+    let begin!: () => void
+    let write!: (message: { type: `insert` | `update`; value: PageRow }) => void
+    let commit!: () => void
+    const source = createCollection<PageRow>({
+      id: `pagination-stable-order-update-${collectionSequence++}`,
+      getKey: ({ id }) => id,
+      syncMode: `on-demand`,
+      startSync: true,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      sync: {
+        sync: (operations) => {
+          begin = operations.begin
+          write = operations.write
+          commit = operations.commit
+          operations.markReady()
+          return {
+            loadSubset: (options: LoadSubsetOptions) => {
+              loads.push(options)
+              begin()
+              write({
+                type: `insert`,
+                value: { id: 1, rank: 0, keep: true },
+              })
+              commit()
+              return true
+            },
+          }
+        },
+      },
+    })
+    const live = createLiveQueryCollection((query) =>
+      query
+        .from({ row: source })
+        .orderBy(({ row }) => row.rank, `asc`)
+        .limit(1),
+    )
+
+    try {
+      await live.preload()
+      const loadsBeforeMutation = loads.length
+      begin()
+      write({ type: `update`, value: { id: 1, rank: 0, keep: false } })
+      commit()
+      await flushPromises()
+
+      expect(
+        live.toArray.map(({ id, rank, keep }) => ({ id, rank, keep })),
+      ).toEqual([{ id: 1, rank: 0, keep: false }])
+      expect(loads).toHaveLength(loadsBeforeMutation)
+    } finally {
+      await cleanupAll(live, source)
+    }
+  })
+
+  it.each([{ ids: [1, Number.NaN] }, { ids: [Number.NaN, 1] }])(
+    `keeps finite public keys before NaN across insertion order`,
+    async ({ ids }) => {
+      const source = createCollection(
+        mockSyncCollectionOptions({
+          id: `pagination-nan-key-order-${collectionSequence++}`,
+          initialData: ids.map((id) => ({ id, rank: 0 })),
+          getKey: (row: PageRow) => row.id,
+          autoIndex: `eager`,
+        }),
+      )
+      const live = createLiveQueryCollection((query) =>
+        query
+          .from({ row: source })
+          .orderBy(({ row }) => row.rank, `asc`)
+          .limit(1),
+      )
+
+      try {
+        await live.preload()
+        expect(Array.from(live.values(), ({ id }) => id)).toEqual([1])
+      } finally {
+        await cleanupAll(live, source)
+      }
+    },
+  )
+})
diff --git a/packages/db/tests/query/pooled-live-query-gc-oracle.test.ts b/packages/db/tests/query/pooled-live-query-gc-oracle.test.ts
index 341ff2a05e..d5c1916c5e 100644
--- a/packages/db/tests/query/pooled-live-query-gc-oracle.test.ts
+++ b/packages/db/tests/query/pooled-live-query-gc-oracle.test.ts
@@ -1,24 +1,26 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { fc } from '@fast-check/vitest'
-import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
-import { createOracleReach } from '../oracle-reach.js'
-import {
-  createPooledLiveQuery,
-  pooledLiveQueries,
-} from '../../src/query/pooled-live-query.js'
-import { CollectionImpl, createCollection } from '../../src/collection/index.js'
+import { createCollection } from '../../src/collection/index.js'
+import { createDeferred } from '../../src/deferred.js'
 import { createLiveQueryObserver } from '../../src/live-query-observer.js'
 import { BaseQueryBuilder, Query } from '../../src/query/builder/index.js'
-import { createLiveQueryCollection, eq, not } from '../../src/query/index.js'
-import { createDeferred } from '../../src/deferred.js'
+import { createLiveQueryCollection, eq } from '../../src/query/index.js'
+import { createPooledLiveQuery } from '../../src/query/pooled-live-query.js'
 import { CollectionHasSubscribersError } from '../../src/errors.js'
-import { resolveLiveQueryValue } from '../../src/live-query-options.js'
+import { oraclePropertyOptions, oracleRuns } from '../oracle-config.js'
+import { createOracleReach } from '../oracle-reach.js'
+import { declareOracle } from '../oracle-declaration.js'
 import {
   captureMicrotaskErrors,
   mockSyncCollectionOptions,
   withOracleCleanup,
 } from '../utils.js'
-import type { Collection } from '../../src/collection/index.js'
+import {
+  makeSource,
+  query,
+  releaseTime,
+} from './pooled-live-query-gc-support.js'
+import type { Row } from './pooled-live-query-gc-support.js'
 
 /**
  * # Does a pooled live query hold its source as long as its Collection would?
@@ -40,36 +42,6 @@ import type { Collection } from '../../src/collection/index.js'
  * Release timing is resource lifetime, not data, so the pooled
  * live query oracle does not observe it.
  */
-type Row = { id: string; g: string }
-let serial = 0
-
-function makeSource() {
-  return createCollection(
-    mockSyncCollectionOptions<Row>({
-      id: `pooled-gc-${serial++}`,
-      getKey: (row) => row.id,
-      initialData: [{ id: `a`, g: `x` }],
-    }),
-  )
-}
-
-const query = (source: Collection<Row, string | number, any>) => (q: any) =>
-  q.from({ r: source }).where(({ r }: any) => eq(r.g, `x`))
-
-// Milliseconds after which the source no longer has a subscriber, checking
-// up to `horizon`; undefined when it keeps one throughout.
-async function releaseTime(
-  source: ReturnType<typeof makeSource>,
-  horizon: number,
-): Promise<number | undefined> {
-  for (let elapsed = 0; elapsed <= horizon; elapsed++) {
-    if (source.subscriberCount === 0) return elapsed
-    // Collection cleanup settles through promises after its timer fires.
-    await vi.advanceTimersByTimeAsync(1)
-  }
-  return undefined
-}
-
 function pooled(gcTime: number, subscribe: boolean) {
   const source = makeSource()
   const view = createPooledLiveQuery(query(source)(new Query()), { gcTime })!
@@ -90,6 +62,31 @@ function compiled(gcTime: number, subscribe: boolean) {
   return source
 }
 
+// Pooled and live-query Collection sources lose their last subscriber at the
+// same time under the same timeline. The Collection is the differential
+// reference: the pooled partition releases in its GC timer, and the Collection
+// one cleanup-queue tick later.
+async function expectPooledReleaseMatchesCollection(
+  gcTime: number,
+  subscribe: boolean,
+): Promise<void> {
+  const expected = await releaseTime(compiled(gcTime, subscribe), 400)
+  const actual = await releaseTime(pooled(gcTime, subscribe), 400)
+  if (expected === undefined) expect(actual).toBeUndefined()
+  // The Collection releases its source one cleanup-queue tick after
+  // its GC timer fires; the partition releases in the timer itself.
+  else expect([expected - 1, expected]).toContain(actual)
+}
+
+declareOracle({
+  check: [
+    expectPooledReleaseMatchesCollection,
+    checkCallbackHistory,
+    expectPooledCleanupMatchesOrdinary,
+  ],
+  model: [expectedCallbackHistory],
+})
+
 /**
  * Callback failure does not transfer an unreturned subscription handle or
  * remove a healthy observer's right to terminal cleanup status. These are
@@ -358,166 +355,6 @@ describe(`pooled live query gcTime`, () => {
     }
   }
 
-  it.each([`loading`, `ready`] as const)(
-    `releases a partition when source startup re-enters cleanup at %s`,
-    async (cleanupAt) => {
-      const gate = createDeferred<void>()
-      let starts = 0
-      const source = createCollection<Row>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({ markReady }) => {
-            starts++
-            markReady()
-            return { cleanup: () => gate.promise }
-          },
-        },
-      })
-      const builder = new Query()
-        .from({ r: source })
-        .where(({ r }) => eq(r.g, `x`))
-      if (!(builder instanceof BaseQueryBuilder))
-        throw new Error(`not a builder`)
-      const view = createPooledLiveQuery(builder, { gcTime: 1 })!
-      let pending: Promise<void> | undefined
-      const off = source.on(`status:change`, ({ status }) => {
-        if (status === cleanupAt) pending = source.cleanup()
-      })
-      let stop: { unsubscribe: () => void } | undefined
-      try {
-        stop = view.subscribeChanges(() => {})
-        expect(pending).toBeDefined()
-        expect(starts).toBe(cleanupAt === `loading` ? 0 : 1)
-        // Source cleanup start crashes a pooled view that it did not end.
-        expect(view.status).toBe(`crashed`)
-        expect(source.subscriberCount).toBe(0)
-        expect(source[`_changes`].activeSubscribersCount).toBe(0)
-        gate.resolve()
-        await pending
-        expect(source.subscriberCount).toBe(0)
-      } finally {
-        off()
-        gate.resolve()
-        stop?.unsubscribe()
-        await source.cleanup()
-      }
-    },
-  )
-
-  // Cleanup start makes a dependent terminal even if it registers late. A
-  // released partition has no source subscription, so its next attachment
-  // must observe cleanup before acquiring one. The bounded grammar varies
-  // initial ownership (new, retained, released), callback mode and held source
-  // status. It checks terminality before settlement, after restart, and after a
-  // fresh partition mounts. Source counts detect retained or duplicate ownership.
-  it.each(
-    ([`new`, `retained`, `released`] as const).flatMap((ownership) =>
-      ([`granular`, `wholesale`] as const).flatMap((mode) =>
-        ([`loading`, `ready`] as const).map((priorStatus) => ({
-          ownership,
-          mode,
-          priorStatus,
-        })),
-      ),
-    ),
-  )(
-    `retires $ownership $mode partition during $priorStatus cleanup`,
-    async ({ ownership, mode, priorStatus }) => {
-      const gate = createDeferred<void>()
-      let starts = 0
-      const source = createCollection<Row>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            starts++
-            begin()
-            write({ type: `insert`, value: { id: `a`, g: `x` } })
-            commit()
-            if (priorStatus === `ready` || starts > 1) markReady()
-            return { cleanup: () => gate.promise }
-          },
-        },
-      })
-      const build = () => {
-        const builder = new Query()
-          .from({ r: source })
-          .where(({ r }) => eq(r.g, `x`))
-        if (!(builder instanceof BaseQueryBuilder))
-          throw new Error(`not a builder`)
-        return createPooledLiveQuery(builder, { gcTime: 1 })!
-      }
-      let view: ReturnType<typeof build> | undefined
-      let observer: ReturnType<typeof createLiveQueryObserver> | undefined
-      let stop: (() => void) | undefined
-      let fresh:
-        | ReturnType<typeof createLiveQueryObserver<Row, string | number>>
-        | undefined
-      let stopFresh: (() => void) | undefined
-      try {
-        source.startSyncImmediate()
-        if (ownership !== `new`) {
-          view = build()
-          observer = createLiveQueryObserver(view, { mode })
-          stop = observer.subscribe(() => {})
-          if (ownership === `released`) {
-            stop()
-            stop = undefined
-            await vi.advanceTimersByTimeAsync(100)
-            expect(source.subscriberCount).toBe(0)
-          }
-        }
-        // A retained view reads the source, so only a cascade cleanup may
-        // start; it ends the view. A view that attaches during cleanup
-        // crashes, because the cleanup did not end it.
-        const pending =
-          ownership === `retained`
-            ? source.cleanup({ dependents: true })
-            : source.cleanup()
-        const terminal = ownership === `retained` ? `cleaned-up` : `crashed`
-        expect(source.status).toBe(priorStatus)
-        view ??= build()
-        observer ??= createLiveQueryObserver(view, { mode })
-        let attachmentError: unknown
-        try {
-          if (ownership !== `retained`) stop = observer.subscribe(() => {})
-        } catch (error) {
-          attachmentError = error
-        }
-        expect(
-          attachmentError,
-          `late dependent becomes terminal without acquiring a source`,
-        ).toBeUndefined()
-        expect(view.status).toBe(terminal)
-        expect(observer.getSnapshot().status).toBe(terminal)
-        expect(source.subscriberCount).toBe(0)
-        expect(source[`_changes`].activeSubscribersCount).toBe(0)
-        gate.resolve()
-        await pending
-        source.startSyncImmediate()
-        expect(view.status).toBe(terminal)
-        fresh = createLiveQueryObserver(build(), { mode })
-        stopFresh = fresh.subscribe(() => {})
-        expect(fresh.getSnapshot().status).toBe(`ready`)
-        expect(
-          Array.from(fresh.getSnapshot().state!.values(), ({ id, g }) => ({
-            id,
-            g,
-          })),
-        ).toEqual([{ id: `a`, g: `x` }])
-        expect(source.subscriberCount).toBe(1)
-      } finally {
-        gate.resolve()
-        stop?.()
-        stopFresh?.()
-        observer?.dispose()
-        fresh?.dispose()
-        await source.cleanup()
-      }
-    },
-  )
-
   /**
    * Late cleanup notification can invoke application status listeners before
    * registration returns. A throw is still fail-fast, but it cannot retain a
@@ -639,457 +476,13 @@ describe(`pooled live query gcTime`, () => {
     })
   }
 
-  /** A recoverable eager-source problem after readiness is a sync problem in
-   * the health tree: it changes neither status nor partition lifetime. Only
-   * source cleanup is terminal. The return-to-healthy checkpoint checks both
-   * shared views and fresh subscription ownership in the same sync run.
-   * On-demand sources cannot enter this path: pooling explicitly excludes them.
-   */
-  it.each([`before-views`, `after-views`] as const)(
-    `retains a partition through a recoverable sync problem $0`,
-    async (errorAt) => {
-      let fail = () => {}
-      let recover = () => {}
-      const source = createCollection<Row>({
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: ({
-            begin,
-            write,
-            commit,
-            markReady,
-            reportError,
-            reportHealthy,
-          }) => {
-            begin()
-            write({ type: `insert`, value: { id: `a`, g: `x` } })
-            commit()
-            markReady()
-            fail = () => reportError(new Error(`temporary source error`))
-            recover = reportHealthy
-          },
-        },
-      })
-      source.startSyncImmediate()
-      if (errorAt === `before-views`) fail()
-      const build = () => {
-        const builder = new Query()
-          .from({ r: source })
-          .where(({ r }) => eq(r.g, `x`))
-        if (!(builder instanceof BaseQueryBuilder))
-          throw new Error(`not a builder`)
-        return createPooledLiveQuery(builder, { gcTime: 1 })!
-      }
-      const views = [build(), build()]
-      const stops: Array<ReturnType<typeof source.subscribeChanges>> = []
-      try {
-        if (errorAt === `after-views`) fail()
-        for (const view of views) {
-          expect(view).toBeDefined()
-          stops.push(view.subscribeChanges(() => {}))
-          expect(view.status).toBe(`ready`)
-          expect(view.health.hasErrors).toBe(true)
-        }
-        recover()
-        for (const view of views) {
-          expect(view.status).toBe(`ready`)
-          expect(view.health.hasErrors).toBe(false)
-          expect(
-            Array.from(view.entries(), ([key, row]) => ({
-              key,
-              id: row.id,
-              g: row.g,
-            })),
-          ).toEqual([{ key: `a`, id: `a`, g: `x` }])
-        }
-        expect(source.subscriberCount).toBe(1)
-      } finally {
-        stops.forEach((stop) => stop.unsubscribe())
-        await vi.advanceTimersByTimeAsync(100)
-        await source.cleanup()
-      }
-    },
-  )
-
   for (const gcTime of [1, 100, 0, Number.POSITIVE_INFINITY]) {
     for (const subscribe of [true, false]) {
       it(`matches a live-query Collection for gcTime ${gcTime}${subscribe ? `` : ` without a subscriber`}`, async () => {
-        const expected = await releaseTime(compiled(gcTime, subscribe), 400)
-        const actual = await releaseTime(pooled(gcTime, subscribe), 400)
-        if (expected === undefined) expect(actual).toBeUndefined()
-        // The Collection releases its source one cleanup-queue tick after
-        // its GC timer fires; the partition releases in the timer itself.
-        else expect([expected - 1, expected]).toContain(actual)
+        await expectPooledReleaseMatchesCollection(gcTime, subscribe)
       })
     }
   }
-
-  it(`follows its source again when resubscribed after its partition released`, async () => {
-    const run = async (
-      build: (source: ReturnType<typeof makeSource>) => any,
-    ) => {
-      const source = makeSource()
-      const observer = createLiveQueryObserver(build(source), {
-        mode: `wholesale`,
-      })
-      observer.subscribe(() => {})()
-      await vi.advanceTimersByTimeAsync(50)
-      // Hidden past gcTime, as under a hidden React Activity, then shown.
-      source.utils.begin()
-      source.utils.write({ type: `insert`, value: { id: `b`, g: `x` } })
-      source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
-      source.utils.commit()
-      const stop = observer.subscribe(() => {})
-      await vi.advanceTimersByTimeAsync(1)
-      source.utils.begin()
-      source.utils.write({ type: `insert`, value: { id: `c`, g: `x` } })
-      source.utils.commit()
-      await vi.advanceTimersByTimeAsync(1)
-      const keys = [...observer.getSnapshot().state!.keys()]
-      stop()
-      return keys
-    }
-    const compiledKeys = await run((source) =>
-      createLiveQueryCollection({
-        query: query(source),
-        startSync: true,
-        gcTime: 1,
-      }),
-    )
-    expect(compiledKeys).toEqual([`b`, `c`])
-    expect(
-      await run((source) =>
-        createPooledLiveQuery(query(source)(new Query()), { gcTime: 1 })!,
-      ),
-    ).toEqual(compiledKeys)
-  })
-
-  it(`seeds a filtered view from its refilled group after a release`, async () => {
-    const source = makeSource()
-    source.utils.begin()
-    source.utils.write({ type: `insert`, value: { id: `b`, g: `x` } })
-    source.utils.commit()
-    // `not(eq(r.id, 'b'))` is evaluated per view, so this view keeps `a`.
-    const view = createPooledLiveQuery(
-      query(source)(new Query()).where(({ r }: any) => not(eq(r.id, `b`))),
-      { gcTime: 1 },
-    )!
-    const observer = createLiveQueryObserver(view, { mode: `wholesale` })
-    observer.subscribe(() => {})()
-    await vi.advanceTimersByTimeAsync(60)
-    const stop = observer.subscribe(() => {})
-    await vi.advanceTimersByTimeAsync(1)
-    expect([...observer.getSnapshot().state!.keys()]).toEqual([`a`])
-    source.utils.begin()
-    source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
-    source.utils.commit()
-    await vi.advanceTimersByTimeAsync(1)
-    expect([...observer.getSnapshot().state!.keys()]).toEqual([])
-    stop()
-  })
-
-  it(`shares one partition after a released partition subscribes again`, async () => {
-    const source = makeSource()
-    const mount = () => {
-      const view = createPooledLiveQuery(query(source)(new Query()), {
-        gcTime: 1,
-      })!
-      const observer = createLiveQueryObserver(view, { mode: `wholesale` })
-      return { observer, stop: observer.subscribe(() => {}) }
-    }
-    const first = mount()
-    first.stop()
-    await vi.advanceTimersByTimeAsync(60)
-    // The released partition's view subscribes again, beside a new view.
-    const again = first.observer.subscribe(() => {})
-    const second = mount()
-    // The new view joins the partition that subscribed again.
-    expect(source.subscriberCount).toBe(1)
-    again()
-    await vi.advanceTimersByTimeAsync(60)
-    const third = mount()
-    expect(source.subscriberCount).toBe(1)
-    second.stop()
-    third.stop()
-  })
-
-  // Cleaning up one view ends that view only. A sibling built during a
-  // render, still inside its grace period to subscribe, keeps its rows and
-  // its partition, as its own live-query Collection would.
-  it(`keeps a built sibling's rows when another view is cleaned up`, async () => {
-    const source = createCollection(
-      mockSyncCollectionOptions<Row>({
-        id: `pooled-gc-sibling-${serial++}`,
-        getKey: (row) => row.id,
-        initialData: [
-          { id: `a`, g: `x` },
-          { id: `b`, g: `y` },
-        ],
-      }),
-    )
-    const view = (g: string) =>
-      createPooledLiveQuery(
-        new Query()
-          .from({ r: source })
-          .where(({ r }: any) => eq(r.g, g)) as any,
-        { gcTime: 100 },
-      )!
-    const first = view(`x`)
-    const sibling = view(`y`)
-    const stop = createLiveQueryObserver(first, {
-      mode: `wholesale`,
-    }).subscribe(() => {})
-    // Read the sibling without subscribing: it stays inside its grace period.
-    const siblingRows = () => [
-      ...createLiveQueryObserver(sibling, { mode: `wholesale` })
-        .getSnapshot()
-        .state!.keys(),
-    ]
-    await vi.advanceTimersByTimeAsync(0)
-    expect(siblingRows()).toEqual([`b`])
-    stop()
-    await first.cleanup()
-    expect(siblingRows()).toEqual([`b`])
-    expect(source.subscriberCount).toBe(1)
-  })
-
-  it(`keeps a newer partition when an older one releases again`, async () => {
-    const source = makeSource()
-    const mount = () => {
-      const view = createPooledLiveQuery(query(source)(new Query()), {
-        gcTime: 1,
-      })!
-      const observer = createLiveQueryObserver(view, { mode: `wholesale` })
-      return { observer, stop: observer.subscribe(() => {}) }
-    }
-    const first = mount()
-    first.stop()
-    await vi.advanceTimersByTimeAsync(60)
-    // A new partition takes the key before the old view subscribes again.
-    const second = mount()
-    first.observer.subscribe(() => {})()
-    await vi.advanceTimersByTimeAsync(60)
-    const third = mount()
-    expect(source.subscriberCount).toBe(1)
-    second.stop()
-    third.stop()
-  })
-
-  it(`ends with its source's dependents, before the source's cleanup settles`, async () => {
-    let release!: () => void
-    const source = createCollection<Row, string | number>({
-      id: `pooled-gc-${serial++}`,
-      getKey: (row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: `a`, g: `x` } })
-          commit()
-          markReady()
-          // The adapter's cleanup stays pending until released.
-          return () =>
-            new Promise<void>((resolve) => {
-              release = resolve
-            })
-        },
-      },
-    })
-    const observe = (view: any) => {
-      const observer = createLiveQueryObserver(view, { mode: `wholesale` })
-      return { observer, stop: observer.subscribe(() => {}) }
-    }
-    const pooledView = observe(
-      createPooledLiveQuery(query(source)(new Query()), { gcTime: 1 })!,
-    )
-    const compiledView = observe(
-      createLiveQueryCollection({ query: query(source), startSync: true }),
-    )
-    await vi.advanceTimersByTimeAsync(1)
-    // Cleanup refuses while they read the source; with its dependents it
-    // ends both views like their live queries, before the adapter settles.
-    await expect(source.cleanup()).rejects.toThrow(/dependent/)
-    const cleanup = source.cleanup({ dependents: true })
-    await vi.advanceTimersByTimeAsync(1)
-    expect(compiledView.observer.getSnapshot().status).toBe(`cleaned-up`)
-    expect(pooledView.observer.getSnapshot().status).toBe(`cleaned-up`)
-    release()
-    await cleanup
-    pooledView.stop()
-    compiledView.stop()
-  })
-
-  it(`defaults to a live-query Collection's gcTime when the adapter gives none`, async () => {
-    // A pooled view and a compiled one, each on its own source.
-    const pooledOnOwn = makeSource()
-    const pooledObserver = createLiveQueryObserver(
-      resolveLiveQueryValue(query(pooledOnOwn)(new Query()), {
-        pool: pooledLiveQueries,
-      }),
-      { mode: `wholesale` },
-    )
-    pooledObserver.subscribe(() => {})()
-    const compiledOnOwn = makeSource()
-    const compiledObserver = createLiveQueryObserver(
-      createLiveQueryCollection({
-        query: query(compiledOnOwn),
-        startSync: true,
-      }),
-      { mode: `wholesale` },
-    )
-    compiledObserver.subscribe(() => {})()
-    await vi.advanceTimersByTimeAsync(4_900)
-    expect(compiledOnOwn.subscriberCount).toBe(1)
-    expect(pooledOnOwn.subscriberCount).toBe(1)
-    await vi.advanceTimersByTimeAsync(300)
-    expect(compiledOnOwn.subscriberCount).toBe(0)
-    expect(pooledOnOwn.subscriberCount).toBe(0)
-  })
-
-  it(`pools a query config that names only its query`, () => {
-    const source = makeSource()
-    const observe = (value: unknown) =>
-      createLiveQueryObserver(
-        resolveLiveQueryValue(value, { pool: pooledLiveQueries, gcTime: 1 }),
-        {
-          mode: `wholesale`,
-        },
-      ).subscribe(() => {})
-    const stops = [
-      observe({ query: query(source)(new Query()) }),
-      observe({ query: query(source)(new Query()), gcTime: 5 }),
-    ]
-    expect(source.subscriberCount).toBe(1)
-    // An id names a distinct Collection, so that config compiles its own.
-    stops.push(observe({ query: query(source)(new Query()), id: `own` }))
-    expect(source.subscriberCount).toBe(2)
-    for (const stop of stops) stop()
-  })
-
-  it(`keeps groups only for values with rows or watchers`, async () => {
-    const source = makeSource()
-    source.utils.begin()
-    for (let n = 0; n < 50; n++) {
-      source.utils.write({ type: `insert`, value: { id: `r${n}`, g: `v${n}` } })
-    }
-    source.utils.commit()
-    const view = createPooledLiveQuery(query(source)(new Query()), {
-      gcTime: 1,
-    })!
-    const observer = createLiveQueryObserver(view, { mode: `wholesale` })
-    const stop = observer.subscribe(() => {})
-    const groups = () =>
-      (view as unknown as { partition: { groups: Map<string, unknown> } })
-        .partition.groups.size
-    // One group per distinct value, plus the watched `x`.
-    expect(groups()).toBe(51)
-    source.utils.begin()
-    for (let n = 0; n < 50; n++) {
-      source.utils.write({ type: `delete`, value: { id: `r${n}`, g: `v${n}` } })
-    }
-    source.utils.commit()
-    expect(groups()).toBe(1)
-    // The watched group empties and is dropped; new rows recreate it, and
-    // the observer still sees them.
-    source.utils.begin()
-    source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
-    source.utils.commit()
-    expect(groups()).toBe(1)
-    expect(observer.getSnapshot().data).toEqual([])
-    stop()
-    expect(groups()).toBe(0)
-    const again = observer.subscribe(() => {})
-    source.utils.begin()
-    source.utils.write({ type: `insert`, value: { id: `b`, g: `x` } })
-    source.utils.commit()
-    expect([...observer.getSnapshot().state!.keys()]).toEqual([`b`])
-    again()
-  })
-
-  it(`never reuses a dropped group's revision for a detached reader`, () => {
-    const source = makeSource()
-    const write = (type: `insert` | `delete`, id: string, g: string) => {
-      source.utils.begin()
-      source.utils.write({ type, value: { id, g } })
-      source.utils.commit()
-    }
-    // A watched `y` view keeps the partition subscribed.
-    write(`insert`, `z`, `y`)
-    const keepAlive = createLiveQueryObserver(
-      createPooledLiveQuery(
-        new Query()
-          .from({ r: source })
-          .where(({ r }: any) => eq(r.g, `y`)) as any,
-        { gcTime: 1 },
-      ),
-      { mode: `wholesale` },
-    ).subscribe(() => {})
-    // The `x` view is read without subscribing, so it compares revisions.
-    const reader = createLiveQueryObserver(
-      createPooledLiveQuery(query(source)(new Query()), { gcTime: 1 }),
-      { mode: `wholesale` },
-    )
-    write(`insert`, `b`, `x`)
-    const keys = () => [...reader.getSnapshot().state!.keys()]
-    expect(keys()).toEqual([`a`, `b`])
-    // Emptying the unwatched group drops it; new rows build a new one.
-    source.utils.begin()
-    source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
-    source.utils.write({ type: `delete`, value: { id: `b`, g: `x` } })
-    source.utils.commit()
-    write(`insert`, `c`, `x`)
-    write(`insert`, `d`, `x`)
-    expect(keys()).toEqual([`c`, `d`])
-    keepAlive()
-  })
-
-  it(`keeps its public Collection live while observed`, async () => {
-    const source = makeSource()
-    const view = createPooledLiveQuery(query(source)(new Query()), {
-      gcTime: 1,
-    })!
-    const observer = createLiveQueryObserver(view, { mode: `wholesale` })
-    const stop = observer.subscribe(() => {})
-    const collection = observer.getSnapshot().collection!
-    expect(collection.toArray).toHaveLength(1)
-    await vi.advanceTimersByTimeAsync(500)
-    expect(collection.status).toBe(`ready`)
-    expect(collection.toArray).toHaveLength(1)
-    stop()
-  })
-
-  it(`hands users a Collection that queries accept as a source`, () => {
-    const source = makeSource()
-    const view = createPooledLiveQuery(query(source)(new Query()), {
-      gcTime: 1,
-    })!
-    const collection = createLiveQueryObserver(view, {
-      mode: `wholesale`,
-    }).getSnapshot().collection!
-    expect(collection).toBeInstanceOf(CollectionImpl)
-    const nested = createLiveQueryCollection({
-      query: (q) => q.from({ c: collection }),
-      startSync: true,
-    })
-    expect(nested.toArray.map((row) => row.id)).toEqual([`a`])
-  })
-
-  it.each([[[5, 120]], [[120, 5]]])(
-    `releases with the longest gcTime among a partition's views (%j)`,
-    async (gcTimes) => {
-      const source = makeSource()
-      for (const gcTime of gcTimes) {
-        const view = createPooledLiveQuery(query(source)(new Query()), {
-          gcTime,
-        })!
-        createLiveQueryObserver(view, { mode: `wholesale` }).subscribe(
-          () => {},
-        )()
-      }
-      expect(await releaseTime(source, 400)).toBe(120)
-    },
-  )
 })
 
 /**
@@ -1183,6 +576,8 @@ const cleanupReachStates = [
   `retried cleanup after the reader ended`,
 ] as const
 
+let serial = 0
+
 type CleanupPath = `pooled` | `ordinary`
 type CleanupTrace = Array<string>
 
@@ -1340,6 +735,18 @@ async function runCleanupHistory(
   return trace
 }
 
+/**
+ * The differential check: a pooled view's cleanup trace equals the trace of
+ * an ordinary live-query Collection that runs the same history.
+ */
+async function expectPooledCleanupMatchesOrdinary(
+  history: CleanupHistory,
+  reach?: Parameters<typeof runCleanupHistory>[2],
+): Promise<void> {
+  const pooledTrace = await runCleanupHistory(`pooled`, history, reach)
+  expect(pooledTrace).toEqual(await runCleanupHistory(`ordinary`, history))
+}
+
 describe(`pooled live query cleanup admission`, () => {
   beforeEach(() => vi.useFakeTimers())
   afterEach(() => vi.useRealTimers())
@@ -1361,9 +768,7 @@ describe(`pooled live query cleanup admission`, () => {
     ],
   }
   it(`keeps a view whose cleanup rejected in its partition`, async () => {
-    expect(await runCleanupHistory(`pooled`, pinned)).toEqual(
-      await runCleanupHistory(`ordinary`, pinned),
-    )
+    await expectPooledCleanupMatchesOrdinary(pinned)
   })
 
   for (const campaign of [`fixed`, `random`] as const) {
@@ -1372,10 +777,7 @@ describe(`pooled live query cleanup admission`, () => {
       await fc.assert(
         fc.asyncProperty(cleanupHistory, async (history) => {
           reach.beginHistory()
-          const pooledTrace = await runCleanupHistory(`pooled`, history, reach)
-          expect(pooledTrace).toEqual(
-            await runCleanupHistory(`ordinary`, history),
-          )
+          await expectPooledCleanupMatchesOrdinary(history, reach)
         }),
         campaign === `fixed`
           ? { numRuns: oracleRuns(80), seed: 2168 }
diff --git a/packages/db/tests/query/pooled-live-query-gc-support.ts b/packages/db/tests/query/pooled-live-query-gc-support.ts
new file mode 100644
index 0000000000..1c36ecbc75
--- /dev/null
+++ b/packages/db/tests/query/pooled-live-query-gc-support.ts
@@ -0,0 +1,39 @@
+// Shared fixtures for the pooled live query gcTime tests. The release-timing
+// law is owned by pooled-live-query-gc-oracle.test.ts. This module builds the
+// sources, queries, and release measurements that both test files use.
+import { vi } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { eq } from '../../src/query/index.js'
+import { mockSyncCollectionOptions } from '../utils.js'
+import type { Collection } from '../../src/collection/index.js'
+
+export type Row = { id: string; g: string }
+let serial = 0
+
+export function makeSource() {
+  return createCollection(
+    mockSyncCollectionOptions<Row>({
+      id: `pooled-gc-fixture-${serial++}`,
+      getKey: (row) => row.id,
+      initialData: [{ id: `a`, g: `x` }],
+    }),
+  )
+}
+
+export const query =
+  (source: Collection<Row, string | number, any>) => (q: any) =>
+    q.from({ r: source }).where(({ r }: any) => eq(r.g, `x`))
+
+// Milliseconds after which the source no longer has a subscriber, checking
+// up to `horizon`; undefined when it keeps one throughout.
+export async function releaseTime(
+  source: ReturnType<typeof makeSource>,
+  horizon: number,
+): Promise<number | undefined> {
+  for (let elapsed = 0; elapsed <= horizon; elapsed++) {
+    if (source.subscriberCount === 0) return elapsed
+    // Collection cleanup settles through promises after its timer fires.
+    await vi.advanceTimersByTimeAsync(1)
+  }
+  return undefined
+}
diff --git a/packages/db/tests/query/pooled-live-query-gc.test.ts b/packages/db/tests/query/pooled-live-query-gc.test.ts
new file mode 100644
index 0000000000..79a8044e21
--- /dev/null
+++ b/packages/db/tests/query/pooled-live-query-gc.test.ts
@@ -0,0 +1,628 @@
+// Ordinary pooled live query gcTime tests: partition membership, resubscription,
+// terminal cleanup, config defaults, and group bookkeeping. Each compares
+// production with literal expectations. The release-timing law that the
+// generated gcTime cases check is owned by pooled-live-query-gc-oracle.test.ts.
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { CollectionImpl, createCollection } from '../../src/collection/index.js'
+import { createLiveQueryObserver } from '../../src/live-query-observer.js'
+import { BaseQueryBuilder, Query } from '../../src/query/builder/index.js'
+import { createLiveQueryCollection, eq, not } from '../../src/query/index.js'
+import { createDeferred } from '../../src/deferred.js'
+import {
+  createPooledLiveQuery,
+  pooledLiveQueries,
+} from '../../src/query/pooled-live-query.js'
+import { resolveLiveQueryValue } from '../../src/live-query-options.js'
+import { mockSyncCollectionOptions } from '../utils.js'
+import {
+  makeSource,
+  query,
+  releaseTime,
+} from './pooled-live-query-gc-support.js'
+import type { Row } from './pooled-live-query-gc-support.js'
+
+let serial = 0
+
+describe(`pooled live query gcTime`, () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => vi.useRealTimers())
+
+  it(`follows its source again when resubscribed after its partition released`, async () => {
+    const run = async (
+      build: (source: ReturnType<typeof makeSource>) => any,
+    ) => {
+      const source = makeSource()
+      const observer = createLiveQueryObserver(build(source), {
+        mode: `wholesale`,
+      })
+      observer.subscribe(() => {})()
+      await vi.advanceTimersByTimeAsync(50)
+      // Hidden past gcTime, as under a hidden React Activity, then shown.
+      source.utils.begin()
+      source.utils.write({ type: `insert`, value: { id: `b`, g: `x` } })
+      source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
+      source.utils.commit()
+      const stop = observer.subscribe(() => {})
+      await vi.advanceTimersByTimeAsync(1)
+      source.utils.begin()
+      source.utils.write({ type: `insert`, value: { id: `c`, g: `x` } })
+      source.utils.commit()
+      await vi.advanceTimersByTimeAsync(1)
+      const keys = [...observer.getSnapshot().state!.keys()]
+      stop()
+      return keys
+    }
+    const compiledKeys = await run((source) =>
+      createLiveQueryCollection({
+        query: query(source),
+        startSync: true,
+        gcTime: 1,
+      }),
+    )
+    expect(compiledKeys).toEqual([`b`, `c`])
+    expect(
+      await run((source) =>
+        createPooledLiveQuery(query(source)(new Query()), { gcTime: 1 })!,
+      ),
+    ).toEqual(compiledKeys)
+  })
+
+  it(`seeds a filtered view from its refilled group after a release`, async () => {
+    const source = makeSource()
+    source.utils.begin()
+    source.utils.write({ type: `insert`, value: { id: `b`, g: `x` } })
+    source.utils.commit()
+    // `not(eq(r.id, 'b'))` is evaluated per view, so this view keeps `a`.
+    const view = createPooledLiveQuery(
+      query(source)(new Query()).where(({ r }: any) => not(eq(r.id, `b`))),
+      { gcTime: 1 },
+    )!
+    const observer = createLiveQueryObserver(view, { mode: `wholesale` })
+    observer.subscribe(() => {})()
+    await vi.advanceTimersByTimeAsync(60)
+    const stop = observer.subscribe(() => {})
+    await vi.advanceTimersByTimeAsync(1)
+    expect([...observer.getSnapshot().state!.keys()]).toEqual([`a`])
+    source.utils.begin()
+    source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
+    source.utils.commit()
+    await vi.advanceTimersByTimeAsync(1)
+    expect([...observer.getSnapshot().state!.keys()]).toEqual([])
+    stop()
+  })
+
+  it(`shares one partition after a released partition subscribes again`, async () => {
+    const source = makeSource()
+    const mount = () => {
+      const view = createPooledLiveQuery(query(source)(new Query()), {
+        gcTime: 1,
+      })!
+      const observer = createLiveQueryObserver(view, { mode: `wholesale` })
+      return { observer, stop: observer.subscribe(() => {}) }
+    }
+    const first = mount()
+    first.stop()
+    await vi.advanceTimersByTimeAsync(60)
+    // The released partition's view subscribes again, beside a new view.
+    const again = first.observer.subscribe(() => {})
+    const second = mount()
+    // The new view joins the partition that subscribed again.
+    expect(source.subscriberCount).toBe(1)
+    again()
+    await vi.advanceTimersByTimeAsync(60)
+    const third = mount()
+    expect(source.subscriberCount).toBe(1)
+    second.stop()
+    third.stop()
+  })
+
+  // Cleaning up one view ends that view only. A sibling built during a
+  // render, still inside its grace period to subscribe, keeps its rows and
+  // its partition, as its own live-query Collection would.
+  it(`keeps a built sibling's rows when another view is cleaned up`, async () => {
+    const source = createCollection(
+      mockSyncCollectionOptions<Row>({
+        id: `pooled-gc-sibling-${serial++}`,
+        getKey: (row) => row.id,
+        initialData: [
+          { id: `a`, g: `x` },
+          { id: `b`, g: `y` },
+        ],
+      }),
+    )
+    const view = (g: string) =>
+      createPooledLiveQuery(
+        new Query()
+          .from({ r: source })
+          .where(({ r }: any) => eq(r.g, g)) as any,
+        { gcTime: 100 },
+      )!
+    const first = view(`x`)
+    const sibling = view(`y`)
+    const stop = createLiveQueryObserver(first, {
+      mode: `wholesale`,
+    }).subscribe(() => {})
+    // Read the sibling without subscribing: it stays inside its grace period.
+    const siblingRows = () => [
+      ...createLiveQueryObserver(sibling, { mode: `wholesale` })
+        .getSnapshot()
+        .state!.keys(),
+    ]
+    await vi.advanceTimersByTimeAsync(0)
+    expect(siblingRows()).toEqual([`b`])
+    stop()
+    await first.cleanup()
+    expect(siblingRows()).toEqual([`b`])
+    expect(source.subscriberCount).toBe(1)
+  })
+
+  it(`keeps a newer partition when an older one releases again`, async () => {
+    const source = makeSource()
+    const mount = () => {
+      const view = createPooledLiveQuery(query(source)(new Query()), {
+        gcTime: 1,
+      })!
+      const observer = createLiveQueryObserver(view, { mode: `wholesale` })
+      return { observer, stop: observer.subscribe(() => {}) }
+    }
+    const first = mount()
+    first.stop()
+    await vi.advanceTimersByTimeAsync(60)
+    // A new partition takes the key before the old view subscribes again.
+    const second = mount()
+    first.observer.subscribe(() => {})()
+    await vi.advanceTimersByTimeAsync(60)
+    const third = mount()
+    expect(source.subscriberCount).toBe(1)
+    second.stop()
+    third.stop()
+  })
+
+  it(`ends with its source's dependents, before the source's cleanup settles`, async () => {
+    let release!: () => void
+    const source = createCollection<Row, string | number>({
+      id: `pooled-gc-${serial++}`,
+      getKey: (row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: `a`, g: `x` } })
+          commit()
+          markReady()
+          // The adapter's cleanup stays pending until released.
+          return () =>
+            new Promise<void>((resolve) => {
+              release = resolve
+            })
+        },
+      },
+    })
+    const observe = (view: any) => {
+      const observer = createLiveQueryObserver(view, { mode: `wholesale` })
+      return { observer, stop: observer.subscribe(() => {}) }
+    }
+    const pooledView = observe(
+      createPooledLiveQuery(query(source)(new Query()), { gcTime: 1 })!,
+    )
+    const compiledView = observe(
+      createLiveQueryCollection({ query: query(source), startSync: true }),
+    )
+    await vi.advanceTimersByTimeAsync(1)
+    // Cleanup refuses while they read the source; with its dependents it
+    // ends both views like their live queries, before the adapter settles.
+    await expect(source.cleanup()).rejects.toThrow(/dependent/)
+    const cleanup = source.cleanup({ dependents: true })
+    await vi.advanceTimersByTimeAsync(1)
+    expect(compiledView.observer.getSnapshot().status).toBe(`cleaned-up`)
+    expect(pooledView.observer.getSnapshot().status).toBe(`cleaned-up`)
+    release()
+    await cleanup
+    pooledView.stop()
+    compiledView.stop()
+  })
+
+  it(`defaults to a live-query Collection's gcTime when the adapter gives none`, async () => {
+    // A pooled view and a compiled one, each on its own source.
+    const pooledOnOwn = makeSource()
+    const pooledObserver = createLiveQueryObserver(
+      resolveLiveQueryValue(query(pooledOnOwn)(new Query()), {
+        pool: pooledLiveQueries,
+      }),
+      { mode: `wholesale` },
+    )
+    pooledObserver.subscribe(() => {})()
+    const compiledOnOwn = makeSource()
+    const compiledObserver = createLiveQueryObserver(
+      createLiveQueryCollection({
+        query: query(compiledOnOwn),
+        startSync: true,
+      }),
+      { mode: `wholesale` },
+    )
+    compiledObserver.subscribe(() => {})()
+    await vi.advanceTimersByTimeAsync(4_900)
+    expect(compiledOnOwn.subscriberCount).toBe(1)
+    expect(pooledOnOwn.subscriberCount).toBe(1)
+    await vi.advanceTimersByTimeAsync(300)
+    expect(compiledOnOwn.subscriberCount).toBe(0)
+    expect(pooledOnOwn.subscriberCount).toBe(0)
+  })
+
+  it(`pools a query config that names only its query`, () => {
+    const source = makeSource()
+    const observe = (value: unknown) =>
+      createLiveQueryObserver(
+        resolveLiveQueryValue(value, { pool: pooledLiveQueries, gcTime: 1 }),
+        {
+          mode: `wholesale`,
+        },
+      ).subscribe(() => {})
+    const stops = [
+      observe({ query: query(source)(new Query()) }),
+      observe({ query: query(source)(new Query()), gcTime: 5 }),
+    ]
+    expect(source.subscriberCount).toBe(1)
+    // An id names a distinct Collection, so that config compiles its own.
+    stops.push(observe({ query: query(source)(new Query()), id: `own` }))
+    expect(source.subscriberCount).toBe(2)
+    for (const stop of stops) stop()
+  })
+
+  it(`keeps groups only for values with rows or watchers`, async () => {
+    const source = makeSource()
+    source.utils.begin()
+    for (let n = 0; n < 50; n++) {
+      source.utils.write({ type: `insert`, value: { id: `r${n}`, g: `v${n}` } })
+    }
+    source.utils.commit()
+    const view = createPooledLiveQuery(query(source)(new Query()), {
+      gcTime: 1,
+    })!
+    const observer = createLiveQueryObserver(view, { mode: `wholesale` })
+    const stop = observer.subscribe(() => {})
+    const groups = () =>
+      (view as unknown as { partition: { groups: Map<string, unknown> } })
+        .partition.groups.size
+    // One group per distinct value, plus the watched `x`.
+    expect(groups()).toBe(51)
+    source.utils.begin()
+    for (let n = 0; n < 50; n++) {
+      source.utils.write({ type: `delete`, value: { id: `r${n}`, g: `v${n}` } })
+    }
+    source.utils.commit()
+    expect(groups()).toBe(1)
+    // The watched group empties and is dropped; new rows recreate it, and
+    // the observer still sees them.
+    source.utils.begin()
+    source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
+    source.utils.commit()
+    expect(groups()).toBe(1)
+    expect(observer.getSnapshot().data).toEqual([])
+    stop()
+    expect(groups()).toBe(0)
+    const again = observer.subscribe(() => {})
+    source.utils.begin()
+    source.utils.write({ type: `insert`, value: { id: `b`, g: `x` } })
+    source.utils.commit()
+    expect([...observer.getSnapshot().state!.keys()]).toEqual([`b`])
+    again()
+  })
+
+  it(`never reuses a dropped group's revision for a detached reader`, () => {
+    const source = makeSource()
+    const write = (type: `insert` | `delete`, id: string, g: string) => {
+      source.utils.begin()
+      source.utils.write({ type, value: { id, g } })
+      source.utils.commit()
+    }
+    // A watched `y` view keeps the partition subscribed.
+    write(`insert`, `z`, `y`)
+    const keepAlive = createLiveQueryObserver(
+      createPooledLiveQuery(
+        new Query()
+          .from({ r: source })
+          .where(({ r }: any) => eq(r.g, `y`)) as any,
+        { gcTime: 1 },
+      ),
+      { mode: `wholesale` },
+    ).subscribe(() => {})
+    // The `x` view is read without subscribing, so it compares revisions.
+    const reader = createLiveQueryObserver(
+      createPooledLiveQuery(query(source)(new Query()), { gcTime: 1 }),
+      { mode: `wholesale` },
+    )
+    write(`insert`, `b`, `x`)
+    const keys = () => [...reader.getSnapshot().state!.keys()]
+    expect(keys()).toEqual([`a`, `b`])
+    // Emptying the unwatched group drops it; new rows build a new one.
+    source.utils.begin()
+    source.utils.write({ type: `delete`, value: { id: `a`, g: `x` } })
+    source.utils.write({ type: `delete`, value: { id: `b`, g: `x` } })
+    source.utils.commit()
+    write(`insert`, `c`, `x`)
+    write(`insert`, `d`, `x`)
+    expect(keys()).toEqual([`c`, `d`])
+    keepAlive()
+  })
+
+  it(`keeps its public Collection live while observed`, async () => {
+    const source = makeSource()
+    const view = createPooledLiveQuery(query(source)(new Query()), {
+      gcTime: 1,
+    })!
+    const observer = createLiveQueryObserver(view, { mode: `wholesale` })
+    const stop = observer.subscribe(() => {})
+    const collection = observer.getSnapshot().collection!
+    expect(collection.toArray).toHaveLength(1)
+    await vi.advanceTimersByTimeAsync(500)
+    expect(collection.status).toBe(`ready`)
+    expect(collection.toArray).toHaveLength(1)
+    stop()
+  })
+
+  it(`hands users a Collection that queries accept as a source`, () => {
+    const source = makeSource()
+    const view = createPooledLiveQuery(query(source)(new Query()), {
+      gcTime: 1,
+    })!
+    const collection = createLiveQueryObserver(view, {
+      mode: `wholesale`,
+    }).getSnapshot().collection!
+    expect(collection).toBeInstanceOf(CollectionImpl)
+    const nested = createLiveQueryCollection({
+      query: (q) => q.from({ c: collection }),
+      startSync: true,
+    })
+    expect(nested.toArray.map((row) => row.id)).toEqual([`a`])
+  })
+
+  it.each([[[5, 120]], [[120, 5]]])(
+    `releases with the longest gcTime among a partition's views (%j)`,
+    async (gcTimes) => {
+      const source = makeSource()
+      for (const gcTime of gcTimes) {
+        const view = createPooledLiveQuery(query(source)(new Query()), {
+          gcTime,
+        })!
+        createLiveQueryObserver(view, { mode: `wholesale` }).subscribe(
+          () => {},
+        )()
+      }
+      expect(await releaseTime(source, 400)).toBe(120)
+    },
+  )
+
+  it.each([`loading`, `ready`] as const)(
+    `releases a partition when source startup re-enters cleanup at %s`,
+    async (cleanupAt) => {
+      const gate = createDeferred<void>()
+      let starts = 0
+      const source = createCollection<Row>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({ markReady }) => {
+            starts++
+            markReady()
+            return { cleanup: () => gate.promise }
+          },
+        },
+      })
+      const builder = new Query()
+        .from({ r: source })
+        .where(({ r }) => eq(r.g, `x`))
+      if (!(builder instanceof BaseQueryBuilder))
+        throw new Error(`not a builder`)
+      const view = createPooledLiveQuery(builder, { gcTime: 1 })!
+      let pending: Promise<void> | undefined
+      const off = source.on(`status:change`, ({ status }) => {
+        if (status === cleanupAt) pending = source.cleanup()
+      })
+      let stop: { unsubscribe: () => void } | undefined
+      try {
+        stop = view.subscribeChanges(() => {})
+        expect(pending).toBeDefined()
+        expect(starts).toBe(cleanupAt === `loading` ? 0 : 1)
+        // Source cleanup start crashes a pooled view that it did not end.
+        expect(view.status).toBe(`crashed`)
+        expect(source.subscriberCount).toBe(0)
+        expect(source[`_changes`].activeSubscribersCount).toBe(0)
+        gate.resolve()
+        await pending
+        expect(source.subscriberCount).toBe(0)
+      } finally {
+        off()
+        gate.resolve()
+        stop?.unsubscribe()
+        await source.cleanup()
+      }
+    },
+  )
+
+  // Cleanup start makes a dependent terminal even if it registers late. A
+  // released partition has no source subscription, so its next attachment
+  // must observe cleanup before acquiring one. The bounded grammar varies
+  // initial ownership (new, retained, released), callback mode and held source
+  // status. It checks terminality before settlement, after restart, and after a
+  // fresh partition mounts. Source counts detect retained or duplicate ownership.
+  it.each(
+    ([`new`, `retained`, `released`] as const).flatMap((ownership) =>
+      ([`granular`, `wholesale`] as const).flatMap((mode) =>
+        ([`loading`, `ready`] as const).map((priorStatus) => ({
+          ownership,
+          mode,
+          priorStatus,
+        })),
+      ),
+    ),
+  )(
+    `retires $ownership $mode partition during $priorStatus cleanup`,
+    async ({ ownership, mode, priorStatus }) => {
+      const gate = createDeferred<void>()
+      let starts = 0
+      const source = createCollection<Row>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            starts++
+            begin()
+            write({ type: `insert`, value: { id: `a`, g: `x` } })
+            commit()
+            if (priorStatus === `ready` || starts > 1) markReady()
+            return { cleanup: () => gate.promise }
+          },
+        },
+      })
+      const build = () => {
+        const builder = new Query()
+          .from({ r: source })
+          .where(({ r }) => eq(r.g, `x`))
+        if (!(builder instanceof BaseQueryBuilder))
+          throw new Error(`not a builder`)
+        return createPooledLiveQuery(builder, { gcTime: 1 })!
+      }
+      let view: ReturnType<typeof build> | undefined
+      let observer: ReturnType<typeof createLiveQueryObserver> | undefined
+      let stop: (() => void) | undefined
+      let fresh:
+        | ReturnType<typeof createLiveQueryObserver<Row, string | number>>
+        | undefined
+      let stopFresh: (() => void) | undefined
+      try {
+        source.startSyncImmediate()
+        if (ownership !== `new`) {
+          view = build()
+          observer = createLiveQueryObserver(view, { mode })
+          stop = observer.subscribe(() => {})
+          if (ownership === `released`) {
+            stop()
+            stop = undefined
+            await vi.advanceTimersByTimeAsync(100)
+            expect(source.subscriberCount).toBe(0)
+          }
+        }
+        // A retained view reads the source, so only a cascade cleanup may
+        // start; it ends the view. A view that attaches during cleanup
+        // crashes, because the cleanup did not end it.
+        const pending =
+          ownership === `retained`
+            ? source.cleanup({ dependents: true })
+            : source.cleanup()
+        const terminal = ownership === `retained` ? `cleaned-up` : `crashed`
+        expect(source.status).toBe(priorStatus)
+        view ??= build()
+        observer ??= createLiveQueryObserver(view, { mode })
+        let attachmentError: unknown
+        try {
+          if (ownership !== `retained`) stop = observer.subscribe(() => {})
+        } catch (error) {
+          attachmentError = error
+        }
+        expect(
+          attachmentError,
+          `late dependent becomes terminal without acquiring a source`,
+        ).toBeUndefined()
+        expect(view.status).toBe(terminal)
+        expect(observer.getSnapshot().status).toBe(terminal)
+        expect(source.subscriberCount).toBe(0)
+        expect(source[`_changes`].activeSubscribersCount).toBe(0)
+        gate.resolve()
+        await pending
+        source.startSyncImmediate()
+        expect(view.status).toBe(terminal)
+        fresh = createLiveQueryObserver(build(), { mode })
+        stopFresh = fresh.subscribe(() => {})
+        expect(fresh.getSnapshot().status).toBe(`ready`)
+        expect(
+          Array.from(fresh.getSnapshot().state!.values(), ({ id, g }) => ({
+            id,
+            g,
+          })),
+        ).toEqual([{ id: `a`, g: `x` }])
+        expect(source.subscriberCount).toBe(1)
+      } finally {
+        gate.resolve()
+        stop?.()
+        stopFresh?.()
+        observer?.dispose()
+        fresh?.dispose()
+        await source.cleanup()
+      }
+    },
+  )
+
+  /** A recoverable eager-source problem after readiness is a sync problem in
+   * the health tree: it changes neither status nor partition lifetime. Only
+   * source cleanup is terminal. The return-to-healthy checkpoint checks both
+   * shared views and fresh subscription ownership in the same sync run.
+   * On-demand sources cannot enter this path: pooling explicitly excludes them.
+   */
+  it.each([`before-views`, `after-views`] as const)(
+    `retains a partition through a recoverable sync problem $0`,
+    async (errorAt) => {
+      let fail = () => {}
+      let recover = () => {}
+      const source = createCollection<Row>({
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: ({
+            begin,
+            write,
+            commit,
+            markReady,
+            reportError,
+            reportHealthy,
+          }) => {
+            begin()
+            write({ type: `insert`, value: { id: `a`, g: `x` } })
+            commit()
+            markReady()
+            fail = () => reportError(new Error(`temporary source error`))
+            recover = reportHealthy
+          },
+        },
+      })
+      source.startSyncImmediate()
+      if (errorAt === `before-views`) fail()
+      const build = () => {
+        const builder = new Query()
+          .from({ r: source })
+          .where(({ r }) => eq(r.g, `x`))
+        if (!(builder instanceof BaseQueryBuilder))
+          throw new Error(`not a builder`)
+        return createPooledLiveQuery(builder, { gcTime: 1 })!
+      }
+      const views = [build(), build()]
+      const stops: Array<ReturnType<typeof source.subscribeChanges>> = []
+      try {
+        if (errorAt === `after-views`) fail()
+        for (const view of views) {
+          expect(view).toBeDefined()
+          stops.push(view.subscribeChanges(() => {}))
+          expect(view.status).toBe(`ready`)
+          expect(view.health.hasErrors).toBe(true)
+        }
+        recover()
+        for (const view of views) {
+          expect(view.status).toBe(`ready`)
+          expect(view.health.hasErrors).toBe(false)
+          expect(
+            Array.from(view.entries(), ([key, row]) => ({
+              key,
+              id: row.id,
+              g: row.g,
+            })),
+          ).toEqual([{ key: `a`, id: `a`, g: `x` }])
+        }
+        expect(source.subscriberCount).toBe(1)
+      } finally {
+        stops.forEach((stop) => stop.unsubscribe())
+        await vi.advanceTimersByTimeAsync(100)
+        await source.cleanup()
+      }
+    },
+  )
+})
diff --git a/packages/db/tests/query/pooled-live-query-oracle.property.test.ts b/packages/db/tests/query/pooled-live-query-oracle.property.test.ts
index 4b0ceb899e..0f10d28c43 100644
--- a/packages/db/tests/query/pooled-live-query-oracle.property.test.ts
+++ b/packages/db/tests/query/pooled-live-query-oracle.property.test.ts
@@ -97,6 +97,7 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { createOracleReach } from '../oracle-reach.js'
 import {
   flushPromises,
@@ -1039,6 +1040,23 @@ async function runHistory(history: History, reach?: Reach): Promise<void> {
   ])
 }
 
+// The pooled observer publishes the status and keys that a live-query
+// Collection compiled for the same query publishes.
+function expectSnapshotMatchesReference(
+  snapshot: ReturnType<
+    ReturnType<typeof createLiveQueryObserver>[`getSnapshot`]
+  >,
+  reference: ReturnType<typeof createLiveQueryCollection>,
+): void {
+  expect(snapshot.status).toBe(reference.status)
+  expect([...snapshot.state!.keys()]).toEqual([...reference.keys()])
+}
+
+declareOracle({
+  check: [runHistory, expectSnapshotMatchesReference],
+  model: [expectedKeys, expectedRows],
+})
+
 describe(`pooled live query oracle`, () => {
   // The pinned histories and the fixed campaign stand aside during any path
   // replay. The random campaign below is the one that a replay of this
@@ -1082,8 +1100,7 @@ describe(`pooled live query oracle`, () => {
       const reference = createLiveQueryCollection({ query, startSync: true })
       await reference.preload()
       const snapshot = pooled.getSnapshot()
-      expect(snapshot.status).toBe(reference.status)
-      expect([...snapshot.state!.keys()]).toEqual([...reference.keys()])
+      expectSnapshotMatchesReference(snapshot, reference)
       stop()
       await source.cleanup({ dependents: true })
     })
diff --git a/packages/db/tests/query/subquery-user-value-oracle.test.ts b/packages/db/tests/query/subquery-user-value-oracle.test.ts
index 9b27a203fe..955de9dc5c 100644
--- a/packages/db/tests/query/subquery-user-value-oracle.test.ts
+++ b/packages/db/tests/query/subquery-user-value-oracle.test.ts
@@ -10,6 +10,7 @@ import { buildQuery } from '../../src/query/builder/index.js'
 import { compileQuery } from '../../src/query/compiler/index.js'
 import { collectCollectionSources } from '../../src/query/ir.js'
 import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { stripVirtualProps } from '../utils.js'
 import { createControlledCollection } from './includes-oracle-helpers.js'
 
@@ -55,12 +56,14 @@ const tags: Array<Tag> = [
   { id: 7, groupId: 2 },
 ]
 
+type DistinctRow = { personId: number; groupId: number }
+
 // DISTINCT forms the set of child group IDs before the outer join and WHERE.
 // This model deliberately ignores compiler weights and public-key reduction.
 function expectedDistinctRows(
   personRows: Iterable<Person>,
   tagRows: Iterable<Tag>,
-): Array<{ personId: number; groupId: number }> {
+): Array<DistinctRow> {
   const groups = new Set(Array.from(tagRows, (tag) => tag.groupId))
   return Array.from(personRows)
     .filter((person) => person.enabled && groups.has(person.groupId))
@@ -68,6 +71,67 @@ function expectedDistinctRows(
     .sort((left, right) => left.personId - right.personId)
 }
 
+/**
+ * The check for the DISTINCT history: after each source write, the public rows
+ * of the live query must equal the model's rows for the same source Maps. The
+ * Maps model source rows by ID, so a tag delete is legal only for a tag that
+ * exists, even when another tag still supports the same group.
+ */
+function expectPublicSnapshotFollowsModel(
+  live: { readonly toArray: Array<DistinctRow> },
+  modelPeople: ReadonlyMap<number, Person>,
+  modelTags: ReadonlyMap<number, Tag>,
+  checkpoint: string,
+): void {
+  expect(
+    live.toArray
+      .map(stripVirtualProps)
+      .sort((left, right) => left.personId - right.personId),
+    checkpoint,
+  ).toEqual(expectedDistinctRows(modelPeople.values(), modelTags.values()))
+}
+
+/**
+ * The aggregate QueryRef is one row whose total counts every source item. The
+ * joined person is published only when that total equals its ID.
+ */
+function expectedAggregateJoinRows(
+  itemRows: ReadonlyMap<number, { id: number }>,
+  personRows: ReadonlyMap<number, { id: number }>,
+): Array<{ personId: number; total: number }> {
+  const total = itemRows.size
+  return Array.from(personRows.values())
+    .filter((person) => person.id === total)
+    .map((person) => ({ personId: person.id, total }))
+}
+
+/**
+ * The joined bag of person-tag candidates, sorted by the declared person ID.
+ * An ordered findOne publishes the first candidate, and a sticky singleton
+ * would keep an earlier one.
+ */
+function expectedFindOneCandidates(
+  personRows: ReadonlyMap<number, { id: number; groupId: number }>,
+  tagRows: ReadonlyMap<number, { id: number; groupId: number }>,
+): Array<{ personId: number; tagId: number }> {
+  return Array.from(personRows.values())
+    .flatMap((person) =>
+      Array.from(tagRows.values())
+        .filter((tag) => tag.groupId === person.groupId)
+        .map((tag) => ({ personId: person.id, tagId: tag.id })),
+    )
+    .sort((left, right) => left.personId - right.personId)
+}
+
+declareOracle({
+  check: [expectPublicSnapshotFollowsModel],
+  model: [
+    expectedDistinctRows,
+    expectedAggregateJoinRows,
+    expectedFindOneCandidates,
+  ],
+})
+
 describe('subquery boundaries preserve operators and user rows', () => {
   it('joins the distinct subquery result before applying the outer WHERE', async () => {
     const persons = createControlledCollection<Person>(
@@ -192,14 +256,8 @@ describe('subquery boundaries preserve operators and user rows', () => {
     // tag still supports the same group.
     const modelPeople = new Map(people.map((person) => [person.id, person]))
     const modelTags = new Map(tags.map((tag) => [tag.id, tag]))
-    const checkPublicSnapshot = (checkpoint: string) => {
-      expect(
-        live.toArray
-          .map(stripVirtualProps)
-          .sort((left, right) => left.personId - right.personId),
-        checkpoint,
-      ).toEqual(expectedDistinctRows(modelPeople.values(), modelTags.values()))
-    }
+    const checkPublicSnapshot = (checkpoint: string) =>
+      expectPublicSnapshotFollowsModel(live, modelPeople, modelTags, checkpoint)
 
     await withHistoryCleanup(
       async () => {
@@ -236,231 +294,6 @@ describe('subquery boundaries preserve operators and user rows', () => {
     )
   })
 
-  it('keeps a no-select user row shaped like a Value expression intact', async () => {
-    const original = { id: 1, type: 'val' as const, value: 42 }
-    const source = createControlledCollection('value-shaped-source', [original])
-    const live = createLiveQueryCollection({
-      query: (q) => {
-        const inner = q.from({ item: source.collection })
-        return q.from({ item: inner })
-      },
-    })
-
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([original])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
-
-  it('keeps a selected user object shaped like a Value expression intact', async () => {
-    const source = createControlledCollection('value-shaped-selection', [
-      { id: 1 },
-    ])
-    try {
-      const live = createLiveQueryCollection({
-        query: (q) =>
-          q.from({ item: source.collection }).select(() => ({
-            type: 'val' as const,
-            value: 42,
-          })),
-        getKey: () => 1,
-      })
-      try {
-        await live.preload()
-        expect(live.toArray.map(stripVirtualProps)).toEqual([
-          { type: 'val', value: 42 },
-        ])
-      } finally {
-        await live.cleanup()
-      }
-    } finally {
-      await source.collection.cleanup()
-    }
-  })
-
-  it('evaluates selected arrays of references as arrays of row values', async () => {
-    const source = createControlledCollection('array-selection', [
-      { id: 1, name: 'Ada' },
-    ])
-    const live = createLiveQueryCollection({
-      query: (q) =>
-        q.from({ item: source.collection }).select(({ item }) => ({
-          pair: [item.id, item.name],
-        })),
-      getKey: () => 1,
-    })
-    try {
-      await live.preload()
-      expect(live.toArray[0]?.pair.map((value) => typeof value)).toEqual([
-        'number',
-        'string',
-      ])
-      expect(live.toArray.map(stripVirtualProps)).toEqual([
-        { pair: [1, 'Ada'] },
-      ])
-      expect(JSON.stringify(live.toArray.map(stripVirtualProps))).toBe(
-        '[{"pair":[1,"Ada"]}]',
-      )
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
-
-  it('keeps a top-level proxy-shaped selected field as user data', async () => {
-    const source = createControlledCollection('proxy-field-selection', [
-      { id: 1 },
-    ])
-    const live = createLiveQueryCollection({
-      query: (q) =>
-        q.from({ item: source.collection }).select(({ item }) => ({
-          __refProxy: true,
-          id: item.id,
-        })),
-      getKey: () => 1,
-    })
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([
-        { __refProxy: true, id: 1 },
-      ])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
-
-  it('keeps proxy-shaped fields in aggregate subqueries', async () => {
-    const source = createControlledCollection('proxy-field-aggregate', [
-      { id: 1 },
-      { id: 2 },
-    ])
-    const live = createLiveQueryCollection({
-      query: (q) => {
-        const summary = q
-          .from({ item: source.collection })
-          .select(({ item }) => ({
-            __refProxy: true,
-            total: count(item.id),
-          }))
-        return q.from({ result: summary }).select(({ result }) => ({
-          __refProxy: result.__refProxy,
-          total: result.total,
-        }))
-      },
-      getKey: () => 1,
-    })
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([
-        { __refProxy: true, total: 2 },
-      ])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
-
-  it.each([
-    { name: 'reference-shaped', payload: { type: 'ref', path: ['name'] } },
-    {
-      name: 'function-shaped',
-      payload: { type: 'func', name: 'user', args: [] },
-    },
-    {
-      name: 'conditional-shaped',
-      payload: { type: 'conditionalSelect', branches: [] },
-    },
-    { name: 'proxy-shaped', payload: { __refProxy: true, __path: ['name'] } },
-    { name: 'wrapper-shaped', payload: { __brand: 'MaterializeWrapper' } },
-  ])('keeps selected $name user objects intact', async ({ payload }) => {
-    const source = createControlledCollection('selected-container', [{ id: 1 }])
-    const live = createLiveQueryCollection({
-      query: (q) =>
-        q.from({ item: source.collection }).select(() => ({ payload })),
-      getKey: () => 1,
-    })
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([{ payload }])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
-
-  it('keeps an outer virtual-field WHERE after a joined DISTINCT result', async () => {
-    const source = createControlledCollection('distinct-pushdown', [
-      { id: 1, groupId: 1 },
-      { id: 2, groupId: 1 },
-    ])
-    const people = createControlledCollection('distinct-pushdown-people', [
-      { id: 1, groupId: 1 },
-    ])
-    const live = createLiveQueryCollection({
-      query: (q) => {
-        const groups = q
-          .from({ item: source.collection })
-          .select(({ item }) => ({ groupId: item.groupId }))
-          .distinct()
-        return q
-          .from({ person: people.collection })
-          .innerJoin({ group: groups }, ({ person, group }) =>
-            eq(person.groupId, group.groupId),
-          )
-          .where(({ group }) => eq(group.$key, 2))
-          .select(({ group }) => ({ groupId: group.groupId }))
-      },
-      getKey: () => 1,
-    })
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-      await people.collection.cleanup()
-    }
-  })
-
-  it('keeps an outer WHERE after a nested aggregate select', async () => {
-    const source = createControlledCollection('nested-aggregate-pushdown', [
-      { id: 1 },
-      { id: 2 },
-    ])
-    const people = createControlledCollection('nested-aggregate-people', [
-      { id: 2 },
-    ])
-    const live = createLiveQueryCollection({
-      query: (q) => {
-        const stats = q
-          .from({ item: source.collection })
-          .select(({ item }) => ({
-            stats: { type: 'summary', total: count(item.id) },
-          }))
-        return q
-          .from({ person: people.collection })
-          .innerJoin({ result: stats }, ({ person, result }) =>
-            eq(person.id, result.stats.total),
-          )
-          .where(({ result }) => eq(result.$key, 'single_group'))
-          .select(({ result }) => ({ total: result.stats.total }))
-      },
-      getKey: () => 1,
-    })
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([{ total: 2 }])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-      await people.collection.cleanup()
-    }
-  })
-
   it('recomputes a joined aggregate QueryRef after source writes', async () => {
     const initialItems = [{ id: 1 }, { id: 2 }]
     const initialPeople = [{ id: 2 }]
@@ -497,10 +330,7 @@ describe('subquery boundaries preserve operators and user rows', () => {
     const modelItems = new Map(initialItems.map((row) => [row.id, row]))
     const modelPeople = new Map(initialPeople.map((row) => [row.id, row]))
     const checkPublicSnapshot = (checkpoint: string) => {
-      const total = modelItems.size
-      const expected = Array.from(modelPeople.values())
-        .filter((person) => person.id === total)
-        .map((person) => ({ personId: person.id, total }))
+      const expected = expectedAggregateJoinRows(modelItems, modelPeople)
       expect(live.toArray.map(stripVirtualProps), checkpoint).toEqual(expected)
     }
 
@@ -573,10 +403,7 @@ describe('subquery boundaries preserve operators and user rows', () => {
     ])
     const modelPeople = new Map([[2, { id: 2 }]])
     const checkPublicSnapshot = (checkpoint: string) => {
-      const total = modelItems.size
-      const expected = Array.from(modelPeople.values())
-        .filter((person) => person.id === total)
-        .map((person) => ({ personId: person.id, total }))
+      const expected = expectedAggregateJoinRows(modelItems, modelPeople)
       expect(live.toArray.map(stripVirtualProps), checkpoint).toEqual(expected)
     }
     await withHistoryCleanup(
@@ -604,74 +431,6 @@ describe('subquery boundaries preserve operators and user rows', () => {
     )
   })
 
-  it('keeps one default-key findOne QueryRef row through candidate changes', async () => {
-    const first = { id: 1 }
-    const second = { id: 2 }
-    const source = createControlledCollection('find-one-default-source', [
-      first,
-      second,
-    ])
-    const anchors = createControlledCollection('find-one-default-anchors', [
-      first,
-      second,
-    ])
-    const joined = createLiveQueryCollection({
-      query: (q) => {
-        const firstQuery = q
-          .from({ item: source.collection })
-          .select(({ item }) => ({ id: item.id }))
-          .findOne()
-        return q
-          .from({ anchor: anchors.collection })
-          .innerJoin({ first: firstQuery }, ({ anchor, first: row }) =>
-            eq(anchor.id, row.id),
-          )
-          .select(({ first: row }) => ({ id: row.id }))
-      },
-      getKey: (row) => row.id,
-    })
-    const leading = createLiveQueryCollection({
-      query: (q) => {
-        const firstQuery = q
-          .from({ item: source.collection })
-          .select(({ item }) => ({ id: item.id }))
-          .findOne()
-        return q
-          .from({ first: firstQuery })
-          .innerJoin({ anchor: anchors.collection }, ({ first: row, anchor }) =>
-            eq(row.id, anchor.id),
-          )
-          .select(({ first: row }) => ({ id: row.id }))
-      },
-      getKey: (row) => row.id,
-    })
-
-    await withHistoryCleanup(
-      async () => {
-        await Promise.all([joined.preload(), leading.preload()])
-        for (const live of [joined, leading]) {
-          expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 1 }])
-        }
-
-        source.write('delete', first)
-        for (const live of [joined, leading]) {
-          expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 2 }])
-        }
-
-        source.write('insert', first)
-        for (const live of [joined, leading]) {
-          expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 1 }])
-        }
-      },
-      () => [
-        () => joined.cleanup(),
-        () => leading.cleanup(),
-        () => source.collection.cleanup(),
-        () => anchors.collection.cleanup(),
-      ],
-    )
-  })
-
   // The public builder documents findOne() as returning the first result.
   // The nested QueryRef must reduce the candidates before the outer join.
   it('publishes one ordered joined findOne QueryRef row through source writes', async () => {
@@ -730,14 +489,7 @@ describe('subquery boundaries preserve operators and user rows', () => {
     const recordPublicSnapshot = (checkpoint: string) => {
       // Enumerate the joined bag, sort by the declared person ID, then take
       // one row. This reference does not use the compiler's singleton state.
-      const candidates = Array.from(modelPeople.values())
-        .flatMap((person) =>
-          Array.from(modelTags.values())
-            .filter((tag) => tag.groupId === person.groupId)
-            .map((tag) => ({ personId: person.id, tagId: tag.id })),
-        )
-        .sort((left, right) => left.personId - right.personId)
-      const first = candidates[0]
+      const first = expectedFindOneCandidates(modelPeople, modelTags)[0]
       const expected = first
         ? [{ anchorId: first.personId, tagId: first.tagId }]
         : []
@@ -830,13 +582,7 @@ describe('subquery boundaries preserve operators and user rows', () => {
     const modelPeople = new Map(initialPeople.map((row) => [row.id, row]))
     const modelTags = new Map(initialTags.map((row) => [row.id, row]))
     const checkPublicSnapshot = (checkpoint: string) => {
-      const first = Array.from(modelPeople.values())
-        .flatMap((person) =>
-          Array.from(modelTags.values())
-            .filter((tag) => tag.groupId === person.groupId)
-            .map((tag) => ({ personId: person.id, tagId: tag.id })),
-        )
-        .sort((left, right) => left.personId - right.personId)[0]
+      const first = expectedFindOneCandidates(modelPeople, modelTags)[0]
       const actual = live.toArray.map((row) => ({
         anchorId: row.anchorId,
         first: row.first && {
@@ -873,71 +619,4 @@ describe('subquery boundaries preserve operators and user rows', () => {
       ],
     )
   })
-
-  it('keeps a renamed no-select QueryRef bound to its source', async () => {
-    const source = createControlledCollection('renamed-query-ref', [{ id: 1 }])
-    const live = createLiveQueryCollection({
-      query: (q) => q.from({ one: q.from({ item: source.collection }) }),
-    })
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 1 }])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
-
-  it.each([
-    { id: 1, type: 'ref', path: ['name'] },
-    { id: 2, type: 'func', name: 'user', args: [] },
-    { id: 3, type: 'agg', name: 'user', args: [] },
-    { id: 4, type: 'conditionalSelect', branches: [] },
-    { id: 5, type: 'includesSubquery', query: {}, fieldName: 'user' },
-  ])(
-    'keeps a functional user result with IR-like fields: $type',
-    async (expected) => {
-      const source = createControlledCollection('expression-shaped-selection', [
-        { id: 1 },
-      ])
-      try {
-        const live = createLiveQueryCollection({
-          query: (q) =>
-            q.from({ item: source.collection }).fn.select(() => expected),
-          getKey: (row) => row.id,
-        })
-        try {
-          await live.preload()
-          expect(live.toArray.map(stripVirtualProps)).toEqual([expected])
-        } finally {
-          await live.cleanup()
-        }
-      } finally {
-        await source.collection.cleanup()
-      }
-    },
-  )
-
-  it('compares a Value-shaped predicate operand as user data', async () => {
-    const payload = { type: 'val' as const, value: 42 }
-    const rows: Array<{ id: number; payload: unknown }> = [
-      { id: 1, payload },
-      { id: 2, payload: 42 },
-    ]
-    const source = createControlledCollection('value-shaped-predicate', rows)
-    const live = createLiveQueryCollection({
-      query: (q) =>
-        q
-          .from({ item: source.collection })
-          .where(({ item }) => eq(item.payload, payload)),
-    })
-
-    try {
-      await live.preload()
-      expect(live.toArray.map(stripVirtualProps)).toEqual([rows[0]])
-    } finally {
-      await live.cleanup()
-      await source.collection.cleanup()
-    }
-  })
 })
diff --git a/packages/db/tests/query/subquery-user-value.test.ts b/packages/db/tests/query/subquery-user-value.test.ts
new file mode 100644
index 0000000000..77bf5d9dd5
--- /dev/null
+++ b/packages/db/tests/query/subquery-user-value.test.ts
@@ -0,0 +1,372 @@
+/**
+ * Ordinary unit tests moved out of subquery-user-value-oracle.test.ts. Each
+ * compares a user row, selected object, or predicate operand with a value
+ * written in the test. None reaches the DISTINCT or aggregate model. The law
+ * that a QueryRef keeps user rows as data is stated in the oracle file.
+ */
+import { describe, expect, it } from 'vitest'
+import { count, createLiveQueryCollection, eq } from '../../src/query/index.js'
+import { withHistoryCleanup } from '../optimistic-history-oracle.js'
+import { stripVirtualProps } from '../utils.js'
+import { createControlledCollection } from './includes-oracle-helpers.js'
+
+describe('subquery boundaries preserve operators and user rows', () => {
+  it('keeps a no-select user row shaped like a Value expression intact', async () => {
+    const original = { id: 1, type: 'val' as const, value: 42 }
+    const source = createControlledCollection('value-shaped-source', [original])
+    const live = createLiveQueryCollection({
+      query: (q) => {
+        const inner = q.from({ item: source.collection })
+        return q.from({ item: inner })
+      },
+    })
+
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([original])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it('keeps a selected user object shaped like a Value expression intact', async () => {
+    const source = createControlledCollection('value-shaped-selection', [
+      { id: 1 },
+    ])
+    try {
+      const live = createLiveQueryCollection({
+        query: (q) =>
+          q.from({ item: source.collection }).select(() => ({
+            type: 'val' as const,
+            value: 42,
+          })),
+        getKey: () => 1,
+      })
+      try {
+        await live.preload()
+        expect(live.toArray.map(stripVirtualProps)).toEqual([
+          { type: 'val', value: 42 },
+        ])
+      } finally {
+        await live.cleanup()
+      }
+    } finally {
+      await source.collection.cleanup()
+    }
+  })
+
+  it('evaluates selected arrays of references as arrays of row values', async () => {
+    const source = createControlledCollection('array-selection', [
+      { id: 1, name: 'Ada' },
+    ])
+    const live = createLiveQueryCollection({
+      query: (q) =>
+        q.from({ item: source.collection }).select(({ item }) => ({
+          pair: [item.id, item.name],
+        })),
+      getKey: () => 1,
+    })
+    try {
+      await live.preload()
+      expect(live.toArray[0]?.pair.map((value) => typeof value)).toEqual([
+        'number',
+        'string',
+      ])
+      expect(live.toArray.map(stripVirtualProps)).toEqual([
+        { pair: [1, 'Ada'] },
+      ])
+      expect(JSON.stringify(live.toArray.map(stripVirtualProps))).toBe(
+        '[{"pair":[1,"Ada"]}]',
+      )
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it('keeps a top-level proxy-shaped selected field as user data', async () => {
+    const source = createControlledCollection('proxy-field-selection', [
+      { id: 1 },
+    ])
+    const live = createLiveQueryCollection({
+      query: (q) =>
+        q.from({ item: source.collection }).select(({ item }) => ({
+          __refProxy: true,
+          id: item.id,
+        })),
+      getKey: () => 1,
+    })
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([
+        { __refProxy: true, id: 1 },
+      ])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it('keeps proxy-shaped fields in aggregate subqueries', async () => {
+    const source = createControlledCollection('proxy-field-aggregate', [
+      { id: 1 },
+      { id: 2 },
+    ])
+    const live = createLiveQueryCollection({
+      query: (q) => {
+        const summary = q
+          .from({ item: source.collection })
+          .select(({ item }) => ({
+            __refProxy: true,
+            total: count(item.id),
+          }))
+        return q.from({ result: summary }).select(({ result }) => ({
+          __refProxy: result.__refProxy,
+          total: result.total,
+        }))
+      },
+      getKey: () => 1,
+    })
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([
+        { __refProxy: true, total: 2 },
+      ])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it.each([
+    { name: 'reference-shaped', payload: { type: 'ref', path: ['name'] } },
+    {
+      name: 'function-shaped',
+      payload: { type: 'func', name: 'user', args: [] },
+    },
+    {
+      name: 'conditional-shaped',
+      payload: { type: 'conditionalSelect', branches: [] },
+    },
+    { name: 'proxy-shaped', payload: { __refProxy: true, __path: ['name'] } },
+    { name: 'wrapper-shaped', payload: { __brand: 'MaterializeWrapper' } },
+  ])('keeps selected $name user objects intact', async ({ payload }) => {
+    const source = createControlledCollection('selected-container', [{ id: 1 }])
+    const live = createLiveQueryCollection({
+      query: (q) =>
+        q.from({ item: source.collection }).select(() => ({ payload })),
+      getKey: () => 1,
+    })
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([{ payload }])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it('keeps an outer virtual-field WHERE after a joined DISTINCT result', async () => {
+    const source = createControlledCollection('distinct-pushdown', [
+      { id: 1, groupId: 1 },
+      { id: 2, groupId: 1 },
+    ])
+    const people = createControlledCollection('distinct-pushdown-people', [
+      { id: 1, groupId: 1 },
+    ])
+    const live = createLiveQueryCollection({
+      query: (q) => {
+        const groups = q
+          .from({ item: source.collection })
+          .select(({ item }) => ({ groupId: item.groupId }))
+          .distinct()
+        return q
+          .from({ person: people.collection })
+          .innerJoin({ group: groups }, ({ person, group }) =>
+            eq(person.groupId, group.groupId),
+          )
+          .where(({ group }) => eq(group.$key, 2))
+          .select(({ group }) => ({ groupId: group.groupId }))
+      },
+      getKey: () => 1,
+    })
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+      await people.collection.cleanup()
+    }
+  })
+
+  it('keeps an outer WHERE after a nested aggregate select', async () => {
+    const source = createControlledCollection('nested-aggregate-pushdown', [
+      { id: 1 },
+      { id: 2 },
+    ])
+    const people = createControlledCollection('nested-aggregate-people', [
+      { id: 2 },
+    ])
+    const live = createLiveQueryCollection({
+      query: (q) => {
+        const stats = q
+          .from({ item: source.collection })
+          .select(({ item }) => ({
+            stats: { type: 'summary', total: count(item.id) },
+          }))
+        return q
+          .from({ person: people.collection })
+          .innerJoin({ result: stats }, ({ person, result }) =>
+            eq(person.id, result.stats.total),
+          )
+          .where(({ result }) => eq(result.$key, 'single_group'))
+          .select(({ result }) => ({ total: result.stats.total }))
+      },
+      getKey: () => 1,
+    })
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([{ total: 2 }])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+      await people.collection.cleanup()
+    }
+  })
+  it('keeps a renamed no-select QueryRef bound to its source', async () => {
+    const source = createControlledCollection('renamed-query-ref', [{ id: 1 }])
+    const live = createLiveQueryCollection({
+      query: (q) => q.from({ one: q.from({ item: source.collection }) }),
+    })
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 1 }])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it.each([
+    { id: 1, type: 'ref', path: ['name'] },
+    { id: 2, type: 'func', name: 'user', args: [] },
+    { id: 3, type: 'agg', name: 'user', args: [] },
+    { id: 4, type: 'conditionalSelect', branches: [] },
+    { id: 5, type: 'includesSubquery', query: {}, fieldName: 'user' },
+  ])(
+    'keeps a functional user result with IR-like fields: $type',
+    async (expected) => {
+      const source = createControlledCollection('expression-shaped-selection', [
+        { id: 1 },
+      ])
+      try {
+        const live = createLiveQueryCollection({
+          query: (q) =>
+            q.from({ item: source.collection }).fn.select(() => expected),
+          getKey: (row) => row.id,
+        })
+        try {
+          await live.preload()
+          expect(live.toArray.map(stripVirtualProps)).toEqual([expected])
+        } finally {
+          await live.cleanup()
+        }
+      } finally {
+        await source.collection.cleanup()
+      }
+    },
+  )
+
+  it('compares a Value-shaped predicate operand as user data', async () => {
+    const payload = { type: 'val' as const, value: 42 }
+    const rows: Array<{ id: number; payload: unknown }> = [
+      { id: 1, payload },
+      { id: 2, payload: 42 },
+    ]
+    const source = createControlledCollection('value-shaped-predicate', rows)
+    const live = createLiveQueryCollection({
+      query: (q) =>
+        q
+          .from({ item: source.collection })
+          .where(({ item }) => eq(item.payload, payload)),
+    })
+
+    try {
+      await live.preload()
+      expect(live.toArray.map(stripVirtualProps)).toEqual([rows[0]])
+    } finally {
+      await live.cleanup()
+      await source.collection.cleanup()
+    }
+  })
+
+  it('keeps one default-key findOne QueryRef row through candidate changes', async () => {
+    const first = { id: 1 }
+    const second = { id: 2 }
+    const source = createControlledCollection('find-one-default-source', [
+      first,
+      second,
+    ])
+    const anchors = createControlledCollection('find-one-default-anchors', [
+      first,
+      second,
+    ])
+    const joined = createLiveQueryCollection({
+      query: (q) => {
+        const firstQuery = q
+          .from({ item: source.collection })
+          .select(({ item }) => ({ id: item.id }))
+          .findOne()
+        return q
+          .from({ anchor: anchors.collection })
+          .innerJoin({ first: firstQuery }, ({ anchor, first: row }) =>
+            eq(anchor.id, row.id),
+          )
+          .select(({ first: row }) => ({ id: row.id }))
+      },
+      getKey: (row) => row.id,
+    })
+    const leading = createLiveQueryCollection({
+      query: (q) => {
+        const firstQuery = q
+          .from({ item: source.collection })
+          .select(({ item }) => ({ id: item.id }))
+          .findOne()
+        return q
+          .from({ first: firstQuery })
+          .innerJoin({ anchor: anchors.collection }, ({ first: row, anchor }) =>
+            eq(row.id, anchor.id),
+          )
+          .select(({ first: row }) => ({ id: row.id }))
+      },
+      getKey: (row) => row.id,
+    })
+
+    await withHistoryCleanup(
+      async () => {
+        await Promise.all([joined.preload(), leading.preload()])
+        for (const live of [joined, leading]) {
+          expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 1 }])
+        }
+
+        source.write('delete', first)
+        for (const live of [joined, leading]) {
+          expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 2 }])
+        }
+
+        source.write('insert', first)
+        for (const live of [joined, leading]) {
+          expect(live.toArray.map(stripVirtualProps)).toEqual([{ id: 1 }])
+        }
+      },
+      () => [
+        () => joined.cleanup(),
+        () => leading.cleanup(),
+        () => source.collection.cleanup(),
+        () => anchors.collection.cleanup(),
+      ],
+    )
+  })
+})
diff --git a/packages/db/tests/query/virtual-row-fields-oracle.test-d.ts b/packages/db/tests/query/virtual-row-fields-oracle.test-d.ts
index c204c99901..32f6465102 100644
--- a/packages/db/tests/query/virtual-row-fields-oracle.test-d.ts
+++ b/packages/db/tests/query/virtual-row-fields-oracle.test-d.ts
@@ -40,8 +40,9 @@ import {
   materialize,
   toArray,
 } from '../../src/query/index.js'
-import { createCollection } from '../../src/collection/index.js'
-import { mockSyncCollectionOptions } from '../utils.js'
+import { declareOracle } from '../oracle-declaration.js'
+import { rows } from './virtual-row-fields-type-fixture.js'
+import type { Profile, Row } from './virtual-row-fields-type-fixture.js'
 import type { RefLeaf } from '../../src/query/builder/types.js'
 import type { SingleRowRefProxy } from '../../src/query/builder/ref-proxy.js'
 import type { Ref } from '../../src/query/index.js'
@@ -87,23 +88,9 @@ type IndexRefFor<
 
 type VirtualVariant = PublishedValueFor<Variant, `row-root`>
 
-type Profile = { label: string }
-type Row = {
-  id: string
-  profile: Profile
-  optionalProfile?: Profile
-  nullableProfile: Profile | null
-  createdAt: Date
-  tags: Array<string>
-}
-
-const rows = createCollection(
-  mockSyncCollectionOptions<Row>({
-    id: `virtual-row-fields-type-oracle`,
-    getKey: (row) => row.id,
-    initialData: [],
-  }),
-)
+declareOracle({
+  typeModel: [`PublishedValueFor`, `QueryRefFor`, `IndexRefFor`],
+})
 
 describe(`virtual row field type boundary`, () => {
   test(`WithoutVirtualProps preserves discriminated row unions`, () => {
@@ -176,36 +163,6 @@ describe(`virtual row field type boundary`, () => {
     })
   })
 
-  test(`opaque scalar child results do not gain virtual row fields`, () => {
-    const collection = createLiveQueryCollection((q) =>
-      q.from({ row: rows }).select(({ row }) => ({
-        id: row.id,
-        dates: toArray(
-          q
-            .from({ child: rows })
-            .where(({ child }) => eq(child.id, row.id))
-            .select(({ child }) => child.createdAt),
-        ),
-        firstDate: materialize(
-          q
-            .from({ child: rows })
-            .where(({ child }) => eq(child.id, row.id))
-            .select(({ child }) => child.createdAt)
-            .findOne(),
-        ),
-      })),
-    )
-
-    const result = collection.toArray[0]!
-    expectTypeOf(result.dates[0]!).toEqualTypeOf<Date>()
-    expectTypeOf(result.firstDate).toEqualTypeOf<Date | undefined>()
-
-    // @ts-expect-error Date values are not rows and have no virtual row fields.
-    result.dates[0]!.$key
-    // @ts-expect-error Materialized Date values are not rows either.
-    result.firstDate?.$synced
-  })
-
   test(`projected child metadata follows row-shaped results`, () => {
     const collection = createLiveQueryCollection((q) =>
       q.from({ row: rows }).select(({ row }) => ({
diff --git a/packages/db/tests/query/virtual-row-fields-oracle.test.ts b/packages/db/tests/query/virtual-row-fields-oracle.test.ts
index 796f93f36c..8548e1cfef 100644
--- a/packages/db/tests/query/virtual-row-fields-oracle.test.ts
+++ b/packages/db/tests/query/virtual-row-fields-oracle.test.ts
@@ -41,7 +41,12 @@ import {
 } from '../../src/query/index.js'
 import { createCollection } from '../../src/collection/index.js'
 import { hasVirtualProps } from '../../src/virtual-props.js'
+import { declareOracle } from '../oracle-declaration.js'
 import { mockSyncCollectionOptions } from '../utils.js'
+import {
+  checkWithCleanup,
+  virtualFieldNames,
+} from './virtual-row-fields-support.js'
 
 type Profile = { label: string }
 
@@ -61,173 +66,41 @@ type VirtualFieldSubject =
   | `nested-value`
   | `opaque-value`
 
-const virtualFieldNames = [
-  `$key`,
-  `$hasPendingWrites`,
-  `$synced`,
-  `$origin`,
-  `$collectionId`,
-] as const
-
 // Only row roots and unprojected whole-row children carry virtual row fields.
 function expectsVirtualFields(subject: VirtualFieldSubject): boolean {
   return subject === `row-root` || subject === `whole-row-child`
 }
 
-function assertPublishedRootFields(row: unknown, name: string): void {
-  for (const field of virtualFieldNames) {
-    if (!(field in Object(row))) {
-      throw new Error(`${name} root must expose ${field}`)
+// Each observed value publishes the virtual row fields exactly when the model
+// classifies its subject as a row, so a missing or leaked field fails at the
+// observation that shows it.
+function expectPublishedFieldClassification(
+  observations: Array<{
+    name: string
+    subject: VirtualFieldSubject
+    value: unknown
+  }>,
+): void {
+  for (const observation of observations) {
+    const expectsFields = expectsVirtualFields(observation.subject)
+    expect(hasVirtualProps(observation.value), observation.name).toBe(
+      expectsFields,
+    )
+    for (const field of virtualFieldNames) {
+      expect(
+        field in Object(observation.value),
+        `${observation.name} ${expectsFields ? `must expose` : `must not expose`} ${field}`,
+      ).toBe(expectsFields)
     }
   }
-  expect(hasVirtualProps(row), `${name} root classification`).toBe(true)
 }
 
-async function checkWithCleanup(
-  check: () => Promise<void>,
-  cleanups: ReadonlyArray<() => Promise<void>>,
-): Promise<void> {
-  let primaryFailure: unknown
-  let checkFailed = false
-  try {
-    await check()
-  } catch (error) {
-    primaryFailure = error
-    checkFailed = true
-  }
-
-  const cleanupFailures: Array<unknown> = []
-  for (const cleanup of cleanups) {
-    try {
-      await cleanup()
-    } catch (error) {
-      cleanupFailures.push(error)
-    }
-  }
-
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(
-      cleanupFailures,
-      `Virtual row oracle check and cleanup failed`,
-      {
-        cause: primaryFailure,
-      },
-    )
-  }
-  if (checkFailed) throw primaryFailure
-}
+declareOracle({
+  check: [expectPublishedFieldClassification],
+  model: [expectsVirtualFields],
+})
 
 describe(`virtual row field runtime boundary`, () => {
-  test(`publishes every virtual field on implicit, expression, and functional root shapes`, async () => {
-    const rows = createCollection(
-      mockSyncCollectionOptions<Row>({
-        id: `virtual-row-fields-root-shapes-source`,
-        getKey: (row) => row.id,
-        initialData: [
-          {
-            id: `row-1`,
-            profile: { label: `nested` },
-            createdAt: new Date(`2026-09-20T12:34:56.000Z`),
-            tags: [`one`],
-          },
-        ],
-      }),
-    )
-    const implicit = createLiveQueryCollection((q) => q.from({ row: rows }))
-    const expression = createLiveQueryCollection((q) =>
-      q.from({ row: rows }).select(({ row }) => ({
-        id: row.id,
-        label: row.profile.label,
-      })),
-    )
-    const functional = createLiveQueryCollection((q) =>
-      q.from({ row: rows }).fn.select(({ row }) => ({
-        id: row.id,
-        label: row.profile.label,
-      })),
-    )
-
-    await checkWithCleanup(async () => {
-      await Promise.all([
-        implicit.preload(),
-        expression.preload(),
-        functional.preload(),
-      ])
-
-      const observed = [
-        { name: `implicit`, row: implicit.toArray[0] },
-        { name: `expression`, row: expression.toArray[0] },
-        { name: `functional`, row: functional.toArray[0] },
-      ]
-      for (const { name, row } of observed) {
-        expect(row, `${name} root must publish`).toBeDefined()
-        assertPublishedRootFields(row, name)
-        expect(row!.$hasPendingWrites, `${name} has no pending write`).toBe(
-          false,
-        )
-        expect(row!.$hasPendingWrites, `${name} legacy inverse`).toBe(
-          !row!.$synced,
-        )
-      }
-
-      expect(implicit.toArray[0]?.id).toBe(`row-1`)
-      expect(expression.toArray[0]).toMatchObject({
-        id: `row-1`,
-        label: `nested`,
-      })
-      expect(functional.toArray[0]).toMatchObject({
-        id: `row-1`,
-        label: `nested`,
-      })
-
-      // Wrong rule: functional projection outputs are treated as ordinary
-      // values and never receive root fields. The direct field check above
-      // rejects this observation at the same post-preload checkpoint.
-      const wrongFunctionalRoot = Object.fromEntries(
-        Object.entries(functional.toArray[0]!).filter(
-          ([field]) => field !== `$collectionId`,
-        ),
-      )
-      expect(() =>
-        assertPublishedRootFields(wrongFunctionalRoot, `functional`),
-      ).toThrow(`functional root must expose $collectionId`)
-    }, [
-      () => functional.cleanup(),
-      () => expression.cleanup(),
-      () => implicit.cleanup(),
-      () => rows.cleanup(),
-    ])
-  })
-
-  test(`keeps the primary mismatch and attempts every cleanup`, async () => {
-    const mismatch = new Error(`published row mismatch`)
-    const firstCleanupError = new Error(`first cleanup failed`)
-    const lastCleanupError = new Error(`last cleanup failed`)
-    const attempted: Array<string> = []
-
-    await expect(
-      checkWithCleanup(async () => {
-        throw mismatch
-      }, [
-        async () => {
-          attempted.push(`first`)
-          throw firstCleanupError
-        },
-        async () => {
-          attempted.push(`middle`)
-        },
-        async () => {
-          attempted.push(`last`)
-          throw lastCleanupError
-        },
-      ]),
-    ).rejects.toMatchObject({
-      cause: mismatch,
-      errors: [firstCleanupError, lastCleanupError],
-    })
-    expect(attempted).toEqual([`first`, `middle`, `last`])
-  })
-
   test(`matches the row and value classification after publication`, async () => {
     const createdAt = new Date(`2026-09-20T12:34:56.000Z`)
     const rows = createCollection(
@@ -384,19 +257,7 @@ describe(`virtual row field runtime boundary`, () => {
         },
       ]
 
-      for (const observation of observations) {
-        const expectsFields = expectsVirtualFields(observation.subject)
-        expect(hasVirtualProps(observation.value), observation.name).toBe(
-          expectsFields,
-        )
-        for (const field of virtualFieldNames) {
-          expect(
-            field in Object(observation.value),
-            `${observation.name} ${expectsFields ? `must expose` : `must not expose`} ${field}`,
-          ).toBe(expectsFields)
-        }
-      }
-
+      expectPublishedFieldClassification(observations)
       expect(result.$key).toBe(`row-1`)
       expect(result.$hasPendingWrites).toBe(!result.$synced)
       expect(result.wholeRows[0]!.$hasPendingWrites).toBe(
diff --git a/packages/db/tests/query/virtual-row-fields-support.ts b/packages/db/tests/query/virtual-row-fields-support.ts
new file mode 100644
index 0000000000..c9d55557d3
--- /dev/null
+++ b/packages/db/tests/query/virtual-row-fields-support.ts
@@ -0,0 +1,44 @@
+// Shared cleanup harness for the virtual row field tests. It runs a check,
+// then every cleanup, and reports the check's failure as the cause.
+export async function checkWithCleanup(
+  check: () => Promise<void>,
+  cleanups: ReadonlyArray<() => Promise<void>>,
+): Promise<void> {
+  let primaryFailure: unknown
+  let checkFailed = false
+  try {
+    await check()
+  } catch (error) {
+    primaryFailure = error
+    checkFailed = true
+  }
+
+  const cleanupFailures: Array<unknown> = []
+  for (const cleanup of cleanups) {
+    try {
+      await cleanup()
+    } catch (error) {
+      cleanupFailures.push(error)
+    }
+  }
+
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(
+      cleanupFailures,
+      `Virtual row oracle check and cleanup failed`,
+      {
+        cause: primaryFailure,
+      },
+    )
+  }
+  if (checkFailed) throw primaryFailure
+}
+
+// The virtual row fields that every published row root carries.
+export const virtualFieldNames = [
+  `$key`,
+  `$hasPendingWrites`,
+  `$synced`,
+  `$origin`,
+  `$collectionId`,
+] as const
diff --git a/packages/db/tests/query/virtual-row-fields-type-fixture.ts b/packages/db/tests/query/virtual-row-fields-type-fixture.ts
new file mode 100644
index 0000000000..7fc4dfba02
--- /dev/null
+++ b/packages/db/tests/query/virtual-row-fields-type-fixture.ts
@@ -0,0 +1,21 @@
+// The row fixture that the virtual row field type tests share.
+import { createCollection } from '../../src/collection/index.js'
+import { mockSyncCollectionOptions } from '../utils.js'
+
+export type Profile = { label: string }
+export type Row = {
+  id: string
+  profile: Profile
+  optionalProfile?: Profile
+  nullableProfile: Profile | null
+  createdAt: Date
+  tags: Array<string>
+}
+
+export const rows = createCollection(
+  mockSyncCollectionOptions<Row>({
+    id: `virtual-row-fields-type-oracle`,
+    getKey: (row) => row.id,
+    initialData: [],
+  }),
+)
diff --git a/packages/db/tests/query/virtual-row-fields.test-d.ts b/packages/db/tests/query/virtual-row-fields.test-d.ts
new file mode 100644
index 0000000000..4ba538c822
--- /dev/null
+++ b/packages/db/tests/query/virtual-row-fields.test-d.ts
@@ -0,0 +1,43 @@
+// Ordinary type test for virtual row fields: opaque scalar child results,
+// compared with written types. The row and value classification law is owned
+// by virtual-row-fields-oracle.test-d.ts.
+import { describe, expectTypeOf, test } from 'vitest'
+import {
+  createLiveQueryCollection,
+  eq,
+  materialize,
+  toArray,
+} from '../../src/query/index.js'
+import { rows } from './virtual-row-fields-type-fixture.js'
+
+describe(`virtual row field type boundary`, () => {
+  test(`opaque scalar child results do not gain virtual row fields`, () => {
+    const collection = createLiveQueryCollection((q) =>
+      q.from({ row: rows }).select(({ row }) => ({
+        id: row.id,
+        dates: toArray(
+          q
+            .from({ child: rows })
+            .where(({ child }) => eq(child.id, row.id))
+            .select(({ child }) => child.createdAt),
+        ),
+        firstDate: materialize(
+          q
+            .from({ child: rows })
+            .where(({ child }) => eq(child.id, row.id))
+            .select(({ child }) => child.createdAt)
+            .findOne(),
+        ),
+      })),
+    )
+
+    const result = collection.toArray[0]!
+    expectTypeOf(result.dates[0]!).toEqualTypeOf<Date>()
+    expectTypeOf(result.firstDate).toEqualTypeOf<Date | undefined>()
+
+    // @ts-expect-error Date values are not rows and have no virtual row fields.
+    result.dates[0]!.$key
+    // @ts-expect-error Materialized Date values are not rows either.
+    result.firstDate?.$synced
+  })
+})
diff --git a/packages/db/tests/query/virtual-row-fields.test.ts b/packages/db/tests/query/virtual-row-fields.test.ts
new file mode 100644
index 0000000000..dd0d7ce80a
--- /dev/null
+++ b/packages/db/tests/query/virtual-row-fields.test.ts
@@ -0,0 +1,143 @@
+// Ordinary tests for virtual row fields: a fixed root-shape scenario compared
+// with written values, and a harness self-test for checkWithCleanup. The
+// published-row classification law is owned by virtual-row-fields-oracle.test.ts.
+import { describe, expect, test } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { createLiveQueryCollection } from '../../src/query/index.js'
+import { hasVirtualProps } from '../../src/virtual-props.js'
+import { mockSyncCollectionOptions } from '../utils.js'
+import {
+  checkWithCleanup,
+  virtualFieldNames,
+} from './virtual-row-fields-support.js'
+
+type Profile = { label: string }
+
+type Row = {
+  id: string
+  profile: Profile
+  optionalProfile?: Profile
+  createdAt: Date
+  tags: Array<string>
+}
+
+function assertPublishedRootFields(row: unknown, name: string): void {
+  for (const field of virtualFieldNames) {
+    if (!(field in Object(row))) {
+      throw new Error(`${name} root must expose ${field}`)
+    }
+  }
+  expect(hasVirtualProps(row), `${name} root classification`).toBe(true)
+}
+
+describe(`virtual row field runtime boundary`, () => {
+  test(`publishes every virtual field on implicit, expression, and functional root shapes`, async () => {
+    const rows = createCollection(
+      mockSyncCollectionOptions<Row>({
+        id: `virtual-row-fields-root-shapes-source`,
+        getKey: (row) => row.id,
+        initialData: [
+          {
+            id: `row-1`,
+            profile: { label: `nested` },
+            createdAt: new Date(`2026-09-20T12:34:56.000Z`),
+            tags: [`one`],
+          },
+        ],
+      }),
+    )
+    const implicit = createLiveQueryCollection((q) => q.from({ row: rows }))
+    const expression = createLiveQueryCollection((q) =>
+      q.from({ row: rows }).select(({ row }) => ({
+        id: row.id,
+        label: row.profile.label,
+      })),
+    )
+    const functional = createLiveQueryCollection((q) =>
+      q.from({ row: rows }).fn.select(({ row }) => ({
+        id: row.id,
+        label: row.profile.label,
+      })),
+    )
+
+    await checkWithCleanup(async () => {
+      await Promise.all([
+        implicit.preload(),
+        expression.preload(),
+        functional.preload(),
+      ])
+
+      const observed = [
+        { name: `implicit`, row: implicit.toArray[0] },
+        { name: `expression`, row: expression.toArray[0] },
+        { name: `functional`, row: functional.toArray[0] },
+      ]
+      for (const { name, row } of observed) {
+        expect(row, `${name} root must publish`).toBeDefined()
+        assertPublishedRootFields(row, name)
+        expect(row!.$hasPendingWrites, `${name} has no pending write`).toBe(
+          false,
+        )
+        expect(row!.$hasPendingWrites, `${name} legacy inverse`).toBe(
+          !row!.$synced,
+        )
+      }
+
+      expect(implicit.toArray[0]?.id).toBe(`row-1`)
+      expect(expression.toArray[0]).toMatchObject({
+        id: `row-1`,
+        label: `nested`,
+      })
+      expect(functional.toArray[0]).toMatchObject({
+        id: `row-1`,
+        label: `nested`,
+      })
+
+      // Wrong rule: functional projection outputs are treated as ordinary
+      // values and never receive root fields. The direct field check above
+      // rejects this observation at the same post-preload checkpoint.
+      const wrongFunctionalRoot = Object.fromEntries(
+        Object.entries(functional.toArray[0]!).filter(
+          ([field]) => field !== `$collectionId`,
+        ),
+      )
+      expect(() =>
+        assertPublishedRootFields(wrongFunctionalRoot, `functional`),
+      ).toThrow(`functional root must expose $collectionId`)
+    }, [
+      () => functional.cleanup(),
+      () => expression.cleanup(),
+      () => implicit.cleanup(),
+      () => rows.cleanup(),
+    ])
+  })
+
+  test(`keeps the primary mismatch and attempts every cleanup`, async () => {
+    const mismatch = new Error(`published row mismatch`)
+    const firstCleanupError = new Error(`first cleanup failed`)
+    const lastCleanupError = new Error(`last cleanup failed`)
+    const attempted: Array<string> = []
+
+    await expect(
+      checkWithCleanup(async () => {
+        throw mismatch
+      }, [
+        async () => {
+          attempted.push(`first`)
+          throw firstCleanupError
+        },
+        async () => {
+          attempted.push(`middle`)
+        },
+        async () => {
+          attempted.push(`last`)
+          throw lastCleanupError
+        },
+      ]),
+    ).rejects.toMatchObject({
+      cause: mismatch,
+      errors: [firstCleanupError, lastCleanupError],
+    })
+    expect(attempted).toEqual([`first`, `middle`, `last`])
+  })
+})
diff --git a/packages/db/tests/query/where-predicate-publication-oracle.property.test.ts b/packages/db/tests/query/where-predicate-publication-oracle.property.test.ts
index e1740dd552..b92f8d870d 100644
--- a/packages/db/tests/query/where-predicate-publication-oracle.property.test.ts
+++ b/packages/db/tests/query/where-predicate-publication-oracle.property.test.ts
@@ -58,12 +58,11 @@
  *
  * Refinement check: each consumer's exact key set equals the model after the
  * subscribers attach and after each sync transaction commits. Direct
- * subscribers are reconstructed from their callback batches. Two fixed
- * witnesses check boundaries outside the generated grammar: Collection
- * readiness reaches a filtered subscriber as one empty batch, and an eager
- * source restarted after cleanup retracts a vanished row even when its first
- * batch cannot satisfy the predicate. A third witness checks that a same-key
- * update which stays TRUE publishes its new row and exact subscriber payload.
+ * subscribers are reconstructed from their callback batches. Fixed witnesses
+ * for boundaries outside the generated grammar (Collection readiness, a
+ * same-key update that stays TRUE, a pending optimistic delete, a layout-only
+ * publication, and a restarted source) compare with written values, so they
+ * are unit tests in where-predicate-publication.test.ts.
  *
  * Calibration: pinned histories separate Kleene from two-valued logic, and a
  * checker test requires the two-valued answer to fail. Hostile production
@@ -88,7 +87,6 @@ import { describe, expect, it } from 'vitest'
 import { createCollection } from '../../src/collection/index.js'
 import { BasicIndex } from '../../src/indexes/basic-index.js'
 import { and, eq, not, or } from '../../src/query/builder/functions.js'
-import { Func, PropRef, Value } from '../../src/query/ir.js'
 import { createLiveQueryCollection } from '../../src/query/index.js'
 import {
   oraclePropertyOptions,
@@ -96,25 +94,30 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../oracle-config.js'
+import { declareOracle } from '../oracle-declaration.js'
+import { mockSyncCollectionOptions, withOracleCleanup } from '../utils.js'
 import {
-  mockSyncCollectionOptions,
-  mockSyncCollectionOptionsNoInitialState,
-  withOracleCleanup,
-} from '../utils.js'
+  MISSING,
+  fieldEq,
+  irPredicate,
+  recordVisibleKeys,
+} from './where-predicate-support.js'
+import type {
+  FieldValue,
+  Operand,
+  Predicate,
+  Row,
+} from './where-predicate-support.js'
 import type { BasicExpression } from '../../src/query/ir.js'
-import type { ChangeMessage } from '../../src/types.js'
 
 const property = `where-predicate.publication`
 
 // A string whose content equals an internal normalized-key prefix must still
 // compare as an ordinary string.
 const PREFIXED = `\u0000tanstack-db:string:a`
-const MISSING = Symbol(`missing field`)
 // A valid Date equals the number of its timestamp.
 const DATE_ONE = new Date(1)
 
-type FieldValue = string | boolean | number | Date | null | typeof MISSING
-type Row = { id: string; v?: unknown }
 type Truth = boolean | null
 
 const fieldValues: ReadonlyArray<FieldValue> = [
@@ -140,16 +143,6 @@ const literalValues: ReadonlyArray<FieldValue> = [
   null,
 ]
 
-type Operand =
-  | { kind: `field` }
-  | { kind: `literal`; value: FieldValue }
-  | { kind: `virtual`; name: `$synced` | `$origin` | `$key` }
-
-type Predicate =
-  | { kind: `eq`; left: Operand; right: Operand }
-  | { kind: `not`; arg: Predicate }
-  | { kind: `and` | `or`; args: [Predicate, Predicate] }
-
 type SeedRow = { v: FieldValue; optimistic: boolean }
 type Operation =
   | { type: `insert`; v: FieldValue; reuse?: number }
@@ -370,12 +363,6 @@ const historyArbitrary: fc.Arbitrary<History> = fc.oneof(
   },
 )
 
-const fieldEq = (value: FieldValue): Predicate => ({
-  kind: `eq`,
-  left: { kind: `field` },
-  right: { kind: `literal`, value },
-})
-
 // Kleene and two-valued logic disagree on each snapshot history. The first is
 // the negated nullish comparison that a FALSE-for-UNKNOWN fast path misses.
 const pinnedHistories: ReadonlyArray<History> = [
@@ -564,32 +551,6 @@ function builderPredicate(
   }
 }
 
-function irOperand(operand: Operand): BasicExpression {
-  switch (operand.kind) {
-    case `field`:
-      return new PropRef([`v`])
-    case `literal`:
-      return new Value(operand.value === MISSING ? undefined : operand.value)
-    case `virtual`:
-      return new PropRef([operand.name])
-  }
-}
-
-function irPredicate(predicate: Predicate): BasicExpression<boolean> {
-  switch (predicate.kind) {
-    case `eq`:
-      return new Func(`eq`, [
-        irOperand(predicate.left),
-        irOperand(predicate.right),
-      ])
-    case `not`:
-      return new Func(`not`, [irPredicate(predicate.arg)])
-    case `and`:
-    case `or`:
-      return new Func(predicate.kind, predicate.args.map(irPredicate))
-  }
-}
-
 function sourceRow(id: string, v: FieldValue): Row {
   return v === MISSING ? { id } : { id, v }
 }
@@ -618,16 +579,6 @@ type Observation = {
   keys: Array<string>
 }
 
-// Rebuild a subscriber's visible key set from its callback batches.
-function recordVisibleKeys(visible: Set<string | number>) {
-  return (changes: Array<ChangeMessage<Row>>) => {
-    for (const change of changes) {
-      if (change.type === `delete`) visible.delete(change.key)
-      else visible.add(change.key)
-    }
-  }
-}
-
 let collectionSerial = 0
 
 async function observeHistory(
@@ -833,6 +784,18 @@ async function runHistory(history: History): Promise<void> {
   }
 }
 
+// The check is `runHistory`: it runs each generated history with and without a
+// BasicIndex, and compares every consumer's observed key set with the model's
+// keys after each checkpoint. The model is `expectedTruth`, the Kleene
+// evaluator, and `expectedVisible`, which adds the touched-row rule for a
+// subscriber without initial state. The pinned calibration and the generated
+// properties reach them; the witness tests in where-predicate-publication.test.ts
+// do not.
+declareOracle({
+  check: [runHistory],
+  model: [expectedTruth, expectedVisible],
+})
+
 function describeValue(value: FieldValue): string {
   if (value === MISSING) return `<missing>`
   if (typeof value === `string`) return JSON.stringify(value)
@@ -907,205 +870,6 @@ describe(`WHERE predicate publication oracle`, () => {
       }
     })
 
-    it(`Collection readiness reaches a filtered subscriber as one empty batch`, async () => {
-      // `markReady` notifies subscribers of Collection readiness with an
-      // empty batch. A subscriber
-      // whose predicate no row can satisfy must still receive it.
-      const collection = createCollection(
-        mockSyncCollectionOptionsNoInitialState<Row>({
-          id: `where-publication-ready-${collectionSerial++}`,
-          getKey: (row) => row.id,
-        }),
-      )
-      const batches: Array<number> = []
-      const subscription = collection.subscribeChanges(
-        (changes) => batches.push(changes.length),
-        { whereExpression: irPredicate(fieldEq(`a`)) },
-      )
-      await withOracleCleanup(() => {
-        collection.utils.begin()
-        collection.utils.commit()
-        collection.utils.markReady()
-        expect(batches).toEqual([0])
-      }, [() => subscription.unsubscribe(), () => collection.cleanup()])
-    })
-
-    it(`publishes the new payload for a same-key update that stays TRUE`, async () => {
-      type PayloadRow = { id: string; v: string; n: number }
-      const collection = createCollection(
-        mockSyncCollectionOptions<PayloadRow>({
-          id: `where-publication-payload-${collectionSerial++}`,
-          getKey: (row) => row.id,
-          initialData: [{ id: `r0`, v: `a`, n: 1 }],
-        }),
-      )
-      const live = createLiveQueryCollection((q) =>
-        q.from({ row: collection }).where(({ row }) => eq(row.v, `a`)),
-      )
-      const events: Array<{
-        type: string
-        key: string | number
-        n: number
-        previousN: number | undefined
-      }> = []
-      await collection.stateWhenReady()
-      await live.preload()
-      const subscription = collection.subscribeChanges(
-        (changes) => {
-          for (const change of changes) {
-            events.push({
-              type: change.type,
-              key: change.key,
-              n: change.value.n,
-              previousN: change.previousValue?.n,
-            })
-          }
-        },
-        {
-          includeInitialState: true,
-          whereExpression: irPredicate(fieldEq(`a`)),
-        },
-      )
-      await withOracleCleanup(() => {
-        events.length = 0
-        expect(live.get(`r0`)?.n).toBe(1)
-        collection.utils.begin()
-        collection.utils.write({
-          type: `update`,
-          value: { id: `r0`, v: `a`, n: 2 },
-        })
-        collection.utils.commit()
-        expect(live.get(`r0`)?.n).toBe(2)
-        expect(events).toEqual([
-          { type: `update`, key: `r0`, n: 2, previousN: 1 },
-        ])
-      }, [
-        () => subscription.unsubscribe(),
-        () => live.cleanup(),
-        () => collection.cleanup(),
-      ])
-    })
-
-    it(`a pending optimistic delete hides a row from a prefiltered unindexed scan`, async () => {
-      // The scan may read synced rows directly only when no optimistic state
-      // changes visibility. A pending delete removes a synced row.
-      const collection = createCollection(
-        mockSyncCollectionOptions<Row>({
-          id: `where-publication-optimistic-delete-${collectionSerial++}`,
-          getKey: (row) => row.id,
-          initialData: [
-            { id: `r0`, v: `a` },
-            { id: `r1`, v: `a` },
-            { id: `r2`, v: `b` },
-          ],
-        }),
-      )
-      const visible = new Set<string | number>()
-      let subscription: { unsubscribe: () => void } | undefined
-      await withOracleCleanup(async () => {
-        await collection.stateWhenReady()
-        // The adapter's onDelete awaits a sync acknowledgement that this test
-        // never sends, so the delete stays pending.
-        collection.delete(`r1`)
-        subscription = collection.subscribeChanges(recordVisibleKeys(visible), {
-          includeInitialState: true,
-          whereExpression: irPredicate(fieldEq(`a`)),
-        })
-        const snapshot = collection.currentStateAsChanges({
-          where: irPredicate(fieldEq(`a`)),
-        })
-        expect(snapshot?.map((change) => change.key)).toEqual([`r0`])
-        expect([...visible]).toEqual([`r0`])
-      }, [() => subscription?.unsubscribe(), () => collection.cleanup()])
-    })
-
-    it(`a layout-only publication reaches a filtered subscriber as one empty batch`, async () => {
-      // An ordered live query whose rows move without changing their selected
-      // values publishes no rows, only a layout change. Every subscriber still
-      // learns that the layout changed, whatever its predicate.
-      type RankedRow = { id: string; rank: number }
-      const source = createCollection(
-        mockSyncCollectionOptions<RankedRow>({
-          id: `where-publication-layout-${collectionSerial++}`,
-          getKey: (row) => row.id,
-          initialData: [
-            { id: `r0`, rank: 1 },
-            { id: `r1`, rank: 2 },
-          ],
-        }),
-      )
-      const live = createLiveQueryCollection((q) =>
-        q
-          .from({ row: source })
-          .orderBy(({ row }) => row.rank)
-          .select(({ row }) => ({ id: row.id })),
-      )
-      const batches: Array<number> = []
-      let subscription: { unsubscribe: () => void } | undefined
-      await withOracleCleanup(async () => {
-        await live.preload()
-        subscription = live.subscribeChanges(
-          (changes) => batches.push(changes.length),
-          {
-            whereExpression: new Func(`eq`, [
-              new PropRef([`id`]),
-              new Value(`missing`),
-            ]),
-          },
-        )
-        source.utils.begin()
-        source.utils.write({ type: `update`, value: { id: `r0`, rank: 3 } })
-        source.utils.commit()
-        expect([...live.keys()]).toEqual([`r1`, `r0`])
-        expect(batches).toEqual([0])
-      }, [
-        () => subscription?.unsubscribe(),
-        () => live.cleanup(),
-        () => source.cleanup(),
-      ])
-    })
-
-    it(`a restarted source retracts a vanished row even when its first batch cannot match`, async () => {
-      // Cleanup keeps the subscriber's published rows. The restarted eager
-      // source's first publication must retract rows it no longer holds,
-      // although no change in that batch satisfies the predicate. The check
-      // runs before ready, whose empty batch would also reconcile them.
-      let sourceRows: Array<Row> = [{ id: `r0`, v: `a` }]
-      let markSourceReady = () => {}
-      const collection = createCollection<Row>({
-        id: `where-publication-restart-${collectionSerial++}`,
-        getKey: (row) => row.id,
-        startSync: true,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            begin()
-            for (const row of sourceRows) write({ type: `insert`, value: row })
-            commit()
-            markSourceReady = markReady
-          },
-        },
-      })
-      const visible = new Set<string | number>()
-      markSourceReady()
-      await collection.stateWhenReady()
-      const subscription = collection.subscribeChanges(
-        recordVisibleKeys(visible),
-        {
-          includeInitialState: true,
-          whereExpression: irPredicate(fieldEq(`a`)),
-        },
-      )
-      await withOracleCleanup(async () => {
-        expect([...visible]).toEqual([`r0`])
-        sourceRows = [{ id: `r1`, v: `b` }]
-        await collection.cleanup()
-        collection.startSyncImmediate()
-        expect([...visible]).toEqual([])
-        markSourceReady()
-        expect([...visible]).toEqual([])
-      }, [() => subscription.unsubscribe(), () => collection.cleanup()])
-    })
-
     for (const history of [
       ...pinnedHistories,
       pinnedPrefilteredSnapshot,
diff --git a/packages/db/tests/query/where-predicate-publication.test.ts b/packages/db/tests/query/where-predicate-publication.test.ts
new file mode 100644
index 0000000000..2e8225c28c
--- /dev/null
+++ b/packages/db/tests/query/where-predicate-publication.test.ts
@@ -0,0 +1,228 @@
+// Unit tests for the WHERE publication path with fixed witnesses: an empty
+// readiness batch, a same-key update that stays TRUE, a pending optimistic
+// delete, a layout-only publication, and a restarted source. Each compares
+// production with written values, not with a model. The law and its oracle
+// owner are in where-predicate-publication-oracle.property.test.ts; the shared
+// predicate builders are in where-predicate-support.ts.
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../../src/collection/index.js'
+import { eq } from '../../src/query/builder/functions.js'
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import { createLiveQueryCollection } from '../../src/query/index.js'
+import { oracleReplayRequested } from '../oracle-config.js'
+import {
+  mockSyncCollectionOptions,
+  mockSyncCollectionOptionsNoInitialState,
+  withOracleCleanup,
+} from '../utils.js'
+import {
+  fieldEq,
+  irPredicate,
+  recordVisibleKeys,
+} from './where-predicate-support.js'
+import type { Row } from './where-predicate-support.js'
+
+let collectionSerial = 0
+
+describe(`WHERE predicate publication oracle`, () => {
+  if (!oracleReplayRequested()) {
+    it(`Collection readiness reaches a filtered subscriber as one empty batch`, async () => {
+      // `markReady` notifies subscribers of Collection readiness with an
+      // empty batch. A subscriber
+      // whose predicate no row can satisfy must still receive it.
+      const collection = createCollection(
+        mockSyncCollectionOptionsNoInitialState<Row>({
+          id: `where-publication-ready-${collectionSerial++}`,
+          getKey: (row) => row.id,
+        }),
+      )
+      const batches: Array<number> = []
+      const subscription = collection.subscribeChanges(
+        (changes) => batches.push(changes.length),
+        { whereExpression: irPredicate(fieldEq(`a`)) },
+      )
+      await withOracleCleanup(() => {
+        collection.utils.begin()
+        collection.utils.commit()
+        collection.utils.markReady()
+        expect(batches).toEqual([0])
+      }, [() => subscription.unsubscribe(), () => collection.cleanup()])
+    })
+
+    it(`publishes the new payload for a same-key update that stays TRUE`, async () => {
+      type PayloadRow = { id: string; v: string; n: number }
+      const collection = createCollection(
+        mockSyncCollectionOptions<PayloadRow>({
+          id: `where-publication-payload-${collectionSerial++}`,
+          getKey: (row) => row.id,
+          initialData: [{ id: `r0`, v: `a`, n: 1 }],
+        }),
+      )
+      const live = createLiveQueryCollection((q) =>
+        q.from({ row: collection }).where(({ row }) => eq(row.v, `a`)),
+      )
+      const events: Array<{
+        type: string
+        key: string | number
+        n: number
+        previousN: number | undefined
+      }> = []
+      await collection.stateWhenReady()
+      await live.preload()
+      const subscription = collection.subscribeChanges(
+        (changes) => {
+          for (const change of changes) {
+            events.push({
+              type: change.type,
+              key: change.key,
+              n: change.value.n,
+              previousN: change.previousValue?.n,
+            })
+          }
+        },
+        {
+          includeInitialState: true,
+          whereExpression: irPredicate(fieldEq(`a`)),
+        },
+      )
+      await withOracleCleanup(() => {
+        events.length = 0
+        expect(live.get(`r0`)?.n).toBe(1)
+        collection.utils.begin()
+        collection.utils.write({
+          type: `update`,
+          value: { id: `r0`, v: `a`, n: 2 },
+        })
+        collection.utils.commit()
+        expect(live.get(`r0`)?.n).toBe(2)
+        expect(events).toEqual([
+          { type: `update`, key: `r0`, n: 2, previousN: 1 },
+        ])
+      }, [
+        () => subscription.unsubscribe(),
+        () => live.cleanup(),
+        () => collection.cleanup(),
+      ])
+    })
+
+    it(`a pending optimistic delete hides a row from a prefiltered unindexed scan`, async () => {
+      // The scan may read synced rows directly only when no optimistic state
+      // changes visibility. A pending delete removes a synced row.
+      const collection = createCollection(
+        mockSyncCollectionOptions<Row>({
+          id: `where-publication-optimistic-delete-${collectionSerial++}`,
+          getKey: (row) => row.id,
+          initialData: [
+            { id: `r0`, v: `a` },
+            { id: `r1`, v: `a` },
+            { id: `r2`, v: `b` },
+          ],
+        }),
+      )
+      const visible = new Set<string | number>()
+      let subscription: { unsubscribe: () => void } | undefined
+      await withOracleCleanup(async () => {
+        await collection.stateWhenReady()
+        // The adapter's onDelete awaits a sync acknowledgement that this test
+        // never sends, so the delete stays pending.
+        collection.delete(`r1`)
+        subscription = collection.subscribeChanges(recordVisibleKeys(visible), {
+          includeInitialState: true,
+          whereExpression: irPredicate(fieldEq(`a`)),
+        })
+        const snapshot = collection.currentStateAsChanges({
+          where: irPredicate(fieldEq(`a`)),
+        })
+        expect(snapshot?.map((change) => change.key)).toEqual([`r0`])
+        expect([...visible]).toEqual([`r0`])
+      }, [() => subscription?.unsubscribe(), () => collection.cleanup()])
+    })
+
+    it(`a layout-only publication reaches a filtered subscriber as one empty batch`, async () => {
+      // An ordered live query whose rows move without changing their selected
+      // values publishes no rows, only a layout change. Every subscriber still
+      // learns that the layout changed, whatever its predicate.
+      type RankedRow = { id: string; rank: number }
+      const source = createCollection(
+        mockSyncCollectionOptions<RankedRow>({
+          id: `where-publication-layout-${collectionSerial++}`,
+          getKey: (row) => row.id,
+          initialData: [
+            { id: `r0`, rank: 1 },
+            { id: `r1`, rank: 2 },
+          ],
+        }),
+      )
+      const live = createLiveQueryCollection((q) =>
+        q
+          .from({ row: source })
+          .orderBy(({ row }) => row.rank)
+          .select(({ row }) => ({ id: row.id })),
+      )
+      const batches: Array<number> = []
+      let subscription: { unsubscribe: () => void } | undefined
+      await withOracleCleanup(async () => {
+        await live.preload()
+        subscription = live.subscribeChanges(
+          (changes) => batches.push(changes.length),
+          {
+            whereExpression: new Func(`eq`, [
+              new PropRef([`id`]),
+              new Value(`missing`),
+            ]),
+          },
+        )
+        source.utils.begin()
+        source.utils.write({ type: `update`, value: { id: `r0`, rank: 3 } })
+        source.utils.commit()
+        expect([...live.keys()]).toEqual([`r1`, `r0`])
+        expect(batches).toEqual([0])
+      }, [
+        () => subscription?.unsubscribe(),
+        () => live.cleanup(),
+        () => source.cleanup(),
+      ])
+    })
+
+    it(`a restarted source retracts a vanished row even when its first batch cannot match`, async () => {
+      // Cleanup keeps the subscriber's published rows. The restarted eager
+      // source's first publication must retract rows it no longer holds,
+      // although no change in that batch satisfies the predicate. The check
+      // runs before ready, whose empty batch would also reconcile them.
+      let sourceRows: Array<Row> = [{ id: `r0`, v: `a` }]
+      let markSourceReady = () => {}
+      const collection = createCollection<Row>({
+        id: `where-publication-restart-${collectionSerial++}`,
+        getKey: (row) => row.id,
+        startSync: true,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            begin()
+            for (const row of sourceRows) write({ type: `insert`, value: row })
+            commit()
+            markSourceReady = markReady
+          },
+        },
+      })
+      const visible = new Set<string | number>()
+      markSourceReady()
+      await collection.stateWhenReady()
+      const subscription = collection.subscribeChanges(
+        recordVisibleKeys(visible),
+        {
+          includeInitialState: true,
+          whereExpression: irPredicate(fieldEq(`a`)),
+        },
+      )
+      await withOracleCleanup(async () => {
+        expect([...visible]).toEqual([`r0`])
+        sourceRows = [{ id: `r1`, v: `b` }]
+        await collection.cleanup()
+        collection.startSyncImmediate()
+        expect([...visible]).toEqual([])
+        markSourceReady()
+        expect([...visible]).toEqual([])
+      }, [() => subscription.unsubscribe(), () => collection.cleanup()])
+    })
+  }
+})
diff --git a/packages/db/tests/query/where-predicate-support.ts b/packages/db/tests/query/where-predicate-support.ts
new file mode 100644
index 0000000000..33972d8791
--- /dev/null
+++ b/packages/db/tests/query/where-predicate-support.ts
@@ -0,0 +1,64 @@
+// Predicate builders shared by the WHERE publication oracle and its ordinary
+// witness tests. The oracle that owns the law is
+// where-predicate-publication-oracle.property.test.ts.
+import { Func, PropRef, Value } from '../../src/query/ir.js'
+import type { BasicExpression } from '../../src/query/ir.js'
+import type { ChangeMessage } from '../../src/types.js'
+
+export const MISSING = Symbol(`missing field`)
+
+export type FieldValue =
+  string | boolean | number | Date | null | typeof MISSING
+export type Row = { id: string; v?: unknown }
+
+export type Operand =
+  | { kind: `field` }
+  | { kind: `literal`; value: FieldValue }
+  | { kind: `virtual`; name: `$synced` | `$origin` | `$key` }
+
+export type Predicate =
+  | { kind: `eq`; left: Operand; right: Operand }
+  | { kind: `not`; arg: Predicate }
+  | { kind: `and` | `or`; args: [Predicate, Predicate] }
+
+export const fieldEq = (value: FieldValue): Predicate => ({
+  kind: `eq`,
+  left: { kind: `field` },
+  right: { kind: `literal`, value },
+})
+
+function irOperand(operand: Operand): BasicExpression {
+  switch (operand.kind) {
+    case `field`:
+      return new PropRef([`v`])
+    case `literal`:
+      return new Value(operand.value === MISSING ? undefined : operand.value)
+    case `virtual`:
+      return new PropRef([operand.name])
+  }
+}
+
+export function irPredicate(predicate: Predicate): BasicExpression<boolean> {
+  switch (predicate.kind) {
+    case `eq`:
+      return new Func(`eq`, [
+        irOperand(predicate.left),
+        irOperand(predicate.right),
+      ])
+    case `not`:
+      return new Func(`not`, [irPredicate(predicate.arg)])
+    case `and`:
+    case `or`:
+      return new Func(predicate.kind, predicate.args.map(irPredicate))
+  }
+}
+
+// Rebuild a subscriber's visible key set from its callback batches.
+export function recordVisibleKeys(visible: Set<string | number>) {
+  return (changes: Array<ChangeMessage<Row>>) => {
+    for (const change of changes) {
+      if (change.type === `delete`) visible.delete(change.key)
+      else visible.add(change.key)
+    }
+  }
+}
diff --git a/packages/db/tests/reference-expression-oracle.ts b/packages/db/tests/reference-expression-oracle.ts
index 839a7de33b..9f11c166e4 100644
--- a/packages/db/tests/reference-expression-oracle.ts
+++ b/packages/db/tests/reference-expression-oracle.ts
@@ -1,3 +1,4 @@
+import { declareOracle } from './oracle-declaration.js'
 import type { BasicExpression } from '../src/query/ir.js'
 
 function compareReferenceValues(left: unknown, right: unknown): number {
@@ -62,3 +63,5 @@ export function evaluateReferenceExpression(
       throw new Error(`unsupported reference expression: ${expression.name}`)
   }
 }
+
+declareOracle({ model: [evaluateReferenceExpression] })
diff --git a/packages/db/tests/reverse-index-oracle.property.test.ts b/packages/db/tests/reverse-index-oracle.property.test.ts
index e1b5e9d63c..e5873bc89a 100644
--- a/packages/db/tests/reverse-index-oracle.property.test.ts
+++ b/packages/db/tests/reverse-index-oracle.property.test.ts
@@ -1,13 +1,10 @@
 import { describe, expect, it } from 'vitest'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { createCollection } from '../src/collection/index.js'
-import { BasicIndex } from '../src/indexes/basic-index.js'
 import { BTreeIndex } from '../src/indexes/btree-index.js'
 import { ReverseIndex } from '../src/indexes/reverse-index.js'
-import { createLiveQueryCollection } from '../src/query/live-query-collection.js'
 import { PropRef } from '../src/query/ir.js'
 import { oracleRandomParameters, readOracleRunConfig } from './oracle-config.js'
-import type { IndexOperation } from '../src/indexes/base-index.js'
+import { declareOracle } from './oracle-declaration.js'
 
 /**
  * # Does a reversed index read in its query's order, in bounded work?
@@ -175,126 +172,9 @@ const readCase: fc.Arbitrary<ReadCase> = fc.record({
   rejected: fc.uniqueArray(fc.integer({ min: 0, max: 15 }), { maxLength: 6 }),
 })
 
-/** An order-capable index that advertises no equality lookup operation. */
-class RangeOnlyIndex<TKey extends string | number> extends BTreeIndex<TKey> {
-  public override readonly supportedOperations = new Set<IndexOperation>([
-    `gt`,
-    `gte`,
-    `lt`,
-    `lte`,
-  ])
-
-  override lookup(operation: IndexOperation, value: unknown): Set<TKey> {
-    if (!this.supportedOperations.has(operation)) {
-      throw new Error(`Unsupported operation: ${operation}`)
-    }
-    return super.lookup(operation, value)
-  }
-}
-
-describe(`legacy reversed index reads`, () => {
-  // An ascending index with nulls last over key 1 -> null, 2 -> 1, 3 -> 2.
-  it.each([BTreeIndex, BasicIndex] as const)(
-    `keeps plain reversal when no null placement is given (%o)`,
-    (IndexType) => {
-      const index = new IndexType<number>(
-        1,
-        new PropRef([`value`]),
-        undefined,
-        {
-          compareOptions: {
-            direction: `asc`,
-            nulls: `last`,
-            stringSort: `locale`,
-          },
-        },
-      )
-      for (const [key, value] of [
-        [1, null],
-        [2, 1],
-        [3, 2],
-      ] as const) {
-        index.add(key, { value })
-      }
-      const reader = new ReverseIndex(index)
-      expect(reader.takeFromStart(3)).toEqual([1, 3, 2])
-      expect(reader.take(3, null)).toEqual([3, 2])
-    },
-  )
-})
-
-describe(`reversed reads through a range-only index`, () => {
-  it.each([`first`, `last`] as const)(
-    `reads with nulls %s without an equality lookup`,
-    (nulls) => {
-      const index = new RangeOnlyIndex<number>(
-        1,
-        new PropRef([`value`]),
-        undefined,
-        { compareOptions: { direction: `asc`, nulls, stringSort: `locale` } },
-      )
-      for (const [key, value] of [
-        [1, null],
-        [2, 1],
-        [3, 2],
-      ] as const) {
-        index.add(key, { value })
-      }
-      const reader = new ReverseIndex(index, nulls === `first`)
-      expect(reader.takeFromStart(3)).toEqual(
-        nulls === `first` ? [1, 3, 2] : [3, 2, 1],
-      )
-    },
-  )
-
-  it(`orders a descending snapshot and a limited live query`, async () => {
-    type Item = { id: number; rank: number }
-    const source = createCollection<Item, number>({
-      id: `range-only-${Math.random()}`,
-      getKey: (item) => item.id,
-      syncMode: `eager`,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: 1, rank: 1 } })
-          write({ type: `insert`, value: { id: 2, rank: 2 } })
-          commit()
-          markReady()
-        },
-      },
-    })
-    source.createIndex((item) => item.rank, { indexType: RangeOnlyIndex })
-    const query = createLiveQueryCollection({
-      startSync: true,
-      query: (q) =>
-        q
-          .from({ item: source })
-          .orderBy(({ item }) => item.rank, `desc`)
-          .limit(1),
-    })
-    try {
-      const snapshot = source.currentStateAsChanges({
-        orderBy: [
-          {
-            expression: new PropRef([`rank`]),
-            compareOptions: {
-              direction: `desc`,
-              nulls: `first`,
-              stringSort: `locale`,
-            },
-          },
-        ],
-        limit: 1,
-      })
-      expect(snapshot?.map((change) => change.key)).toEqual([2])
-      await query.preload()
-      expect(query.toArray.map((item) => item.id)).toEqual([2])
-    } finally {
-      await query.cleanup()
-      await source.cleanup()
-    }
-  })
+declareOracle({
+  check: [checkRead],
+  model: [modelOrder, after, expectedRead],
 })
 
 describe(`reversed index reads`, () => {
diff --git a/packages/db/tests/reverse-index.test.ts b/packages/db/tests/reverse-index.test.ts
new file mode 100644
index 0000000000..d326c9495c
--- /dev/null
+++ b/packages/db/tests/reverse-index.test.ts
@@ -0,0 +1,136 @@
+/**
+ * Ordinary reversal tests for indexes that have no ordered range or whose
+ * reads fix one null placement, plus a live query over a range-only index.
+ * The reversed-read law is owned by reverse-index-oracle.property.test.ts.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import { BasicIndex } from '../src/indexes/basic-index.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { ReverseIndex } from '../src/indexes/reverse-index.js'
+import { createLiveQueryCollection } from '../src/query/live-query-collection.js'
+import { PropRef } from '../src/query/ir.js'
+import type { IndexOperation } from '../src/indexes/base-index.js'
+
+/** An order-capable index that advertises no equality lookup operation. */
+class RangeOnlyIndex<TKey extends string | number> extends BTreeIndex<TKey> {
+  public override readonly supportedOperations = new Set<IndexOperation>([
+    `gt`,
+    `gte`,
+    `lt`,
+    `lte`,
+  ])
+
+  override lookup(operation: IndexOperation, value: unknown): Set<TKey> {
+    if (!this.supportedOperations.has(operation)) {
+      throw new Error(`Unsupported operation: ${operation}`)
+    }
+    return super.lookup(operation, value)
+  }
+}
+
+describe(`legacy reversed index reads`, () => {
+  // An ascending index with nulls last over key 1 -> null, 2 -> 1, 3 -> 2.
+  it.each([BTreeIndex, BasicIndex] as const)(
+    `keeps plain reversal when no null placement is given (%o)`,
+    (IndexType) => {
+      const index = new IndexType<number>(
+        1,
+        new PropRef([`value`]),
+        undefined,
+        {
+          compareOptions: {
+            direction: `asc`,
+            nulls: `last`,
+            stringSort: `locale`,
+          },
+        },
+      )
+      for (const [key, value] of [
+        [1, null],
+        [2, 1],
+        [3, 2],
+      ] as const) {
+        index.add(key, { value })
+      }
+      const reader = new ReverseIndex(index)
+      expect(reader.takeFromStart(3)).toEqual([1, 3, 2])
+      expect(reader.take(3, null)).toEqual([3, 2])
+    },
+  )
+})
+
+describe(`reversed reads through a range-only index`, () => {
+  it.each([`first`, `last`] as const)(
+    `reads with nulls %s without an equality lookup`,
+    (nulls) => {
+      const index = new RangeOnlyIndex<number>(
+        1,
+        new PropRef([`value`]),
+        undefined,
+        { compareOptions: { direction: `asc`, nulls, stringSort: `locale` } },
+      )
+      for (const [key, value] of [
+        [1, null],
+        [2, 1],
+        [3, 2],
+      ] as const) {
+        index.add(key, { value })
+      }
+      const reader = new ReverseIndex(index, nulls === `first`)
+      expect(reader.takeFromStart(3)).toEqual(
+        nulls === `first` ? [1, 3, 2] : [3, 2, 1],
+      )
+    },
+  )
+
+  it(`orders a descending snapshot and a limited live query`, async () => {
+    type Item = { id: number; rank: number }
+    const source = createCollection<Item, number>({
+      id: `range-only-${Math.random()}`,
+      getKey: (item) => item.id,
+      syncMode: `eager`,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: 1, rank: 1 } })
+          write({ type: `insert`, value: { id: 2, rank: 2 } })
+          commit()
+          markReady()
+        },
+      },
+    })
+    source.createIndex((item) => item.rank, { indexType: RangeOnlyIndex })
+    const query = createLiveQueryCollection({
+      startSync: true,
+      query: (q) =>
+        q
+          .from({ item: source })
+          .orderBy(({ item }) => item.rank, `desc`)
+          .limit(1),
+    })
+    try {
+      const snapshot = source.currentStateAsChanges({
+        orderBy: [
+          {
+            expression: new PropRef([`rank`]),
+            compareOptions: {
+              direction: `desc`,
+              nulls: `first`,
+              stringSort: `locale`,
+            },
+          },
+        ],
+        limit: 1,
+      })
+      expect(snapshot?.map((change) => change.key)).toEqual([2])
+      await query.preload()
+      expect(query.toArray.map((item) => item.id)).toEqual([2])
+    } finally {
+      await query.cleanup()
+      await source.cleanup()
+    }
+  })
+})
diff --git a/packages/db/tests/sorted-map-support.ts b/packages/db/tests/sorted-map-support.ts
new file mode 100644
index 0000000000..f8b2d2e2cd
--- /dev/null
+++ b/packages/db/tests/sorted-map-support.ts
@@ -0,0 +1,90 @@
+import { expect } from 'vitest'
+import type { SortedMap } from '../src/SortedMap'
+
+/**
+ * Comparison shared by SortedMap-oracle.test.ts and SortedMap.test.ts. expectMap
+ * states the SortedMap law: an observed view must refine a full recomputation of
+ * a plain Map model. Rows compare by rank, so one check serves row objects from
+ * the oracle driver and plain numbers in unit examples.
+ */
+
+export type Order = `key` | `ascending` | `descending`
+
+// Production stores row objects so the driver can change one in place. The
+// model stores each row's rank as a number and never shares an object.
+export type Row = { rank: number }
+
+export type ModelKey = number
+
+const probeKeys: Array<ModelKey> = [
+  -3,
+  -2,
+  -1,
+  0,
+  1,
+  2,
+  3,
+  Number.NaN,
+  10,
+  26,
+  50,
+]
+
+// The generated keys are numbers, which key order sorts ascending with `NaN`
+// after every other number.
+const compareModelKeys = (a: ModelKey, b: ModelKey) =>
+  Number.isNaN(a) || Number.isNaN(b)
+    ? Number(Number.isNaN(a)) - Number(Number.isNaN(b))
+    : a - b
+
+export function modelOrder(model: Map<ModelKey, number>, order: Order) {
+  return [...model].sort(
+    ([ka, va], [kb, vb]) =>
+      (order === `key` ? 0 : order === `ascending` ? va - vb : vb - va) ||
+      compareModelKeys(ka, kb),
+  )
+}
+
+const byKey = (entries: Array<[ModelKey, number]>) =>
+  [...entries].sort(([a], [b]) => compareModelKeys(a, b))
+
+// Compare one observed view with the model. Without the order promise, the
+// view must still hold each key once with its current value.
+export function expectView(
+  actual: Array<[ModelKey, number]>,
+  expected: Array<[ModelKey, number]>,
+  orderPromised: boolean,
+) {
+  if (orderPromised) expect(actual).toEqual(expected)
+  else expect(byKey(actual)).toEqual(byKey(expected))
+}
+
+function rankOf(value: Row | number | undefined): number {
+  return (typeof value === `number` ? value : value?.rank) as number
+}
+
+export function expectMap<V extends Row | number>(
+  actual: SortedMap<number, V>,
+  model: Map<ModelKey, number>,
+  order: Order,
+  orderPromised = true,
+) {
+  // Recompute from a plain Map; do not copy SortedMap's binary insertion logic.
+  const expected = modelOrder(model, order)
+  const ranks = (entries: Iterable<[number, V]>) =>
+    // A stale slot reads no row; keep it visible to the comparison.
+    [...entries].map(([key, value]): [ModelKey, number] => [key, rankOf(value)])
+  expect(actual.size).toBe(model.size)
+  expectView(ranks(actual), expected, orderPromised)
+  expectView(ranks(actual.entries()), expected, orderPromised)
+  const values = [...actual.values()]
+  expectView(
+    [...actual.keys()].map((key, index) => [key, rankOf(values[index])]),
+    expected,
+    orderPromised,
+  )
+  for (const key of probeKeys) {
+    expect(actual.has(key)).toBe(model.has(key))
+    expect(rankOf(actual.get(key))).toBe(model.get(key))
+  }
+}
diff --git a/packages/db/tests/source-health-oracle.test.ts b/packages/db/tests/source-health-oracle.test.ts
index fb94b93a2e..428da270ef 100644
--- a/packages/db/tests/source-health-oracle.test.ts
+++ b/packages/db/tests/source-health-oracle.test.ts
@@ -227,31 +227,51 @@ import { createLiveQueryCollection } from '../src/query/live-query-collection.js
 import { createEffect } from '../src/query/effect.js'
 import { createPooledLiveQuery } from '../src/query/pooled-live-query.js'
 import { Query } from '../src/query/builder/index.js'
-import { eq, isUndefined, not } from '../src/query/builder/functions.js'
+import { eq } from '../src/query/builder/functions.js'
 import { include } from '../src/query/builder/include-functions.js'
 import {
   CollectionHasSubscribersError,
   CollectionReloadDuringSyncEntryError,
 } from '../src/errors.js'
 import { RequestErrors } from '../src/collection/lifecycle.js'
-import { BTreeIndex } from '../src/indexes/btree-index.js'
 import { createDeferred } from '../src/deferred.js'
 import { createOracleReach } from './oracle-reach.js'
 import { oraclePropertyOptions } from './oracle-config.js'
-import { captureMicrotaskErrors, flushPromises } from './utils.js'
+import { declareOracle } from './oracle-declaration.js'
+import { flushPromises } from './utils.js'
+import { createSource } from './source-health-support.js'
+import type {
+  PooledView,
+  Row,
+  SourceName,
+  Subject,
+  SyncParams,
+} from './source-health-support.js'
 import type { Collection } from '../src/collection/index.js'
 import type {
   CollectionStatus,
   HealthNode,
   LoadSubsetOptions,
-  SyncConfig,
 } from '../src/types.js'
 
-// `tag` names the write that produced a row, so a read shows which write
-// (and so which sync run) the row came from.
-type Row = { id: number; parentId: number; tag?: number }
-type SyncParams = Parameters<SyncConfig<Row, number>[`sync`]>[0]
-type SourceName = `A` | `B`
+// The model steps each Collection and derives the trees, rows, request errors,
+// and gates that the public observations must equal; the checks compare them.
+declareOracle({
+  check: [expectIdentity, expectRequestErrors, expectHeldDemandCovered],
+  model: [
+    applyModel,
+    applySourceStep,
+    expectedTree,
+    expectedQuerySize,
+    applyWindowStep,
+    settleWindow,
+    applyLazyStep,
+    expectedRequestErrors,
+    expectedOverlap,
+    expectedOnDemandReload,
+  ],
+})
+
 type Shape =
   `direct` | `join` | `self-join` | `nested` | `include` | `pooled-nested`
 // A source step that takes no other argument.
@@ -1411,88 +1431,6 @@ function expectedTree(
 // Production driver
 // ---------------------------------------------------------------------------
 
-function createSource(name: SourceName) {
-  let params: SyncParams | undefined
-  let failNextCleanup = false
-  // A held adapter cleanup stays pending until the driver settles it.
-  let held: ReturnType<typeof createDeferred<void>> | undefined
-  // The next cleanup, a reload's retired run's, stays pending until the
-  // driver rejects it.
-  let holdNextCleanup = false
-  let retiredHeld: ReturnType<typeof createDeferred<void>> | undefined
-  // The next sync run calls markReady() inside sync().
-  let readyInSync = false
-  // Sync runs the adapter was asked to start, and those whose cleanup it was
-  // asked to run: the difference is the runs still live at the adapter.
-  const runs = { started: 0, ended: 0 }
-  const collection = createCollection<Row, number>({
-    id: `health-oracle-${name}-${Math.random().toString(36).slice(2)}`,
-    getKey: (row) => row.id,
-    startSync: false,
-    gcTime: 0,
-    sync: {
-      sync: (next) => {
-        params = next
-        runs.started++
-        if (readyInSync) {
-          readyInSync = false
-          next.markReady()
-        }
-        return () => {
-          runs.ended++
-          if (held) return held.promise
-          if (holdNextCleanup) {
-            holdNextCleanup = false
-            retiredHeld ??= createDeferred<void>()
-            return retiredHeld.promise
-          }
-          if (!failNextCleanup) return
-          failNextCleanup = false
-          return Promise.reject(new Error(`${name} cleanup failed`))
-        }
-      },
-    },
-  })
-  return {
-    collection,
-    liveRuns: () => runs.started - runs.ended,
-    failNextCleanup: (armed = true) => {
-      failNextCleanup = armed
-    },
-    holdNextCleanup: (armed = true) => {
-      holdNextCleanup = armed
-    },
-    markReadyInNextSync: (armed = true) => {
-      readyInSync = armed
-    },
-    rejectRetiredCleanup: () => {
-      retiredHeld?.reject(new Error(`${name} cleanup failed`))
-      retiredHeld = undefined
-    },
-    holdCleanup: () => {
-      held ??= createDeferred<void>()
-    },
-    settleCleanup: () => {
-      held?.resolve()
-      held = undefined
-    },
-    get params(): SyncParams {
-      if (!params) throw new Error(`source ${name} has not started`)
-      return params
-    },
-  }
-}
-
-// The observed query and how the driver starts and measures it. A live-query
-// Collection starts with a preload; a pooled view starts when it has a
-// subscriber, as an observer would subscribe.
-type Subject = {
-  query: Pick<Collection<any, any>, `status` | `health` | `on` | `cleanup`>
-  inner?: Collection<any, any>
-  start: () => void
-  size: () => number
-}
-
 function liveQuery(query: Collection<any, any>, inner?: Collection<any, any>) {
   return {
     query,
@@ -1572,11 +1510,6 @@ function buildQuery(
   }
 }
 
-type PooledView = Subject[`query`] & {
-  subscribeChanges: (listener: () => void) => { unsubscribe: () => void }
-  entries: () => Iterable<unknown>
-}
-
 // The public tree, projected onto the fields the model owns.
 // A failed adapter cleanup reaches the node as a SyncCleanupError, whose
 // message names the Collection; the model knows only the adapter's message.
@@ -3445,1231 +3378,14 @@ describe(`source failure and health oracle`, () => {
     ([shape, steps], directSubscribers) => {
       historiesRan = true
       historyReach.beginHistory()
-      return withDeadline(
-        runHistory(shape, steps, directSubscribers, historyReach),
-      )
-    },
-    120_000,
-  )
-  afterAll(() => {
-    if (historiesRan) historyReach.assertReached()
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Request lane
-// ---------------------------------------------------------------------------
-
-/**
- * A live query's lazy source loads only the keys its rows reach, and an
- * on-demand root source loads the window the query shows. After the query's
- * initial-query readiness, a load that fails is a request error on the query's own node:
- * the source stays healthy and the query keeps its status. A lazy demand's
- * error clears when the same demand later settles, or when the query stops
- * needing it; a root source's error clears when a later load of that source
- * settles. Before initial-query readiness, the same failure fails the query's sync run.
- */
-// ---------------------------------------------------------------------------
-// Reload invariant witness
-// ---------------------------------------------------------------------------
-
-// A reload retires its sync run, and the retired run's `commit()` can no
-// longer reach a transaction it left open. That transaction has no public
-// observation (its writes never apply), so this witness checks the
-// invariant directly: after the reload no transaction stays open, and the
-// new run's own commit decides the row.
-// ---------------------------------------------------------------------------
-// Problem values
-// ---------------------------------------------------------------------------
-
-/**
- * `fail()`, `reportError()`, and a crash accept any value as the problem. The
- * law: the value never changes what the call does. Status, node, and a
- * reload's promise follow the same rules as for an `Error`, and the node's
- * problem keeps the value as its `cause`. A value that cannot describe
- * itself (no prototype, a throwing getter) shows the generic message. The
- * lane crosses each call site with each kind of value.
- */
-describe(`problem values`, () => {
-  const values: Record<string, () => unknown> = {
-    error: () => new Error(`gave up`),
-    string: () => `gave up`,
-    'no prototype': () => Object.create(null),
-    'throwing getter': () => ({
-      get code() {
-        throw new Error(`getter`)
-      },
-      toString() {
-        throw new Error(`toString`)
-      },
-    }),
-  }
-  const sites = [
-    `fail before ready`,
-    `fail after ready`,
-    `fail during a reload`,
-    `reportError`,
-    `crash`,
-  ] as const
-  const cases = sites.flatMap((site) =>
-    Object.keys(values).map((value) => ({ site, value })),
-  )
-  it.each(cases)(`%j`, async ({ site, value }) => {
-    let params!: SyncParams
-    const collection = createCollection<Row, number>({
-      id: `health-problem-value-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (next) => {
-          params = next
-        },
-      },
-    })
-    const problem = values[value]!()
-    void collection.preload().catch(() => undefined)
-    await flushPromises()
-    let reload: Promise<void> | undefined
-    if (site !== `fail before ready`) {
-      params.markReady()
-      if (site === `fail during a reload`) {
-        reload = collection.reload()
-        void reload.catch(() => undefined)
-      }
-    }
-    if (site === `reportError`) params.reportError(problem)
-    else if (site === `crash`) collection._lifecycle.crash(problem)
-    else params.fail(problem)
-    await flushPromises()
-    const shown =
-      site === `fail before ready` || site === `crash`
-        ? collection.health.error
-        : site === `reportError`
-          ? collection.health.failureReason
-          : collection.health.error
-    expect(collection.status).toBe(
-      site === `fail before ready`
-        ? `error`
-        : site === `crash`
-          ? `crashed`
-          : `ready`,
-    )
-    expect(shown?.cause, `the node keeps the value`).toBe(problem)
-    expect(typeof shown?.message).toBe(`string`)
-    // One call is one failure in the problem's frame, and it is the one the
-    // problem shows. JSON keeps every failure's facts and leaves out causes.
-    expect(shown?.errors.length, `one failure listed`).toBe(1)
-    expect(shown?.errors[0]?.cause, `the listed failure's value`).toBe(problem)
-    const facts = JSON.parse(JSON.stringify(shown!.errors[0]))
-    expect(facts, `JSON leaves out the cause`).not.toHaveProperty(`cause`)
-    expect(JSON.parse(JSON.stringify(shown))).toEqual({
-      ...facts,
-      errors: [facts],
-    })
-    if (reload)
-      await expect(reload, `a failed reload settles`).rejects.toBe(problem)
-    await collection.cleanup()
-  })
-})
-
-describe(`reload invariant`, () => {
-  // A query's reload() settles with the query: after its failed source
-  // recovers, the query reloads itself, and the reload waits for that run to
-  // be ready (or to fail).
-  it(`settles a query reload with the query's restarted run`, async () => {
-    let runs = 0
-    const loads: Array<ReturnType<typeof createDeferred<void>>> = []
-    const parents = createCollection<Row, number>({
-      id: `health-query-reload-parents-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          if (runs++ === 0) {
-            params.fail(new Error(`first load failed`))
-            return
-          }
-          params.begin()
-          params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-          params.commit()
-          params.markReady()
-        },
-      },
-    })
-    const children = createCollection<Row, number>({
-      id: `health-query-reload-children-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: () => {
-              const load = createDeferred<void>()
-              loads.push(load)
-              return load.promise
-            },
-          }
-        },
-      },
-    })
-    const query = createLiveQueryCollection((q) =>
-      q
-        .from({ parent: parents })
-        .leftJoin({ child: children }, ({ parent, child }) =>
-          eq(parent.id, child.parentId),
-        ),
-    )
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await query.preload().catch(() => undefined)
-      expect(query.status).toBe(`error`)
-      let settled = false
-      const reload = query.reload().finally(() => {
-        settled = true
-      })
-      await flushPromises()
-      // The query's own reload waits for its join load: it keeps `error` and
-      // shows `reloading`, and the reload waits too.
-      expect(query.status).toBe(`error`)
-      expect(query.health.reloading).toBe(true)
-      expect(settled, `reload settled before the query's run was ready`).toBe(
-        false,
-      )
-      for (const load of loads) load.resolve()
-      await reload
-      expect(query.status).toBe(`ready`)
-    } finally {
-      console.error = consoleError
-      for (const load of loads) load.resolve()
-      await query.cleanup()
-      await parents.cleanup()
-      await children.cleanup()
-    }
-  })
-
-  // A throwing sync function is a programming error in any run. During a
-  // reload of a failed first load the status still shows `error`, but this
-  // run did not fail, so the throw crashes the Collection.
-  it(`crashes when a reload's sync function throws after a failed first load`, async () => {
-    let runs = 0
-    const collection = createCollection<Row, number>({
-      id: `health-reload-throw-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          if (runs++ === 0) params.fail(new Error(`first load failed`))
-          else throw new Error(`sync threw`)
-        },
-      },
-    })
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await collection.preload().catch(() => undefined)
-      expect(collection.status).toBe(`error`)
-      await expect(collection.reload()).rejects.toThrow(`sync threw`)
-      expect(collection.status).toBe(`crashed`)
-      expect(collection.health.reloading).toBe(false)
-    } finally {
-      console.error = consoleError
-      await collection.cleanup()
-    }
-  })
-
-  // A snapshot replaces every synced row, so inside it the baseline an
-  // adapter diffs against is empty. An adapter that writes only rows missing
-  // from the baseline, as Query Collections do, then rebuilds every row, and
-  // the rows the snapshot does not write go.
-  it(`gives a diffing adapter an empty baseline inside a reload's snapshot`, async () => {
-    const source = createSource(`A`)
-    source.collection.startSyncImmediate()
-    const writeMissing = (rows: Array<Row>, snapshot: boolean) => {
-      const params = source.params
-      params.begin(snapshot ? { snapshot } : undefined)
-      const baseline = new Map(params.collection._state.acceptedSyncedEntries())
-      for (const row of rows)
-        if (!baseline.has(row.id)) params.write({ type: `insert`, value: row })
-      params.commit()
-      params.markReady()
-    }
-    writeMissing(
-      [
-        { id: 1, parentId: 1 },
-        { id: 2, parentId: 2 },
-      ],
-      false,
-    )
-    const reload = source.collection.reload()
-    writeMissing([{ id: 1, parentId: 1 }], true)
-    await reload
-    expect([...source.collection.keys()]).toEqual([1])
-    await source.collection.cleanup()
-  })
-
-  // Cleanup start closes restart admission (ARCHITECTURE law 14), and a
-  // reload starts a sync run. While adapter cleanup is pending, a reload
-  // rejects as a start would, and no sync run starts under the cleanup.
-  it(`rejects a reload while adapter cleanup is pending`, async () => {
-    let runs = 0
-    const adapterCleanup = createDeferred<void>()
-    const collection = createCollection<Row, number>({
-      id: `health-reload-during-cleanup-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          runs++
-          params.markReady()
-          return () => adapterCleanup.promise
-        },
-      },
-    })
-    await collection.preload()
-    const cleaned = collection.cleanup()
-    await expect(collection.reload()).rejects.toThrow(/during cleanup/)
-    expect(runs).toBe(1)
-    adapterCleanup.resolve()
-    await cleaned
-    expect(collection.status).toBe(`cleaned-up`)
-    expect(runs).toBe(1)
-  })
-
-  // Cleanup start drops the discarded run's problems while the status waits
-  // for adapter cleanup. Every change to the tree is announced, so the drop
-  // is too: the last health:change before the status change shows no
-  // problem. The cause of a `crashed` or `error` status stays while that
-  // status shows.
-  it.each([`report`, `fail`, `crash`, `first-load-error`] as const)(
-    `announces the problems that cleanup start drops: %s`,
-    async (problem) => {
-      const adapterCleanup = createDeferred<void>()
-      let params!: SyncParams
-      const collection = createCollection<Row, number>({
-        id: `health-cleanup-drop-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: (next) => {
-            params = next
-            if (problem === `first-load-error`)
-              next.fail(new Error(`first load failed`))
-            else next.markReady()
-            return () => adapterCleanup.promise
-          },
-        },
-      })
-      await collection.preload().catch(() => undefined)
-      if (problem === `report`) params.reportError(new Error(`stalled`))
-      else if (problem === `fail`) params.fail(new Error(`stopped`))
-      else if (problem === `crash`)
-        collection._lifecycle.crash(new Error(`crashed`))
-      const announced: Array<HealthNode> = []
-      collection.on(`health:change`, () => announced.push(collection.health))
-      const cleaned = collection.cleanup()
-      // A status's own cause stays while that status shows.
-      const keepsCause = problem === `crash` || problem === `first-load-error`
-      expect(collection.status).toBe(
-        problem === `crash`
-          ? `crashed`
-          : problem === `first-load-error`
-            ? `error`
-            : `ready`,
-      )
-      if (keepsCause) {
-        expect(collection.health.error?.message).toBe(
-          problem === `crash` ? `crashed` : `first load failed`,
-        )
-        expect(announced).toEqual([])
-      } else {
-        expect(collection.health.hasErrors).toBe(false)
-        expect(announced.at(-1)?.hasErrors).toBe(false)
-      }
-      adapterCleanup.resolve()
-      await cleaned
-      expect(collection.status).toBe(`cleaned-up`)
-      expect(collection.health.hasErrors).toBe(false)
-    },
-  )
-
-  // A ready callback that throws reaches the adapter's markReady() when the
-  // adapter calls it after sync() returns. Inside sync() it reaches no caller,
-  // so core reports it uncaught (maintainer decision). The reload itself
-  // succeeded once the status is ready, so it resolves either way.
-  it.each([`sync`, `async`] as const)(
-    `settles a reload whose ready callback throws: %s markReady`,
-    async (timing) => {
-      let runs = 0
-      const collection = createCollection<Row, number>({
-        id: `health-reload-ready-throw-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            if (runs++ === 0) {
-              params.fail(new Error(`first load failed`))
-              return
-            }
-            if (timing === `sync`) params.markReady()
-            else
-              setTimeout(() => {
-                expect(() => params.markReady()).toThrow(`callback threw`)
-              }, 0)
-          },
-        },
-      })
-      await collection.preload().catch(() => undefined)
-      const failure = new Error(`callback threw`)
-      collection.onFirstReady(() => {
-        throw failure
-      })
-      const uncaught = captureMicrotaskErrors()
-      const settled = await Promise.race([
-        collection.reload().then(
-          () => `resolved`,
-          () => `rejected`,
-        ),
-        new Promise((resolve) => setTimeout(() => resolve(`pending`), 200)),
-      ])
-      uncaught.restore()
-      expect(uncaught.errors).toEqual(timing === `sync` ? [failure] : [])
-      expect(settled).toBe(`resolved`)
-      expect(collection.status).toBe(`ready`)
-      expect(collection.health.reloading).toBe(false)
-      await collection.cleanup()
-    },
-  )
-
-  // A live query that never started has no run yet. Its reload starts it,
-  // as any Collection's reload starts an idle one, after it reloads a source
-  // whose first load failed.
-  it.each([`ready`, `failed`] as const)(
-    `starts a never-started live query on reload: source %s`,
-    async (sourceState) => {
-      let runs = 0
-      const source = createCollection<Row, number>({
-        id: `health-idle-query-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        gcTime: 0,
-        startSync: true,
-        sync: {
-          sync: (params) => {
-            if (runs++ === 0 && sourceState === `failed`) {
-              params.fail(new Error(`first load failed`))
-              return
-            }
-            params.begin()
-            params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-            params.commit()
-            params.markReady()
-          },
-        },
-      })
-      await source.preload().catch(() => undefined)
-      const query = createLiveQueryCollection({
-        query: (q) => q.from({ row: source }),
-        startSync: false,
-      })
-      expect(query.status).toBe(`idle`)
-      try {
-        await query.reload()
-        expect(query.status).toBe(`ready`)
-        expect(query.size).toBe(1)
-        expect(source.status).toBe(`ready`)
-      } finally {
-        await query.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-
-  // A reload whose new run fails keeps the rows, so they stay the baseline
-  // that a diffing adapter, such as query-db, reads for its next write.
-  // A transaction the new run opened before it failed is no longer the
-  // reload's replacement: when it commits, its writes apply on the kept rows.
-  it.each([`no open transaction`, `an open transaction`] as const)(
-    `keeps the rows as the baseline after the reload's new run fails with %s`,
-    async (open) => {
-      const source = createSource(`A`)
-      source.collection.startSyncImmediate()
-      source.params.begin()
-      source.params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-      source.params.commit()
-      source.params.markReady()
-      const reload = source.collection.reload().catch(() => undefined)
-      if (open === `an open transaction`) {
-        source.params.begin()
-        source.params.write({ type: `insert`, value: { id: 2, parentId: 2 } })
-      }
-      source.params.fail(new Error(`reload failed`))
-      await reload
-      const baseline = [
-        ...source.params.collection._state.acceptedSyncedEntries(),
-      ]
-      expect(baseline.map(([key]) => key)).toEqual(
-        open === `an open transaction` ? [1, 2] : [1],
-      )
-      expect([...source.collection.keys()]).toEqual([1])
-      if (open === `an open transaction`) {
-        await source.params.commit()
-        expect([...source.collection.keys()].sort()).toEqual([1, 2])
-      }
-      expect(source.collection.status).toBe(`ready`)
-      expect(source.collection.health.error?.message).toBe(`reload failed`)
-      await source.collection.cleanup()
-    },
-  )
-
-  // A canceled commit never happened, and the reload's other writes apply on
-  // the kept rows: without a snapshot, the reload ends at markReady() with
-  // every row it kept.
-  it(`keeps the rows through a canceled reload commit without a snapshot`, async () => {
-    const source = createSource(`A`)
-    source.collection.startSyncImmediate()
-    const first = source.params
-    first.begin()
-    first.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-    first.commit()
-    first.markReady()
-    const reload = source.collection.reload()
-    const next = source.params
-    const canceled = new AbortController()
-    canceled.abort()
-    next.begin()
-    next.write({ type: `insert`, value: { id: 3, parentId: 3 } })
-    try {
-      next.commit(canceled.signal)
-    } catch {
-      // A canceled commit may throw its abort reason.
-    }
-    // The run continues at once, before the canceled receipt settles.
-    next.begin()
-    next.write({ type: `insert`, value: { id: 2, parentId: 2 } })
-    next.commit()
-    next.markReady()
-    await reload
-    expect(source.collection.health.reloading).toBe(false)
-    expect([...source.collection.keys()].sort()).toEqual([1, 2])
-    await source.collection.cleanup()
-  })
-
-  it(`drops the retired run's open sync transaction`, async () => {
-    const source = createSource(`A`)
-    source.collection.startSyncImmediate()
-    const first = source.params
-    first.begin()
-    first.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-    first.commit()
-    first.markReady()
-    first.begin()
-    first.write({ type: `insert`, value: { id: 2, parentId: 0 } })
-    const reload = source.collection.reload()
-    const next = source.params
-    next.begin()
-    next.write({ type: `insert`, value: { id: 2, parentId: 2 } })
-    next.commit()
-    next.markReady()
-    await reload
-    expect(
-      source.collection._state.pendingSyncedTransactions.filter(
-        (transaction) => !transaction.committed,
-      ),
-    ).toEqual([])
-    expect(source.collection.get(2)).toMatchObject({ id: 2, parentId: 2 })
-    await source.collection.cleanup()
-  })
-})
-
-describe(`request errors`, () => {
-  function createRequestHistory() {
-    let parentParams!: SyncParams
-    const outcomes: Array<`ok` | `fail` | `hold`> = []
-    const held: Array<ReturnType<typeof createDeferred<void>>> = []
-    const parents = createCollection<Row, number>({
-      id: `health-request-parents-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          parentParams = params
-        },
-      },
-    })
-    const children = createCollection<Row, number>({
-      id: `health-request-children-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: (_options: LoadSubsetOptions) => {
-              const outcome = outcomes.shift() ?? `ok`
-              if (outcome === `hold`) {
-                const load = createDeferred<void>()
-                held.push(load)
-                return load.promise
-              }
-              return outcome === `ok`
-                ? Promise.resolve()
-                : Promise.reject(new Error(`child load failed`))
-            },
-          }
-        },
-      },
-    })
-    const query = createLiveQueryCollection((q) =>
-      q
-        .from({ parent: parents })
-        .leftJoin({ child: children }, ({ parent, child }) =>
-          eq(parent.id, child.parentId),
-        ),
-    )
-    const writeParent = (type: `insert` | `delete`, id: number) => {
-      parentParams.begin()
-      parentParams.write({ type, value: { id, parentId: id } })
-      parentParams.commit()
-    }
-    const markParentsReady = () => parentParams.markReady()
-    return {
-      parents,
-      children,
-      query,
-      outcomes,
-      held,
-      writeParent,
-      markParentsReady,
-    }
-  }
-
-  async function withHistory(
-    run: (history: ReturnType<typeof createRequestHistory>) => Promise<void>,
-  ) {
-    const history = createRequestHistory()
-    expect(
-      history.query.health,
-      `the query exposes a health tree`,
-    ).toBeDefined()
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await run(history)
-    } finally {
-      console.error = consoleError
-      await history.query.cleanup()
-      await history.parents.cleanup()
-      await history.children.cleanup()
-    }
-  }
-
-  it(`a failed load after initial-query readiness is a request error that clears when its demand settles`, () =>
-    withHistory(
-      async ({ query, children, outcomes, writeParent, markParentsReady }) => {
-        const preload = query.preload()
-        writeParent(`insert`, 1)
-        markParentsReady()
-        await preload
-        expect(query.health.hasErrors).toBe(false)
-
-        outcomes.push(`fail`)
-        writeParent(`insert`, 2)
-        await flushPromises()
-        expect(query.status).toBe(`ready`)
-        expect(query.health.error).toMatchObject({
-          message: `child load failed`,
-        })
-        expect(query.health.failureReason).toBeNull()
-        expect(children.health.hasErrors).toBe(false)
-
-        // The demand changes again and its new load settles.
-        outcomes.push(`ok`)
-        writeParent(`insert`, 3)
-        await flushPromises()
-        expect(query.health.hasErrors).toBe(false)
-      },
-    ))
-
-  it(`a request error clears when the query stops needing the demand`, () =>
-    withHistory(async ({ query, outcomes, writeParent, markParentsReady }) => {
-      const preload = query.preload()
-      writeParent(`insert`, 1)
-      markParentsReady()
-      await preload
-
-      outcomes.push(`fail`)
-      writeParent(`insert`, 2)
-      await flushPromises()
-      expect(query.health.error).toMatchObject({ message: `child load failed` })
-
-      writeParent(`delete`, 1)
-      writeParent(`delete`, 2)
-      await flushPromises()
-      expect(query.health.hasErrors).toBe(false)
-      expect(query.status).toBe(`ready`)
-    }))
-
-  // A later load of the failed demand that fulfills clears its error, also
-  // when a reload issues it: a source's reload replays the query's demand,
-  // and the query's own reload loads it in a new run. The guide offers
-  // `reload()` for a node with an `error`, so the query's reload must reach
-  // a request error on its own node.
-  it.each([`source`, `query`] as const)(
-    `a request error clears when the %s reload loads the demand again`,
-    (reloaded) =>
-      withHistory(
-        async ({
-          query,
-          children,
-          outcomes,
-          writeParent,
-          markParentsReady,
-        }) => {
-          const preload = query.preload()
-          writeParent(`insert`, 1)
-          markParentsReady()
-          await preload
-
-          outcomes.push(`fail`)
-          writeParent(`insert`, 2)
-          await flushPromises()
-          expect(query.health.error).toMatchObject({
-            message: `child load failed`,
-          })
-
-          await (reloaded === `source` ? children : query).reload()
-          await flushPromises()
-          expect(query.health.hasErrors).toBe(false)
-          expect(query.status).toBe(`ready`)
-          expect(query.size).toBe(2)
-        },
-      ),
-  )
-
-  // A replay clears only what failed before it started (as LoadOrder does
-  // for root loads): a demand that fails while the replay is in flight keeps
-  // its error when the replay succeeds. The replay holds that failure with
-  // its publication, so it shows once the replay settles.
-  it(`a source reload's replay keeps a request error that failed after it started`, () =>
-    withHistory(
-      async ({
-        query,
-        children,
-        outcomes,
-        held,
-        writeParent,
-        markParentsReady,
-      }) => {
-        const preload = query.preload()
-        writeParent(`insert`, 1)
-        markParentsReady()
-        await preload
-
-        outcomes.push(`hold`)
-        const reload = children.reload()
-        await flushPromises()
-        expect(held, `the replay is in flight`).toHaveLength(1)
-
-        outcomes.push(`fail`)
-        writeParent(`insert`, 2)
-        await flushPromises()
-
-        held[0]!.resolve()
-        await reload
-        await flushPromises()
-        expect(query.health.error, `the later failure stays`).toMatchObject({
-          message: `child load failed`,
-        })
-      },
-    ))
-
-  it(`a failed load before initial-query readiness fails the query's sync run`, () =>
-    withHistory(async ({ query, outcomes, writeParent, markParentsReady }) => {
-      outcomes.push(`fail`)
-      const preload = query.preload()
-      void preload.catch(() => undefined)
-      writeParent(`insert`, 1)
-      markParentsReady()
-      await flushPromises()
-      expect(query.status).toBe(`error`)
-      expect(query.health.error).toMatchObject({ message: `child load failed` })
-      await expect(preload).rejects.toBeDefined()
-    }))
-})
-
-// A crash is not recovered in place: `reload()` rejects and nothing starts a
-// new sync run. Only cleanup leaves `crashed`, and cleanup discards all of
-// the Collection's state, so a later start is a fresh start, as a new
-// Collection over the same source would be. Model: after the cascade
-// cleanup and a new preload, the Collection and a query mounted again show
-// only the new run's rows and no problem.
-describe(`crash recovery`, () => {
-  it(`recovers a crashed Collection only through a full cleanup`, async () => {
-    let runs = 0
-    const collection = createCollection<Row, number>({
-      id: `health-crash-recovery-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          const run = ++runs
-          params.begin()
-          params.write({ type: `insert`, value: { id: run, parentId: run } })
-          params.commit()
-          params.markReady()
-        },
-      },
-    })
-    let query = createLiveQueryCollection((q) => q.from({ row: collection }))
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await query.preload()
-      collection._lifecycle.crash(new Error(`index broke`))
-      expect(query.status).toBe(`crashed`)
-
-      await expect(collection.reload()).rejects.toThrow(/crashed/)
-      await flushPromises()
-      expect(collection.status, `nothing recovers it in place`).toBe(`crashed`)
-      expect(runs).toBe(1)
-
-      await collection.cleanup({ dependents: true })
-      await collection.preload()
-      expect(runs).toBe(2)
-      expect(collection.status).toBe(`ready`)
-      expect(collection.toArray.map((row) => row.id)).toEqual([2])
-      expect(collection.health.hasErrors).toBe(false)
-
-      query = createLiveQueryCollection((q) => q.from({ row: collection }))
-      await query.preload()
-      expect(query.status).toBe(`ready`)
-      expect(query.toArray.map((row) => row.id)).toEqual([2])
-      expect(query.health.hasErrors).toBe(false)
-    } finally {
-      console.error = consoleError
-      await query.cleanup()
-      await collection.cleanup({ dependents: true })
-    }
-  })
-})
-
-// A query whose first load failed waits for `reload()`: another source
-// becoming ready does not restart it, and its failed load is not retried. The
-// main grammar fails only sources, so this lane supplies the query's own
-// failure.
-describe(`a query's own failed first load`, () => {
-  it(`does not restart when an unrelated source becomes ready`, async () => {
-    let loads = 0
-    const children = createCollection<Row, number>({
-      id: `health-own-children-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              return new Promise<void>((_, reject) =>
-                setTimeout(() => reject(new Error(`child load failed`)), 0),
-              )
-            },
-          }
-        },
-      },
-    })
-    const parents = createSource(`B`)
-    parents.collection.startSyncImmediate()
-    const query = createLiveQueryCollection((q) =>
-      q
-        .from({ child: children })
-        .where(({ child }) => eq(child.parentId, 1))
-        .join({ parent: parents.collection }, ({ child, parent }) =>
-          eq(child.parentId, parent.id),
-        ),
-    )
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      void query.preload().catch(() => undefined)
-      await flushPromises()
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      expect(query.status).toBe(`error`)
-      expect(query.health.error).toMatchObject({ message: `child load failed` })
-      const loadsAtFailure = loads
-      parents.params.markReady()
-      await flushPromises()
-      await new Promise((resolve) => setTimeout(resolve, 0))
-      expect(query.status).toBe(`error`)
-      expect(loads).toBe(loadsAtFailure)
-    } finally {
-      console.error = consoleError
-      await query.cleanup()
-      await parents.collection.cleanup()
-      await children.cleanup()
-    }
-  })
-
-  // The query's own reload starts a new run while the status still shows the
-  // failed first load. That run is in its first load too, so its outcome
-  // decides the reload: a load that fails again fails it (status `error`,
-  // the new cause), and a graph that throws crashes the query.
-  it.each([`ok`, `load-fails`, `graph-throws`] as const)(
-    `settles the query's reload with its new run: %s`,
-    async (outcome) => {
-      const answers: Array<`fail` | `ok`> = [
-        `fail`,
-        outcome === `load-fails` ? `fail` : `ok`,
-      ]
-      const source = createCollection<Row, number>({
-        id: `health-own-reload-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            params.markReady()
-            return {
-              loadSubset: () => {
-                const answer = answers.shift() ?? `ok`
-                if (answer === `fail`)
-                  return Promise.reject(
-                    new Error(`load ${2 - answers.length} failed`),
-                  )
-                // The rows arrive after the run's sync entry, so a graph
-                // that throws on them does so in a later graph run.
-                return Promise.resolve().then(() => {
-                  params.begin()
-                  params.write({
-                    type: `insert`,
-                    value: { id: 1, parentId: 1 },
-                  })
-                  params.commit()
-                })
-              },
-            }
-          },
-        },
-      })
-      const query = createLiveQueryCollection((q) =>
-        q.from({ row: source }).fn.select(({ row }) => {
-          if (outcome === `graph-throws`) throw new Error(`select threw`)
-          return row
-        }),
-      )
-      const consoleError = console.error
-      console.error = () => {}
-      try {
-        await query.preload().catch(() => undefined)
-        expect(query.status).toBe(`error`)
-        const settled = await Promise.race([
-          query.reload().then(
-            () => `resolved`,
-            () => `rejected`,
-          ),
-          new Promise((resolve) => setTimeout(() => resolve(`pending`), 200)),
-        ])
-        expect(settled).toBe(outcome === `ok` ? `resolved` : `rejected`)
-        expect(query.status).toBe(
-          outcome === `ok`
-            ? `ready`
-            : outcome === `load-fails`
-              ? `error`
-              : `crashed`,
-        )
-        expect(query.health.reloading).toBe(false)
-        if (outcome === `ok`) expect(query.size).toBe(1)
-        if (outcome === `load-fails`)
-          expect(query.health.error?.message).toContain(`load 2 failed`)
-      } finally {
-        console.error = consoleError
-        await query.cleanup()
-        await source.cleanup()
-      }
-    },
-  )
-})
-
-// An ordered window that filters on a lazily joined source waits for its join
-// loads before it moves. A join load that fails after readiness is a request
-// error on the query's node, and it settles that demand: the window must not
-// wait for it for good. A later move loads, moves the window, and clears the
-// error. Every marker row exists from the start, so only the load fails.
-describe(`a failed join load under an ordered filtered window`, () => {
-  // Q1 (review 2): while the join load is pending, the query holds its
-  // output. When the load fails, the failure settles that demand (law 16),
-  // so the held output publishes at once: a change made meanwhile, which
-  // needs no other join load, shows without waiting for some later change.
-  it.each([`left`, `inner`] as const)(
-    `publishes a change held behind a failed join load (%s join)`,
-    async (join) => {
-      let rootParams!: SyncParams
-      const pendingLoads: Array<ReturnType<typeof createDeferred<void>>> = []
-      let holdLoads = false
-      const roots = createCollection<
-        { id: number; rank: number; label?: string },
-        number
-      >({
-        id: `health-held-roots-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            rootParams = params as unknown as SyncParams
-            params.begin()
-            for (let id = 1; id <= 10; id++)
-              params.write({ type: `insert`, value: { id, rank: id } })
-            params.commit()
-            params.markReady()
-          },
-        },
-      })
-      const markers = createCollection<{ id: number; rootId: number }, number>({
-        id: `health-held-markers-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            params.begin()
-            for (let id = 1; id <= 10; id++)
-              params.write({
-                type: `insert`,
-                value: { id: 100 + id, rootId: id },
-              })
-            params.commit()
-            params.markReady()
-            return {
-              loadSubset: () => {
-                if (!holdLoads) return Promise.resolve()
-                const load = createDeferred<void>()
-                pendingLoads.push(load)
-                return load.promise
-              },
-            }
-          },
-        },
-      })
-      const query = createLiveQueryCollection((q) => {
-        const from = q.from({ root: roots })
-        const joined =
-          join === `left`
-            ? from.leftJoin({ marker: markers }, ({ root, marker }) =>
-                eq(root.id, marker.rootId),
-              )
-            : from.join({ marker: markers }, ({ root, marker }) =>
-                eq(root.id, marker.rootId),
-              )
-        return joined
-          .where(({ marker }) => not(isUndefined(marker.id)))
-          .orderBy(({ root }) => root.rank)
-          .limit(2)
-      })
-      const subscription = query.subscribeChanges(() => {})
-      const consoleError = console.error
-      console.error = () => {}
-      const ids = () => query.toArray.map((row: any) => row.root.id as number)
-      try {
-        await query.preload()
-        expect(ids()).toEqual([1, 2])
-        holdLoads = true
-        // A new root asks the lazy join for its marker; the load is held.
-        rootParams.begin()
-        rootParams.write({
-          type: `insert`,
-          value: { id: 11, rank: 0 },
-        } as never)
-        rootParams.commit()
-        await flushPromises()
-        expect(
-          pendingLoads.length,
-          `the new root waits for a join load`,
-        ).toBeGreaterThan(0)
-        // Root 2 is visible and its marker is loaded: its update needs no
-        // join load.
-        rootParams.begin()
-        rootParams.write({
-          type: `update`,
-          value: { id: 2, rank: 2, label: `edited` },
-        } as never)
-        rootParams.commit()
-        await flushPromises()
-        for (const load of pendingLoads.splice(0))
-          load.reject(new Error(`marker load failed`))
-        await flushPromises()
-        expect(pendingLoads, `no join load is pending`).toEqual([])
-        expect(query.status).toBe(`ready`)
-        expect(query.health.error).toMatchObject({
-          message: `marker load failed`,
-        })
-        expect(ids(), `the window keeps its rows`).toEqual([1, 2])
-        expect(
-          (query.toArray[1] as any).root.label,
-          `the held change publishes after the failure`,
-        ).toBe(`edited`)
-      } finally {
-        console.error = consoleError
-        subscription.unsubscribe()
-        await query.cleanup()
-        await roots.cleanup()
-        await markers.cleanup()
-      }
-    },
-  )
-
-  it.each([`left`, `inner`] as const)(
-    `lets a later window move (%s join)`,
-    async (join) => {
-      let failLoads = false
-      const roots = createCollection<{ id: number; rank: number }, number>({
-        id: `health-window-roots-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            params.begin()
-            for (let id = 1; id <= 10; id++)
-              params.write({ type: `insert`, value: { id, rank: id } })
-            params.commit()
-            params.markReady()
-          },
-        },
-      })
-      const markers = createCollection<{ id: number; rootId: number }, number>({
-        id: `health-window-markers-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            params.begin()
-            for (let id = 1; id <= 10; id++)
-              params.write({
-                type: `insert`,
-                value: { id: 100 + id, rootId: id },
-              })
-            params.commit()
-            params.markReady()
-            return {
-              loadSubset: () =>
-                failLoads
-                  ? Promise.reject(new Error(`marker load failed`))
-                  : Promise.resolve(),
-            }
-          },
-        },
-      })
-      const query = createLiveQueryCollection((q) => {
-        const from = q.from({ root: roots })
-        const joined =
-          join === `left`
-            ? from.leftJoin({ marker: markers }, ({ root, marker }) =>
-                eq(root.id, marker.rootId),
-              )
-            : from.join({ marker: markers }, ({ root, marker }) =>
-                eq(root.id, marker.rootId),
-              )
-        return joined
-          .where(({ marker }) => not(isUndefined(marker.id)))
-          .orderBy(({ root }) => root.rank)
-          .limit(2)
-      })
-      const subscription = query.subscribeChanges(() => {})
-      const consoleError = console.error
-      console.error = () => {}
-      const ids = () => query.toArray.map((row: any) => row.root.id as number)
-      try {
-        await query.preload()
-        expect(ids()).toEqual([1, 2])
-
-        failLoads = true
-        await expect(
-          Promise.resolve(query.utils.setWindow({ offset: 4, limit: 2 })),
-        ).rejects.toThrow(`marker load failed`)
-        expect(query.status).toBe(`ready`)
-        expect(query.health.error).toMatchObject({
-          message: `marker load failed`,
-        })
-
-        failLoads = false
-        await query.utils.setWindow({ offset: 6, limit: 2 })
-        await flushPromises()
-        expect(ids(), `the window moves after the failure`).toEqual([7, 8])
-        expect(query.health.error, `the later load clears it`).toBeNull()
-        expect(query.status).toBe(`ready`)
-      } finally {
-        console.error = consoleError
-        subscription.unsubscribe()
-        await query.cleanup()
-        await roots.cleanup()
-        await markers.cleanup()
-      }
+      return withDeadline(
+        runHistory(shape, steps, directSubscribers, historyReach),
+      )
     },
+    120_000,
   )
-})
-
-describe(`root request health`, () => {
-  it(`a failed root load after initial-query readiness is a request error that clears when a later load settles`, async () => {
-    const outcomes: Array<`ok` | `fail`> = []
-    const source = createCollection<Row, number>({
-      id: `health-root-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: () =>
-              (outcomes.shift() ?? `ok`) === `ok`
-                ? Promise.resolve()
-                : Promise.reject(new Error(`root load failed`)),
-          }
-        },
-      },
-    })
-    const query = createLiveQueryCollection((q) =>
-      q
-        .from({ row: source })
-        .orderBy(({ row }) => row.id)
-        .limit(2),
-    )
-    expect(query.health, `the query exposes a health tree`).toBeDefined()
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await query.preload()
-      expect(query.health.hasErrors).toBe(false)
-
-      outcomes.push(`fail`)
-      await Promise.resolve(
-        query.utils.setWindow({ offset: 4, limit: 2 }),
-      ).catch(() => undefined)
-      await flushPromises()
-      expect(query.status).toBe(`ready`)
-      expect(query.health.error).toMatchObject({ message: `root load failed` })
-      expect(source.health.hasErrors).toBe(false)
-
-      await query.utils.setWindow({ offset: 8, limit: 2 })
-      await flushPromises()
-      expect(query.health.hasErrors).toBe(false)
-    } finally {
-      console.error = consoleError
-      await query.cleanup()
-      await source.cleanup()
-    }
+  afterAll(() => {
+    if (historiesRan) historyReach.assertReached()
   })
 })
 
@@ -4971,171 +3687,6 @@ describe(`on-demand reload`, () => {
   )
 })
 
-// ---------------------------------------------------------------------------
-// On-demand first load after query readiness
-// ---------------------------------------------------------------------------
-
-/**
- * A live query over an on-demand Collection becomes ready when its subsets
- * settle, so the Collection can still be in its first load when the query is
- * ready. The generated Collections are eager and never reach this state.
- * The laws are the ones above. After the query has shown data, only a crash
- * changes its status. The Collection's own node shows its first-load failure
- * (`error` status) or its stop after readiness (`ready` status, with an
- * `error`). The query's `reload()` reloads the Collection, and the new run's
- * readiness clears the node. A crashed query's `reload()` rejects.
- *
- * Histories cross the Collection's step (`fail` before its first ready,
- * `fail` after a `markReady()`, or `crash`) with a direct query and an
- * inner join to an eager Collection. Each history then calls the query's
- * `reload()`. The model gives the node's status and error message, the
- * query's status, and its row count at each cut.
- */
-type LateFirstLoadHistory = {
-  step: `fail-before-ready` | `fail-after-ready` | `crash`
-  shape: `direct` | `join`
-}
-
-type LateFirstLoadCut = {
-  queryStatus: CollectionStatus
-  rows: number | null
-  node: { status: CollectionStatus; error: string | null }
-}
-
-function expectedLateFirstLoad(history: LateFirstLoadHistory): {
-  afterStep: LateFirstLoadCut
-  afterReload: LateFirstLoadCut | `rejects`
-} {
-  if (history.step === `crash`)
-    return {
-      afterStep: {
-        queryStatus: `crashed`,
-        rows: null,
-        node: { status: `crashed`, error: `stopped` },
-      },
-      afterReload: `rejects`,
-    }
-  return {
-    afterStep: {
-      queryStatus: `ready`,
-      rows: 1,
-      node: {
-        status: history.step === `fail-before-ready` ? `error` : `ready`,
-        error: `stopped`,
-      },
-    },
-    afterReload: {
-      queryStatus: `ready`,
-      rows: 1,
-      node: { status: `ready`, error: null },
-    },
-  }
-}
-
-describe(`on-demand first load after query readiness`, () => {
-  const histories: Array<LateFirstLoadHistory> = []
-  for (const step of [
-    `fail-before-ready`,
-    `fail-after-ready`,
-    `crash`,
-  ] as const)
-    for (const shape of [`direct`, `join`] as const)
-      histories.push({ step, shape })
-
-  it.each(histories)(`step $step, shape $shape`, async (history) => {
-    let runs = 0
-    let firstRun!: SyncParams
-    const lazy = createCollection<Row, number>({
-      id: `health-late-first-load-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          // The first run stays in its first load; a reload's run is ready.
-          if (runs++ === 0) firstRun = params
-          else params.markReady()
-          return {
-            loadSubset: () => {
-              params.begin()
-              params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-              params.commit()
-              return true
-            },
-          }
-        },
-      },
-    })
-    const eager = createCollection<Row, number>({
-      id: `health-late-first-load-eager-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          params.begin()
-          params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-          params.commit()
-          params.markReady()
-        },
-      },
-    })
-    const query = createLiveQueryCollection((q) =>
-      history.shape === `direct`
-        ? q.from({ lazy })
-        : q
-            .from({ eager })
-            .join({ lazy }, ({ eager, lazy }) => eq(eager.id, lazy.id)),
-    )
-    const lazyNode = () =>
-      query.health.sources.find((node) => node.alias === `lazy`)!
-    const cut = (): LateFirstLoadCut => ({
-      queryStatus: query.status,
-      rows: query.status === `ready` ? query.size : null,
-      node: {
-        status: lazyNode().status,
-        error: lazyNode().error?.message ?? null,
-      },
-    })
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await query.preload()
-      // Premise: the query is ready while the Collection is still loading.
-      expect(lazy.status).toBe(`loading`)
-      expect(query.size).toBe(1)
-
-      const model = expectedLateFirstLoad(history)
-      const stopped = new Error(`stopped`)
-      if (history.step === `crash`)
-        firstRun.collection._lifecycle.crash(stopped)
-      else {
-        if (history.step === `fail-after-ready`) firstRun.markReady()
-        firstRun.fail(stopped)
-      }
-      await flushPromises()
-      expect(cut(), `after the step`).toEqual(model.afterStep)
-      expect(
-        findProblems(query.health).some((node) => node.alias === `lazy`),
-      ).toBe(true)
-
-      if (model.afterReload === `rejects`) {
-        await expect(query.reload()).rejects.toBeDefined()
-        expect(runs, `a crashed query does not reload its sources`).toBe(1)
-      } else {
-        await query.reload()
-        await flushPromises()
-        expect(cut(), `after the query's reload`).toEqual(model.afterReload)
-        expect(findProblems(query.health)).toEqual([])
-      }
-    } finally {
-      console.error = consoleError
-      await query.cleanup()
-      await lazy.cleanup()
-      await eager.cleanup()
-    }
-  })
-})
-
 // ---------------------------------------------------------------------------
 // The demand model, shared by the on-demand grammars
 // ---------------------------------------------------------------------------
@@ -8384,99 +6935,9 @@ describe(`lazy join demand grammar`, () => {
       ],
       { window: 2 },
     ))
-  // Q4 (review 2): a load that waited for a deferred start (DbClient
-  // hydration defers a start through this seam) runs the adapter's
-  // loadSubset when the start resumes. A reload from inside that call
-  // rejects, as from any loadSubset call.
-  it(`a reload from inside a deferred loadSubset rejects`, async () => {
-    let reentrant: Promise<void> | undefined
-    const children = createCollection<Row, number>({
-      id: `health-deferred-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      startSync: false,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: () => {
-              if (!reentrant) {
-                reentrant = children.reload()
-                reentrant.catch(() => undefined)
-              }
-              return true
-            },
-          }
-        },
-      },
-    })
-    expect(children._deferSyncStart()).toBe(true)
-    const query = createLiveQueryCollection((q) => q.from({ row: children }))
-    void query.preload().catch(() => undefined)
-    await flushPromises()
-    children._resumeSyncStart()
-    await flushPromises()
-    expect(reentrant, `the deferred load ran`).toBeDefined()
-    await expect(reentrant).rejects.toBeInstanceOf(
-      CollectionReloadDuringSyncEntryError,
-    )
-    await query.cleanup()
-    await children.cleanup()
-  })
-  // Q6 (review 2): cleanup run from a subscription's status listener while
-  // a reload retires the run ends that reload with its run. A later fresh
-  // start then has the rows it loads as its diff baseline: no reload's
-  // replacement is armed (law 14: cleanup discards the run's state).
-  it(`a cleanup run while a reload retires the run leaves no replacement armed`, async () => {
-    let params!: SyncParams
-    let syncCalls = 0
-    const source = createCollection<Row, number>({
-      id: `health-reentrant-cleanup-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (next) => {
-          syncCalls++
-          params = next
-          next.markReady()
-          return { loadSubset: () => new Promise<void>(() => {}) }
-        },
-      },
-    })
-    await source.preload()
-    const subscription = source.subscribeChanges(() => {}, {
-      includeInitialState: true,
-    })
-    subscription.requestSnapshot({
-      where: undefined as never,
-      optimizedOnly: false,
-    } as never)
-    let cleanup: Promise<void> | undefined
-    subscription.on(`status:change`, () => {
-      cleanup ??= source.cleanup().catch(() => undefined)
-    })
-    void source.reload().catch(() => undefined)
-    await cleanup
-    await flushPromises()
-    expect(syncCalls, `the ended reload starts no sync run`).toBe(1)
-    subscription.unsubscribe()
-    await source.preload()
-    params.begin()
-    params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-    params.commit()
-    await flushPromises()
-    expect(cleanup, `the listener ran during the reload`).toBeDefined()
-    expect(
-      [...source._state.acceptedSyncedEntries()].map(([key]) => key),
-      `the fresh run's diff baseline`,
-    ).toEqual([1])
-    await source.cleanup()
-  })
-  // The generated replay of the witness above: a cleanup from the query's
-  // subscription's status listener while the reload replays its demand,
-  // for each cleanup form.
+  // The generated replay of the fixed cleanup witness in source-health.test.ts:
+  // a cleanup from the query's subscription's status listener while the
+  // reload replays its demand, for each cleanup form.
   it.each([false, true])(
     `a cleanup from a subscription's status listener during a reload leaves no replacement armed (dependents: %s)`,
     (dependents) =>
@@ -8484,41 +6945,6 @@ describe(`lazy join demand grammar`, () => {
         ending: { at: `subscription-status`, dependents },
       }),
   )
-  // Q7 (review 2): a reload's new run that calls markReady() while a
-  // transaction is open completes the reload and keeps the rows, and the
-  // open transaction still commits on top of them.
-  it(`markReady() during a reload with an open write keeps the write committable`, async () => {
-    let params!: SyncParams
-    const source = createCollection<Row, number>({
-      id: `health-direct-ready-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (next) => {
-          params = next
-          if (source.status === `loading`) {
-            next.begin()
-            next.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-            next.commit()
-            next.markReady()
-          }
-        },
-      },
-    })
-    await source.preload()
-    const reload = source.reload()
-    params.begin()
-    params.write({ type: `insert`, value: { id: 2, parentId: 2 } })
-    params.markReady()
-    expect(
-      () => params.write({ type: `insert`, value: { id: 3, parentId: 3 } }),
-      `the open transaction still takes writes`,
-    ).not.toThrow()
-    expect(() => params.commit(), `the open write still commits`).not.toThrow()
-    await reload
-    expect(source.toArray.map((row) => row.id)).toEqual([1, 2, 3])
-    await source.cleanup()
-  })
   const lazyReach = createOracleReach(
     `source-health.lazy-demand`,
     lazyReachStates,
@@ -8699,643 +7125,6 @@ describe(`lazy join demand grammar`, () => {
   )
 })
 
-// ---------------------------------------------------------------------------
-// Effect lane
-// ---------------------------------------------------------------------------
-
-/**
- * An Effect works the same as a query. Its initial-query readiness is its
- * initial load: every
- * initial load has settled and every eager source is ready, whether or not it
- * has `skipInitial`. `skipInitial` only decides whether the initial rows are
- * delivered. As for a live query, a crashed source ends the Effect through
- * `onSourceError` at any time, and a source whose first load fails ends it
- * before its initial-query readiness. An on-demand source can fail its first
- * load after that readiness, because the readiness follows the Effect's
- * settled loads; like every other source problem after it, that is a sync
- * problem on the source's node: it does not dispose the Effect, and
- * `onHealthChange` receives the health tree, with one node per source alias.
- *
- * The lane crosses `skipInitial`, the source mode, and when the source fails.
- * Before initial-query readiness, an eager source has not called `markReady()`, and an
- * on-demand source still has its first load pending. After it, the
- * source calls `fail()`, which fails the first load of an on-demand source
- * still in its initial sync and sets the `error` of an eager source after
- * Collection readiness, or it crashes, or it reaches Collection readiness
- * (on-demand only) and then reports a `failureReason`. Every history also checks that one change reaches
- * `onHealthChange` once: no two reported trees are the same object. The app
- * knows the tree the gate opens on, announced or not (laws 16 and 17), so a
- * healthy gate announces nothing, and each later change is one call.
- */
-describe(`effect errors`, () => {
-  type EffectHistory = {
-    skipInitial: boolean
-    syncMode: `eager` | `on-demand`
-    failure:
-      | `before gate`
-      | `fail after gate`
-      | `crash after gate`
-      | `report after gate`
-      | `problem before the Effect`
-  }
-  const histories: Array<EffectHistory> = [true, false].flatMap((skipInitial) =>
-    ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
-      (
-        [
-          `before gate`,
-          `fail after gate`,
-          `crash after gate`,
-          `report after gate`,
-          `problem before the Effect`,
-        ] as const
-      ).map((failure) => ({ skipInitial, syncMode, failure })),
-    ),
-  )
-
-  it.each(histories)(`%j`, async ({ skipInitial, syncMode, failure }) => {
-    let params!: SyncParams
-    let settleLoad = () => {}
-    const writeRow = () => {
-      params.begin()
-      params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-      params.commit()
-    }
-    const source = createCollection<Row, number>({
-      id: `health-effect-${syncMode}-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode,
-      gcTime: 0,
-      sync: {
-        sync: (next) => {
-          params = next
-          if (syncMode === `eager`) return undefined
-          return {
-            loadSubset: () =>
-              new Promise<void>((resolve) => {
-                settleLoad = () => {
-                  writeRow()
-                  resolve()
-                }
-              }),
-          }
-        },
-      },
-    })
-    const sourceErrors: Array<Error> = []
-    const trees: Array<HealthNode> = []
-    const delivered: Array<unknown> = []
-    const startEffect = () =>
-      createEffect({
-        query: (q) => q.from({ row: source }),
-        skipInitial,
-        onBatch: (events) => {
-          delivered.push(...events.map((event) => event.key))
-        },
-        onSourceError: (error) => sourceErrors.push(error),
-        onHealthChange: (health) => trees.push(health),
-      })
-    const consoleError = console.error
-    console.error = () => {}
-    // A source can already be ready and report a problem when the Effect is
-    // created. Law 16: after the Effect's initial-query readiness, a sync
-    // problem reaches onHealthChange, so the gate reports the tree it opens
-    // on once (law 17: every change is announced).
-    if (failure === `problem before the Effect`) {
-      void source.preload()
-      await flushPromises()
-      if (syncMode === `eager`) {
-        writeRow()
-        params.markReady()
-      } else params.markReady()
-      await flushPromises()
-      params.reportError(new Error(`stalled`))
-    }
-    const effect = startEffect()
-    try {
-      await flushPromises()
-      if (failure === `problem before the Effect`) {
-        if (syncMode === `on-demand`) settleLoad()
-        await flushPromises()
-        expect(effect.disposed).toBe(false)
-        expect(trees, `the gate reports the problem once`).toHaveLength(1)
-        expect(trees[0]).toMatchObject({
-          hasErrors: true,
-          sources: [{ alias: `row`, failureReason: { message: `stalled` } }],
-        })
-        return
-      }
-      if (failure === `before gate`) {
-        params.fail(new Error(`gave up`))
-        await flushPromises()
-        // Model: the Effect never reached initial-query readiness, so the failure
-        // ends it.
-        expect(effect.disposed).toBe(true)
-        expect(sourceErrors).toHaveLength(1)
-        expect(trees).toEqual([])
-        return
-      }
-      // Reach initial-query readiness: the eager source becomes ready, or the on-demand
-      // source's first load settles.
-      if (syncMode === `eager`) {
-        writeRow()
-        params.markReady()
-      } else {
-        settleLoad()
-      }
-      await flushPromises()
-      // Model: only `skipInitial` withholds the initial rows.
-      expect(delivered).toEqual(skipInitial ? [] : [1])
-      // The status change that completes the gate is part of the gate's
-      // tree, not a change after it.
-      expect(trees, `a healthy gate announces nothing`).toEqual([])
-
-      if (failure === `report after gate`) {
-        // An on-demand source reaches its own Collection readiness after the
-        // Effect's: a status change that must reach onHealthChange once.
-        if (syncMode === `on-demand`) params.markReady()
-        await flushPromises()
-        params.reportError(new Error(`stalled`))
-        await flushPromises()
-        expect(effect.disposed).toBe(false)
-        expect(trees.at(-1)).toMatchObject({
-          hasErrors: true,
-          sources: [
-            {
-              alias: `row`,
-              failureReason: { message: `stalled` },
-              error: null,
-            },
-          ],
-        })
-        expect(new Set(trees).size, `one report per change`).toBe(trees.length)
-        // The on-demand source's own readiness is one change, the report
-        // another.
-        expect(trees, `one call per change`).toHaveLength(
-          syncMode === `on-demand` ? 2 : 1,
-        )
-        return
-      }
-      if (failure === `crash after gate`) {
-        params.collection._lifecycle.crash(new Error(`crashed`))
-      } else {
-        params.fail(new Error(`gave up`))
-      }
-      await flushPromises()
-      // Model: only a crash ends the Effect after its gate. A failed first
-      // load of an on-demand source and an eager source's fail after
-      // Collection readiness are both the source node's `error`.
-      const ends = failure === `crash after gate`
-      expect(effect.disposed).toBe(ends)
-      expect(sourceErrors).toHaveLength(ends ? 1 : 0)
-      expect(new Set(trees).size, `one report per change`).toBe(trees.length)
-      if (!ends) expect(trees, `one call per change`).toHaveLength(1)
-      if (!ends) {
-        expect(trees.at(-1)).toMatchObject({
-          kind: `live-query`,
-          hasErrors: true,
-          sources: [
-            {
-              alias: `row`,
-              status: syncMode === `on-demand` ? `error` : `ready`,
-              failureReason: null,
-              error: { message: `gave up` },
-            },
-          ],
-        })
-      }
-    } finally {
-      console.error = consoleError
-      await effect.dispose()
-      await source.cleanup()
-    }
-  })
-})
-
-// Where an Effect's gate opens must not change what it announces. The gate
-// can open when the Effect starts (every source already ready), inside a
-// source's `status:change` (an eager source, a nested query, or a join's
-// second source becomes ready after the Effect), or when a load settles (an
-// on-demand source). The app knows the tree the gate opens on, announced or
-// not (laws 16 and 17). Model: after a healthy gate `onHealthChange` has had
-// no call, and the next change is exactly one call with the changed facts.
-// The on-demand row makes its source ready after the gate, a real change on
-// the source's node, so an Effect that suppresses a real first change fails.
-describe(`effect healthy gate`, () => {
-  type Opener =
-    | `eager source ready after the Effect`
-    | `eager source ready before the Effect`
-    | `on-demand first load settles`
-    | `nested query ready after the Effect`
-    | `second join source ready after the Effect`
-  const openers: Array<Opener> = [
-    `eager source ready after the Effect`,
-    `eager source ready before the Effect`,
-    `on-demand first load settles`,
-    `nested query ready after the Effect`,
-    `second join source ready after the Effect`,
-  ]
-  it.each(openers)(`%s`, async (opener) => {
-    const syncMode =
-      opener === `on-demand first load settles` ? `on-demand` : `eager`
-    const sources = [`a`, `b`].map((name) => {
-      const state: { params?: SyncParams; settle: () => void } = {
-        settle: () => {},
-      }
-      const collection = createCollection<Row, number>({
-        id: `health-gate-${name}-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        syncMode: name === `a` ? syncMode : `eager`,
-        gcTime: 0,
-        sync: {
-          sync: (params) => {
-            state.params = params
-            params.begin()
-            params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-            params.commit()
-            if (name === `a` && syncMode === `on-demand`)
-              return {
-                loadSubset: () =>
-                  new Promise<void>((resolve) => {
-                    state.settle = resolve
-                  }),
-              }
-            return undefined
-          },
-        },
-      })
-      return { collection, state }
-    })
-    const [a, b] = sources as [(typeof sources)[0], (typeof sources)[0]]
-    const nested =
-      opener === `nested query ready after the Effect`
-        ? createLiveQueryCollection((q) => q.from({ row: a.collection }))
-        : undefined
-    const trees: Array<HealthNode> = []
-    const consoleError = console.error
-    console.error = () => {}
-    if (opener === `eager source ready before the Effect`) {
-      void a.collection.preload()
-      await flushPromises()
-      a.state.params!.markReady()
-      await flushPromises()
-    }
-    if (opener === `second join source ready after the Effect`) {
-      void a.collection.preload()
-      await flushPromises()
-      a.state.params!.markReady()
-      await flushPromises()
-    }
-    const effect = createEffect({
-      query: (q) =>
-        opener === `second join source ready after the Effect`
-          ? q
-              .from({ row: a.collection })
-              .join({ other: b.collection }, ({ row, other }) =>
-                eq(row.id, other.id),
-              )
-          : nested
-            ? q.from({ view: nested })
-            : q.from({ row: a.collection }),
-      onBatch: () => {},
-      onHealthChange: (health) => trees.push(health),
-    })
-    try {
-      await flushPromises()
-      // Open the gate.
-      if (opener === `on-demand first load settles`) a.state.settle()
-      else if (opener === `second join source ready after the Effect`)
-        b.state.params!.markReady()
-      else if (opener !== `eager source ready before the Effect`)
-        a.state.params!.markReady()
-      await flushPromises()
-      expect(effect.disposed).toBe(false)
-      expect(trees, `a healthy gate announces nothing`).toEqual([])
-      // One change after the gate: the on-demand source, still loading at
-      // the gate, becomes ready; every other source reports a problem.
-      if (opener === `on-demand first load settles`) a.state.params!.markReady()
-      else a.state.params!.reportError(new Error(`stalled`))
-      await flushPromises()
-      expect(trees, `one call for the change`).toHaveLength(1)
-      expect(trees[0]!.hasErrors).toBe(
-        opener !== `on-demand first load settles`,
-      )
-    } finally {
-      console.error = consoleError
-      await effect.dispose()
-      await nested?.cleanup().catch(() => undefined)
-      await a.collection.cleanup().catch(() => undefined)
-      await b.collection.cleanup().catch(() => undefined)
-    }
-  })
-})
-
-// The Effect lane above creates the Effect first. A source can already be in
-// `error` (its first load failed) or `crashed` when the Effect subscribes.
-// No status change follows, so the Effect must read the status when it
-// subscribes. Model: the Effect never reaches its gate, so either status ends
-// it through `onSourceError` once, and no tree is reported.
-describe(`effect over a source that already stopped`, () => {
-  const histories = ([`error`, `crashed`] as const).flatMap((status) =>
-    [true, false].map((skipInitial) => ({ status, skipInitial })),
-  )
-
-  it.each(histories)(`%j`, async ({ status, skipInitial }) => {
-    let loads = 0
-    const source = createCollection<Row, number>({
-      id: `health-effect-stopped-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      startSync: true,
-      syncMode: `on-demand`,
-      sync: {
-        sync: (params) => {
-          if (status === `error`) params.fail(new Error(`first load failed`))
-          else params.markReady()
-          return {
-            loadSubset: () => {
-              loads++
-              return true
-            },
-          }
-        },
-      },
-    })
-    await source.preload().catch(() => undefined)
-    if (status === `crashed`) source._lifecycle.crash(new Error(`crashed`))
-    expect(source.status).toBe(status)
-    const listeners = () =>
-      [
-        ...(
-          source as unknown as {
-            _events: { listeners: Map<string, Map<unknown, unknown>> }
-          }
-        )._events.listeners.values(),
-      ].reduce((sum, set) => sum + set.size, 0)
-    const listenersBefore = listeners()
-    const sourceErrors: Array<Error> = []
-    const trees: Array<HealthNode> = []
-    const consoleError = console.error
-    console.error = () => {}
-    const effect = createEffect({
-      query: (q) => q.from({ row: source }),
-      skipInitial,
-      onBatch: () => {},
-      onSourceError: (error) => sourceErrors.push(error),
-      onHealthChange: (health) => trees.push(health),
-    })
-    try {
-      await flushPromises()
-      expect(effect.disposed).toBe(true)
-      expect(sourceErrors).toHaveLength(1)
-      expect(trees).toEqual([])
-      // It ends before any subscription or load reaches the source, and it
-      // leaves no listener on it.
-      expect(loads, `loads issued to the stopped source`).toBe(0)
-      expect(source.subscriberCount).toBe(0)
-      expect(listeners(), `listeners left on the source`).toBe(listenersBefore)
-    } finally {
-      console.error = consoleError
-      await effect.dispose()
-      await source.cleanup()
-    }
-  })
-})
-
-/**
- * An Effect has no request errors: a load that fails after its gate, as
- * before it, ends the Effect through `onSourceError`, and no tree it reported
- * shows the failure. The parents lead the Effect, and a lazy join loads the
- * children each new parent row reaches. The lane crosses `skipInitial` with
- * the parents' source mode.
- */
-describe(`effect load failures`, () => {
-  type RequestHistory = {
-    skipInitial: boolean
-    parentMode: `eager` | `on-demand`
-  }
-  const histories: Array<RequestHistory> = [true, false].flatMap(
-    (skipInitial) =>
-      ([`eager`, `on-demand`] as const).map((parentMode) => ({
-        skipInitial,
-        parentMode,
-      })),
-  )
-
-  it.each(histories)(`%j`, async ({ skipInitial, parentMode }) => {
-    let parentParams!: SyncParams
-    const outcomes: Array<`ok` | `fail`> = []
-    const parents = createCollection<Row, number>({
-      id: `health-effect-parents-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: parentMode,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          parentParams = params
-          if (parentMode === `on-demand`) {
-            params.markReady()
-            return { loadSubset: () => Promise.resolve() }
-          }
-          return undefined
-        },
-      },
-    })
-    const children = createCollection<Row, number>({
-      id: `health-effect-children-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      syncMode: `on-demand`,
-      gcTime: 0,
-      sync: {
-        sync: (params) => {
-          params.markReady()
-          return {
-            loadSubset: () =>
-              (outcomes.shift() ?? `ok`) === `ok`
-                ? Promise.resolve()
-                : Promise.reject(new Error(`child load failed`)),
-          }
-        },
-      },
-    })
-    const writeParent = (id: number) => {
-      parentParams.begin()
-      parentParams.write({ type: `insert`, value: { id, parentId: id } })
-      parentParams.commit()
-    }
-    const sourceErrors: Array<Error> = []
-    const trees: Array<HealthNode> = []
-    const effect = createEffect({
-      query: (q) =>
-        q
-          .from({ parent: parents })
-          .leftJoin({ child: children }, ({ parent, child }) =>
-            eq(parent.id, child.parentId),
-          ),
-      skipInitial,
-      onBatch: () => {},
-      onSourceError: (error) => sourceErrors.push(error),
-      onHealthChange: (health) => trees.push(health),
-    })
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      await flushPromises()
-      writeParent(1)
-      if (parentMode === `eager`) parentParams.markReady()
-      await flushPromises()
-
-      // Model: after initial-query readiness, a failed load ends the Effect.
-      outcomes.push(`fail`)
-      writeParent(2)
-      await flushPromises()
-      expect(effect.disposed).toBe(true)
-      expect(sourceErrors.map((error) => error.message)).toEqual([
-        `child load failed`,
-      ])
-      expect(trees.every((tree) => tree.error === null)).toBe(true)
-    } finally {
-      console.error = consoleError
-      await effect.dispose()
-      await parents.cleanup()
-      await children.cleanup()
-    }
-  })
-})
-
-/**
- * Two includes that read one Collection under the same alias are two include
- * nodes, and the query fixes that shape, so a cleaned-up query keeps them. A
- * per-row child Collection that starts changes nothing in the tree, so it
- * emits no `health:change`; otherwise every new parent row would rebuild it.
- */
-// A pooled view's tree keeps node identity, as every tree does, whatever
-// alias its query gives the source, including the alias `root` that the
-// view's own node shows. The generated pooled shape uses one alias.
-describe(`pooled view node identity`, () => {
-  it.each([`row`, `root`])(`with source alias %s`, async (alias) => {
-    let params!: SyncParams
-    const source = createCollection<Row, number>({
-      id: `health-pooled-alias-${Math.random().toString(36).slice(2)}`,
-      getKey: (row) => row.id,
-      gcTime: 0,
-      sync: {
-        sync: (next) => {
-          params = next
-          next.begin()
-          next.write({ type: `insert`, value: { id: 1, parentId: 1 } })
-          next.commit()
-          next.markReady()
-        },
-      },
-    })
-    const view = createPooledLiveQuery(
-      new Query()
-        .from({ [alias]: source })
-        .where((refs) =>
-          eq(
-            (refs as Record<string, { parentId: number }>)[alias]!.parentId,
-            1,
-          ),
-        ) as unknown as Parameters<typeof createPooledLiveQuery>[0],
-    ) as unknown as PooledView
-    const subscription = view.subscribeChanges(() => {})
-    try {
-      await source.preload()
-      const first = view.health
-      expect(first.sources.map((node) => node.alias)).toEqual([alias])
-      expect(view.health, `a second read gives the same tree`).toBe(first)
-      params.reportError(new Error(`stalled`))
-      const reported = view.health
-      expect(reported).not.toBe(first)
-      expect(view.health, `the changed tree is stable too`).toBe(reported)
-      expect(reported.sources[0]!.failureReason?.message).toBe(`stalled`)
-    } finally {
-      subscription.unsubscribe()
-      await source.cleanup({ dependents: true })
-    }
-  })
-})
-
-describe(`include nodes`, () => {
-  it(`keep their shape, and healthy children change nothing`, async () => {
-    const make = (name: string) => {
-      let params!: SyncParams
-      const collection = createCollection<Row, number>({
-        id: `health-include-${name}-${Math.random().toString(36).slice(2)}`,
-        getKey: (row) => row.id,
-        gcTime: 0,
-        sync: {
-          sync: (next) => {
-            params = next
-          },
-        },
-      })
-      const write = (row: Row, type: `insert` | `delete` = `insert`) => {
-        params.begin()
-        params.write({ type, value: row })
-        params.commit()
-      }
-      return { collection, write, ready: () => params.markReady() }
-    }
-    const A = make(`A`)
-    const B = make(`B`)
-    const query = createLiveQueryCollection((q) =>
-      q.from({ b: B.collection }).select(({ b }) => ({
-        id: b.id,
-        items: include(
-          q.from({ a: A.collection }).where(({ a }) => eq(a.parentId, b.id)),
-        ),
-        same: include(
-          q.from({ a: A.collection }).where(({ a }) => eq(a.id, b.id)),
-        ),
-      })),
-    )
-    const consoleError = console.error
-    console.error = () => {}
-    try {
-      const preload = query.preload()
-      B.write({ id: 1, parentId: 1 })
-      B.write({ id: 2, parentId: 2 })
-      B.ready()
-      A.write({ id: 1, parentId: 1 })
-      A.ready()
-      await preload
-      const includes = () => query.health.sources.slice(1)
-      expect(includes().map((node) => [node.alias, node.kind])).toEqual([
-        [`a`, `include`],
-        [`a`, `include`],
-      ])
-
-      let events = 0
-      const stop = query.on(`health:change`, () => {
-        events++
-      })
-      // New parent rows start healthy child Collections. Every tree change is
-      // announced, so with no event the tree is the same object.
-      const treeBefore = query.health
-      B.write({ id: 3, parentId: 3 })
-      B.write({ id: 4, parentId: 4 })
-      await flushPromises()
-      stop()
-      expect(events, `healthy children emit no health:change`).toBe(0)
-      expect(query.health, `no tree change without an event`).toBe(treeBefore)
-
-      // The tree's shape comes from the query, so a cleaned-up query keeps
-      // its include nodes.
-      await query.cleanup()
-      expect(includes().map((node) => node.kind)).toEqual([
-        `include`,
-        `include`,
-      ])
-    } finally {
-      console.error = consoleError
-      await query.cleanup()
-      await A.collection.cleanup()
-      await B.collection.cleanup()
-    }
-  })
-})
-
 // ---------------------------------------------------------------------------
 // Request error bookkeeping
 // ---------------------------------------------------------------------------
diff --git a/packages/db/tests/source-health-support.ts b/packages/db/tests/source-health-support.ts
new file mode 100644
index 0000000000..3ec3999cfc
--- /dev/null
+++ b/packages/db/tests/source-health-support.ts
@@ -0,0 +1,103 @@
+/**
+ * The source Collections and observed-query types that the source failure and
+ * health oracle (source-health-oracle.test.ts) and its ordinary fixed tests
+ * (source-health.test.ts) share. The driver controls one source Collection's
+ * sync run, its adapter cleanup, and when its run calls `markReady()`.
+ */
+import { createCollection } from '../src/collection/index.js'
+import { createDeferred } from '../src/deferred.js'
+import type { Collection } from '../src/collection/index.js'
+import type { SyncConfig } from '../src/types.js'
+
+// `tag` names the write that produced a row, so a read shows which write
+// (and so which sync run) the row came from.
+export type Row = { id: number; parentId: number; tag?: number }
+export type SyncParams = Parameters<SyncConfig<Row, number>[`sync`]>[0]
+export type SourceName = `A` | `B`
+
+export function createSource(name: SourceName) {
+  let params: SyncParams | undefined
+  let failNextCleanup = false
+  // A held adapter cleanup stays pending until the driver settles it.
+  let held: ReturnType<typeof createDeferred<void>> | undefined
+  // The next cleanup, a reload's retired run's, stays pending until the
+  // driver rejects it.
+  let holdNextCleanup = false
+  let retiredHeld: ReturnType<typeof createDeferred<void>> | undefined
+  // The next sync run calls markReady() inside sync().
+  let readyInSync = false
+  // Sync runs the adapter was asked to start, and those whose cleanup it was
+  // asked to run: the difference is the runs still live at the adapter.
+  const runs = { started: 0, ended: 0 }
+  const collection = createCollection<Row, number>({
+    id: `health-oracle-${name}-${Math.random().toString(36).slice(2)}`,
+    getKey: (row) => row.id,
+    startSync: false,
+    gcTime: 0,
+    sync: {
+      sync: (next) => {
+        params = next
+        runs.started++
+        if (readyInSync) {
+          readyInSync = false
+          next.markReady()
+        }
+        return () => {
+          runs.ended++
+          if (held) return held.promise
+          if (holdNextCleanup) {
+            holdNextCleanup = false
+            retiredHeld ??= createDeferred<void>()
+            return retiredHeld.promise
+          }
+          if (!failNextCleanup) return
+          failNextCleanup = false
+          return Promise.reject(new Error(`${name} cleanup failed`))
+        }
+      },
+    },
+  })
+  return {
+    collection,
+    liveRuns: () => runs.started - runs.ended,
+    failNextCleanup: (armed = true) => {
+      failNextCleanup = armed
+    },
+    holdNextCleanup: (armed = true) => {
+      holdNextCleanup = armed
+    },
+    markReadyInNextSync: (armed = true) => {
+      readyInSync = armed
+    },
+    rejectRetiredCleanup: () => {
+      retiredHeld?.reject(new Error(`${name} cleanup failed`))
+      retiredHeld = undefined
+    },
+    holdCleanup: () => {
+      held ??= createDeferred<void>()
+    },
+    settleCleanup: () => {
+      held?.resolve()
+      held = undefined
+    },
+    get params(): SyncParams {
+      if (!params) throw new Error(`source ${name} has not started`)
+      return params
+    },
+  }
+}
+
+// The observed query and how the driver starts and measures it. A live-query
+// Collection starts with a preload; a pooled view starts when it has a
+// subscriber, as an observer would subscribe.
+export type Subject = {
+  query: Pick<Collection<any, any>, `status` | `health` | `on` | `cleanup`>
+  inner?: Collection<any, any>
+  start: () => void
+  size: () => number
+}
+
+export type PooledView = Subject[`query`] & {
+  subscribeChanges: (listener: () => void) => { unsubscribe: () => void }
+  entries: () => Iterable<unknown>
+}
diff --git a/packages/db/tests/source-health.test.ts b/packages/db/tests/source-health.test.ts
new file mode 100644
index 0000000000..913d1639c8
--- /dev/null
+++ b/packages/db/tests/source-health.test.ts
@@ -0,0 +1,2175 @@
+/**
+ * Ordinary fixed scenarios for source failure and the health tree. Each test
+ * runs one written history and compares production with values written in the
+ * test, so no declared check or model reaches it. The law, its model, and its
+ * generated histories are owned by source-health-oracle.test.ts. These fixed
+ * tests have no oracle owner (tracked in TanStack/db#2264).
+ */
+import { describe, expect, it } from 'vitest'
+import { createCollection, findProblems } from '../src/collection/index.js'
+import { createLiveQueryCollection } from '../src/query/live-query-collection.js'
+import { createEffect } from '../src/query/effect.js'
+import { createPooledLiveQuery } from '../src/query/pooled-live-query.js'
+import { Query } from '../src/query/builder/index.js'
+import { eq, isUndefined, not } from '../src/query/builder/functions.js'
+import { include } from '../src/query/builder/include-functions.js'
+import { CollectionReloadDuringSyncEntryError } from '../src/errors.js'
+import { BTreeIndex } from '../src/indexes/btree-index.js'
+import { createDeferred } from '../src/deferred.js'
+import { captureMicrotaskErrors, flushPromises } from './utils.js'
+import { createSource } from './source-health-support.js'
+import type {
+  CollectionStatus,
+  HealthNode,
+  LoadSubsetOptions,
+} from '../src/types.js'
+import type { PooledView, Row, SyncParams } from './source-health-support.js'
+
+// ---------------------------------------------------------------------------
+// Request lane
+// ---------------------------------------------------------------------------
+
+/**
+ * A live query's lazy source loads only the keys its rows reach, and an
+ * on-demand root source loads the window the query shows. After the query's
+ * initial-query readiness, a load that fails is a request error on the query's own node:
+ * the source stays healthy and the query keeps its status. A lazy demand's
+ * error clears when the same demand later settles, or when the query stops
+ * needing it; a root source's error clears when a later load of that source
+ * settles. Before initial-query readiness, the same failure fails the query's sync run.
+ */
+// ---------------------------------------------------------------------------
+// Reload invariant witness
+// ---------------------------------------------------------------------------
+
+// A reload retires its sync run, and the retired run's `commit()` can no
+// longer reach a transaction it left open. That transaction has no public
+// observation (its writes never apply), so this witness checks the
+// invariant directly: after the reload no transaction stays open, and the
+// new run's own commit decides the row.
+// ---------------------------------------------------------------------------
+// Problem values
+// ---------------------------------------------------------------------------
+
+/**
+ * `fail()`, `reportError()`, and a crash accept any value as the problem. The
+ * law: the value never changes what the call does. Status, node, and a
+ * reload's promise follow the same rules as for an `Error`, and the node's
+ * problem keeps the value as its `cause`. A value that cannot describe
+ * itself (no prototype, a throwing getter) shows the generic message. The
+ * lane crosses each call site with each kind of value.
+ */
+describe(`problem values`, () => {
+  const values: Record<string, () => unknown> = {
+    error: () => new Error(`gave up`),
+    string: () => `gave up`,
+    'no prototype': () => Object.create(null),
+    'throwing getter': () => ({
+      get code() {
+        throw new Error(`getter`)
+      },
+      toString() {
+        throw new Error(`toString`)
+      },
+    }),
+  }
+  const sites = [
+    `fail before ready`,
+    `fail after ready`,
+    `fail during a reload`,
+    `reportError`,
+    `crash`,
+  ] as const
+  const cases = sites.flatMap((site) =>
+    Object.keys(values).map((value) => ({ site, value })),
+  )
+  it.each(cases)(`%j`, async ({ site, value }) => {
+    let params!: SyncParams
+    const collection = createCollection<Row, number>({
+      id: `health-problem-value-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (next) => {
+          params = next
+        },
+      },
+    })
+    const problem = values[value]!()
+    void collection.preload().catch(() => undefined)
+    await flushPromises()
+    let reload: Promise<void> | undefined
+    if (site !== `fail before ready`) {
+      params.markReady()
+      if (site === `fail during a reload`) {
+        reload = collection.reload()
+        void reload.catch(() => undefined)
+      }
+    }
+    if (site === `reportError`) params.reportError(problem)
+    else if (site === `crash`) collection._lifecycle.crash(problem)
+    else params.fail(problem)
+    await flushPromises()
+    const shown =
+      site === `fail before ready` || site === `crash`
+        ? collection.health.error
+        : site === `reportError`
+          ? collection.health.failureReason
+          : collection.health.error
+    expect(collection.status).toBe(
+      site === `fail before ready`
+        ? `error`
+        : site === `crash`
+          ? `crashed`
+          : `ready`,
+    )
+    expect(shown?.cause, `the node keeps the value`).toBe(problem)
+    expect(typeof shown?.message).toBe(`string`)
+    // One call is one failure in the problem's frame, and it is the one the
+    // problem shows. JSON keeps every failure's facts and leaves out causes.
+    expect(shown?.errors.length, `one failure listed`).toBe(1)
+    expect(shown?.errors[0]?.cause, `the listed failure's value`).toBe(problem)
+    const facts = JSON.parse(JSON.stringify(shown!.errors[0]))
+    expect(facts, `JSON leaves out the cause`).not.toHaveProperty(`cause`)
+    expect(JSON.parse(JSON.stringify(shown))).toEqual({
+      ...facts,
+      errors: [facts],
+    })
+    if (reload)
+      await expect(reload, `a failed reload settles`).rejects.toBe(problem)
+    await collection.cleanup()
+  })
+})
+
+describe(`reload invariant`, () => {
+  // A query's reload() settles with the query: after its failed source
+  // recovers, the query reloads itself, and the reload waits for that run to
+  // be ready (or to fail).
+  it(`settles a query reload with the query's restarted run`, async () => {
+    let runs = 0
+    const loads: Array<ReturnType<typeof createDeferred<void>>> = []
+    const parents = createCollection<Row, number>({
+      id: `health-query-reload-parents-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          if (runs++ === 0) {
+            params.fail(new Error(`first load failed`))
+            return
+          }
+          params.begin()
+          params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+          params.commit()
+          params.markReady()
+        },
+      },
+    })
+    const children = createCollection<Row, number>({
+      id: `health-query-reload-children-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: () => {
+              const load = createDeferred<void>()
+              loads.push(load)
+              return load.promise
+            },
+          }
+        },
+      },
+    })
+    const query = createLiveQueryCollection((q) =>
+      q
+        .from({ parent: parents })
+        .leftJoin({ child: children }, ({ parent, child }) =>
+          eq(parent.id, child.parentId),
+        ),
+    )
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await query.preload().catch(() => undefined)
+      expect(query.status).toBe(`error`)
+      let settled = false
+      const reload = query.reload().finally(() => {
+        settled = true
+      })
+      await flushPromises()
+      // The query's own reload waits for its join load: it keeps `error` and
+      // shows `reloading`, and the reload waits too.
+      expect(query.status).toBe(`error`)
+      expect(query.health.reloading).toBe(true)
+      expect(settled, `reload settled before the query's run was ready`).toBe(
+        false,
+      )
+      for (const load of loads) load.resolve()
+      await reload
+      expect(query.status).toBe(`ready`)
+    } finally {
+      console.error = consoleError
+      for (const load of loads) load.resolve()
+      await query.cleanup()
+      await parents.cleanup()
+      await children.cleanup()
+    }
+  })
+
+  // A throwing sync function is a programming error in any run. During a
+  // reload of a failed first load the status still shows `error`, but this
+  // run did not fail, so the throw crashes the Collection.
+  it(`crashes when a reload's sync function throws after a failed first load`, async () => {
+    let runs = 0
+    const collection = createCollection<Row, number>({
+      id: `health-reload-throw-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          if (runs++ === 0) params.fail(new Error(`first load failed`))
+          else throw new Error(`sync threw`)
+        },
+      },
+    })
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await collection.preload().catch(() => undefined)
+      expect(collection.status).toBe(`error`)
+      await expect(collection.reload()).rejects.toThrow(`sync threw`)
+      expect(collection.status).toBe(`crashed`)
+      expect(collection.health.reloading).toBe(false)
+    } finally {
+      console.error = consoleError
+      await collection.cleanup()
+    }
+  })
+
+  // A snapshot replaces every synced row, so inside it the baseline an
+  // adapter diffs against is empty. An adapter that writes only rows missing
+  // from the baseline, as Query Collections do, then rebuilds every row, and
+  // the rows the snapshot does not write go.
+  it(`gives a diffing adapter an empty baseline inside a reload's snapshot`, async () => {
+    const source = createSource(`A`)
+    source.collection.startSyncImmediate()
+    const writeMissing = (rows: Array<Row>, snapshot: boolean) => {
+      const params = source.params
+      params.begin(snapshot ? { snapshot } : undefined)
+      const baseline = new Map(params.collection._state.acceptedSyncedEntries())
+      for (const row of rows)
+        if (!baseline.has(row.id)) params.write({ type: `insert`, value: row })
+      params.commit()
+      params.markReady()
+    }
+    writeMissing(
+      [
+        { id: 1, parentId: 1 },
+        { id: 2, parentId: 2 },
+      ],
+      false,
+    )
+    const reload = source.collection.reload()
+    writeMissing([{ id: 1, parentId: 1 }], true)
+    await reload
+    expect([...source.collection.keys()]).toEqual([1])
+    await source.collection.cleanup()
+  })
+
+  // Cleanup start closes restart admission (ARCHITECTURE law 14), and a
+  // reload starts a sync run. While adapter cleanup is pending, a reload
+  // rejects as a start would, and no sync run starts under the cleanup.
+  it(`rejects a reload while adapter cleanup is pending`, async () => {
+    let runs = 0
+    const adapterCleanup = createDeferred<void>()
+    const collection = createCollection<Row, number>({
+      id: `health-reload-during-cleanup-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          runs++
+          params.markReady()
+          return () => adapterCleanup.promise
+        },
+      },
+    })
+    await collection.preload()
+    const cleaned = collection.cleanup()
+    await expect(collection.reload()).rejects.toThrow(/during cleanup/)
+    expect(runs).toBe(1)
+    adapterCleanup.resolve()
+    await cleaned
+    expect(collection.status).toBe(`cleaned-up`)
+    expect(runs).toBe(1)
+  })
+
+  // Cleanup start drops the discarded run's problems while the status waits
+  // for adapter cleanup. Every change to the tree is announced, so the drop
+  // is too: the last health:change before the status change shows no
+  // problem. The cause of a `crashed` or `error` status stays while that
+  // status shows.
+  it.each([`report`, `fail`, `crash`, `first-load-error`] as const)(
+    `announces the problems that cleanup start drops: %s`,
+    async (problem) => {
+      const adapterCleanup = createDeferred<void>()
+      let params!: SyncParams
+      const collection = createCollection<Row, number>({
+        id: `health-cleanup-drop-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: (next) => {
+            params = next
+            if (problem === `first-load-error`)
+              next.fail(new Error(`first load failed`))
+            else next.markReady()
+            return () => adapterCleanup.promise
+          },
+        },
+      })
+      await collection.preload().catch(() => undefined)
+      if (problem === `report`) params.reportError(new Error(`stalled`))
+      else if (problem === `fail`) params.fail(new Error(`stopped`))
+      else if (problem === `crash`)
+        collection._lifecycle.crash(new Error(`crashed`))
+      const announced: Array<HealthNode> = []
+      collection.on(`health:change`, () => announced.push(collection.health))
+      const cleaned = collection.cleanup()
+      // A status's own cause stays while that status shows.
+      const keepsCause = problem === `crash` || problem === `first-load-error`
+      expect(collection.status).toBe(
+        problem === `crash`
+          ? `crashed`
+          : problem === `first-load-error`
+            ? `error`
+            : `ready`,
+      )
+      if (keepsCause) {
+        expect(collection.health.error?.message).toBe(
+          problem === `crash` ? `crashed` : `first load failed`,
+        )
+        expect(announced).toEqual([])
+      } else {
+        expect(collection.health.hasErrors).toBe(false)
+        expect(announced.at(-1)?.hasErrors).toBe(false)
+      }
+      adapterCleanup.resolve()
+      await cleaned
+      expect(collection.status).toBe(`cleaned-up`)
+      expect(collection.health.hasErrors).toBe(false)
+    },
+  )
+
+  // A ready callback that throws reaches the adapter's markReady() when the
+  // adapter calls it after sync() returns. Inside sync() it reaches no caller,
+  // so core reports it uncaught (maintainer decision). The reload itself
+  // succeeded once the status is ready, so it resolves either way.
+  it.each([`sync`, `async`] as const)(
+    `settles a reload whose ready callback throws: %s markReady`,
+    async (timing) => {
+      let runs = 0
+      const collection = createCollection<Row, number>({
+        id: `health-reload-ready-throw-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            if (runs++ === 0) {
+              params.fail(new Error(`first load failed`))
+              return
+            }
+            if (timing === `sync`) params.markReady()
+            else
+              setTimeout(() => {
+                expect(() => params.markReady()).toThrow(`callback threw`)
+              }, 0)
+          },
+        },
+      })
+      await collection.preload().catch(() => undefined)
+      const failure = new Error(`callback threw`)
+      collection.onFirstReady(() => {
+        throw failure
+      })
+      const uncaught = captureMicrotaskErrors()
+      const settled = await Promise.race([
+        collection.reload().then(
+          () => `resolved`,
+          () => `rejected`,
+        ),
+        new Promise((resolve) => setTimeout(() => resolve(`pending`), 200)),
+      ])
+      uncaught.restore()
+      expect(uncaught.errors).toEqual(timing === `sync` ? [failure] : [])
+      expect(settled).toBe(`resolved`)
+      expect(collection.status).toBe(`ready`)
+      expect(collection.health.reloading).toBe(false)
+      await collection.cleanup()
+    },
+  )
+
+  // A live query that never started has no run yet. Its reload starts it,
+  // as any Collection's reload starts an idle one, after it reloads a source
+  // whose first load failed.
+  it.each([`ready`, `failed`] as const)(
+    `starts a never-started live query on reload: source %s`,
+    async (sourceState) => {
+      let runs = 0
+      const source = createCollection<Row, number>({
+        id: `health-idle-query-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        gcTime: 0,
+        startSync: true,
+        sync: {
+          sync: (params) => {
+            if (runs++ === 0 && sourceState === `failed`) {
+              params.fail(new Error(`first load failed`))
+              return
+            }
+            params.begin()
+            params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+            params.commit()
+            params.markReady()
+          },
+        },
+      })
+      await source.preload().catch(() => undefined)
+      const query = createLiveQueryCollection({
+        query: (q) => q.from({ row: source }),
+        startSync: false,
+      })
+      expect(query.status).toBe(`idle`)
+      try {
+        await query.reload()
+        expect(query.status).toBe(`ready`)
+        expect(query.size).toBe(1)
+        expect(source.status).toBe(`ready`)
+      } finally {
+        await query.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+
+  // A reload whose new run fails keeps the rows, so they stay the baseline
+  // that a diffing adapter, such as query-db, reads for its next write.
+  // A transaction the new run opened before it failed is no longer the
+  // reload's replacement: when it commits, its writes apply on the kept rows.
+  it.each([`no open transaction`, `an open transaction`] as const)(
+    `keeps the rows as the baseline after the reload's new run fails with %s`,
+    async (open) => {
+      const source = createSource(`A`)
+      source.collection.startSyncImmediate()
+      source.params.begin()
+      source.params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+      source.params.commit()
+      source.params.markReady()
+      const reload = source.collection.reload().catch(() => undefined)
+      if (open === `an open transaction`) {
+        source.params.begin()
+        source.params.write({ type: `insert`, value: { id: 2, parentId: 2 } })
+      }
+      source.params.fail(new Error(`reload failed`))
+      await reload
+      const baseline = [
+        ...source.params.collection._state.acceptedSyncedEntries(),
+      ]
+      expect(baseline.map(([key]) => key)).toEqual(
+        open === `an open transaction` ? [1, 2] : [1],
+      )
+      expect([...source.collection.keys()]).toEqual([1])
+      if (open === `an open transaction`) {
+        await source.params.commit()
+        expect([...source.collection.keys()].sort()).toEqual([1, 2])
+      }
+      expect(source.collection.status).toBe(`ready`)
+      expect(source.collection.health.error?.message).toBe(`reload failed`)
+      await source.collection.cleanup()
+    },
+  )
+
+  // A canceled commit never happened, and the reload's other writes apply on
+  // the kept rows: without a snapshot, the reload ends at markReady() with
+  // every row it kept.
+  it(`keeps the rows through a canceled reload commit without a snapshot`, async () => {
+    const source = createSource(`A`)
+    source.collection.startSyncImmediate()
+    const first = source.params
+    first.begin()
+    first.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+    first.commit()
+    first.markReady()
+    const reload = source.collection.reload()
+    const next = source.params
+    const canceled = new AbortController()
+    canceled.abort()
+    next.begin()
+    next.write({ type: `insert`, value: { id: 3, parentId: 3 } })
+    try {
+      next.commit(canceled.signal)
+    } catch {
+      // A canceled commit may throw its abort reason.
+    }
+    // The run continues at once, before the canceled receipt settles.
+    next.begin()
+    next.write({ type: `insert`, value: { id: 2, parentId: 2 } })
+    next.commit()
+    next.markReady()
+    await reload
+    expect(source.collection.health.reloading).toBe(false)
+    expect([...source.collection.keys()].sort()).toEqual([1, 2])
+    await source.collection.cleanup()
+  })
+
+  it(`drops the retired run's open sync transaction`, async () => {
+    const source = createSource(`A`)
+    source.collection.startSyncImmediate()
+    const first = source.params
+    first.begin()
+    first.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+    first.commit()
+    first.markReady()
+    first.begin()
+    first.write({ type: `insert`, value: { id: 2, parentId: 0 } })
+    const reload = source.collection.reload()
+    const next = source.params
+    next.begin()
+    next.write({ type: `insert`, value: { id: 2, parentId: 2 } })
+    next.commit()
+    next.markReady()
+    await reload
+    expect(
+      source.collection._state.pendingSyncedTransactions.filter(
+        (transaction) => !transaction.committed,
+      ),
+    ).toEqual([])
+    expect(source.collection.get(2)).toMatchObject({ id: 2, parentId: 2 })
+    await source.collection.cleanup()
+  })
+})
+
+describe(`request errors`, () => {
+  function createRequestHistory() {
+    let parentParams!: SyncParams
+    const outcomes: Array<`ok` | `fail` | `hold`> = []
+    const held: Array<ReturnType<typeof createDeferred<void>>> = []
+    const parents = createCollection<Row, number>({
+      id: `health-request-parents-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          parentParams = params
+        },
+      },
+    })
+    const children = createCollection<Row, number>({
+      id: `health-request-children-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: (_options: LoadSubsetOptions) => {
+              const outcome = outcomes.shift() ?? `ok`
+              if (outcome === `hold`) {
+                const load = createDeferred<void>()
+                held.push(load)
+                return load.promise
+              }
+              return outcome === `ok`
+                ? Promise.resolve()
+                : Promise.reject(new Error(`child load failed`))
+            },
+          }
+        },
+      },
+    })
+    const query = createLiveQueryCollection((q) =>
+      q
+        .from({ parent: parents })
+        .leftJoin({ child: children }, ({ parent, child }) =>
+          eq(parent.id, child.parentId),
+        ),
+    )
+    const writeParent = (type: `insert` | `delete`, id: number) => {
+      parentParams.begin()
+      parentParams.write({ type, value: { id, parentId: id } })
+      parentParams.commit()
+    }
+    const markParentsReady = () => parentParams.markReady()
+    return {
+      parents,
+      children,
+      query,
+      outcomes,
+      held,
+      writeParent,
+      markParentsReady,
+    }
+  }
+
+  async function withHistory(
+    run: (history: ReturnType<typeof createRequestHistory>) => Promise<void>,
+  ) {
+    const history = createRequestHistory()
+    expect(
+      history.query.health,
+      `the query exposes a health tree`,
+    ).toBeDefined()
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await run(history)
+    } finally {
+      console.error = consoleError
+      await history.query.cleanup()
+      await history.parents.cleanup()
+      await history.children.cleanup()
+    }
+  }
+
+  it(`a failed load after initial-query readiness is a request error that clears when its demand settles`, () =>
+    withHistory(
+      async ({ query, children, outcomes, writeParent, markParentsReady }) => {
+        const preload = query.preload()
+        writeParent(`insert`, 1)
+        markParentsReady()
+        await preload
+        expect(query.health.hasErrors).toBe(false)
+
+        outcomes.push(`fail`)
+        writeParent(`insert`, 2)
+        await flushPromises()
+        expect(query.status).toBe(`ready`)
+        expect(query.health.error).toMatchObject({
+          message: `child load failed`,
+        })
+        expect(query.health.failureReason).toBeNull()
+        expect(children.health.hasErrors).toBe(false)
+
+        // The demand changes again and its new load settles.
+        outcomes.push(`ok`)
+        writeParent(`insert`, 3)
+        await flushPromises()
+        expect(query.health.hasErrors).toBe(false)
+      },
+    ))
+
+  it(`a request error clears when the query stops needing the demand`, () =>
+    withHistory(async ({ query, outcomes, writeParent, markParentsReady }) => {
+      const preload = query.preload()
+      writeParent(`insert`, 1)
+      markParentsReady()
+      await preload
+
+      outcomes.push(`fail`)
+      writeParent(`insert`, 2)
+      await flushPromises()
+      expect(query.health.error).toMatchObject({ message: `child load failed` })
+
+      writeParent(`delete`, 1)
+      writeParent(`delete`, 2)
+      await flushPromises()
+      expect(query.health.hasErrors).toBe(false)
+      expect(query.status).toBe(`ready`)
+    }))
+
+  // A later load of the failed demand that fulfills clears its error, also
+  // when a reload issues it: a source's reload replays the query's demand,
+  // and the query's own reload loads it in a new run. The guide offers
+  // `reload()` for a node with an `error`, so the query's reload must reach
+  // a request error on its own node.
+  it.each([`source`, `query`] as const)(
+    `a request error clears when the %s reload loads the demand again`,
+    (reloaded) =>
+      withHistory(
+        async ({
+          query,
+          children,
+          outcomes,
+          writeParent,
+          markParentsReady,
+        }) => {
+          const preload = query.preload()
+          writeParent(`insert`, 1)
+          markParentsReady()
+          await preload
+
+          outcomes.push(`fail`)
+          writeParent(`insert`, 2)
+          await flushPromises()
+          expect(query.health.error).toMatchObject({
+            message: `child load failed`,
+          })
+
+          await (reloaded === `source` ? children : query).reload()
+          await flushPromises()
+          expect(query.health.hasErrors).toBe(false)
+          expect(query.status).toBe(`ready`)
+          expect(query.size).toBe(2)
+        },
+      ),
+  )
+
+  // A replay clears only what failed before it started (as LoadOrder does
+  // for root loads): a demand that fails while the replay is in flight keeps
+  // its error when the replay succeeds. The replay holds that failure with
+  // its publication, so it shows once the replay settles.
+  it(`a source reload's replay keeps a request error that failed after it started`, () =>
+    withHistory(
+      async ({
+        query,
+        children,
+        outcomes,
+        held,
+        writeParent,
+        markParentsReady,
+      }) => {
+        const preload = query.preload()
+        writeParent(`insert`, 1)
+        markParentsReady()
+        await preload
+
+        outcomes.push(`hold`)
+        const reload = children.reload()
+        await flushPromises()
+        expect(held, `the replay is in flight`).toHaveLength(1)
+
+        outcomes.push(`fail`)
+        writeParent(`insert`, 2)
+        await flushPromises()
+
+        held[0]!.resolve()
+        await reload
+        await flushPromises()
+        expect(query.health.error, `the later failure stays`).toMatchObject({
+          message: `child load failed`,
+        })
+      },
+    ))
+
+  it(`a failed load before initial-query readiness fails the query's sync run`, () =>
+    withHistory(async ({ query, outcomes, writeParent, markParentsReady }) => {
+      outcomes.push(`fail`)
+      const preload = query.preload()
+      void preload.catch(() => undefined)
+      writeParent(`insert`, 1)
+      markParentsReady()
+      await flushPromises()
+      expect(query.status).toBe(`error`)
+      expect(query.health.error).toMatchObject({ message: `child load failed` })
+      await expect(preload).rejects.toBeDefined()
+    }))
+})
+
+// A crash is not recovered in place: `reload()` rejects and nothing starts a
+// new sync run. Only cleanup leaves `crashed`, and cleanup discards all of
+// the Collection's state, so a later start is a fresh start, as a new
+// Collection over the same source would be. Model: after the cascade
+// cleanup and a new preload, the Collection and a query mounted again show
+// only the new run's rows and no problem.
+describe(`crash recovery`, () => {
+  it(`recovers a crashed Collection only through a full cleanup`, async () => {
+    let runs = 0
+    const collection = createCollection<Row, number>({
+      id: `health-crash-recovery-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          const run = ++runs
+          params.begin()
+          params.write({ type: `insert`, value: { id: run, parentId: run } })
+          params.commit()
+          params.markReady()
+        },
+      },
+    })
+    let query = createLiveQueryCollection((q) => q.from({ row: collection }))
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await query.preload()
+      collection._lifecycle.crash(new Error(`index broke`))
+      expect(query.status).toBe(`crashed`)
+
+      await expect(collection.reload()).rejects.toThrow(/crashed/)
+      await flushPromises()
+      expect(collection.status, `nothing recovers it in place`).toBe(`crashed`)
+      expect(runs).toBe(1)
+
+      await collection.cleanup({ dependents: true })
+      await collection.preload()
+      expect(runs).toBe(2)
+      expect(collection.status).toBe(`ready`)
+      expect(collection.toArray.map((row) => row.id)).toEqual([2])
+      expect(collection.health.hasErrors).toBe(false)
+
+      query = createLiveQueryCollection((q) => q.from({ row: collection }))
+      await query.preload()
+      expect(query.status).toBe(`ready`)
+      expect(query.toArray.map((row) => row.id)).toEqual([2])
+      expect(query.health.hasErrors).toBe(false)
+    } finally {
+      console.error = consoleError
+      await query.cleanup()
+      await collection.cleanup({ dependents: true })
+    }
+  })
+})
+
+// A query whose first load failed waits for `reload()`: another source
+// becoming ready does not restart it, and its failed load is not retried. The
+// main grammar fails only sources, so this lane supplies the query's own
+// failure.
+describe(`a query's own failed first load`, () => {
+  it(`does not restart when an unrelated source becomes ready`, async () => {
+    let loads = 0
+    const children = createCollection<Row, number>({
+      id: `health-own-children-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              return new Promise<void>((_, reject) =>
+                setTimeout(() => reject(new Error(`child load failed`)), 0),
+              )
+            },
+          }
+        },
+      },
+    })
+    const parents = createSource(`B`)
+    parents.collection.startSyncImmediate()
+    const query = createLiveQueryCollection((q) =>
+      q
+        .from({ child: children })
+        .where(({ child }) => eq(child.parentId, 1))
+        .join({ parent: parents.collection }, ({ child, parent }) =>
+          eq(child.parentId, parent.id),
+        ),
+    )
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      void query.preload().catch(() => undefined)
+      await flushPromises()
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(query.status).toBe(`error`)
+      expect(query.health.error).toMatchObject({ message: `child load failed` })
+      const loadsAtFailure = loads
+      parents.params.markReady()
+      await flushPromises()
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(query.status).toBe(`error`)
+      expect(loads).toBe(loadsAtFailure)
+    } finally {
+      console.error = consoleError
+      await query.cleanup()
+      await parents.collection.cleanup()
+      await children.cleanup()
+    }
+  })
+
+  // The query's own reload starts a new run while the status still shows the
+  // failed first load. That run is in its first load too, so its outcome
+  // decides the reload: a load that fails again fails it (status `error`,
+  // the new cause), and a graph that throws crashes the query.
+  it.each([`ok`, `load-fails`, `graph-throws`] as const)(
+    `settles the query's reload with its new run: %s`,
+    async (outcome) => {
+      const answers: Array<`fail` | `ok`> = [
+        `fail`,
+        outcome === `load-fails` ? `fail` : `ok`,
+      ]
+      const source = createCollection<Row, number>({
+        id: `health-own-reload-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            params.markReady()
+            return {
+              loadSubset: () => {
+                const answer = answers.shift() ?? `ok`
+                if (answer === `fail`)
+                  return Promise.reject(
+                    new Error(`load ${2 - answers.length} failed`),
+                  )
+                // The rows arrive after the run's sync entry, so a graph
+                // that throws on them does so in a later graph run.
+                return Promise.resolve().then(() => {
+                  params.begin()
+                  params.write({
+                    type: `insert`,
+                    value: { id: 1, parentId: 1 },
+                  })
+                  params.commit()
+                })
+              },
+            }
+          },
+        },
+      })
+      const query = createLiveQueryCollection((q) =>
+        q.from({ row: source }).fn.select(({ row }) => {
+          if (outcome === `graph-throws`) throw new Error(`select threw`)
+          return row
+        }),
+      )
+      const consoleError = console.error
+      console.error = () => {}
+      try {
+        await query.preload().catch(() => undefined)
+        expect(query.status).toBe(`error`)
+        const settled = await Promise.race([
+          query.reload().then(
+            () => `resolved`,
+            () => `rejected`,
+          ),
+          new Promise((resolve) => setTimeout(() => resolve(`pending`), 200)),
+        ])
+        expect(settled).toBe(outcome === `ok` ? `resolved` : `rejected`)
+        expect(query.status).toBe(
+          outcome === `ok`
+            ? `ready`
+            : outcome === `load-fails`
+              ? `error`
+              : `crashed`,
+        )
+        expect(query.health.reloading).toBe(false)
+        if (outcome === `ok`) expect(query.size).toBe(1)
+        if (outcome === `load-fails`)
+          expect(query.health.error?.message).toContain(`load 2 failed`)
+      } finally {
+        console.error = consoleError
+        await query.cleanup()
+        await source.cleanup()
+      }
+    },
+  )
+})
+
+// An ordered window that filters on a lazily joined source waits for its join
+// loads before it moves. A join load that fails after readiness is a request
+// error on the query's node, and it settles that demand: the window must not
+// wait for it for good. A later move loads, moves the window, and clears the
+// error. Every marker row exists from the start, so only the load fails.
+describe(`a failed join load under an ordered filtered window`, () => {
+  // Q1 (review 2): while the join load is pending, the query holds its
+  // output. When the load fails, the failure settles that demand (law 16),
+  // so the held output publishes at once: a change made meanwhile, which
+  // needs no other join load, shows without waiting for some later change.
+  it.each([`left`, `inner`] as const)(
+    `publishes a change held behind a failed join load (%s join)`,
+    async (join) => {
+      let rootParams!: SyncParams
+      const pendingLoads: Array<ReturnType<typeof createDeferred<void>>> = []
+      let holdLoads = false
+      const roots = createCollection<
+        { id: number; rank: number; label?: string },
+        number
+      >({
+        id: `health-held-roots-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            rootParams = params as unknown as SyncParams
+            params.begin()
+            for (let id = 1; id <= 10; id++)
+              params.write({ type: `insert`, value: { id, rank: id } })
+            params.commit()
+            params.markReady()
+          },
+        },
+      })
+      const markers = createCollection<{ id: number; rootId: number }, number>({
+        id: `health-held-markers-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            params.begin()
+            for (let id = 1; id <= 10; id++)
+              params.write({
+                type: `insert`,
+                value: { id: 100 + id, rootId: id },
+              })
+            params.commit()
+            params.markReady()
+            return {
+              loadSubset: () => {
+                if (!holdLoads) return Promise.resolve()
+                const load = createDeferred<void>()
+                pendingLoads.push(load)
+                return load.promise
+              },
+            }
+          },
+        },
+      })
+      const query = createLiveQueryCollection((q) => {
+        const from = q.from({ root: roots })
+        const joined =
+          join === `left`
+            ? from.leftJoin({ marker: markers }, ({ root, marker }) =>
+                eq(root.id, marker.rootId),
+              )
+            : from.join({ marker: markers }, ({ root, marker }) =>
+                eq(root.id, marker.rootId),
+              )
+        return joined
+          .where(({ marker }) => not(isUndefined(marker.id)))
+          .orderBy(({ root }) => root.rank)
+          .limit(2)
+      })
+      const subscription = query.subscribeChanges(() => {})
+      const consoleError = console.error
+      console.error = () => {}
+      const ids = () => query.toArray.map((row: any) => row.root.id as number)
+      try {
+        await query.preload()
+        expect(ids()).toEqual([1, 2])
+        holdLoads = true
+        // A new root asks the lazy join for its marker; the load is held.
+        rootParams.begin()
+        rootParams.write({
+          type: `insert`,
+          value: { id: 11, rank: 0 },
+        } as never)
+        rootParams.commit()
+        await flushPromises()
+        expect(
+          pendingLoads.length,
+          `the new root waits for a join load`,
+        ).toBeGreaterThan(0)
+        // Root 2 is visible and its marker is loaded: its update needs no
+        // join load.
+        rootParams.begin()
+        rootParams.write({
+          type: `update`,
+          value: { id: 2, rank: 2, label: `edited` },
+        } as never)
+        rootParams.commit()
+        await flushPromises()
+        for (const load of pendingLoads.splice(0))
+          load.reject(new Error(`marker load failed`))
+        await flushPromises()
+        expect(pendingLoads, `no join load is pending`).toEqual([])
+        expect(query.status).toBe(`ready`)
+        expect(query.health.error).toMatchObject({
+          message: `marker load failed`,
+        })
+        expect(ids(), `the window keeps its rows`).toEqual([1, 2])
+        expect(
+          (query.toArray[1] as any).root.label,
+          `the held change publishes after the failure`,
+        ).toBe(`edited`)
+      } finally {
+        console.error = consoleError
+        subscription.unsubscribe()
+        await query.cleanup()
+        await roots.cleanup()
+        await markers.cleanup()
+      }
+    },
+  )
+
+  it.each([`left`, `inner`] as const)(
+    `lets a later window move (%s join)`,
+    async (join) => {
+      let failLoads = false
+      const roots = createCollection<{ id: number; rank: number }, number>({
+        id: `health-window-roots-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            params.begin()
+            for (let id = 1; id <= 10; id++)
+              params.write({ type: `insert`, value: { id, rank: id } })
+            params.commit()
+            params.markReady()
+          },
+        },
+      })
+      const markers = createCollection<{ id: number; rootId: number }, number>({
+        id: `health-window-markers-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            params.begin()
+            for (let id = 1; id <= 10; id++)
+              params.write({
+                type: `insert`,
+                value: { id: 100 + id, rootId: id },
+              })
+            params.commit()
+            params.markReady()
+            return {
+              loadSubset: () =>
+                failLoads
+                  ? Promise.reject(new Error(`marker load failed`))
+                  : Promise.resolve(),
+            }
+          },
+        },
+      })
+      const query = createLiveQueryCollection((q) => {
+        const from = q.from({ root: roots })
+        const joined =
+          join === `left`
+            ? from.leftJoin({ marker: markers }, ({ root, marker }) =>
+                eq(root.id, marker.rootId),
+              )
+            : from.join({ marker: markers }, ({ root, marker }) =>
+                eq(root.id, marker.rootId),
+              )
+        return joined
+          .where(({ marker }) => not(isUndefined(marker.id)))
+          .orderBy(({ root }) => root.rank)
+          .limit(2)
+      })
+      const subscription = query.subscribeChanges(() => {})
+      const consoleError = console.error
+      console.error = () => {}
+      const ids = () => query.toArray.map((row: any) => row.root.id as number)
+      try {
+        await query.preload()
+        expect(ids()).toEqual([1, 2])
+
+        failLoads = true
+        await expect(
+          Promise.resolve(query.utils.setWindow({ offset: 4, limit: 2 })),
+        ).rejects.toThrow(`marker load failed`)
+        expect(query.status).toBe(`ready`)
+        expect(query.health.error).toMatchObject({
+          message: `marker load failed`,
+        })
+
+        failLoads = false
+        await query.utils.setWindow({ offset: 6, limit: 2 })
+        await flushPromises()
+        expect(ids(), `the window moves after the failure`).toEqual([7, 8])
+        expect(query.health.error, `the later load clears it`).toBeNull()
+        expect(query.status).toBe(`ready`)
+      } finally {
+        console.error = consoleError
+        subscription.unsubscribe()
+        await query.cleanup()
+        await roots.cleanup()
+        await markers.cleanup()
+      }
+    },
+  )
+})
+
+describe(`root request health`, () => {
+  it(`a failed root load after initial-query readiness is a request error that clears when a later load settles`, async () => {
+    const outcomes: Array<`ok` | `fail`> = []
+    const source = createCollection<Row, number>({
+      id: `health-root-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: () =>
+              (outcomes.shift() ?? `ok`) === `ok`
+                ? Promise.resolve()
+                : Promise.reject(new Error(`root load failed`)),
+          }
+        },
+      },
+    })
+    const query = createLiveQueryCollection((q) =>
+      q
+        .from({ row: source })
+        .orderBy(({ row }) => row.id)
+        .limit(2),
+    )
+    expect(query.health, `the query exposes a health tree`).toBeDefined()
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await query.preload()
+      expect(query.health.hasErrors).toBe(false)
+
+      outcomes.push(`fail`)
+      await Promise.resolve(
+        query.utils.setWindow({ offset: 4, limit: 2 }),
+      ).catch(() => undefined)
+      await flushPromises()
+      expect(query.status).toBe(`ready`)
+      expect(query.health.error).toMatchObject({ message: `root load failed` })
+      expect(source.health.hasErrors).toBe(false)
+
+      await query.utils.setWindow({ offset: 8, limit: 2 })
+      await flushPromises()
+      expect(query.health.hasErrors).toBe(false)
+    } finally {
+      console.error = consoleError
+      await query.cleanup()
+      await source.cleanup()
+    }
+  })
+})
+
+// ---------------------------------------------------------------------------
+// On-demand first load after query readiness
+// ---------------------------------------------------------------------------
+
+/**
+ * A live query over an on-demand Collection becomes ready when its subsets
+ * settle, so the Collection can still be in its first load when the query is
+ * ready. The generated Collections are eager and never reach this state.
+ * The laws are the ones above. After the query has shown data, only a crash
+ * changes its status. The Collection's own node shows its first-load failure
+ * (`error` status) or its stop after readiness (`ready` status, with an
+ * `error`). The query's `reload()` reloads the Collection, and the new run's
+ * readiness clears the node. A crashed query's `reload()` rejects.
+ *
+ * Histories cross the Collection's step (`fail` before its first ready,
+ * `fail` after a `markReady()`, or `crash`) with a direct query and an
+ * inner join to an eager Collection. Each history then calls the query's
+ * `reload()`. The model gives the node's status and error message, the
+ * query's status, and its row count at each cut.
+ */
+type LateFirstLoadHistory = {
+  step: `fail-before-ready` | `fail-after-ready` | `crash`
+  shape: `direct` | `join`
+}
+
+type LateFirstLoadCut = {
+  queryStatus: CollectionStatus
+  rows: number | null
+  node: { status: CollectionStatus; error: string | null }
+}
+
+function expectedLateFirstLoad(history: LateFirstLoadHistory): {
+  afterStep: LateFirstLoadCut
+  afterReload: LateFirstLoadCut | `rejects`
+} {
+  if (history.step === `crash`)
+    return {
+      afterStep: {
+        queryStatus: `crashed`,
+        rows: null,
+        node: { status: `crashed`, error: `stopped` },
+      },
+      afterReload: `rejects`,
+    }
+  return {
+    afterStep: {
+      queryStatus: `ready`,
+      rows: 1,
+      node: {
+        status: history.step === `fail-before-ready` ? `error` : `ready`,
+        error: `stopped`,
+      },
+    },
+    afterReload: {
+      queryStatus: `ready`,
+      rows: 1,
+      node: { status: `ready`, error: null },
+    },
+  }
+}
+
+describe(`on-demand first load after query readiness`, () => {
+  const histories: Array<LateFirstLoadHistory> = []
+  for (const step of [
+    `fail-before-ready`,
+    `fail-after-ready`,
+    `crash`,
+  ] as const)
+    for (const shape of [`direct`, `join`] as const)
+      histories.push({ step, shape })
+
+  it.each(histories)(`step $step, shape $shape`, async (history) => {
+    let runs = 0
+    let firstRun!: SyncParams
+    const lazy = createCollection<Row, number>({
+      id: `health-late-first-load-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          // The first run stays in its first load; a reload's run is ready.
+          if (runs++ === 0) firstRun = params
+          else params.markReady()
+          return {
+            loadSubset: () => {
+              params.begin()
+              params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+              params.commit()
+              return true
+            },
+          }
+        },
+      },
+    })
+    const eager = createCollection<Row, number>({
+      id: `health-late-first-load-eager-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          params.begin()
+          params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+          params.commit()
+          params.markReady()
+        },
+      },
+    })
+    const query = createLiveQueryCollection((q) =>
+      history.shape === `direct`
+        ? q.from({ lazy })
+        : q
+            .from({ eager })
+            .join({ lazy }, ({ eager, lazy }) => eq(eager.id, lazy.id)),
+    )
+    const lazyNode = () =>
+      query.health.sources.find((node) => node.alias === `lazy`)!
+    const cut = (): LateFirstLoadCut => ({
+      queryStatus: query.status,
+      rows: query.status === `ready` ? query.size : null,
+      node: {
+        status: lazyNode().status,
+        error: lazyNode().error?.message ?? null,
+      },
+    })
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await query.preload()
+      // Premise: the query is ready while the Collection is still loading.
+      expect(lazy.status).toBe(`loading`)
+      expect(query.size).toBe(1)
+
+      const model = expectedLateFirstLoad(history)
+      const stopped = new Error(`stopped`)
+      if (history.step === `crash`)
+        firstRun.collection._lifecycle.crash(stopped)
+      else {
+        if (history.step === `fail-after-ready`) firstRun.markReady()
+        firstRun.fail(stopped)
+      }
+      await flushPromises()
+      expect(cut(), `after the step`).toEqual(model.afterStep)
+      expect(
+        findProblems(query.health).some((node) => node.alias === `lazy`),
+      ).toBe(true)
+
+      if (model.afterReload === `rejects`) {
+        await expect(query.reload()).rejects.toBeDefined()
+        expect(runs, `a crashed query does not reload its sources`).toBe(1)
+      } else {
+        await query.reload()
+        await flushPromises()
+        expect(cut(), `after the query's reload`).toEqual(model.afterReload)
+        expect(findProblems(query.health)).toEqual([])
+      }
+    } finally {
+      console.error = consoleError
+      await query.cleanup()
+      await lazy.cleanup()
+      await eager.cleanup()
+    }
+  })
+})
+
+describe(`lazy join demand grammar`, () => {
+  // Q4 (review 2): a load that waited for a deferred start (DbClient
+  // hydration defers a start through this seam) runs the adapter's
+  // loadSubset when the start resumes. A reload from inside that call
+  // rejects, as from any loadSubset call.
+  it(`a reload from inside a deferred loadSubset rejects`, async () => {
+    let reentrant: Promise<void> | undefined
+    const children = createCollection<Row, number>({
+      id: `health-deferred-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      startSync: false,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: () => {
+              if (!reentrant) {
+                reentrant = children.reload()
+                reentrant.catch(() => undefined)
+              }
+              return true
+            },
+          }
+        },
+      },
+    })
+    expect(children._deferSyncStart()).toBe(true)
+    const query = createLiveQueryCollection((q) => q.from({ row: children }))
+    void query.preload().catch(() => undefined)
+    await flushPromises()
+    children._resumeSyncStart()
+    await flushPromises()
+    expect(reentrant, `the deferred load ran`).toBeDefined()
+    await expect(reentrant).rejects.toBeInstanceOf(
+      CollectionReloadDuringSyncEntryError,
+    )
+    await query.cleanup()
+    await children.cleanup()
+  })
+
+  // Q6 (review 2): cleanup run from a subscription's status listener while
+  // a reload retires the run ends that reload with its run. A later fresh
+  // start then has the rows it loads as its diff baseline: no reload's
+  // replacement is armed (law 14: cleanup discards the run's state).
+  it(`a cleanup run while a reload retires the run leaves no replacement armed`, async () => {
+    let params!: SyncParams
+    let syncCalls = 0
+    const source = createCollection<Row, number>({
+      id: `health-reentrant-cleanup-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (next) => {
+          syncCalls++
+          params = next
+          next.markReady()
+          return { loadSubset: () => new Promise<void>(() => {}) }
+        },
+      },
+    })
+    await source.preload()
+    const subscription = source.subscribeChanges(() => {}, {
+      includeInitialState: true,
+    })
+    subscription.requestSnapshot({
+      where: undefined as never,
+      optimizedOnly: false,
+    } as never)
+    let cleanup: Promise<void> | undefined
+    subscription.on(`status:change`, () => {
+      cleanup ??= source.cleanup().catch(() => undefined)
+    })
+    void source.reload().catch(() => undefined)
+    await cleanup
+    await flushPromises()
+    expect(syncCalls, `the ended reload starts no sync run`).toBe(1)
+    subscription.unsubscribe()
+    await source.preload()
+    params.begin()
+    params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+    params.commit()
+    await flushPromises()
+    expect(cleanup, `the listener ran during the reload`).toBeDefined()
+    expect(
+      [...source._state.acceptedSyncedEntries()].map(([key]) => key),
+      `the fresh run's diff baseline`,
+    ).toEqual([1])
+    await source.cleanup()
+  })
+
+  // Q7 (review 2): a reload's new run that calls markReady() while a
+  // transaction is open completes the reload and keeps the rows, and the
+  // open transaction still commits on top of them.
+  it(`markReady() during a reload with an open write keeps the write committable`, async () => {
+    let params!: SyncParams
+    const source = createCollection<Row, number>({
+      id: `health-direct-ready-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (next) => {
+          params = next
+          if (source.status === `loading`) {
+            next.begin()
+            next.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+            next.commit()
+            next.markReady()
+          }
+        },
+      },
+    })
+    await source.preload()
+    const reload = source.reload()
+    params.begin()
+    params.write({ type: `insert`, value: { id: 2, parentId: 2 } })
+    params.markReady()
+    expect(
+      () => params.write({ type: `insert`, value: { id: 3, parentId: 3 } }),
+      `the open transaction still takes writes`,
+    ).not.toThrow()
+    expect(() => params.commit(), `the open write still commits`).not.toThrow()
+    await reload
+    expect(source.toArray.map((row) => row.id)).toEqual([1, 2, 3])
+    await source.cleanup()
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Effect lane
+// ---------------------------------------------------------------------------
+
+/**
+ * An Effect works the same as a query. Its initial-query readiness is its
+ * initial load: every
+ * initial load has settled and every eager source is ready, whether or not it
+ * has `skipInitial`. `skipInitial` only decides whether the initial rows are
+ * delivered. As for a live query, a crashed source ends the Effect through
+ * `onSourceError` at any time, and a source whose first load fails ends it
+ * before its initial-query readiness. An on-demand source can fail its first
+ * load after that readiness, because the readiness follows the Effect's
+ * settled loads; like every other source problem after it, that is a sync
+ * problem on the source's node: it does not dispose the Effect, and
+ * `onHealthChange` receives the health tree, with one node per source alias.
+ *
+ * The lane crosses `skipInitial`, the source mode, and when the source fails.
+ * Before initial-query readiness, an eager source has not called `markReady()`, and an
+ * on-demand source still has its first load pending. After it, the
+ * source calls `fail()`, which fails the first load of an on-demand source
+ * still in its initial sync and sets the `error` of an eager source after
+ * Collection readiness, or it crashes, or it reaches Collection readiness
+ * (on-demand only) and then reports a `failureReason`. Every history also checks that one change reaches
+ * `onHealthChange` once: no two reported trees are the same object. The app
+ * knows the tree the gate opens on, announced or not (laws 16 and 17), so a
+ * healthy gate announces nothing, and each later change is one call.
+ */
+describe(`effect errors`, () => {
+  type EffectHistory = {
+    skipInitial: boolean
+    syncMode: `eager` | `on-demand`
+    failure:
+      | `before gate`
+      | `fail after gate`
+      | `crash after gate`
+      | `report after gate`
+      | `problem before the Effect`
+  }
+  const histories: Array<EffectHistory> = [true, false].flatMap((skipInitial) =>
+    ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
+      (
+        [
+          `before gate`,
+          `fail after gate`,
+          `crash after gate`,
+          `report after gate`,
+          `problem before the Effect`,
+        ] as const
+      ).map((failure) => ({ skipInitial, syncMode, failure })),
+    ),
+  )
+
+  it.each(histories)(`%j`, async ({ skipInitial, syncMode, failure }) => {
+    let params!: SyncParams
+    let settleLoad = () => {}
+    const writeRow = () => {
+      params.begin()
+      params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+      params.commit()
+    }
+    const source = createCollection<Row, number>({
+      id: `health-effect-${syncMode}-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode,
+      gcTime: 0,
+      sync: {
+        sync: (next) => {
+          params = next
+          if (syncMode === `eager`) return undefined
+          return {
+            loadSubset: () =>
+              new Promise<void>((resolve) => {
+                settleLoad = () => {
+                  writeRow()
+                  resolve()
+                }
+              }),
+          }
+        },
+      },
+    })
+    const sourceErrors: Array<Error> = []
+    const trees: Array<HealthNode> = []
+    const delivered: Array<unknown> = []
+    const startEffect = () =>
+      createEffect({
+        query: (q) => q.from({ row: source }),
+        skipInitial,
+        onBatch: (events) => {
+          delivered.push(...events.map((event) => event.key))
+        },
+        onSourceError: (error) => sourceErrors.push(error),
+        onHealthChange: (health) => trees.push(health),
+      })
+    const consoleError = console.error
+    console.error = () => {}
+    // A source can already be ready and report a problem when the Effect is
+    // created. Law 16: after the Effect's initial-query readiness, a sync
+    // problem reaches onHealthChange, so the gate reports the tree it opens
+    // on once (law 17: every change is announced).
+    if (failure === `problem before the Effect`) {
+      void source.preload()
+      await flushPromises()
+      if (syncMode === `eager`) {
+        writeRow()
+        params.markReady()
+      } else params.markReady()
+      await flushPromises()
+      params.reportError(new Error(`stalled`))
+    }
+    const effect = startEffect()
+    try {
+      await flushPromises()
+      if (failure === `problem before the Effect`) {
+        if (syncMode === `on-demand`) settleLoad()
+        await flushPromises()
+        expect(effect.disposed).toBe(false)
+        expect(trees, `the gate reports the problem once`).toHaveLength(1)
+        expect(trees[0]).toMatchObject({
+          hasErrors: true,
+          sources: [{ alias: `row`, failureReason: { message: `stalled` } }],
+        })
+        return
+      }
+      if (failure === `before gate`) {
+        params.fail(new Error(`gave up`))
+        await flushPromises()
+        // Model: the Effect never reached initial-query readiness, so the failure
+        // ends it.
+        expect(effect.disposed).toBe(true)
+        expect(sourceErrors).toHaveLength(1)
+        expect(trees).toEqual([])
+        return
+      }
+      // Reach initial-query readiness: the eager source becomes ready, or the on-demand
+      // source's first load settles.
+      if (syncMode === `eager`) {
+        writeRow()
+        params.markReady()
+      } else {
+        settleLoad()
+      }
+      await flushPromises()
+      // Model: only `skipInitial` withholds the initial rows.
+      expect(delivered).toEqual(skipInitial ? [] : [1])
+      // The status change that completes the gate is part of the gate's
+      // tree, not a change after it.
+      expect(trees, `a healthy gate announces nothing`).toEqual([])
+
+      if (failure === `report after gate`) {
+        // An on-demand source reaches its own Collection readiness after the
+        // Effect's: a status change that must reach onHealthChange once.
+        if (syncMode === `on-demand`) params.markReady()
+        await flushPromises()
+        params.reportError(new Error(`stalled`))
+        await flushPromises()
+        expect(effect.disposed).toBe(false)
+        expect(trees.at(-1)).toMatchObject({
+          hasErrors: true,
+          sources: [
+            {
+              alias: `row`,
+              failureReason: { message: `stalled` },
+              error: null,
+            },
+          ],
+        })
+        expect(new Set(trees).size, `one report per change`).toBe(trees.length)
+        // The on-demand source's own readiness is one change, the report
+        // another.
+        expect(trees, `one call per change`).toHaveLength(
+          syncMode === `on-demand` ? 2 : 1,
+        )
+        return
+      }
+      if (failure === `crash after gate`) {
+        params.collection._lifecycle.crash(new Error(`crashed`))
+      } else {
+        params.fail(new Error(`gave up`))
+      }
+      await flushPromises()
+      // Model: only a crash ends the Effect after its gate. A failed first
+      // load of an on-demand source and an eager source's fail after
+      // Collection readiness are both the source node's `error`.
+      const ends = failure === `crash after gate`
+      expect(effect.disposed).toBe(ends)
+      expect(sourceErrors).toHaveLength(ends ? 1 : 0)
+      expect(new Set(trees).size, `one report per change`).toBe(trees.length)
+      if (!ends) expect(trees, `one call per change`).toHaveLength(1)
+      if (!ends) {
+        expect(trees.at(-1)).toMatchObject({
+          kind: `live-query`,
+          hasErrors: true,
+          sources: [
+            {
+              alias: `row`,
+              status: syncMode === `on-demand` ? `error` : `ready`,
+              failureReason: null,
+              error: { message: `gave up` },
+            },
+          ],
+        })
+      }
+    } finally {
+      console.error = consoleError
+      await effect.dispose()
+      await source.cleanup()
+    }
+  })
+})
+
+// Where an Effect's gate opens must not change what it announces. The gate
+// can open when the Effect starts (every source already ready), inside a
+// source's `status:change` (an eager source, a nested query, or a join's
+// second source becomes ready after the Effect), or when a load settles (an
+// on-demand source). The app knows the tree the gate opens on, announced or
+// not (laws 16 and 17). Model: after a healthy gate `onHealthChange` has had
+// no call, and the next change is exactly one call with the changed facts.
+// The on-demand row makes its source ready after the gate, a real change on
+// the source's node, so an Effect that suppresses a real first change fails.
+describe(`effect healthy gate`, () => {
+  type Opener =
+    | `eager source ready after the Effect`
+    | `eager source ready before the Effect`
+    | `on-demand first load settles`
+    | `nested query ready after the Effect`
+    | `second join source ready after the Effect`
+  const openers: Array<Opener> = [
+    `eager source ready after the Effect`,
+    `eager source ready before the Effect`,
+    `on-demand first load settles`,
+    `nested query ready after the Effect`,
+    `second join source ready after the Effect`,
+  ]
+  it.each(openers)(`%s`, async (opener) => {
+    const syncMode =
+      opener === `on-demand first load settles` ? `on-demand` : `eager`
+    const sources = [`a`, `b`].map((name) => {
+      const state: { params?: SyncParams; settle: () => void } = {
+        settle: () => {},
+      }
+      const collection = createCollection<Row, number>({
+        id: `health-gate-${name}-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        syncMode: name === `a` ? syncMode : `eager`,
+        gcTime: 0,
+        sync: {
+          sync: (params) => {
+            state.params = params
+            params.begin()
+            params.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+            params.commit()
+            if (name === `a` && syncMode === `on-demand`)
+              return {
+                loadSubset: () =>
+                  new Promise<void>((resolve) => {
+                    state.settle = resolve
+                  }),
+              }
+            return undefined
+          },
+        },
+      })
+      return { collection, state }
+    })
+    const [a, b] = sources as [(typeof sources)[0], (typeof sources)[0]]
+    const nested =
+      opener === `nested query ready after the Effect`
+        ? createLiveQueryCollection((q) => q.from({ row: a.collection }))
+        : undefined
+    const trees: Array<HealthNode> = []
+    const consoleError = console.error
+    console.error = () => {}
+    if (opener === `eager source ready before the Effect`) {
+      void a.collection.preload()
+      await flushPromises()
+      a.state.params!.markReady()
+      await flushPromises()
+    }
+    if (opener === `second join source ready after the Effect`) {
+      void a.collection.preload()
+      await flushPromises()
+      a.state.params!.markReady()
+      await flushPromises()
+    }
+    const effect = createEffect({
+      query: (q) =>
+        opener === `second join source ready after the Effect`
+          ? q
+              .from({ row: a.collection })
+              .join({ other: b.collection }, ({ row, other }) =>
+                eq(row.id, other.id),
+              )
+          : nested
+            ? q.from({ view: nested })
+            : q.from({ row: a.collection }),
+      onBatch: () => {},
+      onHealthChange: (health) => trees.push(health),
+    })
+    try {
+      await flushPromises()
+      // Open the gate.
+      if (opener === `on-demand first load settles`) a.state.settle()
+      else if (opener === `second join source ready after the Effect`)
+        b.state.params!.markReady()
+      else if (opener !== `eager source ready before the Effect`)
+        a.state.params!.markReady()
+      await flushPromises()
+      expect(effect.disposed).toBe(false)
+      expect(trees, `a healthy gate announces nothing`).toEqual([])
+      // One change after the gate: the on-demand source, still loading at
+      // the gate, becomes ready; every other source reports a problem.
+      if (opener === `on-demand first load settles`) a.state.params!.markReady()
+      else a.state.params!.reportError(new Error(`stalled`))
+      await flushPromises()
+      expect(trees, `one call for the change`).toHaveLength(1)
+      expect(trees[0]!.hasErrors).toBe(
+        opener !== `on-demand first load settles`,
+      )
+    } finally {
+      console.error = consoleError
+      await effect.dispose()
+      await nested?.cleanup().catch(() => undefined)
+      await a.collection.cleanup().catch(() => undefined)
+      await b.collection.cleanup().catch(() => undefined)
+    }
+  })
+})
+
+// The Effect lane above creates the Effect first. A source can already be in
+// `error` (its first load failed) or `crashed` when the Effect subscribes.
+// No status change follows, so the Effect must read the status when it
+// subscribes. Model: the Effect never reaches its gate, so either status ends
+// it through `onSourceError` once, and no tree is reported.
+describe(`effect over a source that already stopped`, () => {
+  const histories = ([`error`, `crashed`] as const).flatMap((status) =>
+    [true, false].map((skipInitial) => ({ status, skipInitial })),
+  )
+
+  it.each(histories)(`%j`, async ({ status, skipInitial }) => {
+    let loads = 0
+    const source = createCollection<Row, number>({
+      id: `health-effect-stopped-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      startSync: true,
+      syncMode: `on-demand`,
+      sync: {
+        sync: (params) => {
+          if (status === `error`) params.fail(new Error(`first load failed`))
+          else params.markReady()
+          return {
+            loadSubset: () => {
+              loads++
+              return true
+            },
+          }
+        },
+      },
+    })
+    await source.preload().catch(() => undefined)
+    if (status === `crashed`) source._lifecycle.crash(new Error(`crashed`))
+    expect(source.status).toBe(status)
+    const listeners = () =>
+      [
+        ...(
+          source as unknown as {
+            _events: { listeners: Map<string, Map<unknown, unknown>> }
+          }
+        )._events.listeners.values(),
+      ].reduce((sum, set) => sum + set.size, 0)
+    const listenersBefore = listeners()
+    const sourceErrors: Array<Error> = []
+    const trees: Array<HealthNode> = []
+    const consoleError = console.error
+    console.error = () => {}
+    const effect = createEffect({
+      query: (q) => q.from({ row: source }),
+      skipInitial,
+      onBatch: () => {},
+      onSourceError: (error) => sourceErrors.push(error),
+      onHealthChange: (health) => trees.push(health),
+    })
+    try {
+      await flushPromises()
+      expect(effect.disposed).toBe(true)
+      expect(sourceErrors).toHaveLength(1)
+      expect(trees).toEqual([])
+      // It ends before any subscription or load reaches the source, and it
+      // leaves no listener on it.
+      expect(loads, `loads issued to the stopped source`).toBe(0)
+      expect(source.subscriberCount).toBe(0)
+      expect(listeners(), `listeners left on the source`).toBe(listenersBefore)
+    } finally {
+      console.error = consoleError
+      await effect.dispose()
+      await source.cleanup()
+    }
+  })
+})
+
+/**
+ * An Effect has no request errors: a load that fails after its gate, as
+ * before it, ends the Effect through `onSourceError`, and no tree it reported
+ * shows the failure. The parents lead the Effect, and a lazy join loads the
+ * children each new parent row reaches. The lane crosses `skipInitial` with
+ * the parents' source mode.
+ */
+describe(`effect load failures`, () => {
+  type RequestHistory = {
+    skipInitial: boolean
+    parentMode: `eager` | `on-demand`
+  }
+  const histories: Array<RequestHistory> = [true, false].flatMap(
+    (skipInitial) =>
+      ([`eager`, `on-demand`] as const).map((parentMode) => ({
+        skipInitial,
+        parentMode,
+      })),
+  )
+
+  it.each(histories)(`%j`, async ({ skipInitial, parentMode }) => {
+    let parentParams!: SyncParams
+    const outcomes: Array<`ok` | `fail`> = []
+    const parents = createCollection<Row, number>({
+      id: `health-effect-parents-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: parentMode,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          parentParams = params
+          if (parentMode === `on-demand`) {
+            params.markReady()
+            return { loadSubset: () => Promise.resolve() }
+          }
+          return undefined
+        },
+      },
+    })
+    const children = createCollection<Row, number>({
+      id: `health-effect-children-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      syncMode: `on-demand`,
+      gcTime: 0,
+      sync: {
+        sync: (params) => {
+          params.markReady()
+          return {
+            loadSubset: () =>
+              (outcomes.shift() ?? `ok`) === `ok`
+                ? Promise.resolve()
+                : Promise.reject(new Error(`child load failed`)),
+          }
+        },
+      },
+    })
+    const writeParent = (id: number) => {
+      parentParams.begin()
+      parentParams.write({ type: `insert`, value: { id, parentId: id } })
+      parentParams.commit()
+    }
+    const sourceErrors: Array<Error> = []
+    const trees: Array<HealthNode> = []
+    const effect = createEffect({
+      query: (q) =>
+        q
+          .from({ parent: parents })
+          .leftJoin({ child: children }, ({ parent, child }) =>
+            eq(parent.id, child.parentId),
+          ),
+      skipInitial,
+      onBatch: () => {},
+      onSourceError: (error) => sourceErrors.push(error),
+      onHealthChange: (health) => trees.push(health),
+    })
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      await flushPromises()
+      writeParent(1)
+      if (parentMode === `eager`) parentParams.markReady()
+      await flushPromises()
+
+      // Model: after initial-query readiness, a failed load ends the Effect.
+      outcomes.push(`fail`)
+      writeParent(2)
+      await flushPromises()
+      expect(effect.disposed).toBe(true)
+      expect(sourceErrors.map((error) => error.message)).toEqual([
+        `child load failed`,
+      ])
+      expect(trees.every((tree) => tree.error === null)).toBe(true)
+    } finally {
+      console.error = consoleError
+      await effect.dispose()
+      await parents.cleanup()
+      await children.cleanup()
+    }
+  })
+})
+
+/**
+ * Two includes that read one Collection under the same alias are two include
+ * nodes, and the query fixes that shape, so a cleaned-up query keeps them. A
+ * per-row child Collection that starts changes nothing in the tree, so it
+ * emits no `health:change`; otherwise every new parent row would rebuild it.
+ */
+// A pooled view's tree keeps node identity, as every tree does, whatever
+// alias its query gives the source, including the alias `root` that the
+// view's own node shows. The generated pooled shape uses one alias.
+describe(`pooled view node identity`, () => {
+  it.each([`row`, `root`])(`with source alias %s`, async (alias) => {
+    let params!: SyncParams
+    const source = createCollection<Row, number>({
+      id: `health-pooled-alias-${Math.random().toString(36).slice(2)}`,
+      getKey: (row) => row.id,
+      gcTime: 0,
+      sync: {
+        sync: (next) => {
+          params = next
+          next.begin()
+          next.write({ type: `insert`, value: { id: 1, parentId: 1 } })
+          next.commit()
+          next.markReady()
+        },
+      },
+    })
+    const view = createPooledLiveQuery(
+      new Query()
+        .from({ [alias]: source })
+        .where((refs) =>
+          eq(
+            (refs as Record<string, { parentId: number }>)[alias]!.parentId,
+            1,
+          ),
+        ) as unknown as Parameters<typeof createPooledLiveQuery>[0],
+    ) as unknown as PooledView
+    const subscription = view.subscribeChanges(() => {})
+    try {
+      await source.preload()
+      const first = view.health
+      expect(first.sources.map((node) => node.alias)).toEqual([alias])
+      expect(view.health, `a second read gives the same tree`).toBe(first)
+      params.reportError(new Error(`stalled`))
+      const reported = view.health
+      expect(reported).not.toBe(first)
+      expect(view.health, `the changed tree is stable too`).toBe(reported)
+      expect(reported.sources[0]!.failureReason?.message).toBe(`stalled`)
+    } finally {
+      subscription.unsubscribe()
+      await source.cleanup({ dependents: true })
+    }
+  })
+})
+
+describe(`include nodes`, () => {
+  it(`keep their shape, and healthy children change nothing`, async () => {
+    const make = (name: string) => {
+      let params!: SyncParams
+      const collection = createCollection<Row, number>({
+        id: `health-include-${name}-${Math.random().toString(36).slice(2)}`,
+        getKey: (row) => row.id,
+        gcTime: 0,
+        sync: {
+          sync: (next) => {
+            params = next
+          },
+        },
+      })
+      const write = (row: Row, type: `insert` | `delete` = `insert`) => {
+        params.begin()
+        params.write({ type, value: row })
+        params.commit()
+      }
+      return { collection, write, ready: () => params.markReady() }
+    }
+    const A = make(`A`)
+    const B = make(`B`)
+    const query = createLiveQueryCollection((q) =>
+      q.from({ b: B.collection }).select(({ b }) => ({
+        id: b.id,
+        items: include(
+          q.from({ a: A.collection }).where(({ a }) => eq(a.parentId, b.id)),
+        ),
+        same: include(
+          q.from({ a: A.collection }).where(({ a }) => eq(a.id, b.id)),
+        ),
+      })),
+    )
+    const consoleError = console.error
+    console.error = () => {}
+    try {
+      const preload = query.preload()
+      B.write({ id: 1, parentId: 1 })
+      B.write({ id: 2, parentId: 2 })
+      B.ready()
+      A.write({ id: 1, parentId: 1 })
+      A.ready()
+      await preload
+      const includes = () => query.health.sources.slice(1)
+      expect(includes().map((node) => [node.alias, node.kind])).toEqual([
+        [`a`, `include`],
+        [`a`, `include`],
+      ])
+
+      let events = 0
+      const stop = query.on(`health:change`, () => {
+        events++
+      })
+      // New parent rows start healthy child Collections. Every tree change is
+      // announced, so with no event the tree is the same object.
+      const treeBefore = query.health
+      B.write({ id: 3, parentId: 3 })
+      B.write({ id: 4, parentId: 4 })
+      await flushPromises()
+      stop()
+      expect(events, `healthy children emit no health:change`).toBe(0)
+      expect(query.health, `no tree change without an event`).toBe(treeBefore)
+
+      // The tree's shape comes from the query, so a cleaned-up query keeps
+      // its include nodes.
+      await query.cleanup()
+      expect(includes().map((node) => node.kind)).toEqual([
+        `include`,
+        `include`,
+      ])
+    } finally {
+      console.error = consoleError
+      await query.cleanup()
+      await A.collection.cleanup()
+      await B.collection.cleanup()
+    }
+  })
+})
diff --git a/packages/db/tests/ssr-snapshot-admission-oracle.ts b/packages/db/tests/ssr-snapshot-admission-oracle.ts
index 09a7129394..61f562e91e 100644
--- a/packages/db/tests/ssr-snapshot-admission-oracle.ts
+++ b/packages/db/tests/ssr-snapshot-admission-oracle.ts
@@ -1,4 +1,5 @@
 import { fc } from '@fast-check/vitest'
+import { declareOracle } from './oracle-declaration.js'
 
 /**
  * SSR may expose only a snapshot the first browser render can reproduce.
@@ -89,6 +90,8 @@ export function expectedSsrSnapshot(history: SsrSnapshotHistory) {
   } as const
 }
 
+declareOracle({ model: [expectedSsrSnapshot, expectedSsrRuntimeErrorViews] })
+
 // Named replays reconstruct the admission boundary before random shrinking can
 // stop a campaign at its first mismatch. They use the same driver and judgment.
 export const ssrSnapshotExamples: Array<SsrSnapshotHistory> = [
diff --git a/packages/db/tests/temporal-index-order-oracle.test.ts b/packages/db/tests/temporal-index-order.test.ts
similarity index 100%
rename from packages/db/tests/temporal-index-order-oracle.test.ts
rename to packages/db/tests/temporal-index-order.test.ts
diff --git a/packages/db/tests/transaction-ownership-oracle.property.test.ts b/packages/db/tests/transaction-ownership-oracle.property.test.ts
index 7c23a54102..1974b78f43 100644
--- a/packages/db/tests/transaction-ownership-oracle.property.test.ts
+++ b/packages/db/tests/transaction-ownership-oracle.property.test.ts
@@ -4,6 +4,7 @@ import { createCollection } from '../src/collection/index.js'
 import { createTransaction } from '../src/transactions.js'
 import { DuplicateTransactionIdError } from '../src/errors.js'
 import { oraclePropertyOptions, oracleRuns } from './oracle-config.js'
+import { declareOracle } from './oracle-declaration.js'
 import {
   captureCreatedTransactions,
   mockSyncCollectionOptionsNoInitialState,
@@ -741,6 +742,8 @@ async function runHistory(steps: ReadonlyArray<Step>): Promise<void> {
 
 const history = fc.array(step, { minLength: 1, maxLength: 24 })
 
+declareOracle({ check: [runHistory], model: [OwnershipModel] })
+
 describe(`settled transactions leave every Collection that tracked them`, () => {
   it(`generated histories with a fixed seed`, async () => {
     await fc.assert(
diff --git a/packages/db/tests/truncate-readiness-oracle.test.ts b/packages/db/tests/truncate-readiness-oracle.test.ts
index 240146abc0..8e918a8d3f 100644
--- a/packages/db/tests/truncate-readiness-oracle.test.ts
+++ b/packages/db/tests/truncate-readiness-oracle.test.ts
@@ -18,6 +18,7 @@
 import { expect, it } from 'vitest'
 import { createCollection } from '../src/collection/index.js'
 import { createDeferred } from '../src/deferred.js'
+import { declareOracle } from './oracle-declaration.js'
 import type { SyncConfig } from '../src/types.js'
 
 type Row = { id: number; value: string }
@@ -31,6 +32,46 @@ const cells = (['loading', 'ready'] as const).flatMap((status) =>
     ),
   ),
 )
+// The model: an authored replacement with `markReady: false` keeps the
+// current status; every other final intent makes the collection ready.
+function expectedReplacementStatus(
+  status: (typeof cells)[number][`status`],
+  last: Intent,
+): string {
+  return last === false ? status : 'ready'
+}
+
+// The check: every publication, and the committed status, follow the model.
+function expectReplacementStatus(
+  committed: string,
+  observed: ReadonlyArray<string>,
+  expectedStatus: string,
+): void {
+  expect.soft(committed).toBe(expectedStatus)
+  expect
+    .soft(
+      observed.every((value) => value === expectedStatus),
+      'status at publication',
+    )
+    .toBe(true)
+}
+
+// The model for reentrant batches: the final intent alone decides the status.
+// A `false` intent leaves the Collection loading; any other ends ready.
+function expectReentrantStatuses(
+  committed: string,
+  statuses: ReadonlyArray<string>,
+  last: Intent,
+): void {
+  expect(committed).toBe(last === false ? 'loading' : 'ready')
+  expect(statuses).toEqual(last === false ? [] : ['ready'])
+}
+
+declareOracle({
+  check: [expectReplacementStatus, expectReentrantStatuses],
+  model: [expectedReplacementStatus],
+})
+
 it.each(cells)(
   'replacement readiness follows the final authored intent: %j',
   async ({ status, held, first, last }) => {
@@ -74,14 +115,8 @@ it.each(cells)(
       truncate(last === undefined ? undefined : { markReady: last })
       sync.write({ type: 'insert', value: { id: 3, value: 'replacement' } })
       const receipt = sync.commit()
-      const expectedStatus = last === false ? status : 'ready'
-      expect.soft(c.status).toBe(expectedStatus)
-      expect
-        .soft(
-          observed.every((value) => value === expectedStatus),
-          'status at publication',
-        )
-        .toBe(true)
+      const expectedStatus = expectedReplacementStatus(status, last)
+      expectReplacementStatus(c.status, observed, expectedStatus)
       expect(
         [...c.base.values()].map((row) => ({ id: row.id, value: row.value })),
       ).toEqual([{ id: 3, value: 'replacement' }])
@@ -104,37 +139,6 @@ it.each(cells)(
   },
 )
 
-// After the initial error, the run's markReady() does nothing (maintainer
-// decision), so a replacement that promises readiness still applies its rows
-// and leaves the attempt in error.
-it.each(intents)(
-  'keeps the initial error under a ready-promising replacement: markReady %s',
-  async (markReady) => {
-    let sync!: Sync
-    const c = createCollection<Row, number>({
-      getKey: (row) => row.id,
-      startSync: true,
-      gcTime: Infinity,
-      sync: {
-        sync: (params) => {
-          sync = params
-        },
-      },
-    })
-    try {
-      sync.fail(new Error('initial sync failed'))
-      sync.begin()
-      sync.truncate(markReady === undefined ? undefined : { markReady })
-      sync.write({ type: 'insert', value: { id: 1, value: 'late' } })
-      expect(() => sync.commit()).not.toThrow()
-      expect(c.status).toBe('error')
-      expect([...c.keys()]).toEqual([1])
-    } finally {
-      await c.cleanup()
-    }
-  },
-)
-
 // Reentrant commits queue behind the publication currently notifying observers.
 // Their final replacement determines the next published batch, including its
 // readiness intent. An earlier replaced snapshot must not make that batch ready.
@@ -178,8 +182,7 @@ it.each(intents.flatMap((first) => intents.map((last) => ({ first, last }))))(
       sync.commit()
       await Promise.all(receipts)
       expect(entered).toBe(true)
-      expect(c.status).toBe(last === false ? 'loading' : 'ready')
-      expect(statuses).toEqual(last === false ? [] : ['ready'])
+      expectReentrantStatuses(c.status, statuses, last)
       expect([...c.keys()]).toEqual([3])
     } finally {
       subscription.unsubscribe()
diff --git a/packages/db/tests/truncate-readiness.test.ts b/packages/db/tests/truncate-readiness.test.ts
new file mode 100644
index 0000000000..4643c56e5d
--- /dev/null
+++ b/packages/db/tests/truncate-readiness.test.ts
@@ -0,0 +1,41 @@
+// Ordinary tests for truncate readiness after an initial sync error. They
+// compare production with written values. The replacement-readiness law and
+// its model are owned by truncate-readiness-oracle.test.ts.
+import { expect, it } from 'vitest'
+import { createCollection } from '../src/collection/index.js'
+import type { SyncConfig } from '../src/types.js'
+
+type Row = { id: number; value: string }
+type Sync = Parameters<SyncConfig<Row, number>['sync']>[0]
+const intents: Array<undefined | boolean> = [undefined, true, false]
+
+// After the initial error, the run's markReady() does nothing (maintainer
+// decision), so a replacement that promises readiness still applies its rows
+// and leaves the attempt in error.
+it.each(intents)(
+  'keeps the initial error under a ready-promising replacement: markReady %s',
+  async (markReady) => {
+    let sync!: Sync
+    const c = createCollection<Row, number>({
+      getKey: (row) => row.id,
+      startSync: true,
+      gcTime: Infinity,
+      sync: {
+        sync: (params) => {
+          sync = params
+        },
+      },
+    })
+    try {
+      sync.fail(new Error('initial sync failed'))
+      sync.begin()
+      sync.truncate(markReady === undefined ? undefined : { markReady })
+      sync.write({ type: 'insert', value: { id: 1, value: 'late' } })
+      expect(() => sync.commit()).not.toThrow()
+      expect(c.status).toBe('error')
+      expect([...c.keys()]).toEqual([1])
+    } finally {
+      await c.cleanup()
+    }
+  },
+)
diff --git a/packages/db/tests/utils-oracle.property.test.ts b/packages/db/tests/utils-oracle.property.test.ts
index 050b9bd6cc..322e197ef1 100644
--- a/packages/db/tests/utils-oracle.property.test.ts
+++ b/packages/db/tests/utils-oracle.property.test.ts
@@ -1,12 +1,20 @@
 import { describe, expect, it } from 'vitest'
 import { fc, test as fcTest } from '@fast-check/vitest'
 import { Temporal } from 'temporal-polyfill'
-import { deepEquals, equalPersistedSnapshotValues } from '../src/utils'
+import { deepEquals } from '../src/utils'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from './oracle-config.js'
+import {
+  assertDistinctTypes,
+  assertExtraProperty,
+  edgeCarriers,
+  expectCopyAndChanged,
+  expectEqualityPair,
+  expectRingLaw,
+} from './deep-equals-support'
 
 /**
  * The `deepEquals` API contract in `../src/utils.ts`, reinforced by the
@@ -34,7 +42,9 @@ import {
 // its fast-check shrink directly, for example with
 // `vitest run tests/utils-oracle.property.test.ts`.
 const fixedSeed = 20260911
+
 const campaignRuns = 100
+
 // Each property registers as `utils.<number>`, in file order. A path replay
 // selects one with TANSTACK_DB_ORACLE_PROPERTY=utils.<number>.
 let nextPropertyId = 0
@@ -71,6 +81,7 @@ const arbitraryPrimitive = fc.oneof(
 )
 
 const arbitraryDate = fc.date().map((d) => new Date(d.getTime()))
+
 const arbitraryFiniteDate = fc
   .integer({ min: -1_000_000_000_000, max: 2_000_000_000_000 })
   .map((time) => new Date(time))
@@ -140,15 +151,19 @@ const arbitrarySameTypePrimitive = fc.oneof(
 )
 
 const arbitrarySameTypeDate = fc.tuple(arbitraryDate, arbitraryDate)
+
 const arbitrarySameTypeRegExp = fc.tuple(arbitraryRegExp, arbitraryRegExp)
+
 const arbitrarySameTypeUint8Array = fc.tuple(
   arbitraryUint8Array,
   arbitraryUint8Array,
 )
+
 const arbitrarySameTypeTemporalDate = fc.tuple(
   arbitraryTemporalPlainDate,
   arbitraryTemporalPlainDate,
 )
+
 const arbitrarySameTypeTemporalDuration = fc.tuple(
   arbitraryTemporalDuration,
   arbitraryTemporalDuration,
@@ -184,9 +199,11 @@ const arbitrarySingleValue = fc.oneof(
   fc.array(fc.integer(), { maxLength: 5 }),
   fc.dictionary(fc.string(), fc.integer(), { maxKeys: 5 }),
 )
+
 const arbitraryNonNullValue = arbitrarySingleValue.filter(
   (value) => value !== null,
 )
+
 const arbitraryDefinedValue = arbitrarySingleValue.filter(
   (value) => value !== undefined,
 )
@@ -226,86 +243,11 @@ const arbitraryExtraProperty = fc
     return { original, key, value }
   })
 
-const edgeCarriers = [`object`, `array`, `map`, `symbol`] as const
-type EdgeCarrier = (typeof edgeCarriers)[number]
-type EqualityNode = { value: number; next?: unknown }
-
-// Construct corresponding rings, not an implementation of deep equality.
-// Every node is reachable; replacing one numeric payload must be observable.
-// Map keys/symbol keys are shared tokens, while all structural nodes are fresh.
-function equalityRing(
-  cells: ReadonlyArray<{ value: number; carrier: EdgeCarrier }>,
-  keys: ReadonlyArray<symbol>,
-): EqualityNode {
-  const nodes: Array<EqualityNode> = cells.map(({ value }) => ({ value }))
-  for (const [index, cell] of cells.entries()) {
-    const target = nodes[(index + 1) % nodes.length]!
-    switch (cell.carrier) {
-      case `object`:
-        nodes[index]!.next = { target }
-        break
-      case `array`:
-        nodes[index]!.next = [target]
-        break
-      case `map`:
-        nodes[index]!.next = new Map([[keys[index]!, target]])
-        break
-      case `symbol`:
-        nodes[index]!.next = { [keys[index]!]: target }
-        break
-    }
-  }
-  return nodes[0]!
-}
-
-function expectEqualityPair(
-  a: unknown,
-  b: unknown,
-  expected: boolean,
-  equal: (a: unknown, b: unknown) => boolean = deepEquals,
-): void {
-  expect(equal(a, b), `forward equality`).toBe(expected)
-  expect(equal(b, a), `reverse equality`).toBe(expected)
-}
-
-function expectCopyAndChanged(
-  original: unknown,
-  copy: unknown,
-  changed: unknown,
-  equal: (a: unknown, b: unknown) => boolean = deepEquals,
-): void {
-  expectEqualityPair(original, copy, true, equal)
-  expectEqualityPair(original, changed, false, equal)
-}
-
 function adjacentDateTime(time: number): number {
   if (Number.isNaN(time)) return 0
   return time === 8_640_000_000_000_000 ? time - 1 : time + 1
 }
 
-function expectRingLaw(
-  cells: ReadonlyArray<{ value: number; carrier: EdgeCarrier }>,
-  equal: (a: unknown, b: unknown) => boolean = deepEquals,
-): void {
-  expect(cells.length).toBeGreaterThan(0)
-  const keys = cells.map((_, index) => Symbol(`edge-${index}`))
-  const original = equalityRing(cells, keys)
-  const copy = equalityRing(cells, keys)
-  expect(original).not.toBe(copy)
-  expectEqualityPair(original, copy, true, equal)
-  // Check every reachable payload, including nodes past a mixed-container edge.
-  for (let changed = 0; changed < cells.length; changed++) {
-    const different = equalityRing(
-      cells.map((cell, index) => ({
-        ...cell,
-        value: cell.value + (index === changed ? 1 : 0),
-      })),
-      keys,
-    )
-    expectEqualityPair(original, different, false, equal)
-  }
-}
-
 // Legal rings have 1–5 reachable nodes, integer payloads, and one of four
 // native edge carriers at each node. A zero-node ring has no root and is
 // excluded. The fixed pair enumeration below reconstructs every ordered
@@ -318,194 +260,12 @@ const ringArbitrary = fc.array(
   { minLength: 1, maxLength: 5 },
 )
 
-function assertExtraProperty(
-  {
-    original,
-    key,
-    value,
-  }: {
-    original: Record<string, number>
-    key: string
-    value: number
-  },
-  equal: (a: unknown, b: unknown) => boolean,
-): void {
-  expect(key in original).toBe(false)
-  const extended = { ...original, [key]: value }
-  expect(Object.keys(extended)).toHaveLength(Object.keys(original).length + 1)
-  expect(equal(original, { ...original }), `property copy must be equal`).toBe(
-    true,
-  )
-  expect(equal(original, extended), `extra property must be unequal`).toBe(
-    false,
-  )
-  expect(equal(extended, original), `extra property must be unequal`).toBe(
-    false,
-  )
-}
-
-function assertDistinctTypes(
-  a: unknown,
-  b: unknown,
-  equal: (a: unknown, b: unknown) => boolean,
-): void {
-  expect(equal(a, b), `distinct types must be unequal (forward)`).toBe(false)
-  expect(equal(b, a), `distinct types must be unequal (reverse)`).toBe(false)
-}
-
 describe(`deepEquals property-based tests`, () => {
-  describe(`non-ring grammar boundaries`, () => {
-    const cases: ReadonlyArray<{
-      name: string
-      values: () => readonly [unknown, unknown, unknown]
-    }> = [
-      { name: `null and undefined`, values: () => [null, null, undefined] },
-      {
-        name: `undefined and null`,
-        values: () => [undefined, undefined, null],
-      },
-      { name: `boolean`, values: () => [true, true, false] },
-      { name: `integer`, values: () => [0, 0, 1] },
-      { name: `string`, values: () => [`a`, `a`, `b`] },
-      { name: `double`, values: () => [0.5, 0.5, 1.5] },
-      { name: `NaN`, values: () => [NaN, NaN, 1] },
-      { name: `infinity`, values: () => [Infinity, Infinity, -Infinity] },
-      { name: `signed zero`, values: () => [-0, 0, 1] },
-      {
-        name: `Date time`,
-        values: () => [new Date(0), new Date(0), new Date(1)],
-      },
-      {
-        name: `RegExp flags`,
-        values: () => [/a/g, /a/g, /a/i],
-      },
-      {
-        name: `RegExp source`,
-        values: () => [/a/g, /a/g, /b/g],
-      },
-      {
-        name: `Uint8Array length`,
-        values: () => [new Uint8Array(), new Uint8Array(), new Uint8Array([1])],
-      },
-      {
-        name: `Uint8Array content`,
-        values: () => [
-          new Uint8Array([1]),
-          new Uint8Array([1]),
-          new Uint8Array([2]),
-        ],
-      },
-      {
-        name: `Float32Array content`,
-        values: () => [
-          new Float32Array([1.5]),
-          new Float32Array([1.5]),
-          new Float32Array([2.5]),
-        ],
-      },
-      {
-        name: `Temporal.PlainDate day`,
-        values: () => [
-          new Temporal.PlainDate(2024, 1, 1),
-          new Temporal.PlainDate(2024, 1, 1),
-          new Temporal.PlainDate(2024, 1, 2),
-        ],
-      },
-      {
-        name: `Temporal.Duration seconds`,
-        values: () => [
-          Temporal.Duration.from({ seconds: 1 }),
-          Temporal.Duration.from({ seconds: 1 }),
-          Temporal.Duration.from({ seconds: 2 }),
-        ],
-      },
-      { name: `array length`, values: () => [[], [], [1]] },
-      { name: `array content`, values: () => [[1], [1], [2]] },
-      { name: `record key`, values: () => [{}, {}, { a: 1 }] },
-      { name: `record value`, values: () => [{ a: 1 }, { a: 1 }, { a: 2 }] },
-      {
-        name: `Map entry`,
-        values: () => [
-          new Map([[`a`, 1]]),
-          new Map([[`a`, 1]]),
-          new Map([[`a`, 2]]),
-        ],
-      },
-      {
-        name: `Set membership`,
-        values: () => [new Set([1]), new Set([1]), new Set([2])],
-      },
-    ]
-
-    it.each(cases)(
-      `reconstructs equal and changed $name witnesses`,
-      ({ values }) => {
-        expectCopyAndChanged(...values())
-      },
-    )
-
-    it(`rejects reference-only and type-only comparisons at their named checkpoints`, () => {
-      const [date, dateCopy, changedDate] = cases
-        .find(({ name }) => name === `Date time`)!
-        .values()
-      // A reference-only comparison loses equality between separate Dates.
-      expect(() =>
-        expectCopyAndChanged(date, dateCopy, changedDate, Object.is),
-      ).toThrow(`forward equality`)
-      const [array, arrayCopy, changedArray] = cases
-        .find(({ name }) => name === `array content`)!
-        .values()
-      // A shallow type comparison accepts the wrong element at the same cut.
-      const typeOnly = (a: unknown, b: unknown) =>
-        Object.prototype.toString.call(a) === Object.prototype.toString.call(b)
-      expect(() =>
-        expectCopyAndChanged(array, arrayCopy, changedArray, typeOnly),
-      ).toThrow(`forward equality`)
-      expectCopyAndChanged(date, dateCopy, changedDate)
-      expectCopyAndChanged(array, arrayCopy, changedArray)
-    })
-
-    it(`keeps empty and nonempty containers distinct across the 0–1 margin`, () => {
-      expectCopyAndChanged([], [], [0])
-      expectCopyAndChanged({}, {}, { value: 0 })
-      expectCopyAndChanged(new Map(), new Map(), new Map([[0, 0]]))
-      expectCopyAndChanged(new Set(), new Set(), new Set([0]))
-      expectCopyAndChanged(
-        new Uint8Array(),
-        new Uint8Array(),
-        new Uint8Array([0]),
-      )
-    })
-  })
-
   describe(`bounded native graph relations`, () => {
-    it.each(
-      edgeCarriers.flatMap((first) =>
-        edgeCarriers.map((second) => ({ first, second })),
-      ),
-    )(
-      `compares equal and changed rings through $first then $second`,
-      ({ first, second }) =>
-        expectRingLaw([
-          { value: 0, carrier: first },
-          { value: 0, carrier: second },
-        ]),
-    )
-
-    it.each([1, 4, 5])(`compares equal and changed %i-node rings`, (length) => {
-      expectRingLaw(
-        Array.from({ length }, (_, index) => ({
-          value: index,
-          carrier: edgeCarriers[index % edgeCarriers.length]!,
-        })),
-      )
-    })
-
     utilsProperty([ringArbitrary])(
       `compares separately allocated mixed rings and every changed payload`,
       (cells) => expectRingLaw(cells),
     )
-
     it(`runs a fixed mixed-ring campaign without skipped antecedents`, () => {
       const result = fc.check(
         fc.property(ringArbitrary, (cells) => expectRingLaw(cells)),
@@ -513,19 +273,6 @@ describe(`deepEquals property-based tests`, () => {
       )
       expect(result).toMatchObject({ failed: false, numRuns: 100, numSkips: 0 })
     })
-
-    it(`rejects comparators that ignore graph payloads or reject equal cycles`, () => {
-      const cells = [
-        { value: 0, carrier: `map` as const },
-        { value: 0, carrier: `symbol` as const },
-      ]
-      expect(() => expectRingLaw(cells, () => true)).toThrow(`forward equality`)
-      expect(() => expectRingLaw(cells, () => false)).toThrow(
-        `forward equality`,
-      )
-      expectRingLaw(cells)
-    })
-
     utilsProperty([fc.integer(), fc.string()])(
       `preserves structural equality across acyclic sharing and unfolding`,
       (value, key) => {
@@ -547,7 +294,6 @@ describe(`deepEquals property-based tests`, () => {
         expectEqualityPair(shared, unfolded, false)
       },
     )
-
     utilsProperty([fc.integer(), fc.string()])(
       `distinguishes symbol identity from description in keys and values`,
       (value, description) => {
@@ -565,7 +311,6 @@ describe(`deepEquals property-based tests`, () => {
         )
       },
     )
-
     utilsProperty([fc.integer()])(
       `keeps Map key identity while comparing nested values structurally`,
       (value) => {
@@ -587,46 +332,6 @@ describe(`deepEquals property-based tests`, () => {
         )
       },
     )
-
-    it(`rejects symbol-erasing, Map-key-erasing and Set-size-only comparisons`, () => {
-      const key = Symbol(`key`)
-      const a = { [key]: 1 }
-      const b = { [key]: 2 }
-      const stringOnly = (left: unknown, right: unknown) =>
-        deepEquals(
-          Object.fromEntries(Object.entries(left as object)),
-          Object.fromEntries(Object.entries(right as object)),
-        )
-      expect(() => expectEqualityPair(a, b, false, stringOnly)).toThrow(
-        `forward equality`,
-      )
-      expectEqualityPair(a, b, false)
-      expectEqualityPair(a, { [key]: 1 }, true)
-
-      const mapA = new Map([[{ key: 1 }, 0]])
-      const mapB = new Map([[{ key: 1 }, 0]])
-      const mapValuesOnly = (left: unknown, right: unknown) =>
-        deepEquals(
-          [...(left as Map<unknown, unknown>).values()],
-          [...(right as Map<unknown, unknown>).values()],
-        )
-      expect(() =>
-        expectEqualityPair(mapA, mapB, false, mapValuesOnly),
-      ).toThrow(`forward equality`)
-      expectEqualityPair(mapA, mapB, false)
-      expectEqualityPair(mapA, new Map(mapA), true)
-
-      const setA = new Set([1, 2])
-      const setB = new Set([1, 3])
-      const sizeOnly = (left: unknown, right: unknown) =>
-        (left as Set<unknown>).size === (right as Set<unknown>).size
-      expect(() => expectEqualityPair(setA, setB, false, sizeOnly)).toThrow(
-        `forward equality`,
-      )
-      expectEqualityPair(setA, setB, false)
-      expectEqualityPair(setA, new Set([2, 1]), true)
-    })
-
     it(`shrinks and replays a payload-blind graph comparator`, () => {
       const property = fc.property(ringArbitrary, (cells) =>
         expectRingLaw(cells, () => true),
@@ -645,7 +350,6 @@ describe(`deepEquals property-based tests`, () => {
       expect(replay.counterexample).toEqual(failure.counterexample)
       expectRingLaw(failure.counterexample[0])
     })
-
     utilsProperty([
       fc.uniqueArray(fc.integer(), { minLength: 1, maxLength: 8 }),
     ])(
@@ -660,17 +364,7 @@ describe(`deepEquals property-based tests`, () => {
         expectEqualityPair(original, different, false)
       },
     )
-
-    it(`matches object-valued Sets by value rather than cardinality`, () => {
-      expectEqualityPair(
-        new Set([{ id: 1 }, { id: 2 }]),
-        new Set([{ id: 2 }, { id: 1 }]),
-        true,
-      )
-      expectEqualityPair(new Set([{ id: 1 }]), new Set([{ id: 2 }]), false)
-    })
   })
-
   describe(`equivalence relation properties`, () => {
     utilsProperty([arbitrarySingleValue])(
       `reflexivity: deepEquals(a, a) is always true`,
@@ -700,149 +394,22 @@ describe(`deepEquals property-based tests`, () => {
       },
     )
   })
-
   describe(`cross-type comparisons`, () => {
-    // A Date's display and numeric timestamp encode the same instant, but
-    // change-event equality keeps the Date value class distinct. The finite
-    // generator makes both encodings legal; the 2023 case preserves the old
-    // unit test's exact operands.
-    it(`keeps a 2023 Date distinct from its old primitive probes`, () => {
-      const date = new Date(`2023-01-01T00:00:00Z`)
-      expectCopyAndChanged(
-        date,
-        new Date(`2023-01-01T00:00:00Z`),
-        new Date(`2023-01-02T00:00:00Z`),
-      )
-      assertDistinctTypes(date, `2023-01-01T00:00:00Z`, deepEquals)
-      assertDistinctTypes(date, date.getTime(), deepEquals)
-    })
-
-    // RegExp source text does not acquire the regex's value class, even when
-    // it spells the same pattern. The source and flags still govern equality
-    // between two genuine RegExps in the laws below.
-    it(`keeps /abc/g distinct from its old source-text probe`, () => {
-      expectCopyAndChanged(/abc/g, /abc/g, /abc/i)
-      expectCopyAndChanged(/abc/g, /abc/g, /def/g)
-      expectEqualityPair(/test/i, /test/i, true)
-      assertDistinctTypes(/abc/g, `abc`, deepEquals)
-    })
-
-    it(`rejects primitive-coercing equality for Date and RegExp`, () => {
-      const date = new Date(`2023-01-01T00:00:00Z`)
-      const dateAsNumber = (left: unknown, right: unknown) =>
-        (left instanceof Date ? left.getTime() : left) ===
-        (right instanceof Date ? right.getTime() : right)
-      const dateAsString = (left: unknown, right: unknown) =>
-        (left instanceof Date ? left.toISOString() : left) ===
-        (right instanceof Date ? right.toISOString() : right)
-      const regexpAsSource = (left: unknown, right: unknown) =>
-        (left instanceof RegExp ? left.source : left) ===
-        (right instanceof RegExp ? right.source : right)
-      expect(() =>
-        assertDistinctTypes(date, date.getTime(), dateAsNumber),
-      ).toThrow(`distinct types must be unequal (forward)`)
-      expect(() =>
-        assertDistinctTypes(date, date.toISOString(), dateAsString),
-      ).toThrow(`distinct types must be unequal (forward)`)
-      expect(() => assertDistinctTypes(/abc/g, `abc`, regexpAsSource)).toThrow(
-        `distinct types must be unequal (forward)`,
-      )
-    })
-
     utilsProperty([arbitraryDate, arbitraryTemporalDuration])(
       `generated Date and Temporal.Duration are unequal in both directions`,
       (date, duration) => assertDistinctTypes(date, duration, deepEquals),
     )
-
     utilsProperty([arbitraryDate, arbitraryTemporalPlainDate])(
       `generated Date and Temporal.PlainDate are unequal in both directions`,
       (date, plainDate) => assertDistinctTypes(date, plainDate, deepEquals),
     )
-
     utilsProperty([arbitraryTemporalPlainDate, arbitraryTemporalDuration])(
       `generated different Temporal types are unequal in both directions`,
       (plainDate, duration) =>
         assertDistinctTypes(plainDate, duration, deepEquals),
     )
-
-    it(`distinct-type law rejects equality in either direction`, () => {
-      const date = new Date(0)
-      const duration = Temporal.Duration.from({ seconds: 0 })
-      expect(() =>
-        assertDistinctTypes(date, duration, (a) => a === date),
-      ).toThrow(`distinct types must be unequal (forward)`)
-      expect(() =>
-        assertDistinctTypes(date, duration, (a) => a === duration),
-      ).toThrow(`distinct types must be unequal (reverse)`)
-      assertDistinctTypes(date, duration, Object.is)
-      // Distinct instances of the same type remain legitimate equal neighbors.
-      expect(deepEquals(date, new Date(0))).toBe(true)
-      expect(deepEquals(duration, Temporal.Duration.from({ seconds: 0 }))).toBe(
-        true,
-      )
-    })
-
-    it(`Date and Temporal.Duration are not equal in either direction`, () => {
-      const date = new Date(`1970-01-01T00:00:00.000Z`)
-      const duration = Temporal.Duration.from({
-        hours: 0,
-        minutes: 0,
-        seconds: 0,
-      })
-
-      // Both directions should return false for different types (symmetric)
-      expect(deepEquals(date, duration)).toBe(false)
-      expect(deepEquals(duration, date)).toBe(false)
-    })
-
-    it(`Date and Temporal.PlainDate are not equal in either direction`, () => {
-      const date = new Date(`2023-01-01T00:00:00.000Z`)
-      const plainDate = new Temporal.PlainDate(2023, 1, 1)
-
-      expect(deepEquals(date, plainDate)).toBe(false)
-      expect(deepEquals(plainDate, date)).toBe(false)
-    })
-
-    it(`RegExp and object are not equal in either direction`, () => {
-      const regex = /test/g
-      const obj = { source: `test`, flags: `g` }
-
-      expect(deepEquals(regex, obj)).toBe(false)
-      expect(deepEquals(obj, regex)).toBe(false)
-    })
-
-    it(`Map and object are not equal in either direction`, () => {
-      const map = new Map([[`a`, 1]])
-      const obj = { a: 1 }
-
-      expect(deepEquals(map, obj)).toBe(false)
-      expect(deepEquals(obj, map)).toBe(false)
-    })
-
-    it(`Set and array are not equal in either direction`, () => {
-      const set = new Set([1, 2, 3])
-      const arr = [1, 2, 3]
-
-      expect(deepEquals(set, arr)).toBe(false)
-      expect(deepEquals(arr, set)).toBe(false)
-    })
-
-    it(`Uint8Array and array are not equal in either direction`, () => {
-      const typedArr = new Uint8Array([1, 2, 3])
-      const arr = [1, 2, 3]
-
-      expect(deepEquals(typedArr, arr)).toBe(false)
-      expect(deepEquals(arr, typedArr)).toBe(false)
-    })
   })
-
   describe(`change-event equality`, () => {
-    it(`treats copied NaN values and invalid Dates as equal`, () => {
-      expect(deepEquals({ rank: NaN }, { rank: NaN })).toBe(true)
-      expect(deepEquals(new Date(NaN), new Date(NaN))).toBe(true)
-      expect(deepEquals({ rank: NaN }, { rank: 10 })).toBe(false)
-    })
-
     utilsProperty([fc.array(fc.integer(), { minLength: 0, maxLength: 10 })])(
       `arrays with same elements are equal`,
       (arr) => {
@@ -850,7 +417,6 @@ describe(`deepEquals property-based tests`, () => {
         expectCopyAndChanged(arr, copy, [...arr, 0])
       },
     )
-
     utilsProperty([
       fc.dictionary(fc.string(), fc.integer(), { minKeys: 0, maxKeys: 10 }),
     ])(`objects with same properties are equal`, (obj) => {
@@ -859,7 +425,6 @@ describe(`deepEquals property-based tests`, () => {
       while (freshKey in obj) freshKey += `_`
       expectCopyAndChanged(obj, copy, { ...obj, [freshKey]: 0 })
     })
-
     utilsProperty([
       fc.array(fc.tuple(fc.string(), fc.integer()), {
         minLength: 0,
@@ -872,7 +437,6 @@ describe(`deepEquals property-based tests`, () => {
       while (map1.has(freshKey)) freshKey += `_`
       expectCopyAndChanged(map1, map2, new Map([...map1, [freshKey, 0]]))
     })
-
     utilsProperty([fc.array(fc.integer(), { minLength: 0, maxLength: 10 })])(
       `Sets with same primitive values are equal`,
       (arr) => {
@@ -881,7 +445,6 @@ describe(`deepEquals property-based tests`, () => {
         expectCopyAndChanged(set1, set2, new Set([...set1, `fresh`]))
       },
     )
-
     utilsProperty([fc.uint8Array({ minLength: 0, maxLength: 50 })])(
       `Uint8Arrays with same content are equal`,
       (arr) => {
@@ -889,7 +452,6 @@ describe(`deepEquals property-based tests`, () => {
         expectCopyAndChanged(arr, copy, new Uint8Array([...arr, 0]))
       },
     )
-
     utilsProperty([arbitraryDate])(`Dates with same time are equal`, (date) => {
       const copy = new Date(date.getTime())
       expectCopyAndChanged(
@@ -898,7 +460,6 @@ describe(`deepEquals property-based tests`, () => {
         new Date(adjacentDateTime(date.getTime())),
       )
     })
-
     utilsProperty([arbitraryTemporalPlainDate])(
       `Temporal.PlainDate with same values are equal`,
       (date) => {
@@ -907,7 +468,6 @@ describe(`deepEquals property-based tests`, () => {
       },
     )
   })
-
   describe(`inequality properties`, () => {
     utilsProperty([
       fc.array(fc.integer(), { minLength: 1, maxLength: 10 }),
@@ -916,27 +476,12 @@ describe(`deepEquals property-based tests`, () => {
       const modified = [...arr, extraElement]
       expect(deepEquals(arr, modified)).toBe(false)
     })
-
     utilsProperty([arbitraryExtraProperty])(
       `objects with extra property are not equal`,
       (sample) => {
         assertExtraProperty(sample, deepEquals)
       },
     )
-
-    it(`extra-property law rejects a subset-only comparison`, () => {
-      const sample = { original: { a: 1 }, key: `b`, value: 2 }
-      const subsetEqual = (a: unknown, b: unknown): boolean => {
-        const left = a as Record<string, number>
-        const right = b as Record<string, number>
-        return Object.keys(left).every((key) => left[key] === right[key])
-      }
-      expect(() => assertExtraProperty(sample, subsetEqual)).toThrow(
-        `extra property must be unequal`,
-      )
-      assertExtraProperty(sample, deepEquals)
-    })
-
     it(`fixed campaign reaches an extra property in every case`, () => {
       const result = fc.check(
         fc.property(arbitraryExtraProperty, (sample) => {
@@ -946,14 +491,12 @@ describe(`deepEquals property-based tests`, () => {
       )
       expect(result).toMatchObject({ failed: false, numRuns: 100, numSkips: 0 })
     })
-
     utilsProperty([fc.integer(), fc.string()])(
       `different types are not equal`,
       (num, str) => {
         expect(deepEquals(num, str)).toBe(false)
       },
     )
-
     utilsProperty([fc.date(), fc.date()])(
       `dates with different times are not equal`,
       (date1, date2) => {
@@ -970,7 +513,6 @@ describe(`deepEquals property-based tests`, () => {
       },
     )
   })
-
   describe(`edge cases`, () => {
     utilsProperty([arbitraryNonNullValue])(
       `null is never equal to a non-null value`,
@@ -996,7 +538,6 @@ describe(`deepEquals property-based tests`, () => {
       },
     )
   })
-
   // `deepEquals` drives change-event suppression, so it deliberately ignores
   // state that draft revert detection keeps (see proxy-revert-oracle): Map and
   // Set insertion order, RegExp `lastIndex`, and array holes. These laws pin
@@ -1154,7 +695,6 @@ describe(`deepEquals property-based tests`, () => {
       expectEqualityPair({ items: sparse }, { items: dense }, true)
     })
   })
-
   describe(`nested structure consistency`, () => {
     utilsProperty([
       fc.array(fc.array(fc.integer(), { maxLength: 3 }), { maxLength: 3 }),
@@ -1176,10 +716,6 @@ describe(`deepEquals property-based tests`, () => {
       expect(deepEquals(nestedObj, clone)).toBe(true)
     })
   })
-
-  // Keep newly added generated laws after the original registration order:
-  // `utils.<number>` names properties in registration order, so saved
-  // seed/path replays keep their numbers.
   describe(`additional non-ring value boundaries`, () => {
     utilsProperty([arbitraryRegExp])(
       `RegExp source and flags determine equality`,
@@ -1199,7 +735,6 @@ describe(`deepEquals property-based tests`, () => {
         expectEqualityPair(regex, changedSource, false)
       },
     )
-
     utilsProperty([arbitraryFloat32Array])(
       `Float32Array content and length determine equality`,
       (array) => {
@@ -1210,7 +745,6 @@ describe(`deepEquals property-based tests`, () => {
         )
       },
     )
-
     utilsProperty([arbitraryTemporalDuration])(
       `Temporal.Duration with same fields is equal and changed seconds are unequal`,
       (duration) => {
@@ -1227,7 +761,6 @@ describe(`deepEquals property-based tests`, () => {
         expectCopyAndChanged(duration, copy, changed)
       },
     )
-
     utilsProperty([arbitraryFiniteDate])(
       `Date differs from its ISO text and epoch number in both directions`,
       (date) => {
@@ -1235,12 +768,10 @@ describe(`deepEquals property-based tests`, () => {
         assertDistinctTypes(date, date.getTime(), deepEquals)
       },
     )
-
     utilsProperty([arbitraryRegExp])(
       `RegExp differs from its source text in both directions`,
       (regex) => assertDistinctTypes(regex, regex.source, deepEquals),
     )
-
     // The source fields, rather than Temporal's display or ordered duration,
     // form the reference identity. The production path is deepEquals in both
     // directions; its direct result is compared after each constructed pair.
@@ -1259,14 +790,6 @@ describe(`deepEquals property-based tests`, () => {
         }
       },
     )
-
-    it(`keeps one second distinct from 1000 milliseconds with the same display`, () => {
-      const seconds = Temporal.Duration.from({ seconds: 1 })
-      const milliseconds = Temporal.Duration.from({ milliseconds: 1000 })
-      expect(seconds.toString()).toBe(milliseconds.toString())
-      expectEqualityPair(seconds, milliseconds, false)
-    })
-
     // This generated grammar varies magnitude and sign while enumerating every
     // adjacent subsecond unit boundary. Both constructors encode the same
     // displayed elapsed time, but the single nonzero source field differs.
@@ -1292,30 +815,3 @@ describe(`deepEquals property-based tests`, () => {
     )
   })
 })
-
-// Persisted-snapshot equality decides whether a reload can leave the public
-// row untouched. Prototype identity is part of that row's observable shape:
-// equal fields on a class or null-prototype record cannot certify that a
-// plain durable record is already public. Two values with the same prototype
-// and fields remain equal. This is a direct comparator boundary; the persisted
-// wrapper oracle owns the source/live publication checkpoint.
-describe(`persisted-snapshot prototype equality`, () => {
-  it(`distinguishes nested prototypes while accepting equal same-prototype values`, () => {
-    class DetailBox {
-      constructor(public rank: number) {}
-    }
-    const authored = { detail: new DetailBox(7) }
-    const durable = { detail: { rank: 7 } }
-    const sameShape = { detail: new DetailBox(7) }
-    const nullPrototype = Object.assign(Object.create(null) as object, {
-      rank: 7,
-    })
-
-    expect(deepEquals(authored, durable)).toBe(true)
-    expect(equalPersistedSnapshotValues(authored, durable)).toBe(false)
-    expect(equalPersistedSnapshotValues(authored, sameShape)).toBe(true)
-    expect(
-      equalPersistedSnapshotValues({ detail: nullPrototype }, durable),
-    ).toBe(false)
-  })
-})
diff --git a/packages/db/tests/utils.test.ts b/packages/db/tests/utils.test.ts
index eff8abb949..57f0a41c52 100644
--- a/packages/db/tests/utils.test.ts
+++ b/packages/db/tests/utils.test.ts
@@ -1,8 +1,21 @@
 import { describe, expect, it, vi } from 'vitest'
 import { Temporal } from 'temporal-polyfill'
-import { deepEquals, resetWarnings, warnOnce } from '../src/utils'
+import {
+  deepEquals,
+  equalPersistedSnapshotValues,
+  resetWarnings,
+  warnOnce,
+} from '../src/utils'
 import { normalizeError } from '../src/utils/error'
 import { isPromiseLike } from '../src/utils/type-guards'
+import {
+  assertDistinctTypes,
+  assertExtraProperty,
+  edgeCarriers,
+  expectCopyAndChanged,
+  expectEqualityPair,
+  expectRingLaw,
+} from './deep-equals-support'
 import {
   oracleRandomParameters,
   readOracleRunConfig,
@@ -583,3 +596,374 @@ describe(`isPromiseLike`, () => {
     expect(isPromiseLike(result)).toBe(true)
   })
 })
+
+/** Ordinary tests moved from src.ts; the oracle file owns the law. */
+
+describe(`deepEquals property-based tests`, () => {
+  describe(`non-ring grammar boundaries`, () => {
+    const cases: ReadonlyArray<{
+      name: string
+      values: () => readonly [unknown, unknown, unknown]
+    }> = [
+      { name: `null and undefined`, values: () => [null, null, undefined] },
+      {
+        name: `undefined and null`,
+        values: () => [undefined, undefined, null],
+      },
+      { name: `boolean`, values: () => [true, true, false] },
+      { name: `integer`, values: () => [0, 0, 1] },
+      { name: `string`, values: () => [`a`, `a`, `b`] },
+      { name: `double`, values: () => [0.5, 0.5, 1.5] },
+      { name: `NaN`, values: () => [NaN, NaN, 1] },
+      { name: `infinity`, values: () => [Infinity, Infinity, -Infinity] },
+      { name: `signed zero`, values: () => [-0, 0, 1] },
+      {
+        name: `Date time`,
+        values: () => [new Date(0), new Date(0), new Date(1)],
+      },
+      {
+        name: `RegExp flags`,
+        values: () => [/a/g, /a/g, /a/i],
+      },
+      {
+        name: `RegExp source`,
+        values: () => [/a/g, /a/g, /b/g],
+      },
+      {
+        name: `Uint8Array length`,
+        values: () => [new Uint8Array(), new Uint8Array(), new Uint8Array([1])],
+      },
+      {
+        name: `Uint8Array content`,
+        values: () => [
+          new Uint8Array([1]),
+          new Uint8Array([1]),
+          new Uint8Array([2]),
+        ],
+      },
+      {
+        name: `Float32Array content`,
+        values: () => [
+          new Float32Array([1.5]),
+          new Float32Array([1.5]),
+          new Float32Array([2.5]),
+        ],
+      },
+      {
+        name: `Temporal.PlainDate day`,
+        values: () => [
+          new Temporal.PlainDate(2024, 1, 1),
+          new Temporal.PlainDate(2024, 1, 1),
+          new Temporal.PlainDate(2024, 1, 2),
+        ],
+      },
+      {
+        name: `Temporal.Duration seconds`,
+        values: () => [
+          Temporal.Duration.from({ seconds: 1 }),
+          Temporal.Duration.from({ seconds: 1 }),
+          Temporal.Duration.from({ seconds: 2 }),
+        ],
+      },
+      { name: `array length`, values: () => [[], [], [1]] },
+      { name: `array content`, values: () => [[1], [1], [2]] },
+      { name: `record key`, values: () => [{}, {}, { a: 1 }] },
+      { name: `record value`, values: () => [{ a: 1 }, { a: 1 }, { a: 2 }] },
+      {
+        name: `Map entry`,
+        values: () => [
+          new Map([[`a`, 1]]),
+          new Map([[`a`, 1]]),
+          new Map([[`a`, 2]]),
+        ],
+      },
+      {
+        name: `Set membership`,
+        values: () => [new Set([1]), new Set([1]), new Set([2])],
+      },
+    ]
+
+    it.each(cases)(
+      `reconstructs equal and changed $name witnesses`,
+      ({ values }) => {
+        expectCopyAndChanged(...values())
+      },
+    )
+
+    it(`rejects reference-only and type-only comparisons at their named checkpoints`, () => {
+      const [date, dateCopy, changedDate] = cases
+        .find(({ name }) => name === `Date time`)!
+        .values()
+      // A reference-only comparison loses equality between separate Dates.
+      expect(() =>
+        expectCopyAndChanged(date, dateCopy, changedDate, Object.is),
+      ).toThrow(`forward equality`)
+      const [array, arrayCopy, changedArray] = cases
+        .find(({ name }) => name === `array content`)!
+        .values()
+      // A shallow type comparison accepts the wrong element at the same cut.
+      const typeOnly = (a: unknown, b: unknown) =>
+        Object.prototype.toString.call(a) === Object.prototype.toString.call(b)
+      expect(() =>
+        expectCopyAndChanged(array, arrayCopy, changedArray, typeOnly),
+      ).toThrow(`forward equality`)
+      expectCopyAndChanged(date, dateCopy, changedDate)
+      expectCopyAndChanged(array, arrayCopy, changedArray)
+    })
+
+    it(`keeps empty and nonempty containers distinct across the 0–1 margin`, () => {
+      expectCopyAndChanged([], [], [0])
+      expectCopyAndChanged({}, {}, { value: 0 })
+      expectCopyAndChanged(new Map(), new Map(), new Map([[0, 0]]))
+      expectCopyAndChanged(new Set(), new Set(), new Set([0]))
+      expectCopyAndChanged(
+        new Uint8Array(),
+        new Uint8Array(),
+        new Uint8Array([0]),
+      )
+    })
+  })
+  describe(`bounded native graph relations`, () => {
+    it.each(
+      edgeCarriers.flatMap((first) =>
+        edgeCarriers.map((second) => ({ first, second })),
+      ),
+    )(
+      `compares equal and changed rings through $first then $second`,
+      ({ first, second }) =>
+        expectRingLaw([
+          { value: 0, carrier: first },
+          { value: 0, carrier: second },
+        ]),
+    )
+    it.each([1, 4, 5])(`compares equal and changed %i-node rings`, (length) => {
+      expectRingLaw(
+        Array.from({ length }, (_, index) => ({
+          value: index,
+          carrier: edgeCarriers[index % edgeCarriers.length]!,
+        })),
+      )
+    })
+    it(`rejects comparators that ignore graph payloads or reject equal cycles`, () => {
+      const cells = [
+        { value: 0, carrier: `map` as const },
+        { value: 0, carrier: `symbol` as const },
+      ]
+      expect(() => expectRingLaw(cells, () => true)).toThrow(`forward equality`)
+      expect(() => expectRingLaw(cells, () => false)).toThrow(
+        `forward equality`,
+      )
+      expectRingLaw(cells)
+    })
+    it(`rejects symbol-erasing, Map-key-erasing and Set-size-only comparisons`, () => {
+      const key = Symbol(`key`)
+      const a = { [key]: 1 }
+      const b = { [key]: 2 }
+      const stringOnly = (left: unknown, right: unknown) =>
+        deepEquals(
+          Object.fromEntries(Object.entries(left as object)),
+          Object.fromEntries(Object.entries(right as object)),
+        )
+      expect(() => expectEqualityPair(a, b, false, stringOnly)).toThrow(
+        `forward equality`,
+      )
+      expectEqualityPair(a, b, false)
+      expectEqualityPair(a, { [key]: 1 }, true)
+
+      const mapA = new Map([[{ key: 1 }, 0]])
+      const mapB = new Map([[{ key: 1 }, 0]])
+      const mapValuesOnly = (left: unknown, right: unknown) =>
+        deepEquals(
+          [...(left as Map<unknown, unknown>).values()],
+          [...(right as Map<unknown, unknown>).values()],
+        )
+      expect(() =>
+        expectEqualityPair(mapA, mapB, false, mapValuesOnly),
+      ).toThrow(`forward equality`)
+      expectEqualityPair(mapA, mapB, false)
+      expectEqualityPair(mapA, new Map(mapA), true)
+
+      const setA = new Set([1, 2])
+      const setB = new Set([1, 3])
+      const sizeOnly = (left: unknown, right: unknown) =>
+        (left as Set<unknown>).size === (right as Set<unknown>).size
+      expect(() => expectEqualityPair(setA, setB, false, sizeOnly)).toThrow(
+        `forward equality`,
+      )
+      expectEqualityPair(setA, setB, false)
+      expectEqualityPair(setA, new Set([2, 1]), true)
+    })
+    it(`matches object-valued Sets by value rather than cardinality`, () => {
+      expectEqualityPair(
+        new Set([{ id: 1 }, { id: 2 }]),
+        new Set([{ id: 2 }, { id: 1 }]),
+        true,
+      )
+      expectEqualityPair(new Set([{ id: 1 }]), new Set([{ id: 2 }]), false)
+    })
+  })
+  describe(`cross-type comparisons`, () => {
+    // A Date's display and numeric timestamp encode the same instant, but
+    // change-event equality keeps the Date value class distinct. The finite
+    // generator makes both encodings legal; the 2023 case preserves the old
+    // unit test's exact operands.
+    it(`keeps a 2023 Date distinct from its old primitive probes`, () => {
+      const date = new Date(`2023-01-01T00:00:00Z`)
+      expectCopyAndChanged(
+        date,
+        new Date(`2023-01-01T00:00:00Z`),
+        new Date(`2023-01-02T00:00:00Z`),
+      )
+      assertDistinctTypes(date, `2023-01-01T00:00:00Z`, deepEquals)
+      assertDistinctTypes(date, date.getTime(), deepEquals)
+    })
+    // RegExp source text does not acquire the regex's value class, even when
+    // it spells the same pattern. The source and flags still govern equality
+    // between two genuine RegExps in the laws below.
+    it(`keeps /abc/g distinct from its old source-text probe`, () => {
+      expectCopyAndChanged(/abc/g, /abc/g, /abc/i)
+      expectCopyAndChanged(/abc/g, /abc/g, /def/g)
+      expectEqualityPair(/test/i, /test/i, true)
+      assertDistinctTypes(/abc/g, `abc`, deepEquals)
+    })
+    it(`rejects primitive-coercing equality for Date and RegExp`, () => {
+      const date = new Date(`2023-01-01T00:00:00Z`)
+      const dateAsNumber = (left: unknown, right: unknown) =>
+        (left instanceof Date ? left.getTime() : left) ===
+        (right instanceof Date ? right.getTime() : right)
+      const dateAsString = (left: unknown, right: unknown) =>
+        (left instanceof Date ? left.toISOString() : left) ===
+        (right instanceof Date ? right.toISOString() : right)
+      const regexpAsSource = (left: unknown, right: unknown) =>
+        (left instanceof RegExp ? left.source : left) ===
+        (right instanceof RegExp ? right.source : right)
+      expect(() =>
+        assertDistinctTypes(date, date.getTime(), dateAsNumber),
+      ).toThrow(`distinct types must be unequal (forward)`)
+      expect(() =>
+        assertDistinctTypes(date, date.toISOString(), dateAsString),
+      ).toThrow(`distinct types must be unequal (forward)`)
+      expect(() => assertDistinctTypes(/abc/g, `abc`, regexpAsSource)).toThrow(
+        `distinct types must be unequal (forward)`,
+      )
+    })
+    it(`distinct-type law rejects equality in either direction`, () => {
+      const date = new Date(0)
+      const duration = Temporal.Duration.from({ seconds: 0 })
+      expect(() =>
+        assertDistinctTypes(date, duration, (a) => a === date),
+      ).toThrow(`distinct types must be unequal (forward)`)
+      expect(() =>
+        assertDistinctTypes(date, duration, (a) => a === duration),
+      ).toThrow(`distinct types must be unequal (reverse)`)
+      assertDistinctTypes(date, duration, Object.is)
+      // Distinct instances of the same type remain legitimate equal neighbors.
+      expect(deepEquals(date, new Date(0))).toBe(true)
+      expect(deepEquals(duration, Temporal.Duration.from({ seconds: 0 }))).toBe(
+        true,
+      )
+    })
+    it(`Date and Temporal.Duration are not equal in either direction`, () => {
+      const date = new Date(`1970-01-01T00:00:00.000Z`)
+      const duration = Temporal.Duration.from({
+        hours: 0,
+        minutes: 0,
+        seconds: 0,
+      })
+
+      // Both directions should return false for different types (symmetric)
+      expect(deepEquals(date, duration)).toBe(false)
+      expect(deepEquals(duration, date)).toBe(false)
+    })
+    it(`Date and Temporal.PlainDate are not equal in either direction`, () => {
+      const date = new Date(`2023-01-01T00:00:00.000Z`)
+      const plainDate = new Temporal.PlainDate(2023, 1, 1)
+
+      expect(deepEquals(date, plainDate)).toBe(false)
+      expect(deepEquals(plainDate, date)).toBe(false)
+    })
+    it(`RegExp and object are not equal in either direction`, () => {
+      const regex = /test/g
+      const obj = { source: `test`, flags: `g` }
+
+      expect(deepEquals(regex, obj)).toBe(false)
+      expect(deepEquals(obj, regex)).toBe(false)
+    })
+    it(`Map and object are not equal in either direction`, () => {
+      const map = new Map([[`a`, 1]])
+      const obj = { a: 1 }
+
+      expect(deepEquals(map, obj)).toBe(false)
+      expect(deepEquals(obj, map)).toBe(false)
+    })
+    it(`Set and array are not equal in either direction`, () => {
+      const set = new Set([1, 2, 3])
+      const arr = [1, 2, 3]
+
+      expect(deepEquals(set, arr)).toBe(false)
+      expect(deepEquals(arr, set)).toBe(false)
+    })
+    it(`Uint8Array and array are not equal in either direction`, () => {
+      const typedArr = new Uint8Array([1, 2, 3])
+      const arr = [1, 2, 3]
+
+      expect(deepEquals(typedArr, arr)).toBe(false)
+      expect(deepEquals(arr, typedArr)).toBe(false)
+    })
+  })
+  describe(`change-event equality`, () => {
+    it(`treats copied NaN values and invalid Dates as equal`, () => {
+      expect(deepEquals({ rank: NaN }, { rank: NaN })).toBe(true)
+      expect(deepEquals(new Date(NaN), new Date(NaN))).toBe(true)
+      expect(deepEquals({ rank: NaN }, { rank: 10 })).toBe(false)
+    })
+  })
+  describe(`inequality properties`, () => {
+    it(`extra-property law rejects a subset-only comparison`, () => {
+      const sample = { original: { a: 1 }, key: `b`, value: 2 }
+      const subsetEqual = (a: unknown, b: unknown): boolean => {
+        const left = a as Record<string, number>
+        const right = b as Record<string, number>
+        return Object.keys(left).every((key) => left[key] === right[key])
+      }
+      expect(() => assertExtraProperty(sample, subsetEqual)).toThrow(
+        `extra property must be unequal`,
+      )
+      assertExtraProperty(sample, deepEquals)
+    })
+  })
+  describe(`additional non-ring value boundaries`, () => {
+    it(`keeps one second distinct from 1000 milliseconds with the same display`, () => {
+      const seconds = Temporal.Duration.from({ seconds: 1 })
+      const milliseconds = Temporal.Duration.from({ milliseconds: 1000 })
+      expect(seconds.toString()).toBe(milliseconds.toString())
+      expectEqualityPair(seconds, milliseconds, false)
+    })
+  })
+})
+// Persisted-snapshot equality decides whether a reload can leave the public
+// row untouched. Prototype identity is part of that row's observable shape:
+// equal fields on a class or null-prototype record cannot certify that a
+// plain durable record is already public. Two values with the same prototype
+// and fields remain equal. This is a direct comparator boundary; the persisted
+// wrapper oracle owns the source/live publication checkpoint.
+describe(`persisted-snapshot prototype equality`, () => {
+  it(`distinguishes nested prototypes while accepting equal same-prototype values`, () => {
+    class DetailBox {
+      constructor(public rank: number) {}
+    }
+    const authored = { detail: new DetailBox(7) }
+    const durable = { detail: { rank: 7 } }
+    const sameShape = { detail: new DetailBox(7) }
+    const nullPrototype = Object.assign(Object.create(null) as object, {
+      rank: 7,
+    })
+
+    expect(deepEquals(authored, durable)).toBe(true)
+    expect(equalPersistedSnapshotValues(authored, durable)).toBe(false)
+    expect(equalPersistedSnapshotValues(authored, sameShape)).toBe(true)
+    expect(
+      equalPersistedSnapshotValues({ detail: nullPrototype }, durable),
+    ).toBe(false)
+  })
+})
diff --git a/packages/db/vitest.dist.config.ts b/packages/db/vitest.dist.config.ts
index 9aa26e144a..8c9533eaa3 100644
--- a/packages/db/vitest.dist.config.ts
+++ b/packages/db/vitest.dist.config.ts
@@ -67,6 +67,7 @@ export default defineConfig({
     // instead of behavior. About 9 seconds in total.
     include: [
       `query/ordered-source-loader-state-oracle.test.ts`,
+      `query/ordered-source-loader-state.test.ts`,
       `live-query-observer.test.ts`,
       `query/includes-publication-oracle.test.ts`,
       `query/bucket-facade-adapter.test.ts`,
diff --git a/packages/electric-db-collection/e2e/electric.e2e.test.ts b/packages/electric-db-collection/e2e/electric.e2e.test.ts
index dae7a2abb6..e35e4615b0 100644
--- a/packages/electric-db-collection/e2e/electric.e2e.test.ts
+++ b/packages/electric-db-collection/e2e/electric.e2e.test.ts
@@ -14,6 +14,7 @@ import {
   createDeduplicationTestSuite,
   createJoinsTestSuite,
   createLiveUpdatesTestSuite,
+  createLiveUpdatesUnitTestSuite,
   createMovesTestSuite,
   createMutationsTestSuite,
   createPaginationTestSuite,
@@ -631,6 +632,7 @@ describe(`Electric Collection E2E Tests`, () => {
   createDeduplicationTestSuite(getConfig)
   createCollationTestSuite(getConfig)
   createMutationsTestSuite(getConfig)
+  createLiveUpdatesUnitTestSuite(getConfig)
   createLiveUpdatesTestSuite(getConfig)
   createProgressiveTestSuite(getConfig)
   createMovesTestSuite(getConfig as any)
diff --git a/packages/electric-db-collection/e2e/sql-predicate-semantics-oracle.e2e.test.ts b/packages/electric-db-collection/e2e/sql-predicate-semantics-oracle.e2e.test.ts
index e132947597..fc2d9bfb09 100644
--- a/packages/electric-db-collection/e2e/sql-predicate-semantics-oracle.e2e.test.ts
+++ b/packages/electric-db-collection/e2e/sql-predicate-semantics-oracle.e2e.test.ts
@@ -4,6 +4,7 @@ import { IR } from '@tanstack/db'
 import { afterAll, beforeAll, describe, expect, inject, it } from 'vitest'
 import { makePgClient } from '../../db-collection-e2e/support/global-setup'
 import { compileSQL } from '../src/sql-compiler'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import type { Client } from 'pg'
 
 type Row = {
@@ -255,6 +256,8 @@ function evaluate(value: Predicate, row: Row): Truth {
   return actual <= value.value
 }
 
+declareOracle({ model: [evaluate] })
+
 describe(`Electric predicate compiler semantics`, () => {
   let client: Client
   let table: string
@@ -369,80 +372,6 @@ describe(`Electric predicate compiler semantics`, () => {
     )
   })
 
-  it(`preserves boolean grouping beneath a comparison`, async () => {
-    const world: Array<Row> = [
-      { id: 1, count: 0, label: null, enabled: true },
-      { id: 2, count: 0, label: null, enabled: false },
-      { id: 3, count: 0, label: null, enabled: null },
-    ]
-    await client.query(`TRUNCATE "${table}"`)
-    for (const row of world) {
-      await client.query(
-        `INSERT INTO "${table}" (id, count, label, enabled) VALUES ($1, $2, $3, $4)`,
-        [row.id, row.count, row.label, row.enabled],
-      )
-    }
-    const compiled = compileSQL({
-      where: new IR.Func(`eq`, [
-        new IR.Func(`or`, [new IR.PropRef([`enabled`]), new IR.Value(false)]),
-        new IR.Value(false),
-      ]),
-    })
-    const result = await client.query<{ id: number }>(
-      `SELECT id FROM "${table}" WHERE ${compiled.where} ORDER BY id`,
-      Object.values(compiled.params ?? {}),
-    )
-
-    expect(result.rows.map(({ id }) => id)).toEqual([2])
-  })
-
-  it(`preserves PostgreSQL array membership semantics`, async () => {
-    await client.query(`TRUNCATE "${table}"`)
-    await client.query(
-      `INSERT INTO "${table}" (id, roles, integer_roles, required_role) VALUES
-        (1, ARRAY['admin', 'editor'], ARRAY[1, 2], 'admin'),
-        (2, ARRAY['viewer'], ARRAY[3], 'admin'),
-        (3, NULL, NULL, NULL),
-        (4, ARRAY[NULL]::TEXT[], ARRAY[NULL]::INTEGER[], 'admin')`,
-    )
-
-    const ref = (column: string) => new IR.PropRef([column])
-    const call = (name: string, ...args: Array<IR.BasicExpression>) =>
-      new IR.Func<boolean>(name, args)
-    const selectedIds = async (
-      where: IR.BasicExpression<boolean>,
-    ): Promise<Array<number>> => {
-      const compiled = compileSQL({ where })
-      const params = Object.entries(compiled.params ?? {})
-        .sort(([left], [right]) => Number(left) - Number(right))
-        .map(([, value]) => value)
-      const result = await client.query<{ id: number }>(
-        `SELECT id FROM "${table}" WHERE ${compiled.where} ORDER BY id`,
-        params,
-      )
-      return result.rows.map(({ id }) => id)
-    }
-
-    const integerMembership = call(`in`, new IR.Value(2), ref(`integer_roles`))
-    expect(await selectedIds(integerMembership)).toEqual([1])
-    expect(await selectedIds(call(`not`, integerMembership))).toEqual([2, 3, 4])
-    expect(
-      await selectedIds(call(`in`, ref(`required_role`), ref(`roles`))),
-    ).toEqual([1])
-
-    const reversedContainment = await client.query<{ id: number }>(
-      `SELECT id FROM "${table}" WHERE ARRAY[$1] @> roles ORDER BY id`,
-      [`admin`],
-    )
-    expect(reversedContainment.rows.map(({ id }) => id)).not.toEqual([1])
-    await expect(
-      client.query(
-        `SELECT id FROM "${table}" WHERE integer_roles @> ARRAY[$1]`,
-        [`2`],
-      ),
-    ).rejects.toMatchObject({ code: `42883` })
-  })
-
   it(`rejects representative compiler faults against PostgreSQL`, async () => {
     const world: Array<Row> = [
       { id: 1, count: 2, label: null, enabled: true },
diff --git a/packages/electric-db-collection/e2e/sql-predicate-semantics.e2e.test.ts b/packages/electric-db-collection/e2e/sql-predicate-semantics.e2e.test.ts
new file mode 100644
index 0000000000..15c5bcff3d
--- /dev/null
+++ b/packages/electric-db-collection/e2e/sql-predicate-semantics.e2e.test.ts
@@ -0,0 +1,117 @@
+// Ordinary PostgreSQL compiler checks for boolean grouping beneath a comparison and
+// array membership. The predicate meaning law (selected IDs match a finite
+// three-valued evaluator) is owned by sql-predicate-semantics-oracle.e2e.test.ts.
+import { IR } from '@tanstack/db'
+import { afterAll, beforeAll, describe, expect, inject, it } from 'vitest'
+import { makePgClient } from '../../db-collection-e2e/support/global-setup'
+import { compileSQL } from '../src/sql-compiler'
+import type { Client } from 'pg'
+
+type Row = {
+  id: number
+  count: number | null
+  label: string | null
+  enabled: boolean | null
+}
+
+describe(`Electric predicate compiler semantics`, () => {
+  let client: Client
+  let table: string
+
+  beforeAll(async () => {
+    client = makePgClient()
+    await client.connect()
+    await client.query(`SET search_path TO ${inject(`testSchema`)}`)
+    table = `predicate_semantics_${Date.now().toString(16)}`
+    await client.query(
+      `CREATE TABLE "${table}" (
+        id INTEGER PRIMARY KEY,
+        count INTEGER,
+        label TEXT,
+        enabled BOOLEAN,
+        roles TEXT[],
+        integer_roles INTEGER[],
+        required_role VARCHAR(16)
+      )`,
+    )
+  })
+
+  afterAll(async () => {
+    await client.query(`DROP TABLE IF EXISTS "${table}"`)
+    await client.end()
+  })
+
+  it(`preserves boolean grouping beneath a comparison`, async () => {
+    const world: Array<Row> = [
+      { id: 1, count: 0, label: null, enabled: true },
+      { id: 2, count: 0, label: null, enabled: false },
+      { id: 3, count: 0, label: null, enabled: null },
+    ]
+    await client.query(`TRUNCATE "${table}"`)
+    for (const row of world) {
+      await client.query(
+        `INSERT INTO "${table}" (id, count, label, enabled) VALUES ($1, $2, $3, $4)`,
+        [row.id, row.count, row.label, row.enabled],
+      )
+    }
+    const compiled = compileSQL({
+      where: new IR.Func(`eq`, [
+        new IR.Func(`or`, [new IR.PropRef([`enabled`]), new IR.Value(false)]),
+        new IR.Value(false),
+      ]),
+    })
+    const result = await client.query<{ id: number }>(
+      `SELECT id FROM "${table}" WHERE ${compiled.where} ORDER BY id`,
+      Object.values(compiled.params ?? {}),
+    )
+
+    expect(result.rows.map(({ id }) => id)).toEqual([2])
+  })
+
+  it(`preserves PostgreSQL array membership semantics`, async () => {
+    await client.query(`TRUNCATE "${table}"`)
+    await client.query(
+      `INSERT INTO "${table}" (id, roles, integer_roles, required_role) VALUES
+        (1, ARRAY['admin', 'editor'], ARRAY[1, 2], 'admin'),
+        (2, ARRAY['viewer'], ARRAY[3], 'admin'),
+        (3, NULL, NULL, NULL),
+        (4, ARRAY[NULL]::TEXT[], ARRAY[NULL]::INTEGER[], 'admin')`,
+    )
+
+    const ref = (column: string) => new IR.PropRef([column])
+    const call = (name: string, ...args: Array<IR.BasicExpression>) =>
+      new IR.Func<boolean>(name, args)
+    const selectedIds = async (
+      where: IR.BasicExpression<boolean>,
+    ): Promise<Array<number>> => {
+      const compiled = compileSQL({ where })
+      const params = Object.entries(compiled.params ?? {})
+        .sort(([left], [right]) => Number(left) - Number(right))
+        .map(([, value]) => value)
+      const result = await client.query<{ id: number }>(
+        `SELECT id FROM "${table}" WHERE ${compiled.where} ORDER BY id`,
+        params,
+      )
+      return result.rows.map(({ id }) => id)
+    }
+
+    const integerMembership = call(`in`, new IR.Value(2), ref(`integer_roles`))
+    expect(await selectedIds(integerMembership)).toEqual([1])
+    expect(await selectedIds(call(`not`, integerMembership))).toEqual([2, 3, 4])
+    expect(
+      await selectedIds(call(`in`, ref(`required_role`), ref(`roles`))),
+    ).toEqual([1])
+
+    const reversedContainment = await client.query<{ id: number }>(
+      `SELECT id FROM "${table}" WHERE ARRAY[$1] @> roles ORDER BY id`,
+      [`admin`],
+    )
+    expect(reversedContainment.rows.map(({ id }) => id)).not.toEqual([1])
+    await expect(
+      client.query(
+        `SELECT id FROM "${table}" WHERE integer_roles @> ARRAY[$1]`,
+        [`2`],
+      ),
+    ).rejects.toMatchObject({ code: `42883` })
+  })
+})
diff --git a/packages/electric-db-collection/package.json b/packages/electric-db-collection/package.json
index 71033c0521..6d9d89b040 100644
--- a/packages/electric-db-collection/package.json
+++ b/packages/electric-db-collection/package.json
@@ -21,7 +21,7 @@
     "dev": "vite build --watch",
     "lint": "eslint . --fix",
     "test": "vitest run",
-    "test:oracles": "vitest run tests/pg-serializer-oracle.property.test.ts tests/electric-oracle.property.test.ts tests/electric-recovery-oracle.test.ts tests/electric-descriptor-isolation-oracle.test.ts tests/electric-sdk-framing.test.ts tests/electric-sdk-delivery-oracle.property.test.ts tests/electric-oracle-lifecycle.test.ts",
+    "test:oracles": "vitest run tests/pg-serializer-oracle.property.test.ts tests/electric-oracle.property.test.ts tests/electric-recovery-oracle.test.ts tests/electric-descriptor-isolation-oracle.test.ts tests/electric-sdk-framing.test.ts tests/electric-sdk-delivery-oracle.property.test.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts"
   },
   "type": "module",
diff --git a/packages/electric-db-collection/tests/electric-adapter-support.ts b/packages/electric-db-collection/tests/electric-adapter-support.ts
new file mode 100644
index 0000000000..739ccfaec5
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-adapter-support.ts
@@ -0,0 +1,460 @@
+// Shared fixtures for the Electric adapter tests: the mocked ShapeStream,
+// the collection and persistence harness, and the publication recorder.
+// The laws these fixtures serve are owned by electric-oracle.property.test.ts,
+// and each test file that uses them calls vi.mock for @electric-sql/client itself.
+import { isDeepStrictEqual } from 'node:util'
+import { expect, vi } from 'vitest'
+import { createCollection } from '@tanstack/db'
+import { electricCollectionOptions } from '../src/electric'
+import { withElectricCleanup } from './electric-oracle-lifecycle'
+import type { Collection, SyncMetadataApi } from '@tanstack/db'
+import type { ChangeMessage, Message, Offset, Row } from '@electric-sql/client'
+import type {
+  PersistedTx,
+  PersistenceAdapter,
+} from '../../db-sqlite-persistence-core/src'
+import type { ElectricSyncMode } from '../src/electric'
+
+export type OracleRow = Row & {
+  id: number
+  name: string
+  stable: string
+}
+
+export const mockSubscribe = vi.fn()
+
+export const shapeId = `{"params":{"table":"test_table"},"url":"http://test-url"}`
+
+export const mockStream = {
+  subscribe: mockSubscribe,
+  unsubscribeAll: vi.fn(),
+  requestSnapshot: vi.fn().mockResolvedValue(undefined),
+  fetchSnapshot: vi.fn().mockResolvedValue({ metadata: {}, data: [] }),
+  forceDisconnectAndRefresh: vi.fn().mockResolvedValue(undefined),
+  isUpToDate: false,
+  shapeHandle: undefined as string | undefined,
+  lastOffset: `-1` as string,
+}
+
+export function createDeferred<T>(): {
+  promise: Promise<T>
+  resolve: (value: T | PromiseLike<T>) => void
+  reject: (reason?: unknown) => void
+} {
+  let resolve!: (value: T | PromiseLike<T>) => void
+  let reject!: (reason?: unknown) => void
+  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise
+    reject = rejectPromise
+  })
+  return { promise, resolve, reject }
+}
+
+export function everyContiguousPartition<T>(
+  values: Array<T>,
+): Array<Array<Array<T>>> {
+  if (values.length === 0) return [[]]
+  const partitions: Array<Array<Array<T>>> = []
+  const boundaryCount = values.length - 1
+  for (let mask = 0; mask < 1 << boundaryCount; mask++) {
+    const batches: Array<Array<T>> = [[values[0]!]]
+    for (let index = 1; index < values.length; index++) {
+      if ((mask & (1 << (index - 1))) !== 0) {
+        batches.push([values[index]!])
+      } else {
+        batches.at(-1)!.push(values[index]!)
+      }
+    }
+    partitions.push(batches)
+  }
+  return partitions
+}
+
+export function createMetadata(seed: ReadonlyMap<string, unknown>): {
+  api: SyncMetadataApi<string | number>
+  state: Map<string, unknown>
+} {
+  const state = new Map(seed)
+  return {
+    state,
+    api: {
+      persistence: null,
+      row: {
+        get: () => undefined,
+        set: () => {},
+        delete: () => {},
+      },
+      collection: {
+        get: (key) => state.get(key),
+        set: (key, value) => {
+          state.set(key, value)
+        },
+        delete: (key) => {
+          state.delete(key)
+        },
+        list: (prefix) =>
+          Array.from(state, ([key, value]) => ({ key, value })).filter(
+            ({ key }) => !prefix || key.startsWith(prefix),
+          ),
+      },
+    },
+  }
+}
+
+export function resumeState(): ReadonlyMap<string, unknown> {
+  // This fixture represents an untagged source. Legacy/unknown membership is
+  // exercised separately by the cold-recovery history generator.
+  return new Map([
+    [
+      `electric:resume`,
+      {
+        kind: `resume`,
+        requiresTagState: false,
+        offset: `10_0`,
+        handle: `shape-1`,
+        shapeId,
+        updatedAt: 1,
+      },
+    ],
+  ])
+}
+
+export function createPersistedAdapter(
+  collectionMetadata: Map<string, unknown>,
+  rows: Map<string | number, OracleRow>,
+  loadGate: Promise<void> = Promise.resolve(),
+): PersistenceAdapter {
+  let latestTerm = 0
+  let latestSeq = 0
+  let latestRowVersion = 0
+  let resetEpoch = 0
+  return {
+    loadSubset: () =>
+      loadGate.then(() =>
+        Array.from(rows, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+        })),
+      ),
+    loadResumeSnapshot: async (_collectionId, ctx) => {
+      if (ctx?.includeRows !== false) await loadGate
+      return {
+        rows:
+          ctx?.includeRows === false
+            ? []
+            : Array.from(rows, ([key, value]) => ({
+                key,
+                value: structuredClone(value),
+              })),
+        keySet: { status: `consistent` },
+        collectionMetadata: Array.from(collectionMetadata, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+        })),
+        latestTerm,
+        latestSeq,
+        latestRowVersion,
+        resetEpoch,
+      }
+    },
+    loadCollectionMetadata: () =>
+      Promise.resolve(
+        Array.from(collectionMetadata, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+        })),
+      ),
+    applyCommittedTx: (_target, tx: PersistedTx) => {
+      for (const mutation of tx.collectionMetadataMutations ?? []) {
+        if (mutation.type === `delete`) {
+          collectionMetadata.delete(mutation.key)
+        } else {
+          collectionMetadata.set(mutation.key, structuredClone(mutation.value))
+        }
+      }
+      if (tx.truncate) {
+        rows.clear()
+        resetEpoch++
+      }
+      for (const mutation of tx.mutations) {
+        if (mutation.type === `delete`) {
+          rows.delete(mutation.key)
+        } else if (mutation.type === `update`) {
+          rows.set(mutation.key, {
+            ...rows.get(mutation.key),
+            ...structuredClone(mutation.value),
+          } as OracleRow)
+        } else {
+          rows.set(mutation.key, structuredClone(mutation.value) as OracleRow)
+        }
+      }
+      latestTerm = tx.term
+      latestSeq = tx.seq
+      latestRowVersion = tx.rowVersion
+      return Promise.resolve()
+    },
+    ensureIndex: () => Promise.resolve(),
+  }
+}
+
+export function createOracleCollection(
+  id: string,
+  syncMode: ElectricSyncMode,
+  metadata: SyncMetadataApi<string | number>,
+  shapeResumeOptions: {
+    offset?: Offset
+    handle?: string
+    signal?: AbortSignal
+    onError?: () => Promise<Record<string, never> | undefined>
+  } = {},
+  wrapParams: <TParams>(params: TParams) => TParams = (params) => params,
+) {
+  let subscriber!: (messages: Array<Message<OracleRow>>) => void
+  let sdkError!: (error: unknown) => void
+  const unsubscribe = vi.fn()
+  mockSubscribe.mockImplementationOnce((callback, onSubscriberError) => {
+    subscriber = callback
+    sdkError = onSubscriberError
+    return unsubscribe
+  })
+  const options = electricCollectionOptions<OracleRow>({
+    id,
+    shapeOptions: {
+      url: `http://test-url`,
+      params: { table: `test_table` },
+      ...shapeResumeOptions,
+    },
+    syncMode,
+    getKey: (row) => row.id,
+    startSync: true,
+  })
+  const originalSync = options.sync
+  return {
+    collection: createCollection({
+      ...options,
+      sync: {
+        sync: (params: Parameters<typeof originalSync.sync>[0]) =>
+          originalSync.sync(wrapParams({ ...params, metadata })),
+      },
+    }),
+    subscriber,
+    sdkError,
+    unsubscribe,
+  }
+}
+
+export type TraceResult = {
+  rows: Array<[string | number, string, string]>
+  snapshots: Array<Array<[string | number, string, string]>>
+  status: string
+  resume: unknown
+}
+
+export function rowsFromCollection(
+  collection: Collection<OracleRow, string | number>,
+): Array<[string | number, string, string]> {
+  return Array.from(
+    collection,
+    ([key, row]): [string | number, string, string] => [
+      key,
+      row.name,
+      row.stable,
+    ],
+  ).sort(([left], [right]) => String(left).localeCompare(String(right)))
+}
+
+export function rowsFromMap(
+  rows: ReadonlyMap<string | number, OracleRow>,
+): Array<[string | number, string, string]> {
+  return Array.from(rows, ([key, row]): [string | number, string, string] => [
+    key,
+    row.name,
+    row.stable,
+  ]).sort(([left], [right]) => String(left).localeCompare(String(right)))
+}
+
+export function observableResume(value: unknown): unknown {
+  if (value === null || typeof value !== `object`) return value
+  const state = value as Record<string, unknown>
+  return {
+    kind: state.kind,
+    offset: state.offset,
+    handle: state.handle,
+    shapeId: state.shapeId,
+  }
+}
+
+export type Publication = { cut: string; rows: TraceResult[`rows`] }
+
+export function observePublications(
+  collection: Collection<OracleRow, string | number>,
+) {
+  const entries: Array<Publication> = []
+  const record = (cut: string) => {
+    entries.push({ cut, rows: structuredClone(rowsFromCollection(collection)) })
+  }
+  const subscription = collection.subscribeChanges(() => record(`event`), {
+    includeInitialState: false,
+  })
+  return { entries, record, stop: () => subscription.unsubscribe() }
+}
+
+export function expectWholePublications(
+  entries: Array<Publication>,
+  allowed: Array<TraceResult[`rows`]>,
+) {
+  let position = 0
+  for (const entry of entries) {
+    while (
+      position < allowed.length &&
+      !isDeepStrictEqual(entry.rows, allowed[position])
+    )
+      position++
+    expect(position, JSON.stringify({ entry, allowed, entries })).toBeLessThan(
+      allowed.length,
+    )
+  }
+}
+
+export async function runTrace(
+  id: string,
+  syncMode: ElectricSyncMode,
+  prefix: Array<Array<Message<OracleRow>>>,
+  batches: Array<Array<Message<OracleRow>>>,
+  seed: ReadonlyMap<string, unknown> = new Map(),
+  hooks: {
+    beforeDelivery?: () => void
+    cleanup?: (cleanup: () => Promise<void>) => Promise<void>
+  } = {},
+): Promise<TraceResult> {
+  const metadata = createMetadata(seed)
+  const { collection, subscriber } = createOracleCollection(
+    id,
+    syncMode,
+    metadata.api,
+  )
+  const deliver = (batch: Array<Message<OracleRow>>) => {
+    hooks.beforeDelivery?.()
+    subscriber(batch)
+  }
+  const cleanup = () => collection.cleanup()
+  return withElectricCleanup(() => {
+    for (const batch of prefix) deliver(batch)
+    const snapshots: Array<Array<[string | number, string, string]>> = []
+    for (const batch of batches) {
+      deliver(batch)
+      snapshots.push(rowsFromCollection(collection))
+    }
+    return {
+      rows: rowsFromCollection(collection),
+      snapshots,
+      status: collection.status,
+      resume: observableResume(metadata.state.get(`electric:resume`)),
+    }
+  }, [() => (hooks.cleanup ? hooks.cleanup(cleanup) : cleanup())])
+}
+
+export function change(
+  operation: `insert` | `update` | `delete`,
+  id: number,
+  name: string,
+): ChangeMessage<OracleRow> {
+  const value =
+    operation === `insert`
+      ? { id, name, stable: `stable-${id}` }
+      : operation === `update`
+        ? { id, name }
+        : { id }
+  return {
+    key: String(id),
+    value: value as OracleRow,
+    headers: { operation },
+  }
+}
+
+export const upToDate: Message<OracleRow> = {
+  headers: { control: `up-to-date` },
+}
+
+export const subsetEnd: Message<OracleRow> = {
+  headers: { control: `subset-end` },
+}
+
+export const mustRefetch: Message<OracleRow> = {
+  headers: { control: `must-refetch` },
+}
+
+export type PreloadOutcome =
+  { status: `fulfilled` } | { status: `rejected`; reason: unknown }
+
+export function observePreload(promise: Promise<void>) {
+  const observed: {
+    expectedRejection?: `cleanup` | `invalid-resume`
+    settled: boolean
+    outcome: Promise<PreloadOutcome>
+  } = {
+    settled: false,
+    // Both handlers are installed at creation, before a driver command can
+    // invalidate or retire the collection. Keep the original rejection object.
+    outcome: promise.then(
+      () => {
+        observed.settled = true
+        return { status: `fulfilled` }
+      },
+      (reason: unknown) => {
+        observed.settled = true
+        return { status: `rejected`, reason }
+      },
+    ),
+  }
+  return observed
+}
+
+export type ObservedPreload = ReturnType<typeof observePreload>
+
+export function expectPreloadOutcome(
+  observed: ObservedPreload,
+  outcome: PreloadOutcome,
+) {
+  if (observed.expectedRejection === undefined) {
+    if (outcome.status === `rejected`) throw outcome.reason
+    return
+  }
+  expect(outcome.status).toBe(`rejected`)
+  if (outcome.status === `rejected`) {
+    expect(outcome.reason).toMatchObject(
+      observed.expectedRejection === `cleanup`
+        ? {
+            name: `AbortError`,
+            message: `Collection preload was abandoned during cleanup`,
+          }
+        : {
+            message: `Electric resume state referenced an unseen row; a full snapshot is required`,
+          },
+    )
+  }
+}
+
+export function resetElectricOracleMocks(): void {
+  vi.clearAllMocks()
+  // clearAllMocks retains one-shot implementations from a failed earlier
+  // history. Each history must own its transport responses independently.
+  mockSubscribe.mockReset()
+  mockStream.requestSnapshot.mockReset().mockResolvedValue(undefined)
+  mockStream.isUpToDate = false
+  mockStream.shapeHandle = `shape-current`
+  mockStream.lastOffset = `20_0`
+}
+
+/**
+ * After Collection readiness, an Electric sync adapter that gives up reports a
+ * stopped sync: the Collection's `error`. Status and rows stay, and only a restart recovers; the
+ * reset resume state is what lets that restart refetch.
+ */
+export function expectGaveUpAfterReadiness(
+  collection: Collection<OracleRow, string | number>,
+) {
+  expect(collection.status).toBe(`ready`)
+  expect(collection.health.failureReason).toBeNull()
+  expect(collection.health.error).toBeTruthy()
+}
diff --git a/packages/electric-db-collection/tests/electric-adapter.test.ts b/packages/electric-db-collection/tests/electric-adapter.test.ts
new file mode 100644
index 0000000000..47aabad576
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-adapter.test.ts
@@ -0,0 +1,2577 @@
+// Adapter unit tests for Electric collections: fixed histories with hand-written
+// expectations, and the harness self-tests for the cleanup and publication recorders.
+// The laws these tests exercise are owned by electric-oracle.property.test.ts.
+import { isDeepStrictEqual } from 'node:util'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { IR, createCollection, createTransaction } from '@tanstack/db'
+import { ShapeStream } from '@electric-sql/client'
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src'
+import { electricCollectionOptions } from '../src/electric'
+import { atCheckpoint, withElectricCleanup } from './electric-oracle-lifecycle'
+import { createMockStream } from './electric-stream-mock'
+import {
+  change,
+  createDeferred,
+  createMetadata,
+  createOracleCollection,
+  createPersistedAdapter,
+  everyContiguousPartition,
+  expectGaveUpAfterReadiness,
+  expectPreloadOutcome,
+  expectWholePublications,
+  mockStream,
+  mockSubscribe,
+  mustRefetch,
+  observePreload,
+  observePublications,
+  resetElectricOracleMocks,
+  resumeState,
+  rowsFromCollection,
+  rowsFromMap,
+  runTrace,
+  shapeId,
+  subsetEnd,
+  upToDate,
+} from './electric-adapter-support'
+import type { OracleRow } from './electric-adapter-support'
+import type { Message, Offset } from '@electric-sql/client'
+import type { PersistedTx } from '../../db-sqlite-persistence-core/src'
+import type { ElectricCollectionUtils } from '../src/electric'
+
+vi.mock(`@electric-sql/client`, async () => {
+  const actual = await vi.importActual(`@electric-sql/client`)
+  return {
+    ...actual,
+    ShapeStream: vi.fn(() => createMockStream(mockStream)),
+  }
+})
+
+describe(`Electric adapter laws`, () => {
+  beforeEach(() => {
+    resetElectricOracleMocks()
+  })
+
+  it.each([false, true])(
+    `cleans direct traces after delivery failure and preserves the primary error (cleanup failure: %s)`,
+    async (failCleanup) => {
+      const primary = new Error(`delivery sentinel`)
+      const secondary = new Error(`cleanup sentinel`)
+      const cleanup = vi.fn(async (release: () => Promise<void>) => {
+        await release()
+        if (failCleanup) throw secondary
+      })
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      try {
+        await expect(
+          runTrace(`cleanup-${failCleanup}`, `eager`, [[]], [], new Map(), {
+            beforeDelivery: () => {
+              throw primary
+            },
+            cleanup,
+          }),
+        ).rejects.toBe(primary)
+        expect(cleanup).toHaveBeenCalledTimes(1)
+        const unsubscribe = mockSubscribe.mock.results.at(-1)!.value
+        expect(unsubscribe).toHaveBeenCalledTimes(1)
+        const streamOptions = vi.mocked(ShapeStream).mock.calls.at(-1)![0] as {
+          signal?: AbortSignal
+        }
+        expect(streamOptions.signal?.aborted).toBe(true)
+        if (failCleanup)
+          expect(warning).toHaveBeenCalledWith(
+            `Electric oracle cleanup failed after a primary error`,
+            secondary,
+          )
+        else expect(warning).not.toHaveBeenCalled()
+      } finally {
+        warning.mockRestore()
+      }
+    },
+  )
+  it(`preserves unexpected preload failures instead of treating observation as success`, async () => {
+    const failure = new Error(`test-owned preload failure`)
+    const observed = observePreload(Promise.reject(failure))
+    const outcome = await observed.outcome
+    expect(outcome).toEqual({ status: `rejected`, reason: failure })
+    if (outcome.status === `rejected`) expect(outcome.reason).toBe(failure)
+    expect(() => expectPreloadOutcome(observed, outcome)).toThrow(failure)
+    const success = observePreload(Promise.resolve())
+    expectPreloadOutcome(success, await success.outcome)
+  })
+  it.each([`reset`, `delete`, `move-out`] as const)(
+    `keeps $0 removal authoritative across an optimistic write and a new acquisition`,
+    async (removal) => {
+      const trace = createOracleCollection(
+        `parked-presence`,
+        `on-demand`,
+        createMetadata(new Map()).api,
+      )
+      const persistence = createDeferred<void>()
+      let acquired: Promise<unknown> | undefined
+      let transaction: ReturnType<typeof createTransaction> | undefined
+      try {
+        const inserted = change(`insert`, 1, `complete`)
+        trace.subscriber([
+          { ...inserted, headers: { ...inserted.headers, tags: [`left`] } },
+          upToDate,
+        ])
+        transaction = createTransaction({
+          mutationFn: () => persistence.promise,
+        })
+        transaction.mutate(() =>
+          trace.collection.insert({
+            id: 99,
+            name: `optimistic`,
+            stable: `stable-99`,
+          }),
+        )
+        const removed: Message<OracleRow> =
+          removal === `reset`
+            ? mustRefetch
+            : removal === `delete`
+              ? change(`delete`, 1, `complete`)
+              : {
+                  headers: {
+                    event: `move-out`,
+                    patterns: [{ pos: 0, value: `left` }],
+                  },
+                }
+        trace.subscriber([removed, subsetEnd])
+        // Truncation drains immediately; ordinary removals remain parked.
+        expect(trace.collection.has(1)).toBe(removal !== `reset`)
+        acquired = Promise.resolve(
+          trace.collection._sync.loadSubset({
+            where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(2)]),
+          }),
+        )
+        void acquired.catch(() => {})
+        trace.subscriber([change(`update`, 1, `partial`), upToDate])
+        persistence.resolve()
+        await transaction.isPersisted.promise
+        await acquired
+        expect(trace.collection.has(1)).toBe(false)
+      } finally {
+        persistence.resolve()
+        await transaction?.isPersisted.promise
+        await trace.collection.cleanup()
+        await acquired
+      }
+    },
+  )
+  it(`publishes later Electric callbacks while an earlier durability turn is held`, async () => {
+    let subscriber: ((messages: Array<Message<OracleRow>>) => void) | undefined
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const firstPersistenceEntered = createDeferred<void>()
+    const releaseFirstPersistence = createDeferred<void>()
+    const persistedMetadata = new Map<string, unknown>()
+    const persistedRows = new Map<string | number, OracleRow>()
+    const adapter = createPersistedAdapter(persistedMetadata, persistedRows)
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    let heldFirstRow = false
+    let durabilityCalls = 0
+    adapter.applyCommittedTx = async (...args) => {
+      durabilityCalls++
+      if (
+        !heldFirstRow &&
+        args[1].mutations.some((mutation) => mutation.key === 1)
+      ) {
+        heldFirstRow = true
+        firstPersistenceEntered.resolve()
+        await releaseFirstPersistence.promise
+      }
+      await applyCommittedTx(...args)
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `queued-persisted-presence`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          syncMode: `progressive`,
+          getKey: (row) => row.id,
+          startSync: true,
+        }),
+        persistence: { adapter },
+      }),
+    )
+    const publications = observePublications(collection)
+
+    await withElectricCleanup(async () => {
+      await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`), {
+        interval: 1,
+        timeout: 250,
+      })
+      mockStream.lastOffset = `90_0`
+      subscriber!([upToDate])
+      await vi.waitFor(() => expect(collection.status).toBe(`ready`), {
+        interval: 1,
+        timeout: 250,
+      })
+
+      const first = change(`insert`, 1, `holds persistence`)
+      first.value = { id: 1, name: `holds persistence`, stable: `stable-1` }
+      mockStream.lastOffset = `91_0`
+      subscriber!([first, upToDate])
+      await atCheckpoint(
+        firstPersistenceEntered.promise,
+        `first Electric persistence entered`,
+      )
+      const durabilityCallsAtHold = durabilityCalls
+
+      const queued = change(`insert`, 2, `queued insert`)
+      queued.value = { id: 2, name: `queued insert`, stable: `stable-2` }
+      mockStream.lastOffset = `92_0`
+      subscriber!([queued, upToDate])
+
+      const laterUpdate = change(`update`, 2, `later update`)
+      laterUpdate.value = { id: 2, name: `later update`, stable: `stable-2` }
+      mockStream.lastOffset = `93_0`
+      subscriber!([laterUpdate, upToDate])
+
+      const expected = rowsFromMap(
+        new Map([
+          [1, first.value],
+          [2, laterUpdate.value],
+        ]),
+      )
+      expect({
+        publicRows: rowsFromCollection(collection),
+        durableRows: rowsFromMap(persistedRows),
+        noLaterDurabilityStarted: durabilityCalls === durabilityCallsAtHold,
+        published: publications.entries.some(
+          ({ cut, rows }) =>
+            cut === `event` && isDeepStrictEqual(rows, expected),
+        ),
+      }).toEqual({
+        publicRows: rowsFromMap(new Map([[1, first.value]])),
+        durableRows: [],
+        noLaterDurabilityStarted: true,
+        published: false,
+      })
+
+      releaseFirstPersistence.resolve()
+      await vi.waitFor(
+        () =>
+          expect(rowsFromMap(persistedRows)).toEqual(
+            rowsFromMap(
+              new Map([
+                [1, first.value],
+                [2, laterUpdate.value],
+              ]),
+            ),
+          ),
+        { interval: 1, timeout: 250 },
+      )
+      expect(rowsFromCollection(collection)).toEqual(
+        rowsFromMap(
+          new Map([
+            [1, first.value],
+            [2, laterUpdate.value],
+          ]),
+        ),
+      )
+      expect(collection.status).toBe(`ready`)
+    }, [
+      () => releaseFirstPersistence.resolve(),
+      () => publications.stop(),
+      () => collection.cleanup(),
+    ])
+  })
+  it(`keeps pending row presence across callbacks until one persisted subset commit`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const persistedRows = new Map<string | number, OracleRow>()
+    const persistedMetadata = new Map<string, unknown>()
+    const adapter = createPersistedAdapter(persistedMetadata, persistedRows)
+    const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
+    const durabilityEntered = createDeferred<void>()
+    const releaseDurability = createDeferred<void>()
+    const durabilitySettled = createDeferred<void>()
+    let persistedTx: PersistedTx | undefined
+    adapter.applyCommittedTx = async (...args) => {
+      persistedTx = structuredClone(args[1])
+      durabilityEntered.resolve()
+      await releaseDurability.promise
+      await applyCommittedTx(...args)
+      durabilitySettled.resolve()
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `persisted-cross-callback-presence`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          syncMode: `eager`,
+          getKey: (row) => row.id,
+          startSync: true,
+        }),
+        persistence: { adapter },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await withElectricCleanup(async () => {
+      await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
+
+      subscriber([change(`insert`, 1, ``)])
+      subscriber([change(`update`, 1, `updated across callbacks`)])
+      subscriber([subsetEnd])
+      await atCheckpoint(
+        durabilityEntered.promise,
+        `cross-callback durability entered`,
+      )
+
+      expect({
+        publicRows: rowsFromCollection(collection),
+        durableRows: rowsFromMap(persistedRows),
+        persistedMutations: persistedTx?.mutations.map((mutation) => ({
+          type: mutation.type,
+          key: mutation.key,
+          value: mutation.type === `delete` ? undefined : mutation.value,
+        })),
+      }).toEqual({
+        publicRows: [[1, `updated across callbacks`, `stable-1`]],
+        durableRows: [],
+        persistedMutations: [
+          {
+            type: `update`,
+            key: 1,
+            value: {
+              id: 1,
+              name: ``,
+              stable: `stable-1`,
+            },
+          },
+          {
+            type: `update`,
+            key: 1,
+            value: {
+              id: 1,
+              name: `updated across callbacks`,
+            },
+          },
+        ],
+      })
+
+      releaseDurability.resolve()
+      await atCheckpoint(
+        durabilitySettled.promise,
+        `cross-callback durability settled`,
+      )
+      expect(rowsFromMap(persistedRows)).toEqual([
+        [1, `updated across callbacks`, `stable-1`],
+      ])
+    }, [
+      async () => {
+        releaseDurability.resolve()
+        await collection.cleanup()
+      },
+    ])
+  })
+  it(`retains a wrong intermediate publication even when the final read repairs it`, async () => {
+    const trace = createOracleCollection(
+      `publication-recorder-control`,
+      `eager`,
+      createMetadata(new Map()).api,
+    )
+    trace.subscriber([change(`insert`, 1, `old`), upToDate])
+    const observed = observePublications(trace.collection)
+    try {
+      observed.record(`before`)
+      trace.subscriber([change(`update`, 1, `wrong`), upToDate])
+      trace.subscriber([change(`update`, 1, `correct`), upToDate])
+      observed.record(`final`)
+      expect(rowsFromCollection(trace.collection)).toEqual([
+        [1, `correct`, `stable-1`],
+      ])
+      expect(observed.entries[0]!.rows).toEqual([[1, `old`, `stable-1`]])
+      expect(
+        observed.entries.some(
+          ({ cut, rows }) => cut === `event` && rows[0]?.[1] === `wrong`,
+        ),
+      ).toBe(true)
+      expect(() =>
+        expectWholePublications(observed.entries, [
+          [[1, `old`, `stable-1`]],
+          [[1, `correct`, `stable-1`]],
+        ]),
+      ).toThrow()
+      expectWholePublications(observed.entries, [
+        [[1, `old`, `stable-1`]],
+        [[1, `wrong`, `stable-1`]],
+        [[1, `correct`, `stable-1`]],
+      ])
+    } finally {
+      observed.stop()
+      await trace.collection.cleanup()
+    }
+  })
+  for (const syncMode of [`eager`, `progressive`] as const) {
+    it(`rejects unseen resumed updates and recovers on the next ${syncMode} lifecycle`, async () => {
+      const metadata = createMetadata(resumeState())
+      const old = createOracleCollection(
+        `invalid-${syncMode}-resume`,
+        syncMode,
+        metadata.api,
+      )
+
+      old.subscriber([change(`update`, 1, `partial`)])
+      expect(old.collection.status).toBe(`error`)
+      expect(old.collection.has(1)).toBe(false)
+      expect(old.unsubscribe).toHaveBeenCalledOnce()
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `reset` }),
+      )
+
+      old.subscriber([change(`insert`, 1, `old generation`), upToDate])
+      expect(old.collection.has(1)).toBe(false)
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `reset` }),
+      )
+      await old.collection.cleanup()
+
+      const fresh = createOracleCollection(
+        `fresh-${syncMode}-snapshot`,
+        syncMode,
+        metadata.api,
+      )
+      fresh.subscriber([change(`insert`, 1, `complete snapshot`), upToDate])
+
+      expect(fresh.collection.status).toBe(`ready`)
+      expect(fresh.collection.get(1)?.name).toBe(`complete snapshot`)
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `resume`, offset: `20_0` }),
+      )
+      await fresh.collection.cleanup()
+    })
+
+    it(`treats delete then update as an invalid ${syncMode} resume`, async () => {
+      const metadata = createMetadata(resumeState())
+      const trace = createOracleCollection(
+        `delete-update-${syncMode}-resume`,
+        syncMode,
+        metadata.api,
+      )
+
+      trace.subscriber([
+        change(`insert`, 1, `seen`),
+        change(`delete`, 1, `seen`),
+        change(`update`, 1, `partial`),
+      ])
+
+      expect(trace.collection.status).toBe(`error`)
+      expect(trace.collection.has(1)).toBe(false)
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `reset` }),
+      )
+      await trace.collection.cleanup()
+    })
+
+    it(`rejects delete then update across every ${syncMode} resume partition`, async () => {
+      const messages = [
+        change(`delete`, 1, `complete`),
+        change(`update`, 1, `partial`),
+        upToDate,
+      ]
+
+      for (const [partitionId, partition] of everyContiguousPartition(
+        messages,
+      ).entries()) {
+        const metadata = createMetadata(resumeState())
+        const trace = createOracleCollection(
+          `invalid-partition-${syncMode}-${partitionId}`,
+          syncMode,
+          metadata.api,
+        )
+        trace.subscriber([change(`insert`, 1, `complete`), upToDate])
+        for (const batch of partition) trace.subscriber(batch)
+
+        expectGaveUpAfterReadiness(trace.collection)
+        expect(trace.collection.get(1)).toEqual(
+          expect.objectContaining({ stable: `stable-1` }),
+        )
+        expect(metadata.state.get(`electric:resume`)).toEqual(
+          expect.objectContaining({ kind: `reset` }),
+        )
+        await trace.collection.cleanup()
+      }
+    })
+  }
+  it(`keeps stream cleanup and stale callbacks scoped to their lifecycle`, async () => {
+    const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> = []
+    const unsubscribes = [vi.fn(), vi.fn()]
+    mockSubscribe.mockImplementation((callback) => {
+      const index = subscribers.length
+      subscribers.push(callback)
+      return unsubscribes[index]!
+    })
+    const options = electricCollectionOptions<OracleRow>({
+      id: `reused-sync-config`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const createLifecycle = (id: string) => {
+      const metadata = createMetadata(resumeState())
+      const lifecycleSync = options.sync
+      return createCollection({
+        ...options,
+        id,
+        sync: {
+          ...lifecycleSync,
+          sync: (params: Parameters<typeof lifecycleSync.sync>[0]) =>
+            lifecycleSync.sync({ ...params, metadata: metadata.api }),
+        },
+      })
+    }
+
+    const oldCollection = createLifecycle(`old-sync-lifecycle`)
+    const currentCollection = createLifecycle(`current-sync-lifecycle`)
+
+    subscribers[0]!([change(`insert`, 1, `first row`), upToDate])
+    subscribers[1]!([change(`insert`, 2, `second row`), upToDate])
+    expect(oldCollection.get(1)?.name).toBe(`first row`)
+    expect(currentCollection.get(2)?.name).toBe(`second row`)
+    subscribers[0]!([change(`update`, 1, `first row updated`), upToDate])
+    const currentMatch = currentCollection.utils.awaitMatch(
+      (message) => `value` in message && message.value.id === 3,
+      100,
+    )
+    const currentTxid = currentCollection.utils.awaitTxId(42, 100)
+    const currentSnapshotTxid = currentCollection.utils.awaitTxId(50, 100)
+    let currentMatchResolved = false
+    let currentTxidResolved = false
+    let currentSnapshotTxidResolved = false
+    void currentMatch.then(() => {
+      currentMatchResolved = true
+    })
+    void currentTxid.then(() => {
+      currentTxidResolved = true
+    })
+    void currentSnapshotTxid.then(() => {
+      currentSnapshotTxidResolved = true
+    })
+    subscribers[0]!([
+      change(`insert`, 3, `wrong lifecycle`),
+      {
+        headers: {
+          control: `snapshot-end`,
+          xmin: `100`,
+          xmax: `150`,
+          xip_list: [],
+        },
+      },
+      { headers: { control: `up-to-date`, txids: [42] } },
+    ])
+    await Promise.resolve()
+    expect(currentMatchResolved).toBe(false)
+    expect(currentTxidResolved).toBe(false)
+    expect(currentSnapshotTxidResolved).toBe(false)
+
+    await oldCollection.cleanup()
+
+    expect(unsubscribes[0]).toHaveBeenCalledOnce()
+    expect(unsubscribes[1]).not.toHaveBeenCalled()
+
+    subscribers[0]!([change(`update`, 1, `stale`)])
+    expect(unsubscribes[1]).not.toHaveBeenCalled()
+    subscribers[1]!([
+      change(`insert`, 3, `still live`),
+      {
+        headers: {
+          control: `snapshot-end`,
+          xmin: `100`,
+          xmax: `150`,
+          xip_list: [],
+        },
+      },
+      { headers: { control: `up-to-date`, txids: [42] } },
+    ])
+    await expect(currentMatch).resolves.toBe(true)
+    await expect(currentTxid).resolves.toBe(true)
+    await expect(currentSnapshotTxid).resolves.toBe(true)
+    expect(currentCollection.get(3)?.name).toBe(`still live`)
+    await currentCollection.cleanup()
+    expect(unsubscribes[1]).toHaveBeenCalledOnce()
+  })
+  it(`binds sync metadata import and export to the receiving collection`, async () => {
+    const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> = []
+    mockSubscribe.mockImplementation((callback) => {
+      subscribers.push(callback)
+      return vi.fn()
+    })
+    const options = electricCollectionOptions<OracleRow>({
+      id: `shared-metadata-config`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const first = createCollection({ ...options, id: `metadata-first` })
+    const second = createCollection({ ...options, id: `metadata-second` })
+
+    subscribers[0]!([{ headers: { control: `up-to-date`, txids: [11] } }])
+    subscribers[1]!([{ headers: { control: `up-to-date`, txids: [22] } }])
+
+    expect(first.config.sync.exportSyncMeta?.()).toMatchObject({
+      version: 1,
+      seenTxids: [11],
+    })
+    expect(second.config.sync.exportSyncMeta?.()).toMatchObject({
+      version: 1,
+      seenTxids: [22],
+    })
+
+    const importedResume = {
+      kind: `resume` as const,
+      requiresTagState: false,
+      offset: `7_0` as const,
+      handle: `shape-7`,
+      shapeId,
+      updatedAt: 7,
+    }
+    first.config.sync.importSyncMeta?.({
+      version: 1,
+      resume: importedResume,
+      seenTxids: [99],
+    })
+
+    await expect(first.utils.awaitTxId(99, 50)).resolves.toBe(true)
+    await expect(second.utils.awaitTxId(99, 10)).rejects.toThrow()
+    expect(first.config.sync.exportSyncMeta?.()).toEqual({
+      version: 1,
+      resume: importedResume,
+      seenTxids: [99],
+    })
+    expect(second.config.sync.exportSyncMeta?.()).toMatchObject({
+      version: 1,
+      seenTxids: [22],
+    })
+    expect(second.config.sync.exportSyncMeta?.()).not.toMatchObject({
+      resume: importedResume,
+    })
+
+    const third = createCollection({ ...options, id: `metadata-third` })
+    await expect(third.utils.awaitTxId(99, 10)).rejects.toThrow()
+    expect(third.config.sync.exportSyncMeta?.()).not.toMatchObject({
+      resume: importedResume,
+    })
+
+    await first.cleanup()
+    await second.cleanup()
+    await third.cleanup()
+  })
+  it(`consumes raw sync metadata when the next collection is materialized`, async () => {
+    mockSubscribe.mockImplementation(() => vi.fn())
+    const options = electricCollectionOptions<OracleRow>({
+      id: `seeded-metadata-config`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const importedResume = {
+      kind: `resume` as const,
+      requiresTagState: false,
+      offset: `8_0` as const,
+      handle: `shape-8`,
+      shapeId,
+      updatedAt: 8,
+    }
+    options.sync.importSyncMeta?.({
+      version: 1,
+      resume: importedResume,
+      seenTxids: [55],
+    })
+
+    const seeded = createCollection({ ...options, id: `metadata-seeded` })
+    await expect(seeded.utils.awaitTxId(55, 50)).resolves.toBe(true)
+    expect(seeded.config.sync.exportSyncMeta?.()).toMatchObject({
+      resume: importedResume,
+      seenTxids: [55],
+    })
+
+    const unseeded = createCollection({ ...options, id: `metadata-unseeded` })
+    await expect(unseeded.utils.awaitTxId(55, 10)).rejects.toThrow()
+    expect(unseeded.config.sync.exportSyncMeta?.()).toEqual({
+      version: 1,
+      seenTxids: [],
+    })
+
+    await seeded.cleanup()
+    await unseeded.cleanup()
+  })
+  it(`binds imported evidence and pending matches before lazy sync starts`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementation((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const options = electricCollectionOptions<OracleRow>({
+      id: `lazy-bound-evidence`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: false,
+    })
+    const collection = createCollection(options)
+    const importedResume = {
+      kind: `resume` as const,
+      requiresTagState: false,
+      offset: `9_0` as const,
+      handle: `shape-9`,
+      shapeId,
+      updatedAt: 9,
+    }
+    collection.config.sync.importSyncMeta?.({
+      version: 1,
+      resume: importedResume,
+      seenTxids: [33],
+    })
+
+    await expect(collection.utils.awaitTxId(33, 20)).resolves.toBe(true)
+    const pendingMatch = collection.utils.awaitMatch(
+      (message) => `value` in message && message.value.id === 5,
+      100,
+    )
+    const pendingTxid = collection.utils.awaitTxId(34, 100)
+    const preload = collection.preload()
+    expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
+      offset: `9_0`,
+      handle: `shape-9`,
+    })
+    const evidenceChange = change(`insert`, 5, `matched after start`)
+    subscriber([
+      {
+        ...evidenceChange,
+        headers: { operation: `insert`, txids: [34] },
+      },
+      upToDate,
+    ])
+
+    await expect(pendingMatch).resolves.toBe(true)
+    await expect(pendingTxid).resolves.toBe(true)
+    await preload
+    expect(collection.get(5)?.name).toBe(`matched after start`)
+    await collection.cleanup()
+  })
+  it(`keeps descriptor utilities captured before collection startup live`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementation((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const options = electricCollectionOptions<OracleRow>({
+      id: `captured-descriptor-utilities`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: false,
+    })
+    const { awaitMatch, awaitTxId } = options.utils
+    const collection = createCollection(options)
+    const pendingMatch = awaitMatch(
+      (message) => `value` in message && message.value.id === 77,
+      100,
+    )
+    const pendingTxid = awaitTxId(77, 100)
+
+    const preload = collection.preload()
+    const evidenceChange = change(`insert`, 77, `captured utilities`)
+    subscriber([
+      {
+        ...evidenceChange,
+        headers: { operation: `insert`, txids: [77] },
+      },
+      upToDate,
+    ])
+
+    await expect(pendingMatch).resolves.toBe(true)
+    await expect(pendingTxid).resolves.toBe(true)
+    await preload
+    await collection.cleanup()
+  })
+  it(`retires a pending pre-start match when a lazy collection is cleaned up`, async () => {
+    mockSubscribe.mockImplementation(() => vi.fn())
+    const collection = createCollection(
+      electricCollectionOptions<OracleRow>({
+        id: `lazy-pre-start-cleanup`,
+        shapeOptions: {
+          url: `http://test-url`,
+          params: { table: `test_table` },
+        },
+        getKey: (row) => row.id,
+        startSync: false,
+      }),
+    )
+    const pendingMatch = collection.utils.awaitMatch(() => false, 100)
+
+    await collection.cleanup()
+
+    await expect(pendingMatch).rejects.toThrow(/aborted/i)
+    expect(mockSubscribe).not.toHaveBeenCalled()
+  })
+  it(`retires pre-start waiters when persisted metadata startup is interrupted`, async () => {
+    const metadataStarted = createDeferred<void>()
+    const metadataGate = createDeferred<void>()
+    const adapter = createPersistedAdapter(new Map(), new Map())
+    const loadResumeSnapshot = adapter.loadResumeSnapshot
+    adapter.loadResumeSnapshot = async (...args) => {
+      metadataStarted.resolve()
+      await metadataGate.promise
+      return loadResumeSnapshot(args[0], args[1])
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `persisted-startup-waiter-cleanup`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          getKey: (row) => row.id,
+          startSync: false,
+        }),
+        persistence: { adapter },
+      }),
+    )
+    const pendingMatch = collection.utils.awaitMatch(() => false, 100)
+    const pendingTxid = collection.utils.awaitTxId(702, 100)
+    const preload = expect(collection.preload()).rejects.toMatchObject({
+      name: `AbortError`,
+    })
+    await metadataStarted.promise
+    const matchOutcome = expect(pendingMatch).rejects.toThrow(/aborted/i)
+    const txidOutcome = expect(pendingTxid).rejects.toThrow(/aborted/i)
+
+    await collection.cleanup()
+
+    await matchOutcome
+    await txidOutcome
+    expect(mockSubscribe).not.toHaveBeenCalled()
+    metadataGate.resolve()
+    await preload
+  })
+  it(`retires pre-start waiters through automatic collection GC`, async () => {
+    const metadataGate = createDeferred<void>()
+    const adapter = createPersistedAdapter(new Map(), new Map())
+    const loadResumeSnapshot = adapter.loadResumeSnapshot
+    adapter.loadResumeSnapshot = vi.fn(async (...args) => {
+      await metadataGate.promise
+      return loadResumeSnapshot(args[0], args[1])
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `persisted-gc-waiter-cleanup`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          getKey: (row) => row.id,
+          startSync: false,
+          gcTime: 10,
+        }),
+        persistence: { adapter },
+      }),
+    )
+    const pendingMatch = collection.utils.awaitMatch(() => false, 5000)
+    const pendingTxid = collection.utils.awaitTxId(703, 5000)
+    // A pending preload owns retention; exercise unowned sync for automatic GC.
+    collection.startSyncImmediate()
+    await vi.waitFor(
+      () => expect(adapter.loadResumeSnapshot).toHaveBeenCalledOnce(),
+      { interval: 1, timeout: 250 },
+    )
+    const subscription = collection.subscribeChanges(() => {})
+    const matchOutcome = pendingMatch.catch((error: unknown) => error)
+    const txidOutcome = pendingTxid.catch((error: unknown) => error)
+
+    subscription.unsubscribe()
+    await vi.waitFor(() => expect(collection.status).toBe(`cleaned-up`), {
+      interval: 10,
+      timeout: 1500,
+    })
+    const pendingSentinel = Symbol(`pending`)
+    const matchResult = await Promise.race([
+      matchOutcome,
+      new Promise((resolve) => setTimeout(() => resolve(pendingSentinel), 50)),
+    ])
+    const txidResult = await Promise.race([
+      txidOutcome,
+      new Promise((resolve) => setTimeout(() => resolve(pendingSentinel), 50)),
+    ])
+
+    expect(matchResult).toEqual(
+      expect.objectContaining({
+        message: expect.stringMatching(/aborted/i),
+      }),
+    )
+    expect(txidResult).toEqual(
+      expect.objectContaining({
+        message: expect.stringMatching(/aborted/i),
+      }),
+    )
+    expect(mockSubscribe).not.toHaveBeenCalled()
+    metadataGate.resolve()
+  })
+  it(`retires every pending waiter when its collection lifecycle is cleaned up`, async () => {
+    mockSubscribe.mockImplementation(() => vi.fn())
+    const lazy = createCollection(
+      electricCollectionOptions<OracleRow>({
+        id: `lazy-waiter-cleanup`,
+        shapeOptions: {
+          url: `http://test-url`,
+          params: { table: `test_table` },
+        },
+        getKey: (row) => row.id,
+        startSync: false,
+      }),
+    )
+    const lazyTxid = lazy.utils.awaitTxId(700, 100)
+    await lazy.cleanup()
+    await expect(lazyTxid).rejects.toThrow(/aborted/i)
+
+    const active = createOracleCollection(
+      `active-waiter-cleanup`,
+      `eager`,
+      createMetadata(new Map()).api,
+    )
+    const activeMatch = active.collection.utils.awaitMatch(() => false, 100)
+    const activeTxid = active.collection.utils.awaitTxId(701, 100)
+    await active.collection.cleanup()
+
+    await expect(activeMatch).rejects.toThrow(/aborted/i)
+    await expect(activeTxid).rejects.toThrow(/aborted/i)
+  })
+  it(`settles waiters according to whether evidence or cleanup wins`, async () => {
+    for (const cleanupWins of [true, false]) {
+      const trace = createOracleCollection(
+        `waiter-race-${cleanupWins}`,
+        `eager`,
+        createMetadata(new Map()).api,
+      )
+      const pendingMatch = trace.collection.utils.awaitMatch(
+        (message) => `value` in message && message.value.id === 91,
+        100,
+      )
+      const pendingTxid = trace.collection.utils.awaitTxId(91, 100)
+      const evidenceChange = change(`insert`, 91, `race winner`)
+      const evidence: Array<Message<OracleRow>> = [
+        {
+          ...evidenceChange,
+          headers: { operation: `insert`, txids: [91] },
+        },
+        upToDate,
+      ]
+
+      if (cleanupWins) {
+        await trace.collection.cleanup()
+        trace.subscriber(evidence)
+        await expect(pendingMatch).rejects.toThrow(/aborted/i)
+        await expect(pendingTxid).rejects.toThrow(/aborted/i)
+        expect(trace.collection.get(91)).toBeUndefined()
+      } else {
+        trace.subscriber(evidence)
+        await trace.collection.cleanup()
+        await expect(pendingMatch).resolves.toBe(true)
+        await expect(pendingTxid).resolves.toBe(true)
+      }
+    }
+  })
+  it(`keeps committed match evidence across newer writer batches`, async () => {
+    const metadata = createMetadata(new Map())
+    const trace = createOracleCollection(
+      `await-match-batch-generation`,
+      `eager`,
+      metadata.api,
+    )
+
+    trace.subscriber([change(`insert`, 1, `old batch`), upToDate])
+    trace.subscriber([change(`insert`, 2, `current batch`), upToDate])
+
+    await expect(
+      trace.collection.utils.awaitMatch(
+        (message) => `value` in message && message.value.name === `old batch`,
+        20,
+      ),
+    ).resolves.toBe(true)
+    await trace.collection.cleanup()
+  })
+  it(`keeps committed match evidence across callbacks with no new data`, async () => {
+    const trace = createOracleCollection(
+      `await-match-neutral-callback`,
+      `eager`,
+      createMetadata(new Map()).api,
+    )
+
+    trace.subscriber([change(`insert`, 1, `committed`), upToDate])
+    trace.subscriber([
+      {
+        headers: {
+          control: `snapshot-end`,
+          xmin: `100`,
+          xmax: `150`,
+          xip_list: [],
+        },
+      },
+    ])
+    trace.subscriber([])
+
+    await expect(
+      trace.collection.utils.awaitMatch(
+        (message) => `value` in message && message.value.id === 1,
+        20,
+      ),
+    ).resolves.toBe(true)
+    await trace.collection.cleanup()
+  })
+  it(`clears committed match evidence when the stream must refetch`, async () => {
+    const trace = createOracleCollection(
+      `await-match-reset-generation`,
+      `eager`,
+      createMetadata(new Map()).api,
+    )
+
+    trace.subscriber([change(`insert`, 1, `old generation`), upToDate])
+    trace.subscriber([mustRefetch, upToDate])
+
+    await expect(
+      trace.collection.utils.awaitMatch(
+        (message) =>
+          `value` in message && message.value.name === `old generation`,
+        20,
+      ),
+    ).rejects.toThrow(/Timeout waiting for custom match function/)
+    await trace.collection.cleanup()
+  })
+  it(`does not let a committed message satisfy awaitMatch after restart`, async () => {
+    const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> = []
+    mockSubscribe.mockImplementation((callback) => {
+      subscribers.push(callback)
+      return vi.fn()
+    })
+    const collection = createCollection(
+      electricCollectionOptions<OracleRow>({
+        id: `await-match-lifecycle-generation`,
+        shapeOptions: {
+          url: `http://test-url`,
+          params: { table: `test_table` },
+        },
+        getKey: (row) => row.id,
+        startSync: true,
+      }),
+    )
+
+    subscribers[0]!([change(`insert`, 1, `old lifecycle`), upToDate])
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(subscribers).toHaveLength(2))
+
+    await expect(
+      collection.utils.awaitMatch(
+        (message) =>
+          `value` in message && message.value.name === `old lifecycle`,
+        20,
+      ),
+    ).rejects.toThrow(/Timeout waiting for custom match function/)
+    await collection.cleanup()
+  })
+  for (const syncMode of [`eager`, `on-demand`, `progressive`] as const) {
+    it(`does not apply an unseen ${syncMode} update after must-refetch`, async () => {
+      const metadata = createMetadata(new Map())
+      const trace = createOracleCollection(
+        `must-refetch-unseen-${syncMode}`,
+        syncMode,
+        metadata.api,
+      )
+      trace.subscriber([change(`insert`, 1, `complete`), upToDate])
+
+      trace.subscriber([mustRefetch, change(`update`, 1, `partial`), upToDate])
+
+      expect(trace.collection.status).toBe(`ready`)
+      expect(trace.collection.has(1)).toBe(false)
+      await trace.collection.cleanup()
+    })
+
+    it(`keeps the ${syncMode} reset marker until the replacement snapshot is complete`, async () => {
+      const metadata = createMetadata(resumeState())
+      const trace = createOracleCollection(
+        `durable-reset-${syncMode}`,
+        syncMode,
+        metadata.api,
+      )
+
+      trace.subscriber([mustRefetch])
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `reset` }),
+      )
+
+      trace.subscriber([change(`insert`, 1, `partial snapshot`), subsetEnd])
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `reset` }),
+      )
+
+      trace.subscriber([
+        change(`update`, 2, `unseen`),
+        change(`update`, 1, `complete snapshot`),
+        upToDate,
+      ])
+      expect(trace.collection.status).toBe(`ready`)
+      expect(trace.collection.get(1)).toEqual(
+        expect.objectContaining({
+          id: 1,
+          name: `complete snapshot`,
+          stable: `stable-1`,
+        }),
+      )
+      expect(trace.collection.has(2)).toBe(false)
+      expect(metadata.state.get(`electric:resume`)).toEqual(
+        expect.objectContaining({ kind: `resume`, offset: `20_0` }),
+      )
+      await trace.collection.cleanup()
+    })
+  }
+  it(`does not let an older applied receipt finish a newer reset`, async () => {
+    const metadata = createMetadata(resumeState())
+    const trace = createOracleCollection(
+      `overlapping-reset-generations`,
+      `eager`,
+      metadata.api,
+    )
+    const persistence = createDeferred<void>()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+
+    trace.subscriber([
+      mustRefetch,
+      change(`insert`, 1, `first replacement`),
+      subsetEnd,
+    ])
+    transaction.mutate(() =>
+      trace.collection.insert({
+        id: 99,
+        name: `optimistic`,
+        stable: `stable-99`,
+      }),
+    )
+    trace.subscriber([upToDate])
+    trace.subscriber([mustRefetch])
+    await Promise.resolve()
+
+    trace.subscriber([change(`update`, 2, `unseen`), upToDate])
+
+    expect(trace.collection.status).not.toBe(`error`)
+    expect(trace.collection.has(2)).toBe(false)
+
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await trace.collection.cleanup()
+  })
+  // Readiness counts accepted rows; they publish when the mutation settles.
+  it(`publishes readiness once a held receipt is accepted`, async () => {
+    const metadata = createMetadata(new Map())
+    const trace = createOracleCollection(
+      `deferred-applied-receipt`,
+      `eager`,
+      metadata.api,
+    )
+    const persistence = createDeferred<void>()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    transaction.mutate(() =>
+      trace.collection.insert({
+        id: 99,
+        name: `optimistic`,
+        stable: `stable-99`,
+      }),
+    )
+
+    trace.subscriber([change(`insert`, 1, `synced`), upToDate])
+    await Promise.resolve()
+
+    expect(trace.collection.status).toBe(`ready`)
+    expect(trace.collection.has(1)).toBe(false)
+
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await trace.collection.stateWhenReady()
+
+    expect(trace.collection.status).toBe(`ready`)
+    expect(trace.collection.get(1)).toEqual(
+      expect.objectContaining({ stable: `stable-1` }),
+    )
+    await trace.collection.cleanup()
+  })
+  /**
+   * Full-mode recovery can accept its complete source snapshot while an
+   * optimistic transaction still withholds application. Collection readiness
+   * is allowed at acceptance; LoadSubsetFn success must await the applied
+   * receipt. The independent obligation is simply pending until the held
+   * transaction releases, then exact source-row visibility at settlement.
+   *
+   * Demand before and after readiness distinguishes an initial-ready gate
+   * from the stronger applied-settlement law, including receipts created
+   * before the acquisition's own commit cursor. The transaction promise
+   * controls application; yielding a turn only drains already queued work.
+   */
+  it.each([`before-ready`, `after-ready`] as const)(
+    `full recovery subset waits for application when acquired %s`,
+    async (acquireAt) => {
+      const trace = createOracleCollection(
+        `full-recovery-applied-${acquireAt}`,
+        `on-demand`,
+        createMetadata(
+          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+        ).api,
+      )
+      const persistence = createDeferred<void>()
+      const transaction = createTransaction({
+        mutationFn: () => persistence.promise,
+      })
+      transaction.mutate(() =>
+        trace.collection.insert({
+          id: 99,
+          name: `optimistic`,
+          stable: `stable-99`,
+        }),
+      )
+      let outcome: `pending` | `fulfilled` | `rejected` = `pending`
+      const acquire = () =>
+        Promise.resolve(trace.collection._sync.loadSubset({ limit: 1 })).then(
+          () => {
+            outcome = `fulfilled`
+          },
+          (error: unknown) => {
+            outcome = `rejected`
+            throw error
+          },
+        )
+      let loading: Promise<void> | undefined
+      await withElectricCleanup(async () => {
+        if (acquireAt === `before-ready`) loading = acquire()
+        trace.subscriber([change(`insert`, 1, `replacement`), upToDate])
+        expect(trace.collection.status).toBe(`ready`)
+        if (acquireAt === `after-ready`) loading = acquire()
+        void loading!.catch(() => undefined)
+        await new Promise<void>((resolve) => setTimeout(resolve, 0))
+        expect(trace.collection.has(1), `application is still held`).toBe(false)
+        expect(outcome, `ready does not establish subset application`).toBe(
+          `pending`,
+        )
+        persistence.resolve()
+        await transaction.isPersisted.promise
+        await atCheckpoint(loading!, `full recovery applied settlement`)
+        expect(outcome).toBe(`fulfilled`)
+        expect(trace.collection.get(1)).toMatchObject({
+          id: 1,
+          name: `replacement`,
+          stable: `stable-1`,
+        })
+      }, [() => persistence.resolve(), () => trace.collection.cleanup()])
+    },
+  )
+  // A full stream keeps its capability across a same-run must-refetch. Its
+  // previous applied snapshot cannot establish newly requested replacement
+  // coverage. This continuation rejects a permanently fulfilled startup gate.
+  it(`full recovery demand waits again after a same-run reset`, async () => {
+    const trace = createOracleCollection(
+      `full-recovery-reset`,
+      `on-demand`,
+      createMetadata(
+        new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+      ).api,
+    )
+    await withElectricCleanup(async () => {
+      trace.subscriber([change(`insert`, 1, `first`), upToDate])
+      await trace.collection._sync.loadSubset({ limit: 1 })
+      trace.subscriber([mustRefetch])
+      let outcome = `pending`
+      const loading = Promise.resolve(
+        trace.collection._sync.loadSubset({ limit: 2 }),
+      ).then(
+        () => {
+          outcome = `fulfilled`
+        },
+        (error: unknown) => {
+          outcome = `rejected`
+          throw error
+        },
+      )
+      void loading.catch(() => undefined)
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(outcome, `prior readiness is not replacement coverage`).toBe(
+        `pending`,
+      )
+      trace.subscriber([change(`insert`, 2, `second`), upToDate])
+      await atCheckpoint(loading, `same-run replacement applied`)
+      expect(outcome).toBe(`fulfilled`)
+      expect(rowsFromCollection(trace.collection)).toEqual([
+        [2, `second`, `stable-2`],
+      ])
+    }, [() => trace.collection.cleanup()])
+  })
+  /**
+   * A scoped source snapshot owes applied settlement at subset-end, even
+   * when must-refetch opened a truncate replay. The independent model knows
+   * one inserted source row and no other rows; it predicts that a successful
+   * demand observes that row. This driver acquires through the real persisted
+   * wrapper before reset, delivers a subset-end without up-to-date, and checks
+   * public visibility at demand settlement. Full-mode replay's distinct
+   * up-to-date obligation is checked by neighboring laws.
+   */
+  it(`applies a scoped reset subset before its demand succeeds`, async () => {
+    let subscriber: ((messages: Array<Message<OracleRow>>) => void) | undefined
+    mockSubscribe.mockImplementation((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const adapter = createPersistedAdapter(
+      new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+      new Map(),
+    )
+    // This fixture abstracts physical cache IDs because the law here concerns
+    // source settlement. The SQLite generation oracle owns physical isolation.
+    let generation = 0
+    const claim = (id: string) => ({
+      storageCollectionId: `${id}:generation-${generation}`,
+      claimId: `claim-${generation}`,
+    })
+    adapter.claimCacheGeneration = async (id) => claim(id)
+    adapter.rotateCacheGeneration = async (id) => {
+      generation++
+      return claim(id)
+    }
+    adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
+    adapter.releaseCacheGenerationClaim = async () => {}
+    const options = electricCollectionOptions<OracleRow>({
+      id: `scoped-reset-applied-settlement`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      syncMode: `on-demand`,
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({ ...options, persistence: { adapter } }),
+    )
+    const snapshot = createDeferred<void>()
+    mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
+
+    await withElectricCleanup(async () => {
+      collection.startSyncImmediate()
+      await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
+      const demand = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+      void demand.catch(() => undefined)
+      await vi.waitFor(() =>
+        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
+      )
+      subscriber!([mustRefetch])
+      subscriber!([change(`insert`, 1, `scoped replacement`), subsetEnd])
+      snapshot.resolve()
+      await atCheckpoint(demand, `scoped reset applied settlement`)
+      expect(collection.get(1)).toMatchObject({
+        id: 1,
+        name: `scoped replacement`,
+        stable: `stable-1`,
+      })
+    }, [() => snapshot.resolve(), () => collection.cleanup()])
+  })
+  // Initial failure rejects all current waiters with the original error.
+  // Cleanup quietly settles adapter loads and invalidates later callbacks.
+  // A provider error alone does not make its future callbacks obsolete;
+  // retry semantics are checked by the neighboring recovery laws.
+  it.each([`failure`, `cleanup`] as const)(
+    `full recovery retires concurrent demand on %s`,
+    async (terminal) => {
+      const loggedError = vi
+        .spyOn(console, `error`)
+        .mockImplementation(() => {})
+      const trace = createOracleCollection(
+        `full-recovery-${terminal}`,
+        `on-demand`,
+        createMetadata(
+          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+        ).api,
+      )
+      const sentinel = new Error(`initial full sync failed`)
+      const outcomes = [1, 2].map((limit) =>
+        Promise.resolve(trace.collection._sync.loadSubset({ limit })).then(
+          () => ({ kind: `fulfilled` as const }),
+          (error: unknown) => ({ kind: `rejected` as const, error }),
+        ),
+      )
+      await withElectricCleanup(async () => {
+        if (terminal === `failure`) {
+          const options = vi.mocked(ShapeStream).mock.calls.at(-1)?.[0] as
+            | {
+                onError?: (error: unknown) => void
+              }
+            | undefined
+          expect(options?.onError).toBeTypeOf(`function`)
+          options?.onError?.(sentinel)
+        } else await trace.collection.cleanup()
+        const results = await atCheckpoint(
+          Promise.all(outcomes),
+          `terminal full recovery settlement`,
+        )
+        if (terminal === `failure`) {
+          expect(results).toEqual([
+            { kind: `rejected`, error: sentinel },
+            { kind: `rejected`, error: sentinel },
+          ])
+          expect(trace.collection.status).toBe(`error`)
+        } else {
+          expect(results).toEqual([
+            { kind: `fulfilled` },
+            { kind: `fulfilled` },
+          ])
+          expect(trace.collection.status).toBe(`cleaned-up`)
+          trace.subscriber([change(`insert`, 1, `abandoned`), upToDate])
+          expect(trace.collection.has(1)).toBe(false)
+        }
+      }, [() => trace.collection.cleanup(), () => loggedError.mockRestore()])
+    },
+  )
+  // Each demand owns its cancellation even while full-log source evidence is
+  // shared. Aborting one demand ends that load before up-to-date; its sibling
+  // and a replacement of the canceled demand still wait for the source
+  // snapshot and succeed after the row applies.
+  it(`cancels one full recovery demand without settling its sibling`, async () => {
+    const trace = createOracleCollection(
+      `full-recovery-one-abort`,
+      `on-demand`,
+      createMetadata(
+        new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+      ).api,
+    )
+    const controller = new AbortController()
+    const canceled = Promise.resolve(
+      trace.collection._sync.loadSubset({
+        limit: 1,
+        signal: controller.signal,
+      }),
+    )
+    void canceled.catch(() => undefined)
+    let siblingOutcome = `pending`
+    const sibling = Promise.resolve(
+      trace.collection._sync.loadSubset({ limit: 2 }),
+    ).then(
+      () => {
+        siblingOutcome = `fulfilled`
+      },
+      () => {
+        siblingOutcome = `rejected`
+      },
+    )
+
+    await withElectricCleanup(async () => {
+      controller.abort()
+      await expect(
+        atCheckpoint(canceled, `canceled full recovery demand`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      expect(siblingOutcome).toBe(`pending`)
+
+      // Cancellation cannot mark this predicate complete or poison a later
+      // acquisition of the same demand key.
+      const replacement = Promise.resolve(
+        trace.collection._sync.loadSubset({ limit: 1 }),
+      )
+      let replacementOutcome = `pending`
+      const observedReplacement = replacement.then(
+        () => {
+          replacementOutcome = `fulfilled`
+        },
+        () => {
+          replacementOutcome = `rejected`
+        },
+      )
+      await Promise.resolve()
+      expect(replacementOutcome).toBe(`pending`)
+
+      trace.subscriber([change(`insert`, 1, `source row`), upToDate])
+      await atCheckpoint(
+        Promise.all([sibling, observedReplacement]),
+        `remaining full recovery demands`,
+      )
+      expect(siblingOutcome).toBe(`fulfilled`)
+      expect(replacementOutcome).toBe(`fulfilled`)
+      expect(trace.collection.get(1)).toMatchObject({ name: `source row` })
+    }, [() => trace.collection.cleanup()])
+  })
+  // An external ShapeStream abort is a provider failure, not Collection
+  // cleanup. It cannot fulfill an in-flight demand or certify its key as
+  // loaded when no source snapshot arrived. A second identical demand must
+  // therefore remain a failing acquisition rather than deduplicated success.
+  it(`does not certify a full recovery demand after external stream abort`, async () => {
+    const external = new AbortController()
+    const trace = createOracleCollection(
+      `full-recovery-external-abort`,
+      `on-demand`,
+      createMetadata(
+        new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+      ).api,
+      { signal: external.signal },
+    )
+    const first = Promise.resolve(
+      trace.collection._sync.loadSubset({ limit: 1 }),
+    )
+    void first.catch(() => undefined)
+
+    await withElectricCleanup(async () => {
+      external.abort()
+      await expect(
+        atCheckpoint(first, `externally aborted full recovery demand`),
+      ).rejects.toMatchObject({ name: `StreamAbortedError` })
+      const second = trace.collection._sync.loadSubset({ limit: 1 })
+      expect(second).not.toBe(true)
+      await expect(Promise.resolve(second)).rejects.toMatchObject({
+        name: `AbortError`,
+      })
+      expect(trace.collection.size).toBe(0)
+    }, [() => trace.collection.cleanup()])
+  })
+  // A subset transport may return after the shared stream retires. Its
+  // messages cannot apply to that lifecycle, so transport settlement alone
+  // cannot certify the demand or its deduplication key.
+  it(`does not certify a subset snapshot after external stream abort`, async () => {
+    const external = new AbortController()
+    const trace = createOracleCollection(
+      `subset-external-abort`,
+      `on-demand`,
+      createMetadata(new Map()).api,
+      { signal: external.signal },
+    )
+    const snapshot = createDeferred<void>()
+    mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
+    const first = Promise.resolve(
+      trace.collection._sync.loadSubset({ limit: 1 }),
+    )
+    void first.catch(() => undefined)
+
+    await withElectricCleanup(async () => {
+      await vi.waitFor(() =>
+        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
+      )
+      external.abort()
+      snapshot.resolve()
+      await expect(
+        atCheckpoint(first, `externally aborted subset snapshot`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      const second = trace.collection._sync.loadSubset({ limit: 1 })
+      expect(second).not.toBe(true)
+      await expect(Promise.resolve(second)).rejects.toMatchObject({
+        name: `AbortError`,
+      })
+      expect(trace.collection.size).toBe(0)
+    }, [() => snapshot.resolve(), () => trace.collection.cleanup()])
+  })
+  // Even a completed transport cannot certify a demand while its accepted
+  // source commit is waiting for application. Retiring the stream during that
+  // wait leaves no visible source row, so the demand must fail when the held
+  // applied receipt finally settles.
+  it(`does not certify an externally aborted subset during applied settlement`, async () => {
+    const external = new AbortController()
+    const trace = createOracleCollection(
+      `subset-held-external-abort`,
+      `on-demand`,
+      createMetadata(new Map()).api,
+      { signal: external.signal },
+    )
+    const persistence = createDeferred<void>()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    transaction.mutate(() =>
+      trace.collection.insert({
+        id: 99,
+        name: `optimistic`,
+        stable: `stable-99`,
+      }),
+    )
+    const snapshot = createDeferred<void>()
+    mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
+    const first = Promise.resolve(
+      trace.collection._sync.loadSubset({ limit: 1 }),
+    )
+    void first.catch(() => undefined)
+
+    await withElectricCleanup(async () => {
+      await vi.waitFor(() =>
+        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
+      )
+      trace.subscriber([change(`insert`, 1, `source row`), subsetEnd])
+      snapshot.resolve()
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(trace.collection.has(1), `applied receipt is held`).toBe(false)
+      external.abort()
+      persistence.resolve()
+      await transaction.isPersisted.promise
+      await expect(
+        atCheckpoint(first, `externally aborted held subset`),
+      ).rejects.toMatchObject({ name: `AbortError` })
+      const second = trace.collection._sync.loadSubset({ limit: 1 })
+      expect(second).not.toBe(true)
+      await expect(Promise.resolve(second)).rejects.toMatchObject({
+        name: `AbortError`,
+      })
+      expect(mockStream.requestSnapshot).toHaveBeenCalledOnce()
+    }, [
+      () => snapshot.resolve(),
+      () => persistence.resolve(),
+      () => trace.collection.cleanup(),
+    ])
+  })
+  // Application can outlive the SDK request. A caller that releases its
+  // demand during that interval must reject promptly, while the source
+  // receipt remains held and a later acquisition can still wait for it.
+  it(`cancels a subset demand while its source receipt is held`, async () => {
+    const trace = createOracleCollection(
+      `subset-held-demand-abort`,
+      `on-demand`,
+      createMetadata(new Map()).api,
+    )
+    const persistence = createDeferred<void>()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    transaction.mutate(() =>
+      trace.collection.insert({
+        id: 99,
+        name: `optimistic`,
+        stable: `stable-99`,
+      }),
+    )
+    const snapshot = createDeferred<void>()
+    mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
+    const controller = new AbortController()
+    const first = Promise.resolve(
+      trace.collection._sync.loadSubset({
+        limit: 1,
+        signal: controller.signal,
+      }),
+    )
+    let firstOutcome: `pending` | `fulfilled` | `rejected` = `pending`
+    let firstError: unknown
+    const observedFirst = first.then(
+      () => {
+        firstOutcome = `fulfilled`
+      },
+      (error: unknown) => {
+        firstOutcome = `rejected`
+        firstError = error
+      },
+    )
+
+    await withElectricCleanup(async () => {
+      await vi.waitFor(() =>
+        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
+      )
+      trace.subscriber([change(`insert`, 1, `source row`), subsetEnd])
+      snapshot.resolve()
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(trace.collection.has(1)).toBe(false)
+      controller.abort()
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(firstOutcome).toBe(`rejected`)
+      expect(firstError).toMatchObject({ name: `AbortError` })
+      persistence.resolve()
+      await transaction.isPersisted.promise
+      await observedFirst
+      expect(trace.collection.has(1)).toBe(true)
+    }, [
+      () => snapshot.resolve(),
+      () => persistence.resolve(),
+      () => trace.collection.cleanup(),
+    ])
+  })
+  // A demand canceled before its subset transport settles has no successful
+  // acquisition, whether that transport later resolves or rejects. The source
+  // may still apply a late SDK response, but this caller observes AbortError and
+  // an identical later demand remains eligible for a new acquisition.
+  it.each([`resolve`, `reject`] as const)(
+    `rejects a canceled subset demand when its transport later %ss`,
+    async (transportOutcome) => {
+      const trace = createOracleCollection(
+        `subset-demand-abort-${transportOutcome}`,
+        `on-demand`,
+        createMetadata(new Map()).api,
+      )
+      const controller = new AbortController()
+      const snapshot = createDeferred<void>()
+      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
+      const first = Promise.resolve(
+        trace.collection._sync.loadSubset({
+          limit: 1,
+          signal: controller.signal,
+        }),
+      )
+      void first.catch(() => undefined)
+
+      await withElectricCleanup(async () => {
+        await vi.waitFor(() =>
+          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
+        )
+        controller.abort()
+        if (transportOutcome === `resolve`) snapshot.resolve()
+        else snapshot.reject(new Error(`late provider failure`))
+        await expect(
+          atCheckpoint(first, `canceled subset ${transportOutcome}`),
+        ).rejects.toMatchObject({ name: `AbortError` })
+        const second = trace.collection._sync.loadSubset({ limit: 1 })
+        expect(second).not.toBe(true)
+        await expect(
+          atCheckpoint(
+            Promise.resolve(second).then(() => undefined),
+            `fresh subset after ${transportOutcome} and caller abort`,
+          ),
+        ).resolves.toBeUndefined()
+        expect(mockStream.requestSnapshot).toHaveBeenCalledTimes(2)
+      }, [() => snapshot.resolve(), () => trace.collection.cleanup()])
+    },
+  )
+  // Snapshot responses share one SDK cursor, but a queued demand owns its
+  // cancellation independently of the request ahead of it. At the next task
+  // boundary after abort, this caller must have rejected without invoking a
+  // second SDK request; the first demand remains pending until its response.
+  it(`cancels a queued subset demand while an earlier snapshot is held`, async () => {
+    const trace = createOracleCollection(
+      `queued-subset-abort`,
+      `on-demand`,
+      createMetadata(new Map()).api,
+    )
+    const held = createDeferred<void>()
+    mockStream.requestSnapshot.mockReturnValueOnce(held.promise)
+    const first = Promise.resolve(
+      trace.collection._sync.loadSubset({ limit: 1 }),
+    )
+    const controller = new AbortController()
+    let secondOutcome: `pending` | `fulfilled` | `rejected` = `pending`
+    let secondError: unknown
+    const second = Promise.resolve(
+      trace.collection._sync.loadSubset({
+        limit: 2,
+        signal: controller.signal,
+      }),
+    ).then(
+      () => {
+        secondOutcome = `fulfilled`
+      },
+      (error: unknown) => {
+        secondOutcome = `rejected`
+        secondError = error
+      },
+    )
+
+    await withElectricCleanup(async () => {
+      await vi.waitFor(() =>
+        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
+      )
+      controller.abort()
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(secondOutcome).toBe(`rejected`)
+      expect(secondError).toMatchObject({ name: `AbortError` })
+      expect(mockStream.requestSnapshot).toHaveBeenCalledOnce()
+      held.resolve()
+      await atCheckpoint(Promise.all([first, second]), `queued abort drain`)
+    }, [() => held.resolve(), () => trace.collection.cleanup()])
+  })
+  it(`drops a held receipt's rows when cleanup abandons it`, async () => {
+    const metadata = createMetadata(new Map())
+    const trace = createOracleCollection(
+      `rejected-applied-receipt`,
+      `eager`,
+      metadata.api,
+    )
+    const persistence = createDeferred<void>()
+    const transaction = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    transaction.mutate(() =>
+      trace.collection.insert({
+        id: 99,
+        name: `optimistic`,
+        stable: `stable-99`,
+      }),
+    )
+    trace.subscriber([change(`insert`, 1, `synced`), upToDate])
+    await Promise.resolve()
+    expect(trace.collection.status).toBe(`ready`)
+
+    await trace.collection.cleanup()
+    persistence.resolve()
+    await transaction.isPersisted.promise
+    await Promise.resolve()
+
+    expect(trace.collection.status).toBe(`cleaned-up`)
+    expect(trace.collection._lifecycle.getSyncError()).toBeUndefined()
+    expect(trace.collection.has(1)).toBe(false)
+  })
+  it(`accepts partial resumed updates for rows restored by persistence`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const collectionMetadata = new Map(resumeState())
+    const persistedRows = new Map<string | number, OracleRow>([
+      [
+        1,
+        {
+          id: 1,
+          name: `persisted`,
+          stable: `stable-1`,
+        },
+      ],
+    ])
+    const electricOptions = electricCollectionOptions<OracleRow>({
+      id: `persisted-resume-oracle`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      syncMode: `progressive`,
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricOptions,
+        persistence: {
+          adapter: createPersistedAdapter(collectionMetadata, persistedRows),
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await collection._sync.loadSubset({ limit: 10 })
+    expect(collection.get(1)).toEqual(
+      expect.objectContaining({ name: `persisted`, stable: `stable-1` }),
+    )
+    expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
+      offset: `10_0`,
+      handle: `shape-1`,
+    })
+
+    subscriber([change(`update`, 1, `resumed update`), upToDate])
+    await vi.waitFor(() => expect(collection.status).toBe(`ready`))
+
+    expect(collection.get(1)).toEqual(
+      expect.objectContaining({
+        name: `resumed update`,
+        stable: `stable-1`,
+      }),
+    )
+    await vi.waitFor(() => {
+      expect(persistedRows.get(1)).toEqual(
+        expect.objectContaining({
+          name: `resumed update`,
+          stable: `stable-1`,
+        }),
+      )
+    })
+    await collection.cleanup()
+  })
+  it(`buffers resumed updates that arrive while persisted rows are hydrating`, async () => {
+    let subscriber: ((messages: Array<Message<OracleRow>>) => void) | undefined
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const hydration = createDeferred<void>()
+    const collectionMetadata = new Map(resumeState())
+    const persistedRows = new Map<string | number, OracleRow>([
+      [
+        1,
+        {
+          id: 1,
+          name: `persisted`,
+          stable: `stable-1`,
+        },
+      ],
+    ])
+    const electricOptions = electricCollectionOptions<OracleRow>({
+      id: `concurrent-persisted-resume-oracle`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      syncMode: `progressive`,
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricOptions,
+        persistence: {
+          adapter: createPersistedAdapter(
+            collectionMetadata,
+            persistedRows,
+            hydration.promise,
+          ),
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
+    expect(collection.status).not.toBe(`error`)
+    subscriber!([change(`update`, 1, `concurrent update`), upToDate])
+
+    expect(collection.status).not.toBe(`error`)
+    hydration.resolve()
+    await vi.waitFor(() => expect(collection.status).toBe(`ready`))
+    expect(collection.get(1)).toEqual(
+      expect.objectContaining({
+        name: `concurrent update`,
+        stable: `stable-1`,
+      }),
+    )
+    await collection.cleanup()
+  })
+  it(`rehydrates persisted rows and resume metadata after cleanup and restart`, async () => {
+    const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> = []
+    mockSubscribe.mockImplementation((callback) => {
+      subscribers.push(callback)
+      return vi.fn()
+    })
+    const collectionMetadata = new Map(resumeState())
+    const persistedRows = new Map<string | number, OracleRow>([
+      [1, { id: 1, name: `persisted`, stable: `stable-1` }],
+    ])
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `persisted-restart-oracle`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          syncMode: `progressive`,
+          getKey: (row) => row.id,
+          startSync: true,
+        }),
+        persistence: {
+          adapter: createPersistedAdapter(collectionMetadata, persistedRows),
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`persisted`))
+    await vi.waitFor(() => expect(subscribers).toHaveLength(1))
+    subscribers[0]!([upToDate])
+    await collection.stateWhenReady()
+
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(subscribers).toHaveLength(2))
+    await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`persisted`))
+    expect(collectionMetadata.get(`electric:resume`)).toEqual(
+      expect.objectContaining({ kind: `resume` }),
+    )
+    await collection.cleanup()
+  })
+  it(`does not let hydration from a cleaned-up lifecycle poison restart`, async () => {
+    const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> = []
+    mockSubscribe.mockImplementation((callback) => {
+      subscribers.push(callback)
+      return vi.fn()
+    })
+    const firstHydration = createDeferred<void>()
+    const collectionMetadata = new Map(resumeState())
+    const persistedRows = new Map<string | number, OracleRow>([
+      [1, { id: 1, name: `current`, stable: `stable-1` }],
+    ])
+    const adapter = createPersistedAdapter(collectionMetadata, persistedRows)
+    const loadResumeSnapshot = adapter.loadResumeSnapshot
+    let hydrationCall = 0
+    adapter.loadResumeSnapshot = vi.fn(async (collectionId, ctx) => {
+      const snapshot = await loadResumeSnapshot(collectionId, ctx)
+      if (ctx?.includeRows === false) return snapshot
+      hydrationCall++
+      if (hydrationCall === 1) {
+        await firstHydration.promise
+        return {
+          ...snapshot,
+          rows: [
+            {
+              key: 1,
+              value: { id: 1, name: `stale`, stable: `stable-1` },
+            },
+          ],
+        }
+      }
+      return snapshot
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `persisted-stale-hydration-oracle`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          syncMode: `progressive`,
+          getKey: (row) => row.id,
+          startSync: true,
+        }),
+        persistence: { adapter },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(hydrationCall).toBe(1))
+    await collection.cleanup()
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(subscribers).toHaveLength(2))
+
+    firstHydration.resolve()
+    await vi.waitFor(() => expect(hydrationCall).toBe(2))
+    await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`current`))
+    subscribers[1]!([upToDate])
+    await collection.stateWhenReady()
+    await collection.cleanup()
+  })
+  it(`does not hydrate persisted on-demand rows before subset demand`, async () => {
+    let subscriber: ((messages: Array<Message<OracleRow>>) => void) | undefined
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const collectionMetadata = new Map<string, unknown>()
+    const persistedRows = new Map<string | number, OracleRow>([
+      [1, { id: 1, name: `persisted`, stable: `stable-1` }],
+    ])
+    const adapter = createPersistedAdapter(collectionMetadata, persistedRows)
+    const loadSubset = vi.fn(adapter.loadSubset)
+    adapter.loadSubset = loadSubset
+    const electricOptions = electricCollectionOptions<OracleRow>({
+      id: `persisted-on-demand-oracle`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      syncMode: `on-demand`,
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricOptions,
+        persistence: { adapter },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
+    subscriber!([upToDate])
+    await vi.waitFor(() => expect(collection.status).toBe(`ready`))
+
+    expect(loadSubset).not.toHaveBeenCalled()
+    expect(collection.has(1)).toBe(false)
+    await collection.cleanup()
+  })
+  it.each(
+    [`reset`, `delete`, `move-out`].flatMap((removal) =>
+      [`none`, `before-commit`, `after-commit`].map((acquire) => ({
+        removal,
+        acquire,
+      })),
+    ),
+  )(
+    `keeps removed rows unknown across $removal and subset acquisition $acquire`,
+    async ({ removal, acquire }) => {
+      const trace = createOracleCollection(
+        `presence-${removal}-${acquire}`,
+        `on-demand`,
+        createMetadata(new Map()).api,
+      )
+      const snapshot = createDeferred<void>()
+      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
+      let acquired: Promise<unknown> | undefined
+      const request = () => {
+        acquired = Promise.resolve(
+          trace.collection._sync.loadSubset({
+            where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(2)]),
+          }),
+        )
+        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce()
+      }
+      try {
+        const inserted = change(`insert`, 1, `complete`)
+        trace.subscriber([
+          { ...inserted, headers: { ...inserted.headers, tags: [`left`] } },
+          upToDate,
+        ])
+        expect(trace.collection.get(1)?.stable).toBe(`stable-1`)
+        const removed: Message<OracleRow> =
+          removal === `reset`
+            ? mustRefetch
+            : removal === `delete`
+              ? change(`delete`, 1, `complete`)
+              : ({
+                  headers: {
+                    event: `move-out`,
+                    patterns: [{ pos: 0, value: `left` }],
+                  },
+                } as Message<OracleRow>)
+        trace.subscriber([removed])
+        if (acquire === `before-commit`) request()
+        trace.subscriber([subsetEnd])
+        expect(trace.collection.has(1)).toBe(false)
+        if (acquire === `after-commit`) request()
+        snapshot.resolve()
+        await acquired
+        trace.subscriber([change(`update`, 1, `partial`), upToDate])
+        expect(trace.collection.has(1)).toBe(false)
+      } finally {
+        snapshot.resolve()
+        await trace.collection.cleanup()
+        await acquired
+      }
+    },
+  )
+  it(`applies on-demand catch-up updates to hydrated persisted rows`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const collectionMetadata = new Map(resumeState())
+    const persistedRows = new Map<string | number, OracleRow>([
+      [1, { id: 1, name: `persisted`, stable: `stable-1` }],
+    ])
+    const collection = createCollection(
+      persistedCollectionOptions<
+        OracleRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<OracleRow>
+      >({
+        ...electricCollectionOptions<OracleRow>({
+          id: `on-demand-persisted-catch-up`,
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
+          },
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          startSync: true,
+        }),
+        persistence: {
+          adapter: createPersistedAdapter(collectionMetadata, persistedRows),
+        },
+      }),
+    )
+
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
+    await collection._sync.loadSubset({})
+    subscriber([change(`update`, 1, `caught up`), upToDate])
+    await vi.waitFor(() => expect(collection.status).toBe(`ready`))
+
+    expect(collection.get(1)).toEqual(
+      expect.objectContaining({ name: `caught up`, stable: `stable-1` }),
+    )
+    expect(collectionMetadata.get(`electric:resume`)).toEqual(
+      expect.objectContaining({ kind: `resume`, offset: `20_0` }),
+    )
+    await collection.cleanup()
+  })
+  it.each([
+    {
+      name: `malformed`,
+      seed: new Map<string, unknown>([
+        [
+          `electric:resume`,
+          {
+            kind: `resume`,
+            requiresTagState: false,
+            offset: 10,
+            handle: `shape-1`,
+            shapeId,
+            updatedAt: 1,
+          },
+        ],
+      ]),
+    },
+    {
+      name: `reset`,
+      seed: new Map<string, unknown>([
+        [`electric:resume`, { kind: `reset`, updatedAt: 1 }],
+      ]),
+    },
+    {
+      name: `incompatible`,
+      seed: new Map<string, unknown>([
+        [
+          `electric:resume`,
+          {
+            kind: `resume`,
+            requiresTagState: false,
+            offset: `10_0`,
+            handle: `shape-1`,
+            shapeId: `different-shape`,
+            updatedAt: 1,
+          },
+        ],
+      ]),
+    },
+  ])(`starts a full snapshot for $name resume metadata`, async ({ seed }) => {
+    const metadata = createMetadata(seed)
+    const trace = createOracleCollection(
+      `non-resumable-metadata`,
+      `eager`,
+      metadata.api,
+    )
+
+    expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
+      offset: undefined,
+      handle: undefined,
+    })
+    trace.subscriber([change(`insert`, 1, `full snapshot`), upToDate])
+
+    expect(trace.collection.status).toBe(`ready`)
+    expect(trace.collection.get(1)).toEqual(
+      expect.objectContaining({ stable: `stable-1` }),
+    )
+    expect(metadata.state.get(`electric:resume`)).toEqual(
+      expect.objectContaining({ kind: `resume`, offset: `20_0` }),
+    )
+    await trace.collection.cleanup()
+  })
+  it(`does not mix an explicit resume option with persisted metadata`, async () => {
+    const metadata = createMetadata(resumeState())
+    const trace = createOracleCollection(
+      `explicit-resume`,
+      `on-demand`,
+      metadata.api,
+      { handle: `explicit-handle` },
+    )
+
+    expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
+      offset: `now`,
+      handle: `explicit-handle`,
+    })
+    trace.subscriber([upToDate])
+    expect(trace.collection.status).toBe(`ready`)
+    await trace.collection.cleanup()
+  })
+  // An explicit source cursor owns this run's resume decision. A malformed
+  // durable record is still invalid for a later implicit run, but it cannot
+  // authorize this run to write a reset before any source evidence arrives.
+  // The metadata Map observes that side effect at startup, before up-to-date
+  // can legitimately stage a fresh resume record.
+  it.each([
+    { name: `offset`, options: { offset: `10_0` as Offset } },
+    { name: `handle`, options: { handle: `explicit-handle` } },
+  ])(
+    `leaves malformed durable resume untouched with explicit $name`,
+    async ({ options }) => {
+      const malformed = { kind: `resume`, offset: 10, handle: `stale` }
+      const metadata = createMetadata(new Map([[`electric:resume`, malformed]]))
+      const trace = createOracleCollection(
+        `explicit-malformed-${options}`,
+        `on-demand`,
+        metadata.api,
+        options,
+      )
+      try {
+        expect(metadata.state.get(`electric:resume`)).toBe(malformed)
+      } finally {
+        await trace.collection.cleanup()
+      }
+    },
+  )
+  it(`lets an equal-timestamp reset dominate a stale hydrated resume`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const options = electricCollectionOptions<OracleRow>({
+      id: `equal-timestamp-reset`,
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: true,
+    })
+    options.sync.importSyncMeta?.({
+      version: 1,
+      resume: {
+        kind: `resume`,
+        requiresTagState: false,
+        offset: `10_0`,
+        handle: `stale-handle`,
+        shapeId,
+        updatedAt: 1,
+      },
+      seenTxids: [],
+    })
+    const originalSync = options.sync
+    const metadata = createMetadata(
+      new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
+    )
+    const collection = createCollection({
+      ...options,
+      sync: {
+        ...originalSync,
+        sync: (params: Parameters<typeof originalSync.sync>[0]) =>
+          originalSync.sync({ ...params, metadata: metadata.api }),
+      },
+    })
+
+    expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
+      offset: undefined,
+      handle: undefined,
+    })
+    subscriber([change(`insert`, 1, `full snapshot`), upToDate])
+    expect(collection.status).toBe(`ready`)
+    await collection.cleanup()
+  })
+  it(`retains the selected tag requirement when timestamps establish an order`, () => {
+    const merge = electricCollectionOptions<OracleRow>({
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+    }).sync.mergeSyncMeta!
+    for (const olderTag of [undefined, false, true]) {
+      for (const newerTag of [undefined, false, true]) {
+        const state = (updatedAt: number, tag: boolean | undefined) => ({
+          version: 1,
+          seenTxids: [updatedAt],
+          resume: {
+            kind: `resume`,
+            offset: `10_0`,
+            handle: `shape-1`,
+            shapeId,
+            updatedAt,
+            ...(tag === undefined ? {} : { requiresTagState: tag }),
+          },
+        })
+        const older = state(1, olderTag)
+        const newer = state(2, newerTag)
+        const expected = { ...newer, seenTxids: [1, 2] }
+        expect(merge(older, newer)).toEqual(expected)
+        expect(merge(newer, older)).toEqual(expected)
+      }
+    }
+  })
+  it(`rejects an unseen partial update from an explicit eager resume`, async () => {
+    const metadata = createMetadata(resumeState())
+    const trace = createOracleCollection(
+      `explicit-eager-resume`,
+      `eager`,
+      metadata.api,
+      { offset: `10_0` as Offset, handle: `explicit-handle` },
+    )
+
+    trace.subscriber([change(`update`, 1, `partial`), upToDate])
+
+    expect(trace.collection.status).toBe(`error`)
+    expect(trace.collection.has(1)).toBe(false)
+    expect(metadata.state.get(`electric:resume`)).toEqual(
+      expect.objectContaining({ kind: `reset` }),
+    )
+    await trace.collection.cleanup()
+  })
+  it(`accepts complete replica updates from an explicit eager resume`, async () => {
+    let subscriber!: (messages: Array<Message<OracleRow>>) => void
+    mockSubscribe.mockImplementationOnce((callback) => {
+      subscriber = callback
+      return vi.fn()
+    })
+    const collection = createCollection(
+      electricCollectionOptions<OracleRow>({
+        id: `explicit-full-replica-resume`,
+        shapeOptions: {
+          url: `http://test-url`,
+          params: { table: `test_table`, replica: `full` },
+          offset: `10_0` as Offset,
+          handle: `explicit-handle`,
+        },
+        syncMode: `eager`,
+        getKey: (row) => row.id,
+        startSync: true,
+      }),
+    )
+
+    subscriber([
+      {
+        key: `1`,
+        value: { id: 1, name: `complete update`, stable: `stable-1` },
+        headers: { operation: `update` },
+      },
+      upToDate,
+    ])
+
+    expect(collection.status).toBe(`ready`)
+    expect(collection.get(1)).toEqual(
+      expect.objectContaining({
+        name: `complete update`,
+        stable: `stable-1`,
+      }),
+    )
+    await collection.cleanup()
+  })
+  it.each([10, 100])(
+    `subset acquisition avoids scanning the applied baseline with %s rows`,
+    async (size) => {
+      const trace = createOracleCollection(
+        `acquisition-work`,
+        `on-demand`,
+        createMetadata(new Map()).api,
+      )
+      try {
+        trace.subscriber([
+          ...Array.from({ length: size }, (_, id) =>
+            change(`insert`, id, `row`),
+          ),
+          upToDate,
+        ])
+        await trace.collection._sync.loadSubset({})
+        const keys = vi.spyOn(trace.collection._state.syncedData, `keys`)
+        try {
+          for (let i = 0; i < 3; i++)
+            await trace.collection._sync.loadSubset({})
+          expect(keys).not.toHaveBeenCalled()
+          for (let i = 0; i < 3; i++)
+            await trace.collection._sync.loadSubset({
+              where: new IR.Func(`eq`, [
+                new IR.PropRef([`id`]),
+                new IR.Value(size + i),
+              ]),
+            })
+          expect(keys).not.toHaveBeenCalled()
+          expect(mockStream.requestSnapshot).toHaveBeenCalledTimes(4)
+        } finally {
+          keys.mockRestore()
+        }
+      } finally {
+        await trace.collection.cleanup()
+      }
+    },
+  )
+  it(`ignores an unseen on-demand update without blocking readiness`, async () => {
+    const metadata = createMetadata(resumeState())
+    const trace = createOracleCollection(
+      `on-demand-unseen-update`,
+      `on-demand`,
+      metadata.api,
+    )
+
+    trace.subscriber([change(`update`, 1, `partial`), upToDate])
+
+    expect(trace.collection.status).toBe(`ready`)
+    expect(trace.collection.has(1)).toBe(false)
+    expect(metadata.state.get(`electric:resume`)).toEqual(
+      expect.objectContaining({ kind: `resume`, offset: `20_0` }),
+    )
+    await trace.collection.cleanup()
+  })
+  it(`records match and txid evidence for an ignored on-demand update`, async () => {
+    const trace = createOracleCollection(
+      `on-demand-ignored-update-evidence`,
+      `on-demand`,
+      createMetadata(resumeState()).api,
+    )
+    trace.subscriber([upToDate])
+
+    const pendingMatch = trace.collection.utils.awaitMatch(
+      (message) => `value` in message && message.value.id === 808,
+      100,
+    )
+    const pendingTxid = trace.collection.utils.awaitTxId(808, 100)
+    const update = change(`update`, 808, `ignored`)
+    update.headers.txids = [808]
+
+    trace.subscriber([update, upToDate])
+
+    await Promise.all([
+      expect(pendingMatch).resolves.toBe(true),
+      expect(pendingTxid).resolves.toBe(true),
+    ])
+    expect(trace.collection.has(808)).toBe(false)
+    await trace.collection.cleanup()
+  })
+})
diff --git a/packages/electric-db-collection/tests/electric-descriptor-fixture.ts b/packages/electric-db-collection/tests/electric-descriptor-fixture.ts
new file mode 100644
index 0000000000..9aa91e25f3
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-descriptor-fixture.ts
@@ -0,0 +1,23 @@
+/**
+ * The Electric collection options that every descriptor-isolation test builds.
+ * It sits outside electric-descriptor-harness.ts, which the ShapeStream mock
+ * loads, so that the mock does not import the Electric adapter it replaces.
+ */
+import { electricCollectionOptions } from '../src/electric'
+import type { TestRow } from './electric-persistence-fixture'
+
+export function descriptor(
+  form: `original` | `once-spread`,
+  startSync = true,
+  syncMode: `eager` | `on-demand` | `progressive` = `eager`,
+) {
+  const options = electricCollectionOptions<TestRow>({
+    shapeOptions: { url: `http://test-url`, params: { table: `test_table` } },
+    getKey: (row) => row.id,
+    startSync,
+    syncMode,
+  })
+  // Spreading once consumes the options creator's utils getter. Reusing this
+  // plain descriptor must be as safe as reading that getter for each instance.
+  return form === `once-spread` ? { ...options } : options
+}
diff --git a/packages/electric-db-collection/tests/electric-descriptor-harness.ts b/packages/electric-db-collection/tests/electric-descriptor-harness.ts
new file mode 100644
index 0000000000..a31fe81e80
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-descriptor-harness.ts
@@ -0,0 +1,152 @@
+/**
+ * Shared Electric descriptor harness for the descriptor-isolation oracle and its
+ * ordinary unit tests. The mocked ShapeStream is controlled through
+ * `streams` and `harnessState`; each test file reaches the mock through its
+ * own hoisted vi.mock and calls resetElectricDescriptorHarness before each test.
+ * The law and its driver live in electric-descriptor-isolation-oracle.test.ts.
+ */
+import { isDeepStrictEqual } from 'node:util'
+import { expect, vi } from 'vitest'
+import type { TestRow } from './electric-persistence-fixture'
+import type { Message } from '@electric-sql/client'
+
+export type TagExposure = { cut: string; rows: Array<TestRow> }
+
+export function expectWholeTagRecovery(
+  entries: Array<TagExposure>,
+  allowed: Array<Array<TestRow>>,
+) {
+  let position = 0
+  for (const entry of entries) {
+    while (
+      position < allowed.length &&
+      !isDeepStrictEqual(entry.rows, allowed[position])
+    )
+      position++
+    expect(position, JSON.stringify({ entry, entries, allowed })).toBeLessThan(
+      allowed.length,
+    )
+  }
+}
+
+export type StreamHarness = {
+  send: (messages: Array<Message<TestRow>>) => void
+  unsubscribe: ReturnType<typeof vi.fn>
+  holdSnapshots: boolean
+  ignoreAbort: boolean
+  pendingSnapshotCount: () => number
+  snapshotRequested: () => Promise<void>
+  completeSnapshot: (messages?: Array<Message<TestRow>>) => void
+}
+
+export const streams: Array<StreamHarness> = []
+export const harnessState: {
+  holdNewSnapshots: boolean
+  onStreamSubscribed: (() => void) | undefined
+} = { holdNewSnapshots: false, onStreamSubscribed: undefined }
+
+export async function createMockedElectricClient() {
+  const actual = await vi.importActual(`@electric-sql/client`)
+  return {
+    ...actual,
+    ShapeStream: vi.fn((options: { log?: string; signal?: AbortSignal }) => {
+      const pendingSnapshots: Array<{
+        resolve: () => void
+        reject: (error: Error) => void
+      }> = []
+      const requestObservers: Array<() => void> = []
+      let snapshotRequests = 0
+      const unsubscribe = vi.fn()
+      // As in the SDK, abort owns snapshot cancellation. Callback release
+      // alone does not reject an in-flight HTTP request.
+      options.signal?.addEventListener(
+        `abort`,
+        () => {
+          if (harness?.ignoreAbort) return
+          for (const pending of pendingSnapshots.splice(0)) {
+            pending.reject(new Error(`snapshot aborted`))
+          }
+        },
+        { once: true },
+      )
+      let harness: StreamHarness | undefined
+      return {
+        subscribe: (send: StreamHarness[`send`]) => {
+          harness = {
+            // Deliberately retain the raw callback for late-delivery tests.
+            // Release calls are observed separately from these injections.
+            send,
+            unsubscribe,
+            holdSnapshots: harnessState.holdNewSnapshots,
+            ignoreAbort: false,
+            pendingSnapshotCount: () => pendingSnapshots.length,
+            snapshotRequested: () =>
+              snapshotRequests > 0
+                ? Promise.resolve()
+                : new Promise<void>((resolve) =>
+                    requestObservers.push(resolve),
+                  ),
+            completeSnapshot: (messages) => {
+              const pending = pendingSnapshots.shift()
+              if (!pending) throw new Error(`no pending snapshot request`)
+              if (messages) send(messages)
+              pending.resolve()
+            },
+          }
+          streams.push(harness)
+          harnessState.onStreamSubscribed?.()
+          return unsubscribe
+        },
+        unsubscribeAll: unsubscribe,
+        // ShapeStream.requestSnapshot is legal only in changes_only mode.
+        // The installed-SDK delivery oracle is the receiving witness.
+        requestSnapshot: vi.fn(() => {
+          if (options.log !== `changes_only`) {
+            return Promise.reject(
+              new Error(`Snapshot requests are not supported in full mode`),
+            )
+          }
+          snapshotRequests++
+          for (const observe of requestObservers.splice(0)) observe()
+          if (harness?.holdSnapshots) {
+            return new Promise<void>((resolve, reject) => {
+              pendingSnapshots.push({ resolve, reject })
+            })
+          }
+          return Promise.resolve()
+        }),
+        fetchSnapshot: vi.fn().mockResolvedValue({ metadata: {}, data: [] }),
+        isUpToDate: false,
+        shapeHandle: `shape-current`,
+        lastOffset: `20_0`,
+      }
+    }),
+  }
+}
+
+export const upToDate: Message<TestRow> = { headers: { control: `up-to-date` } }
+export const mustRefetch: Message<TestRow> = {
+  headers: { control: `must-refetch` },
+}
+
+export function insert(id: number, tag: string): Message<TestRow> {
+  return {
+    key: String(id),
+    value: { id, name: tag, stable: `stable-${id}` },
+    headers: {
+      operation: `insert`,
+      tags: [tag],
+    },
+  }
+}
+
+export function moveOut(tag: string): Message<TestRow> {
+  return { headers: { event: `move-out`, patterns: [{ pos: 0, value: tag }] } }
+}
+
+export function resetElectricDescriptorHarness(): void {
+  streams.length = 0
+  harnessState.holdNewSnapshots = false
+  harnessState.onStreamSubscribed = undefined
+  vi.clearAllMocks()
+}
diff --git a/packages/electric-db-collection/tests/electric-descriptor-isolation-oracle.test.ts b/packages/electric-db-collection/tests/electric-descriptor-isolation-oracle.test.ts
index 131b65a619..1b68932edf 100644
--- a/packages/electric-db-collection/tests/electric-descriptor-isolation-oracle.test.ts
+++ b/packages/electric-db-collection/tests/electric-descriptor-isolation-oracle.test.ts
@@ -1,28 +1,28 @@
-import { isDeepStrictEqual } from 'node:util'
 import { fc, test as fcTest } from '@fast-check/vitest'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import {
-  createCollection,
-  createTransaction,
-  withAcceptedReceipt,
-} from '@tanstack/db'
+import { beforeEach, expect, it, vi } from 'vitest'
+import { createCollection } from '@tanstack/db'
 import { ShapeStream } from '@electric-sql/client'
-import {
-  InvalidPersistedCollectionConfigError,
-  persistedCollectionOptions,
-} from '../../db-sqlite-persistence-core/src'
-import { electricCollectionOptions } from '../src/electric'
-import { StreamAbortedError } from '../src/errors'
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { atCheckpoint } from './electric-oracle-lifecycle'
-import { storageTargetId, tagPersistence } from './electric-persistence-fixture'
+import {
+  expectWholeTagRecovery,
+  insert,
+  moveOut,
+  resetElectricDescriptorHarness,
+  streams,
+  upToDate,
+} from './electric-descriptor-harness'
+import { descriptor } from './electric-descriptor-fixture'
+import { tagPersistence } from './electric-persistence-fixture'
+import type { TagExposure } from './electric-descriptor-harness'
 import type { TestRow } from './electric-persistence-fixture'
 import type { Message } from '@electric-sql/client'
-import type { PersistenceAdapter } from '../../db-sqlite-persistence-core/src'
 import type { ElectricCollectionUtils } from '../src/electric'
 
 /**
@@ -52,207 +52,17 @@ import type { ElectricCollectionUtils } from '../src/electric'
  */
 
 // Ordinary tests stand aside during any path replay, which runs one property.
+vi.mock(`@electric-sql/client`, async () =>
+  (await import(`./electric-descriptor-harness`)).createMockedElectricClient(),
+)
+
 const fixedCase = oracleReplayTest(it)
-const fixedDescribe = oracleReplayTest(describe)
 
 // The durable fixture is a driver, not the independent tag model. It must
 // preserve the SQLite adapter's mutation algebra: an insert replaces the old
 // value, while metadataChanged clears metadata even when the new value is
 // undefined. Otherwise the tag oracle could falsely accept stale columns or
 // stale membership after a fresh source snapshot.
-fixedCase(`replaces stale durable columns and metadata on insert`, async () => {
-  const { adapter, rows } = tagPersistence()
-  rows.set(1, {
-    value: {
-      id: 1,
-      name: `old`,
-      stable: `old-stable`,
-      obsolete: `must disappear`,
-    } as TestRow,
-    metadata: { tags: [`stale`] },
-  })
-
-  await adapter.applyCommittedTx(
-    { kind: `eager`, collectionId: `fixture-insert-law` },
-    {
-      txId: `fresh-insert`,
-      term: 1,
-      seq: 1,
-      rowVersion: 1,
-      mutations: [
-        {
-          type: `insert`,
-          key: 1,
-          value: { id: 1, name: `fresh`, stable: `fresh-stable` },
-          metadataChanged: true,
-          metadata: undefined,
-        },
-      ],
-    },
-  )
-
-  expect(rows.get(1)).toEqual({
-    value: { id: 1, name: `fresh`, stable: `fresh-stable` },
-    metadata: undefined,
-  })
-})
-
-type TagExposure = { cut: string; rows: Array<TestRow> }
-
-function expectMoveOutCheckpoint(observation: {
-  status: string
-  publicRowPresent: boolean
-  durableRowPresent: boolean
-}) {
-  expect(observation).toEqual({
-    status: `ready`,
-    publicRowPresent: false,
-    durableRowPresent: false,
-  })
-}
-
-function expectWholeTagRecovery(
-  entries: Array<TagExposure>,
-  allowed: Array<Array<TestRow>>,
-) {
-  let position = 0
-  for (const entry of entries) {
-    while (
-      position < allowed.length &&
-      !isDeepStrictEqual(entry.rows, allowed[position])
-    )
-      position++
-    expect(position, JSON.stringify({ entry, entries, allowed })).toBeLessThan(
-      allowed.length,
-    )
-  }
-}
-type StreamHarness = {
-  send: (messages: Array<Message<TestRow>>) => void
-  unsubscribe: ReturnType<typeof vi.fn>
-  holdSnapshots: boolean
-  ignoreAbort: boolean
-  pendingSnapshotCount: () => number
-  snapshotRequested: () => Promise<void>
-  completeSnapshot: (messages?: Array<Message<TestRow>>) => void
-}
-
-const streams: Array<StreamHarness> = []
-let holdNewSnapshots = false
-let onStreamSubscribed: (() => void) | undefined
-
-vi.mock(`@electric-sql/client`, async () => {
-  const actual = await vi.importActual(`@electric-sql/client`)
-  return {
-    ...actual,
-    ShapeStream: vi.fn((options: { log?: string; signal?: AbortSignal }) => {
-      const pendingSnapshots: Array<{
-        resolve: () => void
-        reject: (error: Error) => void
-      }> = []
-      const requestObservers: Array<() => void> = []
-      let snapshotRequests = 0
-      const unsubscribe = vi.fn()
-      // As in the SDK, abort owns snapshot cancellation. Callback release
-      // alone does not reject an in-flight HTTP request.
-      options.signal?.addEventListener(
-        `abort`,
-        () => {
-          if (harness?.ignoreAbort) return
-          for (const pending of pendingSnapshots.splice(0)) {
-            pending.reject(new Error(`snapshot aborted`))
-          }
-        },
-        { once: true },
-      )
-      let harness: StreamHarness | undefined
-      return {
-        subscribe: (send: StreamHarness[`send`]) => {
-          harness = {
-            // Deliberately retain the raw callback for late-delivery tests.
-            // Release calls are observed separately from these injections.
-            send,
-            unsubscribe,
-            holdSnapshots: holdNewSnapshots,
-            ignoreAbort: false,
-            pendingSnapshotCount: () => pendingSnapshots.length,
-            snapshotRequested: () =>
-              snapshotRequests > 0
-                ? Promise.resolve()
-                : new Promise<void>((resolve) =>
-                    requestObservers.push(resolve),
-                  ),
-            completeSnapshot: (messages) => {
-              const pending = pendingSnapshots.shift()
-              if (!pending) throw new Error(`no pending snapshot request`)
-              if (messages) send(messages)
-              pending.resolve()
-            },
-          }
-          streams.push(harness)
-          onStreamSubscribed?.()
-          return unsubscribe
-        },
-        unsubscribeAll: unsubscribe,
-        // ShapeStream.requestSnapshot is legal only in changes_only mode.
-        // The installed-SDK delivery oracle is the receiving witness.
-        requestSnapshot: vi.fn(() => {
-          if (options.log !== `changes_only`) {
-            return Promise.reject(
-              new Error(`Snapshot requests are not supported in full mode`),
-            )
-          }
-          snapshotRequests++
-          for (const observe of requestObservers.splice(0)) observe()
-          if (harness?.holdSnapshots) {
-            return new Promise<void>((resolve, reject) => {
-              pendingSnapshots.push({ resolve, reject })
-            })
-          }
-          return Promise.resolve()
-        }),
-        fetchSnapshot: vi.fn().mockResolvedValue({ metadata: {}, data: [] }),
-        isUpToDate: false,
-        shapeHandle: `shape-current`,
-        lastOffset: `20_0`,
-      }
-    }),
-  }
-})
-
-const upToDate: Message<TestRow> = { headers: { control: `up-to-date` } }
-const mustRefetch: Message<TestRow> = { headers: { control: `must-refetch` } }
-
-function insert(id: number, tag: string): Message<TestRow> {
-  return {
-    key: String(id),
-    value: { id, name: tag, stable: `stable-${id}` },
-    headers: {
-      operation: `insert`,
-      tags: [tag],
-    },
-  }
-}
-
-function moveOut(tag: string): Message<TestRow> {
-  return { headers: { event: `move-out`, patterns: [{ pos: 0, value: tag }] } }
-}
-
-function descriptor(
-  form: `original` | `once-spread`,
-  startSync = true,
-  syncMode: `eager` | `on-demand` | `progressive` = `eager`,
-) {
-  const options = electricCollectionOptions<TestRow>({
-    shapeOptions: { url: `http://test-url`, params: { table: `test_table` } },
-    getKey: (row) => row.id,
-    startSync,
-    syncMode,
-  })
-  // Spreading once consumes the options creator's utils getter. Reusing this
-  // plain descriptor must be as safe as reading that getter for each instance.
-  return form === `once-spread` ? { ...options } : options
-}
 
 const tagHistory = fc.record({
   syncMode: fc.constantFrom(
@@ -638,10 +448,7 @@ oracleReplayTest(fcTest, `electric.persisted-tag-history`).prop(
 )
 
 beforeEach(() => {
-  streams.length = 0
-  holdNewSnapshots = false
-  onStreamSubscribed = undefined
-  vi.clearAllMocks()
+  resetElectricDescriptorHarness()
 })
 
 // A released acquisition does not cancel the installed SDK's physical
@@ -654,508 +461,23 @@ beforeEach(() => {
 // on old evidence must reject so an accepted cache clear can advance. This
 // driver crosses Electric, the persisted wrapper, and the controlled SDK
 // callback boundary.
-fixedCase(
-  `restarts a provider session before an old subset can publish into a new cache`,
-  async () => {
-    const durable = new Map<string, Map<number, TestRow>>([
-      [`cache-old`, new Map()],
-    ])
-    let currentStorageId = `cache-old`
-    let claimedStorageId = `cache-old`
-    let expired = false
-    const claimId = `one-run-claim`
-    let oldToDeliver: StreamHarness | undefined
-    let deliverDuringRecovery = false
-    const adapter: PersistenceAdapter = {
-      runInHydrationScope: async (task) => {
-        if (deliverDuringRecovery) {
-          deliverDuringRecovery = false
-          oldToDeliver?.completeSnapshot([
-            insert(3, `late-during-rotation`),
-            { headers: { control: `subset-end` } },
-          ])
-        }
-        return task(adapter)
-      },
-      claimCacheGeneration: () =>
-        Promise.resolve({
-          storageCollectionId: currentStorageId,
-          claimId,
-          expiresAtMs: Date.now() + 10_000,
-        }),
-      renewCacheGenerationClaim: () =>
-        Promise.resolve(expired ? undefined : Date.now() + 10_000),
-      rotateCacheGeneration: () => {
-        currentStorageId = `cache-new`
-        claimedStorageId = currentStorageId
-        durable.set(currentStorageId, new Map())
-        deliverDuringRecovery = true
-        expired = false
-        return Promise.resolve({
-          storageCollectionId: currentStorageId,
-          claimId,
-          expiresAtMs: Date.now() + 10_000,
-        })
-      },
-      releaseCacheGenerationClaim: () => Promise.resolve(),
-      loadSubset: (id) =>
-        Promise.resolve(
-          Array.from(
-            durable.get(storageTargetId(id)) ?? [],
-            ([key, value]) => ({ key, value }),
-          ),
-        ),
-      loadResumeSnapshot: (id) =>
-        Promise.resolve({
-          rows: Array.from(
-            durable.get(storageTargetId(id)) ?? [],
-            ([key, value]) => ({
-              key,
-              value,
-            }),
-          ),
-          keySet: {
-            status:
-              storageTargetId(id) === `cache-old`
-                ? `consistent`
-                : `incompatible`,
-          },
-          collectionMetadata: [],
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          resetEpoch: 0,
-        }),
-      applyCommittedTx: (id, tx) => {
-        expect(storageTargetId(id)).toBe(claimedStorageId)
-        const rows = durable.get(storageTargetId(id))!
-        if (tx.truncate) rows.clear()
-        for (const mutation of tx.mutations) {
-          if (mutation.type === `delete`) rows.delete(Number(mutation.key))
-          else
-            rows.set(
-              Number(mutation.key),
-              structuredClone(mutation.value) as TestRow,
-            )
-        }
-        return Promise.resolve()
-      },
-      ensureIndex: () => Promise.resolve(),
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<
-        TestRow,
-        string | number,
-        never,
-        ElectricCollectionUtils<TestRow>
-      >({
-        ...descriptor(`original`, false, `on-demand`),
-        id: `late-provider-row`,
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(streams).toHaveLength(1))
-      const old = streams[0]!
-      oldToDeliver = old
-      old.send([
-        insert(1, `old`),
-        // 779 is visible only through the old snapshot. Explicit txid 778 is
-        // listed as active so the two evidence paths remain distinguishable.
-        {
-          headers: {
-            control: `snapshot-end`,
-            xmin: `778`,
-            xmax: `800`,
-            xip_list: [`778`],
-          },
-        },
-        { headers: { control: `up-to-date`, txids: [778] } },
-      ])
-      await collection.stateWhenReady()
-      await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`old`))
-      await expect(collection.utils.awaitTxId(778)).resolves.toBe(true)
-      await expect(collection.utils.awaitTxId(779)).resolves.toBe(true)
-      old.holdSnapshots = true
-      old.ignoreAbort = true
-      const oldWait = collection.utils.awaitTxId(801, 10_000).then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-      const oldMatch = collection.utils
-        .awaitMatch(
-          (message) => `value` in message && message.value.id === 9,
-          10_000,
-        )
-        .then(
-          () => undefined,
-          (error: unknown) => error,
-        )
-      const firstDemand = Promise.resolve(
-        collection._sync.loadSubset({ limit: 1 }),
-      )
-      await atCheckpoint(old.snapshotRequested(), `old request`)
-      let handlerEntered!: () => void
-      const handlerStart = new Promise<void>((resolve) => {
-        handlerEntered = resolve
-      })
-      const mutation = createTransaction({
-        mutationFn: async () => {
-          handlerEntered()
-          await collection.utils.awaitTxId(802, 10_000)
-        },
-      })
-      mutation.mutate(() =>
-        collection.insert({ id: 10, name: `optimistic`, stable: `stable-10` }),
-      )
-      const handlerOutcome = mutation.isPersisted.promise.then(
-        () => undefined,
-        (error: unknown) => error,
-      )
-      await atCheckpoint(handlerStart, `old mutation handler wait`)
-
-      holdNewSnapshots = true
-      expired = true
-      const secondDemand = Promise.resolve(
-        collection._sync.loadSubset({ limit: 2 }),
-      )
-      await vi.waitFor(() => expect(streams).toHaveLength(2))
-      expect(await oldWait).toBeInstanceOf(StreamAbortedError)
-      expect(await oldMatch).toBeInstanceOf(StreamAbortedError)
-      expect(await handlerOutcome).toBeInstanceOf(StreamAbortedError)
-      const fresh = streams[1]!
-      await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
-      fresh.send([insert(2, `fresh`), { headers: { control: `subset-end` } }])
-      fresh.completeSnapshot()
-      await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
-      fresh.send([{ headers: { control: `subset-end` } }])
-      fresh.completeSnapshot()
-      await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
-      fresh.send([{ headers: { control: `subset-end` } }])
-      fresh.completeSnapshot()
-      await atCheckpoint(
-        Promise.all([firstDemand, secondDemand]),
-        `replayed demands`,
-      )
-      expect(collection.get(1)).toBeUndefined()
-      expect(collection.get(2)?.name).toBe(`fresh`)
-      expect(collection.get(10)).toBeUndefined()
-
-      // The old txid and snapshot once acknowledged mutations, but their
-      // source rows were cleared during cache rotation. The replacement
-      // session must observe both kinds of evidence anew.
-      let replacementWaitSettled = false
-      const replacementWait = collection.utils
-        .awaitTxId(778, 1_000)
-        .then(() => {
-          replacementWaitSettled = true
-        })
-      await Promise.resolve()
-      const txidSettledBeforeFreshEvidence = replacementWaitSettled
-      let replacementSnapshotWaitSettled = false
-      const replacementSnapshotWait = collection.utils
-        .awaitTxId(779, 1_000)
-        .then(() => {
-          replacementSnapshotWaitSettled = true
-        })
-      await Promise.resolve()
-      const snapshotSettledBeforeFreshEvidence = replacementSnapshotWaitSettled
-      fresh.send([
-        {
-          headers: {
-            control: `snapshot-end`,
-            xmin: `778`,
-            xmax: `800`,
-            xip_list: [`778`],
-          },
-        },
-        { headers: { control: `up-to-date`, txids: [778] } },
-      ])
-      await atCheckpoint(replacementWait, `replacement txid evidence`)
-      await atCheckpoint(
-        replacementSnapshotWait,
-        `replacement snapshot evidence`,
-      )
-      expect(txidSettledBeforeFreshEvidence).toBe(false)
-      expect(snapshotSettledBeforeFreshEvidence).toBe(false)
-
-      old.send([
-        insert(4, `late-after-restart`),
-        { headers: { control: `subset-end` } },
-      ])
-      await Promise.resolve()
-      expect(collection.get(3)).toBeUndefined()
-      expect(collection.get(4)).toBeUndefined()
-      expect([...durable.get(`cache-new`)!.keys()]).toEqual([2])
-    } finally {
-      await atCheckpoint(collection.cleanup(), `provider restart cleanup`)
-    }
-  },
-)
 
 // An acquisition's abort is independent of provider-session replacement. The
 // model retires an old stream, holds cache rotation, and releases one demand
 // while a second demand still needs the fresh source snapshot. At the held
 // rotation checkpoint the released demand owes AbortError, while its sibling
 // remains pending; after rotation, that sibling owes an applied fresh row.
-fixedCase(`aborts one demand while its provider session restarts`, async () => {
-  let storageCollectionId = `cache-old`
-  let expired = false
-  let releaseRotation!: () => void
-  let rotationEntered!: () => void
-  const rotationGate = new Promise<void>((resolve) => {
-    releaseRotation = resolve
-  })
-  const entered = new Promise<void>((resolve) => {
-    rotationEntered = resolve
-  })
-  const adapter: PersistenceAdapter = {
-    claimCacheGeneration: () =>
-      Promise.resolve({
-        storageCollectionId,
-        claimId: `abort-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }),
-    renewCacheGenerationClaim: () =>
-      Promise.resolve(expired ? undefined : Date.now() + 10_000),
-    rotateCacheGeneration: async () => {
-      rotationEntered()
-      await rotationGate
-      storageCollectionId = `cache-new`
-      expired = false
-      return {
-        storageCollectionId,
-        claimId: `abort-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }
-    },
-    releaseCacheGenerationClaim: () => Promise.resolve(),
-    loadSubset: () => Promise.resolve([]),
-    loadResumeSnapshot: () =>
-      Promise.resolve({
-        rows: [],
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }),
-    applyCommittedTx: () => Promise.resolve(),
-    ensureIndex: () => Promise.resolve(),
-  }
-  const collection = createCollection(
-    persistedCollectionOptions<
-      TestRow,
-      string | number,
-      never,
-      ElectricCollectionUtils<TestRow>
-    >({
-      ...descriptor(`original`, false, `on-demand`),
-      id: `abort-during-provider-restart`,
-      persistence: { adapter },
-    }),
-  )
-  const aborter = new AbortController()
-  let releasedOutcome = `pending`
-  let siblingOutcome = `pending`
-  let sibling: Promise<void> | undefined
-  try {
-    collection.startSyncImmediate()
-    await vi.waitFor(() => expect(streams).toHaveLength(1))
-    const old = streams[0]!
-    old.send([upToDate])
-    await collection.stateWhenReady()
-    old.holdSnapshots = true
-    old.ignoreAbort = true
-    const released = Promise.resolve(
-      collection._sync.loadSubset({ limit: 1, signal: aborter.signal }),
-    ).then(
-      () => {
-        releasedOutcome = `fulfilled`
-      },
-      (error: unknown) => {
-        releasedOutcome =
-          typeof error === `object` && error !== null && `name` in error
-            ? String(error.name)
-            : `rejected`
-      },
-    )
-    await atCheckpoint(old.snapshotRequested(), `old held request`)
-
-    holdNewSnapshots = true
-    expired = true
-    sibling = Promise.resolve(collection._sync.loadSubset({ limit: 2 })).then(
-      () => {
-        siblingOutcome = `fulfilled`
-      },
-    )
-    void sibling.catch(() => undefined)
-    await atCheckpoint(entered, `cache rotation entered`)
-    aborter.abort()
-    await new Promise<void>((resolve) => setTimeout(resolve, 0))
-    const outcomeAtHeldRotation = releasedOutcome
-    expect(siblingOutcome).toBe(`pending`)
-
-    releaseRotation()
-    await vi.waitFor(() => expect(streams).toHaveLength(2))
-    const fresh = streams[1]!
-    await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
-    fresh.send([insert(2, `fresh`), { headers: { control: `subset-end` } }])
-    fresh.completeSnapshot()
-    await atCheckpoint(Promise.all([released, sibling]), `demand outcomes`)
-    expect(outcomeAtHeldRotation).toBe(`AbortError`)
-    expect(releasedOutcome).toBe(`AbortError`)
-    expect(siblingOutcome).toBe(`fulfilled`)
-    expect(collection.get(2)?.name).toBe(`fresh`)
-  } finally {
-    releaseRotation()
-    await sibling?.catch(() => undefined)
-    await atCheckpoint(collection.cleanup(), `restart abort cleanup`)
-  }
-})
 
 // Cleanup can arrive after the old provider session has retired but before
 // SQLite finishes rotating its cache. The Collection owns that cleanup, so
 // rotation's lifecycle cancellation must not turn successful resource teardown
 // into a cleanup error. No replacement stream may start after cleanup begins.
-fixedCase(`cleans up during a held provider-session restart`, async () => {
-  let storageCollectionId = `cache-old`
-  let expired = false
-  let releaseRotation!: () => void
-  let rotationEntered!: () => void
-  const rotationGate = new Promise<void>((resolve) => {
-    releaseRotation = resolve
-  })
-  const entered = new Promise<void>((resolve) => {
-    rotationEntered = resolve
-  })
-  const adapter: PersistenceAdapter = {
-    claimCacheGeneration: () =>
-      Promise.resolve({
-        storageCollectionId,
-        claimId: `cleanup-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }),
-    renewCacheGenerationClaim: () =>
-      Promise.resolve(expired ? undefined : Date.now() + 10_000),
-    rotateCacheGeneration: async () => {
-      rotationEntered()
-      await rotationGate
-      storageCollectionId = `cache-new`
-      return {
-        storageCollectionId,
-        claimId: `cleanup-claim`,
-        expiresAtMs: Date.now() + 10_000,
-      }
-    },
-    releaseCacheGenerationClaim: () => Promise.resolve(),
-    loadSubset: () => Promise.resolve([]),
-    loadResumeSnapshot: () =>
-      Promise.resolve({
-        rows: [],
-        keySet: { status: `consistent` },
-        collectionMetadata: [],
-        latestTerm: 0,
-        latestSeq: 0,
-        latestRowVersion: 0,
-        resetEpoch: 0,
-      }),
-    applyCommittedTx: () => Promise.resolve(),
-    ensureIndex: () => Promise.resolve(),
-  }
-  const collection = createCollection(
-    persistedCollectionOptions<
-      TestRow,
-      string | number,
-      never,
-      ElectricCollectionUtils<TestRow>
-    >({
-      ...descriptor(`original`, false, `on-demand`),
-      id: `cleanup-during-provider-restart`,
-      persistence: { adapter },
-    }),
-  )
-  try {
-    collection.startSyncImmediate()
-    await vi.waitFor(() => expect(streams).toHaveLength(1))
-    streams[0]!.send([upToDate])
-    await collection.stateWhenReady()
-
-    expired = true
-    const demand = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-    void demand.catch(() => undefined)
-    await atCheckpoint(entered, `held cache rotation`)
-    const cleanup = collection.cleanup()
-    releaseRotation()
-    await atCheckpoint(cleanup, `cleanup after held rotation`)
-    await demand.catch(() => undefined)
-    expect(streams).toHaveLength(1)
-    expect(collection.status).toBe(`cleaned-up`)
-  } finally {
-    releaseRotation()
-  }
-})
 
 // A failed cache rotation cannot leave a retired Electric provider session
 // accepting demands. The hook contract permits cacheRotated to reject. The
 // independent outcome rule is that the next demand rejects that failure and
 // cleanup remains possible; a microtask-scheduled cleanup bounds the test even
 // when a wrong implementation repeatedly revisits the retired session.
-fixedCase(`rejects a demand after provider-session restart fails`, async () => {
-  const options = descriptor(`original`, false, `on-demand`)
-  const rotationError = new Error(`cache rotation failed`)
-  const params = {
-    collection: {
-      utils: {},
-      getKeyFromItem: (row: TestRow) => row.id,
-      // A fresh Collection holds no synced rows.
-      _state: { acceptedSyncedEntries: () => new Map().entries() },
-    },
-    begin: () => {},
-    write: () => {},
-    commit: () => true,
-    markReady: () => {},
-    fail: () => {},
-    truncate: () => {},
-    metadata: {
-      collection: { get: () => undefined, set: () => {} },
-      row: { get: () => undefined, set: () => {} },
-      persistence: {
-        protocol: `@tanstack/db/sync-persistence`,
-        version: 1,
-        managedCacheGeneration: true,
-        hydrateBaseline: async () => {},
-        startScopedRecovery: async () => {},
-        reserveCommitTurn: () => {},
-        scanPersistedRows: async () => [],
-        resumeSnapshot: {
-          certify: async () => {},
-          getKeySetEvidence: () => undefined,
-          expectCurrentCommit: () => {},
-        },
-      },
-    },
-  } as unknown as Parameters<typeof options.sync.sync>[0]
-  const run = options.sync.sync(params)
-  if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
-    throw new Error(`Missing managed Electric restart hook`)
-  }
-  await expect(
-    run.restartAfterScopedRecovery(Promise.reject(rotationError)),
-  ).rejects.toBe(rotationError)
-  const demand = Promise.resolve(run.loadSubset?.({ limit: 1 }))
-  try {
-    const watchdog = (async () => {
-      for (let turn = 0; turn < 50; turn++) await Promise.resolve()
-      throw new Error(`Demand did not reject while the run was active`)
-    })()
-    await expect(Promise.race([demand, watchdog])).rejects.toBe(rotationError)
-  } finally {
-    await run.cleanup?.()
-  }
-})
 
 // A cache rotation retires the provider session and starts a replacement on
 // the same core sync run. If the retired session's first up-to-date was
@@ -1166,484 +488,28 @@ fixedCase(`rejects a demand after provider-session restart fails`, async () => {
 // The driver observes the Collection's readiness boundary (markReady and
 // fail) after the retired acceptance settles and after the replacement
 // delivers its snapshot.
-fixedCase.each([`resolves`, `rejects`] as const)(
-  `lets only the replacement session decide readiness when a retired acceptance %s`,
-  async (outcome) => {
-    const options = descriptor(`original`, false, `on-demand`)
-    const readiness: Array<string> = []
-    let status = `loading`
-    let releaseAcceptance!: () => void
-    let failAcceptance!: (error: Error) => void
-    const acceptance = new Promise<void>((resolve, reject) => {
-      releaseAcceptance = resolve
-      failAcceptance = reject
-    })
-    void acceptance.catch(() => undefined)
-    let holdNextCommit = true
-    const params = {
-      collection: {
-        utils: {},
-        getKeyFromItem: (row: TestRow) => row.id,
-        _state: {
-          syncedData: new Map(),
-          acceptedSyncedEntries: () => new Map().entries(),
-        },
-        get status() {
-          return status
-        },
-      },
-      begin: () => {},
-      write: () => {},
-      // The first commit's acceptance is held, as a persistence wrapper
-      // accepts after its durable step.
-      commit: () => {
-        if (!holdNextCommit) return true
-        holdNextCommit = false
-        return withAcceptedReceipt(Promise.resolve(), acceptance)
-      },
-      markReady: () => {
-        readiness.push(`ready`)
-        status = `ready`
-      },
-      fail: () => {
-        readiness.push(`error`)
-        status = `error`
-      },
-      truncate: () => {},
-      metadata: {
-        collection: { get: () => undefined, set: () => {} },
-        row: { get: () => undefined, set: () => {} },
-        persistence: {
-          protocol: `@tanstack/db/sync-persistence`,
-          version: 1,
-          managedCacheGeneration: true,
-          hydrateBaseline: async () => {},
-          startScopedRecovery: async () => {},
-          reserveCommitTurn: () => {},
-          scanPersistedRows: async () => [],
-          resumeSnapshot: {
-            certify: async () => {},
-            getKeySetEvidence: () => undefined,
-            expectCurrentCommit: () => {},
-          },
-        },
-      },
-    } as unknown as Parameters<typeof options.sync.sync>[0]
-    const run = options.sync.sync(params)
-    if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
-      throw new Error(`Missing managed Electric restart hook`)
-    }
-    try {
-      streams[0]!.send([upToDate])
-      await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      expect(readiness, `first snapshot committed, not accepted`).toEqual([])
-
-      await atCheckpoint(
-        Promise.resolve(run.restartAfterScopedRecovery(Promise.resolve())),
-        `cache rotation`,
-      )
-      if (outcome === `resolves`) releaseAcceptance()
-      else failAcceptance(new Error(`retired generation write aborted`))
-      await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      expect(readiness, `retired acceptance ${outcome}`).toEqual([])
-
-      expect(streams).toHaveLength(2)
-      streams[1]!.send([upToDate])
-      await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      expect(readiness, `replacement snapshot`).toEqual([`ready`])
-    } finally {
-      releaseAcceptance()
-      await run.cleanup?.()
-    }
-  },
-)
 
 // Two valid cache rotations may overlap in the persisted wrapper. The second
 // hook call owns a distinct cacheRotated gate: its replacement provider session
 // cannot start and its hook cannot settle merely because the first gate did.
 // Holding each gate separately distinguishes that rule from returning the
 // first restart promise for both calls.
-fixedCase(
-  `waits for every overlapping cache rotation before restarting Electric`,
-  async () => {
-    const options = descriptor(`original`, false, `on-demand`)
-    const params = {
-      collection: {
-        utils: {},
-        getKeyFromItem: (row: TestRow) => row.id,
-        // A fresh Collection holds no synced rows.
-        _state: { acceptedSyncedEntries: () => new Map().entries() },
-      },
-      begin: () => {},
-      write: () => {},
-      commit: () => true,
-      markReady: () => {},
-      fail: () => {},
-      truncate: () => {},
-      metadata: {
-        collection: { get: () => undefined, set: () => {} },
-        row: { get: () => undefined, set: () => {} },
-        persistence: {
-          protocol: `@tanstack/db/sync-persistence`,
-          version: 1,
-          managedCacheGeneration: true,
-          hydrateBaseline: async () => {},
-          startScopedRecovery: async () => {},
-          reserveCommitTurn: () => {},
-          scanPersistedRows: async () => [],
-          resumeSnapshot: {
-            certify: async () => {},
-            getKeySetEvidence: () => undefined,
-            expectCurrentCommit: () => {},
-          },
-        },
-      },
-    } as unknown as Parameters<typeof options.sync.sync>[0]
-    const run = options.sync.sync(params)
-    if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
-      throw new Error(`Missing managed Electric restart hook`)
-    }
-    let releaseFirst!: () => void
-    let releaseSecond!: () => void
-    const firstGate = new Promise<void>((resolve) => {
-      releaseFirst = resolve
-    })
-    const secondGate = new Promise<void>((resolve) => {
-      releaseSecond = resolve
-    })
-    const first = Promise.resolve(run.restartAfterScopedRecovery(firstGate))
-    const second = Promise.resolve(run.restartAfterScopedRecovery(secondGate))
-    let secondSettled = false
-    void second.finally(() => {
-      secondSettled = true
-    })
-    try {
-      releaseFirst()
-      await atCheckpoint(first, `first cache rotation`)
-      await new Promise<void>((resolve) => queueMicrotask(resolve))
-      expect(secondSettled).toBe(false)
-      releaseSecond()
-      await atCheckpoint(second, `second cache rotation`)
-    } finally {
-      releaseFirst()
-      releaseSecond()
-      await Promise.allSettled([first, second])
-      await run.cleanup?.()
-    }
-  },
-)
 
 // A second rotation can begin just after the first replacement subscribed but
 // before its restart promise cleared. The newly subscribed stream is now the
 // old provider session: retirement must unsubscribe it synchronously. A mock
 // callback deliberately arrives after unsubscribe while the second cache gate
 // is held; no row may enter the Collection write boundary from that session.
-fixedCase(
-  `retires a replacement Electric stream before a second cache rotation`,
-  async () => {
-    const options = descriptor(`original`, false, `on-demand`)
-    const write = vi.fn()
-    const fail = vi.fn()
-    const params = {
-      collection: {
-        utils: {},
-        getKeyFromItem: (row: TestRow) => row.id,
-        _state: {
-          syncedData: new Map(),
-          acceptedSyncedEntries: () => new Map().entries(),
-        },
-      },
-      begin: () => {},
-      write,
-      commit: () => true,
-      markReady: () => {},
-      fail,
-      truncate: () => {},
-      metadata: {
-        collection: { get: () => undefined, set: () => {} },
-        row: { get: () => undefined, set: () => {} },
-        persistence: {
-          protocol: `@tanstack/db/sync-persistence`,
-          version: 1,
-          managedCacheGeneration: true,
-          hydrateBaseline: async () => {},
-          startScopedRecovery: async () => {},
-          reserveCommitTurn: () => {},
-          scanPersistedRows: async () => [],
-          resumeSnapshot: {
-            certify: async () => {},
-            getKeySetEvidence: () => undefined,
-            expectCurrentCommit: () => {},
-          },
-        },
-      },
-    } as unknown as Parameters<typeof options.sync.sync>[0]
-    const run = options.sync.sync(params)
-    if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
-      throw new Error(`Missing managed Electric restart hook`)
-    }
-    let releaseFirst!: () => void
-    let releaseSecond!: () => void
-    const firstGate = new Promise<void>((resolve) => {
-      releaseFirst = resolve
-    })
-    const secondGate = new Promise<void>((resolve) => {
-      releaseSecond = resolve
-    })
-    let second!: Promise<void>
-    let secondCalled!: () => void
-    const secondStarted = new Promise<void>((resolve) => {
-      secondCalled = resolve
-    })
-    onStreamSubscribed = () => {
-      if (streams.length !== 2) return
-      queueMicrotask(() => {
-        second = Promise.resolve(run.restartAfterScopedRecovery!(secondGate))
-        secondCalled()
-      })
-    }
-    const first = Promise.resolve(run.restartAfterScopedRecovery(firstGate))
-    try {
-      releaseFirst()
-      await atCheckpoint(secondStarted, `second cache rotation starts`)
-      const retiredStream = streams[1]!
-      expect(retiredStream.unsubscribe).toHaveBeenCalledOnce()
-      retiredStream.ignoreAbort = true
-      retiredStream.send([insert(7, `retired`), upToDate])
-      expect(write).not.toHaveBeenCalled()
-      expect(fail).not.toHaveBeenCalled()
-      releaseSecond()
-      await atCheckpoint(second, `second cache rotation completes`)
-      expect(streams).toHaveLength(3)
-      const fresh = streams[2]!
-      const demand = Promise.resolve(run.loadSubset?.({ limit: 1 }))
-      await atCheckpoint(fresh.snapshotRequested(), `final provider subset`)
-      fresh.send([insert(8, `fresh`), { headers: { control: `subset-end` } }])
-      await atCheckpoint(demand, `final provider demand applied`)
-      expect(write).toHaveBeenCalledWith(
-        expect.objectContaining({
-          type: `insert`,
-          value: expect.objectContaining({ id: 8, name: `fresh` }),
-        }),
-      )
-    } finally {
-      onStreamSubscribed = undefined
-      releaseFirst()
-      releaseSecond()
-      await Promise.allSettled([first, second])
-      await run.cleanup?.()
-    }
-  },
-)
 
 // Imported acknowledgement evidence belongs to the old persisted cache.
 // Initial scoped recovery clears that cache before any new source message,
 // so a txid wait must remain pending until the new provider session supplies
 // its own evidence. The independent checkpoint observes settlement timing.
-fixedCase(
-  `forgets imported txid evidence during initial scoped recovery`,
-  async () => {
-    let storageCollectionId = `cache-old`
-    const claimId = `initial-claim`
-    const adapter: PersistenceAdapter = {
-      claimCacheGeneration: () =>
-        Promise.resolve({
-          storageCollectionId,
-          claimId,
-          expiresAtMs: Date.now() + 10_000,
-        }),
-      renewCacheGenerationClaim: () => Promise.resolve(Date.now() + 10_000),
-      rotateCacheGeneration: () => {
-        storageCollectionId = `cache-new`
-        return Promise.resolve({
-          storageCollectionId,
-          claimId,
-          expiresAtMs: Date.now() + 10_000,
-        })
-      },
-      releaseCacheGenerationClaim: () => Promise.resolve(),
-      loadSubset: () => Promise.resolve([]),
-      loadResumeSnapshot: () =>
-        Promise.resolve({
-          rows: [],
-          keySet: { status: `consistent` },
-          collectionMetadata: [],
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          resetEpoch: 0,
-        }),
-      applyCommittedTx: () => Promise.resolve(),
-      ensureIndex: () => Promise.resolve(),
-    }
-    const options = descriptor(`original`, false, `on-demand`)
-    options.sync.importSyncMeta?.({
-      version: 1,
-      resume: {
-        kind: `resume`,
-        offset: `10_0`,
-        handle: `old`,
-        shapeId: `incompatible`,
-        updatedAt: 1,
-        requiresTagState: false,
-      },
-      seenTxids: [778],
-    })
-    const collection = createCollection(
-      persistedCollectionOptions<
-        TestRow,
-        string | number,
-        never,
-        ElectricCollectionUtils<TestRow>
-      >({
-        ...options,
-        id: `initial-evidence`,
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(storageCollectionId).toBe(`cache-new`))
-      await vi.waitFor(() => expect(streams).toHaveLength(1))
-      let settled = false
-      const wait = collection.utils.awaitTxId(778, 1_000).then(() => {
-        settled = true
-      })
-      await Promise.resolve()
-      expect(settled).toBe(false)
-      streams[0]!.send([{ headers: { control: `up-to-date`, txids: [778] } }])
-      await atCheckpoint(wait, `new txid evidence`)
-    } finally {
-      await atCheckpoint(collection.cleanup(), `initial evidence cleanup`)
-    }
-  },
-)
 
 // A provider session can end with a source transaction open between batches.
 // That transaction has no source commit point, so it supplies no public row or
 // acquisition readiness. Retiring the session must abandon its commit turn;
 // otherwise a demand in the replacement session waits on impossible work.
-fixedCase(
-  `starts a new subset after retiring an incomplete old stream transaction`,
-  async () => {
-    const durable = new Map<string, Map<number, TestRow>>([
-      [`cache-old`, new Map()],
-    ])
-    let storageCollectionId = `cache-old`
-    let expired = false
-    const claimId = `open-tx-claim`
-    const adapter: PersistenceAdapter = {
-      claimCacheGeneration: () =>
-        Promise.resolve({
-          storageCollectionId,
-          claimId,
-          expiresAtMs: Date.now() + 300,
-        }),
-      renewCacheGenerationClaim: () =>
-        Promise.resolve(expired ? undefined : Date.now() + 300),
-      rotateCacheGeneration: () => {
-        storageCollectionId = `cache-new`
-        durable.set(storageCollectionId, new Map())
-        expired = false
-        return Promise.resolve({
-          storageCollectionId,
-          claimId,
-          expiresAtMs: Date.now() + 10_000,
-        })
-      },
-      releaseCacheGenerationClaim: () => Promise.resolve(),
-      loadSubset: (id) =>
-        Promise.resolve(
-          Array.from(
-            durable.get(storageTargetId(id)) ?? [],
-            ([key, value]) => ({
-              key,
-              value,
-            }),
-          ),
-        ),
-      loadResumeSnapshot: (id) =>
-        Promise.resolve({
-          rows: Array.from(
-            durable.get(storageTargetId(id)) ?? [],
-            ([key, value]) => ({
-              key,
-              value,
-            }),
-          ),
-          keySet: {
-            status:
-              storageTargetId(id) === `cache-old`
-                ? `consistent`
-                : `incompatible`,
-          },
-          collectionMetadata: [],
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          resetEpoch: 0,
-        }),
-      applyCommittedTx: (id, tx) => {
-        const rows = durable.get(storageTargetId(id))!
-        if (tx.truncate) rows.clear()
-        for (const mutation of tx.mutations) {
-          if (mutation.type === `delete`) rows.delete(Number(mutation.key))
-          else
-            rows.set(
-              Number(mutation.key),
-              structuredClone(mutation.value) as TestRow,
-            )
-        }
-        return Promise.resolve()
-      },
-      ensureIndex: () => Promise.resolve(),
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<
-        TestRow,
-        string | number,
-        never,
-        ElectricCollectionUtils<TestRow>
-      >({
-        ...descriptor(`original`, false, `on-demand`),
-        id: `open-old-transaction`,
-        persistence: { adapter },
-      }),
-    )
-    let demand: Promise<void> | undefined
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(streams).toHaveLength(1))
-      const old = streams[0]!
-      old.send([insert(1, `old`), { headers: { control: `up-to-date` } }])
-      await collection.stateWhenReady()
-      old.send([insert(2, `incomplete`)])
-      expect(collection.get(2)).toBeUndefined()
-      holdNewSnapshots = true
-      expired = true
-      await vi.waitFor(() => expect(streams).toHaveLength(2), {
-        timeout: 2_000,
-      })
-      const fresh = streams[1]!
-      demand = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
-        () => undefined,
-      )
-      await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1), {
-        timeout: 600,
-      })
-      fresh.send([{ headers: { control: `subset-end` } }])
-      fresh.completeSnapshot()
-      await atCheckpoint(
-        demand,
-        `fresh subset after incomplete old transaction`,
-      )
-      expect(collection.get(2)).toBeUndefined()
-    } finally {
-      await atCheckpoint(collection.cleanup(), `open transaction cleanup`)
-      await demand?.catch(() => undefined)
-    }
-  },
-)
 
 fixedCase.each([`eager`, `on-demand`, `progressive`] as const)(
   `delivers abandoned tag-recovery callbacks after replacement starts in %s mode`,
@@ -1662,32 +528,6 @@ fixedCase.each([`eager`, `on-demand`, `progressive`] as const)(
   },
 )
 
-fixedCase(
-  `rejects torn or reverted tag-recovery histories even when their last snapshot is correct`,
-  () => {
-    const cached = [{ id: 1, name: `cached`, stable: `stable-1` }]
-    const replacement = [{ id: 2, name: `replacement`, stable: `stable-2` }]
-    const record = (rows: Array<Array<TestRow>>) =>
-      rows.map((snapshot, index) => ({
-        cut: `cut-${index}`,
-        rows: structuredClone(snapshot),
-      }))
-    expectWholeTagRecovery(record([cached, cached, replacement, replacement]), [
-      cached,
-      replacement,
-    ])
-    for (const rows of [
-      [cached, [], replacement],
-      [cached, [...cached, ...replacement], replacement],
-      [cached, replacement, cached, replacement],
-    ]) {
-      expect(() =>
-        expectWholeTagRecovery(record(rows), [cached, replacement]),
-      ).toThrow()
-    }
-  },
-)
-
 const ownerHistory = fc.record({
   startSync: fc.boolean(),
   retire: fc.integer({ min: 0, max: 1 }),
@@ -1788,293 +628,5 @@ oracleReplayTest(fcTest, `electric.bound-descriptor-history`).prop(
 // Reusing one wrapper itself is rejected before a second owner starts. The
 // public checkpoints are admission, the first receipt, and each Collection's
 // rows after only the first provider session acknowledges its transaction.
-fixedCase.each([`shared storage`, `distinct storage`] as const)(
-  `keeps insert acknowledgements on the owner of a reused Electric descriptor ($0)`,
-  async (storage) => {
-    const readTargets: Array<string> = []
-    const adapter: PersistenceAdapter = {
-      loadSubset: () => Promise.resolve([]),
-      loadResumeSnapshot: (target) => {
-        readTargets.push(storageTargetId(target))
-        return Promise.resolve({
-          rows: [],
-          keySet: { status: `consistent` },
-          collectionMetadata: [],
-          latestTerm: 0,
-          latestSeq: 0,
-          latestRowVersion: 0,
-          resetEpoch: 0,
-        })
-      },
-      loadCollectionMetadata: () => Promise.resolve([]),
-      applyCommittedTx: () => Promise.resolve(),
-      ensureIndex: () => Promise.resolve(),
-    }
-    const electricOptions = electricCollectionOptions<TestRow>({
-      shapeOptions: {
-        url: `http://test-url`,
-        params: { table: `test_table` },
-      },
-      getKey: (row) => row.id,
-      startSync: false,
-      onInsert: () => Promise.resolve({ txid: 200, timeout: 100 }),
-    })
-    // The Electric descriptor is reusable; each persisted wrapper binds one
-    // Collection so its receipt and sync controls cannot move to another owner.
-    const persistedOptions = (id: string) =>
-      persistedCollectionOptions<
-        TestRow,
-        string | number,
-        never,
-        ElectricCollectionUtils<TestRow>
-      >({ ...electricOptions, id, persistence: { adapter } })
-    const firstOptions = persistedOptions(`first-persisted-owner`)
-    const first = createCollection(firstOptions)
-    expect(() => createCollection(firstOptions)).toThrow(
-      InvalidPersistedCollectionConfigError,
-    )
-    const secondId =
-      storage === `shared storage`
-        ? `first-persisted-owner`
-        : `second-persisted-owner`
-    const second = createCollection(persistedOptions(secondId))
-    try {
-      first.startSyncImmediate()
-      await vi.waitFor(() => expect(streams).toHaveLength(1))
-      streams[0]!.send([upToDate])
-      await vi.waitFor(() => expect(first.status).toBe(`ready`))
-      second.startSyncImmediate()
-      await vi.waitFor(() => expect(streams).toHaveLength(2))
-      streams[1]!.send([upToDate])
-      await vi.waitFor(() => expect(second.status).toBe(`ready`))
-      expect(second.id).toBe(secondId)
-      expect(new Set(readTargets)).toEqual(
-        new Set([`first-persisted-owner`, secondId]),
-      )
-
-      const transaction = first.insert({
-        id: 1,
-        name: `own`,
-        stable: `stable-1`,
-      })
-      void transaction.isPersisted.promise.catch(() => undefined)
-      streams[0]!.send([
-        insert(1, `own`),
-        { headers: { control: `up-to-date`, txids: [200] } },
-      ])
-      await expect(transaction.isPersisted.promise).resolves.toBeDefined()
-      expect(first.get(1)?.name).toBe(`own`)
-      expect(second.has(1)).toBe(false)
-    } finally {
-      await first.cleanup()
-      await second.cleanup()
-    }
-  },
-)
-
-fixedCase(
-  `rejects a descriptor move-out checkpoint that deletes rows by fail-stopping`,
-  () => {
-    expectMoveOutCheckpoint({
-      status: `ready`,
-      publicRowPresent: false,
-      durableRowPresent: false,
-    })
-    expect(() =>
-      expectMoveOutCheckpoint({
-        status: `error`,
-        publicRowPresent: false,
-        durableRowPresent: false,
-      }),
-    ).toThrow()
-  },
-)
-
-fixedCase.each([`resume`, `fresh`] as const)(
-  `restores compatible tags and discards obsolete tags on persisted $0 restart`,
-  async (restart) => {
-    const { rows, metadata, adapter } = tagPersistence()
-    const collection = createCollection(
-      persistedCollectionOptions<
-        TestRow,
-        string | number,
-        never,
-        ElectricCollectionUtils<TestRow>
-      >({
-        ...descriptor(`original`, false),
-        id: `tag-restart-${restart}`,
-        persistence: { adapter },
-      }),
-    )
-    try {
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(streams).toHaveLength(1))
-      streams[0]!.send([insert(1, `old`), upToDate])
-      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
-      await vi.waitFor(() =>
-        expect(metadata.get(`electric:resume`)).toMatchObject({
-          kind: `resume`,
-          offset: `20_0`,
-        }),
-      )
-      await collection.cleanup()
-      if (restart === `fresh`) {
-        metadata.set(`electric:resume`, {
-          kind: `reset`,
-          updatedAt: Date.now() + 1,
-        })
-      }
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(streams).toHaveLength(2))
-      await vi.waitFor(() => expect(collection.get(1)?.stable).toBe(`stable-1`))
-      expect(vi.mocked(ShapeStream).mock.calls[1]?.[0]).toMatchObject({
-        offset: restart === `resume` ? `20_0` : undefined,
-      })
-      const currentTag = restart === `resume` ? `old` : `current`
-      if (restart === `fresh`)
-        streams[1]!.send([insert(1, currentTag), upToDate])
-      streams[1]!.send([moveOut(currentTag), upToDate])
-      await vi.waitFor(() => expect(collection.has(1)).toBe(false))
-      await vi.waitFor(() => expect(rows.has(1)).toBe(false))
-      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
-      expectMoveOutCheckpoint({
-        status: collection.status,
-        publicRowPresent: collection.has(1),
-        durableRowPresent: rows.has(1),
-      })
-    } finally {
-      await collection.cleanup()
-    }
-  },
-)
 
-fixedDescribe.each([`original`, `once-spread`] as const)(
-  `%s Electric descriptor`,
-  (form) => {
-    it.each([false, true])(
-      `keeps acknowledgement helpers on their owning collection, eager=%s`,
-      async (startSync) => {
-        const options = descriptor(form, startSync)
-        const first = createCollection({ ...options, id: `first` })
-        const second = createCollection({ ...options, id: `second` })
-        const firstWait = first.utils.awaitTxId(11, 100)
-        const secondWait = second.utils.awaitTxId(22, 100)
-        // Observe rejections even if an earlier assertion fails and cleanup
-        // aborts a still-pending waiter.
-        void firstWait.catch(() => undefined)
-        void secondWait.catch(() => undefined)
-        try {
-          first.config.sync.importSyncMeta?.({ version: 1, seenTxids: [11] })
-          second.config.sync.importSyncMeta?.({ version: 1, seenTxids: [22] })
-          await expect(firstWait).resolves.toBe(true)
-          await expect(secondWait).resolves.toBe(true)
-          if (!startSync) expect(streams).toHaveLength(0)
-
-          first.startSyncImmediate()
-          second.startSyncImmediate()
-          expect(streams).toHaveLength(2)
-          const peerMatch = second.utils.awaitMatch(
-            (message) => `value` in message && message.value.name === `first`,
-            100,
-          )
-          const ownMatch = first.utils.awaitMatch(
-            (message) => `value` in message && message.value.name === `first`,
-            100,
-          )
-          const ownTxid = first.utils.awaitTxId(33, 100)
-          const peerTxid = second.utils.awaitTxId(33, 100)
-          let peerMatched = false
-          let peerAcknowledged = false
-          void peerMatch.then(
-            () => {
-              peerMatched = true
-            },
-            () => undefined,
-          )
-          void peerTxid.then(
-            () => {
-              peerAcknowledged = true
-            },
-            () => undefined,
-          )
-          void ownMatch.catch(() => undefined)
-          void ownTxid.catch(() => undefined)
-          streams[0]!.send([
-            insert(1, `first`),
-            { headers: { control: `up-to-date`, txids: [33] } },
-          ])
-          await expect(ownMatch).resolves.toBe(true)
-          await expect(ownTxid).resolves.toBe(true)
-          expect(peerMatched).toBe(false)
-          expect(peerAcknowledged).toBe(false)
-          await second.cleanup()
-          await expect(peerMatch).rejects.toThrow(/aborted/i)
-          await expect(peerTxid).rejects.toThrow(/aborted/i)
-          await expect(first.utils.awaitTxId(11, 20)).resolves.toBe(true)
-          expect(streams[0]!.unsubscribe).not.toHaveBeenCalled()
-          expect(streams[1]!.unsubscribe).toHaveBeenCalledOnce()
-        } finally {
-          await first.cleanup()
-          await second.cleanup()
-        }
-      },
-    )
-
-    it.each(
-      [false, true].flatMap((equalKeys) =>
-        ([`none`, `reset`, `cleanup`] as const).map((peerAction) => ({
-          equalKeys,
-          peerAction,
-        })),
-      ),
-    )(
-      `keeps tag visibility independent, equal keys=$equalKeys, peer=$peerAction`,
-      async ({ equalKeys, peerAction }) => {
-        const options = descriptor(form)
-        const first = createCollection({ ...options, id: `tag-first` })
-        const second = createCollection({ ...options, id: `tag-second` })
-        const secondKey = equalKeys ? 1 : 2
-        try {
-          streams[0]!.send([insert(1, `left`), upToDate])
-          streams[1]!.send([insert(secondKey, `right`), upToDate])
-          if (peerAction === `reset`) {
-            streams[1]!.send([
-              mustRefetch,
-              insert(secondKey, `right`),
-              upToDate,
-            ])
-          } else if (peerAction === `cleanup`) {
-            await second.cleanup()
-          }
-
-          expect(first.get(1)?.stable).toBe(`stable-1`)
-          streams[0]!.send([moveOut(`left`), upToDate])
-          expect(first.has(1)).toBe(false)
-          if (peerAction !== `cleanup`) {
-            expect(second.get(secondKey)?.name).toBe(`right`)
-            streams[1]!.send([moveOut(`right`), upToDate])
-            expect(second.has(secondKey)).toBe(false)
-          }
-        } finally {
-          await first.cleanup()
-          await second.cleanup()
-        }
-      },
-    )
-
-    it(`discards tag state when the same Collection starts a new sync run`, async () => {
-      const collection = createCollection(descriptor(form))
-      try {
-        streams[0]!.send([insert(1, `old`), upToDate])
-        await collection.cleanup()
-        collection.startSyncImmediate()
-        expect(streams).toHaveLength(2)
-        streams[1]!.send([insert(1, `current`), upToDate])
-        streams[1]!.send([moveOut(`current`), upToDate])
-        expect(collection.has(1)).toBe(false)
-      } finally {
-        await collection.cleanup()
-      }
-    })
-  },
-)
+declareOracle({ check: [runTagHistory, runOwnerHistory] })
diff --git a/packages/electric-db-collection/tests/electric-descriptor-isolation.test.ts b/packages/electric-db-collection/tests/electric-descriptor-isolation.test.ts
new file mode 100644
index 0000000000..d6002c82d8
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-descriptor-isolation.test.ts
@@ -0,0 +1,1322 @@
+// Unit tests for the Electric descriptor surface, moved out of the
+// descriptor-isolation oracle, which owns the law. These compare production with
+// hand-written expectations, so they run as ordinary tests.
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createCollection,
+  createTransaction,
+  withAcceptedReceipt,
+} from '@tanstack/db'
+import { ShapeStream } from '@electric-sql/client'
+import {
+  InvalidPersistedCollectionConfigError,
+  persistedCollectionOptions,
+} from '../../db-sqlite-persistence-core/src'
+import { electricCollectionOptions } from '../src/electric'
+import { StreamAbortedError } from '../src/errors'
+import { atCheckpoint } from './electric-oracle-lifecycle'
+import { storageTargetId, tagPersistence } from './electric-persistence-fixture'
+import {
+  expectWholeTagRecovery,
+  harnessState,
+  insert,
+  moveOut,
+  mustRefetch,
+  resetElectricDescriptorHarness,
+  streams,
+  upToDate,
+} from './electric-descriptor-harness'
+import { descriptor } from './electric-descriptor-fixture'
+import type { StreamHarness } from './electric-descriptor-harness'
+import type { PersistenceAdapter } from '../../db-sqlite-persistence-core/src'
+import type { ElectricCollectionUtils } from '../src/electric'
+import type { TestRow } from './electric-persistence-fixture'
+
+vi.mock(`@electric-sql/client`, async () =>
+  (await import(`./electric-descriptor-harness`)).createMockedElectricClient(),
+)
+
+beforeEach(() => {
+  resetElectricDescriptorHarness()
+})
+
+function expectMoveOutCheckpoint(observation: {
+  status: string
+  publicRowPresent: boolean
+  durableRowPresent: boolean
+}) {
+  expect(observation).toEqual({
+    status: `ready`,
+    publicRowPresent: false,
+    durableRowPresent: false,
+  })
+}
+
+it(`replaces stale durable columns and metadata on insert`, async () => {
+  const { adapter, rows } = tagPersistence()
+  rows.set(1, {
+    value: {
+      id: 1,
+      name: `old`,
+      stable: `old-stable`,
+      obsolete: `must disappear`,
+    } as TestRow,
+    metadata: { tags: [`stale`] },
+  })
+
+  await adapter.applyCommittedTx(
+    { kind: `eager`, collectionId: `fixture-insert-law` },
+    {
+      txId: `fresh-insert`,
+      term: 1,
+      seq: 1,
+      rowVersion: 1,
+      mutations: [
+        {
+          type: `insert`,
+          key: 1,
+          value: { id: 1, name: `fresh`, stable: `fresh-stable` },
+          metadataChanged: true,
+          metadata: undefined,
+        },
+      ],
+    },
+  )
+
+  expect(rows.get(1)).toEqual({
+    value: { id: 1, name: `fresh`, stable: `fresh-stable` },
+    metadata: undefined,
+  })
+})
+
+it(`restarts a provider session before an old subset can publish into a new cache`, async () => {
+  const durable = new Map<string, Map<number, TestRow>>([
+    [`cache-old`, new Map()],
+  ])
+  let currentStorageId = `cache-old`
+  let claimedStorageId = `cache-old`
+  let expired = false
+  const claimId = `one-run-claim`
+  let oldToDeliver: StreamHarness | undefined
+  let deliverDuringRecovery = false
+  const adapter: PersistenceAdapter = {
+    runInHydrationScope: async (task) => {
+      if (deliverDuringRecovery) {
+        deliverDuringRecovery = false
+        oldToDeliver?.completeSnapshot([
+          insert(3, `late-during-rotation`),
+          { headers: { control: `subset-end` } },
+        ])
+      }
+      return task(adapter)
+    },
+    claimCacheGeneration: () =>
+      Promise.resolve({
+        storageCollectionId: currentStorageId,
+        claimId,
+        expiresAtMs: Date.now() + 10_000,
+      }),
+    renewCacheGenerationClaim: () =>
+      Promise.resolve(expired ? undefined : Date.now() + 10_000),
+    rotateCacheGeneration: () => {
+      currentStorageId = `cache-new`
+      claimedStorageId = currentStorageId
+      durable.set(currentStorageId, new Map())
+      deliverDuringRecovery = true
+      expired = false
+      return Promise.resolve({
+        storageCollectionId: currentStorageId,
+        claimId,
+        expiresAtMs: Date.now() + 10_000,
+      })
+    },
+    releaseCacheGenerationClaim: () => Promise.resolve(),
+    loadSubset: (id) =>
+      Promise.resolve(
+        Array.from(durable.get(storageTargetId(id)) ?? [], ([key, value]) => ({
+          key,
+          value,
+        })),
+      ),
+    loadResumeSnapshot: (id) =>
+      Promise.resolve({
+        rows: Array.from(
+          durable.get(storageTargetId(id)) ?? [],
+          ([key, value]) => ({
+            key,
+            value,
+          }),
+        ),
+        keySet: {
+          status:
+            storageTargetId(id) === `cache-old` ? `consistent` : `incompatible`,
+        },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: (id, tx) => {
+      expect(storageTargetId(id)).toBe(claimedStorageId)
+      const rows = durable.get(storageTargetId(id))!
+      if (tx.truncate) rows.clear()
+      for (const mutation of tx.mutations) {
+        if (mutation.type === `delete`) rows.delete(Number(mutation.key))
+        else
+          rows.set(
+            Number(mutation.key),
+            structuredClone(mutation.value) as TestRow,
+          )
+      }
+      return Promise.resolve()
+    },
+    ensureIndex: () => Promise.resolve(),
+  }
+  const collection = createCollection(
+    persistedCollectionOptions<
+      TestRow,
+      string | number,
+      never,
+      ElectricCollectionUtils<TestRow>
+    >({
+      ...descriptor(`original`, false, `on-demand`),
+      id: `late-provider-row`,
+      persistence: { adapter },
+    }),
+  )
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(streams).toHaveLength(1))
+    const old = streams[0]!
+    oldToDeliver = old
+    old.send([
+      insert(1, `old`),
+      // 779 is visible only through the old snapshot. Explicit txid 778 is
+      // listed as active so the two evidence paths remain distinguishable.
+      {
+        headers: {
+          control: `snapshot-end`,
+          xmin: `778`,
+          xmax: `800`,
+          xip_list: [`778`],
+        },
+      },
+      { headers: { control: `up-to-date`, txids: [778] } },
+    ])
+    await collection.stateWhenReady()
+    await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`old`))
+    await expect(collection.utils.awaitTxId(778)).resolves.toBe(true)
+    await expect(collection.utils.awaitTxId(779)).resolves.toBe(true)
+    old.holdSnapshots = true
+    old.ignoreAbort = true
+    const oldWait = collection.utils.awaitTxId(801, 10_000).then(
+      () => undefined,
+      (error: unknown) => error,
+    )
+    const oldMatch = collection.utils
+      .awaitMatch(
+        (message) => `value` in message && message.value.id === 9,
+        10_000,
+      )
+      .then(
+        () => undefined,
+        (error: unknown) => error,
+      )
+    const firstDemand = Promise.resolve(
+      collection._sync.loadSubset({ limit: 1 }),
+    )
+    await atCheckpoint(old.snapshotRequested(), `old request`)
+    let handlerEntered!: () => void
+    const handlerStart = new Promise<void>((resolve) => {
+      handlerEntered = resolve
+    })
+    const mutation = createTransaction({
+      mutationFn: async () => {
+        handlerEntered()
+        await collection.utils.awaitTxId(802, 10_000)
+      },
+    })
+    mutation.mutate(() =>
+      collection.insert({ id: 10, name: `optimistic`, stable: `stable-10` }),
+    )
+    const handlerOutcome = mutation.isPersisted.promise.then(
+      () => undefined,
+      (error: unknown) => error,
+    )
+    await atCheckpoint(handlerStart, `old mutation handler wait`)
+
+    harnessState.holdNewSnapshots = true
+    expired = true
+    const secondDemand = Promise.resolve(
+      collection._sync.loadSubset({ limit: 2 }),
+    )
+    await vi.waitFor(() => expect(streams).toHaveLength(2))
+    expect(await oldWait).toBeInstanceOf(StreamAbortedError)
+    expect(await oldMatch).toBeInstanceOf(StreamAbortedError)
+    expect(await handlerOutcome).toBeInstanceOf(StreamAbortedError)
+    const fresh = streams[1]!
+    await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
+    fresh.send([insert(2, `fresh`), { headers: { control: `subset-end` } }])
+    fresh.completeSnapshot()
+    await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
+    fresh.send([{ headers: { control: `subset-end` } }])
+    fresh.completeSnapshot()
+    await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
+    fresh.send([{ headers: { control: `subset-end` } }])
+    fresh.completeSnapshot()
+    await atCheckpoint(
+      Promise.all([firstDemand, secondDemand]),
+      `replayed demands`,
+    )
+    expect(collection.get(1)).toBeUndefined()
+    expect(collection.get(2)?.name).toBe(`fresh`)
+    expect(collection.get(10)).toBeUndefined()
+
+    // The old txid and snapshot once acknowledged mutations, but their
+    // source rows were cleared during cache rotation. The replacement
+    // session must observe both kinds of evidence anew.
+    let replacementWaitSettled = false
+    const replacementWait = collection.utils.awaitTxId(778, 1_000).then(() => {
+      replacementWaitSettled = true
+    })
+    await Promise.resolve()
+    const txidSettledBeforeFreshEvidence = replacementWaitSettled
+    let replacementSnapshotWaitSettled = false
+    const replacementSnapshotWait = collection.utils
+      .awaitTxId(779, 1_000)
+      .then(() => {
+        replacementSnapshotWaitSettled = true
+      })
+    await Promise.resolve()
+    const snapshotSettledBeforeFreshEvidence = replacementSnapshotWaitSettled
+    fresh.send([
+      {
+        headers: {
+          control: `snapshot-end`,
+          xmin: `778`,
+          xmax: `800`,
+          xip_list: [`778`],
+        },
+      },
+      { headers: { control: `up-to-date`, txids: [778] } },
+    ])
+    await atCheckpoint(replacementWait, `replacement txid evidence`)
+    await atCheckpoint(replacementSnapshotWait, `replacement snapshot evidence`)
+    expect(txidSettledBeforeFreshEvidence).toBe(false)
+    expect(snapshotSettledBeforeFreshEvidence).toBe(false)
+
+    old.send([
+      insert(4, `late-after-restart`),
+      { headers: { control: `subset-end` } },
+    ])
+    await Promise.resolve()
+    expect(collection.get(3)).toBeUndefined()
+    expect(collection.get(4)).toBeUndefined()
+    expect([...durable.get(`cache-new`)!.keys()]).toEqual([2])
+  } finally {
+    await atCheckpoint(collection.cleanup(), `provider restart cleanup`)
+  }
+})
+
+it(`aborts one demand while its provider session restarts`, async () => {
+  let storageCollectionId = `cache-old`
+  let expired = false
+  let releaseRotation!: () => void
+  let rotationEntered!: () => void
+  const rotationGate = new Promise<void>((resolve) => {
+    releaseRotation = resolve
+  })
+  const entered = new Promise<void>((resolve) => {
+    rotationEntered = resolve
+  })
+  const adapter: PersistenceAdapter = {
+    claimCacheGeneration: () =>
+      Promise.resolve({
+        storageCollectionId,
+        claimId: `abort-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }),
+    renewCacheGenerationClaim: () =>
+      Promise.resolve(expired ? undefined : Date.now() + 10_000),
+    rotateCacheGeneration: async () => {
+      rotationEntered()
+      await rotationGate
+      storageCollectionId = `cache-new`
+      expired = false
+      return {
+        storageCollectionId,
+        claimId: `abort-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    },
+    releaseCacheGenerationClaim: () => Promise.resolve(),
+    loadSubset: () => Promise.resolve([]),
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: () => Promise.resolve(),
+    ensureIndex: () => Promise.resolve(),
+  }
+  const collection = createCollection(
+    persistedCollectionOptions<
+      TestRow,
+      string | number,
+      never,
+      ElectricCollectionUtils<TestRow>
+    >({
+      ...descriptor(`original`, false, `on-demand`),
+      id: `abort-during-provider-restart`,
+      persistence: { adapter },
+    }),
+  )
+  const aborter = new AbortController()
+  let releasedOutcome = `pending`
+  let siblingOutcome = `pending`
+  let sibling: Promise<void> | undefined
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(streams).toHaveLength(1))
+    const old = streams[0]!
+    old.send([upToDate])
+    await collection.stateWhenReady()
+    old.holdSnapshots = true
+    old.ignoreAbort = true
+    const released = Promise.resolve(
+      collection._sync.loadSubset({ limit: 1, signal: aborter.signal }),
+    ).then(
+      () => {
+        releasedOutcome = `fulfilled`
+      },
+      (error: unknown) => {
+        releasedOutcome =
+          typeof error === `object` && error !== null && `name` in error
+            ? String(error.name)
+            : `rejected`
+      },
+    )
+    await atCheckpoint(old.snapshotRequested(), `old held request`)
+
+    harnessState.holdNewSnapshots = true
+    expired = true
+    sibling = Promise.resolve(collection._sync.loadSubset({ limit: 2 })).then(
+      () => {
+        siblingOutcome = `fulfilled`
+      },
+    )
+    void sibling.catch(() => undefined)
+    await atCheckpoint(entered, `cache rotation entered`)
+    aborter.abort()
+    await new Promise<void>((resolve) => setTimeout(resolve, 0))
+    const outcomeAtHeldRotation = releasedOutcome
+    expect(siblingOutcome).toBe(`pending`)
+
+    releaseRotation()
+    await vi.waitFor(() => expect(streams).toHaveLength(2))
+    const fresh = streams[1]!
+    await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1))
+    fresh.send([insert(2, `fresh`), { headers: { control: `subset-end` } }])
+    fresh.completeSnapshot()
+    await atCheckpoint(Promise.all([released, sibling]), `demand outcomes`)
+    expect(outcomeAtHeldRotation).toBe(`AbortError`)
+    expect(releasedOutcome).toBe(`AbortError`)
+    expect(siblingOutcome).toBe(`fulfilled`)
+    expect(collection.get(2)?.name).toBe(`fresh`)
+  } finally {
+    releaseRotation()
+    await sibling?.catch(() => undefined)
+    await atCheckpoint(collection.cleanup(), `restart abort cleanup`)
+  }
+})
+
+it(`cleans up during a held provider-session restart`, async () => {
+  let storageCollectionId = `cache-old`
+  let expired = false
+  let releaseRotation!: () => void
+  let rotationEntered!: () => void
+  const rotationGate = new Promise<void>((resolve) => {
+    releaseRotation = resolve
+  })
+  const entered = new Promise<void>((resolve) => {
+    rotationEntered = resolve
+  })
+  const adapter: PersistenceAdapter = {
+    claimCacheGeneration: () =>
+      Promise.resolve({
+        storageCollectionId,
+        claimId: `cleanup-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }),
+    renewCacheGenerationClaim: () =>
+      Promise.resolve(expired ? undefined : Date.now() + 10_000),
+    rotateCacheGeneration: async () => {
+      rotationEntered()
+      await rotationGate
+      storageCollectionId = `cache-new`
+      return {
+        storageCollectionId,
+        claimId: `cleanup-claim`,
+        expiresAtMs: Date.now() + 10_000,
+      }
+    },
+    releaseCacheGenerationClaim: () => Promise.resolve(),
+    loadSubset: () => Promise.resolve([]),
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: () => Promise.resolve(),
+    ensureIndex: () => Promise.resolve(),
+  }
+  const collection = createCollection(
+    persistedCollectionOptions<
+      TestRow,
+      string | number,
+      never,
+      ElectricCollectionUtils<TestRow>
+    >({
+      ...descriptor(`original`, false, `on-demand`),
+      id: `cleanup-during-provider-restart`,
+      persistence: { adapter },
+    }),
+  )
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(streams).toHaveLength(1))
+    streams[0]!.send([upToDate])
+    await collection.stateWhenReady()
+
+    expired = true
+    const demand = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+    void demand.catch(() => undefined)
+    await atCheckpoint(entered, `held cache rotation`)
+    const cleanup = collection.cleanup()
+    releaseRotation()
+    await atCheckpoint(cleanup, `cleanup after held rotation`)
+    await demand.catch(() => undefined)
+    expect(streams).toHaveLength(1)
+    expect(collection.status).toBe(`cleaned-up`)
+  } finally {
+    releaseRotation()
+  }
+})
+
+it(`rejects a demand after provider-session restart fails`, async () => {
+  const options = descriptor(`original`, false, `on-demand`)
+  const rotationError = new Error(`cache rotation failed`)
+  const params = {
+    collection: {
+      utils: {},
+      getKeyFromItem: (row: TestRow) => row.id,
+      // A fresh Collection holds no synced rows.
+      _state: { acceptedSyncedEntries: () => new Map().entries() },
+    },
+    begin: () => {},
+    write: () => {},
+    commit: () => true,
+    markReady: () => {},
+    fail: () => {},
+    truncate: () => {},
+    metadata: {
+      collection: { get: () => undefined, set: () => {} },
+      row: { get: () => undefined, set: () => {} },
+      persistence: {
+        protocol: `@tanstack/db/sync-persistence`,
+        version: 1,
+        managedCacheGeneration: true,
+        hydrateBaseline: async () => {},
+        startScopedRecovery: async () => {},
+        reserveCommitTurn: () => {},
+        scanPersistedRows: async () => [],
+        resumeSnapshot: {
+          certify: async () => {},
+          getKeySetEvidence: () => undefined,
+          expectCurrentCommit: () => {},
+        },
+      },
+    },
+  } as unknown as Parameters<typeof options.sync.sync>[0]
+  const run = options.sync.sync(params)
+  if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
+    throw new Error(`Missing managed Electric restart hook`)
+  }
+  await expect(
+    run.restartAfterScopedRecovery(Promise.reject(rotationError)),
+  ).rejects.toBe(rotationError)
+  const demand = Promise.resolve(run.loadSubset?.({ limit: 1 }))
+  try {
+    const watchdog = (async () => {
+      for (let turn = 0; turn < 50; turn++) await Promise.resolve()
+      throw new Error(`Demand did not reject while the run was active`)
+    })()
+    await expect(Promise.race([demand, watchdog])).rejects.toBe(rotationError)
+  } finally {
+    await run.cleanup?.()
+  }
+})
+
+it.each([`resolves`, `rejects`] as const)(
+  `lets only the replacement session decide readiness when a retired acceptance %s`,
+  async (outcome) => {
+    const options = descriptor(`original`, false, `on-demand`)
+    const readiness: Array<string> = []
+    let status = `loading`
+    let releaseAcceptance!: () => void
+    let failAcceptance!: (error: Error) => void
+    const acceptance = new Promise<void>((resolve, reject) => {
+      releaseAcceptance = resolve
+      failAcceptance = reject
+    })
+    void acceptance.catch(() => undefined)
+    let holdNextCommit = true
+    const params = {
+      collection: {
+        utils: {},
+        getKeyFromItem: (row: TestRow) => row.id,
+        _state: {
+          syncedData: new Map(),
+          acceptedSyncedEntries: () => new Map().entries(),
+        },
+        get status() {
+          return status
+        },
+      },
+      begin: () => {},
+      write: () => {},
+      // The first commit's acceptance is held, as a persistence wrapper
+      // accepts after its durable step.
+      commit: () => {
+        if (!holdNextCommit) return true
+        holdNextCommit = false
+        return withAcceptedReceipt(Promise.resolve(), acceptance)
+      },
+      markReady: () => {
+        readiness.push(`ready`)
+        status = `ready`
+      },
+      fail: () => {
+        readiness.push(`error`)
+        status = `error`
+      },
+      truncate: () => {},
+      metadata: {
+        collection: { get: () => undefined, set: () => {} },
+        row: { get: () => undefined, set: () => {} },
+        persistence: {
+          protocol: `@tanstack/db/sync-persistence`,
+          version: 1,
+          managedCacheGeneration: true,
+          hydrateBaseline: async () => {},
+          startScopedRecovery: async () => {},
+          reserveCommitTurn: () => {},
+          scanPersistedRows: async () => [],
+          resumeSnapshot: {
+            certify: async () => {},
+            getKeySetEvidence: () => undefined,
+            expectCurrentCommit: () => {},
+          },
+        },
+      },
+    } as unknown as Parameters<typeof options.sync.sync>[0]
+    const run = options.sync.sync(params)
+    if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
+      throw new Error(`Missing managed Electric restart hook`)
+    }
+    try {
+      streams[0]!.send([upToDate])
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(readiness, `first snapshot committed, not accepted`).toEqual([])
+
+      await atCheckpoint(
+        Promise.resolve(run.restartAfterScopedRecovery(Promise.resolve())),
+        `cache rotation`,
+      )
+      if (outcome === `resolves`) releaseAcceptance()
+      else failAcceptance(new Error(`retired generation write aborted`))
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(readiness, `retired acceptance ${outcome}`).toEqual([])
+
+      expect(streams).toHaveLength(2)
+      streams[1]!.send([upToDate])
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      expect(readiness, `replacement snapshot`).toEqual([`ready`])
+    } finally {
+      releaseAcceptance()
+      await run.cleanup?.()
+    }
+  },
+)
+
+it(`waits for every overlapping cache rotation before restarting Electric`, async () => {
+  const options = descriptor(`original`, false, `on-demand`)
+  const params = {
+    collection: {
+      utils: {},
+      getKeyFromItem: (row: TestRow) => row.id,
+      // A fresh Collection holds no synced rows.
+      _state: { acceptedSyncedEntries: () => new Map().entries() },
+    },
+    begin: () => {},
+    write: () => {},
+    commit: () => true,
+    markReady: () => {},
+    fail: () => {},
+    truncate: () => {},
+    metadata: {
+      collection: { get: () => undefined, set: () => {} },
+      row: { get: () => undefined, set: () => {} },
+      persistence: {
+        protocol: `@tanstack/db/sync-persistence`,
+        version: 1,
+        managedCacheGeneration: true,
+        hydrateBaseline: async () => {},
+        startScopedRecovery: async () => {},
+        reserveCommitTurn: () => {},
+        scanPersistedRows: async () => [],
+        resumeSnapshot: {
+          certify: async () => {},
+          getKeySetEvidence: () => undefined,
+          expectCurrentCommit: () => {},
+        },
+      },
+    },
+  } as unknown as Parameters<typeof options.sync.sync>[0]
+  const run = options.sync.sync(params)
+  if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
+    throw new Error(`Missing managed Electric restart hook`)
+  }
+  let releaseFirst!: () => void
+  let releaseSecond!: () => void
+  const firstGate = new Promise<void>((resolve) => {
+    releaseFirst = resolve
+  })
+  const secondGate = new Promise<void>((resolve) => {
+    releaseSecond = resolve
+  })
+  const first = Promise.resolve(run.restartAfterScopedRecovery(firstGate))
+  const second = Promise.resolve(run.restartAfterScopedRecovery(secondGate))
+  let secondSettled = false
+  void second.finally(() => {
+    secondSettled = true
+  })
+  try {
+    releaseFirst()
+    await atCheckpoint(first, `first cache rotation`)
+    await new Promise<void>((resolve) => queueMicrotask(resolve))
+    expect(secondSettled).toBe(false)
+    releaseSecond()
+    await atCheckpoint(second, `second cache rotation`)
+  } finally {
+    releaseFirst()
+    releaseSecond()
+    await Promise.allSettled([first, second])
+    await run.cleanup?.()
+  }
+})
+
+it(`retires a replacement Electric stream before a second cache rotation`, async () => {
+  const options = descriptor(`original`, false, `on-demand`)
+  const write = vi.fn()
+  const fail = vi.fn()
+  const params = {
+    collection: {
+      utils: {},
+      getKeyFromItem: (row: TestRow) => row.id,
+      _state: {
+        syncedData: new Map(),
+        acceptedSyncedEntries: () => new Map().entries(),
+      },
+    },
+    begin: () => {},
+    write,
+    commit: () => true,
+    markReady: () => {},
+    fail,
+    truncate: () => {},
+    metadata: {
+      collection: { get: () => undefined, set: () => {} },
+      row: { get: () => undefined, set: () => {} },
+      persistence: {
+        protocol: `@tanstack/db/sync-persistence`,
+        version: 1,
+        managedCacheGeneration: true,
+        hydrateBaseline: async () => {},
+        startScopedRecovery: async () => {},
+        reserveCommitTurn: () => {},
+        scanPersistedRows: async () => [],
+        resumeSnapshot: {
+          certify: async () => {},
+          getKeySetEvidence: () => undefined,
+          expectCurrentCommit: () => {},
+        },
+      },
+    },
+  } as unknown as Parameters<typeof options.sync.sync>[0]
+  const run = options.sync.sync(params)
+  if (typeof run !== `object` || !run.restartAfterScopedRecovery) {
+    throw new Error(`Missing managed Electric restart hook`)
+  }
+  let releaseFirst!: () => void
+  let releaseSecond!: () => void
+  const firstGate = new Promise<void>((resolve) => {
+    releaseFirst = resolve
+  })
+  const secondGate = new Promise<void>((resolve) => {
+    releaseSecond = resolve
+  })
+  let second!: Promise<void>
+  let secondCalled!: () => void
+  const secondStarted = new Promise<void>((resolve) => {
+    secondCalled = resolve
+  })
+  harnessState.onStreamSubscribed = () => {
+    if (streams.length !== 2) return
+    queueMicrotask(() => {
+      second = Promise.resolve(run.restartAfterScopedRecovery!(secondGate))
+      secondCalled()
+    })
+  }
+  const first = Promise.resolve(run.restartAfterScopedRecovery(firstGate))
+  try {
+    releaseFirst()
+    await atCheckpoint(secondStarted, `second cache rotation starts`)
+    const retiredStream = streams[1]!
+    expect(retiredStream.unsubscribe).toHaveBeenCalledOnce()
+    retiredStream.ignoreAbort = true
+    retiredStream.send([insert(7, `retired`), upToDate])
+    expect(write).not.toHaveBeenCalled()
+    expect(fail).not.toHaveBeenCalled()
+    releaseSecond()
+    await atCheckpoint(second, `second cache rotation completes`)
+    expect(streams).toHaveLength(3)
+    const fresh = streams[2]!
+    const demand = Promise.resolve(run.loadSubset?.({ limit: 1 }))
+    await atCheckpoint(fresh.snapshotRequested(), `final provider subset`)
+    fresh.send([insert(8, `fresh`), { headers: { control: `subset-end` } }])
+    await atCheckpoint(demand, `final provider demand applied`)
+    expect(write).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: `insert`,
+        value: expect.objectContaining({ id: 8, name: `fresh` }),
+      }),
+    )
+  } finally {
+    harnessState.onStreamSubscribed = undefined
+    releaseFirst()
+    releaseSecond()
+    await Promise.allSettled([first, second])
+    await run.cleanup?.()
+  }
+})
+
+it(`forgets imported txid evidence during initial scoped recovery`, async () => {
+  let storageCollectionId = `cache-old`
+  const claimId = `initial-claim`
+  const adapter: PersistenceAdapter = {
+    claimCacheGeneration: () =>
+      Promise.resolve({
+        storageCollectionId,
+        claimId,
+        expiresAtMs: Date.now() + 10_000,
+      }),
+    renewCacheGenerationClaim: () => Promise.resolve(Date.now() + 10_000),
+    rotateCacheGeneration: () => {
+      storageCollectionId = `cache-new`
+      return Promise.resolve({
+        storageCollectionId,
+        claimId,
+        expiresAtMs: Date.now() + 10_000,
+      })
+    },
+    releaseCacheGenerationClaim: () => Promise.resolve(),
+    loadSubset: () => Promise.resolve([]),
+    loadResumeSnapshot: () =>
+      Promise.resolve({
+        rows: [],
+        keySet: { status: `consistent` },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: () => Promise.resolve(),
+    ensureIndex: () => Promise.resolve(),
+  }
+  const options = descriptor(`original`, false, `on-demand`)
+  options.sync.importSyncMeta?.({
+    version: 1,
+    resume: {
+      kind: `resume`,
+      offset: `10_0`,
+      handle: `old`,
+      shapeId: `incompatible`,
+      updatedAt: 1,
+      requiresTagState: false,
+    },
+    seenTxids: [778],
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<
+      TestRow,
+      string | number,
+      never,
+      ElectricCollectionUtils<TestRow>
+    >({
+      ...options,
+      id: `initial-evidence`,
+      persistence: { adapter },
+    }),
+  )
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(storageCollectionId).toBe(`cache-new`))
+    await vi.waitFor(() => expect(streams).toHaveLength(1))
+    let settled = false
+    const wait = collection.utils.awaitTxId(778, 1_000).then(() => {
+      settled = true
+    })
+    await Promise.resolve()
+    expect(settled).toBe(false)
+    streams[0]!.send([{ headers: { control: `up-to-date`, txids: [778] } }])
+    await atCheckpoint(wait, `new txid evidence`)
+  } finally {
+    await atCheckpoint(collection.cleanup(), `initial evidence cleanup`)
+  }
+})
+
+it(`starts a new subset after retiring an incomplete old stream transaction`, async () => {
+  const durable = new Map<string, Map<number, TestRow>>([
+    [`cache-old`, new Map()],
+  ])
+  let storageCollectionId = `cache-old`
+  let expired = false
+  const claimId = `open-tx-claim`
+  const adapter: PersistenceAdapter = {
+    claimCacheGeneration: () =>
+      Promise.resolve({
+        storageCollectionId,
+        claimId,
+        expiresAtMs: Date.now() + 300,
+      }),
+    renewCacheGenerationClaim: () =>
+      Promise.resolve(expired ? undefined : Date.now() + 300),
+    rotateCacheGeneration: () => {
+      storageCollectionId = `cache-new`
+      durable.set(storageCollectionId, new Map())
+      expired = false
+      return Promise.resolve({
+        storageCollectionId,
+        claimId,
+        expiresAtMs: Date.now() + 10_000,
+      })
+    },
+    releaseCacheGenerationClaim: () => Promise.resolve(),
+    loadSubset: (id) =>
+      Promise.resolve(
+        Array.from(durable.get(storageTargetId(id)) ?? [], ([key, value]) => ({
+          key,
+          value,
+        })),
+      ),
+    loadResumeSnapshot: (id) =>
+      Promise.resolve({
+        rows: Array.from(
+          durable.get(storageTargetId(id)) ?? [],
+          ([key, value]) => ({
+            key,
+            value,
+          }),
+        ),
+        keySet: {
+          status:
+            storageTargetId(id) === `cache-old` ? `consistent` : `incompatible`,
+        },
+        collectionMetadata: [],
+        latestTerm: 0,
+        latestSeq: 0,
+        latestRowVersion: 0,
+        resetEpoch: 0,
+      }),
+    applyCommittedTx: (id, tx) => {
+      const rows = durable.get(storageTargetId(id))!
+      if (tx.truncate) rows.clear()
+      for (const mutation of tx.mutations) {
+        if (mutation.type === `delete`) rows.delete(Number(mutation.key))
+        else
+          rows.set(
+            Number(mutation.key),
+            structuredClone(mutation.value) as TestRow,
+          )
+      }
+      return Promise.resolve()
+    },
+    ensureIndex: () => Promise.resolve(),
+  }
+  const collection = createCollection(
+    persistedCollectionOptions<
+      TestRow,
+      string | number,
+      never,
+      ElectricCollectionUtils<TestRow>
+    >({
+      ...descriptor(`original`, false, `on-demand`),
+      id: `open-old-transaction`,
+      persistence: { adapter },
+    }),
+  )
+  let demand: Promise<void> | undefined
+  try {
+    collection.startSyncImmediate()
+    await vi.waitFor(() => expect(streams).toHaveLength(1))
+    const old = streams[0]!
+    old.send([insert(1, `old`), { headers: { control: `up-to-date` } }])
+    await collection.stateWhenReady()
+    old.send([insert(2, `incomplete`)])
+    expect(collection.get(2)).toBeUndefined()
+    harnessState.holdNewSnapshots = true
+    expired = true
+    await vi.waitFor(() => expect(streams).toHaveLength(2), {
+      timeout: 2_000,
+    })
+    const fresh = streams[1]!
+    demand = Promise.resolve(collection._sync.loadSubset({ limit: 1 })).then(
+      () => undefined,
+    )
+    await vi.waitFor(() => expect(fresh.pendingSnapshotCount()).toBe(1), {
+      timeout: 600,
+    })
+    fresh.send([{ headers: { control: `subset-end` } }])
+    fresh.completeSnapshot()
+    await atCheckpoint(demand, `fresh subset after incomplete old transaction`)
+    expect(collection.get(2)).toBeUndefined()
+  } finally {
+    await atCheckpoint(collection.cleanup(), `open transaction cleanup`)
+    await demand?.catch(() => undefined)
+  }
+})
+
+it(`rejects torn or reverted tag-recovery histories even when their last snapshot is correct`, () => {
+  const cached = [{ id: 1, name: `cached`, stable: `stable-1` }]
+  const replacement = [{ id: 2, name: `replacement`, stable: `stable-2` }]
+  const record = (rows: Array<Array<TestRow>>) =>
+    rows.map((snapshot, index) => ({
+      cut: `cut-${index}`,
+      rows: structuredClone(snapshot),
+    }))
+  expectWholeTagRecovery(record([cached, cached, replacement, replacement]), [
+    cached,
+    replacement,
+  ])
+  for (const rows of [
+    [cached, [], replacement],
+    [cached, [...cached, ...replacement], replacement],
+    [cached, replacement, cached, replacement],
+  ]) {
+    expect(() =>
+      expectWholeTagRecovery(record(rows), [cached, replacement]),
+    ).toThrow()
+  }
+})
+
+it.each([`shared storage`, `distinct storage`] as const)(
+  `keeps insert acknowledgements on the owner of a reused Electric descriptor ($0)`,
+  async (storage) => {
+    const readTargets: Array<string> = []
+    const adapter: PersistenceAdapter = {
+      loadSubset: () => Promise.resolve([]),
+      loadResumeSnapshot: (target) => {
+        readTargets.push(storageTargetId(target))
+        return Promise.resolve({
+          rows: [],
+          keySet: { status: `consistent` },
+          collectionMetadata: [],
+          latestTerm: 0,
+          latestSeq: 0,
+          latestRowVersion: 0,
+          resetEpoch: 0,
+        })
+      },
+      loadCollectionMetadata: () => Promise.resolve([]),
+      applyCommittedTx: () => Promise.resolve(),
+      ensureIndex: () => Promise.resolve(),
+    }
+    const electricOptions = electricCollectionOptions<TestRow>({
+      shapeOptions: {
+        url: `http://test-url`,
+        params: { table: `test_table` },
+      },
+      getKey: (row) => row.id,
+      startSync: false,
+      onInsert: () => Promise.resolve({ txid: 200, timeout: 100 }),
+    })
+    // The Electric descriptor is reusable; each persisted wrapper binds one
+    // Collection so its receipt and sync controls cannot move to another owner.
+    const persistedOptions = (id: string) =>
+      persistedCollectionOptions<
+        TestRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<TestRow>
+      >({ ...electricOptions, id, persistence: { adapter } })
+    const firstOptions = persistedOptions(`first-persisted-owner`)
+    const first = createCollection(firstOptions)
+    expect(() => createCollection(firstOptions)).toThrow(
+      InvalidPersistedCollectionConfigError,
+    )
+    const secondId =
+      storage === `shared storage`
+        ? `first-persisted-owner`
+        : `second-persisted-owner`
+    const second = createCollection(persistedOptions(secondId))
+    try {
+      first.startSyncImmediate()
+      await vi.waitFor(() => expect(streams).toHaveLength(1))
+      streams[0]!.send([upToDate])
+      await vi.waitFor(() => expect(first.status).toBe(`ready`))
+      second.startSyncImmediate()
+      await vi.waitFor(() => expect(streams).toHaveLength(2))
+      streams[1]!.send([upToDate])
+      await vi.waitFor(() => expect(second.status).toBe(`ready`))
+      expect(second.id).toBe(secondId)
+      expect(new Set(readTargets)).toEqual(
+        new Set([`first-persisted-owner`, secondId]),
+      )
+
+      const transaction = first.insert({
+        id: 1,
+        name: `own`,
+        stable: `stable-1`,
+      })
+      void transaction.isPersisted.promise.catch(() => undefined)
+      streams[0]!.send([
+        insert(1, `own`),
+        { headers: { control: `up-to-date`, txids: [200] } },
+      ])
+      await expect(transaction.isPersisted.promise).resolves.toBeDefined()
+      expect(first.get(1)?.name).toBe(`own`)
+      expect(second.has(1)).toBe(false)
+    } finally {
+      await first.cleanup()
+      await second.cleanup()
+    }
+  },
+)
+
+it(`rejects a descriptor move-out checkpoint that deletes rows by fail-stopping`, () => {
+  expectMoveOutCheckpoint({
+    status: `ready`,
+    publicRowPresent: false,
+    durableRowPresent: false,
+  })
+  expect(() =>
+    expectMoveOutCheckpoint({
+      status: `error`,
+      publicRowPresent: false,
+      durableRowPresent: false,
+    }),
+  ).toThrow()
+})
+
+it.each([`resume`, `fresh`] as const)(
+  `restores compatible tags and discards obsolete tags on persisted $0 restart`,
+  async (restart) => {
+    const { rows, metadata, adapter } = tagPersistence()
+    const collection = createCollection(
+      persistedCollectionOptions<
+        TestRow,
+        string | number,
+        never,
+        ElectricCollectionUtils<TestRow>
+      >({
+        ...descriptor(`original`, false),
+        id: `tag-restart-${restart}`,
+        persistence: { adapter },
+      }),
+    )
+    try {
+      collection.startSyncImmediate()
+      await vi.waitFor(() => expect(streams).toHaveLength(1))
+      streams[0]!.send([insert(1, `old`), upToDate])
+      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
+      await vi.waitFor(() =>
+        expect(metadata.get(`electric:resume`)).toMatchObject({
+          kind: `resume`,
+          offset: `20_0`,
+        }),
+      )
+      await collection.cleanup()
+      if (restart === `fresh`) {
+        metadata.set(`electric:resume`, {
+          kind: `reset`,
+          updatedAt: Date.now() + 1,
+        })
+      }
+      collection.startSyncImmediate()
+      await vi.waitFor(() => expect(streams).toHaveLength(2))
+      await vi.waitFor(() => expect(collection.get(1)?.stable).toBe(`stable-1`))
+      expect(vi.mocked(ShapeStream).mock.calls[1]?.[0]).toMatchObject({
+        offset: restart === `resume` ? `20_0` : undefined,
+      })
+      const currentTag = restart === `resume` ? `old` : `current`
+      if (restart === `fresh`)
+        streams[1]!.send([insert(1, currentTag), upToDate])
+      streams[1]!.send([moveOut(currentTag), upToDate])
+      await vi.waitFor(() => expect(collection.has(1)).toBe(false))
+      await vi.waitFor(() => expect(rows.has(1)).toBe(false))
+      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
+      expectMoveOutCheckpoint({
+        status: collection.status,
+        publicRowPresent: collection.has(1),
+        durableRowPresent: rows.has(1),
+      })
+    } finally {
+      await collection.cleanup()
+    }
+  },
+)
+
+describe.each([`original`, `once-spread`] as const)(
+  `%s Electric descriptor`,
+  (form) => {
+    it.each([false, true])(
+      `keeps acknowledgement helpers on their owning collection, eager=%s`,
+      async (startSync) => {
+        const options = descriptor(form, startSync)
+        const first = createCollection({ ...options, id: `first` })
+        const second = createCollection({ ...options, id: `second` })
+        const firstWait = first.utils.awaitTxId(11, 100)
+        const secondWait = second.utils.awaitTxId(22, 100)
+        // Observe rejections even if an earlier assertion fails and cleanup
+        // aborts a still-pending waiter.
+        void firstWait.catch(() => undefined)
+        void secondWait.catch(() => undefined)
+        try {
+          first.config.sync.importSyncMeta?.({ version: 1, seenTxids: [11] })
+          second.config.sync.importSyncMeta?.({ version: 1, seenTxids: [22] })
+          await expect(firstWait).resolves.toBe(true)
+          await expect(secondWait).resolves.toBe(true)
+          if (!startSync) expect(streams).toHaveLength(0)
+
+          first.startSyncImmediate()
+          second.startSyncImmediate()
+          expect(streams).toHaveLength(2)
+          const peerMatch = second.utils.awaitMatch(
+            (message) => `value` in message && message.value.name === `first`,
+            100,
+          )
+          const ownMatch = first.utils.awaitMatch(
+            (message) => `value` in message && message.value.name === `first`,
+            100,
+          )
+          const ownTxid = first.utils.awaitTxId(33, 100)
+          const peerTxid = second.utils.awaitTxId(33, 100)
+          let peerMatched = false
+          let peerAcknowledged = false
+          void peerMatch.then(
+            () => {
+              peerMatched = true
+            },
+            () => undefined,
+          )
+          void peerTxid.then(
+            () => {
+              peerAcknowledged = true
+            },
+            () => undefined,
+          )
+          void ownMatch.catch(() => undefined)
+          void ownTxid.catch(() => undefined)
+          streams[0]!.send([
+            insert(1, `first`),
+            { headers: { control: `up-to-date`, txids: [33] } },
+          ])
+          await expect(ownMatch).resolves.toBe(true)
+          await expect(ownTxid).resolves.toBe(true)
+          expect(peerMatched).toBe(false)
+          expect(peerAcknowledged).toBe(false)
+          await second.cleanup()
+          await expect(peerMatch).rejects.toThrow(/aborted/i)
+          await expect(peerTxid).rejects.toThrow(/aborted/i)
+          await expect(first.utils.awaitTxId(11, 20)).resolves.toBe(true)
+          expect(streams[0]!.unsubscribe).not.toHaveBeenCalled()
+          expect(streams[1]!.unsubscribe).toHaveBeenCalledOnce()
+        } finally {
+          await first.cleanup()
+          await second.cleanup()
+        }
+      },
+    )
+
+    it.each(
+      [false, true].flatMap((equalKeys) =>
+        ([`none`, `reset`, `cleanup`] as const).map((peerAction) => ({
+          equalKeys,
+          peerAction,
+        })),
+      ),
+    )(
+      `keeps tag visibility independent, equal keys=$equalKeys, peer=$peerAction`,
+      async ({ equalKeys, peerAction }) => {
+        const options = descriptor(form)
+        const first = createCollection({ ...options, id: `tag-first` })
+        const second = createCollection({ ...options, id: `tag-second` })
+        const secondKey = equalKeys ? 1 : 2
+        try {
+          streams[0]!.send([insert(1, `left`), upToDate])
+          streams[1]!.send([insert(secondKey, `right`), upToDate])
+          if (peerAction === `reset`) {
+            streams[1]!.send([
+              mustRefetch,
+              insert(secondKey, `right`),
+              upToDate,
+            ])
+          } else if (peerAction === `cleanup`) {
+            await second.cleanup()
+          }
+
+          expect(first.get(1)?.stable).toBe(`stable-1`)
+          streams[0]!.send([moveOut(`left`), upToDate])
+          expect(first.has(1)).toBe(false)
+          if (peerAction !== `cleanup`) {
+            expect(second.get(secondKey)?.name).toBe(`right`)
+            streams[1]!.send([moveOut(`right`), upToDate])
+            expect(second.has(secondKey)).toBe(false)
+          }
+        } finally {
+          await first.cleanup()
+          await second.cleanup()
+        }
+      },
+    )
+
+    it(`discards tag state when the same Collection starts a new sync run`, async () => {
+      const collection = createCollection(descriptor(form))
+      try {
+        streams[0]!.send([insert(1, `old`), upToDate])
+        await collection.cleanup()
+        collection.startSyncImmediate()
+        expect(streams).toHaveLength(2)
+        streams[1]!.send([insert(1, `current`), upToDate])
+        streams[1]!.send([moveOut(`current`), upToDate])
+        expect(collection.has(1)).toBe(false)
+      } finally {
+        await collection.cleanup()
+      }
+    })
+  },
+)
diff --git a/packages/electric-db-collection/tests/electric-oracle-lifecycle.test.ts b/packages/electric-db-collection/tests/electric-lifecycle.test.ts
similarity index 100%
rename from packages/electric-db-collection/tests/electric-oracle-lifecycle.test.ts
rename to packages/electric-db-collection/tests/electric-lifecycle.test.ts
diff --git a/packages/electric-db-collection/tests/electric-oracle.property.test.ts b/packages/electric-db-collection/tests/electric-oracle.property.test.ts
index 96c8f4f845..53e0f2ae92 100644
--- a/packages/electric-db-collection/tests/electric-oracle.property.test.ts
+++ b/packages/electric-db-collection/tests/electric-oracle.property.test.ts
@@ -20,20 +20,47 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config'
-import { createMockStream } from './electric-stream-mock'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { atCheckpoint, withElectricCleanup } from './electric-oracle-lifecycle'
+import { createMockStream } from './electric-stream-mock'
 import {
   applyRetryModel,
   createRetryModel,
   expectedRetryObservation,
   retryStepIsLegal,
 } from './electric-retry-decision-model'
-import type { Collection, SyncMetadataApi } from '@tanstack/db'
-import type { ChangeMessage, Message, Offset, Row } from '@electric-sql/client'
+import {
+  change,
+  createDeferred,
+  createMetadata,
+  createOracleCollection,
+  createPersistedAdapter,
+  everyContiguousPartition,
+  expectGaveUpAfterReadiness,
+  expectPreloadOutcome,
+  expectWholePublications,
+  mockStream,
+  mockSubscribe,
+  mustRefetch,
+  observableResume,
+  observePreload,
+  observePublications,
+  resetElectricOracleMocks,
+  resumeState,
+  rowsFromCollection,
+  rowsFromMap,
+  runTrace,
+  shapeId,
+  subsetEnd,
+  upToDate,
+} from './electric-adapter-support'
 import type {
-  PersistedTx,
-  PersistenceAdapter,
-} from '../../db-sqlite-persistence-core/src'
+  ObservedPreload,
+  OracleRow,
+  TraceResult,
+} from './electric-adapter-support'
+import type { Collection } from '@tanstack/db'
+import type { ChangeMessage, Message } from '@electric-sql/client'
 import type { ElectricCollectionUtils, ElectricSyncMode } from '../src/electric'
 import type {
   RetryDecision,
@@ -78,62 +105,6 @@ function electricHistoryProperty<T>(
   })(`${name} (random)`, check, timeout)
 }
 
-/**
- * # Does the Electric adapter preserve one coherent replica lifecycle?
- *
- * Electric delivers change messages, reset controls, offsets, handles, and
- * snapshot availability through an SDK stream. The adapter must publish atomic
- * callback cuts, wait for acceptance before Collection readiness and for
- * application before subset success, persist valid resume evidence for a valid source prefix, reject unseen partial updates,
- * and keep stale callbacks and metadata scoped to the sync run that created
- * them.
- *
- * Independent Maps model rows, selected-tag membership, source commits, resume
- * evidence, and persisted state. A controlled ShapeStream boundary supplies
- * authored message partitions and settlement order. The production Collection,
- * Query-backed persistence wrapper, metadata APIs, and cleanup run unchanged.
- * Checks cover public and durable rows, exact batches, readiness, errors,
- * metadata, waiters, stream ownership, and restart at named checkpoints.
- *
- * The suite retains fixed protocol histories, exhaustive contiguous
- * partitions, fixed campaigns, random campaigns, and explicit seed/path replay
- * for durability policies. Sensitivity checks reject missing prefix evidence.
- * Installed-SDK HTTP delivery, PostgreSQL semantics, and live-service execution
- * remain separate evidence.
- */
-type OracleRow = Row & {
-  id: number
-  name: string
-  stable: string
-}
-
-const mockSubscribe = vi.fn()
-const shapeId = `{"params":{"table":"test_table"},"url":"http://test-url"}`
-const mockStream = {
-  subscribe: mockSubscribe,
-  unsubscribeAll: vi.fn(),
-  requestSnapshot: vi.fn().mockResolvedValue(undefined),
-  fetchSnapshot: vi.fn().mockResolvedValue({ metadata: {}, data: [] }),
-  forceDisconnectAndRefresh: vi.fn().mockResolvedValue(undefined),
-  isUpToDate: false,
-  shapeHandle: undefined as string | undefined,
-  lastOffset: `-1` as string,
-}
-
-function createDeferred<T>(): {
-  promise: Promise<T>
-  resolve: (value: T | PromiseLike<T>) => void
-  reject: (reason?: unknown) => void
-} {
-  let resolve!: (value: T | PromiseLike<T>) => void
-  let reject!: (reason?: unknown) => void
-  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
-    resolve = resolvePromise
-    reject = rejectPromise
-  })
-  return { promise, resolve, reject }
-}
-
 vi.mock(`@electric-sql/client`, async () => {
   const actual = await vi.importActual(`@electric-sql/client`)
   return {
@@ -144,24 +115,6 @@ vi.mock(`@electric-sql/client`, async () => {
   }
 })
 
-function everyContiguousPartition<T>(values: Array<T>): Array<Array<Array<T>>> {
-  if (values.length === 0) return [[]]
-  const partitions: Array<Array<Array<T>>> = []
-  const boundaryCount = values.length - 1
-  for (let mask = 0; mask < 1 << boundaryCount; mask++) {
-    const batches: Array<Array<T>> = [[values[0]!]]
-    for (let index = 1; index < values.length; index++) {
-      if ((mask & (1 << (index - 1))) !== 0) {
-        batches.push([values[index]!])
-      } else {
-        batches.at(-1)!.push(values[index]!)
-      }
-    }
-    partitions.push(batches)
-  }
-  return partitions
-}
-
 function isSdkResetFramedPartition(
   batches: Array<Array<Message<OracleRow>>>,
 ): boolean {
@@ -180,133 +133,6 @@ function isSdkResetFramedPartition(
   )
 }
 
-function createMetadata(seed: ReadonlyMap<string, unknown>): {
-  api: SyncMetadataApi<string | number>
-  state: Map<string, unknown>
-} {
-  const state = new Map(seed)
-  return {
-    state,
-    api: {
-      persistence: null,
-      row: {
-        get: () => undefined,
-        set: () => {},
-        delete: () => {},
-      },
-      collection: {
-        get: (key) => state.get(key),
-        set: (key, value) => {
-          state.set(key, value)
-        },
-        delete: (key) => {
-          state.delete(key)
-        },
-        list: (prefix) =>
-          Array.from(state, ([key, value]) => ({ key, value })).filter(
-            ({ key }) => !prefix || key.startsWith(prefix),
-          ),
-      },
-    },
-  }
-}
-
-function resumeState(): ReadonlyMap<string, unknown> {
-  // This fixture represents an untagged source. Legacy/unknown membership is
-  // exercised separately by the cold-recovery history generator.
-  return new Map([
-    [
-      `electric:resume`,
-      {
-        kind: `resume`,
-        requiresTagState: false,
-        offset: `10_0`,
-        handle: `shape-1`,
-        shapeId,
-        updatedAt: 1,
-      },
-    ],
-  ])
-}
-
-function createPersistedAdapter(
-  collectionMetadata: Map<string, unknown>,
-  rows: Map<string | number, OracleRow>,
-  loadGate: Promise<void> = Promise.resolve(),
-): PersistenceAdapter {
-  let latestTerm = 0
-  let latestSeq = 0
-  let latestRowVersion = 0
-  let resetEpoch = 0
-  return {
-    loadSubset: () =>
-      loadGate.then(() =>
-        Array.from(rows, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-        })),
-      ),
-    loadResumeSnapshot: async (_collectionId, ctx) => {
-      if (ctx?.includeRows !== false) await loadGate
-      return {
-        rows:
-          ctx?.includeRows === false
-            ? []
-            : Array.from(rows, ([key, value]) => ({
-                key,
-                value: structuredClone(value),
-              })),
-        keySet: { status: `consistent` },
-        collectionMetadata: Array.from(collectionMetadata, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-        })),
-        latestTerm,
-        latestSeq,
-        latestRowVersion,
-        resetEpoch,
-      }
-    },
-    loadCollectionMetadata: () =>
-      Promise.resolve(
-        Array.from(collectionMetadata, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-        })),
-      ),
-    applyCommittedTx: (_target, tx: PersistedTx) => {
-      for (const mutation of tx.collectionMetadataMutations ?? []) {
-        if (mutation.type === `delete`) {
-          collectionMetadata.delete(mutation.key)
-        } else {
-          collectionMetadata.set(mutation.key, structuredClone(mutation.value))
-        }
-      }
-      if (tx.truncate) {
-        rows.clear()
-        resetEpoch++
-      }
-      for (const mutation of tx.mutations) {
-        if (mutation.type === `delete`) {
-          rows.delete(mutation.key)
-        } else if (mutation.type === `update`) {
-          rows.set(mutation.key, {
-            ...rows.get(mutation.key),
-            ...structuredClone(mutation.value),
-          } as OracleRow)
-        } else {
-          rows.set(mutation.key, structuredClone(mutation.value) as OracleRow)
-        }
-      }
-      latestTerm = tx.term
-      latestSeq = tx.seq
-      latestRowVersion = tx.rowVersion
-      return Promise.resolve()
-    },
-    ensureIndex: () => Promise.resolve(),
-  }
-}
-
 type SourceLedgerEvent = {
   type: `source-commit`
   offset: string
@@ -505,59 +331,6 @@ async function runRejectedDurablePrefixWitness(
   }, [() => collection.cleanup()])
 }
 
-function createOracleCollection(
-  id: string,
-  syncMode: ElectricSyncMode,
-  metadata: SyncMetadataApi<string | number>,
-  shapeResumeOptions: {
-    offset?: Offset
-    handle?: string
-    signal?: AbortSignal
-    onError?: () => Promise<Record<string, never> | undefined>
-  } = {},
-  wrapParams: <TParams>(params: TParams) => TParams = (params) => params,
-) {
-  let subscriber!: (messages: Array<Message<OracleRow>>) => void
-  let sdkError!: (error: unknown) => void
-  const unsubscribe = vi.fn()
-  mockSubscribe.mockImplementationOnce((callback, onSubscriberError) => {
-    subscriber = callback
-    sdkError = onSubscriberError
-    return unsubscribe
-  })
-  const options = electricCollectionOptions<OracleRow>({
-    id,
-    shapeOptions: {
-      url: `http://test-url`,
-      params: { table: `test_table` },
-      ...shapeResumeOptions,
-    },
-    syncMode,
-    getKey: (row) => row.id,
-    startSync: true,
-  })
-  const originalSync = options.sync
-  return {
-    collection: createCollection({
-      ...options,
-      sync: {
-        sync: (params: Parameters<typeof originalSync.sync>[0]) =>
-          originalSync.sync(wrapParams({ ...params, metadata })),
-      },
-    }),
-    subscriber,
-    sdkError,
-    unsubscribe,
-  }
-}
-
-type TraceResult = {
-  rows: Array<[string | number, string, string]>
-  snapshots: Array<Array<[string | number, string, string]>>
-  status: string
-  resume: unknown
-}
-
 type PersistedTraceResult = TraceResult & {
   durableRows: Array<[string | number, string, string]>
   durableResume: unknown
@@ -569,29 +342,6 @@ type ReferenceState = {
   pending: Map<number, OracleRow>
 }
 
-function rowsFromCollection(
-  collection: Collection<OracleRow, string | number>,
-): Array<[string | number, string, string]> {
-  return Array.from(
-    collection,
-    ([key, row]): [string | number, string, string] => [
-      key,
-      row.name,
-      row.stable,
-    ],
-  ).sort(([left], [right]) => String(left).localeCompare(String(right)))
-}
-
-function rowsFromMap(
-  rows: ReadonlyMap<string | number, OracleRow>,
-): Array<[string | number, string, string]> {
-  return Array.from(rows, ([key, row]): [string | number, string, string] => [
-    key,
-    row.name,
-    row.stable,
-  ]).sort(([left], [right]) => String(left).localeCompare(String(right)))
-}
-
 /**
  * A persisted Electric sync transaction publishes at its applied receipt; an
  * earlier adapter durability turn must not hide later source callbacks. This
@@ -1330,87 +1080,6 @@ function recomputedSnapshots(
   })
 }
 
-function observableResume(value: unknown): unknown {
-  if (value === null || typeof value !== `object`) return value
-  const state = value as Record<string, unknown>
-  return {
-    kind: state.kind,
-    offset: state.offset,
-    handle: state.handle,
-    shapeId: state.shapeId,
-  }
-}
-
-type Publication = { cut: string; rows: TraceResult[`rows`] }
-
-function observePublications(
-  collection: Collection<OracleRow, string | number>,
-) {
-  const entries: Array<Publication> = []
-  const record = (cut: string) => {
-    entries.push({ cut, rows: structuredClone(rowsFromCollection(collection)) })
-  }
-  const subscription = collection.subscribeChanges(() => record(`event`), {
-    includeInitialState: false,
-  })
-  return { entries, record, stop: () => subscription.unsubscribe() }
-}
-
-function expectWholePublications(
-  entries: Array<Publication>,
-  allowed: Array<TraceResult[`rows`]>,
-) {
-  let position = 0
-  for (const entry of entries) {
-    while (
-      position < allowed.length &&
-      !isDeepStrictEqual(entry.rows, allowed[position])
-    )
-      position++
-    expect(position, JSON.stringify({ entry, allowed, entries })).toBeLessThan(
-      allowed.length,
-    )
-  }
-}
-
-async function runTrace(
-  id: string,
-  syncMode: ElectricSyncMode,
-  prefix: Array<Array<Message<OracleRow>>>,
-  batches: Array<Array<Message<OracleRow>>>,
-  seed: ReadonlyMap<string, unknown> = new Map(),
-  hooks: {
-    beforeDelivery?: () => void
-    cleanup?: (cleanup: () => Promise<void>) => Promise<void>
-  } = {},
-): Promise<TraceResult> {
-  const metadata = createMetadata(seed)
-  const { collection, subscriber } = createOracleCollection(
-    id,
-    syncMode,
-    metadata.api,
-  )
-  const deliver = (batch: Array<Message<OracleRow>>) => {
-    hooks.beforeDelivery?.()
-    subscriber(batch)
-  }
-  const cleanup = () => collection.cleanup()
-  return withElectricCleanup(() => {
-    for (const batch of prefix) deliver(batch)
-    const snapshots: Array<Array<[string | number, string, string]>> = []
-    for (const batch of batches) {
-      deliver(batch)
-      snapshots.push(rowsFromCollection(collection))
-    }
-    return {
-      rows: rowsFromCollection(collection),
-      snapshots,
-      status: collection.status,
-      resume: observableResume(metadata.state.get(`electric:resume`)),
-    }
-  }, [() => (hooks.cleanup ? hooks.cleanup(cleanup) : cleanup())])
-}
-
 async function runPersistedTrace(
   id: string,
   syncMode: ElectricSyncMode,
@@ -1629,34 +1298,6 @@ async function runQueryTrace(
   }
 }
 
-function change(
-  operation: `insert` | `update` | `delete`,
-  id: number,
-  name: string,
-): ChangeMessage<OracleRow> {
-  const value =
-    operation === `insert`
-      ? { id, name, stable: `stable-${id}` }
-      : operation === `update`
-        ? { id, name }
-        : { id }
-  return {
-    key: String(id),
-    value: value as OracleRow,
-    headers: { operation },
-  }
-}
-
-const upToDate: Message<OracleRow> = {
-  headers: { control: `up-to-date` },
-}
-const subsetEnd: Message<OracleRow> = {
-  headers: { control: `subset-end` },
-}
-const mustRefetch: Message<OracleRow> = {
-  headers: { control: `must-refetch` },
-}
-
 async function checkInitialMoveOut(
   syncMode: ElectricSyncMode,
   removals: number,
@@ -1678,10 +1319,7 @@ async function checkInitialMoveOut(
     ),
     upToDate,
   ]
-  // The contract is a tagged relation: removing its only tag removes the row.
-  // Completing that snapshot must not affect later, unrelated live updates.
-  const initialRows: TraceResult[`rows`] =
-    removals === 0 ? [[id, `snapshot`, `stable-${id}`]] : []
+  const expected = expectedInitialMoveOutSnapshots(removals, id, updated)
   for (const partition of everyContiguousPartition(initial)) {
     const result = await runTrace(
       `initial-move-out-${syncMode}`,
@@ -1692,18 +1330,40 @@ async function checkInitialMoveOut(
         [change(`update`, id + 1, updated), upToDate],
       ],
     )
-    expect(result.snapshots).toEqual([
-      [...initialRows, [id + 1, `live`, `stable-${id + 1}`]].sort(
-        ([left], [right]) => String(left).localeCompare(String(right)),
-      ),
-      [...initialRows, [id + 1, updated, `stable-${id + 1}`]].sort(
-        ([left], [right]) => String(left).localeCompare(String(right)),
-      ),
-    ])
+    expect(result.snapshots).toEqual(expected)
     expect(result.status).toBe(`ready`)
   }
 }
 
+// The contract is a tagged relation: removing its only tag removes the row.
+// Completing that snapshot must not affect later, unrelated live updates. The
+// model predicts the public rows after the initial snapshot and after each
+// live update, for any number of move-outs of that snapshot.
+function expectedInitialMoveOutSnapshots(
+  removals: number,
+  id: number,
+  updated: string,
+): Array<TraceResult[`snapshots`][number]> {
+  const initialRows: TraceResult[`rows`] =
+    removals === 0 ? [[id, `snapshot`, `stable-${id}`]] : []
+  const liveRows: TraceResult[`rows`] = [
+    ...initialRows,
+    [id + 1, `live`, `stable-${id + 1}`],
+  ]
+  const updatedRows: TraceResult[`rows`] = [
+    ...initialRows,
+    [id + 1, updated, `stable-${id + 1}`],
+  ]
+  return [
+    liveRows.sort(([left], [right]) =>
+      String(left).localeCompare(String(right)),
+    ),
+    updatedRows.sort(([left], [right]) =>
+      String(left).localeCompare(String(right)),
+    ),
+  ]
+}
+
 type PartitionScenario = {
   name: string
   prefix: Array<Array<Message<OracleRow>>>
@@ -1744,19 +1404,6 @@ type ProcessCommand =
   | { kind: `cleanup`; slot: ProcessSlot }
   | { kind: `restart`; slot: ProcessSlot }
 
-/**
- * After Collection readiness, an Electric sync adapter that gives up reports a
- * stopped sync: the Collection's `error`. Status and rows stay, and only a restart recovers; the
- * reset resume state is what lets that restart refetch.
- */
-function expectGaveUpAfterReadiness(
-  collection: Collection<OracleRow, string | number>,
-) {
-  expect(collection.status).toBe(`ready`)
-  expect(collection.health.failureReason).toBeNull()
-  expect(collection.health.error).toBeTruthy()
-}
-
 type ProcessRuntime = {
   collection: Collection<OracleRow, string | number>
   subscriber?: (messages: Array<Message<OracleRow>>) => void
@@ -1777,57 +1424,6 @@ type ProcessRuntime = {
   preloads: Array<ObservedPreload>
 }
 
-type PreloadOutcome =
-  { status: `fulfilled` } | { status: `rejected`; reason: unknown }
-
-function observePreload(promise: Promise<void>) {
-  const observed: {
-    expectedRejection?: `cleanup` | `invalid-resume`
-    settled: boolean
-    outcome: Promise<PreloadOutcome>
-  } = {
-    settled: false,
-    // Both handlers are installed at creation, before a driver command can
-    // invalidate or retire the collection. Keep the original rejection object.
-    outcome: promise.then(
-      () => {
-        observed.settled = true
-        return { status: `fulfilled` }
-      },
-      (reason: unknown) => {
-        observed.settled = true
-        return { status: `rejected`, reason }
-      },
-    ),
-  }
-  return observed
-}
-
-type ObservedPreload = ReturnType<typeof observePreload>
-
-function expectPreloadOutcome(
-  observed: ObservedPreload,
-  outcome: PreloadOutcome,
-) {
-  if (observed.expectedRejection === undefined) {
-    if (outcome.status === `rejected`) throw outcome.reason
-    return
-  }
-  expect(outcome.status).toBe(`rejected`)
-  if (outcome.status === `rejected`) {
-    expect(outcome.reason).toMatchObject(
-      observed.expectedRejection === `cleanup`
-        ? {
-            name: `AbortError`,
-            message: `Collection preload was abandoned during cleanup`,
-          }
-        : {
-            message: `Electric resume state referenced an unseen row; a full snapshot is required`,
-          },
-    )
-  }
-}
-
 async function runPublicationBeforePersistenceWitness(
   id: string,
   row: OracleRow,
@@ -2794,19 +2390,74 @@ async function runSchedulerPermutation(
   }
 }
 
-function resetElectricOracleMocks(): void {
-  vi.clearAllMocks()
-  // clearAllMocks retains one-shot implementations from a failed earlier
-  // history. Each history must own its transport responses independently.
-  mockSubscribe.mockReset()
-  mockStream.requestSnapshot.mockReset().mockResolvedValue(undefined)
-  mockStream.isUpToDate = false
-  mockStream.shapeHandle = `shape-current`
-  mockStream.lastOffset = `20_0`
+const assertPublicationEpochHistory = async (
+  tokens: Array<DesignToken>,
+  partitionSeed: number,
+) => {
+  const messages = buildDifferentialHistory(tokens)
+  const partitions = everyContiguousPartition(messages).filter(
+    isSdkResetFramedPartition,
+  )
+  const partition = partitions[partitionSeed % partitions.length]!
+  const referenceSnapshots = recomputedSnapshots([], partition)
+
+  for (const syncMode of [`eager`, `on-demand`, `progressive`] as const) {
+    const direct = await runTrace(
+      `direct-differential-${syncMode}`,
+      syncMode,
+      [],
+      partition,
+    )
+    const persisted = await runPersistedTrace(
+      `persisted-differential-${syncMode}`,
+      syncMode,
+      partition,
+    )
+    const query = await runQueryTrace(
+      `query-differential-${syncMode}`,
+      partition,
+    )
+
+    expect(direct.snapshots).toEqual(referenceSnapshots)
+    expect(persisted.snapshots).toEqual(referenceSnapshots)
+    expect(query.snapshots).toEqual(referenceSnapshots)
+    expect(persisted.rows).toEqual(direct.rows)
+    expect(query.rows).toEqual(direct.rows)
+    expect(persisted.status).toBe(direct.status)
+    expect(query.status).toBe(`ready`)
+    expect(persisted.resume).toEqual(direct.resume)
+    expect(persisted.durableRows).toEqual(direct.rows)
+    expect(persisted.durableResume).toEqual(direct.resume)
+    expect(persisted.persistenceCommits).toBeGreaterThan(0)
+  }
 }
 
 // Each registration below says which path replays stand it aside. A path
 // replay runs only the selected property, and the sibling suites register it.
+/**
+ * # Does the Electric adapter preserve one coherent replica lifecycle?
+ *
+ * Electric delivers change messages, reset controls, offsets, handles, and
+ * snapshot availability through an SDK stream. The adapter must publish atomic
+ * callback cuts, wait for acceptance before Collection readiness and for
+ * application before subset success, persist valid resume evidence for a valid source prefix, reject unseen partial updates,
+ * and keep stale callbacks and metadata scoped to the sync run that created
+ * them.
+ *
+ * Independent Maps model rows, selected-tag membership, source commits, resume
+ * evidence, and persisted state. A controlled ShapeStream boundary supplies
+ * authored message partitions and settlement order. The production Collection,
+ * Query-backed persistence wrapper, metadata APIs, and cleanup run unchanged.
+ * Checks cover public and durable rows, exact batches, readiness, errors,
+ * metadata, waiters, stream ownership, and restart at named checkpoints.
+ *
+ * The suite retains fixed protocol histories, exhaustive contiguous
+ * partitions, fixed campaigns, random campaigns, and explicit seed/path replay
+ * for durability policies. Sensitivity checks reject missing prefix evidence.
+ * Installed-SDK HTTP delivery, PostgreSQL semantics, and live-service execution
+ * remain separate evidence.
+ */
+
 describe(`Electric adapter laws`, () => {
   let processGrammarRun = 0
   let persistencePolicyRun = 0
@@ -2815,44 +2466,6 @@ describe(`Electric adapter laws`, () => {
     resetElectricOracleMocks()
   })
 
-  oracleReplayTest(it).each([false, true])(
-    `cleans direct traces after delivery failure and preserves the primary error (cleanup failure: %s)`,
-    async (failCleanup) => {
-      const primary = new Error(`delivery sentinel`)
-      const secondary = new Error(`cleanup sentinel`)
-      const cleanup = vi.fn(async (release: () => Promise<void>) => {
-        await release()
-        if (failCleanup) throw secondary
-      })
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      try {
-        await expect(
-          runTrace(`cleanup-${failCleanup}`, `eager`, [[]], [], new Map(), {
-            beforeDelivery: () => {
-              throw primary
-            },
-            cleanup,
-          }),
-        ).rejects.toBe(primary)
-        expect(cleanup).toHaveBeenCalledTimes(1)
-        const unsubscribe = mockSubscribe.mock.results.at(-1)!.value
-        expect(unsubscribe).toHaveBeenCalledTimes(1)
-        const streamOptions = vi.mocked(ShapeStream).mock.calls.at(-1)![0] as {
-          signal?: AbortSignal
-        }
-        expect(streamOptions.signal?.aborted).toBe(true)
-        if (failCleanup)
-          expect(warning).toHaveBeenCalledWith(
-            `Electric oracle cleanup failed after a primary error`,
-            secondary,
-          )
-        else expect(warning).not.toHaveBeenCalled()
-      } finally {
-        warning.mockRestore()
-      }
-    },
-  )
-
   oracleReplayTest(it).each(
     ([`eager`, `on-demand`, `progressive`] as const).flatMap((syncMode) =>
       [0, 1, 2].map((removals) => ({ syncMode, removals })),
@@ -2977,222 +2590,13 @@ describe(`Electric adapter laws`, () => {
   )
 
   oracleReplayTest(it)(
-    `preserves unexpected preload failures instead of treating observation as success`,
+    `publishes an Electric source commit before its adapter persistence settles`,
     async () => {
-      const failure = new Error(`test-owned preload failure`)
-      const observed = observePreload(Promise.reject(failure))
-      const outcome = await observed.outcome
-      expect(outcome).toEqual({ status: `rejected`, reason: failure })
-      if (outcome.status === `rejected`) expect(outcome.reason).toBe(failure)
-      expect(() => expectPreloadOutcome(observed, outcome)).toThrow(failure)
-      const success = observePreload(Promise.resolve())
-      expectPreloadOutcome(success, await success.outcome)
-    },
-  )
-
-  oracleReplayTest(it).each([`reset`, `delete`, `move-out`] as const)(
-    `keeps $0 removal authoritative across an optimistic write and a new acquisition`,
-    async (removal) => {
-      const trace = createOracleCollection(
-        `parked-presence`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-      )
-      const persistence = createDeferred<void>()
-      let acquired: Promise<unknown> | undefined
-      let transaction: ReturnType<typeof createTransaction> | undefined
-      try {
-        const inserted = change(`insert`, 1, `complete`)
-        trace.subscriber([
-          { ...inserted, headers: { ...inserted.headers, tags: [`left`] } },
-          upToDate,
-        ])
-        transaction = createTransaction({
-          mutationFn: () => persistence.promise,
-        })
-        transaction.mutate(() =>
-          trace.collection.insert({
-            id: 99,
-            name: `optimistic`,
-            stable: `stable-99`,
-          }),
-        )
-        const removed: Message<OracleRow> =
-          removal === `reset`
-            ? mustRefetch
-            : removal === `delete`
-              ? change(`delete`, 1, `complete`)
-              : {
-                  headers: {
-                    event: `move-out`,
-                    patterns: [{ pos: 0, value: `left` }],
-                  },
-                }
-        trace.subscriber([removed, subsetEnd])
-        // Truncation drains immediately; ordinary removals remain parked.
-        expect(trace.collection.has(1)).toBe(removal !== `reset`)
-        acquired = Promise.resolve(
-          trace.collection._sync.loadSubset({
-            where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(2)]),
-          }),
-        )
-        void acquired.catch(() => {})
-        trace.subscriber([change(`update`, 1, `partial`), upToDate])
-        persistence.resolve()
-        await transaction.isPersisted.promise
-        await acquired
-        expect(trace.collection.has(1)).toBe(false)
-      } finally {
-        persistence.resolve()
-        await transaction?.isPersisted.promise
-        await trace.collection.cleanup()
-        await acquired
-      }
-    },
-  )
-
-  oracleReplayTest(it)(
-    `publishes an Electric source commit before its adapter persistence settles`,
-    async () => {
-      await runPublicationBeforePersistenceWitness(
-        `publication-before-persistence-fixed`,
-        { id: 41, name: `visible first`, stable: `stable-41` },
-        741,
-      )
-    },
-  )
-
-  oracleReplayTest(it)(
-    `publishes later Electric callbacks while an earlier durability turn is held`,
-    async () => {
-      let subscriber:
-        ((messages: Array<Message<OracleRow>>) => void) | undefined
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const firstPersistenceEntered = createDeferred<void>()
-      const releaseFirstPersistence = createDeferred<void>()
-      const persistedMetadata = new Map<string, unknown>()
-      const persistedRows = new Map<string | number, OracleRow>()
-      const adapter = createPersistedAdapter(persistedMetadata, persistedRows)
-      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-      let heldFirstRow = false
-      let durabilityCalls = 0
-      adapter.applyCommittedTx = async (...args) => {
-        durabilityCalls++
-        if (
-          !heldFirstRow &&
-          args[1].mutations.some((mutation) => mutation.key === 1)
-        ) {
-          heldFirstRow = true
-          firstPersistenceEntered.resolve()
-          await releaseFirstPersistence.promise
-        }
-        await applyCommittedTx(...args)
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `queued-persisted-presence`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            syncMode: `progressive`,
-            getKey: (row) => row.id,
-            startSync: true,
-          }),
-          persistence: { adapter },
-        }),
-      )
-      const publications = observePublications(collection)
-
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`), {
-          interval: 1,
-          timeout: 250,
-        })
-        mockStream.lastOffset = `90_0`
-        subscriber!([upToDate])
-        await vi.waitFor(() => expect(collection.status).toBe(`ready`), {
-          interval: 1,
-          timeout: 250,
-        })
-
-        const first = change(`insert`, 1, `holds persistence`)
-        first.value = { id: 1, name: `holds persistence`, stable: `stable-1` }
-        mockStream.lastOffset = `91_0`
-        subscriber!([first, upToDate])
-        await atCheckpoint(
-          firstPersistenceEntered.promise,
-          `first Electric persistence entered`,
-        )
-        const durabilityCallsAtHold = durabilityCalls
-
-        const queued = change(`insert`, 2, `queued insert`)
-        queued.value = { id: 2, name: `queued insert`, stable: `stable-2` }
-        mockStream.lastOffset = `92_0`
-        subscriber!([queued, upToDate])
-
-        const laterUpdate = change(`update`, 2, `later update`)
-        laterUpdate.value = { id: 2, name: `later update`, stable: `stable-2` }
-        mockStream.lastOffset = `93_0`
-        subscriber!([laterUpdate, upToDate])
-
-        const expected = rowsFromMap(
-          new Map([
-            [1, first.value],
-            [2, laterUpdate.value],
-          ]),
-        )
-        expect({
-          publicRows: rowsFromCollection(collection),
-          durableRows: rowsFromMap(persistedRows),
-          noLaterDurabilityStarted: durabilityCalls === durabilityCallsAtHold,
-          published: publications.entries.some(
-            ({ cut, rows }) =>
-              cut === `event` && isDeepStrictEqual(rows, expected),
-          ),
-        }).toEqual({
-          publicRows: rowsFromMap(new Map([[1, first.value]])),
-          durableRows: [],
-          noLaterDurabilityStarted: true,
-          published: false,
-        })
-
-        releaseFirstPersistence.resolve()
-        await vi.waitFor(
-          () =>
-            expect(rowsFromMap(persistedRows)).toEqual(
-              rowsFromMap(
-                new Map([
-                  [1, first.value],
-                  [2, laterUpdate.value],
-                ]),
-              ),
-            ),
-          { interval: 1, timeout: 250 },
-        )
-        expect(rowsFromCollection(collection)).toEqual(
-          rowsFromMap(
-            new Map([
-              [1, first.value],
-              [2, laterUpdate.value],
-            ]),
-          ),
-        )
-        expect(collection.status).toBe(`ready`)
-      }, [
-        () => releaseFirstPersistence.resolve(),
-        () => publications.stop(),
-        () => collection.cleanup(),
-      ])
+      await runPublicationBeforePersistenceWitness(
+        `publication-before-persistence-fixed`,
+        { id: 41, name: `visible first`, stable: `stable-41` },
+        741,
+      )
     },
   )
 
@@ -3759,157 +3163,11 @@ describe(`Electric adapter laws`, () => {
     },
   )
 
-  oracleReplayTest(it)(
-    `keeps pending row presence across callbacks until one persisted subset commit`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const persistedRows = new Map<string | number, OracleRow>()
-      const persistedMetadata = new Map<string, unknown>()
-      const adapter = createPersistedAdapter(persistedMetadata, persistedRows)
-      const applyCommittedTx = adapter.applyCommittedTx.bind(adapter)
-      const durabilityEntered = createDeferred<void>()
-      const releaseDurability = createDeferred<void>()
-      const durabilitySettled = createDeferred<void>()
-      let persistedTx: PersistedTx | undefined
-      adapter.applyCommittedTx = async (...args) => {
-        persistedTx = structuredClone(args[1])
-        durabilityEntered.resolve()
-        await releaseDurability.promise
-        await applyCommittedTx(...args)
-        durabilitySettled.resolve()
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `persisted-cross-callback-presence`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            syncMode: `eager`,
-            getKey: (row) => row.id,
-            startSync: true,
-          }),
-          persistence: { adapter },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
-
-        subscriber([change(`insert`, 1, ``)])
-        subscriber([change(`update`, 1, `updated across callbacks`)])
-        subscriber([subsetEnd])
-        await atCheckpoint(
-          durabilityEntered.promise,
-          `cross-callback durability entered`,
-        )
-
-        expect({
-          publicRows: rowsFromCollection(collection),
-          durableRows: rowsFromMap(persistedRows),
-          persistedMutations: persistedTx?.mutations.map((mutation) => ({
-            type: mutation.type,
-            key: mutation.key,
-            value: mutation.type === `delete` ? undefined : mutation.value,
-          })),
-        }).toEqual({
-          publicRows: [[1, `updated across callbacks`, `stable-1`]],
-          durableRows: [],
-          persistedMutations: [
-            {
-              type: `update`,
-              key: 1,
-              value: {
-                id: 1,
-                name: ``,
-                stable: `stable-1`,
-              },
-            },
-            {
-              type: `update`,
-              key: 1,
-              value: {
-                id: 1,
-                name: `updated across callbacks`,
-              },
-            },
-          ],
-        })
-
-        releaseDurability.resolve()
-        await atCheckpoint(
-          durabilitySettled.promise,
-          `cross-callback durability settled`,
-        )
-        expect(rowsFromMap(persistedRows)).toEqual([
-          [1, `updated across callbacks`, `stable-1`],
-        ])
-      }, [
-        async () => {
-          releaseDurability.resolve()
-          await collection.cleanup()
-        },
-      ])
-    },
-  )
-
   const publicationEpochTokensArbitrary = fc.array(designTokenArb, {
     minLength: 1,
     maxLength: 7,
   })
   const publicationEpochPartitionArbitrary = fc.nat()
-  const assertPublicationEpochHistory = async (
-    tokens: Array<DesignToken>,
-    partitionSeed: number,
-  ) => {
-    const messages = buildDifferentialHistory(tokens)
-    const partitions = everyContiguousPartition(messages).filter(
-      isSdkResetFramedPartition,
-    )
-    const partition = partitions[partitionSeed % partitions.length]!
-    const referenceSnapshots = recomputedSnapshots([], partition)
-
-    for (const syncMode of [`eager`, `on-demand`, `progressive`] as const) {
-      const direct = await runTrace(
-        `direct-differential-${syncMode}`,
-        syncMode,
-        [],
-        partition,
-      )
-      const persisted = await runPersistedTrace(
-        `persisted-differential-${syncMode}`,
-        syncMode,
-        partition,
-      )
-      const query = await runQueryTrace(
-        `query-differential-${syncMode}`,
-        partition,
-      )
-
-      expect(direct.snapshots).toEqual(referenceSnapshots)
-      expect(persisted.snapshots).toEqual(referenceSnapshots)
-      expect(query.snapshots).toEqual(referenceSnapshots)
-      expect(persisted.rows).toEqual(direct.rows)
-      expect(query.rows).toEqual(direct.rows)
-      expect(persisted.status).toBe(direct.status)
-      expect(query.status).toBe(`ready`)
-      expect(persisted.resume).toEqual(direct.resume)
-      expect(persisted.durableRows).toEqual(direct.rows)
-      expect(persisted.durableResume).toEqual(direct.resume)
-      expect(persisted.persistenceCommits).toBeGreaterThan(0)
-    }
-  }
   const publicationEpochExamples: Array<[Array<DesignToken>, number]> = [
     [
       [
@@ -3960,48 +3218,6 @@ describe(`Electric adapter laws`, () => {
     30_000,
   )
 
-  oracleReplayTest(it)(
-    `retains a wrong intermediate publication even when the final read repairs it`,
-    async () => {
-      const trace = createOracleCollection(
-        `publication-recorder-control`,
-        `eager`,
-        createMetadata(new Map()).api,
-      )
-      trace.subscriber([change(`insert`, 1, `old`), upToDate])
-      const observed = observePublications(trace.collection)
-      try {
-        observed.record(`before`)
-        trace.subscriber([change(`update`, 1, `wrong`), upToDate])
-        trace.subscriber([change(`update`, 1, `correct`), upToDate])
-        observed.record(`final`)
-        expect(rowsFromCollection(trace.collection)).toEqual([
-          [1, `correct`, `stable-1`],
-        ])
-        expect(observed.entries[0]!.rows).toEqual([[1, `old`, `stable-1`]])
-        expect(
-          observed.entries.some(
-            ({ cut, rows }) => cut === `event` && rows[0]?.[1] === `wrong`,
-          ),
-        ).toBe(true)
-        expect(() =>
-          expectWholePublications(observed.entries, [
-            [[1, `old`, `stable-1`]],
-            [[1, `correct`, `stable-1`]],
-          ]),
-        ).toThrow()
-        expectWholePublications(observed.entries, [
-          [[1, `old`, `stable-1`]],
-          [[1, `wrong`, `stable-1`]],
-          [[1, `correct`, `stable-1`]],
-        ])
-      } finally {
-        observed.stop()
-        await trace.collection.cleanup()
-      }
-    },
-  )
-
   oracleReplayTest(it)(
     `checks an authored HTTP transcript and separate complete Query snapshots`,
     async () => {
@@ -4196,1126 +3412,120 @@ describe(`Electric adapter laws`, () => {
     },
   )
 
-  for (const syncMode of [`eager`, `progressive`] as const) {
-    it(`rejects unseen resumed updates and recovers on the next ${syncMode} lifecycle`, async () => {
-      const metadata = createMetadata(resumeState())
-      const old = createOracleCollection(
-        `invalid-${syncMode}-resume`,
-        syncMode,
-        metadata.api,
-      )
-
-      old.subscriber([change(`update`, 1, `partial`)])
-      expect(old.collection.status).toBe(`error`)
-      expect(old.collection.has(1)).toBe(false)
-      expect(old.unsubscribe).toHaveBeenCalledOnce()
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `reset` }),
-      )
-
-      old.subscriber([change(`insert`, 1, `old generation`), upToDate])
-      expect(old.collection.has(1)).toBe(false)
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `reset` }),
-      )
-      await old.collection.cleanup()
-
-      const fresh = createOracleCollection(
-        `fresh-${syncMode}-snapshot`,
-        syncMode,
-        metadata.api,
-      )
-      fresh.subscriber([change(`insert`, 1, `complete snapshot`), upToDate])
-
-      expect(fresh.collection.status).toBe(`ready`)
-      expect(fresh.collection.get(1)?.name).toBe(`complete snapshot`)
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `resume`, offset: `20_0` }),
-      )
-      await fresh.collection.cleanup()
-    })
-
-    it(`treats delete then update as an invalid ${syncMode} resume`, async () => {
-      const metadata = createMetadata(resumeState())
-      const trace = createOracleCollection(
-        `delete-update-${syncMode}-resume`,
-        syncMode,
-        metadata.api,
-      )
-
-      trace.subscriber([
-        change(`insert`, 1, `seen`),
-        change(`delete`, 1, `seen`),
-        change(`update`, 1, `partial`),
-      ])
-
-      expect(trace.collection.status).toBe(`error`)
-      expect(trace.collection.has(1)).toBe(false)
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `reset` }),
-      )
-      await trace.collection.cleanup()
-    })
-
-    it(`rejects delete then update across every ${syncMode} resume partition`, async () => {
-      const messages = [
-        change(`delete`, 1, `complete`),
-        change(`update`, 1, `partial`),
-        upToDate,
-      ]
-
-      for (const [partitionId, partition] of everyContiguousPartition(
-        messages,
-      ).entries()) {
-        const metadata = createMetadata(resumeState())
-        const trace = createOracleCollection(
-          `invalid-partition-${syncMode}-${partitionId}`,
-          syncMode,
-          metadata.api,
-        )
-        trace.subscriber([change(`insert`, 1, `complete`), upToDate])
-        for (const batch of partition) trace.subscriber(batch)
-
-        expectGaveUpAfterReadiness(trace.collection)
-        expect(trace.collection.get(1)).toEqual(
-          expect.objectContaining({ stable: `stable-1` }),
-        )
-        expect(metadata.state.get(`electric:resume`)).toEqual(
-          expect.objectContaining({ kind: `reset` }),
-        )
-        await trace.collection.cleanup()
-      }
-    })
-  }
+  const reentryHistory = fc.record({
+    txid: fc.integer({ min: 1, max: 10000 }),
+    names: fc.array(fc.string({ maxLength: 8 }), {
+      minLength: 1,
+      maxLength: 5,
+    }),
+    trigger: fc.nat({ max: 4 }),
+  })
 
-  oracleReplayTest(it)(
-    `keeps stream cleanup and stale callbacks scoped to their lifecycle`,
-    async () => {
+  async function runReentryHistory(history: {
+    txid: number
+    names: Array<string>
+    trigger: number
+  }) {
+    // Same ownership law, with retirement either outside or inside a callback.
+    // Previously the grammar only retired a sync run between complete callbacks.
+    for (const insideCallback of [false, true]) {
       const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> =
         []
-      const unsubscribes = [vi.fn(), vi.fn()]
       mockSubscribe.mockImplementation((callback) => {
-        const index = subscribers.length
         subscribers.push(callback)
-        return unsubscribes[index]!
-      })
-      const options = electricCollectionOptions<OracleRow>({
-        id: `reused-sync-config`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-        startSync: true,
+        return vi.fn()
       })
-      const createLifecycle = (id: string) => {
-        const metadata = createMetadata(resumeState())
-        const lifecycleSync = options.sync
-        return createCollection({
-          ...options,
-          id,
-          sync: {
-            ...lifecycleSync,
-            sync: (params: Parameters<typeof lifecycleSync.sync>[0]) =>
-              lifecycleSync.sync({ ...params, metadata: metadata.api }),
+      const collection = createCollection(
+        electricCollectionOptions<OracleRow>({
+          shapeOptions: {
+            url: `http://test-url`,
+            params: { table: `test_table` },
           },
-        })
+          getKey: (row) => row.id,
+          startSync: true,
+        }),
+      )
+      const triggerId = (history.trigger % history.names.length) + 1
+      let retired = false
+      let cleanup: Promise<void> | undefined
+      let replacementVisits = 0
+      let replacementOutcome: Promise<unknown> | undefined
+      const restart = () => {
+        retired = true
+        cleanup = collection.cleanup()
+        collection.startSyncImmediate()
+        replacementOutcome = collection.utils
+          .awaitMatch(() => {
+            replacementVisits++
+            return false
+          })
+          .catch(() => undefined)
       }
-
-      const oldCollection = createLifecycle(`old-sync-lifecycle`)
-      const currentCollection = createLifecycle(`current-sync-lifecycle`)
-
-      subscribers[0]!([change(`insert`, 1, `first row`), upToDate])
-      subscribers[1]!([change(`insert`, 2, `second row`), upToDate])
-      expect(oldCollection.get(1)?.name).toBe(`first row`)
-      expect(currentCollection.get(2)?.name).toBe(`second row`)
-      subscribers[0]!([change(`update`, 1, `first row updated`), upToDate])
-      const currentMatch = currentCollection.utils.awaitMatch(
-        (message) => `value` in message && message.value.id === 3,
-        100,
+      const waiting = collection.utils.awaitMatch((message) => {
+        if (
+          insideCallback &&
+          !retired &&
+          `value` in message &&
+          message.value.id === triggerId
+        )
+          restart()
+        return false
+      }, 20)
+      // Observe the old waiter before any callback can retire its sync run.
+      const oldOutcome = waiting.then(
+        () => `resolved`,
+        () => `rejected`,
       )
-      const currentTxid = currentCollection.utils.awaitTxId(42, 100)
-      const currentSnapshotTxid = currentCollection.utils.awaitTxId(50, 100)
-      let currentMatchResolved = false
-      let currentTxidResolved = false
-      let currentSnapshotTxidResolved = false
-      void currentMatch.then(() => {
-        currentMatchResolved = true
-      })
-      void currentTxid.then(() => {
-        currentTxidResolved = true
-      })
-      void currentSnapshotTxid.then(() => {
-        currentSnapshotTxidResolved = true
-      })
-      subscribers[0]!([
-        change(`insert`, 3, `wrong lifecycle`),
-        {
-          headers: {
-            control: `snapshot-end`,
-            xmin: `100`,
-            xmax: `150`,
-            xip_list: [],
-          },
-        },
-        { headers: { control: `up-to-date`, txids: [42] } },
-      ])
-      await Promise.resolve()
-      expect(currentMatchResolved).toBe(false)
-      expect(currentTxidResolved).toBe(false)
-      expect(currentSnapshotTxidResolved).toBe(false)
-
-      await oldCollection.cleanup()
-
-      expect(unsubscribes[0]).toHaveBeenCalledOnce()
-      expect(unsubscribes[1]).not.toHaveBeenCalled()
-
-      subscribers[0]!([change(`update`, 1, `stale`)])
-      expect(unsubscribes[1]).not.toHaveBeenCalled()
-      subscribers[1]!([
-        change(`insert`, 3, `still live`),
-        {
-          headers: {
-            control: `snapshot-end`,
-            xmin: `100`,
-            xmax: `150`,
-            xip_list: [],
-          },
-        },
-        { headers: { control: `up-to-date`, txids: [42] } },
-      ])
-      await expect(currentMatch).resolves.toBe(true)
-      await expect(currentTxid).resolves.toBe(true)
-      await expect(currentSnapshotTxid).resolves.toBe(true)
-      expect(currentCollection.get(3)?.name).toBe(`still live`)
-      await currentCollection.cleanup()
-      expect(unsubscribes[1]).toHaveBeenCalledOnce()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `binds sync metadata import and export to the receiving collection`,
-    async () => {
-      const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> =
-        []
-      mockSubscribe.mockImplementation((callback) => {
-        subscribers.push(callback)
-        return vi.fn()
-      })
-      const options = electricCollectionOptions<OracleRow>({
-        id: `shared-metadata-config`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      const first = createCollection({ ...options, id: `metadata-first` })
-      const second = createCollection({ ...options, id: `metadata-second` })
-
-      subscribers[0]!([{ headers: { control: `up-to-date`, txids: [11] } }])
-      subscribers[1]!([{ headers: { control: `up-to-date`, txids: [22] } }])
-
-      expect(first.config.sync.exportSyncMeta?.()).toMatchObject({
-        version: 1,
-        seenTxids: [11],
-      })
-      expect(second.config.sync.exportSyncMeta?.()).toMatchObject({
-        version: 1,
-        seenTxids: [22],
-      })
-
-      const importedResume = {
-        kind: `resume` as const,
-        requiresTagState: false,
-        offset: `7_0` as const,
-        handle: `shape-7`,
-        shapeId,
-        updatedAt: 7,
-      }
-      first.config.sync.importSyncMeta?.({
-        version: 1,
-        resume: importedResume,
-        seenTxids: [99],
-      })
-
-      await expect(first.utils.awaitTxId(99, 50)).resolves.toBe(true)
-      await expect(second.utils.awaitTxId(99, 10)).rejects.toThrow()
-      expect(first.config.sync.exportSyncMeta?.()).toEqual({
-        version: 1,
-        resume: importedResume,
-        seenTxids: [99],
-      })
-      expect(second.config.sync.exportSyncMeta?.()).toMatchObject({
-        version: 1,
-        seenTxids: [22],
-      })
-      expect(second.config.sync.exportSyncMeta?.()).not.toMatchObject({
-        resume: importedResume,
-      })
-
-      const third = createCollection({ ...options, id: `metadata-third` })
-      await expect(third.utils.awaitTxId(99, 10)).rejects.toThrow()
-      expect(third.config.sync.exportSyncMeta?.()).not.toMatchObject({
-        resume: importedResume,
-      })
-
-      await first.cleanup()
-      await second.cleanup()
-      await third.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `consumes raw sync metadata when the next collection is materialized`,
-    async () => {
-      mockSubscribe.mockImplementation(() => vi.fn())
-      const options = electricCollectionOptions<OracleRow>({
-        id: `seeded-metadata-config`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      const importedResume = {
-        kind: `resume` as const,
-        requiresTagState: false,
-        offset: `8_0` as const,
-        handle: `shape-8`,
-        shapeId,
-        updatedAt: 8,
-      }
-      options.sync.importSyncMeta?.({
-        version: 1,
-        resume: importedResume,
-        seenTxids: [55],
-      })
-
-      const seeded = createCollection({ ...options, id: `metadata-seeded` })
-      await expect(seeded.utils.awaitTxId(55, 50)).resolves.toBe(true)
-      expect(seeded.config.sync.exportSyncMeta?.()).toMatchObject({
-        resume: importedResume,
-        seenTxids: [55],
-      })
-
-      const unseeded = createCollection({ ...options, id: `metadata-unseeded` })
-      await expect(unseeded.utils.awaitTxId(55, 10)).rejects.toThrow()
-      expect(unseeded.config.sync.exportSyncMeta?.()).toEqual({
-        version: 1,
-        seenTxids: [],
-      })
-
-      await seeded.cleanup()
-      await unseeded.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `binds imported evidence and pending matches before lazy sync starts`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementation((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const options = electricCollectionOptions<OracleRow>({
-        id: `lazy-bound-evidence`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-        startSync: false,
-      })
-      const collection = createCollection(options)
-      const importedResume = {
-        kind: `resume` as const,
-        requiresTagState: false,
-        offset: `9_0` as const,
-        handle: `shape-9`,
-        shapeId,
-        updatedAt: 9,
-      }
-      collection.config.sync.importSyncMeta?.({
-        version: 1,
-        resume: importedResume,
-        seenTxids: [33],
-      })
-
-      await expect(collection.utils.awaitTxId(33, 20)).resolves.toBe(true)
-      const pendingMatch = collection.utils.awaitMatch(
-        (message) => `value` in message && message.value.id === 5,
-        100,
-      )
-      const pendingTxid = collection.utils.awaitTxId(34, 100)
-      const preload = collection.preload()
-      expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
-        offset: `9_0`,
-        handle: `shape-9`,
-      })
-      const evidenceChange = change(`insert`, 5, `matched after start`)
-      subscriber([
-        {
-          ...evidenceChange,
-          headers: { operation: `insert`, txids: [34] },
-        },
-        upToDate,
-      ])
-
-      await expect(pendingMatch).resolves.toBe(true)
-      await expect(pendingTxid).resolves.toBe(true)
-      await preload
-      expect(collection.get(5)?.name).toBe(`matched after start`)
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `keeps descriptor utilities captured before collection startup live`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementation((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const options = electricCollectionOptions<OracleRow>({
-        id: `captured-descriptor-utilities`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-        startSync: false,
-      })
-      const { awaitMatch, awaitTxId } = options.utils
-      const collection = createCollection(options)
-      const pendingMatch = awaitMatch(
-        (message) => `value` in message && message.value.id === 77,
-        100,
-      )
-      const pendingTxid = awaitTxId(77, 100)
-
-      const preload = collection.preload()
-      const evidenceChange = change(`insert`, 77, `captured utilities`)
-      subscriber([
-        {
-          ...evidenceChange,
-          headers: { operation: `insert`, txids: [77] },
-        },
-        upToDate,
-      ])
-
-      await expect(pendingMatch).resolves.toBe(true)
-      await expect(pendingTxid).resolves.toBe(true)
-      await preload
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `retires a pending pre-start match when a lazy collection is cleaned up`,
-    async () => {
-      mockSubscribe.mockImplementation(() => vi.fn())
-      const collection = createCollection(
-        electricCollectionOptions<OracleRow>({
-          id: `lazy-pre-start-cleanup`,
-          shapeOptions: {
-            url: `http://test-url`,
-            params: { table: `test_table` },
-          },
-          getKey: (row) => row.id,
-          startSync: false,
-        }),
-      )
-      const pendingMatch = collection.utils.awaitMatch(() => false, 100)
-
-      await collection.cleanup()
-
-      await expect(pendingMatch).rejects.toThrow(/aborted/i)
-      expect(mockSubscribe).not.toHaveBeenCalled()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `retires pre-start waiters when persisted metadata startup is interrupted`,
-    async () => {
-      const metadataStarted = createDeferred<void>()
-      const metadataGate = createDeferred<void>()
-      const adapter = createPersistedAdapter(new Map(), new Map())
-      const loadResumeSnapshot = adapter.loadResumeSnapshot
-      adapter.loadResumeSnapshot = async (...args) => {
-        metadataStarted.resolve()
-        await metadataGate.promise
-        return loadResumeSnapshot(args[0], args[1])
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `persisted-startup-waiter-cleanup`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            getKey: (row) => row.id,
-            startSync: false,
-          }),
-          persistence: { adapter },
-        }),
-      )
-      const pendingMatch = collection.utils.awaitMatch(() => false, 100)
-      const pendingTxid = collection.utils.awaitTxId(702, 100)
-      const preload = expect(collection.preload()).rejects.toMatchObject({
-        name: `AbortError`,
-      })
-      await metadataStarted.promise
-      const matchOutcome = expect(pendingMatch).rejects.toThrow(/aborted/i)
-      const txidOutcome = expect(pendingTxid).rejects.toThrow(/aborted/i)
-
-      await collection.cleanup()
-
-      await matchOutcome
-      await txidOutcome
-      expect(mockSubscribe).not.toHaveBeenCalled()
-      metadataGate.resolve()
-      await preload
-    },
-  )
-
-  oracleReplayTest(it)(
-    `retires pre-start waiters through automatic collection GC`,
-    async () => {
-      const metadataGate = createDeferred<void>()
-      const adapter = createPersistedAdapter(new Map(), new Map())
-      const loadResumeSnapshot = adapter.loadResumeSnapshot
-      adapter.loadResumeSnapshot = vi.fn(async (...args) => {
-        await metadataGate.promise
-        return loadResumeSnapshot(args[0], args[1])
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `persisted-gc-waiter-cleanup`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            getKey: (row) => row.id,
-            startSync: false,
-            gcTime: 10,
-          }),
-          persistence: { adapter },
-        }),
-      )
-      const pendingMatch = collection.utils.awaitMatch(() => false, 5000)
-      const pendingTxid = collection.utils.awaitTxId(703, 5000)
-      // A pending preload owns retention; exercise unowned sync for automatic GC.
-      collection.startSyncImmediate()
-      await vi.waitFor(
-        () => expect(adapter.loadResumeSnapshot).toHaveBeenCalledOnce(),
-        { interval: 1, timeout: 250 },
-      )
-      const subscription = collection.subscribeChanges(() => {})
-      const matchOutcome = pendingMatch.catch((error: unknown) => error)
-      const txidOutcome = pendingTxid.catch((error: unknown) => error)
-
-      subscription.unsubscribe()
-      await vi.waitFor(() => expect(collection.status).toBe(`cleaned-up`), {
-        interval: 10,
-        timeout: 1500,
-      })
-      const pendingSentinel = Symbol(`pending`)
-      const matchResult = await Promise.race([
-        matchOutcome,
-        new Promise((resolve) =>
-          setTimeout(() => resolve(pendingSentinel), 50),
-        ),
-      ])
-      const txidResult = await Promise.race([
-        txidOutcome,
-        new Promise((resolve) =>
-          setTimeout(() => resolve(pendingSentinel), 50),
-        ),
-      ])
-
-      expect(matchResult).toEqual(
-        expect.objectContaining({
-          message: expect.stringMatching(/aborted/i),
-        }),
-      )
-      expect(txidResult).toEqual(
-        expect.objectContaining({
-          message: expect.stringMatching(/aborted/i),
-        }),
-      )
-      expect(mockSubscribe).not.toHaveBeenCalled()
-      metadataGate.resolve()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `retires every pending waiter when its collection lifecycle is cleaned up`,
-    async () => {
-      mockSubscribe.mockImplementation(() => vi.fn())
-      const lazy = createCollection(
-        electricCollectionOptions<OracleRow>({
-          id: `lazy-waiter-cleanup`,
-          shapeOptions: {
-            url: `http://test-url`,
-            params: { table: `test_table` },
-          },
-          getKey: (row) => row.id,
-          startSync: false,
-        }),
-      )
-      const lazyTxid = lazy.utils.awaitTxId(700, 100)
-      await lazy.cleanup()
-      await expect(lazyTxid).rejects.toThrow(/aborted/i)
-
-      const active = createOracleCollection(
-        `active-waiter-cleanup`,
-        `eager`,
-        createMetadata(new Map()).api,
-      )
-      const activeMatch = active.collection.utils.awaitMatch(() => false, 100)
-      const activeTxid = active.collection.utils.awaitTxId(701, 100)
-      await active.collection.cleanup()
-
-      await expect(activeMatch).rejects.toThrow(/aborted/i)
-      await expect(activeTxid).rejects.toThrow(/aborted/i)
-    },
-  )
-
-  oracleReplayTest(it)(
-    `settles waiters according to whether evidence or cleanup wins`,
-    async () => {
-      for (const cleanupWins of [true, false]) {
-        const trace = createOracleCollection(
-          `waiter-race-${cleanupWins}`,
-          `eager`,
-          createMetadata(new Map()).api,
-        )
-        const pendingMatch = trace.collection.utils.awaitMatch(
-          (message) => `value` in message && message.value.id === 91,
-          100,
-        )
-        const pendingTxid = trace.collection.utils.awaitTxId(91, 100)
-        const evidenceChange = change(`insert`, 91, `race winner`)
-        const evidence: Array<Message<OracleRow>> = [
-          {
-            ...evidenceChange,
-            headers: { operation: `insert`, txids: [91] },
-          },
-          upToDate,
-        ]
-
-        if (cleanupWins) {
-          await trace.collection.cleanup()
-          trace.subscriber(evidence)
-          await expect(pendingMatch).rejects.toThrow(/aborted/i)
-          await expect(pendingTxid).rejects.toThrow(/aborted/i)
-          expect(trace.collection.get(91)).toBeUndefined()
-        } else {
-          trace.subscriber(evidence)
-          await trace.collection.cleanup()
-          await expect(pendingMatch).resolves.toBe(true)
-          await expect(pendingTxid).resolves.toBe(true)
-        }
-      }
-    },
-  )
-
-  oracleReplayTest(it)(
-    `keeps committed match evidence across newer writer batches`,
-    async () => {
-      const metadata = createMetadata(new Map())
-      const trace = createOracleCollection(
-        `await-match-batch-generation`,
-        `eager`,
-        metadata.api,
-      )
-
-      trace.subscriber([change(`insert`, 1, `old batch`), upToDate])
-      trace.subscriber([change(`insert`, 2, `current batch`), upToDate])
-
-      await expect(
-        trace.collection.utils.awaitMatch(
-          (message) => `value` in message && message.value.name === `old batch`,
-          20,
-        ),
-      ).resolves.toBe(true)
-      await trace.collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `keeps committed match evidence across callbacks with no new data`,
-    async () => {
-      const trace = createOracleCollection(
-        `await-match-neutral-callback`,
-        `eager`,
-        createMetadata(new Map()).api,
-      )
-
-      trace.subscriber([change(`insert`, 1, `committed`), upToDate])
-      trace.subscriber([
-        {
-          headers: {
-            control: `snapshot-end`,
-            xmin: `100`,
-            xmax: `150`,
-            xip_list: [],
-          },
-        },
-      ])
-      trace.subscriber([])
-
-      await expect(
-        trace.collection.utils.awaitMatch(
-          (message) => `value` in message && message.value.id === 1,
-          20,
-        ),
-      ).resolves.toBe(true)
-      await trace.collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `clears committed match evidence when the stream must refetch`,
-    async () => {
-      const trace = createOracleCollection(
-        `await-match-reset-generation`,
-        `eager`,
-        createMetadata(new Map()).api,
-      )
-
-      trace.subscriber([change(`insert`, 1, `old generation`), upToDate])
-      trace.subscriber([mustRefetch, upToDate])
-
-      await expect(
-        trace.collection.utils.awaitMatch(
-          (message) =>
-            `value` in message && message.value.name === `old generation`,
-          20,
-        ),
-      ).rejects.toThrow(/Timeout waiting for custom match function/)
-      await trace.collection.cleanup()
-    },
-  )
-
-  const reentryHistory = fc.record({
-    txid: fc.integer({ min: 1, max: 10000 }),
-    names: fc.array(fc.string({ maxLength: 8 }), {
-      minLength: 1,
-      maxLength: 5,
-    }),
-    trigger: fc.nat({ max: 4 }),
-  })
-
-  async function runReentryHistory(history: {
-    txid: number
-    names: Array<string>
-    trigger: number
-  }) {
-    // Same ownership law, with retirement either outside or inside a callback.
-    // Previously the grammar only retired a sync run between complete callbacks.
-    for (const insideCallback of [false, true]) {
-      const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> =
-        []
-      mockSubscribe.mockImplementation((callback) => {
-        subscribers.push(callback)
-        return vi.fn()
-      })
-      const collection = createCollection(
-        electricCollectionOptions<OracleRow>({
-          shapeOptions: {
-            url: `http://test-url`,
-            params: { table: `test_table` },
-          },
-          getKey: (row) => row.id,
-          startSync: true,
-        }),
-      )
-      const triggerId = (history.trigger % history.names.length) + 1
-      let retired = false
-      let cleanup: Promise<void> | undefined
-      let replacementVisits = 0
-      let replacementOutcome: Promise<unknown> | undefined
-      const restart = () => {
-        retired = true
-        cleanup = collection.cleanup()
-        collection.startSyncImmediate()
-        replacementOutcome = collection.utils
-          .awaitMatch(() => {
-            replacementVisits++
-            return false
-          })
-          .catch(() => undefined)
-      }
-      const waiting = collection.utils.awaitMatch((message) => {
-        if (
-          insideCallback &&
-          !retired &&
-          `value` in message &&
-          message.value.id === triggerId
-        )
-          restart()
-        return false
-      }, 20)
-      // Observe the old waiter before any callback can retire its sync run.
-      const oldOutcome = waiting.then(
-        () => `resolved`,
-        () => `rejected`,
-      )
-      try {
-        if (!insideCallback) restart()
-        const messages = history.names.map((name, index) =>
-          change(`insert`, index + 1, name),
-        )
-        const acknowledgement: Message<OracleRow> = {
-          headers: { control: `up-to-date`, txids: [history.txid] },
-        }
-        subscribers[0]!([...messages, acknowledgement])
-        await cleanup
-        expect(subscribers).toHaveLength(2)
-        expect(await oldOutcome).toBe(`rejected`)
-        expect(replacementVisits).toBe(0)
-        // The old callback's tail is not evidence from the replacement stream.
-        // This is the utility's own deadline, not a sleep used to infer readiness.
-        await expect(
-          collection.utils.awaitTxId(history.txid, 10),
-        ).rejects.toThrow(/Timeout/)
-        expect(collection.size).toBe(0)
-        subscribers[1]!([...messages, acknowledgement])
-        await expect(
-          collection.utils.awaitTxId(history.txid, 10),
-        ).resolves.toBe(true)
-        expect(
-          [...collection.values()].map((row) => ({
-            id: row.id,
-            name: row.name,
-          })),
-        ).toEqual(history.names.map((name, index) => ({ id: index + 1, name })))
-      } finally {
-        await collection.cleanup()
-        await oldOutcome
-        await replacementOutcome
-      }
-    }
-  }
+      try {
+        if (!insideCallback) restart()
+        const messages = history.names.map((name, index) =>
+          change(`insert`, index + 1, name),
+        )
+        const acknowledgement: Message<OracleRow> = {
+          headers: { control: `up-to-date`, txids: [history.txid] },
+        }
+        subscribers[0]!([...messages, acknowledgement])
+        await cleanup
+        expect(subscribers).toHaveLength(2)
+        expect(await oldOutcome).toBe(`rejected`)
+        expect(replacementVisits).toBe(0)
+        // The old callback's tail is not evidence from the replacement stream.
+        // This is the utility's own deadline, not a sleep used to infer readiness.
+        await expect(
+          collection.utils.awaitTxId(history.txid, 10),
+        ).rejects.toThrow(/Timeout/)
+        expect(collection.size).toBe(0)
+        subscribers[1]!([...messages, acknowledgement])
+        await expect(
+          collection.utils.awaitTxId(history.txid, 10),
+        ).resolves.toBe(true)
+        expect(
+          [...collection.values()].map((row) => ({
+            id: row.id,
+            name: row.name,
+          })),
+        ).toEqual(history.names.map((name, index) => ({ id: index + 1, name })))
+      } finally {
+        await collection.cleanup()
+        await oldOutcome
+        await replacementOutcome
+      }
+    }
+  }
 
   oracleReplayTest(fcTest).prop([reentryHistory], {
     seed: 42713,
     numRuns: oracleRuns(10),
-  })(
-    `replacement sync runs reject evidence from callback reentry histories (fixed)`,
-    runReentryHistory,
-  )
-  oracleReplayTest(fcTest, `electric.match-reentry`).prop(
-    [reentryHistory],
-    oraclePropertyOptions(10, `electric.match-reentry`),
-  )(
-    `replacement sync runs reject evidence from callback reentry histories (random)`,
-    runReentryHistory,
-  )
-
-  oracleReplayTest(it)(
-    `does not let a committed message satisfy awaitMatch after restart`,
-    async () => {
-      const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> =
-        []
-      mockSubscribe.mockImplementation((callback) => {
-        subscribers.push(callback)
-        return vi.fn()
-      })
-      const collection = createCollection(
-        electricCollectionOptions<OracleRow>({
-          id: `await-match-lifecycle-generation`,
-          shapeOptions: {
-            url: `http://test-url`,
-            params: { table: `test_table` },
-          },
-          getKey: (row) => row.id,
-          startSync: true,
-        }),
-      )
-
-      subscribers[0]!([change(`insert`, 1, `old lifecycle`), upToDate])
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(subscribers).toHaveLength(2))
-
-      await expect(
-        collection.utils.awaitMatch(
-          (message) =>
-            `value` in message && message.value.name === `old lifecycle`,
-          20,
-        ),
-      ).rejects.toThrow(/Timeout waiting for custom match function/)
-      await collection.cleanup()
-    },
-  )
-
-  for (const syncMode of [`eager`, `on-demand`, `progressive`] as const) {
-    it(`does not apply an unseen ${syncMode} update after must-refetch`, async () => {
-      const metadata = createMetadata(new Map())
-      const trace = createOracleCollection(
-        `must-refetch-unseen-${syncMode}`,
-        syncMode,
-        metadata.api,
-      )
-      trace.subscriber([change(`insert`, 1, `complete`), upToDate])
-
-      trace.subscriber([mustRefetch, change(`update`, 1, `partial`), upToDate])
-
-      expect(trace.collection.status).toBe(`ready`)
-      expect(trace.collection.has(1)).toBe(false)
-      await trace.collection.cleanup()
-    })
-
-    it(`keeps the ${syncMode} reset marker until the replacement snapshot is complete`, async () => {
-      const metadata = createMetadata(resumeState())
-      const trace = createOracleCollection(
-        `durable-reset-${syncMode}`,
-        syncMode,
-        metadata.api,
-      )
-
-      trace.subscriber([mustRefetch])
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `reset` }),
-      )
-
-      trace.subscriber([change(`insert`, 1, `partial snapshot`), subsetEnd])
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `reset` }),
-      )
-
-      trace.subscriber([
-        change(`update`, 2, `unseen`),
-        change(`update`, 1, `complete snapshot`),
-        upToDate,
-      ])
-      expect(trace.collection.status).toBe(`ready`)
-      expect(trace.collection.get(1)).toEqual(
-        expect.objectContaining({
-          id: 1,
-          name: `complete snapshot`,
-          stable: `stable-1`,
-        }),
-      )
-      expect(trace.collection.has(2)).toBe(false)
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `resume`, offset: `20_0` }),
-      )
-      await trace.collection.cleanup()
-    })
-  }
-
-  oracleReplayTest(it)(
-    `does not let an older applied receipt finish a newer reset`,
-    async () => {
-      const metadata = createMetadata(resumeState())
-      const trace = createOracleCollection(
-        `overlapping-reset-generations`,
-        `eager`,
-        metadata.api,
-      )
-      const persistence = createDeferred<void>()
-      const transaction = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-
-      trace.subscriber([
-        mustRefetch,
-        change(`insert`, 1, `first replacement`),
-        subsetEnd,
-      ])
-      transaction.mutate(() =>
-        trace.collection.insert({
-          id: 99,
-          name: `optimistic`,
-          stable: `stable-99`,
-        }),
-      )
-      trace.subscriber([upToDate])
-      trace.subscriber([mustRefetch])
-      await Promise.resolve()
-
-      trace.subscriber([change(`update`, 2, `unseen`), upToDate])
-
-      expect(trace.collection.status).not.toBe(`error`)
-      expect(trace.collection.has(2)).toBe(false)
-
-      persistence.resolve()
-      await transaction.isPersisted.promise
-      await trace.collection.cleanup()
-    },
-  )
-
-  // Readiness counts accepted rows; they publish when the mutation settles.
-  oracleReplayTest(it)(
-    `publishes readiness once a held receipt is accepted`,
-    async () => {
-      const metadata = createMetadata(new Map())
-      const trace = createOracleCollection(
-        `deferred-applied-receipt`,
-        `eager`,
-        metadata.api,
-      )
-      const persistence = createDeferred<void>()
-      const transaction = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-      transaction.mutate(() =>
-        trace.collection.insert({
-          id: 99,
-          name: `optimistic`,
-          stable: `stable-99`,
-        }),
-      )
-
-      trace.subscriber([change(`insert`, 1, `synced`), upToDate])
-      await Promise.resolve()
-
-      expect(trace.collection.status).toBe(`ready`)
-      expect(trace.collection.has(1)).toBe(false)
-
-      persistence.resolve()
-      await transaction.isPersisted.promise
-      await trace.collection.stateWhenReady()
-
-      expect(trace.collection.status).toBe(`ready`)
-      expect(trace.collection.get(1)).toEqual(
-        expect.objectContaining({ stable: `stable-1` }),
-      )
-      await trace.collection.cleanup()
-    },
-  )
-
-  /**
-   * Full-mode recovery can accept its complete source snapshot while an
-   * optimistic transaction still withholds application. Collection readiness
-   * is allowed at acceptance; LoadSubsetFn success must await the applied
-   * receipt. The independent obligation is simply pending until the held
-   * transaction releases, then exact source-row visibility at settlement.
-   *
-   * Demand before and after readiness distinguishes an initial-ready gate
-   * from the stronger applied-settlement law, including receipts created
-   * before the acquisition's own commit cursor. The transaction promise
-   * controls application; yielding a turn only drains already queued work.
-   */
-  oracleReplayTest(it).each([`before-ready`, `after-ready`] as const)(
-    `full recovery subset waits for application when acquired %s`,
-    async (acquireAt) => {
-      const trace = createOracleCollection(
-        `full-recovery-applied-${acquireAt}`,
-        `on-demand`,
-        createMetadata(
-          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-        ).api,
-      )
-      const persistence = createDeferred<void>()
-      const transaction = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-      transaction.mutate(() =>
-        trace.collection.insert({
-          id: 99,
-          name: `optimistic`,
-          stable: `stable-99`,
-        }),
-      )
-      let outcome: `pending` | `fulfilled` | `rejected` = `pending`
-      const acquire = () =>
-        Promise.resolve(trace.collection._sync.loadSubset({ limit: 1 })).then(
-          () => {
-            outcome = `fulfilled`
-          },
-          (error: unknown) => {
-            outcome = `rejected`
-            throw error
-          },
-        )
-      let loading: Promise<void> | undefined
-      await withElectricCleanup(async () => {
-        if (acquireAt === `before-ready`) loading = acquire()
-        trace.subscriber([change(`insert`, 1, `replacement`), upToDate])
-        expect(trace.collection.status).toBe(`ready`)
-        if (acquireAt === `after-ready`) loading = acquire()
-        void loading!.catch(() => undefined)
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-        expect(trace.collection.has(1), `application is still held`).toBe(false)
-        expect(outcome, `ready does not establish subset application`).toBe(
-          `pending`,
-        )
-        persistence.resolve()
-        await transaction.isPersisted.promise
-        await atCheckpoint(loading!, `full recovery applied settlement`)
-        expect(outcome).toBe(`fulfilled`)
-        expect(trace.collection.get(1)).toMatchObject({
-          id: 1,
-          name: `replacement`,
-          stable: `stable-1`,
-        })
-      }, [() => persistence.resolve(), () => trace.collection.cleanup()])
-    },
+  })(
+    `replacement sync runs reject evidence from callback reentry histories (fixed)`,
+    runReentryHistory,
   )
-
-  // A full stream keeps its capability across a same-run must-refetch. Its
-  // previous applied snapshot cannot establish newly requested replacement
-  // coverage. This continuation rejects a permanently fulfilled startup gate.
-  oracleReplayTest(it)(
-    `full recovery demand waits again after a same-run reset`,
-    async () => {
-      const trace = createOracleCollection(
-        `full-recovery-reset`,
-        `on-demand`,
-        createMetadata(
-          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-        ).api,
-      )
-      await withElectricCleanup(async () => {
-        trace.subscriber([change(`insert`, 1, `first`), upToDate])
-        await trace.collection._sync.loadSubset({ limit: 1 })
-        trace.subscriber([mustRefetch])
-        let outcome = `pending`
-        const loading = Promise.resolve(
-          trace.collection._sync.loadSubset({ limit: 2 }),
-        ).then(
-          () => {
-            outcome = `fulfilled`
-          },
-          (error: unknown) => {
-            outcome = `rejected`
-            throw error
-          },
-        )
-        void loading.catch(() => undefined)
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-        expect(outcome, `prior readiness is not replacement coverage`).toBe(
-          `pending`,
-        )
-        trace.subscriber([change(`insert`, 2, `second`), upToDate])
-        await atCheckpoint(loading, `same-run replacement applied`)
-        expect(outcome).toBe(`fulfilled`)
-        expect(rowsFromCollection(trace.collection)).toEqual([
-          [2, `second`, `stable-2`],
-        ])
-      }, [() => trace.collection.cleanup()])
-    },
+  oracleReplayTest(fcTest, `electric.match-reentry`).prop(
+    [reentryHistory],
+    oraclePropertyOptions(10, `electric.match-reentry`),
+  )(
+    `replacement sync runs reject evidence from callback reentry histories (random)`,
+    runReentryHistory,
   )
 
   /**
@@ -5848,760 +4058,79 @@ describe(`Electric adapter laws`, () => {
         ] as Array<[boolean, RetryStep]>
       ).map(([hasOnError, giveUp]): [RetryHistory] => [
         {
-          wait: `full-log`,
-          hasOnError,
-          steps: [
-            { kind: `demand` },
-            { kind: `hold-acceptance` },
-            { kind: `up-to-date` },
-            giveUp,
-            { kind: `accept` },
-          ],
-        },
-      ]),
-      [
-        {
-          wait: `progressive`,
-          hasOnError: true,
-          steps: [
-            { kind: `demand` },
-            { kind: `hold-acceptance` },
-            { kind: `up-to-date` },
-            { kind: `error`, decision: `async-give-up` },
-            { kind: `decide` },
-            { kind: `demand` },
-            { kind: `accept` },
-          ],
-        },
-      ],
-      // While the first snapshot's acceptance is pending: a retry, then the
-      // acceptance, then a final give-up; a retry, then a give-up, then the
-      // acceptance; and an acceptance that fails, with and without an earlier
-      // external abort.
-      [
-        {
-          wait: `full-log`,
-          hasOnError: true,
-          steps: [
-            { kind: `demand` },
-            { kind: `hold-acceptance` },
-            { kind: `up-to-date` },
-            { kind: `error`, decision: `sync-retry` },
-            { kind: `accept` },
-            { kind: `error`, decision: `sync-give-up` },
-          ],
-        },
-      ],
-      [
-        {
-          wait: `full-log`,
-          hasOnError: true,
-          steps: [
-            { kind: `demand` },
-            { kind: `hold-acceptance` },
-            { kind: `up-to-date` },
-            { kind: `error`, decision: `async-retry` },
-            { kind: `decide` },
-            { kind: `client-give-up` },
-            { kind: `accept` },
-          ],
-        },
-      ],
-      ...[false, true].map((aborted): [RetryHistory] => [
-        {
-          wait: `full-log`,
-          hasOnError: true,
-          steps: [
-            { kind: `demand` },
-            { kind: `hold-acceptance` },
-            { kind: `up-to-date` },
-            ...(aborted ? [{ kind: `abort` as const }] : []),
-            { kind: `accept-fails` },
-          ],
-        },
-      ]),
-    ] satisfies Array<[RetryHistory]> as Array<[RetryHistory]>,
-  )
-
-  /**
-   * A scoped source snapshot owes applied settlement at subset-end, even
-   * when must-refetch opened a truncate replay. The independent model knows
-   * one inserted source row and no other rows; it predicts that a successful
-   * demand observes that row. This driver acquires through the real persisted
-   * wrapper before reset, delivers a subset-end without up-to-date, and checks
-   * public visibility at demand settlement. Full-mode replay's distinct
-   * up-to-date obligation is checked by neighboring laws.
-   */
-  oracleReplayTest(it)(
-    `applies a scoped reset subset before its demand succeeds`,
-    async () => {
-      let subscriber:
-        ((messages: Array<Message<OracleRow>>) => void) | undefined
-      mockSubscribe.mockImplementation((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const adapter = createPersistedAdapter(
-        new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-        new Map(),
-      )
-      // This fixture abstracts physical cache IDs because the law here concerns
-      // source settlement. The SQLite generation oracle owns physical isolation.
-      let generation = 0
-      const claim = (id: string) => ({
-        storageCollectionId: `${id}:generation-${generation}`,
-        claimId: `claim-${generation}`,
-      })
-      adapter.claimCacheGeneration = async (id) => claim(id)
-      adapter.rotateCacheGeneration = async (id) => {
-        generation++
-        return claim(id)
-      }
-      adapter.renewCacheGenerationClaim = async () => Date.now() + 60_000
-      adapter.releaseCacheGenerationClaim = async () => {}
-      const options = electricCollectionOptions<OracleRow>({
-        id: `scoped-reset-applied-settlement`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({ ...options, persistence: { adapter } }),
-      )
-      const snapshot = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
-
-      await withElectricCleanup(async () => {
-        collection.startSyncImmediate()
-        await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
-        const demand = Promise.resolve(
-          collection._sync.loadSubset({ limit: 1 }),
-        )
-        void demand.catch(() => undefined)
-        await vi.waitFor(() =>
-          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
-        )
-        subscriber!([mustRefetch])
-        subscriber!([change(`insert`, 1, `scoped replacement`), subsetEnd])
-        snapshot.resolve()
-        await atCheckpoint(demand, `scoped reset applied settlement`)
-        expect(collection.get(1)).toMatchObject({
-          id: 1,
-          name: `scoped replacement`,
-          stable: `stable-1`,
-        })
-      }, [() => snapshot.resolve(), () => collection.cleanup()])
-    },
-  )
-
-  // Initial failure rejects all current waiters with the original error.
-  // Cleanup quietly settles adapter loads and invalidates later callbacks.
-  // A provider error alone does not make its future callbacks obsolete;
-  // retry semantics are checked by the neighboring recovery laws.
-  oracleReplayTest(it).each([`failure`, `cleanup`] as const)(
-    `full recovery retires concurrent demand on %s`,
-    async (terminal) => {
-      const loggedError = vi
-        .spyOn(console, `error`)
-        .mockImplementation(() => {})
-      const trace = createOracleCollection(
-        `full-recovery-${terminal}`,
-        `on-demand`,
-        createMetadata(
-          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-        ).api,
-      )
-      const sentinel = new Error(`initial full sync failed`)
-      const outcomes = [1, 2].map((limit) =>
-        Promise.resolve(trace.collection._sync.loadSubset({ limit })).then(
-          () => ({ kind: `fulfilled` as const }),
-          (error: unknown) => ({ kind: `rejected` as const, error }),
-        ),
-      )
-      await withElectricCleanup(async () => {
-        if (terminal === `failure`) {
-          const options = vi.mocked(ShapeStream).mock.calls.at(-1)?.[0] as
-            | {
-                onError?: (error: unknown) => void
-              }
-            | undefined
-          expect(options?.onError).toBeTypeOf(`function`)
-          options?.onError?.(sentinel)
-        } else await trace.collection.cleanup()
-        const results = await atCheckpoint(
-          Promise.all(outcomes),
-          `terminal full recovery settlement`,
-        )
-        if (terminal === `failure`) {
-          expect(results).toEqual([
-            { kind: `rejected`, error: sentinel },
-            { kind: `rejected`, error: sentinel },
-          ])
-          expect(trace.collection.status).toBe(`error`)
-        } else {
-          expect(results).toEqual([
-            { kind: `fulfilled` },
-            { kind: `fulfilled` },
-          ])
-          expect(trace.collection.status).toBe(`cleaned-up`)
-          trace.subscriber([change(`insert`, 1, `abandoned`), upToDate])
-          expect(trace.collection.has(1)).toBe(false)
-        }
-      }, [() => trace.collection.cleanup(), () => loggedError.mockRestore()])
-    },
-  )
-
-  // Each demand owns its cancellation even while full-log source evidence is
-  // shared. Aborting one demand ends that load before up-to-date; its sibling
-  // and a replacement of the canceled demand still wait for the source
-  // snapshot and succeed after the row applies.
-  oracleReplayTest(it)(
-    `cancels one full recovery demand without settling its sibling`,
-    async () => {
-      const trace = createOracleCollection(
-        `full-recovery-one-abort`,
-        `on-demand`,
-        createMetadata(
-          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-        ).api,
-      )
-      const controller = new AbortController()
-      const canceled = Promise.resolve(
-        trace.collection._sync.loadSubset({
-          limit: 1,
-          signal: controller.signal,
-        }),
-      )
-      void canceled.catch(() => undefined)
-      let siblingOutcome = `pending`
-      const sibling = Promise.resolve(
-        trace.collection._sync.loadSubset({ limit: 2 }),
-      ).then(
-        () => {
-          siblingOutcome = `fulfilled`
-        },
-        () => {
-          siblingOutcome = `rejected`
-        },
-      )
-
-      await withElectricCleanup(async () => {
-        controller.abort()
-        await expect(
-          atCheckpoint(canceled, `canceled full recovery demand`),
-        ).rejects.toMatchObject({ name: `AbortError` })
-        expect(siblingOutcome).toBe(`pending`)
-
-        // Cancellation cannot mark this predicate complete or poison a later
-        // acquisition of the same demand key.
-        const replacement = Promise.resolve(
-          trace.collection._sync.loadSubset({ limit: 1 }),
-        )
-        let replacementOutcome = `pending`
-        const observedReplacement = replacement.then(
-          () => {
-            replacementOutcome = `fulfilled`
-          },
-          () => {
-            replacementOutcome = `rejected`
-          },
-        )
-        await Promise.resolve()
-        expect(replacementOutcome).toBe(`pending`)
-
-        trace.subscriber([change(`insert`, 1, `source row`), upToDate])
-        await atCheckpoint(
-          Promise.all([sibling, observedReplacement]),
-          `remaining full recovery demands`,
-        )
-        expect(siblingOutcome).toBe(`fulfilled`)
-        expect(replacementOutcome).toBe(`fulfilled`)
-        expect(trace.collection.get(1)).toMatchObject({ name: `source row` })
-      }, [() => trace.collection.cleanup()])
-    },
-  )
-
-  // An external ShapeStream abort is a provider failure, not Collection
-  // cleanup. It cannot fulfill an in-flight demand or certify its key as
-  // loaded when no source snapshot arrived. A second identical demand must
-  // therefore remain a failing acquisition rather than deduplicated success.
-  oracleReplayTest(it)(
-    `does not certify a full recovery demand after external stream abort`,
-    async () => {
-      const external = new AbortController()
-      const trace = createOracleCollection(
-        `full-recovery-external-abort`,
-        `on-demand`,
-        createMetadata(
-          new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-        ).api,
-        { signal: external.signal },
-      )
-      const first = Promise.resolve(
-        trace.collection._sync.loadSubset({ limit: 1 }),
-      )
-      void first.catch(() => undefined)
-
-      await withElectricCleanup(async () => {
-        external.abort()
-        await expect(
-          atCheckpoint(first, `externally aborted full recovery demand`),
-        ).rejects.toMatchObject({ name: `StreamAbortedError` })
-        const second = trace.collection._sync.loadSubset({ limit: 1 })
-        expect(second).not.toBe(true)
-        await expect(Promise.resolve(second)).rejects.toMatchObject({
-          name: `AbortError`,
-        })
-        expect(trace.collection.size).toBe(0)
-      }, [() => trace.collection.cleanup()])
-    },
-  )
-
-  // A subset transport may return after the shared stream retires. Its
-  // messages cannot apply to that lifecycle, so transport settlement alone
-  // cannot certify the demand or its deduplication key.
-  oracleReplayTest(it)(
-    `does not certify a subset snapshot after external stream abort`,
-    async () => {
-      const external = new AbortController()
-      const trace = createOracleCollection(
-        `subset-external-abort`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-        { signal: external.signal },
-      )
-      const snapshot = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
-      const first = Promise.resolve(
-        trace.collection._sync.loadSubset({ limit: 1 }),
-      )
-      void first.catch(() => undefined)
-
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() =>
-          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
-        )
-        external.abort()
-        snapshot.resolve()
-        await expect(
-          atCheckpoint(first, `externally aborted subset snapshot`),
-        ).rejects.toMatchObject({ name: `AbortError` })
-        const second = trace.collection._sync.loadSubset({ limit: 1 })
-        expect(second).not.toBe(true)
-        await expect(Promise.resolve(second)).rejects.toMatchObject({
-          name: `AbortError`,
-        })
-        expect(trace.collection.size).toBe(0)
-      }, [() => snapshot.resolve(), () => trace.collection.cleanup()])
-    },
-  )
-
-  // Even a completed transport cannot certify a demand while its accepted
-  // source commit is waiting for application. Retiring the stream during that
-  // wait leaves no visible source row, so the demand must fail when the held
-  // applied receipt finally settles.
-  oracleReplayTest(it)(
-    `does not certify an externally aborted subset during applied settlement`,
-    async () => {
-      const external = new AbortController()
-      const trace = createOracleCollection(
-        `subset-held-external-abort`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-        { signal: external.signal },
-      )
-      const persistence = createDeferred<void>()
-      const transaction = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-      transaction.mutate(() =>
-        trace.collection.insert({
-          id: 99,
-          name: `optimistic`,
-          stable: `stable-99`,
-        }),
-      )
-      const snapshot = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
-      const first = Promise.resolve(
-        trace.collection._sync.loadSubset({ limit: 1 }),
-      )
-      void first.catch(() => undefined)
-
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() =>
-          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
-        )
-        trace.subscriber([change(`insert`, 1, `source row`), subsetEnd])
-        snapshot.resolve()
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-        expect(trace.collection.has(1), `applied receipt is held`).toBe(false)
-        external.abort()
-        persistence.resolve()
-        await transaction.isPersisted.promise
-        await expect(
-          atCheckpoint(first, `externally aborted held subset`),
-        ).rejects.toMatchObject({ name: `AbortError` })
-        const second = trace.collection._sync.loadSubset({ limit: 1 })
-        expect(second).not.toBe(true)
-        await expect(Promise.resolve(second)).rejects.toMatchObject({
-          name: `AbortError`,
-        })
-        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce()
-      }, [
-        () => snapshot.resolve(),
-        () => persistence.resolve(),
-        () => trace.collection.cleanup(),
-      ])
-    },
-  )
-
-  // Application can outlive the SDK request. A caller that releases its
-  // demand during that interval must reject promptly, while the source
-  // receipt remains held and a later acquisition can still wait for it.
-  oracleReplayTest(it)(
-    `cancels a subset demand while its source receipt is held`,
-    async () => {
-      const trace = createOracleCollection(
-        `subset-held-demand-abort`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-      )
-      const persistence = createDeferred<void>()
-      const transaction = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-      transaction.mutate(() =>
-        trace.collection.insert({
-          id: 99,
-          name: `optimistic`,
-          stable: `stable-99`,
-        }),
-      )
-      const snapshot = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
-      const controller = new AbortController()
-      const first = Promise.resolve(
-        trace.collection._sync.loadSubset({
-          limit: 1,
-          signal: controller.signal,
-        }),
-      )
-      let firstOutcome: `pending` | `fulfilled` | `rejected` = `pending`
-      let firstError: unknown
-      const observedFirst = first.then(
-        () => {
-          firstOutcome = `fulfilled`
-        },
-        (error: unknown) => {
-          firstOutcome = `rejected`
-          firstError = error
-        },
-      )
-
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() =>
-          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
-        )
-        trace.subscriber([change(`insert`, 1, `source row`), subsetEnd])
-        snapshot.resolve()
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-        expect(trace.collection.has(1)).toBe(false)
-        controller.abort()
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-        expect(firstOutcome).toBe(`rejected`)
-        expect(firstError).toMatchObject({ name: `AbortError` })
-        persistence.resolve()
-        await transaction.isPersisted.promise
-        await observedFirst
-        expect(trace.collection.has(1)).toBe(true)
-      }, [
-        () => snapshot.resolve(),
-        () => persistence.resolve(),
-        () => trace.collection.cleanup(),
-      ])
-    },
-  )
-
-  // A demand canceled before its subset transport settles has no successful
-  // acquisition, whether that transport later resolves or rejects. The source
-  // may still apply a late SDK response, but this caller observes AbortError and
-  // an identical later demand remains eligible for a new acquisition.
-  oracleReplayTest(it).each([`resolve`, `reject`] as const)(
-    `rejects a canceled subset demand when its transport later %ss`,
-    async (transportOutcome) => {
-      const trace = createOracleCollection(
-        `subset-demand-abort-${transportOutcome}`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-      )
-      const controller = new AbortController()
-      const snapshot = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
-      const first = Promise.resolve(
-        trace.collection._sync.loadSubset({
-          limit: 1,
-          signal: controller.signal,
-        }),
-      )
-      void first.catch(() => undefined)
-
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() =>
-          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
-        )
-        controller.abort()
-        if (transportOutcome === `resolve`) snapshot.resolve()
-        else snapshot.reject(new Error(`late provider failure`))
-        await expect(
-          atCheckpoint(first, `canceled subset ${transportOutcome}`),
-        ).rejects.toMatchObject({ name: `AbortError` })
-        const second = trace.collection._sync.loadSubset({ limit: 1 })
-        expect(second).not.toBe(true)
-        await expect(
-          atCheckpoint(
-            Promise.resolve(second).then(() => undefined),
-            `fresh subset after ${transportOutcome} and caller abort`,
-          ),
-        ).resolves.toBeUndefined()
-        expect(mockStream.requestSnapshot).toHaveBeenCalledTimes(2)
-      }, [() => snapshot.resolve(), () => trace.collection.cleanup()])
-    },
-  )
-
-  // Snapshot responses share one SDK cursor, but a queued demand owns its
-  // cancellation independently of the request ahead of it. At the next task
-  // boundary after abort, this caller must have rejected without invoking a
-  // second SDK request; the first demand remains pending until its response.
-  oracleReplayTest(it)(
-    `cancels a queued subset demand while an earlier snapshot is held`,
-    async () => {
-      const trace = createOracleCollection(
-        `queued-subset-abort`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-      )
-      const held = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(held.promise)
-      const first = Promise.resolve(
-        trace.collection._sync.loadSubset({ limit: 1 }),
-      )
-      const controller = new AbortController()
-      let secondOutcome: `pending` | `fulfilled` | `rejected` = `pending`
-      let secondError: unknown
-      const second = Promise.resolve(
-        trace.collection._sync.loadSubset({
-          limit: 2,
-          signal: controller.signal,
-        }),
-      ).then(
-        () => {
-          secondOutcome = `fulfilled`
+          wait: `full-log`,
+          hasOnError,
+          steps: [
+            { kind: `demand` },
+            { kind: `hold-acceptance` },
+            { kind: `up-to-date` },
+            giveUp,
+            { kind: `accept` },
+          ],
         },
-        (error: unknown) => {
-          secondOutcome = `rejected`
-          secondError = error
+      ]),
+      [
+        {
+          wait: `progressive`,
+          hasOnError: true,
+          steps: [
+            { kind: `demand` },
+            { kind: `hold-acceptance` },
+            { kind: `up-to-date` },
+            { kind: `error`, decision: `async-give-up` },
+            { kind: `decide` },
+            { kind: `demand` },
+            { kind: `accept` },
+          ],
         },
-      )
-
-      await withElectricCleanup(async () => {
-        await vi.waitFor(() =>
-          expect(mockStream.requestSnapshot).toHaveBeenCalledOnce(),
-        )
-        controller.abort()
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-        expect(secondOutcome).toBe(`rejected`)
-        expect(secondError).toMatchObject({ name: `AbortError` })
-        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce()
-        held.resolve()
-        await atCheckpoint(Promise.all([first, second]), `queued abort drain`)
-      }, [() => held.resolve(), () => trace.collection.cleanup()])
-    },
-  )
-
-  oracleReplayTest(it)(
-    `drops a held receipt's rows when cleanup abandons it`,
-    async () => {
-      const metadata = createMetadata(new Map())
-      const trace = createOracleCollection(
-        `rejected-applied-receipt`,
-        `eager`,
-        metadata.api,
-      )
-      const persistence = createDeferred<void>()
-      const transaction = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-      transaction.mutate(() =>
-        trace.collection.insert({
-          id: 99,
-          name: `optimistic`,
-          stable: `stable-99`,
-        }),
-      )
-      trace.subscriber([change(`insert`, 1, `synced`), upToDate])
-      await Promise.resolve()
-      expect(trace.collection.status).toBe(`ready`)
-
-      await trace.collection.cleanup()
-      persistence.resolve()
-      await transaction.isPersisted.promise
-      await Promise.resolve()
-
-      expect(trace.collection.status).toBe(`cleaned-up`)
-      expect(trace.collection._lifecycle.getSyncError()).toBeUndefined()
-      expect(trace.collection.has(1)).toBe(false)
-    },
-  )
-
-  oracleReplayTest(it)(
-    `accepts partial resumed updates for rows restored by persistence`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const collectionMetadata = new Map(resumeState())
-      const persistedRows = new Map<string | number, OracleRow>([
-        [
-          1,
-          {
-            id: 1,
-            name: `persisted`,
-            stable: `stable-1`,
-          },
-        ],
-      ])
-      const electricOptions = electricCollectionOptions<OracleRow>({
-        id: `persisted-resume-oracle`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
+      ],
+      // While the first snapshot's acceptance is pending: a retry, then the
+      // acceptance, then a final give-up; a retry, then a give-up, then the
+      // acceptance; and an acceptance that fails, with and without an earlier
+      // external abort.
+      [
+        {
+          wait: `full-log`,
+          hasOnError: true,
+          steps: [
+            { kind: `demand` },
+            { kind: `hold-acceptance` },
+            { kind: `up-to-date` },
+            { kind: `error`, decision: `sync-retry` },
+            { kind: `accept` },
+            { kind: `error`, decision: `sync-give-up` },
+          ],
         },
-        syncMode: `progressive`,
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricOptions,
-          persistence: {
-            adapter: createPersistedAdapter(collectionMetadata, persistedRows),
-          },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await collection._sync.loadSubset({ limit: 10 })
-      expect(collection.get(1)).toEqual(
-        expect.objectContaining({ name: `persisted`, stable: `stable-1` }),
-      )
-      expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
-        offset: `10_0`,
-        handle: `shape-1`,
-      })
-
-      subscriber([change(`update`, 1, `resumed update`), upToDate])
-      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
-
-      expect(collection.get(1)).toEqual(
-        expect.objectContaining({
-          name: `resumed update`,
-          stable: `stable-1`,
-        }),
-      )
-      await vi.waitFor(() => {
-        expect(persistedRows.get(1)).toEqual(
-          expect.objectContaining({
-            name: `resumed update`,
-            stable: `stable-1`,
-          }),
-        )
-      })
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `buffers resumed updates that arrive while persisted rows are hydrating`,
-    async () => {
-      let subscriber:
-        ((messages: Array<Message<OracleRow>>) => void) | undefined
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const hydration = createDeferred<void>()
-      const collectionMetadata = new Map(resumeState())
-      const persistedRows = new Map<string | number, OracleRow>([
-        [
-          1,
-          {
-            id: 1,
-            name: `persisted`,
-            stable: `stable-1`,
-          },
-        ],
-      ])
-      const electricOptions = electricCollectionOptions<OracleRow>({
-        id: `concurrent-persisted-resume-oracle`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
+      ],
+      [
+        {
+          wait: `full-log`,
+          hasOnError: true,
+          steps: [
+            { kind: `demand` },
+            { kind: `hold-acceptance` },
+            { kind: `up-to-date` },
+            { kind: `error`, decision: `async-retry` },
+            { kind: `decide` },
+            { kind: `client-give-up` },
+            { kind: `accept` },
+          ],
         },
-        syncMode: `progressive`,
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricOptions,
-          persistence: {
-            adapter: createPersistedAdapter(
-              collectionMetadata,
-              persistedRows,
-              hydration.promise,
-            ),
-          },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
-      expect(collection.status).not.toBe(`error`)
-      subscriber!([change(`update`, 1, `concurrent update`), upToDate])
-
-      expect(collection.status).not.toBe(`error`)
-      hydration.resolve()
-      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
-      expect(collection.get(1)).toEqual(
-        expect.objectContaining({
-          name: `concurrent update`,
-          stable: `stable-1`,
-        }),
-      )
-      await collection.cleanup()
-    },
+      ],
+      ...[false, true].map((aborted): [RetryHistory] => [
+        {
+          wait: `full-log`,
+          hasOnError: true,
+          steps: [
+            { kind: `demand` },
+            { kind: `hold-acceptance` },
+            { kind: `up-to-date` },
+            ...(aborted ? [{ kind: `abort` as const }] : []),
+            { kind: `accept-fails` },
+          ],
+        },
+      ]),
+    ] satisfies Array<[RetryHistory]> as Array<[RetryHistory]>,
   )
 
   oracleReplayTest(it)(
@@ -6647,277 +4176,43 @@ describe(`Electric adapter laws`, () => {
     [durablePrefixArbitrary],
     durablePrefixPropertyOptions(`random`),
   )(
-    `a rejected initial Electric row commit creates no durable source prefix (random)`,
-    checkDurablePrefix,
-  )
-
-  oracleReplayTest(fcTest).prop(
-    [
-      fc.uniqueArray(fc.integer({ min: 1, max: 20 }), {
-        minLength: 2,
-        maxLength: 6,
-      }),
-    ],
-    { numRuns: 20, seed: 20260922 },
-  )(`append-only resume judgment rejects a missing committed row`, (ids) => {
-    const events: Array<SourceLedgerEvent> = ids.map((id) => ({
-      type: `source-commit`,
-      offset: `${id}_0`,
-      mutations: [
-        {
-          type: `set`,
-          row: { id, name: `row-${id}`, stable: `stable-${id}` },
-        },
-      ],
-    }))
-    const expected = rowsFromMap(
-      foldSourceLedgerThrough(events, events.at(-1)!.offset),
-    )
-    // An intermediate durable checkpoint contains exactly its source prefix.
-    const prefix = rowsFromMap(
-      foldSourceLedgerThrough(events, events[0]!.offset),
-    )
-    expect(prefix).toEqual(expected.filter(([key]) => key === ids[0]))
-    // An offset outside the append-only ledger cannot justify resume state.
-    expect(() => foldSourceLedgerThrough(events, `absent_0`)).toThrow(
-      /absent from source ledger/,
-    )
-  })
-
-  oracleReplayTest(it)(
-    `rehydrates persisted rows and resume metadata after cleanup and restart`,
-    async () => {
-      const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> =
-        []
-      mockSubscribe.mockImplementation((callback) => {
-        subscribers.push(callback)
-        return vi.fn()
-      })
-      const collectionMetadata = new Map(resumeState())
-      const persistedRows = new Map<string | number, OracleRow>([
-        [1, { id: 1, name: `persisted`, stable: `stable-1` }],
-      ])
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `persisted-restart-oracle`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            syncMode: `progressive`,
-            getKey: (row) => row.id,
-            startSync: true,
-          }),
-          persistence: {
-            adapter: createPersistedAdapter(collectionMetadata, persistedRows),
-          },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`persisted`))
-      await vi.waitFor(() => expect(subscribers).toHaveLength(1))
-      subscribers[0]!([upToDate])
-      await collection.stateWhenReady()
-
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(subscribers).toHaveLength(2))
-      await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`persisted`))
-      expect(collectionMetadata.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `resume` }),
-      )
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `does not let hydration from a cleaned-up lifecycle poison restart`,
-    async () => {
-      const subscribers: Array<(messages: Array<Message<OracleRow>>) => void> =
-        []
-      mockSubscribe.mockImplementation((callback) => {
-        subscribers.push(callback)
-        return vi.fn()
-      })
-      const firstHydration = createDeferred<void>()
-      const collectionMetadata = new Map(resumeState())
-      const persistedRows = new Map<string | number, OracleRow>([
-        [1, { id: 1, name: `current`, stable: `stable-1` }],
-      ])
-      const adapter = createPersistedAdapter(collectionMetadata, persistedRows)
-      const loadResumeSnapshot = adapter.loadResumeSnapshot
-      let hydrationCall = 0
-      adapter.loadResumeSnapshot = vi.fn(async (collectionId, ctx) => {
-        const snapshot = await loadResumeSnapshot(collectionId, ctx)
-        if (ctx?.includeRows === false) return snapshot
-        hydrationCall++
-        if (hydrationCall === 1) {
-          await firstHydration.promise
-          return {
-            ...snapshot,
-            rows: [
-              {
-                key: 1,
-                value: { id: 1, name: `stale`, stable: `stable-1` },
-              },
-            ],
-          }
-        }
-        return snapshot
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `persisted-stale-hydration-oracle`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            syncMode: `progressive`,
-            getKey: (row) => row.id,
-            startSync: true,
-          }),
-          persistence: { adapter },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(hydrationCall).toBe(1))
-      await collection.cleanup()
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(subscribers).toHaveLength(2))
-
-      firstHydration.resolve()
-      await vi.waitFor(() => expect(hydrationCall).toBe(2))
-      await vi.waitFor(() => expect(collection.get(1)?.name).toBe(`current`))
-      subscribers[1]!([upToDate])
-      await collection.stateWhenReady()
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `does not hydrate persisted on-demand rows before subset demand`,
-    async () => {
-      let subscriber:
-        ((messages: Array<Message<OracleRow>>) => void) | undefined
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const collectionMetadata = new Map<string, unknown>()
-      const persistedRows = new Map<string | number, OracleRow>([
-        [1, { id: 1, name: `persisted`, stable: `stable-1` }],
-      ])
-      const adapter = createPersistedAdapter(collectionMetadata, persistedRows)
-      const loadSubset = vi.fn(adapter.loadSubset)
-      adapter.loadSubset = loadSubset
-      const electricOptions = electricCollectionOptions<OracleRow>({
-        id: `persisted-on-demand-oracle`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        syncMode: `on-demand`,
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricOptions,
-          persistence: { adapter },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
-      subscriber!([upToDate])
-      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
-
-      expect(loadSubset).not.toHaveBeenCalled()
-      expect(collection.has(1)).toBe(false)
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it).each(
-    [`reset`, `delete`, `move-out`].flatMap((removal) =>
-      [`none`, `before-commit`, `after-commit`].map((acquire) => ({
-        removal,
-        acquire,
-      })),
-    ),
-  )(
-    `keeps removed rows unknown across $removal and subset acquisition $acquire`,
-    async ({ removal, acquire }) => {
-      const trace = createOracleCollection(
-        `presence-${removal}-${acquire}`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-      )
-      const snapshot = createDeferred<void>()
-      mockStream.requestSnapshot.mockReturnValueOnce(snapshot.promise)
-      let acquired: Promise<unknown> | undefined
-      const request = () => {
-        acquired = Promise.resolve(
-          trace.collection._sync.loadSubset({
-            where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(2)]),
-          }),
-        )
-        expect(mockStream.requestSnapshot).toHaveBeenCalledOnce()
-      }
-      try {
-        const inserted = change(`insert`, 1, `complete`)
-        trace.subscriber([
-          { ...inserted, headers: { ...inserted.headers, tags: [`left`] } },
-          upToDate,
-        ])
-        expect(trace.collection.get(1)?.stable).toBe(`stable-1`)
-        const removed: Message<OracleRow> =
-          removal === `reset`
-            ? mustRefetch
-            : removal === `delete`
-              ? change(`delete`, 1, `complete`)
-              : ({
-                  headers: {
-                    event: `move-out`,
-                    patterns: [{ pos: 0, value: `left` }],
-                  },
-                } as Message<OracleRow>)
-        trace.subscriber([removed])
-        if (acquire === `before-commit`) request()
-        trace.subscriber([subsetEnd])
-        expect(trace.collection.has(1)).toBe(false)
-        if (acquire === `after-commit`) request()
-        snapshot.resolve()
-        await acquired
-        trace.subscriber([change(`update`, 1, `partial`), upToDate])
-        expect(trace.collection.has(1)).toBe(false)
-      } finally {
-        snapshot.resolve()
-        await trace.collection.cleanup()
-        await acquired
-      }
-    },
+    `a rejected initial Electric row commit creates no durable source prefix (random)`,
+    checkDurablePrefix,
   )
 
+  oracleReplayTest(fcTest).prop(
+    [
+      fc.uniqueArray(fc.integer({ min: 1, max: 20 }), {
+        minLength: 2,
+        maxLength: 6,
+      }),
+    ],
+    { numRuns: 20, seed: 20260922 },
+  )(`append-only resume judgment rejects a missing committed row`, (ids) => {
+    const events: Array<SourceLedgerEvent> = ids.map((id) => ({
+      type: `source-commit`,
+      offset: `${id}_0`,
+      mutations: [
+        {
+          type: `set`,
+          row: { id, name: `row-${id}`, stable: `stable-${id}` },
+        },
+      ],
+    }))
+    const expected = rowsFromMap(
+      foldSourceLedgerThrough(events, events.at(-1)!.offset),
+    )
+    // An intermediate durable checkpoint contains exactly its source prefix.
+    const prefix = rowsFromMap(
+      foldSourceLedgerThrough(events, events[0]!.offset),
+    )
+    expect(prefix).toEqual(expected.filter(([key]) => key === ids[0]))
+    // An offset outside the append-only ledger cannot justify resume state.
+    expect(() => foldSourceLedgerThrough(events, `absent_0`)).toThrow(
+      /absent from source ledger/,
+    )
+  })
+
   electricHistoryProperty(
     `electric.subset-request-row-validity`,
     `subset request invocation preserves row validity through generated stream histories without response delivery`,
@@ -7009,220 +4304,6 @@ describe(`Electric adapter laws`, () => {
     ],
   )
 
-  oracleReplayTest(it)(
-    `applies on-demand catch-up updates to hydrated persisted rows`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const collectionMetadata = new Map(resumeState())
-      const persistedRows = new Map<string | number, OracleRow>([
-        [1, { id: 1, name: `persisted`, stable: `stable-1` }],
-      ])
-      const collection = createCollection(
-        persistedCollectionOptions<
-          OracleRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<OracleRow>
-        >({
-          ...electricCollectionOptions<OracleRow>({
-            id: `on-demand-persisted-catch-up`,
-            shapeOptions: {
-              url: `http://test-url`,
-              params: { table: `test_table` },
-            },
-            syncMode: `on-demand`,
-            getKey: (row) => row.id,
-            startSync: true,
-          }),
-          persistence: {
-            adapter: createPersistedAdapter(collectionMetadata, persistedRows),
-          },
-        }),
-      )
-
-      collection.startSyncImmediate()
-      await vi.waitFor(() => expect(subscriber).toBeTypeOf(`function`))
-      await collection._sync.loadSubset({})
-      subscriber([change(`update`, 1, `caught up`), upToDate])
-      await vi.waitFor(() => expect(collection.status).toBe(`ready`))
-
-      expect(collection.get(1)).toEqual(
-        expect.objectContaining({ name: `caught up`, stable: `stable-1` }),
-      )
-      expect(collectionMetadata.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `resume`, offset: `20_0` }),
-      )
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it).each([
-    {
-      name: `malformed`,
-      seed: new Map<string, unknown>([
-        [
-          `electric:resume`,
-          {
-            kind: `resume`,
-            requiresTagState: false,
-            offset: 10,
-            handle: `shape-1`,
-            shapeId,
-            updatedAt: 1,
-          },
-        ],
-      ]),
-    },
-    {
-      name: `reset`,
-      seed: new Map<string, unknown>([
-        [`electric:resume`, { kind: `reset`, updatedAt: 1 }],
-      ]),
-    },
-    {
-      name: `incompatible`,
-      seed: new Map<string, unknown>([
-        [
-          `electric:resume`,
-          {
-            kind: `resume`,
-            requiresTagState: false,
-            offset: `10_0`,
-            handle: `shape-1`,
-            shapeId: `different-shape`,
-            updatedAt: 1,
-          },
-        ],
-      ]),
-    },
-  ])(`starts a full snapshot for $name resume metadata`, async ({ seed }) => {
-    const metadata = createMetadata(seed)
-    const trace = createOracleCollection(
-      `non-resumable-metadata`,
-      `eager`,
-      metadata.api,
-    )
-
-    expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
-      offset: undefined,
-      handle: undefined,
-    })
-    trace.subscriber([change(`insert`, 1, `full snapshot`), upToDate])
-
-    expect(trace.collection.status).toBe(`ready`)
-    expect(trace.collection.get(1)).toEqual(
-      expect.objectContaining({ stable: `stable-1` }),
-    )
-    expect(metadata.state.get(`electric:resume`)).toEqual(
-      expect.objectContaining({ kind: `resume`, offset: `20_0` }),
-    )
-    await trace.collection.cleanup()
-  })
-
-  oracleReplayTest(it)(
-    `does not mix an explicit resume option with persisted metadata`,
-    async () => {
-      const metadata = createMetadata(resumeState())
-      const trace = createOracleCollection(
-        `explicit-resume`,
-        `on-demand`,
-        metadata.api,
-        { handle: `explicit-handle` },
-      )
-
-      expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
-        offset: `now`,
-        handle: `explicit-handle`,
-      })
-      trace.subscriber([upToDate])
-      expect(trace.collection.status).toBe(`ready`)
-      await trace.collection.cleanup()
-    },
-  )
-
-  // An explicit source cursor owns this run's resume decision. A malformed
-  // durable record is still invalid for a later implicit run, but it cannot
-  // authorize this run to write a reset before any source evidence arrives.
-  // The metadata Map observes that side effect at startup, before up-to-date
-  // can legitimately stage a fresh resume record.
-  oracleReplayTest(it).each([
-    { name: `offset`, options: { offset: `10_0` as Offset } },
-    { name: `handle`, options: { handle: `explicit-handle` } },
-  ])(
-    `leaves malformed durable resume untouched with explicit $name`,
-    async ({ options }) => {
-      const malformed = { kind: `resume`, offset: 10, handle: `stale` }
-      const metadata = createMetadata(new Map([[`electric:resume`, malformed]]))
-      const trace = createOracleCollection(
-        `explicit-malformed-${options}`,
-        `on-demand`,
-        metadata.api,
-        options,
-      )
-      try {
-        expect(metadata.state.get(`electric:resume`)).toBe(malformed)
-      } finally {
-        await trace.collection.cleanup()
-      }
-    },
-  )
-
-  oracleReplayTest(it)(
-    `lets an equal-timestamp reset dominate a stale hydrated resume`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const options = electricCollectionOptions<OracleRow>({
-        id: `equal-timestamp-reset`,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-        startSync: true,
-      })
-      options.sync.importSyncMeta?.({
-        version: 1,
-        resume: {
-          kind: `resume`,
-          requiresTagState: false,
-          offset: `10_0`,
-          handle: `stale-handle`,
-          shapeId,
-          updatedAt: 1,
-        },
-        seenTxids: [],
-      })
-      const originalSync = options.sync
-      const metadata = createMetadata(
-        new Map([[`electric:resume`, { kind: `reset`, updatedAt: 1 }]]),
-      )
-      const collection = createCollection({
-        ...options,
-        sync: {
-          ...originalSync,
-          sync: (params: Parameters<typeof originalSync.sync>[0]) =>
-            originalSync.sync({ ...params, metadata: metadata.api }),
-        },
-      })
-
-      expect(vi.mocked(ShapeStream).mock.calls.at(-1)?.[0]).toMatchObject({
-        offset: undefined,
-        handle: undefined,
-      })
-      subscriber([change(`insert`, 1, `full snapshot`), upToDate])
-      expect(collection.status).toBe(`ready`)
-      await collection.cleanup()
-    },
-  )
-
   electricHistoryProperty(
     `electric.resume-metadata-merge`,
     `resume metadata merge is commutative and reset-safe on timestamp ties`,
@@ -7460,194 +4541,6 @@ describe(`Electric adapter laws`, () => {
     ],
   )
 
-  oracleReplayTest(it)(
-    `retains the selected tag requirement when timestamps establish an order`,
-    () => {
-      const merge = electricCollectionOptions<OracleRow>({
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        getKey: (row) => row.id,
-      }).sync.mergeSyncMeta!
-      for (const olderTag of [undefined, false, true]) {
-        for (const newerTag of [undefined, false, true]) {
-          const state = (updatedAt: number, tag: boolean | undefined) => ({
-            version: 1,
-            seenTxids: [updatedAt],
-            resume: {
-              kind: `resume`,
-              offset: `10_0`,
-              handle: `shape-1`,
-              shapeId,
-              updatedAt,
-              ...(tag === undefined ? {} : { requiresTagState: tag }),
-            },
-          })
-          const older = state(1, olderTag)
-          const newer = state(2, newerTag)
-          const expected = { ...newer, seenTxids: [1, 2] }
-          expect(merge(older, newer)).toEqual(expected)
-          expect(merge(newer, older)).toEqual(expected)
-        }
-      }
-    },
-  )
-
-  oracleReplayTest(it)(
-    `rejects an unseen partial update from an explicit eager resume`,
-    async () => {
-      const metadata = createMetadata(resumeState())
-      const trace = createOracleCollection(
-        `explicit-eager-resume`,
-        `eager`,
-        metadata.api,
-        { offset: `10_0` as Offset, handle: `explicit-handle` },
-      )
-
-      trace.subscriber([change(`update`, 1, `partial`), upToDate])
-
-      expect(trace.collection.status).toBe(`error`)
-      expect(trace.collection.has(1)).toBe(false)
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `reset` }),
-      )
-      await trace.collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `accepts complete replica updates from an explicit eager resume`,
-    async () => {
-      let subscriber!: (messages: Array<Message<OracleRow>>) => void
-      mockSubscribe.mockImplementationOnce((callback) => {
-        subscriber = callback
-        return vi.fn()
-      })
-      const collection = createCollection(
-        electricCollectionOptions<OracleRow>({
-          id: `explicit-full-replica-resume`,
-          shapeOptions: {
-            url: `http://test-url`,
-            params: { table: `test_table`, replica: `full` },
-            offset: `10_0` as Offset,
-            handle: `explicit-handle`,
-          },
-          syncMode: `eager`,
-          getKey: (row) => row.id,
-          startSync: true,
-        }),
-      )
-
-      subscriber([
-        {
-          key: `1`,
-          value: { id: 1, name: `complete update`, stable: `stable-1` },
-          headers: { operation: `update` },
-        },
-        upToDate,
-      ])
-
-      expect(collection.status).toBe(`ready`)
-      expect(collection.get(1)).toEqual(
-        expect.objectContaining({
-          name: `complete update`,
-          stable: `stable-1`,
-        }),
-      )
-      await collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it).each([10, 100])(
-    `subset acquisition avoids scanning the applied baseline with %s rows`,
-    async (size) => {
-      const trace = createOracleCollection(
-        `acquisition-work`,
-        `on-demand`,
-        createMetadata(new Map()).api,
-      )
-      try {
-        trace.subscriber([
-          ...Array.from({ length: size }, (_, id) =>
-            change(`insert`, id, `row`),
-          ),
-          upToDate,
-        ])
-        await trace.collection._sync.loadSubset({})
-        const keys = vi.spyOn(trace.collection._state.syncedData, `keys`)
-        try {
-          for (let i = 0; i < 3; i++)
-            await trace.collection._sync.loadSubset({})
-          expect(keys).not.toHaveBeenCalled()
-          for (let i = 0; i < 3; i++)
-            await trace.collection._sync.loadSubset({
-              where: new IR.Func(`eq`, [
-                new IR.PropRef([`id`]),
-                new IR.Value(size + i),
-              ]),
-            })
-          expect(keys).not.toHaveBeenCalled()
-          expect(mockStream.requestSnapshot).toHaveBeenCalledTimes(4)
-        } finally {
-          keys.mockRestore()
-        }
-      } finally {
-        await trace.collection.cleanup()
-      }
-    },
-  )
-
-  oracleReplayTest(it)(
-    `ignores an unseen on-demand update without blocking readiness`,
-    async () => {
-      const metadata = createMetadata(resumeState())
-      const trace = createOracleCollection(
-        `on-demand-unseen-update`,
-        `on-demand`,
-        metadata.api,
-      )
-
-      trace.subscriber([change(`update`, 1, `partial`), upToDate])
-
-      expect(trace.collection.status).toBe(`ready`)
-      expect(trace.collection.has(1)).toBe(false)
-      expect(metadata.state.get(`electric:resume`)).toEqual(
-        expect.objectContaining({ kind: `resume`, offset: `20_0` }),
-      )
-      await trace.collection.cleanup()
-    },
-  )
-
-  oracleReplayTest(it)(
-    `records match and txid evidence for an ignored on-demand update`,
-    async () => {
-      const trace = createOracleCollection(
-        `on-demand-ignored-update-evidence`,
-        `on-demand`,
-        createMetadata(resumeState()).api,
-      )
-      trace.subscriber([upToDate])
-
-      const pendingMatch = trace.collection.utils.awaitMatch(
-        (message) => `value` in message && message.value.id === 808,
-        100,
-      )
-      const pendingTxid = trace.collection.utils.awaitTxId(808, 100)
-      const update = change(`update`, 808, `ignored`)
-      update.headers.txids = [808]
-
-      trace.subscriber([update, upToDate])
-
-      await Promise.all([
-        expect(pendingMatch).resolves.toBe(true),
-        expect(pendingTxid).resolves.toBe(true),
-      ])
-      expect(trace.collection.has(808)).toBe(false)
-      await trace.collection.cleanup()
-    },
-  )
-
   oracleReplayTest(it)(
     `reconstructs persistence-interleaving campaigns and rejects ablated, out-of-range, and foreign histories`,
     () => {
@@ -7762,3 +4655,40 @@ oracleReplayTest(describe, queuedPresenceProperty)(
     )
   },
 )
+
+// The checks run a history through production and compare each observation
+// with the model (or the authored snapshots they are given). The models are
+// independent folds of the same histories. The grammar generates the queued
+// presence and persistence interleaving campaigns.
+declareOracle({
+  check: [
+    runProcessGrammar,
+    runQueuedPresenceCampaign,
+    expectQueuedPresenceAtDurabilityHold,
+    checkInitialMoveOut,
+    runRejectedDurablePrefixWitness,
+    runPublicationBeforePersistenceWitness,
+    runPersistenceFailureCrashOnlyWitness,
+    assertPublicationEpochHistory,
+    runSchedulerPermutation,
+    runPersistenceInterleavingCampaign,
+    expectPersistenceInterleavingObservation,
+  ],
+  model: [
+    expectedSnapshots,
+    recomputeCommittedRows,
+    recomputedSnapshots,
+    expectedQueuedPresenceRows,
+    foldSourceLedgerThrough,
+    isSdkResetFramedPartition,
+    applyReferenceBatch,
+    createRetryModel,
+    applyRetryModel,
+    expectedRetryObservation,
+    expectedInitialMoveOutSnapshots,
+  ],
+  grammar: [
+    queuedPresenceArbitraries,
+    persistenceInterleavingCampaignArbitrary,
+  ],
+})
diff --git a/packages/electric-db-collection/tests/electric-persistence-fixture.ts b/packages/electric-db-collection/tests/electric-persistence-fixture.ts
index cc8da9805f..72a3919c51 100644
--- a/packages/electric-db-collection/tests/electric-persistence-fixture.ts
+++ b/packages/electric-db-collection/tests/electric-persistence-fixture.ts
@@ -1,7 +1,9 @@
 import { compileSingleRowExpression, toBooleanPredicate } from '@tanstack/db'
+import type { DatabaseSync } from 'node:sqlite'
 import type {
   PersistedStorageTarget,
   PersistenceAdapter,
+  SQLiteDriver,
 } from '../../db-sqlite-persistence-core/src'
 
 export function storageTargetId(target: PersistedStorageTarget): string {
@@ -168,3 +170,48 @@ export function managedTagPersistence() {
     currentStorageId: () => currentStorageId,
   }
 }
+
+function toSqliteBinding(value: unknown): string | number | bigint | null {
+  if (value === null || value === undefined) return null
+  if (typeof value === `boolean`) return value ? 1 : 0
+  if (
+    typeof value === `string` ||
+    typeof value === `number` ||
+    typeof value === `bigint`
+  ) {
+    return value
+  }
+  return String(value)
+}
+
+export function nodeSqliteDriver(database: DatabaseSync): SQLiteDriver {
+  const driver: SQLiteDriver = {
+    exec: (sql) => {
+      database.exec(sql)
+      return Promise.resolve()
+    },
+    query: (sql, params = []) =>
+      Promise.resolve(
+        database
+          .prepare(sql)
+          .all(...params.map(toSqliteBinding))
+          .map((row) => ({ ...row })) as Array<never>,
+      ),
+    run: (sql, params = []) => {
+      database.prepare(sql).run(...params.map(toSqliteBinding))
+      return Promise.resolve()
+    },
+    transaction: async (transaction) => {
+      database.exec(`BEGIN IMMEDIATE`)
+      try {
+        const result = await transaction(driver)
+        database.exec(`COMMIT`)
+        return result
+      } catch (error) {
+        database.exec(`ROLLBACK`)
+        throw error
+      }
+    },
+  }
+  return driver
+}
diff --git a/packages/electric-db-collection/tests/electric-recovery-oracle.test.ts b/packages/electric-db-collection/tests/electric-recovery-oracle.test.ts
index ecf23f543a..902b701826 100644
--- a/packages/electric-db-collection/tests/electric-recovery-oracle.test.ts
+++ b/packages/electric-db-collection/tests/electric-recovery-oracle.test.ts
@@ -5,22 +5,33 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { createCollection } from '@tanstack/db'
 import { ShapeStream } from '@electric-sql/client'
 import { oraclePropertyOptions, oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import {
   SQLiteCorePersistenceAdapter,
   createPersistedTableName,
   persistedCollectionOptions,
 } from '../../db-sqlite-persistence-core/src'
 import { electricCollectionOptions } from '../src/electric'
-import type { Message, Row } from '@electric-sql/client'
+import { nodeSqliteDriver } from './electric-persistence-fixture'
+import {
+  attachRecoveryCleanupDiagnostics,
+  change,
+  expectPersistedRestartLaw,
+  expectWholeRecoveryTrace,
+  externalPublisher,
+  fixture,
+  freshRow,
+  oldRow,
+  otherOldRow,
+  upToDate,
+  withFixtureCleanup,
+} from './electric-recovery-support'
+import type { Message } from '@electric-sql/client'
+import type { ElectricCollectionUtils } from '../src/electric'
 import type {
-  PersistedCollectionCoordinator,
-  PersistedTx,
-  PersistenceAdapter,
-  ProtocolEnvelope,
-  SQLiteDriver,
-  TxCommitted,
-} from '../../db-sqlite-persistence-core/src'
-import type { ElectricCollectionUtils, ElectricSyncMode } from '../src/electric'
+  Item,
+  PersistedRestartObservation,
+} from './electric-recovery-support'
 
 /**
  * # What remains visible while a persisted Electric replica repairs itself?
@@ -49,14 +60,7 @@ import type { ElectricCollectionUtils, ElectricSyncMode } from '../src/electric'
  * external-publisher fixture routes complete committed transactions through
  * its bound adapter; that wiring does not add native-host evidence.
  */
-type Item = Row & {
-  id: number
-  name: string
-  stable: string
-  obsolete?: string
-}
 type Subscriber = (messages: Array<Message<Item>>) => void
-type Exposure = { cut: string; rows: Array<Item> }
 
 function persistedResumeKind(value: unknown): unknown {
   return value && typeof value === `object`
@@ -64,67 +68,6 @@ function persistedResumeKind(value: unknown): unknown {
     : undefined
 }
 
-function toSqliteBinding(value: unknown): string | number | bigint | null {
-  if (value === null || value === undefined) return null
-  if (typeof value === `boolean`) return value ? 1 : 0
-  if (
-    typeof value === `string` ||
-    typeof value === `number` ||
-    typeof value === `bigint`
-  ) {
-    return value
-  }
-  return String(value)
-}
-
-function nodeSqliteDriver(database: DatabaseSync): SQLiteDriver {
-  const driver: SQLiteDriver = {
-    exec: (sql) => {
-      database.exec(sql)
-      return Promise.resolve()
-    },
-    query: (sql, params = []) =>
-      Promise.resolve(
-        database
-          .prepare(sql)
-          .all(...params.map(toSqliteBinding))
-          .map((row) => ({ ...row })) as Array<never>,
-      ),
-    run: (sql, params = []) => {
-      database.prepare(sql).run(...params.map(toSqliteBinding))
-      return Promise.resolve()
-    },
-    transaction: async (transaction) => {
-      database.exec(`BEGIN IMMEDIATE`)
-      try {
-        const result = await transaction(driver)
-        database.exec(`COMMIT`)
-        return result
-      } catch (error) {
-        database.exec(`ROLLBACK`)
-        throw error
-      }
-    },
-  }
-  return driver
-}
-
-function expectWholeRecoveryTrace(
-  entries: Array<Exposure>,
-  allowed: Array<Array<Item>>,
-) {
-  let position = 0
-  for (const entry of entries) {
-    while (
-      position < allowed.length &&
-      !isDeepStrictEqual(entry.rows, allowed[position])
-    )
-      position++
-    expect(position, JSON.stringify({ entry, allowed, entries })).toBeLessThan(
-      allowed.length,
-    )
-  }
-}
 const subscribers: Array<Subscriber> = []
 const mockSubscribe = vi.fn((callback: Subscriber) => {
   subscribers.push(callback)
@@ -153,203 +96,6 @@ function deferred() {
   return { promise, resolve }
 }
 
-const oldRow: Item = { id: 1, name: `old`, stable: `stable-1` }
-const otherOldRow: Item = { id: 3, name: `other-old`, stable: `stable-3` }
-const freshRow: Item = { id: 2, name: `fresh`, stable: `stable-2` }
-const upToDate: Message<Item> = { headers: { control: `up-to-date` } }
-
-function change(
-  operation: `insert` | `update` | `delete`,
-  value: Partial<Item>,
-): Message<Item> {
-  return { key: String(value.id), value: value as Item, headers: { operation } }
-}
-
-function fixture(
-  syncMode: ElectricSyncMode,
-  coordinator?: PersistedCollectionCoordinator,
-) {
-  const rows = new Map<string | number, Item>([[oldRow.id, { ...oldRow }]])
-  const metadata = new Map<string, unknown>([
-    [
-      `electric:resume`,
-      {
-        kind: `resume`,
-        requiresTagState: false,
-        offset: `10_0`,
-        handle: `shape-old`,
-        shapeId: `{"params":{"table":"test_table"},"url":"http://test-url"}`,
-        updatedAt: 1,
-      },
-    ],
-  ])
-  let hydrationGate = Promise.resolve()
-  const commits: Array<PersistedTx> = []
-  let latestTerm = 0
-  let latestSeq = 0
-  let latestRowVersion = 0
-  let resetEpoch = 0
-  let durableRowReads = 0
-  const adapter: PersistenceAdapter = {
-    loadSubset: () => {
-      durableRowReads++
-      const snapshot = Array.from(rows, ([key, value]) => ({
-        key,
-        value: { ...value },
-      }))
-      return hydrationGate.then(() => snapshot)
-    },
-    loadResumeSnapshot: async (_collectionId, ctx) => {
-      if (ctx?.includeRows !== false) {
-        durableRowReads++
-        await hydrationGate
-      }
-      return {
-        rows:
-          ctx?.includeRows === false
-            ? []
-            : Array.from(rows, ([key, value]) => ({
-                key,
-                value: { ...value },
-              })),
-        keySet: { status: `consistent` },
-        collectionMetadata: Array.from(metadata, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-        })),
-        latestTerm,
-        latestSeq,
-        latestRowVersion,
-        resetEpoch,
-      }
-    },
-    loadCollectionMetadata: () =>
-      Promise.resolve(
-        Array.from(metadata, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-        })),
-      ),
-    applyCommittedTx: (_collectionId, tx) => {
-      for (const mutation of tx.collectionMetadataMutations ?? []) {
-        if (mutation.type === `delete`) metadata.delete(mutation.key)
-        else metadata.set(mutation.key, structuredClone(mutation.value))
-      }
-      if (tx.truncate) {
-        rows.clear()
-        resetEpoch++
-      }
-      for (const mutation of tx.mutations) {
-        if (mutation.type === `delete`) rows.delete(mutation.key)
-        else {
-          rows.set(
-            mutation.key,
-            mutation.type === `insert`
-              ? (structuredClone(mutation.value) as Item)
-              : ({
-                  ...rows.get(mutation.key),
-                  ...structuredClone(mutation.value),
-                } as Item),
-          )
-        }
-      }
-      latestTerm = tx.term
-      latestSeq = tx.seq
-      latestRowVersion = tx.rowVersion
-      commits.push(structuredClone(tx))
-      return Promise.resolve()
-    },
-    ensureIndex: () => Promise.resolve(),
-  }
-  const collectionId = `persisted-recovery-${syncMode}`
-  if (coordinator) {
-    coordinator.requestApplyCommittedTx = async (requestedCollectionId, tx) => {
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: requestedCollectionId },
-        tx,
-      )
-      return {
-        type: `rpc:applyCommittedTx:res`,
-        rpcId: tx.txId,
-        ok: true,
-        term: tx.term,
-        seq: tx.seq,
-        latestRowVersion: tx.rowVersion,
-      }
-    }
-  }
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      ElectricCollectionUtils<Item>
-    >({
-      ...electricCollectionOptions<Item>({
-        id: collectionId,
-        shapeOptions: {
-          url: `http://test-url`,
-          params: { table: `test_table` },
-        },
-        syncMode,
-        getKey: (row) => row.id,
-        startSync: false,
-      }),
-      persistence: { adapter, coordinator },
-    }),
-  )
-  const publicRows = () =>
-    Array.from(collection.values(), (row) => {
-      const {
-        $hasPendingWrites: _pending,
-        $synced: _synced,
-        $origin: _origin,
-        $key: _key,
-        $collectionId: _collectionId,
-        ...value
-      } = row
-      return structuredClone(value) as Item
-    }).sort((a, b) => a.id - b.id)
-  const durableRows = () =>
-    structuredClone([...rows.values()].sort((a, b) => a.id - b.id))
-  const exposures: Array<Exposure> = []
-  const record = (cut: string) => {
-    exposures.push({ cut, rows: structuredClone(publicRows()) })
-  }
-  let stopObserving = () => {}
-  const start = () => {
-    stopObserving()
-    collection.startSyncImmediate()
-    const subscription = collection.subscribeChanges(() => record(`event`), {
-      includeInitialState: false,
-    })
-    stopObserving = () => subscription.unsubscribe()
-    record(`started`)
-  }
-  return {
-    collection,
-    rows,
-    metadata,
-    commits,
-    publicRows,
-    durableRows,
-    exposures,
-    record,
-    durableRowReadCount: () => durableRowReads,
-    latestDurableRowVersion: () => latestRowVersion,
-    commitExternalTx: (tx: PersistedTx) =>
-      adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        tx,
-      ),
-    start,
-    stopObserving: () => stopObserving(),
-    pauseHydration: (gate: Promise<void>) => {
-      hydrationGate = gate
-    },
-  }
-}
-
 const scenarios = ([`eager`, `progressive`] as const).flatMap((syncMode) =>
   [false, true].flatMap((empty) =>
     ([`before`, `after`] as const).map((hydration) => ({
@@ -395,100 +141,10 @@ const persistedRestartScenarios = ([`empty`, `nonempty`] as const).flatMap(
     ),
 )
 
-type PersistedRestartObservation = {
-  checkpoint: `post-restart-up-to-date`
-  requestedOffset: string | undefined
-  requestedHandle: string | undefined
-  visibleRows: Array<Item>
-  durableRows: Array<Item>
-  durableResumeKind: unknown
-  status: string
-}
-
-function expectPersistedRestartLaw(
-  actual: PersistedRestartObservation,
-  expected: PersistedRestartObservation,
-): void {
-  expect(actual).toEqual(expected)
-}
-
 function cloneItem(item: Item): Item {
   return { id: item.id, name: item.name, stable: item.stable }
 }
 
-function attachRecoveryCleanupDiagnostics(
-  primary: unknown,
-  cleanupEvidence: string,
-  cleanupFailures: ReadonlyArray<unknown>,
-): Error {
-  const error =
-    primary instanceof Error
-      ? primary
-      : new Error(`Persisted restart oracle failed with a non-Error value`, {
-          cause: primary,
-        })
-  Object.defineProperty(error, `cleanupEvidence`, {
-    value: cleanupEvidence,
-    enumerable: true,
-  })
-  if (cleanupFailures.length > 0) {
-    Object.defineProperty(error, `cleanupFailures`, {
-      value: [...cleanupFailures],
-      enumerable: true,
-    })
-  }
-  return error
-}
-
-async function withFixtureCleanup(
-  f: ReturnType<typeof fixture>,
-  run: () => Promise<void>,
-  beforeCleanup?: () => void,
-): Promise<void> {
-  let failed = false
-  let primaryFailure: unknown
-  try {
-    await run()
-  } catch (error) {
-    failed = true
-    primaryFailure = error
-  }
-  const cleanupFailures: Array<unknown> = []
-  try {
-    beforeCleanup?.()
-  } catch (error) {
-    cleanupFailures.push(
-      new Error(`Recovery gate release failed`, { cause: error }),
-    )
-  }
-  try {
-    f.stopObserving()
-  } catch (error) {
-    cleanupFailures.push(
-      new Error(`Recovery observer cleanup failed`, { cause: error }),
-    )
-  }
-  try {
-    await f.collection.cleanup()
-  } catch (error) {
-    cleanupFailures.push(
-      new Error(`Recovery Collection cleanup failed`, { cause: error }),
-    )
-  }
-  if (failed) {
-    throw attachRecoveryCleanupDiagnostics(
-      primaryFailure,
-      cleanupFailures.length === 0
-        ? `passed: recovery fixture cleanup`
-        : `failed: recovery fixture cleanup`,
-      cleanupFailures,
-    )
-  }
-  if (cleanupFailures.length > 0) {
-    throw new AggregateError(cleanupFailures, `Recovery fixture cleanup failed`)
-  }
-}
-
 async function observePersistedRestart(
   scenario: PersistedRestartScenario,
 ): Promise<{
@@ -524,18 +180,10 @@ async function observePersistedRestart(
       scenario.rowState === `empty`
         ? []
         : [cloneItem(oldRow), cloneItem(otherOldRow)]
-    const canResume =
-      scenario.transition === `compatible-reopen` &&
-      scenario.resumeKind === `resume`
-    const expected: PersistedRestartObservation = {
-      checkpoint: `post-restart-up-to-date`,
-      requestedOffset: canResume ? `10_0` : undefined,
-      requestedHandle: canResume ? `shape-old` : undefined,
-      visibleRows: modelCanonicalRows.map(cloneItem),
-      durableRows: modelCanonicalRows.map(cloneItem),
-      durableResumeKind: `resume`,
-      status: `ready`,
-    }
+    const expected = expectedPostRestartObservation(
+      scenario,
+      modelCanonicalRows,
+    )
     const resumeState =
       scenario.resumeKind === `none`
         ? []
@@ -867,6 +515,238 @@ async function observePersistedRestart(
   return result
 }
 
+function expectedPostRestartObservation(
+  scenario: PersistedRestartScenario,
+  modelCanonicalRows: Array<Item>,
+): PersistedRestartObservation {
+  const canResume =
+    scenario.transition === `compatible-reopen` &&
+    scenario.resumeKind === `resume`
+  return {
+    checkpoint: `post-restart-up-to-date`,
+    requestedOffset: canResume ? `10_0` : undefined,
+    requestedHandle: canResume ? `shape-old` : undefined,
+    visibleRows: modelCanonicalRows.map(cloneItem),
+    durableRows: modelCanonicalRows.map(cloneItem),
+    durableResumeKind: `resume`,
+    status: `ready`,
+  }
+}
+
+/**
+ * The Map adapter stands in for SQLite's row operations. An insert replaces
+ * the row; an update keeps the fields that the command omits.
+ */
+function expectedDurableRow(
+  operation: `insert` | `update`,
+  previous: Item,
+  next: Item,
+): Item {
+  return operation === `insert` ? next : { ...previous, ...next }
+}
+
+type PublicationHistoryCommand = {
+  id: number
+  name: string
+  deleted: boolean
+  fullReload: boolean
+  operation?: `insert` | `update`
+  obsolete?: boolean
+}
+
+/**
+ * One model command pairs two production boundaries: a committed peer
+ * publication, then an Electric stream update. The row Map models complete
+ * public values; the publication marker is only a reach witness, not model
+ * state. No later command branches on that marker.
+ *
+ * The bounded grammar permits 1–8 pairs, keys 2–4 beside the untouched
+ * baseline key 1, and names of length 0–8. Key variation distinguishes
+ * independent rows from repeated edits; name and optional field variation
+ * distinguish partial update from same-key insert replacement. Deletion
+ * changes membership;
+ * fullReload requires a persisted read. A targeted notice can also require
+ * a read when its row is new to this Collection: the notice carries a
+ * patch without a completeness certificate. Public rows, rather than the
+ * number of reads, decide whether that route satisfies the law. Multiple
+ * pairs expose repeated-key histories. The authored history below
+ * reconstructs insert then delete with a reload. The other fixed histories
+ * reach both sequence-length and name/key margins. The grammar excludes a
+ * malformed peer transaction that lists one key as both changed and deleted;
+ * the publisher constructs exactly one of those lists from `deleted`.
+ * Arbitrary keys and longer histories remain outside this property.
+ */
+const publicationHistoryArbitrary = fc.array(
+  fc.record({
+    id: fc.integer({ min: 2, max: 4 }),
+    name: fc.string({ maxLength: 8 }),
+    deleted: fc.boolean(),
+    fullReload: fc.boolean(),
+    operation: fc.constantFrom(`insert` as const, `update` as const),
+    obsolete: fc.boolean(),
+  }),
+  { minLength: 1, maxLength: 8 },
+)
+
+/**
+ * The model applies a committed peer publication to the expected rows. A
+ * delete removes the key; an insert replaces the row; an update keeps the
+ * fields that the notice omits.
+ */
+function applyPublicationCommandToModel(
+  expected: Map<number, Item>,
+  command: PublicationHistoryCommand,
+  row: Item,
+  operation: `insert` | `update`,
+): void {
+  if (command.deleted) expected.delete(row.id)
+  else {
+    expected.set(
+      row.id,
+      operation === `insert`
+        ? structuredClone(row)
+        : { ...expected.get(row.id), ...structuredClone(row) },
+    )
+  }
+}
+
+/**
+ * A stream update after a peer publication renames the row that the model
+ * holds. A missing row means the model has no basis for the update.
+ */
+function applyStreamUpdateToModel(
+  expected: Map<number, Item>,
+  id: number,
+): void {
+  const current = expected.get(id)
+  if (!current) throw new Error(`peer row missing before stream update`)
+  expected.set(id, { ...current, name: `stream` })
+}
+
+const assertPublicationHistory = async (
+  commands: Array<PublicationHistoryCommand>,
+) => {
+  subscribers.length = 0
+  const peer = externalPublisher()
+  const f = fixture(`on-demand`, peer.coordinator)
+  const expected = new Map([[oldRow.id, structuredClone(oldRow)]])
+  const expectedRows = () =>
+    structuredClone([...expected.values()].sort((a, b) => a.id - b.id))
+  let checkpoint = `startup`
+  await withFixtureCleanup(f, async () => {
+    try {
+      f.start()
+      await vi.waitFor(() => expect(subscribers).toHaveLength(1), {
+        interval: 1,
+      })
+      await f.collection._sync.loadSubset({})
+      subscribers[0]!([upToDate])
+      for (const command of commands) {
+        checkpoint = `peer publication ${JSON.stringify(command)}`
+        const before = expectedRows()
+        const cut = f.exposures.length
+        f.record(`before peer ${JSON.stringify(command)}`)
+        const row = {
+          id: command.id,
+          name: command.name,
+          stable: `peer-${command.id}`,
+          ...(command.obsolete ? { obsolete: `old field` } : {}),
+        }
+        const operation =
+          command.operation ?? (expected.has(row.id) ? `update` : `insert`)
+        applyPublicationCommandToModel(expected, command, row, operation)
+        const rowReadsBeforeNotice = f.durableRowReadCount()
+        const revision = await peer.publish(
+          f,
+          row,
+          command.deleted,
+          command.fullReload,
+          operation,
+        )
+        f.record(`after peer revision ${revision}`)
+        // An unchanged row set is not proof that the peer publication ran.
+        // Its metadata marker commits with the rows, including empty deletes.
+        await vi.waitFor(
+          () =>
+            expect(
+              f.collection._state.syncedCollectionMetadata.get(
+                `oracle:publication`,
+              ),
+            ).toBe(revision),
+          { interval: 1 },
+        )
+        if (command.fullReload) {
+          await vi.waitFor(
+            () =>
+              expect(f.durableRowReadCount()).toBeGreaterThan(
+                rowReadsBeforeNotice,
+              ),
+            { interval: 1 },
+          )
+        }
+        expect(f.publicRows()).toEqual(expectedRows())
+        f.record(`peer revision ${revision} settled`)
+        const afterPeer = expectedRows()
+        const peerExposures = f.exposures.slice(cut)
+        expectWholeRecoveryTrace(peerExposures, [before, afterPeer])
+        if (!isDeepStrictEqual(before, afterPeer)) {
+          expect(
+            peerExposures.some(
+              ({ cut: eventCut, rows }) =>
+                eventCut === `event` && isDeepStrictEqual(rows, afterPeer),
+            ),
+          ).toBe(true)
+        }
+        checkpoint = `stream delta after ${JSON.stringify(command)}`
+        const streamCut = f.exposures.length
+        f.record(`before stream revision ${revision}`)
+        subscribers[0]!([
+          change(`update`, { id: row.id, name: `stream` }),
+          upToDate,
+        ])
+        if (!command.deleted) applyStreamUpdateToModel(expected, row.id)
+        f.record(`after stream revision ${revision}`)
+        expect(f.publicRows()).toEqual(expectedRows())
+        await vi.waitFor(
+          () => expect(f.durableRows()).toEqual(expectedRows()),
+          { interval: 1 },
+        )
+        const streamExposures = f.exposures.slice(streamCut)
+        expectWholeRecoveryTrace(streamExposures, [afterPeer, expectedRows()])
+        if (!isDeepStrictEqual(afterPeer, expectedRows())) {
+          expect(
+            streamExposures.some(
+              ({ cut: eventCut, rows }) =>
+                eventCut === `event` && isDeepStrictEqual(rows, expectedRows()),
+            ),
+          ).toBe(true)
+        }
+      }
+    } catch (error) {
+      throw new Error(
+        `Electric publication history violation. checkpoint=${checkpoint} history=${JSON.stringify(commands)}`,
+        { cause: error },
+      )
+    }
+  })
+}
+
+function expectedReplacementRows(empty: boolean): Array<Item> {
+  return empty ? [] : [freshRow]
+}
+
+declareOracle({
+  check: [observePersistedRestart, assertPublicationHistory],
+  model: [
+    expectedPostRestartObservation,
+    expectedDurableRow,
+    applyPublicationCommandToModel,
+    applyStreamUpdateToModel,
+    expectedReplacementRows,
+  ],
+  grammar: [publicationHistoryArbitrary],
+})
+
 describe(`persisted Electric recovery laws`, () => {
   // The Map adapter is the driver's durable boundary. It must enact SQLite's
   // distinct row operations before its rows can serve as evidence for a peer
@@ -893,7 +773,7 @@ describe(`persisted Electric recovery laws`, () => {
           mutations: [{ type: operation, key: next.id, value: next }],
         })
         expect(f.rows.get(next.id)).toEqual(
-          operation === `insert` ? next : { ...old, ...next },
+          expectedDurableRow(operation, old, next),
         )
       })
     },
@@ -928,386 +808,6 @@ describe(`persisted Electric recovery laws`, () => {
     },
   )
 
-  it(`accepts a compatible empty resume and rejects a stale reset request or missing canonical row`, () => {
-    const compatibleEmpty: PersistedRestartObservation = {
-      checkpoint: `post-restart-up-to-date`,
-      requestedOffset: `10_0`,
-      requestedHandle: `shape-old`,
-      visibleRows: [],
-      durableRows: [],
-      durableResumeKind: `resume`,
-      status: `ready`,
-    }
-    expect(() =>
-      expectPersistedRestartLaw(
-        { ...compatibleEmpty, visibleRows: [], durableRows: [] },
-        compatibleEmpty,
-      ),
-    ).not.toThrow()
-
-    const freshNonempty: PersistedRestartObservation = {
-      ...compatibleEmpty,
-      requestedOffset: undefined,
-      requestedHandle: undefined,
-      visibleRows: [{ ...oldRow }, { ...otherOldRow }],
-      durableRows: [{ ...oldRow }, { ...otherOldRow }],
-    }
-    expect(() =>
-      expectPersistedRestartLaw(
-        {
-          ...freshNonempty,
-          requestedOffset: `10_0`,
-          requestedHandle: `shape-old`,
-          visibleRows: [{ ...oldRow }],
-          durableRows: [{ ...oldRow }],
-        },
-        freshNonempty,
-      ),
-    ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
-  })
-
-  it(`keeps repaired intermediate publications in the persisted recovery record`, async () => {
-    const f = fixture(`eager`)
-    await withFixtureCleanup(f, async () => {
-      f.start()
-      await vi.waitFor(() => expect(f.publicRows()).toEqual([oldRow]))
-      await vi.waitFor(() => expect(subscribers).toHaveLength(1))
-      const cut = f.exposures.length
-      f.record(`before`)
-      subscribers[0]!([change(`update`, { id: 1, name: `wrong` }), upToDate])
-      subscribers[0]!([change(`update`, { id: 1, name: `correct` }), upToDate])
-      const correct = [{ ...oldRow, name: `correct` }]
-      await vi.waitFor(() => expect(f.publicRows()).toEqual(correct))
-      f.record(`repaired`)
-      const entries = f.exposures.slice(cut)
-      expect(entries[0]!.rows).toEqual([oldRow])
-      expect(
-        entries.some(
-          ({ cut: kind, rows }) =>
-            kind === `event` && rows[0]?.name === `wrong`,
-        ),
-      ).toBe(true)
-      expect(() =>
-        expectWholeRecoveryTrace(entries, [[oldRow], correct]),
-      ).toThrow()
-      expectWholeRecoveryTrace(entries, [
-        [oldRow],
-        [{ ...oldRow, name: `wrong` }],
-        correct,
-      ])
-    })
-  })
-
-  function externalPublisher() {
-    let receive: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-    let id = ``
-    let term = 100
-    const coordinator: PersistedCollectionCoordinator = {
-      getNodeId: () => `local`,
-      subscribe: (collectionId, callback) => {
-        id = collectionId
-        receive = callback
-        return () => {
-          receive = undefined
-        }
-      },
-      publish: () => {},
-      isLeader: () => true,
-      ensureLeadership: () => Promise.resolve(),
-      requestEnsurePersistedIndex: () => Promise.resolve(),
-      requestEnsureRemoteSubset: () => Promise.resolve(),
-      requestReleaseRemoteSubset: () => Promise.resolve(),
-      registerRemoteSubsetOwner: () => () => {},
-      requestApplyCommittedTx: (_collectionId, tx) =>
-        Promise.resolve({
-          type: `rpc:applyCommittedTx:res`,
-          rpcId: tx.txId,
-          ok: true,
-          term: tx.term,
-          seq: tx.seq,
-          latestRowVersion: tx.rowVersion,
-        }),
-    }
-    return {
-      coordinator,
-      publish: async (
-        fixtureState: ReturnType<typeof fixture>,
-        row: Item,
-        deleted: boolean,
-        fullReload: boolean,
-        operation?: `insert` | `update`,
-      ) => {
-        const revision = term++
-        const rowVersion = fixtureState.latestDurableRowVersion() + 1
-        const txId = `peer-${revision}`
-        // Commit the peer's rows, marker, and stream position before its
-        // notice. A notice with no matching durable position is not a legal
-        // ordinary publication history.
-        await fixtureState.commitExternalTx({
-          txId,
-          term: revision,
-          seq: 1,
-          rowVersion,
-          mutations: deleted
-            ? [{ type: `delete`, key: row.id, value: row }]
-            : [
-                {
-                  type:
-                    operation ??
-                    (fixtureState.rows.has(row.id) ? `update` : `insert`),
-                  key: row.id,
-                  value: row,
-                },
-              ],
-          collectionMetadataMutations: [
-            { type: `set`, key: `oracle:publication`, value: revision },
-          ],
-        })
-        const committed: TxCommitted = fullReload
-          ? {
-              type: `tx:committed`,
-              term: revision,
-              seq: 1,
-              txId,
-              latestRowVersion: rowVersion,
-              requiresFullReload: true,
-            }
-          : {
-              type: `tx:committed`,
-              term: revision,
-              seq: 1,
-              txId,
-              latestRowVersion: rowVersion,
-              requiresFullReload: false,
-              changedRows: deleted ? [] : [{ key: row.id, value: row }],
-              deletedKeys: deleted ? [row.id] : [],
-              collectionMetadataMutations: [
-                { type: `set`, key: `oracle:publication`, value: revision },
-              ],
-            }
-        receive?.({
-          v: 1,
-          dbName: id,
-          collectionId: id,
-          senderId: `peer`,
-          ts: Date.now(),
-          payload: committed,
-        })
-        return revision
-      },
-    }
-  }
-
-  it.each(
-    ([`eager`, `progressive`, `on-demand`] as const).flatMap((syncMode) =>
-      [false, true].map((fullReload) => ({ syncMode, fullReload })),
-    ),
-  )(
-    `$syncMode merges stream deltas into independently published rows, fullReload=$fullReload`,
-    async ({ syncMode, fullReload }) => {
-      const peer = externalPublisher()
-      const f = fixture(syncMode, peer.coordinator)
-      await withFixtureCleanup(f, async () => {
-        f.start()
-        await vi.waitFor(() => expect(subscribers).toHaveLength(1))
-        if (syncMode === `on-demand`) await f.collection._sync.loadSubset({})
-        await vi.waitFor(() => expect(f.publicRows()).toEqual([oldRow]))
-        subscribers[0]!([upToDate])
-        const cut = f.exposures.length
-        f.record(`before peer`)
-        await peer.publish(f, freshRow, false, fullReload)
-        f.record(`after peer delivery`)
-        await vi.waitFor(() =>
-          expect(f.publicRows()).toEqual([oldRow, freshRow]),
-        )
-        f.record(`peer settled`)
-        expectWholeRecoveryTrace(f.exposures.slice(cut), [
-          [oldRow],
-          [oldRow, freshRow],
-        ])
-        const streamCut = f.exposures.length
-        f.record(`before stream delta`)
-        subscribers[0]!([
-          change(`update`, { id: freshRow.id, name: `changed` }),
-          upToDate,
-        ])
-        const expected = [oldRow, { ...freshRow, name: `changed` }]
-        f.record(`after stream delta`)
-        expect(f.publicRows()).toEqual(expected)
-        await vi.waitFor(() => expect(f.durableRows()).toEqual(expected))
-        expectWholeRecoveryTrace(f.exposures.slice(streamCut), [
-          [oldRow, freshRow],
-          expected,
-        ])
-      })
-    },
-  )
-
-  type PublicationHistoryCommand = {
-    id: number
-    name: string
-    deleted: boolean
-    fullReload: boolean
-    operation?: `insert` | `update`
-    obsolete?: boolean
-  }
-
-  /**
-   * One model command pairs two production boundaries: a committed peer
-   * publication, then an Electric stream update. The row Map models complete
-   * public values; the publication marker is only a reach witness, not model
-   * state. No later command branches on that marker.
-   *
-   * The bounded grammar permits 1–8 pairs, keys 2–4 beside the untouched
-   * baseline key 1, and names of length 0–8. Key variation distinguishes
-   * independent rows from repeated edits; name and optional field variation
-   * distinguish partial update from same-key insert replacement. Deletion
-   * changes membership;
-   * fullReload requires a persisted read. A targeted notice can also require
-   * a read when its row is new to this Collection: the notice carries a
-   * patch without a completeness certificate. Public rows, rather than the
-   * number of reads, decide whether that route satisfies the law. Multiple
-   * pairs expose repeated-key histories. The authored history below
-   * reconstructs insert then delete with a reload. The other fixed histories
-   * reach both sequence-length and name/key margins. The grammar excludes a
-   * malformed peer transaction that lists one key as both changed and deleted;
-   * the publisher constructs exactly one of those lists from `deleted`.
-   * Arbitrary keys and longer histories remain outside this property.
-   */
-  const publicationHistoryArbitrary = fc.array(
-    fc.record({
-      id: fc.integer({ min: 2, max: 4 }),
-      name: fc.string({ maxLength: 8 }),
-      deleted: fc.boolean(),
-      fullReload: fc.boolean(),
-      operation: fc.constantFrom(`insert` as const, `update` as const),
-      obsolete: fc.boolean(),
-    }),
-    { minLength: 1, maxLength: 8 },
-  )
-
-  const assertPublicationHistory = async (
-    commands: Array<PublicationHistoryCommand>,
-  ) => {
-    subscribers.length = 0
-    const peer = externalPublisher()
-    const f = fixture(`on-demand`, peer.coordinator)
-    const expected = new Map([[oldRow.id, structuredClone(oldRow)]])
-    const expectedRows = () =>
-      structuredClone([...expected.values()].sort((a, b) => a.id - b.id))
-    let checkpoint = `startup`
-    await withFixtureCleanup(f, async () => {
-      try {
-        f.start()
-        await vi.waitFor(() => expect(subscribers).toHaveLength(1), {
-          interval: 1,
-        })
-        await f.collection._sync.loadSubset({})
-        subscribers[0]!([upToDate])
-        for (const command of commands) {
-          checkpoint = `peer publication ${JSON.stringify(command)}`
-          const before = expectedRows()
-          const cut = f.exposures.length
-          f.record(`before peer ${JSON.stringify(command)}`)
-          const row = {
-            id: command.id,
-            name: command.name,
-            stable: `peer-${command.id}`,
-            ...(command.obsolete ? { obsolete: `old field` } : {}),
-          }
-          const operation =
-            command.operation ?? (expected.has(row.id) ? `update` : `insert`)
-          if (command.deleted) expected.delete(row.id)
-          else {
-            expected.set(
-              row.id,
-              operation === `insert`
-                ? structuredClone(row)
-                : { ...expected.get(row.id), ...structuredClone(row) },
-            )
-          }
-          const rowReadsBeforeNotice = f.durableRowReadCount()
-          const revision = await peer.publish(
-            f,
-            row,
-            command.deleted,
-            command.fullReload,
-            operation,
-          )
-          f.record(`after peer revision ${revision}`)
-          // An unchanged row set is not proof that the peer publication ran.
-          // Its metadata marker commits with the rows, including empty deletes.
-          await vi.waitFor(
-            () =>
-              expect(
-                f.collection._state.syncedCollectionMetadata.get(
-                  `oracle:publication`,
-                ),
-              ).toBe(revision),
-            { interval: 1 },
-          )
-          if (command.fullReload) {
-            await vi.waitFor(
-              () =>
-                expect(f.durableRowReadCount()).toBeGreaterThan(
-                  rowReadsBeforeNotice,
-                ),
-              { interval: 1 },
-            )
-          }
-          expect(f.publicRows()).toEqual(expectedRows())
-          f.record(`peer revision ${revision} settled`)
-          const afterPeer = expectedRows()
-          const peerExposures = f.exposures.slice(cut)
-          expectWholeRecoveryTrace(peerExposures, [before, afterPeer])
-          if (!isDeepStrictEqual(before, afterPeer)) {
-            expect(
-              peerExposures.some(
-                ({ cut: eventCut, rows }) =>
-                  eventCut === `event` && isDeepStrictEqual(rows, afterPeer),
-              ),
-            ).toBe(true)
-          }
-          checkpoint = `stream delta after ${JSON.stringify(command)}`
-          const streamCut = f.exposures.length
-          f.record(`before stream revision ${revision}`)
-          subscribers[0]!([
-            change(`update`, { id: row.id, name: `stream` }),
-            upToDate,
-          ])
-          if (!command.deleted) {
-            const current = expected.get(row.id)
-            if (!current)
-              throw new Error(`peer row missing before stream update`)
-            expected.set(row.id, { ...current, name: `stream` })
-          }
-          f.record(`after stream revision ${revision}`)
-          expect(f.publicRows()).toEqual(expectedRows())
-          await vi.waitFor(
-            () => expect(f.durableRows()).toEqual(expectedRows()),
-            { interval: 1 },
-          )
-          const streamExposures = f.exposures.slice(streamCut)
-          expectWholeRecoveryTrace(streamExposures, [afterPeer, expectedRows()])
-          if (!isDeepStrictEqual(afterPeer, expectedRows())) {
-            expect(
-              streamExposures.some(
-                ({ cut: eventCut, rows }) =>
-                  eventCut === `event` &&
-                  isDeepStrictEqual(rows, expectedRows()),
-              ),
-            ).toBe(true)
-          }
-        }
-      } catch (error) {
-        throw new Error(
-          `Electric publication history violation. checkpoint=${checkpoint} history=${JSON.stringify(commands)}`,
-          { cause: error },
-        )
-      }
-    })
-  }
-
   const publicationHistoryExamples: Array<[Array<PublicationHistoryCommand>]> =
     [
       [[{ id: 2, name: ``, deleted: false, fullReload: false }]],
@@ -1450,7 +950,7 @@ describe(`persisted Electric recovery laws`, () => {
           }
           f.record(`before replacement data`)
           const partialCut = f.exposures.length
-          const expected = empty ? [] : [freshRow]
+          const expected = expectedReplacementRows(empty)
           subscribers[1]!(
             expected.map((row) => change(`insert`, structuredClone(row))),
           )
@@ -1508,25 +1008,4 @@ describe(`persisted Electric recovery laws`, () => {
       )
     },
   )
-
-  it.each([`eager`, `progressive`] as const)(
-    `%s valid resume retains cached rows and their unchanged fields`,
-    async (syncMode) => {
-      const f = fixture(syncMode)
-      await withFixtureCleanup(f, async () => {
-        f.start()
-        await vi.waitFor(() => expect(f.publicRows()).toEqual([oldRow]))
-        await vi.waitFor(() => expect(subscribers).toHaveLength(1))
-        subscribers[0]!([
-          change(`update`, { id: 1, name: `changed` }),
-          upToDate,
-        ])
-        await vi.waitFor(() => expect(f.collection.status).toBe(`ready`))
-        const expected = [{ ...oldRow, name: `changed` }]
-        expect(f.publicRows()).toEqual(expected)
-        await vi.waitFor(() => expect(f.durableRows()).toEqual(expected))
-        expect(f.commits.every((tx) => !tx.truncate)).toBe(true)
-      })
-    },
-  )
 })
diff --git a/packages/electric-db-collection/tests/electric-recovery-support.ts b/packages/electric-db-collection/tests/electric-recovery-support.ts
new file mode 100644
index 0000000000..ac6886f12c
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-recovery-support.ts
@@ -0,0 +1,437 @@
+import { isDeepStrictEqual } from 'node:util'
+import { expect } from 'vitest'
+import { createCollection } from '@tanstack/db'
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src'
+import { electricCollectionOptions } from '../src/electric'
+import type { Message, Row } from '@electric-sql/client'
+import type {
+  PersistedCollectionCoordinator,
+  PersistedTx,
+  PersistenceAdapter,
+  ProtocolEnvelope,
+  TxCommitted,
+} from '../../db-sqlite-persistence-core/src'
+import type { ElectricCollectionUtils, ElectricSyncMode } from '../src/electric'
+
+/**
+ * Shared fixtures for the persisted Electric recovery tests. The Map-backed
+ * adapter, the peer publisher, and the whole-trace comparison serve both
+ * electric-recovery-oracle.test.ts, which owns the recovery laws, and
+ * electric-recovery.test.ts, which holds the hand-written cases.
+ */
+
+export type Item = Row & {
+  id: number
+  name: string
+  stable: string
+  obsolete?: string
+}
+export type Exposure = { cut: string; rows: Array<Item> }
+
+export function expectWholeRecoveryTrace(
+  entries: Array<Exposure>,
+  allowed: Array<Array<Item>>,
+) {
+  let position = 0
+  for (const entry of entries) {
+    while (
+      position < allowed.length &&
+      !isDeepStrictEqual(entry.rows, allowed[position])
+    )
+      position++
+    expect(position, JSON.stringify({ entry, allowed, entries })).toBeLessThan(
+      allowed.length,
+    )
+  }
+}
+
+export const oldRow: Item = { id: 1, name: `old`, stable: `stable-1` }
+export const otherOldRow: Item = {
+  id: 3,
+  name: `other-old`,
+  stable: `stable-3`,
+}
+export const freshRow: Item = { id: 2, name: `fresh`, stable: `stable-2` }
+export const upToDate: Message<Item> = { headers: { control: `up-to-date` } }
+
+export function change(
+  operation: `insert` | `update` | `delete`,
+  value: Partial<Item>,
+): Message<Item> {
+  return { key: String(value.id), value: value as Item, headers: { operation } }
+}
+
+export function fixture(
+  syncMode: ElectricSyncMode,
+  coordinator?: PersistedCollectionCoordinator,
+) {
+  const rows = new Map<string | number, Item>([[oldRow.id, { ...oldRow }]])
+  const metadata = new Map<string, unknown>([
+    [
+      `electric:resume`,
+      {
+        kind: `resume`,
+        requiresTagState: false,
+        offset: `10_0`,
+        handle: `shape-old`,
+        shapeId: `{"params":{"table":"test_table"},"url":"http://test-url"}`,
+        updatedAt: 1,
+      },
+    ],
+  ])
+  let hydrationGate = Promise.resolve()
+  const commits: Array<PersistedTx> = []
+  let latestTerm = 0
+  let latestSeq = 0
+  let latestRowVersion = 0
+  let resetEpoch = 0
+  let durableRowReads = 0
+  const adapter: PersistenceAdapter = {
+    loadSubset: () => {
+      durableRowReads++
+      const snapshot = Array.from(rows, ([key, value]) => ({
+        key,
+        value: { ...value },
+      }))
+      return hydrationGate.then(() => snapshot)
+    },
+    loadResumeSnapshot: async (_collectionId, ctx) => {
+      if (ctx?.includeRows !== false) {
+        durableRowReads++
+        await hydrationGate
+      }
+      return {
+        rows:
+          ctx?.includeRows === false
+            ? []
+            : Array.from(rows, ([key, value]) => ({
+                key,
+                value: { ...value },
+              })),
+        keySet: { status: `consistent` },
+        collectionMetadata: Array.from(metadata, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+        })),
+        latestTerm,
+        latestSeq,
+        latestRowVersion,
+        resetEpoch,
+      }
+    },
+    loadCollectionMetadata: () =>
+      Promise.resolve(
+        Array.from(metadata, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+        })),
+      ),
+    applyCommittedTx: (_collectionId, tx) => {
+      for (const mutation of tx.collectionMetadataMutations ?? []) {
+        if (mutation.type === `delete`) metadata.delete(mutation.key)
+        else metadata.set(mutation.key, structuredClone(mutation.value))
+      }
+      if (tx.truncate) {
+        rows.clear()
+        resetEpoch++
+      }
+      for (const mutation of tx.mutations) {
+        if (mutation.type === `delete`) rows.delete(mutation.key)
+        else {
+          rows.set(
+            mutation.key,
+            mutation.type === `insert`
+              ? (structuredClone(mutation.value) as Item)
+              : ({
+                  ...rows.get(mutation.key),
+                  ...structuredClone(mutation.value),
+                } as Item),
+          )
+        }
+      }
+      latestTerm = tx.term
+      latestSeq = tx.seq
+      latestRowVersion = tx.rowVersion
+      commits.push(structuredClone(tx))
+      return Promise.resolve()
+    },
+    ensureIndex: () => Promise.resolve(),
+  }
+  const collectionId = `persisted-recovery-${syncMode}`
+  if (coordinator) {
+    coordinator.requestApplyCommittedTx = async (requestedCollectionId, tx) => {
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: requestedCollectionId },
+        tx,
+      )
+      return {
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }
+    }
+  }
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      ElectricCollectionUtils<Item>
+    >({
+      ...electricCollectionOptions<Item>({
+        id: collectionId,
+        shapeOptions: {
+          url: `http://test-url`,
+          params: { table: `test_table` },
+        },
+        syncMode,
+        getKey: (row) => row.id,
+        startSync: false,
+      }),
+      persistence: { adapter, coordinator },
+    }),
+  )
+  const publicRows = () =>
+    Array.from(collection.values(), (row) => {
+      const {
+        $hasPendingWrites: _pending,
+        $synced: _synced,
+        $origin: _origin,
+        $key: _key,
+        $collectionId: _collectionId,
+        ...value
+      } = row
+      return structuredClone(value) as Item
+    }).sort((a, b) => a.id - b.id)
+  const durableRows = () =>
+    structuredClone([...rows.values()].sort((a, b) => a.id - b.id))
+  const exposures: Array<Exposure> = []
+  const record = (cut: string) => {
+    exposures.push({ cut, rows: structuredClone(publicRows()) })
+  }
+  let stopObserving = () => {}
+  const start = () => {
+    stopObserving()
+    collection.startSyncImmediate()
+    const subscription = collection.subscribeChanges(() => record(`event`), {
+      includeInitialState: false,
+    })
+    stopObserving = () => subscription.unsubscribe()
+    record(`started`)
+  }
+  return {
+    collection,
+    rows,
+    metadata,
+    commits,
+    publicRows,
+    durableRows,
+    exposures,
+    record,
+    durableRowReadCount: () => durableRowReads,
+    latestDurableRowVersion: () => latestRowVersion,
+    commitExternalTx: (tx: PersistedTx) =>
+      adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        tx,
+      ),
+    start,
+    stopObserving: () => stopObserving(),
+    pauseHydration: (gate: Promise<void>) => {
+      hydrationGate = gate
+    },
+  }
+}
+
+export type PersistedRestartObservation = {
+  checkpoint: `post-restart-up-to-date`
+  requestedOffset: string | undefined
+  requestedHandle: string | undefined
+  visibleRows: Array<Item>
+  durableRows: Array<Item>
+  durableResumeKind: unknown
+  status: string
+}
+
+export function expectPersistedRestartLaw(
+  actual: PersistedRestartObservation,
+  expected: PersistedRestartObservation,
+): void {
+  expect(actual).toEqual(expected)
+}
+
+export function attachRecoveryCleanupDiagnostics(
+  primary: unknown,
+  cleanupEvidence: string,
+  cleanupFailures: ReadonlyArray<unknown>,
+): Error {
+  const error =
+    primary instanceof Error
+      ? primary
+      : new Error(`Persisted restart oracle failed with a non-Error value`, {
+          cause: primary,
+        })
+  Object.defineProperty(error, `cleanupEvidence`, {
+    value: cleanupEvidence,
+    enumerable: true,
+  })
+  if (cleanupFailures.length > 0) {
+    Object.defineProperty(error, `cleanupFailures`, {
+      value: [...cleanupFailures],
+      enumerable: true,
+    })
+  }
+  return error
+}
+
+export async function withFixtureCleanup(
+  f: ReturnType<typeof fixture>,
+  run: () => Promise<void>,
+  beforeCleanup?: () => void,
+): Promise<void> {
+  let failed = false
+  let primaryFailure: unknown
+  try {
+    await run()
+  } catch (error) {
+    failed = true
+    primaryFailure = error
+  }
+  const cleanupFailures: Array<unknown> = []
+  try {
+    beforeCleanup?.()
+  } catch (error) {
+    cleanupFailures.push(
+      new Error(`Recovery gate release failed`, { cause: error }),
+    )
+  }
+  try {
+    f.stopObserving()
+  } catch (error) {
+    cleanupFailures.push(
+      new Error(`Recovery observer cleanup failed`, { cause: error }),
+    )
+  }
+  try {
+    await f.collection.cleanup()
+  } catch (error) {
+    cleanupFailures.push(
+      new Error(`Recovery Collection cleanup failed`, { cause: error }),
+    )
+  }
+  if (failed) {
+    throw attachRecoveryCleanupDiagnostics(
+      primaryFailure,
+      cleanupFailures.length === 0
+        ? `passed: recovery fixture cleanup`
+        : `failed: recovery fixture cleanup`,
+      cleanupFailures,
+    )
+  }
+  if (cleanupFailures.length > 0) {
+    throw new AggregateError(cleanupFailures, `Recovery fixture cleanup failed`)
+  }
+}
+
+export function externalPublisher() {
+  let receive: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+  let id = ``
+  let term = 100
+  const coordinator: PersistedCollectionCoordinator = {
+    getNodeId: () => `local`,
+    subscribe: (collectionId, callback) => {
+      id = collectionId
+      receive = callback
+      return () => {
+        receive = undefined
+      }
+    },
+    publish: () => {},
+    isLeader: () => true,
+    ensureLeadership: () => Promise.resolve(),
+    requestEnsurePersistedIndex: () => Promise.resolve(),
+    requestEnsureRemoteSubset: () => Promise.resolve(),
+    requestReleaseRemoteSubset: () => Promise.resolve(),
+    registerRemoteSubsetOwner: () => () => {},
+    requestApplyCommittedTx: (_collectionId, tx) =>
+      Promise.resolve({
+        type: `rpc:applyCommittedTx:res`,
+        rpcId: tx.txId,
+        ok: true,
+        term: tx.term,
+        seq: tx.seq,
+        latestRowVersion: tx.rowVersion,
+      }),
+  }
+  return {
+    coordinator,
+    publish: async (
+      fixtureState: ReturnType<typeof fixture>,
+      row: Item,
+      deleted: boolean,
+      fullReload: boolean,
+      operation?: `insert` | `update`,
+    ) => {
+      const revision = term++
+      const rowVersion = fixtureState.latestDurableRowVersion() + 1
+      const txId = `peer-${revision}`
+      // Commit the peer's rows, marker, and stream position before its
+      // notice. A notice with no matching durable position is not a legal
+      // ordinary publication history.
+      await fixtureState.commitExternalTx({
+        txId,
+        term: revision,
+        seq: 1,
+        rowVersion,
+        mutations: deleted
+          ? [{ type: `delete`, key: row.id, value: row }]
+          : [
+              {
+                type:
+                  operation ??
+                  (fixtureState.rows.has(row.id) ? `update` : `insert`),
+                key: row.id,
+                value: row,
+              },
+            ],
+        collectionMetadataMutations: [
+          { type: `set`, key: `oracle:publication`, value: revision },
+        ],
+      })
+      const committed: TxCommitted = fullReload
+        ? {
+            type: `tx:committed`,
+            term: revision,
+            seq: 1,
+            txId,
+            latestRowVersion: rowVersion,
+            requiresFullReload: true,
+          }
+        : {
+            type: `tx:committed`,
+            term: revision,
+            seq: 1,
+            txId,
+            latestRowVersion: rowVersion,
+            requiresFullReload: false,
+            changedRows: deleted ? [] : [{ key: row.id, value: row }],
+            deletedKeys: deleted ? [row.id] : [],
+            collectionMetadataMutations: [
+              { type: `set`, key: `oracle:publication`, value: revision },
+            ],
+          }
+      receive?.({
+        v: 1,
+        dbName: id,
+        collectionId: id,
+        senderId: `peer`,
+        ts: Date.now(),
+        payload: committed,
+      })
+      return revision
+    },
+  }
+}
diff --git a/packages/electric-db-collection/tests/electric-recovery.test.ts b/packages/electric-db-collection/tests/electric-recovery.test.ts
new file mode 100644
index 0000000000..cef5541d07
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-recovery.test.ts
@@ -0,0 +1,188 @@
+// Persisted Electric recovery cases whose expectations are written by hand: a
+// repaired intermediate publication, a compatible empty resume, a peer
+// publication merged with stream deltas, and a valid resume that keeps cached
+// fields. The recovery laws they illustrate are owned by
+// electric-recovery-oracle.test.ts.
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  change,
+  expectPersistedRestartLaw,
+  expectWholeRecoveryTrace,
+  externalPublisher,
+  fixture,
+  freshRow,
+  oldRow,
+  otherOldRow,
+  upToDate,
+  withFixtureCleanup,
+} from './electric-recovery-support'
+import type { Message } from '@electric-sql/client'
+import type {
+  Item,
+  PersistedRestartObservation,
+} from './electric-recovery-support'
+
+type Subscriber = (messages: Array<Message<Item>>) => void
+
+const subscribers: Array<Subscriber> = []
+const mockSubscribe = vi.fn((callback: Subscriber) => {
+  subscribers.push(callback)
+  return vi.fn()
+})
+
+vi.mock(`@electric-sql/client`, async () => ({
+  ...(await vi.importActual(`@electric-sql/client`)),
+  ShapeStream: vi.fn(() => ({
+    subscribe: mockSubscribe,
+    unsubscribeAll: vi.fn(),
+    requestSnapshot: vi.fn().mockResolvedValue(undefined),
+    fetchSnapshot: vi.fn().mockResolvedValue({ metadata: {}, data: [] }),
+    forceDisconnectAndRefresh: vi.fn().mockResolvedValue(undefined),
+    isUpToDate: false,
+    shapeHandle: `shape-current`,
+    lastOffset: `20_0`,
+  })),
+}))
+
+describe(`persisted Electric recovery laws`, () => {
+  beforeEach(() => {
+    subscribers.length = 0
+    vi.clearAllMocks()
+  })
+
+  it(`accepts a compatible empty resume and rejects a stale reset request or missing canonical row`, () => {
+    const compatibleEmpty: PersistedRestartObservation = {
+      checkpoint: `post-restart-up-to-date`,
+      requestedOffset: `10_0`,
+      requestedHandle: `shape-old`,
+      visibleRows: [],
+      durableRows: [],
+      durableResumeKind: `resume`,
+      status: `ready`,
+    }
+    expect(() =>
+      expectPersistedRestartLaw(
+        { ...compatibleEmpty, visibleRows: [], durableRows: [] },
+        compatibleEmpty,
+      ),
+    ).not.toThrow()
+
+    const freshNonempty: PersistedRestartObservation = {
+      ...compatibleEmpty,
+      requestedOffset: undefined,
+      requestedHandle: undefined,
+      visibleRows: [{ ...oldRow }, { ...otherOldRow }],
+      durableRows: [{ ...oldRow }, { ...otherOldRow }],
+    }
+    expect(() =>
+      expectPersistedRestartLaw(
+        {
+          ...freshNonempty,
+          requestedOffset: `10_0`,
+          requestedHandle: `shape-old`,
+          visibleRows: [{ ...oldRow }],
+          durableRows: [{ ...oldRow }],
+        },
+        freshNonempty,
+      ),
+    ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
+  })
+
+  it(`keeps repaired intermediate publications in the persisted recovery record`, async () => {
+    const f = fixture(`eager`)
+    await withFixtureCleanup(f, async () => {
+      f.start()
+      await vi.waitFor(() => expect(f.publicRows()).toEqual([oldRow]))
+      await vi.waitFor(() => expect(subscribers).toHaveLength(1))
+      const cut = f.exposures.length
+      f.record(`before`)
+      subscribers[0]!([change(`update`, { id: 1, name: `wrong` }), upToDate])
+      subscribers[0]!([change(`update`, { id: 1, name: `correct` }), upToDate])
+      const correct = [{ ...oldRow, name: `correct` }]
+      await vi.waitFor(() => expect(f.publicRows()).toEqual(correct))
+      f.record(`repaired`)
+      const entries = f.exposures.slice(cut)
+      expect(entries[0]!.rows).toEqual([oldRow])
+      expect(
+        entries.some(
+          ({ cut: kind, rows }) =>
+            kind === `event` && rows[0]?.name === `wrong`,
+        ),
+      ).toBe(true)
+      expect(() =>
+        expectWholeRecoveryTrace(entries, [[oldRow], correct]),
+      ).toThrow()
+      expectWholeRecoveryTrace(entries, [
+        [oldRow],
+        [{ ...oldRow, name: `wrong` }],
+        correct,
+      ])
+    })
+  })
+
+  it.each(
+    ([`eager`, `progressive`, `on-demand`] as const).flatMap((syncMode) =>
+      [false, true].map((fullReload) => ({ syncMode, fullReload })),
+    ),
+  )(
+    `$syncMode merges stream deltas into independently published rows, fullReload=$fullReload`,
+    async ({ syncMode, fullReload }) => {
+      const peer = externalPublisher()
+      const f = fixture(syncMode, peer.coordinator)
+      await withFixtureCleanup(f, async () => {
+        f.start()
+        await vi.waitFor(() => expect(subscribers).toHaveLength(1))
+        if (syncMode === `on-demand`) await f.collection._sync.loadSubset({})
+        await vi.waitFor(() => expect(f.publicRows()).toEqual([oldRow]))
+        subscribers[0]!([upToDate])
+        const cut = f.exposures.length
+        f.record(`before peer`)
+        await peer.publish(f, freshRow, false, fullReload)
+        f.record(`after peer delivery`)
+        await vi.waitFor(() =>
+          expect(f.publicRows()).toEqual([oldRow, freshRow]),
+        )
+        f.record(`peer settled`)
+        expectWholeRecoveryTrace(f.exposures.slice(cut), [
+          [oldRow],
+          [oldRow, freshRow],
+        ])
+        const streamCut = f.exposures.length
+        f.record(`before stream delta`)
+        subscribers[0]!([
+          change(`update`, { id: freshRow.id, name: `changed` }),
+          upToDate,
+        ])
+        const expected = [oldRow, { ...freshRow, name: `changed` }]
+        f.record(`after stream delta`)
+        expect(f.publicRows()).toEqual(expected)
+        await vi.waitFor(() => expect(f.durableRows()).toEqual(expected))
+        expectWholeRecoveryTrace(f.exposures.slice(streamCut), [
+          [oldRow, freshRow],
+          expected,
+        ])
+      })
+    },
+  )
+
+  it.each([`eager`, `progressive`] as const)(
+    `%s valid resume retains cached rows and their unchanged fields`,
+    async (syncMode) => {
+      const f = fixture(syncMode)
+      await withFixtureCleanup(f, async () => {
+        f.start()
+        await vi.waitFor(() => expect(f.publicRows()).toEqual([oldRow]))
+        await vi.waitFor(() => expect(subscribers).toHaveLength(1))
+        subscribers[0]!([
+          change(`update`, { id: 1, name: `changed` }),
+          upToDate,
+        ])
+        await vi.waitFor(() => expect(f.collection.status).toBe(`ready`))
+        const expected = [{ ...oldRow, name: `changed` }]
+        expect(f.publicRows()).toEqual(expected)
+        await vi.waitFor(() => expect(f.durableRows()).toEqual(expected))
+        expect(f.commits.every((tx) => !tx.truncate)).toBe(true)
+      })
+    },
+  )
+})
diff --git a/packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts b/packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts
index 505948c1c5..99dbab2599 100644
--- a/packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts
+++ b/packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts
@@ -1,28 +1,21 @@
-import { DatabaseSync } from 'node:sqlite'
 import fc from 'fast-check'
 import { expect, it, vi } from 'vitest'
-import {
-  IR,
-  createCollection,
-  createLiveQueryCollection,
-  eq,
-} from '@tanstack/db'
+import { IR, createCollection } from '@tanstack/db'
 import { ShapeStream } from '@electric-sql/client'
-import {
-  SQLiteCorePersistenceAdapter,
-  SingleProcessCoordinator,
-  persistedCollectionOptions,
-} from '../../db-sqlite-persistence-core/src'
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src'
 import { electricCollectionOptions } from '../src/electric'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
 } from '../../db/tests/oracle-config'
 import { createOracleReach } from '../../db/tests/oracle-reach'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import {
-  managedTagPersistence,
-  storageTargetId,
-} from './electric-persistence-fixture'
+  controlledHttp,
+  deferred,
+  headers,
+  recordVisibilityListeners,
+} from './electric-sdk-delivery-support'
 import {
   atCheckpoint,
   withElectricCleanup,
@@ -33,21 +26,17 @@ import {
   createRetryModel,
   expectedRetryObservation,
 } from './electric-retry-decision-model'
-import type { TestRow } from './electric-persistence-fixture'
+import { storageTargetId } from './electric-persistence-fixture'
+import type { Item, Request } from './electric-sdk-delivery-support'
+import type { ElectricCollectionUtils } from '../src/electric'
+import type { PersistenceAdapter } from '../../db-sqlite-persistence-core/src'
 import type {
   RetryDecision,
   RetryModel,
   RetryObservation,
   RetryStep,
 } from './electric-retry-decision-model'
-import type { ElectricCollectionUtils } from '../src/electric'
-import type { SyncMetadataApi, SyncPersistenceCapabilityV1 } from '@tanstack/db'
-import type {
-  PersistenceAdapter,
-  ProtocolEnvelope,
-  SQLiteDriver,
-  TxCommitted,
-} from '../../db-sqlite-persistence-core/src'
+import type { SyncMetadataApi } from '@tanstack/db'
 import type { Message } from '@electric-sql/client'
 import type * as ElectricSdkModule from '@electric-sql/client'
 
@@ -94,8 +83,10 @@ vi.mock(`@electric-sql/client`, async (importOriginal) => {
  * scoped source snapshots: old durable rows remain cache-only, an empty
  * snapshot cannot readmit them, and no demand causes no unrestricted local or
  * full-shape network read. Concurrent demands share one SDK cursor, so their
- * snapshot requests must run in order. Named two-launch and concurrent cases
- * check those laws at HTTP, local-read, public-row, and settlement boundaries.
+ * snapshot requests must run in order. The hand-written two-launch and
+ * concurrent cases in electric-sdk-delivery.test.ts illustrate those laws at
+ * HTTP, local-read, public-row, and settlement boundaries; no declared check
+ * in this file compares the scoped-restart history with a model.
  * A coordinator notification after the scoped A snapshot changes an unrelated
  * durable row. The source Map still predicts A for its active predicate. The
  * post-notification public comparison must retain A; the persistence capability
@@ -130,6 +121,20 @@ if (
   throw new Error(`Unknown Electric SDK delivery oracle fault`)
 }
 
+// The checks are the drivers that run a finite history and compare production
+// with the model state at each checkpoint. The retry model is the shared
+// module `electric-retry-decision-model.ts`, which predicts each observation.
+declareOracle({
+  check: [
+    checkSnapshots,
+    checkMembership,
+    runClientRetryCell,
+    checkSourceRelease,
+    checkManagedRotation,
+  ],
+  model: [createRetryModel, applyRetryModel, expectedRetryObservation],
+})
+
 function sdkCampaigns(
   propertyId: string,
   name: string,
@@ -191,357 +196,6 @@ function sameViolation() {
   }
 }
 
-type Item = { id: number; name: string }
-
-function toSqliteBinding(value: unknown): string | number | bigint | null {
-  if (value === null || value === undefined) return null
-  if (typeof value === `boolean`) return value ? 1 : 0
-  if (
-    typeof value === `string` ||
-    typeof value === `number` ||
-    typeof value === `bigint`
-  ) {
-    return value
-  }
-  return String(value)
-}
-
-function nodeSqliteDriver(database: DatabaseSync): SQLiteDriver {
-  const driver: SQLiteDriver = {
-    exec: (sql) => {
-      database.exec(sql)
-      return Promise.resolve()
-    },
-    query: (sql, params = []) =>
-      Promise.resolve(
-        database
-          .prepare(sql)
-          .all(...params.map(toSqliteBinding))
-          .map((row) => ({ ...row })) as Array<never>,
-      ),
-    run: (sql, params = []) => {
-      database.prepare(sql).run(...params.map(toSqliteBinding))
-      return Promise.resolve()
-    },
-    transaction: async (transaction) => {
-      database.exec(`BEGIN IMMEDIATE`)
-      try {
-        const result = await transaction(driver)
-        database.exec(`COMMIT`)
-        return result
-      } catch (error) {
-        database.exec(`ROLLBACK`)
-        throw error
-      }
-    },
-  }
-  return driver
-}
-
-function deferred<T>() {
-  let resolve!: (value: T) => void
-  const promise = new Promise<T>((done) => {
-    resolve = done
-  })
-  return { promise, resolve }
-}
-
-type Request = { url: URL; respond: (response: Response) => void }
-
-// The finite provider only holds responses and observes each fetch's signal.
-function controlledHttp() {
-  const queued: Array<Request> = []
-  const waiting: Array<{
-    snapshot: boolean | undefined
-    resolve: (request: Request) => void
-    reject: (error: unknown) => void
-  }> = []
-  const active = new Set<() => void>()
-  let closed = false
-  const closedError = new Error(`Electric oracle HTTP provider closed`)
-  const isSnapshot = (request: Request) =>
-    request.url.searchParams.has(`subset__where`)
-  const fetchClient: typeof fetch = (input, init) =>
-    new Promise<Response>((resolve, reject) => {
-      if (closed) {
-        reject(closedError)
-        return
-      }
-      const signal = init?.signal
-      const url = new URL(String(input))
-      const request: Request = {
-        url,
-        respond: (response) => {
-          remove()
-          resolve(response)
-        },
-      }
-      const remove = () => {
-        signal?.removeEventListener(`abort`, abort)
-        active.delete(abort)
-        const index = queued.indexOf(request)
-        if (index >= 0) queued.splice(index, 1)
-      }
-      const abort = () => {
-        remove()
-        reject(
-          signal?.reason ??
-            new DOMException(`Provider request aborted`, `AbortError`),
-        )
-      }
-      if (signal?.aborted) {
-        abort()
-        return
-      }
-      signal?.addEventListener(`abort`, abort, { once: true })
-      active.add(abort)
-      const index = waiting.findIndex(
-        (waiter) =>
-          waiter.snapshot === undefined ||
-          waiter.snapshot === isSnapshot(request),
-      )
-      if (index >= 0) waiting.splice(index, 1)[0]!.resolve(request)
-      else queued.push(request)
-    })
-  return {
-    fetchClient,
-    take: (snapshot = false): Promise<Request> => {
-      if (closed) return Promise.reject(closedError)
-      const index = queued.findIndex(
-        (request) => isSnapshot(request) === snapshot,
-      )
-      if (index >= 0) return Promise.resolve(queued.splice(index, 1)[0]!)
-      return new Promise((resolve, reject) =>
-        waiting.push({ snapshot, resolve, reject }),
-      )
-    },
-    takeAny: (): Promise<Request> => {
-      if (closed) return Promise.reject(closedError)
-      if (queued.length > 0) return Promise.resolve(queued.shift()!)
-      return new Promise((resolve, reject) =>
-        waiting.push({ snapshot: undefined, resolve, reject }),
-      )
-    },
-    close: () => {
-      closed = true
-      for (const abort of [...active]) abort()
-      for (const waiter of waiting.splice(0)) waiter.reject(closedError)
-    },
-    activeCount: () => active.size,
-  }
-}
-
-// EventTarget registration identity is callback plus capture. Replay native
-// add/remove calls in order: a removal cannot erase a later registration, and
-// repeated additions of one identity retain one listener. The installed SDK
-// uses no once or signal options, which would need automatic-removal tracking.
-function recordVisibilityListeners() {
-  const add = vi.spyOn(document, `addEventListener`)
-  const remove = vi.spyOn(document, `removeEventListener`)
-  const visibility = (calls: Array<Array<unknown>>) =>
-    calls
-      .filter(([type]) => type === `visibilitychange`)
-      .map(([, listener]) => listener)
-  return {
-    registered: () => visibility(add.mock.calls).length,
-    live: () => {
-      const calls = [
-        ...add.mock.calls.map((call, index) => ({
-          call,
-          adding: true,
-          order: add.mock.invocationCallOrder[index]!,
-        })),
-        ...remove.mock.calls.map((call, index) => ({
-          call,
-          adding: false,
-          order: remove.mock.invocationCallOrder[index]!,
-        })),
-      ].sort((left, right) => left.order - right.order)
-      const listeners = new Map<
-        EventListenerOrEventListenerObject,
-        Set<boolean>
-      >()
-      for (const {
-        call: [type, listener, options],
-        adding,
-      } of calls) {
-        if (type !== `visibilitychange`) continue
-        const capture =
-          typeof options === `boolean` ? options : Boolean(options?.capture)
-        if (adding) {
-          const captures = listeners.get(listener) ?? new Set<boolean>()
-          captures.add(capture)
-          listeners.set(listener, captures)
-        } else listeners.get(listener)?.delete(capture)
-      }
-      return [...listeners.values()].reduce(
-        (count, captures) => count + captures.size,
-        0,
-      )
-    },
-    restore: () => {
-      // The comparison has already run. Release even a failed subject's
-      // registrations so RED runs and shrinking do not retain dead streams.
-      try {
-        for (const [type, listener, options] of add.mock.calls)
-          if (type === `visibilitychange`)
-            document.removeEventListener(type, listener, options)
-      } finally {
-        add.mockRestore()
-        remove.mockRestore()
-      }
-    },
-  }
-}
-
-// EventTarget identifies a listener by callback and capture, coalesces duplicate
-// additions, and applies removals in order (DOM Standard, "EventTarget"). This
-// bounded calibration sends every sequence of up to three add/remove calls
-// through the real EventTarget, then compares dispatch with the recorder before
-// teardown. Two callbacks and both capture modes distinguish wrong identities;
-// omitted, boolean, and object options distinguish equivalent capture spellings.
-// Three calls reach add/remove/re-add. Once and signal options are outside this
-// recorder's installed-SDK domain.
-fixedCase(
-  `records EventTarget ownership across bounded listener histories`,
-  () => {
-    type Step = {
-      add: boolean
-      callback: number
-      options: boolean | { capture: boolean } | undefined
-    }
-    const options = [
-      undefined,
-      false,
-      true,
-      { capture: false },
-      { capture: true },
-    ]
-    const steps: Array<Step> = [false, true].flatMap((add) =>
-      [0, 1].flatMap((callback) =>
-        options.map((capture) => ({ add, callback, options: capture })),
-      ),
-    )
-    function* histories(prefix: Array<Step> = []): Generator<Array<Step>> {
-      yield prefix
-      if (prefix.length < 3)
-        for (const step of steps) yield* histories([...prefix, step])
-    }
-    let checked = 0
-    for (const history of histories()) {
-      const listeners = recordVisibilityListeners()
-      const callbacks = [vi.fn(), vi.fn()]
-      try {
-        for (const step of history) {
-          const callback = callbacks[step.callback]!
-          if (step.add)
-            document.addEventListener(
-              `visibilitychange`,
-              callback,
-              step.options,
-            )
-          else
-            document.removeEventListener(
-              `visibilitychange`,
-              callback,
-              step.options,
-            )
-        }
-        document.dispatchEvent(new Event(`visibilitychange`))
-        // Native dispatch supplies the independent count, including both capture
-        // identities of one callback. Teardown cannot change this observation.
-        const dispatched = callbacks.reduce(
-          (count, callback) => count + callback.mock.calls.length,
-          0,
-        )
-        expect(listeners.live(), JSON.stringify(history)).toBe(dispatched)
-        checked++
-      } finally {
-        listeners.restore()
-        for (const callback of callbacks) {
-          document.removeEventListener(`visibilitychange`, callback, false)
-          document.removeEventListener(`visibilitychange`, callback, true)
-        }
-      }
-    }
-    expect(checked).toBe(8421)
-  },
-  60_000,
-)
-
-// Teardown must preserve a failed comparison and release its registrations.
-// Enumerate every retained subset of three fresh callbacks. Dispatch observes
-// actual EventTarget ownership independently of the recorder's live count.
-fixedCase(
-  `releases recorded listeners after preserving a primary failure`,
-  async () => {
-    for (let retained = 0; retained < 8; retained++) {
-      const listeners = recordVisibilityListeners()
-      const callbacks = Array.from({ length: 3 }, () => vi.fn())
-      const primary = new Error(`listener comparison failed`)
-      try {
-        await expect(
-          withElectricCleanup(() => {
-            for (const [index, callback] of callbacks.entries()) {
-              document.addEventListener(`visibilitychange`, callback)
-              if ((retained & (1 << index)) === 0)
-                document.removeEventListener(`visibilitychange`, callback)
-            }
-            expect(listeners.registered()).toBe(3)
-            throw primary
-          }, [() => listeners.restore()]),
-        ).rejects.toBe(primary)
-        document.dispatchEvent(new Event(`visibilitychange`))
-        for (const callback of callbacks)
-          expect(callback).not.toHaveBeenCalled()
-      } finally {
-        // Independent cleanup also makes this calibration safe on the old recorder.
-        for (const callback of callbacks)
-          document.removeEventListener(`visibilitychange`, callback)
-        listeners.restore()
-      }
-    }
-  },
-)
-
-// Deliver a coordinator notification through the same persistence wrapper
-// used by the installed-SDK receiver. The test still controls the provider
-// response independently of this durable-cache notification.
-function controlledCoordinator(collectionId: string) {
-  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
-  return Object.assign(new SingleProcessCoordinator(), {
-    subscribe: (
-      _collectionId: string,
-      onMessage: (message: ProtocolEnvelope<unknown>) => void,
-    ) => {
-      subscriber = onMessage
-      return () => {
-        subscriber = undefined
-      }
-    },
-    emit: (payload: TxCommitted) => {
-      subscriber?.({
-        v: 1,
-        dbName: `sdk-receiver`,
-        collectionId,
-        senderId: `other-tab`,
-        ts: Date.now(),
-        payload,
-      })
-    },
-  })
-}
-
-const headers = (offset: number) => ({
-  'electric-handle': `shape`,
-  'electric-offset': `${offset}_0`,
-  'electric-cursor': String(offset),
-  'electric-up-to-date': `true`,
-  'electric-schema': JSON.stringify({
-    id: { type: `int4` },
-    name: { type: `text` },
-  }),
-})
 let sequence = 0
 
 function resetResumeMetadata(): SyncMetadataApi<string | number> {
@@ -847,7 +501,12 @@ fixedCase(
   },
 )
 
-fixedCase(`lets requestSnapshot own the warm transport`, async () => {
+async function checkMembership(
+  leftWidth: number,
+  rightWidth: number,
+  cycles: number,
+  dropMoveIn = false,
+) {
   const http = controlledHttp()
   let delivery = deferred<void>()
   const subscribe = ShapeStream.prototype.subscribe
@@ -861,7 +520,13 @@ fixedCase(`lets requestSnapshot own the warm transport`, async () => {
         return subscribe.call(
           this,
           (messages) => {
-            const result = callback(messages)
+            const result = callback(
+              dropMoveIn
+                ? messages.filter(
+                    (message) => message.headers.event !== `move-in`,
+                  )
+                : messages,
+            )
             delivery.resolve()
             return result
           },
@@ -870,7 +535,7 @@ fixedCase(`lets requestSnapshot own the warm transport`, async () => {
       }),
     [
       {
-        label: `warm HTTP provider during spy setup`,
+        label: `membership HTTP provider during spy setup`,
         release: () => http.close(),
       },
     ],
@@ -879,147 +544,389 @@ fixedCase(`lets requestSnapshot own the warm transport`, async () => {
     () =>
       createCollection(
         electricCollectionOptions<Item>({
-          id: `sdk-warm-snapshot-${++sequence}`,
+          id: `sdk-membership-${++sequence}`,
           shapeOptions: {
-            url: `http://test-url/warm-snapshot-${sequence}`,
+            url: `http://test-url/membership-${sequence}`,
             params: { table: `rows` },
             fetchClient: http.fetchClient,
           },
-          syncMode: `on-demand`,
           startSync: true,
           getKey: (row) => row.id,
         }),
       ),
     [
-      { label: `warm HTTP provider during setup`, release: () => http.close() },
       {
-        label: `warm subscription spy during setup`,
+        label: `membership HTTP provider during setup`,
+        release: () => http.close(),
+      },
+      {
+        label: `membership subscription spy during setup`,
         release: () => spy.mockRestore(),
       },
     ],
   )
-
-  return withElectricCleanup(async () => {
-    const initial = await atCheckpoint(http.take(), `initial live request`)
-    initial.respond(
+  // A fixed OR of two AND groups. The expected state is just a bit set,
+  // independent of the adapter's tag indexes and mutable DNF arrays.
+  const width = leftWidth + rightWidth
+  const left = (1 << leftWidth) - 1
+  const right = ((1 << width) - 1) ^ left
+  let active = left | right
+  const groups = [left, right]
+  const hashes = Array.from({ length: width }, (_unused, pos) => `hash_${pos}`)
+  let offset = 0
+  async function send(message: unknown, label: string) {
+    delivery = deferred<void>()
+    const request = await atCheckpoint(http.take(), `membership request`)
+    request.respond(
       new Response(
         JSON.stringify([
+          message,
           {
             headers: {
               control: `up-to-date`,
-              global_last_seen_lsn: `1`,
+              global_last_seen_lsn: String(++offset),
             },
           },
         ]),
-        { headers: headers(1) },
+        { headers: headers(offset) },
       ),
     )
-    await atCheckpoint(delivery.promise, `initial up-to-date delivery`)
-
-    // Hold the next live poll. The installed SDK's requestSnapshot owns the
-    // pause/abort transition from this poll to the subset request.
-    await atCheckpoint(http.take(), `warm live poll`)
-    delivery = deferred<void>()
-    const loading = collection._sync.loadSubset({
-      where: new IR.Func(`gte`, [new IR.PropRef([`id`]), new IR.Value(1)]),
-    })
-    const request = await atCheckpoint(
-      http.takeAny(),
-      `first request after warm loadSubset`,
+    await atCheckpoint(delivery.promise, `membership delivery`)
+    const visible = groups.some((group) => (active & group) === group)
+    expect(
+      collection.toArray.map(({ id, name }) => ({ id, name })),
+      label,
+    ).toEqual(visible ? [{ id: 1, name: `member` }] : [])
+  }
+  async function move(
+    event: `move-in` | `move-out`,
+    pos: number,
+    label: string,
+  ) {
+    if (event === `move-in`) active |= 1 << pos
+    else active &= ~(1 << pos)
+    await send(
+      { headers: { event, patterns: [{ pos, value: hashes[pos] }] } },
+      label,
     )
-    expect(request.url.searchParams.has(`subset__where`)).toBe(true)
-    expect(http.activeCount()).toBe(1)
-    request.respond(
-      new Response(
-        JSON.stringify({
-          metadata: {
-            xmin: `10`,
-            xmax: `20`,
-            xip_list: [],
-            database_lsn: `10`,
-            snapshot_mark: 2,
-          },
-          data: [],
-        }),
-        { headers: headers(2) },
-      ),
+  }
+  return withElectricCleanup(async () => {
+    await send(
+      {
+        key: `1`,
+        value: { id: `1`, name: `member` },
+        headers: {
+          operation: `insert`,
+          tags: groups.map((group) =>
+            hashes
+              .map((hash, pos) => (group & (1 << pos) ? hash : ``))
+              .join(`/`),
+          ),
+          active_conditions: hashes.map(() => true),
+        },
+      },
+      `initial membership`,
     )
-    await atCheckpoint(delivery.promise, `warm snapshot delivery`)
-    await atCheckpoint(Promise.resolve(loading), `warm snapshot completion`)
+    // This is the supported move-out/in/out cycle in tags.test.ts. Both
+    // disjuncts retain at least one live alternative until the final deletion;
+    // no move-in is used to resurrect a row whose tag index was removed.
+    for (let cycle = 0; cycle < cycles; cycle++) {
+      await move(`move-out`, 0, `cycle ${cycle} left inactive`)
+      await move(`move-in`, 0, `cycle ${cycle} silent left reactivation`)
+      await move(`move-out`, leftWidth, `cycle ${cycle} after silent move-in`)
+      await move(
+        `move-in`,
+        leftWidth,
+        `cycle ${cycle} silent right reactivation`,
+      )
+    }
+    await move(`move-out`, 0, `one disjunct remains`)
+    await move(`move-out`, leftWidth, `all disjuncts inactive`)
+    await atCheckpoint(http.take(), `pending membership poll`)
   }, [
-    { label: `warm collection`, release: () => collection.cleanup() },
-    { label: `warm HTTP provider`, release: () => http.close() },
-    { label: `warm subscription spy`, release: () => spy.mockRestore() },
+    { label: `membership collection`, release: () => collection.cleanup() },
+    {
+      label: `membership requests after collection cleanup`,
+      release: () => expect(http.activeCount()).toBe(0),
+    },
+    { label: `membership HTTP provider`, release: () => http.close() },
+    { label: `membership subscription spy`, release: () => spy.mockRestore() },
     {
-      label: `warm requests after provider closure`,
+      label: `membership requests after provider closure`,
       release: () => expect(http.activeCount()).toBe(0),
     },
   ])
-})
+}
 
-/**
- * The installed SDK can finish a subset HTTP response after the shared stream
- * was externally aborted. The stream can no longer apply that row, so the
- * adapter must reject the demand and leave its predicate uncertified. This
- * receives the oracle's external-abort law through the real requestSnapshot
- * transport rather than relying on a mocked provider promise.
- */
-fixedCase(`does not certify an aborted SDK subset snapshot`, async () => {
-  const http = controlledHttp()
-  const external = new AbortController()
-  const collection = createCollection(
-    electricCollectionOptions<Item>({
-      id: `sdk-subset-abort-${++sequence}`,
-      shapeOptions: {
-        url: `http://test-url/subset-abort-${sequence}`,
-        params: { table: `rows` },
-        fetchClient: http.fetchClient,
-        signal: external.signal,
-      },
-      syncMode: `on-demand`,
-      startSync: true,
-      getKey: (row) => row.id,
+// Grammar: two disjoint AND groups of 1..2 conditions, with 1..3 complete
+// move-out/in cycles and a final two-group deactivation. The 1/1/1 witness
+// reconstructs a dropped move-in at its visibility checkpoint. A width of 2
+// distinguishes one condition from a conjunction. Removing either width axis
+// loses that group's marginal case. Removing cycle count loses repeated
+// reactivation.
+// Each move-in has a preceding move-out, so the grammar excludes an unmatched
+// move-in and a move for a tag absent from the inserted row. It does not claim
+// row resurrection after the tag index has been removed. The first left
+// move-out leaves the right group active; it distinguishes OR from a wrong
+// rule that requires both groups to remain active.
+const membershipViolation = sameViolation()
+const membershipProperty = fc.asyncProperty(
+  fc.integer({ min: 1, max: 2 }),
+  fc.integer({ min: 1, max: 2 }),
+  fc.integer({ min: 1, max: 3 }),
+  (left, right, cycles) =>
+    membershipViolation.check({ left, right, cycles }, () =>
+      checkMembership(left, right, cycles, replayFault === `move-in`),
+    ),
+)
+sdkCampaigns(
+  `electric.sdk-dnf-membership`,
+  `preserves DNF visibility through installed-SDK silent move-in cycles`,
+  20260918,
+  membershipViolation,
+  (seed) =>
+    fc.assert(membershipProperty, {
+      ...oraclePropertyOptions(12, `electric.sdk-dnf-membership`),
+      ...(seed === undefined ? {} : { seed }),
     }),
-  )
+)
 
-  await withElectricCleanup(async () => {
-    await atCheckpoint(http.take(), `abortable live transport`)
-    const first = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-    void first.catch(() => undefined)
-    const request = await atCheckpoint(http.take(true), `abortable subset HTTP`)
-    external.abort()
-    request.respond(
-      new Response(
-        JSON.stringify({
-          metadata: {
-            xmin: `10`,
-            xmax: `20`,
-            xip_list: [],
-            database_lsn: `10`,
-            snapshot_mark: 1,
-          },
-          data: [
+fixedCase(`detects dropped move-in at its visibility checkpoint`, async () => {
+  await expect(checkMembership(1, 1, 1, true)).rejects.toMatchObject({
+    name: `AssertionError`,
+    message: expect.stringContaining(`after silent move-in`),
+  })
+})
+
+/**
+ * # The retry-decision law through the installed Electric client
+ *
+ * The retry-decision oracle in `electric-oracle.property.test.ts` drives the
+ * adapter through a controlled ShapeStream. This lane receives the same law
+ * through the installed `@electric-sql/client`, its retry policy, and HTTP.
+ * It uses the same independent model (`electric-retry-decision-model.ts`).
+ *
+ * The client turns three provider behaviors into the model's steps:
+ *
+ * - A 503 the client retries, then a complete snapshot: an error whose
+ *   decision is a retry, then the first up-to-date.
+ * - A response without Electric headers: an error whose decision is a retry,
+ *   then the client gives up by itself, because the error is not retryable.
+ * - Repeated 503 responses: an error and a retry for each one, until the
+ *   client spends its budget of 50 consecutive retries and gives up by
+ *   itself on the 51st error.
+ *
+ * The client gives up in the same continuation that receives the decision,
+ * so the checkpoint after that decision already includes the give-up.
+ *
+ * The grammar crosses those three behaviors with the eager, on-demand
+ * full-log, and progressive sync modes, and with a synchronous or an
+ * asynchronous retry from `onError`. Each history starts one waiting demand
+ * and, after the outcome, one later demand. A full-log demand is a subset
+ * load. An eager or progressive Collection has no subset demand before its
+ * first ready, so its demand is the readiness wait (`preload()`).
+ *
+ * At each checkpoint the lane compares the Collection status, each demand's
+ * settlement, and whether the snapshot's row is visible with the model:
+ * after the first error reaches `onError`, after an asynchronous decision,
+ * after the outcome, and after the later demand. It also checks that a
+ * full-log Collection requests the full log, and that a client that gave up
+ * keeps no provider transport open. A rejection's cause is
+ * compared only as a rejection here; the retry-decision oracle checks causes.
+ */
+type ClientOutcome = `retried-503` | `missing-headers` | `exhausted`
+type ClientMode = `eager` | `full-log` | `progressive`
+
+const clientRetryCells = (
+  [`retried-503`, `missing-headers`, `exhausted`] as const
+).flatMap((outcome) =>
+  ([`eager`, `full-log`, `progressive`] as const).flatMap((mode) =>
+    ([`sync-retry`, `async-retry`] as const).map(
+      (decision) => [outcome, mode, decision] as const,
+    ),
+  ),
+)
+
+// The installed client's documented consecutive-retry budget.
+const CLIENT_RETRY_BUDGET = 50
+
+// A rejection's cause, and the readiness wait's cause, are checked by the
+// controlled retry-decision oracle. Here a non-full-log demand is itself a
+// readiness wait.
+function clientObservation(observation: RetryObservation): RetryObservation {
+  return {
+    status: observation.status,
+    rowVisible: observation.rowVisible,
+    demands: observation.demands.map((settlement) =>
+      settlement.startsWith(`rejected`) ? `rejected:any` : settlement,
+    ),
+  }
+}
+
+async function runClientRetryCell(
+  outcome: ClientOutcome,
+  mode: ClientMode,
+  decision: Extract<RetryDecision, `sync-retry` | `async-retry`>,
+): Promise<void> {
+  const http = controlledHttp()
+  const decisions: Array<() => void> = []
+  let onErrorCalls = 0
+  const options = electricCollectionOptions<Item>({
+    id: `sdk-retry-${outcome}-${mode}-${decision}-${++sequence}`,
+    shapeOptions: {
+      url: `http://test-url/retry-${sequence}`,
+      params: { table: `rows` },
+      fetchClient: http.fetchClient,
+      backoffOptions: {
+        initialDelay: 0,
+        maxDelay: 0,
+        multiplier: 1,
+        maxRetries: 0,
+      },
+      onError: () => {
+        onErrorCalls++
+        if (decision === `sync-retry`) return {}
+        return new Promise<Record<string, never>>((resolve) => {
+          decisions.push(() => resolve({}))
+        })
+      },
+    },
+    syncMode:
+      mode === `eager`
+        ? `eager`
+        : mode === `progressive`
+          ? `progressive`
+          : `on-demand`,
+    startSync: true,
+    getKey: (row) => row.id,
+  })
+  const metadata = resetResumeMetadata()
+  const originalSync = options.sync
+  const collection = createCollection({
+    ...options,
+    sync:
+      mode === `full-log`
+        ? {
+            sync: (params: Parameters<typeof originalSync.sync>[0]) =>
+              originalSync.sync({ ...params, metadata }),
+          }
+        : originalSync,
+  })
+  const model: RetryModel = createRetryModel(false)
+  const settlements: Array<`pending` | `fulfilled` | `rejected:any`> = []
+  const track = (result: unknown) => {
+    const slot = settlements.push(`pending`) - 1
+    void Promise.resolve(result).then(
+      () => {
+        settlements[slot] = `fulfilled`
+      },
+      () => {
+        settlements[slot] = `rejected:any`
+      },
+    )
+  }
+  const demand = () =>
+    track(
+      mode === `full-log`
+        ? collection._sync.loadSubset({ limit: settlements.length + 1 })
+        : collection.preload(),
+    )
+  const step = (next: RetryStep) => applyRetryModel(model, next, true, `e`)
+  const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
+  const check = async (label: string) => {
+    await turn()
+    await turn()
+    expect(
+      clientObservation({
+        status: collection.status,
+        demands: [...settlements],
+        rowVisible: collection.has(1),
+      }),
+      `${outcome} ${mode} ${decision}: ${label}`,
+    ).toEqual(clientObservation(expectedRetryObservation(model, false)))
+  }
+  // Answer one request with an error, and settle its decision. When the
+  // client gives up after this decision, the same checkpoint shows it.
+  const failOnce = async (
+    response: Response,
+    label: string,
+    givesUp: boolean,
+  ) => {
+    const calls = onErrorCalls
+    const request = await atCheckpoint(http.take(), `${label} HTTP`)
+    // A full-log Collection asks the provider for the full log.
+    if (mode === `full-log`)
+      expect(request.url.searchParams.get(`log`)).toBe(`full`)
+    request.respond(response)
+    await vi.waitFor(() => expect(onErrorCalls).toBe(calls + 1))
+    step({ kind: `error`, decision })
+    if (decision === `async-retry`) {
+      await check(`${label} reached onError`)
+      decisions.shift()!()
+      step({ kind: `decide` })
+    }
+    if (givesUp) step({ kind: `client-give-up` })
+    await check(`${label} decided`)
+  }
+
+  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+  const consoleWarn = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  await withElectricCleanup(async () => {
+    demand()
+    step({ kind: `demand` })
+    if (outcome === `retried-503`) {
+      await failOnce(
+        new Response(`transient`, { status: 503 }),
+        `first 503`,
+        false,
+      )
+      const retry = await atCheckpoint(http.take(), `retried HTTP`)
+      retry.respond(
+        new Response(
+          JSON.stringify([
             {
               key: `1`,
-              value: { id: `1`, name: `discarded` },
+              value: { id: `1`, name: `recovered` },
               headers: { operation: `insert` },
             },
-          ],
-        }),
-        { headers: headers(2) },
-      ),
-    )
-    await expect(
-      atCheckpoint(first, `externally aborted SDK subset`),
-    ).rejects.toMatchObject({ name: `AbortError` })
-    expect(collection.has(1)).toBe(false)
-    const second = collection._sync.loadSubset({ limit: 1 })
-    expect(second).not.toBe(true)
-    await expect(Promise.resolve(second)).rejects.toMatchObject({
-      name: `AbortError`,
-    })
-  }, [() => collection.cleanup(), () => http.close()])
-})
+            { headers: { control: `up-to-date`, global_last_seen_lsn: `1` } },
+          ]),
+          { headers: headers(1) },
+        ),
+      )
+      await vi.waitFor(() => expect(collection.status).not.toBe(`loading`))
+      step({ kind: `up-to-date` })
+    } else if (outcome === `missing-headers`) {
+      await failOnce(new Response(`[]`, { status: 200 }), `headerless`, true)
+    } else {
+      // The client retries while its budget lasts, then gives up.
+      for (let attempt = 1; attempt <= CLIENT_RETRY_BUDGET + 1; attempt++) {
+        await failOnce(
+          new Response(`transient`, { status: 503 }),
+          `503 #${attempt}`,
+          attempt === CLIENT_RETRY_BUDGET + 1,
+        )
+      }
+    }
+    await check(`outcome`)
+    // A client that gave up keeps no provider transport open.
+    if (outcome !== `retried-503`) expect(http.activeCount()).toBe(0)
+    demand()
+    step({ kind: `demand` })
+    await check(`later demand`)
+  }, [
+    () => collection.cleanup(),
+    () => http.close(),
+    () => consoleError.mockRestore(),
+    () => consoleWarn.mockRestore(),
+  ])
+}
+
+fixedCase.each(clientRetryCells)(
+  `installed client: %s in %s mode with an onError %s follows the retry-decision model`,
+  (outcome, mode, decision) => runClientRetryCell(outcome, mode, decision),
+  60_000,
+)
 
 /**
  * A managed cache claim can expire while an installed SDK snapshot request is
@@ -1406,1136 +1313,6 @@ sdkCampaigns(
   },
 )
 
-/**
- * An expired run can rotate without Electric reset metadata, then persist one
- * demanded source row in its private generation. That row is a partial cache,
- * not an offline source snapshot. After a cold restart, the provider model has
- * no matching row. Real SQLite supplies incompatible key-set evidence and no
- * resume record; the installed SDK holds an empty subset HTTP response. Before
- * and after that response, the public Collection must not expose the stale
- * cached row. The generation must rotate before it can serve the new demand,
- * even when the caller supplies an explicit source offset or handle. Those
- * source cursor options do not certify the persisted cache's key set.
- */
-fixedCase.each([
-  { cursor: `none`, shapeCursor: {} },
-  { cursor: `explicit offset`, shapeCursor: { offset: `now` as const } },
-  { cursor: `explicit handle`, shapeCursor: { handle: `explicit-shape` } },
-])(
-  `keeps a partial cache without a reset marker private after cold restart with $cursor`,
-  async ({ shapeCursor }) => {
-    const database = new DatabaseSync(`:memory:`)
-    const adapter = new SQLiteCorePersistenceAdapter({
-      driver: nodeSqliteDriver(database),
-    })
-    const collectionId = `sdk-cold-expired-cache-${++sequence}`
-    const first = await adapter.claimCacheGeneration(collectionId)
-    const partial = await adapter.rotateCacheGeneration(
-      collectionId,
-      first.claimId,
-    )
-    await adapter.applyCommittedTx(
-      {
-        kind: `managed`,
-        storageCollectionId: partial.storageCollectionId,
-        claimId: partial.claimId,
-      },
-      {
-        txId: `partial-subset-row`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        cacheGenerationClaimId: partial.claimId,
-        mutations: [
-          {
-            type: `insert`,
-            key: 1,
-            value: { id: 1, name: `stale-partial` },
-          },
-        ],
-      },
-    )
-    const seeded = await adapter.loadResumeSnapshot(
-      {
-        kind: `managed`,
-        storageCollectionId: partial.storageCollectionId,
-        claimId: partial.claimId,
-      },
-      { cacheGenerationClaimId: partial.claimId },
-    )
-    expect(seeded.keySet).toEqual({ status: `incompatible` })
-    expect(seeded.collectionMetadata).toEqual([])
-    await adapter.releaseCacheGenerationClaim(partial.claimId)
-
-    const http = controlledHttp()
-    const electric = electricCollectionOptions<Item>({
-      id: collectionId,
-      shapeOptions: {
-        url: `http://test-url/${collectionId}`,
-        params: { table: `rows` },
-        fetchClient: http.fetchClient,
-        ...shapeCursor,
-      },
-      syncMode: `on-demand`,
-      startSync: true,
-      getKey: (row) => row.id,
-    })
-    const collection = createCollection(
-      persistedCollectionOptions<
-        Item,
-        string | number,
-        never,
-        ElectricCollectionUtils<Item>
-      >({ ...electric, persistence: { adapter } }),
-    )
-
-    try {
-      await withElectricCleanup(async () => {
-        const stream = await atCheckpoint(http.take(), `cold restart stream`)
-        expect(stream.url.searchParams.get(`log`)).toBe(`changes_only`)
-        const load = Promise.resolve(
-          collection._sync.loadSubset({
-            where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(1)]),
-          }),
-        )
-        void load.catch(() => undefined)
-        const request = await atCheckpoint(
-          http.take(true),
-          `cold restart source snapshot`,
-        )
-        expect(collection.get(1), `before source evidence`).toBeUndefined()
-        const current = await adapter.claimCacheGeneration(collectionId)
-        try {
-          expect(current.storageCollectionId).not.toBe(
-            partial.storageCollectionId,
-          )
-        } finally {
-          await adapter.releaseCacheGenerationClaim(current.claimId)
-        }
-
-        request.respond(
-          new Response(
-            JSON.stringify({
-              metadata: {
-                xmin: `10`,
-                xmax: `20`,
-                xip_list: [],
-                database_lsn: `10`,
-                snapshot_mark: 2,
-              },
-              data: [],
-            }),
-            { headers: headers(2) },
-          ),
-        )
-        await atCheckpoint(load, `empty source snapshot applied`)
-        expect(collection.status).toBe(`ready`)
-        expect(collection.get(1), `after empty source evidence`).toBeUndefined()
-      }, [() => collection.cleanup(), () => http.close()])
-    } finally {
-      database.close()
-    }
-  },
-)
-
-/**
- * Two active demands share one ShapeStream cursor. The source model gives each
- * predicate one row and increasing offsets. The second provider snapshot may
- * start only after the first settles; otherwise an older HTTP response can
- * overwrite a later row and regress that cursor. The SDK method invocation is
- * the checkpoint, while public rows verify both acquisitions still apply.
- */
-fixedCase(
-  `serializes concurrent subset snapshots on one SDK stream`,
-  async () => {
-    const http = controlledHttp()
-    const requestSnapshot = vi.spyOn(ShapeStream.prototype, `requestSnapshot`)
-    const collection = createCollection(
-      electricCollectionOptions<Item>({
-        id: `sdk-ordered-snapshots-${++sequence}`,
-        shapeOptions: {
-          url: `http://test-url/ordered-snapshots-${sequence}`,
-          params: { table: `rows` },
-          fetchClient: http.fetchClient,
-        },
-        syncMode: `on-demand`,
-        startSync: true,
-        getKey: (row) => row.id,
-      }),
-    )
-    const demand = (id: number) => ({
-      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(id)]),
-    })
-    const respond = (request: Request, id: number) =>
-      request.respond(
-        new Response(
-          JSON.stringify({
-            metadata: {
-              xmin: `10`,
-              xmax: `20`,
-              xip_list: [],
-              database_lsn: `10`,
-              snapshot_mark: id,
-            },
-            data: [
-              {
-                key: String(id),
-                value: { id: String(id), name: `row-${id}` },
-                headers: { operation: `insert` },
-              },
-            ],
-          }),
-          { headers: headers(id + 1) },
-        ),
-      )
-    await withElectricCleanup(async () => {
-      await atCheckpoint(http.take(), `initial ordered-snapshot transport`)
-      const first = Promise.resolve(collection._sync.loadSubset(demand(1)))
-      const second = Promise.resolve(collection._sync.loadSubset(demand(2)))
-      const firstRequest = await atCheckpoint(
-        http.take(true),
-        `first ordered snapshot`,
-      )
-      await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      expect(
-        requestSnapshot,
-        `second snapshot waits for first`,
-      ).toHaveBeenCalledTimes(1)
-      respond(firstRequest, 1)
-      await atCheckpoint(first, `first ordered snapshot applied`)
-      const secondRequest = await atCheckpoint(
-        http.take(true),
-        `second ordered snapshot`,
-      )
-      expect(requestSnapshot).toHaveBeenCalledTimes(2)
-      respond(secondRequest, 2)
-      await atCheckpoint(second, `second ordered snapshot applied`)
-      expect(collection.toArray.map(({ id, name }) => ({ id, name }))).toEqual([
-        { id: 1, name: `row-1` },
-        { id: 2, name: `row-2` },
-      ])
-    }, [
-      () => collection.cleanup(),
-      () => http.close(),
-      () => requestSnapshot.mockRestore(),
-      () => expect(http.activeCount()).toBe(0),
-    ])
-  },
-)
-
-async function checkMembership(
-  leftWidth: number,
-  rightWidth: number,
-  cycles: number,
-  dropMoveIn = false,
-) {
-  const http = controlledHttp()
-  let delivery = deferred<void>()
-  const subscribe = ShapeStream.prototype.subscribe
-  const spy = await withElectricSetup(
-    () =>
-      vi.spyOn(ShapeStream.prototype, `subscribe`).mockImplementation(function (
-        this: ShapeStream,
-        callback,
-        onError,
-      ) {
-        return subscribe.call(
-          this,
-          (messages) => {
-            const result = callback(
-              dropMoveIn
-                ? messages.filter(
-                    (message) => message.headers.event !== `move-in`,
-                  )
-                : messages,
-            )
-            delivery.resolve()
-            return result
-          },
-          onError,
-        )
-      }),
-    [
-      {
-        label: `membership HTTP provider during spy setup`,
-        release: () => http.close(),
-      },
-    ],
-  )
-  const collection = await withElectricSetup(
-    () =>
-      createCollection(
-        electricCollectionOptions<Item>({
-          id: `sdk-membership-${++sequence}`,
-          shapeOptions: {
-            url: `http://test-url/membership-${sequence}`,
-            params: { table: `rows` },
-            fetchClient: http.fetchClient,
-          },
-          startSync: true,
-          getKey: (row) => row.id,
-        }),
-      ),
-    [
-      {
-        label: `membership HTTP provider during setup`,
-        release: () => http.close(),
-      },
-      {
-        label: `membership subscription spy during setup`,
-        release: () => spy.mockRestore(),
-      },
-    ],
-  )
-  // A fixed OR of two AND groups. The expected state is just a bit set,
-  // independent of the adapter's tag indexes and mutable DNF arrays.
-  const width = leftWidth + rightWidth
-  const left = (1 << leftWidth) - 1
-  const right = ((1 << width) - 1) ^ left
-  let active = left | right
-  const groups = [left, right]
-  const hashes = Array.from({ length: width }, (_unused, pos) => `hash_${pos}`)
-  let offset = 0
-  async function send(message: unknown, label: string) {
-    delivery = deferred<void>()
-    const request = await atCheckpoint(http.take(), `membership request`)
-    request.respond(
-      new Response(
-        JSON.stringify([
-          message,
-          {
-            headers: {
-              control: `up-to-date`,
-              global_last_seen_lsn: String(++offset),
-            },
-          },
-        ]),
-        { headers: headers(offset) },
-      ),
-    )
-    await atCheckpoint(delivery.promise, `membership delivery`)
-    const visible = groups.some((group) => (active & group) === group)
-    expect(
-      collection.toArray.map(({ id, name }) => ({ id, name })),
-      label,
-    ).toEqual(visible ? [{ id: 1, name: `member` }] : [])
-  }
-  async function move(
-    event: `move-in` | `move-out`,
-    pos: number,
-    label: string,
-  ) {
-    if (event === `move-in`) active |= 1 << pos
-    else active &= ~(1 << pos)
-    await send(
-      { headers: { event, patterns: [{ pos, value: hashes[pos] }] } },
-      label,
-    )
-  }
-  return withElectricCleanup(async () => {
-    await send(
-      {
-        key: `1`,
-        value: { id: `1`, name: `member` },
-        headers: {
-          operation: `insert`,
-          tags: groups.map((group) =>
-            hashes
-              .map((hash, pos) => (group & (1 << pos) ? hash : ``))
-              .join(`/`),
-          ),
-          active_conditions: hashes.map(() => true),
-        },
-      },
-      `initial membership`,
-    )
-    // This is the supported move-out/in/out cycle in tags.test.ts. Both
-    // disjuncts retain at least one live alternative until the final deletion;
-    // no move-in is used to resurrect a row whose tag index was removed.
-    for (let cycle = 0; cycle < cycles; cycle++) {
-      await move(`move-out`, 0, `cycle ${cycle} left inactive`)
-      await move(`move-in`, 0, `cycle ${cycle} silent left reactivation`)
-      await move(`move-out`, leftWidth, `cycle ${cycle} after silent move-in`)
-      await move(
-        `move-in`,
-        leftWidth,
-        `cycle ${cycle} silent right reactivation`,
-      )
-    }
-    await move(`move-out`, 0, `one disjunct remains`)
-    await move(`move-out`, leftWidth, `all disjuncts inactive`)
-    await atCheckpoint(http.take(), `pending membership poll`)
-  }, [
-    { label: `membership collection`, release: () => collection.cleanup() },
-    {
-      label: `membership requests after collection cleanup`,
-      release: () => expect(http.activeCount()).toBe(0),
-    },
-    { label: `membership HTTP provider`, release: () => http.close() },
-    { label: `membership subscription spy`, release: () => spy.mockRestore() },
-    {
-      label: `membership requests after provider closure`,
-      release: () => expect(http.activeCount()).toBe(0),
-    },
-  ])
-}
-
-// Grammar: two disjoint AND groups of 1..2 conditions, with 1..3 complete
-// move-out/in cycles and a final two-group deactivation. The 1/1/1 witness
-// reconstructs a dropped move-in at its visibility checkpoint. A width of 2
-// distinguishes one condition from a conjunction. Removing either width axis
-// loses that group's marginal case. Removing cycle count loses repeated
-// reactivation.
-// Each move-in has a preceding move-out, so the grammar excludes an unmatched
-// move-in and a move for a tag absent from the inserted row. It does not claim
-// row resurrection after the tag index has been removed. The first left
-// move-out leaves the right group active; it distinguishes OR from a wrong
-// rule that requires both groups to remain active.
-const membershipViolation = sameViolation()
-const membershipProperty = fc.asyncProperty(
-  fc.integer({ min: 1, max: 2 }),
-  fc.integer({ min: 1, max: 2 }),
-  fc.integer({ min: 1, max: 3 }),
-  (left, right, cycles) =>
-    membershipViolation.check({ left, right, cycles }, () =>
-      checkMembership(left, right, cycles, replayFault === `move-in`),
-    ),
-)
-sdkCampaigns(
-  `electric.sdk-dnf-membership`,
-  `preserves DNF visibility through installed-SDK silent move-in cycles`,
-  20260918,
-  membershipViolation,
-  (seed) =>
-    fc.assert(membershipProperty, {
-      ...oraclePropertyOptions(12, `electric.sdk-dnf-membership`),
-      ...(seed === undefined ? {} : { seed }),
-    }),
-)
-
-fixedCase(`detects dropped move-in at its visibility checkpoint`, async () => {
-  await expect(checkMembership(1, 1, 1, true)).rejects.toMatchObject({
-    name: `AssertionError`,
-    message: expect.stringContaining(`after silent move-in`),
-  })
-})
-
-/**
- * Restart demand must remain legal when recovery changes provider capability.
- * Electric's SDK permits requestSnapshot only in changes_only mode. The
- * LoadSubsetFn contract requires success to follow application of the rows
- * that establish the requested subset. This receiving witness uses the real
- * SDK with the same durable-storage seam as the tag-history owner.
- *
- * The independent model is a complete replacement row after the second
- * launch. Tagged and untagged launches differ only in provider acquisition:
- * the tagged launch cannot resume its prior cursor, but its on-demand stream
- * can start changes-only and request the active subset. The untagged neighbor
- * resumes its cursor. Both must satisfy the same subset demand.
- * A new descriptor and Collection discard all prior in-memory tag state.
- * This checks SDK behavior over controlled HTTP, not server tag generation,
- * native SQLite, or a separate operating-system process.
- * One source snapshot for id = 1 may satisfy the live query's active demand.
- * The receiver verifies that scope before returning the authored row. The
- * law judges applied rows and demand settlement, not the number of physical
- * snapshot requests.
- */
-fixedCase.each(
-  [false, true].flatMap((tagged) =>
-    ([`direct`, `live-query`] as const).map((consumer) => ({
-      tagged,
-      consumer,
-    })),
-  ),
-)(
-  `satisfies subset demand after a fresh persisted launch, tagged=$tagged consumer=$consumer`,
-  async ({ tagged, consumer }) => {
-    const { adapter, rows, metadata } = managedTagPersistence()
-    const collectionId = `sdk-persisted-restart-${++sequence}`
-    const http = controlledHttp()
-    const firstRow: TestRow = { id: 1, name: `first`, stable: `retained` }
-    const replacement: TestRow = { ...firstRow, name: `replacement` }
-    const create = () =>
-      createCollection(
-        persistedCollectionOptions<
-          TestRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<TestRow>
-        >({
-          ...electricCollectionOptions<TestRow>({
-            id: collectionId,
-            shapeOptions: {
-              url: `http://test-url/${collectionId}`,
-              params: { table: `rows` },
-              fetchClient: http.fetchClient,
-            },
-            syncMode: `on-demand`,
-            startSync: true,
-            getKey: (row) => row.id,
-          }),
-          persistence: { adapter },
-        }),
-      )
-    const message = (row: TestRow) => ({
-      key: String(row.id),
-      value: { ...row, id: String(row.id) },
-      headers: {
-        operation: `insert`,
-        ...(tagged ? { tags: [`selected`] } : {}),
-      },
-    })
-    const responseHeaders = (offset: number) => ({
-      ...headers(offset),
-      'electric-schema': JSON.stringify({
-        id: { type: `int4` },
-        name: { type: `text` },
-        stable: { type: `text` },
-      }),
-    })
-    const snapshotResponse = (row: TestRow, offset: number) =>
-      new Response(
-        JSON.stringify({
-          metadata: {
-            xmin: `10`,
-            xmax: `20`,
-            xip_list: [],
-            database_lsn: `10`,
-            snapshot_mark: offset,
-          },
-          data: [message(row)],
-        }),
-        { headers: responseHeaders(offset) },
-      )
-    const demand = {
-      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(1)]),
-    }
-    const expectIdOneSnapshot = (request: Request) => {
-      expect(request.url.searchParams.get(`subset__where`)).toBe(`"id" = $1`)
-      expect(
-        JSON.parse(request.url.searchParams.get(`subset__params`) ?? `null`),
-      ).toEqual({ 1: `1` })
-    }
-    const first = create()
-    let current = first
-    let cleanupQuery = () => Promise.resolve()
-    await withElectricCleanup(async () => {
-      const initial = await atCheckpoint(
-        http.take(),
-        `first launch stream started`,
-      )
-      expect(initial.url.searchParams.get(`log`)).toBe(`changes_only`)
-      const firstLoad = Promise.resolve(first._sync.loadSubset(demand))
-      void firstLoad.catch(() => undefined)
-      const request = await atCheckpoint(
-        http.take(true),
-        `first launch snapshot`,
-      )
-      expectIdOneSnapshot(request)
-      request.respond(snapshotResponse(firstRow, 2))
-      await atCheckpoint(firstLoad, `first launch subset applied`)
-      await vi.waitFor(
-        () =>
-          expect(metadata().get(`electric:resume`)).toMatchObject({
-            kind: `resume`,
-            requiresTagState: tagged,
-          }),
-        { interval: 1 },
-      )
-      expect(rows().get(1)?.value).toEqual(firstRow)
-      await first.cleanup()
-
-      current = create()
-      const resumed = await atCheckpoint(
-        http.take(),
-        `second launch stream started`,
-      )
-      expect(resumed.url.searchParams.get(`log`)).toBe(`changes_only`)
-      expect(resumed.url.searchParams.get(`offset`)).toBe(
-        tagged ? `now` : `2_0`,
-      )
-      const query =
-        consumer === `live-query`
-          ? createLiveQueryCollection({
-              startSync: false,
-              query: (q) =>
-                q
-                  .from({ row: current })
-                  .where(({ row }) => eq(row.id, 1))
-                  .select(({ row }) => ({
-                    id: row.id,
-                    name: row.name,
-                    stable: row.stable,
-                  })),
-            })
-          : undefined
-      if (query) cleanupQuery = () => query.cleanup()
-      const loading = Promise.resolve(
-        query ? query.preload() : current._sync.loadSubset(demand),
-      ).then(
-        () => ({ kind: `fulfilled` as const }),
-        (error: unknown) => ({
-          kind: `rejected` as const,
-          error: String(error),
-        }),
-      )
-      const resumedSnapshot = await atCheckpoint(
-        http.take(true),
-        `resumed subset snapshot`,
-      )
-      expectIdOneSnapshot(resumedSnapshot)
-      resumedSnapshot.respond(snapshotResponse(replacement, 3))
-      const outcome = await atCheckpoint(
-        loading,
-        `second launch subset settled`,
-      )
-      await vi.waitFor(() => expect(current.status).toBe(`ready`), {
-        interval: 1,
-      })
-      await vi.waitFor(
-        () => expect(rows().get(1)?.value).toEqual(replacement),
-        {
-          interval: 1,
-        },
-      )
-      // Observe settlement as well as rows. A ready Collection with correct
-      // rows cannot excuse a rejected subset acquisition.
-      expect({
-        outcome,
-        status: current.status,
-        row: current.get(1),
-      }).toMatchObject({
-        outcome: { kind: `fulfilled` },
-        status: `ready`,
-        row: replacement,
-      })
-      if (query) {
-        expect(query.status).toBe(`ready`)
-        // This law observes selected payload values, not virtual metadata.
-        expect(
-          query.toArray.map(({ id, name, stable }) => ({ id, name, stable })),
-        ).toEqual([replacement])
-      }
-    }, [
-      () => cleanupQuery(),
-      () => current.cleanup(),
-      () => first.cleanup(),
-      () => http.close(),
-      () => expect(http.activeCount()).toBe(0),
-    ])
-  },
-)
-
-/**
- * A persisted source row is only a cache after tag state is lost. The source
- * model starts with A and B, then changes A and removes B while the Collection
- * is closed. Only A is active at the second launch. Its scoped snapshot may
- * establish A, but neither the old B row nor a later empty B snapshot may
- * re-admit B from SQLite. This driver observes HTTP scope, durable rows, local
- * reads, public rows, and acquisition settlement at each cut. The controlled
- * provider supplies authoritative responses for the requested predicates;
- * live-server framing and native storage remain separate receiving boundaries.
- * A local cache clear is not source readiness: the restarted Collection stays
- * loading at the stream-request cut, before Electric sends source evidence.
- */
-fixedCase.each([
-  { cause: `lost tags`, tagged: true, nextTable: `rows` },
-  { cause: `changed shape`, tagged: false, nextTable: `other_rows` },
-  {
-    cause: `malformed resume state`,
-    tagged: false,
-    nextTable: `rows`,
-    malformed: true,
-  },
-])(
-  `quarantines uncertified cache rows across later scoped demands after $cause`,
-  async ({ tagged, nextTable, malformed }) => {
-    const fixture = managedTagPersistence()
-    const { adapter, rows, metadata } = fixture
-    const baselineReads = vi.spyOn(adapter, `loadResumeSnapshot`)
-    const http = controlledHttp()
-    const collectionId = `sdk-scoped-restart-${++sequence}`
-    const coordinator = controlledCoordinator(collectionId)
-    let currentCapability: SyncPersistenceCapabilityV1<string | number> | null =
-      null
-    const source = new Map<number, TestRow>([
-      [1, { id: 1, name: `old-a`, stable: `a` }],
-      [2, { id: 2, name: `old-b`, stable: `b` }],
-    ])
-    const demand = (id: number) => ({
-      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(id)]),
-    })
-    const create = (table = `rows`) => {
-      const electricOptions = electricCollectionOptions<TestRow>({
-        id: collectionId,
-        shapeOptions: {
-          url: `http://test-url/${collectionId}`,
-          params: { table },
-          fetchClient: http.fetchClient,
-        },
-        syncMode: `on-demand`,
-        startSync: true,
-        getKey: (row) => row.id,
-      })
-      return createCollection(
-        persistedCollectionOptions<
-          TestRow,
-          string | number,
-          never,
-          ElectricCollectionUtils<TestRow>
-        >({
-          ...electricOptions,
-          sync: {
-            ...electricOptions.sync,
-            sync: (params) => {
-              currentCapability = params.metadata?.persistence ?? null
-              return electricOptions.sync.sync(params)
-            },
-          },
-          persistence: { adapter, coordinator },
-        }),
-      )
-    }
-    const respond = (
-      request: Request,
-      result: Array<TestRow>,
-      offset: number,
-    ) =>
-      request.respond(
-        new Response(
-          JSON.stringify({
-            metadata: {
-              xmin: `10`,
-              xmax: `20`,
-              xip_list: [],
-              database_lsn: `10`,
-              snapshot_mark: offset,
-            },
-            data: result.map((row) => ({
-              key: String(row.id),
-              value: { ...row, id: String(row.id) },
-              headers: {
-                operation: `insert`,
-                ...(tagged ? { tags: [`selected`] } : {}),
-              },
-            })),
-          }),
-          {
-            headers: {
-              ...headers(offset),
-              'electric-schema': JSON.stringify({
-                id: { type: `int4` },
-                name: { type: `text` },
-                stable: { type: `text` },
-              }),
-            },
-          },
-        ),
-      )
-    const publicRows = (collection: ReturnType<typeof create>) =>
-      collection.toArray
-        .map(({ id, name, stable }) => ({ id, name, stable }))
-        .sort((a, b) => a.id - b.id)
-    const first = create()
-    let current = first
-    let localReads: { mockRestore: () => void } | undefined
-    await withElectricCleanup(async () => {
-      await atCheckpoint(http.take(), `initial changes-only transport`)
-      for (const [id, row] of source) {
-        const loading = Promise.resolve(first._sync.loadSubset(demand(id)))
-        const request = await atCheckpoint(
-          http.take(true),
-          `initial subset ${id}`,
-        )
-        respond(request, [row], id + 1)
-        await atCheckpoint(loading, `initial subset ${id} applied`)
-      }
-      expect(publicRows(first)).toEqual([...source.values()])
-      expect(rows().size).toBe(2)
-      expect(metadata().get(`electric:resume`)).toMatchObject({
-        kind: `resume`,
-        requiresTagState: tagged,
-      })
-      await first.cleanup()
-      baselineReads.mockClear()
-      if (malformed) {
-        metadata().set(`electric:resume`, { kind: `resume`, offset: 10 })
-      }
-      const oldStorageId = fixture.currentStorageId()
-
-      source.set(1, { id: 1, name: `new-a`, stable: `a` })
-      source.delete(2)
-      localReads = vi.spyOn(adapter, `loadSubset`)
-      current = create(nextTable)
-      const resumed = await atCheckpoint(
-        http.take(),
-        `scoped restart transport`,
-      )
-      expect(resumed.url.searchParams.get(`log`)).toBe(`changes_only`)
-      expect(resumed.url.searchParams.get(`offset`)).toBe(`now`)
-      expect(publicRows(current), `before active demand`).toEqual([])
-      expect(current.status, `before source readiness`).toBe(`loading`)
-      expect(baselineReads, `startup metadata read`).toHaveBeenCalled()
-      expect(
-        baselineReads.mock.calls.every(
-          ([, context]) => context?.includeRows !== true,
-        ),
-        `no full baseline row read`,
-      ).toBe(true)
-
-      if (!tagged) {
-        // An empty first source snapshot must still establish its own demand
-        // without promoting the stale durable B row into the Collection.
-        const emptyFirst = Promise.resolve(current._sync.loadSubset(demand(2)))
-        const emptyRequest = await atCheckpoint(
-          http.take(true),
-          `first empty scoped snapshot`,
-        )
-        expect(localReads).not.toHaveBeenCalled()
-        respond(emptyRequest, [], 4)
-        await atCheckpoint(emptyFirst, `first empty subset applied`)
-        expect(publicRows(current), `after first empty subset`).toEqual([])
-      }
-
-      const loadingA = Promise.resolve(
-        current._sync.loadSubset({ ...demand(1), limit: 10 }),
-      )
-      const requestA = await atCheckpoint(http.take(true), `scoped A snapshot`)
-      expect(requestA.url.searchParams.get(`subset__where`)).toContain(`id`)
-      expect(localReads).not.toHaveBeenCalled()
-      respond(requestA, [source.get(1)!], tagged ? 4 : 5)
-      await atCheckpoint(loadingA, `scoped A applied`)
-      expect(publicRows(current), `after A applied`).toEqual([source.get(1)])
-      expect(
-        fixture.rowsAt(oldStorageId).get(2)?.value,
-        `durable B retained`,
-      ).toEqual({
-        id: 2,
-        name: `old-b`,
-        stable: `b`,
-      })
-
-      // A second tab updates durable cache outside the active A demand. The
-      // provider has not sent another source change, so the public A row still
-      // follows its applied source snapshot. The capability scan fences the
-      // coordinator's async handling before this public observation.
-      const durablePosition = await adapter.loadResumeSnapshot(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          includeRows: false,
-        },
-      )
-      const otherTabRow: TestRow = {
-        id: 3,
-        name: `other-tab-cache`,
-        stable: `c`,
-      }
-      source.set(3, otherTabRow)
-      rows().set(3, { value: otherTabRow })
-      coordinator.emit({
-        type: `tx:committed`,
-        term: durablePosition.latestTerm,
-        seq: durablePosition.latestSeq + 1,
-        txId: `other-tab-cache-update`,
-        latestRowVersion: durablePosition.latestRowVersion + 1,
-        requiresFullReload: false,
-        changedRows: [{ key: 3, value: otherTabRow }],
-        deletedKeys: [],
-      })
-      expect(currentCapability?.scanPersistedRows).toBeTypeOf(`function`)
-      await currentCapability!.scanPersistedRows()
-      expect(publicRows(current), `after coordinator invalidation`).toEqual([
-        source.get(1),
-      ])
-
-      if (tagged) {
-        // The coordinator may refresh A, but the new physical cache does not
-        // require that request. Service it first only if the provider sends
-        // it; either path must leave B absent after B's empty snapshot.
-        const loadingB = Promise.resolve(current._sync.loadSubset(demand(2)))
-        let requestB = await atCheckpoint(http.take(true), `empty B snapshot`)
-        let bOffset = 5
-        if (requestB.url.searchParams.get(`subset__params`)?.includes(`:"1"`)) {
-          respond(requestB, [source.get(1)!], 5)
-          requestB = await atCheckpoint(http.take(true), `empty B snapshot`)
-          bOffset = 6
-        }
-        expect(requestB.url.searchParams.get(`subset__params`)).toContain(`"2"`)
-        expect(publicRows(current), `while B is pending`).toEqual([
-          source.get(1),
-        ])
-        expect(localReads).not.toHaveBeenCalled()
-        respond(requestB, [], bOffset)
-        await atCheckpoint(loadingB, `empty B applied`)
-        expect(publicRows(current), `after empty B applied`).toEqual([
-          source.get(1),
-        ])
-      }
-      expect(metadata().get(`electric:resume`)).toMatchObject({ kind: `reset` })
-
-      await current.cleanup()
-      localReads.mockRestore()
-      localReads = vi.spyOn(adapter, `loadSubset`)
-      current = create(nextTable)
-      const idle = await atCheckpoint(http.take(), `idle scoped restart`)
-      expect(idle.url.searchParams.get(`log`)).toBe(`changes_only`)
-      expect(idle.url.searchParams.get(`offset`)).toBe(`now`)
-      expect(publicRows(current), `no active demand`).toEqual([])
-      expect(localReads, `no unrestricted local read`).not.toHaveBeenCalled()
-      expect(
-        baselineReads.mock.calls.every(
-          ([, context]) => context?.includeRows !== true,
-        ),
-        `no full baseline row read without demand`,
-      ).toBe(true)
-      expect(
-        fixture.rowsAt(oldStorageId).get(2)?.value,
-        `cache retained without demand`,
-      ).toMatchObject({
-        id: 2,
-        name: `old-b`,
-      })
-    }, [
-      () => current.cleanup(),
-      () => first.cleanup(),
-      () => http.close(),
-      () => localReads?.mockRestore(),
-      () => baselineReads.mockRestore(),
-      () => expect(http.activeCount()).toBe(0),
-    ])
-  },
-)
-
-/**
- * # The retry-decision law through the installed Electric client
- *
- * The retry-decision oracle in `electric-oracle.property.test.ts` drives the
- * adapter through a controlled ShapeStream. This lane receives the same law
- * through the installed `@electric-sql/client`, its retry policy, and HTTP.
- * It uses the same independent model (`electric-retry-decision-model.ts`).
- *
- * The client turns three provider behaviors into the model's steps:
- *
- * - A 503 the client retries, then a complete snapshot: an error whose
- *   decision is a retry, then the first up-to-date.
- * - A response without Electric headers: an error whose decision is a retry,
- *   then the client gives up by itself, because the error is not retryable.
- * - Repeated 503 responses: an error and a retry for each one, until the
- *   client spends its budget of 50 consecutive retries and gives up by
- *   itself on the 51st error.
- *
- * The client gives up in the same continuation that receives the decision,
- * so the checkpoint after that decision already includes the give-up.
- *
- * The grammar crosses those three behaviors with the eager, on-demand
- * full-log, and progressive sync modes, and with a synchronous or an
- * asynchronous retry from `onError`. Each history starts one waiting demand
- * and, after the outcome, one later demand. A full-log demand is a subset
- * load. An eager or progressive Collection has no subset demand before its
- * first ready, so its demand is the readiness wait (`preload()`).
- *
- * At each checkpoint the lane compares the Collection status, each demand's
- * settlement, and whether the snapshot's row is visible with the model:
- * after the first error reaches `onError`, after an asynchronous decision,
- * after the outcome, and after the later demand. It also checks that a
- * full-log Collection requests the full log, and that a client that gave up
- * keeps no provider transport open. A rejection's cause is
- * compared only as a rejection here; the retry-decision oracle checks causes.
- */
-type ClientOutcome = `retried-503` | `missing-headers` | `exhausted`
-type ClientMode = `eager` | `full-log` | `progressive`
-
-const clientRetryCells = (
-  [`retried-503`, `missing-headers`, `exhausted`] as const
-).flatMap((outcome) =>
-  ([`eager`, `full-log`, `progressive`] as const).flatMap((mode) =>
-    ([`sync-retry`, `async-retry`] as const).map(
-      (decision) => [outcome, mode, decision] as const,
-    ),
-  ),
-)
-
-// The installed client's documented consecutive-retry budget.
-const CLIENT_RETRY_BUDGET = 50
-
-// A rejection's cause, and the readiness wait's cause, are checked by the
-// controlled retry-decision oracle. Here a non-full-log demand is itself a
-// readiness wait.
-function clientObservation(observation: RetryObservation): RetryObservation {
-  return {
-    status: observation.status,
-    rowVisible: observation.rowVisible,
-    demands: observation.demands.map((settlement) =>
-      settlement.startsWith(`rejected`) ? `rejected:any` : settlement,
-    ),
-  }
-}
-
-async function runClientRetryCell(
-  outcome: ClientOutcome,
-  mode: ClientMode,
-  decision: Extract<RetryDecision, `sync-retry` | `async-retry`>,
-): Promise<void> {
-  const http = controlledHttp()
-  const decisions: Array<() => void> = []
-  let onErrorCalls = 0
-  const options = electricCollectionOptions<Item>({
-    id: `sdk-retry-${outcome}-${mode}-${decision}-${++sequence}`,
-    shapeOptions: {
-      url: `http://test-url/retry-${sequence}`,
-      params: { table: `rows` },
-      fetchClient: http.fetchClient,
-      backoffOptions: {
-        initialDelay: 0,
-        maxDelay: 0,
-        multiplier: 1,
-        maxRetries: 0,
-      },
-      onError: () => {
-        onErrorCalls++
-        if (decision === `sync-retry`) return {}
-        return new Promise<Record<string, never>>((resolve) => {
-          decisions.push(() => resolve({}))
-        })
-      },
-    },
-    syncMode:
-      mode === `eager`
-        ? `eager`
-        : mode === `progressive`
-          ? `progressive`
-          : `on-demand`,
-    startSync: true,
-    getKey: (row) => row.id,
-  })
-  const metadata = resetResumeMetadata()
-  const originalSync = options.sync
-  const collection = createCollection({
-    ...options,
-    sync:
-      mode === `full-log`
-        ? {
-            sync: (params: Parameters<typeof originalSync.sync>[0]) =>
-              originalSync.sync({ ...params, metadata }),
-          }
-        : originalSync,
-  })
-  const model: RetryModel = createRetryModel(false)
-  const settlements: Array<`pending` | `fulfilled` | `rejected:any`> = []
-  const track = (result: unknown) => {
-    const slot = settlements.push(`pending`) - 1
-    void Promise.resolve(result).then(
-      () => {
-        settlements[slot] = `fulfilled`
-      },
-      () => {
-        settlements[slot] = `rejected:any`
-      },
-    )
-  }
-  const demand = () =>
-    track(
-      mode === `full-log`
-        ? collection._sync.loadSubset({ limit: settlements.length + 1 })
-        : collection.preload(),
-    )
-  const step = (next: RetryStep) => applyRetryModel(model, next, true, `e`)
-  const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
-  const check = async (label: string) => {
-    await turn()
-    await turn()
-    expect(
-      clientObservation({
-        status: collection.status,
-        demands: [...settlements],
-        rowVisible: collection.has(1),
-      }),
-      `${outcome} ${mode} ${decision}: ${label}`,
-    ).toEqual(clientObservation(expectedRetryObservation(model, false)))
-  }
-  // Answer one request with an error, and settle its decision. When the
-  // client gives up after this decision, the same checkpoint shows it.
-  const failOnce = async (
-    response: Response,
-    label: string,
-    givesUp: boolean,
-  ) => {
-    const calls = onErrorCalls
-    const request = await atCheckpoint(http.take(), `${label} HTTP`)
-    // A full-log Collection asks the provider for the full log.
-    if (mode === `full-log`)
-      expect(request.url.searchParams.get(`log`)).toBe(`full`)
-    request.respond(response)
-    await vi.waitFor(() => expect(onErrorCalls).toBe(calls + 1))
-    step({ kind: `error`, decision })
-    if (decision === `async-retry`) {
-      await check(`${label} reached onError`)
-      decisions.shift()!()
-      step({ kind: `decide` })
-    }
-    if (givesUp) step({ kind: `client-give-up` })
-    await check(`${label} decided`)
-  }
-
-  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-  const consoleWarn = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  await withElectricCleanup(async () => {
-    demand()
-    step({ kind: `demand` })
-    if (outcome === `retried-503`) {
-      await failOnce(
-        new Response(`transient`, { status: 503 }),
-        `first 503`,
-        false,
-      )
-      const retry = await atCheckpoint(http.take(), `retried HTTP`)
-      retry.respond(
-        new Response(
-          JSON.stringify([
-            {
-              key: `1`,
-              value: { id: `1`, name: `recovered` },
-              headers: { operation: `insert` },
-            },
-            { headers: { control: `up-to-date`, global_last_seen_lsn: `1` } },
-          ]),
-          { headers: headers(1) },
-        ),
-      )
-      await vi.waitFor(() => expect(collection.status).not.toBe(`loading`))
-      step({ kind: `up-to-date` })
-    } else if (outcome === `missing-headers`) {
-      await failOnce(new Response(`[]`, { status: 200 }), `headerless`, true)
-    } else {
-      // The client retries while its budget lasts, then gives up.
-      for (let attempt = 1; attempt <= CLIENT_RETRY_BUDGET + 1; attempt++) {
-        await failOnce(
-          new Response(`transient`, { status: 503 }),
-          `503 #${attempt}`,
-          attempt === CLIENT_RETRY_BUDGET + 1,
-        )
-      }
-    }
-    await check(`outcome`)
-    // A client that gave up keeps no provider transport open.
-    if (outcome !== `retried-503`) expect(http.activeCount()).toBe(0)
-    demand()
-    step({ kind: `demand` })
-    await check(`later demand`)
-  }, [
-    () => collection.cleanup(),
-    () => http.close(),
-    () => consoleError.mockRestore(),
-    () => consoleWarn.mockRestore(),
-  ])
-}
-
-fixedCase.each(clientRetryCells)(
-  `installed client: %s in %s mode with an onError %s follows the retry-decision model`,
-  (outcome, mode, decision) => runClientRetryCell(outcome, mode, decision),
-  60_000,
-)
-
 /**
  * # Cleanup releases the installed client's stream listeners
  *
diff --git a/packages/electric-db-collection/tests/electric-sdk-delivery-support.ts b/packages/electric-db-collection/tests/electric-sdk-delivery-support.ts
new file mode 100644
index 0000000000..0b1274e56d
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-sdk-delivery-support.ts
@@ -0,0 +1,207 @@
+// Controlled HTTP provider, deferred promises, shared response headers, and the
+// controlled coordinator for the installed-SDK delivery tests. The oracle in
+// electric-sdk-delivery-oracle.property.test.ts and the hand-written cases in
+// electric-sdk-delivery.test.ts both use them.
+import { vi } from 'vitest'
+import { SingleProcessCoordinator } from '../../db-sqlite-persistence-core/src'
+import type {
+  ProtocolEnvelope,
+  TxCommitted,
+} from '../../db-sqlite-persistence-core/src'
+
+export type Item = { id: number; name: string }
+
+export function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+export type Request = { url: URL; respond: (response: Response) => void }
+
+// The finite provider only holds responses and observes each fetch's signal.
+export function controlledHttp() {
+  const queued: Array<Request> = []
+  const waiting: Array<{
+    snapshot: boolean | undefined
+    resolve: (request: Request) => void
+    reject: (error: unknown) => void
+  }> = []
+  const active = new Set<() => void>()
+  let closed = false
+  const closedError = new Error(`Electric oracle HTTP provider closed`)
+  const isSnapshot = (request: Request) =>
+    request.url.searchParams.has(`subset__where`)
+  const fetchClient: typeof fetch = (input, init) =>
+    new Promise<Response>((resolve, reject) => {
+      if (closed) {
+        reject(closedError)
+        return
+      }
+      const signal = init?.signal
+      const url = new URL(String(input))
+      const request: Request = {
+        url,
+        respond: (response) => {
+          remove()
+          resolve(response)
+        },
+      }
+      const remove = () => {
+        signal?.removeEventListener(`abort`, abort)
+        active.delete(abort)
+        const index = queued.indexOf(request)
+        if (index >= 0) queued.splice(index, 1)
+      }
+      const abort = () => {
+        remove()
+        reject(
+          signal?.reason ??
+            new DOMException(`Provider request aborted`, `AbortError`),
+        )
+      }
+      if (signal?.aborted) {
+        abort()
+        return
+      }
+      signal?.addEventListener(`abort`, abort, { once: true })
+      active.add(abort)
+      const index = waiting.findIndex(
+        (waiter) =>
+          waiter.snapshot === undefined ||
+          waiter.snapshot === isSnapshot(request),
+      )
+      if (index >= 0) waiting.splice(index, 1)[0]!.resolve(request)
+      else queued.push(request)
+    })
+  return {
+    fetchClient,
+    take: (snapshot = false): Promise<Request> => {
+      if (closed) return Promise.reject(closedError)
+      const index = queued.findIndex(
+        (request) => isSnapshot(request) === snapshot,
+      )
+      if (index >= 0) return Promise.resolve(queued.splice(index, 1)[0]!)
+      return new Promise((resolve, reject) =>
+        waiting.push({ snapshot, resolve, reject }),
+      )
+    },
+    takeAny: (): Promise<Request> => {
+      if (closed) return Promise.reject(closedError)
+      if (queued.length > 0) return Promise.resolve(queued.shift()!)
+      return new Promise((resolve, reject) =>
+        waiting.push({ snapshot: undefined, resolve, reject }),
+      )
+    },
+    close: () => {
+      closed = true
+      for (const abort of [...active]) abort()
+      for (const waiter of waiting.splice(0)) waiter.reject(closedError)
+    },
+    activeCount: () => active.size,
+  }
+}
+
+export const headers = (offset: number) => ({
+  'electric-handle': `shape`,
+  'electric-offset': `${offset}_0`,
+  'electric-cursor': String(offset),
+  'electric-up-to-date': `true`,
+  'electric-schema': JSON.stringify({
+    id: { type: `int4` },
+    name: { type: `text` },
+  }),
+})
+
+// Deliver a coordinator notification through the same persistence wrapper
+// used by the installed-SDK receiver. The test still controls the provider
+// response independently of this durable-cache notification.
+export function controlledCoordinator(collectionId: string) {
+  let subscriber: ((message: ProtocolEnvelope<unknown>) => void) | undefined
+  return Object.assign(new SingleProcessCoordinator(), {
+    subscribe: (
+      _collectionId: string,
+      onMessage: (message: ProtocolEnvelope<unknown>) => void,
+    ) => {
+      subscriber = onMessage
+      return () => {
+        subscriber = undefined
+      }
+    },
+    emit: (payload: TxCommitted) => {
+      subscriber?.({
+        v: 1,
+        dbName: `sdk-receiver`,
+        collectionId,
+        senderId: `other-tab`,
+        ts: Date.now(),
+        payload,
+      })
+    },
+  })
+}
+
+// EventTarget registration identity is callback plus capture. Replay native
+// add/remove calls in order: a removal cannot erase a later registration, and
+// repeated additions of one identity retain one listener. The installed SDK
+// uses no once or signal options, which would need automatic-removal tracking.
+export function recordVisibilityListeners() {
+  const add = vi.spyOn(document, `addEventListener`)
+  const remove = vi.spyOn(document, `removeEventListener`)
+  const visibility = (calls: Array<Array<unknown>>) =>
+    calls
+      .filter(([type]) => type === `visibilitychange`)
+      .map(([, listener]) => listener)
+  return {
+    registered: () => visibility(add.mock.calls).length,
+    live: () => {
+      const calls = [
+        ...add.mock.calls.map((call, index) => ({
+          call,
+          adding: true,
+          order: add.mock.invocationCallOrder[index]!,
+        })),
+        ...remove.mock.calls.map((call, index) => ({
+          call,
+          adding: false,
+          order: remove.mock.invocationCallOrder[index]!,
+        })),
+      ].sort((left, right) => left.order - right.order)
+      const listeners = new Map<
+        EventListenerOrEventListenerObject,
+        Set<boolean>
+      >()
+      for (const {
+        call: [type, listener, options],
+        adding,
+      } of calls) {
+        if (type !== `visibilitychange`) continue
+        const capture =
+          typeof options === `boolean` ? options : Boolean(options?.capture)
+        if (adding) {
+          const captures = listeners.get(listener) ?? new Set<boolean>()
+          captures.add(capture)
+          listeners.set(listener, captures)
+        } else listeners.get(listener)?.delete(capture)
+      }
+      return [...listeners.values()].reduce(
+        (count, captures) => count + captures.size,
+        0,
+      )
+    },
+    restore: () => {
+      // The comparison has already run. Release even a failed subject's
+      // registrations so RED runs and shrinking do not retain dead streams.
+      try {
+        for (const [type, listener, options] of add.mock.calls)
+          if (type === `visibilitychange`)
+            document.removeEventListener(type, listener, options)
+      } finally {
+        add.mockRestore()
+        remove.mockRestore()
+      }
+    },
+  }
+}
diff --git a/packages/electric-db-collection/tests/electric-sdk-delivery.test.ts b/packages/electric-db-collection/tests/electric-sdk-delivery.test.ts
new file mode 100644
index 0000000000..3d10ea10a7
--- /dev/null
+++ b/packages/electric-db-collection/tests/electric-sdk-delivery.test.ts
@@ -0,0 +1,1014 @@
+// Installed-SDK delivery cases whose expectations are written by hand: an
+// ordinary subset snapshot, an externally aborted subset, a partial cache after
+// cold restart, ordered concurrent snapshots, a persisted restart, and scoped
+// restarts that quarantine uncertified cache rows. The delivery laws they
+// illustrate are owned by
+// electric-sdk-delivery-oracle.property.test.ts.
+import { DatabaseSync } from 'node:sqlite'
+import { expect, it, vi } from 'vitest'
+import {
+  IR,
+  createCollection,
+  createLiveQueryCollection,
+  eq,
+} from '@tanstack/db'
+import { ShapeStream } from '@electric-sql/client'
+import {
+  SQLiteCorePersistenceAdapter,
+  persistedCollectionOptions,
+} from '../../db-sqlite-persistence-core/src'
+import { electricCollectionOptions } from '../src/electric'
+import {
+  atCheckpoint,
+  withElectricCleanup,
+  withElectricSetup,
+} from './electric-oracle-lifecycle'
+import {
+  managedTagPersistence,
+  nodeSqliteDriver,
+} from './electric-persistence-fixture'
+import {
+  controlledCoordinator,
+  controlledHttp,
+  deferred,
+  headers,
+  recordVisibilityListeners,
+} from './electric-sdk-delivery-support'
+import type { Item, Request } from './electric-sdk-delivery-support'
+import type { SyncPersistenceCapabilityV1 } from '@tanstack/db'
+import type { TestRow } from './electric-persistence-fixture'
+import type { ElectricCollectionUtils } from '../src/electric'
+
+let sequence = 0
+
+it(`lets requestSnapshot own the warm transport`, async () => {
+  const http = controlledHttp()
+  let delivery = deferred<void>()
+  const subscribe = ShapeStream.prototype.subscribe
+  const spy = await withElectricSetup(
+    () =>
+      vi.spyOn(ShapeStream.prototype, `subscribe`).mockImplementation(function (
+        this: ShapeStream,
+        callback,
+        onError,
+      ) {
+        return subscribe.call(
+          this,
+          (messages) => {
+            const result = callback(messages)
+            delivery.resolve()
+            return result
+          },
+          onError,
+        )
+      }),
+    [
+      {
+        label: `warm HTTP provider during spy setup`,
+        release: () => http.close(),
+      },
+    ],
+  )
+  const collection = await withElectricSetup(
+    () =>
+      createCollection(
+        electricCollectionOptions<Item>({
+          id: `sdk-warm-snapshot-${++sequence}`,
+          shapeOptions: {
+            url: `http://test-url/warm-snapshot-${sequence}`,
+            params: { table: `rows` },
+            fetchClient: http.fetchClient,
+          },
+          syncMode: `on-demand`,
+          startSync: true,
+          getKey: (row) => row.id,
+        }),
+      ),
+    [
+      { label: `warm HTTP provider during setup`, release: () => http.close() },
+      {
+        label: `warm subscription spy during setup`,
+        release: () => spy.mockRestore(),
+      },
+    ],
+  )
+
+  return withElectricCleanup(async () => {
+    const initial = await atCheckpoint(http.take(), `initial live request`)
+    initial.respond(
+      new Response(
+        JSON.stringify([
+          {
+            headers: {
+              control: `up-to-date`,
+              global_last_seen_lsn: `1`,
+            },
+          },
+        ]),
+        { headers: headers(1) },
+      ),
+    )
+    await atCheckpoint(delivery.promise, `initial up-to-date delivery`)
+
+    // Hold the next live poll. The installed SDK's requestSnapshot owns the
+    // pause/abort transition from this poll to the subset request.
+    await atCheckpoint(http.take(), `warm live poll`)
+    delivery = deferred<void>()
+    const loading = collection._sync.loadSubset({
+      where: new IR.Func(`gte`, [new IR.PropRef([`id`]), new IR.Value(1)]),
+    })
+    const request = await atCheckpoint(
+      http.takeAny(),
+      `first request after warm loadSubset`,
+    )
+    expect(request.url.searchParams.has(`subset__where`)).toBe(true)
+    expect(http.activeCount()).toBe(1)
+    request.respond(
+      new Response(
+        JSON.stringify({
+          metadata: {
+            xmin: `10`,
+            xmax: `20`,
+            xip_list: [],
+            database_lsn: `10`,
+            snapshot_mark: 2,
+          },
+          data: [],
+        }),
+        { headers: headers(2) },
+      ),
+    )
+    await atCheckpoint(delivery.promise, `warm snapshot delivery`)
+    await atCheckpoint(Promise.resolve(loading), `warm snapshot completion`)
+  }, [
+    { label: `warm collection`, release: () => collection.cleanup() },
+    { label: `warm HTTP provider`, release: () => http.close() },
+    { label: `warm subscription spy`, release: () => spy.mockRestore() },
+    {
+      label: `warm requests after provider closure`,
+      release: () => expect(http.activeCount()).toBe(0),
+    },
+  ])
+})
+
+/**
+ * The installed SDK can finish a subset HTTP response after the shared stream
+ * was externally aborted. The stream can no longer apply that row, so the
+ * adapter must reject the demand and leave its predicate uncertified. This
+ * receives the oracle's external-abort law through the real requestSnapshot
+ * transport rather than relying on a mocked provider promise.
+ */
+it(`does not certify an aborted SDK subset snapshot`, async () => {
+  const http = controlledHttp()
+  const external = new AbortController()
+  const collection = createCollection(
+    electricCollectionOptions<Item>({
+      id: `sdk-subset-abort-${++sequence}`,
+      shapeOptions: {
+        url: `http://test-url/subset-abort-${sequence}`,
+        params: { table: `rows` },
+        fetchClient: http.fetchClient,
+        signal: external.signal,
+      },
+      syncMode: `on-demand`,
+      startSync: true,
+      getKey: (row) => row.id,
+    }),
+  )
+
+  await withElectricCleanup(async () => {
+    await atCheckpoint(http.take(), `abortable live transport`)
+    const first = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+    void first.catch(() => undefined)
+    const request = await atCheckpoint(http.take(true), `abortable subset HTTP`)
+    external.abort()
+    request.respond(
+      new Response(
+        JSON.stringify({
+          metadata: {
+            xmin: `10`,
+            xmax: `20`,
+            xip_list: [],
+            database_lsn: `10`,
+            snapshot_mark: 1,
+          },
+          data: [
+            {
+              key: `1`,
+              value: { id: `1`, name: `discarded` },
+              headers: { operation: `insert` },
+            },
+          ],
+        }),
+        { headers: headers(2) },
+      ),
+    )
+    await expect(
+      atCheckpoint(first, `externally aborted SDK subset`),
+    ).rejects.toMatchObject({ name: `AbortError` })
+    expect(collection.has(1)).toBe(false)
+    const second = collection._sync.loadSubset({ limit: 1 })
+    expect(second).not.toBe(true)
+    await expect(Promise.resolve(second)).rejects.toMatchObject({
+      name: `AbortError`,
+    })
+  }, [() => collection.cleanup(), () => http.close()])
+})
+
+/**
+ * An expired run can rotate without Electric reset metadata, then persist one
+ * demanded source row in its private generation. That row is a partial cache,
+ * not an offline source snapshot. After a cold restart, the provider model has
+ * no matching row. Real SQLite supplies incompatible key-set evidence and no
+ * resume record; the installed SDK holds an empty subset HTTP response. Before
+ * and after that response, the public Collection must not expose the stale
+ * cached row. The generation must rotate before it can serve the new demand,
+ * even when the caller supplies an explicit source offset or handle. Those
+ * source cursor options do not certify the persisted cache's key set.
+ */
+it.each([
+  { cursor: `none`, shapeCursor: {} },
+  { cursor: `explicit offset`, shapeCursor: { offset: `now` as const } },
+  { cursor: `explicit handle`, shapeCursor: { handle: `explicit-shape` } },
+])(
+  `keeps a partial cache without a reset marker private after cold restart with $cursor`,
+  async ({ shapeCursor }) => {
+    const database = new DatabaseSync(`:memory:`)
+    const adapter = new SQLiteCorePersistenceAdapter({
+      driver: nodeSqliteDriver(database),
+    })
+    const collectionId = `sdk-cold-expired-cache-${++sequence}`
+    const first = await adapter.claimCacheGeneration(collectionId)
+    const partial = await adapter.rotateCacheGeneration(
+      collectionId,
+      first.claimId,
+    )
+    await adapter.applyCommittedTx(
+      {
+        kind: `managed`,
+        storageCollectionId: partial.storageCollectionId,
+        claimId: partial.claimId,
+      },
+      {
+        txId: `partial-subset-row`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        cacheGenerationClaimId: partial.claimId,
+        mutations: [
+          {
+            type: `insert`,
+            key: 1,
+            value: { id: 1, name: `stale-partial` },
+          },
+        ],
+      },
+    )
+    const seeded = await adapter.loadResumeSnapshot(
+      {
+        kind: `managed`,
+        storageCollectionId: partial.storageCollectionId,
+        claimId: partial.claimId,
+      },
+      { cacheGenerationClaimId: partial.claimId },
+    )
+    expect(seeded.keySet).toEqual({ status: `incompatible` })
+    expect(seeded.collectionMetadata).toEqual([])
+    await adapter.releaseCacheGenerationClaim(partial.claimId)
+
+    const http = controlledHttp()
+    const electric = electricCollectionOptions<Item>({
+      id: collectionId,
+      shapeOptions: {
+        url: `http://test-url/${collectionId}`,
+        params: { table: `rows` },
+        fetchClient: http.fetchClient,
+        ...shapeCursor,
+      },
+      syncMode: `on-demand`,
+      startSync: true,
+      getKey: (row) => row.id,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        Item,
+        string | number,
+        never,
+        ElectricCollectionUtils<Item>
+      >({ ...electric, persistence: { adapter } }),
+    )
+
+    try {
+      await withElectricCleanup(async () => {
+        const stream = await atCheckpoint(http.take(), `cold restart stream`)
+        expect(stream.url.searchParams.get(`log`)).toBe(`changes_only`)
+        const load = Promise.resolve(
+          collection._sync.loadSubset({
+            where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(1)]),
+          }),
+        )
+        void load.catch(() => undefined)
+        const request = await atCheckpoint(
+          http.take(true),
+          `cold restart source snapshot`,
+        )
+        expect(collection.get(1), `before source evidence`).toBeUndefined()
+        const current = await adapter.claimCacheGeneration(collectionId)
+        try {
+          expect(current.storageCollectionId).not.toBe(
+            partial.storageCollectionId,
+          )
+        } finally {
+          await adapter.releaseCacheGenerationClaim(current.claimId)
+        }
+
+        request.respond(
+          new Response(
+            JSON.stringify({
+              metadata: {
+                xmin: `10`,
+                xmax: `20`,
+                xip_list: [],
+                database_lsn: `10`,
+                snapshot_mark: 2,
+              },
+              data: [],
+            }),
+            { headers: headers(2) },
+          ),
+        )
+        await atCheckpoint(load, `empty source snapshot applied`)
+        expect(collection.status).toBe(`ready`)
+        expect(collection.get(1), `after empty source evidence`).toBeUndefined()
+      }, [() => collection.cleanup(), () => http.close()])
+    } finally {
+      database.close()
+    }
+  },
+)
+
+/**
+ * Two active demands share one ShapeStream cursor. The source model gives each
+ * predicate one row and increasing offsets. The second provider snapshot may
+ * start only after the first settles; otherwise an older HTTP response can
+ * overwrite a later row and regress that cursor. The SDK method invocation is
+ * the checkpoint, while public rows verify both acquisitions still apply.
+ */
+it(`serializes concurrent subset snapshots on one SDK stream`, async () => {
+  const http = controlledHttp()
+  const requestSnapshot = vi.spyOn(ShapeStream.prototype, `requestSnapshot`)
+  const collection = createCollection(
+    electricCollectionOptions<Item>({
+      id: `sdk-ordered-snapshots-${++sequence}`,
+      shapeOptions: {
+        url: `http://test-url/ordered-snapshots-${sequence}`,
+        params: { table: `rows` },
+        fetchClient: http.fetchClient,
+      },
+      syncMode: `on-demand`,
+      startSync: true,
+      getKey: (row) => row.id,
+    }),
+  )
+  const demand = (id: number) => ({
+    where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(id)]),
+  })
+  const respond = (request: Request, id: number) =>
+    request.respond(
+      new Response(
+        JSON.stringify({
+          metadata: {
+            xmin: `10`,
+            xmax: `20`,
+            xip_list: [],
+            database_lsn: `10`,
+            snapshot_mark: id,
+          },
+          data: [
+            {
+              key: String(id),
+              value: { id: String(id), name: `row-${id}` },
+              headers: { operation: `insert` },
+            },
+          ],
+        }),
+        { headers: headers(id + 1) },
+      ),
+    )
+  await withElectricCleanup(async () => {
+    await atCheckpoint(http.take(), `initial ordered-snapshot transport`)
+    const first = Promise.resolve(collection._sync.loadSubset(demand(1)))
+    const second = Promise.resolve(collection._sync.loadSubset(demand(2)))
+    const firstRequest = await atCheckpoint(
+      http.take(true),
+      `first ordered snapshot`,
+    )
+    await new Promise<void>((resolve) => setTimeout(resolve, 0))
+    expect(
+      requestSnapshot,
+      `second snapshot waits for first`,
+    ).toHaveBeenCalledTimes(1)
+    respond(firstRequest, 1)
+    await atCheckpoint(first, `first ordered snapshot applied`)
+    const secondRequest = await atCheckpoint(
+      http.take(true),
+      `second ordered snapshot`,
+    )
+    expect(requestSnapshot).toHaveBeenCalledTimes(2)
+    respond(secondRequest, 2)
+    await atCheckpoint(second, `second ordered snapshot applied`)
+    expect(collection.toArray.map(({ id, name }) => ({ id, name }))).toEqual([
+      { id: 1, name: `row-1` },
+      { id: 2, name: `row-2` },
+    ])
+  }, [
+    () => collection.cleanup(),
+    () => http.close(),
+    () => requestSnapshot.mockRestore(),
+    () => expect(http.activeCount()).toBe(0),
+  ])
+})
+
+/**
+ * Restart demand must remain legal when recovery changes provider capability.
+ * Electric's SDK permits requestSnapshot only in changes_only mode. The
+ * LoadSubsetFn contract requires success to follow application of the rows
+ * that establish the requested subset. This receiving witness uses the real
+ * SDK with the same durable-storage seam as the tag-history owner.
+ *
+ * The independent model is a complete replacement row after the second
+ * launch. Tagged and untagged launches differ only in provider acquisition:
+ * the tagged launch cannot resume its prior cursor, but its on-demand stream
+ * can start changes-only and request the active subset. The untagged neighbor
+ * resumes its cursor. Both must satisfy the same subset demand.
+ * A new descriptor and Collection discard all prior in-memory tag state.
+ * This checks SDK behavior over controlled HTTP, not server tag generation,
+ * native SQLite, or a separate operating-system process.
+ * One source snapshot for id = 1 may satisfy the live query's active demand.
+ * The receiver verifies that scope before returning the authored row. The
+ * law judges applied rows and demand settlement, not the number of physical
+ * snapshot requests.
+ */
+it.each(
+  [false, true].flatMap((tagged) =>
+    ([`direct`, `live-query`] as const).map((consumer) => ({
+      tagged,
+      consumer,
+    })),
+  ),
+)(
+  `satisfies subset demand after a fresh persisted launch, tagged=$tagged consumer=$consumer`,
+  async ({ tagged, consumer }) => {
+    const { adapter, rows, metadata } = managedTagPersistence()
+    const collectionId = `sdk-persisted-restart-${++sequence}`
+    const http = controlledHttp()
+    const firstRow: TestRow = { id: 1, name: `first`, stable: `retained` }
+    const replacement: TestRow = { ...firstRow, name: `replacement` }
+    const create = () =>
+      createCollection(
+        persistedCollectionOptions<
+          TestRow,
+          string | number,
+          never,
+          ElectricCollectionUtils<TestRow>
+        >({
+          ...electricCollectionOptions<TestRow>({
+            id: collectionId,
+            shapeOptions: {
+              url: `http://test-url/${collectionId}`,
+              params: { table: `rows` },
+              fetchClient: http.fetchClient,
+            },
+            syncMode: `on-demand`,
+            startSync: true,
+            getKey: (row) => row.id,
+          }),
+          persistence: { adapter },
+        }),
+      )
+    const message = (row: TestRow) => ({
+      key: String(row.id),
+      value: { ...row, id: String(row.id) },
+      headers: {
+        operation: `insert`,
+        ...(tagged ? { tags: [`selected`] } : {}),
+      },
+    })
+    const responseHeaders = (offset: number) => ({
+      ...headers(offset),
+      'electric-schema': JSON.stringify({
+        id: { type: `int4` },
+        name: { type: `text` },
+        stable: { type: `text` },
+      }),
+    })
+    const snapshotResponse = (row: TestRow, offset: number) =>
+      new Response(
+        JSON.stringify({
+          metadata: {
+            xmin: `10`,
+            xmax: `20`,
+            xip_list: [],
+            database_lsn: `10`,
+            snapshot_mark: offset,
+          },
+          data: [message(row)],
+        }),
+        { headers: responseHeaders(offset) },
+      )
+    const demand = {
+      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(1)]),
+    }
+    const expectIdOneSnapshot = (request: Request) => {
+      expect(request.url.searchParams.get(`subset__where`)).toBe(`"id" = $1`)
+      expect(
+        JSON.parse(request.url.searchParams.get(`subset__params`) ?? `null`),
+      ).toEqual({ 1: `1` })
+    }
+    const first = create()
+    let current = first
+    let cleanupQuery = () => Promise.resolve()
+    await withElectricCleanup(async () => {
+      const initial = await atCheckpoint(
+        http.take(),
+        `first launch stream started`,
+      )
+      expect(initial.url.searchParams.get(`log`)).toBe(`changes_only`)
+      const firstLoad = Promise.resolve(first._sync.loadSubset(demand))
+      void firstLoad.catch(() => undefined)
+      const request = await atCheckpoint(
+        http.take(true),
+        `first launch snapshot`,
+      )
+      expectIdOneSnapshot(request)
+      request.respond(snapshotResponse(firstRow, 2))
+      await atCheckpoint(firstLoad, `first launch subset applied`)
+      await vi.waitFor(
+        () =>
+          expect(metadata().get(`electric:resume`)).toMatchObject({
+            kind: `resume`,
+            requiresTagState: tagged,
+          }),
+        { interval: 1 },
+      )
+      expect(rows().get(1)?.value).toEqual(firstRow)
+      await first.cleanup()
+
+      current = create()
+      const resumed = await atCheckpoint(
+        http.take(),
+        `second launch stream started`,
+      )
+      expect(resumed.url.searchParams.get(`log`)).toBe(`changes_only`)
+      expect(resumed.url.searchParams.get(`offset`)).toBe(
+        tagged ? `now` : `2_0`,
+      )
+      const query =
+        consumer === `live-query`
+          ? createLiveQueryCollection({
+              startSync: false,
+              query: (q) =>
+                q
+                  .from({ row: current })
+                  .where(({ row }) => eq(row.id, 1))
+                  .select(({ row }) => ({
+                    id: row.id,
+                    name: row.name,
+                    stable: row.stable,
+                  })),
+            })
+          : undefined
+      if (query) cleanupQuery = () => query.cleanup()
+      const loading = Promise.resolve(
+        query ? query.preload() : current._sync.loadSubset(demand),
+      ).then(
+        () => ({ kind: `fulfilled` as const }),
+        (error: unknown) => ({
+          kind: `rejected` as const,
+          error: String(error),
+        }),
+      )
+      const resumedSnapshot = await atCheckpoint(
+        http.take(true),
+        `resumed subset snapshot`,
+      )
+      expectIdOneSnapshot(resumedSnapshot)
+      resumedSnapshot.respond(snapshotResponse(replacement, 3))
+      const outcome = await atCheckpoint(
+        loading,
+        `second launch subset settled`,
+      )
+      await vi.waitFor(() => expect(current.status).toBe(`ready`), {
+        interval: 1,
+      })
+      await vi.waitFor(
+        () => expect(rows().get(1)?.value).toEqual(replacement),
+        {
+          interval: 1,
+        },
+      )
+      // Observe settlement as well as rows. A ready Collection with correct
+      // rows cannot excuse a rejected subset acquisition.
+      expect({
+        outcome,
+        status: current.status,
+        row: current.get(1),
+      }).toMatchObject({
+        outcome: { kind: `fulfilled` },
+        status: `ready`,
+        row: replacement,
+      })
+      if (query) {
+        expect(query.status).toBe(`ready`)
+        // This law observes selected payload values, not virtual metadata.
+        expect(
+          query.toArray.map(({ id, name, stable }) => ({ id, name, stable })),
+        ).toEqual([replacement])
+      }
+    }, [
+      () => cleanupQuery(),
+      () => current.cleanup(),
+      () => first.cleanup(),
+      () => http.close(),
+      () => expect(http.activeCount()).toBe(0),
+    ])
+  },
+)
+
+/**
+ * A persisted source row is only a cache after tag state is lost. The source
+ * model starts with A and B, then changes A and removes B while the Collection
+ * is closed. Only A is active at the second launch. Its scoped snapshot may
+ * establish A, but neither the old B row nor a later empty B snapshot may
+ * re-admit B from SQLite. This driver observes HTTP scope, durable rows, local
+ * reads, public rows, and acquisition settlement at each cut. The controlled
+ * provider supplies authoritative responses for the requested predicates;
+ * live-server framing and native storage remain separate receiving boundaries.
+ * A local cache clear is not source readiness: the restarted Collection stays
+ * loading at the stream-request cut, before Electric sends source evidence.
+ */
+it.each([
+  { cause: `lost tags`, tagged: true, nextTable: `rows` },
+  { cause: `changed shape`, tagged: false, nextTable: `other_rows` },
+  {
+    cause: `malformed resume state`,
+    tagged: false,
+    nextTable: `rows`,
+    malformed: true,
+  },
+])(
+  `quarantines uncertified cache rows across later scoped demands after $cause`,
+  async ({ tagged, nextTable, malformed }) => {
+    const fixture = managedTagPersistence()
+    const { adapter, rows, metadata } = fixture
+    const baselineReads = vi.spyOn(adapter, `loadResumeSnapshot`)
+    const http = controlledHttp()
+    const collectionId = `sdk-scoped-restart-${++sequence}`
+    const coordinator = controlledCoordinator(collectionId)
+    let currentCapability: SyncPersistenceCapabilityV1<string | number> | null =
+      null
+    const source = new Map<number, TestRow>([
+      [1, { id: 1, name: `old-a`, stable: `a` }],
+      [2, { id: 2, name: `old-b`, stable: `b` }],
+    ])
+    const demand = (id: number) => ({
+      where: new IR.Func(`eq`, [new IR.PropRef([`id`]), new IR.Value(id)]),
+    })
+    const create = (table = `rows`) => {
+      const electricOptions = electricCollectionOptions<TestRow>({
+        id: collectionId,
+        shapeOptions: {
+          url: `http://test-url/${collectionId}`,
+          params: { table },
+          fetchClient: http.fetchClient,
+        },
+        syncMode: `on-demand`,
+        startSync: true,
+        getKey: (row) => row.id,
+      })
+      return createCollection(
+        persistedCollectionOptions<
+          TestRow,
+          string | number,
+          never,
+          ElectricCollectionUtils<TestRow>
+        >({
+          ...electricOptions,
+          sync: {
+            ...electricOptions.sync,
+            sync: (params) => {
+              currentCapability = params.metadata?.persistence ?? null
+              return electricOptions.sync.sync(params)
+            },
+          },
+          persistence: { adapter, coordinator },
+        }),
+      )
+    }
+    const respond = (
+      request: Request,
+      result: Array<TestRow>,
+      offset: number,
+    ) =>
+      request.respond(
+        new Response(
+          JSON.stringify({
+            metadata: {
+              xmin: `10`,
+              xmax: `20`,
+              xip_list: [],
+              database_lsn: `10`,
+              snapshot_mark: offset,
+            },
+            data: result.map((row) => ({
+              key: String(row.id),
+              value: { ...row, id: String(row.id) },
+              headers: {
+                operation: `insert`,
+                ...(tagged ? { tags: [`selected`] } : {}),
+              },
+            })),
+          }),
+          {
+            headers: {
+              ...headers(offset),
+              'electric-schema': JSON.stringify({
+                id: { type: `int4` },
+                name: { type: `text` },
+                stable: { type: `text` },
+              }),
+            },
+          },
+        ),
+      )
+    const publicRows = (collection: ReturnType<typeof create>) =>
+      collection.toArray
+        .map(({ id, name, stable }) => ({ id, name, stable }))
+        .sort((a, b) => a.id - b.id)
+    const first = create()
+    let current = first
+    let localReads: { mockRestore: () => void } | undefined
+    await withElectricCleanup(async () => {
+      await atCheckpoint(http.take(), `initial changes-only transport`)
+      for (const [id, row] of source) {
+        const loading = Promise.resolve(first._sync.loadSubset(demand(id)))
+        const request = await atCheckpoint(
+          http.take(true),
+          `initial subset ${id}`,
+        )
+        respond(request, [row], id + 1)
+        await atCheckpoint(loading, `initial subset ${id} applied`)
+      }
+      expect(publicRows(first)).toEqual([...source.values()])
+      expect(rows().size).toBe(2)
+      expect(metadata().get(`electric:resume`)).toMatchObject({
+        kind: `resume`,
+        requiresTagState: tagged,
+      })
+      await first.cleanup()
+      baselineReads.mockClear()
+      if (malformed) {
+        metadata().set(`electric:resume`, { kind: `resume`, offset: 10 })
+      }
+      const oldStorageId = fixture.currentStorageId()
+
+      source.set(1, { id: 1, name: `new-a`, stable: `a` })
+      source.delete(2)
+      localReads = vi.spyOn(adapter, `loadSubset`)
+      current = create(nextTable)
+      const resumed = await atCheckpoint(
+        http.take(),
+        `scoped restart transport`,
+      )
+      expect(resumed.url.searchParams.get(`log`)).toBe(`changes_only`)
+      expect(resumed.url.searchParams.get(`offset`)).toBe(`now`)
+      expect(publicRows(current), `before active demand`).toEqual([])
+      expect(current.status, `before source readiness`).toBe(`loading`)
+      expect(baselineReads, `startup metadata read`).toHaveBeenCalled()
+      expect(
+        baselineReads.mock.calls.every(
+          ([, context]) => context?.includeRows !== true,
+        ),
+        `no full baseline row read`,
+      ).toBe(true)
+
+      if (!tagged) {
+        // An empty first source snapshot must still establish its own demand
+        // without promoting the stale durable B row into the Collection.
+        const emptyFirst = Promise.resolve(current._sync.loadSubset(demand(2)))
+        const emptyRequest = await atCheckpoint(
+          http.take(true),
+          `first empty scoped snapshot`,
+        )
+        expect(localReads).not.toHaveBeenCalled()
+        respond(emptyRequest, [], 4)
+        await atCheckpoint(emptyFirst, `first empty subset applied`)
+        expect(publicRows(current), `after first empty subset`).toEqual([])
+      }
+
+      const loadingA = Promise.resolve(
+        current._sync.loadSubset({ ...demand(1), limit: 10 }),
+      )
+      const requestA = await atCheckpoint(http.take(true), `scoped A snapshot`)
+      expect(requestA.url.searchParams.get(`subset__where`)).toContain(`id`)
+      expect(localReads).not.toHaveBeenCalled()
+      respond(requestA, [source.get(1)!], tagged ? 4 : 5)
+      await atCheckpoint(loadingA, `scoped A applied`)
+      expect(publicRows(current), `after A applied`).toEqual([source.get(1)])
+      expect(
+        fixture.rowsAt(oldStorageId).get(2)?.value,
+        `durable B retained`,
+      ).toEqual({
+        id: 2,
+        name: `old-b`,
+        stable: `b`,
+      })
+
+      // A second tab updates durable cache outside the active A demand. The
+      // provider has not sent another source change, so the public A row still
+      // follows its applied source snapshot. The capability scan fences the
+      // coordinator's async handling before this public observation.
+      const durablePosition = await adapter.loadResumeSnapshot(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          includeRows: false,
+        },
+      )
+      const otherTabRow: TestRow = {
+        id: 3,
+        name: `other-tab-cache`,
+        stable: `c`,
+      }
+      source.set(3, otherTabRow)
+      rows().set(3, { value: otherTabRow })
+      coordinator.emit({
+        type: `tx:committed`,
+        term: durablePosition.latestTerm,
+        seq: durablePosition.latestSeq + 1,
+        txId: `other-tab-cache-update`,
+        latestRowVersion: durablePosition.latestRowVersion + 1,
+        requiresFullReload: false,
+        changedRows: [{ key: 3, value: otherTabRow }],
+        deletedKeys: [],
+      })
+      expect(currentCapability?.scanPersistedRows).toBeTypeOf(`function`)
+      await currentCapability!.scanPersistedRows()
+      expect(publicRows(current), `after coordinator invalidation`).toEqual([
+        source.get(1),
+      ])
+
+      if (tagged) {
+        // The coordinator may refresh A, but the new physical cache does not
+        // require that request. Service it first only if the provider sends
+        // it; either path must leave B absent after B's empty snapshot.
+        const loadingB = Promise.resolve(current._sync.loadSubset(demand(2)))
+        let requestB = await atCheckpoint(http.take(true), `empty B snapshot`)
+        let bOffset = 5
+        if (requestB.url.searchParams.get(`subset__params`)?.includes(`:"1"`)) {
+          respond(requestB, [source.get(1)!], 5)
+          requestB = await atCheckpoint(http.take(true), `empty B snapshot`)
+          bOffset = 6
+        }
+        expect(requestB.url.searchParams.get(`subset__params`)).toContain(`"2"`)
+        expect(publicRows(current), `while B is pending`).toEqual([
+          source.get(1),
+        ])
+        expect(localReads).not.toHaveBeenCalled()
+        respond(requestB, [], bOffset)
+        await atCheckpoint(loadingB, `empty B applied`)
+        expect(publicRows(current), `after empty B applied`).toEqual([
+          source.get(1),
+        ])
+      }
+      expect(metadata().get(`electric:resume`)).toMatchObject({ kind: `reset` })
+
+      await current.cleanup()
+      localReads.mockRestore()
+      localReads = vi.spyOn(adapter, `loadSubset`)
+      current = create(nextTable)
+      const idle = await atCheckpoint(http.take(), `idle scoped restart`)
+      expect(idle.url.searchParams.get(`log`)).toBe(`changes_only`)
+      expect(idle.url.searchParams.get(`offset`)).toBe(`now`)
+      expect(publicRows(current), `no active demand`).toEqual([])
+      expect(localReads, `no unrestricted local read`).not.toHaveBeenCalled()
+      expect(
+        baselineReads.mock.calls.every(
+          ([, context]) => context?.includeRows !== true,
+        ),
+        `no full baseline row read without demand`,
+      ).toBe(true)
+      expect(
+        fixture.rowsAt(oldStorageId).get(2)?.value,
+        `cache retained without demand`,
+      ).toMatchObject({
+        id: 2,
+        name: `old-b`,
+      })
+    }, [
+      () => current.cleanup(),
+      () => first.cleanup(),
+      () => http.close(),
+      () => localReads?.mockRestore(),
+      () => baselineReads.mockRestore(),
+      () => expect(http.activeCount()).toBe(0),
+    ])
+  },
+)
+
+// EventTarget identifies a listener by callback and capture, coalesces duplicate
+// additions, and applies removals in order (DOM Standard, "EventTarget"). This
+// bounded calibration sends every sequence of up to three add/remove calls
+// through the real EventTarget, then compares dispatch with the recorder before
+// teardown. Two callbacks and both capture modes distinguish wrong identities;
+// omitted, boolean, and object options distinguish equivalent capture spellings.
+// Three calls reach add/remove/re-add. Once and signal options are outside this
+// recorder's installed-SDK domain.
+it(`records EventTarget ownership across bounded listener histories`, () => {
+  type Step = {
+    add: boolean
+    callback: number
+    options: boolean | { capture: boolean } | undefined
+  }
+  const options = [
+    undefined,
+    false,
+    true,
+    { capture: false },
+    { capture: true },
+  ]
+  const steps: Array<Step> = [false, true].flatMap((add) =>
+    [0, 1].flatMap((callback) =>
+      options.map((capture) => ({ add, callback, options: capture })),
+    ),
+  )
+  function* histories(prefix: Array<Step> = []): Generator<Array<Step>> {
+    yield prefix
+    if (prefix.length < 3)
+      for (const step of steps) yield* histories([...prefix, step])
+  }
+  let checked = 0
+  for (const history of histories()) {
+    const listeners = recordVisibilityListeners()
+    const callbacks = [vi.fn(), vi.fn()]
+    try {
+      for (const step of history) {
+        const callback = callbacks[step.callback]!
+        if (step.add)
+          document.addEventListener(`visibilitychange`, callback, step.options)
+        else
+          document.removeEventListener(
+            `visibilitychange`,
+            callback,
+            step.options,
+          )
+      }
+      document.dispatchEvent(new Event(`visibilitychange`))
+      // Native dispatch supplies the independent count, including both capture
+      // identities of one callback. Teardown cannot change this observation.
+      const dispatched = callbacks.reduce(
+        (count, callback) => count + callback.mock.calls.length,
+        0,
+      )
+      expect(listeners.live(), JSON.stringify(history)).toBe(dispatched)
+      checked++
+    } finally {
+      listeners.restore()
+      for (const callback of callbacks) {
+        document.removeEventListener(`visibilitychange`, callback, false)
+        document.removeEventListener(`visibilitychange`, callback, true)
+      }
+    }
+  }
+  expect(checked).toBe(8421)
+}, 60_000)
+
+// Teardown must preserve a failed comparison and release its registrations.
+// Enumerate every retained subset of three fresh callbacks. Dispatch observes
+// actual EventTarget ownership independently of the recorder's live count.
+it(`releases recorded listeners after preserving a primary failure`, async () => {
+  for (let retained = 0; retained < 8; retained++) {
+    const listeners = recordVisibilityListeners()
+    const callbacks = Array.from({ length: 3 }, () => vi.fn())
+    const primary = new Error(`listener comparison failed`)
+    try {
+      await expect(
+        withElectricCleanup(() => {
+          for (const [index, callback] of callbacks.entries()) {
+            document.addEventListener(`visibilitychange`, callback)
+            if ((retained & (1 << index)) === 0)
+              document.removeEventListener(`visibilitychange`, callback)
+          }
+          expect(listeners.registered()).toBe(3)
+          throw primary
+        }, [() => listeners.restore()]),
+      ).rejects.toBe(primary)
+      document.dispatchEvent(new Event(`visibilitychange`))
+      for (const callback of callbacks) expect(callback).not.toHaveBeenCalled()
+    } finally {
+      // Independent cleanup also makes this calibration safe on the old recorder.
+      for (const callback of callbacks)
+        document.removeEventListener(`visibilitychange`, callback)
+      listeners.restore()
+    }
+  }
+})
diff --git a/packages/electric-db-collection/tests/pg-serializer-finite-decoder.ts b/packages/electric-db-collection/tests/pg-serializer-finite-decoder.ts
new file mode 100644
index 0000000000..9c85ecccc6
--- /dev/null
+++ b/packages/electric-db-collection/tests/pg-serializer-finite-decoder.ts
@@ -0,0 +1,74 @@
+/**
+ * Independent decoder for the serializer's flat finite-value text dialect. The
+ * PostgreSQL serializer oracle (pg-serializer-oracle.property.test.ts) compares
+ * production output against inputs through it.
+ */
+export type FiniteArrayValue = string | number | boolean | null
+
+export function parseFiniteNumber(text: string): number {
+  const match = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.exec(text)
+  // Comparing the full match also rejects a final newline before JavaScript's $.
+  if (match?.[0] !== text || !Number.isFinite(Number(text))) {
+    throw new Error(`invalid finite numeric output: ${JSON.stringify(text)}`)
+  }
+  return Number(text)
+}
+
+/**
+ * Decode the existing serializer's flat finite-value dialect, not arbitrary SQL.
+ * Quoted text is distinct from unquoted NULL, boolean, and numeric tokens.
+ * Grammar authority: PostgreSQL 18, sections 8.15.2 and 8.15.6:
+ * https://www.postgresql.org/docs/18/arrays.html#ARRAYS-IO
+ * No casts, nested dimensions, server ranges, or provider NULL policy are modeled.
+ */
+export function parseFiniteArray(text: string): Array<FiniteArrayValue> {
+  const values: Array<FiniteArrayValue> = []
+  let position = 1
+  const invalid = () =>
+    new Error(
+      `invalid flat array output at ${position}: ${JSON.stringify(text)}`,
+    )
+  if (text[0] !== `{`) throw invalid()
+  if (text === `{}`) return values
+
+  while (position < text.length) {
+    if (text[position] === `"`) {
+      position++
+      let value = ``
+      let closed = false
+      while (position < text.length) {
+        const character = text[position++]!
+        if (character === `"`) {
+          closed = true
+          break
+        }
+        if (character === `\\`) {
+          if (position === text.length) throw invalid()
+          value += text[position++]!
+        } else {
+          value += character
+        }
+      }
+      if (!closed) throw invalid()
+      values.push(value)
+    } else {
+      const start = position
+      while (
+        position < text.length &&
+        text[position] !== `,` &&
+        text[position] !== `}`
+      )
+        position++
+      const token = text.slice(start, position)
+      if (token === `NULL`) values.push(null)
+      else if (token === `true`) values.push(true)
+      else if (token === `false`) values.push(false)
+      else values.push(parseFiniteNumber(token))
+    }
+
+    const separator = text[position++]
+    if (separator === `}` && position === text.length) return values
+    if (separator !== `,`) throw invalid()
+  }
+  throw invalid()
+}
diff --git a/packages/electric-db-collection/tests/pg-serializer-oracle.property.test.ts b/packages/electric-db-collection/tests/pg-serializer-oracle.property.test.ts
index c75e38fb9e..2f0ff9d36f 100644
--- a/packages/electric-db-collection/tests/pg-serializer-oracle.property.test.ts
+++ b/packages/electric-db-collection/tests/pg-serializer-oracle.property.test.ts
@@ -1,11 +1,14 @@
 import { describe, expect, it } from 'vitest'
-import { fc, test as fcTest } from '@fast-check/vitest'
+import { fc } from '@fast-check/vitest'
 import { serialize } from '../src/pg-serializer'
+import { oracleReplayTest, oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import {
-  oraclePropertyOptions,
-  oracleReplayTest,
-  oracleRuns,
-} from '../../db/tests/oracle-config'
+  parseFiniteArray,
+  parseFiniteNumber,
+} from './pg-serializer-finite-decoder'
+import { serializerProp } from './pg-serializer-property-support'
+import type { FiniteArrayValue } from './pg-serializer-finite-decoder'
 
 // Replay one named law with TANSTACK_DB_ORACLE_SEED=<reported seed>,
 // TANSTACK_DB_ORACLE_PATH=<reported shrink path>, and
@@ -13,29 +16,9 @@ import {
 // TANSTACK_DB_ORACLE_SEED=1 TANSTACK_DB_ORACLE_PATH=0 \
 // TANSTACK_DB_ORACLE_PROPERTY=pg-serializer.mixed-array-contents \
 // pnpm exec vitest run tests/pg-serializer-oracle.property.test.ts
-const registeredProperties = new Set<string>()
 // Examples stand aside during any path replay, which runs one property.
 const example = oracleReplayTest(it)
 
-function serializerProp<T>(property: string, [arbitrary]: [fc.Arbitrary<T>]) {
-  return (name: string, check: (value: T) => void): void => {
-    if (registeredProperties.has(name)) {
-      throw new Error(`duplicate PostgreSQL serializer property: ${name}`)
-    }
-    registeredProperties.add(name)
-    // A path replay of the property runs only the random campaign, from its
-    // path. The fixed campaign stands aside during every path replay.
-    oracleReplayTest(fcTest).prop([arbitrary], {
-      numRuns: oracleRuns(100),
-      seed: 20260930,
-    })(`${name} (fixed)`, check)
-    oracleReplayTest(fcTest, property).prop(
-      [arbitrary],
-      oraclePropertyOptions(100, property),
-    )(`${name} (random)`, check)
-  }
-}
-
 /**
  * # Does PostgreSQL text serialization preserve the supported value domain?
  *
@@ -70,76 +53,6 @@ function serializerProp<T>(property: string, [arbitrary]: [fc.Arbitrary<T>]) {
  * flat finite-value model. Malformed array text is a nearby rejected output.
  */
 
-type FiniteArrayValue = string | number | boolean | null
-
-function parseFiniteNumber(text: string): number {
-  const match = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.exec(text)
-  // Comparing the full match also rejects a final newline before JavaScript's $.
-  if (match?.[0] !== text || !Number.isFinite(Number(text))) {
-    throw new Error(`invalid finite numeric output: ${JSON.stringify(text)}`)
-  }
-  return Number(text)
-}
-
-/**
- * Decode the existing serializer's flat finite-value dialect, not arbitrary SQL.
- * Quoted text is distinct from unquoted NULL, boolean, and numeric tokens.
- * Grammar authority: PostgreSQL 18, sections 8.15.2 and 8.15.6:
- * https://www.postgresql.org/docs/18/arrays.html#ARRAYS-IO
- * No casts, nested dimensions, server ranges, or provider NULL policy are modeled.
- */
-function parseFiniteArray(text: string): Array<FiniteArrayValue> {
-  const values: Array<FiniteArrayValue> = []
-  let position = 1
-  const invalid = () =>
-    new Error(
-      `invalid flat array output at ${position}: ${JSON.stringify(text)}`,
-    )
-  if (text[0] !== `{`) throw invalid()
-  if (text === `{}`) return values
-
-  while (position < text.length) {
-    if (text[position] === `"`) {
-      position++
-      let value = ``
-      let closed = false
-      while (position < text.length) {
-        const character = text[position++]!
-        if (character === `"`) {
-          closed = true
-          break
-        }
-        if (character === `\\`) {
-          if (position === text.length) throw invalid()
-          value += text[position++]!
-        } else {
-          value += character
-        }
-      }
-      if (!closed) throw invalid()
-      values.push(value)
-    } else {
-      const start = position
-      while (
-        position < text.length &&
-        text[position] !== `,` &&
-        text[position] !== `}`
-      )
-        position++
-      const token = text.slice(start, position)
-      if (token === `NULL`) values.push(null)
-      else if (token === `true`) values.push(true)
-      else if (token === `false`) values.push(false)
-      else values.push(parseFiniteNumber(token))
-    }
-
-    const separator = text[position++]
-    if (separator === `}` && position === text.length) return values
-    if (separator !== `,`) throw invalid()
-  }
-  throw invalid()
-}
-
 function expectFiniteArrayContents(
   input: ReadonlyArray<FiniteArrayValue | undefined>,
   output: string,
@@ -147,6 +60,8 @@ function expectFiniteArrayContents(
   expect(parseFiniteArray(output)).toEqual(input.map((value) => value ?? null))
 }
 
+declareOracle({ check: [expectFiniteArrayContents] })
+
 describe(`pg-serializer property-based tests`, () => {
   describe(`string serialization`, () => {
     serializerProp(`pg-serializer.string-passthrough`, [fc.string()])(
@@ -231,14 +146,6 @@ describe(`pg-serializer property-based tests`, () => {
     )
   })
 
-  describe(`null/undefined serialization`, () => {
-    serializerProp(`pg-serializer.nullish-empty`, [
-      fc.constantFrom(null, undefined),
-    ])(`null and undefined both serialize to empty string`, (val) => {
-      expect(serialize(val)).toBe(``)
-    })
-  })
-
   describe(`date serialization`, () => {
     // Use bounded dates to avoid negative years which have different ISO format
     const arbitraryBoundedDate = fc.date({
@@ -247,13 +154,6 @@ describe(`pg-serializer property-based tests`, () => {
       max: new Date(`9999-12-31T23:59:59.999Z`),
     })
 
-    example.each([
-      [new Date(`0000-01-01T00:00:00.000Z`), `0000-01-01T00:00:00.000Z`],
-      [new Date(`9999-12-31T23:59:59.999Z`), `9999-12-31T23:59:59.999Z`],
-    ] as const)(`serializes the bounded Date endpoint %s`, (date, text) => {
-      expect(serialize(date)).toBe(text)
-    })
-
     serializerProp(`pg-serializer.date-iso`, [arbitraryBoundedDate])(
       `dates produce valid ISO strings`,
       (date) => {
@@ -361,35 +261,6 @@ describe(`pg-serializer property-based tests`, () => {
   })
 
   describe(`finite scalar and array checker calibration`, () => {
-    example.each([
-      [`0`, 0],
-      [`-0`, -0],
-      [`1.25`, 1.25],
-      [`5e-324`, Number.MIN_VALUE],
-      [`1.7976931348623157e+308`, Number.MAX_VALUE],
-      [`-2.5E-3`, -0.0025],
-    ] as const)(`reads the complete finite token %s`, (text, value) => {
-      expect(parseFiniteNumber(text)).toBe(value)
-    })
-
-    example.each([
-      ``,
-      ` `,
-      `1.25junk`,
-      `1.25\n`,
-      `1.25 2`,
-      `0x10`,
-      `NaN`,
-      `Infinity`,
-      `1e999`,
-      `1e`,
-      `1.2.3`,
-    ])(`rejects the invalid finite numeric token %j`, (text) => {
-      expect(() => parseFiniteNumber(text)).toThrow(
-        `invalid finite numeric output`,
-      )
-    })
-
     const validArrays: Array<{
       name: string
       input: Array<FiniteArrayValue | undefined>
@@ -502,24 +373,6 @@ describe(`pg-serializer property-based tests`, () => {
       expect(replay.errorInstance).toMatchObject({ name: `AssertionError` })
     })
 
-    example.each([
-      ``,
-      `[]`,
-      `{`,
-      `}`,
-      `{1`,
-      `{1,}`,
-      `{,1}`,
-      `{true,,false}`,
-      `{1}tail`,
-      `{"unterminated}`,
-      `{"a" "b"}`,
-      `{"a"b"}`,
-      `{"trailing\\`,
-    ])(`rejects malformed array output %j`, (output) => {
-      expect(() => parseFiniteArray(output)).toThrow()
-    })
-
     serializerProp(`pg-serializer.mixed-array-contents`, [
       fc.array(
         fc.oneof(
diff --git a/packages/electric-db-collection/tests/pg-serializer-property-support.ts b/packages/electric-db-collection/tests/pg-serializer-property-support.ts
new file mode 100644
index 0000000000..a5d981ca4b
--- /dev/null
+++ b/packages/electric-db-collection/tests/pg-serializer-property-support.ts
@@ -0,0 +1,33 @@
+import { test as fcTest } from '@fast-check/vitest'
+import {
+  oraclePropertyOptions,
+  oracleReplayTest,
+  oracleRuns,
+} from '../../db/tests/oracle-config'
+import type { fc } from '@fast-check/vitest'
+
+// Registers a generated property under a unique name, once as a fixed campaign
+// and once as a random campaign. The pg-serializer oracle and its ordinary
+// serializer tests both register properties through this helper.
+const registeredProperties = new Set<string>()
+export function serializerProp<T>(
+  property: string,
+  [arbitrary]: [fc.Arbitrary<T>],
+) {
+  return (name: string, check: (value: T) => void): void => {
+    if (registeredProperties.has(name)) {
+      throw new Error(`duplicate PostgreSQL serializer property: ${name}`)
+    }
+    registeredProperties.add(name)
+    // A path replay of the property runs only the random campaign, from its
+    // path. The fixed campaign stands aside during every path replay.
+    oracleReplayTest(fcTest).prop([arbitrary], {
+      numRuns: oracleRuns(100),
+      seed: 20260930,
+    })(`${name} (fixed)`, check)
+    oracleReplayTest(fcTest, property).prop(
+      [arbitrary],
+      oraclePropertyOptions(100, property),
+    )(`${name} (random)`, check)
+  }
+}
diff --git a/packages/electric-db-collection/tests/pg-serializer.test.ts b/packages/electric-db-collection/tests/pg-serializer.test.ts
index 266da1acf2..c706e1aaca 100644
--- a/packages/electric-db-collection/tests/pg-serializer.test.ts
+++ b/packages/electric-db-collection/tests/pg-serializer.test.ts
@@ -1,5 +1,11 @@
+import { fc } from '@fast-check/vitest'
 import { describe, expect, it } from 'vitest'
 import { serialize } from '../src/pg-serializer'
+import {
+  parseFiniteArray,
+  parseFiniteNumber,
+} from './pg-serializer-finite-decoder'
+import { serializerProp } from './pg-serializer-property-support'
 
 describe(`pg-serializer`, () => {
   describe(`serialize`, () => {
@@ -124,3 +130,71 @@ describe(`pg-serializer`, () => {
     })
   })
 })
+
+describe(`pg-serializer property-based tests`, () => {
+  describe(`null/undefined serialization`, () => {
+    serializerProp(`pg-serializer.nullish-empty`, [
+      fc.constantFrom(null, undefined),
+    ])(`null and undefined both serialize to empty string`, (val) => {
+      expect(serialize(val)).toBe(``)
+    })
+  })
+
+  describe(`date serialization`, () => {
+    it.each([
+      [new Date(`0000-01-01T00:00:00.000Z`), `0000-01-01T00:00:00.000Z`],
+      [new Date(`9999-12-31T23:59:59.999Z`), `9999-12-31T23:59:59.999Z`],
+    ] as const)(`serializes the bounded Date endpoint %s`, (date, text) => {
+      expect(serialize(date)).toBe(text)
+    })
+  })
+
+  describe(`finite scalar and array checker calibration`, () => {
+    it.each([
+      [`0`, 0],
+      [`-0`, -0],
+      [`1.25`, 1.25],
+      [`5e-324`, Number.MIN_VALUE],
+      [`1.7976931348623157e+308`, Number.MAX_VALUE],
+      [`-2.5E-3`, -0.0025],
+    ] as const)(`reads the complete finite token %s`, (text, value) => {
+      expect(parseFiniteNumber(text)).toBe(value)
+    })
+
+    it.each([
+      ``,
+      ` `,
+      `1.25junk`,
+      `1.25\n`,
+      `1.25 2`,
+      `0x10`,
+      `NaN`,
+      `Infinity`,
+      `1e999`,
+      `1e`,
+      `1.2.3`,
+    ])(`rejects the invalid finite numeric token %j`, (text) => {
+      expect(() => parseFiniteNumber(text)).toThrow(
+        `invalid finite numeric output`,
+      )
+    })
+
+    it.each([
+      ``,
+      `[]`,
+      `{`,
+      `}`,
+      `{1`,
+      `{1,}`,
+      `{,1}`,
+      `{true,,false}`,
+      `{1}tail`,
+      `{"unterminated}`,
+      `{"a" "b"}`,
+      `{"a"b"}`,
+      `{"trailing\\`,
+    ])(`rejects malformed array output %j`, (output) => {
+      expect(() => parseFiniteArray(output)).toThrow()
+    })
+  })
+})
diff --git a/packages/electron-db-sqlite-persistence/tests/electron-ipc-readiness-oracle.test.ts b/packages/electron-db-sqlite-persistence/tests/electron-ipc-readiness-oracle.test.ts
index 2a4e5d009a..885e371362 100644
--- a/packages/electron-db-sqlite-persistence/tests/electron-ipc-readiness-oracle.test.ts
+++ b/packages/electron-db-sqlite-persistence/tests/electron-ipc-readiness-oracle.test.ts
@@ -4,6 +4,7 @@ import { join } from 'node:path'
 import { describe, expect, it, onTestFinished, vi } from 'vitest'
 import { persistedCollectionOptions } from '@tanstack/db-sqlite-persistence-core'
 import { createNodeSQLitePersistence } from '@tanstack/node-db-sqlite-persistence'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
   IR,
   createCollection,
@@ -386,13 +387,26 @@ async function observeIpcReadinessHistory(
   return observed
 }
 
+// The law of initial readiness: the observed checkpoints of each composed load
+// equal the model's prediction for that history.
+async function compareIpcReadinessHistory(
+  history: IpcReadinessHistory,
+): Promise<void> {
+  expect(await observeIpcReadinessHistory(history)).toEqual(
+    expectedCheckpoints(history),
+  )
+}
+
+declareOracle({
+  check: [compareIpcReadinessHistory],
+  model: [expectedCheckpoints],
+})
+
 describe(`Electron renderer initial readiness follows the composed load`, () => {
   it.each(ipcReadinessHistories)(
     `matches the model: $renderer renderer, hydration $hydration, then $next`,
     async (history) => {
-      expect(await observeIpcReadinessHistory(history)).toEqual(
-        expectedCheckpoints(history),
-      )
+      await compareIpcReadinessHistory(history)
     },
     historyTimeout,
   )
@@ -604,6 +618,21 @@ async function observeCoordinatedRendererHistory(
   }
 }
 
+// The law of follower settlement: the observed follower checkpoints equal the
+// model's prediction for each apply outcome and consumer.
+async function compareCoordinatedRendererHistory(
+  history: CoordinatedRendererHistory,
+): Promise<void> {
+  expect(await observeCoordinatedRendererHistory(history)).toEqual(
+    expectedCoordinatedRenderer(history),
+  )
+}
+
+declareOracle({
+  check: [compareCoordinatedRendererHistory],
+  model: [expectedCoordinatedRenderer],
+})
+
 describe(`Electron follower renderer settles with its owner's rows`, () => {
   it.each(
     ([`ok`, `fails`] as const).flatMap((apply) =>
@@ -615,9 +644,7 @@ describe(`Electron follower renderer settles with its owner's rows`, () => {
   )(
     `matches the model: apply $apply, consumer $consumer`,
     async (history) => {
-      expect(await observeCoordinatedRendererHistory(history)).toEqual(
-        expectedCoordinatedRenderer(history),
-      )
+      await compareCoordinatedRendererHistory(history)
     },
     isElectronFullE2EEnabled() ? 180_000 : 20_000,
   )
diff --git a/packages/electron-db-sqlite-persistence/tests/reload-class-oracle.electron.e2e.test.ts b/packages/electron-db-sqlite-persistence/tests/reload-class-oracle.electron.e2e.test.ts
index b7f6fdd8bb..cd391c26fc 100644
--- a/packages/electron-db-sqlite-persistence/tests/reload-class-oracle.electron.e2e.test.ts
+++ b/packages/electron-db-sqlite-persistence/tests/reload-class-oracle.electron.e2e.test.ts
@@ -14,6 +14,7 @@ import { fileURLToPath } from 'node:url'
 import { build } from 'esbuild'
 import electronPath from 'electron'
 import { expect, it, onTestFinished } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 
 const fixture = join(
   dirname(fileURLToPath(import.meta.url)),
@@ -125,6 +126,22 @@ function runApp(out: string, databases: string): Promise<Result> {
   })
 }
 
+// The app's comparison of each fixed reload history with the oracle: every
+// expected history reports, and none reports a violation.
+function expectReloadClassLawsHold(result: Result): void {
+  expect(result.expected.length).toBeGreaterThan(0)
+  expect(result.results.map(({ name }) => name)).toEqual(result.expected)
+  expect(
+    result.results.filter(
+      (entry) =>
+        entry.failedBeforeCheckpoint !== undefined ||
+        (entry.violations?.length ?? 0) > 0,
+    ),
+  ).toEqual([])
+}
+
+declareOracle({ check: [expectReloadClassLawsHold] })
+
 it(`real Electron reload is free of avoidable work ahead of its reads`, async () => {
   const out = mkdtempSync(join(tmpdir(), `reload-class-app-`))
   const databases = mkdtempSync(join(tmpdir(), `reload-class-db-`))
@@ -135,13 +152,5 @@ it(`real Electron reload is free of avoidable work ahead of its reads`, async ()
   await bundle(out)
   const result = await runApp(out, databases)
   if (process.env.RELOAD_ORACLE_DEBUG) console.log(JSON.stringify(result))
-  expect(result.expected.length).toBeGreaterThan(0)
-  expect(result.results.map(({ name }) => name)).toEqual(result.expected)
-  expect(
-    result.results.filter(
-      (entry) =>
-        entry.failedBeforeCheckpoint !== undefined ||
-        (entry.violations?.length ?? 0) > 0,
-    ),
-  ).toEqual([])
+  expectReloadClassLawsHold(result)
 }, 600_000)
diff --git a/packages/node-db-sqlite-persistence/tests/expression-index-oracle.test.ts b/packages/node-db-sqlite-persistence/tests/expression-index-oracle.test.ts
index 9ba77b9fe7..864c524516 100644
--- a/packages/node-db-sqlite-persistence/tests/expression-index-oracle.test.ts
+++ b/packages/node-db-sqlite-persistence/tests/expression-index-oracle.test.ts
@@ -33,6 +33,10 @@
  * raw SQL, and native-host planning. Generated BigInts stay inside SQLite's
  * signed range. A fixed legacy-byte case checks read compatibility beyond it.
  *
+ * Fixed scenarios whose expectations are literal, the replay-configuration and
+ * plan-classifier self-tests, and the cleanup self-test are ordinary unit tests in
+ * expression-index.test.ts, with the observer in expression-index-support.ts.
+ *
  * Independent model: fixed keys encode the result of each generated relation;
  * the equality witness also uses a full adapter scan, a small path walker, and
  * strict scalar equality. Neither judgment calls the SQL compiler.
@@ -60,24 +64,18 @@
  */
 import fc from 'fast-check'
 import { describe, expect, vi, it as vitestIt } from 'vitest'
-import {
-  BasicIndex,
-  IR,
-  coalesce as coalesceExpression,
-  createCollection,
-} from '@tanstack/db'
+import { IR } from '@tanstack/db'
 import {
   createPersistedTableName,
   createSQLiteCorePersistenceAdapter,
   decodePersistedStorageKey,
-  persistedCollectionOptions,
 } from '@tanstack/db-sqlite-persistence-core'
 import {
   oraclePropertyOptions,
   oracleReplayTest,
   oracleRuns,
-  readOracleRunConfig,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import {
   Temporal,
   temporalFamilies,
@@ -85,19 +83,34 @@ import {
   temporalValue,
 } from '../../db-sqlite-persistence-core/tests/temporal-value-oracle'
 import { BetterSqlite3SQLiteDriver } from '../src/node-driver'
+import {
+  SQLITE_BIGINT_MAX,
+  SQLITE_BIGINT_MIN,
+  bigintRangeError,
+  createNestedRow,
+  createQueryObservingDriver,
+  observeExpressionIndexScenario,
+  planScansTable,
+  planUsesNamedIndex,
+  planUsesNamedIndexForOrdering,
+  readPath,
+  sqliteJsonPath,
+  sqliteScalarParameter,
+  withFailurePreservingCleanup,
+} from './expression-index-support'
+import type { TemporalFamily } from '../../db-sqlite-persistence-core/tests/temporal-value-oracle'
 import type {
-  PersistedTx,
-  SQLiteDriver,
-} from '@tanstack/db-sqlite-persistence-core'
+  CapturedQuery,
+  ExpressionIndexObservation,
+  ExpressionIndexScenario,
+  OracleScalar,
+  QueryPlanRow,
+  QueryTransform,
+  ScanRow,
+} from './expression-index-support'
 
 const DEFAULT_ORACLE_SEED = 1_659_005
 const DEFAULT_ORACLE_RUNS = 8
-const SQLITE_BIGINT_MIN = -9_223_372_036_854_775_808n
-const SQLITE_BIGINT_MAX = 9_223_372_036_854_775_807n
-const PERSISTED_TYPE_TAG = `__tanstack_db_persisted_type__`
-const PERSISTED_VALUE_TAG = `value`
-
-type OracleScalar = boolean | number | string
 
 type OracleCase = {
   path: Array<string>
@@ -105,22 +118,6 @@ type OracleCase = {
   distractors: [OracleScalar, OracleScalar]
 }
 
-type CapturedQuery = {
-  sql: string
-  params: ReadonlyArray<unknown>
-}
-
-type QueryTransform = (query: CapturedQuery) => CapturedQuery
-
-type QueryPlanRow = {
-  detail: string
-}
-
-type ScanRow = {
-  key: string | number
-  value: Record<string, unknown>
-}
-
 const identifierStart = [`a`, `m`, `p`, `t`, `x`] as const
 const identifierRest = [`a`, `b`, `e`, `i`, `n`, `r`, `s`, `0`, `1`] as const
 
@@ -172,49 +169,6 @@ function generatedCampaignParameters(campaign: GeneratedPropertyCampaign) {
   return { verbose: 2 as const, ...campaign.parameters }
 }
 
-function createNestedRow(
-  path: ReadonlyArray<string>,
-  value: OracleScalar | bigint,
-): Record<string, unknown> {
-  let nested: unknown = value
-
-  for (let index = path.length - 1; index >= 0; index--) {
-    const segment = path[index]!
-    if (/^\d+$/.test(segment)) {
-      const entries = Array.from<unknown>({ length: Number(segment) + 1 })
-      entries[Number(segment)] = nested
-      nested = entries
-    } else {
-      nested = { [segment]: nested }
-    }
-  }
-
-  if (typeof nested !== `object` || nested === null || Array.isArray(nested)) {
-    throw new Error(`generated path must be rooted in an object`)
-  }
-  return nested as Record<string, unknown>
-}
-
-function readPath(
-  row: Record<string, unknown>,
-  path: ReadonlyArray<string>,
-): unknown {
-  let value: unknown = row
-
-  for (const segment of path) {
-    if (Array.isArray(value) && /^\d+$/.test(segment)) {
-      value = value[Number(segment)]
-      continue
-    }
-    if (typeof value !== `object` || value === null || Array.isArray(value)) {
-      return undefined
-    }
-    value = (value as Record<string, unknown>)[segment]
-  }
-
-  return value
-}
-
 function expectedKeysFromScan(
   rows: ReadonlyArray<ScanRow>,
   path: ReadonlyArray<string>,
@@ -226,175 +180,6 @@ function expectedKeysFromScan(
     .sort()
 }
 
-function sqliteJsonPath(path: ReadonlyArray<string>): string {
-  return path.reduce((result, segment) => {
-    return /^\d+$/.test(segment)
-      ? `${result}[${segment}]`
-      : `${result}.${segment}`
-  }, `$`)
-}
-
-function sqliteLiteral(value: string): string {
-  return `'${value.replace(/'/g, `''`)}'`
-}
-
-function sqliteScalarParameter(value: OracleScalar): number | string {
-  return typeof value === `boolean` ? (value ? 1 : 0) : value
-}
-
-function serializeIndexExpression(expression: IR.BasicExpression): string {
-  return JSON.stringify(
-    expression,
-    function (this: Record<string, unknown>, key, value: unknown) {
-      // Read the original before Temporal.toJSON converts it to an ordinary string.
-      const original = this[key]
-      if (
-        original instanceof Temporal.Instant ||
-        original instanceof Temporal.PlainDate
-      ) {
-        return {
-          [PERSISTED_TYPE_TAG]:
-            original instanceof Temporal.Instant
-              ? `Temporal.Instant`
-              : `Temporal.PlainDate`,
-          [PERSISTED_VALUE_TAG]: original.toString(),
-        }
-      }
-      return typeof value === `bigint`
-        ? {
-            [PERSISTED_TYPE_TAG]: `bigint`,
-            [PERSISTED_VALUE_TAG]: value.toString(),
-          }
-        : value
-    },
-  )
-}
-
-function bigintRangeError(value: bigint): string {
-  return `SQLite BigInt value ${value} is outside the signed 64-bit range [${SQLITE_BIGINT_MIN}, ${SQLITE_BIGINT_MAX}]`
-}
-
-function createQueryObservingDriver(
-  inner: SQLiteDriver,
-  observe: (query: CapturedQuery) => void,
-  transform?: QueryTransform,
-): SQLiteDriver {
-  const wrap = (driver: SQLiteDriver): SQLiteDriver => ({
-    exec: (sql) => driver.exec(sql),
-    query: async <T>(sql: string, params: ReadonlyArray<unknown> = []) => {
-      const query = transform
-        ? transform({ sql, params: [...params] })
-        : { sql, params: [...params] }
-      observe(query)
-      return driver.query<T>(query.sql, query.params)
-    },
-    run: (sql, params) => driver.run(sql, params),
-    transaction: (body) =>
-      driver.transaction((transactionDriver) => body(wrap(transactionDriver))),
-    transactionWithDriver: driver.transactionWithDriver
-      ? (body) =>
-          driver.transactionWithDriver!((transactionDriver) =>
-            body(wrap(transactionDriver)),
-          )
-      : undefined,
-  })
-
-  return wrap(inner)
-}
-
-async function withFailurePreservingCleanup<T>(
-  body: () => T | Promise<T>,
-  cleanups: ReadonlyArray<() => void | Promise<void>>,
-): Promise<T> {
-  let primary: { error: unknown } | undefined
-  let result: T
-  try {
-    result = await body()
-  } catch (error) {
-    primary = { error }
-  }
-
-  const cleanupFailures: Array<unknown> = []
-  for (const cleanup of cleanups) {
-    try {
-      await cleanup()
-    } catch (error) {
-      cleanupFailures.push(error)
-    }
-  }
-
-  if (cleanupFailures.length > 0) {
-    if (primary) {
-      throw new AggregateError(
-        [primary.error, ...cleanupFailures],
-        `Expression-index oracle and cleanup failed`,
-        { cause: primary.error },
-      )
-    }
-    if (cleanupFailures.length === 1) throw cleanupFailures[0]
-    throw new AggregateError(
-      cleanupFailures,
-      `Expression-index oracle cleanup failed`,
-    )
-  }
-  if (primary) throw primary.error
-  return result!
-}
-
-function planUsesNamedIndex(
-  plan: ReadonlyArray<QueryPlanRow>,
-  tableName: string,
-  indexName: string,
-): boolean {
-  const tablePattern = sqlitePlanIdentifierPattern(tableName)
-  const indexPattern = sqlitePlanIdentifierPattern(indexName)
-  const searchPattern = new RegExp(
-    `\\bSEARCH(?: TABLE)? ${tablePattern}(?:\\s|$)`,
-  )
-  const indexUsagePattern = new RegExp(
-    `\\bUSING INDEX ${indexPattern}(?:\\s|$)`,
-  )
-
-  return plan.some(
-    ({ detail }) =>
-      searchPattern.test(detail) && indexUsagePattern.test(detail),
-  )
-}
-
-function planScansTable(
-  plan: ReadonlyArray<QueryPlanRow>,
-  tableName: string,
-): boolean {
-  const tablePattern = sqlitePlanIdentifierPattern(tableName)
-  const scanPattern = new RegExp(`^SCAN(?: TABLE)? ${tablePattern}(?:\\s|$)`)
-  return plan.some(({ detail }) => scanPattern.test(detail))
-}
-
-function sqlitePlanIdentifierPattern(identifier: string): string {
-  const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, `\\$&`)
-  return `(?:"${escaped}"|${escaped})`
-}
-
-type ExpressionIndexScenario = {
-  viaWrapper?: boolean
-  observeIndexValues?: boolean
-  label: string
-  indexExpression: IR.BasicExpression
-  where?: IR.BasicExpression<boolean>
-  orderBy?: IR.OrderBy
-  preserveResultOrder?: boolean
-  rows: ReadonlyArray<{
-    key: string
-    value: Record<string, unknown>
-  }>
-  preparePreviousIndex?: (
-    adapter: ReturnType<typeof createSQLiteCorePersistenceAdapter>,
-    collectionId: string,
-    signature: string,
-  ) => Promise<void>
-  transformQuery?: QueryTransform
-}
-
 const GENERATED_SCENARIO_KINDS = [
   `eq`,
   `in`,
@@ -426,247 +211,6 @@ type GeneratedExpressionIndexScenario = ExpressionIndexScenario & {
   expectedPlan: `search` | `ordered-scan`
 }
 
-type ExpressionIndexObservation = {
-  indexSql: unknown
-  indexValues?: Array<{ key: string; value: unknown }>
-  adapterKeys: Array<string>
-  directSqlKeys: Array<string>
-  indexName: string
-  plan: Array<QueryPlanRow>
-  predicateQuery: CapturedQuery
-  tableName: string
-}
-
-async function observeExpressionIndexScenario({
-  viaWrapper = false,
-  observeIndexValues = false,
-  label,
-  indexExpression,
-  where,
-  orderBy,
-  preserveResultOrder = false,
-  rows,
-  preparePreviousIndex,
-  transformQuery,
-}: ExpressionIndexScenario): Promise<ExpressionIndexObservation> {
-  const baseDriver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  const collectionId = `expression-index-${label}`
-  let signature = `generated-expression`
-  let cleanupCollection: (() => Promise<void>) | undefined
-  const tableName = createPersistedTableName(collectionId, `c`)
-  let predicateQuery: CapturedQuery | undefined
-
-  const observingDriver = createQueryObservingDriver(
-    baseDriver,
-    (query) => {
-      if (
-        query.sql.includes(`SELECT key, value, metadata, row_version`) &&
-        query.sql.includes(`FROM "${tableName}"`)
-      ) {
-        predicateQuery = query
-      }
-    },
-    transformQuery
-      ? (query) =>
-          query.sql.includes(`SELECT key, value, metadata, row_version`) &&
-          query.sql.includes(`FROM "${tableName}"`)
-            ? transformQuery(query)
-            : query
-      : undefined,
-  )
-  const adapter = createSQLiteCorePersistenceAdapter({
-    driver: observingDriver,
-  })
-
-  return withFailurePreservingCleanup(async () => {
-    await adapter.applyCommittedTx(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        txId: `seed-${label}`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: rows.map((row) => ({
-          type: `insert` as const,
-          key: row.key,
-          value: row.value,
-        })),
-      },
-    )
-    await preparePreviousIndex?.(adapter, collectionId, signature)
-    if (viaWrapper) {
-      if (
-        indexExpression.type !== `func` ||
-        indexExpression.name !== `coalesce` ||
-        indexExpression.args[1]?.type !== `val`
-      )
-        throw new Error(`Expected coalesce wrapper witness`)
-      const fallback = indexExpression.args[1].value
-      const collection = createCollection(
-        persistedCollectionOptions<Record<string, unknown>, string>({
-          id: collectionId,
-          getKey: (row) => String(row.id),
-          defaultIndexType: BasicIndex,
-          sync: {
-            sync: ({ markReady }) => {
-              markReady()
-            },
-          },
-          persistence: { adapter },
-        }),
-      )
-      cleanupCollection = () => collection.cleanup()
-      collection.createIndex((row) => coalesceExpression(row.stamp, fallback))
-      const metadata = collection.getIndexMetadata()[0]!
-      signature = metadata.signature
-      expect(metadata.expression.type).toBe(`func`)
-      if (
-        metadata.expression.type !== `func` ||
-        metadata.expression.args[1]?.type !== `val`
-      )
-        throw new Error(`Missing native literal`)
-      expect(metadata.expression.args[1].value).toBeInstanceOf(
-        fallback instanceof Temporal.Instant
-          ? Temporal.Instant
-          : Temporal.PlainDate,
-      )
-      const adjacent =
-        fallback instanceof Temporal.Instant
-          ? fallback.add({ nanoseconds: 1 })
-          : (fallback as Temporal.PlainDate).add({ days: 1 })
-      const second = collection.createIndex((row) =>
-        coalesceExpression(row.stamp, new IR.Value(adjacent)),
-      )
-      expect(collection.getIndexMetadata()[1]!.signature).not.toBe(signature)
-      collection.removeIndex(second)
-      await collection.preload()
-    } else {
-      await adapter.ensureIndex(
-        { kind: `eager`, collectionId: collectionId },
-        signature,
-        {
-          expressionSql: [serializeIndexExpression(indexExpression)],
-        },
-      )
-    }
-
-    const adapterRows = await adapter.loadSubset(
-      { kind: `eager`, collectionId: collectionId },
-      {
-        ...(where ? { where } : {}),
-        ...(orderBy ? { orderBy } : {}),
-      },
-    )
-    if (!predicateQuery) {
-      throw new Error(`predicate query checkpoint was not reached`)
-    }
-
-    const directSqlRows = baseDriver
-      .getDatabase()
-      .prepare(predicateQuery.sql)
-      .all(...predicateQuery.params) as Array<{ key: string }>
-    const registryRow = baseDriver
-      .getDatabase()
-      .prepare(
-        `SELECT index_name, expression_sql FROM persisted_index_registry
-           WHERE collection_id = ? AND signature = ?`,
-      )
-      .get(collectionId, signature) as
-      { index_name: string; expression_sql: string } | undefined
-    if (!registryRow) {
-      throw new Error(`expression index registry checkpoint was not reached`)
-    }
-
-    const plan = baseDriver
-      .getDatabase()
-      .prepare(`EXPLAIN QUERY PLAN ${predicateQuery.sql}`)
-      .all(...predicateQuery.params) as Array<QueryPlanRow>
-
-    const normalizeKeys = (keys: Array<string>): Array<string> =>
-      preserveResultOrder ? keys : keys.sort()
-
-    const expressionSql = (
-      JSON.parse(registryRow.expression_sql) as Array<string>
-    )[0]!
-    const indexValues = observeIndexValues
-      ? (
-          baseDriver
-            .getDatabase()
-            .prepare(
-              `SELECT key, ${expressionSql} AS value FROM "${tableName}" ORDER BY key`,
-            )
-            .all() as Array<{ key: string; value: unknown }>
-        ).map((row) => ({
-          key: String(decodePersistedStorageKey(row.key)),
-          value: row.value,
-        }))
-      : undefined
-    return {
-      indexValues,
-      indexSql: baseDriver
-        .getDatabase()
-        .prepare(`SELECT sql FROM sqlite_master WHERE name = ?`)
-        .get(registryRow.index_name),
-      adapterKeys: normalizeKeys(adapterRows.map((row) => String(row.key))),
-      directSqlKeys: normalizeKeys(
-        directSqlRows.map((row) => String(decodePersistedStorageKey(row.key))),
-      ),
-      indexName: registryRow.index_name,
-      plan,
-      predicateQuery,
-      tableName,
-    }
-  }, [() => cleanupCollection?.(), () => baseDriver.close()])
-}
-
-function makeOverbroadEqualityMutation(query: CapturedQuery): CapturedQuery {
-  if (!query.sql.includes(` WHERE `)) return query
-  const sql = query.sql.replace(/ = \?/g, ` >= ?`)
-  if (sql === query.sql) {
-    throw new Error(`overbroad equality mutation did not reach the predicate`)
-  }
-  return { sql, params: query.params }
-}
-
-function makeLegacyPathBindingMutation(query: CapturedQuery): CapturedQuery {
-  if (!query.sql.includes(` WHERE `)) return query
-
-  const params: Array<unknown> = []
-  let pathCount = 0
-  let bindingIndex = 0
-  const sql = query.sql.replace(
-    /json_extract\(value, ('(?:''|[^'])+')\)|\?/g,
-    (match, literal: string | undefined) => {
-      if (literal === undefined) {
-        params.push(query.params[bindingIndex++])
-        return match
-      }
-      pathCount++
-      params.push(literal.slice(1, -1).replace(/''/g, `'`))
-      return `json_extract(value, ?)`
-    },
-  )
-  if (pathCount === 0 || bindingIndex !== query.params.length) {
-    throw new Error(
-      `legacy path-binding mutation did not reach all reference paths and bindings`,
-    )
-  }
-  return { sql, params }
-}
-
-function planUsesNamedIndexForOrdering(
-  plan: ReadonlyArray<QueryPlanRow>,
-  tableName: string,
-  indexName: string,
-): boolean {
-  const tablePattern = sqlitePlanIdentifierPattern(tableName)
-  const indexPattern = sqlitePlanIdentifierPattern(indexName)
-  const orderedScanPattern = new RegExp(
-    `^SCAN(?: TABLE)? ${tablePattern} USING INDEX ${indexPattern}(?:\\s|$)`,
-  )
-  return plan.some(({ detail }) => orderedScanPattern.test(detail))
-}
-
 const numericIndexCaseArbitrary = fc
   .tuple(legalPathArbitrary, fc.integer({ min: -10_000, max: 10_000 }))
   .map(([path, target]) => ({ path, target }))
@@ -1293,1077 +837,115 @@ async function assertExpressionIndexHistory(
   }, [() => baseDriver.close()])
 }
 
+// Pure JavaScript comparisons state which public rows satisfy a Number or
+// BigInt range predicate. The model is independent of SQLite and of the
+// adapter, so the SQL candidate set is judged against these keys.
+function expectedRangeKeys(
+  rows: ReadonlyArray<{ key: string; value: { n: number | bigint } }>,
+  operator: `gt` | `gte` | `lt` | `lte`,
+  fieldOnLeft: boolean,
+  bound: bigint,
+): Array<string> {
+  const matches = (
+    op: `gt` | `gte` | `lt` | `lte`,
+    left: number | bigint,
+    right: number | bigint,
+  ): boolean => {
+    switch (op) {
+      case `gt`:
+        return left > right
+      case `gte`:
+        return left >= right
+      case `lt`:
+        return left < right
+      case `lte`:
+        return left <= right
+    }
+  }
+  return rows
+    .filter(({ value }) =>
+      fieldOnLeft
+        ? matches(operator, value.n, bound)
+        : matches(operator, bound, value.n),
+    )
+    .map(({ key }) => key)
+    .sort()
+}
+
+// Fixture ranks give the semantic order of native values, and their kind and
+// canonical text give equality. Null and missing stamps match no ordering
+// predicate. This model is independent of SQLite, so SQL may keep extra
+// candidates that the row evaluator then removes.
+function expectedNativePolarityKeys(
+  family: TemporalFamily,
+  nullableRows: ReadonlyArray<{ key: string }>,
+  operator: `gt` | `gte` | `lt` | `lte`,
+  reverse: boolean,
+  negate: boolean,
+): Array<string> {
+  return nullableRows
+    .flatMap((row) => {
+      if (row.key === `null` || row.key === `missing`) return []
+      const rank =
+        row.key === `nan` ? Infinity : family.ranks[Number(row.key.slice(4))]!
+      const a = reverse ? family.ranks[1] : rank
+      const b = reverse ? rank : family.ranks[1]
+      const match =
+        operator === `gt`
+          ? a > b
+          : operator === `gte`
+            ? a >= b
+            : operator === `lt`
+              ? a < b
+              : a <= b
+      return match !== negate ? [row.key] : []
+    })
+    .sort()
+}
+
+declareOracle({
+  check: [assertExpressionIndexHistory],
+  model: [expectedKeysFromScan, expectedRangeKeys, expectedNativePolarityKeys],
+  grammar: [generatedScenarioMatrixArbitrary],
+})
+
 describe(`SQLite expression-index oracle`, () => {
   const it = oracleReplayTest(vitestIt)
 
-  it.each([
-    {
-      label: `empty seed`,
-      environment: { TANSTACK_DB_ORACLE_SEED: `` },
-      message: `TANSTACK_DB_ORACLE_SEED must be an integer`,
-    },
-    {
-      label: `path without seed`,
-      environment: { TANSTACK_DB_ORACLE_PATH: `0` },
-      message: `TANSTACK_DB_ORACLE_PATH requires TANSTACK_DB_ORACLE_SEED`,
-    },
-    {
-      label: `property without path`,
-      environment: {
-        TANSTACK_DB_ORACLE_SEED: `1659005`,
-        TANSTACK_DB_ORACLE_PROPERTY: `sqlite-persistence.expression-index`,
-      },
-      message: `TANSTACK_DB_ORACLE_PROPERTY requires TANSTACK_DB_ORACLE_PATH`,
-    },
-    {
-      label: `invalid shrink path`,
-      environment: {
-        TANSTACK_DB_ORACLE_SEED: `1659005`,
-        TANSTACK_DB_ORACLE_PATH: `0:`,
-        TANSTACK_DB_ORACLE_PROPERTY: `sqlite-persistence.expression-index`,
+  it(`keeps large Number matches across BigInt range directions and boolean wrappers`, async () => {
+    const field = new IR.PropRef([`n`])
+    const cases = [
+      {
+        name: `positive`,
+        number: 1000000000000000100,
+        bound: 1000000000000000120n,
       },
-      message: `TANSTACK_DB_ORACLE_PATH must contain colon-separated nonnegative integers`,
-    },
-  ])(`rejects a $label replay configuration`, ({ environment, message }) => {
-    expect(() => readOracleRunConfig(environment)).toThrow(message)
-  })
-
-  it(`accepts a seed alone and a checked seed and shrink-path replay pair`, () => {
-    expect(readOracleRunConfig({ TANSTACK_DB_ORACLE_SEED: `1659005` })).toEqual(
       {
-        multiplier: 1,
-        replaySeed: 1659005,
-        replayPath: undefined,
-        replayProperty: undefined,
+        name: `negative`,
+        number: -1000000000000000100,
+        bound: -1000000000000000120n,
       },
-    )
-    expect(
-      readOracleRunConfig({
-        TANSTACK_DB_ORACLE_SEED: `-1659005`,
-        TANSTACK_DB_ORACLE_PATH: `0:1:2`,
-        TANSTACK_DB_ORACLE_PROPERTY: `sqlite-persistence.expression-index`,
-      }),
-    ).toEqual({
-      multiplier: 1,
-      replaySeed: -1659005,
-      replayPath: `0:1:2`,
-      replayProperty: `sqlite-persistence.expression-index`,
-    })
-  })
-
-  it.each([
-    {
-      label: `coalesce-constant`,
-      indexExpression: new IR.Func(`coalesce`, [
-        new IR.PropRef([`nickname`]),
-        new IR.Value(`none`),
-      ]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.Func(`coalesce`, [
-          new IR.PropRef([`nickname`]),
-          new IR.Value(`none`),
-        ]),
-        new IR.Value(`none`),
-      ]),
-      rows: [
-        { key: `missing`, value: { nickname: null } },
-        { key: `present`, value: { nickname: `Ada` } },
-      ],
-      expectedKeys: [`missing`],
-    },
-    {
-      label: `string-membership-constant`,
-      indexExpression: new IR.Func(`in`, [
-        new IR.PropRef([`nickname`]),
-        new IR.Value([`Ada`, `Grace`]),
-      ]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.Func(`in`, [
-          new IR.PropRef([`nickname`]),
-          new IR.Value([`Ada`, `Grace`]),
-        ]),
-        new IR.Value(true),
-      ]),
-      rows: [
-        { key: `matching`, value: { nickname: `Ada` } },
-        { key: `different`, value: { nickname: `Linus` } },
-      ],
-      expectedKeys: [`matching`],
-    },
-    {
-      label: `strftime-constant`,
-      indexExpression: new IR.Func(`strftime`, [
-        new IR.Value(`%Y-%m-%d`),
-        new IR.Func(`datetime`, [new IR.PropRef([`createdAt`])]),
-      ]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.Func(`strftime`, [
-          new IR.Value(`%Y-%m-%d`),
-          new IR.Func(`datetime`, [new IR.PropRef([`createdAt`])]),
-        ]),
-        new IR.Value(`2026-04-05`),
-      ]),
-      rows: [
-        { key: `current`, value: { createdAt: `2026-04-05T00:00:00.000Z` } },
-        {
-          key: `epoch-milliseconds`,
-          value: { createdAt: new Date(`2026-04-05T00:00:00.000Z`).getTime() },
-        },
-        { key: `past`, value: { createdAt: `2025-04-05T00:00:00.000Z` } },
-      ],
-      expectedKeys: [`current`, `epoch-milliseconds`],
-    },
-    {
-      label: `add-constant`,
-      indexExpression: new IR.Func(`add`, [
-        new IR.PropRef([`score`]),
-        new IR.Value(1),
-      ]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.Func(`add`, [new IR.PropRef([`score`]), new IR.Value(1)]),
-        new IR.Value(`21`),
-      ]),
-      rows: [
-        { key: `matching`, value: { score: `2` } },
-        { key: `different`, value: { score: 4 } },
-      ],
-      expectedKeys: [`matching`],
-    },
-    {
-      label: `bigint-coalesce-constant`,
-      indexExpression: new IR.Func(`coalesce`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value(SQLITE_BIGINT_MIN),
-      ]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.Func(`coalesce`, [
-          new IR.PropRef([`largeViewCount`]),
-          new IR.Value(SQLITE_BIGINT_MIN),
-        ]),
-        new IR.Value(SQLITE_BIGINT_MIN),
-      ]),
-      rows: [
-        { key: `missing`, value: { largeViewCount: null } },
-        { key: `minimum`, value: { largeViewCount: SQLITE_BIGINT_MIN } },
-        { key: `zero`, value: { largeViewCount: 0n } },
-      ],
-      expectedKeys: [`minimum`, `missing`],
-    },
-  ])(
-    `loads through a constant-bearing $label expression`,
-    async ({ expectedKeys, ...scenario }) => {
-      const observation = await observeExpressionIndexScenario(scenario)
-
-      expect(observation.adapterKeys).toEqual(expectedKeys)
-      if (
-        scenario.label === `strftime-constant` ||
-        scenario.label === `add-constant` ||
-        scenario.label === `string-membership-constant`
-      ) {
-        expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
-        expect(observation.directSqlKeys).toEqual(
-          scenario.rows.map((row) => row.key).sort(),
-        )
-        expect(planScansTable(observation.plan, observation.tableName)).toBe(
-          true,
-        )
-        return
-      }
-      expect(observation.directSqlKeys).toEqual(expectedKeys)
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-      ).toBe(true)
-    },
-  )
-
-  // Literal positions and polarity come from the string contract, not SQL.
-  it.each([`\u0000ab`, `a\u0000b`, `ab\u0000`])(
-    `preserves ordinary NUL strings / %j`,
-    async (target) => {
-      const ref = new IR.PropRef([`stamp`])
-      const literal = new IR.Value(target)
-      const eq = new IR.Func<boolean>(`eq`, [ref, literal])
-      for (const where of [
-        eq,
-        new IR.Func<boolean>(`eq`, [literal, ref]),
-        new IR.Func<boolean>(`in`, [ref, new IR.Value([target, `other`])]),
-        new IR.Func<boolean>(`and`, [eq, new IR.Value(true)]),
-        new IR.Func<boolean>(`or`, [eq, new IR.Value(false)]),
-      ]) {
-        const result = await observeExpressionIndexScenario({
-          label: `NUL`,
-          indexExpression: ref,
-          where,
-          rows: [
-            { key: `match`, value: { stamp: target } },
-            { key: `different`, value: { stamp: `absent` } },
-          ],
-        })
-        expect(result.adapterKeys).toEqual([`match`])
-        expect(result.directSqlKeys).toEqual([`match`])
-      }
-    },
-  )
+    ] as const
+    const operators = [`gt`, `gte`, `lt`, `lte`] as const
 
-  // Distinct native/ordinary fallback meanings must retain separate persisted
-  // indexes. The wrapper receives both public definitions before preload; the
-  // registry and sqlite_master checkpoints expose a signature collision even
-  // when residual query evaluation could still return correct rows.
-  it(`persists separate indexes for native and ordinary tagged literals`, async () => {
-    vi.stubGlobal(`Temporal`, Temporal)
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const adapter = createSQLiteCorePersistenceAdapter({ driver })
-    const collectionId = `native-tag-indexes`
-    const collection = createCollection(
-      persistedCollectionOptions<{ id: string; stamp: unknown }, string>({
-        id: collectionId,
-        getKey: (row) => row.id,
-        defaultIndexType: BasicIndex,
-        sync: { sync: ({ markReady }) => markReady() },
-        persistence: { adapter },
-      }),
-    )
-    try {
-      await withFailurePreservingCleanup(async () => {
-        const native = Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-        for (const value of [
-          native,
-          { __type: `Temporal.Instant`, value: String(native) },
-        ]) {
-          collection.createIndex((row) =>
-            coalesceExpression(row.stamp, new IR.Value(value)),
+    for (const testCase of cases) {
+      const rows = [
+        { key: `rounded-number`, value: { n: testCase.number } },
+        { key: `exact-bigint`, value: { n: testCase.bound } },
+      ]
+      for (const operator of operators) {
+        for (const fieldOnLeft of [true, false]) {
+          const literal = new IR.Value(testCase.bound)
+          const predicate = new IR.Func<boolean>(
+            operator,
+            fieldOnLeft ? [field, literal] : [literal, field],
           )
-        }
-        await collection.preload()
-        const entries = driver
-          .getDatabase()
-          .prepare(
-            `SELECT index_name FROM persisted_index_registry WHERE collection_id = ? AND removed = 0`,
+          const expectedKeys = expectedRangeKeys(
+            rows,
+            operator,
+            fieldOnLeft,
+            testCase.bound,
           )
-          .all(collectionId) as Array<{ index_name: string }>
-        expect(entries).toHaveLength(2)
-        expect(new Set(entries.map((entry) => entry.index_name)).size).toBe(2)
-        for (const entry of entries) {
-          expect(
-            driver
-              .getDatabase()
-              .prepare(
-                `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
-              )
-              .all(entry.index_name),
-          ).toHaveLength(1)
-        }
-      }, [() => collection.cleanup(), () => driver.close()])
-    } finally {
-      vi.unstubAllGlobals()
-    }
-  })
-
-  // A NUL string stays ordinary text in both bound predicates and index DDL.
-  // Enumerate string-only and native-mixed membership, with positive/negative
-  // predicates. Expected keys come from fixture membership; stored index values
-  // independently observe the DDL before residual filtering can hide a mismatch.
-  it.each([`\u0000ab`, `a\u0000b`, `ab\u0000`, `é'\u0000𐀀`])(
-    `preserves NUL membership literals in index definitions / %j`,
-    async (target) => {
-      vi.stubGlobal(`Temporal`, Temporal)
-      try {
-        const native = Temporal.Instant.from(`2026-01-02T00:00:00Z`)
-        for (const mixed of [false, true]) {
-          const membership = new IR.Func<boolean>(`in`, [
-            new IR.PropRef([`stamp`]),
-            new IR.Value(mixed ? [target, native] : [target]),
-          ])
-          for (const negate of [false, true]) {
-            const result = await observeExpressionIndexScenario({
-              label: `NUL-membership`,
-              indexExpression: membership,
-              observeIndexValues: true,
-              where: negate ? new IR.Func(`not`, [membership]) : membership,
-              rows: [
-                { key: `match`, value: { stamp: target } },
-                { key: `native`, value: { stamp: native } },
-                { key: `other`, value: { stamp: `absent` } },
-              ],
-            })
-            const matches = mixed ? [`match`, `native`] : [`match`]
-            const expected = negate
-              ? [`match`, `native`, `other`].filter(
-                  (key) => !matches.includes(key),
-                )
-              : matches
-            expect(result.adapterKeys).toEqual(expected)
-            expect(result.directSqlKeys).toEqual(
-              expect.arrayContaining(expected),
-            )
-            expect(result.indexValues).toEqual([
-              { key: `match`, value: 1 },
-              { key: `native`, value: mixed ? 1 : 0 },
-              { key: `other`, value: 0 },
-            ])
-          }
-        }
-      } finally {
-        vi.unstubAllGlobals()
-      }
-    },
-  )
-
-  it(`keeps large string membership indexes within SQLite expression depth`, async () => {
-    const membership = new IR.Func(`in`, [
-      new IR.PropRef([`nickname`]),
-      new IR.Value(Array.from({ length: 1025 }, (_, index) => `name-${index}`)),
-    ])
-    const observation = await observeExpressionIndexScenario({
-      label: `large-string-membership`,
-      indexExpression: membership,
-      where: new IR.Func<boolean>(`eq`, [membership, new IR.Value(true)]),
-      rows: [
-        { key: `matching`, value: { nickname: `name-1024` } },
-        { key: `different`, value: { nickname: `absent` } },
-      ],
-    })
-    expect(observation.adapterKeys).toEqual([`matching`])
-    // The DDL remains valid at large arity. The safe classifier deliberately
-    // leaves eq(in(...), true) to residual filtering, as for other scalar functions.
-    expect(observation.indexSql).toBeDefined()
-    expect(observation.directSqlKeys).toEqual([`different`, `matching`])
-    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
-  })
-
-  it(`rebuilds a persisted BigInt-constant index when its normalized spec changes`, async () => {
-    const indexExpression = new IR.Func(`coalesce`, [
-      new IR.PropRef([`largeViewCount`]),
-      new IR.Value(SQLITE_BIGINT_MIN),
-    ])
-    const observation = await observeExpressionIndexScenario({
-      label: `bigint-constant-upgrade`,
-      indexExpression,
-      where: new IR.Func<boolean>(`eq`, [
-        indexExpression,
-        new IR.Value(SQLITE_BIGINT_MIN),
-      ]),
-      rows: [
-        { key: `missing`, value: { largeViewCount: null } },
-        { key: `minimum`, value: { largeViewCount: SQLITE_BIGINT_MIN } },
-        { key: `zero`, value: { largeViewCount: 0n } },
-      ],
-      preparePreviousIndex: async (adapter, collectionId, signature) => {
-        await adapter.ensureIndex(
-          { kind: `eager`, collectionId: collectionId },
-          signature,
-          {
-            expressionSql: [
-              JSON.stringify(indexExpression, (_key, value: unknown) =>
-                typeof value === `bigint` ? value.toString() : value,
-              ),
-            ],
-          },
-        )
-      },
-    })
-
-    expect(observation.adapterKeys).toEqual([`minimum`, `missing`])
-    expect(observation.directSqlKeys).toEqual([`minimum`, `missing`])
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-  })
-
-  it.each([
-    {
-      label: `bigint-field-range`,
-      indexExpression: new IR.PropRef([`largeViewCount`]),
-      where: new IR.Func<boolean>(`gt`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value(BigInt(`9007199254740993`)),
-      ]),
-      rows: [
-        {
-          key: `lower`,
-          value: { largeViewCount: BigInt(`9007199254740992`) },
-        },
-        {
-          key: `higher`,
-          value: { largeViewCount: BigInt(`9007199254740997`) },
-        },
-      ],
-      expectedKeys: [`higher`],
-      expectedCandidateKeys: [`higher`, `lower`],
-      expectedQueryParams: [],
-    },
-    {
-      label: `bigint-field-min-boundary`,
-      indexExpression: new IR.PropRef([`largeViewCount`]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value(SQLITE_BIGINT_MIN),
-      ]),
-      rows: [
-        {
-          key: `minimum`,
-          value: { largeViewCount: SQLITE_BIGINT_MIN },
-        },
-        {
-          key: `next`,
-          value: { largeViewCount: SQLITE_BIGINT_MIN + 1n },
-        },
-      ],
-      expectedKeys: [`minimum`],
-      expectedQueryParams: [],
-    },
-    {
-      label: `bigint-field-max-boundary`,
-      indexExpression: new IR.PropRef([`largeViewCount`]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value(SQLITE_BIGINT_MAX),
-      ]),
-      rows: [
-        {
-          key: `previous`,
-          value: { largeViewCount: SQLITE_BIGINT_MAX - 1n },
-        },
-        {
-          key: `maximum`,
-          value: { largeViewCount: SQLITE_BIGINT_MAX },
-        },
-      ],
-      expectedKeys: [`maximum`],
-      expectedQueryParams: [],
-    },
-    {
-      label: `date-field-range`,
-      indexExpression: new IR.PropRef([`createdAt`]),
-      where: new IR.Func<boolean>(`gt`, [
-        new IR.PropRef([`createdAt`]),
-        new IR.Value(new Date(`2026-01-02T12:00:00.000Z`)),
-      ]),
-      rows: [
-        {
-          key: `earlier`,
-          value: { createdAt: new Date(`2026-01-02T00:00:00.000Z`) },
-        },
-        {
-          key: `later`,
-          value: { createdAt: new Date(`2026-01-03T00:00:00.000Z`) },
-        },
-        {
-          key: `numeric-later`,
-          value: { createdAt: new Date(`2026-01-03T00:00:00.000Z`).getTime() },
-        },
-      ],
-      expectedKeys: [`later`, `numeric-later`],
-      expectedQueryParams: [],
-    },
-    {
-      label: `bigint-field-in`,
-      indexExpression: new IR.PropRef([`largeViewCount`]),
-      where: new IR.Func<boolean>(`in`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value([BigInt(`9007199254740992`), BigInt(`9007199254740997`)]),
-      ]),
-      rows: [
-        {
-          key: `included-low`,
-          value: { largeViewCount: BigInt(`9007199254740992`) },
-        },
-        {
-          key: `excluded`,
-          value: { largeViewCount: BigInt(`9007199254740994`) },
-        },
-        {
-          key: `included-high`,
-          value: { largeViewCount: BigInt(`9007199254740997`) },
-        },
-      ],
-      expectedKeys: [`included-high`, `included-low`],
-      expectedQueryParams: [`[9007199254740992,9007199254740997]`],
-    },
-    {
-      label: `bigint-field-batched-in`,
-      indexExpression: new IR.PropRef([`largeViewCount`]),
-      where: new IR.Func<boolean>(`in`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value(
-          Array.from(
-            { length: 901 },
-            (_unused, index) => BigInt(`9007199254740992`) + BigInt(index),
-          ),
-        ),
-      ]),
-      rows: [
-        {
-          key: `included-first`,
-          value: { largeViewCount: BigInt(`9007199254740992`) },
-        },
-        {
-          key: `excluded`,
-          value: { largeViewCount: BigInt(`9007199254740991`) },
-        },
-        {
-          key: `included-last`,
-          value: { largeViewCount: BigInt(`9007199254741892`) },
-        },
-      ],
-      expectedKeys: [`included-first`, `included-last`],
-      expectedQueryParams: [
-        `[${Array.from({ length: 901 }, (_unused, index) =>
-          (BigInt(`9007199254740992`) + BigInt(index)).toString(),
-        ).join(`,`)}]`,
-      ],
-    },
-  ])(
-    `uses the raw $label field expression index`,
-    async ({
-      expectedKeys,
-      expectedCandidateKeys,
-      expectedQueryParams,
-      ...scenario
-    }) => {
-      const observation = await observeExpressionIndexScenario(scenario)
-      const diagnostic = JSON.stringify(
-        {
-          sql: observation.predicateQuery.sql,
-          params: observation.predicateQuery.params,
-          plan: observation.plan.map((row) => row.detail),
-          adapterKeys: observation.adapterKeys,
-          directSqlKeys: observation.directSqlKeys,
-        },
-        null,
-        2,
-      )
-
-      expect(observation.adapterKeys, diagnostic).toEqual(expectedKeys)
-      if (scenario.label === `date-field-range`) {
-        expect(observation.predicateQuery.sql, diagnostic).not.toContain(
-          ` WHERE `,
-        )
-        expect(observation.directSqlKeys, diagnostic).toEqual(
-          scenario.rows.map((row) => row.key).sort(),
-        )
-        expect(planScansTable(observation.plan, observation.tableName)).toBe(
-          true,
-        )
-        return
-      }
-      expect(observation.directSqlKeys, diagnostic).toEqual(
-        expectedCandidateKeys ?? expectedKeys,
-      )
-      expect(observation.predicateQuery.params, diagnostic).toEqual(
-        expectedQueryParams,
-      )
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-        diagnostic,
-      ).toBe(true)
-    },
-  )
-
-  it(`uses the field expression index for a paired-surrogate string equality`, async () => {
-    const field = new IR.PropRef([`name`])
-    const observation = await observeExpressionIndexScenario({
-      label: `paired-surrogate-equality`,
-      indexExpression: field,
-      where: new IR.Func<boolean>(`eq`, [field, new IR.Value(`😀`)]),
-      rows: [
-        { key: `matching`, value: { name: `😀` } },
-        { key: `other`, value: { name: `other` } },
-      ],
-    })
-
-    expect(observation.adapterKeys).toEqual([`matching`])
-    expect(observation.directSqlKeys).toEqual([`matching`])
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-  })
-
-  it.each([
-    { label: `field on the left`, reversed: false },
-    { label: `field on the right`, reversed: true },
-  ])(
-    `keeps indexed lone-surrogate equality sound with $label`,
-    async ({ reversed }) => {
-      const field = new IR.PropRef([`name`])
-      const value = new IR.Value(`\uD800`)
-      const observation = await observeExpressionIndexScenario({
-        label: `lone-surrogate-equality`,
-        indexExpression: field,
-        where: new IR.Func<boolean>(
-          `eq`,
-          reversed ? [value, field] : [field, value],
-        ),
-        rows: [
-          { key: `matching`, value: { name: `\uD800` } },
-          { key: `other-lone`, value: { name: `\uDC00` } },
-          { key: `ordinary`, value: { name: `ordinary` } },
-        ],
-      })
-
-      expect(observation.adapterKeys).toEqual([`matching`])
-      // The binding and stored value must have the same SQLite byte sequence.
-      expect(observation.directSqlKeys).toEqual([`matching`])
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-      ).toBe(true)
-    },
-  )
-
-  it.each([
-    { label: `BigInt equality`, value: 1n, expectedKeys: [`bigint`] },
-    { label: `boolean equality`, value: true, expectedKeys: [`boolean`] },
-  ])(
-    `keeps indexed $label sound across stored scalar types`,
-    async ({ value, expectedKeys }) => {
-      const field = new IR.PropRef([`n`])
-      const observation = await observeExpressionIndexScenario({
-        label: `mixed-scalar-equality`,
-        indexExpression: field,
-        where: new IR.Func<boolean>(`eq`, [field, new IR.Value(value)]),
-        rows: [
-          { key: `bigint`, value: { n: 1n } },
-          { key: `boolean`, value: { n: true } },
-          { key: `number`, value: { n: 1 } },
-          { key: `text`, value: { n: `1` } },
-          { key: `nan`, value: { n: Number.NaN } },
-          { key: `date`, value: { n: new Date(1) } },
-          { key: `null`, value: { n: null } },
-          { key: `missing`, value: {} },
-        ],
-      })
-
-      expect(observation.adapterKeys).toEqual(expectedKeys)
-      expect(observation.directSqlKeys).toEqual([`bigint`, `boolean`, `number`])
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-      ).toBe(true)
-    },
-  )
-
-  it.each([`eq`, `in`] as const)(
-    `keeps Date epoch matches when a numeric $operator predicate falls back`,
-    async (operator) => {
-      const field = new IR.PropRef([`n`])
-      const observation = await observeExpressionIndexScenario({
-        label: `numeric-${operator}-date-epoch`,
-        indexExpression: field,
-        where: new IR.Func<boolean>(operator, [
-          field,
-          new IR.Value(operator === `eq` ? 1 : [1]),
-        ]),
-        rows: [
-          { key: `date`, value: { n: new Date(1) } },
-          { key: `number`, value: { n: 1 } },
-          { key: `other`, value: { n: 2 } },
-        ],
-      })
-
-      expect(observation.adapterKeys).toEqual([`date`, `number`])
-      expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
-      expect(observation.directSqlKeys).toEqual([`date`, `number`, `other`])
-    },
-  )
-
-  it(`keeps a BigInt match through a lower-wrapped membership fallback`, async () => {
-    const lower = new IR.Func(`lower`, [new IR.PropRef([`n`])])
-    const observation = await observeExpressionIndexScenario({
-      label: `bigint-lower-membership`,
-      indexExpression: lower,
-      where: new IR.Func<boolean>(`in`, [lower, new IR.Value([1n])]),
-      rows: [
-        { key: `bigint`, value: { n: 1n } },
-        { key: `number`, value: { n: 1 } },
-        { key: `text`, value: { n: `1` } },
-      ],
-    })
-
-    expect(observation.adapterKeys).toEqual([`bigint`])
-    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
-    expect(observation.directSqlKeys).toEqual([`bigint`, `number`, `text`])
-  })
-
-  it(`keeps a missing field equal to a lone-surrogate coalesce fallback`, async () => {
-    const fallback = `\uD800`
-    const coalesce = new IR.Func(`coalesce`, [
-      new IR.PropRef([`name`]),
-      new IR.Value(fallback),
-    ])
-    const observation = await observeExpressionIndexScenario({
-      label: `lone-surrogate-coalesce`,
-      indexExpression: coalesce,
-      where: new IR.Func<boolean>(`eq`, [coalesce, new IR.Value(fallback)]),
-      rows: [
-        { key: `missing`, value: {} },
-        { key: `other`, value: { name: `other` } },
-      ],
-    })
-
-    expect(observation.adapterKeys).toEqual([`missing`])
-    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
-    expect(observation.directSqlKeys).toEqual([`missing`, `other`])
-  })
-
-  it(`keeps indexed BigInt membership sound across stored scalar types`, async () => {
-    const field = new IR.PropRef([`n`])
-    const observation = await observeExpressionIndexScenario({
-      label: `mixed-scalar-bigint-in`,
-      indexExpression: field,
-      where: new IR.Func<boolean>(`in`, [field, new IR.Value([1n, 2n])]),
-      rows: [
-        { key: `bigint-one`, value: { n: 1n } },
-        { key: `bigint-two`, value: { n: 2n } },
-        { key: `boolean`, value: { n: true } },
-        { key: `number`, value: { n: 1 } },
-        { key: `text`, value: { n: `1` } },
-        { key: `nan`, value: { n: Number.NaN } },
-        { key: `date`, value: { n: new Date(1) } },
-        { key: `null`, value: { n: null } },
-        { key: `missing`, value: {} },
-      ],
-    })
-
-    expect(observation.adapterKeys).toEqual([`bigint-one`, `bigint-two`])
-    expect(observation.directSqlKeys).toEqual([
-      `bigint-one`,
-      `bigint-two`,
-      `boolean`,
-      `number`,
-    ])
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-  })
-
-  it(`uses an indexed safe conjunct while leaving an unsafe range to the row evaluator`, async () => {
-    const status = new IR.PropRef([`status`])
-    const observation = await observeExpressionIndexScenario({
-      label: `indexed-safe-conjunct`,
-      indexExpression: status,
-      where: new IR.Func<boolean>(`and`, [
-        new IR.Func<boolean>(`eq`, [status, new IR.Value(`active`)]),
-        new IR.Func<boolean>(`gt`, [new IR.PropRef([`n`]), new IR.Value(0)]),
-      ]),
-      rows: [
-        { key: `active-nan`, value: { status: `active`, n: Number.NaN } },
-        { key: `active-negative`, value: { status: `active`, n: -1 } },
-        { key: `active-zero`, value: { status: `active`, n: 0 } },
-        { key: `inactive-positive`, value: { status: `inactive`, n: 2 } },
-        { key: `inactive-zero`, value: { status: `inactive`, n: 0 } },
-        { key: `inactive-nan`, value: { status: `inactive`, n: Number.NaN } },
-      ],
-    })
-
-    expect(observation.adapterKeys).toEqual([`active-nan`])
-    expect(observation.directSqlKeys).toEqual([`active-nan`, `active-zero`])
-    expect(observation.predicateQuery.sql).toContain(` WHERE `)
-    expect(observation.predicateQuery.sql).toContain(`$.n`)
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-    expect(planScansTable(observation.plan, observation.tableName)).toBe(false)
-  })
-
-  it.each([
-    {
-      operator: `gt`,
-      target: 1,
-      expectedKeys: [
-        `array`,
-        `bigint-positive`,
-        `date`,
-        `infinity`,
-        `nan`,
-        `numeric-text`,
-        `positive`,
-      ],
-    },
-    {
-      operator: `lt`,
-      target: 2,
-      expectedKeys: [
-        `bigint-negative`,
-        `negative`,
-        `negative-infinity`,
-        `negative-subnormal`,
-        `negative-text`,
-        `one`,
-        `zero`,
-      ],
-    },
-  ] as const)(
-    `uses an indexed superset for a mixed scalar $operator range`,
-    async ({ operator, target, expectedKeys }) => {
-      const field = new IR.PropRef([`n`])
-      const rows = [
-        { key: `negative`, value: { n: -2 } },
-        { key: `negative-subnormal`, value: { n: -Number.MIN_VALUE } },
-        { key: `zero`, value: { n: 0 } },
-        { key: `one`, value: { n: 1 } },
-        { key: `positive`, value: { n: 3 } },
-        { key: `nan`, value: { n: Number.NaN } },
-        { key: `infinity`, value: { n: Number.POSITIVE_INFINITY } },
-        { key: `negative-infinity`, value: { n: Number.NEGATIVE_INFINITY } },
-        { key: `numeric-text`, value: { n: `3` } },
-        { key: `negative-text`, value: { n: `-2` } },
-        { key: `word`, value: { n: `abc` } },
-        { key: `bigint-negative`, value: { n: -2n } },
-        { key: `bigint-positive`, value: { n: 3n } },
-        { key: `date`, value: { n: new Date(3) } },
-        { key: `null`, value: { n: null } },
-        { key: `missing`, value: {} },
-        { key: `array`, value: { n: [3] } },
-        { key: `object`, value: { n: { x: 3 } } },
-      ]
-      const observation = await observeExpressionIndexScenario({
-        label: `mixed-scalar-${operator}-range`,
-        indexExpression: field,
-        where: new IR.Func<boolean>(operator, [field, new IR.Value(target)]),
-        rows,
-      })
-
-      expect(observation.adapterKeys).toEqual(expectedKeys)
-      expect(observation.directSqlKeys).toEqual(
-        expect.arrayContaining([...expectedKeys]),
-      )
-      expect(observation.directSqlKeys.length).toBeLessThan(rows.length)
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-      ).toBe(true)
-      expect(planScansTable(observation.plan, observation.tableName)).toBe(
-        false,
-      )
-    },
-  )
-
-  it.each([
-    {
-      operator: `gt`,
-      expectedKeys: [`above`, `date`, `nan`, `numeric-text`],
-      expectedCandidates: 7,
-    },
-    {
-      operator: `gte`,
-      expectedKeys: [`above`, `date`, `equal`, `nan`, `numeric-text`],
-      expectedCandidates: 7,
-    },
-    {
-      operator: `lt`,
-      expectedKeys: [`below`, `negative`],
-      expectedCandidates: 8,
-    },
-    {
-      operator: `lte`,
-      expectedKeys: [`below`, `equal`, `negative`],
-      expectedCandidates: 8,
-    },
-  ] as const)(
-    `keeps matches adjacent to an indexed integer $operator bound`,
-    async ({ operator, expectedKeys, expectedCandidates }) => {
-      const field = new IR.PropRef([`n`])
-      const rows = [
-        { key: `negative`, value: { n: -1 } },
-        { key: `below`, value: { n: 1 - Number.EPSILON / 2 } },
-        { key: `equal`, value: { n: 1 } },
-        { key: `above`, value: { n: 1 + Number.EPSILON } },
-        { key: `nan`, value: { n: Number.NaN } },
-        { key: `numeric-text`, value: { n: `2` } },
-        { key: `date`, value: { n: new Date(2) } },
-        { key: `null`, value: { n: null } },
-        { key: `missing`, value: {} },
-      ]
-      const observation = await observeExpressionIndexScenario({
-        label: `adjacent-integer-${operator}`,
-        indexExpression: field,
-        where: new IR.Func<boolean>(operator, [field, new IR.Value(1)]),
-        rows,
-      })
-
-      expect(observation.adapterKeys).toEqual(expectedKeys)
-      expect(observation.directSqlKeys).toEqual(
-        expect.arrayContaining([...expectedKeys]),
-      )
-      expect(observation.directSqlKeys).toHaveLength(expectedCandidates)
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-      ).toBe(true)
-    },
-  )
-
-  it(`keeps Unicode lowercase matches in an indexed candidate set`, async () => {
-    const field = new IR.PropRef([`name`])
-    const lower = new IR.Func(`lower`, [field])
-    const rows = [
-      { key: `ascii-lower`, value: { name: `ak` } },
-      { key: `ascii-upper`, value: { name: `AK` } },
-      { key: `kelvin-inside`, value: { name: `aK` } },
-      { key: `ascii-other`, value: { name: `ak-more` } },
-      { key: `unicode-other`, value: { name: `aé` } },
-      { key: `ascii-before`, value: { name: `abc` } },
-    ]
-    const observation = await observeExpressionIndexScenario({
-      label: `unicode-lower-candidates`,
-      indexExpression: lower,
-      where: new IR.Func<boolean>(`eq`, [lower, new IR.Value(`ak`)]),
-      rows,
-    })
-
-    expect(observation.adapterKeys).toEqual([
-      `ascii-lower`,
-      `ascii-upper`,
-      `kelvin-inside`,
-    ])
-    expect(observation.directSqlKeys).toEqual(
-      expect.arrayContaining(observation.adapterKeys),
-    )
-    expect(observation.directSqlKeys).not.toContain(`ascii-other`)
-    expect(observation.directSqlKeys).toHaveLength(4)
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-    expect(planScansTable(observation.plan, observation.tableName)).toBe(false)
-  })
-
-  it.each([
-    {
-      label: `large Number and BigInt bound`,
-      value: { n: 1000000000000000100 },
-      indexExpression: new IR.PropRef([`n`]),
-      predicate: new IR.Func<boolean>(`gt`, [
-        new IR.PropRef([`n`]),
-        new IR.Value(1000000000000000120n),
-      ]),
-    },
-    {
-      label: `numeric object key`,
-      value: { part: { '0': `match` } },
-      indexExpression: new IR.PropRef([`part`, `0`]),
-      predicate: new IR.Func<boolean>(`eq`, [
-        new IR.PropRef([`part`, `0`]),
-        new IR.Value(`match`),
-      ]),
-    },
-    {
-      label: `Unicode lowercase after NUL`,
-      value: { name: `a\u0000K` },
-      indexExpression: new IR.Func(`lower`, [new IR.PropRef([`name`])]),
-      predicate: new IR.Func<boolean>(`eq`, [
-        new IR.Func(`lower`, [new IR.PropRef([`name`])]),
-        new IR.Value(`a\u0000k`),
-      ]),
-    },
-  ])(`keeps $label through a unary SQL candidate`, async (testCase) => {
-    for (const wrapper of [`and`, `or`] as const) {
-      const observation = await observeExpressionIndexScenario({
-        label: `candidate-${testCase.label}-${wrapper}`,
-        indexExpression: testCase.indexExpression,
-        where: new IR.Func<boolean>(wrapper, [testCase.predicate]),
-        rows: [{ key: `match`, value: testCase.value }],
-      })
-
-      // The JavaScript predicate matches each row by the public contract.
-      // Every matching key must survive SQLite before that evaluator runs.
-      expect(observation.adapterKeys).toEqual([`match`])
-      expect(observation.directSqlKeys).toContain(`match`)
-    }
-  })
-
-  it(`keeps large Number matches across BigInt range directions and boolean wrappers`, async () => {
-    const field = new IR.PropRef([`n`])
-    const cases = [
-      {
-        name: `positive`,
-        number: 1000000000000000100,
-        bound: 1000000000000000120n,
-      },
-      {
-        name: `negative`,
-        number: -1000000000000000100,
-        bound: -1000000000000000120n,
-      },
-    ] as const
-    const operators = [`gt`, `gte`, `lt`, `lte`] as const
-    const matches = (
-      operator: (typeof operators)[number],
-      left: number | bigint,
-      right: number | bigint,
-    ): boolean => {
-      switch (operator) {
-        case `gt`:
-          return left > right
-        case `gte`:
-          return left >= right
-        case `lt`:
-          return left < right
-        case `lte`:
-          return left <= right
-      }
-    }
-
-    for (const testCase of cases) {
-      const rows = [
-        { key: `rounded-number`, value: { n: testCase.number } },
-        { key: `exact-bigint`, value: { n: testCase.bound } },
-      ]
-      for (const operator of operators) {
-        for (const fieldOnLeft of [true, false]) {
-          const literal = new IR.Value(testCase.bound)
-          const predicate = new IR.Func<boolean>(
-            operator,
-            fieldOnLeft ? [field, literal] : [literal, field],
-          )
-          const expectedKeys = rows
-            .filter(({ value }) =>
-              fieldOnLeft
-                ? matches(operator, value.n, testCase.bound)
-                : matches(operator, testCase.bound, value.n),
-            )
-            .map(({ key }) => key)
-            .sort()
           for (const wrapper of [`direct`, `and`, `or`] as const) {
             const observation = await observeExpressionIndexScenario({
               label: `rounded-${testCase.name}-${operator}-${fieldOnLeft}-${wrapper}`,
@@ -2397,497 +979,6 @@ describe(`SQLite expression-index oracle`, () => {
     }
   })
 
-  it(`keeps numeric-key object and array matches across candidate kinds`, async () => {
-    const variants = [
-      {
-        name: `equality`,
-        match: `match`,
-        other: `other`,
-        predicate: (ref: IR.PropRef) =>
-          new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
-      },
-      {
-        name: `coalesce`,
-        match: `match`,
-        other: `other`,
-        predicate: (ref: IR.PropRef) =>
-          new IR.Func<boolean>(`eq`, [
-            new IR.Func(`coalesce`, [ref, new IR.Value(`fallback`)]),
-            new IR.Value(`match`),
-          ]),
-      },
-      {
-        name: `membership`,
-        match: 1n,
-        other: 2n,
-        predicate: (ref: IR.PropRef) =>
-          new IR.Func<boolean>(`in`, [ref, new IR.Value([1n])]),
-      },
-      {
-        name: `prefix`,
-        match: `match`,
-        other: `other`,
-        predicate: (ref: IR.PropRef) =>
-          new IR.Func<boolean>(`like`, [ref, new IR.Value(`mat%`)]),
-      },
-      {
-        name: `lowercase`,
-        match: `MATCH`,
-        other: `other`,
-        predicate: (ref: IR.PropRef) =>
-          new IR.Func<boolean>(`eq`, [
-            new IR.Func(`lower`, [ref]),
-            new IR.Value(`match`),
-          ]),
-      },
-    ]
-    for (const segment of [`0`, `1`]) {
-      const wrapArray = (value: unknown) => {
-        const items: Array<unknown> = []
-        items[Number(segment)] = value
-        return { part: items }
-      }
-      for (const variant of variants) {
-        const ref = new IR.PropRef([`part`, segment])
-        const rows = [
-          {
-            key: `array-match`,
-            value: wrapArray(variant.match),
-          },
-          {
-            key: `object-match`,
-            value: { part: { [segment]: variant.match } },
-          },
-          {
-            key: `array-other`,
-            value: wrapArray(variant.other),
-          },
-          {
-            key: `object-other`,
-            value: { part: { [segment]: variant.other } },
-          },
-        ]
-        const predicate = variant.predicate(ref)
-        for (const wrapper of [`direct`, `and`, `or`] as const) {
-          const observation = await observeExpressionIndexScenario({
-            label: `numeric-key-${segment}-${variant.name}-${wrapper}`,
-            indexExpression: ref,
-            where:
-              wrapper === `direct`
-                ? predicate
-                : new IR.Func<boolean>(wrapper, [predicate]),
-            rows,
-          })
-          const expectedKeys = [`array-match`, `object-match`]
-          expect(observation.adapterKeys).toEqual(expectedKeys)
-          expect(observation.directSqlKeys).toEqual(
-            expect.arrayContaining(expectedKeys),
-          )
-          if (variant.name === `equality`) {
-            expect(
-              planUsesNamedIndex(
-                observation.plan,
-                observation.tableName,
-                observation.indexName,
-              ),
-            ).toBe(true)
-          }
-        }
-      }
-    }
-  })
-
-  it(`indexes mixed array and object numeric paths`, async () => {
-    const ref = new IR.PropRef([`part`, `0`, `0`])
-    const observation = await observeExpressionIndexScenario({
-      label: `mixed-numeric-carriers`,
-      indexExpression: ref,
-      where: new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
-      rows: [
-        { key: `array-array`, value: { part: [[`match`]] } },
-        { key: `array-object`, value: { part: [{ '0': `match` }] } },
-        { key: `object-array`, value: { part: { '0': [`match`] } } },
-        { key: `object-object`, value: { part: { '0': { '0': `match` } } } },
-      ],
-    })
-    const expectedKeys = [
-      `array-array`,
-      `array-object`,
-      `object-array`,
-      `object-object`,
-    ]
-    expect(observation.adapterKeys).toEqual(expectedKeys)
-    expect(observation.directSqlKeys).toEqual(expectedKeys)
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-  })
-
-  it(`indexes every three-segment numeric carrier combination`, async () => {
-    const ref = new IR.PropRef([`part`, `0`, `0`, `0`])
-    const rows = Array.from({ length: 8 }, (_unused, mask) => {
-      let nested: unknown = `match`
-      for (let bit = 0; bit < 3; bit++) {
-        nested = mask & (1 << bit) ? [nested] : { '0': nested }
-      }
-      return { key: `carrier-${mask}`, value: { part: nested } }
-    })
-    const observation = await observeExpressionIndexScenario({
-      label: `three-numeric-carriers`,
-      indexExpression: ref,
-      where: new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
-      rows,
-    })
-    const expectedKeys = rows.map(({ key }) => key)
-    expect(observation.adapterKeys).toEqual(expectedKeys)
-    expect(observation.directSqlKeys).toEqual(expectedKeys)
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-  })
-
-  it(`keeps deep numeric paths in the unbounded candidate set`, async () => {
-    const ref = new IR.PropRef([`part`, `0`, `0`, `0`, `0`])
-    const observation = await observeExpressionIndexScenario({
-      label: `deep-numeric-carriers`,
-      indexExpression: ref,
-      where: new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
-      rows: [
-        {
-          key: `match`,
-          value: { part: { '0': { '0': { '0': { '0': `match` } } } } },
-        },
-      ],
-    })
-    expect(observation.adapterKeys).toEqual([`match`])
-    expect(observation.directSqlKeys).toEqual([`match`])
-    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
-  })
-
-  it(`keeps Unicode lowercase matches across NUL placement and equality direction`, async () => {
-    const spellings = [
-      { name: `NUL before fold`, source: `a\u0000K`, target: `a\u0000k` },
-      { name: `NUL after fold`, source: `K\u0000a`, target: `k\u0000a` },
-      { name: `NUL after prefix`, source: `aK\u0000b`, target: `ak\u0000b` },
-      { name: `no NUL`, source: `aK`, target: `ak` },
-    ]
-    const field = new IR.PropRef([`name`])
-    const lower = new IR.Func(`lower`, [field])
-    for (const spelling of spellings) {
-      expect(spelling.source.toLowerCase()).toBe(spelling.target)
-      const rows = [
-        { key: `ascii`, value: { name: spelling.target } },
-        { key: `unicode`, value: { name: spelling.source } },
-        { key: `other`, value: { name: `different` } },
-      ]
-      for (const lowerOnLeft of [true, false]) {
-        const literal = new IR.Value(spelling.target)
-        const predicate = new IR.Func<boolean>(
-          `eq`,
-          lowerOnLeft ? [lower, literal] : [literal, lower],
-        )
-        for (const wrapper of [`direct`, `and`, `or`] as const) {
-          const observation = await observeExpressionIndexScenario({
-            label: `nul-lower-${spelling.name}-${lowerOnLeft}-${wrapper}`,
-            indexExpression: lower,
-            where:
-              wrapper === `direct`
-                ? predicate
-                : new IR.Func<boolean>(wrapper, [predicate]),
-            rows,
-          })
-          const expectedKeys = [`ascii`, `unicode`]
-          expect(observation.adapterKeys).toEqual(expectedKeys)
-          expect(observation.directSqlKeys).toEqual(
-            expect.arrayContaining(expectedKeys),
-          )
-        }
-      }
-    }
-  })
-
-  it.each([
-    {
-      label: `greater than zero`,
-      operator: `gt`,
-      target: 0,
-      expectedKeys: [`infinity`, `nan`, `numeric-text`, `positive`],
-    },
-    {
-      label: `less than two`,
-      operator: `lt`,
-      target: 2,
-      expectedKeys: [`negative`, `negative-infinity`, `positive`],
-    },
-  ] as const)(
-    `keeps indexed numeric comparison matches for $label`,
-    async ({ label, operator, target, expectedKeys }) => {
-      const field = new IR.PropRef([`n`])
-      const observation = await observeExpressionIndexScenario({
-        label: `numeric-domain-${label}`,
-        indexExpression: field,
-        where: new IR.Func<boolean>(operator, [field, new IR.Value(target)]),
-        rows: [
-          { key: `negative`, value: { n: -1 } },
-          { key: `positive`, value: { n: 1 } },
-          { key: `nan`, value: { n: Number.NaN } },
-          { key: `infinity`, value: { n: Number.POSITIVE_INFINITY } },
-          { key: `negative-infinity`, value: { n: Number.NEGATIVE_INFINITY } },
-          { key: `missing`, value: {} },
-          { key: `null`, value: { n: null } },
-          { key: `numeric-text`, value: { n: `2` } },
-          { key: `text`, value: { n: `abc` } },
-        ],
-      })
-
-      // Public rows are exact. SQL may admit extra candidates for the row
-      // evaluator when SQLite and TanStack DB order stored values differently.
-      expect(observation.adapterKeys).toEqual(expectedKeys)
-      expect(
-        planUsesNamedIndex(
-          observation.plan,
-          observation.tableName,
-          observation.indexName,
-        ),
-      ).toBe(true)
-    },
-  )
-
-  it.each([
-    {
-      label: `nested row value`,
-      tx: {
-        txId: `out-of-range-row`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [
-          {
-            type: `insert`,
-            key: `row`,
-            value: { profile: { count: SQLITE_BIGINT_MAX + 1n } },
-          },
-        ],
-      } satisfies PersistedTx,
-    },
-    {
-      label: `row metadata`,
-      tx: {
-        txId: `out-of-range-row-metadata`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
-        rowMetadataMutations: [
-          {
-            type: `set`,
-            key: `row`,
-            value: { count: SQLITE_BIGINT_MIN - 1n },
-          },
-        ],
-      } satisfies PersistedTx,
-    },
-    {
-      label: `collection metadata`,
-      tx: {
-        txId: `out-of-range-collection-metadata`,
-        term: 1,
-        seq: 1,
-        rowVersion: 1,
-        mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
-        collectionMetadataMutations: [
-          {
-            type: `set`,
-            key: `checkpoint`,
-            value: { count: SQLITE_BIGINT_MAX + 1n },
-          },
-        ],
-      } satisfies PersistedTx,
-    },
-  ])(`rejects an out-of-range BigInt in a persisted $label`, async ({ tx }) => {
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const adapter = createSQLiteCorePersistenceAdapter({ driver })
-
-    await withFailurePreservingCleanup(async () => {
-      await expect(
-        adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: `bigint-write-range` },
-          tx,
-        ),
-      ).rejects.toThrow(
-        /SQLite BigInt value .* outside the signed 64-bit range/,
-      )
-
-      if (adapter.scanRows) {
-        expect(
-          await adapter.scanRows({
-            kind: `eager`,
-            collectionId: `bigint-write-range`,
-          }),
-        ).toEqual([])
-      }
-    }, [() => driver.close()])
-  })
-
-  it(`reads a legacy persisted BigInt beyond the new write range`, async () => {
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const adapter = createSQLiteCorePersistenceAdapter({ driver })
-    const collectionId = `legacy-bigint-read`
-    const tableName = createPersistedTableName(collectionId, `c`)
-    const legacyValue = 10n ** 30n
-
-    await withFailurePreservingCleanup(async () => {
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-legacy-bigint-read`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `legacy`,
-              value: { id: `legacy`, count: 1n },
-            },
-          ],
-        },
-      )
-      driver
-        .getDatabase()
-        .prepare(`UPDATE "${tableName}" SET value = ?`)
-        .run(
-          JSON.stringify({
-            id: `legacy`,
-            count: {
-              [PERSISTED_TYPE_TAG]: `bigint`,
-              [PERSISTED_VALUE_TAG]: legacyValue.toString(),
-            },
-          }),
-        )
-
-      if (!adapter.scanRows) {
-        throw new Error(`real SQLite adapter did not expose scanRows`)
-      }
-      const scanned = await adapter.scanRows({
-        kind: `eager`,
-        collectionId: collectionId,
-      })
-      expect(scanned.map((row) => row.value)).toEqual([
-        { id: `legacy`, count: legacyValue },
-      ])
-
-      const subset = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`id`]),
-            new IR.Value(`legacy`),
-          ]),
-        },
-      )
-      expect(subset.map((row) => row.value)).toEqual([
-        { id: `legacy`, count: legacyValue },
-      ])
-    }, [() => driver.close()])
-  })
-
-  it.each([
-    {
-      label: `scalar comparison`,
-      rejectedValue: SQLITE_BIGINT_MAX + 1n,
-      where: new IR.Func<boolean>(`gt`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value(SQLITE_BIGINT_MAX + 1n),
-      ]),
-    },
-    {
-      label: `ordinary IN`,
-      rejectedValue: SQLITE_BIGINT_MIN - 1n,
-      where: new IR.Func<boolean>(`in`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value([0n, SQLITE_BIGINT_MIN - 1n]),
-      ]),
-    },
-    {
-      label: `batched IN`,
-      rejectedValue: SQLITE_BIGINT_MAX + 1n,
-      where: new IR.Func<boolean>(`in`, [
-        new IR.PropRef([`largeViewCount`]),
-        new IR.Value([
-          ...Array.from({ length: 900 }, (_unused, index) => BigInt(index)),
-          SQLITE_BIGINT_MAX + 1n,
-        ]),
-      ]),
-    },
-  ])(
-    `rejects an out-of-range BigInt in a $label before SQLite comparison`,
-    async ({ rejectedValue, where }) => {
-      const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-      const adapter = createSQLiteCorePersistenceAdapter({ driver })
-      const collectionId = `bigint-query-range`
-
-      await withFailurePreservingCleanup(async () => {
-        await adapter.applyCommittedTx(
-          { kind: `eager`, collectionId: collectionId },
-          {
-            txId: `seed-bigint-query-range`,
-            term: 1,
-            seq: 1,
-            rowVersion: 1,
-            mutations: [
-              {
-                type: `insert`,
-                key: `zero`,
-                value: { largeViewCount: 0n },
-              },
-            ],
-          },
-        )
-
-        await expect(
-          adapter.loadSubset(
-            { kind: `eager`, collectionId: collectionId },
-            { where },
-          ),
-        ).rejects.toThrow(bigintRangeError(rejectedValue))
-      }, [() => driver.close()])
-    },
-  )
-
-  it(`rejects a hostile serialized out-of-range BigInt index constant`, async () => {
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const adapter = createSQLiteCorePersistenceAdapter({ driver })
-    const value = SQLITE_BIGINT_MAX + 1n
-
-    await withFailurePreservingCleanup(async () => {
-      await expect(
-        adapter.ensureIndex(
-          { kind: `eager`, collectionId: `bigint-index-range` },
-          `out-of-range`,
-          {
-            expressionSql: [
-              serializeIndexExpression(
-                new IR.Func(`add`, [
-                  new IR.PropRef([`largeViewCount`]),
-                  new IR.Value(value),
-                ]),
-              ),
-            ],
-          },
-        ),
-      ).rejects.toThrow(bigintRangeError(value))
-    }, [() => driver.close()])
-  })
-
   async function roundTripGeneratedBigInt(campaign: GeneratedPropertyCampaign) {
     await fc.assert(
       fc.asyncProperty(
@@ -2998,227 +1089,6 @@ describe(`SQLite expression-index oracle`, () => {
     rejectGeneratedBigInt,
   )
 
-  it(`does not confuse an alias-qualified field ref with a nested JSON path`, async () => {
-    const observation = await observeExpressionIndexScenario({
-      label: `alias-qualified-field`,
-      indexExpression: new IR.PropRef([`score`]),
-      where: new IR.Func<boolean>(`gt`, [
-        new IR.PropRef([`todos`, `score`], `todos`),
-        new IR.Value(1),
-      ]),
-      rows: [
-        { key: `matching`, value: { score: 2 } },
-        { key: `different`, value: { score: 0 } },
-      ],
-    })
-    const diagnostic = JSON.stringify(
-      {
-        sql: observation.predicateQuery.sql,
-        params: observation.predicateQuery.params,
-        plan: observation.plan.map((row) => row.detail),
-        adapterKeys: observation.adapterKeys,
-        directSqlKeys: observation.directSqlKeys,
-      },
-      null,
-      2,
-    )
-
-    expect(observation.adapterKeys, diagnostic).toEqual([`matching`])
-    expect(observation.directSqlKeys, diagnostic).toEqual([`matching`])
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-      diagnostic,
-    ).toBe(true)
-  })
-
-  it(`does not guess that a legacy nested path is an alias`, async () => {
-    const baseDriver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const adapter = createSQLiteCorePersistenceAdapter({ driver: baseDriver })
-    const collectionId = `legacy-nested-path`
-
-    await withFailurePreservingCleanup(async () => {
-      await adapter.applyCommittedTx(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          txId: `seed-legacy-nested-path`,
-          term: 1,
-          seq: 1,
-          rowVersion: 1,
-          mutations: [
-            {
-              type: `insert`,
-              key: `nested-match`,
-              value: {
-                profile: { [`meta-field`]: `alpha` },
-                [`meta-field`]: `flat-other`,
-              },
-            },
-            {
-              type: `insert`,
-              key: `flat-only`,
-              value: { [`meta-field`]: `alpha` },
-            },
-          ],
-        },
-      )
-
-      const rows = await adapter.loadSubset(
-        { kind: `eager`, collectionId: collectionId },
-        {
-          where: new IR.Func(`eq`, [
-            new IR.PropRef([`profile`, `meta-field`]),
-            new IR.Value(`alpha`),
-          ]),
-        },
-      )
-
-      expect(rows.map((row) => row.key)).toEqual([`nested-match`])
-    }, [() => baseDriver.close()])
-  })
-
-  it(`exposes an overbroad indexed predicate hidden by in-memory re-filtering`, async () => {
-    const observation = await observeExpressionIndexScenario({
-      label: `overbroad-indexed-predicate`,
-      indexExpression: new IR.PropRef([`score`]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.PropRef([`score`]),
-        new IR.Value(`2`),
-      ]),
-      rows: [
-        { key: `lower`, value: { score: `1` } },
-        { key: `matching`, value: { score: `2` } },
-        { key: `higher`, value: { score: `3` } },
-      ],
-      transformQuery: makeOverbroadEqualityMutation,
-    })
-
-    expect(observation.adapterKeys).toEqual([`matching`])
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(true)
-    expect(planScansTable(observation.plan, observation.tableName)).toBe(false)
-    expect(observation.directSqlKeys).toEqual([`higher`, `matching`])
-  })
-
-  it(`kills the former path-binding compiler behavior at the driver boundary`, async () => {
-    const observation = await observeExpressionIndexScenario({
-      label: `legacy-path-binding`,
-      indexExpression: new IR.PropRef([`score`]),
-      where: new IR.Func<boolean>(`eq`, [
-        new IR.PropRef([`score`]),
-        new IR.Value(`2`),
-      ]),
-      rows: [
-        { key: `matching`, value: { score: `2` } },
-        { key: `different`, value: { score: `3` } },
-      ],
-      transformQuery: makeLegacyPathBindingMutation,
-    })
-
-    expect(observation.adapterKeys).toEqual([`matching`])
-    expect(observation.directSqlKeys).toEqual([`matching`])
-    expect(
-      planUsesNamedIndex(
-        observation.plan,
-        observation.tableName,
-        observation.indexName,
-      ),
-    ).toBe(false)
-    expect(planScansTable(observation.plan, observation.tableName)).toBe(true)
-  })
-
-  it(`recognizes equivalent SQLite plan identifier formats without prefix collisions`, () => {
-    const tableName = `rows`
-    const indexName = `literal_ddl`
-
-    for (const detail of [
-      `SEARCH rows USING INDEX literal_ddl (<expr>=?)`,
-      `SEARCH TABLE rows USING INDEX literal_ddl (<expr>=?)`,
-      `SEARCH "rows" USING INDEX "literal_ddl" (<expr>=?)`,
-      `SEARCH TABLE "rows" USING INDEX "literal_ddl" (<expr>=?)`,
-    ]) {
-      expect(planUsesNamedIndex([{ detail }], tableName, indexName)).toBe(true)
-    }
-
-    for (const detail of [`SCAN rows`, `SCAN TABLE rows`, `SCAN "rows"`]) {
-      expect(planScansTable([{ detail }], tableName)).toBe(true)
-    }
-
-    expect(
-      planUsesNamedIndex(
-        [
-          {
-            detail: `SEARCH rows_archive USING INDEX literal_ddl_backup (<expr>=?)`,
-          },
-        ],
-        tableName,
-        indexName,
-      ),
-    ).toBe(false)
-    expect(planScansTable([{ detail: `SCAN rows_archive` }], tableName)).toBe(
-      false,
-    )
-  })
-
-  it(`distinguishes rejected DDL path binding from correct predicate rows without index use`, async () => {
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const database = driver.getDatabase()
-    const jsonPath = `$.payload.threadId`
-    const target = `thread-'1`
-
-    await withFailurePreservingCleanup(() => {
-      database.exec(
-        `CREATE TABLE rows (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,
-      )
-      const insert = database.prepare(
-        `INSERT INTO rows (key, value) VALUES (?, ?)`,
-      )
-      insert.run(`matching`, JSON.stringify({ payload: { threadId: target } }))
-      insert.run(
-        `different`,
-        JSON.stringify({ payload: { threadId: `thread-2` } }),
-      )
-
-      // SQLite rejects a DDL-path binding before an index can exist. This is
-      // a setup-rejection control only, not the production oracle's RED.
-      expect(() =>
-        database
-          .prepare(`CREATE INDEX bound_ddl ON rows (json_extract(value, ?))`)
-          .run(jsonPath),
-      ).toThrow(/parameters prohibited in index expressions/i)
-
-      database.exec(
-        `CREATE INDEX literal_ddl ON rows (json_extract(value, ${sqliteLiteral(jsonPath)}))`,
-      )
-      const literalPredicate = `SELECT key FROM rows WHERE json_extract(value, ${sqliteLiteral(jsonPath)}) = ?`
-      const boundPredicate = `SELECT key FROM rows WHERE json_extract(value, ?) = ?`
-      const literalRows = database.prepare(literalPredicate).all(target)
-      const boundRows = database.prepare(boundPredicate).all(jsonPath, target)
-      const literalPlan = database
-        .prepare(`EXPLAIN QUERY PLAN ${literalPredicate}`)
-        .all(target) as Array<QueryPlanRow>
-      const boundPlan = database
-        .prepare(`EXPLAIN QUERY PLAN ${boundPredicate}`)
-        .all(jsonPath, target) as Array<QueryPlanRow>
-
-      // Same correct rows, different plan: a row-only assertion is
-      // false-green. This predicate-plan mismatch kills the hostile mutant.
-      expect(boundRows).toEqual(literalRows)
-      expect(planUsesNamedIndex(literalPlan, `rows`, `literal_ddl`)).toBe(true)
-      expect(planScansTable(literalPlan, `rows`)).toBe(false)
-      expect(planUsesNamedIndex(boundPlan, `rows`, `literal_ddl`)).toBe(false)
-      expect(planScansTable(boundPlan, `rows`)).toBe(true)
-    }, [() => driver.close()])
-  })
-
   it(`uses the expression index for the fixed filter witness`, async () => {
     await assertExpressionIndexHistory(
       {
@@ -3412,43 +1282,6 @@ describe(`Temporal expression-index refinement`, () => {
     },
   )
 
-  it.each(temporalFamilies)(
-    `preserves wrapper-created native coalesce literals / $name`,
-    async (family) => {
-      vi.stubGlobal(`Temporal`, Temporal)
-      try {
-        const expression = new IR.Func(`coalesce`, [
-          new IR.PropRef([`stamp`]),
-          new IR.Value(temporalValue(family, 1)),
-        ])
-        const result = await observeExpressionIndexScenario({
-          label: `wrapper-${family.name}`,
-          viaWrapper: true,
-          indexExpression: expression,
-          where: new IR.Func<boolean>(`eq`, [
-            expression,
-            new IR.Value(temporalValue(family, 1)),
-          ]),
-          rows: family.texts.map((_, i) => ({
-            key: `row-${i}`,
-            value: {
-              id: `row-${i}`,
-              stamp: i === 1 ? null : temporalValue(family, i),
-            },
-          })),
-        })
-        expect(result.adapterKeys).toEqual([`row-1`])
-        expect(result.directSqlKeys).toEqual([`row-1`])
-        expect(
-          planUsesNamedIndex(result.plan, result.tableName, result.indexName),
-          JSON.stringify(result),
-        ).toBe(true)
-        expect(planScansTable(result.plan, result.tableName)).toBe(false)
-      } finally {
-        vi.unstubAllGlobals()
-      }
-    },
-  )
   // Independent fixture rank/text rules also judge mixed-domain candidates.
   // SQL may retain extras, but NOT must never invert an approximate prefilter.
   it.each(temporalFamilies)(
@@ -3478,26 +1311,13 @@ describe(`Temporal expression-index refinement`, () => {
               const where = negate
                 ? new IR.Func<boolean>(`not`, [comparison])
                 : comparison
-              const expectedKeys = nullableRows
-                .flatMap((row) => {
-                  if (row.key === `null` || row.key === `missing`) return []
-                  const rank =
-                    row.key === `nan`
-                      ? Infinity
-                      : family.ranks[Number(row.key.slice(4))]!
-                  const a = reverse ? family.ranks[1] : rank
-                  const b = reverse ? rank : family.ranks[1]
-                  const match =
-                    operator === `gt`
-                      ? a > b
-                      : operator === `gte`
-                        ? a >= b
-                        : operator === `lt`
-                          ? a < b
-                          : a <= b
-                  return match !== negate ? [row.key] : []
-                })
-                .sort()
+              const expectedKeys = expectedNativePolarityKeys(
+                family,
+                nullableRows,
+                operator,
+                reverse,
+                negate,
+              )
               const result = await observeExpressionIndexScenario({
                 label: `native-polarity`,
                 indexExpression: ref,
@@ -3628,106 +1448,4 @@ describe(`Temporal expression-index refinement`, () => {
       }
     },
   )
-
-  it.each(temporalFamilies)(
-    `retains native identity through numeric array and object paths / $name`,
-    async (family) => {
-      vi.stubGlobal(`Temporal`, Temporal)
-      try {
-        const ref = new IR.PropRef([`dates`, `0`])
-        for (const carrier of [`array`, `object`] as const) {
-          const rows = family.texts.map((_, i) => ({
-            key: `row-${i}`,
-            value: {
-              dates:
-                carrier === `array`
-                  ? [temporalValue(family, i)]
-                  : { 0: temporalValue(family, i) },
-            },
-          }))
-          for (const operator of [`eq`, `in`] as const) {
-            const expression = new IR.Func<boolean>(operator, [
-              ref,
-              new IR.Value(
-                operator === `eq`
-                  ? temporalValue(family, 1)
-                  : [temporalValue(family, 1)],
-              ),
-            ])
-            const result = await observeExpressionIndexScenario({
-              label: `${family.name}-${carrier}-${operator}`,
-              indexExpression: expression,
-              where: expression,
-              rows,
-              observeIndexValues: true,
-            })
-            expect(result.adapterKeys).toEqual([`row-1`])
-            expect(result.directSqlKeys).toEqual([`row-1`])
-            expect(result.indexValues).toEqual(
-              family.texts.map((_, i) => ({
-                key: `row-${i}`,
-                value: i === 1 ? 1 : 0,
-              })),
-            )
-          }
-        }
-      } finally {
-        vi.unstubAllGlobals()
-      }
-    },
-  )
-
-  it(`preserves the primary failure and still closes SQLite`, async () => {
-    const { CollectionImpl } = await import('../../db/src/collection/index')
-    const primary = new Error(`primary metadata failure`)
-    const cleanup = new Error(`secondary cleanup failure`)
-    const cleanupOriginal = CollectionImpl.prototype.cleanup
-    const execOriginal = BetterSqlite3SQLiteDriver.prototype.exec
-    let driver: BetterSqlite3SQLiteDriver | undefined
-    const execSpy = vi
-      .spyOn(BetterSqlite3SQLiteDriver.prototype, `exec`)
-      .mockImplementation(function (this: BetterSqlite3SQLiteDriver, sql) {
-        driver = this
-        return execOriginal.call(this, sql)
-      })
-    const closeSpy = vi.spyOn(BetterSqlite3SQLiteDriver.prototype, `close`)
-    const cleanupSpy = vi
-      .spyOn(CollectionImpl.prototype, `cleanup`)
-      .mockImplementation(async function (
-        this: InstanceType<typeof CollectionImpl>,
-      ) {
-        await cleanupOriginal.call(this)
-        throw cleanup
-      })
-    const metadataSpy = vi
-      .spyOn(CollectionImpl.prototype, `getIndexMetadata`)
-      .mockImplementation(() => {
-        throw primary
-      })
-    vi.stubGlobal(`Temporal`, Temporal)
-    try {
-      const result = await observeExpressionIndexScenario({
-        label: `prep-cleanup`,
-        viaWrapper: true,
-        indexExpression: new IR.Func(`coalesce`, [
-          new IR.PropRef([`stamp`]),
-          new IR.Value(Temporal.Instant.from(`2026-01-01T00:00:00Z`)),
-        ]),
-        rows: [],
-      }).then(
-        () => undefined,
-        (error) => error,
-      )
-      expect.soft(result).toBeInstanceOf(AggregateError)
-      expect.soft(result?.errors).toEqual([primary, cleanup])
-      expect.soft(closeSpy).toHaveBeenCalledTimes(1)
-    } finally {
-      metadataSpy.mockRestore()
-      cleanupSpy.mockRestore()
-      closeSpy.mockRestore()
-      execSpy.mockRestore()
-      driver?.close()
-      vi.unstubAllGlobals()
-    }
-  })
 })
diff --git a/packages/node-db-sqlite-persistence/tests/expression-index-support.ts b/packages/node-db-sqlite-persistence/tests/expression-index-support.ts
new file mode 100644
index 0000000000..dcbf952c06
--- /dev/null
+++ b/packages/node-db-sqlite-persistence/tests/expression-index-support.ts
@@ -0,0 +1,505 @@
+/**
+ * Fixtures, the SQLite query observer, and plan classifiers shared by the
+ * expression-index owner and its ordinary unit tests. The observer runs a
+ * scenario through the public SQLite-core adapter and reports what happened.
+ * It states no expectation: the law and its independent model are in
+ * expression-index-oracle.test.ts.
+ */
+import { expect } from 'vitest'
+import {
+  BasicIndex,
+  IR,
+  coalesce as coalesceExpression,
+  createCollection,
+} from '@tanstack/db'
+import {
+  createPersistedTableName,
+  createSQLiteCorePersistenceAdapter,
+  decodePersistedStorageKey,
+  persistedCollectionOptions,
+} from '@tanstack/db-sqlite-persistence-core'
+import { Temporal } from '../../db-sqlite-persistence-core/tests/temporal-value-oracle'
+import { BetterSqlite3SQLiteDriver } from '../src/node-driver'
+import type { SQLiteDriver } from '@tanstack/db-sqlite-persistence-core'
+
+export const SQLITE_BIGINT_MIN = -9_223_372_036_854_775_808n
+export const SQLITE_BIGINT_MAX = 9_223_372_036_854_775_807n
+export const PERSISTED_TYPE_TAG = `__tanstack_db_persisted_type__`
+export const PERSISTED_VALUE_TAG = `value`
+
+export type OracleScalar = boolean | number | string
+
+export type CapturedQuery = {
+  sql: string
+  params: ReadonlyArray<unknown>
+}
+
+export type QueryTransform = (query: CapturedQuery) => CapturedQuery
+
+export type QueryPlanRow = {
+  detail: string
+}
+
+export type ScanRow = {
+  key: string | number
+  value: Record<string, unknown>
+}
+
+export function createNestedRow(
+  path: ReadonlyArray<string>,
+  value: OracleScalar | bigint,
+): Record<string, unknown> {
+  let nested: unknown = value
+
+  for (let index = path.length - 1; index >= 0; index--) {
+    const segment = path[index]!
+    if (/^\d+$/.test(segment)) {
+      const entries = Array.from<unknown>({ length: Number(segment) + 1 })
+      entries[Number(segment)] = nested
+      nested = entries
+    } else {
+      nested = { [segment]: nested }
+    }
+  }
+
+  if (typeof nested !== `object` || nested === null || Array.isArray(nested)) {
+    throw new Error(`generated path must be rooted in an object`)
+  }
+  return nested as Record<string, unknown>
+}
+
+export function readPath(
+  row: Record<string, unknown>,
+  path: ReadonlyArray<string>,
+): unknown {
+  let value: unknown = row
+
+  for (const segment of path) {
+    if (Array.isArray(value) && /^\d+$/.test(segment)) {
+      value = value[Number(segment)]
+      continue
+    }
+    if (typeof value !== `object` || value === null || Array.isArray(value)) {
+      return undefined
+    }
+    value = (value as Record<string, unknown>)[segment]
+  }
+
+  return value
+}
+
+export function sqliteJsonPath(path: ReadonlyArray<string>): string {
+  return path.reduce((result, segment) => {
+    return /^\d+$/.test(segment)
+      ? `${result}[${segment}]`
+      : `${result}.${segment}`
+  }, `$`)
+}
+
+export function sqliteLiteral(value: string): string {
+  return `'${value.replace(/'/g, `''`)}'`
+}
+
+export function sqliteScalarParameter(value: OracleScalar): number | string {
+  return typeof value === `boolean` ? (value ? 1 : 0) : value
+}
+
+export function serializeIndexExpression(
+  expression: IR.BasicExpression,
+): string {
+  return JSON.stringify(
+    expression,
+    function (this: Record<string, unknown>, key, value: unknown) {
+      // Read the original before Temporal.toJSON converts it to an ordinary string.
+      const original = this[key]
+      if (
+        original instanceof Temporal.Instant ||
+        original instanceof Temporal.PlainDate
+      ) {
+        return {
+          [PERSISTED_TYPE_TAG]:
+            original instanceof Temporal.Instant
+              ? `Temporal.Instant`
+              : `Temporal.PlainDate`,
+          [PERSISTED_VALUE_TAG]: original.toString(),
+        }
+      }
+      return typeof value === `bigint`
+        ? {
+            [PERSISTED_TYPE_TAG]: `bigint`,
+            [PERSISTED_VALUE_TAG]: value.toString(),
+          }
+        : value
+    },
+  )
+}
+
+export function bigintRangeError(value: bigint): string {
+  return `SQLite BigInt value ${value} is outside the signed 64-bit range [${SQLITE_BIGINT_MIN}, ${SQLITE_BIGINT_MAX}]`
+}
+
+export function createQueryObservingDriver(
+  inner: SQLiteDriver,
+  observe: (query: CapturedQuery) => void,
+  transform?: QueryTransform,
+): SQLiteDriver {
+  const wrap = (driver: SQLiteDriver): SQLiteDriver => ({
+    exec: (sql) => driver.exec(sql),
+    query: async <T>(sql: string, params: ReadonlyArray<unknown> = []) => {
+      const query = transform
+        ? transform({ sql, params: [...params] })
+        : { sql, params: [...params] }
+      observe(query)
+      return driver.query<T>(query.sql, query.params)
+    },
+    run: (sql, params) => driver.run(sql, params),
+    transaction: (body) =>
+      driver.transaction((transactionDriver) => body(wrap(transactionDriver))),
+    transactionWithDriver: driver.transactionWithDriver
+      ? (body) =>
+          driver.transactionWithDriver!((transactionDriver) =>
+            body(wrap(transactionDriver)),
+          )
+      : undefined,
+  })
+
+  return wrap(inner)
+}
+
+export async function withFailurePreservingCleanup<T>(
+  body: () => T | Promise<T>,
+  cleanups: ReadonlyArray<() => void | Promise<void>>,
+): Promise<T> {
+  let primary: { error: unknown } | undefined
+  let result: T
+  try {
+    result = await body()
+  } catch (error) {
+    primary = { error }
+  }
+
+  const cleanupFailures: Array<unknown> = []
+  for (const cleanup of cleanups) {
+    try {
+      await cleanup()
+    } catch (error) {
+      cleanupFailures.push(error)
+    }
+  }
+
+  if (cleanupFailures.length > 0) {
+    if (primary) {
+      throw new AggregateError(
+        [primary.error, ...cleanupFailures],
+        `Expression-index oracle and cleanup failed`,
+        { cause: primary.error },
+      )
+    }
+    if (cleanupFailures.length === 1) throw cleanupFailures[0]
+    throw new AggregateError(
+      cleanupFailures,
+      `Expression-index oracle cleanup failed`,
+    )
+  }
+  if (primary) throw primary.error
+  return result!
+}
+
+export function planUsesNamedIndex(
+  plan: ReadonlyArray<QueryPlanRow>,
+  tableName: string,
+  indexName: string,
+): boolean {
+  const tablePattern = sqlitePlanIdentifierPattern(tableName)
+  const indexPattern = sqlitePlanIdentifierPattern(indexName)
+  const searchPattern = new RegExp(
+    `\\bSEARCH(?: TABLE)? ${tablePattern}(?:\\s|$)`,
+  )
+  const indexUsagePattern = new RegExp(
+    `\\bUSING INDEX ${indexPattern}(?:\\s|$)`,
+  )
+
+  return plan.some(
+    ({ detail }) =>
+      searchPattern.test(detail) && indexUsagePattern.test(detail),
+  )
+}
+
+export function planScansTable(
+  plan: ReadonlyArray<QueryPlanRow>,
+  tableName: string,
+): boolean {
+  const tablePattern = sqlitePlanIdentifierPattern(tableName)
+  const scanPattern = new RegExp(`^SCAN(?: TABLE)? ${tablePattern}(?:\\s|$)`)
+  return plan.some(({ detail }) => scanPattern.test(detail))
+}
+
+export function sqlitePlanIdentifierPattern(identifier: string): string {
+  const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, `\\$&`)
+  return `(?:"${escaped}"|${escaped})`
+}
+
+export type ExpressionIndexScenario = {
+  viaWrapper?: boolean
+  observeIndexValues?: boolean
+  label: string
+  indexExpression: IR.BasicExpression
+  where?: IR.BasicExpression<boolean>
+  orderBy?: IR.OrderBy
+  preserveResultOrder?: boolean
+  rows: ReadonlyArray<{
+    key: string
+    value: Record<string, unknown>
+  }>
+  preparePreviousIndex?: (
+    adapter: ReturnType<typeof createSQLiteCorePersistenceAdapter>,
+    collectionId: string,
+    signature: string,
+  ) => Promise<void>
+  transformQuery?: QueryTransform
+}
+
+export type ExpressionIndexObservation = {
+  indexSql: unknown
+  indexValues?: Array<{ key: string; value: unknown }>
+  adapterKeys: Array<string>
+  directSqlKeys: Array<string>
+  indexName: string
+  plan: Array<QueryPlanRow>
+  predicateQuery: CapturedQuery
+  tableName: string
+}
+
+export async function observeExpressionIndexScenario({
+  viaWrapper = false,
+  observeIndexValues = false,
+  label,
+  indexExpression,
+  where,
+  orderBy,
+  preserveResultOrder = false,
+  rows,
+  preparePreviousIndex,
+  transformQuery,
+}: ExpressionIndexScenario): Promise<ExpressionIndexObservation> {
+  const baseDriver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  const collectionId = `expression-index-${label}`
+  let signature = `generated-expression`
+  let cleanupCollection: (() => Promise<void>) | undefined
+  const tableName = createPersistedTableName(collectionId, `c`)
+  let predicateQuery: CapturedQuery | undefined
+
+  const observingDriver = createQueryObservingDriver(
+    baseDriver,
+    (query) => {
+      if (
+        query.sql.includes(`SELECT key, value, metadata, row_version`) &&
+        query.sql.includes(`FROM "${tableName}"`)
+      ) {
+        predicateQuery = query
+      }
+    },
+    transformQuery
+      ? (query) =>
+          query.sql.includes(`SELECT key, value, metadata, row_version`) &&
+          query.sql.includes(`FROM "${tableName}"`)
+            ? transformQuery(query)
+            : query
+      : undefined,
+  )
+  const adapter = createSQLiteCorePersistenceAdapter({
+    driver: observingDriver,
+  })
+
+  return withFailurePreservingCleanup(async () => {
+    await adapter.applyCommittedTx(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        txId: `seed-${label}`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: rows.map((row) => ({
+          type: `insert` as const,
+          key: row.key,
+          value: row.value,
+        })),
+      },
+    )
+    await preparePreviousIndex?.(adapter, collectionId, signature)
+    if (viaWrapper) {
+      if (
+        indexExpression.type !== `func` ||
+        indexExpression.name !== `coalesce` ||
+        indexExpression.args[1]?.type !== `val`
+      )
+        throw new Error(`Expected coalesce wrapper witness`)
+      const fallback = indexExpression.args[1].value
+      const collection = createCollection(
+        persistedCollectionOptions<Record<string, unknown>, string>({
+          id: collectionId,
+          getKey: (row) => String(row.id),
+          defaultIndexType: BasicIndex,
+          sync: {
+            sync: ({ markReady }) => {
+              markReady()
+            },
+          },
+          persistence: { adapter },
+        }),
+      )
+      cleanupCollection = () => collection.cleanup()
+      collection.createIndex((row) => coalesceExpression(row.stamp, fallback))
+      const metadata = collection.getIndexMetadata()[0]!
+      signature = metadata.signature
+      expect(metadata.expression.type).toBe(`func`)
+      if (
+        metadata.expression.type !== `func` ||
+        metadata.expression.args[1]?.type !== `val`
+      )
+        throw new Error(`Missing native literal`)
+      expect(metadata.expression.args[1].value).toBeInstanceOf(
+        fallback instanceof Temporal.Instant
+          ? Temporal.Instant
+          : Temporal.PlainDate,
+      )
+      const adjacent =
+        fallback instanceof Temporal.Instant
+          ? fallback.add({ nanoseconds: 1 })
+          : (fallback as Temporal.PlainDate).add({ days: 1 })
+      const second = collection.createIndex((row) =>
+        coalesceExpression(row.stamp, new IR.Value(adjacent)),
+      )
+      expect(collection.getIndexMetadata()[1]!.signature).not.toBe(signature)
+      collection.removeIndex(second)
+      await collection.preload()
+    } else {
+      await adapter.ensureIndex(
+        { kind: `eager`, collectionId: collectionId },
+        signature,
+        {
+          expressionSql: [serializeIndexExpression(indexExpression)],
+        },
+      )
+    }
+
+    const adapterRows = await adapter.loadSubset(
+      { kind: `eager`, collectionId: collectionId },
+      {
+        ...(where ? { where } : {}),
+        ...(orderBy ? { orderBy } : {}),
+      },
+    )
+    if (!predicateQuery) {
+      throw new Error(`predicate query checkpoint was not reached`)
+    }
+
+    const directSqlRows = baseDriver
+      .getDatabase()
+      .prepare(predicateQuery.sql)
+      .all(...predicateQuery.params) as Array<{ key: string }>
+    const registryRow = baseDriver
+      .getDatabase()
+      .prepare(
+        `SELECT index_name, expression_sql FROM persisted_index_registry
+           WHERE collection_id = ? AND signature = ?`,
+      )
+      .get(collectionId, signature) as
+      { index_name: string; expression_sql: string } | undefined
+    if (!registryRow) {
+      throw new Error(`expression index registry checkpoint was not reached`)
+    }
+
+    const plan = baseDriver
+      .getDatabase()
+      .prepare(`EXPLAIN QUERY PLAN ${predicateQuery.sql}`)
+      .all(...predicateQuery.params) as Array<QueryPlanRow>
+
+    const normalizeKeys = (keys: Array<string>): Array<string> =>
+      preserveResultOrder ? keys : keys.sort()
+
+    const expressionSql = (
+      JSON.parse(registryRow.expression_sql) as Array<string>
+    )[0]!
+    const indexValues = observeIndexValues
+      ? (
+          baseDriver
+            .getDatabase()
+            .prepare(
+              `SELECT key, ${expressionSql} AS value FROM "${tableName}" ORDER BY key`,
+            )
+            .all() as Array<{ key: string; value: unknown }>
+        ).map((row) => ({
+          key: String(decodePersistedStorageKey(row.key)),
+          value: row.value,
+        }))
+      : undefined
+    return {
+      indexValues,
+      indexSql: baseDriver
+        .getDatabase()
+        .prepare(`SELECT sql FROM sqlite_master WHERE name = ?`)
+        .get(registryRow.index_name),
+      adapterKeys: normalizeKeys(adapterRows.map((row) => String(row.key))),
+      directSqlKeys: normalizeKeys(
+        directSqlRows.map((row) => String(decodePersistedStorageKey(row.key))),
+      ),
+      indexName: registryRow.index_name,
+      plan,
+      predicateQuery,
+      tableName,
+    }
+  }, [() => cleanupCollection?.(), () => baseDriver.close()])
+}
+
+export function makeOverbroadEqualityMutation(
+  query: CapturedQuery,
+): CapturedQuery {
+  if (!query.sql.includes(` WHERE `)) return query
+  const sql = query.sql.replace(/ = \?/g, ` >= ?`)
+  if (sql === query.sql) {
+    throw new Error(`overbroad equality mutation did not reach the predicate`)
+  }
+  return { sql, params: query.params }
+}
+
+export function makeLegacyPathBindingMutation(
+  query: CapturedQuery,
+): CapturedQuery {
+  if (!query.sql.includes(` WHERE `)) return query
+
+  const params: Array<unknown> = []
+  let pathCount = 0
+  let bindingIndex = 0
+  const sql = query.sql.replace(
+    /json_extract\(value, ('(?:''|[^'])+')\)|\?/g,
+    (match, literal: string | undefined) => {
+      if (literal === undefined) {
+        params.push(query.params[bindingIndex++])
+        return match
+      }
+      pathCount++
+      params.push(literal.slice(1, -1).replace(/''/g, `'`))
+      return `json_extract(value, ?)`
+    },
+  )
+  if (pathCount === 0 || bindingIndex !== query.params.length) {
+    throw new Error(
+      `legacy path-binding mutation did not reach all reference paths and bindings`,
+    )
+  }
+  return { sql, params }
+}
+
+export function planUsesNamedIndexForOrdering(
+  plan: ReadonlyArray<QueryPlanRow>,
+  tableName: string,
+  indexName: string,
+): boolean {
+  const tablePattern = sqlitePlanIdentifierPattern(tableName)
+  const indexPattern = sqlitePlanIdentifierPattern(indexName)
+  const orderedScanPattern = new RegExp(
+    `^SCAN(?: TABLE)? ${tablePattern} USING INDEX ${indexPattern}(?:\\s|$)`,
+  )
+  return plan.some(({ detail }) => orderedScanPattern.test(detail))
+}
diff --git a/packages/node-db-sqlite-persistence/tests/expression-index.test.ts b/packages/node-db-sqlite-persistence/tests/expression-index.test.ts
new file mode 100644
index 0000000000..316d36ba75
--- /dev/null
+++ b/packages/node-db-sqlite-persistence/tests/expression-index.test.ts
@@ -0,0 +1,1916 @@
+/**
+ * Ordinary SQLite expression-index tests. Each one checks a fixed case against
+ * values written out in the test, a replay-configuration parser, a plan
+ * classifier, or the cleanup behavior of the observer. None reaches an
+ * independent model, so none is oracle coverage. The law these cases illustrate,
+ * and the generated check that owns it, are in expression-index-oracle.test.ts.
+ * The shared observer and fixtures are in expression-index-support.ts.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import {
+  BasicIndex,
+  IR,
+  coalesce as coalesceExpression,
+  createCollection,
+} from '@tanstack/db'
+import {
+  createPersistedTableName,
+  createSQLiteCorePersistenceAdapter,
+  persistedCollectionOptions,
+} from '@tanstack/db-sqlite-persistence-core'
+import { readOracleRunConfig } from '../../db/tests/oracle-config.js'
+import {
+  Temporal,
+  temporalFamilies,
+  temporalValue,
+} from '../../db-sqlite-persistence-core/tests/temporal-value-oracle'
+import { BetterSqlite3SQLiteDriver } from '../src/node-driver'
+import {
+  PERSISTED_TYPE_TAG,
+  PERSISTED_VALUE_TAG,
+  SQLITE_BIGINT_MAX,
+  SQLITE_BIGINT_MIN,
+  bigintRangeError,
+  makeLegacyPathBindingMutation,
+  makeOverbroadEqualityMutation,
+  observeExpressionIndexScenario,
+  planScansTable,
+  planUsesNamedIndex,
+  serializeIndexExpression,
+  sqliteLiteral,
+  withFailurePreservingCleanup,
+} from './expression-index-support'
+import type { PersistedTx } from '@tanstack/db-sqlite-persistence-core'
+import type { QueryPlanRow } from './expression-index-support'
+
+describe(`SQLite expression-index oracle`, () => {
+  it.each([
+    {
+      label: `empty seed`,
+      environment: { TANSTACK_DB_ORACLE_SEED: `` },
+      message: `TANSTACK_DB_ORACLE_SEED must be an integer`,
+    },
+    {
+      label: `path without seed`,
+      environment: { TANSTACK_DB_ORACLE_PATH: `0` },
+      message: `TANSTACK_DB_ORACLE_PATH requires TANSTACK_DB_ORACLE_SEED`,
+    },
+    {
+      label: `property without path`,
+      environment: {
+        TANSTACK_DB_ORACLE_SEED: `1659005`,
+        TANSTACK_DB_ORACLE_PROPERTY: `sqlite-persistence.expression-index`,
+      },
+      message: `TANSTACK_DB_ORACLE_PROPERTY requires TANSTACK_DB_ORACLE_PATH`,
+    },
+    {
+      label: `invalid shrink path`,
+      environment: {
+        TANSTACK_DB_ORACLE_SEED: `1659005`,
+        TANSTACK_DB_ORACLE_PATH: `0:`,
+        TANSTACK_DB_ORACLE_PROPERTY: `sqlite-persistence.expression-index`,
+      },
+      message: `TANSTACK_DB_ORACLE_PATH must contain colon-separated nonnegative integers`,
+    },
+  ])(`rejects a $label replay configuration`, ({ environment, message }) => {
+    expect(() => readOracleRunConfig(environment)).toThrow(message)
+  })
+
+  it(`accepts a seed alone and a checked seed and shrink-path replay pair`, () => {
+    expect(readOracleRunConfig({ TANSTACK_DB_ORACLE_SEED: `1659005` })).toEqual(
+      {
+        multiplier: 1,
+        replaySeed: 1659005,
+        replayPath: undefined,
+        replayProperty: undefined,
+      },
+    )
+    expect(
+      readOracleRunConfig({
+        TANSTACK_DB_ORACLE_SEED: `-1659005`,
+        TANSTACK_DB_ORACLE_PATH: `0:1:2`,
+        TANSTACK_DB_ORACLE_PROPERTY: `sqlite-persistence.expression-index`,
+      }),
+    ).toEqual({
+      multiplier: 1,
+      replaySeed: -1659005,
+      replayPath: `0:1:2`,
+      replayProperty: `sqlite-persistence.expression-index`,
+    })
+  })
+
+  it.each([
+    {
+      label: `coalesce-constant`,
+      indexExpression: new IR.Func(`coalesce`, [
+        new IR.PropRef([`nickname`]),
+        new IR.Value(`none`),
+      ]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.Func(`coalesce`, [
+          new IR.PropRef([`nickname`]),
+          new IR.Value(`none`),
+        ]),
+        new IR.Value(`none`),
+      ]),
+      rows: [
+        { key: `missing`, value: { nickname: null } },
+        { key: `present`, value: { nickname: `Ada` } },
+      ],
+      expectedKeys: [`missing`],
+    },
+    {
+      label: `string-membership-constant`,
+      indexExpression: new IR.Func(`in`, [
+        new IR.PropRef([`nickname`]),
+        new IR.Value([`Ada`, `Grace`]),
+      ]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.Func(`in`, [
+          new IR.PropRef([`nickname`]),
+          new IR.Value([`Ada`, `Grace`]),
+        ]),
+        new IR.Value(true),
+      ]),
+      rows: [
+        { key: `matching`, value: { nickname: `Ada` } },
+        { key: `different`, value: { nickname: `Linus` } },
+      ],
+      expectedKeys: [`matching`],
+    },
+    {
+      label: `strftime-constant`,
+      indexExpression: new IR.Func(`strftime`, [
+        new IR.Value(`%Y-%m-%d`),
+        new IR.Func(`datetime`, [new IR.PropRef([`createdAt`])]),
+      ]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.Func(`strftime`, [
+          new IR.Value(`%Y-%m-%d`),
+          new IR.Func(`datetime`, [new IR.PropRef([`createdAt`])]),
+        ]),
+        new IR.Value(`2026-04-05`),
+      ]),
+      rows: [
+        { key: `current`, value: { createdAt: `2026-04-05T00:00:00.000Z` } },
+        {
+          key: `epoch-milliseconds`,
+          value: { createdAt: new Date(`2026-04-05T00:00:00.000Z`).getTime() },
+        },
+        { key: `past`, value: { createdAt: `2025-04-05T00:00:00.000Z` } },
+      ],
+      expectedKeys: [`current`, `epoch-milliseconds`],
+    },
+    {
+      label: `add-constant`,
+      indexExpression: new IR.Func(`add`, [
+        new IR.PropRef([`score`]),
+        new IR.Value(1),
+      ]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.Func(`add`, [new IR.PropRef([`score`]), new IR.Value(1)]),
+        new IR.Value(`21`),
+      ]),
+      rows: [
+        { key: `matching`, value: { score: `2` } },
+        { key: `different`, value: { score: 4 } },
+      ],
+      expectedKeys: [`matching`],
+    },
+    {
+      label: `bigint-coalesce-constant`,
+      indexExpression: new IR.Func(`coalesce`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value(SQLITE_BIGINT_MIN),
+      ]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.Func(`coalesce`, [
+          new IR.PropRef([`largeViewCount`]),
+          new IR.Value(SQLITE_BIGINT_MIN),
+        ]),
+        new IR.Value(SQLITE_BIGINT_MIN),
+      ]),
+      rows: [
+        { key: `missing`, value: { largeViewCount: null } },
+        { key: `minimum`, value: { largeViewCount: SQLITE_BIGINT_MIN } },
+        { key: `zero`, value: { largeViewCount: 0n } },
+      ],
+      expectedKeys: [`minimum`, `missing`],
+    },
+  ])(
+    `loads through a constant-bearing $label expression`,
+    async ({ expectedKeys, ...scenario }) => {
+      const observation = await observeExpressionIndexScenario(scenario)
+
+      expect(observation.adapterKeys).toEqual(expectedKeys)
+      if (
+        scenario.label === `strftime-constant` ||
+        scenario.label === `add-constant` ||
+        scenario.label === `string-membership-constant`
+      ) {
+        expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
+        expect(observation.directSqlKeys).toEqual(
+          scenario.rows.map((row) => row.key).sort(),
+        )
+        expect(planScansTable(observation.plan, observation.tableName)).toBe(
+          true,
+        )
+        return
+      }
+      expect(observation.directSqlKeys).toEqual(expectedKeys)
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+      ).toBe(true)
+    },
+  )
+
+  // Literal positions and polarity come from the string contract, not SQL.
+  it.each([`\u0000ab`, `a\u0000b`, `ab\u0000`])(
+    `preserves ordinary NUL strings / %j`,
+    async (target) => {
+      const ref = new IR.PropRef([`stamp`])
+      const literal = new IR.Value(target)
+      const eq = new IR.Func<boolean>(`eq`, [ref, literal])
+      for (const where of [
+        eq,
+        new IR.Func<boolean>(`eq`, [literal, ref]),
+        new IR.Func<boolean>(`in`, [ref, new IR.Value([target, `other`])]),
+        new IR.Func<boolean>(`and`, [eq, new IR.Value(true)]),
+        new IR.Func<boolean>(`or`, [eq, new IR.Value(false)]),
+      ]) {
+        const result = await observeExpressionIndexScenario({
+          label: `NUL`,
+          indexExpression: ref,
+          where,
+          rows: [
+            { key: `match`, value: { stamp: target } },
+            { key: `different`, value: { stamp: `absent` } },
+          ],
+        })
+        expect(result.adapterKeys).toEqual([`match`])
+        expect(result.directSqlKeys).toEqual([`match`])
+      }
+    },
+  )
+
+  // Distinct native/ordinary fallback meanings must retain separate persisted
+  // indexes. The wrapper receives both public definitions before preload; the
+  // registry and sqlite_master checkpoints expose a signature collision even
+  // when residual query evaluation could still return correct rows.
+  it(`persists separate indexes for native and ordinary tagged literals`, async () => {
+    vi.stubGlobal(`Temporal`, Temporal)
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const adapter = createSQLiteCorePersistenceAdapter({ driver })
+    const collectionId = `native-tag-indexes`
+    const collection = createCollection(
+      persistedCollectionOptions<{ id: string; stamp: unknown }, string>({
+        id: collectionId,
+        getKey: (row) => row.id,
+        defaultIndexType: BasicIndex,
+        sync: { sync: ({ markReady }) => markReady() },
+        persistence: { adapter },
+      }),
+    )
+    try {
+      await withFailurePreservingCleanup(async () => {
+        const native = Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+        for (const value of [
+          native,
+          { __type: `Temporal.Instant`, value: String(native) },
+        ]) {
+          collection.createIndex((row) =>
+            coalesceExpression(row.stamp, new IR.Value(value)),
+          )
+        }
+        await collection.preload()
+        const entries = driver
+          .getDatabase()
+          .prepare(
+            `SELECT index_name FROM persisted_index_registry WHERE collection_id = ? AND removed = 0`,
+          )
+          .all(collectionId) as Array<{ index_name: string }>
+        expect(entries).toHaveLength(2)
+        expect(new Set(entries.map((entry) => entry.index_name)).size).toBe(2)
+        for (const entry of entries) {
+          expect(
+            driver
+              .getDatabase()
+              .prepare(
+                `SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`,
+              )
+              .all(entry.index_name),
+          ).toHaveLength(1)
+        }
+      }, [() => collection.cleanup(), () => driver.close()])
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  // A NUL string stays ordinary text in both bound predicates and index DDL.
+  // Enumerate string-only and native-mixed membership, with positive/negative
+  // predicates. Expected keys come from fixture membership; stored index values
+  // independently observe the DDL before residual filtering can hide a mismatch.
+  it.each([`\u0000ab`, `a\u0000b`, `ab\u0000`, `é'\u0000𐀀`])(
+    `preserves NUL membership literals in index definitions / %j`,
+    async (target) => {
+      vi.stubGlobal(`Temporal`, Temporal)
+      try {
+        const native = Temporal.Instant.from(`2026-01-02T00:00:00Z`)
+        for (const mixed of [false, true]) {
+          const membership = new IR.Func<boolean>(`in`, [
+            new IR.PropRef([`stamp`]),
+            new IR.Value(mixed ? [target, native] : [target]),
+          ])
+          for (const negate of [false, true]) {
+            const result = await observeExpressionIndexScenario({
+              label: `NUL-membership`,
+              indexExpression: membership,
+              observeIndexValues: true,
+              where: negate ? new IR.Func(`not`, [membership]) : membership,
+              rows: [
+                { key: `match`, value: { stamp: target } },
+                { key: `native`, value: { stamp: native } },
+                { key: `other`, value: { stamp: `absent` } },
+              ],
+            })
+            const matches = mixed ? [`match`, `native`] : [`match`]
+            const expected = negate
+              ? [`match`, `native`, `other`].filter(
+                  (key) => !matches.includes(key),
+                )
+              : matches
+            expect(result.adapterKeys).toEqual(expected)
+            expect(result.directSqlKeys).toEqual(
+              expect.arrayContaining(expected),
+            )
+            expect(result.indexValues).toEqual([
+              { key: `match`, value: 1 },
+              { key: `native`, value: mixed ? 1 : 0 },
+              { key: `other`, value: 0 },
+            ])
+          }
+        }
+      } finally {
+        vi.unstubAllGlobals()
+      }
+    },
+  )
+
+  it(`keeps large string membership indexes within SQLite expression depth`, async () => {
+    const membership = new IR.Func(`in`, [
+      new IR.PropRef([`nickname`]),
+      new IR.Value(Array.from({ length: 1025 }, (_, index) => `name-${index}`)),
+    ])
+    const observation = await observeExpressionIndexScenario({
+      label: `large-string-membership`,
+      indexExpression: membership,
+      where: new IR.Func<boolean>(`eq`, [membership, new IR.Value(true)]),
+      rows: [
+        { key: `matching`, value: { nickname: `name-1024` } },
+        { key: `different`, value: { nickname: `absent` } },
+      ],
+    })
+    expect(observation.adapterKeys).toEqual([`matching`])
+    // The DDL remains valid at large arity. The safe classifier deliberately
+    // leaves eq(in(...), true) to residual filtering, as for other scalar functions.
+    expect(observation.indexSql).toBeDefined()
+    expect(observation.directSqlKeys).toEqual([`different`, `matching`])
+    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
+  })
+
+  it(`rebuilds a persisted BigInt-constant index when its normalized spec changes`, async () => {
+    const indexExpression = new IR.Func(`coalesce`, [
+      new IR.PropRef([`largeViewCount`]),
+      new IR.Value(SQLITE_BIGINT_MIN),
+    ])
+    const observation = await observeExpressionIndexScenario({
+      label: `bigint-constant-upgrade`,
+      indexExpression,
+      where: new IR.Func<boolean>(`eq`, [
+        indexExpression,
+        new IR.Value(SQLITE_BIGINT_MIN),
+      ]),
+      rows: [
+        { key: `missing`, value: { largeViewCount: null } },
+        { key: `minimum`, value: { largeViewCount: SQLITE_BIGINT_MIN } },
+        { key: `zero`, value: { largeViewCount: 0n } },
+      ],
+      preparePreviousIndex: async (adapter, collectionId, signature) => {
+        await adapter.ensureIndex(
+          { kind: `eager`, collectionId: collectionId },
+          signature,
+          {
+            expressionSql: [
+              JSON.stringify(indexExpression, (_key, value: unknown) =>
+                typeof value === `bigint` ? value.toString() : value,
+              ),
+            ],
+          },
+        )
+      },
+    })
+
+    expect(observation.adapterKeys).toEqual([`minimum`, `missing`])
+    expect(observation.directSqlKeys).toEqual([`minimum`, `missing`])
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+  })
+
+  it.each([
+    {
+      label: `bigint-field-range`,
+      indexExpression: new IR.PropRef([`largeViewCount`]),
+      where: new IR.Func<boolean>(`gt`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value(BigInt(`9007199254740993`)),
+      ]),
+      rows: [
+        {
+          key: `lower`,
+          value: { largeViewCount: BigInt(`9007199254740992`) },
+        },
+        {
+          key: `higher`,
+          value: { largeViewCount: BigInt(`9007199254740997`) },
+        },
+      ],
+      expectedKeys: [`higher`],
+      expectedCandidateKeys: [`higher`, `lower`],
+      expectedQueryParams: [],
+    },
+    {
+      label: `bigint-field-min-boundary`,
+      indexExpression: new IR.PropRef([`largeViewCount`]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value(SQLITE_BIGINT_MIN),
+      ]),
+      rows: [
+        {
+          key: `minimum`,
+          value: { largeViewCount: SQLITE_BIGINT_MIN },
+        },
+        {
+          key: `next`,
+          value: { largeViewCount: SQLITE_BIGINT_MIN + 1n },
+        },
+      ],
+      expectedKeys: [`minimum`],
+      expectedQueryParams: [],
+    },
+    {
+      label: `bigint-field-max-boundary`,
+      indexExpression: new IR.PropRef([`largeViewCount`]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value(SQLITE_BIGINT_MAX),
+      ]),
+      rows: [
+        {
+          key: `previous`,
+          value: { largeViewCount: SQLITE_BIGINT_MAX - 1n },
+        },
+        {
+          key: `maximum`,
+          value: { largeViewCount: SQLITE_BIGINT_MAX },
+        },
+      ],
+      expectedKeys: [`maximum`],
+      expectedQueryParams: [],
+    },
+    {
+      label: `date-field-range`,
+      indexExpression: new IR.PropRef([`createdAt`]),
+      where: new IR.Func<boolean>(`gt`, [
+        new IR.PropRef([`createdAt`]),
+        new IR.Value(new Date(`2026-01-02T12:00:00.000Z`)),
+      ]),
+      rows: [
+        {
+          key: `earlier`,
+          value: { createdAt: new Date(`2026-01-02T00:00:00.000Z`) },
+        },
+        {
+          key: `later`,
+          value: { createdAt: new Date(`2026-01-03T00:00:00.000Z`) },
+        },
+        {
+          key: `numeric-later`,
+          value: { createdAt: new Date(`2026-01-03T00:00:00.000Z`).getTime() },
+        },
+      ],
+      expectedKeys: [`later`, `numeric-later`],
+      expectedQueryParams: [],
+    },
+    {
+      label: `bigint-field-in`,
+      indexExpression: new IR.PropRef([`largeViewCount`]),
+      where: new IR.Func<boolean>(`in`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value([BigInt(`9007199254740992`), BigInt(`9007199254740997`)]),
+      ]),
+      rows: [
+        {
+          key: `included-low`,
+          value: { largeViewCount: BigInt(`9007199254740992`) },
+        },
+        {
+          key: `excluded`,
+          value: { largeViewCount: BigInt(`9007199254740994`) },
+        },
+        {
+          key: `included-high`,
+          value: { largeViewCount: BigInt(`9007199254740997`) },
+        },
+      ],
+      expectedKeys: [`included-high`, `included-low`],
+      expectedQueryParams: [`[9007199254740992,9007199254740997]`],
+    },
+    {
+      label: `bigint-field-batched-in`,
+      indexExpression: new IR.PropRef([`largeViewCount`]),
+      where: new IR.Func<boolean>(`in`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value(
+          Array.from(
+            { length: 901 },
+            (_unused, index) => BigInt(`9007199254740992`) + BigInt(index),
+          ),
+        ),
+      ]),
+      rows: [
+        {
+          key: `included-first`,
+          value: { largeViewCount: BigInt(`9007199254740992`) },
+        },
+        {
+          key: `excluded`,
+          value: { largeViewCount: BigInt(`9007199254740991`) },
+        },
+        {
+          key: `included-last`,
+          value: { largeViewCount: BigInt(`9007199254741892`) },
+        },
+      ],
+      expectedKeys: [`included-first`, `included-last`],
+      expectedQueryParams: [
+        `[${Array.from({ length: 901 }, (_unused, index) =>
+          (BigInt(`9007199254740992`) + BigInt(index)).toString(),
+        ).join(`,`)}]`,
+      ],
+    },
+  ])(
+    `uses the raw $label field expression index`,
+    async ({
+      expectedKeys,
+      expectedCandidateKeys,
+      expectedQueryParams,
+      ...scenario
+    }) => {
+      const observation = await observeExpressionIndexScenario(scenario)
+      const diagnostic = JSON.stringify(
+        {
+          sql: observation.predicateQuery.sql,
+          params: observation.predicateQuery.params,
+          plan: observation.plan.map((row) => row.detail),
+          adapterKeys: observation.adapterKeys,
+          directSqlKeys: observation.directSqlKeys,
+        },
+        null,
+        2,
+      )
+
+      expect(observation.adapterKeys, diagnostic).toEqual(expectedKeys)
+      if (scenario.label === `date-field-range`) {
+        expect(observation.predicateQuery.sql, diagnostic).not.toContain(
+          ` WHERE `,
+        )
+        expect(observation.directSqlKeys, diagnostic).toEqual(
+          scenario.rows.map((row) => row.key).sort(),
+        )
+        expect(planScansTable(observation.plan, observation.tableName)).toBe(
+          true,
+        )
+        return
+      }
+      expect(observation.directSqlKeys, diagnostic).toEqual(
+        expectedCandidateKeys ?? expectedKeys,
+      )
+      expect(observation.predicateQuery.params, diagnostic).toEqual(
+        expectedQueryParams,
+      )
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+        diagnostic,
+      ).toBe(true)
+    },
+  )
+
+  it(`uses the field expression index for a paired-surrogate string equality`, async () => {
+    const field = new IR.PropRef([`name`])
+    const observation = await observeExpressionIndexScenario({
+      label: `paired-surrogate-equality`,
+      indexExpression: field,
+      where: new IR.Func<boolean>(`eq`, [field, new IR.Value(`😀`)]),
+      rows: [
+        { key: `matching`, value: { name: `😀` } },
+        { key: `other`, value: { name: `other` } },
+      ],
+    })
+
+    expect(observation.adapterKeys).toEqual([`matching`])
+    expect(observation.directSqlKeys).toEqual([`matching`])
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+  })
+
+  it.each([
+    { label: `field on the left`, reversed: false },
+    { label: `field on the right`, reversed: true },
+  ])(
+    `keeps indexed lone-surrogate equality sound with $label`,
+    async ({ reversed }) => {
+      const field = new IR.PropRef([`name`])
+      const value = new IR.Value(`\uD800`)
+      const observation = await observeExpressionIndexScenario({
+        label: `lone-surrogate-equality`,
+        indexExpression: field,
+        where: new IR.Func<boolean>(
+          `eq`,
+          reversed ? [value, field] : [field, value],
+        ),
+        rows: [
+          { key: `matching`, value: { name: `\uD800` } },
+          { key: `other-lone`, value: { name: `\uDC00` } },
+          { key: `ordinary`, value: { name: `ordinary` } },
+        ],
+      })
+
+      expect(observation.adapterKeys).toEqual([`matching`])
+      // The binding and stored value must have the same SQLite byte sequence.
+      expect(observation.directSqlKeys).toEqual([`matching`])
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+      ).toBe(true)
+    },
+  )
+
+  it.each([
+    { label: `BigInt equality`, value: 1n, expectedKeys: [`bigint`] },
+    { label: `boolean equality`, value: true, expectedKeys: [`boolean`] },
+  ])(
+    `keeps indexed $label sound across stored scalar types`,
+    async ({ value, expectedKeys }) => {
+      const field = new IR.PropRef([`n`])
+      const observation = await observeExpressionIndexScenario({
+        label: `mixed-scalar-equality`,
+        indexExpression: field,
+        where: new IR.Func<boolean>(`eq`, [field, new IR.Value(value)]),
+        rows: [
+          { key: `bigint`, value: { n: 1n } },
+          { key: `boolean`, value: { n: true } },
+          { key: `number`, value: { n: 1 } },
+          { key: `text`, value: { n: `1` } },
+          { key: `nan`, value: { n: Number.NaN } },
+          { key: `date`, value: { n: new Date(1) } },
+          { key: `null`, value: { n: null } },
+          { key: `missing`, value: {} },
+        ],
+      })
+
+      expect(observation.adapterKeys).toEqual(expectedKeys)
+      expect(observation.directSqlKeys).toEqual([`bigint`, `boolean`, `number`])
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+      ).toBe(true)
+    },
+  )
+
+  it.each([`eq`, `in`] as const)(
+    `keeps Date epoch matches when a numeric $operator predicate falls back`,
+    async (operator) => {
+      const field = new IR.PropRef([`n`])
+      const observation = await observeExpressionIndexScenario({
+        label: `numeric-${operator}-date-epoch`,
+        indexExpression: field,
+        where: new IR.Func<boolean>(operator, [
+          field,
+          new IR.Value(operator === `eq` ? 1 : [1]),
+        ]),
+        rows: [
+          { key: `date`, value: { n: new Date(1) } },
+          { key: `number`, value: { n: 1 } },
+          { key: `other`, value: { n: 2 } },
+        ],
+      })
+
+      expect(observation.adapterKeys).toEqual([`date`, `number`])
+      expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
+      expect(observation.directSqlKeys).toEqual([`date`, `number`, `other`])
+    },
+  )
+
+  it(`keeps a BigInt match through a lower-wrapped membership fallback`, async () => {
+    const lower = new IR.Func(`lower`, [new IR.PropRef([`n`])])
+    const observation = await observeExpressionIndexScenario({
+      label: `bigint-lower-membership`,
+      indexExpression: lower,
+      where: new IR.Func<boolean>(`in`, [lower, new IR.Value([1n])]),
+      rows: [
+        { key: `bigint`, value: { n: 1n } },
+        { key: `number`, value: { n: 1 } },
+        { key: `text`, value: { n: `1` } },
+      ],
+    })
+
+    expect(observation.adapterKeys).toEqual([`bigint`])
+    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
+    expect(observation.directSqlKeys).toEqual([`bigint`, `number`, `text`])
+  })
+
+  it(`keeps a missing field equal to a lone-surrogate coalesce fallback`, async () => {
+    const fallback = `\uD800`
+    const coalesce = new IR.Func(`coalesce`, [
+      new IR.PropRef([`name`]),
+      new IR.Value(fallback),
+    ])
+    const observation = await observeExpressionIndexScenario({
+      label: `lone-surrogate-coalesce`,
+      indexExpression: coalesce,
+      where: new IR.Func<boolean>(`eq`, [coalesce, new IR.Value(fallback)]),
+      rows: [
+        { key: `missing`, value: {} },
+        { key: `other`, value: { name: `other` } },
+      ],
+    })
+
+    expect(observation.adapterKeys).toEqual([`missing`])
+    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
+    expect(observation.directSqlKeys).toEqual([`missing`, `other`])
+  })
+
+  it(`keeps indexed BigInt membership sound across stored scalar types`, async () => {
+    const field = new IR.PropRef([`n`])
+    const observation = await observeExpressionIndexScenario({
+      label: `mixed-scalar-bigint-in`,
+      indexExpression: field,
+      where: new IR.Func<boolean>(`in`, [field, new IR.Value([1n, 2n])]),
+      rows: [
+        { key: `bigint-one`, value: { n: 1n } },
+        { key: `bigint-two`, value: { n: 2n } },
+        { key: `boolean`, value: { n: true } },
+        { key: `number`, value: { n: 1 } },
+        { key: `text`, value: { n: `1` } },
+        { key: `nan`, value: { n: Number.NaN } },
+        { key: `date`, value: { n: new Date(1) } },
+        { key: `null`, value: { n: null } },
+        { key: `missing`, value: {} },
+      ],
+    })
+
+    expect(observation.adapterKeys).toEqual([`bigint-one`, `bigint-two`])
+    expect(observation.directSqlKeys).toEqual([
+      `bigint-one`,
+      `bigint-two`,
+      `boolean`,
+      `number`,
+    ])
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+  })
+
+  it(`uses an indexed safe conjunct while leaving an unsafe range to the row evaluator`, async () => {
+    const status = new IR.PropRef([`status`])
+    const observation = await observeExpressionIndexScenario({
+      label: `indexed-safe-conjunct`,
+      indexExpression: status,
+      where: new IR.Func<boolean>(`and`, [
+        new IR.Func<boolean>(`eq`, [status, new IR.Value(`active`)]),
+        new IR.Func<boolean>(`gt`, [new IR.PropRef([`n`]), new IR.Value(0)]),
+      ]),
+      rows: [
+        { key: `active-nan`, value: { status: `active`, n: Number.NaN } },
+        { key: `active-negative`, value: { status: `active`, n: -1 } },
+        { key: `active-zero`, value: { status: `active`, n: 0 } },
+        { key: `inactive-positive`, value: { status: `inactive`, n: 2 } },
+        { key: `inactive-zero`, value: { status: `inactive`, n: 0 } },
+        { key: `inactive-nan`, value: { status: `inactive`, n: Number.NaN } },
+      ],
+    })
+
+    expect(observation.adapterKeys).toEqual([`active-nan`])
+    expect(observation.directSqlKeys).toEqual([`active-nan`, `active-zero`])
+    expect(observation.predicateQuery.sql).toContain(` WHERE `)
+    expect(observation.predicateQuery.sql).toContain(`$.n`)
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+    expect(planScansTable(observation.plan, observation.tableName)).toBe(false)
+  })
+
+  it.each([
+    {
+      operator: `gt`,
+      target: 1,
+      expectedKeys: [
+        `array`,
+        `bigint-positive`,
+        `date`,
+        `infinity`,
+        `nan`,
+        `numeric-text`,
+        `positive`,
+      ],
+    },
+    {
+      operator: `lt`,
+      target: 2,
+      expectedKeys: [
+        `bigint-negative`,
+        `negative`,
+        `negative-infinity`,
+        `negative-subnormal`,
+        `negative-text`,
+        `one`,
+        `zero`,
+      ],
+    },
+  ] as const)(
+    `uses an indexed superset for a mixed scalar $operator range`,
+    async ({ operator, target, expectedKeys }) => {
+      const field = new IR.PropRef([`n`])
+      const rows = [
+        { key: `negative`, value: { n: -2 } },
+        { key: `negative-subnormal`, value: { n: -Number.MIN_VALUE } },
+        { key: `zero`, value: { n: 0 } },
+        { key: `one`, value: { n: 1 } },
+        { key: `positive`, value: { n: 3 } },
+        { key: `nan`, value: { n: Number.NaN } },
+        { key: `infinity`, value: { n: Number.POSITIVE_INFINITY } },
+        { key: `negative-infinity`, value: { n: Number.NEGATIVE_INFINITY } },
+        { key: `numeric-text`, value: { n: `3` } },
+        { key: `negative-text`, value: { n: `-2` } },
+        { key: `word`, value: { n: `abc` } },
+        { key: `bigint-negative`, value: { n: -2n } },
+        { key: `bigint-positive`, value: { n: 3n } },
+        { key: `date`, value: { n: new Date(3) } },
+        { key: `null`, value: { n: null } },
+        { key: `missing`, value: {} },
+        { key: `array`, value: { n: [3] } },
+        { key: `object`, value: { n: { x: 3 } } },
+      ]
+      const observation = await observeExpressionIndexScenario({
+        label: `mixed-scalar-${operator}-range`,
+        indexExpression: field,
+        where: new IR.Func<boolean>(operator, [field, new IR.Value(target)]),
+        rows,
+      })
+
+      expect(observation.adapterKeys).toEqual(expectedKeys)
+      expect(observation.directSqlKeys).toEqual(
+        expect.arrayContaining([...expectedKeys]),
+      )
+      expect(observation.directSqlKeys.length).toBeLessThan(rows.length)
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+      ).toBe(true)
+      expect(planScansTable(observation.plan, observation.tableName)).toBe(
+        false,
+      )
+    },
+  )
+
+  it.each([
+    {
+      operator: `gt`,
+      expectedKeys: [`above`, `date`, `nan`, `numeric-text`],
+      expectedCandidates: 7,
+    },
+    {
+      operator: `gte`,
+      expectedKeys: [`above`, `date`, `equal`, `nan`, `numeric-text`],
+      expectedCandidates: 7,
+    },
+    {
+      operator: `lt`,
+      expectedKeys: [`below`, `negative`],
+      expectedCandidates: 8,
+    },
+    {
+      operator: `lte`,
+      expectedKeys: [`below`, `equal`, `negative`],
+      expectedCandidates: 8,
+    },
+  ] as const)(
+    `keeps matches adjacent to an indexed integer $operator bound`,
+    async ({ operator, expectedKeys, expectedCandidates }) => {
+      const field = new IR.PropRef([`n`])
+      const rows = [
+        { key: `negative`, value: { n: -1 } },
+        { key: `below`, value: { n: 1 - Number.EPSILON / 2 } },
+        { key: `equal`, value: { n: 1 } },
+        { key: `above`, value: { n: 1 + Number.EPSILON } },
+        { key: `nan`, value: { n: Number.NaN } },
+        { key: `numeric-text`, value: { n: `2` } },
+        { key: `date`, value: { n: new Date(2) } },
+        { key: `null`, value: { n: null } },
+        { key: `missing`, value: {} },
+      ]
+      const observation = await observeExpressionIndexScenario({
+        label: `adjacent-integer-${operator}`,
+        indexExpression: field,
+        where: new IR.Func<boolean>(operator, [field, new IR.Value(1)]),
+        rows,
+      })
+
+      expect(observation.adapterKeys).toEqual(expectedKeys)
+      expect(observation.directSqlKeys).toEqual(
+        expect.arrayContaining([...expectedKeys]),
+      )
+      expect(observation.directSqlKeys).toHaveLength(expectedCandidates)
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+      ).toBe(true)
+    },
+  )
+
+  it(`keeps Unicode lowercase matches in an indexed candidate set`, async () => {
+    const field = new IR.PropRef([`name`])
+    const lower = new IR.Func(`lower`, [field])
+    const rows = [
+      { key: `ascii-lower`, value: { name: `ak` } },
+      { key: `ascii-upper`, value: { name: `AK` } },
+      { key: `kelvin-inside`, value: { name: `aK` } },
+      { key: `ascii-other`, value: { name: `ak-more` } },
+      { key: `unicode-other`, value: { name: `aé` } },
+      { key: `ascii-before`, value: { name: `abc` } },
+    ]
+    const observation = await observeExpressionIndexScenario({
+      label: `unicode-lower-candidates`,
+      indexExpression: lower,
+      where: new IR.Func<boolean>(`eq`, [lower, new IR.Value(`ak`)]),
+      rows,
+    })
+
+    expect(observation.adapterKeys).toEqual([
+      `ascii-lower`,
+      `ascii-upper`,
+      `kelvin-inside`,
+    ])
+    expect(observation.directSqlKeys).toEqual(
+      expect.arrayContaining(observation.adapterKeys),
+    )
+    expect(observation.directSqlKeys).not.toContain(`ascii-other`)
+    expect(observation.directSqlKeys).toHaveLength(4)
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+    expect(planScansTable(observation.plan, observation.tableName)).toBe(false)
+  })
+
+  it.each([
+    {
+      label: `large Number and BigInt bound`,
+      value: { n: 1000000000000000100 },
+      indexExpression: new IR.PropRef([`n`]),
+      predicate: new IR.Func<boolean>(`gt`, [
+        new IR.PropRef([`n`]),
+        new IR.Value(1000000000000000120n),
+      ]),
+    },
+    {
+      label: `numeric object key`,
+      value: { part: { '0': `match` } },
+      indexExpression: new IR.PropRef([`part`, `0`]),
+      predicate: new IR.Func<boolean>(`eq`, [
+        new IR.PropRef([`part`, `0`]),
+        new IR.Value(`match`),
+      ]),
+    },
+    {
+      label: `Unicode lowercase after NUL`,
+      value: { name: `a\u0000K` },
+      indexExpression: new IR.Func(`lower`, [new IR.PropRef([`name`])]),
+      predicate: new IR.Func<boolean>(`eq`, [
+        new IR.Func(`lower`, [new IR.PropRef([`name`])]),
+        new IR.Value(`a\u0000k`),
+      ]),
+    },
+  ])(`keeps $label through a unary SQL candidate`, async (testCase) => {
+    for (const wrapper of [`and`, `or`] as const) {
+      const observation = await observeExpressionIndexScenario({
+        label: `candidate-${testCase.label}-${wrapper}`,
+        indexExpression: testCase.indexExpression,
+        where: new IR.Func<boolean>(wrapper, [testCase.predicate]),
+        rows: [{ key: `match`, value: testCase.value }],
+      })
+
+      // The JavaScript predicate matches each row by the public contract.
+      // Every matching key must survive SQLite before that evaluator runs.
+      expect(observation.adapterKeys).toEqual([`match`])
+      expect(observation.directSqlKeys).toContain(`match`)
+    }
+  })
+
+  it(`keeps numeric-key object and array matches across candidate kinds`, async () => {
+    const variants = [
+      {
+        name: `equality`,
+        match: `match`,
+        other: `other`,
+        predicate: (ref: IR.PropRef) =>
+          new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
+      },
+      {
+        name: `coalesce`,
+        match: `match`,
+        other: `other`,
+        predicate: (ref: IR.PropRef) =>
+          new IR.Func<boolean>(`eq`, [
+            new IR.Func(`coalesce`, [ref, new IR.Value(`fallback`)]),
+            new IR.Value(`match`),
+          ]),
+      },
+      {
+        name: `membership`,
+        match: 1n,
+        other: 2n,
+        predicate: (ref: IR.PropRef) =>
+          new IR.Func<boolean>(`in`, [ref, new IR.Value([1n])]),
+      },
+      {
+        name: `prefix`,
+        match: `match`,
+        other: `other`,
+        predicate: (ref: IR.PropRef) =>
+          new IR.Func<boolean>(`like`, [ref, new IR.Value(`mat%`)]),
+      },
+      {
+        name: `lowercase`,
+        match: `MATCH`,
+        other: `other`,
+        predicate: (ref: IR.PropRef) =>
+          new IR.Func<boolean>(`eq`, [
+            new IR.Func(`lower`, [ref]),
+            new IR.Value(`match`),
+          ]),
+      },
+    ]
+    for (const segment of [`0`, `1`]) {
+      const wrapArray = (value: unknown) => {
+        const items: Array<unknown> = []
+        items[Number(segment)] = value
+        return { part: items }
+      }
+      for (const variant of variants) {
+        const ref = new IR.PropRef([`part`, segment])
+        const rows = [
+          {
+            key: `array-match`,
+            value: wrapArray(variant.match),
+          },
+          {
+            key: `object-match`,
+            value: { part: { [segment]: variant.match } },
+          },
+          {
+            key: `array-other`,
+            value: wrapArray(variant.other),
+          },
+          {
+            key: `object-other`,
+            value: { part: { [segment]: variant.other } },
+          },
+        ]
+        const predicate = variant.predicate(ref)
+        for (const wrapper of [`direct`, `and`, `or`] as const) {
+          const observation = await observeExpressionIndexScenario({
+            label: `numeric-key-${segment}-${variant.name}-${wrapper}`,
+            indexExpression: ref,
+            where:
+              wrapper === `direct`
+                ? predicate
+                : new IR.Func<boolean>(wrapper, [predicate]),
+            rows,
+          })
+          const expectedKeys = [`array-match`, `object-match`]
+          expect(observation.adapterKeys).toEqual(expectedKeys)
+          expect(observation.directSqlKeys).toEqual(
+            expect.arrayContaining(expectedKeys),
+          )
+          if (variant.name === `equality`) {
+            expect(
+              planUsesNamedIndex(
+                observation.plan,
+                observation.tableName,
+                observation.indexName,
+              ),
+            ).toBe(true)
+          }
+        }
+      }
+    }
+  })
+
+  it(`indexes mixed array and object numeric paths`, async () => {
+    const ref = new IR.PropRef([`part`, `0`, `0`])
+    const observation = await observeExpressionIndexScenario({
+      label: `mixed-numeric-carriers`,
+      indexExpression: ref,
+      where: new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
+      rows: [
+        { key: `array-array`, value: { part: [[`match`]] } },
+        { key: `array-object`, value: { part: [{ '0': `match` }] } },
+        { key: `object-array`, value: { part: { '0': [`match`] } } },
+        { key: `object-object`, value: { part: { '0': { '0': `match` } } } },
+      ],
+    })
+    const expectedKeys = [
+      `array-array`,
+      `array-object`,
+      `object-array`,
+      `object-object`,
+    ]
+    expect(observation.adapterKeys).toEqual(expectedKeys)
+    expect(observation.directSqlKeys).toEqual(expectedKeys)
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+  })
+
+  it(`indexes every three-segment numeric carrier combination`, async () => {
+    const ref = new IR.PropRef([`part`, `0`, `0`, `0`])
+    const rows = Array.from({ length: 8 }, (_unused, mask) => {
+      let nested: unknown = `match`
+      for (let bit = 0; bit < 3; bit++) {
+        nested = mask & (1 << bit) ? [nested] : { '0': nested }
+      }
+      return { key: `carrier-${mask}`, value: { part: nested } }
+    })
+    const observation = await observeExpressionIndexScenario({
+      label: `three-numeric-carriers`,
+      indexExpression: ref,
+      where: new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
+      rows,
+    })
+    const expectedKeys = rows.map(({ key }) => key)
+    expect(observation.adapterKeys).toEqual(expectedKeys)
+    expect(observation.directSqlKeys).toEqual(expectedKeys)
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+  })
+
+  it(`keeps deep numeric paths in the unbounded candidate set`, async () => {
+    const ref = new IR.PropRef([`part`, `0`, `0`, `0`, `0`])
+    const observation = await observeExpressionIndexScenario({
+      label: `deep-numeric-carriers`,
+      indexExpression: ref,
+      where: new IR.Func<boolean>(`eq`, [ref, new IR.Value(`match`)]),
+      rows: [
+        {
+          key: `match`,
+          value: { part: { '0': { '0': { '0': { '0': `match` } } } } },
+        },
+      ],
+    })
+    expect(observation.adapterKeys).toEqual([`match`])
+    expect(observation.directSqlKeys).toEqual([`match`])
+    expect(observation.predicateQuery.sql).not.toContain(` WHERE `)
+  })
+
+  it(`keeps Unicode lowercase matches across NUL placement and equality direction`, async () => {
+    const spellings = [
+      { name: `NUL before fold`, source: `a\u0000K`, target: `a\u0000k` },
+      { name: `NUL after fold`, source: `K\u0000a`, target: `k\u0000a` },
+      { name: `NUL after prefix`, source: `aK\u0000b`, target: `ak\u0000b` },
+      { name: `no NUL`, source: `aK`, target: `ak` },
+    ]
+    const field = new IR.PropRef([`name`])
+    const lower = new IR.Func(`lower`, [field])
+    for (const spelling of spellings) {
+      expect(spelling.source.toLowerCase()).toBe(spelling.target)
+      const rows = [
+        { key: `ascii`, value: { name: spelling.target } },
+        { key: `unicode`, value: { name: spelling.source } },
+        { key: `other`, value: { name: `different` } },
+      ]
+      for (const lowerOnLeft of [true, false]) {
+        const literal = new IR.Value(spelling.target)
+        const predicate = new IR.Func<boolean>(
+          `eq`,
+          lowerOnLeft ? [lower, literal] : [literal, lower],
+        )
+        for (const wrapper of [`direct`, `and`, `or`] as const) {
+          const observation = await observeExpressionIndexScenario({
+            label: `nul-lower-${spelling.name}-${lowerOnLeft}-${wrapper}`,
+            indexExpression: lower,
+            where:
+              wrapper === `direct`
+                ? predicate
+                : new IR.Func<boolean>(wrapper, [predicate]),
+            rows,
+          })
+          const expectedKeys = [`ascii`, `unicode`]
+          expect(observation.adapterKeys).toEqual(expectedKeys)
+          expect(observation.directSqlKeys).toEqual(
+            expect.arrayContaining(expectedKeys),
+          )
+        }
+      }
+    }
+  })
+
+  it.each([
+    {
+      label: `greater than zero`,
+      operator: `gt`,
+      target: 0,
+      expectedKeys: [`infinity`, `nan`, `numeric-text`, `positive`],
+    },
+    {
+      label: `less than two`,
+      operator: `lt`,
+      target: 2,
+      expectedKeys: [`negative`, `negative-infinity`, `positive`],
+    },
+  ] as const)(
+    `keeps indexed numeric comparison matches for $label`,
+    async ({ label, operator, target, expectedKeys }) => {
+      const field = new IR.PropRef([`n`])
+      const observation = await observeExpressionIndexScenario({
+        label: `numeric-domain-${label}`,
+        indexExpression: field,
+        where: new IR.Func<boolean>(operator, [field, new IR.Value(target)]),
+        rows: [
+          { key: `negative`, value: { n: -1 } },
+          { key: `positive`, value: { n: 1 } },
+          { key: `nan`, value: { n: Number.NaN } },
+          { key: `infinity`, value: { n: Number.POSITIVE_INFINITY } },
+          { key: `negative-infinity`, value: { n: Number.NEGATIVE_INFINITY } },
+          { key: `missing`, value: {} },
+          { key: `null`, value: { n: null } },
+          { key: `numeric-text`, value: { n: `2` } },
+          { key: `text`, value: { n: `abc` } },
+        ],
+      })
+
+      // Public rows are exact. SQL may admit extra candidates for the row
+      // evaluator when SQLite and TanStack DB order stored values differently.
+      expect(observation.adapterKeys).toEqual(expectedKeys)
+      expect(
+        planUsesNamedIndex(
+          observation.plan,
+          observation.tableName,
+          observation.indexName,
+        ),
+      ).toBe(true)
+    },
+  )
+
+  it.each([
+    {
+      label: `nested row value`,
+      tx: {
+        txId: `out-of-range-row`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [
+          {
+            type: `insert`,
+            key: `row`,
+            value: { profile: { count: SQLITE_BIGINT_MAX + 1n } },
+          },
+        ],
+      } satisfies PersistedTx,
+    },
+    {
+      label: `row metadata`,
+      tx: {
+        txId: `out-of-range-row-metadata`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
+        rowMetadataMutations: [
+          {
+            type: `set`,
+            key: `row`,
+            value: { count: SQLITE_BIGINT_MIN - 1n },
+          },
+        ],
+      } satisfies PersistedTx,
+    },
+    {
+      label: `collection metadata`,
+      tx: {
+        txId: `out-of-range-collection-metadata`,
+        term: 1,
+        seq: 1,
+        rowVersion: 1,
+        mutations: [{ type: `insert`, key: `row`, value: { id: `row` } }],
+        collectionMetadataMutations: [
+          {
+            type: `set`,
+            key: `checkpoint`,
+            value: { count: SQLITE_BIGINT_MAX + 1n },
+          },
+        ],
+      } satisfies PersistedTx,
+    },
+  ])(`rejects an out-of-range BigInt in a persisted $label`, async ({ tx }) => {
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const adapter = createSQLiteCorePersistenceAdapter({ driver })
+
+    await withFailurePreservingCleanup(async () => {
+      await expect(
+        adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: `bigint-write-range` },
+          tx,
+        ),
+      ).rejects.toThrow(
+        /SQLite BigInt value .* outside the signed 64-bit range/,
+      )
+
+      if (adapter.scanRows) {
+        expect(
+          await adapter.scanRows({
+            kind: `eager`,
+            collectionId: `bigint-write-range`,
+          }),
+        ).toEqual([])
+      }
+    }, [() => driver.close()])
+  })
+
+  it(`reads a legacy persisted BigInt beyond the new write range`, async () => {
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const adapter = createSQLiteCorePersistenceAdapter({ driver })
+    const collectionId = `legacy-bigint-read`
+    const tableName = createPersistedTableName(collectionId, `c`)
+    const legacyValue = 10n ** 30n
+
+    await withFailurePreservingCleanup(async () => {
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-legacy-bigint-read`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `legacy`,
+              value: { id: `legacy`, count: 1n },
+            },
+          ],
+        },
+      )
+      driver
+        .getDatabase()
+        .prepare(`UPDATE "${tableName}" SET value = ?`)
+        .run(
+          JSON.stringify({
+            id: `legacy`,
+            count: {
+              [PERSISTED_TYPE_TAG]: `bigint`,
+              [PERSISTED_VALUE_TAG]: legacyValue.toString(),
+            },
+          }),
+        )
+
+      if (!adapter.scanRows) {
+        throw new Error(`real SQLite adapter did not expose scanRows`)
+      }
+      const scanned = await adapter.scanRows({
+        kind: `eager`,
+        collectionId: collectionId,
+      })
+      expect(scanned.map((row) => row.value)).toEqual([
+        { id: `legacy`, count: legacyValue },
+      ])
+
+      const subset = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`id`]),
+            new IR.Value(`legacy`),
+          ]),
+        },
+      )
+      expect(subset.map((row) => row.value)).toEqual([
+        { id: `legacy`, count: legacyValue },
+      ])
+    }, [() => driver.close()])
+  })
+
+  it.each([
+    {
+      label: `scalar comparison`,
+      rejectedValue: SQLITE_BIGINT_MAX + 1n,
+      where: new IR.Func<boolean>(`gt`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value(SQLITE_BIGINT_MAX + 1n),
+      ]),
+    },
+    {
+      label: `ordinary IN`,
+      rejectedValue: SQLITE_BIGINT_MIN - 1n,
+      where: new IR.Func<boolean>(`in`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value([0n, SQLITE_BIGINT_MIN - 1n]),
+      ]),
+    },
+    {
+      label: `batched IN`,
+      rejectedValue: SQLITE_BIGINT_MAX + 1n,
+      where: new IR.Func<boolean>(`in`, [
+        new IR.PropRef([`largeViewCount`]),
+        new IR.Value([
+          ...Array.from({ length: 900 }, (_unused, index) => BigInt(index)),
+          SQLITE_BIGINT_MAX + 1n,
+        ]),
+      ]),
+    },
+  ])(
+    `rejects an out-of-range BigInt in a $label before SQLite comparison`,
+    async ({ rejectedValue, where }) => {
+      const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+      const adapter = createSQLiteCorePersistenceAdapter({ driver })
+      const collectionId = `bigint-query-range`
+
+      await withFailurePreservingCleanup(async () => {
+        await adapter.applyCommittedTx(
+          { kind: `eager`, collectionId: collectionId },
+          {
+            txId: `seed-bigint-query-range`,
+            term: 1,
+            seq: 1,
+            rowVersion: 1,
+            mutations: [
+              {
+                type: `insert`,
+                key: `zero`,
+                value: { largeViewCount: 0n },
+              },
+            ],
+          },
+        )
+
+        await expect(
+          adapter.loadSubset(
+            { kind: `eager`, collectionId: collectionId },
+            { where },
+          ),
+        ).rejects.toThrow(bigintRangeError(rejectedValue))
+      }, [() => driver.close()])
+    },
+  )
+
+  it(`rejects a hostile serialized out-of-range BigInt index constant`, async () => {
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const adapter = createSQLiteCorePersistenceAdapter({ driver })
+    const value = SQLITE_BIGINT_MAX + 1n
+
+    await withFailurePreservingCleanup(async () => {
+      await expect(
+        adapter.ensureIndex(
+          { kind: `eager`, collectionId: `bigint-index-range` },
+          `out-of-range`,
+          {
+            expressionSql: [
+              serializeIndexExpression(
+                new IR.Func(`add`, [
+                  new IR.PropRef([`largeViewCount`]),
+                  new IR.Value(value),
+                ]),
+              ),
+            ],
+          },
+        ),
+      ).rejects.toThrow(bigintRangeError(value))
+    }, [() => driver.close()])
+  })
+
+  it(`does not confuse an alias-qualified field ref with a nested JSON path`, async () => {
+    const observation = await observeExpressionIndexScenario({
+      label: `alias-qualified-field`,
+      indexExpression: new IR.PropRef([`score`]),
+      where: new IR.Func<boolean>(`gt`, [
+        new IR.PropRef([`todos`, `score`], `todos`),
+        new IR.Value(1),
+      ]),
+      rows: [
+        { key: `matching`, value: { score: 2 } },
+        { key: `different`, value: { score: 0 } },
+      ],
+    })
+    const diagnostic = JSON.stringify(
+      {
+        sql: observation.predicateQuery.sql,
+        params: observation.predicateQuery.params,
+        plan: observation.plan.map((row) => row.detail),
+        adapterKeys: observation.adapterKeys,
+        directSqlKeys: observation.directSqlKeys,
+      },
+      null,
+      2,
+    )
+
+    expect(observation.adapterKeys, diagnostic).toEqual([`matching`])
+    expect(observation.directSqlKeys, diagnostic).toEqual([`matching`])
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+      diagnostic,
+    ).toBe(true)
+  })
+
+  it(`does not guess that a legacy nested path is an alias`, async () => {
+    const baseDriver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const adapter = createSQLiteCorePersistenceAdapter({ driver: baseDriver })
+    const collectionId = `legacy-nested-path`
+
+    await withFailurePreservingCleanup(async () => {
+      await adapter.applyCommittedTx(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          txId: `seed-legacy-nested-path`,
+          term: 1,
+          seq: 1,
+          rowVersion: 1,
+          mutations: [
+            {
+              type: `insert`,
+              key: `nested-match`,
+              value: {
+                profile: { [`meta-field`]: `alpha` },
+                [`meta-field`]: `flat-other`,
+              },
+            },
+            {
+              type: `insert`,
+              key: `flat-only`,
+              value: { [`meta-field`]: `alpha` },
+            },
+          ],
+        },
+      )
+
+      const rows = await adapter.loadSubset(
+        { kind: `eager`, collectionId: collectionId },
+        {
+          where: new IR.Func(`eq`, [
+            new IR.PropRef([`profile`, `meta-field`]),
+            new IR.Value(`alpha`),
+          ]),
+        },
+      )
+
+      expect(rows.map((row) => row.key)).toEqual([`nested-match`])
+    }, [() => baseDriver.close()])
+  })
+
+  it(`exposes an overbroad indexed predicate hidden by in-memory re-filtering`, async () => {
+    const observation = await observeExpressionIndexScenario({
+      label: `overbroad-indexed-predicate`,
+      indexExpression: new IR.PropRef([`score`]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.PropRef([`score`]),
+        new IR.Value(`2`),
+      ]),
+      rows: [
+        { key: `lower`, value: { score: `1` } },
+        { key: `matching`, value: { score: `2` } },
+        { key: `higher`, value: { score: `3` } },
+      ],
+      transformQuery: makeOverbroadEqualityMutation,
+    })
+
+    expect(observation.adapterKeys).toEqual([`matching`])
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(true)
+    expect(planScansTable(observation.plan, observation.tableName)).toBe(false)
+    expect(observation.directSqlKeys).toEqual([`higher`, `matching`])
+  })
+
+  it(`kills the former path-binding compiler behavior at the driver boundary`, async () => {
+    const observation = await observeExpressionIndexScenario({
+      label: `legacy-path-binding`,
+      indexExpression: new IR.PropRef([`score`]),
+      where: new IR.Func<boolean>(`eq`, [
+        new IR.PropRef([`score`]),
+        new IR.Value(`2`),
+      ]),
+      rows: [
+        { key: `matching`, value: { score: `2` } },
+        { key: `different`, value: { score: `3` } },
+      ],
+      transformQuery: makeLegacyPathBindingMutation,
+    })
+
+    expect(observation.adapterKeys).toEqual([`matching`])
+    expect(observation.directSqlKeys).toEqual([`matching`])
+    expect(
+      planUsesNamedIndex(
+        observation.plan,
+        observation.tableName,
+        observation.indexName,
+      ),
+    ).toBe(false)
+    expect(planScansTable(observation.plan, observation.tableName)).toBe(true)
+  })
+
+  it(`recognizes equivalent SQLite plan identifier formats without prefix collisions`, () => {
+    const tableName = `rows`
+    const indexName = `literal_ddl`
+
+    for (const detail of [
+      `SEARCH rows USING INDEX literal_ddl (<expr>=?)`,
+      `SEARCH TABLE rows USING INDEX literal_ddl (<expr>=?)`,
+      `SEARCH "rows" USING INDEX "literal_ddl" (<expr>=?)`,
+      `SEARCH TABLE "rows" USING INDEX "literal_ddl" (<expr>=?)`,
+    ]) {
+      expect(planUsesNamedIndex([{ detail }], tableName, indexName)).toBe(true)
+    }
+
+    for (const detail of [`SCAN rows`, `SCAN TABLE rows`, `SCAN "rows"`]) {
+      expect(planScansTable([{ detail }], tableName)).toBe(true)
+    }
+
+    expect(
+      planUsesNamedIndex(
+        [
+          {
+            detail: `SEARCH rows_archive USING INDEX literal_ddl_backup (<expr>=?)`,
+          },
+        ],
+        tableName,
+        indexName,
+      ),
+    ).toBe(false)
+    expect(planScansTable([{ detail: `SCAN rows_archive` }], tableName)).toBe(
+      false,
+    )
+  })
+
+  it(`distinguishes rejected DDL path binding from correct predicate rows without index use`, async () => {
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const database = driver.getDatabase()
+    const jsonPath = `$.payload.threadId`
+    const target = `thread-'1`
+
+    await withFailurePreservingCleanup(() => {
+      database.exec(
+        `CREATE TABLE rows (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,
+      )
+      const insert = database.prepare(
+        `INSERT INTO rows (key, value) VALUES (?, ?)`,
+      )
+      insert.run(`matching`, JSON.stringify({ payload: { threadId: target } }))
+      insert.run(
+        `different`,
+        JSON.stringify({ payload: { threadId: `thread-2` } }),
+      )
+
+      // SQLite rejects a DDL-path binding before an index can exist. This is
+      // a setup-rejection control only, not the production oracle's RED.
+      expect(() =>
+        database
+          .prepare(`CREATE INDEX bound_ddl ON rows (json_extract(value, ?))`)
+          .run(jsonPath),
+      ).toThrow(/parameters prohibited in index expressions/i)
+
+      database.exec(
+        `CREATE INDEX literal_ddl ON rows (json_extract(value, ${sqliteLiteral(jsonPath)}))`,
+      )
+      const literalPredicate = `SELECT key FROM rows WHERE json_extract(value, ${sqliteLiteral(jsonPath)}) = ?`
+      const boundPredicate = `SELECT key FROM rows WHERE json_extract(value, ?) = ?`
+      const literalRows = database.prepare(literalPredicate).all(target)
+      const boundRows = database.prepare(boundPredicate).all(jsonPath, target)
+      const literalPlan = database
+        .prepare(`EXPLAIN QUERY PLAN ${literalPredicate}`)
+        .all(target) as Array<QueryPlanRow>
+      const boundPlan = database
+        .prepare(`EXPLAIN QUERY PLAN ${boundPredicate}`)
+        .all(jsonPath, target) as Array<QueryPlanRow>
+
+      // Same correct rows, different plan: a row-only assertion is
+      // false-green. This predicate-plan mismatch kills the hostile mutant.
+      expect(boundRows).toEqual(literalRows)
+      expect(planUsesNamedIndex(literalPlan, `rows`, `literal_ddl`)).toBe(true)
+      expect(planScansTable(literalPlan, `rows`)).toBe(false)
+      expect(planUsesNamedIndex(boundPlan, `rows`, `literal_ddl`)).toBe(false)
+      expect(planScansTable(boundPlan, `rows`)).toBe(true)
+    }, [() => driver.close()])
+  })
+})
+
+describe(`Temporal expression-index refinement`, () => {
+  it.each(temporalFamilies)(
+    `preserves wrapper-created native coalesce literals / $name`,
+    async (family) => {
+      vi.stubGlobal(`Temporal`, Temporal)
+      try {
+        const expression = new IR.Func(`coalesce`, [
+          new IR.PropRef([`stamp`]),
+          new IR.Value(temporalValue(family, 1)),
+        ])
+        const result = await observeExpressionIndexScenario({
+          label: `wrapper-${family.name}`,
+          viaWrapper: true,
+          indexExpression: expression,
+          where: new IR.Func<boolean>(`eq`, [
+            expression,
+            new IR.Value(temporalValue(family, 1)),
+          ]),
+          rows: family.texts.map((_, i) => ({
+            key: `row-${i}`,
+            value: {
+              id: `row-${i}`,
+              stamp: i === 1 ? null : temporalValue(family, i),
+            },
+          })),
+        })
+        expect(result.adapterKeys).toEqual([`row-1`])
+        expect(result.directSqlKeys).toEqual([`row-1`])
+        expect(
+          planUsesNamedIndex(result.plan, result.tableName, result.indexName),
+          JSON.stringify(result),
+        ).toBe(true)
+        expect(planScansTable(result.plan, result.tableName)).toBe(false)
+      } finally {
+        vi.unstubAllGlobals()
+      }
+    },
+  )
+
+  it.each(temporalFamilies)(
+    `retains native identity through numeric array and object paths / $name`,
+    async (family) => {
+      vi.stubGlobal(`Temporal`, Temporal)
+      try {
+        const ref = new IR.PropRef([`dates`, `0`])
+        for (const carrier of [`array`, `object`] as const) {
+          const rows = family.texts.map((_, i) => ({
+            key: `row-${i}`,
+            value: {
+              dates:
+                carrier === `array`
+                  ? [temporalValue(family, i)]
+                  : { 0: temporalValue(family, i) },
+            },
+          }))
+          for (const operator of [`eq`, `in`] as const) {
+            const expression = new IR.Func<boolean>(operator, [
+              ref,
+              new IR.Value(
+                operator === `eq`
+                  ? temporalValue(family, 1)
+                  : [temporalValue(family, 1)],
+              ),
+            ])
+            const result = await observeExpressionIndexScenario({
+              label: `${family.name}-${carrier}-${operator}`,
+              indexExpression: expression,
+              where: expression,
+              rows,
+              observeIndexValues: true,
+            })
+            expect(result.adapterKeys).toEqual([`row-1`])
+            expect(result.directSqlKeys).toEqual([`row-1`])
+            expect(result.indexValues).toEqual(
+              family.texts.map((_, i) => ({
+                key: `row-${i}`,
+                value: i === 1 ? 1 : 0,
+              })),
+            )
+          }
+        }
+      } finally {
+        vi.unstubAllGlobals()
+      }
+    },
+  )
+
+  it(`preserves the primary failure and still closes SQLite`, async () => {
+    const { CollectionImpl } = await import('../../db/src/collection/index')
+    const primary = new Error(`primary metadata failure`)
+    const cleanup = new Error(`secondary cleanup failure`)
+    const cleanupOriginal = CollectionImpl.prototype.cleanup
+    const execOriginal = BetterSqlite3SQLiteDriver.prototype.exec
+    let driver: BetterSqlite3SQLiteDriver | undefined
+    const execSpy = vi
+      .spyOn(BetterSqlite3SQLiteDriver.prototype, `exec`)
+      .mockImplementation(function (this: BetterSqlite3SQLiteDriver, sql) {
+        driver = this
+        return execOriginal.call(this, sql)
+      })
+    const closeSpy = vi.spyOn(BetterSqlite3SQLiteDriver.prototype, `close`)
+    const cleanupSpy = vi
+      .spyOn(CollectionImpl.prototype, `cleanup`)
+      .mockImplementation(async function (
+        this: InstanceType<typeof CollectionImpl>,
+      ) {
+        await cleanupOriginal.call(this)
+        throw cleanup
+      })
+    const metadataSpy = vi
+      .spyOn(CollectionImpl.prototype, `getIndexMetadata`)
+      .mockImplementation(() => {
+        throw primary
+      })
+    vi.stubGlobal(`Temporal`, Temporal)
+    try {
+      const result = await observeExpressionIndexScenario({
+        label: `prep-cleanup`,
+        viaWrapper: true,
+        indexExpression: new IR.Func(`coalesce`, [
+          new IR.PropRef([`stamp`]),
+          new IR.Value(Temporal.Instant.from(`2026-01-01T00:00:00Z`)),
+        ]),
+        rows: [],
+      }).then(
+        () => undefined,
+        (error) => error,
+      )
+      expect.soft(result).toBeInstanceOf(AggregateError)
+      expect.soft(result?.errors).toEqual([primary, cleanup])
+      expect.soft(closeSpy).toHaveBeenCalledTimes(1)
+    } finally {
+      metadataSpy.mockRestore()
+      cleanupSpy.mockRestore()
+      closeSpy.mockRestore()
+      execSpy.mockRestore()
+      driver?.close()
+      vi.unstubAllGlobals()
+    }
+  })
+})
diff --git a/packages/offline-transactions/tests/KeyScheduler-lifecycle.test.ts b/packages/offline-transactions/tests/KeyScheduler-lifecycle.test.ts
new file mode 100644
index 0000000000..4c27ddaa2c
--- /dev/null
+++ b/packages/offline-transactions/tests/KeyScheduler-lifecycle.test.ts
@@ -0,0 +1,30 @@
+// Ordinary unit tests for KeyScheduler's selective removal of unissued work. The
+// generated lifecycle law is owned by KeyScheduler-oracle.property.test.ts
+// (offline.key-scheduler-fifo-ledger).
+import { describe, expect, it } from 'vitest'
+import { KeyScheduler } from '../src/executor/KeyScheduler'
+import { BASE_TIME, createTransaction } from './key-scheduler-support'
+
+describe(`KeyScheduler generated lifecycle`, () => {
+  it(`selectively removes only unissued work`, () => {
+    const scheduler = new KeyScheduler()
+    const active = createTransaction(``, BASE_TIME, BASE_TIME, 1)
+    const removed = createTransaction(`removed`, BASE_TIME + 1, BASE_TIME, 2)
+    const retained = createTransaction(`retained`, BASE_TIME + 2, BASE_TIME, 3)
+    scheduler.schedule(active)
+    scheduler.schedule(removed)
+    scheduler.schedule(retained)
+    scheduler.markStarted(active)
+
+    expect(
+      scheduler.removePendingTransactions([active.id, removed.id, `missing`]),
+    ).toEqual([removed.id, `missing`])
+
+    expect({
+      pending: scheduler.getAllPendingTransactions().map(({ id }) => id),
+      running: scheduler.getRunningCount(),
+    }).toEqual({ pending: [active.id, retained.id], running: 1 })
+    scheduler.markCompleted(active)
+    expect(scheduler.getNext()?.id).toBe(retained.id)
+  })
+})
diff --git a/packages/offline-transactions/tests/KeyScheduler-oracle.property.test.ts b/packages/offline-transactions/tests/KeyScheduler-oracle.property.test.ts
index 2507650f6b..98004b3f28 100644
--- a/packages/offline-transactions/tests/KeyScheduler-oracle.property.test.ts
+++ b/packages/offline-transactions/tests/KeyScheduler-oracle.property.test.ts
@@ -6,6 +6,8 @@ import {
   oracleReplayTest,
   oracleRuns,
 } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import { BASE_TIME, createTransaction } from './key-scheduler-support'
 import type { OfflineTransaction } from '../src/types'
 
 const FIFO_LEDGER_PROPERTY = `offline.key-scheduler-fifo-ledger`
@@ -61,7 +63,6 @@ type Snapshot = {
   runningCount: number
 }
 
-const BASE_TIME = Date.parse(`2026-01-01T00:00:00.000Z`)
 const FIXED_SEED = 1815
 const RUNS = oracleRuns(150)
 
@@ -280,26 +281,6 @@ const legalHistory = fc
   .array(commandToken, { minLength: 1, maxLength: 50 })
   .map(buildLegalHistory)
 
-function createTransaction(
-  id: string,
-  createdAt: number,
-  nextAttemptAt: number,
-  payload: number,
-): OfflineTransaction {
-  return {
-    id,
-    mutationFnName: `syncData`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `idempotency-${id}`,
-    createdAt: new Date(createdAt),
-    retryCount: 0,
-    nextAttemptAt,
-    metadata: { payload },
-    version: 1,
-  }
-}
-
 function cloneTransaction(transaction: OfflineTransaction): OfflineTransaction {
   return {
     ...transaction,
@@ -514,6 +495,8 @@ function runHistory(
   return coverage
 }
 
+declareOracle({ check: [runHistory], model: [expectedSnapshot] })
+
 describe(`KeyScheduler generated lifecycle`, () => {
   afterEach(() => vi.useRealTimers())
 
@@ -821,26 +804,4 @@ describe(`KeyScheduler generated lifecycle`, () => {
       }),
     ).toThrow()
   })
-
-  it(`selectively removes only unissued work`, () => {
-    const scheduler = new KeyScheduler()
-    const active = createTransaction(``, BASE_TIME, BASE_TIME, 1)
-    const removed = createTransaction(`removed`, BASE_TIME + 1, BASE_TIME, 2)
-    const retained = createTransaction(`retained`, BASE_TIME + 2, BASE_TIME, 3)
-    scheduler.schedule(active)
-    scheduler.schedule(removed)
-    scheduler.schedule(retained)
-    scheduler.markStarted(active)
-
-    expect(
-      scheduler.removePendingTransactions([active.id, removed.id, `missing`]),
-    ).toEqual([removed.id, `missing`])
-
-    expect({
-      pending: scheduler.getAllPendingTransactions().map(({ id }) => id),
-      running: scheduler.getRunningCount(),
-    }).toEqual({ pending: [active.id, retained.id], running: 1 })
-    scheduler.markCompleted(active)
-    expect(scheduler.getNext()?.id).toBe(retained.id)
-  })
 })
diff --git a/packages/offline-transactions/tests/connectivity-replay-oracle.test.ts b/packages/offline-transactions/tests/connectivity-replay-oracle.test.ts
index 6fb3a49164..9de67b52d6 100644
--- a/packages/offline-transactions/tests/connectivity-replay-oracle.test.ts
+++ b/packages/offline-transactions/tests/connectivity-replay-oracle.test.ts
@@ -1,5 +1,6 @@
 import { expect, it, vi } from 'vitest'
 import { NonRetriableError } from '../src/types'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { FakeStorageAdapter, createTestOfflineEnvironment } from './harness'
 import { atOracleCheckpoint, cleanupOfflineOracle } from './oracle-lifecycle'
 
@@ -39,6 +40,8 @@ function expectedAt(phase: `hidden` | `visible`): {
     : { providerCalls: 1, outboxEntries: 0, callerState: `fulfilled` }
 }
 
+declareOracle({ model: [expectedAt] })
+
 it.each([`visibilitychange`, `explicit retry`] as const)(
   `replays a committed outbox write on %s in a visible tab with a false online hint`,
   async (signal) => {
diff --git a/packages/offline-transactions/tests/harness.ts b/packages/offline-transactions/tests/harness.ts
index 8b0855c1e1..d6e9b9a552 100644
--- a/packages/offline-transactions/tests/harness.ts
+++ b/packages/offline-transactions/tests/harness.ts
@@ -280,3 +280,15 @@ function requireTestItem(value: unknown, mutationKey: string): TestItem {
   }
   return value
 }
+
+/** A promise that a test resolves to release one controlled step. */
+export function gate() {
+  let resolve!: () => void
+  const promise = new Promise<void>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+/** Yields one macrotask, after the microtasks that the step queued. */
+export const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
diff --git a/packages/offline-transactions/tests/interruption-settlement-oracle.property.test.ts b/packages/offline-transactions/tests/interruption-settlement-oracle.property.test.ts
index 6322911209..a0f465a79d 100644
--- a/packages/offline-transactions/tests/interruption-settlement-oracle.property.test.ts
+++ b/packages/offline-transactions/tests/interruption-settlement-oracle.property.test.ts
@@ -5,6 +5,7 @@ import {
   oraclePropertyOptions,
   oracleReplayTest,
 } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { FakeStorageAdapter, createTestOfflineEnvironment } from './harness'
 import {
   atOracleCheckpoint,
@@ -310,6 +311,8 @@ async function checkInterruption({
   }
 }
 
+declareOracle({ check: [checkInterruption] })
+
 /**
  * Fixed histories designed to reach each interruption landing deterministically.
  * Each named history specifies: a specific turn, outcomes, and transaction count
diff --git a/packages/offline-transactions/tests/key-scheduler-support.ts b/packages/offline-transactions/tests/key-scheduler-support.ts
new file mode 100644
index 0000000000..03f220e7ff
--- /dev/null
+++ b/packages/offline-transactions/tests/key-scheduler-support.ts
@@ -0,0 +1,25 @@
+// Fixtures shared by the KeyScheduler oracle and its ordinary unit tests in
+// KeyScheduler-lifecycle.test.ts. They build transactions and a fixed clock.
+import type { OfflineTransaction } from '../src/types'
+
+export const BASE_TIME = Date.parse(`2026-01-01T00:00:00.000Z`)
+
+export function createTransaction(
+  id: string,
+  createdAt: number,
+  nextAttemptAt: number,
+  payload: number,
+): OfflineTransaction {
+  return {
+    id,
+    mutationFnName: `syncData`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `idempotency-${id}`,
+    createdAt: new Date(createdAt),
+    retryCount: 0,
+    nextAttemptAt,
+    metadata: { payload },
+    version: 1,
+  }
+}
diff --git a/packages/offline-transactions/tests/leadership-replay-oracle.property.test.ts b/packages/offline-transactions/tests/leadership-replay-oracle.property.test.ts
index 50195ae882..813ece021f 100644
--- a/packages/offline-transactions/tests/leadership-replay-oracle.property.test.ts
+++ b/packages/offline-transactions/tests/leadership-replay-oracle.property.test.ts
@@ -4,14 +4,18 @@ import { expect, it, vi } from 'vitest'
 import { OutboxManager } from '../src/outbox/OutboxManager'
 import { OfflineExecutor } from '../src/OfflineExecutor'
 import { TransactionExecutor } from '../src/executor/TransactionExecutor'
-import { KeyScheduler } from '../src/executor/KeyScheduler'
-import { NonRetriableError } from '../src/types'
 import { oracleReplayTest } from '../../db/tests/oracle-config'
-import { FakeStorageAdapter, createTestOfflineEnvironment } from './harness'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import {
+  FakeStorageAdapter,
+  createTestOfflineEnvironment,
+  gate,
+  turn,
+} from './harness'
+import { storedTransaction } from './leadership-replay-support'
 import { atOracleCheckpoint, cleanupOfflineOracle } from './oracle-lifecycle'
 import { oracleLaneOptions, readOfflineOracleConfig } from './oracle-config'
-import type { OfflineTransaction, OnlineDetector } from '../src/types'
-import type { TestItem } from './harness'
+import type { OfflineTransaction } from '../src/types'
 
 /**
  * # May leadership replay an offline transaction more than once, or report
@@ -69,28 +73,6 @@ import type { TestItem } from './harness'
  * storage engine. Exactly-once network execution across independent leaders is
  * not promised. Provider side effects after an issued call remain provider-owned.
  */
-function gate() {
-  let resolve!: () => void
-  const promise = new Promise<void>((done) => {
-    resolve = done
-  })
-  return { promise, resolve }
-}
-
-const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
-
-const storedTransaction = (id: string): OfflineTransaction => ({
-  id,
-  mutationFnName: `syncData`,
-  mutations: [],
-  keys: [],
-  idempotencyKey: `${id}/once`,
-  createdAt: new Date(0),
-  retryCount: 0,
-  nextAttemptAt: 0,
-  version: 1,
-})
-
 type ReplayLedgerEvent =
   | { type: `stored`; id: string }
   | { type: `read-captured`; ids: Array<string> }
@@ -179,993 +161,9 @@ const storageFailureOracle = readOfflineOracleConfig({
   defaultRuns: 10,
 })
 
-it(`removes an earlier deletion-pending row before replaying an equal-time peer`, async () => {
-  // The README promises creation-order FIFO and deletion before success. This
-  // fixed offline executor restart history uses storage insertion order to
-  // distinguish creation when both persisted timestamps are equal. The
-  // independent expected trace first removes the earlier completed-provider row,
-  // then executes and removes its later peer. It covers this storage boundary,
-  // not ordering across independent storage writers or a native browser host.
-  const earlier: OfflineTransaction = {
-    ...storedTransaction(`earlier`),
-    outboxPhase: `deletion-pending`,
-  }
-  const later = storedTransaction(`later`)
-  const events: Array<string> = []
-  const hookInputs: Array<Array<string>> = []
-  class Storage extends FakeStorageAdapter {
-    override async delete(key: string): Promise<void> {
-      events.push(`delete:${key.slice(3)}`)
-      await super.delete(key)
-    }
-  }
-  const outbox = new OutboxManager(new Storage(), {})
-  await outbox.add(earlier)
-  await outbox.add(later)
-  const executor = new TransactionExecutor(
-    new KeyScheduler(),
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: async ({ transaction }) => {
-          events.push(`provider:${transaction.id}`)
-        },
-      },
-      beforeRetry: (transactions) => {
-        hookInputs.push(transactions.map(({ id }) => id))
-        return transactions
-      },
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => true,
-      resolveTransaction: () => {},
-      rejectTransaction: () => {},
-      registerRestorationTransaction: () => {},
-    },
-  )
-
-  let hasPrimaryFailure = false
-  try {
-    expect((await outbox.getAll()).map(({ id }) => id)).toEqual([
-      earlier.id,
-      later.id,
-    ])
-    await atOracleCheckpoint(
-      executor.loadPendingTransactions(),
-      `equal-time outbox replay loaded`,
-    )
-    await atOracleCheckpoint(
-      executor.executeAll(),
-      `equal-time outbox replay drained`,
-    )
-
-    expect({ hookInputs, events, remaining: await outbox.count() }).toEqual({
-      hookInputs: [[later.id]],
-      events: [
-        `delete:${earlier.id}`,
-        `provider:${later.id}`,
-        `delete:${later.id}`,
-      ],
-      remaining: 0,
-    })
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    await cleanupOfflineOracle([() => executor.clear()], hasPrimaryFailure)
-  }
-})
-
-// The model is a safety relation over public settlement and external effects:
-// fulfillment requires an admitted outbox record or a provider call. The
-// before-call history selects the online-only path; the onMutate history has
-// already selected the offline path. Loss before admission rejects and rolls
-// back that selected offline transaction.
-it.each([
-  { history: `retains leadership`, loss: `never`, providerCalls: 1 },
-  {
-    history: `loses leadership before invocation`,
-    loss: `before-call`,
-    providerCalls: 1,
-  },
-  {
-    history: `loses leadership during onMutate`,
-    loss: `on-mutate`,
-    providerCalls: 0,
-  },
-  {
-    history: `loses leadership just after onMutate`,
-    loss: `after-on-mutate`,
-    providerCalls: 0,
-  },
-] as const)(
-  `never fulfills an unadmitted action when it $history`,
-  async ({ loss, providerCalls }) => {
-    const stored = gate()
-    const releaseWrite = gate()
-    class Storage extends FakeStorageAdapter {
-      override async set(key: string, value: string) {
-        await super.set(key, value)
-        if (key.startsWith(`tx:`)) {
-          stored.resolve()
-          // Keep the stored record visible before admission starts provider work.
-          if (loss === `never`) await releaseWrite.promise
-        }
-      }
-    }
-    const env = createTestOfflineEnvironment({ storage: new Storage() })
-    const row: TestItem = {
-      id: `admission-row`,
-      value: `Buy milk`,
-      completed: false,
-      updatedAt: new Date(1700000000000),
-    }
-    const outcome: {
-      status: `pending` | `fulfilled` | `rejected`
-      error?: unknown
-    } = {
-      status: `pending`,
-    }
-    let observed: Promise<void> | undefined
-    let transactionId: string | undefined
-    let hasPrimaryFailure = false
-    try {
-      await env.waitForLeader()
-      const action = env.executor.createOfflineAction({
-        mutationFnName: env.mutationFnName,
-        onMutate: (item: TestItem) => {
-          env.collection.insert(item)
-          if (loss === `on-mutate`) env.leader.setLeader(false)
-          if (loss === `after-on-mutate`)
-            queueMicrotask(() => env.leader.setLeader(false))
-        },
-      })
-      if (loss === `before-call`) env.leader.setLeader(false)
-      const transaction = action(row)
-      transactionId = transaction.id
-      const settled = transaction.isPersisted.promise.then(
-        () => {
-          outcome.status = `fulfilled`
-        },
-        (error: unknown) => {
-          outcome.status = `rejected`
-          outcome.error = error
-        },
-      )
-      observed = settled
-
-      // Public settlement or a stored record lets us inspect this attempt.
-      // The provider call may follow the stored record.
-      await atOracleCheckpoint(
-        Promise.race([settled, stored.promise]),
-        `action settled or stored`,
-      )
-      const durable = await env.executor.peekOutbox()
-      // Fulfillment without either effect violates the admission law.
-      expect([
-        outcome.status,
-        durable.length,
-        env.mutationCalls.length,
-      ]).not.toEqual([`fulfilled`, 0, 0])
-      if (loss === `on-mutate` || loss === `after-on-mutate`) {
-        expect(env.executor.isOfflineEnabled).toBe(false)
-        expect(outcome.status).toBe(`rejected`)
-        expect(outcome.error).toBeInstanceOf(NonRetriableError)
-        expect(durable).toEqual([])
-        expect(env.collection.get(row.id)).toBeUndefined()
-      } else {
-        if (loss === `never`) {
-          expect(outcome.status).toBe(`pending`)
-          expect(durable).toHaveLength(1)
-          expect(env.mutationCalls).toHaveLength(0)
-          releaseWrite.resolve()
-        }
-        await atOracleCheckpoint(observed, `admitted action settled`)
-        expect(outcome.status).toBe(`fulfilled`)
-        expect(env.collection.get(row.id)).toMatchObject(row)
-      }
-      expect(env.mutationCalls).toHaveLength(providerCalls)
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseWrite.resolve()
-      if (outcome.status === `pending` && transactionId) {
-        env.executor.rejectTransaction(
-          transactionId,
-          new NonRetriableError(`oracle cleanup`),
-        )
-      }
-      await cleanupOfflineOracle(
-        [
-          () => observed,
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
-
-it(`rejects a selected manual offline transaction that loses leadership before admission`, async () => {
-  const env = createTestOfflineEnvironment()
-  const row: TestItem = {
-    id: `manual-admission-row`,
-    value: `Buy milk`,
-    completed: false,
-    updatedAt: new Date(1700000000000),
-  }
-  let transactionId: string | undefined
-  let commitObserved: Promise<unknown> | undefined
-  let persistedObserved: Promise<unknown> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const offline = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    const transaction = offline.mutate(() => env.collection.insert(row))
-    transactionId = transaction.id
-    persistedObserved = transaction.isPersisted.promise.then(
-      () => `fulfilled`,
-      (error: unknown) => error,
-    )
-
-    env.leader.setLeader(false)
-    commitObserved = offline.commit().then(
-      () => `fulfilled`,
-      (error: unknown) => error,
-    )
-    const [commitResult, persistedResult] = await atOracleCheckpoint(
-      Promise.all([commitObserved, persistedObserved]),
-      `manual action rejected before admission`,
-    )
-    expect(commitResult).toBeInstanceOf(NonRetriableError)
-    expect(persistedResult).toBe(commitResult)
-    expect(env.collection.get(row.id)).toBeUndefined()
-    expect(await env.executor.peekOutbox()).toEqual([])
-    expect(env.mutationCalls).toEqual([])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    if (transactionId)
-      env.executor.rejectTransaction(
-        transactionId,
-        new NonRetriableError(`oracle cleanup`),
-      )
-    await cleanupOfflineOracle(
-      [
-        () => commitObserved,
-        () => persistedObserved,
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it(`revokes only replay work excluded by the retry hook`, async () => {
-  // The hook classifies one captured replay snapshot. Reconciliation may
-  // revoke IDs from that snapshot, but must preserve work admitted later.
-  const captured = gate()
-  const delivery = gate()
-  let hold = false
-  let scans = 0
-  class Storage extends FakeStorageAdapter {
-    override async keys() {
-      scans++
-      return super.keys()
-    }
-
-    override async get(key: string) {
-      const value = await super.get(key)
-      if (hold && key === `tx:filtered`) {
-        captured.resolve()
-        await delivery.promise
-      }
-      return value
-    }
-  }
-
-  const filtered = storedTransaction(`filtered`)
-  const retained = {
-    ...storedTransaction(`retained`),
-    createdAt: new Date(1),
-  }
-  const admitted = {
-    ...storedTransaction(`admitted`),
-    createdAt: new Date(2),
-  }
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  await outbox.add(filtered)
-  await outbox.add(retained)
-
-  const hookInputs: Array<Array<string>> = []
-  const calls: Array<string> = []
-  let filterReplay = false
-  let online = false
-  const scheduler = new KeyScheduler()
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: async ({ transaction }) => {
-          calls.push(transaction.id)
-        },
-      },
-      beforeRetry: (transactions) => {
-        hookInputs.push(transactions.map(({ id }) => id))
-        return filterReplay
-          ? transactions.filter(({ id }) => id !== filtered.id)
-          : transactions
-      },
-      jitter: false,
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => online,
-      resolveTransaction: () => {},
-      rejectTransaction: () => {},
-      registerRestorationTransaction: () => {},
-    },
-  )
-
-  try {
-    await executor.loadPendingTransactions()
-    expect(scheduler.getAllPendingTransactions().map(({ id }) => id)).toEqual([
-      filtered.id,
-      retained.id,
-    ])
-
-    filterReplay = true
-    hold = true
-    const loading = executor.loadPendingTransactions()
-    await atOracleCheckpoint(captured.promise, `retry scan captured filtered`)
-    await outbox.add(admitted)
-    await executor.execute(admitted)
-    hold = false
-    delivery.resolve()
-    await atOracleCheckpoint(loading, `filtered retry scan delivered`)
-
-    const queued = scheduler.getAllPendingTransactions().map(({ id }) => id)
-    const durable = (await outbox.getAll()).map(({ id }) => id)
-    online = true
-    await atOracleCheckpoint(executor.executeAll(), `retained work drained`)
-
-    expect({ queued, durable, calls, hookInputs, scans }).toEqual({
-      queued: [retained.id, admitted.id],
-      durable: [retained.id, admitted.id],
-      calls: [retained.id, admitted.id],
-      hookInputs: [
-        [filtered.id, retained.id],
-        [filtered.id, retained.id],
-      ],
-      scans: 3,
-    })
-  } finally {
-    hold = false
-    delivery.resolve()
-    executor.clear()
-  }
-})
-
-it(`settles replay work discarded by the retry hook`, async () => {
-  const persisted = gate()
-  const removed = gate()
-  class Storage extends FakeStorageAdapter {
-    override async set(key: string, value: string) {
-      await super.set(key, value)
-      persisted.resolve()
-    }
-
-    override async delete(key: string) {
-      await super.delete(key)
-      removed.resolve()
-    }
-  }
-  const onlineDetector: OnlineDetector = {
-    subscribe: () => () => {},
-    notifyOnline: () => {},
-    isOnline: () => false,
-    dispose: () => {},
-  }
-  let discardReplay = false
-  const storage = new Storage()
-  const env = createTestOfflineEnvironment({
-    storage,
-    config: {
-      onlineDetector,
-      beforeRetry: (transactions) => (discardReplay ? [] : transactions),
-    },
-  })
-  let commitStatus: unknown = `pending`
-  let waitStatus: unknown = `pending`
-  let commitObserved: Promise<void> | undefined
-  let waitObserved: Promise<void> | undefined
-  let transactionId = ``
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const transaction = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    transactionId = transaction.id
-    waitObserved = env.executor
-      .waitForTransactionCompletion(transaction.id)
-      .then(
-        () => {
-          waitStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          waitStatus = error
-        },
-      )
-    transaction.mutate(() => {
-      env.collection.insert({
-        id: `discarded`,
-        value: `optimistic`,
-        completed: false,
-        updatedAt: new Date(0),
-      })
-    })
-    commitObserved = transaction.commit().then(
-      () => {
-        commitStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        commitStatus = error
-      },
-    )
-    await atOracleCheckpoint(persisted.promise, `discarded work persisted`)
-    expect(env.collection.get(`discarded`)).toMatchObject({
-      value: `optimistic`,
-    })
-
-    env.leader.setLeader(false)
-    discardReplay = true
-    env.leader.setLeader(true)
-    await atOracleCheckpoint(removed.promise, `discarded work removed`)
-    await turn()
-
-    expect(commitStatus).toBeInstanceOf(NonRetriableError)
-    expect(waitStatus).toBe(commitStatus)
-    expect(env.collection.get(`discarded`)).toBeUndefined()
-    expect(storage.snapshot()).not.toHaveProperty(`tx:${transaction.id}`)
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    if (commitStatus === `pending` && transactionId)
-      env.executor.rejectTransaction(
-        transactionId,
-        new NonRetriableError(`oracle cleanup`),
-      )
-    await cleanupOfflineOracle(
-      [
-        () => Promise.all([commitObserved, waitObserved]),
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it.each([0, 1])(
-  `settles each discarded replay after its durable removal succeeds when deletion %i fails`,
-  async (failedIndex) => {
-    const successfulIndex = 1 - failedIndex
-    const persisted = gate()
-    const removing = gate()
-    const releaseRemoval = gate()
-    const removed = gate()
-    const failed = gate()
-    const retried = gate()
-    const storageError = new Error(`discard removal failed`)
-    let writes = 0
-    let failedKey = ``
-    let failRemoval = false
-    let failedOnce = false
-    class Storage extends FakeStorageAdapter {
-      override async set(key: string, value: string) {
-        await super.set(key, value)
-        if (++writes === 2) persisted.resolve()
-      }
-
-      override async delete(key: string) {
-        if (failRemoval && key !== failedKey) {
-          removing.resolve()
-          await releaseRemoval.promise
-        }
-        if (failRemoval && key === failedKey && !failedOnce) {
-          failedOnce = true
-          failed.resolve()
-          throw storageError
-        }
-        await super.delete(key)
-        if (key === failedKey) retried.resolve()
-        else removed.resolve()
-      }
-    }
-    const onlineDetector: OnlineDetector = {
-      subscribe: () => () => {},
-      notifyOnline: () => {},
-      isOnline: () => false,
-      dispose: () => {},
-    }
-    let discardReplay = false
-    const storage = new Storage()
-    const env = createTestOfflineEnvironment({
-      storage,
-      config: {
-        onlineDetector,
-        beforeRetry: (transactions) => (discardReplay ? [] : transactions),
-      },
-    })
-    const ids: Array<string> = []
-    const commitStatuses: Array<unknown> = [`pending`, `pending`]
-    const waitStatuses: Array<unknown> = [`pending`, `pending`]
-    const commitObserved: Array<Promise<void>> = []
-    const waitObserved: Array<Promise<void>> = []
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let hasPrimaryFailure = false
-    try {
-      await env.waitForLeader()
-      for (let index = 0; index < 2; index++) {
-        const transaction = env.executor.createOfflineTransaction({
-          mutationFnName: env.mutationFnName,
-          autoCommit: false,
-        })
-        ids.push(transaction.id)
-        waitObserved.push(
-          env.executor.waitForTransactionCompletion(transaction.id).then(
-            () => {
-              waitStatuses[index] = `fulfilled`
-            },
-            (error: unknown) => {
-              waitStatuses[index] = error
-            },
-          ),
-        )
-        transaction.mutate(() => {
-          env.collection.insert({
-            id: `discarded-${index}`,
-            value: `optimistic-${index}`,
-            completed: false,
-            updatedAt: new Date(index),
-          })
-        })
-        commitObserved.push(
-          transaction.commit().then(
-            () => {
-              commitStatuses[index] = `fulfilled`
-            },
-            (error: unknown) => {
-              commitStatuses[index] = error
-            },
-          ),
-        )
-      }
-      await atOracleCheckpoint(persisted.promise, `discarded work persisted`)
-
-      env.leader.setLeader(false)
-      discardReplay = true
-      failedKey = `tx:${ids[failedIndex]}`
-      failRemoval = true
-      env.leader.setLeader(true)
-      await atOracleCheckpoint(
-        Promise.all([removing.promise, failed.promise]),
-        `mixed discard removals started`,
-      )
-      await turn()
-
-      expect(commitStatuses).toEqual([`pending`, `pending`])
-      expect(waitStatuses).toEqual([`pending`, `pending`])
-      expect(warning).toHaveBeenCalledWith(
-        `Failed to remove transaction excluded by beforeRetry:`,
-        ids[failedIndex],
-        storageError,
-      )
-      expect(env.executor.getPendingCount()).toBe(0)
-      expect(storage.snapshot()).toHaveProperty(`tx:${ids[0]}`)
-      expect(storage.snapshot()).toHaveProperty(failedKey)
-      expect(env.collection.get(`discarded-0`)?.value).toBe(`optimistic-0`)
-      expect(env.collection.get(`discarded-1`)?.value).toBe(`optimistic-1`)
-      expect(env.mutationCalls).toHaveLength(0)
-
-      releaseRemoval.resolve()
-      await atOracleCheckpoint(removed.promise, `successful discard removed`)
-      await turn()
-
-      expect(commitStatuses[successfulIndex]).toBeInstanceOf(NonRetriableError)
-      expect(waitStatuses[successfulIndex]).toBe(
-        commitStatuses[successfulIndex],
-      )
-      expect(commitStatuses[failedIndex]).toBe(`pending`)
-      expect(waitStatuses[failedIndex]).toBe(`pending`)
-      expect({
-        queued: env.executor.getPendingCount(),
-        durable: Object.keys(storage.snapshot()),
-        optimistic: [
-          env.collection.get(`discarded-${successfulIndex}`),
-          env.collection.get(`discarded-${failedIndex}`)?.value,
-        ],
-        calls: env.mutationCalls.length,
-      }).toEqual({
-        queued: 0,
-        durable: [failedKey],
-        optimistic: [undefined, `optimistic-${failedIndex}`],
-        calls: 0,
-      })
-
-      env.leader.setLeader(false)
-      env.leader.setLeader(true)
-      await atOracleCheckpoint(retried.promise, `failed discard retried`)
-      await turn()
-
-      expect(commitStatuses[failedIndex]).toBeInstanceOf(NonRetriableError)
-      expect(waitStatuses[failedIndex]).toBe(commitStatuses[failedIndex])
-      expect({
-        queued: env.executor.getPendingCount(),
-        durable: storage.snapshot(),
-        optimistic: env.collection.get(`discarded-${failedIndex}`),
-        calls: env.mutationCalls.length,
-      }).toEqual({ queued: 0, durable: {}, optimistic: undefined, calls: 0 })
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseRemoval.resolve()
-      for (let index = 0; index < ids.length; index++)
-        if (commitStatuses[index] === `pending`)
-          env.executor.rejectTransaction(
-            ids[index]!,
-            new NonRetriableError(`oracle cleanup`),
-          )
-      await cleanupOfflineOracle(
-        [
-          () => Promise.all([...commitObserved, ...waitObserved]),
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-      warning.mockRestore()
-    }
-  },
-)
-
-it(`keeps retry timers live when a retry record update fails`, async () => {
-  vi.useFakeTimers()
-  vi.setSystemTime(0)
-  const storageError = new Error(`retry update failed`)
-  class Storage extends FakeStorageAdapter {
-    private failed = false
-
-    override async set(key: string, value: string) {
-      if (!this.failed && JSON.parse(value).retryCount > 0) {
-        this.failed = true
-        throw storageError
-      }
-      await super.set(key, value)
-    }
-  }
-  const transaction = storedTransaction(`retry-after-update-failure`)
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  await outbox.add(transaction)
-  const scheduler = new KeyScheduler()
-  const calls: Array<string> = []
-  const completed: Array<string> = []
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: async ({ transaction: current }) => {
-          calls.push(current.id)
-          if (calls.length === 1) throw new Error(`provider unavailable`)
-        },
-      },
-      jitter: false,
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => true,
-      resolveTransaction: (id) => completed.push(id),
-      rejectTransaction: () => {},
-      registerRestorationTransaction: () => {},
-    },
-  )
-
-  try {
-    await expect(executor.execute(transaction)).rejects.toBe(storageError)
-    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
-      calls: [transaction.id],
-      completed: [],
-      pending: 1,
-    })
-
-    await vi.advanceTimersByTimeAsync(1000)
-    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
-      calls: [transaction.id, transaction.id],
-      completed: [transaction.id],
-      pending: 0,
-    })
-    expect(await outbox.get(transaction.id)).toBeNull()
-  } finally {
-    executor.clear()
-    vi.useRealTimers()
-  }
-})
-
-it(`stops later work when terminal outbox removal fails`, async () => {
-  vi.useFakeTimers()
-  vi.setSystemTime(0)
-  const storageError = new Error(`permanent removal failed`)
-  class Storage extends FakeStorageAdapter {
-    private failed = false
-
-    override async delete(key: string) {
-      if (!this.failed && key === `tx:permanent`) {
-        this.failed = true
-        throw storageError
-      }
-      await super.delete(key)
-    }
-  }
-  const permanent = storedTransaction(`permanent`)
-  const later = { ...storedTransaction(`later`), createdAt: new Date(1) }
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  await outbox.add(permanent)
-  await outbox.add(later)
-  const scheduler = new KeyScheduler()
-  scheduler.schedule(permanent)
-  scheduler.schedule(later)
-  const calls: Array<string> = []
-  const completed: Array<string> = []
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: async ({ transaction }) => {
-          calls.push(transaction.id)
-          if (transaction.id === permanent.id)
-            throw new NonRetriableError(`permanent`)
-        },
-      },
-      jitter: false,
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => true,
-      resolveTransaction: (id) => completed.push(id),
-      rejectTransaction: () => {},
-      registerRestorationTransaction: () => {},
-    },
-  )
-
-  try {
-    await expect(executor.executeAll()).rejects.toBe(storageError)
-    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
-      calls: [permanent.id],
-      completed: [],
-      pending: 2,
-    })
-
-    await vi.advanceTimersByTimeAsync(60_000)
-    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
-      calls: [permanent.id],
-      completed: [],
-      pending: 2,
-    })
-    expect((await outbox.get(permanent.id))?.outboxPhase).toBe(
-      `rejection-pending`,
-    )
-    expect(await outbox.get(later.id)).toEqual(later)
-  } finally {
-    executor.clear()
-    vi.useRealTimers()
-  }
-})
-
-it(`keeps issued work durable when a replay hook excludes it`, async () => {
-  const entered = gate()
-  const release = gate()
-  const retryRead = gate()
-  const retryWrite = gate()
-  let holdRetryUpdate = false
-  class Storage extends FakeStorageAdapter {
-    override async get(key: string) {
-      const value = await super.get(key)
-      if (holdRetryUpdate && key === `tx:active`) {
-        holdRetryUpdate = false
-        retryRead.resolve()
-        await retryWrite.promise
-      }
-      return value
-    }
-  }
-  const active = storedTransaction(`active`)
-  const filtered = {
-    ...storedTransaction(`filtered`),
-    createdAt: new Date(1),
-  }
-  const retained = {
-    ...storedTransaction(`retained`),
-    createdAt: new Date(2),
-  }
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  await Promise.all(
-    [active, filtered, retained].map((transaction) => outbox.add(transaction)),
-  )
-  const scheduler = new KeyScheduler()
-  let online = true
-  for (const transaction of [active, filtered, retained])
-    scheduler.schedule(transaction)
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: async () => {
-          entered.resolve()
-          await release.promise
-          holdRetryUpdate = true
-          throw new Error(`retry`)
-        },
-      },
-      beforeRetry: (transactions) =>
-        transactions.filter(({ id }) => id === retained.id),
-      jitter: false,
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => online,
-      resolveTransaction: () => {},
-      rejectTransaction: () => {},
-      registerRestorationTransaction: () => {},
-    },
-  )
-
-  let executing: Promise<void> | undefined
-  try {
-    executing = executor.executeAll()
-    await atOracleCheckpoint(entered.promise, `issued work entered provider`)
-    await executor.loadPendingTransactions()
-
-    expect({
-      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
-      durable: (await outbox.getAll()).map(({ id }) => id),
-      running: scheduler.getRunningCount(),
-    }).toEqual({
-      queued: [active.id, retained.id],
-      durable: [active.id, retained.id],
-      running: 1,
-    })
-
-    release.resolve()
-    await atOracleCheckpoint(retryRead.promise, `retry persistence read issued`)
-    await executor.loadPendingTransactions()
-    expect({
-      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
-      durable: (await outbox.getAll()).map(({ id }) => id),
-      running: scheduler.getRunningCount(),
-    }).toEqual({
-      queued: [active.id, retained.id],
-      durable: [active.id, retained.id],
-      running: 1,
-    })
-
-    online = false
-    retryWrite.resolve()
-    await atOracleCheckpoint(executing, `issued work scheduled its retry`)
-    expect({
-      active: await outbox.get(active.id),
-      filtered: await outbox.get(filtered.id),
-      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
-      running: scheduler.getRunningCount(),
-    }).toMatchObject({
-      active: { id: active.id, retryCount: 1 },
-      filtered: null,
-      queued: [active.id, retained.id],
-      running: 0,
-    })
-  } finally {
-    online = false
-    release.resolve()
-    retryWrite.resolve()
-    await executing?.catch(() => undefined)
-    executor.clear()
-  }
-})
-
-it(`keeps permanently failed work owned until durable deletion settles`, async () => {
-  const deleting = gate()
-  const deleteRelease = gate()
-  class Storage extends FakeStorageAdapter {
-    override async delete(key: string) {
-      if (key === `tx:active`) {
-        deleting.resolve()
-        await deleteRelease.promise
-      }
-      return super.delete(key)
-    }
-  }
-  const active = storedTransaction(`active`)
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  await outbox.add(active)
-  const scheduler = new KeyScheduler()
-  scheduler.schedule(active)
-  const calls: Array<string> = []
-  let online = true
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: async ({ transaction }) => {
-          calls.push(transaction.id)
-          throw new NonRetriableError(`permanent`)
-        },
-      },
-      jitter: false,
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => online,
-      resolveTransaction: () => {},
-      rejectTransaction: () => {},
-      registerRestorationTransaction: () => {},
-    },
-  )
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  let executing: Promise<void> | undefined
-
-  try {
-    executing = executor.executeAll()
-    await atOracleCheckpoint(deleting.promise, `durable rejection started`)
-    await executor.loadPendingTransactions()
-    expect({
-      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
-      durable: (await outbox.getAll()).map(({ id }) => id),
-      running: scheduler.getRunningCount(),
-    }).toEqual({ queued: [active.id], durable: [active.id], running: 1 })
-
-    online = false
-    deleteRelease.resolve()
-    await atOracleCheckpoint(executing, `durable rejection settled`)
-    expect({
-      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
-      durable: (await outbox.getAll()).map(({ id }) => id),
-      calls,
-    }).toEqual({ queued: [], durable: [], calls: [active.id] })
-  } finally {
-    online = false
-    deleteRelease.resolve()
-    await executing?.catch(() => undefined)
-    executor.clear()
-    warning.mockRestore()
-  }
-})
+// The stale-read campaign compares each delivered read with the ledger fold,
+// the model. The append-only judgment pins the fold's own result.
+declareOracle({ check: [checkStaleRead], model: [foldReplayLedger] })
 
 const startupCases = (seed: number | undefined) =>
   [`construction`, `leadership`, `outbox read`, `retry hook`].map(
@@ -1702,73 +700,6 @@ oracleReplayTest(it, REPORT_PROPERTY).each(reportCases(undefined))(
   checkReport,
 )
 
-it(`does not readmit a permanently rejected row from a stale outbox read`, async () => {
-  // Law: once durable removal and rejection complete, an older read cannot
-  // schedule that ID or restore its optimistic state.
-  const captured = gate()
-  const delivery = gate()
-  let hold = true
-  let capturedOnce = false
-  class Storage extends FakeStorageAdapter {
-    override async get(key: string) {
-      const value = await super.get(key)
-      if (hold && !capturedOnce && key === `tx:rejected`) {
-        capturedOnce = true
-        captured.resolve()
-        await delivery.promise
-      }
-      return value
-    }
-  }
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  const rejected = storedTransaction(`rejected`)
-  await outbox.add(rejected)
-  const scheduler = new KeyScheduler()
-  let online = false
-  let observedRejection: Error | undefined
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        syncData: () => Promise.reject(new NonRetriableError(`permanent`)),
-      },
-      jitter: false,
-    },
-    {
-      isOfflineEnabled: true,
-      isOnline: () => online,
-      resolveTransaction: () => {},
-      rejectTransaction: (_id, error) => {
-        observedRejection = error
-      },
-      registerRestorationTransaction: () => {},
-    },
-  )
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  try {
-    const loading = executor.loadPendingTransactions()
-    await atOracleCheckpoint(captured.promise, `stale read captured row`)
-    online = true
-    await executor.execute(rejected)
-    online = false
-    expect(observedRejection).toBeInstanceOf(NonRetriableError)
-    expect(await outbox.get(rejected.id)).toBeNull()
-    hold = false
-    delivery.resolve()
-    await atOracleCheckpoint(loading, `stale read delivered`)
-
-    expect(scheduler.getAllPendingTransactions()).toEqual([])
-  } finally {
-    hold = false
-    delivery.resolve()
-    executor.clear()
-    warning.mockRestore()
-  }
-})
-
 // The fixed lane stands aside during any path replay. The random lane runs in
 // ordinary and seed-only runs, and it is the replay of STALE_READ_PROPERTY.
 async function checkStaleRead(seed: number | undefined): Promise<void> {
@@ -1875,122 +806,6 @@ it(`append-only replay judgment rejects stale admission after durable removal`,
   expect(expected.staleCapture).not.toEqual(expected.unfinished)
 })
 
-it.each([`remove`, `removeMany`, `clear`] as const)(
-  `filters %s from an outbox read already in flight`,
-  async (operation) => {
-    const captured = gate()
-    const delivery = gate()
-    let hold = true
-    class Storage extends FakeStorageAdapter {
-      override async get(key: string) {
-        const value = await super.get(key)
-        if (hold && key === `tx:removed`) {
-          captured.resolve()
-          await delivery.promise
-        }
-        return value
-      }
-    }
-    const outbox = new OutboxManager(new Storage(), {})
-    const removed = storedTransaction(`removed`)
-    await outbox.add(removed)
-    try {
-      const reading = outbox.getAll()
-      await atOracleCheckpoint(captured.promise, `outbox read captured row`)
-      if (operation === `remove`) await outbox.remove(removed.id)
-      else if (operation === `removeMany`) await outbox.removeMany([removed.id])
-      else await outbox.clear()
-      hold = false
-      delivery.resolve()
-
-      await expect(
-        atOracleCheckpoint(reading, `outbox read delivered`),
-      ).resolves.toEqual([])
-    } finally {
-      hold = false
-      delivery.resolve()
-    }
-  },
-)
-
-it.each([1, 4])(
-  `loads once while %s concurrent acknowledgments finish`,
-  async (acknowledgments) => {
-    // Work law: one replay request performs one outbox scan. Concurrent
-    // removals filter that scan's result instead of restarting O(N) reads.
-    const captured = gate()
-    const delivery = gate()
-    let hold = true
-    let scans = 0
-    class Storage extends FakeStorageAdapter {
-      override async keys() {
-        scans++
-        return super.keys()
-      }
-      override async get(key: string) {
-        const value = await super.get(key)
-        if (hold && key === `tx:peer`) {
-          captured.resolve()
-          await delivery.promise
-        }
-        return value
-      }
-    }
-    const storage = new Storage()
-    const outbox = new OutboxManager(storage, {})
-    const peer = storedTransaction(`peer`)
-    await outbox.add(peer)
-    const scheduler = new KeyScheduler()
-    let online = false
-    const completed: Array<string> = []
-    const executor = new TransactionExecutor(
-      scheduler,
-      outbox,
-      {
-        collections: {},
-        mutationFns: { syncData: async () => {} },
-        jitter: false,
-      },
-      {
-        isOfflineEnabled: true,
-        isOnline: () => online,
-        resolveTransaction: (id) => completed.push(id),
-        rejectTransaction: () => {},
-        registerRestorationTransaction: () => {},
-      },
-    )
-    try {
-      const loading = executor.loadPendingTransactions()
-      await atOracleCheckpoint(captured.promise, `replay scan captured peer`)
-      online = true
-      for (let index = 0; index < acknowledgments; index++) {
-        const active = storedTransaction(`active-${index}`)
-        await outbox.add(active)
-        await executor.execute(active)
-      }
-      online = false
-      hold = false
-      delivery.resolve()
-      await atOracleCheckpoint(loading, `replay scan delivered`)
-
-      expect(completed).toEqual(
-        Array.from(
-          { length: acknowledgments },
-          (_, index) => `active-${index}`,
-        ),
-      )
-      expect(scans).toBe(1)
-      expect(scheduler.getAllPendingTransactions().map(({ id }) => id)).toEqual(
-        [peer.id],
-      )
-    } finally {
-      hold = false
-      delivery.resolve()
-      executor.clear()
-    }
-  },
-)
-
 // A replay scan can capture A, then block on another storage read until A's
 // successful deletion. Pending-only dedupe no longer remembers A at admission.
 // Peers admitted only through this scan must still execute exactly once.
@@ -2238,122 +1053,3 @@ oracleReplayTest(it, STORAGE_FAILURE_PROPERTY).each(
   `rejects initialization when storage $operation fails without losing records (seed $seed)`,
   checkStorageFailure,
 )
-
-it(`keeps startup replay available when discarded-work cleanup fails`, async () => {
-  const discarded = storedTransaction(`discarded-at-startup`)
-  const retained = {
-    ...storedTransaction(`retained-at-startup`),
-    createdAt: new Date(1),
-  }
-  const cleanupError = new Error(`discarded cleanup unavailable`)
-  class Storage extends FakeStorageAdapter {
-    override async delete(key: string): Promise<void> {
-      if (key === `tx:${discarded.id}`) throw cleanupError
-      await super.delete(key)
-    }
-  }
-  const storage = new Storage()
-  const outbox = new OutboxManager(storage, {})
-  await outbox.add(discarded)
-  await outbox.add(retained)
-  const replayed = gate()
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  const env = createTestOfflineEnvironment({
-    storage,
-    mutationFn: ({ transaction }) => {
-      if (transaction.id === retained.id) replayed.resolve()
-    },
-    config: {
-      beforeRetry: (transactions) =>
-        transactions.filter(({ id }) => id !== discarded.id),
-    },
-  })
-  let hasPrimaryFailure = false
-  try {
-    await expect(
-      atOracleCheckpoint(
-        env.executor.waitForInit(),
-        `startup replay admitted despite discarded cleanup failure`,
-      ),
-    ).resolves.toBeUndefined()
-    await atOracleCheckpoint(replayed.promise, `retained startup work replayed`)
-    await turn()
-
-    expect(env.mutationCalls.map(({ transaction }) => transaction.id)).toEqual([
-      retained.id,
-    ])
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      discarded.id,
-    ])
-    expect(warning).toHaveBeenCalledWith(
-      `Failed to remove transaction excluded by beforeRetry:`,
-      discarded.id,
-      cleanupError,
-    )
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    await cleanupOfflineOracle(
-      [
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-        () => warning.mockRestore(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it.each([false, true])(
-  `fences each successful clear deletion while a peer is pending or fails, failure=%s`,
-  async (failure) => {
-    const captured = gate(),
-      delivery = gate(),
-      removed = gate(),
-      release = gate()
-    let hold = true
-    class Storage extends FakeStorageAdapter {
-      override async get(key: string) {
-        const value = await super.get(key)
-        if (hold && key === `tx:removed`) {
-          captured.resolve()
-          await delivery.promise
-        }
-        return value
-      }
-      override async delete(key: string) {
-        if (key === `tx:peer`) {
-          await release.promise
-          if (failure) throw new Error(`storage deletion failed`)
-        }
-        await super.delete(key)
-        if (key === `tx:removed`) removed.resolve()
-      }
-    }
-    const outbox = new OutboxManager(new Storage(), {})
-    await outbox.add(storedTransaction(`removed`))
-    await outbox.add(storedTransaction(`peer`))
-    const reading = outbox.getAll()
-    await atOracleCheckpoint(captured.promise, `read captured removed row`)
-    const clearing = outbox.clear().then(
-      () => undefined,
-      (error: unknown) => error,
-    )
-    try {
-      await atOracleCheckpoint(removed.promise, `first deletion finished`)
-      if (failure) {
-        release.resolve()
-        expect(await clearing).toBeInstanceOf(Error)
-      }
-      hold = false
-      delivery.resolve()
-      expect((await reading).map(({ id }) => id)).toEqual([`peer`])
-    } finally {
-      hold = false
-      delivery.resolve()
-      release.resolve()
-      await clearing
-    }
-  },
-)
diff --git a/packages/offline-transactions/tests/leadership-replay-support.ts b/packages/offline-transactions/tests/leadership-replay-support.ts
new file mode 100644
index 0000000000..01934d93a6
--- /dev/null
+++ b/packages/offline-transactions/tests/leadership-replay-support.ts
@@ -0,0 +1,16 @@
+// Shared fixtures for the leadership replay tests: the stored offline
+// transaction record. The laws are owned by
+// leadership-replay-oracle.property.test.ts.
+import type { OfflineTransaction } from '../src/types'
+
+export const storedTransaction = (id: string): OfflineTransaction => ({
+  id,
+  mutationFnName: `syncData`,
+  mutations: [],
+  keys: [],
+  idempotencyKey: `${id}/once`,
+  createdAt: new Date(0),
+  retryCount: 0,
+  nextAttemptAt: 0,
+  version: 1,
+})
diff --git a/packages/offline-transactions/tests/leadership-replay.test.ts b/packages/offline-transactions/tests/leadership-replay.test.ts
new file mode 100644
index 0000000000..d126b02b66
--- /dev/null
+++ b/packages/offline-transactions/tests/leadership-replay.test.ts
@@ -0,0 +1,1309 @@
+// Leadership replay cases whose expectations are written by hand: a fixed
+// outbox restart, pinned admission and retry-hook histories, stale reads,
+// and failed deletions. The leadership and replay laws they illustrate are
+// owned by leadership-replay-oracle.property.test.ts.
+import { expect, it, vi } from 'vitest'
+import { OutboxManager } from '../src/outbox/OutboxManager'
+import { TransactionExecutor } from '../src/executor/TransactionExecutor'
+import { KeyScheduler } from '../src/executor/KeyScheduler'
+import { NonRetriableError } from '../src/types'
+import {
+  FakeStorageAdapter,
+  createTestOfflineEnvironment,
+  gate,
+  turn,
+} from './harness'
+import { atOracleCheckpoint, cleanupOfflineOracle } from './oracle-lifecycle'
+import { storedTransaction } from './leadership-replay-support'
+import type { OfflineTransaction, OnlineDetector } from '../src/types'
+import type { TestItem } from './harness'
+
+it(`removes an earlier deletion-pending row before replaying an equal-time peer`, async () => {
+  // The README promises creation-order FIFO and deletion before success. This
+  // fixed offline executor restart history uses storage insertion order to
+  // distinguish creation when both persisted timestamps are equal. The
+  // independent expected trace first removes the earlier completed-provider row,
+  // then executes and removes its later peer. It covers this storage boundary,
+  // not ordering across independent storage writers or a native browser host.
+  const earlier: OfflineTransaction = {
+    ...storedTransaction(`earlier`),
+    outboxPhase: `deletion-pending`,
+  }
+  const later = storedTransaction(`later`)
+  const events: Array<string> = []
+  const hookInputs: Array<Array<string>> = []
+  class Storage extends FakeStorageAdapter {
+    override async delete(key: string): Promise<void> {
+      events.push(`delete:${key.slice(3)}`)
+      await super.delete(key)
+    }
+  }
+  const outbox = new OutboxManager(new Storage(), {})
+  await outbox.add(earlier)
+  await outbox.add(later)
+  const executor = new TransactionExecutor(
+    new KeyScheduler(),
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: async ({ transaction }) => {
+          events.push(`provider:${transaction.id}`)
+        },
+      },
+      beforeRetry: (transactions) => {
+        hookInputs.push(transactions.map(({ id }) => id))
+        return transactions
+      },
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => true,
+      resolveTransaction: () => {},
+      rejectTransaction: () => {},
+      registerRestorationTransaction: () => {},
+    },
+  )
+
+  let hasPrimaryFailure = false
+  try {
+    expect((await outbox.getAll()).map(({ id }) => id)).toEqual([
+      earlier.id,
+      later.id,
+    ])
+    await atOracleCheckpoint(
+      executor.loadPendingTransactions(),
+      `equal-time outbox replay loaded`,
+    )
+    await atOracleCheckpoint(
+      executor.executeAll(),
+      `equal-time outbox replay drained`,
+    )
+
+    expect({ hookInputs, events, remaining: await outbox.count() }).toEqual({
+      hookInputs: [[later.id]],
+      events: [
+        `delete:${earlier.id}`,
+        `provider:${later.id}`,
+        `delete:${later.id}`,
+      ],
+      remaining: 0,
+    })
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupOfflineOracle([() => executor.clear()], hasPrimaryFailure)
+  }
+})
+
+// The model is a safety relation over public settlement and external effects:
+// fulfillment requires an admitted outbox record or a provider call. The
+// before-call history selects the online-only path; the onMutate history has
+// already selected the offline path. Loss before admission rejects and rolls
+// back that selected offline transaction.
+it.each([
+  { history: `retains leadership`, loss: `never`, providerCalls: 1 },
+  {
+    history: `loses leadership before invocation`,
+    loss: `before-call`,
+    providerCalls: 1,
+  },
+  {
+    history: `loses leadership during onMutate`,
+    loss: `on-mutate`,
+    providerCalls: 0,
+  },
+  {
+    history: `loses leadership just after onMutate`,
+    loss: `after-on-mutate`,
+    providerCalls: 0,
+  },
+] as const)(
+  `never fulfills an unadmitted action when it $history`,
+  async ({ loss, providerCalls }) => {
+    const stored = gate()
+    const releaseWrite = gate()
+    class Storage extends FakeStorageAdapter {
+      override async set(key: string, value: string) {
+        await super.set(key, value)
+        if (key.startsWith(`tx:`)) {
+          stored.resolve()
+          // Keep the stored record visible before admission starts provider work.
+          if (loss === `never`) await releaseWrite.promise
+        }
+      }
+    }
+    const env = createTestOfflineEnvironment({ storage: new Storage() })
+    const row: TestItem = {
+      id: `admission-row`,
+      value: `Buy milk`,
+      completed: false,
+      updatedAt: new Date(1700000000000),
+    }
+    const outcome: {
+      status: `pending` | `fulfilled` | `rejected`
+      error?: unknown
+    } = {
+      status: `pending`,
+    }
+    let observed: Promise<void> | undefined
+    let transactionId: string | undefined
+    let hasPrimaryFailure = false
+    try {
+      await env.waitForLeader()
+      const action = env.executor.createOfflineAction({
+        mutationFnName: env.mutationFnName,
+        onMutate: (item: TestItem) => {
+          env.collection.insert(item)
+          if (loss === `on-mutate`) env.leader.setLeader(false)
+          if (loss === `after-on-mutate`)
+            queueMicrotask(() => env.leader.setLeader(false))
+        },
+      })
+      if (loss === `before-call`) env.leader.setLeader(false)
+      const transaction = action(row)
+      transactionId = transaction.id
+      const settled = transaction.isPersisted.promise.then(
+        () => {
+          outcome.status = `fulfilled`
+        },
+        (error: unknown) => {
+          outcome.status = `rejected`
+          outcome.error = error
+        },
+      )
+      observed = settled
+
+      // Public settlement or a stored record lets us inspect this attempt.
+      // The provider call may follow the stored record.
+      await atOracleCheckpoint(
+        Promise.race([settled, stored.promise]),
+        `action settled or stored`,
+      )
+      const durable = await env.executor.peekOutbox()
+      // Fulfillment without either effect violates the admission law.
+      expect([
+        outcome.status,
+        durable.length,
+        env.mutationCalls.length,
+      ]).not.toEqual([`fulfilled`, 0, 0])
+      if (loss === `on-mutate` || loss === `after-on-mutate`) {
+        expect(env.executor.isOfflineEnabled).toBe(false)
+        expect(outcome.status).toBe(`rejected`)
+        expect(outcome.error).toBeInstanceOf(NonRetriableError)
+        expect(durable).toEqual([])
+        expect(env.collection.get(row.id)).toBeUndefined()
+      } else {
+        if (loss === `never`) {
+          expect(outcome.status).toBe(`pending`)
+          expect(durable).toHaveLength(1)
+          expect(env.mutationCalls).toHaveLength(0)
+          releaseWrite.resolve()
+        }
+        await atOracleCheckpoint(observed, `admitted action settled`)
+        expect(outcome.status).toBe(`fulfilled`)
+        expect(env.collection.get(row.id)).toMatchObject(row)
+      }
+      expect(env.mutationCalls).toHaveLength(providerCalls)
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseWrite.resolve()
+      if (outcome.status === `pending` && transactionId) {
+        env.executor.rejectTransaction(
+          transactionId,
+          new NonRetriableError(`oracle cleanup`),
+        )
+      }
+      await cleanupOfflineOracle(
+        [
+          () => observed,
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+it(`rejects a selected manual offline transaction that loses leadership before admission`, async () => {
+  const env = createTestOfflineEnvironment()
+  const row: TestItem = {
+    id: `manual-admission-row`,
+    value: `Buy milk`,
+    completed: false,
+    updatedAt: new Date(1700000000000),
+  }
+  let transactionId: string | undefined
+  let commitObserved: Promise<unknown> | undefined
+  let persistedObserved: Promise<unknown> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const offline = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    const transaction = offline.mutate(() => env.collection.insert(row))
+    transactionId = transaction.id
+    persistedObserved = transaction.isPersisted.promise.then(
+      () => `fulfilled`,
+      (error: unknown) => error,
+    )
+
+    env.leader.setLeader(false)
+    commitObserved = offline.commit().then(
+      () => `fulfilled`,
+      (error: unknown) => error,
+    )
+    const [commitResult, persistedResult] = await atOracleCheckpoint(
+      Promise.all([commitObserved, persistedObserved]),
+      `manual action rejected before admission`,
+    )
+    expect(commitResult).toBeInstanceOf(NonRetriableError)
+    expect(persistedResult).toBe(commitResult)
+    expect(env.collection.get(row.id)).toBeUndefined()
+    expect(await env.executor.peekOutbox()).toEqual([])
+    expect(env.mutationCalls).toEqual([])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    if (transactionId)
+      env.executor.rejectTransaction(
+        transactionId,
+        new NonRetriableError(`oracle cleanup`),
+      )
+    await cleanupOfflineOracle(
+      [
+        () => commitObserved,
+        () => persistedObserved,
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it(`revokes only replay work excluded by the retry hook`, async () => {
+  // The hook classifies one captured replay snapshot. Reconciliation may
+  // revoke IDs from that snapshot, but must preserve work admitted later.
+  const captured = gate()
+  const delivery = gate()
+  let hold = false
+  let scans = 0
+  class Storage extends FakeStorageAdapter {
+    override async keys() {
+      scans++
+      return super.keys()
+    }
+
+    override async get(key: string) {
+      const value = await super.get(key)
+      if (hold && key === `tx:filtered`) {
+        captured.resolve()
+        await delivery.promise
+      }
+      return value
+    }
+  }
+
+  const filtered = storedTransaction(`filtered`)
+  const retained = {
+    ...storedTransaction(`retained`),
+    createdAt: new Date(1),
+  }
+  const admitted = {
+    ...storedTransaction(`admitted`),
+    createdAt: new Date(2),
+  }
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  await outbox.add(filtered)
+  await outbox.add(retained)
+
+  const hookInputs: Array<Array<string>> = []
+  const calls: Array<string> = []
+  let filterReplay = false
+  let online = false
+  const scheduler = new KeyScheduler()
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: async ({ transaction }) => {
+          calls.push(transaction.id)
+        },
+      },
+      beforeRetry: (transactions) => {
+        hookInputs.push(transactions.map(({ id }) => id))
+        return filterReplay
+          ? transactions.filter(({ id }) => id !== filtered.id)
+          : transactions
+      },
+      jitter: false,
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => online,
+      resolveTransaction: () => {},
+      rejectTransaction: () => {},
+      registerRestorationTransaction: () => {},
+    },
+  )
+
+  try {
+    await executor.loadPendingTransactions()
+    expect(scheduler.getAllPendingTransactions().map(({ id }) => id)).toEqual([
+      filtered.id,
+      retained.id,
+    ])
+
+    filterReplay = true
+    hold = true
+    const loading = executor.loadPendingTransactions()
+    await atOracleCheckpoint(captured.promise, `retry scan captured filtered`)
+    await outbox.add(admitted)
+    await executor.execute(admitted)
+    hold = false
+    delivery.resolve()
+    await atOracleCheckpoint(loading, `filtered retry scan delivered`)
+
+    const queued = scheduler.getAllPendingTransactions().map(({ id }) => id)
+    const durable = (await outbox.getAll()).map(({ id }) => id)
+    online = true
+    await atOracleCheckpoint(executor.executeAll(), `retained work drained`)
+
+    expect({ queued, durable, calls, hookInputs, scans }).toEqual({
+      queued: [retained.id, admitted.id],
+      durable: [retained.id, admitted.id],
+      calls: [retained.id, admitted.id],
+      hookInputs: [
+        [filtered.id, retained.id],
+        [filtered.id, retained.id],
+      ],
+      scans: 3,
+    })
+  } finally {
+    hold = false
+    delivery.resolve()
+    executor.clear()
+  }
+})
+
+it(`settles replay work discarded by the retry hook`, async () => {
+  const persisted = gate()
+  const removed = gate()
+  class Storage extends FakeStorageAdapter {
+    override async set(key: string, value: string) {
+      await super.set(key, value)
+      persisted.resolve()
+    }
+
+    override async delete(key: string) {
+      await super.delete(key)
+      removed.resolve()
+    }
+  }
+  const onlineDetector: OnlineDetector = {
+    subscribe: () => () => {},
+    notifyOnline: () => {},
+    isOnline: () => false,
+    dispose: () => {},
+  }
+  let discardReplay = false
+  const storage = new Storage()
+  const env = createTestOfflineEnvironment({
+    storage,
+    config: {
+      onlineDetector,
+      beforeRetry: (transactions) => (discardReplay ? [] : transactions),
+    },
+  })
+  let commitStatus: unknown = `pending`
+  let waitStatus: unknown = `pending`
+  let commitObserved: Promise<void> | undefined
+  let waitObserved: Promise<void> | undefined
+  let transactionId = ``
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const transaction = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    transactionId = transaction.id
+    waitObserved = env.executor
+      .waitForTransactionCompletion(transaction.id)
+      .then(
+        () => {
+          waitStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          waitStatus = error
+        },
+      )
+    transaction.mutate(() => {
+      env.collection.insert({
+        id: `discarded`,
+        value: `optimistic`,
+        completed: false,
+        updatedAt: new Date(0),
+      })
+    })
+    commitObserved = transaction.commit().then(
+      () => {
+        commitStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        commitStatus = error
+      },
+    )
+    await atOracleCheckpoint(persisted.promise, `discarded work persisted`)
+    expect(env.collection.get(`discarded`)).toMatchObject({
+      value: `optimistic`,
+    })
+
+    env.leader.setLeader(false)
+    discardReplay = true
+    env.leader.setLeader(true)
+    await atOracleCheckpoint(removed.promise, `discarded work removed`)
+    await turn()
+
+    expect(commitStatus).toBeInstanceOf(NonRetriableError)
+    expect(waitStatus).toBe(commitStatus)
+    expect(env.collection.get(`discarded`)).toBeUndefined()
+    expect(storage.snapshot()).not.toHaveProperty(`tx:${transaction.id}`)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    if (commitStatus === `pending` && transactionId)
+      env.executor.rejectTransaction(
+        transactionId,
+        new NonRetriableError(`oracle cleanup`),
+      )
+    await cleanupOfflineOracle(
+      [
+        () => Promise.all([commitObserved, waitObserved]),
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it.each([0, 1])(
+  `settles each discarded replay after its durable removal succeeds when deletion %i fails`,
+  async (failedIndex) => {
+    const successfulIndex = 1 - failedIndex
+    const persisted = gate()
+    const removing = gate()
+    const releaseRemoval = gate()
+    const removed = gate()
+    const failed = gate()
+    const retried = gate()
+    const storageError = new Error(`discard removal failed`)
+    let writes = 0
+    let failedKey = ``
+    let failRemoval = false
+    let failedOnce = false
+    class Storage extends FakeStorageAdapter {
+      override async set(key: string, value: string) {
+        await super.set(key, value)
+        if (++writes === 2) persisted.resolve()
+      }
+
+      override async delete(key: string) {
+        if (failRemoval && key !== failedKey) {
+          removing.resolve()
+          await releaseRemoval.promise
+        }
+        if (failRemoval && key === failedKey && !failedOnce) {
+          failedOnce = true
+          failed.resolve()
+          throw storageError
+        }
+        await super.delete(key)
+        if (key === failedKey) retried.resolve()
+        else removed.resolve()
+      }
+    }
+    const onlineDetector: OnlineDetector = {
+      subscribe: () => () => {},
+      notifyOnline: () => {},
+      isOnline: () => false,
+      dispose: () => {},
+    }
+    let discardReplay = false
+    const storage = new Storage()
+    const env = createTestOfflineEnvironment({
+      storage,
+      config: {
+        onlineDetector,
+        beforeRetry: (transactions) => (discardReplay ? [] : transactions),
+      },
+    })
+    const ids: Array<string> = []
+    const commitStatuses: Array<unknown> = [`pending`, `pending`]
+    const waitStatuses: Array<unknown> = [`pending`, `pending`]
+    const commitObserved: Array<Promise<void>> = []
+    const waitObserved: Array<Promise<void>> = []
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let hasPrimaryFailure = false
+    try {
+      await env.waitForLeader()
+      for (let index = 0; index < 2; index++) {
+        const transaction = env.executor.createOfflineTransaction({
+          mutationFnName: env.mutationFnName,
+          autoCommit: false,
+        })
+        ids.push(transaction.id)
+        waitObserved.push(
+          env.executor.waitForTransactionCompletion(transaction.id).then(
+            () => {
+              waitStatuses[index] = `fulfilled`
+            },
+            (error: unknown) => {
+              waitStatuses[index] = error
+            },
+          ),
+        )
+        transaction.mutate(() => {
+          env.collection.insert({
+            id: `discarded-${index}`,
+            value: `optimistic-${index}`,
+            completed: false,
+            updatedAt: new Date(index),
+          })
+        })
+        commitObserved.push(
+          transaction.commit().then(
+            () => {
+              commitStatuses[index] = `fulfilled`
+            },
+            (error: unknown) => {
+              commitStatuses[index] = error
+            },
+          ),
+        )
+      }
+      await atOracleCheckpoint(persisted.promise, `discarded work persisted`)
+
+      env.leader.setLeader(false)
+      discardReplay = true
+      failedKey = `tx:${ids[failedIndex]}`
+      failRemoval = true
+      env.leader.setLeader(true)
+      await atOracleCheckpoint(
+        Promise.all([removing.promise, failed.promise]),
+        `mixed discard removals started`,
+      )
+      await turn()
+
+      expect(commitStatuses).toEqual([`pending`, `pending`])
+      expect(waitStatuses).toEqual([`pending`, `pending`])
+      expect(warning).toHaveBeenCalledWith(
+        `Failed to remove transaction excluded by beforeRetry:`,
+        ids[failedIndex],
+        storageError,
+      )
+      expect(env.executor.getPendingCount()).toBe(0)
+      expect(storage.snapshot()).toHaveProperty(`tx:${ids[0]}`)
+      expect(storage.snapshot()).toHaveProperty(failedKey)
+      expect(env.collection.get(`discarded-0`)?.value).toBe(`optimistic-0`)
+      expect(env.collection.get(`discarded-1`)?.value).toBe(`optimistic-1`)
+      expect(env.mutationCalls).toHaveLength(0)
+
+      releaseRemoval.resolve()
+      await atOracleCheckpoint(removed.promise, `successful discard removed`)
+      await turn()
+
+      expect(commitStatuses[successfulIndex]).toBeInstanceOf(NonRetriableError)
+      expect(waitStatuses[successfulIndex]).toBe(
+        commitStatuses[successfulIndex],
+      )
+      expect(commitStatuses[failedIndex]).toBe(`pending`)
+      expect(waitStatuses[failedIndex]).toBe(`pending`)
+      expect({
+        queued: env.executor.getPendingCount(),
+        durable: Object.keys(storage.snapshot()),
+        optimistic: [
+          env.collection.get(`discarded-${successfulIndex}`),
+          env.collection.get(`discarded-${failedIndex}`)?.value,
+        ],
+        calls: env.mutationCalls.length,
+      }).toEqual({
+        queued: 0,
+        durable: [failedKey],
+        optimistic: [undefined, `optimistic-${failedIndex}`],
+        calls: 0,
+      })
+
+      env.leader.setLeader(false)
+      env.leader.setLeader(true)
+      await atOracleCheckpoint(retried.promise, `failed discard retried`)
+      await turn()
+
+      expect(commitStatuses[failedIndex]).toBeInstanceOf(NonRetriableError)
+      expect(waitStatuses[failedIndex]).toBe(commitStatuses[failedIndex])
+      expect({
+        queued: env.executor.getPendingCount(),
+        durable: storage.snapshot(),
+        optimistic: env.collection.get(`discarded-${failedIndex}`),
+        calls: env.mutationCalls.length,
+      }).toEqual({ queued: 0, durable: {}, optimistic: undefined, calls: 0 })
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseRemoval.resolve()
+      for (let index = 0; index < ids.length; index++)
+        if (commitStatuses[index] === `pending`)
+          env.executor.rejectTransaction(
+            ids[index]!,
+            new NonRetriableError(`oracle cleanup`),
+          )
+      await cleanupOfflineOracle(
+        [
+          () => Promise.all([...commitObserved, ...waitObserved]),
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+      warning.mockRestore()
+    }
+  },
+)
+
+it(`keeps retry timers live when a retry record update fails`, async () => {
+  vi.useFakeTimers()
+  vi.setSystemTime(0)
+  const storageError = new Error(`retry update failed`)
+  class Storage extends FakeStorageAdapter {
+    private failed = false
+
+    override async set(key: string, value: string) {
+      if (!this.failed && JSON.parse(value).retryCount > 0) {
+        this.failed = true
+        throw storageError
+      }
+      await super.set(key, value)
+    }
+  }
+  const transaction = storedTransaction(`retry-after-update-failure`)
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  await outbox.add(transaction)
+  const scheduler = new KeyScheduler()
+  const calls: Array<string> = []
+  const completed: Array<string> = []
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: async ({ transaction: current }) => {
+          calls.push(current.id)
+          if (calls.length === 1) throw new Error(`provider unavailable`)
+        },
+      },
+      jitter: false,
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => true,
+      resolveTransaction: (id) => completed.push(id),
+      rejectTransaction: () => {},
+      registerRestorationTransaction: () => {},
+    },
+  )
+
+  try {
+    await expect(executor.execute(transaction)).rejects.toBe(storageError)
+    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
+      calls: [transaction.id],
+      completed: [],
+      pending: 1,
+    })
+
+    await vi.advanceTimersByTimeAsync(1000)
+    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
+      calls: [transaction.id, transaction.id],
+      completed: [transaction.id],
+      pending: 0,
+    })
+    expect(await outbox.get(transaction.id)).toBeNull()
+  } finally {
+    executor.clear()
+    vi.useRealTimers()
+  }
+})
+
+it(`stops later work when terminal outbox removal fails`, async () => {
+  vi.useFakeTimers()
+  vi.setSystemTime(0)
+  const storageError = new Error(`permanent removal failed`)
+  class Storage extends FakeStorageAdapter {
+    private failed = false
+
+    override async delete(key: string) {
+      if (!this.failed && key === `tx:permanent`) {
+        this.failed = true
+        throw storageError
+      }
+      await super.delete(key)
+    }
+  }
+  const permanent = storedTransaction(`permanent`)
+  const later = { ...storedTransaction(`later`), createdAt: new Date(1) }
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  await outbox.add(permanent)
+  await outbox.add(later)
+  const scheduler = new KeyScheduler()
+  scheduler.schedule(permanent)
+  scheduler.schedule(later)
+  const calls: Array<string> = []
+  const completed: Array<string> = []
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: async ({ transaction }) => {
+          calls.push(transaction.id)
+          if (transaction.id === permanent.id)
+            throw new NonRetriableError(`permanent`)
+        },
+      },
+      jitter: false,
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => true,
+      resolveTransaction: (id) => completed.push(id),
+      rejectTransaction: () => {},
+      registerRestorationTransaction: () => {},
+    },
+  )
+
+  try {
+    await expect(executor.executeAll()).rejects.toBe(storageError)
+    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
+      calls: [permanent.id],
+      completed: [],
+      pending: 2,
+    })
+
+    await vi.advanceTimersByTimeAsync(60_000)
+    expect({ calls, completed, pending: executor.getPendingCount() }).toEqual({
+      calls: [permanent.id],
+      completed: [],
+      pending: 2,
+    })
+    expect((await outbox.get(permanent.id))?.outboxPhase).toBe(
+      `rejection-pending`,
+    )
+    expect(await outbox.get(later.id)).toEqual(later)
+  } finally {
+    executor.clear()
+    vi.useRealTimers()
+  }
+})
+
+it(`keeps issued work durable when a replay hook excludes it`, async () => {
+  const entered = gate()
+  const release = gate()
+  const retryRead = gate()
+  const retryWrite = gate()
+  let holdRetryUpdate = false
+  class Storage extends FakeStorageAdapter {
+    override async get(key: string) {
+      const value = await super.get(key)
+      if (holdRetryUpdate && key === `tx:active`) {
+        holdRetryUpdate = false
+        retryRead.resolve()
+        await retryWrite.promise
+      }
+      return value
+    }
+  }
+  const active = storedTransaction(`active`)
+  const filtered = {
+    ...storedTransaction(`filtered`),
+    createdAt: new Date(1),
+  }
+  const retained = {
+    ...storedTransaction(`retained`),
+    createdAt: new Date(2),
+  }
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  await Promise.all(
+    [active, filtered, retained].map((transaction) => outbox.add(transaction)),
+  )
+  const scheduler = new KeyScheduler()
+  let online = true
+  for (const transaction of [active, filtered, retained])
+    scheduler.schedule(transaction)
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: async () => {
+          entered.resolve()
+          await release.promise
+          holdRetryUpdate = true
+          throw new Error(`retry`)
+        },
+      },
+      beforeRetry: (transactions) =>
+        transactions.filter(({ id }) => id === retained.id),
+      jitter: false,
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => online,
+      resolveTransaction: () => {},
+      rejectTransaction: () => {},
+      registerRestorationTransaction: () => {},
+    },
+  )
+
+  let executing: Promise<void> | undefined
+  try {
+    executing = executor.executeAll()
+    await atOracleCheckpoint(entered.promise, `issued work entered provider`)
+    await executor.loadPendingTransactions()
+
+    expect({
+      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
+      durable: (await outbox.getAll()).map(({ id }) => id),
+      running: scheduler.getRunningCount(),
+    }).toEqual({
+      queued: [active.id, retained.id],
+      durable: [active.id, retained.id],
+      running: 1,
+    })
+
+    release.resolve()
+    await atOracleCheckpoint(retryRead.promise, `retry persistence read issued`)
+    await executor.loadPendingTransactions()
+    expect({
+      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
+      durable: (await outbox.getAll()).map(({ id }) => id),
+      running: scheduler.getRunningCount(),
+    }).toEqual({
+      queued: [active.id, retained.id],
+      durable: [active.id, retained.id],
+      running: 1,
+    })
+
+    online = false
+    retryWrite.resolve()
+    await atOracleCheckpoint(executing, `issued work scheduled its retry`)
+    expect({
+      active: await outbox.get(active.id),
+      filtered: await outbox.get(filtered.id),
+      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
+      running: scheduler.getRunningCount(),
+    }).toMatchObject({
+      active: { id: active.id, retryCount: 1 },
+      filtered: null,
+      queued: [active.id, retained.id],
+      running: 0,
+    })
+  } finally {
+    online = false
+    release.resolve()
+    retryWrite.resolve()
+    await executing?.catch(() => undefined)
+    executor.clear()
+  }
+})
+
+it(`keeps permanently failed work owned until durable deletion settles`, async () => {
+  const deleting = gate()
+  const deleteRelease = gate()
+  class Storage extends FakeStorageAdapter {
+    override async delete(key: string) {
+      if (key === `tx:active`) {
+        deleting.resolve()
+        await deleteRelease.promise
+      }
+      return super.delete(key)
+    }
+  }
+  const active = storedTransaction(`active`)
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  await outbox.add(active)
+  const scheduler = new KeyScheduler()
+  scheduler.schedule(active)
+  const calls: Array<string> = []
+  let online = true
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: async ({ transaction }) => {
+          calls.push(transaction.id)
+          throw new NonRetriableError(`permanent`)
+        },
+      },
+      jitter: false,
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => online,
+      resolveTransaction: () => {},
+      rejectTransaction: () => {},
+      registerRestorationTransaction: () => {},
+    },
+  )
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  let executing: Promise<void> | undefined
+
+  try {
+    executing = executor.executeAll()
+    await atOracleCheckpoint(deleting.promise, `durable rejection started`)
+    await executor.loadPendingTransactions()
+    expect({
+      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
+      durable: (await outbox.getAll()).map(({ id }) => id),
+      running: scheduler.getRunningCount(),
+    }).toEqual({ queued: [active.id], durable: [active.id], running: 1 })
+
+    online = false
+    deleteRelease.resolve()
+    await atOracleCheckpoint(executing, `durable rejection settled`)
+    expect({
+      queued: scheduler.getAllPendingTransactions().map(({ id }) => id),
+      durable: (await outbox.getAll()).map(({ id }) => id),
+      calls,
+    }).toEqual({ queued: [], durable: [], calls: [active.id] })
+  } finally {
+    online = false
+    deleteRelease.resolve()
+    await executing?.catch(() => undefined)
+    executor.clear()
+    warning.mockRestore()
+  }
+})
+
+it(`does not readmit a permanently rejected row from a stale outbox read`, async () => {
+  // Law: once durable removal and rejection complete, an older read cannot
+  // schedule that ID or restore its optimistic state.
+  const captured = gate()
+  const delivery = gate()
+  let hold = true
+  let capturedOnce = false
+  class Storage extends FakeStorageAdapter {
+    override async get(key: string) {
+      const value = await super.get(key)
+      if (hold && !capturedOnce && key === `tx:rejected`) {
+        capturedOnce = true
+        captured.resolve()
+        await delivery.promise
+      }
+      return value
+    }
+  }
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  const rejected = storedTransaction(`rejected`)
+  await outbox.add(rejected)
+  const scheduler = new KeyScheduler()
+  let online = false
+  let observedRejection: Error | undefined
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: () => Promise.reject(new NonRetriableError(`permanent`)),
+      },
+      jitter: false,
+    },
+    {
+      isOfflineEnabled: true,
+      isOnline: () => online,
+      resolveTransaction: () => {},
+      rejectTransaction: (_id, error) => {
+        observedRejection = error
+      },
+      registerRestorationTransaction: () => {},
+    },
+  )
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  try {
+    const loading = executor.loadPendingTransactions()
+    await atOracleCheckpoint(captured.promise, `stale read captured row`)
+    online = true
+    await executor.execute(rejected)
+    online = false
+    expect(observedRejection).toBeInstanceOf(NonRetriableError)
+    expect(await outbox.get(rejected.id)).toBeNull()
+    hold = false
+    delivery.resolve()
+    await atOracleCheckpoint(loading, `stale read delivered`)
+
+    expect(scheduler.getAllPendingTransactions()).toEqual([])
+  } finally {
+    hold = false
+    delivery.resolve()
+    executor.clear()
+    warning.mockRestore()
+  }
+})
+
+it.each([`remove`, `removeMany`, `clear`] as const)(
+  `filters %s from an outbox read already in flight`,
+  async (operation) => {
+    const captured = gate()
+    const delivery = gate()
+    let hold = true
+    class Storage extends FakeStorageAdapter {
+      override async get(key: string) {
+        const value = await super.get(key)
+        if (hold && key === `tx:removed`) {
+          captured.resolve()
+          await delivery.promise
+        }
+        return value
+      }
+    }
+    const outbox = new OutboxManager(new Storage(), {})
+    const removed = storedTransaction(`removed`)
+    await outbox.add(removed)
+    try {
+      const reading = outbox.getAll()
+      await atOracleCheckpoint(captured.promise, `outbox read captured row`)
+      if (operation === `remove`) await outbox.remove(removed.id)
+      else if (operation === `removeMany`) await outbox.removeMany([removed.id])
+      else await outbox.clear()
+      hold = false
+      delivery.resolve()
+
+      await expect(
+        atOracleCheckpoint(reading, `outbox read delivered`),
+      ).resolves.toEqual([])
+    } finally {
+      hold = false
+      delivery.resolve()
+    }
+  },
+)
+
+it.each([1, 4])(
+  `loads once while %s concurrent acknowledgments finish`,
+  async (acknowledgments) => {
+    // Work law: one replay request performs one outbox scan. Concurrent
+    // removals filter that scan's result instead of restarting O(N) reads.
+    const captured = gate()
+    const delivery = gate()
+    let hold = true
+    let scans = 0
+    class Storage extends FakeStorageAdapter {
+      override async keys() {
+        scans++
+        return super.keys()
+      }
+      override async get(key: string) {
+        const value = await super.get(key)
+        if (hold && key === `tx:peer`) {
+          captured.resolve()
+          await delivery.promise
+        }
+        return value
+      }
+    }
+    const storage = new Storage()
+    const outbox = new OutboxManager(storage, {})
+    const peer = storedTransaction(`peer`)
+    await outbox.add(peer)
+    const scheduler = new KeyScheduler()
+    let online = false
+    const completed: Array<string> = []
+    const executor = new TransactionExecutor(
+      scheduler,
+      outbox,
+      {
+        collections: {},
+        mutationFns: { syncData: async () => {} },
+        jitter: false,
+      },
+      {
+        isOfflineEnabled: true,
+        isOnline: () => online,
+        resolveTransaction: (id) => completed.push(id),
+        rejectTransaction: () => {},
+        registerRestorationTransaction: () => {},
+      },
+    )
+    try {
+      const loading = executor.loadPendingTransactions()
+      await atOracleCheckpoint(captured.promise, `replay scan captured peer`)
+      online = true
+      for (let index = 0; index < acknowledgments; index++) {
+        const active = storedTransaction(`active-${index}`)
+        await outbox.add(active)
+        await executor.execute(active)
+      }
+      online = false
+      hold = false
+      delivery.resolve()
+      await atOracleCheckpoint(loading, `replay scan delivered`)
+
+      expect(completed).toEqual(
+        Array.from(
+          { length: acknowledgments },
+          (_, index) => `active-${index}`,
+        ),
+      )
+      expect(scans).toBe(1)
+      expect(scheduler.getAllPendingTransactions().map(({ id }) => id)).toEqual(
+        [peer.id],
+      )
+    } finally {
+      hold = false
+      delivery.resolve()
+      executor.clear()
+    }
+  },
+)
+
+it(`keeps startup replay available when discarded-work cleanup fails`, async () => {
+  const discarded = storedTransaction(`discarded-at-startup`)
+  const retained = {
+    ...storedTransaction(`retained-at-startup`),
+    createdAt: new Date(1),
+  }
+  const cleanupError = new Error(`discarded cleanup unavailable`)
+  class Storage extends FakeStorageAdapter {
+    override async delete(key: string): Promise<void> {
+      if (key === `tx:${discarded.id}`) throw cleanupError
+      await super.delete(key)
+    }
+  }
+  const storage = new Storage()
+  const outbox = new OutboxManager(storage, {})
+  await outbox.add(discarded)
+  await outbox.add(retained)
+  const replayed = gate()
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  const env = createTestOfflineEnvironment({
+    storage,
+    mutationFn: ({ transaction }) => {
+      if (transaction.id === retained.id) replayed.resolve()
+    },
+    config: {
+      beforeRetry: (transactions) =>
+        transactions.filter(({ id }) => id !== discarded.id),
+    },
+  })
+  let hasPrimaryFailure = false
+  try {
+    await expect(
+      atOracleCheckpoint(
+        env.executor.waitForInit(),
+        `startup replay admitted despite discarded cleanup failure`,
+      ),
+    ).resolves.toBeUndefined()
+    await atOracleCheckpoint(replayed.promise, `retained startup work replayed`)
+    await turn()
+
+    expect(env.mutationCalls.map(({ transaction }) => transaction.id)).toEqual([
+      retained.id,
+    ])
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      discarded.id,
+    ])
+    expect(warning).toHaveBeenCalledWith(
+      `Failed to remove transaction excluded by beforeRetry:`,
+      discarded.id,
+      cleanupError,
+    )
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupOfflineOracle(
+      [
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+        () => warning.mockRestore(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it.each([false, true])(
+  `fences each successful clear deletion while a peer is pending or fails, failure=%s`,
+  async (failure) => {
+    const captured = gate(),
+      delivery = gate(),
+      removed = gate(),
+      release = gate()
+    let hold = true
+    class Storage extends FakeStorageAdapter {
+      override async get(key: string) {
+        const value = await super.get(key)
+        if (hold && key === `tx:removed`) {
+          captured.resolve()
+          await delivery.promise
+        }
+        return value
+      }
+      override async delete(key: string) {
+        if (key === `tx:peer`) {
+          await release.promise
+          if (failure) throw new Error(`storage deletion failed`)
+        }
+        await super.delete(key)
+        if (key === `tx:removed`) removed.resolve()
+      }
+    }
+    const outbox = new OutboxManager(new Storage(), {})
+    await outbox.add(storedTransaction(`removed`))
+    await outbox.add(storedTransaction(`peer`))
+    const reading = outbox.getAll()
+    await atOracleCheckpoint(captured.promise, `read captured removed row`)
+    const clearing = outbox.clear().then(
+      () => undefined,
+      (error: unknown) => error,
+    )
+    try {
+      await atOracleCheckpoint(removed.promise, `first deletion finished`)
+      if (failure) {
+        release.resolve()
+        expect(await clearing).toBeInstanceOf(Error)
+      }
+      hold = false
+      delivery.resolve()
+      expect((await reading).map(({ id }) => id)).toEqual([`peer`])
+    } finally {
+      hold = false
+      delivery.resolve()
+      release.resolve()
+      await clearing
+    }
+  },
+)
diff --git a/packages/offline-transactions/tests/transaction-serializer-oracle.property.test.ts b/packages/offline-transactions/tests/transaction-serializer-oracle.property.test.ts
index 55800955b2..1ef3fa32c5 100644
--- a/packages/offline-transactions/tests/transaction-serializer-oracle.property.test.ts
+++ b/packages/offline-transactions/tests/transaction-serializer-oracle.property.test.ts
@@ -3,17 +3,14 @@ import { createCollection, createTransaction } from '@tanstack/db'
 import fc from 'fast-check'
 import { expect, it, vi } from 'vitest'
 import { OutboxManager } from '../src/outbox/OutboxManager'
-import {
-  MissingTemporalConstructorError,
-  TransactionSerializer,
-} from '../src/outbox/TransactionSerializer'
+import { TransactionSerializer } from '../src/outbox/TransactionSerializer'
 import { runOracleCampaign } from '../../db/tests/oracle-campaign'
 import { oracleReplayTest, oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { cleanupOfflineOracle } from './oracle-lifecycle'
 import { FakeStorageAdapter } from './harness'
 import { oracleLaneOptions, readOfflineOracleConfig } from './oracle-config'
 import type { OfflineTransaction } from '../src/types'
-import type { PendingMutation } from '@tanstack/db'
 
 /**
  * # Does an offline transaction survive durable serialization exactly?
@@ -27,9 +24,10 @@ import type { PendingMutation } from '@tanstack/db'
  * their prior meanings. Unsupported or malformed encodings fail visibly.
  *
  * Model: each generated Pair derives runtime and wire values from one semantic
- * leaf. It never walks production output or imports serializer helpers. Focused
- * metadata witnesses use JSON's toJSON, boxed-scalar, and array-index rules.
- * Mutation values deliberately retain the package's structural encoding rules.
+ * leaf. It never walks production output or imports serializer helpers. Mutation
+ * values deliberately retain the package's structural encoding rules. Focused
+ * single-case witnesses for metadata toJSON, boxed scalars, cycles, Temporal
+ * markers, and malformed wire are unit tests in transaction-serializer.test.ts.
  *
  * History grammar: insert, update, and delete edits span two collection registry
  * keys. Trees contain bounded arrays, objects, hostile keys, Date values, and
@@ -49,8 +47,8 @@ import type { PendingMutation } from '@tanstack/db'
  * Reach and controls: pinned histories force every edit kind and hostile marker.
  * Fixed and random lanes support seed/path replay. Encoder and decoder faults
  * inject Date/string confusion, wrong registry, omitted changes, and unknown
- * versions. Malformed markers and missing Temporal constructors test failure
- * paths before durable data can be replaced.
+ * versions. Malformed generated markers are rejected before durable data can
+ * be replaced; the single-case Temporal failure paths are unit tests.
  *
  * Limits for default v3: undefined, non-finite numbers, arbitrary native
  * objects, and cross-realm boxed values are outside that domain's evidence. Cycles must fail
@@ -380,596 +378,16 @@ async function checkRoundtrip(
   if (cleanupFailure !== undefined) throw cleanupFailure
 }
 
+// The check runs one history through production and compares every checkpoint
+// with the semantic model above. Generated properties, fixed histories, and the
+// fault calibrations all reach it.
+declareOracle({ check: [checkRoundtrip] })
+
 const twin: Pair = {
   runtime: `2024-01-01T00:00:00.000Z`,
   wire: `2024-01-01T00:00:00.000Z`,
 }
 
-const temporalCases = [
-  [`Duration`, `PT1H30M`],
-  [`Instant`, `2026-09-16T12:34:56Z`],
-  [`PlainDate`, `2026-09-16`],
-  [`PlainDateTime`, `2026-09-16T12:34:56`],
-  [`PlainMonthDay`, `09-16`],
-  [`PlainTime`, `12:34:56`],
-  [`PlainYearMonth`, `2026-09`],
-  [`ZonedDateTime`, `2026-09-16T12:34:56-06:00[America/Denver]`],
-] as const
-
-type TemporalName = (typeof temporalCases)[number][0]
-
-class TemporalStub {
-  readonly #name: TemporalName
-  readonly #value: string
-
-  constructor(name: TemporalName, value: string) {
-    this.#name = name
-    this.#value = value
-  }
-
-  get [Symbol.toStringTag](): `Temporal.${TemporalName}` {
-    return `Temporal.${this.#name}`
-  }
-
-  toString(): string {
-    return this.#value
-  }
-}
-
-function temporalStubConstructor(name: TemporalName) {
-  return class extends TemporalStub {
-    constructor(value: string) {
-      super(name, value)
-    }
-
-    static from(value: string): TemporalStub {
-      return new TemporalStub(name, value)
-    }
-  }
-}
-
-function metadataTransaction(
-  metadata: Record<string, unknown>,
-): OfflineTransaction {
-  return {
-    id: `metadata-json`,
-    mutationFnName: `persist`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `once`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    metadata,
-    version: 1,
-  }
-}
-
-it(`rejects cyclic metadata with a bounded JSON-style error`, () => {
-  const metadata: Record<string, unknown> = {}
-  metadata.self = metadata
-
-  expect(() =>
-    new TransactionSerializer({}).serialize(metadataTransaction(metadata)),
-  ).toThrowError(new TypeError(`Converting circular structure to JSON`))
-})
-
-it(`rejects cyclic mutation values with a bounded JSON-style error`, () => {
-  const collection = { id: `cycle-writer` } as any
-  const modified: Record<string, unknown> = { id: `one` }
-  modified.self = modified
-  const transaction: OfflineTransaction = {
-    ...metadataTransaction({}),
-    mutations: [
-      {
-        globalKey: `cycle-writer:one`,
-        type: `insert`,
-        modified,
-        original: {},
-        changes: modified,
-        collection,
-      } as PendingMutation,
-    ],
-    keys: [`cycle-writer:one`],
-  }
-
-  expect(() =>
-    new TransactionSerializer({ rows: collection }).serialize(transaction),
-  ).toThrowError(new TypeError(`Converting circular structure to JSON`))
-})
-
-it(`preserves repeated references that do not form a cycle`, () => {
-  const shared = { nested: [`value`] }
-  const transaction = metadataTransaction({ left: shared, right: shared })
-
-  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
-
-  expect(wire.metadata).toEqual({
-    left: { nested: [`value`] },
-    right: { nested: [`value`] },
-  })
-})
-
-it(`preserves spoofed Temporal tags as data while restoring branded values`, async () => {
-  class PlainDateStub {
-    readonly #value: string
-
-    constructor(value: string) {
-      this.#value = value
-    }
-
-    static from(value: string): PlainDateStub {
-      return new PlainDateStub(value)
-    }
-
-    get [Symbol.toStringTag](): `Temporal.PlainDate` {
-      return `Temporal.PlainDate`
-    }
-
-    toString(): string {
-      return this.#value
-    }
-  }
-
-  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
-  const previousTemporal = temporalGlobal.Temporal
-  temporalGlobal.Temporal = { PlainDate: PlainDateStub }
-  const storage = new FakeStorageAdapter()
-  const outbox = new OutboxManager(storage, {})
-  const transaction = metadataTransaction({
-    spoofed: {
-      keep: `user data`,
-      [Symbol.toStringTag]: `Temporal.PlainDate`,
-      toString: () => `not-a-date`,
-    },
-    genuine: new PlainDateStub(`2026-09-22`),
-  })
-
-  try {
-    await outbox.add(transaction)
-    const restored = await outbox.get(transaction.id)
-
-    expect(restored?.metadata).toMatchObject({
-      spoofed: { keep: `user data` },
-      genuine: expect.any(PlainDateStub),
-    })
-    expect(String((restored?.metadata as any).genuine)).toBe(`2026-09-22`)
-  } finally {
-    if (previousTemporal === undefined) delete temporalGlobal.Temporal
-    else temporalGlobal.Temporal = previousTemporal
-  }
-})
-
-it(`preserves plain user data with a Temporal tag when Temporal is unavailable`, () => {
-  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
-  const previousTemporal = temporalGlobal.Temporal
-  delete temporalGlobal.Temporal
-  const transaction = metadataTransaction({
-    spoofed: {
-      keep: `user data`,
-      [Symbol.toStringTag]: `Temporal.Instant`,
-    },
-  })
-
-  try {
-    const wire = JSON.parse(
-      new TransactionSerializer({}).serialize(transaction),
-    )
-
-    expect(wire.metadata).toEqual({ spoofed: { keep: `user data` } })
-  } finally {
-    if (previousTemporal === undefined) delete temporalGlobal.Temporal
-    else temporalGlobal.Temporal = previousTemporal
-  }
-})
-
-it(`does not invoke a mutation value's plain Symbol.toStringTag getter`, () => {
-  let reads = 0
-  const value = { keep: `user data` }
-  Object.defineProperty(value, Symbol.toStringTag, {
-    get() {
-      reads++
-      throw new Error(`do not inspect user getters`)
-    },
-  })
-  const collection = { id: `tag-getter-writer` } as any
-  const modified = { id: `one`, value }
-  const transaction: OfflineTransaction = {
-    ...metadataTransaction({}),
-    mutations: [
-      {
-        globalKey: `tag-getter-writer:one`,
-        type: `insert`,
-        modified,
-        original: {},
-        changes: modified,
-        collection,
-      } as unknown as PendingMutation,
-    ],
-    keys: [`tag-getter-writer:one`],
-  }
-
-  const wire = JSON.parse(
-    new TransactionSerializer({ rows: collection }).serialize(transaction),
-  )
-
-  expect({ reads, modified: wire.mutations[0].modified }).toEqual({
-    reads: 0,
-    modified: { id: `one`, value: { keep: `user data` } },
-  })
-})
-
-it(`rejects native scalars before storage when global restoration is unavailable`, async () => {
-  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
-  const previousTemporal = temporalGlobal.Temporal
-  temporalGlobal.Temporal = {}
-  const storage = new FakeStorageAdapter()
-  const outbox = new OutboxManager(storage, {})
-  const transaction: OfflineTransaction = {
-    id: `unrestorable-native-scalar`,
-    mutationFnName: `persist`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `once`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    metadata: {
-      due: new TemporalStub(`PlainDate`, `2026-09-16`),
-    },
-    version: 1,
-  }
-
-  try {
-    await expect(outbox.add(transaction)).rejects.toThrow(
-      MissingTemporalConstructorError,
-    )
-    expect(storage.snapshot()).toEqual({})
-  } finally {
-    if (previousTemporal === undefined) delete temporalGlobal.Temporal
-    else temporalGlobal.Temporal = previousTemporal
-  }
-})
-
-it(`uses one validated Temporal tag when writing a marker`, () => {
-  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
-  const previousTemporal = temporalGlobal.Temporal
-  let reads = 0
-  class PlainDateStub {
-    readonly #value: string
-
-    constructor(value: string) {
-      this.#value = value
-    }
-
-    static from(value: string): PlainDateStub {
-      return new PlainDateStub(value)
-    }
-
-    get [Symbol.toStringTag]() {
-      reads++
-      return reads === 1 ? `Temporal.PlainDate` : `Temporal.Invalid`
-    }
-
-    toString(): string {
-      return this.#value
-    }
-  }
-  temporalGlobal.Temporal = { PlainDate: PlainDateStub }
-  const value = new PlainDateStub(`2026-09-16`)
-
-  try {
-    const wire = JSON.parse(
-      new TransactionSerializer({}).serialize(metadataTransaction({ value })),
-    )
-    expect(wire.metadata.value).toEqual({
-      __type: `Temporal`,
-      type: `Temporal.PlainDate`,
-      value: `2026-09-16`,
-    })
-    expect(reads).toBe(1)
-  } finally {
-    if (previousTemporal === undefined) delete temporalGlobal.Temporal
-    else temporalGlobal.Temporal = previousTemporal
-  }
-})
-
-it(`preserves metadata toJSON values without changing mutation value semantics`, () => {
-  class JsonValue {
-    toJSON(key: string) {
-      return `from-toJSON:${key}`
-    }
-  }
-  const collection = {
-    id: `metadata-json-writer`,
-    getKeyFromItem: (value: { id: string }) => value.id,
-  } as any
-  const serializer = new TransactionSerializer({ rows: collection })
-  const url = new URL(`https://example.com/path`)
-  const jsonValue = new JsonValue()
-  const metadata = {
-    url,
-    jsonValue,
-    nested: [jsonValue],
-    boxed: [Object(7), Object(`value`), Object(false)],
-  }
-  Object.defineProperty(metadata, `toJSON`, {
-    value: (key: string) => ({ ...metadata, metadataKey: key }),
-  })
-  const transaction: OfflineTransaction = {
-    id: `metadata-json`,
-    mutationFnName: `persist`,
-    mutations: [
-      {
-        globalKey: `metadata-json-writer:one`,
-        type: `insert`,
-        modified: { id: `one`, url, jsonValue },
-        original: {},
-        changes: {},
-        collection,
-      } as unknown as PendingMutation,
-    ],
-    keys: [`metadata-json-writer:one`],
-    idempotencyKey: `once`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    metadata,
-    version: 1,
-  }
-
-  const encoded = serializer.serialize(transaction)
-  const wire = JSON.parse(encoded)
-  expect(wire.metadata).toEqual({
-    url: `https://example.com/path`,
-    jsonValue: `from-toJSON:jsonValue`,
-    nested: [`from-toJSON:0`],
-    boxed: [7, `value`, false],
-    metadataKey: `metadata`,
-  })
-  expect(wire.mutations[0].modified).toEqual({
-    id: `one`,
-    url: {},
-    jsonValue: {},
-  })
-
-  const decoded = serializer.deserialize(encoded)
-  expect(decoded.metadata).toEqual(wire.metadata)
-  expect(decoded.mutations[0]!.modified).toEqual(wire.mutations[0].modified)
-})
-
-it(`does not invoke toJSON again on its immediate replacement`, () => {
-  const nested = {
-    toJSON(key: string) {
-      return `nested:${key}`
-    },
-  }
-  const replacement = {
-    nested,
-    toJSON() {
-      return `incorrect second invocation`
-    },
-  }
-  const transaction = metadataTransaction({
-    value: {
-      toJSON(key: string) {
-        return key === `value` ? replacement : `incorrect key:${key}`
-      },
-    },
-  })
-
-  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
-
-  expect(wire.metadata).toEqual({ value: { nested: `nested:nested` } })
-})
-
-it(`rejects a toJSON replacement that references its receiver`, () => {
-  const source = {
-    toJSON() {
-      return { back: source }
-    },
-  }
-
-  expect(() =>
-    new TransactionSerializer({}).serialize(
-      metadataTransaction({ value: source }),
-    ),
-  ).toThrowError(new TypeError(`Converting circular structure to JSON`))
-})
-
-it(`treats immediate native-scalar replacements as ordinary JSON values`, () => {
-  const temporalReplacement = {
-    [Symbol.toStringTag]: `Temporal.PlainDate`,
-    toString() {
-      return `2026-09-16`
-    },
-  }
-  const transaction = metadataTransaction({
-    date: { toJSON: () => new Date(0) },
-    temporal: { toJSON: () => temporalReplacement },
-  })
-
-  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
-
-  expect(wire.metadata).toEqual({ date: {}, temporal: {} })
-})
-
-it(`preserves JSON array length and indexed-property semantics in metadata`, () => {
-  const values = Array(3) as Array<string | undefined>
-  Object.defineProperty(values, 0, { enumerable: false, value: `hidden` })
-  values[1] = `visible`
-  const shrinking = Array(3) as Array<string | undefined>
-  Object.defineProperty(shrinking, 0, {
-    enumerable: true,
-    get() {
-      shrinking.length = 1
-      return `first`
-    },
-  })
-  const transaction = metadataTransaction({ values, shrinking })
-
-  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
-
-  expect(wire.metadata).toEqual({
-    values: [`hidden`, `visible`, null],
-    shrinking: [`first`, null, null],
-  })
-})
-
-it(`retains JSON's error for boxed BigInt metadata`, () => {
-  const transaction = metadataTransaction({ value: Object(1n) })
-
-  expect(() => new TransactionSerializer({}).serialize(transaction)).toThrow(
-    TypeError,
-  )
-})
-
-it(`does not recurse through fresh toJSON replacement objects`, () => {
-  const freshReplacement = (): Record<string, unknown> => ({
-    toJSON: freshReplacement,
-  })
-  const transaction = metadataTransaction({
-    value: { toJSON: freshReplacement },
-  })
-
-  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
-
-  expect(wire.metadata).toEqual({ value: {} })
-})
-
-it(`reads metadata toJSON once with its object as the receiver`, () => {
-  let reads = 0
-  let selfCalls = 0
-  const value = {
-    marker: `receiver`,
-    get toJSON() {
-      reads++
-      if (reads > 1) throw new Error(`toJSON read more than once`)
-      return function (this: { marker: string }, key: string) {
-        return `${this.marker}:${key}`
-      }
-    },
-  }
-  const self = {
-    keep: `value`,
-    toJSON() {
-      selfCalls++
-      return this
-    },
-  }
-  const transaction = metadataTransaction({ value, self })
-
-  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
-
-  expect(wire.metadata).toEqual({
-    value: `receiver:value`,
-    self: { keep: `value` },
-  })
-  expect(reads).toBe(1)
-  expect(selfCalls).toBe(1)
-})
-
-it(`preserves native scalar identity across storage restart`, async () => {
-  type NativeRow = {
-    id: string
-    values: Record<TemporalName, TemporalStub>
-  }
-  const writer = createCollection<NativeRow>({
-    id: `native-scalar-writer`,
-    getKey: (row) => row.id,
-    sync: { sync: ({ markReady }) => markReady() },
-  })
-  const reader = createCollection<NativeRow>({
-    id: `native-scalar-reader`,
-    getKey: (row) => row.id,
-    sync: { sync: ({ markReady }) => markReady() },
-  })
-  const previousTemporal = (
-    globalThis as { Temporal?: Record<string, unknown> }
-  ).Temporal
-  ;(globalThis as { Temporal?: Record<string, unknown> }).Temporal =
-    Object.fromEntries(
-      temporalCases.map(([name]) => [name, temporalStubConstructor(name)]),
-    )
-
-  const values = Object.fromEntries(
-    temporalCases.map(([name, value]) => [name, new TemporalStub(name, value)]),
-  ) as NativeRow[`values`]
-  const mutation = {
-    globalKey: `native-scalar-writer:one`,
-    type: `update`,
-    modified: { id: `one`, values },
-    original: { id: `one`, values },
-    changes: { values },
-    collection: writer,
-  } as unknown as PendingMutation
-  const transaction: OfflineTransaction = {
-    id: `native-scalars`,
-    mutationFnName: `persist`,
-    mutations: [mutation],
-    keys: [mutation.globalKey],
-    idempotencyKey: `once`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    metadata: { nested: { values } },
-    version: 1,
-  }
-
-  try {
-    const encoded = new TransactionSerializer({ rows: writer }).serialize(
-      transaction,
-    )
-    const wire = JSON.parse(encoded)
-    expect(wire.valueEncoding).toBe(3)
-    const encodedLocations = [
-      wire.mutations[0].modified.values,
-      wire.mutations[0].original.values,
-      wire.mutations[0].changes.values,
-      wire.metadata.nested.values,
-    ] as Array<Record<TemporalName, unknown>>
-    for (const location of encodedLocations)
-      for (const [name, value] of temporalCases)
-        expect(location[name]).toEqual({
-          __type: `Temporal`,
-          type: `Temporal.${name}`,
-          value,
-        })
-
-    const restarted = new TransactionSerializer({ rows: reader })
-    const decoded = restarted.deserialize(encoded)
-    const decodedMutation = decoded.mutations[0]!
-    const restored = [
-      (decodedMutation.modified as NativeRow).values,
-      (decodedMutation.original as NativeRow).values,
-      (decodedMutation.changes as { values: NativeRow[`values`] }).values,
-      (
-        decoded.metadata as {
-          nested: { values: NativeRow[`values`] }
-        }
-      ).nested.values,
-    ] as Array<Record<TemporalName, unknown>>
-
-    for (const location of restored) {
-      for (const [name, value] of temporalCases) {
-        expect(location[name]).toBeInstanceOf(TemporalStub)
-        expect(Object.prototype.toString.call(location[name])).toBe(
-          `[object Temporal.${name}]`,
-        )
-        expect(String(location[name])).toBe(value)
-      }
-    }
-  } finally {
-    if (previousTemporal === undefined)
-      delete (globalThis as { Temporal?: Record<string, unknown> }).Temporal
-    else
-      (globalThis as { Temporal?: Record<string, unknown> }).Temporal =
-        previousTemporal
-    await writer.cleanup()
-    await reader.cleanup()
-  }
-})
-
 it(`preserves marker-shaped user data through current wire encoding`, async () => {
   const runtime = {
     __type: `Temporal`,
@@ -989,296 +407,6 @@ it(`preserves marker-shaped user data through current wire encoding`, async () =
   )
 })
 
-it(`preserves prior wire meanings when reading native scalar markers`, async () => {
-  const collection = createCollection<{
-    id: string
-    due: unknown
-    createdAt: unknown
-  }>({
-    id: `native-scalar-compatibility`,
-    getKey: (row) => row.id,
-    sync: { sync: ({ markReady }) => markReady() },
-  })
-  const serializer = new TransactionSerializer({ rows: collection })
-  const temporalData = {
-    __type: `Temporal`,
-    type: `Temporal.PlainDate`,
-    value: `2026-09-16`,
-  }
-  const dateMarker = {
-    __type: `Date`,
-    value: `2026-09-16T12:34:56.000Z`,
-  }
-  const baseWire = {
-    id: `compatibility`,
-    mutationFnName: `persist`,
-    mutations: [
-      {
-        globalKey: `rows:one`,
-        type: `insert`,
-        modified: { id: `one`, due: temporalData, createdAt: dateMarker },
-        original: {},
-        changes: {},
-        collectionId: `rows`,
-      },
-    ],
-    keys: [`rows:one`],
-    idempotencyKey: `once`,
-    createdAt: new Date(0).toISOString(),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    metadata: { due: temporalData, createdAt: dateMarker },
-    version: 1,
-  }
-
-  try {
-    const unversioned = serializer.deserialize(JSON.stringify(baseWire))
-    expect(unversioned.mutations[0]!.modified).toEqual({
-      id: `one`,
-      due: temporalData,
-      createdAt: new Date(dateMarker.value),
-    })
-    expect(unversioned.metadata).toEqual(baseWire.metadata)
-
-    const versionTwo = serializer.deserialize(
-      JSON.stringify({
-        ...baseWire,
-        valueEncoding: 2,
-        mutations: [
-          {
-            ...baseWire.mutations[0],
-            modified: {
-              id: `one`,
-              due: { __type: `Object`, value: temporalData },
-              createdAt: dateMarker,
-            },
-          },
-        ],
-      }),
-    )
-    expect(versionTwo.mutations[0]!.modified).toEqual({
-      id: `one`,
-      due: temporalData,
-      createdAt: new Date(dateMarker.value),
-    })
-    expect(versionTwo.metadata).toEqual(baseWire.metadata)
-  } finally {
-    await collection.cleanup()
-  }
-})
-
-it(`keeps legacy pending-work records phase-free across serialization`, () => {
-  const serializer = new TransactionSerializer({})
-  const legacyWire = {
-    id: `legacy-pending`,
-    mutationFnName: `persist`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `legacy-key`,
-    createdAt: new Date(0).toISOString(),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    version: 1,
-  }
-
-  const decoded = serializer.deserialize(JSON.stringify(legacyWire))
-  expect(decoded.outboxPhase).toBeUndefined()
-  const rewritten = JSON.parse(serializer.serialize(decoded)) as Record<
-    string,
-    unknown
-  >
-  expect(rewritten).not.toHaveProperty(`outboxPhase`)
-  expect(rewritten).toMatchObject(legacyWire)
-  expect(rewritten).toHaveProperty(`valueEncoding`, 3)
-})
-
-it(`round-trips a mutationFn-fulfilled deletion-pending record`, () => {
-  const serializer = new TransactionSerializer({})
-  const transaction: OfflineTransaction = {
-    id: `deletion-pending`,
-    mutationFnName: `persist`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `stable-key`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    outboxPhase: `deletion-pending`,
-    version: 1,
-  }
-
-  const encoded = serializer.serialize(transaction)
-  expect(JSON.parse(encoded)).toMatchObject({
-    id: transaction.id,
-    idempotencyKey: `stable-key`,
-    outboxPhase: `deletion-pending`,
-    valueEncoding: 3,
-    version: 1,
-  })
-  expect(serializer.deserialize(encoded)).toEqual(transaction)
-})
-
-it.each([null, false, 0, {}, `provider-pending`, `unknown`])(
-  `rejects malformed or unknown outbox phase %j`,
-  (outboxPhase) => {
-    const serializer = new TransactionSerializer({})
-    const wire = {
-      id: `invalid-phase`,
-      mutationFnName: `persist`,
-      mutations: [],
-      keys: [],
-      idempotencyKey: `stable-key`,
-      createdAt: new Date(0).toISOString(),
-      retryCount: 0,
-      nextAttemptAt: 0,
-      outboxPhase,
-      version: 1,
-    }
-    expect(() => serializer.deserialize(JSON.stringify(wire))).toThrow(
-      /Unsupported transaction outbox phase/,
-    )
-    expect(() =>
-      serializer.serialize({
-        ...wire,
-        createdAt: new Date(0),
-      } as unknown as OfflineTransaction),
-    ).toThrow(/Unsupported transaction outbox phase/)
-  },
-)
-
-it(`fails visibly with the retained native scalar transaction id`, async () => {
-  const collection = createCollection<{ id: string; due: unknown }>({
-    id: `native-scalar-missing-runtime`,
-    getKey: (row) => row.id,
-    sync: { sync: ({ markReady }) => markReady() },
-  })
-  const marker = {
-    __type: `Temporal`,
-    type: `Temporal.PlainDate`,
-    value: `2026-09-16`,
-  }
-  const wire = JSON.stringify({
-    valueEncoding: 3,
-    id: `missing-runtime`,
-    mutationFnName: `persist`,
-    mutations: [
-      {
-        globalKey: `rows:one`,
-        type: `insert`,
-        modified: { id: `one`, due: marker },
-        original: {},
-        changes: {},
-        collectionId: `rows`,
-      },
-    ],
-    keys: [`rows:one`],
-    idempotencyKey: `once`,
-    createdAt: new Date(0).toISOString(),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    metadata: { due: marker },
-    version: 1,
-  })
-  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
-  const previousTemporal = temporalGlobal.Temporal
-  temporalGlobal.Temporal = {}
-  const storage = new FakeStorageAdapter()
-  await storage.set(`tx:missing-runtime`, wire)
-  const outbox = new OutboxManager(storage, { rows: collection })
-
-  try {
-    expect(() =>
-      new TransactionSerializer({ rows: collection }).deserialize(wire),
-    ).toThrow(MissingTemporalConstructorError)
-    await expect(outbox.get(`missing-runtime`)).rejects.toThrow(
-      /transaction missing-runtime/,
-    )
-    await expect(outbox.getAll()).rejects.toThrow(/transaction missing-runtime/)
-    expect(storage.snapshot()).toHaveProperty(`tx:missing-runtime`, wire)
-  } finally {
-    if (previousTemporal === undefined) delete temporalGlobal.Temporal
-    else temporalGlobal.Temporal = previousTemporal
-    await collection.cleanup()
-  }
-})
-
-it(`rejects malformed native scalar markers and constructor failures`, async () => {
-  const collection = createCollection<{ id: string; due: unknown }>({
-    id: `native-scalar-invalid`,
-    getKey: (row) => row.id,
-    sync: { sync: ({ markReady }) => markReady() },
-  })
-  const serializer = new TransactionSerializer({ rows: collection })
-  const wire = (marker: unknown) =>
-    JSON.stringify({
-      valueEncoding: 3,
-      id: `invalid-native-scalar`,
-      mutationFnName: `persist`,
-      mutations: [
-        {
-          globalKey: `rows:one`,
-          type: `insert`,
-          modified: { id: `one`, due: marker },
-          original: {},
-          changes: {},
-          collectionId: `rows`,
-        },
-      ],
-      keys: [`rows:one`],
-      idempotencyKey: `once`,
-      createdAt: new Date(0).toISOString(),
-      retryCount: 0,
-      nextAttemptAt: 0,
-      version: 1,
-    })
-
-  try {
-    expect(() =>
-      serializer.deserialize(
-        wire({
-          __type: `Temporal`,
-          type: `Temporal.Calendar`,
-          value: `iso8601`,
-        }),
-      ),
-    ).toThrow(`Corrupted Temporal marker: invalid type field`)
-    expect(() =>
-      serializer.deserialize(
-        wire({ __type: `Temporal`, type: `Temporal.PlainDate` }),
-      ),
-    ).toThrow(`Corrupted Temporal marker: missing value field`)
-
-    const temporalGlobal = globalThis as {
-      Temporal?: Record<string, unknown>
-    }
-    const previousTemporal = temporalGlobal.Temporal
-    const constructorFailure = new Error(`constructor rejected value`)
-    temporalGlobal.Temporal = {
-      PlainDate: {
-        from: () => {
-          throw constructorFailure
-        },
-      },
-    }
-    try {
-      expect(() =>
-        serializer.deserialize(
-          wire({
-            __type: `Temporal`,
-            type: `Temporal.PlainDate`,
-            value: `not-a-date`,
-          }),
-        ),
-      ).toThrow(constructorFailure)
-    } finally {
-      if (previousTemporal === undefined) delete temporalGlobal.Temporal
-      else temporalGlobal.Temporal = previousTemporal
-    }
-  } finally {
-    await collection.cleanup()
-  }
-})
-
 // Roundtrips generate valid envelopes. Corrupted wire must be rejected before
 // it can replace any mutation field with an invented empty object.
 it.each([`modified`, `original`, `changes`] as const)(
diff --git a/packages/offline-transactions/tests/transaction-serializer.test.ts b/packages/offline-transactions/tests/transaction-serializer.test.ts
new file mode 100644
index 0000000000..f9fe3777db
--- /dev/null
+++ b/packages/offline-transactions/tests/transaction-serializer.test.ts
@@ -0,0 +1,889 @@
+// Focused serializer witnesses: metadata toJSON and boxed-scalar rules,
+// cycles, Temporal markers, legacy phases, and malformed wire. The serializer
+// law that these examples instantiate is owned by
+// transaction-serializer-oracle.property.test.ts.
+import { createCollection } from '@tanstack/db'
+import { expect, it } from 'vitest'
+import { OutboxManager } from '../src/outbox/OutboxManager'
+import {
+  MissingTemporalConstructorError,
+  TransactionSerializer,
+} from '../src/outbox/TransactionSerializer'
+import { FakeStorageAdapter } from './harness'
+import type { OfflineTransaction } from '../src/types'
+import type { PendingMutation } from '@tanstack/db'
+
+const temporalCases = [
+  [`Duration`, `PT1H30M`],
+  [`Instant`, `2026-09-16T12:34:56Z`],
+  [`PlainDate`, `2026-09-16`],
+  [`PlainDateTime`, `2026-09-16T12:34:56`],
+  [`PlainMonthDay`, `09-16`],
+  [`PlainTime`, `12:34:56`],
+  [`PlainYearMonth`, `2026-09`],
+  [`ZonedDateTime`, `2026-09-16T12:34:56-06:00[America/Denver]`],
+] as const
+
+type TemporalName = (typeof temporalCases)[number][0]
+
+class TemporalStub {
+  readonly #name: TemporalName
+  readonly #value: string
+
+  constructor(name: TemporalName, value: string) {
+    this.#name = name
+    this.#value = value
+  }
+
+  get [Symbol.toStringTag](): `Temporal.${TemporalName}` {
+    return `Temporal.${this.#name}`
+  }
+
+  toString(): string {
+    return this.#value
+  }
+}
+
+function temporalStubConstructor(name: TemporalName) {
+  return class extends TemporalStub {
+    constructor(value: string) {
+      super(name, value)
+    }
+
+    static from(value: string): TemporalStub {
+      return new TemporalStub(name, value)
+    }
+  }
+}
+
+function metadataTransaction(
+  metadata: Record<string, unknown>,
+): OfflineTransaction {
+  return {
+    id: `metadata-json`,
+    mutationFnName: `persist`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `once`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    metadata,
+    version: 1,
+  }
+}
+
+it(`rejects cyclic metadata with a bounded JSON-style error`, () => {
+  const metadata: Record<string, unknown> = {}
+  metadata.self = metadata
+
+  expect(() =>
+    new TransactionSerializer({}).serialize(metadataTransaction(metadata)),
+  ).toThrowError(new TypeError(`Converting circular structure to JSON`))
+})
+
+it(`rejects cyclic mutation values with a bounded JSON-style error`, () => {
+  const collection = { id: `cycle-writer` } as any
+  const modified: Record<string, unknown> = { id: `one` }
+  modified.self = modified
+  const transaction: OfflineTransaction = {
+    ...metadataTransaction({}),
+    mutations: [
+      {
+        globalKey: `cycle-writer:one`,
+        type: `insert`,
+        modified,
+        original: {},
+        changes: modified,
+        collection,
+      } as PendingMutation,
+    ],
+    keys: [`cycle-writer:one`],
+  }
+
+  expect(() =>
+    new TransactionSerializer({ rows: collection }).serialize(transaction),
+  ).toThrowError(new TypeError(`Converting circular structure to JSON`))
+})
+
+it(`preserves repeated references that do not form a cycle`, () => {
+  const shared = { nested: [`value`] }
+  const transaction = metadataTransaction({ left: shared, right: shared })
+
+  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
+
+  expect(wire.metadata).toEqual({
+    left: { nested: [`value`] },
+    right: { nested: [`value`] },
+  })
+})
+
+it(`preserves spoofed Temporal tags as data while restoring branded values`, async () => {
+  class PlainDateStub {
+    readonly #value: string
+
+    constructor(value: string) {
+      this.#value = value
+    }
+
+    static from(value: string): PlainDateStub {
+      return new PlainDateStub(value)
+    }
+
+    get [Symbol.toStringTag](): `Temporal.PlainDate` {
+      return `Temporal.PlainDate`
+    }
+
+    toString(): string {
+      return this.#value
+    }
+  }
+
+  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
+  const previousTemporal = temporalGlobal.Temporal
+  temporalGlobal.Temporal = { PlainDate: PlainDateStub }
+  const storage = new FakeStorageAdapter()
+  const outbox = new OutboxManager(storage, {})
+  const transaction = metadataTransaction({
+    spoofed: {
+      keep: `user data`,
+      [Symbol.toStringTag]: `Temporal.PlainDate`,
+      toString: () => `not-a-date`,
+    },
+    genuine: new PlainDateStub(`2026-09-22`),
+  })
+
+  try {
+    await outbox.add(transaction)
+    const restored = await outbox.get(transaction.id)
+
+    expect(restored?.metadata).toMatchObject({
+      spoofed: { keep: `user data` },
+      genuine: expect.any(PlainDateStub),
+    })
+    expect(String((restored?.metadata as any).genuine)).toBe(`2026-09-22`)
+  } finally {
+    if (previousTemporal === undefined) delete temporalGlobal.Temporal
+    else temporalGlobal.Temporal = previousTemporal
+  }
+})
+
+it(`preserves plain user data with a Temporal tag when Temporal is unavailable`, () => {
+  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
+  const previousTemporal = temporalGlobal.Temporal
+  delete temporalGlobal.Temporal
+  const transaction = metadataTransaction({
+    spoofed: {
+      keep: `user data`,
+      [Symbol.toStringTag]: `Temporal.Instant`,
+    },
+  })
+
+  try {
+    const wire = JSON.parse(
+      new TransactionSerializer({}).serialize(transaction),
+    )
+
+    expect(wire.metadata).toEqual({ spoofed: { keep: `user data` } })
+  } finally {
+    if (previousTemporal === undefined) delete temporalGlobal.Temporal
+    else temporalGlobal.Temporal = previousTemporal
+  }
+})
+
+it(`does not invoke a mutation value's plain Symbol.toStringTag getter`, () => {
+  let reads = 0
+  const value = { keep: `user data` }
+  Object.defineProperty(value, Symbol.toStringTag, {
+    get() {
+      reads++
+      throw new Error(`do not inspect user getters`)
+    },
+  })
+  const collection = { id: `tag-getter-writer` } as any
+  const modified = { id: `one`, value }
+  const transaction: OfflineTransaction = {
+    ...metadataTransaction({}),
+    mutations: [
+      {
+        globalKey: `tag-getter-writer:one`,
+        type: `insert`,
+        modified,
+        original: {},
+        changes: modified,
+        collection,
+      } as unknown as PendingMutation,
+    ],
+    keys: [`tag-getter-writer:one`],
+  }
+
+  const wire = JSON.parse(
+    new TransactionSerializer({ rows: collection }).serialize(transaction),
+  )
+
+  expect({ reads, modified: wire.mutations[0].modified }).toEqual({
+    reads: 0,
+    modified: { id: `one`, value: { keep: `user data` } },
+  })
+})
+
+it(`rejects native scalars before storage when global restoration is unavailable`, async () => {
+  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
+  const previousTemporal = temporalGlobal.Temporal
+  temporalGlobal.Temporal = {}
+  const storage = new FakeStorageAdapter()
+  const outbox = new OutboxManager(storage, {})
+  const transaction: OfflineTransaction = {
+    id: `unrestorable-native-scalar`,
+    mutationFnName: `persist`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `once`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    metadata: {
+      due: new TemporalStub(`PlainDate`, `2026-09-16`),
+    },
+    version: 1,
+  }
+
+  try {
+    await expect(outbox.add(transaction)).rejects.toThrow(
+      MissingTemporalConstructorError,
+    )
+    expect(storage.snapshot()).toEqual({})
+  } finally {
+    if (previousTemporal === undefined) delete temporalGlobal.Temporal
+    else temporalGlobal.Temporal = previousTemporal
+  }
+})
+
+it(`uses one validated Temporal tag when writing a marker`, () => {
+  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
+  const previousTemporal = temporalGlobal.Temporal
+  let reads = 0
+  class PlainDateStub {
+    readonly #value: string
+
+    constructor(value: string) {
+      this.#value = value
+    }
+
+    static from(value: string): PlainDateStub {
+      return new PlainDateStub(value)
+    }
+
+    get [Symbol.toStringTag]() {
+      reads++
+      return reads === 1 ? `Temporal.PlainDate` : `Temporal.Invalid`
+    }
+
+    toString(): string {
+      return this.#value
+    }
+  }
+  temporalGlobal.Temporal = { PlainDate: PlainDateStub }
+  const value = new PlainDateStub(`2026-09-16`)
+
+  try {
+    const wire = JSON.parse(
+      new TransactionSerializer({}).serialize(metadataTransaction({ value })),
+    )
+    expect(wire.metadata.value).toEqual({
+      __type: `Temporal`,
+      type: `Temporal.PlainDate`,
+      value: `2026-09-16`,
+    })
+    expect(reads).toBe(1)
+  } finally {
+    if (previousTemporal === undefined) delete temporalGlobal.Temporal
+    else temporalGlobal.Temporal = previousTemporal
+  }
+})
+
+it(`preserves metadata toJSON values without changing mutation value semantics`, () => {
+  class JsonValue {
+    toJSON(key: string) {
+      return `from-toJSON:${key}`
+    }
+  }
+  const collection = {
+    id: `metadata-json-writer`,
+    getKeyFromItem: (value: { id: string }) => value.id,
+  } as any
+  const serializer = new TransactionSerializer({ rows: collection })
+  const url = new URL(`https://example.com/path`)
+  const jsonValue = new JsonValue()
+  const metadata = {
+    url,
+    jsonValue,
+    nested: [jsonValue],
+    boxed: [Object(7), Object(`value`), Object(false)],
+  }
+  Object.defineProperty(metadata, `toJSON`, {
+    value: (key: string) => ({ ...metadata, metadataKey: key }),
+  })
+  const transaction: OfflineTransaction = {
+    id: `metadata-json`,
+    mutationFnName: `persist`,
+    mutations: [
+      {
+        globalKey: `metadata-json-writer:one`,
+        type: `insert`,
+        modified: { id: `one`, url, jsonValue },
+        original: {},
+        changes: {},
+        collection,
+      } as unknown as PendingMutation,
+    ],
+    keys: [`metadata-json-writer:one`],
+    idempotencyKey: `once`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    metadata,
+    version: 1,
+  }
+
+  const encoded = serializer.serialize(transaction)
+  const wire = JSON.parse(encoded)
+  expect(wire.metadata).toEqual({
+    url: `https://example.com/path`,
+    jsonValue: `from-toJSON:jsonValue`,
+    nested: [`from-toJSON:0`],
+    boxed: [7, `value`, false],
+    metadataKey: `metadata`,
+  })
+  expect(wire.mutations[0].modified).toEqual({
+    id: `one`,
+    url: {},
+    jsonValue: {},
+  })
+
+  const decoded = serializer.deserialize(encoded)
+  expect(decoded.metadata).toEqual(wire.metadata)
+  expect(decoded.mutations[0]!.modified).toEqual(wire.mutations[0].modified)
+})
+
+it(`does not invoke toJSON again on its immediate replacement`, () => {
+  const nested = {
+    toJSON(key: string) {
+      return `nested:${key}`
+    },
+  }
+  const replacement = {
+    nested,
+    toJSON() {
+      return `incorrect second invocation`
+    },
+  }
+  const transaction = metadataTransaction({
+    value: {
+      toJSON(key: string) {
+        return key === `value` ? replacement : `incorrect key:${key}`
+      },
+    },
+  })
+
+  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
+
+  expect(wire.metadata).toEqual({ value: { nested: `nested:nested` } })
+})
+
+it(`rejects a toJSON replacement that references its receiver`, () => {
+  const source = {
+    toJSON() {
+      return { back: source }
+    },
+  }
+
+  expect(() =>
+    new TransactionSerializer({}).serialize(
+      metadataTransaction({ value: source }),
+    ),
+  ).toThrowError(new TypeError(`Converting circular structure to JSON`))
+})
+
+it(`treats immediate native-scalar replacements as ordinary JSON values`, () => {
+  const temporalReplacement = {
+    [Symbol.toStringTag]: `Temporal.PlainDate`,
+    toString() {
+      return `2026-09-16`
+    },
+  }
+  const transaction = metadataTransaction({
+    date: { toJSON: () => new Date(0) },
+    temporal: { toJSON: () => temporalReplacement },
+  })
+
+  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
+
+  expect(wire.metadata).toEqual({ date: {}, temporal: {} })
+})
+
+it(`preserves JSON array length and indexed-property semantics in metadata`, () => {
+  const values = Array(3) as Array<string | undefined>
+  Object.defineProperty(values, 0, { enumerable: false, value: `hidden` })
+  values[1] = `visible`
+  const shrinking = Array(3) as Array<string | undefined>
+  Object.defineProperty(shrinking, 0, {
+    enumerable: true,
+    get() {
+      shrinking.length = 1
+      return `first`
+    },
+  })
+  const transaction = metadataTransaction({ values, shrinking })
+
+  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
+
+  expect(wire.metadata).toEqual({
+    values: [`hidden`, `visible`, null],
+    shrinking: [`first`, null, null],
+  })
+})
+
+it(`retains JSON's error for boxed BigInt metadata`, () => {
+  const transaction = metadataTransaction({ value: Object(1n) })
+
+  expect(() => new TransactionSerializer({}).serialize(transaction)).toThrow(
+    TypeError,
+  )
+})
+
+it(`does not recurse through fresh toJSON replacement objects`, () => {
+  const freshReplacement = (): Record<string, unknown> => ({
+    toJSON: freshReplacement,
+  })
+  const transaction = metadataTransaction({
+    value: { toJSON: freshReplacement },
+  })
+
+  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
+
+  expect(wire.metadata).toEqual({ value: {} })
+})
+
+it(`reads metadata toJSON once with its object as the receiver`, () => {
+  let reads = 0
+  let selfCalls = 0
+  const value = {
+    marker: `receiver`,
+    get toJSON() {
+      reads++
+      if (reads > 1) throw new Error(`toJSON read more than once`)
+      return function (this: { marker: string }, key: string) {
+        return `${this.marker}:${key}`
+      }
+    },
+  }
+  const self = {
+    keep: `value`,
+    toJSON() {
+      selfCalls++
+      return this
+    },
+  }
+  const transaction = metadataTransaction({ value, self })
+
+  const wire = JSON.parse(new TransactionSerializer({}).serialize(transaction))
+
+  expect(wire.metadata).toEqual({
+    value: `receiver:value`,
+    self: { keep: `value` },
+  })
+  expect(reads).toBe(1)
+  expect(selfCalls).toBe(1)
+})
+
+it(`preserves native scalar identity across storage restart`, async () => {
+  type NativeRow = {
+    id: string
+    values: Record<TemporalName, TemporalStub>
+  }
+  const writer = createCollection<NativeRow>({
+    id: `native-scalar-writer`,
+    getKey: (row) => row.id,
+    sync: { sync: ({ markReady }) => markReady() },
+  })
+  const reader = createCollection<NativeRow>({
+    id: `native-scalar-reader`,
+    getKey: (row) => row.id,
+    sync: { sync: ({ markReady }) => markReady() },
+  })
+  const previousTemporal = (
+    globalThis as { Temporal?: Record<string, unknown> }
+  ).Temporal
+  ;(globalThis as { Temporal?: Record<string, unknown> }).Temporal =
+    Object.fromEntries(
+      temporalCases.map(([name]) => [name, temporalStubConstructor(name)]),
+    )
+
+  const values = Object.fromEntries(
+    temporalCases.map(([name, value]) => [name, new TemporalStub(name, value)]),
+  ) as NativeRow[`values`]
+  const mutation = {
+    globalKey: `native-scalar-writer:one`,
+    type: `update`,
+    modified: { id: `one`, values },
+    original: { id: `one`, values },
+    changes: { values },
+    collection: writer,
+  } as unknown as PendingMutation
+  const transaction: OfflineTransaction = {
+    id: `native-scalars`,
+    mutationFnName: `persist`,
+    mutations: [mutation],
+    keys: [mutation.globalKey],
+    idempotencyKey: `once`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    metadata: { nested: { values } },
+    version: 1,
+  }
+
+  try {
+    const encoded = new TransactionSerializer({ rows: writer }).serialize(
+      transaction,
+    )
+    const wire = JSON.parse(encoded)
+    expect(wire.valueEncoding).toBe(3)
+    const encodedLocations = [
+      wire.mutations[0].modified.values,
+      wire.mutations[0].original.values,
+      wire.mutations[0].changes.values,
+      wire.metadata.nested.values,
+    ] as Array<Record<TemporalName, unknown>>
+    for (const location of encodedLocations)
+      for (const [name, value] of temporalCases)
+        expect(location[name]).toEqual({
+          __type: `Temporal`,
+          type: `Temporal.${name}`,
+          value,
+        })
+
+    const restarted = new TransactionSerializer({ rows: reader })
+    const decoded = restarted.deserialize(encoded)
+    const decodedMutation = decoded.mutations[0]!
+    const restored = [
+      (decodedMutation.modified as NativeRow).values,
+      (decodedMutation.original as NativeRow).values,
+      (decodedMutation.changes as { values: NativeRow[`values`] }).values,
+      (
+        decoded.metadata as {
+          nested: { values: NativeRow[`values`] }
+        }
+      ).nested.values,
+    ] as Array<Record<TemporalName, unknown>>
+
+    for (const location of restored) {
+      for (const [name, value] of temporalCases) {
+        expect(location[name]).toBeInstanceOf(TemporalStub)
+        expect(Object.prototype.toString.call(location[name])).toBe(
+          `[object Temporal.${name}]`,
+        )
+        expect(String(location[name])).toBe(value)
+      }
+    }
+  } finally {
+    if (previousTemporal === undefined)
+      delete (globalThis as { Temporal?: Record<string, unknown> }).Temporal
+    else
+      (globalThis as { Temporal?: Record<string, unknown> }).Temporal =
+        previousTemporal
+    await writer.cleanup()
+    await reader.cleanup()
+  }
+})
+
+it(`preserves prior wire meanings when reading native scalar markers`, async () => {
+  const collection = createCollection<{
+    id: string
+    due: unknown
+    createdAt: unknown
+  }>({
+    id: `native-scalar-compatibility`,
+    getKey: (row) => row.id,
+    sync: { sync: ({ markReady }) => markReady() },
+  })
+  const serializer = new TransactionSerializer({ rows: collection })
+  const temporalData = {
+    __type: `Temporal`,
+    type: `Temporal.PlainDate`,
+    value: `2026-09-16`,
+  }
+  const dateMarker = {
+    __type: `Date`,
+    value: `2026-09-16T12:34:56.000Z`,
+  }
+  const baseWire = {
+    id: `compatibility`,
+    mutationFnName: `persist`,
+    mutations: [
+      {
+        globalKey: `rows:one`,
+        type: `insert`,
+        modified: { id: `one`, due: temporalData, createdAt: dateMarker },
+        original: {},
+        changes: {},
+        collectionId: `rows`,
+      },
+    ],
+    keys: [`rows:one`],
+    idempotencyKey: `once`,
+    createdAt: new Date(0).toISOString(),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    metadata: { due: temporalData, createdAt: dateMarker },
+    version: 1,
+  }
+
+  try {
+    const unversioned = serializer.deserialize(JSON.stringify(baseWire))
+    expect(unversioned.mutations[0]!.modified).toEqual({
+      id: `one`,
+      due: temporalData,
+      createdAt: new Date(dateMarker.value),
+    })
+    expect(unversioned.metadata).toEqual(baseWire.metadata)
+
+    const versionTwo = serializer.deserialize(
+      JSON.stringify({
+        ...baseWire,
+        valueEncoding: 2,
+        mutations: [
+          {
+            ...baseWire.mutations[0],
+            modified: {
+              id: `one`,
+              due: { __type: `Object`, value: temporalData },
+              createdAt: dateMarker,
+            },
+          },
+        ],
+      }),
+    )
+    expect(versionTwo.mutations[0]!.modified).toEqual({
+      id: `one`,
+      due: temporalData,
+      createdAt: new Date(dateMarker.value),
+    })
+    expect(versionTwo.metadata).toEqual(baseWire.metadata)
+  } finally {
+    await collection.cleanup()
+  }
+})
+
+it(`keeps legacy pending-work records phase-free across serialization`, () => {
+  const serializer = new TransactionSerializer({})
+  const legacyWire = {
+    id: `legacy-pending`,
+    mutationFnName: `persist`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `legacy-key`,
+    createdAt: new Date(0).toISOString(),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    version: 1,
+  }
+
+  const decoded = serializer.deserialize(JSON.stringify(legacyWire))
+  expect(decoded.outboxPhase).toBeUndefined()
+  const rewritten = JSON.parse(serializer.serialize(decoded)) as Record<
+    string,
+    unknown
+  >
+  expect(rewritten).not.toHaveProperty(`outboxPhase`)
+  expect(rewritten).toMatchObject(legacyWire)
+  expect(rewritten).toHaveProperty(`valueEncoding`, 3)
+})
+
+it(`round-trips a mutationFn-fulfilled deletion-pending record`, () => {
+  const serializer = new TransactionSerializer({})
+  const transaction: OfflineTransaction = {
+    id: `deletion-pending`,
+    mutationFnName: `persist`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `stable-key`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    outboxPhase: `deletion-pending`,
+    version: 1,
+  }
+
+  const encoded = serializer.serialize(transaction)
+  expect(JSON.parse(encoded)).toMatchObject({
+    id: transaction.id,
+    idempotencyKey: `stable-key`,
+    outboxPhase: `deletion-pending`,
+    valueEncoding: 3,
+    version: 1,
+  })
+  expect(serializer.deserialize(encoded)).toEqual(transaction)
+})
+
+it.each([null, false, 0, {}, `provider-pending`, `unknown`])(
+  `rejects malformed or unknown outbox phase %j`,
+  (outboxPhase) => {
+    const serializer = new TransactionSerializer({})
+    const wire = {
+      id: `invalid-phase`,
+      mutationFnName: `persist`,
+      mutations: [],
+      keys: [],
+      idempotencyKey: `stable-key`,
+      createdAt: new Date(0).toISOString(),
+      retryCount: 0,
+      nextAttemptAt: 0,
+      outboxPhase,
+      version: 1,
+    }
+    expect(() => serializer.deserialize(JSON.stringify(wire))).toThrow(
+      /Unsupported transaction outbox phase/,
+    )
+    expect(() =>
+      serializer.serialize({
+        ...wire,
+        createdAt: new Date(0),
+      } as unknown as OfflineTransaction),
+    ).toThrow(/Unsupported transaction outbox phase/)
+  },
+)
+
+it(`fails visibly with the retained native scalar transaction id`, async () => {
+  const collection = createCollection<{ id: string; due: unknown }>({
+    id: `native-scalar-missing-runtime`,
+    getKey: (row) => row.id,
+    sync: { sync: ({ markReady }) => markReady() },
+  })
+  const marker = {
+    __type: `Temporal`,
+    type: `Temporal.PlainDate`,
+    value: `2026-09-16`,
+  }
+  const wire = JSON.stringify({
+    valueEncoding: 3,
+    id: `missing-runtime`,
+    mutationFnName: `persist`,
+    mutations: [
+      {
+        globalKey: `rows:one`,
+        type: `insert`,
+        modified: { id: `one`, due: marker },
+        original: {},
+        changes: {},
+        collectionId: `rows`,
+      },
+    ],
+    keys: [`rows:one`],
+    idempotencyKey: `once`,
+    createdAt: new Date(0).toISOString(),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    metadata: { due: marker },
+    version: 1,
+  })
+  const temporalGlobal = globalThis as { Temporal?: Record<string, unknown> }
+  const previousTemporal = temporalGlobal.Temporal
+  temporalGlobal.Temporal = {}
+  const storage = new FakeStorageAdapter()
+  await storage.set(`tx:missing-runtime`, wire)
+  const outbox = new OutboxManager(storage, { rows: collection })
+
+  try {
+    expect(() =>
+      new TransactionSerializer({ rows: collection }).deserialize(wire),
+    ).toThrow(MissingTemporalConstructorError)
+    await expect(outbox.get(`missing-runtime`)).rejects.toThrow(
+      /transaction missing-runtime/,
+    )
+    await expect(outbox.getAll()).rejects.toThrow(/transaction missing-runtime/)
+    expect(storage.snapshot()).toHaveProperty(`tx:missing-runtime`, wire)
+  } finally {
+    if (previousTemporal === undefined) delete temporalGlobal.Temporal
+    else temporalGlobal.Temporal = previousTemporal
+    await collection.cleanup()
+  }
+})
+
+it(`rejects malformed native scalar markers and constructor failures`, async () => {
+  const collection = createCollection<{ id: string; due: unknown }>({
+    id: `native-scalar-invalid`,
+    getKey: (row) => row.id,
+    sync: { sync: ({ markReady }) => markReady() },
+  })
+  const serializer = new TransactionSerializer({ rows: collection })
+  const wire = (marker: unknown) =>
+    JSON.stringify({
+      valueEncoding: 3,
+      id: `invalid-native-scalar`,
+      mutationFnName: `persist`,
+      mutations: [
+        {
+          globalKey: `rows:one`,
+          type: `insert`,
+          modified: { id: `one`, due: marker },
+          original: {},
+          changes: {},
+          collectionId: `rows`,
+        },
+      ],
+      keys: [`rows:one`],
+      idempotencyKey: `once`,
+      createdAt: new Date(0).toISOString(),
+      retryCount: 0,
+      nextAttemptAt: 0,
+      version: 1,
+    })
+
+  try {
+    expect(() =>
+      serializer.deserialize(
+        wire({
+          __type: `Temporal`,
+          type: `Temporal.Calendar`,
+          value: `iso8601`,
+        }),
+      ),
+    ).toThrow(`Corrupted Temporal marker: invalid type field`)
+    expect(() =>
+      serializer.deserialize(
+        wire({ __type: `Temporal`, type: `Temporal.PlainDate` }),
+      ),
+    ).toThrow(`Corrupted Temporal marker: missing value field`)
+
+    const temporalGlobal = globalThis as {
+      Temporal?: Record<string, unknown>
+    }
+    const previousTemporal = temporalGlobal.Temporal
+    const constructorFailure = new Error(`constructor rejected value`)
+    temporalGlobal.Temporal = {
+      PlainDate: {
+        from: () => {
+          throw constructorFailure
+        },
+      },
+    }
+    try {
+      expect(() =>
+        serializer.deserialize(
+          wire({
+            __type: `Temporal`,
+            type: `Temporal.PlainDate`,
+            value: `not-a-date`,
+          }),
+        ),
+      ).toThrow(constructorFailure)
+    } finally {
+      if (previousTemporal === undefined) delete temporalGlobal.Temporal
+      else temporalGlobal.Temporal = previousTemporal
+    }
+  } finally {
+    await collection.cleanup()
+  }
+})
diff --git a/packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts b/packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts
index dbb6f3bc39..85ad378054 100644
--- a/packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts
+++ b/packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts
@@ -1,17 +1,19 @@
-import { runInNewContext } from 'node:vm'
 import fc from 'fast-check'
 import { createCollection, createTransaction } from '@tanstack/db'
 import { expect, it, vi } from 'vitest'
 import { NonRetriableError } from '../src/types'
 import { OutboxManager } from '../src/outbox/OutboxManager'
-import { KeyScheduler } from '../src/executor/KeyScheduler'
-import { TransactionExecutor } from '../src/executor/TransactionExecutor'
-import { DefaultRetryPolicy } from '../src/retry/RetryPolicy'
 import {
   oracleReplayRequested,
   oracleReplayTest,
 } from '../../db/tests/oracle-config'
-import { FakeStorageAdapter, createTestOfflineEnvironment } from './harness'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import {
+  FakeStorageAdapter,
+  createTestOfflineEnvironment,
+  gate,
+  turn,
+} from './harness'
 import {
   atOracleCheckpoint,
   captureUnhandledRejections,
@@ -20,11 +22,7 @@ import {
 import { oracleLaneOptions, readOfflineOracleConfig } from './oracle-config'
 import type { TestItem } from './harness'
 import type { Transaction } from '@tanstack/db'
-import type {
-  OfflineConfig,
-  OfflineTransaction,
-  TransactionSignaler,
-} from '../src/types'
+import type { OfflineConfig } from '../src/types'
 
 /**
  * # Does each offline transaction settle only from its own durable history?
@@ -176,16 +174,6 @@ const admissionOracle = readOfflineOracleConfig({
   defaultRuns: 10,
 })
 
-function gate() {
-  let resolve!: () => void
-  const promise = new Promise<void>((done) => {
-    resolve = done
-  })
-  return { promise, resolve }
-}
-
-const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
-
 const localRows = (rows: Iterable<TestItem>) =>
   [...rows]
     .map(({ id, value, completed, updatedAt }) => ({
@@ -203,6 +191,24 @@ function expectLocalRows(
   expect(localRows(actual)).toEqual(localRows(expected))
 }
 
+// The model of public Collection rows after a restored snapshot settles. The
+// server rows are the durable provider results so far, and each queued restored
+// row is still visible. Restoration holds pending snapshots. Core rollback
+// cancels conflicting pending peers, but not disjoint peers or their
+// independently queued work.
+function expectedRestoredLocalRows(
+  rows: Array<TestItem>,
+  sharedKey: boolean,
+  failedIndex: number,
+  index: number,
+  expectedServer: Map<string, TestItem>,
+): Map<string, TestItem> {
+  const pending = sharedKey && index >= failedIndex ? [] : rows.slice(index + 1)
+  const expected = new Map(expectedServer)
+  for (const row of pending) expected.set(row.id, row)
+  return expected
+}
+
 /**
  * How a generated transaction commits: by `commit()`, by auto-commit with the
  * option set or omitted, or as an `OfflineAction`, which always auto-commits.
@@ -937,12 +943,13 @@ it.each([
         await turn()
         if (index !== failedIndex)
           expectedServer.set(rows[index]!.id, rows[index]!)
-        // Restoration holds pending snapshots. Core rollback cancels conflicting
-        // pending peers, but not disjoint peers or their independently queued work.
-        const pending =
-          sharedKey && index >= failedIndex ? [] : rows.slice(index + 1)
-        const expected = new Map(expectedServer)
-        for (const row of pending) expected.set(row.id, row)
+        const expected = expectedRestoredLocalRows(
+          rows,
+          sharedKey,
+          failedIndex,
+          index,
+          expectedServer,
+        )
         expectLocalRows(env.collection.toArray, expected.values())
         if (index === failedIndex) {
           const wrong = localRows(env.collection.toArray)
@@ -1360,587 +1367,344 @@ oracleReplayTest(it, RETRY_DECISION_PROPERTY).each([undefined])(
   checkRetryDecision,
 )
 
-// The no-hook run is the reference for existing retry timing. With the same
-// retry count, ordinary Error, disabled jitter, and clock, adding a true hook
-// may change the decision path but not the durable deadline. Comparing outbox
-// records leaves the choice of delay implementation to production.
-it(`preserves the default retry deadline when the hook agrees`, async () => {
-  const fixedNow = 1_000_000
-  const providerError = new Error(`temporary connection failure`)
-  const hookCalls: Array<{ error: Error; retryCount: number }> = []
-  const clock = vi.spyOn(Date, `now`).mockReturnValue(fixedNow)
-  const signaler: TransactionSignaler = {
-    isOfflineEnabled: true,
-    isOnline: () => true,
-    resolveTransaction: () => {
-      throw new Error(`failed provider cannot resolve`)
-    },
-    rejectTransaction: () => {
-      throw new Error(`ordinary failure should retry`)
-    },
-    registerRestorationTransaction: () => {},
-  }
-  const observeDeadline = async (withHook: boolean): Promise<number> => {
-    const outbox = new OutboxManager(new FakeStorageAdapter(), {})
-    const executor = new TransactionExecutor(
-      new KeyScheduler(),
-      outbox,
-      {
-        collections: {},
-        mutationFns: {
-          syncData: () => Promise.reject(providerError),
-        },
-        jitter: false,
-        ...(withHook
-          ? {
-              shouldRetry: (error: Error, retryCount: number) => {
-                hookCalls.push({ error, retryCount })
-                return true
-              },
-            }
-          : {}),
-      },
-      signaler,
-    )
-    const transaction: OfflineTransaction = {
-      id: withHook ? `hooked-deadline` : `default-deadline`,
-      mutationFnName: `syncData`,
-      mutations: [],
-      keys: [],
-      idempotencyKey: withHook ? `hooked-deadline` : `default-deadline`,
-      createdAt: new Date(0),
-      retryCount: 0,
-      nextAttemptAt: 0,
-      version: 1,
-    }
-    await outbox.add(transaction)
-    try {
-      await atOracleCheckpoint(
-        executor.execute(transaction),
-        `retry deadline ${withHook ? `with` : `without`} hook`,
-      )
-      const stored = await outbox.get(transaction.id)
-      expect(stored).toMatchObject({ retryCount: 1 })
-      return stored!.nextAttemptAt
-    } finally {
-      executor.pause()
-    }
-  }
+// A storage row may be visible before its write acknowledges. The independent
+// model keeps visibility, acknowledgement, and provider eligibility separate:
+// the peer cannot run before both its write and the failed head's deletion
+// acknowledge. It does not copy the executor's queue or cleanup machinery.
+type StartedWriteCut =
+  | { stored: false; acknowledgement: `held` }
+  | { stored: true; acknowledgement: `held` | `fulfilled` }
+  | { stored: false; acknowledgement: `rejected` }
 
-  try {
-    const defaultDeadline = await observeDeadline(false)
-    const hookedDeadline = await observeDeadline(true)
-    expect(defaultDeadline).toBeGreaterThan(fixedNow)
-    expect(hookedDeadline).toBe(defaultDeadline)
-    expect(hookCalls).toEqual([{ error: providerError, retryCount: 0 }])
-    expect(hookCalls[0]?.error).toBe(providerError)
-  } finally {
-    clock.mockRestore()
+function expectedStartedPeer(
+  cut: StartedWriteCut,
+  headRemoved: boolean,
+): {
+  visible: boolean
+  caller: `pending` | `rejected`
+  providerEligible: boolean
+} {
+  return {
+    visible: cut.stored,
+    caller: cut.acknowledgement === `rejected` ? `rejected` : `pending`,
+    providerEligible: cut.acknowledgement === `fulfilled` && headRemoved,
   }
-})
+}
+
+// Legal grammar: the head provider is held while a peer starts a public commit.
+// The peer write acknowledges before the fault, remains held before storage, or
+// becomes visible before its acknowledgement. A held write may acknowledge
+// during the head's terminal marker or after head deletion; one write rejects
+// before changing storage. Throwing and invalid hooks cross every write cut.
+// The driver compares both public promises, Collection rows, exact outbox IDs,
+// and provider calls before and after the two acknowledgements. A successful
+// peer must finish in this executor; this is not a fresh-executor replay law.
+it.each([
+  [`throw`, `durable-before`],
+  [`throw`, `late-during-marker`],
+  [`throw`, `visible-before-ack`],
+  [`throw`, `visible-across-cleanup`],
+  [`throw`, `late-after-cleanup`],
+  [`throw`, `failure-before-store`],
+  [`invalid`, `durable-before`],
+  [`invalid`, `late-during-marker`],
+  [`invalid`, `visible-before-ack`],
+  [`invalid`, `visible-across-cleanup`],
+  [`invalid`, `late-after-cleanup`],
+  [`invalid`, `failure-before-store`],
+] as const)(
+  `settles a started peer across %s hook failure and %s write`,
+  async (failureKind, peerWriteCase) => {
+    const providerError = new Error(`HTTP 401 Unauthorized`)
+    const hookError = new Error(`retry decision failed`)
+    const storageError = new Error(`peer outbox write failed`)
+    const providerEntered = gate()
+    const releaseProvider = gate()
+    const peerWriteEntered = gate()
+    const peerRowStored = gate()
+    const releasePeerWrite = gate()
+    const peerWriteSettled = gate()
+    const hookEntered = gate()
+    const terminalMarkerEntered = gate()
+    const releaseTerminalMarker = gate()
+    const peerProviderEntered = gate()
+    const releasePeerProvider = gate()
+    const providerCalls: Array<string> = []
+    let headId = ``
+    let peerId = ``
+    let holdPeerWrite = peerWriteCase !== `durable-before`
 
-// Two ordinary provider failures are a legal history. The first explicit
-// answer keeps the head. On the second failure, false removes it while
-// undefined delegates to the default and keeps it for a third attempt. The
-// distinct Errors expose a stale-error decision at the second durable cut.
-it.each([`terminal`, `defer`] as const)(
-  `passes the second error and retry count to the decision hook (%s)`,
-  async (secondDecision) => {
-    const firstError = new Error(`temporary first failure`)
-    const secondError = new Error(`temporary second failure`)
-    const firstRetryStored = gate()
-    const secondDecisionStored = gate()
-    const hookCalls: Array<{ error: Error; retryCount: number }> = []
-    let transactionId = ``
-    class DecisionStorage extends FakeStorageAdapter {
+    class ControlledStorage extends FakeStorageAdapter {
       override async set(key: string, value: string): Promise<void> {
+        if (
+          key === `tx:${headId}` &&
+          (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
+            `rejection-pending`
+        ) {
+          terminalMarkerEntered.resolve()
+          await releaseTerminalMarker.promise
+        }
+        if (key === `tx:${peerId}`) {
+          peerWriteEntered.resolve()
+          if (
+            (peerWriteCase === `visible-before-ack` ||
+              peerWriteCase === `visible-across-cleanup`) &&
+            holdPeerWrite
+          ) {
+            await super.set(key, value)
+            peerRowStored.resolve()
+            await releasePeerWrite.promise
+            holdPeerWrite = false
+            peerWriteSettled.resolve()
+            return
+          }
+          if (holdPeerWrite) {
+            await releasePeerWrite.promise
+            holdPeerWrite = false
+            if (peerWriteCase === `failure-before-store`) {
+              peerWriteSettled.resolve()
+              throw storageError
+            }
+          }
+        }
         await super.set(key, value)
-        if (key !== `tx:${transactionId}`) return
-        const record = JSON.parse(value) as { retryCount: number }
-        if (record.retryCount === 1) firstRetryStored.resolve()
-        if (record.retryCount === 2) secondDecisionStored.resolve()
-      }
-
-      override async delete(key: string): Promise<void> {
-        await super.delete(key)
-        if (key === `tx:${transactionId}`) secondDecisionStored.resolve()
+        if (key === `tx:${peerId}`) {
+          peerRowStored.resolve()
+          peerWriteSettled.resolve()
+        }
       }
     }
-    const config = {
-      jitter: false,
-      shouldRetry: (error: Error, retryCount: number): boolean | undefined => {
-        hookCalls.push({ error, retryCount })
-        if (retryCount === 0) return true
-        return secondDecision === `terminal` ? false : undefined
-      },
-    }
+
+    const storage = new ControlledStorage()
     const env = createTestOfflineEnvironment({
-      storage: new DecisionStorage(),
-      config,
-      mutationFn: (params) => {
-        const attempt = env.mutationCalls.length
-        if (attempt === 1) throw firstError
-        if (attempt === 2) throw secondError
-        env.applyMutations(params.transaction.mutations)
+      storage,
+      config: {
+        shouldRetry: (): boolean | undefined => {
+          hookEntered.resolve()
+          if (failureKind === `throw`) throw hookError
+          return null as unknown as boolean | undefined
+        },
+      },
+      mutationFn: async ({ transaction }) => {
+        providerCalls.push(transaction.id)
+        if (transaction.id === headId) {
+          providerEntered.resolve()
+          await releaseProvider.promise
+          throw providerError
+        }
+        peerProviderEntered.resolve()
+        await releasePeerProvider.promise
+        env.applyMutations(transaction.mutations)
       },
     })
     const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let commitStatus: unknown = `pending`
-    let waitStatus: unknown = `pending`
+    const errorLog = vi.spyOn(console, `error`).mockImplementation(() => {})
     const observed: Array<Promise<void>> = []
+    const outcomes = new Map<string, { commit: unknown; persisted: unknown }>()
     let hasPrimaryFailure = false
-    try {
-      await env.waitForLeader()
+
+    function createObservedTransaction(rowId: string, updatedAt: number) {
       const tx = env.executor.createOfflineTransaction({
         mutationFnName: env.mutationFnName,
         autoCommit: false,
       })
-      transactionId = tx.id
-      const observedWait = env.executor
-        .waitForTransactionCompletion(tx.id)
-        .then(
-          () => {
-            waitStatus = `fulfilled`
-          },
-          (error: unknown) => {
-            waitStatus = error
-          },
-        )
-      tx.mutate(() =>
+      const transaction = tx.mutate(() =>
         env.collection.insert({
-          id: `retry-count`,
-          value: `pending`,
+          id: rowId,
+          value: rowId,
           completed: false,
-          updatedAt: new Date(0),
+          updatedAt: new Date(updatedAt),
         }),
       )
-      const observedCommit = tx.commit().then(
+      const outcome = {
+        commit: `pending` as unknown,
+        persisted: `pending` as unknown,
+      }
+      outcomes.set(tx.id, outcome)
+      const commit = tx.commit().then(
         () => {
-          commitStatus = `fulfilled`
+          outcome.commit = `fulfilled`
         },
         (error: unknown) => {
-          commitStatus = error
+          outcome.commit = error
         },
       )
-      observed.push(observedCommit, observedWait)
-      await atOracleCheckpoint(firstRetryStored.promise, `first retry stored`)
-      expect((await env.executor.peekOutbox())[0]?.retryCount).toBe(1)
-      expect(commitStatus).toBe(`pending`)
-      expect(waitStatus).toBe(`pending`)
-
-      await turn()
-      env.executor.getOnlineDetector().notifyOnline()
-      await atOracleCheckpoint(
-        secondDecisionStored.promise,
-        `second decision stored`,
+      const persisted = transaction.when(`settled`).then(
+        () => {
+          outcome.persisted = `fulfilled`
+        },
+        (error: unknown) => {
+          outcome.persisted = error
+        },
       )
-      await turn()
-      expect(hookCalls).toEqual([
-        { error: firstError, retryCount: 0 },
-        { error: secondError, retryCount: 1 },
-      ])
-      expect(hookCalls[0]?.error).toBe(firstError)
-      expect(hookCalls[1]?.error).toBe(secondError)
-      expect(env.mutationCalls).toHaveLength(2)
-      if (secondDecision === `defer`) {
-        expect(await env.executor.peekOutbox()).toMatchObject([
-          { id: tx.id, retryCount: 2 },
-        ])
-        expect(commitStatus).toBe(`pending`)
-        expect(waitStatus).toBe(`pending`)
-        env.executor.getOnlineDetector().notifyOnline()
-        await atOracleCheckpoint(
-          Promise.all([observedCommit, observedWait]),
-          `delegated second retry settled caller`,
-        )
-        expect(env.mutationCalls).toHaveLength(3)
-        expect(commitStatus).toBe(`fulfilled`)
-        expect(waitStatus).toBe(`fulfilled`)
-        expect(await env.executor.peekOutbox()).toEqual([])
-      } else {
-        expect(await env.executor.peekOutbox()).toEqual([])
+      observed.push(commit, persisted)
+      return { id: tx.id, commit, persisted, outcome }
+    }
+
+    try {
+      await env.waitForLeader()
+      const head = createObservedTransaction(`head`, 0)
+      headId = head.id
+      await atOracleCheckpoint(providerEntered.promise, `head provider entered`)
+
+      const peer = createObservedTransaction(`peer`, 1)
+      peerId = peer.id
+      await atOracleCheckpoint(peerWriteEntered.promise, `peer write started`)
+      if (peerWriteCase === `durable-before`)
         await atOracleCheckpoint(
-          Promise.all([observedCommit, observedWait]),
-          `second failure settled caller`,
+          peerWriteSettled.promise,
+          `peer durable before fault`,
         )
-        expect(commitStatus).toBe(secondError)
-        expect(waitStatus).toBe(secondError)
-      }
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
       if (
-        transactionId &&
-        (commitStatus === `pending` || waitStatus === `pending`)
+        peerWriteCase === `visible-before-ack` ||
+        peerWriteCase === `visible-across-cleanup`
       )
-        env.executor.rejectTransaction(
-          transactionId,
-          new Error(`retry count oracle cleanup`),
+        await atOracleCheckpoint(
+          peerRowStored.promise,
+          `peer visible before ack`,
         )
-      await cleanupOfflineOracle(
-        [
-          () => Promise.all(observed),
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-          () => warning.mockRestore(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
 
-// The same-Error contract is based on the thrown value, not its realm. A foreign
-// Error with a status-bearing field must reach the public hook unchanged. The
-// 401 is a boundary control: the default decision would terminate it, while
-// the hook's true answer retains the row for a later successful attempt.
-it(`passes a cross-realm Error unchanged to shouldRetry`, async () => {
-  const providerError = runInNewContext(
-    `Object.assign(new Error('HTTP 401 Unauthorized'), { status: 401 })`,
-  ) as Error & { status: number }
-  expect(providerError instanceof Error).toBe(false)
-  const hookEntered = gate()
-  const retryStored = gate()
-  let transactionId = ``
-  let hookError: Error | undefined
-  class RetryStorage extends FakeStorageAdapter {
-    override async set(key: string, value: string): Promise<void> {
-      await super.set(key, value)
-      if (key !== `tx:${transactionId}`) return
-      if ((JSON.parse(value) as { retryCount: number }).retryCount === 1)
-        retryStored.resolve()
-    }
-  }
-  const env = createTestOfflineEnvironment({
-    storage: new RetryStorage(),
-    config: {
-      jitter: false,
-      shouldRetry: (error, retryCount) => {
-        expect(retryCount).toBe(0)
-        hookError = error
-        hookEntered.resolve()
-        return (error as Error & { status?: number }).status === 401
-      },
-    },
-    mutationFn: (params) => {
-      if (params.attempt === 1) throw providerError
-      env.applyMutations(params.transaction.mutations)
-    },
-  })
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  let commitResult: unknown = `pending`
-  let observedCommit: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const tx = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    transactionId = tx.id
-    tx.mutate(() =>
-      env.collection.insert({
-        id: `foreign-error-retry`,
-        value: `pending`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    observedCommit = tx.commit().then(
-      () => {
-        commitResult = `fulfilled`
-      },
-      (error: unknown) => {
-        commitResult = error
-      },
-    )
-    await atOracleCheckpoint(hookEntered.promise, `foreign Error reached hook`)
-    expect(hookError).toBe(providerError)
-    expect((hookError as Error & { status?: number }).status).toBe(401)
-    await atOracleCheckpoint(retryStored.promise, `foreign Error retry stored`)
-    expect((await env.executor.peekOutbox())[0]?.retryCount).toBe(1)
-    expect(commitResult).toBe(`pending`)
-    env.executor.getOnlineDetector().notifyOnline()
-    await atOracleCheckpoint(observedCommit, `foreign Error retry settled`)
-    expect(commitResult).toBe(`fulfilled`)
-    expect(env.mutationCalls).toHaveLength(2)
-    expect(await env.executor.peekOutbox()).toEqual([])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    if (transactionId && commitResult === `pending`)
-      env.executor.rejectTransaction(
-        transactionId,
-        new Error(`foreign Error oracle cleanup`),
+      releaseProvider.resolve()
+      await atOracleCheckpoint(hookEntered.promise, `retry hook failed`)
+      await atOracleCheckpoint(
+        terminalMarkerEntered.promise,
+        `terminal marker held`,
       )
-    await cleanupOfflineOracle(
-      [
-        () => observedCommit,
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-        () => warning.mockRestore(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-// The public hook always receives an Error, including when the named mutation
-// function rejects with a primitive or object. Returning false distinguishes
-// this hook decision from the default retry for these inputs. The public commit
-// rejection must be the same converted Error observed by the hook.
-it.each([
-  { label: `string`, rejection: `network disconnected` },
-  { label: `object`, rejection: { status: 401 } },
-])(
-  `passes a converted Error to shouldRetry for a $label rejection`,
-  async ({ rejection }) => {
-    const hookCalls: Array<{ error: Error; retryCount: number }> = []
-    const env = createTestOfflineEnvironment({
-      config: {
-        shouldRetry: (error, retryCount) => {
-          hookCalls.push({ error, retryCount })
-          return false
-        },
-      },
-      mutationFn: () => Promise.reject(rejection),
-    })
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let transactionId = ``
-    let observedCommit: Promise<void> | undefined
-    let commitStatus: unknown = `pending`
-    let hasPrimaryFailure = false
-    try {
-      await env.waitForLeader()
-      const tx = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      transactionId = tx.id
-      tx.mutate(() =>
-        env.collection.insert({
-          id: `converted-error`,
-          value: `pending`,
-          completed: false,
-          updatedAt: new Date(0),
-        }),
-      )
-      observedCommit = tx.commit().then(
-        () => {
-          commitStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          commitStatus = error
-        },
-      )
-      await atOracleCheckpoint(
-        observedCommit,
-        `non-Error rejection settled caller`,
+      const atFault = expectedStartedPeer(
+        peerWriteCase === `durable-before`
+          ? { stored: true, acknowledgement: `fulfilled` }
+          : peerWriteCase === `visible-before-ack` ||
+              peerWriteCase === `visible-across-cleanup`
+            ? { stored: true, acknowledgement: `held` }
+            : { stored: false, acknowledgement: `held` },
+        false,
       )
-      expect(hookCalls).toEqual([{ error: expect.any(Error), retryCount: 0 }])
-      expect(hookCalls[0]?.error).not.toBe(rejection)
-      expect(commitStatus).toBe(hookCalls[0]?.error)
-      expect(await env.executor.peekOutbox()).toEqual([])
-      expect(env.collection.toArray).toEqual([])
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      if (transactionId && commitStatus === `pending`)
-        env.executor.rejectTransaction(
-          transactionId,
-          new Error(`non-Error rejection oracle cleanup`),
-        )
-      await cleanupOfflineOracle(
-        [
-          () => observedCommit,
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-          () => warning.mockRestore(),
-        ],
-        hasPrimaryFailure,
+      expect(head.outcome.commit).toBe(`pending`)
+      expect(peer.outcome.commit).toBe(atFault.caller)
+      expect(peer.outcome.persisted).toBe(atFault.caller)
+      expect(providerCalls).toEqual([head.id])
+      expect(atFault.providerEligible).toBe(false)
+      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual(
+        atFault.visible ? [head.id, peer.id] : [head.id],
       )
-    }
-  },
-)
+      expect(env.collection.toArray.map(({ id }) => id)).toEqual([
+        `head`,
+        `peer`,
+      ])
 
-// A configuration failure is observed through public commit(), not only the
-// executor's internal batch promise. The provider error is a 401, so ignoring
-// the hook would reject with the provider error. A Promise is invalid whether
-// it fulfills or rejects; its later rejection must stay within this row-local
-// failure boundary rather than become an unhandled process rejection. A fresh
-// executor over the same storage must skip the failed row.
-it.each([
-  `throw`,
-  `null`,
-  `zero`,
-  `promise-fulfilled`,
-  `promise-rejected`,
-] as const)(
-  `rejects public commit when shouldRetry fails (%s)`,
-  async (failureKind) => {
-    const providerError = new Error(`HTTP 401 Unauthorized`)
-    const hookError = new Error(`retry decision unavailable`)
-    const asyncError = new Error(`async retry decision failed`)
-    const { rejections: unhandled, cleanup: cleanupUnhandled } =
-      captureUnhandledRejections()
-    const providerEntered = gate()
-    const releaseProvider = gate()
-    const terminalMarkerStored = gate()
-    const retryRecordStored = gate()
-    let hookCalls = 0
-    let transactionId = ``
-    class DecisionStorage extends FakeStorageAdapter {
-      override async set(key: string, value: string): Promise<void> {
-        await super.set(key, value)
-        if (key !== `tx:${transactionId}`) return
-        const record = JSON.parse(value) as {
-          outboxPhase?: string
-          retryCount: number
-        }
-        if (record.outboxPhase === `rejection-pending`)
-          terminalMarkerStored.resolve()
-        if (record.retryCount === 1) retryRecordStored.resolve()
+      const writeAfterCleanup =
+        peerWriteCase === `late-after-cleanup` ||
+        peerWriteCase === `visible-across-cleanup`
+      if (!writeAfterCleanup) {
+        releasePeerWrite.resolve()
+        await atOracleCheckpoint(peerWriteSettled.promise, `peer write settled`)
       }
-    }
-    const config = {
-      jitter: false,
-      shouldRetry: (
-        _error: Error,
-        _retryCount: number,
-      ): boolean | undefined => {
-        hookCalls++
-        if (failureKind === `throw`) throw hookError
-        if (failureKind === `null`)
-          return null as unknown as boolean | undefined
-        if (failureKind === `zero`) return 0 as unknown as boolean | undefined
-        // An async hook returns a Promise. Neither outcome is a synchronous
-        // retry decision, and a rejection must still be observed.
-        return (failureKind === `promise-rejected`
-          ? Promise.reject(asyncError)
-          : Promise.resolve(true)) as unknown as boolean | undefined
-      },
-    }
-    const storage = new DecisionStorage()
-    const env = createTestOfflineEnvironment({
-      storage,
-      config,
-      mutationFn: async () => {
-        providerEntered.resolve()
-        await releaseProvider.promise
-        throw providerError
-      },
-    })
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    let restarted: ReturnType<typeof createTestOfflineEnvironment> | undefined
-    let commitStatus: unknown = `pending`
-    let hasPrimaryFailure = false
-    try {
-      await env.waitForLeader()
-      const tx = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      transactionId = tx.id
-      tx.mutate(() =>
-        env.collection.insert({
-          id: `invalid-decision`,
-          value: `pending`,
-          completed: false,
-          updatedAt: new Date(0),
-        }),
-      )
-      const observedCommit = tx.commit().then(
-        () => {
-          commitStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          commitStatus = error
-        },
+      const afterWrite = expectedStartedPeer(
+        peerWriteCase === `failure-before-store`
+          ? { stored: false, acknowledgement: `rejected` }
+          : writeAfterCleanup
+            ? peerWriteCase === `visible-across-cleanup`
+              ? { stored: true, acknowledgement: `held` }
+              : { stored: false, acknowledgement: `held` }
+            : { stored: true, acknowledgement: `fulfilled` },
+        false,
       )
-      await atOracleCheckpoint(providerEntered.promise, `provider entered`)
-      const [admitted] = await env.executor.peekOutbox()
-      expect(admitted?.retryCount).toBe(0)
-      releaseProvider.resolve()
-      // The first durable decision must be terminal. A mistaken implementation
-      // that awaits a Promise answer stores a retry record instead of a marker.
-      const storedDecision = await atOracleCheckpoint(
-        Promise.race([
-          terminalMarkerStored.promise.then(() => `terminal` as const),
-          retryRecordStored.promise.then(() => `retry` as const),
-        ]),
-        `invalid decision recorded`,
+      if (peerWriteCase === `failure-before-store`) {
+        await atOracleCheckpoint(peer.commit, `failed peer commit settled`)
+        await atOracleCheckpoint(
+          peer.persisted,
+          `failed peer persistence settled`,
+        )
+        expect(peer.outcome.commit).toBe(storageError)
+        expect(peer.outcome.persisted).toBe(storageError)
+      } else {
+        await turn()
+        expect(peer.outcome.commit).toBe(afterWrite.caller)
+        expect(peer.outcome.persisted).toBe(afterWrite.caller)
+      }
+      expect(afterWrite.providerEligible).toBe(false)
+      expect(providerCalls).toEqual([head.id])
+      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual(
+        afterWrite.visible ? [head.id, peer.id] : [head.id],
       )
-      expect(storedDecision).toBe(`terminal`)
+
+      releaseTerminalMarker.resolve()
+      await atOracleCheckpoint(head.commit, `failed head settled`)
       await atOracleCheckpoint(
-        observedCommit,
-        `invalid decision settled caller`,
+        head.persisted,
+        `failed head persistence settled`,
       )
+      if (failureKind === `throw`) {
+        expect(head.outcome.commit).toBe(hookError)
+        expect(head.outcome.persisted).toBe(hookError)
+      } else {
+        expect(head.outcome.commit).toBeInstanceOf(TypeError)
+        expect(head.outcome.persisted).toBeInstanceOf(TypeError)
+      }
 
-      if (failureKind === `throw`) expect(commitStatus).toBe(hookError)
-      else {
-        expect(commitStatus).toBeInstanceOf(TypeError)
-        expect(commitStatus).not.toBe(providerError)
+      if (writeAfterCleanup) {
+        // A visible row without write acknowledgement cannot run even after
+        // the failed head is removed.
+        expect(providerCalls).toEqual([head.id])
+        expect(peer.outcome.commit).toBe(`pending`)
+        expect(peer.outcome.persisted).toBe(`pending`)
+        expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual(
+          peerWriteCase === `visible-across-cleanup` ? [peer.id] : [],
+        )
+        releasePeerWrite.resolve()
+        await atOracleCheckpoint(
+          peerWriteSettled.promise,
+          `late peer write settled`,
+        )
       }
-      expect(hookCalls).toBe(1)
-      const remaining = await env.executor.peekOutbox()
-      await turn()
-      expect(unhandled).toEqual([])
-      expect(env.executor.getRunningCount()).toBe(0)
-      expect(env.mutationCalls).toHaveLength(1)
-      expect(env.collection.toArray).toEqual([])
 
-      env.executor.dispose()
-      restarted = createTestOfflineEnvironment({
-        storage,
-        mutationFn: (params) => {
-          restarted!.applyMutations(params.transaction.mutations)
-        },
-      })
-      await restarted.waitForLeader()
-      const fresh = restarted.executor.createOfflineTransaction({
-        mutationFnName: restarted.mutationFnName,
-        autoCommit: false,
-      })
-      fresh.mutate(() =>
-        restarted!.collection.insert({
-          id: `after-hook-failure`,
-          value: `fresh`,
-          completed: false,
-          updatedAt: new Date(1),
-        }),
-      )
-      await atOracleCheckpoint(fresh.commit(), `fresh work after hook failure`)
-      // The new transaction proves that restart has passed the FIFO head.
-      // A retained failed row would have called the provider before this one.
-      expect(
-        restarted.mutationCalls.map(({ transaction: { id } }) => id),
-      ).toEqual([fresh.id])
-      expect(remaining).toEqual([])
-      expect(await restarted.executor.peekOutbox()).toEqual([])
-      expect(restarted.collection.toArray.map(({ id }) => id)).toEqual([
-        `after-hook-failure`,
-      ])
+      if (peerWriteCase === `failure-before-store`) {
+        expect(providerCalls).toEqual([head.id])
+        expect(await env.executor.peekOutbox()).toEqual([])
+        expect(env.collection.toArray).toEqual([])
+      } else {
+        const firstPeerEvent = await atOracleCheckpoint(
+          Promise.race([
+            peerProviderEntered.promise.then(() => `provider` as const),
+            peer.commit.then(() => `settled` as const),
+          ]),
+          `peer provider or early settlement`,
+        )
+        expect(firstPeerEvent).toBe(`provider`)
+        expect(peer.outcome.commit).toBe(`pending`)
+        expect(peer.outcome.persisted).toBe(`pending`)
+        expect(providerCalls).toEqual([head.id, peer.id])
+        expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+          peer.id,
+        ])
+        releasePeerProvider.resolve()
+        await atOracleCheckpoint(peer.commit, `peer commit settled`)
+        await atOracleCheckpoint(peer.persisted, `peer persistence settled`)
+        expect(peer.outcome.commit).toBe(`fulfilled`)
+        expect(peer.outcome.persisted).toBe(`fulfilled`)
+        expect(providerCalls).toEqual([head.id, peer.id])
+        expect(await env.executor.peekOutbox()).toEqual([])
+        expect(env.collection.toArray.map(({ id }) => id)).toEqual([`peer`])
+      }
     } catch (error) {
       hasPrimaryFailure = true
       throw error
     } finally {
       releaseProvider.resolve()
-      if (transactionId && commitStatus === `pending`)
-        env.executor.rejectTransaction(
-          transactionId,
-          new Error(`invalid decision oracle cleanup`),
-        )
+      releasePeerWrite.resolve()
+      releaseTerminalMarker.resolve()
+      releasePeerProvider.resolve()
+      const cleanupError = new Error(`started-peer oracle cleanup`)
+      for (const [id, outcome] of outcomes)
+        if (outcome.commit === `pending` || outcome.persisted === `pending`)
+          env.executor.rejectTransaction(id, cleanupError)
       await cleanupOfflineOracle(
         [
+          () => Promise.all(observed),
           () => env.executor.dispose(),
-          () => restarted?.executor.dispose(),
           () => env.collection.cleanup(),
-          () => restarted?.collection.cleanup(),
           () => warning.mockRestore(),
-          () => cleanupUnhandled(),
+          () => errorLog.mockRestore(),
         ],
         hasPrimaryFailure,
       )
@@ -1948,2338 +1712,269 @@ it.each([
   },
 )
 
-// The model treats an acknowledged peer write as queued work. The hook fault
-// belongs to the head row; a peer admitted before or during terminal cleanup
-// stays pending until the head's deletion acknowledges and its provider runs.
-// This relation does not copy the executor's queue or cleanup machinery.
-function expectedHookFaultPeerAtHeldCleanup(): {
-  durable: true
-  outcome: `pending`
-} {
-  return { durable: true, outcome: `pending` }
-}
-
-function observedFaultAdmissionOutcome(value: unknown) {
-  if (value instanceof Error) return `rejected`
-  return value
-}
-
-// Legal history: the FIFO head enters its named mutation function, one peer
-// becomes durable, then the hook throws or returns an invalid result. Storage
-// holds the terminal marker read, write, or deletion while a second public commit
-// joins the queue. The held cut compares settlement, exact outbox contents,
-// provider calls, and optimistic rows. After deletion, both peers must run in
-// FIFO order in this executor. The held Promise rejects only after both peers
-// settle, so its later failure must not escape as an unhandled process
-// rejection. No storage write fails.
-it.each([
-  [`throw`, `marker`],
-  [`throw`, `read`],
-  [`throw`, `deletion`],
-  [`invalid`, `marker`],
-  [`invalid`, `read`],
-  [`invalid`, `deletion`],
-  [`promise-late-rejection`, `deletion`],
-] as const)(
-  `admits queued work during %s hook failure and %s cleanup`,
-  async (failureKind, heldStep) => {
-    const providerError = new Error(`HTTP 401 Unauthorized`)
-    const hookError = new Error(`retry decision failed`)
-    const asyncError = new Error(`async retry decision failed`)
-    const { rejections: unhandled, cleanup: cleanupUnhandled } =
-      captureUnhandledRejections()
-    const providerEntered = gate()
-    const releaseProvider = gate()
-    const hookEntered = gate()
-    const preFaultStored = gate()
-    const terminalCleanupEntered = gate()
-    const releaseTerminalCleanup = gate()
-    const postFaultStored = gate()
-    let headId = ``
-    let preFaultId = ``
-    let postFaultId = ``
-    let holdTerminalRead = false
-    let asyncDecision: Promise<boolean> | undefined
-    let rejectAsyncDecision: ((error: Error) => void) | undefined
-    let lateDecisionRejected = false
-    const providerCalls: Array<string> = []
-
-    class HeldTerminalDeleteStorage extends FakeStorageAdapter {
-      override async get(key: string): Promise<string | null> {
-        if (heldStep === `read` && key === `tx:${headId}` && holdTerminalRead) {
-          holdTerminalRead = false
-          terminalCleanupEntered.resolve()
-          await releaseTerminalCleanup.promise
-        }
-        return super.get(key)
-      }
-
-      override async set(key: string, value: string): Promise<void> {
-        if (
-          heldStep === `marker` &&
-          key === `tx:${headId}` &&
-          (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
-            `rejection-pending`
-        ) {
-          terminalCleanupEntered.resolve()
-          await releaseTerminalCleanup.promise
-        }
-        await super.set(key, value)
-        if (key === `tx:${preFaultId}`) preFaultStored.resolve()
-        if (key === `tx:${postFaultId}`) postFaultStored.resolve()
-      }
-
-      override async delete(key: string): Promise<void> {
-        if (heldStep === `deletion` && key === `tx:${headId}`) {
-          terminalCleanupEntered.resolve()
-          await releaseTerminalCleanup.promise
+// A first-provider retry-record write fails after 2–5 transactions have been
+// admitted. Two is the marginal held-head/peer history; five checks that every
+// later peer survives. Removing the peer removes the independence question.
+// The fixture does not generate a duplicate ID or a successful retry-record
+// write, because neither has this failure premise.
+async function checkRetryRecordFailure(seed: number | undefined) {
+  await fc.assert(
+    fc.asyncProperty(fc.integer({ min: 2, max: 5 }), async (count) => {
+      const storageError = new Error(`retry record unavailable`)
+      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+      class RetryStorage extends FakeStorageAdapter {
+        failUpdate = true
+        override async set(key: string, value: string): Promise<void> {
+          if (this.failUpdate && JSON.parse(value).retryCount > 0) {
+            this.failUpdate = false
+            throw storageError
+          }
+          await super.set(key, value)
         }
-        await super.delete(key)
       }
-    }
-
-    const env = createTestOfflineEnvironment({
-      storage: new HeldTerminalDeleteStorage(),
-      config: {
-        shouldRetry: (): boolean | undefined => {
-          hookEntered.resolve()
-          holdTerminalRead = true
-          if (failureKind === `throw`) throw hookError
-          if (failureKind === `promise-late-rejection`) {
-            asyncDecision = new Promise<boolean>((_resolve, reject) => {
-              rejectAsyncDecision = reject
-            })
-            return asyncDecision as unknown as boolean | undefined
+      const entered = gate()
+      const release = gate()
+      const calls: Array<string> = []
+      const statuses: Array<unknown> = []
+      const observed: Array<Promise<void>> = []
+      const ids: Array<string> = []
+      const env = createTestOfflineEnvironment({
+        storage: new RetryStorage(),
+        config: { jitter: false },
+        mutationFn: async (params) => {
+          calls.push(params.transaction.id)
+          if (calls.length === 1) {
+            entered.resolve()
+            await release.promise
+            throw new Error(`temporary provider failure`)
           }
-          return null as unknown as boolean | undefined
-        },
-      },
-      mutationFn: async ({ transaction }) => {
-        providerCalls.push(transaction.id)
-        if (transaction.id === headId) {
-          providerEntered.resolve()
-          await releaseProvider.promise
-          throw providerError
-        }
-        env.applyMutations(transaction.mutations)
-      },
-    })
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const errorLog = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const observed: Array<Promise<void>> = []
-    const outcomes = new Map<string, unknown>()
-    let hasPrimaryFailure = false
-
-    // The production driver uses public transactions and their commit promises.
-    // Each outcome starts pending so the held checkpoint can reject early success.
-    function createObservedTransaction(rowId: string, updatedAt: number) {
-      const tx = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      tx.mutate(() =>
-        env.collection.insert({
-          id: rowId,
-          value: rowId,
-          completed: false,
-          updatedAt: new Date(updatedAt),
-        }),
-      )
-      outcomes.set(tx.id, `pending`)
-      const commit = tx.commit().then(
-        () => {
-          outcomes.set(tx.id, `fulfilled`)
-        },
-        (error: unknown) => {
-          outcomes.set(tx.id, error)
-        },
-      )
-      observed.push(commit)
-      return { id: tx.id, commit }
-    }
-
-    try {
-      await env.waitForLeader()
-      const head = createObservedTransaction(`head`, 0)
-      headId = head.id
-      await atOracleCheckpoint(providerEntered.promise, `head provider entered`)
-
-      const preFault = createObservedTransaction(`before-fault`, 1)
-      preFaultId = preFault.id
-      await atOracleCheckpoint(preFaultStored.promise, `pre-fault peer durable`)
-      releaseProvider.resolve()
-      await atOracleCheckpoint(hookEntered.promise, `retry hook failed`)
-      await atOracleCheckpoint(
-        terminalCleanupEntered.promise,
-        `terminal ${heldStep} held`,
-      )
-
-      const postFault = createObservedTransaction(`after-fault`, 2)
-      postFaultId = postFault.id
-      const firstObservation = await atOracleCheckpoint(
-        Promise.race([
-          postFault.commit.then(() => `settled` as const),
-          postFaultStored.promise.then(() => `durable` as const),
-        ]),
-        `post-fault admission or rejection`,
-      )
-
-      const before = expectedHookFaultPeerAtHeldCleanup()
-      const after = expectedHookFaultPeerAtHeldCleanup()
-      const outboxAtHeldCleanup = await env.executor.peekOutbox()
-      const durableIds = new Set(outboxAtHeldCleanup.map(({ id }) => id))
-      // The race rejects an early admission refusal at this exact cut;
-      // waiting for final cleanup alone would hide the transient violation.
-      expect(firstObservation).toBe(`durable`)
-      expect(durableIds.has(preFault.id)).toBe(before.durable)
-      expect(durableIds.has(postFault.id)).toBe(after.durable)
-      expect([...durableIds].sort()).toEqual(
-        [head.id, preFault.id, postFault.id].sort(),
-      )
-      expect(observedFaultAdmissionOutcome(outcomes.get(preFault.id))).toBe(
-        before.outcome,
-      )
-      expect(observedFaultAdmissionOutcome(outcomes.get(postFault.id))).toBe(
-        after.outcome,
-      )
-      expect(outcomes.get(head.id)).toBe(`pending`)
-      expect(
-        outboxAtHeldCleanup.find(({ id }) => id === head.id)?.outboxPhase,
-      ).toBe(heldStep === `deletion` ? `rejection-pending` : undefined)
-      expect(
-        outboxAtHeldCleanup.find(({ id }) => id === preFault.id)?.outboxPhase,
-      ).toBeUndefined()
-      expect(providerCalls).toEqual([head.id])
-      expect(env.collection.toArray.map(({ id }) => id).sort()).toEqual([
-        `after-fault`,
-        `before-fault`,
-        `head`,
-      ])
-
-      releaseTerminalCleanup.resolve()
-      await atOracleCheckpoint(head.commit, `failed head settled`)
-      if (failureKind === `throw`) expect(outcomes.get(head.id)).toBe(hookError)
-      else expect(outcomes.get(head.id)).toBeInstanceOf(TypeError)
-      await atOracleCheckpoint(preFault.commit, `pre-fault peer settled`)
-      await atOracleCheckpoint(postFault.commit, `post-fault peer settled`)
-      expect(outcomes.get(preFault.id)).toBe(`fulfilled`)
-      expect(outcomes.get(postFault.id)).toBe(`fulfilled`)
-      expect(await env.executor.peekOutbox()).toEqual([])
-      expect(providerCalls).toEqual([head.id, preFault.id, postFault.id])
-      expect(env.collection.toArray.map(({ id }) => id).sort()).toEqual([
-        `after-fault`,
-        `before-fault`,
-      ])
-      if (failureKind === `promise-late-rejection`) {
-        expect(rejectAsyncDecision).toBeTypeOf(`function`)
-        rejectAsyncDecision?.(asyncError)
-        lateDecisionRejected = true
-      }
-      await turn()
-      expect(unhandled).toEqual([])
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      if (asyncDecision && !lateDecisionRejected) {
-        // Release a mutant that wrongly awaits this test-owned Promise.
-        void asyncDecision.catch(() => {})
-        rejectAsyncDecision?.(asyncError)
-      }
-      releaseProvider.resolve()
-      releaseTerminalCleanup.resolve()
-      const cleanupError = new Error(`hook-fault admission oracle cleanup`)
-      for (const [id, outcome] of outcomes)
-        if (outcome === `pending`)
-          env.executor.rejectTransaction(id, cleanupError)
-      await cleanupOfflineOracle(
-        [
-          () => Promise.all(observed),
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-          () => warning.mockRestore(),
-          () => errorLog.mockRestore(),
-          () => cleanupUnhandled(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
-
-// A storage row may be visible before its write acknowledges. The independent
-// model keeps visibility, acknowledgement, and provider eligibility separate:
-// the peer cannot run before both its write and the failed head's deletion
-// acknowledge. It does not copy the executor's queue or cleanup machinery.
-type StartedWriteCut =
-  | { stored: false; acknowledgement: `held` }
-  | { stored: true; acknowledgement: `held` | `fulfilled` }
-  | { stored: false; acknowledgement: `rejected` }
-
-function expectedStartedPeer(
-  cut: StartedWriteCut,
-  headRemoved: boolean,
-): {
-  visible: boolean
-  caller: `pending` | `rejected`
-  providerEligible: boolean
-} {
-  return {
-    visible: cut.stored,
-    caller: cut.acknowledgement === `rejected` ? `rejected` : `pending`,
-    providerEligible: cut.acknowledgement === `fulfilled` && headRemoved,
-  }
-}
-
-// Legal grammar: the head provider is held while a peer starts a public commit.
-// The peer write acknowledges before the fault, remains held before storage, or
-// becomes visible before its acknowledgement. A held write may acknowledge
-// during the head's terminal marker or after head deletion; one write rejects
-// before changing storage. Throwing and invalid hooks cross every write cut.
-// The driver compares both public promises, Collection rows, exact outbox IDs,
-// and provider calls before and after the two acknowledgements. A successful
-// peer must finish in this executor; this is not a fresh-executor replay law.
-it.each([
-  [`throw`, `durable-before`],
-  [`throw`, `late-during-marker`],
-  [`throw`, `visible-before-ack`],
-  [`throw`, `visible-across-cleanup`],
-  [`throw`, `late-after-cleanup`],
-  [`throw`, `failure-before-store`],
-  [`invalid`, `durable-before`],
-  [`invalid`, `late-during-marker`],
-  [`invalid`, `visible-before-ack`],
-  [`invalid`, `visible-across-cleanup`],
-  [`invalid`, `late-after-cleanup`],
-  [`invalid`, `failure-before-store`],
-] as const)(
-  `settles a started peer across %s hook failure and %s write`,
-  async (failureKind, peerWriteCase) => {
-    const providerError = new Error(`HTTP 401 Unauthorized`)
-    const hookError = new Error(`retry decision failed`)
-    const storageError = new Error(`peer outbox write failed`)
-    const providerEntered = gate()
-    const releaseProvider = gate()
-    const peerWriteEntered = gate()
-    const peerRowStored = gate()
-    const releasePeerWrite = gate()
-    const peerWriteSettled = gate()
-    const hookEntered = gate()
-    const terminalMarkerEntered = gate()
-    const releaseTerminalMarker = gate()
-    const peerProviderEntered = gate()
-    const releasePeerProvider = gate()
-    const providerCalls: Array<string> = []
-    let headId = ``
-    let peerId = ``
-    let holdPeerWrite = peerWriteCase !== `durable-before`
-
-    class ControlledStorage extends FakeStorageAdapter {
-      override async set(key: string, value: string): Promise<void> {
-        if (
-          key === `tx:${headId}` &&
-          (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
-            `rejection-pending`
-        ) {
-          terminalMarkerEntered.resolve()
-          await releaseTerminalMarker.promise
-        }
-        if (key === `tx:${peerId}`) {
-          peerWriteEntered.resolve()
-          if (
-            (peerWriteCase === `visible-before-ack` ||
-              peerWriteCase === `visible-across-cleanup`) &&
-            holdPeerWrite
-          ) {
-            await super.set(key, value)
-            peerRowStored.resolve()
-            await releasePeerWrite.promise
-            holdPeerWrite = false
-            peerWriteSettled.resolve()
-            return
-          }
-          if (holdPeerWrite) {
-            await releasePeerWrite.promise
-            holdPeerWrite = false
-            if (peerWriteCase === `failure-before-store`) {
-              peerWriteSettled.resolve()
-              throw storageError
-            }
-          }
-        }
-        await super.set(key, value)
-        if (key === `tx:${peerId}`) {
-          peerRowStored.resolve()
-          peerWriteSettled.resolve()
-        }
-      }
-    }
-
-    const storage = new ControlledStorage()
-    const env = createTestOfflineEnvironment({
-      storage,
-      config: {
-        shouldRetry: (): boolean | undefined => {
-          hookEntered.resolve()
-          if (failureKind === `throw`) throw hookError
-          return null as unknown as boolean | undefined
-        },
-      },
-      mutationFn: async ({ transaction }) => {
-        providerCalls.push(transaction.id)
-        if (transaction.id === headId) {
-          providerEntered.resolve()
-          await releaseProvider.promise
-          throw providerError
-        }
-        peerProviderEntered.resolve()
-        await releasePeerProvider.promise
-        env.applyMutations(transaction.mutations)
-      },
-    })
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    const errorLog = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const observed: Array<Promise<void>> = []
-    const outcomes = new Map<string, { commit: unknown; persisted: unknown }>()
-    let hasPrimaryFailure = false
-
-    function createObservedTransaction(rowId: string, updatedAt: number) {
-      const tx = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      const transaction = tx.mutate(() =>
-        env.collection.insert({
-          id: rowId,
-          value: rowId,
-          completed: false,
-          updatedAt: new Date(updatedAt),
-        }),
-      )
-      const outcome = {
-        commit: `pending` as unknown,
-        persisted: `pending` as unknown,
-      }
-      outcomes.set(tx.id, outcome)
-      const commit = tx.commit().then(
-        () => {
-          outcome.commit = `fulfilled`
-        },
-        (error: unknown) => {
-          outcome.commit = error
-        },
-      )
-      const persisted = transaction.when(`settled`).then(
-        () => {
-          outcome.persisted = `fulfilled`
-        },
-        (error: unknown) => {
-          outcome.persisted = error
-        },
-      )
-      observed.push(commit, persisted)
-      return { id: tx.id, commit, persisted, outcome }
-    }
-
-    try {
-      await env.waitForLeader()
-      const head = createObservedTransaction(`head`, 0)
-      headId = head.id
-      await atOracleCheckpoint(providerEntered.promise, `head provider entered`)
-
-      const peer = createObservedTransaction(`peer`, 1)
-      peerId = peer.id
-      await atOracleCheckpoint(peerWriteEntered.promise, `peer write started`)
-      if (peerWriteCase === `durable-before`)
-        await atOracleCheckpoint(
-          peerWriteSettled.promise,
-          `peer durable before fault`,
-        )
-      if (
-        peerWriteCase === `visible-before-ack` ||
-        peerWriteCase === `visible-across-cleanup`
-      )
-        await atOracleCheckpoint(
-          peerRowStored.promise,
-          `peer visible before ack`,
-        )
-
-      releaseProvider.resolve()
-      await atOracleCheckpoint(hookEntered.promise, `retry hook failed`)
-      await atOracleCheckpoint(
-        terminalMarkerEntered.promise,
-        `terminal marker held`,
-      )
-      const atFault = expectedStartedPeer(
-        peerWriteCase === `durable-before`
-          ? { stored: true, acknowledgement: `fulfilled` }
-          : peerWriteCase === `visible-before-ack` ||
-              peerWriteCase === `visible-across-cleanup`
-            ? { stored: true, acknowledgement: `held` }
-            : { stored: false, acknowledgement: `held` },
-        false,
-      )
-      expect(head.outcome.commit).toBe(`pending`)
-      expect(peer.outcome.commit).toBe(atFault.caller)
-      expect(peer.outcome.persisted).toBe(atFault.caller)
-      expect(providerCalls).toEqual([head.id])
-      expect(atFault.providerEligible).toBe(false)
-      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual(
-        atFault.visible ? [head.id, peer.id] : [head.id],
-      )
-      expect(env.collection.toArray.map(({ id }) => id)).toEqual([
-        `head`,
-        `peer`,
-      ])
-
-      const writeAfterCleanup =
-        peerWriteCase === `late-after-cleanup` ||
-        peerWriteCase === `visible-across-cleanup`
-      if (!writeAfterCleanup) {
-        releasePeerWrite.resolve()
-        await atOracleCheckpoint(peerWriteSettled.promise, `peer write settled`)
-      }
-      const afterWrite = expectedStartedPeer(
-        peerWriteCase === `failure-before-store`
-          ? { stored: false, acknowledgement: `rejected` }
-          : writeAfterCleanup
-            ? peerWriteCase === `visible-across-cleanup`
-              ? { stored: true, acknowledgement: `held` }
-              : { stored: false, acknowledgement: `held` }
-            : { stored: true, acknowledgement: `fulfilled` },
-        false,
-      )
-      if (peerWriteCase === `failure-before-store`) {
-        await atOracleCheckpoint(peer.commit, `failed peer commit settled`)
-        await atOracleCheckpoint(
-          peer.persisted,
-          `failed peer persistence settled`,
-        )
-        expect(peer.outcome.commit).toBe(storageError)
-        expect(peer.outcome.persisted).toBe(storageError)
-      } else {
-        await turn()
-        expect(peer.outcome.commit).toBe(afterWrite.caller)
-        expect(peer.outcome.persisted).toBe(afterWrite.caller)
-      }
-      expect(afterWrite.providerEligible).toBe(false)
-      expect(providerCalls).toEqual([head.id])
-      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual(
-        afterWrite.visible ? [head.id, peer.id] : [head.id],
-      )
-
-      releaseTerminalMarker.resolve()
-      await atOracleCheckpoint(head.commit, `failed head settled`)
-      await atOracleCheckpoint(
-        head.persisted,
-        `failed head persistence settled`,
-      )
-      if (failureKind === `throw`) {
-        expect(head.outcome.commit).toBe(hookError)
-        expect(head.outcome.persisted).toBe(hookError)
-      } else {
-        expect(head.outcome.commit).toBeInstanceOf(TypeError)
-        expect(head.outcome.persisted).toBeInstanceOf(TypeError)
-      }
-
-      if (writeAfterCleanup) {
-        // A visible row without write acknowledgement cannot run even after
-        // the failed head is removed.
-        expect(providerCalls).toEqual([head.id])
-        expect(peer.outcome.commit).toBe(`pending`)
-        expect(peer.outcome.persisted).toBe(`pending`)
-        expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual(
-          peerWriteCase === `visible-across-cleanup` ? [peer.id] : [],
-        )
-        releasePeerWrite.resolve()
-        await atOracleCheckpoint(
-          peerWriteSettled.promise,
-          `late peer write settled`,
-        )
-      }
-
-      if (peerWriteCase === `failure-before-store`) {
-        expect(providerCalls).toEqual([head.id])
-        expect(await env.executor.peekOutbox()).toEqual([])
-        expect(env.collection.toArray).toEqual([])
-      } else {
-        const firstPeerEvent = await atOracleCheckpoint(
-          Promise.race([
-            peerProviderEntered.promise.then(() => `provider` as const),
-            peer.commit.then(() => `settled` as const),
-          ]),
-          `peer provider or early settlement`,
-        )
-        expect(firstPeerEvent).toBe(`provider`)
-        expect(peer.outcome.commit).toBe(`pending`)
-        expect(peer.outcome.persisted).toBe(`pending`)
-        expect(providerCalls).toEqual([head.id, peer.id])
-        expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-          peer.id,
-        ])
-        releasePeerProvider.resolve()
-        await atOracleCheckpoint(peer.commit, `peer commit settled`)
-        await atOracleCheckpoint(peer.persisted, `peer persistence settled`)
-        expect(peer.outcome.commit).toBe(`fulfilled`)
-        expect(peer.outcome.persisted).toBe(`fulfilled`)
-        expect(providerCalls).toEqual([head.id, peer.id])
-        expect(await env.executor.peekOutbox()).toEqual([])
-        expect(env.collection.toArray.map(({ id }) => id)).toEqual([`peer`])
-      }
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseProvider.resolve()
-      releasePeerWrite.resolve()
-      releaseTerminalMarker.resolve()
-      releasePeerProvider.resolve()
-      const cleanupError = new Error(`started-peer oracle cleanup`)
-      for (const [id, outcome] of outcomes)
-        if (outcome.commit === `pending` || outcome.persisted === `pending`)
-          env.executor.rejectTransaction(id, cleanupError)
-      await cleanupOfflineOracle(
-        [
-          () => Promise.all(observed),
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-          () => warning.mockRestore(),
-          () => errorLog.mockRestore(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
-
-// A hook failure removes only the head. The already queued peer then runs in
-// the same batch, and a later batch remains available for new work.
-it(`continues queued work after shouldRetry throws`, async () => {
-  const providerError = new Error(`HTTP 401 Unauthorized`)
-  const hookError = new Error(`retry decision failed`)
-  const outbox = new OutboxManager(new FakeStorageAdapter(), {})
-  const scheduler = new KeyScheduler()
-  const rejections: Array<Error> = []
-  const resolutions: Array<string> = []
-  let peerCalls = 0
-  const signaler: TransactionSignaler = {
-    isOfflineEnabled: true,
-    isOnline: () => true,
-    resolveTransaction: (id) => {
-      if (id === `hook-failure-head`)
-        throw new Error(`failed head cannot resolve`)
-      resolutions.push(id)
-    },
-    rejectTransaction: (_id, error) => rejections.push(error),
-    registerRestorationTransaction: () => {},
-  }
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
-    {
-      collections: {},
-      mutationFns: {
-        head: () => Promise.reject(providerError),
-        peer: () => {
-          peerCalls++
-          return Promise.resolve()
-        },
-      },
-      shouldRetry: () => {
-        throw hookError
-      },
-    },
-    signaler,
-  )
-  const head: OfflineTransaction = {
-    id: `hook-failure-head`,
-    mutationFnName: `head`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `hook-failure-head`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    version: 1,
-  }
-  const peer: OfflineTransaction = {
-    ...head,
-    id: `hook-failure-peer`,
-    mutationFnName: `peer`,
-    idempotencyKey: `hook-failure-peer`,
-    createdAt: new Date(1),
-  }
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  try {
-    await outbox.add(head)
-    await outbox.add(peer)
-    scheduler.schedule(peer)
-    await expect(executor.execute(head)).resolves.toBeUndefined()
-    expect(rejections).toEqual([hookError])
-    expect(await outbox.get(head.id)).toBeNull()
-    expect(await outbox.get(peer.id)).toBeNull()
-    expect(scheduler.getPendingCount()).toBe(0)
-    expect(peerCalls).toBe(1)
-    expect(resolutions).toEqual([peer.id])
-    await expect(executor.executeAll()).resolves.toBeUndefined()
-    expect(peerCalls).toBe(1)
-    expect(resolutions).toEqual([peer.id])
-  } finally {
-    executor.pause()
-    warning.mockRestore()
-  }
-})
-
-// A first-provider retry-record write fails after 2–5 transactions have been
-// admitted. Two is the marginal held-head/peer history; five checks that every
-// later peer survives. Removing the peer removes the independence question.
-// The fixture does not generate a duplicate ID or a successful retry-record
-// write, because neither has this failure premise.
-async function checkRetryRecordFailure(seed: number | undefined) {
-  await fc.assert(
-    fc.asyncProperty(fc.integer({ min: 2, max: 5 }), async (count) => {
-      const storageError = new Error(`retry record unavailable`)
-      const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-      class RetryStorage extends FakeStorageAdapter {
-        failUpdate = true
-        override async set(key: string, value: string): Promise<void> {
-          if (this.failUpdate && JSON.parse(value).retryCount > 0) {
-            this.failUpdate = false
-            throw storageError
-          }
-          await super.set(key, value)
-        }
-      }
-      const entered = gate()
-      const release = gate()
-      const calls: Array<string> = []
-      const statuses: Array<unknown> = []
-      const observed: Array<Promise<void>> = []
-      const ids: Array<string> = []
-      const env = createTestOfflineEnvironment({
-        storage: new RetryStorage(),
-        config: { jitter: false },
-        mutationFn: async (params) => {
-          calls.push(params.transaction.id)
-          if (calls.length === 1) {
-            entered.resolve()
-            await release.promise
-            throw new Error(`temporary provider failure`)
-          }
-          env.applyMutations(params.transaction.mutations)
-        },
-      })
-      let hasPrimaryFailure = false
-      try {
-        await env.waitForLeader()
-        for (let index = 0; index < count; index++) {
-          const tx = env.executor.createOfflineTransaction({
-            mutationFnName: env.mutationFnName,
-            autoCommit: false,
-          })
-          ids.push(tx.id)
-          tx.mutate(() =>
-            env.collection.insert({
-              id: `row-${index}`,
-              value: `value-${index}`,
-              completed: false,
-              updatedAt: new Date(0),
-            }),
-          )
-          statuses[index] = `pending`
-          observed.push(
-            tx.commit().then(
-              () => {
-                statuses[index] = `fulfilled`
-              },
-              (error: unknown) => {
-                statuses[index] = error
-              },
-            ),
-          )
-          if (index === 0)
-            await atOracleCheckpoint(
-              entered.promise,
-              `first retry provider entered`,
-            )
-        }
-        await turn()
-        release.resolve()
-        await turn()
-        expect(calls).toEqual([ids[0]])
-        expect(statuses).toEqual(ids.map(() => `pending`))
-        expect(() =>
-          expect([`fulfilled`, ...statuses.slice(1)]).toEqual(
-            ids.map(() => `pending`),
-          ),
-        ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
-        expect(warning).toHaveBeenCalledWith(
-          `Failed to execute transactions:`,
-          storageError,
-        )
-        expect((await env.executor.peekOutbox()).map((tx) => tx.id)).toEqual(
-          ids,
-        )
-        env.executor.getOnlineDetector().notifyOnline()
-        await atOracleCheckpoint(
-          Promise.all(observed),
-          `retry recovery settled`,
-        )
-        expect(calls).toEqual([ids[0], ...ids])
-        expect(statuses).toEqual(ids.map(() => `fulfilled`))
-        expect(await env.executor.peekOutbox()).toEqual([])
-        expect([...env.serverState.keys()]).toEqual(
-          ids.map((_id, index) => `row-${index}`),
-        )
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        release.resolve()
-        await cleanupOfflineOracle(
-          [
-            () => env.executor.getOnlineDetector().notifyOnline(),
-            () => turn(),
-            () => env.executor.dispose(),
-            () => env.collection.cleanup(),
-            () => {
-              warning.mockRestore()
-            },
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    }),
-    {
-      ...oracleLaneOptions(retryRecordOracle, seed),
-      examples: [[2], [5]],
-    },
-  )
-}
-
-oracleReplayTest(it).each([20260916])(
-  `keeps admitted transactions pending when a peer's retry record cannot be updated (seed %s)`,
-  checkRetryRecordFailure,
-)
-oracleReplayTest(it, RETRY_RECORD_PROPERTY).each([undefined])(
-  `keeps admitted transactions pending when a peer's retry record cannot be updated (seed %s)`,
-  checkRetryRecordFailure,
-)
-
-// The failed durable write can be first, middle, or last among three distinct
-// IDs. All positions are pinned, so the conditional failure premise is reached
-// at each boundary. Removing the two admitted peers would hide accidental
-// global rejection. A duplicate ID is outside this legal admission grammar.
-async function checkDurableAdmissionFailure(seed: number | undefined) {
-  await fc.assert(
-    fc.asyncProperty(fc.integer({ min: 0, max: 2 }), async (failedIndex) => {
-      const storageError = new Error(`admission unavailable`)
-      class Storage extends FakeStorageAdapter {
-        writes = 0
-        override async set(key: string, value: string): Promise<void> {
-          if (this.writes++ === failedIndex) throw storageError
-          await super.set(key, value)
-        }
-      }
-      const release = gate()
-      const env = createTestOfflineEnvironment({
-        storage: new Storage(),
-        mutationFn: async (params) => {
-          await release.promise
-          env.applyMutations(params.transaction.mutations)
-        },
-      })
-      const ids: Array<string> = []
-      const statuses: Array<unknown> = []
-      const observed: Array<Promise<void>> = []
-      let hasPrimaryFailure = false
-      try {
-        await env.waitForLeader()
-        for (let index = 0; index < 3; index++) {
-          const tx = env.executor.createOfflineTransaction({
-            mutationFnName: env.mutationFnName,
-            autoCommit: false,
-          })
-          ids.push(tx.id)
-          tx.mutate(() =>
-            env.collection.insert({
-              id: `row-${index}`,
-              value: `value-${index}`,
-              completed: false,
-              updatedAt: new Date(0),
-            }),
-          )
-          statuses[index] = `pending`
-          observed.push(
-            tx.commit().then(
-              () => {
-                statuses[index] = `fulfilled`
-              },
-              (error: unknown) => {
-                statuses[index] = error
-              },
-            ),
-          )
-          await turn()
-        }
-        expect(statuses[failedIndex]).toBe(storageError)
-        expect((await env.executor.peekOutbox()).map((tx) => tx.id)).toEqual(
-          ids.filter((_id, index) => index !== failedIndex),
-        )
-        release.resolve()
-        await atOracleCheckpoint(
-          Promise.all(observed),
-          `admitted peers settled`,
-        )
-        expect(env.mutationCalls.map((call) => call.transaction.id)).toEqual(
-          ids.filter((_id, index) => index !== failedIndex),
-        )
-        for (let index = 0; index < 3; index++) {
-          expect(statuses[index]).toBe(
-            index === failedIndex ? storageError : `fulfilled`,
-          )
-          expect(env.collection.has(`row-${index}`)).toBe(index !== failedIndex)
-        }
-        const expectedStatuses = ids.map((_id, index) =>
-          index === failedIndex ? storageError : `fulfilled`,
-        )
-        expect(() =>
-          expect(statuses.map(() => storageError)).toEqual(expectedStatuses),
-        ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
-        expect(await env.executor.peekOutbox()).toEqual([])
-      } catch (error) {
-        hasPrimaryFailure = true
-        throw error
-      } finally {
-        release.resolve()
-        await cleanupOfflineOracle(
-          [
-            () => turn(),
-            () => env.executor.dispose(),
-            () => env.collection.cleanup(),
-          ],
-          hasPrimaryFailure,
-        )
-      }
-    }),
-    {
-      ...oracleLaneOptions(admissionOracle, seed),
-      examples: [[0], [1], [2]],
-    },
-  )
-}
-
-oracleReplayTest(it).each([20260916])(
-  `rejects only the transaction whose durable admission fails (seed %s)`,
-  checkDurableAdmissionFailure,
-)
-oracleReplayTest(it, ADMISSION_PROPERTY).each([undefined])(
-  `rejects only the transaction whose durable admission fails (seed %s)`,
-  checkDurableAdmissionFailure,
-)
-
-it(`keeps commit pending until successful outbox deletion`, async () => {
-  const deletionEntered = gate()
-  const releaseDeletion = gate()
-  class Storage extends FakeStorageAdapter {
-    override async delete(key: string): Promise<void> {
-      if (key.startsWith(`tx:`)) {
-        deletionEntered.resolve()
-        await releaseDeletion.promise
-      }
-      await super.delete(key)
-    }
-  }
-  const env = createTestOfflineEnvironment({ storage: new Storage() })
-  let commitStatus: unknown = `pending`
-  let persistedStatus: unknown = `pending`
-  let transactionId = ``
-  let observed: Promise<void> | undefined
-  let observedPersistence: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const transaction = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    transactionId = transaction.id
-    const localTransaction = transaction.mutate(() =>
-      env.collection.insert({
-        id: `held-delete`,
-        value: `provider-applied`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    observedPersistence = localTransaction.isPersisted.promise.then(
-      () => {
-        persistedStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        persistedStatus = error
-      },
-    )
-    observed = transaction.commit().then(
-      () => {
-        commitStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        commitStatus = error
-      },
-    )
-
-    await atOracleCheckpoint(deletionEntered.promise, `outbox deletion entered`)
-    await turn()
-    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-      transactionId,
-    ])
-    expect(env.serverState.has(`held-delete`)).toBe(true)
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      transactionId,
-    ])
-    expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
-      `pending`,
-      `pending`,
-      `persisting`,
-    ])
-
-    releaseDeletion.resolve()
-    await atOracleCheckpoint(
-      Promise.all([observed, observedPersistence]),
-      `outbox deletion settled caller`,
-    )
-    expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
-      `fulfilled`,
-      `fulfilled`,
-      `completed`,
-    ])
-    expect(await env.executor.peekOutbox()).toEqual([])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseDeletion.resolve()
-    if (commitStatus === `pending` && transactionId)
-      env.executor.resolveTransaction(transactionId, undefined)
-    await cleanupOfflineOracle(
-      [
-        () => Promise.all([observed, observedPersistence]),
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it.each([`removeFromOutbox`, `clearOutbox`] as const)(
-  `settles active provider work after %s acknowledges outbox deletion`,
-  async (removal) => {
-    const providerEntered = gate()
-    const releaseProvider = gate()
-    const env = createTestOfflineEnvironment({
-      mutationFn: async (params) => {
-        providerEntered.resolve()
-        await releaseProvider.promise
-        env.applyMutations(params.transaction.mutations)
-      },
-    })
-    let transactionId = ``
-    let commitStatus: unknown = `pending`
-    let persistedStatus: unknown = `pending`
-    let observed: Promise<void> | undefined
-    let observedPersistence: Promise<void> | undefined
-    let hasPrimaryFailure = false
-    try {
-      await env.waitForLeader()
-      const transaction = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      transactionId = transaction.id
-      const localTransaction = transaction.mutate(() =>
-        env.collection.insert({
-          id: `manually-removed-active`,
-          value: `provider-applied`,
-          completed: false,
-          updatedAt: new Date(0),
-        }),
-      )
-      observedPersistence = localTransaction.isPersisted.promise.then(
-        () => {
-          persistedStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          persistedStatus = error
-        },
-      )
-      observed = transaction.commit().then(
-        () => {
-          commitStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          commitStatus = error
-        },
-      )
-
-      await atOracleCheckpoint(providerEntered.promise, `provider held`)
-      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-        transactionId,
-      ])
-      if (removal === `removeFromOutbox`)
-        await env.executor.removeFromOutbox(transactionId)
-      else await env.executor.clearOutbox()
-      expect(await env.executor.peekOutbox()).toEqual([])
-      expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
-        `pending`,
-        `pending`,
-        `persisting`,
-      ])
-
-      releaseProvider.resolve()
-      await atOracleCheckpoint(
-        Promise.all([observed, observedPersistence]),
-        `provider fulfillment after ${removal} deletion settled caller`,
-      )
-      expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
-        `fulfilled`,
-        `fulfilled`,
-        `completed`,
-      ])
-      expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-        transactionId,
-      ])
-      expect(env.serverState.has(`manually-removed-active`)).toBe(true)
-      expect(await env.executor.peekOutbox()).toEqual([])
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseProvider.resolve()
-      if (commitStatus === `pending` && transactionId)
-        env.executor.resolveTransaction(transactionId, undefined)
-      await cleanupOfflineOracle(
-        [
-          () => Promise.all([observed, observedPersistence]),
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
-
-// The independently chosen result is a rejection with the provider error:
-// deletion is already acknowledged, and a retry cannot re-admit that row.
-// Hold the real public provider call, remove its outbox entry, then reject it.
-// The checkpoint compares both caller promises and the outbox before admitting
-// a later peer. The peer checks that a missing retry record did not stop the
-// executor. The default network retry and overridden 401 retry reach the same
-// persistence boundary by different decisions.
-it.each([
-  [`removeFromOutbox`, `default`],
-  [`removeFromOutbox`, `hook`],
-  [`clearOutbox`, `default`],
-  [`clearOutbox`, `hook`],
-] as const)(
-  `rejects a failed provider after %s removed its outbox row (%s retry)`,
-  async (removal, retryDecision) => {
-    const providerEntered = gate()
-    const releaseProvider = gate()
-    const providerError = new Error(
-      retryDecision === `hook`
-        ? `HTTP 401 Unauthorized`
-        : `network unavailable`,
-    )
-    let headId = ``
-    const env = createTestOfflineEnvironment({
-      config: {
-        jitter: false,
-        ...(retryDecision === `hook`
-          ? { shouldRetry: (error: Error) => error === providerError }
-          : {}),
-      },
-      mutationFn: async (params) => {
-        if (params.transaction.id === headId) {
-          providerEntered.resolve()
-          await releaseProvider.promise
-          throw providerError
-        }
-        env.applyMutations(params.transaction.mutations)
-      },
-    })
-    let headCommit: Promise<void> | undefined
-    let headPersistence: Promise<void> | undefined
-    let headCommitResult: unknown = `pending`
-    let headPersistenceResult: unknown = `pending`
-    let hasPrimaryFailure = false
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    try {
-      await env.waitForLeader()
-      const head = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      headId = head.id
-      const localHead = head.mutate(() =>
-        env.collection.insert({
-          id: `removed-failure`,
-          value: `never-applied`,
-          completed: false,
-          updatedAt: new Date(0),
-        }),
-      )
-      headPersistence = localHead.isPersisted.promise.then(
-        () => {
-          headPersistenceResult = `fulfilled`
-        },
-        (error: unknown) => {
-          headPersistenceResult = error
-        },
-      )
-      headCommit = head.commit().then(
-        () => {
-          headCommitResult = `fulfilled`
-        },
-        (error: unknown) => {
-          headCommitResult = error
-        },
-      )
-
-      await atOracleCheckpoint(providerEntered.promise, `provider held`)
-      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-        headId,
-      ])
-      if (removal === `removeFromOutbox`)
-        await env.executor.removeFromOutbox(headId)
-      else await env.executor.clearOutbox()
-      expect(await env.executor.peekOutbox()).toEqual([])
-      expect([headCommitResult, headPersistenceResult]).toEqual([
-        `pending`,
-        `pending`,
-      ])
-
-      releaseProvider.resolve()
-      if (removal === `removeFromOutbox`) {
-        await vi.waitFor(() => expect(env.executor.getRunningCount()).toBe(0))
-        await Promise.resolve()
-        await Promise.resolve()
-      }
-      await atOracleCheckpoint(
-        Promise.all([headCommit, headPersistence]),
-        `provider rejection after acknowledged removal`,
-      )
-      expect([headCommitResult, headPersistenceResult]).toEqual([
-        providerError,
-        providerError,
-      ])
-      expect(localHead.state).toBe(`failed`)
-      expect(await env.executor.peekOutbox()).toEqual([])
-      expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-        headId,
-      ])
-
-      const peer = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      peer.mutate(() =>
-        env.collection.insert({
-          id: `later-peer`,
-          value: `applied`,
-          completed: false,
-          updatedAt: new Date(0),
-        }),
-      )
-      await atOracleCheckpoint(peer.commit(), `later peer settled`)
-      expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-        headId,
-        peer.id,
-      ])
-      expect(env.serverState.has(`removed-failure`)).toBe(false)
-      expect(env.serverState.has(`later-peer`)).toBe(true)
-      expect(await env.executor.peekOutbox()).toEqual([])
-    } catch (error) {
-      hasPrimaryFailure = true
-      throw error
-    } finally {
-      releaseProvider.resolve()
-      if (headCommitResult === `pending` && headId)
-        env.executor.rejectTransaction(headId, providerError)
-      await cleanupOfflineOracle(
-        [
-          () => Promise.all([headCommit, headPersistence]),
-          () => env.executor.dispose(),
-          () => env.collection.cleanup(),
-          () => warning.mockRestore(),
-        ],
-        hasPrimaryFailure,
-      )
-    }
-  },
-)
-
-it(`stops successful provider work when outbox deletion fails`, async () => {
-  const firstProviderEntered = gate()
-  const releaseFirstProvider = gate()
-  const deletionAttempted = gate()
-  const storageError = new Error(`acknowledgement cleanup failed`)
-  let transactionId = ``
-  class Storage extends FakeStorageAdapter {
-    attempts = 0
-    override async delete(key: string): Promise<void> {
-      if (key === `tx:${transactionId}`) {
-        this.attempts++
-        deletionAttempted.resolve()
-        throw storageError
-      }
-      await super.delete(key)
-    }
-  }
-  const storage = new Storage()
-  const env = createTestOfflineEnvironment({
-    storage,
-    mutationFn: async (params) => {
-      if (params.transaction.id === transactionId) {
-        firstProviderEntered.resolve()
-        await releaseFirstProvider.promise
-      }
-      env.applyMutations(params.transaction.mutations)
-    },
-  })
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  let commitStatus: unknown = `pending`
-  let persistedStatus: unknown = `pending`
-  let peerStatus: unknown = `pending`
-  let peerId = ``
-  let observed: Promise<void> | undefined
-  let observedPersistence: Promise<void> | undefined
-  let observedPeer: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const transaction = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    transactionId = transaction.id
-    const localTransaction = transaction.mutate(() =>
-      env.collection.insert({
-        id: `successful-cleanup-failure`,
-        value: `provider-applied`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    observedPersistence = localTransaction.isPersisted.promise.then(
-      () => {
-        persistedStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        persistedStatus = error
-      },
-    )
-    observed = transaction.commit().then(
-      () => {
-        commitStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        commitStatus = error
-      },
-    )
-
-    await atOracleCheckpoint(
-      firstProviderEntered.promise,
-      `first provider held`,
-    )
-    const peer = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    peerId = peer.id
-    peer.mutate(() =>
-      env.collection.insert({
-        id: `queued-peer`,
-        value: `provider-applied`,
-        completed: false,
-        updatedAt: new Date(1),
-      }),
-    )
-    observedPeer = peer.commit().then(
-      () => {
-        peerStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        peerStatus = error
-      },
-    )
-    await turn()
-    releaseFirstProvider.resolve()
-
-    await atOracleCheckpoint(
-      deletionAttempted.promise,
-      `successful acknowledgement cleanup attempted`,
-    )
-    await turn()
-
-    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-      transactionId,
-    ])
-    expect(env.serverState.has(`successful-cleanup-failure`)).toBe(true)
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      transactionId,
-      peerId,
-    ])
-    expect([
-      commitStatus,
-      persistedStatus,
-      localTransaction.state,
-      peerStatus,
-    ]).toEqual([storageError, storageError, `failed`, `pending`])
-
-    env.executor.getOnlineDetector().notifyOnline()
-    await turn()
-    expect(storage.attempts).toBe(1)
-    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-      transactionId,
-    ])
-    expect(peerStatus).toBe(`pending`)
-    const later = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    later.mutate(() =>
-      env.collection.insert({
-        id: `after-storage-stop`,
-        value: `not-admitted`,
-        completed: false,
-        updatedAt: new Date(2),
-      }),
-    )
-    await expect(later.commit()).rejects.toBe(storageError)
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      transactionId,
-      peerId,
-    ])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseFirstProvider.resolve()
-    if (commitStatus === `pending` && transactionId)
-      env.executor.resolveTransaction(transactionId, undefined)
-    if (peerStatus === `pending` && peerId)
-      env.executor.resolveTransaction(peerId, undefined)
-    await cleanupOfflineOracle(
-      [
-        () => Promise.all([observed, observedPersistence, observedPeer]),
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-        () => warning.mockRestore(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it(`stops after a failed deletion-pending write and holds its queued peer`, async () => {
-  const firstProviderEntered = gate()
-  const releaseFirstProvider = gate()
-  const markerWriteFailed = gate()
-  const markerError = new Error(`deletion-pending record unavailable`)
-  let headId = ``
-  class Storage extends FakeStorageAdapter {
-    markerWrites = 0
-    deletedIds: Array<string> = []
-
-    override async set(key: string, value: string): Promise<void> {
-      if (
-        key === `tx:${headId}` &&
-        (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
-          `deletion-pending`
-      ) {
-        this.markerWrites++
-        markerWriteFailed.resolve()
-        throw markerError
-      }
-      await super.set(key, value)
-    }
-
-    override async delete(key: string): Promise<void> {
-      if (key.startsWith(`tx:`)) this.deletedIds.push(key.slice(3))
-      await super.delete(key)
-    }
-  }
-  const storage = new Storage()
-  const env = createTestOfflineEnvironment({
-    storage,
-    mutationFn: async (params) => {
-      if (params.transaction.id === headId) {
-        firstProviderEntered.resolve()
-        await releaseFirstProvider.promise
-      }
-      env.applyMutations(params.transaction.mutations)
-    },
-  })
-  let headStatus: unknown = `pending`
-  let persistedStatus: unknown = `pending`
-  let peerStatus: unknown = `pending`
-  let peerId = ``
-  let observedHead: Promise<void> | undefined
-  let observedPersistence: Promise<void> | undefined
-  let observedPeer: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const head = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    headId = head.id
-    const localTransaction = head.mutate(() =>
-      env.collection.insert({
-        id: `marker-write-head`,
-        value: `provider-applied`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    observedPersistence = localTransaction.isPersisted.promise.then(
-      () => {
-        persistedStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        persistedStatus = error
-      },
-    )
-    observedHead = head.commit().then(
-      () => {
-        headStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        headStatus = error
-      },
-    )
-
-    await atOracleCheckpoint(firstProviderEntered.promise, `head provider held`)
-    const peer = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    peerId = peer.id
-    peer.mutate(() =>
-      env.collection.insert({
-        id: `marker-write-peer`,
-        value: `queued`,
-        completed: false,
-        updatedAt: new Date(1),
-      }),
-    )
-    observedPeer = peer.commit().then(
-      () => {
-        peerStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        peerStatus = error
-      },
-    )
-    await turn()
-    releaseFirstProvider.resolve()
-
-    await atOracleCheckpoint(
-      markerWriteFailed.promise,
-      `fulfilled-provider marker write failed`,
-    )
-    await turn()
-    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-      headId,
-    ])
-    expect(env.serverState.has(`marker-write-head`)).toBe(true)
-    expect(env.serverState.has(`marker-write-peer`)).toBe(false)
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      headId,
-      peerId,
-    ])
-    expect((await env.executor.peekOutbox())[0]?.outboxPhase).toBeUndefined()
-    expect(storage.deletedIds).toEqual([])
-    expect([
-      headStatus,
-      persistedStatus,
-      localTransaction.state,
-      peerStatus,
-    ]).toEqual([markerError, markerError, `failed`, `pending`])
-
-    env.executor.getOnlineDetector().notifyOnline()
-    await turn()
-    expect(storage.markerWrites).toBe(1)
-    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
-      headId,
-    ])
-    expect(storage.deletedIds).toEqual([])
-    expect(peerStatus).toBe(`pending`)
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      headId,
-      peerId,
-    ])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseFirstProvider.resolve()
-    if (headStatus === `pending` && headId)
-      env.executor.resolveTransaction(headId, undefined)
-    if (peerStatus === `pending` && peerId)
-      env.executor.resolveTransaction(peerId, undefined)
-    await cleanupOfflineOracle(
-      [
-        () => Promise.all([observedHead, observedPersistence, observedPeer]),
-        () => env.executor.dispose(),
-        () => env.collection.cleanup(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it(`restarts a fulfilled provider transaction after a stopped deletion failure`, async () => {
-  const firstDeletionAttempted = gate()
-  const restartedDeletionAttempted = gate()
-  const storageError = new Error(`acknowledgement cleanup failed`)
-  const providerCalls: Array<{ id: string; idempotencyKey: string }> = []
-  let providerFulfilled = false
-  class Storage extends FakeStorageAdapter {
-    failDeletes = true
-    completedWritesAfterProviderFulfilled = 0
-
-    override async set(key: string, value: string): Promise<void> {
-      await super.set(key, value)
-      if (providerFulfilled) this.completedWritesAfterProviderFulfilled++
-    }
-
-    override async delete(key: string): Promise<void> {
-      if (key.startsWith(`tx:`)) {
-        if (this.failDeletes) {
-          firstDeletionAttempted.resolve()
-          throw storageError
-        }
-        restartedDeletionAttempted.resolve()
-      }
-      await super.delete(key)
-    }
-  }
-  const storage = new Storage()
-  const first = createTestOfflineEnvironment({
-    storage,
-    mutationFn: (params) => {
-      providerCalls.push({
-        id: params.transaction.id,
-        idempotencyKey: params.idempotencyKey,
-      })
-      first.applyMutations(params.transaction.mutations)
-      providerFulfilled = true
-    },
-  })
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  let second: ReturnType<typeof createTestOfflineEnvironment> | undefined
-  let transactionId = ``
-  let commitStatus: unknown = `pending`
-  let persistedStatus: unknown = `pending`
-  let observed: Promise<void> | undefined
-  let observedPersistence: Promise<void> | undefined
-  let replayStatus: unknown = `pending`
-  let observedReplay: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await first.waitForLeader()
-    const transaction = first.executor.createOfflineTransaction({
-      mutationFnName: first.mutationFnName,
-      autoCommit: false,
-      idempotencyKey: `restart-after-provider-fulfillment`,
-    })
-    transactionId = transaction.id
-    const localTransaction = transaction.mutate(() =>
-      first.collection.insert({
-        id: `restart-after-delete-failure`,
-        value: `provider-applied`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    observedPersistence = localTransaction.isPersisted.promise.then(
-      () => {
-        persistedStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        persistedStatus = error
-      },
-    )
-    observed = transaction.commit().then(
-      () => {
-        commitStatus = `fulfilled`
-      },
-      (error: unknown) => {
-        commitStatus = error
-      },
-    )
-
-    await atOracleCheckpoint(
-      firstDeletionAttempted.promise,
-      `first deletion failed after provider fulfillment`,
-    )
-    await turn()
-    expect(providerCalls).toEqual([
-      {
-        id: transactionId,
-        idempotencyKey: `restart-after-provider-fulfillment`,
-      },
-    ])
-    expect(first.serverState.has(`restart-after-delete-failure`)).toBe(true)
-    expect((await first.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      transactionId,
-    ])
-    expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
-      storageError,
-      storageError,
-      `failed`,
-    ])
-    expect(storage.completedWritesAfterProviderFulfilled).toBeGreaterThan(0)
-    const markerWrites = storage.completedWritesAfterProviderFulfilled
-
-    first.executor.dispose()
-    storage.failDeletes = false
-    second = createTestOfflineEnvironment({
-      storage,
-      config: {
-        // Filtering unfulfilled work cannot cancel already fulfilled provider
-        // work whose only remaining obligation is durable deletion.
-        beforeRetry: () => [],
-      },
-      mutationFn: (params) => {
-        providerCalls.push({
-          id: params.transaction.id,
-          idempotencyKey: params.idempotencyKey,
-        })
-      },
-    })
-    observedReplay = second.executor
-      .waitForTransactionCompletion(transactionId)
-      .then(
-        () => {
-          replayStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          replayStatus = error
+          env.applyMutations(params.transaction.mutations)
         },
-      )
-    await second.waitForLeader()
-    await atOracleCheckpoint(
-      restartedDeletionAttempted.promise,
-      `restarted deletion attempted`,
-    )
-    expect(await second.executor.peekOutbox()).toEqual([])
-    await atOracleCheckpoint(observedReplay, `restarted deletion settled`)
-    expect(replayStatus).toBe(`fulfilled`)
-    expect(providerCalls).toEqual([
-      {
-        id: transactionId,
-        idempotencyKey: `restart-after-provider-fulfillment`,
-      },
-    ])
-    expect(storage.completedWritesAfterProviderFulfilled).toBe(markerWrites)
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    if (commitStatus === `pending` && transactionId)
-      first.executor.resolveTransaction(transactionId, undefined)
-    await cleanupOfflineOracle(
-      [
-        () => Promise.all([observed, observedPersistence]),
-        () => observedReplay,
-        () => first.executor.dispose(),
-        () => second?.executor.dispose(),
-        () => first.collection.cleanup(),
-        () => second?.collection.cleanup(),
-        () => warning.mockRestore(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-it(`replays an admitted row with no fulfilled-provider checkpoint`, async () => {
-  const deletionCompleted = gate()
-  class Storage extends FakeStorageAdapter {
-    override async delete(key: string): Promise<void> {
-      await super.delete(key)
-      if (key === `tx:legacy-unmarked-transaction`) deletionCompleted.resolve()
-    }
-  }
-  const storage = new Storage()
-  const seed = createCollection<TestItem, string>({
-    id: `test-items`,
-    getKey: (row) => row.id,
-    startSync: true,
-    sync: { sync: (ops) => ops.markReady() },
-  })
-  const outbox = new OutboxManager(storage, { [seed.id]: seed })
-  const seedTransaction = createTransaction({
-    autoCommit: false,
-    mutationFn: () => Promise.resolve(),
-  })
-  void seedTransaction.isPersisted.promise.catch(() => {})
-  try {
-    seedTransaction.mutate(() =>
-      seed.insert({
-        id: `legacy-unmarked`,
-        value: `replay-me`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    await outbox.add({
-      id: `legacy-unmarked-transaction`,
-      mutationFnName: `syncData`,
-      mutations: seedTransaction.mutations,
-      keys: seedTransaction.mutations.map(({ globalKey }) => globalKey),
-      idempotencyKey: `legacy-unmarked-key`,
-      createdAt: new Date(0),
-      retryCount: 0,
-      nextAttemptAt: 0,
-      version: 1,
-    })
-  } finally {
-    seedTransaction.rollback({ isSecondaryRollback: true })
-    await seed.cleanup()
-  }
-
-  const providerEntered = gate()
-  const providerCalls: Array<{ id: string; idempotencyKey: string }> = []
-  const env = createTestOfflineEnvironment({
-    storage,
-    mutationFn: (params) => {
-      providerCalls.push({
-        id: params.transaction.id,
-        idempotencyKey: params.idempotencyKey,
       })
-      env.applyMutations(params.transaction.mutations)
-      providerEntered.resolve()
-    },
-  })
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    await atOracleCheckpoint(
-      providerEntered.promise,
-      `unmarked provider replay`,
-    )
-    expect(providerCalls).toEqual([
-      {
-        id: `legacy-unmarked-transaction`,
-        idempotencyKey: `legacy-unmarked-key`,
-      },
-    ])
-    expect(env.serverState.has(`legacy-unmarked`)).toBe(true)
-    await atOracleCheckpoint(
-      deletionCompleted.promise,
-      `unmarked replay outbox deletion`,
-    )
-    expect(await env.executor.peekOutbox()).toEqual([])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    await cleanupOfflineOracle(
-      [() => env.executor.dispose(), () => env.collection.cleanup()],
-      hasPrimaryFailure,
-    )
-  }
-})
-
-// Deletion failure leaves a durable terminal marker. The two causes must both
-// retain their own error and skip the provider when a fresh executor removes it.
-async function checkTerminalFailureWithFailedDeletion(
-  failureKind: `provider` | `hook`,
-) {
-  const deletionAttempted = gate()
-  const restartedDeletionAttempted = gate()
-  const releaseRestartedDeletion = gate()
-  const primaryError =
-    failureKind === `provider`
-      ? new NonRetriableError(`provider rejected permanently`)
-      : new Error(`retry decision failed`)
-  const providerError =
-    failureKind === `provider`
-      ? primaryError
-      : new Error(`HTTP 401 Unauthorized`)
-  const storageError = new Error(`rejection cleanup failed`)
-  class Storage extends FakeStorageAdapter {
-    failDeletes = true
-    override async delete(key: string): Promise<void> {
-      if (key.startsWith(`tx:`)) {
-        if (this.failDeletes) {
-          deletionAttempted.resolve()
-          throw storageError
+      let hasPrimaryFailure = false
+      try {
+        await env.waitForLeader()
+        for (let index = 0; index < count; index++) {
+          const tx = env.executor.createOfflineTransaction({
+            mutationFnName: env.mutationFnName,
+            autoCommit: false,
+          })
+          ids.push(tx.id)
+          tx.mutate(() =>
+            env.collection.insert({
+              id: `row-${index}`,
+              value: `value-${index}`,
+              completed: false,
+              updatedAt: new Date(0),
+            }),
+          )
+          statuses[index] = `pending`
+          observed.push(
+            tx.commit().then(
+              () => {
+                statuses[index] = `fulfilled`
+              },
+              (error: unknown) => {
+                statuses[index] = error
+              },
+            ),
+          )
+          if (index === 0)
+            await atOracleCheckpoint(
+              entered.promise,
+              `first retry provider entered`,
+            )
         }
-        restartedDeletionAttempted.resolve()
-        await releaseRestartedDeletion.promise
-      }
-      await super.delete(key)
-    }
-  }
-  const storage = new Storage()
-  let providerCalls = 0
-  const env = createTestOfflineEnvironment({
-    storage,
-    config:
-      failureKind === `hook`
-        ? {
-            shouldRetry: () => {
-              throw primaryError
+        await turn()
+        release.resolve()
+        await turn()
+        expect(calls).toEqual([ids[0]])
+        expect(statuses).toEqual(ids.map(() => `pending`))
+        expect(() =>
+          expect([`fulfilled`, ...statuses.slice(1)]).toEqual(
+            ids.map(() => `pending`),
+          ),
+        ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
+        expect(warning).toHaveBeenCalledWith(
+          `Failed to execute transactions:`,
+          storageError,
+        )
+        expect((await env.executor.peekOutbox()).map((tx) => tx.id)).toEqual(
+          ids,
+        )
+        env.executor.getOnlineDetector().notifyOnline()
+        await atOracleCheckpoint(
+          Promise.all(observed),
+          `retry recovery settled`,
+        )
+        expect(calls).toEqual([ids[0], ...ids])
+        expect(statuses).toEqual(ids.map(() => `fulfilled`))
+        expect(await env.executor.peekOutbox()).toEqual([])
+        expect([...env.serverState.keys()]).toEqual(
+          ids.map((_id, index) => `row-${index}`),
+        )
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        release.resolve()
+        await cleanupOfflineOracle(
+          [
+            () => env.executor.getOnlineDetector().notifyOnline(),
+            () => turn(),
+            () => env.executor.dispose(),
+            () => env.collection.cleanup(),
+            () => {
+              warning.mockRestore()
             },
-          }
-        : {},
-    mutationFn: () => {
-      providerCalls++
-      return Promise.reject(providerError)
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    }),
+    {
+      ...oracleLaneOptions(retryRecordOracle, seed),
+      examples: [[2], [5]],
     },
-  })
-  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-  let restarted: ReturnType<typeof createTestOfflineEnvironment> | undefined
-  let status: unknown = `pending`
-  let replayStatus: unknown = `pending`
-  let transactionId = ``
-  let observed: Promise<void> | undefined
-  let observedReplay: Promise<void> | undefined
-  let hasPrimaryFailure = false
-  try {
-    await env.waitForLeader()
-    const transaction = env.executor.createOfflineTransaction({
-      mutationFnName: env.mutationFnName,
-      autoCommit: false,
-    })
-    transactionId = transaction.id
-    transaction.mutate(() =>
-      env.collection.insert({
-        id: `permanent-cleanup-failure`,
-        value: `optimistic`,
-        completed: false,
-        updatedAt: new Date(0),
-      }),
-    )
-    observed = transaction.commit().then(
-      () => {
-        status = `fulfilled`
-      },
-      (error: unknown) => {
-        status = error
-      },
-    )
-
-    await atOracleCheckpoint(
-      deletionAttempted.promise,
-      `permanent rejection cleanup attempted`,
-    )
-    await turn()
-
-    expect(status).toBe(primaryError)
-    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
-      transaction.id,
-    ])
-    expect((await env.executor.peekOutbox())[0]).toMatchObject({
-      outboxPhase: `rejection-pending`,
-      lastError: { message: primaryError.message },
-    })
-    expect(providerCalls).toBe(1)
-
-    env.executor.dispose()
-    storage.failDeletes = false
-    restarted = createTestOfflineEnvironment({
-      storage,
-      mutationFn: () => {
-        providerCalls++
-      },
-    })
-    observedReplay = restarted.executor
-      .waitForTransactionCompletion(transactionId)
-      .then(
-        () => {
-          replayStatus = `fulfilled`
-        },
-        (error: unknown) => {
-          replayStatus = error
-        },
-      )
-    await restarted.waitForLeader()
-    await atOracleCheckpoint(
-      restartedDeletionAttempted.promise,
-      `terminal rejection deletion retried after restart`,
-    )
-    expect(providerCalls).toBe(1)
-    expect(restarted.collection.toArray).toEqual([])
-    releaseRestartedDeletion.resolve()
-    await atOracleCheckpoint(observedReplay, `terminal replay settled`)
-    expect(replayStatus).toMatchObject({
-      name: primaryError.name,
-      message: primaryError.message,
-    })
-    expect(await restarted.executor.peekOutbox()).toEqual([])
-  } catch (error) {
-    hasPrimaryFailure = true
-    throw error
-  } finally {
-    releaseRestartedDeletion.resolve()
-    if (status === `pending` && transactionId)
-      env.executor.rejectTransaction(transactionId, primaryError)
-    if (replayStatus === `pending` && transactionId)
-      restarted?.executor.rejectTransaction(transactionId, primaryError)
-    await cleanupOfflineOracle(
-      [
-        () => observed,
-        () => observedReplay,
-        () => env.executor.dispose(),
-        () => restarted?.executor.dispose(),
-        () => env.collection.cleanup(),
-        () => restarted?.collection.cleanup(),
-        () => warning.mockRestore(),
-      ],
-      hasPrimaryFailure,
-    )
-  }
+  )
 }
 
-it.each([`provider`, `hook`] as const)(
-  `preserves terminal %s failure when rejection cleanup also fails`,
-  checkTerminalFailureWithFailedDeletion,
+oracleReplayTest(it).each([20260916])(
+  `keeps admitted transactions pending when a peer's retry record cannot be updated (seed %s)`,
+  checkRetryRecordFailure,
+)
+oracleReplayTest(it, RETRY_RECORD_PROPERTY).each([undefined])(
+  `keeps admitted transactions pending when a peer's retry record cannot be updated (seed %s)`,
+  checkRetryRecordFailure,
 )
 
-// The row-local hook law ends when terminal storage fails. A failed marker or
-// deletion leaves the head's durable ownership unresolved, so the executor
-// must stop before the queued peer runs. The failed head keeps the hook error;
-// the batch reports the storage error. Provider-failure deletion is an adjacent
-// control that preserves the established storage-stop boundary.
-it.each([
-  [`provider`, `deletion`],
-  [`hook`, `marker`],
-  [`hook`, `deletion`],
-] as const)(
-  `stops queued work after %s terminal failure and failed %s`,
-  async (failureKind, failedStep) => {
-    const providerError =
-      failureKind === `provider`
-        ? new NonRetriableError(`provider rejected`)
-        : new Error(`HTTP 401 Unauthorized`)
-    const hookError = new Error(`retry decision failed`)
-    const callerError = failureKind === `hook` ? hookError : providerError
-    const storageError = new Error(`${failedStep} rejected`)
-    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
-    class Storage extends FakeStorageAdapter {
-      failCleanup = true
-
-      override async set(key: string, value: string): Promise<void> {
-        if (
-          this.failCleanup &&
-          failedStep === `marker` &&
-          key === `tx:terminal-cleanup-head` &&
-          (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
-            `rejection-pending`
-        )
-          throw storageError
-        await super.set(key, value)
-      }
-
-      override async delete(key: string): Promise<void> {
-        if (this.failCleanup && failedStep === `deletion`) throw storageError
-        await super.delete(key)
+// The failed durable write can be first, middle, or last among three distinct
+// IDs. All positions are pinned, so the conditional failure premise is reached
+// at each boundary. Removing the two admitted peers would hide accidental
+// global rejection. A duplicate ID is outside this legal admission grammar.
+async function checkDurableAdmissionFailure(seed: number | undefined) {
+  await fc.assert(
+    fc.asyncProperty(fc.integer({ min: 0, max: 2 }), async (failedIndex) => {
+      const storageError = new Error(`admission unavailable`)
+      class Storage extends FakeStorageAdapter {
+        writes = 0
+        override async set(key: string, value: string): Promise<void> {
+          if (this.writes++ === failedIndex) throw storageError
+          await super.set(key, value)
+        }
       }
-    }
-    const storage = new Storage()
-    const outbox = new OutboxManager(storage, {})
-    const scheduler = new KeyScheduler()
-    const rejections: Array<{ id: string; error: Error }> = []
-    const resolutions: Array<string> = []
-    let peerCalls = 0
-    const signaler: TransactionSignaler = {
-      isOfflineEnabled: true,
-      isOnline: () => true,
-      resolveTransaction: (id) => resolutions.push(id),
-      rejectTransaction: (id, error) => rejections.push({ id, error }),
-      registerRestorationTransaction: () => {},
-    }
-    const executor = new TransactionExecutor(
-      scheduler,
-      outbox,
-      {
-        collections: {},
-        mutationFns: {
-          syncData: () => Promise.reject(providerError),
-          peer: () => {
-            peerCalls++
-            return Promise.resolve()
-          },
+      const release = gate()
+      const env = createTestOfflineEnvironment({
+        storage: new Storage(),
+        mutationFn: async (params) => {
+          await release.promise
+          env.applyMutations(params.transaction.mutations)
         },
-        ...(failureKind === `hook`
-          ? {
-              shouldRetry: () => {
-                throw hookError
+      })
+      const ids: Array<string> = []
+      const statuses: Array<unknown> = []
+      const observed: Array<Promise<void>> = []
+      let hasPrimaryFailure = false
+      try {
+        await env.waitForLeader()
+        for (let index = 0; index < 3; index++) {
+          const tx = env.executor.createOfflineTransaction({
+            mutationFnName: env.mutationFnName,
+            autoCommit: false,
+          })
+          ids.push(tx.id)
+          tx.mutate(() =>
+            env.collection.insert({
+              id: `row-${index}`,
+              value: `value-${index}`,
+              completed: false,
+              updatedAt: new Date(0),
+            }),
+          )
+          statuses[index] = `pending`
+          observed.push(
+            tx.commit().then(
+              () => {
+                statuses[index] = `fulfilled`
               },
-            }
-          : {}),
-        jitter: false,
-      },
-      signaler,
-    )
-    const transaction: OfflineTransaction = {
-      id: `terminal-cleanup-head`,
-      mutationFnName: `syncData`,
-      mutations: [],
-      keys: [],
-      idempotencyKey: `terminal-cleanup-head`,
-      createdAt: new Date(0),
-      retryCount: 0,
-      nextAttemptAt: 0,
-      version: 1,
-    }
-    const peer: OfflineTransaction = {
-      ...transaction,
-      id: `terminal-cleanup-peer`,
-      mutationFnName: `peer`,
-      idempotencyKey: `terminal-cleanup-peer`,
-      createdAt: new Date(1),
-    }
-    await outbox.add(transaction)
-    await outbox.add(peer)
-    scheduler.schedule(peer)
-    try {
-      await expect(executor.execute(transaction)).rejects.toBe(storageError)
-      expect(rejections).toEqual([{ id: transaction.id, error: callerError }])
-      expect(resolutions).toEqual([])
-      expect(peerCalls).toBe(0)
-      expect(scheduler.getPendingCount()).toBe(2)
-      expect((await outbox.get(transaction.id))?.outboxPhase).toBe(
-        failedStep === `deletion` ? `rejection-pending` : undefined,
-      )
-      expect(await outbox.get(peer.id)).toMatchObject({ id: peer.id })
-
-      storage.failCleanup = false
-      executor.resetRetryDelays()
-      await expect(executor.executeAll()).rejects.toBe(storageError)
-      await expect(executor.execute(peer)).rejects.toBe(storageError)
-      expect(peerCalls).toBe(0)
-      expect(resolutions).toEqual([])
-      expect(scheduler.getPendingCount()).toBe(2)
-      expect(await outbox.get(peer.id)).toMatchObject({ id: peer.id })
-    } finally {
-      executor.pause()
-      warning.mockRestore()
-    }
-  },
-)
-
-it(`stops after failed deletion without rerunning the provider`, async () => {
-  const storageError = new Error(`delete rejected`)
-  const rejections: Array<Error> = []
-  const retryCounts: Array<number> = []
-  const delay = vi.spyOn(DefaultRetryPolicy.prototype, `calculateDelay`)
-  delay.mockImplementation((retryCount) => {
-    retryCounts.push(retryCount)
-    return 60_000
-  })
-  class Storage extends FakeStorageAdapter {
-    override delete(): Promise<void> {
-      return Promise.reject(storageError)
-    }
-  }
-  const outbox = new OutboxManager(new Storage(), {})
-  const scheduler = new KeyScheduler()
-  let providerCalls = 0
-  const signaler: TransactionSignaler = {
-    isOfflineEnabled: true,
-    isOnline: () => true,
-    resolveTransaction: () => {
-      throw new Error(`deletion has not succeeded`)
-    },
-    rejectTransaction: (_id, error) => rejections.push(error),
-    registerRestorationTransaction: () => {},
-  }
-  const executor = new TransactionExecutor(
-    scheduler,
-    outbox,
+              (error: unknown) => {
+                statuses[index] = error
+              },
+            ),
+          )
+          await turn()
+        }
+        expect(statuses[failedIndex]).toBe(storageError)
+        expect((await env.executor.peekOutbox()).map((tx) => tx.id)).toEqual(
+          ids.filter((_id, index) => index !== failedIndex),
+        )
+        release.resolve()
+        await atOracleCheckpoint(
+          Promise.all(observed),
+          `admitted peers settled`,
+        )
+        expect(env.mutationCalls.map((call) => call.transaction.id)).toEqual(
+          ids.filter((_id, index) => index !== failedIndex),
+        )
+        for (let index = 0; index < 3; index++) {
+          expect(statuses[index]).toBe(
+            index === failedIndex ? storageError : `fulfilled`,
+          )
+          expect(env.collection.has(`row-${index}`)).toBe(index !== failedIndex)
+        }
+        const expectedStatuses = ids.map((_id, index) =>
+          index === failedIndex ? storageError : `fulfilled`,
+        )
+        expect(() =>
+          expect(statuses.map(() => storageError)).toEqual(expectedStatuses),
+        ).toThrowError(expect.objectContaining({ name: `AssertionError` }))
+        expect(await env.executor.peekOutbox()).toEqual([])
+      } catch (error) {
+        hasPrimaryFailure = true
+        throw error
+      } finally {
+        release.resolve()
+        await cleanupOfflineOracle(
+          [
+            () => turn(),
+            () => env.executor.dispose(),
+            () => env.collection.cleanup(),
+          ],
+          hasPrimaryFailure,
+        )
+      }
+    }),
     {
-      collections: {},
-      mutationFns: {
-        syncData: () => {
-          providerCalls++
-          return Promise.resolve()
-        },
-      },
-      jitter: false,
+      ...oracleLaneOptions(admissionOracle, seed),
+      examples: [[0], [1], [2]],
     },
-    signaler,
   )
-  const transaction: OfflineTransaction = {
-    id: `deletion-backoff`,
-    mutationFnName: `syncData`,
-    mutations: [],
-    keys: [],
-    idempotencyKey: `deletion-backoff`,
-    createdAt: new Date(0),
-    retryCount: 0,
-    nextAttemptAt: 0,
-    version: 1,
-  }
-  await outbox.add(transaction)
-  try {
-    await expect(executor.execute(transaction)).rejects.toBe(storageError)
-    executor.resetRetryDelays()
-    await expect(executor.executeAll()).rejects.toBe(storageError)
-    expect(retryCounts).toEqual([])
-    expect(rejections).toEqual([storageError])
-    expect(providerCalls).toBe(1)
-    expect((await outbox.get(transaction.id))?.outboxPhase).toBe(
-      `deletion-pending`,
-    )
-  } finally {
-    executor.pause()
-    delay.mockRestore()
-  }
-})
+}
 
-// Focused witness, not a generated history: the FIFO model keeps a queued
-// transaction's optimistic rows, and a rollback while the transaction
-// persists removes them. Once the mutation function runs, the executor alone
-// settles the waiter, so a rollback must not settle it early or change its
-// outcome.
-it.each([true, false])(
-  `keeps the executor's outcome for a rollback while persisting (succeeds: %s)`,
-  async (succeeds) => {
-    const providerError = new NonRetriableError(`provider failed`)
-    const entered = gate()
-    const release = gate()
-    const env = createTestOfflineEnvironment({
-      mutationFn: async (params) => {
-        entered.resolve()
-        await release.promise
-        if (!succeeds) throw providerError
-        env.applyMutations(params.transaction.mutations)
-      },
-    })
-    const { rejections: unhandled, cleanup: cleanupUnhandled } =
-      captureUnhandledRejections()
-    const logged = vi.spyOn(console, `error`).mockImplementation(() => {})
-    try {
-      await env.waitForLeader()
-      const tx = env.executor.createOfflineTransaction({
-        mutationFnName: env.mutationFnName,
-        autoCommit: false,
-      })
-      tx.mutate(() =>
-        env.collection.insert({
-          id: `held`,
-          value: `v`,
-          completed: false,
-          updatedAt: new Date(0),
-        }),
-      )
-      const statuses: Array<unknown> = []
-      const wait = env.executor.waitForTransactionCompletion(tx.id).then(
-        () => statuses.push(`fulfilled`),
-        (error: unknown) => statuses.push(error),
-      )
-      void tx.commit().catch(() => undefined)
-      await atOracleCheckpoint(entered.promise, `provider entered`)
-      tx.rollback()
-      await turn()
-      expect(statuses, `waiter before the executor settles`).toEqual([])
-      release.resolve()
-      await atOracleCheckpoint(wait, `waiter settled`)
-      expect(statuses, `waiter outcome`).toEqual([
-        succeeds ? `fulfilled` : providerError,
-      ])
-      expect(env.serverState.has(`held`), `server row`).toBe(succeeds)
-      expect(await env.executor.peekOutbox(), `outbox`).toEqual([])
-      await turn()
-      expect(unhandled, `unhandled rejections`).toEqual([])
-    } finally {
-      release.resolve()
-      cleanupUnhandled()
-      logged.mockRestore()
-      env.executor.dispose()
-    }
-  },
+oracleReplayTest(it).each([20260916])(
+  `rejects only the transaction whose durable admission fails (seed %s)`,
+  checkDurableAdmissionFailure,
 )
-
-// Focused witness, not a generated history: a failed outbox write stops the
-// executor, so a FIFO history cannot continue past it. For every commit path,
-// the admission write fails, the receipt rejects with the storage error, and
-// the failure neither escapes as an unhandled rejection nor is logged again.
-it.each([`manual`, `auto`, `default`, `action`] as const)(
-  `rejects the receipt when the outbox write fails (%s)`,
-  async (commit) => {
-    const storageError = new Error(`outbox write unavailable`)
-    class FailingStorage extends FakeStorageAdapter {
-      override async set(key: string, value: string): Promise<void> {
-        if (key.startsWith(`tx:`)) throw storageError
-        await super.set(key, value)
-      }
-    }
-    const env = createTestOfflineEnvironment({
-      storage: new FailingStorage(),
-      mutationFn: (params) => {
-        env.applyMutations(params.transaction.mutations)
-        return Promise.resolve()
-      },
-    })
-    const { rejections: unhandled, cleanup: cleanupUnhandled } =
-      captureUnhandledRejections()
-    const logged = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const debug = vi.spyOn(console, `log`).mockImplementation(() => {})
-    try {
-      await env.waitForLeader()
-      const write = () =>
-        env.collection.insert({
-          id: `stored`,
-          value: `v`,
-          completed: false,
-          updatedAt: new Date(0),
-        })
-      let receipt: Promise<unknown>
-      if (commit === `action`) {
-        const transaction = env.executor.createOfflineAction({
-          mutationFnName: env.mutationFnName,
-          onMutate: write,
-        })(undefined)
-        receipt = transaction.when(`settled`)
-      } else {
-        const tx = env.executor.createOfflineTransaction({
-          mutationFnName: env.mutationFnName,
-          ...(commit === `default` ? {} : { autoCommit: commit === `auto` }),
-        })
-        const transaction = tx.mutate(write)
-        receipt =
-          commit === `manual` ? tx.commit() : transaction.when(`settled`)
-      }
-      await expect(receipt).rejects.toBe(storageError)
-      await turn()
-      expect(unhandled, `unhandled rejections`).toEqual([])
-      // The executor logs the persist failure once; nothing logs it again.
-      expect(
-        logged.mock.calls.map(([message]) => String(message)),
-        `errors logged`,
-      ).toEqual([
-        expect.stringMatching(/^Failed to persist offline transaction /),
-      ])
-      expect(debug.mock.calls, `debug output`).toEqual([])
-      expect(env.collection.get(`stored`), `optimistic row`).toBeUndefined()
-      expect(env.serverState.size, `provider calls`).toBe(0)
-    } finally {
-      cleanupUnhandled()
-      logged.mockRestore()
-      debug.mockRestore()
-      env.executor.dispose()
-      await env.collection.cleanup()
-    }
-  },
+oracleReplayTest(it, ADMISSION_PROPERTY).each([undefined])(
+  `rejects only the transaction whose durable admission fails (seed %s)`,
+  checkDurableAdmissionFailure,
 )
+
+// The checks run generated histories and compare production with each model's
+// prediction at every checkpoint. The models state the settlement rules: the
+// retry decision table and FIFO local rows, and the visibility and provider
+// eligibility of a started peer. Fixed scenarios whose expectations are
+// written by hand are not oracle tests; they live in transaction-settlement.test.ts.
+declareOracle({
+  check: [
+    checkSettlement,
+    checkRetryDecision,
+    checkRetryRecordFailure,
+    checkDurableAdmissionFailure,
+  ],
+  model: [
+    expectedRetryDecision,
+    expectedRestoredLocalRows,
+    expectedStartedPeer,
+  ],
+})
diff --git a/packages/offline-transactions/tests/transaction-settlement.test.ts b/packages/offline-transactions/tests/transaction-settlement.test.ts
new file mode 100644
index 0000000000..a6d07a4744
--- /dev/null
+++ b/packages/offline-transactions/tests/transaction-settlement.test.ts
@@ -0,0 +1,2358 @@
+// Offline settlement cases whose expectations are written by hand: a retry
+// deadline that a hook must not change, a rejected hook result, a held
+// deletion, a failed terminal marker, and a rejected outbox write. Each runs
+// the real executor against a finite history and compares with values written
+// in the test. The settlement laws they illustrate are owned by
+// transaction-settlement-oracle.property.test.ts.
+import { runInNewContext } from 'node:vm'
+import { createCollection, createTransaction } from '@tanstack/db'
+import { expect, it, vi } from 'vitest'
+import { NonRetriableError } from '../src/types'
+import { OutboxManager } from '../src/outbox/OutboxManager'
+import { KeyScheduler } from '../src/executor/KeyScheduler'
+import { TransactionExecutor } from '../src/executor/TransactionExecutor'
+import { DefaultRetryPolicy } from '../src/retry/RetryPolicy'
+import {
+  FakeStorageAdapter,
+  createTestOfflineEnvironment,
+  gate,
+  turn,
+} from './harness'
+import {
+  atOracleCheckpoint,
+  captureUnhandledRejections,
+  cleanupOfflineOracle,
+} from './oracle-lifecycle'
+import type { TestItem } from './harness'
+import type { OfflineTransaction, TransactionSignaler } from '../src/types'
+
+// The no-hook run is the reference for existing retry timing. With the same
+// retry count, ordinary Error, disabled jitter, and clock, adding a true hook
+// may change the decision path but not the durable deadline. Comparing outbox
+// records leaves the choice of delay implementation to production.
+it(`preserves the default retry deadline when the hook agrees`, async () => {
+  const fixedNow = 1_000_000
+  const providerError = new Error(`temporary connection failure`)
+  const hookCalls: Array<{ error: Error; retryCount: number }> = []
+  const clock = vi.spyOn(Date, `now`).mockReturnValue(fixedNow)
+  const signaler: TransactionSignaler = {
+    isOfflineEnabled: true,
+    isOnline: () => true,
+    resolveTransaction: () => {
+      throw new Error(`failed provider cannot resolve`)
+    },
+    rejectTransaction: () => {
+      throw new Error(`ordinary failure should retry`)
+    },
+    registerRestorationTransaction: () => {},
+  }
+  const observeDeadline = async (withHook: boolean): Promise<number> => {
+    const outbox = new OutboxManager(new FakeStorageAdapter(), {})
+    const executor = new TransactionExecutor(
+      new KeyScheduler(),
+      outbox,
+      {
+        collections: {},
+        mutationFns: {
+          syncData: () => Promise.reject(providerError),
+        },
+        jitter: false,
+        ...(withHook
+          ? {
+              shouldRetry: (error: Error, retryCount: number) => {
+                hookCalls.push({ error, retryCount })
+                return true
+              },
+            }
+          : {}),
+      },
+      signaler,
+    )
+    const transaction: OfflineTransaction = {
+      id: withHook ? `hooked-deadline` : `default-deadline`,
+      mutationFnName: `syncData`,
+      mutations: [],
+      keys: [],
+      idempotencyKey: withHook ? `hooked-deadline` : `default-deadline`,
+      createdAt: new Date(0),
+      retryCount: 0,
+      nextAttemptAt: 0,
+      version: 1,
+    }
+    await outbox.add(transaction)
+    try {
+      await atOracleCheckpoint(
+        executor.execute(transaction),
+        `retry deadline ${withHook ? `with` : `without`} hook`,
+      )
+      const stored = await outbox.get(transaction.id)
+      expect(stored).toMatchObject({ retryCount: 1 })
+      return stored!.nextAttemptAt
+    } finally {
+      executor.pause()
+    }
+  }
+
+  try {
+    const defaultDeadline = await observeDeadline(false)
+    const hookedDeadline = await observeDeadline(true)
+    expect(defaultDeadline).toBeGreaterThan(fixedNow)
+    expect(hookedDeadline).toBe(defaultDeadline)
+    expect(hookCalls).toEqual([{ error: providerError, retryCount: 0 }])
+    expect(hookCalls[0]?.error).toBe(providerError)
+  } finally {
+    clock.mockRestore()
+  }
+})
+
+// Two ordinary provider failures are a legal history. The first explicit
+// answer keeps the head. On the second failure, false removes it while
+// undefined delegates to the default and keeps it for a third attempt. The
+// distinct Errors expose a stale-error decision at the second durable cut.
+it.each([`terminal`, `defer`] as const)(
+  `passes the second error and retry count to the decision hook (%s)`,
+  async (secondDecision) => {
+    const firstError = new Error(`temporary first failure`)
+    const secondError = new Error(`temporary second failure`)
+    const firstRetryStored = gate()
+    const secondDecisionStored = gate()
+    const hookCalls: Array<{ error: Error; retryCount: number }> = []
+    let transactionId = ``
+    class DecisionStorage extends FakeStorageAdapter {
+      override async set(key: string, value: string): Promise<void> {
+        await super.set(key, value)
+        if (key !== `tx:${transactionId}`) return
+        const record = JSON.parse(value) as { retryCount: number }
+        if (record.retryCount === 1) firstRetryStored.resolve()
+        if (record.retryCount === 2) secondDecisionStored.resolve()
+      }
+
+      override async delete(key: string): Promise<void> {
+        await super.delete(key)
+        if (key === `tx:${transactionId}`) secondDecisionStored.resolve()
+      }
+    }
+    const config = {
+      jitter: false,
+      shouldRetry: (error: Error, retryCount: number): boolean | undefined => {
+        hookCalls.push({ error, retryCount })
+        if (retryCount === 0) return true
+        return secondDecision === `terminal` ? false : undefined
+      },
+    }
+    const env = createTestOfflineEnvironment({
+      storage: new DecisionStorage(),
+      config,
+      mutationFn: (params) => {
+        const attempt = env.mutationCalls.length
+        if (attempt === 1) throw firstError
+        if (attempt === 2) throw secondError
+        env.applyMutations(params.transaction.mutations)
+      },
+    })
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let commitStatus: unknown = `pending`
+    let waitStatus: unknown = `pending`
+    const observed: Array<Promise<void>> = []
+    let hasPrimaryFailure = false
+    try {
+      await env.waitForLeader()
+      const tx = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      transactionId = tx.id
+      const observedWait = env.executor
+        .waitForTransactionCompletion(tx.id)
+        .then(
+          () => {
+            waitStatus = `fulfilled`
+          },
+          (error: unknown) => {
+            waitStatus = error
+          },
+        )
+      tx.mutate(() =>
+        env.collection.insert({
+          id: `retry-count`,
+          value: `pending`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      const observedCommit = tx.commit().then(
+        () => {
+          commitStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          commitStatus = error
+        },
+      )
+      observed.push(observedCommit, observedWait)
+      await atOracleCheckpoint(firstRetryStored.promise, `first retry stored`)
+      expect((await env.executor.peekOutbox())[0]?.retryCount).toBe(1)
+      expect(commitStatus).toBe(`pending`)
+      expect(waitStatus).toBe(`pending`)
+
+      await turn()
+      env.executor.getOnlineDetector().notifyOnline()
+      await atOracleCheckpoint(
+        secondDecisionStored.promise,
+        `second decision stored`,
+      )
+      await turn()
+      expect(hookCalls).toEqual([
+        { error: firstError, retryCount: 0 },
+        { error: secondError, retryCount: 1 },
+      ])
+      expect(hookCalls[0]?.error).toBe(firstError)
+      expect(hookCalls[1]?.error).toBe(secondError)
+      expect(env.mutationCalls).toHaveLength(2)
+      if (secondDecision === `defer`) {
+        expect(await env.executor.peekOutbox()).toMatchObject([
+          { id: tx.id, retryCount: 2 },
+        ])
+        expect(commitStatus).toBe(`pending`)
+        expect(waitStatus).toBe(`pending`)
+        env.executor.getOnlineDetector().notifyOnline()
+        await atOracleCheckpoint(
+          Promise.all([observedCommit, observedWait]),
+          `delegated second retry settled caller`,
+        )
+        expect(env.mutationCalls).toHaveLength(3)
+        expect(commitStatus).toBe(`fulfilled`)
+        expect(waitStatus).toBe(`fulfilled`)
+        expect(await env.executor.peekOutbox()).toEqual([])
+      } else {
+        expect(await env.executor.peekOutbox()).toEqual([])
+        await atOracleCheckpoint(
+          Promise.all([observedCommit, observedWait]),
+          `second failure settled caller`,
+        )
+        expect(commitStatus).toBe(secondError)
+        expect(waitStatus).toBe(secondError)
+      }
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      if (
+        transactionId &&
+        (commitStatus === `pending` || waitStatus === `pending`)
+      )
+        env.executor.rejectTransaction(
+          transactionId,
+          new Error(`retry count oracle cleanup`),
+        )
+      await cleanupOfflineOracle(
+        [
+          () => Promise.all(observed),
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+          () => warning.mockRestore(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// The same-Error contract is based on the thrown value, not its realm. A foreign
+// Error with a status-bearing field must reach the public hook unchanged. The
+// 401 is a boundary control: the default decision would terminate it, while
+// the hook's true answer retains the row for a later successful attempt.
+it(`passes a cross-realm Error unchanged to shouldRetry`, async () => {
+  const providerError = runInNewContext(
+    `Object.assign(new Error('HTTP 401 Unauthorized'), { status: 401 })`,
+  ) as Error & { status: number }
+  expect(providerError instanceof Error).toBe(false)
+  const hookEntered = gate()
+  const retryStored = gate()
+  let transactionId = ``
+  let hookError: Error | undefined
+  class RetryStorage extends FakeStorageAdapter {
+    override async set(key: string, value: string): Promise<void> {
+      await super.set(key, value)
+      if (key !== `tx:${transactionId}`) return
+      if ((JSON.parse(value) as { retryCount: number }).retryCount === 1)
+        retryStored.resolve()
+    }
+  }
+  const env = createTestOfflineEnvironment({
+    storage: new RetryStorage(),
+    config: {
+      jitter: false,
+      shouldRetry: (error, retryCount) => {
+        expect(retryCount).toBe(0)
+        hookError = error
+        hookEntered.resolve()
+        return (error as Error & { status?: number }).status === 401
+      },
+    },
+    mutationFn: (params) => {
+      if (params.attempt === 1) throw providerError
+      env.applyMutations(params.transaction.mutations)
+    },
+  })
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  let commitResult: unknown = `pending`
+  let observedCommit: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const tx = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    transactionId = tx.id
+    tx.mutate(() =>
+      env.collection.insert({
+        id: `foreign-error-retry`,
+        value: `pending`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    observedCommit = tx.commit().then(
+      () => {
+        commitResult = `fulfilled`
+      },
+      (error: unknown) => {
+        commitResult = error
+      },
+    )
+    await atOracleCheckpoint(hookEntered.promise, `foreign Error reached hook`)
+    expect(hookError).toBe(providerError)
+    expect((hookError as Error & { status?: number }).status).toBe(401)
+    await atOracleCheckpoint(retryStored.promise, `foreign Error retry stored`)
+    expect((await env.executor.peekOutbox())[0]?.retryCount).toBe(1)
+    expect(commitResult).toBe(`pending`)
+    env.executor.getOnlineDetector().notifyOnline()
+    await atOracleCheckpoint(observedCommit, `foreign Error retry settled`)
+    expect(commitResult).toBe(`fulfilled`)
+    expect(env.mutationCalls).toHaveLength(2)
+    expect(await env.executor.peekOutbox()).toEqual([])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    if (transactionId && commitResult === `pending`)
+      env.executor.rejectTransaction(
+        transactionId,
+        new Error(`foreign Error oracle cleanup`),
+      )
+    await cleanupOfflineOracle(
+      [
+        () => observedCommit,
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+        () => warning.mockRestore(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// The public hook always receives an Error, including when the named mutation
+// function rejects with a primitive or object. Returning false distinguishes
+// this hook decision from the default retry for these inputs. The public commit
+// rejection must be the same converted Error observed by the hook.
+it.each([
+  { label: `string`, rejection: `network disconnected` },
+  { label: `object`, rejection: { status: 401 } },
+])(
+  `passes a converted Error to shouldRetry for a $label rejection`,
+  async ({ rejection }) => {
+    const hookCalls: Array<{ error: Error; retryCount: number }> = []
+    const env = createTestOfflineEnvironment({
+      config: {
+        shouldRetry: (error, retryCount) => {
+          hookCalls.push({ error, retryCount })
+          return false
+        },
+      },
+      mutationFn: () => Promise.reject(rejection),
+    })
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let transactionId = ``
+    let observedCommit: Promise<void> | undefined
+    let commitStatus: unknown = `pending`
+    let hasPrimaryFailure = false
+    try {
+      await env.waitForLeader()
+      const tx = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      transactionId = tx.id
+      tx.mutate(() =>
+        env.collection.insert({
+          id: `converted-error`,
+          value: `pending`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      observedCommit = tx.commit().then(
+        () => {
+          commitStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          commitStatus = error
+        },
+      )
+      await atOracleCheckpoint(
+        observedCommit,
+        `non-Error rejection settled caller`,
+      )
+      expect(hookCalls).toEqual([{ error: expect.any(Error), retryCount: 0 }])
+      expect(hookCalls[0]?.error).not.toBe(rejection)
+      expect(commitStatus).toBe(hookCalls[0]?.error)
+      expect(await env.executor.peekOutbox()).toEqual([])
+      expect(env.collection.toArray).toEqual([])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      if (transactionId && commitStatus === `pending`)
+        env.executor.rejectTransaction(
+          transactionId,
+          new Error(`non-Error rejection oracle cleanup`),
+        )
+      await cleanupOfflineOracle(
+        [
+          () => observedCommit,
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+          () => warning.mockRestore(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// A configuration failure is observed through public commit(), not only the
+// executor's internal batch promise. The provider error is a 401, so ignoring
+// the hook would reject with the provider error. A Promise is invalid whether
+// it fulfills or rejects; its later rejection must stay within this row-local
+// failure boundary rather than become an unhandled process rejection. A fresh
+// executor over the same storage must skip the failed row.
+it.each([
+  `throw`,
+  `null`,
+  `zero`,
+  `promise-fulfilled`,
+  `promise-rejected`,
+] as const)(
+  `rejects public commit when shouldRetry fails (%s)`,
+  async (failureKind) => {
+    const providerError = new Error(`HTTP 401 Unauthorized`)
+    const hookError = new Error(`retry decision unavailable`)
+    const asyncError = new Error(`async retry decision failed`)
+    const { rejections: unhandled, cleanup: cleanupUnhandled } =
+      captureUnhandledRejections()
+    const providerEntered = gate()
+    const releaseProvider = gate()
+    const terminalMarkerStored = gate()
+    const retryRecordStored = gate()
+    let hookCalls = 0
+    let transactionId = ``
+    class DecisionStorage extends FakeStorageAdapter {
+      override async set(key: string, value: string): Promise<void> {
+        await super.set(key, value)
+        if (key !== `tx:${transactionId}`) return
+        const record = JSON.parse(value) as {
+          outboxPhase?: string
+          retryCount: number
+        }
+        if (record.outboxPhase === `rejection-pending`)
+          terminalMarkerStored.resolve()
+        if (record.retryCount === 1) retryRecordStored.resolve()
+      }
+    }
+    const config = {
+      jitter: false,
+      shouldRetry: (
+        _error: Error,
+        _retryCount: number,
+      ): boolean | undefined => {
+        hookCalls++
+        if (failureKind === `throw`) throw hookError
+        if (failureKind === `null`)
+          return null as unknown as boolean | undefined
+        if (failureKind === `zero`) return 0 as unknown as boolean | undefined
+        // An async hook returns a Promise. Neither outcome is a synchronous
+        // retry decision, and a rejection must still be observed.
+        return (failureKind === `promise-rejected`
+          ? Promise.reject(asyncError)
+          : Promise.resolve(true)) as unknown as boolean | undefined
+      },
+    }
+    const storage = new DecisionStorage()
+    const env = createTestOfflineEnvironment({
+      storage,
+      config,
+      mutationFn: async () => {
+        providerEntered.resolve()
+        await releaseProvider.promise
+        throw providerError
+      },
+    })
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    let restarted: ReturnType<typeof createTestOfflineEnvironment> | undefined
+    let commitStatus: unknown = `pending`
+    let hasPrimaryFailure = false
+    try {
+      await env.waitForLeader()
+      const tx = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      transactionId = tx.id
+      tx.mutate(() =>
+        env.collection.insert({
+          id: `invalid-decision`,
+          value: `pending`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      const observedCommit = tx.commit().then(
+        () => {
+          commitStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          commitStatus = error
+        },
+      )
+      await atOracleCheckpoint(providerEntered.promise, `provider entered`)
+      const [admitted] = await env.executor.peekOutbox()
+      expect(admitted?.retryCount).toBe(0)
+      releaseProvider.resolve()
+      // The first durable decision must be terminal. A mistaken implementation
+      // that awaits a Promise answer stores a retry record instead of a marker.
+      const storedDecision = await atOracleCheckpoint(
+        Promise.race([
+          terminalMarkerStored.promise.then(() => `terminal` as const),
+          retryRecordStored.promise.then(() => `retry` as const),
+        ]),
+        `invalid decision recorded`,
+      )
+      expect(storedDecision).toBe(`terminal`)
+      await atOracleCheckpoint(
+        observedCommit,
+        `invalid decision settled caller`,
+      )
+
+      if (failureKind === `throw`) expect(commitStatus).toBe(hookError)
+      else {
+        expect(commitStatus).toBeInstanceOf(TypeError)
+        expect(commitStatus).not.toBe(providerError)
+      }
+      expect(hookCalls).toBe(1)
+      const remaining = await env.executor.peekOutbox()
+      await turn()
+      expect(unhandled).toEqual([])
+      expect(env.executor.getRunningCount()).toBe(0)
+      expect(env.mutationCalls).toHaveLength(1)
+      expect(env.collection.toArray).toEqual([])
+
+      env.executor.dispose()
+      restarted = createTestOfflineEnvironment({
+        storage,
+        mutationFn: (params) => {
+          restarted!.applyMutations(params.transaction.mutations)
+        },
+      })
+      await restarted.waitForLeader()
+      const fresh = restarted.executor.createOfflineTransaction({
+        mutationFnName: restarted.mutationFnName,
+        autoCommit: false,
+      })
+      fresh.mutate(() =>
+        restarted!.collection.insert({
+          id: `after-hook-failure`,
+          value: `fresh`,
+          completed: false,
+          updatedAt: new Date(1),
+        }),
+      )
+      await atOracleCheckpoint(fresh.commit(), `fresh work after hook failure`)
+      // The new transaction proves that restart has passed the FIFO head.
+      // A retained failed row would have called the provider before this one.
+      expect(
+        restarted.mutationCalls.map(({ transaction: { id } }) => id),
+      ).toEqual([fresh.id])
+      expect(remaining).toEqual([])
+      expect(await restarted.executor.peekOutbox()).toEqual([])
+      expect(restarted.collection.toArray.map(({ id }) => id)).toEqual([
+        `after-hook-failure`,
+      ])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseProvider.resolve()
+      if (transactionId && commitStatus === `pending`)
+        env.executor.rejectTransaction(
+          transactionId,
+          new Error(`invalid decision oracle cleanup`),
+        )
+      await cleanupOfflineOracle(
+        [
+          () => env.executor.dispose(),
+          () => restarted?.executor.dispose(),
+          () => env.collection.cleanup(),
+          () => restarted?.collection.cleanup(),
+          () => warning.mockRestore(),
+          () => cleanupUnhandled(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// The model treats an acknowledged peer write as queued work. The hook fault
+// belongs to the head row; a peer admitted before or during terminal cleanup
+// stays pending until the head's deletion acknowledges and its provider runs.
+// This relation does not copy the executor's queue or cleanup machinery.
+function expectedHookFaultPeerAtHeldCleanup(): {
+  durable: true
+  outcome: `pending`
+} {
+  return { durable: true, outcome: `pending` }
+}
+
+function observedFaultAdmissionOutcome(value: unknown) {
+  if (value instanceof Error) return `rejected`
+  return value
+}
+
+// Legal history: the FIFO head enters its named mutation function, one peer
+// becomes durable, then the hook throws or returns an invalid result. Storage
+// holds the terminal marker read, write, or deletion while a second public commit
+// joins the queue. The held cut compares settlement, exact outbox contents,
+// provider calls, and optimistic rows. After deletion, both peers must run in
+// FIFO order in this executor. The held Promise rejects only after both peers
+// settle, so its later failure must not escape as an unhandled process
+// rejection. No storage write fails.
+it.each([
+  [`throw`, `marker`],
+  [`throw`, `read`],
+  [`throw`, `deletion`],
+  [`invalid`, `marker`],
+  [`invalid`, `read`],
+  [`invalid`, `deletion`],
+  [`promise-late-rejection`, `deletion`],
+] as const)(
+  `admits queued work during %s hook failure and %s cleanup`,
+  async (failureKind, heldStep) => {
+    const providerError = new Error(`HTTP 401 Unauthorized`)
+    const hookError = new Error(`retry decision failed`)
+    const asyncError = new Error(`async retry decision failed`)
+    const { rejections: unhandled, cleanup: cleanupUnhandled } =
+      captureUnhandledRejections()
+    const providerEntered = gate()
+    const releaseProvider = gate()
+    const hookEntered = gate()
+    const preFaultStored = gate()
+    const terminalCleanupEntered = gate()
+    const releaseTerminalCleanup = gate()
+    const postFaultStored = gate()
+    let headId = ``
+    let preFaultId = ``
+    let postFaultId = ``
+    let holdTerminalRead = false
+    let asyncDecision: Promise<boolean> | undefined
+    let rejectAsyncDecision: ((error: Error) => void) | undefined
+    let lateDecisionRejected = false
+    const providerCalls: Array<string> = []
+
+    class HeldTerminalDeleteStorage extends FakeStorageAdapter {
+      override async get(key: string): Promise<string | null> {
+        if (heldStep === `read` && key === `tx:${headId}` && holdTerminalRead) {
+          holdTerminalRead = false
+          terminalCleanupEntered.resolve()
+          await releaseTerminalCleanup.promise
+        }
+        return super.get(key)
+      }
+
+      override async set(key: string, value: string): Promise<void> {
+        if (
+          heldStep === `marker` &&
+          key === `tx:${headId}` &&
+          (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
+            `rejection-pending`
+        ) {
+          terminalCleanupEntered.resolve()
+          await releaseTerminalCleanup.promise
+        }
+        await super.set(key, value)
+        if (key === `tx:${preFaultId}`) preFaultStored.resolve()
+        if (key === `tx:${postFaultId}`) postFaultStored.resolve()
+      }
+
+      override async delete(key: string): Promise<void> {
+        if (heldStep === `deletion` && key === `tx:${headId}`) {
+          terminalCleanupEntered.resolve()
+          await releaseTerminalCleanup.promise
+        }
+        await super.delete(key)
+      }
+    }
+
+    const env = createTestOfflineEnvironment({
+      storage: new HeldTerminalDeleteStorage(),
+      config: {
+        shouldRetry: (): boolean | undefined => {
+          hookEntered.resolve()
+          holdTerminalRead = true
+          if (failureKind === `throw`) throw hookError
+          if (failureKind === `promise-late-rejection`) {
+            asyncDecision = new Promise<boolean>((_resolve, reject) => {
+              rejectAsyncDecision = reject
+            })
+            return asyncDecision as unknown as boolean | undefined
+          }
+          return null as unknown as boolean | undefined
+        },
+      },
+      mutationFn: async ({ transaction }) => {
+        providerCalls.push(transaction.id)
+        if (transaction.id === headId) {
+          providerEntered.resolve()
+          await releaseProvider.promise
+          throw providerError
+        }
+        env.applyMutations(transaction.mutations)
+      },
+    })
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    const errorLog = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const observed: Array<Promise<void>> = []
+    const outcomes = new Map<string, unknown>()
+    let hasPrimaryFailure = false
+
+    // The production driver uses public transactions and their commit promises.
+    // Each outcome starts pending so the held checkpoint can reject early success.
+    function createObservedTransaction(rowId: string, updatedAt: number) {
+      const tx = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      tx.mutate(() =>
+        env.collection.insert({
+          id: rowId,
+          value: rowId,
+          completed: false,
+          updatedAt: new Date(updatedAt),
+        }),
+      )
+      outcomes.set(tx.id, `pending`)
+      const commit = tx.commit().then(
+        () => {
+          outcomes.set(tx.id, `fulfilled`)
+        },
+        (error: unknown) => {
+          outcomes.set(tx.id, error)
+        },
+      )
+      observed.push(commit)
+      return { id: tx.id, commit }
+    }
+
+    try {
+      await env.waitForLeader()
+      const head = createObservedTransaction(`head`, 0)
+      headId = head.id
+      await atOracleCheckpoint(providerEntered.promise, `head provider entered`)
+
+      const preFault = createObservedTransaction(`before-fault`, 1)
+      preFaultId = preFault.id
+      await atOracleCheckpoint(preFaultStored.promise, `pre-fault peer durable`)
+      releaseProvider.resolve()
+      await atOracleCheckpoint(hookEntered.promise, `retry hook failed`)
+      await atOracleCheckpoint(
+        terminalCleanupEntered.promise,
+        `terminal ${heldStep} held`,
+      )
+
+      const postFault = createObservedTransaction(`after-fault`, 2)
+      postFaultId = postFault.id
+      const firstObservation = await atOracleCheckpoint(
+        Promise.race([
+          postFault.commit.then(() => `settled` as const),
+          postFaultStored.promise.then(() => `durable` as const),
+        ]),
+        `post-fault admission or rejection`,
+      )
+
+      const before = expectedHookFaultPeerAtHeldCleanup()
+      const after = expectedHookFaultPeerAtHeldCleanup()
+      const outboxAtHeldCleanup = await env.executor.peekOutbox()
+      const durableIds = new Set(outboxAtHeldCleanup.map(({ id }) => id))
+      // The race rejects an early admission refusal at this exact cut;
+      // waiting for final cleanup alone would hide the transient violation.
+      expect(firstObservation).toBe(`durable`)
+      expect(durableIds.has(preFault.id)).toBe(before.durable)
+      expect(durableIds.has(postFault.id)).toBe(after.durable)
+      expect([...durableIds].sort()).toEqual(
+        [head.id, preFault.id, postFault.id].sort(),
+      )
+      expect(observedFaultAdmissionOutcome(outcomes.get(preFault.id))).toBe(
+        before.outcome,
+      )
+      expect(observedFaultAdmissionOutcome(outcomes.get(postFault.id))).toBe(
+        after.outcome,
+      )
+      expect(outcomes.get(head.id)).toBe(`pending`)
+      expect(
+        outboxAtHeldCleanup.find(({ id }) => id === head.id)?.outboxPhase,
+      ).toBe(heldStep === `deletion` ? `rejection-pending` : undefined)
+      expect(
+        outboxAtHeldCleanup.find(({ id }) => id === preFault.id)?.outboxPhase,
+      ).toBeUndefined()
+      expect(providerCalls).toEqual([head.id])
+      expect(env.collection.toArray.map(({ id }) => id).sort()).toEqual([
+        `after-fault`,
+        `before-fault`,
+        `head`,
+      ])
+
+      releaseTerminalCleanup.resolve()
+      await atOracleCheckpoint(head.commit, `failed head settled`)
+      if (failureKind === `throw`) expect(outcomes.get(head.id)).toBe(hookError)
+      else expect(outcomes.get(head.id)).toBeInstanceOf(TypeError)
+      await atOracleCheckpoint(preFault.commit, `pre-fault peer settled`)
+      await atOracleCheckpoint(postFault.commit, `post-fault peer settled`)
+      expect(outcomes.get(preFault.id)).toBe(`fulfilled`)
+      expect(outcomes.get(postFault.id)).toBe(`fulfilled`)
+      expect(await env.executor.peekOutbox()).toEqual([])
+      expect(providerCalls).toEqual([head.id, preFault.id, postFault.id])
+      expect(env.collection.toArray.map(({ id }) => id).sort()).toEqual([
+        `after-fault`,
+        `before-fault`,
+      ])
+      if (failureKind === `promise-late-rejection`) {
+        expect(rejectAsyncDecision).toBeTypeOf(`function`)
+        rejectAsyncDecision?.(asyncError)
+        lateDecisionRejected = true
+      }
+      await turn()
+      expect(unhandled).toEqual([])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      if (asyncDecision && !lateDecisionRejected) {
+        // Release a mutant that wrongly awaits this test-owned Promise.
+        void asyncDecision.catch(() => {})
+        rejectAsyncDecision?.(asyncError)
+      }
+      releaseProvider.resolve()
+      releaseTerminalCleanup.resolve()
+      const cleanupError = new Error(`hook-fault admission oracle cleanup`)
+      for (const [id, outcome] of outcomes)
+        if (outcome === `pending`)
+          env.executor.rejectTransaction(id, cleanupError)
+      await cleanupOfflineOracle(
+        [
+          () => Promise.all(observed),
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+          () => warning.mockRestore(),
+          () => errorLog.mockRestore(),
+          () => cleanupUnhandled(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// A hook failure removes only the head. The already queued peer then runs in
+// the same batch, and a later batch remains available for new work.
+it(`continues queued work after shouldRetry throws`, async () => {
+  const providerError = new Error(`HTTP 401 Unauthorized`)
+  const hookError = new Error(`retry decision failed`)
+  const outbox = new OutboxManager(new FakeStorageAdapter(), {})
+  const scheduler = new KeyScheduler()
+  const rejections: Array<Error> = []
+  const resolutions: Array<string> = []
+  let peerCalls = 0
+  const signaler: TransactionSignaler = {
+    isOfflineEnabled: true,
+    isOnline: () => true,
+    resolveTransaction: (id) => {
+      if (id === `hook-failure-head`)
+        throw new Error(`failed head cannot resolve`)
+      resolutions.push(id)
+    },
+    rejectTransaction: (_id, error) => rejections.push(error),
+    registerRestorationTransaction: () => {},
+  }
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        head: () => Promise.reject(providerError),
+        peer: () => {
+          peerCalls++
+          return Promise.resolve()
+        },
+      },
+      shouldRetry: () => {
+        throw hookError
+      },
+    },
+    signaler,
+  )
+  const head: OfflineTransaction = {
+    id: `hook-failure-head`,
+    mutationFnName: `head`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `hook-failure-head`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    version: 1,
+  }
+  const peer: OfflineTransaction = {
+    ...head,
+    id: `hook-failure-peer`,
+    mutationFnName: `peer`,
+    idempotencyKey: `hook-failure-peer`,
+    createdAt: new Date(1),
+  }
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  try {
+    await outbox.add(head)
+    await outbox.add(peer)
+    scheduler.schedule(peer)
+    await expect(executor.execute(head)).resolves.toBeUndefined()
+    expect(rejections).toEqual([hookError])
+    expect(await outbox.get(head.id)).toBeNull()
+    expect(await outbox.get(peer.id)).toBeNull()
+    expect(scheduler.getPendingCount()).toBe(0)
+    expect(peerCalls).toBe(1)
+    expect(resolutions).toEqual([peer.id])
+    await expect(executor.executeAll()).resolves.toBeUndefined()
+    expect(peerCalls).toBe(1)
+    expect(resolutions).toEqual([peer.id])
+  } finally {
+    executor.pause()
+    warning.mockRestore()
+  }
+})
+
+it(`keeps commit pending until successful outbox deletion`, async () => {
+  const deletionEntered = gate()
+  const releaseDeletion = gate()
+  class Storage extends FakeStorageAdapter {
+    override async delete(key: string): Promise<void> {
+      if (key.startsWith(`tx:`)) {
+        deletionEntered.resolve()
+        await releaseDeletion.promise
+      }
+      await super.delete(key)
+    }
+  }
+  const env = createTestOfflineEnvironment({ storage: new Storage() })
+  let commitStatus: unknown = `pending`
+  let persistedStatus: unknown = `pending`
+  let transactionId = ``
+  let observed: Promise<void> | undefined
+  let observedPersistence: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const transaction = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    transactionId = transaction.id
+    const localTransaction = transaction.mutate(() =>
+      env.collection.insert({
+        id: `held-delete`,
+        value: `provider-applied`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    observedPersistence = localTransaction.isPersisted.promise.then(
+      () => {
+        persistedStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        persistedStatus = error
+      },
+    )
+    observed = transaction.commit().then(
+      () => {
+        commitStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        commitStatus = error
+      },
+    )
+
+    await atOracleCheckpoint(deletionEntered.promise, `outbox deletion entered`)
+    await turn()
+    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+      transactionId,
+    ])
+    expect(env.serverState.has(`held-delete`)).toBe(true)
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      transactionId,
+    ])
+    expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
+      `pending`,
+      `pending`,
+      `persisting`,
+    ])
+
+    releaseDeletion.resolve()
+    await atOracleCheckpoint(
+      Promise.all([observed, observedPersistence]),
+      `outbox deletion settled caller`,
+    )
+    expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
+      `fulfilled`,
+      `fulfilled`,
+      `completed`,
+    ])
+    expect(await env.executor.peekOutbox()).toEqual([])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseDeletion.resolve()
+    if (commitStatus === `pending` && transactionId)
+      env.executor.resolveTransaction(transactionId, undefined)
+    await cleanupOfflineOracle(
+      [
+        () => Promise.all([observed, observedPersistence]),
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it.each([`removeFromOutbox`, `clearOutbox`] as const)(
+  `settles active provider work after %s acknowledges outbox deletion`,
+  async (removal) => {
+    const providerEntered = gate()
+    const releaseProvider = gate()
+    const env = createTestOfflineEnvironment({
+      mutationFn: async (params) => {
+        providerEntered.resolve()
+        await releaseProvider.promise
+        env.applyMutations(params.transaction.mutations)
+      },
+    })
+    let transactionId = ``
+    let commitStatus: unknown = `pending`
+    let persistedStatus: unknown = `pending`
+    let observed: Promise<void> | undefined
+    let observedPersistence: Promise<void> | undefined
+    let hasPrimaryFailure = false
+    try {
+      await env.waitForLeader()
+      const transaction = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      transactionId = transaction.id
+      const localTransaction = transaction.mutate(() =>
+        env.collection.insert({
+          id: `manually-removed-active`,
+          value: `provider-applied`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      observedPersistence = localTransaction.isPersisted.promise.then(
+        () => {
+          persistedStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          persistedStatus = error
+        },
+      )
+      observed = transaction.commit().then(
+        () => {
+          commitStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          commitStatus = error
+        },
+      )
+
+      await atOracleCheckpoint(providerEntered.promise, `provider held`)
+      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+        transactionId,
+      ])
+      if (removal === `removeFromOutbox`)
+        await env.executor.removeFromOutbox(transactionId)
+      else await env.executor.clearOutbox()
+      expect(await env.executor.peekOutbox()).toEqual([])
+      expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
+        `pending`,
+        `pending`,
+        `persisting`,
+      ])
+
+      releaseProvider.resolve()
+      await atOracleCheckpoint(
+        Promise.all([observed, observedPersistence]),
+        `provider fulfillment after ${removal} deletion settled caller`,
+      )
+      expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
+        `fulfilled`,
+        `fulfilled`,
+        `completed`,
+      ])
+      expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+        transactionId,
+      ])
+      expect(env.serverState.has(`manually-removed-active`)).toBe(true)
+      expect(await env.executor.peekOutbox()).toEqual([])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseProvider.resolve()
+      if (commitStatus === `pending` && transactionId)
+        env.executor.resolveTransaction(transactionId, undefined)
+      await cleanupOfflineOracle(
+        [
+          () => Promise.all([observed, observedPersistence]),
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+// The independently chosen result is a rejection with the provider error:
+// deletion is already acknowledged, and a retry cannot re-admit that row.
+// Hold the real public provider call, remove its outbox entry, then reject it.
+// The checkpoint compares both caller promises and the outbox before admitting
+// a later peer. The peer checks that a missing retry record did not stop the
+// executor. The default network retry and overridden 401 retry reach the same
+// persistence boundary by different decisions.
+it.each([
+  [`removeFromOutbox`, `default`],
+  [`removeFromOutbox`, `hook`],
+  [`clearOutbox`, `default`],
+  [`clearOutbox`, `hook`],
+] as const)(
+  `rejects a failed provider after %s removed its outbox row (%s retry)`,
+  async (removal, retryDecision) => {
+    const providerEntered = gate()
+    const releaseProvider = gate()
+    const providerError = new Error(
+      retryDecision === `hook`
+        ? `HTTP 401 Unauthorized`
+        : `network unavailable`,
+    )
+    let headId = ``
+    const env = createTestOfflineEnvironment({
+      config: {
+        jitter: false,
+        ...(retryDecision === `hook`
+          ? { shouldRetry: (error: Error) => error === providerError }
+          : {}),
+      },
+      mutationFn: async (params) => {
+        if (params.transaction.id === headId) {
+          providerEntered.resolve()
+          await releaseProvider.promise
+          throw providerError
+        }
+        env.applyMutations(params.transaction.mutations)
+      },
+    })
+    let headCommit: Promise<void> | undefined
+    let headPersistence: Promise<void> | undefined
+    let headCommitResult: unknown = `pending`
+    let headPersistenceResult: unknown = `pending`
+    let hasPrimaryFailure = false
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    try {
+      await env.waitForLeader()
+      const head = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      headId = head.id
+      const localHead = head.mutate(() =>
+        env.collection.insert({
+          id: `removed-failure`,
+          value: `never-applied`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      headPersistence = localHead.isPersisted.promise.then(
+        () => {
+          headPersistenceResult = `fulfilled`
+        },
+        (error: unknown) => {
+          headPersistenceResult = error
+        },
+      )
+      headCommit = head.commit().then(
+        () => {
+          headCommitResult = `fulfilled`
+        },
+        (error: unknown) => {
+          headCommitResult = error
+        },
+      )
+
+      await atOracleCheckpoint(providerEntered.promise, `provider held`)
+      expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+        headId,
+      ])
+      if (removal === `removeFromOutbox`)
+        await env.executor.removeFromOutbox(headId)
+      else await env.executor.clearOutbox()
+      expect(await env.executor.peekOutbox()).toEqual([])
+      expect([headCommitResult, headPersistenceResult]).toEqual([
+        `pending`,
+        `pending`,
+      ])
+
+      releaseProvider.resolve()
+      if (removal === `removeFromOutbox`) {
+        await vi.waitFor(() => expect(env.executor.getRunningCount()).toBe(0))
+        await Promise.resolve()
+        await Promise.resolve()
+      }
+      await atOracleCheckpoint(
+        Promise.all([headCommit, headPersistence]),
+        `provider rejection after acknowledged removal`,
+      )
+      expect([headCommitResult, headPersistenceResult]).toEqual([
+        providerError,
+        providerError,
+      ])
+      expect(localHead.state).toBe(`failed`)
+      expect(await env.executor.peekOutbox()).toEqual([])
+      expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+        headId,
+      ])
+
+      const peer = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      peer.mutate(() =>
+        env.collection.insert({
+          id: `later-peer`,
+          value: `applied`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      await atOracleCheckpoint(peer.commit(), `later peer settled`)
+      expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+        headId,
+        peer.id,
+      ])
+      expect(env.serverState.has(`removed-failure`)).toBe(false)
+      expect(env.serverState.has(`later-peer`)).toBe(true)
+      expect(await env.executor.peekOutbox()).toEqual([])
+    } catch (error) {
+      hasPrimaryFailure = true
+      throw error
+    } finally {
+      releaseProvider.resolve()
+      if (headCommitResult === `pending` && headId)
+        env.executor.rejectTransaction(headId, providerError)
+      await cleanupOfflineOracle(
+        [
+          () => Promise.all([headCommit, headPersistence]),
+          () => env.executor.dispose(),
+          () => env.collection.cleanup(),
+          () => warning.mockRestore(),
+        ],
+        hasPrimaryFailure,
+      )
+    }
+  },
+)
+
+it(`stops successful provider work when outbox deletion fails`, async () => {
+  const firstProviderEntered = gate()
+  const releaseFirstProvider = gate()
+  const deletionAttempted = gate()
+  const storageError = new Error(`acknowledgement cleanup failed`)
+  let transactionId = ``
+  class Storage extends FakeStorageAdapter {
+    attempts = 0
+    override async delete(key: string): Promise<void> {
+      if (key === `tx:${transactionId}`) {
+        this.attempts++
+        deletionAttempted.resolve()
+        throw storageError
+      }
+      await super.delete(key)
+    }
+  }
+  const storage = new Storage()
+  const env = createTestOfflineEnvironment({
+    storage,
+    mutationFn: async (params) => {
+      if (params.transaction.id === transactionId) {
+        firstProviderEntered.resolve()
+        await releaseFirstProvider.promise
+      }
+      env.applyMutations(params.transaction.mutations)
+    },
+  })
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  let commitStatus: unknown = `pending`
+  let persistedStatus: unknown = `pending`
+  let peerStatus: unknown = `pending`
+  let peerId = ``
+  let observed: Promise<void> | undefined
+  let observedPersistence: Promise<void> | undefined
+  let observedPeer: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const transaction = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    transactionId = transaction.id
+    const localTransaction = transaction.mutate(() =>
+      env.collection.insert({
+        id: `successful-cleanup-failure`,
+        value: `provider-applied`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    observedPersistence = localTransaction.isPersisted.promise.then(
+      () => {
+        persistedStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        persistedStatus = error
+      },
+    )
+    observed = transaction.commit().then(
+      () => {
+        commitStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        commitStatus = error
+      },
+    )
+
+    await atOracleCheckpoint(
+      firstProviderEntered.promise,
+      `first provider held`,
+    )
+    const peer = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    peerId = peer.id
+    peer.mutate(() =>
+      env.collection.insert({
+        id: `queued-peer`,
+        value: `provider-applied`,
+        completed: false,
+        updatedAt: new Date(1),
+      }),
+    )
+    observedPeer = peer.commit().then(
+      () => {
+        peerStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        peerStatus = error
+      },
+    )
+    await turn()
+    releaseFirstProvider.resolve()
+
+    await atOracleCheckpoint(
+      deletionAttempted.promise,
+      `successful acknowledgement cleanup attempted`,
+    )
+    await turn()
+
+    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+      transactionId,
+    ])
+    expect(env.serverState.has(`successful-cleanup-failure`)).toBe(true)
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      transactionId,
+      peerId,
+    ])
+    expect([
+      commitStatus,
+      persistedStatus,
+      localTransaction.state,
+      peerStatus,
+    ]).toEqual([storageError, storageError, `failed`, `pending`])
+
+    env.executor.getOnlineDetector().notifyOnline()
+    await turn()
+    expect(storage.attempts).toBe(1)
+    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+      transactionId,
+    ])
+    expect(peerStatus).toBe(`pending`)
+    const later = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    later.mutate(() =>
+      env.collection.insert({
+        id: `after-storage-stop`,
+        value: `not-admitted`,
+        completed: false,
+        updatedAt: new Date(2),
+      }),
+    )
+    await expect(later.commit()).rejects.toBe(storageError)
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      transactionId,
+      peerId,
+    ])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseFirstProvider.resolve()
+    if (commitStatus === `pending` && transactionId)
+      env.executor.resolveTransaction(transactionId, undefined)
+    if (peerStatus === `pending` && peerId)
+      env.executor.resolveTransaction(peerId, undefined)
+    await cleanupOfflineOracle(
+      [
+        () => Promise.all([observed, observedPersistence, observedPeer]),
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+        () => warning.mockRestore(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it(`stops after a failed deletion-pending write and holds its queued peer`, async () => {
+  const firstProviderEntered = gate()
+  const releaseFirstProvider = gate()
+  const markerWriteFailed = gate()
+  const markerError = new Error(`deletion-pending record unavailable`)
+  let headId = ``
+  class Storage extends FakeStorageAdapter {
+    markerWrites = 0
+    deletedIds: Array<string> = []
+
+    override async set(key: string, value: string): Promise<void> {
+      if (
+        key === `tx:${headId}` &&
+        (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
+          `deletion-pending`
+      ) {
+        this.markerWrites++
+        markerWriteFailed.resolve()
+        throw markerError
+      }
+      await super.set(key, value)
+    }
+
+    override async delete(key: string): Promise<void> {
+      if (key.startsWith(`tx:`)) this.deletedIds.push(key.slice(3))
+      await super.delete(key)
+    }
+  }
+  const storage = new Storage()
+  const env = createTestOfflineEnvironment({
+    storage,
+    mutationFn: async (params) => {
+      if (params.transaction.id === headId) {
+        firstProviderEntered.resolve()
+        await releaseFirstProvider.promise
+      }
+      env.applyMutations(params.transaction.mutations)
+    },
+  })
+  let headStatus: unknown = `pending`
+  let persistedStatus: unknown = `pending`
+  let peerStatus: unknown = `pending`
+  let peerId = ``
+  let observedHead: Promise<void> | undefined
+  let observedPersistence: Promise<void> | undefined
+  let observedPeer: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const head = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    headId = head.id
+    const localTransaction = head.mutate(() =>
+      env.collection.insert({
+        id: `marker-write-head`,
+        value: `provider-applied`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    observedPersistence = localTransaction.isPersisted.promise.then(
+      () => {
+        persistedStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        persistedStatus = error
+      },
+    )
+    observedHead = head.commit().then(
+      () => {
+        headStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        headStatus = error
+      },
+    )
+
+    await atOracleCheckpoint(firstProviderEntered.promise, `head provider held`)
+    const peer = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    peerId = peer.id
+    peer.mutate(() =>
+      env.collection.insert({
+        id: `marker-write-peer`,
+        value: `queued`,
+        completed: false,
+        updatedAt: new Date(1),
+      }),
+    )
+    observedPeer = peer.commit().then(
+      () => {
+        peerStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        peerStatus = error
+      },
+    )
+    await turn()
+    releaseFirstProvider.resolve()
+
+    await atOracleCheckpoint(
+      markerWriteFailed.promise,
+      `fulfilled-provider marker write failed`,
+    )
+    await turn()
+    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+      headId,
+    ])
+    expect(env.serverState.has(`marker-write-head`)).toBe(true)
+    expect(env.serverState.has(`marker-write-peer`)).toBe(false)
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      headId,
+      peerId,
+    ])
+    expect((await env.executor.peekOutbox())[0]?.outboxPhase).toBeUndefined()
+    expect(storage.deletedIds).toEqual([])
+    expect([
+      headStatus,
+      persistedStatus,
+      localTransaction.state,
+      peerStatus,
+    ]).toEqual([markerError, markerError, `failed`, `pending`])
+
+    env.executor.getOnlineDetector().notifyOnline()
+    await turn()
+    expect(storage.markerWrites).toBe(1)
+    expect(env.mutationCalls.map(({ transaction: { id } }) => id)).toEqual([
+      headId,
+    ])
+    expect(storage.deletedIds).toEqual([])
+    expect(peerStatus).toBe(`pending`)
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      headId,
+      peerId,
+    ])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseFirstProvider.resolve()
+    if (headStatus === `pending` && headId)
+      env.executor.resolveTransaction(headId, undefined)
+    if (peerStatus === `pending` && peerId)
+      env.executor.resolveTransaction(peerId, undefined)
+    await cleanupOfflineOracle(
+      [
+        () => Promise.all([observedHead, observedPersistence, observedPeer]),
+        () => env.executor.dispose(),
+        () => env.collection.cleanup(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it(`restarts a fulfilled provider transaction after a stopped deletion failure`, async () => {
+  const firstDeletionAttempted = gate()
+  const restartedDeletionAttempted = gate()
+  const storageError = new Error(`acknowledgement cleanup failed`)
+  const providerCalls: Array<{ id: string; idempotencyKey: string }> = []
+  let providerFulfilled = false
+  class Storage extends FakeStorageAdapter {
+    failDeletes = true
+    completedWritesAfterProviderFulfilled = 0
+
+    override async set(key: string, value: string): Promise<void> {
+      await super.set(key, value)
+      if (providerFulfilled) this.completedWritesAfterProviderFulfilled++
+    }
+
+    override async delete(key: string): Promise<void> {
+      if (key.startsWith(`tx:`)) {
+        if (this.failDeletes) {
+          firstDeletionAttempted.resolve()
+          throw storageError
+        }
+        restartedDeletionAttempted.resolve()
+      }
+      await super.delete(key)
+    }
+  }
+  const storage = new Storage()
+  const first = createTestOfflineEnvironment({
+    storage,
+    mutationFn: (params) => {
+      providerCalls.push({
+        id: params.transaction.id,
+        idempotencyKey: params.idempotencyKey,
+      })
+      first.applyMutations(params.transaction.mutations)
+      providerFulfilled = true
+    },
+  })
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  let second: ReturnType<typeof createTestOfflineEnvironment> | undefined
+  let transactionId = ``
+  let commitStatus: unknown = `pending`
+  let persistedStatus: unknown = `pending`
+  let observed: Promise<void> | undefined
+  let observedPersistence: Promise<void> | undefined
+  let replayStatus: unknown = `pending`
+  let observedReplay: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await first.waitForLeader()
+    const transaction = first.executor.createOfflineTransaction({
+      mutationFnName: first.mutationFnName,
+      autoCommit: false,
+      idempotencyKey: `restart-after-provider-fulfillment`,
+    })
+    transactionId = transaction.id
+    const localTransaction = transaction.mutate(() =>
+      first.collection.insert({
+        id: `restart-after-delete-failure`,
+        value: `provider-applied`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    observedPersistence = localTransaction.isPersisted.promise.then(
+      () => {
+        persistedStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        persistedStatus = error
+      },
+    )
+    observed = transaction.commit().then(
+      () => {
+        commitStatus = `fulfilled`
+      },
+      (error: unknown) => {
+        commitStatus = error
+      },
+    )
+
+    await atOracleCheckpoint(
+      firstDeletionAttempted.promise,
+      `first deletion failed after provider fulfillment`,
+    )
+    await turn()
+    expect(providerCalls).toEqual([
+      {
+        id: transactionId,
+        idempotencyKey: `restart-after-provider-fulfillment`,
+      },
+    ])
+    expect(first.serverState.has(`restart-after-delete-failure`)).toBe(true)
+    expect((await first.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      transactionId,
+    ])
+    expect([commitStatus, persistedStatus, localTransaction.state]).toEqual([
+      storageError,
+      storageError,
+      `failed`,
+    ])
+    expect(storage.completedWritesAfterProviderFulfilled).toBeGreaterThan(0)
+    const markerWrites = storage.completedWritesAfterProviderFulfilled
+
+    first.executor.dispose()
+    storage.failDeletes = false
+    second = createTestOfflineEnvironment({
+      storage,
+      config: {
+        // Filtering unfulfilled work cannot cancel already fulfilled provider
+        // work whose only remaining obligation is durable deletion.
+        beforeRetry: () => [],
+      },
+      mutationFn: (params) => {
+        providerCalls.push({
+          id: params.transaction.id,
+          idempotencyKey: params.idempotencyKey,
+        })
+      },
+    })
+    observedReplay = second.executor
+      .waitForTransactionCompletion(transactionId)
+      .then(
+        () => {
+          replayStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          replayStatus = error
+        },
+      )
+    await second.waitForLeader()
+    await atOracleCheckpoint(
+      restartedDeletionAttempted.promise,
+      `restarted deletion attempted`,
+    )
+    expect(await second.executor.peekOutbox()).toEqual([])
+    await atOracleCheckpoint(observedReplay, `restarted deletion settled`)
+    expect(replayStatus).toBe(`fulfilled`)
+    expect(providerCalls).toEqual([
+      {
+        id: transactionId,
+        idempotencyKey: `restart-after-provider-fulfillment`,
+      },
+    ])
+    expect(storage.completedWritesAfterProviderFulfilled).toBe(markerWrites)
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    if (commitStatus === `pending` && transactionId)
+      first.executor.resolveTransaction(transactionId, undefined)
+    await cleanupOfflineOracle(
+      [
+        () => Promise.all([observed, observedPersistence]),
+        () => observedReplay,
+        () => first.executor.dispose(),
+        () => second?.executor.dispose(),
+        () => first.collection.cleanup(),
+        () => second?.collection.cleanup(),
+        () => warning.mockRestore(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+it(`replays an admitted row with no fulfilled-provider checkpoint`, async () => {
+  const deletionCompleted = gate()
+  class Storage extends FakeStorageAdapter {
+    override async delete(key: string): Promise<void> {
+      await super.delete(key)
+      if (key === `tx:legacy-unmarked-transaction`) deletionCompleted.resolve()
+    }
+  }
+  const storage = new Storage()
+  const seed = createCollection<TestItem, string>({
+    id: `test-items`,
+    getKey: (row) => row.id,
+    startSync: true,
+    sync: { sync: (ops) => ops.markReady() },
+  })
+  const outbox = new OutboxManager(storage, { [seed.id]: seed })
+  const seedTransaction = createTransaction({
+    autoCommit: false,
+    mutationFn: () => Promise.resolve(),
+  })
+  void seedTransaction.isPersisted.promise.catch(() => {})
+  try {
+    seedTransaction.mutate(() =>
+      seed.insert({
+        id: `legacy-unmarked`,
+        value: `replay-me`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    await outbox.add({
+      id: `legacy-unmarked-transaction`,
+      mutationFnName: `syncData`,
+      mutations: seedTransaction.mutations,
+      keys: seedTransaction.mutations.map(({ globalKey }) => globalKey),
+      idempotencyKey: `legacy-unmarked-key`,
+      createdAt: new Date(0),
+      retryCount: 0,
+      nextAttemptAt: 0,
+      version: 1,
+    })
+  } finally {
+    seedTransaction.rollback({ isSecondaryRollback: true })
+    await seed.cleanup()
+  }
+
+  const providerEntered = gate()
+  const providerCalls: Array<{ id: string; idempotencyKey: string }> = []
+  const env = createTestOfflineEnvironment({
+    storage,
+    mutationFn: (params) => {
+      providerCalls.push({
+        id: params.transaction.id,
+        idempotencyKey: params.idempotencyKey,
+      })
+      env.applyMutations(params.transaction.mutations)
+      providerEntered.resolve()
+    },
+  })
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    await atOracleCheckpoint(
+      providerEntered.promise,
+      `unmarked provider replay`,
+    )
+    expect(providerCalls).toEqual([
+      {
+        id: `legacy-unmarked-transaction`,
+        idempotencyKey: `legacy-unmarked-key`,
+      },
+    ])
+    expect(env.serverState.has(`legacy-unmarked`)).toBe(true)
+    await atOracleCheckpoint(
+      deletionCompleted.promise,
+      `unmarked replay outbox deletion`,
+    )
+    expect(await env.executor.peekOutbox()).toEqual([])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    await cleanupOfflineOracle(
+      [() => env.executor.dispose(), () => env.collection.cleanup()],
+      hasPrimaryFailure,
+    )
+  }
+})
+
+// Deletion failure leaves a durable terminal marker. The two causes must both
+// retain their own error and skip the provider when a fresh executor removes it.
+async function checkTerminalFailureWithFailedDeletion(
+  failureKind: `provider` | `hook`,
+) {
+  const deletionAttempted = gate()
+  const restartedDeletionAttempted = gate()
+  const releaseRestartedDeletion = gate()
+  const primaryError =
+    failureKind === `provider`
+      ? new NonRetriableError(`provider rejected permanently`)
+      : new Error(`retry decision failed`)
+  const providerError =
+    failureKind === `provider`
+      ? primaryError
+      : new Error(`HTTP 401 Unauthorized`)
+  const storageError = new Error(`rejection cleanup failed`)
+  class Storage extends FakeStorageAdapter {
+    failDeletes = true
+    override async delete(key: string): Promise<void> {
+      if (key.startsWith(`tx:`)) {
+        if (this.failDeletes) {
+          deletionAttempted.resolve()
+          throw storageError
+        }
+        restartedDeletionAttempted.resolve()
+        await releaseRestartedDeletion.promise
+      }
+      await super.delete(key)
+    }
+  }
+  const storage = new Storage()
+  let providerCalls = 0
+  const env = createTestOfflineEnvironment({
+    storage,
+    config:
+      failureKind === `hook`
+        ? {
+            shouldRetry: () => {
+              throw primaryError
+            },
+          }
+        : {},
+    mutationFn: () => {
+      providerCalls++
+      return Promise.reject(providerError)
+    },
+  })
+  const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+  let restarted: ReturnType<typeof createTestOfflineEnvironment> | undefined
+  let status: unknown = `pending`
+  let replayStatus: unknown = `pending`
+  let transactionId = ``
+  let observed: Promise<void> | undefined
+  let observedReplay: Promise<void> | undefined
+  let hasPrimaryFailure = false
+  try {
+    await env.waitForLeader()
+    const transaction = env.executor.createOfflineTransaction({
+      mutationFnName: env.mutationFnName,
+      autoCommit: false,
+    })
+    transactionId = transaction.id
+    transaction.mutate(() =>
+      env.collection.insert({
+        id: `permanent-cleanup-failure`,
+        value: `optimistic`,
+        completed: false,
+        updatedAt: new Date(0),
+      }),
+    )
+    observed = transaction.commit().then(
+      () => {
+        status = `fulfilled`
+      },
+      (error: unknown) => {
+        status = error
+      },
+    )
+
+    await atOracleCheckpoint(
+      deletionAttempted.promise,
+      `permanent rejection cleanup attempted`,
+    )
+    await turn()
+
+    expect(status).toBe(primaryError)
+    expect((await env.executor.peekOutbox()).map(({ id }) => id)).toEqual([
+      transaction.id,
+    ])
+    expect((await env.executor.peekOutbox())[0]).toMatchObject({
+      outboxPhase: `rejection-pending`,
+      lastError: { message: primaryError.message },
+    })
+    expect(providerCalls).toBe(1)
+
+    env.executor.dispose()
+    storage.failDeletes = false
+    restarted = createTestOfflineEnvironment({
+      storage,
+      mutationFn: () => {
+        providerCalls++
+      },
+    })
+    observedReplay = restarted.executor
+      .waitForTransactionCompletion(transactionId)
+      .then(
+        () => {
+          replayStatus = `fulfilled`
+        },
+        (error: unknown) => {
+          replayStatus = error
+        },
+      )
+    await restarted.waitForLeader()
+    await atOracleCheckpoint(
+      restartedDeletionAttempted.promise,
+      `terminal rejection deletion retried after restart`,
+    )
+    expect(providerCalls).toBe(1)
+    expect(restarted.collection.toArray).toEqual([])
+    releaseRestartedDeletion.resolve()
+    await atOracleCheckpoint(observedReplay, `terminal replay settled`)
+    expect(replayStatus).toMatchObject({
+      name: primaryError.name,
+      message: primaryError.message,
+    })
+    expect(await restarted.executor.peekOutbox()).toEqual([])
+  } catch (error) {
+    hasPrimaryFailure = true
+    throw error
+  } finally {
+    releaseRestartedDeletion.resolve()
+    if (status === `pending` && transactionId)
+      env.executor.rejectTransaction(transactionId, primaryError)
+    if (replayStatus === `pending` && transactionId)
+      restarted?.executor.rejectTransaction(transactionId, primaryError)
+    await cleanupOfflineOracle(
+      [
+        () => observed,
+        () => observedReplay,
+        () => env.executor.dispose(),
+        () => restarted?.executor.dispose(),
+        () => env.collection.cleanup(),
+        () => restarted?.collection.cleanup(),
+        () => warning.mockRestore(),
+      ],
+      hasPrimaryFailure,
+    )
+  }
+}
+
+it.each([`provider`, `hook`] as const)(
+  `preserves terminal %s failure when rejection cleanup also fails`,
+  checkTerminalFailureWithFailedDeletion,
+)
+
+// The row-local hook law ends when terminal storage fails. A failed marker or
+// deletion leaves the head's durable ownership unresolved, so the executor
+// must stop before the queued peer runs. The failed head keeps the hook error;
+// the batch reports the storage error. Provider-failure deletion is an adjacent
+// control that preserves the established storage-stop boundary.
+it.each([
+  [`provider`, `deletion`],
+  [`hook`, `marker`],
+  [`hook`, `deletion`],
+] as const)(
+  `stops queued work after %s terminal failure and failed %s`,
+  async (failureKind, failedStep) => {
+    const providerError =
+      failureKind === `provider`
+        ? new NonRetriableError(`provider rejected`)
+        : new Error(`HTTP 401 Unauthorized`)
+    const hookError = new Error(`retry decision failed`)
+    const callerError = failureKind === `hook` ? hookError : providerError
+    const storageError = new Error(`${failedStep} rejected`)
+    const warning = vi.spyOn(console, `warn`).mockImplementation(() => {})
+    class Storage extends FakeStorageAdapter {
+      failCleanup = true
+
+      override async set(key: string, value: string): Promise<void> {
+        if (
+          this.failCleanup &&
+          failedStep === `marker` &&
+          key === `tx:terminal-cleanup-head` &&
+          (JSON.parse(value) as { outboxPhase?: string }).outboxPhase ===
+            `rejection-pending`
+        )
+          throw storageError
+        await super.set(key, value)
+      }
+
+      override async delete(key: string): Promise<void> {
+        if (this.failCleanup && failedStep === `deletion`) throw storageError
+        await super.delete(key)
+      }
+    }
+    const storage = new Storage()
+    const outbox = new OutboxManager(storage, {})
+    const scheduler = new KeyScheduler()
+    const rejections: Array<{ id: string; error: Error }> = []
+    const resolutions: Array<string> = []
+    let peerCalls = 0
+    const signaler: TransactionSignaler = {
+      isOfflineEnabled: true,
+      isOnline: () => true,
+      resolveTransaction: (id) => resolutions.push(id),
+      rejectTransaction: (id, error) => rejections.push({ id, error }),
+      registerRestorationTransaction: () => {},
+    }
+    const executor = new TransactionExecutor(
+      scheduler,
+      outbox,
+      {
+        collections: {},
+        mutationFns: {
+          syncData: () => Promise.reject(providerError),
+          peer: () => {
+            peerCalls++
+            return Promise.resolve()
+          },
+        },
+        ...(failureKind === `hook`
+          ? {
+              shouldRetry: () => {
+                throw hookError
+              },
+            }
+          : {}),
+        jitter: false,
+      },
+      signaler,
+    )
+    const transaction: OfflineTransaction = {
+      id: `terminal-cleanup-head`,
+      mutationFnName: `syncData`,
+      mutations: [],
+      keys: [],
+      idempotencyKey: `terminal-cleanup-head`,
+      createdAt: new Date(0),
+      retryCount: 0,
+      nextAttemptAt: 0,
+      version: 1,
+    }
+    const peer: OfflineTransaction = {
+      ...transaction,
+      id: `terminal-cleanup-peer`,
+      mutationFnName: `peer`,
+      idempotencyKey: `terminal-cleanup-peer`,
+      createdAt: new Date(1),
+    }
+    await outbox.add(transaction)
+    await outbox.add(peer)
+    scheduler.schedule(peer)
+    try {
+      await expect(executor.execute(transaction)).rejects.toBe(storageError)
+      expect(rejections).toEqual([{ id: transaction.id, error: callerError }])
+      expect(resolutions).toEqual([])
+      expect(peerCalls).toBe(0)
+      expect(scheduler.getPendingCount()).toBe(2)
+      expect((await outbox.get(transaction.id))?.outboxPhase).toBe(
+        failedStep === `deletion` ? `rejection-pending` : undefined,
+      )
+      expect(await outbox.get(peer.id)).toMatchObject({ id: peer.id })
+
+      storage.failCleanup = false
+      executor.resetRetryDelays()
+      await expect(executor.executeAll()).rejects.toBe(storageError)
+      await expect(executor.execute(peer)).rejects.toBe(storageError)
+      expect(peerCalls).toBe(0)
+      expect(resolutions).toEqual([])
+      expect(scheduler.getPendingCount()).toBe(2)
+      expect(await outbox.get(peer.id)).toMatchObject({ id: peer.id })
+    } finally {
+      executor.pause()
+      warning.mockRestore()
+    }
+  },
+)
+
+it(`stops after failed deletion without rerunning the provider`, async () => {
+  const storageError = new Error(`delete rejected`)
+  const rejections: Array<Error> = []
+  const retryCounts: Array<number> = []
+  const delay = vi.spyOn(DefaultRetryPolicy.prototype, `calculateDelay`)
+  delay.mockImplementation((retryCount) => {
+    retryCounts.push(retryCount)
+    return 60_000
+  })
+  class Storage extends FakeStorageAdapter {
+    override delete(): Promise<void> {
+      return Promise.reject(storageError)
+    }
+  }
+  const outbox = new OutboxManager(new Storage(), {})
+  const scheduler = new KeyScheduler()
+  let providerCalls = 0
+  const signaler: TransactionSignaler = {
+    isOfflineEnabled: true,
+    isOnline: () => true,
+    resolveTransaction: () => {
+      throw new Error(`deletion has not succeeded`)
+    },
+    rejectTransaction: (_id, error) => rejections.push(error),
+    registerRestorationTransaction: () => {},
+  }
+  const executor = new TransactionExecutor(
+    scheduler,
+    outbox,
+    {
+      collections: {},
+      mutationFns: {
+        syncData: () => {
+          providerCalls++
+          return Promise.resolve()
+        },
+      },
+      jitter: false,
+    },
+    signaler,
+  )
+  const transaction: OfflineTransaction = {
+    id: `deletion-backoff`,
+    mutationFnName: `syncData`,
+    mutations: [],
+    keys: [],
+    idempotencyKey: `deletion-backoff`,
+    createdAt: new Date(0),
+    retryCount: 0,
+    nextAttemptAt: 0,
+    version: 1,
+  }
+  await outbox.add(transaction)
+  try {
+    await expect(executor.execute(transaction)).rejects.toBe(storageError)
+    executor.resetRetryDelays()
+    await expect(executor.executeAll()).rejects.toBe(storageError)
+    expect(retryCounts).toEqual([])
+    expect(rejections).toEqual([storageError])
+    expect(providerCalls).toBe(1)
+    expect((await outbox.get(transaction.id))?.outboxPhase).toBe(
+      `deletion-pending`,
+    )
+  } finally {
+    executor.pause()
+    delay.mockRestore()
+  }
+})
+
+// Focused witness, not a generated history: the FIFO model keeps a queued
+// transaction's optimistic rows, and a rollback while the transaction
+// persists removes them. Once the mutation function runs, the executor alone
+// settles the waiter, so a rollback must not settle it early or change its
+// outcome.
+it.each([true, false])(
+  `keeps the executor's outcome for a rollback while persisting (succeeds: %s)`,
+  async (succeeds) => {
+    const providerError = new NonRetriableError(`provider failed`)
+    const entered = gate()
+    const release = gate()
+    const env = createTestOfflineEnvironment({
+      mutationFn: async (params) => {
+        entered.resolve()
+        await release.promise
+        if (!succeeds) throw providerError
+        env.applyMutations(params.transaction.mutations)
+      },
+    })
+    const { rejections: unhandled, cleanup: cleanupUnhandled } =
+      captureUnhandledRejections()
+    const logged = vi.spyOn(console, `error`).mockImplementation(() => {})
+    try {
+      await env.waitForLeader()
+      const tx = env.executor.createOfflineTransaction({
+        mutationFnName: env.mutationFnName,
+        autoCommit: false,
+      })
+      tx.mutate(() =>
+        env.collection.insert({
+          id: `held`,
+          value: `v`,
+          completed: false,
+          updatedAt: new Date(0),
+        }),
+      )
+      const statuses: Array<unknown> = []
+      const wait = env.executor.waitForTransactionCompletion(tx.id).then(
+        () => statuses.push(`fulfilled`),
+        (error: unknown) => statuses.push(error),
+      )
+      void tx.commit().catch(() => undefined)
+      await atOracleCheckpoint(entered.promise, `provider entered`)
+      tx.rollback()
+      await turn()
+      expect(statuses, `waiter before the executor settles`).toEqual([])
+      release.resolve()
+      await atOracleCheckpoint(wait, `waiter settled`)
+      expect(statuses, `waiter outcome`).toEqual([
+        succeeds ? `fulfilled` : providerError,
+      ])
+      expect(env.serverState.has(`held`), `server row`).toBe(succeeds)
+      expect(await env.executor.peekOutbox(), `outbox`).toEqual([])
+      await turn()
+      expect(unhandled, `unhandled rejections`).toEqual([])
+    } finally {
+      release.resolve()
+      cleanupUnhandled()
+      logged.mockRestore()
+      env.executor.dispose()
+    }
+  },
+)
+
+// Focused witness, not a generated history: a failed outbox write stops the
+// executor, so a FIFO history cannot continue past it. For every commit path,
+// the admission write fails, the receipt rejects with the storage error, and
+// the failure neither escapes as an unhandled rejection nor is logged again.
+it.each([`manual`, `auto`, `default`, `action`] as const)(
+  `rejects the receipt when the outbox write fails (%s)`,
+  async (commit) => {
+    const storageError = new Error(`outbox write unavailable`)
+    class FailingStorage extends FakeStorageAdapter {
+      override async set(key: string, value: string): Promise<void> {
+        if (key.startsWith(`tx:`)) throw storageError
+        await super.set(key, value)
+      }
+    }
+    const env = createTestOfflineEnvironment({
+      storage: new FailingStorage(),
+      mutationFn: (params) => {
+        env.applyMutations(params.transaction.mutations)
+        return Promise.resolve()
+      },
+    })
+    const { rejections: unhandled, cleanup: cleanupUnhandled } =
+      captureUnhandledRejections()
+    const logged = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const debug = vi.spyOn(console, `log`).mockImplementation(() => {})
+    try {
+      await env.waitForLeader()
+      const write = () =>
+        env.collection.insert({
+          id: `stored`,
+          value: `v`,
+          completed: false,
+          updatedAt: new Date(0),
+        })
+      let receipt: Promise<unknown>
+      if (commit === `action`) {
+        const transaction = env.executor.createOfflineAction({
+          mutationFnName: env.mutationFnName,
+          onMutate: write,
+        })(undefined)
+        receipt = transaction.when(`settled`)
+      } else {
+        const tx = env.executor.createOfflineTransaction({
+          mutationFnName: env.mutationFnName,
+          ...(commit === `default` ? {} : { autoCommit: commit === `auto` }),
+        })
+        const transaction = tx.mutate(write)
+        receipt =
+          commit === `manual` ? tx.commit() : transaction.when(`settled`)
+      }
+      await expect(receipt).rejects.toBe(storageError)
+      await turn()
+      expect(unhandled, `unhandled rejections`).toEqual([])
+      // The executor logs the persist failure once; nothing logs it again.
+      expect(
+        logged.mock.calls.map(([message]) => String(message)),
+        `errors logged`,
+      ).toEqual([
+        expect.stringMatching(/^Failed to persist offline transaction /),
+      ])
+      expect(debug.mock.calls, `debug output`).toEqual([])
+      expect(env.collection.get(`stored`), `optimistic row`).toBeUndefined()
+      expect(env.serverState.size, `provider calls`).toBe(0)
+    } finally {
+      cleanupUnhandled()
+      logged.mockRestore()
+      debug.mockRestore()
+      env.executor.dispose()
+      await env.collection.cleanup()
+    }
+  },
+)
diff --git a/packages/powersync-db-collection/package.json b/packages/powersync-db-collection/package.json
index aba31abf97..d326135fc8 100644
--- a/packages/powersync-db-collection/package.json
+++ b/packages/powersync-db-collection/package.json
@@ -27,8 +27,7 @@
     "build": "vite build",
     "dev": "vite build --watch",
     "lint": "eslint . --fix",
-    "test": "vitest --run",
-    "test:oracles": "vitest --run tests/correctness-oracle.test.ts"
+    "test": "vitest --run"
   },
   "type": "module",
   "main": "dist/cjs/index.cjs",
diff --git a/packages/powersync-db-collection/tests/correctness-oracle.test.ts b/packages/powersync-db-collection/tests/correctness.test.ts
similarity index 100%
rename from packages/powersync-db-collection/tests/correctness-oracle.test.ts
rename to packages/powersync-db-collection/tests/correctness.test.ts
diff --git a/packages/preact-db/tests/infinite-query-conformance.test.ts b/packages/preact-db/tests/infinite-query-conformance.test.ts
index 350a8cd9c1..c5d7f5b517 100644
--- a/packages/preact-db/tests/infinite-query-conformance.test.ts
+++ b/packages/preact-db/tests/infinite-query-conformance.test.ts
@@ -28,6 +28,7 @@ import {
 } from '@tanstack/db'
 import { mockSyncCollectionOptions } from '../../db/tests/utils'
 import { runInfiniteQuerySuite } from '../../db/tests/conformance/infinite-suite-oracle'
+import { registerInfiniteQueryUnitScenarios } from '../../db/tests/conformance/infinite-suite-cases'
 import { makeInfiniteOnDemandSource } from '../../db/tests/conformance/infinite-on-demand'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
 import { renderHook, settle } from './render-probe'
@@ -275,4 +276,4 @@ const preactInfiniteDriver: InfiniteQueryDriver = {
   knownGaps: [],
 }
 
-runInfiniteQuerySuite(preactInfiniteDriver)
+runInfiniteQuerySuite(preactInfiniteDriver, registerInfiniteQueryUnitScenarios)
diff --git a/packages/query-db-collection/e2e/query.e2e.test.ts b/packages/query-db-collection/e2e/query.e2e.test.ts
index de63a799ba..3e276a2355 100644
--- a/packages/query-db-collection/e2e/query.e2e.test.ts
+++ b/packages/query-db-collection/e2e/query.e2e.test.ts
@@ -14,6 +14,7 @@ import {
   createDeduplicationTestSuite,
   createJoinsTestSuite,
   createLiveUpdatesTestSuite,
+  createLiveUpdatesUnitTestSuite,
   createMutationsTestSuite,
   createPaginationTestSuite,
   createPredicatesTestSuite,
@@ -272,5 +273,6 @@ describe(`Query Collection E2E Tests`, () => {
   createDeduplicationTestSuite(getConfig)
   createCollationTestSuite(getConfig)
   createMutationsTestSuite(getConfig)
+  createLiveUpdatesUnitTestSuite(getConfig)
   createLiveUpdatesTestSuite(getConfig)
 })
diff --git a/packages/query-db-collection/package.json b/packages/query-db-collection/package.json
index 9092f15e37..e4e51d9da5 100644
--- a/packages/query-db-collection/package.json
+++ b/packages/query-db-collection/package.json
@@ -21,7 +21,7 @@
     "dev": "vite build --watch",
     "lint": "eslint . --fix",
     "test": "vitest run",
-    "test:oracles": "vitest run --coverage.enabled=false tests/includes-work-counter-oracle.test.ts tests/load-subset-lifecycle-oracle.test.ts tests/ownership-lifecycle.oracle.test.ts tests/persisted-direct-write-window.oracle.test.ts tests/ssr-dehydration-oracle.test.ts tests/cursor-pagination.oracle.test.ts tests/cursor-pagination.cache-oracle.test.ts tests/cursor-pagination.publication-oracle.test.ts tests/cursor-pagination.boundary-oracle.test.ts tests/cursor-pagination-oracle.integration.test.ts",
+    "test:oracles": "vitest run --coverage.enabled=false tests/includes-work-counter-oracle.test.ts tests/ownership-lifecycle.oracle.test.ts tests/persisted-direct-write-window.oracle.test.ts tests/ssr-dehydration-oracle.test.ts tests/cursor-pagination.oracle.test.ts tests/cursor-pagination.cache-oracle.test.ts tests/cursor-pagination.publication-oracle.test.ts tests/cursor-pagination.boundary-oracle.test.ts tests/cursor-pagination-oracle.integration.test.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts"
   },
   "type": "module",
diff --git a/packages/query-db-collection/tests/cursor-pagination-boundary-support.ts b/packages/query-db-collection/tests/cursor-pagination-boundary-support.ts
new file mode 100644
index 0000000000..10969b3ce8
--- /dev/null
+++ b/packages/query-db-collection/tests/cursor-pagination-boundary-support.ts
@@ -0,0 +1,19 @@
+import { QueryClient } from '@tanstack/query-core'
+
+// Shared fixtures for the cursor fetch boundary tests. The boundary oracle
+// (cursor-pagination.boundary-oracle.test.ts) and the ordinary boundary tests
+// (cursor-pagination.boundary.test.ts) both build clients and page rows with
+// these helpers.
+export const tick = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
+export const makeClient = () =>
+  new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+        staleTime: Infinity,
+        gcTime: Infinity,
+      },
+    },
+  })
+export const rowsFor = (size: number) =>
+  Array.from({ length: size * 2 }, (_, id) => ({ id }))
diff --git a/packages/query-db-collection/tests/cursor-pagination-integration-fixture.ts b/packages/query-db-collection/tests/cursor-pagination-integration-fixture.ts
new file mode 100644
index 0000000000..8aea780cfc
--- /dev/null
+++ b/packages/query-db-collection/tests/cursor-pagination-integration-fixture.ts
@@ -0,0 +1,151 @@
+import {
+  BasicIndex,
+  createCollection,
+  createLiveQueryCollection,
+} from '@tanstack/db'
+import { QueryClient } from '@tanstack/query-core'
+import { expect } from 'vitest'
+import { createDeferred } from '../../db/src/deferred.js'
+import { createCursorPager, queryCollectionOptions } from '../src/index.js'
+import { createBackend } from './cursor-pagination/backend.js'
+import type { Row, Scope } from './cursor-pagination/model-oracle.js'
+
+// Shared fixture for the cursor adapter integration tests. The law is owned by
+// cursor-pagination-oracle.integration.test.ts, and the ordinary response delivery
+// test is in cursor-pagination.integration.test.ts.
+export function createFixture(
+  rows: Array<Row>,
+  scope: Scope,
+  backendSize: number,
+  holdFirst = false,
+) {
+  const backend = { calls: [] as Array<string | undefined> }
+  const gate = createDeferred<void>()
+  let received = 0
+  const client = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false, staleTime: Infinity, gcTime: Infinity },
+    },
+  })
+  const makePager = (rank?: number) => {
+    const makeBackend = () =>
+      createBackend(
+        rank === undefined ? rows : rows.filter((row) => row.rank === rank),
+        scope,
+        backendSize,
+      )
+    let transport = makeBackend()
+    return createCursorPager({
+      queryClient: client,
+      queryKey: [`cursor-experiment`, scope, `opaque-pages`, rank ?? null],
+      fetchPage: async (cursor, signal) => {
+        if (cursor === undefined) transport = makeBackend()
+        if (rank === undefined) backend.calls.push(cursor)
+        const page = await transport.fetchPage(cursor, signal)
+        if (++received === 1 && holdFirst) await gate.promise
+        return page
+      },
+    })
+  }
+  const pager = makePager()
+  const ties = new Map<number, ReturnType<typeof makePager>>()
+  const requests: Array<{ offset: number; limit: number | undefined }> = []
+  let cursorRequestCount = 0
+  const direction = scope.descending ? `desc` : `asc`
+  const source = createCollection(
+    queryCollectionOptions<Row>({
+      queryClient: client,
+      queryKey: [`cursor-experiment`, scope, `rows`],
+      syncMode: `on-demand`,
+      autoIndex: `eager`,
+      defaultIndexType: BasicIndex,
+      getKey: (row) => row.id,
+      queryFn: async (ctx) => {
+        const options = ctx.meta?.loadSubsetOptions
+        let reader = pager
+        const where = options?.where
+        if (where !== undefined) {
+          if (
+            where.type !== `func` ||
+            where.name !== `eq` ||
+            where.args.length !== 2 ||
+            where.args[0]?.type !== `ref` ||
+            where.args[0].path.length !== 1 ||
+            where.args[0].path[0] !== `rank` ||
+            where.args[1]?.type !== `val` ||
+            typeof where.args[1].value !== `number`
+          ) {
+            throw new Error(`Unsupported fixture predicate`)
+          }
+          const rank = where.args[1].value
+          let tie = ties.get(rank)
+          if (!tie) {
+            tie = makePager(rank)
+            ties.set(rank, tie)
+          }
+          reader = tie
+        }
+        if (options?.cursor) {
+          cursorRequestCount++
+          expect(options.cursor.whereCurrent).toMatchObject({
+            type: `func`,
+            name: `eq`,
+            args: [
+              { type: `ref`, path: [`rank`] },
+              { type: `val`, value: expect.any(Number) },
+            ],
+          })
+          expect(options.cursor.whereFrom).toMatchObject({
+            type: `func`,
+            name: scope.descending ? `lt` : `gt`,
+            args: [
+              { type: `ref`, path: [`rank`] },
+              { type: `val`, value: expect.any(Number) },
+            ],
+          })
+        }
+        if (options?.orderBy) {
+          expect(options.orderBy).toMatchObject([
+            { expression: { path: [`rank`] }, compareOptions: { direction } },
+            { expression: { path: [`id`] }, compareOptions: { direction } },
+          ])
+        }
+        const window = { offset: options?.offset ?? 0, limit: options?.limit }
+        requests.push(window)
+        return reader.read(window, ctx.signal)
+      },
+    }),
+  )
+  const live = createLiveQueryCollection((q) =>
+    q
+      .from({ row: source })
+      .orderBy(({ row }) => row.rank, direction)
+      .orderBy(({ row }) => row.id, direction)
+      .limit(1),
+  )
+  return {
+    backend,
+    gate,
+    requests,
+    cursorRequestCount: () => cursorRequestCount,
+    live,
+    source,
+    refresh: () =>
+      client.invalidateQueries(
+        { queryKey: [`cursor-experiment`, scope] },
+        { throwOnError: true },
+      ),
+    received: () => received,
+    async cleanup() {
+      gate.resolve()
+      await live.cleanup()
+      await source.cleanup()
+      client.clear()
+    },
+  }
+}
+
+export // This oracle checks all user row fields and their order. Virtual Collection
+// fields ($key/$origin/etc.) are outside the cursor adapter's responsibility.
+const observeRows = (rows: ReadonlyArray<Row>) =>
+  rows.map(({ id, rank, group }) => ({ id, rank, group }))
diff --git a/packages/query-db-collection/tests/cursor-pagination-oracle.integration.test.ts b/packages/query-db-collection/tests/cursor-pagination-oracle.integration.test.ts
index 7dc89ec31d..dab72779e3 100644
--- a/packages/query-db-collection/tests/cursor-pagination-oracle.integration.test.ts
+++ b/packages/query-db-collection/tests/cursor-pagination-oracle.integration.test.ts
@@ -1,9 +1,5 @@
 import { QueryClient } from '@tanstack/query-core'
-import {
-  BasicIndex,
-  createCollection,
-  createLiveQueryCollection,
-} from '@tanstack/db'
+import { createCollection } from '@tanstack/db'
 import { describe, expect, it, vi } from 'vitest'
 import fc from 'fast-check'
 import {
@@ -11,12 +7,14 @@ import {
   oracleRuns,
   readOracleRunConfig,
 } from '../../db/tests/oracle-config.js'
-import { createDeferred } from '../../db/src/deferred.js'
 import { createLiveQueryWindowController } from '../../db/src/live-query-window-controller.js'
 import { createCursorPager, queryCollectionOptions } from '../src/index.js'
-import { createBackend } from './cursor-pagination/backend.js'
+import {
+  createFixture,
+  observeRows,
+} from './cursor-pagination-integration-fixture.js'
 import { expectedWindow } from './cursor-pagination/model-oracle.js'
-import type { Row, Scope } from './cursor-pagination/model-oracle.js'
+import type { Row } from './cursor-pagination/model-oracle.js'
 
 /**
  * # Does opaque pagination refine a real live-query window?
@@ -38,138 +36,6 @@ import type { Row, Scope } from './cursor-pagination/model-oracle.js'
  * cursor expressions, then chooses the explicit offset for its local reader.
  * Each tie filter has its own opaque backend sequence, just like the prefix.
  */
-function createFixture(
-  rows: Array<Row>,
-  scope: Scope,
-  backendSize: number,
-  holdFirst = false,
-) {
-  const backend = { calls: [] as Array<string | undefined> }
-  const gate = createDeferred<void>()
-  let received = 0
-  const client = new QueryClient({
-    defaultOptions: {
-      queries: { retry: false, staleTime: Infinity, gcTime: Infinity },
-    },
-  })
-  const makePager = (rank?: number) => {
-    const makeBackend = () =>
-      createBackend(
-        rank === undefined ? rows : rows.filter((row) => row.rank === rank),
-        scope,
-        backendSize,
-      )
-    let transport = makeBackend()
-    return createCursorPager({
-      queryClient: client,
-      queryKey: [`cursor-experiment`, scope, `opaque-pages`, rank ?? null],
-      fetchPage: async (cursor, signal) => {
-        if (cursor === undefined) transport = makeBackend()
-        if (rank === undefined) backend.calls.push(cursor)
-        const page = await transport.fetchPage(cursor, signal)
-        if (++received === 1 && holdFirst) await gate.promise
-        return page
-      },
-    })
-  }
-  const pager = makePager()
-  const ties = new Map<number, ReturnType<typeof makePager>>()
-  const requests: Array<{ offset: number; limit: number | undefined }> = []
-  let cursorRequestCount = 0
-  const direction = scope.descending ? `desc` : `asc`
-  const source = createCollection(
-    queryCollectionOptions<Row>({
-      queryClient: client,
-      queryKey: [`cursor-experiment`, scope, `rows`],
-      syncMode: `on-demand`,
-      autoIndex: `eager`,
-      defaultIndexType: BasicIndex,
-      getKey: (row) => row.id,
-      queryFn: async (ctx) => {
-        const options = ctx.meta?.loadSubsetOptions
-        let reader = pager
-        const where = options?.where
-        if (where !== undefined) {
-          if (
-            where.type !== `func` ||
-            where.name !== `eq` ||
-            where.args.length !== 2 ||
-            where.args[0]?.type !== `ref` ||
-            where.args[0].path.length !== 1 ||
-            where.args[0].path[0] !== `rank` ||
-            where.args[1]?.type !== `val` ||
-            typeof where.args[1].value !== `number`
-          ) {
-            throw new Error(`Unsupported fixture predicate`)
-          }
-          const rank = where.args[1].value
-          let tie = ties.get(rank)
-          if (!tie) {
-            tie = makePager(rank)
-            ties.set(rank, tie)
-          }
-          reader = tie
-        }
-        if (options?.cursor) {
-          cursorRequestCount++
-          expect(options.cursor.whereCurrent).toMatchObject({
-            type: `func`,
-            name: `eq`,
-            args: [
-              { type: `ref`, path: [`rank`] },
-              { type: `val`, value: expect.any(Number) },
-            ],
-          })
-          expect(options.cursor.whereFrom).toMatchObject({
-            type: `func`,
-            name: scope.descending ? `lt` : `gt`,
-            args: [
-              { type: `ref`, path: [`rank`] },
-              { type: `val`, value: expect.any(Number) },
-            ],
-          })
-        }
-        if (options?.orderBy) {
-          expect(options.orderBy).toMatchObject([
-            { expression: { path: [`rank`] }, compareOptions: { direction } },
-            { expression: { path: [`id`] }, compareOptions: { direction } },
-          ])
-        }
-        const window = { offset: options?.offset ?? 0, limit: options?.limit }
-        requests.push(window)
-        return reader.read(window, ctx.signal)
-      },
-    }),
-  )
-  const live = createLiveQueryCollection((q) =>
-    q
-      .from({ row: source })
-      .orderBy(({ row }) => row.rank, direction)
-      .orderBy(({ row }) => row.id, direction)
-      .limit(1),
-  )
-  return {
-    backend,
-    gate,
-    requests,
-    cursorRequestCount: () => cursorRequestCount,
-    live,
-    source,
-    refresh: () =>
-      client.invalidateQueries(
-        { queryKey: [`cursor-experiment`, scope] },
-        { throwOnError: true },
-      ),
-    received: () => received,
-    async cleanup() {
-      gate.resolve()
-      await live.cleanup()
-      await source.cleanup()
-      client.clear()
-    },
-  }
-}
-
 const matrix = [0, 1, 9, 20].flatMap((count) =>
   [2, 5].flatMap((backendSize) =>
     [3, 7].flatMap((pageSize) =>
@@ -183,11 +49,6 @@ const matrix = [0, 1, 9, 20].flatMap((count) =>
   ),
 )
 
-// This oracle checks all user row fields and their order. Virtual Collection
-// fields ($key/$origin/etc.) are outside the cursor adapter's responsibility.
-const observeRows = (rows: ReadonlyArray<Row>) =>
-  rows.map(({ id, rank, group }) => ({ id, rank, group }))
-
 const manualWriteProperty = `cursor-pagination.manual-write`
 const manualWriteReplay = readOracleRunConfig()
 const manualWriteCampaigns =
@@ -506,60 +367,4 @@ describe(`cursor adapter through production pagination`, () => {
       }
     },
   )
-
-  it(`holds real response delivery and preserves a shallower peer after deep exhaustion`, async () => {
-    const rows = Array.from({ length: 9 }, (_, id) => ({
-      id,
-      rank: Math.floor(id / 6),
-      group: 0,
-    }))
-    const scope = { group: undefined, descending: false }
-    const fixture = createFixture(rows, scope, 2, true)
-    const shallow = createLiveQueryWindowController(fixture.live, {
-      pageSize: 3,
-    })
-    const deep = createLiveQueryWindowController(fixture.live, { pageSize: 10 })
-    const publications: Array<Array<number>> = []
-    const stopShallow = shallow.subscribe(() =>
-      publications.push(shallow.getSnapshot().data.map((row) => row.id)),
-    )
-    const stopDeep = deep.subscribe(() => {})
-    let fulfilledPreloads = 0
-    const pending = Promise.allSettled(
-      [shallow.preload(), deep.preload()].map((promise) =>
-        promise.then(() => {
-          fulfilledPreloads++
-        }),
-      ),
-    )
-    try {
-      await vi.waitFor(() => expect(fixture.received()).toBe(1))
-      expect(fulfilledPreloads).toBe(0)
-      expect(shallow.getSnapshot().data).toEqual([])
-      expect(publications.every((batch) => batch.length === 0)).toBe(true)
-      fixture.gate.resolve()
-      expect((await pending).map((result) => result.status)).toEqual([
-        `fulfilled`,
-        `fulfilled`,
-      ])
-      expect(shallow.getSnapshot().hasNextPage).toBe(true)
-      expect(deep.getSnapshot().hasNextPage).toBe(false)
-      stopDeep()
-      deep.dispose()
-      await shallow.preload()
-      expect(observeRows(shallow.getSnapshot().data)).toEqual(rows.slice(0, 3))
-      expect(shallow.getSnapshot().hasNextPage).toBe(true)
-      await shallow.fetchNextPage()
-      expect(observeRows(shallow.getSnapshot().data)).toEqual(rows.slice(0, 6))
-      expect(fixture.backend.calls).toHaveLength(5)
-    } finally {
-      fixture.gate.resolve()
-      await pending
-      stopShallow()
-      stopDeep()
-      shallow.dispose()
-      deep.dispose()
-      await fixture.cleanup()
-    }
-  })
 })
diff --git a/packages/query-db-collection/tests/cursor-pagination.boundary-oracle.test.ts b/packages/query-db-collection/tests/cursor-pagination.boundary-oracle.test.ts
index e968e36d58..e050390895 100644
--- a/packages/query-db-collection/tests/cursor-pagination.boundary-oracle.test.ts
+++ b/packages/query-db-collection/tests/cursor-pagination.boundary-oracle.test.ts
@@ -1,5 +1,4 @@
 // @vitest-environment jsdom
-import { QueryClient, hashKey } from '@tanstack/query-core'
 import { createCollection } from '@tanstack/db'
 import fc from 'fast-check'
 import { describe, expect, it, vi } from 'vitest'
@@ -9,6 +8,11 @@ import {
   readOracleRunConfig,
 } from '../../db/tests/oracle-config.js'
 import { createCursorPager, queryCollectionOptions } from '../src/index.js'
+import {
+  makeClient,
+  rowsFor,
+  tick,
+} from './cursor-pagination-boundary-support.js'
 
 /**
  * # Do browser-facing readers release the right cursor work?
@@ -66,20 +70,6 @@ async function finishBoundaryCleanup(
     )
 }
 
-const tick = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
-const makeClient = () =>
-  new QueryClient({
-    defaultOptions: {
-      queries: {
-        retry: false,
-        staleTime: Infinity,
-        gcTime: Infinity,
-      },
-    },
-  })
-const rowsFor = (size: number) =>
-  Array.from({ length: size * 2 }, (_, id) => ({ id }))
-
 describe(`cursor Query fetch boundaries`, () => {
   it.each([false, true])(
     `nested row query settles when pages cancel; replacement=%s`,
@@ -227,169 +217,4 @@ describe(`cursor Query fetch boundaries`, () => {
       `cursor-pagination.reader-abort`,
     )
   })
-
-  it(`a fresh hit does not inherit another Query fetch's same-turn cancellation`, async () => {
-    const client = makeClient(),
-      entered = createDeferred<void>(),
-      release = createDeferred<void>()
-    const key = [`hit`],
-      rows = rowsFor(1)
-    const options = {
-      queryClient: client,
-      queryKey: key,
-      fetchPage: async (cursor: string | undefined) => {
-        if (cursor) {
-          entered.resolve()
-          await release.promise
-        }
-        return {
-          rows: [rows[cursor ? 1 : 0]!],
-          nextCursor: cursor ? null : `next`,
-        }
-      },
-    }
-    await createCursorPager(options).read({ limit: 1 })
-    const pending = createCursorPager(options)
-      .read({})
-      .catch(() => {})
-    try {
-      await entered.promise
-      const hit = createCursorPager(options).read({ limit: 1 })
-      void client.cancelQueries(
-        { queryKey: key, exact: true },
-        { revert: false },
-      )
-      expect(await hit).toEqual(rows.slice(0, 1))
-    } finally {
-      release.resolve()
-      await pending
-      client.clear()
-    }
-  })
-
-  it.each([undefined, false, 1] as const)(
-    `browser retry policy is the same across Query fetch phases: %s`,
-    async (retry) => {
-      for (const phase of [`initial`, `growth`] as const) {
-        const client = new QueryClient({
-          defaultOptions: {
-            queries: { gcTime: Infinity, staleTime: Infinity, retryDelay: 0 },
-          },
-        })
-        if (retry !== undefined) client.setQueryDefaults([`retry`], { retry })
-        let calls = 0
-        const error = new Error(`page failed`)
-        const pager = createCursorPager({
-          queryClient: client,
-          queryKey: [`retry`],
-          fetchPage: (cursor) => {
-            if (phase === `initial` || cursor !== undefined) {
-              calls++
-              return Promise.reject(error)
-            }
-            return Promise.resolve({ rows: [{ id: 0 }], nextCursor: `next` })
-          },
-        })
-        try {
-          await expect(pager.read({})).rejects.toBe(error)
-          expect(calls).toBe(retry === 1 ? 2 : 1)
-        } finally {
-          client.clear()
-        }
-      }
-    },
-  )
-
-  it(`supports an AbortSignal without throwIfAborted`, async () => {
-    const client = makeClient(),
-      abort = new AbortController(),
-      rows = rowsFor(1)
-    Object.defineProperty(abort.signal, `throwIfAborted`, { value: undefined })
-    const pager = createCursorPager({
-      queryClient: client,
-      queryKey: [`compat`],
-      fetchPage: () => Promise.resolve({ rows, nextCursor: null }),
-    })
-    try {
-      expect(await pager.read({}, abort.signal)).toEqual(rows)
-      abort.abort()
-      await expect(pager.read({}, abort.signal)).rejects.toMatchObject({
-        name: `AbortError`,
-      })
-    } finally {
-      client.clear()
-    }
-  })
-
-  it.each([`response`, `cache`] as const)(
-    `invalid continuation rejects without spinning from %s`,
-    async (origin) => {
-      const client = makeClient(),
-        key = [`invalid`]
-      const invalid = { rows: rowsFor(1), nextCursor: undefined }
-      const pager = createCursorPager({
-        queryClient: client,
-        queryKey: key,
-        fetchPage: () =>
-          Promise.resolve(
-            invalid as unknown as {
-              rows: Array<{ id: number }>
-              nextCursor: null
-            },
-          ),
-      })
-      if (origin === `cache`)
-        client.setQueryData(key, { pages: [invalid], pageParams: [undefined] })
-      // A semantic work budget turns a microtask loop into a finite RED witness.
-      let attempts = 0
-      if (origin === `cache`) {
-        const query = client
-          .getQueryCache()
-          .find({ queryKey: key, exact: true })!
-        const run = query.fetch.bind(query)
-        vi.spyOn(query, `fetch`).mockImplementation((...input) => {
-          if (++attempts > 3) throw new Error(`loop budget exceeded`)
-          return run(...input)
-        })
-      }
-      try {
-        await expect(pager.read({ limit: 10 })).rejects.toThrow(
-          `Invalid cursor page`,
-        )
-        expect(attempts).toBeLessThanOrEqual(1)
-      } finally {
-        vi.restoreAllMocks()
-        client.clear()
-      }
-    },
-  )
-
-  it(`fresh reads do not hash unrelated cached queries`, async () => {
-    const client = makeClient()
-    let hashes = 0
-    client.setDefaultOptions({
-      queries: {
-        ...client.getDefaultOptions().queries,
-        queryKeyHashFn: (key) => {
-          hashes++
-          return hashKey(key)
-        },
-      },
-    })
-    for (let index = 0; index < 100; index++)
-      client.setQueryData([`unrelated`, index], index)
-    const pager = createCursorPager({
-      queryClient: client,
-      queryKey: [`work`],
-      fetchPage: () => Promise.resolve({ rows: rowsFor(1), nextCursor: null }),
-    })
-    try {
-      await pager.read({})
-      hashes = 0
-      await pager.read({ limit: 1 })
-      expect(hashes).toBeLessThan(10)
-    } finally {
-      client.clear()
-    }
-  })
 })
diff --git a/packages/query-db-collection/tests/cursor-pagination.boundary.test.ts b/packages/query-db-collection/tests/cursor-pagination.boundary.test.ts
new file mode 100644
index 0000000000..dd300f1156
--- /dev/null
+++ b/packages/query-db-collection/tests/cursor-pagination.boundary.test.ts
@@ -0,0 +1,177 @@
+// @vitest-environment jsdom
+// Ordinary tests for cursor Query fetch boundaries: a fresh hit beside a same-turn
+// cancellation, retry policy, AbortSignal compatibility, invalid continuations,
+// and hash work. The cursor boundary law (nested cancellation and reader abort)
+// is owned by cursor-pagination.boundary-oracle.test.ts.
+import { QueryClient, hashKey } from '@tanstack/query-core'
+import { describe, expect, it, vi } from 'vitest'
+import { createDeferred } from '../../db/src/deferred.js'
+import { createCursorPager } from '../src/index.js'
+import { makeClient, rowsFor } from './cursor-pagination-boundary-support.js'
+
+describe(`cursor Query fetch boundaries`, () => {
+  it(`a fresh hit does not inherit another Query fetch's same-turn cancellation`, async () => {
+    const client = makeClient(),
+      entered = createDeferred<void>(),
+      release = createDeferred<void>()
+    const key = [`hit`],
+      rows = rowsFor(1)
+    const options = {
+      queryClient: client,
+      queryKey: key,
+      fetchPage: async (cursor: string | undefined) => {
+        if (cursor) {
+          entered.resolve()
+          await release.promise
+        }
+        return {
+          rows: [rows[cursor ? 1 : 0]!],
+          nextCursor: cursor ? null : `next`,
+        }
+      },
+    }
+    await createCursorPager(options).read({ limit: 1 })
+    const pending = createCursorPager(options)
+      .read({})
+      .catch(() => {})
+    try {
+      await entered.promise
+      const hit = createCursorPager(options).read({ limit: 1 })
+      void client.cancelQueries(
+        { queryKey: key, exact: true },
+        { revert: false },
+      )
+      expect(await hit).toEqual(rows.slice(0, 1))
+    } finally {
+      release.resolve()
+      await pending
+      client.clear()
+    }
+  })
+
+  it.each([undefined, false, 1] as const)(
+    `browser retry policy is the same across Query fetch phases: %s`,
+    async (retry) => {
+      for (const phase of [`initial`, `growth`] as const) {
+        const client = new QueryClient({
+          defaultOptions: {
+            queries: { gcTime: Infinity, staleTime: Infinity, retryDelay: 0 },
+          },
+        })
+        if (retry !== undefined) client.setQueryDefaults([`retry`], { retry })
+        let calls = 0
+        const error = new Error(`page failed`)
+        const pager = createCursorPager({
+          queryClient: client,
+          queryKey: [`retry`],
+          fetchPage: (cursor) => {
+            if (phase === `initial` || cursor !== undefined) {
+              calls++
+              return Promise.reject(error)
+            }
+            return Promise.resolve({ rows: [{ id: 0 }], nextCursor: `next` })
+          },
+        })
+        try {
+          await expect(pager.read({})).rejects.toBe(error)
+          expect(calls).toBe(retry === 1 ? 2 : 1)
+        } finally {
+          client.clear()
+        }
+      }
+    },
+  )
+
+  it(`supports an AbortSignal without throwIfAborted`, async () => {
+    const client = makeClient(),
+      abort = new AbortController(),
+      rows = rowsFor(1)
+    Object.defineProperty(abort.signal, `throwIfAborted`, { value: undefined })
+    const pager = createCursorPager({
+      queryClient: client,
+      queryKey: [`compat`],
+      fetchPage: () => Promise.resolve({ rows, nextCursor: null }),
+    })
+    try {
+      expect(await pager.read({}, abort.signal)).toEqual(rows)
+      abort.abort()
+      await expect(pager.read({}, abort.signal)).rejects.toMatchObject({
+        name: `AbortError`,
+      })
+    } finally {
+      client.clear()
+    }
+  })
+
+  it.each([`response`, `cache`] as const)(
+    `invalid continuation rejects without spinning from %s`,
+    async (origin) => {
+      const client = makeClient(),
+        key = [`invalid`]
+      const invalid = { rows: rowsFor(1), nextCursor: undefined }
+      const pager = createCursorPager({
+        queryClient: client,
+        queryKey: key,
+        fetchPage: () =>
+          Promise.resolve(
+            invalid as unknown as {
+              rows: Array<{ id: number }>
+              nextCursor: null
+            },
+          ),
+      })
+      if (origin === `cache`)
+        client.setQueryData(key, { pages: [invalid], pageParams: [undefined] })
+      // A semantic work budget turns a microtask loop into a finite RED witness.
+      let attempts = 0
+      if (origin === `cache`) {
+        const query = client
+          .getQueryCache()
+          .find({ queryKey: key, exact: true })!
+        const run = query.fetch.bind(query)
+        vi.spyOn(query, `fetch`).mockImplementation((...input) => {
+          if (++attempts > 3) throw new Error(`loop budget exceeded`)
+          return run(...input)
+        })
+      }
+      try {
+        await expect(pager.read({ limit: 10 })).rejects.toThrow(
+          `Invalid cursor page`,
+        )
+        expect(attempts).toBeLessThanOrEqual(1)
+      } finally {
+        vi.restoreAllMocks()
+        client.clear()
+      }
+    },
+  )
+
+  it(`fresh reads do not hash unrelated cached queries`, async () => {
+    const client = makeClient()
+    let hashes = 0
+    client.setDefaultOptions({
+      queries: {
+        ...client.getDefaultOptions().queries,
+        queryKeyHashFn: (key) => {
+          hashes++
+          return hashKey(key)
+        },
+      },
+    })
+    for (let index = 0; index < 100; index++)
+      client.setQueryData([`unrelated`, index], index)
+    const pager = createCursorPager({
+      queryClient: client,
+      queryKey: [`work`],
+      fetchPage: () => Promise.resolve({ rows: rowsFor(1), nextCursor: null }),
+    })
+    try {
+      await pager.read({})
+      hashes = 0
+      await pager.read({ limit: 1 })
+      expect(hashes).toBeLessThan(10)
+    } finally {
+      client.clear()
+    }
+  })
+})
diff --git a/packages/query-db-collection/tests/cursor-pagination.integration.test.ts b/packages/query-db-collection/tests/cursor-pagination.integration.test.ts
new file mode 100644
index 0000000000..2972ae052f
--- /dev/null
+++ b/packages/query-db-collection/tests/cursor-pagination.integration.test.ts
@@ -0,0 +1,67 @@
+// Ordinary integration tests for the cursor adapter through production pagination:
+// response delivery with a shallower peer after deep exhaustion. The window law is
+// owned by cursor-pagination-oracle.integration.test.ts.
+import { describe, expect, it, vi } from 'vitest'
+import { createLiveQueryWindowController } from '../../db/src/live-query-window-controller.js'
+import {
+  createFixture,
+  observeRows,
+} from './cursor-pagination-integration-fixture.js'
+
+describe(`cursor adapter through production pagination`, () => {
+  it(`holds real response delivery and preserves a shallower peer after deep exhaustion`, async () => {
+    const rows = Array.from({ length: 9 }, (_, id) => ({
+      id,
+      rank: Math.floor(id / 6),
+      group: 0,
+    }))
+    const scope = { group: undefined, descending: false }
+    const fixture = createFixture(rows, scope, 2, true)
+    const shallow = createLiveQueryWindowController(fixture.live, {
+      pageSize: 3,
+    })
+    const deep = createLiveQueryWindowController(fixture.live, { pageSize: 10 })
+    const publications: Array<Array<number>> = []
+    const stopShallow = shallow.subscribe(() =>
+      publications.push(shallow.getSnapshot().data.map((row) => row.id)),
+    )
+    const stopDeep = deep.subscribe(() => {})
+    let fulfilledPreloads = 0
+    const pending = Promise.allSettled(
+      [shallow.preload(), deep.preload()].map((promise) =>
+        promise.then(() => {
+          fulfilledPreloads++
+        }),
+      ),
+    )
+    try {
+      await vi.waitFor(() => expect(fixture.received()).toBe(1))
+      expect(fulfilledPreloads).toBe(0)
+      expect(shallow.getSnapshot().data).toEqual([])
+      expect(publications.every((batch) => batch.length === 0)).toBe(true)
+      fixture.gate.resolve()
+      expect((await pending).map((result) => result.status)).toEqual([
+        `fulfilled`,
+        `fulfilled`,
+      ])
+      expect(shallow.getSnapshot().hasNextPage).toBe(true)
+      expect(deep.getSnapshot().hasNextPage).toBe(false)
+      stopDeep()
+      deep.dispose()
+      await shallow.preload()
+      expect(observeRows(shallow.getSnapshot().data)).toEqual(rows.slice(0, 3))
+      expect(shallow.getSnapshot().hasNextPage).toBe(true)
+      await shallow.fetchNextPage()
+      expect(observeRows(shallow.getSnapshot().data)).toEqual(rows.slice(0, 6))
+      expect(fixture.backend.calls).toHaveLength(5)
+    } finally {
+      fixture.gate.resolve()
+      await pending
+      stopShallow()
+      stopDeep()
+      shallow.dispose()
+      deep.dispose()
+      await fixture.cleanup()
+    }
+  })
+})
diff --git a/packages/query-db-collection/tests/cursor-pagination.oracle.test.ts b/packages/query-db-collection/tests/cursor-pagination.oracle.test.ts
index 08a749fe7f..402d2c5bca 100644
--- a/packages/query-db-collection/tests/cursor-pagination.oracle.test.ts
+++ b/packages/query-db-collection/tests/cursor-pagination.oracle.test.ts
@@ -202,17 +202,6 @@ describe(`opaque cursor adapter`, () => {
     expect(await pending).toEqual(expected)
   })
 
-  it(`accepts large backend pages without spreading rows into arguments`, async () => {
-    const rows = Array.from({ length: 150_000 }, (_, id) => id)
-    const pager = createCursorPager(() =>
-      Promise.resolve({ rows, nextCursor: null }),
-    )
-    expect(await pager.read({ offset: 149_997, limit: undefined })).toEqual(
-      rows.slice(149_997),
-    )
-    expect(await pager.read({ offset: 0, limit: 2 })).toEqual(rows.slice(0, 2))
-  })
-
   it.each([1, 2, 5, 50])(
     `fulfills windows across backend pages of %i`,
     async (pageSize) => {
@@ -384,18 +373,6 @@ describe(`opaque cursor adapter`, () => {
     )
   })
 
-  it(`rejects a repeated opaque cursor without looping`, async () => {
-    let calls = 0
-    const pager = createCursorPager(() => {
-      calls++
-      return Promise.resolve({ rows: [], nextCursor: `same` })
-    })
-    await expect(pager.read({ offset: 0, limit: 1 })).rejects.toThrow(
-      `repeated`,
-    )
-    expect(calls).toBe(2)
-  })
-
   it(`recovers after faults at generated intermediate page boundaries`, async () => {
     await assertCursorProperty(
       fc.asyncProperty(
diff --git a/packages/query-db-collection/tests/cursor-pagination.test.ts b/packages/query-db-collection/tests/cursor-pagination.test.ts
new file mode 100644
index 0000000000..8dd4e4f41a
--- /dev/null
+++ b/packages/query-db-collection/tests/cursor-pagination.test.ts
@@ -0,0 +1,30 @@
+// Ordinary robustness tests for the opaque cursor pager: very large backend
+// pages and a repeated continuation cursor. The opaque cursor law (every window
+// equals the full-relation slice) is owned by cursor-pagination.oracle.test.ts.
+import { describe, expect, it } from 'vitest'
+import { createCursorPager } from './cursor-pagination/pager.js'
+
+describe(`opaque cursor adapter`, () => {
+  it(`accepts large backend pages without spreading rows into arguments`, async () => {
+    const rows = Array.from({ length: 150_000 }, (_, id) => id)
+    const pager = createCursorPager(() =>
+      Promise.resolve({ rows, nextCursor: null }),
+    )
+    expect(await pager.read({ offset: 149_997, limit: undefined })).toEqual(
+      rows.slice(149_997),
+    )
+    expect(await pager.read({ offset: 0, limit: 2 })).toEqual(rows.slice(0, 2))
+  })
+
+  it(`rejects a repeated opaque cursor without looping`, async () => {
+    let calls = 0
+    const pager = createCursorPager(() => {
+      calls++
+      return Promise.resolve({ rows: [], nextCursor: `same` })
+    })
+    await expect(pager.read({ offset: 0, limit: 1 })).rejects.toThrow(
+      `repeated`,
+    )
+    expect(calls).toBe(2)
+  })
+})
diff --git a/packages/query-db-collection/tests/cursor-pagination/model-oracle.ts b/packages/query-db-collection/tests/cursor-pagination/model-oracle.ts
index 3c7582d644..0ee0e05e1c 100644
--- a/packages/query-db-collection/tests/cursor-pagination/model-oracle.ts
+++ b/packages/query-db-collection/tests/cursor-pagination/model-oracle.ts
@@ -1,3 +1,5 @@
+import { declareOracle } from '../../../db/tests/oracle-declaration.js'
+
 export type Row = { id: number; rank: number; group: number }
 export type Scope = { group: number | undefined; descending: boolean }
 export type Window = { offset: number; limit: number | undefined }
@@ -34,3 +36,5 @@ export function expectedWindow(
   const all = expectedRows(source, scope, { offset: 0, limit: undefined })
   return { rows: all.slice(0, n), hasNextPage: all.length > n }
 }
+
+declareOracle({ model: [expectedRows, expectedWindow] })
diff --git a/packages/query-db-collection/tests/load-subset-lifecycle-oracle.test.ts b/packages/query-db-collection/tests/load-subset-lifecycle.test.ts
similarity index 100%
rename from packages/query-db-collection/tests/load-subset-lifecycle-oracle.test.ts
rename to packages/query-db-collection/tests/load-subset-lifecycle.test.ts
diff --git a/packages/query-db-collection/tests/optimistic-ordered-refetch-oracle.test.ts b/packages/query-db-collection/tests/optimistic-ordered-refetch-oracle.test.ts
index 7c5a7622ba..3ec8d5e9a8 100644
--- a/packages/query-db-collection/tests/optimistic-ordered-refetch-oracle.test.ts
+++ b/packages/query-db-collection/tests/optimistic-ordered-refetch-oracle.test.ts
@@ -9,30 +9,14 @@ import { expect, it, vi } from 'vitest'
 import { createDeferred } from '../../db/src/deferred.js'
 import { queryCollectionOptions } from '../src/query.js'
 import { applyPredicates } from '../e2e/query-filter.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import { isNarrowRankTieProbe } from './optimistic-ordered-refetch-probe.js'
 import type { LoadSubsetOptions } from '@tanstack/db'
+import type { Row } from './optimistic-ordered-refetch-probe.js'
 
-type Row = { id: number; folder: `inbox` | `archive`; at: number }
 type ProviderPhase =
   `initial` | `optimistic` | `held-invalidation` | `handler-refetch`
 
-// A boundary probe may omit ordering, but its predicate must select one rank.
-// Add another row at that rank so a key-specific request cannot masquerade as
-// a rank-tie probe. Evaluate the whole predicate scope, not the capped answer.
-function isNarrowRankTieProbe(
-  options: LoadSubsetOptions,
-  remote: Array<Row>,
-): boolean {
-  if (options.orderBy !== undefined || options.where === undefined) return false
-  const matches = applyPredicates(remote, { where: options.where })
-  if (matches.length === 0) return false
-  const rank = matches[0]!.at
-  if (matches.some((row) => row.at !== rank)) return false
-  const additionalTie: Row = { ...matches[0]!, id: 1000 }
-  return applyPredicates([...remote, additionalTie], {
-    where: options.where,
-  }).some((row) => row.id === additionalTie.id)
-}
-
 /**
  * # Does a Query DB refetch preserve an optimistic ordered departure?
  *
@@ -68,12 +52,6 @@ async function checkOptimisticOrderedRefetch(
     folder: id === 4 ? `archive` : `inbox`,
     at: id,
   }))
-  const expected = () =>
-    remote
-      .filter(({ folder }) => folder === `inbox`)
-      .sort((left, right) => right.at - left.at)
-      .slice(0, 2)
-      .map(({ id }) => id)
   const persistence = createDeferred<void>()
   let providerPhase: ProviderPhase = `initial`
   const requests: Array<{
@@ -131,7 +109,7 @@ async function checkOptimisticOrderedRefetch(
   let unsubscribe: (() => void) | undefined
   try {
     await live.preload()
-    expect(publicIds()).toEqual(expected())
+    expect(publicIds()).toEqual(expectedPublicWindow(remote))
     expect(source.toArray.map(({ id }) => id).sort()).toEqual([2, 3])
     const subscription = live.subscribeChanges(
       () => publications.push(publicIds()),
@@ -215,7 +193,9 @@ async function checkOptimisticOrderedRefetch(
         ),
       ).toBe(true)
     }
-    await vi.waitFor(() => expect(publicIds()).toEqual(expected()))
+    await vi.waitFor(() =>
+      expect(publicIds()).toEqual(expectedPublicWindow(remote)),
+    )
     expect(publicIds()).toEqual(reportDuringHold ? [5, 2] : [2, 1])
     expect(publications.at(-1)).toEqual(publicIds())
   } finally {
@@ -227,18 +207,26 @@ async function checkOptimisticOrderedRefetch(
   }
 }
 
+/**
+ * The public window of the live query `inbox` order `at desc` limit 2, computed
+ * from the plain remote row ledger. This is the model that the check compares
+ * the live rows against at each checkpoint.
+ */
+function expectedPublicWindow(remote: ReadonlyArray<Row>): Array<number> {
+  return remote
+    .filter(({ folder }) => folder === `inbox`)
+    .sort((left, right) => right.at - left.at)
+    .slice(0, 2)
+    .map(({ id }) => id)
+}
+
+declareOracle({
+  check: [checkOptimisticOrderedRefetch],
+  model: [expectedPublicWindow],
+})
+
 it(`publishes a short optimistic window during a mutation-handler refetch`, () =>
   checkOptimisticOrderedRefetch(false))
 
 it(`keeps the short optimistic window through a held refetch report`, () =>
   checkOptimisticOrderedRefetch(true))
-
-it(`rejects an unordered page cap as a rank-tie probe`, () => {
-  const remote: Array<Row> = [1, 2, 3].map((id) => ({
-    id,
-    folder: `inbox`,
-    at: id,
-  }))
-  expect(isNarrowRankTieProbe({ limit: 1 }, remote)).toBe(false)
-  expect(isNarrowRankTieProbe({}, [])).toBe(false)
-})
diff --git a/packages/query-db-collection/tests/optimistic-ordered-refetch-probe.ts b/packages/query-db-collection/tests/optimistic-ordered-refetch-probe.ts
new file mode 100644
index 0000000000..befe69d89c
--- /dev/null
+++ b/packages/query-db-collection/tests/optimistic-ordered-refetch-probe.ts
@@ -0,0 +1,22 @@
+import { applyPredicates } from '../e2e/query-filter.js'
+import type { LoadSubsetOptions } from '@tanstack/db'
+
+export type Row = { id: number; folder: `inbox` | `archive`; at: number }
+
+// A boundary probe may omit ordering, but its predicate must select one rank.
+// Add another row at that rank so a key-specific request cannot masquerade as
+// a rank-tie probe. Evaluate the whole predicate scope, not the capped answer.
+export function isNarrowRankTieProbe(
+  options: LoadSubsetOptions,
+  remote: Array<Row>,
+): boolean {
+  if (options.orderBy !== undefined || options.where === undefined) return false
+  const matches = applyPredicates(remote, { where: options.where })
+  if (matches.length === 0) return false
+  const rank = matches[0]!.at
+  if (matches.some((row) => row.at !== rank)) return false
+  const additionalTie: Row = { ...matches[0]!, id: 1000 }
+  return applyPredicates([...remote, additionalTie], {
+    where: options.where,
+  }).some((row) => row.id === additionalTie.id)
+}
diff --git a/packages/query-db-collection/tests/optimistic-ordered-refetch.test.ts b/packages/query-db-collection/tests/optimistic-ordered-refetch.test.ts
new file mode 100644
index 0000000000..8307f47d29
--- /dev/null
+++ b/packages/query-db-collection/tests/optimistic-ordered-refetch.test.ts
@@ -0,0 +1,16 @@
+// Unit tests for the rank-tie probe classifier that the optimistic ordered
+// refetch oracle uses. The law (a boundary probe must select one rank) is owned
+// by optimistic-ordered-refetch-oracle.test.ts.
+import { expect, it } from 'vitest'
+import { isNarrowRankTieProbe } from './optimistic-ordered-refetch-probe.js'
+import type { Row } from './optimistic-ordered-refetch-probe.js'
+
+it(`rejects an unordered page cap as a rank-tie probe`, () => {
+  const remote: Array<Row> = [1, 2, 3].map((id) => ({
+    id,
+    folder: `inbox`,
+    at: id,
+  }))
+  expect(isNarrowRankTieProbe({ limit: 1 }, remote)).toBe(false)
+  expect(isNarrowRankTieProbe({}, [])).toBe(false)
+})
diff --git a/packages/query-db-collection/tests/ownership-lifecycle-support.ts b/packages/query-db-collection/tests/ownership-lifecycle-support.ts
new file mode 100644
index 0000000000..b38654e946
--- /dev/null
+++ b/packages/query-db-collection/tests/ownership-lifecycle-support.ts
@@ -0,0 +1,669 @@
+/**
+ * Shared fixtures and reference helpers for the Query Collection ownership
+ * tests. The ownership law and its checks are owned by
+ * ownership-lifecycle.oracle.test.ts, which declares them over these fixtures.
+ */
+
+import { QueryClient, hashKey } from '@tanstack/query-core'
+import { IR, createCollection } from '@tanstack/db'
+import { expect, vi } from 'vitest'
+
+import { createDeferred } from '../../db/src/deferred.js'
+
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src/index.js'
+
+import { queryCollectionOptions } from '../src/query.js'
+import type {
+  Collection,
+  LoadSubsetOptions,
+  SyncMetadataApi,
+} from '@tanstack/db'
+import type { QueryFunctionContext } from '@tanstack/query-core'
+import type {
+  PersistedCacheGenerationClaim,
+  PersistenceAdapter,
+} from '../../db-sqlite-persistence-core/src/index.js'
+import type { NonSingleResult } from '../../db/src/types.js'
+import type { QueryCollectionUtils } from '../src/query.js'
+
+export type Item = {
+  id: string
+  category: string
+  name: string
+}
+
+export type MutationLifecycleSnapshot = {
+  server: Array<string>
+  cache: Array<string>
+  synced: Array<string>
+  source: Array<string>
+  derived: Array<string>
+}
+
+export type MutationPublicationSnapshot = Pick<
+  MutationLifecycleSnapshot,
+  `source` | `derived`
+> & { expected: Array<string> }
+
+export type MetadataRecorder = {
+  rows: Map<string | number, unknown>
+  writes: Array<{ type: `set` | `delete`; key: string | number }>
+}
+
+export type OwnershipFixtureOptions = {
+  id: string
+  results: Array<Array<Item> | Promise<Array<Item>>>
+  getKey?: (item: Item) => string | number
+  syncMode?: `eager` | `on-demand`
+  customHash?: boolean
+  staleTime?: number
+  persistedGcTime?: number
+  metadataRecorder?: MetadataRecorder
+  setupMetadata?: (metadata: SyncMetadataApi<string | number>) => void
+  scanPersistedRows?: () => Promise<
+    Array<{ key: string | number; value: Item; metadata?: unknown }>
+  >
+}
+
+export type OwnershipFixture = {
+  collection: Collection<
+    Item,
+    string | number,
+    QueryCollectionUtils<Item, string | number, Item, unknown>,
+    never,
+    Item
+  > &
+    NonSingleResult
+  queryClient: QueryClient
+  queryFn: ReturnType<typeof vi.fn<() => Promise<Array<Item>>>>
+}
+
+export const shared = { id: `shared`, category: `shared`, name: `Shared` }
+
+export const detailOnly = { id: `detail`, category: `detail`, name: `Detail` }
+
+export const listOnly = { id: `list`, category: `list`, name: `List` }
+
+// The overlap fixtures return rows from both named categories.
+// A literal field name passed to eq() would instead become a constant value.
+export const categoryIn = (...categories: Array<string>) =>
+  new IR.Func(`in`, [new IR.PropRef([`category`]), new IR.Value(categories)])
+
+export const cleanups: Array<() => Promise<void>> = []
+
+export async function runCleanups(): Promise<void> {
+  const results = await Promise.allSettled(
+    cleanups.splice(0).map((cleanup) => cleanup()),
+  )
+  const failures = results.flatMap((result) =>
+    result.status === `rejected` ? [result.reason] : [],
+  )
+  if (failures.length > 0) {
+    throw new AggregateError(failures, `Ownership oracle cleanup failed`, {
+      cause: failures[0],
+    })
+  }
+}
+
+export function createQueryClient(
+  customHash = false,
+  staleTime = Number.POSITIVE_INFINITY,
+): QueryClient {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        gcTime: Number.POSITIVE_INFINITY,
+        retry: false,
+        staleTime,
+        queryKeyHashFn: customHash
+          ? (key) => `custom:${hashKey(key)}`
+          : undefined,
+      },
+    },
+  })
+}
+
+export function recordMetadata(
+  metadata: SyncMetadataApi<string | number>,
+  recorder: MetadataRecorder,
+): SyncMetadataApi<string | number> {
+  // These are emitted writes, captured before delegation, not durable commits.
+  return {
+    ...metadata,
+    row: {
+      get: (key) => metadata.row.get(key),
+      set: (key, value) => {
+        recorder.writes.push({ type: `set`, key })
+        recorder.rows.set(key, value)
+        metadata.row.set(key, value)
+      },
+      delete: (key) => {
+        recorder.writes.push({ type: `delete`, key })
+        recorder.rows.delete(key)
+        metadata.row.delete(key)
+      },
+    },
+    collection: {
+      get: (key) => metadata.collection.get(key),
+      set: (key, value) => metadata.collection.set(key, value),
+      delete: (key) => metadata.collection.delete(key),
+      list: (prefix) => metadata.collection.list(prefix),
+    },
+  }
+}
+
+export function createOwnershipFixture({
+  id,
+  results,
+  getKey = (item) => item.id,
+  syncMode = `on-demand`,
+  metadataRecorder,
+  setupMetadata,
+  scanPersistedRows,
+  customHash,
+  staleTime,
+  persistedGcTime,
+}: OwnershipFixtureOptions): OwnershipFixture {
+  const queryClient = createQueryClient(customHash, staleTime)
+  const queryFn = vi.fn<() => Promise<Array<Item>>>()
+  results.forEach((result) =>
+    queryFn.mockImplementationOnce(() => Promise.resolve(result)),
+  )
+  queryFn.mockRejectedValue(new Error(`Unexpected ownership refetch`))
+  const baseOptions = queryCollectionOptions<Item>({
+    id,
+    queryClient,
+    queryKey: [id],
+    queryFn,
+    getKey,
+    syncMode,
+    startSync: true,
+    persistedGcTime,
+  })
+  const originalSync = baseOptions.sync
+  let pendingSetup = setupMetadata
+  const collection = createCollection(
+    metadataRecorder || setupMetadata || scanPersistedRows
+      ? {
+          ...baseOptions,
+          sync: {
+            sync: (params: Parameters<typeof originalSync.sync>[0]) => {
+              if (!params.metadata) {
+                throw new Error(`Sync metadata API is unavailable`)
+              }
+              const observedMetadata = metadataRecorder
+                ? recordMetadata(params.metadata, metadataRecorder)
+                : params.metadata
+              const metadataWithPersistedScan: SyncMetadataApi<
+                string | number
+              > = scanPersistedRows
+                ? {
+                    ...observedMetadata,
+                    persistence: {
+                      protocol: `@tanstack/db/sync-persistence`,
+                      version: 1,
+                      hydrateBaseline: async () => {},
+                      reserveCommitTurn: () => {},
+                      scanPersistedRows,
+                      resumeSnapshot: {
+                        certify: async () => {},
+                        getKeySetEvidence: () => ({ status: `consistent` }),
+                        expectCurrentCommit: () => {},
+                      },
+                    },
+                  }
+                : observedMetadata
+              if (pendingSetup) {
+                params.begin()
+                pendingSetup(metadataWithPersistedScan)
+                params.commit()
+                pendingSetup = undefined
+              }
+              return originalSync.sync({
+                ...params,
+                metadata: metadataWithPersistedScan,
+              })
+            },
+          },
+        }
+      : baseOptions,
+  )
+  cleanups.push(async () => {
+    await collection.cleanup()
+    queryClient.clear()
+  })
+  return { collection, queryClient, queryFn }
+}
+
+export function rows(collection: {
+  keys: () => Iterable<string | number>
+}): Array<string> {
+  return Array.from(collection.keys()).map(String).sort()
+}
+
+export function itemIds(items: Iterable<Item>): Array<string> {
+  return Array.from(items, ({ id }) => id).sort()
+}
+
+export function expectMutationLifecycleSnapshot(
+  snapshot: MutationLifecycleSnapshot,
+  authoritative: ReadonlyArray<string>,
+  visible: ReadonlyArray<string>,
+  ordered: boolean,
+): void {
+  expect(snapshot).toEqual({
+    server: [...authoritative].sort(),
+    cache: [...authoritative].sort(),
+    synced: [...authoritative].sort(),
+    source: [...visible].sort(),
+    derived: ordered ? [...visible] : [...visible].sort(),
+  })
+}
+
+export function expectMutationPublicationIntegrity(
+  publications: ReadonlyArray<MutationPublicationSnapshot>,
+): void {
+  for (const publication of publications) {
+    expect(publication).toEqual({
+      source: publication.expected,
+      derived: publication.expected,
+      expected: publication.expected,
+    })
+  }
+}
+
+export function persistedOwners(
+  metadata: ReadonlyMap<string | number, unknown>,
+  rowId: string,
+): Array<string> {
+  const rowMetadata = metadata.get(rowId)
+  if (!rowMetadata || typeof rowMetadata !== `object`) return []
+  const queryCollection = (rowMetadata as Record<string, unknown>)
+    .queryCollection
+  if (!queryCollection || typeof queryCollection !== `object`) return []
+  const owners = (queryCollection as Record<string, unknown>).owners
+  return owners && typeof owners === `object` ? Object.keys(owners).sort() : []
+}
+
+export type StoredOwnership = {
+  rows: Map<string | number, Item>
+  rowMetadata: Map<string | number, unknown>
+  collectionMetadata: Map<string, unknown>
+}
+
+export function categorySubset(category: `detail` | `list`): LoadSubsetOptions {
+  return {
+    where: new IR.Func(`in`, [
+      new IR.PropRef([`category`]),
+      new IR.Value([`shared`, category]),
+    ]),
+  }
+}
+
+export function selectOwnershipRows(
+  items: Iterable<Item>,
+  options: LoadSubsetOptions,
+): Array<Item> {
+  if (
+    options.orderBy !== undefined ||
+    options.limit !== undefined ||
+    options.offset !== undefined ||
+    options.cursor !== undefined
+  ) {
+    throw new Error(`Ownership fixture does not support ordering or windows`)
+  }
+  const { where } = options
+  if (!where) return Array.from(items, (item) => structuredClone(item))
+  if (
+    where.type !== `func` ||
+    where.name !== `in` ||
+    where.args.length !== 2 ||
+    where.args[0]?.type !== `ref` ||
+    where.args[0].path.length !== 1 ||
+    where.args[0].path[0] !== `category` ||
+    where.args[1]?.type !== `val` ||
+    !Array.isArray(where.args[1].value) ||
+    !where.args[1].value.every((value: unknown) => typeof value === `string`)
+  ) {
+    throw new Error(`Ownership fixture supports only category membership`)
+  }
+  const categories = new Set<string>(where.args[1].value)
+  return Array.from(items)
+    .filter((item) => categories.has(item.category))
+    .map((item) => structuredClone(item))
+}
+
+export function createOwnershipStorage(
+  seed?: StoredOwnership,
+  gatedCommit?: number,
+) {
+  const state: StoredOwnership = structuredClone(
+    seed ?? {
+      rows: new Map(),
+      rowMetadata: new Map(),
+      collectionMetadata: new Map(),
+    },
+  )
+  const entered = createDeferred<void>()
+  const released = createDeferred<void>()
+  let commitCount = 0
+  let latestTerm = 0
+  let latestSeq = 0
+  let latestRowVersion = 0
+  const adapter: PersistenceAdapter = {
+    loadSubset: (_id, options) =>
+      Promise.resolve(
+        selectOwnershipRows(state.rows.values(), options).map((value) => ({
+          key: value.id,
+          value,
+          metadata: structuredClone(state.rowMetadata.get(value.id)),
+        })),
+      ),
+    loadResumeSnapshot: (_id, options) =>
+      Promise.resolve({
+        rows:
+          options?.includeRows === false
+            ? []
+            : Array.from(state.rows, ([key, value]) => ({
+                key,
+                value: structuredClone(value),
+                metadata: structuredClone(state.rowMetadata.get(key)),
+              })),
+        keySet: { status: `consistent` },
+        collectionMetadata: Array.from(
+          state.collectionMetadata,
+          ([key, value]) => ({ key, value: structuredClone(value) }),
+        ),
+        latestTerm,
+        latestSeq,
+        latestRowVersion,
+        resetEpoch: 0,
+      }),
+    loadCollectionMetadata: () =>
+      Promise.resolve(
+        Array.from(state.collectionMetadata, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+        })),
+      ),
+    scanRows: () =>
+      Promise.resolve(
+        Array.from(state.rows, ([key, value]) => ({
+          key,
+          value: structuredClone(value),
+          metadata: structuredClone(state.rowMetadata.get(key)),
+        })),
+      ),
+    ensureIndex: () => Promise.resolve(),
+    applyCommittedTx: async (_id, transaction) => {
+      const tx = structuredClone(transaction)
+      commitCount++
+      if (commitCount === gatedCommit) {
+        entered.resolve()
+        await released.promise
+      }
+      if (tx.truncate) {
+        state.rows.clear()
+        state.rowMetadata.clear()
+      }
+      for (const mutation of tx.mutations) {
+        if (mutation.type === `delete`) {
+          state.rows.delete(mutation.key)
+          state.rowMetadata.delete(mutation.key)
+        } else {
+          const { id, category, name } = mutation.value
+          if (
+            typeof id !== `string` ||
+            typeof category !== `string` ||
+            typeof name !== `string`
+          ) {
+            throw new Error(`Ownership fixture received an invalid row`)
+          }
+          state.rows.set(mutation.key, { id, category, name })
+          if (mutation.metadataChanged) {
+            state.rowMetadata.set(
+              mutation.key,
+              structuredClone(mutation.metadata),
+            )
+          }
+        }
+      }
+      for (const mutation of tx.rowMetadataMutations ?? []) {
+        if (mutation.type === `delete`) state.rowMetadata.delete(mutation.key)
+        else
+          state.rowMetadata.set(mutation.key, structuredClone(mutation.value))
+      }
+      for (const mutation of tx.collectionMetadataMutations ?? []) {
+        if (mutation.type === `delete`)
+          state.collectionMetadata.delete(mutation.key)
+        else
+          state.collectionMetadata.set(
+            mutation.key,
+            structuredClone(mutation.value),
+          )
+      }
+      latestTerm = tx.term
+      latestSeq = tx.seq
+      latestRowVersion = tx.rowVersion
+    },
+  }
+  return {
+    adapter,
+    entered: entered.promise,
+    release: () => released.resolve(),
+    snapshot: (): StoredOwnership => structuredClone(state),
+  }
+}
+
+export function createPersistedOwnershipFixture(
+  id: string,
+  storage: ReturnType<typeof createOwnershipStorage>,
+  serverRows: Array<Item>,
+  syncMode: `eager` | `on-demand` = `on-demand`,
+) {
+  const queryClient = createQueryClient()
+  const providerRows = structuredClone(serverRows)
+  const queryFn = vi.fn((context: QueryFunctionContext) =>
+    Promise.resolve(
+      selectOwnershipRows(providerRows, context.meta?.loadSubsetOptions ?? {}),
+    ),
+  )
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode,
+        persistedGcTime: Number.POSITIVE_INFINITY,
+        startSync: true,
+      }),
+      persistence: { adapter: storage.adapter },
+    }),
+  )
+  cleanups.push(async () => {
+    storage.release()
+    try {
+      await collection.cleanup()
+    } finally {
+      queryClient.clear()
+    }
+  })
+  return { collection, queryClient, queryFn }
+}
+
+export function storedItems(
+  storage: ReturnType<typeof createOwnershipStorage>,
+): Array<Item> {
+  return [...storage.snapshot().rows.values()].sort((a, b) =>
+    a.id.localeCompare(b.id),
+  )
+}
+
+// The direct-write receipt follows the applied commit, regardless of whether
+// the Query Collection already exposes the new row in memory.
+export function expectedDirectWriteReceipt(applied: boolean) {
+  return {
+    receipt: applied ? `fulfilled` : `pending`,
+    storedName: applied ? `Updated` : shared.name,
+  }
+}
+
+// A direct write can apply only in the current sync run. Cleanup start closes
+// that admission; restart creates a new current run.
+export function expectedDirectWriteAdmission(
+  syncRun: `current` | `invalidated`,
+) {
+  return syncRun === `current` ? `fulfilled` : `rejected`
+}
+
+export type ColdOwnershipObservation = {
+  stored: Array<Item>
+  visible: Array<Item>
+}
+
+export async function observeColdOwnerRevalidation(
+  dropMetadata = false,
+): Promise<Array<ColdOwnershipObservation>> {
+  const hotStorage = createOwnershipStorage(undefined, 1)
+  const hot = createPersistedOwnershipFixture(
+    `cold-owner-revalidation`,
+    hotStorage,
+    [shared, detailOnly, listOnly],
+  )
+  const detail = categorySubset(`detail`)
+  const list = categorySubset(`list`)
+  const firstLoad = Promise.resolve(hot.collection._sync.loadSubset(detail))
+  // Observe rejection before any gate assertion can abort the test.
+  void firstLoad.catch(() => undefined)
+  try {
+    await hotStorage.entered
+    expect(hotStorage.snapshot().rows.size).toBe(0)
+    expect(hotStorage.snapshot().rowMetadata.size).toBe(0)
+    hotStorage.release()
+    await firstLoad
+    await hot.collection._sync.loadSubset(list)
+    await vi.waitFor(() =>
+      expect(storedItems(hotStorage)).toEqual([detailOnly, listOnly, shared]),
+    )
+    hot.collection._sync.unloadSubset(detail)
+    hot.collection._sync.unloadSubset(list)
+    // Both retention markers must commit before making a separate cold store.
+    // Their private hash encoding is not the expected ownership authority.
+    await vi.waitFor(() =>
+      expect(hotStorage.snapshot().collectionMetadata.size).toBe(2),
+    )
+    const coldSeed = hotStorage.snapshot()
+    if (dropMetadata) coldSeed.rowMetadata.clear()
+    const coldStorage = createOwnershipStorage(coldSeed)
+    const cold = createPersistedOwnershipFixture(
+      `cold-owner-revalidation`,
+      coldStorage,
+      [],
+    )
+    expect(cold.queryFn).not.toHaveBeenCalled()
+    const capture = (): ColdOwnershipObservation => ({
+      stored: storedItems(coldStorage),
+      visible: cold.collection.toArray
+        .map(({ id, category, name }) => ({ id, category, name }))
+        .sort((a, b) => a.id.localeCompare(b.id)),
+    })
+    const observations = [capture()]
+    await cold.collection._sync.loadSubset(detail)
+    await vi.waitFor(() =>
+      expect(coldStorage.snapshot().collectionMetadata.size).toBe(1),
+    )
+    observations.push(capture())
+    await cold.collection._sync.loadSubset(list)
+    await vi.waitFor(() =>
+      expect(coldStorage.snapshot().collectionMetadata.size).toBe(0),
+    )
+    observations.push(capture())
+    expect(cold.queryFn).toHaveBeenCalledTimes(2)
+    return observations
+  } finally {
+    hotStorage.release()
+  }
+}
+
+export function expectColdOwnerRevalidation(
+  observations: Array<ColdOwnershipObservation>,
+): void {
+  expect(observations).toEqual([
+    { stored: [detailOnly, listOnly, shared], visible: [] },
+    { stored: [listOnly, shared], visible: [shared] },
+    { stored: [], visible: [] },
+  ])
+}
+
+// The recorder follows the tested sync run's persisted cache claim across
+// rotation. An expired run may own a new retired generation while another run
+// still claims the active head, so claiming the logical ID here would inspect
+// the wrong cache. The durable comparison reads the physical ID in this run's
+// latest claim, without releasing its authority.
+export function recordRunCacheClaim(
+  adapter: PersistenceAdapter,
+): () => PersistedCacheGenerationClaim {
+  const claimCacheGeneration = adapter.claimCacheGeneration?.bind(adapter)
+  const rotateCacheGeneration = adapter.rotateCacheGeneration?.bind(adapter)
+  if (!claimCacheGeneration || !rotateCacheGeneration) {
+    throw new Error(`Expected managed SQLite cache generations`)
+  }
+  let current: PersistedCacheGenerationClaim | undefined
+  adapter.claimCacheGeneration = async (...args) => {
+    current = await claimCacheGeneration(...args)
+    return current
+  }
+  adapter.rotateCacheGeneration = async (...args) => {
+    current = await rotateCacheGeneration(...args)
+    return current
+  }
+  return () => {
+    if (!current) throw new Error(`Expected a claimed cache generation`)
+    return current
+  }
+}
+
+export async function readClaimedCacheRows(
+  adapter: PersistenceAdapter,
+  claim: PersistedCacheGenerationClaim,
+): Promise<Array<{ key: string | number; name: unknown }>> {
+  const persistedRows = await adapter.loadSubset(
+    {
+      kind: `managed`,
+      storageCollectionId: claim.storageCollectionId,
+      claimId: claim.claimId,
+    },
+    {},
+    {
+      cacheGenerationClaimId: claim.claimId,
+    },
+  )
+  return persistedRows
+    .map((row) => ({ key: row.key, name: row.value.name }))
+    .sort((a, b) => String(a.key).localeCompare(String(b.key)))
+}
+
+/**
+ * The Query failure a Collection reports: its failed first load while it is
+ * in `error`, or the cause of its failure reason after readiness.
+ */
+export function reportedError(collection: {
+  status: string
+  health: {
+    failureReason: { cause: unknown } | null
+    error: { cause: unknown } | null
+  }
+  _lifecycle: { getSyncError: () => unknown }
+}): unknown {
+  return collection.status === `error`
+    ? collection._lifecycle.getSyncError()
+    : (collection.health.failureReason ?? collection.health.error)?.cause
+}
diff --git a/packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts b/packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts
index c60d302e2d..53e02d87e2 100644
--- a/packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts
+++ b/packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts
@@ -1,66 +1,50 @@
-import {
-  CancelledError,
-  QueryClient,
-  QueryObserver,
-  focusManager,
-  hashKey,
-  isCancelledError,
-} from '@tanstack/query-core'
+import { hashKey, isCancelledError } from '@tanstack/query-core'
 import {
   DbClient,
   IR,
   collectionOptions,
   createCollection,
-  createLiveQueryCollection,
   createOptimisticAction,
   createTransaction,
   eq,
   getLoadSubsetDemandKey,
 } from '@tanstack/db'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import { createDeferred } from '../../db/src/deferred.js'
 import {
   compileSingleRowExpression,
   toBooleanPredicate,
 } from '../../db/src/query/compiler/evaluators.js'
-import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src/index.js'
-import { createNodeSQLitePersistence } from '../../node-db-sqlite-persistence/src/index.js'
-import { BetterSqlite3SQLiteDriver } from '../../node-db-sqlite-persistence/src/node-driver.js'
-import {
-  InvalidQueryResultError,
-  SyncNotInitializedError,
-} from '../src/errors.js'
+
+import { InvalidQueryResultError } from '../src/errors.js'
 import { queryCollectionOptions } from '../src/query.js'
-import type {
-  Collection,
-  LoadSubsetOptions,
-  SyncMetadataApi,
-  Transaction,
-} from '@tanstack/db'
-import type { QueryFunctionContext } from '@tanstack/query-core'
-import type {
-  PersistedCacheGenerationClaim,
-  PersistenceAdapter,
-} from '../../db-sqlite-persistence-core/src/index.js'
-import type { NonSingleResult } from '../../db/src/types.js'
-import type { QueryCollectionUtils } from '../src/query.js'
+import {
+  categorySubset,
+  cleanups,
+  createOwnershipFixture,
+  createOwnershipStorage,
+  createPersistedOwnershipFixture,
+  createQueryClient,
+  detailOnly,
+  itemIds,
+  listOnly,
+  persistedOwners,
+  reportedError,
+  rows,
+  runCleanups,
+  shared,
+  storedItems,
+} from './ownership-lifecycle-support.js'
+import type { LoadSubsetOptions, Transaction } from '@tanstack/db'
+import type { QueryClient, QueryFunctionContext } from '@tanstack/query-core'
 
-/**
- * The Query failure a Collection reports: its failed first load while it is
- * in `error`, or the cause of its failure reason after readiness.
- */
-function reportedError(collection: {
-  status: string
-  health: {
-    failureReason: { cause: unknown } | null
-    error: { cause: unknown } | null
-  }
-  _lifecycle: { getSyncError: () => unknown }
-}): unknown {
-  return collection.status === `error`
-    ? collection._lifecycle.getSyncError()
-    : (collection.health.failureReason ?? collection.health.error)?.cause
-}
+import type { QueryCollectionUtils } from '../src/query.js'
+import type {
+  Item,
+  MetadataRecorder,
+  OwnershipFixture,
+} from './ownership-lifecycle-support.js'
 
 /**
  * # Who owns a Query-backed row, and when may it disappear?
@@ -275,82 +259,6 @@ function expectPublicRefetchObservation(
   )
 }
 
-type Item = {
-  id: string
-  category: string
-  name: string
-}
-
-type MutationLifecycleSnapshot = {
-  server: Array<string>
-  cache: Array<string>
-  synced: Array<string>
-  source: Array<string>
-  derived: Array<string>
-}
-
-type MutationPublicationSnapshot = Pick<
-  MutationLifecycleSnapshot,
-  `source` | `derived`
-> & { expected: Array<string> }
-
-type MetadataRecorder = {
-  rows: Map<string | number, unknown>
-  writes: Array<{ type: `set` | `delete`; key: string | number }>
-}
-
-type OwnershipFixtureOptions = {
-  id: string
-  results: Array<Array<Item> | Promise<Array<Item>>>
-  getKey?: (item: Item) => string | number
-  syncMode?: `eager` | `on-demand`
-  customHash?: boolean
-  staleTime?: number
-  persistedGcTime?: number
-  metadataRecorder?: MetadataRecorder
-  setupMetadata?: (metadata: SyncMetadataApi<string | number>) => void
-  scanPersistedRows?: () => Promise<
-    Array<{ key: string | number; value: Item; metadata?: unknown }>
-  >
-}
-
-type OwnershipFixture = {
-  collection: Collection<
-    Item,
-    string | number,
-    QueryCollectionUtils<Item, string | number, Item, unknown>,
-    never,
-    Item
-  > &
-    NonSingleResult
-  queryClient: QueryClient
-  queryFn: ReturnType<typeof vi.fn<() => Promise<Array<Item>>>>
-}
-
-const shared = { id: `shared`, category: `shared`, name: `Shared` }
-const detailOnly = { id: `detail`, category: `detail`, name: `Detail` }
-const listOnly = { id: `list`, category: `list`, name: `List` }
-
-// The overlap fixtures return rows from both named categories.
-// A literal field name passed to eq() would instead become a constant value.
-const categoryIn = (...categories: Array<string>) =>
-  new IR.Func(`in`, [new IR.PropRef([`category`]), new IR.Value(categories)])
-const cleanups: Array<() => Promise<void>> = []
-
-async function runCleanups(): Promise<void> {
-  const results = await Promise.allSettled(
-    cleanups.splice(0).map((cleanup) => cleanup()),
-  )
-  const failures = results.flatMap((result) =>
-    result.status === `rejected` ? [result.reason] : [],
-  )
-  if (failures.length > 0) {
-    throw new AggregateError(failures, `Ownership oracle cleanup failed`, {
-      cause: failures[0],
-    })
-  }
-}
-
 /**
  * `collection.utils.refetch()` is normally an application barrier. The public
  * contract is `docs/collections/query-collection.md#controlling-refetch-behavior`:
@@ -1017,496 +925,692 @@ function expectHandlerIdentityObservation(
   expect(actual).toEqual(expected)
 }
 
-function createQueryClient(
-  customHash = false,
-  staleTime = Number.POSITIVE_INFINITY,
-): QueryClient {
-  return new QueryClient({
-    defaultOptions: {
-      queries: {
-        gcTime: Number.POSITIVE_INFINITY,
-        retry: false,
-        staleTime,
-        queryKeyHashFn: customHash
-          ? (key) => `custom:${hashKey(key)}`
-          : undefined,
-      },
-    },
-  })
+/**
+ * ## A reacquired observer lease owns the current Query result
+ *
+ * Law: reacquiring a released demand creates a new observer lease. Its
+ * current result is the Query's latest successful data, so it owns that
+ * data's rows from reacquisition until its own release. An older acquisition
+ * release that publishes later retires only the older lease. If the new
+ * lease starts a refetch, a successful refetch replaces the lease's result.
+ * A failed refetch keeps the last successful data, so it keeps those rows.
+ * `staleTime` decides whether a refetch starts. It cannot decide whether the
+ * cached result is owned.
+ *
+ * Authority: the reacquisition law in the history above, and the TanStack
+ * Query rules that a stale Query refetches when an observer mounts and that
+ * a failed refetch keeps the previous `data`.
+ *
+ * Limits: one reacquired on-demand subset whose result has one or two
+ * rows, zero to two peer subsets that own the first row, no persisted
+ * metadata, and one unrelated optimistic transaction that holds
+ * publication. A release commit that
+ * rejects and the direct-write path have their own histories below. Eager
+ * mode cannot reach the premise: it has no subset release, and ending an
+ * eager sync run removes its Query from the cache, so a restart fetches
+ * instead of replaying cached data.
+ */
+const solo: Item = { id: `solo`, category: `detail`, name: `Solo` }
+
+type ReacquisitionHistory = {
+  /** `Infinity`: reacquisition starts no fetch. `0`: it starts a refetch. */
+  staleTime: number
+  /** The refetch outcome. It has no effect when no refetch starts. */
+  refetch: `rejects` | `same-rows` | `empty`
+  /** The refetch settles before or after the older release publishes. */
+  settles: `while-held` | `after-publication`
+  /** Peer leases that also own `shared` until after the refetch. */
+  peers: 0 | 1 | 2
+  /** Rows in the reacquired lease's result; the second is owned only here. */
+  rows: 1 | 2
 }
 
-function recordMetadata(
-  metadata: SyncMetadataApi<string | number>,
-  recorder: MetadataRecorder,
-): SyncMetadataApi<string | number> {
-  // These are emitted writes, captured before delegation, not durable commits.
-  return {
-    ...metadata,
-    row: {
-      get: (key) => metadata.row.get(key),
-      set: (key, value) => {
-        recorder.writes.push({ type: `set`, key })
-        recorder.rows.set(key, value)
-        metadata.row.set(key, value)
-      },
-      delete: (key) => {
-        recorder.writes.push({ type: `delete`, key })
-        recorder.rows.delete(key)
-        metadata.row.delete(key)
-      },
-    },
-    collection: {
-      get: (key) => metadata.collection.get(key),
-      set: (key, value) => metadata.collection.set(key, value),
-      delete: (key) => metadata.collection.delete(key),
-      list: (prefix) => metadata.collection.list(prefix),
-    },
-  }
+type ReacquisitionObservation = {
+  /** Public rows after reacquisition, while publication is still held. */
+  held: Array<string>
+  /** Public rows after the held transactions publish. */
+  published: Array<string>
+  /** Public rows after the refetch, if any, has settled. */
+  settled: Array<string>
+  /** Public rows after every peer is released. */
+  peerReleased: Array<string>
+  /** Public rows after the reacquired demand is released. */
+  released: Array<string>
+  /** Query function calls. Query staleness decides this count. */
+  queryCalls: number
 }
 
-function createOwnershipFixture({
-  id,
-  results,
-  getKey = (item) => item.id,
-  syncMode = `on-demand`,
-  metadataRecorder,
-  setupMetadata,
-  scanPersistedRows,
-  customHash,
-  staleTime,
-  persistedGcTime,
-}: OwnershipFixtureOptions): OwnershipFixture {
-  const queryClient = createQueryClient(customHash, staleTime)
-  const queryFn = vi.fn<() => Promise<Array<Item>>>()
-  results.forEach((result) =>
-    queryFn.mockImplementationOnce(() => Promise.resolve(result)),
-  )
-  queryFn.mockRejectedValue(new Error(`Unexpected ownership refetch`))
-  const baseOptions = queryCollectionOptions<Item>({
-    id,
-    queryClient,
-    queryKey: [id],
-    queryFn,
-    getKey,
-    syncMode,
-    startSync: true,
-    persistedGcTime,
-  })
-  const originalSync = baseOptions.sync
-  let pendingSetup = setupMetadata
-  const collection = createCollection(
-    metadataRecorder || setupMetadata || scanPersistedRows
-      ? {
-          ...baseOptions,
-          sync: {
-            sync: (params: Parameters<typeof originalSync.sync>[0]) => {
-              if (!params.metadata) {
-                throw new Error(`Sync metadata API is unavailable`)
-              }
-              const observedMetadata = metadataRecorder
-                ? recordMetadata(params.metadata, metadataRecorder)
-                : params.metadata
-              const metadataWithPersistedScan: SyncMetadataApi<
-                string | number
-              > = scanPersistedRows
-                ? {
-                    ...observedMetadata,
-                    persistence: {
-                      protocol: `@tanstack/db/sync-persistence`,
-                      version: 1,
-                      hydrateBaseline: async () => {},
-                      reserveCommitTurn: () => {},
-                      scanPersistedRows,
-                      resumeSnapshot: {
-                        certify: async () => {},
-                        getKeySetEvidence: () => ({ status: `consistent` }),
-                        expectCurrentCommit: () => {},
-                      },
-                    },
-                  }
-                : observedMetadata
-              if (pendingSetup) {
-                params.begin()
-                pendingSetup(metadataWithPersistedScan)
-                params.commit()
-                pendingSetup = undefined
-              }
-              return originalSync.sync({
-                ...params,
-                metadata: metadataWithPersistedScan,
-              })
-            },
-          },
-        }
-      : baseOptions,
-  )
-  cleanups.push(async () => {
-    await collection.cleanup()
-    queryClient.clear()
-  })
-  return { collection, queryClient, queryFn }
+/**
+ * The model keeps each active lease's latest successful result. Public
+ * synced rows are the union of those results at the last publication. Each
+ * peer's result is always `shared`; peers are active until `peerReleased`.
+ * A peer hides a lost `shared` until the peers leave, which is why that
+ * checkpoint exists; the lease-only `solo` row shows a loss at once. While the optimistic blocker
+ * holds publication, the public view is the blocker plus the rows published
+ * before the release, which the first lease owned. The model does not
+ * represent tombstones, ownership maps, or sync transactions.
+ */
+const modelReacquisition = (
+  history: ReacquisitionHistory,
+): ReacquisitionObservation => {
+  const cached = history.rows === 2 ? [shared.id, solo.id] : [shared.id]
+  const refetchStarts = history.staleTime === 0
+  const refetched = !refetchStarts
+    ? cached
+    : history.refetch === `empty`
+      ? []
+      : // Both a same-rows result and a failed refetch leave the rows owned.
+        cached
+  const union = (...results: Array<Array<string>>) =>
+    [...new Set(results.flat())].sort()
+  const peerRows = history.peers > 0 ? [shared.id] : []
+  return {
+    held: union([`blocker`], cached, peerRows),
+    published: union(
+      history.settles === `while-held` ? refetched : cached,
+      peerRows,
+    ),
+    settled: union(refetched, peerRows),
+    peerReleased: union(refetched),
+    released: [],
+    queryCalls: 1 + history.peers + (refetchStarts ? 1 : 0),
+  }
 }
 
-function rows(collection: {
-  keys: () => Iterable<string | number>
-}): Array<string> {
-  return Array.from(collection.keys()).map(String).sort()
-}
+/**
+ * The grammar crosses the refetch's start, outcome, and placement relative to
+ * the older release's publication. A fresh reacquisition starts no refetch,
+ * so it has one history. The `empty` histories reject a design that keeps the
+ * row for any reacquired demand. The `rejects` and `same-rows` histories
+ * that settle after publication reject a design that skips the cached
+ * result because the older lease left an ownership entry behind. Removing
+ * the already-applied guard altogether also passes this table; the
+ * persisted direct-write histories that keep an accepted write through a
+ * refetch start reject that repair. A repair that treats every empty
+ * ownership entry as unapplied also passes this table; the sibling history
+ * that keeps a direct insert through a refetch start of an empty result
+ * rejects it. Each history runs with zero, one, or two peers and with a
+ * one- or two-row result. With a peer, the older release keeps `shared`,
+ * so only the `peerReleased` checkpoint shows whether the reacquired lease
+ * owns it. On the original defect `shared` survives while a peer owns it
+ * and disappears when the peers leave, while `solo` disappears at
+ * publication. Two peers check that releasing every other owner, not just
+ * one, leaves the reacquired lease as the row's owner.
+ */
+const reacquisitionHistories: Array<ReacquisitionHistory> = (
+  [0, 1, 2] as const
+).flatMap((peers) =>
+  ([1, 2] as const).flatMap((resultRows) => [
+    {
+      staleTime: Number.POSITIVE_INFINITY,
+      refetch: `rejects` as const,
+      settles: `after-publication` as const,
+      peers,
+      rows: resultRows,
+    },
+    ...([`rejects`, `same-rows`, `empty`] as const).flatMap((refetch) =>
+      ([`while-held`, `after-publication`] as const).map((settles) => ({
+        staleTime: 0,
+        refetch,
+        settles,
+        peers,
+        rows: resultRows,
+      })),
+    ),
+  ]),
+)
 
-function itemIds(items: Iterable<Item>): Array<string> {
-  return Array.from(items, ({ id }) => id).sort()
+/**
+ * ## Published owners never name a released observer lease
+ *
+ * Law: each publication records, for each row, the observer leases that own
+ * it. A released lease is not an owner, even while its release waits behind
+ * held publication. A later lease that claims the row during that wait
+ * must not copy the released lease back into the row's owners from metadata
+ * that has not yet published the release. A hydrated client trusts those
+ * owners: a row stays public there while any recorded owner may still need
+ * it, so a stale owner keeps the row alive after its last real owner is
+ * released.
+ *
+ * Authority: the file's opening law (a row remains public while any committed
+ * owner needs it), and the hydration history above, which releases a
+ * hydrated demand and expects its rows to leave. The reacquisition table
+ * above changes how a released lease's ownership entry is read; this table
+ * keeps a repair from simply deleting that entry at release.
+ *
+ * Limits: one row, one released lease `a`, one claiming lease `b`, and an
+ * optional peer lease `c` that is never released. `a` may be reacquired
+ * without cached data before `b` claims the row; its fetch then fails, so
+ * the reacquired lease never applies a result. Hydration uses the public
+ * `DbClient.dehydrate` and `hydrate` paths with a fresh QueryClient. Native
+ * persistence and cold persisted scans are owned by the persisted histories.
+ */
+type PublishedOwnerHistory = {
+  /** `b` claims the row while `a`'s release is held, or after it publishes. */
+  claims: `while-held` | `after-publication`
+  /** Whether peer `c` also owns the row and stays acquired. */
+  peer: boolean
+  /** Whether `a` is reacquired without cached data and its fetch fails. */
+  reacquired: boolean
 }
 
-function expectMutationLifecycleSnapshot(
-  snapshot: MutationLifecycleSnapshot,
-  authoritative: ReadonlyArray<string>,
-  visible: ReadonlyArray<string>,
-  ordered: boolean,
-): void {
-  expect(snapshot).toEqual({
-    server: [...authoritative].sort(),
-    cache: [...authoritative].sort(),
-    synced: [...authoritative].sort(),
-    source: [...visible].sort(),
-    derived: ordered ? [...visible] : [...visible].sort(),
-  })
+type PublishedOwnerObservation = {
+  /** Owner edges for the row in the dehydrated state. Keys are opaque. */
+  dehydratedOwners: number
+  /** Public rows in the hydrated client after it acquires `b`. */
+  hydratedLoaded: Array<string>
+  /** Public rows in the hydrated client after it releases `b`. */
+  hydratedReleased: Array<string>
 }
 
-function expectMutationPublicationIntegrity(
-  publications: ReadonlyArray<MutationPublicationSnapshot>,
-): void {
-  for (const publication of publications) {
-    expect(publication).toEqual({
-      source: publication.expected,
-      derived: publication.expected,
-      expected: publication.expected,
-    })
+/**
+ * The model records the set of active leases whose result holds the row. A
+ * release removes its lease at once, regardless of publication. Hydration
+ * copies that set; after the hydrated client releases `b`, the row stays
+ * exactly when another recorded owner remains. Publication timing is absent
+ * from the model, because the law says it cannot change the owner set.
+ */
+const modelPublishedOwners = (
+  history: PublishedOwnerHistory,
+): PublishedOwnerObservation => {
+  const activeOwners = new Set([`a`, ...(history.peer ? [`c`] : [])])
+  activeOwners.delete(`a`)
+  activeOwners.add(`b`)
+  const afterHydratedRelease = new Set(activeOwners)
+  afterHydratedRelease.delete(`b`)
+  return {
+    dehydratedOwners: activeOwners.size,
+    hydratedLoaded: [shared.id],
+    hydratedReleased: afterHydratedRelease.size > 0 ? [shared.id] : [],
   }
 }
 
-function persistedOwners(
-  metadata: ReadonlyMap<string | number, unknown>,
-  rowId: string,
-): Array<string> {
-  const rowMetadata = metadata.get(rowId)
-  if (!rowMetadata || typeof rowMetadata !== `object`) return []
-  const queryCollection = (rowMetadata as Record<string, unknown>)
-    .queryCollection
-  if (!queryCollection || typeof queryCollection !== `object`) return []
-  const owners = (queryCollection as Record<string, unknown>).owners
-  return owners && typeof owners === `object` ? Object.keys(owners).sort() : []
-}
-
-type StoredOwnership = {
-  rows: Map<string | number, Item>
-  rowMetadata: Map<string | number, unknown>
-  collectionMetadata: Map<string, unknown>
-}
+/**
+ * `while-held` reaches the premise: `b`'s sync transaction reads row
+ * metadata that still names `a`. `after-publication` is the nearby boundary
+ * where the release has published first. The peer histories require `c` to
+ * remain an owner, so a repair that drops every metadata owner at release,
+ * or one that ignores recorded owners on hydration, fails them. A repair that
+ * deletes the released lease's ownership entry at release instead of keeping
+ * it until publication fails the `while-held` histories. Without a peer, it
+ * fails at both the owner count and the leaked hydrated row; with a peer,
+ * `c` keeps the row public, so only the owner count distinguishes it.
+ *
+ * The `reacquired` histories reject a repair that deletes the released
+ * entry when the Query is reacquired. The reacquired lease has no result
+ * yet, so `b` reads metadata naming `a` while `a` looks unresolved and
+ * copies it back. A later result for `a` would correct the edge, so `a`'s
+ * fetch fails and it never applies one. The model is unchanged: a lease
+ * without a successful result owns nothing.
+ */
+const publishedOwnerHistories: Array<PublishedOwnerHistory> = (
+  [`while-held`, `after-publication`] as const
+).flatMap((claims) =>
+  [false, true].flatMap((peer) =>
+    [false, true].map((reacquired) => ({ claims, peer, reacquired })),
+  ),
+)
 
-function categorySubset(category: `detail` | `list`): LoadSubsetOptions {
-  return {
-    where: new IR.Func(`in`, [
-      new IR.PropRef([`category`]),
-      new IR.Value([`shared`, category]),
-    ]),
+/**
+ * An empty persisted baseline is established by its first scan in a sync
+ * run. With no durable writer or cache rotation, later retained Query
+ * reacquisitions have no row ownership to reconcile and need no further
+ * full-store scan.
+ * A new sync run has no such evidence: a durable owner may have appeared
+ * while this Collection was absent. This is a bounded work proposal beside
+ * the existing row-ownership law, not a claim about arbitrary peer writes.
+ *
+ * The independent model retains only whether the current sync run scanned
+ * its empty baseline. `restart` removes that evidence. The fixed histories
+ * distinguish retained reacquisition from a cold run. They drive the real
+ * Query observer and persistence scan seam. They compare scan counts and
+ * public rows after each applied result.
+ */
+const expectedEmptyBaselineScans = (
+  history: ReadonlyArray<`empty-result` | `restart`>,
+): number => {
+  let scans = 0
+  let emptyBaselineKnown = false
+  for (const action of history) {
+    if (action === `restart`) {
+      emptyBaselineKnown = false
+    } else if (!emptyBaselineKnown) {
+      scans++
+      emptyBaselineKnown = true
+    }
   }
+  return scans
 }
 
-function selectOwnershipRows(
-  items: Iterable<Item>,
-  options: LoadSubsetOptions,
-): Array<Item> {
-  if (
-    options.orderBy !== undefined ||
-    options.limit !== undefined ||
-    options.offset !== undefined ||
-    options.cursor !== undefined
-  ) {
-    throw new Error(`Ownership fixture does not support ordering or windows`)
+/**
+ * Law: a direct row keeps its public value and persisted owners through every
+ * legal delete, reinsert, refetch, and subset release, as the lifetime reference
+ * in the test below states. One call runs one history of that grammar.
+ */
+async function runDirectRowLifetimeHistory({
+  ownerCount,
+  withMetadata,
+  history,
+}: {
+  ownerCount: 1 | 2
+  withMetadata: boolean
+  history:
+    | `update`
+    | `delete`
+    | `delete-insert`
+    | `delete-upsert`
+    | `delete-insert-refetch`
+}): Promise<void> {
+  const id = `direct-row-lifetime-${ownerCount}-${withMetadata}-${history}`
+  const replacement = { ...shared, name: `Reinserted` }
+  const serverReplacement = { ...shared, name: `Server result` }
+  const initialResults = Array.from({ length: ownerCount }, () => [shared])
+  const laterResults = Array.from({ length: ownerCount }, () => [
+    serverReplacement,
+  ])
+  const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
+  const { collection, queryFn } = createOwnershipFixture({
+    id,
+    results: [...initialResults, ...laterResults],
+    metadataRecorder: withMetadata ? metadata : undefined,
+  })
+  const demands = [categorySubset(`detail`), categorySubset(`list`)].slice(
+    0,
+    ownerCount,
+  )
+  const demandHashes = demands.map((demand) =>
+    hashKey([id, getLoadSubsetDemandKey(demand)]),
+  )
+  const claims = new Set<number>()
+  let expected: Item | undefined
+  let insertedDirectly = false
+  const observe = () => {
+    expect(collection.get(shared.id)?.name).toBe(expected?.name)
+    expect(rows(collection)).toEqual(expected ? [shared.id] : [])
+    if (withMetadata)
+      expect(
+        persistedOwners(collection._state.syncedMetadata, shared.id),
+      ).toEqual([...claims].map((index) => demandHashes[index]!).sort())
   }
-  const { where } = options
-  if (!where) return Array.from(items, (item) => structuredClone(item))
-  if (
-    where.type !== `func` ||
-    where.name !== `in` ||
-    where.args.length !== 2 ||
-    where.args[0]?.type !== `ref` ||
-    where.args[0].path.length !== 1 ||
-    where.args[0].path[0] !== `category` ||
-    where.args[1]?.type !== `val` ||
-    !Array.isArray(where.args[1].value) ||
-    !where.args[1].value.every((value: unknown) => typeof value === `string`)
-  ) {
-    throw new Error(`Ownership fixture supports only category membership`)
+  for (const [index, demand] of demands.entries()) {
+    await collection._sync.loadSubset(demand)
+    claims.add(index)
+    expected = shared
+    insertedDirectly = false
+    observe()
   }
-  const categories = new Set<string>(where.args[1].value)
-  return Array.from(items)
-    .filter((item) => categories.has(item.category))
-    .map((item) => structuredClone(item))
-}
-
-function createOwnershipStorage(seed?: StoredOwnership, gatedCommit?: number) {
-  const state: StoredOwnership = structuredClone(
-    seed ?? {
-      rows: new Map(),
-      rowMetadata: new Map(),
-      collectionMetadata: new Map(),
-    },
-  )
-  const entered = createDeferred<void>()
-  const released = createDeferred<void>()
-  let commitCount = 0
-  let latestTerm = 0
-  let latestSeq = 0
-  let latestRowVersion = 0
-  const adapter: PersistenceAdapter = {
-    loadSubset: (_id, options) =>
-      Promise.resolve(
-        selectOwnershipRows(state.rows.values(), options).map((value) => ({
-          key: value.id,
-          value,
-          metadata: structuredClone(state.rowMetadata.get(value.id)),
-        })),
-      ),
-    loadResumeSnapshot: (_id, options) =>
-      Promise.resolve({
-        rows:
-          options?.includeRows === false
-            ? []
-            : Array.from(state.rows, ([key, value]) => ({
-                key,
-                value: structuredClone(value),
-                metadata: structuredClone(state.rowMetadata.get(key)),
-              })),
-        keySet: { status: `consistent` },
-        collectionMetadata: Array.from(
-          state.collectionMetadata,
-          ([key, value]) => ({ key, value: structuredClone(value) }),
-        ),
-        latestTerm,
-        latestSeq,
-        latestRowVersion,
-        resetEpoch: 0,
-      }),
-    loadCollectionMetadata: () =>
-      Promise.resolve(
-        Array.from(state.collectionMetadata, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-        })),
-      ),
-    scanRows: () =>
-      Promise.resolve(
-        Array.from(state.rows, ([key, value]) => ({
-          key,
-          value: structuredClone(value),
-          metadata: structuredClone(state.rowMetadata.get(key)),
-        })),
-      ),
-    ensureIndex: () => Promise.resolve(),
-    applyCommittedTx: async (_id, transaction) => {
-      const tx = structuredClone(transaction)
-      commitCount++
-      if (commitCount === gatedCommit) {
-        entered.resolve()
-        await released.promise
-      }
-      if (tx.truncate) {
-        state.rows.clear()
-        state.rowMetadata.clear()
-      }
-      for (const mutation of tx.mutations) {
-        if (mutation.type === `delete`) {
-          state.rows.delete(mutation.key)
-          state.rowMetadata.delete(mutation.key)
-        } else {
-          const { id, category, name } = mutation.value
-          if (
-            typeof id !== `string` ||
-            typeof category !== `string` ||
-            typeof name !== `string`
-          ) {
-            throw new Error(`Ownership fixture received an invalid row`)
-          }
-          state.rows.set(mutation.key, { id, category, name })
-          if (mutation.metadataChanged) {
-            state.rowMetadata.set(
-              mutation.key,
-              structuredClone(mutation.metadata),
-            )
-          }
-        }
-      }
-      for (const mutation of tx.rowMetadataMutations ?? []) {
-        if (mutation.type === `delete`) state.rowMetadata.delete(mutation.key)
-        else
-          state.rowMetadata.set(mutation.key, structuredClone(mutation.value))
-      }
-      for (const mutation of tx.collectionMetadataMutations ?? []) {
-        if (mutation.type === `delete`)
-          state.collectionMetadata.delete(mutation.key)
-        else
-          state.collectionMetadata.set(
-            mutation.key,
-            structuredClone(mutation.value),
-          )
-      }
-      latestTerm = tx.term
-      latestSeq = tx.seq
-      latestRowVersion = tx.rowVersion
-    },
+  if (history === `update`) {
+    await collection.utils.writeUpdate({ id: shared.id, name: `Updated` })
+    expected = { ...shared, name: `Updated` }
+    observe()
+  } else {
+    await collection.utils.writeDelete(shared.id)
+    expected = undefined
+    claims.clear()
+    insertedDirectly = false
+    observe()
+    if (history !== `delete`) {
+      if (history === `delete-upsert`)
+        await collection.utils.writeUpsert(replacement)
+      else await collection.utils.writeInsert(replacement)
+      expected = replacement
+      insertedDirectly = true
+      observe()
+    }
   }
-  return {
-    adapter,
-    entered: entered.promise,
-    release: () => released.resolve(),
-    snapshot: (): StoredOwnership => structuredClone(state),
+  if (history === `delete-insert-refetch`) {
+    await collection.utils.refetch()
+    demands.forEach((_, index) => claims.add(index))
+    expected = serverReplacement
+    insertedDirectly = false
+    observe()
+  }
+  for (const [index, demand] of demands.entries()) {
+    collection._sync.unloadSubset(demand)
+    claims.delete(index)
+    if (claims.size === 0 && !insertedDirectly) expected = undefined
+    observe()
   }
+  expect(queryFn).toHaveBeenCalledTimes(
+    ownerCount * (history === `delete-insert-refetch` ? 2 : 1),
+  )
 }
 
-function createPersistedOwnershipFixture(
-  id: string,
-  storage: ReturnType<typeof createOwnershipStorage>,
-  serverRows: Array<Item>,
-  syncMode: `eager` | `on-demand` = `on-demand`,
-) {
+/**
+ * Law: a direct write and a physical fetch are ordered by authored position; the
+ * later of the two supplies the shared key. One call runs one order history of
+ * the grammar below against the reference it builds.
+ */
+async function runDirectWriteOrderHistory({
+  order,
+  laterWrite,
+  cacheEdit,
+  finalRefetch,
+}: {
+  order: `write-first` | `fetch-first`
+  laterWrite: `none` | `same-key` | `other-key`
+  cacheEdit: boolean
+  finalRefetch: boolean
+}): Promise<void> {
+  type Row = { id: string; name: string }
   const queryClient = createQueryClient()
-  const providerRows = structuredClone(serverRows)
-  const queryFn = vi.fn((context: QueryFunctionContext) =>
-    Promise.resolve(
-      selectOwnershipRows(providerRows, context.meta?.loadSubsetOptions ?? {}),
-    ),
+  const queryKey = [`shared-post-write-cached-before-acquisition`]
+  let requestNumber = 0
+  const queryFn = vi.fn(() =>
+    Promise.resolve([
+      {
+        id: `x`,
+        name: ++requestNumber === 1 ? `Server 1` : `Server 2`,
+      },
+    ]),
   )
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
+  const makeCollection = (id: string) =>
+    createCollection(
+      queryCollectionOptions<Row>({
         id,
         queryClient,
-        queryKey: [id],
+        queryKey,
         queryFn,
-        getKey: (item) => item.id,
-        syncMode,
-        persistedGcTime: Number.POSITIVE_INFINITY,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        staleTime: Infinity,
         startSync: true,
       }),
-      persistence: { adapter: storage.adapter },
-    }),
-  )
+    )
+  const a = makeCollection(`cached-newer-a`)
+  const b = makeCollection(`cached-newer-b`)
   cleanups.push(async () => {
-    storage.release()
-    try {
-      await collection.cleanup()
-    } finally {
-      queryClient.clear()
-    }
+    await Promise.all([a.cleanup(), b.cleanup()])
+    queryClient.clear()
   })
-  return { collection, queryClient, queryFn }
+  const reference: {
+    position: number
+    directX?: { value: string; position: number }
+    remoteX?: { value: string; position: number }
+    cacheStillFetched: boolean
+  } = { position: 0, cacheStillFetched: false }
+  const writeX = async (name: string) => {
+    reference.directX = { value: name, position: ++reference.position }
+    if (a.has(`x`)) await a.utils.writeUpdate({ id: `x`, name })
+    else await a.utils.writeInsert({ id: `x`, name })
+  }
+  const fetchB = async (first: boolean) => {
+    const started = ++reference.position
+    if (first) await b._sync.loadSubset({})
+    else await b.utils.refetch({ throwOnError: true })
+    reference.remoteX = {
+      value: first ? `Server 1` : `Server 2`,
+      position: started,
+    }
+    reference.cacheStillFetched = true
+  }
+  if (order === `write-first`) await writeX(`Written`)
+  await fetchB(true)
+  if (order === `fetch-first`) await writeX(`Written`)
+  if (laterWrite === `same-key`) await writeX(`Later write`)
+  if (laterWrite === `other-key`) {
+    reference.position++
+    await a.utils.writeInsert({ id: `y`, name: `Other write` })
+  }
+  if (cacheEdit) {
+    queryClient.setQueryData(queryKey, [{ id: `x`, name: `Local cache edit` }])
+    reference.cacheStillFetched = false
+  }
+  if (finalRefetch) await fetchB(false)
+  const callsBeforeAcquisition = queryFn.mock.calls.length
+  await a._sync.loadSubset({})
+  const revalidatedCacheEdit = cacheEdit && !finalRefetch
+  expect(queryFn).toHaveBeenCalledTimes(
+    callsBeforeAcquisition + Number(revalidatedCacheEdit),
+  )
+  if (revalidatedCacheEdit) {
+    reference.remoteX = {
+      value: `Server 2`,
+      position: ++reference.position,
+    }
+    reference.cacheStillFetched = true
+  }
+  const { directX, remoteX, cacheStillFetched } = reference
+  if (!directX || !remoteX) throw new Error(`Illegal authority history`)
+  const remoteMayReplace =
+    cacheStillFetched && remoteX.position > directX.position
+  expect(a.get(`x`)?.name).toBe(
+    remoteMayReplace ? remoteX.value : directX.value,
+  )
+  // The complete unbounded response omits y, so it retires that
+  // ownerless direct row; without such a response the row survives.
+  expect(a.get(`y`)?.name).toBe(
+    laterWrite === `other-key` && !finalRefetch && !revalidatedCacheEdit
+      ? `Other write`
+      : undefined,
+  )
+  a._sync.unloadSubset({})
+  expect(a.get(`x`)?.name).toBe(remoteMayReplace ? undefined : directX.value)
 }
 
-function storedItems(
-  storage: ReturnType<typeof createOwnershipStorage>,
-): Array<Item> {
-  return [...storage.snapshot().rows.values()].sort((a, b) =>
-    a.id.localeCompare(b.id),
+/**
+ * Law: a physical fetch takes its position when it starts, so the newest started
+ * fetch supplies a shared row, and releasing a newer owner does not revert it. One
+ * call runs one history of the grammar below and compares public values.
+ */
+async function runOverlappingSubsetHistory({
+  existingOwner,
+  settleNewerFirst,
+  directWrite,
+  sameValue,
+}: {
+  existingOwner: boolean
+  settleNewerFirst: boolean
+  directWrite: `none` | `between` | `after`
+  sameValue: boolean
+}): Promise<void> {
+  const id = `overlapping-fetch-value-${existingOwner}-${settleNewerFirst}-${directWrite}-${sameValue}`
+  const older = createDeferred<Array<Item>>()
+  const newer = createDeferred<Array<Item>>()
+  const initial = { ...shared, name: `Initial` }
+  const olderRow = { ...shared, name: `Older` }
+  const newerRow = { ...shared, name: sameValue ? `Initial` : `Newer` }
+  const manual = { ...shared, name: `Manual` }
+  const { collection, queryClient, queryFn } = createOwnershipFixture({
+    id,
+    results: existingOwner
+      ? [[initial], older.promise, newer.promise]
+      : [older.promise, newer.promise],
+  })
+  cleanups.push(async () => {
+    older.resolve([olderRow])
+    newer.resolve([newerRow])
+  })
+  const olderSubset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+  const newerSubset = { where: eq(new IR.PropRef([`id`]), `shared`) }
+  expect(getLoadSubsetDemandKey(olderSubset)).not.toBe(
+    getLoadSubsetDemandKey(newerSubset),
   )
-}
+  // The provider's authored rows must be legal for their real scopes.
+  // This checks fixture admission only; the reference below still judges
+  // public values independently of the production expression compiler.
+  expect(
+    toBooleanPredicate(compileSingleRowExpression(olderSubset.where)(initial)),
+  ).toBe(true)
+  expect(
+    toBooleanPredicate(compileSingleRowExpression(olderSubset.where)(olderRow)),
+  ).toBe(true)
+  expect(
+    toBooleanPredicate(compileSingleRowExpression(newerSubset.where)(newerRow)),
+  ).toBe(true)
+
+  // Model: each accepted operation may replace the value only when its
+  // position exceeds the position of the accepted value already held.
+  // Claiming a subset and replacing a value are separate operations.
+  const reference: {
+    position: number
+    acceptedAt: number
+    value: string | undefined
+    owners: Set<`older` | `newer`>
+  } = {
+    position: 0,
+    acceptedAt: 0,
+    value: undefined,
+    owners: new Set(),
+  }
+  const start = () => ++reference.position
+  const acceptFetch = (
+    owner: `older` | `newer`,
+    started: number,
+    value: string,
+  ) => {
+    reference.owners.add(owner)
+    if (started > reference.acceptedAt) {
+      reference.value = value
+      reference.acceptedAt = started
+    }
+  }
+  const acceptWrite = () => {
+    reference.value = manual.name
+    reference.acceptedAt = ++reference.position
+  }
+  const expectPublicRow = () => {
+    expect(collection.get(shared.id)?.name).toBe(
+      reference.owners.size > 0 ? reference.value : undefined,
+    )
+    expect(collection.has(shared.id)).toBe(reference.owners.size > 0)
+  }
 
-// The direct-write receipt follows the applied commit, regardless of whether
-// the Query Collection already exposes the new row in memory.
-function expectedDirectWriteReceipt(applied: boolean) {
-  return {
-    receipt: applied ? `fulfilled` : `pending`,
-    storedName: applied ? `Updated` : shared.name,
+  if (existingOwner) {
+    const initialStart = start()
+    await collection._sync.loadSubset(olderSubset)
+    acceptFetch(`older`, initialStart, initial.name)
+    expectPublicRow()
   }
-}
+  const olderStart = start()
+  const olderLoad = collection._sync.loadSubset(
+    existingOwner ? { ...olderSubset, refetch: true } : olderSubset,
+  )
+  void Promise.resolve(olderLoad).catch(() => undefined)
+  await vi.waitFor(() =>
+    expect(queryFn).toHaveBeenCalledTimes(existingOwner ? 2 : 1),
+  )
 
-// A direct write can apply only in the current sync run. Cleanup start closes
-// that admission; restart creates a new current run.
-function expectedDirectWriteAdmission(syncRun: `current` | `invalidated`) {
-  return syncRun === `current` ? `fulfilled` : `rejected`
-}
+  if (directWrite === `between`) {
+    await collection.utils.writeUpdate(manual)
+    acceptWrite()
+    expectPublicRow()
+  }
+  const newerStart = start()
+  const newerLoad = collection._sync.loadSubset(newerSubset)
+  void Promise.resolve(newerLoad).catch(() => undefined)
+  await vi.waitFor(() =>
+    expect(queryFn).toHaveBeenCalledTimes(existingOwner ? 3 : 2),
+  )
+  expect(queryClient.getQueryCache().findAll({ queryKey: [id] })).toHaveLength(
+    2,
+  )
+  if (directWrite === `after`) {
+    await collection.utils.writeUpdate(manual)
+    acceptWrite()
+    expectPublicRow()
+  }
 
-type ColdOwnershipObservation = { stored: Array<Item>; visible: Array<Item> }
+  const settle = async (owner: `older` | `newer`) => {
+    if (owner === `older`) {
+      older.resolve([olderRow])
+      await olderLoad
+      acceptFetch(owner, olderStart, olderRow.name)
+    } else {
+      newer.resolve([newerRow])
+      await newerLoad
+      acceptFetch(owner, newerStart, newerRow.name)
+    }
+    expectPublicRow()
+  }
+  if (settleNewerFirst) {
+    await settle(`newer`)
+    await settle(`older`)
+  } else {
+    await settle(`older`)
+    await settle(`newer`)
+  }
 
-async function observeColdOwnerRevalidation(
-  dropMetadata = false,
-): Promise<Array<ColdOwnershipObservation>> {
-  const hotStorage = createOwnershipStorage(undefined, 1)
-  const hot = createPersistedOwnershipFixture(
-    `cold-owner-revalidation`,
-    hotStorage,
-    [shared, detailOnly, listOnly],
-  )
-  const detail = categorySubset(`detail`)
-  const list = categorySubset(`list`)
-  const firstLoad = Promise.resolve(hot.collection._sync.loadSubset(detail))
-  // Observe rejection before any gate assertion can abort the test.
-  void firstLoad.catch(() => undefined)
-  try {
-    await hotStorage.entered
-    expect(hotStorage.snapshot().rows.size).toBe(0)
-    expect(hotStorage.snapshot().rowMetadata.size).toBe(0)
-    hotStorage.release()
-    await firstLoad
-    await hot.collection._sync.loadSubset(list)
-    await vi.waitFor(() =>
-      expect(storedItems(hotStorage)).toEqual([detailOnly, listOnly, shared]),
-    )
-    hot.collection._sync.unloadSubset(detail)
-    hot.collection._sync.unloadSubset(list)
-    // Both retention markers must commit before making a separate cold store.
-    // Their private hash encoding is not the expected ownership authority.
-    await vi.waitFor(() =>
-      expect(hotStorage.snapshot().collectionMetadata.size).toBe(2),
-    )
-    const coldSeed = hotStorage.snapshot()
-    if (dropMetadata) coldSeed.rowMetadata.clear()
-    const coldStorage = createOwnershipStorage(coldSeed)
-    const cold = createPersistedOwnershipFixture(
-      `cold-owner-revalidation`,
-      coldStorage,
-      [],
-    )
-    expect(cold.queryFn).not.toHaveBeenCalled()
-    const capture = (): ColdOwnershipObservation => ({
-      stored: storedItems(coldStorage),
-      visible: cold.collection.toArray
-        .map(({ id, category, name }) => ({ id, category, name }))
-        .sort((a, b) => a.id.localeCompare(b.id)),
-    })
-    const observations = [capture()]
-    await cold.collection._sync.loadSubset(detail)
-    await vi.waitFor(() =>
-      expect(coldStorage.snapshot().collectionMetadata.size).toBe(1),
-    )
-    observations.push(capture())
-    await cold.collection._sync.loadSubset(list)
-    await vi.waitFor(() =>
-      expect(coldStorage.snapshot().collectionMetadata.size).toBe(0),
-    )
-    observations.push(capture())
-    expect(cold.queryFn).toHaveBeenCalledTimes(2)
-    return observations
-  } finally {
-    hotStorage.release()
+  const release = (owner: `older` | `newer`) => {
+    const subset = owner === `older` ? olderSubset : newerSubset
+    collection._sync.unloadSubset(subset)
+    if (owner === `older` && existingOwner)
+      collection._sync.unloadSubset(subset)
+    reference.owners.delete(owner)
+    expectPublicRow()
+  }
+  if (existingOwner) {
+    release(`older`)
+    release(`newer`)
+  } else {
+    release(`newer`)
+    release(`older`)
+  }
+
+  // Reacquisition starts a new row-ownership lifetime. Only the acquired
+  // Query's retained cache is projected; an earlier overlap does not
+  // permanently rewrite a different Query entry. This legal neighbor
+  // distinguishes continuous-owner precedence from global precedence.
+  if (!existingOwner && settleNewerFirst && directWrite === `none`) {
+    reference.owners.add(`older`)
+    reference.value = olderRow.name
+    await collection._sync.loadSubset(olderSubset)
+    expectPublicRow()
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    collection._sync.unloadSubset(olderSubset)
+    reference.owners.delete(`older`)
+    expectPublicRow()
+
+    reference.owners.add(`newer`)
+    reference.value = newerRow.name
+    await collection._sync.loadSubset(newerSubset)
+    expectPublicRow()
+    expect(queryFn).toHaveBeenCalledTimes(2)
   }
 }
 
-function expectColdOwnerRevalidation(
-  observations: Array<ColdOwnershipObservation>,
-): void {
-  expect(observations).toEqual([
-    { stored: [detailOnly, listOnly, shared], visible: [] },
-    { stored: [listOnly, shared], visible: [shared] },
-    { stored: [], visible: [] },
-  ])
+/**
+ * Law: a fetch that started before a direct write keeps the server's rows for
+ * every key that write did not touch; a write recorded after the fetch began
+ * wins for its key. This reference overlays the writes on the fetched rows in
+ * order. It is the expected visible rows of the merge-cut histories below.
+ */
+type MergeRow = { id: string; value: string }
+function mergeDirectWritesOverFetch(
+  fetched: Array<MergeRow>,
+  writes: Array<MergeRow>,
+): Record<string, string> {
+  const rows = new Map(fetched.map((row) => [row.id, row]))
+  for (const row of writes) rows.set(row.id, row)
+  return Object.fromEntries(
+    [...rows.values()].map((row) => [row.id, row.value]),
+  )
 }
 
+declareOracle({
+  check: [
+    expectPublicRefetchObservation,
+    runDirectRowLifetimeHistory,
+    runDirectWriteOrderHistory,
+    runOverlappingSubsetHistory,
+  ],
+  model: [
+    advanceResultSettlementModel,
+    reduceExplicitRefetchApplication,
+    reduceRefetchCallSettlement,
+    reduceHandlerRefetchBoundary,
+    reduceMutationRefreshLiveness,
+    observeHandlerRefetchBoundary,
+    observeQueryCacheWork,
+    observeFetchRecordSuccessorWork,
+    modelReacquisition,
+    modelPublishedOwners,
+    expectedEmptyBaselineScans,
+    mergeDirectWritesOverFetch,
+  ],
+  grammar: [mutationRefreshHistoryGrammar, handlerCollectionHistoryGrammar],
+})
+
 describe(`query collection ownership lifecycle`, () => {
   afterEach(async () => {
     await runCleanups()
@@ -4065,58 +4169,14 @@ describe(`query collection ownership lifecycle`, () => {
     expect(collection.get(shared.id)?.name).toBe(replacement.name)
   })
 
-  it(`starts the deferred replacement when the barrier resolves during a fetch`, async () => {
-    const id = `deferred-result-in-flight`
+  it(`cancels a deferred public refetch when cleanup retires it`, async () => {
+    const id = `deferred-result-cleanup`
     const barrier = createDeferred<void>()
-    const inFlight = createDeferred<Array<Item>>()
-    const initial = { ...shared, name: `Initial` }
-    const replacement = { ...shared, name: `Replacement` }
     const queryClient = createQueryClient()
     const queryFn = vi
       .fn<() => Promise<Array<Item>>>()
-      .mockResolvedValueOnce([initial])
-      .mockImplementationOnce(() => inFlight.promise)
-      .mockResolvedValue([replacement])
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      collection.deferDataRefresh = null
-      barrier.resolve()
-      inFlight.resolve([initial])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.stateWhenReady()
-    collection.deferDataRefresh = barrier.promise
-    void collection.utils.refetch().catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-
-    collection.deferDataRefresh = null
-    barrier.resolve()
-
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    await vi.waitFor(() => {
-      expect(collection.get(shared.id)?.name).toBe(replacement.name)
-    })
-  })
-
-  it(`cancels a deferred public refetch when cleanup retires it`, async () => {
-    const id = `deferred-result-cleanup`
-    const barrier = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi
-      .fn<() => Promise<Array<Item>>>()
-      .mockResolvedValueOnce([shared])
-      .mockResolvedValueOnce([{ ...shared, name: `Skipped` }])
+      .mockResolvedValueOnce([shared])
+      .mockResolvedValueOnce([{ ...shared, name: `Skipped` }])
     const collection = createCollection(
       queryCollectionOptions<Item>({
         id,
@@ -4306,434 +4366,6 @@ describe(`query collection ownership lifecycle`, () => {
     expect(collection.get(shared.id)?.name).toBe(recovered.name)
   })
 
-  /**
-   * Error recovery law: a previous Query failure remains public while an
-   * explicit retry is pending. A failed retry is another consecutive failure;
-   * a successful retry clears the error. This follows the documented
-   * `lastError`/`errorCount` reset-on-success contract. The model represents
-   * only these three public error fields, not Collection status or row changes.
-   *
-   * The bounded history crosses a failed initial load, a failed background
-   * refetch, or a failed Collection application with a held retry. One retry
-   * holds Collection application after Query fetch success. A background
-   * failure crosses an intermediate Query retry attempt before a held final
-   * attempt. A repeated error at clock time zero distinguishes consecutive
-   * failures from duplicate observer notifications. The real QueryClient and
-   * `clearError()` are the driver.
-   * The refinement check reads the public utils
-   * when the retry starts but before its result settles, then after settlement.
-   *
-   * ORC-001: `query.ts` getter comments and the error-handling guide promise
-   * reset on success. ORC-002/003/005: the three-state public model below is
-   * separate from Query's timestamp and is checked at both named boundaries.
-   * ORC-004/007: this is a bounded fixed matrix, not a generated property.
-   * ORC-006: the original `clearError()` fails both initial pending cases;
-   * an observer-success reset fails the application-error and held-application
-   * cases; an unconditional error-result classifier recounts the old error
-   * during a Query retry attempt; a zero timestamp sentinel fails the
-   * epoch-zero repeated-error case.
-   * ORC-008:
-   * no model state is combined or removed. ORC-009: `retry pending` maps to
-   * a held Query result; no new production concept is named. ORC-010: cleanup
-   * settles the held result and retains primary assertion failures. ORC-011:
-   * no plausible shared semantic helper needs a second formulation here.
-   * The matrix does not cover concurrent retries for multiple tracked Queries,
-   * mutation-handler fetch-boundary settlement, or deferred result application.
-   */
-  it.each([
-    { priorFailure: `initial`, retryResult: `failure`, sameError: false },
-    { priorFailure: `initial`, retryResult: `success`, sameError: false },
-    { priorFailure: `background`, retryResult: `failure`, sameError: false },
-    { priorFailure: `background`, retryResult: `success`, sameError: false },
-    { priorFailure: `initial`, retryResult: `failure`, sameError: true },
-  ] as const)(
-    `keeps a $priorFailure error visible until a held retry $retryResult, same error $sameError`,
-    async ({ priorFailure, retryResult, sameError }) => {
-      const id = `held-error-retry-${priorFailure}-${retryResult}-${sameError}`
-      const previousError = new Error(`previous failure`)
-      const retryError = sameError ? previousError : new Error(`retry failure`)
-      const heldResult = createDeferred<Array<Item>>()
-      const queryClient = createQueryClient()
-      const now = sameError ? vi.spyOn(Date, `now`).mockReturnValue(0) : null
-      const queryFn = vi.fn<() => Promise<Array<Item>>>()
-      if (priorFailure === `background`) {
-        queryFn.mockResolvedValueOnce([shared])
-      }
-      queryFn.mockRejectedValueOnce(previousError)
-      queryFn.mockImplementationOnce(() => heldResult.promise)
-      const consoleError = vi
-        .spyOn(console, `error`)
-        .mockImplementation(() => {})
-      const collection = createCollection(
-        queryCollectionOptions<Item>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (item) => item.id,
-          syncMode: `eager`,
-          startSync: true,
-          retry: false,
-        }),
-      )
-      cleanups.push(async () => {
-        consoleError.mockRestore()
-        now?.mockRestore()
-        heldResult.resolve([])
-        await collection.cleanup()
-        queryClient.clear()
-      })
-
-      if (priorFailure === `initial`) {
-        await expect(collection.stateWhenReady()).rejects.toBe(previousError)
-      } else {
-        await collection.stateWhenReady()
-        await expect(
-          collection.utils.refetch({ throwOnError: true }),
-        ).rejects.toBe(previousError)
-      }
-
-      const observeError = () => reportedError(collection)
-      // An independent model. An initial error is final for its sync run, so
-      // every later state reports it. After readiness, a pending retry keeps
-      // the previous health error, a failed retry reports its own, and a
-      // successful retry clears it.
-      const expected =
-        priorFailure === `initial`
-          ? {
-              pending: previousError,
-              failure: previousError,
-              success: previousError,
-            }
-          : { pending: previousError, failure: retryError, success: undefined }
-      expect(observeError()).toEqual(expected.pending)
-
-      const retry = collection.utils.refetch({ throwOnError: true }).then(
-        () => ({ outcome: `fulfilled` as const }),
-        (error: unknown) => ({ outcome: `rejected` as const, error }),
-      )
-      await vi.waitFor(() =>
-        expect(queryFn).toHaveBeenCalledTimes(
-          priorFailure === `initial` ? 2 : 3,
-        ),
-      )
-      expect(observeError()).toEqual(expected.pending)
-
-      if (retryResult === `failure`) {
-        heldResult.reject(retryError)
-        expect(await retry).toEqual({ outcome: `rejected`, error: retryError })
-      } else {
-        heldResult.resolve([shared])
-        expect(await retry).toEqual({ outcome: `fulfilled` })
-      }
-      expect(observeError()).toEqual(expected[retryResult])
-    },
-  )
-
-  it.each([`success`, `failure`] as const)(
-    `retains an application error while a held retry reaches %s`,
-    async (retryResult) => {
-      const id = `held-application-error-retry-${retryResult}`
-      const applicationError = new Error(`application failed`)
-      const retryError = new Error(`retry failed`)
-      const heldResult = createDeferred<Array<Item>>()
-      const queryClient = createQueryClient()
-      const queryFn = vi
-        .fn<() => Promise<Array<Item>>>()
-        .mockResolvedValueOnce([shared])
-        .mockImplementationOnce(() => heldResult.promise)
-      let failApplication = true
-      const consoleError = vi
-        .spyOn(console, `error`)
-        .mockImplementation(() => {})
-      const collection = createCollection(
-        queryCollectionOptions<Item>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (item) => {
-            if (failApplication) {
-              failApplication = false
-              throw applicationError
-            }
-            return item.id
-          },
-          syncMode: `eager`,
-          startSync: true,
-          retry: false,
-        }),
-      )
-      cleanups.push(async () => {
-        heldResult.resolve([shared])
-        try {
-          await collection.cleanup()
-        } finally {
-          queryClient.clear()
-          consoleError.mockRestore()
-        }
-      })
-      let retry:
-        | Promise<
-            { outcome: `fulfilled` } | { outcome: `rejected`; error: unknown }
-          >
-        | undefined
-      try {
-        await expect(collection.stateWhenReady()).rejects.toBe(applicationError)
-        expect(reportedError(collection)).toBe(applicationError)
-
-        retry = collection.utils.refetch({ throwOnError: true }).then(
-          () => ({ outcome: `fulfilled` as const }),
-          (error: unknown) => ({ outcome: `rejected` as const, error }),
-        )
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-        // Query still holds its old successful result, despite the failed
-        // Collection application. A fetch-start success notification is not recovery.
-        expect(reportedError(collection)).toBe(applicationError)
-
-        if (retryResult === `failure`) {
-          heldResult.reject(retryError)
-          expect(await retry).toEqual({
-            outcome: `rejected`,
-            error: retryError,
-          })
-        } else {
-          heldResult.resolve([shared])
-          expect(await retry).toEqual({ outcome: `fulfilled` })
-        }
-        // The failed application was the initial load, so its error is final
-        // for this sync run whatever the retry does.
-        expect(reportedError(collection)).toBe(applicationError)
-        expect(collection.status).toBe(`error`)
-      } finally {
-        heldResult.resolve([shared])
-        await retry
-      }
-    },
-  )
-
-  it(`retains a Query error until a successful retry applies`, async () => {
-    const id = `held-retry-application`
-    const queryHash = hashKey([id])
-    const previousError = new Error(`previous fetch failed`)
-    const firstResult = createDeferred<Array<Item>>()
-    const persistedScan =
-      createDeferred<
-        Array<{ key: string | number; value: Item; metadata?: unknown }>
-      >()
-    const scanPersistedRows = vi.fn(() => persistedScan.promise)
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [firstResult.promise, [shared]],
-      syncMode: `on-demand`,
-      scanPersistedRows,
-      setupMetadata: (metadata) => {
-        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-          queryHash,
-          mode: `until-revalidated`,
-        })
-      },
-    })
-    cleanups.push(() => {
-      consoleError.mockRestore()
-      return Promise.resolve()
-    })
-
-    try {
-      const initialLoad = collection._sync.loadSubset({})
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
-      firstResult.reject(previousError)
-      await expect(
-        Promise.resolve(initialLoad === true ? undefined : initialLoad),
-      ).rejects.toBe(previousError)
-      expect(reportedError(collection)).toBe(previousError)
-      expect(reportedError(collection)).toBeDefined()
-
-      const retry = collection.utils.refetch({ throwOnError: true })
-      await vi.waitFor(() => {
-        expect(queryFn).toHaveBeenCalledTimes(2)
-        expect(scanPersistedRows).toHaveBeenCalledOnce()
-      })
-      // Query has fetched successfully, but Collection application is held.
-      expect(reportedError(collection)).toBe(previousError)
-      expect(reportedError(collection)).toBeDefined()
-
-      persistedScan.resolve([])
-      await retry
-      expect(reportedError(collection)).toBeUndefined()
-    } finally {
-      firstResult.resolve([])
-      persistedScan.resolve([])
-    }
-  })
-
-  /**
-   * A completed failure remains visible until a later successful result
-   * applies. The model counts terminal failures, including reuse of the same
-   * Error object in one clock tick. The persisted scan holds the older success
-   * between fetch completion and application; the public checkpoint is after
-   * that scan is released. This does not exercise native SQLite persistence.
-   */
-  it.each([`clearError`, `reused-error`] as const)(
-    `does not let an older held revalidation clear a newer Query error after %s`,
-    async (retryMode) => {
-      const id = `held-revalidation-newer-error`
-      const queryHash = hashKey([id])
-      const previousError = new Error(`initial fetch failed`)
-      const newerError =
-        retryMode === `reused-error`
-          ? previousError
-          : new Error(`later fetch failed`)
-      const dateNow =
-        retryMode === `reused-error`
-          ? vi.spyOn(Date, `now`).mockReturnValue(1_000)
-          : undefined
-      const firstResult = createDeferred<Array<Item>>()
-      const laterResult = createDeferred<Array<Item>>()
-      const persistedScan =
-        createDeferred<
-          Array<{ key: string | number; value: Item; metadata?: unknown }>
-        >()
-      const scanPersistedRows = vi.fn(() => persistedScan.promise)
-      const consoleError = vi
-        .spyOn(console, `error`)
-        .mockImplementation(() => {})
-      const { collection, queryFn } = createOwnershipFixture({
-        id,
-        results: [firstResult.promise, [shared], laterResult.promise],
-        syncMode: `on-demand`,
-        scanPersistedRows,
-        setupMetadata: (metadata) => {
-          metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-            queryHash,
-            mode: `until-revalidated`,
-          })
-        },
-      })
-      cleanups.push(() => {
-        consoleError.mockRestore()
-        dateNow?.mockRestore()
-        return Promise.resolve()
-      })
-
-      try {
-        const initialLoad = collection._sync.loadSubset({})
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
-        firstResult.reject(previousError)
-        await expect(
-          Promise.resolve(initialLoad === true ? undefined : initialLoad),
-        ).rejects.toBe(previousError)
-        expect(reportedError(collection)).toBe(previousError)
-
-        const firstRetry = (
-          retryMode === `clearError`
-            ? collection.utils.refetch({ throwOnError: true })
-            : collection.utils.refetch({ throwOnError: true })
-        ).then(
-          () => ({ outcome: `fulfilled` as const }),
-          (error: unknown) => ({ outcome: `rejected` as const, error }),
-        )
-        await vi.waitFor(() => {
-          expect(queryFn).toHaveBeenCalledTimes(2)
-          expect(scanPersistedRows).toHaveBeenCalledOnce()
-        })
-        expect(reportedError(collection)).toBe(previousError)
-
-        const secondRetry = collection.utils.refetch({ throwOnError: true })
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-        laterResult.reject(newerError)
-        await expect(secondRetry).rejects.toBe(newerError)
-        expect(reportedError(collection)).toBe(newerError)
-        expect(reportedError(collection)).toBeDefined()
-
-        persistedScan.resolve([])
-        expect(await firstRetry).toEqual({ outcome: `fulfilled` })
-        expect(reportedError(collection)).toBe(newerError)
-        expect(reportedError(collection)).toBeDefined()
-      } finally {
-        firstResult.resolve([])
-        laterResult.resolve([])
-        persistedScan.resolve([])
-      }
-    },
-  )
-
-  it.each([`success`, `failure`] as const)(
-    `does not recount the previous error during a Query retry attempt ending in %s`,
-    async (outcome) => {
-      const id = `held-query-retry-attempt-${outcome}`
-      const previousError = new Error(`previous fetch failed`)
-      const attemptError = new Error(`retry attempt failed`)
-      const finalError = new Error(`retry finally failed`)
-      const heldResult = createDeferred<Array<Item>>()
-      const queryFn = vi
-        .fn<() => Promise<Array<Item>>>()
-        .mockResolvedValueOnce([shared])
-        .mockRejectedValueOnce(previousError)
-        .mockRejectedValueOnce(attemptError)
-        .mockImplementationOnce(() => heldResult.promise)
-      const queryClient = createQueryClient()
-      const consoleError = vi
-        .spyOn(console, `error`)
-        .mockImplementation(() => {})
-      const collection = createCollection(
-        queryCollectionOptions<Item>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (item) => item.id,
-          syncMode: `eager`,
-          startSync: true,
-          retry: (count, error) => error === attemptError && count < 2,
-          retryDelay: 0,
-        }),
-      )
-      cleanups.push(async () => {
-        heldResult.resolve([shared])
-        try {
-          await collection.cleanup()
-        } finally {
-          queryClient.clear()
-          consoleError.mockRestore()
-        }
-      })
-
-      await collection.stateWhenReady()
-      await expect(
-        collection.utils.refetch({ throwOnError: true }),
-      ).rejects.toBe(previousError)
-      expect(reportedError(collection)).toBeDefined()
-      const retry = collection.utils.refetch({ throwOnError: true }).then(
-        () => ({ outcome: `fulfilled` as const }),
-        (error: unknown) => ({ outcome: `rejected` as const, error }),
-      )
-      try {
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(4))
-        // Query retains its old error while its first retry attempt has failed.
-        expect(reportedError(collection)).toBe(previousError)
-        expect(reportedError(collection)).toBeDefined()
-        if (outcome === `success`) {
-          heldResult.resolve([shared])
-          expect(await retry).toEqual({ outcome: `fulfilled` })
-          expect(reportedError(collection)).toBeUndefined()
-        } else {
-          heldResult.reject(finalError)
-          expect(await retry).toEqual({
-            outcome: `rejected`,
-            error: finalError,
-          })
-          expect(reportedError(collection)).toBe(finalError)
-          expect(reportedError(collection)).toBeDefined()
-        }
-      } finally {
-        heldResult.resolve([shared])
-        await retry
-      }
-    },
-  )
-
   it(`rejects an invalid retained revalidation before its persisted baseline loads`, async () => {
     const id = `retained-invalid-result-settlement`
     const queryHash = hashKey([id])
@@ -5027,9461 +4659,715 @@ describe(`query collection ownership lifecycle`, () => {
     await Promise.allSettled([oldRefetch, freshRefetch])
   })
 
-  it(`starts an idle collection only when a direct write is invoked`, () => {
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn((): Promise<Array<Item>> => Promise.resolve([]))
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id: `idle-direct-write-startup`,
-        queryClient,
-        queryKey: [`idle-direct-write-startup`],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: false,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    expect(collection.status).toBe(`idle`)
-    expect(reportedError(collection)).toBeUndefined()
-    expect(collection.status).toBe(`idle`)
-
-    collection.utils.writeUpsert({
-      id: `first`,
-      category: `direct`,
-      name: `First`,
-    })
-
-    expect(collection.status).toBe(`ready`)
-    expect(rows(collection)).toEqual([`first`])
-    expect(queryFn).not.toHaveBeenCalled()
-  })
-
-  it(`fails fast when a direct write is attempted during deferred startup`, () => {
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn((): Promise<Array<Item>> => Promise.resolve([]))
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id: `deferred-direct-write`,
-        queryClient,
-        queryKey: [`deferred-direct-write`],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: false,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    expect(collection._deferSyncStart()).toBe(true)
-    for (const write of [
-      () => collection.utils.writeInsert(shared),
-      () => collection.utils.writeUpdate(shared),
-      () => collection.utils.writeDelete(shared.id),
-      () => collection.utils.writeUpsert(shared),
-      () => collection.utils.writeBatch(() => {}),
-    ]) {
-      expect(write).toThrow(SyncNotInitializedError)
-    }
-    expect(collection.status).toBe(`idle`)
-    expect(rows(collection)).toEqual([])
-
-    collection._resumeSyncStart()
-    expect(collection.status).toBe(`ready`)
-    expect(rows(collection)).toEqual([])
-    expect(queryFn).not.toHaveBeenCalled()
-  })
-
-  it(`does not restart a cleaned-up idle collection for a direct write`, async () => {
-    const id = `cleaned-idle-direct-write`
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn((): Promise<Array<Item>> => Promise.resolve([]))
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: false,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.cleanup()
-    expect(() => collection.utils.writeUpsert(shared)).toThrow(
-      SyncNotInitializedError,
-    )
-    expect(collection.status).toBe(`cleaned-up`)
-    expect(rows(collection)).toEqual([])
-    expect(queryFn).not.toHaveBeenCalled()
-  })
-
-  it(`rejects a late mutation write without restarting a cleaned-up collection`, async () => {
-    const id = `late-mutation-after-cleanup`
-    const queryKey = [id] as const
-    const inserted = { id: `late`, category: `mutation`, name: `Late` }
-    const serverRows: Array<Item> = []
-    const handlerEntered = createDeferred<void>()
-    const releaseHandler = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(serverRows)))
-    let writeLate = (_item: Item) => {}
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => item.id,
-        startSync: true,
-        onInsert: async ({ transaction }) => {
-          handlerEntered.resolve()
-          await releaseHandler.promise
-          transaction.mutations.forEach(({ modified }) =>
-            writeLate(structuredClone(modified)),
-          )
-          return { refetch: false }
+  /**
+   * The driver uses the public `loadSubset` and `unloadSubset` entry points, a
+   * real QueryClient, and a held query function for the refetch. The blocker's
+   * mutation function holds publication. Each checkpoint follows a settled
+   * macrotask turn, so the comparison reads rows only after the step's sync
+   * work has run. `loadSubset` settlement is not compared: this law does not
+   * say whether the caller waits for the refetch.
+   */
+  it.each(reacquisitionHistories)(
+    `keeps a reacquired lease's result (staleTime $staleTime, refetch $refetch, settles $settles, peers $peers, rows $rows)`,
+    async (history) => {
+      const id = `reacquired-lease-${history.staleTime}-${history.refetch}-${history.settles}-${history.peers}-${history.rows}`
+      const detail = categorySubset(`detail`)
+      const peerSubsets = [
+        categorySubset(`list`),
+        {
+          where: new IR.Func(`in`, [
+            new IR.PropRef([`category`]),
+            new IR.Value([`peer`, `shared`]),
+          ]),
         },
-      }),
-    )
-    writeLate = (item) => collection.utils.writeUpsert(item)
-    cleanups.push(async () => {
-      releaseHandler.resolve()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.stateWhenReady()
-    expect(queryFn).toHaveBeenCalledOnce()
-
-    const mutation = collection.insert(inserted)
-    await handlerEntered.promise
-    await collection.cleanup()
-    releaseHandler.resolve()
-    await expect(mutation.isPersisted.promise).rejects.toBeInstanceOf(
-      SyncNotInitializedError,
-    )
-
-    expect(collection.status).toBe(`cleaned-up`)
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(itemIds(collection._state.syncedData.values())).toEqual([])
-    expect(queryClient.getQueryData(queryKey)).toBeUndefined()
-  })
-
-  it.each([
-    { ordered: false, settlementOrder: [0, 1] },
-    { ordered: false, settlementOrder: [1, 0] },
-    { ordered: true, settlementOrder: [0, 1] },
-    { ordered: true, settlementOrder: [1, 0] },
-  ] as const)(
-    `publishes mutation refetches through source and downstream view: %j`,
-    async ({ ordered, settlementOrder }) => {
-      const id = `mutation-publication-${ordered ? `ordered` : `unordered`}-${settlementOrder.join(``)}`
-      const queryClient = createQueryClient()
-      const serverRows: Array<Item> = []
-      const persistenceGates: Array<ReturnType<typeof createDeferred<void>>> =
-        []
-      const queryFn = vi.fn(() =>
-        Promise.resolve(serverRows.map((item) => structuredClone(item))),
-      )
-      const collection = createCollection(
-        queryCollectionOptions<Item>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (item) => item.id,
-          startSync: true,
-          onInsert: async ({ transaction }) => {
-            const gate = createDeferred<void>()
-            persistenceGates.push(gate)
-            await gate.promise
-            serverRows.push(
-              ...transaction.mutations.map(({ modified }) =>
-                structuredClone(modified),
-              ),
-            )
-          },
-        }),
-      )
-      const derived = createLiveQueryCollection((query) => {
-        const source = query.from({ item: collection })
-        const result = ordered
-          ? source.orderBy(({ item }) => item.name, `asc`)
-          : source
-        return result.select(({ item }) => ({ ...item }))
+      ].slice(0, history.peers)
+      const leaseResult = history.rows === 2 ? [shared, solo] : [shared]
+      const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
+      const persistence = createDeferred<void>()
+      const refetch = createDeferred<Array<Item>>()
+      void refetch.promise.catch(() => undefined)
+      const { collection, queryFn } = createOwnershipFixture({
+        id,
+        results: [leaseResult, ...peerSubsets.map(() => [shared])],
+        staleTime: history.staleTime,
       })
-      const publications: Array<MutationPublicationSnapshot> = []
-      let expectedPublication: Array<string> = []
-      const subscription = derived.subscribeChanges(() => {
-        publications.push({
-          source: ordered
-            ? [...collection.toArray]
-                .sort((left, right) => left.name.localeCompare(right.name))
-                .map(({ id: rowId }) => rowId)
-            : rows(collection),
-          derived: ordered
-            ? derived.toArray.map(({ id: rowId }) => rowId)
-            : rows(derived),
-          expected: expectedPublication,
-        })
+      queryFn.mockImplementationOnce(() => refetch.promise)
+      const settleRefetch = () => {
+        if (history.refetch === `rejects`)
+          refetch.reject(new Error(`refetch failed`))
+        else
+          refetch.resolve(
+            history.refetch === `empty`
+              ? []
+              : leaseResult.map((item) => ({ ...item })),
+          )
+      }
+      const settleTurn = async () => {
+        for (let turn = 0; turn < 3; turn++)
+          await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      }
+      const mutation = createTransaction({
+        mutationFn: () => persistence.promise,
       })
+
+      await collection._sync.loadSubset(detail)
+      for (const peer of peerSubsets) await collection._sync.loadSubset(peer)
+      mutation.mutate(() => collection.insert(blocker))
       cleanups.push(async () => {
-        persistenceGates.forEach((gate) => gate.resolve())
-        subscription.unsubscribe()
-        await derived.cleanup()
-        await collection.cleanup()
-        queryClient.clear()
+        persistence.resolve()
+        refetch.reject(new Error(`cleanup`))
+        await mutation.isPersisted.promise.catch(() => undefined)
       })
 
-      const firstItem = {
-        id: `z-first`,
-        category: `mutation`,
-        name: `1-first`,
-      }
-      const secondItem = {
-        id: `a-second`,
-        category: `mutation`,
-        name: `2-second`,
+      // The release's sync transaction is accepted but held behind the blocker.
+      const pendingBefore = collection._state.pendingSyncedTransactions.length
+      collection._sync.unloadSubset(detail)
+      await vi.waitFor(() =>
+        expect(
+          collection._state.pendingSyncedTransactions.length,
+        ).toBeGreaterThan(pendingBefore),
+      )
+      const reacquired = Promise.resolve(collection._sync.loadSubset(detail))
+      void reacquired.catch(() => undefined)
+      await settleTurn()
+      const held = rows(collection)
+
+      if (history.settles === `while-held`) {
+        settleRefetch()
+        await settleTurn()
       }
-      await derived.preload()
-      expectedPublication = [firstItem.id]
-      const first = collection.insert(firstItem)
-      const visibleIds = [firstItem.id, secondItem.id]
-      expectedPublication = ordered ? visibleIds : [...visibleIds].sort()
-      const second = collection.insert(secondItem)
-      const transactions = [first, second]
-      const items = [firstItem, secondItem]
-      const queryKey = [id] as const
-      const capture = (): MutationLifecycleSnapshot => ({
-        server: itemIds(serverRows),
-        cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-        synced: itemIds(collection._state.syncedData.values()),
-        source: itemIds(collection.toArray),
-        derived: ordered
-          ? derived.toArray.map(({ id: rowId }) => rowId)
-          : itemIds(derived.toArray),
-      })
+      persistence.resolve()
+      await mutation.isPersisted.promise
+      await settleTurn()
+      const published = rows(collection)
 
-      expect(persistenceGates).toHaveLength(2)
-      expect(queryFn).toHaveBeenCalledOnce()
-      expectMutationLifecycleSnapshot(capture(), [], visibleIds, ordered)
-
-      const settled = new Set<number>()
-      for (const transactionIndex of settlementOrder) {
-        persistenceGates[transactionIndex]!.resolve()
-        await transactions[transactionIndex]!.isPersisted.promise
-        settled.add(transactionIndex)
-
-        const authoritativeIds = [...settled].map((index) => items[index]!.id)
-        expect(queryFn).toHaveBeenCalledTimes(1 + settled.size)
-        const expectedSynced =
-          settled.size === transactions.length ? authoritativeIds : []
-        expect(capture()).toEqual({
-          server: [...authoritativeIds].sort(),
-          cache: [...authoritativeIds].sort(),
-          synced: [...expectedSynced].sort(),
-          source: [...visibleIds].sort(),
-          derived: ordered ? visibleIds : [...visibleIds].sort(),
-        })
-        expectMutationPublicationIntegrity(publications)
-        expect(publications.at(-1)?.derived).toEqual(
-          ordered ? visibleIds : [...visibleIds].sort(),
-        )
+      if (history.settles === `after-publication`) {
+        settleRefetch()
+        await settleTurn()
       }
+      await reacquired.catch(() => undefined)
+      const settled = rows(collection)
 
-      const thirdItem = {
-        id: `m-third`,
-        category: `mutation`,
-        name: `3-third`,
+      for (const peer of peerSubsets) {
+        collection._sync.unloadSubset(peer)
+        await settleTurn()
       }
-      const allVisibleIds = [...visibleIds, thirdItem.id]
-      expectedPublication = ordered ? allVisibleIds : [...allVisibleIds].sort()
-      const third = collection.insert(thirdItem)
-      expect(persistenceGates).toHaveLength(3)
-      expectMutationLifecycleSnapshot(
-        capture(),
-        visibleIds,
-        allVisibleIds,
-        ordered,
-      )
+      const peerReleased = rows(collection)
 
-      persistenceGates[2]!.resolve()
-      await third.isPersisted.promise
+      collection._sync.unloadSubset(detail)
+      await settleTurn()
 
-      expect(queryFn).toHaveBeenCalledTimes(4)
-      expectMutationLifecycleSnapshot(
-        capture(),
-        allVisibleIds,
-        allVisibleIds,
-        ordered,
-      )
-      expectMutationPublicationIntegrity(publications)
-      expect(publications.at(-1)?.derived).toEqual(
-        ordered ? allVisibleIds : [...allVisibleIds].sort(),
-      )
+      expect({
+        held,
+        published,
+        settled,
+        peerReleased,
+        released: rows(collection),
+        queryCalls: queryFn.mock.calls.length,
+      }).toEqual(modelReacquisition(history))
     },
   )
 
-  it(`rejects incomplete and misordered mutation publication receipts`, () => {
-    const visible = [`z-first`, `a-second`, `m-third`]
-    const valid: MutationLifecycleSnapshot = {
-      server: [...visible].sort(),
-      cache: [...visible].sort(),
-      synced: [...visible].sort(),
-      source: [...visible].sort(),
-      derived: visible,
-    }
-
-    expectMutationLifecycleSnapshot(valid, visible, visible, true)
-    for (const mutant of [
-      { ...valid, synced: [] },
-      { ...valid, source: [] },
-      { ...valid, derived: visible.slice(0, 2) },
-      { ...valid, derived: [...visible].reverse() },
-      { ...valid, source: [...valid.source, `stale`] },
-    ]) {
-      expect(() =>
-        expectMutationLifecycleSnapshot(mutant, visible, visible, true),
-      ).toThrow()
-    }
-  })
-
-  it(`rejects a torn intermediate publication before a complete final snapshot`, () => {
-    const first = [`z-first`]
-    const firstAndSecond = [`z-first`, `a-second`]
-    const allVisible = [`z-first`, `a-second`, `m-third`]
-    const legitimateSequence: Array<MutationPublicationSnapshot> = [
-      { source: first, derived: first, expected: first },
-      {
-        source: firstAndSecond,
-        derived: firstAndSecond,
-        expected: firstAndSecond,
-      },
-      { source: allVisible, derived: allVisible, expected: allVisible },
-    ]
-
-    expect(() =>
-      expectMutationPublicationIntegrity(legitimateSequence),
-    ).not.toThrow()
-    expect(() =>
-      expectMutationPublicationIntegrity([
-        ...legitimateSequence.slice(0, 2),
-        { source: [], derived: [], expected: allVisible },
-        legitimateSequence[2]!,
-      ]),
-    ).toThrow()
-  })
-
-  it(`supersedes a stale focus result before publishing a newer mutation snapshot`, async () => {
-    const id = `focus-result-supersession`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `mutation`, name: `A` }
-    const retired = { id: `b`, category: `mutation`, name: `B` }
-    const inserted = { id: `c`, category: `mutation`, name: `C` }
-    const serverRows = [initial, retired]
-    const firstFocus = createDeferred<Array<Item>>()
-    const secondFocus = createDeferred<Array<Item>>()
-    const handlerEntered = createDeferred<void>()
-    const releaseHandler = createDeferred<void>()
-    const queryClient = createQueryClient(false, 0)
-    let queryCalls = 0
-    const queryFn = vi.fn(() => {
-      queryCalls++
-      if (queryCalls === 2) return firstFocus.promise
-      if (queryCalls === 3) return secondFocus.promise
-      return Promise.resolve(structuredClone(serverRows))
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        staleTime: 0,
-        refetchOnWindowFocus: true,
-        onInsert: async ({ transaction }) => {
-          serverRows.splice(
-            0,
-            serverRows.length,
-            initial,
-            ...transaction.mutations.map(({ modified }) =>
-              structuredClone(modified),
-            ),
-          )
-          handlerEntered.resolve()
-          await releaseHandler.promise
-          return { refetch: false }
-        },
-      }),
-    )
-    const derived = createLiveQueryCollection((query) =>
-      query.from({ item: collection }).select(({ item }) => ({
-        id: item.id,
-        category: item.category,
-        name: item.name,
-      })),
-    )
-    const sourcePublications: Array<Array<string>> = []
-    const derivedPublications: Array<MutationPublicationSnapshot> = []
-    const sourceSubscription = collection.subscribeChanges(() => {
-      sourcePublications.push(itemIds(collection.toArray))
-    })
-    const derivedSubscription = derived.subscribeChanges(() => {
-      const source = itemIds(collection.toArray)
-      derivedPublications.push({
-        source,
-        derived: itemIds(derived.toArray),
-        expected: source,
+  /**
+   * The driver runs a server DbClient and a hydrated browser DbClient over the
+   * same Collection descriptor. On the server, an optimistic blocker holds
+   * publication while `a` is released and, in `while-held` histories, while
+   * `b` is acquired. In `reacquired` histories, `a`'s Query is removed with
+   * the public `QueryClient.removeQueries` after its release, then `a` is
+   * reacquired and its held fetch rejects after `b` claims the row. The
+   * checkpoints are the dehydrated state after every held
+   * transaction publishes, and the hydrated client's public rows after it
+   * acquires and then releases `b`.
+   */
+  it.each(publishedOwnerHistories)(
+    `publishes only active owners when a lease claims a released row (claims $claims, peer $peer, reacquired $reacquired)`,
+    async (history) => {
+      const id = `published-owners-${history.claims}-${history.peer}-${history.reacquired}`
+      const subset = (category: string): LoadSubsetOptions => ({
+        where: new IR.Func(`in`, [
+          new IR.PropRef([`category`]),
+          new IR.Value([category, `shared`]),
+        ]),
       })
-    })
-    cleanups.push(async () => {
-      releaseHandler.resolve()
-      sourceSubscription.unsubscribe()
-      derivedSubscription.unsubscribe()
-      await derived.cleanup()
-      await collection.cleanup()
-      queryClient.clear()
-      focusManager.setFocused(undefined)
-    })
-
-    await derived.preload()
-    expect(queryFn).toHaveBeenCalledOnce()
-    sourcePublications.length = 0
-    derivedPublications.length = 0
-
-    focusManager.setFocused(false)
-    focusManager.setFocused(true)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-
-    const mutation = collection.insert(inserted)
-    await handlerEntered.promise
-    firstFocus.resolve([structuredClone(initial)])
-    await vi.waitFor(() =>
-      expect(queryClient.getQueryState(queryKey)?.fetchStatus).toBe(`idle`),
-    )
-
-    let waiterOutcome: `pending` | `resolved` | `rejected` = `pending`
-    const waiter = Promise.resolve(collection._sync.loadSubset({})).then(
-      () => {
-        waiterOutcome = `resolved`
-      },
-      (error) => {
-        waiterOutcome = `rejected`
-        throw error
-      },
-    )
-
-    focusManager.setFocused(false)
-    focusManager.setFocused(true)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    secondFocus.resolve(structuredClone(serverRows))
-    await vi.waitFor(() =>
-      expect(queryClient.getQueryState(queryKey)?.fetchStatus).toBe(`idle`),
-    )
-
-    releaseHandler.resolve()
-    await mutation.isPersisted.promise
-    await waiter
-    await vi.waitFor(() =>
-      expect(itemIds(derived.toArray)).toEqual([initial.id, inserted.id]),
-    )
-
-    expect(waiterOutcome).toBe(`resolved`)
-    expect(sourcePublications).not.toContainEqual([initial.id])
-    for (const publication of sourcePublications) {
-      expect([
-        [initial.id, inserted.id],
-        [initial.id, retired.id, inserted.id].sort(),
-      ]).toContainEqual(publication)
-    }
-    expectMutationPublicationIntegrity(derivedPublications)
-    expect({
-      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-      synced: itemIds(collection._state.syncedData.values()),
-      source: itemIds(collection.toArray),
-      derived: itemIds(derived.toArray),
-    }).toEqual({
-      cache: [initial.id, inserted.id],
-      synced: [initial.id, inserted.id],
-      source: [initial.id, inserted.id],
-      derived: [initial.id, inserted.id],
-    })
-
-    queryClient.setQueryData(queryKey, [])
-    await vi.waitFor(() => {
-      expect({
-        synced: itemIds(collection._state.syncedData.values()),
-        source: itemIds(collection.toArray),
-        derived: itemIds(derived.toArray),
-      }).toEqual({ synced: [], source: [], derived: [] })
-    })
-  })
-
-  it(`removes rows superseded while an older result is publishing`, async () => {
-    const id = `reentrant-committed-result-supersession`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const sibling = { id: `b`, category: `result`, name: `B` }
-    const updated = { ...initial, name: `A from server` }
-    const orphaned = { id: `c`, category: `result`, name: `C` }
-    const handlerEntered = createDeferred<void>()
-    const releaseHandler = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([initial, sibling]))
-    const onUpdate = vi.fn(async () => {
-      handlerEntered.resolve()
-      await releaseHandler.promise
-      return { refetch: false }
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => item.id,
-        startSync: true,
-        onUpdate,
-      }),
-    )
-    cleanups.push(async () => {
-      releaseHandler.resolve()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.stateWhenReady()
-    const mutation = collection.update(initial.id, (draft) => {
-      draft.name = `A optimistic`
-    })
-    await handlerEntered.promise
-
-    const publications: Array<Array<string>> = []
-    let superseded = false
-    const subscription = collection.subscribeChanges(() => {
-      const ids = itemIds(collection.toArray)
-      publications.push(ids)
-      if (!superseded && ids.includes(orphaned.id)) {
-        superseded = true
-        queryClient.setQueryData(queryKey, [updated, sibling])
-      }
-    })
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-
-    queryClient.setQueryData(queryKey, [updated, sibling, orphaned])
-    expect(itemIds(collection._state.syncedData.values())).toEqual([
-      initial.id,
-      sibling.id,
-    ])
-
-    releaseHandler.resolve()
-    await mutation.isPersisted.promise
-    await collection._sync.loadSubset({})
-
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(onUpdate).toHaveBeenCalledOnce()
-    expect(superseded).toBe(true)
-    expect(publications).toContainEqual([initial.id, sibling.id, orphaned.id])
-    expect({
-      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-      synced: itemIds(collection._state.syncedData.values()),
-      source: itemIds(collection.toArray),
-    }).toEqual({
-      cache: [initial.id, sibling.id],
-      synced: [initial.id, sibling.id],
-      source: [initial.id, sibling.id],
-    })
-    expect(
-      persistedOwners(collection._state.syncedMetadata, orphaned.id),
-    ).toEqual([])
-  })
-
-  it(`retains ownership after a publication listener throws`, async () => {
-    const id = `failed-result-publication`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const sibling = { id: `b`, category: `result`, name: `B` }
-    const transient = { id: `c`, category: `result`, name: `C` }
-    const publicationError = new Error(`Publication failed`)
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([initial, sibling]))
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => item.id,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      consoleError.mockRestore()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.stateWhenReady()
-    let threw = false
-    const subscription = collection.subscribeChanges(() => {
-      if (!threw && collection.has(transient.id)) {
-        threw = true
-        throw publicationError
-      }
-    })
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-
-    queryClient.setQueryData(queryKey, [initial, sibling, transient])
-    await vi.waitFor(() => expect(threw).toBe(true))
-    queryClient.setQueryData(queryKey, [initial, sibling])
-    await collection._sync.loadSubset({})
-
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect({
-      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-      synced: itemIds(collection._state.syncedData.values()),
-      source: itemIds(collection.toArray),
-    }).toEqual({
-      cache: [initial.id, sibling.id],
-      synced: [initial.id, sibling.id],
-      source: [initial.id, sibling.id],
-    })
-    expect(
-      persistedOwners(collection._state.syncedMetadata, transient.id),
-    ).toEqual([])
-  })
-
-  it(`reports a reentrant initial replacement failure before readiness`, async () => {
-    const id = `failed-initial-result-replacement`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const invalid = { id: `invalid`, category: `result`, name: `Invalid` }
-    const applicationError = new Error(`Replacement application failed`)
-    const firstResult = createDeferred<Array<Item>>()
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => firstResult.promise)
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => {
-          if (item.id === invalid.id) throw applicationError
-          return item.id
-        },
-        startSync: false,
-      }),
-    )
-    cleanups.push(async () => {
-      firstResult.resolve([initial])
-      consoleError.mockRestore()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    collection.startSyncImmediate()
-    expect(collection.status).toBe(`loading`)
-    let replaced = false
-    const subscription = collection.subscribeChanges(() => {
-      if (!replaced && collection.has(initial.id)) {
-        replaced = true
-        queryClient.setQueryData(queryKey, [invalid])
-      }
-    })
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-
-    firstResult.resolve([initial])
-    await vi.waitFor(() => expect(collection.status).toBe(`error`))
-
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(replaced).toBe(true)
-    expect(reportedError(collection)).toBe(applicationError)
-    expect(itemIds(collection.toArray)).toEqual([initial.id])
-  })
-
-  it(`releases provisional ownership when commit fails before publication`, async () => {
-    const id = `failed-prepublication-commit`
-    const detailSubset = { where: eq(new IR.PropRef([`category`]), `detail`) }
-    const listSubset = { where: eq(new IR.PropRef([`category`]), `list`) }
-    const detailKey = [id, getLoadSubsetDemandKey(detailSubset)] as const
-    const detail = { id: `a`, category: `detail`, name: `A` }
-    const list = { id: `c`, category: `list`, name: `C` }
-    const commitError = new Error(`Commit failed before publication`)
-    const queryClient = createQueryClient()
-    const queryFn = vi
-      .fn<() => Promise<Array<Item>>>()
-      .mockResolvedValueOnce([detail])
-      .mockResolvedValueOnce([list])
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const baseOptions = queryCollectionOptions<Item>({
-      id,
-      queryClient,
-      queryKey: [id],
-      queryFn,
-      getKey: (item) => item.id,
-      syncMode: `on-demand`,
-      startSync: true,
-    })
-    const originalSync = baseOptions.sync
-    let failNextCommit = false
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        sync: (params: Parameters<typeof originalSync.sync>[0]) =>
-          originalSync.sync({
-            ...params,
-            commit: (signal) => {
-              if (failNextCommit) {
-                failNextCommit = false
-                throw commitError
-              }
-              return params.commit(signal)
-            },
-          }),
-      },
-    })
-    cleanups.push(async () => {
-      collection._sync.unloadSubset(detailSubset)
-      collection._sync.unloadSubset(listSubset)
-      consoleError.mockRestore()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset(detailSubset)
-    expect(itemIds(collection.toArray)).toEqual([detail.id])
-
-    failNextCommit = true
-    queryClient.setQueryData(detailKey, [detail, list])
-    await vi.waitFor(() => expect(reportedError(collection)).toBe(commitError))
-    expect(itemIds(collection.toArray)).toEqual([detail.id])
-
-    await collection._sync.loadSubset(listSubset)
-    expect(itemIds(collection.toArray)).toEqual([detail.id, list.id])
-    collection._sync.unloadSubset(listSubset)
-    await vi.waitFor(() =>
-      expect(itemIds(collection.toArray)).toEqual([detail.id]),
-    )
-  })
-
-  it(`retires a publishing result when its final subset unloads`, async () => {
-    const id = `reentrant-result-unload`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const sibling = { id: `b`, category: `result`, name: `B` }
-    const updated = { ...initial, name: `A from server` }
-    const orphaned = { id: `c`, category: `result`, name: `C` }
-    const handlerEntered = createDeferred<void>()
-    const releaseHandler = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([initial, sibling]))
-    const onUpdate = vi.fn(async () => {
-      handlerEntered.resolve()
-      await releaseHandler.promise
-      return { refetch: false }
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        onUpdate,
-      }),
-    )
-    cleanups.push(async () => {
-      releaseHandler.resolve()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    let unloaded = false
-    const subscription = collection.subscribeChanges(() => {
-      if (!unloaded && collection.has(orphaned.id)) {
-        unloaded = true
-        collection._sync.unloadSubset({})
-      }
-    })
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-
-    const mutation = collection.update(initial.id, (draft) => {
-      draft.name = `A optimistic`
-    })
-    await handlerEntered.promise
-    queryClient.setQueryData(queryKey, [updated, sibling, orphaned])
-    expect(itemIds(collection._state.syncedData.values())).toEqual([
-      initial.id,
-      sibling.id,
-    ])
-
-    releaseHandler.resolve()
-    await mutation.isPersisted.promise
-    await vi.waitFor(() => expect(unloaded).toBe(true))
-    await vi.waitFor(() => {
-      expect({
-        synced: itemIds(collection._state.syncedData.values()),
-        source: itemIds(collection.toArray),
-      }).toEqual({ synced: [], source: [] })
-    })
-
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(onUpdate).toHaveBeenCalledOnce()
-    expect(
-      persistedOwners(collection._state.syncedMetadata, orphaned.id),
-    ).toEqual([])
-  })
-
-  /**
-   * Releasing and then reacquiring one demand creates a new active claim. An
-   * older release may publish later, but it cannot erase that newer claim. The
-   * independent model removes the first claim, adds the second, and leaves the
-   * shared row until the second release. The unrelated blocker only delays
-   * publication.
-   */
-  it(`keeps a reacquired claim across an older release publication`, async () => {
-    const id = `reacquired-claim-old-release`
-    const detail = categorySubset(`detail`)
-    const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
-    const persistence = createDeferred<void>()
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [[shared]],
-      staleTime: Number.POSITIVE_INFINITY,
-    })
-    const mutation = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-
-    await collection._sync.loadSubset(detail)
-    mutation.mutate(() => collection.insert(blocker))
-    cleanups.push(async () => {
-      persistence.resolve()
-      await mutation.isPersisted.promise.catch(() => undefined)
-    })
-
-    const pendingBefore = collection._state.pendingSyncedTransactions.length
-    collection._sync.unloadSubset(detail)
-    await vi.waitFor(() =>
-      expect(
-        collection._state.pendingSyncedTransactions.length,
-      ).toBeGreaterThan(pendingBefore),
-    )
-    const pendingAfterRelease =
-      collection._state.pendingSyncedTransactions.length
-    const reacquired = Promise.resolve(collection._sync.loadSubset(detail))
-    void reacquired.catch(() => undefined)
-    await vi.waitFor(() =>
-      expect(
-        collection._state.pendingSyncedTransactions.length,
-      ).toBeGreaterThan(pendingAfterRelease),
-    )
-
-    persistence.resolve()
-    await mutation.isPersisted.promise
-    await reacquired
-    await vi.waitFor(() => expect(rows(collection)).toEqual([shared.id]))
-
-    collection._sync.unloadSubset(detail)
-    await vi.waitFor(() => expect(rows(collection)).toEqual([]))
-    expect(queryFn).toHaveBeenCalledOnce()
-  })
-
-  /**
-   * ## A reacquired observer lease owns the current Query result
-   *
-   * Law: reacquiring a released demand creates a new observer lease. Its
-   * current result is the Query's latest successful data, so it owns that
-   * data's rows from reacquisition until its own release. An older acquisition
-   * release that publishes later retires only the older lease. If the new
-   * lease starts a refetch, a successful refetch replaces the lease's result.
-   * A failed refetch keeps the last successful data, so it keeps those rows.
-   * `staleTime` decides whether a refetch starts. It cannot decide whether the
-   * cached result is owned.
-   *
-   * Authority: the reacquisition law in the history above, and the TanStack
-   * Query rules that a stale Query refetches when an observer mounts and that
-   * a failed refetch keeps the previous `data`.
-   *
-   * Limits: one reacquired on-demand subset whose result has one or two
-   * rows, zero to two peer subsets that own the first row, no persisted
-   * metadata, and one unrelated optimistic transaction that holds
-   * publication. A release commit that
-   * rejects and the direct-write path have their own histories below. Eager
-   * mode cannot reach the premise: it has no subset release, and ending an
-   * eager sync run removes its Query from the cache, so a restart fetches
-   * instead of replaying cached data.
-   */
-  const solo: Item = { id: `solo`, category: `detail`, name: `Solo` }
-
-  type ReacquisitionHistory = {
-    /** `Infinity`: reacquisition starts no fetch. `0`: it starts a refetch. */
-    staleTime: number
-    /** The refetch outcome. It has no effect when no refetch starts. */
-    refetch: `rejects` | `same-rows` | `empty`
-    /** The refetch settles before or after the older release publishes. */
-    settles: `while-held` | `after-publication`
-    /** Peer leases that also own `shared` until after the refetch. */
-    peers: 0 | 1 | 2
-    /** Rows in the reacquired lease's result; the second is owned only here. */
-    rows: 1 | 2
-  }
-
-  type ReacquisitionObservation = {
-    /** Public rows after reacquisition, while publication is still held. */
-    held: Array<string>
-    /** Public rows after the held transactions publish. */
-    published: Array<string>
-    /** Public rows after the refetch, if any, has settled. */
-    settled: Array<string>
-    /** Public rows after every peer is released. */
-    peerReleased: Array<string>
-    /** Public rows after the reacquired demand is released. */
-    released: Array<string>
-    /** Query function calls. Query staleness decides this count. */
-    queryCalls: number
-  }
-
-  /**
-   * The model keeps each active lease's latest successful result. Public
-   * synced rows are the union of those results at the last publication. Each
-   * peer's result is always `shared`; peers are active until `peerReleased`.
-   * A peer hides a lost `shared` until the peers leave, which is why that
-   * checkpoint exists; the lease-only `solo` row shows a loss at once. While the optimistic blocker
-   * holds publication, the public view is the blocker plus the rows published
-   * before the release, which the first lease owned. The model does not
-   * represent tombstones, ownership maps, or sync transactions.
-   */
-  const modelReacquisition = (
-    history: ReacquisitionHistory,
-  ): ReacquisitionObservation => {
-    const cached = history.rows === 2 ? [shared.id, solo.id] : [shared.id]
-    const refetchStarts = history.staleTime === 0
-    const refetched = !refetchStarts
-      ? cached
-      : history.refetch === `empty`
-        ? []
-        : // Both a same-rows result and a failed refetch leave the rows owned.
-          cached
-    const union = (...results: Array<Array<string>>) =>
-      [...new Set(results.flat())].sort()
-    const peerRows = history.peers > 0 ? [shared.id] : []
-    return {
-      held: union([`blocker`], cached, peerRows),
-      published: union(
-        history.settles === `while-held` ? refetched : cached,
-        peerRows,
-      ),
-      settled: union(refetched, peerRows),
-      peerReleased: union(refetched),
-      released: [],
-      queryCalls: 1 + history.peers + (refetchStarts ? 1 : 0),
-    }
-  }
-
-  /**
-   * The grammar crosses the refetch's start, outcome, and placement relative to
-   * the older release's publication. A fresh reacquisition starts no refetch,
-   * so it has one history. The `empty` histories reject a design that keeps the
-   * row for any reacquired demand. The `rejects` and `same-rows` histories
-   * that settle after publication reject a design that skips the cached
-   * result because the older lease left an ownership entry behind. Removing
-   * the already-applied guard altogether also passes this table; the
-   * persisted direct-write histories that keep an accepted write through a
-   * refetch start reject that repair. A repair that treats every empty
-   * ownership entry as unapplied also passes this table; the sibling history
-   * that keeps a direct insert through a refetch start of an empty result
-   * rejects it. Each history runs with zero, one, or two peers and with a
-   * one- or two-row result. With a peer, the older release keeps `shared`,
-   * so only the `peerReleased` checkpoint shows whether the reacquired lease
-   * owns it. On the original defect `shared` survives while a peer owns it
-   * and disappears when the peers leave, while `solo` disappears at
-   * publication. Two peers check that releasing every other owner, not just
-   * one, leaves the reacquired lease as the row's owner.
-   */
-  const reacquisitionHistories: Array<ReacquisitionHistory> = (
-    [0, 1, 2] as const
-  ).flatMap((peers) =>
-    ([1, 2] as const).flatMap((resultRows) => [
-      {
-        staleTime: Number.POSITIVE_INFINITY,
-        refetch: `rejects` as const,
-        settles: `after-publication` as const,
-        peers,
-        rows: resultRows,
-      },
-      ...([`rejects`, `same-rows`, `empty`] as const).flatMap((refetch) =>
-        ([`while-held`, `after-publication`] as const).map((settles) => ({
-          staleTime: 0,
-          refetch,
-          settles,
-          peers,
-          rows: resultRows,
-        })),
-      ),
-    ]),
-  )
-
-  /**
-   * The driver uses the public `loadSubset` and `unloadSubset` entry points, a
-   * real QueryClient, and a held query function for the refetch. The blocker's
-   * mutation function holds publication. Each checkpoint follows a settled
-   * macrotask turn, so the comparison reads rows only after the step's sync
-   * work has run. `loadSubset` settlement is not compared: this law does not
-   * say whether the caller waits for the refetch.
-   */
-  it.each(reacquisitionHistories)(
-    `keeps a reacquired lease's result (staleTime $staleTime, refetch $refetch, settles $settles, peers $peers, rows $rows)`,
-    async (history) => {
-      const id = `reacquired-lease-${history.staleTime}-${history.refetch}-${history.settles}-${history.peers}-${history.rows}`
-      const detail = categorySubset(`detail`)
-      const peerSubsets = [
-        categorySubset(`list`),
-        {
-          where: new IR.Func(`in`, [
-            new IR.PropRef([`category`]),
-            new IR.Value([`peer`, `shared`]),
-          ]),
-        },
-      ].slice(0, history.peers)
-      const leaseResult = history.rows === 2 ? [shared, solo] : [shared]
-      const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
-      const persistence = createDeferred<void>()
-      const refetch = createDeferred<Array<Item>>()
-      void refetch.promise.catch(() => undefined)
-      const { collection, queryFn } = createOwnershipFixture({
-        id,
-        results: [leaseResult, ...peerSubsets.map(() => [shared])],
-        staleTime: history.staleTime,
-      })
-      queryFn.mockImplementationOnce(() => refetch.promise)
-      const settleRefetch = () => {
-        if (history.refetch === `rejects`)
-          refetch.reject(new Error(`refetch failed`))
-        else
-          refetch.resolve(
-            history.refetch === `empty`
-              ? []
-              : leaseResult.map((item) => ({ ...item })),
-          )
-      }
-      const settleTurn = async () => {
-        for (let turn = 0; turn < 3; turn++)
-          await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      }
-      const mutation = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-
-      await collection._sync.loadSubset(detail)
-      for (const peer of peerSubsets) await collection._sync.loadSubset(peer)
-      mutation.mutate(() => collection.insert(blocker))
-      cleanups.push(async () => {
-        persistence.resolve()
-        refetch.reject(new Error(`cleanup`))
-        await mutation.isPersisted.promise.catch(() => undefined)
-      })
-
-      // The release's sync transaction is accepted but held behind the blocker.
-      const pendingBefore = collection._state.pendingSyncedTransactions.length
-      collection._sync.unloadSubset(detail)
-      await vi.waitFor(() =>
-        expect(
-          collection._state.pendingSyncedTransactions.length,
-        ).toBeGreaterThan(pendingBefore),
-      )
-      const reacquired = Promise.resolve(collection._sync.loadSubset(detail))
-      void reacquired.catch(() => undefined)
-      await settleTurn()
-      const held = rows(collection)
-
-      if (history.settles === `while-held`) {
-        settleRefetch()
-        await settleTurn()
-      }
-      persistence.resolve()
-      await mutation.isPersisted.promise
-      await settleTurn()
-      const published = rows(collection)
-
-      if (history.settles === `after-publication`) {
-        settleRefetch()
-        await settleTurn()
-      }
-      await reacquired.catch(() => undefined)
-      const settled = rows(collection)
-
-      for (const peer of peerSubsets) {
-        collection._sync.unloadSubset(peer)
-        await settleTurn()
-      }
-      const peerReleased = rows(collection)
-
-      collection._sync.unloadSubset(detail)
-      await settleTurn()
-
-      expect({
-        held,
-        published,
-        settled,
-        peerReleased,
-        released: rows(collection),
-        queryCalls: queryFn.mock.calls.length,
-      }).toEqual(modelReacquisition(history))
-    },
-  )
-
-  /**
-   * ## Published owners never name a released observer lease
-   *
-   * Law: each publication records, for each row, the observer leases that own
-   * it. A released lease is not an owner, even while its release waits behind
-   * held publication. A later lease that claims the row during that wait
-   * must not copy the released lease back into the row's owners from metadata
-   * that has not yet published the release. A hydrated client trusts those
-   * owners: a row stays public there while any recorded owner may still need
-   * it, so a stale owner keeps the row alive after its last real owner is
-   * released.
-   *
-   * Authority: the file's opening law (a row remains public while any committed
-   * owner needs it), and the hydration history above, which releases a
-   * hydrated demand and expects its rows to leave. The reacquisition table
-   * above changes how a released lease's ownership entry is read; this table
-   * keeps a repair from simply deleting that entry at release.
-   *
-   * Limits: one row, one released lease `a`, one claiming lease `b`, and an
-   * optional peer lease `c` that is never released. `a` may be reacquired
-   * without cached data before `b` claims the row; its fetch then fails, so
-   * the reacquired lease never applies a result. Hydration uses the public
-   * `DbClient.dehydrate` and `hydrate` paths with a fresh QueryClient. Native
-   * persistence and cold persisted scans are owned by the persisted histories.
-   */
-  type PublishedOwnerHistory = {
-    /** `b` claims the row while `a`'s release is held, or after it publishes. */
-    claims: `while-held` | `after-publication`
-    /** Whether peer `c` also owns the row and stays acquired. */
-    peer: boolean
-    /** Whether `a` is reacquired without cached data and its fetch fails. */
-    reacquired: boolean
-  }
-
-  type PublishedOwnerObservation = {
-    /** Owner edges for the row in the dehydrated state. Keys are opaque. */
-    dehydratedOwners: number
-    /** Public rows in the hydrated client after it acquires `b`. */
-    hydratedLoaded: Array<string>
-    /** Public rows in the hydrated client after it releases `b`. */
-    hydratedReleased: Array<string>
-  }
-
-  /**
-   * The model records the set of active leases whose result holds the row. A
-   * release removes its lease at once, regardless of publication. Hydration
-   * copies that set; after the hydrated client releases `b`, the row stays
-   * exactly when another recorded owner remains. Publication timing is absent
-   * from the model, because the law says it cannot change the owner set.
-   */
-  const modelPublishedOwners = (
-    history: PublishedOwnerHistory,
-  ): PublishedOwnerObservation => {
-    const activeOwners = new Set([`a`, ...(history.peer ? [`c`] : [])])
-    activeOwners.delete(`a`)
-    activeOwners.add(`b`)
-    const afterHydratedRelease = new Set(activeOwners)
-    afterHydratedRelease.delete(`b`)
-    return {
-      dehydratedOwners: activeOwners.size,
-      hydratedLoaded: [shared.id],
-      hydratedReleased: afterHydratedRelease.size > 0 ? [shared.id] : [],
-    }
-  }
-
-  /**
-   * `while-held` reaches the premise: `b`'s sync transaction reads row
-   * metadata that still names `a`. `after-publication` is the nearby boundary
-   * where the release has published first. The peer histories require `c` to
-   * remain an owner, so a repair that drops every metadata owner at release,
-   * or one that ignores recorded owners on hydration, fails them. A repair that
-   * deletes the released lease's ownership entry at release instead of keeping
-   * it until publication fails the `while-held` histories. Without a peer, it
-   * fails at both the owner count and the leaked hydrated row; with a peer,
-   * `c` keeps the row public, so only the owner count distinguishes it.
-   *
-   * The `reacquired` histories reject a repair that deletes the released
-   * entry when the Query is reacquired. The reacquired lease has no result
-   * yet, so `b` reads metadata naming `a` while `a` looks unresolved and
-   * copies it back. A later result for `a` would correct the edge, so `a`'s
-   * fetch fails and it never applies one. The model is unchanged: a lease
-   * without a successful result owns nothing.
-   */
-  const publishedOwnerHistories: Array<PublishedOwnerHistory> = (
-    [`while-held`, `after-publication`] as const
-  ).flatMap((claims) =>
-    [false, true].flatMap((peer) =>
-      [false, true].map((reacquired) => ({ claims, peer, reacquired })),
-    ),
-  )
-
-  /**
-   * The driver runs a server DbClient and a hydrated browser DbClient over the
-   * same Collection descriptor. On the server, an optimistic blocker holds
-   * publication while `a` is released and, in `while-held` histories, while
-   * `b` is acquired. In `reacquired` histories, `a`'s Query is removed with
-   * the public `QueryClient.removeQueries` after its release, then `a` is
-   * reacquired and its held fetch rejects after `b` claims the row. The
-   * checkpoints are the dehydrated state after every held
-   * transaction publishes, and the hydrated client's public rows after it
-   * acquires and then releases `b`.
-   */
-  it.each(publishedOwnerHistories)(
-    `publishes only active owners when a lease claims a released row (claims $claims, peer $peer, reacquired $reacquired)`,
-    async (history) => {
-      const id = `published-owners-${history.claims}-${history.peer}-${history.reacquired}`
-      const subset = (category: string): LoadSubsetOptions => ({
-        where: new IR.Func(`in`, [
-          new IR.PropRef([`category`]),
-          new IR.Value([category, `shared`]),
-        ]),
-      })
-      const [a, b, c] = [subset(`a`), subset(`b`), subset(`c`)]
-      // Query keys embed the subset as JSON, so `a`'s key holds `\"a\"`.
-      const isQueryForA = (queryKey: unknown) =>
-        JSON.stringify(queryKey).includes(`\\"a\\"`)
-      const reacquiredFetch = createDeferred<Array<Item>>()
-      void reacquiredFetch.promise.catch(() => undefined)
-      const createClient = (
-        queryFn: (context: QueryFunctionContext) => Promise<Array<Item>> = () =>
-          Promise.resolve([shared]),
-      ) => {
-        const queryClient = createQueryClient()
-        const descriptor = collectionOptions(
-          queryCollectionOptions<Item>({
-            id,
-            queryClient,
-            queryKey: [id],
-            queryFn,
-            getKey: (item) => item.id,
-            syncMode: `on-demand`,
-            startSync: true,
-          }),
-        )
-        const client = new DbClient({ queryClient })
-        cleanups.push(async () => {
-          await client.cleanup()
-          queryClient.clear()
-        })
-        return {
-          client,
-          queryClient,
-          collection: client.collection(descriptor),
-        }
-      }
-      const settleTurn = async () => {
-        for (let turn = 0; turn < 3; turn++)
-          await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      }
-
-      let fetchesForA = 0
-      const server = createClient(({ queryKey }) => {
-        if (isQueryForA(queryKey) && fetchesForA++ > 0)
-          return reacquiredFetch.promise
-        return Promise.resolve([shared])
-      })
-      const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
-      const persistence = createDeferred<void>()
-      const mutation = createTransaction({
-        mutationFn: () => persistence.promise,
-      })
-      cleanups.push(async () => {
-        persistence.resolve()
-        reacquiredFetch.reject(new Error(`cleanup`))
-        await mutation.isPersisted.promise.catch(() => undefined)
-      })
-
-      await server.collection._sync.loadSubset(a)
-      if (history.peer) await server.collection._sync.loadSubset(c)
-      mutation.mutate(() => server.collection.insert(blocker))
-      server.collection._sync.unloadSubset(a)
-      let reacquired: Promise<unknown> | undefined
-      if (history.reacquired) {
-        await settleTurn()
-        server.queryClient.removeQueries({
-          predicate: (query) => isQueryForA(query.queryKey),
-        })
-        reacquired = Promise.resolve(server.collection._sync.loadSubset(a))
-        void reacquired.catch(() => undefined)
-        await settleTurn()
-      }
-      const failReacquiredFetch = async () => {
-        const pending = reacquired
-        if (!pending) return
-        reacquiredFetch.reject(new Error(`reacquired fetch failed`))
-        await pending.catch(() => undefined)
-        await settleTurn()
-      }
-      if (history.claims === `while-held`) {
-        const claimed = Promise.resolve(server.collection._sync.loadSubset(b))
-        await settleTurn()
-        await failReacquiredFetch()
-        persistence.resolve()
-        await mutation.isPersisted.promise
-        await claimed
-      } else {
-        persistence.resolve()
-        await mutation.isPersisted.promise
-        await settleTurn()
-        await server.collection._sync.loadSubset(b)
-        await failReacquiredFetch()
-      }
-      await settleTurn()
-      const state = server.client.dehydrate({
-        shouldDehydrateCollection: () => true,
-      })
-      const sharedRow = state.collections
-        .flatMap((chunk) => chunk.rows)
-        .find((row) => row.key === shared.id)
-      const owners = (
-        sharedRow?.metadata as
-          { queryCollection?: { owners?: Record<string, true> } } | undefined
-      )?.queryCollection?.owners
-
-      const browser = createClient()
-      browser.client.hydrate(state)
-      await browser.collection._sync.loadSubset(b)
-      const hydratedLoaded = rows(browser.collection)
-      browser.collection._sync.unloadSubset(b)
-      await settleTurn()
-
-      expect({
-        dehydratedOwners: Object.keys(owners ?? {}).length,
-        hydratedLoaded,
-        hydratedReleased: rows(browser.collection),
-      }).toEqual(modelPublishedOwners(history))
-    },
-  )
-
-  /**
-   * ## A reacquired lease's cached rows receive accepted direct writes
-   *
-   * Law: in on-demand mode, an accepted direct write patches the cached rows
-   * of each active Query in its Collection that may still apply them. A Query
-   * whose lease has not yet applied a result may hold the written key, so it
-   * is patched; only a resolved scope that does not own the key may be
-   * skipped. The patched cache keeps a later replay of that cached result
-   * from presenting the pre-write value as a server result.
-   *
-   * Authority: the opening direct-write law of this file. A released lease's
-   * empty ownership entry, kept while its release is held, does not resolve a
-   * later lease of the same Query.
-   *
-   * Reference: one row whose server value is Shared, then an accepted Manual
-   * upsert. The model expects the public row and the reacquired Query's cache
-   * to show Manual.
-   *
-   * History: hold publication behind an optimistic blocker, release the
-   * demand, raise a refresh barrier (`deferDataRefresh`, as offline
-   * transactions do while they replay), and reacquire. The barrier keeps the
-   * cached result unapplied. The acquisition's own fetch fails, so Query
-   * keeps its cached data and is idle when the upsert arrives. The checkpoint
-   * is after publication and the barrier both end. Public rows alone cannot
-   * distinguish the skip: the upsert keeps the row either way. The Query
-   * cache, read through `QueryClient.getQueriesData`, does.
-   */
-  it(`patches a reacquired lease's cached rows while its result waits`, async () => {
-    const id = `reacquired-lease-direct-patch`
-    const detail = categorySubset(`detail`)
-    const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
-    const persistence = createDeferred<void>()
-    const barrier = createDeferred<void>()
-    const { collection, queryClient, queryFn } = createOwnershipFixture({
-      id,
-      results: [[shared]],
-    })
-    const mutation = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-    const settleTurn = async () => {
-      for (let turn = 0; turn < 3; turn++)
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-    }
-    cleanups.push(async () => {
-      collection.deferDataRefresh = null
-      barrier.resolve()
-      persistence.resolve()
-      await mutation.isPersisted.promise.catch(() => undefined)
-    })
-
-    await collection._sync.loadSubset(detail)
-    mutation.mutate(() => collection.insert(blocker))
-    collection._sync.unloadSubset(detail)
-    await settleTurn()
-    collection.deferDataRefresh = barrier.promise
-    const reacquired = Promise.resolve(collection._sync.loadSubset(detail))
-    void reacquired.catch(() => undefined)
-    await settleTurn()
-    const write = Promise.resolve(
-      collection.utils.writeUpsert({ ...shared, name: `Manual` }),
-    )
-    void write.catch(() => undefined)
-    await settleTurn()
-
-    persistence.resolve()
-    await mutation.isPersisted.promise
-    collection.deferDataRefresh = null
-    barrier.resolve()
-    await reacquired.catch(() => undefined)
-    await write
-    await settleTurn()
-
-    expect({
-      row: collection.get(shared.id)?.name,
-      cache: queryClient
-        .getQueriesData<Array<Item>>({ queryKey: [id] })
-        .flatMap(([, data]) => data ?? [])
-        .map((item) => item.name),
-      queryCalls: queryFn.mock.calls.length,
-    }).toEqual({ row: `Manual`, cache: [`Manual`], queryCalls: 2 })
-  })
-
-  /**
-   * ## A release whose durable commit fails is terminal for its sync run
-   *
-   * Law: a release is complete only when its commit is durable. If that
-   * commit fails, the Collection reports the failure and enters `error`; the
-   * released row stays public and stored, because the deletion never became
-   * durable. A later acquisition in that run rejects with the same failure
-   * instead of reading ownership the failed release left behind. Cleanup ends
-   * the run; a restarted run starts with no ownership from the old run, so
-   * its acquisition and release behave as in a fresh Collection.
-   *
-   * Authority: the Code Weight and Fail-Fast rules in AGENTS.md (a
-   * contradictory collaborator signal rejects at the boundary instead of
-   * recovering), the persisted direct-write receipt law in this file's opening
-   * prose, and the glossary's cleanup definition (it ends the sync run and its
-   * resources).
-   *
-   * Reference: the model owns one row through one demand. A failed release
-   * is a local persistence failure, so it crashes the Collection and leaves
-   * `{ rows: [shared], stored: [shared], status: crashed }`; a restarted
-   * load and release give `[shared]` and then `{ rows: [], stored: [] }`. The
-   * `durable` history is the control: the release succeeds and the restarted
-   * run never refetches, because no demand remains.
-   *
-   * Limits: one on-demand row, no persisted retention (`persistedGcTime: 0`,
-   * since retention intentionally keeps released rows), a controlled adapter
-   * whose next commit throws, and a public `cleanup()` then `preload()`
-   * restart. A failed commit that a host retries is outside this witness.
-   */
-  it.each([`durable`, `failed`, `failed-then-reacquired`] as const)(
-    `keeps a released row and fails loudly when its release commit fails (%s)`,
-    async (history) => {
-      const id = `release-commit-${history}`
-      const storage = createOwnershipStorage()
-      const queryClient = createQueryClient()
-      const queryFn = vi.fn(() => Promise.resolve([shared]))
-      let failNextCommit = false
-      const applyCommittedTx = storage.adapter.applyCommittedTx
-      storage.adapter.applyCommittedTx = (...args) => {
-        if (!failNextCommit) return applyCommittedTx(...args)
-        failNextCommit = false
-        return Promise.reject(new Error(`storage failed`))
-      }
-      const collection = createCollection(
-        persistedCollectionOptions<
-          Item,
-          string | number,
-          never,
-          QueryCollectionUtils<Item, string | number, Item, unknown>
-        >({
-          ...queryCollectionOptions<Item>({
-            id,
-            queryClient,
-            queryKey: [id],
-            queryFn,
-            getKey: (item) => item.id,
-            syncMode: `on-demand`,
-            persistedGcTime: 0,
-            startSync: true,
-          }),
-          persistence: { adapter: storage.adapter },
-        }),
-      )
-      cleanups.push(async () => {
-        await collection.cleanup().catch(() => undefined)
-        queryClient.clear()
-      })
-      const settleTurn = async () => {
-        for (let turn = 0; turn < 3; turn++)
-          await new Promise<void>((resolve) => setTimeout(resolve, 0))
-      }
-      const observe = () => ({
-        rows: rows(collection),
-        stored: storedItems(storage).map((item) => item.id),
-        status: collection.status,
-      })
-      const detail = categorySubset(`detail`)
-
-      await collection._sync.loadSubset(detail)
-      failNextCommit = history !== `durable`
-      collection._sync.unloadSubset(detail)
-      await settleTurn()
-      const afterRelease = observe()
-
-      let reacquisition: string | undefined
-      if (history === `failed-then-reacquired`) {
-        reacquisition = await Promise.resolve(
-          collection._sync.loadSubset(detail),
-        ).then(
-          () => `fulfilled`,
-          (error: unknown) =>
-            error instanceof Error ? error.message : String(error),
-        )
-      }
-
-      await collection.cleanup()
-      await collection.preload()
-      await collection._sync.loadSubset(detail)
-      const restartedLoad = rows(collection)
-      collection._sync.unloadSubset(detail)
-      await settleTurn()
-
-      const failed = history !== `durable`
-      expect({
-        afterRelease,
-        reacquisition,
-        restartedLoad,
-        restartedRelease: observe(),
-        queryCalls: queryFn.mock.calls.length,
-      }).toEqual({
-        afterRelease: failed
-          ? { rows: [shared.id], stored: [shared.id], status: `crashed` }
-          : { rows: [], stored: [], status: `ready` },
-        reacquisition:
-          history === `failed-then-reacquired`
-            ? `Failed to durably persist collection "${id}": storage failed`
-            : undefined,
-        restartedLoad: [shared.id],
-        restartedRelease: { rows: [], stored: [], status: `ready` },
-        queryCalls: failed ? 2 : 1,
-      })
-    },
-  )
-
-  /**
-   * The same fail-loud law covers a reacquired lease whose own durable commit
-   * fails. The release's commit is held at the persistence boundary while the
-   * Query is reacquired; the reacquired application's commit then fails. The
-   * release is durable, so the row leaves; the reacquired result never became
-   * durable, so it cannot keep the row. The persistence failure crashes the
-   * Collection, the
-   * acquisition rejects with the persistence failure, and a restart serves and
-   * releases the row normally. A history that keeps the row public after the
-   * failure would report a result that storage never accepted.
-   */
-  it(`fails loudly when a reacquired lease's commit fails after a held release`, async () => {
-    const id = `reacquired-commit-fails`
-    const storage = createOwnershipStorage(undefined, 2)
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([shared]))
-    let commits = 0
-    const applyCommittedTx = storage.adapter.applyCommittedTx
-    storage.adapter.applyCommittedTx = (...args) => {
-      // Commit 1 loads the row, 2 is the held release, 3 is the reacquisition.
-      if (++commits === 3) return Promise.reject(new Error(`storage failed`))
-      return applyCommittedTx(...args)
-    }
-    const collection = createCollection(
-      persistedCollectionOptions<
-        Item,
-        string | number,
-        never,
-        QueryCollectionUtils<Item, string | number, Item, unknown>
-      >({
-        ...queryCollectionOptions<Item>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (item) => item.id,
-          syncMode: `on-demand`,
-          persistedGcTime: 0,
-          startSync: true,
-        }),
-        persistence: { adapter: storage.adapter },
-      }),
-    )
-    cleanups.push(async () => {
-      storage.release()
-      await collection.cleanup().catch(() => undefined)
-      queryClient.clear()
-    })
-    const settleTurn = async () => {
-      for (let turn = 0; turn < 3; turn++)
-        await new Promise<void>((resolve) => setTimeout(resolve, 0))
-    }
-    const detail = categorySubset(`detail`)
-
-    await collection._sync.loadSubset(detail)
-    collection._sync.unloadSubset(detail)
-    await storage.entered
-    const reacquisition = Promise.resolve(
-      collection._sync.loadSubset(detail),
-    ).then(
-      () => `fulfilled`,
-      (error: unknown) =>
-        error instanceof Error ? error.message : String(error),
-    )
-    await settleTurn()
-    const held = { rows: rows(collection), status: collection.status }
-
-    storage.release()
-    const reacquired = await reacquisition
-    await settleTurn()
-    const failed = { rows: rows(collection), status: collection.status }
-
-    await collection.cleanup()
-    await collection.preload()
-    await collection._sync.loadSubset(detail)
-    const restartedLoad = rows(collection)
-    collection._sync.unloadSubset(detail)
-    await settleTurn()
-
-    expect({
-      held,
-      reacquired,
-      failed,
-      restartedLoad,
-      restartedRelease: {
-        rows: rows(collection),
-        stored: storedItems(storage).map((item) => item.id),
-      },
-    }).toEqual({
-      held: { rows: [shared.id], status: `ready` },
-      reacquired: `Failed to durably persist collection "${id}": storage failed`,
-      failed: { rows: [], status: `crashed` },
-      restartedLoad: [shared.id],
-      restartedRelease: { rows: [], stored: [] },
-    })
-  })
-
-  /**
-   * Accepted Query results update ownership in acceptance order even while
-   * publication is held. The independent model stores each active Query's
-   * latest complete result and exposes their union: after the detail and list
-   * results become empty, the peer still exposes the row; after the peer is
-   * released, the union is empty. Published metadata remains stale until the
-   * hold ends, so it cannot be the model's source of truth.
-   */
-  it(`composes accepted owner retirements ahead of stale metadata`, async () => {
-    const id = `accepted-owner-retirements`
-    const detail = categorySubset(`detail`)
-    const list = categorySubset(`list`)
-    const peer: LoadSubsetOptions = {
-      where: new IR.Func(`in`, [
-        new IR.PropRef([`category`]),
-        new IR.Value([`shared`, `peer`]),
-      ]),
-    }
-    const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
-    const persistence = createDeferred<void>()
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [[shared], [shared], [shared], [], [], [shared]],
-    })
-    const mutation = createTransaction({
-      mutationFn: () => persistence.promise,
-    })
-
-    await collection._sync.loadSubset(detail)
-    await collection._sync.loadSubset(list)
-    await collection._sync.loadSubset(peer)
-
-    mutation.mutate(() => collection.insert(blocker))
-    cleanups.push(async () => {
-      persistence.resolve()
-      await mutation.isPersisted.promise.catch(() => undefined)
-    })
-    expect(mutation.state).toBe(`persisting`)
-
-    const pendingBefore = collection._state.pendingSyncedTransactions.length
-    const refetch = collection.utils.refetch()
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(6))
-    await vi.waitFor(() =>
-      expect(
-        collection._state.pendingSyncedTransactions.length,
-      ).toBeGreaterThanOrEqual(pendingBefore + 2),
-    )
-
-    persistence.resolve()
-    await mutation.isPersisted.promise
-    await refetch
-    await vi.waitFor(() => expect(rows(collection)).toEqual([shared.id]))
-
-    collection._sync.unloadSubset(peer)
-    await vi.waitFor(() => expect(rows(collection)).toEqual([]))
-    expect(queryFn).toHaveBeenCalledTimes(6)
-  })
-
-  // Law: once a result's sync transaction is accepted, the rows it owns stay
-  // owned when a later result supersedes it. The later result diffs against
-  // that ownership, so a row only the superseded result added is deleted, and
-  // a later empty result deletes the rest. Model: the owned rows after each
-  // result are exactly that result's rows. Checkpoint: visible and stored rows
-  // after each refetch settles.
-  // Law: once a result's sync transaction is accepted, the rows it owns stay
-  // owned when a later result supersedes it, whether durable storage or a
-  // persisting mutation holds it. The later result diffs against that
-  // ownership, so a row only the superseded result added is deleted, and a
-  // later empty result deletes the rest. Model: the owned rows after each
-  // result are exactly that result's rows. Checkpoint: visible and stored rows
-  // after each refetch settles. Before this law, every supersession test held
-  // durable storage, where the result's core transaction had already applied,
-  // so restoring the old ownership was a no-op and no test observed it.
-  it.each([`storage`, `mutation`] as const)(
-    `keeps an accepted superseded result's ownership for the next diff when %s holds it`,
-    async (holder) => {
-      const id = `superseded-accepted-ownership-${holder}`
-      const row = (key: string): Item => ({
-        id: key,
-        category: `result`,
-        name: key.toUpperCase(),
-      })
-      let server: Array<Item> = [row(`a`)]
-      const storage = createOwnershipStorage()
-      const apply = storage.adapter.applyCommittedTx.bind(storage.adapter)
-      let holdStorage = false
-      const entered = createDeferred<void>()
-      const released = createDeferred<void>()
-      storage.adapter.applyCommittedTx = async (...args) => {
-        if (holdStorage && args[1].mutations.length > 0) {
-          holdStorage = false
-          entered.resolve()
-          await released.promise
-        }
-        return apply(...args)
-      }
-      const queryClient = createQueryClient()
-      const options = queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn: () => Promise.resolve(structuredClone(server)),
-        getKey: (item) => item.id,
-        startSync: true,
-      })
-      const collection = createCollection(
-        holder === `storage`
-          ? persistedCollectionOptions<
-              Item,
-              string | number,
-              never,
-              QueryCollectionUtils<Item, string | number, Item, unknown>
-            >({ ...options, persistence: { adapter: storage.adapter } })
-          : options,
-      )
-      const mutation = createTransaction({
-        mutationFn: () => released.promise,
-      })
-      cleanups.push(async () => {
-        released.resolve()
-        if (holder === `mutation`)
-          await mutation.isPersisted.promise.catch(() => undefined)
-        try {
-          await collection.cleanup()
-        } finally {
-          queryClient.clear()
-        }
-      })
-      const observe = () => ({
-        visible: [...collection.keys()].filter((key) => key !== `local`).sort(),
-        stored:
-          holder === `storage`
-            ? storedItems(storage).map((item) => item.id)
-            : [...collection._state.syncedData.keys()].sort(),
-      })
-
-      await collection.preload()
-      expect(observe()).toEqual({ visible: [`a`], stored: [`a`] })
-
-      // The first result is accepted and held before it can be stored or
-      // published; a second result supersedes it.
-      server = [row(`b`), row(`c`)]
-      if (holder === `storage`) holdStorage = true
-      else
-        mutation.mutate(() =>
-          collection.insert({ id: `local`, category: `local`, name: `L` }),
-        )
-      const first = collection.utils.refetch()
-      if (holder === `storage`) await entered.promise
-      else
-        await vi.waitFor(() =>
-          expect(
-            collection._state.pendingSyncedTransactions.length,
-          ).toBeGreaterThan(0),
-        )
-      const queuedAfterFirst =
-        collection._state.pendingSyncedTransactions.length
-      server = [row(`b`)]
-      const second = collection.utils.refetch()
-      if (holder === `mutation`)
-        await vi.waitFor(() =>
-          expect(
-            collection._state.pendingSyncedTransactions.length,
-          ).toBeGreaterThan(queuedAfterFirst),
-        )
-      released.resolve()
-      await Promise.all([first, second])
-      if (holder === `mutation`)
-        await mutation.isPersisted.promise.catch(() => undefined)
-      await vi.waitFor(() =>
-        expect(observe()).toEqual({ visible: [`b`], stored: [`b`] }),
-      )
-
-      server = []
-      await collection.utils.refetch()
-      await vi.waitFor(() =>
-        expect(observe()).toEqual({ visible: [], stored: [] }),
-      )
-    },
-  )
-
-  // Law: a fetch that started before a direct write keeps the server's rows
-  // for every key that write did not touch; a key written after the fetch
-  // began keeps its accepted row. Reference: the fetched rows, overlaid by the
-  // direct writes made after the fetch started, in order. Checkpoint: visible
-  // rows and the Query cache after the fetch settles. Cuts: the initial load,
-  // a handler's automatic refetch while another handler writes a different
-  // key or the same key, and a user refetch. The review probes are these cuts.
-  type MergeCut =
-    | `initial-load`
-    | `handler-refetch-other-key`
-    | `handler-refetch-same-key`
-    | `user-refetch`
-  it.each<MergeCut>([
-    `initial-load`,
-    `handler-refetch-other-key`,
-    `handler-refetch-same-key`,
-    `user-refetch`,
-  ])(
-    `keeps server rows a direct write did not touch when an older fetch settles: %s`,
-    async (cut) => {
-      type Row = { id: string; value: string }
-      const id = `older-fetch-merge-${cut}`
-      let server: Array<Row> =
-        cut === `initial-load`
-          ? [
-              { id: `1`, value: `a` },
-              { id: `2`, value: `b` },
-            ]
-          : [
-              { id: `1`, value: `old1` },
-              { id: `2`, value: `old2` },
-            ]
-      const held: Array<ReturnType<typeof createDeferred<void>>> = []
-      let hold = cut === `initial-load`
-      const queryClient = createQueryClient()
-      const writtenKey = cut === `handler-refetch-same-key` ? `1` : `2`
-      const collection = createCollection(
-        queryCollectionOptions<Row>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn: async () => {
-            const snapshot = server.map((row) => ({ ...row }))
-            if (hold) {
-              const gate = createDeferred<void>()
-              held.push(gate)
-              await gate.promise
-            }
-            return snapshot
-          },
-          getKey: (row) => row.id,
-          startSync: true,
-          onUpdate: async ({ transaction, collection: handlerCollection }) => {
-            const modified = transaction.mutations[0].modified
-            if (modified.value === `A`) {
-              // Handler A: the server accepts the change, and the automatic
-              // refetch confirms it.
-              server = server.map((row) =>
-                row.id === `1` ? { id: `1`, value: `A` } : row,
-              )
-              return
-            }
-            server = server.map((row) =>
-              row.id === writtenKey ? { id: writtenKey, value: `B` } : row,
-            )
-            await handlerCollection.utils.writeUpdate({
-              id: writtenKey,
-              value: `B`,
-            })
-            return { refetch: false }
-          },
-        }),
-      )
-      cleanups.push(async () => {
-        held.forEach((gate) => gate.resolve())
-        await collection.cleanup()
-        queryClient.clear()
-      })
-      const merge = (fetched: Array<Row>, writes: Array<Row>) => {
-        const rows = new Map(fetched.map((row) => [row.id, row]))
-        for (const row of writes) rows.set(row.id, row)
-        return Object.fromEntries(
-          [...rows.values()].map((row) => [row.id, row.value]),
-        )
-      }
-      const visible = () =>
-        Object.fromEntries(
-          Array.from(collection.values(), (row) => [row.id, row.value]),
-        )
-      const cached = () =>
-        Object.fromEntries(
-          (queryClient.getQueryData<Array<Row>>([id]) ?? []).map((row) => [
-            row.id,
-            row.value,
-          ]),
-        )
-
-      let expected: Record<string, string>
-      if (cut === `initial-load`) {
-        const fetched = server
-        const ready = collection.preload()
-        await vi.waitFor(() => expect(held).toHaveLength(1))
-        await collection.utils.writeInsert({ id: `3`, value: `c` })
-        expect(
-          queryClient.getQueryCache().find({ queryKey: [id] })?.state.status,
-        ).toBe(`pending`)
-        held[0]!.resolve()
-        await ready
-        expected = merge(fetched, [{ id: `3`, value: `c` }])
-      } else if (cut === `user-refetch`) {
-        await collection.preload()
-        server = [
-          { id: `1`, value: `new1` },
-          { id: `2`, value: `new2` },
-        ]
-        const fetched = server
-        hold = true
-        const refetch = collection.utils.refetch()
-        await vi.waitFor(() => expect(held).toHaveLength(1))
-        hold = false
-        await collection.utils.writeInsert({ id: `3`, value: `c` })
-        held[0]!.resolve()
-        await refetch
-        expected = merge(fetched, [{ id: `3`, value: `c` }])
-        // The refetch settles only once the merged rows are visible.
-        expect(visible()).toEqual(expected)
-      } else {
-        await collection.preload()
-        hold = true
-        const first = collection.update(`1`, (draft) => {
-          draft.value = `A`
-        })
-        await vi.waitFor(() => expect(held).toHaveLength(1))
-        hold = false
-        const fetched = server
-        await collection.update(writtenKey, (draft) => {
-          draft.value = `B-optimistic`
-        }).isPersisted.promise
-        held[0]!.resolve()
-        await first.isPersisted.promise
-        expected = merge(fetched, [{ id: writtenKey, value: `B` }])
-      }
-      await vi.waitFor(() => expect(visible()).toEqual(expected))
-      expect(cached()).toEqual(expected)
-    },
-  )
-
-  /**
-   * A fetched result can finish before its persisted baseline scan. Its
-   * source rows retain their fetch-start position while that application is
-   * queued. The reference overlays a later accepted direct write on those
-   * rows, even if the scan returns that newly written row. Check public rows
-   * when initial readiness settles, after the held scan is released.
-   */
-  it(`keeps a direct write made after fetch completion but before application`, async () => {
-    const id = `queued-older-result-direct-write`
-    const queryHash = hashKey([id])
-    const older = { ...shared, name: `Older fetch` }
-    const manual = { ...shared, name: `Manual` }
-    const persistedScan =
-      createDeferred<
-        Array<{ key: string | number; value: Item; metadata?: unknown }>
-      >()
-    const scanPersistedRows = vi.fn(() => persistedScan.promise)
-    const { collection, queryClient, queryFn } = createOwnershipFixture({
-      id,
-      syncMode: `eager`,
-      results: [[older]],
-      scanPersistedRows,
-      setupMetadata: (metadata) => {
-        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-          queryHash,
-          mode: `until-revalidated`,
-        })
-      },
-    })
-    cleanups.push(() => {
-      persistedScan.resolve([])
-      return Promise.resolve()
-    })
-
-    const ready = collection.stateWhenReady()
-    await vi.waitFor(() => {
-      expect(queryFn).toHaveBeenCalledOnce()
-      expect(scanPersistedRows).toHaveBeenCalledOnce()
-    })
-    await collection.utils.writeInsert(manual)
-    expect(collection.get(manual.id)?.name).toBe(`Manual`)
-    persistedScan.resolve([
-      {
-        key: manual.id,
-        value: manual,
-        metadata: { queryCollection: { owners: { [queryHash]: true } } },
-      },
-    ])
-    await ready
-    expect(collection.get(manual.id)?.name).toBe(`Manual`)
-
-    // The accepted result is settled. An unrelated Query state notification
-    // must not re-enter its older-result merge and patch the cache again.
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    let stateNotifications = 0
-    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
-      if (
-        event.type === `updated` &&
-        event.query === query &&
-        event.action.type === `setState`
-      )
-        stateNotifications++
-    })
-    try {
-      query.setState({ isInvalidated: true })
-      for (let turn = 0; turn < 20; turn++) await Promise.resolve()
-      expect(stateNotifications).toBe(1)
-      expect(query.state.isInvalidated).toBe(true)
-    } finally {
-      unsubscribe()
-    }
-  })
-
-  it(`settles a direct write only after its persisted commit applies`, async () => {
-    const id = `persisted-direct-write-receipt`
-    const storage = createOwnershipStorage(undefined, 2)
-    const { collection } = createPersistedOwnershipFixture(
-      id,
-      storage,
-      [shared],
-      `eager`,
-    )
-    await collection.stateWhenReady()
-
-    let receipt: `pending` | `fulfilled` | `rejected` = `pending`
-    const write = collection.utils.writeUpdate({ ...shared, name: `Updated` })
-    void write.then(
-      () => (receipt = `fulfilled`),
-      () => (receipt = `rejected`),
-    )
-    const observe = () => ({
-      receipt,
-      storedName: storage.snapshot().rows.get(shared.id)?.name,
-    })
-
-    await storage.entered
-    await Promise.resolve()
-    expect(observe()).toEqual(expectedDirectWriteReceipt(false))
-
-    storage.release()
-    await write
-    expect(observe()).toEqual(expectedDirectWriteReceipt(true))
-    expect(collection.get(shared.id)?.name).toBe(`Updated`)
-  })
-
-  /**
-   * A Query refetch may begin while a direct write waits for its persisted
-   * commit. Starting that request repeats the old cached success to observers,
-   * but no new provider row has arrived. The independent reference has three
-   * row states in order: the first fetched Server row, the accepted Manual
-   * write, and the later fetched Newer row. The old cached row cannot become
-   * authoritative again at refetch start.
-   *
-   * The legal history holds the direct commit, starts a real QueryClient
-   * refetch whose provider response is also held, then releases the commit.
-   * At the write receipt, while the response is still held, compare public
-   * and durable rows with Manual. After the provider responds, compare both
-   * with Newer. These two cuts reject a design that treats a fetch-start
-   * observer notification as a fresh result without forbidding a later
-   * physical result from replacing the direct write.
-   */
-  it.each([`eager`, `on-demand`] as const)(
-    `keeps an accepted persisted %s write through a refetch start until its result arrives`,
-    async (syncMode) => {
-      const id = `persisted-direct-write-refetch-start-${syncMode}`
-      const storage = createOwnershipStorage(undefined, 2)
-      const queryClient = createQueryClient()
-      const newer = { ...shared, name: `Newer` }
-      const manual = { ...shared, name: `Manual` }
-      const heldResult = createDeferred<Array<Item>>()
-      const requestStarted = createDeferred<void>()
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([shared])
-        .mockImplementationOnce(() => {
-          requestStarted.resolve()
-          return heldResult.promise
-        })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          Item,
-          string | number,
-          never,
-          QueryCollectionUtils<Item, string | number, Item, unknown>
-        >({
-          ...queryCollectionOptions<Item>({
-            id,
-            queryClient,
-            queryKey: [id],
-            queryFn,
-            getKey: (item) => item.id,
-            syncMode,
-            persistedGcTime: Number.POSITIVE_INFINITY,
-            startSync: true,
-          }),
-          persistence: { adapter: storage.adapter },
-        }),
-      )
-      cleanups.push(async () => {
-        storage.release()
-        heldResult.resolve([newer])
-        await collection.cleanup()
-        queryClient.clear()
-      })
-
-      if (syncMode === `eager`) await collection.stateWhenReady()
-      else await collection._sync.loadSubset({})
-      expect(collection.get(shared.id)?.name).toBe(shared.name)
-      expect(storedItems(storage)[0]?.name).toBe(shared.name)
-
-      const write = collection.utils.writeUpdate(manual)
-      await storage.entered
-      const refetch = queryClient.refetchQueries({ queryKey: [id] })
-      void refetch.catch(() => undefined)
-      await requestStarted.promise
-      expect(queryFn).toHaveBeenCalledTimes(2)
-
-      storage.release()
-      await write
-      expect({
-        public: collection.get(shared.id)?.name,
-        durable: storedItems(storage)[0]?.name,
-      }).toEqual({ public: manual.name, durable: manual.name })
-
-      heldResult.resolve([newer])
-      await refetch
-      expect({
-        public: collection.get(shared.id)?.name,
-        durable: storedItems(storage)[0]?.name,
-      }).toEqual({ public: newer.name, durable: newer.name })
-    },
-  )
-
-  /**
-   * The same law holds when the Query's current result is empty. An empty
-   * result is a resolved scope that owns no rows; it is not an unapplied
-   * result. The reference sequence is the first fetched result (no rows), the
-   * accepted Manual insert, and the later fetched Newer row. Starting the
-   * refetch repeats the empty cached success; it cannot remove the direct row
-   * or claim it.
-   *
-   * This sibling exists because the reacquisition table above makes a
-   * released lease's empty ownership entry distinguishable from an applied
-   * one. A repair that instead treats every empty ownership entry as
-   * unapplied passes that table and the non-empty history above. Here it
-   * replays the empty cached result at refetch start: in on-demand mode the
-   * insert disappears at its own receipt, and in eager mode the later Newer
-   * result does not replace Manual. The checkpoints and holds match the
-   * history above.
-   */
-  it.each([`eager`, `on-demand`] as const)(
-    `keeps an accepted persisted %s insert through a refetch start of an empty result`,
-    async (syncMode) => {
-      const id = `persisted-direct-insert-empty-refetch-start-${syncMode}`
-      const storage = createOwnershipStorage(undefined, 2)
-      const queryClient = createQueryClient()
-      const newer = { ...shared, name: `Newer` }
-      const manual = { ...shared, name: `Manual` }
-      const heldResult = createDeferred<Array<Item>>()
-      const requestStarted = createDeferred<void>()
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([])
-        .mockImplementationOnce(() => {
-          requestStarted.resolve()
-          return heldResult.promise
-        })
-      const collection = createCollection(
-        persistedCollectionOptions<
-          Item,
-          string | number,
-          never,
-          QueryCollectionUtils<Item, string | number, Item, unknown>
-        >({
-          ...queryCollectionOptions<Item>({
-            id,
-            queryClient,
-            queryKey: [id],
-            queryFn,
-            getKey: (item) => item.id,
-            syncMode,
-            persistedGcTime: Number.POSITIVE_INFINITY,
-            startSync: true,
-          }),
-          persistence: { adapter: storage.adapter },
-        }),
-      )
-      cleanups.push(async () => {
-        storage.release()
-        heldResult.resolve([newer])
-        await collection.cleanup()
-        queryClient.clear()
-      })
-      const observe = () => ({
-        public: collection.get(shared.id)?.name ?? null,
-        durable: storedItems(storage)[0]?.name ?? null,
-      })
-
-      if (syncMode === `eager`) await collection.stateWhenReady()
-      else await collection._sync.loadSubset({})
-      expect(observe()).toEqual({ public: null, durable: null })
-
-      const write = collection.utils.writeInsert(manual)
-      await storage.entered
-      const refetch = queryClient.refetchQueries({ queryKey: [id] })
-      void refetch.catch(() => undefined)
-      await requestStarted.promise
-      expect(queryFn).toHaveBeenCalledTimes(2)
-
-      storage.release()
-      await write
-      expect(observe()).toEqual({ public: manual.name, durable: manual.name })
-
-      heldResult.resolve([newer])
-      await refetch
-      expect(observe()).toEqual({ public: newer.name, durable: newer.name })
-    },
-  )
-
-  it(`rejects writes from an invalidated sync run and admits writes after restart`, async () => {
-    const id = `direct-write-cleanup-admission`
-    const storage = createOwnershipStorage()
-    const { collection } = createPersistedOwnershipFixture(
-      id,
-      storage,
-      [shared],
-      `eager`,
-    )
-    await collection.stateWhenReady()
-
-    const observe = async (write: () => Promise<void>) => {
-      try {
-        await write()
-        return `fulfilled` as const
-      } catch (error) {
-        expect(error).toBeInstanceOf(SyncNotInitializedError)
-        return `rejected` as const
-      }
-    }
-
-    const before = { ...shared, name: `Before cleanup` }
-    expect(await observe(() => collection.utils.writeUpdate(before))).toBe(
-      expectedDirectWriteAdmission(`current`),
-    )
-    expect(storage.snapshot().rows.get(shared.id)?.name).toBe(before.name)
-
-    const cleanup = collection.cleanup()
-    const late = { id: `late`, category: `direct`, name: `Late` }
-    const lateWrites = [
-      () => collection.utils.writeInsert(late),
-      () => collection.utils.writeUpdate({ ...shared, name: `Late update` }),
-      () => collection.utils.writeDelete(shared.id),
-      () => collection.utils.writeUpsert(late),
-      () =>
-        collection.utils.writeBatch(() => collection.utils.writeInsert(late)),
-    ]
-    for (const write of lateWrites) {
-      expect(await observe(write)).toBe(
-        expectedDirectWriteAdmission(`invalidated`),
-      )
-    }
-    await cleanup
-    expect(storage.snapshot().rows.has(late.id)).toBe(false)
-    expect(storage.snapshot().rows.get(shared.id)?.name).toBe(before.name)
-
-    const subscription = collection.subscribeChanges(() => {})
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-    await collection.stateWhenReady()
-    const restarted = {
-      id: `restarted`,
-      category: `direct`,
-      name: `Restarted`,
-    }
-    expect(await observe(() => collection.utils.writeInsert(restarted))).toBe(
-      expectedDirectWriteAdmission(`current`),
-    )
-    expect(storage.snapshot().rows.get(restarted.id)).toEqual(restarted)
-  })
-
-  it(`retains post-publication ownership through durable persistence`, async () => {
-    const id = `persisted-post-application-unload`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const sibling = { id: `b`, category: `result`, name: `B` }
-    const transient = { id: `c`, category: `result`, name: `C` }
-    const storage = createOwnershipStorage(undefined, 2)
-    const { collection, queryClient, queryFn } =
-      createPersistedOwnershipFixture(id, storage, [initial, sibling])
-    const createDerived = () =>
-      createLiveQueryCollection((query) =>
-        query.from({ item: collection }).select(({ item }) => ({ ...item })),
-      )
-    const firstDerived = createDerived()
-    let secondDerived: ReturnType<typeof createDerived> | undefined
-
-    try {
-      await firstDerived.preload()
-      expect(queryFn).toHaveBeenCalledOnce()
-      expect(itemIds(storage.snapshot().rows.values())).toEqual([
-        initial.id,
-        sibling.id,
-      ])
-
-      queryClient.setQueryData(queryKey, [initial, sibling, transient])
-      await storage.entered
-      expect({
-        synced: itemIds(collection._state.syncedData.values()),
-        derived: itemIds(firstDerived.toArray),
-        stored: itemIds(storage.snapshot().rows.values()),
-      }).toEqual({
-        synced: [initial.id, sibling.id, transient.id],
-        derived: [initial.id, sibling.id, transient.id],
-        stored: [initial.id, sibling.id],
-      })
-
-      await firstDerived.cleanup()
-      storage.release()
-      await vi.waitFor(() =>
-        expect(itemIds(storage.snapshot().rows.values())).toEqual([
-          initial.id,
-          sibling.id,
-          transient.id,
-        ]),
-      )
-
-      queryClient.removeQueries({ queryKey, exact: true })
-      secondDerived = createDerived()
-      await secondDerived.preload()
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-      await vi.waitFor(() => {
-        expect({
-          synced: itemIds(collection._state.syncedData.values()),
-          source: itemIds(collection.toArray),
-          derived: itemIds(secondDerived?.toArray ?? []),
-          stored: itemIds(storage.snapshot().rows.values()),
-        }).toEqual({
-          synced: [initial.id, sibling.id],
-          source: [initial.id, sibling.id],
-          derived: [initial.id, sibling.id],
-          stored: [initial.id, sibling.id],
-        })
-      })
-      expect(
-        persistedOwners(storage.snapshot().rowMetadata, transient.id),
-      ).toEqual([])
-    } finally {
-      storage.release()
-      await secondDerived?.cleanup()
-      if (firstDerived.status !== `cleaned-up`) await firstDerived.cleanup()
-    }
-  })
-
-  it(`keeps only the newest cache result when publication reenters application`, async () => {
-    const id = `reentrant-result-application`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const outer = { id: `b`, category: `result`, name: `B` }
-    const inner = { id: `c`, category: `result`, name: `C` }
-    const queryClient = createQueryClient()
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn: () => Promise.resolve([initial]),
-        getKey: (item) => item.id,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.stateWhenReady()
-    const publications: Array<Array<string>> = []
-    let injected = false
-    const subscription = collection.subscribeChanges(() => {
-      const ids = itemIds(collection.toArray)
-      publications.push(ids)
-      if (!injected && ids.includes(outer.id)) {
-        injected = true
-        queryClient.setQueryData(queryKey, [inner])
-      }
-    })
-    cleanups.push(async () => subscription.unsubscribe())
-
-    queryClient.setQueryData(queryKey, [outer])
-    await vi.waitFor(() => expect(itemIds(collection.toArray)).toEqual([`c`]))
-
-    expect(publications).toEqual([[`b`], [`c`]])
-    queryClient.setQueryData(queryKey, [])
-    await vi.waitFor(() => expect(collection.toArray).toEqual([]))
-  })
-
-  it(`retains a reentrant newer application failure for subset settlement`, async () => {
-    const id = `reentrant-result-failure`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `result`, name: `A` }
-    const outer = { id: `b`, category: `result`, name: `B` }
-    const invalid = { id: `invalid`, category: `result`, name: `Invalid` }
-    const applicationError = new Error(`newest result application failed`)
-    const queryClient = createQueryClient()
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn: () => Promise.resolve([initial]),
-        getKey: (item) => {
-          if (item.id === invalid.id) throw applicationError
-          return item.id
-        },
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      consoleError.mockRestore()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    let injected = false
-    let pendingWaiter: Promise<void> | undefined
-    const subscription = collection.subscribeChanges(() => {
-      if (!injected && collection.has(outer.id)) {
-        injected = true
-        queryClient.setQueryData(queryKey, [invalid])
-        pendingWaiter = expect(
-          Promise.resolve(collection._sync.loadSubset({})),
-        ).rejects.toBe(applicationError)
-        void pendingWaiter.catch(() => {})
-      }
-    })
-    cleanups.push(async () => subscription.unsubscribe())
-
-    queryClient.setQueryData(queryKey, [outer])
-    await vi.waitFor(() => expect(reportedError(collection)).toBeDefined())
-    await pendingWaiter
-    await expect(Promise.resolve(collection._sync.loadSubset({}))).rejects.toBe(
-      applicationError,
-    )
-  })
-
-  it(`retires mutation ownership when a later cache result is empty`, async () => {
-    const id = `mutation-ownership-replacement`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `mutation`, name: `A` }
-    const inserted = { id: `b`, category: `mutation`, name: `B` }
-    const serverRows = [initial]
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(serverRows)))
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (item) => item.id,
-        startSync: true,
-        onInsert: ({ transaction }) => {
-          serverRows.push(
-            ...transaction.mutations.map(({ modified }) =>
-              structuredClone(modified),
-            ),
-          )
-          return Promise.resolve()
-        },
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.stateWhenReady()
-    const mutation = collection.insert(inserted)
-    await mutation.isPersisted.promise
-    expect({
-      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-      synced: itemIds(collection._state.syncedData.values()),
-      source: itemIds(collection.toArray),
-    }).toEqual({ cache: [`a`, `b`], synced: [`a`, `b`], source: [`a`, `b`] })
-
-    queryClient.setQueryData(queryKey, [])
-    await vi.waitFor(() => {
-      expect({
-        cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-        synced: itemIds(collection._state.syncedData.values()),
-        source: itemIds(collection.toArray),
-      }).toEqual({ cache: [], synced: [], source: [] })
-    })
-  })
-
-  it(`publishes an authoritative delete after its mutation refetch`, async () => {
-    const id = `mutation-delete-publication`
-    const queryKey = [id] as const
-    const initial = { id: `a`, category: `mutation`, name: `A` }
-    const serverRows = [initial]
-    const queryClient = createQueryClient()
-    const preexistingRefetchResult = createDeferred<Array<Item>>()
-    const mutationRefetchResult = createDeferred<Array<Item>>()
-    const persistenceGate = createDeferred<void>()
-    const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
-    const commitRequests: Array<{
-      writes: Array<string>
-      receipt: `immediate` | `pending`
-      outcome?: `applied` | `aborted` | `rejected`
-    }> = []
-    const queryFn = vi
-      .fn<() => Promise<Array<Item>>>()
-      .mockResolvedValueOnce(structuredClone(serverRows))
-      .mockReturnValueOnce(preexistingRefetchResult.promise)
-      .mockReturnValueOnce(mutationRefetchResult.promise)
-    const baseOptions = queryCollectionOptions<Item>({
-      id,
-      queryClient,
-      queryKey,
-      queryFn,
-      getKey: (item) => item.id,
-      startSync: true,
-      onDelete: async ({ transaction }) => {
-        await persistenceGate.promise
-        const deleted = new Set(
-          transaction.mutations.map(({ original }) => original.id),
-        )
-        serverRows.splice(
-          0,
-          serverRows.length,
-          ...serverRows.filter(({ id: rowId }) => !deleted.has(rowId)),
-        )
-      },
-    })
-    const originalSync = baseOptions.sync
-    const collection = createCollection({
-      ...baseOptions,
-      sync: {
-        sync: (params: Parameters<typeof originalSync.sync>[0]) => {
-          let writes: Array<string> = []
-          return originalSync.sync({
-            ...params,
-            metadata: recordMetadata(params.metadata!, metadata),
-            begin: () => {
-              writes = []
-              return params.begin()
-            },
-            write: (change) => {
-              writes.push(change.type)
-              params.write(change)
-            },
-            commit: (signal) => {
-              const result = params.commit(signal)
-              const request: (typeof commitRequests)[number] = {
-                writes: [...writes],
-                receipt: result === true ? `immediate` : `pending`,
-              }
-              commitRequests.push(request)
-              if (result === true) {
-                request.outcome = `applied`
-              } else {
-                void result.then(
-                  () => {
-                    request.outcome = `applied`
-                  },
-                  (error) => {
-                    request.outcome = isCancelledError(error)
-                      ? `aborted`
-                      : `rejected`
-                  },
-                )
-              }
-              return result
-            },
-          })
-        },
-      },
-    })
-    const derived = createLiveQueryCollection((query) =>
-      query.from({ item: collection }).select(({ item }) => ({
-        id: item.id,
-        category: item.category,
-        name: item.name,
-      })),
-    )
-    const capture = (): MutationLifecycleSnapshot => ({
-      server: itemIds(serverRows),
-      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
-      synced: itemIds(collection._state.syncedData.values()),
-      source: itemIds(collection.toArray),
-      derived: itemIds(derived.toArray),
-    })
-    const publications: Array<MutationLifecycleSnapshot> = []
-    const subscription = derived.subscribeChanges(() => {
-      publications.push(capture())
-    })
-    cleanups.push(async () => {
-      persistenceGate.resolve()
-      preexistingRefetchResult.resolve([])
-      mutationRefetchResult.resolve([])
-      subscription.unsubscribe()
-      await derived.cleanup()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await derived.preload()
-    expectMutationLifecycleSnapshot(
-      capture(),
-      [initial.id],
-      [initial.id],
-      false,
-    )
-
-    const preexistingRefetch = collection.utils.refetch({ throwOnError: true })
-    void preexistingRefetch.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-
-    const mutation = collection.delete(initial.id)
-    expect(itemIds(collection.toArray)).toEqual([])
-    expect(itemIds(derived.toArray)).toEqual([])
-
-    persistenceGate.resolve()
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    mutationRefetchResult.resolve([])
-    await mutation.isPersisted.promise
-
-    expect(queryFn).toHaveBeenCalledTimes(3)
-    expect(commitRequests.some(({ writes }) => writes.includes(`delete`))).toBe(
-      true,
-    )
-    expect(commitRequests.some(({ receipt }) => receipt === `pending`)).toBe(
-      true,
-    )
-    expect(metadata.writes).toContainEqual({ type: `delete`, key: initial.id })
-    await vi.waitFor(() =>
-      expect(commitRequests.every(({ outcome }) => outcome !== undefined)).toBe(
-        true,
-      ),
-    )
-    expectMutationLifecycleSnapshot(capture(), [], [], false)
-    expect(publications.at(-1)?.source).toEqual([])
-    expect(publications.at(-1)?.derived).toEqual([])
-  })
-
-  it(`keeps cached rows until the final exact acquisition is released`, async () => {
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `shared-acquisition`,
-      results: [[shared, detailOnly]],
-    })
-    const subset = { where: categoryIn(`shared`, `detail`) }
-
-    await collection._sync.loadSubset(subset)
-    await collection._sync.loadSubset(subset)
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
-
-    collection._sync.unloadSubset(subset)
-    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
-    collection._sync.unloadSubset(subset)
-    expect(rows(collection)).toEqual([])
-
-    await collection._sync.loadSubset(subset)
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
-  })
-
-  it(`removes only rows whose final query owner is released`, async () => {
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `overlapping-acquisitions`,
-      results: [
-        [shared, detailOnly],
-        [shared, listOnly],
-      ],
-    })
-    const detail = { where: categoryIn(`shared`, `detail`) }
-    const list = { where: categoryIn(`shared`, `list`) }
-
-    await collection._sync.loadSubset(detail)
-    await collection._sync.loadSubset(list)
-    expect(rows(collection)).toEqual([detailOnly.id, listOnly.id, shared.id])
-
-    collection._sync.unloadSubset(detail)
-    expect(rows(collection)).toEqual([listOnly.id, shared.id])
-    await collection._sync.loadSubset(detail)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(rows(collection)).toEqual([detailOnly.id, listOnly.id, shared.id])
-
-    collection._sync.unloadSubset(list)
-    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
-  })
-
-  it.each([`remount`, `refetch`] as const)(
-    `keeps eager rows idle after cache removal and recovers on %s`,
-    async (action) => {
-      const id = `eager-lifetime-owner`
-      const { collection, queryClient, queryFn } = createOwnershipFixture({
-        id,
-        syncMode: `eager`,
-        results: [[shared], [{ ...shared, name: `Refetched` }]],
-      })
-      await collection.stateWhenReady()
-      const subscription = collection.subscribeChanges(() => {})
-      subscription.unsubscribe()
-
-      queryClient.removeQueries({ queryKey: [id], exact: true })
-
-      expect(rows(collection)).toEqual([shared.id])
-      await Promise.resolve()
-      expect(queryFn).toHaveBeenCalledOnce()
-
-      const remounted =
-        action === `remount` ? collection.subscribeChanges(() => {}) : undefined
-      if (action === `refetch`) await collection.utils.refetch()
-      await vi.waitFor(() => {
-        expect(queryFn).toHaveBeenCalledTimes(2)
-        expect(collection.get(shared.id)?.name).toBe(`Refetched`)
-      })
-      remounted?.unsubscribe()
-    },
-  )
-
-  // Request data is reusable; each invocation still creates its own owner.
-  // Cross startup with reference reuse and partial retirement, not only the
-  // already-started observer path tested above.
-  it.each(
-    [2, 3].flatMap((owners) =>
-      [false, true].flatMap((sharedReference) =>
-        [0, 1, owners].map((retired) => ({
-          owners,
-          sharedReference,
-          retired,
-        })),
-      ),
-    ),
-  )(
-    `preserves startup ownership for $owners calls, shared reference $sharedReference, $retired retired`,
-    async ({ owners, sharedReference, retired }) => {
-      const id = `startup-owner-history`
-      const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-      const queryHash = hashKey([id, getLoadSubsetDemandKey(subset)])
-      const { collection, queryFn } = createOwnershipFixture({
-        id,
-        results: [[shared]],
-        setupMetadata: (metadata) =>
-          metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-            queryHash,
-            mode: `until-revalidated`,
-          }),
-      })
-      collection.startSyncImmediate()
-      const requests = Array.from({ length: owners }, () =>
-        sharedReference ? subset : { ...subset },
-      )
-      const results = Promise.allSettled(
-        requests.map((request) => collection._sync.loadSubset(request)),
-      )
-      for (const request of requests.slice(0, retired)) {
-        collection._sync.unloadSubset(request)
-      }
-      const outcomes = await results
-      const live = owners - retired
-      expect(
-        outcomes.filter((outcome) => outcome.status === `fulfilled`),
-      ).toHaveLength(live)
-      const failures = outcomes.filter(
-        (outcome) => outcome.status === `rejected`,
-      )
-      expect(failures).toHaveLength(retired)
-      for (const failure of failures) {
-        expect(failure.reason).toMatchObject({ name: `AbortError` })
-      }
-      expect(queryFn).toHaveBeenCalledTimes(live > 0 ? 1 : 0)
-      const observedRows = () =>
-        collection.toArray.map(({ id: rowId, category, name }) => ({
-          id: rowId,
-          category,
-          name,
-        }))
-      expect(observedRows()).toEqual(live > 0 ? [shared] : [])
-      for (let index = retired; index < owners; index++) {
-        collection._sync.unloadSubset(requests[index]!)
-        expect(observedRows()).toEqual(index + 1 < owners ? [shared] : [])
-      }
-    },
-  )
-
-  it.each([false, true])(
-    `replaces an active eager cache entry with custom hash %s`,
-    async (customHash) => {
-      const id = `active-eager-custom-hash-${customHash}`
-      const { collection, queryClient, queryFn } = createOwnershipFixture({
-        id,
-        customHash,
-        syncMode: `eager`,
-        results: [[shared], [{ ...shared, name: `Replaced` }]],
-      })
-      await collection.stateWhenReady()
-      const subscription = collection.subscribeChanges(() => {})
-      try {
-        queryClient.removeQueries({ queryKey: [id], exact: true })
-        for (let turn = 0; turn < 20; turn++) await Promise.resolve()
-        expect(queryFn).toHaveBeenCalledTimes(2)
-        expect(collection.get(shared.id)?.name).toBe(`Replaced`)
-      } finally {
-        subscription.unsubscribe()
-      }
-    },
-  )
-
-  it.each(
-    [false, true].flatMap((mounted) =>
-      [false, true].flatMap((customHash) =>
-        [false, true].map((rejectOld) => ({ mounted, customHash, rejectOld })),
-      ),
-    ),
-  )(
-    `replaces a removed pending eager refetch without reviving idle demand: %j`,
-    async ({ mounted, customHash, rejectOld }) => {
-      const old = createDeferred<Array<Item>>()
-      const next = createDeferred<Array<Item>>()
-      const id = `pending-eager-removal`
-      const { collection, queryClient, queryFn } = createOwnershipFixture({
-        id,
-        customHash,
-        syncMode: `eager`,
-        results: [[shared], old.promise, next.promise],
-      })
-      await collection.stateWhenReady()
-      let subscription = collection.subscribeChanges(() => {})
-      if (!mounted) subscription.unsubscribe()
-      let settled = false
-      const refetch = collection.utils.refetch({ throwOnError: true }).then(
-        () => {
-          settled = true
-        },
-        (error: unknown) => {
-          settled = true
-          return error
-        },
-      )
-      try {
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-        queryClient.removeQueries({ queryKey: [id], exact: true })
-        for (let turn = 0; turn < 30; turn++) await Promise.resolve()
-        expect(queryFn).toHaveBeenCalledTimes(mounted ? 3 : 2)
-        expect(collection.get(shared.id)?.name).toBe(`Shared`)
-        if (!mounted) subscription = collection.subscribeChanges(() => {})
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-        next.resolve([{ ...shared, name: `Current` }])
-        await vi.waitFor(() =>
-          expect(collection.get(shared.id)?.name).toBe(`Current`),
-        )
-        if (rejectOld) old.reject(new Error(`retired request failed`))
-        else old.resolve([{ ...shared, name: `Obsolete` }])
-        await vi.waitFor(() => expect(settled).toBe(true))
-        expect(isCancelledError(await refetch)).toBe(true)
-        expect(collection.get(shared.id)?.name).toBe(`Current`)
-        expect(queryFn).toHaveBeenCalledTimes(3)
-        expect(collection.status).toBe(`ready`)
-      } finally {
-        old.resolve([shared])
-        next.resolve([shared])
-        subscription.unsubscribe()
-      }
-    },
-  )
-
-  it.each(
-    [0, Number.POSITIVE_INFINITY].flatMap((staleTime) =>
-      [false, true].map((customHash) => ({ staleTime, customHash })),
-    ),
-  )(
-    `starts only the requested fetch for an idle eager observer: %j`,
-    async ({ staleTime, customHash }) => {
-      const { collection, queryFn } = createOwnershipFixture({
-        id: `idle-explicit-refetch`,
-        syncMode: `eager`,
-        staleTime,
-        customHash,
-        results: [[shared]],
-      })
-      await collection.stateWhenReady()
-      queryFn.mockResolvedValue([{ ...shared, name: `Refetched` }])
-      const subscription = collection.subscribeChanges(() => {})
-      subscription.unsubscribe()
-      for (let turn = 0; turn < 30; turn++) await Promise.resolve()
-      const before = queryFn.mock.calls.length
-      const [result] = await collection.utils.refetch({ throwOnError: true })
-      expect(queryFn).toHaveBeenCalledTimes(before + 1)
-      expect(collection.subscriberCount).toBe(0)
-      expect((result?.data as Array<Item>)[0]?.name).toBe(`Refetched`)
-      expect(collection.get(shared.id)?.name).toBe(`Refetched`)
-    },
-  )
-
-  it.each([`release`, `cleanup`, `retain`] as const)(
-    `honors %s during startup retention maintenance`,
-    async (action) => {
-      const id = `released-startup-retention`
-      const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-      const key = `queryCollection:gc:${hashKey([id, getLoadSubsetDemandKey(subset)])}`
-      const { collection, queryFn } = createOwnershipFixture({
-        id,
-        results: [[shared]],
-        setupMetadata: (metadata) =>
-          metadata.collection.set(key, {
-            queryHash: hashKey([id, getLoadSubsetDemandKey(subset)]),
-            mode: `until-revalidated`,
-          }),
-      })
-      collection.startSyncImmediate()
-      const result = Promise.resolve(collection._sync.loadSubset(subset)).then(
-        () => `ready`,
-        (error: unknown) => error,
-      )
-      if (action === `release`) collection._sync.unloadSubset(subset)
-      if (action === `cleanup`) await collection.cleanup()
-      for (let turn = 0; turn < 30; turn++) await Promise.resolve()
-      if (action === `retain`) {
-        expect(queryFn).toHaveBeenCalledTimes(1)
-        await expect(result).resolves.toBe(`ready`)
-        expect(collection.size).toBe(1)
-      } else {
-        expect(queryFn).not.toHaveBeenCalled()
-        await expect(result).resolves.toMatchObject({ name: `AbortError` })
-        expect(collection.size).toBe(0)
-      }
-    },
-  )
-
-  it.each([false, true])(
-    `removes owned cache entries on cleanup with custom hash %s`,
-    async (customHash) => {
-      const id = `cleanup-custom-${customHash}`
-      const { collection, queryClient } = createOwnershipFixture({
-        id,
-        customHash,
-        syncMode: `eager`,
-        results: [[shared]],
-      })
-      await collection.stateWhenReady()
-      expect(queryClient.getQueryCache().getAll()).toHaveLength(1)
-      await collection.cleanup()
-      expect(queryClient.getQueryCache().getAll()).toHaveLength(0)
-    },
-  )
-
-  it(`settles an unfinished load when its final owner leaves`, async () => {
-    const pending = createDeferred<Array<Item>>()
-    const { collection } = createOwnershipFixture({
-      id: `release-before-result`,
-      results: [pending.promise],
-    })
-    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-    let outcome: unknown = `pending`
-    const load = Promise.resolve(collection._sync.loadSubset(subset)).then(
-      () => {
-        outcome = `ready`
-      },
-      (error: unknown) => {
-        outcome = error
-      },
-    )
-    try {
-      expect(collection.isLoadingSubset).toBe(true)
-      collection._sync.unloadSubset(subset)
-      for (let turn = 0; turn < 20; turn++) await Promise.resolve()
-      expect(outcome).toMatchObject({ name: `AbortError` })
-      expect(collection.isLoadingSubset).toBe(false)
-      await load
-    } finally {
-      pending.resolve([shared])
-    }
-  })
-
-  it(`keeps active on-demand rows when the Query cache entry departs`, async () => {
-    const id = `active-cache-removal`
-    const { collection, queryClient } = createOwnershipFixture({
-      id,
-      results: [[shared]],
-    })
-    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-    await collection._sync.loadSubset(subset)
-
-    queryClient.removeQueries({ queryKey: [id] })
-    expect(rows(collection)).toEqual([shared.id])
-
-    collection._sync.unloadSubset(subset)
-    expect(rows(collection)).toEqual([])
-  })
-
-  it(`keeps an inactive scoped cache isolated from another scope's manual write`, async () => {
-    const id = `inactive-scoped-cache-isolation`
-    const queryClient = createQueryClient()
-    const sourceRows = new Map<string, Item>([
-      [`1`, { id: `1`, category: `A`, name: `Category A` }],
-      [`2`, { id: `2`, category: `B`, name: `Category B` }],
-    ])
-    const expectedByCategory = new Map<string, Array<string>>()
-    const providerCalls: Array<string> = []
-    let manualWrites = 0
-    let remountReached = false
-    let comparisonCount = 0
-
-    const recomputeCategory = (category: string): Array<string> =>
-      Array.from(sourceRows.values())
-        .filter((row) => row.category === category)
-        .map((row) => row.id)
-        .sort()
-
-    expectedByCategory.set(`A`, recomputeCategory(`A`))
-    expectedByCategory.set(`B`, recomputeCategory(`B`))
-
-    const queryFn = vi.fn((context: QueryFunctionContext) => {
-      const where = context.meta?.loadSubsetOptions?.where
-      const operands = where?.type === `func` ? where.args : []
-      const categoryRef = operands.find(
-        (operand) =>
-          operand.type === `ref` &&
-          operand.path.length === 1 &&
-          operand.path[0] === `category`,
-      )
-      const categoryValue = operands.find(
-        (operand) =>
-          operand.type === `val` && typeof operand.value === `string`,
-      )
-      if (
-        where?.type !== `func` ||
-        where.name !== `eq` ||
-        operands.length !== 2 ||
-        categoryRef?.type !== `ref` ||
-        categoryValue?.type !== `val` ||
-        typeof categoryValue.value !== `string`
-      ) {
-        throw new Error(`Category fixture received an unsupported request`)
-      }
-
-      const category = categoryValue.value
-      providerCalls.push(category)
-      return Promise.resolve(
-        Array.from(sourceRows.values(), (row) => structuredClone(row)).filter(
-          (row) => row.category === category,
-        ),
-      )
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const createCategoryQuery = (category: string) =>
-      createLiveQueryCollection({
-        query: (query) =>
-          query
-            .from({ item: collection })
-            .where(({ item }) => eq(item.category, category)),
-      })
-
-    type CategoryQuery = ReturnType<typeof createCategoryQuery>
-    let inactiveCategoryA: CategoryQuery | undefined
-    let activeCategoryB: CategoryQuery | undefined
-    let remountedCategoryA: CategoryQuery | undefined
-
-    try {
-      inactiveCategoryA = createCategoryQuery(`A`)
-      await inactiveCategoryA.preload()
-      expect(rows(inactiveCategoryA)).toEqual(expectedByCategory.get(`A`))
-      await inactiveCategoryA.cleanup()
-      inactiveCategoryA = undefined
-
-      activeCategoryB = createCategoryQuery(`B`)
-      await activeCategoryB.preload()
-      expect(rows(activeCategoryB)).toEqual(expectedByCategory.get(`B`))
-
-      const added = { id: `3`, category: `B`, name: `New category B` }
-      sourceRows.set(added.id, structuredClone(added))
-      expectedByCategory.set(`B`, recomputeCategory(`B`))
-      manualWrites++
-      collection.utils.writeUpsert(structuredClone(added))
-      const cacheEntriesAfterManualWrite = queryClient
-        .getQueryCache()
-        .findAll({ queryKey: [id] }).length
-
-      remountedCategoryA = createCategoryQuery(`A`)
-      await remountedCategoryA.preload()
-      remountReached = true
-
-      expect(providerCalls.slice(0, 2)).toEqual([`A`, `B`])
-      expect(manualWrites).toBe(1)
-      expect(remountReached).toBe(true)
-      comparisonCount++
-      expect(rows(remountedCategoryA)).toEqual(expectedByCategory.get(`A`))
-      expect(comparisonCount).toBe(1)
-      expect(cacheEntriesAfterManualWrite).toBe(1)
-      expect(providerCalls.filter((category) => category === `A`)).toHaveLength(
-        2,
-      )
-    } finally {
-      await remountedCategoryA?.cleanup()
-      await activeCategoryB?.cleanup()
-      await inactiveCategoryA?.cleanup()
-    }
-  })
-
-  /**
-   * A direct insert changes the Collection independently of Query result
-   * ownership. The previous direct-write contract permits this surgical
-   * change even though the adapter cannot infer a subset owner for the row.
-   * In this legal history, the fetched row belongs to one loaded subset and
-   * the direct row belongs to no subset. The independent expected-key set
-   * removes only the fetched row when that subset unloads. The production
-   * driver uses the public write utilities and a real QueryClient; after the
-   * accepted write, unload, and explicit delete, compare public Collection
-   * keys and provider calls. This does not promise a bounded lifetime for an
-   * unowned direct row that the caller never deletes.
-   */
-  it(`keeps a direct insert after its queried subset unloads`, async () => {
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `direct-insert-without-query-owner`,
-      results: [[shared]],
-    })
-    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-    const inserted = { id: `direct`, category: `shared`, name: `Direct` }
-    const expectedKeys = new Set([shared.id])
-
-    await collection._sync.loadSubset(subset)
-    await collection.utils.writeInsert(inserted)
-    expectedKeys.add(inserted.id)
-    expect(rows(collection)).toEqual([...expectedKeys].sort())
-
-    collection._sync.unloadSubset(subset)
-    expectedKeys.delete(shared.id)
-    expect(rows(collection)).toEqual([...expectedKeys].sort())
-    expect(queryFn).toHaveBeenCalledOnce()
-
-    await collection.utils.writeDelete(inserted.id)
-    expectedKeys.delete(inserted.id)
-    expect(rows(collection)).toEqual([...expectedKeys].sort())
-  })
-
-  /**
-   * An explicit complete scoped result settles a directly inserted row in its
-   * scope. The independent reference first accepts the surgical insert, then
-   * replaces that scope with the empty server result at refetch settlement.
-   * Ordinary subset unload above is distinct: it supplies no new server fact.
-   */
-  it(`removes an ownerless on-demand insert after an empty explicit refetch`, async () => {
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `on-demand-direct-insert-empty-refetch`,
-      results: [[], []],
-    })
-    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-    await collection._sync.loadSubset(subset)
-    await collection.utils.writeInsert(shared)
-    expect(rows(collection)).toEqual([shared.id])
-
-    await collection.utils.refetch({ throwOnError: true })
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(rows(collection)).toEqual([])
-  })
-
-  /**
-   * The reference treats only a successful, complete result for a row's
-   * predicate as evidence that an omitted direct row is gone. A disjoint
-   * predicate, a limited/offset/cursor window, and a failed request provide
-   * no such fact.
-   * Nonempty omission rejects an implementation that recognizes only empty
-   * results. Each history compares public rows at refetch settlement.
-   */
-  it.each([
-    {
-      history: `complete-nonempty`,
-      category: `shared`,
-      window: {},
-      removes: true,
-    },
-    { history: `disjoint`, category: `other`, window: {}, removes: false },
-    {
-      history: `limited`,
-      category: `shared`,
-      window: { limit: 1 },
-      removes: false,
-    },
-    {
-      history: `offset`,
-      category: `shared`,
-      window: { offset: 1 },
-      removes: false,
-    },
-    {
-      history: `cursor`,
-      category: `shared`,
-      window: {
-        cursor: {
-          whereFrom: eq(new IR.PropRef([`id`]), `other`),
-          whereCurrent: eq(new IR.PropRef([`id`]), `other`),
-          lastKey: `other`,
-        },
-      },
-      removes: false,
-    },
-  ] as const)(
-    `reconciles an ownerless direct row after a $history refetch`,
-    async ({ history, category, window, removes }) => {
-      const other = { id: `other`, category, name: `Other` }
-      const { collection, queryFn } = createOwnershipFixture({
-        id: `ownerless-refetch-${history}`,
-        results: [[], [other]],
-      })
-      const subset = {
-        where: eq(new IR.PropRef([`category`]), category),
-        ...window,
-      }
-      await collection._sync.loadSubset(subset)
-      await collection.utils.writeInsert(shared)
-      await collection.utils.refetch({ throwOnError: true })
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(rows(collection)).toEqual(
-        removes ? [other.id] : [other.id, shared.id],
-      )
-    },
-  )
-
-  /**
-   * An empty provider response is not evidence of global absence. The
-   * reference keeps an ownerless direct row when the complete predicate is
-   * disjoint or the request covers only a window. The provider has no server
-   * rows, so each empty response is a legal result for its request. Compare
-   * public keys when the explicit refetch has applied.
-   */
-  it.each([
-    {
-      history: `disjoint-empty`,
-      where: eq(new IR.PropRef([`category`]), `other`),
-      window: {},
-    },
-    {
-      history: `offset-empty`,
-      where: eq(new IR.PropRef([`category`]), `shared`),
-      window: { offset: 1 },
-    },
-    {
-      history: `cursor-empty`,
-      where: eq(new IR.PropRef([`category`]), `shared`),
-      window: {
-        cursor: {
-          whereFrom: eq(new IR.PropRef([`id`]), `other`),
-          whereCurrent: eq(new IR.PropRef([`id`]), `other`),
-          lastKey: `other`,
-        },
-      },
-    },
-  ] as const)(
-    `keeps an ownerless direct row after a $history refetch`,
-    async ({ history, where, window }) => {
-      const { collection, queryFn } = createOwnershipFixture({
-        id: `ownerless-${history}`,
-        results: [[], []],
-      })
-      const subset = { where, ...window }
-      await collection._sync.loadSubset(subset)
-      await collection.utils.writeInsert(shared)
-      await collection.utils.refetch({ throwOnError: true })
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(rows(collection)).toEqual([shared.id])
-    },
-  )
-
-  /**
-   * A compound predicate remains a scope boundary. The independent rule
-   * evaluates both conjuncts on the accepted direct row before deciding
-   * whether a complete empty result can retire it.
-   */
-  it.each([
-    { history: `matching`, id: shared.id, removes: true },
-    { history: `disjoint`, id: `other`, removes: false },
-  ] as const)(
-    `reconciles a direct row after a $history compound-scope refetch`,
-    async ({ history, id, removes }) => {
-      const { collection, queryFn } = createOwnershipFixture({
-        id: `ownerless-compound-${history}`,
-        results: [[], []],
-      })
-      const subset = {
-        where: new IR.Func(`and`, [
-          eq(new IR.PropRef([`category`]), `shared`),
-          eq(new IR.PropRef([`id`]), id),
-        ]),
-      }
-      await collection._sync.loadSubset(subset)
-      await collection.utils.writeInsert(shared)
-      await collection.utils.refetch({ throwOnError: true })
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(rows(collection)).toEqual(removes ? [] : [shared.id])
-    },
-  )
-
-  /** A failed response provides no complete scope and cannot retire a row. */
-  it(`keeps an ownerless direct row when explicit refetch fails`, async () => {
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `ownerless-failed-refetch`,
-      results: [[]],
-    })
-    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-    await collection._sync.loadSubset(subset)
-    await collection.utils.writeInsert(shared)
-    queryFn.mockRejectedValueOnce(new Error(`source unavailable`))
-    await expect(
-      collection.utils.refetch({ throwOnError: true }),
-    ).rejects.toThrow(`source unavailable`)
-    expect(rows(collection)).toEqual([shared.id])
-  })
-
-  /**
-   * An eager refetch is a complete source snapshot. A direct insert changes
-   * the public row set without fetching, but a later explicit refetch with an
-   * empty server result removes that key. The independent reference replaces
-   * its full row set with the returned snapshot at refetch settlement. This
-   * crosses the public write/refetch path and compares both rows and requests.
-   */
-  it(`reconciles an eager direct insert against a later empty refetch`, async () => {
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `eager-direct-insert-refetch`,
-      results: [[], []],
-      syncMode: `eager`,
-    })
-    await collection.preload()
-    expect(rows(collection)).toEqual([])
-    await collection.utils.writeInsert(shared)
-    expect(rows(collection)).toEqual([shared.id])
-    await collection.utils.refetch()
-    expect(rows(collection)).toEqual([])
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * A direct eager insert need not inherit the prior fetched result's owner.
-   * The next complete provider snapshot can claim that same key and replace
-   * its value; a following empty snapshot removes it. The independent eager
-   * reference replaces its full row set at each explicit refetch settlement.
-   */
-  it(`claims and later removes an eager direct insert through server snapshots`, async () => {
-    const server = { ...shared, name: `Server` }
-    const { collection, queryFn } = createOwnershipFixture({
-      id: `eager-direct-insert-later-claim`,
-      results: [[], [server], []],
-      syncMode: `eager`,
-    })
-    await collection.preload()
-    await collection.utils.writeInsert({ ...shared, name: `Direct` })
-    expect(collection.get(shared.id)?.name).toBe(`Direct`)
-    await collection.utils.refetch()
-    expect(collection.get(shared.id)?.name).toBe(`Server`)
-    await collection.utils.refetch()
-    expect(collection.has(shared.id)).toBe(false)
-    expect(queryFn).toHaveBeenCalledTimes(3)
-  })
-
-  /**
-   * A fetched row lifetime has one or more subset claims. A direct update
-   * preserves them; a direct delete ends that lifetime and all its claims.
-   * Inserting or upserting the same key after the delete creates an unowned
-   * lifetime. A later provider result can claim it again. The reference below
-   * uses only these row-lifetime rules, not Query cache or ownership helpers.
-   *
-   * The bounded legal grammar crosses one/two overlapping subset owners,
-   * in-memory/persisted metadata, and update, delete, reinsert, upsert, and
-   * refetch-after-reinsert. The driver uses real QueryClient and public write
-   * utilities. The independent claim set records demand indices, then maps
-   * those indices to the documented static on-demand Query key for metadata
-   * comparison. It compares public rows and exact accepted owner identities
-   * after each action and release; forgetting ownership on any write fails the
-   * update lane, while retaining a deleted lifetime fails the reinsert lane.
-   */
-  it.each(
-    ([1, 2] as const).flatMap((ownerCount) =>
-      ([false, true] as const).flatMap((withMetadata) =>
-        (
-          [
-            `update`,
-            `delete`,
-            `delete-insert`,
-            `delete-upsert`,
-            `delete-insert-refetch`,
-          ] as const
-        ).map((history) => ({ ownerCount, withMetadata, history })),
-      ),
-    ),
-  )(
-    `tracks a direct row lifetime through $history with $ownerCount owners and metadata=$withMetadata`,
-    async ({ ownerCount, withMetadata, history }) => {
-      const id = `direct-row-lifetime-${ownerCount}-${withMetadata}-${history}`
-      const replacement = { ...shared, name: `Reinserted` }
-      const serverReplacement = { ...shared, name: `Server result` }
-      const initialResults = Array.from({ length: ownerCount }, () => [shared])
-      const laterResults = Array.from({ length: ownerCount }, () => [
-        serverReplacement,
-      ])
-      const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
-      const { collection, queryFn } = createOwnershipFixture({
-        id,
-        results: [...initialResults, ...laterResults],
-        metadataRecorder: withMetadata ? metadata : undefined,
-      })
-      const demands = [categorySubset(`detail`), categorySubset(`list`)].slice(
-        0,
-        ownerCount,
-      )
-      const demandHashes = demands.map((demand) =>
-        hashKey([id, getLoadSubsetDemandKey(demand)]),
-      )
-      const claims = new Set<number>()
-      let expected: Item | undefined
-      let insertedDirectly = false
-      const observe = () => {
-        expect(collection.get(shared.id)?.name).toBe(expected?.name)
-        expect(rows(collection)).toEqual(expected ? [shared.id] : [])
-        if (withMetadata)
-          expect(
-            persistedOwners(collection._state.syncedMetadata, shared.id),
-          ).toEqual([...claims].map((index) => demandHashes[index]!).sort())
-      }
-      for (const [index, demand] of demands.entries()) {
-        await collection._sync.loadSubset(demand)
-        claims.add(index)
-        expected = shared
-        insertedDirectly = false
-        observe()
-      }
-      if (history === `update`) {
-        await collection.utils.writeUpdate({ id: shared.id, name: `Updated` })
-        expected = { ...shared, name: `Updated` }
-        observe()
-      } else {
-        await collection.utils.writeDelete(shared.id)
-        expected = undefined
-        claims.clear()
-        insertedDirectly = false
-        observe()
-        if (history !== `delete`) {
-          if (history === `delete-upsert`)
-            await collection.utils.writeUpsert(replacement)
-          else await collection.utils.writeInsert(replacement)
-          expected = replacement
-          insertedDirectly = true
-          observe()
-        }
-      }
-      if (history === `delete-insert-refetch`) {
-        await collection.utils.refetch()
-        demands.forEach((_, index) => claims.add(index))
-        expected = serverReplacement
-        insertedDirectly = false
-        observe()
-      }
-      for (const [index, demand] of demands.entries()) {
-        collection._sync.unloadSubset(demand)
-        claims.delete(index)
-        if (claims.size === 0 && !insertedDirectly) expected = undefined
-        observe()
-      }
-      expect(queryFn).toHaveBeenCalledTimes(
-        ownerCount * (history === `delete-insert-refetch` ? 2 : 1),
-      )
-    },
-  )
-
-  /**
-   * A direct update preserves both subset claims in durable metadata. A fresh
-   * Collection over those stored rows can retire one claim after an empty
-   * result without losing the peer's row, then retire the final claim and the
-   * row. The reference is the authored set of two demand identities; each
-   * empty result removes only its own identity. Cloning the durable snapshot
-   * represents a new process without asking cleanup to retire the old run's
-   * active demands. Compare exact stored owners and public rows after each
-   * revalidation, not just their cardinality.
-   */
-  it(`retires overlapping persisted owners after a direct update and restart`, async () => {
-    const id = `direct-update-overlap-persisted-restart`
-    const first = categorySubset(`detail`)
-    const second = categorySubset(`list`)
-    const firstHash = hashKey([id, getLoadSubsetDemandKey(first)])
-    const secondHash = hashKey([id, getLoadSubsetDemandKey(second)])
-    const hotStorage = createOwnershipStorage()
-    const hot = createPersistedOwnershipFixture(id, hotStorage, [shared])
-
-    await hot.collection._sync.loadSubset(first)
-    await hot.collection._sync.loadSubset(second)
-    await hot.collection.utils.writeUpdate({ id: shared.id, name: `Updated` })
-    const durable = hotStorage.snapshot()
-    expect(durable.rows.get(shared.id)?.name).toBe(`Updated`)
-    expect(persistedOwners(durable.rowMetadata, shared.id)).toEqual(
-      [firstHash, secondHash].sort(),
-    )
-
-    const coldStorage = createOwnershipStorage(durable)
-    const cold = createPersistedOwnershipFixture(id, coldStorage, [])
-    await cold.collection._sync.loadSubset(first)
-    expect(cold.collection.get(shared.id)?.name).toBe(`Updated`)
-    expect(
-      persistedOwners(coldStorage.snapshot().rowMetadata, shared.id),
-    ).toEqual([secondHash])
-
-    await cold.collection._sync.loadSubset(second)
-    expect(cold.collection.has(shared.id)).toBe(false)
-    const settled = coldStorage.snapshot()
-    expect(settled.rows.has(shared.id)).toBe(false)
-    expect(persistedOwners(settled.rowMetadata, shared.id)).toEqual([])
-    expect(hot.queryFn).toHaveBeenCalledTimes(2)
-    expect(cold.queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * SQLite is the receiving boundary for the row-lifetime rule. A fetched
-   * lifetime ends at direct deletion; reinserting the key creates a durable
-   * unowned row. Releasing both old subset leases and restarting the Collection
-   * must not turn their retired claims into a deletion of that row.
-   */
-  it(`keeps a reinserted direct row across SQLite subset release and restart`, async () => {
-    const id = `direct-row-lifetime-sqlite-restart`
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const persistence = createNodeSQLitePersistence({
-      database: driver.getDatabase(),
-    })
-    const managed = persistence.resolvePersistenceForCollection!({
-      collectionId: id,
-      mode: `sync-present`,
-    })
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([shared]))
-    const makeCollection = (client: QueryClient, source: typeof queryFn) =>
-      createCollection(
-        persistedCollectionOptions<
-          Item,
-          string | number,
-          never,
-          QueryCollectionUtils<Item, string | number, Item, unknown>
-        >({
-          ...queryCollectionOptions<Item>({
-            id,
-            queryClient: client,
-            queryKey: [id],
-            queryFn: source,
-            getKey: (item) => item.id,
-            syncMode: `on-demand`,
-            startSync: true,
-          }),
-          persistence: managed,
-        }),
-      )
-    const collection = makeCollection(queryClient, queryFn)
-    const first = { limit: 1 }
-    const second = { limit: 2 }
-    const replacement = { ...shared, name: `Reinserted` }
-    const restart: {
-      collection?: ReturnType<typeof makeCollection>
-      client?: QueryClient
-    } = {}
-    cleanups.push(async () => {
-      await restart.collection?.cleanup()
-      await collection.cleanup()
-      queryClient.clear()
-      restart.client?.clear()
-      driver.close()
-    })
-
-    await collection._sync.loadSubset(first)
-    await collection._sync.loadSubset(second)
-    await collection.utils.writeDelete(shared.id)
-    await collection.utils.writeInsert(replacement)
-    collection._sync.unloadSubset(first)
-    collection._sync.unloadSubset(second)
-    expect(collection.get(shared.id)?.name).toBe(replacement.name)
-
-    await collection.cleanup()
-    restart.client = createQueryClient()
-    restart.collection = makeCollection(
-      restart.client,
-      vi.fn(() => Promise.resolve([])),
-    )
-    await restart.collection._sync.loadSubset(first)
-    expect(restart.collection.get(shared.id)?.name).toBe(replacement.name)
-  })
-
-  /**
-   * A fresh persisted run no longer has the writer's in-memory position, but
-   * an explicit complete source result still settles an omitted direct row.
-   * The reference has a durable insert followed by an empty complete-scope fetch:
-   * the row exists before that fetch and is absent when it applies. This is
-   * separate from the limited-window restart above, whose omission proves
-   * nothing about a row outside its window. A disjoint durable row remains
-   * stored because the filtered result says nothing about it. Its public
-   * visibility requires acquiring its own on-demand scope after restart.
-   */
-  it(`retires a persisted ownerless row after a complete empty result`, async () => {
-    const id = `persisted-ownerless-complete-result`
-    const disjoint = {
-      id: `persisted-disjoint`,
-      category: `other`,
-      name: `Other`,
-    }
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    const persistence = createNodeSQLitePersistence({
-      database: driver.getDatabase(),
-    })
-    const managed = persistence.resolvePersistenceForCollection!({
-      collectionId: id,
-      mode: `sync-present`,
-    })
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([] as Array<Item>))
-    const makeCollection = (client: QueryClient) =>
-      createCollection(
-        persistedCollectionOptions<
-          Item,
-          string | number,
-          never,
-          QueryCollectionUtils<Item, string | number, Item, unknown>
-        >({
-          ...queryCollectionOptions<Item>({
-            id,
-            queryClient: client,
-            queryKey: [id],
-            queryFn,
-            getKey: (item) => item.id,
-            syncMode: `on-demand`,
-            startSync: true,
-          }),
-          persistence: managed,
-        }),
-      )
-    const first = makeCollection(queryClient)
-    const restart: { collection?: ReturnType<typeof makeCollection> } = {}
-    const secondClient = createQueryClient()
-    cleanups.push(async () => {
-      await restart.collection?.cleanup()
-      await first.cleanup()
-      queryClient.clear()
-      secondClient.clear()
-      driver.close()
-    })
-    await vi.waitFor(() => expect(first.status).toBe(`ready`))
-    await first.utils.writeInsert(shared)
-    await first.utils.writeInsert(disjoint)
-    expect(first.has(shared.id)).toBe(true)
-    expect(first.has(disjoint.id)).toBe(true)
-    await first.cleanup()
-    const claim = await managed.adapter.claimCacheGeneration!(id)
-    try {
-      const durable = await managed.adapter.loadResumeSnapshot({
-        kind: `managed`,
-        storageCollectionId: claim.storageCollectionId,
-        claimId: claim.claimId,
-      })
-      expect(durable.rows.find((row) => row.key === shared.id)?.value).toEqual(
-        shared,
-      )
-      expect(
-        durable.rows.find((row) => row.key === disjoint.id)?.value,
-      ).toEqual(disjoint)
-    } finally {
-      await managed.adapter.releaseCacheGenerationClaim!(claim.claimId)
-    }
-    restart.collection = makeCollection(secondClient)
-    await restart.collection._sync.loadSubset({
-      where: eq(new IR.PropRef([`category`]), `shared`),
-    })
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(restart.collection.has(shared.id)).toBe(false)
-    const settledClaim = await managed.adapter.claimCacheGeneration!(id)
-    try {
-      const durable = await managed.adapter.loadResumeSnapshot({
-        kind: `managed`,
-        storageCollectionId: settledClaim.storageCollectionId,
-        claimId: settledClaim.claimId,
-      })
-      expect(durable.rows.some((row) => row.key === shared.id)).toBe(false)
-      expect(
-        durable.rows.find((row) => row.key === disjoint.id)?.value,
-      ).toEqual(disjoint)
-    } finally {
-      await managed.adapter.releaseCacheGenerationClaim!(settledClaim.claimId)
-    }
-  })
-
-  /**
-   * Direct writes previously promised to change the synced rows without an
-   * automatic Query refetch. The pre-#1826 user guide and QueryCollectionUtils
-   * API comments stated that promise. It lets a caller apply one server event
-   * without requesting every active subset again. A later, independently
-   * scheduled queryFn result may still replace the write.
-   *
-   * The independent reference filters the event-updated rows by category.
-   * The legal history loads ten disjoint live queries, then upserts, updates,
-   * deletes, inserts, and batches rows across their scopes. The production
-   * driver records real queryFn requests. After each accepted write, public
-   * rows must reflect the event and no new provider request may have started
-   * because of the write. This does not promise that direct writes
-   * maintain exact Query cache entries for arbitrary scoped or windowed
-   * requests; the caller controls that lower-level consistency risk.
-   */
-  it(`direct write changes one row without requesting active subsets`, async () => {
-    const id = `scoped-direct-write-work`
-    const queryClient = createQueryClient()
-    const categories = Array.from(
-      { length: 10 },
-      (_, index) => `category-${index}`,
-    )
-    const providerRows = new Map<string, Item>(
-      categories.map((category) => [
-        category,
-        { id: category, category, name: `Before` },
-      ]),
-    )
-    const providerCalls: Array<string> = []
-    const queryFn = vi.fn((context: QueryFunctionContext) => {
-      const where = context.meta?.loadSubsetOptions?.where
-      const category =
-        where?.type === `func`
-          ? where.args.find((arg) => arg.type === `val`)?.value
-          : undefined
-      if (typeof category !== `string`) {
-        throw new Error(`Expected an equality subset with a category`)
-      }
-      providerCalls.push(category)
-      return Promise.resolve(
-        [...providerRows.values()]
-          .filter((row) => row.category === category)
-          .map((row) => structuredClone(row)),
-      )
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    const liveQueries = categories.map((category) =>
-      createLiveQueryCollection({
-        query: (query) =>
-          query
-            .from({ item: collection })
-            .where(({ item }) => eq(item.category, category)),
-      }),
-    )
-    cleanups.push(async () => {
-      await Promise.all(liveQueries.map((query) => query.cleanup()))
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await Promise.all(liveQueries.map((query) => query.preload()))
-    expect(providerCalls).toHaveLength(categories.length)
-
-    const expectDirectWrite = async (write: () => Promise<void>) => {
-      const callsBeforeWrite = providerCalls.length
-      await write()
-      for (const [index, category] of categories.entries()) {
-        const expectedRows = [...providerRows.values()].filter(
-          (row) => row.category === category,
-        )
-        expect(
-          liveQueries[index]!.toArray.map((row) => row.name).sort(),
-        ).toEqual(expectedRows.map((row) => row.name).sort())
-      }
-      expect(providerCalls.slice(callsBeforeWrite)).toEqual([])
-    }
-
-    const changed = {
-      ...providerRows.get(categories[3]!)!,
-      name: `After`,
-    }
-    providerRows.set(changed.id, changed)
-    await expectDirectWrite(() =>
-      collection.utils.writeUpsert(structuredClone(changed)),
-    )
-
-    const updated = { ...changed, name: `Updated` }
-    providerRows.set(updated.id, updated)
-    await expectDirectWrite(() =>
-      collection.utils.writeUpdate({ id: updated.id, name: updated.name }),
-    )
-
-    providerRows.delete(updated.id)
-    await expectDirectWrite(() => collection.utils.writeDelete(updated.id))
-
-    const inserted = {
-      id: `inserted`,
-      category: categories[3]!,
-      name: `Inserted`,
-    }
-    providerRows.set(inserted.id, inserted)
-    await expectDirectWrite(() => collection.utils.writeInsert(inserted))
-
-    const batched = {
-      id: `batched`,
-      category: categories[4]!,
-      name: `Batched`,
-    }
-    const batchUpdated = {
-      ...providerRows.get(categories[4]!)!,
-      name: `Batch updated`,
-    }
-    providerRows.set(batched.id, batched)
-    providerRows.set(batchUpdated.id, batchUpdated)
-    await expectDirectWrite(() =>
-      collection.utils.writeBatch(() => {
-        collection.utils.writeInsert(batched)
-        collection.utils.writeUpdate({
-          id: batchUpdated.id,
-          name: batchUpdated.name,
-        })
-      }),
-    )
-  })
-
-  /**
-   * A direct delete cannot infer the row that fills a limited provider window.
-   * The independent source model slices eleven ordered rows to ten. Deleting
-   * the first row leaves nine cached rows under infinite stale time, even after
-   * reacquisition; an explicit refetch returns the next ten-row source slice.
-   * The public checkpoint is the row set and request count after each load and
-   * after refetch. This documents the lower-level API's exactness boundary.
-   */
-  it(`refills a directly shortened window only after explicit refetch`, async () => {
-    type Row = { id: string; rank: number }
-    const id = `direct-delete-window-refill`
-    const queryClient = createQueryClient()
-    const source = Array.from({ length: 11 }, (_, rank) => ({
-      id: String(rank),
-      rank,
-    }))
-    const queryFn = vi.fn((context: QueryFunctionContext) =>
-      Promise.resolve(
-        source
-          .slice(0, context.meta?.loadSubsetOptions?.limit ?? source.length)
-          .map((row) => ({ ...row })),
-      ),
-    )
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        staleTime: Infinity,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const demand = { limit: 10 }
-    await collection._sync.loadSubset(demand)
-    expect(rows(collection)).toEqual(
-      source
-        .slice(0, 10)
-        .map((row) => row.id)
-        .sort(),
-    )
-    source.shift()
-    await collection.utils.writeDelete(`0`)
-    expect(rows(collection)).toHaveLength(9)
-    collection._sync.unloadSubset(demand)
-    await collection._sync.loadSubset(demand)
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(rows(collection)).toHaveLength(9)
-    await collection.utils.refetch()
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(rows(collection)).toEqual(
-      source
-        .slice(0, 10)
-        .map((row) => row.id)
-        .sort(),
-    )
-  })
-
-  /**
-   * A deferred refresh barrier is legal during offline replay. It delays
-   * application of fetched data, but it does not turn a direct write into a
-   * request. No Query request is in flight in this history, so the independent
-   * reference keeps the accepted event row. The history loads one on-demand
-   * Query, holds the barrier, writes, then releases it. It observes public
-   * rows and real queryFn calls after the accepted write and barrier release;
-   * it does not model the full OfflineExecutor.
-   */
-  it(`does not refetch a direct write after a deferred refresh barrier`, async () => {
-    const id = `deferred-direct-write-no-refetch`
-    const initial = { id: `row`, category: `A`, name: `Before` }
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([structuredClone(initial)]))
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    const barrier = createDeferred<void>()
-    const release = barrier.promise.finally(() => {
-      collection.deferDataRefresh = null
-    })
-    cleanups.push(async () => {
-      barrier.resolve()
-      await release
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    expect(queryFn).toHaveBeenCalledTimes(1)
-    collection.deferDataRefresh = barrier.promise
-    await collection.utils.writeUpdate({ id: initial.id, name: `After` })
-    expect(collection.get(initial.id)?.name).toBe(`After`)
-    expect(queryFn).toHaveBeenCalledTimes(1)
-
-    barrier.resolve()
-    await release
-    for (let turn = 0; turn < 20; turn++) await Promise.resolve()
-    expect(queryFn).toHaveBeenCalledTimes(1)
-    expect(collection.get(initial.id)?.name).toBe(`After`)
-  })
-
-  /**
-   * A directly selected array is a writable part of the Query response.
-   * Unlike a derived projection, replacing this property preserves the
-   * envelope. The authored response predicts both the changed row and the
-   * unchanged metadata after an accepted on-demand direct write.
-   */
-  it(`patches a directly selected on-demand cache array without refetching`, async () => {
-    const id = `direct-select-direct-write`
-    const initial = { id: `row`, category: `A`, name: `Before` }
-    const response = { items: [initial], pageInfo: { hasNextPage: false } }
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
-    const collection = createCollection(
-      queryCollectionOptions({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        select: (value: typeof response) => value.items,
-        getKey: (item: Item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    await collection.utils.writeUpdate({ id: initial.id, name: `After` })
-
-    expect(queryClient.getQueryData([id])).toEqual({
-      items: [{ ...initial, name: `After` }],
-      pageInfo: response.pageInfo,
-    })
-    expect(collection.get(initial.id)?.name).toBe(`After`)
-    expect(queryFn).toHaveBeenCalledTimes(1)
-  })
-
-  /**
-   * A derived select reads rows from an envelope but gives no inverse for a
-   * direct cache write. The documented edges-to-nodes projection is legal.
-   * A direct write may leave its Query cache row stale, but the cached value
-   * must remain a valid response for select. The response shape is the
-   * independent reference; the driver loads it through a real QueryClient,
-   * then checks the cache, public Collection row, and request count after the
-   * accepted write. This does not require an inverse projection.
-   */
-  it(`keeps a derived selected cache response valid after a direct write`, async () => {
-    const id = `derived-select-direct-write`
-    const initial = { id: `row`, category: `A`, name: `Before` }
-    const response = {
-      edges: [{ cursor: `cursor-1`, node: initial }],
-      pageInfo: { hasNextPage: false },
-    }
-    const select = (value: typeof response) =>
-      value.edges.map((edge) => edge.node)
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
-    const collection = createCollection(
-      queryCollectionOptions({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        select,
-        getKey: (item: Item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    expect(queryClient.getQueryData([id])).toEqual(response)
-    await collection.utils.writeUpdate({ id: initial.id, name: `After` })
-
-    const cached = queryClient.getQueryData<typeof response>([id])!
-    expect(cached.edges).toEqual([
-      expect.objectContaining({
-        cursor: `cursor-1`,
-        node: expect.objectContaining({ id: initial.id }),
-      }),
-    ])
-    expect(select(cached)).toEqual([
-      expect.objectContaining({ id: initial.id }),
-    ])
-    expect(collection.get(initial.id)?.name).toBe(`After`)
-    expect(queryFn).toHaveBeenCalledTimes(1)
-  })
-
-  /**
-   * A direct write is local to its Collection until a provider result says
-   * otherwise. Two Collections may own one physical Query, but that shared
-   * cache cannot carry A's accepted local row into B. The reference has one
-   * server row and two Collection row sets: writing A changes only A. Compare
-   * both public rows and the shared cache immediately after the write, before
-   * any newer provider result can legitimately update B.
-   */
-  it.each(
-    ([`update`, `delete`, `upsert`] as const).flatMap((operation) =>
-      ([`A-first`, `B-first`] as const).map((loadOrder) => ({
-        operation,
-        loadOrder,
-      })),
-    ),
-  )(
-    `keeps a $operation out of another Collection sharing its Query ($loadOrder)`,
-    async ({ operation, loadOrder }) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`shared-direct-write-isolation`]
-      const server = { id: `x`, name: `Server` }
-      const queryFn = vi.fn(() => Promise.resolve([{ ...server }]))
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const ownerA = makeCollection(`shared-direct-write-owner-a`)
-      const ownerB = makeCollection(`shared-direct-write-owner-b`)
-      cleanups.push(async () => {
-        await ownerA.cleanup()
-        await ownerB.cleanup()
-        queryClient.clear()
-      })
-
-      const first = loadOrder === `A-first` ? ownerA : ownerB
-      const second = loadOrder === `A-first` ? ownerB : ownerA
-      await first._sync.loadSubset({})
-      await second._sync.loadSubset({})
-      expect(queryFn).toHaveBeenCalledTimes(1)
-      if (operation === `delete`) await ownerA.utils.writeDelete(server.id)
-      else if (operation === `upsert`)
-        await ownerA.utils.writeUpsert({ id: server.id, name: `Manual` })
-      else await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
-      expect(ownerA.get(server.id)?.name).toBe(
-        operation === `delete` ? undefined : `Manual`,
-      )
-      expect(ownerB.get(server.id)?.name).toBe(`Server`)
-      expect(queryClient.getQueryData(queryKey)).toEqual([server])
-      expect(queryFn).toHaveBeenCalledTimes(1)
-    },
-  )
-
-  /**
-   * Eager Collections project one shared Query cache. A direct cache write
-   * changes that projection for both Collections without starting a request.
-   * The independent reference applies each write to the shared row set, then
-   * compares both public Collections and the Query cache at write settlement.
-   */
-  it.each([`update`, `delete`, `upsert`] as const)(
-    `projects an eager $0 through a Query shared by two Collections`,
-    async (operation) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`shared-eager-direct-${operation}`]
-      const server = { id: `x`, name: `Server` }
-      const queryFn = vi.fn(() => Promise.resolve([server]))
-      const makeCollection = (suffix: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id: `shared-eager-direct-${operation}-${suffix}`,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `eager`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`a`)
-      const b = makeCollection(`b`)
-      cleanups.push(async () => {
-        await a.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-      })
-
-      await Promise.all([a.preload(), b.preload()])
-      expect(queryFn).toHaveBeenCalledOnce()
-      if (operation === `delete`) await a.utils.writeDelete(server.id)
-      else if (operation === `upsert`)
-        await a.utils.writeUpsert({ id: server.id, name: `Manual` })
-      else await a.utils.writeUpdate({ id: server.id, name: `Manual` })
-      expect(a.get(server.id)?.name).toBe(
-        operation === `delete` ? undefined : `Manual`,
-      )
-      expect(b.get(server.id)?.name).toBe(
-        operation === `delete` ? undefined : `Manual`,
-      )
-      expect(queryClient.getQueryData(queryKey)).toEqual(
-        operation === `delete` ? [] : [{ id: server.id, name: `Manual` }],
-      )
-      expect(queryFn).toHaveBeenCalledOnce()
-    },
-  )
-
-  /**
-   * A new direct key joins the shared eager cache and both projections. A
-   * later complete server response that omits the key retires it in both.
-   */
-  it(`projects an eager new-key insert until a later complete fetch`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`shared-eager-new-key`]
-    const server = { id: `x`, name: `Server` }
-    const queryFn = vi.fn(() => Promise.resolve([server]))
-    const makeCollection = (suffix: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id: `shared-eager-new-key-${suffix}`,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `eager`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`a`)
-    const b = makeCollection(`b`)
-    cleanups.push(async () => {
-      await a.cleanup()
-      await b.cleanup()
-      queryClient.clear()
-    })
-
-    await Promise.all([a.preload(), b.preload()])
-    expect(queryFn).toHaveBeenCalledOnce()
-    await a.utils.writeInsert({ id: `y`, name: `Manual` })
-    expect(a.get(`y`)?.name).toBe(`Manual`)
-    expect(b.get(`y`)?.name).toBe(`Manual`)
-    expect(queryClient.getQueryData(queryKey)).toEqual([
-      server,
-      { id: `y`, name: `Manual` },
-    ])
-    expect(queryFn).toHaveBeenCalledOnce()
-
-    await b.utils.refetch({ throwOnError: true })
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(a.has(`y`)).toBe(false)
-    expect(b.has(`y`)).toBe(false)
-    expect(a.get(`x`)?.name).toBe(server.name)
-    expect(b.get(`x`)?.name).toBe(server.name)
-  })
-
-  /**
-   * A shared eager cache projects A's direct write to both Collections. The
-   * older request must not undo that accepted value in either projection;
-   * a later-started complete fetch can replace it in both.
-   */
-  it(`preserves an eager direct write across an older shared fetch`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`shared-eager-older-fetch`]
-    const server = { id: `x`, name: `Server` }
-    const older = { id: `x`, name: `Older` }
-    const newer = { id: `x`, name: `Newer` }
-    const held = createDeferred<Array<Row>>()
-    const started = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([server])
-      .mockImplementationOnce(() => {
-        started.resolve()
-        return held.promise
-      })
-      .mockResolvedValue([newer])
-    const makeCollection = (suffix: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id: `shared-eager-older-fetch-${suffix}`,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `eager`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`a`)
-    const b = makeCollection(`b`)
-    cleanups.push(async () => {
-      held.resolve([older])
-      await a.cleanup()
-      await b.cleanup()
-      queryClient.clear()
-    })
-
-    await Promise.all([a.preload(), b.preload()])
-    const refetch = b.utils.refetch({ throwOnError: true })
-    await started.promise
-    await a.utils.writeUpdate({ id: server.id, name: `Manual` })
-    expect(a.get(server.id)?.name).toBe(`Manual`)
-    expect(b.get(server.id)?.name).toBe(`Manual`)
-    held.resolve([older])
-    await refetch
-    expect(a.get(server.id)?.name).toBe(`Manual`)
-    expect(b.get(server.id)?.name).toBe(`Manual`)
-
-    await b.utils.refetch({ throwOnError: true })
-    expect(queryFn).toHaveBeenCalledTimes(3)
-    expect(a.get(server.id)?.name).toBe(newer.name)
-    expect(b.get(server.id)?.name).toBe(newer.name)
-  })
-
-  /**
-   * A later eager Collection projects the shared cache's direct edit without
-   * requiring a new fetch. A subsequent explicit fetch replaces that cached
-   * value in both Collections. The reference keeps cache projection separate
-   * from server freshness and compares both rows and request count.
-   */
-  it(`projects an eager cache patch on later acquisition`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`late-eager-direct-patch`]
-    const server = { id: `x`, name: `Server` }
-    const newer = { id: `x`, name: `Newer` }
-    const held = createDeferred<Array<Row>>()
-    const requestStarted = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([server])
-      .mockImplementationOnce(() => {
-        requestStarted.resolve()
-        return held.promise
-      })
-    const makeCollection = (suffix: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id: `late-eager-direct-${suffix}`,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `eager`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`a`)
-    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
-    cleanups.push(async () => {
-      held.resolve([newer])
-      await a.cleanup()
-      await peer.collection?.cleanup()
-      queryClient.clear()
-    })
-
-    await a.preload()
-    await a.utils.writeUpdate({ id: server.id, name: `Manual` })
-    expect(queryClient.getQueryData(queryKey)).toEqual([
-      { id: server.id, name: `Manual` },
-    ])
-    peer.collection = makeCollection(`b`)
-    const b = peer.collection
-    await b.preload()
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(b.get(server.id)?.name).toBe(`Manual`)
-    expect(a.get(server.id)?.name).toBe(`Manual`)
-    const refetch = b.utils.refetch({ throwOnError: true })
-    await requestStarted.promise
-    expect(b.get(server.id)?.name).toBe(`Manual`)
-    held.resolve([newer])
-    await refetch
-    expect(b.get(server.id)?.name).toBe(newer.name)
-    expect(a.get(server.id)?.name).toBe(newer.name)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * A disabled Query never starts its own request. Eager B can project the
-   * shared cache edit immediately; on-demand B still waits for server
-   * authority under its separate subset ownership law, including after an
-   * outside setQueryData edit. Explicit refetch remains available in both
-   * modes and later replaces the cached value.
-   */
-  it.each([
-    { syncMode: `eager`, externalCacheEdit: false },
-    { syncMode: `on-demand`, externalCacheEdit: false },
-    { syncMode: `on-demand`, externalCacheEdit: true },
-  ] as const)(
-    `respects disabled $syncMode acquisition of a shared Query with external cache edit=$externalCacheEdit`,
-    async ({ syncMode, externalCacheEdit }) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`disabled-late-peer-${syncMode}-${externalCacheEdit}`]
-      const server = { id: `x`, name: `Server` }
-      const newer = { id: `x`, name: `Newer` }
-      const held = createDeferred<Array<Row>>()
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([server])
-        .mockImplementationOnce(() => held.promise)
-      const makeCollection = (suffix: string, enabled: boolean) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id: `disabled-late-peer-${syncMode}-${suffix}`,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode,
-            enabled,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`a`, true)
-      const peer: { collection?: ReturnType<typeof makeCollection> } = {}
-      cleanups.push(async () => {
-        held.resolve([newer])
-        await a.cleanup()
-        await peer.collection?.cleanup()
-        queryClient.clear()
-      })
-
-      if (syncMode === `eager`) await a.preload()
-      else await a._sync.loadSubset({})
-      await a.utils.writeUpdate({ id: server.id, name: `Manual` })
-      if (externalCacheEdit)
-        queryClient.setQueryData(queryKey, [{ ...server, name: `Manual` }])
-      peer.collection = makeCollection(`b`, false)
-      const b = peer.collection
-      const load =
-        syncMode === `eager`
-          ? b.preload()
-          : Promise.resolve(b._sync.loadSubset({}))
-      let loadState: `pending` | `fulfilled` | `rejected` = `pending`
-      void load.then(
-        () => (loadState = `fulfilled`),
-        () => (loadState = `rejected`),
-      )
-      for (let turn = 0; turn < 4; turn++) await Promise.resolve()
-      expect(queryFn).toHaveBeenCalledOnce()
-      expect(b.get(server.id)?.name).toBe(
-        syncMode === `eager` ? `Manual` : undefined,
-      )
-      expect(loadState).toBe(syncMode === `eager` ? `fulfilled` : `pending`)
-
-      const refetch = b.utils.refetch({ throwOnError: true })
-      held.resolve([newer])
-      await Promise.all([load, refetch])
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(b.get(server.id)?.name).toBe(newer.name)
-      expect(a.get(server.id)?.name).toBe(newer.name)
-    },
-  )
-
-  /**
-   * An eager direct write can seed an idle shared Query before any provider
-   * fetch. A disabled B projects that seed without starting a request. The
-   * next explicit refetch can replace it with the server row.
-   */
-  it(`projects an eager direct cache seed to a disabled peer`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`disabled-eager-seed-peer`]
-    const direct = { id: `x`, name: `Manual` }
-    const server = { id: `x`, name: `Server` }
-    const held = createDeferred<Array<Row>>()
-    const queryFn = vi.fn(() => held.promise)
-    const makeCollection = (suffix: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id: `disabled-eager-seed-peer-${suffix}`,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `eager`,
-          enabled: false,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`a`)
-    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
-    cleanups.push(async () => {
-      held.resolve([server])
-      await a.cleanup()
-      await peer.collection?.cleanup()
-      queryClient.clear()
-    })
-
-    await a.utils.writeInsert(direct)
-    expect(a.get(direct.id)?.name).toBe(direct.name)
-    expect(queryClient.getQueryData(queryKey)).toEqual([direct])
-    peer.collection = makeCollection(`b`)
-    const b = peer.collection
-    const load = b.preload()
-    for (let turn = 0; turn < 4; turn++) await Promise.resolve()
-    expect(queryFn).not.toHaveBeenCalled()
-    await load
-    expect(b.get(direct.id)?.name).toBe(direct.name)
-
-    const refetch = b.utils.refetch({ throwOnError: true })
-    expect(queryFn).toHaveBeenCalledOnce()
-    held.resolve([server])
-    await refetch
-    expect(b.get(direct.id)?.name).toBe(server.name)
-    expect(a.get(direct.id)?.name).toBe(server.name)
-  })
-
-  /**
-   * An eager Query is one keyed cache document projected by both Collections.
-   * A direct write changes its authored key in that document; a peer's later
-   * direct write changes only its own authored key, even if that peer has not
-   * yet applied the first cache notification. The independent reference folds
-   * A's write then B's write over the two server rows. Holding B's result
-   * application keeps its accepted rows stale at B's write, distinguishing a
-   * surgical cache edit from replacing the cache with B's whole row snapshot.
-   * The same-key neighbor requires the later accepted write to win. Compare
-   * the shared cache and unblocked A projection after B's accepted write, while
-   * B's result application remains held. Neither write starts a request.
-   */
-  it.each([`disjoint`, `same-key`] as const)(
-    `composes $0 eager direct writes through one shared Query`,
-    async (writeOrder) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`shared-eager-write-composition`, writeOrder]
-      const server = [
-        { id: `x`, name: `Server X` },
-        { id: `y`, name: `Server Y` },
-      ]
-      const queryFn = vi.fn(() => Promise.resolve(server))
-      const makeCollection = (suffix: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id: `shared-eager-write-composition-${writeOrder}-${suffix}`,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `eager`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`a`)
-      const b = makeCollection(`b`)
-      const barrier = createDeferred<void>()
-      cleanups.push(async () => {
-        b.deferDataRefresh = null
-        barrier.resolve()
-        await a.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-      })
-
-      await Promise.all([a.preload(), b.preload()])
-      expect(queryFn).toHaveBeenCalledOnce()
-      b.deferDataRefresh = barrier.promise
-      await a.utils.writeUpdate({ id: `x`, name: `A` })
-      expect(b.get(`x`)?.name).toBe(`Server X`)
-      const bKey = writeOrder === `disjoint` ? `y` : `x`
-      await b.utils.writeUpdate({ id: bKey, name: `B` })
-      expect(b.get(bKey)?.name).toBe(`B`)
-      if (writeOrder === `disjoint`) expect(b.get(`x`)?.name).toBe(`Server X`)
-
-      const expected = [
-        { id: `x`, name: writeOrder === `disjoint` ? `A` : `B` },
-        { id: `y`, name: writeOrder === `disjoint` ? `B` : `Server Y` },
-      ]
-      expect(queryClient.getQueryData(queryKey)).toEqual(expected)
-      expect(queryFn).toHaveBeenCalledOnce()
-      await vi.waitFor(() => {
-        expect([a.get(`x`)?.name, a.get(`y`)?.name]).toEqual(
-          expected.map((row) => row.name),
-        )
-      })
-      expect(queryFn).toHaveBeenCalledOnce()
-    },
-  )
-
-  /**
-   * Directly selected response arrays carry the same shared-Query law as raw
-   * arrays. The response envelope is part of the cache contract, while each
-   * Collection's accepted rows can lag behind a held notification. Folding
-   * two disjoint writes over the response checks both row composition and
-   * preservation of unrelated envelope metadata without a provider request.
-   */
-  it(`composes eager peer writes inside a selected response array`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`shared-eager-wrapped-composition`]
-    const server = [
-      { id: `x`, name: `Server X` },
-      { id: `y`, name: `Server Y` },
-    ]
-    const queryFn = vi.fn(() => Promise.resolve({ items: server, tag: `keep` }))
-    const makeCollection = (id: string) =>
-      createCollection(
-        queryCollectionOptions({
-          id,
-          queryClient,
-          queryKey,
-          queryFn,
-          select: (response) => response.items,
-          getKey: (row: Row) => row.id,
-          syncMode: `eager`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`shared-eager-wrapped-a`)
-    const b = makeCollection(`shared-eager-wrapped-b`)
-    const barrier = createDeferred<void>()
-    cleanups.push(async () => {
-      b.deferDataRefresh = null
-      barrier.resolve()
-      await a.cleanup()
-      await b.cleanup()
-      queryClient.clear()
-    })
-
-    await Promise.all([a.preload(), b.preload()])
-    b.deferDataRefresh = barrier.promise
-    await a.utils.writeUpdate({ id: `x`, name: `A` })
-    await b.utils.writeUpdate({ id: `y`, name: `B` })
-    const expected = [
-      { id: `x`, name: `A` },
-      { id: `y`, name: `B` },
-    ]
-    expect(queryClient.getQueryData(queryKey)).toEqual({
-      items: expected,
-      tag: `keep`,
-    })
-    await vi.waitFor(() => {
-      expect([a.get(`x`)?.name, a.get(`y`)?.name]).toEqual([`A`, `B`])
-    })
-    expect(queryFn).toHaveBeenCalledOnce()
-  })
-
-  /**
-   * B owns a shared on-demand Query while A has no subset owner. The Query
-   * Collection guide's on-demand cache rule protects another Collection's
-   * owned Query: A's direct insert changes only A's accepted row and starts
-   * no provider request. A later physical fetch may replace that row when A
-   * acquires the cached result, as the guide's shared-key rule permits.
-   *
-   * The reference is the authored server row, A-only insert, and newer server
-   * row in that order. The first public-row and cache checkpoint rejects a
-   * shared-cache guard that runs only when the writing Collection owns a row.
-   * The final checkpoint distinguishes that guard from a rule that refuses
-   * all later server authority.
-   */
-  it(`keeps an unacquired direct insert out of another Collection's shared Query`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`shared-unacquired-direct-insert`]
-    const server = { id: `x`, name: `Server` }
-    const newer = { id: `x`, name: `Newer` }
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([server])
-      .mockResolvedValue([newer])
-    const makeCollection = (id: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const ownerA = makeCollection(`shared-unacquired-insert-a`)
-    const ownerB = makeCollection(`shared-unacquired-insert-b`)
-    cleanups.push(async () => {
-      await ownerA.cleanup()
-      await ownerB.cleanup()
-      queryClient.clear()
-    })
-
-    await ownerB._sync.loadSubset({})
-    expect(ownerB.get(server.id)?.name).toBe(server.name)
-    expect(ownerA.has(server.id)).toBe(false)
-    await ownerA.utils.writeInsert({ id: server.id, name: `Manual` })
-    expect(ownerA.get(server.id)?.name).toBe(`Manual`)
-    expect(ownerB.get(server.id)?.name).toBe(server.name)
-    expect(queryClient.getQueryData(queryKey)).toEqual([server])
-    expect(queryFn).toHaveBeenCalledOnce()
-
-    await ownerB.utils.refetch({ throwOnError: true })
-    expect(ownerA.get(server.id)?.name).toBe(`Manual`)
-    expect(ownerB.get(server.id)?.name).toBe(newer.name)
-    await ownerA._sync.loadSubset({})
-    expect(ownerA.get(server.id)?.name).toBe(newer.name)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * A Collection that acquires a Query after another Collection's direct
-   * cache patch must not mistake that local edit for a server result. The
-   * reference starts with one server row, then gives only A the direct update.
-   * B's first acquisition may request a new result; while that request is
-   * held, B has no server-confirmed copy of A's value. A post-write result
-   * may then replace A's write in both Collections. Constructing B before or
-   * after the write varies registration without changing this authority law.
-   * The driver checks public rows, cache data, and provider calls at each cut.
-   */
-  it.each([`registered`, `later-created`] as const)(
-    `does not adopt another Collection's cached direct edit on later acquisition: %s`,
-    async (peerTiming) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`late-shared-direct-edit-${peerTiming}`]
-      const server = { id: `x`, name: `Server` }
-      const newer = { id: `x`, name: `Newer` }
-      const held = createDeferred<Array<Row>>()
-      const requestStarted = createDeferred<void>()
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([server])
-        .mockImplementationOnce(() => {
-          requestStarted.resolve()
-          return held.promise
-        })
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const ownerA = makeCollection(`late-shared-a-${peerTiming}`)
-      let ownerB =
-        peerTiming === `registered`
-          ? makeCollection(`late-shared-b-${peerTiming}`)
-          : undefined
-      cleanups.push(async () => {
-        held.resolve([newer])
-        await ownerA.cleanup()
-        await ownerB?.cleanup()
-        queryClient.clear()
-      })
-
-      await ownerA._sync.loadSubset({})
-      expect(ownerA.get(server.id)?.name).toBe(server.name)
-      await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
-      expect(ownerA.get(server.id)?.name).toBe(`Manual`)
-      expect(queryClient.getQueryData(queryKey)).toEqual([
-        { id: server.id, name: `Manual` },
-      ])
-      expect(queryFn).toHaveBeenCalledOnce()
-
-      ownerB ??= makeCollection(`late-shared-b-${peerTiming}`)
-      const load = Promise.resolve(ownerB._sync.loadSubset({}))
-      void load.catch(() => undefined)
-      const first = await Promise.race([
-        load.then(
-          () => `settled`,
-          () => `rejected`,
-        ),
-        requestStarted.promise.then(() => `request-started`),
-      ])
-      expect(first).toBe(`request-started`)
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(ownerB.has(server.id)).toBe(false)
-      held.resolve([newer])
-      await load
-      expect(ownerB.get(server.id)?.name).toBe(newer.name)
-      expect(ownerA.get(server.id)?.name).toBe(newer.name)
-    },
-  )
-
-  /**
-   * Query Core may assign a Collection key the physical Query created for a
-   * different stored key when a custom hash aliases them. The cache is the
-   * source of that Query's rows; a direct write to a different row cannot
-   * evict the foreign stored key or turn its old row into a fresh fetch. The
-   * reference keeps the ownerless direct y across subset release and keeps
-   * the foreign physical Query. Its cached x has not been verified by a
-   * physical fetch for this Collection, so disabled reacquisition waits until
-   * an explicit refetch returns the server row. This distinguishes retaining
-   * the cache entry from incorrectly treating it as fresh authority.
-   */
-  it(`retains a foreign stored key under a custom Query hash after a direct write`, async () => {
-    type Row = { id: string; name: string }
-    const foreignKey = [`foreign-stored-key`]
-    const baseKey = [`collection-stored-key`]
-    const queryClient = new QueryClient({
-      defaultOptions: {
-        queries: {
-          queryKeyHashFn: () => `shared-hash`,
-          staleTime: Infinity,
-          gcTime: Infinity,
-          retry: false,
-        },
-      },
-    })
-    queryClient.setQueryData(foreignKey, [{ id: `x`, name: `Cached` }])
-    const physicalQuery = queryClient.getQueryCache().getAll()[0]!
-    const queryFn = vi.fn(() => Promise.resolve([{ id: `x`, name: `Server` }]))
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id: `foreign-stored-key-collection`,
-        queryClient,
-        queryKey: () => baseKey,
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        enabled: false,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    expect(collection.get(`x`)?.name).toBe(`Cached`)
-    await collection.utils.writeInsert({ id: `y`, name: `Manual` })
-    collection._sync.unloadSubset({})
-    const reacquisition = Promise.resolve(collection._sync.loadSubset({}))
-    let settled = false
-    void reacquisition.then(() => (settled = true))
-    for (let turn = 0; turn < 5; turn++) await Promise.resolve()
-    expect(settled).toBe(false)
-    expect(collection.get(`y`)?.name).toBe(`Manual`)
-    expect(queryClient.getQueryCache().getAll()).toContain(physicalQuery)
-    expect(physicalQuery.queryKey).toEqual(foreignKey)
-    expect(queryFn).not.toHaveBeenCalled()
-    await collection.utils.refetch({ throwOnError: true })
-    await reacquisition
-    expect(collection.get(`x`)?.name).toBe(`Server`)
-    expect(collection.has(`y`)).toBe(false)
-    expect(queryFn).toHaveBeenCalledOnce()
-  })
-
-  /**
-   * A reset may reuse a Query's numeric data-update count. The independent
-   * authority rule distinguishes the physical provider result from A's local
-   * cache patch: B must ignore the patch while waiting, then apply the new
-   * provider row even when reset gives it the patch's old count. The driver
-   * observes B's pending load before the result and its settlement afterward.
-   */
-  it.each([`new-response`, `same-reference`] as const)(
-    `settles a shared Query acquisition after reset reuses a cache edit version: %s`,
-    async (responseIdentity) => {
-      type Row = { id: string; name: string }
-      const queryKey = [`shared-reset-cache-version`]
-      const queryClient = createQueryClient()
-      const replacement = createDeferred<Array<Row>>()
-      const abandoned = createDeferred<Array<Row>>()
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([{ id: `x`, name: `Initial` }])
-        .mockImplementationOnce(() => abandoned.promise)
-        .mockImplementationOnce(() => replacement.promise)
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`shared-reset-a`)
-      const b = makeCollection(`shared-reset-b`)
-      cleanups.push(async () => {
-        abandoned.resolve([])
-        replacement.resolve([])
-        await a.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-      })
-
-      await a._sync.loadSubset({})
-      await a.utils.writeUpdate({ id: `x`, name: `Manual` })
-      const query = queryClient.getQueryCache().find({ queryKey, exact: true })!
-      const editedCacheData = query.state.data as Array<Row>
-      expect(query.state.dataUpdateCount).toBe(1)
-      const acquisition = Promise.resolve(b._sync.loadSubset({}))
-      void acquisition.catch(() => undefined)
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-      expect(b.has(`x`)).toBe(false)
-
-      const reset = queryClient.resetQueries({ queryKey, exact: true })
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-      const expected =
-        responseIdentity === `same-reference`
-          ? editedCacheData
-          : [{ id: `x`, name: `After reset` }]
-      replacement.resolve(expected)
-      await reset
-      await vi.waitFor(() => expect(b.get(`x`)?.name).toBe(expected[0]?.name))
-      await acquisition
-      expect(query.state.dataUpdateCount).toBe(1)
-    },
-  )
-
-  /**
-   * Query Core notifies observers before its cache success listener. A direct
-   * write made by a foreign observer in that gap is still a local cache edit,
-   * not part of the successful provider response. The independent account
-   * gives A the direct value and leaves B without a confirmed row until a
-   * third physical request settles. The held B request distinguishes fetched
-   * response identity from the mutable Query state seen by the cache listener.
-   */
-  it(`does not certify a reentrant direct cache edit as a fetched result`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`reentrant-success-direct-edit`]
-    const server = { id: `x`, name: `Server` }
-    const older = { id: `x`, name: `Older` }
-    const newer = { id: `x`, name: `Newer` }
-    const held = createDeferred<Array<Row>>()
-    const requestStarted = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([server])
-      .mockResolvedValueOnce([older])
-      .mockImplementationOnce(() => {
-        requestStarted.resolve()
-        return held.promise
-      })
-    const makeCollection = (id: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`reentrant-success-a`)
-    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
-    const outside = new QueryObserver(queryClient, {
-      queryKey,
-      queryFn,
-      enabled: false,
-      notifyOnChangeProps: `all`,
-    })
-    let directWrite: Promise<unknown> | undefined
-    const unsubscribe = outside.subscribe((result) => {
-      if (
-        result.isSuccess &&
-        !result.isFetching &&
-        result.data?.[0]?.name === older.name &&
-        !directWrite
-      ) {
-        directWrite = Promise.resolve(
-          a.utils.writeUpdate({ id: server.id, name: `Manual` }),
-        )
-      }
-    })
-    cleanups.push(async () => {
-      held.resolve([newer])
-      unsubscribe()
-      await a.cleanup()
-      await peer.collection?.cleanup()
-      queryClient.clear()
-    })
-
-    await a._sync.loadSubset({})
-    await a.utils.refetch({ throwOnError: true })
-    await directWrite
-    expect(a.get(server.id)?.name).toBe(`Manual`)
-    expect(queryClient.getQueryData(queryKey)).toEqual([
-      { id: server.id, name: `Manual` },
-    ])
-    peer.collection = makeCollection(`reentrant-success-b`)
-    const load = Promise.resolve(peer.collection._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    expect(
-      await Promise.race([
-        load.then(
-          () => `settled`,
-          () => `rejected`,
-        ),
-        requestStarted.promise.then(() => `request-started`),
-      ]),
-    ).toBe(`request-started`)
-    expect(peer.collection.has(server.id)).toBe(false)
-    held.resolve([newer])
-    await load
-    expect(peer.collection.get(server.id)?.name).toBe(newer.name)
-  })
-
-  /**
-   * A directly selected response property has the same provenance rule as a
-   * raw array. A's direct edit can patch its Query envelope, but a later B
-   * cannot treat that envelope as a server fetch. The reference gives B no
-   * row until the held replacement response, then gives it the server row.
-   * This distinguishes the rule from a patch marker set only for raw arrays.
-   */
-  it(`withholds a directly selected cache edit from a later Collection`, async () => {
-    type Row = { id: string; name: string }
-    type Response = { items: Array<Row> }
-    const queryClient = createQueryClient()
-    const queryKey = [`late-shared-wrapped-direct-edit`]
-    const server = { id: `x`, name: `Server` }
-    const newer = { id: `x`, name: `Newer` }
-    const held = createDeferred<Response>()
-    const requestStarted = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce({ items: [server] })
-      .mockImplementationOnce(() => {
-        requestStarted.resolve()
-        return held.promise
-      })
-    const makeCollection = (id: string) =>
-      createCollection(
-        queryCollectionOptions({
-          id,
-          queryClient,
-          queryKey,
-          queryFn,
-          select: (response: Response) => response.items,
-          getKey: (row: Row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const ownerA = makeCollection(`late-wrapped-a`)
-    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
-    cleanups.push(async () => {
-      held.resolve({ items: [newer] })
-      await ownerA.cleanup()
-      await peer.collection?.cleanup()
-      queryClient.clear()
-    })
-
-    await ownerA._sync.loadSubset({})
-    await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
-    expect(queryClient.getQueryData(queryKey)).toEqual({
-      items: [{ id: server.id, name: `Manual` }],
-    })
-    peer.collection = makeCollection(`late-wrapped-b`)
-    const ownerB = peer.collection
-    const load = Promise.resolve(ownerB._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    expect(
-      await Promise.race([
-        load.then(
-          () => `settled`,
-          () => `rejected`,
-        ),
-        requestStarted.promise.then(() => `request-started`),
-      ]),
-    ).toBe(`request-started`)
-    expect(ownerB.has(server.id)).toBe(false)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    held.resolve({ items: [newer] })
-    await load
-    expect(ownerB.get(server.id)?.name).toBe(newer.name)
-    expect(ownerA.get(server.id)?.name).toBe(newer.name)
-  })
-
-  /**
-   * The late peer must withhold A's local cache edit while its replacement
-   * fetch runs. If that fetch fails, it still reports the new Query error:
-   * withholding an old success cannot suppress a terminal failure. The
-   * independent reference has no B-owned row and one failed B request, so the
-   * public checkpoint is B's error state and absence of A's direct value.
-   * The successful sibling above distinguishes this from withholding every
-   * result. Registration on either side of the write is a legal history.
-   */
-  it.each([`registered`, `later-created`] as const)(
-    `reports a failed fetch while withholding another Collection's cached edit: %s`,
-    async (peerTiming) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`late-shared-direct-error-${peerTiming}`]
-      const failure = new Error(`replacement failed`)
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
-        .mockRejectedValueOnce(failure)
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const ownerA = makeCollection(`late-error-a-${peerTiming}`)
-      let ownerB =
-        peerTiming === `registered`
-          ? makeCollection(`late-error-b-${peerTiming}`)
-          : undefined
-      cleanups.push(async () => {
-        await ownerA.cleanup()
-        await ownerB?.cleanup()
-        queryClient.clear()
-      })
-
-      await ownerA._sync.loadSubset({})
-      await ownerA.utils.writeUpdate({ id: `x`, name: `Manual` })
-      ownerB ??= makeCollection(`late-error-b-${peerTiming}`)
-      await expect(ownerB._sync.loadSubset({})).rejects.toBe(failure)
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(ownerB.has(`x`)).toBe(false)
-      expect(reportedError(ownerB)).toBe(failure)
-      expect(reportedError(ownerB)).toBeDefined()
-      expect(ownerA.get(`x`)?.name).toBe(`Manual`)
-    },
-  )
-
-  /**
-   * A shared request started before A's local write remains a server result
-   * for B. A's later accepted value wins only in A. The reference keeps two
-   * Collection row sets over the one provider response. B releases and
-   * reacquires its subset while the fetch is held. After settlement, B sees
-   * the provider row and A sees its direct write. This tests the result-merge
-   * and remount paths as well as the immediate cache patch path above.
-   */
-  it(`keeps an older shared fetch from carrying A's direct write into B`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`shared-older-fetch-isolation`]
-    const older = createDeferred<Array<Row>>()
-    const server = { id: `x`, name: `Server` }
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([server])
-      .mockImplementationOnce(() => older.promise)
-    const makeCollection = (id: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const ownerA = makeCollection(`shared-older-fetch-a`)
-    const ownerB = makeCollection(`shared-older-fetch-b`)
-    cleanups.push(async () => {
-      older.resolve([server])
-      await ownerA.cleanup()
-      await ownerB.cleanup()
-      queryClient.clear()
-    })
-
-    await Promise.all([
-      ownerA._sync.loadSubset({}),
-      ownerB._sync.loadSubset({}),
-    ])
-    const refresh = ownerA.utils.refetch({ throwOnError: true })
-    void refresh.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-    await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
-    expect(ownerB.get(server.id)?.name).toBe(`Server`)
-    ownerB._sync.unloadSubset({})
-    expect(ownerB.has(server.id)).toBe(false)
-    const reacquire = Promise.resolve(ownerB._sync.loadSubset({}))
-    void reacquire.catch(() => undefined)
-    older.resolve([{ id: server.id, name: `Older` }])
-    await Promise.all([refresh, reacquire])
-    expect(ownerA.get(server.id)?.name).toBe(`Manual`)
-    expect(ownerB.get(server.id)?.name).toBe(`Older`)
-  })
-
-  /**
-   * An explicit refetch after a direct write needs a post-write provider
-   * request, even if another Collection started the shared empty-cache fetch.
-   * The independent reference orders provider starts and accepted writes; the
-   * physical Query's initiating Collection does not change that order. The
-   * two legal start orders distinguish a local fetch clock from a shared one.
-   * At refetch settlement, observe request count and A's public row.
-   */
-  it.each([`A-first`, `B-first`] as const)(
-    `starts a post-write refetch of a shared empty-cache Query ($startOrder)`,
-    async (startOrder) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`shared-empty-cache-post-write-${startOrder}`]
-      const first = createDeferred<Array<Row>>()
-      const queryFn = vi
-        .fn()
-        .mockImplementationOnce(() => first.promise)
-        .mockResolvedValueOnce([])
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`shared-refetch-a-${startOrder}`)
-      const b = makeCollection(`shared-refetch-b-${startOrder}`)
-      cleanups.push(async () => {
-        first.resolve([])
-        await Promise.all([a.cleanup(), b.cleanup()])
-        queryClient.clear()
-      })
-      const initial = startOrder === `A-first` ? a : b
-      const second = startOrder === `A-first` ? b : a
-      const firstLoad = Promise.resolve(initial._sync.loadSubset({}))
-      void firstLoad.catch(() => undefined)
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
-      const secondLoad = Promise.resolve(second._sync.loadSubset({}))
-      void secondLoad.catch(() => undefined)
-      await a.utils.writeInsert({ id: `x`, name: `Written` })
-      await a.utils.writeDelete(`x`)
-      const refetch = a.utils.refetch({ throwOnError: true })
-      void refetch.catch(() => undefined)
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-      first.resolve([{ id: `x`, name: `Stale` }])
-      await refetch
-      expect(a.has(`x`)).toBe(false)
-      await Promise.allSettled([firstLoad, secondLoad])
-    },
-  )
-
-  /**
-   * The neighboring order is different: a shared empty-cache request begun
-   * after A's direct write is already post-write authority. A's explicit
-   * refetch may join it. The independent request-order reference predicts one
-   * provider call and both Collections receiving that result at settlement.
-   * This rejects a blanket rule that cancels every shared in-flight request.
-   */
-  it(`reuses a shared empty-cache request started after the direct write`, async () => {
-    type Row = { id: string; name: string }
-    const queryClient = createQueryClient()
-    const queryKey = [`shared-newer-empty-cache-request`]
-    const response = createDeferred<Array<Row>>()
-    const server = { id: `x`, name: `Server` }
-    const queryFn = vi.fn(() => response.promise)
-    const makeCollection = (id: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`shared-newer-a`)
-    const b = makeCollection(`shared-newer-b`)
-    cleanups.push(async () => {
-      response.resolve([server])
-      await Promise.all([a.cleanup(), b.cleanup()])
-      queryClient.clear()
-    })
-    await a.utils.writeInsert({ id: `x`, name: `Written` })
-    const bLoad = Promise.resolve(b._sync.loadSubset({}))
-    void bLoad.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
-    const aLoad = Promise.resolve(a._sync.loadSubset({}))
-    void aLoad.catch(() => undefined)
-    const refetch = a.utils.refetch({ throwOnError: true })
-    void refetch.catch(() => undefined)
-    expect(queryFn).toHaveBeenCalledOnce()
-    response.resolve([server])
-    await Promise.all([aLoad, bLoad, refetch])
-    expect(queryFn).toHaveBeenCalledOnce()
-    expect(a.get(`x`)?.name).toBe(`Server`)
-    expect(b.get(`x`)?.name).toBe(`Server`)
-  })
-
-  /**
-   * A's sync restart cannot move an already-running physical Query request
-   * past its earlier direct write. The reference order is B's request start,
-   * A's accepted insert/delete, A's sync restart, then A's explicit refetch.
-   * A post-write request must start and settle without reviving x. This is
-   * the same request-order law as the two-Collection histories above, with
-   * one added sync-run boundary.
-   */
-  it.each([false, true] as const)(
-    `keeps a shared pre-write fetch older across Collection sync restart with explicit refetch=%s`,
-    async (explicitRefetch) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`shared-fetch-across-sync-restart`, explicitRefetch]
-      const first = createDeferred<Array<Row>>()
-      const queryFn = vi
-        .fn()
-        .mockImplementationOnce(() => first.promise)
-        .mockResolvedValue([])
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`shared-fetch-restart-a`)
-      const b = makeCollection(`shared-fetch-restart-b`)
-      cleanups.push(async () => {
-        first.resolve([])
-        await Promise.all([a.cleanup(), b.cleanup()])
-        queryClient.clear()
-      })
-      const bLoad = Promise.resolve(b._sync.loadSubset({}))
-      void bLoad.catch(() => undefined)
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
-      await a.utils.writeInsert({ id: `x`, name: `Written` })
-      await a.utils.writeDelete(`x`)
-      await a.cleanup()
-      const subscription = a.subscribeChanges(() => {})
-      cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-      const aLoad = Promise.resolve(a._sync.loadSubset({}))
-      void aLoad.catch(() => undefined)
-      const refetch = explicitRefetch
-        ? a.utils.refetch({ throwOnError: true })
-        : undefined
-      void refetch?.catch(() => undefined)
-      if (explicitRefetch)
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-      first.resolve([{ id: `x`, name: `Stale` }])
-      await refetch
-      await aLoad
-      expect(a.has(`x`)).toBe(false)
-      await Promise.allSettled([aLoad, bLoad])
-    },
-  )
-
-  /**
-   * Cleanup ends one sync run and discards its memory-only direct rows. A
-   * direct-row position from that run cannot veto a valid cached Query row
-   * when the same Collection starts a new run. The independent reference has
-   * one server row, one optional accepted direct row, and a run boundary that
-   * removes the direct row. B retains the physical Query throughout.
-   *
-   * Both histories insert directly; one explicitly deletes before cleanup.
-   * The real QueryClient and public Collection are checked after restart and
-   * cached acquisition. One provider call proves the cached path was used.
-   */
-  it.each([false, true] as const)(
-    `does not carry an old direct-row position into a restarted sync run, deleted=%s`,
-    async (deleteBeforeCleanup) => {
-      type Row = { id: string; name: string }
-      const id = `direct-position-restart-${deleteBeforeCleanup}`
-      const queryClient = createQueryClient()
-      const queryKey = [id]
-      const server = { id: `x`, name: `Server` }
-      const queryFn = vi.fn(() => Promise.resolve([server]))
-      const makeCollection = (name: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id: name,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`${id}-a`)
-      const b = makeCollection(`${id}-b`)
-      cleanups.push(async () => {
-        await a.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-      })
-      await b._sync.loadSubset({})
-      expect(b.get(`x`)?.name).toBe(server.name)
-      await a.utils.writeInsert({ id: `x`, name: `Direct` })
-      expect(a.get(`x`)?.name).toBe(`Direct`)
-      if (deleteBeforeCleanup) await a.utils.writeDelete(`x`)
-      await a.cleanup()
-
-      const subscription = a.subscribeChanges(() => {})
-      cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-      await a._sync.loadSubset({})
-      expect(queryFn).toHaveBeenCalledOnce()
-      expect(a.get(`x`)?.name).toBe(server.name)
-      expect(b.get(`x`)?.name).toBe(server.name)
-    },
-  )
-
-  /**
-   * A direct cache patch belongs to the sync run that accepted it. An outside
-   * Query observer can retain that physical cache through A's cleanup, but
-   * A's next run cannot treat its own old local edit as a fetched result.
-   * The independent reference discards A's memory-only row at cleanup and
-   * waits for a new server response. The held-request cut rejects a cache
-   * provenance rule that compares Collection identity but ignores sync run.
-   */
-  it(`does not replay its own direct cache patch after sync restart`, async () => {
-    type Row = { id: string; name: string }
-    const id = `direct-cache-patch-restart`
-    const queryClient = createQueryClient()
-    const queryKey = [id]
-    const server = { id: `x`, name: `Server` }
-    const newer = { id: `x`, name: `Newer` }
-    const held = createDeferred<Array<Row>>()
-    const requestStarted = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([server])
-      .mockImplementationOnce(() => {
-        requestStarted.resolve()
-        return held.promise
-      })
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        staleTime: Infinity,
-        startSync: true,
-      }),
-    )
-    const outside = new QueryObserver(queryClient, {
-      queryKey,
-      queryFn,
-      enabled: false,
-      staleTime: Infinity,
-    })
-    const unsubscribeOutside = outside.subscribe(() => {})
-    cleanups.push(async () => {
-      held.resolve([newer])
-      unsubscribeOutside()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    await collection.utils.writeUpdate({ id: server.id, name: `Manual` })
-    expect(queryClient.getQueryData(queryKey)).toEqual([
-      { id: server.id, name: `Manual` },
-    ])
-    await collection.cleanup()
-    expect(queryClient.getQueryData(queryKey)).toEqual([
-      { id: server.id, name: `Manual` },
-    ])
-    const subscription = collection.subscribeChanges(() => {})
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-    const load = Promise.resolve(collection._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    expect(
-      await Promise.race([
-        load.then(
-          () => `settled`,
-          () => `rejected`,
-        ),
-        requestStarted.promise.then(() => `request-started`),
-      ]),
-    ).toBe(`request-started`)
-    expect(collection.has(server.id)).toBe(false)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    held.resolve([newer])
-    await load
-    expect(collection.get(server.id)?.name).toBe(newer.name)
-  })
-
-  /**
-   * A's accepted direct row has its own position. A physical fetch started
-   * later may replace and claim it when A next acquires the shared Query;
-   * an earlier fetched snapshot or B's local cache edit may not. The small
-   * reference below orders only authored writes and actual provider fetches.
-   * Cache edits invalidate the last fetched snapshot but do not create a new
-   * remote position. It deliberately has no Query observers or cache-version
-   * classifier.
-   *
-   * The legal grammar crosses fetch/write order, another write to the same or
-   * a disjoint key, a foreign local cache edit, and a final real refetch. The
-   * driver uses two Collections sharing one physical Query. At A's acquisition
-   * and subset release it compares public rows with the reference. A fetched
-   * cached result needs no request; a local cache edit with no later fetch
-   * requires one to establish authority. The inverse order rejects blindly
-   * trusting any cached result; the cache-edit lanes reject mistaking
-   * setQueryData for a remote success.
-   */
-  it.each(
-    ([`write-first`, `fetch-first`] as const).flatMap((order) =>
-      ([`none`, `same-key`, `other-key`] as const).flatMap((laterWrite) =>
-        ([false, true] as const).flatMap((cacheEdit) =>
-          ([false, true] as const).map((finalRefetch) => ({
-            order,
-            laterWrite,
-            cacheEdit,
-            finalRefetch,
-          })),
-        ),
-      ),
-    ),
-  )(
-    `orders shared fetches, writes, and cache edits before acquisition: $order/$laterWrite/cache=$cacheEdit/refetch=$finalRefetch`,
-    async ({ order, laterWrite, cacheEdit, finalRefetch }) => {
-      type Row = { id: string; name: string }
-      const queryClient = createQueryClient()
-      const queryKey = [`shared-post-write-cached-before-acquisition`]
-      let requestNumber = 0
-      const queryFn = vi.fn(() =>
-        Promise.resolve([
-          {
-            id: `x`,
-            name: ++requestNumber === 1 ? `Server 1` : `Server 2`,
-          },
-        ]),
-      )
-      const makeCollection = (id: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id,
-            queryClient,
-            queryKey,
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`cached-newer-a`)
-      const b = makeCollection(`cached-newer-b`)
-      cleanups.push(async () => {
-        await Promise.all([a.cleanup(), b.cleanup()])
-        queryClient.clear()
-      })
-      const reference: {
-        position: number
-        directX?: { value: string; position: number }
-        remoteX?: { value: string; position: number }
-        cacheStillFetched: boolean
-      } = { position: 0, cacheStillFetched: false }
-      const writeX = async (name: string) => {
-        reference.directX = { value: name, position: ++reference.position }
-        if (a.has(`x`)) await a.utils.writeUpdate({ id: `x`, name })
-        else await a.utils.writeInsert({ id: `x`, name })
-      }
-      const fetchB = async (first: boolean) => {
-        const started = ++reference.position
-        if (first) await b._sync.loadSubset({})
-        else await b.utils.refetch({ throwOnError: true })
-        reference.remoteX = {
-          value: first ? `Server 1` : `Server 2`,
-          position: started,
-        }
-        reference.cacheStillFetched = true
-      }
-      if (order === `write-first`) await writeX(`Written`)
-      await fetchB(true)
-      if (order === `fetch-first`) await writeX(`Written`)
-      if (laterWrite === `same-key`) await writeX(`Later write`)
-      if (laterWrite === `other-key`) {
-        reference.position++
-        await a.utils.writeInsert({ id: `y`, name: `Other write` })
-      }
-      if (cacheEdit) {
-        queryClient.setQueryData(queryKey, [
-          { id: `x`, name: `Local cache edit` },
-        ])
-        reference.cacheStillFetched = false
-      }
-      if (finalRefetch) await fetchB(false)
-      const callsBeforeAcquisition = queryFn.mock.calls.length
-      await a._sync.loadSubset({})
-      const revalidatedCacheEdit = cacheEdit && !finalRefetch
-      expect(queryFn).toHaveBeenCalledTimes(
-        callsBeforeAcquisition + Number(revalidatedCacheEdit),
-      )
-      if (revalidatedCacheEdit) {
-        reference.remoteX = {
-          value: `Server 2`,
-          position: ++reference.position,
-        }
-        reference.cacheStillFetched = true
-      }
-      const { directX, remoteX, cacheStillFetched } = reference
-      if (!directX || !remoteX) throw new Error(`Illegal authority history`)
-      const remoteMayReplace =
-        cacheStillFetched && remoteX.position > directX.position
-      expect(a.get(`x`)?.name).toBe(
-        remoteMayReplace ? remoteX.value : directX.value,
-      )
-      // The complete unbounded response omits y, so it retires that
-      // ownerless direct row; without such a response the row survives.
-      expect(a.get(`y`)?.name).toBe(
-        laterWrite === `other-key` && !finalRefetch && !revalidatedCacheEdit
-          ? `Other write`
-          : undefined,
-      )
-      a._sync.unloadSubset({})
-      expect(a.get(`x`)?.name).toBe(
-        remoteMayReplace ? undefined : directX.value,
-      )
-    },
-  )
-
-  /**
-   * Two distinct on-demand Queries can return the same row. For that row, a
-   * successfully applied physical fetch takes its position when it starts:
-   * the latest such fetch supplies the value, even when an older fetch settles
-   * afterward. An older result still claims its own subset, so releasing the
-   * newer subset does not discard the row or revert its value. An accepted
-   * direct write participates in the same order for the key it changes.
-   *
-   * The reference below has only one row, its last accepted position, and a
-   * set of subset owners. It does not classify Query cache events or replay
-   * production's ownership maps. The legal histories cross an existing versus
-   * first-time older owner and both settlement orders; two neighboring writes
-   * fall between or after the fetch starts. The driver uses distinct semantic
-   * demands and real Query observers. One newer result repeats the initial
-   * value: it still takes a position that an older result cannot undo. After
-   * each applied settlement and after releasing the newer owner, the public
-   * Collection row must match the model.
-   */
-  it.each([
-    ...([false, true] as const).flatMap((existingOwner) =>
-      ([false, true] as const).map((settleNewerFirst) => ({
-        existingOwner,
-        settleNewerFirst,
-        directWrite: `none` as const,
-        sameValue: false,
-      })),
-    ),
-    {
-      existingOwner: true,
-      settleNewerFirst: true,
-      directWrite: `none` as const,
-      sameValue: true,
-    },
-    {
-      existingOwner: true,
-      settleNewerFirst: true,
-      directWrite: `between` as const,
-      sameValue: false,
-    },
-    {
-      existingOwner: true,
-      settleNewerFirst: true,
-      directWrite: `after` as const,
-      sameValue: false,
-    },
-  ])(
-    `orders overlapping subset values and owners: existing=$existingOwner/newer-first=$settleNewerFirst/write=$directWrite/equal=$sameValue`,
-    async ({ existingOwner, settleNewerFirst, directWrite, sameValue }) => {
-      const id = `overlapping-fetch-value-${existingOwner}-${settleNewerFirst}-${directWrite}-${sameValue}`
-      const older = createDeferred<Array<Item>>()
-      const newer = createDeferred<Array<Item>>()
-      const initial = { ...shared, name: `Initial` }
-      const olderRow = { ...shared, name: `Older` }
-      const newerRow = { ...shared, name: sameValue ? `Initial` : `Newer` }
-      const manual = { ...shared, name: `Manual` }
-      const { collection, queryClient, queryFn } = createOwnershipFixture({
-        id,
-        results: existingOwner
-          ? [[initial], older.promise, newer.promise]
-          : [older.promise, newer.promise],
-      })
-      cleanups.push(async () => {
-        older.resolve([olderRow])
-        newer.resolve([newerRow])
-      })
-      const olderSubset = { where: eq(new IR.PropRef([`category`]), `shared`) }
-      const newerSubset = { where: eq(new IR.PropRef([`id`]), `shared`) }
-      expect(getLoadSubsetDemandKey(olderSubset)).not.toBe(
-        getLoadSubsetDemandKey(newerSubset),
-      )
-      // The provider's authored rows must be legal for their real scopes.
-      // This checks fixture admission only; the reference below still judges
-      // public values independently of the production expression compiler.
-      expect(
-        toBooleanPredicate(
-          compileSingleRowExpression(olderSubset.where)(initial),
-        ),
-      ).toBe(true)
-      expect(
-        toBooleanPredicate(
-          compileSingleRowExpression(olderSubset.where)(olderRow),
-        ),
-      ).toBe(true)
-      expect(
-        toBooleanPredicate(
-          compileSingleRowExpression(newerSubset.where)(newerRow),
-        ),
-      ).toBe(true)
-
-      // Model: each accepted operation may replace the value only when its
-      // position exceeds the position of the accepted value already held.
-      // Claiming a subset and replacing a value are separate operations.
-      const reference: {
-        position: number
-        acceptedAt: number
-        value: string | undefined
-        owners: Set<`older` | `newer`>
-      } = {
-        position: 0,
-        acceptedAt: 0,
-        value: undefined,
-        owners: new Set(),
-      }
-      const start = () => ++reference.position
-      const acceptFetch = (
-        owner: `older` | `newer`,
-        started: number,
-        value: string,
-      ) => {
-        reference.owners.add(owner)
-        if (started > reference.acceptedAt) {
-          reference.value = value
-          reference.acceptedAt = started
-        }
-      }
-      const acceptWrite = () => {
-        reference.value = manual.name
-        reference.acceptedAt = ++reference.position
-      }
-      const expectPublicRow = () => {
-        expect(collection.get(shared.id)?.name).toBe(
-          reference.owners.size > 0 ? reference.value : undefined,
-        )
-        expect(collection.has(shared.id)).toBe(reference.owners.size > 0)
-      }
-
-      if (existingOwner) {
-        const initialStart = start()
-        await collection._sync.loadSubset(olderSubset)
-        acceptFetch(`older`, initialStart, initial.name)
-        expectPublicRow()
-      }
-      const olderStart = start()
-      const olderLoad = collection._sync.loadSubset(
-        existingOwner ? { ...olderSubset, refetch: true } : olderSubset,
-      )
-      void Promise.resolve(olderLoad).catch(() => undefined)
-      await vi.waitFor(() =>
-        expect(queryFn).toHaveBeenCalledTimes(existingOwner ? 2 : 1),
-      )
-
-      if (directWrite === `between`) {
-        await collection.utils.writeUpdate(manual)
-        acceptWrite()
-        expectPublicRow()
-      }
-      const newerStart = start()
-      const newerLoad = collection._sync.loadSubset(newerSubset)
-      void Promise.resolve(newerLoad).catch(() => undefined)
-      await vi.waitFor(() =>
-        expect(queryFn).toHaveBeenCalledTimes(existingOwner ? 3 : 2),
-      )
-      expect(
-        queryClient.getQueryCache().findAll({ queryKey: [id] }),
-      ).toHaveLength(2)
-      if (directWrite === `after`) {
-        await collection.utils.writeUpdate(manual)
-        acceptWrite()
-        expectPublicRow()
-      }
-
-      const settle = async (owner: `older` | `newer`) => {
-        if (owner === `older`) {
-          older.resolve([olderRow])
-          await olderLoad
-          acceptFetch(owner, olderStart, olderRow.name)
-        } else {
-          newer.resolve([newerRow])
-          await newerLoad
-          acceptFetch(owner, newerStart, newerRow.name)
-        }
-        expectPublicRow()
-      }
-      if (settleNewerFirst) {
-        await settle(`newer`)
-        await settle(`older`)
-      } else {
-        await settle(`older`)
-        await settle(`newer`)
-      }
-
-      const release = (owner: `older` | `newer`) => {
-        const subset = owner === `older` ? olderSubset : newerSubset
-        collection._sync.unloadSubset(subset)
-        if (owner === `older` && existingOwner)
-          collection._sync.unloadSubset(subset)
-        reference.owners.delete(owner)
-        expectPublicRow()
-      }
-      if (existingOwner) {
-        release(`older`)
-        release(`newer`)
-      } else {
-        release(`newer`)
-        release(`older`)
-      }
-
-      // Reacquisition starts a new row-ownership lifetime. Only the acquired
-      // Query's retained cache is projected; an earlier overlap does not
-      // permanently rewrite a different Query entry. This legal neighbor
-      // distinguishes continuous-owner precedence from global precedence.
-      if (!existingOwner && settleNewerFirst && directWrite === `none`) {
-        reference.owners.add(`older`)
-        reference.value = olderRow.name
-        await collection._sync.loadSubset(olderSubset)
-        expectPublicRow()
-        expect(queryFn).toHaveBeenCalledTimes(2)
-        collection._sync.unloadSubset(olderSubset)
-        reference.owners.delete(`older`)
-        expectPublicRow()
-
-        reference.owners.add(`newer`)
-        reference.value = newerRow.name
-        await collection._sync.loadSubset(newerSubset)
-        expectPublicRow()
-        expect(queryFn).toHaveBeenCalledTimes(2)
-      }
-    },
-  )
-
-  /**
-   * A fresh Collection instance is a separate receiving boundary for the
-   * same authority law. The persisted direct row was accepted before B's
-   * physical fetch, and B keeps that exact Query alive while A restarts.
-   * The reference order makes the server row authoritative at A's next load.
-   * A restart may issue another request if it cannot recover that order from
-   * storage; it may not silently keep the older direct value at settlement.
-   */
-  it.each([false, true] as const)(
-    `adopts a newer shared server result after persisted Collection restart with cache edit=%s`,
-    async (cacheEdit) => {
-      type Row = { id: string; name: string }
-      const id = `shared-newer-after-persisted-restart-${cacheEdit}`
-      const queryKey = [id]
-      const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-      const persistence = createNodeSQLitePersistence({
-        database: driver.getDatabase(),
-      })
-      const managed = persistence.resolvePersistenceForCollection!({
-        collectionId: id,
-        mode: `sync-present`,
-      })
-      const queryClient = createQueryClient()
-      const server = { id: `x`, name: `Server` }
-      let aRequests = 0
-      const aQueryFn = vi.fn(() =>
-        Promise.resolve(++aRequests === 1 ? [] : [server]),
-      )
-      const bQueryFn = vi.fn(() => Promise.resolve([server]))
-      const makeA = () =>
-        createCollection(
-          persistedCollectionOptions<
-            Row,
-            string | number,
-            never,
-            QueryCollectionUtils<Row, string | number, Row, unknown>
-          >({
-            ...queryCollectionOptions<Row>({
-              id,
-              queryClient,
-              queryKey,
-              queryFn: aQueryFn,
-              getKey: (row) => row.id,
-              syncMode: `on-demand`,
-              staleTime: Infinity,
-              startSync: true,
-            }),
-            persistence: managed,
-          }),
-        )
-      const firstA = makeA()
-      const b = createCollection(
-        queryCollectionOptions<Row>({
-          id: `${id}-b`,
-          queryClient,
-          queryKey,
-          queryFn: bQueryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-      const restart: { collection?: ReturnType<typeof makeA> } = {}
-      cleanups.push(async () => {
-        await restart.collection?.cleanup()
-        await firstA.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-        driver.close()
-      })
-      await firstA._sync.loadSubset({})
-      firstA._sync.unloadSubset({})
-      const callsBeforeWrite =
-        aQueryFn.mock.calls.length + bQueryFn.mock.calls.length
-      await firstA.utils.writeInsert({ id: `x`, name: `Direct` })
-      expect(firstA.get(`x`)?.name).toBe(`Direct`)
-      expect(aQueryFn.mock.calls.length + bQueryFn.mock.calls.length).toBe(
-        callsBeforeWrite,
-      )
-      await b._sync.loadSubset({})
-      await b.utils.refetch({ throwOnError: true })
-      expect(b.get(`x`)?.name).toBe(`Server`)
-      if (cacheEdit)
-        queryClient.setQueryData(queryKey, [
-          { id: `x`, name: `Local cache edit` },
-        ])
-      await firstA.cleanup()
-
-      restart.collection = makeA()
-      const callsBeforeRestartLoad =
-        aQueryFn.mock.calls.length + bQueryFn.mock.calls.length
-      await restart.collection._sync.loadSubset({})
-      expect(aQueryFn.mock.calls.length + bQueryFn.mock.calls.length).toBe(
-        callsBeforeRestartLoad + 1,
-      )
-      expect(restart.collection.get(`x`)?.name).toBe(`Server`)
-    },
-  )
-
-  /**
-   * A fresh persisted Collection can meet a Query cache entry fetched before
-   * its accepted direct write. The shared physical Query stays unchanged
-   * while B owns it: letting A patch that cache would publish A's local row
-   * into B. A's SQLite row nevertheless survives cleanup. Its owner may be
-   * absent (direct insert before A acquired the subset) or retained (direct
-   * update after A acquired it); neither makes the old cache a new fetch.
-   *
-   * The independent reference orders B's server result, A's accepted write,
-   * A's cleanup, and A's next acquisition. The retained cache cannot order
-   * its row against the durable write, so acquisition must request a new
-   * result; that result may replace the durable value. The driver uses a real QueryClient
-   * shared by both Collections and a managed SQLite cache. It checks A and B,
-   * the unchanged Query cache, durable storage after cleanup, request count,
-   * and A's public row when the new acquisition settles. The two histories
-   * distinguish the ownerless-row ambiguity guard from an owned direct
-   * update whose cached Query is equally old.
-   */
-  it.each([`ownerless-insert`, `owned-update`] as const)(
-    `keeps a persisted %s direct row ahead of an older shared Query after restart`,
-    async (rowLifetime) => {
-      type Row = { id: string; name: string }
-      const id = `persisted-old-shared-cache-${rowLifetime}`
-      const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-      const persistence = createNodeSQLitePersistence({
-        database: driver.getDatabase(),
-      })
-      const managed = persistence.resolvePersistenceForCollection!({
-        collectionId: id,
-        mode: `sync-present`,
-      })
-      const queryClient = createQueryClient()
-      const queryKey = [id]
-      const server = { id: `x`, name: `Server` }
-      const direct = { id: `x`, name: `Direct` }
-      const newer = { id: `x`, name: `Newer` }
-      const queryFn = vi
-        .fn(() => Promise.resolve([newer]))
-        .mockResolvedValueOnce([server])
-      const makeA = () =>
-        createCollection(
-          persistedCollectionOptions<
-            Row,
-            string | number,
-            never,
-            QueryCollectionUtils<Row, string | number, Row, unknown>
-          >({
-            ...queryCollectionOptions<Row>({
-              id,
-              queryClient,
-              queryKey,
-              queryFn,
-              getKey: (row) => row.id,
-              syncMode: `on-demand`,
-              staleTime: Infinity,
-              startSync: true,
-            }),
-            persistence: managed,
-          }),
-        )
-      const a = makeA()
-      const b = createCollection(
-        queryCollectionOptions<Row>({
-          id: `${id}-b`,
-          queryClient,
-          queryKey,
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-      let restarted: ReturnType<typeof makeA> | undefined
-      try {
-        await b._sync.loadSubset({})
-        if (rowLifetime === `owned-update`) await a._sync.loadSubset({})
-        else await vi.waitFor(() => expect(a.status).toBe(`ready`))
-        expect(a.get(`x`)?.name).toBe(
-          rowLifetime === `owned-update` ? server.name : undefined,
-        )
-        if (rowLifetime === `owned-update`) await a.utils.writeUpdate(direct)
-        else await a.utils.writeInsert(direct)
-        expect(a.get(`x`)?.name).toBe(direct.name)
-        expect(b.get(`x`)?.name).toBe(server.name)
-        expect(queryClient.getQueryData(queryKey)).toEqual([server])
-        expect(queryFn).toHaveBeenCalledOnce()
-
-        await a.cleanup()
-        const claim = await managed.adapter.claimCacheGeneration!(id)
-        try {
-          const durable = await managed.adapter.loadResumeSnapshot({
-            kind: `managed`,
-            storageCollectionId: claim.storageCollectionId,
-            claimId: claim.claimId,
-          })
-          expect(durable.rows.find((row) => row.key === `x`)?.value).toEqual(
-            direct,
-          )
-        } finally {
-          await managed.adapter.releaseCacheGenerationClaim!(claim.claimId)
-        }
-
-        restarted = makeA()
-        const callsBeforeAcquisition = queryFn.mock.calls.length
-        await restarted._sync.loadSubset({})
-        const newRequests = queryFn.mock.calls.length - callsBeforeAcquisition
-        expect(newRequests).toBe(1)
-        expect(restarted.get(`x`)?.name).toBe(newer.name)
-      } finally {
-        await restarted?.cleanup()
-        await a.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-        driver.close()
-      }
-    },
-  )
-
-  /**
-   * A direct write is an accepted Collection row, not completion of an
-   * unfinished Query request. With a held first fetch, the independent Query
-   * state still has no fetched data after the write. The public Collection
-   * has the accepted row; Query Core must not treat that row as a successful
-   * response to ensureQueryData before the provider answers.
-   */
-  it(`does not turn a pending eager Query into cached fetched data`, async () => {
-    const id = `pending-query-direct-write`
-    const first = createDeferred<Array<Item>>()
-    const { collection, queryClient, queryFn } = createOwnershipFixture({
-      id,
-      syncMode: `eager`,
-      results: [first.promise],
-    })
-    cleanups.push(() => {
-      first.resolve([])
-      return Promise.resolve()
-    })
-    const preload = collection.preload()
-    void preload.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    expect(query.state.status).toBe(`pending`)
-    await collection.utils.writeInsert(shared)
-    expect(collection.has(shared.id)).toBe(true)
-    expect(query.state.data).toBeUndefined()
-    expect(query.state.status).toBe(`pending`)
-    first.resolve([])
-    await preload
-  })
-
-  /**
-   * Disabling the eager Query leaves a valid pending, idle cache entry. The
-   * existing eager cache-seeding contract applies without an in-flight
-   * request: the accepted row enters the raw-row cache. Query must then be
-   * coherent for consumers, while its untouched timestamp still says that
-   * no provider fetch has established freshness. This distinguishes the
-   * legal idle seed from an unfinished request, which cannot be completed by
-   * a direct write. Collection readiness still waits for a provider result.
-   */
-  it(`seeds an idle pending eager Query coherently without marking it fresh`, async () => {
-    type Row = { id: string; name: string }
-    const id = `pending-idle-direct-write`
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([] as Array<Row>))
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `eager`,
-        enabled: false,
-        staleTime: 1_000,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    expect(query.state.status).toBe(`pending`)
-    expect(query.state.fetchStatus).toBe(`idle`)
-    await collection.utils.writeInsert({ id: `x`, name: `Manual` })
-    expect(collection.get(`x`)?.name).toBe(`Manual`)
-    expect(query.state.status).toBe(`success`)
-    expect(query.state.data).toEqual([{ id: `x`, name: `Manual` }])
-    expect(query.state.dataUpdatedAt).toBe(0)
-    expect(query.isStaleByTime(1_000)).toBe(true)
-    expect(queryFn).not.toHaveBeenCalled()
-    expect(collection.status).toBe(`loading`)
-  })
-
-  /**
-   * A direct write may leave a derived response envelope stale, but a later
-   * subset load cannot resolve successfully with no rows when both its cache
-   * and provider contain one. The history loads one row, writes it, retires
-   * its only subset lease, then reacquires the same Query. The independent
-   * response model has one row at load settlement; the Collection must too.
-   */
-  it(`restores a derived selected subset from its cached result after reacquisition`, async () => {
-    const id = `derived-select-reacquisition`
-    const before = { id: `x`, name: `Before` }
-    const response = { edges: [{ node: before }] }
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
-    const collection = createCollection(
-      queryCollectionOptions({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        select: (value: typeof response) =>
-          value.edges.map((edge) => edge.node),
-        getKey: (row: typeof before) => row.id,
-        syncMode: `on-demand`,
-        staleTime: Number.POSITIVE_INFINITY,
-        gcTime: Number.POSITIVE_INFINITY,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    await collection.utils.writeUpdate({ id: before.id, name: `After` })
-    collection._sync.unloadSubset({})
-    expect(collection.has(before.id)).toBe(false)
-    await collection._sync.loadSubset({})
-    expect(collection.has(before.id)).toBe(true)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * Restarted eager sync has the same readiness obligation as a reacquired
-   * subset. A derived cache envelope may remain untouched by a direct write,
-   * but a new sync session must establish its source rows before reporting
-   * ready. The provider returns one row and no post-write refetch is caused by
-   * the write itself; restart may fetch to regain result authority.
-   */
-  it(`restores a derived selected eager result after sync restart`, async () => {
-    const id = `derived-select-eager-restart`
-    const row = { id: `x`, name: `Server` }
-    const response = { edges: [{ node: row }] }
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
-    const collection = createCollection(
-      queryCollectionOptions({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        select: (value: typeof response) =>
-          value.edges.map((edge) => edge.node),
-        getKey: (value: typeof row) => value.id,
-        syncMode: `eager`,
-        staleTime: Infinity,
-        gcTime: Infinity,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    await collection.preload()
-    await collection.utils.writeUpdate({ id: row.id, name: `Manual` })
-    expect(queryFn).toHaveBeenCalledTimes(1)
-    await collection.cleanup()
-    const subscription = collection.subscribeChanges(() => {})
-    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
-    await collection.stateWhenReady()
-    expect(collection.has(row.id)).toBe(true)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * A fetched source snapshot still owns every row it returned when a direct
-   * write lands during its request. The reference overlays the accepted write
-   * on that snapshot. A derived `select` has no inverse into the cached
-   * envelope, so this checks public rows and initial readiness after the held
-   * fetch settles without requiring a rewritten Query cache response.
-   */
-  it.each([`eager`, `on-demand`] as const)(
-    `applies a derived selected %s fetch that began before a direct write`,
-    async (syncMode) => {
-      type Row = { id: string; name: string }
-      const id = `derived-select-older-fetch-${syncMode}`
-      const fetched = { edges: [{ node: { id: `server`, name: `Fetched` } }] }
-      const gate = createDeferred<typeof fetched>()
-      const queryClient = createQueryClient()
-      const queryFn = vi.fn(() => gate.promise)
-      const collection = createCollection(
-        queryCollectionOptions({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          select: (response: typeof fetched) =>
-            response.edges.map((edge) => edge.node),
-          getKey: (row: Row) => row.id,
-          syncMode,
-          startSync: true,
-        }),
-      )
-      cleanups.push(async () => {
-        gate.resolve(fetched)
-        await collection.cleanup()
-        queryClient.clear()
-      })
-
-      const ready =
-        syncMode === `eager`
-          ? collection.preload()
-          : Promise.resolve(collection._sync.loadSubset({}))
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
-      await collection.utils.writeInsert({ id: `manual`, name: `Written` })
-      gate.resolve(fetched)
-      await vi.waitFor(() =>
-        expect(collection.get(`server`)?.name).toBe(`Fetched`),
-      )
-      await ready
-      expect(
-        Object.fromEntries(
-          Array.from(collection.values(), (row) => [row.id, row.name]),
-        ),
-      ).toEqual({ server: `Fetched`, manual: `Written` })
-      expect(queryFn).toHaveBeenCalledTimes(1)
-    },
-  )
-
-  /**
-   * A deferred refresh barrier prevents a fetched row from becoming public
-   * while an optimistic mutation persists. A direct write to another key
-   * cannot bypass that boundary merely because a derived select has no cache
-   * inverse. The authored response adds a new server row; the independent
-   * public snapshot contains only the direct-written row until release.
-   */
-  it(`holds a derived selected older result behind the refresh barrier`, async () => {
-    const id = `derived-select-held-refresh`
-    const initial = { id: `x`, name: `Before` }
-    const server = { id: `y`, name: `Server` }
-    const response = (rows: Array<typeof initial>) => ({
-      edges: rows.map((node) => ({ node })),
-    })
-    const held = createDeferred<ReturnType<typeof response>>()
-    const barrier = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce(response([initial]))
-      .mockImplementationOnce(() => held.promise)
-      .mockResolvedValue(response([server]))
-    const collection = createCollection(
-      queryCollectionOptions({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        select: (value: ReturnType<typeof response>) =>
-          value.edges.map((edge) => edge.node),
-        getKey: (row: typeof initial) => row.id,
-        syncMode: `eager`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      held.resolve(response([server]))
-      collection.deferDataRefresh = null
-      barrier.resolve()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.preload()
-    collection.deferDataRefresh = barrier.promise
-    const refetch = collection.utils.refetch({ throwOnError: true })
-    void refetch.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-    await collection.utils.writeUpdate({ id: initial.id, name: `Manual` })
-    held.resolve(response([{ ...initial, name: `Older` }, server]))
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    await vi.waitFor(() => expect(query.state.fetchStatus).toBe(`idle`))
-    for (let turn = 0; turn < 20; turn++) await Promise.resolve()
-    expect(collection.get(initial.id)?.name).toBe(`Manual`)
-    expect(collection.has(server.id)).toBe(false)
-    collection.deferDataRefresh = null
-    barrier.resolve()
-    await refetch.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    await vi.waitFor(() => expect(collection.has(server.id)).toBe(true))
-  })
-
-  /**
-   * A silent cancellation that replaces a Query fetch lets public Collection
-   * refetch callers follow the successor, as Query Core does for its own
-   * `cancelRefetch` path. The reference is the successor's applied row at
-   * both public refetch settlements. A raw QueryClient `fetchQuery` waiter
-   * holds the retryer promise instead and may receive `CancelledError`; that
-   * is Query Core's separate boundary. Holding the first fetch distinguishes
-   * a synchronous replacement from a cancellation awaited before replacement.
-   */
-  it(`settles overlapping explicit refetch callers on the replacement`, async () => {
-    type Row = { id: string; name: string }
-    const id = `overlapping-post-write-refetch`
-    const first = createDeferred<Array<Row>>()
-    const replacement = createDeferred<Array<Row>>()
-    const queryClient = createQueryClient()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([{ id: `x`, name: `Initial` }])
-      .mockImplementationOnce(() => first.promise)
-      .mockImplementation(() => replacement.promise)
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `eager`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      first.resolve([{ id: `x`, name: `Old` }])
-      replacement.resolve([{ id: `x`, name: `Server` }])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.preload()
-    let earlierOutcome = `pending`
-    const earlier = collection.utils.refetch({ throwOnError: true }).then(
-      () => {
-        earlierOutcome = `resolved`
-        return { outcome: earlierOutcome, row: collection.get(`x`)?.name }
-      },
-      (error) => {
-        earlierOutcome = isCancelledError(error) ? `cancelled` : `rejected`
-        return { outcome: earlierOutcome, row: collection.get(`x`)?.name }
-      },
-    )
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-    let externalOutcome = `pending`
-    const external = queryClient
-      .fetchQuery({ queryKey: [id], queryFn, staleTime: 0 })
-      .then(
-        (rows) => {
-          externalOutcome = `resolved`
-          return { outcome: externalOutcome, row: rows[0]?.name }
-        },
-        (error) => {
-          externalOutcome = isCancelledError(error) ? `cancelled` : `rejected`
-          return { outcome: externalOutcome, row: undefined }
-        },
-      )
-    await collection.utils.writeUpdate({ id: `x`, name: `Written` })
-    const later = collection.utils.refetch({ throwOnError: true })
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    expect(earlierOutcome).toBe(`pending`)
-    expect(externalOutcome).toBe(`pending`)
-    replacement.resolve([{ id: `x`, name: `Server` }])
-    await later
-    expect(await earlier).toEqual({ outcome: `resolved`, row: `Server` })
-    expect(await external).toEqual({ outcome: `cancelled`, row: undefined })
-    expect(collection.get(`x`)?.name).toBe(`Server`)
-  })
-
-  /**
-   * A derived selected response has no safe inverse for a direct cache edit.
-   * Its old cached envelope may remain, but remounting a live query without
-   * a new provider result must not replay that envelope over an accepted
-   * direct write. The independent reference keeps the accepted row until a
-   * later fetch; this history observes both the public row and request count
-   * after the live-query subscriber returns.
-   */
-  it(`does not replay an unpatchable eager cache response on resubscribe`, async () => {
-    type Row = { id: string; name: string }
-    const id = `derived-eager-resubscribe`
-    const response = { data: [{ id: `x`, name: `before` }] }
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
-    const collection = createCollection(
-      queryCollectionOptions({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        select: (value: typeof response) => value.data.filter(Boolean),
-        getKey: (row: Row) => row.id,
-        syncMode: `eager`,
-        startSync: true,
-      }),
-    )
-    const createLive = () =>
-      createLiveQueryCollection({
-        query: (query) => query.from({ row: collection }),
-      })
-    const first = createLive()
-    const liveQueries = [first]
-    cleanups.push(async () => {
-      await Promise.all(liveQueries.map((query) => query.cleanup()))
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await first.preload()
-    await collection.utils.writeUpdate({ id: `x`, name: `after` })
-    expect(queryClient.getQueryData<typeof response>([id])).toEqual(response)
-    await first.cleanup()
-    const second = createLive()
-    liveQueries.push(second)
-    await second.preload()
-    expect(collection.get(`x`)?.name).toBe(`after`)
-    expect(queryFn).toHaveBeenCalledTimes(1)
-  })
-
-  /**
-   * An outside Query observer may retain an inactive A cache with an older
-   * row. The Collection row is independently held by active subset B. A
-   * direct update changes that public row; remounting A and then releasing B
-   * must not restore the old value. The retained cache is allowed to stay
-   * stale, so this checks the ownership boundary rather than requiring a
-   * cache patch the Collection cannot safely infer.
-   */
-  it(`keeps a direct row when a foreign-retained subset remounts`, async () => {
-    type Row = { id: string; name: string; category: string }
-    const id = `foreign-retained-subset-remount`
-    const queryClient = createQueryClient()
-    const initial = { id: `x`, name: `before`, category: `A` }
-    const queryFn = vi.fn(() => Promise.resolve([{ ...initial }]))
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    const a = { where: eq(new IR.PropRef([`category`]), `A`) }
-    const b = { where: eq(new IR.PropRef([`id`]), `x`) }
-    let unsubscribe = () => {}
-    cleanups.push(async () => {
-      unsubscribe()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    await collection._sync.loadSubset(a)
-    const aQuery = queryClient.getQueryCache().findAll({ queryKey: [id] })[0]!
-    await collection._sync.loadSubset(b)
-    const foreign = new QueryObserver(queryClient, {
-      queryKey: aQuery.queryKey,
-      queryFn,
-      staleTime: Infinity,
-      retry: false,
-    })
-    unsubscribe = foreign.subscribe(() => {})
-    collection._sync.unloadSubset(a)
-    await collection.utils.writeUpdate({ id: `x`, name: `after` })
-    expect(
-      queryClient.getQueryData<Array<Row>>(aQuery.queryKey)?.[0]?.name,
-    ).toBe(`before`)
-    await collection._sync.loadSubset(a)
-    collection._sync.unloadSubset(b)
-    expect(collection.get(`x`)?.name).toBe(`after`)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * A Query observer can retain a listener after its last subset lease ends.
-   * The independent row rule is that an accepted direct update wins until a
-   * newer provider result arrives. Keep that observer alive, update the row,
-   * then reacquire the subset without a new request. Both its cached and
-   * public row must reflect the write at that checkpoint.
-   */
-  it(`patches a zero-lease observer retained by a listener`, async () => {
-    type Row = { id: string; name: string }
-    const id = `listener-retained-direct-write`
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([{ id: `x`, name: `before` }]))
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        staleTime: Number.POSITIVE_INFINITY,
-      }),
-    )
-    let releaseListener = () => {}
-    cleanups.push(async () => {
-      releaseListener()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    const observer = query.observers[0]!
-    releaseListener = observer.subscribe(() => {})
-    collection._sync.unloadSubset({})
-    await collection.utils.writeUpdate({ id: `x`, name: `after` })
-    expect(query.state.data).toEqual([{ id: `x`, name: `after` }])
-    await collection._sync.loadSubset({})
-    expect(collection.get(`x`)?.name).toBe(`after`)
-    expect(queryFn).toHaveBeenCalledTimes(1)
-  })
-
-  /**
-   * A fetched result may have reached the Query cache while its persisted
-   * baseline scan still holds Collection application. Its new row has no
-   * committed owner yet. A direct write to that row must patch the provisional
-   * cache entry before any later cache replay; the independent reference
-   * overlays the accepted write on the fetched row at this held checkpoint.
-   */
-  it(`patches a provisional cached row while its result application waits`, async () => {
-    const id = `pending-result-cache-patch`
-    const queryHash = hashKey([id])
-    const before = { ...shared, name: `Before` }
-    const provisional = { id: `new`, category: `shared`, name: `Older` }
-    const manual = { ...provisional, name: `Manual` }
-    const scan =
-      createDeferred<
-        Array<{ key: string | number; value: Item; metadata?: unknown }>
-      >()
-    const scanPersistedRows = vi.fn(() => scan.promise)
-    const { collection, queryClient, queryFn } = createOwnershipFixture({
-      id,
-      results: [[before], [provisional]],
-      scanPersistedRows,
-    })
-    cleanups.push(() => {
-      scan.resolve([])
-      return Promise.resolve()
-    })
-    await collection._sync.loadSubset({})
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    const foreign = new QueryObserver(queryClient, {
-      queryKey: [id],
-      queryFn,
-      staleTime: Infinity,
-    })
-    const release = foreign.subscribe(() => {})
-    cleanups.push(() => Promise.resolve(release()))
-    collection._sync.unloadSubset({})
-    await collection.utils.writeDelete(before.id)
-    collection._state.syncedCollectionMetadata.set(
-      `queryCollection:gc:${queryHash}`,
-      {
-        queryHash,
-        mode: `until-revalidated`,
-      },
-    )
-    const load = Promise.resolve(collection._sync.loadSubset({ refetch: true }))
-    void load.catch(() => undefined)
-    await vi.waitFor(() => expect(query.state.data).toEqual([provisional]))
-    expect(scanPersistedRows).toHaveBeenCalled()
-    await collection.utils.writeUpsert(manual)
-    expect(query.state.data).toEqual([manual])
-    scan.resolve([])
-    await load
-    expect(collection.get(manual.id)?.name).toBe(`Manual`)
-  })
-
-  /**
-   * A fetch-start position is needed only while its subset observer remains
-   * live. The reference count after retiring eight distinct subset leases is
-   * zero. Instrument maps receiving this fixture's unique Query hashes,
-   * distinguish fetch positions by their distinct values across eight
-   * requests, then compare retained entries after every subset unloads.
-   */
-  it(`retires fetch-start positions with their subset observers`, async () => {
-    type Row = { id: string }
-    const id = `fetch-start-retirement`
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => Promise.resolve([] as Array<Row>))
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const originals = Map.prototype.set
-    const stamped = new Set<Map<unknown, unknown>>()
-    const setSpy = vi.spyOn(Map.prototype, `set`).mockImplementation(function (
-      this: Map<unknown, unknown>,
-      key: unknown,
-      value: unknown,
-    ) {
-      if (
-        typeof key === `string` &&
-        key.includes(id) &&
-        typeof value === `number`
-      ) {
-        stamped.add(this)
-      }
-      return originals.call(this, key, value)
-    })
-    const demands = Array.from({ length: 8 }, (_, index) => ({
-      where: eq(new IR.PropRef([`id`]), String(index)),
-    }))
-    try {
-      for (const demand of demands) await collection._sync.loadSubset(demand)
-    } finally {
-      setSpy.mockRestore()
-    }
-    const fetchStarts = [...stamped].find((map) => {
-      const positions = demands.map((demand) =>
-        map.get(hashKey([id, getLoadSubsetDemandKey(demand)])),
-      )
-      return (
-        positions.every((position) => typeof position === `number`) &&
-        new Set(positions).size === demands.length
-      )
-    })
-    expect(fetchStarts).toBeDefined()
-    expect(
-      [...fetchStarts!.keys()].filter((key) => String(key).includes(id)),
-    ).toHaveLength(8)
-    for (const demand of demands) collection._sync.unloadSubset(demand)
-    expect(
-      [...fetchStarts!.keys()].filter((key) => String(key).includes(id)),
-    ).toHaveLength(0)
-  })
-
-  /**
-   * Persisted retention may keep an unfinished Query after its final observer
-   * lease ends. Its fetch-start position must survive that interval so a later
-   * lease can compare the request with a direct write. Once the detached fetch
-   * settles or its Query leaves the cache, no request can reuse that position.
-   * The reference holds one position at unload and zero at either terminal
-   * checkpoint. The driver records the same map as the retirement witness.
-   */
-  it.each([`settlement`, `cache removal`] as const)(
-    `retires a persisted Query's fetch-start position after detached %s`,
-    async (ending) => {
-      const id = `retained-fetch-start-retirement`
-      const queryHash = hashKey([id])
-      const pending = createDeferred<Array<Item>>()
-      const { collection, queryClient, queryFn } = createOwnershipFixture({
-        id,
-        results: [pending.promise],
-        persistedGcTime: Number.POSITIVE_INFINITY,
-        scanPersistedRows: () => Promise.resolve([]),
-      })
-      const originalSet = Map.prototype.set
-      const stamped = new Set<Map<unknown, unknown>>()
-      const setSpy = vi
-        .spyOn(Map.prototype, `set`)
-        .mockImplementation(function (
-          this: Map<unknown, unknown>,
-          key: unknown,
-          value: unknown,
-        ) {
-          if (key === queryHash && typeof value === `number`) stamped.add(this)
-          return originalSet.call(this, key, value)
-        })
-      const load = Promise.resolve(collection._sync.loadSubset({}))
-      void load.catch(() => undefined)
-      try {
-        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
-      } finally {
-        setSpy.mockRestore()
-      }
-      const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-      collection._sync.unloadSubset({})
-      expect(query.state.fetchStatus).toBe(`fetching`)
-      const fetchStarts = [...stamped].find(
-        (map) =>
-          typeof map.get(queryHash) === `number` &&
-          Number.isFinite(map.get(queryHash)) &&
-          map.get(queryHash) !== 0,
-      )
-      expect(fetchStarts).toBeDefined()
-      expect(fetchStarts!.has(queryHash)).toBe(true)
-      if (ending === `settlement`) {
-        pending.resolve([])
-        await vi.waitFor(() => expect(query.state.fetchStatus).toBe(`idle`))
-      } else {
-        queryClient.removeQueries({ queryKey: [id], exact: true })
-      }
-      expect(fetchStarts!.has(queryHash)).toBe(false)
-      pending.resolve([])
-      await load.catch(() => undefined)
-    },
-  )
-
-  /**
-   * An explicit refetch after a direct write asks the provider for a result
-   * newer than that write. The reference is request order: a request begun
-   * before the write cannot discharge the later refetch, even when Query Core
-   * has no cached data and would normally reuse the pending request. The
-   * legal history holds the initial request, writes a row, deletes it, then
-   * refetches. At settlement, the public row set must equal the second
-   * provider response and the provider must have received two requests.
-   */
-  it(`starts a post-write request for explicit refetch during an empty-cache fetch`, async () => {
-    type Row = { id: string; name: string }
-    const id = `post-write-explicit-refetch`
-    const first = createDeferred<Array<Row>>()
-    const started = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => {
-      if (queryFn.mock.calls.length === 1) {
-        started.resolve()
-        return first.promise
-      }
-      return Promise.resolve([] as Array<Row>)
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      first.resolve([])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection.utils.writeInsert({ id: `x`, name: `local` })
-    const load = Promise.resolve(collection._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    await started.promise
-    await collection.utils.writeDelete(`x`)
-    const refetch = collection.utils.refetch({ throwOnError: true })
-    first.resolve([{ id: `x`, name: `stale` }])
-    await refetch
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(collection.has(`x`)).toBe(false)
-    await load.catch(() => undefined)
-  })
-
-  /**
-   * An explicit subset refetch has the same post-write request-order promise
-   * as utils.refetch. The first empty-cache request begins before a direct
-   * delete; a second load with `refetch: true` must start a newer request.
-   * At that load's settlement, the public row reflects the newer response.
-   */
-  it(`starts a post-write request for an explicit subset refetch`, async () => {
-    const id = `subset-post-write-refetch`
-    const first = createDeferred<Array<Item>>()
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [first.promise, []],
-    })
-    await collection.utils.writeInsert(shared)
-    const initialLoad = Promise.resolve(collection._sync.loadSubset({}))
-    void initialLoad.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
-    await collection.utils.writeDelete(shared.id)
-    const refetchLoad = Promise.resolve(
-      collection._sync.loadSubset({ refetch: true }),
-    )
-    first.resolve([{ ...shared, name: `Stale` }])
-    await refetchLoad
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(collection.has(shared.id)).toBe(false)
-    await initialLoad.catch(() => undefined)
-  })
-
-  /**
-   * A deferred refresh is scheduled when a successful cached result is
-   * refetching while the barrier is held. After a direct delete, releasing the
-   * barrier starts a newer request. The independent request-order rule needs
-   * that third provider call before the older refetch is allowed to settle.
-   */
-  it(`starts a post-write request when a deferred refresh barrier releases`, async () => {
-    const id = `deferred-post-write-refetch`
-    const older = createDeferred<Array<Item>>()
-    const barrier = createDeferred<void>()
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [[shared], older.promise, []],
-    })
-    const release = barrier.promise.then(() => {
-      collection.deferDataRefresh = null
-    })
-    cleanups.push(() => {
-      older.resolve([])
-      barrier.resolve()
-      return Promise.resolve()
-    })
-    await collection._sync.loadSubset({})
-    collection.deferDataRefresh = barrier.promise
-    const refetch = collection.utils.refetch({ throwOnError: true })
-    void refetch.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-    await collection.utils.writeDelete(shared.id)
-    barrier.resolve()
-    await release
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    older.resolve([{ ...shared, name: `Stale` }])
-    await refetch.catch(() => undefined)
-    expect(collection.has(shared.id)).toBe(false)
-  })
-
-  /**
-   * Retiring a subset can retain its persisted rows while Query Core keeps an
-   * unfinished, empty-cache request. Reacquiring that subset does not make the
-   * old request newer. The reference is request order: after an accepted direct
-   * delete, an explicit refetch must start a post-write request, and its public
-   * settlement must observe that request's rows. Without a later write, the
-   * refetch may reuse the request. Hold it across unload and reacquisition in
-   * both histories to distinguish this from an ordinary active fetch. This
-   * controlled Query Core driver does not model a native SQLite adapter.
-   */
-  it.each([
-    {
-      name: `starts a post-write refetch after reacquiring a retained in-flight Query`,
-      writeAfterStart: true,
-      requestCount: 2,
-    },
-    {
-      name: `reuses a retained in-flight Query without a later write`,
-      writeAfterStart: false,
-      requestCount: 1,
-    },
-  ])(`$name`, async ({ writeAfterStart, requestCount }) => {
-    const id = `retained-post-write-refetch`
-    const stale = { ...shared, name: `Stale` }
-    const first = createDeferred<Array<Item>>()
-    const { collection, queryClient, queryFn } = createOwnershipFixture({
-      id,
-      results: [first.promise, []],
-      persistedGcTime: Number.POSITIVE_INFINITY,
-      scanPersistedRows: () => Promise.resolve([]),
-    })
-
-    await collection.utils.writeInsert(shared)
-    const initialLoad = Promise.resolve(collection._sync.loadSubset({}))
-    void initialLoad.catch(() => undefined)
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    collection._sync.unloadSubset({})
-    expect(query.state.fetchStatus).toBe(`fetching`)
-    expect(query.getObserversCount()).toBe(0)
-
-    const reacquiredLoad = Promise.resolve(collection._sync.loadSubset({}))
-    void reacquiredLoad.catch(() => undefined)
-    expect(queryClient.getQueryCache().find({ queryKey: [id] })).toBe(query)
-    expect(queryFn).toHaveBeenCalledTimes(1)
-    if (writeAfterStart) await collection.utils.writeDelete(shared.id)
-    const refetch = collection.utils.refetch({ throwOnError: true })
-    first.resolve([stale])
-    await refetch
-    expect(queryFn).toHaveBeenCalledTimes(requestCount)
-    if (writeAfterStart) expect(collection.has(shared.id)).toBe(false)
-    await Promise.allSettled([initialLoad, reacquiredLoad])
-  })
-
-  /**
-   * A Query can keep fetching after ordinary subset cleanup when an outside
-   * observer still owns it. That request began before a later direct delete.
-   * Reacquisition cannot promote it above the delete. The request-order model
-   * keeps the deletion when the old result settles; an explicit refetch must
-   * instead start a new request. Both histories observe the public row at
-   * their load or refetch settlement checkpoint.
-   */
-  it.each([`old result`, `explicit refetch`] as const)(
-    `preserves a direct delete across ordinary unload and reacquisition: %s`,
-    async (ending) => {
-      const id = `ordinary-unload-post-write-${ending}`
-      const stale = { ...shared, name: `Stale` }
-      const first = createDeferred<Array<Item>>()
-      const { collection, queryClient, queryFn } = createOwnershipFixture({
-        id,
-        results: [first.promise, []],
-      })
-      await collection.utils.writeInsert(shared)
-      const initialLoad = Promise.resolve(collection._sync.loadSubset({}))
-      void initialLoad.catch(() => undefined)
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
-      const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-      const foreign = new QueryObserver(queryClient, {
-        queryKey: [id],
-        queryFn,
-        staleTime: Number.POSITIVE_INFINITY,
-      })
-      const unsubscribe = foreign.subscribe(() => {})
-      cleanups.push(() => {
-        unsubscribe()
-        return Promise.resolve()
-      })
-      collection._sync.unloadSubset({})
-      expect(query.state.fetchStatus).toBe(`fetching`)
-      expect(query.getObserversCount()).toBe(1)
-      await collection.utils.writeDelete(shared.id)
-      const reacquiredLoad = Promise.resolve(collection._sync.loadSubset({}))
-      void reacquiredLoad.catch(() => undefined)
-      expect(queryClient.getQueryCache().find({ queryKey: [id] })).toBe(query)
-
-      if (ending === `explicit refetch`) {
-        const refetch = collection.utils.refetch({ throwOnError: true })
-        first.resolve([stale])
-        await refetch
-        expect(queryFn).toHaveBeenCalledTimes(2)
-      } else {
-        first.resolve([stale])
-      }
-      await reacquiredLoad
-      expect(collection.has(shared.id)).toBe(false)
-      await initialLoad.catch(() => undefined)
-    },
-  )
-
-  /**
-   * A fetched result and accepted direct writes form a per-key ordered merge.
-   * The independent reference overlays writes accepted after fetch start onto
-   * fetched rows, but does not add unrelated keys to an on-demand scope. This
-   * history covers a previously owned row, a held explicit refetch, a later
-   * direct update, and an unrelated direct insert. The Collection rows and Query cache are compared when
-   * the refetch settles; the eager sibling above covers the other sync mode.
-   */
-  it(`keeps a later on-demand direct update over an older refetch row`, async () => {
-    type Row = { id: string; name: string }
-    const id = `on-demand-older-fetch-write`
-    const held = createDeferred<Array<Row>>()
-    const started = createDeferred<void>()
-    const queryClient = createQueryClient()
-    const queryFn = vi.fn(() => {
-      if (queryFn.mock.calls.length === 1)
-        return Promise.resolve([{ id: `x`, name: `before` }])
-      started.resolve()
-      return held.promise
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      held.resolve([])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    const refetch = collection.utils.refetch({ throwOnError: true })
-    await started.promise
-    await collection.utils.writeUpdate({ id: `x`, name: `after` })
-    await collection.utils.writeInsert({ id: `y`, name: `outside scope` })
-    held.resolve([{ id: `x`, name: `before` }])
-    await refetch
-    expect(collection.get(`x`)?.name).toBe(`after`)
-    expect(collection.get(`y`)?.name).toBe(`outside scope`)
-    expect(queryClient.getQueryData<Array<Row>>([id])).toEqual([
-      { id: `x`, name: `after` },
-    ])
-  })
-
-  /**
-   * A cached row with a subset owner does not give a later local cache edit
-   * server authority over an accepted direct update. The independent order
-   * has four values: fetched Server, A's Manual write, a QueryClient-only
-   * cache edit, then a new provider fetch. The edit is visible to B through
-   * its Query observer, but A keeps Manual until the final fetch starts after
-   * the write and returns Newer. This crosses the owned-row state omitted by
-   * the ownerless shared-cache histories. The real QueryClient drives both
-   * Collections; public rows and provider calls are checked after the edit
-   * and after the optional fetch. The neighboring fetch history rejects a
-   * repair that permanently shields A from server results.
-   */
-  it.each([
-    { history: `local-cache-edit`, fetchAfterEdit: false },
-    { history: `newer-provider-fetch`, fetchAfterEdit: true },
-  ])(
-    `keeps owned direct-row authority across $history`,
-    async ({ fetchAfterEdit }) => {
-      type Row = { id: string; name: string }
-      const id = `owned-direct-cache-edit-${fetchAfterEdit}`
-      const queryClient = createQueryClient()
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
-        .mockResolvedValue([{ id: `x`, name: `Newer` }])
-      const makeCollection = (suffix: string) =>
-        createCollection(
-          queryCollectionOptions<Row>({
-            id: `${id}-${suffix}`,
-            queryClient,
-            queryKey: [id],
-            queryFn,
-            getKey: (row) => row.id,
-            syncMode: `on-demand`,
-            staleTime: Infinity,
-            startSync: true,
-          }),
-        )
-      const a = makeCollection(`a`)
-      const b = makeCollection(`b`)
-      cleanups.push(async () => {
-        await a.cleanup()
-        await b.cleanup()
-        queryClient.clear()
-      })
-
-      await a._sync.loadSubset({})
-      await b._sync.loadSubset({})
-      expect(queryFn).toHaveBeenCalledOnce()
-      await a.utils.writeUpdate({ id: `x`, name: `Manual` })
-      expect(a.get(`x`)?.name).toBe(`Manual`)
-      expect(b.get(`x`)?.name).toBe(`Server`)
-
-      queryClient.setQueryData([id], [{ id: `x`, name: `Local edit` }])
-      await vi.waitFor(() => expect(b.get(`x`)?.name).toBe(`Local edit`))
-      expect(queryFn).toHaveBeenCalledOnce()
-      if (!fetchAfterEdit) {
-        expect(a.get(`x`)?.name).toBe(`Manual`)
-        return
-      }
-
-      await b.utils.refetch({ throwOnError: true })
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(a.get(`x`)?.name).toBe(`Newer`)
-      expect(b.get(`x`)?.name).toBe(`Newer`)
-    },
-  )
-
-  /**
-   * Starting a newer physical fetch does not publish its answer. While that
-   * request is held, a manual Query cache edit remains local and cannot
-   * replace A's accepted direct row. The independent reference orders the
-   * direct write, fetch start, local edit, and fetch result separately. The
-   * held cut distinguishes fetch-start authority from result authority; the
-   * final cut admits the actual newer server row.
-   */
-  it(`keeps an owned direct row through a local cache edit during a held fetch`, async () => {
-    type Row = { id: string; name: string }
-    const id = `owned-direct-held-fetch-cache-edit`
-    const queryClient = createQueryClient()
-    const held = createDeferred<Array<Row>>()
-    const requestStarted = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
-      .mockImplementationOnce(() => {
-        requestStarted.resolve()
-        return held.promise
-      })
-    const makeCollection = (suffix: string) =>
-      createCollection(
-        queryCollectionOptions<Row>({
-          id: `${id}-${suffix}`,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode: `on-demand`,
-          staleTime: Infinity,
-          startSync: true,
-        }),
-      )
-    const a = makeCollection(`a`)
-    const b = makeCollection(`b`)
-    cleanups.push(async () => {
-      held.resolve([{ id: `x`, name: `Newer` }])
-      await a.cleanup()
-      await b.cleanup()
-      queryClient.clear()
-    })
-
-    await a._sync.loadSubset({})
-    await b._sync.loadSubset({})
-    await a.utils.writeUpdate({ id: `x`, name: `Manual` })
-    const refetch = b.utils.refetch({ throwOnError: true })
-    await requestStarted.promise
-    queryClient.setQueryData([id], [{ id: `x`, name: `Local edit` }])
-    await vi.waitFor(() => expect(b.get(`x`)?.name).toBe(`Local edit`))
-    expect(queryFn).toHaveBeenCalledTimes(2)
-    expect(a.get(`x`)?.name).toBe(`Manual`)
-
-    held.resolve([{ id: `x`, name: `Newer` }])
-    await refetch
-    expect(a.get(`x`)?.name).toBe(`Newer`)
-    expect(b.get(`x`)?.name).toBe(`Newer`)
-  })
-
-  /**
-   * A local cache edit still lacks server authority after A releases and
-   * reacquires its sole subset. The direct update owned that subset, so its
-   * row retires on unload; the retained Query cache then contains a manual
-   * edit that cannot establish a new owned row. The independent reference
-   * requires a physical result before load settlement. An outside Query
-   * observer keeps the cache alive, and the held-request checkpoint rejects
-   * treating the manual edit as a successful fetch.
-   */
-  it(`revalidates a sole owner's manually edited cache on reacquisition`, async () => {
-    type Row = { id: string; name: string }
-    const id = `owned-direct-manual-cache-reacquisition`
-    const queryClient = createQueryClient()
-    const queryKey = [id]
-    const newer = { id: `x`, name: `Newer` }
-    const held = createDeferred<Array<Row>>()
-    const requestStarted = createDeferred<void>()
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
-      .mockImplementationOnce(() => {
-        requestStarted.resolve()
-        return held.promise
-      })
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey,
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        staleTime: Infinity,
-        startSync: true,
-      }),
-    )
-    const outside = new QueryObserver(queryClient, {
-      queryKey,
-      queryFn,
-      enabled: false,
-      staleTime: Infinity,
-    })
-    const unsubscribeOutside = outside.subscribe(() => {})
-    cleanups.push(async () => {
-      held.resolve([newer])
-      unsubscribeOutside()
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    await collection.utils.writeUpdate({ id: `x`, name: `Manual` })
-    queryClient.setQueryData(queryKey, [{ id: `x`, name: `Local edit` }])
-    expect(collection.get(`x`)?.name).toBe(`Manual`)
-    collection._sync.unloadSubset({})
-    expect(collection.has(`x`)).toBe(false)
-    const load = Promise.resolve(collection._sync.loadSubset({}))
-    void load.catch(() => undefined)
-    expect(
-      await Promise.race([
-        load.then(
-          () => `settled`,
-          () => `rejected`,
-        ),
-        requestStarted.promise.then(() => `request-started`),
-      ]),
-    ).toBe(`request-started`)
-    expect(collection.has(`x`)).toBe(false)
-    held.resolve([newer])
-    await load
-    expect(collection.get(`x`)?.name).toBe(newer.name)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-  })
-
-  /**
-   * A direct cache edit is a notification, not a Query result. Its independent
-   * reference keeps the last fetch error and Query's invalidation/freshness
-   * metadata while replacing only an already cached row. The grammar here
-   * covers an error, a pending invalidation, and an expired timestamp; the checkpoints are
-   * Collection utilities, Query cache state, and the accepted Collection row.
-   */
-  it.each(
-    ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
-      ([`error`, `invalidation`, `stale`] as const).map((cut) => ({
-        syncMode,
-        cut,
-      })),
-    ),
-  )(
-    `preserves Query $cut state across a $syncMode direct cache patch`,
-    async ({ syncMode, cut }) => {
-      type Row = { id: string; name: string }
-      const id = `direct-cache-${cut}`
-      const queryClient = createQueryClient(false, 1000)
-      const fetchError = new Error(`fetch failed`)
-      const queryFn = vi
-        .fn()
-        .mockResolvedValueOnce([{ id: `x`, name: `before` }])
-        .mockRejectedValueOnce(fetchError)
-      const collection = createCollection(
-        queryCollectionOptions<Row>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (row) => row.id,
-          syncMode,
-          startSync: true,
-        }),
-      )
-      cleanups.push(async () => {
-        await collection.cleanup()
-        queryClient.clear()
-      })
-      if (syncMode === `eager`) await collection.preload()
-      else await collection._sync.loadSubset({})
-      const query = queryClient
-        .getQueryCache()
-        .find({ queryKey: [id], exact: true })!
-      if (cut === `error`) {
-        await collection.utils.refetch()
-        expect(reportedError(collection)).toBe(fetchError)
-      } else {
-        if (cut === `invalidation`) {
-          await queryClient.invalidateQueries({
-            queryKey: [id],
-            exact: true,
-            refetchType: `none`,
-          })
-          expect(query.state.isInvalidated).toBe(true)
-        } else {
-          query.setState({ dataUpdatedAt: Date.now() - 60_000 })
-          expect(query.isStale()).toBe(true)
-        }
-      }
-      const updatedAt = query.state.dataUpdatedAt
-      await collection.utils.writeUpdate({ id: `x`, name: `after` })
-      expect(collection.get(`x`)?.name).toBe(`after`)
-      expect(query.state.dataUpdatedAt).toBe(updatedAt)
-      if (cut === `error`) {
-        expect(reportedError(collection)).toBe(fetchError)
-        expect(reportedError(collection)).toBeDefined()
-      } else if (cut === `invalidation`) {
-        expect(query.state.isInvalidated).toBe(true)
-      } else {
-        expect(query.isStale()).toBe(true)
-      }
-    },
-  )
-
-  /**
-   * A Query Core hash may coalesce equivalent subset predicates into one
-   * physical Query while DB retains two logical subset demands. A response
-   * from a fetch started before an accepted direct write cannot undo that
-   * write's key, whichever logical demand observed the fetch. A response from
-   * a later fetch may replace it. The reference is the order of the authored
-   * fetches and write, independent of the Query cache's chosen first key.
-   *
-   * The legal history uses `id = x` and `id IN [x]`, which have equal row
-   * meaning but distinct demand keys. The real QueryClient coalesces them by
-   * a custom hash. The public row is compared after the write, after the held
-   * older result applies, and after a post-write result applies. The provider
-   * call count proves each requested fetch ran.
-   */
-  it(`preserves a direct write across an older aliased Query fetch`, async () => {
-    type Row = { id: string; name: string }
-    const id = `aliased-fetch-write-order`
-    const older = createDeferred<Array<Row>>()
-    const queryClient = new QueryClient({
-      defaultOptions: {
-        queries: {
-          retry: false,
-          staleTime: Infinity,
-          gcTime: Infinity,
-          queryKeyHashFn: () => `equivalent-subset-query`,
-        },
-      },
-    })
-    const before = { id: `x`, name: `Before` }
-    const manual = { id: `x`, name: `Manual` }
-    const newer = { id: `x`, name: `Newer` }
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce([before])
-      .mockImplementationOnce(() => older.promise)
-      .mockResolvedValue([newer])
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      older.resolve([])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const a = { where: eq(new IR.PropRef([`id`]), `x`) }
-    const b = {
-      where: new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`x`])]),
-    }
-    expect(getLoadSubsetDemandKey(a)).not.toBe(getLoadSubsetDemandKey(b))
-
-    await collection._sync.loadSubset(a)
-    await collection._sync.loadSubset({ ...b, refetch: true })
-    expect(collection.get(`x`)?.name).toBe(before.name)
-    const held = collection._sync.loadSubset({ ...b, refetch: true })
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    await collection.utils.writeUpdate(manual)
-    expect(collection.get(`x`)?.name).toBe(manual.name)
-
-    older.resolve([{ id: `x`, name: `Older` }])
-    await held
-    expect(collection.get(`x`)?.name).toBe(manual.name)
-
-    await collection._sync.loadSubset({ ...b, refetch: true })
-    expect(queryFn).toHaveBeenCalledTimes(4)
-    expect(collection.get(`x`)?.name).toBe(newer.name)
-  })
-
-  /**
-   * The physical Query may start fetching before a second equivalent logical
-   * demand attaches. That demand did not observe the fetch event, but its
-   * result is still older than a later accepted direct write. The independent
-   * reference orders the held fetch before the write and preserves `Manual`
-   * for both demands at result settlement. A later fetch remains authoritative.
-   * This history distinguishes joining an in-flight Query from observing a
-   * fetch that starts after both logical demands are attached.
-   */
-  it(`preserves a direct write when an aliased demand joins an in-flight fetch`, async () => {
-    type Row = { id: string; name: string }
-    const id = `aliased-join-in-flight-fetch`
-    const older = createDeferred<Array<Row>>()
-    const queryClient = new QueryClient({
-      defaultOptions: {
-        queries: {
-          retry: false,
-          staleTime: Infinity,
-          gcTime: Infinity,
-          queryKeyHashFn: () => `aliased-join-query`,
-        },
-      },
-    })
-    const before = { id: `x`, name: `Before` }
-    const manual = { id: `x`, name: `Manual` }
-    const newer = { id: `x`, name: `Newer` }
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([before])
-      .mockImplementationOnce(() => older.promise)
-      .mockResolvedValue([newer])
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      older.resolve([])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const a = { where: eq(new IR.PropRef([`id`]), `x`) }
-    const b = {
-      where: new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`x`])]),
-    }
-    expect(getLoadSubsetDemandKey(a)).not.toBe(getLoadSubsetDemandKey(b))
-
-    await collection._sync.loadSubset(a)
-    expect(collection.get(`x`)?.name).toBe(before.name)
-    const held = collection._sync.loadSubset({ ...a, refetch: true })
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-    const joining = collection._sync.loadSubset(b)
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    await vi.waitFor(() => expect(query.getObserversCount()).toBe(2))
-    await collection.utils.writeUpdate(manual)
-    expect(collection.get(`x`)?.name).toBe(manual.name)
-
-    older.resolve([{ id: `x`, name: `Older` }])
-    await Promise.all([held, joining])
-    expect(collection.get(`x`)?.name).toBe(manual.name)
-    expect(queryFn).toHaveBeenCalledTimes(2)
-
-    await collection._sync.loadSubset({ ...b, refetch: true })
-    expect(queryFn).toHaveBeenCalledTimes(3)
-    expect(collection.get(`x`)?.name).toBe(newer.name)
-  })
-
-  /**
-   * Two equivalent demands share a physical Query. A direct write lands while
-   * its first refetch is held. A later physical refetch starts after the write,
-   * then the demand whose key Query Core uses retires. The remaining demand
-   * did not run the Query function, but the new fetch is authoritative for
-   * its row. The independent reference uses the authored fetch/write order:
-   * `Newer` must replace `Manual` when the replacement result applies. This
-   * distinguishes fetch-event propagation from attach-time initialization.
-   */
-  it(`applies a post-write fetch to an aliased demand after its peer retires`, async () => {
-    type Row = { id: string; name: string }
-    const id = `aliased-peer-retires-after-fetch-start`
-    const older = createDeferred<Array<Row>>()
-    const replacement = createDeferred<Array<Row>>()
-    const queryClient = new QueryClient({
-      defaultOptions: {
-        queries: {
-          retry: false,
-          staleTime: Infinity,
-          gcTime: Infinity,
-          queryKeyHashFn: () => `aliased-peer-retirement-query`,
-        },
-      },
-    })
-    const before = { id: `x`, name: `Before` }
-    const manual = { id: `x`, name: `Manual` }
-    const newer = { id: `x`, name: `Newer` }
-    const queryFn = vi
-      .fn()
-      .mockResolvedValueOnce([before])
-      .mockImplementationOnce(() => older.promise)
-      .mockImplementationOnce(() => replacement.promise)
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      older.resolve([])
-      replacement.resolve([])
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const a = { where: eq(new IR.PropRef([`id`]), `x`) }
-    const b = {
-      where: new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`x`])]),
-    }
-    expect(getLoadSubsetDemandKey(a)).not.toBe(getLoadSubsetDemandKey(b))
-
-    await collection._sync.loadSubset(b)
-    await collection._sync.loadSubset(a)
-    expect(collection.get(`x`)?.name).toBe(before.name)
-    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
-    expect(query.getObserversCount()).toBe(2)
-    const held = queryClient.refetchQueries({
-      predicate: (candidate) => candidate === query,
-    })
-    void held.catch(() => {})
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-    expect(query.state.fetchStatus).toBe(`fetching`)
-    await collection.utils.writeUpdate(manual)
-    expect(collection.get(`x`)?.name).toBe(manual.name)
-
-    const postWrite = queryClient.refetchQueries({
-      predicate: (candidate) => candidate === query,
-    })
-    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
-    collection._sync.unloadSubset(b)
-    expect(query.getObserversCount()).toBe(1)
-    expect(collection.get(`x`)?.name).toBe(manual.name)
-
-    replacement.resolve([newer])
-    await postWrite
-    await vi.waitFor(() => expect(collection.get(`x`)?.name).toBe(newer.name))
-    older.resolve([{ id: `x`, name: `Older` }])
-    await held.catch(() => {})
-    expect(collection.get(`x`)?.name).toBe(newer.name)
-    expect(queryFn).toHaveBeenCalledTimes(3)
-  })
-
-  /**
-   * One physical Query has one cache-patch obligation per direct write. Two
-   * distinct subset demands may alias the same Query under a custom Query
-   * hash. The model counts physical Queries, not logical demand hashes. The
-   * driver observes Query cache notifications and the public row after one write.
-   */
-  it(`patches a shared physical Query once per direct write`, async () => {
-    type Row = { id: string; name: string; category: string }
-    const id = `shared-physical-query-write`
-    const queryClient = new QueryClient({
-      defaultOptions: {
-        queries: {
-          retry: false,
-          staleTime: Infinity,
-          gcTime: Infinity,
-          queryKeyHashFn: () => `shared-physical-query`,
-        },
-      },
-    })
-    const queryFn = vi.fn(() =>
-      Promise.resolve([{ id: `x`, name: `before`, category: `A` }]),
-    )
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    await collection._sync.loadSubset({
-      where: eq(new IR.PropRef([`category`]), `A`),
-    })
-    await collection._sync.loadSubset({
-      where: eq(new IR.PropRef([`id`]), `x`),
-    })
-    const queries = queryClient.getQueryCache().getAll()
-    expect(queries).toHaveLength(1)
-    let notifications = 0
-    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
-      if (event.type === `updated` && event.query === queries[0])
-        notifications++
-    })
-    await collection.utils.writeUpdate({ id: `x`, name: `after` })
-    unsubscribe()
-    expect(notifications).toBe(1)
-    expect(collection.get(`x`)?.name).toBe(`after`)
-  })
-
-  /**
-   * A zero-lease logical scope can keep its observer through an outside
-   * listener after its Collection handler is removed. A second logical scope
-   * may share that physical Query under a custom hash and become the owner of
-   * a newer row. The independent cache rule requires one patch through the
-   * owning scope even when the disjoint observer is visited first.
-   */
-  it(`patches an aliased Query through its owning observer`, async () => {
-    type Row = { id: string; name: string; category: string }
-    const id = `aliased-owner-cache-patch`
-    const a = { id: `a`, name: `A`, category: `A` }
-    const b = { id: `b`, name: `Before`, category: `B` }
-    const queryClient = new QueryClient({
-      defaultOptions: {
-        queries: {
-          retry: false,
-          staleTime: Infinity,
-          gcTime: Infinity,
-          queryKeyHashFn: () => `aliased-owner`,
-        },
-      },
-    })
-    const queryFn = vi.fn().mockResolvedValueOnce([a]).mockResolvedValue([b])
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    const demandA = { where: eq(new IR.PropRef([`category`]), `A`) }
-    const demandB = { where: eq(new IR.PropRef([`category`]), `B`) }
-    await collection._sync.loadSubset(demandA)
-    const query = queryClient.getQueryCache().getAll()[0]!
-    const observerA = query.observers[0]!
-    const releaseOutsideListener = observerA.subscribe(() => {})
-    cleanups.push(() => Promise.resolve(releaseOutsideListener()))
-    collection._sync.unloadSubset(demandA)
-    await collection._sync.loadSubset({ ...demandB, refetch: true })
-    expect(collection.has(b.id)).toBe(true)
-    expect(query.state.data).toEqual([b])
-    await collection.utils.writeUpdate({ id: b.id, name: `After` })
-    expect(query.state.data).toEqual([{ ...b, name: `After` }])
-  })
-
-  /**
-   * A direct update to an owned row needs work in its owner's cached scope,
-   * not in every disjoint scope. The independent category partition has ten
-   * scopes of 1,000 rows and exactly one owner for the changed key. After
-   * preload, a counted getKey boundary bounds one write to three owner-sized
-   * passes plus fixed overhead. This counts actual adapter key extraction,
-   * rather than timing or provider work.
-   */
-  it(`bounds direct cache patch work by the changed row's owners`, async () => {
-    type Row = { id: string; category: string; name: string }
-    const id = `direct-cache-owner-work`
-    const queryClient = createQueryClient()
-    let getKeyCalls = 0
-    const source = Array.from({ length: 10 }, (_, category) =>
-      Array.from({ length: 1000 }, (_, index) => ({
-        id: `${category}-${index}`,
-        category: String(category),
-        name: `before`,
-      })),
-    ).flat()
-    const queryFn = vi.fn((context: QueryFunctionContext) => {
-      const where = context.meta?.loadSubsetOptions?.where
-      const lastArg = where?.type === `func` ? where.args.at(-1) : undefined
-      const category = lastArg?.type === `val` ? lastArg.value : undefined
-      return Promise.resolve(source.filter((row) => row.category === category))
-    })
-    const collection = createCollection(
-      queryCollectionOptions<Row>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (row) => {
-          getKeyCalls++
-          return row.id
-        },
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    for (let category = 0; category < 10; category++)
-      await collection._sync.loadSubset({
-        where: eq(new IR.PropRef([`category`]), String(category)),
-      })
-    getKeyCalls = 0
-    await collection.utils.writeUpdate({ id: `3-0`, name: `after` })
-    expect(collection.get(`3-0`)?.name).toBe(`after`)
-    expect(queryFn).toHaveBeenCalledTimes(10)
-    expect(getKeyCalls).toBeLessThanOrEqual(3010)
-  })
-
-  /**
-   * An empty persisted baseline is established by its first scan in a sync
-   * run. With no durable writer or cache rotation, later retained Query
-   * reacquisitions have no row ownership to reconcile and need no further
-   * full-store scan.
-   * A new sync run has no such evidence: a durable owner may have appeared
-   * while this Collection was absent. This is a bounded work proposal beside
-   * the existing row-ownership law, not a claim about arbitrary peer writes.
-   *
-   * The independent model retains only whether the current sync run scanned
-   * its empty baseline. `restart` removes that evidence. The fixed histories
-   * distinguish retained reacquisition from a cold run. They drive the real
-   * Query observer and persistence scan seam. They compare scan counts and
-   * public rows after each applied result.
-   */
-  const expectedEmptyBaselineScans = (
-    history: ReadonlyArray<`empty-result` | `restart`>,
-  ): number => {
-    let scans = 0
-    let emptyBaselineKnown = false
-    for (const action of history) {
-      if (action === `restart`) {
-        emptyBaselineKnown = false
-      } else if (!emptyBaselineKnown) {
-        scans++
-        emptyBaselineKnown = true
-      }
-    }
-    return scans
-  }
-
-  it(`does not rescan a stable empty persisted baseline on retained reacquisition`, async () => {
-    const id = `empty-persisted-baseline-work`
-    const queryHash = hashKey([id])
-    const scanPersistedRows = vi.fn(() => Promise.resolve([]))
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [[], [], []],
-      scanPersistedRows,
-      persistedGcTime: Number.POSITIVE_INFINITY,
-      setupMetadata: (metadata) =>
-        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-          queryHash,
-          mode: `until-revalidated`,
-        }),
-    })
-    const history: Array<`empty-result` | `restart`> = []
-
-    await collection._sync.loadSubset({})
-    history.push(`empty-result`)
-    expect(rows(collection)).toEqual([])
-    expect(scanPersistedRows).toHaveBeenCalledTimes(
-      expectedEmptyBaselineScans(history),
-    )
-
-    for (let result = 0; result < 2; result++) {
-      collection._sync.unloadSubset({})
-      await collection._sync.loadSubset({ refetch: true })
-      history.push(`empty-result`)
-      expect(rows(collection)).toEqual([])
-      expect(scanPersistedRows).toHaveBeenCalledTimes(
-        expectedEmptyBaselineScans(history),
-      )
-    }
-    expect(queryFn).toHaveBeenCalledTimes(3)
-  })
-
-  it(`scans a cold durable owner that appeared after an empty sync run`, async () => {
-    const id = `cold-owner-after-empty-baseline`
-    const queryHash = hashKey([id])
-    const hotStorage = createOwnershipStorage()
-    const hot = createPersistedOwnershipFixture(id, hotStorage, [])
-    await hot.collection._sync.loadSubset({})
-    expect(storedItems(hotStorage)).toEqual([])
-    await hot.collection.cleanup()
-
-    // This seeded durable state represents another writer's committed owner
-    // while the first Collection had no sync run. The cold Collection cannot
-    // use the first run's empty-baseline evidence.
-    const coldSeed = hotStorage.snapshot()
-    coldSeed.rows.set(shared.id, shared)
-    coldSeed.rowMetadata.set(shared.id, {
-      queryCollection: { owners: { [queryHash]: true } },
-    })
-    coldSeed.collectionMetadata.set(`queryCollection:gc:${queryHash}`, {
-      queryHash,
-      mode: `until-revalidated`,
-    })
-    const coldStorage = createOwnershipStorage(coldSeed)
-    const coldScanRows = vi.spyOn(coldStorage.adapter, `scanRows`)
-    const cold = createPersistedOwnershipFixture(id, coldStorage, [])
-    await cold.collection._sync.loadSubset({})
-
-    // The empty provider result retires the cold durable owner. A design that
-    // skips every empty-baseline scan leaves the stored row behind.
-    expect(cold.queryFn).toHaveBeenCalledOnce()
-    expect(rows(cold.collection)).toEqual([])
-    expect(storedItems(coldStorage)).toEqual([])
-    expect(coldScanRows).toHaveBeenCalledTimes(
-      expectedEmptyBaselineScans([`restart`, `empty-result`]),
-    )
-  })
-
-  /**
-   * A current complete Query result replaces its cold persisted result. The
-   * independent model starts with `{kept, omitted}` and replaces it with
-   * `{kept}`. Persisted row order cannot change that result, so both scan
-   * orders must expose the survivor and delete the omission.
-   */
-  it.each([
-    { scanOrder: [`kept`, `omitted`] },
-    { scanOrder: [`omitted`, `kept`] },
-  ] as const)(
-    `replaces a cold two-row result in scan order $scanOrder`,
-    async ({ scanOrder }) => {
-      const id = `cold-multi-row-owner-${scanOrder.join(`-`)}`
-      const queryHash = hashKey([id])
-      const kept: Item = { id: `kept`, category: `shared`, name: `Kept` }
-      const omitted: Item = {
-        id: `omitted`,
-        category: `shared`,
-        name: `Omitted`,
-      }
-      const byId = new Map([
-        [kept.id, kept],
-        [omitted.id, omitted],
-      ])
-      const ownerMetadata = {
-        queryCollection: { owners: { [queryHash]: true } },
-      }
-      const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
-      const scanPersistedRows = vi.fn(() =>
-        Promise.resolve(
-          scanOrder.map((rowId) => ({
-            key: rowId,
-            value: byId.get(rowId)!,
-            metadata: ownerMetadata,
-          })),
-        ),
-      )
-      const { collection } = createOwnershipFixture({
-        id,
-        results: [[kept]],
-        metadataRecorder: metadata,
-        scanPersistedRows,
-        setupMetadata: (syncMetadata) =>
-          syncMetadata.collection.set(`queryCollection:gc:${queryHash}`, {
-            queryHash,
-            mode: `until-revalidated`,
-          }),
-      })
-
-      await collection._sync.loadSubset({})
-
-      expect(rows(collection)).toEqual([kept.id])
-      expect(metadata.writes).toContainEqual({
-        type: `delete`,
-        key: omitted.id,
-      })
-    },
-  )
-
-  /**
-   * Hydrated rows obey the same complete-result replacement law. The public
-   * Collection begins with `{kept, omitted}` and the Query returns `{kept}`.
-   * Hydration order cannot change the public result or keep the survivor alive
-   * after its demand is released.
-   */
-  it.each([
-    { hydrationOrder: [`kept`, `omitted`] },
-    { hydrationOrder: [`omitted`, `kept`] },
-  ] as const)(
-    `replaces a hydrated two-row result in order $hydrationOrder`,
-    async ({ hydrationOrder }) => {
-      const id = `hydrated-multi-row-owner-${hydrationOrder.join(`-`)}`
-      const queryHash = hashKey([id])
-      const kept: Item = { id: `kept`, category: `shared`, name: `Kept` }
-      const omitted: Item = {
-        id: `omitted`,
-        category: `shared`,
-        name: `Omitted`,
-      }
-      const byId = new Map([
-        [kept.id, kept],
-        [omitted.id, omitted],
-      ])
-      const queryClient = createQueryClient()
-      const queryFn = vi.fn(() => Promise.resolve([kept]))
-      const descriptor = collectionOptions(
-        queryCollectionOptions<Item>({
-          id,
-          queryClient,
-          queryKey: [id],
-          queryFn,
-          getKey: (item) => item.id,
-          syncMode: `on-demand`,
-          startSync: true,
-        }),
-      )
-      const client = new DbClient({ queryClient })
-      client.hydrate({
-        collections: [
-          {
-            collectionId: id,
-            rows: hydrationOrder.map((rowId) => ({
-              key: rowId,
-              value: byId.get(rowId)!,
-              metadata: {
-                queryCollection: { owners: { [queryHash]: true } },
-              },
-            })),
-          },
-        ],
-      })
-      const collection = client.collection(descriptor)
-      cleanups.push(async () => {
-        await client.cleanup()
-        queryClient.clear()
-      })
-
-      await collection._sync.loadSubset({})
-      expect(rows(collection)).toEqual([kept.id])
-
-      collection._sync.unloadSubset({})
-      await vi.waitFor(() => expect(rows(collection)).toEqual([]))
-      expect(queryFn).toHaveBeenCalledOnce()
-    },
-  )
-
-  /**
-   * A retained subset owner cannot be settled by acquiring a different Query
-   * key. The independent source model has one `detail` row in durable storage;
-   * the current complete source keeps, omits, or moves it out of that subset.
-   * After a full-source result applies, acquiring the retained subset must
-   * reconcile its old owner and remove its revalidation marker. Compare public
-   * and durable rows at that acquisition's settlement, before any explicit
-   * refetch. The unchanged and moved cases guard against deleting a row still
-   * owned by the full source.
-   */
-  it.each([{ name: `omitted` }, { name: `unchanged` }, { name: `moved` }])(
-    `settles a retained $name subset after a complete full-source result`,
-    async ({ name }) => {
-      const id = `retained-subset-after-full-${name}`
-      const oldRow: Item = {
-        id: `detail-row`,
-        category: `detail`,
-        name: `Original`,
-      }
-      const subset = categorySubset(`detail`)
-      const subsetHash = hashKey([id, getLoadSubsetDemandKey(subset)])
-      const retentionKey = `queryCollection:gc:${subsetHash}`
-      const storage = createOwnershipStorage({
-        rows: new Map([[oldRow.id, oldRow]]),
-        rowMetadata: new Map([
-          [oldRow.id, { queryCollection: { owners: { [subsetHash]: true } } }],
-        ]),
-        collectionMetadata: new Map([
-          [retentionKey, { queryHash: subsetHash, mode: `until-revalidated` }],
-        ]),
-      })
-      const currentSource: Array<Item> =
-        name === `omitted`
-          ? []
-          : name === `unchanged`
-            ? [oldRow]
-            : [{ ...oldRow, category: `list`, name: `Moved` }]
-      const { collection } = createPersistedOwnershipFixture(
-        id,
-        storage,
-        currentSource,
-      )
-
-      await collection.stateWhenReady()
-      await collection._sync.loadSubset({})
-      await collection._sync.loadSubset(subset)
-
-      expect({
-        publicRows: collection.toArray.map(
-          ({ id: rowId, category, name: rowName }) => ({
-            id: rowId,
-            category,
-            name: rowName,
-          }),
-        ),
-        durableRows: storedItems(storage),
-        retentionPending: storage
-          .snapshot()
-          .collectionMetadata.has(retentionKey),
-      }).toEqual({
-        publicRows: currentSource,
-        durableRows: currentSource,
-        retentionPending: false,
-      })
-      if (name === `moved`) {
-        expect(
-          persistedOwners(storage.snapshot().rowMetadata, oldRow.id),
-        ).toEqual([hashKey([id])])
-      }
-      if (name === `unchanged`) {
-        collection._sync.unloadSubset({})
-        expect(rows(collection)).toEqual([oldRow.id])
-      }
-    },
-  )
-
-  it(`emits metadata for every owner of rows shared by overlapping queries`, async () => {
-    const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
-    const { collection } = createOwnershipFixture({
-      id: `persisted-overlap`,
-      results: [[shared], [shared, listOnly]],
-      metadataRecorder: metadata,
-    })
-    const detail = { where: categoryIn(`shared`, `detail`) }
-    const list = { where: categoryIn(`shared`, `list`) }
-
-    await collection._sync.loadSubset(detail)
-    expect(persistedOwners(metadata.rows, shared.id)).toHaveLength(1)
-
-    await collection._sync.loadSubset(list)
-    expect(persistedOwners(metadata.rows, shared.id)).toHaveLength(2)
-    expect(persistedOwners(metadata.rows, listOnly.id)).toHaveLength(1)
-
-    collection._sync.unloadSubset(list)
-    expect(rows(collection)).toEqual([shared.id])
-    expect(persistedOwners(metadata.rows, shared.id)).toHaveLength(1)
-  })
-
-  it(`preserves committed peer ownership through a cold revalidation`, async () => {
-    expectColdOwnerRevalidation(await observeColdOwnerRevalidation())
-  })
-
-  it(`rejects a superseded accepted result while publishing its successor`, async () => {
-    const id = `superseded-retained-scan`
-    const queryKey = [id] as const
-    const queryHash = hashKey(queryKey)
-    const initial = { id: `initial`, category: `retained`, name: `Initial` }
-    const first = { id: `first`, category: `retained`, name: `First` }
-    const second = { id: `second`, category: `retained`, name: `Second` }
-    const initialScan =
-      createDeferred<
-        Array<{ key: string | number; value: Item; metadata?: unknown }>
-      >()
-    const firstRefetchScan =
-      createDeferred<
-        Array<{ key: string | number; value: Item; metadata?: unknown }>
-      >()
-    const scanPersistedRows = vi
-      .fn()
-      .mockReturnValueOnce(initialScan.promise)
-      .mockReturnValueOnce(firstRefetchScan.promise)
-      .mockResolvedValue([])
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      results: [[initial], [first], [second]],
-      syncMode: `eager`,
-      scanPersistedRows,
-      setupMetadata: (metadata) => {
-        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-          queryHash,
-          mode: `until-revalidated`,
-        })
-      },
-    })
-    const publications: Array<Array<string>> = []
-    const subscription = collection.subscribeChanges(() => {
-      publications.push(itemIds(collection.toArray))
-    })
-    cleanups.push(() => {
-      subscription.unsubscribe()
-      return Promise.resolve()
-    })
-    cleanups.push(() => {
-      initialScan.resolve([])
-      firstRefetchScan.resolve([])
-      return Promise.resolve()
-    })
-
-    await vi.waitFor(() => expect(scanPersistedRows).toHaveBeenCalledOnce())
-    expect(queryFn).toHaveBeenCalledOnce()
-    let model: ExplicitRefetchApplicationModel = {
-      calls: new Map(),
-      publicValues: new Map([[`query`, `none`]]),
-    }
-    model = reduceExplicitRefetchApplication(model, {
-      type: `start-call`,
-      callId: 1,
-      resultIds: [`query`],
-      throwOnError: true,
-    })
-    const firstRefetch = collection.utils.refetch({ throwOnError: true })
-    void firstRefetch.catch(() => {})
-    await vi.waitFor(() => {
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(scanPersistedRows).toHaveBeenCalledTimes(2)
-    })
-    model = reduceExplicitRefetchApplication(model, {
-      type: `accept-result`,
-      callId: 1,
-      resultId: `query`,
-      value: first.name,
-    })
-
-    model = reduceExplicitRefetchApplication(model, {
-      type: `start-call`,
-      callId: 2,
-      resultIds: [`query`],
-      throwOnError: true,
-    })
-    const secondRefetch = collection.utils.refetch({ throwOnError: true })
-    await vi.waitFor(() => {
-      expect(queryFn).toHaveBeenCalledTimes(3)
-      expect(collection.get(second.id)?.name).toBe(second.name)
-    })
-    model = reduceExplicitRefetchApplication(model, {
-      type: `accept-result`,
-      callId: 2,
-      resultId: `query`,
-      value: second.name,
-    })
-    model = reduceExplicitRefetchApplication(model, {
-      type: `retire-application`,
-      callId: 1,
-      resultId: `query`,
-    })
-    model = reduceExplicitRefetchApplication(model, {
-      type: `fulfill-application`,
-      callId: 2,
-      resultId: `query`,
-    })
-    await secondRefetch
-    expectExplicitRefetchObservation(
-      {
-        publicValues: { query: collection.get(second.id)?.name },
-        refetch: `resolved`,
-        resultOrder: [`query`],
-      },
-      observeExplicitRefetchApplication(model, 2),
-    )
-
-    firstRefetchScan.resolve([])
-    await expect(firstRefetch).rejects.toMatchObject({ name: `AbortError` })
-    expectExplicitRefetchObservation(
-      {
-        publicValues: { query: collection.get(second.id)?.name },
-        refetch: `rejected`,
-      },
-      observeExplicitRefetchApplication(model, 1),
-    )
-    initialScan.resolve([])
-
-    await vi.waitFor(() => {
-      expect(itemIds(collection.toArray)).toEqual([second.id])
-    })
-    expect(publications).not.toContainEqual([initial.id])
-    expect(publications).not.toContainEqual([first.id])
-  })
-
-  it(`rejects emitted ownership that is absent from cold storage`, async () => {
-    const observations = await observeColdOwnerRevalidation(true)
-    expect(() => expectColdOwnerRevalidation(observations)).toThrow()
-  })
-
-  it(`restages a persisted owner when its absent row arrives`, async () => {
-    const id = `persisted-owner-before-row`
-    const queryHash = hashKey([id])
-    const result = createDeferred<Array<Item>>()
-    const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
-    let setupCalls = 0
-    const { collection, queryFn } = createOwnershipFixture({
-      id,
-      syncMode: `eager`,
-      results: [result.promise, [{ ...shared, name: `Restarted` }]],
-      metadataRecorder: metadata,
-      setupMetadata: (api) => {
-        setupCalls++
-        api.row.set(shared.id, {
-          queryCollection: { owners: { [queryHash]: true } },
+      const [a, b, c] = [subset(`a`), subset(`b`), subset(`c`)]
+      // Query keys embed the subset as JSON, so `a`'s key holds `\"a\"`.
+      const isQueryForA = (queryKey: unknown) =>
+        JSON.stringify(queryKey).includes(`\\"a\\"`)
+      const reacquiredFetch = createDeferred<Array<Item>>()
+      void reacquiredFetch.promise.catch(() => undefined)
+      const createClient = (
+        queryFn: (context: QueryFunctionContext) => Promise<Array<Item>> = () =>
+          Promise.resolve([shared]),
+      ) => {
+        const queryClient = createQueryClient()
+        const descriptor = collectionOptions(
+          queryCollectionOptions<Item>({
+            id,
+            queryClient,
+            queryKey: [id],
+            queryFn,
+            getKey: (item) => item.id,
+            syncMode: `on-demand`,
+            startSync: true,
+          }),
+        )
+        const client = new DbClient({ queryClient })
+        cleanups.push(async () => {
+          await client.cleanup()
+          queryClient.clear()
         })
-      },
-    })
-
-    expect(rows(collection)).toEqual([])
-    expect(persistedOwners(metadata.rows, shared.id)).toEqual([queryHash])
-    result.resolve([shared])
-    await collection.stateWhenReady()
-    expect(rows(collection)).toEqual([shared.id])
-    expect(persistedOwners(metadata.rows, shared.id)).toEqual([queryHash])
-
-    await collection.cleanup()
-    await collection.preload()
-    await vi.waitFor(() => {
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(collection.get(shared.id)?.name).toBe(`Restarted`)
-    })
-    expect(setupCalls).toBe(1)
-    expect(persistedOwners(metadata.rows, shared.id)).toEqual([queryHash])
-  })
-
-  it(`uses the replacement Query when the cache is cleared before an explicit refetch`, async () => {
-    const barrier = createDeferred<void>()
-    const thirdFetch = createDeferred<Array<Item>>()
-    const authoritative = { ...shared, name: `Authoritative` }
-    const { collection, queryClient, queryFn } = createOwnershipFixture({
-      id: `clear-before-explicit-refetch`,
-      results: [[shared], [authoritative], thirdFetch.promise],
-    })
-    const barrierCompletion = barrier.promise.then(() => {
-      collection.deferDataRefresh = null
-    })
-
-    try {
-      await collection._sync.loadSubset({})
-      collection.deferDataRefresh = barrier.promise
-      collection.utils.writeUpdate({ ...shared, name: `Manual` })
-      queryClient.clear()
-
-      barrier.resolve()
-      await barrierCompletion
-      const refresh = collection.utils.refetch({ throwOnError: true })
-      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
-      await refresh
-      for (let turn = 0; turn < 30; turn++) await Promise.resolve()
-
-      expect(queryFn).toHaveBeenCalledTimes(2)
-      expect(collection.get(shared.id)?.name).toBe(`Authoritative`)
-    } finally {
-      barrier.resolve()
-      collection.deferDataRefresh = null
-      thirdFetch.resolve([])
-    }
-  })
-
-  it(`removes unobserved sibling scopes without scanning or snapshots`, async () => {
-    const id = `unobserved-sibling-manual-write`
-    const queryClient = createQueryClient()
-    const siblingKey = [id, `prefetched-sibling`]
-    queryClient.setQueryData(siblingKey, [shared])
-    const queryFn = vi.fn(() => Promise.resolve([shared]))
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-
-    await collection._sync.loadSubset({})
-    const findAll = vi.spyOn(queryClient.getQueryCache(), `findAll`)
-    const values = vi.spyOn(collection._state.syncedData, `values`)
-
-    collection.utils.writeDelete(shared.id)
-
-    expect(queryClient.getQueryData(siblingKey)).toBeUndefined()
-    expect(findAll).not.toHaveBeenCalled()
-    expect(values).not.toHaveBeenCalled()
-  })
-})
-
-it.each([false, true])(
-  `evicts sibling caches created before sync starts, restart=%s`,
-  async (restart) => {
-    const queryClient = createQueryClient()
-    const id = `delayed-sync-cache`
-    const collection = createCollection(
-      queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn: () => Promise.resolve([shared]),
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: false,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-    })
-    if (restart) {
-      collection.startSyncImmediate()
-      await collection._sync.loadSubset({})
-      await collection.cleanup()
-    }
-    const siblingKey = [id, `prefetched-sibling`]
-    queryClient.setQueryData(siblingKey, [shared])
-    collection.startSyncImmediate()
-    await collection._sync.loadSubset({})
-    collection.utils.writeDelete(shared.id)
-    expect(queryClient.getQueryData(siblingKey)).toBeUndefined()
-  },
-)
-
-// The recorder follows the tested sync run's persisted cache claim across
-// rotation. An expired run may own a new retired generation while another run
-// still claims the active head, so claiming the logical ID here would inspect
-// the wrong cache. The durable comparison reads the physical ID in this run's
-// latest claim, without releasing its authority.
-function recordRunCacheClaim(
-  adapter: PersistenceAdapter,
-): () => PersistedCacheGenerationClaim {
-  const claimCacheGeneration = adapter.claimCacheGeneration?.bind(adapter)
-  const rotateCacheGeneration = adapter.rotateCacheGeneration?.bind(adapter)
-  if (!claimCacheGeneration || !rotateCacheGeneration) {
-    throw new Error(`Expected managed SQLite cache generations`)
-  }
-  let current: PersistedCacheGenerationClaim | undefined
-  adapter.claimCacheGeneration = async (...args) => {
-    current = await claimCacheGeneration(...args)
-    return current
-  }
-  adapter.rotateCacheGeneration = async (...args) => {
-    current = await rotateCacheGeneration(...args)
-    return current
-  }
-  return () => {
-    if (!current) throw new Error(`Expected a claimed cache generation`)
-    return current
-  }
-}
-
-async function readClaimedCacheRows(
-  adapter: PersistenceAdapter,
-  claim: PersistedCacheGenerationClaim,
-): Promise<Array<{ key: string | number; name: unknown }>> {
-  const persistedRows = await adapter.loadSubset(
-    {
-      kind: `managed`,
-      storageCollectionId: claim.storageCollectionId,
-      claimId: claim.claimId,
-    },
-    {},
-    {
-      cacheGenerationClaimId: claim.claimId,
-    },
-  )
-  return persistedRows
-    .map((row) => ({ key: row.key, name: row.value.name }))
-    .sort((a, b) => String(a.key).localeCompare(String(b.key)))
-}
-
-// Law: when a persisted cache claim expires, an on-demand Query Collection
-// reacquires only active demands from a fetch that starts after rotation.
-// Model: the provider's current rows replace the expired cache's rows for the
-// active subset. The QueryClient may still contain the old success, but that
-// success has no authority over the new persisted cache generation. This real
-// SQLite/QueryClient driver checks public and durable rows when reacquisition
-// settles.
-it(`reacquires an active Query subset after its SQLite cache claim expires`, async () => {
-  const id = `query-cache-claim-recovery`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const managed = persistence.resolvePersistenceForCollection!({
-    collectionId: id,
-    mode: `sync-present`,
-  })
-  const currentClaim = recordRunCacheClaim(managed.adapter)
-  const queryClient = createQueryClient()
-  let activeRows: Array<Item> = [
-    { id: `active-old`, category: `active`, name: `Old` },
-  ]
-  const triggeringRows: Array<Item> = [
-    { id: `trigger-fresh`, category: `active`, name: `Trigger` },
-  ]
-  const activeDemandKey = getLoadSubsetDemandKey({ limit: 1 })
-  const queryFn = vi.fn((context: QueryFunctionContext) =>
-    Promise.resolve(
-      structuredClone(
-        context.queryKey[1] === activeDemandKey ? activeRows : triggeringRows,
-      ),
-    ),
-  )
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence: managed,
-    }),
-  )
-  cleanups.push(async () => {
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
+        return {
+          client,
+          queryClient,
+          collection: client.collection(descriptor),
+        }
+      }
+      const settleTurn = async () => {
+        for (let turn = 0; turn < 3; turn++)
+          await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      }
 
-  await collection._sync.loadSubset({ limit: 1 })
-  expect(itemIds(collection.toArray)).toEqual([`active-old`])
-  expect(queryFn).toHaveBeenCalledTimes(1)
-  const oldStorageId = currentClaim().storageCollectionId
+      let fetchesForA = 0
+      const server = createClient(({ queryKey }) => {
+        if (isQueryForA(queryKey) && fetchesForA++ > 0)
+          return reacquiredFetch.promise
+        return Promise.resolve([shared])
+      })
+      const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
+      const persistence = createDeferred<void>()
+      const mutation = createTransaction({
+        mutationFn: () => persistence.promise,
+      })
+      cleanups.push(async () => {
+        persistence.resolve()
+        reacquiredFetch.reject(new Error(`cleanup`))
+        await mutation.isPersisted.promise.catch(() => undefined)
+      })
 
-  now += 10_001
-  activeRows = [{ id: `active-fresh`, category: `active`, name: `Fresh` }]
-  await collection._sync.loadSubset({ limit: 2 })
-  await vi.waitFor(() =>
-    expect(new Set(itemIds(collection.toArray))).toEqual(
-      new Set([`active-fresh`, `trigger-fresh`]),
-    ),
-  )
-  expect(
-    queryFn.mock.calls.filter(
-      ([context]) => context.queryKey[1] === activeDemandKey,
-    ),
-  ).toHaveLength(2)
-  expect(currentClaim().storageCollectionId).not.toBe(oldStorageId)
-  expect(await readClaimedCacheRows(managed.adapter, currentClaim())).toEqual([
-    { key: `active-fresh`, name: `Fresh` },
-    { key: `trigger-fresh`, name: `Trigger` },
-  ])
-})
+      await server.collection._sync.loadSubset(a)
+      if (history.peer) await server.collection._sync.loadSubset(c)
+      mutation.mutate(() => server.collection.insert(blocker))
+      server.collection._sync.unloadSubset(a)
+      let reacquired: Promise<unknown> | undefined
+      if (history.reacquired) {
+        await settleTurn()
+        server.queryClient.removeQueries({
+          predicate: (query) => isQueryForA(query.queryKey),
+        })
+        reacquired = Promise.resolve(server.collection._sync.loadSubset(a))
+        void reacquired.catch(() => undefined)
+        await settleTurn()
+      }
+      const failReacquiredFetch = async () => {
+        const pending = reacquired
+        if (!pending) return
+        reacquiredFetch.reject(new Error(`reacquired fetch failed`))
+        await pending.catch(() => undefined)
+        await settleTurn()
+      }
+      if (history.claims === `while-held`) {
+        const claimed = Promise.resolve(server.collection._sync.loadSubset(b))
+        await settleTurn()
+        await failReacquiredFetch()
+        persistence.resolve()
+        await mutation.isPersisted.promise
+        await claimed
+      } else {
+        persistence.resolve()
+        await mutation.isPersisted.promise
+        await settleTurn()
+        await server.collection._sync.loadSubset(b)
+        await failReacquiredFetch()
+      }
+      await settleTurn()
+      const state = server.client.dehydrate({
+        shouldDehydrateCollection: () => true,
+      })
+      const sharedRow = state.collections
+        .flatMap((chunk) => chunk.rows)
+        .find((row) => row.key === shared.id)
+      const owners = (
+        sharedRow?.metadata as
+          { queryCollection?: { owners?: Record<string, true> } } | undefined
+      )?.queryCollection?.owners
 
-// Distinct Query keys are independent documents even when one key is a
-// prefix of the other and both Collections share one QueryClient. The model
-// has two claims: A expires at 11000 and B, acquired later, expires at 15000.
-// At 11001 only A may replace its persisted cache generation and source row.
-// The real QueryClient uses prefix matching, so B's cache entry is deliberately
-// inside A's base-key search. Public rows, B's Query entry, its durable rows,
-// its current storage ID, and its fetch count are compared after A reloads.
-it(`keeps a warm Query Collection independent when a prefix-sharing peer rotates`, async () => {
-  const firstId = `query-prefix-rotation-a`
-  const secondId = `query-prefix-rotation-b`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const firstManaged = persistence.resolvePersistenceForCollection!({
-    collectionId: firstId,
-    mode: `sync-present`,
-  })
-  const secondManaged = persistence.resolvePersistenceForCollection!({
-    collectionId: secondId,
-    mode: `sync-present`,
-  })
-  const queryClient = createQueryClient()
-  const firstDemand = { limit: 1 }
-  const secondDemand = { limit: 2 }
-  const firstKey = [`shared-prefix`, getLoadSubsetDemandKey(firstDemand)]
-  const secondKey = [
-    `shared-prefix`,
-    `peer`,
-    getLoadSubsetDemandKey(firstDemand),
-  ]
-  let firstRows: Array<Item> = [
-    { id: `first-old`, category: `active`, name: `Old` },
-  ]
-  const firstQueryFn = vi.fn((context: QueryFunctionContext) =>
-    Promise.resolve(
-      structuredClone(
-        context.queryKey[1] === getLoadSubsetDemandKey(firstDemand)
-          ? firstRows
-          : [{ id: `trigger`, category: `active`, name: `Trigger` }],
-      ),
-    ),
-  )
-  const secondRow: Item = {
-    id: `second-warm`,
-    category: `peer`,
-    name: `Warm`,
-  }
-  const secondQueryFn = vi.fn(() => Promise.resolve([secondRow]))
-  const first = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id: firstId,
-        queryClient,
-        queryKey: [`shared-prefix`],
-        queryFn: firstQueryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence: firstManaged,
-    }),
-  )
-  const mounted = [first]
-  cleanups.push(async () => {
-    for (const collection of mounted.reverse()) await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
-  await first._sync.loadSubset(firstDemand)
-  expect(itemIds(first.toArray)).toEqual([`first-old`])
-  expect(queryClient.getQueryData(firstKey)).toHaveLength(1)
-
-  now = 5_000
-  const peer = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id: secondId,
-        queryClient,
-        queryKey: [`shared-prefix`, `peer`],
-        queryFn: secondQueryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence: secondManaged,
-    }),
-  )
-  mounted.push(peer)
-  await peer._sync.loadSubset(firstDemand)
-  expect(itemIds(peer.toArray)).toEqual([`second-warm`])
-  expect(secondQueryFn).toHaveBeenCalledTimes(1)
-  const secondHead = driver
-    .getDatabase()
-    .prepare(
-      `SELECT physical_id FROM cache_generation
-       WHERE logical_id = ? AND retired = 0`,
-    )
-    .get(secondId) as { physical_id: string }
-  const secondClaim = driver
-    .getDatabase()
-    .prepare(`SELECT claim_id FROM cache_generation_claim WHERE logical_id = ?`)
-    .get(secondId) as { claim_id: string }
-  expect(
-    await secondManaged.adapter.loadSubset(
-      {
-        kind: `managed`,
-        storageCollectionId: secondHead.physical_id,
-        claimId: secondClaim.claim_id,
-      },
-      {},
-      {
-        cacheGenerationClaimId: secondClaim.claim_id,
-      },
-    ),
-  ).toMatchObject([{ value: secondRow }])
+      const browser = createClient()
+      browser.client.hydrate(state)
+      await browser.collection._sync.loadSubset(b)
+      const hydratedLoaded = rows(browser.collection)
+      browser.collection._sync.unloadSubset(b)
+      await settleTurn()
 
-  now = 11_001
-  firstRows = [{ id: `first-fresh`, category: `active`, name: `Fresh` }]
-  await first._sync.loadSubset(secondDemand)
-  await vi.waitFor(() =>
-    expect(new Set(itemIds(first.toArray))).toEqual(
-      new Set([`first-fresh`, `trigger`]),
-    ),
+      expect({
+        dehydratedOwners: Object.keys(owners ?? {}).length,
+        hydratedLoaded,
+        hydratedReleased: rows(browser.collection),
+      }).toEqual(modelPublishedOwners(history))
+    },
   )
-  expect(itemIds(peer.toArray)).toEqual([`second-warm`])
-  expect(queryClient.getQueryData(secondKey)).toEqual([secondRow])
-  expect(secondQueryFn).toHaveBeenCalledTimes(1)
-  expect(
-    driver
-      .getDatabase()
-      .prepare(
-        `SELECT physical_id FROM cache_generation
-         WHERE logical_id = ? AND retired = 0`,
-      )
-      .get(secondId),
-  ).toMatchObject(secondHead)
-  expect(
-    await secondManaged.adapter.loadSubset(
-      {
-        kind: `managed`,
-        storageCollectionId: secondHead.physical_id,
-        claimId: secondClaim.claim_id,
-      },
-      {},
-      {
-        cacheGenerationClaimId: secondClaim.claim_id,
-      },
-    ),
-  ).toMatchObject([{ value: secondRow }])
-})
 
-// A claim can expire while persisted startup is reading metadata, before the
-// Query source enters its sync run. The wrapper rotates the cache privately at
-// that boundary. The old QueryClient success is not a source snapshot for the
-// replacement generation: the first demand must fetch and publish fresh rows.
-// With no rotation, an existing QueryClient success remains reusable. This
-// real SQLite driver checks both sides of that boundary at demand settlement.
-it.each([false, true])(
-  `uses cached QueryClient data according to private startup rotation: %s`,
-  async (rotateAtStartup) => {
-    const id = `query-cache-startup-rotation`
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    let now = 1_000
-    const persistence = createNodeSQLitePersistence({
-      database: driver.getDatabase(),
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => now,
-    })
-    const managed = persistence.resolvePersistenceForCollection!({
-      collectionId: id,
-      mode: `sync-present`,
-    })
-    const claim = managed.adapter.claimCacheGeneration!.bind(managed.adapter)
-    const rotate = managed.adapter.rotateCacheGeneration!.bind(managed.adapter)
-    let rotations = 0
-    if (rotateAtStartup) {
-      managed.adapter.claimCacheGeneration = async (...args) => {
-        const acquired = await claim(...args)
-        now = 12_000
-        return acquired
-      }
-    }
-    managed.adapter.rotateCacheGeneration = async (...args) => {
-      rotations++
-      return rotate(...args)
-    }
-    const queryClient = createQueryClient()
-    queryClient.setQueryData(
-      [id, getLoadSubsetDemandKey({ limit: 1 })],
-      [{ id: `old`, category: `active`, name: `Old` }],
-    )
-    const queryFn = vi.fn(() =>
-      Promise.resolve([{ id: `fresh`, category: `active`, name: `Fresh` }]),
-    )
-    const collection = createCollection(
-      persistedCollectionOptions<
-        Item,
-        string | number,
-        never,
-        QueryCollectionUtils<Item, string | number, Item, unknown>
-      >({
-        ...queryCollectionOptions<Item>({
+  // Law: a fetch that started before a direct write keeps the server's rows
+  // for every key that write did not touch; a key written after the fetch
+  // began keeps its accepted row. Reference: the fetched rows, overlaid by the
+  // direct writes made after the fetch started, in order. Checkpoint: visible
+  // rows and the Query cache after the fetch settles. Cuts: the initial load,
+  // a handler's automatic refetch while another handler writes a different
+  // key or the same key, and a user refetch. The review probes are these cuts.
+  type MergeCut =
+    | `initial-load`
+    | `handler-refetch-other-key`
+    | `handler-refetch-same-key`
+    | `user-refetch`
+  it.each<MergeCut>([
+    `initial-load`,
+    `handler-refetch-other-key`,
+    `handler-refetch-same-key`,
+    `user-refetch`,
+  ])(
+    `keeps server rows a direct write did not touch when an older fetch settles: %s`,
+    async (cut) => {
+      type Row = { id: string; value: string }
+      const id = `older-fetch-merge-${cut}`
+      let server: Array<Row> =
+        cut === `initial-load`
+          ? [
+              { id: `1`, value: `a` },
+              { id: `2`, value: `b` },
+            ]
+          : [
+              { id: `1`, value: `old1` },
+              { id: `2`, value: `old2` },
+            ]
+      const held: Array<ReturnType<typeof createDeferred<void>>> = []
+      let hold = cut === `initial-load`
+      const queryClient = createQueryClient()
+      const writtenKey = cut === `handler-refetch-same-key` ? `1` : `2`
+      const collection = createCollection(
+        queryCollectionOptions<Row>({
           id,
           queryClient,
           queryKey: [id],
-          queryFn,
-          getKey: (item) => item.id,
-          syncMode: `on-demand`,
-          startSync: true,
-        }),
-        persistence: managed,
-      }),
-    )
-    cleanups.push(async () => {
-      await collection.cleanup()
-      queryClient.clear()
-      driver.close()
-    })
-
-    await collection.stateWhenReady()
-    await collection._sync.loadSubset({ limit: 1 })
-    expect(rotations).toBe(rotateAtStartup ? 1 : 0)
-    expect(queryFn).toHaveBeenCalledTimes(rotateAtStartup ? 1 : 0)
-    expect(itemIds(collection.toArray)).toEqual([
-      rotateAtStartup ? `fresh` : `old`,
-    ])
-  },
-)
-
-// Two rotations may be queued before the first reaches its source restart.
-// The latest rotation alone owns reacquisition. At the held second-rotation
-// checkpoint the model still has no authoritative source row, so neither the
-// old Query observer nor the first recovery may start another provider fetch.
-// After the final rotation, the active demand must fetch and apply a new row.
-it(`waits for the final SQLite rotation before reacquiring a Query subset`, async () => {
-  const id = `query-cache-overlapping-rotations`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => 1_000,
-  })
-  const managed = persistence.resolvePersistenceForCollection!({
-    collectionId: id,
-    mode: `sync-present`,
-  })
-  const rotate = managed.adapter.rotateCacheGeneration?.bind(managed.adapter)
-  if (!rotate) throw new Error(`Expected managed SQLite rotation`)
-  const secondRotationEntered = createDeferred<void>()
-  const releaseSecondRotation = createDeferred<void>()
-  let rotations = 0
-  managed.adapter.rotateCacheGeneration = async (...args) => {
-    if (++rotations === 2) {
-      secondRotationEntered.resolve()
-      await releaseSecondRotation.promise
-    }
-    return rotate(...args)
-  }
-  const queryClient = createQueryClient()
-  let fetches = 0
-  const queryOptions = queryCollectionOptions<Item>({
-    id,
-    queryClient,
-    queryKey: [id],
-    queryFn: () =>
-      Promise.resolve([
-        { id: `r${++fetches}`, category: `active`, name: `source` },
-      ]),
-    getKey: (item) => item.id,
-    syncMode: `on-demand`,
-    startSync: true,
-  })
-  const sourceSync = queryOptions.sync.sync
-  let recover!: () => Promise<void>
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryOptions,
-      sync: {
-        ...queryOptions.sync,
-        sync: (params) => {
-          recover = params.metadata!.persistence!.startScopedRecovery!
-          return sourceSync(params)
-        },
-      },
-      persistence: managed,
-    }),
-  )
-  cleanups.push(async () => {
-    releaseSecondRotation.resolve()
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
-
-  const demand = { limit: 1 }
-  await collection._sync.loadSubset(demand)
-  expect(itemIds(collection.toArray)).toEqual([`r1`])
-  const first = recover()
-  const second = recover()
-  await secondRotationEntered.promise
-  await first
-  expect(rotations).toBe(2)
-  expect(fetches, `before the final cache rotation`).toBe(1)
-  expect(itemIds(collection.toArray)).toEqual([])
-
-  releaseSecondRotation.resolve()
-  await second
-  await vi.waitFor(() => expect(collection.size).toBe(1))
-  expect(collection.has(`r1`)).toBe(false)
-  expect(fetches).toBeGreaterThan(1)
-})
-
-// The old Query fetch can outlive a cache rotation even when its observer is
-// released. A late success has no authority to republish a row into the new
-// generation. The provider snapshot is captured before the held fetch, so the
-// old and fresh rows are distinguishable in both public and durable state at
-// the settlement and stale-fetch-release checkpoints.
-it(`does not publish a Query result started before SQLite cache rotation`, async () => {
-  const id = `query-cache-claim-late-fetch`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const managed = persistence.resolvePersistenceForCollection!({
-    collectionId: id,
-    mode: `sync-present`,
-  })
-  const currentClaim = recordRunCacheClaim(managed.adapter)
-  const queryClient = createQueryClient()
-  let providerRows: Array<Item> = [
-    { id: `old`, category: `active`, name: `Old` },
-  ]
-  let holdNextFetch = false
-  const oldFetchEntered = createDeferred<void>()
-  const releaseOldFetch = createDeferred<void>()
-  const queryFn = vi.fn(async () => {
-    const snapshot = structuredClone(providerRows)
-    if (holdNextFetch) {
-      holdNextFetch = false
-      oldFetchEntered.resolve()
-      await releaseOldFetch.promise
-    }
-    return snapshot
-  })
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence: managed,
-    }),
-  )
-  cleanups.push(async () => {
-    releaseOldFetch.resolve()
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
-
-  await collection._sync.loadSubset({ limit: 1 })
-  expect(itemIds(collection.toArray)).toEqual([`old`])
-  const oldStorageId = currentClaim().storageCollectionId
-  holdNextFetch = true
-  const oldLoad = Promise.resolve(
-    collection._sync.loadSubset({ limit: 1, refetch: true }),
-  )
-  void oldLoad.catch(() => undefined)
-  await oldFetchEntered.promise
-
-  now += 10_001
-  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
-  await collection._sync.loadSubset({ limit: 2 })
-  expect(itemIds(collection.toArray)).toEqual([`fresh`])
-  expect(currentClaim().storageCollectionId).not.toBe(oldStorageId)
-  expect(await readClaimedCacheRows(managed.adapter, currentClaim())).toEqual([
-    { key: `fresh`, name: `Fresh` },
-  ])
-
-  releaseOldFetch.resolve()
-  await Promise.allSettled([oldLoad])
-  await new Promise<void>((resolve) => queueMicrotask(resolve))
-  expect(itemIds(collection.toArray)).toEqual([`fresh`])
-  expect(await readClaimedCacheRows(managed.adapter, currentClaim())).toEqual([
-    { key: `fresh`, name: `Fresh` },
-  ])
-})
-
-// A peer Query observer may already have a fetch in flight when persistence
-// rotates its startup cache. With no cached Query result, the first Collection
-// demand joins that old fetch. Neither its success nor its error establishes
-// the replacement generation. The demand must start another fetch and apply
-// the fresh source row. The provider outcome is an independent history axis.
-it.each([`success`, `error`] as const)(
-  `reacquires after a pre-start Query fetch ends with %s`,
-  async (oldOutcome) => {
-    const id = `query-cache-pre-start-fetch-${oldOutcome}`
-    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-    let now = 1_000
-    const persistence = createNodeSQLitePersistence({
-      database: driver.getDatabase(),
-      cacheGenerationClaimTtlMs: 10_000,
-      now: () => now,
-    })
-    const managed = persistence.resolvePersistenceForCollection!({
-      collectionId: id,
-      mode: `sync-present`,
-    })
-    const claim = managed.adapter.claimCacheGeneration!.bind(managed.adapter)
-    managed.adapter.claimCacheGeneration = async (...args) => {
-      const acquired = await claim(...args)
-      now = 12_000
-      return acquired
-    }
-    const queryClient = createQueryClient()
-    const activeDemandKey = getLoadSubsetDemandKey({ limit: 1 })
-    const oldFetchEntered = createDeferred<void>()
-    const releaseOldFetch = createDeferred<void>()
-    const peer = new QueryObserver(queryClient, {
-      queryKey: [id, activeDemandKey],
-      queryFn: async () => {
-        oldFetchEntered.resolve()
-        await releaseOldFetch.promise
-        if (oldOutcome === `error`) throw new Error(`retired fetch failed`)
-        return [{ id: `old`, category: `active`, name: `Old` }]
-      },
-      retry: false,
-    })
-    const releasePeer = peer.subscribe(() => {})
-    await oldFetchEntered.promise
-    const queryFn = vi.fn(() =>
-      Promise.resolve([{ id: `fresh`, category: `active`, name: `Fresh` }]),
-    )
-    const sourceLoadEntered = createDeferred<void>()
-    const queryOptions = queryCollectionOptions<Item>({
-      id,
-      queryClient,
-      queryKey: [id],
-      queryFn,
-      getKey: (item) => item.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      retry: false,
-    })
-    const collection = createCollection(
-      persistedCollectionOptions<
-        Item,
-        string | number,
-        never,
-        QueryCollectionUtils<Item, string | number, Item, unknown>
-      >({
-        ...queryOptions,
-        sync: {
-          ...queryOptions.sync,
-          sync: (params) => {
-            const source = queryOptions.sync.sync(params)
-            if (!source || typeof source === `function` || !source.loadSubset) {
-              throw new Error(`Expected on-demand Query source`)
+          queryFn: async () => {
+            const snapshot = server.map((row) => ({ ...row }))
+            if (hold) {
+              const gate = createDeferred<void>()
+              held.push(gate)
+              await gate.promise
             }
-            return {
-              ...source,
-              loadSubset: (options) => {
-                const work = source.loadSubset!(options)
-                sourceLoadEntered.resolve()
-                return work
-              },
+            return snapshot
+          },
+          getKey: (row) => row.id,
+          startSync: true,
+          onUpdate: async ({ transaction, collection: handlerCollection }) => {
+            const modified = transaction.mutations[0].modified
+            if (modified.value === `A`) {
+              // Handler A: the server accepts the change, and the automatic
+              // refetch confirms it.
+              server = server.map((row) =>
+                row.id === `1` ? { id: `1`, value: `A` } : row,
+              )
+              return
             }
+            server = server.map((row) =>
+              row.id === writtenKey ? { id: writtenKey, value: `B` } : row,
+            )
+            await handlerCollection.utils.writeUpdate({
+              id: writtenKey,
+              value: `B`,
+            })
+            return { refetch: false }
           },
-        },
-        persistence: managed,
-      }),
-    )
-    cleanups.push(async () => {
-      releaseOldFetch.resolve()
-      releasePeer()
-      await collection.cleanup()
-      queryClient.clear()
-      driver.close()
-    })
-
-    await collection.stateWhenReady()
-    const load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
-    void load.catch(() => undefined)
-    await sourceLoadEntered.promise
-    expect(queryFn).not.toHaveBeenCalled()
-    expect(collection.size).toBe(0)
-    releaseOldFetch.resolve()
-    let timeout: ReturnType<typeof setTimeout> | undefined
-    try {
-      await Promise.race([
-        load,
-        new Promise<void>((_, reject) => {
-          timeout = setTimeout(
-            () => reject(new Error(`fresh Query demand remained pending`)),
-            500,
-          )
         }),
-      ])
-    } finally {
-      if (timeout) clearTimeout(timeout)
-    }
-    expect(queryFn).toHaveBeenCalledTimes(1)
-    expect(itemIds(collection.toArray)).toEqual([`fresh`])
-  },
-)
-
-// A later demand is a separate ownership node. A previous QueryClient success
-// for that key remains an ordinary cache hit, but it cannot establish rows in
-// the replacement SQLite generation. The held provider fetch gives this
-// history a checkpoint before fresh rows are available: the old cached row
-// must stay absent, and the demand may settle only after fresh application.
-it(`refetches a later Query demand with old client data after cache rotation`, async () => {
-  const id = `query-cache-claim-later-demand`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const queryClient = createQueryClient()
-  let providerRows: Array<Item> = [
-    { id: `old`, category: `active`, name: `Old` },
-  ]
-  const laterProviderRows: Array<Item> = [
-    { id: `later`, category: `active`, name: `Later` },
-  ]
-  let holdFetch = false
-  const freshFetchEntered = createDeferred<void>()
-  const releaseFreshFetch = createDeferred<void>()
-  const queryFn = vi.fn(async (context: QueryFunctionContext) => {
-    if (holdFetch) {
-      freshFetchEntered.resolve()
-      await releaseFreshFetch.promise
-    }
-    return structuredClone(
-      context.queryKey[1] === getLoadSubsetDemandKey({ limit: 2 })
-        ? laterProviderRows
-        : providerRows,
-    )
-  })
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence,
-    }),
-  )
-  cleanups.push(async () => {
-    releaseFreshFetch.resolve()
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
+      )
+      cleanups.push(async () => {
+        held.forEach((gate) => gate.resolve())
+        await collection.cleanup()
+        queryClient.clear()
+      })
+      const visible = () =>
+        Object.fromEntries(
+          Array.from(collection.values(), (row) => [row.id, row.value]),
+        )
+      const cached = () =>
+        Object.fromEntries(
+          (queryClient.getQueryData<Array<Row>>([id]) ?? []).map((row) => [
+            row.id,
+            row.value,
+          ]),
+        )
 
-  await collection._sync.loadSubset({ limit: 1 })
-  expect(itemIds(collection.toArray)).toEqual([`old`])
-  now += 10_001
-  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
-  await collection._sync.loadSubset({ limit: 1, refetch: true })
-  expect(itemIds(collection.toArray)).toEqual([`fresh`])
-
-  const laterDemand = { limit: 2 }
-  queryClient.setQueryData(
-    [id, getLoadSubsetDemandKey(laterDemand)],
-    [{ id: `stale`, category: `active`, name: `Stale` }],
+      let expected: Record<string, string>
+      if (cut === `initial-load`) {
+        const fetched = server
+        const ready = collection.preload()
+        await vi.waitFor(() => expect(held).toHaveLength(1))
+        await collection.utils.writeInsert({ id: `3`, value: `c` })
+        expect(
+          queryClient.getQueryCache().find({ queryKey: [id] })?.state.status,
+        ).toBe(`pending`)
+        held[0]!.resolve()
+        await ready
+        expected = mergeDirectWritesOverFetch(fetched, [
+          { id: `3`, value: `c` },
+        ])
+      } else if (cut === `user-refetch`) {
+        await collection.preload()
+        server = [
+          { id: `1`, value: `new1` },
+          { id: `2`, value: `new2` },
+        ]
+        const fetched = server
+        hold = true
+        const refetch = collection.utils.refetch()
+        await vi.waitFor(() => expect(held).toHaveLength(1))
+        hold = false
+        await collection.utils.writeInsert({ id: `3`, value: `c` })
+        held[0]!.resolve()
+        await refetch
+        expected = mergeDirectWritesOverFetch(fetched, [
+          { id: `3`, value: `c` },
+        ])
+        // The refetch settles only once the merged rows are visible.
+        expect(visible()).toEqual(expected)
+      } else {
+        await collection.preload()
+        hold = true
+        const first = collection.update(`1`, (draft) => {
+          draft.value = `A`
+        })
+        await vi.waitFor(() => expect(held).toHaveLength(1))
+        hold = false
+        const fetched = server
+        await collection.update(writtenKey, (draft) => {
+          draft.value = `B-optimistic`
+        }).isPersisted.promise
+        held[0]!.resolve()
+        await first.isPersisted.promise
+        expected = mergeDirectWritesOverFetch(fetched, [
+          { id: writtenKey, value: `B` },
+        ])
+      }
+      await vi.waitFor(() => expect(visible()).toEqual(expected))
+      expect(cached()).toEqual(expected)
+    },
   )
-  holdFetch = true
-  const load = Promise.resolve(collection._sync.loadSubset(laterDemand))
-  void load.catch(() => undefined)
-  await freshFetchEntered.promise
-  expect(itemIds(collection.toArray)).toEqual([`fresh`])
-  releaseFreshFetch.resolve()
-  await load
-  expect(itemIds(collection.toArray)).toEqual([`fresh`, `later`])
-})
 
-// A new key has no fetch from the retired cache generation. The generation
-// boundary requires a fresh provider result, but its first fetch already
-// supplies that result. The request log is the observation: a cancelled first
-// fetch followed by a second one would return the right rows while wasting
-// one transport for every new key after recovery.
-it(`fetches a new Query key once after cache rotation`, async () => {
-  const id = `query-cache-new-key-after-rotation`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const queryClient = createQueryClient()
-  const queryFn = vi.fn((context: QueryFunctionContext) =>
-    Promise.resolve([
-      {
-        id: `row-${String(context.queryKey[1])}`,
-        category: `active`,
-        name: `source`,
-      },
-    ]),
-  )
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence,
-    }),
+  /**
+   * A fetched row lifetime has one or more subset claims. A direct update
+   * preserves them; a direct delete ends that lifetime and all its claims.
+   * Inserting or upserting the same key after the delete creates an unowned
+   * lifetime. A later provider result can claim it again. The reference below
+   * uses only these row-lifetime rules, not Query cache or ownership helpers.
+   *
+   * The bounded legal grammar crosses one/two overlapping subset owners,
+   * in-memory/persisted metadata, and update, delete, reinsert, upsert, and
+   * refetch-after-reinsert. The driver uses real QueryClient and public write
+   * utilities. The independent claim set records demand indices, then maps
+   * those indices to the documented static on-demand Query key for metadata
+   * comparison. It compares public rows and exact accepted owner identities
+   * after each action and release; forgetting ownership on any write fails the
+   * update lane, while retaining a deleted lifetime fails the reinsert lane.
+   */
+  it.each(
+    ([1, 2] as const).flatMap((ownerCount) =>
+      ([false, true] as const).flatMap((withMetadata) =>
+        (
+          [
+            `update`,
+            `delete`,
+            `delete-insert`,
+            `delete-upsert`,
+            `delete-insert-refetch`,
+          ] as const
+        ).map((history) => ({ ownerCount, withMetadata, history })),
+      ),
+    ),
+  )(
+    `tracks a direct row lifetime through $history with $ownerCount owners and metadata=$withMetadata`,
+    runDirectRowLifetimeHistory,
   )
-  cleanups.push(async () => {
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
 
-  await collection._sync.loadSubset({ limit: 1 })
-  now += 10_001
-  await collection._sync.loadSubset({ limit: 1, refetch: true })
-  const beforeNewKey = queryFn.mock.calls.length
-  await collection._sync.loadSubset({ limit: 2 })
-  expect(queryFn.mock.calls.length - beforeNewKey).toBe(1)
-
-  const laterDemand = { limit: 3 }
-  queryClient.setQueryData(
-    [id, getLoadSubsetDemandKey(laterDemand)],
-    [{ id: `stale`, category: `active`, name: `Stale` }],
+  /**
+   * A's accepted direct row has its own position. A physical fetch started
+   * later may replace and claim it when A next acquires the shared Query;
+   * an earlier fetched snapshot or B's local cache edit may not. The small
+   * reference below orders only authored writes and actual provider fetches.
+   * Cache edits invalidate the last fetched snapshot but do not create a new
+   * remote position. It deliberately has no Query observers or cache-version
+   * classifier.
+   *
+   * The legal grammar crosses fetch/write order, another write to the same or
+   * a disjoint key, a foreign local cache edit, and a final real refetch. The
+   * driver uses two Collections sharing one physical Query. At A's acquisition
+   * and subset release it compares public rows with the reference. A fetched
+   * cached result needs no request; a local cache edit with no later fetch
+   * requires one to establish authority. The inverse order rejects blindly
+   * trusting any cached result; the cache-edit lanes reject mistaking
+   * setQueryData for a remote success.
+   */
+  it.each(
+    ([`write-first`, `fetch-first`] as const).flatMap((order) =>
+      ([`none`, `same-key`, `other-key`] as const).flatMap((laterWrite) =>
+        ([false, true] as const).flatMap((cacheEdit) =>
+          ([false, true] as const).map((finalRefetch) => ({
+            order,
+            laterWrite,
+            cacheEdit,
+            finalRefetch,
+          })),
+        ),
+      ),
+    ),
+  )(
+    `orders shared fetches, writes, and cache edits before acquisition: $order/$laterWrite/cache=$cacheEdit/refetch=$finalRefetch`,
+    runDirectWriteOrderHistory,
   )
-  const beforeSeededKey = queryFn.mock.calls.length
-  await collection._sync.loadSubset(laterDemand)
-  expect(queryFn.mock.calls.length - beforeSeededKey).toBe(1)
-})
 
-// Rotation is a durable authority boundary. If SQLite refuses it, the current
-// sync run cannot resume its old observers as if the cache were still valid.
-// The public Collection status and later demand rejection make this fail-stop
-// visible; a pending internal recovery flag alone is not a silent freeze.
-it(`reports a failed Query cache rotation as a terminal Collection error`, async () => {
-  const id = `query-cache-failed-rotation`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    now: () => 1_000,
-  })
-  const managed = persistence.resolvePersistenceForCollection!({
-    collectionId: id,
-    mode: `sync-present`,
-  })
-  const failure = new Error(`rotation refused`)
-  const rotationEntered = createDeferred<void>()
-  managed.adapter.rotateCacheGeneration = async () => {
-    rotationEntered.resolve()
-    throw failure
-  }
-  const queryClient = createQueryClient()
-  const queryOptions = queryCollectionOptions<Item>({
-    id,
-    queryClient,
-    queryKey: [id],
-    queryFn: () =>
-      Promise.resolve([{ id: `old`, category: `active`, name: `Old` }]),
-    getKey: (item) => item.id,
-    syncMode: `on-demand`,
-    startSync: true,
-  })
-  const sourceSync = queryOptions.sync.sync
-  let recover!: () => Promise<void>
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryOptions,
-      sync: {
-        ...queryOptions.sync,
-        sync: (params) => {
-          recover = params.metadata!.persistence!.startScopedRecovery!
-          return sourceSync(params)
-        },
-      },
-      persistence: managed,
-    }),
+  /**
+   * Two distinct on-demand Queries can return the same row. For that row, a
+   * successfully applied physical fetch takes its position when it starts:
+   * the latest such fetch supplies the value, even when an older fetch settles
+   * afterward. An older result still claims its own subset, so releasing the
+   * newer subset does not discard the row or revert its value. An accepted
+   * direct write participates in the same order for the key it changes.
+   *
+   * The reference below has only one row, its last accepted position, and a
+   * set of subset owners. It does not classify Query cache events or replay
+   * production's ownership maps. The legal histories cross an existing versus
+   * first-time older owner and both settlement orders; two neighboring writes
+   * fall between or after the fetch starts. The driver uses distinct semantic
+   * demands and real Query observers. One newer result repeats the initial
+   * value: it still takes a position that an older result cannot undo. After
+   * each applied settlement and after releasing the newer owner, the public
+   * Collection row must match the model.
+   */
+  it.each([
+    ...([false, true] as const).flatMap((existingOwner) =>
+      ([false, true] as const).map((settleNewerFirst) => ({
+        existingOwner,
+        settleNewerFirst,
+        directWrite: `none` as const,
+        sameValue: false,
+      })),
+    ),
+    {
+      existingOwner: true,
+      settleNewerFirst: true,
+      directWrite: `none` as const,
+      sameValue: true,
+    },
+    {
+      existingOwner: true,
+      settleNewerFirst: true,
+      directWrite: `between` as const,
+      sameValue: false,
+    },
+    {
+      existingOwner: true,
+      settleNewerFirst: true,
+      directWrite: `after` as const,
+      sameValue: false,
+    },
+  ])(
+    `orders overlapping subset values and owners: existing=$existingOwner/newer-first=$settleNewerFirst/write=$directWrite/equal=$sameValue`,
+    runOverlappingSubsetHistory,
   )
-  cleanups.push(async () => {
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
 
-  await collection._sync.loadSubset({ limit: 1 })
-  expect(collection.status).toBe(`ready`)
-  const outcome = recover()
-  await rotationEntered.promise
-  await expect(outcome).rejects.toBe(failure)
-  // A refused rotation is a persistence failure, so the Collection crashes
-  // even after Collection readiness, and later demand rejects with its cause.
-  expect(collection.status).toBe(`crashed`)
-  await expect(collection._sync.loadSubset({ limit: 2 })).rejects.toBe(failure)
-})
+  it(`does not rescan a stable empty persisted baseline on retained reacquisition`, async () => {
+    const id = `empty-persisted-baseline-work`
+    const queryHash = hashKey([id])
+    const scanPersistedRows = vi.fn(() => Promise.resolve([]))
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [[], [], []],
+      scanPersistedRows,
+      persistedGcTime: Number.POSITIVE_INFINITY,
+      setupMetadata: (metadata) =>
+        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+          queryHash,
+          mode: `until-revalidated`,
+        }),
+    })
+    const history: Array<`empty-result` | `restart`> = []
 
-// A public refetch returns a Query result only if that result still belongs to
-// the current persisted cache generation. This provider captures the old row
-// before a held fetch, then recovery rotates SQLite and applies the fresh row.
-// The old result may complete in QueryClient, but the utility must report its
-// invalidated operation as canceled instead of fulfilling with unapplied data.
-it(`cancels a Query utility refetch whose result crosses cache rotation`, async () => {
-  const id = `query-cache-claim-held-utility-refetch`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const queryClient = createQueryClient()
-  let providerRows: Array<Item> = [
-    { id: `old`, category: `active`, name: `Old` },
-  ]
-  const oldFetchEntered = createDeferred<void>()
-  const releaseOldFetch = createDeferred<void>()
-  let fetches = 0
-  const queryFn = vi.fn(async () => {
-    const snapshot = structuredClone(providerRows)
-    if (++fetches === 2) {
-      oldFetchEntered.resolve()
-      await releaseOldFetch.promise
+    await collection._sync.loadSubset({})
+    history.push(`empty-result`)
+    expect(rows(collection)).toEqual([])
+    expect(scanPersistedRows).toHaveBeenCalledTimes(
+      expectedEmptyBaselineScans(history),
+    )
+
+    for (let result = 0; result < 2; result++) {
+      collection._sync.unloadSubset({})
+      await collection._sync.loadSubset({ refetch: true })
+      history.push(`empty-result`)
+      expect(rows(collection)).toEqual([])
+      expect(scanPersistedRows).toHaveBeenCalledTimes(
+        expectedEmptyBaselineScans(history),
+      )
     }
-    return snapshot
-  })
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence,
-    }),
-  )
-  cleanups.push(async () => {
-    releaseOldFetch.resolve()
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
+    expect(queryFn).toHaveBeenCalledTimes(3)
   })
 
-  await collection._sync.loadSubset({ limit: 1 })
-  expect(itemIds(collection.toArray)).toEqual([`old`])
-  const oldRefetch = collection.utils.refetch({ throwOnError: true })
-  void oldRefetch.catch(() => undefined)
-  await oldFetchEntered.promise
-  now += 10_001
-  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
-  await collection._sync.loadSubset({ limit: 2 })
-  expect(itemIds(collection.toArray)).toEqual([`fresh`])
-
-  releaseOldFetch.resolve()
-  await expect(oldRefetch).rejects.toBeInstanceOf(CancelledError)
-  expect(itemIds(collection.toArray)).toEqual([`fresh`])
-})
+  it(`scans a cold durable owner that appeared after an empty sync run`, async () => {
+    const id = `cold-owner-after-empty-baseline`
+    const queryHash = hashKey([id])
+    const hotStorage = createOwnershipStorage()
+    const hot = createPersistedOwnershipFixture(id, hotStorage, [])
+    await hot.collection._sync.loadSubset({})
+    expect(storedItems(hotStorage)).toEqual([])
+    await hot.collection.cleanup()
+
+    // This seeded durable state represents another writer's committed owner
+    // while the first Collection had no sync run. The cold Collection cannot
+    // use the first run's empty-baseline evidence.
+    const coldSeed = hotStorage.snapshot()
+    coldSeed.rows.set(shared.id, shared)
+    coldSeed.rowMetadata.set(shared.id, {
+      queryCollection: { owners: { [queryHash]: true } },
+    })
+    coldSeed.collectionMetadata.set(`queryCollection:gc:${queryHash}`, {
+      queryHash,
+      mode: `until-revalidated`,
+    })
+    const coldStorage = createOwnershipStorage(coldSeed)
+    const coldScanRows = vi.spyOn(coldStorage.adapter, `scanRows`)
+    const cold = createPersistedOwnershipFixture(id, coldStorage, [])
+    await cold.collection._sync.loadSubset({})
 
-// A released acquisition cannot schedule another provider fetch. In this
-// history a refetch has joined an old, held Query fetch; cache rotation
-// invalidates that result, and unload retires its final observer lease. When
-// the old fetch completes, the call count must stay fixed at the release cut.
-it(`does not restart a released Query acquisition after cache rotation`, async () => {
-  const id = `query-cache-claim-released-refetch`
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
+    // The empty provider result retires the cold durable owner. A design that
+    // skips every empty-baseline scan leaves the stored row behind.
+    expect(cold.queryFn).toHaveBeenCalledOnce()
+    expect(rows(cold.collection)).toEqual([])
+    expect(storedItems(coldStorage)).toEqual([])
+    expect(coldScanRows).toHaveBeenCalledTimes(
+      expectedEmptyBaselineScans([`restart`, `empty-result`]),
+    )
   })
-  const queryClient = createQueryClient()
-  let providerRows: Array<Item> = [
-    { id: `old`, category: `active`, name: `Old` },
-  ]
-  const oldFetchEntered = createDeferred<void>()
-  const releaseOldFetch = createDeferred<void>()
-  const activeDemandKey = getLoadSubsetDemandKey({ limit: 1 })
-  let activeFetches = 0
-  const queryFn = vi.fn(async (context: QueryFunctionContext) => {
-    const snapshot = structuredClone(providerRows)
-    if (context.queryKey[1] === activeDemandKey && ++activeFetches === 2) {
-      oldFetchEntered.resolve()
-      await releaseOldFetch.promise
+
+  it(`rejects a superseded accepted result while publishing its successor`, async () => {
+    const id = `superseded-retained-scan`
+    const queryKey = [id] as const
+    const queryHash = hashKey(queryKey)
+    const initial = { id: `initial`, category: `retained`, name: `Initial` }
+    const first = { id: `first`, category: `retained`, name: `First` }
+    const second = { id: `second`, category: `retained`, name: `Second` }
+    const initialScan =
+      createDeferred<
+        Array<{ key: string | number; value: Item; metadata?: unknown }>
+      >()
+    const firstRefetchScan =
+      createDeferred<
+        Array<{ key: string | number; value: Item; metadata?: unknown }>
+      >()
+    const scanPersistedRows = vi
+      .fn()
+      .mockReturnValueOnce(initialScan.promise)
+      .mockReturnValueOnce(firstRefetchScan.promise)
+      .mockResolvedValue([])
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [[initial], [first], [second]],
+      syncMode: `eager`,
+      scanPersistedRows,
+      setupMetadata: (metadata) => {
+        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+          queryHash,
+          mode: `until-revalidated`,
+        })
+      },
+    })
+    const publications: Array<Array<string>> = []
+    const subscription = collection.subscribeChanges(() => {
+      publications.push(itemIds(collection.toArray))
+    })
+    cleanups.push(() => {
+      subscription.unsubscribe()
+      return Promise.resolve()
+    })
+    cleanups.push(() => {
+      initialScan.resolve([])
+      firstRefetchScan.resolve([])
+      return Promise.resolve()
+    })
+
+    await vi.waitFor(() => expect(scanPersistedRows).toHaveBeenCalledOnce())
+    expect(queryFn).toHaveBeenCalledOnce()
+    let model: ExplicitRefetchApplicationModel = {
+      calls: new Map(),
+      publicValues: new Map([[`query`, `none`]]),
     }
-    return snapshot
-  })
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryCollectionOptions<Item>({
-        id,
-        queryClient,
-        queryKey: [id],
-        queryFn,
-        getKey: (item) => item.id,
-        syncMode: `on-demand`,
-        startSync: true,
-      }),
-      persistence,
-    }),
-  )
-  cleanups.push(async () => {
-    releaseOldFetch.resolve()
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
+    model = reduceExplicitRefetchApplication(model, {
+      type: `start-call`,
+      callId: 1,
+      resultIds: [`query`],
+      throwOnError: true,
+    })
+    const firstRefetch = collection.utils.refetch({ throwOnError: true })
+    void firstRefetch.catch(() => {})
+    await vi.waitFor(() => {
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(scanPersistedRows).toHaveBeenCalledTimes(2)
+    })
+    model = reduceExplicitRefetchApplication(model, {
+      type: `accept-result`,
+      callId: 1,
+      resultId: `query`,
+      value: first.name,
+    })
 
-  await collection._sync.loadSubset({ limit: 1 })
-  const oldLoad = Promise.resolve(
-    collection._sync.loadSubset({ limit: 1, refetch: true }),
-  )
-  void oldLoad.catch(() => undefined)
-  await oldFetchEntered.promise
-  now += 10_001
-  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
-  await collection._sync.loadSubset({ limit: 2 })
-  collection._sync.unloadSubset({ limit: 1 })
-  collection._sync.unloadSubset({ limit: 1 })
-  const fetchesAtRelease = activeFetches
-  releaseOldFetch.resolve()
-  await Promise.allSettled([oldLoad])
-  await new Promise<void>((resolve) => setTimeout(resolve, 0))
-  expect(activeFetches).toBe(fetchesAtRelease)
-  expect(collection.get(`old`)).toBeUndefined()
-})
+    model = reduceExplicitRefetchApplication(model, {
+      type: `start-call`,
+      callId: 2,
+      resultIds: [`query`],
+      throwOnError: true,
+    })
+    const secondRefetch = collection.utils.refetch({ throwOnError: true })
+    await vi.waitFor(() => {
+      expect(queryFn).toHaveBeenCalledTimes(3)
+      expect(collection.get(second.id)?.name).toBe(second.name)
+    })
+    model = reduceExplicitRefetchApplication(model, {
+      type: `accept-result`,
+      callId: 2,
+      resultId: `query`,
+      value: second.name,
+    })
+    model = reduceExplicitRefetchApplication(model, {
+      type: `retire-application`,
+      callId: 1,
+      resultId: `query`,
+    })
+    model = reduceExplicitRefetchApplication(model, {
+      type: `fulfill-application`,
+      callId: 2,
+      resultId: `query`,
+    })
+    await secondRefetch
+    expectExplicitRefetchObservation(
+      {
+        publicValues: { query: collection.get(second.id)?.name },
+        refetch: `resolved`,
+        resultOrder: [`query`],
+      },
+      observeExplicitRefetchApplication(model, 2),
+    )
 
-// Retention maintenance reads old persisted ownership before deciding what to
-// delete. A scan returned by the old SQLite generation has no authority after
-// rotation, even if a fresh provider result uses the same row key. The wrapper
-// holds the completed real-adapter scan so the check observes the fresh row
-// both before and after the stale maintenance continuation is released.
-it(`does not delete a fresh Query row from an old retention scan`, async () => {
-  // The old retention scan must start after the Collection is ready, however
-  // long startup takes. Startup cleans up an entry that has already expired,
-  // and that would hold the scan inside startup. So the entry expires a minute
-  // out on a fake clock that advances with real time, and the test moves the
-  // clock past it only after readiness.
-  vi.useFakeTimers({
-    toFake: [`setTimeout`, `clearTimeout`, `Date`],
-    shouldAdvanceTime: true,
-  })
-  const id = `query-cache-claim-held-retention`
-  const oldRow: Item = { id: `same`, category: `active`, name: `Old` }
-  const freshRow: Item = { ...oldRow, name: `Fresh` }
-  const subset = { limit: 1 }
-  const queryHash = hashKey([id, getLoadSubsetDemandKey(subset)])
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  let now = 1_000
-  const persistence = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-    cacheGenerationClaimTtlMs: 10_000,
-    now: () => now,
-  })
-  const queryClient = createQueryClient()
-  const scanEntered = createDeferred<void>()
-  const releaseOldScan = createDeferred<void>()
-  let scans = 0
-  const queryOptions = queryCollectionOptions<Item>({
-    id,
-    queryClient,
-    queryKey: [id],
-    queryFn: () => Promise.resolve([freshRow]),
-    getKey: (item) => item.id,
-    syncMode: `on-demand`,
-    startSync: true,
-  })
-  const originalSync = queryOptions.sync.sync
-  const collection = createCollection(
-    persistedCollectionOptions<
-      Item,
-      string | number,
-      never,
-      QueryCollectionUtils<Item, string | number, Item, unknown>
-    >({
-      ...queryOptions,
-      sync: {
-        ...queryOptions.sync,
-        sync: (params) => {
-          const metadata = params.metadata!
-          const capability = metadata.persistence!
-          const scan = capability.scanPersistedRows
-          params.begin()
-          params.write({ type: `insert`, value: oldRow })
-          metadata.row.set(oldRow.id, {
-            queryCollection: { owners: { [queryHash]: true } },
-          })
-          metadata.collection.set(`queryCollection:gc:${queryHash}`, {
-            queryHash,
-            mode: `ttl`,
-            expiresAt: Date.now() + 60_000,
-          })
-          params.commit()
-          return originalSync({
-            ...params,
-            metadata: {
-              ...metadata,
-              persistence: {
-                ...capability,
-                scanPersistedRows: async (...args) => {
-                  const snapshot = await scan(...args)
-                  if (++scans === 1) {
-                    scanEntered.resolve()
-                    await releaseOldScan.promise
-                  }
-                  return snapshot
-                },
-              },
-            },
-          })
-        },
+    firstRefetchScan.resolve([])
+    await expect(firstRefetch).rejects.toMatchObject({ name: `AbortError` })
+    expectExplicitRefetchObservation(
+      {
+        publicValues: { query: collection.get(second.id)?.name },
+        refetch: `rejected`,
       },
-      persistence,
-    }),
-  )
-  cleanups.push(async () => {
-    vi.useRealTimers()
-    releaseOldScan.resolve()
-    await collection.cleanup()
-    queryClient.clear()
-    driver.close()
-  })
+      observeExplicitRefetchApplication(model, 1),
+    )
+    initialScan.resolve([])
 
-  await collection.stateWhenReady()
-  expect(scans).toBe(0)
-  await vi.advanceTimersByTimeAsync(60_001)
-  await scanEntered.promise
-  now += 10_001
-  await collection._sync.loadSubset(subset)
-  expect(collection.get(`same`)?.name).toBe(`Fresh`)
-  releaseOldScan.resolve()
-  await new Promise<void>((resolve) => setTimeout(resolve, 0))
-  expect(collection.get(`same`)?.name).toBe(`Fresh`)
-  expect(collection.status).toBe(`ready`)
+    await vi.waitFor(() => {
+      expect(itemIds(collection.toArray)).toEqual([second.id])
+    })
+    expect(publications).not.toContainEqual([initial.id])
+    expect(publications).not.toContainEqual([first.id])
+  })
 })
diff --git a/packages/query-db-collection/tests/ownership-lifecycle.test.ts b/packages/query-db-collection/tests/ownership-lifecycle.test.ts
new file mode 100644
index 0000000000..22c82d269b
--- /dev/null
+++ b/packages/query-db-collection/tests/ownership-lifecycle.test.ts
@@ -0,0 +1,8645 @@
+/**
+ * Ordinary Query Collection ownership tests: fixed scenarios whose expected
+ * values are written by hand. The ownership law and its generated histories
+ * are owned by ownership-lifecycle.oracle.test.ts.
+ */
+
+import {
+  CancelledError,
+  QueryClient,
+  QueryObserver,
+  focusManager,
+  hashKey,
+  isCancelledError,
+} from '@tanstack/query-core'
+import {
+  DbClient,
+  IR,
+  collectionOptions,
+  createCollection,
+  createLiveQueryCollection,
+  createTransaction,
+  eq,
+  getLoadSubsetDemandKey,
+} from '@tanstack/db'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { createDeferred } from '../../db/src/deferred.js'
+
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src/index.js'
+import { createNodeSQLitePersistence } from '../../node-db-sqlite-persistence/src/index.js'
+import { BetterSqlite3SQLiteDriver } from '../../node-db-sqlite-persistence/src/node-driver.js'
+import { SyncNotInitializedError } from '../src/errors.js'
+import { queryCollectionOptions } from '../src/query.js'
+import {
+  categoryIn,
+  categorySubset,
+  cleanups,
+  createOwnershipFixture,
+  createOwnershipStorage,
+  createPersistedOwnershipFixture,
+  createQueryClient,
+  detailOnly,
+  expectColdOwnerRevalidation,
+  expectMutationLifecycleSnapshot,
+  expectMutationPublicationIntegrity,
+  expectedDirectWriteAdmission,
+  expectedDirectWriteReceipt,
+  itemIds,
+  listOnly,
+  observeColdOwnerRevalidation,
+  persistedOwners,
+  readClaimedCacheRows,
+  recordMetadata,
+  recordRunCacheClaim,
+  reportedError,
+  rows,
+  runCleanups,
+  shared,
+  storedItems,
+} from './ownership-lifecycle-support.js'
+import type {
+  Item,
+  MetadataRecorder,
+  MutationLifecycleSnapshot,
+  MutationPublicationSnapshot,
+} from './ownership-lifecycle-support.js'
+import type { LoadSubsetOptions } from '@tanstack/db'
+import type { QueryFunctionContext } from '@tanstack/query-core'
+
+import type { QueryCollectionUtils } from '../src/query.js'
+
+describe(`query collection ownership lifecycle`, () => {
+  afterEach(async () => {
+    await runCleanups()
+  })
+
+  it(`starts the deferred replacement when the barrier resolves during a fetch`, async () => {
+    const id = `deferred-result-in-flight`
+    const barrier = createDeferred<void>()
+    const inFlight = createDeferred<Array<Item>>()
+    const initial = { ...shared, name: `Initial` }
+    const replacement = { ...shared, name: `Replacement` }
+    const queryClient = createQueryClient()
+    const queryFn = vi
+      .fn<() => Promise<Array<Item>>>()
+      .mockResolvedValueOnce([initial])
+      .mockImplementationOnce(() => inFlight.promise)
+      .mockResolvedValue([replacement])
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      collection.deferDataRefresh = null
+      barrier.resolve()
+      inFlight.resolve([initial])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.stateWhenReady()
+    collection.deferDataRefresh = barrier.promise
+    void collection.utils.refetch().catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+
+    collection.deferDataRefresh = null
+    barrier.resolve()
+
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    await vi.waitFor(() => {
+      expect(collection.get(shared.id)?.name).toBe(replacement.name)
+    })
+  })
+
+  /**
+   * Error recovery law: a previous Query failure remains public while an
+   * explicit retry is pending. A failed retry is another consecutive failure;
+   * a successful retry clears the error. This follows the documented
+   * `lastError`/`errorCount` reset-on-success contract. The model represents
+   * only these three public error fields, not Collection status or row changes.
+   *
+   * The bounded history crosses a failed initial load, a failed background
+   * refetch, or a failed Collection application with a held retry. One retry
+   * holds Collection application after Query fetch success. A background
+   * failure crosses an intermediate Query retry attempt before a held final
+   * attempt. A repeated error at clock time zero distinguishes consecutive
+   * failures from duplicate observer notifications. The real QueryClient and
+   * `clearError()` are the driver.
+   * The refinement check reads the public utils
+   * when the retry starts but before its result settles, then after settlement.
+   *
+   * ORC-001: `query.ts` getter comments and the error-handling guide promise
+   * reset on success. ORC-002/003/005: the three-state public model below is
+   * separate from Query's timestamp and is checked at both named boundaries.
+   * ORC-004/007: this is a bounded fixed matrix, not a generated property.
+   * ORC-006: the original `clearError()` fails both initial pending cases;
+   * an observer-success reset fails the application-error and held-application
+   * cases; an unconditional error-result classifier recounts the old error
+   * during a Query retry attempt; a zero timestamp sentinel fails the
+   * epoch-zero repeated-error case.
+   * ORC-008:
+   * no model state is combined or removed. ORC-009: `retry pending` maps to
+   * a held Query result; no new production concept is named. ORC-010: cleanup
+   * settles the held result and retains primary assertion failures. ORC-011:
+   * no plausible shared semantic helper needs a second formulation here.
+   * The matrix does not cover concurrent retries for multiple tracked Queries,
+   * mutation-handler fetch-boundary settlement, or deferred result application.
+   */
+  it.each([
+    { priorFailure: `initial`, retryResult: `failure`, sameError: false },
+    { priorFailure: `initial`, retryResult: `success`, sameError: false },
+    { priorFailure: `background`, retryResult: `failure`, sameError: false },
+    { priorFailure: `background`, retryResult: `success`, sameError: false },
+    { priorFailure: `initial`, retryResult: `failure`, sameError: true },
+  ] as const)(
+    `keeps a $priorFailure error visible until a held retry $retryResult, same error $sameError`,
+    async ({ priorFailure, retryResult, sameError }) => {
+      const id = `held-error-retry-${priorFailure}-${retryResult}-${sameError}`
+      const previousError = new Error(`previous failure`)
+      const retryError = sameError ? previousError : new Error(`retry failure`)
+      const heldResult = createDeferred<Array<Item>>()
+      const queryClient = createQueryClient()
+      const now = sameError ? vi.spyOn(Date, `now`).mockReturnValue(0) : null
+      const queryFn = vi.fn<() => Promise<Array<Item>>>()
+      if (priorFailure === `background`) {
+        queryFn.mockResolvedValueOnce([shared])
+      }
+      queryFn.mockRejectedValueOnce(previousError)
+      queryFn.mockImplementationOnce(() => heldResult.promise)
+      const consoleError = vi
+        .spyOn(console, `error`)
+        .mockImplementation(() => {})
+      const collection = createCollection(
+        queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => item.id,
+          syncMode: `eager`,
+          startSync: true,
+          retry: false,
+        }),
+      )
+      cleanups.push(async () => {
+        consoleError.mockRestore()
+        now?.mockRestore()
+        heldResult.resolve([])
+        await collection.cleanup()
+        queryClient.clear()
+      })
+
+      if (priorFailure === `initial`) {
+        await expect(collection.stateWhenReady()).rejects.toBe(previousError)
+      } else {
+        await collection.stateWhenReady()
+        await expect(
+          collection.utils.refetch({ throwOnError: true }),
+        ).rejects.toBe(previousError)
+      }
+
+      const observeError = () => reportedError(collection)
+      // An independent model. An initial error is final for its sync run, so
+      // every later state reports it. After readiness, a pending retry keeps
+      // the previous health error, a failed retry reports its own, and a
+      // successful retry clears it.
+      const expected =
+        priorFailure === `initial`
+          ? {
+              pending: previousError,
+              failure: previousError,
+              success: previousError,
+            }
+          : { pending: previousError, failure: retryError, success: undefined }
+      expect(observeError()).toEqual(expected.pending)
+
+      const retry = collection.utils.refetch({ throwOnError: true }).then(
+        () => ({ outcome: `fulfilled` as const }),
+        (error: unknown) => ({ outcome: `rejected` as const, error }),
+      )
+      await vi.waitFor(() =>
+        expect(queryFn).toHaveBeenCalledTimes(
+          priorFailure === `initial` ? 2 : 3,
+        ),
+      )
+      expect(observeError()).toEqual(expected.pending)
+
+      if (retryResult === `failure`) {
+        heldResult.reject(retryError)
+        expect(await retry).toEqual({ outcome: `rejected`, error: retryError })
+      } else {
+        heldResult.resolve([shared])
+        expect(await retry).toEqual({ outcome: `fulfilled` })
+      }
+      expect(observeError()).toEqual(expected[retryResult])
+    },
+  )
+
+  it.each([`success`, `failure`] as const)(
+    `retains an application error while a held retry reaches %s`,
+    async (retryResult) => {
+      const id = `held-application-error-retry-${retryResult}`
+      const applicationError = new Error(`application failed`)
+      const retryError = new Error(`retry failed`)
+      const heldResult = createDeferred<Array<Item>>()
+      const queryClient = createQueryClient()
+      const queryFn = vi
+        .fn<() => Promise<Array<Item>>>()
+        .mockResolvedValueOnce([shared])
+        .mockImplementationOnce(() => heldResult.promise)
+      let failApplication = true
+      const consoleError = vi
+        .spyOn(console, `error`)
+        .mockImplementation(() => {})
+      const collection = createCollection(
+        queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => {
+            if (failApplication) {
+              failApplication = false
+              throw applicationError
+            }
+            return item.id
+          },
+          syncMode: `eager`,
+          startSync: true,
+          retry: false,
+        }),
+      )
+      cleanups.push(async () => {
+        heldResult.resolve([shared])
+        try {
+          await collection.cleanup()
+        } finally {
+          queryClient.clear()
+          consoleError.mockRestore()
+        }
+      })
+      let retry:
+        | Promise<
+            { outcome: `fulfilled` } | { outcome: `rejected`; error: unknown }
+          >
+        | undefined
+      try {
+        await expect(collection.stateWhenReady()).rejects.toBe(applicationError)
+        expect(reportedError(collection)).toBe(applicationError)
+
+        retry = collection.utils.refetch({ throwOnError: true }).then(
+          () => ({ outcome: `fulfilled` as const }),
+          (error: unknown) => ({ outcome: `rejected` as const, error }),
+        )
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+        // Query still holds its old successful result, despite the failed
+        // Collection application. A fetch-start success notification is not recovery.
+        expect(reportedError(collection)).toBe(applicationError)
+
+        if (retryResult === `failure`) {
+          heldResult.reject(retryError)
+          expect(await retry).toEqual({
+            outcome: `rejected`,
+            error: retryError,
+          })
+        } else {
+          heldResult.resolve([shared])
+          expect(await retry).toEqual({ outcome: `fulfilled` })
+        }
+        // The failed application was the initial load, so its error is final
+        // for this sync run whatever the retry does.
+        expect(reportedError(collection)).toBe(applicationError)
+        expect(collection.status).toBe(`error`)
+      } finally {
+        heldResult.resolve([shared])
+        await retry
+      }
+    },
+  )
+
+  it(`retains a Query error until a successful retry applies`, async () => {
+    const id = `held-retry-application`
+    const queryHash = hashKey([id])
+    const previousError = new Error(`previous fetch failed`)
+    const firstResult = createDeferred<Array<Item>>()
+    const persistedScan =
+      createDeferred<
+        Array<{ key: string | number; value: Item; metadata?: unknown }>
+      >()
+    const scanPersistedRows = vi.fn(() => persistedScan.promise)
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [firstResult.promise, [shared]],
+      syncMode: `on-demand`,
+      scanPersistedRows,
+      setupMetadata: (metadata) => {
+        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+          queryHash,
+          mode: `until-revalidated`,
+        })
+      },
+    })
+    cleanups.push(() => {
+      consoleError.mockRestore()
+      return Promise.resolve()
+    })
+
+    try {
+      const initialLoad = collection._sync.loadSubset({})
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
+      firstResult.reject(previousError)
+      await expect(
+        Promise.resolve(initialLoad === true ? undefined : initialLoad),
+      ).rejects.toBe(previousError)
+      expect(reportedError(collection)).toBe(previousError)
+      expect(reportedError(collection)).toBeDefined()
+
+      const retry = collection.utils.refetch({ throwOnError: true })
+      await vi.waitFor(() => {
+        expect(queryFn).toHaveBeenCalledTimes(2)
+        expect(scanPersistedRows).toHaveBeenCalledOnce()
+      })
+      // Query has fetched successfully, but Collection application is held.
+      expect(reportedError(collection)).toBe(previousError)
+      expect(reportedError(collection)).toBeDefined()
+
+      persistedScan.resolve([])
+      await retry
+      expect(reportedError(collection)).toBeUndefined()
+    } finally {
+      firstResult.resolve([])
+      persistedScan.resolve([])
+    }
+  })
+
+  /**
+   * A completed failure remains visible until a later successful result
+   * applies. The model counts terminal failures, including reuse of the same
+   * Error object in one clock tick. The persisted scan holds the older success
+   * between fetch completion and application; the public checkpoint is after
+   * that scan is released. This does not exercise native SQLite persistence.
+   */
+  it.each([`clearError`, `reused-error`] as const)(
+    `does not let an older held revalidation clear a newer Query error after %s`,
+    async (retryMode) => {
+      const id = `held-revalidation-newer-error`
+      const queryHash = hashKey([id])
+      const previousError = new Error(`initial fetch failed`)
+      const newerError =
+        retryMode === `reused-error`
+          ? previousError
+          : new Error(`later fetch failed`)
+      const dateNow =
+        retryMode === `reused-error`
+          ? vi.spyOn(Date, `now`).mockReturnValue(1_000)
+          : undefined
+      const firstResult = createDeferred<Array<Item>>()
+      const laterResult = createDeferred<Array<Item>>()
+      const persistedScan =
+        createDeferred<
+          Array<{ key: string | number; value: Item; metadata?: unknown }>
+        >()
+      const scanPersistedRows = vi.fn(() => persistedScan.promise)
+      const consoleError = vi
+        .spyOn(console, `error`)
+        .mockImplementation(() => {})
+      const { collection, queryFn } = createOwnershipFixture({
+        id,
+        results: [firstResult.promise, [shared], laterResult.promise],
+        syncMode: `on-demand`,
+        scanPersistedRows,
+        setupMetadata: (metadata) => {
+          metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+            queryHash,
+            mode: `until-revalidated`,
+          })
+        },
+      })
+      cleanups.push(() => {
+        consoleError.mockRestore()
+        dateNow?.mockRestore()
+        return Promise.resolve()
+      })
+
+      try {
+        const initialLoad = collection._sync.loadSubset({})
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
+        firstResult.reject(previousError)
+        await expect(
+          Promise.resolve(initialLoad === true ? undefined : initialLoad),
+        ).rejects.toBe(previousError)
+        expect(reportedError(collection)).toBe(previousError)
+
+        const firstRetry = (
+          retryMode === `clearError`
+            ? collection.utils.refetch({ throwOnError: true })
+            : collection.utils.refetch({ throwOnError: true })
+        ).then(
+          () => ({ outcome: `fulfilled` as const }),
+          (error: unknown) => ({ outcome: `rejected` as const, error }),
+        )
+        await vi.waitFor(() => {
+          expect(queryFn).toHaveBeenCalledTimes(2)
+          expect(scanPersistedRows).toHaveBeenCalledOnce()
+        })
+        expect(reportedError(collection)).toBe(previousError)
+
+        const secondRetry = collection.utils.refetch({ throwOnError: true })
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+        laterResult.reject(newerError)
+        await expect(secondRetry).rejects.toBe(newerError)
+        expect(reportedError(collection)).toBe(newerError)
+        expect(reportedError(collection)).toBeDefined()
+
+        persistedScan.resolve([])
+        expect(await firstRetry).toEqual({ outcome: `fulfilled` })
+        expect(reportedError(collection)).toBe(newerError)
+        expect(reportedError(collection)).toBeDefined()
+      } finally {
+        firstResult.resolve([])
+        laterResult.resolve([])
+        persistedScan.resolve([])
+      }
+    },
+  )
+
+  it.each([`success`, `failure`] as const)(
+    `does not recount the previous error during a Query retry attempt ending in %s`,
+    async (outcome) => {
+      const id = `held-query-retry-attempt-${outcome}`
+      const previousError = new Error(`previous fetch failed`)
+      const attemptError = new Error(`retry attempt failed`)
+      const finalError = new Error(`retry finally failed`)
+      const heldResult = createDeferred<Array<Item>>()
+      const queryFn = vi
+        .fn<() => Promise<Array<Item>>>()
+        .mockResolvedValueOnce([shared])
+        .mockRejectedValueOnce(previousError)
+        .mockRejectedValueOnce(attemptError)
+        .mockImplementationOnce(() => heldResult.promise)
+      const queryClient = createQueryClient()
+      const consoleError = vi
+        .spyOn(console, `error`)
+        .mockImplementation(() => {})
+      const collection = createCollection(
+        queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => item.id,
+          syncMode: `eager`,
+          startSync: true,
+          retry: (count, error) => error === attemptError && count < 2,
+          retryDelay: 0,
+        }),
+      )
+      cleanups.push(async () => {
+        heldResult.resolve([shared])
+        try {
+          await collection.cleanup()
+        } finally {
+          queryClient.clear()
+          consoleError.mockRestore()
+        }
+      })
+
+      await collection.stateWhenReady()
+      await expect(
+        collection.utils.refetch({ throwOnError: true }),
+      ).rejects.toBe(previousError)
+      expect(reportedError(collection)).toBeDefined()
+      const retry = collection.utils.refetch({ throwOnError: true }).then(
+        () => ({ outcome: `fulfilled` as const }),
+        (error: unknown) => ({ outcome: `rejected` as const, error }),
+      )
+      try {
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(4))
+        // Query retains its old error while its first retry attempt has failed.
+        expect(reportedError(collection)).toBe(previousError)
+        expect(reportedError(collection)).toBeDefined()
+        if (outcome === `success`) {
+          heldResult.resolve([shared])
+          expect(await retry).toEqual({ outcome: `fulfilled` })
+          expect(reportedError(collection)).toBeUndefined()
+        } else {
+          heldResult.reject(finalError)
+          expect(await retry).toEqual({
+            outcome: `rejected`,
+            error: finalError,
+          })
+          expect(reportedError(collection)).toBe(finalError)
+          expect(reportedError(collection)).toBeDefined()
+        }
+      } finally {
+        heldResult.resolve([shared])
+        await retry
+      }
+    },
+  )
+
+  it(`starts an idle collection only when a direct write is invoked`, () => {
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn((): Promise<Array<Item>> => Promise.resolve([]))
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id: `idle-direct-write-startup`,
+        queryClient,
+        queryKey: [`idle-direct-write-startup`],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: false,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    expect(collection.status).toBe(`idle`)
+    expect(reportedError(collection)).toBeUndefined()
+    expect(collection.status).toBe(`idle`)
+
+    collection.utils.writeUpsert({
+      id: `first`,
+      category: `direct`,
+      name: `First`,
+    })
+
+    expect(collection.status).toBe(`ready`)
+    expect(rows(collection)).toEqual([`first`])
+    expect(queryFn).not.toHaveBeenCalled()
+  })
+
+  it(`fails fast when a direct write is attempted during deferred startup`, () => {
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn((): Promise<Array<Item>> => Promise.resolve([]))
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id: `deferred-direct-write`,
+        queryClient,
+        queryKey: [`deferred-direct-write`],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: false,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    expect(collection._deferSyncStart()).toBe(true)
+    for (const write of [
+      () => collection.utils.writeInsert(shared),
+      () => collection.utils.writeUpdate(shared),
+      () => collection.utils.writeDelete(shared.id),
+      () => collection.utils.writeUpsert(shared),
+      () => collection.utils.writeBatch(() => {}),
+    ]) {
+      expect(write).toThrow(SyncNotInitializedError)
+    }
+    expect(collection.status).toBe(`idle`)
+    expect(rows(collection)).toEqual([])
+
+    collection._resumeSyncStart()
+    expect(collection.status).toBe(`ready`)
+    expect(rows(collection)).toEqual([])
+    expect(queryFn).not.toHaveBeenCalled()
+  })
+
+  it(`does not restart a cleaned-up idle collection for a direct write`, async () => {
+    const id = `cleaned-idle-direct-write`
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn((): Promise<Array<Item>> => Promise.resolve([]))
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: false,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.cleanup()
+    expect(() => collection.utils.writeUpsert(shared)).toThrow(
+      SyncNotInitializedError,
+    )
+    expect(collection.status).toBe(`cleaned-up`)
+    expect(rows(collection)).toEqual([])
+    expect(queryFn).not.toHaveBeenCalled()
+  })
+
+  it(`rejects a late mutation write without restarting a cleaned-up collection`, async () => {
+    const id = `late-mutation-after-cleanup`
+    const queryKey = [id] as const
+    const inserted = { id: `late`, category: `mutation`, name: `Late` }
+    const serverRows: Array<Item> = []
+    const handlerEntered = createDeferred<void>()
+    const releaseHandler = createDeferred<void>()
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(serverRows)))
+    let writeLate = (_item: Item) => {}
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => item.id,
+        startSync: true,
+        onInsert: async ({ transaction }) => {
+          handlerEntered.resolve()
+          await releaseHandler.promise
+          transaction.mutations.forEach(({ modified }) =>
+            writeLate(structuredClone(modified)),
+          )
+          return { refetch: false }
+        },
+      }),
+    )
+    writeLate = (item) => collection.utils.writeUpsert(item)
+    cleanups.push(async () => {
+      releaseHandler.resolve()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.stateWhenReady()
+    expect(queryFn).toHaveBeenCalledOnce()
+
+    const mutation = collection.insert(inserted)
+    await handlerEntered.promise
+    await collection.cleanup()
+    releaseHandler.resolve()
+    await expect(mutation.isPersisted.promise).rejects.toBeInstanceOf(
+      SyncNotInitializedError,
+    )
+
+    expect(collection.status).toBe(`cleaned-up`)
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(itemIds(collection._state.syncedData.values())).toEqual([])
+    expect(queryClient.getQueryData(queryKey)).toBeUndefined()
+  })
+
+  it.each([
+    { ordered: false, settlementOrder: [0, 1] },
+    { ordered: false, settlementOrder: [1, 0] },
+    { ordered: true, settlementOrder: [0, 1] },
+    { ordered: true, settlementOrder: [1, 0] },
+  ] as const)(
+    `publishes mutation refetches through source and downstream view: %j`,
+    async ({ ordered, settlementOrder }) => {
+      const id = `mutation-publication-${ordered ? `ordered` : `unordered`}-${settlementOrder.join(``)}`
+      const queryClient = createQueryClient()
+      const serverRows: Array<Item> = []
+      const persistenceGates: Array<ReturnType<typeof createDeferred<void>>> =
+        []
+      const queryFn = vi.fn(() =>
+        Promise.resolve(serverRows.map((item) => structuredClone(item))),
+      )
+      const collection = createCollection(
+        queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => item.id,
+          startSync: true,
+          onInsert: async ({ transaction }) => {
+            const gate = createDeferred<void>()
+            persistenceGates.push(gate)
+            await gate.promise
+            serverRows.push(
+              ...transaction.mutations.map(({ modified }) =>
+                structuredClone(modified),
+              ),
+            )
+          },
+        }),
+      )
+      const derived = createLiveQueryCollection((query) => {
+        const source = query.from({ item: collection })
+        const result = ordered
+          ? source.orderBy(({ item }) => item.name, `asc`)
+          : source
+        return result.select(({ item }) => ({ ...item }))
+      })
+      const publications: Array<MutationPublicationSnapshot> = []
+      let expectedPublication: Array<string> = []
+      const subscription = derived.subscribeChanges(() => {
+        publications.push({
+          source: ordered
+            ? [...collection.toArray]
+                .sort((left, right) => left.name.localeCompare(right.name))
+                .map(({ id: rowId }) => rowId)
+            : rows(collection),
+          derived: ordered
+            ? derived.toArray.map(({ id: rowId }) => rowId)
+            : rows(derived),
+          expected: expectedPublication,
+        })
+      })
+      cleanups.push(async () => {
+        persistenceGates.forEach((gate) => gate.resolve())
+        subscription.unsubscribe()
+        await derived.cleanup()
+        await collection.cleanup()
+        queryClient.clear()
+      })
+
+      const firstItem = {
+        id: `z-first`,
+        category: `mutation`,
+        name: `1-first`,
+      }
+      const secondItem = {
+        id: `a-second`,
+        category: `mutation`,
+        name: `2-second`,
+      }
+      await derived.preload()
+      expectedPublication = [firstItem.id]
+      const first = collection.insert(firstItem)
+      const visibleIds = [firstItem.id, secondItem.id]
+      expectedPublication = ordered ? visibleIds : [...visibleIds].sort()
+      const second = collection.insert(secondItem)
+      const transactions = [first, second]
+      const items = [firstItem, secondItem]
+      const queryKey = [id] as const
+      const capture = (): MutationLifecycleSnapshot => ({
+        server: itemIds(serverRows),
+        cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+        synced: itemIds(collection._state.syncedData.values()),
+        source: itemIds(collection.toArray),
+        derived: ordered
+          ? derived.toArray.map(({ id: rowId }) => rowId)
+          : itemIds(derived.toArray),
+      })
+
+      expect(persistenceGates).toHaveLength(2)
+      expect(queryFn).toHaveBeenCalledOnce()
+      expectMutationLifecycleSnapshot(capture(), [], visibleIds, ordered)
+
+      const settled = new Set<number>()
+      for (const transactionIndex of settlementOrder) {
+        persistenceGates[transactionIndex]!.resolve()
+        await transactions[transactionIndex]!.isPersisted.promise
+        settled.add(transactionIndex)
+
+        const authoritativeIds = [...settled].map((index) => items[index]!.id)
+        expect(queryFn).toHaveBeenCalledTimes(1 + settled.size)
+        const expectedSynced =
+          settled.size === transactions.length ? authoritativeIds : []
+        expect(capture()).toEqual({
+          server: [...authoritativeIds].sort(),
+          cache: [...authoritativeIds].sort(),
+          synced: [...expectedSynced].sort(),
+          source: [...visibleIds].sort(),
+          derived: ordered ? visibleIds : [...visibleIds].sort(),
+        })
+        expectMutationPublicationIntegrity(publications)
+        expect(publications.at(-1)?.derived).toEqual(
+          ordered ? visibleIds : [...visibleIds].sort(),
+        )
+      }
+
+      const thirdItem = {
+        id: `m-third`,
+        category: `mutation`,
+        name: `3-third`,
+      }
+      const allVisibleIds = [...visibleIds, thirdItem.id]
+      expectedPublication = ordered ? allVisibleIds : [...allVisibleIds].sort()
+      const third = collection.insert(thirdItem)
+      expect(persistenceGates).toHaveLength(3)
+      expectMutationLifecycleSnapshot(
+        capture(),
+        visibleIds,
+        allVisibleIds,
+        ordered,
+      )
+
+      persistenceGates[2]!.resolve()
+      await third.isPersisted.promise
+
+      expect(queryFn).toHaveBeenCalledTimes(4)
+      expectMutationLifecycleSnapshot(
+        capture(),
+        allVisibleIds,
+        allVisibleIds,
+        ordered,
+      )
+      expectMutationPublicationIntegrity(publications)
+      expect(publications.at(-1)?.derived).toEqual(
+        ordered ? allVisibleIds : [...allVisibleIds].sort(),
+      )
+    },
+  )
+
+  it(`rejects incomplete and misordered mutation publication receipts`, () => {
+    const visible = [`z-first`, `a-second`, `m-third`]
+    const valid: MutationLifecycleSnapshot = {
+      server: [...visible].sort(),
+      cache: [...visible].sort(),
+      synced: [...visible].sort(),
+      source: [...visible].sort(),
+      derived: visible,
+    }
+
+    expectMutationLifecycleSnapshot(valid, visible, visible, true)
+    for (const mutant of [
+      { ...valid, synced: [] },
+      { ...valid, source: [] },
+      { ...valid, derived: visible.slice(0, 2) },
+      { ...valid, derived: [...visible].reverse() },
+      { ...valid, source: [...valid.source, `stale`] },
+    ]) {
+      expect(() =>
+        expectMutationLifecycleSnapshot(mutant, visible, visible, true),
+      ).toThrow()
+    }
+  })
+
+  it(`rejects a torn intermediate publication before a complete final snapshot`, () => {
+    const first = [`z-first`]
+    const firstAndSecond = [`z-first`, `a-second`]
+    const allVisible = [`z-first`, `a-second`, `m-third`]
+    const legitimateSequence: Array<MutationPublicationSnapshot> = [
+      { source: first, derived: first, expected: first },
+      {
+        source: firstAndSecond,
+        derived: firstAndSecond,
+        expected: firstAndSecond,
+      },
+      { source: allVisible, derived: allVisible, expected: allVisible },
+    ]
+
+    expect(() =>
+      expectMutationPublicationIntegrity(legitimateSequence),
+    ).not.toThrow()
+    expect(() =>
+      expectMutationPublicationIntegrity([
+        ...legitimateSequence.slice(0, 2),
+        { source: [], derived: [], expected: allVisible },
+        legitimateSequence[2]!,
+      ]),
+    ).toThrow()
+  })
+
+  it(`supersedes a stale focus result before publishing a newer mutation snapshot`, async () => {
+    const id = `focus-result-supersession`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `mutation`, name: `A` }
+    const retired = { id: `b`, category: `mutation`, name: `B` }
+    const inserted = { id: `c`, category: `mutation`, name: `C` }
+    const serverRows = [initial, retired]
+    const firstFocus = createDeferred<Array<Item>>()
+    const secondFocus = createDeferred<Array<Item>>()
+    const handlerEntered = createDeferred<void>()
+    const releaseHandler = createDeferred<void>()
+    const queryClient = createQueryClient(false, 0)
+    let queryCalls = 0
+    const queryFn = vi.fn(() => {
+      queryCalls++
+      if (queryCalls === 2) return firstFocus.promise
+      if (queryCalls === 3) return secondFocus.promise
+      return Promise.resolve(structuredClone(serverRows))
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        staleTime: 0,
+        refetchOnWindowFocus: true,
+        onInsert: async ({ transaction }) => {
+          serverRows.splice(
+            0,
+            serverRows.length,
+            initial,
+            ...transaction.mutations.map(({ modified }) =>
+              structuredClone(modified),
+            ),
+          )
+          handlerEntered.resolve()
+          await releaseHandler.promise
+          return { refetch: false }
+        },
+      }),
+    )
+    const derived = createLiveQueryCollection((query) =>
+      query.from({ item: collection }).select(({ item }) => ({
+        id: item.id,
+        category: item.category,
+        name: item.name,
+      })),
+    )
+    const sourcePublications: Array<Array<string>> = []
+    const derivedPublications: Array<MutationPublicationSnapshot> = []
+    const sourceSubscription = collection.subscribeChanges(() => {
+      sourcePublications.push(itemIds(collection.toArray))
+    })
+    const derivedSubscription = derived.subscribeChanges(() => {
+      const source = itemIds(collection.toArray)
+      derivedPublications.push({
+        source,
+        derived: itemIds(derived.toArray),
+        expected: source,
+      })
+    })
+    cleanups.push(async () => {
+      releaseHandler.resolve()
+      sourceSubscription.unsubscribe()
+      derivedSubscription.unsubscribe()
+      await derived.cleanup()
+      await collection.cleanup()
+      queryClient.clear()
+      focusManager.setFocused(undefined)
+    })
+
+    await derived.preload()
+    expect(queryFn).toHaveBeenCalledOnce()
+    sourcePublications.length = 0
+    derivedPublications.length = 0
+
+    focusManager.setFocused(false)
+    focusManager.setFocused(true)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+
+    const mutation = collection.insert(inserted)
+    await handlerEntered.promise
+    firstFocus.resolve([structuredClone(initial)])
+    await vi.waitFor(() =>
+      expect(queryClient.getQueryState(queryKey)?.fetchStatus).toBe(`idle`),
+    )
+
+    let waiterOutcome: `pending` | `resolved` | `rejected` = `pending`
+    const waiter = Promise.resolve(collection._sync.loadSubset({})).then(
+      () => {
+        waiterOutcome = `resolved`
+      },
+      (error) => {
+        waiterOutcome = `rejected`
+        throw error
+      },
+    )
+
+    focusManager.setFocused(false)
+    focusManager.setFocused(true)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    secondFocus.resolve(structuredClone(serverRows))
+    await vi.waitFor(() =>
+      expect(queryClient.getQueryState(queryKey)?.fetchStatus).toBe(`idle`),
+    )
+
+    releaseHandler.resolve()
+    await mutation.isPersisted.promise
+    await waiter
+    await vi.waitFor(() =>
+      expect(itemIds(derived.toArray)).toEqual([initial.id, inserted.id]),
+    )
+
+    expect(waiterOutcome).toBe(`resolved`)
+    expect(sourcePublications).not.toContainEqual([initial.id])
+    for (const publication of sourcePublications) {
+      expect([
+        [initial.id, inserted.id],
+        [initial.id, retired.id, inserted.id].sort(),
+      ]).toContainEqual(publication)
+    }
+    expectMutationPublicationIntegrity(derivedPublications)
+    expect({
+      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+      synced: itemIds(collection._state.syncedData.values()),
+      source: itemIds(collection.toArray),
+      derived: itemIds(derived.toArray),
+    }).toEqual({
+      cache: [initial.id, inserted.id],
+      synced: [initial.id, inserted.id],
+      source: [initial.id, inserted.id],
+      derived: [initial.id, inserted.id],
+    })
+
+    queryClient.setQueryData(queryKey, [])
+    await vi.waitFor(() => {
+      expect({
+        synced: itemIds(collection._state.syncedData.values()),
+        source: itemIds(collection.toArray),
+        derived: itemIds(derived.toArray),
+      }).toEqual({ synced: [], source: [], derived: [] })
+    })
+  })
+
+  it(`removes rows superseded while an older result is publishing`, async () => {
+    const id = `reentrant-committed-result-supersession`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const sibling = { id: `b`, category: `result`, name: `B` }
+    const updated = { ...initial, name: `A from server` }
+    const orphaned = { id: `c`, category: `result`, name: `C` }
+    const handlerEntered = createDeferred<void>()
+    const releaseHandler = createDeferred<void>()
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([initial, sibling]))
+    const onUpdate = vi.fn(async () => {
+      handlerEntered.resolve()
+      await releaseHandler.promise
+      return { refetch: false }
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => item.id,
+        startSync: true,
+        onUpdate,
+      }),
+    )
+    cleanups.push(async () => {
+      releaseHandler.resolve()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.stateWhenReady()
+    const mutation = collection.update(initial.id, (draft) => {
+      draft.name = `A optimistic`
+    })
+    await handlerEntered.promise
+
+    const publications: Array<Array<string>> = []
+    let superseded = false
+    const subscription = collection.subscribeChanges(() => {
+      const ids = itemIds(collection.toArray)
+      publications.push(ids)
+      if (!superseded && ids.includes(orphaned.id)) {
+        superseded = true
+        queryClient.setQueryData(queryKey, [updated, sibling])
+      }
+    })
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+
+    queryClient.setQueryData(queryKey, [updated, sibling, orphaned])
+    expect(itemIds(collection._state.syncedData.values())).toEqual([
+      initial.id,
+      sibling.id,
+    ])
+
+    releaseHandler.resolve()
+    await mutation.isPersisted.promise
+    await collection._sync.loadSubset({})
+
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(onUpdate).toHaveBeenCalledOnce()
+    expect(superseded).toBe(true)
+    expect(publications).toContainEqual([initial.id, sibling.id, orphaned.id])
+    expect({
+      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+      synced: itemIds(collection._state.syncedData.values()),
+      source: itemIds(collection.toArray),
+    }).toEqual({
+      cache: [initial.id, sibling.id],
+      synced: [initial.id, sibling.id],
+      source: [initial.id, sibling.id],
+    })
+    expect(
+      persistedOwners(collection._state.syncedMetadata, orphaned.id),
+    ).toEqual([])
+  })
+
+  it(`retains ownership after a publication listener throws`, async () => {
+    const id = `failed-result-publication`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const sibling = { id: `b`, category: `result`, name: `B` }
+    const transient = { id: `c`, category: `result`, name: `C` }
+    const publicationError = new Error(`Publication failed`)
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([initial, sibling]))
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => item.id,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      consoleError.mockRestore()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.stateWhenReady()
+    let threw = false
+    const subscription = collection.subscribeChanges(() => {
+      if (!threw && collection.has(transient.id)) {
+        threw = true
+        throw publicationError
+      }
+    })
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+
+    queryClient.setQueryData(queryKey, [initial, sibling, transient])
+    await vi.waitFor(() => expect(threw).toBe(true))
+    queryClient.setQueryData(queryKey, [initial, sibling])
+    await collection._sync.loadSubset({})
+
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect({
+      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+      synced: itemIds(collection._state.syncedData.values()),
+      source: itemIds(collection.toArray),
+    }).toEqual({
+      cache: [initial.id, sibling.id],
+      synced: [initial.id, sibling.id],
+      source: [initial.id, sibling.id],
+    })
+    expect(
+      persistedOwners(collection._state.syncedMetadata, transient.id),
+    ).toEqual([])
+  })
+
+  it(`reports a reentrant initial replacement failure before readiness`, async () => {
+    const id = `failed-initial-result-replacement`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const invalid = { id: `invalid`, category: `result`, name: `Invalid` }
+    const applicationError = new Error(`Replacement application failed`)
+    const firstResult = createDeferred<Array<Item>>()
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => firstResult.promise)
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => {
+          if (item.id === invalid.id) throw applicationError
+          return item.id
+        },
+        startSync: false,
+      }),
+    )
+    cleanups.push(async () => {
+      firstResult.resolve([initial])
+      consoleError.mockRestore()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    collection.startSyncImmediate()
+    expect(collection.status).toBe(`loading`)
+    let replaced = false
+    const subscription = collection.subscribeChanges(() => {
+      if (!replaced && collection.has(initial.id)) {
+        replaced = true
+        queryClient.setQueryData(queryKey, [invalid])
+      }
+    })
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+
+    firstResult.resolve([initial])
+    await vi.waitFor(() => expect(collection.status).toBe(`error`))
+
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(replaced).toBe(true)
+    expect(reportedError(collection)).toBe(applicationError)
+    expect(itemIds(collection.toArray)).toEqual([initial.id])
+  })
+
+  it(`releases provisional ownership when commit fails before publication`, async () => {
+    const id = `failed-prepublication-commit`
+    const detailSubset = { where: eq(new IR.PropRef([`category`]), `detail`) }
+    const listSubset = { where: eq(new IR.PropRef([`category`]), `list`) }
+    const detailKey = [id, getLoadSubsetDemandKey(detailSubset)] as const
+    const detail = { id: `a`, category: `detail`, name: `A` }
+    const list = { id: `c`, category: `list`, name: `C` }
+    const commitError = new Error(`Commit failed before publication`)
+    const queryClient = createQueryClient()
+    const queryFn = vi
+      .fn<() => Promise<Array<Item>>>()
+      .mockResolvedValueOnce([detail])
+      .mockResolvedValueOnce([list])
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const baseOptions = queryCollectionOptions<Item>({
+      id,
+      queryClient,
+      queryKey: [id],
+      queryFn,
+      getKey: (item) => item.id,
+      syncMode: `on-demand`,
+      startSync: true,
+    })
+    const originalSync = baseOptions.sync
+    let failNextCommit = false
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        sync: (params: Parameters<typeof originalSync.sync>[0]) =>
+          originalSync.sync({
+            ...params,
+            commit: (signal) => {
+              if (failNextCommit) {
+                failNextCommit = false
+                throw commitError
+              }
+              return params.commit(signal)
+            },
+          }),
+      },
+    })
+    cleanups.push(async () => {
+      collection._sync.unloadSubset(detailSubset)
+      collection._sync.unloadSubset(listSubset)
+      consoleError.mockRestore()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset(detailSubset)
+    expect(itemIds(collection.toArray)).toEqual([detail.id])
+
+    failNextCommit = true
+    queryClient.setQueryData(detailKey, [detail, list])
+    await vi.waitFor(() => expect(reportedError(collection)).toBe(commitError))
+    expect(itemIds(collection.toArray)).toEqual([detail.id])
+
+    await collection._sync.loadSubset(listSubset)
+    expect(itemIds(collection.toArray)).toEqual([detail.id, list.id])
+    collection._sync.unloadSubset(listSubset)
+    await vi.waitFor(() =>
+      expect(itemIds(collection.toArray)).toEqual([detail.id]),
+    )
+  })
+
+  it(`retires a publishing result when its final subset unloads`, async () => {
+    const id = `reentrant-result-unload`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const sibling = { id: `b`, category: `result`, name: `B` }
+    const updated = { ...initial, name: `A from server` }
+    const orphaned = { id: `c`, category: `result`, name: `C` }
+    const handlerEntered = createDeferred<void>()
+    const releaseHandler = createDeferred<void>()
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([initial, sibling]))
+    const onUpdate = vi.fn(async () => {
+      handlerEntered.resolve()
+      await releaseHandler.promise
+      return { refetch: false }
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        onUpdate,
+      }),
+    )
+    cleanups.push(async () => {
+      releaseHandler.resolve()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    let unloaded = false
+    const subscription = collection.subscribeChanges(() => {
+      if (!unloaded && collection.has(orphaned.id)) {
+        unloaded = true
+        collection._sync.unloadSubset({})
+      }
+    })
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+
+    const mutation = collection.update(initial.id, (draft) => {
+      draft.name = `A optimistic`
+    })
+    await handlerEntered.promise
+    queryClient.setQueryData(queryKey, [updated, sibling, orphaned])
+    expect(itemIds(collection._state.syncedData.values())).toEqual([
+      initial.id,
+      sibling.id,
+    ])
+
+    releaseHandler.resolve()
+    await mutation.isPersisted.promise
+    await vi.waitFor(() => expect(unloaded).toBe(true))
+    await vi.waitFor(() => {
+      expect({
+        synced: itemIds(collection._state.syncedData.values()),
+        source: itemIds(collection.toArray),
+      }).toEqual({ synced: [], source: [] })
+    })
+
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(onUpdate).toHaveBeenCalledOnce()
+    expect(
+      persistedOwners(collection._state.syncedMetadata, orphaned.id),
+    ).toEqual([])
+  })
+
+  /**
+   * Releasing and then reacquiring one demand creates a new active claim. An
+   * older release may publish later, but it cannot erase that newer claim. The
+   * independent model removes the first claim, adds the second, and leaves the
+   * shared row until the second release. The unrelated blocker only delays
+   * publication.
+   */
+  it(`keeps a reacquired claim across an older release publication`, async () => {
+    const id = `reacquired-claim-old-release`
+    const detail = categorySubset(`detail`)
+    const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
+    const persistence = createDeferred<void>()
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [[shared]],
+      staleTime: Number.POSITIVE_INFINITY,
+    })
+    const mutation = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+
+    await collection._sync.loadSubset(detail)
+    mutation.mutate(() => collection.insert(blocker))
+    cleanups.push(async () => {
+      persistence.resolve()
+      await mutation.isPersisted.promise.catch(() => undefined)
+    })
+
+    const pendingBefore = collection._state.pendingSyncedTransactions.length
+    collection._sync.unloadSubset(detail)
+    await vi.waitFor(() =>
+      expect(
+        collection._state.pendingSyncedTransactions.length,
+      ).toBeGreaterThan(pendingBefore),
+    )
+    const pendingAfterRelease =
+      collection._state.pendingSyncedTransactions.length
+    const reacquired = Promise.resolve(collection._sync.loadSubset(detail))
+    void reacquired.catch(() => undefined)
+    await vi.waitFor(() =>
+      expect(
+        collection._state.pendingSyncedTransactions.length,
+      ).toBeGreaterThan(pendingAfterRelease),
+    )
+
+    persistence.resolve()
+    await mutation.isPersisted.promise
+    await reacquired
+    await vi.waitFor(() => expect(rows(collection)).toEqual([shared.id]))
+
+    collection._sync.unloadSubset(detail)
+    await vi.waitFor(() => expect(rows(collection)).toEqual([]))
+    expect(queryFn).toHaveBeenCalledOnce()
+  })
+
+  /**
+   * ## A reacquired lease's cached rows receive accepted direct writes
+   *
+   * Law: in on-demand mode, an accepted direct write patches the cached rows
+   * of each active Query in its Collection that may still apply them. A Query
+   * whose lease has not yet applied a result may hold the written key, so it
+   * is patched; only a resolved scope that does not own the key may be
+   * skipped. The patched cache keeps a later replay of that cached result
+   * from presenting the pre-write value as a server result.
+   *
+   * Authority: the opening direct-write law of this file. A released lease's
+   * empty ownership entry, kept while its release is held, does not resolve a
+   * later lease of the same Query.
+   *
+   * Reference: one row whose server value is Shared, then an accepted Manual
+   * upsert. The model expects the public row and the reacquired Query's cache
+   * to show Manual.
+   *
+   * History: hold publication behind an optimistic blocker, release the
+   * demand, raise a refresh barrier (`deferDataRefresh`, as offline
+   * transactions do while they replay), and reacquire. The barrier keeps the
+   * cached result unapplied. The acquisition's own fetch fails, so Query
+   * keeps its cached data and is idle when the upsert arrives. The checkpoint
+   * is after publication and the barrier both end. Public rows alone cannot
+   * distinguish the skip: the upsert keeps the row either way. The Query
+   * cache, read through `QueryClient.getQueriesData`, does.
+   */
+  it(`patches a reacquired lease's cached rows while its result waits`, async () => {
+    const id = `reacquired-lease-direct-patch`
+    const detail = categorySubset(`detail`)
+    const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
+    const persistence = createDeferred<void>()
+    const barrier = createDeferred<void>()
+    const { collection, queryClient, queryFn } = createOwnershipFixture({
+      id,
+      results: [[shared]],
+    })
+    const mutation = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+    const settleTurn = async () => {
+      for (let turn = 0; turn < 3; turn++)
+        await new Promise<void>((resolve) => setTimeout(resolve, 0))
+    }
+    cleanups.push(async () => {
+      collection.deferDataRefresh = null
+      barrier.resolve()
+      persistence.resolve()
+      await mutation.isPersisted.promise.catch(() => undefined)
+    })
+
+    await collection._sync.loadSubset(detail)
+    mutation.mutate(() => collection.insert(blocker))
+    collection._sync.unloadSubset(detail)
+    await settleTurn()
+    collection.deferDataRefresh = barrier.promise
+    const reacquired = Promise.resolve(collection._sync.loadSubset(detail))
+    void reacquired.catch(() => undefined)
+    await settleTurn()
+    const write = Promise.resolve(
+      collection.utils.writeUpsert({ ...shared, name: `Manual` }),
+    )
+    void write.catch(() => undefined)
+    await settleTurn()
+
+    persistence.resolve()
+    await mutation.isPersisted.promise
+    collection.deferDataRefresh = null
+    barrier.resolve()
+    await reacquired.catch(() => undefined)
+    await write
+    await settleTurn()
+
+    expect({
+      row: collection.get(shared.id)?.name,
+      cache: queryClient
+        .getQueriesData<Array<Item>>({ queryKey: [id] })
+        .flatMap(([, data]) => data ?? [])
+        .map((item) => item.name),
+      queryCalls: queryFn.mock.calls.length,
+    }).toEqual({ row: `Manual`, cache: [`Manual`], queryCalls: 2 })
+  })
+
+  /**
+   * ## A release whose durable commit fails is terminal for its sync run
+   *
+   * Law: a release is complete only when its commit is durable. If that
+   * commit fails, the Collection reports the failure and enters `error`; the
+   * released row stays public and stored, because the deletion never became
+   * durable. A later acquisition in that run rejects with the same failure
+   * instead of reading ownership the failed release left behind. Cleanup ends
+   * the run; a restarted run starts with no ownership from the old run, so
+   * its acquisition and release behave as in a fresh Collection.
+   *
+   * Authority: the Code Weight and Fail-Fast rules in AGENTS.md (a
+   * contradictory collaborator signal rejects at the boundary instead of
+   * recovering), the persisted direct-write receipt law in this file's opening
+   * prose, and the glossary's cleanup definition (it ends the sync run and its
+   * resources).
+   *
+   * Reference: the model owns one row through one demand. A failed release
+   * is a local persistence failure, so it crashes the Collection and leaves
+   * `{ rows: [shared], stored: [shared], status: crashed }`; a restarted
+   * load and release give `[shared]` and then `{ rows: [], stored: [] }`. The
+   * `durable` history is the control: the release succeeds and the restarted
+   * run never refetches, because no demand remains.
+   *
+   * Limits: one on-demand row, no persisted retention (`persistedGcTime: 0`,
+   * since retention intentionally keeps released rows), a controlled adapter
+   * whose next commit throws, and a public `cleanup()` then `preload()`
+   * restart. A failed commit that a host retries is outside this witness.
+   */
+  it.each([`durable`, `failed`, `failed-then-reacquired`] as const)(
+    `keeps a released row and fails loudly when its release commit fails (%s)`,
+    async (history) => {
+      const id = `release-commit-${history}`
+      const storage = createOwnershipStorage()
+      const queryClient = createQueryClient()
+      const queryFn = vi.fn(() => Promise.resolve([shared]))
+      let failNextCommit = false
+      const applyCommittedTx = storage.adapter.applyCommittedTx
+      storage.adapter.applyCommittedTx = (...args) => {
+        if (!failNextCommit) return applyCommittedTx(...args)
+        failNextCommit = false
+        return Promise.reject(new Error(`storage failed`))
+      }
+      const collection = createCollection(
+        persistedCollectionOptions<
+          Item,
+          string | number,
+          never,
+          QueryCollectionUtils<Item, string | number, Item, unknown>
+        >({
+          ...queryCollectionOptions<Item>({
+            id,
+            queryClient,
+            queryKey: [id],
+            queryFn,
+            getKey: (item) => item.id,
+            syncMode: `on-demand`,
+            persistedGcTime: 0,
+            startSync: true,
+          }),
+          persistence: { adapter: storage.adapter },
+        }),
+      )
+      cleanups.push(async () => {
+        await collection.cleanup().catch(() => undefined)
+        queryClient.clear()
+      })
+      const settleTurn = async () => {
+        for (let turn = 0; turn < 3; turn++)
+          await new Promise<void>((resolve) => setTimeout(resolve, 0))
+      }
+      const observe = () => ({
+        rows: rows(collection),
+        stored: storedItems(storage).map((item) => item.id),
+        status: collection.status,
+      })
+      const detail = categorySubset(`detail`)
+
+      await collection._sync.loadSubset(detail)
+      failNextCommit = history !== `durable`
+      collection._sync.unloadSubset(detail)
+      await settleTurn()
+      const afterRelease = observe()
+
+      let reacquisition: string | undefined
+      if (history === `failed-then-reacquired`) {
+        reacquisition = await Promise.resolve(
+          collection._sync.loadSubset(detail),
+        ).then(
+          () => `fulfilled`,
+          (error: unknown) =>
+            error instanceof Error ? error.message : String(error),
+        )
+      }
+
+      await collection.cleanup()
+      await collection.preload()
+      await collection._sync.loadSubset(detail)
+      const restartedLoad = rows(collection)
+      collection._sync.unloadSubset(detail)
+      await settleTurn()
+
+      const failed = history !== `durable`
+      expect({
+        afterRelease,
+        reacquisition,
+        restartedLoad,
+        restartedRelease: observe(),
+        queryCalls: queryFn.mock.calls.length,
+      }).toEqual({
+        afterRelease: failed
+          ? { rows: [shared.id], stored: [shared.id], status: `crashed` }
+          : { rows: [], stored: [], status: `ready` },
+        reacquisition:
+          history === `failed-then-reacquired`
+            ? `Failed to durably persist collection "${id}": storage failed`
+            : undefined,
+        restartedLoad: [shared.id],
+        restartedRelease: { rows: [], stored: [], status: `ready` },
+        queryCalls: failed ? 2 : 1,
+      })
+    },
+  )
+
+  /**
+   * The same fail-loud law covers a reacquired lease whose own durable commit
+   * fails. The release's commit is held at the persistence boundary while the
+   * Query is reacquired; the reacquired application's commit then fails. The
+   * release is durable, so the row leaves; the reacquired result never became
+   * durable, so it cannot keep the row. The persistence failure crashes the
+   * Collection, the
+   * acquisition rejects with the persistence failure, and a restart serves and
+   * releases the row normally. A history that keeps the row public after the
+   * failure would report a result that storage never accepted.
+   */
+  it(`fails loudly when a reacquired lease's commit fails after a held release`, async () => {
+    const id = `reacquired-commit-fails`
+    const storage = createOwnershipStorage(undefined, 2)
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([shared]))
+    let commits = 0
+    const applyCommittedTx = storage.adapter.applyCommittedTx
+    storage.adapter.applyCommittedTx = (...args) => {
+      // Commit 1 loads the row, 2 is the held release, 3 is the reacquisition.
+      if (++commits === 3) return Promise.reject(new Error(`storage failed`))
+      return applyCommittedTx(...args)
+    }
+    const collection = createCollection(
+      persistedCollectionOptions<
+        Item,
+        string | number,
+        never,
+        QueryCollectionUtils<Item, string | number, Item, unknown>
+      >({
+        ...queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => item.id,
+          syncMode: `on-demand`,
+          persistedGcTime: 0,
+          startSync: true,
+        }),
+        persistence: { adapter: storage.adapter },
+      }),
+    )
+    cleanups.push(async () => {
+      storage.release()
+      await collection.cleanup().catch(() => undefined)
+      queryClient.clear()
+    })
+    const settleTurn = async () => {
+      for (let turn = 0; turn < 3; turn++)
+        await new Promise<void>((resolve) => setTimeout(resolve, 0))
+    }
+    const detail = categorySubset(`detail`)
+
+    await collection._sync.loadSubset(detail)
+    collection._sync.unloadSubset(detail)
+    await storage.entered
+    const reacquisition = Promise.resolve(
+      collection._sync.loadSubset(detail),
+    ).then(
+      () => `fulfilled`,
+      (error: unknown) =>
+        error instanceof Error ? error.message : String(error),
+    )
+    await settleTurn()
+    const held = { rows: rows(collection), status: collection.status }
+
+    storage.release()
+    const reacquired = await reacquisition
+    await settleTurn()
+    const failed = { rows: rows(collection), status: collection.status }
+
+    await collection.cleanup()
+    await collection.preload()
+    await collection._sync.loadSubset(detail)
+    const restartedLoad = rows(collection)
+    collection._sync.unloadSubset(detail)
+    await settleTurn()
+
+    expect({
+      held,
+      reacquired,
+      failed,
+      restartedLoad,
+      restartedRelease: {
+        rows: rows(collection),
+        stored: storedItems(storage).map((item) => item.id),
+      },
+    }).toEqual({
+      held: { rows: [shared.id], status: `ready` },
+      reacquired: `Failed to durably persist collection "${id}": storage failed`,
+      failed: { rows: [], status: `crashed` },
+      restartedLoad: [shared.id],
+      restartedRelease: { rows: [], stored: [] },
+    })
+  })
+
+  /**
+   * Accepted Query results update ownership in acceptance order even while
+   * publication is held. The independent model stores each active Query's
+   * latest complete result and exposes their union: after the detail and list
+   * results become empty, the peer still exposes the row; after the peer is
+   * released, the union is empty. Published metadata remains stale until the
+   * hold ends, so it cannot be the model's source of truth.
+   */
+  it(`composes accepted owner retirements ahead of stale metadata`, async () => {
+    const id = `accepted-owner-retirements`
+    const detail = categorySubset(`detail`)
+    const list = categorySubset(`list`)
+    const peer: LoadSubsetOptions = {
+      where: new IR.Func(`in`, [
+        new IR.PropRef([`category`]),
+        new IR.Value([`shared`, `peer`]),
+      ]),
+    }
+    const blocker = { id: `blocker`, category: `local`, name: `Blocker` }
+    const persistence = createDeferred<void>()
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [[shared], [shared], [shared], [], [], [shared]],
+    })
+    const mutation = createTransaction({
+      mutationFn: () => persistence.promise,
+    })
+
+    await collection._sync.loadSubset(detail)
+    await collection._sync.loadSubset(list)
+    await collection._sync.loadSubset(peer)
+
+    mutation.mutate(() => collection.insert(blocker))
+    cleanups.push(async () => {
+      persistence.resolve()
+      await mutation.isPersisted.promise.catch(() => undefined)
+    })
+    expect(mutation.state).toBe(`persisting`)
+
+    const pendingBefore = collection._state.pendingSyncedTransactions.length
+    const refetch = collection.utils.refetch()
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(6))
+    await vi.waitFor(() =>
+      expect(
+        collection._state.pendingSyncedTransactions.length,
+      ).toBeGreaterThanOrEqual(pendingBefore + 2),
+    )
+
+    persistence.resolve()
+    await mutation.isPersisted.promise
+    await refetch
+    await vi.waitFor(() => expect(rows(collection)).toEqual([shared.id]))
+
+    collection._sync.unloadSubset(peer)
+    await vi.waitFor(() => expect(rows(collection)).toEqual([]))
+    expect(queryFn).toHaveBeenCalledTimes(6)
+  })
+
+  // Law: once a result's sync transaction is accepted, the rows it owns stay
+  // owned when a later result supersedes it. The later result diffs against
+  // that ownership, so a row only the superseded result added is deleted, and
+  // a later empty result deletes the rest. Model: the owned rows after each
+  // result are exactly that result's rows. Checkpoint: visible and stored rows
+  // after each refetch settles.
+  // Law: once a result's sync transaction is accepted, the rows it owns stay
+  // owned when a later result supersedes it, whether durable storage or a
+  // persisting mutation holds it. The later result diffs against that
+  // ownership, so a row only the superseded result added is deleted, and a
+  // later empty result deletes the rest. Model: the owned rows after each
+  // result are exactly that result's rows. Checkpoint: visible and stored rows
+  // after each refetch settles. Before this law, every supersession test held
+  // durable storage, where the result's core transaction had already applied,
+  // so restoring the old ownership was a no-op and no test observed it.
+  it.each([`storage`, `mutation`] as const)(
+    `keeps an accepted superseded result's ownership for the next diff when %s holds it`,
+    async (holder) => {
+      const id = `superseded-accepted-ownership-${holder}`
+      const row = (key: string): Item => ({
+        id: key,
+        category: `result`,
+        name: key.toUpperCase(),
+      })
+      let server: Array<Item> = [row(`a`)]
+      const storage = createOwnershipStorage()
+      const apply = storage.adapter.applyCommittedTx.bind(storage.adapter)
+      let holdStorage = false
+      const entered = createDeferred<void>()
+      const released = createDeferred<void>()
+      storage.adapter.applyCommittedTx = async (...args) => {
+        if (holdStorage && args[1].mutations.length > 0) {
+          holdStorage = false
+          entered.resolve()
+          await released.promise
+        }
+        return apply(...args)
+      }
+      const queryClient = createQueryClient()
+      const options = queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn: () => Promise.resolve(structuredClone(server)),
+        getKey: (item) => item.id,
+        startSync: true,
+      })
+      const collection = createCollection(
+        holder === `storage`
+          ? persistedCollectionOptions<
+              Item,
+              string | number,
+              never,
+              QueryCollectionUtils<Item, string | number, Item, unknown>
+            >({ ...options, persistence: { adapter: storage.adapter } })
+          : options,
+      )
+      const mutation = createTransaction({
+        mutationFn: () => released.promise,
+      })
+      cleanups.push(async () => {
+        released.resolve()
+        if (holder === `mutation`)
+          await mutation.isPersisted.promise.catch(() => undefined)
+        try {
+          await collection.cleanup()
+        } finally {
+          queryClient.clear()
+        }
+      })
+      const observe = () => ({
+        visible: [...collection.keys()].filter((key) => key !== `local`).sort(),
+        stored:
+          holder === `storage`
+            ? storedItems(storage).map((item) => item.id)
+            : [...collection._state.syncedData.keys()].sort(),
+      })
+
+      await collection.preload()
+      expect(observe()).toEqual({ visible: [`a`], stored: [`a`] })
+
+      // The first result is accepted and held before it can be stored or
+      // published; a second result supersedes it.
+      server = [row(`b`), row(`c`)]
+      if (holder === `storage`) holdStorage = true
+      else
+        mutation.mutate(() =>
+          collection.insert({ id: `local`, category: `local`, name: `L` }),
+        )
+      const first = collection.utils.refetch()
+      if (holder === `storage`) await entered.promise
+      else
+        await vi.waitFor(() =>
+          expect(
+            collection._state.pendingSyncedTransactions.length,
+          ).toBeGreaterThan(0),
+        )
+      const queuedAfterFirst =
+        collection._state.pendingSyncedTransactions.length
+      server = [row(`b`)]
+      const second = collection.utils.refetch()
+      if (holder === `mutation`)
+        await vi.waitFor(() =>
+          expect(
+            collection._state.pendingSyncedTransactions.length,
+          ).toBeGreaterThan(queuedAfterFirst),
+        )
+      released.resolve()
+      await Promise.all([first, second])
+      if (holder === `mutation`)
+        await mutation.isPersisted.promise.catch(() => undefined)
+      await vi.waitFor(() =>
+        expect(observe()).toEqual({ visible: [`b`], stored: [`b`] }),
+      )
+
+      server = []
+      await collection.utils.refetch()
+      await vi.waitFor(() =>
+        expect(observe()).toEqual({ visible: [], stored: [] }),
+      )
+    },
+  )
+
+  /**
+   * A fetched result can finish before its persisted baseline scan. Its
+   * source rows retain their fetch-start position while that application is
+   * queued. The reference overlays a later accepted direct write on those
+   * rows, even if the scan returns that newly written row. Check public rows
+   * when initial readiness settles, after the held scan is released.
+   */
+  it(`keeps a direct write made after fetch completion but before application`, async () => {
+    const id = `queued-older-result-direct-write`
+    const queryHash = hashKey([id])
+    const older = { ...shared, name: `Older fetch` }
+    const manual = { ...shared, name: `Manual` }
+    const persistedScan =
+      createDeferred<
+        Array<{ key: string | number; value: Item; metadata?: unknown }>
+      >()
+    const scanPersistedRows = vi.fn(() => persistedScan.promise)
+    const { collection, queryClient, queryFn } = createOwnershipFixture({
+      id,
+      syncMode: `eager`,
+      results: [[older]],
+      scanPersistedRows,
+      setupMetadata: (metadata) => {
+        metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+          queryHash,
+          mode: `until-revalidated`,
+        })
+      },
+    })
+    cleanups.push(() => {
+      persistedScan.resolve([])
+      return Promise.resolve()
+    })
+
+    const ready = collection.stateWhenReady()
+    await vi.waitFor(() => {
+      expect(queryFn).toHaveBeenCalledOnce()
+      expect(scanPersistedRows).toHaveBeenCalledOnce()
+    })
+    await collection.utils.writeInsert(manual)
+    expect(collection.get(manual.id)?.name).toBe(`Manual`)
+    persistedScan.resolve([
+      {
+        key: manual.id,
+        value: manual,
+        metadata: { queryCollection: { owners: { [queryHash]: true } } },
+      },
+    ])
+    await ready
+    expect(collection.get(manual.id)?.name).toBe(`Manual`)
+
+    // The accepted result is settled. An unrelated Query state notification
+    // must not re-enter its older-result merge and patch the cache again.
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    let stateNotifications = 0
+    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
+      if (
+        event.type === `updated` &&
+        event.query === query &&
+        event.action.type === `setState`
+      )
+        stateNotifications++
+    })
+    try {
+      query.setState({ isInvalidated: true })
+      for (let turn = 0; turn < 20; turn++) await Promise.resolve()
+      expect(stateNotifications).toBe(1)
+      expect(query.state.isInvalidated).toBe(true)
+    } finally {
+      unsubscribe()
+    }
+  })
+
+  it(`settles a direct write only after its persisted commit applies`, async () => {
+    const id = `persisted-direct-write-receipt`
+    const storage = createOwnershipStorage(undefined, 2)
+    const { collection } = createPersistedOwnershipFixture(
+      id,
+      storage,
+      [shared],
+      `eager`,
+    )
+    await collection.stateWhenReady()
+
+    let receipt: `pending` | `fulfilled` | `rejected` = `pending`
+    const write = collection.utils.writeUpdate({ ...shared, name: `Updated` })
+    void write.then(
+      () => (receipt = `fulfilled`),
+      () => (receipt = `rejected`),
+    )
+    const observe = () => ({
+      receipt,
+      storedName: storage.snapshot().rows.get(shared.id)?.name,
+    })
+
+    await storage.entered
+    await Promise.resolve()
+    expect(observe()).toEqual(expectedDirectWriteReceipt(false))
+
+    storage.release()
+    await write
+    expect(observe()).toEqual(expectedDirectWriteReceipt(true))
+    expect(collection.get(shared.id)?.name).toBe(`Updated`)
+  })
+
+  /**
+   * A Query refetch may begin while a direct write waits for its persisted
+   * commit. Starting that request repeats the old cached success to observers,
+   * but no new provider row has arrived. The independent reference has three
+   * row states in order: the first fetched Server row, the accepted Manual
+   * write, and the later fetched Newer row. The old cached row cannot become
+   * authoritative again at refetch start.
+   *
+   * The legal history holds the direct commit, starts a real QueryClient
+   * refetch whose provider response is also held, then releases the commit.
+   * At the write receipt, while the response is still held, compare public
+   * and durable rows with Manual. After the provider responds, compare both
+   * with Newer. These two cuts reject a design that treats a fetch-start
+   * observer notification as a fresh result without forbidding a later
+   * physical result from replacing the direct write.
+   */
+  it.each([`eager`, `on-demand`] as const)(
+    `keeps an accepted persisted %s write through a refetch start until its result arrives`,
+    async (syncMode) => {
+      const id = `persisted-direct-write-refetch-start-${syncMode}`
+      const storage = createOwnershipStorage(undefined, 2)
+      const queryClient = createQueryClient()
+      const newer = { ...shared, name: `Newer` }
+      const manual = { ...shared, name: `Manual` }
+      const heldResult = createDeferred<Array<Item>>()
+      const requestStarted = createDeferred<void>()
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([shared])
+        .mockImplementationOnce(() => {
+          requestStarted.resolve()
+          return heldResult.promise
+        })
+      const collection = createCollection(
+        persistedCollectionOptions<
+          Item,
+          string | number,
+          never,
+          QueryCollectionUtils<Item, string | number, Item, unknown>
+        >({
+          ...queryCollectionOptions<Item>({
+            id,
+            queryClient,
+            queryKey: [id],
+            queryFn,
+            getKey: (item) => item.id,
+            syncMode,
+            persistedGcTime: Number.POSITIVE_INFINITY,
+            startSync: true,
+          }),
+          persistence: { adapter: storage.adapter },
+        }),
+      )
+      cleanups.push(async () => {
+        storage.release()
+        heldResult.resolve([newer])
+        await collection.cleanup()
+        queryClient.clear()
+      })
+
+      if (syncMode === `eager`) await collection.stateWhenReady()
+      else await collection._sync.loadSubset({})
+      expect(collection.get(shared.id)?.name).toBe(shared.name)
+      expect(storedItems(storage)[0]?.name).toBe(shared.name)
+
+      const write = collection.utils.writeUpdate(manual)
+      await storage.entered
+      const refetch = queryClient.refetchQueries({ queryKey: [id] })
+      void refetch.catch(() => undefined)
+      await requestStarted.promise
+      expect(queryFn).toHaveBeenCalledTimes(2)
+
+      storage.release()
+      await write
+      expect({
+        public: collection.get(shared.id)?.name,
+        durable: storedItems(storage)[0]?.name,
+      }).toEqual({ public: manual.name, durable: manual.name })
+
+      heldResult.resolve([newer])
+      await refetch
+      expect({
+        public: collection.get(shared.id)?.name,
+        durable: storedItems(storage)[0]?.name,
+      }).toEqual({ public: newer.name, durable: newer.name })
+    },
+  )
+
+  /**
+   * The same law holds when the Query's current result is empty. An empty
+   * result is a resolved scope that owns no rows; it is not an unapplied
+   * result. The reference sequence is the first fetched result (no rows), the
+   * accepted Manual insert, and the later fetched Newer row. Starting the
+   * refetch repeats the empty cached success; it cannot remove the direct row
+   * or claim it.
+   *
+   * This sibling exists because the reacquisition table above makes a
+   * released lease's empty ownership entry distinguishable from an applied
+   * one. A repair that instead treats every empty ownership entry as
+   * unapplied passes that table and the non-empty history above. Here it
+   * replays the empty cached result at refetch start: in on-demand mode the
+   * insert disappears at its own receipt, and in eager mode the later Newer
+   * result does not replace Manual. The checkpoints and holds match the
+   * history above.
+   */
+  it.each([`eager`, `on-demand`] as const)(
+    `keeps an accepted persisted %s insert through a refetch start of an empty result`,
+    async (syncMode) => {
+      const id = `persisted-direct-insert-empty-refetch-start-${syncMode}`
+      const storage = createOwnershipStorage(undefined, 2)
+      const queryClient = createQueryClient()
+      const newer = { ...shared, name: `Newer` }
+      const manual = { ...shared, name: `Manual` }
+      const heldResult = createDeferred<Array<Item>>()
+      const requestStarted = createDeferred<void>()
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([])
+        .mockImplementationOnce(() => {
+          requestStarted.resolve()
+          return heldResult.promise
+        })
+      const collection = createCollection(
+        persistedCollectionOptions<
+          Item,
+          string | number,
+          never,
+          QueryCollectionUtils<Item, string | number, Item, unknown>
+        >({
+          ...queryCollectionOptions<Item>({
+            id,
+            queryClient,
+            queryKey: [id],
+            queryFn,
+            getKey: (item) => item.id,
+            syncMode,
+            persistedGcTime: Number.POSITIVE_INFINITY,
+            startSync: true,
+          }),
+          persistence: { adapter: storage.adapter },
+        }),
+      )
+      cleanups.push(async () => {
+        storage.release()
+        heldResult.resolve([newer])
+        await collection.cleanup()
+        queryClient.clear()
+      })
+      const observe = () => ({
+        public: collection.get(shared.id)?.name ?? null,
+        durable: storedItems(storage)[0]?.name ?? null,
+      })
+
+      if (syncMode === `eager`) await collection.stateWhenReady()
+      else await collection._sync.loadSubset({})
+      expect(observe()).toEqual({ public: null, durable: null })
+
+      const write = collection.utils.writeInsert(manual)
+      await storage.entered
+      const refetch = queryClient.refetchQueries({ queryKey: [id] })
+      void refetch.catch(() => undefined)
+      await requestStarted.promise
+      expect(queryFn).toHaveBeenCalledTimes(2)
+
+      storage.release()
+      await write
+      expect(observe()).toEqual({ public: manual.name, durable: manual.name })
+
+      heldResult.resolve([newer])
+      await refetch
+      expect(observe()).toEqual({ public: newer.name, durable: newer.name })
+    },
+  )
+
+  it(`rejects writes from an invalidated sync run and admits writes after restart`, async () => {
+    const id = `direct-write-cleanup-admission`
+    const storage = createOwnershipStorage()
+    const { collection } = createPersistedOwnershipFixture(
+      id,
+      storage,
+      [shared],
+      `eager`,
+    )
+    await collection.stateWhenReady()
+
+    const observe = async (write: () => Promise<void>) => {
+      try {
+        await write()
+        return `fulfilled` as const
+      } catch (error) {
+        expect(error).toBeInstanceOf(SyncNotInitializedError)
+        return `rejected` as const
+      }
+    }
+
+    const before = { ...shared, name: `Before cleanup` }
+    expect(await observe(() => collection.utils.writeUpdate(before))).toBe(
+      expectedDirectWriteAdmission(`current`),
+    )
+    expect(storage.snapshot().rows.get(shared.id)?.name).toBe(before.name)
+
+    const cleanup = collection.cleanup()
+    const late = { id: `late`, category: `direct`, name: `Late` }
+    const lateWrites = [
+      () => collection.utils.writeInsert(late),
+      () => collection.utils.writeUpdate({ ...shared, name: `Late update` }),
+      () => collection.utils.writeDelete(shared.id),
+      () => collection.utils.writeUpsert(late),
+      () =>
+        collection.utils.writeBatch(() => collection.utils.writeInsert(late)),
+    ]
+    for (const write of lateWrites) {
+      expect(await observe(write)).toBe(
+        expectedDirectWriteAdmission(`invalidated`),
+      )
+    }
+    await cleanup
+    expect(storage.snapshot().rows.has(late.id)).toBe(false)
+    expect(storage.snapshot().rows.get(shared.id)?.name).toBe(before.name)
+
+    const subscription = collection.subscribeChanges(() => {})
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+    await collection.stateWhenReady()
+    const restarted = {
+      id: `restarted`,
+      category: `direct`,
+      name: `Restarted`,
+    }
+    expect(await observe(() => collection.utils.writeInsert(restarted))).toBe(
+      expectedDirectWriteAdmission(`current`),
+    )
+    expect(storage.snapshot().rows.get(restarted.id)).toEqual(restarted)
+  })
+
+  it(`retains post-publication ownership through durable persistence`, async () => {
+    const id = `persisted-post-application-unload`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const sibling = { id: `b`, category: `result`, name: `B` }
+    const transient = { id: `c`, category: `result`, name: `C` }
+    const storage = createOwnershipStorage(undefined, 2)
+    const { collection, queryClient, queryFn } =
+      createPersistedOwnershipFixture(id, storage, [initial, sibling])
+    const createDerived = () =>
+      createLiveQueryCollection((query) =>
+        query.from({ item: collection }).select(({ item }) => ({ ...item })),
+      )
+    const firstDerived = createDerived()
+    let secondDerived: ReturnType<typeof createDerived> | undefined
+
+    try {
+      await firstDerived.preload()
+      expect(queryFn).toHaveBeenCalledOnce()
+      expect(itemIds(storage.snapshot().rows.values())).toEqual([
+        initial.id,
+        sibling.id,
+      ])
+
+      queryClient.setQueryData(queryKey, [initial, sibling, transient])
+      await storage.entered
+      expect({
+        synced: itemIds(collection._state.syncedData.values()),
+        derived: itemIds(firstDerived.toArray),
+        stored: itemIds(storage.snapshot().rows.values()),
+      }).toEqual({
+        synced: [initial.id, sibling.id, transient.id],
+        derived: [initial.id, sibling.id, transient.id],
+        stored: [initial.id, sibling.id],
+      })
+
+      await firstDerived.cleanup()
+      storage.release()
+      await vi.waitFor(() =>
+        expect(itemIds(storage.snapshot().rows.values())).toEqual([
+          initial.id,
+          sibling.id,
+          transient.id,
+        ]),
+      )
+
+      queryClient.removeQueries({ queryKey, exact: true })
+      secondDerived = createDerived()
+      await secondDerived.preload()
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+      await vi.waitFor(() => {
+        expect({
+          synced: itemIds(collection._state.syncedData.values()),
+          source: itemIds(collection.toArray),
+          derived: itemIds(secondDerived?.toArray ?? []),
+          stored: itemIds(storage.snapshot().rows.values()),
+        }).toEqual({
+          synced: [initial.id, sibling.id],
+          source: [initial.id, sibling.id],
+          derived: [initial.id, sibling.id],
+          stored: [initial.id, sibling.id],
+        })
+      })
+      expect(
+        persistedOwners(storage.snapshot().rowMetadata, transient.id),
+      ).toEqual([])
+    } finally {
+      storage.release()
+      await secondDerived?.cleanup()
+      if (firstDerived.status !== `cleaned-up`) await firstDerived.cleanup()
+    }
+  })
+
+  it(`keeps only the newest cache result when publication reenters application`, async () => {
+    const id = `reentrant-result-application`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const outer = { id: `b`, category: `result`, name: `B` }
+    const inner = { id: `c`, category: `result`, name: `C` }
+    const queryClient = createQueryClient()
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn: () => Promise.resolve([initial]),
+        getKey: (item) => item.id,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.stateWhenReady()
+    const publications: Array<Array<string>> = []
+    let injected = false
+    const subscription = collection.subscribeChanges(() => {
+      const ids = itemIds(collection.toArray)
+      publications.push(ids)
+      if (!injected && ids.includes(outer.id)) {
+        injected = true
+        queryClient.setQueryData(queryKey, [inner])
+      }
+    })
+    cleanups.push(async () => subscription.unsubscribe())
+
+    queryClient.setQueryData(queryKey, [outer])
+    await vi.waitFor(() => expect(itemIds(collection.toArray)).toEqual([`c`]))
+
+    expect(publications).toEqual([[`b`], [`c`]])
+    queryClient.setQueryData(queryKey, [])
+    await vi.waitFor(() => expect(collection.toArray).toEqual([]))
+  })
+
+  it(`retains a reentrant newer application failure for subset settlement`, async () => {
+    const id = `reentrant-result-failure`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `result`, name: `A` }
+    const outer = { id: `b`, category: `result`, name: `B` }
+    const invalid = { id: `invalid`, category: `result`, name: `Invalid` }
+    const applicationError = new Error(`newest result application failed`)
+    const queryClient = createQueryClient()
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn: () => Promise.resolve([initial]),
+        getKey: (item) => {
+          if (item.id === invalid.id) throw applicationError
+          return item.id
+        },
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      consoleError.mockRestore()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    let injected = false
+    let pendingWaiter: Promise<void> | undefined
+    const subscription = collection.subscribeChanges(() => {
+      if (!injected && collection.has(outer.id)) {
+        injected = true
+        queryClient.setQueryData(queryKey, [invalid])
+        pendingWaiter = expect(
+          Promise.resolve(collection._sync.loadSubset({})),
+        ).rejects.toBe(applicationError)
+        void pendingWaiter.catch(() => {})
+      }
+    })
+    cleanups.push(async () => subscription.unsubscribe())
+
+    queryClient.setQueryData(queryKey, [outer])
+    await vi.waitFor(() => expect(reportedError(collection)).toBeDefined())
+    await pendingWaiter
+    await expect(Promise.resolve(collection._sync.loadSubset({}))).rejects.toBe(
+      applicationError,
+    )
+  })
+
+  it(`retires mutation ownership when a later cache result is empty`, async () => {
+    const id = `mutation-ownership-replacement`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `mutation`, name: `A` }
+    const inserted = { id: `b`, category: `mutation`, name: `B` }
+    const serverRows = [initial]
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(serverRows)))
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (item) => item.id,
+        startSync: true,
+        onInsert: ({ transaction }) => {
+          serverRows.push(
+            ...transaction.mutations.map(({ modified }) =>
+              structuredClone(modified),
+            ),
+          )
+          return Promise.resolve()
+        },
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.stateWhenReady()
+    const mutation = collection.insert(inserted)
+    await mutation.isPersisted.promise
+    expect({
+      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+      synced: itemIds(collection._state.syncedData.values()),
+      source: itemIds(collection.toArray),
+    }).toEqual({ cache: [`a`, `b`], synced: [`a`, `b`], source: [`a`, `b`] })
+
+    queryClient.setQueryData(queryKey, [])
+    await vi.waitFor(() => {
+      expect({
+        cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+        synced: itemIds(collection._state.syncedData.values()),
+        source: itemIds(collection.toArray),
+      }).toEqual({ cache: [], synced: [], source: [] })
+    })
+  })
+
+  it(`publishes an authoritative delete after its mutation refetch`, async () => {
+    const id = `mutation-delete-publication`
+    const queryKey = [id] as const
+    const initial = { id: `a`, category: `mutation`, name: `A` }
+    const serverRows = [initial]
+    const queryClient = createQueryClient()
+    const preexistingRefetchResult = createDeferred<Array<Item>>()
+    const mutationRefetchResult = createDeferred<Array<Item>>()
+    const persistenceGate = createDeferred<void>()
+    const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
+    const commitRequests: Array<{
+      writes: Array<string>
+      receipt: `immediate` | `pending`
+      outcome?: `applied` | `aborted` | `rejected`
+    }> = []
+    const queryFn = vi
+      .fn<() => Promise<Array<Item>>>()
+      .mockResolvedValueOnce(structuredClone(serverRows))
+      .mockReturnValueOnce(preexistingRefetchResult.promise)
+      .mockReturnValueOnce(mutationRefetchResult.promise)
+    const baseOptions = queryCollectionOptions<Item>({
+      id,
+      queryClient,
+      queryKey,
+      queryFn,
+      getKey: (item) => item.id,
+      startSync: true,
+      onDelete: async ({ transaction }) => {
+        await persistenceGate.promise
+        const deleted = new Set(
+          transaction.mutations.map(({ original }) => original.id),
+        )
+        serverRows.splice(
+          0,
+          serverRows.length,
+          ...serverRows.filter(({ id: rowId }) => !deleted.has(rowId)),
+        )
+      },
+    })
+    const originalSync = baseOptions.sync
+    const collection = createCollection({
+      ...baseOptions,
+      sync: {
+        sync: (params: Parameters<typeof originalSync.sync>[0]) => {
+          let writes: Array<string> = []
+          return originalSync.sync({
+            ...params,
+            metadata: recordMetadata(params.metadata!, metadata),
+            begin: () => {
+              writes = []
+              return params.begin()
+            },
+            write: (change) => {
+              writes.push(change.type)
+              params.write(change)
+            },
+            commit: (signal) => {
+              const result = params.commit(signal)
+              const request: (typeof commitRequests)[number] = {
+                writes: [...writes],
+                receipt: result === true ? `immediate` : `pending`,
+              }
+              commitRequests.push(request)
+              if (result === true) {
+                request.outcome = `applied`
+              } else {
+                void result.then(
+                  () => {
+                    request.outcome = `applied`
+                  },
+                  (error) => {
+                    request.outcome = isCancelledError(error)
+                      ? `aborted`
+                      : `rejected`
+                  },
+                )
+              }
+              return result
+            },
+          })
+        },
+      },
+    })
+    const derived = createLiveQueryCollection((query) =>
+      query.from({ item: collection }).select(({ item }) => ({
+        id: item.id,
+        category: item.category,
+        name: item.name,
+      })),
+    )
+    const capture = (): MutationLifecycleSnapshot => ({
+      server: itemIds(serverRows),
+      cache: itemIds(queryClient.getQueryData<Array<Item>>(queryKey) ?? []),
+      synced: itemIds(collection._state.syncedData.values()),
+      source: itemIds(collection.toArray),
+      derived: itemIds(derived.toArray),
+    })
+    const publications: Array<MutationLifecycleSnapshot> = []
+    const subscription = derived.subscribeChanges(() => {
+      publications.push(capture())
+    })
+    cleanups.push(async () => {
+      persistenceGate.resolve()
+      preexistingRefetchResult.resolve([])
+      mutationRefetchResult.resolve([])
+      subscription.unsubscribe()
+      await derived.cleanup()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await derived.preload()
+    expectMutationLifecycleSnapshot(
+      capture(),
+      [initial.id],
+      [initial.id],
+      false,
+    )
+
+    const preexistingRefetch = collection.utils.refetch({ throwOnError: true })
+    void preexistingRefetch.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+
+    const mutation = collection.delete(initial.id)
+    expect(itemIds(collection.toArray)).toEqual([])
+    expect(itemIds(derived.toArray)).toEqual([])
+
+    persistenceGate.resolve()
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    mutationRefetchResult.resolve([])
+    await mutation.isPersisted.promise
+
+    expect(queryFn).toHaveBeenCalledTimes(3)
+    expect(commitRequests.some(({ writes }) => writes.includes(`delete`))).toBe(
+      true,
+    )
+    expect(commitRequests.some(({ receipt }) => receipt === `pending`)).toBe(
+      true,
+    )
+    expect(metadata.writes).toContainEqual({ type: `delete`, key: initial.id })
+    await vi.waitFor(() =>
+      expect(commitRequests.every(({ outcome }) => outcome !== undefined)).toBe(
+        true,
+      ),
+    )
+    expectMutationLifecycleSnapshot(capture(), [], [], false)
+    expect(publications.at(-1)?.source).toEqual([])
+    expect(publications.at(-1)?.derived).toEqual([])
+  })
+
+  it(`keeps cached rows until the final exact acquisition is released`, async () => {
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `shared-acquisition`,
+      results: [[shared, detailOnly]],
+    })
+    const subset = { where: categoryIn(`shared`, `detail`) }
+
+    await collection._sync.loadSubset(subset)
+    await collection._sync.loadSubset(subset)
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
+
+    collection._sync.unloadSubset(subset)
+    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
+    collection._sync.unloadSubset(subset)
+    expect(rows(collection)).toEqual([])
+
+    await collection._sync.loadSubset(subset)
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
+  })
+
+  it(`removes only rows whose final query owner is released`, async () => {
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `overlapping-acquisitions`,
+      results: [
+        [shared, detailOnly],
+        [shared, listOnly],
+      ],
+    })
+    const detail = { where: categoryIn(`shared`, `detail`) }
+    const list = { where: categoryIn(`shared`, `list`) }
+
+    await collection._sync.loadSubset(detail)
+    await collection._sync.loadSubset(list)
+    expect(rows(collection)).toEqual([detailOnly.id, listOnly.id, shared.id])
+
+    collection._sync.unloadSubset(detail)
+    expect(rows(collection)).toEqual([listOnly.id, shared.id])
+    await collection._sync.loadSubset(detail)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(rows(collection)).toEqual([detailOnly.id, listOnly.id, shared.id])
+
+    collection._sync.unloadSubset(list)
+    expect(rows(collection)).toEqual([detailOnly.id, shared.id])
+  })
+
+  it.each([`remount`, `refetch`] as const)(
+    `keeps eager rows idle after cache removal and recovers on %s`,
+    async (action) => {
+      const id = `eager-lifetime-owner`
+      const { collection, queryClient, queryFn } = createOwnershipFixture({
+        id,
+        syncMode: `eager`,
+        results: [[shared], [{ ...shared, name: `Refetched` }]],
+      })
+      await collection.stateWhenReady()
+      const subscription = collection.subscribeChanges(() => {})
+      subscription.unsubscribe()
+
+      queryClient.removeQueries({ queryKey: [id], exact: true })
+
+      expect(rows(collection)).toEqual([shared.id])
+      await Promise.resolve()
+      expect(queryFn).toHaveBeenCalledOnce()
+
+      const remounted =
+        action === `remount` ? collection.subscribeChanges(() => {}) : undefined
+      if (action === `refetch`) await collection.utils.refetch()
+      await vi.waitFor(() => {
+        expect(queryFn).toHaveBeenCalledTimes(2)
+        expect(collection.get(shared.id)?.name).toBe(`Refetched`)
+      })
+      remounted?.unsubscribe()
+    },
+  )
+
+  // Request data is reusable; each invocation still creates its own owner.
+  // Cross startup with reference reuse and partial retirement, not only the
+  // already-started observer path tested above.
+  it.each(
+    [2, 3].flatMap((owners) =>
+      [false, true].flatMap((sharedReference) =>
+        [0, 1, owners].map((retired) => ({
+          owners,
+          sharedReference,
+          retired,
+        })),
+      ),
+    ),
+  )(
+    `preserves startup ownership for $owners calls, shared reference $sharedReference, $retired retired`,
+    async ({ owners, sharedReference, retired }) => {
+      const id = `startup-owner-history`
+      const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+      const queryHash = hashKey([id, getLoadSubsetDemandKey(subset)])
+      const { collection, queryFn } = createOwnershipFixture({
+        id,
+        results: [[shared]],
+        setupMetadata: (metadata) =>
+          metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+            queryHash,
+            mode: `until-revalidated`,
+          }),
+      })
+      collection.startSyncImmediate()
+      const requests = Array.from({ length: owners }, () =>
+        sharedReference ? subset : { ...subset },
+      )
+      const results = Promise.allSettled(
+        requests.map((request) => collection._sync.loadSubset(request)),
+      )
+      for (const request of requests.slice(0, retired)) {
+        collection._sync.unloadSubset(request)
+      }
+      const outcomes = await results
+      const live = owners - retired
+      expect(
+        outcomes.filter((outcome) => outcome.status === `fulfilled`),
+      ).toHaveLength(live)
+      const failures = outcomes.filter(
+        (outcome) => outcome.status === `rejected`,
+      )
+      expect(failures).toHaveLength(retired)
+      for (const failure of failures) {
+        expect(failure.reason).toMatchObject({ name: `AbortError` })
+      }
+      expect(queryFn).toHaveBeenCalledTimes(live > 0 ? 1 : 0)
+      const observedRows = () =>
+        collection.toArray.map(({ id: rowId, category, name }) => ({
+          id: rowId,
+          category,
+          name,
+        }))
+      expect(observedRows()).toEqual(live > 0 ? [shared] : [])
+      for (let index = retired; index < owners; index++) {
+        collection._sync.unloadSubset(requests[index]!)
+        expect(observedRows()).toEqual(index + 1 < owners ? [shared] : [])
+      }
+    },
+  )
+
+  it.each([false, true])(
+    `replaces an active eager cache entry with custom hash %s`,
+    async (customHash) => {
+      const id = `active-eager-custom-hash-${customHash}`
+      const { collection, queryClient, queryFn } = createOwnershipFixture({
+        id,
+        customHash,
+        syncMode: `eager`,
+        results: [[shared], [{ ...shared, name: `Replaced` }]],
+      })
+      await collection.stateWhenReady()
+      const subscription = collection.subscribeChanges(() => {})
+      try {
+        queryClient.removeQueries({ queryKey: [id], exact: true })
+        for (let turn = 0; turn < 20; turn++) await Promise.resolve()
+        expect(queryFn).toHaveBeenCalledTimes(2)
+        expect(collection.get(shared.id)?.name).toBe(`Replaced`)
+      } finally {
+        subscription.unsubscribe()
+      }
+    },
+  )
+
+  it.each(
+    [false, true].flatMap((mounted) =>
+      [false, true].flatMap((customHash) =>
+        [false, true].map((rejectOld) => ({ mounted, customHash, rejectOld })),
+      ),
+    ),
+  )(
+    `replaces a removed pending eager refetch without reviving idle demand: %j`,
+    async ({ mounted, customHash, rejectOld }) => {
+      const old = createDeferred<Array<Item>>()
+      const next = createDeferred<Array<Item>>()
+      const id = `pending-eager-removal`
+      const { collection, queryClient, queryFn } = createOwnershipFixture({
+        id,
+        customHash,
+        syncMode: `eager`,
+        results: [[shared], old.promise, next.promise],
+      })
+      await collection.stateWhenReady()
+      let subscription = collection.subscribeChanges(() => {})
+      if (!mounted) subscription.unsubscribe()
+      let settled = false
+      const refetch = collection.utils.refetch({ throwOnError: true }).then(
+        () => {
+          settled = true
+        },
+        (error: unknown) => {
+          settled = true
+          return error
+        },
+      )
+      try {
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+        queryClient.removeQueries({ queryKey: [id], exact: true })
+        for (let turn = 0; turn < 30; turn++) await Promise.resolve()
+        expect(queryFn).toHaveBeenCalledTimes(mounted ? 3 : 2)
+        expect(collection.get(shared.id)?.name).toBe(`Shared`)
+        if (!mounted) subscription = collection.subscribeChanges(() => {})
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+        next.resolve([{ ...shared, name: `Current` }])
+        await vi.waitFor(() =>
+          expect(collection.get(shared.id)?.name).toBe(`Current`),
+        )
+        if (rejectOld) old.reject(new Error(`retired request failed`))
+        else old.resolve([{ ...shared, name: `Obsolete` }])
+        await vi.waitFor(() => expect(settled).toBe(true))
+        expect(isCancelledError(await refetch)).toBe(true)
+        expect(collection.get(shared.id)?.name).toBe(`Current`)
+        expect(queryFn).toHaveBeenCalledTimes(3)
+        expect(collection.status).toBe(`ready`)
+      } finally {
+        old.resolve([shared])
+        next.resolve([shared])
+        subscription.unsubscribe()
+      }
+    },
+  )
+
+  it.each(
+    [0, Number.POSITIVE_INFINITY].flatMap((staleTime) =>
+      [false, true].map((customHash) => ({ staleTime, customHash })),
+    ),
+  )(
+    `starts only the requested fetch for an idle eager observer: %j`,
+    async ({ staleTime, customHash }) => {
+      const { collection, queryFn } = createOwnershipFixture({
+        id: `idle-explicit-refetch`,
+        syncMode: `eager`,
+        staleTime,
+        customHash,
+        results: [[shared]],
+      })
+      await collection.stateWhenReady()
+      queryFn.mockResolvedValue([{ ...shared, name: `Refetched` }])
+      const subscription = collection.subscribeChanges(() => {})
+      subscription.unsubscribe()
+      for (let turn = 0; turn < 30; turn++) await Promise.resolve()
+      const before = queryFn.mock.calls.length
+      const [result] = await collection.utils.refetch({ throwOnError: true })
+      expect(queryFn).toHaveBeenCalledTimes(before + 1)
+      expect(collection.subscriberCount).toBe(0)
+      expect((result?.data as Array<Item>)[0]?.name).toBe(`Refetched`)
+      expect(collection.get(shared.id)?.name).toBe(`Refetched`)
+    },
+  )
+
+  it.each([`release`, `cleanup`, `retain`] as const)(
+    `honors %s during startup retention maintenance`,
+    async (action) => {
+      const id = `released-startup-retention`
+      const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+      const key = `queryCollection:gc:${hashKey([id, getLoadSubsetDemandKey(subset)])}`
+      const { collection, queryFn } = createOwnershipFixture({
+        id,
+        results: [[shared]],
+        setupMetadata: (metadata) =>
+          metadata.collection.set(key, {
+            queryHash: hashKey([id, getLoadSubsetDemandKey(subset)]),
+            mode: `until-revalidated`,
+          }),
+      })
+      collection.startSyncImmediate()
+      const result = Promise.resolve(collection._sync.loadSubset(subset)).then(
+        () => `ready`,
+        (error: unknown) => error,
+      )
+      if (action === `release`) collection._sync.unloadSubset(subset)
+      if (action === `cleanup`) await collection.cleanup()
+      for (let turn = 0; turn < 30; turn++) await Promise.resolve()
+      if (action === `retain`) {
+        expect(queryFn).toHaveBeenCalledTimes(1)
+        await expect(result).resolves.toBe(`ready`)
+        expect(collection.size).toBe(1)
+      } else {
+        expect(queryFn).not.toHaveBeenCalled()
+        await expect(result).resolves.toMatchObject({ name: `AbortError` })
+        expect(collection.size).toBe(0)
+      }
+    },
+  )
+
+  it.each([false, true])(
+    `removes owned cache entries on cleanup with custom hash %s`,
+    async (customHash) => {
+      const id = `cleanup-custom-${customHash}`
+      const { collection, queryClient } = createOwnershipFixture({
+        id,
+        customHash,
+        syncMode: `eager`,
+        results: [[shared]],
+      })
+      await collection.stateWhenReady()
+      expect(queryClient.getQueryCache().getAll()).toHaveLength(1)
+      await collection.cleanup()
+      expect(queryClient.getQueryCache().getAll()).toHaveLength(0)
+    },
+  )
+
+  it(`settles an unfinished load when its final owner leaves`, async () => {
+    const pending = createDeferred<Array<Item>>()
+    const { collection } = createOwnershipFixture({
+      id: `release-before-result`,
+      results: [pending.promise],
+    })
+    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+    let outcome: unknown = `pending`
+    const load = Promise.resolve(collection._sync.loadSubset(subset)).then(
+      () => {
+        outcome = `ready`
+      },
+      (error: unknown) => {
+        outcome = error
+      },
+    )
+    try {
+      expect(collection.isLoadingSubset).toBe(true)
+      collection._sync.unloadSubset(subset)
+      for (let turn = 0; turn < 20; turn++) await Promise.resolve()
+      expect(outcome).toMatchObject({ name: `AbortError` })
+      expect(collection.isLoadingSubset).toBe(false)
+      await load
+    } finally {
+      pending.resolve([shared])
+    }
+  })
+
+  it(`keeps active on-demand rows when the Query cache entry departs`, async () => {
+    const id = `active-cache-removal`
+    const { collection, queryClient } = createOwnershipFixture({
+      id,
+      results: [[shared]],
+    })
+    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+    await collection._sync.loadSubset(subset)
+
+    queryClient.removeQueries({ queryKey: [id] })
+    expect(rows(collection)).toEqual([shared.id])
+
+    collection._sync.unloadSubset(subset)
+    expect(rows(collection)).toEqual([])
+  })
+
+  it(`keeps an inactive scoped cache isolated from another scope's manual write`, async () => {
+    const id = `inactive-scoped-cache-isolation`
+    const queryClient = createQueryClient()
+    const sourceRows = new Map<string, Item>([
+      [`1`, { id: `1`, category: `A`, name: `Category A` }],
+      [`2`, { id: `2`, category: `B`, name: `Category B` }],
+    ])
+    const expectedByCategory = new Map<string, Array<string>>()
+    const providerCalls: Array<string> = []
+    let manualWrites = 0
+    let remountReached = false
+    let comparisonCount = 0
+
+    const recomputeCategory = (category: string): Array<string> =>
+      Array.from(sourceRows.values())
+        .filter((row) => row.category === category)
+        .map((row) => row.id)
+        .sort()
+
+    expectedByCategory.set(`A`, recomputeCategory(`A`))
+    expectedByCategory.set(`B`, recomputeCategory(`B`))
+
+    const queryFn = vi.fn((context: QueryFunctionContext) => {
+      const where = context.meta?.loadSubsetOptions?.where
+      const operands = where?.type === `func` ? where.args : []
+      const categoryRef = operands.find(
+        (operand) =>
+          operand.type === `ref` &&
+          operand.path.length === 1 &&
+          operand.path[0] === `category`,
+      )
+      const categoryValue = operands.find(
+        (operand) =>
+          operand.type === `val` && typeof operand.value === `string`,
+      )
+      if (
+        where?.type !== `func` ||
+        where.name !== `eq` ||
+        operands.length !== 2 ||
+        categoryRef?.type !== `ref` ||
+        categoryValue?.type !== `val` ||
+        typeof categoryValue.value !== `string`
+      ) {
+        throw new Error(`Category fixture received an unsupported request`)
+      }
+
+      const category = categoryValue.value
+      providerCalls.push(category)
+      return Promise.resolve(
+        Array.from(sourceRows.values(), (row) => structuredClone(row)).filter(
+          (row) => row.category === category,
+        ),
+      )
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const createCategoryQuery = (category: string) =>
+      createLiveQueryCollection({
+        query: (query) =>
+          query
+            .from({ item: collection })
+            .where(({ item }) => eq(item.category, category)),
+      })
+
+    type CategoryQuery = ReturnType<typeof createCategoryQuery>
+    let inactiveCategoryA: CategoryQuery | undefined
+    let activeCategoryB: CategoryQuery | undefined
+    let remountedCategoryA: CategoryQuery | undefined
+
+    try {
+      inactiveCategoryA = createCategoryQuery(`A`)
+      await inactiveCategoryA.preload()
+      expect(rows(inactiveCategoryA)).toEqual(expectedByCategory.get(`A`))
+      await inactiveCategoryA.cleanup()
+      inactiveCategoryA = undefined
+
+      activeCategoryB = createCategoryQuery(`B`)
+      await activeCategoryB.preload()
+      expect(rows(activeCategoryB)).toEqual(expectedByCategory.get(`B`))
+
+      const added = { id: `3`, category: `B`, name: `New category B` }
+      sourceRows.set(added.id, structuredClone(added))
+      expectedByCategory.set(`B`, recomputeCategory(`B`))
+      manualWrites++
+      collection.utils.writeUpsert(structuredClone(added))
+      const cacheEntriesAfterManualWrite = queryClient
+        .getQueryCache()
+        .findAll({ queryKey: [id] }).length
+
+      remountedCategoryA = createCategoryQuery(`A`)
+      await remountedCategoryA.preload()
+      remountReached = true
+
+      expect(providerCalls.slice(0, 2)).toEqual([`A`, `B`])
+      expect(manualWrites).toBe(1)
+      expect(remountReached).toBe(true)
+      comparisonCount++
+      expect(rows(remountedCategoryA)).toEqual(expectedByCategory.get(`A`))
+      expect(comparisonCount).toBe(1)
+      expect(cacheEntriesAfterManualWrite).toBe(1)
+      expect(providerCalls.filter((category) => category === `A`)).toHaveLength(
+        2,
+      )
+    } finally {
+      await remountedCategoryA?.cleanup()
+      await activeCategoryB?.cleanup()
+      await inactiveCategoryA?.cleanup()
+    }
+  })
+
+  /**
+   * A direct insert changes the Collection independently of Query result
+   * ownership. The previous direct-write contract permits this surgical
+   * change even though the adapter cannot infer a subset owner for the row.
+   * In this legal history, the fetched row belongs to one loaded subset and
+   * the direct row belongs to no subset. The independent expected-key set
+   * removes only the fetched row when that subset unloads. The production
+   * driver uses the public write utilities and a real QueryClient; after the
+   * accepted write, unload, and explicit delete, compare public Collection
+   * keys and provider calls. This does not promise a bounded lifetime for an
+   * unowned direct row that the caller never deletes.
+   */
+  it(`keeps a direct insert after its queried subset unloads`, async () => {
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `direct-insert-without-query-owner`,
+      results: [[shared]],
+    })
+    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+    const inserted = { id: `direct`, category: `shared`, name: `Direct` }
+    const expectedKeys = new Set([shared.id])
+
+    await collection._sync.loadSubset(subset)
+    await collection.utils.writeInsert(inserted)
+    expectedKeys.add(inserted.id)
+    expect(rows(collection)).toEqual([...expectedKeys].sort())
+
+    collection._sync.unloadSubset(subset)
+    expectedKeys.delete(shared.id)
+    expect(rows(collection)).toEqual([...expectedKeys].sort())
+    expect(queryFn).toHaveBeenCalledOnce()
+
+    await collection.utils.writeDelete(inserted.id)
+    expectedKeys.delete(inserted.id)
+    expect(rows(collection)).toEqual([...expectedKeys].sort())
+  })
+
+  /**
+   * An explicit complete scoped result settles a directly inserted row in its
+   * scope. The independent reference first accepts the surgical insert, then
+   * replaces that scope with the empty server result at refetch settlement.
+   * Ordinary subset unload above is distinct: it supplies no new server fact.
+   */
+  it(`removes an ownerless on-demand insert after an empty explicit refetch`, async () => {
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `on-demand-direct-insert-empty-refetch`,
+      results: [[], []],
+    })
+    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+    await collection._sync.loadSubset(subset)
+    await collection.utils.writeInsert(shared)
+    expect(rows(collection)).toEqual([shared.id])
+
+    await collection.utils.refetch({ throwOnError: true })
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(rows(collection)).toEqual([])
+  })
+
+  /**
+   * The reference treats only a successful, complete result for a row's
+   * predicate as evidence that an omitted direct row is gone. A disjoint
+   * predicate, a limited/offset/cursor window, and a failed request provide
+   * no such fact.
+   * Nonempty omission rejects an implementation that recognizes only empty
+   * results. Each history compares public rows at refetch settlement.
+   */
+  it.each([
+    {
+      history: `complete-nonempty`,
+      category: `shared`,
+      window: {},
+      removes: true,
+    },
+    { history: `disjoint`, category: `other`, window: {}, removes: false },
+    {
+      history: `limited`,
+      category: `shared`,
+      window: { limit: 1 },
+      removes: false,
+    },
+    {
+      history: `offset`,
+      category: `shared`,
+      window: { offset: 1 },
+      removes: false,
+    },
+    {
+      history: `cursor`,
+      category: `shared`,
+      window: {
+        cursor: {
+          whereFrom: eq(new IR.PropRef([`id`]), `other`),
+          whereCurrent: eq(new IR.PropRef([`id`]), `other`),
+          lastKey: `other`,
+        },
+      },
+      removes: false,
+    },
+  ] as const)(
+    `reconciles an ownerless direct row after a $history refetch`,
+    async ({ history, category, window, removes }) => {
+      const other = { id: `other`, category, name: `Other` }
+      const { collection, queryFn } = createOwnershipFixture({
+        id: `ownerless-refetch-${history}`,
+        results: [[], [other]],
+      })
+      const subset = {
+        where: eq(new IR.PropRef([`category`]), category),
+        ...window,
+      }
+      await collection._sync.loadSubset(subset)
+      await collection.utils.writeInsert(shared)
+      await collection.utils.refetch({ throwOnError: true })
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(rows(collection)).toEqual(
+        removes ? [other.id] : [other.id, shared.id],
+      )
+    },
+  )
+
+  /**
+   * An empty provider response is not evidence of global absence. The
+   * reference keeps an ownerless direct row when the complete predicate is
+   * disjoint or the request covers only a window. The provider has no server
+   * rows, so each empty response is a legal result for its request. Compare
+   * public keys when the explicit refetch has applied.
+   */
+  it.each([
+    {
+      history: `disjoint-empty`,
+      where: eq(new IR.PropRef([`category`]), `other`),
+      window: {},
+    },
+    {
+      history: `offset-empty`,
+      where: eq(new IR.PropRef([`category`]), `shared`),
+      window: { offset: 1 },
+    },
+    {
+      history: `cursor-empty`,
+      where: eq(new IR.PropRef([`category`]), `shared`),
+      window: {
+        cursor: {
+          whereFrom: eq(new IR.PropRef([`id`]), `other`),
+          whereCurrent: eq(new IR.PropRef([`id`]), `other`),
+          lastKey: `other`,
+        },
+      },
+    },
+  ] as const)(
+    `keeps an ownerless direct row after a $history refetch`,
+    async ({ history, where, window }) => {
+      const { collection, queryFn } = createOwnershipFixture({
+        id: `ownerless-${history}`,
+        results: [[], []],
+      })
+      const subset = { where, ...window }
+      await collection._sync.loadSubset(subset)
+      await collection.utils.writeInsert(shared)
+      await collection.utils.refetch({ throwOnError: true })
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(rows(collection)).toEqual([shared.id])
+    },
+  )
+
+  /**
+   * A compound predicate remains a scope boundary. The independent rule
+   * evaluates both conjuncts on the accepted direct row before deciding
+   * whether a complete empty result can retire it.
+   */
+  it.each([
+    { history: `matching`, id: shared.id, removes: true },
+    { history: `disjoint`, id: `other`, removes: false },
+  ] as const)(
+    `reconciles a direct row after a $history compound-scope refetch`,
+    async ({ history, id, removes }) => {
+      const { collection, queryFn } = createOwnershipFixture({
+        id: `ownerless-compound-${history}`,
+        results: [[], []],
+      })
+      const subset = {
+        where: new IR.Func(`and`, [
+          eq(new IR.PropRef([`category`]), `shared`),
+          eq(new IR.PropRef([`id`]), id),
+        ]),
+      }
+      await collection._sync.loadSubset(subset)
+      await collection.utils.writeInsert(shared)
+      await collection.utils.refetch({ throwOnError: true })
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(rows(collection)).toEqual(removes ? [] : [shared.id])
+    },
+  )
+
+  /** A failed response provides no complete scope and cannot retire a row. */
+  it(`keeps an ownerless direct row when explicit refetch fails`, async () => {
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `ownerless-failed-refetch`,
+      results: [[]],
+    })
+    const subset = { where: eq(new IR.PropRef([`category`]), `shared`) }
+    await collection._sync.loadSubset(subset)
+    await collection.utils.writeInsert(shared)
+    queryFn.mockRejectedValueOnce(new Error(`source unavailable`))
+    await expect(
+      collection.utils.refetch({ throwOnError: true }),
+    ).rejects.toThrow(`source unavailable`)
+    expect(rows(collection)).toEqual([shared.id])
+  })
+
+  /**
+   * An eager refetch is a complete source snapshot. A direct insert changes
+   * the public row set without fetching, but a later explicit refetch with an
+   * empty server result removes that key. The independent reference replaces
+   * its full row set with the returned snapshot at refetch settlement. This
+   * crosses the public write/refetch path and compares both rows and requests.
+   */
+  it(`reconciles an eager direct insert against a later empty refetch`, async () => {
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `eager-direct-insert-refetch`,
+      results: [[], []],
+      syncMode: `eager`,
+    })
+    await collection.preload()
+    expect(rows(collection)).toEqual([])
+    await collection.utils.writeInsert(shared)
+    expect(rows(collection)).toEqual([shared.id])
+    await collection.utils.refetch()
+    expect(rows(collection)).toEqual([])
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * A direct eager insert need not inherit the prior fetched result's owner.
+   * The next complete provider snapshot can claim that same key and replace
+   * its value; a following empty snapshot removes it. The independent eager
+   * reference replaces its full row set at each explicit refetch settlement.
+   */
+  it(`claims and later removes an eager direct insert through server snapshots`, async () => {
+    const server = { ...shared, name: `Server` }
+    const { collection, queryFn } = createOwnershipFixture({
+      id: `eager-direct-insert-later-claim`,
+      results: [[], [server], []],
+      syncMode: `eager`,
+    })
+    await collection.preload()
+    await collection.utils.writeInsert({ ...shared, name: `Direct` })
+    expect(collection.get(shared.id)?.name).toBe(`Direct`)
+    await collection.utils.refetch()
+    expect(collection.get(shared.id)?.name).toBe(`Server`)
+    await collection.utils.refetch()
+    expect(collection.has(shared.id)).toBe(false)
+    expect(queryFn).toHaveBeenCalledTimes(3)
+  })
+
+  /**
+   * A direct update preserves both subset claims in durable metadata. A fresh
+   * Collection over those stored rows can retire one claim after an empty
+   * result without losing the peer's row, then retire the final claim and the
+   * row. The reference is the authored set of two demand identities; each
+   * empty result removes only its own identity. Cloning the durable snapshot
+   * represents a new process without asking cleanup to retire the old run's
+   * active demands. Compare exact stored owners and public rows after each
+   * revalidation, not just their cardinality.
+   */
+  it(`retires overlapping persisted owners after a direct update and restart`, async () => {
+    const id = `direct-update-overlap-persisted-restart`
+    const first = categorySubset(`detail`)
+    const second = categorySubset(`list`)
+    const firstHash = hashKey([id, getLoadSubsetDemandKey(first)])
+    const secondHash = hashKey([id, getLoadSubsetDemandKey(second)])
+    const hotStorage = createOwnershipStorage()
+    const hot = createPersistedOwnershipFixture(id, hotStorage, [shared])
+
+    await hot.collection._sync.loadSubset(first)
+    await hot.collection._sync.loadSubset(second)
+    await hot.collection.utils.writeUpdate({ id: shared.id, name: `Updated` })
+    const durable = hotStorage.snapshot()
+    expect(durable.rows.get(shared.id)?.name).toBe(`Updated`)
+    expect(persistedOwners(durable.rowMetadata, shared.id)).toEqual(
+      [firstHash, secondHash].sort(),
+    )
+
+    const coldStorage = createOwnershipStorage(durable)
+    const cold = createPersistedOwnershipFixture(id, coldStorage, [])
+    await cold.collection._sync.loadSubset(first)
+    expect(cold.collection.get(shared.id)?.name).toBe(`Updated`)
+    expect(
+      persistedOwners(coldStorage.snapshot().rowMetadata, shared.id),
+    ).toEqual([secondHash])
+
+    await cold.collection._sync.loadSubset(second)
+    expect(cold.collection.has(shared.id)).toBe(false)
+    const settled = coldStorage.snapshot()
+    expect(settled.rows.has(shared.id)).toBe(false)
+    expect(persistedOwners(settled.rowMetadata, shared.id)).toEqual([])
+    expect(hot.queryFn).toHaveBeenCalledTimes(2)
+    expect(cold.queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * SQLite is the receiving boundary for the row-lifetime rule. A fetched
+   * lifetime ends at direct deletion; reinserting the key creates a durable
+   * unowned row. Releasing both old subset leases and restarting the Collection
+   * must not turn their retired claims into a deletion of that row.
+   */
+  it(`keeps a reinserted direct row across SQLite subset release and restart`, async () => {
+    const id = `direct-row-lifetime-sqlite-restart`
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const persistence = createNodeSQLitePersistence({
+      database: driver.getDatabase(),
+    })
+    const managed = persistence.resolvePersistenceForCollection!({
+      collectionId: id,
+      mode: `sync-present`,
+    })
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([shared]))
+    const makeCollection = (client: QueryClient, source: typeof queryFn) =>
+      createCollection(
+        persistedCollectionOptions<
+          Item,
+          string | number,
+          never,
+          QueryCollectionUtils<Item, string | number, Item, unknown>
+        >({
+          ...queryCollectionOptions<Item>({
+            id,
+            queryClient: client,
+            queryKey: [id],
+            queryFn: source,
+            getKey: (item) => item.id,
+            syncMode: `on-demand`,
+            startSync: true,
+          }),
+          persistence: managed,
+        }),
+      )
+    const collection = makeCollection(queryClient, queryFn)
+    const first = { limit: 1 }
+    const second = { limit: 2 }
+    const replacement = { ...shared, name: `Reinserted` }
+    const restart: {
+      collection?: ReturnType<typeof makeCollection>
+      client?: QueryClient
+    } = {}
+    cleanups.push(async () => {
+      await restart.collection?.cleanup()
+      await collection.cleanup()
+      queryClient.clear()
+      restart.client?.clear()
+      driver.close()
+    })
+
+    await collection._sync.loadSubset(first)
+    await collection._sync.loadSubset(second)
+    await collection.utils.writeDelete(shared.id)
+    await collection.utils.writeInsert(replacement)
+    collection._sync.unloadSubset(first)
+    collection._sync.unloadSubset(second)
+    expect(collection.get(shared.id)?.name).toBe(replacement.name)
+
+    await collection.cleanup()
+    restart.client = createQueryClient()
+    restart.collection = makeCollection(
+      restart.client,
+      vi.fn(() => Promise.resolve([])),
+    )
+    await restart.collection._sync.loadSubset(first)
+    expect(restart.collection.get(shared.id)?.name).toBe(replacement.name)
+  })
+
+  /**
+   * A fresh persisted run no longer has the writer's in-memory position, but
+   * an explicit complete source result still settles an omitted direct row.
+   * The reference has a durable insert followed by an empty complete-scope fetch:
+   * the row exists before that fetch and is absent when it applies. This is
+   * separate from the limited-window restart above, whose omission proves
+   * nothing about a row outside its window. A disjoint durable row remains
+   * stored because the filtered result says nothing about it. Its public
+   * visibility requires acquiring its own on-demand scope after restart.
+   */
+  it(`retires a persisted ownerless row after a complete empty result`, async () => {
+    const id = `persisted-ownerless-complete-result`
+    const disjoint = {
+      id: `persisted-disjoint`,
+      category: `other`,
+      name: `Other`,
+    }
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    const persistence = createNodeSQLitePersistence({
+      database: driver.getDatabase(),
+    })
+    const managed = persistence.resolvePersistenceForCollection!({
+      collectionId: id,
+      mode: `sync-present`,
+    })
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([] as Array<Item>))
+    const makeCollection = (client: QueryClient) =>
+      createCollection(
+        persistedCollectionOptions<
+          Item,
+          string | number,
+          never,
+          QueryCollectionUtils<Item, string | number, Item, unknown>
+        >({
+          ...queryCollectionOptions<Item>({
+            id,
+            queryClient: client,
+            queryKey: [id],
+            queryFn,
+            getKey: (item) => item.id,
+            syncMode: `on-demand`,
+            startSync: true,
+          }),
+          persistence: managed,
+        }),
+      )
+    const first = makeCollection(queryClient)
+    const restart: { collection?: ReturnType<typeof makeCollection> } = {}
+    const secondClient = createQueryClient()
+    cleanups.push(async () => {
+      await restart.collection?.cleanup()
+      await first.cleanup()
+      queryClient.clear()
+      secondClient.clear()
+      driver.close()
+    })
+    await vi.waitFor(() => expect(first.status).toBe(`ready`))
+    await first.utils.writeInsert(shared)
+    await first.utils.writeInsert(disjoint)
+    expect(first.has(shared.id)).toBe(true)
+    expect(first.has(disjoint.id)).toBe(true)
+    await first.cleanup()
+    const claim = await managed.adapter.claimCacheGeneration!(id)
+    try {
+      const durable = await managed.adapter.loadResumeSnapshot({
+        kind: `managed`,
+        storageCollectionId: claim.storageCollectionId,
+        claimId: claim.claimId,
+      })
+      expect(durable.rows.find((row) => row.key === shared.id)?.value).toEqual(
+        shared,
+      )
+      expect(
+        durable.rows.find((row) => row.key === disjoint.id)?.value,
+      ).toEqual(disjoint)
+    } finally {
+      await managed.adapter.releaseCacheGenerationClaim!(claim.claimId)
+    }
+    restart.collection = makeCollection(secondClient)
+    await restart.collection._sync.loadSubset({
+      where: eq(new IR.PropRef([`category`]), `shared`),
+    })
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(restart.collection.has(shared.id)).toBe(false)
+    const settledClaim = await managed.adapter.claimCacheGeneration!(id)
+    try {
+      const durable = await managed.adapter.loadResumeSnapshot({
+        kind: `managed`,
+        storageCollectionId: settledClaim.storageCollectionId,
+        claimId: settledClaim.claimId,
+      })
+      expect(durable.rows.some((row) => row.key === shared.id)).toBe(false)
+      expect(
+        durable.rows.find((row) => row.key === disjoint.id)?.value,
+      ).toEqual(disjoint)
+    } finally {
+      await managed.adapter.releaseCacheGenerationClaim!(settledClaim.claimId)
+    }
+  })
+
+  /**
+   * Direct writes previously promised to change the synced rows without an
+   * automatic Query refetch. The pre-#1826 user guide and QueryCollectionUtils
+   * API comments stated that promise. It lets a caller apply one server event
+   * without requesting every active subset again. A later, independently
+   * scheduled queryFn result may still replace the write.
+   *
+   * The independent reference filters the event-updated rows by category.
+   * The legal history loads ten disjoint live queries, then upserts, updates,
+   * deletes, inserts, and batches rows across their scopes. The production
+   * driver records real queryFn requests. After each accepted write, public
+   * rows must reflect the event and no new provider request may have started
+   * because of the write. This does not promise that direct writes
+   * maintain exact Query cache entries for arbitrary scoped or windowed
+   * requests; the caller controls that lower-level consistency risk.
+   */
+  it(`direct write changes one row without requesting active subsets`, async () => {
+    const id = `scoped-direct-write-work`
+    const queryClient = createQueryClient()
+    const categories = Array.from(
+      { length: 10 },
+      (_, index) => `category-${index}`,
+    )
+    const providerRows = new Map<string, Item>(
+      categories.map((category) => [
+        category,
+        { id: category, category, name: `Before` },
+      ]),
+    )
+    const providerCalls: Array<string> = []
+    const queryFn = vi.fn((context: QueryFunctionContext) => {
+      const where = context.meta?.loadSubsetOptions?.where
+      const category =
+        where?.type === `func`
+          ? where.args.find((arg) => arg.type === `val`)?.value
+          : undefined
+      if (typeof category !== `string`) {
+        throw new Error(`Expected an equality subset with a category`)
+      }
+      providerCalls.push(category)
+      return Promise.resolve(
+        [...providerRows.values()]
+          .filter((row) => row.category === category)
+          .map((row) => structuredClone(row)),
+      )
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    const liveQueries = categories.map((category) =>
+      createLiveQueryCollection({
+        query: (query) =>
+          query
+            .from({ item: collection })
+            .where(({ item }) => eq(item.category, category)),
+      }),
+    )
+    cleanups.push(async () => {
+      await Promise.all(liveQueries.map((query) => query.cleanup()))
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await Promise.all(liveQueries.map((query) => query.preload()))
+    expect(providerCalls).toHaveLength(categories.length)
+
+    const expectDirectWrite = async (write: () => Promise<void>) => {
+      const callsBeforeWrite = providerCalls.length
+      await write()
+      for (const [index, category] of categories.entries()) {
+        const expectedRows = [...providerRows.values()].filter(
+          (row) => row.category === category,
+        )
+        expect(
+          liveQueries[index]!.toArray.map((row) => row.name).sort(),
+        ).toEqual(expectedRows.map((row) => row.name).sort())
+      }
+      expect(providerCalls.slice(callsBeforeWrite)).toEqual([])
+    }
+
+    const changed = {
+      ...providerRows.get(categories[3]!)!,
+      name: `After`,
+    }
+    providerRows.set(changed.id, changed)
+    await expectDirectWrite(() =>
+      collection.utils.writeUpsert(structuredClone(changed)),
+    )
+
+    const updated = { ...changed, name: `Updated` }
+    providerRows.set(updated.id, updated)
+    await expectDirectWrite(() =>
+      collection.utils.writeUpdate({ id: updated.id, name: updated.name }),
+    )
+
+    providerRows.delete(updated.id)
+    await expectDirectWrite(() => collection.utils.writeDelete(updated.id))
+
+    const inserted = {
+      id: `inserted`,
+      category: categories[3]!,
+      name: `Inserted`,
+    }
+    providerRows.set(inserted.id, inserted)
+    await expectDirectWrite(() => collection.utils.writeInsert(inserted))
+
+    const batched = {
+      id: `batched`,
+      category: categories[4]!,
+      name: `Batched`,
+    }
+    const batchUpdated = {
+      ...providerRows.get(categories[4]!)!,
+      name: `Batch updated`,
+    }
+    providerRows.set(batched.id, batched)
+    providerRows.set(batchUpdated.id, batchUpdated)
+    await expectDirectWrite(() =>
+      collection.utils.writeBatch(() => {
+        collection.utils.writeInsert(batched)
+        collection.utils.writeUpdate({
+          id: batchUpdated.id,
+          name: batchUpdated.name,
+        })
+      }),
+    )
+  })
+
+  /**
+   * A direct delete cannot infer the row that fills a limited provider window.
+   * The independent source model slices eleven ordered rows to ten. Deleting
+   * the first row leaves nine cached rows under infinite stale time, even after
+   * reacquisition; an explicit refetch returns the next ten-row source slice.
+   * The public checkpoint is the row set and request count after each load and
+   * after refetch. This documents the lower-level API's exactness boundary.
+   */
+  it(`refills a directly shortened window only after explicit refetch`, async () => {
+    type Row = { id: string; rank: number }
+    const id = `direct-delete-window-refill`
+    const queryClient = createQueryClient()
+    const source = Array.from({ length: 11 }, (_, rank) => ({
+      id: String(rank),
+      rank,
+    }))
+    const queryFn = vi.fn((context: QueryFunctionContext) =>
+      Promise.resolve(
+        source
+          .slice(0, context.meta?.loadSubsetOptions?.limit ?? source.length)
+          .map((row) => ({ ...row })),
+      ),
+    )
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        staleTime: Infinity,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const demand = { limit: 10 }
+    await collection._sync.loadSubset(demand)
+    expect(rows(collection)).toEqual(
+      source
+        .slice(0, 10)
+        .map((row) => row.id)
+        .sort(),
+    )
+    source.shift()
+    await collection.utils.writeDelete(`0`)
+    expect(rows(collection)).toHaveLength(9)
+    collection._sync.unloadSubset(demand)
+    await collection._sync.loadSubset(demand)
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(rows(collection)).toHaveLength(9)
+    await collection.utils.refetch()
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(rows(collection)).toEqual(
+      source
+        .slice(0, 10)
+        .map((row) => row.id)
+        .sort(),
+    )
+  })
+
+  /**
+   * A deferred refresh barrier is legal during offline replay. It delays
+   * application of fetched data, but it does not turn a direct write into a
+   * request. No Query request is in flight in this history, so the independent
+   * reference keeps the accepted event row. The history loads one on-demand
+   * Query, holds the barrier, writes, then releases it. It observes public
+   * rows and real queryFn calls after the accepted write and barrier release;
+   * it does not model the full OfflineExecutor.
+   */
+  it(`does not refetch a direct write after a deferred refresh barrier`, async () => {
+    const id = `deferred-direct-write-no-refetch`
+    const initial = { id: `row`, category: `A`, name: `Before` }
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([structuredClone(initial)]))
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    const barrier = createDeferred<void>()
+    const release = barrier.promise.finally(() => {
+      collection.deferDataRefresh = null
+    })
+    cleanups.push(async () => {
+      barrier.resolve()
+      await release
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    expect(queryFn).toHaveBeenCalledTimes(1)
+    collection.deferDataRefresh = barrier.promise
+    await collection.utils.writeUpdate({ id: initial.id, name: `After` })
+    expect(collection.get(initial.id)?.name).toBe(`After`)
+    expect(queryFn).toHaveBeenCalledTimes(1)
+
+    barrier.resolve()
+    await release
+    for (let turn = 0; turn < 20; turn++) await Promise.resolve()
+    expect(queryFn).toHaveBeenCalledTimes(1)
+    expect(collection.get(initial.id)?.name).toBe(`After`)
+  })
+
+  /**
+   * A directly selected array is a writable part of the Query response.
+   * Unlike a derived projection, replacing this property preserves the
+   * envelope. The authored response predicts both the changed row and the
+   * unchanged metadata after an accepted on-demand direct write.
+   */
+  it(`patches a directly selected on-demand cache array without refetching`, async () => {
+    const id = `direct-select-direct-write`
+    const initial = { id: `row`, category: `A`, name: `Before` }
+    const response = { items: [initial], pageInfo: { hasNextPage: false } }
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
+    const collection = createCollection(
+      queryCollectionOptions({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        select: (value: typeof response) => value.items,
+        getKey: (item: Item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    await collection.utils.writeUpdate({ id: initial.id, name: `After` })
+
+    expect(queryClient.getQueryData([id])).toEqual({
+      items: [{ ...initial, name: `After` }],
+      pageInfo: response.pageInfo,
+    })
+    expect(collection.get(initial.id)?.name).toBe(`After`)
+    expect(queryFn).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * A derived select reads rows from an envelope but gives no inverse for a
+   * direct cache write. The documented edges-to-nodes projection is legal.
+   * A direct write may leave its Query cache row stale, but the cached value
+   * must remain a valid response for select. The response shape is the
+   * independent reference; the driver loads it through a real QueryClient,
+   * then checks the cache, public Collection row, and request count after the
+   * accepted write. This does not require an inverse projection.
+   */
+  it(`keeps a derived selected cache response valid after a direct write`, async () => {
+    const id = `derived-select-direct-write`
+    const initial = { id: `row`, category: `A`, name: `Before` }
+    const response = {
+      edges: [{ cursor: `cursor-1`, node: initial }],
+      pageInfo: { hasNextPage: false },
+    }
+    const select = (value: typeof response) =>
+      value.edges.map((edge) => edge.node)
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
+    const collection = createCollection(
+      queryCollectionOptions({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        select,
+        getKey: (item: Item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    expect(queryClient.getQueryData([id])).toEqual(response)
+    await collection.utils.writeUpdate({ id: initial.id, name: `After` })
+
+    const cached = queryClient.getQueryData<typeof response>([id])!
+    expect(cached.edges).toEqual([
+      expect.objectContaining({
+        cursor: `cursor-1`,
+        node: expect.objectContaining({ id: initial.id }),
+      }),
+    ])
+    expect(select(cached)).toEqual([
+      expect.objectContaining({ id: initial.id }),
+    ])
+    expect(collection.get(initial.id)?.name).toBe(`After`)
+    expect(queryFn).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * A direct write is local to its Collection until a provider result says
+   * otherwise. Two Collections may own one physical Query, but that shared
+   * cache cannot carry A's accepted local row into B. The reference has one
+   * server row and two Collection row sets: writing A changes only A. Compare
+   * both public rows and the shared cache immediately after the write, before
+   * any newer provider result can legitimately update B.
+   */
+  it.each(
+    ([`update`, `delete`, `upsert`] as const).flatMap((operation) =>
+      ([`A-first`, `B-first`] as const).map((loadOrder) => ({
+        operation,
+        loadOrder,
+      })),
+    ),
+  )(
+    `keeps a $operation out of another Collection sharing its Query ($loadOrder)`,
+    async ({ operation, loadOrder }) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`shared-direct-write-isolation`]
+      const server = { id: `x`, name: `Server` }
+      const queryFn = vi.fn(() => Promise.resolve([{ ...server }]))
+      const makeCollection = (id: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const ownerA = makeCollection(`shared-direct-write-owner-a`)
+      const ownerB = makeCollection(`shared-direct-write-owner-b`)
+      cleanups.push(async () => {
+        await ownerA.cleanup()
+        await ownerB.cleanup()
+        queryClient.clear()
+      })
+
+      const first = loadOrder === `A-first` ? ownerA : ownerB
+      const second = loadOrder === `A-first` ? ownerB : ownerA
+      await first._sync.loadSubset({})
+      await second._sync.loadSubset({})
+      expect(queryFn).toHaveBeenCalledTimes(1)
+      if (operation === `delete`) await ownerA.utils.writeDelete(server.id)
+      else if (operation === `upsert`)
+        await ownerA.utils.writeUpsert({ id: server.id, name: `Manual` })
+      else await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
+      expect(ownerA.get(server.id)?.name).toBe(
+        operation === `delete` ? undefined : `Manual`,
+      )
+      expect(ownerB.get(server.id)?.name).toBe(`Server`)
+      expect(queryClient.getQueryData(queryKey)).toEqual([server])
+      expect(queryFn).toHaveBeenCalledTimes(1)
+    },
+  )
+
+  /**
+   * Eager Collections project one shared Query cache. A direct cache write
+   * changes that projection for both Collections without starting a request.
+   * The independent reference applies each write to the shared row set, then
+   * compares both public Collections and the Query cache at write settlement.
+   */
+  it.each([`update`, `delete`, `upsert`] as const)(
+    `projects an eager $0 through a Query shared by two Collections`,
+    async (operation) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`shared-eager-direct-${operation}`]
+      const server = { id: `x`, name: `Server` }
+      const queryFn = vi.fn(() => Promise.resolve([server]))
+      const makeCollection = (suffix: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id: `shared-eager-direct-${operation}-${suffix}`,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `eager`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`a`)
+      const b = makeCollection(`b`)
+      cleanups.push(async () => {
+        await a.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+      })
+
+      await Promise.all([a.preload(), b.preload()])
+      expect(queryFn).toHaveBeenCalledOnce()
+      if (operation === `delete`) await a.utils.writeDelete(server.id)
+      else if (operation === `upsert`)
+        await a.utils.writeUpsert({ id: server.id, name: `Manual` })
+      else await a.utils.writeUpdate({ id: server.id, name: `Manual` })
+      expect(a.get(server.id)?.name).toBe(
+        operation === `delete` ? undefined : `Manual`,
+      )
+      expect(b.get(server.id)?.name).toBe(
+        operation === `delete` ? undefined : `Manual`,
+      )
+      expect(queryClient.getQueryData(queryKey)).toEqual(
+        operation === `delete` ? [] : [{ id: server.id, name: `Manual` }],
+      )
+      expect(queryFn).toHaveBeenCalledOnce()
+    },
+  )
+
+  /**
+   * A new direct key joins the shared eager cache and both projections. A
+   * later complete server response that omits the key retires it in both.
+   */
+  it(`projects an eager new-key insert until a later complete fetch`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`shared-eager-new-key`]
+    const server = { id: `x`, name: `Server` }
+    const queryFn = vi.fn(() => Promise.resolve([server]))
+    const makeCollection = (suffix: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id: `shared-eager-new-key-${suffix}`,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `eager`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`a`)
+    const b = makeCollection(`b`)
+    cleanups.push(async () => {
+      await a.cleanup()
+      await b.cleanup()
+      queryClient.clear()
+    })
+
+    await Promise.all([a.preload(), b.preload()])
+    expect(queryFn).toHaveBeenCalledOnce()
+    await a.utils.writeInsert({ id: `y`, name: `Manual` })
+    expect(a.get(`y`)?.name).toBe(`Manual`)
+    expect(b.get(`y`)?.name).toBe(`Manual`)
+    expect(queryClient.getQueryData(queryKey)).toEqual([
+      server,
+      { id: `y`, name: `Manual` },
+    ])
+    expect(queryFn).toHaveBeenCalledOnce()
+
+    await b.utils.refetch({ throwOnError: true })
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(a.has(`y`)).toBe(false)
+    expect(b.has(`y`)).toBe(false)
+    expect(a.get(`x`)?.name).toBe(server.name)
+    expect(b.get(`x`)?.name).toBe(server.name)
+  })
+
+  /**
+   * A shared eager cache projects A's direct write to both Collections. The
+   * older request must not undo that accepted value in either projection;
+   * a later-started complete fetch can replace it in both.
+   */
+  it(`preserves an eager direct write across an older shared fetch`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`shared-eager-older-fetch`]
+    const server = { id: `x`, name: `Server` }
+    const older = { id: `x`, name: `Older` }
+    const newer = { id: `x`, name: `Newer` }
+    const held = createDeferred<Array<Row>>()
+    const started = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([server])
+      .mockImplementationOnce(() => {
+        started.resolve()
+        return held.promise
+      })
+      .mockResolvedValue([newer])
+    const makeCollection = (suffix: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id: `shared-eager-older-fetch-${suffix}`,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `eager`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`a`)
+    const b = makeCollection(`b`)
+    cleanups.push(async () => {
+      held.resolve([older])
+      await a.cleanup()
+      await b.cleanup()
+      queryClient.clear()
+    })
+
+    await Promise.all([a.preload(), b.preload()])
+    const refetch = b.utils.refetch({ throwOnError: true })
+    await started.promise
+    await a.utils.writeUpdate({ id: server.id, name: `Manual` })
+    expect(a.get(server.id)?.name).toBe(`Manual`)
+    expect(b.get(server.id)?.name).toBe(`Manual`)
+    held.resolve([older])
+    await refetch
+    expect(a.get(server.id)?.name).toBe(`Manual`)
+    expect(b.get(server.id)?.name).toBe(`Manual`)
+
+    await b.utils.refetch({ throwOnError: true })
+    expect(queryFn).toHaveBeenCalledTimes(3)
+    expect(a.get(server.id)?.name).toBe(newer.name)
+    expect(b.get(server.id)?.name).toBe(newer.name)
+  })
+
+  /**
+   * A later eager Collection projects the shared cache's direct edit without
+   * requiring a new fetch. A subsequent explicit fetch replaces that cached
+   * value in both Collections. The reference keeps cache projection separate
+   * from server freshness and compares both rows and request count.
+   */
+  it(`projects an eager cache patch on later acquisition`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`late-eager-direct-patch`]
+    const server = { id: `x`, name: `Server` }
+    const newer = { id: `x`, name: `Newer` }
+    const held = createDeferred<Array<Row>>()
+    const requestStarted = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([server])
+      .mockImplementationOnce(() => {
+        requestStarted.resolve()
+        return held.promise
+      })
+    const makeCollection = (suffix: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id: `late-eager-direct-${suffix}`,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `eager`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`a`)
+    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
+    cleanups.push(async () => {
+      held.resolve([newer])
+      await a.cleanup()
+      await peer.collection?.cleanup()
+      queryClient.clear()
+    })
+
+    await a.preload()
+    await a.utils.writeUpdate({ id: server.id, name: `Manual` })
+    expect(queryClient.getQueryData(queryKey)).toEqual([
+      { id: server.id, name: `Manual` },
+    ])
+    peer.collection = makeCollection(`b`)
+    const b = peer.collection
+    await b.preload()
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(b.get(server.id)?.name).toBe(`Manual`)
+    expect(a.get(server.id)?.name).toBe(`Manual`)
+    const refetch = b.utils.refetch({ throwOnError: true })
+    await requestStarted.promise
+    expect(b.get(server.id)?.name).toBe(`Manual`)
+    held.resolve([newer])
+    await refetch
+    expect(b.get(server.id)?.name).toBe(newer.name)
+    expect(a.get(server.id)?.name).toBe(newer.name)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * A disabled Query never starts its own request. Eager B can project the
+   * shared cache edit immediately; on-demand B still waits for server
+   * authority under its separate subset ownership law, including after an
+   * outside setQueryData edit. Explicit refetch remains available in both
+   * modes and later replaces the cached value.
+   */
+  it.each([
+    { syncMode: `eager`, externalCacheEdit: false },
+    { syncMode: `on-demand`, externalCacheEdit: false },
+    { syncMode: `on-demand`, externalCacheEdit: true },
+  ] as const)(
+    `respects disabled $syncMode acquisition of a shared Query with external cache edit=$externalCacheEdit`,
+    async ({ syncMode, externalCacheEdit }) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`disabled-late-peer-${syncMode}-${externalCacheEdit}`]
+      const server = { id: `x`, name: `Server` }
+      const newer = { id: `x`, name: `Newer` }
+      const held = createDeferred<Array<Row>>()
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([server])
+        .mockImplementationOnce(() => held.promise)
+      const makeCollection = (suffix: string, enabled: boolean) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id: `disabled-late-peer-${syncMode}-${suffix}`,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode,
+            enabled,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`a`, true)
+      const peer: { collection?: ReturnType<typeof makeCollection> } = {}
+      cleanups.push(async () => {
+        held.resolve([newer])
+        await a.cleanup()
+        await peer.collection?.cleanup()
+        queryClient.clear()
+      })
+
+      if (syncMode === `eager`) await a.preload()
+      else await a._sync.loadSubset({})
+      await a.utils.writeUpdate({ id: server.id, name: `Manual` })
+      if (externalCacheEdit)
+        queryClient.setQueryData(queryKey, [{ ...server, name: `Manual` }])
+      peer.collection = makeCollection(`b`, false)
+      const b = peer.collection
+      const load =
+        syncMode === `eager`
+          ? b.preload()
+          : Promise.resolve(b._sync.loadSubset({}))
+      let loadState: `pending` | `fulfilled` | `rejected` = `pending`
+      void load.then(
+        () => (loadState = `fulfilled`),
+        () => (loadState = `rejected`),
+      )
+      for (let turn = 0; turn < 4; turn++) await Promise.resolve()
+      expect(queryFn).toHaveBeenCalledOnce()
+      expect(b.get(server.id)?.name).toBe(
+        syncMode === `eager` ? `Manual` : undefined,
+      )
+      expect(loadState).toBe(syncMode === `eager` ? `fulfilled` : `pending`)
+
+      const refetch = b.utils.refetch({ throwOnError: true })
+      held.resolve([newer])
+      await Promise.all([load, refetch])
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(b.get(server.id)?.name).toBe(newer.name)
+      expect(a.get(server.id)?.name).toBe(newer.name)
+    },
+  )
+
+  /**
+   * An eager direct write can seed an idle shared Query before any provider
+   * fetch. A disabled B projects that seed without starting a request. The
+   * next explicit refetch can replace it with the server row.
+   */
+  it(`projects an eager direct cache seed to a disabled peer`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`disabled-eager-seed-peer`]
+    const direct = { id: `x`, name: `Manual` }
+    const server = { id: `x`, name: `Server` }
+    const held = createDeferred<Array<Row>>()
+    const queryFn = vi.fn(() => held.promise)
+    const makeCollection = (suffix: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id: `disabled-eager-seed-peer-${suffix}`,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `eager`,
+          enabled: false,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`a`)
+    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
+    cleanups.push(async () => {
+      held.resolve([server])
+      await a.cleanup()
+      await peer.collection?.cleanup()
+      queryClient.clear()
+    })
+
+    await a.utils.writeInsert(direct)
+    expect(a.get(direct.id)?.name).toBe(direct.name)
+    expect(queryClient.getQueryData(queryKey)).toEqual([direct])
+    peer.collection = makeCollection(`b`)
+    const b = peer.collection
+    const load = b.preload()
+    for (let turn = 0; turn < 4; turn++) await Promise.resolve()
+    expect(queryFn).not.toHaveBeenCalled()
+    await load
+    expect(b.get(direct.id)?.name).toBe(direct.name)
+
+    const refetch = b.utils.refetch({ throwOnError: true })
+    expect(queryFn).toHaveBeenCalledOnce()
+    held.resolve([server])
+    await refetch
+    expect(b.get(direct.id)?.name).toBe(server.name)
+    expect(a.get(direct.id)?.name).toBe(server.name)
+  })
+
+  /**
+   * An eager Query is one keyed cache document projected by both Collections.
+   * A direct write changes its authored key in that document; a peer's later
+   * direct write changes only its own authored key, even if that peer has not
+   * yet applied the first cache notification. The independent reference folds
+   * A's write then B's write over the two server rows. Holding B's result
+   * application keeps its accepted rows stale at B's write, distinguishing a
+   * surgical cache edit from replacing the cache with B's whole row snapshot.
+   * The same-key neighbor requires the later accepted write to win. Compare
+   * the shared cache and unblocked A projection after B's accepted write, while
+   * B's result application remains held. Neither write starts a request.
+   */
+  it.each([`disjoint`, `same-key`] as const)(
+    `composes $0 eager direct writes through one shared Query`,
+    async (writeOrder) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`shared-eager-write-composition`, writeOrder]
+      const server = [
+        { id: `x`, name: `Server X` },
+        { id: `y`, name: `Server Y` },
+      ]
+      const queryFn = vi.fn(() => Promise.resolve(server))
+      const makeCollection = (suffix: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id: `shared-eager-write-composition-${writeOrder}-${suffix}`,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `eager`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`a`)
+      const b = makeCollection(`b`)
+      const barrier = createDeferred<void>()
+      cleanups.push(async () => {
+        b.deferDataRefresh = null
+        barrier.resolve()
+        await a.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+      })
+
+      await Promise.all([a.preload(), b.preload()])
+      expect(queryFn).toHaveBeenCalledOnce()
+      b.deferDataRefresh = barrier.promise
+      await a.utils.writeUpdate({ id: `x`, name: `A` })
+      expect(b.get(`x`)?.name).toBe(`Server X`)
+      const bKey = writeOrder === `disjoint` ? `y` : `x`
+      await b.utils.writeUpdate({ id: bKey, name: `B` })
+      expect(b.get(bKey)?.name).toBe(`B`)
+      if (writeOrder === `disjoint`) expect(b.get(`x`)?.name).toBe(`Server X`)
+
+      const expected = [
+        { id: `x`, name: writeOrder === `disjoint` ? `A` : `B` },
+        { id: `y`, name: writeOrder === `disjoint` ? `B` : `Server Y` },
+      ]
+      expect(queryClient.getQueryData(queryKey)).toEqual(expected)
+      expect(queryFn).toHaveBeenCalledOnce()
+      await vi.waitFor(() => {
+        expect([a.get(`x`)?.name, a.get(`y`)?.name]).toEqual(
+          expected.map((row) => row.name),
+        )
+      })
+      expect(queryFn).toHaveBeenCalledOnce()
+    },
+  )
+
+  /**
+   * Directly selected response arrays carry the same shared-Query law as raw
+   * arrays. The response envelope is part of the cache contract, while each
+   * Collection's accepted rows can lag behind a held notification. Folding
+   * two disjoint writes over the response checks both row composition and
+   * preservation of unrelated envelope metadata without a provider request.
+   */
+  it(`composes eager peer writes inside a selected response array`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`shared-eager-wrapped-composition`]
+    const server = [
+      { id: `x`, name: `Server X` },
+      { id: `y`, name: `Server Y` },
+    ]
+    const queryFn = vi.fn(() => Promise.resolve({ items: server, tag: `keep` }))
+    const makeCollection = (id: string) =>
+      createCollection(
+        queryCollectionOptions({
+          id,
+          queryClient,
+          queryKey,
+          queryFn,
+          select: (response) => response.items,
+          getKey: (row: Row) => row.id,
+          syncMode: `eager`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`shared-eager-wrapped-a`)
+    const b = makeCollection(`shared-eager-wrapped-b`)
+    const barrier = createDeferred<void>()
+    cleanups.push(async () => {
+      b.deferDataRefresh = null
+      barrier.resolve()
+      await a.cleanup()
+      await b.cleanup()
+      queryClient.clear()
+    })
+
+    await Promise.all([a.preload(), b.preload()])
+    b.deferDataRefresh = barrier.promise
+    await a.utils.writeUpdate({ id: `x`, name: `A` })
+    await b.utils.writeUpdate({ id: `y`, name: `B` })
+    const expected = [
+      { id: `x`, name: `A` },
+      { id: `y`, name: `B` },
+    ]
+    expect(queryClient.getQueryData(queryKey)).toEqual({
+      items: expected,
+      tag: `keep`,
+    })
+    await vi.waitFor(() => {
+      expect([a.get(`x`)?.name, a.get(`y`)?.name]).toEqual([`A`, `B`])
+    })
+    expect(queryFn).toHaveBeenCalledOnce()
+  })
+
+  /**
+   * B owns a shared on-demand Query while A has no subset owner. The Query
+   * Collection guide's on-demand cache rule protects another Collection's
+   * owned Query: A's direct insert changes only A's accepted row and starts
+   * no provider request. A later physical fetch may replace that row when A
+   * acquires the cached result, as the guide's shared-key rule permits.
+   *
+   * The reference is the authored server row, A-only insert, and newer server
+   * row in that order. The first public-row and cache checkpoint rejects a
+   * shared-cache guard that runs only when the writing Collection owns a row.
+   * The final checkpoint distinguishes that guard from a rule that refuses
+   * all later server authority.
+   */
+  it(`keeps an unacquired direct insert out of another Collection's shared Query`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`shared-unacquired-direct-insert`]
+    const server = { id: `x`, name: `Server` }
+    const newer = { id: `x`, name: `Newer` }
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([server])
+      .mockResolvedValue([newer])
+    const makeCollection = (id: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const ownerA = makeCollection(`shared-unacquired-insert-a`)
+    const ownerB = makeCollection(`shared-unacquired-insert-b`)
+    cleanups.push(async () => {
+      await ownerA.cleanup()
+      await ownerB.cleanup()
+      queryClient.clear()
+    })
+
+    await ownerB._sync.loadSubset({})
+    expect(ownerB.get(server.id)?.name).toBe(server.name)
+    expect(ownerA.has(server.id)).toBe(false)
+    await ownerA.utils.writeInsert({ id: server.id, name: `Manual` })
+    expect(ownerA.get(server.id)?.name).toBe(`Manual`)
+    expect(ownerB.get(server.id)?.name).toBe(server.name)
+    expect(queryClient.getQueryData(queryKey)).toEqual([server])
+    expect(queryFn).toHaveBeenCalledOnce()
+
+    await ownerB.utils.refetch({ throwOnError: true })
+    expect(ownerA.get(server.id)?.name).toBe(`Manual`)
+    expect(ownerB.get(server.id)?.name).toBe(newer.name)
+    await ownerA._sync.loadSubset({})
+    expect(ownerA.get(server.id)?.name).toBe(newer.name)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * A Collection that acquires a Query after another Collection's direct
+   * cache patch must not mistake that local edit for a server result. The
+   * reference starts with one server row, then gives only A the direct update.
+   * B's first acquisition may request a new result; while that request is
+   * held, B has no server-confirmed copy of A's value. A post-write result
+   * may then replace A's write in both Collections. Constructing B before or
+   * after the write varies registration without changing this authority law.
+   * The driver checks public rows, cache data, and provider calls at each cut.
+   */
+  it.each([`registered`, `later-created`] as const)(
+    `does not adopt another Collection's cached direct edit on later acquisition: %s`,
+    async (peerTiming) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`late-shared-direct-edit-${peerTiming}`]
+      const server = { id: `x`, name: `Server` }
+      const newer = { id: `x`, name: `Newer` }
+      const held = createDeferred<Array<Row>>()
+      const requestStarted = createDeferred<void>()
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([server])
+        .mockImplementationOnce(() => {
+          requestStarted.resolve()
+          return held.promise
+        })
+      const makeCollection = (id: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const ownerA = makeCollection(`late-shared-a-${peerTiming}`)
+      let ownerB =
+        peerTiming === `registered`
+          ? makeCollection(`late-shared-b-${peerTiming}`)
+          : undefined
+      cleanups.push(async () => {
+        held.resolve([newer])
+        await ownerA.cleanup()
+        await ownerB?.cleanup()
+        queryClient.clear()
+      })
+
+      await ownerA._sync.loadSubset({})
+      expect(ownerA.get(server.id)?.name).toBe(server.name)
+      await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
+      expect(ownerA.get(server.id)?.name).toBe(`Manual`)
+      expect(queryClient.getQueryData(queryKey)).toEqual([
+        { id: server.id, name: `Manual` },
+      ])
+      expect(queryFn).toHaveBeenCalledOnce()
+
+      ownerB ??= makeCollection(`late-shared-b-${peerTiming}`)
+      const load = Promise.resolve(ownerB._sync.loadSubset({}))
+      void load.catch(() => undefined)
+      const first = await Promise.race([
+        load.then(
+          () => `settled`,
+          () => `rejected`,
+        ),
+        requestStarted.promise.then(() => `request-started`),
+      ])
+      expect(first).toBe(`request-started`)
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(ownerB.has(server.id)).toBe(false)
+      held.resolve([newer])
+      await load
+      expect(ownerB.get(server.id)?.name).toBe(newer.name)
+      expect(ownerA.get(server.id)?.name).toBe(newer.name)
+    },
+  )
+
+  /**
+   * Query Core may assign a Collection key the physical Query created for a
+   * different stored key when a custom hash aliases them. The cache is the
+   * source of that Query's rows; a direct write to a different row cannot
+   * evict the foreign stored key or turn its old row into a fresh fetch. The
+   * reference keeps the ownerless direct y across subset release and keeps
+   * the foreign physical Query. Its cached x has not been verified by a
+   * physical fetch for this Collection, so disabled reacquisition waits until
+   * an explicit refetch returns the server row. This distinguishes retaining
+   * the cache entry from incorrectly treating it as fresh authority.
+   */
+  it(`retains a foreign stored key under a custom Query hash after a direct write`, async () => {
+    type Row = { id: string; name: string }
+    const foreignKey = [`foreign-stored-key`]
+    const baseKey = [`collection-stored-key`]
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          queryKeyHashFn: () => `shared-hash`,
+          staleTime: Infinity,
+          gcTime: Infinity,
+          retry: false,
+        },
+      },
+    })
+    queryClient.setQueryData(foreignKey, [{ id: `x`, name: `Cached` }])
+    const physicalQuery = queryClient.getQueryCache().getAll()[0]!
+    const queryFn = vi.fn(() => Promise.resolve([{ id: `x`, name: `Server` }]))
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id: `foreign-stored-key-collection`,
+        queryClient,
+        queryKey: () => baseKey,
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        enabled: false,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    expect(collection.get(`x`)?.name).toBe(`Cached`)
+    await collection.utils.writeInsert({ id: `y`, name: `Manual` })
+    collection._sync.unloadSubset({})
+    const reacquisition = Promise.resolve(collection._sync.loadSubset({}))
+    let settled = false
+    void reacquisition.then(() => (settled = true))
+    for (let turn = 0; turn < 5; turn++) await Promise.resolve()
+    expect(settled).toBe(false)
+    expect(collection.get(`y`)?.name).toBe(`Manual`)
+    expect(queryClient.getQueryCache().getAll()).toContain(physicalQuery)
+    expect(physicalQuery.queryKey).toEqual(foreignKey)
+    expect(queryFn).not.toHaveBeenCalled()
+    await collection.utils.refetch({ throwOnError: true })
+    await reacquisition
+    expect(collection.get(`x`)?.name).toBe(`Server`)
+    expect(collection.has(`y`)).toBe(false)
+    expect(queryFn).toHaveBeenCalledOnce()
+  })
+
+  /**
+   * A reset may reuse a Query's numeric data-update count. The independent
+   * authority rule distinguishes the physical provider result from A's local
+   * cache patch: B must ignore the patch while waiting, then apply the new
+   * provider row even when reset gives it the patch's old count. The driver
+   * observes B's pending load before the result and its settlement afterward.
+   */
+  it.each([`new-response`, `same-reference`] as const)(
+    `settles a shared Query acquisition after reset reuses a cache edit version: %s`,
+    async (responseIdentity) => {
+      type Row = { id: string; name: string }
+      const queryKey = [`shared-reset-cache-version`]
+      const queryClient = createQueryClient()
+      const replacement = createDeferred<Array<Row>>()
+      const abandoned = createDeferred<Array<Row>>()
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([{ id: `x`, name: `Initial` }])
+        .mockImplementationOnce(() => abandoned.promise)
+        .mockImplementationOnce(() => replacement.promise)
+      const makeCollection = (id: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`shared-reset-a`)
+      const b = makeCollection(`shared-reset-b`)
+      cleanups.push(async () => {
+        abandoned.resolve([])
+        replacement.resolve([])
+        await a.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+      })
+
+      await a._sync.loadSubset({})
+      await a.utils.writeUpdate({ id: `x`, name: `Manual` })
+      const query = queryClient.getQueryCache().find({ queryKey, exact: true })!
+      const editedCacheData = query.state.data as Array<Row>
+      expect(query.state.dataUpdateCount).toBe(1)
+      const acquisition = Promise.resolve(b._sync.loadSubset({}))
+      void acquisition.catch(() => undefined)
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+      expect(b.has(`x`)).toBe(false)
+
+      const reset = queryClient.resetQueries({ queryKey, exact: true })
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+      const expected =
+        responseIdentity === `same-reference`
+          ? editedCacheData
+          : [{ id: `x`, name: `After reset` }]
+      replacement.resolve(expected)
+      await reset
+      await vi.waitFor(() => expect(b.get(`x`)?.name).toBe(expected[0]?.name))
+      await acquisition
+      expect(query.state.dataUpdateCount).toBe(1)
+    },
+  )
+
+  /**
+   * Query Core notifies observers before its cache success listener. A direct
+   * write made by a foreign observer in that gap is still a local cache edit,
+   * not part of the successful provider response. The independent account
+   * gives A the direct value and leaves B without a confirmed row until a
+   * third physical request settles. The held B request distinguishes fetched
+   * response identity from the mutable Query state seen by the cache listener.
+   */
+  it(`does not certify a reentrant direct cache edit as a fetched result`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`reentrant-success-direct-edit`]
+    const server = { id: `x`, name: `Server` }
+    const older = { id: `x`, name: `Older` }
+    const newer = { id: `x`, name: `Newer` }
+    const held = createDeferred<Array<Row>>()
+    const requestStarted = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([server])
+      .mockResolvedValueOnce([older])
+      .mockImplementationOnce(() => {
+        requestStarted.resolve()
+        return held.promise
+      })
+    const makeCollection = (id: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`reentrant-success-a`)
+    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
+    const outside = new QueryObserver(queryClient, {
+      queryKey,
+      queryFn,
+      enabled: false,
+      notifyOnChangeProps: `all`,
+    })
+    let directWrite: Promise<unknown> | undefined
+    const unsubscribe = outside.subscribe((result) => {
+      if (
+        result.isSuccess &&
+        !result.isFetching &&
+        result.data?.[0]?.name === older.name &&
+        !directWrite
+      ) {
+        directWrite = Promise.resolve(
+          a.utils.writeUpdate({ id: server.id, name: `Manual` }),
+        )
+      }
+    })
+    cleanups.push(async () => {
+      held.resolve([newer])
+      unsubscribe()
+      await a.cleanup()
+      await peer.collection?.cleanup()
+      queryClient.clear()
+    })
+
+    await a._sync.loadSubset({})
+    await a.utils.refetch({ throwOnError: true })
+    await directWrite
+    expect(a.get(server.id)?.name).toBe(`Manual`)
+    expect(queryClient.getQueryData(queryKey)).toEqual([
+      { id: server.id, name: `Manual` },
+    ])
+    peer.collection = makeCollection(`reentrant-success-b`)
+    const load = Promise.resolve(peer.collection._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    expect(
+      await Promise.race([
+        load.then(
+          () => `settled`,
+          () => `rejected`,
+        ),
+        requestStarted.promise.then(() => `request-started`),
+      ]),
+    ).toBe(`request-started`)
+    expect(peer.collection.has(server.id)).toBe(false)
+    held.resolve([newer])
+    await load
+    expect(peer.collection.get(server.id)?.name).toBe(newer.name)
+  })
+
+  /**
+   * A directly selected response property has the same provenance rule as a
+   * raw array. A's direct edit can patch its Query envelope, but a later B
+   * cannot treat that envelope as a server fetch. The reference gives B no
+   * row until the held replacement response, then gives it the server row.
+   * This distinguishes the rule from a patch marker set only for raw arrays.
+   */
+  it(`withholds a directly selected cache edit from a later Collection`, async () => {
+    type Row = { id: string; name: string }
+    type Response = { items: Array<Row> }
+    const queryClient = createQueryClient()
+    const queryKey = [`late-shared-wrapped-direct-edit`]
+    const server = { id: `x`, name: `Server` }
+    const newer = { id: `x`, name: `Newer` }
+    const held = createDeferred<Response>()
+    const requestStarted = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce({ items: [server] })
+      .mockImplementationOnce(() => {
+        requestStarted.resolve()
+        return held.promise
+      })
+    const makeCollection = (id: string) =>
+      createCollection(
+        queryCollectionOptions({
+          id,
+          queryClient,
+          queryKey,
+          queryFn,
+          select: (response: Response) => response.items,
+          getKey: (row: Row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const ownerA = makeCollection(`late-wrapped-a`)
+    const peer: { collection?: ReturnType<typeof makeCollection> } = {}
+    cleanups.push(async () => {
+      held.resolve({ items: [newer] })
+      await ownerA.cleanup()
+      await peer.collection?.cleanup()
+      queryClient.clear()
+    })
+
+    await ownerA._sync.loadSubset({})
+    await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
+    expect(queryClient.getQueryData(queryKey)).toEqual({
+      items: [{ id: server.id, name: `Manual` }],
+    })
+    peer.collection = makeCollection(`late-wrapped-b`)
+    const ownerB = peer.collection
+    const load = Promise.resolve(ownerB._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    expect(
+      await Promise.race([
+        load.then(
+          () => `settled`,
+          () => `rejected`,
+        ),
+        requestStarted.promise.then(() => `request-started`),
+      ]),
+    ).toBe(`request-started`)
+    expect(ownerB.has(server.id)).toBe(false)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    held.resolve({ items: [newer] })
+    await load
+    expect(ownerB.get(server.id)?.name).toBe(newer.name)
+    expect(ownerA.get(server.id)?.name).toBe(newer.name)
+  })
+
+  /**
+   * The late peer must withhold A's local cache edit while its replacement
+   * fetch runs. If that fetch fails, it still reports the new Query error:
+   * withholding an old success cannot suppress a terminal failure. The
+   * independent reference has no B-owned row and one failed B request, so the
+   * public checkpoint is B's error state and absence of A's direct value.
+   * The successful sibling above distinguishes this from withholding every
+   * result. Registration on either side of the write is a legal history.
+   */
+  it.each([`registered`, `later-created`] as const)(
+    `reports a failed fetch while withholding another Collection's cached edit: %s`,
+    async (peerTiming) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`late-shared-direct-error-${peerTiming}`]
+      const failure = new Error(`replacement failed`)
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
+        .mockRejectedValueOnce(failure)
+      const makeCollection = (id: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const ownerA = makeCollection(`late-error-a-${peerTiming}`)
+      let ownerB =
+        peerTiming === `registered`
+          ? makeCollection(`late-error-b-${peerTiming}`)
+          : undefined
+      cleanups.push(async () => {
+        await ownerA.cleanup()
+        await ownerB?.cleanup()
+        queryClient.clear()
+      })
+
+      await ownerA._sync.loadSubset({})
+      await ownerA.utils.writeUpdate({ id: `x`, name: `Manual` })
+      ownerB ??= makeCollection(`late-error-b-${peerTiming}`)
+      await expect(ownerB._sync.loadSubset({})).rejects.toBe(failure)
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(ownerB.has(`x`)).toBe(false)
+      expect(reportedError(ownerB)).toBe(failure)
+      expect(reportedError(ownerB)).toBeDefined()
+      expect(ownerA.get(`x`)?.name).toBe(`Manual`)
+    },
+  )
+
+  /**
+   * A shared request started before A's local write remains a server result
+   * for B. A's later accepted value wins only in A. The reference keeps two
+   * Collection row sets over the one provider response. B releases and
+   * reacquires its subset while the fetch is held. After settlement, B sees
+   * the provider row and A sees its direct write. This tests the result-merge
+   * and remount paths as well as the immediate cache patch path above.
+   */
+  it(`keeps an older shared fetch from carrying A's direct write into B`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`shared-older-fetch-isolation`]
+    const older = createDeferred<Array<Row>>()
+    const server = { id: `x`, name: `Server` }
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([server])
+      .mockImplementationOnce(() => older.promise)
+    const makeCollection = (id: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const ownerA = makeCollection(`shared-older-fetch-a`)
+    const ownerB = makeCollection(`shared-older-fetch-b`)
+    cleanups.push(async () => {
+      older.resolve([server])
+      await ownerA.cleanup()
+      await ownerB.cleanup()
+      queryClient.clear()
+    })
+
+    await Promise.all([
+      ownerA._sync.loadSubset({}),
+      ownerB._sync.loadSubset({}),
+    ])
+    const refresh = ownerA.utils.refetch({ throwOnError: true })
+    void refresh.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+    await ownerA.utils.writeUpdate({ id: server.id, name: `Manual` })
+    expect(ownerB.get(server.id)?.name).toBe(`Server`)
+    ownerB._sync.unloadSubset({})
+    expect(ownerB.has(server.id)).toBe(false)
+    const reacquire = Promise.resolve(ownerB._sync.loadSubset({}))
+    void reacquire.catch(() => undefined)
+    older.resolve([{ id: server.id, name: `Older` }])
+    await Promise.all([refresh, reacquire])
+    expect(ownerA.get(server.id)?.name).toBe(`Manual`)
+    expect(ownerB.get(server.id)?.name).toBe(`Older`)
+  })
+
+  /**
+   * An explicit refetch after a direct write needs a post-write provider
+   * request, even if another Collection started the shared empty-cache fetch.
+   * The independent reference orders provider starts and accepted writes; the
+   * physical Query's initiating Collection does not change that order. The
+   * two legal start orders distinguish a local fetch clock from a shared one.
+   * At refetch settlement, observe request count and A's public row.
+   */
+  it.each([`A-first`, `B-first`] as const)(
+    `starts a post-write refetch of a shared empty-cache Query ($startOrder)`,
+    async (startOrder) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`shared-empty-cache-post-write-${startOrder}`]
+      const first = createDeferred<Array<Row>>()
+      const queryFn = vi
+        .fn()
+        .mockImplementationOnce(() => first.promise)
+        .mockResolvedValueOnce([])
+      const makeCollection = (id: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`shared-refetch-a-${startOrder}`)
+      const b = makeCollection(`shared-refetch-b-${startOrder}`)
+      cleanups.push(async () => {
+        first.resolve([])
+        await Promise.all([a.cleanup(), b.cleanup()])
+        queryClient.clear()
+      })
+      const initial = startOrder === `A-first` ? a : b
+      const second = startOrder === `A-first` ? b : a
+      const firstLoad = Promise.resolve(initial._sync.loadSubset({}))
+      void firstLoad.catch(() => undefined)
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
+      const secondLoad = Promise.resolve(second._sync.loadSubset({}))
+      void secondLoad.catch(() => undefined)
+      await a.utils.writeInsert({ id: `x`, name: `Written` })
+      await a.utils.writeDelete(`x`)
+      const refetch = a.utils.refetch({ throwOnError: true })
+      void refetch.catch(() => undefined)
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+      first.resolve([{ id: `x`, name: `Stale` }])
+      await refetch
+      expect(a.has(`x`)).toBe(false)
+      await Promise.allSettled([firstLoad, secondLoad])
+    },
+  )
+
+  /**
+   * The neighboring order is different: a shared empty-cache request begun
+   * after A's direct write is already post-write authority. A's explicit
+   * refetch may join it. The independent request-order reference predicts one
+   * provider call and both Collections receiving that result at settlement.
+   * This rejects a blanket rule that cancels every shared in-flight request.
+   */
+  it(`reuses a shared empty-cache request started after the direct write`, async () => {
+    type Row = { id: string; name: string }
+    const queryClient = createQueryClient()
+    const queryKey = [`shared-newer-empty-cache-request`]
+    const response = createDeferred<Array<Row>>()
+    const server = { id: `x`, name: `Server` }
+    const queryFn = vi.fn(() => response.promise)
+    const makeCollection = (id: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`shared-newer-a`)
+    const b = makeCollection(`shared-newer-b`)
+    cleanups.push(async () => {
+      response.resolve([server])
+      await Promise.all([a.cleanup(), b.cleanup()])
+      queryClient.clear()
+    })
+    await a.utils.writeInsert({ id: `x`, name: `Written` })
+    const bLoad = Promise.resolve(b._sync.loadSubset({}))
+    void bLoad.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
+    const aLoad = Promise.resolve(a._sync.loadSubset({}))
+    void aLoad.catch(() => undefined)
+    const refetch = a.utils.refetch({ throwOnError: true })
+    void refetch.catch(() => undefined)
+    expect(queryFn).toHaveBeenCalledOnce()
+    response.resolve([server])
+    await Promise.all([aLoad, bLoad, refetch])
+    expect(queryFn).toHaveBeenCalledOnce()
+    expect(a.get(`x`)?.name).toBe(`Server`)
+    expect(b.get(`x`)?.name).toBe(`Server`)
+  })
+
+  /**
+   * A's sync restart cannot move an already-running physical Query request
+   * past its earlier direct write. The reference order is B's request start,
+   * A's accepted insert/delete, A's sync restart, then A's explicit refetch.
+   * A post-write request must start and settle without reviving x. This is
+   * the same request-order law as the two-Collection histories above, with
+   * one added sync-run boundary.
+   */
+  it.each([false, true] as const)(
+    `keeps a shared pre-write fetch older across Collection sync restart with explicit refetch=%s`,
+    async (explicitRefetch) => {
+      type Row = { id: string; name: string }
+      const queryClient = createQueryClient()
+      const queryKey = [`shared-fetch-across-sync-restart`, explicitRefetch]
+      const first = createDeferred<Array<Row>>()
+      const queryFn = vi
+        .fn()
+        .mockImplementationOnce(() => first.promise)
+        .mockResolvedValue([])
+      const makeCollection = (id: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`shared-fetch-restart-a`)
+      const b = makeCollection(`shared-fetch-restart-b`)
+      cleanups.push(async () => {
+        first.resolve([])
+        await Promise.all([a.cleanup(), b.cleanup()])
+        queryClient.clear()
+      })
+      const bLoad = Promise.resolve(b._sync.loadSubset({}))
+      void bLoad.catch(() => undefined)
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
+      await a.utils.writeInsert({ id: `x`, name: `Written` })
+      await a.utils.writeDelete(`x`)
+      await a.cleanup()
+      const subscription = a.subscribeChanges(() => {})
+      cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+      const aLoad = Promise.resolve(a._sync.loadSubset({}))
+      void aLoad.catch(() => undefined)
+      const refetch = explicitRefetch
+        ? a.utils.refetch({ throwOnError: true })
+        : undefined
+      void refetch?.catch(() => undefined)
+      if (explicitRefetch)
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+      first.resolve([{ id: `x`, name: `Stale` }])
+      await refetch
+      await aLoad
+      expect(a.has(`x`)).toBe(false)
+      await Promise.allSettled([aLoad, bLoad])
+    },
+  )
+
+  /**
+   * Cleanup ends one sync run and discards its memory-only direct rows. A
+   * direct-row position from that run cannot veto a valid cached Query row
+   * when the same Collection starts a new run. The independent reference has
+   * one server row, one optional accepted direct row, and a run boundary that
+   * removes the direct row. B retains the physical Query throughout.
+   *
+   * Both histories insert directly; one explicitly deletes before cleanup.
+   * The real QueryClient and public Collection are checked after restart and
+   * cached acquisition. One provider call proves the cached path was used.
+   */
+  it.each([false, true] as const)(
+    `does not carry an old direct-row position into a restarted sync run, deleted=%s`,
+    async (deleteBeforeCleanup) => {
+      type Row = { id: string; name: string }
+      const id = `direct-position-restart-${deleteBeforeCleanup}`
+      const queryClient = createQueryClient()
+      const queryKey = [id]
+      const server = { id: `x`, name: `Server` }
+      const queryFn = vi.fn(() => Promise.resolve([server]))
+      const makeCollection = (name: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id: name,
+            queryClient,
+            queryKey,
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`${id}-a`)
+      const b = makeCollection(`${id}-b`)
+      cleanups.push(async () => {
+        await a.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+      })
+      await b._sync.loadSubset({})
+      expect(b.get(`x`)?.name).toBe(server.name)
+      await a.utils.writeInsert({ id: `x`, name: `Direct` })
+      expect(a.get(`x`)?.name).toBe(`Direct`)
+      if (deleteBeforeCleanup) await a.utils.writeDelete(`x`)
+      await a.cleanup()
+
+      const subscription = a.subscribeChanges(() => {})
+      cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+      await a._sync.loadSubset({})
+      expect(queryFn).toHaveBeenCalledOnce()
+      expect(a.get(`x`)?.name).toBe(server.name)
+      expect(b.get(`x`)?.name).toBe(server.name)
+    },
+  )
+
+  /**
+   * A direct cache patch belongs to the sync run that accepted it. An outside
+   * Query observer can retain that physical cache through A's cleanup, but
+   * A's next run cannot treat its own old local edit as a fetched result.
+   * The independent reference discards A's memory-only row at cleanup and
+   * waits for a new server response. The held-request cut rejects a cache
+   * provenance rule that compares Collection identity but ignores sync run.
+   */
+  it(`does not replay its own direct cache patch after sync restart`, async () => {
+    type Row = { id: string; name: string }
+    const id = `direct-cache-patch-restart`
+    const queryClient = createQueryClient()
+    const queryKey = [id]
+    const server = { id: `x`, name: `Server` }
+    const newer = { id: `x`, name: `Newer` }
+    const held = createDeferred<Array<Row>>()
+    const requestStarted = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([server])
+      .mockImplementationOnce(() => {
+        requestStarted.resolve()
+        return held.promise
+      })
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        staleTime: Infinity,
+        startSync: true,
+      }),
+    )
+    const outside = new QueryObserver(queryClient, {
+      queryKey,
+      queryFn,
+      enabled: false,
+      staleTime: Infinity,
+    })
+    const unsubscribeOutside = outside.subscribe(() => {})
+    cleanups.push(async () => {
+      held.resolve([newer])
+      unsubscribeOutside()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    await collection.utils.writeUpdate({ id: server.id, name: `Manual` })
+    expect(queryClient.getQueryData(queryKey)).toEqual([
+      { id: server.id, name: `Manual` },
+    ])
+    await collection.cleanup()
+    expect(queryClient.getQueryData(queryKey)).toEqual([
+      { id: server.id, name: `Manual` },
+    ])
+    const subscription = collection.subscribeChanges(() => {})
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+    const load = Promise.resolve(collection._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    expect(
+      await Promise.race([
+        load.then(
+          () => `settled`,
+          () => `rejected`,
+        ),
+        requestStarted.promise.then(() => `request-started`),
+      ]),
+    ).toBe(`request-started`)
+    expect(collection.has(server.id)).toBe(false)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    held.resolve([newer])
+    await load
+    expect(collection.get(server.id)?.name).toBe(newer.name)
+  })
+
+  /**
+   * A fresh Collection instance is a separate receiving boundary for the
+   * same authority law. The persisted direct row was accepted before B's
+   * physical fetch, and B keeps that exact Query alive while A restarts.
+   * The reference order makes the server row authoritative at A's next load.
+   * A restart may issue another request if it cannot recover that order from
+   * storage; it may not silently keep the older direct value at settlement.
+   */
+  it.each([false, true] as const)(
+    `adopts a newer shared server result after persisted Collection restart with cache edit=%s`,
+    async (cacheEdit) => {
+      type Row = { id: string; name: string }
+      const id = `shared-newer-after-persisted-restart-${cacheEdit}`
+      const queryKey = [id]
+      const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+      const persistence = createNodeSQLitePersistence({
+        database: driver.getDatabase(),
+      })
+      const managed = persistence.resolvePersistenceForCollection!({
+        collectionId: id,
+        mode: `sync-present`,
+      })
+      const queryClient = createQueryClient()
+      const server = { id: `x`, name: `Server` }
+      let aRequests = 0
+      const aQueryFn = vi.fn(() =>
+        Promise.resolve(++aRequests === 1 ? [] : [server]),
+      )
+      const bQueryFn = vi.fn(() => Promise.resolve([server]))
+      const makeA = () =>
+        createCollection(
+          persistedCollectionOptions<
+            Row,
+            string | number,
+            never,
+            QueryCollectionUtils<Row, string | number, Row, unknown>
+          >({
+            ...queryCollectionOptions<Row>({
+              id,
+              queryClient,
+              queryKey,
+              queryFn: aQueryFn,
+              getKey: (row) => row.id,
+              syncMode: `on-demand`,
+              staleTime: Infinity,
+              startSync: true,
+            }),
+            persistence: managed,
+          }),
+        )
+      const firstA = makeA()
+      const b = createCollection(
+        queryCollectionOptions<Row>({
+          id: `${id}-b`,
+          queryClient,
+          queryKey,
+          queryFn: bQueryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+      const restart: { collection?: ReturnType<typeof makeA> } = {}
+      cleanups.push(async () => {
+        await restart.collection?.cleanup()
+        await firstA.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+        driver.close()
+      })
+      await firstA._sync.loadSubset({})
+      firstA._sync.unloadSubset({})
+      const callsBeforeWrite =
+        aQueryFn.mock.calls.length + bQueryFn.mock.calls.length
+      await firstA.utils.writeInsert({ id: `x`, name: `Direct` })
+      expect(firstA.get(`x`)?.name).toBe(`Direct`)
+      expect(aQueryFn.mock.calls.length + bQueryFn.mock.calls.length).toBe(
+        callsBeforeWrite,
+      )
+      await b._sync.loadSubset({})
+      await b.utils.refetch({ throwOnError: true })
+      expect(b.get(`x`)?.name).toBe(`Server`)
+      if (cacheEdit)
+        queryClient.setQueryData(queryKey, [
+          { id: `x`, name: `Local cache edit` },
+        ])
+      await firstA.cleanup()
+
+      restart.collection = makeA()
+      const callsBeforeRestartLoad =
+        aQueryFn.mock.calls.length + bQueryFn.mock.calls.length
+      await restart.collection._sync.loadSubset({})
+      expect(aQueryFn.mock.calls.length + bQueryFn.mock.calls.length).toBe(
+        callsBeforeRestartLoad + 1,
+      )
+      expect(restart.collection.get(`x`)?.name).toBe(`Server`)
+    },
+  )
+
+  /**
+   * A fresh persisted Collection can meet a Query cache entry fetched before
+   * its accepted direct write. The shared physical Query stays unchanged
+   * while B owns it: letting A patch that cache would publish A's local row
+   * into B. A's SQLite row nevertheless survives cleanup. Its owner may be
+   * absent (direct insert before A acquired the subset) or retained (direct
+   * update after A acquired it); neither makes the old cache a new fetch.
+   *
+   * The independent reference orders B's server result, A's accepted write,
+   * A's cleanup, and A's next acquisition. The retained cache cannot order
+   * its row against the durable write, so acquisition must request a new
+   * result; that result may replace the durable value. The driver uses a real QueryClient
+   * shared by both Collections and a managed SQLite cache. It checks A and B,
+   * the unchanged Query cache, durable storage after cleanup, request count,
+   * and A's public row when the new acquisition settles. The two histories
+   * distinguish the ownerless-row ambiguity guard from an owned direct
+   * update whose cached Query is equally old.
+   */
+  it.each([`ownerless-insert`, `owned-update`] as const)(
+    `keeps a persisted %s direct row ahead of an older shared Query after restart`,
+    async (rowLifetime) => {
+      type Row = { id: string; name: string }
+      const id = `persisted-old-shared-cache-${rowLifetime}`
+      const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+      const persistence = createNodeSQLitePersistence({
+        database: driver.getDatabase(),
+      })
+      const managed = persistence.resolvePersistenceForCollection!({
+        collectionId: id,
+        mode: `sync-present`,
+      })
+      const queryClient = createQueryClient()
+      const queryKey = [id]
+      const server = { id: `x`, name: `Server` }
+      const direct = { id: `x`, name: `Direct` }
+      const newer = { id: `x`, name: `Newer` }
+      const queryFn = vi
+        .fn(() => Promise.resolve([newer]))
+        .mockResolvedValueOnce([server])
+      const makeA = () =>
+        createCollection(
+          persistedCollectionOptions<
+            Row,
+            string | number,
+            never,
+            QueryCollectionUtils<Row, string | number, Row, unknown>
+          >({
+            ...queryCollectionOptions<Row>({
+              id,
+              queryClient,
+              queryKey,
+              queryFn,
+              getKey: (row) => row.id,
+              syncMode: `on-demand`,
+              staleTime: Infinity,
+              startSync: true,
+            }),
+            persistence: managed,
+          }),
+        )
+      const a = makeA()
+      const b = createCollection(
+        queryCollectionOptions<Row>({
+          id: `${id}-b`,
+          queryClient,
+          queryKey,
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+      let restarted: ReturnType<typeof makeA> | undefined
+      try {
+        await b._sync.loadSubset({})
+        if (rowLifetime === `owned-update`) await a._sync.loadSubset({})
+        else await vi.waitFor(() => expect(a.status).toBe(`ready`))
+        expect(a.get(`x`)?.name).toBe(
+          rowLifetime === `owned-update` ? server.name : undefined,
+        )
+        if (rowLifetime === `owned-update`) await a.utils.writeUpdate(direct)
+        else await a.utils.writeInsert(direct)
+        expect(a.get(`x`)?.name).toBe(direct.name)
+        expect(b.get(`x`)?.name).toBe(server.name)
+        expect(queryClient.getQueryData(queryKey)).toEqual([server])
+        expect(queryFn).toHaveBeenCalledOnce()
+
+        await a.cleanup()
+        const claim = await managed.adapter.claimCacheGeneration!(id)
+        try {
+          const durable = await managed.adapter.loadResumeSnapshot({
+            kind: `managed`,
+            storageCollectionId: claim.storageCollectionId,
+            claimId: claim.claimId,
+          })
+          expect(durable.rows.find((row) => row.key === `x`)?.value).toEqual(
+            direct,
+          )
+        } finally {
+          await managed.adapter.releaseCacheGenerationClaim!(claim.claimId)
+        }
+
+        restarted = makeA()
+        const callsBeforeAcquisition = queryFn.mock.calls.length
+        await restarted._sync.loadSubset({})
+        const newRequests = queryFn.mock.calls.length - callsBeforeAcquisition
+        expect(newRequests).toBe(1)
+        expect(restarted.get(`x`)?.name).toBe(newer.name)
+      } finally {
+        await restarted?.cleanup()
+        await a.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+        driver.close()
+      }
+    },
+  )
+
+  /**
+   * A direct write is an accepted Collection row, not completion of an
+   * unfinished Query request. With a held first fetch, the independent Query
+   * state still has no fetched data after the write. The public Collection
+   * has the accepted row; Query Core must not treat that row as a successful
+   * response to ensureQueryData before the provider answers.
+   */
+  it(`does not turn a pending eager Query into cached fetched data`, async () => {
+    const id = `pending-query-direct-write`
+    const first = createDeferred<Array<Item>>()
+    const { collection, queryClient, queryFn } = createOwnershipFixture({
+      id,
+      syncMode: `eager`,
+      results: [first.promise],
+    })
+    cleanups.push(() => {
+      first.resolve([])
+      return Promise.resolve()
+    })
+    const preload = collection.preload()
+    void preload.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    expect(query.state.status).toBe(`pending`)
+    await collection.utils.writeInsert(shared)
+    expect(collection.has(shared.id)).toBe(true)
+    expect(query.state.data).toBeUndefined()
+    expect(query.state.status).toBe(`pending`)
+    first.resolve([])
+    await preload
+  })
+
+  /**
+   * Disabling the eager Query leaves a valid pending, idle cache entry. The
+   * existing eager cache-seeding contract applies without an in-flight
+   * request: the accepted row enters the raw-row cache. Query must then be
+   * coherent for consumers, while its untouched timestamp still says that
+   * no provider fetch has established freshness. This distinguishes the
+   * legal idle seed from an unfinished request, which cannot be completed by
+   * a direct write. Collection readiness still waits for a provider result.
+   */
+  it(`seeds an idle pending eager Query coherently without marking it fresh`, async () => {
+    type Row = { id: string; name: string }
+    const id = `pending-idle-direct-write`
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([] as Array<Row>))
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `eager`,
+        enabled: false,
+        staleTime: 1_000,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    expect(query.state.status).toBe(`pending`)
+    expect(query.state.fetchStatus).toBe(`idle`)
+    await collection.utils.writeInsert({ id: `x`, name: `Manual` })
+    expect(collection.get(`x`)?.name).toBe(`Manual`)
+    expect(query.state.status).toBe(`success`)
+    expect(query.state.data).toEqual([{ id: `x`, name: `Manual` }])
+    expect(query.state.dataUpdatedAt).toBe(0)
+    expect(query.isStaleByTime(1_000)).toBe(true)
+    expect(queryFn).not.toHaveBeenCalled()
+    expect(collection.status).toBe(`loading`)
+  })
+
+  /**
+   * A direct write may leave a derived response envelope stale, but a later
+   * subset load cannot resolve successfully with no rows when both its cache
+   * and provider contain one. The history loads one row, writes it, retires
+   * its only subset lease, then reacquires the same Query. The independent
+   * response model has one row at load settlement; the Collection must too.
+   */
+  it(`restores a derived selected subset from its cached result after reacquisition`, async () => {
+    const id = `derived-select-reacquisition`
+    const before = { id: `x`, name: `Before` }
+    const response = { edges: [{ node: before }] }
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
+    const collection = createCollection(
+      queryCollectionOptions({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        select: (value: typeof response) =>
+          value.edges.map((edge) => edge.node),
+        getKey: (row: typeof before) => row.id,
+        syncMode: `on-demand`,
+        staleTime: Number.POSITIVE_INFINITY,
+        gcTime: Number.POSITIVE_INFINITY,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    await collection.utils.writeUpdate({ id: before.id, name: `After` })
+    collection._sync.unloadSubset({})
+    expect(collection.has(before.id)).toBe(false)
+    await collection._sync.loadSubset({})
+    expect(collection.has(before.id)).toBe(true)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * Restarted eager sync has the same readiness obligation as a reacquired
+   * subset. A derived cache envelope may remain untouched by a direct write,
+   * but a new sync session must establish its source rows before reporting
+   * ready. The provider returns one row and no post-write refetch is caused by
+   * the write itself; restart may fetch to regain result authority.
+   */
+  it(`restores a derived selected eager result after sync restart`, async () => {
+    const id = `derived-select-eager-restart`
+    const row = { id: `x`, name: `Server` }
+    const response = { edges: [{ node: row }] }
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
+    const collection = createCollection(
+      queryCollectionOptions({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        select: (value: typeof response) =>
+          value.edges.map((edge) => edge.node),
+        getKey: (value: typeof row) => value.id,
+        syncMode: `eager`,
+        staleTime: Infinity,
+        gcTime: Infinity,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    await collection.preload()
+    await collection.utils.writeUpdate({ id: row.id, name: `Manual` })
+    expect(queryFn).toHaveBeenCalledTimes(1)
+    await collection.cleanup()
+    const subscription = collection.subscribeChanges(() => {})
+    cleanups.push(() => Promise.resolve(subscription.unsubscribe()))
+    await collection.stateWhenReady()
+    expect(collection.has(row.id)).toBe(true)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * A fetched source snapshot still owns every row it returned when a direct
+   * write lands during its request. The reference overlays the accepted write
+   * on that snapshot. A derived `select` has no inverse into the cached
+   * envelope, so this checks public rows and initial readiness after the held
+   * fetch settles without requiring a rewritten Query cache response.
+   */
+  it.each([`eager`, `on-demand`] as const)(
+    `applies a derived selected %s fetch that began before a direct write`,
+    async (syncMode) => {
+      type Row = { id: string; name: string }
+      const id = `derived-select-older-fetch-${syncMode}`
+      const fetched = { edges: [{ node: { id: `server`, name: `Fetched` } }] }
+      const gate = createDeferred<typeof fetched>()
+      const queryClient = createQueryClient()
+      const queryFn = vi.fn(() => gate.promise)
+      const collection = createCollection(
+        queryCollectionOptions({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          select: (response: typeof fetched) =>
+            response.edges.map((edge) => edge.node),
+          getKey: (row: Row) => row.id,
+          syncMode,
+          startSync: true,
+        }),
+      )
+      cleanups.push(async () => {
+        gate.resolve(fetched)
+        await collection.cleanup()
+        queryClient.clear()
+      })
+
+      const ready =
+        syncMode === `eager`
+          ? collection.preload()
+          : Promise.resolve(collection._sync.loadSubset({}))
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
+      await collection.utils.writeInsert({ id: `manual`, name: `Written` })
+      gate.resolve(fetched)
+      await vi.waitFor(() =>
+        expect(collection.get(`server`)?.name).toBe(`Fetched`),
+      )
+      await ready
+      expect(
+        Object.fromEntries(
+          Array.from(collection.values(), (row) => [row.id, row.name]),
+        ),
+      ).toEqual({ server: `Fetched`, manual: `Written` })
+      expect(queryFn).toHaveBeenCalledTimes(1)
+    },
+  )
+
+  /**
+   * A deferred refresh barrier prevents a fetched row from becoming public
+   * while an optimistic mutation persists. A direct write to another key
+   * cannot bypass that boundary merely because a derived select has no cache
+   * inverse. The authored response adds a new server row; the independent
+   * public snapshot contains only the direct-written row until release.
+   */
+  it(`holds a derived selected older result behind the refresh barrier`, async () => {
+    const id = `derived-select-held-refresh`
+    const initial = { id: `x`, name: `Before` }
+    const server = { id: `y`, name: `Server` }
+    const response = (rows: Array<typeof initial>) => ({
+      edges: rows.map((node) => ({ node })),
+    })
+    const held = createDeferred<ReturnType<typeof response>>()
+    const barrier = createDeferred<void>()
+    const queryClient = createQueryClient()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce(response([initial]))
+      .mockImplementationOnce(() => held.promise)
+      .mockResolvedValue(response([server]))
+    const collection = createCollection(
+      queryCollectionOptions({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        select: (value: ReturnType<typeof response>) =>
+          value.edges.map((edge) => edge.node),
+        getKey: (row: typeof initial) => row.id,
+        syncMode: `eager`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      held.resolve(response([server]))
+      collection.deferDataRefresh = null
+      barrier.resolve()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.preload()
+    collection.deferDataRefresh = barrier.promise
+    const refetch = collection.utils.refetch({ throwOnError: true })
+    void refetch.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+    await collection.utils.writeUpdate({ id: initial.id, name: `Manual` })
+    held.resolve(response([{ ...initial, name: `Older` }, server]))
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    await vi.waitFor(() => expect(query.state.fetchStatus).toBe(`idle`))
+    for (let turn = 0; turn < 20; turn++) await Promise.resolve()
+    expect(collection.get(initial.id)?.name).toBe(`Manual`)
+    expect(collection.has(server.id)).toBe(false)
+    collection.deferDataRefresh = null
+    barrier.resolve()
+    await refetch.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    await vi.waitFor(() => expect(collection.has(server.id)).toBe(true))
+  })
+
+  /**
+   * A silent cancellation that replaces a Query fetch lets public Collection
+   * refetch callers follow the successor, as Query Core does for its own
+   * `cancelRefetch` path. The reference is the successor's applied row at
+   * both public refetch settlements. A raw QueryClient `fetchQuery` waiter
+   * holds the retryer promise instead and may receive `CancelledError`; that
+   * is Query Core's separate boundary. Holding the first fetch distinguishes
+   * a synchronous replacement from a cancellation awaited before replacement.
+   */
+  it(`settles overlapping explicit refetch callers on the replacement`, async () => {
+    type Row = { id: string; name: string }
+    const id = `overlapping-post-write-refetch`
+    const first = createDeferred<Array<Row>>()
+    const replacement = createDeferred<Array<Row>>()
+    const queryClient = createQueryClient()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([{ id: `x`, name: `Initial` }])
+      .mockImplementationOnce(() => first.promise)
+      .mockImplementation(() => replacement.promise)
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `eager`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      first.resolve([{ id: `x`, name: `Old` }])
+      replacement.resolve([{ id: `x`, name: `Server` }])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.preload()
+    let earlierOutcome = `pending`
+    const earlier = collection.utils.refetch({ throwOnError: true }).then(
+      () => {
+        earlierOutcome = `resolved`
+        return { outcome: earlierOutcome, row: collection.get(`x`)?.name }
+      },
+      (error) => {
+        earlierOutcome = isCancelledError(error) ? `cancelled` : `rejected`
+        return { outcome: earlierOutcome, row: collection.get(`x`)?.name }
+      },
+    )
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+    let externalOutcome = `pending`
+    const external = queryClient
+      .fetchQuery({ queryKey: [id], queryFn, staleTime: 0 })
+      .then(
+        (rows) => {
+          externalOutcome = `resolved`
+          return { outcome: externalOutcome, row: rows[0]?.name }
+        },
+        (error) => {
+          externalOutcome = isCancelledError(error) ? `cancelled` : `rejected`
+          return { outcome: externalOutcome, row: undefined }
+        },
+      )
+    await collection.utils.writeUpdate({ id: `x`, name: `Written` })
+    const later = collection.utils.refetch({ throwOnError: true })
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    expect(earlierOutcome).toBe(`pending`)
+    expect(externalOutcome).toBe(`pending`)
+    replacement.resolve([{ id: `x`, name: `Server` }])
+    await later
+    expect(await earlier).toEqual({ outcome: `resolved`, row: `Server` })
+    expect(await external).toEqual({ outcome: `cancelled`, row: undefined })
+    expect(collection.get(`x`)?.name).toBe(`Server`)
+  })
+
+  /**
+   * A derived selected response has no safe inverse for a direct cache edit.
+   * Its old cached envelope may remain, but remounting a live query without
+   * a new provider result must not replay that envelope over an accepted
+   * direct write. The independent reference keeps the accepted row until a
+   * later fetch; this history observes both the public row and request count
+   * after the live-query subscriber returns.
+   */
+  it(`does not replay an unpatchable eager cache response on resubscribe`, async () => {
+    type Row = { id: string; name: string }
+    const id = `derived-eager-resubscribe`
+    const response = { data: [{ id: `x`, name: `before` }] }
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve(structuredClone(response)))
+    const collection = createCollection(
+      queryCollectionOptions({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        select: (value: typeof response) => value.data.filter(Boolean),
+        getKey: (row: Row) => row.id,
+        syncMode: `eager`,
+        startSync: true,
+      }),
+    )
+    const createLive = () =>
+      createLiveQueryCollection({
+        query: (query) => query.from({ row: collection }),
+      })
+    const first = createLive()
+    const liveQueries = [first]
+    cleanups.push(async () => {
+      await Promise.all(liveQueries.map((query) => query.cleanup()))
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await first.preload()
+    await collection.utils.writeUpdate({ id: `x`, name: `after` })
+    expect(queryClient.getQueryData<typeof response>([id])).toEqual(response)
+    await first.cleanup()
+    const second = createLive()
+    liveQueries.push(second)
+    await second.preload()
+    expect(collection.get(`x`)?.name).toBe(`after`)
+    expect(queryFn).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * An outside Query observer may retain an inactive A cache with an older
+   * row. The Collection row is independently held by active subset B. A
+   * direct update changes that public row; remounting A and then releasing B
+   * must not restore the old value. The retained cache is allowed to stay
+   * stale, so this checks the ownership boundary rather than requiring a
+   * cache patch the Collection cannot safely infer.
+   */
+  it(`keeps a direct row when a foreign-retained subset remounts`, async () => {
+    type Row = { id: string; name: string; category: string }
+    const id = `foreign-retained-subset-remount`
+    const queryClient = createQueryClient()
+    const initial = { id: `x`, name: `before`, category: `A` }
+    const queryFn = vi.fn(() => Promise.resolve([{ ...initial }]))
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    const a = { where: eq(new IR.PropRef([`category`]), `A`) }
+    const b = { where: eq(new IR.PropRef([`id`]), `x`) }
+    let unsubscribe = () => {}
+    cleanups.push(async () => {
+      unsubscribe()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    await collection._sync.loadSubset(a)
+    const aQuery = queryClient.getQueryCache().findAll({ queryKey: [id] })[0]!
+    await collection._sync.loadSubset(b)
+    const foreign = new QueryObserver(queryClient, {
+      queryKey: aQuery.queryKey,
+      queryFn,
+      staleTime: Infinity,
+      retry: false,
+    })
+    unsubscribe = foreign.subscribe(() => {})
+    collection._sync.unloadSubset(a)
+    await collection.utils.writeUpdate({ id: `x`, name: `after` })
+    expect(
+      queryClient.getQueryData<Array<Row>>(aQuery.queryKey)?.[0]?.name,
+    ).toBe(`before`)
+    await collection._sync.loadSubset(a)
+    collection._sync.unloadSubset(b)
+    expect(collection.get(`x`)?.name).toBe(`after`)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * A Query observer can retain a listener after its last subset lease ends.
+   * The independent row rule is that an accepted direct update wins until a
+   * newer provider result arrives. Keep that observer alive, update the row,
+   * then reacquire the subset without a new request. Both its cached and
+   * public row must reflect the write at that checkpoint.
+   */
+  it(`patches a zero-lease observer retained by a listener`, async () => {
+    type Row = { id: string; name: string }
+    const id = `listener-retained-direct-write`
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([{ id: `x`, name: `before` }]))
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+        staleTime: Number.POSITIVE_INFINITY,
+      }),
+    )
+    let releaseListener = () => {}
+    cleanups.push(async () => {
+      releaseListener()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    const observer = query.observers[0]!
+    releaseListener = observer.subscribe(() => {})
+    collection._sync.unloadSubset({})
+    await collection.utils.writeUpdate({ id: `x`, name: `after` })
+    expect(query.state.data).toEqual([{ id: `x`, name: `after` }])
+    await collection._sync.loadSubset({})
+    expect(collection.get(`x`)?.name).toBe(`after`)
+    expect(queryFn).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * A fetched result may have reached the Query cache while its persisted
+   * baseline scan still holds Collection application. Its new row has no
+   * committed owner yet. A direct write to that row must patch the provisional
+   * cache entry before any later cache replay; the independent reference
+   * overlays the accepted write on the fetched row at this held checkpoint.
+   */
+  it(`patches a provisional cached row while its result application waits`, async () => {
+    const id = `pending-result-cache-patch`
+    const queryHash = hashKey([id])
+    const before = { ...shared, name: `Before` }
+    const provisional = { id: `new`, category: `shared`, name: `Older` }
+    const manual = { ...provisional, name: `Manual` }
+    const scan =
+      createDeferred<
+        Array<{ key: string | number; value: Item; metadata?: unknown }>
+      >()
+    const scanPersistedRows = vi.fn(() => scan.promise)
+    const { collection, queryClient, queryFn } = createOwnershipFixture({
+      id,
+      results: [[before], [provisional]],
+      scanPersistedRows,
+    })
+    cleanups.push(() => {
+      scan.resolve([])
+      return Promise.resolve()
+    })
+    await collection._sync.loadSubset({})
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    const foreign = new QueryObserver(queryClient, {
+      queryKey: [id],
+      queryFn,
+      staleTime: Infinity,
+    })
+    const release = foreign.subscribe(() => {})
+    cleanups.push(() => Promise.resolve(release()))
+    collection._sync.unloadSubset({})
+    await collection.utils.writeDelete(before.id)
+    collection._state.syncedCollectionMetadata.set(
+      `queryCollection:gc:${queryHash}`,
+      {
+        queryHash,
+        mode: `until-revalidated`,
+      },
+    )
+    const load = Promise.resolve(collection._sync.loadSubset({ refetch: true }))
+    void load.catch(() => undefined)
+    await vi.waitFor(() => expect(query.state.data).toEqual([provisional]))
+    expect(scanPersistedRows).toHaveBeenCalled()
+    await collection.utils.writeUpsert(manual)
+    expect(query.state.data).toEqual([manual])
+    scan.resolve([])
+    await load
+    expect(collection.get(manual.id)?.name).toBe(`Manual`)
+  })
+
+  /**
+   * A fetch-start position is needed only while its subset observer remains
+   * live. The reference count after retiring eight distinct subset leases is
+   * zero. Instrument maps receiving this fixture's unique Query hashes,
+   * distinguish fetch positions by their distinct values across eight
+   * requests, then compare retained entries after every subset unloads.
+   */
+  it(`retires fetch-start positions with their subset observers`, async () => {
+    type Row = { id: string }
+    const id = `fetch-start-retirement`
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => Promise.resolve([] as Array<Row>))
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const originals = Map.prototype.set
+    const stamped = new Set<Map<unknown, unknown>>()
+    const setSpy = vi.spyOn(Map.prototype, `set`).mockImplementation(function (
+      this: Map<unknown, unknown>,
+      key: unknown,
+      value: unknown,
+    ) {
+      if (
+        typeof key === `string` &&
+        key.includes(id) &&
+        typeof value === `number`
+      ) {
+        stamped.add(this)
+      }
+      return originals.call(this, key, value)
+    })
+    const demands = Array.from({ length: 8 }, (_, index) => ({
+      where: eq(new IR.PropRef([`id`]), String(index)),
+    }))
+    try {
+      for (const demand of demands) await collection._sync.loadSubset(demand)
+    } finally {
+      setSpy.mockRestore()
+    }
+    const fetchStarts = [...stamped].find((map) => {
+      const positions = demands.map((demand) =>
+        map.get(hashKey([id, getLoadSubsetDemandKey(demand)])),
+      )
+      return (
+        positions.every((position) => typeof position === `number`) &&
+        new Set(positions).size === demands.length
+      )
+    })
+    expect(fetchStarts).toBeDefined()
+    expect(
+      [...fetchStarts!.keys()].filter((key) => String(key).includes(id)),
+    ).toHaveLength(8)
+    for (const demand of demands) collection._sync.unloadSubset(demand)
+    expect(
+      [...fetchStarts!.keys()].filter((key) => String(key).includes(id)),
+    ).toHaveLength(0)
+  })
+
+  /**
+   * Persisted retention may keep an unfinished Query after its final observer
+   * lease ends. Its fetch-start position must survive that interval so a later
+   * lease can compare the request with a direct write. Once the detached fetch
+   * settles or its Query leaves the cache, no request can reuse that position.
+   * The reference holds one position at unload and zero at either terminal
+   * checkpoint. The driver records the same map as the retirement witness.
+   */
+  it.each([`settlement`, `cache removal`] as const)(
+    `retires a persisted Query's fetch-start position after detached %s`,
+    async (ending) => {
+      const id = `retained-fetch-start-retirement`
+      const queryHash = hashKey([id])
+      const pending = createDeferred<Array<Item>>()
+      const { collection, queryClient, queryFn } = createOwnershipFixture({
+        id,
+        results: [pending.promise],
+        persistedGcTime: Number.POSITIVE_INFINITY,
+        scanPersistedRows: () => Promise.resolve([]),
+      })
+      const originalSet = Map.prototype.set
+      const stamped = new Set<Map<unknown, unknown>>()
+      const setSpy = vi
+        .spyOn(Map.prototype, `set`)
+        .mockImplementation(function (
+          this: Map<unknown, unknown>,
+          key: unknown,
+          value: unknown,
+        ) {
+          if (key === queryHash && typeof value === `number`) stamped.add(this)
+          return originalSet.call(this, key, value)
+        })
+      const load = Promise.resolve(collection._sync.loadSubset({}))
+      void load.catch(() => undefined)
+      try {
+        await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
+      } finally {
+        setSpy.mockRestore()
+      }
+      const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+      collection._sync.unloadSubset({})
+      expect(query.state.fetchStatus).toBe(`fetching`)
+      const fetchStarts = [...stamped].find(
+        (map) =>
+          typeof map.get(queryHash) === `number` &&
+          Number.isFinite(map.get(queryHash)) &&
+          map.get(queryHash) !== 0,
+      )
+      expect(fetchStarts).toBeDefined()
+      expect(fetchStarts!.has(queryHash)).toBe(true)
+      if (ending === `settlement`) {
+        pending.resolve([])
+        await vi.waitFor(() => expect(query.state.fetchStatus).toBe(`idle`))
+      } else {
+        queryClient.removeQueries({ queryKey: [id], exact: true })
+      }
+      expect(fetchStarts!.has(queryHash)).toBe(false)
+      pending.resolve([])
+      await load.catch(() => undefined)
+    },
+  )
+
+  /**
+   * An explicit refetch after a direct write asks the provider for a result
+   * newer than that write. The reference is request order: a request begun
+   * before the write cannot discharge the later refetch, even when Query Core
+   * has no cached data and would normally reuse the pending request. The
+   * legal history holds the initial request, writes a row, deletes it, then
+   * refetches. At settlement, the public row set must equal the second
+   * provider response and the provider must have received two requests.
+   */
+  it(`starts a post-write request for explicit refetch during an empty-cache fetch`, async () => {
+    type Row = { id: string; name: string }
+    const id = `post-write-explicit-refetch`
+    const first = createDeferred<Array<Row>>()
+    const started = createDeferred<void>()
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => {
+      if (queryFn.mock.calls.length === 1) {
+        started.resolve()
+        return first.promise
+      }
+      return Promise.resolve([] as Array<Row>)
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      first.resolve([])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection.utils.writeInsert({ id: `x`, name: `local` })
+    const load = Promise.resolve(collection._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    await started.promise
+    await collection.utils.writeDelete(`x`)
+    const refetch = collection.utils.refetch({ throwOnError: true })
+    first.resolve([{ id: `x`, name: `stale` }])
+    await refetch
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(collection.has(`x`)).toBe(false)
+    await load.catch(() => undefined)
+  })
+
+  /**
+   * An explicit subset refetch has the same post-write request-order promise
+   * as utils.refetch. The first empty-cache request begins before a direct
+   * delete; a second load with `refetch: true` must start a newer request.
+   * At that load's settlement, the public row reflects the newer response.
+   */
+  it(`starts a post-write request for an explicit subset refetch`, async () => {
+    const id = `subset-post-write-refetch`
+    const first = createDeferred<Array<Item>>()
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [first.promise, []],
+    })
+    await collection.utils.writeInsert(shared)
+    const initialLoad = Promise.resolve(collection._sync.loadSubset({}))
+    void initialLoad.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
+    await collection.utils.writeDelete(shared.id)
+    const refetchLoad = Promise.resolve(
+      collection._sync.loadSubset({ refetch: true }),
+    )
+    first.resolve([{ ...shared, name: `Stale` }])
+    await refetchLoad
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(collection.has(shared.id)).toBe(false)
+    await initialLoad.catch(() => undefined)
+  })
+
+  /**
+   * A deferred refresh is scheduled when a successful cached result is
+   * refetching while the barrier is held. After a direct delete, releasing the
+   * barrier starts a newer request. The independent request-order rule needs
+   * that third provider call before the older refetch is allowed to settle.
+   */
+  it(`starts a post-write request when a deferred refresh barrier releases`, async () => {
+    const id = `deferred-post-write-refetch`
+    const older = createDeferred<Array<Item>>()
+    const barrier = createDeferred<void>()
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      results: [[shared], older.promise, []],
+    })
+    const release = barrier.promise.then(() => {
+      collection.deferDataRefresh = null
+    })
+    cleanups.push(() => {
+      older.resolve([])
+      barrier.resolve()
+      return Promise.resolve()
+    })
+    await collection._sync.loadSubset({})
+    collection.deferDataRefresh = barrier.promise
+    const refetch = collection.utils.refetch({ throwOnError: true })
+    void refetch.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+    await collection.utils.writeDelete(shared.id)
+    barrier.resolve()
+    await release
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    older.resolve([{ ...shared, name: `Stale` }])
+    await refetch.catch(() => undefined)
+    expect(collection.has(shared.id)).toBe(false)
+  })
+
+  /**
+   * Retiring a subset can retain its persisted rows while Query Core keeps an
+   * unfinished, empty-cache request. Reacquiring that subset does not make the
+   * old request newer. The reference is request order: after an accepted direct
+   * delete, an explicit refetch must start a post-write request, and its public
+   * settlement must observe that request's rows. Without a later write, the
+   * refetch may reuse the request. Hold it across unload and reacquisition in
+   * both histories to distinguish this from an ordinary active fetch. This
+   * controlled Query Core driver does not model a native SQLite adapter.
+   */
+  it.each([
+    {
+      name: `starts a post-write refetch after reacquiring a retained in-flight Query`,
+      writeAfterStart: true,
+      requestCount: 2,
+    },
+    {
+      name: `reuses a retained in-flight Query without a later write`,
+      writeAfterStart: false,
+      requestCount: 1,
+    },
+  ])(`$name`, async ({ writeAfterStart, requestCount }) => {
+    const id = `retained-post-write-refetch`
+    const stale = { ...shared, name: `Stale` }
+    const first = createDeferred<Array<Item>>()
+    const { collection, queryClient, queryFn } = createOwnershipFixture({
+      id,
+      results: [first.promise, []],
+      persistedGcTime: Number.POSITIVE_INFINITY,
+      scanPersistedRows: () => Promise.resolve([]),
+    })
+
+    await collection.utils.writeInsert(shared)
+    const initialLoad = Promise.resolve(collection._sync.loadSubset({}))
+    void initialLoad.catch(() => undefined)
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(1))
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    collection._sync.unloadSubset({})
+    expect(query.state.fetchStatus).toBe(`fetching`)
+    expect(query.getObserversCount()).toBe(0)
+
+    const reacquiredLoad = Promise.resolve(collection._sync.loadSubset({}))
+    void reacquiredLoad.catch(() => undefined)
+    expect(queryClient.getQueryCache().find({ queryKey: [id] })).toBe(query)
+    expect(queryFn).toHaveBeenCalledTimes(1)
+    if (writeAfterStart) await collection.utils.writeDelete(shared.id)
+    const refetch = collection.utils.refetch({ throwOnError: true })
+    first.resolve([stale])
+    await refetch
+    expect(queryFn).toHaveBeenCalledTimes(requestCount)
+    if (writeAfterStart) expect(collection.has(shared.id)).toBe(false)
+    await Promise.allSettled([initialLoad, reacquiredLoad])
+  })
+
+  /**
+   * A Query can keep fetching after ordinary subset cleanup when an outside
+   * observer still owns it. That request began before a later direct delete.
+   * Reacquisition cannot promote it above the delete. The request-order model
+   * keeps the deletion when the old result settles; an explicit refetch must
+   * instead start a new request. Both histories observe the public row at
+   * their load or refetch settlement checkpoint.
+   */
+  it.each([`old result`, `explicit refetch`] as const)(
+    `preserves a direct delete across ordinary unload and reacquisition: %s`,
+    async (ending) => {
+      const id = `ordinary-unload-post-write-${ending}`
+      const stale = { ...shared, name: `Stale` }
+      const first = createDeferred<Array<Item>>()
+      const { collection, queryClient, queryFn } = createOwnershipFixture({
+        id,
+        results: [first.promise, []],
+      })
+      await collection.utils.writeInsert(shared)
+      const initialLoad = Promise.resolve(collection._sync.loadSubset({}))
+      void initialLoad.catch(() => undefined)
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledOnce())
+      const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+      const foreign = new QueryObserver(queryClient, {
+        queryKey: [id],
+        queryFn,
+        staleTime: Number.POSITIVE_INFINITY,
+      })
+      const unsubscribe = foreign.subscribe(() => {})
+      cleanups.push(() => {
+        unsubscribe()
+        return Promise.resolve()
+      })
+      collection._sync.unloadSubset({})
+      expect(query.state.fetchStatus).toBe(`fetching`)
+      expect(query.getObserversCount()).toBe(1)
+      await collection.utils.writeDelete(shared.id)
+      const reacquiredLoad = Promise.resolve(collection._sync.loadSubset({}))
+      void reacquiredLoad.catch(() => undefined)
+      expect(queryClient.getQueryCache().find({ queryKey: [id] })).toBe(query)
+
+      if (ending === `explicit refetch`) {
+        const refetch = collection.utils.refetch({ throwOnError: true })
+        first.resolve([stale])
+        await refetch
+        expect(queryFn).toHaveBeenCalledTimes(2)
+      } else {
+        first.resolve([stale])
+      }
+      await reacquiredLoad
+      expect(collection.has(shared.id)).toBe(false)
+      await initialLoad.catch(() => undefined)
+    },
+  )
+
+  /**
+   * A fetched result and accepted direct writes form a per-key ordered merge.
+   * The independent reference overlays writes accepted after fetch start onto
+   * fetched rows, but does not add unrelated keys to an on-demand scope. This
+   * history covers a previously owned row, a held explicit refetch, a later
+   * direct update, and an unrelated direct insert. The Collection rows and Query cache are compared when
+   * the refetch settles; the eager sibling above covers the other sync mode.
+   */
+  it(`keeps a later on-demand direct update over an older refetch row`, async () => {
+    type Row = { id: string; name: string }
+    const id = `on-demand-older-fetch-write`
+    const held = createDeferred<Array<Row>>()
+    const started = createDeferred<void>()
+    const queryClient = createQueryClient()
+    const queryFn = vi.fn(() => {
+      if (queryFn.mock.calls.length === 1)
+        return Promise.resolve([{ id: `x`, name: `before` }])
+      started.resolve()
+      return held.promise
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      held.resolve([])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    const refetch = collection.utils.refetch({ throwOnError: true })
+    await started.promise
+    await collection.utils.writeUpdate({ id: `x`, name: `after` })
+    await collection.utils.writeInsert({ id: `y`, name: `outside scope` })
+    held.resolve([{ id: `x`, name: `before` }])
+    await refetch
+    expect(collection.get(`x`)?.name).toBe(`after`)
+    expect(collection.get(`y`)?.name).toBe(`outside scope`)
+    expect(queryClient.getQueryData<Array<Row>>([id])).toEqual([
+      { id: `x`, name: `after` },
+    ])
+  })
+
+  /**
+   * A cached row with a subset owner does not give a later local cache edit
+   * server authority over an accepted direct update. The independent order
+   * has four values: fetched Server, A's Manual write, a QueryClient-only
+   * cache edit, then a new provider fetch. The edit is visible to B through
+   * its Query observer, but A keeps Manual until the final fetch starts after
+   * the write and returns Newer. This crosses the owned-row state omitted by
+   * the ownerless shared-cache histories. The real QueryClient drives both
+   * Collections; public rows and provider calls are checked after the edit
+   * and after the optional fetch. The neighboring fetch history rejects a
+   * repair that permanently shields A from server results.
+   */
+  it.each([
+    { history: `local-cache-edit`, fetchAfterEdit: false },
+    { history: `newer-provider-fetch`, fetchAfterEdit: true },
+  ])(
+    `keeps owned direct-row authority across $history`,
+    async ({ fetchAfterEdit }) => {
+      type Row = { id: string; name: string }
+      const id = `owned-direct-cache-edit-${fetchAfterEdit}`
+      const queryClient = createQueryClient()
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
+        .mockResolvedValue([{ id: `x`, name: `Newer` }])
+      const makeCollection = (suffix: string) =>
+        createCollection(
+          queryCollectionOptions<Row>({
+            id: `${id}-${suffix}`,
+            queryClient,
+            queryKey: [id],
+            queryFn,
+            getKey: (row) => row.id,
+            syncMode: `on-demand`,
+            staleTime: Infinity,
+            startSync: true,
+          }),
+        )
+      const a = makeCollection(`a`)
+      const b = makeCollection(`b`)
+      cleanups.push(async () => {
+        await a.cleanup()
+        await b.cleanup()
+        queryClient.clear()
+      })
+
+      await a._sync.loadSubset({})
+      await b._sync.loadSubset({})
+      expect(queryFn).toHaveBeenCalledOnce()
+      await a.utils.writeUpdate({ id: `x`, name: `Manual` })
+      expect(a.get(`x`)?.name).toBe(`Manual`)
+      expect(b.get(`x`)?.name).toBe(`Server`)
+
+      queryClient.setQueryData([id], [{ id: `x`, name: `Local edit` }])
+      await vi.waitFor(() => expect(b.get(`x`)?.name).toBe(`Local edit`))
+      expect(queryFn).toHaveBeenCalledOnce()
+      if (!fetchAfterEdit) {
+        expect(a.get(`x`)?.name).toBe(`Manual`)
+        return
+      }
+
+      await b.utils.refetch({ throwOnError: true })
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(a.get(`x`)?.name).toBe(`Newer`)
+      expect(b.get(`x`)?.name).toBe(`Newer`)
+    },
+  )
+
+  /**
+   * Starting a newer physical fetch does not publish its answer. While that
+   * request is held, a manual Query cache edit remains local and cannot
+   * replace A's accepted direct row. The independent reference orders the
+   * direct write, fetch start, local edit, and fetch result separately. The
+   * held cut distinguishes fetch-start authority from result authority; the
+   * final cut admits the actual newer server row.
+   */
+  it(`keeps an owned direct row through a local cache edit during a held fetch`, async () => {
+    type Row = { id: string; name: string }
+    const id = `owned-direct-held-fetch-cache-edit`
+    const queryClient = createQueryClient()
+    const held = createDeferred<Array<Row>>()
+    const requestStarted = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
+      .mockImplementationOnce(() => {
+        requestStarted.resolve()
+        return held.promise
+      })
+    const makeCollection = (suffix: string) =>
+      createCollection(
+        queryCollectionOptions<Row>({
+          id: `${id}-${suffix}`,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode: `on-demand`,
+          staleTime: Infinity,
+          startSync: true,
+        }),
+      )
+    const a = makeCollection(`a`)
+    const b = makeCollection(`b`)
+    cleanups.push(async () => {
+      held.resolve([{ id: `x`, name: `Newer` }])
+      await a.cleanup()
+      await b.cleanup()
+      queryClient.clear()
+    })
+
+    await a._sync.loadSubset({})
+    await b._sync.loadSubset({})
+    await a.utils.writeUpdate({ id: `x`, name: `Manual` })
+    const refetch = b.utils.refetch({ throwOnError: true })
+    await requestStarted.promise
+    queryClient.setQueryData([id], [{ id: `x`, name: `Local edit` }])
+    await vi.waitFor(() => expect(b.get(`x`)?.name).toBe(`Local edit`))
+    expect(queryFn).toHaveBeenCalledTimes(2)
+    expect(a.get(`x`)?.name).toBe(`Manual`)
+
+    held.resolve([{ id: `x`, name: `Newer` }])
+    await refetch
+    expect(a.get(`x`)?.name).toBe(`Newer`)
+    expect(b.get(`x`)?.name).toBe(`Newer`)
+  })
+
+  /**
+   * A local cache edit still lacks server authority after A releases and
+   * reacquires its sole subset. The direct update owned that subset, so its
+   * row retires on unload; the retained Query cache then contains a manual
+   * edit that cannot establish a new owned row. The independent reference
+   * requires a physical result before load settlement. An outside Query
+   * observer keeps the cache alive, and the held-request checkpoint rejects
+   * treating the manual edit as a successful fetch.
+   */
+  it(`revalidates a sole owner's manually edited cache on reacquisition`, async () => {
+    type Row = { id: string; name: string }
+    const id = `owned-direct-manual-cache-reacquisition`
+    const queryClient = createQueryClient()
+    const queryKey = [id]
+    const newer = { id: `x`, name: `Newer` }
+    const held = createDeferred<Array<Row>>()
+    const requestStarted = createDeferred<void>()
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([{ id: `x`, name: `Server` }])
+      .mockImplementationOnce(() => {
+        requestStarted.resolve()
+        return held.promise
+      })
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey,
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        staleTime: Infinity,
+        startSync: true,
+      }),
+    )
+    const outside = new QueryObserver(queryClient, {
+      queryKey,
+      queryFn,
+      enabled: false,
+      staleTime: Infinity,
+    })
+    const unsubscribeOutside = outside.subscribe(() => {})
+    cleanups.push(async () => {
+      held.resolve([newer])
+      unsubscribeOutside()
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    await collection.utils.writeUpdate({ id: `x`, name: `Manual` })
+    queryClient.setQueryData(queryKey, [{ id: `x`, name: `Local edit` }])
+    expect(collection.get(`x`)?.name).toBe(`Manual`)
+    collection._sync.unloadSubset({})
+    expect(collection.has(`x`)).toBe(false)
+    const load = Promise.resolve(collection._sync.loadSubset({}))
+    void load.catch(() => undefined)
+    expect(
+      await Promise.race([
+        load.then(
+          () => `settled`,
+          () => `rejected`,
+        ),
+        requestStarted.promise.then(() => `request-started`),
+      ]),
+    ).toBe(`request-started`)
+    expect(collection.has(`x`)).toBe(false)
+    held.resolve([newer])
+    await load
+    expect(collection.get(`x`)?.name).toBe(newer.name)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+  })
+
+  /**
+   * A direct cache edit is a notification, not a Query result. Its independent
+   * reference keeps the last fetch error and Query's invalidation/freshness
+   * metadata while replacing only an already cached row. The grammar here
+   * covers an error, a pending invalidation, and an expired timestamp; the checkpoints are
+   * Collection utilities, Query cache state, and the accepted Collection row.
+   */
+  it.each(
+    ([`eager`, `on-demand`] as const).flatMap((syncMode) =>
+      ([`error`, `invalidation`, `stale`] as const).map((cut) => ({
+        syncMode,
+        cut,
+      })),
+    ),
+  )(
+    `preserves Query $cut state across a $syncMode direct cache patch`,
+    async ({ syncMode, cut }) => {
+      type Row = { id: string; name: string }
+      const id = `direct-cache-${cut}`
+      const queryClient = createQueryClient(false, 1000)
+      const fetchError = new Error(`fetch failed`)
+      const queryFn = vi
+        .fn()
+        .mockResolvedValueOnce([{ id: `x`, name: `before` }])
+        .mockRejectedValueOnce(fetchError)
+      const collection = createCollection(
+        queryCollectionOptions<Row>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (row) => row.id,
+          syncMode,
+          startSync: true,
+        }),
+      )
+      cleanups.push(async () => {
+        await collection.cleanup()
+        queryClient.clear()
+      })
+      if (syncMode === `eager`) await collection.preload()
+      else await collection._sync.loadSubset({})
+      const query = queryClient
+        .getQueryCache()
+        .find({ queryKey: [id], exact: true })!
+      if (cut === `error`) {
+        await collection.utils.refetch()
+        expect(reportedError(collection)).toBe(fetchError)
+      } else {
+        if (cut === `invalidation`) {
+          await queryClient.invalidateQueries({
+            queryKey: [id],
+            exact: true,
+            refetchType: `none`,
+          })
+          expect(query.state.isInvalidated).toBe(true)
+        } else {
+          query.setState({ dataUpdatedAt: Date.now() - 60_000 })
+          expect(query.isStale()).toBe(true)
+        }
+      }
+      const updatedAt = query.state.dataUpdatedAt
+      await collection.utils.writeUpdate({ id: `x`, name: `after` })
+      expect(collection.get(`x`)?.name).toBe(`after`)
+      expect(query.state.dataUpdatedAt).toBe(updatedAt)
+      if (cut === `error`) {
+        expect(reportedError(collection)).toBe(fetchError)
+        expect(reportedError(collection)).toBeDefined()
+      } else if (cut === `invalidation`) {
+        expect(query.state.isInvalidated).toBe(true)
+      } else {
+        expect(query.isStale()).toBe(true)
+      }
+    },
+  )
+
+  /**
+   * A Query Core hash may coalesce equivalent subset predicates into one
+   * physical Query while DB retains two logical subset demands. A response
+   * from a fetch started before an accepted direct write cannot undo that
+   * write's key, whichever logical demand observed the fetch. A response from
+   * a later fetch may replace it. The reference is the order of the authored
+   * fetches and write, independent of the Query cache's chosen first key.
+   *
+   * The legal history uses `id = x` and `id IN [x]`, which have equal row
+   * meaning but distinct demand keys. The real QueryClient coalesces them by
+   * a custom hash. The public row is compared after the write, after the held
+   * older result applies, and after a post-write result applies. The provider
+   * call count proves each requested fetch ran.
+   */
+  it(`preserves a direct write across an older aliased Query fetch`, async () => {
+    type Row = { id: string; name: string }
+    const id = `aliased-fetch-write-order`
+    const older = createDeferred<Array<Row>>()
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+          staleTime: Infinity,
+          gcTime: Infinity,
+          queryKeyHashFn: () => `equivalent-subset-query`,
+        },
+      },
+    })
+    const before = { id: `x`, name: `Before` }
+    const manual = { id: `x`, name: `Manual` }
+    const newer = { id: `x`, name: `Newer` }
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce([before])
+      .mockImplementationOnce(() => older.promise)
+      .mockResolvedValue([newer])
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      older.resolve([])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const a = { where: eq(new IR.PropRef([`id`]), `x`) }
+    const b = {
+      where: new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`x`])]),
+    }
+    expect(getLoadSubsetDemandKey(a)).not.toBe(getLoadSubsetDemandKey(b))
+
+    await collection._sync.loadSubset(a)
+    await collection._sync.loadSubset({ ...b, refetch: true })
+    expect(collection.get(`x`)?.name).toBe(before.name)
+    const held = collection._sync.loadSubset({ ...b, refetch: true })
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    await collection.utils.writeUpdate(manual)
+    expect(collection.get(`x`)?.name).toBe(manual.name)
+
+    older.resolve([{ id: `x`, name: `Older` }])
+    await held
+    expect(collection.get(`x`)?.name).toBe(manual.name)
+
+    await collection._sync.loadSubset({ ...b, refetch: true })
+    expect(queryFn).toHaveBeenCalledTimes(4)
+    expect(collection.get(`x`)?.name).toBe(newer.name)
+  })
+
+  /**
+   * The physical Query may start fetching before a second equivalent logical
+   * demand attaches. That demand did not observe the fetch event, but its
+   * result is still older than a later accepted direct write. The independent
+   * reference orders the held fetch before the write and preserves `Manual`
+   * for both demands at result settlement. A later fetch remains authoritative.
+   * This history distinguishes joining an in-flight Query from observing a
+   * fetch that starts after both logical demands are attached.
+   */
+  it(`preserves a direct write when an aliased demand joins an in-flight fetch`, async () => {
+    type Row = { id: string; name: string }
+    const id = `aliased-join-in-flight-fetch`
+    const older = createDeferred<Array<Row>>()
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+          staleTime: Infinity,
+          gcTime: Infinity,
+          queryKeyHashFn: () => `aliased-join-query`,
+        },
+      },
+    })
+    const before = { id: `x`, name: `Before` }
+    const manual = { id: `x`, name: `Manual` }
+    const newer = { id: `x`, name: `Newer` }
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([before])
+      .mockImplementationOnce(() => older.promise)
+      .mockResolvedValue([newer])
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      older.resolve([])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const a = { where: eq(new IR.PropRef([`id`]), `x`) }
+    const b = {
+      where: new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`x`])]),
+    }
+    expect(getLoadSubsetDemandKey(a)).not.toBe(getLoadSubsetDemandKey(b))
+
+    await collection._sync.loadSubset(a)
+    expect(collection.get(`x`)?.name).toBe(before.name)
+    const held = collection._sync.loadSubset({ ...a, refetch: true })
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+    const joining = collection._sync.loadSubset(b)
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    await vi.waitFor(() => expect(query.getObserversCount()).toBe(2))
+    await collection.utils.writeUpdate(manual)
+    expect(collection.get(`x`)?.name).toBe(manual.name)
+
+    older.resolve([{ id: `x`, name: `Older` }])
+    await Promise.all([held, joining])
+    expect(collection.get(`x`)?.name).toBe(manual.name)
+    expect(queryFn).toHaveBeenCalledTimes(2)
+
+    await collection._sync.loadSubset({ ...b, refetch: true })
+    expect(queryFn).toHaveBeenCalledTimes(3)
+    expect(collection.get(`x`)?.name).toBe(newer.name)
+  })
+
+  /**
+   * Two equivalent demands share a physical Query. A direct write lands while
+   * its first refetch is held. A later physical refetch starts after the write,
+   * then the demand whose key Query Core uses retires. The remaining demand
+   * did not run the Query function, but the new fetch is authoritative for
+   * its row. The independent reference uses the authored fetch/write order:
+   * `Newer` must replace `Manual` when the replacement result applies. This
+   * distinguishes fetch-event propagation from attach-time initialization.
+   */
+  it(`applies a post-write fetch to an aliased demand after its peer retires`, async () => {
+    type Row = { id: string; name: string }
+    const id = `aliased-peer-retires-after-fetch-start`
+    const older = createDeferred<Array<Row>>()
+    const replacement = createDeferred<Array<Row>>()
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+          staleTime: Infinity,
+          gcTime: Infinity,
+          queryKeyHashFn: () => `aliased-peer-retirement-query`,
+        },
+      },
+    })
+    const before = { id: `x`, name: `Before` }
+    const manual = { id: `x`, name: `Manual` }
+    const newer = { id: `x`, name: `Newer` }
+    const queryFn = vi
+      .fn()
+      .mockResolvedValueOnce([before])
+      .mockImplementationOnce(() => older.promise)
+      .mockImplementationOnce(() => replacement.promise)
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      older.resolve([])
+      replacement.resolve([])
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const a = { where: eq(new IR.PropRef([`id`]), `x`) }
+    const b = {
+      where: new IR.Func(`in`, [new IR.PropRef([`id`]), new IR.Value([`x`])]),
+    }
+    expect(getLoadSubsetDemandKey(a)).not.toBe(getLoadSubsetDemandKey(b))
+
+    await collection._sync.loadSubset(b)
+    await collection._sync.loadSubset(a)
+    expect(collection.get(`x`)?.name).toBe(before.name)
+    const query = queryClient.getQueryCache().find({ queryKey: [id] })!
+    expect(query.getObserversCount()).toBe(2)
+    const held = queryClient.refetchQueries({
+      predicate: (candidate) => candidate === query,
+    })
+    void held.catch(() => {})
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+    expect(query.state.fetchStatus).toBe(`fetching`)
+    await collection.utils.writeUpdate(manual)
+    expect(collection.get(`x`)?.name).toBe(manual.name)
+
+    const postWrite = queryClient.refetchQueries({
+      predicate: (candidate) => candidate === query,
+    })
+    await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(3))
+    collection._sync.unloadSubset(b)
+    expect(query.getObserversCount()).toBe(1)
+    expect(collection.get(`x`)?.name).toBe(manual.name)
+
+    replacement.resolve([newer])
+    await postWrite
+    await vi.waitFor(() => expect(collection.get(`x`)?.name).toBe(newer.name))
+    older.resolve([{ id: `x`, name: `Older` }])
+    await held.catch(() => {})
+    expect(collection.get(`x`)?.name).toBe(newer.name)
+    expect(queryFn).toHaveBeenCalledTimes(3)
+  })
+
+  /**
+   * One physical Query has one cache-patch obligation per direct write. Two
+   * distinct subset demands may alias the same Query under a custom Query
+   * hash. The model counts physical Queries, not logical demand hashes. The
+   * driver observes Query cache notifications and the public row after one write.
+   */
+  it(`patches a shared physical Query once per direct write`, async () => {
+    type Row = { id: string; name: string; category: string }
+    const id = `shared-physical-query-write`
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+          staleTime: Infinity,
+          gcTime: Infinity,
+          queryKeyHashFn: () => `shared-physical-query`,
+        },
+      },
+    })
+    const queryFn = vi.fn(() =>
+      Promise.resolve([{ id: `x`, name: `before`, category: `A` }]),
+    )
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    await collection._sync.loadSubset({
+      where: eq(new IR.PropRef([`category`]), `A`),
+    })
+    await collection._sync.loadSubset({
+      where: eq(new IR.PropRef([`id`]), `x`),
+    })
+    const queries = queryClient.getQueryCache().getAll()
+    expect(queries).toHaveLength(1)
+    let notifications = 0
+    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
+      if (event.type === `updated` && event.query === queries[0])
+        notifications++
+    })
+    await collection.utils.writeUpdate({ id: `x`, name: `after` })
+    unsubscribe()
+    expect(notifications).toBe(1)
+    expect(collection.get(`x`)?.name).toBe(`after`)
+  })
+
+  /**
+   * A zero-lease logical scope can keep its observer through an outside
+   * listener after its Collection handler is removed. A second logical scope
+   * may share that physical Query under a custom hash and become the owner of
+   * a newer row. The independent cache rule requires one patch through the
+   * owning scope even when the disjoint observer is visited first.
+   */
+  it(`patches an aliased Query through its owning observer`, async () => {
+    type Row = { id: string; name: string; category: string }
+    const id = `aliased-owner-cache-patch`
+    const a = { id: `a`, name: `A`, category: `A` }
+    const b = { id: `b`, name: `Before`, category: `B` }
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+          staleTime: Infinity,
+          gcTime: Infinity,
+          queryKeyHashFn: () => `aliased-owner`,
+        },
+      },
+    })
+    const queryFn = vi.fn().mockResolvedValueOnce([a]).mockResolvedValue([b])
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => row.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    const demandA = { where: eq(new IR.PropRef([`category`]), `A`) }
+    const demandB = { where: eq(new IR.PropRef([`category`]), `B`) }
+    await collection._sync.loadSubset(demandA)
+    const query = queryClient.getQueryCache().getAll()[0]!
+    const observerA = query.observers[0]!
+    const releaseOutsideListener = observerA.subscribe(() => {})
+    cleanups.push(() => Promise.resolve(releaseOutsideListener()))
+    collection._sync.unloadSubset(demandA)
+    await collection._sync.loadSubset({ ...demandB, refetch: true })
+    expect(collection.has(b.id)).toBe(true)
+    expect(query.state.data).toEqual([b])
+    await collection.utils.writeUpdate({ id: b.id, name: `After` })
+    expect(query.state.data).toEqual([{ ...b, name: `After` }])
+  })
+
+  /**
+   * A direct update to an owned row needs work in its owner's cached scope,
+   * not in every disjoint scope. The independent category partition has ten
+   * scopes of 1,000 rows and exactly one owner for the changed key. After
+   * preload, a counted getKey boundary bounds one write to three owner-sized
+   * passes plus fixed overhead. This counts actual adapter key extraction,
+   * rather than timing or provider work.
+   */
+  it(`bounds direct cache patch work by the changed row's owners`, async () => {
+    type Row = { id: string; category: string; name: string }
+    const id = `direct-cache-owner-work`
+    const queryClient = createQueryClient()
+    let getKeyCalls = 0
+    const source = Array.from({ length: 10 }, (_, category) =>
+      Array.from({ length: 1000 }, (_, index) => ({
+        id: `${category}-${index}`,
+        category: String(category),
+        name: `before`,
+      })),
+    ).flat()
+    const queryFn = vi.fn((context: QueryFunctionContext) => {
+      const where = context.meta?.loadSubsetOptions?.where
+      const lastArg = where?.type === `func` ? where.args.at(-1) : undefined
+      const category = lastArg?.type === `val` ? lastArg.value : undefined
+      return Promise.resolve(source.filter((row) => row.category === category))
+    })
+    const collection = createCollection(
+      queryCollectionOptions<Row>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (row) => {
+          getKeyCalls++
+          return row.id
+        },
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    for (let category = 0; category < 10; category++)
+      await collection._sync.loadSubset({
+        where: eq(new IR.PropRef([`category`]), String(category)),
+      })
+    getKeyCalls = 0
+    await collection.utils.writeUpdate({ id: `3-0`, name: `after` })
+    expect(collection.get(`3-0`)?.name).toBe(`after`)
+    expect(queryFn).toHaveBeenCalledTimes(10)
+    expect(getKeyCalls).toBeLessThanOrEqual(3010)
+  })
+
+  /**
+   * A current complete Query result replaces its cold persisted result. The
+   * independent model starts with `{kept, omitted}` and replaces it with
+   * `{kept}`. Persisted row order cannot change that result, so both scan
+   * orders must expose the survivor and delete the omission.
+   */
+  it.each([
+    { scanOrder: [`kept`, `omitted`] },
+    { scanOrder: [`omitted`, `kept`] },
+  ] as const)(
+    `replaces a cold two-row result in scan order $scanOrder`,
+    async ({ scanOrder }) => {
+      const id = `cold-multi-row-owner-${scanOrder.join(`-`)}`
+      const queryHash = hashKey([id])
+      const kept: Item = { id: `kept`, category: `shared`, name: `Kept` }
+      const omitted: Item = {
+        id: `omitted`,
+        category: `shared`,
+        name: `Omitted`,
+      }
+      const byId = new Map([
+        [kept.id, kept],
+        [omitted.id, omitted],
+      ])
+      const ownerMetadata = {
+        queryCollection: { owners: { [queryHash]: true } },
+      }
+      const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
+      const scanPersistedRows = vi.fn(() =>
+        Promise.resolve(
+          scanOrder.map((rowId) => ({
+            key: rowId,
+            value: byId.get(rowId)!,
+            metadata: ownerMetadata,
+          })),
+        ),
+      )
+      const { collection } = createOwnershipFixture({
+        id,
+        results: [[kept]],
+        metadataRecorder: metadata,
+        scanPersistedRows,
+        setupMetadata: (syncMetadata) =>
+          syncMetadata.collection.set(`queryCollection:gc:${queryHash}`, {
+            queryHash,
+            mode: `until-revalidated`,
+          }),
+      })
+
+      await collection._sync.loadSubset({})
+
+      expect(rows(collection)).toEqual([kept.id])
+      expect(metadata.writes).toContainEqual({
+        type: `delete`,
+        key: omitted.id,
+      })
+    },
+  )
+
+  /**
+   * Hydrated rows obey the same complete-result replacement law. The public
+   * Collection begins with `{kept, omitted}` and the Query returns `{kept}`.
+   * Hydration order cannot change the public result or keep the survivor alive
+   * after its demand is released.
+   */
+  it.each([
+    { hydrationOrder: [`kept`, `omitted`] },
+    { hydrationOrder: [`omitted`, `kept`] },
+  ] as const)(
+    `replaces a hydrated two-row result in order $hydrationOrder`,
+    async ({ hydrationOrder }) => {
+      const id = `hydrated-multi-row-owner-${hydrationOrder.join(`-`)}`
+      const queryHash = hashKey([id])
+      const kept: Item = { id: `kept`, category: `shared`, name: `Kept` }
+      const omitted: Item = {
+        id: `omitted`,
+        category: `shared`,
+        name: `Omitted`,
+      }
+      const byId = new Map([
+        [kept.id, kept],
+        [omitted.id, omitted],
+      ])
+      const queryClient = createQueryClient()
+      const queryFn = vi.fn(() => Promise.resolve([kept]))
+      const descriptor = collectionOptions(
+        queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => item.id,
+          syncMode: `on-demand`,
+          startSync: true,
+        }),
+      )
+      const client = new DbClient({ queryClient })
+      client.hydrate({
+        collections: [
+          {
+            collectionId: id,
+            rows: hydrationOrder.map((rowId) => ({
+              key: rowId,
+              value: byId.get(rowId)!,
+              metadata: {
+                queryCollection: { owners: { [queryHash]: true } },
+              },
+            })),
+          },
+        ],
+      })
+      const collection = client.collection(descriptor)
+      cleanups.push(async () => {
+        await client.cleanup()
+        queryClient.clear()
+      })
+
+      await collection._sync.loadSubset({})
+      expect(rows(collection)).toEqual([kept.id])
+
+      collection._sync.unloadSubset({})
+      await vi.waitFor(() => expect(rows(collection)).toEqual([]))
+      expect(queryFn).toHaveBeenCalledOnce()
+    },
+  )
+
+  /**
+   * A retained subset owner cannot be settled by acquiring a different Query
+   * key. The independent source model has one `detail` row in durable storage;
+   * the current complete source keeps, omits, or moves it out of that subset.
+   * After a full-source result applies, acquiring the retained subset must
+   * reconcile its old owner and remove its revalidation marker. Compare public
+   * and durable rows at that acquisition's settlement, before any explicit
+   * refetch. The unchanged and moved cases guard against deleting a row still
+   * owned by the full source.
+   */
+  it.each([{ name: `omitted` }, { name: `unchanged` }, { name: `moved` }])(
+    `settles a retained $name subset after a complete full-source result`,
+    async ({ name }) => {
+      const id = `retained-subset-after-full-${name}`
+      const oldRow: Item = {
+        id: `detail-row`,
+        category: `detail`,
+        name: `Original`,
+      }
+      const subset = categorySubset(`detail`)
+      const subsetHash = hashKey([id, getLoadSubsetDemandKey(subset)])
+      const retentionKey = `queryCollection:gc:${subsetHash}`
+      const storage = createOwnershipStorage({
+        rows: new Map([[oldRow.id, oldRow]]),
+        rowMetadata: new Map([
+          [oldRow.id, { queryCollection: { owners: { [subsetHash]: true } } }],
+        ]),
+        collectionMetadata: new Map([
+          [retentionKey, { queryHash: subsetHash, mode: `until-revalidated` }],
+        ]),
+      })
+      const currentSource: Array<Item> =
+        name === `omitted`
+          ? []
+          : name === `unchanged`
+            ? [oldRow]
+            : [{ ...oldRow, category: `list`, name: `Moved` }]
+      const { collection } = createPersistedOwnershipFixture(
+        id,
+        storage,
+        currentSource,
+      )
+
+      await collection.stateWhenReady()
+      await collection._sync.loadSubset({})
+      await collection._sync.loadSubset(subset)
+
+      expect({
+        publicRows: collection.toArray.map(
+          ({ id: rowId, category, name: rowName }) => ({
+            id: rowId,
+            category,
+            name: rowName,
+          }),
+        ),
+        durableRows: storedItems(storage),
+        retentionPending: storage
+          .snapshot()
+          .collectionMetadata.has(retentionKey),
+      }).toEqual({
+        publicRows: currentSource,
+        durableRows: currentSource,
+        retentionPending: false,
+      })
+      if (name === `moved`) {
+        expect(
+          persistedOwners(storage.snapshot().rowMetadata, oldRow.id),
+        ).toEqual([hashKey([id])])
+      }
+      if (name === `unchanged`) {
+        collection._sync.unloadSubset({})
+        expect(rows(collection)).toEqual([oldRow.id])
+      }
+    },
+  )
+
+  it(`emits metadata for every owner of rows shared by overlapping queries`, async () => {
+    const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
+    const { collection } = createOwnershipFixture({
+      id: `persisted-overlap`,
+      results: [[shared], [shared, listOnly]],
+      metadataRecorder: metadata,
+    })
+    const detail = { where: categoryIn(`shared`, `detail`) }
+    const list = { where: categoryIn(`shared`, `list`) }
+
+    await collection._sync.loadSubset(detail)
+    expect(persistedOwners(metadata.rows, shared.id)).toHaveLength(1)
+
+    await collection._sync.loadSubset(list)
+    expect(persistedOwners(metadata.rows, shared.id)).toHaveLength(2)
+    expect(persistedOwners(metadata.rows, listOnly.id)).toHaveLength(1)
+
+    collection._sync.unloadSubset(list)
+    expect(rows(collection)).toEqual([shared.id])
+    expect(persistedOwners(metadata.rows, shared.id)).toHaveLength(1)
+  })
+
+  it(`preserves committed peer ownership through a cold revalidation`, async () => {
+    expectColdOwnerRevalidation(await observeColdOwnerRevalidation())
+  })
+
+  it(`rejects emitted ownership that is absent from cold storage`, async () => {
+    const observations = await observeColdOwnerRevalidation(true)
+    expect(() => expectColdOwnerRevalidation(observations)).toThrow()
+  })
+
+  it(`restages a persisted owner when its absent row arrives`, async () => {
+    const id = `persisted-owner-before-row`
+    const queryHash = hashKey([id])
+    const result = createDeferred<Array<Item>>()
+    const metadata: MetadataRecorder = { rows: new Map(), writes: [] }
+    let setupCalls = 0
+    const { collection, queryFn } = createOwnershipFixture({
+      id,
+      syncMode: `eager`,
+      results: [result.promise, [{ ...shared, name: `Restarted` }]],
+      metadataRecorder: metadata,
+      setupMetadata: (api) => {
+        setupCalls++
+        api.row.set(shared.id, {
+          queryCollection: { owners: { [queryHash]: true } },
+        })
+      },
+    })
+
+    expect(rows(collection)).toEqual([])
+    expect(persistedOwners(metadata.rows, shared.id)).toEqual([queryHash])
+    result.resolve([shared])
+    await collection.stateWhenReady()
+    expect(rows(collection)).toEqual([shared.id])
+    expect(persistedOwners(metadata.rows, shared.id)).toEqual([queryHash])
+
+    await collection.cleanup()
+    await collection.preload()
+    await vi.waitFor(() => {
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(collection.get(shared.id)?.name).toBe(`Restarted`)
+    })
+    expect(setupCalls).toBe(1)
+    expect(persistedOwners(metadata.rows, shared.id)).toEqual([queryHash])
+  })
+
+  it(`uses the replacement Query when the cache is cleared before an explicit refetch`, async () => {
+    const barrier = createDeferred<void>()
+    const thirdFetch = createDeferred<Array<Item>>()
+    const authoritative = { ...shared, name: `Authoritative` }
+    const { collection, queryClient, queryFn } = createOwnershipFixture({
+      id: `clear-before-explicit-refetch`,
+      results: [[shared], [authoritative], thirdFetch.promise],
+    })
+    const barrierCompletion = barrier.promise.then(() => {
+      collection.deferDataRefresh = null
+    })
+
+    try {
+      await collection._sync.loadSubset({})
+      collection.deferDataRefresh = barrier.promise
+      collection.utils.writeUpdate({ ...shared, name: `Manual` })
+      queryClient.clear()
+
+      barrier.resolve()
+      await barrierCompletion
+      const refresh = collection.utils.refetch({ throwOnError: true })
+      await vi.waitFor(() => expect(queryFn).toHaveBeenCalledTimes(2))
+      await refresh
+      for (let turn = 0; turn < 30; turn++) await Promise.resolve()
+
+      expect(queryFn).toHaveBeenCalledTimes(2)
+      expect(collection.get(shared.id)?.name).toBe(`Authoritative`)
+    } finally {
+      barrier.resolve()
+      collection.deferDataRefresh = null
+      thirdFetch.resolve([])
+    }
+  })
+
+  it(`removes unobserved sibling scopes without scanning or snapshots`, async () => {
+    const id = `unobserved-sibling-manual-write`
+    const queryClient = createQueryClient()
+    const siblingKey = [id, `prefetched-sibling`]
+    queryClient.setQueryData(siblingKey, [shared])
+    const queryFn = vi.fn(() => Promise.resolve([shared]))
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+
+    await collection._sync.loadSubset({})
+    const findAll = vi.spyOn(queryClient.getQueryCache(), `findAll`)
+    const values = vi.spyOn(collection._state.syncedData, `values`)
+
+    collection.utils.writeDelete(shared.id)
+
+    expect(queryClient.getQueryData(siblingKey)).toBeUndefined()
+    expect(findAll).not.toHaveBeenCalled()
+    expect(values).not.toHaveBeenCalled()
+  })
+})
+
+it.each([false, true])(
+  `evicts sibling caches created before sync starts, restart=%s`,
+  async (restart) => {
+    const queryClient = createQueryClient()
+    const id = `delayed-sync-cache`
+    const collection = createCollection(
+      queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn: () => Promise.resolve([shared]),
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: false,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+    })
+    if (restart) {
+      collection.startSyncImmediate()
+      await collection._sync.loadSubset({})
+      await collection.cleanup()
+    }
+    const siblingKey = [id, `prefetched-sibling`]
+    queryClient.setQueryData(siblingKey, [shared])
+    collection.startSyncImmediate()
+    await collection._sync.loadSubset({})
+    collection.utils.writeDelete(shared.id)
+    expect(queryClient.getQueryData(siblingKey)).toBeUndefined()
+  },
+)
+
+// Law: when a persisted cache claim expires, an on-demand Query Collection
+// reacquires only active demands from a fetch that starts after rotation.
+// Model: the provider's current rows replace the expired cache's rows for the
+// active subset. The QueryClient may still contain the old success, but that
+// success has no authority over the new persisted cache generation. This real
+// SQLite/QueryClient driver checks public and durable rows when reacquisition
+// settles.
+it(`reacquires an active Query subset after its SQLite cache claim expires`, async () => {
+  const id = `query-cache-claim-recovery`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const managed = persistence.resolvePersistenceForCollection!({
+    collectionId: id,
+    mode: `sync-present`,
+  })
+  const currentClaim = recordRunCacheClaim(managed.adapter)
+  const queryClient = createQueryClient()
+  let activeRows: Array<Item> = [
+    { id: `active-old`, category: `active`, name: `Old` },
+  ]
+  const triggeringRows: Array<Item> = [
+    { id: `trigger-fresh`, category: `active`, name: `Trigger` },
+  ]
+  const activeDemandKey = getLoadSubsetDemandKey({ limit: 1 })
+  const queryFn = vi.fn((context: QueryFunctionContext) =>
+    Promise.resolve(
+      structuredClone(
+        context.queryKey[1] === activeDemandKey ? activeRows : triggeringRows,
+      ),
+    ),
+  )
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence: managed,
+    }),
+  )
+  cleanups.push(async () => {
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  expect(itemIds(collection.toArray)).toEqual([`active-old`])
+  expect(queryFn).toHaveBeenCalledTimes(1)
+  const oldStorageId = currentClaim().storageCollectionId
+
+  now += 10_001
+  activeRows = [{ id: `active-fresh`, category: `active`, name: `Fresh` }]
+  await collection._sync.loadSubset({ limit: 2 })
+  await vi.waitFor(() =>
+    expect(new Set(itemIds(collection.toArray))).toEqual(
+      new Set([`active-fresh`, `trigger-fresh`]),
+    ),
+  )
+  expect(
+    queryFn.mock.calls.filter(
+      ([context]) => context.queryKey[1] === activeDemandKey,
+    ),
+  ).toHaveLength(2)
+  expect(currentClaim().storageCollectionId).not.toBe(oldStorageId)
+  expect(await readClaimedCacheRows(managed.adapter, currentClaim())).toEqual([
+    { key: `active-fresh`, name: `Fresh` },
+    { key: `trigger-fresh`, name: `Trigger` },
+  ])
+})
+
+// Distinct Query keys are independent documents even when one key is a
+// prefix of the other and both Collections share one QueryClient. The model
+// has two claims: A expires at 11000 and B, acquired later, expires at 15000.
+// At 11001 only A may replace its persisted cache generation and source row.
+// The real QueryClient uses prefix matching, so B's cache entry is deliberately
+// inside A's base-key search. Public rows, B's Query entry, its durable rows,
+// its current storage ID, and its fetch count are compared after A reloads.
+it(`keeps a warm Query Collection independent when a prefix-sharing peer rotates`, async () => {
+  const firstId = `query-prefix-rotation-a`
+  const secondId = `query-prefix-rotation-b`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const firstManaged = persistence.resolvePersistenceForCollection!({
+    collectionId: firstId,
+    mode: `sync-present`,
+  })
+  const secondManaged = persistence.resolvePersistenceForCollection!({
+    collectionId: secondId,
+    mode: `sync-present`,
+  })
+  const queryClient = createQueryClient()
+  const firstDemand = { limit: 1 }
+  const secondDemand = { limit: 2 }
+  const firstKey = [`shared-prefix`, getLoadSubsetDemandKey(firstDemand)]
+  const secondKey = [
+    `shared-prefix`,
+    `peer`,
+    getLoadSubsetDemandKey(firstDemand),
+  ]
+  let firstRows: Array<Item> = [
+    { id: `first-old`, category: `active`, name: `Old` },
+  ]
+  const firstQueryFn = vi.fn((context: QueryFunctionContext) =>
+    Promise.resolve(
+      structuredClone(
+        context.queryKey[1] === getLoadSubsetDemandKey(firstDemand)
+          ? firstRows
+          : [{ id: `trigger`, category: `active`, name: `Trigger` }],
+      ),
+    ),
+  )
+  const secondRow: Item = {
+    id: `second-warm`,
+    category: `peer`,
+    name: `Warm`,
+  }
+  const secondQueryFn = vi.fn(() => Promise.resolve([secondRow]))
+  const first = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id: firstId,
+        queryClient,
+        queryKey: [`shared-prefix`],
+        queryFn: firstQueryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence: firstManaged,
+    }),
+  )
+  const mounted = [first]
+  cleanups.push(async () => {
+    for (const collection of mounted.reverse()) await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+  await first._sync.loadSubset(firstDemand)
+  expect(itemIds(first.toArray)).toEqual([`first-old`])
+  expect(queryClient.getQueryData(firstKey)).toHaveLength(1)
+
+  now = 5_000
+  const peer = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id: secondId,
+        queryClient,
+        queryKey: [`shared-prefix`, `peer`],
+        queryFn: secondQueryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence: secondManaged,
+    }),
+  )
+  mounted.push(peer)
+  await peer._sync.loadSubset(firstDemand)
+  expect(itemIds(peer.toArray)).toEqual([`second-warm`])
+  expect(secondQueryFn).toHaveBeenCalledTimes(1)
+  const secondHead = driver
+    .getDatabase()
+    .prepare(
+      `SELECT physical_id FROM cache_generation
+       WHERE logical_id = ? AND retired = 0`,
+    )
+    .get(secondId) as { physical_id: string }
+  const secondClaim = driver
+    .getDatabase()
+    .prepare(`SELECT claim_id FROM cache_generation_claim WHERE logical_id = ?`)
+    .get(secondId) as { claim_id: string }
+  expect(
+    await secondManaged.adapter.loadSubset(
+      {
+        kind: `managed`,
+        storageCollectionId: secondHead.physical_id,
+        claimId: secondClaim.claim_id,
+      },
+      {},
+      {
+        cacheGenerationClaimId: secondClaim.claim_id,
+      },
+    ),
+  ).toMatchObject([{ value: secondRow }])
+
+  now = 11_001
+  firstRows = [{ id: `first-fresh`, category: `active`, name: `Fresh` }]
+  await first._sync.loadSubset(secondDemand)
+  await vi.waitFor(() =>
+    expect(new Set(itemIds(first.toArray))).toEqual(
+      new Set([`first-fresh`, `trigger`]),
+    ),
+  )
+  expect(itemIds(peer.toArray)).toEqual([`second-warm`])
+  expect(queryClient.getQueryData(secondKey)).toEqual([secondRow])
+  expect(secondQueryFn).toHaveBeenCalledTimes(1)
+  expect(
+    driver
+      .getDatabase()
+      .prepare(
+        `SELECT physical_id FROM cache_generation
+         WHERE logical_id = ? AND retired = 0`,
+      )
+      .get(secondId),
+  ).toMatchObject(secondHead)
+  expect(
+    await secondManaged.adapter.loadSubset(
+      {
+        kind: `managed`,
+        storageCollectionId: secondHead.physical_id,
+        claimId: secondClaim.claim_id,
+      },
+      {},
+      {
+        cacheGenerationClaimId: secondClaim.claim_id,
+      },
+    ),
+  ).toMatchObject([{ value: secondRow }])
+})
+
+// A claim can expire while persisted startup is reading metadata, before the
+// Query source enters its sync run. The wrapper rotates the cache privately at
+// that boundary. The old QueryClient success is not a source snapshot for the
+// replacement generation: the first demand must fetch and publish fresh rows.
+// With no rotation, an existing QueryClient success remains reusable. This
+// real SQLite driver checks both sides of that boundary at demand settlement.
+it.each([false, true])(
+  `uses cached QueryClient data according to private startup rotation: %s`,
+  async (rotateAtStartup) => {
+    const id = `query-cache-startup-rotation`
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    let now = 1_000
+    const persistence = createNodeSQLitePersistence({
+      database: driver.getDatabase(),
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => now,
+    })
+    const managed = persistence.resolvePersistenceForCollection!({
+      collectionId: id,
+      mode: `sync-present`,
+    })
+    const claim = managed.adapter.claimCacheGeneration!.bind(managed.adapter)
+    const rotate = managed.adapter.rotateCacheGeneration!.bind(managed.adapter)
+    let rotations = 0
+    if (rotateAtStartup) {
+      managed.adapter.claimCacheGeneration = async (...args) => {
+        const acquired = await claim(...args)
+        now = 12_000
+        return acquired
+      }
+    }
+    managed.adapter.rotateCacheGeneration = async (...args) => {
+      rotations++
+      return rotate(...args)
+    }
+    const queryClient = createQueryClient()
+    queryClient.setQueryData(
+      [id, getLoadSubsetDemandKey({ limit: 1 })],
+      [{ id: `old`, category: `active`, name: `Old` }],
+    )
+    const queryFn = vi.fn(() =>
+      Promise.resolve([{ id: `fresh`, category: `active`, name: `Fresh` }]),
+    )
+    const collection = createCollection(
+      persistedCollectionOptions<
+        Item,
+        string | number,
+        never,
+        QueryCollectionUtils<Item, string | number, Item, unknown>
+      >({
+        ...queryCollectionOptions<Item>({
+          id,
+          queryClient,
+          queryKey: [id],
+          queryFn,
+          getKey: (item) => item.id,
+          syncMode: `on-demand`,
+          startSync: true,
+        }),
+        persistence: managed,
+      }),
+    )
+    cleanups.push(async () => {
+      await collection.cleanup()
+      queryClient.clear()
+      driver.close()
+    })
+
+    await collection.stateWhenReady()
+    await collection._sync.loadSubset({ limit: 1 })
+    expect(rotations).toBe(rotateAtStartup ? 1 : 0)
+    expect(queryFn).toHaveBeenCalledTimes(rotateAtStartup ? 1 : 0)
+    expect(itemIds(collection.toArray)).toEqual([
+      rotateAtStartup ? `fresh` : `old`,
+    ])
+  },
+)
+
+// Two rotations may be queued before the first reaches its source restart.
+// The latest rotation alone owns reacquisition. At the held second-rotation
+// checkpoint the model still has no authoritative source row, so neither the
+// old Query observer nor the first recovery may start another provider fetch.
+// After the final rotation, the active demand must fetch and apply a new row.
+it(`waits for the final SQLite rotation before reacquiring a Query subset`, async () => {
+  const id = `query-cache-overlapping-rotations`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => 1_000,
+  })
+  const managed = persistence.resolvePersistenceForCollection!({
+    collectionId: id,
+    mode: `sync-present`,
+  })
+  const rotate = managed.adapter.rotateCacheGeneration?.bind(managed.adapter)
+  if (!rotate) throw new Error(`Expected managed SQLite rotation`)
+  const secondRotationEntered = createDeferred<void>()
+  const releaseSecondRotation = createDeferred<void>()
+  let rotations = 0
+  managed.adapter.rotateCacheGeneration = async (...args) => {
+    if (++rotations === 2) {
+      secondRotationEntered.resolve()
+      await releaseSecondRotation.promise
+    }
+    return rotate(...args)
+  }
+  const queryClient = createQueryClient()
+  let fetches = 0
+  const queryOptions = queryCollectionOptions<Item>({
+    id,
+    queryClient,
+    queryKey: [id],
+    queryFn: () =>
+      Promise.resolve([
+        { id: `r${++fetches}`, category: `active`, name: `source` },
+      ]),
+    getKey: (item) => item.id,
+    syncMode: `on-demand`,
+    startSync: true,
+  })
+  const sourceSync = queryOptions.sync.sync
+  let recover!: () => Promise<void>
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryOptions,
+      sync: {
+        ...queryOptions.sync,
+        sync: (params) => {
+          recover = params.metadata!.persistence!.startScopedRecovery!
+          return sourceSync(params)
+        },
+      },
+      persistence: managed,
+    }),
+  )
+  cleanups.push(async () => {
+    releaseSecondRotation.resolve()
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  const demand = { limit: 1 }
+  await collection._sync.loadSubset(demand)
+  expect(itemIds(collection.toArray)).toEqual([`r1`])
+  const first = recover()
+  const second = recover()
+  await secondRotationEntered.promise
+  await first
+  expect(rotations).toBe(2)
+  expect(fetches, `before the final cache rotation`).toBe(1)
+  expect(itemIds(collection.toArray)).toEqual([])
+
+  releaseSecondRotation.resolve()
+  await second
+  await vi.waitFor(() => expect(collection.size).toBe(1))
+  expect(collection.has(`r1`)).toBe(false)
+  expect(fetches).toBeGreaterThan(1)
+})
+
+// The old Query fetch can outlive a cache rotation even when its observer is
+// released. A late success has no authority to republish a row into the new
+// generation. The provider snapshot is captured before the held fetch, so the
+// old and fresh rows are distinguishable in both public and durable state at
+// the settlement and stale-fetch-release checkpoints.
+it(`does not publish a Query result started before SQLite cache rotation`, async () => {
+  const id = `query-cache-claim-late-fetch`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const managed = persistence.resolvePersistenceForCollection!({
+    collectionId: id,
+    mode: `sync-present`,
+  })
+  const currentClaim = recordRunCacheClaim(managed.adapter)
+  const queryClient = createQueryClient()
+  let providerRows: Array<Item> = [
+    { id: `old`, category: `active`, name: `Old` },
+  ]
+  let holdNextFetch = false
+  const oldFetchEntered = createDeferred<void>()
+  const releaseOldFetch = createDeferred<void>()
+  const queryFn = vi.fn(async () => {
+    const snapshot = structuredClone(providerRows)
+    if (holdNextFetch) {
+      holdNextFetch = false
+      oldFetchEntered.resolve()
+      await releaseOldFetch.promise
+    }
+    return snapshot
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence: managed,
+    }),
+  )
+  cleanups.push(async () => {
+    releaseOldFetch.resolve()
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  expect(itemIds(collection.toArray)).toEqual([`old`])
+  const oldStorageId = currentClaim().storageCollectionId
+  holdNextFetch = true
+  const oldLoad = Promise.resolve(
+    collection._sync.loadSubset({ limit: 1, refetch: true }),
+  )
+  void oldLoad.catch(() => undefined)
+  await oldFetchEntered.promise
+
+  now += 10_001
+  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
+  await collection._sync.loadSubset({ limit: 2 })
+  expect(itemIds(collection.toArray)).toEqual([`fresh`])
+  expect(currentClaim().storageCollectionId).not.toBe(oldStorageId)
+  expect(await readClaimedCacheRows(managed.adapter, currentClaim())).toEqual([
+    { key: `fresh`, name: `Fresh` },
+  ])
+
+  releaseOldFetch.resolve()
+  await Promise.allSettled([oldLoad])
+  await new Promise<void>((resolve) => queueMicrotask(resolve))
+  expect(itemIds(collection.toArray)).toEqual([`fresh`])
+  expect(await readClaimedCacheRows(managed.adapter, currentClaim())).toEqual([
+    { key: `fresh`, name: `Fresh` },
+  ])
+})
+
+// A peer Query observer may already have a fetch in flight when persistence
+// rotates its startup cache. With no cached Query result, the first Collection
+// demand joins that old fetch. Neither its success nor its error establishes
+// the replacement generation. The demand must start another fetch and apply
+// the fresh source row. The provider outcome is an independent history axis.
+it.each([`success`, `error`] as const)(
+  `reacquires after a pre-start Query fetch ends with %s`,
+  async (oldOutcome) => {
+    const id = `query-cache-pre-start-fetch-${oldOutcome}`
+    const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+    let now = 1_000
+    const persistence = createNodeSQLitePersistence({
+      database: driver.getDatabase(),
+      cacheGenerationClaimTtlMs: 10_000,
+      now: () => now,
+    })
+    const managed = persistence.resolvePersistenceForCollection!({
+      collectionId: id,
+      mode: `sync-present`,
+    })
+    const claim = managed.adapter.claimCacheGeneration!.bind(managed.adapter)
+    managed.adapter.claimCacheGeneration = async (...args) => {
+      const acquired = await claim(...args)
+      now = 12_000
+      return acquired
+    }
+    const queryClient = createQueryClient()
+    const activeDemandKey = getLoadSubsetDemandKey({ limit: 1 })
+    const oldFetchEntered = createDeferred<void>()
+    const releaseOldFetch = createDeferred<void>()
+    const peer = new QueryObserver(queryClient, {
+      queryKey: [id, activeDemandKey],
+      queryFn: async () => {
+        oldFetchEntered.resolve()
+        await releaseOldFetch.promise
+        if (oldOutcome === `error`) throw new Error(`retired fetch failed`)
+        return [{ id: `old`, category: `active`, name: `Old` }]
+      },
+      retry: false,
+    })
+    const releasePeer = peer.subscribe(() => {})
+    await oldFetchEntered.promise
+    const queryFn = vi.fn(() =>
+      Promise.resolve([{ id: `fresh`, category: `active`, name: `Fresh` }]),
+    )
+    const sourceLoadEntered = createDeferred<void>()
+    const queryOptions = queryCollectionOptions<Item>({
+      id,
+      queryClient,
+      queryKey: [id],
+      queryFn,
+      getKey: (item) => item.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      retry: false,
+    })
+    const collection = createCollection(
+      persistedCollectionOptions<
+        Item,
+        string | number,
+        never,
+        QueryCollectionUtils<Item, string | number, Item, unknown>
+      >({
+        ...queryOptions,
+        sync: {
+          ...queryOptions.sync,
+          sync: (params) => {
+            const source = queryOptions.sync.sync(params)
+            if (!source || typeof source === `function` || !source.loadSubset) {
+              throw new Error(`Expected on-demand Query source`)
+            }
+            return {
+              ...source,
+              loadSubset: (options) => {
+                const work = source.loadSubset!(options)
+                sourceLoadEntered.resolve()
+                return work
+              },
+            }
+          },
+        },
+        persistence: managed,
+      }),
+    )
+    cleanups.push(async () => {
+      releaseOldFetch.resolve()
+      releasePeer()
+      await collection.cleanup()
+      queryClient.clear()
+      driver.close()
+    })
+
+    await collection.stateWhenReady()
+    const load = Promise.resolve(collection._sync.loadSubset({ limit: 1 }))
+    void load.catch(() => undefined)
+    await sourceLoadEntered.promise
+    expect(queryFn).not.toHaveBeenCalled()
+    expect(collection.size).toBe(0)
+    releaseOldFetch.resolve()
+    let timeout: ReturnType<typeof setTimeout> | undefined
+    try {
+      await Promise.race([
+        load,
+        new Promise<void>((_, reject) => {
+          timeout = setTimeout(
+            () => reject(new Error(`fresh Query demand remained pending`)),
+            500,
+          )
+        }),
+      ])
+    } finally {
+      if (timeout) clearTimeout(timeout)
+    }
+    expect(queryFn).toHaveBeenCalledTimes(1)
+    expect(itemIds(collection.toArray)).toEqual([`fresh`])
+  },
+)
+
+// A later demand is a separate ownership node. A previous QueryClient success
+// for that key remains an ordinary cache hit, but it cannot establish rows in
+// the replacement SQLite generation. The held provider fetch gives this
+// history a checkpoint before fresh rows are available: the old cached row
+// must stay absent, and the demand may settle only after fresh application.
+it(`refetches a later Query demand with old client data after cache rotation`, async () => {
+  const id = `query-cache-claim-later-demand`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const queryClient = createQueryClient()
+  let providerRows: Array<Item> = [
+    { id: `old`, category: `active`, name: `Old` },
+  ]
+  const laterProviderRows: Array<Item> = [
+    { id: `later`, category: `active`, name: `Later` },
+  ]
+  let holdFetch = false
+  const freshFetchEntered = createDeferred<void>()
+  const releaseFreshFetch = createDeferred<void>()
+  const queryFn = vi.fn(async (context: QueryFunctionContext) => {
+    if (holdFetch) {
+      freshFetchEntered.resolve()
+      await releaseFreshFetch.promise
+    }
+    return structuredClone(
+      context.queryKey[1] === getLoadSubsetDemandKey({ limit: 2 })
+        ? laterProviderRows
+        : providerRows,
+    )
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence,
+    }),
+  )
+  cleanups.push(async () => {
+    releaseFreshFetch.resolve()
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  expect(itemIds(collection.toArray)).toEqual([`old`])
+  now += 10_001
+  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
+  await collection._sync.loadSubset({ limit: 1, refetch: true })
+  expect(itemIds(collection.toArray)).toEqual([`fresh`])
+
+  const laterDemand = { limit: 2 }
+  queryClient.setQueryData(
+    [id, getLoadSubsetDemandKey(laterDemand)],
+    [{ id: `stale`, category: `active`, name: `Stale` }],
+  )
+  holdFetch = true
+  const load = Promise.resolve(collection._sync.loadSubset(laterDemand))
+  void load.catch(() => undefined)
+  await freshFetchEntered.promise
+  expect(itemIds(collection.toArray)).toEqual([`fresh`])
+  releaseFreshFetch.resolve()
+  await load
+  expect(itemIds(collection.toArray)).toEqual([`fresh`, `later`])
+})
+
+// A new key has no fetch from the retired cache generation. The generation
+// boundary requires a fresh provider result, but its first fetch already
+// supplies that result. The request log is the observation: a cancelled first
+// fetch followed by a second one would return the right rows while wasting
+// one transport for every new key after recovery.
+it(`fetches a new Query key once after cache rotation`, async () => {
+  const id = `query-cache-new-key-after-rotation`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const queryClient = createQueryClient()
+  const queryFn = vi.fn((context: QueryFunctionContext) =>
+    Promise.resolve([
+      {
+        id: `row-${String(context.queryKey[1])}`,
+        category: `active`,
+        name: `source`,
+      },
+    ]),
+  )
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence,
+    }),
+  )
+  cleanups.push(async () => {
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  now += 10_001
+  await collection._sync.loadSubset({ limit: 1, refetch: true })
+  const beforeNewKey = queryFn.mock.calls.length
+  await collection._sync.loadSubset({ limit: 2 })
+  expect(queryFn.mock.calls.length - beforeNewKey).toBe(1)
+
+  const laterDemand = { limit: 3 }
+  queryClient.setQueryData(
+    [id, getLoadSubsetDemandKey(laterDemand)],
+    [{ id: `stale`, category: `active`, name: `Stale` }],
+  )
+  const beforeSeededKey = queryFn.mock.calls.length
+  await collection._sync.loadSubset(laterDemand)
+  expect(queryFn.mock.calls.length - beforeSeededKey).toBe(1)
+})
+
+// Rotation is a durable authority boundary. If SQLite refuses it, the current
+// sync run cannot resume its old observers as if the cache were still valid.
+// The public Collection status and later demand rejection make this fail-stop
+// visible; a pending internal recovery flag alone is not a silent freeze.
+it(`reports a failed Query cache rotation as a terminal Collection error`, async () => {
+  const id = `query-cache-failed-rotation`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    now: () => 1_000,
+  })
+  const managed = persistence.resolvePersistenceForCollection!({
+    collectionId: id,
+    mode: `sync-present`,
+  })
+  const failure = new Error(`rotation refused`)
+  const rotationEntered = createDeferred<void>()
+  managed.adapter.rotateCacheGeneration = async () => {
+    rotationEntered.resolve()
+    throw failure
+  }
+  const queryClient = createQueryClient()
+  const queryOptions = queryCollectionOptions<Item>({
+    id,
+    queryClient,
+    queryKey: [id],
+    queryFn: () =>
+      Promise.resolve([{ id: `old`, category: `active`, name: `Old` }]),
+    getKey: (item) => item.id,
+    syncMode: `on-demand`,
+    startSync: true,
+  })
+  const sourceSync = queryOptions.sync.sync
+  let recover!: () => Promise<void>
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryOptions,
+      sync: {
+        ...queryOptions.sync,
+        sync: (params) => {
+          recover = params.metadata!.persistence!.startScopedRecovery!
+          return sourceSync(params)
+        },
+      },
+      persistence: managed,
+    }),
+  )
+  cleanups.push(async () => {
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  expect(collection.status).toBe(`ready`)
+  const outcome = recover()
+  await rotationEntered.promise
+  await expect(outcome).rejects.toBe(failure)
+  // A refused rotation is a persistence failure, so the Collection crashes
+  // even after Collection readiness, and later demand rejects with its cause.
+  expect(collection.status).toBe(`crashed`)
+  await expect(collection._sync.loadSubset({ limit: 2 })).rejects.toBe(failure)
+})
+
+// A public refetch returns a Query result only if that result still belongs to
+// the current persisted cache generation. This provider captures the old row
+// before a held fetch, then recovery rotates SQLite and applies the fresh row.
+// The old result may complete in QueryClient, but the utility must report its
+// invalidated operation as canceled instead of fulfilling with unapplied data.
+it(`cancels a Query utility refetch whose result crosses cache rotation`, async () => {
+  const id = `query-cache-claim-held-utility-refetch`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const queryClient = createQueryClient()
+  let providerRows: Array<Item> = [
+    { id: `old`, category: `active`, name: `Old` },
+  ]
+  const oldFetchEntered = createDeferred<void>()
+  const releaseOldFetch = createDeferred<void>()
+  let fetches = 0
+  const queryFn = vi.fn(async () => {
+    const snapshot = structuredClone(providerRows)
+    if (++fetches === 2) {
+      oldFetchEntered.resolve()
+      await releaseOldFetch.promise
+    }
+    return snapshot
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence,
+    }),
+  )
+  cleanups.push(async () => {
+    releaseOldFetch.resolve()
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  expect(itemIds(collection.toArray)).toEqual([`old`])
+  const oldRefetch = collection.utils.refetch({ throwOnError: true })
+  void oldRefetch.catch(() => undefined)
+  await oldFetchEntered.promise
+  now += 10_001
+  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
+  await collection._sync.loadSubset({ limit: 2 })
+  expect(itemIds(collection.toArray)).toEqual([`fresh`])
+
+  releaseOldFetch.resolve()
+  await expect(oldRefetch).rejects.toBeInstanceOf(CancelledError)
+  expect(itemIds(collection.toArray)).toEqual([`fresh`])
+})
+
+// A released acquisition cannot schedule another provider fetch. In this
+// history a refetch has joined an old, held Query fetch; cache rotation
+// invalidates that result, and unload retires its final observer lease. When
+// the old fetch completes, the call count must stay fixed at the release cut.
+it(`does not restart a released Query acquisition after cache rotation`, async () => {
+  const id = `query-cache-claim-released-refetch`
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const queryClient = createQueryClient()
+  let providerRows: Array<Item> = [
+    { id: `old`, category: `active`, name: `Old` },
+  ]
+  const oldFetchEntered = createDeferred<void>()
+  const releaseOldFetch = createDeferred<void>()
+  const activeDemandKey = getLoadSubsetDemandKey({ limit: 1 })
+  let activeFetches = 0
+  const queryFn = vi.fn(async (context: QueryFunctionContext) => {
+    const snapshot = structuredClone(providerRows)
+    if (context.queryKey[1] === activeDemandKey && ++activeFetches === 2) {
+      oldFetchEntered.resolve()
+      await releaseOldFetch.promise
+    }
+    return snapshot
+  })
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryCollectionOptions<Item>({
+        id,
+        queryClient,
+        queryKey: [id],
+        queryFn,
+        getKey: (item) => item.id,
+        syncMode: `on-demand`,
+        startSync: true,
+      }),
+      persistence,
+    }),
+  )
+  cleanups.push(async () => {
+    releaseOldFetch.resolve()
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection._sync.loadSubset({ limit: 1 })
+  const oldLoad = Promise.resolve(
+    collection._sync.loadSubset({ limit: 1, refetch: true }),
+  )
+  void oldLoad.catch(() => undefined)
+  await oldFetchEntered.promise
+  now += 10_001
+  providerRows = [{ id: `fresh`, category: `active`, name: `Fresh` }]
+  await collection._sync.loadSubset({ limit: 2 })
+  collection._sync.unloadSubset({ limit: 1 })
+  collection._sync.unloadSubset({ limit: 1 })
+  const fetchesAtRelease = activeFetches
+  releaseOldFetch.resolve()
+  await Promise.allSettled([oldLoad])
+  await new Promise<void>((resolve) => setTimeout(resolve, 0))
+  expect(activeFetches).toBe(fetchesAtRelease)
+  expect(collection.get(`old`)).toBeUndefined()
+})
+
+// Retention maintenance reads old persisted ownership before deciding what to
+// delete. A scan returned by the old SQLite generation has no authority after
+// rotation, even if a fresh provider result uses the same row key. The wrapper
+// holds the completed real-adapter scan so the check observes the fresh row
+// both before and after the stale maintenance continuation is released.
+it(`does not delete a fresh Query row from an old retention scan`, async () => {
+  // The old retention scan must start after the Collection is ready, however
+  // long startup takes. Startup cleans up an entry that has already expired,
+  // and that would hold the scan inside startup. So the entry expires a minute
+  // out on a fake clock that advances with real time, and the test moves the
+  // clock past it only after readiness.
+  vi.useFakeTimers({
+    toFake: [`setTimeout`, `clearTimeout`, `Date`],
+    shouldAdvanceTime: true,
+  })
+  const id = `query-cache-claim-held-retention`
+  const oldRow: Item = { id: `same`, category: `active`, name: `Old` }
+  const freshRow: Item = { ...oldRow, name: `Fresh` }
+  const subset = { limit: 1 }
+  const queryHash = hashKey([id, getLoadSubsetDemandKey(subset)])
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  let now = 1_000
+  const persistence = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+    cacheGenerationClaimTtlMs: 10_000,
+    now: () => now,
+  })
+  const queryClient = createQueryClient()
+  const scanEntered = createDeferred<void>()
+  const releaseOldScan = createDeferred<void>()
+  let scans = 0
+  const queryOptions = queryCollectionOptions<Item>({
+    id,
+    queryClient,
+    queryKey: [id],
+    queryFn: () => Promise.resolve([freshRow]),
+    getKey: (item) => item.id,
+    syncMode: `on-demand`,
+    startSync: true,
+  })
+  const originalSync = queryOptions.sync.sync
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Item,
+      string | number,
+      never,
+      QueryCollectionUtils<Item, string | number, Item, unknown>
+    >({
+      ...queryOptions,
+      sync: {
+        ...queryOptions.sync,
+        sync: (params) => {
+          const metadata = params.metadata!
+          const capability = metadata.persistence!
+          const scan = capability.scanPersistedRows
+          params.begin()
+          params.write({ type: `insert`, value: oldRow })
+          metadata.row.set(oldRow.id, {
+            queryCollection: { owners: { [queryHash]: true } },
+          })
+          metadata.collection.set(`queryCollection:gc:${queryHash}`, {
+            queryHash,
+            mode: `ttl`,
+            expiresAt: Date.now() + 60_000,
+          })
+          params.commit()
+          return originalSync({
+            ...params,
+            metadata: {
+              ...metadata,
+              persistence: {
+                ...capability,
+                scanPersistedRows: async (...args) => {
+                  const snapshot = await scan(...args)
+                  if (++scans === 1) {
+                    scanEntered.resolve()
+                    await releaseOldScan.promise
+                  }
+                  return snapshot
+                },
+              },
+            },
+          })
+        },
+      },
+      persistence,
+    }),
+  )
+  cleanups.push(async () => {
+    vi.useRealTimers()
+    releaseOldScan.resolve()
+    await collection.cleanup()
+    queryClient.clear()
+    driver.close()
+  })
+
+  await collection.stateWhenReady()
+  expect(scans).toBe(0)
+  await vi.advanceTimersByTimeAsync(60_001)
+  await scanEntered.promise
+  now += 10_001
+  await collection._sync.loadSubset(subset)
+  expect(collection.get(`same`)?.name).toBe(`Fresh`)
+  releaseOldScan.resolve()
+  await new Promise<void>((resolve) => setTimeout(resolve, 0))
+  expect(collection.get(`same`)?.name).toBe(`Fresh`)
+  expect(collection.status).toBe(`ready`)
+})
diff --git a/packages/query-db-collection/tests/persisted-direct-write-support.ts b/packages/query-db-collection/tests/persisted-direct-write-support.ts
new file mode 100644
index 0000000000..73a20d1946
--- /dev/null
+++ b/packages/query-db-collection/tests/persisted-direct-write-support.ts
@@ -0,0 +1,271 @@
+// Fixtures shared by the persisted direct-write oracle and its ordinary unit tests
+// in persisted-direct-write.test.ts. They build collections, storage, and held
+// durable writes. They compare nothing; the oracle owns the law.
+
+import { QueryClient } from '@tanstack/query-core'
+import { createNodeSQLitePersistence } from '../../node-db-sqlite-persistence/src'
+import { BetterSqlite3SQLiteDriver } from '../../node-db-sqlite-persistence/src/node-driver'
+import type { QueryCollectionUtils } from '../src/query'
+import type {
+  PersistedStorageTarget,
+  PersistedTx,
+} from '../../db-sqlite-persistence-core/src'
+
+export type Row = { id: string; value: number }
+export type Op = `insert` | `update` | `delete` | `upsert`
+export const flush = () => new Promise((resolve) => setTimeout(resolve, 0))
+
+export function deferred<T = void>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+export function sortRows(rows: Iterable<Row>): Array<Row> {
+  return Array.from(rows, ({ id, value }) => ({ id, value })).sort((l, r) =>
+    l.id < r.id ? -1 : l.id > r.id ? 1 : 0,
+  )
+}
+
+export function write(utils: QueryCollectionUtils<Row>, op: Op): unknown {
+  switch (op) {
+    case `insert`:
+      return utils.writeInsert({ id: `k`, value: 9 })
+    case `update`:
+      return utils.writeUpdate({ id: `k`, value: 9 })
+    case `delete`:
+      return utils.writeDelete(`k`)
+    case `upsert`:
+      return utils.writeUpsert({ id: `k`, value: 9 })
+  }
+}
+
+/** Run the write; report `ok` or the error name, thrown or rejected. */
+export async function outcomeOf(
+  run: () => unknown,
+): Promise<{ outcome: string; timing: `sync` | `async` | `none` }> {
+  let result: unknown
+  try {
+    result = run()
+  } catch (error) {
+    return { outcome: (error as Error).name, timing: `sync` }
+  }
+  try {
+    await result
+    return { outcome: `ok`, timing: `none` }
+  } catch (error) {
+    return { outcome: (error as Error).name, timing: `async` }
+  }
+}
+
+/**
+ * Run a driver, then every cleanup step. A cleanup failure must not hide the
+ * driver's failure: when both fail, the result is an AggregateError whose
+ * `cause` is the driver's failure and whose `errors` list it first, then each
+ * cleanup failure.
+ */
+export async function checked<T>(
+  body: () => Promise<T>,
+  cleanups: Array<() => unknown>,
+): Promise<T> {
+  let primary: { error: unknown } | undefined
+  try {
+    return await body()
+  } catch (error) {
+    primary = { error }
+    throw error
+  } finally {
+    const failures: Array<unknown> = []
+    for (const cleanup of cleanups) {
+      try {
+        await cleanup()
+      } catch (error) {
+        failures.push(error)
+      }
+    }
+    if (failures.length > 0) {
+      // eslint-disable-next-line no-unsafe-finally
+      throw primary
+        ? new AggregateError(
+            [primary.error, ...failures],
+            `driver failed: ${String((primary.error as Error).message)}; cleanup also failed`,
+            { cause: primary.error },
+          )
+        : new AggregateError(failures, `cleanup failed`)
+    }
+  }
+}
+
+/** Narrow a stored value and key to this oracle's row shape. */
+export function asRow(value: Record<string, unknown>): Row {
+  if (typeof value.id !== `string` || typeof value.value !== `number`) {
+    throw new Error(`unexpected stored row: ${JSON.stringify(value)}`)
+  }
+  return { ...value, id: value.id, value: value.value }
+}
+
+export function asKey(key: string | number): string {
+  if (typeof key !== `string`) throw new Error(`unexpected key: ${key}`)
+  return key
+}
+
+export function createAdapter(seed: Array<Row>) {
+  const rows = new Map(seed.map((row) => [row.id, row]))
+  const rowMetadata = new Map<string, unknown>()
+  const collectionMetadata = new Map<string, unknown>()
+  let latestTerm = 0
+  let latestSeq = 0
+  let latestRowVersion = 0
+  const entries = () =>
+    Array.from(rows.values()).map((value) => ({
+      key: value.id,
+      value,
+      metadata: rowMetadata.get(value.id),
+    }))
+  return {
+    rows,
+    loadSubset: async () => entries(),
+    loadResumeSnapshot: async (
+      _target: PersistedStorageTarget,
+      options?: { includeRows?: boolean },
+    ) => ({
+      rows: options?.includeRows === false ? [] : entries(),
+      keySet: { status: `consistent` as const },
+      collectionMetadata: Array.from(
+        collectionMetadata.entries(),
+        ([key, value]) => ({ key, value }),
+      ),
+      latestTerm,
+      latestSeq,
+      latestRowVersion,
+      resetEpoch: 0,
+    }),
+    loadCollectionMetadata: async () =>
+      Array.from(collectionMetadata.entries()).map(([key, value]) => ({
+        key,
+        value,
+      })),
+    scanRows: async () => entries(),
+    applyCommittedTx: async (
+      _target: PersistedStorageTarget,
+      tx: PersistedTx,
+    ) => {
+      if (tx.truncate) {
+        rows.clear()
+        rowMetadata.clear()
+      }
+      for (const mutation of tx.mutations) {
+        const key = asKey(mutation.key)
+        if (mutation.type === `delete`) {
+          rows.delete(key)
+          rowMetadata.delete(key)
+        } else {
+          rows.set(key, asRow(mutation.value))
+        }
+      }
+      for (const mutation of tx.rowMetadataMutations ?? []) {
+        const key = asKey(mutation.key)
+        if (mutation.type === `delete`) rowMetadata.delete(key)
+        else rowMetadata.set(key, mutation.value)
+      }
+      for (const mutation of tx.collectionMetadataMutations ?? []) {
+        if (mutation.type === `delete`) collectionMetadata.delete(mutation.key)
+        else collectionMetadata.set(mutation.key, mutation.value)
+      }
+      latestTerm = tx.term
+      latestSeq = tx.seq
+      latestRowVersion = tx.rowVersion
+    },
+    ensureIndex: async () => {},
+  }
+}
+
+export type StorageKind = `fake` | `sqlite`
+
+/**
+ * Storage for the persisted driver. The fake adapter holds rows in memory.
+ * The `sqlite` storage uses the node SQLite adapter over an in-memory
+ * database, and starts empty, so the first fetch stores the base rows.
+ */
+export function createStorage(
+  kind: StorageKind,
+  seed: Array<Row>,
+  collectionId: string,
+) {
+  if (kind === `fake`) {
+    const adapter = createAdapter(seed)
+    return {
+      adapter,
+      persistence: { adapter },
+      storedRows: (_collectionId: string) =>
+        Promise.resolve(sortRows(adapter.rows.values())),
+      close: () => {},
+    }
+  }
+  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
+  // A Query Collection is sync-present. Resolve that adapter, so the gate
+  // below wraps the adapter the collection writes through.
+  const resolved = createNodeSQLitePersistence({
+    database: driver.getDatabase(),
+  }).resolvePersistenceForCollection!({
+    collectionId,
+    mode: `sync-present`,
+    schemaVersion: undefined,
+  })
+  const persistence = {
+    adapter: resolved.adapter,
+    coordinator: resolved.coordinator,
+  }
+  const adapter = resolved.adapter as unknown as ReturnType<
+    typeof createAdapter
+  > & {
+    scanRows: (target: {
+      kind: `eager`
+      collectionId: string
+    }) => Promise<Array<{ key: unknown; value: Row }>>
+  }
+  return {
+    adapter,
+    persistence,
+    storedRows: async (collectionId: string) =>
+      sortRows(
+        (await adapter.scanRows({ kind: `eager`, collectionId })).map(
+          (row) => row.value,
+        ),
+      ),
+    close: () => driver.close(),
+  }
+}
+
+export function newQueryClient() {
+  return new QueryClient({
+    defaultOptions: { queries: { staleTime: 0, gcTime: 0, retry: false } },
+  })
+}
+
+/** A queryFn whose calls after `armed` wait for the test to return them. */
+export function heldQueryFn(rows: () => Array<Row>) {
+  const calls: Array<{ resolve: (rows: Array<Row>) => void }> = []
+  let armed = false
+  const started = { count: 0 }
+  const queryFn = () => {
+    started.count++
+    if (!armed) return Promise.resolve(rows().map((row) => ({ ...row })))
+    const call = deferred<Array<Row>>()
+    calls.push(call)
+    return call.promise
+  }
+  return {
+    queryFn,
+    started,
+    arm: () => {
+      armed = true
+    },
+    disarm: () => {
+      armed = false
+    },
+    calls,
+  }
+}
diff --git a/packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts b/packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts
index a559a2ed61..e832509f60 100644
--- a/packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts
+++ b/packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts
@@ -1,16 +1,22 @@
 import { describe, expect, it, vi } from 'vitest'
-import { QueryClient } from '@tanstack/query-core'
 import { DuplicateKeySyncError, createCollection } from '@tanstack/db'
 import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src'
-import { createNodeSQLitePersistence } from '../../node-db-sqlite-persistence/src'
-import { BetterSqlite3SQLiteDriver } from '../../node-db-sqlite-persistence/src/node-driver'
 import { queryCollectionOptions } from '../src/query'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
+import {
+  checked,
+  createAdapter,
+  createStorage,
+  deferred,
+  flush,
+  heldQueryFn,
+  newQueryClient,
+  outcomeOf,
+  sortRows,
+  write,
+} from './persisted-direct-write-support'
 import type { QueryCollectionUtils } from '../src/query'
-import type {
-  PersistedStorageTarget,
-  PersistedTx,
-} from '../../db-sqlite-persistence-core/src'
-
+import type { Op, Row, StorageKind } from './persisted-direct-write-support'
 /**
  * # Does a direct write see the commits that came before it?
  *
@@ -27,8 +33,8 @@ import type {
  * the write runs. The reference does not share the persistence wrapper, which
  * is the code under judgment. It shares the Query Collection's direct-write
  * code, so it cannot find a fault in that code that both paths share. The
- * precedence model at the end of this file covers that code: its expected
- * rows come from stated rules, not from a collection.
+ * precedence rules for writes that interleave with refetches are pinned as
+ * unit tests in `persisted-direct-write.test.ts`; they are not an oracle.
  *
  * ## Contract and ownership table
  *
@@ -39,10 +45,10 @@ import type {
  * | the Query cache agrees | the same | updateCacheData | Query cache rows after settlement | this oracle |
  * | storage agrees | the same | persisted durable write | stored rows after settlement equal the visible rows | this oracle |
  * | real SQLite receives the same | a subset: each write type, `refetch-only`, `source-write`, and the ordering cases | the same, over the node SQLite adapter | the same observations | this oracle; the full matrix runs over an in-memory fake adapter |
- * | rejected writes gain no precedence | 4 rejected writes during a held refetch, with and without persistence | utils.write* -> validation | rows and Query cache inside the refetch's fulfillment | precedence model |
- * | a later accepted write keeps precedence | a second write after a deferred result arrives, same key and sibling key | deferred merge | rows, Query cache and stored rows after settlement | precedence model |
- * | refetch settles after its rows apply | a deferred result, and one whose merged write is held | deferred merge -> result settlement | rows inside the refetch's fulfillment | precedence model |
- * | cleanup during the wait rejects | insert, upsert and batch while cleanup retires the sync run | manual-sync -> current-context check | outcome, stored rows, rows after a restart | precedence model |
+ * | rejected writes gain no precedence | 4 rejected writes during a held refetch, with and without persistence | utils.write* -> validation | rows and Query cache inside the refetch's fulfillment | unit tests in `persisted-direct-write.test.ts`; no oracle owner |
+ * | a later accepted write keeps precedence | a second write after a deferred result arrives, same key and sibling key | deferred merge | rows, Query cache and stored rows after settlement | unit tests in `persisted-direct-write.test.ts`; no oracle owner |
+ * | refetch settles after its rows apply | a deferred result, and one whose merged write is held | deferred merge -> result settlement | rows inside the refetch's fulfillment | unit tests in `persisted-direct-write.test.ts`; no oracle owner |
+ * | cleanup during the wait rejects | insert, upsert and batch while cleanup retires the sync run | manual-sync -> current-context check | outcome, stored rows, rows after a restart | unit tests in `persisted-direct-write.test.ts`; no oracle owner |
  * | validation errors reject the promise | duplicate insert, with and without persistence | utils.writeInsert | `rejects.toBeInstanceOf(DuplicateKeySyncError)` | this oracle |
  *
  * Lock holders:
@@ -61,7 +67,7 @@ import type {
  *
  * The domain is a finite matrix of 16 cases, not a generated history, so no
  * random campaign is claimed. The matrix comparison ignores whether an error
- * is thrown at once or rejects later. The precedence model and the
+ * is thrown at once or rejects later. The precedence rules and the
  * duplicate-insert witness check that validation errors reject the promise.
  *
  * The driver checks that it reached the window: when the write runs, storage
@@ -70,8 +76,6 @@ import type {
  * both observations, so a failure keeps the case that broke the law.
  */
 
-type Row = { id: string; value: number }
-type Op = `insert` | `update` | `delete` | `upsert`
 type Holder = `source-write` | `startup`
 type KeyCase = `refetch-only` | `both`
 
@@ -85,16 +89,6 @@ const ops: Array<Op> = [`insert`, `update`, `delete`, `upsert`]
 const holders: Array<Holder> = [`source-write`, `startup`]
 const keyCases: Array<KeyCase> = [`refetch-only`, `both`]
 
-const flush = () => new Promise((resolve) => setTimeout(resolve, 0))
-
-function deferred<T = void>() {
-  let resolve!: (value: T) => void
-  const promise = new Promise<T>((done) => {
-    resolve = done
-  })
-  return { promise, resolve }
-}
-
 /** The applied rows before the window, and the waiting refetch's rows. */
 function scenario(keyCase: KeyCase): { base: Array<Row>; next: Array<Row> } {
   return keyCase === `both`
@@ -117,228 +111,6 @@ function scenario(keyCase: KeyCase): { base: Array<Row>; next: Array<Row> } {
       }
 }
 
-function sortRows(rows: Iterable<Row>): Array<Row> {
-  return Array.from(rows, ({ id, value }) => ({ id, value })).sort((l, r) =>
-    l.id < r.id ? -1 : l.id > r.id ? 1 : 0,
-  )
-}
-
-function write(utils: QueryCollectionUtils<Row>, op: Op): unknown {
-  switch (op) {
-    case `insert`:
-      return utils.writeInsert({ id: `k`, value: 9 })
-    case `update`:
-      return utils.writeUpdate({ id: `k`, value: 9 })
-    case `delete`:
-      return utils.writeDelete(`k`)
-    case `upsert`:
-      return utils.writeUpsert({ id: `k`, value: 9 })
-  }
-}
-
-/** Run the write; report `ok` or the error name, thrown or rejected. */
-async function outcomeOf(
-  run: () => unknown,
-): Promise<{ outcome: string; timing: `sync` | `async` | `none` }> {
-  let result: unknown
-  try {
-    result = run()
-  } catch (error) {
-    return { outcome: (error as Error).name, timing: `sync` }
-  }
-  try {
-    await result
-    return { outcome: `ok`, timing: `none` }
-  } catch (error) {
-    return { outcome: (error as Error).name, timing: `async` }
-  }
-}
-
-/**
- * Run a driver, then every cleanup step. A cleanup failure must not hide the
- * driver's failure: when both fail, the result is an AggregateError whose
- * `cause` is the driver's failure and whose `errors` list it first, then each
- * cleanup failure.
- */
-async function checked<T>(
-  body: () => Promise<T>,
-  cleanups: Array<() => unknown>,
-): Promise<T> {
-  let primary: { error: unknown } | undefined
-  try {
-    return await body()
-  } catch (error) {
-    primary = { error }
-    throw error
-  } finally {
-    const failures: Array<unknown> = []
-    for (const cleanup of cleanups) {
-      try {
-        await cleanup()
-      } catch (error) {
-        failures.push(error)
-      }
-    }
-    if (failures.length > 0) {
-      // eslint-disable-next-line no-unsafe-finally
-      throw primary
-        ? new AggregateError(
-            [primary.error, ...failures],
-            `driver failed: ${String((primary.error as Error).message)}; cleanup also failed`,
-            { cause: primary.error },
-          )
-        : new AggregateError(failures, `cleanup failed`)
-    }
-  }
-}
-
-/** Narrow a stored value and key to this oracle's row shape. */
-function asRow(value: Record<string, unknown>): Row {
-  if (typeof value.id !== `string` || typeof value.value !== `number`) {
-    throw new Error(`unexpected stored row: ${JSON.stringify(value)}`)
-  }
-  return { ...value, id: value.id, value: value.value }
-}
-
-function asKey(key: string | number): string {
-  if (typeof key !== `string`) throw new Error(`unexpected key: ${key}`)
-  return key
-}
-
-function createAdapter(seed: Array<Row>) {
-  const rows = new Map(seed.map((row) => [row.id, row]))
-  const rowMetadata = new Map<string, unknown>()
-  const collectionMetadata = new Map<string, unknown>()
-  let latestTerm = 0
-  let latestSeq = 0
-  let latestRowVersion = 0
-  const entries = () =>
-    Array.from(rows.values()).map((value) => ({
-      key: value.id,
-      value,
-      metadata: rowMetadata.get(value.id),
-    }))
-  return {
-    rows,
-    loadSubset: async () => entries(),
-    loadResumeSnapshot: async (
-      _target: PersistedStorageTarget,
-      options?: { includeRows?: boolean },
-    ) => ({
-      rows: options?.includeRows === false ? [] : entries(),
-      keySet: { status: `consistent` as const },
-      collectionMetadata: Array.from(
-        collectionMetadata.entries(),
-        ([key, value]) => ({ key, value }),
-      ),
-      latestTerm,
-      latestSeq,
-      latestRowVersion,
-      resetEpoch: 0,
-    }),
-    loadCollectionMetadata: async () =>
-      Array.from(collectionMetadata.entries()).map(([key, value]) => ({
-        key,
-        value,
-      })),
-    scanRows: async () => entries(),
-    applyCommittedTx: async (
-      _target: PersistedStorageTarget,
-      tx: PersistedTx,
-    ) => {
-      if (tx.truncate) {
-        rows.clear()
-        rowMetadata.clear()
-      }
-      for (const mutation of tx.mutations) {
-        const key = asKey(mutation.key)
-        if (mutation.type === `delete`) {
-          rows.delete(key)
-          rowMetadata.delete(key)
-        } else {
-          rows.set(key, asRow(mutation.value))
-        }
-      }
-      for (const mutation of tx.rowMetadataMutations ?? []) {
-        const key = asKey(mutation.key)
-        if (mutation.type === `delete`) rowMetadata.delete(key)
-        else rowMetadata.set(key, mutation.value)
-      }
-      for (const mutation of tx.collectionMetadataMutations ?? []) {
-        if (mutation.type === `delete`) collectionMetadata.delete(mutation.key)
-        else collectionMetadata.set(mutation.key, mutation.value)
-      }
-      latestTerm = tx.term
-      latestSeq = tx.seq
-      latestRowVersion = tx.rowVersion
-    },
-    ensureIndex: async () => {},
-  }
-}
-
-type StorageKind = `fake` | `sqlite`
-
-/**
- * Storage for the persisted driver. The fake adapter holds rows in memory.
- * The `sqlite` storage uses the node SQLite adapter over an in-memory
- * database, and starts empty, so the first fetch stores the base rows.
- */
-function createStorage(
-  kind: StorageKind,
-  seed: Array<Row>,
-  collectionId: string,
-) {
-  if (kind === `fake`) {
-    const adapter = createAdapter(seed)
-    return {
-      adapter,
-      persistence: { adapter },
-      storedRows: (_collectionId: string) =>
-        Promise.resolve(sortRows(adapter.rows.values())),
-      close: () => {},
-    }
-  }
-  const driver = new BetterSqlite3SQLiteDriver({ filename: `:memory:` })
-  // A Query Collection is sync-present. Resolve that adapter, so the gate
-  // below wraps the adapter the collection writes through.
-  const resolved = createNodeSQLitePersistence({
-    database: driver.getDatabase(),
-  }).resolvePersistenceForCollection!({
-    collectionId,
-    mode: `sync-present`,
-    schemaVersion: undefined,
-  })
-  const persistence = {
-    adapter: resolved.adapter,
-    coordinator: resolved.coordinator,
-  }
-  const adapter = resolved.adapter as unknown as ReturnType<
-    typeof createAdapter
-  > & {
-    scanRows: (target: {
-      kind: `eager`
-      collectionId: string
-    }) => Promise<Array<{ key: unknown; value: Row }>>
-  }
-  return {
-    adapter,
-    persistence,
-    storedRows: async (collectionId: string) =>
-      sortRows(
-        (await adapter.scanRows({ kind: `eager`, collectionId })).map(
-          (row) => row.value,
-        ),
-      ),
-    close: () => driver.close(),
-  }
-}
-
-function newQueryClient() {
-  return new QueryClient({
-    defaultOptions: { queries: { staleTime: 0, gcTime: 0, retry: false } },
-  })
-}
-
 /**
  * Reference: no persistence. The waiting refetch has applied when the write
  * runs, so its rows decide validation.
@@ -487,27 +259,52 @@ async function persisted(
   ])
 }
 
+/**
+ * The matrix law: a direct write that runs while an earlier refetch waits for
+ * the apply lock returns the outcome and rows of the no-persistence reference,
+ * and storage then holds the visible rows. The reference is the model: it runs
+ * the same operations after the waiting refetch has applied. The driver's
+ * `waited` observation shows that the write ran inside the window.
+ */
+async function compareWriteWithReference(
+  op: Op,
+  holder: Holder,
+  keyCase: KeyCase,
+  kind: StorageKind = `fake`,
+): Promise<void> {
+  const expected = await reference(op, keyCase)
+  const actual = await persisted(op, holder, keyCase, kind)
+  const label = kind === `sqlite` ? `sqlite` : `persisted`
+  // The driver reached the window: core had not accepted `next`.
+  expect(actual.waited, `the refetch waited on the lock`).toBe(true)
+  const observed = {
+    outcome: actual.outcome,
+    visible: actual.visible,
+    cache: actual.cache,
+  }
+  expect(
+    observed,
+    `${label} ${JSON.stringify(observed)} != reference ${JSON.stringify(expected)}`,
+  ).toEqual(expected)
+  expect(actual.stored, `storage matches the visible rows`).toEqual(
+    actual.visible,
+  )
+}
+
+declareOracle({
+  check: [
+    compareWriteWithReference,
+    compareLaterRefetchOrder,
+    compareDuplicateInsert,
+  ],
+})
+
 describe(`persisted direct writes behind a waiting refetch`, () => {
   for (const holder of holders) {
     for (const keyCase of keyCases) {
       for (const op of ops) {
         it(`${op} with ${holder} holding the lock, key ${keyCase}`, async () => {
-          const expected = await reference(op, keyCase)
-          const actual = await persisted(op, holder, keyCase)
-          // The driver reached the window: core had not accepted `next`.
-          expect(actual.waited, `the refetch waited on the lock`).toBe(true)
-          const observed = {
-            outcome: actual.outcome,
-            visible: actual.visible,
-            cache: actual.cache,
-          }
-          expect(
-            observed,
-            `persisted ${JSON.stringify(observed)} != reference ${JSON.stringify(expected)}`,
-          ).toEqual(expected)
-          expect(actual.stored, `storage matches the visible rows`).toEqual(
-            actual.visible,
-          )
+          await compareWriteWithReference(op, holder, keyCase)
         })
       }
     }
@@ -545,31 +342,6 @@ function laterRows(touch: Touch): Array<Row> {
       ]
 }
 
-/** A queryFn whose calls after `armed` wait for the test to return them. */
-function heldQueryFn(rows: () => Array<Row>) {
-  const calls: Array<{ resolve: (rows: Array<Row>) => void }> = []
-  let armed = false
-  const started = { count: 0 }
-  const queryFn = () => {
-    started.count++
-    if (!armed) return Promise.resolve(rows().map((row) => ({ ...row })))
-    const call = deferred<Array<Row>>()
-    calls.push(call)
-    return call.promise
-  }
-  return {
-    queryFn,
-    started,
-    arm: () => {
-      armed = true
-    },
-    disarm: () => {
-      armed = false
-    },
-    calls,
-  }
-}
-
 async function referenceOrder(start: Start, touch: Touch): Promise<Array<Row>> {
   const server: Array<Row> = [
     { id: `a`, value: 2 },
@@ -715,20 +487,33 @@ async function persistedOrder(
   ])
 }
 
+/**
+ * The ordering law for a later refetch: the write's result matches the
+ * no-persistence reference, and storage holds the visible rows.
+ */
+async function compareLaterRefetchOrder(
+  start: Start,
+  touch: Touch,
+  kind: StorageKind = `fake`,
+): Promise<void> {
+  const expected = await referenceOrder(start, touch)
+  const actual = await persistedOrder(start, touch, kind)
+  const label = kind === `sqlite` ? `sqlite` : `persisted`
+  expect(actual.waited, `the write waited on the lock`).toBe(true)
+  expect(
+    actual.visible,
+    `${label} ${JSON.stringify(actual.visible)} != reference ${JSON.stringify(expected)}`,
+  ).toEqual(expected)
+  expect(actual.stored, `storage matches the visible rows`).toEqual(
+    actual.visible,
+  )
+}
+
 describe(`a later refetch while a persisted direct write waits`, () => {
   for (const start of [`before`, `after`] as const) {
     for (const touch of [`same`, `different`] as const) {
       it(`R3 started ${start} the write, ${touch} key`, async () => {
-        const expected = await referenceOrder(start, touch)
-        const actual = await persistedOrder(start, touch)
-        expect(actual.waited, `the write waited on the lock`).toBe(true)
-        expect(
-          actual.visible,
-          `persisted ${JSON.stringify(actual.visible)} != reference ${JSON.stringify(expected)}`,
-        ).toEqual(expected)
-        expect(actual.stored, `storage matches the visible rows`).toEqual(
-          actual.visible,
-        )
+        await compareLaterRefetchOrder(start, touch)
       })
     }
   }
@@ -746,41 +531,18 @@ describe(`a later refetch while a persisted direct write waits`, () => {
 describe(`real SQLite: persisted direct writes behind a waiting refetch`, () => {
   for (const op of ops) {
     it(`${op} with source-write holding the lock, key refetch-only`, async () => {
-      const expected = await reference(op, `refetch-only`)
-      const actual = await persisted(
+      await compareWriteWithReference(
         op,
         `source-write`,
         `refetch-only`,
         `sqlite`,
       )
-      expect(actual.waited, `the refetch waited on the lock`).toBe(true)
-      const observed = {
-        outcome: actual.outcome,
-        visible: actual.visible,
-        cache: actual.cache,
-      }
-      expect(
-        observed,
-        `sqlite ${JSON.stringify(observed)} != reference ${JSON.stringify(expected)}`,
-      ).toEqual(expected)
-      expect(actual.stored, `SQLite matches the visible rows`).toEqual(
-        actual.visible,
-      )
     })
   }
   for (const start of [`before`, `after`] as const) {
     for (const touch of [`same`, `different`] as const) {
       it(`R3 started ${start} the write, ${touch} key`, async () => {
-        const expected = await referenceOrder(start, touch)
-        const actual = await persistedOrder(start, touch, `sqlite`)
-        expect(actual.waited, `the write waited on the lock`).toBe(true)
-        expect(
-          actual.visible,
-          `sqlite ${JSON.stringify(actual.visible)} != reference ${JSON.stringify(expected)}`,
-        ).toEqual(expected)
-        expect(actual.stored, `SQLite matches the visible rows`).toEqual(
-          actual.visible,
-        )
+        await compareLaterRefetchOrder(start, touch, `sqlite`)
       })
     }
   }
@@ -794,159 +556,24 @@ describe(`real SQLite: persisted direct writes behind a waiting refetch`, () =>
  * check a persisted `writeInsert` of an existing key replaced the row. This
  * witness needs no lock window: the key is applied before the write runs.
  */
-describe(`a persisted direct insert of an existing key`, () => {
-  it(`rejects like the reference and keeps the row`, async () => {
-    const base: Array<Row> = [{ id: `k`, value: 1 }]
-    const reference = createCollection(
-      queryCollectionOptions<Row>({
-        id: `reference-duplicate-insert`,
-        queryKey: [`reference-duplicate-insert`],
-        queryFn: () => Promise.resolve(base.map((row) => ({ ...row }))),
-        queryClient: newQueryClient(),
-        getKey: (row) => row.id,
-        startSync: true,
-      }),
-    )
-    const adapter = createAdapter(base)
-    const persistedCollection = createCollection(
-      persistedCollectionOptions<
-        Row,
-        string | number,
-        never,
-        QueryCollectionUtils<Row>
-      >({
-        ...queryCollectionOptions<Row>({
-          id: `persisted-duplicate-insert`,
-          queryKey: [`persisted-duplicate-insert`],
-          queryFn: () => Promise.resolve(base.map((row) => ({ ...row }))),
-          queryClient: newQueryClient(),
-          getKey: (row) => row.id,
-          startSync: true,
-        }),
-        persistence: { adapter },
-      }),
-    )
-    await checked(async () => {
-      await reference.preload()
-      await persistedCollection.preload()
-      // The returned promise rejects with DuplicateKeySyncError. A
-      // synchronous throw fails here, because it escapes the call before
-      // `expect` receives a promise.
-      for (const collection of [reference, persistedCollection]) {
-        await expect(
-          collection.utils.writeInsert({ id: `k`, value: 9 }),
-        ).rejects.toBeInstanceOf(DuplicateKeySyncError)
-      }
-      await flush()
-      expect(sortRows(persistedCollection.values())).toEqual(
-        sortRows(reference.values()),
-      )
-      expect(sortRows(adapter.rows.values())).toEqual([{ id: `k`, value: 1 }])
-    }, [() => reference.cleanup(), () => persistedCollection.cleanup()])
-  })
-})
-
-describe(`the oracle harness keeps the primary failure`, () => {
-  it(`reports the driver's failure when cleanup also fails`, async () => {
-    const report = await checked(() => {
-      expect(1, `the driver's assertion`).toBe(2)
-      return Promise.resolve()
-    }, [
-      () => {
-        throw new Error(`cleanup failed on purpose`)
-      },
-    ]).then(
-      () => undefined,
-      (error: unknown) => error,
-    )
-    expect(report).toBeInstanceOf(AggregateError)
-    const aggregate = report as AggregateError
-    expect((aggregate.cause as Error).message).toContain(
-      `the driver's assertion`,
-    )
-    expect(aggregate.message).toContain(`the driver's assertion`)
-    expect(aggregate.errors).toHaveLength(2)
-    expect(aggregate.errors[0]).toBe(aggregate.cause)
-    expect((aggregate.errors[1] as Error).message).toBe(
-      `cleanup failed on purpose`,
-    )
-  })
-})
-
 /**
- * ## Direct writes interleaved with refetches: the precedence model
- *
- * The rows above come from a reference collection. That reference runs the
- * same direct-write code, so it cannot judge a fault in the code both paths
- * share. The laws below take their expected rows from this model instead:
- *
- * 1. A direct write takes its position in the order of operations when it is
- *    called. A fetch that starts later reflects the server after the write.
- * 2. Only an accepted write gains precedence over a fetch that started before
- *    it. A rejected write changes no rows and gains no precedence.
- * 3. For each key, the newest of these wins: the latest accepted write, or a
- *    fetch that started after it.
- * 4. `await refetch()` settles after its result's rows apply, even when that
- *    result had to wait for a direct write.
- * 5. A write whose sync run cleanup retired while it waited rejects, and it
- *    stores nothing.
- *
- * Each case below states its expected rows from these rules. The histories
- * are finite and pinned. Rule 4 is observed inside the refetch's fulfillment
- * callback, not after a later flush, because a later flush hides a refetch
- * that settles early.
+ * The duplicate-insert law: without persistence, core rejects a sync insert of an existing key;
+ * the persisted collection must reject it too, and keep the stored row.
  */
-
-type FailedWrite = `insert` | `update` | `delete` | `batch`
-
-function failingWrite(
-  utils: QueryCollectionUtils<Row>,
-  failed: FailedWrite,
-): unknown {
-  switch (failed) {
-    case `insert`:
-      // `k` exists in the applied rows, so this insert is a duplicate.
-      return utils.writeInsert({ id: `k`, value: 9 })
-    case `update`:
-      // `k` is not in the applied rows.
-      return utils.writeUpdate({ id: `k`, value: 9 })
-    case `delete`:
-      return utils.writeDelete(`k`)
-    case `batch`:
-      return utils.writeBatch(() => {
-        utils.writeInsert({ id: `k`, value: 9 })
-        utils.writeInsert({ id: `k`, value: 10 })
-      })
-  }
-}
-
-/** A persisted collection whose next durable write can be held. */
-function heldPersistedCollection(
-  id: string,
-  storage: ReturnType<typeof createAdapter>,
-  queryFn: () => Promise<Array<Row>>,
-) {
-  // Each hold catches the next durable write that changes rows.
-  let held:
-    | {
-        entered: ReturnType<typeof deferred<void>>
-        gate: ReturnType<typeof deferred<void>>
-      }
-    | undefined
-  let first: typeof held
-  const original = storage.applyCommittedTx
-  storage.applyCommittedTx = async (...args) => {
-    const current = held
-    if (current && args[1].mutations.length) {
-      held = undefined
-      current.entered.resolve()
-      await current.gate.promise
-    }
-    return original(...args)
-  }
-  const queryClient = newQueryClient()
-  const queryKey = [id]
-  const collection = createCollection(
+async function compareDuplicateInsert(): Promise<void> {
+  const base: Array<Row> = [{ id: `k`, value: 1 }]
+  const reference = createCollection(
+    queryCollectionOptions<Row>({
+      id: `reference-duplicate-insert`,
+      queryKey: [`reference-duplicate-insert`],
+      queryFn: () => Promise.resolve(base.map((row) => ({ ...row }))),
+      queryClient: newQueryClient(),
+      getKey: (row) => row.id,
+      startSync: true,
+    }),
+  )
+  const adapter = createAdapter(base)
+  const persistedCollection = createCollection(
     persistedCollectionOptions<
       Row,
       string | number,
@@ -954,330 +581,37 @@ function heldPersistedCollection(
       QueryCollectionUtils<Row>
     >({
       ...queryCollectionOptions<Row>({
-        id,
-        queryKey,
-        queryClient,
-        queryFn,
+        id: `persisted-duplicate-insert`,
+        queryKey: [`persisted-duplicate-insert`],
+        queryFn: () => Promise.resolve(base.map((row) => ({ ...row }))),
+        queryClient: newQueryClient(),
         getKey: (row) => row.id,
         startSync: true,
       }),
-      persistence: { adapter: storage },
+      persistence: { adapter },
     }),
   )
-  return {
-    collection,
-    queryClient,
-    queryKey,
-    hold: () => {
-      held = { entered: deferred(), gate: deferred() }
-      first ??= held
-      return {
-        entered: held.entered.promise,
-        release: held.gate.resolve,
-      }
-    },
-    get entered() {
-      return first!.entered.promise
-    },
-    release: () => first?.gate.resolve(),
-  }
-}
-
-describe(`direct writes interleaved with refetches follow the precedence model`, () => {
-  for (const persistence of [false, true]) {
-    for (const failed of [`insert`, `update`, `delete`, `batch`] as const) {
-      it(`a rejected ${failed} leaves an in-flight refetch authoritative (persisted=${persistence})`, async () => {
-        // Rule 2: the rejected write gains no precedence, so the refetch's
-        // row for `k` (value 2) is the expected row.
-        const base = failed === `insert` ? [{ id: `k`, value: 1 }] : []
-        const held = heldQueryFn(() => base)
-        const id = `rejected-${failed}-${persistence}`
-        const queryClient = newQueryClient()
-        const options = queryCollectionOptions<Row>({
-          id,
-          queryKey: [id],
-          queryClient,
-          queryFn: held.queryFn,
-          getKey: (row) => row.id,
-          startSync: true,
-        })
-        const collection = persistence
-          ? createCollection(
-              persistedCollectionOptions<
-                Row,
-                string | number,
-                never,
-                QueryCollectionUtils<Row>
-              >({ ...options, persistence: { adapter: createAdapter(base) } }),
-            )
-          : createCollection(options)
-        await checked(async () => {
-          await collection.preload()
-          held.arm()
-          const refetch = collection.utils.refetch()
-          await vi.waitFor(() => expect(held.calls.length).toBe(1))
-          const result = await outcomeOf(() =>
-            failingWrite(collection.utils, failed),
-          )
-          expect(result).toMatchObject({ timing: `async` })
-          expect(result.outcome).not.toBe(`ok`)
-          held.disarm()
-          held.calls[0]!.resolve([{ id: `k`, value: 2 }])
-          const rowsAtSettlement = await refetch.then(() =>
-            sortRows(collection.values()),
-          )
-          expect(rowsAtSettlement).toEqual([{ id: `k`, value: 2 }])
-          expect(
-            sortRows(queryClient.getQueryData<Array<Row>>([id]) ?? []),
-          ).toEqual([{ id: `k`, value: 2 }])
-        }, [() => collection.cleanup()])
-      })
+  await checked(async () => {
+    await reference.preload()
+    await persistedCollection.preload()
+    // The returned promise rejects with DuplicateKeySyncError. A
+    // synchronous throw fails here, because it escapes the call before
+    // `expect` receives a promise.
+    for (const collection of [reference, persistedCollection]) {
+      await expect(
+        collection.utils.writeInsert({ id: `k`, value: 9 }),
+      ).rejects.toBeInstanceOf(DuplicateKeySyncError)
     }
-  }
-
-  it(`a queued write sees an earlier queued write`, async () => {
-    // Rule 3: the insert of k=3 is accepted first, so the update to k=4 is
-    // valid and wins.
-    let server = [{ id: `a`, value: 1 }]
-    const storage = createAdapter(server)
-    const fixture = heldPersistedCollection(`two-queued-writes`, storage, () =>
-      Promise.resolve(server.map((row) => ({ ...row }))),
-    )
-    const { collection } = fixture
-    await checked(async () => {
-      await collection.preload()
-      fixture.hold()
-      server = [{ id: `a`, value: 2 }]
-      const refetch = collection.utils.refetch()
-      await fixture.entered
-      const first = outcomeOf(() =>
-        collection.utils.writeInsert({ id: `k`, value: 3 }),
-      )
-      const second = outcomeOf(() =>
-        collection.utils.writeUpdate({ id: `k`, value: 4 }),
-      )
-      fixture.release()
-      expect((await first).outcome).toBe(`ok`)
-      expect((await second).outcome).toBe(`ok`)
-      await refetch
-      expect(sortRows(collection.values())).toEqual([
-        { id: `a`, value: 2 },
-        { id: `k`, value: 4 },
-      ])
-    }, [() => fixture.release(), () => collection.cleanup()])
-  })
-
-  it(`a refetch that waited for a direct write settles after its rows apply`, async () => {
-    // Rule 4. The later refetch starts after the write, so its row wins
-    // (rule 1). Its fulfillment must already see that row.
-    let server = [{ id: `k`, value: 1 }]
-    const storage = createAdapter(server)
-    const held = heldQueryFn(() => server)
-    const fixture = heldPersistedCollection(
-      `settles-after-apply`,
-      storage,
-      held.queryFn,
+    await flush()
+    expect(sortRows(persistedCollection.values())).toEqual(
+      sortRows(reference.values()),
     )
-    const { collection } = fixture
-    await checked(async () => {
-      await collection.preload()
-      fixture.hold()
-      server = [{ id: `k`, value: 2 }]
-      const firstRefetch = collection.utils.refetch()
-      await fixture.entered
-      const directWrite = outcomeOf(() =>
-        collection.utils.writeUpdate({ id: `k`, value: 9 }),
-      )
-      held.arm()
-      let settled = false
-      const later = collection.utils.refetch().then(() => {
-        settled = true
-        return sortRows(collection.values())
-      })
-      await vi.waitFor(() => expect(held.calls.length).toBe(1))
-      held.disarm()
-      held.calls[0]!.resolve([{ id: `k`, value: 6 }])
-      await flush()
-      await flush()
-      expect({ settled, rows: sortRows(collection.values()) }).toEqual({
-        settled: false,
-        rows: [{ id: `k`, value: 2 }],
-      })
-      fixture.release()
-      expect(await later).toEqual([{ id: `k`, value: 6 }])
-      await Promise.all([firstRefetch, directWrite])
-    }, [() => fixture.release(), () => collection.cleanup()])
-  })
+    expect(sortRows(adapter.rows.values())).toEqual([{ id: `k`, value: 1 }])
+  }, [() => reference.cleanup(), () => persistedCollection.cleanup()])
+}
 
-  it(`a refetch that waited for a direct write settles only after its held merge applies`, async () => {
-    // Rule 4 when the merged rows' own durable write is held: the refetch
-    // must keep waiting until that write releases and the rows apply.
-    let server = [{ id: `k`, value: 1 }]
-    const storage = createAdapter(server)
-    const held = heldQueryFn(() => server)
-    const fixture = heldPersistedCollection(
-      `settles-after-held-merge`,
-      storage,
-      held.queryFn,
-    )
-    const { collection } = fixture
-    let mergeHold: ReturnType<typeof fixture.hold> | undefined
-    await checked(async () => {
-      await collection.preload()
-      fixture.hold()
-      server = [{ id: `k`, value: 2 }]
-      const firstRefetch = collection.utils.refetch()
-      await fixture.entered
-      const directWrite = outcomeOf(() =>
-        collection.utils.writeUpdate({ id: `k`, value: 9 }),
-      )
-      held.arm()
-      let settled = false
-      const later = collection.utils.refetch().then(() => {
-        settled = true
-        return sortRows(collection.values())
-      })
-      await vi.waitFor(() => expect(held.calls.length).toBe(1))
-      held.disarm()
-      held.calls[0]!.resolve([{ id: `k`, value: 6 }])
-      await flush()
-      // Release the first hold, but catch the next row write: the direct
-      // write's, then the merged result's.
-      mergeHold = fixture.hold()
-      fixture.release()
-      await mergeHold.entered
-      const writeHold = mergeHold
-      mergeHold = fixture.hold()
-      writeHold.release()
-      await mergeHold.entered
-      await flush()
-      expect(settled).toBe(false)
-      mergeHold.release()
-      expect(await later).toEqual([{ id: `k`, value: 6 }])
-      await Promise.all([directWrite, firstRefetch])
-    }, [
-      () => fixture.release(),
-      () => mergeHold?.release(),
-      () => collection.cleanup(),
-    ])
+describe(`a persisted direct insert of an existing key`, () => {
+  it(`rejects like the reference and keeps the row`, async () => {
+    await compareDuplicateInsert()
   })
-
-  for (const sibling of [false, true]) {
-    it(`a write after a deferred result arrives keeps precedence (${sibling ? `sibling key` : `same key`})`, async () => {
-      // W1 writes k=9. R3 starts after W1 and returns k=6, so R3 wins on k
-      // (rule 1). W2 is called after R3 started, so W2 wins on its key
-      // (rule 3): k=10 for the same key, or j=10 beside k=6.
-      let server = [{ id: `k`, value: 1 }]
-      const storage = createAdapter(server)
-      const held = heldQueryFn(() => server)
-      const id = `second-write-${sibling ? `sibling` : `same`}`
-      const fixture = heldPersistedCollection(id, storage, held.queryFn)
-      const { collection, queryClient, queryKey } = fixture
-      await checked(async () => {
-        await collection.preload()
-        fixture.hold()
-        server = [{ id: `k`, value: 5 }]
-        const first = collection.utils.refetch()
-        await fixture.entered
-        const w1 = outcomeOf(() =>
-          collection.utils.writeUpdate({ id: `k`, value: 9 }),
-        )
-        held.arm()
-        const r3 = collection.utils.refetch()
-        await vi.waitFor(() => expect(held.calls.length).toBe(1))
-        held.disarm()
-        held.calls[0]!.resolve(
-          sibling
-            ? [
-                { id: `j`, value: 1 },
-                { id: `k`, value: 6 },
-              ]
-            : [{ id: `k`, value: 6 }],
-        )
-        await flush()
-        const w2 = outcomeOf(() =>
-          sibling
-            ? collection.utils.writeUpsert({ id: `j`, value: 10 })
-            : collection.utils.writeUpdate({ id: `k`, value: 10 }),
-        )
-        fixture.release()
-        expect((await w1).outcome).toBe(`ok`)
-        expect((await w2).outcome).toBe(`ok`)
-        await Promise.all([first, r3])
-        await flush()
-        const expected = sibling
-          ? [
-              { id: `j`, value: 10 },
-              { id: `k`, value: 6 },
-            ]
-          : [{ id: `k`, value: 10 }]
-        expect({
-          rows: sortRows(collection.values()),
-          cache: sortRows(queryClient.getQueryData<Array<Row>>(queryKey) ?? []),
-          stored: sortRows(storage.rows.values()),
-        }).toEqual({ rows: expected, cache: expected, stored: expected })
-      }, [() => fixture.release(), () => collection.cleanup()])
-    })
-  }
-
-  for (const op of [`insert`, `upsert`, `batch`] as const) {
-    it(`a ${op} whose sync run cleanup retired while it waited rejects and stores nothing`, async () => {
-      // Rule 5. The write waits behind a held durable write, then cleanup
-      // starts before the lock is released.
-      let server = [{ id: `a`, value: 1 }]
-      const storage = createAdapter(server)
-      const fixture = heldPersistedCollection(`cleanup-${op}`, storage, () =>
-        Promise.resolve(server.map((row) => ({ ...row }))),
-      )
-      const { collection } = fixture
-      await checked(async () => {
-        await collection.preload()
-        fixture.hold()
-        server = [{ id: `a`, value: 2 }]
-        const refetch = collection.utils.refetch().catch(() => undefined)
-        await fixture.entered
-        const pending = outcomeOf(() =>
-          op === `insert`
-            ? collection.utils.writeInsert({ id: `z`, value: 9 })
-            : op === `upsert`
-              ? collection.utils.writeUpsert({ id: `z`, value: 9 })
-              : collection.utils.writeBatch(() => {
-                  collection.utils.writeInsert({ id: `z`, value: 9 })
-                }),
-        )
-        const cleanup = collection.cleanup()
-        fixture.release()
-        await cleanup
-        const result = await pending
-        await refetch
-        expect(result.outcome).not.toBe(`ok`)
-        expect(storage.rows.has(`z`)).toBe(false)
-        // A restart over the same storage publishes no `z`.
-        const restarted = createCollection(
-          persistedCollectionOptions<
-            Row,
-            string | number,
-            never,
-            QueryCollectionUtils<Row>
-          >({
-            ...queryCollectionOptions<Row>({
-              id: `cleanup-${op}`,
-              queryKey: [`cleanup-${op}-restart`],
-              queryClient: newQueryClient(),
-              queryFn: () => Promise.resolve(server.map((row) => ({ ...row }))),
-              getKey: (row) => row.id,
-              startSync: true,
-            }),
-            persistence: { adapter: storage },
-          }),
-        )
-        try {
-          await restarted.preload()
-          expect(restarted.has(`z`)).toBe(false)
-        } finally {
-          await restarted.cleanup()
-        }
-      }, [() => fixture.release(), () => collection.cleanup()])
-    })
-  }
 })
diff --git a/packages/query-db-collection/tests/persisted-direct-write.test.ts b/packages/query-db-collection/tests/persisted-direct-write.test.ts
new file mode 100644
index 0000000000..c2cd2fb983
--- /dev/null
+++ b/packages/query-db-collection/tests/persisted-direct-write.test.ts
@@ -0,0 +1,456 @@
+// Ordinary unit tests for direct writes that interleave with refetches, and for
+// the oracle harness's failure reporting. Their expected rows are pinned by
+// hand from the precedence rules in each test's comments. The matrix and ordering
+// laws are owned by persisted-direct-write-window.oracle.test.ts.
+import { describe, expect, it, vi } from 'vitest'
+import { createCollection } from '@tanstack/db'
+import { persistedCollectionOptions } from '../../db-sqlite-persistence-core/src'
+import { queryCollectionOptions } from '../src/query'
+import {
+  checked,
+  createAdapter,
+  deferred,
+  flush,
+  heldQueryFn,
+  newQueryClient,
+  outcomeOf,
+  sortRows,
+} from './persisted-direct-write-support'
+import type { QueryCollectionUtils } from '../src/query'
+import type { Row } from './persisted-direct-write-support'
+
+describe(`the oracle harness keeps the primary failure`, () => {
+  it(`reports the driver's failure when cleanup also fails`, async () => {
+    const report = await checked(() => {
+      expect(1, `the driver's assertion`).toBe(2)
+      return Promise.resolve()
+    }, [
+      () => {
+        throw new Error(`cleanup failed on purpose`)
+      },
+    ]).then(
+      () => undefined,
+      (error: unknown) => error,
+    )
+    expect(report).toBeInstanceOf(AggregateError)
+    const aggregate = report as AggregateError
+    expect((aggregate.cause as Error).message).toContain(
+      `the driver's assertion`,
+    )
+    expect(aggregate.message).toContain(`the driver's assertion`)
+    expect(aggregate.errors).toHaveLength(2)
+    expect(aggregate.errors[0]).toBe(aggregate.cause)
+    expect((aggregate.errors[1] as Error).message).toBe(
+      `cleanup failed on purpose`,
+    )
+  })
+})
+
+/**
+ * ## Direct writes interleaved with refetches: the precedence model
+ *
+ * The rows above come from a reference collection. That reference runs the
+ * same direct-write code, so it cannot judge a fault in the code both paths
+ * share. The laws below take their expected rows from this model instead:
+ *
+ * 1. A direct write takes its position in the order of operations when it is
+ *    called. A fetch that starts later reflects the server after the write.
+ * 2. Only an accepted write gains precedence over a fetch that started before
+ *    it. A rejected write changes no rows and gains no precedence.
+ * 3. For each key, the newest of these wins: the latest accepted write, or a
+ *    fetch that started after it.
+ * 4. `await refetch()` settles after its result's rows apply, even when that
+ *    result had to wait for a direct write.
+ * 5. A write whose sync run cleanup retired while it waited rejects, and it
+ *    stores nothing.
+ *
+ * Each case below states its expected rows from these rules. The histories
+ * are finite and pinned. Rule 4 is observed inside the refetch's fulfillment
+ * callback, not after a later flush, because a later flush hides a refetch
+ * that settles early.
+ */
+
+type FailedWrite = `insert` | `update` | `delete` | `batch`
+
+function failingWrite(
+  utils: QueryCollectionUtils<Row>,
+  failed: FailedWrite,
+): unknown {
+  switch (failed) {
+    case `insert`:
+      // `k` exists in the applied rows, so this insert is a duplicate.
+      return utils.writeInsert({ id: `k`, value: 9 })
+    case `update`:
+      // `k` is not in the applied rows.
+      return utils.writeUpdate({ id: `k`, value: 9 })
+    case `delete`:
+      return utils.writeDelete(`k`)
+    case `batch`:
+      return utils.writeBatch(() => {
+        utils.writeInsert({ id: `k`, value: 9 })
+        utils.writeInsert({ id: `k`, value: 10 })
+      })
+  }
+}
+
+/** A persisted collection whose next durable write can be held. */
+function heldPersistedCollection(
+  id: string,
+  storage: ReturnType<typeof createAdapter>,
+  queryFn: () => Promise<Array<Row>>,
+) {
+  // Each hold catches the next durable write that changes rows.
+  let held:
+    | {
+        entered: ReturnType<typeof deferred<void>>
+        gate: ReturnType<typeof deferred<void>>
+      }
+    | undefined
+  let first: typeof held
+  const original = storage.applyCommittedTx
+  storage.applyCommittedTx = async (...args) => {
+    const current = held
+    if (current && args[1].mutations.length) {
+      held = undefined
+      current.entered.resolve()
+      await current.gate.promise
+    }
+    return original(...args)
+  }
+  const queryClient = newQueryClient()
+  const queryKey = [id]
+  const collection = createCollection(
+    persistedCollectionOptions<
+      Row,
+      string | number,
+      never,
+      QueryCollectionUtils<Row>
+    >({
+      ...queryCollectionOptions<Row>({
+        id,
+        queryKey,
+        queryClient,
+        queryFn,
+        getKey: (row) => row.id,
+        startSync: true,
+      }),
+      persistence: { adapter: storage },
+    }),
+  )
+  return {
+    collection,
+    queryClient,
+    queryKey,
+    hold: () => {
+      held = { entered: deferred(), gate: deferred() }
+      first ??= held
+      return {
+        entered: held.entered.promise,
+        release: held.gate.resolve,
+      }
+    },
+    get entered() {
+      return first!.entered.promise
+    },
+    release: () => first?.gate.resolve(),
+  }
+}
+
+describe(`direct writes interleaved with refetches follow the precedence model`, () => {
+  for (const persistence of [false, true]) {
+    for (const failed of [`insert`, `update`, `delete`, `batch`] as const) {
+      it(`a rejected ${failed} leaves an in-flight refetch authoritative (persisted=${persistence})`, async () => {
+        // Rule 2: the rejected write gains no precedence, so the refetch's
+        // row for `k` (value 2) is the expected row.
+        const base = failed === `insert` ? [{ id: `k`, value: 1 }] : []
+        const held = heldQueryFn(() => base)
+        const id = `rejected-${failed}-${persistence}`
+        const queryClient = newQueryClient()
+        const options = queryCollectionOptions<Row>({
+          id,
+          queryKey: [id],
+          queryClient,
+          queryFn: held.queryFn,
+          getKey: (row) => row.id,
+          startSync: true,
+        })
+        const collection = persistence
+          ? createCollection(
+              persistedCollectionOptions<
+                Row,
+                string | number,
+                never,
+                QueryCollectionUtils<Row>
+              >({ ...options, persistence: { adapter: createAdapter(base) } }),
+            )
+          : createCollection(options)
+        await checked(async () => {
+          await collection.preload()
+          held.arm()
+          const refetch = collection.utils.refetch()
+          await vi.waitFor(() => expect(held.calls.length).toBe(1))
+          const result = await outcomeOf(() =>
+            failingWrite(collection.utils, failed),
+          )
+          expect(result).toMatchObject({ timing: `async` })
+          expect(result.outcome).not.toBe(`ok`)
+          held.disarm()
+          held.calls[0]!.resolve([{ id: `k`, value: 2 }])
+          const rowsAtSettlement = await refetch.then(() =>
+            sortRows(collection.values()),
+          )
+          expect(rowsAtSettlement).toEqual([{ id: `k`, value: 2 }])
+          expect(
+            sortRows(queryClient.getQueryData<Array<Row>>([id]) ?? []),
+          ).toEqual([{ id: `k`, value: 2 }])
+        }, [() => collection.cleanup()])
+      })
+    }
+  }
+
+  it(`a queued write sees an earlier queued write`, async () => {
+    // Rule 3: the insert of k=3 is accepted first, so the update to k=4 is
+    // valid and wins.
+    let server = [{ id: `a`, value: 1 }]
+    const storage = createAdapter(server)
+    const fixture = heldPersistedCollection(`two-queued-writes`, storage, () =>
+      Promise.resolve(server.map((row) => ({ ...row }))),
+    )
+    const { collection } = fixture
+    await checked(async () => {
+      await collection.preload()
+      fixture.hold()
+      server = [{ id: `a`, value: 2 }]
+      const refetch = collection.utils.refetch()
+      await fixture.entered
+      const first = outcomeOf(() =>
+        collection.utils.writeInsert({ id: `k`, value: 3 }),
+      )
+      const second = outcomeOf(() =>
+        collection.utils.writeUpdate({ id: `k`, value: 4 }),
+      )
+      fixture.release()
+      expect((await first).outcome).toBe(`ok`)
+      expect((await second).outcome).toBe(`ok`)
+      await refetch
+      expect(sortRows(collection.values())).toEqual([
+        { id: `a`, value: 2 },
+        { id: `k`, value: 4 },
+      ])
+    }, [() => fixture.release(), () => collection.cleanup()])
+  })
+
+  it(`a refetch that waited for a direct write settles after its rows apply`, async () => {
+    // Rule 4. The later refetch starts after the write, so its row wins
+    // (rule 1). Its fulfillment must already see that row.
+    let server = [{ id: `k`, value: 1 }]
+    const storage = createAdapter(server)
+    const held = heldQueryFn(() => server)
+    const fixture = heldPersistedCollection(
+      `settles-after-apply`,
+      storage,
+      held.queryFn,
+    )
+    const { collection } = fixture
+    await checked(async () => {
+      await collection.preload()
+      fixture.hold()
+      server = [{ id: `k`, value: 2 }]
+      const firstRefetch = collection.utils.refetch()
+      await fixture.entered
+      const directWrite = outcomeOf(() =>
+        collection.utils.writeUpdate({ id: `k`, value: 9 }),
+      )
+      held.arm()
+      let settled = false
+      const later = collection.utils.refetch().then(() => {
+        settled = true
+        return sortRows(collection.values())
+      })
+      await vi.waitFor(() => expect(held.calls.length).toBe(1))
+      held.disarm()
+      held.calls[0]!.resolve([{ id: `k`, value: 6 }])
+      await flush()
+      await flush()
+      expect({ settled, rows: sortRows(collection.values()) }).toEqual({
+        settled: false,
+        rows: [{ id: `k`, value: 2 }],
+      })
+      fixture.release()
+      expect(await later).toEqual([{ id: `k`, value: 6 }])
+      await Promise.all([firstRefetch, directWrite])
+    }, [() => fixture.release(), () => collection.cleanup()])
+  })
+
+  it(`a refetch that waited for a direct write settles only after its held merge applies`, async () => {
+    // Rule 4 when the merged rows' own durable write is held: the refetch
+    // must keep waiting until that write releases and the rows apply.
+    let server = [{ id: `k`, value: 1 }]
+    const storage = createAdapter(server)
+    const held = heldQueryFn(() => server)
+    const fixture = heldPersistedCollection(
+      `settles-after-held-merge`,
+      storage,
+      held.queryFn,
+    )
+    const { collection } = fixture
+    let mergeHold: ReturnType<typeof fixture.hold> | undefined
+    await checked(async () => {
+      await collection.preload()
+      fixture.hold()
+      server = [{ id: `k`, value: 2 }]
+      const firstRefetch = collection.utils.refetch()
+      await fixture.entered
+      const directWrite = outcomeOf(() =>
+        collection.utils.writeUpdate({ id: `k`, value: 9 }),
+      )
+      held.arm()
+      let settled = false
+      const later = collection.utils.refetch().then(() => {
+        settled = true
+        return sortRows(collection.values())
+      })
+      await vi.waitFor(() => expect(held.calls.length).toBe(1))
+      held.disarm()
+      held.calls[0]!.resolve([{ id: `k`, value: 6 }])
+      await flush()
+      // Release the first hold, but catch the next row write: the direct
+      // write's, then the merged result's.
+      mergeHold = fixture.hold()
+      fixture.release()
+      await mergeHold.entered
+      const writeHold = mergeHold
+      mergeHold = fixture.hold()
+      writeHold.release()
+      await mergeHold.entered
+      await flush()
+      expect(settled).toBe(false)
+      mergeHold.release()
+      expect(await later).toEqual([{ id: `k`, value: 6 }])
+      await Promise.all([directWrite, firstRefetch])
+    }, [
+      () => fixture.release(),
+      () => mergeHold?.release(),
+      () => collection.cleanup(),
+    ])
+  })
+
+  for (const sibling of [false, true]) {
+    it(`a write after a deferred result arrives keeps precedence (${sibling ? `sibling key` : `same key`})`, async () => {
+      // W1 writes k=9. R3 starts after W1 and returns k=6, so R3 wins on k
+      // (rule 1). W2 is called after R3 started, so W2 wins on its key
+      // (rule 3): k=10 for the same key, or j=10 beside k=6.
+      let server = [{ id: `k`, value: 1 }]
+      const storage = createAdapter(server)
+      const held = heldQueryFn(() => server)
+      const id = `second-write-${sibling ? `sibling` : `same`}`
+      const fixture = heldPersistedCollection(id, storage, held.queryFn)
+      const { collection, queryClient, queryKey } = fixture
+      await checked(async () => {
+        await collection.preload()
+        fixture.hold()
+        server = [{ id: `k`, value: 5 }]
+        const first = collection.utils.refetch()
+        await fixture.entered
+        const w1 = outcomeOf(() =>
+          collection.utils.writeUpdate({ id: `k`, value: 9 }),
+        )
+        held.arm()
+        const r3 = collection.utils.refetch()
+        await vi.waitFor(() => expect(held.calls.length).toBe(1))
+        held.disarm()
+        held.calls[0]!.resolve(
+          sibling
+            ? [
+                { id: `j`, value: 1 },
+                { id: `k`, value: 6 },
+              ]
+            : [{ id: `k`, value: 6 }],
+        )
+        await flush()
+        const w2 = outcomeOf(() =>
+          sibling
+            ? collection.utils.writeUpsert({ id: `j`, value: 10 })
+            : collection.utils.writeUpdate({ id: `k`, value: 10 }),
+        )
+        fixture.release()
+        expect((await w1).outcome).toBe(`ok`)
+        expect((await w2).outcome).toBe(`ok`)
+        await Promise.all([first, r3])
+        await flush()
+        const expected = sibling
+          ? [
+              { id: `j`, value: 10 },
+              { id: `k`, value: 6 },
+            ]
+          : [{ id: `k`, value: 10 }]
+        expect({
+          rows: sortRows(collection.values()),
+          cache: sortRows(queryClient.getQueryData<Array<Row>>(queryKey) ?? []),
+          stored: sortRows(storage.rows.values()),
+        }).toEqual({ rows: expected, cache: expected, stored: expected })
+      }, [() => fixture.release(), () => collection.cleanup()])
+    })
+  }
+
+  for (const op of [`insert`, `upsert`, `batch`] as const) {
+    it(`a ${op} whose sync run cleanup retired while it waited rejects and stores nothing`, async () => {
+      // Rule 5. The write waits behind a held durable write, then cleanup
+      // starts before the lock is released.
+      let server = [{ id: `a`, value: 1 }]
+      const storage = createAdapter(server)
+      const fixture = heldPersistedCollection(`cleanup-${op}`, storage, () =>
+        Promise.resolve(server.map((row) => ({ ...row }))),
+      )
+      const { collection } = fixture
+      await checked(async () => {
+        await collection.preload()
+        fixture.hold()
+        server = [{ id: `a`, value: 2 }]
+        const refetch = collection.utils.refetch().catch(() => undefined)
+        await fixture.entered
+        const pending = outcomeOf(() =>
+          op === `insert`
+            ? collection.utils.writeInsert({ id: `z`, value: 9 })
+            : op === `upsert`
+              ? collection.utils.writeUpsert({ id: `z`, value: 9 })
+              : collection.utils.writeBatch(() => {
+                  collection.utils.writeInsert({ id: `z`, value: 9 })
+                }),
+        )
+        const cleanup = collection.cleanup()
+        fixture.release()
+        await cleanup
+        const result = await pending
+        await refetch
+        expect(result.outcome).not.toBe(`ok`)
+        expect(storage.rows.has(`z`)).toBe(false)
+        // A restart over the same storage publishes no `z`.
+        const restarted = createCollection(
+          persistedCollectionOptions<
+            Row,
+            string | number,
+            never,
+            QueryCollectionUtils<Row>
+          >({
+            ...queryCollectionOptions<Row>({
+              id: `cleanup-${op}`,
+              queryKey: [`cleanup-${op}-restart`],
+              queryClient: newQueryClient(),
+              queryFn: () => Promise.resolve(server.map((row) => ({ ...row }))),
+              getKey: (row) => row.id,
+              startSync: true,
+            }),
+            persistence: { adapter: storage },
+          }),
+        )
+        try {
+          await restarted.preload()
+          expect(restarted.has(`z`)).toBe(false)
+        } finally {
+          await restarted.cleanup()
+        }
+      }, [() => fixture.release(), () => collection.cleanup()])
+    })
+  }
+})
diff --git a/packages/query-db-collection/tests/refetch-ordered-prefix-oracle.test.ts b/packages/query-db-collection/tests/refetch-ordered-prefix-oracle.test.ts
index 06c50b2953..fe2646d59f 100644
--- a/packages/query-db-collection/tests/refetch-ordered-prefix-oracle.test.ts
+++ b/packages/query-db-collection/tests/refetch-ordered-prefix-oracle.test.ts
@@ -1,6 +1,5 @@
 import {
   BTreeIndex,
-  IR,
   createCollection,
   createLiveQueryCollection,
   eq,
@@ -17,8 +16,10 @@ import {
   oracleRuns,
   readOracleRunConfig,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import { evaluateReferenceExpression } from '../../db/tests/reference-expression-oracle'
 import { queryCollectionOptions } from '../src/query'
+import { sameOrderedIds, settle } from './refetch-ordered-prefix-support'
 import type { LoadSubsetOptions, SyncConfig } from '@tanstack/db'
 
 /**
@@ -476,12 +477,6 @@ type Run = {
 
 let collectionSequence = 0
 
-async function settle(): Promise<void> {
-  for (let turn = 0; turn < 20; turn++) {
-    await new Promise((resolve) => setTimeout(resolve, 0))
-  }
-}
-
 async function startRun(testCase: Case): Promise<Run> {
   const { scenario } = testCase
   const id = `refetch-ordered-prefix-${collectionSequence++}`
@@ -1013,16 +1008,6 @@ async function withDeadline<T>(work: Promise<T>): Promise<T> {
   }
 }
 
-function sameOrderedIds(
-  actual: ReadonlyArray<number>,
-  expected: ReadonlyArray<number>,
-): boolean {
-  return (
-    actual.length === expected.length &&
-    expected.every((id, index) => actual[index] === id)
-  )
-}
-
 const property = `query-db.refetch-ordered-prefix`
 const replay = readOracleRunConfig()
 const campaigns =
@@ -1032,14 +1017,13 @@ const campaigns =
       ? ([`replay`] as const)
       : ([] as const)
 
-describe(`query-db on-demand refetch keeps served ordered prefixes whole`, () => {
-  it(`the comparison rejects a window with the right size but a stale row`, () => {
-    expect(sameOrderedIds([5, 4], [5, 4])).toBe(true)
-    expect(sameOrderedIds([4, 1], [5, 4])).toBe(false)
-    expect(sameOrderedIds([4, 5], [5, 4])).toBe(false)
-    expect(sameOrderedIds([5], [5, 4])).toBe(false)
-  })
+declareOracle({
+  check: [checkCase],
+  model: [expectedWindow, expectedCoverage],
+  grammar: [caseArbitrary, heldCaseArbitrary],
+})
 
+describe(`query-db on-demand refetch keeps served ordered prefixes whole`, () => {
   // The issue's trace (rank desc, limit 2). Removing rank 10's marker makes
   // the loader serve a continuation after rank 4. The backend then gains
   // rank 5 (marked) and rank 6 (unmarked). The refetched first page ends at
@@ -1518,89 +1502,6 @@ describe(`query-db on-demand refetch keeps served ordered prefixes whole`, () =>
     expect(failures).toEqual([])
   })
 
-  // A row that arrives ahead moves a one-page window's end earlier, so the
-  // refetch must report. The report gate judges a page's end by order, not
-  // by how the provider returned it:
-  // - Rows without `rank` sort last, so the first page ends on one. An empty
-  //   page and a page whose last row has no order value stay distinct.
-  // - A provider may return a page's rows in any order. Its last array row
-  //   is then not the page's end.
-  // These drive the sync boundary directly: the generated campaigns give
-  // every row a rank, and their provider returns rows in order.
-  it.each([
-    {
-      name: `from a row without an order value`,
-      initial: [{ id: 0, rank: 3 }, { id: 1 }, { id: 2 }],
-      arrival: { id: 3, rank: 2 },
-      reversed: false,
-    },
-    {
-      name: `when the provider returns the page in reverse order`,
-      initial: [
-        { id: 0, rank: 10 },
-        { id: 1, rank: 4 },
-        { id: 2, rank: 1 },
-      ],
-      arrival: { id: 3, rank: 6 },
-      reversed: true,
-    },
-  ])(
-    `a refetch reports a page whose end moves earlier $name`,
-    async ({ initial, arrival, reversed }) => {
-      type Row = { id: number; rank?: number }
-      const backend: Array<Row> = [...initial]
-      const queryClient = new QueryClient({
-        defaultOptions: { queries: { staleTime: Infinity, retry: false } },
-      })
-      const items = createCollection(
-        queryCollectionOptions<Row>({
-          id: `refetch-ordered-prefix-unranked-${collectionSequence++}`,
-          queryClient,
-          queryKey: [`unranked`],
-          syncMode: `on-demand`,
-          getKey: (row) => row.id,
-          queryFn: (ctx) => {
-            const options = ctx.meta?.loadSubsetOptions as LoadSubsetOptions
-            const offset = options.offset ?? 0
-            const page = [...backend]
-              .sort(
-                (a, b) =>
-                  (b.rank ?? -Infinity) - (a.rank ?? -Infinity) || a.id - b.id,
-              )
-              .slice(offset, offset + options.limit!)
-            return reversed ? page.reverse() : page
-          },
-        }),
-      )
-      let reports = 0
-      items.on(`loadedSubsets:invalidated`, () => {
-        reports++
-      })
-      const orderBy: Array<IR.OrderByClause> = [
-        {
-          expression: new IR.PropRef([`rank`]),
-          compareOptions: {
-            direction: `desc`,
-            nulls: `last`,
-            stringSort: `lexical`,
-          },
-        },
-      ]
-      try {
-        items.startSyncImmediate()
-        await items._sync.loadSubset({ orderBy, limit: 2 })
-        expect(items.toArray.map((row) => row.id).sort()).toEqual([0, 1])
-        backend.push(arrival)
-        await items.utils.refetch()
-        await settle()
-        expect(reports).toBe(1)
-      } finally {
-        await items.cleanup()
-        queryClient.clear()
-      }
-    },
-  )
-
   it(`a refetch settles when the provider honors neither cursor nor offset`, async () => {
     const run = await startRun({
       scenario: {
diff --git a/packages/query-db-collection/tests/refetch-ordered-prefix-support.ts b/packages/query-db-collection/tests/refetch-ordered-prefix-support.ts
new file mode 100644
index 0000000000..a559aa5d36
--- /dev/null
+++ b/packages/query-db-collection/tests/refetch-ordered-prefix-support.ts
@@ -0,0 +1,18 @@
+// Helpers shared by the refetch-ordered-prefix oracle and its ordinary unit
+// tests in refetch-ordered-prefix.test.ts. Neither owns a law here.
+
+export async function settle(): Promise<void> {
+  for (let turn = 0; turn < 20; turn++) {
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  }
+}
+
+export function sameOrderedIds(
+  actual: ReadonlyArray<number>,
+  expected: ReadonlyArray<number>,
+): boolean {
+  return (
+    actual.length === expected.length &&
+    expected.every((id, index) => actual[index] === id)
+  )
+}
diff --git a/packages/query-db-collection/tests/refetch-ordered-prefix.test.ts b/packages/query-db-collection/tests/refetch-ordered-prefix.test.ts
new file mode 100644
index 0000000000..18876a1003
--- /dev/null
+++ b/packages/query-db-collection/tests/refetch-ordered-prefix.test.ts
@@ -0,0 +1,102 @@
+// Ordinary unit tests for on-demand refetch of ordered prefixes. The law, its
+// model, and the generated histories are owned by
+// refetch-ordered-prefix-oracle.test.ts (query-db.refetch-ordered-prefix).
+import { QueryClient } from '@tanstack/query-core'
+import { IR, createCollection } from '@tanstack/db'
+import { describe, expect, it } from 'vitest'
+import { queryCollectionOptions } from '../src/query'
+import { sameOrderedIds, settle } from './refetch-ordered-prefix-support'
+import type { LoadSubsetOptions } from '@tanstack/db'
+
+let collectionSequence = 0
+
+describe(`query-db on-demand refetch keeps served ordered prefixes whole`, () => {
+  it(`the comparison rejects a window with the right size but a stale row`, () => {
+    expect(sameOrderedIds([5, 4], [5, 4])).toBe(true)
+    expect(sameOrderedIds([4, 1], [5, 4])).toBe(false)
+    expect(sameOrderedIds([4, 5], [5, 4])).toBe(false)
+    expect(sameOrderedIds([5], [5, 4])).toBe(false)
+  })
+  // A row that arrives ahead moves a one-page window's end earlier, so the
+  // refetch must report. The report gate judges a page's end by order, not
+  // by how the provider returned it:
+  // - Rows without `rank` sort last, so the first page ends on one. An empty
+  //   page and a page whose last row has no order value stay distinct.
+  // - A provider may return a page's rows in any order. Its last array row
+  //   is then not the page's end.
+  // These drive the sync boundary directly: the generated campaigns give
+  // every row a rank, and their provider returns rows in order.
+  it.each([
+    {
+      name: `from a row without an order value`,
+      initial: [{ id: 0, rank: 3 }, { id: 1 }, { id: 2 }],
+      arrival: { id: 3, rank: 2 },
+      reversed: false,
+    },
+    {
+      name: `when the provider returns the page in reverse order`,
+      initial: [
+        { id: 0, rank: 10 },
+        { id: 1, rank: 4 },
+        { id: 2, rank: 1 },
+      ],
+      arrival: { id: 3, rank: 6 },
+      reversed: true,
+    },
+  ])(
+    `a refetch reports a page whose end moves earlier $name`,
+    async ({ initial, arrival, reversed }) => {
+      type Row = { id: number; rank?: number }
+      const backend: Array<Row> = [...initial]
+      const queryClient = new QueryClient({
+        defaultOptions: { queries: { staleTime: Infinity, retry: false } },
+      })
+      const items = createCollection(
+        queryCollectionOptions<Row>({
+          id: `refetch-ordered-prefix-unranked-${collectionSequence++}`,
+          queryClient,
+          queryKey: [`unranked`],
+          syncMode: `on-demand`,
+          getKey: (row) => row.id,
+          queryFn: (ctx) => {
+            const options = ctx.meta?.loadSubsetOptions as LoadSubsetOptions
+            const offset = options.offset ?? 0
+            const page = [...backend]
+              .sort(
+                (a, b) =>
+                  (b.rank ?? -Infinity) - (a.rank ?? -Infinity) || a.id - b.id,
+              )
+              .slice(offset, offset + options.limit!)
+            return reversed ? page.reverse() : page
+          },
+        }),
+      )
+      let reports = 0
+      items.on(`loadedSubsets:invalidated`, () => {
+        reports++
+      })
+      const orderBy: Array<IR.OrderByClause> = [
+        {
+          expression: new IR.PropRef([`rank`]),
+          compareOptions: {
+            direction: `desc`,
+            nulls: `last`,
+            stringSort: `lexical`,
+          },
+        },
+      ]
+      try {
+        items.startSyncImmediate()
+        await items._sync.loadSubset({ orderBy, limit: 2 })
+        expect(items.toArray.map((row) => row.id).sort()).toEqual([0, 1])
+        backend.push(arrival)
+        await items.utils.refetch()
+        await settle()
+        expect(reports).toBe(1)
+      } finally {
+        await items.cleanup()
+        queryClient.clear()
+      }
+    },
+  )
+})
diff --git a/packages/query-db-collection/tests/ssr-dehydration-oracle.test.ts b/packages/query-db-collection/tests/ssr-dehydration-oracle.test.ts
index 75049315b9..b078d92464 100644
--- a/packages/query-db-collection/tests/ssr-dehydration-oracle.test.ts
+++ b/packages/query-db-collection/tests/ssr-dehydration-oracle.test.ts
@@ -9,6 +9,7 @@ import {
 import { crossSerializeStream, getCrossReferenceHeader } from 'seroval'
 import { describe, expect, it } from 'vitest'
 import { queryCollectionOptions } from '../src/query.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import type { DehydratedState } from '@tanstack/query-core'
 import type { LoadSubsetOptions } from '@tanstack/db'
 
@@ -117,6 +118,8 @@ function expectHydratedRow(
   browserClient.clear()
 }
 
+declareOracle({ check: [expectHydratedRow] })
+
 async function checkWithCleanup(
   check: () => Promise<void>,
   cleanups: ReadonlyArray<() => void | Promise<void>>,
diff --git a/packages/react-db/tests/descriptor-query-binding-oracle.test.tsx b/packages/react-db/tests/descriptor-query-binding-oracle.test.tsx
index 5e7ab0b4e5..ccbe9118e1 100644
--- a/packages/react-db/tests/descriptor-query-binding-oracle.test.tsx
+++ b/packages/react-db/tests/descriptor-query-binding-oracle.test.tsx
@@ -90,22 +90,16 @@
  * not request rows. These histories do not cover arbitrary concurrent render
  * schedules or Electric transaction evidence.
  */
+
 import { Writable } from 'node:stream'
 import { act, render, renderHook, waitFor } from '@testing-library/react'
 import {
   BTreeIndex,
   DbClient,
   Query,
-  UnhashableQueryIRError,
   collectionOptions,
-  createCollection,
-  createLiveQueryCollection,
-  eq,
   getLiveQueryHash,
   getStableQueryBuilderHash,
-  isUndefined,
-  prepareLiveQueryValue,
-  toArray,
 } from '@tanstack/db'
 import { describe, expect, it, vi } from 'vitest'
 import { fc } from '@fast-check/vitest'
@@ -124,7 +118,6 @@ import { createOracleReach } from '../../db/tests/oracle-reach'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
 import { DbProvider } from '../src/DbProvider'
 import { useLiveQuery } from '../src/useLiveQuery'
-import { useLiveQueryEffect } from '../src/useLiveQueryEffect'
 import { useLiveSuspenseQuery } from '../src/useLiveSuspenseQuery'
 import { mockSyncCollectionOptions } from '../../db/tests/utils'
 import { createDeferred } from '../../db/src/deferred'
@@ -133,19 +126,15 @@ import {
   modelSubscriberStartCleanup,
   subscriberStartCleanupHistories,
 } from '../../db/tests/collection-subscription-lifecycle-grammar-oracle'
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import { renderSsr } from './descriptor-query-binding-support'
+import type { Row } from './descriptor-query-binding-support'
 import type { DehydratedRouterDbState } from '../../react-router-with-db/src'
 import type { SsrSnapshotHistory } from '../../db/tests/ssr-snapshot-admission-oracle'
 import type { SsrStreamHistory } from '../../db/tests/ssr-stream-view-oracle'
-import type {
-  Context,
-  DeferredLiveQueryCollections,
-  QueryBuilder,
-} from '@tanstack/db'
 import type { ReactNode } from 'react'
 import type { Root } from 'react-dom/client'
 
-type Row = { id: string; value: string }
-
 const histories = [
   {
     name: `disjoint keys`,
@@ -181,114 +170,17 @@ function expectedRows(rows: ReadonlyMap<string, Row>): Array<Row> {
   )
 }
 
-describe(`standalone descriptor query binding`, () => {
-  it(`binds a continued query for the next committed client-aware hook`, async () => {
-    const client = new DbClient()
-    const baseDescriptor = collectionOptions(`continued-react-base`, () => ({
-      id: `continued-react-base`,
-      getKey: (row: Row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({ type: `insert`, value: { id: `one`, value: `base` } })
-          commit()
-          markReady()
-        },
-      },
-    }))
-    let lateStarts = 0
-    const lateDescriptor = collectionOptions(`continued-react-late`, () => ({
-      id: `continued-react-late`,
-      getKey: (row: Row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          lateStarts++
-          begin()
-          write({ type: `insert`, value: { id: `one`, value: `late` } })
-          commit()
-          markReady()
-        },
-      },
-    }))
-    const original = new Query().from({ base: baseDescriptor })
-    const firstRenderDeferrals: DeferredLiveQueryCollections = new Set()
-    const prepared = prepareLiveQueryValue(
-      original,
-      client,
-      firstRenderDeferrals,
-    ) as typeof original
-    for (const source of firstRenderDeferrals) source._resumeSyncStart()
-    firstRenderDeferrals.clear()
-
-    const continued = prepared
-      .join({ late: lateDescriptor }, ({ base, late }) => eq(base.id, late.id))
-      .select(({ base, late }) => ({ id: base.id, value: late.value }))
-    expect(lateStarts).toBe(0)
-
-    const mounted = renderHook(() => useLiveQuery({ client, query: continued }))
-    await waitFor(() => {
-      expect(
-        mounted.result.current.data.map(({ id, value }) => ({ id, value })),
-      ).toEqual([{ id: `one`, value: `late` }])
-    })
-    expect(lateStarts).toBe(1)
-    mounted.unmount()
-  })
-
-  it(`does not start a continued descriptor in a render that never commits`, async () => {
-    const client = new DbClient()
-    const baseDescriptor = collectionOptions(`abandoned-react-base`, () => ({
-      id: `abandoned-react-base`,
-      getKey: (row: Row) => row.id,
-      startSync: true,
-      sync: { sync: ({ markReady }) => markReady() },
-    }))
-    let lateMaterializations = 0
-    let lateStarts = 0
-    const lateDescriptor = collectionOptions(`abandoned-react-late`, () => {
-      lateMaterializations++
-      return {
-        id: `abandoned-react-late`,
-        getKey: (row: Row) => row.id,
-        startSync: true,
-        sync: {
-          sync: ({ markReady }) => {
-            lateStarts++
-            markReady()
-          },
-        },
-      }
-    })
-    const original = new Query().from({ base: baseDescriptor })
-    const never = new Promise<void>(() => {})
-
-    function Abandoned(): ReactNode {
-      const deferrals: DeferredLiveQueryCollections = new Set()
-      const prepared = prepareLiveQueryValue(
-        original,
-        client,
-        deferrals,
-      ) as typeof original
-      prepared.join({ late: lateDescriptor }, ({ base, late }) =>
-        eq(base.id, late.id),
-      )
-      throw never
-    }
+// The model reducer for one write: the row keyed by `next.id` takes its value.
+function applyModelWrite(model: Map<string, Row>, next: Row): void {
+  model.set(next.id, { ...next })
+}
 
-    const mounted = render(
-      <Suspense fallback={<div>Waiting</div>}>
-        <Abandoned />
-      </Suspense>,
-    )
-    expect(mounted.getByText(`Waiting`)).toBeDefined()
-    await act(async () => {})
-    expect(lateMaterializations).toBe(0)
-    expect(lateStarts).toBe(0)
-    mounted.unmount()
-  })
+declareOracle({
+  check: [checkStreamCut],
+  model: [expectedRows, applyModelWrite],
+})
 
+describe(`standalone descriptor query binding`, () => {
   // A suspended render owns no provider demand. A later independent reader
   // does: ordinary subscriptions and preloads start exactly one sync run,
   // while a deferring subscription preserves the zero-start cut. Ordinary
@@ -457,416 +349,6 @@ describe(`standalone descriptor query binding`, () => {
     },
   )
 
-  it(`rejects an unbound descriptor after a same-hash concrete query`, async () => {
-    const id = `standalone-descriptor-unbound-transition`
-    const concrete = createCollection(
-      mockSyncCollectionOptions<Row>({
-        id,
-        getKey: (row) => row.id,
-        initialData: [{ id: `one`, value: `concrete` }],
-      }),
-    )
-    const descriptor = collectionOptions(id, () =>
-      mockSyncCollectionOptions<Row>({
-        id,
-        getKey: (row) => row.id,
-        initialData: [{ id: `one`, value: `descriptor` }],
-      }),
-    )
-    const concreteQuery = new Query()
-      .from({ item: concrete })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    const unboundQuery = new Query()
-      .from({ item: descriptor })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    expect(getStableQueryBuilderHash(unboundQuery)).toBe(
-      getStableQueryBuilderHash(concreteQuery),
-    )
-
-    let query = concreteQuery
-    const mounted = renderHook(() => useLiveQuery({ query }))
-    await waitFor(() => {
-      expect(mounted.result.current.data[0]?.value).toBe(`concrete`)
-    })
-
-    // The public error is the observation at the attempted consumption cut.
-    // Returning the previous row would conceal the missing DbClient.
-    query = unboundQuery
-    expect(() => mounted.rerender()).toThrow(/requires a DbClient.*DbProvider/)
-    mounted.unmount()
-
-    // An explicit identity changes when preparation runs, not the need for a
-    // client. Both supported identity forms still owe the React-specific fix.
-    expect(() =>
-      renderHook(() =>
-        useLiveQuery({ query: unboundQuery, queryKey: [`unbound`] }),
-      ),
-    ).toThrow(/requires a DbClient.*DbProvider/)
-    expect(() =>
-      renderHook(() => useLiveQuery({ query: unboundQuery }, [])),
-    ).toThrow(/requires a DbClient.*DbProvider/)
-    expect(() =>
-      renderHook(() =>
-        useLiveSuspenseQuery({
-          query: unboundQuery,
-          queryKey: [`unbound-suspense`],
-        }),
-      ),
-    ).toThrow(/requires a DbClient.*DbProvider/)
-    expect(() =>
-      renderHook(() => useLiveSuspenseQuery(() => unboundQuery, [])),
-    ).toThrow(/requires a DbClient.*DbProvider/)
-  })
-
-  it(`rejects a different source after a hook registered the same stream hash`, async () => {
-    const id = `hook-first-preload-source`
-    let finishFirst!: () => void
-    const first = createCollection({
-      id,
-      getKey: (row: Row) => row.id,
-      sync: {
-        sync: ({ markReady }) => {
-          finishFirst = markReady
-        },
-      },
-    })
-    const second = collectionOptions(id, () =>
-      mockSyncCollectionOptions<Row>({
-        id,
-        getKey: (row) => row.id,
-        initialData: [{ id: `one`, value: `second` }],
-      }),
-    )
-    const firstQuery = new Query()
-      .from({ item: first })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    const secondQuery = new Query()
-      .from({ item: second })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    expect(getStableQueryBuilderHash(firstQuery)).toBe(
-      getStableQueryBuilderHash(secondQuery),
-    )
-    const client = new DbClient()
-    client._setSsrStreamingEnabled(true)
-    client._setSsrServerCleanupEnabled(true)
-    const wrapper = ({ children }: { children: ReactNode }) => (
-      <DbProvider client={client}>
-        <Suspense fallback={null}>{children}</Suspense>
-      </DbProvider>
-    )
-    const mounted = renderHook(
-      () => useLiveSuspenseQuery({ query: firstQuery }),
-      { wrapper },
-    )
-
-    try {
-      expect(
-        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toHaveLength(1)
-      expect(() => client.preloadLiveQuery({ query: firstQuery })).not.toThrow()
-      expect(() => client.preloadLiveQuery({ query: secondQuery })).toThrow(
-        /different source Collections/,
-      )
-    } finally {
-      await act(async () => {
-        finishFirst()
-        await Promise.resolve()
-      })
-      mounted.unmount()
-      await client.cleanup()
-      await first.cleanup()
-    }
-  })
-
-  it(`keeps a hydration-first hook's local source claim for later preloads`, async () => {
-    const id = `hydration-first-hook-source`
-    let finishBrowser!: () => void
-    const descriptor = collectionOptions(id, (client) => ({
-      id,
-      getKey: (row: Row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          const publish = () => {
-            begin()
-            for (const row of client.requireDependency<Array<Row>>(`rows`)) {
-              write({ type: `insert`, value: row })
-            }
-            commit()
-            markReady()
-          }
-          if (client.getDependency<boolean>(`deferReady`)) {
-            finishBrowser = publish
-          } else {
-            publish()
-          }
-        },
-      },
-    }))
-    const query = new Query()
-      .from({ item: descriptor })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    const server = new DbClient({
-      rows: [{ id: `one`, value: `server` }],
-    })
-    const browser = new DbClient({
-      rows: [{ id: `one`, value: `browser` }],
-      deferReady: true,
-    })
-    const other = createCollection(
-      mockSyncCollectionOptions<Row>({
-        id,
-        getKey: (row) => row.id,
-        initialData: [{ id: `one`, value: `other` }],
-      }),
-    )
-    const otherQuery = new Query()
-      .from({ item: other })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    let mounted: ReturnType<typeof renderHook> | undefined
-    const browserRows = () =>
-      (mounted!.result.current as { data: Array<Row> }).data.map((row) => ({
-        id: row.id,
-        value: row.value,
-      }))
-
-    try {
-      await server.preloadLiveQuery({ query })
-      browser.hydrate(server.dehydrate())
-      expect(getStableQueryBuilderHash(query)).toBe(
-        getStableQueryBuilderHash(otherQuery),
-      )
-
-      mounted = renderHook(() => useLiveQuery({ query }), {
-        wrapper: ({ children }: { children: ReactNode }) => (
-          <DbProvider client={browser}>{children}</DbProvider>
-        ),
-      })
-      await waitFor(() => {
-        expect(browserRows()).toEqual([{ id: `one`, value: `server` }])
-      })
-      expect(
-        browser.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
-      ).toHaveLength(1)
-      expect(() => browser.preloadLiveQuery({ query: otherQuery })).toThrow(
-        /different source Collections/,
-      )
-      act(() => finishBrowser())
-      await waitFor(() => {
-        expect(browserRows()).toEqual([{ id: `one`, value: `browser` }])
-      })
-    } finally {
-      mounted?.unmount()
-      await browser.cleanup()
-      await server.cleanup()
-      await other.cleanup()
-    }
-  })
-
-  /**
-   * Suspense requests data during render so that React has a promise to retry.
-   * That preload is local demand even if React never commits the render. The
-   * independent ownership rule is first local preload wins: another source
-   * object with the same query hash cannot borrow its hydrated stream. The
-   * fallback, source start, same-source acceptance, and conflicting-preload
-   * error are observed before the held server result settles.
-   */
-  it(`keeps a hydrated stream's source claim from an abandoned Suspense preload`, async () => {
-    const client = new DbClient()
-    client._setSsrServerCleanupEnabled(true)
-    const server = new DbClient()
-    let firstStarts = 0
-    let finishFirst: (() => void) | undefined
-    let finishSecond: (() => void) | undefined
-    const source = (started: (markReady: () => void) => void) =>
-      createCollection({
-        id: `hydrated-suspense-claim`,
-        getKey: (row: Row) => row.id,
-        sync: { sync: ({ markReady }) => started(markReady) },
-      })
-    const first = source((markReady) => {
-      firstStarts++
-      finishFirst = markReady
-    })
-    const second = source((markReady) => {
-      finishSecond = markReady
-    })
-    const serverSource = source((markReady) => markReady())
-    const queryFor = (collection: typeof first) =>
-      new Query()
-        .from({ item: collection })
-        .select(({ item }) => ({ id: item.id, value: item.value }))
-    const firstQuery = queryFor(first)
-    const secondQuery = queryFor(second)
-    let settle!: (value: { rows: Array<{ key: string; value: Row }> }) => void
-    const pending = new Promise<{ rows: Array<{ key: string; value: Row }> }>(
-      (resolve) => {
-        settle = resolve
-      },
-    )
-    let mounted: ReturnType<typeof render> | undefined
-
-    try {
-      expect(getStableQueryBuilderHash(secondQuery)).toBe(
-        getStableQueryBuilderHash(firstQuery),
-      )
-      await server.preloadLiveQuery({ query: queryFor(serverSource) })
-      const queryHash = server.dehydrate().liveQueries![0]!.queryHash
-      client.hydrate({
-        collections: [],
-        liveQueries: [{ queryHash, dehydratedAt: 1, promise: pending }],
-      })
-      const never = new Promise<void>(() => {})
-      function Abandoned(): ReactNode {
-        useLiveSuspenseQuery({ query: firstQuery })
-        throw never
-      }
-
-      mounted = render(
-        <DbProvider client={client}>
-          <Suspense fallback={<div>Waiting</div>}>
-            <Abandoned />
-          </Suspense>
-        </DbProvider>,
-      )
-      expect(mounted.getByText(`Waiting`)).toBeDefined()
-      expect(firstStarts, `Suspense preload begins before commit`).toBe(1)
-      expect(() => client.preloadLiveQuery({ query: secondQuery })).toThrow(
-        /different source Collections/,
-      )
-      expect(() => client.preloadLiveQuery({ query: firstQuery })).not.toThrow()
-    } finally {
-      mounted?.unmount()
-      settle({ rows: [] })
-      finishFirst?.()
-      finishSecond?.()
-      await act(async () => {
-        await pending
-      })
-      await client.cleanup()
-      await server.cleanup()
-      await first.cleanup()
-      await second.cleanup()
-      await serverSource.cleanup()
-    }
-  })
-
-  it(`dehydrates a descriptor source first consumed by a committed Effect`, async () => {
-    const id = `standalone-descriptor-effect-dehydration`
-    const expected = { id: `one`, value: `first` }
-    const descriptor = collectionOptions(id, (client) =>
-      mockSyncCollectionOptions<Row>({
-        id,
-        getKey: (row) => row.id,
-        initialData: client.requireDependency<Array<Row>>(`rows`),
-      }),
-    )
-    const query = new Query()
-      .from({ item: descriptor })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    const client = new DbClient({ rows: [{ ...expected }] })
-    const observed: Array<Row> = []
-
-    const mounted = renderHook(
-      () =>
-        useLiveQueryEffect<Row, string>({
-          query,
-          onEnter: ({ value }) => {
-            observed.push({ id: value.id, value: value.value })
-          },
-        }),
-      {
-        wrapper: ({ children }: { children: ReactNode }) => (
-          <DbProvider client={client}>{children}</DbProvider>
-        ),
-      },
-    )
-
-    // The plain expected row is independent of the Effect and dehydration code.
-    // Compare at the settled enter cut, then at the public dehydrate() call.
-    await waitFor(() => expect(observed).toEqual([expected]))
-    const chunk = client
-      .dehydrate()
-      .collections.find((collection) => collection.collectionId === id)
-    expect(chunk?.rows.map(({ key, value }) => ({ key, value }))).toEqual([
-      { key: expected.id, value: expected },
-    ])
-    mounted.unmount()
-  })
-
-  it(`binds an Effect's prebuilt query to its receiving provider`, async () => {
-    const descriptor = collectionOptions(
-      `standalone-descriptor-effect-rows`,
-      (client) =>
-        mockSyncCollectionOptions<Row>({
-          id: `standalone-descriptor-effect-rows`,
-          getKey: (row) => row.id,
-          initialData: client.requireDependency<Array<Row>>(`rows`),
-        }),
-    )
-    const query = new Query()
-      .from({ item: descriptor })
-      .select(({ item }) => ({ id: item.id, value: item.value }))
-    const expected = [
-      { id: `shared`, value: `first` },
-      { id: `shared`, value: `second` },
-    ]
-    const observed: Array<Array<Row>> = [[], []]
-    const updates: Array<Array<Row>> = [[], []]
-    const clients = expected.map((row) => new DbClient({ rows: [{ ...row }] }))
-    const oldClient = clients[0]!
-    const mounted = expected.map((_, index) => {
-      return renderHook(
-        () =>
-          useLiveQueryEffect<Row, string>({
-            query,
-            onEnter: ({ value }) => {
-              observed[index]!.push({ id: value.id, value: value.value })
-            },
-            onUpdate: ({ value }) => {
-              updates[index]!.push({ id: value.id, value: value.value })
-            },
-          }),
-        {
-          wrapper: ({ children }: { children: ReactNode }) => (
-            <DbProvider client={clients[index]!}>{children}</DbProvider>
-          ),
-        },
-      )
-    })
-
-    // At initial publication, each Effect must report its own client's row.
-    await waitFor(() => {
-      expect(observed).toEqual(expected.map((row) => [row]))
-    })
-
-    clients[0] = clients[1]!
-    mounted[0]!.rerender()
-    await waitFor(() => {
-      expect(observed[0]).toEqual([expected[0], expected[1]])
-    })
-
-    act(() => {
-      oldClient.collection(descriptor).update(`shared`, (draft) => {
-        draft.value = `old write`
-      })
-    })
-    await act(async () => {})
-    expect(observed[0]).toEqual([expected[0], expected[1]])
-    expect(updates[0]).toEqual([])
-
-    act(() => {
-      clients[1]!.collection(descriptor).update(`shared`, (draft) => {
-        draft.value = `new write`
-      })
-    })
-    await waitFor(() => {
-      expect(updates[0]).toEqual([{ id: `shared`, value: `new write` }])
-    })
-
-    mounted.forEach((hook) => hook.unmount())
-  })
-
   it.each(histories)(
     `binds one prebuilt Query to each receiving DbClient with $name`,
     async ({ name, initial, writes }) => {
@@ -964,7 +446,7 @@ describe(`standalone descriptor query binding`, () => {
             collection.insert({ ...next })
           }
         })
-        model.set(next.id, { ...next })
+        applyModelWrite(model, next)
       }
 
       write(firstClient, firstModel, writes.first)
@@ -984,719 +466,6 @@ describe(`standalone descriptor query binding`, () => {
       second.unmount()
     },
   )
-
-  it.each([`join`, `nestedFrom`, `union`, `include`] as const)(
-    `keeps two descriptor sources local to each provider in a %s query`,
-    async (form) => {
-      type Parent = { id: string; value: string }
-      type Child = { id: string; parentId: string; value: string }
-      const parentDescriptor = collectionOptions(
-        `two-source-parent-${form}`,
-        (client) =>
-          mockSyncCollectionOptions<Parent>({
-            id: `two-source-parent-${form}`,
-            getKey: (row) => row.id,
-            initialData: client.requireDependency<Array<Parent>>(`parents`),
-          }),
-      )
-      const childDescriptor = collectionOptions(
-        `two-source-child-${form}`,
-        (client) =>
-          mockSyncCollectionOptions<Child>({
-            id: `two-source-child-${form}`,
-            getKey: (row) => row.id,
-            initialData: client.requireDependency<Array<Child>>(`children`),
-          }),
-      )
-
-      // One plan is built before either client. Each client supplies two
-      // distinct source rows; aliases and query identity are shared.
-      const joined = () =>
-        new Query()
-          .from({ parent: parentDescriptor })
-          .innerJoin({ child: childDescriptor }, ({ parent, child }) =>
-            eq(parent.id, child.parentId),
-          )
-          .select(({ parent, child }) => ({
-            id: parent.id,
-            value: parent.value,
-            childValue: child.value,
-          }))
-      const query =
-        form === `join`
-          ? joined()
-          : form === `nestedFrom`
-            ? new Query().from({ wrapper: joined() }).select(({ wrapper }) => ({
-                id: wrapper.id,
-                value: wrapper.value,
-                childValue: wrapper.childValue,
-              }))
-            : form === `union`
-              ? new Query().unionAll(
-                  new Query()
-                    .from({ parent: parentDescriptor })
-                    .select(({ parent }) => ({
-                      id: parent.id,
-                      value: parent.value,
-                    })),
-                  new Query()
-                    .from({ child: childDescriptor })
-                    .select(({ child }) => ({
-                      id: child.id,
-                      value: child.value,
-                    })),
-                )
-              : new Query()
-                  .from({ parent: parentDescriptor })
-                  .select(({ parent }) => ({
-                    id: parent.id,
-                    value: parent.value,
-                    children: toArray(
-                      new Query()
-                        .from({ child: childDescriptor })
-                        .where(({ child }) => eq(child.parentId, parent.id))
-                        .select(({ child }) => ({
-                          id: child.id,
-                          value: child.value,
-                        })),
-                    ),
-                  }))
-      const hookQuery = query as QueryBuilder<Context>
-      const first = new DbClient({
-        parents: [{ id: `parent`, value: `FIRST PARENT` }],
-        children: [{ id: `child`, parentId: `parent`, value: `FIRST CHILD` }],
-      })
-      const second = new DbClient({
-        parents: [{ id: `parent`, value: `SECOND PARENT` }],
-        children: [{ id: `child`, parentId: `parent`, value: `SECOND CHILD` }],
-      })
-      const models = new Map([
-        [first, { parent: `FIRST PARENT`, child: `FIRST CHILD` }],
-        [second, { parent: `SECOND PARENT`, child: `SECOND CHILD` }],
-      ])
-      const mounted = [first, second].map((client) => ({
-        client,
-        hook: renderHook(() => useLiveQuery({ query: hookQuery }), {
-          wrapper: ({ children }: { children: ReactNode }) => (
-            <DbProvider client={client}>{children}</DbProvider>
-          ),
-        }),
-      }))
-
-      /** The model recomputes rows from each client's two plain values. */
-      const expected = (client: DbClient) => {
-        const values = models.get(client)!
-        return form === `union`
-          ? [
-              { id: `child`, value: values.child },
-              { id: `parent`, value: values.parent },
-            ]
-          : form === `join` || form === `nestedFrom`
-            ? [
-                {
-                  id: `parent`,
-                  value: values.parent,
-                  childValue: values.child,
-                },
-              ]
-            : [
-                {
-                  id: `parent`,
-                  value: values.parent,
-                  children: [{ id: `child`, value: values.child }],
-                },
-              ]
-      }
-      const check = async (cut: string) => {
-        await waitFor(() => {
-          for (const { client, hook } of mounted) {
-            const rows = (
-              hook.result.current.data as Array<{
-                id: string
-                value: string
-                childValue?: string
-                children?: Array<{ id: string; value: string }>
-              }>
-            )
-              .map((row) => ({
-                id: row.id,
-                value: row.value,
-                ...(form === `join` || form === `nestedFrom`
-                  ? { childValue: row.childValue }
-                  : {}),
-                ...(form === `include`
-                  ? {
-                      children: (row.children ?? []).map((child) => ({
-                        id: child.id,
-                        value: child.value,
-                      })),
-                    }
-                  : {}),
-              }))
-              .sort((a, b) => a.id.localeCompare(b.id))
-            expect(
-              rows,
-              `${cut}: ${client === first ? `first` : `second`}`,
-            ).toEqual(expected(client))
-          }
-        })
-      }
-
-      try {
-        await check(`initial publication`)
-        act(() => {
-          first.collection(childDescriptor).update(`child`, (draft) => {
-            draft.value = `FIRST CHILD 2`
-          })
-        })
-        models.get(first)!.child = `FIRST CHILD 2`
-        await check(`first child write`)
-
-        act(() => {
-          second.collection(parentDescriptor).update(`parent`, (draft) => {
-            draft.value = `SECOND PARENT 2`
-          })
-        })
-        models.get(second)!.parent = `SECOND PARENT 2`
-        await check(`second parent write`)
-      } finally {
-        for (const { hook } of mounted) {
-          hook.unmount()
-          await hook.result.current.collection.cleanup()
-        }
-        await first.cleanup()
-        await second.cleanup()
-      }
-    },
-  )
-
-  it.each([`shadowed`, `renamed`] as const)(
-    `keeps client and lexical source identity in a %s descriptor include`,
-    async (aliasForm) => {
-      type Parent = { id: string; value: string }
-      type Child = { id: string; parentId: string; value: string }
-      const parentDescriptor = collectionOptions(
-        `combined-parent-${aliasForm}`,
-        (client) =>
-          mockSyncCollectionOptions<Parent>({
-            id: `combined-parent-${aliasForm}`,
-            getKey: (row) => row.id,
-            initialData: client.requireDependency<Array<Parent>>(`parents`),
-          }),
-      )
-      const childDescriptor = collectionOptions(
-        `combined-child-${aliasForm}`,
-        (client) =>
-          mockSyncCollectionOptions<Child>({
-            id: `combined-child-${aliasForm}`,
-            getKey: (row) => row.id,
-            initialData: client.requireDependency<Array<Child>>(`children`),
-          }),
-      )
-
-      // Both branches promise the same rows. Renaming only the child alias
-      // must not change which client or lexical source supplies either value.
-      const query =
-        aliasForm === `shadowed`
-          ? new Query()
-              .from({ issue: parentDescriptor })
-              .select(({ issue }) => ({
-                id: issue.id,
-                value: issue.value,
-                children: toArray(
-                  new Query()
-                    .from({ issue: childDescriptor })
-                    .where(({ issue: child }) => eq(child.parentId, issue.id))
-                    .select(({ issue: child }) => ({
-                      id: child.id,
-                      value: child.value,
-                      parentValue: issue.value,
-                    })),
-                ),
-              }))
-          : new Query()
-              .from({ issue: parentDescriptor })
-              .select(({ issue }) => ({
-                id: issue.id,
-                value: issue.value,
-                children: toArray(
-                  new Query()
-                    .from({ child: childDescriptor })
-                    .where(({ child }) => eq(child.parentId, issue.id))
-                    .select(({ child }) => ({
-                      id: child.id,
-                      value: child.value,
-                      parentValue: issue.value,
-                    })),
-                ),
-              }))
-      const first = new DbClient({
-        parents: [{ id: `p`, value: `FIRST PARENT` }],
-        children: [{ id: `c`, parentId: `p`, value: `FIRST CHILD` }],
-      })
-      const second = new DbClient({
-        parents: [{ id: `p`, value: `SECOND PARENT` }],
-        children: [{ id: `c`, parentId: `p`, value: `SECOND CHILD` }],
-      })
-      const model = new Map([
-        [first, { parent: `FIRST PARENT`, child: `FIRST CHILD` }],
-        [second, { parent: `SECOND PARENT`, child: `SECOND CHILD` }],
-      ])
-      const mounted = [first, second].map((client) => ({
-        client,
-        hook: renderHook(
-          () => useLiveQuery({ query: query as QueryBuilder<Context> }),
-          {
-            wrapper: ({ children }: { children: ReactNode }) => (
-              <DbProvider client={client}>{children}</DbProvider>
-            ),
-          },
-        ),
-      }))
-      const check = async (cut: string) => {
-        await waitFor(() => {
-          for (const { client, hook } of mounted) {
-            const values = model.get(client)!
-            const rows = (
-              hook.result.current.data as Array<{
-                id: string
-                value: string
-                children: Array<{
-                  id: string
-                  value: string
-                  parentValue: string
-                }>
-              }>
-            ).map((row) => ({
-              id: row.id,
-              value: row.value,
-              children: row.children.map((child) => ({
-                id: child.id,
-                value: child.value,
-                parentValue: child.parentValue,
-              })),
-            }))
-            expect(rows, `${cut}: public rows`).toEqual([
-              {
-                id: `p`,
-                value: values.parent,
-                children: [
-                  {
-                    id: `c`,
-                    value: values.child,
-                    parentValue: values.parent,
-                  },
-                ],
-              },
-            ])
-          }
-        })
-      }
-
-      try {
-        await check(`initial publication`)
-        const bound = prepareLiveQueryValue(
-          query,
-          first,
-        ) as QueryBuilder<Context>
-        expect(getStableQueryBuilderHash(bound)).toBe(
-          getStableQueryBuilderHash(query),
-        )
-        act(() => {
-          first.collection(childDescriptor).update(`c`, (draft) => {
-            draft.value = `FIRST CHILD 2`
-          })
-        })
-        model.get(first)!.child = `FIRST CHILD 2`
-        await check(`first child write`)
-        act(() => {
-          second.collection(parentDescriptor).update(`p`, (draft) => {
-            draft.value = `SECOND PARENT 2`
-          })
-        })
-        model.get(second)!.parent = `SECOND PARENT 2`
-        await check(`second parent write`)
-      } finally {
-        for (const { hook } of mounted) {
-          hook.unmount()
-          await hook.result.current.collection.cleanup()
-        }
-        await first.cleanup()
-        await second.cleanup()
-      }
-    },
-  )
-
-  /**
-   * A descriptor plan keeps both its receiving client and each source's
-   * lexical binding. The plain model pairs main and joined rows by ID, then
-   * restricts the pair to its parent. A missing join side stays undefined even
-   * when the parent and local main sources both spell their alias `issue`.
-   * RIGHT/FULL, correlation side, alias spelling, and source mode are legal
-   * dimensions. Two clients have the same row IDs but distinct values. The
-   * public comparison runs after initial acquisition and every authored write;
-   * on-demand cells also observe each client's provider requests.
-   */
-  const outerJoinHistories = [
-    { kind: `right`, correlation: `joined` },
-    { kind: `right`, correlation: `main` },
-    { kind: `full`, correlation: `joined` },
-    { kind: `full`, correlation: `main` },
-  ] as const
-  for (const { kind, correlation } of outerJoinHistories) {
-    for (const mode of [`eager`, `onDemand`] as const) {
-      it(`${kind} join with ${correlation} correlation binds shadowed and renamed descriptors per client in ${mode} mode`, async () => {
-        type Parent = { id: number; marker: string }
-        type Main = {
-          id: number
-          parentId: number
-          anchorId: number
-          label: string
-        }
-        type Anchor = { id: number; parentId: number }
-        type Sources = {
-          parents: Map<number, Parent>
-          mains: Map<number, Main>
-          anchors: Map<number, Anchor>
-        }
-        type Role = keyof Sources
-        type Expected = {
-          parentId: number
-          mainId: number | undefined
-          anchorId: number | undefined
-          label: string | undefined
-          marker: string
-          missingMain: boolean
-          missingAnchor: boolean
-        }
-
-        const initial = (marker: string): Sources => ({
-          parents: new Map([[1, { id: 1, marker }]]),
-          mains: new Map([
-            [
-              10,
-              { id: 10, parentId: 1, anchorId: 7, label: `${marker} MATCH` },
-            ],
-            [
-              11,
-              {
-                id: 11,
-                parentId: 1,
-                anchorId: 9,
-                label: `${marker} MAIN ONLY`,
-              },
-            ],
-          ]),
-          anchors: new Map([
-            [7, { id: 7, parentId: 1 }],
-            [8, { id: 8, parentId: 1 }],
-          ]),
-        })
-        const first = new DbClient({ marker: `FIRST` })
-        const second = new DbClient({ marker: `SECOND` })
-        const models = new Map<DbClient, Sources>([
-          [first, initial(`FIRST`)],
-          [second, initial(`SECOND`)],
-        ])
-        const counters = new Map<
-          DbClient,
-          Map<Role, { starts: number; requests: number }>
-        >()
-        const writers = new Map<
-          DbClient,
-          Map<
-            Role,
-            (type: `insert` | `update` | `delete`, row: unknown) => void
-          >
-        >()
-
-        /** The adapter reads authored source rows; expected rows use only maps. */
-        const descriptor = <T extends { id: number }>(
-          role: Role,
-          suffix: string,
-        ) =>
-          collectionOptions(
-            `combined-outer-${kind}-${correlation}-${mode}-${suffix}`,
-            (client) => ({
-              id: `combined-outer-${kind}-${correlation}-${mode}-${suffix}`,
-              getKey: (row: T) => row.id,
-              startSync: true,
-              ...(role !== `parents` && mode === `onDemand`
-                ? { syncMode: `on-demand` as const }
-                : {}),
-              sync: {
-                sync: ({ begin, write, commit, markReady }) => {
-                  const clientCounters = counters.get(client) ?? new Map()
-                  counters.set(client, clientCounters)
-                  const count = clientCounters.get(role) ?? {
-                    starts: 0,
-                    requests: 0,
-                  }
-                  clientCounters.set(role, count)
-                  count.starts++
-                  const installed = new Set<number>()
-                  const send = (
-                    type: `insert` | `update` | `delete`,
-                    row: T,
-                  ) => {
-                    begin()
-                    write({ type, value: { ...row } })
-                    commit()
-                    if (type === `delete`) installed.delete(row.id)
-                    else installed.add(row.id)
-                  }
-                  const clientWriters =
-                    writers.get(client) ??
-                    new Map<
-                      Role,
-                      (
-                        type: `insert` | `update` | `delete`,
-                        row: unknown,
-                      ) => void
-                    >()
-                  writers.set(client, clientWriters)
-                  clientWriters.set(role, (type, row) => send(type, row as T))
-                  const rows = () =>
-                    [
-                      ...models.get(client)![role].values(),
-                    ] as unknown as Array<T>
-                  if (role === `parents` || mode === `eager`) {
-                    for (const row of rows()) send(`insert`, row)
-                  }
-                  markReady()
-                  if (role !== `parents` && mode === `onDemand`) {
-                    return {
-                      loadSubset: () => {
-                        count.requests++
-                        for (const row of rows()) {
-                          if (!installed.has(row.id)) send(`insert`, row)
-                        }
-                        return Promise.resolve()
-                      },
-                    }
-                  }
-                  return undefined
-                },
-              },
-            }),
-          )
-
-        const parents = descriptor<Parent>(`parents`, `parent`)
-        const mains = descriptor<Main>(`mains`, `main`)
-        const anchors = descriptor<Anchor>(`anchors`, `anchor`)
-        const cases = ([`issue`, `child`] as const).map((alias) => {
-          const query = new Query()
-            .from({ issue: parents })
-            .select(({ issue: parent }) => {
-              const joinedSource =
-                correlation === `joined`
-                  ? new Query()
-                      .from({ source: anchors })
-                      .where(({ source }) => eq(source.parentId, parent.id))
-                      .select(({ source }) => ({
-                        id: source.id,
-                        parentId: source.parentId,
-                      }))
-                  : anchors
-              const child = new Query()
-                .from({ [alias]: mains })
-                .join(
-                  { anchor: joinedSource },
-                  (context: Record<string, unknown>) =>
-                    eq(
-                      (context[alias] as Main).anchorId,
-                      (context.anchor as Anchor).id,
-                    ),
-                  kind,
-                )
-                .where((context: Record<string, unknown>) =>
-                  correlation === `joined`
-                    ? eq((context.anchor as Anchor).parentId, parent.id)
-                    : eq((context[alias] as Main).parentId, parent.id),
-                )
-                .select((context: Record<string, unknown>) => ({
-                  mainId: (context[alias] as Main).id,
-                  anchorId: (context.anchor as Anchor).id,
-                  label: (context[alias] as Main).label,
-                  marker: parent.marker,
-                  missingMain: isUndefined((context[alias] as Main).id),
-                  missingAnchor: isUndefined((context.anchor as Anchor).id),
-                }))
-              return { id: parent.id, rows: toArray(child) }
-            })
-          return {
-            alias,
-            query,
-            mounted: [first, second].map((client) => ({
-              client,
-              hook: renderHook(
-                () => useLiveQuery({ query: query as QueryBuilder<Context> }),
-                {
-                  wrapper: ({ children }: { children: ReactNode }) => (
-                    <DbProvider client={client}>{children}</DbProvider>
-                  ),
-                },
-              ),
-            })),
-          }
-        })
-
-        /** The model uses source roles and values, never lexical alias text. */
-        const expected = (sources: Sources): Array<Expected> => {
-          const mainsNow = [...sources.mains.values()]
-          const anchorsNow = [...sources.anchors.values()]
-          const pairs: Array<[Main | undefined, Anchor | undefined]> = []
-          for (const anchor of anchorsNow) {
-            const matches = mainsNow.filter(
-              (main) => main.anchorId === anchor.id,
-            )
-            if (matches.length === 0) pairs.push([undefined, anchor])
-            else for (const main of matches) pairs.push([main, anchor])
-          }
-          if (kind === `full`) {
-            for (const main of mainsNow) {
-              if (!anchorsNow.some((anchor) => anchor.id === main.anchorId)) {
-                pairs.push([main, undefined])
-              }
-            }
-          }
-          return [...sources.parents.values()]
-            .flatMap((parent) =>
-              pairs
-                .filter(([main, anchor]) =>
-                  correlation === `joined`
-                    ? anchor?.parentId === parent.id
-                    : main?.parentId === parent.id,
-                )
-                .map(([main, anchor]) => ({
-                  parentId: parent.id,
-                  mainId: main?.id,
-                  anchorId: anchor?.id,
-                  label: main?.label,
-                  marker: parent.marker,
-                  missingMain: main === undefined,
-                  missingAnchor: anchor === undefined,
-                })),
-            )
-            .sort(
-              (a, b) =>
-                a.parentId - b.parentId ||
-                (a.anchorId ?? Infinity) - (b.anchorId ?? Infinity) ||
-                (a.mainId ?? Infinity) - (b.mainId ?? Infinity),
-            )
-        }
-        const observe = (
-          data: ReadonlyArray<{
-            id: number
-            rows: Array<Omit<Expected, `parentId`>>
-          }>,
-        ): Array<Expected> =>
-          data
-            .flatMap((parent) =>
-              parent.rows.map((row) => ({ parentId: parent.id, ...row })),
-            )
-            .sort(
-              (a, b) =>
-                a.parentId - b.parentId ||
-                (a.anchorId ?? Infinity) - (b.anchorId ?? Infinity) ||
-                (a.mainId ?? Infinity) - (b.mainId ?? Infinity),
-            )
-        const check = async (cut: string) => {
-          await waitFor(() => {
-            for (const entry of cases) {
-              for (const { client, hook } of entry.mounted) {
-                const rows = hook.result.current.data as unknown as Array<{
-                  id: number
-                  rows: Array<Omit<Expected, `parentId`>>
-                }>
-                expect(observe(rows), `${entry.alias}, ${cut}`).toEqual(
-                  expected(models.get(client)!),
-                )
-              }
-            }
-          })
-        }
-        const change = <T extends { id: number }>(
-          client: DbClient,
-          role: Role,
-          type: `insert` | `update` | `delete`,
-          row: T,
-        ) => {
-          const source = models.get(client)![role] as unknown as Map<number, T>
-          if (type === `delete`) source.delete(row.id)
-          else source.set(row.id, row)
-          act(() => {
-            writers.get(client)!.get(role)!(type, row)
-          })
-        }
-
-        try {
-          await check(`initial acquisition`)
-          for (const client of [first, second]) {
-            for (const role of [`parents`, `mains`, `anchors`] as const) {
-              expect(counters.get(client)?.get(role)?.starts).toBe(1)
-              if (role !== `parents` && mode === `onDemand`) {
-                expect(
-                  counters.get(client)?.get(role)?.requests,
-                ).toBeGreaterThan(0)
-              }
-            }
-          }
-          for (const entry of cases) {
-            expect(
-              getStableQueryBuilderHash(
-                prepareLiveQueryValue(
-                  entry.query,
-                  first,
-                ) as QueryBuilder<Context>,
-              ),
-            ).toBe(getStableQueryBuilderHash(entry.query))
-            expect(
-              getStableQueryBuilderHash(
-                prepareLiveQueryValue(
-                  entry.query,
-                  second,
-                ) as QueryBuilder<Context>,
-              ),
-            ).toBe(getStableQueryBuilderHash(entry.query))
-          }
-
-          change(first, `mains`, `update`, {
-            id: 10,
-            parentId: 1,
-            anchorId: 7,
-            label: `FIRST UPDATED`,
-          })
-          await check(`first client main update`)
-          change(second, `mains`, `delete`, models.get(second)!.mains.get(10)!)
-          await check(`second client main becomes absent`)
-          change(second, `mains`, `insert`, {
-            id: 10,
-            parentId: 1,
-            anchorId: 7,
-            label: `SECOND RETURNED`,
-          })
-          await check(`second client main returns`)
-          change(first, `anchors`, `delete`, models.get(first)!.anchors.get(7)!)
-          await check(`first client joined side becomes absent`)
-          change(second, `parents`, `update`, {
-            id: 1,
-            marker: `SECOND UPDATED`,
-          })
-          await check(`second client parent update`)
-        } finally {
-          for (const entry of cases) {
-            for (const { hook } of entry.mounted) {
-              hook.unmount()
-              await hook.result.current.collection.cleanup()
-            }
-          }
-          await first.cleanup()
-          await second.cleanup()
-        }
-      })
-    }
-  }
 })
 
 /**
@@ -1897,18 +666,6 @@ describe(`descriptor error handoff at React commit`, () => {
  * Query-only infinite preparation includes its first-page peek-ahead window.
  * This driver supplies host scheduling, not another expected-result model.
  */
-// React's server renderer runs in this jsdom test process. Remove the browser
-// global only for that host call; hydrateRoot retains the real browser globals.
-function renderSsr(node: ReactNode): string {
-  const browserWindow = globalThis.window
-  vi.stubGlobal(`window`, undefined)
-  try {
-    return renderToString(node)
-  } finally {
-    vi.stubGlobal(`window`, browserWindow)
-  }
-}
-
 describe(`SSR snapshot admission`, () => {
   const properties = {
     ordinary: `react.ssr-ordinary`,
@@ -2202,412 +959,6 @@ describe(`SSR snapshot admission`, () => {
   }
 })
 
-// Suspense discovery is explicit data demand in streaming mode. A warm source
-// must still register this query, rather than bypassing transport because its
-// live-query Collection happens to be ready before the wrapper reads it.
-describe(`SSR Suspense discovery`, () => {
-  for (const warm of [false, true]) {
-    it(`streams a render-discovered result with warm=${warm}`, async () => {
-      const descriptor = collectionOptions(`ssr-suspense-discovery`, () => ({
-        id: `ssr-suspense-discovery`,
-        getKey: (row: { id: string; name: string }) => row.id,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            begin()
-            write({ type: `insert`, value: { id: `1`, name: `server 1` } })
-            commit()
-            markReady()
-          },
-        },
-      }))
-      const client = new DbClient()
-      client._setSsrStreamingEnabled(true)
-      const query = new Query()
-        .from({ person: descriptor })
-        .select(({ person }) => ({ name: person.name }))
-      function Consumer() {
-        const result = useLiveSuspenseQuery({ query })
-        return <span>{result.data.map((row) => row.name).join(`,`)}</span>
-      }
-      // This driver invokes React's Node server host inside jsdom. Match the
-      // actual host's globals so the hydration getter cannot mistake it for a
-      // browser receiver waiting for a record the server has not produced yet.
-      const originalWindow = globalThis.window
-      vi.stubGlobal(`window`, undefined)
-      try {
-        if (warm)
-          await client.preloadLiveQuery({
-            query: new Query()
-              .from({ person: descriptor })
-              .select(({ person }) => ({ id: person.id })),
-          })
-        const errors: Array<unknown> = []
-        const html = await new Promise<string>((resolve, reject) => {
-          let text = ``
-          const sink = new Writable({
-            write(chunk, _encoding, done) {
-              text += chunk.toString()
-              done()
-            },
-          })
-          sink.on(`finish`, () => resolve(text))
-          sink.on(`error`, reject)
-          const stream = renderToPipeableStream(
-            <DbProvider client={client}>
-              <Suspense fallback={<span>loading</span>}>
-                <Consumer />
-              </Suspense>
-            </DbProvider>,
-            {
-              onAllReady() {
-                stream.pipe(sink)
-              },
-              onError(error) {
-                errors.push(error)
-              },
-            },
-          )
-        })
-        expect(errors).toEqual([])
-        expect(html).toContain(`<span>server 1</span>`)
-        const hash = getLiveQueryHash({ query })
-        const result = client
-          .dehydrate({ shouldDehydrateLiveQuery: () => true })
-          .liveQueries?.find((entry) => entry.queryHash === hash)
-        expect(
-          result,
-          `render-discovered warm and cold results enter transport`,
-        ).toBeDefined()
-        const snapshot = result?.snapshot ?? (await result?.promise)
-        expect(snapshot?.rows.map((row) => row.value)).toEqual([
-          expect.objectContaining({ name: `server 1` }),
-        ])
-      } finally {
-        vi.stubGlobal(`window`, originalWindow)
-        await client.cleanup()
-      }
-    })
-  }
-})
-
-/** Prepared Suspense results must render on either React server host. Streaming
- * is explicit demand; opaque logic still requires a portable identity even
- * when warm. This bounded grammar crosses source/query preparation, empty/nonempty
- * results, streaming on/off, and keyed/unkeyed opaque discovery. The observation
- * is final server markup and server errors, before any browser can repair it.
- */
-describe(`SSR Suspense receiving matrix`, () => {
-  for (const streaming of [false, true]) {
-    for (const preparation of [`source`, `query`] as const) {
-      for (const count of [0, 2]) {
-        it(`renders prepared ${preparation} count=${count} streaming=${streaming}`, async () => {
-          const descriptor = collectionOptions(`suspense-prepared`, () => ({
-            id: `suspense-prepared`,
-            getKey: (row: { id: string; name: string }) => row.id,
-            sync: {
-              sync: ({ begin, write, commit, markReady }) => {
-                begin()
-                for (let i = 0; i < count; i++)
-                  write({
-                    type: `insert`,
-                    value: { id: String(i), name: `server ${i}` },
-                  })
-                commit()
-                markReady()
-              },
-            },
-          }))
-          const client = new DbClient()
-          client._setSsrStreamingEnabled(streaming)
-          const query = new Query()
-            .from({ person: descriptor })
-            .select(({ person }) => ({ name: person.name }))
-          function Consumer() {
-            const { data } = useLiveSuspenseQuery({ query })
-            return (
-              <output>
-                {data.map((row) => row.name).join(`,`) || `empty ready`}
-              </output>
-            )
-          }
-          const app = (
-            <DbProvider client={client}>
-              <Suspense fallback={<span>loading</span>}>
-                <Consumer />
-              </Suspense>
-            </DbProvider>
-          )
-          const browserWindow = globalThis.window
-          try {
-            if (preparation === `source`)
-              await client.collection(descriptor).preload()
-            else await client.preloadLiveQuery({ query })
-            vi.stubGlobal(`window`, undefined)
-            let html: string
-            const errors: Array<unknown> = []
-            if (!streaming) html = renderToString(app)
-            else
-              html = await new Promise<string>((resolve, reject) => {
-                let result = ``
-                const sink = new Writable({
-                  write(chunk, _encoding, done) {
-                    result += chunk.toString()
-                    done()
-                  },
-                })
-                sink.on(`finish`, () => resolve(result))
-                sink.on(`error`, reject)
-                const stream = renderToPipeableStream(app, {
-                  onAllReady() {
-                    stream.pipe(sink)
-                  },
-                  onError(error) {
-                    errors.push(error)
-                  },
-                })
-              })
-            expect(errors).toEqual([])
-            expect(
-              html,
-              `prepared results finish rather than suspend forever`,
-            ).toContain(
-              `<output>${count ? `server 0,server 1` : `empty ready`}</output>`,
-            )
-          } finally {
-            vi.stubGlobal(`window`, browserWindow)
-            await client.cleanup()
-          }
-        })
-      }
-    }
-  }
-  for (const warm of [false, true])
-    for (const keyed of [false, true]) {
-      it(`checks opaque streaming identity warm=${warm} keyed=${keyed}`, async () => {
-        const descriptor = collectionOptions(`opaque-ssr`, () => ({
-          id: `opaque-ssr`,
-          getKey: (row: { id: string }) => row.id,
-          sync: {
-            sync: ({ begin, write, commit, markReady }) => {
-              begin()
-              write({ type: `insert`, value: { id: `server` } })
-              commit()
-              markReady()
-            },
-          },
-        }))
-        const client = new DbClient()
-        client._setSsrStreamingEnabled(true)
-        const query = new Query()
-          .from({ row: descriptor })
-          .fn.where(({ row }) => row.id.length > 0)
-        function Consumer() {
-          const { data } = useLiveSuspenseQuery({
-            query,
-            ...(keyed ? { queryKey: [`opaque`] } : {}),
-          })
-          return <output>{data.map((row) => row.id).join(`,`)}</output>
-        }
-        const browserWindow = globalThis.window
-        try {
-          if (warm)
-            await client.preloadLiveQuery({
-              query: new Query()
-                .from({ row: descriptor })
-                .select(({ row }) => ({ id: row.id })),
-            })
-          vi.stubGlobal(`window`, undefined)
-          const errors: Array<unknown> = []
-          const html = await new Promise<string>((resolve, reject) => {
-            let result = ``
-            const sink = new Writable({
-              write(chunk, _encoding, done) {
-                result += chunk.toString()
-                done()
-              },
-            })
-            sink.on(`finish`, () => resolve(result))
-            sink.on(`error`, reject)
-            const stream = renderToPipeableStream(
-              <DbProvider client={client}>
-                <Suspense fallback={<span>loading</span>}>
-                  <Consumer />
-                </Suspense>
-              </DbProvider>,
-              {
-                onAllReady() {
-                  stream.pipe(sink)
-                },
-                onError(error) {
-                  errors.push(error)
-                },
-              },
-            )
-          })
-          if (keyed) {
-            expect(errors).toEqual([])
-            expect(html).toContain(`<output>server</output>`)
-            expect(
-              client
-                .dehydrate()
-                .liveQueries?.some(
-                  (q) =>
-                    q.queryHash === getLiveQueryHash({ query }, [`opaque`]),
-                ),
-            ).toBe(true)
-          } else {
-            expect(
-              errors,
-              `warm rows do not waive transport identity`,
-            ).toHaveLength(1)
-            // The shared conformance identity law rejects an unkeyed opaque
-            // React query during preparation, before SSR stream admission.
-            // Warming the source does not change that programming error.
-            expect(errors[0]).toBeInstanceOf(UnhashableQueryIRError)
-          }
-        } finally {
-          vi.stubGlobal(`window`, browserWindow)
-          await client.cleanup()
-        }
-      })
-    }
-})
-
-/** Result identity includes the caller's current input and its initial window.
- * The reference is authored rows sliced by page size, never transport records.
- * Browser replacement crosses builder -> callback Collection, with a distinct
- * explicit key or derived identity. Server preload checks both matching and
- * unbounded windows under one key; their portable result identities must differ.
- */
-function useRuntimeWindow(
-  input: unknown,
-  config: { pageSize: number; queryKey?: Array<string> },
-) {
-  // Exercise the callback-returned Collection runtime path without extending
-  // TypeScript's current QueryBuilder-only callback overload.
-  return Reflect.apply(useLiveInfiniteQuery, undefined, [input, config]) as {
-    data: Array<{ id: string; name: string }>
-  }
-}
-describe(`infinite hydration identity`, () => {
-  for (const keyed of [false, true])
-    it(`switches to callback Collection keyed=${keyed}`, async () => {
-      const source = createCollection(
-        mockSyncCollectionOptions<{ id: string; name: string }>({
-          id: `infinite-identity-source`,
-          getKey: (row) => row.id,
-          initialData: [
-            { id: `a`, name: `old` },
-            { id: `b`, name: `new` },
-          ],
-        }),
-      )
-      const client = new DbClient()
-      const oldQuery = new Query()
-        .from({ row: source })
-        .where(({ row }) => eq(row.id, `a`))
-        .orderBy(({ row }) => row.id)
-      const supplied = createLiveQueryCollection({
-        query: new Query()
-          .from({ row: source })
-          .where(({ row }) => eq(row.id, `b`))
-          .orderBy(({ row }) => row.id)
-          .limit(2),
-      })
-      let unmount: (() => void) | undefined
-      try {
-        await client.preloadLiveQuery({
-          query: oldQuery.limit(2),
-          ...(keyed ? { queryKey: [`old`] } : {}),
-        })
-        await supplied.preload()
-        const wrapper = ({ children }: { children: ReactNode }) => (
-          <DbProvider client={client}>{children}</DbProvider>
-        )
-        const hook = renderHook(
-          ({ replacement }: { replacement: boolean }) =>
-            useRuntimeWindow(() => (replacement ? supplied : oldQuery), {
-              pageSize: 1,
-              ...(keyed ? { queryKey: [replacement ? `new` : `old`] } : {}),
-            }),
-          { wrapper, initialProps: { replacement: false } },
-        )
-        unmount = hook.unmount
-        expect(hook.result.current.data.map((row) => row.name)).toEqual([`old`])
-        hook.rerender({ replacement: true })
-        expect(
-          hook.result.current.data.map((row) => row.name),
-          `replacement owns its hydration identity`,
-        ).toEqual([`new`])
-      } finally {
-        unmount?.()
-        await client.cleanup()
-        await supplied.cleanup()
-        await source.cleanup()
-      }
-    })
-  for (const matching of [false, true])
-    it(`keeps keyed initial window distinct matching=${matching}`, async () => {
-      const descriptor = collectionOptions(`window-identity`, () => ({
-        id: `window-identity`,
-        getKey: (row: { id: string }) => row.id,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        sync: {
-          sync: ({ begin, write, commit, markReady }) => {
-            begin()
-            for (const id of [`a`, `b`, `c`, `d`])
-              write({ type: `insert`, value: { id } })
-            commit()
-            markReady()
-          },
-        },
-      }))
-      const query = new Query()
-        .from({ row: descriptor })
-        .orderBy(({ row }) => row.id)
-      const client = new DbClient()
-      try {
-        const unbounded = getLiveQueryHash({ query }, [`window`])
-        const windowed = getLiveQueryHash({ query: query.limit(2).offset(0) }, [
-          `window`,
-        ])
-        await client.preloadLiveQuery({
-          query: matching ? query.limit(2).offset(0) : query,
-          queryKey: [`window`],
-        })
-        function Consumer() {
-          const result = useLiveInfiniteQuery(() => query, {
-            pageSize: 1,
-            queryKey: [`window`],
-          })
-          return <output>{result.data.map((row) => row.id).join(`,`)}</output>
-        }
-        const renderWindow = () =>
-          renderSsr(
-            <DbProvider client={client}>
-              <Consumer />
-            </DbProvider>,
-          )
-        if (matching) expect(renderWindow()).toContain(`<output>a</output>`)
-        else expect(renderWindow).toThrow(/SSR.*preload/)
-        expect(
-          unbounded,
-          `unbounded and windowed results cannot alias`,
-        ).not.toBe(windowed)
-        if (matching)
-          expect(
-            client
-              .dehydrate()
-              .liveQueries?.find((q) => q.queryHash === windowed)?.snapshot
-              ?.rows,
-          ).toHaveLength(2)
-      } finally {
-        await client.cleanup()
-      }
-    })
-})
-
 // Streaming must capture the view it actually renders, even when the adapter
 // publishes again in the microtask before its preload promise captures a result.
 // This metamorphic observation compares the final host markup with transport.
@@ -3074,46 +1425,3 @@ describe(`stream render snapshot cut`, () => {
       reach.assertReached()
     })
 })
-
-// Explicit keys identify the same window across builder preload and supplied
-// Collection input, including a callback that returns that Collection.
-for (const callback of [false, true])
-  it(`hydrates a supplied window with callback=${callback}`, async () => {
-    const source = createCollection(
-      mockSyncCollectionOptions<{ id: string }>({
-        id: `supplied-window-key`,
-        getKey: (row) => row.id,
-        autoIndex: `eager`,
-        defaultIndexType: BTreeIndex,
-        initialData: [{ id: `a` }, { id: `b` }, { id: `c` }],
-      }),
-    )
-    const query = new Query()
-      .from({ row: source })
-      .orderBy(({ row }) => row.id)
-      .limit(2)
-      .offset(0)
-    const supplied = createLiveQueryCollection({ query })
-    const client = new DbClient()
-    function Consumer() {
-      const result = useRuntimeWindow(callback ? () => supplied : supplied, {
-        pageSize: 1,
-        queryKey: [`supplied`],
-      })
-      return <output>{result.data.map((row) => row.id).join(`,`)}</output>
-    }
-    try {
-      await client.preloadLiveQuery({ query, queryKey: [`supplied`] })
-      expect(
-        renderSsr(
-          <DbProvider client={client}>
-            <Consumer />
-          </DbProvider>,
-        ),
-      ).toContain(`<output>a</output>`)
-    } finally {
-      await client.cleanup()
-      await supplied.cleanup()
-      await source.cleanup()
-    }
-  })
diff --git a/packages/react-db/tests/descriptor-query-binding-support.tsx b/packages/react-db/tests/descriptor-query-binding-support.tsx
new file mode 100644
index 0000000000..322bb7053f
--- /dev/null
+++ b/packages/react-db/tests/descriptor-query-binding-support.tsx
@@ -0,0 +1,19 @@
+// Shared row type and SSR render host for the descriptor query binding tests.
+// The law is owned by descriptor-query-binding-oracle.test.tsx.
+import { renderToString } from 'react-dom/server'
+import { vi } from 'vitest'
+import type { ReactNode } from 'react'
+
+export type Row = { id: string; value: string }
+
+// React's server renderer runs in this jsdom test process. Remove the browser
+// global only for that host call; hydrateRoot retains the real browser globals.
+export function renderSsr(node: ReactNode): string {
+  const browserWindow = globalThis.window
+  vi.stubGlobal(`window`, undefined)
+  try {
+    return renderToString(node)
+  } finally {
+    vi.stubGlobal(`window`, browserWindow)
+  }
+}
diff --git a/packages/react-db/tests/descriptor-query-binding.test.tsx b/packages/react-db/tests/descriptor-query-binding.test.tsx
new file mode 100644
index 0000000000..91a11436d2
--- /dev/null
+++ b/packages/react-db/tests/descriptor-query-binding.test.tsx
@@ -0,0 +1,1706 @@
+/** Ordinary tests moved from descriptor-query-binding-oracle.test.tsx; the oracle file owns the law. */
+import { Writable } from 'node:stream'
+import { act, render, renderHook, waitFor } from '@testing-library/react'
+import {
+  BTreeIndex,
+  DbClient,
+  Query,
+  UnhashableQueryIRError,
+  collectionOptions,
+  createCollection,
+  createLiveQueryCollection,
+  eq,
+  getLiveQueryHash,
+  getStableQueryBuilderHash,
+  isUndefined,
+  prepareLiveQueryValue,
+  toArray,
+} from '@tanstack/db'
+import { describe, expect, it, vi } from 'vitest'
+import { Suspense } from 'react'
+import { renderToPipeableStream, renderToString } from 'react-dom/server'
+import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
+import { DbProvider } from '../src/DbProvider'
+import { useLiveQuery } from '../src/useLiveQuery'
+import { useLiveQueryEffect } from '../src/useLiveQueryEffect'
+import { useLiveSuspenseQuery } from '../src/useLiveSuspenseQuery'
+import { mockSyncCollectionOptions } from '../../db/tests/utils'
+import { renderSsr } from './descriptor-query-binding-support'
+import type { Row } from './descriptor-query-binding-support'
+import type {
+  Context,
+  DeferredLiveQueryCollections,
+  QueryBuilder,
+} from '@tanstack/db'
+import type { ReactNode } from 'react'
+
+describe(`standalone descriptor query binding`, () => {
+  it(`binds a continued query for the next committed client-aware hook`, async () => {
+    const client = new DbClient()
+    const baseDescriptor = collectionOptions(`continued-react-base`, () => ({
+      id: `continued-react-base`,
+      getKey: (row: Row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({ type: `insert`, value: { id: `one`, value: `base` } })
+          commit()
+          markReady()
+        },
+      },
+    }))
+    let lateStarts = 0
+    const lateDescriptor = collectionOptions(`continued-react-late`, () => ({
+      id: `continued-react-late`,
+      getKey: (row: Row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          lateStarts++
+          begin()
+          write({ type: `insert`, value: { id: `one`, value: `late` } })
+          commit()
+          markReady()
+        },
+      },
+    }))
+    const original = new Query().from({ base: baseDescriptor })
+    const firstRenderDeferrals: DeferredLiveQueryCollections = new Set()
+    const prepared = prepareLiveQueryValue(
+      original,
+      client,
+      firstRenderDeferrals,
+    ) as typeof original
+    for (const source of firstRenderDeferrals) source._resumeSyncStart()
+    firstRenderDeferrals.clear()
+
+    const continued = prepared
+      .join({ late: lateDescriptor }, ({ base, late }) => eq(base.id, late.id))
+      .select(({ base, late }) => ({ id: base.id, value: late.value }))
+    expect(lateStarts).toBe(0)
+
+    const mounted = renderHook(() => useLiveQuery({ client, query: continued }))
+    await waitFor(() => {
+      expect(
+        mounted.result.current.data.map(({ id, value }) => ({ id, value })),
+      ).toEqual([{ id: `one`, value: `late` }])
+    })
+    expect(lateStarts).toBe(1)
+    mounted.unmount()
+  })
+  it(`does not start a continued descriptor in a render that never commits`, async () => {
+    const client = new DbClient()
+    const baseDescriptor = collectionOptions(`abandoned-react-base`, () => ({
+      id: `abandoned-react-base`,
+      getKey: (row: Row) => row.id,
+      startSync: true,
+      sync: { sync: ({ markReady }) => markReady() },
+    }))
+    let lateMaterializations = 0
+    let lateStarts = 0
+    const lateDescriptor = collectionOptions(`abandoned-react-late`, () => {
+      lateMaterializations++
+      return {
+        id: `abandoned-react-late`,
+        getKey: (row: Row) => row.id,
+        startSync: true,
+        sync: {
+          sync: ({ markReady }) => {
+            lateStarts++
+            markReady()
+          },
+        },
+      }
+    })
+    const original = new Query().from({ base: baseDescriptor })
+    const never = new Promise<void>(() => {})
+
+    function Abandoned(): ReactNode {
+      const deferrals: DeferredLiveQueryCollections = new Set()
+      const prepared = prepareLiveQueryValue(
+        original,
+        client,
+        deferrals,
+      ) as typeof original
+      prepared.join({ late: lateDescriptor }, ({ base, late }) =>
+        eq(base.id, late.id),
+      )
+      throw never
+    }
+
+    const mounted = render(
+      <Suspense fallback={<div>Waiting</div>}>
+        <Abandoned />
+      </Suspense>,
+    )
+    expect(mounted.getByText(`Waiting`)).toBeDefined()
+    await act(async () => {})
+    expect(lateMaterializations).toBe(0)
+    expect(lateStarts).toBe(0)
+    mounted.unmount()
+  })
+  it(`rejects an unbound descriptor after a same-hash concrete query`, async () => {
+    const id = `standalone-descriptor-unbound-transition`
+    const concrete = createCollection(
+      mockSyncCollectionOptions<Row>({
+        id,
+        getKey: (row) => row.id,
+        initialData: [{ id: `one`, value: `concrete` }],
+      }),
+    )
+    const descriptor = collectionOptions(id, () =>
+      mockSyncCollectionOptions<Row>({
+        id,
+        getKey: (row) => row.id,
+        initialData: [{ id: `one`, value: `descriptor` }],
+      }),
+    )
+    const concreteQuery = new Query()
+      .from({ item: concrete })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    const unboundQuery = new Query()
+      .from({ item: descriptor })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    expect(getStableQueryBuilderHash(unboundQuery)).toBe(
+      getStableQueryBuilderHash(concreteQuery),
+    )
+
+    let query = concreteQuery
+    const mounted = renderHook(() => useLiveQuery({ query }))
+    await waitFor(() => {
+      expect(mounted.result.current.data[0]?.value).toBe(`concrete`)
+    })
+
+    // The public error is the observation at the attempted consumption cut.
+    // Returning the previous row would conceal the missing DbClient.
+    query = unboundQuery
+    expect(() => mounted.rerender()).toThrow(/requires a DbClient.*DbProvider/)
+    mounted.unmount()
+
+    // An explicit identity changes when preparation runs, not the need for a
+    // client. Both supported identity forms still owe the React-specific fix.
+    expect(() =>
+      renderHook(() =>
+        useLiveQuery({ query: unboundQuery, queryKey: [`unbound`] }),
+      ),
+    ).toThrow(/requires a DbClient.*DbProvider/)
+    expect(() =>
+      renderHook(() => useLiveQuery({ query: unboundQuery }, [])),
+    ).toThrow(/requires a DbClient.*DbProvider/)
+    expect(() =>
+      renderHook(() =>
+        useLiveSuspenseQuery({
+          query: unboundQuery,
+          queryKey: [`unbound-suspense`],
+        }),
+      ),
+    ).toThrow(/requires a DbClient.*DbProvider/)
+    expect(() =>
+      renderHook(() => useLiveSuspenseQuery(() => unboundQuery, [])),
+    ).toThrow(/requires a DbClient.*DbProvider/)
+  })
+  it(`rejects a different source after a hook registered the same stream hash`, async () => {
+    const id = `hook-first-preload-source`
+    let finishFirst!: () => void
+    const first = createCollection({
+      id,
+      getKey: (row: Row) => row.id,
+      sync: {
+        sync: ({ markReady }) => {
+          finishFirst = markReady
+        },
+      },
+    })
+    const second = collectionOptions(id, () =>
+      mockSyncCollectionOptions<Row>({
+        id,
+        getKey: (row) => row.id,
+        initialData: [{ id: `one`, value: `second` }],
+      }),
+    )
+    const firstQuery = new Query()
+      .from({ item: first })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    const secondQuery = new Query()
+      .from({ item: second })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    expect(getStableQueryBuilderHash(firstQuery)).toBe(
+      getStableQueryBuilderHash(secondQuery),
+    )
+    const client = new DbClient()
+    client._setSsrStreamingEnabled(true)
+    client._setSsrServerCleanupEnabled(true)
+    const wrapper = ({ children }: { children: ReactNode }) => (
+      <DbProvider client={client}>
+        <Suspense fallback={null}>{children}</Suspense>
+      </DbProvider>
+    )
+    const mounted = renderHook(
+      () => useLiveSuspenseQuery({ query: firstQuery }),
+      { wrapper },
+    )
+
+    try {
+      expect(
+        client.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toHaveLength(1)
+      expect(() => client.preloadLiveQuery({ query: firstQuery })).not.toThrow()
+      expect(() => client.preloadLiveQuery({ query: secondQuery })).toThrow(
+        /different source Collections/,
+      )
+    } finally {
+      await act(async () => {
+        finishFirst()
+        await Promise.resolve()
+      })
+      mounted.unmount()
+      await client.cleanup()
+      await first.cleanup()
+    }
+  })
+  it(`keeps a hydration-first hook's local source claim for later preloads`, async () => {
+    const id = `hydration-first-hook-source`
+    let finishBrowser!: () => void
+    const descriptor = collectionOptions(id, (client) => ({
+      id,
+      getKey: (row: Row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          const publish = () => {
+            begin()
+            for (const row of client.requireDependency<Array<Row>>(`rows`)) {
+              write({ type: `insert`, value: row })
+            }
+            commit()
+            markReady()
+          }
+          if (client.getDependency<boolean>(`deferReady`)) {
+            finishBrowser = publish
+          } else {
+            publish()
+          }
+        },
+      },
+    }))
+    const query = new Query()
+      .from({ item: descriptor })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    const server = new DbClient({
+      rows: [{ id: `one`, value: `server` }],
+    })
+    const browser = new DbClient({
+      rows: [{ id: `one`, value: `browser` }],
+      deferReady: true,
+    })
+    const other = createCollection(
+      mockSyncCollectionOptions<Row>({
+        id,
+        getKey: (row) => row.id,
+        initialData: [{ id: `one`, value: `other` }],
+      }),
+    )
+    const otherQuery = new Query()
+      .from({ item: other })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    let mounted: ReturnType<typeof renderHook> | undefined
+    const browserRows = () =>
+      (mounted!.result.current as { data: Array<Row> }).data.map((row) => ({
+        id: row.id,
+        value: row.value,
+      }))
+
+    try {
+      await server.preloadLiveQuery({ query })
+      browser.hydrate(server.dehydrate())
+      expect(getStableQueryBuilderHash(query)).toBe(
+        getStableQueryBuilderHash(otherQuery),
+      )
+
+      mounted = renderHook(() => useLiveQuery({ query }), {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <DbProvider client={browser}>{children}</DbProvider>
+        ),
+      })
+      await waitFor(() => {
+        expect(browserRows()).toEqual([{ id: `one`, value: `server` }])
+      })
+      expect(
+        browser.dehydrate({ shouldDehydrateLiveQuery: () => true }).liveQueries,
+      ).toHaveLength(1)
+      expect(() => browser.preloadLiveQuery({ query: otherQuery })).toThrow(
+        /different source Collections/,
+      )
+      act(() => finishBrowser())
+      await waitFor(() => {
+        expect(browserRows()).toEqual([{ id: `one`, value: `browser` }])
+      })
+    } finally {
+      mounted?.unmount()
+      await browser.cleanup()
+      await server.cleanup()
+      await other.cleanup()
+    }
+  })
+  /**
+   * Suspense requests data during render so that React has a promise to retry.
+   * That preload is local demand even if React never commits the render. The
+   * independent ownership rule is first local preload wins: another source
+   * object with the same query hash cannot borrow its hydrated stream. The
+   * fallback, source start, same-source acceptance, and conflicting-preload
+   * error are observed before the held server result settles.
+   */
+  it(`keeps a hydrated stream's source claim from an abandoned Suspense preload`, async () => {
+    const client = new DbClient()
+    client._setSsrServerCleanupEnabled(true)
+    const server = new DbClient()
+    let firstStarts = 0
+    let finishFirst: (() => void) | undefined
+    let finishSecond: (() => void) | undefined
+    const source = (started: (markReady: () => void) => void) =>
+      createCollection({
+        id: `hydrated-suspense-claim`,
+        getKey: (row: Row) => row.id,
+        sync: { sync: ({ markReady }) => started(markReady) },
+      })
+    const first = source((markReady) => {
+      firstStarts++
+      finishFirst = markReady
+    })
+    const second = source((markReady) => {
+      finishSecond = markReady
+    })
+    const serverSource = source((markReady) => markReady())
+    const queryFor = (collection: typeof first) =>
+      new Query()
+        .from({ item: collection })
+        .select(({ item }) => ({ id: item.id, value: item.value }))
+    const firstQuery = queryFor(first)
+    const secondQuery = queryFor(second)
+    let settle!: (value: { rows: Array<{ key: string; value: Row }> }) => void
+    const pending = new Promise<{ rows: Array<{ key: string; value: Row }> }>(
+      (resolve) => {
+        settle = resolve
+      },
+    )
+    let mounted: ReturnType<typeof render> | undefined
+
+    try {
+      expect(getStableQueryBuilderHash(secondQuery)).toBe(
+        getStableQueryBuilderHash(firstQuery),
+      )
+      await server.preloadLiveQuery({ query: queryFor(serverSource) })
+      const queryHash = server.dehydrate().liveQueries![0]!.queryHash
+      client.hydrate({
+        collections: [],
+        liveQueries: [{ queryHash, dehydratedAt: 1, promise: pending }],
+      })
+      const never = new Promise<void>(() => {})
+      function Abandoned(): ReactNode {
+        useLiveSuspenseQuery({ query: firstQuery })
+        throw never
+      }
+
+      mounted = render(
+        <DbProvider client={client}>
+          <Suspense fallback={<div>Waiting</div>}>
+            <Abandoned />
+          </Suspense>
+        </DbProvider>,
+      )
+      expect(mounted.getByText(`Waiting`)).toBeDefined()
+      expect(firstStarts, `Suspense preload begins before commit`).toBe(1)
+      expect(() => client.preloadLiveQuery({ query: secondQuery })).toThrow(
+        /different source Collections/,
+      )
+      expect(() => client.preloadLiveQuery({ query: firstQuery })).not.toThrow()
+    } finally {
+      mounted?.unmount()
+      settle({ rows: [] })
+      finishFirst?.()
+      finishSecond?.()
+      await act(async () => {
+        await pending
+      })
+      await client.cleanup()
+      await server.cleanup()
+      await first.cleanup()
+      await second.cleanup()
+      await serverSource.cleanup()
+    }
+  })
+  it(`dehydrates a descriptor source first consumed by a committed Effect`, async () => {
+    const id = `standalone-descriptor-effect-dehydration`
+    const expected = { id: `one`, value: `first` }
+    const descriptor = collectionOptions(id, (client) =>
+      mockSyncCollectionOptions<Row>({
+        id,
+        getKey: (row) => row.id,
+        initialData: client.requireDependency<Array<Row>>(`rows`),
+      }),
+    )
+    const query = new Query()
+      .from({ item: descriptor })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    const client = new DbClient({ rows: [{ ...expected }] })
+    const observed: Array<Row> = []
+
+    const mounted = renderHook(
+      () =>
+        useLiveQueryEffect<Row, string>({
+          query,
+          onEnter: ({ value }) => {
+            observed.push({ id: value.id, value: value.value })
+          },
+        }),
+      {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <DbProvider client={client}>{children}</DbProvider>
+        ),
+      },
+    )
+
+    // The plain expected row is independent of the Effect and dehydration code.
+    // Compare at the settled enter cut, then at the public dehydrate() call.
+    await waitFor(() => expect(observed).toEqual([expected]))
+    const chunk = client
+      .dehydrate()
+      .collections.find((collection) => collection.collectionId === id)
+    expect(chunk?.rows.map(({ key, value }) => ({ key, value }))).toEqual([
+      { key: expected.id, value: expected },
+    ])
+    mounted.unmount()
+  })
+  it(`binds an Effect's prebuilt query to its receiving provider`, async () => {
+    const descriptor = collectionOptions(
+      `standalone-descriptor-effect-rows`,
+      (client) =>
+        mockSyncCollectionOptions<Row>({
+          id: `standalone-descriptor-effect-rows`,
+          getKey: (row) => row.id,
+          initialData: client.requireDependency<Array<Row>>(`rows`),
+        }),
+    )
+    const query = new Query()
+      .from({ item: descriptor })
+      .select(({ item }) => ({ id: item.id, value: item.value }))
+    const expected = [
+      { id: `shared`, value: `first` },
+      { id: `shared`, value: `second` },
+    ]
+    const observed: Array<Array<Row>> = [[], []]
+    const updates: Array<Array<Row>> = [[], []]
+    const clients = expected.map((row) => new DbClient({ rows: [{ ...row }] }))
+    const oldClient = clients[0]!
+    const mounted = expected.map((_, index) => {
+      return renderHook(
+        () =>
+          useLiveQueryEffect<Row, string>({
+            query,
+            onEnter: ({ value }) => {
+              observed[index]!.push({ id: value.id, value: value.value })
+            },
+            onUpdate: ({ value }) => {
+              updates[index]!.push({ id: value.id, value: value.value })
+            },
+          }),
+        {
+          wrapper: ({ children }: { children: ReactNode }) => (
+            <DbProvider client={clients[index]!}>{children}</DbProvider>
+          ),
+        },
+      )
+    })
+
+    // At initial publication, each Effect must report its own client's row.
+    await waitFor(() => {
+      expect(observed).toEqual(expected.map((row) => [row]))
+    })
+
+    clients[0] = clients[1]!
+    mounted[0]!.rerender()
+    await waitFor(() => {
+      expect(observed[0]).toEqual([expected[0], expected[1]])
+    })
+
+    act(() => {
+      oldClient.collection(descriptor).update(`shared`, (draft) => {
+        draft.value = `old write`
+      })
+    })
+    await act(async () => {})
+    expect(observed[0]).toEqual([expected[0], expected[1]])
+    expect(updates[0]).toEqual([])
+
+    act(() => {
+      clients[1]!.collection(descriptor).update(`shared`, (draft) => {
+        draft.value = `new write`
+      })
+    })
+    await waitFor(() => {
+      expect(updates[0]).toEqual([{ id: `shared`, value: `new write` }])
+    })
+
+    mounted.forEach((hook) => hook.unmount())
+  })
+  it.each([`join`, `nestedFrom`, `union`, `include`] as const)(
+    `keeps two descriptor sources local to each provider in a %s query`,
+    async (form) => {
+      type Parent = { id: string; value: string }
+      type Child = { id: string; parentId: string; value: string }
+      const parentDescriptor = collectionOptions(
+        `two-source-parent-${form}`,
+        (client) =>
+          mockSyncCollectionOptions<Parent>({
+            id: `two-source-parent-${form}`,
+            getKey: (row) => row.id,
+            initialData: client.requireDependency<Array<Parent>>(`parents`),
+          }),
+      )
+      const childDescriptor = collectionOptions(
+        `two-source-child-${form}`,
+        (client) =>
+          mockSyncCollectionOptions<Child>({
+            id: `two-source-child-${form}`,
+            getKey: (row) => row.id,
+            initialData: client.requireDependency<Array<Child>>(`children`),
+          }),
+      )
+
+      // One plan is built before either client. Each client supplies two
+      // distinct source rows; aliases and query identity are shared.
+      const joined = () =>
+        new Query()
+          .from({ parent: parentDescriptor })
+          .innerJoin({ child: childDescriptor }, ({ parent, child }) =>
+            eq(parent.id, child.parentId),
+          )
+          .select(({ parent, child }) => ({
+            id: parent.id,
+            value: parent.value,
+            childValue: child.value,
+          }))
+      const query =
+        form === `join`
+          ? joined()
+          : form === `nestedFrom`
+            ? new Query().from({ wrapper: joined() }).select(({ wrapper }) => ({
+                id: wrapper.id,
+                value: wrapper.value,
+                childValue: wrapper.childValue,
+              }))
+            : form === `union`
+              ? new Query().unionAll(
+                  new Query()
+                    .from({ parent: parentDescriptor })
+                    .select(({ parent }) => ({
+                      id: parent.id,
+                      value: parent.value,
+                    })),
+                  new Query()
+                    .from({ child: childDescriptor })
+                    .select(({ child }) => ({
+                      id: child.id,
+                      value: child.value,
+                    })),
+                )
+              : new Query()
+                  .from({ parent: parentDescriptor })
+                  .select(({ parent }) => ({
+                    id: parent.id,
+                    value: parent.value,
+                    children: toArray(
+                      new Query()
+                        .from({ child: childDescriptor })
+                        .where(({ child }) => eq(child.parentId, parent.id))
+                        .select(({ child }) => ({
+                          id: child.id,
+                          value: child.value,
+                        })),
+                    ),
+                  }))
+      const hookQuery = query as QueryBuilder<Context>
+      const first = new DbClient({
+        parents: [{ id: `parent`, value: `FIRST PARENT` }],
+        children: [{ id: `child`, parentId: `parent`, value: `FIRST CHILD` }],
+      })
+      const second = new DbClient({
+        parents: [{ id: `parent`, value: `SECOND PARENT` }],
+        children: [{ id: `child`, parentId: `parent`, value: `SECOND CHILD` }],
+      })
+      const models = new Map([
+        [first, { parent: `FIRST PARENT`, child: `FIRST CHILD` }],
+        [second, { parent: `SECOND PARENT`, child: `SECOND CHILD` }],
+      ])
+      const mounted = [first, second].map((client) => ({
+        client,
+        hook: renderHook(() => useLiveQuery({ query: hookQuery }), {
+          wrapper: ({ children }: { children: ReactNode }) => (
+            <DbProvider client={client}>{children}</DbProvider>
+          ),
+        }),
+      }))
+
+      /** The model recomputes rows from each client's two plain values. */
+      const expected = (client: DbClient) => {
+        const values = models.get(client)!
+        return form === `union`
+          ? [
+              { id: `child`, value: values.child },
+              { id: `parent`, value: values.parent },
+            ]
+          : form === `join` || form === `nestedFrom`
+            ? [
+                {
+                  id: `parent`,
+                  value: values.parent,
+                  childValue: values.child,
+                },
+              ]
+            : [
+                {
+                  id: `parent`,
+                  value: values.parent,
+                  children: [{ id: `child`, value: values.child }],
+                },
+              ]
+      }
+      const check = async (cut: string) => {
+        await waitFor(() => {
+          for (const { client, hook } of mounted) {
+            const rows = (
+              hook.result.current.data as Array<{
+                id: string
+                value: string
+                childValue?: string
+                children?: Array<{ id: string; value: string }>
+              }>
+            )
+              .map((row) => ({
+                id: row.id,
+                value: row.value,
+                ...(form === `join` || form === `nestedFrom`
+                  ? { childValue: row.childValue }
+                  : {}),
+                ...(form === `include`
+                  ? {
+                      children: (row.children ?? []).map((child) => ({
+                        id: child.id,
+                        value: child.value,
+                      })),
+                    }
+                  : {}),
+              }))
+              .sort((a, b) => a.id.localeCompare(b.id))
+            expect(
+              rows,
+              `${cut}: ${client === first ? `first` : `second`}`,
+            ).toEqual(expected(client))
+          }
+        })
+      }
+
+      try {
+        await check(`initial publication`)
+        act(() => {
+          first.collection(childDescriptor).update(`child`, (draft) => {
+            draft.value = `FIRST CHILD 2`
+          })
+        })
+        models.get(first)!.child = `FIRST CHILD 2`
+        await check(`first child write`)
+
+        act(() => {
+          second.collection(parentDescriptor).update(`parent`, (draft) => {
+            draft.value = `SECOND PARENT 2`
+          })
+        })
+        models.get(second)!.parent = `SECOND PARENT 2`
+        await check(`second parent write`)
+      } finally {
+        for (const { hook } of mounted) {
+          hook.unmount()
+          await hook.result.current.collection.cleanup()
+        }
+        await first.cleanup()
+        await second.cleanup()
+      }
+    },
+  )
+  it.each([`shadowed`, `renamed`] as const)(
+    `keeps client and lexical source identity in a %s descriptor include`,
+    async (aliasForm) => {
+      type Parent = { id: string; value: string }
+      type Child = { id: string; parentId: string; value: string }
+      const parentDescriptor = collectionOptions(
+        `combined-parent-${aliasForm}`,
+        (client) =>
+          mockSyncCollectionOptions<Parent>({
+            id: `combined-parent-${aliasForm}`,
+            getKey: (row) => row.id,
+            initialData: client.requireDependency<Array<Parent>>(`parents`),
+          }),
+      )
+      const childDescriptor = collectionOptions(
+        `combined-child-${aliasForm}`,
+        (client) =>
+          mockSyncCollectionOptions<Child>({
+            id: `combined-child-${aliasForm}`,
+            getKey: (row) => row.id,
+            initialData: client.requireDependency<Array<Child>>(`children`),
+          }),
+      )
+
+      // Both branches promise the same rows. Renaming only the child alias
+      // must not change which client or lexical source supplies either value.
+      const query =
+        aliasForm === `shadowed`
+          ? new Query()
+              .from({ issue: parentDescriptor })
+              .select(({ issue }) => ({
+                id: issue.id,
+                value: issue.value,
+                children: toArray(
+                  new Query()
+                    .from({ issue: childDescriptor })
+                    .where(({ issue: child }) => eq(child.parentId, issue.id))
+                    .select(({ issue: child }) => ({
+                      id: child.id,
+                      value: child.value,
+                      parentValue: issue.value,
+                    })),
+                ),
+              }))
+          : new Query()
+              .from({ issue: parentDescriptor })
+              .select(({ issue }) => ({
+                id: issue.id,
+                value: issue.value,
+                children: toArray(
+                  new Query()
+                    .from({ child: childDescriptor })
+                    .where(({ child }) => eq(child.parentId, issue.id))
+                    .select(({ child }) => ({
+                      id: child.id,
+                      value: child.value,
+                      parentValue: issue.value,
+                    })),
+                ),
+              }))
+      const first = new DbClient({
+        parents: [{ id: `p`, value: `FIRST PARENT` }],
+        children: [{ id: `c`, parentId: `p`, value: `FIRST CHILD` }],
+      })
+      const second = new DbClient({
+        parents: [{ id: `p`, value: `SECOND PARENT` }],
+        children: [{ id: `c`, parentId: `p`, value: `SECOND CHILD` }],
+      })
+      const model = new Map([
+        [first, { parent: `FIRST PARENT`, child: `FIRST CHILD` }],
+        [second, { parent: `SECOND PARENT`, child: `SECOND CHILD` }],
+      ])
+      const mounted = [first, second].map((client) => ({
+        client,
+        hook: renderHook(
+          () => useLiveQuery({ query: query as QueryBuilder<Context> }),
+          {
+            wrapper: ({ children }: { children: ReactNode }) => (
+              <DbProvider client={client}>{children}</DbProvider>
+            ),
+          },
+        ),
+      }))
+      const check = async (cut: string) => {
+        await waitFor(() => {
+          for (const { client, hook } of mounted) {
+            const values = model.get(client)!
+            const rows = (
+              hook.result.current.data as Array<{
+                id: string
+                value: string
+                children: Array<{
+                  id: string
+                  value: string
+                  parentValue: string
+                }>
+              }>
+            ).map((row) => ({
+              id: row.id,
+              value: row.value,
+              children: row.children.map((child) => ({
+                id: child.id,
+                value: child.value,
+                parentValue: child.parentValue,
+              })),
+            }))
+            expect(rows, `${cut}: public rows`).toEqual([
+              {
+                id: `p`,
+                value: values.parent,
+                children: [
+                  {
+                    id: `c`,
+                    value: values.child,
+                    parentValue: values.parent,
+                  },
+                ],
+              },
+            ])
+          }
+        })
+      }
+
+      try {
+        await check(`initial publication`)
+        const bound = prepareLiveQueryValue(
+          query,
+          first,
+        ) as QueryBuilder<Context>
+        expect(getStableQueryBuilderHash(bound)).toBe(
+          getStableQueryBuilderHash(query),
+        )
+        act(() => {
+          first.collection(childDescriptor).update(`c`, (draft) => {
+            draft.value = `FIRST CHILD 2`
+          })
+        })
+        model.get(first)!.child = `FIRST CHILD 2`
+        await check(`first child write`)
+        act(() => {
+          second.collection(parentDescriptor).update(`p`, (draft) => {
+            draft.value = `SECOND PARENT 2`
+          })
+        })
+        model.get(second)!.parent = `SECOND PARENT 2`
+        await check(`second parent write`)
+      } finally {
+        for (const { hook } of mounted) {
+          hook.unmount()
+          await hook.result.current.collection.cleanup()
+        }
+        await first.cleanup()
+        await second.cleanup()
+      }
+    },
+  )
+  /**
+   * A descriptor plan keeps both its receiving client and each source's
+   * lexical binding. The plain model pairs main and joined rows by ID, then
+   * restricts the pair to its parent. A missing join side stays undefined even
+   * when the parent and local main sources both spell their alias `issue`.
+   * RIGHT/FULL, correlation side, alias spelling, and source mode are legal
+   * dimensions. Two clients have the same row IDs but distinct values. The
+   * public comparison runs after initial acquisition and every authored write;
+   * on-demand cells also observe each client's provider requests.
+   */
+  const outerJoinHistories = [
+    { kind: `right`, correlation: `joined` },
+    { kind: `right`, correlation: `main` },
+    { kind: `full`, correlation: `joined` },
+    { kind: `full`, correlation: `main` },
+  ] as const
+  for (const { kind, correlation } of outerJoinHistories) {
+    for (const mode of [`eager`, `onDemand`] as const) {
+      it(`${kind} join with ${correlation} correlation binds shadowed and renamed descriptors per client in ${mode} mode`, async () => {
+        type Parent = { id: number; marker: string }
+        type Main = {
+          id: number
+          parentId: number
+          anchorId: number
+          label: string
+        }
+        type Anchor = { id: number; parentId: number }
+        type Sources = {
+          parents: Map<number, Parent>
+          mains: Map<number, Main>
+          anchors: Map<number, Anchor>
+        }
+        type Role = keyof Sources
+        type Expected = {
+          parentId: number
+          mainId: number | undefined
+          anchorId: number | undefined
+          label: string | undefined
+          marker: string
+          missingMain: boolean
+          missingAnchor: boolean
+        }
+
+        const initial = (marker: string): Sources => ({
+          parents: new Map([[1, { id: 1, marker }]]),
+          mains: new Map([
+            [
+              10,
+              { id: 10, parentId: 1, anchorId: 7, label: `${marker} MATCH` },
+            ],
+            [
+              11,
+              {
+                id: 11,
+                parentId: 1,
+                anchorId: 9,
+                label: `${marker} MAIN ONLY`,
+              },
+            ],
+          ]),
+          anchors: new Map([
+            [7, { id: 7, parentId: 1 }],
+            [8, { id: 8, parentId: 1 }],
+          ]),
+        })
+        const first = new DbClient({ marker: `FIRST` })
+        const second = new DbClient({ marker: `SECOND` })
+        const models = new Map<DbClient, Sources>([
+          [first, initial(`FIRST`)],
+          [second, initial(`SECOND`)],
+        ])
+        const counters = new Map<
+          DbClient,
+          Map<Role, { starts: number; requests: number }>
+        >()
+        const writers = new Map<
+          DbClient,
+          Map<
+            Role,
+            (type: `insert` | `update` | `delete`, row: unknown) => void
+          >
+        >()
+
+        /** The adapter reads authored source rows; expected rows use only maps. */
+        const descriptor = <T extends { id: number }>(
+          role: Role,
+          suffix: string,
+        ) =>
+          collectionOptions(
+            `combined-outer-${kind}-${correlation}-${mode}-${suffix}`,
+            (client) => ({
+              id: `combined-outer-${kind}-${correlation}-${mode}-${suffix}`,
+              getKey: (row: T) => row.id,
+              startSync: true,
+              ...(role !== `parents` && mode === `onDemand`
+                ? { syncMode: `on-demand` as const }
+                : {}),
+              sync: {
+                sync: ({ begin, write, commit, markReady }) => {
+                  const clientCounters = counters.get(client) ?? new Map()
+                  counters.set(client, clientCounters)
+                  const count = clientCounters.get(role) ?? {
+                    starts: 0,
+                    requests: 0,
+                  }
+                  clientCounters.set(role, count)
+                  count.starts++
+                  const installed = new Set<number>()
+                  const send = (
+                    type: `insert` | `update` | `delete`,
+                    row: T,
+                  ) => {
+                    begin()
+                    write({ type, value: { ...row } })
+                    commit()
+                    if (type === `delete`) installed.delete(row.id)
+                    else installed.add(row.id)
+                  }
+                  const clientWriters =
+                    writers.get(client) ??
+                    new Map<
+                      Role,
+                      (
+                        type: `insert` | `update` | `delete`,
+                        row: unknown,
+                      ) => void
+                    >()
+                  writers.set(client, clientWriters)
+                  clientWriters.set(role, (type, row) => send(type, row as T))
+                  const rows = () =>
+                    [
+                      ...models.get(client)![role].values(),
+                    ] as unknown as Array<T>
+                  if (role === `parents` || mode === `eager`) {
+                    for (const row of rows()) send(`insert`, row)
+                  }
+                  markReady()
+                  if (role !== `parents` && mode === `onDemand`) {
+                    return {
+                      loadSubset: () => {
+                        count.requests++
+                        for (const row of rows()) {
+                          if (!installed.has(row.id)) send(`insert`, row)
+                        }
+                        return Promise.resolve()
+                      },
+                    }
+                  }
+                  return undefined
+                },
+              },
+            }),
+          )
+
+        const parents = descriptor<Parent>(`parents`, `parent`)
+        const mains = descriptor<Main>(`mains`, `main`)
+        const anchors = descriptor<Anchor>(`anchors`, `anchor`)
+        const cases = ([`issue`, `child`] as const).map((alias) => {
+          const query = new Query()
+            .from({ issue: parents })
+            .select(({ issue: parent }) => {
+              const joinedSource =
+                correlation === `joined`
+                  ? new Query()
+                      .from({ source: anchors })
+                      .where(({ source }) => eq(source.parentId, parent.id))
+                      .select(({ source }) => ({
+                        id: source.id,
+                        parentId: source.parentId,
+                      }))
+                  : anchors
+              const child = new Query()
+                .from({ [alias]: mains })
+                .join(
+                  { anchor: joinedSource },
+                  (context: Record<string, unknown>) =>
+                    eq(
+                      (context[alias] as Main).anchorId,
+                      (context.anchor as Anchor).id,
+                    ),
+                  kind,
+                )
+                .where((context: Record<string, unknown>) =>
+                  correlation === `joined`
+                    ? eq((context.anchor as Anchor).parentId, parent.id)
+                    : eq((context[alias] as Main).parentId, parent.id),
+                )
+                .select((context: Record<string, unknown>) => ({
+                  mainId: (context[alias] as Main).id,
+                  anchorId: (context.anchor as Anchor).id,
+                  label: (context[alias] as Main).label,
+                  marker: parent.marker,
+                  missingMain: isUndefined((context[alias] as Main).id),
+                  missingAnchor: isUndefined((context.anchor as Anchor).id),
+                }))
+              return { id: parent.id, rows: toArray(child) }
+            })
+          return {
+            alias,
+            query,
+            mounted: [first, second].map((client) => ({
+              client,
+              hook: renderHook(
+                () => useLiveQuery({ query: query as QueryBuilder<Context> }),
+                {
+                  wrapper: ({ children }: { children: ReactNode }) => (
+                    <DbProvider client={client}>{children}</DbProvider>
+                  ),
+                },
+              ),
+            })),
+          }
+        })
+
+        /** The model uses source roles and values, never lexical alias text. */
+        const expected = (sources: Sources): Array<Expected> => {
+          const mainsNow = [...sources.mains.values()]
+          const anchorsNow = [...sources.anchors.values()]
+          const pairs: Array<[Main | undefined, Anchor | undefined]> = []
+          for (const anchor of anchorsNow) {
+            const matches = mainsNow.filter(
+              (main) => main.anchorId === anchor.id,
+            )
+            if (matches.length === 0) pairs.push([undefined, anchor])
+            else for (const main of matches) pairs.push([main, anchor])
+          }
+          if (kind === `full`) {
+            for (const main of mainsNow) {
+              if (!anchorsNow.some((anchor) => anchor.id === main.anchorId)) {
+                pairs.push([main, undefined])
+              }
+            }
+          }
+          return [...sources.parents.values()]
+            .flatMap((parent) =>
+              pairs
+                .filter(([main, anchor]) =>
+                  correlation === `joined`
+                    ? anchor?.parentId === parent.id
+                    : main?.parentId === parent.id,
+                )
+                .map(([main, anchor]) => ({
+                  parentId: parent.id,
+                  mainId: main?.id,
+                  anchorId: anchor?.id,
+                  label: main?.label,
+                  marker: parent.marker,
+                  missingMain: main === undefined,
+                  missingAnchor: anchor === undefined,
+                })),
+            )
+            .sort(
+              (a, b) =>
+                a.parentId - b.parentId ||
+                (a.anchorId ?? Infinity) - (b.anchorId ?? Infinity) ||
+                (a.mainId ?? Infinity) - (b.mainId ?? Infinity),
+            )
+        }
+        const observe = (
+          data: ReadonlyArray<{
+            id: number
+            rows: Array<Omit<Expected, `parentId`>>
+          }>,
+        ): Array<Expected> =>
+          data
+            .flatMap((parent) =>
+              parent.rows.map((row) => ({ parentId: parent.id, ...row })),
+            )
+            .sort(
+              (a, b) =>
+                a.parentId - b.parentId ||
+                (a.anchorId ?? Infinity) - (b.anchorId ?? Infinity) ||
+                (a.mainId ?? Infinity) - (b.mainId ?? Infinity),
+            )
+        const check = async (cut: string) => {
+          await waitFor(() => {
+            for (const entry of cases) {
+              for (const { client, hook } of entry.mounted) {
+                const rows = hook.result.current.data as unknown as Array<{
+                  id: number
+                  rows: Array<Omit<Expected, `parentId`>>
+                }>
+                expect(observe(rows), `${entry.alias}, ${cut}`).toEqual(
+                  expected(models.get(client)!),
+                )
+              }
+            }
+          })
+        }
+        const change = <T extends { id: number }>(
+          client: DbClient,
+          role: Role,
+          type: `insert` | `update` | `delete`,
+          row: T,
+        ) => {
+          const source = models.get(client)![role] as unknown as Map<number, T>
+          if (type === `delete`) source.delete(row.id)
+          else source.set(row.id, row)
+          act(() => {
+            writers.get(client)!.get(role)!(type, row)
+          })
+        }
+
+        try {
+          await check(`initial acquisition`)
+          for (const client of [first, second]) {
+            for (const role of [`parents`, `mains`, `anchors`] as const) {
+              expect(counters.get(client)?.get(role)?.starts).toBe(1)
+              if (role !== `parents` && mode === `onDemand`) {
+                expect(
+                  counters.get(client)?.get(role)?.requests,
+                ).toBeGreaterThan(0)
+              }
+            }
+          }
+          for (const entry of cases) {
+            expect(
+              getStableQueryBuilderHash(
+                prepareLiveQueryValue(
+                  entry.query,
+                  first,
+                ) as QueryBuilder<Context>,
+              ),
+            ).toBe(getStableQueryBuilderHash(entry.query))
+            expect(
+              getStableQueryBuilderHash(
+                prepareLiveQueryValue(
+                  entry.query,
+                  second,
+                ) as QueryBuilder<Context>,
+              ),
+            ).toBe(getStableQueryBuilderHash(entry.query))
+          }
+
+          change(first, `mains`, `update`, {
+            id: 10,
+            parentId: 1,
+            anchorId: 7,
+            label: `FIRST UPDATED`,
+          })
+          await check(`first client main update`)
+          change(second, `mains`, `delete`, models.get(second)!.mains.get(10)!)
+          await check(`second client main becomes absent`)
+          change(second, `mains`, `insert`, {
+            id: 10,
+            parentId: 1,
+            anchorId: 7,
+            label: `SECOND RETURNED`,
+          })
+          await check(`second client main returns`)
+          change(first, `anchors`, `delete`, models.get(first)!.anchors.get(7)!)
+          await check(`first client joined side becomes absent`)
+          change(second, `parents`, `update`, {
+            id: 1,
+            marker: `SECOND UPDATED`,
+          })
+          await check(`second client parent update`)
+        } finally {
+          for (const entry of cases) {
+            for (const { hook } of entry.mounted) {
+              hook.unmount()
+              await hook.result.current.collection.cleanup()
+            }
+          }
+          await first.cleanup()
+          await second.cleanup()
+        }
+      })
+    }
+  }
+})
+
+// Suspense discovery is explicit data demand in streaming mode. A warm source
+// must still register this query, rather than bypassing transport because its
+// live-query Collection happens to be ready before the wrapper reads it.
+describe(`SSR Suspense discovery`, () => {
+  for (const warm of [false, true]) {
+    it(`streams a render-discovered result with warm=${warm}`, async () => {
+      const descriptor = collectionOptions(`ssr-suspense-discovery`, () => ({
+        id: `ssr-suspense-discovery`,
+        getKey: (row: { id: string; name: string }) => row.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            begin()
+            write({ type: `insert`, value: { id: `1`, name: `server 1` } })
+            commit()
+            markReady()
+          },
+        },
+      }))
+      const client = new DbClient()
+      client._setSsrStreamingEnabled(true)
+      const query = new Query()
+        .from({ person: descriptor })
+        .select(({ person }) => ({ name: person.name }))
+      function Consumer() {
+        const result = useLiveSuspenseQuery({ query })
+        return <span>{result.data.map((row) => row.name).join(`,`)}</span>
+      }
+      // This driver invokes React's Node server host inside jsdom. Match the
+      // actual host's globals so the hydration getter cannot mistake it for a
+      // browser receiver waiting for a record the server has not produced yet.
+      const originalWindow = globalThis.window
+      vi.stubGlobal(`window`, undefined)
+      try {
+        if (warm)
+          await client.preloadLiveQuery({
+            query: new Query()
+              .from({ person: descriptor })
+              .select(({ person }) => ({ id: person.id })),
+          })
+        const errors: Array<unknown> = []
+        const html = await new Promise<string>((resolve, reject) => {
+          let text = ``
+          const sink = new Writable({
+            write(chunk, _encoding, done) {
+              text += chunk.toString()
+              done()
+            },
+          })
+          sink.on(`finish`, () => resolve(text))
+          sink.on(`error`, reject)
+          const stream = renderToPipeableStream(
+            <DbProvider client={client}>
+              <Suspense fallback={<span>loading</span>}>
+                <Consumer />
+              </Suspense>
+            </DbProvider>,
+            {
+              onAllReady() {
+                stream.pipe(sink)
+              },
+              onError(error) {
+                errors.push(error)
+              },
+            },
+          )
+        })
+        expect(errors).toEqual([])
+        expect(html).toContain(`<span>server 1</span>`)
+        const hash = getLiveQueryHash({ query })
+        const result = client
+          .dehydrate({ shouldDehydrateLiveQuery: () => true })
+          .liveQueries?.find((entry) => entry.queryHash === hash)
+        expect(
+          result,
+          `render-discovered warm and cold results enter transport`,
+        ).toBeDefined()
+        const snapshot = result?.snapshot ?? (await result?.promise)
+        expect(snapshot?.rows.map((row) => row.value)).toEqual([
+          expect.objectContaining({ name: `server 1` }),
+        ])
+      } finally {
+        vi.stubGlobal(`window`, originalWindow)
+        await client.cleanup()
+      }
+    })
+  }
+})
+
+/** Prepared Suspense results must render on either React server host. Streaming
+ * is explicit demand; opaque logic still requires a portable identity even
+ * when warm. This bounded grammar crosses source/query preparation, empty/nonempty
+ * results, streaming on/off, and keyed/unkeyed opaque discovery. The observation
+ * is final server markup and server errors, before any browser can repair it.
+ */
+describe(`SSR Suspense receiving matrix`, () => {
+  for (const streaming of [false, true]) {
+    for (const preparation of [`source`, `query`] as const) {
+      for (const count of [0, 2]) {
+        it(`renders prepared ${preparation} count=${count} streaming=${streaming}`, async () => {
+          const descriptor = collectionOptions(`suspense-prepared`, () => ({
+            id: `suspense-prepared`,
+            getKey: (row: { id: string; name: string }) => row.id,
+            sync: {
+              sync: ({ begin, write, commit, markReady }) => {
+                begin()
+                for (let i = 0; i < count; i++)
+                  write({
+                    type: `insert`,
+                    value: { id: String(i), name: `server ${i}` },
+                  })
+                commit()
+                markReady()
+              },
+            },
+          }))
+          const client = new DbClient()
+          client._setSsrStreamingEnabled(streaming)
+          const query = new Query()
+            .from({ person: descriptor })
+            .select(({ person }) => ({ name: person.name }))
+          function Consumer() {
+            const { data } = useLiveSuspenseQuery({ query })
+            return (
+              <output>
+                {data.map((row) => row.name).join(`,`) || `empty ready`}
+              </output>
+            )
+          }
+          const app = (
+            <DbProvider client={client}>
+              <Suspense fallback={<span>loading</span>}>
+                <Consumer />
+              </Suspense>
+            </DbProvider>
+          )
+          const browserWindow = globalThis.window
+          try {
+            if (preparation === `source`)
+              await client.collection(descriptor).preload()
+            else await client.preloadLiveQuery({ query })
+            vi.stubGlobal(`window`, undefined)
+            let html: string
+            const errors: Array<unknown> = []
+            if (!streaming) html = renderToString(app)
+            else
+              html = await new Promise<string>((resolve, reject) => {
+                let result = ``
+                const sink = new Writable({
+                  write(chunk, _encoding, done) {
+                    result += chunk.toString()
+                    done()
+                  },
+                })
+                sink.on(`finish`, () => resolve(result))
+                sink.on(`error`, reject)
+                const stream = renderToPipeableStream(app, {
+                  onAllReady() {
+                    stream.pipe(sink)
+                  },
+                  onError(error) {
+                    errors.push(error)
+                  },
+                })
+              })
+            expect(errors).toEqual([])
+            expect(
+              html,
+              `prepared results finish rather than suspend forever`,
+            ).toContain(
+              `<output>${count ? `server 0,server 1` : `empty ready`}</output>`,
+            )
+          } finally {
+            vi.stubGlobal(`window`, browserWindow)
+            await client.cleanup()
+          }
+        })
+      }
+    }
+  }
+  for (const warm of [false, true])
+    for (const keyed of [false, true]) {
+      it(`checks opaque streaming identity warm=${warm} keyed=${keyed}`, async () => {
+        const descriptor = collectionOptions(`opaque-ssr`, () => ({
+          id: `opaque-ssr`,
+          getKey: (row: { id: string }) => row.id,
+          sync: {
+            sync: ({ begin, write, commit, markReady }) => {
+              begin()
+              write({ type: `insert`, value: { id: `server` } })
+              commit()
+              markReady()
+            },
+          },
+        }))
+        const client = new DbClient()
+        client._setSsrStreamingEnabled(true)
+        const query = new Query()
+          .from({ row: descriptor })
+          .fn.where(({ row }) => row.id.length > 0)
+        function Consumer() {
+          const { data } = useLiveSuspenseQuery({
+            query,
+            ...(keyed ? { queryKey: [`opaque`] } : {}),
+          })
+          return <output>{data.map((row) => row.id).join(`,`)}</output>
+        }
+        const browserWindow = globalThis.window
+        try {
+          if (warm)
+            await client.preloadLiveQuery({
+              query: new Query()
+                .from({ row: descriptor })
+                .select(({ row }) => ({ id: row.id })),
+            })
+          vi.stubGlobal(`window`, undefined)
+          const errors: Array<unknown> = []
+          const html = await new Promise<string>((resolve, reject) => {
+            let result = ``
+            const sink = new Writable({
+              write(chunk, _encoding, done) {
+                result += chunk.toString()
+                done()
+              },
+            })
+            sink.on(`finish`, () => resolve(result))
+            sink.on(`error`, reject)
+            const stream = renderToPipeableStream(
+              <DbProvider client={client}>
+                <Suspense fallback={<span>loading</span>}>
+                  <Consumer />
+                </Suspense>
+              </DbProvider>,
+              {
+                onAllReady() {
+                  stream.pipe(sink)
+                },
+                onError(error) {
+                  errors.push(error)
+                },
+              },
+            )
+          })
+          if (keyed) {
+            expect(errors).toEqual([])
+            expect(html).toContain(`<output>server</output>`)
+            expect(
+              client
+                .dehydrate()
+                .liveQueries?.some(
+                  (q) =>
+                    q.queryHash === getLiveQueryHash({ query }, [`opaque`]),
+                ),
+            ).toBe(true)
+          } else {
+            expect(
+              errors,
+              `warm rows do not waive transport identity`,
+            ).toHaveLength(1)
+            // The shared conformance identity law rejects an unkeyed opaque
+            // React query during preparation, before SSR stream admission.
+            // Warming the source does not change that programming error.
+            expect(errors[0]).toBeInstanceOf(UnhashableQueryIRError)
+          }
+        } finally {
+          vi.stubGlobal(`window`, browserWindow)
+          await client.cleanup()
+        }
+      })
+    }
+})
+
+/** Result identity includes the caller's current input and its initial window.
+ * The reference is authored rows sliced by page size, never transport records.
+ * Browser replacement crosses builder -> callback Collection, with a distinct
+ * explicit key or derived identity. Server preload checks both matching and
+ * unbounded windows under one key; their portable result identities must differ.
+ */
+function useRuntimeWindow(
+  input: unknown,
+  config: { pageSize: number; queryKey?: Array<string> },
+) {
+  // Exercise the callback-returned Collection runtime path without extending
+  // TypeScript's current QueryBuilder-only callback overload.
+  return Reflect.apply(useLiveInfiniteQuery, undefined, [input, config]) as {
+    data: Array<{ id: string; name: string }>
+  }
+}
+describe(`infinite hydration identity`, () => {
+  for (const keyed of [false, true])
+    it(`switches to callback Collection keyed=${keyed}`, async () => {
+      const source = createCollection(
+        mockSyncCollectionOptions<{ id: string; name: string }>({
+          id: `infinite-identity-source`,
+          getKey: (row) => row.id,
+          initialData: [
+            { id: `a`, name: `old` },
+            { id: `b`, name: `new` },
+          ],
+        }),
+      )
+      const client = new DbClient()
+      const oldQuery = new Query()
+        .from({ row: source })
+        .where(({ row }) => eq(row.id, `a`))
+        .orderBy(({ row }) => row.id)
+      const supplied = createLiveQueryCollection({
+        query: new Query()
+          .from({ row: source })
+          .where(({ row }) => eq(row.id, `b`))
+          .orderBy(({ row }) => row.id)
+          .limit(2),
+      })
+      let unmount: (() => void) | undefined
+      try {
+        await client.preloadLiveQuery({
+          query: oldQuery.limit(2),
+          ...(keyed ? { queryKey: [`old`] } : {}),
+        })
+        await supplied.preload()
+        const wrapper = ({ children }: { children: ReactNode }) => (
+          <DbProvider client={client}>{children}</DbProvider>
+        )
+        const hook = renderHook(
+          ({ replacement }: { replacement: boolean }) =>
+            useRuntimeWindow(() => (replacement ? supplied : oldQuery), {
+              pageSize: 1,
+              ...(keyed ? { queryKey: [replacement ? `new` : `old`] } : {}),
+            }),
+          { wrapper, initialProps: { replacement: false } },
+        )
+        unmount = hook.unmount
+        expect(hook.result.current.data.map((row) => row.name)).toEqual([`old`])
+        hook.rerender({ replacement: true })
+        expect(
+          hook.result.current.data.map((row) => row.name),
+          `replacement owns its hydration identity`,
+        ).toEqual([`new`])
+      } finally {
+        unmount?.()
+        await client.cleanup()
+        await supplied.cleanup()
+        await source.cleanup()
+      }
+    })
+  for (const matching of [false, true])
+    it(`keeps keyed initial window distinct matching=${matching}`, async () => {
+      const descriptor = collectionOptions(`window-identity`, () => ({
+        id: `window-identity`,
+        getKey: (row: { id: string }) => row.id,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            begin()
+            for (const id of [`a`, `b`, `c`, `d`])
+              write({ type: `insert`, value: { id } })
+            commit()
+            markReady()
+          },
+        },
+      }))
+      const query = new Query()
+        .from({ row: descriptor })
+        .orderBy(({ row }) => row.id)
+      const client = new DbClient()
+      try {
+        const unbounded = getLiveQueryHash({ query }, [`window`])
+        const windowed = getLiveQueryHash({ query: query.limit(2).offset(0) }, [
+          `window`,
+        ])
+        await client.preloadLiveQuery({
+          query: matching ? query.limit(2).offset(0) : query,
+          queryKey: [`window`],
+        })
+        function Consumer() {
+          const result = useLiveInfiniteQuery(() => query, {
+            pageSize: 1,
+            queryKey: [`window`],
+          })
+          return <output>{result.data.map((row) => row.id).join(`,`)}</output>
+        }
+        const renderWindow = () =>
+          renderSsr(
+            <DbProvider client={client}>
+              <Consumer />
+            </DbProvider>,
+          )
+        if (matching) expect(renderWindow()).toContain(`<output>a</output>`)
+        else expect(renderWindow).toThrow(/SSR.*preload/)
+        expect(
+          unbounded,
+          `unbounded and windowed results cannot alias`,
+        ).not.toBe(windowed)
+        if (matching)
+          expect(
+            client
+              .dehydrate()
+              .liveQueries?.find((q) => q.queryHash === windowed)?.snapshot
+              ?.rows,
+          ).toHaveLength(2)
+      } finally {
+        await client.cleanup()
+      }
+    })
+})
+
+// Explicit keys identify the same window across builder preload and supplied
+// Collection input, including a callback that returns that Collection.
+for (const callback of [false, true])
+  it(`hydrates a supplied window with callback=${callback}`, async () => {
+    const source = createCollection(
+      mockSyncCollectionOptions<{ id: string }>({
+        id: `supplied-window-key`,
+        getKey: (row) => row.id,
+        autoIndex: `eager`,
+        defaultIndexType: BTreeIndex,
+        initialData: [{ id: `a` }, { id: `b` }, { id: `c` }],
+      }),
+    )
+    const query = new Query()
+      .from({ row: source })
+      .orderBy(({ row }) => row.id)
+      .limit(2)
+      .offset(0)
+    const supplied = createLiveQueryCollection({ query })
+    const client = new DbClient()
+    function Consumer() {
+      const result = useRuntimeWindow(callback ? () => supplied : supplied, {
+        pageSize: 1,
+        queryKey: [`supplied`],
+      })
+      return <output>{result.data.map((row) => row.id).join(`,`)}</output>
+    }
+    try {
+      await client.preloadLiveQuery({ query, queryKey: [`supplied`] })
+      expect(
+        renderSsr(
+          <DbProvider client={client}>
+            <Consumer />
+          </DbProvider>,
+        ),
+      ).toContain(`<output>a</output>`)
+    } finally {
+      await client.cleanup()
+      await supplied.cleanup()
+      await source.cleanup()
+    }
+  })
diff --git a/packages/react-db/tests/infinite-query-conformance.test.tsx b/packages/react-db/tests/infinite-query-conformance.test.tsx
index a25aad8038..4dddb7b44e 100644
--- a/packages/react-db/tests/infinite-query-conformance.test.tsx
+++ b/packages/react-db/tests/infinite-query-conformance.test.tsx
@@ -19,6 +19,7 @@ import {
 } from '@tanstack/db'
 import { mockSyncCollectionOptions } from '../../db/tests/utils'
 import { runInfiniteQuerySuite } from '../../db/tests/conformance/infinite-suite-oracle'
+import { registerInfiniteQueryUnitScenarios } from '../../db/tests/conformance/infinite-suite-cases'
 import { makeInfiniteOnDemandSource } from '../../db/tests/conformance/infinite-on-demand'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
 import { rejectReadsAfterRenderError } from './rejected-binding'
@@ -329,14 +330,17 @@ const reactInfiniteDriver: InfiniteQueryDriver = {
   knownGaps: [],
 }
 
-runInfiniteQuerySuite(reactInfiniteDriver)
-runInfiniteQuerySuite({
-  ...reactInfiniteDriver,
-  name: `react (dependency list)`,
-  mount: mountWithDependencyList,
-  mountControllable: mountControllableWith(`dependency list`),
-  mountKeyedControllable: mountKeyedControllableWith(`dependency list`),
-})
+runInfiniteQuerySuite(reactInfiniteDriver, registerInfiniteQueryUnitScenarios)
+runInfiniteQuerySuite(
+  {
+    ...reactInfiniteDriver,
+    name: `react (dependency list)`,
+    mount: mountWithDependencyList,
+    mountControllable: mountControllableWith(`dependency list`),
+    mountKeyedControllable: mountKeyedControllableWith(`dependency list`),
+  },
+  registerInfiniteQueryUnitScenarios,
+)
 
 it(`publishes query-function pages on the first layout commit after mount and dependency replacement`, async () => {
   const source = makeSource(
diff --git a/packages/react-db/tests/infinite-query-render-cuts-oracle.test.tsx b/packages/react-db/tests/infinite-query-render-cuts-oracle.test.tsx
index c76bf792f7..78fdce59a8 100644
--- a/packages/react-db/tests/infinite-query-render-cuts-oracle.test.tsx
+++ b/packages/react-db/tests/infinite-query-render-cuts-oracle.test.tsx
@@ -30,71 +30,35 @@
  * Expectations come from the source rows, page size, request counts, and
  * useLiveQuery under the same history, never from the hook's controller state.
  */
-import { Component, StrictMode, Suspense, useLayoutEffect } from 'react'
+import { StrictMode, Suspense, useLayoutEffect } from 'react'
 import { act, render, renderHook, waitFor } from '@testing-library/react'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import {
   BTreeIndex,
   createCollection,
   createLiveQueryCollection,
-  gt,
 } from '@tanstack/db'
 import { makeInfiniteOnDemandSource } from '../../db/tests/conformance/infinite-on-demand'
-import { mockSyncCollectionOptions } from '../../db/tests/utils'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
 import { useLiveQuery } from '../src/useLiveQuery'
+import {
+  PAGE_SIZE,
+  cleanups,
+  makeSyncSource,
+  nextSequence,
+  rows,
+} from './infinite-query-render-cuts-support'
+import type { Row } from './infinite-query-render-cuts-support'
 import type { ReactNode } from 'react'
 
-type Row = { id: string; label: string; rank: number }
-
-class ErrorBoundary extends Component<
-  { children: ReactNode },
-  { error?: Error }
-> {
-  state: { error?: Error } = {}
-  static getDerivedStateFromError(error: Error) {
-    return { error }
-  }
-  render() {
-    return this.state.error ? (
-      <div>Rejected: {this.state.error.message}</div>
-    ) : (
-      this.props.children
-    )
-  }
-}
-
-let sequence = 0
-const cleanups: Array<() => Promise<void> | void> = []
 afterEach(async () => {
   // Unmount hooks before cleaning up the sources they read.
   for (const cleanup of cleanups.splice(0).reverse()) await cleanup()
 })
 
-function rows(count: number): Array<Row> {
-  return Array.from({ length: count }, (_, index) => ({
-    id: String(index + 1),
-    label: `row-${index + 1}`,
-    rank: count - index,
-  }))
-}
-
-function makeSyncSource(count: number) {
-  const source = createCollection(
-    mockSyncCollectionOptions<Row>({
-      id: `infinite-render-cuts-${sequence++}`,
-      getKey: (row) => row.id,
-      autoIndex: `eager`,
-      initialData: rows(count),
-    }),
-  )
-  cleanups.push(() => source.cleanup())
-  return source
-}
-
 type HookName = `live` | `infinite`
 type InputForm = `query` | `supplied`
-const PAGE_SIZE = 2
 
 // Counts source acquisitions. The load never settles, so only the request
 // itself is observed. A wrapped source sits behind a live-query Collection,
@@ -102,7 +66,7 @@ const PAGE_SIZE = 2
 function makeCountingOnDemandSource(wrapped: boolean) {
   let loads = 0
   const source = createCollection<Row>({
-    id: `infinite-render-cuts-remote-${sequence++}`,
+    id: `infinite-render-cuts-remote-${nextSequence()}`,
     getKey: (row) => row.id,
     syncMode: `on-demand`,
     autoIndex: `eager`,
@@ -206,6 +170,21 @@ async function firstWindowLoadsForStrictMount(hook: HookName) {
   }
 }
 
+// The law: a render that never commits starts no acquisition, and the infinite
+// hook starts the same acquisitions as useLiveQuery under the same history.
+async function checkAbandonedRenderAcquisitions(
+  form: InputForm,
+  wrapped: boolean,
+): Promise<void> {
+  const reference = await acquisitionsForAbandonedRender(`live`, form, wrapped)
+  expect(reference).toBe(0)
+  expect(await acquisitionsForAbandonedRender(`infinite`, form, wrapped)).toBe(
+    reference,
+  )
+}
+
+declareOracle({ check: [checkAbandonedRenderAcquisitions] })
+
 describe(`on-demand sources match useLiveQuery`, () => {
   it.each([
     { form: `query` as const, wrapped: false },
@@ -214,15 +193,7 @@ describe(`on-demand sources match useLiveQuery`, () => {
   ])(
     `starts no acquisition attempt for a render that never commits, as useLiveQuery does (%o)`,
     async ({ form, wrapped }) => {
-      const reference = await acquisitionsForAbandonedRender(
-        `live`,
-        form,
-        wrapped,
-      )
-      expect(reference).toBe(0)
-      expect(
-        await acquisitionsForAbandonedRender(`infinite`, form, wrapped),
-      ).toBe(reference)
+      await checkAbandonedRenderAcquisitions(form, wrapped)
     },
   )
 
@@ -235,201 +206,18 @@ describe(`on-demand sources match useLiveQuery`, () => {
     expect(reference.loads).toBe(1)
     expect(await firstWindowLoadsForStrictMount(`infinite`)).toEqual(reference)
   })
-
-  it.each([`live`, `infinite`] as const)(
-    `delivers a mounted replacement's startup error to the error boundary (%s)`,
-    async (hook) => {
-      const source = makeSyncSource(4)
-      const failure = new Error(`replacement failed to start`)
-      const commits: Array<{ fail: boolean; status: string }> = []
-      const consoleError = vi
-        .spyOn(console, `error`)
-        .mockImplementation(() => {})
-      function View({ fail }: { fail: boolean }): ReactNode {
-        const query = (q: any) =>
-          q
-            .from({ items: source })
-            .fn.where(() => {
-              if (fail) throw failure
-              return true
-            })
-            .orderBy(({ items }: any) => items.rank, `desc`)
-        const result: any =
-          hook === `live`
-            ? useLiveQuery({
-                queryKey: [`startup-error`, fail],
-                query: (q: any) => query(q).limit(PAGE_SIZE + 1),
-              })
-            : useLiveInfiniteQuery(query, {
-                pageSize: PAGE_SIZE,
-                queryKey: [`startup-error`, fail],
-              })
-        useLayoutEffect(() => {
-          commits.push({ fail, status: result.status })
-        })
-        return null
-      }
-      try {
-        const view = render(
-          <ErrorBoundary>
-            <View fail={false} />
-          </ErrorBoundary>,
-        )
-        cleanups.push(() => view.unmount())
-        await waitFor(() =>
-          expect(commits.at(-1)).toEqual({ fail: false, status: `ready` }),
-        )
-        await act(async () => {
-          view.rerender(
-            <ErrorBoundary>
-              <View fail={true} />
-            </ErrorBoundary>,
-          )
-        })
-        // The error reaches the boundary; the replacement never commits.
-        expect(
-          view.getByText(`Rejected: replacement failed to start`),
-        ).toBeDefined()
-        expect(commits.filter((commit) => commit.fail)).toEqual([])
-      } finally {
-        consoleError.mockRestore()
-      }
-    },
-  )
 })
 
-describe(`retries after GC`, () => {
-  beforeEach(() => vi.useFakeTimers())
-  afterEach(() => vi.useRealTimers())
-
-  it(`shows the ready first page when a Suspense retry follows a GC-collected abandoned render`, async () => {
-    const source = makeSyncSource(10)
-    let suspend = true
-    let release!: () => void
-    const gate = new Promise<void>((resolve) => {
-      release = resolve
-    })
-    const commits: Array<{ status: string; ids: Array<string> }> = []
-    let abandonedCollection: { status: string } | undefined
-    let retryCollection: { status: string } | undefined
-
-    function Query(): ReactNode {
-      const result = useLiveInfiniteQuery(
-        (q) =>
-          q.from({ items: source }).orderBy(({ items }) => items.rank, `desc`),
-        { pageSize: 3 },
-      )
-      if (suspend) {
-        abandonedCollection = result.collection as unknown as {
-          status: string
-        }
-        throw gate
-      }
-      retryCollection = result.collection as unknown as { status: string }
-      useLayoutEffect(() => {
-        commits.push({
-          status: result.status,
-          ids: result.data.map((row) => row.id),
-        })
-      })
-      return null
-    }
-
-    const view = render(
-      <Suspense fallback={null}>
-        <Query />
-      </Suspense>,
-    )
-    cleanups.push(() => view.unmount())
-    // Let the 50 ms unsubscribed GC floor reclaim the abandoned collection.
-    await act(async () => {
-      await vi.advanceTimersByTimeAsync(100)
-    })
-
-    suspend = false
-    await act(async () => {
-      release()
-      await vi.advanceTimersByTimeAsync(0)
-    })
-
-    expect(abandonedCollection?.status).toBe(`cleaned-up`)
-    expect(retryCollection).not.toBe(abandonedCollection)
-    expect(commits[0]).toEqual({ status: `ready`, ids: [`1`, `2`, `3`] })
-  })
-
-  it(`shows the ready first page when a mounted query's suspended update retries after GC`, async () => {
-    // A committed component keeps its hook refs across a suspended update. A
-    // retry that bound the update's collection after GC cleaned it up would
-    // commit an empty cleaned-up page before recovering.
-    const source = makeSyncSource(10)
-    let suspend = false
-    let release!: () => void
-    const gate = new Promise<void>((resolve) => {
-      release = resolve
-    })
-    const commits: Array<{
-      minimum: number
-      status: string
-      ranks: Array<number>
-    }> = []
-
-    function Query({ minimum }: { minimum: number }): ReactNode {
-      const result = useLiveInfiniteQuery(
-        (q) =>
-          q
-            .from({ items: source })
-            .where(({ items }) => gt(items.rank, minimum))
-            .orderBy(({ items }) => items.rank, `desc`),
-        { pageSize: 3 },
-        [minimum],
-      )
-      useLayoutEffect(() => {
-        commits.push({
-          minimum,
-          status: result.status,
-          ranks: result.data.map((row) => row.rank),
-        })
-      })
-      if (suspend) throw gate
-      return null
-    }
-
-    const view = render(
-      <Suspense fallback={null}>
-        <Query minimum={0} />
-      </Suspense>,
-    )
-    cleanups.push(() => view.unmount())
-    await act(async () => {
-      await vi.advanceTimersByTimeAsync(0)
-    })
-
-    suspend = true
-    await act(async () => {
-      view.rerender(
-        <Suspense fallback={null}>
-          <Query minimum={5} />
-        </Suspense>,
-      )
-      await vi.advanceTimersByTimeAsync(0)
-    })
-    await act(async () => {
-      await vi.advanceTimersByTimeAsync(200)
-    })
-
-    suspend = false
-    await act(async () => {
-      release()
-      await vi.advanceTimersByTimeAsync(0)
-    })
+// The law: with a synchronous source, the first commit is ready and shows every
+// row in source order. This model gives that commit for `count` rows.
+function expectedReadyFirstCommit(count: number): {
+  status: string
+  ids: Array<string>
+} {
+  return { status: `ready`, ids: rows(count).map((row) => row.id) }
+}
 
-    expect(commits.find((commit) => commit.minimum === 5)).toEqual({
-      minimum: 5,
-      status: `ready`,
-      ranks: [10, 9, 8],
-    })
-  })
-})
+declareOracle({ model: [expectedReadyFirstCommit] })
 
 describe(`agreement with useLiveQuery`, () => {
   it(`commits the same ready rows first as useLiveQuery for a synchronous source`, async () => {
@@ -465,111 +253,8 @@ describe(`agreement with useLiveQuery`, () => {
     )
     await waitFor(() => expect(infinite.length).toBeGreaterThan(0))
 
-    const expected = { status: `ready`, ids: rows(10).map((row) => row.id) }
+    const expected = expectedReadyFirstCommit(10)
     expect(live[0]).toEqual(expected)
     expect(infinite[0]).toEqual(expected)
   })
 })
-
-describe(`collections kept from an abandoned render`, () => {
-  // An eager source that writes `current` as a snapshot each time its sync
-  // run starts, so a reload serves new rows from the same source object.
-  function makeRestartableSource(initial: Array<Row>) {
-    let current = initial
-    const source = createCollection<Row>({
-      id: `infinite-render-cuts-restartable-${sequence++}`,
-      getKey: (row) => row.id,
-      autoIndex: `eager`,
-      defaultIndexType: BTreeIndex,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          // The run's rows are the full state: its snapshot replaces the
-          // rows a reload keeps.
-          begin({ snapshot: true })
-          for (const row of current) write({ type: `insert`, value: row })
-          commit()
-          markReady()
-        },
-      },
-    })
-    cleanups.push(() => source.cleanup())
-    return {
-      source,
-      // A reload starts a new sync run under mounted queries; its snapshot
-      // replaces the rows.
-      restartWith: async (next: Array<Row>) => {
-        current = next
-        await source.reload()
-      },
-    }
-  }
-  const byId = (ids: Array<number>): Array<Row> =>
-    ids.map((id) => ({ id: String(id), label: `row-${id}`, rank: id }))
-
-  it.each([`live`, `infinite`] as const)(
-    `shows the restarted source's rows when an abandoned render's query is selected again (%s)`,
-    async (hook) => {
-      // Model: after the restart the source holds ids 4-8, so the query for
-      // ranks above 2, ascending, shows ids 4 and 5 on its first page.
-      const { source, restartWith } = makeRestartableSource(
-        byId([1, 2, 3, 4, 5]),
-      )
-      const never = new Promise<void>(() => {})
-      const commits: Array<{
-        minimum: number
-        status: string
-        ids: Array<string>
-      }> = []
-      function Query({
-        minimum,
-        suspend,
-      }: {
-        minimum: number
-        suspend: boolean
-      }): ReactNode {
-        const query = (q: any) =>
-          q
-            .from({ items: source })
-            .where(({ items }: any) => gt(items.rank, minimum))
-            .orderBy(({ items }: any) => items.rank, `asc`)
-        const result: any =
-          hook === `live`
-            ? useLiveQuery((q: any) => query(q).limit(PAGE_SIZE + 1))
-            : useLiveInfiniteQuery(query, { pageSize: PAGE_SIZE })
-        useLayoutEffect(() => {
-          commits.push({
-            minimum,
-            status: result.status,
-            ids: result.data.slice(0, PAGE_SIZE).map((row: Row) => row.id),
-          })
-        })
-        if (suspend) throw never
-        return null
-      }
-      const tree = (minimum: number, suspend: boolean) => (
-        <Suspense fallback={null}>
-          <Query minimum={minimum} suspend={suspend} />
-        </Suspense>
-      )
-      const view = render(tree(0, false))
-      cleanups.push(() => view.unmount())
-      await act(async () => {})
-      // Render B and abandon it, then commit A again.
-      act(() => view.rerender(tree(2, true)))
-      act(() => view.rerender(tree(0, false)))
-      await act(async () => restartWith(byId([4, 5, 6, 7, 8])))
-      commits.length = 0
-      act(() => view.rerender(tree(2, false)))
-      await act(async () => {
-        await new Promise((resolve) => setTimeout(resolve, 0))
-      })
-
-      expect(commits.filter((commit) => commit.minimum === 2).at(-1)).toEqual({
-        minimum: 2,
-        status: `ready`,
-        ids: [`4`, `5`],
-      })
-    },
-  )
-})
diff --git a/packages/react-db/tests/infinite-query-render-cuts-support.tsx b/packages/react-db/tests/infinite-query-render-cuts-support.tsx
new file mode 100644
index 0000000000..7388301247
--- /dev/null
+++ b/packages/react-db/tests/infinite-query-render-cuts-support.tsx
@@ -0,0 +1,55 @@
+import { Component } from 'react'
+import { createCollection } from '@tanstack/db'
+import { mockSyncCollectionOptions } from '../../db/tests/utils'
+import type { ReactNode } from 'react'
+
+// Shared fixtures for the infinite query render-cut tests. The laws are owned by
+// infinite-query-render-cuts-oracle.test.tsx, and the ordinary pinned tests live in
+// infinite-query-render-cuts.test.tsx.
+export type Row = { id: string; label: string; rank: number }
+
+export const cleanups: Array<() => Promise<void> | void> = []
+let sequence = 0
+export function nextSequence(): number {
+  return sequence++
+}
+
+export const PAGE_SIZE = 2
+
+export class ErrorBoundary extends Component<
+  { children: ReactNode },
+  { error?: Error }
+> {
+  state: { error?: Error } = {}
+  static getDerivedStateFromError(error: Error) {
+    return { error }
+  }
+  render() {
+    return this.state.error ? (
+      <div>Rejected: {this.state.error.message}</div>
+    ) : (
+      this.props.children
+    )
+  }
+}
+
+export function rows(count: number): Array<Row> {
+  return Array.from({ length: count }, (_, index) => ({
+    id: String(index + 1),
+    label: `row-${index + 1}`,
+    rank: count - index,
+  }))
+}
+
+export function makeSyncSource(count: number) {
+  const source = createCollection(
+    mockSyncCollectionOptions<Row>({
+      id: `infinite-render-cuts-${nextSequence()}`,
+      getKey: (row) => row.id,
+      autoIndex: `eager`,
+      initialData: rows(count),
+    }),
+  )
+  cleanups.push(() => source.cleanup())
+  return source
+}
diff --git a/packages/react-db/tests/infinite-query-render-cuts.test.tsx b/packages/react-db/tests/infinite-query-render-cuts.test.tsx
new file mode 100644
index 0000000000..0085109f73
--- /dev/null
+++ b/packages/react-db/tests/infinite-query-render-cuts.test.tsx
@@ -0,0 +1,323 @@
+// Ordinary React tests for render cuts: a mounted replacement's startup error and
+// a collection reclaimed by GC before a Suspense retry, and a kept collection whose
+// source restarted. The render-cut laws are owned
+// by infinite-query-render-cuts-oracle.test.tsx.
+import { Suspense, useLayoutEffect } from 'react'
+import { act, render, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { BTreeIndex, createCollection, gt } from '@tanstack/db'
+import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
+import { useLiveQuery } from '../src/useLiveQuery'
+import {
+  ErrorBoundary,
+  PAGE_SIZE,
+  cleanups,
+  makeSyncSource,
+  nextSequence,
+} from './infinite-query-render-cuts-support'
+import type { Row } from './infinite-query-render-cuts-support'
+import type { ReactNode } from 'react'
+
+afterEach(async () => {
+  // Unmount hooks before cleaning up the sources they read.
+  for (const cleanup of cleanups.splice(0).reverse()) await cleanup()
+})
+
+describe(`on-demand sources match useLiveQuery`, () => {
+  it.each([`live`, `infinite`] as const)(
+    `delivers a mounted replacement's startup error to the error boundary (%s)`,
+    async (hook) => {
+      const source = makeSyncSource(4)
+      const failure = new Error(`replacement failed to start`)
+      const commits: Array<{ fail: boolean; status: string }> = []
+      const consoleError = vi
+        .spyOn(console, `error`)
+        .mockImplementation(() => {})
+      function View({ fail }: { fail: boolean }): ReactNode {
+        const query = (q: any) =>
+          q
+            .from({ items: source })
+            .fn.where(() => {
+              if (fail) throw failure
+              return true
+            })
+            .orderBy(({ items }: any) => items.rank, `desc`)
+        const result: any =
+          hook === `live`
+            ? useLiveQuery({
+                queryKey: [`startup-error`, fail],
+                query: (q: any) => query(q).limit(PAGE_SIZE + 1),
+              })
+            : useLiveInfiniteQuery(query, {
+                pageSize: PAGE_SIZE,
+                queryKey: [`startup-error`, fail],
+              })
+        useLayoutEffect(() => {
+          commits.push({ fail, status: result.status })
+        })
+        return null
+      }
+      try {
+        const view = render(
+          <ErrorBoundary>
+            <View fail={false} />
+          </ErrorBoundary>,
+        )
+        cleanups.push(() => view.unmount())
+        await waitFor(() =>
+          expect(commits.at(-1)).toEqual({ fail: false, status: `ready` }),
+        )
+        await act(async () => {
+          view.rerender(
+            <ErrorBoundary>
+              <View fail={true} />
+            </ErrorBoundary>,
+          )
+        })
+        // The error reaches the boundary; the replacement never commits.
+        expect(
+          view.getByText(`Rejected: replacement failed to start`),
+        ).toBeDefined()
+        expect(commits.filter((commit) => commit.fail)).toEqual([])
+      } finally {
+        consoleError.mockRestore()
+      }
+    },
+  )
+})
+
+describe(`retries after GC`, () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => vi.useRealTimers())
+
+  it(`shows the ready first page when a Suspense retry follows a GC-collected abandoned render`, async () => {
+    const source = makeSyncSource(10)
+    let suspend = true
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const commits: Array<{ status: string; ids: Array<string> }> = []
+    let abandonedCollection: { status: string } | undefined
+    let retryCollection: { status: string } | undefined
+
+    function Query(): ReactNode {
+      const result = useLiveInfiniteQuery(
+        (q) =>
+          q.from({ items: source }).orderBy(({ items }) => items.rank, `desc`),
+        { pageSize: 3 },
+      )
+      if (suspend) {
+        abandonedCollection = result.collection as unknown as {
+          status: string
+        }
+        throw gate
+      }
+      retryCollection = result.collection as unknown as { status: string }
+      useLayoutEffect(() => {
+        commits.push({
+          status: result.status,
+          ids: result.data.map((row) => row.id),
+        })
+      })
+      return null
+    }
+
+    const view = render(
+      <Suspense fallback={null}>
+        <Query />
+      </Suspense>,
+    )
+    cleanups.push(() => view.unmount())
+    // Let the 50 ms unsubscribed GC floor reclaim the abandoned collection.
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(100)
+    })
+
+    suspend = false
+    await act(async () => {
+      release()
+      await vi.advanceTimersByTimeAsync(0)
+    })
+
+    expect(abandonedCollection?.status).toBe(`cleaned-up`)
+    expect(retryCollection).not.toBe(abandonedCollection)
+    expect(commits[0]).toEqual({ status: `ready`, ids: [`1`, `2`, `3`] })
+  })
+
+  it(`shows the ready first page when a mounted query's suspended update retries after GC`, async () => {
+    // A committed component keeps its hook refs across a suspended update. A
+    // retry that bound the update's collection after GC cleaned it up would
+    // commit an empty cleaned-up page before recovering.
+    const source = makeSyncSource(10)
+    let suspend = false
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const commits: Array<{
+      minimum: number
+      status: string
+      ranks: Array<number>
+    }> = []
+
+    function Query({ minimum }: { minimum: number }): ReactNode {
+      const result = useLiveInfiniteQuery(
+        (q) =>
+          q
+            .from({ items: source })
+            .where(({ items }) => gt(items.rank, minimum))
+            .orderBy(({ items }) => items.rank, `desc`),
+        { pageSize: 3 },
+        [minimum],
+      )
+      useLayoutEffect(() => {
+        commits.push({
+          minimum,
+          status: result.status,
+          ranks: result.data.map((row) => row.rank),
+        })
+      })
+      if (suspend) throw gate
+      return null
+    }
+
+    const view = render(
+      <Suspense fallback={null}>
+        <Query minimum={0} />
+      </Suspense>,
+    )
+    cleanups.push(() => view.unmount())
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(0)
+    })
+
+    suspend = true
+    await act(async () => {
+      view.rerender(
+        <Suspense fallback={null}>
+          <Query minimum={5} />
+        </Suspense>,
+      )
+      await vi.advanceTimersByTimeAsync(0)
+    })
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(200)
+    })
+
+    suspend = false
+    await act(async () => {
+      release()
+      await vi.advanceTimersByTimeAsync(0)
+    })
+
+    expect(commits.find((commit) => commit.minimum === 5)).toEqual({
+      minimum: 5,
+      status: `ready`,
+      ranks: [10, 9, 8],
+    })
+  })
+})
+
+describe(`collections kept from an abandoned render`, () => {
+  // An eager source that writes `current` as a snapshot each time its sync
+  // run starts, so a reload serves new rows from the same source object.
+  function makeRestartableSource(initial: Array<Row>) {
+    let current = initial
+    const source = createCollection<Row>({
+      id: `infinite-render-cuts-restartable-${nextSequence()}`,
+      getKey: (row) => row.id,
+      autoIndex: `eager`,
+      defaultIndexType: BTreeIndex,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          // The run's rows are the full state: its snapshot replaces the
+          // rows a reload keeps.
+          begin({ snapshot: true })
+          for (const row of current) write({ type: `insert`, value: row })
+          commit()
+          markReady()
+        },
+      },
+    })
+    cleanups.push(() => source.cleanup())
+    return {
+      source,
+      // A reload starts a new sync run under mounted queries; its snapshot
+      // replaces the rows.
+      restartWith: async (next: Array<Row>) => {
+        current = next
+        await source.reload()
+      },
+    }
+  }
+  const byId = (ids: Array<number>): Array<Row> =>
+    ids.map((id) => ({ id: String(id), label: `row-${id}`, rank: id }))
+
+  it.each([`live`, `infinite`] as const)(
+    `shows the restarted source's rows when an abandoned render's query is selected again (%s)`,
+    async (hook) => {
+      // Model: after the restart the source holds ids 4-8, so the query for
+      // ranks above 2, ascending, shows ids 4 and 5 on its first page.
+      const { source, restartWith } = makeRestartableSource(
+        byId([1, 2, 3, 4, 5]),
+      )
+      const never = new Promise<void>(() => {})
+      const commits: Array<{
+        minimum: number
+        status: string
+        ids: Array<string>
+      }> = []
+      function Query({
+        minimum,
+        suspend,
+      }: {
+        minimum: number
+        suspend: boolean
+      }): ReactNode {
+        const query = (q: any) =>
+          q
+            .from({ items: source })
+            .where(({ items }: any) => gt(items.rank, minimum))
+            .orderBy(({ items }: any) => items.rank, `asc`)
+        const result: any =
+          hook === `live`
+            ? useLiveQuery((q: any) => query(q).limit(PAGE_SIZE + 1))
+            : useLiveInfiniteQuery(query, { pageSize: PAGE_SIZE })
+        useLayoutEffect(() => {
+          commits.push({
+            minimum,
+            status: result.status,
+            ids: result.data.slice(0, PAGE_SIZE).map((row: Row) => row.id),
+          })
+        })
+        if (suspend) throw never
+        return null
+      }
+      const tree = (minimum: number, suspend: boolean) => (
+        <Suspense fallback={null}>
+          <Query minimum={minimum} suspend={suspend} />
+        </Suspense>
+      )
+      const view = render(tree(0, false))
+      cleanups.push(() => view.unmount())
+      await act(async () => {})
+      // Render B and abandon it, then commit A again.
+      act(() => view.rerender(tree(2, true)))
+      act(() => view.rerender(tree(0, false)))
+      await act(async () => restartWith(byId([4, 5, 6, 7, 8])))
+      commits.length = 0
+      act(() => view.rerender(tree(2, false)))
+      await act(async () => {
+        await new Promise((resolve) => setTimeout(resolve, 0))
+      })
+
+      expect(commits.filter((commit) => commit.minimum === 2).at(-1)).toEqual({
+        minimum: 2,
+        status: `ready`,
+        ids: [`4`, `5`],
+      })
+    },
+  )
+})
diff --git a/packages/react-db/tests/source-id-reuse-oracle.test.tsx b/packages/react-db/tests/source-id-reuse-oracle.test.tsx
index afbf321710..d74d276886 100644
--- a/packages/react-db/tests/source-id-reuse-oracle.test.tsx
+++ b/packages/react-db/tests/source-id-reuse-oracle.test.tsx
@@ -40,51 +40,24 @@
  * below runs dependency-list hook paths too. This does not assert a
  * process-wide Collection registry or other explicit-key semantics.
  */
+
+import { act, render, renderHook, waitFor } from '@testing-library/react'
 import {
   DbClient,
   SourceCollectionIdReuseError,
   collectionOptions,
-  createCollection,
   eq,
   gt,
 } from '@tanstack/db'
-import { act, render, renderHook, waitFor } from '@testing-library/react'
 import { describe, expect, it, vi } from 'vitest'
-import { Component, Suspense } from 'react'
+import { Suspense } from 'react'
 import { DbProvider } from '../src/DbProvider'
 import { useLiveQuery } from '../src/useLiveQuery'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
 import { useLiveSuspenseQuery } from '../src/useLiveSuspenseQuery'
-import { mockSyncCollectionOptions } from '../../db/tests/utils'
-import type { Context, QueryBuilder } from '@tanstack/db'
-import type { ReactNode } from 'react'
-
-type Row = { id: string; value: string; rank: number }
-
-class TestErrorBoundary extends Component<
-  { children: ReactNode },
-  { error?: Error }
-> {
-  state: { error?: Error } = {}
-
-  static getDerivedStateFromError(error: Error) {
-    return { error }
-  }
-
-  render() {
-    return this.state.error ? <div>Rejected</div> : this.props.children
-  }
-}
-
-function source(id: string, value: string) {
-  return createCollection(
-    mockSyncCollectionOptions<Row>({
-      id,
-      getKey: (row) => row.id,
-      initialData: [{ id: `one`, value, rank: 1 }],
-    }),
-  )
-}
+import { declareOracle } from '../../db/tests/oracle-declaration'
+import { TestErrorBoundary, source } from './source-id-reuse-support'
+import type { Row } from './source-id-reuse-support'
 
 type Binding = { source: ReturnType<typeof source>; client?: DbClient }
 
@@ -111,6 +84,11 @@ function checkRerender(
   }
 }
 
+declareOracle({
+  check: [checkRerender, checkReleaseHistory],
+  model: [expectedCollision],
+})
+
 /*
  * Release law. A hook in one DbClient scope first reads only its own source,
  * then rerenders into a rejected query that also reads a shared descriptor.
@@ -373,203 +351,120 @@ const releaseReaders: Record<
   },
 }
 
+/**
+ * Release driver: runs one rejection history (cause, hook, reader) and checks
+ * when the shared source starts. The law is the release law above: a rejected
+ * render releases its deferral before the reader asks, and a render that never
+ * commits releases it at the reclaim. Each cell of the grammar reaches a
+ * materialized shared descriptor, so the driver asserts that before the reader.
+ */
+let releaseSequence = 0
+async function checkReleaseHistory(
+  makeCause: (typeof releaseCauses)[string],
+  hook: ReleaseHook,
+  read: (typeof releaseReaders)[string],
+) {
+  const client = new DbClient()
+  const id = `release-shared-${releaseSequence++}`
+  let syncStarts = 0
+  let materialized = 0
+  const shared = collectionOptions(
+    id,
+    () => (
+      materialized++,
+      {
+        id,
+        getKey: (row: Row) => row.id,
+        sync: {
+          sync: ({ begin, write, commit, markReady }) => {
+            syncStarts++
+            begin()
+            write({
+              type: `insert`,
+              value: { id: `one`, value: `shared`, rank: 1 },
+            })
+            commit()
+            markReady()
+          },
+        },
+      }
+    ),
+  )
+  const failing = collectionOptions(`${id}-failing`, () => {
+    throw new Error(`descriptor factory failed`)
+  })
+  const cause = makeCause(shared, failing)
+  cause.setup?.(client)
+  const never = new Promise<void>(() => {})
+  function View({ step }: { step: ReleaseStep }) {
+    hook.use(
+      (q) => cause.query(q, step, hook.ordered),
+      cause.deps?.(step) ?? [step.current, step.reject],
+    )
+    if (step.reject && cause.afterHook === `throw`) {
+      throw new Error(`sibling failed`)
+    }
+    if (step.reject && cause.afterHook === `suspend`) throw never
+    return <div>Query</div>
+  }
+  const tree = (step: ReleaseStep) => (
+    <DbProvider client={client}>
+      <TestErrorBoundary>
+        <Suspense fallback={<div>Loading</div>}>
+          <View step={step} />
+        </Suspense>
+      </TestErrorBoundary>
+    </DbProvider>
+  )
+  const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+  try {
+    const initial = {
+      current: source(`settings`, `first`),
+      reject: false,
+    }
+    const root = render(tree(cause.atMount ? cause.rejected(initial) : initial))
+    await act(async () => {})
+    if (!cause.atMount) root.rerender(tree(cause.rejected(initial)))
+    expect(
+      root.getByText(cause.afterHook === `suspend` ? `Loading` : `Rejected`),
+    ).toBeDefined()
+    // Declared reach: the rejected render materialized the shared
+    // descriptor, so it held a deferral the law must release.
+    expect(materialized).toBe(1)
+    // A rejection releases at its render boundary, before the reader.
+    // A render that never commits releases at the reclaim, which the
+    // real GC timer may reach before or after the reader asks.
+    if (!cause.afterHook) expect(syncStarts).toBe(0)
+
+    const value = read(client.collection(shared) as any)
+    if (cause.afterHook) {
+      await waitFor(() => expect(value()).toBe(`shared`))
+    } else {
+      // Released at the render boundary, so the demand started it.
+      expect(syncStarts).toBe(1)
+      await act(async () => {})
+      expect(value()).toBe(`shared`)
+    }
+    expect(syncStarts).toBe(1)
+  } finally {
+    consoleError.mockRestore()
+  }
+}
+
 describe(`React source ID reuse: rejected renders release deferred sync starts`, () => {
-  let sequence = 0
   for (const [causeName, makeCause] of Object.entries(releaseCauses)) {
     for (const [hookName, hook] of Object.entries(releaseHooks)) {
       const probe = makeCause(undefined, undefined)
       if (probe.rejectsIn && !probe.rejectsIn(hook)) continue
       for (const [readerName, read] of Object.entries(releaseReaders)) {
-        it(`after ${causeName} in ${hookName}, ${readerName} starts the shared source`, async () => {
-          const client = new DbClient()
-          const id = `release-shared-${sequence++}`
-          let syncStarts = 0
-          let materialized = 0
-          const shared = collectionOptions(
-            id,
-            () => (
-              materialized++,
-              {
-                id,
-                getKey: (row: Row) => row.id,
-                sync: {
-                  sync: ({ begin, write, commit, markReady }) => {
-                    syncStarts++
-                    begin()
-                    write({
-                      type: `insert`,
-                      value: { id: `one`, value: `shared`, rank: 1 },
-                    })
-                    commit()
-                    markReady()
-                  },
-                },
-              }
-            ),
-          )
-          const failing = collectionOptions(`${id}-failing`, () => {
-            throw new Error(`descriptor factory failed`)
-          })
-          const cause = makeCause(shared, failing)
-          cause.setup?.(client)
-          const never = new Promise<void>(() => {})
-          function View({ step }: { step: ReleaseStep }) {
-            hook.use(
-              (q) => cause.query(q, step, hook.ordered),
-              cause.deps?.(step) ?? [step.current, step.reject],
-            )
-            if (step.reject && cause.afterHook === `throw`) {
-              throw new Error(`sibling failed`)
-            }
-            if (step.reject && cause.afterHook === `suspend`) throw never
-            return <div>Query</div>
-          }
-          const tree = (step: ReleaseStep) => (
-            <DbProvider client={client}>
-              <TestErrorBoundary>
-                <Suspense fallback={<div>Loading</div>}>
-                  <View step={step} />
-                </Suspense>
-              </TestErrorBoundary>
-            </DbProvider>
-          )
-          const consoleError = vi
-            .spyOn(console, `error`)
-            .mockImplementation(() => {})
-          try {
-            const initial = {
-              current: source(`settings`, `first`),
-              reject: false,
-            }
-            const root = render(
-              tree(cause.atMount ? cause.rejected(initial) : initial),
-            )
-            await act(async () => {})
-            if (!cause.atMount) root.rerender(tree(cause.rejected(initial)))
-            expect(
-              root.getByText(
-                cause.afterHook === `suspend` ? `Loading` : `Rejected`,
-              ),
-            ).toBeDefined()
-            // Declared reach: the rejected render materialized the shared
-            // descriptor, so it held a deferral the law must release.
-            expect(materialized).toBe(1)
-            // A rejection releases at its render boundary, before the reader.
-            // A render that never commits releases at the reclaim, which the
-            // real GC timer may reach before or after the reader asks.
-            if (!cause.afterHook) expect(syncStarts).toBe(0)
-
-            const value = read(client.collection(shared) as any)
-            if (cause.afterHook) {
-              await waitFor(() => expect(value()).toBe(`shared`))
-            } else {
-              // Released at the render boundary, so the demand started it.
-              expect(syncStarts).toBe(1)
-              await act(async () => {})
-              expect(value()).toBe(`shared`)
-            }
-            expect(syncStarts).toBe(1)
-          } finally {
-            consoleError.mockRestore()
-          }
-        })
+        it(`after ${causeName} in ${hookName}, ${readerName} starts the shared source`, () =>
+          checkReleaseHistory(makeCause, hook, read))
       }
     }
   }
 })
 
 describe(`React source ID reuse`, () => {
-  it(`releases a later shared source when earlier deferred sync starts fail`, async () => {
-    const client = new DbClient()
-    const first = source(`settings`, `first`)
-    const replacement = source(`settings`, `replacement`)
-    const failedStarts: [number, number] = [0, 0]
-    const failing = ([0, 1] as const).map((index) =>
-      collectionOptions(`failing-${index}`, () => ({
-        id: `failing-${index}`,
-        getKey: (row: Row) => row.id,
-        startSync: true,
-        sync: {
-          sync: () => {
-            failedStarts[index]++
-            throw new Error(`sync ${index} failed`)
-          },
-        },
-      })),
-    )
-    let healthyStarts = 0
-    const healthy = collectionOptions(`healthy-after-failures`, () => ({
-      id: `healthy-after-failures`,
-      getKey: (row: Row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          healthyStarts++
-          begin()
-          write({
-            type: `insert`,
-            value: { id: `one`, value: `healthy`, rank: 1 },
-          })
-          commit()
-          markReady()
-        },
-      },
-    }))
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-
-    function View({
-      current,
-      include,
-    }: {
-      current: typeof first
-      include: boolean
-    }) {
-      useLiveQuery({
-        client,
-        query: (q): QueryBuilder<Context> =>
-          include
-            ? q
-                .from({ failingA: failing[0]! })
-                .join({ failingB: failing[1]! }, ({ failingA, failingB }) =>
-                  eq(failingA.id, failingB.id),
-                )
-                .join({ healthy }, ({ failingA, healthy: row }) =>
-                  eq(failingA.id, row.id),
-                )
-                .join({ settings: current }, ({ failingA, settings }) =>
-                  eq(failingA.id, settings.id),
-                )
-            : q.from({ settings: current }),
-      })
-      return <div>Query</div>
-    }
-
-    try {
-      const root = render(
-        <TestErrorBoundary>
-          <View current={first} include={false} />
-        </TestErrorBoundary>,
-      )
-      await act(async () => {})
-      root.rerender(
-        <TestErrorBoundary>
-          <View current={replacement} include={true} />
-        </TestErrorBoundary>,
-      )
-      expect(root.getByText(`Rejected`)).toBeDefined()
-      expect(failedStarts).toEqual([1, 1])
-
-      const shared = client.collection(healthy)
-      const reader = renderHook(() => useLiveQuery(shared))
-      await act(async () => {})
-      expect(reader.result.current.status).toBe(`ready`)
-      expect(reader.result.current.data[0]?.value).toBe(`healthy`)
-      expect(healthyStarts).toBe(1)
-    } finally {
-      consoleError.mockRestore()
-    }
-  })
-
   it(`rejects a different active source with the same ID before exposing stale rows`, async () => {
     const first = source(`settings`, `first`)
     const second = source(`settings`, `second`)
@@ -640,23 +535,6 @@ describe(`React source ID reuse`, () => {
     )
   })
 
-  it(`rejects two distinct source objects with one ID in a single query`, () => {
-    const leftSource = source(`settings`, `first`)
-    const rightSource = source(`settings`, `second`)
-    expect(() =>
-      renderHook(() =>
-        useLiveQuery({
-          query: (q) =>
-            q
-              .from({ first: leftSource })
-              .join({ second: rightSource }, ({ first, second }) =>
-                eq(first.id, second.id),
-              ),
-        }),
-      ),
-    ).toThrow(SourceCollectionIdReuseError)
-  })
-
   it(`keeps a mounted hook's ID binding after source cleanup`, async () => {
     const first = source(`settings`, `first`)
     const second = source(`settings`, `second`)
@@ -674,261 +552,6 @@ describe(`React source ID reuse`, () => {
     )
   })
 
-  it(`permits the same ID in a new hook after unmount and cleanup`, async () => {
-    const first = source(`settings`, `first`)
-    const oldHook = renderHook(() =>
-      useLiveQuery({ query: (q) => q.from({ settings: first }) }),
-    )
-    await waitFor(() =>
-      expect(oldHook.result.current.data[0]?.value).toBe(`first`),
-    )
-    const oldQuery = oldHook.result.current.collection
-    oldHook.unmount()
-    await waitFor(() => expect(oldQuery.status).toBe(`cleaned-up`))
-    await first.cleanup()
-
-    const second = source(`settings`, `second`)
-    const newHook = renderHook(() =>
-      useLiveQuery({ query: (q) => q.from({ settings: second }) }),
-    )
-    await waitFor(() =>
-      expect(newHook.result.current.data[0]?.value).toBe(`second`),
-    )
-  })
-
-  it(`lets a keyed query swap a source under its ID when the key changes`, async () => {
-    const first = source(`settings`, `first`)
-    const replacement = source(`settings`, `replacement`)
-    const hook = renderHook(
-      ({ current }: { current: typeof first }) =>
-        useLiveQuery({
-          queryKey: [`settings`, current === first ? 1 : 2],
-          query: (q) => q.from({ settings: current }),
-        }),
-      { initialProps: { current: first } },
-    )
-    await waitFor(() =>
-      expect(hook.result.current.data[0]?.value).toBe(`first`),
-    )
-    hook.rerender({ current: replacement })
-    await waitFor(() =>
-      expect(hook.result.current.data[0]?.value).toBe(`replacement`),
-    )
-  })
-
-  // A Suspense mount suspends before it commits, so its retry render may
-  // reuse the cached Suspense collection instead of compiling again. With a
-  // dependency list, that retry must still claim the source's ID.
-  it(`claims a Suspense query's source when a dependency-list retry reuses its cached collection`, async () => {
-    let markFirstReady!: () => void
-    const first = createCollection<Row>({
-      id: `suspense-settings`,
-      getKey: (row) => row.id,
-      startSync: true,
-      sync: {
-        sync: ({ begin, write, commit, markReady }) => {
-          begin()
-          write({
-            type: `insert`,
-            value: { id: `one`, value: `first`, rank: 1 },
-          })
-          commit()
-          markFirstReady = markReady
-        },
-      },
-    })
-    const replacement = source(`suspense-settings`, `replacement`)
-    const labels = new Map<object, string>([
-      [first, `first`],
-      [replacement, `replacement`],
-    ])
-    const View = ({ current }: { current: typeof first }) => {
-      // A hashable dependency keys the Suspense cache; a Collection cannot.
-      const { data } = useLiveSuspenseQuery(
-        (q) => q.from({ settings: current }),
-        [labels.get(current)],
-      )
-      return <div>{data[0]?.value}</div>
-    }
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    try {
-      const root = render(
-        <TestErrorBoundary>
-          <Suspense fallback={<div>Loading</div>}>
-            <View current={first} />
-          </Suspense>
-        </TestErrorBoundary>,
-      )
-      expect(root.getByText(`Loading`)).toBeDefined()
-      await act(async () => markFirstReady())
-      await waitFor(() => expect(root.getByText(`first`)).toBeDefined())
-
-      root.rerender(
-        <TestErrorBoundary>
-          <Suspense fallback={<div>Loading</div>}>
-            <View current={replacement} />
-          </Suspense>
-        </TestErrorBoundary>,
-      )
-      expect(root.getByText(`Rejected`)).toBeDefined()
-    } finally {
-      consoleError.mockRestore()
-    }
-  })
-
-  it(`claims a Suspense query's source when a dependency-list hook mounts from a sibling's cached collection`, async () => {
-    const first = source(`sibling-suspense`, `first`)
-    const replacement = source(`sibling-suspense`, `replacement`)
-    const labels = new Map<object, string>([
-      [first, `first`],
-      [replacement, `replacement`],
-    ])
-    const View = ({ current }: { current: typeof first }) => {
-      // A hashable dependency keys the Suspense cache; a Collection cannot.
-      const { data } = useLiveSuspenseQuery(
-        (q) => q.from({ settings: current }),
-        [labels.get(current)],
-      )
-      return <div>{data[0]?.value}</div>
-    }
-    const tree = (second: typeof first) => (
-      <>
-        <Suspense fallback={<div>Loading</div>}>
-          <View current={first} />
-        </Suspense>
-        <TestErrorBoundary>
-          <Suspense fallback={<div>Loading</div>}>
-            <View current={second} />
-          </Suspense>
-        </TestErrorBoundary>
-      </>
-    )
-    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
-    try {
-      const root = render(tree(first))
-      await waitFor(() => expect(root.getAllByText(`first`)).toHaveLength(2))
-      root.rerender(tree(replacement))
-      expect(root.getByText(`Rejected`)).toBeDefined()
-    } finally {
-      consoleError.mockRestore()
-    }
-  })
-
-  it(`permits independent client scopes to use the same ID`, async () => {
-    const firstClient = new DbClient()
-    const secondClient = new DbClient()
-    const first = source(`settings`, `first`)
-    const second = source(`settings`, `second`)
-    const firstHook = renderHook(() =>
-      useLiveQuery({
-        client: firstClient,
-        query: (q) => q.from({ settings: first }),
-      }),
-    )
-    const secondHook = renderHook(() =>
-      useLiveQuery({
-        client: secondClient,
-        query: (q) => q.from({ settings: second }),
-      }),
-    )
-
-    await waitFor(() => {
-      expect(firstHook.result.current.data[0]?.value).toBe(`first`)
-      expect(secondHook.result.current.data[0]?.value).toBe(`second`)
-    })
-  })
-
-  it(`keeps separate client-scoped Suspense hooks bound to their own sources`, async () => {
-    const client = new DbClient()
-    const first = source(`settings`, `first`)
-    const second = source(`settings`, `second`)
-    const View = ({ current }: { current: typeof first }) => {
-      const { data } = useLiveSuspenseQuery({
-        client,
-        query: (q) => q.from({ settings: current }),
-      })
-      return <div>{data[0]?.value}</div>
-    }
-    const firstView = render(
-      <Suspense fallback={<div>First loading</div>}>
-        <View current={first} />
-      </Suspense>,
-    )
-    await waitFor(() => expect(firstView.getByText(`first`)).toBeDefined())
-    const secondView = render(
-      <Suspense fallback={<div>Second loading</div>}>
-        <View current={second} />
-      </Suspense>,
-    )
-    await waitFor(() => expect(secondView.getByText(`second`)).toBeDefined())
-  })
-
-  it(`keeps a client-scoped Suspense retry bound to its new source`, async () => {
-    const client = new DbClient()
-    const first = source(`settings`, `first`)
-    const second = source(`settings`, `second`)
-    const never = new Promise<void>(() => {})
-    const View = ({
-      current,
-      suspend,
-    }: {
-      current: typeof first
-      suspend: boolean
-    }) => {
-      const { data } = useLiveSuspenseQuery({
-        client,
-        query: (q) => q.from({ settings: current }),
-      })
-      if (suspend) throw never
-      return <div>{data[0]?.value}</div>
-    }
-    const root = render(
-      <Suspense fallback={<div>Loading</div>}>
-        <View current={first} suspend={true} />
-      </Suspense>,
-    )
-    expect(root.getByText(`Loading`)).toBeDefined()
-    root.rerender(
-      <Suspense fallback={<div>Loading</div>}>
-        <View current={second} suspend={false} />
-      </Suspense>,
-    )
-    await waitFor(() => expect(root.getByText(`second`)).toBeDefined())
-  })
-
-  it(`remembers IDs across DbProvider client switches`, async () => {
-    const firstClient = new DbClient()
-    const secondClient = new DbClient()
-    const first = source(`settings`, `first`)
-    const otherScope = source(`settings`, `other`)
-    const replacement = source(`settings`, `replacement`)
-    const View = ({ current }: { current: typeof first }) => {
-      const { data } = useLiveQuery({
-        query: (q) => q.from({ settings: current }),
-      })
-      return <div>{data[0]?.value}</div>
-    }
-    const root = render(
-      <DbProvider client={firstClient}>
-        <View current={first} />
-      </DbProvider>,
-    )
-    await waitFor(() => expect(root.getByText(`first`)).toBeDefined())
-    root.rerender(
-      <DbProvider client={secondClient}>
-        <View current={otherScope} />
-      </DbProvider>,
-    )
-    await waitFor(() => expect(root.getByText(`other`)).toBeDefined())
-    expect(() =>
-      root.rerender(
-        <DbProvider client={firstClient}>
-          <View current={replacement} />
-        </DbProvider>,
-      ),
-    ).toThrow(SourceCollectionIdReuseError)
-  })
-
   it(`remembers each client scope when one mounted hook switches clients`, async () => {
     const firstClient = new DbClient()
     const secondClient = new DbClient()
diff --git a/packages/react-db/tests/source-id-reuse-support.tsx b/packages/react-db/tests/source-id-reuse-support.tsx
new file mode 100644
index 0000000000..2ee1ead0f7
--- /dev/null
+++ b/packages/react-db/tests/source-id-reuse-support.tsx
@@ -0,0 +1,33 @@
+import { Component } from 'react'
+import { createCollection } from '@tanstack/db'
+import { mockSyncCollectionOptions } from '../../db/tests/utils'
+import type { ReactNode } from 'react'
+
+// Shared fixtures for the React source ID reuse tests. The reuse law is owned by
+// source-id-reuse-oracle.test.tsx; ordinary pinned tests live in source-id-reuse.test.tsx.
+export type Row = { id: string; value: string; rank: number }
+
+export class TestErrorBoundary extends Component<
+  { children: ReactNode },
+  { error?: Error }
+> {
+  state: { error?: Error } = {}
+
+  static getDerivedStateFromError(error: Error) {
+    return { error }
+  }
+
+  render() {
+    return this.state.error ? <div>Rejected</div> : this.props.children
+  }
+}
+
+export function source(id: string, value: string) {
+  return createCollection(
+    mockSyncCollectionOptions<Row>({
+      id,
+      getKey: (row) => row.id,
+      initialData: [{ id: `one`, value, rank: 1 }],
+    }),
+  )
+}
diff --git a/packages/react-db/tests/source-id-reuse.test.tsx b/packages/react-db/tests/source-id-reuse.test.tsx
new file mode 100644
index 0000000000..d23cc36eb7
--- /dev/null
+++ b/packages/react-db/tests/source-id-reuse.test.tsx
@@ -0,0 +1,385 @@
+// Ordinary React tests for source ID reuse: a rejected render releases the sync
+// deferral it acquired, so a later reader can start a shared Collection. The reuse
+// law is owned by source-id-reuse-oracle.test.tsx.
+import { act, render, renderHook, waitFor } from '@testing-library/react'
+import {
+  DbClient,
+  SourceCollectionIdReuseError,
+  collectionOptions,
+  createCollection,
+  eq,
+} from '@tanstack/db'
+import { describe, expect, it, vi } from 'vitest'
+import { Suspense } from 'react'
+import { DbProvider } from '../src/DbProvider'
+import { useLiveQuery } from '../src/useLiveQuery'
+import { useLiveSuspenseQuery } from '../src/useLiveSuspenseQuery'
+import { TestErrorBoundary, source } from './source-id-reuse-support'
+import type { Context, QueryBuilder } from '@tanstack/db'
+
+import type { Row } from './source-id-reuse-support'
+
+describe(`React source ID reuse`, () => {
+  it(`releases a later shared source when earlier deferred sync starts fail`, async () => {
+    const client = new DbClient()
+    const first = source(`settings`, `first`)
+    const replacement = source(`settings`, `replacement`)
+    const failedStarts: [number, number] = [0, 0]
+    const failing = ([0, 1] as const).map((index) =>
+      collectionOptions(`failing-${index}`, () => ({
+        id: `failing-${index}`,
+        getKey: (row: Row) => row.id,
+        startSync: true,
+        sync: {
+          sync: () => {
+            failedStarts[index]++
+            throw new Error(`sync ${index} failed`)
+          },
+        },
+      })),
+    )
+    let healthyStarts = 0
+    const healthy = collectionOptions(`healthy-after-failures`, () => ({
+      id: `healthy-after-failures`,
+      getKey: (row: Row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          healthyStarts++
+          begin()
+          write({
+            type: `insert`,
+            value: { id: `one`, value: `healthy`, rank: 1 },
+          })
+          commit()
+          markReady()
+        },
+      },
+    }))
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+
+    function View({
+      current,
+      include,
+    }: {
+      current: typeof first
+      include: boolean
+    }) {
+      useLiveQuery({
+        client,
+        query: (q): QueryBuilder<Context> =>
+          include
+            ? q
+                .from({ failingA: failing[0]! })
+                .join({ failingB: failing[1]! }, ({ failingA, failingB }) =>
+                  eq(failingA.id, failingB.id),
+                )
+                .join({ healthy }, ({ failingA, healthy: row }) =>
+                  eq(failingA.id, row.id),
+                )
+                .join({ settings: current }, ({ failingA, settings }) =>
+                  eq(failingA.id, settings.id),
+                )
+            : q.from({ settings: current }),
+      })
+      return <div>Query</div>
+    }
+
+    try {
+      const root = render(
+        <TestErrorBoundary>
+          <View current={first} include={false} />
+        </TestErrorBoundary>,
+      )
+      await act(async () => {})
+      root.rerender(
+        <TestErrorBoundary>
+          <View current={replacement} include={true} />
+        </TestErrorBoundary>,
+      )
+      expect(root.getByText(`Rejected`)).toBeDefined()
+      expect(failedStarts).toEqual([1, 1])
+
+      const shared = client.collection(healthy)
+      const reader = renderHook(() => useLiveQuery(shared))
+      await act(async () => {})
+      expect(reader.result.current.status).toBe(`ready`)
+      expect(reader.result.current.data[0]?.value).toBe(`healthy`)
+      expect(healthyStarts).toBe(1)
+    } finally {
+      consoleError.mockRestore()
+    }
+  })
+
+  it(`rejects two distinct source objects with one ID in a single query`, () => {
+    const leftSource = source(`settings`, `first`)
+    const rightSource = source(`settings`, `second`)
+    expect(() =>
+      renderHook(() =>
+        useLiveQuery({
+          query: (q) =>
+            q
+              .from({ first: leftSource })
+              .join({ second: rightSource }, ({ first, second }) =>
+                eq(first.id, second.id),
+              ),
+        }),
+      ),
+    ).toThrow(SourceCollectionIdReuseError)
+  })
+
+  it(`permits the same ID in a new hook after unmount and cleanup`, async () => {
+    const first = source(`settings`, `first`)
+    const oldHook = renderHook(() =>
+      useLiveQuery({ query: (q) => q.from({ settings: first }) }),
+    )
+    await waitFor(() =>
+      expect(oldHook.result.current.data[0]?.value).toBe(`first`),
+    )
+    const oldQuery = oldHook.result.current.collection
+    oldHook.unmount()
+    await waitFor(() => expect(oldQuery.status).toBe(`cleaned-up`))
+    await first.cleanup()
+
+    const second = source(`settings`, `second`)
+    const newHook = renderHook(() =>
+      useLiveQuery({ query: (q) => q.from({ settings: second }) }),
+    )
+    await waitFor(() =>
+      expect(newHook.result.current.data[0]?.value).toBe(`second`),
+    )
+  })
+
+  it(`lets a keyed query swap a source under its ID when the key changes`, async () => {
+    const first = source(`settings`, `first`)
+    const replacement = source(`settings`, `replacement`)
+    const hook = renderHook(
+      ({ current }: { current: typeof first }) =>
+        useLiveQuery({
+          queryKey: [`settings`, current === first ? 1 : 2],
+          query: (q) => q.from({ settings: current }),
+        }),
+      { initialProps: { current: first } },
+    )
+    await waitFor(() =>
+      expect(hook.result.current.data[0]?.value).toBe(`first`),
+    )
+    hook.rerender({ current: replacement })
+    await waitFor(() =>
+      expect(hook.result.current.data[0]?.value).toBe(`replacement`),
+    )
+  })
+
+  // A Suspense mount suspends before it commits, so its retry render may
+  // reuse the cached Suspense collection instead of compiling again. With a
+  // dependency list, that retry must still claim the source's ID.
+  it(`claims a Suspense query's source when a dependency-list retry reuses its cached collection`, async () => {
+    let markFirstReady!: () => void
+    const first = createCollection<Row>({
+      id: `suspense-settings`,
+      getKey: (row) => row.id,
+      startSync: true,
+      sync: {
+        sync: ({ begin, write, commit, markReady }) => {
+          begin()
+          write({
+            type: `insert`,
+            value: { id: `one`, value: `first`, rank: 1 },
+          })
+          commit()
+          markFirstReady = markReady
+        },
+      },
+    })
+    const replacement = source(`suspense-settings`, `replacement`)
+    const labels = new Map<object, string>([
+      [first, `first`],
+      [replacement, `replacement`],
+    ])
+    const View = ({ current }: { current: typeof first }) => {
+      // A hashable dependency keys the Suspense cache; a Collection cannot.
+      const { data } = useLiveSuspenseQuery(
+        (q) => q.from({ settings: current }),
+        [labels.get(current)],
+      )
+      return <div>{data[0]?.value}</div>
+    }
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    try {
+      const root = render(
+        <TestErrorBoundary>
+          <Suspense fallback={<div>Loading</div>}>
+            <View current={first} />
+          </Suspense>
+        </TestErrorBoundary>,
+      )
+      expect(root.getByText(`Loading`)).toBeDefined()
+      await act(async () => markFirstReady())
+      await waitFor(() => expect(root.getByText(`first`)).toBeDefined())
+
+      root.rerender(
+        <TestErrorBoundary>
+          <Suspense fallback={<div>Loading</div>}>
+            <View current={replacement} />
+          </Suspense>
+        </TestErrorBoundary>,
+      )
+      expect(root.getByText(`Rejected`)).toBeDefined()
+    } finally {
+      consoleError.mockRestore()
+    }
+  })
+
+  it(`claims a Suspense query's source when a dependency-list hook mounts from a sibling's cached collection`, async () => {
+    const first = source(`sibling-suspense`, `first`)
+    const replacement = source(`sibling-suspense`, `replacement`)
+    const labels = new Map<object, string>([
+      [first, `first`],
+      [replacement, `replacement`],
+    ])
+    const View = ({ current }: { current: typeof first }) => {
+      // A hashable dependency keys the Suspense cache; a Collection cannot.
+      const { data } = useLiveSuspenseQuery(
+        (q) => q.from({ settings: current }),
+        [labels.get(current)],
+      )
+      return <div>{data[0]?.value}</div>
+    }
+    const tree = (second: typeof first) => (
+      <>
+        <Suspense fallback={<div>Loading</div>}>
+          <View current={first} />
+        </Suspense>
+        <TestErrorBoundary>
+          <Suspense fallback={<div>Loading</div>}>
+            <View current={second} />
+          </Suspense>
+        </TestErrorBoundary>
+      </>
+    )
+    const consoleError = vi.spyOn(console, `error`).mockImplementation(() => {})
+    try {
+      const root = render(tree(first))
+      await waitFor(() => expect(root.getAllByText(`first`)).toHaveLength(2))
+      root.rerender(tree(replacement))
+      expect(root.getByText(`Rejected`)).toBeDefined()
+    } finally {
+      consoleError.mockRestore()
+    }
+  })
+
+  it(`permits independent client scopes to use the same ID`, async () => {
+    const firstClient = new DbClient()
+    const secondClient = new DbClient()
+    const first = source(`settings`, `first`)
+    const second = source(`settings`, `second`)
+    const firstHook = renderHook(() =>
+      useLiveQuery({
+        client: firstClient,
+        query: (q) => q.from({ settings: first }),
+      }),
+    )
+    const secondHook = renderHook(() =>
+      useLiveQuery({
+        client: secondClient,
+        query: (q) => q.from({ settings: second }),
+      }),
+    )
+
+    await waitFor(() => {
+      expect(firstHook.result.current.data[0]?.value).toBe(`first`)
+      expect(secondHook.result.current.data[0]?.value).toBe(`second`)
+    })
+  })
+
+  it(`keeps separate client-scoped Suspense hooks bound to their own sources`, async () => {
+    const client = new DbClient()
+    const first = source(`settings`, `first`)
+    const second = source(`settings`, `second`)
+    const View = ({ current }: { current: typeof first }) => {
+      const { data } = useLiveSuspenseQuery({
+        client,
+        query: (q) => q.from({ settings: current }),
+      })
+      return <div>{data[0]?.value}</div>
+    }
+    const firstView = render(
+      <Suspense fallback={<div>First loading</div>}>
+        <View current={first} />
+      </Suspense>,
+    )
+    await waitFor(() => expect(firstView.getByText(`first`)).toBeDefined())
+    const secondView = render(
+      <Suspense fallback={<div>Second loading</div>}>
+        <View current={second} />
+      </Suspense>,
+    )
+    await waitFor(() => expect(secondView.getByText(`second`)).toBeDefined())
+  })
+
+  it(`keeps a client-scoped Suspense retry bound to its new source`, async () => {
+    const client = new DbClient()
+    const first = source(`settings`, `first`)
+    const second = source(`settings`, `second`)
+    const never = new Promise<void>(() => {})
+    const View = ({
+      current,
+      suspend,
+    }: {
+      current: typeof first
+      suspend: boolean
+    }) => {
+      const { data } = useLiveSuspenseQuery({
+        client,
+        query: (q) => q.from({ settings: current }),
+      })
+      if (suspend) throw never
+      return <div>{data[0]?.value}</div>
+    }
+    const root = render(
+      <Suspense fallback={<div>Loading</div>}>
+        <View current={first} suspend={true} />
+      </Suspense>,
+    )
+    expect(root.getByText(`Loading`)).toBeDefined()
+    root.rerender(
+      <Suspense fallback={<div>Loading</div>}>
+        <View current={second} suspend={false} />
+      </Suspense>,
+    )
+    await waitFor(() => expect(root.getByText(`second`)).toBeDefined())
+  })
+
+  it(`remembers IDs across DbProvider client switches`, async () => {
+    const firstClient = new DbClient()
+    const secondClient = new DbClient()
+    const first = source(`settings`, `first`)
+    const otherScope = source(`settings`, `other`)
+    const replacement = source(`settings`, `replacement`)
+    const View = ({ current }: { current: typeof first }) => {
+      const { data } = useLiveQuery({
+        query: (q) => q.from({ settings: current }),
+      })
+      return <div>{data[0]?.value}</div>
+    }
+    const root = render(
+      <DbProvider client={firstClient}>
+        <View current={first} />
+      </DbProvider>,
+    )
+    await waitFor(() => expect(root.getByText(`first`)).toBeDefined())
+    root.rerender(
+      <DbProvider client={secondClient}>
+        <View current={otherScope} />
+      </DbProvider>,
+    )
+    await waitFor(() => expect(root.getByText(`other`)).toBeDefined())
+    expect(() =>
+      root.rerender(
+        <DbProvider client={firstClient}>
+          <View current={replacement} />
+        </DbProvider>,
+      ),
+    ).toThrow(SourceCollectionIdReuseError)
+  })
+})
diff --git a/packages/react-db/tests/ssr-runtime-error-handoff-oracle.test.tsx b/packages/react-db/tests/ssr-runtime-error-handoff-oracle.test.tsx
index 78cf0f618e..e947d881cd 100644
--- a/packages/react-db/tests/ssr-runtime-error-handoff-oracle.test.tsx
+++ b/packages/react-db/tests/ssr-runtime-error-handoff-oracle.test.tsx
@@ -31,6 +31,7 @@ import {
   oracleRuns,
 } from '../../db/tests/oracle-config'
 import { createOracleReach } from '../../db/tests/oracle-reach'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { DbProvider } from '../src/DbProvider'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
 import { useLiveQuery } from '../src/useLiveQuery'
@@ -285,6 +286,10 @@ async function checkRuntimeHistory(
     )
 }
 
+// checkRuntimeHistory compares the server view, the browser's first hydration
+// view and its committed view with the shared runtime model's expected views.
+declareOracle({ check: [checkRuntimeHistory] })
+
 describe(`runtime errors across SSR hydration`, () => {
   for (const hook of [`ordinary`, `infinite`] as const) {
     for (const history of ssrRuntimeErrorExamples)
diff --git a/packages/react-db/tests/usePacedMutations-render-cuts-oracle.test.tsx b/packages/react-db/tests/usePacedMutations-render-cuts-oracle.test.tsx
index a14a0024e5..b778671007 100644
--- a/packages/react-db/tests/usePacedMutations-render-cuts-oracle.test.tsx
+++ b/packages/react-db/tests/usePacedMutations-render-cuts-oracle.test.tsx
@@ -38,6 +38,7 @@ import { act, cleanup, fireEvent, render } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createCollection, debounceStrategy } from '@tanstack/db'
 import { usePacedMutations } from '../src/usePacedMutations'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import {
   mockSyncCollectionOptions,
   resetCleanupQueue,
@@ -301,3 +302,5 @@ describe.each([false, true])(
     })
   },
 )
+
+declareOracle({ check: [driveHistory], model: [expectedOutcome] })
diff --git a/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts b/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts
index 591ce9f3af..5befd91fe6 100644
--- a/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts
+++ b/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts
@@ -1,113 +1,27 @@
-import { existsSync, mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
 import { fc } from '@fast-check/vitest'
 import { afterEach, expect, it } from 'vitest'
 import {
   oracleRandomParameters,
   oracleReplayTest,
-  oracleRuns,
   readOracleRunConfig,
 } from '../../db/tests/oracle-config.js'
+import { declareOracle } from '../../db/tests/oracle-declaration.js'
 import { OpSQLiteDriver } from '../src/op-sqlite-driver'
-import { InvalidPersistedCollectionConfigError } from '../../db-sqlite-persistence-core/src'
-import { runSQLiteDriverContractSuite } from '../../db-sqlite-persistence-core/tests/contracts/sqlite-driver-contract'
 import { createOpSQLiteTestDatabase } from './helpers/op-sqlite-test-db'
-import { opSQLiteProviderQueryFixtures } from './fixtures/op-sqlite-provider-results'
-import type { OpSQLiteDatabaseLike } from '../src/op-sqlite-driver'
-import type { SQLiteDriverContractHarnessFactory } from '../../db-sqlite-persistence-core/tests/contracts/sqlite-driver-contract'
-
-const activeCleanupFns: Array<() => void | Promise<void>> = []
-
-afterEach(async () => {
-  const cleanupErrors: Array<unknown> = []
-  while (activeCleanupFns.length > 0) {
-    const cleanupFn = activeCleanupFns.pop()
-    try {
-      await Promise.resolve(cleanupFn?.())
-    } catch (error) {
-      cleanupErrors.push(error)
-    }
-  }
-  if (cleanupErrors.length === 1) {
-    throw cleanupErrors[0]
-  }
-  if (cleanupErrors.length > 1) {
-    throw new AggregateError(cleanupErrors, `op-sqlite test cleanup failed`, {
-      cause: cleanupErrors[0],
-    })
-  }
-})
-
-function createTempSqlitePath(): string {
-  const tempDirectory = mkdtempSync(join(tmpdir(), `db-rn-op-sqlite-test-`))
-  const dbPath = join(tempDirectory, `state.sqlite`)
-  activeCleanupFns.push(() => {
-    rmSync(tempDirectory, { recursive: true, force: true })
-  })
-  return dbPath
-}
-
-type ColumnarDriverHarness = {
-  driver: OpSQLiteDriver
-  queryExecutions: () => number
-}
-
-async function withColumnarDriver<T>(
-  fn: (harness: ColumnarDriverHarness) => Promise<T>,
-): Promise<T> {
-  const tempDirectory = mkdtempSync(
-    join(tmpdir(), `db-rn-op-sqlite-alias-contract-`),
-  )
-  let database: ReturnType<typeof createOpSQLiteTestDatabase> | undefined
-  let outcome: { ok: true; value: T } | { ok: false; error: unknown }
-  try {
-    database = createOpSQLiteTestDatabase({
-      filename: join(tempDirectory, `state.sqlite`),
-      resultShape: `execute-async-columnar`,
-    })
-    const queryExecutions = trackQueryExecutions(database)
-    const driver = new OpSQLiteDriver({ database })
-    outcome = {
-      ok: true,
-      value: await fn({ driver, queryExecutions }),
-    }
-  } catch (error) {
-    outcome = { ok: false, error }
-  }
-
-  const cleanupErrors: Array<unknown> = []
-  if (database) {
-    try {
-      await Promise.resolve(database.close())
-    } catch (error) {
-      cleanupErrors.push(error)
-    }
-  }
-  try {
-    rmSync(tempDirectory, { recursive: true, force: true })
-  } catch (error) {
-    cleanupErrors.push(error)
-  }
-
-  if (!outcome.ok) {
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(
-        [outcome.error, ...cleanupErrors],
-        `op-sqlite alias law and cleanup failed`,
-        { cause: outcome.error },
-      )
-    }
-    throw outcome.error
-  }
-  if (cleanupErrors.length === 1) throw cleanupErrors[0]
-  if (cleanupErrors.length > 1) {
-    throw new AggregateError(cleanupErrors, `op-sqlite alias cleanup failed`, {
-      cause: cleanupErrors[0],
-    })
-  }
-  return outcome.value
-}
+import {
+  activeCleanupFns,
+  createTempSqlitePath,
+  expectExactAliasRows,
+  queryInjectedResult,
+  readAliasOracleRuns,
+  runActiveCleanupFns,
+  statementResultAliasNames,
+  statementResultFieldNames,
+  withColumnarDriver,
+  writeResultFieldNames,
+} from './op-sqlite-driver-support'
+
+afterEach(runActiveCleanupFns)
 
 /**
  * Law: SQLiteDriver.query returns the complete ordered object rows supplied by
@@ -144,377 +58,18 @@ async function withColumnarDriver<T>(
  * Real-provider refinement: frozen receipts from the published 15.2.7 Native
  * and Node sources, plus forward receipts from 18.2.1 Native, Node, and browser
  * sources, prove the shim's accepted envelopes match provider output.
+ * The frozen receipts, envelope-decoding cases, transaction tests, and
+ * malformed-envelope tables are ordinary unit tests in op-sqlite-driver.test.ts;
+ * they compare with fixed values, so they are not part of this law's coverage.
  * Known omissions: frozen provider values establish result-shape conformance,
  * not native device/host execution. A real runtime campaign still owns JSI,
  * worker, and platform delivery.
  */
-it.each([
-  `rows-array`,
-  `rows-object`,
-  `rows-list`,
-  `statement-array`,
-  `execute-rows-with-column-names`,
-  `execute-async-columnar`,
-] as const)(`reads query rows across result shape: %s`, async (resultShape) => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({
-    filename: dbPath,
-    resultShape,
-  })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const driver = new OpSQLiteDriver({
-    database,
-    ...(resultShape === `statement-array`
-      ? { arrayResultMode: `statement-results` as const }
-      : {}),
-  })
-  await driver.exec(
-    `CREATE TABLE todos (id TEXT PRIMARY KEY, title TEXT NOT NULL, score INTEGER NOT NULL)`,
-  )
-  await driver.run(`INSERT INTO todos (id, title, score) VALUES (?, ?, ?)`, [
-    `1`,
-    `Lower score`,
-    7,
-  ])
-  await driver.run(`INSERT INTO todos (id, title, score) VALUES (?, ?, ?)`, [
-    `2`,
-    `Higher score`,
-    41,
-  ])
-
-  const rows = await driver.query<{
-    id: string
-    title: string
-    score: number
-  }>(`SELECT title, score, id FROM todos ORDER BY score DESC`)
-  expectExactRows(rows, [
-    {
-      title: `Higher score`,
-      score: 41,
-      id: `2`,
-    },
-    {
-      title: `Lower score`,
-      score: 7,
-      id: `1`,
-    },
-  ])
-})
-
-it.each(opSQLiteProviderQueryFixtures)(
-  `decodes frozen provider receipt: $label`,
-  async ({ result, expectedRows }) => {
-    const receiptBeforeDecode = structuredClone(result)
-    const actual = await queryInjectedResult<Record<string, unknown>>(result)
-
-    expectExactRows(actual, expectedRows)
-    expect(result).toEqual(receiptBeforeDecode)
-  },
-)
-
-it(`keeps a receipt for every runtime in the current peer major`, () => {
-  expect(
-    opSQLiteProviderQueryFixtures
-      .filter(({ support }) => support === `current-peer`)
-      .map(({ providerVersion, runtime, method }) => ({
-        providerVersion,
-        runtime,
-        method,
-      })),
-  ).toEqual([
-    {
-      providerVersion: `15.2.7`,
-      runtime: `react-native`,
-      method: `executeAsync`,
-    },
-    {
-      providerVersion: `15.2.7`,
-      runtime: `node`,
-      method: `executeAsync`,
-    },
-  ])
-})
-
-it(`provider-receipt checker rejects a shim that drops provider rows`, async () => {
-  for (const { result, expectedRows } of opSQLiteProviderQueryFixtures) {
-    const decoded = await queryInjectedResult<Record<string, unknown>>({
-      ...(result as Record<string, unknown>),
-      rows: [],
-    })
-    expect(() => expectExactRows(decoded, expectedRows)).toThrow()
-  }
-})
-
-async function queryInjectedResult<T = unknown>(
-  result: unknown,
-  arrayResultMode?: `rows` | `statement-results`,
-): Promise<ReadonlyArray<T>> {
-  return new OpSQLiteDriver({
-    database: {
-      executeAsync: () => Promise.resolve(result),
-    },
-    ...(arrayResultMode ? { arrayResultMode } : {}),
-  }).query<T>(`SELECT * FROM injected_result`)
-}
-
-it(`requires an explicit mode for an ambiguous bare result array`, async () => {
-  const ambiguous = [{ rowsAffected: 17, rows: [`nested`] }]
-
-  await expect(queryInjectedResult(ambiguous)).rejects.toThrow(
-    `ambiguous bare result array`,
-  )
-  await expect(queryInjectedResult(ambiguous, `rows`)).resolves.toEqual(
-    ambiguous,
-  )
-  await expect(
-    queryInjectedResult(ambiguous, `statement-results`),
-  ).resolves.toEqual([`nested`])
-})
-
-it(`uses the declared mode for a markerless statement-array envelope`, async () => {
-  const ambiguous = [{ rows: [{ id: `nested-row` }] }]
-
-  await expect(queryInjectedResult(ambiguous)).rejects.toThrow(
-    `ambiguous bare result array`,
-  )
-  await expect(queryInjectedResult(ambiguous, `rows`)).resolves.toEqual(
-    ambiguous,
-  )
-  await expect(
-    queryInjectedResult(ambiguous, `statement-results`),
-  ).resolves.toEqual([{ id: `nested-row` }])
-})
-
-it(`applies the same row-carrier policy to object and declared statement envelopes`, async () => {
-  const rows = [{ id: `row-with-provider-extension` }]
-  const envelope = {
-    rows,
-    res: [{ id: `ignored-provider-res` }],
-    error: undefined,
-    providerExtension: `retained`,
-  }
-
-  await expect(queryInjectedResult(envelope)).resolves.toEqual(rows)
-  await expect(
-    queryInjectedResult([envelope], `statement-results`),
-  ).resolves.toEqual(rows)
-})
-
-it(`rejects positional rows without column metadata`, async () => {
-  const positionalRows = [[`1`, `title`, 7]]
-
-  await expect(queryInjectedResult(positionalRows)).rejects.toThrow(
-    `positional rows require column metadata`,
-  )
-  await expect(queryInjectedResult(positionalRows, `rows`)).rejects.toThrow(
-    `positional rows require column metadata`,
-  )
-})
-
-it(`rejects inherited result carriers instead of treating them as writes`, async () => {
-  let getterReads = 0
-  const prototype = Object.defineProperty({}, `rows`, {
-    get: () => {
-      getterReads++
-      return [{ id: `inherited-row` }]
-    },
-  })
-  const result = Object.assign(Object.create(prototype), { rowsAffected: 0 })
-
-  await expect(queryInjectedResult(result)).rejects.toThrow(
-    `inherited rows carrier`,
-  )
-  expect(getterReads).toBe(0)
-})
-
-it.each([undefined, null])(
-  `rejects a nullish rows carrier beside a write marker: %s`,
-  async (rows) => {
-    await expect(
-      queryInjectedResult({ rowsAffected: 0, rows }),
-    ).rejects.toThrow(`invalid rows carrier`)
-  },
-)
-
-it(`materializes a declared statement row list exactly once`, async () => {
-  const expected = [{ id: `first` }, { id: `second` }]
-  const requestedIndexes: Array<number> = []
-  const rows = {
-    length: expected.length,
-    item: (index: number) => {
-      requestedIndexes.push(index)
-      return expected[index]
-    },
-  }
-
-  await expect(
-    queryInjectedResult([{ rowsAffected: 0, rows }], `statement-results`),
-  ).resolves.toEqual(expected)
-  expect(requestedIndexes).toEqual([0, 1])
-})
-
-it.each([
-  { name: `NaN`, length: Number.NaN },
-  { name: `negative`, length: -1 },
-  { name: `fractional`, length: 1.5 },
-])(`rejects a $name statement row-list length`, async ({ length }) => {
-  await expect(
-    queryInjectedResult(
-      [{ rowsAffected: 0, rows: { length, item: () => ({ id: `row` }) } }],
-      `statement-results`,
-    ),
-  ).rejects.toThrow(`invalid rows carrier`)
-})
-
-it(`rejects an empty array in statement-results mode`, async () => {
-  await expect(queryInjectedResult([], `statement-results`)).rejects.toThrow(
-    `statement-result arrays must contain exactly one result`,
-  )
-  await expect(queryInjectedResult([], `rows`)).resolves.toEqual([])
-  await expect(queryInjectedResult([])).resolves.toEqual([])
-})
-
-it(`reads op-sqlite execute rows when columnNames metadata is also present`, async () => {
-  await expect(
-    queryInjectedResult({
-      rowsAffected: 0,
-      rows: [{ id: `node-or-web-row` }],
-      columnNames: [`id`],
-    }),
-  ).resolves.toEqual([{ id: `node-or-web-row` }])
-})
-
-it(`prefers object rows when op-sqlite also supplies raw columnar rows`, async () => {
-  await expect(
-    queryInjectedResult({
-      rowsAffected: 0,
-      rows: [{ id: `object-row` }],
-      rawRows: [[`raw-row`]],
-      columnNames: [`id`],
-    }),
-  ).resolves.toEqual([{ id: `object-row` }])
-})
-
-it.each([
-  `rows`,
-  `resultRows`,
-  `rawRows`,
-  `columnNames`,
-  `results`,
-  `res`,
-] as const)(
-  `preserves a direct data row with non-scalar %s alias`,
-  async (alias) => {
-    const row = {
-      [alias]: [`nested`, `value`],
-      rowsAffected: 17,
-      ordinary_name: `ordinary-value`,
-    }
-    await expect(queryInjectedResult([row])).resolves.toEqual([row])
-  },
-)
-
-it(`decodes legal duplicate SQLite column names with the last-value law`, async () => {
-  await withColumnarDriver(async ({ driver }) => {
-    await expect(
-      driver.query(`SELECT 'left-id' AS id, 'right-id' AS id`),
-    ).resolves.toEqual([{ id: `right-id` }])
-  })
-})
-
-it(`reads object and structural statement-array write envelopes as empty`, async () => {
-  const writeResult = { rowsAffected: 1, insertId: 17 }
-  await expect(queryInjectedResult(writeResult)).resolves.toEqual([])
-  await expect(
-    queryInjectedResult([{ ...writeResult, rows: [] }], `statement-results`),
-  ).resolves.toEqual([])
-})
-
-it.each([
-  {
-    name: `one row with a rowsAffected alias`,
-    rows: [{ rowsAffected: 42 }],
-  },
-  {
-    name: `multiple rows with a changes alias`,
-    rows: [{ changes: 1 }, { changes: 2 }],
-  },
-])(
-  `preserves direct data rows containing only write aliases: $name`,
-  async ({ rows }) => {
-    await expect(queryInjectedResult(rows)).resolves.toEqual(rows)
-  },
-)
-
-function expectExactRows<T>(
-  actual: ReadonlyArray<T>,
-  expected: ReadonlyArray<T>,
-): void {
-  expect(actual).toHaveLength(expected.length)
-  expected.forEach((row, rowIndex) => {
-    if (isRecord(row)) {
-      const actualRow = actual[rowIndex]
-      expect(Object.keys(isRecord(actualRow) ? actualRow : {})).toEqual(
-        Object.keys(row),
-      )
-    }
-    expect(actual[rowIndex]).toEqual(row)
-  })
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === `object` && value !== null && !Array.isArray(value)
-}
-
-function expectExactAliasRows(
-  actual: ReadonlyArray<Record<string, unknown>>,
-  expected: ReadonlyArray<Record<string, unknown>>,
-): void {
-  try {
-    expect(actual).toHaveLength(expected.length)
-    expected.forEach((row, rowIndex) => {
-      expect(Object.keys(actual[rowIndex] ?? {})).toEqual(Object.keys(row))
-      expect(actual[rowIndex]).toEqual(row)
-    })
-  } catch (cause) {
-    throw new Error(`op-sqlite reserved-alias exact-row law violated`, {
-      cause,
-    })
-  }
-}
-
-const statementResultFieldNames = [
-  `rows`,
-  `resultRows`,
-  `rawRows`,
-  `columnNames`,
-  `results`,
-  `rowsAffected`,
-  `changes`,
-  `insertId`,
-  `lastInsertRowId`,
-  `res`,
-] as const
-
-const statementResultAliasNames = [
-  ...statementResultFieldNames,
-  `ordinary_name`,
-  `another_value`,
-] as const
-
-const writeResultFieldNames = [
-  `rowsAffected`,
-  `changes`,
-  `insertId`,
-  `lastInsertRowId`,
-] as const
 
 type AliasOracleProperty =
   | `op-sqlite.write-marker-aliases`
   | `op-sqlite.result-carrier-equivalence`
   | `op-sqlite.columnar-sql-aliases`
-type AliasOracleEnvironment = Record<string, string | undefined>
 type AliasOracleParameters = {
   numRuns: number
   seed?: number
@@ -523,22 +78,6 @@ type AliasOracleParameters = {
 
 const FIXED_ALIAS_ORACLE_SEED = 165903
 
-function readAliasOracleRuns(
-  environment: AliasOracleEnvironment = process.env,
-): number {
-  // A run-count control, not a replay coordinate. Its default is the shared
-  // base count, so TANSTACK_DB_ORACLE_RUNS_MULTIPLIER still scales it.
-  const runsText =
-    environment.TANSTACK_DB_OP_SQLITE_ORACLE_RUNS ?? String(oracleRuns(50))
-  const runs = Number(runsText)
-  if (runsText.trim() === `` || !Number.isSafeInteger(runs) || runs < 1) {
-    throw new Error(
-      `TANSTACK_DB_OP_SQLITE_ORACLE_RUNS must be a positive integer`,
-    )
-  }
-  return runs
-}
-
 const aliasOracleRuns = readAliasOracleRuns()
 // Replay coordinates come from the shared TANSTACK_DB_ORACLE_* variables.
 const aliasOracleReplay = readOracleRunConfig()
@@ -635,91 +174,6 @@ function expectAliasGrammar<TAlias extends string>(
   )
 }
 
-it(`configures identical fixed and seedless-random alias campaigns`, () => {
-  const runs = readAliasOracleRuns({})
-  expect(runs).toBe(oracleRuns(50))
-  expect(
-    oracleRandomParameters(runs, undefined, `op-sqlite.write-marker-aliases`),
-  ).toEqual({ numRuns: runs })
-})
-
-it(`reseeds the random alias campaigns from a seed-only replay`, () => {
-  expect(
-    oracleRandomParameters(
-      50,
-      readOracleRunConfig({ TANSTACK_DB_ORACLE_SEED: `271828` }),
-      `op-sqlite.write-marker-aliases`,
-    ),
-  ).toEqual({ numRuns: 50, seed: 271828 })
-})
-
-it(`selects exactly one alias property and shrink path for replay`, () => {
-  const replay = readOracleRunConfig({
-    TANSTACK_DB_ORACLE_SEED: `271828`,
-    TANSTACK_DB_ORACLE_PATH: `0:1`,
-    TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.columnar-sql-aliases`,
-  })
-
-  expect(
-    oracleRandomParameters(50, replay, `op-sqlite.write-marker-aliases`),
-  ).toEqual({ numRuns: 50, seed: 271828 })
-  expect(
-    oracleRandomParameters(50, replay, `op-sqlite.columnar-sql-aliases`),
-  ).toMatchObject({ numRuns: 1, seed: 271828, path: `0:1` })
-})
-
-it.each([
-  {
-    name: `path without seed`,
-    environment: { TANSTACK_DB_ORACLE_PATH: `0` },
-  },
-  {
-    name: `property without seed`,
-    environment: {
-      TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.write-marker-aliases`,
-    },
-  },
-  {
-    name: `seed and path without property`,
-    environment: {
-      TANSTACK_DB_ORACLE_SEED: `1`,
-      TANSTACK_DB_ORACLE_PATH: `0`,
-    },
-  },
-  {
-    name: `non-integer seed`,
-    environment: {
-      TANSTACK_DB_ORACLE_SEED: `1.5`,
-      TANSTACK_DB_ORACLE_PATH: `0`,
-      TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.write-marker-aliases`,
-    },
-  },
-  {
-    name: `invalid shrink path`,
-    environment: {
-      TANSTACK_DB_ORACLE_SEED: `1`,
-      TANSTACK_DB_ORACLE_PATH: `first`,
-      TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.write-marker-aliases`,
-    },
-  },
-  {
-    name: `unknown property`,
-    environment: {
-      TANSTACK_DB_ORACLE_SEED: `1`,
-      TANSTACK_DB_ORACLE_PATH: `0`,
-      TANSTACK_DB_ORACLE_PROPERTY: `unknown`,
-    },
-  },
-])(`rejects incomplete alias replay coordinates: $name`, ({ environment }) => {
-  expect(() => readOracleRunConfig(environment)).toThrow()
-})
-
-it(`rejects a non-integer alias run budget`, () => {
-  expect(() =>
-    readAliasOracleRuns({ TANSTACK_DB_OP_SQLITE_ORACLE_RUNS: `1.5` }),
-  ).toThrow(`TANSTACK_DB_OP_SQLITE_ORACLE_RUNS must be a positive integer`)
-})
-
 it(`controls alias grammar reconstruction, ablation, range, and exclusion`, () => {
   expectAliasGrammar(writeResultAliasesArbitrary, writeResultFieldNames)
   expectAliasGrammar(statementResultAliasesArbitrary, statementResultAliasNames)
@@ -844,21 +298,6 @@ function aliasQueryCase(aliases: ReadonlyArray<string>): {
   }
 }
 
-function trackQueryExecutions(
-  database: ReturnType<typeof createOpSQLiteTestDatabase>,
-): () => number {
-  const executeAsync = database.executeAsync
-  if (!executeAsync) {
-    throw new Error(`columnar fixture must expose executeAsync`)
-  }
-  let queryExecutions = 0
-  database.executeAsync = (sql, params) => {
-    if (/^\s*SELECT\b/i.test(sql)) queryExecutions++
-    return executeAsync.call(database, sql, params)
-  }
-  return () => queryExecutions
-}
-
 it(`preserves every statement-result field name when used as a SQL alias`, async () => {
   await withColumnarDriver(async ({ driver, queryExecutions }) => {
     const aliases = statementResultFieldNames
@@ -919,248 +358,11 @@ registerAliasOracle(
   },
 )
 
-it(`returns an exact empty row set for an empty columnar SELECT`, async () => {
-  await withColumnarDriver(async ({ driver, queryExecutions }) => {
-    await driver.exec(`CREATE TABLE empty_rows (id TEXT PRIMARY KEY)`)
-
-    expectExactRows(
-      await driver.query<{ id: string }>(`SELECT id FROM empty_rows`),
-      [],
-    )
-    expect(queryExecutions()).toBe(1)
-  })
-})
-
-it(`preserves a __proto__ column as own data without changing the row prototype`, async () => {
-  const [row] = await queryInjectedResult<Record<string, unknown>>({
-    rowsAffected: 0,
-    rawRows: [[`ordinary-data`]],
-    columnNames: [`__proto__`],
-  })
-
-  expect(Object.getPrototypeOf(row)).toBe(Object.prototype)
-  expect(Object.prototype.hasOwnProperty.call(row, `__proto__`)).toBe(true)
-  expect(row?.[`__proto__`]).toBe(`ordinary-data`)
-})
-
-it(`preserves a constructor column as own data without changing the row prototype`, async () => {
-  const [row] = await queryInjectedResult<Record<string, unknown>>({
-    rowsAffected: 0,
-    rawRows: [[`ordinary-data`]],
-    columnNames: [`constructor`],
-  })
-
-  expect(Object.getPrototypeOf(row)).toBe(Object.prototype)
-  expect(Object.prototype.hasOwnProperty.call(row, `constructor`)).toBe(true)
-  expect(row?.[`constructor`]).toBe(`ordinary-data`)
-})
-
-const malformedColumnarResults: ReadonlyArray<{
-  name: string
-  result: unknown
-}> = [
-  {
-    name: `null result`,
-    result: null,
-  },
-  {
-    name: `undefined result`,
-    result: undefined,
-  },
-  {
-    name: `empty object`,
-    result: {},
-  },
-  {
-    name: `primitive result`,
-    result: 42,
-  },
-  {
-    name: `rawRows without columnNames`,
-    result: { rowsAffected: 0, rawRows: [[`1`]] },
-  },
-  {
-    name: `columnNames without rawRows`,
-    result: { rowsAffected: 0, columnNames: [`id`] },
-  },
-  {
-    name: `wrapped rawRows without columnNames`,
-    result: [{ rowsAffected: 0, rawRows: [[`1`]] }],
-  },
-  {
-    name: `wrapped columnNames without rawRows`,
-    result: [{ rowsAffected: 0, columnNames: [`id`] }],
-  },
-  {
-    name: `row shorter than columnNames`,
-    result: {
-      rowsAffected: 0,
-      rawRows: [[`1`]],
-      columnNames: [`id`, `title`],
-    },
-  },
-  {
-    name: `row wider than columnNames`,
-    result: {
-      rowsAffected: 0,
-      rawRows: [[`1`, `extra`]],
-      columnNames: [`id`],
-    },
-  },
-  {
-    name: `non-array raw row`,
-    result: {
-      rowsAffected: 0,
-      rawRows: [{ id: `1` }],
-      columnNames: [`id`],
-    },
-  },
-  {
-    name: `nonempty rawRows with no column names`,
-    result: {
-      rowsAffected: 0,
-      rawRows: [[]],
-      columnNames: [],
-    },
-  },
-  {
-    name: `unknown row carrier beside a write marker`,
-    result: { rowsAffected: 0, mysteryRows: [[`1`]] },
-  },
-  {
-    name: `unknown envelope without a write marker`,
-    result: { mysteryRows: [[`1`]] },
-  },
-  {
-    name: `optional res field without the required rows carrier`,
-    result: { rowsAffected: 0, res: [{ id: `legacy` }] },
-  },
-  {
-    name: `columnar rows with a conflicting resultRows carrier`,
-    result: {
-      rowsAffected: 0,
-      rawRows: [[`columnar`]],
-      columnNames: [`id`],
-      resultRows: [{ id: `conflict` }],
-    },
-  },
-  {
-    name: `columnar rows with a conflicting nested results carrier`,
-    result: {
-      rowsAffected: 0,
-      rawRows: [[`columnar`]],
-      columnNames: [`id`],
-      results: [{ rows: [{ id: `conflict` }] }],
-    },
-  },
-]
-
-function expectMalformedQueryRejected(
-  outcome: PromiseSettledResult<ReadonlyArray<unknown>>,
-): void {
-  expect(outcome.status).toBe(`rejected`)
-  if (outcome.status === `rejected`) {
-    expect(outcome.reason).toBeInstanceOf(InvalidPersistedCollectionConfigError)
-  }
-}
-
-it.each(malformedColumnarResults)(
-  `throws for malformed or unknown SELECT result: $name`,
-  async ({ result }) => {
-    let queryExecutions = 0
-    const database: OpSQLiteDatabaseLike = {
-      executeAsync: () => {
-        queryExecutions++
-        return Promise.resolve(result)
-      },
-    }
-    const driver = new OpSQLiteDriver({ database })
-
-    const [outcome] = await Promise.allSettled([
-      driver.query(`SELECT id FROM malformed_result`),
-    ])
-    expect(queryExecutions).toBe(1)
-    expectMalformedQueryRejected(outcome)
-  },
-)
-
-it(`supports exactly one results wrapper`, async () => {
-  let queryExecutions = 0
-  const database: OpSQLiteDatabaseLike = {
-    executeAsync: () => {
-      queryExecutions++
-      return Promise.resolve({
-        results: [{ rows: [{ id: `one-level` }] }],
-      })
-    },
-  }
-
-  await expect(
-    new OpSQLiteDriver({ database }).query(`SELECT id FROM wrapped_result`),
-  ).resolves.toEqual([{ id: `one-level` }])
-  expect(queryExecutions).toBe(1)
-})
-
-it(`rejects a multi-statement results wrapper instead of dropping results`, async () => {
-  await expect(
-    queryInjectedResult({
-      results: [
-        { rows: [{ id: `first-statement` }] },
-        { rows: [{ id: `second-statement` }] },
-      ],
-    }),
-  ).rejects.toThrow(`invalid nested results carrier`)
-})
-
-it(`models OP-SQLite writes with an empty rows carrier`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({
-    filename: dbPath,
-    resultShape: `execute-async-columnar`,
-  })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-  const executeAsync = database.executeAsync
-  if (!executeAsync) {
-    throw new Error(`columnar fixture must expose executeAsync`)
-  }
-
-  await executeAsync(`CREATE TABLE write_receipt (id INTEGER PRIMARY KEY)`)
-  await expect(
-    executeAsync(`INSERT INTO write_receipt (id) VALUES (?)`, [1]),
-  ).resolves.toMatchObject({ rowsAffected: 1, rows: [] })
-})
-
-it.each([
-  {
-    name: `second results wrapper`,
-    createResult: () => ({
-      results: [{ results: [{ rows: [{ id: `too-deep` }] }] }],
-    }),
-  },
-  {
-    name: `cyclic second-level results wrapper`,
-    createResult: () => {
-      const cyclicResult: Record<string, unknown> = {}
-      cyclicResult.results = [cyclicResult]
-      return cyclicResult
-    },
-  },
-])(`rejects unsupported results depth: $name`, async ({ createResult }) => {
-  let queryExecutions = 0
-  const database: OpSQLiteDatabaseLike = {
-    executeAsync: () => {
-      queryExecutions++
-      return Promise.resolve(createResult())
-    },
-  }
-  const [outcome] = await Promise.allSettled([
-    new OpSQLiteDriver({ database }).query(
-      `SELECT id FROM unsupported_results_depth`,
-    ),
-  ])
-
-  expect(queryExecutions).toBe(1)
-  expectMalformedQueryRejected(outcome)
+// The reference rows for a SQL alias case come from the alias list alone: no
+// production decoder runs here. Each row maps every alias to its own scalar.
+declareOracle({
+  model: [aliasQueryCase],
+  grammar: [writeResultAliasesArbitrary, statementResultAliasesArbitrary],
 })
 
 const reservedAliasWrongAnswers = (() => {
@@ -1252,385 +454,3 @@ it(`reserved-alias checker shrinks and replays the same row-law violation`, () =
     originalAliases.length,
   )
 })
-
-it(`malformed-envelope checker rejects an accepted conflicting carrier`, () => {
-  expect(() =>
-    expectMalformedQueryRejected({
-      status: `fulfilled`,
-      value: [{ id: `conflict` }],
-    }),
-  ).toThrow()
-  expectMalformedQueryRejected({
-    status: `rejected`,
-    reason: new InvalidPersistedCollectionConfigError(`invalid result`),
-  })
-})
-
-it.each([
-  {
-    name: `silently empty`,
-    actual: [],
-  },
-  {
-    name: `rows swapped`,
-    actual: [
-      { title: `Lower score`, score: 7, id: `1` },
-      { title: `Higher score`, score: 41, id: `2` },
-    ],
-  },
-  {
-    name: `first row copied into the second`,
-    actual: [
-      { title: `Higher score`, score: 41, id: `2` },
-      { title: `Higher score`, score: 41, id: `2` },
-    ],
-  },
-])(`exact-row oracle rejects hostile output: $name`, ({ actual }) => {
-  const expected = [
-    { title: `Higher score`, score: 41, id: `2` },
-    { title: `Lower score`, score: 7, id: `1` },
-  ]
-  expect(() => expectExactRows(actual, expected)).toThrow()
-  expectExactRows(expected, expected)
-})
-
-it(`rolls back transaction on failure`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({ filename: dbPath })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const driver = new OpSQLiteDriver({ database })
-  await driver.exec(
-    `CREATE TABLE tx_test (id TEXT PRIMARY KEY, title TEXT NOT NULL)`,
-  )
-
-  await expect(
-    driver.transactionWithDriver(async (transactionDriver) => {
-      await transactionDriver.run(
-        `INSERT INTO tx_test (id, title) VALUES (?, ?)`,
-        [`1`, `First`],
-      )
-      await transactionDriver.run(
-        `INSERT INTO tx_test (missing_column) VALUES (?)`,
-        [`x`],
-      )
-    }),
-  ).rejects.toThrow()
-
-  const rows = await driver.query<{ count: number }>(
-    `SELECT COUNT(*) AS count FROM tx_test`,
-  )
-  expect(rows[0]?.count).toBe(0)
-})
-
-it(`supports nested savepoint rollback without losing outer transaction`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({ filename: dbPath })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const driver = new OpSQLiteDriver({ database })
-  await driver.exec(
-    `CREATE TABLE nested_tx_test (id TEXT PRIMARY KEY, title TEXT NOT NULL)`,
-  )
-
-  await driver.transactionWithDriver(async (outerTransactionDriver) => {
-    await outerTransactionDriver.run(
-      `INSERT INTO nested_tx_test (id, title) VALUES (?, ?)`,
-      [`1`, `Outer before`],
-    )
-
-    await expect(
-      outerTransactionDriver.transaction(async (innerTransactionDriver) => {
-        await innerTransactionDriver.run(
-          `INSERT INTO nested_tx_test (id, title) VALUES (?, ?)`,
-          [`2`, `Inner failing`],
-        )
-        throw new Error(`nested-failure`)
-      }),
-    ).rejects.toThrow(`nested-failure`)
-
-    await outerTransactionDriver.run(
-      `INSERT INTO nested_tx_test (id, title) VALUES (?, ?)`,
-      [`3`, `Outer after`],
-    )
-  })
-
-  const rows = await driver.query<{ id: string; title: string }>(
-    `SELECT id, title FROM nested_tx_test ORDER BY id ASC`,
-  )
-  expect(rows).toEqual([
-    { id: `1`, title: `Outer before` },
-    { id: `3`, title: `Outer after` },
-  ])
-})
-
-it(`supports transaction callbacks that use provided transaction driver`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({ filename: dbPath })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const driver = new OpSQLiteDriver({ database })
-  await driver.exec(`CREATE TABLE closure_tx_test (value INTEGER NOT NULL)`)
-
-  let resolveHold: (() => void) | undefined
-  const hold = new Promise<void>((resolve) => {
-    resolveHold = resolve
-  })
-  let resolveEntered: (() => void) | undefined
-  const entered = new Promise<void>((resolve) => {
-    resolveEntered = resolve
-  })
-
-  const txPromise = driver.transaction(async (transactionDriver) => {
-    if (!resolveEntered) {
-      throw new Error(`transaction entry signal missing`)
-    }
-    resolveEntered()
-    await transactionDriver.run(
-      `INSERT INTO closure_tx_test (value) VALUES (?)`,
-      [1],
-    )
-    await hold
-    await transactionDriver.run(
-      `INSERT INTO closure_tx_test (value) VALUES (?)`,
-      [2],
-    )
-  })
-
-  await entered
-
-  let outsideResolved = false
-  const outsidePromise = driver
-    .run(`INSERT INTO closure_tx_test (value) VALUES (?)`, [3])
-    .then(() => {
-      outsideResolved = true
-    })
-
-  await Promise.resolve()
-  expect(outsideResolved).toBe(false)
-
-  if (!resolveHold) {
-    throw new Error(`transaction hold signal missing`)
-  }
-  resolveHold()
-
-  await Promise.all([txPromise, outsidePromise])
-
-  const rows = await driver.query<{ value: number }>(
-    `SELECT value FROM closure_tx_test ORDER BY value ASC`,
-  )
-  expect(rows.map((row) => row.value)).toEqual([1, 2, 3])
-})
-
-it(`throws when transaction callback omits transaction driver argument`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({ filename: dbPath })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const driver = new OpSQLiteDriver({ database })
-
-  await expect(
-    driver.transaction((() => Promise.resolve()) as never),
-  ).rejects.toThrow(`transaction driver argument`)
-})
-
-it(`serializes unrelated operations behind an active transaction`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({ filename: dbPath })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const driver = new OpSQLiteDriver({ database })
-  await driver.exec(
-    `CREATE TABLE tx_scope_test (id TEXT PRIMARY KEY, title TEXT NOT NULL)`,
-  )
-
-  let resolveOuterTransaction: (() => void) | undefined
-  const outerTransactionGate = new Promise<void>((resolve) => {
-    resolveOuterTransaction = resolve
-  })
-
-  let signalOuterInsertComplete: (() => void) | undefined
-  const outerInsertComplete = new Promise<void>((resolve) => {
-    signalOuterInsertComplete = resolve
-  })
-
-  const outerTransaction = driver.transactionWithDriver(
-    async (transactionDriver) => {
-      await transactionDriver.run(
-        `INSERT INTO tx_scope_test (id, title) VALUES (?, ?)`,
-        [`outer`, `Inside transaction`],
-      )
-      signalOuterInsertComplete?.()
-      await outerTransactionGate
-      throw new Error(`rollback-outer-transaction`)
-    },
-  )
-
-  await outerInsertComplete
-
-  let unrelatedWriteCompleted = false
-  const unrelatedWrite = driver
-    .run(`INSERT INTO tx_scope_test (id, title) VALUES (?, ?)`, [
-      `outside`,
-      `Outside transaction`,
-    ])
-    .then(() => {
-      unrelatedWriteCompleted = true
-    })
-  await Promise.resolve()
-  expect(unrelatedWriteCompleted).toBe(false)
-
-  resolveOuterTransaction?.()
-
-  await expect(outerTransaction).rejects.toThrow(`rollback-outer-transaction`)
-  await unrelatedWrite
-
-  const rows = await driver.query<{ id: string; title: string }>(
-    `SELECT id, title FROM tx_scope_test ORDER BY id ASC`,
-  )
-  expect(rows).toEqual([{ id: `outside`, title: `Outside transaction` }])
-})
-
-it(`serializes transactions across drivers for one database handle`, async () => {
-  const dbPath = createTempSqlitePath()
-  const database = createOpSQLiteTestDatabase({ filename: dbPath })
-  activeCleanupFns.push(() => Promise.resolve(database.close()))
-
-  const firstDriver = new OpSQLiteDriver({ database })
-  const secondDriver = new OpSQLiteDriver({ database })
-  await firstDriver.exec(`CREATE TABLE shared_tx_test (value INTEGER NOT NULL)`)
-
-  const firstTransaction = firstDriver.transaction(
-    async (transactionDriver) => {
-      await transactionDriver.run(
-        `INSERT INTO shared_tx_test (value) VALUES (?)`,
-        [1],
-      )
-      await Promise.resolve()
-      await transactionDriver.run(
-        `INSERT INTO shared_tx_test (value) VALUES (?)`,
-        [2],
-      )
-    },
-  )
-  const secondTransaction = secondDriver.transaction(
-    async (transactionDriver) => {
-      await transactionDriver.run(
-        `INSERT INTO shared_tx_test (value) VALUES (?)`,
-        [3],
-      )
-    },
-  )
-
-  await Promise.all([firstTransaction, secondTransaction])
-
-  const rows = await firstDriver.query<{ value: number }>(
-    `SELECT value FROM shared_tx_test ORDER BY rowid ASC`,
-  )
-  expect(rows.map((row) => row.value)).toEqual([1, 2, 3])
-})
-
-it(`throws config error when db execute methods are missing`, () => {
-  expect(() => new OpSQLiteDriver({ database: {} as never })).toThrowError(
-    InvalidPersistedCollectionConfigError,
-  )
-})
-
-function createColumnarDriverHarness(
-  createDatabase: typeof createOpSQLiteTestDatabase = createOpSQLiteTestDatabase,
-): ReturnType<SQLiteDriverContractHarnessFactory> {
-  const tempDirectory = mkdtempSync(join(tmpdir(), `db-rn-op-sqlite-contract-`))
-  let database: ReturnType<typeof createOpSQLiteTestDatabase> | undefined
-  try {
-    const createdDatabase = createDatabase({
-      filename: join(tempDirectory, `state.sqlite`),
-      resultShape: `execute-async-columnar`,
-    })
-    database = createdDatabase
-    const driver = new OpSQLiteDriver({ database: createdDatabase })
-
-    return {
-      driver,
-      cleanup: async () => {
-        const cleanupErrors: Array<unknown> = []
-        try {
-          await Promise.resolve(createdDatabase.close())
-        } catch (error) {
-          cleanupErrors.push(error)
-        }
-        try {
-          rmSync(tempDirectory, { recursive: true, force: true })
-        } catch (error) {
-          cleanupErrors.push(error)
-        }
-        if (cleanupErrors.length === 1) throw cleanupErrors[0]
-        if (cleanupErrors.length > 1) {
-          throw new AggregateError(
-            cleanupErrors,
-            `op-sqlite contract cleanup failed`,
-            { cause: cleanupErrors[0] },
-          )
-        }
-      },
-    }
-  } catch (error) {
-    const cleanupErrors: Array<unknown> = []
-    try {
-      database?.close()
-    } catch (cleanupError) {
-      cleanupErrors.push(cleanupError)
-    }
-    try {
-      rmSync(tempDirectory, { recursive: true, force: true })
-    } catch (cleanupError) {
-      cleanupErrors.push(cleanupError)
-    }
-    if (cleanupErrors.length > 0) {
-      throw new AggregateError(
-        [error, ...cleanupErrors],
-        `op-sqlite contract construction and cleanup failed`,
-        { cause: error },
-      )
-    }
-    throw error
-  }
-}
-
-it(`removes the contract directory when database construction fails`, () => {
-  let tempDirectory: string | undefined
-  expect(() =>
-    createColumnarDriverHarness(({ filename }) => {
-      const directory = dirname(filename)
-      tempDirectory = directory
-      activeCleanupFns.push(() => {
-        rmSync(directory, { recursive: true, force: true })
-      })
-      throw new Error(`construction failed`)
-    }),
-  ).toThrow(`construction failed`)
-  expect(tempDirectory).toBeDefined()
-  expect(existsSync(tempDirectory!)).toBe(false)
-})
-
-it(`closes the database and removes the contract directory when driver construction fails`, () => {
-  let tempDirectory: string | undefined
-  let closed = false
-  expect(() =>
-    createColumnarDriverHarness(({ filename }) => {
-      tempDirectory = dirname(filename)
-      return {
-        close: () => {
-          closed = true
-        },
-      }
-    }),
-  ).toThrow(`execute/executeAsync/executeRaw/execAsync`)
-  expect(closed).toBe(true)
-  expect(tempDirectory).toBeDefined()
-  expect(existsSync(tempDirectory!)).toBe(false)
-})
-
-runSQLiteDriverContractSuite(
-  `op-sqlite executeAsync columnar driver`,
-  createColumnarDriverHarness,
-)
diff --git a/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-support.ts b/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-support.ts
new file mode 100644
index 0000000000..d00e201f09
--- /dev/null
+++ b/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-support.ts
@@ -0,0 +1,275 @@
+/**
+ * Shared helpers for the op-sqlite driver tests: temporary databases, columnar
+ * test harnesses, and the exact-row checkers. The ordinary driver tests in
+ * op-sqlite-driver.test.ts and the alias owner in op-sqlite-driver-oracle.test.ts
+ * import them. The checkers compare with the rows their caller supplies, so
+ * they state no expectation of their own.
+ */
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect } from 'vitest'
+import { oracleRuns } from '../../db/tests/oracle-config.js'
+import { OpSQLiteDriver } from '../src/op-sqlite-driver'
+import { createOpSQLiteTestDatabase } from './helpers/op-sqlite-test-db'
+import type { SQLiteDriverContractHarnessFactory } from '../../db-sqlite-persistence-core/tests/contracts/sqlite-driver-contract'
+
+export const activeCleanupFns: Array<() => void | Promise<void>> = []
+
+export async function runActiveCleanupFns(): Promise<void> {
+  const cleanupErrors: Array<unknown> = []
+  while (activeCleanupFns.length > 0) {
+    const cleanupFn = activeCleanupFns.pop()
+    try {
+      await Promise.resolve(cleanupFn?.())
+    } catch (error) {
+      cleanupErrors.push(error)
+    }
+  }
+  if (cleanupErrors.length === 1) {
+    throw cleanupErrors[0]
+  }
+  if (cleanupErrors.length > 1) {
+    throw new AggregateError(cleanupErrors, `op-sqlite test cleanup failed`, {
+      cause: cleanupErrors[0],
+    })
+  }
+}
+
+export function createTempSqlitePath(): string {
+  const tempDirectory = mkdtempSync(join(tmpdir(), `db-rn-op-sqlite-test-`))
+  const dbPath = join(tempDirectory, `state.sqlite`)
+  activeCleanupFns.push(() => {
+    rmSync(tempDirectory, { recursive: true, force: true })
+  })
+  return dbPath
+}
+
+export type ColumnarDriverHarness = {
+  driver: OpSQLiteDriver
+  queryExecutions: () => number
+}
+
+export async function withColumnarDriver<T>(
+  fn: (harness: ColumnarDriverHarness) => Promise<T>,
+): Promise<T> {
+  const tempDirectory = mkdtempSync(
+    join(tmpdir(), `db-rn-op-sqlite-alias-contract-`),
+  )
+  let database: ReturnType<typeof createOpSQLiteTestDatabase> | undefined
+  let outcome: { ok: true; value: T } | { ok: false; error: unknown }
+  try {
+    database = createOpSQLiteTestDatabase({
+      filename: join(tempDirectory, `state.sqlite`),
+      resultShape: `execute-async-columnar`,
+    })
+    const queryExecutions = trackQueryExecutions(database)
+    const driver = new OpSQLiteDriver({ database })
+    outcome = {
+      ok: true,
+      value: await fn({ driver, queryExecutions }),
+    }
+  } catch (error) {
+    outcome = { ok: false, error }
+  }
+
+  const cleanupErrors: Array<unknown> = []
+  if (database) {
+    try {
+      await Promise.resolve(database.close())
+    } catch (error) {
+      cleanupErrors.push(error)
+    }
+  }
+  try {
+    rmSync(tempDirectory, { recursive: true, force: true })
+  } catch (error) {
+    cleanupErrors.push(error)
+  }
+
+  if (!outcome.ok) {
+    if (cleanupErrors.length > 0) {
+      throw new AggregateError(
+        [outcome.error, ...cleanupErrors],
+        `op-sqlite alias law and cleanup failed`,
+        { cause: outcome.error },
+      )
+    }
+    throw outcome.error
+  }
+  if (cleanupErrors.length === 1) throw cleanupErrors[0]
+  if (cleanupErrors.length > 1) {
+    throw new AggregateError(cleanupErrors, `op-sqlite alias cleanup failed`, {
+      cause: cleanupErrors[0],
+    })
+  }
+  return outcome.value
+}
+
+export async function queryInjectedResult<T = unknown>(
+  result: unknown,
+  arrayResultMode?: `rows` | `statement-results`,
+): Promise<ReadonlyArray<T>> {
+  return new OpSQLiteDriver({
+    database: {
+      executeAsync: () => Promise.resolve(result),
+    },
+    ...(arrayResultMode ? { arrayResultMode } : {}),
+  }).query<T>(`SELECT * FROM injected_result`)
+}
+
+export function expectExactRows<T>(
+  actual: ReadonlyArray<T>,
+  expected: ReadonlyArray<T>,
+): void {
+  expect(actual).toHaveLength(expected.length)
+  expected.forEach((row, rowIndex) => {
+    if (isRecord(row)) {
+      const actualRow = actual[rowIndex]
+      expect(Object.keys(isRecord(actualRow) ? actualRow : {})).toEqual(
+        Object.keys(row),
+      )
+    }
+    expect(actual[rowIndex]).toEqual(row)
+  })
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === `object` && value !== null && !Array.isArray(value)
+}
+
+export function expectExactAliasRows(
+  actual: ReadonlyArray<Record<string, unknown>>,
+  expected: ReadonlyArray<Record<string, unknown>>,
+): void {
+  try {
+    expect(actual).toHaveLength(expected.length)
+    expected.forEach((row, rowIndex) => {
+      expect(Object.keys(actual[rowIndex] ?? {})).toEqual(Object.keys(row))
+      expect(actual[rowIndex]).toEqual(row)
+    })
+  } catch (cause) {
+    throw new Error(`op-sqlite reserved-alias exact-row law violated`, {
+      cause,
+    })
+  }
+}
+
+export const statementResultFieldNames = [
+  `rows`,
+  `resultRows`,
+  `rawRows`,
+  `columnNames`,
+  `results`,
+  `rowsAffected`,
+  `changes`,
+  `insertId`,
+  `lastInsertRowId`,
+  `res`,
+] as const
+
+export const statementResultAliasNames = [
+  ...statementResultFieldNames,
+  `ordinary_name`,
+  `another_value`,
+] as const
+
+export const writeResultFieldNames = [
+  `rowsAffected`,
+  `changes`,
+  `insertId`,
+  `lastInsertRowId`,
+] as const
+
+export type AliasOracleEnvironment = Record<string, string | undefined>
+
+export function readAliasOracleRuns(
+  environment: AliasOracleEnvironment = process.env,
+): number {
+  // A run-count control, not a replay coordinate. Its default is the shared
+  // base count, so TANSTACK_DB_ORACLE_RUNS_MULTIPLIER still scales it.
+  const runsText =
+    environment.TANSTACK_DB_OP_SQLITE_ORACLE_RUNS ?? String(oracleRuns(50))
+  const runs = Number(runsText)
+  if (runsText.trim() === `` || !Number.isSafeInteger(runs) || runs < 1) {
+    throw new Error(
+      `TANSTACK_DB_OP_SQLITE_ORACLE_RUNS must be a positive integer`,
+    )
+  }
+  return runs
+}
+
+export function trackQueryExecutions(
+  database: ReturnType<typeof createOpSQLiteTestDatabase>,
+): () => number {
+  const executeAsync = database.executeAsync
+  if (!executeAsync) {
+    throw new Error(`columnar fixture must expose executeAsync`)
+  }
+  let queryExecutions = 0
+  database.executeAsync = (sql, params) => {
+    if (/^\s*SELECT\b/i.test(sql)) queryExecutions++
+    return executeAsync.call(database, sql, params)
+  }
+  return () => queryExecutions
+}
+
+export function createColumnarDriverHarness(
+  createDatabase: typeof createOpSQLiteTestDatabase = createOpSQLiteTestDatabase,
+): ReturnType<SQLiteDriverContractHarnessFactory> {
+  const tempDirectory = mkdtempSync(join(tmpdir(), `db-rn-op-sqlite-contract-`))
+  let database: ReturnType<typeof createOpSQLiteTestDatabase> | undefined
+  try {
+    const createdDatabase = createDatabase({
+      filename: join(tempDirectory, `state.sqlite`),
+      resultShape: `execute-async-columnar`,
+    })
+    database = createdDatabase
+    const driver = new OpSQLiteDriver({ database: createdDatabase })
+
+    return {
+      driver,
+      cleanup: async () => {
+        const cleanupErrors: Array<unknown> = []
+        try {
+          await Promise.resolve(createdDatabase.close())
+        } catch (error) {
+          cleanupErrors.push(error)
+        }
+        try {
+          rmSync(tempDirectory, { recursive: true, force: true })
+        } catch (error) {
+          cleanupErrors.push(error)
+        }
+        if (cleanupErrors.length === 1) throw cleanupErrors[0]
+        if (cleanupErrors.length > 1) {
+          throw new AggregateError(
+            cleanupErrors,
+            `op-sqlite contract cleanup failed`,
+            { cause: cleanupErrors[0] },
+          )
+        }
+      },
+    }
+  } catch (error) {
+    const cleanupErrors: Array<unknown> = []
+    try {
+      database?.close()
+    } catch (cleanupError) {
+      cleanupErrors.push(cleanupError)
+    }
+    try {
+      rmSync(tempDirectory, { recursive: true, force: true })
+    } catch (cleanupError) {
+      cleanupErrors.push(cleanupError)
+    }
+    if (cleanupErrors.length > 0) {
+      throw new AggregateError(
+        [error, ...cleanupErrors],
+        `op-sqlite contract construction and cleanup failed`,
+        { cause: error },
+      )
+    }
+    throw error
+  }
+}
diff --git a/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver.test.ts b/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver.test.ts
new file mode 100644
index 0000000000..36d5fdcdb9
--- /dev/null
+++ b/packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver.test.ts
@@ -0,0 +1,972 @@
+/**
+ * Ordinary op-sqlite driver tests: provider receipts, result-envelope decoding,
+ * transactions, and fixed SQL-alias cases. Each checks a fixed case against
+ * values written out in the test, a replay-configuration parser, or a hostile
+ * fixture. None compares with an independent model, so none is oracle coverage.
+ * The alias law and its generated checks are in op-sqlite-driver-oracle.test.ts,
+ * and the shared helpers are in op-sqlite-driver-support.ts.
+ */
+import { existsSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import {
+  oracleRandomParameters,
+  oracleRuns,
+  readOracleRunConfig,
+} from '../../db/tests/oracle-config.js'
+import { InvalidPersistedCollectionConfigError } from '../../db-sqlite-persistence-core/src'
+import { OpSQLiteDriver } from '../src/op-sqlite-driver'
+import { runSQLiteDriverContractSuite } from '../../db-sqlite-persistence-core/tests/contracts/sqlite-driver-contract'
+import { createOpSQLiteTestDatabase } from './helpers/op-sqlite-test-db'
+import { opSQLiteProviderQueryFixtures } from './fixtures/op-sqlite-provider-results'
+import {
+  activeCleanupFns,
+  createColumnarDriverHarness,
+  createTempSqlitePath,
+  expectExactRows,
+  queryInjectedResult,
+  readAliasOracleRuns,
+  runActiveCleanupFns,
+  withColumnarDriver,
+} from './op-sqlite-driver-support'
+import type { OpSQLiteDatabaseLike } from '../src/op-sqlite-driver'
+
+afterEach(runActiveCleanupFns)
+
+it.each([
+  `rows-array`,
+  `rows-object`,
+  `rows-list`,
+  `statement-array`,
+  `execute-rows-with-column-names`,
+  `execute-async-columnar`,
+] as const)(`reads query rows across result shape: %s`, async (resultShape) => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({
+    filename: dbPath,
+    resultShape,
+  })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const driver = new OpSQLiteDriver({
+    database,
+    ...(resultShape === `statement-array`
+      ? { arrayResultMode: `statement-results` as const }
+      : {}),
+  })
+  await driver.exec(
+    `CREATE TABLE todos (id TEXT PRIMARY KEY, title TEXT NOT NULL, score INTEGER NOT NULL)`,
+  )
+  await driver.run(`INSERT INTO todos (id, title, score) VALUES (?, ?, ?)`, [
+    `1`,
+    `Lower score`,
+    7,
+  ])
+  await driver.run(`INSERT INTO todos (id, title, score) VALUES (?, ?, ?)`, [
+    `2`,
+    `Higher score`,
+    41,
+  ])
+
+  const rows = await driver.query<{
+    id: string
+    title: string
+    score: number
+  }>(`SELECT title, score, id FROM todos ORDER BY score DESC`)
+  expectExactRows(rows, [
+    {
+      title: `Higher score`,
+      score: 41,
+      id: `2`,
+    },
+    {
+      title: `Lower score`,
+      score: 7,
+      id: `1`,
+    },
+  ])
+})
+
+it.each(opSQLiteProviderQueryFixtures)(
+  `decodes frozen provider receipt: $label`,
+  async ({ result, expectedRows }) => {
+    const receiptBeforeDecode = structuredClone(result)
+    const actual = await queryInjectedResult<Record<string, unknown>>(result)
+
+    expectExactRows(actual, expectedRows)
+    expect(result).toEqual(receiptBeforeDecode)
+  },
+)
+
+it(`keeps a receipt for every runtime in the current peer major`, () => {
+  expect(
+    opSQLiteProviderQueryFixtures
+      .filter(({ support }) => support === `current-peer`)
+      .map(({ providerVersion, runtime, method }) => ({
+        providerVersion,
+        runtime,
+        method,
+      })),
+  ).toEqual([
+    {
+      providerVersion: `15.2.7`,
+      runtime: `react-native`,
+      method: `executeAsync`,
+    },
+    {
+      providerVersion: `15.2.7`,
+      runtime: `node`,
+      method: `executeAsync`,
+    },
+  ])
+})
+
+it(`provider-receipt checker rejects a shim that drops provider rows`, async () => {
+  for (const { result, expectedRows } of opSQLiteProviderQueryFixtures) {
+    const decoded = await queryInjectedResult<Record<string, unknown>>({
+      ...(result as Record<string, unknown>),
+      rows: [],
+    })
+    expect(() => expectExactRows(decoded, expectedRows)).toThrow()
+  }
+})
+
+it(`requires an explicit mode for an ambiguous bare result array`, async () => {
+  const ambiguous = [{ rowsAffected: 17, rows: [`nested`] }]
+
+  await expect(queryInjectedResult(ambiguous)).rejects.toThrow(
+    `ambiguous bare result array`,
+  )
+  await expect(queryInjectedResult(ambiguous, `rows`)).resolves.toEqual(
+    ambiguous,
+  )
+  await expect(
+    queryInjectedResult(ambiguous, `statement-results`),
+  ).resolves.toEqual([`nested`])
+})
+
+it(`uses the declared mode for a markerless statement-array envelope`, async () => {
+  const ambiguous = [{ rows: [{ id: `nested-row` }] }]
+
+  await expect(queryInjectedResult(ambiguous)).rejects.toThrow(
+    `ambiguous bare result array`,
+  )
+  await expect(queryInjectedResult(ambiguous, `rows`)).resolves.toEqual(
+    ambiguous,
+  )
+  await expect(
+    queryInjectedResult(ambiguous, `statement-results`),
+  ).resolves.toEqual([{ id: `nested-row` }])
+})
+
+it(`applies the same row-carrier policy to object and declared statement envelopes`, async () => {
+  const rows = [{ id: `row-with-provider-extension` }]
+  const envelope = {
+    rows,
+    res: [{ id: `ignored-provider-res` }],
+    error: undefined,
+    providerExtension: `retained`,
+  }
+
+  await expect(queryInjectedResult(envelope)).resolves.toEqual(rows)
+  await expect(
+    queryInjectedResult([envelope], `statement-results`),
+  ).resolves.toEqual(rows)
+})
+
+it(`rejects positional rows without column metadata`, async () => {
+  const positionalRows = [[`1`, `title`, 7]]
+
+  await expect(queryInjectedResult(positionalRows)).rejects.toThrow(
+    `positional rows require column metadata`,
+  )
+  await expect(queryInjectedResult(positionalRows, `rows`)).rejects.toThrow(
+    `positional rows require column metadata`,
+  )
+})
+
+it(`rejects inherited result carriers instead of treating them as writes`, async () => {
+  let getterReads = 0
+  const prototype = Object.defineProperty({}, `rows`, {
+    get: () => {
+      getterReads++
+      return [{ id: `inherited-row` }]
+    },
+  })
+  const result = Object.assign(Object.create(prototype), { rowsAffected: 0 })
+
+  await expect(queryInjectedResult(result)).rejects.toThrow(
+    `inherited rows carrier`,
+  )
+  expect(getterReads).toBe(0)
+})
+
+it.each([undefined, null])(
+  `rejects a nullish rows carrier beside a write marker: %s`,
+  async (rows) => {
+    await expect(
+      queryInjectedResult({ rowsAffected: 0, rows }),
+    ).rejects.toThrow(`invalid rows carrier`)
+  },
+)
+
+it(`materializes a declared statement row list exactly once`, async () => {
+  const expected = [{ id: `first` }, { id: `second` }]
+  const requestedIndexes: Array<number> = []
+  const rows = {
+    length: expected.length,
+    item: (index: number) => {
+      requestedIndexes.push(index)
+      return expected[index]
+    },
+  }
+
+  await expect(
+    queryInjectedResult([{ rowsAffected: 0, rows }], `statement-results`),
+  ).resolves.toEqual(expected)
+  expect(requestedIndexes).toEqual([0, 1])
+})
+
+it.each([
+  { name: `NaN`, length: Number.NaN },
+  { name: `negative`, length: -1 },
+  { name: `fractional`, length: 1.5 },
+])(`rejects a $name statement row-list length`, async ({ length }) => {
+  await expect(
+    queryInjectedResult(
+      [{ rowsAffected: 0, rows: { length, item: () => ({ id: `row` }) } }],
+      `statement-results`,
+    ),
+  ).rejects.toThrow(`invalid rows carrier`)
+})
+
+it(`rejects an empty array in statement-results mode`, async () => {
+  await expect(queryInjectedResult([], `statement-results`)).rejects.toThrow(
+    `statement-result arrays must contain exactly one result`,
+  )
+  await expect(queryInjectedResult([], `rows`)).resolves.toEqual([])
+  await expect(queryInjectedResult([])).resolves.toEqual([])
+})
+
+it(`reads op-sqlite execute rows when columnNames metadata is also present`, async () => {
+  await expect(
+    queryInjectedResult({
+      rowsAffected: 0,
+      rows: [{ id: `node-or-web-row` }],
+      columnNames: [`id`],
+    }),
+  ).resolves.toEqual([{ id: `node-or-web-row` }])
+})
+
+it(`prefers object rows when op-sqlite also supplies raw columnar rows`, async () => {
+  await expect(
+    queryInjectedResult({
+      rowsAffected: 0,
+      rows: [{ id: `object-row` }],
+      rawRows: [[`raw-row`]],
+      columnNames: [`id`],
+    }),
+  ).resolves.toEqual([{ id: `object-row` }])
+})
+
+it.each([
+  `rows`,
+  `resultRows`,
+  `rawRows`,
+  `columnNames`,
+  `results`,
+  `res`,
+] as const)(
+  `preserves a direct data row with non-scalar %s alias`,
+  async (alias) => {
+    const row = {
+      [alias]: [`nested`, `value`],
+      rowsAffected: 17,
+      ordinary_name: `ordinary-value`,
+    }
+    await expect(queryInjectedResult([row])).resolves.toEqual([row])
+  },
+)
+
+it(`decodes legal duplicate SQLite column names with the last-value law`, async () => {
+  await withColumnarDriver(async ({ driver }) => {
+    await expect(
+      driver.query(`SELECT 'left-id' AS id, 'right-id' AS id`),
+    ).resolves.toEqual([{ id: `right-id` }])
+  })
+})
+
+it(`reads object and structural statement-array write envelopes as empty`, async () => {
+  const writeResult = { rowsAffected: 1, insertId: 17 }
+  await expect(queryInjectedResult(writeResult)).resolves.toEqual([])
+  await expect(
+    queryInjectedResult([{ ...writeResult, rows: [] }], `statement-results`),
+  ).resolves.toEqual([])
+})
+
+it.each([
+  {
+    name: `one row with a rowsAffected alias`,
+    rows: [{ rowsAffected: 42 }],
+  },
+  {
+    name: `multiple rows with a changes alias`,
+    rows: [{ changes: 1 }, { changes: 2 }],
+  },
+])(
+  `preserves direct data rows containing only write aliases: $name`,
+  async ({ rows }) => {
+    await expect(queryInjectedResult(rows)).resolves.toEqual(rows)
+  },
+)
+
+it(`configures identical fixed and seedless-random alias campaigns`, () => {
+  const runs = readAliasOracleRuns({})
+  expect(runs).toBe(oracleRuns(50))
+  expect(
+    oracleRandomParameters(runs, undefined, `op-sqlite.write-marker-aliases`),
+  ).toEqual({ numRuns: runs })
+})
+
+it(`reseeds the random alias campaigns from a seed-only replay`, () => {
+  expect(
+    oracleRandomParameters(
+      50,
+      readOracleRunConfig({ TANSTACK_DB_ORACLE_SEED: `271828` }),
+      `op-sqlite.write-marker-aliases`,
+    ),
+  ).toEqual({ numRuns: 50, seed: 271828 })
+})
+
+it(`selects exactly one alias property and shrink path for replay`, () => {
+  const replay = readOracleRunConfig({
+    TANSTACK_DB_ORACLE_SEED: `271828`,
+    TANSTACK_DB_ORACLE_PATH: `0:1`,
+    TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.columnar-sql-aliases`,
+  })
+
+  expect(
+    oracleRandomParameters(50, replay, `op-sqlite.write-marker-aliases`),
+  ).toEqual({ numRuns: 50, seed: 271828 })
+  expect(
+    oracleRandomParameters(50, replay, `op-sqlite.columnar-sql-aliases`),
+  ).toMatchObject({ numRuns: 1, seed: 271828, path: `0:1` })
+})
+
+it.each([
+  {
+    name: `path without seed`,
+    environment: { TANSTACK_DB_ORACLE_PATH: `0` },
+  },
+  {
+    name: `property without seed`,
+    environment: {
+      TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.write-marker-aliases`,
+    },
+  },
+  {
+    name: `seed and path without property`,
+    environment: {
+      TANSTACK_DB_ORACLE_SEED: `1`,
+      TANSTACK_DB_ORACLE_PATH: `0`,
+    },
+  },
+  {
+    name: `non-integer seed`,
+    environment: {
+      TANSTACK_DB_ORACLE_SEED: `1.5`,
+      TANSTACK_DB_ORACLE_PATH: `0`,
+      TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.write-marker-aliases`,
+    },
+  },
+  {
+    name: `invalid shrink path`,
+    environment: {
+      TANSTACK_DB_ORACLE_SEED: `1`,
+      TANSTACK_DB_ORACLE_PATH: `first`,
+      TANSTACK_DB_ORACLE_PROPERTY: `op-sqlite.write-marker-aliases`,
+    },
+  },
+  {
+    name: `unknown property`,
+    environment: {
+      TANSTACK_DB_ORACLE_SEED: `1`,
+      TANSTACK_DB_ORACLE_PATH: `0`,
+      TANSTACK_DB_ORACLE_PROPERTY: `unknown`,
+    },
+  },
+])(`rejects incomplete alias replay coordinates: $name`, ({ environment }) => {
+  expect(() => readOracleRunConfig(environment)).toThrow()
+})
+
+it(`rejects a non-integer alias run budget`, () => {
+  expect(() =>
+    readAliasOracleRuns({ TANSTACK_DB_OP_SQLITE_ORACLE_RUNS: `1.5` }),
+  ).toThrow(`TANSTACK_DB_OP_SQLITE_ORACLE_RUNS must be a positive integer`)
+})
+
+it(`returns an exact empty row set for an empty columnar SELECT`, async () => {
+  await withColumnarDriver(async ({ driver, queryExecutions }) => {
+    await driver.exec(`CREATE TABLE empty_rows (id TEXT PRIMARY KEY)`)
+
+    expectExactRows(
+      await driver.query<{ id: string }>(`SELECT id FROM empty_rows`),
+      [],
+    )
+    expect(queryExecutions()).toBe(1)
+  })
+})
+
+it(`preserves a __proto__ column as own data without changing the row prototype`, async () => {
+  const [row] = await queryInjectedResult<Record<string, unknown>>({
+    rowsAffected: 0,
+    rawRows: [[`ordinary-data`]],
+    columnNames: [`__proto__`],
+  })
+
+  expect(Object.getPrototypeOf(row)).toBe(Object.prototype)
+  expect(Object.prototype.hasOwnProperty.call(row, `__proto__`)).toBe(true)
+  expect(row?.[`__proto__`]).toBe(`ordinary-data`)
+})
+
+it(`preserves a constructor column as own data without changing the row prototype`, async () => {
+  const [row] = await queryInjectedResult<Record<string, unknown>>({
+    rowsAffected: 0,
+    rawRows: [[`ordinary-data`]],
+    columnNames: [`constructor`],
+  })
+
+  expect(Object.getPrototypeOf(row)).toBe(Object.prototype)
+  expect(Object.prototype.hasOwnProperty.call(row, `constructor`)).toBe(true)
+  expect(row?.[`constructor`]).toBe(`ordinary-data`)
+})
+
+const malformedColumnarResults: ReadonlyArray<{
+  name: string
+  result: unknown
+}> = [
+  {
+    name: `null result`,
+    result: null,
+  },
+  {
+    name: `undefined result`,
+    result: undefined,
+  },
+  {
+    name: `empty object`,
+    result: {},
+  },
+  {
+    name: `primitive result`,
+    result: 42,
+  },
+  {
+    name: `rawRows without columnNames`,
+    result: { rowsAffected: 0, rawRows: [[`1`]] },
+  },
+  {
+    name: `columnNames without rawRows`,
+    result: { rowsAffected: 0, columnNames: [`id`] },
+  },
+  {
+    name: `wrapped rawRows without columnNames`,
+    result: [{ rowsAffected: 0, rawRows: [[`1`]] }],
+  },
+  {
+    name: `wrapped columnNames without rawRows`,
+    result: [{ rowsAffected: 0, columnNames: [`id`] }],
+  },
+  {
+    name: `row shorter than columnNames`,
+    result: {
+      rowsAffected: 0,
+      rawRows: [[`1`]],
+      columnNames: [`id`, `title`],
+    },
+  },
+  {
+    name: `row wider than columnNames`,
+    result: {
+      rowsAffected: 0,
+      rawRows: [[`1`, `extra`]],
+      columnNames: [`id`],
+    },
+  },
+  {
+    name: `non-array raw row`,
+    result: {
+      rowsAffected: 0,
+      rawRows: [{ id: `1` }],
+      columnNames: [`id`],
+    },
+  },
+  {
+    name: `nonempty rawRows with no column names`,
+    result: {
+      rowsAffected: 0,
+      rawRows: [[]],
+      columnNames: [],
+    },
+  },
+  {
+    name: `unknown row carrier beside a write marker`,
+    result: { rowsAffected: 0, mysteryRows: [[`1`]] },
+  },
+  {
+    name: `unknown envelope without a write marker`,
+    result: { mysteryRows: [[`1`]] },
+  },
+  {
+    name: `optional res field without the required rows carrier`,
+    result: { rowsAffected: 0, res: [{ id: `legacy` }] },
+  },
+  {
+    name: `columnar rows with a conflicting resultRows carrier`,
+    result: {
+      rowsAffected: 0,
+      rawRows: [[`columnar`]],
+      columnNames: [`id`],
+      resultRows: [{ id: `conflict` }],
+    },
+  },
+  {
+    name: `columnar rows with a conflicting nested results carrier`,
+    result: {
+      rowsAffected: 0,
+      rawRows: [[`columnar`]],
+      columnNames: [`id`],
+      results: [{ rows: [{ id: `conflict` }] }],
+    },
+  },
+]
+
+function expectMalformedQueryRejected(
+  outcome: PromiseSettledResult<ReadonlyArray<unknown>>,
+): void {
+  expect(outcome.status).toBe(`rejected`)
+  if (outcome.status === `rejected`) {
+    expect(outcome.reason).toBeInstanceOf(InvalidPersistedCollectionConfigError)
+  }
+}
+
+it.each(malformedColumnarResults)(
+  `throws for malformed or unknown SELECT result: $name`,
+  async ({ result }) => {
+    let queryExecutions = 0
+    const database: OpSQLiteDatabaseLike = {
+      executeAsync: () => {
+        queryExecutions++
+        return Promise.resolve(result)
+      },
+    }
+    const driver = new OpSQLiteDriver({ database })
+
+    const [outcome] = await Promise.allSettled([
+      driver.query(`SELECT id FROM malformed_result`),
+    ])
+    expect(queryExecutions).toBe(1)
+    expectMalformedQueryRejected(outcome)
+  },
+)
+
+it(`supports exactly one results wrapper`, async () => {
+  let queryExecutions = 0
+  const database: OpSQLiteDatabaseLike = {
+    executeAsync: () => {
+      queryExecutions++
+      return Promise.resolve({
+        results: [{ rows: [{ id: `one-level` }] }],
+      })
+    },
+  }
+
+  await expect(
+    new OpSQLiteDriver({ database }).query(`SELECT id FROM wrapped_result`),
+  ).resolves.toEqual([{ id: `one-level` }])
+  expect(queryExecutions).toBe(1)
+})
+
+it(`rejects a multi-statement results wrapper instead of dropping results`, async () => {
+  await expect(
+    queryInjectedResult({
+      results: [
+        { rows: [{ id: `first-statement` }] },
+        { rows: [{ id: `second-statement` }] },
+      ],
+    }),
+  ).rejects.toThrow(`invalid nested results carrier`)
+})
+
+it(`models OP-SQLite writes with an empty rows carrier`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({
+    filename: dbPath,
+    resultShape: `execute-async-columnar`,
+  })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+  const executeAsync = database.executeAsync
+  if (!executeAsync) {
+    throw new Error(`columnar fixture must expose executeAsync`)
+  }
+
+  await executeAsync(`CREATE TABLE write_receipt (id INTEGER PRIMARY KEY)`)
+  await expect(
+    executeAsync(`INSERT INTO write_receipt (id) VALUES (?)`, [1]),
+  ).resolves.toMatchObject({ rowsAffected: 1, rows: [] })
+})
+
+it.each([
+  {
+    name: `second results wrapper`,
+    createResult: () => ({
+      results: [{ results: [{ rows: [{ id: `too-deep` }] }] }],
+    }),
+  },
+  {
+    name: `cyclic second-level results wrapper`,
+    createResult: () => {
+      const cyclicResult: Record<string, unknown> = {}
+      cyclicResult.results = [cyclicResult]
+      return cyclicResult
+    },
+  },
+])(`rejects unsupported results depth: $name`, async ({ createResult }) => {
+  let queryExecutions = 0
+  const database: OpSQLiteDatabaseLike = {
+    executeAsync: () => {
+      queryExecutions++
+      return Promise.resolve(createResult())
+    },
+  }
+  const [outcome] = await Promise.allSettled([
+    new OpSQLiteDriver({ database }).query(
+      `SELECT id FROM unsupported_results_depth`,
+    ),
+  ])
+
+  expect(queryExecutions).toBe(1)
+  expectMalformedQueryRejected(outcome)
+})
+
+it(`malformed-envelope checker rejects an accepted conflicting carrier`, () => {
+  expect(() =>
+    expectMalformedQueryRejected({
+      status: `fulfilled`,
+      value: [{ id: `conflict` }],
+    }),
+  ).toThrow()
+  expectMalformedQueryRejected({
+    status: `rejected`,
+    reason: new InvalidPersistedCollectionConfigError(`invalid result`),
+  })
+})
+
+it.each([
+  {
+    name: `silently empty`,
+    actual: [],
+  },
+  {
+    name: `rows swapped`,
+    actual: [
+      { title: `Lower score`, score: 7, id: `1` },
+      { title: `Higher score`, score: 41, id: `2` },
+    ],
+  },
+  {
+    name: `first row copied into the second`,
+    actual: [
+      { title: `Higher score`, score: 41, id: `2` },
+      { title: `Higher score`, score: 41, id: `2` },
+    ],
+  },
+])(`exact-row oracle rejects hostile output: $name`, ({ actual }) => {
+  const expected = [
+    { title: `Higher score`, score: 41, id: `2` },
+    { title: `Lower score`, score: 7, id: `1` },
+  ]
+  expect(() => expectExactRows(actual, expected)).toThrow()
+  expectExactRows(expected, expected)
+})
+
+it(`rolls back transaction on failure`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({ filename: dbPath })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const driver = new OpSQLiteDriver({ database })
+  await driver.exec(
+    `CREATE TABLE tx_test (id TEXT PRIMARY KEY, title TEXT NOT NULL)`,
+  )
+
+  await expect(
+    driver.transactionWithDriver(async (transactionDriver) => {
+      await transactionDriver.run(
+        `INSERT INTO tx_test (id, title) VALUES (?, ?)`,
+        [`1`, `First`],
+      )
+      await transactionDriver.run(
+        `INSERT INTO tx_test (missing_column) VALUES (?)`,
+        [`x`],
+      )
+    }),
+  ).rejects.toThrow()
+
+  const rows = await driver.query<{ count: number }>(
+    `SELECT COUNT(*) AS count FROM tx_test`,
+  )
+  expect(rows[0]?.count).toBe(0)
+})
+
+it(`supports nested savepoint rollback without losing outer transaction`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({ filename: dbPath })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const driver = new OpSQLiteDriver({ database })
+  await driver.exec(
+    `CREATE TABLE nested_tx_test (id TEXT PRIMARY KEY, title TEXT NOT NULL)`,
+  )
+
+  await driver.transactionWithDriver(async (outerTransactionDriver) => {
+    await outerTransactionDriver.run(
+      `INSERT INTO nested_tx_test (id, title) VALUES (?, ?)`,
+      [`1`, `Outer before`],
+    )
+
+    await expect(
+      outerTransactionDriver.transaction(async (innerTransactionDriver) => {
+        await innerTransactionDriver.run(
+          `INSERT INTO nested_tx_test (id, title) VALUES (?, ?)`,
+          [`2`, `Inner failing`],
+        )
+        throw new Error(`nested-failure`)
+      }),
+    ).rejects.toThrow(`nested-failure`)
+
+    await outerTransactionDriver.run(
+      `INSERT INTO nested_tx_test (id, title) VALUES (?, ?)`,
+      [`3`, `Outer after`],
+    )
+  })
+
+  const rows = await driver.query<{ id: string; title: string }>(
+    `SELECT id, title FROM nested_tx_test ORDER BY id ASC`,
+  )
+  expect(rows).toEqual([
+    { id: `1`, title: `Outer before` },
+    { id: `3`, title: `Outer after` },
+  ])
+})
+
+it(`supports transaction callbacks that use provided transaction driver`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({ filename: dbPath })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const driver = new OpSQLiteDriver({ database })
+  await driver.exec(`CREATE TABLE closure_tx_test (value INTEGER NOT NULL)`)
+
+  let resolveHold: (() => void) | undefined
+  const hold = new Promise<void>((resolve) => {
+    resolveHold = resolve
+  })
+  let resolveEntered: (() => void) | undefined
+  const entered = new Promise<void>((resolve) => {
+    resolveEntered = resolve
+  })
+
+  const txPromise = driver.transaction(async (transactionDriver) => {
+    if (!resolveEntered) {
+      throw new Error(`transaction entry signal missing`)
+    }
+    resolveEntered()
+    await transactionDriver.run(
+      `INSERT INTO closure_tx_test (value) VALUES (?)`,
+      [1],
+    )
+    await hold
+    await transactionDriver.run(
+      `INSERT INTO closure_tx_test (value) VALUES (?)`,
+      [2],
+    )
+  })
+
+  await entered
+
+  let outsideResolved = false
+  const outsidePromise = driver
+    .run(`INSERT INTO closure_tx_test (value) VALUES (?)`, [3])
+    .then(() => {
+      outsideResolved = true
+    })
+
+  await Promise.resolve()
+  expect(outsideResolved).toBe(false)
+
+  if (!resolveHold) {
+    throw new Error(`transaction hold signal missing`)
+  }
+  resolveHold()
+
+  await Promise.all([txPromise, outsidePromise])
+
+  const rows = await driver.query<{ value: number }>(
+    `SELECT value FROM closure_tx_test ORDER BY value ASC`,
+  )
+  expect(rows.map((row) => row.value)).toEqual([1, 2, 3])
+})
+
+it(`throws when transaction callback omits transaction driver argument`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({ filename: dbPath })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const driver = new OpSQLiteDriver({ database })
+
+  await expect(
+    driver.transaction((() => Promise.resolve()) as never),
+  ).rejects.toThrow(`transaction driver argument`)
+})
+
+it(`serializes unrelated operations behind an active transaction`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({ filename: dbPath })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const driver = new OpSQLiteDriver({ database })
+  await driver.exec(
+    `CREATE TABLE tx_scope_test (id TEXT PRIMARY KEY, title TEXT NOT NULL)`,
+  )
+
+  let resolveOuterTransaction: (() => void) | undefined
+  const outerTransactionGate = new Promise<void>((resolve) => {
+    resolveOuterTransaction = resolve
+  })
+
+  let signalOuterInsertComplete: (() => void) | undefined
+  const outerInsertComplete = new Promise<void>((resolve) => {
+    signalOuterInsertComplete = resolve
+  })
+
+  const outerTransaction = driver.transactionWithDriver(
+    async (transactionDriver) => {
+      await transactionDriver.run(
+        `INSERT INTO tx_scope_test (id, title) VALUES (?, ?)`,
+        [`outer`, `Inside transaction`],
+      )
+      signalOuterInsertComplete?.()
+      await outerTransactionGate
+      throw new Error(`rollback-outer-transaction`)
+    },
+  )
+
+  await outerInsertComplete
+
+  let unrelatedWriteCompleted = false
+  const unrelatedWrite = driver
+    .run(`INSERT INTO tx_scope_test (id, title) VALUES (?, ?)`, [
+      `outside`,
+      `Outside transaction`,
+    ])
+    .then(() => {
+      unrelatedWriteCompleted = true
+    })
+  await Promise.resolve()
+  expect(unrelatedWriteCompleted).toBe(false)
+
+  resolveOuterTransaction?.()
+
+  await expect(outerTransaction).rejects.toThrow(`rollback-outer-transaction`)
+  await unrelatedWrite
+
+  const rows = await driver.query<{ id: string; title: string }>(
+    `SELECT id, title FROM tx_scope_test ORDER BY id ASC`,
+  )
+  expect(rows).toEqual([{ id: `outside`, title: `Outside transaction` }])
+})
+
+it(`serializes transactions across drivers for one database handle`, async () => {
+  const dbPath = createTempSqlitePath()
+  const database = createOpSQLiteTestDatabase({ filename: dbPath })
+  activeCleanupFns.push(() => Promise.resolve(database.close()))
+
+  const firstDriver = new OpSQLiteDriver({ database })
+  const secondDriver = new OpSQLiteDriver({ database })
+  await firstDriver.exec(`CREATE TABLE shared_tx_test (value INTEGER NOT NULL)`)
+
+  const firstTransaction = firstDriver.transaction(
+    async (transactionDriver) => {
+      await transactionDriver.run(
+        `INSERT INTO shared_tx_test (value) VALUES (?)`,
+        [1],
+      )
+      await Promise.resolve()
+      await transactionDriver.run(
+        `INSERT INTO shared_tx_test (value) VALUES (?)`,
+        [2],
+      )
+    },
+  )
+  const secondTransaction = secondDriver.transaction(
+    async (transactionDriver) => {
+      await transactionDriver.run(
+        `INSERT INTO shared_tx_test (value) VALUES (?)`,
+        [3],
+      )
+    },
+  )
+
+  await Promise.all([firstTransaction, secondTransaction])
+
+  const rows = await firstDriver.query<{ value: number }>(
+    `SELECT value FROM shared_tx_test ORDER BY rowid ASC`,
+  )
+  expect(rows.map((row) => row.value)).toEqual([1, 2, 3])
+})
+
+it(`throws config error when db execute methods are missing`, () => {
+  expect(() => new OpSQLiteDriver({ database: {} as never })).toThrowError(
+    InvalidPersistedCollectionConfigError,
+  )
+})
+
+it(`removes the contract directory when database construction fails`, () => {
+  let tempDirectory: string | undefined
+  expect(() =>
+    createColumnarDriverHarness(({ filename }) => {
+      const directory = dirname(filename)
+      tempDirectory = directory
+      activeCleanupFns.push(() => {
+        rmSync(directory, { recursive: true, force: true })
+      })
+      throw new Error(`construction failed`)
+    }),
+  ).toThrow(`construction failed`)
+  expect(tempDirectory).toBeDefined()
+  expect(existsSync(tempDirectory!)).toBe(false)
+})
+
+it(`closes the database and removes the contract directory when driver construction fails`, () => {
+  let tempDirectory: string | undefined
+  let closed = false
+  expect(() =>
+    createColumnarDriverHarness(({ filename }) => {
+      tempDirectory = dirname(filename)
+      return {
+        close: () => {
+          closed = true
+        },
+      }
+    }),
+  ).toThrow(`execute/executeAsync/executeRaw/execAsync`)
+  expect(closed).toBe(true)
+  expect(tempDirectory).toBeDefined()
+  expect(existsSync(tempDirectory!)).toBe(false)
+})
+
+runSQLiteDriverContractSuite(
+  `op-sqlite executeAsync columnar driver`,
+  createColumnarDriverHarness,
+)
diff --git a/packages/svelte-db/tests/descriptor-query-release-oracle.svelte.test.ts b/packages/svelte-db/tests/descriptor-query-release.svelte.test.ts
similarity index 100%
rename from packages/svelte-db/tests/descriptor-query-release-oracle.svelte.test.ts
rename to packages/svelte-db/tests/descriptor-query-release.svelte.test.ts
diff --git a/packages/svelte-db/tests/infinite-query-conformance.svelte.test.ts b/packages/svelte-db/tests/infinite-query-conformance.svelte.test.ts
index c1bce256af..74123a75d1 100644
--- a/packages/svelte-db/tests/infinite-query-conformance.svelte.test.ts
+++ b/packages/svelte-db/tests/infinite-query-conformance.svelte.test.ts
@@ -18,6 +18,7 @@ import { flushSync, untrack } from 'svelte'
 import { describe, expect, it } from 'vitest'
 import { mockSyncCollectionOptions } from '../../db/tests/utils'
 import { runInfiniteQuerySuite } from '../../db/tests/conformance/infinite-suite-oracle'
+import { registerInfiniteQueryUnitScenarios } from '../../db/tests/conformance/infinite-suite-cases'
 import { makeInfiniteOnDemandSource } from '../../db/tests/conformance/infinite-on-demand'
 import { withScopeSetup } from '../../db/tests/conformance/scope-setup'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery.svelte.js'
@@ -272,7 +273,7 @@ const svelteInfiniteDriver: InfiniteQueryDriver = {
   knownGaps: [],
 }
 
-runInfiniteQuerySuite(svelteInfiniteDriver)
+runInfiniteQuerySuite(svelteInfiniteDriver, registerInfiniteQueryUnitScenarios)
 
 describe(`infinite driver post-root ownership`, () => {
   it(`retains successful root until its owner disposes`, () => {
diff --git a/packages/svelte-db/tests/ssr-runtime-error-oracle.svelte.test.ts b/packages/svelte-db/tests/ssr-runtime-error-oracle.svelte.test.ts
index bc966e6443..c8ff8436db 100644
--- a/packages/svelte-db/tests/ssr-runtime-error-oracle.svelte.test.ts
+++ b/packages/svelte-db/tests/ssr-runtime-error-oracle.svelte.test.ts
@@ -30,6 +30,7 @@ import {
   oracleRuns,
 } from '../../db/tests/oracle-config'
 import { createOracleReach } from '../../db/tests/oracle-reach'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import SsrDbApp from './SsrDbApp.svelte'
 import type { createServer } from 'vite'
 import type { SsrRuntimeErrorHistory } from '../../db/tests/ssr-snapshot-admission-oracle'
@@ -215,6 +216,10 @@ async function checkRuntimeHistory(
     )
 }
 
+// checkRuntimeHistory compares the server view, the browser's first hydration
+// view and its committed view with the shared runtime model's expected views.
+declareOracle({ check: [checkRuntimeHistory] })
+
 describe(`Svelte SSR runtime errors`, () => {
   for (const history of ssrRuntimeErrorExamples)
     it.skipIf(oracleReplayRequested())(
diff --git a/packages/trailbase-db-collection/e2e/trailbase.e2e.test.ts b/packages/trailbase-db-collection/e2e/trailbase.e2e.test.ts
index 44370c4abb..6e4e5902a5 100644
--- a/packages/trailbase-db-collection/e2e/trailbase.e2e.test.ts
+++ b/packages/trailbase-db-collection/e2e/trailbase.e2e.test.ts
@@ -15,6 +15,7 @@ import {
   createDeduplicationTestSuite,
   createJoinsTestSuite,
   createLiveUpdatesTestSuite,
+  createLiveUpdatesUnitTestSuite,
   createMutationsTestSuite,
   createPaginationTestSuite,
   createPredicatesTestSuite,
@@ -484,6 +485,7 @@ describe(`TrailBase Collection E2E Tests`, async () => {
   createDeduplicationTestSuite(getConfig)
   createCollationTestSuite(getConfig)
   createMutationsTestSuite(getConfig)
+  createLiveUpdatesUnitTestSuite(getConfig)
   createLiveUpdatesTestSuite(getConfig)
   createProgressiveTestSuite(getConfig)
 })
diff --git a/packages/trailbase-db-collection/tests/ORACLE.md b/packages/trailbase-db-collection/tests/ORACLE.md
index a5e26d7f5b..a7d57a4681 100644
--- a/packages/trailbase-db-collection/tests/ORACLE.md
+++ b/packages/trailbase-db-collection/tests/ORACLE.md
@@ -85,8 +85,9 @@ The same interpreter runs a fixed corpus and generated histories.
   `error` from the end onward, with a stream failure as its cause, and only
   `reload()` or a restart clears it. Reconnecting is left to the TrailBase
   provider. A mutant that reports the end as a `failureReason` fails 29
-  lifecycle cells. A separate lane checks that a reload after a failed startup
-  settles on the new subscription's outcome while the Collection still shows
+  lifecycle cells. Fixed tests in `lifecycle.test.ts` (no oracle owner
+  (tracked in #2264)) cover the reload and aborted-load scenarios below. One
+  checks that a reload after a failed startup settles on the new subscription's outcome while the Collection still shows
   `error`. Another, `a reload of a ready eager Collection`, enumerates 10
   histories (one or two pages; no change, an update, a delete, or an insert
   between the runs, or an insert whose event arrives while the reload's last
diff --git a/packages/trailbase-db-collection/tests/lifecycle-oracle.property.test.ts b/packages/trailbase-db-collection/tests/lifecycle-oracle.property.test.ts
index 6d38e43437..7b191b5a55 100644
--- a/packages/trailbase-db-collection/tests/lifecycle-oracle.property.test.ts
+++ b/packages/trailbase-db-collection/tests/lifecycle-oracle.property.test.ts
@@ -2,9 +2,20 @@ import { fc, test as fcTest } from '@fast-check/vitest'
 import { expect, it, vi } from 'vitest'
 import { createCollection, createLiveQueryCollection, eq } from '@tanstack/db'
 import { oraclePropertyOptions, oracleRuns } from '../../db/tests/oracle-config'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { trailBaseCollectionOptions } from '../src/trailbase'
 import { MockRecordApi } from './mock-record-api'
+import {
+  deferred,
+  failure,
+  invalidValue,
+  observe,
+  sortedRows,
+  source,
+  turn,
+} from './lifecycle-support'
 import type { Event, ListResponse } from 'trailbase'
+import type { RaceRow, Row } from './lifecycle-support'
 
 /**
  * # Does a TrailBase sync run publish and retire one valid row history?
@@ -27,7 +38,6 @@ import type { Event, ListResponse } from 'trailbase'
  * the boundary intentionally left to service-backed tests.
  */
 
-type Row = { id: number; value: number }
 type Change = { operation: `set` | `delete`; id: number; value: number }
 type Ending =
   `close` | `buffered-close` | `read-error` | `parse-error` | `cleanup`
@@ -53,65 +63,6 @@ type Scenario = {
   syncRuns: Array<SyncRunPlan>
 }
 
-function deferred<T>() {
-  let resolve!: (value: T) => void
-  let reject!: (error: unknown) => void
-  const promise = new Promise<T>((yes, no) => {
-    resolve = yes
-    reject = no
-  })
-  // Every adapter promise is observed even when its sync run is abandoned.
-  void promise.catch(() => undefined)
-  return { promise, resolve, reject }
-}
-
-function observe(promise: Promise<unknown>) {
-  let result: `pending` | `fulfilled` | `rejected` = `pending`
-  let error: unknown
-  void promise.then(
-    () => {
-      result = `fulfilled`
-    },
-    (failure: unknown) => {
-      result = `rejected`
-      error = failure
-    },
-  )
-  return {
-    get result() {
-      return result
-    },
-    get error() {
-      return error
-    },
-  }
-}
-
-// All adapter I/O is gated. One host turn drains native stream microtasks and
-// exposes detached rejections; it does not stand in for a network completion.
-const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
-const failure = new Error(`oracle stream failure`)
-const invalidValue = -10_000
-
-function source() {
-  let controller!: ReadableStreamDefaultController<Event>
-  const cancel = vi.fn((): void | Promise<void> => {})
-  const stream = new ReadableStream<Event>({
-    start(value) {
-      controller = value
-    },
-    cancel,
-  })
-  return {
-    stream,
-    cancel,
-    controller,
-    subscription: deferred<ReadableStream<Event>>(),
-    list: deferred<ListResponse<Row>>(),
-    listCalls: 0,
-  }
-}
-
 /**
  * Reference: rows are an independent key/value relation. Before readiness a
  * required load failure rejects startup; afterward a broken stream retains
@@ -484,91 +435,6 @@ const corpus: Array<{
     syncRuns: [{ kind }, live(`close`)],
   })),
 ]
-it.each([`resolve`, `reject`] as const)(
-  `rejects startup before stream cancellation can %s`,
-  async (cancellation) => {
-    const reports: Array<Array<unknown>> = []
-    const unhandled: Array<unknown> = []
-    const failures: Array<unknown> = []
-    const onUnhandled = (error: unknown) => unhandled.push(error)
-    const reported = vi
-      .spyOn(console, `error`)
-      .mockImplementation((...args) => {
-        reports.push(args)
-      })
-    process.on(`unhandledRejection`, onUnhandled)
-    const active = source()
-    const cancelled = deferred<void>()
-    active.cancel.mockImplementation(() => cancelled.promise)
-    const api = new MockRecordApi<Row>()
-    api.subscribe.mockResolvedValue(active.stream)
-    api.list.mockImplementation(() => active.list.promise)
-    const collection = createCollection(
-      trailBaseCollectionOptions({
-        recordApi: api,
-        getKey: (row: Row) => row.id,
-        syncMode: `eager`,
-        parse: {
-          value: () => {
-            throw failure
-          },
-        },
-        serialize: {},
-      }),
-    )
-    const preload = observe(collection.preload())
-    try {
-      await turn()
-      expect(api.list).toHaveBeenCalledOnce()
-      active.controller.enqueue({ Insert: { id: 1, value: invalidValue } })
-      await turn()
-      expect(active.cancel).toHaveBeenCalledOnce()
-      // Cleanup I/O is still pending, but it cannot postpone the load error.
-      expect(preload.result).toBe(`rejected`)
-      expect(preload.error).toBe(failure)
-      expect(collection.status).toBe(`error`)
-      active.list.resolve({ records: [] })
-      await turn()
-      expect(preload.result).toBe(`rejected`)
-      expect(collection.status).toBe(`error`)
-    } catch (error) {
-      failures.push(error)
-    } finally {
-      if (cancellation === `resolve`) cancelled.resolve()
-      else cancelled.reject(new Error(`cancel failure`))
-      active.list.resolve({ records: [] })
-      try {
-        await collection.cleanup()
-      } catch (error) {
-        failures.push(error)
-      }
-      await turn()
-      try {
-        // Observe the final cancellation/list continuations before restoring
-        // either recorder. Loading failure is reported through preload, not
-        // console.error, and canceled transport errors must stay observed.
-        expect(reports).toEqual([])
-        expect(unhandled).toEqual([])
-        expect(preload.result).toBe(`rejected`)
-        expect(preload.error).toBe(failure)
-        expect(active.stream.locked).toBe(false)
-        expect(active.cancel).toHaveBeenCalledOnce()
-        expect(collection.status).toBe(`cleaned-up`)
-      } catch (error) {
-        failures.push(error)
-      } finally {
-        process.off(`unhandledRejection`, onUnhandled)
-        reported.mockRestore()
-      }
-    }
-    if (failures.length === 1) throw failures[0]
-    if (failures.length > 1)
-      throw new AggregateError(failures, `Startup and cleanup checks failed`, {
-        cause: failures[0],
-      })
-  },
-)
-
 it.each(
   corpus.flatMap((entry) =>
     ([`eager`, `on-demand`] as const).map((mode) => ({ ...entry, mode })),
@@ -872,7 +738,6 @@ it.each(earlyDemandPlans)(
  * no row version to order an event against a page, so the lane only checks a
  * row once all of its events have arrived.
  */
-type RaceRow = { id: number; data: string }
 type RacePlan = {
   mode: `eager` | `on-demand`
   change: `update` | `delete` | `insert` | `insert-then-update`
@@ -911,10 +776,6 @@ function raceChange(change: RacePlan[`change`]): {
   }
 }
 
-// Compare only the row fields; the Collection adds virtual properties.
-const sortedRows = (rows: Iterable<RaceRow>) =>
-  [...rows].map(({ id, data }) => ({ id, data })).sort((a, b) => a.id - b.id)
-
 async function checkPageEventRace(plan: RacePlan) {
   const service = new Map(raceServiceRows.map((row) => [row.id, row]))
   const { events, apply } = raceChange(plan.change)
@@ -1187,277 +1048,20 @@ it.each(heldPlans)(
  * later load. Each compares rows, status, and subscribe calls. After the end,
  * The Collection's `error` stays, and nothing clears it in this sync run.
  */
-it.each([`close`, `read-error`] as const)(
-  `keeps rows, reports an error, and does not resubscribe after the stream ends: %s`,
-  async (ending) => {
-    const service = new Map(raceServiceRows.map((row) => [row.id, row]))
-    let controller!: ReadableStreamDefaultController<Event>
-    const stream = new ReadableStream<Event>({
-      start(value) {
-        controller = value
-      },
-    })
-    const api = new MockRecordApi<RaceRow>()
-    api.subscribe.mockImplementation(() => Promise.resolve(stream))
-    api.list.mockImplementation(() =>
-      Promise.resolve({ records: [...service.values()] }),
-    )
-    const reported = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const collection = createCollection(
-      trailBaseCollectionOptions({
-        recordApi: api,
-        getKey: (row: RaceRow) => row.id,
-        syncMode: `on-demand`,
-        startSync: true,
-        parse: {},
-        serialize: {},
-      }),
-    )
-    const rows = () => sortedRows(collection.toArray)
-
-    try {
-      await turn()
-      await collection._sync.loadSubset({})
-      await turn()
-      const established = sortedRows(service.values())
-      expect(rows(), `${ending} first page`).toEqual(established)
-
-      if (ending === `close`) controller.close()
-      else controller.error(failure)
-      await turn()
-      expect(collection.status, `${ending} status after the end`).toBe(`ready`)
-      expect(rows(), `${ending} rows after the end`).toEqual(established)
-      const stopped = {
-        hasErrors: true,
-        failureReason: null,
-        error: expect.anything(),
-      }
-      expect(collection.health, `${ending} error after the end`).toMatchObject(
-        stopped,
-      )
-
-      service.set(1, { id: 1, data: `v2` })
-      await turn()
-      expect(rows(), `${ending} a later change is not delivered`).toEqual(
-        established,
-      )
-
-      await collection._sync.loadSubset({ limit: 10 } as never)
-      await turn()
-      expect(api.subscribe, `${ending} subscribe calls`).toHaveBeenCalledTimes(
-        1,
-      )
-      expect(rows(), `${ending} a later load lists current rows`).toEqual(
-        sortedRows(service.values()),
-      )
-      expect(collection.health, `${ending} error after the load`).toMatchObject(
-        stopped,
-      )
-    } finally {
-      await collection.cleanup()
-      reported.mockRestore()
-    }
-  },
-)
-
-/**
- * ## Does a reload recover a failed startup?
- *
- * Law (the error surface's reload contract): `reload()` runs `sync` again
- * while the Collection still shows `error`. The new run's own outcome decides
- * the reload: a subscription that listens makes it ready and the reload
- * resolves; a subscription that rejects fails the reload, and the status stays
- * `error`. The adapter cannot read Collection status to learn whether this run
- * is ready, because status still shows the failed run.
- *
- * Grammar (exhaustive, 2 histories): the first subscription rejects; the
- * reload's subscription listens or rejects. Checkpoints: after the reload
- * settles (or a bounded wait), compare its outcome, status, and subscribe
- * calls.
- */
-it.each([`listens`, `rejects`] as const)(
-  `a reload after a failed startup settles when the new subscription %s`,
-  async (outcome) => {
-    const stream = new ReadableStream<Event>({ start() {} })
-    const api = new MockRecordApi<RaceRow>()
-    api.subscribe
-      .mockImplementationOnce(() => Promise.reject(failure))
-      .mockImplementationOnce(() =>
-        outcome === `listens`
-          ? Promise.resolve(stream)
-          : Promise.reject(new Error(`reload subscription failed`)),
-      )
-    api.list.mockImplementation(() => Promise.resolve({ records: [] }))
-    const reported = vi.spyOn(console, `error`).mockImplementation(() => {})
-    const collection = createCollection(
-      trailBaseCollectionOptions({
-        recordApi: api,
-        getKey: (row: RaceRow) => row.id,
-        startSync: true,
-        parse: {},
-        serialize: {},
-      }),
-    )
-    try {
-      await collection.preload().catch(() => undefined)
-      expect(collection.status).toBe(`error`)
-      const settled = await Promise.race([
-        collection.reload().then(
-          () => `resolved`,
-          () => `rejected`,
-        ),
-        new Promise((resolve) => setTimeout(() => resolve(`pending`), 500)),
-      ])
-      expect(settled).toBe(outcome === `listens` ? `resolved` : `rejected`)
-      expect(collection.status).toBe(outcome === `listens` ? `ready` : `error`)
-      expect(api.subscribe).toHaveBeenCalledTimes(2)
-    } finally {
-      await collection.cleanup()
-      reported.mockRestore()
-    }
-  },
-)
-
-/**
- * ## Does a reload of a ready Collection end with the service's rows?
- *
- * Law (the reload contract, maintainer decision F19): a reload keeps the rows
- * on screen until it completes. The new run's writes apply on the kept rows,
- * and only a snapshot or the run's own truncate replaces them; a run that
- * sends neither completes the reload at its `markReady()`. Once the reload
- * settles, an eager Collection holds the service's current rows, so a row
- * the service deleted between the runs is gone.
- *
- * Reference: the service is a key/value relation that `list` reads at the
- * moment it is called, in key order, 256 rows to a page with a cursor. The
- * expected rows never come from the adapter.
- *
- * Grammar (exhaustive, 10 histories): the service holds 3 rows (one page)
- * or 258 rows (two pages); between the runs it changes nothing, updates row
- * 1, deletes row 2, or inserts a new row; or, while the reload's last page
- * is held, it inserts a new row that page does not list and the listener
- * delivers its `Insert` event (`insert-event`). Checkpoints: while the
- * reload's last page is held, every row the Collection showed before the
- * reload that the service still has is still shown, and the reload has not
- * settled; after the page is released, the reload resolves, the status is
- * `ready`, and the rows equal the service's.
- */
-it.each(
-  [3, 258].flatMap((size) =>
-    ([`none`, `update`, `delete`, `insert`, `insert-event`] as const).map(
-      (change) => ({
-        size,
-        change,
-      }),
-    ),
-  ),
-)(
-  `a reload of a ready eager Collection over $size rows ends with the service's rows after a $change`,
-  async ({ size, change }) => {
-    const service = new Map<number, RaceRow>()
-    for (let id = 1; id <= size; id++) service.set(id, { id, data: `v1` })
-    const api = new MockRecordApi<RaceRow>()
-    let listener: WritableStreamDefaultWriter<Event> | undefined
-    api.subscribe.mockImplementation(() => {
-      const stream = new TransformStream<Event>()
-      listener = stream.writable.getWriter()
-      return Promise.resolve(stream.readable)
-    })
-    let holdLastPage: Promise<void> | undefined
-    api.list.mockImplementation(async (options) => {
-      const after = Number(options?.pagination?.cursor ?? 0)
-      const records = [...service.values()]
-        .sort((a, b) => a.id - b.id)
-        .filter((row) => row.id > after)
-        .slice(0, 256)
-      if (records.length < 256) await holdLastPage
-      return { records, cursor: String(records.at(-1)?.id ?? after) }
-    })
-    const collection = createCollection(
-      trailBaseCollectionOptions({
-        recordApi: api,
-        getKey: (row: RaceRow) => row.id,
-        startSync: true,
-        parse: {},
-        serialize: {},
-      }),
-    )
-    try {
-      await collection.preload()
-      const before = sortedRows(collection.toArray)
-      expect(before).toEqual(sortedRows(service.values()))
-
-      if (change === `update`) service.set(1, { id: 1, data: `v2` })
-      else if (change === `delete`) service.delete(2)
-      else if (change === `insert`)
-        service.set(size + 1, { id: size + 1, data: `v1` })
-
-      let releaseLastPage!: () => void
-      holdLastPage = new Promise((resolve) => (releaseLastPage = resolve))
-      const reload = observe(collection.reload())
-      await turn()
-      if (change === `insert-event`) {
-        const row = { id: size + 1, data: `v1` }
-        service.set(row.id, row)
-        await listener!.write({ Insert: row })
-        await turn()
-      }
-      const shown = new Set(collection.toArray.map((row) => row.id))
-      expect(
-        before.filter((row) => service.has(row.id) && !shown.has(row.id)),
-        `kept rows the service still has stay while the reload runs`,
-      ).toEqual([])
-      expect(reload.result).toBe(`pending`)
-
-      releaseLastPage()
-      for (let i = 0; i < 5 && reload.result === `pending`; i++) await turn()
-      expect(reload.result).toBe(`fulfilled`)
-      expect(collection.status).toBe(`ready`)
-      expect(sortedRows(collection.toArray)).toEqual(
-        sortedRows(service.values()),
-      )
-    } finally {
-      await collection.cleanup()
-    }
-  },
-)
-
-/**
- * ## Does an unchanged row survive an on-demand reload?
- *
- * Law (maintainer decisions F19 and snapshot-api §8): an on-demand reload
- * keeps the rows; core replays the live query's demand through the new
- * run, and the replayed pages apply on the kept rows (every page row is a
- * full-row `update`, so a held key is never inserted). Core does not sweep
- * after a reload (issue #2269), and a page cannot say a row is gone, so a
- * row the service deleted while no stream listened stays: that is this
- * adapter's limit for on-demand reloads.
- *
- * Reference: the same service as the eager reload lane. Between the runs
- * the service updates row 1 and deletes row 2 with no change event; row 3
- * is untouched. Checkpoint: once the reload settles and the replayed load
- * has applied, row 1 shows its edit, row 3 survives, and row 2 keeps its
- * last value.
- */
-it(`an unchanged row survives an on-demand reload`, async () => {
-  const service = new Map<number, RaceRow>(
-    [1, 2, 3].map((id) => [id, { id, data: `v1` }]),
-  )
+async function checkStreamEnd(ending: `close` | `read-error`) {
+  const service = new Map(raceServiceRows.map((row) => [row.id, row]))
+  let controller!: ReadableStreamDefaultController<Event>
+  const stream = new ReadableStream<Event>({
+    start(value) {
+      controller = value
+    },
+  })
   const api = new MockRecordApi<RaceRow>()
-  api.subscribe.mockImplementation(() =>
-    Promise.resolve(new ReadableStream<Event>({ start() {} })),
+  api.subscribe.mockImplementation(() => Promise.resolve(stream))
+  api.list.mockImplementation(() =>
+    Promise.resolve({ records: [...service.values()] }),
   )
-  api.list.mockImplementation((options) => {
-    const after = Number(options?.pagination?.cursor ?? 0)
-    const records = [...service.values()]
-      .sort((a, b) => a.id - b.id)
-      .filter((row) => row.id > after)
-      .slice(0, 256)
-    return Promise.resolve({
-      records,
-      cursor: String(records.at(-1)?.id ?? after),
-    })
-  })
+  const reported = vi.spyOn(console, `error`).mockImplementation(() => {})
   const collection = createCollection(
     trailBaseCollectionOptions({
       recordApi: api,
@@ -1468,80 +1072,54 @@ it(`an unchanged row survives an on-demand reload`, async () => {
       serialize: {},
     }),
   )
-  const live = createLiveQueryCollection({
-    query: (q) => q.from({ row: collection }),
-  })
+  const rows = () => sortedRows(collection.toArray)
+
   try {
-    await live.preload()
-    expect(sortedRows(collection.toArray)).toEqual(sortedRows(service.values()))
+    await turn()
+    await collection._sync.loadSubset({})
+    await turn()
+    const established = sortedRows(service.values())
+    expect(rows(), `${ending} first page`).toEqual(established)
 
-    service.set(1, { id: 1, data: `v2` })
-    service.delete(2)
-    await collection.reload()
-    await vi.waitFor(() =>
-      expect(sortedRows(collection.toArray)).toEqual(
-        sortedRows([...service.values(), { id: 2, data: `v1` }]),
-      ),
+    if (ending === `close`) controller.close()
+    else controller.error(failure)
+    await turn()
+    expect(collection.status, `${ending} status after the end`).toBe(`ready`)
+    expect(rows(), `${ending} rows after the end`).toEqual(established)
+    const stopped = {
+      hasErrors: true,
+      failureReason: null,
+      error: expect.anything(),
+    }
+    expect(collection.health, `${ending} error after the end`).toMatchObject(
+      stopped,
     )
-    expect(collection.status).toBe(`ready`)
-  } finally {
-    await live.cleanup()
-    await collection.cleanup()
-  }
-})
 
-/**
- * ## Does an aborted load write no rows?
- *
- * Law (snapshot-api §8): an abort ends the load. Core stops listening to it
- * at once, and the adapter must honor the signal: stop the fetch and write
- * no rows for it. Reference: the service holds 3 rows; a subset load's list
- * is held, the caller aborts, then the list answers. Checkpoints: the load
- * rejects with `AbortError`, and after the late answer the Collection holds
- * no row, while a later load lists every row.
- */
-it(`an aborted load writes no rows and its late result changes nothing`, async () => {
-  const service = [1, 2, 3].map((id) => ({ id, data: `v1` }))
-  const page = deferred<ListResponse<RaceRow>>()
-  const api = new MockRecordApi<RaceRow>()
-  api.subscribe.mockImplementation(() =>
-    Promise.resolve(new ReadableStream<Event>({ start() {} })),
-  )
-  api.list
-    .mockImplementationOnce(() => page.promise)
-    .mockImplementation(() => Promise.resolve({ records: service }))
-  const collection = createCollection(
-    trailBaseCollectionOptions({
-      recordApi: api,
-      getKey: (row: RaceRow) => row.id,
-      syncMode: `on-demand`,
-      startSync: true,
-      parse: {},
-      serialize: {},
-    }),
-  )
-  try {
-    await collection.preload()
-    const abort = new AbortController()
-    const load = observe(
-      Promise.resolve(
-        collection._sync.loadSubset({ limit: 10, signal: abort.signal }),
-      ),
-    )
-    await vi.waitFor(() => expect(api.list).toHaveBeenCalledOnce())
-    abort.abort()
-    page.resolve({ records: service })
+    service.set(1, { id: 1, data: `v2` })
     await turn()
-    expect(load.result).toBe(`rejected`)
-    expect(load.error).toMatchObject({ name: `AbortError` })
-    expect(collection.toArray).toEqual([])
+    expect(rows(), `${ending} a later change is not delivered`).toEqual(
+      established,
+    )
 
-    await collection._sync.loadSubset({ limit: 10 })
-    expect(sortedRows(collection.toArray)).toEqual(sortedRows(service))
+    await collection._sync.loadSubset({ limit: 10 } as never)
+    await turn()
+    expect(api.subscribe, `${ending} subscribe calls`).toHaveBeenCalledTimes(1)
+    expect(rows(), `${ending} a later load lists current rows`).toEqual(
+      sortedRows(service.values()),
+    )
+    expect(collection.health, `${ending} error after the load`).toMatchObject(
+      stopped,
+    )
   } finally {
     await collection.cleanup()
+    reported.mockRestore()
   }
-})
+}
+
+it.each([`close`, `read-error`] as const)(
+  `keeps rows, reports an error, and does not resubscribe after the stream ends: %s`,
+  (ending) => checkStreamEnd(ending),
+)
 
 /**
  * ## Do several pages, several changes, and overlapping loads still converge?
@@ -1904,7 +1482,7 @@ fcTest.prop(
  * clock makes the old run's event and the new run's list call share a
  * millisecond, the case a wall-clock fence cannot order.
  */
-it(`loads a row in a fresh run that an earlier run's event touched`, async () => {
+async function checkFreshRunAfterEvent() {
   const service = new Map(raceServiceRows.map((row) => [row.id, row]))
   const streams: Array<WritableStreamDefaultWriter<Event>> = []
   const api = new MockRecordApi<RaceRow>()
@@ -1953,4 +1531,20 @@ it(`loads a row in a fresh run that an earlier run's event touched`, async () =>
     for (const writer of streams) void writer.close().catch(() => undefined)
     await turn()
   }
+}
+
+it(`loads a row in a fresh run that an earlier run's event touched`, () =>
+  checkFreshRunAfterEvent())
+
+declareOracle({
+  check: [
+    checkLifecycle,
+    checkEarlyDemand,
+    checkPageEventRace,
+    checkHeldPage,
+    checkStreamEnd,
+    checkPageHistory,
+    checkFreshRunAfterEvent,
+  ],
+  model: [expectedEarlyDemand],
 })
diff --git a/packages/trailbase-db-collection/tests/lifecycle-support.ts b/packages/trailbase-db-collection/tests/lifecycle-support.ts
new file mode 100644
index 0000000000..0e4ad6c7b5
--- /dev/null
+++ b/packages/trailbase-db-collection/tests/lifecycle-support.ts
@@ -0,0 +1,76 @@
+import { vi } from 'vitest'
+import type { Event, ListResponse } from 'trailbase'
+
+/**
+ * Shared controls for the TrailBase lifecycle tests. The gated source, the
+ * settle helpers, and the row type serve both lifecycle-oracle.property.test.ts,
+ * which owns the lifecycle laws, and lifecycle.test.ts, which holds the
+ * hand-written startup control.
+ */
+
+export type Row = { id: number; value: number }
+
+export function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (error: unknown) => void
+  const promise = new Promise<T>((yes, no) => {
+    resolve = yes
+    reject = no
+  })
+  // Every adapter promise is observed even when its sync run is abandoned.
+  void promise.catch(() => undefined)
+  return { promise, resolve, reject }
+}
+
+export function observe(promise: Promise<unknown>) {
+  let result: `pending` | `fulfilled` | `rejected` = `pending`
+  let error: unknown
+  void promise.then(
+    () => {
+      result = `fulfilled`
+    },
+    (failure: unknown) => {
+      result = `rejected`
+      error = failure
+    },
+  )
+  return {
+    get result() {
+      return result
+    },
+    get error() {
+      return error
+    },
+  }
+}
+
+// All adapter I/O is gated. One host turn drains native stream microtasks and
+// exposes detached rejections; it does not stand in for a network completion.
+export const turn = () => new Promise<void>((resolve) => setTimeout(resolve, 0))
+export const failure = new Error(`oracle stream failure`)
+export const invalidValue = -10_000
+
+export function source() {
+  let controller!: ReadableStreamDefaultController<Event>
+  const cancel = vi.fn((): void | Promise<void> => {})
+  const stream = new ReadableStream<Event>({
+    start(value) {
+      controller = value
+    },
+    cancel,
+  })
+  return {
+    stream,
+    cancel,
+    controller,
+    subscription: deferred<ReadableStream<Event>>(),
+    list: deferred<ListResponse<Row>>(),
+    listCalls: 0,
+  }
+}
+
+export type RaceRow = { id: number; data: string }
+
+// Compare only the row fields; the Collection adds virtual properties.
+export const sortedRows = (rows: Iterable<RaceRow>) =>
+  [...rows].map(({ id, data }) => ({ id, data })).sort((a, b) => a.id - b.id)
diff --git a/packages/trailbase-db-collection/tests/lifecycle.test.ts b/packages/trailbase-db-collection/tests/lifecycle.test.ts
new file mode 100644
index 0000000000..e330f80fa9
--- /dev/null
+++ b/packages/trailbase-db-collection/tests/lifecycle.test.ts
@@ -0,0 +1,389 @@
+// Hand-written TrailBase lifecycle controls: a load failure rejects readiness
+// while stream cancellation is still pending, so a late cancellation cannot
+// turn the failed startup into readiness; and fixed reload, on-demand reload,
+// and aborted-load scenarios compare with hand-written or service rows. The
+// law that the generated and fixed lifecycle histories check is owned by
+// lifecycle-oracle.property.test.ts.
+import { expect, it, vi } from 'vitest'
+import { createCollection, createLiveQueryCollection } from '@tanstack/db'
+import { trailBaseCollectionOptions } from '../src/trailbase'
+import { MockRecordApi } from './mock-record-api'
+import {
+  deferred,
+  failure,
+  invalidValue,
+  observe,
+  sortedRows,
+  source,
+  turn,
+} from './lifecycle-support'
+import type { Event, ListResponse } from 'trailbase'
+import type { RaceRow, Row } from './lifecycle-support'
+
+it.each([`resolve`, `reject`] as const)(
+  `rejects startup before stream cancellation can %s`,
+  async (cancellation) => {
+    const reports: Array<Array<unknown>> = []
+    const unhandled: Array<unknown> = []
+    const failures: Array<unknown> = []
+    const onUnhandled = (error: unknown) => unhandled.push(error)
+    const reported = vi
+      .spyOn(console, `error`)
+      .mockImplementation((...args) => {
+        reports.push(args)
+      })
+    process.on(`unhandledRejection`, onUnhandled)
+    const active = source()
+    const cancelled = deferred<void>()
+    active.cancel.mockImplementation(() => cancelled.promise)
+    const api = new MockRecordApi<Row>()
+    api.subscribe.mockResolvedValue(active.stream)
+    api.list.mockImplementation(() => active.list.promise)
+    const collection = createCollection(
+      trailBaseCollectionOptions({
+        recordApi: api,
+        getKey: (row: Row) => row.id,
+        syncMode: `eager`,
+        parse: {
+          value: () => {
+            throw failure
+          },
+        },
+        serialize: {},
+      }),
+    )
+    const preload = observe(collection.preload())
+    try {
+      await turn()
+      expect(api.list).toHaveBeenCalledOnce()
+      active.controller.enqueue({ Insert: { id: 1, value: invalidValue } })
+      await turn()
+      expect(active.cancel).toHaveBeenCalledOnce()
+      // Cleanup I/O is still pending, but it cannot postpone the load error.
+      expect(preload.result).toBe(`rejected`)
+      expect(preload.error).toBe(failure)
+      expect(collection.status).toBe(`error`)
+      active.list.resolve({ records: [] })
+      await turn()
+      expect(preload.result).toBe(`rejected`)
+      expect(collection.status).toBe(`error`)
+    } catch (error) {
+      failures.push(error)
+    } finally {
+      if (cancellation === `resolve`) cancelled.resolve()
+      else cancelled.reject(new Error(`cancel failure`))
+      active.list.resolve({ records: [] })
+      try {
+        await collection.cleanup()
+      } catch (error) {
+        failures.push(error)
+      }
+      await turn()
+      try {
+        // Observe the final cancellation/list continuations before restoring
+        // either recorder. Loading failure is reported through preload, not
+        // console.error, and canceled transport errors must stay observed.
+        expect(reports).toEqual([])
+        expect(unhandled).toEqual([])
+        expect(preload.result).toBe(`rejected`)
+        expect(preload.error).toBe(failure)
+        expect(active.stream.locked).toBe(false)
+        expect(active.cancel).toHaveBeenCalledOnce()
+        expect(collection.status).toBe(`cleaned-up`)
+      } catch (error) {
+        failures.push(error)
+      } finally {
+        process.off(`unhandledRejection`, onUnhandled)
+        reported.mockRestore()
+      }
+    }
+    if (failures.length === 1) throw failures[0]
+    if (failures.length > 1)
+      throw new AggregateError(failures, `Startup and cleanup checks failed`, {
+        cause: failures[0],
+      })
+  },
+)
+
+/**
+ * ## Does a reload recover a failed startup?
+ *
+ * Law (the error surface's reload contract): `reload()` runs `sync` again
+ * while the Collection still shows `error`. The new run's own outcome decides
+ * the reload: a subscription that listens makes it ready and the reload
+ * resolves; a subscription that rejects fails the reload, and the status stays
+ * `error`. The adapter cannot read Collection status to learn whether this run
+ * is ready, because status still shows the failed run.
+ *
+ * Grammar (exhaustive, 2 histories): the first subscription rejects; the
+ * reload's subscription listens or rejects. Checkpoints: after the reload
+ * settles (or a bounded wait), compare its outcome, status, and subscribe
+ * calls.
+ */
+it.each([`listens`, `rejects`] as const)(
+  `a reload after a failed startup settles when the new subscription %s`,
+  async (outcome) => {
+    const stream = new ReadableStream<Event>({ start() {} })
+    const api = new MockRecordApi<RaceRow>()
+    api.subscribe
+      .mockImplementationOnce(() => Promise.reject(failure))
+      .mockImplementationOnce(() =>
+        outcome === `listens`
+          ? Promise.resolve(stream)
+          : Promise.reject(new Error(`reload subscription failed`)),
+      )
+    api.list.mockImplementation(() => Promise.resolve({ records: [] }))
+    const reported = vi.spyOn(console, `error`).mockImplementation(() => {})
+    const collection = createCollection(
+      trailBaseCollectionOptions({
+        recordApi: api,
+        getKey: (row: RaceRow) => row.id,
+        startSync: true,
+        parse: {},
+        serialize: {},
+      }),
+    )
+    try {
+      await collection.preload().catch(() => undefined)
+      expect(collection.status).toBe(`error`)
+      const settled = await Promise.race([
+        collection.reload().then(
+          () => `resolved`,
+          () => `rejected`,
+        ),
+        new Promise((resolve) => setTimeout(() => resolve(`pending`), 500)),
+      ])
+      expect(settled).toBe(outcome === `listens` ? `resolved` : `rejected`)
+      expect(collection.status).toBe(outcome === `listens` ? `ready` : `error`)
+      expect(api.subscribe).toHaveBeenCalledTimes(2)
+    } finally {
+      await collection.cleanup()
+      reported.mockRestore()
+    }
+  },
+)
+
+/**
+ * ## Does a reload of a ready Collection end with the service's rows?
+ *
+ * Law (the reload contract, maintainer decision F19): a reload keeps the rows
+ * on screen until it completes. The new run's writes apply on the kept rows,
+ * and only a snapshot or the run's own truncate replaces them; a run that
+ * sends neither completes the reload at its `markReady()`. Once the reload
+ * settles, an eager Collection holds the service's current rows, so a row
+ * the service deleted between the runs is gone.
+ *
+ * Reference: the service is a key/value relation that `list` reads at the
+ * moment it is called, in key order, 256 rows to a page with a cursor. The
+ * expected rows never come from the adapter.
+ *
+ * Grammar (exhaustive, 10 histories): the service holds 3 rows (one page)
+ * or 258 rows (two pages); between the runs it changes nothing, updates row
+ * 1, deletes row 2, or inserts a new row; or, while the reload's last page
+ * is held, it inserts a new row that page does not list and the listener
+ * delivers its `Insert` event (`insert-event`). Checkpoints: while the
+ * reload's last page is held, every row the Collection showed before the
+ * reload that the service still has is still shown, and the reload has not
+ * settled; after the page is released, the reload resolves, the status is
+ * `ready`, and the rows equal the service's.
+ */
+it.each(
+  [3, 258].flatMap((size) =>
+    ([`none`, `update`, `delete`, `insert`, `insert-event`] as const).map(
+      (change) => ({
+        size,
+        change,
+      }),
+    ),
+  ),
+)(
+  `a reload of a ready eager Collection over $size rows ends with the service's rows after a $change`,
+  async ({ size, change }) => {
+    const service = new Map<number, RaceRow>()
+    for (let id = 1; id <= size; id++) service.set(id, { id, data: `v1` })
+    const api = new MockRecordApi<RaceRow>()
+    let listener: WritableStreamDefaultWriter<Event> | undefined
+    api.subscribe.mockImplementation(() => {
+      const stream = new TransformStream<Event>()
+      listener = stream.writable.getWriter()
+      return Promise.resolve(stream.readable)
+    })
+    let holdLastPage: Promise<void> | undefined
+    api.list.mockImplementation(async (options) => {
+      const after = Number(options?.pagination?.cursor ?? 0)
+      const records = [...service.values()]
+        .sort((a, b) => a.id - b.id)
+        .filter((row) => row.id > after)
+        .slice(0, 256)
+      if (records.length < 256) await holdLastPage
+      return { records, cursor: String(records.at(-1)?.id ?? after) }
+    })
+    const collection = createCollection(
+      trailBaseCollectionOptions({
+        recordApi: api,
+        getKey: (row: RaceRow) => row.id,
+        startSync: true,
+        parse: {},
+        serialize: {},
+      }),
+    )
+    try {
+      await collection.preload()
+      const before = sortedRows(collection.toArray)
+      expect(before).toEqual(sortedRows(service.values()))
+
+      if (change === `update`) service.set(1, { id: 1, data: `v2` })
+      else if (change === `delete`) service.delete(2)
+      else if (change === `insert`)
+        service.set(size + 1, { id: size + 1, data: `v1` })
+
+      let releaseLastPage!: () => void
+      holdLastPage = new Promise((resolve) => (releaseLastPage = resolve))
+      const reload = observe(collection.reload())
+      await turn()
+      if (change === `insert-event`) {
+        const row = { id: size + 1, data: `v1` }
+        service.set(row.id, row)
+        await listener!.write({ Insert: row })
+        await turn()
+      }
+      const shown = new Set(collection.toArray.map((row) => row.id))
+      expect(
+        before.filter((row) => service.has(row.id) && !shown.has(row.id)),
+        `kept rows the service still has stay while the reload runs`,
+      ).toEqual([])
+      expect(reload.result).toBe(`pending`)
+
+      releaseLastPage()
+      for (let i = 0; i < 5 && reload.result === `pending`; i++) await turn()
+      expect(reload.result).toBe(`fulfilled`)
+      expect(collection.status).toBe(`ready`)
+      expect(sortedRows(collection.toArray)).toEqual(
+        sortedRows(service.values()),
+      )
+    } finally {
+      await collection.cleanup()
+    }
+  },
+)
+
+/**
+ * ## Does an unchanged row survive an on-demand reload?
+ *
+ * Law (maintainer decisions F19 and snapshot-api §8): an on-demand reload
+ * keeps the rows; core replays the live query's demand through the new
+ * run, and the replayed pages apply on the kept rows (every page row is a
+ * full-row `update`, so a held key is never inserted). Core does not sweep
+ * after a reload (issue #2269), and a page cannot say a row is gone, so a
+ * row the service deleted while no stream listened stays: that is this
+ * adapter's limit for on-demand reloads.
+ *
+ * Reference: the same service as the eager reload lane. Between the runs
+ * the service updates row 1 and deletes row 2 with no change event; row 3
+ * is untouched. Checkpoint: once the reload settles and the replayed load
+ * has applied, row 1 shows its edit, row 3 survives, and row 2 keeps its
+ * last value.
+ */
+it(`an unchanged row survives an on-demand reload`, async () => {
+  const service = new Map<number, RaceRow>(
+    [1, 2, 3].map((id) => [id, { id, data: `v1` }]),
+  )
+  const api = new MockRecordApi<RaceRow>()
+  api.subscribe.mockImplementation(() =>
+    Promise.resolve(new ReadableStream<Event>({ start() {} })),
+  )
+  api.list.mockImplementation((options) => {
+    const after = Number(options?.pagination?.cursor ?? 0)
+    const records = [...service.values()]
+      .sort((a, b) => a.id - b.id)
+      .filter((row) => row.id > after)
+      .slice(0, 256)
+    return Promise.resolve({
+      records,
+      cursor: String(records.at(-1)?.id ?? after),
+    })
+  })
+  const collection = createCollection(
+    trailBaseCollectionOptions({
+      recordApi: api,
+      getKey: (row: RaceRow) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      parse: {},
+      serialize: {},
+    }),
+  )
+  const live = createLiveQueryCollection({
+    query: (q) => q.from({ row: collection }),
+  })
+  try {
+    await live.preload()
+    expect(sortedRows(collection.toArray)).toEqual(sortedRows(service.values()))
+
+    service.set(1, { id: 1, data: `v2` })
+    service.delete(2)
+    await collection.reload()
+    await vi.waitFor(() =>
+      expect(sortedRows(collection.toArray)).toEqual(
+        sortedRows([...service.values(), { id: 2, data: `v1` }]),
+      ),
+    )
+    expect(collection.status).toBe(`ready`)
+  } finally {
+    await live.cleanup()
+    await collection.cleanup()
+  }
+})
+
+/**
+ * ## Does an aborted load write no rows?
+ *
+ * Law (snapshot-api §8): an abort ends the load. Core stops listening to it
+ * at once, and the adapter must honor the signal: stop the fetch and write
+ * no rows for it. Reference: the service holds 3 rows; a subset load's list
+ * is held, the caller aborts, then the list answers. Checkpoints: the load
+ * rejects with `AbortError`, and after the late answer the Collection holds
+ * no row, while a later load lists every row.
+ */
+it(`an aborted load writes no rows and its late result changes nothing`, async () => {
+  const service = [1, 2, 3].map((id) => ({ id, data: `v1` }))
+  const page = deferred<ListResponse<RaceRow>>()
+  const api = new MockRecordApi<RaceRow>()
+  api.subscribe.mockImplementation(() =>
+    Promise.resolve(new ReadableStream<Event>({ start() {} })),
+  )
+  api.list
+    .mockImplementationOnce(() => page.promise)
+    .mockImplementation(() => Promise.resolve({ records: service }))
+  const collection = createCollection(
+    trailBaseCollectionOptions({
+      recordApi: api,
+      getKey: (row: RaceRow) => row.id,
+      syncMode: `on-demand`,
+      startSync: true,
+      parse: {},
+      serialize: {},
+    }),
+  )
+  try {
+    await collection.preload()
+    const abort = new AbortController()
+    const load = observe(
+      Promise.resolve(
+        collection._sync.loadSubset({ limit: 10, signal: abort.signal }),
+      ),
+    )
+    await vi.waitFor(() => expect(api.list).toHaveBeenCalledOnce())
+    abort.abort()
+    page.resolve({ records: service })
+    await turn()
+    expect(load.result).toBe(`rejected`)
+    expect(load.error).toMatchObject({ name: `AbortError` })
+    expect(collection.toArray).toEqual([])
+
+    await collection._sync.loadSubset({ limit: 10 })
+    expect(sortedRows(collection.toArray)).toEqual(sortedRows(service))
+  } finally {
+    await collection.cleanup()
+  }
+})
diff --git a/packages/vue-db/tests/infinite-query-conformance.test.ts b/packages/vue-db/tests/infinite-query-conformance.test.ts
index 98cae5188e..9bc8190393 100644
--- a/packages/vue-db/tests/infinite-query-conformance.test.ts
+++ b/packages/vue-db/tests/infinite-query-conformance.test.ts
@@ -25,6 +25,7 @@ import {
 import { describe, expect, it } from 'vitest'
 import { mockSyncCollectionOptions } from '../../db/tests/utils'
 import { runInfiniteQuerySuite } from '../../db/tests/conformance/infinite-suite-oracle'
+import { registerInfiniteQueryUnitScenarios } from '../../db/tests/conformance/infinite-suite-cases'
 import { makeInfiniteOnDemandSource } from '../../db/tests/conformance/infinite-on-demand'
 import { withScopeSetup } from '../../db/tests/conformance/scope-setup'
 import { useLiveInfiniteQuery } from '../src/useLiveInfiniteQuery'
@@ -280,7 +281,7 @@ const vueInfiniteDriver: InfiniteQueryDriver = {
   knownGaps: [],
 }
 
-runInfiniteQuerySuite(vueInfiniteDriver)
+runInfiniteQuerySuite(vueInfiniteDriver, registerInfiniteQueryUnitScenarios)
 
 describe(`infinite driver scope ownership`, () => {
   it(`retains successful scope until its owner disposes`, () => {
diff --git a/packages/vue-db/tests/useLiveQuery-publication-oracle.test.ts b/packages/vue-db/tests/useLiveQuery-publication-oracle.test.ts
index 91e5a1f7a0..a795ba213d 100644
--- a/packages/vue-db/tests/useLiveQuery-publication-oracle.test.ts
+++ b/packages/vue-db/tests/useLiveQuery-publication-oracle.test.ts
@@ -30,6 +30,7 @@
 import { createCollection } from '@tanstack/db'
 import { effectScope, watch } from 'vue'
 import { expect, it, vi } from 'vitest'
+import { declareOracle } from '../../db/tests/oracle-declaration'
 import { mockSyncCollectionOptions } from '../../db/tests/utils'
 import { useLiveQuery } from '../src/useLiveQuery'
 
@@ -76,6 +77,26 @@ function snapshot(rows: Iterable<Row>): Snapshot {
   return [...rows].map(({ id, value }) => [id, value])
 }
 
+/**
+ * The refinement check at the synchronous watcher cut: every public value the
+ * watcher saw is the preceding or the final snapshot, the source already held
+ * the final rows at each callback, the watcher fired once, and the final
+ * public result equals the final snapshot.
+ */
+function expectCoherentPublication(
+  expected: { before: Snapshot; after: Snapshot },
+  observed: ReadonlyArray<{ publicData: Snapshot; sourceAtCallback: Snapshot }>,
+  finalData: Snapshot,
+): void {
+  for (const { publicData, sourceAtCallback } of observed) {
+    expect(sourceAtCallback).toEqual(expected.after)
+    expect([expected.before, expected.after]).toContainEqual(publicData)
+  }
+  expect(observed).toHaveLength(1)
+  expect(finalData).toEqual(expected.after)
+  expect(observed.at(-1)?.publicData).toEqual(expected.after)
+}
+
 it.each(cases)(
   `publishes one coherent Vue data snapshot for a source $name through $input`,
   async ({ name, initial, change, input }) => {
@@ -129,13 +150,11 @@ it.each(cases)(
 
       const expectedAfter = snapshot(source.values())
       expect(expectedAfter).not.toEqual(expectedBefore)
-      for (const { publicData, sourceAtCallback } of observed) {
-        expect(sourceAtCallback).toEqual(expectedAfter)
-        expect([expectedBefore, expectedAfter]).toContainEqual(publicData)
-      }
-      expect(observed).toHaveLength(1)
-      expect(snapshot(result.data.value)).toEqual(expectedAfter)
-      expect(observed.at(-1)?.publicData).toEqual(expectedAfter)
+      expectCoherentPublication(
+        { before: expectedBefore, after: expectedAfter },
+        observed,
+        snapshot(result.data.value),
+      )
     } catch (error) {
       primaryFailure = error
     }
@@ -177,3 +196,5 @@ it.each(cases)(
     if (primaryFailure !== undefined) throw primaryFailure
   },
 )
+
+declareOracle({ check: [expectCoherentPublication] })
diff --git a/scripts/agent-lint-feedback.mjs b/scripts/agent-lint-feedback.mjs
index 63e80186af..b2df5e122d 100644
--- a/scripts/agent-lint-feedback.mjs
+++ b/scripts/agent-lint-feedback.mjs
@@ -10,7 +10,8 @@
  * adapter per harness reads its hook input and writes its response format.
  *
  *   --format=claude|codex|gemini|copilot   the harness that runs the hook
- *   --event=edit   after an edit: lint the edited files
+ *   --event=edit   after an edit: lint the edited files' oracle files, and the
+ *                  oracle files that reach them through test-module imports
  *   --event=stop   at the end of a turn: lint every file the branch changed
  *   --format=text  print the reports and exit 1: `pnpm lint:changed` lints
  *                  the changed files, `pnpm lint:oracles` (`--all`) every
@@ -34,14 +35,16 @@
  */
 import { execFileSync } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
-import { basename, isAbsolute, join, relative, resolve } from 'node:path'
+import { isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { parseArgs } from 'node:util'
 import tsParser from '@typescript-eslint/parser'
 import { ESLint } from 'eslint'
 import oraclePlugin from './eslint-plugin-oracle/index.js'
+import { resolveImportedTestModule } from './eslint-plugin-oracle/rules/no-unit-test.js'
 import {
   describeLoweredRunBudget,
+  isOracleFile,
   loweredRunBudgets,
   mergeBase,
 } from './check-oracle-run-counts.mjs'
@@ -78,11 +81,70 @@ function repositoryFiles(...outputs) {
 }
 
 /**
- * Every tracked oracle file. Git leaves out builds and untracked checkouts,
- * such as other branches' worktrees under `.worktrees/`.
+ * Every oracle file in the working tree, tracked or new. A new file that an
+ * agent has not added yet is linted like any other. Git leaves out ignored
+ * builds, and lists another checkout nested in this one, such as a worktree
+ * under `.worktrees/`, as a directory, which is not an oracle file.
  */
-function trackedOracleFiles() {
-  return repositoryFiles(git(`ls-files`, `*oracle*.ts`, `*oracle*.tsx`))
+function oracleFilesInTree() {
+  return repositoryFiles(
+    git(`ls-files`, `--cached`, `--others`, `--exclude-standard`),
+  ).filter((file) => isOracleFile(file))
+}
+
+// A relative import or re-export. Reading too much is harmless: a specifier
+// that names no test module resolves to nothing.
+const relativeSpecifier =
+  /\b(?:from|import|require)\s*\(?\s*['"](\.{1,2}\/[^'"\n]*)['"]/g
+const dependencies = new Map()
+
+/** The test modules that a file imports or re-exports, as the rule resolves them. */
+function testModuleDependencies(file) {
+  if (!dependencies.has(file)) {
+    const found = existsSync(file)
+      ? [...readFileSync(file, `utf8`).matchAll(relativeSpecifier)]
+          .map(([, specifier]) => resolveImportedTestModule(file, specifier))
+          .filter((dependency) => dependency !== undefined)
+      : []
+    dependencies.set(file, found)
+  }
+  return dependencies.get(file)
+}
+
+/** Whether an oracle file is edited, or reaches an edited file through test modules. */
+function reachesEdited(oracle, edited) {
+  const seen = new Set([oracle])
+  const pending = [oracle]
+  while (pending.length > 0) {
+    const current = pending.pop()
+    if (edited.has(current)) return true
+    for (const dependency of testModuleDependencies(current)) {
+      if (!seen.has(dependency)) {
+        seen.add(dependency)
+        pending.push(dependency)
+      }
+    }
+  }
+  return false
+}
+
+const pluginSources = join(root, `scripts`, `eslint-plugin-oracle`) + sep
+
+/**
+ * The oracle files that a lint of `files` must cover. The rule reads relative
+ * imports of test modules, so an oracle file is covered when it is named, or
+ * when it reaches a named file through test modules. Production files select
+ * nothing, because the rule does not follow them. A change to the rule's own
+ * sources changes every oracle result, so it selects every oracle file.
+ */
+function affectedOracleFiles(files) {
+  const edited = new Set(files)
+  const oracles = new Set(
+    [...oracleFilesInTree(), ...files].filter((file) => isOracleFile(file)),
+  )
+  if ([...edited].some((file) => file.startsWith(pluginSources)))
+    return [...oracles]
+  return [...oracles].filter((oracle) => reachesEdited(oracle, edited))
 }
 
 /**
@@ -147,9 +209,17 @@ function createLinter() {
     overrideConfigFile: true,
     overrideConfig: [
       { ignores: [`**/dist/**`] },
-      { files: [`**/*.ts`, `**/*.tsx`], languageOptions: { parser: tsParser } },
+      {
+        files: [`**/*.ts`, `**/*.tsx`, `**/*.js`, `**/*.mjs`, `**/*.jsx`],
+        languageOptions: { parser: tsParser },
+      },
       { linterOptions: { noInlineConfig: true } },
-      oraclePlugin.configs.recommended,
+      // `lint` passes only oracle files, chosen by `isOracleFile`, so the rules
+      // apply to every file that it passes.
+      {
+        ...oraclePlugin.configs.recommended,
+        files: [`**/*.ts`, `**/*.tsx`, `**/*.js`, `**/*.mjs`, `**/*.jsx`],
+      },
     ],
   })
 }
@@ -159,7 +229,7 @@ async function lint(eslint, files) {
   const lintable = []
   for (const file of new Set(files)) {
     if (!existsSync(file) || relative(root, file).startsWith(`..`)) continue
-    if (!/oracle.*\.tsx?$/.test(basename(file))) continue
+    if (!isOracleFile(file)) continue
     if (await eslint.isPathIgnored(file)) continue
     lintable.push(file)
   }
@@ -207,7 +277,7 @@ function respond(report, input, scope) {
   }
   const header =
     scope === `edited`
-      ? `Oracle lint reports in the file you edited:`
+      ? `Oracle lint reports for the file you edited, and the oracle files that depend on it:`
       : `Oracle lint reports in this branch's changed files. Fix them before finishing:`
   const reason = `${header}\n${report}\nSee "How oracle work is scored" in AGENTS.md.`
   if (report === `` || (event === `stop` && input.stop_hook_active === true)) {
@@ -242,21 +312,27 @@ function respond(report, input, scope) {
   process.stdout.write(`${JSON.stringify(output)}\n`)
 }
 
-/** The files to lint: named on the command line, edited, or changed. */
+/**
+ * The oracle files to lint: every oracle file, or those that the named, edited,
+ * or changed files affect.
+ */
 function selectFiles(input) {
-  if (options.all) return { scope: `all`, files: trackedOracleFiles() }
+  if (options.all) return { scope: `all`, files: oracleFilesInTree() }
   if (positionals.length > 0) {
-    return { scope: `named`, files: positionals.map((file) => resolve(file)) }
+    return {
+      scope: `named`,
+      files: affectedOracleFiles(positionals.map((file) => resolve(file))),
+    }
   }
   const edited = options.event === `edit` && isHook ? editedFiles(input) : []
   return edited.length > 0
-    ? { scope: `edited`, files: edited }
-    : { scope: `changed`, files: changedFiles() }
+    ? { scope: `edited`, files: affectedOracleFiles(edited) }
+    : { scope: `changed`, files: affectedOracleFiles(changedFiles()) }
 }
 
 /**
- * Lowered run budgets, for a report over the branch's changed files. A
- * lowered budget can be deliberate, so it is a report for review, not a lint
+ * Lowered and removed run budgets, for a report over the branch's changed
+ * files. Either can be deliberate, so it is a report for review, not a lint
  * error.
  */
 function runBudgetReport(scope) {
diff --git a/scripts/check-oracle-run-counts.mjs b/scripts/check-oracle-run-counts.mjs
index 24cdfb2b55..45fe4164c2 100644
--- a/scripts/check-oracle-run-counts.mjs
+++ b/scripts/check-oracle-run-counts.mjs
@@ -1,36 +1,58 @@
 #!/usr/bin/env node
 /**
- * Reports oracle run budgets that a branch lowered.
+ * Reports oracle run budgets that a branch lowered or removed.
  *
  * A generated property checks more histories with a larger budget. Lowering
  * one can make a failing property pass without any change that a lint rule can
- * see, because the new count is still a valid count. This check compares each
- * changed oracle file with its version at the merge-base and reports every
- * budget that went down. A lowered budget can be a deliberate choice, so the
- * report is a tripwire for the reviewer, not a failure: CI prints it as a
- * warning, and the agent hooks return it at the end of a turn.
+ * see, because the new count is still a valid count. Removing one drops its
+ * histories altogether. This check compares each oracle file's budgets with
+ * their versions at the merge-base and reports every budget that went down,
+ * and every budget that no tracked oracle file has any more. Either can be a
+ * deliberate choice, so the report is a tripwire for the reviewer, not a
+ * failure: CI prints it as a warning, and the agent hooks return it at the
+ * end of a turn.
  *
  * A budget is keyed by its registered property where the code names one
  * (`oraclePropertyOptions(n, 'p')`, `oracleRandomParameters(n, _, 'p')`, or
  * `{ property: 'p', defaultRuns: n }`), and otherwise by its fixed seed
- * (`{ seed: s, numRuns: oracleRuns(n) }`). A constant bound to a number counts
- * as that number.
+ * (`{ seed: s, numRuns: oracleRuns(n) }`). A key or count is a literal, a
+ * constant in the same file, or a constant that the file imports. An import
+ * follows relative re-exports (`export { x } from`, `export * from`), so a
+ * constant defined in a support module is tracked where the oracle uses it.
+ *
+ * An oracle file's budgets are its own and those in the test modules that it
+ * imports or re-exports, transitively, other than oracle files, which are
+ * checked as themselves. So a campaign that moves into a support module keeps
+ * its tracking. A budget that leaves one oracle file and appears in another,
+ * where it was not at base, has moved, and its new count is compared. A key
+ * that is in no tracked oracle file at head is reported as removed: the
+ * maintainer decided on 2026-10-27 that a removal is reported like a lowered
+ * budget, and that a move into an imported support module is not a removal.
+ * A fixed seed is not unique, so a key that another oracle file already had at
+ * base counts as present there, and is neither removed nor compared.
+ *
+ * An oracle file is a file whose name contains `oracle`, in TypeScript or
+ * JavaScript. It is checked when it changed, or when a module that it imports
+ * (directly or through re-exports) changed. Untracked files count as changed.
  *
  *   node scripts/check-oracle-run-counts.mjs [--format=text|github]
  */
 import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
-import { basename, join } from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
+import { basename, join, posix } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { parseArgs } from 'node:util'
 import tsParser from '@typescript-eslint/parser'
 
 const root = fileURLToPath(new URL(`../`, import.meta.url))
-function git(...args) {
-  // Pipe stderr so that a failed attempt in `mergeBase` prints nothing.
+
+function git(cwd, ...args) {
+  // Pipe stderr so that a failed attempt in `mergeBase` prints nothing. An
+  // oracle file can exceed the default 1 MiB output buffer.
   return execFileSync(`git`, args, {
-    cwd: root,
+    cwd,
     encoding: `utf8`,
+    maxBuffer: 1024 * 1024 * 1024,
     stdio: [`ignore`, `pipe`, `pipe`],
   }).trim()
 }
@@ -42,7 +64,7 @@ function git(...args) {
 export function mergeBase() {
   for (const branch of [`origin/main`, `main`]) {
     try {
-      return git(`merge-base`, `HEAD`, branch)
+      return git(root, `merge-base`, `HEAD`, branch)
     } catch {
       // Try the next branch.
     }
@@ -52,26 +74,66 @@ export function mergeBase() {
   )
 }
 
-/** The number a node is, or that a constant in the same file is bound to. */
-function numberOf(node, constants) {
-  if (node?.type === `Literal` && typeof node.value === `number`) {
-    return node.value
+/**
+ * Reads files at the base commit or in the working tree, and parses each once.
+ * A file that does not exist at a revision reads as undefined. Any other
+ * failure to read a file throws, so a budget is never compared with a file
+ * that only seemed to be missing.
+ */
+class SourceReader {
+  #repo
+  #base
+  #baseFiles
+  #texts = new Map()
+  #asts = new Map()
+
+  constructor(repo, base) {
+    this.#repo = repo
+    this.#base = base
   }
-  if (node?.type === `Identifier`) return constants.get(node.name)
-  if (node?.type === `CallExpression` && node.callee.name === `oracleRuns`) {
-    return numberOf(node.arguments[0], constants)
+
+  /** Every file at the base commit. */
+  baseFiles() {
+    this.#baseFiles ??= new Set(
+      git(this.#repo, `ls-tree`, `-r`, `--name-only`, this.#base)
+        .split(`\n`)
+        .filter(Boolean),
+    )
+    return this.#baseFiles
   }
-  return undefined
-}
 
-function stringOf(node) {
-  if (node?.type === `Literal` && typeof node.value === `string`) {
-    return node.value
+  text(file, revision) {
+    const key = `${revision}\0${file}`
+    if (!this.#texts.has(key)) {
+      let text
+      if (revision === `head`) {
+        const path = join(this.#repo, file)
+        text = existsSync(path) ? readFileSync(path, `utf8`) : undefined
+      } else if (this.baseFiles().has(file)) {
+        text = git(this.#repo, `show`, `${this.#base}:${file}`)
+      }
+      this.#texts.set(key, text)
+    }
+    return this.#texts.get(key)
   }
-  if (node?.type === `TemplateLiteral` && node.expressions.length === 0) {
-    return node.quasis[0].value.cooked
+
+  ast(file, revision) {
+    const key = `${revision}\0${file}`
+    if (!this.#asts.has(key)) {
+      const text = this.text(file, revision)
+      this.#asts.set(
+        key,
+        text === undefined
+          ? undefined
+          : tsParser.parse(text, {
+              range: true,
+              loc: true,
+              jsx: /\.[jt]sx$/.test(file),
+            }),
+      )
+    }
+    return this.#asts.get(key)
   }
-  return undefined
 }
 
 function walk(node, visit) {
@@ -84,108 +146,330 @@ function walk(node, visit) {
   }
 }
 
-function propertyValue(object, name) {
-  return object.properties.find(
-    (property) =>
-      property.type === `Property` &&
-      !property.computed &&
-      (property.key.name ?? property.key.value) === name,
-  )?.value
+/** The repository path of a relative module, or undefined for a missing one. */
+function resolveModule(fromFile, source, reader, revision) {
+  if (!source.startsWith(`.`)) return undefined
+  const target = posix.normalize(posix.join(posix.dirname(fromFile), source))
+  const stem = target.replace(/\.(m?js|jsx|tsx?)$/, ``)
+  return [
+    `${stem}.ts`,
+    `${stem}.tsx`,
+    `${stem}.js`,
+    `${stem}.mjs`,
+    `${stem}.jsx`,
+    `${stem}/index.ts`,
+    `${stem}/index.js`,
+  ].find((candidate) => reader.text(candidate, revision) !== undefined)
 }
 
-/** Every keyed run budget in one source file. */
-function runBudgets(source, file) {
-  const ast = tsParser.parse(source, {
-    range: true,
-    loc: true,
-    jsx: file.endsWith(`.tsx`),
-  })
-  const constants = new Map()
+function nameOf(node) {
+  return node.name ?? node.value
+}
+
+/**
+ * The number or string that an expression is: a literal, a constant that the
+ * file declares or imports, or `oracleRuns` of one of those.
+ */
+function valueOf(node, file, reader, revision, depth) {
+  if (node === null || node === undefined || depth > 25) return undefined
+  if (
+    node.type === `Literal` &&
+    (typeof node.value === `number` || typeof node.value === `string`)
+  ) {
+    return node.value
+  }
+  if (node.type === `TemplateLiteral` && node.expressions.length === 0) {
+    return node.quasis[0].value.cooked
+  }
+  if (node.type === `Identifier`) {
+    return nameValue(node.name, file, reader, revision, depth + 1)
+  }
+  if (
+    node.type === `CallExpression` &&
+    node.callee.type === `Identifier` &&
+    node.callee.name === `oracleRuns`
+  ) {
+    return valueOf(node.arguments[0], file, reader, revision, depth + 1)
+  }
+  return undefined
+}
+
+/** The value of a name in a file: an import, or a constant that the file declares. */
+function nameValue(name, file, reader, revision, depth) {
+  const ast = reader.ast(file, revision)
+  if (ast === undefined || depth > 25) return undefined
+  for (const statement of ast.body) {
+    if (statement.type !== `ImportDeclaration`) continue
+    for (const specifier of statement.specifiers) {
+      if (specifier.local.name !== name) continue
+      const target = resolveModule(
+        file,
+        statement.source.value,
+        reader,
+        revision,
+      )
+      if (target === undefined || specifier.type !== `ImportSpecifier`)
+        return undefined
+      return exportValue(
+        target,
+        nameOf(specifier.imported),
+        reader,
+        revision,
+        depth + 1,
+      )
+    }
+  }
+  let found
   walk(ast, (node) => {
     if (
-      node.type === `VariableDeclaration` &&
-      node.kind === `const` &&
-      node.declarations.length === 1
-    ) {
-      const [declaration] = node.declarations
-      const value = numberOf(declaration.init, constants)
-      if (declaration.id.type === `Identifier` && value !== undefined) {
-        constants.set(declaration.id.name, value)
+      found !== undefined ||
+      node.type !== `VariableDeclaration` ||
+      node.kind !== `const`
+    )
+      return
+    for (const declarator of node.declarations) {
+      if (declarator.id.type === `Identifier` && declarator.id.name === name) {
+        found = {
+          value: valueOf(declarator.init, file, reader, revision, depth + 1),
+        }
+        return
       }
     }
   })
+  return found?.value
+}
+
+/** The value of an export of a module, following its re-exports. */
+function exportValue(file, name, reader, revision, depth) {
+  const ast = reader.ast(file, revision)
+  if (ast === undefined || depth > 25) return undefined
+  for (const statement of ast.body) {
+    if (statement.type !== `ExportNamedDeclaration`) continue
+    if (statement.declaration?.type === `VariableDeclaration`) {
+      for (const declarator of statement.declaration.declarations) {
+        if (
+          declarator.id.type === `Identifier` &&
+          declarator.id.name === name
+        ) {
+          return valueOf(declarator.init, file, reader, revision, depth + 1)
+        }
+      }
+    }
+    for (const specifier of statement.specifiers) {
+      if (nameOf(specifier.exported) !== name) continue
+      const local = nameOf(specifier.local)
+      if (statement.source === null) {
+        return nameValue(local, file, reader, revision, depth + 1)
+      }
+      const target = resolveModule(
+        file,
+        statement.source.value,
+        reader,
+        revision,
+      )
+      return target === undefined
+        ? undefined
+        : exportValue(target, local, reader, revision, depth + 1)
+    }
+  }
+  for (const statement of ast.body) {
+    if (
+      statement.type !== `ExportAllDeclaration` ||
+      statement.exported !== null
+    )
+      continue
+    const target = resolveModule(file, statement.source.value, reader, revision)
+    const value =
+      target === undefined
+        ? undefined
+        : exportValue(target, name, reader, revision, depth + 1)
+    if (value !== undefined) return value
+  }
+  return undefined
+}
+
+function propertyValue(object, name, file, reader, revision) {
+  const property = object.properties.find(
+    (candidate) =>
+      candidate.type === `Property` &&
+      !candidate.computed &&
+      nameOf(candidate.key) === name,
+  )
+  return property === undefined
+    ? undefined
+    : valueOf(property.value, file, reader, revision, 0)
+}
+
+/** Every keyed run budget in one file at one revision. */
+function runBudgets(file, revision, reader) {
+  const ast = reader.ast(file, revision)
   const budgets = new Map()
+  if (ast === undefined) return budgets
   const record = (key, value) => {
     if (key !== undefined && value !== undefined) budgets.set(key, value)
   }
+  const value = (node) => valueOf(node, file, reader, revision, 0)
   walk(ast, (node) => {
     if (node.type === `CallExpression` && node.callee.type === `Identifier`) {
       const [first, second, third] = node.arguments
       if (node.callee.name === `oraclePropertyOptions`) {
-        const property = stringOf(second)
-        if (property !== undefined) {
-          record(`property ${property}`, numberOf(first, constants))
-        }
+        const property = value(second)
+        if (typeof property === `string`)
+          record(`property ${property}`, value(first))
       }
       if (node.callee.name === `oracleRandomParameters`) {
-        const property = stringOf(third)
-        if (property !== undefined) {
-          record(`property ${property}`, numberOf(first, constants))
-        }
+        const property = value(third)
+        if (typeof property === `string`)
+          record(`property ${property}`, value(first))
       }
     }
     if (node.type === `ObjectExpression`) {
-      const property = stringOf(propertyValue(node, `property`))
-      const defaultRuns = numberOf(
-        propertyValue(node, `defaultRuns`),
-        constants,
-      )
-      if (property !== undefined) record(`property ${property}`, defaultRuns)
-      const seed = numberOf(propertyValue(node, `seed`), constants)
-      const numRuns = numberOf(propertyValue(node, `numRuns`), constants)
-      if (seed !== undefined) record(`fixed seed ${seed}`, numRuns)
+      const property = propertyValue(node, `property`, file, reader, revision)
+      if (typeof property === `string`) {
+        record(
+          `property ${property}`,
+          propertyValue(node, `defaultRuns`, file, reader, revision),
+        )
+      }
+      const seed = propertyValue(node, `seed`, file, reader, revision)
+      if (typeof seed === `number`) {
+        record(
+          `fixed seed ${seed}`,
+          propertyValue(node, `numRuns`, file, reader, revision),
+        )
+      }
     }
   })
   return budgets
 }
 
-function changedOracleFiles(base) {
-  return git(`diff`, `--name-only`, `--diff-filter=M`, base)
-    .split(`\n`)
-    .filter((file) => /oracle.*\.tsx?$/.test(basename(file)))
+/** The repository files that a file imports or re-exports, transitively. */
+function dependencies(file, reader, revision) {
+  const found = new Set()
+  const pending = [file]
+  while (pending.length > 0) {
+    const current = pending.pop()
+    const ast = reader.ast(current, revision)
+    if (ast === undefined) continue
+    for (const statement of ast.body) {
+      if (
+        (statement.type === `ImportDeclaration` ||
+          statement.type === `ExportAllDeclaration` ||
+          statement.type === `ExportNamedDeclaration`) &&
+        statement.source
+      ) {
+        const target = resolveModule(
+          current,
+          statement.source.value,
+          reader,
+          revision,
+        )
+        if (target !== undefined && !found.has(target)) {
+          found.add(target)
+          pending.push(target)
+        }
+      }
+    }
+  }
+  return found
+}
+
+/** Whether a file is an oracle file, by the oracle naming rule. */
+export function isOracleFile(file) {
+  return /oracle.*\.(tsx?|m?js|jsx)$/.test(basename(file))
 }
 
-function show(revision, file) {
-  try {
-    return git(`show`, `${revision}:${file}`)
-  } catch {
-    return undefined
+/**
+ * The budgets that an oracle file uses at a revision: its own, and those in
+ * the non-oracle modules that it reaches. Its own budget wins a shared key.
+ */
+function scopeBudgets(file, revision, reader) {
+  const budgets = new Map()
+  for (const module of dependencies(file, reader, revision)) {
+    if (isOracleFile(module)) continue
+    for (const [key, value] of runBudgets(module, revision, reader))
+      budgets.set(key, value)
   }
+  for (const [key, value] of runBudgets(file, revision, reader))
+    budgets.set(key, value)
+  return budgets
 }
 
-/** Every keyed run budget that the branch lowered in a changed oracle file. */
-export function loweredRunBudgets() {
-  const base = mergeBase()
+/**
+ * Every keyed run budget that the branch lowered or removed, by the oracle
+ * file that used it at base. A removed budget has no `now`. The head side is
+ * the working tree of `repo`, and the base side is the commit `base`.
+ */
+export function loweredRunBudgetsBetween(repo, base) {
+  const reader = new SourceReader(repo, base)
+  const changed = new Set(
+    [
+      git(repo, `diff`, `--name-only`, base),
+      git(repo, `ls-files`, `--others`, `--exclude-standard`),
+    ]
+      .flatMap((output) => output.split(`\n`))
+      .filter(Boolean),
+  )
+  const oracles = [
+    ...new Set(
+      [...reader.baseFiles(), ...changed].filter((file) => isOracleFile(file)),
+    ),
+  ]
+  const scopes = { base: new Map(), head: new Map() }
+  const scope = (file, revision) => {
+    if (!scopes[revision].has(file))
+      scopes[revision].set(file, scopeBudgets(file, revision, reader))
+    return scopes[revision].get(file)
+  }
+  const atHead = oracles.filter(
+    (file) => reader.text(file, `head`) !== undefined,
+  )
   const lowered = []
-  for (const file of changedOracleFiles(base)) {
-    const before = show(base, file)
-    if (before === undefined) continue
-    const after = readFileSync(join(root, file), `utf8`)
-    const previous = runBudgets(before, file)
-    const current = runBudgets(after, file)
-    for (const [key, was] of previous) {
-      const now = current.get(key)
-      if (now !== undefined && now < was) lowered.push({ file, key, was, now })
+  for (const file of oracles) {
+    if (reader.text(file, `base`) === undefined) continue
+    const affected = [file, ...dependencies(file, reader, `head`)].some(
+      (candidate) => changed.has(candidate),
+    )
+    if (!affected) continue
+    for (const [key, was] of scope(file, `base`)) {
+      let now = scope(file, `head`).get(key)
+      if (now === undefined) {
+        const holders = atHead.filter(
+          (other) => other !== file && scope(other, `head`).has(key),
+        )
+        if (holders.length === 0) {
+          lowered.push({ file, key, was })
+          continue
+        }
+        // A key that another file already had at base is that file's own.
+        const movedTo = holders.filter(
+          (other) => !scope(other, `base`).has(key),
+        )
+        if (movedTo.length !== 1) continue
+        now = scope(movedTo[0], `head`).get(key)
+      }
+      if (now < was) lowered.push({ file, key, was, now })
     }
   }
   return lowered
 }
 
+/** Every keyed run budget that the branch lowered or removed, in this repository. */
+export function loweredRunBudgets() {
+  return loweredRunBudgetsBetween(root, mergeBase())
+}
+
 export function describeLoweredRunBudget({ key, was, now }) {
-  return `${key}: run budget lowered from ${was} to ${now}`
+  return now === undefined
+    ? `${key}: run budget removed (was ${was})`
+    : `${key}: run budget lowered from ${was} to ${now}`
 }
 
-if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+// Importing this module, as the lint script does, must not run the report.
+if (
+  process.argv[1] !== undefined &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
   const { values: options } = parseArgs({
     options: { format: { type: `string`, default: `text` } },
   })
@@ -194,7 +478,7 @@ if (import.meta.url === pathToFileURL(process.argv[1]).href) {
     const message = describeLoweredRunBudget(budget)
     if (options.format === `github`) {
       console.log(
-        `::warning file=${budget.file},title=Lowered oracle run budget::${message}`,
+        `::warning file=${budget.file},title=${budget.now === undefined ? `Removed` : `Lowered`} oracle run budget::${message}`,
       )
     } else {
       console.log(`${budget.file}: ${message}`)
diff --git a/scripts/eslint-plugin-oracle/index.js b/scripts/eslint-plugin-oracle/index.js
index 1362fa2933..d6a38d34da 100644
--- a/scripts/eslint-plugin-oracle/index.js
+++ b/scripts/eslint-plugin-oracle/index.js
@@ -1,23 +1,32 @@
 import noDisabled from './rules/no-disabled.js'
+import noUnitTest from './rules/no-unit-test.js'
 
 /**
  * Lint rules for oracle files.
  *
  * AGENTS.md lists the shortcuts that make an oracle pass without enforcing
  * its law ("How oracle work is scored"). These rules report the ones that a
- * syntactic check can see, in files whose names contain `oracle`. They need no
- * type information, so an agent's post-edit hook can run them on one file in
- * well under a second. A directive can silence them in the root config, so
+ * syntactic check can see, in TypeScript and JavaScript files whose names
+ * contain `oracle`. They need no type information, so an agent's post-edit hook
+ * can run them on one file in well under a second. A directive can silence them in the root config, so
  * scripts/agent-lint-feedback.mjs enforces them in a pass that ignores inline
  * directives.
  */
 
-const oracleFiles = [`**/*oracle*.ts`, `**/*oracle*.tsx`]
+// The same names that scripts/check-oracle-run-counts.mjs `isOracleFile` accepts.
+const oracleFiles = [
+  `**/*oracle*.ts`,
+  `**/*oracle*.tsx`,
+  `**/*oracle*.js`,
+  `**/*oracle*.mjs`,
+  `**/*oracle*.jsx`,
+]
 
 const plugin = {
   meta: { name: `eslint-plugin-oracle` },
   rules: {
     'no-disabled': noDisabled,
+    'no-unit-test': noUnitTest,
   },
 }
 
@@ -28,6 +37,7 @@ plugin.configs = {
     plugins: { oracle: plugin },
     rules: {
       'oracle/no-disabled': `error`,
+      'oracle/no-unit-test': `error`,
     },
   },
 }
diff --git a/scripts/eslint-plugin-oracle/no-disabled.test.js b/scripts/eslint-plugin-oracle/no-disabled.test.js
index 1f19462fe1..40cc1a4449 100644
--- a/scripts/eslint-plugin-oracle/no-disabled.test.js
+++ b/scripts/eslint-plugin-oracle/no-disabled.test.js
@@ -1,4 +1,4 @@
-import { describe, it } from 'node:test'
+import { describe, it } from 'vitest'
 import { RuleTester } from 'eslint'
 import tsParser from '@typescript-eslint/parser'
 import noDisabled from './rules/no-disabled.js'
diff --git a/scripts/eslint-plugin-oracle/no-unit-test.test.js b/scripts/eslint-plugin-oracle/no-unit-test.test.js
new file mode 100644
index 0000000000..c04ad96995
--- /dev/null
+++ b/scripts/eslint-plugin-oracle/no-unit-test.test.js
@@ -0,0 +1,460 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, it } from 'vitest'
+import { RuleTester } from 'eslint'
+import tsParser from '@typescript-eslint/parser'
+import noUnitTest from './rules/no-unit-test.js'
+
+RuleTester.describe = describe
+RuleTester.it = it
+
+// Companion modules on disk, so that the rule resolves real imports.
+const root = mkdtempSync(join(tmpdir(), `oracle-no-unit-test-`))
+const tests = join(root, `tests`)
+mkdirSync(join(root, `src`), { recursive: true })
+mkdirSync(tests, { recursive: true })
+writeFileSync(
+  join(tests, `history-oracle.ts`),
+  `import { declareOracle } from './oracle-config.js'
+function checkHistory(history) { return history }
+function modelHistory(history) { return history }
+declareOracle({ check: [checkHistory], model: [modelHistory] })
+export async function runHistory(history) { return checkHistory(history) }
+export function fixture() { return [] }
+export { modelHistory }
+// Every caller here passes work that runs the check, but an importer passes
+// its own work.
+export async function withCleanup(work) { return work() }
+export class Relation { add() {} }
+declareOracle({ check: [Relation] })
+it('checks with cleanup', () => withCleanup(() => runHistory([])))
+`,
+)
+writeFileSync(
+  join(tests, `history-reexport.ts`),
+  `export { runHistory as replayHistory } from './history-oracle.js'
+export * from './history-oracle.js'
+`,
+)
+writeFileSync(
+  join(root, `src`, `production.ts`),
+  `import { declareOracle } from '../tests/oracle-config.js'
+function compile(x) { return x }
+declareOracle({ check: [compile] })
+export { compile }
+`,
+)
+writeFileSync(join(root, `package.json`), JSON.stringify({ name: `published` }))
+// A private package, such as an end-to-end suite, keeps its oracle in src/.
+const suite = join(root, `suite`)
+mkdirSync(join(suite, `src`), { recursive: true })
+writeFileSync(
+  join(suite, `package.json`),
+  JSON.stringify({ name: `suite`, private: true }),
+)
+writeFileSync(
+  join(suite, `src`, `laws-oracle.ts`),
+  `import { declareOracle } from './oracle-config.js'
+export function checkLaws(observation) { return observation }
+declareOracle({ check: [checkLaws] })
+`,
+)
+const filename = join(tests, `subject-oracle.test.ts`)
+const suiteFilename = join(suite, `src`, `pages-oracle.suite.ts`)
+
+const header = `import { declareOracle } from './oracle-config.js'
+function checkHistory(history) { return history }
+function modelHistory(history) { return history }
+declareOracle({ check: [checkHistory], model: [modelHistory] })
+`
+
+const fcImport = `import { fc, test as fcTest } from '@fast-check/vitest'\n`
+
+const ruleTester = new RuleTester({
+  languageOptions: { parser: tsParser, sourceType: `module` },
+})
+
+ruleTester.run(`oracle/no-unit-test`, noUnitTest, {
+  valid: [
+    // A generated property reaches the declared check.
+    {
+      code: `${header}fcTest.prop([history])('checks generated histories', (h) => checkHistory(h))`,
+      filename,
+    },
+    // A fixed history reaches the check through a driver.
+    {
+      code: `${header}async function run(h) { await checkHistory(h) }
+it('retains a row after an update', async () => { await run([{ type: 'update' }]) })`,
+      filename,
+    },
+    // A driver held in a constant, and a body passed by name.
+    {
+      code: `${header}const run = (h) => checkHistory(h)
+const replay = () => run([])
+it('replays the pinned history', replay)`,
+      filename,
+    },
+    // A model pin reaches the declared model.
+    {
+      code: `${header}it('keeps an empty diff pending', () => { expect(modelHistory([])).toEqual([]) })`,
+      filename,
+    },
+    // A table of fixed histories.
+    {
+      code: `${header}it.each(cases)('checks %s', (c) => checkHistory(c))`,
+      filename,
+    },
+    // A calibration witness reaches the check through the selection helper.
+    {
+      code: `import { declareOracle, oracleCalibrationTest } from './oracle-config.js'
+function checkHistory(history) { return history }
+declareOracle({ check: [checkHistory] })
+oracleCalibrationTest(it, 'p', 'fault')('rejects the hostile mutant', () => checkHistory(bad))`,
+      filename,
+    },
+    // A class model.
+    {
+      code: `import { declareOracle } from './oracle-config.js'
+class Model { step() {} }
+function checkHistory(h) { return h }
+declareOracle({ check: [checkHistory], model: [Model] })
+it('steps the model', () => { new Model().step() })`,
+      filename,
+    },
+    // A companion module declares the check, and its driver reaches it.
+    {
+      code: `import { runHistory } from './history-oracle.js'
+it('checks a fixed history', () => runHistory([]))`,
+      filename,
+    },
+    // A re-export and an export star keep the reach.
+    {
+      code: `import { replayHistory, modelHistory } from './history-reexport.js'
+it('replays', () => replayHistory([]))
+it('pins the model', () => modelHistory([]))`,
+      filename,
+    },
+    // A private package's src/ is test code, so the rule follows it.
+    {
+      code: `import { checkLaws } from './laws-oracle.js'
+it('checks the page laws', () => checkLaws([]))`,
+      filename: suiteFilename,
+    },
+    // A test of the shared oracle machinery checks no law.
+    {
+      code: `import { readOracleRunConfig } from './oracle-config.js'
+it('rejects a retired variable', () => expect(() => readOracleRunConfig({})).toThrow())`,
+      filename: join(tests, `oracle-config.test.ts`),
+    },
+    // A helper that registers the property its caller passes in.
+    {
+      code: `${header}function serializerProp(name, check) {
+  fcTest.prop([value])(name, check)
+}
+serializerProp('round-trips a value', (v) => checkHistory(v))
+serializerProp('round-trips an array', (v) => checkHistory([v]))`,
+      filename,
+    },
+    // A grammar calibration reaches the declared grammar.
+    {
+      code: `import { declareOracle } from './oracle-config.js'
+const historyGrammar = fc.array(action)
+function checkHistory(h) { return h }
+declareOracle({ check: [checkHistory], grammar: [historyGrammar] })
+it('reaches every action kind', () => { expect(kinds(fc.sample(historyGrammar, 200))).toEqual(allKinds) })`,
+      filename,
+    },
+    // A generated property is its own check, with or without a declaration.
+    {
+      code: `${fcImport}fcTest.prop([fc.integer(), fc.integer()])('compares antisymmetrically', (a, b) => {
+  expect(Math.sign(compare(a, b))).toBe(-Math.sign(compare(b, a)))
+})`,
+      filename,
+    },
+    {
+      code: `${fcImport}it('round-trips every value', () => {
+  fc.assert(fc.property(fc.string(), (value) => expect(decode(encode(value))).toBe(value)))
+})`,
+      filename,
+    },
+    // A property defined elsewhere, and a helper whose callers pass laws.
+    {
+      code: `${fcImport}const roundTrip = fc.property(fc.string(), (value) => decode(encode(value)) === value)
+it('round-trips', () => fc.assert(roundTrip))
+function utilsProperty(name, arbitraries, check) { fcTest.prop(arbitraries)(name, check) }
+utilsProperty('is reflexive', [fc.anything()], (x) => expect(isEqual(x, x)).toBe(true))
+utilsProperty('is symmetric', [fc.anything(), fc.anything()], (x, y) => expect(isEqual(x, y)).toBe(isEqual(y, x)))`,
+      filename,
+    },
+    // A registration that passes named arbitraries and a named predicate.
+    {
+      code: `${fcImport}const arbitraries = [fc.integer(), fc.string()]
+async function checkCampaign(id, name) { expect(await publish(id, name)).toBe(name) }
+const checkPolicy = async (id) => expect(await persist(id)).toBe(id)
+fcTest.prop(arbitraries)('publishes generated commits', checkCampaign)
+fcTest.prop(arbitraries)('persists generated commits', checkPolicy)`,
+      filename,
+    },
+    // A table row that calls a declared check.
+    {
+      code: `${header}it.each([{ name: 'stale', reject: () => checkHistory(stale) }])('rejects $name', ({ reject }) => expect(reject).toThrow())`,
+      filename,
+    },
+    // A named property predicate that reads its input.
+    {
+      code: `${fcImport}function roundTrips(value) { expect(decode(encode(value))).toBe(value) }
+it('round-trips every value', () => fc.assert(fc.property(fc.string(), roundTrips)))`,
+      filename,
+    },
+    // An exported class declared as a check in its home module.
+    {
+      code: `import { Relation } from './history-oracle.js'
+it('adds a row', () => { new Relation().add() })`,
+      filename,
+    },
+    // A type-level test that compares with a declared type model.
+    {
+      code: `import { declareOracle } from './oracle-config.js'
+type PublishedValueFor<T> = T extends { id: unknown } ? T & { $key: string } : T
+declareOracle({ typeModel: [\`PublishedValueFor\`] })
+type PublishedRow = PublishedValueFor<Row>
+test('publishes row roots', () => {
+  expectTypeOf(rowOf(query)).toEqualTypeOf<PublishedValueFor<Row>>()
+})
+test('publishes a named row root', () => {
+  expectTypeOf(rowOf(query)).toEqualTypeOf<PublishedRow>()
+})`,
+      filename,
+    },
+    // declareOracle can come from the dependency-free oracle-declaration module.
+    {
+      code: `import { declareOracle } from './oracle-declaration.js'
+function checkHistory(history) { return history }
+declareOracle({ check: [checkHistory] })
+it('checks a fixed history', () => checkHistory([]))`,
+      filename,
+    },
+    // A coverage calibration reads a Set that grammar-driven tests fill with
+    // the model's predictions.
+    {
+      code: `${header}const covered = new Set()
+it.each(cases)('runs %s', (c) => { covered.add(modelHistory(c)); checkHistory(c) })
+it('covers every outcome', () => expect([...covered]).toEqual(['a', 'b']))`,
+      filename,
+    },
+    // A placeholder registered during a replay runs nothing.
+    {
+      code: `it.skip('runs only when its replay property is selected', () => {})`,
+      filename,
+    },
+    // A suite and a Playwright step are not tests.
+    {
+      code: `${header}describe('suite', () => {
+  test('runs a browser history', async () => { await test.step('open', async () => {}); checkHistory([]) })
+})`,
+      filename,
+    },
+    // A file with no tests needs no declaration.
+    { code: `export function fixture() { return [] }`, filename },
+  ],
+  invalid: [
+    // The reported failure: production compared with a hand-written value.
+    {
+      code: `${header}import { compileExpression } from '../src/compiler.js'
+fcTest.prop([history])('checks generated histories', (h) => checkHistory(h))
+it('handles a simple table reference', () => {
+  expect(compileExpression(ref)(row)).toEqual({ id: 1 })
+})`,
+      filename,
+      errors: [{ messageId: `unitTest`, line: 7 }],
+    },
+    // A unit test registered through a selection helper's result, or
+    // through a renamed import, is still a test.
+    {
+      code: `${header}import { oracleReplayTest } from './oracle-config.js'
+import { it as vitestIt } from 'vitest'
+const fixedCase = oracleReplayTest(vitestIt)
+fixedCase('checks', () => checkHistory([]))
+fixedCase('compiles', () => expect(compile(1)).toBe(1))
+vitestIt('compiles again', () => expect(compile(2)).toBe(2))`,
+      filename,
+      errors: [
+        { messageId: `unitTest`, line: 9 },
+        { messageId: `unitTest`, line: 10 },
+      ],
+    },
+    // A file with tests and no declaration gets one report.
+    {
+      code: `import { compile } from '../src/compiler.js'
+it('a', () => expect(compile(1)).toBe(1))
+it('b', () => expect(compile(2)).toBe(2))`,
+      filename,
+      errors: [{ messageId: `undeclared`, line: 2 }],
+    },
+    // A local function named declareOracle declares nothing.
+    {
+      code: `function declareOracle() {}
+function checkHistory(h) { return h }
+declareOracle({ check: [checkHistory] })
+it('checks', () => checkHistory([]))`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    // A production module declares no oracle part, even when it calls the
+    // helper, so the rule does not follow it.
+    {
+      code: `${header}import { compile } from '../src/production.js'
+it('checks', () => checkHistory([]))
+it('compiles', () => expect(compile(1)).toBe(1))`,
+      filename,
+      errors: [{ messageId: `unitTest`, line: 7 }],
+    },
+    // A local binding that shadows the check is not the check.
+    {
+      code: `${header}it('checks', () => { const checkHistory = (x) => x; expect(checkHistory(1)).toBe(1) })`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+    // A helper that only uses itself reaches nothing.
+    {
+      code: `${header}function loop(n) { return n === 0 ? 0 : loop(n - 1) }
+it('counts down', () => expect(loop(3)).toBe(0))`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+    // A type annotation runs nothing, so it does not reach the check.
+    {
+      code: `${header}it('types', () => { const check: typeof checkHistory | undefined = undefined; expect(check).toBeUndefined() })`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+    // A companion module's fixture does not reach its check.
+    {
+      code: `import { runHistory, fixture } from './history-oracle.js'
+it('checks a fixed history', () => runHistory([]))
+it('builds a fixture', () => expect(fixture()).toEqual([]))`,
+      filename,
+      errors: [{ messageId: `unitTest`, line: 3 }],
+    },
+    // One caller that passes a unit test makes the helper's test a unit test.
+    {
+      code: `${header}const serializerProp = (name, check) => {
+  fcTest.prop([value])(name, check)
+}
+serializerProp('round-trips a value', (v) => checkHistory(v))
+serializerProp('encodes a date', () => expect(encode(date)).toBe('x'))`,
+      filename,
+      errors: [{ messageId: `unitTest`, line: 6 }],
+    },
+    // A helper that nothing calls by name passes nothing the rule can see.
+    {
+      code: `${header}export function register(name, check) { it(name, check) }`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+    // A property over constants, or one that ignores its input, checks
+    // written values.
+    {
+      code: `${fcImport}fcTest.prop([fc.constant(1)])('compiles one', (n) => expect(compile(n)).toBe(1))`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    {
+      code: `${fcImport}fcTest.prop([fc.integer()])('encodes a date', () => expect(encode(date)).toBe('x'))`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    {
+      code: `${fcImport}it('encodes a date', () => {
+  fc.assert(fc.property(fc.integer(), () => expect(encode(date)).toBe('x')))
+})`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    {
+      code: `${header}${fcImport}function utilsProperty(name, arbitraries, check) { fcTest.prop(arbitraries)(name, check) }
+utilsProperty('is reflexive', [fc.anything()], (x) => expect(isEqual(x, x)).toBe(true))
+utilsProperty('encodes a date', [fc.integer()], () => expect(encode(date)).toBe('x'))
+it('checks', () => checkHistory([]))`,
+      filename,
+      errors: [{ messageId: `unitTest`, line: 6 }],
+    },
+    // A named predicate that ignores its input checks one written value.
+    {
+      code: `${fcImport}function encodesDate() { expect(encode(date)).toBe('x') }
+fcTest.prop([fc.integer()])('encodes a date', encodesDate)`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    // A table of written values reaches nothing.
+    {
+      code: `${header}it.each([[1, 2]])('adds %i', (a, b) => expect(add(a, b)).toBe(3))`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+    // Iterating the declared grammar's cells does not reach it: the body must.
+    {
+      code: `import { declareOracle } from './oracle-config.js'
+const cells = [{ a: 1 }]
+function checkHistory(h) { return h }
+declareOracle({ check: [checkHistory], grammar: [cells] })
+it.each(cells)('handles $a', ({ a }) => expect(compile(a)).toBe(1))`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+    // An imported helper that reaches a part only through its home module's
+    // arguments does not reach one for the importer.
+    {
+      code: `import { withCleanup } from './history-oracle.js'
+it('compiles', () => withCleanup(() => expect(compile(1)).toBe(1)))`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    // A named property predicate that ignores its input checks one value.
+    {
+      code: `${fcImport}const ignores = () => expect(encode(date)).toBe('x')
+it('encodes a date', () => {
+  fc.assert(fc.property(fc.integer(), ignores))
+})`,
+      filename,
+      errors: [{ messageId: `undeclared` }],
+    },
+    // A type test that names no type model, and a name that is not a type.
+    {
+      code: `import { declareOracle } from './oracle-config.js'
+type PublishedValueFor<T> = T
+declareOracle({ typeModel: ['PublishedValueFor', 'MissingModel'] })
+test('publishes row roots', () => {
+  expectTypeOf(rowOf(query)).toEqualTypeOf<PublishedValueFor<Row>>()
+})
+test('keeps a number', () => {
+  expectTypeOf(valueOf(query)).toEqualTypeOf<number>()
+})`,
+      filename,
+      errors: [
+        { messageId: `unknownTypeModel`, line: 3 },
+        { messageId: `unitTest`, line: 7 },
+      ],
+    },
+    // A Set filled with written values carries no declared part.
+    {
+      code: `${header}const seen = new Set()
+it('records', () => { seen.add('a') })
+it('reads', () => expect([...seen]).toEqual(['a']))`,
+      filename,
+      errors: [
+        { messageId: `unitTest`, line: 6 },
+        { messageId: `unitTest`, line: 7 },
+      ],
+    },
+    // A test inside a suite and a test passed a timeout are still tests.
+    {
+      code: `${header}describe('suite', () => {
+  it('a', () => expect(1).toBe(1), 1000)
+})`,
+      filename,
+      errors: [{ messageId: `unitTest` }],
+    },
+  ],
+})
diff --git a/scripts/eslint-plugin-oracle/part-reach-oracle.property.test.js b/scripts/eslint-plugin-oracle/part-reach-oracle.property.test.js
new file mode 100644
index 0000000000..e78288a9ea
--- /dev/null
+++ b/scripts/eslint-plugin-oracle/part-reach-oracle.property.test.js
@@ -0,0 +1,2391 @@
+/**
+ * Law: every test registration in an oracle file reaches a declared part, or
+ * the rule reports it. A declared part is a check, a model, a grammar, or a
+ * type model. A registration reaches a part when its body uses one, directly
+ * or through a binding that reaches one, through local functions, imports,
+ * re-exports, and companion modules. A registration whose `.each` or `.for`
+ * table has a function that reaches a part reaches it too.
+ *
+ * A registration that reaches none is reported as a unit test. A file that
+ * declares no part and has no reaching test gets one `undeclared` report. An
+ * unparseable companion reaches nothing, and an oracle file that calls a helper
+ * that registers tests of its own gets one report for the call, unless the
+ * helper's module is linted on its own.
+ *
+ * A binding is reached however it is bound: a named, namespace, or default
+ * import; a `let` that a hook assigns; or a `for...of` loop variable, which
+ * runs one test per element, so every element must reach. A helper that
+ * registers its caller's body, directly or wrapped in a function of its own,
+ * is judged at the call by the argument it registers. The test also reaches
+ * when the wrapper itself uses a part. A generated property counts as its own
+ * check when one of its arbitraries generates values and its predicate reads
+ * its input. The arbitrary may be named, and the predicate may be imported.
+ *
+ * Authority: the header contract of `rules/no-unit-test.js`, which states the
+ * reach rules and the report rules, and its laws L1 (reports are a pure
+ * function of the source files), L2 (every registration form is checked), L3
+ * (every declared part counts), and L6 (an oracle file registers only oracle
+ * tests, including tests that its imported functions register);
+ * docs/contributing/oracle-rubric.md "Name oracle files consistently", which
+ * says that an oracle-named helper "is linted on its own"; and AGENTS.md "Name
+ * Oracle Files for Discovery". `export *` does not re-export a default export
+ * (ECMAScript, ExportDeclaration semantics), so a default import resolves only
+ * a module's own default.
+ *
+ * Limits. The grammar does not generate function parameters other than a
+ * helper's, `describe` placeholders, declared import bindings, type models
+ * built from other models, a `let` assigned more than once, a `for...of` over
+ * a named array, or a predicate or arbitrary from a package. It builds at most
+ * three companion modules, three functions per module, and six registrations
+ * per oracle file. The receiving paths are a long-lived ESLint instance, a
+ * single-file Linter call, the lint CLI on changed files, and the CLI's
+ * edit-hook form. The CLI lints only files inside its repository, so its paths
+ * write scratch files in `part-reach-scratch-*` directories there, which git
+ * ignores, and remove them afterwards.
+ *
+ * Structure:
+ *   1. The grammar draws a skeleton and builds a legal program from it.
+ *   2. The model predicts the reports from the program, without the rule.
+ *   3. The drivers render the program and lint it on each receiving path.
+ *   4. The comparison checks that each path's reports equal the prediction.
+ *   5. Campaigns run the comparison with fixed and random seeds, and check
+ *      order invariance, rerun equality, and companion edits between lints.
+ */
+import { spawnSync } from 'node:child_process'
+import {
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import tsParser from '@typescript-eslint/parser'
+import { ESLint, Linter } from 'eslint'
+import fc from 'fast-check'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import {
+  oraclePropertyOptions,
+  oracleRuns,
+} from '../../packages/db/tests/oracle-config.js'
+import { createOracleReach } from '../../packages/db/tests/oracle-reach.js'
+import { declareOracle } from '../../packages/db/tests/oracle-declaration.js'
+import oraclePlugin from './index.js'
+
+declareOracle({
+  check: [compareReports],
+  model: [predictReports],
+  grammar: [programArbitrary],
+})
+
+const RULE = `oracle/no-unit-test`
+const ORACLE = `case-oracle.test.ts`
+const PROPERTY = `lint.part-reach`
+const FIXED_SEED = 2234
+const BASE_RUNS = 30
+const repoRoot = fileURLToPath(new URL(`../../`, import.meta.url))
+
+// -- 1. Grammar ---------------------------------------------------------------
+//
+// A skeleton is a tree of fast-check values. Each reference index is taken
+// modulo the number of names that exist, so every skeleton builds a legal
+// program. A reference that has no target is dropped. Feature gates turn a
+// family of forms on, so each campaign studies one dimension at a time.
+
+const SLOTS = 3
+const REFS = 3
+
+// Local references are the most common, because mutual recursion among the
+// oracle's functions is the shape that the reach rule must get right.
+const refSkeleton = fc.record({
+  kind: fc.oneof(
+    { weight: 4, arbitrary: fc.constant(`local`) },
+    { weight: 1, arbitrary: fc.constant(`import`) },
+    { weight: 1, arbitrary: fc.constant(`type`) },
+  ),
+  index: fc.nat({ max: 9 }),
+})
+
+const slotSkeleton = fc.record({
+  present: fc.boolean(),
+  exported: fc.boolean(),
+  part: fc.constantFrom(`none`, `none`, `check`, `model`, `grammar`),
+  refs: fc.array(refSkeleton, { maxLength: REFS }),
+})
+
+// A named import is the common form. A namespace import reads the same export
+// through a member, and a default import reads the target's default export.
+const importForm = fc.oneof(
+  { weight: 3, arbitrary: fc.constant(`named`) },
+  { weight: 1, arbitrary: fc.constant(`namespace`) },
+  { weight: 1, arbitrary: fc.constant(`default`) },
+)
+
+const linkSkeleton = fc.record({
+  target: fc.nat({ max: 9 }),
+  slot: fc.nat({ max: SLOTS - 1 }),
+  form: importForm,
+})
+
+// A re-export imports one name and exports it under another, drawn from the
+// same pool. That lets two modules re-export each other's names: a cycle.
+const reexportSkeleton = fc.record({
+  target: fc.nat({ max: 9 }),
+  slot: fc.nat({ max: SLOTS - 1 }),
+  exportIndex: fc.nat({ max: 99 }),
+})
+
+const moduleSkeleton = fc.record({
+  slots: fc.tuple(slotSkeleton, slotSkeleton, slotSkeleton),
+  stars: fc.array(fc.nat({ max: 9 }), { maxLength: 2 }),
+  reexports: fc.array(reexportSkeleton, { maxLength: 2 }),
+  imports: fc.array(linkSkeleton, { maxLength: 3 }),
+  typeAliases: fc.tuple(fc.boolean(), fc.boolean(), fc.boolean()),
+  typeNames: fc.array(fc.nat({ max: 3 }), { maxLength: 2 }),
+  missingPart: fc.boolean(),
+  stringKeys: fc.boolean(),
+  // The slot that the module exports as its default, if any.
+  defaultSlot: fc.option(fc.nat({ max: SLOTS - 1 }), { nil: undefined }),
+  // Whether the declaration takes its first part list from a spread object.
+  spread: fc.boolean(),
+  // Whether a companion is a JavaScript module, which holds no type syntax.
+  js: fc.boolean(),
+})
+
+const FORMS = [
+  `plain`,
+  `identifier`,
+  `call`,
+  `member`,
+  `options-first`,
+  `options-last`,
+  `each`,
+  `for`,
+  `helper-plain`,
+  `helper-prop`,
+  `property`,
+  `prop-named`,
+  `let-driver`,
+  `for-of`,
+]
+
+// How a caller-passed-body helper registers the body: as its argument, with a
+// trailing timeout after it, or wrapped in a function of the helper's own,
+// which may await the body or use a declared part of a companion.
+const WRAPS = [`direct`, `timed`, `wrap`, `wrap-async`, `wrap-part`]
+
+// The form index is taken modulo the forms that the feature set enables, so
+// each enabled form gets an equal share of the registrations.
+const registrationSkeleton = fc.record({
+  formIndex: fc.nat({ max: FORMS.length - 1 }),
+  constantArb: fc.boolean(),
+  refs: fc.array(refSkeleton, { maxLength: REFS }),
+  callee: fc.nat({ max: 9 }),
+  literalOptions: fc.boolean(),
+  wrapped: fc.boolean(),
+  rows: fc.array(
+    fc.oneof(
+      fc.record({ fn: fc.array(refSkeleton, { maxLength: REFS }) }),
+      fc.record({ value: fc.constant(1) }),
+    ),
+    { minLength: 1, maxLength: 3 },
+  ),
+  // A caller-passed-body helper's layout, and what follows a timed body.
+  wrap: fc.nat({ max: WRAPS.length - 1 }),
+  trailing: fc.constantFrom(`literal`, `name`),
+  // A generated property's arbitrary is written inline or bound to a name;
+  // its predicate is inline, a local function, or imported, and reads its
+  // input or not.
+  arbNamed: fc.boolean(),
+  predicate: fc.constantFrom(`inline`, `local`, `imported`),
+  readsInput: fc.boolean(),
+  // The functions that a `for...of` driver runs, one test each.
+  elements: fc.array(fc.nat({ max: 9 }), { minLength: 1, maxLength: 2 }),
+})
+
+const programSkeleton = fc.record({
+  companions: fc.array(moduleSkeleton, { maxLength: 3 }),
+  broken: fc.boolean(),
+  // An ordinary module, an oracle-named module that is linted on its own, and
+  // an `oracle-` machinery module, which the rule does not lint.
+  registrarName: fc.constantFrom(`reg.ts`, `reg-oracle.ts`, `oracle-reg.ts`),
+  registrarImport: importForm,
+  helperName: fc.constantFrom(
+    `reg-helper.ts`,
+    `reg-helper-oracle.ts`,
+    `oracle-reg-helper.ts`,
+  ),
+  helperImport: fc.constantFrom(`named`, `namespace`),
+  oracle: fc.record({
+    module: moduleSkeleton,
+    objectRefs: fc.array(refSkeleton, { maxLength: REFS }),
+    registrarCall: fc.boolean(),
+    tests: fc.array(registrationSkeleton, { maxLength: 6 }),
+  }),
+})
+
+/** The grammar's feature gates. A campaign turns on one family at a time. */
+const BASE = {
+  companions: true,
+  forms: [`plain`, `identifier`, `each`],
+  stars: false,
+  broken: false,
+  registrar: false,
+  stringKeys: false,
+  typeModels: false,
+  // Off: every import is named, and every helper is a direct `regPlain` in an
+  // ordinary module, imported by name.
+  importForms: false,
+  helperLayouts: false,
+  helperNames: false,
+  spreads: false,
+  jsCompanions: false,
+}
+const ALL = {
+  companions: true,
+  forms: FORMS,
+  stars: true,
+  broken: true,
+  registrar: true,
+  stringKeys: true,
+  typeModels: true,
+  importForms: true,
+  helperLayouts: true,
+  helperNames: true,
+  spreads: true,
+  jsCompanions: true,
+}
+
+/** A module that the lint selection lints as an oracle file. */
+const lintedOnItsOwn = (file) =>
+  file.includes(`oracle`) && !file.startsWith(`oracle-`)
+
+function programArbitrary(features) {
+  return programSkeleton.map((skeleton) => buildProgram(skeleton, features))
+}
+
+// -- Program: the builder ----------------------------------------------------
+
+const stemOf = (file) => file.replace(/\.(ts|js)$/, ``)
+const specOf = (file) => `./${stemOf(file)}.js`
+const nodeKey = (file, name) => `${file}\0${name}`
+
+/**
+ * A program, as the model and the drivers read it:
+ *   modules: Map file -> module (see buildModule)
+ *   oracle: the file that the rule lints
+ *   tests: the oracle's registrations, in source order
+ *   calls: the calls that the oracle makes to imported helpers
+ */
+function buildProgram(skeleton, features) {
+  // A single-file program has no companion, so its recursion is only the
+  // oracle's own functions.
+  const companions = features.companions ? skeleton.companions : []
+  const companionFiles = companions.map(
+    (companion, index) =>
+      `c${index}.${features.jsCompanions && companion.js ? `js` : `ts`}`,
+  )
+  const brokenFile =
+    features.broken && skeleton.broken ? `broken.ts` : undefined
+  const registrarFile =
+    features.registrar && skeleton.oracle.registrarCall
+      ? skeleton.registrarName
+      : undefined
+  const modules = new Map()
+  // An acyclic program lets a companion import only from earlier companions, so
+  // no export cycle can form.
+  const targetsOf = (self) => [
+    ...companionFiles.filter((file) =>
+      features.acyclic ? file < self : file !== self,
+    ),
+    ...(brokenFile ? [brokenFile] : []),
+  ]
+  const oracleTargets = [...companionFiles, ...(brokenFile ? [brokenFile] : [])]
+  // The names that a re-export may export under: every companion slot.
+  const pool = companionFiles.flatMap((file) =>
+    [0, 1, 2].map((index) => slotName(file, index)),
+  )
+
+  companions.forEach((companion, index) => {
+    const file = companionFiles[index]
+    modules.set(
+      file,
+      buildModule({
+        file,
+        role: `companion`,
+        skeleton: companion,
+        targets: targetsOf(file),
+        pool,
+        features,
+        extras: [],
+      }),
+    )
+  })
+  if (brokenFile !== undefined) {
+    modules.set(brokenFile, {
+      file: brokenFile,
+      role: `broken`,
+      bindings: new Map(),
+      exportEntries: [],
+      stars: [],
+      imports: new Map(),
+      types: new Set(),
+      typeNames: [],
+      parts: new Map(),
+      missing: [],
+      declares: false,
+      stringKeys: false,
+    })
+  }
+  const emptyModule = (file, role, fields = {}) => ({
+    file,
+    role,
+    bindings: new Map(),
+    exportEntries: [],
+    stars: [],
+    imports: new Map(),
+    types: new Set(),
+    typeNames: [],
+    parts: new Map(),
+    missing: [],
+    declares: false,
+    stringKeys: false,
+    spread: false,
+    ...fields,
+  })
+  if (registrarFile !== undefined) {
+    modules.set(
+      registrarFile,
+      emptyModule(registrarFile, `registrar`, {
+        bindings: new Map([
+          [`regAll`, { kind: `fn`, refs: [], exported: true }],
+        ]),
+        exportEntries: [
+          { name: `regAll`, local: `regAll` },
+          { name: `default`, local: `regAll` },
+        ],
+      }),
+    )
+  }
+  const registrarImport = features.importForms
+    ? skeleton.registrarImport
+    : `named`
+  const oracleSkeleton = skeleton.oracle
+  const oracle = buildModule({
+    file: ORACLE,
+    role: `oracle`,
+    skeleton: oracleSkeleton.module,
+    targets: oracleTargets,
+    pool,
+    features,
+    // The helpers that registrations use: `oobj` holds a method body, `oopt`
+    // is a non-function options value, and `owrap` is a callee that reaches
+    // nothing. Their references resolve like any other binding's.
+    extras: [
+      { name: `oobj`, kind: `obj`, refs: oracleSkeleton.objectRefs },
+      { name: `oopt`, kind: `opt`, refs: [] },
+      { name: `owrap`, kind: `fn`, refs: [] },
+    ],
+    registrarFile,
+    registrarImport,
+  })
+  modules.set(ORACLE, oracle)
+  const helperFile = features.helperNames
+    ? skeleton.helperName
+    : `reg-helper.ts`
+  const context = {
+    oracle,
+    features,
+    companionFiles,
+    helperFile,
+  }
+  const tests = oracleSkeleton.tests.map((test, index) =>
+    buildRegistration(test, index, context),
+  )
+  const isRegistrarAlias = (alias) =>
+    registrarFile !== undefined &&
+    oracle.imports.get(alias)?.from === registrarFile
+  const calls = []
+  if (registrarFile !== undefined) {
+    calls.push({ alias: `regAll`, file: registrarFile })
+  }
+  // An imported helper that registers the body its caller passes. The oracle
+  // file imports it by name or through a namespace.
+  if (tests.some((test) => test.helper !== undefined)) {
+    const form = features.importForms ? skeleton.helperImport : `named`
+    for (const name of HELPER_EXPORTS) {
+      oracle.imports.set(name, { from: helperFile, imported: name, form })
+    }
+    // `regWrapPart`'s wrapper uses the first companion's first function.
+    const helperImports = new Map()
+    if (companionFiles.length > 0) {
+      helperImports.set(`hpart`, {
+        from: companionFiles[0],
+        imported: slotName(companionFiles[0], 0),
+        form: `named`,
+      })
+    }
+    modules.set(
+      helperFile,
+      emptyModule(helperFile, `helper`, {
+        imports: helperImports,
+        bindings: new Map([
+          [
+            `hpart-wrapper`,
+            {
+              kind: `fn`,
+              refs: helperImports.has(`hpart`)
+                ? [{ kind: `import`, alias: `hpart` }]
+                : [],
+            },
+          ],
+        ]),
+      }),
+    )
+  }
+  // The module that exports the imported predicates, which read their input
+  // or ignore it.
+  if (tests.some((test) => test.property?.predicate === `imported`)) {
+    oracle.imports.set(`predReads`, {
+      from: `pred.ts`,
+      imported: `predReads`,
+      form: `named`,
+    })
+    oracle.imports.set(`predIgnores`, {
+      from: `pred.ts`,
+      imported: `predIgnores`,
+      form: `named`,
+    })
+    modules.set(`pred.ts`, emptyModule(`pred.ts`, `pred`))
+  }
+  for (const test of tests) {
+    const { body } = test
+    if (
+      body.kind === `call` &&
+      body.callee.kind === `import` &&
+      isRegistrarAlias(body.callee.alias)
+    ) {
+      calls.push({
+        alias: body.callee.alias,
+        file: registrarFile,
+        test: test.title,
+      })
+    }
+  }
+  return { oracle: ORACLE, modules, tests, calls, helperFile }
+}
+
+// The helper module's exports, in the order HELPER_TEXT defines them.
+const HELPER_EXPORTS = [
+  `regPlain`,
+  `regTimed`,
+  `regWrap`,
+  `regWrapAsync`,
+  `regWrapPart`,
+  `regProp`,
+]
+const HELPER_OF_WRAP = {
+  direct: `regPlain`,
+  timed: `regTimed`,
+  wrap: `regWrap`,
+  'wrap-async': `regWrapAsync`,
+  'wrap-part': `regWrapPart`,
+}
+
+/** The prefix of a module's own function names: `ofn` in an oracle, `c0f` in c0. */
+function prefixOf(file, role) {
+  return role === `oracle` ? `ofn` : `${stemOf(file)}f`
+}
+
+/** The name that slot `index` of `file` exports, or the broken module's name. */
+function slotName(file, index) {
+  return file.startsWith(`broken`) ? `brokenFn` : `${stemOf(file)}f${index}`
+}
+
+function buildModule({
+  file,
+  role,
+  skeleton,
+  targets,
+  pool,
+  features,
+  extras,
+  registrarFile,
+  registrarImport = `named`,
+}) {
+  const prefix = prefixOf(file, role)
+  const pick = (index) =>
+    targets.length === 0 ? undefined : targets[index % targets.length]
+  const bindings = new Map()
+  const exportEntries = []
+  const imports = new Map()
+  skeleton.slots.forEach((slot, index) => {
+    if (!slot.present) return
+    const name = `${prefix}${index}`
+    bindings.set(name, {
+      kind: `fn`,
+      refs: [],
+      exported: slot.exported,
+      skeleton: slot.refs,
+      part: slot.part,
+    })
+    if (slot.exported) exportEntries.push({ name, local: name })
+  })
+  // A default export names one of the module's own functions.
+  if (
+    features.importForms &&
+    skeleton.defaultSlot !== undefined &&
+    bindings.has(`${prefix}${skeleton.defaultSlot}`)
+  ) {
+    exportEntries.push({
+      name: `default`,
+      local: `${prefix}${skeleton.defaultSlot}`,
+    })
+  }
+  for (const extra of extras) {
+    bindings.set(extra.name, {
+      kind: extra.kind,
+      refs: [],
+      exported: false,
+      skeleton: extra.refs,
+      part: `none`,
+    })
+  }
+  if (registrarFile !== undefined) {
+    // A default import reads the registrar's default export, which is regAll.
+    imports.set(`regAll`, {
+      from: registrarFile,
+      imported: registrarImport === `default` ? `default` : `regAll`,
+      form: registrarImport,
+    })
+  }
+  const stars = features.stars
+    ? skeleton.stars.map(pick).filter((from) => from !== undefined)
+    : []
+  for (const link of skeleton.reexports) {
+    const from =
+      targets.length === 0 ? undefined : targets[link.target % targets.length]
+    if (from === undefined || pool.length === 0) continue
+    const name = pool[link.exportIndex % pool.length]
+    // An export name is unique within a module, so a re-export that repeats
+    // one is dropped, as a duplicate export is a syntax error.
+    if (exportEntries.some((entry) => entry.name === name)) continue
+    exportEntries.push({ name, from, imported: slotName(from, link.slot) })
+  }
+  skeleton.imports.forEach((link, index) => {
+    const from =
+      targets.length === 0 ? undefined : targets[link.target % targets.length]
+    if (from === undefined) return
+    const form = features.importForms ? link.form : `named`
+    imports.set(`i${index}`, {
+      from,
+      imported: form === `default` ? `default` : slotName(from, link.slot),
+      form,
+    })
+  })
+
+  // References resolve only after every name exists, so a helper such as
+  // `owrap` is a legal target from the oracle's own functions.
+  // Local references name the module's functions. Helpers such as `oobj`
+  // are reached through registration forms, so they do not dilute recursion.
+  const helpers = new Set(extras.map((extra) => extra.name))
+  const names = [...bindings.keys()].filter((name) => !helpers.has(name))
+  const aliases = [...imports.keys()]
+  const resolve = (ref) => resolveRef(ref, names, aliases)
+  const javascript = file.endsWith(`.js`)
+  for (const binding of bindings.values()) {
+    binding.refs = binding.skeleton
+      .map(resolve)
+      .filter(
+        (ref) => ref !== undefined && !(javascript && ref.kind === `type`),
+      )
+    delete binding.skeleton
+  }
+
+  const types = new Set(
+    [`T0`, `T1`, `T2`].filter(
+      (_, index) => !javascript && skeleton.typeAliases[index],
+    ),
+  )
+  const typeNames =
+    !javascript && features.typeModels
+      ? [
+          ...new Set(
+            skeleton.typeNames.map((index) =>
+              index === 3 ? `TX` : `T${index}`,
+            ),
+          ),
+        ]
+      : []
+  const parts = new Map()
+  for (const [name, binding] of bindings) {
+    if (binding.part !== undefined && binding.part !== `none`) {
+      parts.set(name, binding.part)
+    }
+  }
+  const missing = skeleton.missingPart ? [`ghostPart`] : []
+  return {
+    file,
+    role,
+    bindings,
+    exportEntries,
+    stars,
+    imports,
+    types,
+    typeNames,
+    parts,
+    missing,
+    declares: parts.size > 0 || typeNames.length > 0 || missing.length > 0,
+    stringKeys: features.stringKeys && skeleton.stringKeys,
+    spread: features.spreads && skeleton.spread,
+  }
+}
+
+function resolveRef(ref, names, aliases) {
+  if (ref.kind === `local`) {
+    return names.length === 0
+      ? undefined
+      : { kind: `local`, name: names[ref.index % names.length] }
+  }
+  if (ref.kind === `import`) {
+    return aliases.length === 0
+      ? undefined
+      : { kind: `import`, alias: aliases[ref.index % aliases.length] }
+  }
+  return { kind: `type`, name: `T${ref.index % 3}` }
+}
+
+/**
+ * One registration in the oracle file. A form outside the active feature set
+ * falls back to a plain registration, so a gated form never appears by
+ * accident.
+ */
+function buildRegistration(skeleton, index, context) {
+  const { oracle, features, companionFiles } = context
+  const title = `t${index}`
+  const names = [...oracle.bindings.keys()]
+  const aliases = [...oracle.imports.keys()]
+  const resolve = (ref) => resolveRef(ref, names, aliases)
+  const functionNames = names.filter(
+    (name) => name.startsWith(`ofn`) && oracle.bindings.get(name).kind === `fn`,
+  )
+  // A fixed input names its form. A generated skeleton takes the form at its index.
+  const requested =
+    skeleton.form ?? features.forms[skeleton.formIndex % features.forms.length]
+  let form = features.forms.includes(requested) ? requested : `plain`
+  if (
+    (form === `identifier` || form === `for-of`) &&
+    functionNames.length === 0
+  ) {
+    form = `plain`
+  }
+  const refs = skeleton.refs.map(resolve).filter((ref) => ref !== undefined)
+  const test = { title, form, wrapped: skeleton.wrapped, refs }
+  const pickFunction = (value) => functionNames[value % functionNames.length]
+  if (form === `helper-plain` || form === `helper-prop`) {
+    // A layout that needs a companion falls back to a plain wrapper.
+    let wrap = features.helperLayouts
+      ? WRAPS[(skeleton.wrap ?? 0) % WRAPS.length]
+      : `direct`
+    if (wrap === `wrap-part` && companionFiles.length === 0) wrap = `wrap`
+    const trailing =
+      skeleton.trailing === `name` && functionNames.length > 0
+        ? { kind: `name`, name: pickFunction(skeleton.callee) }
+        : { kind: `literal` }
+    test.helper = {
+      prop: form === `helper-prop`,
+      constant: skeleton.constantArb,
+      arbNamed: form === `helper-prop` && (skeleton.arbNamed ?? false),
+      // A property helper registers its body directly, as serializerProp does.
+      wrap: form === `helper-prop` ? `direct` : wrap,
+      trailing,
+      // A plain helper's body ignores its input unless the test is a property.
+      readsInput: form === `helper-prop` ? (skeleton.readsInput ?? true) : true,
+    }
+    test.body = { kind: `arrow`, refs }
+  } else if (form === `property` || form === `prop-named`) {
+    test.property = {
+      constant: skeleton.constantArb,
+      arbNamed: skeleton.arbNamed ?? false,
+      predicate: skeleton.predicate ?? `inline`,
+      readsInput: skeleton.readsInput ?? true,
+    }
+    test.body = { kind: `arrow`, refs: [] }
+  } else if (form === `let-driver`) {
+    test.driver = { kind: `let`, refs }
+    test.body = { kind: `arrow`, refs: [] }
+  } else if (form === `for-of`) {
+    test.driver = {
+      kind: `for-of`,
+      elements: (skeleton.elements ?? [0]).map(pickFunction),
+    }
+    test.body = { kind: `arrow`, refs: [] }
+  } else if (form === `identifier`) {
+    test.body = {
+      kind: `ident`,
+      name: functionNames[skeleton.callee % functionNames.length],
+    }
+  } else if (form === `call`) {
+    const callee =
+      aliases.length > 0 && skeleton.callee % 2 === 1
+        ? { kind: `import`, alias: aliases[skeleton.callee % aliases.length] }
+        : { kind: `local`, name: `owrap` }
+    test.body = { kind: `call`, callee, refs }
+  } else if (form === `member`) {
+    test.body = { kind: `member`, object: `oobj` }
+  } else if (form === `options-first` || form === `options-last`) {
+    test.body = { kind: `arrow`, refs }
+    test.options = {
+      at: form === `options-first` ? `first` : `last`,
+      literal: skeleton.literalOptions,
+    }
+  } else if (form === `each` || form === `for`) {
+    test.table = {
+      kind: form,
+      rows: skeleton.rows.map((row) =>
+        row.fn === undefined
+          ? { value: 1 }
+          : { fn: row.fn.map(resolve).filter((ref) => ref !== undefined) },
+      ),
+    }
+    test.body = { kind: `arrow`, refs: [] }
+  } else {
+    test.body = { kind: `arrow`, refs }
+  }
+  return test
+}
+
+// -- 2. Model -----------------------------------------------------------------
+//
+// The model predicts the reports from the program's structure, without the
+// rule's code. It reads the program as data: each binding's references, each
+// module's exports and stars, and each registration's body and table. A
+// binding reaches a part when it is declared, or when one of its references
+// reaches one; the reach relation is the least fixed point of that equation,
+// found by iterating until no binding changes. A name that a module exports
+// resolves through its named re-exports and its star exports, and a visited
+// set ends a cycle of exports. A type reference reaches a part only when its
+// name is a declared type model with an alias in the same file.
+//
+// A namespace import names an export through a member, so it resolves like a
+// named import. A default import resolves the target's own `default` entry:
+// `export *` does not carry a default (ECMAScript), so stars are not followed.
+//
+// A registration's test reaches a part in one of these ways:
+// - Its body, or a function in its `.each` or `.for` table, uses one.
+// - It registers through a helper that passes on its caller's body. The
+//   test is the argument at the body's position, so a trailing timeout or a
+//   trailing name says nothing. A wrapper that the helper writes around the
+//   body reaches when the wrapper uses a part itself.
+// - It runs a generated property: some arbitrary is not `fc.constant`, under
+//   any name, and the predicate reads its input, wherever it is defined.
+// - It runs a `let` driver, which reaches when the value assigned to it does.
+// - It runs inside a `for...of` loop, which registers one test per element,
+//   so every element must reach (rubric: every test uses a declared part).
+//
+// The predicted report list follows the rule's contract. Each unreached
+// registration is a unit test. A file with no declared part and no reaching
+// registration gets one `undeclared` report, on its first unreached test. Each
+// declared type-model name without an alias is reported. Each call to a helper
+// that registers its own tests is reported, unless the helper's module is
+// linted on its own: an oracle-named module, but not an `oracle-` machinery
+// module, which no lint reads (rubric "Name oracle files consistently"). A
+// helper that passes on its caller's body from a module linted on its own is
+// judged there, so its calls are not judged in the oracle file.
+
+/** The reports that the rule should give for a program, as sorted keys. */
+function predictReports(program) {
+  const oracle = program.modules.get(program.oracle)
+  const importNodes = new Map()
+  // An explicit export of a name shadows the star exports, as in ES. Star
+  // exports are followed only when the module has no explicit export of it.
+  const exportNodes = (file, name, seen = new Set()) => {
+    if (seen.has(nodeKey(file, name))) return []
+    seen.add(nodeKey(file, name))
+    const module = program.modules.get(file)
+    if (module === undefined) return []
+    const entry = module.exportEntries.find(
+      (candidate) => candidate.name === name,
+    )
+    if (entry !== undefined) {
+      if (entry.local === undefined) {
+        return exportNodes(entry.from, entry.imported, seen)
+      }
+      return module.bindings.has(entry.local)
+        ? [nodeKey(file, entry.local)]
+        : []
+    }
+    if (name === `default`) return []
+    return module.stars.flatMap((star) => exportNodes(star, name, seen))
+  }
+  for (const [file, module] of program.modules) {
+    for (const [alias, link] of module.imports) {
+      importNodes.set(
+        nodeKey(file, alias),
+        exportNodes(link.from, link.imported),
+      )
+    }
+  }
+
+  const reached = new Set()
+  for (const [file, module] of program.modules) {
+    for (const name of module.parts.keys()) reached.add(nodeKey(file, name))
+  }
+  const isModel = (module, name) =>
+    module.typeNames.includes(name) && module.types.has(name)
+  const refReaches = (file, module, ref) => {
+    if (ref.kind === `local`) return reached.has(nodeKey(file, ref.name))
+    if (ref.kind === `import`) {
+      return (importNodes.get(nodeKey(file, ref.alias)) ?? []).some((node) =>
+        reached.has(node),
+      )
+    }
+    return isModel(module, ref.name)
+  }
+  for (let changed = true; changed;) {
+    changed = false
+    for (const [file, module] of program.modules) {
+      for (const [name, binding] of module.bindings) {
+        const id = nodeKey(file, name)
+        if (reached.has(id)) continue
+        if (binding.refs.some((ref) => refReaches(file, module, ref))) {
+          reached.add(id)
+          changed = true
+        }
+      }
+    }
+  }
+
+  const refOfOracle = (ref) => refReaches(program.oracle, oracle, ref)
+  const functionReaches = (name) => reached.has(nodeKey(program.oracle, name))
+  const reachesPart = (test) => {
+    const { helper, property, driver } = test
+    if (helper !== undefined) {
+      // A generated property: a non-constant arbitrary, and a body that reads its value.
+      if (helper.prop && !helper.constant && helper.readsInput) return true
+      const wrapperReaches =
+        helper.wrap === `wrap-part` &&
+        reached.has(nodeKey(program.helperFile, `hpart-wrapper`))
+      return wrapperReaches || test.body.refs.some(refOfOracle)
+    }
+    if (property !== undefined) return !property.constant && property.readsInput
+    if (driver?.kind === `let`) return driver.refs.some(refOfOracle)
+    if (driver?.kind === `for-of`) return driver.elements.every(functionReaches)
+    const { body } = test
+    const bodyReaches =
+      body.kind === `arrow`
+        ? body.refs.some(refOfOracle)
+        : body.kind === `ident`
+          ? reached.has(nodeKey(program.oracle, body.name))
+          : body.kind === `call`
+            ? refOfOracle(body.callee) || body.refs.some(refOfOracle)
+            : reached.has(nodeKey(program.oracle, body.object))
+    const tableReaches =
+      test.table !== undefined &&
+      test.table.rows.some(
+        (row) => row.fn !== undefined && row.fn.some(refOfOracle),
+      )
+    return bodyReaches || tableReaches
+  }
+  const judged = program.tests.filter(
+    (test) => test.helper === undefined || !lintedOnItsOwn(program.helperFile),
+  )
+  const unreached = judged
+    .filter((test) => !reachesPart(test))
+    .map((test) => test.title)
+  const anyReached = unreached.length < judged.length
+  const declaresParts = oracle.parts.size > 0 || oracle.typeNames.length > 0
+
+  const keys = []
+  if (!declaresParts && !anyReached) {
+    if (unreached.length > 0) keys.push(`undeclared:${unreached[0]}`)
+  } else {
+    for (const title of unreached) keys.push(`unit:${title}`)
+  }
+  for (const name of oracle.typeNames) {
+    if (!oracle.types.has(name)) keys.push(`typeModel:${name}`)
+  }
+  for (const call of program.calls) {
+    if (!lintedOnItsOwn(call.file)) keys.push(`imported:${call.alias}`)
+  }
+  return keys.sort()
+}
+
+// -- 3. Drivers ---------------------------------------------------------------
+//
+// A driver renders a program to files, lints the oracle file, and turns each
+// report into a key. A key names its subject (the test title, the type-model
+// name, or the helper), so the comparison does not depend on line numbers.
+// The renderer records the line of each subject, and a report's line finds it.
+
+const REGISTRAR_TEXT = `import { it } from 'vitest'\nexport function regAll() { it('reg inner', () => { void 0 }) }\nexport default regAll\n`
+const BROKEN_TEXT = `export function brokenFn() {\n`
+const PRED_TEXT = `export function predReads(value) {\n  void value\n}\nexport function predIgnores(value) {\n  void 0\n}\n`
+
+/**
+ * Helpers that register the body their caller passes: directly, before a
+ * timeout, wrapped in a function, awaited in an async wrapper, beside a use of
+ * a companion's function, and as a curried fast-check property, as
+ * serializerProp does. Their order is HELPER_EXPORTS.
+ */
+function helperText(module) {
+  const lines = [
+    `import { it } from 'vitest'`,
+    `import { test as fcTest } from '@fast-check/vitest'`,
+  ]
+  for (const [alias, link] of module.imports) {
+    lines.push(
+      `import { ${link.imported} as ${alias} } from '${specOf(link.from)}'`,
+    )
+  }
+  lines.push(
+    `export function regPlain(name, body) { it(name, body) }`,
+    `export function regTimed(name, body, timeout) { it(name, body, timeout) }`,
+    `export function regWrap(name, body) { it(name, () => { body() }) }`,
+    `export function regWrapAsync(name, body) { it(name, async () => { await body() }) }`,
+    `export function regWrapPart(name, body) { it(name, () => { void hpart; body() }) }`,
+    `export function regProp(arbitraries) {`,
+    `  return (name, check) => { fcTest.prop(arbitraries)(name, check) }`,
+    `}`,
+  )
+  return `${lines.join(`\n`)}\n`
+}
+
+/** The text that uses an imported alias: a namespace import reads a member. */
+function useText(module, alias) {
+  const link = module.imports.get(alias)
+  return link?.form === `namespace` ? `${alias}.${link.imported}` : alias
+}
+
+function importText(alias, link) {
+  const from = specOf(link.from)
+  if (link.form === `namespace`) return `import * as ${alias} from '${from}'`
+  if (link.form === `default`) return `import ${alias} from '${from}'`
+  return `import { ${link.imported} as ${alias} } from '${from}'`
+}
+
+/** The files for a program, and the subject that each line of the oracle names. */
+function renderProgram(program) {
+  const files = new Map()
+  let subjects = new Map()
+  for (const [file, module] of program.modules) {
+    if (module.role === `broken`) {
+      files.set(file, BROKEN_TEXT)
+    } else if (module.role === `registrar`) {
+      files.set(file, REGISTRAR_TEXT)
+    } else if (module.role === `helper`) {
+      files.set(file, helperText(module))
+    } else if (module.role === `pred`) {
+      files.set(file, PRED_TEXT)
+    } else {
+      const rendered = renderModule(module, program)
+      files.set(file, rendered.text)
+      if (file === program.oracle) subjects = rendered.subjects
+    }
+  }
+  return { files, subjects }
+}
+
+function renderModule(module, program) {
+  const lines = []
+  const subjects = new Map()
+  // A text may span several lines, so a subject names the line where its text starts.
+  const push = (text, subject) => {
+    const start = lines.length + 1
+    lines.push(...text.split(`\n`))
+    if (subject !== undefined) subjects.set(start, subject)
+  }
+  const use = (alias) => useText(module, alias)
+  if (module.declares) {
+    push(`import { declareOracle } from './oracle-declaration.js'`)
+  }
+  if (module.role === `oracle`) {
+    if (
+      program.tests.some(
+        (test) => test.property !== undefined || test.helper?.prop,
+      )
+    ) {
+      push(`import fc from 'fast-check'`)
+    }
+    if (program.tests.some((test) => test.form === `prop-named`)) {
+      push(`import { test as fcTest } from '@fast-check/vitest'`)
+    }
+  }
+  for (const [alias, link] of module.imports) push(importText(alias, link))
+  for (const name of module.types) push(`type ${name}<X> = X`)
+  for (const [name, binding] of module.bindings) {
+    if (binding.kind === `obj`) {
+      push(`const ${name} = {`)
+      push(`  m: () => {`)
+      for (const statement of statementsOf(binding.refs, use))
+        push(`    ${statement}`)
+      push(`  },`)
+      push(`}`)
+    } else if (binding.kind === `opt`) {
+      push(`const ${name} = { timeout: 1000 }`)
+    } else {
+      const exported = module.exportEntries.some(
+        (entry) => entry.local === name && entry.name !== `default`,
+      )
+      push(`${exported ? `export ` : ``}function ${name}() {`)
+      for (const statement of statementsOf(binding.refs, use))
+        push(`  ${statement}`)
+      push(`}`)
+    }
+  }
+  for (const entry of module.exportEntries) {
+    if (entry.from !== undefined) {
+      push(
+        `export { ${entry.imported} as ${entry.name} } from '${specOf(entry.from)}'`,
+      )
+    } else if (entry.name === `default`) {
+      push(`export default ${entry.local}`)
+    }
+  }
+  for (const star of module.stars) push(`export * from '${specOf(star)}'`)
+  if (module.role === `oracle`) {
+    if (module.declares) renderDeclaration(module, push)
+    // A call inside a registration is rendered with that registration.
+    for (const call of program.calls.filter(
+      (entry) => entry.test === undefined,
+    )) {
+      push(`${use(call.alias)}()`, { id: call.alias })
+    }
+    for (const test of program.tests) {
+      renderTest(test, push, use)
+    }
+  } else if (module.declares) {
+    renderDeclaration(module, push)
+  }
+  return { text: `${lines.join(`\n`)}\n`, subjects }
+}
+
+/**
+ * Each declared part is a list; each type-model name gets its own line. A
+ * module with `spread` writes its first part list in a const object that the
+ * declaration spreads.
+ */
+function renderDeclaration(module, push) {
+  const partKey = (part) => (module.stringKeys ? `'${part}'` : part)
+  const lists = []
+  for (const part of [`check`, `model`, `grammar`]) {
+    const names = [...module.parts]
+      .filter(([, kind]) => kind === part)
+      .map(([name]) => name)
+    if (part === `check`) names.push(...module.missing)
+    if (names.length > 0) lists.push(`${partKey(part)}: [${names.join(`, `)}]`)
+  }
+  const spread = module.spread && lists.length > 0 ? lists.shift() : undefined
+  if (spread !== undefined) push(`const sharedParts = { ${spread} }`)
+  push(`declareOracle({`)
+  if (spread !== undefined) push(`  ...sharedParts,`)
+  for (const list of lists) push(`  ${list},`)
+  if (module.typeNames.length > 0) {
+    push(`  ${partKey(`typeModel`)}: [`)
+    for (const name of module.typeNames) {
+      push(`    '${name}',`, { id: name })
+    }
+    push(`  ],`)
+  }
+  push(`})`)
+}
+
+function statementsOf(refs, use = (alias) => alias) {
+  return refs.map((ref, index) => {
+    if (ref.kind === `type`) return `type _t${index} = ${ref.name}<number>`
+    return `void ${ref.kind === `local` ? ref.name : use(ref.alias)}`
+  })
+}
+
+function arrowText(refs, use) {
+  return `() => {\n    expect(1).toBe(1)\n    ${statementsOf(refs, use).join(`\n    `)}\n  }`
+}
+
+/** Renders one registration. The first line carries its subject. */
+// The helper that a registration calls, which names an importedRegistration report.
+function callHelper(test) {
+  return test.body.kind === `call` && test.body.callee.kind === `import`
+    ? test.body.callee.alias
+    : undefined
+}
+
+function renderTest(test, push, use) {
+  // The bindings that one registration uses are written just before it.
+  const arbitrary = (constant) => (constant ? `fc.constant(1)` : `fc.integer()`)
+  const named = test.property ?? (test.helper?.prop ? test.helper : undefined)
+  if (named?.arbNamed) {
+    push(`const arb${test.title} = ${arbitrary(named.constant)}`)
+  }
+  if (test.property?.predicate === `local`) {
+    push(`function pred${test.title}(value) {`)
+    push(`  expect(1).toBe(1)`)
+    push(test.property.readsInput ? `  void value` : `  void 0`)
+    push(`}`)
+  }
+  if (test.driver?.kind === `let`) {
+    push(`let drv${test.title}`)
+    push(`beforeAll(() => {`)
+    push(`  drv${test.title} = {`)
+    push(`    run: () => {`)
+    for (const statement of statementsOf(test.driver.refs, use))
+      push(`      ${statement}`)
+    push(`    },`)
+    push(`  }`)
+    push(`})`)
+  }
+  if (test.wrapped) push(`describe('d${test.title}', () => {`)
+  const text = registrationText(test, use)
+  text.forEach((line, offset) => {
+    push(
+      line,
+      offset === 0 ? { id: test.title, helper: callHelper(test) } : undefined,
+    )
+  })
+  if (test.wrapped) push(`})`)
+}
+
+function registrationText(test, use) {
+  const { body, title } = test
+  if (test.helper !== undefined) {
+    const { helper } = test
+    const arbitrary = helper.arbNamed
+      ? `arb${title}`
+      : helper.constant
+        ? `fc.constant(1)`
+        : `fc.integer()`
+    const head = helper.prop
+      ? `${use(`regProp`)}([${arbitrary}])`
+      : use(HELPER_OF_WRAP[helper.wrap])
+    const trailing =
+      helper.wrap !== `timed`
+        ? ``
+        : helper.trailing.kind === `name`
+          ? `, ${helper.trailing.name}`
+          : `, 1000`
+    return [
+      `${head}('${title}', (value) => {`,
+      `    expect(1).toBe(1)`,
+      helper.readsInput ? `    void value` : `    void 0`,
+      `    ${statementsOf(body.refs, use).join(`\n    `)}`,
+      `  }${trailing})`,
+    ]
+  }
+  if (test.property !== undefined) {
+    const { property } = test
+    const arbitrary = property.arbNamed
+      ? `arb${title}`
+      : property.constant
+        ? `fc.constant(1)`
+        : `fc.integer()`
+    const predicate =
+      property.predicate === `local`
+        ? `pred${title}`
+        : property.predicate === `imported`
+          ? property.readsInput
+            ? `predReads`
+            : `predIgnores`
+          : `(value) => {\n    expect(1).toBe(1)\n    ${property.readsInput ? `void value` : `void 0`}\n  }`
+    if (test.form === `prop-named`) {
+      return [`fcTest.prop([${arbitrary}])('${title}', ${predicate})`]
+    }
+    return [
+      `it('${title}', () => {`,
+      `    fc.assert(fc.property(${arbitrary}, ${predicate}))`,
+      `  })`,
+    ]
+  }
+  if (test.driver?.kind === `let`) {
+    return [`it('${title}', () => {`, `    drv${title}.run()`, `  })`]
+  }
+  if (test.driver?.kind === `for-of`) {
+    // The loop and its registration share a line, so the report's line
+    // names this test.
+    return [
+      `for (const drive${title} of [${test.driver.elements.join(`, `)}]) it('${title}', () => {`,
+      `    drive${title}()`,
+      `  })`,
+    ]
+  }
+  if (test.table !== undefined) {
+    const rows = test.table.rows.map((row) =>
+      row.fn === undefined
+        ? `[1]`
+        : `[() => {\n    ${statementsOf(row.fn, use).join(`\n    `)}\n  }]`,
+    )
+    const runner = test.table.kind === `each` ? `it.each` : `it.for`
+    return [
+      `${runner}([${rows.join(`, `)}])('${title} %s', () => {`,
+      `    expect(1).toBe(1)`,
+      `  })`,
+    ]
+  }
+  if (body.kind === `ident`) return [`it('${title}', ${body.name})`]
+  if (body.kind === `member`) return [`it('${title}', ${body.object}.m)`]
+  if (body.kind === `call`) {
+    const callee =
+      body.callee.kind === `local` ? body.callee.name : use(body.callee.alias)
+    return [`it('${title}', ${callee}(${arrowText(body.refs, use)}))`]
+  }
+  if (test.options !== undefined) {
+    const options = test.options.literal ? `{ timeout: 5000 }` : `oopt`
+    return test.options.at === `first`
+      ? [`it('${title}', ${options}, ${arrowText(body.refs, use)})`]
+      : [`it('${title}', ${arrowText(body.refs, use)}, ${options})`]
+  }
+  return [`it('${title}', ${arrowText(body.refs, use)})`]
+}
+
+/**
+ * The keys of a message list. Every message that is not a report of this rule
+ * is a key too, so a configuration or parse failure cannot pass as no reports.
+ */
+function keysOf(messages, subjects) {
+  return messages.map((message) => keyOf(message, subjects)).sort()
+}
+
+function keyOf(message, subjects) {
+  if (message.ruleId !== RULE) {
+    return `other:${message.ruleId ?? `fatal`}@${message.line}:${message.message}`
+  }
+  const subject = subjects.get(message.line)
+  const id = message.messageId
+  if (subject === undefined) return `unmatched:${id}@${message.line}`
+  if (id === `unitTest`) return `unit:${subject.id}`
+  if (id === `undeclared`) return `undeclared:${subject.id}`
+  if (id === `unknownTypeModel`) return `typeModel:${subject.id}`
+  if (id === `importedRegistration`)
+    return `imported:${subject.helper ?? subject.id}`
+  return `other:${id}@${message.line}`
+}
+
+// The CLI prints messages, not ids, so its driver maps the message text.
+const CLI_IDS = [
+  [`This test reaches no part`, `unitTest`],
+  [
+    `This oracle file registers tests and declares no oracle part`,
+    `undeclared`,
+  ],
+  [`This typeModel name is not a type alias`, `unknownTypeModel`],
+  [`This oracle file calls a helper`, `importedRegistration`],
+]
+
+/**
+ * The keys of the CLI's report lines for the oracle file. The CLI exits 0 with
+ * no reports, 1 for text reports, and 2 for hook reports; any other status is
+ * a failure of the CLI itself, not a report.
+ */
+function cliKeys(result, subjects) {
+  // A rule that throws makes the CLI print the error, not a report line.
+  if (
+    ![0, 1, 2].includes(result.status) ||
+    result.stderr.includes(`Occurred while linting`)
+  ) {
+    throw new Error(
+      `lint CLI failed with status ${result.status}: ${result.stderr}`,
+    )
+  }
+  const messages = []
+  for (const line of result.stderr.split(`\n`)) {
+    const match = /^(.+?):(\d+):\d+ (.*) \((\S+)\)$/.exec(line)
+    if (match === null || !match[1].endsWith(ORACLE)) continue
+    const [, , lineText, text, ruleId] = match
+    const id = CLI_IDS.find(([prefix]) => text.startsWith(prefix))?.[1]
+    messages.push({
+      ruleId,
+      messageId: id ?? `unknown-message`,
+      message: text,
+      line: Number(lineText),
+    })
+  }
+  return keysOf(messages, subjects)
+}
+
+// Without `files`, flat config applies only to the default .js patterns.
+const linterConfig = [
+  {
+    files: [`**/*.ts`],
+    languageOptions: { parser: tsParser, sourceType: `module` },
+    plugins: { oracle: oraclePlugin },
+    rules: { [RULE]: `error` },
+  },
+]
+
+// -- Receiving paths ------------------------------------------------------------
+
+let root
+let eslint
+let linter
+let scratch
+let historySeq = 0
+
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), `part-reach-oracle-`))
+  writeFileSync(join(root, `package.json`), JSON.stringify({ name: `scratch` }))
+  // The long-lived path: one ESLint instance, configured as the CLI configures it.
+  eslint = new ESLint({
+    cwd: root,
+    overrideConfigFile: true,
+    overrideConfig: [
+      { ignores: [`**/dist/**`] },
+      { files: [`**/*.ts`, `**/*.tsx`], languageOptions: { parser: tsParser } },
+      { linterOptions: { noInlineConfig: true } },
+      oraclePlugin.configs.recommended,
+    ],
+  })
+  linter = new Linter({ configType: `flat` })
+  // The CLI reads only files inside its repository.
+  scratch = mkdtempSync(join(repoRoot, `part-reach-scratch-`))
+})
+
+// Every history writes its own directory, so removing them can take a while.
+afterAll(() => {
+  rmSync(root, { recursive: true, force: true })
+  rmSync(scratch, { recursive: true, force: true })
+}, 300_000)
+
+/** Writes a program's files into `directory`; returns the oracle's path, text, and subjects. */
+function writeProgram(directory, program) {
+  mkdirSync(directory, { recursive: true })
+  const { files, subjects } = renderProgram(program)
+  for (const [file, text] of files) writeFileSync(join(directory, file), text)
+  return {
+    oracle: join(directory, program.oracle),
+    text: files.get(program.oracle),
+    subjects,
+  }
+}
+
+/** Path 1: a long-lived ESLint instance, linting a new directory each time. */
+async function lintWithEslint(program) {
+  const { oracle, subjects } = writeProgram(
+    join(root, `h${historySeq++}`),
+    program,
+  )
+  if (process.env.REACH_ORACLE_DEBUG) {
+    console.log(
+      `DEBUG ${oracle}\n${[...renderProgram(program).files].map(([f, t]) => `--- ${f}\n${t}`).join(`\n`)}`,
+    )
+  }
+  const results = await eslint.lintFiles([oracle])
+  return keysOf(
+    results.flatMap((result) => result.messages),
+    subjects,
+  )
+}
+
+/**
+ * Path 2: one single-file Linter call, as a RuleTester caller makes it. Flat
+ * config matches a file only inside the working directory, so the program is
+ * written inside the worktree.
+ */
+function lintWithLinter(program) {
+  const { oracle, text, subjects } = writeProgram(
+    join(scratch, `l${historySeq++}`),
+    program,
+  )
+  return keysOf(
+    linter.verify(text, linterConfig, { filename: oracle }),
+    subjects,
+  )
+}
+
+/** Path 3: the lint CLI, a fresh process, on files inside the worktree. */
+function lintWithCli(program) {
+  const directory = join(scratch, `c${historySeq++}`)
+  const { oracle, subjects } = writeProgram(directory, program)
+  const result = spawnSync(
+    process.execPath,
+    [
+      join(repoRoot, `scripts/agent-lint-feedback.mjs`),
+      `--format=text`,
+      oracle,
+    ],
+    { cwd: repoRoot, encoding: `utf8` },
+  )
+  return cliKeys(result, subjects)
+}
+
+/** Path 4: the CLI's edit-hook form, given the changed file as its hook input. */
+function lintWithEditHook(program) {
+  const directory = join(scratch, `e${historySeq++}`)
+  const { oracle, subjects } = writeProgram(directory, program)
+  const result = spawnSync(
+    process.execPath,
+    [
+      join(repoRoot, `scripts/agent-lint-feedback.mjs`),
+      `--format=claude`,
+      `--event=edit`,
+    ],
+    {
+      cwd: repoRoot,
+      encoding: `utf8`,
+      input: JSON.stringify({ tool_input: { file_path: oracle } }),
+    },
+  )
+  return cliKeys(result, subjects)
+}
+
+// -- 4. Comparison --------------------------------------------------------------
+
+/** The paths agree with the model. A mismatch names the path and the keys. */
+function compareReports(path, actual, expected) {
+  const observed = JSON.stringify(actual)
+  const predicted = JSON.stringify(expected)
+  if (observed !== predicted) {
+    throw new Error(`${path} reports ${observed}, predicted ${predicted}`)
+  }
+}
+
+// -- 5. Declared reach and campaigns -------------------------------------------
+//
+// A state is declared when a law depends on it, and the campaign fails when
+// generated programs enter it fewer times than `minimum`. Each state is read
+// from the program's structure: the grammar's own witness, not the model.
+
+const STATES = [
+  `export-star-cycle`,
+  `named-reexport-cycle`,
+  `mutual-recursion-reaches-part`,
+  `mutual-recursion-reaches-no-part`,
+  `form-each`,
+  `form-for`,
+  `form-call-body`,
+  `form-member-body`,
+  `form-options`,
+  `string-keyed-declaration`,
+  `type-model-declaration`,
+  `unparseable-companion`,
+  `imported-registration`,
+  `caller-passed-body-helper`,
+  `companion-edited-between-lints`,
+  // Import forms: a namespace member, a default, and a default import of a
+  // module whose only exports of that name come through `export *`.
+  `namespace-import`,
+  `default-import`,
+  `default-import-through-star`,
+  // ...whose star target does have a default, and that default is a part: the
+  // history that tells "`export *` carries no default" from its rival.
+  `default-import-star-target-has-part`,
+  // Registration helpers by import form and module name.
+  `member-callee-registration`,
+  `default-import-registration`,
+  `prefixed-oracle-registrar`,
+  `prefixed-oracle-helper`,
+  `oracle-named-helper`,
+  // Caller-passed-body layouts.
+  `caller-body-trailing-name`,
+  `caller-body-wrapper`,
+  `caller-body-wrapper-reaches-part`,
+  // Drivers and declarations.
+  `let-assigned-driver`,
+  `for-of-driver`,
+  `for-of-mixed-elements`,
+  `declaration-spread`,
+  // A test imports a declared part from a JavaScript companion.
+  `javascript-companion-import-reaches-part`,
+  // Generated properties.
+  `named-constant-arbitrary`,
+  `imported-predicate`,
+  `predicate-ignores-input`,
+]
+const reach = createOracleReach(PROPERTY, STATES, { minimum: 1 })
+
+/** Marks every declared state that the program enters. */
+function recordStates(program) {
+  reach.beginHistory()
+  const states = new Set()
+  const starCycle = (file, edges) => {
+    const stack = [...edges(file)]
+    const seen = new Set()
+    while (stack.length > 0) {
+      const next = stack.pop()
+      if (next === file) return true
+      if (seen.has(next)) continue
+      seen.add(next)
+      stack.push(...edges(next))
+    }
+    return false
+  }
+  const starEdges = (file) => program.modules.get(file)?.stars ?? []
+  const namedEdges = (file) =>
+    (program.modules.get(file)?.exportEntries ?? [])
+      .filter((entry) => entry.from !== undefined)
+      .map((entry) => entry.from)
+  for (const [file, module] of program.modules) {
+    if (module.role === `companion` || module.role === `oracle`) {
+      if (starCycle(file, starEdges)) states.add(`export-star-cycle`)
+      if (starCycle(file, namedEdges)) states.add(`named-reexport-cycle`)
+    }
+    if (module.role === `broken`) states.add(`unparseable-companion`)
+    if (module.declares && module.stringKeys)
+      states.add(`string-keyed-declaration`)
+    if (module.typeNames.some((name) => module.types.has(name))) {
+      states.add(`type-model-declaration`)
+    }
+    for (const [name, binding] of module.bindings) {
+      if (binding.kind !== `fn`) continue
+      const cyclic = localCycle(module, name)
+      if (cyclic) {
+        states.add(
+          localReachesPart(module, name)
+            ? `mutual-recursion-reaches-part`
+            : `mutual-recursion-reaches-no-part`,
+        )
+      }
+    }
+  }
+  for (const test of program.tests) {
+    if (test.table?.kind === `each`) states.add(`form-each`)
+    if (test.table?.kind === `for`) states.add(`form-for`)
+    if (test.body.kind === `call`) states.add(`form-call-body`)
+    if (test.body.kind === `member`) states.add(`form-member-body`)
+    if (test.options !== undefined) states.add(`form-options`)
+  }
+  if (program.calls.some((call) => !lintedOnItsOwn(call.file))) {
+    states.add(`imported-registration`)
+  }
+  if (program.tests.some((test) => test.helper !== undefined)) {
+    states.add(`caller-passed-body-helper`)
+  }
+  const oracle = program.modules.get(program.oracle)
+  for (const [, module] of program.modules) {
+    for (const [, link] of module.imports) {
+      if (link.form === `namespace`) states.add(`namespace-import`)
+      if (link.form !== `default`) continue
+      states.add(`default-import`)
+      const target = program.modules.get(link.from)
+      if (
+        target !== undefined &&
+        target.stars.length > 0 &&
+        !target.exportEntries.some((entry) => entry.name === `default`)
+      ) {
+        states.add(`default-import-through-star`)
+        const starDefaultIsPart = target.stars.some((star) => {
+          const starModule = program.modules.get(star)
+          const entry = starModule?.exportEntries.find(
+            (candidate) => candidate.name === `default`,
+          )
+          return entry !== undefined && starModule.parts.has(entry.local)
+        })
+        if (starDefaultIsPart) states.add(`default-import-star-target-has-part`)
+      }
+    }
+    if (module.spread && module.declares) states.add(`declaration-spread`)
+    if (module.role === `oracle`) {
+      for (const test of program.tests) {
+        for (const ref of test.refs) {
+          const link = ref.kind === `import` && module.imports.get(ref.alias)
+          if (
+            link &&
+            link.from.endsWith(`.js`) &&
+            program.modules.get(link.from)?.parts.has(link.imported)
+          ) {
+            states.add(`javascript-companion-import-reaches-part`)
+          }
+        }
+      }
+    }
+  }
+  for (const call of program.calls) {
+    const link = oracle.imports.get(call.alias)
+    if (link?.form === `namespace`) states.add(`member-callee-registration`)
+    if (link?.form === `default`) states.add(`default-import-registration`)
+    if (call.file.startsWith(`oracle-`)) states.add(`prefixed-oracle-registrar`)
+  }
+  const companion = program.modules.get(`c0.ts`)
+  for (const test of program.tests) {
+    const { helper, property, driver } = test
+    if (helper !== undefined) {
+      if (program.helperFile.startsWith(`oracle-`))
+        states.add(`prefixed-oracle-helper`)
+      else if (lintedOnItsOwn(program.helperFile))
+        states.add(`oracle-named-helper`)
+      if (helper.wrap === `timed` && helper.trailing.kind === `name`)
+        states.add(`caller-body-trailing-name`)
+      if ([`wrap`, `wrap-async`, `wrap-part`].includes(helper.wrap))
+        states.add(`caller-body-wrapper`)
+      if (helper.wrap === `wrap-part` && companion?.parts.has(`c0f0`))
+        states.add(`caller-body-wrapper-reaches-part`)
+    }
+    const arbitrary = property ?? (helper?.prop ? helper : undefined)
+    if (arbitrary?.arbNamed && arbitrary.constant)
+      states.add(`named-constant-arbitrary`)
+    if (property?.predicate === `imported`) states.add(`imported-predicate`)
+    if (arbitrary !== undefined && !arbitrary.constant && !arbitrary.readsInput)
+      states.add(`predicate-ignores-input`)
+    if (driver?.kind === `let`) states.add(`let-assigned-driver`)
+    if (driver?.kind === `for-of`) {
+      states.add(`for-of-driver`)
+      const reaching = driver.elements.map((name) =>
+        localReachesPart(oracle, name),
+      )
+      if (reaching.includes(true) && reaching.includes(false))
+        states.add(`for-of-mixed-elements`)
+    }
+  }
+  for (const state of states) reach.reach(state)
+}
+
+/** Whether a binding reaches itself through at least one other binding. */
+function localCycle(module, name) {
+  const stack = module.bindings
+    .get(name)
+    .refs.filter((ref) => ref.kind === `local`)
+    .map((ref) => ref.name)
+  const seen = new Set()
+  while (stack.length > 0) {
+    const next = stack.pop()
+    if (next === name) return true
+    if (seen.has(next)) continue
+    seen.add(next)
+    const binding = module.bindings.get(next)
+    if (binding === undefined) continue
+    for (const ref of binding.refs)
+      if (ref.kind === `local`) stack.push(ref.name)
+  }
+  return false
+}
+
+/** Whether a binding's local references lead to a declared part. */
+function localReachesPart(module, name) {
+  const stack = [name]
+  const seen = new Set()
+  while (stack.length > 0) {
+    const next = stack.pop()
+    if (module.parts.has(next)) return true
+    if (seen.has(next)) continue
+    seen.add(next)
+    const binding = module.bindings.get(next)
+    if (binding === undefined) continue
+    for (const ref of binding.refs)
+      if (ref.kind === `local`) stack.push(ref.name)
+  }
+  return false
+}
+
+/** The comparison for one program, on every receiving path that it runs. */
+async function checkProgram(program, paths) {
+  recordStates(program)
+  const expected = predictReports(program)
+  for (const path of paths) {
+    const actual = await path.run(program)
+    compareReports(path.name, actual, expected)
+  }
+}
+
+const IN_PROCESS = [
+  { name: `eslint`, run: lintWithEslint },
+  { name: `linter`, run: (program) => lintWithLinter(program) },
+]
+
+/** One feature family: a fixed-seed campaign and a random-seed campaign. */
+function campaign(name, features, paths = IN_PROCESS, runs = BASE_RUNS) {
+  const arbitrary = programArbitrary(features)
+  const predicate = (program) => checkProgram(program, paths)
+  it(`${name}: fixed-seed campaign`, async () => {
+    await fc.assert(fc.asyncProperty(arbitrary, predicate), {
+      numRuns: oracleRuns(runs),
+      seed: FIXED_SEED,
+    })
+  }, 900_000)
+  it(`${name}: random-seed campaign`, async () => {
+    await fc.assert(
+      fc.asyncProperty(arbitrary, predicate),
+      oraclePropertyOptions(runs, PROPERTY),
+    )
+  }, 900_000)
+}
+
+describe(`declared reach in oracle files`, () => {
+  campaign(`base grammar`, BASE)
+  // Cycles are rare in random programs, so these campaigns run more histories.
+  campaign(`export-star cycles`, { ...BASE, stars: true }, IN_PROCESS, 400)
+  campaign(`named re-export cycles`, BASE, IN_PROCESS, 400)
+  campaign(`call-expression bodies`, {
+    ...BASE,
+    forms: [...BASE.forms, `call`],
+  })
+  campaign(`member-expression bodies`, {
+    ...BASE,
+    forms: [...BASE.forms, `member`],
+  })
+  campaign(`.for tables`, { ...BASE, forms: [...BASE.forms, `for`] })
+  campaign(`options before or after the body`, {
+    ...BASE,
+    forms: [...BASE.forms, `options-first`, `options-last`],
+  })
+  campaign(`string-keyed declarations`, {
+    ...BASE,
+    stringKeys: true,
+    typeModels: true,
+  })
+  campaign(`type models`, { ...BASE, typeModels: true })
+  campaign(`unparseable companion`, { ...BASE, broken: true })
+  campaign(`imported registration helper`, { ...BASE, registrar: true })
+  campaign(`caller-passed body helpers`, {
+    ...BASE,
+    forms: [...BASE.forms, `helper-plain`, `helper-prop`],
+  })
+  // A wrapper that uses a part needs a companion whose first function is one.
+  campaign(
+    `caller-passed body layouts: trailing arguments and wrappers`,
+    {
+      ...BASE,
+      forms: [...BASE.forms, `helper-plain`, `helper-prop`],
+      helperLayouts: true,
+    },
+    IN_PROCESS,
+    200,
+  )
+  campaign(`registration helpers by module name and import form`, {
+    ...BASE,
+    forms: [...BASE.forms, `call`, `helper-plain`, `helper-prop`],
+    registrar: true,
+    helperNames: true,
+    importForms: true,
+  })
+  // A default import through a star needs a star and a default link together.
+  campaign(
+    `namespace and default imports`,
+    { ...BASE, importForms: true, stars: true },
+    IN_PROCESS,
+    200,
+  )
+  // A loop over a reaching and an unreached function is what tells "every
+  // element" from "some element", and it needs two elements of each kind.
+  campaign(
+    `let and for...of drivers`,
+    { ...BASE, forms: [...BASE.forms, `let-driver`, `for-of`] },
+    IN_PROCESS,
+    300,
+  )
+  campaign(`declaration spreads`, { ...BASE, spreads: true })
+  // A test must import a part from a JavaScript companion, which is rare.
+  campaign(
+    `JavaScript companion modules`,
+    { ...BASE, jsCompanions: true },
+    IN_PROCESS,
+    300,
+  )
+  campaign(`generated properties: named arbitraries and predicates`, {
+    ...BASE,
+    forms: [...BASE.forms, `property`, `prop-named`, `helper-prop`],
+  })
+  campaign(`all families`, ALL)
+})
+
+describe(`receiving paths`, () => {
+  it(`the CLI, the edit hook, and a single-file Linter agree with the model`, async () => {
+    for (const seed of [FIXED_SEED, FIXED_SEED + 1]) {
+      await fc.assert(
+        fc.property(programArbitrary(ALL), (program) => {
+          recordStates(program)
+          const expected = predictReports(program)
+          compareReports(`linter`, lintWithLinter(program), expected)
+          compareReports(`cli`, lintWithCli(program), expected)
+          compareReports(`edit-hook`, lintWithEditHook(program), expected)
+        }),
+        { numRuns: oracleRuns(4), seed },
+      )
+    }
+  }, 900_000)
+})
+
+describe(`metamorphic laws`, () => {
+  // Identifier registrations of the oracle's functions, in a single file: the
+  // shape whose evaluation order the reach rule must not depend on. A program
+  // and a permutation of its registrations are drawn together.
+  const orderArbitrary = programArbitrary({
+    ...BASE,
+    companions: false,
+    forms: [`identifier`],
+  }).chain((program) =>
+    fc
+      .shuffledSubarray(
+        program.tests.map((_, index) => index),
+        { minLength: program.tests.length, maxLength: program.tests.length },
+      )
+      .map((order) => ({
+        program,
+        permuted: {
+          ...program,
+          tests: order.map((index) => program.tests[index]),
+        },
+      })),
+  )
+  const orderLaw = async ({ program, permuted }) => {
+    recordStates(program)
+    const original = await lintWithEslint(program)
+    const reordered = await lintWithEslint(permuted)
+    compareReports(`eslint, permuted`, reordered, predictReports(permuted))
+    // The same subjects, except for `undeclared`, which names the first
+    // unreached test in source order and so moves with the order.
+    const bySubject = (keys) =>
+      keys
+        .map((key) => (key.startsWith(`undeclared`) ? `undeclared` : key))
+        .sort()
+    expect(bySubject(reordered)).toEqual(bySubject(original))
+  }
+  it(`registration order does not change the reports: fixed-seed campaign`, async () => {
+    await fc.assert(fc.asyncProperty(orderArbitrary, orderLaw), {
+      numRuns: oracleRuns(3000),
+      seed: FIXED_SEED,
+    })
+  }, 900_000)
+  it(`registration order does not change the reports: random-seed campaign`, async () => {
+    await fc.assert(
+      fc.asyncProperty(orderArbitrary, orderLaw),
+      oraclePropertyOptions(3000, PROPERTY),
+    )
+  }, 900_000)
+
+  it(`linting the same program twice in one process gives the same reports`, async () => {
+    await fc.assert(
+      fc.asyncProperty(programArbitrary(ALL), async (program) => {
+        recordStates(program)
+        const first = await lintWithEslint(program)
+        const second = await lintWithEslint(program)
+        // Rerun equality only: the model is checked by the campaigns above.
+        expect(second).toEqual(first)
+      }),
+      { numRuns: oracleRuns(BASE_RUNS), seed: FIXED_SEED },
+    )
+  }, 900_000)
+
+  it(`a companion edit between lints gives the reports of a fresh process`, async () => {
+    await fc.assert(
+      // Only programs with such a dependency are drawn, so every run edits one.
+      fc.asyncProperty(
+        programArbitrary({ ...BASE, stars: true, acyclic: true }).filter(
+          (program) => dependencyOfReached(program) !== undefined,
+        ),
+        async (program) => {
+          const companion = dependencyOfReached(program)
+          recordStates(program)
+          const before = writeProgram(
+            join(root, `edit${historySeq++}`),
+            program,
+          )
+          await eslint.lintFiles([before.oracle])
+          // The companion gains or loses its declared part, with a new mtime.
+          // The same ESLint instance then lints the unchanged oracle file.
+          const edited = toggleDeclaration(program, companion.file)
+          reach.reach(`companion-edited-between-lints`)
+          rewriteCompanion(
+            join(root, `edit${historySeq - 1}`),
+            edited,
+            companion.file,
+          )
+          const relinted = keysOf(
+            (await eslint.lintFiles([before.oracle])).flatMap(
+              (result) => result.messages,
+            ),
+            before.subjects,
+          )
+          expect(relinted, `same instance after an edit`).toEqual(
+            predictReports(edited),
+          )
+          expect(lintWithCli(edited), `fresh CLI process`).toEqual(
+            predictReports(edited),
+          )
+        },
+      ),
+      { numRuns: oracleRuns(40), seed: FIXED_SEED },
+    )
+  }, 900_000)
+})
+
+/**
+ * A companion that a binding reached by the oracle depends on through an import
+ * in its body. The rule caches a binding's reach in the module that declares
+ * it, so editing the companion leaves that cache stale unless the rule
+ * recomputes it. Re-exports are not cached and so cannot show this.
+ */
+function dependencyOfReached(program) {
+  const oracle = program.modules.get(program.oracle)
+  for (const test of program.tests) {
+    for (const ref of test.refs ?? []) {
+      if (ref.kind !== `import`) continue
+      const link = oracle.imports.get(ref.alias)
+      const middle = program.modules.get(link?.from)
+      const binding = middle?.bindings.get(link.imported)
+      for (const inner of binding?.refs ?? []) {
+        if (inner.kind !== `import`) continue
+        const module = program.modules.get(
+          middle.imports.get(inner.alias)?.from,
+        )
+        if (module?.role === `companion` && module.bindings.size > 0)
+          return module
+      }
+    }
+  }
+  return undefined
+}
+
+/** Adds or removes a declared check in one companion, as an edit would. */
+function toggleDeclaration(program, file) {
+  const module = program.modules.get(file)
+  const parts = new Map(module.parts)
+  if (parts.size > 0) {
+    parts.clear()
+  } else {
+    parts.set([...module.bindings.keys()][0], `check`)
+  }
+  const edited = {
+    ...module,
+    parts,
+    declares:
+      parts.size > 0 ||
+      module.typeNames.length > 0 ||
+      module.missing.length > 0,
+  }
+  return { ...program, modules: new Map(program.modules).set(file, edited) }
+}
+
+/** Rewrites one companion in place, with an mtime after the last write. */
+function rewriteCompanion(directory, program, file) {
+  const { files } = renderProgram(program)
+  const path = join(directory, file)
+  writeFileSync(path, files.get(file))
+  const later = new Date(Date.now() + 5000)
+  utimesSync(path, later, later)
+}
+
+// -- Fixed inputs --------------------------------------------------------------
+//
+// These skeletons are fixed inputs for the reviewer's repros. They go through
+// the same builder, model, and paths as the generated programs, with the full
+// feature set, and carry no expected answers of their own.
+
+const slot = (
+  present,
+  refs = [],
+  { exported = false, part = `none` } = {},
+) => ({
+  present,
+  exported,
+  part,
+  refs,
+})
+const moduleOf = (fields = {}) => ({
+  slots: [slot(false), slot(false), slot(false)],
+  stars: [],
+  reexports: [],
+  imports: [],
+  typeAliases: [false, false, false],
+  typeNames: [],
+  missingPart: false,
+  stringKeys: false,
+  defaultSlot: undefined,
+  spread: false,
+  js: false,
+  ...fields,
+})
+const reg = (fields) => ({
+  form: `plain`,
+  refs: [],
+  callee: 0,
+  literalOptions: false,
+  wrapped: false,
+  rows: [{ value: 1 }],
+  wrap: 0,
+  trailing: `literal`,
+  constantArb: false,
+  arbNamed: false,
+  predicate: `inline`,
+  readsInput: true,
+  elements: [0],
+  ...fields,
+})
+const local = (index) => ({ kind: `local`, index })
+const imported = (index) => ({ kind: `import`, index })
+const typeRef = (index) => ({ kind: `type`, index })
+const fixed = (fields) => ({
+  companions: [],
+  broken: false,
+  registrarName: `reg.ts`,
+  registrarImport: `named`,
+  helperName: `reg-helper.ts`,
+  helperImport: `named`,
+  oracle: {
+    module: moduleOf({
+      slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [],
+  },
+  ...fields,
+})
+
+// Two companions that star-export each other, and that re-export the same
+// name from each other: a star cycle and a named re-export cycle. The oracle
+// imports a name that neither exports, so its registration reaches nothing.
+const exportCycle = fixed({
+  companions: [
+    moduleOf({
+      stars: [0],
+      reexports: [{ target: 0, slot: 0, exportIndex: 3 }],
+    }),
+    moduleOf({
+      stars: [0],
+      reexports: [{ target: 0, slot: 0, exportIndex: 3 }],
+    }),
+  ],
+  oracle: {
+    module: moduleOf({
+      slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+      imports: [{ target: 0, slot: 0 }],
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [reg({ refs: [imported(0)] })],
+  },
+})
+
+// Two companions that re-export each other's names, and no star export: a
+// named re-export cycle. c0 exports c0f0 from c1, and c1 exports c1f0 from c0.
+const namedCycle = fixed({
+  companions: [
+    moduleOf({ reexports: [{ target: 0, slot: 0, exportIndex: 0 }] }),
+    moduleOf({ reexports: [{ target: 0, slot: 0, exportIndex: 3 }] }),
+  ],
+  oracle: {
+    module: moduleOf({
+      slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+      imports: [{ target: 0, slot: 0 }],
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [reg({ refs: [imported(0)] })],
+  },
+})
+
+// Two functions that call each other, and reach the check through only one
+// of them. Each registration names one function. Both orders must agree.
+const mutualRecursion = fixed({
+  oracle: {
+    module: moduleOf({
+      slots: [
+        slot(true, [local(1), local(2)]),
+        slot(true, [local(0)]),
+        slot(true, [], { part: `check` }),
+      ],
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [
+      reg({ form: `identifier`, callee: 0 }),
+      reg({ form: `identifier`, callee: 1 }),
+    ],
+  },
+})
+
+// Each registration form, with one that reaches the check and one that does not.
+const forms = fixed({
+  oracle: {
+    module: moduleOf({
+      slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [
+      reg({ form: `call`, refs: [local(0)] }),
+      reg({ form: `member` }),
+      reg({ form: `for`, rows: [{ value: 1 }] }),
+      reg({ form: `options-first`, refs: [local(0)], literalOptions: true }),
+      reg({ form: `options-last`, literalOptions: false }),
+      reg({ form: `for`, rows: [{ fn: [local(0)] }] }),
+    ],
+  },
+})
+
+// An unparseable companion, a string-keyed type model, and a registration
+// helper from an ordinary module.
+const helpers = fixed({
+  broken: true,
+  companions: [moduleOf({})],
+  registrarName: `reg.ts`,
+  oracle: {
+    module: moduleOf({
+      slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+      imports: [{ target: 1, slot: 0 }],
+      typeAliases: [true, false, false],
+      typeNames: [0],
+      stringKeys: true,
+    }),
+    objectRefs: [],
+    registrarCall: true,
+    tests: [reg({ refs: [imported(0)] }), reg({ refs: [typeRef(0)] })],
+  },
+})
+
+// The second review's repros. The oracle's only function is the check `ofn2`.
+const checkOnly = moduleOf({
+  slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+})
+const WRAP = Object.fromEntries(WRAPS.map((wrap, index) => [wrap, index]))
+
+// A body before a trailing timeout: the body reaches through `ofn2`, and the
+// trailing argument is a literal. A unit body before a trailing `ofn2`.
+const trailingArguments = fixed({
+  oracle: {
+    module: checkOnly,
+    objectRefs: [],
+    registrarCall: false,
+    tests: [
+      reg({ form: `helper-plain`, wrap: WRAP.timed, refs: [local(0)] }),
+      reg({ form: `helper-plain`, wrap: WRAP.timed, trailing: `name` }),
+    ],
+  },
+})
+
+// A helper that awaits its caller's body inside its own async wrapper, a
+// wrapper around a unit body, and a wrapper that uses the companion's check.
+const wrappedBody = fixed({
+  companions: [
+    moduleOf({
+      slots: [
+        slot(true, [], { exported: true, part: `check` }),
+        slot(false),
+        slot(false),
+      ],
+    }),
+  ],
+  oracle: {
+    module: checkOnly,
+    objectRefs: [],
+    registrarCall: false,
+    tests: [
+      reg({ form: `helper-plain`, wrap: WRAP[`wrap-async`], refs: [local(0)] }),
+      reg({ form: `helper-plain`, wrap: WRAP.wrap }),
+      reg({ form: `helper-plain`, wrap: WRAP[`wrap-part`] }),
+    ],
+  },
+})
+
+// A registrar in an `oracle-` module through a namespace member call, and a
+// caller-passed-body helper in an `oracle-` module with a unit body.
+const machineryHelpers = fixed({
+  registrarName: `oracle-reg.ts`,
+  registrarImport: `namespace`,
+  helperName: `oracle-reg-helper.ts`,
+  oracle: {
+    module: checkOnly,
+    objectRefs: [],
+    registrarCall: true,
+    tests: [reg({ form: `helper-plain` })],
+  },
+})
+
+// A registrar through a default import.
+const defaultRegistrar = fixed({
+  registrarImport: `default`,
+  oracle: {
+    module: checkOnly,
+    objectRefs: [],
+    registrarCall: true,
+    tests: [reg({ refs: [local(0)] })],
+  },
+})
+
+// Drivers: a `let` that a hook assigns, a `for...of` over the check, and a
+// namespace import of a companion's exported check.
+const drivers = fixed({
+  companions: [
+    moduleOf({
+      slots: [
+        slot(true, [], { exported: true, part: `check` }),
+        slot(false),
+        slot(false),
+      ],
+    }),
+  ],
+  oracle: {
+    module: moduleOf({
+      slots: [slot(false), slot(false), slot(true, [], { part: `check` })],
+      imports: [{ target: 0, slot: 0, form: `namespace` }],
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [
+      reg({ form: `let-driver`, refs: [local(0)] }),
+      reg({ form: `for-of`, elements: [0] }),
+      reg({ refs: [imported(0)] }),
+    ],
+  },
+})
+
+// A declaration that spreads its first part list, and generated properties:
+// a named constant arbitrary, and an imported predicate that reads or
+// ignores its input, through `fc.property` and through `.prop`.
+const declarationsAndProperties = fixed({
+  oracle: {
+    module: moduleOf({
+      slots: [
+        slot(true, [], { part: `model` }),
+        slot(false),
+        slot(true, [], { part: `check` }),
+      ],
+      spread: true,
+    }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [
+      reg({ refs: [local(0)] }),
+      reg({ form: `property`, constantArb: true, arbNamed: true }),
+      reg({ form: `prop-named`, predicate: `imported` }),
+      reg({ form: `property`, predicate: `imported`, readsInput: false }),
+    ],
+  },
+})
+
+// A default import of c0, which has no default of its own and star-exports
+// c1, whose default is a check. `export *` carries no default, so the test
+// reaches nothing.
+const defaultThroughStar = fixed({
+  companions: [
+    moduleOf({ stars: [0] }),
+    moduleOf({
+      slots: [slot(true, [], { part: `check` }), slot(false), slot(false)],
+      defaultSlot: 0,
+    }),
+  ],
+  oracle: {
+    module: moduleOf({ imports: [{ target: 0, slot: 0, form: `default` }] }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [reg({ refs: [imported(0)] })],
+  },
+})
+
+// An oracle file whose only test imports the check from a JavaScript companion.
+const javascriptCompanion = fixed({
+  companions: [
+    moduleOf({
+      slots: [
+        slot(true, [], { exported: true, part: `check` }),
+        slot(false),
+        slot(false),
+      ],
+      js: true,
+    }),
+  ],
+  oracle: {
+    module: moduleOf({ imports: [{ target: 0, slot: 0, form: `named` }] }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [reg({ refs: [imported(0)] })],
+  },
+})
+
+describe(`fixed inputs through every receiving path`, () => {
+  const paths = [
+    { name: `eslint`, run: lintWithEslint },
+    { name: `linter`, run: (program) => lintWithLinter(program) },
+    { name: `cli`, run: (program) => lintWithCli(program) },
+    { name: `edit-hook`, run: (program) => lintWithEditHook(program) },
+  ]
+  for (const [name, skeleton] of [
+    [`export-star and named re-export cycles`, exportCycle],
+    [`named re-export cycle only`, namedCycle],
+    [`mutual recursion, in both orders`, mutualRecursion],
+    [
+      `mutual recursion, reversed`,
+      {
+        ...mutualRecursion,
+        oracle: {
+          ...mutualRecursion.oracle,
+          tests: [...mutualRecursion.oracle.tests].reverse(),
+        },
+      },
+    ],
+    [`each registration form`, forms],
+    [`broken companion, string-keyed type model, registration helper`, helpers],
+    [`a caller-passed body before a trailing argument`, trailingArguments],
+    [`a caller-passed body inside the helper's wrapper`, wrappedBody],
+    [`helpers in oracle- machinery modules`, machineryHelpers],
+    [`a registrar through a default import`, defaultRegistrar],
+    [`let, for...of, and namespace drivers`, drivers],
+    [
+      `a spread declaration and generated properties`,
+      declarationsAndProperties,
+    ],
+    [`a check imported from a JavaScript companion`, javascriptCompanion],
+    [`a default import through a star export`, defaultThroughStar],
+  ]) {
+    it(`${name}`, async () => {
+      const program = buildProgram(skeleton, ALL)
+      await checkProgram(program, paths)
+    }, 300_000)
+  }
+})
+
+// The reach ledger is checked once every campaign above has run. A state that
+// no generated history entered fails the file, so its law is not claimed.
+afterAll(() => {
+  reach.assertReached()
+})
+
+// A dependency chain. The oracle imports `c1f0`, which imports the check
+// `c0f0`. Editing `c0` between two lints must change the oracle's reports,
+// although `c1` is unchanged: its reach was computed by the earlier lint.
+const chain = fixed({
+  companions: [
+    moduleOf({
+      slots: [
+        slot(true, [], { exported: true, part: `check` }),
+        slot(false),
+        slot(false),
+      ],
+    }),
+    moduleOf({
+      slots: [
+        slot(true, [imported(0)], { exported: true }),
+        slot(false),
+        slot(false),
+      ],
+      imports: [{ target: 0, slot: 0 }],
+    }),
+  ],
+  oracle: {
+    module: moduleOf({ imports: [{ target: 1, slot: 0 }] }),
+    objectRefs: [],
+    registrarCall: false,
+    tests: [reg({ refs: [imported(0)] })],
+  },
+})
+
+describe(`stale reach across a dependency chain`, () => {
+  it(`an edit to a transitive companion changes the reports of the next lint`, async () => {
+    const program = buildProgram(chain, ALL)
+    const before = writeProgram(join(root, `chain${historySeq++}`), program)
+    compareReports(
+      `eslint`,
+      await lintInstance(before.oracle, before.subjects),
+      predictReports(program),
+    )
+    const edited = toggleDeclaration(program, `c0.ts`)
+    rewriteCompanion(
+      before.oracle.slice(0, before.oracle.lastIndexOf(`/`)),
+      edited,
+      `c0.ts`,
+    )
+    compareReports(
+      `eslint after an edit`,
+      await lintInstance(before.oracle, before.subjects),
+      predictReports(edited),
+    )
+  }, 300_000)
+})
+
+/** Lints one file on the long-lived instance; returns its keys. */
+async function lintInstance(file, subjects) {
+  const results = await eslint.lintFiles([file])
+  return keysOf(
+    results.flatMap((result) => result.messages),
+    subjects,
+  )
+}
diff --git a/scripts/eslint-plugin-oracle/registration.js b/scripts/eslint-plugin-oracle/registration.js
new file mode 100644
index 0000000000..14513c0d84
--- /dev/null
+++ b/scripts/eslint-plugin-oracle/registration.js
@@ -0,0 +1,199 @@
+/**
+ * How the oracle rules recognize a test registration and the shared helpers
+ * from oracle-config. Every rule uses these, so that the rules agree on what
+ * a test is.
+ */
+
+export const testRoots = new Set([`describe`, `fcTest`, `it`, `suite`, `test`])
+export const disablingModifiers = new Set([`fixme`, `skip`, `todo`])
+export const conditionalModifiers = new Set([`runIf`, `skipIf`])
+export const aliasModifiers = new Set([
+  ...disablingModifiers,
+  ...conditionalModifiers,
+  `only`,
+])
+// The members that keep a call a test registration. Playwright's `test` also
+// has calls such as `test.info()` and `test.step()` that register nothing.
+export const registrationMembers = new Set([
+  ...aliasModifiers,
+  `concurrent`,
+  `describe`,
+  `each`,
+  `fails`,
+  `for`,
+  `parallel`,
+  `prop`,
+  `sequential`,
+  `serial`,
+])
+// The shared helpers that return a test registration or its `skip` form.
+export const selectionHelpers = new Set([
+  `oracleCalibrationTest`,
+  `oracleReplayTest`,
+])
+
+/** The root identifier and member names of a callee such as `it.skip.prop(...)`. */
+export function calleeChain(callee) {
+  const names = []
+  let node = callee
+  for (;;) {
+    if (node.type === `MemberExpression`) {
+      if (node.property.type === `Identifier`) names.unshift(node.property.name)
+      node = node.object
+    } else if (
+      node.type === `CallExpression` &&
+      node.callee.type === `Identifier` &&
+      selectionHelpers.has(node.callee.name) &&
+      node.arguments.length > 0
+    ) {
+      // `oracleReplayTest(it)` returns `it` or `it.skip`, so a registration
+      // made through it is checked as a registration of `it`.
+      node = node.arguments[0]
+    } else if (node.type === `CallExpression`) {
+      node = node.callee
+    } else {
+      break
+    }
+  }
+  return {
+    root: node.type === `Identifier` ? node.name : undefined,
+    rootNode: node,
+    names,
+  }
+}
+
+/**
+ * Whether an identifier names a test function: `it`, `test`, and the
+ * other test roots, a renamed import of one (`import { it as vitestIt }`),
+ * or a constant bound to one through a selection helper or a member chain
+ * (`const fixedCase = oracleReplayTest(it)`). A registration made through
+ * such a constant is checked as a registration of its test.
+ */
+export function isTestRoot(node, sourceCode, seen = new Set()) {
+  if (node?.type !== `Identifier`) return false
+  if (testRoots.has(node.name)) return true
+  const definition = findVariable(sourceCode.getScope(node), node.name)?.defs[0]
+  if (definition === undefined || seen.has(definition.node)) return false
+  seen.add(definition.node)
+  if (definition.type === `ImportBinding`) {
+    const imported = definition.node.imported
+    return (
+      imported !== undefined && testRoots.has(imported.name ?? imported.value)
+    )
+  }
+  return (
+    definition.type === `Variable` &&
+    definition.parent.kind === `const` &&
+    definition.node.init !== null &&
+    isTestRoot(calleeChain(definition.node.init).rootNode, sourceCode, seen)
+  )
+}
+
+export function isFunction(node) {
+  return (
+    node?.type === `ArrowFunctionExpression` ||
+    node?.type === `FunctionExpression`
+  )
+}
+
+export function findVariable(scope, name) {
+  for (let current = scope; current; current = current.upper) {
+    const variable = current.set.get(name)
+    if (variable !== undefined) return variable
+  }
+  return undefined
+}
+
+/** Whether `source` is an import specifier of the shared oracle-config module. */
+export function isOracleConfigSource(source) {
+  return /(^|\/)oracle-(config|declaration)(\.js)?$/.test(source)
+}
+
+/** A call to one of `names`, imported from oracle-config. */
+export function isSharedHelperCall(node, names, sourceCode) {
+  if (
+    node?.type !== `CallExpression` ||
+    node.callee.type !== `Identifier` ||
+    !names.has(node.callee.name)
+  ) {
+    return false
+  }
+  const definition = findVariable(sourceCode.getScope(node), node.callee.name)
+    ?.defs[0]
+  return (
+    definition?.type === `ImportBinding` &&
+    isOracleConfigSource(definition.parent.source.value)
+  )
+}
+
+/**
+ * The test that a call registers, as `{ body }`, or undefined when the call
+ * registers no test. A suite (`describe`) registers no test of its own. The
+ * body is the function, or the name of the function, that the test runs.
+ */
+export function registeredTest(node, sourceCode) {
+  if (node.parent.type === `CallExpression` && node.parent.callee === node) {
+    // `it.each(table)` is the callee of the registration, not one itself.
+    return undefined
+  }
+  const { root, rootNode, names } = calleeChain(node.callee)
+  if (
+    !isTestRoot(rootNode, sourceCode) ||
+    root === `describe` ||
+    root === `suite` ||
+    names.includes(`describe`) ||
+    !names.every((member) => registrationMembers.has(member))
+  ) {
+    return undefined
+  }
+  const body = registrationBody(node.arguments.slice(1), sourceCode)
+  return body === undefined ? undefined : { body }
+}
+
+/**
+ * The argument that a registration runs. Vitest takes `(name, fn, options)` or
+ * `(name, options, fn)`, so the body is the function wherever it is. Without a
+ * function, the body is a call or member expression that yields one, then an
+ * identifier. An options object, a number, or a value that is not a function
+ * binding is never the body while another argument can be.
+ */
+function registrationBody(args, sourceCode) {
+  return (
+    args.find(isFunction) ??
+    args.find(
+      (argument) =>
+        argument.type === `Identifier` &&
+        isFunctionBinding(argument, sourceCode),
+    ) ??
+    args.find(
+      (argument) =>
+        !plainValueTypes.has(argument.type) && argument.type !== `Identifier`,
+    ) ??
+    args.find((argument) => argument.type === `Identifier`)
+  )
+}
+
+// Argument types that carry data, not behavior, so they can be options.
+const plainValueTypes = new Set([
+  `Literal`,
+  `ObjectExpression`,
+  `ArrayExpression`,
+  `TemplateLiteral`,
+])
+
+/**
+ * Whether an identifier names a function, or may. A binding that holds a plain
+ * value is not a function. An import, a parameter, or a call result may be one.
+ */
+function isFunctionBinding(identifier, sourceCode) {
+  const definition = findVariable(
+    sourceCode.getScope(identifier),
+    identifier.name,
+  )?.defs[0]
+  if (definition?.type === `FunctionName`) return true
+  if (definition?.type === `Variable`) {
+    const init = definition.node.init
+    return init !== null && !plainValueTypes.has(init.type)
+  }
+  return definition !== undefined
+}
diff --git a/scripts/eslint-plugin-oracle/rules/no-disabled.js b/scripts/eslint-plugin-oracle/rules/no-disabled.js
index 15a07bbda5..b795adf68e 100644
--- a/scripts/eslint-plugin-oracle/rules/no-disabled.js
+++ b/scripts/eslint-plugin-oracle/rules/no-disabled.js
@@ -53,34 +53,25 @@
  * still check those.
  */
 
-const testRoots = new Set([`describe`, `fcTest`, `it`, `suite`, `test`])
-const disablingModifiers = new Set([`fixme`, `skip`, `todo`])
-const conditionalModifiers = new Set([`runIf`, `skipIf`])
-const aliasModifiers = new Set([
-  ...disablingModifiers,
-  ...conditionalModifiers,
-  `only`,
-])
+import {
+  aliasModifiers,
+  calleeChain,
+  conditionalModifiers,
+  disablingModifiers,
+  findVariable,
+  isFunction,
+  isSharedHelperCall,
+  isTestRoot,
+  registrationMembers,
+  selectionHelpers,
+  testRoots,
+} from '../registration.js'
+
 const replayConditions = new Set([`oracleReplayRequested`, `oracleReplaySkips`])
-// The members that keep a call a test registration. Playwright's `test` also
-// has calls such as `test.info()` and `test.step()` that register nothing.
-const registrationMembers = new Set([
-  ...aliasModifiers,
-  `concurrent`,
-  `describe`,
-  `each`,
-  `fails`,
-  `parallel`,
-  `prop`,
-  `sequential`,
-  `serial`,
-])
 // oracle-config implements replay selection, so its options may carry a
 // replay path from configuration.
 const replaySelectionModule =
   /(^|[/\\])packages[/\\]db[/\\]tests[/\\]oracle-config\.ts$/
-// The shared helpers that return a test registration or its `skip` form.
-const selectionHelpers = new Set([`oracleCalibrationTest`, `oracleReplayTest`])
 // The variables that select a replay. Any other variable whose name ends
 // in one of these suffixes is a private replay selection.
 const sharedReplayVariables = new Set([
@@ -95,70 +86,6 @@ const runHelpers = new Set([
   `oracleRuns`,
 ])
 
-/** The root identifier and member names of a callee such as `it.skip.prop(...)`. */
-function calleeChain(callee) {
-  const names = []
-  let node = callee
-  for (;;) {
-    if (node.type === `MemberExpression`) {
-      if (node.property.type === `Identifier`) names.unshift(node.property.name)
-      node = node.object
-    } else if (
-      node.type === `CallExpression` &&
-      node.callee.type === `Identifier` &&
-      selectionHelpers.has(node.callee.name) &&
-      node.arguments.length > 0
-    ) {
-      // `oracleReplayTest(it)` returns `it` or `it.skip`, so a registration
-      // made through it is checked as a registration of `it`.
-      node = node.arguments[0]
-    } else if (node.type === `CallExpression`) {
-      node = node.callee
-    } else {
-      break
-    }
-  }
-  return {
-    root: node.type === `Identifier` ? node.name : undefined,
-    rootNode: node,
-    names,
-  }
-}
-
-/**
- * Whether an identifier names a test function: `it`, `test`, and the
- * other test roots, a renamed import of one (`import { it as vitestIt }`),
- * or a constant bound to one through a selection helper or a member chain
- * (`const fixedCase = oracleReplayTest(it)`). A registration made through
- * such a constant is checked as a registration of its test.
- */
-function isTestRoot(node, sourceCode, seen = new Set()) {
-  if (node?.type !== `Identifier`) return false
-  if (testRoots.has(node.name)) return true
-  const definition = findVariable(sourceCode.getScope(node), node.name)?.defs[0]
-  if (definition === undefined || seen.has(definition.node)) return false
-  seen.add(definition.node)
-  if (definition.type === `ImportBinding`) {
-    const imported = definition.node.imported
-    return (
-      imported !== undefined && testRoots.has(imported.name ?? imported.value)
-    )
-  }
-  return (
-    definition.type === `Variable` &&
-    definition.parent.kind === `const` &&
-    definition.node.init !== null &&
-    isTestRoot(calleeChain(definition.node.init).rootNode, sourceCode, seen)
-  )
-}
-
-function isFunction(node) {
-  return (
-    node?.type === `ArrowFunctionExpression` ||
-    node?.type === `FunctionExpression`
-  )
-}
-
 /** A test body that runs something: a named function or a non-empty one. */
 function hasBody(body) {
   if (!isFunction(body)) return true
@@ -188,26 +115,6 @@ function registrationCondition(callee) {
   return undefined
 }
 
-/**
- * A call to one of the shared oracle-config helpers in `names`. The binding
- * must be the import, not a local function with the same name.
- */
-function isSharedHelperCall(node, names, sourceCode) {
-  if (
-    node?.type !== `CallExpression` ||
-    node.callee.type !== `Identifier` ||
-    !names.has(node.callee.name)
-  ) {
-    return false
-  }
-  const definition = findVariable(sourceCode.getScope(node), node.callee.name)
-    ?.defs[0]
-  return (
-    definition?.type === `ImportBinding` &&
-    /(^|\/)oracle-config(\.js)?$/.test(definition.parent.source.value)
-  )
-}
-
 /** Exactly `.skipIf(<shared replay condition>)`, not negated. */
 function isReplaySelection({ name, args }, sourceCode) {
   return (
@@ -432,14 +339,6 @@ function isNumberLiteral(node) {
   return node?.type === `Literal` && typeof node.value === `number`
 }
 
-function findVariable(scope, name) {
-  for (let current = scope; current; current = current.upper) {
-    const variable = current.set.get(name)
-    if (variable !== undefined) return variable
-  }
-  return undefined
-}
-
 function isProcessEnv(node) {
   return (
     node?.type === `MemberExpression` &&
@@ -464,7 +363,6 @@ function isPrivateReplayVariable(name) {
   return replayVariableName.test(name) && !sharedReplayVariables.has(name)
 }
 
-/** A number literal, or a constant bound to one. */
 /** The number literal that `node` is, or that a constant `node` names. */
 function constantNumber(node, sourceCode) {
   if (isNumberLiteral(node)) return node
diff --git a/scripts/eslint-plugin-oracle/rules/no-unit-test.js b/scripts/eslint-plugin-oracle/rules/no-unit-test.js
new file mode 100644
index 0000000000..60cf8c71e4
--- /dev/null
+++ b/scripts/eslint-plugin-oracle/rules/no-unit-test.js
@@ -0,0 +1,1305 @@
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { basename, dirname, join, relative, resolve, sep } from 'node:path'
+import { parseForESLint } from '@typescript-eslint/parser'
+import {
+  findVariable,
+  isFunction,
+  isOracleConfigSource,
+  registeredTest,
+} from '../registration.js'
+
+/**
+ * An oracle's expected results come from its model, and its check compares
+ * production with them. A test that compares production with a value that a
+ * person wrote down is a unit test. Its expectation has no independent
+ * source, so it is not oracle coverage, even in a file named for an oracle.
+ *
+ * Each oracle file declares its parts with `declareOracle` from
+ * oracle-declaration:
+ *
+ *   declareOracle({ check: [checkHistory], model: [modelHistory] })
+ *
+ * The check compares production observations with the model, or with a
+ * second formulation. The grammar is the generators that produce legal
+ * histories. Each is optional: a differential or metamorphic oracle has no
+ * model, and a companion module can declare only the part that its importers
+ * use. Every test in the file must reach a declared part:
+ *
+ * - A generated property or a fixed history reaches the check.
+ * - A model pin reaches the model. It checks one model rule against its
+ *   authority.
+ * - A calibration reaches the check. It shows that the check rejects a
+ *   wrong answer.
+ * - A grammar calibration reaches the grammar. It shows that the generators
+ *   reach the states that the laws need.
+ *
+ * A generated property counts as its own check: `fc.property(...)` or
+ * `fc.asyncProperty(...)` from fast-check, run by the test directly or
+ * through code it calls, or a `.prop([...])` registration. Its predicate
+ * states a law over inputs that nobody wrote down. It does not count when all
+ * its arbitraries are `fc.constant` or `fc.constantFrom`, written inline or
+ * bound to a const name, or when its predicate never reads its input: then it
+ * checks written values. A predicate is read where it is defined, in this file
+ * or in a test module that the file imports. One that the rule cannot read, as
+ * from a package, counts.
+ *
+ * A test reaches a part when its body uses the part, or uses a function or
+ * value that reaches it. The rule follows bindings through the file and
+ * through relative imports of other test modules, so a driver in a companion
+ * module that calls the check counts. An import is followed whether it is
+ * named, a default, or a namespace whose member the code reads; `export *`
+ * does not carry a default. A `let` holds each value that code assigns to it,
+ * such as a driver that a hook builds. A `for...of` loop variable takes each
+ * element of its array in turn, and the loop registers one test per element,
+ * so every element must reach. It does not follow imports of
+ * production: `src/` modules of a published package, which declare no oracle
+ * part. A private package, such as an end-to-end suite, keeps its tests in
+ * `src/`, and the rule follows those.
+ *
+ * The rule reports each test that reaches no declared part. Move such a test
+ * to an ordinary test file, where it stays as supplemental coverage. A file
+ * whose tests reach no part, and that declares none itself, gets one report
+ * that asks for the declaration.
+ *
+ * Files whose names start with `oracle-`, such as `oracle-replay.test.ts`,
+ * test the shared oracle machinery, and the rule skips them.
+ *
+ * A unit test that happens to use a declared grammar passes the rule.
+ * The rule cannot see whether a test that reaches a part also compares
+ * production with hand-written values, or whether a declared part is really
+ * a check or a model. Reviewers still check those.
+ *
+ * An oracle file registers only oracle tests, so it may not call an imported
+ * helper that registers a test of its own. Such a call gets an
+ * importedRegistration report: the author registers those tests from an
+ * ordinary test file. The helper is found through a named, default, or
+ * namespace import. A helper that registers the body its caller passes does not
+ * register a test of its own. Its caller's body is the test, and it is judged
+ * at the call, as a local parameter registration is: the argument at the body
+ * parameter's position, so a trailing timeout is not the body. A helper may
+ * wrap the body in a function of its own; when that wrapper uses a part, every
+ * call's test reaches it. A call to a helper in an oracle-named module is not
+ * judged here, because that module's tests are linted on their own. An
+ * `oracle-` machinery module is not linted, so its helpers are judged here as
+ * an ordinary module's are.
+ */
+
+const declarationHelper = `declareOracle`
+
+/**
+ * Every module that an earlier lint parsed, by path, with the mtime and size
+ * it was read at. Parsing is the costly part, so a module is parsed again only
+ * when it changes. The reach that a lint computes is never kept between lints,
+ * so an edit to any module reaches the next lint: see LintSession.
+ */
+const parsedModules = new Map()
+
+/**
+ * The reach state of one lint run: the modules it loaded, the production
+ * package flags it read, and the reach search that resolves bindings.
+ */
+class LintSession {
+  modules = new Map()
+  published = new Map()
+  search = new ReachSearch()
+}
+
+/**
+ * Resolves reach through cycles. A binding or export that is still being
+ * computed reads as not reaching, which is its least fixed point. A value that
+ * consulted such an assumption above its own computation is not kept, since the
+ * assumption may not hold: it is computed again on its next read. A reaching
+ * value is always kept, because reach only comes from declared parts.
+ */
+class ReachSearch {
+  #frames = []
+  #active = new Map()
+
+  solve(cache, key, compute) {
+    const known = cache.get(key)
+    if (known !== undefined) return known
+    if (!this.#active.has(cache)) this.#active.set(cache, new Map())
+    const active = this.#active.get(cache)
+    const depth = active.get(key)
+    if (depth !== undefined) {
+      const frame = this.#frames.at(-1)
+      frame.low = Math.min(frame.low, depth)
+      return false
+    }
+    const frame = { depth: this.#frames.length, low: Infinity }
+    this.#frames.push(frame)
+    active.set(key, frame.depth)
+    let reaches
+    try {
+      reaches = compute()
+    } finally {
+      this.#frames.pop()
+      active.delete(key)
+    }
+    const caller = this.#frames.at(-1)
+    if (caller !== undefined) caller.low = Math.min(caller.low, frame.low)
+    if (reaches || frame.low >= frame.depth) cache.set(key, reaches)
+    return reaches
+  }
+}
+
+/**
+ * Whether a binding that a module imports from `source` reaches a part. A
+ * module that cannot be loaded reaches nothing.
+ */
+function importedModuleReaches(fromFile, source, name, session) {
+  const file = resolveTestModule(fromFile, source, session)
+  const module = file === undefined ? undefined : loadModule(file, session)
+  return module !== undefined && module.exportReaches(name)
+}
+
+/** Whether a function that a module imports from `source` registers a test. */
+function importedRegisters(fromFile, source, name, session, visiting) {
+  const file = resolveTestModule(fromFile, source, session)
+  const module = file === undefined ? undefined : loadModule(file, session)
+  return module?.registrationShape(name, visiting)
+}
+
+/**
+ * The shape of an imported helper that a call in an oracle file invokes, or
+ * undefined. The root is the callee under any curried calls, as in
+ * `serializerProp(property, [arb])(name, check)`: a named or default import,
+ * or a member of a namespace import, as in `helpers.registerUnits()`. A helper
+ * in a module that is linted on its own is judged there.
+ */
+function importedHelperShape(node, file, sourceCode, session) {
+  let callee = node.callee
+  while (callee.type === `CallExpression`) callee = callee.callee
+  const target = importedTarget(callee, sourceCode.getScope(node))
+  if (target === undefined) return undefined
+  const module = resolveTestModule(file, target.source, session)
+  if (module === undefined || lintedOnItsOwn(module)) return undefined
+  return loadModule(module, session)?.registrationShape(target.name)
+}
+
+/**
+ * The import that an identifier or a namespace member names, as
+ * `{ source, name }`, or undefined when it names no import.
+ */
+function importedTarget(node, scope) {
+  if (
+    node.type === `MemberExpression` &&
+    !node.computed &&
+    node.object.type === `Identifier`
+  ) {
+    const definition = findVariable(scope, node.object.name)?.defs[0]
+    return definition?.type === `ImportBinding` &&
+      definition.node.type === `ImportNamespaceSpecifier`
+      ? { source: definition.parent.source.value, name: node.property.name }
+      : undefined
+  }
+  if (node.type !== `Identifier`) return undefined
+  const definition = findVariable(scope, node.name)?.defs[0]
+  return definition?.type === `ImportBinding`
+    ? importBindingTarget(definition)
+    : undefined
+}
+
+/**
+ * The export that an import binding names: the specifier's name, or `default`.
+ * A namespace import names a whole module, so it gives undefined.
+ */
+function importBindingTarget(definition) {
+  const source = definition.parent.source.value
+  if (definition.node.type === `ImportSpecifier`) {
+    const { imported } = definition.node
+    return { source, name: imported.name ?? imported.value }
+  }
+  if (definition.node.type === `ImportDefaultSpecifier`) {
+    return { source, name: `default` }
+  }
+  return undefined
+}
+
+/**
+ * Whether the lint selection lints a module as an oracle file: its name
+ * contains `oracle`, and it is not an `oracle-` machinery module, which no
+ * lint reads.
+ */
+function lintedOnItsOwn(file) {
+  const name = basename(file)
+  return name.includes(`oracle`) && !name.startsWith(`oracle-`)
+}
+
+/**
+ * Whether a helper call reaches a part through the body its caller passes. The
+ * body is the argument at the position of the helper's body parameter. It
+ * reaches when it uses a part. A fast-check property (`.prop`) also reaches
+ * when one of its arbitraries generates values and its body reads the value,
+ * because then the body is a generated property. A wrapper that the helper
+ * writes around the body, and that uses a part itself, makes the test reach.
+ */
+function callerBodyReaches(node, helper, module) {
+  if (helper.wrapperReaches) return true
+  const body = curriedArguments(node, helper.level)[helper.index]
+  if (body === undefined) return false
+  if (module.nodeReaches(body)) return true
+  return (
+    helper.prop &&
+    isFunction(body) &&
+    generatesValues(node, module) &&
+    module.usesInput(body)
+  )
+}
+
+/**
+ * The arguments of one call in a curried call: level 0 is the call of the
+ * helper itself, and each later level is the call of the function before it
+ * returned.
+ */
+function curriedArguments(node, level) {
+  const calls = []
+  for (let call = node; call.type === `CallExpression`; call = call.callee) {
+    calls.unshift(call)
+  }
+  return calls[level]?.arguments ?? []
+}
+
+/**
+ * Whether an arbitrary generates values: a call that is not a constant, or a
+ * variable whose initializer is one. An identifier is followed to its definition.
+ */
+function generatedArbitrary(value, module) {
+  if (value?.type === `Identifier`) {
+    const definition = findVariable(module.scopeOf(value), value.name)?.defs[0]
+    return (
+      definition?.type === `Variable` &&
+      definition.node.init !== null &&
+      generatedArbitrary(definition.node.init, module)
+    )
+  }
+  return value?.type === `CallExpression` && !isConstant(value)
+}
+
+/** Whether a curried call's arguments include a non-constant arbitrary. */
+function generatesValues(node, module) {
+  for (
+    let inner = node.callee;
+    inner.type === `CallExpression`;
+    inner = inner.callee
+  ) {
+    for (const argument of inner.arguments) {
+      const values =
+        argument.type === `ArrayExpression` ? argument.elements : [argument]
+      if (values.some((value) => generatedArbitrary(value, module))) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
+/** The test module that a relative import names, or undefined. */
+function resolveTestModule(fromFile, source, session) {
+  if (!source.startsWith(`.`)) return undefined
+  const base = resolve(dirname(fromFile), source)
+  const stem = base.replace(/\.(m?js|tsx?)$/, ``)
+  // A `.js` specifier names the TypeScript source when one exists, and
+  // otherwise the JavaScript module itself.
+  const file = [
+    `${stem}.ts`,
+    `${stem}.tsx`,
+    ...(/\.m?js$/.test(base) ? [base] : []),
+    `${base}/index.ts`,
+  ].find((candidate) => existsSync(candidate))
+  // Production declares no oracle part, so the rule does not parse it.
+  if (file === undefined || isProductionModule(file, session)) return undefined
+  return file
+}
+
+/**
+ * Whether a file is shipped source: under `src/` in a published package. A
+ * private package, such as an end-to-end suite, keeps its tests in `src/`.
+ */
+function isProductionModule(file, session) {
+  for (let directory = dirname(file); ; directory = dirname(directory)) {
+    const manifest = join(directory, `package.json`)
+    if (existsSync(manifest)) {
+      if (!session.published.has(directory)) {
+        const { private: isPrivate } = JSON.parse(
+          readFileSync(manifest, `utf8`),
+        )
+        session.published.set(directory, isPrivate !== true)
+      }
+      return (
+        session.published.get(directory) &&
+        relative(directory, file).split(sep)[0] === `src`
+      )
+    }
+    if (dirname(directory) === directory) return false
+  }
+}
+
+/** The name of an object property, whether its key is an identifier or a string. */
+function propertyName(property) {
+  if (property.computed) return stringValue(property.key)
+  return property.key.name ?? stringValue(property.key)
+}
+
+function inTypeQuery(identifier) {
+  for (let node = identifier.parent; node; node = node.parent) {
+    if (node.type === `TSTypeQuery`) return true
+  }
+  return false
+}
+
+/** ESLint sets `parent` on the file it lints; a module parsed here needs it too. */
+function setParents(node, parent) {
+  node.parent = parent
+  for (const [key, child] of Object.entries(node)) {
+    if (key === `parent`) continue
+    for (const item of Array.isArray(child) ? child : [child]) {
+      if (typeof item?.type === `string`) setParents(item, node)
+    }
+  }
+}
+
+/**
+ * The module that a file names, for this lint. A module that cannot be read or
+ * does not parse reaches nothing. Its own lint reports the error.
+ */
+function loadModule(file, session) {
+  if (!session.modules.has(file)) {
+    let parsed
+    try {
+      parsed = parseModule(file)
+    } catch {
+      parsed = undefined
+    }
+    const module =
+      parsed === undefined
+        ? undefined
+        : new OracleModule(file, parsed.ast, parsed.scopeManager, session)
+    session.modules.set(file, module)
+  }
+  return session.modules.get(file)
+}
+
+/** The parsed AST of a module, reused while its mtime and size are unchanged. */
+function parseModule(file) {
+  const { mtimeMs, size } = statSync(file)
+  const cached = parsedModules.get(file)
+  if (cached?.mtimeMs === mtimeMs && cached.size === size) return cached
+  const { ast, scopeManager } = parseForESLint(readFileSync(file, `utf8`), {
+    filePath: file,
+    jsx: file.endsWith(`.tsx`),
+    loc: true,
+    range: true,
+    sourceType: `module`,
+  })
+  setParents(ast, null)
+  const parsed = { mtimeMs, size, ast, scopeManager }
+  parsedModules.set(file, parsed)
+  return parsed
+}
+
+class OracleModule {
+  constructor(file, ast, scopeManager, session) {
+    this.file = file
+    this.scopeManager = scopeManager
+    this.session = session
+    this.reach = new Map()
+    // Reach of a binding seen from another module, which ignores parameters.
+    this.exportedReach = new Map()
+    // Reach of an exported name, by name.
+    this.exportReachCache = new Map()
+    // Resolved references in source order, so a node's references are one
+    // contiguous range.
+    this.references = scopeManager.scopes
+      .flatMap((scope) => scope.references)
+      // A type annotation runs nothing, so only value references reach.
+      // `typeof check` in a type names a value, and still runs nothing.
+      .filter(
+        (reference) =>
+          reference.resolved !== null &&
+          reference.isValueReference &&
+          !inTypeQuery(reference.identifier),
+      )
+      .sort((a, b) => a.identifier.range[0] - b.identifier.range[0])
+    this.resolvedAt = new Map(
+      this.references.map((reference) => [
+        reference.identifier,
+        reference.resolved,
+      ]),
+    )
+    // Start offsets of the generated properties in this module, in order.
+    this.properties = []
+    walk(ast, (node) => {
+      if (this.#isGeneratedProperty(node)) this.properties.push(node.range[0])
+    })
+    this.properties.sort((a, b) => a - b)
+    // Names that `typeModel` lists, with the string literal that names each.
+    this.typeModels = new Map()
+    this.declared = this.#declaredParts()
+    this.#resolveTypeModels(ast)
+    this.exported = new Map()
+    this.starSources = []
+    for (const statement of ast.body) this.#recordExports(statement)
+  }
+
+  /** The variables that `declareOracle({ check, model })` names. */
+  #declaredParts() {
+    const declared = new Set()
+    for (const reference of this.references) {
+      const call = reference.identifier.parent
+      const definition = reference.resolved.defs[0]
+      if (
+        reference.identifier.name !== declarationHelper ||
+        call.type !== `CallExpression` ||
+        call.callee !== reference.identifier ||
+        definition?.type !== `ImportBinding` ||
+        !isOracleConfigSource(definition.parent.source.value)
+      ) {
+        continue
+      }
+      for (const property of this.#declarationProperties(call.arguments[0])) {
+        const value = property.value
+        const parts =
+          value?.type === `ArrayExpression` ? value.elements : [value]
+        if (propertyName(property) === `typeModel`) {
+          for (const part of parts) {
+            const name = stringValue(part)
+            if (name !== undefined) this.typeModels.set(name, part)
+          }
+          continue
+        }
+        for (const part of parts) {
+          const variable =
+            part?.type === `Identifier` ? this.resolvedAt.get(part) : undefined
+          if (variable !== undefined) declared.add(variable)
+        }
+      }
+    }
+    return declared
+  }
+
+  /**
+   * The properties of a declaration object. A spread of a const object
+   * literal contributes that object's properties, as the type accepts it.
+   */
+  #declarationProperties(object, seen = new Set()) {
+    if (object?.type !== `ObjectExpression` || seen.has(object)) return []
+    seen.add(object)
+    return object.properties.flatMap((property) => {
+      if (property.type !== `SpreadElement`) return [property]
+      const definition =
+        property.argument.type === `Identifier`
+          ? this.resolvedAt.get(property.argument)?.defs[0]
+          : undefined
+      return definition?.type === `Variable` &&
+        definition.parent.kind === `const`
+        ? this.#declarationProperties(definition.node.init, seen)
+        : []
+    })
+  }
+
+  #recordExports(statement) {
+    if (statement.type === `ExportDefaultDeclaration`) {
+      this.#recordDefaultExport(statement.declaration)
+      return
+    }
+    if (statement.type === `ExportAllDeclaration`) {
+      if (statement.exported === null) {
+        this.starSources.push(statement.source.value)
+      }
+      return
+    }
+    if (statement.type !== `ExportNamedDeclaration`) return
+    if (statement.declaration !== null) {
+      // A class declares its name twice: in the module and inside its own
+      // scope. The module binding is the one a declaration refers to.
+      const moduleScope = this.#moduleScope()
+      for (const variable of this.scopeManager.getDeclaredVariables(
+        statement.declaration,
+      )) {
+        if (variable.scope === moduleScope)
+          this.exported.set(variable.name, { variable })
+      }
+      return
+    }
+    for (const specifier of statement.specifiers) {
+      const exported = specifier.exported.name ?? specifier.exported.value
+      const local = specifier.local.name ?? specifier.local.value
+      if (statement.source !== null) {
+        this.exported.set(exported, {
+          source: statement.source.value,
+          imported: local,
+        })
+      } else {
+        const variable = findVariable(this.#moduleScope(), local)
+        if (variable !== undefined) this.exported.set(exported, { variable })
+      }
+    }
+  }
+
+  /**
+   * `export default` names a module binding, declares a named function or
+   * class, or exports an expression, which reaches when its code does.
+   */
+  #recordDefaultExport(declaration) {
+    const moduleScope = this.#moduleScope()
+    const variable =
+      declaration.type === `Identifier`
+        ? findVariable(moduleScope, declaration.name)
+        : declaration.id
+          ? this.scopeManager
+              .getDeclaredVariables(declaration)
+              .find((declared) => declared.scope === moduleScope)
+          : undefined
+    this.exported.set(
+      `default`,
+      variable === undefined ? { node: declaration } : { variable },
+    )
+  }
+
+  #moduleScope() {
+    return (
+      this.scopeManager.scopes.find((scope) => scope.type === `module`) ??
+      this.scopeManager.globalScope
+    )
+  }
+
+  get declaresParts() {
+    return this.declared.size > 0 || this.typeModels.size > 0
+  }
+
+  /**
+   * A type model is a type alias or interface in this module's scope, which
+   * a type-level test uses as its expected type. Record where each is used,
+   * and the names that name no such type.
+   */
+  #resolveTypeModels(ast) {
+    this.typeModelUses = []
+    this.unknownTypeModels = []
+    if (this.typeModels.size === 0) return
+    const defined = new Map()
+    for (const statement of ast.body) {
+      const declaration =
+        statement.type === `ExportNamedDeclaration`
+          ? statement.declaration
+          : statement
+      if (
+        declaration?.type === `TSTypeAliasDeclaration` ||
+        declaration?.type === `TSInterfaceDeclaration`
+      ) {
+        defined.set(declaration.id.name, declaration)
+      }
+    }
+    for (const [name, literal] of this.typeModels) {
+      if (!defined.has(name)) this.unknownTypeModels.push(literal)
+    }
+    // A type built from a model, such as `PublishedValueFor<Variant>` under
+    // another name, predicts what the model predicts.
+    const models = new Set(
+      [...this.typeModels.keys()].filter((name) => defined.has(name)),
+    )
+    const namesModel = (node) => {
+      let found = false
+      walk(node, (child) => {
+        if (
+          child.type === `TSTypeReference` &&
+          child.typeName.type === `Identifier` &&
+          models.has(child.typeName.name)
+        ) {
+          found = true
+        }
+      })
+      return found
+    }
+    for (let grew = true; grew;) {
+      grew = false
+      for (const [name, declaration] of defined) {
+        if (!models.has(name) && namesModel(declaration)) {
+          models.add(name)
+          grew = true
+        }
+      }
+    }
+    walk(ast, (node) => {
+      if (
+        node.type === `TSTypeReference` &&
+        node.typeName.type === `Identifier` &&
+        models.has(node.typeName.name)
+      ) {
+        this.typeModelUses.push(node.range[0])
+      }
+    })
+    this.typeModelUses.sort((a, b) => a - b)
+  }
+
+  /**
+   * Whether a binding is a declared part, or uses one. Seen from another
+   * module (`local` false), a parameter reaches nothing: the importer passes
+   * its own arguments, so this module's call sites say nothing about it.
+   */
+  variableReaches(variable, local = true) {
+    if (variable === undefined) return false
+    if (this.declared.has(variable)) return true
+    return this.session.search.solve(
+      local ? this.reach : this.exportedReach,
+      variable,
+      () =>
+        variable.defs.some((definition) =>
+          this.#definitionReaches(definition, local),
+        ) ||
+        this.#assignedValueReaches(variable, local) ||
+        (local && this.#fedByReachingValue(variable, local)),
+    )
+  }
+
+  /**
+   * A binding that code assigns after its declaration, such as a `let` that a
+   * hook sets, holds the value assigned to it. It reaches when one does.
+   */
+  #assignedValueReaches(variable, local) {
+    return variable.references.some(
+      (reference) =>
+        reference.isWrite() &&
+        !reference.init &&
+        reference.writeExpr != null &&
+        this.nodeReaches(reference.writeExpr, local),
+    )
+  }
+
+  /**
+   * A collection that code fills with values from a declared part, such as a
+   * coverage Set that grammar-driven tests add the model's predictions to,
+   * carries those values. A test that reads it uses the part.
+   */
+  #fedByReachingValue(variable, local) {
+    return variable.references.some((reference) => {
+      const member = reference.identifier.parent
+      const call = member?.parent
+      return (
+        member?.type === `MemberExpression` &&
+        member.object === reference.identifier &&
+        !member.computed &&
+        accumulatorMethods.has(member.property.name) &&
+        call?.type === `CallExpression` &&
+        call.callee === member &&
+        call.arguments.some((argument) => this.nodeReaches(argument, local))
+      )
+    })
+  }
+
+  #definitionReaches(definition, local) {
+    switch (definition.type) {
+      case `ImportBinding`: {
+        // A namespace import reaches through the member that each use names.
+        const target = importBindingTarget(definition)
+        return (
+          target !== undefined &&
+          this.#importReaches(target.source, target.name)
+        )
+      }
+      case `FunctionName`:
+      case `ClassName`:
+        return this.nodeReaches(definition.node, local)
+      case `Variable`: {
+        const loop = definition.parent.parent
+        if (loop?.type === `ForOfStatement` && loop.left === definition.parent)
+          return this.#everyElementReaches(loop.right, local)
+        return (
+          definition.node.init !== null &&
+          this.nodeReaches(definition.node.init, local)
+        )
+      }
+      case `Parameter`:
+        return local && this.#parameterReaches(definition)
+      default:
+        return false
+    }
+  }
+
+  /**
+   * A parameter reaches a part when every call of its function passes an
+   * argument that reaches one, as when a helper registers the property that
+   * its caller passes in. A function that the file never calls by name
+   * passes nothing the rule can see.
+   */
+  #parameterReaches(definition) {
+    const index = definition.node.params.indexOf(definition.name)
+    const calls = this.#callsOf(definition)
+    return (
+      index >= 0 &&
+      calls.length > 0 &&
+      calls.every((call) => {
+        const argument = call.arguments[index]
+        return argument !== undefined && this.nodeReaches(argument)
+      })
+    )
+  }
+
+  /** The calls, by name, of the function that declares a parameter. */
+  #callsOf(definition) {
+    const fn = definition.node
+    const binding =
+      fn.type === `FunctionDeclaration`
+        ? fn.id
+        : fn.parent.type === `VariableDeclarator`
+          ? fn.parent.id
+          : undefined
+    if (binding?.type !== `Identifier`) return []
+    const variable = this.scopeManager
+      .getDeclaredVariables(fn.type === `FunctionDeclaration` ? fn : fn.parent)
+      .find((declared) => declared.name === binding.name)
+    return (variable?.references ?? [])
+      .map((reference) => reference.identifier.parent)
+      .filter(
+        (call) =>
+          call.type === `CallExpression` &&
+          call.callee.type === `Identifier` &&
+          call.callee.name === binding.name,
+      )
+  }
+
+  /**
+   * A `for...of` loop variable takes each element in turn, and a registration
+   * in the loop registers one test per element, so every element must reach.
+   * The rule reads an array written in the loop or bound to a const name.
+   */
+  #everyElementReaches(iterable, local) {
+    let array = iterable
+    if (array.type === `Identifier`) {
+      const definition = this.resolvedAt.get(array)?.defs[0]
+      array =
+        definition?.type === `Variable` && definition.parent.kind === `const`
+          ? definition.node.init
+          : undefined
+    }
+    return (
+      array?.type === `ArrayExpression` &&
+      array.elements.length > 0 &&
+      array.elements.every(
+        (element) =>
+          element !== null &&
+          element.type !== `SpreadElement` &&
+          this.nodeReaches(element, local),
+      )
+    )
+  }
+
+  #importReaches(source, name) {
+    return importedModuleReaches(this.file, source, name, this.session)
+  }
+
+  /** Whether an export of this module is a declared part, or uses one. */
+  exportReaches(name) {
+    return this.session.search.solve(this.exportReachCache, name, () => {
+      const entry = this.exported.get(name)
+      if (entry?.variable !== undefined)
+        return this.variableReaches(entry.variable, false)
+      if (entry?.node !== undefined) return this.nodeReaches(entry.node, false)
+      if (entry !== undefined)
+        return this.#importReaches(entry.source, entry.imported)
+      // `export *` does not carry a default export.
+      if (name === `default`) return false
+      return this.starSources.some((source) =>
+        this.#importReaches(source, name),
+      )
+    })
+  }
+
+  /**
+   * How an export of this module registers tests, or undefined when it
+   * registers none. A function registers the body that it writes ('own') or
+   * the body that its caller passes ('parameter'). A cycle of re-exports
+   * registers nothing.
+   */
+  registrationShape(name, visiting = new Set()) {
+    const key = `${this.file}\0${name}`
+    if (visiting.has(key)) return undefined
+    visiting.add(key)
+    const entry = this.exported.get(name)
+    if (entry?.variable !== undefined) {
+      const definition = entry.variable.defs[0]
+      const fn =
+        definition?.type === `FunctionName`
+          ? definition.node
+          : definition?.type === `Variable` && isFunction(definition.node.init)
+            ? definition.node.init
+            : undefined
+      return fn === undefined ? undefined : this.#bodyShape(fn)
+    }
+    if (entry?.node !== undefined) {
+      return isFunction(entry.node) ? this.#bodyShape(entry.node) : undefined
+    }
+    if (entry !== undefined) {
+      return importedRegisters(
+        this.file,
+        entry.source,
+        entry.imported,
+        this.session,
+        visiting,
+      )
+    }
+    if (name === `default`) return undefined
+    for (const source of this.starSources) {
+      const shape = importedRegisters(
+        this.file,
+        source,
+        name,
+        this.session,
+        visiting,
+      )
+      if (shape !== undefined) return shape
+    }
+    return undefined
+  }
+
+  /**
+   * The shape of the registrations in a function's body. A registration
+   * registers the caller's body when its body is a parameter of the function,
+   * or of a function that it returns, or when its body is a wrapper written
+   * here that calls such a parameter. The shape records where the caller
+   * passes that body, and whether the wrapper uses a part itself. Any other
+   * registration registers a body that the function writes, which wins.
+   */
+  #bodyShape(fn) {
+    const sourceCode = { getScope: (node) => this.scopeOf(node) }
+    let shape
+    walk(fn, (node) => {
+      if (node.type !== `CallExpression`) return
+      const test = registeredTest(node, sourceCode)
+      if (test === undefined) return
+      const position = this.#passedBody(test.body, fn, sourceCode)
+      if (position === undefined) shape = { kind: `own` }
+      else if (shape?.kind !== `own`) {
+        shape = {
+          kind: `parameter`,
+          ...position,
+          prop: calleeCall(node.callee, `prop`) !== undefined,
+          // Seen from the caller, the helper's parameters reach nothing.
+          wrapperReaches:
+            isFunction(test.body) && this.nodeReaches(test.body, false),
+        }
+      }
+    })
+    return shape
+  }
+
+  /**
+   * Where a registration's body comes from, when its caller passes it: the
+   * body is a parameter of `fn` or of a function inside `fn`, or a wrapper
+   * that calls one. The position is `{ index, level }`: the parameter's index,
+   * and the number of functions from `fn` to the one that declares it.
+   */
+  #passedBody(body, fn, sourceCode) {
+    const positionOf = (identifier) => {
+      const definition = findVariable(
+        sourceCode.getScope(identifier),
+        identifier.name,
+      )?.defs[0]
+      if (definition?.type !== `Parameter`) return undefined
+      const owner = definition.node
+      let level = 0
+      for (let node = owner; node !== fn; node = node.parent) {
+        // A parameter of the wrapper itself, or of a function outside `fn`.
+        if (node === null || node === body) return undefined
+        if (isFunction(node)) level++
+      }
+      return { index: owner.params.indexOf(definition.name), level }
+    }
+    if (body.type === `Identifier`) return positionOf(body)
+    if (!isFunction(body)) return undefined
+    let position
+    walk(body, (node) => {
+      if (
+        position === undefined &&
+        node.type === `CallExpression` &&
+        node.callee.type === `Identifier`
+      ) {
+        position = positionOf(node.callee)
+      }
+    })
+    return position
+  }
+
+  /** The innermost scope of a node, as ESLint's `getScope` finds it. */
+  scopeOf(node) {
+    for (let current = node; current; current = current.parent) {
+      const scope = this.scopeManager.acquire(current, true)
+      if (scope) return scope
+    }
+    return this.scopeManager.globalScope
+  }
+
+  /**
+   * A generated property: `fc.property(...)` or `fc.asyncProperty(...)` from
+   * fast-check, or a `.prop([...])` registration. Its predicate states a law
+   * over inputs that nobody wrote down, so it is its own check. A property
+   * whose arbitraries are all constants checks one written input, so it does
+   * not count.
+   */
+  #isGeneratedProperty(node) {
+    if (node.type !== `CallExpression`) return false
+    const { callee } = node
+    if (callee.type !== `MemberExpression` || callee.computed) return false
+    const name = callee.property.name
+    if (name !== `property` && name !== `asyncProperty`) return false
+    if (!this.#isFastCheck(callee.object)) return false
+    const predicate = node.arguments.at(-1)
+    return (
+      node.arguments
+        .slice(0, -1)
+        .some((value) => !this.#constantArbitrary(value)) &&
+      this.#predicateUsesInput(predicate)
+    )
+  }
+
+  /**
+   * `fc.constant(x)` or `fc.constantFrom(...)`, written here or bound to a
+   * const name. An arbitrary from elsewhere cannot be seen, so it is not one.
+   */
+  #constantArbitrary(value, seen = new Set()) {
+    if (value?.type !== `Identifier`) return isConstant(value)
+    const definition = this.resolvedAt.get(value)?.defs[0]
+    if (
+      definition?.type !== `Variable` ||
+      definition.parent.kind !== `const` ||
+      seen.has(definition.node)
+    ) {
+      return false
+    }
+    seen.add(definition.node)
+    return this.#constantArbitrary(definition.node.init, seen)
+  }
+
+  /**
+   * Whether a property's predicate reads its input. A named predicate is read
+   * at its definition. One passed in as a parameter cannot be seen here, so
+   * it counts.
+   */
+  #predicateUsesInput(predicate) {
+    if (predicate?.type !== `Identifier`) return this.usesInput(predicate)
+    const definition = this.resolvedAt.get(predicate)?.defs[0]
+    if (definition?.type === `FunctionName`)
+      return this.usesInput(definition.node)
+    if (definition?.type === `Variable`)
+      return this.usesInput(definition.node.init)
+    if (definition?.type === `ImportBinding`)
+      return this.#importedFunctionUsesInput(definition) ?? true
+    return true
+  }
+
+  /**
+   * Whether an imported function reads a parameter, read at its definition.
+   * Undefined when the rule cannot load the function, as for a package.
+   */
+  #importedFunctionUsesInput(definition) {
+    const target = importBindingTarget(definition)
+    const file =
+      target === undefined
+        ? undefined
+        : resolveTestModule(this.file, target.source, this.session)
+    const module =
+      file === undefined ? undefined : loadModule(file, this.session)
+    return module?.exportedFunctionUsesInput(target.name)
+  }
+
+  /** Whether an export is a function that reads a parameter; undefined if it is not one. */
+  exportedFunctionUsesInput(name) {
+    const definition = this.exported.get(name)?.variable?.defs[0]
+    if (definition?.type === `FunctionName`)
+      return this.usesInput(definition.node)
+    if (definition?.type === `Variable`)
+      return this.usesInput(definition.node.init)
+    return undefined
+  }
+
+  /** A function that reads at least one of its parameters. */
+  usesInput(fn) {
+    if (!isFunction(fn) && fn?.type !== `FunctionDeclaration`) return false
+    return this.scopeManager
+      .getDeclaredVariables(fn)
+      .some(
+        (variable) =>
+          variable.defs[0]?.type === `Parameter` &&
+          variable.references.length > 0,
+      )
+  }
+
+  /**
+   * Whether a `.prop([...])` registration runs a generated property: some
+   * arbitrary is not a constant, and the test reads its input. A named test
+   * is checked at its definition, and a test passed in as a parameter at
+   * every call of its helper.
+   */
+  propRegistrationGenerates(registration, body, sourceCode) {
+    const prop = calleeCall(registration.callee, `prop`)
+    if (prop === undefined) return false
+    const [arbitraries] = prop.arguments
+    const values =
+      arbitraries?.type === `ArrayExpression`
+        ? arbitraries.elements
+        : arbitraries?.type === `ObjectExpression`
+          ? arbitraries.properties.map((property) => property.value)
+          : undefined
+    // Arbitraries that a caller passes in are not visible here, so only
+    // written-out constants disqualify the registration.
+    if (values?.every((value) => this.#constantArbitrary(value))) return false
+    if (isFunction(body)) return this.usesInput(body)
+    const definition = findVariable(sourceCode.getScope(body), body.name)
+      ?.defs[0]
+    // A named predicate: a function declaration or a const bound to one.
+    if (definition?.type === `FunctionName`)
+      return this.usesInput(definition.node)
+    if (definition?.type === `Variable`)
+      return this.usesInput(definition.node.init)
+    if (definition?.type === `ImportBinding`)
+      return this.#importedFunctionUsesInput(definition) ?? true
+    if (definition?.type !== `Parameter`) return false
+    const calls = this.#callsOf(definition)
+    return (
+      calls.length > 0 &&
+      calls.every((call) => {
+        const index = definition.node.params.indexOf(definition.name)
+        return this.usesInput(call.arguments[index])
+      })
+    )
+  }
+
+  #isFastCheck(node) {
+    const definition =
+      node.type === `Identifier`
+        ? this.resolvedAt.get(node)?.defs[0]
+        : undefined
+    return (
+      definition?.type === `ImportBinding` &&
+      fastCheckModules.has(definition.parent.source.value)
+    )
+  }
+
+  /** Whether code uses a declared part, directly or through a binding. */
+  nodeReaches(node, local = true) {
+    // Code that runs a generated property that it contains.
+    if (containsOffset(this.properties, node)) return true
+    // A type-level test reaches a type model by naming it in a type.
+    if (containsOffset(this.typeModelUses, node)) return true
+    const [start, end] = node.range
+    let low = 0
+    let high = this.references.length
+    while (low < high) {
+      const middle = (low + high) >> 1
+      if (this.references[middle].identifier.range[0] < start) low = middle + 1
+      else high = middle
+    }
+    for (let index = low; index < this.references.length; index++) {
+      const reference = this.references[index]
+      if (reference.identifier.range[0] >= end) break
+      if (this.#referenceReaches(reference, local)) return true
+    }
+    return false
+  }
+
+  /** A use of a namespace member, such as `model.step`, reaches through that export. */
+  #referenceReaches(reference, local) {
+    const member = reference.identifier.parent
+    const definition = reference.resolved.defs[0]
+    if (
+      definition?.type === `ImportBinding` &&
+      definition.node.type === `ImportNamespaceSpecifier` &&
+      member?.type === `MemberExpression` &&
+      member.object === reference.identifier &&
+      !member.computed
+    ) {
+      return this.#importReaches(
+        definition.parent.source.value,
+        member.property.name,
+      )
+    }
+    return this.variableReaches(reference.resolved, local)
+  }
+}
+
+const fastCheckModules = new Set([`fast-check`, `@fast-check/vitest`])
+
+// Methods that put a value into a collection.
+const accumulatorMethods = new Set([`add`, `set`, `push`, `unshift`])
+
+/** `fc.constant(x)` or `fc.constantFrom(...)`: an arbitrary of written values. */
+function isConstant(node) {
+  return (
+    node?.type === `CallExpression` &&
+    node.callee.type === `MemberExpression` &&
+    !node.callee.computed &&
+    [`constant`, `constantFrom`].includes(node.callee.property.name)
+  )
+}
+
+/** The value of a string literal or of a template with no substitutions. */
+function stringValue(node) {
+  if (node?.type === `Literal` && typeof node.value === `string`)
+    return node.value
+  if (node?.type === `TemplateLiteral` && node.expressions.length === 0)
+    return node.quasis[0].value.cooked
+  return undefined
+}
+
+/** Whether a sorted list of start offsets has one inside a node. */
+function containsOffset(offsets, node) {
+  const [start, end] = node.range
+  let low = 0
+  let high = offsets.length
+  while (low < high) {
+    const middle = (low + high) >> 1
+    if (offsets[middle] < start) low = middle + 1
+    else high = middle
+  }
+  return low < offsets.length && offsets[low] < end
+}
+
+function walk(node, visit) {
+  visit(node)
+  for (const [key, child] of Object.entries(node)) {
+    if (key === `parent`) continue
+    for (const item of Array.isArray(child) ? child : [child]) {
+      if (typeof item?.type === `string`) walk(item, visit)
+    }
+  }
+}
+
+/** The `.<name>(...)` call in a registration's callee chain, if any. */
+function calleeCall(callee, name) {
+  for (let node = callee; node;) {
+    if (
+      node.type === `CallExpression` &&
+      node.callee.type === `MemberExpression` &&
+      !node.callee.computed &&
+      node.callee.property.name === name
+    ) {
+      return node
+    }
+    node =
+      node.type === `CallExpression`
+        ? node.callee
+        : node.type === `MemberExpression`
+          ? node.object
+          : undefined
+  }
+  return undefined
+}
+
+/** Whether a function written in an `.each(...)` table uses a declared part. */
+function tableFunctionReaches(module, table) {
+  let reaches = false
+  for (const row of table.arguments) {
+    walk(row, (node) => {
+      if (!reaches && isFunction(node) && module.nodeReaches(node)) {
+        reaches = true
+      }
+    })
+  }
+  return reaches
+}
+
+function isPlaceholder(body) {
+  return (
+    isFunction(body) &&
+    body.body.type === `BlockStatement` &&
+    body.body.body.length === 0
+  )
+}
+
+/**
+ * The test module that a relative specifier names in `fromFile`, as this rule
+ * resolves it: undefined for production source, a package, or a missing file.
+ * The lint selection in scripts/agent-lint-feedback.mjs follows these edges, so
+ * an edit reaches the oracle files that this rule reads.
+ */
+const selectionSession = new LintSession()
+export function resolveImportedTestModule(fromFile, specifier) {
+  return resolveTestModule(fromFile, specifier, selectionSession)
+}
+
+export default {
+  meta: {
+    type: `problem`,
+    docs: {
+      description: `Report tests in oracle files that reach no declared check or model.`,
+    },
+    schema: [],
+    messages: {
+      unitTest: `This test reaches no part that this file declares with declareOracle, so its expected result has no independent source. A unit test belongs in an ordinary test file: move it there. A fixed history runs through the declared check, a model pin uses the declared model, and a grammar calibration uses the declared grammar.`,
+      unknownTypeModel: `This typeModel name is not a type alias or interface in this file. A type model is the expected type that type-level tests compare with, so it must be declared here.`,
+      importedRegistration: `This oracle file calls a helper that registers tests. An oracle file registers only oracle tests, so register those tests from an ordinary test file and keep this file to its checks and model.`,
+      undeclared: `This oracle file registers tests and declares no oracle part. Name its check, model, and grammar with \`declareOracle({ check: [...], model: [...], grammar: [...] })\` from oracle-declaration. Then move each test that reaches none of them to an ordinary test file.`,
+    },
+  },
+  create(context) {
+    // `oracle-config`, `oracle-reach`, and the other `oracle-` modules are the
+    // shared oracle machinery. Their tests check that machinery, not a law.
+    if (basename(context.filename).startsWith(`oracle-`)) return {}
+    const { sourceCode } = context
+    const session = new LintSession()
+    const module = new OracleModule(
+      context.filename,
+      sourceCode.ast,
+      sourceCode.scopeManager,
+      session,
+    )
+    const unreached = []
+    let anyReached = false
+    return {
+      CallExpression(node) {
+        // A curried callee is not a call of its own: the outermost call is the
+        // registration.
+        const outermost = !(
+          node.parent.type === `CallExpression` && node.parent.callee === node
+        )
+        const helper = outermost
+          ? importedHelperShape(node, context.filename, sourceCode, session)
+          : undefined
+        if (helper?.kind === `own`) {
+          context.report({ node, messageId: `importedRegistration` })
+        }
+        if (helper?.kind === `parameter`) {
+          // The helper registers the body its caller passes, so the caller's
+          // body is the test, judged here as a local parameter registration is.
+          if (callerBodyReaches(node, helper, module)) anyReached = true
+          else unreached.push(node)
+          return
+        }
+        const test = registeredTest(node, sourceCode)
+        if (test === undefined || isPlaceholder(test.body)) return
+        // An `.each(table)` row can carry a function that the test body calls,
+        // such as a hostile observation each check must reject. A function in
+        // the table that uses a declared part makes the test use it. Plain
+        // data, such as the grammar's cells, does not: the body must use them.
+        const table =
+          calleeCall(node.callee, `each`) ?? calleeCall(node.callee, `for`)
+        const reaches =
+          module.propRegistrationGenerates(node, test.body, sourceCode) ||
+          (table !== undefined && tableFunctionReaches(module, table)) ||
+          (test.body.type === `Identifier`
+            ? module.variableReaches(
+                findVariable(sourceCode.getScope(test.body), test.body.name),
+              )
+            : module.nodeReaches(test.body))
+        if (reaches) anyReached = true
+        else unreached.push(node)
+      },
+      'Program:exit'() {
+        for (const node of module.unknownTypeModels) {
+          context.report({ node, messageId: `unknownTypeModel` })
+        }
+        // A file that relies on a companion module's declaration declares
+        // nothing itself. It is undeclared only when no test reaches a part.
+        if (!module.declaresParts && !anyReached) {
+          if (unreached.length > 0) {
+            context.report({ node: unreached[0], messageId: `undeclared` })
+          }
+          return
+        }
+        for (const node of unreached) {
+          context.report({ node, messageId: `unitTest` })
+        }
+      },
+    }
+  },
+}
diff --git a/scripts/eslint-plugin-oracle/vitest.config.mjs b/scripts/eslint-plugin-oracle/vitest.config.mjs
new file mode 100644
index 0000000000..d34dfc0940
--- /dev/null
+++ b/scripts/eslint-plugin-oracle/vitest.config.mjs
@@ -0,0 +1,14 @@
+import { dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'vitest/config'
+
+// The lint-rule suites run in Node. They need no coverage and no package
+// setup, so this config stays separate from the packages' configs.
+export default defineConfig({
+  test: {
+    root: dirname(fileURLToPath(import.meta.url)),
+    include: [`*.test.js`],
+    environment: `node`,
+    coverage: { enabled: false },
+  },
+})
diff --git a/scripts/lint-scope-oracle.property.test.js b/scripts/lint-scope-oracle.property.test.js
new file mode 100644
index 0000000000..c22dab834f
--- /dev/null
+++ b/scripts/lint-scope-oracle.property.test.js
@@ -0,0 +1,808 @@
+/**
+ * Law L4 (lint scope): after an edit, every oracle file whose oracle lint result
+ * can change is linted again, by the edit hook, by `pnpm lint:changed`, and by
+ * the pre-commit hook. An oracle file's result depends on the test modules that
+ * it reaches through relative imports and re-exports: its companions, support
+ * modules, drivers, and other oracle files. The rule does not read production
+ * source, so an edit to production code selects nothing. A change to the
+ * rule's own sources changes every oracle result, so it selects every oracle
+ * file. An oracle file is any file in the working tree whose name contains
+ * `oracle`, in TypeScript or JavaScript, tracked or new and untracked: an
+ * agent's new oracle file is linted like any other.
+ *
+ * Authority: AGENTS.md "Lint feedback while you work" says the hooks and
+ * `pnpm lint:changed` return the oracle reports for the files that were edited,
+ * and that the pre-commit hook lints the staged files. AGENTS.md "Name oracle
+ * files for discovery" defines an oracle file by its name. The rule's header
+ * contract (scripts/eslint-plugin-oracle/rules/no-unit-test.js) states that the
+ * rule follows relative imports of test modules and does not follow production
+ * source. The rule-source case follows from the same reports: the oracle
+ * results are a function of the rule's code.
+ *
+ * Limits. The grammar draws up to three oracle files, two or three support
+ * modules, one driver, and one production module, with relative imports and
+ * re-exports. Half the programs take a re-export chain: the first oracle file
+ * imports the first support module, which re-exports the second. An oracle file
+ * is `.ts` or `.js`, and one can be new and untracked. Support modules and
+ * drivers are `.ts`, and only a tracked `.ts` oracle file is imported by another
+ * oracle file, because the rule resolves only TypeScript test modules. The
+ * `.js` specifier form of an import is drawn for some oracle files. Re-exports
+ * are drawn for support modules only, and star re-exports are the only form.
+ * The driver runs the lint command-line script in temporary git repositories.
+ * The pre-commit leg is covered only by the script's file selection: the glob in
+ * lint-staged.config.js is not evaluated here.
+ *
+ * Structure:
+ *   1. The grammar draws a module graph, the edited and untracked modules, and
+ *      the file that an edit hook names.
+ *   2. The model predicts the oracle files to lint for each scope, by a
+ *      fixed-point closure over the graph's edges.
+ *   3. The driver writes the base commit and the edited working tree, then runs
+ *      the CLI's changed scope, its named scope, and its edit-hook form. A
+ *      crashed CLI is a failure, not an empty selection.
+ *   4. The comparison checks that each observed selection equals the prediction.
+ *   5. Reach counts the graph states that the campaign enters, and the
+ *      campaigns run the same predicate with a fixed seed and a random seed.
+ */
+import { execFileSync, spawnSync } from 'node:child_process'
+import {
+  cpSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { setImmediate } from 'node:timers/promises'
+import { fileURLToPath } from 'node:url'
+import fc from 'fast-check'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { declareOracle } from '../packages/db/tests/oracle-declaration.js'
+import {
+  oraclePropertyOptions,
+  oracleRuns,
+} from '../packages/db/tests/oracle-config.js'
+import { createOracleReach } from '../packages/db/tests/oracle-reach.js'
+
+const PROPERTY = `scripts.lint-scope`
+const FIXED_SEED = 2234
+const BASE_RUNS = 24
+const PRODUCTION = `src/prod.ts`
+const repoRoot = fileURLToPath(new URL(`../`, import.meta.url))
+const APP = `packages/app`
+const RULE = `scripts/eslint-plugin-oracle/rules/no-unit-test.js`
+
+// -- 1. Grammar ---------------------------------------------------------------
+//
+// Every module is a node. An oracle file imports supports, drivers, other
+// oracle files, and production. A support module imports other supports and
+// production. A driver imports supports. Production imports nothing. Each
+// target is an index taken modulo the modules the kind may reach, so every draw
+// is a legal edge. A star re-export is an import whose names the module passes
+// on. An edit adds a line to a module, so its text differs from the base
+// commit. An untracked oracle file exists only in the working tree, so nothing
+// imports it. The edit hook names one module, or the rule's source.
+
+const moduleEdit = fc.boolean()
+
+// Most modules import one target. A second route to an edited module would
+// hide the effect of a re-export, so single targets are drawn more often.
+const singleOrManyTargets = fc.oneof(
+  {
+    weight: 3,
+    arbitrary: fc.array(fc.nat({ max: 9 }), { minLength: 1, maxLength: 1 }),
+  },
+  {
+    weight: 1,
+    arbitrary: fc.array(fc.nat({ max: 9 }), { minLength: 1, maxLength: 3 }),
+  },
+)
+
+const programArbitrary = fc
+  .record({
+    // Random draws reach three shapes too rarely, so a share of the programs
+    // take each of them. See the shape functions below.
+    shape: fc.oneof(
+      { weight: 2, arbitrary: fc.constant(`free`) },
+      { weight: 2, arbitrary: fc.constant(`re-export chain`) },
+      { weight: 2, arbitrary: fc.constant(`oracle chain`) },
+      { weight: 1, arbitrary: fc.constant(`untracked dependent`) },
+    ),
+    oracles: fc.array(
+      fc.record({
+        edited: moduleEdit,
+        targets: singleOrManyTargets,
+        style: fc.nat({ max: 1 }),
+        extension: fc.oneof(
+          { weight: 2, arbitrary: fc.constant(`ts`) },
+          { weight: 1, arbitrary: fc.constant(`js`) },
+        ),
+        untracked: fc.oneof(
+          { weight: 3, arbitrary: fc.constant(false) },
+          { weight: 1, arbitrary: fc.constant(true) },
+        ),
+      }),
+      { minLength: 1, maxLength: 3 },
+    ),
+    // Two supports or more let a chain form, and a single target keeps a
+    // re-export on the only route to an edited module.
+    supports: fc.array(
+      fc.record({
+        edited: moduleEdit,
+        targets: singleOrManyTargets,
+        reexport: fc.array(
+          fc.oneof(
+            { weight: 3, arbitrary: fc.constant(true) },
+            { weight: 1, arbitrary: fc.constant(false) },
+          ),
+          { minLength: 1, maxLength: 2 },
+        ),
+      }),
+      { minLength: 2, maxLength: 3 },
+    ),
+    driver: fc.record({
+      present: fc.boolean(),
+      edited: moduleEdit,
+      targets: fc.array(fc.nat({ max: 9 }), { maxLength: 2 }),
+    }),
+    production: fc.record({ edited: moduleEdit }),
+    ruleEdited: fc.oneof(
+      { weight: 3, arbitrary: fc.constant(false) },
+      { weight: 1, arbitrary: fc.constant(true) },
+    ),
+    // The edit hook names a module of this kind, or the rule's source.
+    hookKind: fc.oneof(
+      { weight: 2, arbitrary: fc.constant(`oracle`) },
+      { weight: 2, arbitrary: fc.constant(`support`) },
+      { weight: 2, arbitrary: fc.constant(`driver`) },
+      { weight: 1, arbitrary: fc.constant(`production`) },
+      { weight: 2, arbitrary: fc.constant(`rule`) },
+    ),
+    hookIndex: fc.nat({ max: 9 }),
+  })
+  .map(({ shape, ...skeleton }) => {
+    const drawn =
+      skeleton.hookKind === `driver`
+        ? { ...skeleton, driver: { ...skeleton.driver, present: true } }
+        : skeleton
+    return buildProgram(shapes[shape](drawn))
+  })
+
+const shapes = {
+  free: (skeleton) => skeleton,
+  're-export chain': reexportChain,
+  'oracle chain': oracleChain,
+  'untracked dependent': untrackedDependent,
+}
+
+/** The skeleton's first two oracle files, adding a second when there is one. */
+function twoOracles(skeleton) {
+  const [first, second = first] = skeleton.oracles
+  return [first, second, ...skeleton.oracles.slice(2)]
+}
+
+/**
+ * The skeleton with the re-export chain drawn: oracle 0 imports support 0, which
+ * re-exports support 1. Oracle 0 and support 0 are unedited and support 1 is
+ * edited, so the re-export is the only route from the edit to oracle 0.
+ */
+function reexportChain(skeleton) {
+  return {
+    ...skeleton,
+    oracles: skeleton.oracles.map((oracle, index) =>
+      index === 0
+        ? { ...oracle, edited: false, untracked: false, targets: [0] }
+        : oracle,
+    ),
+    supports: skeleton.supports.map((support, index) => {
+      if (index === 0) {
+        return { ...support, edited: false, targets: [1], reexport: [true] }
+      }
+      if (index === 1) return { ...support, edited: true }
+      return support
+    }),
+  }
+}
+
+/**
+ * The skeleton with an oracle chain drawn: oracle 1 imports only oracle 0, which
+ * imports the edited support 0. The other oracle file is the only route from
+ * the edit to oracle 1.
+ */
+function oracleChain(skeleton) {
+  const [first, second, ...rest] = twoOracles(skeleton)
+  return {
+    ...skeleton,
+    oracles: [
+      {
+        ...first,
+        extension: `ts`,
+        untracked: false,
+        edited: false,
+        targets: [0],
+      },
+      {
+        ...second,
+        untracked: false,
+        edited: false,
+        fixedTargets: [`case-0-oracle.test.ts`],
+      },
+      ...rest,
+    ],
+    supports: skeleton.supports.map((support, index) =>
+      index === 0 ? { ...support, edited: true } : support,
+    ),
+  }
+}
+
+/**
+ * The skeleton with an untracked dependent drawn: oracle 1 is new and untracked
+ * and imports support 0, which the edit hook names.
+ */
+function untrackedDependent(skeleton) {
+  const [first, second, ...rest] = twoOracles(skeleton)
+  return {
+    ...skeleton,
+    oracles: [
+      first,
+      { ...second, untracked: true, fixedTargets: [`support-0.ts`] },
+      ...rest,
+    ],
+    hookName: `support-0.ts`,
+  }
+}
+
+/**
+ * The modules of a program, with the import edges that the grammar drew. A
+ * re-export is an edge that the module passes on by star export. A shape can
+ * fix a module's targets by name.
+ */
+function buildProgram(skeleton) {
+  const oracles = skeleton.oracles.map((oracle, index) => ({
+    // The rule skips basenames that start with `oracle-`, which are its own
+    // machinery, so generated oracle files use another prefix.
+    name: `case-${index}-oracle.test.${oracle.extension}`,
+    kind: `oracle`,
+    untracked: oracle.untracked,
+    // An untracked file is new, so it has no separate edit.
+    edited: oracle.edited && !oracle.untracked,
+    style: oracle.style,
+    targets: oracle.targets,
+    fixedTargets: oracle.fixedTargets,
+  }))
+  const supports = skeleton.supports.map((support, index) => ({
+    name: `support-${index}.ts`,
+    kind: `support`,
+    untracked: false,
+    edited: support.edited,
+    targets: support.targets,
+    reexport: support.reexport,
+  }))
+  const driver = skeleton.driver.present
+    ? [
+        {
+          name: `driver.test.ts`,
+          kind: `driver`,
+          untracked: false,
+          edited: skeleton.driver.edited,
+          targets: skeleton.driver.targets,
+          reexport: [],
+        },
+      ]
+    : []
+  const production = {
+    name: PRODUCTION,
+    kind: `production`,
+    untracked: false,
+    edited: skeleton.production.edited,
+    targets: [],
+    reexport: [],
+  }
+  const test = [...oracles, ...supports, ...driver]
+  // Only a tracked TypeScript oracle file can be imported by another one.
+  const importableOracles = oracles.filter(
+    (oracle) => !oracle.untracked && oracle.name.endsWith(`.ts`),
+  )
+  const allowed = {
+    oracle: [...supports, ...driver, ...importableOracles, production],
+    support: [...supports, production],
+    driver: [...supports],
+  }
+  const edges = new Map()
+  const reexports = new Map()
+  const byName = new Map(
+    [...test, production].map((module) => [module.name, module]),
+  )
+  for (const module of test) {
+    const targets = allowed[module.kind]
+    const chosen = (module.fixedTargets ?? []).map((name) => ({
+      target: byName.get(name),
+      reexport: false,
+    }))
+    for (const [position, index] of module.fixedTargets
+      ? []
+      : module.targets.entries()) {
+      if (targets.length === 0) break
+      const target = targets[index % targets.length]
+      if (chosen.some((edge) => edge.target === target) || target === module) {
+        continue
+      }
+      chosen.push({ target, reexport: module.reexport?.[position] === true })
+    }
+    edges.set(
+      module.name,
+      chosen.map((edge) => edge.target.name),
+    )
+    reexports.set(
+      module.name,
+      new Set(
+        chosen.filter((edge) => edge.reexport).map((edge) => edge.target.name),
+      ),
+    )
+  }
+  edges.set(production.name, [])
+  reexports.set(production.name, new Set())
+  const modules = [...oracles, ...supports, ...driver, production]
+  const ofKind = modules.filter((module) => module.kind === skeleton.hookKind)
+  const hookTarget =
+    skeleton.hookName ??
+    (ofKind.length === 0
+      ? RULE
+      : ofKind[skeleton.hookIndex % ofKind.length].name)
+  return {
+    oracles,
+    supports,
+    driver,
+    production,
+    ruleEdited: skeleton.ruleEdited,
+    edges,
+    reexports,
+    modules,
+    hookTarget,
+  }
+}
+
+/**
+ * The files that each scope treats as edited. The changed scope sees every
+ * edited tracked module and every untracked file. The named scope, which the
+ * pre-commit hook runs, sees the files it is given: the edited tracked modules.
+ * It runs only when there is one: the hook never runs it without files.
+ * The edit hook sees the one file that the hook input names.
+ */
+function editedByScope(program) {
+  const tracked = program.modules
+    .filter((module) => module.edited)
+    .map((module) => module.name)
+  const untracked = program.modules
+    .filter((module) => module.untracked)
+    .map((module) => module.name)
+  const rule = program.ruleEdited ? [RULE] : []
+  return {
+    changed: [...tracked, ...untracked, ...rule],
+    named: [...tracked, ...rule],
+    hook: [program.hookTarget],
+  }
+}
+
+// -- 2. Model -----------------------------------------------------------------
+//
+// The model reads only the graph. It grows the set of affected modules to a
+// fixed point: an edited test module is affected, and so is every module with
+// an edge into an affected module. Production is never affected, because the
+// rule never reads it, so an edge into production carries nothing. The oracle
+// files in the affected set are the ones to lint. When the edited files
+// include the rule's own source, every oracle file must be linted.
+
+/** The oracle files that a lint of `edited` must cover, as sorted basenames. */
+function predictSelected(program, edited) {
+  if (edited.includes(RULE))
+    return program.oracles.map((oracle) => oracle.name).sort()
+  const affected = new Set(edited.filter((name) => name !== PRODUCTION))
+  let grew = true
+  while (grew) {
+    grew = false
+    for (const [from, targets] of program.edges) {
+      if (affected.has(from)) continue
+      if (targets.some((target) => affected.has(target))) {
+        affected.add(from)
+        grew = true
+      }
+    }
+  }
+  return program.oracles
+    .filter((oracle) => affected.has(oracle.name))
+    .map((oracle) => oracle.name)
+    .sort()
+}
+
+// -- 3. Driver ----------------------------------------------------------------
+//
+// The driver runs the lint script that a developer or hook runs. It writes the
+// modules and the copy of the script and the rule into a temporary repository,
+// commits the tracked modules, edits them in the working tree, and writes the
+// untracked oracle files. It runs the changed scope (`lint:changed`), the named
+// scope (the pre-commit hook), and the edit hook in that one repository: the
+// hook selects from the file its input names, not from the working tree's
+// edits. Each report line names its oracle file. The driver reads those names;
+// it does not compute them. An exit status or stderr that is not a report is a
+// failed run, so a crashed script cannot pass as an empty selection.
+
+/** The text of one module, with or without its edit. */
+function moduleText(program, module, edited) {
+  const lines = []
+  const reexported = program.reexports.get(module.name) ?? new Set()
+  for (const target of program.edges.get(module.name) ?? []) {
+    const spec =
+      target === PRODUCTION
+        ? `../src/prod.js`
+        : `./${target.replace(/\.ts$/, module.kind === `oracle` && module.style === 1 ? `.js` : ``)}`
+    lines.push(
+      reexported.has(target) ? `export * from '${spec}'` : `import '${spec}'`,
+    )
+  }
+  if (module.kind === `oracle`) {
+    lines.push(`it('reads one value', () => { expect(1).toBe(1) })`)
+  }
+  if (module.kind === `production`) lines.push(`export const prod = 1`)
+  if (edited) lines.push(`// edited`)
+  return `${lines.join(`\n`)}\n`
+}
+
+let work
+let pluginDir
+let feedbackScript
+let runCountScript
+
+beforeAll(() => {
+  // Each run has its own directory, so concurrent runs cannot remove each
+  // other's repositories. The real path keeps the file names that the driver
+  // passes in the spelling that the script's repository root uses.
+  work = realpathSync(mkdtempSync(join(tmpdir(), `lint-scope-oracle-`)))
+  pluginDir = join(repoRoot, `scripts`, `eslint-plugin-oracle`)
+  // A mutant is run from a copy: LINT_SCOPE_SCRIPT names the copy under test.
+  feedbackScript =
+    process.env.LINT_SCOPE_SCRIPT ??
+    join(repoRoot, `scripts`, `agent-lint-feedback.mjs`)
+  runCountScript = join(repoRoot, `scripts`, `check-oracle-run-counts.mjs`)
+})
+
+afterAll(() => {
+  rmSync(work, { recursive: true, force: true })
+})
+
+/** Writes the base files, commits them, then writes the edited working tree. */
+function repositoryOf(program) {
+  const directory = mkdtempSync(join(work, `r`))
+  const git = (...args) =>
+    execFileSync(
+      `git`,
+      [
+        `-c`,
+        `user.name=oracle`,
+        `-c`,
+        `user.email=oracle@example.invalid`,
+        ...args,
+      ],
+      {
+        cwd: directory,
+        encoding: `utf8`,
+        stdio: [`ignore`, `pipe`, `pipe`],
+      },
+    )
+  git(`init`, `-q`, `-b`, `main`)
+  writeFileSync(
+    join(directory, `package.json`),
+    // The repository's root is an ES module package, as here.
+    JSON.stringify({ name: `root`, type: `module` }),
+  )
+  mkdirSync(join(directory, APP, `tests`), { recursive: true })
+  mkdirSync(join(directory, APP, `src`), { recursive: true })
+  writeFileSync(
+    join(directory, APP, `package.json`),
+    JSON.stringify({ name: `app` }),
+  )
+  // The plugin's sources, without its tests: its own oracle file would be an
+  // oracle file of this repository too.
+  cpSync(pluginDir, join(directory, `scripts`, `eslint-plugin-oracle`), {
+    recursive: true,
+    filter: (source) => !source.endsWith(`.test.js`),
+  })
+  writeFileSync(
+    join(directory, `scripts`, `agent-lint-feedback.mjs`),
+    readFileSync(feedbackScript, `utf8`),
+  )
+  writeFileSync(
+    join(directory, `scripts`, `check-oracle-run-counts.mjs`),
+    readFileSync(runCountScript, `utf8`),
+  )
+  const pathOf = (name) =>
+    name === RULE
+      ? join(directory, RULE)
+      : name === PRODUCTION
+        ? join(directory, APP, `src`, `prod.ts`)
+        : join(directory, APP, `tests`, name)
+  for (const module of program.modules) {
+    if (!module.untracked)
+      writeFileSync(pathOf(module.name), moduleText(program, module, false))
+  }
+  git(`add`, `-A`)
+  git(`commit`, `-q`, `-m`, `base`)
+  symlinkSync(join(repoRoot, `node_modules`), join(directory, `node_modules`))
+  for (const module of program.modules) {
+    if (module.edited || module.untracked)
+      writeFileSync(pathOf(module.name), moduleText(program, module, true))
+  }
+  if (program.ruleEdited) {
+    const rule = pathOf(RULE)
+    writeFileSync(rule, `${readFileSync(rule, `utf8`)}\n// edited\n`)
+  }
+  return { directory, pathOf }
+}
+
+const lintLine = /^(\S+?):\d+:\d+ .* \((oracle\/[\w-]+|parse)\)$/
+const budgetLine = /^\S+: .+: run budget (lowered|removed) /
+
+/** The oracle basenames in a report's lint lines. */
+function reportedOracles(lines) {
+  const found = new Set()
+  for (const line of lines) {
+    const match = lintLine.exec(line)
+    if (match !== null) found.add(match[1].split(`/`).pop())
+  }
+  return [...found].sort()
+}
+
+/**
+ * Runs the CLI and returns the oracle files that it reported. In text format
+ * the CLI exits 0 with no output, or 1 with report lines on stderr. As a
+ * Claude edit hook it exits 0 with no output, or 2 with a report on stderr.
+ * Anything else, such as a crash, which exits 1 with a stack trace, fails.
+ */
+function runCli(directory, args, input) {
+  const result = spawnSync(
+    process.execPath,
+    [`scripts/agent-lint-feedback.mjs`, ...args],
+    { cwd: directory, encoding: `utf8`, input },
+  )
+  const lines = result.stderr.split(`\n`).filter(Boolean)
+  const hook = args.includes(`--format=claude`)
+  const reported = hook ? 2 : 1
+  const valid =
+    result.stdout === `` &&
+    (result.status === 0
+      ? lines.length === 0
+      : result.status === reported &&
+        (hook
+          ? lines[0]?.startsWith(`Oracle lint reports`)
+          : lines.every(
+              (line) => lintLine.test(line) || budgetLine.test(line),
+            )))
+  if (!valid) {
+    throw new Error(`cli failed (exit ${result.status}):\n${result.stderr}`)
+  }
+  return reportedOracles(lines)
+}
+
+/** The oracle files that each scope lints, from one repository. */
+function observedSelections(program) {
+  const { directory, pathOf } = repositoryOf(program)
+  try {
+    const scopes = editedByScope(program)
+    const changed = runCli(directory, [`--format=text`])
+    // lint-staged runs the named scope once per nonempty chunk of staged
+    // files; without files the script runs its changed scope instead.
+    const named =
+      scopes.named.length === 0
+        ? undefined
+        : runCli(directory, [
+            `--format=text`,
+            ...scopes.named.map((name) => pathOf(name)),
+          ])
+    const input = JSON.stringify({
+      tool_input: { file_path: pathOf(program.hookTarget) },
+    })
+    const hook = runCli(directory, [`--format=claude`, `--event=edit`], input)
+    return { changed, named, hook }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
+
+// -- 4. Comparison ------------------------------------------------------------
+//
+// Each observed selection must equal the model's prediction for its scope, as
+// sorted basenames. The check reports the first oracle file that the script
+// linted or missed, so a failure names the oracle file whose lint scope
+// diverged.
+
+/** Each observation equals the model's prediction, as sorted basenames. */
+function compareSelected(observed, expected) {
+  expect(observed).toEqual(expected)
+}
+
+// -- 5. Reach -----------------------------------------------------------------
+//
+// The states below are coverage of the graph, not a second model. A path is a
+// simple path of imports from one oracle file. A state counts once per history:
+//   direct-dependent: a one-import path from an oracle file to an edited module.
+//   transitive-dependent: a longer path of test modules to an edited module.
+//   re-export-dependent: a re-export decides the selection: without the
+//     re-export edges, the model selects fewer oracle files.
+//   oracle-dependent: an oracle file reaches an edited module only through
+//     another oracle file.
+//   oracle-edit: an oracle file that is itself edited.
+//   unrelated-edit: an edited test module that no oracle file reaches.
+//   production-boundary: an edited production module that an oracle file reaches.
+//   rule-edit: the rule's sources changed, so every oracle file is selected.
+//   untracked-dependent: an untracked oracle file reaches the hook's file.
+//   js-oracle: a JavaScript oracle file is selected.
+//   hook-oracle, hook-support, hook-driver, hook-production, hook-rule: the
+//     kind of file that the edit hook names.
+
+const STATES = [
+  `direct-dependent`,
+  `transitive-dependent`,
+  `re-export-dependent`,
+  `oracle-dependent`,
+  `oracle-edit`,
+  `unrelated-edit`,
+  `production-boundary`,
+  `rule-edit`,
+  `untracked-dependent`,
+  `js-oracle`,
+  `hook-oracle`,
+  `hook-support`,
+  `hook-driver`,
+  `hook-production`,
+  `hook-rule`,
+]
+const reach = createOracleReach(PROPERTY, STATES, { minimum: 2 })
+
+/** Every simple path of imports from `start`, as its list of modules. */
+function pathsFrom(program, start) {
+  const found = []
+  const walk = (node, nodes) => {
+    for (const target of program.edges.get(node) ?? []) {
+      if (nodes.includes(target)) continue
+      const path = [...nodes, target]
+      found.push(path)
+      if (target !== PRODUCTION) walk(target, path)
+    }
+  }
+  walk(start, [start])
+  return found
+}
+
+/** The program with some edges removed. */
+function withoutEdges(program, drop) {
+  return {
+    ...program,
+    edges: new Map(
+      [...program.edges].map(([from, targets]) => [
+        from,
+        targets.filter((target) => !drop(from, target)),
+      ]),
+    ),
+  }
+}
+
+/** Marks the states that the program enters. */
+function recordStates(program) {
+  reach.beginHistory()
+  const states = new Set()
+  const { changed, hook } = editedByScope(program)
+  const edited = new Set(changed)
+  if (program.ruleEdited) states.add(`rule-edit`)
+  const reached = new Set()
+  for (const oracle of program.oracles) {
+    if (oracle.edited) states.add(`oracle-edit`)
+    for (const path of pathsFrom(program, oracle.name)) {
+      for (const node of path) reached.add(node)
+      const end = path.at(-1)
+      if (!edited.has(end)) continue
+      if (end === PRODUCTION) {
+        states.add(`production-boundary`)
+        continue
+      }
+      states.add(
+        path.length === 2 ? `direct-dependent` : `transitive-dependent`,
+      )
+    }
+  }
+  const selected = predictSelected(program, changed).length
+  const oracleNames = new Set(program.oracles.map((oracle) => oracle.name))
+  if (
+    predictSelected(
+      withoutEdges(program, (from, target) =>
+        program.reexports.get(from)?.has(target),
+      ),
+      changed,
+    ).length < selected
+  )
+    states.add(`re-export-dependent`)
+  if (
+    predictSelected(
+      withoutEdges(program, (_, target) => oracleNames.has(target)),
+      changed,
+    ).length < selected
+  )
+    states.add(`oracle-dependent`)
+  for (const module of program.modules) {
+    const testModule = module.kind !== `production` && module.kind !== `oracle`
+    if (module.edited && testModule && !reached.has(module.name)) {
+      states.add(`unrelated-edit`)
+    }
+  }
+  const hookSelected = new Set(predictSelected(program, hook))
+  if (
+    program.oracles.some(
+      (oracle) =>
+        oracle.untracked &&
+        oracle.name !== program.hookTarget &&
+        hookSelected.has(oracle.name),
+    )
+  )
+    states.add(`untracked-dependent`)
+  if (
+    program.oracles.some(
+      (oracle) =>
+        oracle.name.endsWith(`.js`) &&
+        predictSelected(program, changed).includes(oracle.name),
+    )
+  )
+    states.add(`js-oracle`)
+  const target = program.modules.find(
+    (module) => module.name === program.hookTarget,
+  )
+  states.add(`hook-${target?.kind ?? `rule`}`)
+  for (const state of states) reach.reach(state)
+}
+
+function campaign(name) {
+  // A history runs its child processes synchronously, so the predicate yields
+  // between complete histories: the test worker then answers its progress
+  // messages, and a long campaign cannot time out the worker's RPC channel.
+  const predicate = async (program) => {
+    await setImmediate()
+    recordStates(program)
+    const observed = observedSelections(program)
+    const scopes = editedByScope(program)
+    compareSelected(observed.changed, predictSelected(program, scopes.changed))
+    if (observed.named !== undefined)
+      compareSelected(observed.named, predictSelected(program, scopes.named))
+    compareSelected(observed.hook, predictSelected(program, scopes.hook))
+  }
+  it(`${name}: fixed-seed campaign`, async () => {
+    await fc.assert(fc.asyncProperty(programArbitrary, predicate), {
+      numRuns: oracleRuns(BASE_RUNS),
+      seed: FIXED_SEED,
+    })
+  }, 1_200_000)
+  it(`${name}: random-seed campaign`, async () => {
+    await fc.assert(
+      fc.asyncProperty(programArbitrary, predicate),
+      oraclePropertyOptions(BASE_RUNS, PROPERTY),
+    )
+  }, 1_200_000)
+}
+
+describe(`lint selection after an edit`, () => {
+  campaign(`changed, named, and edit-hook scopes`)
+  // Every declared state must be entered by the campaigns above.
+  afterAll(() => {
+    if (process.env.TANSTACK_DB_ORACLE_REACH_REPORT)
+      console.log(`REACH`, JSON.stringify([...reach.counts()]))
+    reach.assertReached()
+  })
+})
+
+// The declaration names the parts above. It runs nothing, so it follows them.
+declareOracle({
+  model: [predictSelected],
+  check: [compareSelected],
+  grammar: [programArbitrary],
+})
diff --git a/scripts/oracle-scripts.vitest.config.mjs b/scripts/oracle-scripts.vitest.config.mjs
new file mode 100644
index 0000000000..ef22215112
--- /dev/null
+++ b/scripts/oracle-scripts.vitest.config.mjs
@@ -0,0 +1,14 @@
+import { dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'vitest/config'
+
+// Generated oracles beside the repository scripts. They run in Node, with no
+// coverage and no package setup.
+export default defineConfig({
+  test: {
+    root: dirname(fileURLToPath(import.meta.url)),
+    include: [`*.property.test.js`],
+    environment: `node`,
+    coverage: { enabled: false },
+  },
+})
diff --git a/scripts/run-budget-oracle.property.test.js b/scripts/run-budget-oracle.property.test.js
new file mode 100644
index 0000000000..2363642755
--- /dev/null
+++ b/scripts/run-budget-oracle.property.test.js
@@ -0,0 +1,637 @@
+/**
+ * Law (L5): every run budget that an oracle property uses is tracked by
+ * scripts/check-oracle-run-counts.mjs, wherever it is written. A budget is the
+ * numRuns of a fixed-seed campaign, or the run count of a registered property.
+ * When the branch lowers a budget, or removes it from every tracked oracle
+ * file, the script reports it, so the change is visible to the reviewer.
+ *
+ * A budget belongs to the oracle file that uses it: its own campaigns, and the
+ * campaigns and constants in the test modules that it imports or re-exports.
+ * Moving a budget between those places keeps it tracked. So does moving it to
+ * another tracked oracle file. A budget is removed when its key is in no
+ * tracked oracle file at head: it was deleted, or moved into an ordinary test
+ * file that no oracle file imports.
+ *
+ * Authority: AGENTS.md "Lint feedback while you work" names a lowered budget
+ * as a shortcut that the oracle pass hides, and the run-count script is the
+ * tripwire for it. docs/contributing/oracle-rubric.md ORC-007 requires the same
+ * property, generators, and budget in each campaign. The removal rule is the
+ * maintainer's decision of 2026-10-27: a key present in a tracked oracle file
+ * at base and in no tracked oracle file at head is reported as removed, and a
+ * move into an imported support module is not a removal. The script's header
+ * states the key and value forms that it reads.
+ *
+ * Limits. The grammar builds one oracle file, up to two support modules, an
+ * ordinary test file, and a second oracle file, with at most three budgets. A
+ * key is unique to its budget, except that a fixed seed can be shared with an
+ * unrelated campaign in the second oracle file. Then the removal law treats
+ * the seed as still present, and the model follows it. Star re-exports are not
+ * generated. A count may be wrapped in oracleRuns. The model judges the
+ * reported budget, its base value, and its head value or removal; it does not
+ * predict the wording of a line.
+ *
+ * Structure:
+ *   1. The grammar draws budgets: their form, the places their count and key
+ *      are written, where the campaign is at base, and where it is at head.
+ *   2. The model predicts the lowered and removed budgets from those draws.
+ *   3. The driver writes both versions into a temporary git repository and runs
+ *      the script's command-line report there, with a copy of the script under
+ *      test. A crashed script is a failure, not an empty report.
+ *   4. The comparison checks that the report equals the prediction.
+ */
+import { execFile } from 'node:child_process'
+import {
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { promisify } from 'node:util'
+import fc from 'fast-check'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { declareOracle } from '../packages/db/tests/oracle-declaration.js'
+import {
+  oraclePropertyOptions,
+  oracleRuns,
+} from '../packages/db/tests/oracle-config.js'
+import { createOracleReach } from '../packages/db/tests/oracle-reach.js'
+
+declareOracle({
+  model: [predictReport],
+  check: [compareReport],
+  grammar: [programArbitrary],
+})
+
+const PROPERTY = `scripts.run-budget`
+const FIXED_SEED = 2234
+const BASE_RUNS = 20
+const repoRoot = fileURLToPath(new URL(`../`, import.meta.url))
+const OTHER_ORACLE = `tests/other-oracle.test.ts`
+const ORDINARY = `tests/ordinary.test.ts`
+// A base oracle file above the default 1 MiB child-process buffer. Reading it
+// at the base commit must not be mistaken for a missing file.
+const LARGE_PADDING = 1_100_000
+
+// -- 1. Grammar ---------------------------------------------------------------
+//
+// A budget's count is written inline, in support module A, or in A and passed
+// on by support module B's re-export. Its key is inline or imported from A. A
+// change edits the count where it is defined, or writes a literal at the call.
+// The campaign itself is in the oracle file or in A at base (`callAt`). At
+// head it stays, moves between the oracle file and A, moves to the ordinary
+// file or the second oracle file, or is deleted (`fate`). The oracle file and
+// A are `.ts` or `.js`; an import names A with or without the `.js` suffix.
+
+const budgetSkeleton = fc.record({
+  form: fc.constantFrom(`property`, `seed`),
+  source: fc.constantFrom(`inline`, `imported`, `reexported`),
+  keySource: fc.constantFrom(`inline`, `imported`),
+  wrapped: fc.boolean(),
+  base: fc.nat({ max: 398 }).map((n) => n + 2),
+  // Lowering, and editing the definition, are the cases that the law is about,
+  // so the grammar draws them more often.
+  change: fc.oneof(
+    { weight: 3, arbitrary: fc.constant(`lower`) },
+    { weight: 1, arbitrary: fc.constant(`raise`) },
+    { weight: 1, arbitrary: fc.constant(`keep`) },
+  ),
+  delta: fc.nat({ max: 50 }).map((n) => n + 1),
+  editAt: fc.oneof(
+    { weight: 3, arbitrary: fc.constant(`definition`) },
+    { weight: 1, arbitrary: fc.constant(`call`) },
+  ),
+  callAt: fc.oneof(
+    { weight: 2, arbitrary: fc.constant(`oracle`) },
+    { weight: 1, arbitrary: fc.constant(`support`) },
+  ),
+  fate: fc.oneof(
+    { weight: 4, arbitrary: fc.constant(`stay`) },
+    { weight: 1, arbitrary: fc.constant(`swap`) },
+    { weight: 2, arbitrary: fc.constant(`remove`) },
+    { weight: 2, arbitrary: fc.constant(`ordinary`) },
+    { weight: 2, arbitrary: fc.constant(`other-oracle`) },
+  ),
+  sharedSeed: fc.boolean(),
+})
+
+const fileForms = fc.record({
+  oracleExtension: fc.oneof(
+    { weight: 2, arbitrary: fc.constant(`ts`) },
+    { weight: 1, arbitrary: fc.constant(`js`) },
+  ),
+  supportExtension: fc.oneof(
+    { weight: 2, arbitrary: fc.constant(`ts`) },
+    { weight: 1, arbitrary: fc.constant(`js`) },
+  ),
+  jsSpecifier: fc.boolean(),
+  large: fc.oneof(
+    { weight: 2, arbitrary: fc.constant(false) },
+    { weight: 1, arbitrary: fc.constant(true) },
+  ),
+  // The second oracle file exists at base, or is new and untracked at head.
+  otherNew: fc.boolean(),
+})
+
+/** Feature gates: which count sources a campaign may draw. */
+const ALL = [`inline`, `imported`, `reexported`]
+
+function programArbitrary(sources, supportOnly = false) {
+  return fc
+    .record({
+      budgets: fc.array(budgetSkeleton, { minLength: 1, maxLength: 3 }),
+      files: fileForms,
+    })
+    .map(({ budgets, files }) => ({
+      files: resolveFiles(files),
+      budgets: budgets.map((budget, index) =>
+        resolveBudget(
+          supportOnly ? supportOnlyBudget(budget) : budget,
+          index,
+          sources,
+          files,
+        ),
+      ),
+    }))
+}
+
+/**
+ * A budget whose only edit lives in a support module: its count is imported
+ * or re-exported, its campaign stays in the oracle file, and the edit is at
+ * the count's definition, so the oracle file stays the same.
+ */
+function supportOnlyBudget(skeleton) {
+  return {
+    ...skeleton,
+    source: skeleton.source === `inline` ? `reexported` : skeleton.source,
+    editAt: `definition`,
+    callAt: `oracle`,
+    fate: `stay`,
+  }
+}
+
+function resolveFiles(files) {
+  return {
+    ...files,
+    oracle: `tests/case-oracle.test.${files.oracleExtension}`,
+    support: `tests/support-a.${files.supportExtension}`,
+    reexport: `tests/support-b.ts`,
+  }
+}
+
+/**
+ * A budget with its index, its values before and after the change, and the
+ * places the grammar drew, restricted to the allowed count sources.
+ */
+function resolveBudget(skeleton, index, sources, files) {
+  const source = sources.includes(skeleton.source) ? skeleton.source : `inline`
+  const headValue =
+    skeleton.change === `lower`
+      ? Math.max(1, skeleton.base - skeleton.delta)
+      : skeleton.change === `raise`
+        ? skeleton.base + skeleton.delta
+        : skeleton.base
+  return {
+    index,
+    form: skeleton.form,
+    source,
+    keySource: skeleton.keySource,
+    wrapped: skeleton.wrapped,
+    before: skeleton.base,
+    after: headValue,
+    changed: headValue !== skeleton.base,
+    // An inline count is always written at the call, so it changes there.
+    // An imported count changes at its definition, or as a literal at the call.
+    changedAt: source === `inline` ? `call` : skeleton.editAt,
+    callAt: skeleton.callAt,
+    fate: skeleton.fate,
+    // A shared seed is an unrelated campaign in the second oracle file, at
+    // base and at head. The budget's own campaign never moves there, and the
+    // file is not new: a campaign that appears with the key at head is a move.
+    sharedSeed:
+      skeleton.form === `seed` &&
+      skeleton.sharedSeed &&
+      skeleton.fate !== `other-oracle` &&
+      !files.otherNew,
+    key:
+      skeleton.form === `property`
+        ? `property budget.${skeleton.keySource === `imported` ? `q` : `p`}${index}`
+        : `fixed seed ${1000 + index}`,
+  }
+}
+
+// -- 2. Model -----------------------------------------------------------------
+//
+// The model reads the draws, not the files. Every budget starts in the oracle
+// file's scope: its campaign is in the oracle file or in a module that the
+// oracle file imports. A budget that is deleted, or moved into the ordinary
+// file, leaves every tracked oracle file, so it is reported as removed, unless
+// its fixed seed is still written in the second oracle file. A budget that
+// stays, moves between the oracle file and its support module, or moves to the
+// second oracle file is still tracked, and it is reported when its count went
+// down. Each line names the oracle file that used the budget at base.
+
+/** The reported budgets, as sorted `file|key|before|after-or-removed` strings. */
+function predictReport(program) {
+  const lines = []
+  for (const budget of program.budgets) {
+    const leaves = budget.fate === `remove` || budget.fate === `ordinary`
+    if (leaves) {
+      if (!budget.sharedSeed) {
+        lines.push(
+          `${program.files.oracle}|${budget.key}|${budget.before}|removed`,
+        )
+      }
+    } else if (budget.after < budget.before) {
+      lines.push(
+        `${program.files.oracle}|${budget.key}|${budget.before}|${budget.after}`,
+      )
+    }
+  }
+  return lines.sort()
+}
+
+// -- 3. Driver ----------------------------------------------------------------
+//
+// The driver renders every file at base and at head, commits the base files,
+// and writes the head files into the working tree, as an edit leaves them. A
+// second oracle file that is new at head stays untracked. It runs the script's
+// command-line report with a copy of the script under test, and reads the
+// report lines back into the model's form.
+
+/** Where a budget's campaign is at a revision, or undefined when it is gone. */
+function campaignFile(program, budget, revision) {
+  const { files } = program
+  const atBase = budget.callAt === `oracle` ? files.oracle : files.support
+  if (revision === `base`) return atBase
+  switch (budget.fate) {
+    case `stay`:
+      return atBase
+    case `swap`:
+      return atBase === files.oracle ? files.support : files.oracle
+    case `ordinary`:
+      return ORDINARY
+    case `other-oracle`:
+      return OTHER_ORACLE
+    default:
+      return undefined
+  }
+}
+
+/** A module's source text, collected as imports, then body lines. */
+class ModuleText {
+  #imports = new Map()
+  #lines = []
+
+  import(specifier, name) {
+    if (!this.#imports.has(specifier)) this.#imports.set(specifier, new Set())
+    this.#imports.get(specifier).add(name)
+  }
+
+  line(text) {
+    this.#lines.push(text)
+  }
+
+  render(padding = 0) {
+    const imports = [...this.#imports].map(
+      ([specifier, names]) =>
+        `import { ${[...names].join(`, `)} } from '${specifier}'`,
+    )
+    const pad = padding > 0 ? [`// ${`x`.repeat(padding)}`] : []
+    return `${[...imports, ...this.#lines, ...pad].join(`\n`)}\n`
+  }
+}
+
+/** The base or head text of every file in a program. */
+function renderFiles(program, revision) {
+  const { files } = program
+  const isHead = revision === `head`
+  const supportSpecifier = files.jsSpecifier ? `./support-a.js` : `./support-a`
+  const modules = new Map(
+    [files.oracle, files.support, files.reexport, ORDINARY].map((file) => [
+      file,
+      new ModuleText(),
+    ]),
+  )
+  const otherPresent = !files.otherNew || isHead
+  if (otherPresent) modules.set(OTHER_ORACLE, new ModuleText())
+  const support = modules.get(files.support)
+  const reexported = []
+
+  for (const budget of program.budgets) {
+    const i = budget.index
+    const host = campaignFile(program, budget, revision)
+    const count = isHead ? budget.after : budget.before
+    const seed = 1000 + i
+    // The definition of an imported key and count lives in support module A.
+    if (budget.keySource === `imported`) {
+      support.line(
+        budget.form === `property`
+          ? `export const PROP_${i} = 'budget.q${i}'`
+          : `export const SEED_${i} = ${seed}`,
+      )
+    }
+    const literalAtCall =
+      budget.source === `inline` ||
+      (isHead && budget.changed && budget.changedAt === `call`)
+    if (!literalAtCall) {
+      const defined =
+        isHead && budget.changed && budget.changedAt === `definition`
+          ? budget.after
+          : budget.before
+      support.line(`export const RUNS_${i} = ${defined}`)
+      if (budget.source === `reexported`) reexported.push(`RUNS_${i}`)
+    }
+    // An unrelated campaign in the second oracle file that shares the seed.
+    if (budget.sharedSeed) {
+      modules
+        .get(OTHER_ORACLE)
+        .line(
+          `fc.assert(fc.property(fc.integer(), () => undefined), { numRuns: 7, seed: ${seed} })`,
+        )
+    }
+    if (host === undefined) continue
+    const hostText = modules.get(host)
+    const inSupport = host === files.support
+    const fromHost = (file) =>
+      file === files.support ? supportSpecifier : `./support-b`
+    // A campaign in A reads A's own constants; elsewhere it imports them.
+    const use = (name, file) => {
+      if (!inSupport) hostText.import(fromHost(file), name)
+      return name
+    }
+    const countText = literalAtCall
+      ? `${count}`
+      : budget.source === `reexported` && !inSupport
+        ? use(`RUNS_${i}`, files.reexport)
+        : use(`RUNS_${i}`, files.support)
+    const runs = budget.wrapped ? `oracleRuns(${countText})` : countText
+    const keyText =
+      budget.keySource === `imported`
+        ? use(
+            budget.form === `property` ? `PROP_${i}` : `SEED_${i}`,
+            files.support,
+          )
+        : budget.form === `property`
+          ? `'budget.p${i}'`
+          : `${seed}`
+    const call =
+      budget.form === `property`
+        ? `export const opts${i} = oraclePropertyOptions(${runs}, ${keyText})`
+        : `export function campaign${i}() { fc.assert(fc.property(fc.integer(), () => undefined), { numRuns: ${runs}, seed: ${keyText} }) }`
+    hostText.line(call)
+    // The oracle file uses a campaign in A by importing it.
+    if (inSupport) {
+      modules
+        .get(files.oracle)
+        .import(
+          supportSpecifier,
+          budget.form === `property` ? `opts${i}` : `campaign${i}`,
+        )
+    }
+  }
+  if (reexported.length > 0) {
+    modules
+      .get(files.reexport)
+      .line(`export { ${reexported.join(`, `)} } from '${supportSpecifier}'`)
+  }
+  const rendered = new Map()
+  for (const [file, text] of modules) {
+    rendered.set(
+      file,
+      text.render(file === files.oracle && files.large ? LARGE_PADDING : 0),
+    )
+  }
+  return rendered
+}
+
+let work
+let scriptText
+
+beforeAll(() => {
+  // Each run has its own directory, so concurrent runs cannot remove each
+  // other's repositories.
+  work = mkdtempSync(join(tmpdir(), `run-budget-oracle-`))
+  // A mutant is run from a copy: RUN_BUDGET_SCRIPT names the copy under test.
+  scriptText = readFileSync(
+    process.env.RUN_BUDGET_SCRIPT ??
+      join(repoRoot, `scripts`, `check-oracle-run-counts.mjs`),
+    `utf8`,
+  )
+})
+
+afterAll(() => {
+  rmSync(work, { recursive: true, force: true })
+})
+
+// Child processes run asynchronously so a long campaign never blocks the
+// test worker's event loop.
+const run = promisify(execFile)
+
+const loweredLine = /^(.+?): (.+): run budget lowered from (\d+) to (\d+)$/
+const removedLine = /^(.+?): (.+): run budget removed \(was (\d+)\)$/
+
+/**
+ * The script's report as model lines. The script exits 0 with no output when
+ * it reports nothing, and 1 with one line per budget when it reports. Any
+ * other outcome, including a crash, which also exits 1, fails the driver.
+ */
+function reportLines({ code, stdout, stderr }) {
+  if (stderr !== `` || (code !== 0 && code !== 1)) {
+    throw new Error(`script failed (exit ${code}):\n${stderr}`)
+  }
+  const lines = stdout.split(`\n`).filter(Boolean)
+  if ((code === 1) !== lines.length > 0) {
+    throw new Error(`exit ${code} does not match report:\n${stdout}`)
+  }
+  return lines
+    .map((line) => {
+      const lowered = loweredLine.exec(line)
+      if (lowered !== null) {
+        const [, file, key, was, now] = lowered
+        return `${file}|${key}|${was}|${now}`
+      }
+      const removed = removedLine.exec(line)
+      if (removed !== null) {
+        const [, file, key, was] = removed
+        return `${file}|${key}|${was}|removed`
+      }
+      throw new Error(`unexpected report line: ${line}`)
+    })
+    .sort()
+}
+
+/**
+ * Runs the script in a fresh repository whose base commit holds the base files
+ * and whose working tree holds the head files. Returns the reported budgets.
+ */
+async function reportOf(program) {
+  const directory = mkdtempSync(join(work, `r`))
+  const git = (...args) =>
+    run(
+      `git`,
+      [
+        `-c`,
+        `user.name=oracle`,
+        `-c`,
+        `user.email=oracle@example.invalid`,
+        ...args,
+      ],
+      { cwd: directory, encoding: `utf8` },
+    )
+  const write = (files) => {
+    for (const [file, text] of files) {
+      mkdirSync(join(directory, file, `..`), { recursive: true })
+      writeFileSync(join(directory, file), text)
+    }
+  }
+  try {
+    await git(`init`, `-q`, `-b`, `main`)
+    mkdirSync(join(directory, `scripts`))
+    writeFileSync(
+      join(directory, `scripts`, `check-oracle-run-counts.mjs`),
+      scriptText,
+    )
+    write(renderFiles(program, `base`))
+    await git(`add`, `-A`)
+    await git(`commit`, `-q`, `-m`, `base`)
+    // The dependencies are linked after the commit, so they are not tracked.
+    symlinkSync(join(repoRoot, `node_modules`), join(directory, `node_modules`))
+    write(renderFiles(program, `head`))
+    const result = await run(
+      process.execPath,
+      [`scripts/check-oracle-run-counts.mjs`, `--format=text`],
+      { cwd: directory, encoding: `utf8`, maxBuffer: 64 * 1024 * 1024 },
+    ).then(
+      ({ stdout, stderr }) => ({ code: 0, stdout, stderr }),
+      (error) => {
+        if (typeof error.code !== `number`) throw error
+        return { code: error.code, stdout: error.stdout, stderr: error.stderr }
+      },
+    )
+    return reportLines(result)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
+
+// -- 4. Comparison ------------------------------------------------------------
+
+/** The script's report equals the model's prediction, as sorted lists. */
+function compareReport(actual, expected) {
+  expect(actual).toEqual(expected)
+}
+
+// -- 5. Reach -----------------------------------------------------------------
+//
+// The states that the laws above depend on. A state counts once per history.
+
+const STATES = [
+  `imported-count`,
+  `re-exported-count`,
+  `imported-key`,
+  `support-only-change`,
+  `oracle-and-support-change`,
+  `lowered-budget`,
+  `campaign-in-support`,
+  `moved-into-support`,
+  `removed-budget`,
+  `moved-to-ordinary`,
+  `moved-to-oracle`,
+  `moved-to-untracked-oracle`,
+  `shared-seed-kept`,
+  `large-base-file`,
+  `js-oracle`,
+  `js-support`,
+]
+const reach = createOracleReach(PROPERTY, STATES, { minimum: 1 })
+
+/** Marks the states that the program enters. */
+function recordStates(program) {
+  reach.beginHistory()
+  const states = new Set()
+  const { files } = program
+  for (const budget of program.budgets) {
+    if (budget.source === `imported`) states.add(`imported-count`)
+    if (budget.source === `reexported`) states.add(`re-exported-count`)
+    if (budget.keySource === `imported`) states.add(`imported-key`)
+    if (budget.after < budget.before) states.add(`lowered-budget`)
+    if (budget.callAt === `support`) states.add(`campaign-in-support`)
+    if (budget.callAt === `oracle` && budget.fate === `swap`) {
+      states.add(`moved-into-support`)
+    }
+    if (budget.fate === `remove`) states.add(`removed-budget`)
+    if (budget.fate === `ordinary`) states.add(`moved-to-ordinary`)
+    if (budget.fate === `other-oracle`) {
+      states.add(
+        files.otherNew ? `moved-to-untracked-oracle` : `moved-to-oracle`,
+      )
+    }
+    if (
+      budget.sharedSeed &&
+      (budget.fate === `remove` || budget.fate === `ordinary`)
+    ) {
+      states.add(`shared-seed-kept`)
+    }
+  }
+  const atCall = program.budgets.some(
+    (budget) => budget.changed && budget.changedAt === `call`,
+  )
+  const atDefinition = program.budgets.some(
+    (budget) => budget.changed && budget.changedAt === `definition`,
+  )
+  if (atDefinition && !atCall) states.add(`support-only-change`)
+  if (atDefinition && atCall) states.add(`oracle-and-support-change`)
+  if (files.large) states.add(`large-base-file`)
+  if (files.oracleExtension === `js`) states.add(`js-oracle`)
+  if (files.supportExtension === `js`) states.add(`js-support`)
+  for (const state of states) reach.reach(state)
+}
+
+// Each campaign has its own fixed seed, so the four campaigns do not draw the
+// same programs. The fixed options are written where the campaign is named, so
+// the run-count script tracks each budget.
+function campaign(name, sources, fixed, supportOnly = false) {
+  const arbitrary = programArbitrary(sources, supportOnly)
+  const predicate = async (program) => {
+    recordStates(program)
+    compareReport(await reportOf(program), predictReport(program))
+  }
+  it(`${name}: fixed-seed campaign`, async () => {
+    await fc.assert(fc.asyncProperty(arbitrary, predicate), fixed)
+  }, 900_000)
+  it(`${name}: random-seed campaign`, async () => {
+    await fc.assert(
+      fc.asyncProperty(arbitrary, predicate),
+      oraclePropertyOptions(BASE_RUNS, PROPERTY),
+    )
+  }, 900_000)
+}
+
+describe(`run budgets that the run-count script tracks`, () => {
+  campaign(`inline and imported counts`, [`inline`, `imported`], {
+    seed: FIXED_SEED,
+    numRuns: oracleRuns(BASE_RUNS),
+  })
+  campaign(`re-exported counts`, [`reexported`], {
+    seed: 2235,
+    numRuns: oracleRuns(BASE_RUNS),
+  })
+  campaign(`every source`, ALL, { seed: 2236, numRuns: oracleRuns(BASE_RUNS) })
+  campaign(
+    `support-only edits`,
+    [`imported`, `reexported`],
+    { seed: 2237, numRuns: oracleRuns(BASE_RUNS) },
+    true,
+  )
+  // Every declared state must be entered by the campaigns above.
+  afterAll(() => {
+    if (process.env.TANSTACK_DB_ORACLE_REACH_REPORT)
+      console.log(`REACH`, JSON.stringify([...reach.counts()]))
+    reach.assertReached()
+  })
+})